From 680845cb1ce337d29ad21295b53ccd05fa2679c2 Mon Sep 17 00:00:00 2001 From: wehub-resource-sync Date: Mon, 13 Jul 2026 12:25:30 +0800 Subject: [PATCH] chore: import upstream snapshot with attribution --- .github/ISSUE_TEMPLATE/01-bug.yml | 71 + .github/ISSUE_TEMPLATE/02-feature.yml | 24 + .github/ISSUE_TEMPLATE/config.yml | 5 + .github/workflows/build-test-images.yml | 77 + .../containerization-build-template.yml | 130 + .github/workflows/containerization-build.yml | 53 + .github/workflows/docs-release.yaml | 46 + .github/workflows/linux-build.yml | 60 + .github/workflows/release.yml | 57 + .gitignore | 28 + .spi.yml | 5 + .swift-format | 68 + .swift-format-nolint | 68 + .swift-version | 1 + CLAUDE.md | 91 + CONTRIBUTING.md | 116 + LICENSE | 202 + MAINTAINERS.txt | 26 + Makefile | 448 ++ Package.resolved | 249 + Package.swift | 337 + Protobuf.Makefile | 55 + README.md | 196 + README.wehub.md | 7 + SECURITY.md | 13 + Sources/CShim/capability.c | 32 + Sources/CShim/cz_tap.c | 78 + Sources/CShim/exec_command.c | 393 + Sources/CShim/include/capability.h | 28 + Sources/CShim/include/cz_tap.h | 39 + Sources/CShim/include/exec_command.h | 56 + Sources/CShim/include/linux_shim.h | 32 + Sources/CShim/include/openat2.h | 37 + Sources/CShim/include/prctl.h | 33 + Sources/CShim/include/socket_helpers.h | 29 + Sources/CShim/include/vsock.h | 33 + Sources/CShim/openat2.c | 33 + Sources/CShim/prctl.c | 47 + Sources/CShim/socket_helpers.c | 33 + Sources/CShim/vsock.c | 19 + .../CloudHypervisor+Client.swift | 169 + .../CloudHypervisor+Error.swift | 27 + Sources/CloudHypervisor/CloudHypervisor.swift | 17 + .../Endpoints/Client+Hotplug.swift | 55 + .../CloudHypervisor/Endpoints/Client+VM.swift | 61 + .../Endpoints/Client+VMM.swift | 40 + Sources/CloudHypervisor/HTTPOverUDS.swift | 202 + Sources/CloudHypervisor/README.md | 95 + .../CloudHypervisor/Types/DeviceConfigs.swift | 242 + Sources/CloudHypervisor/Types/VmConfig.swift | 187 + Sources/CloudHypervisor/Types/VmInfo.swift | 122 + .../Containerization/AttachedFilesystem.swift | 53 + Sources/Containerization/BridgeManager.swift | 399 + .../Containerization/BridgeStateFile.swift | 75 + .../Containerization/CHHotplugProvider.swift | 422 + .../CHInstanceExtension.swift | 46 + Sources/Containerization/CHInterface.swift | 68 + Sources/Containerization/CHProcess.swift | 211 + .../CHVirtualMachineInstance.swift | 753 ++ .../CHVirtualMachineManager.swift | 149 + Sources/Containerization/Container.swift | 27 + .../Containerization/ContainerManager.swift | 383 + .../ContainerStatistics.swift | 248 + .../Containerization/DNSConfiguration.swift | 91 + Sources/Containerization/ExitStatus.swift | 36 + Sources/Containerization/FileMount.swift | 202 + Sources/Containerization/Hash.swift | 40 + .../Containerization/HostDefaultRoute.swift | 68 + .../Containerization/HostsConfiguration.swift | 140 + .../Containerization/HotplugProvider.swift | 56 + .../Containerization/IO/ReaderStream.swift | 22 + .../IO/Terminal+ReaderStream.swift | 36 + Sources/Containerization/IO/Writer.swift | 23 + Sources/Containerization/Image/Image.swift | 130 + .../Image/ImageStore/ImageStore+Export.swift | 179 + .../Image/ImageStore/ImageStore+Import.swift | 257 + .../ImageStore/ImageStore+OCILayout.swift | 110 + .../ImageStore+ReferenceManager.swift | 90 + .../Image/ImageStore/ImageStore.swift | 395 + .../Containerization/Image/InitImage.swift | 85 + .../Containerization/Image/KernelImage.swift | 94 + .../Image/Unpacker/EXT4Unpacker.swift | 169 + .../Image/Unpacker/Unpacker.swift | 40 + Sources/Containerization/Interface.swift | 46 + Sources/Containerization/IptablesRules.swift | 106 + .../Containerization/Kernel+Commandline.swift | 50 + Sources/Containerization/Kernel.swift | 101 + .../LinuxBridgedNetwork.swift | 181 + Sources/Containerization/LinuxContainer.swift | 1531 ++++ Sources/Containerization/LinuxPod.swift | 1335 ++++ Sources/Containerization/LinuxProcess.swift | 485 ++ .../LinuxProcessConfiguration.swift | 457 ++ Sources/Containerization/Mount+CH.swift | 80 + Sources/Containerization/Mount.swift | 452 ++ Sources/Containerization/NATInterface.swift | 42 + .../NATNetworkInterface.swift | 84 + Sources/Containerization/Network.swift | 21 + .../SandboxContext/SandboxContext.grpc.swift | 6833 +++++++++++++++++ .../SandboxContext/SandboxContext.pb.swift | 4704 ++++++++++++ .../SandboxContext/SandboxContext.proto | 493 ++ .../Containerization/SandboxOverrides.swift | 100 + Sources/Containerization/Signal.swift | 302 + Sources/Containerization/SystemPlatform.swift | 41 + Sources/Containerization/TAPDevice.swift | 155 + Sources/Containerization/TimeSyncer.swift | 87 + .../UnixSocketConfiguration.swift | 70 + .../Containerization/UnixSocketRelay.swift | 243 + .../UnixSocketRelayManager.swift | 73 + .../Containerization/VMConfiguration.swift | 103 + .../VZVirtualMachine+Helpers.swift | 152 + .../VZVirtualMachineInstance.swift | 587 ++ .../VZVirtualMachineManager.swift | 84 + .../Containerization/VirtiofsdProcess.swift | 187 + .../VirtualMachineAgent+Additions.swift | 22 + .../VirtualMachineAgent+Interface.swift | 84 + .../VirtualMachineAgent.swift | 110 + .../VirtualMachineInstance.swift | 121 + .../VirtualMachineManager.swift | 20 + .../Containerization/Vminitd+Rosetta.swift | 35 + .../Vminitd+SocketRelay.swift | 47 + Sources/Containerization/Vminitd.swift | 646 ++ Sources/Containerization/VmnetNetwork.swift | 302 + Sources/Containerization/Vsock+Linux.swift | 158 + Sources/Containerization/VsockListener.swift | 101 + .../ArchiveError.swift | 103 + .../ArchiveReader.swift | 428 ++ .../ArchiveWriter.swift | 339 + .../ArchiveWriterConfiguration.swift | 200 + .../ContainerizationArchive/CArchive/COPYING | 65 + .../CArchive/archive_swift_bridge.c | 68 + .../CArchive/include/archive.h | 1214 +++ .../CArchive/include/archive_bridge.h | 12 + .../CArchive/include/archive_entry.h | 731 ++ Sources/ContainerizationArchive/TempDir.swift | 34 + .../ContainerizationArchive/WriteEntry.swift | 318 + .../Documentation.docc/ext4.md | 4 + .../EXT4+Extensions.swift | 97 + .../ContainerizationEXT4/EXT4+FileTree.swift | 101 + .../ContainerizationEXT4/EXT4+Formatter.swift | 1414 ++++ .../ContainerizationEXT4/EXT4+Journal.swift | 197 + Sources/ContainerizationEXT4/EXT4+Ptr.swift | 36 + .../ContainerizationEXT4/EXT4+Reader.swift | 277 + Sources/ContainerizationEXT4/EXT4+Types.swift | 633 ++ .../ContainerizationEXT4/EXT4+Xattrs.swift | 317 + Sources/ContainerizationEXT4/EXT4.swift | 354 + .../EXT4Reader+Export.swift | 215 + .../ContainerizationEXT4/EXT4Reader+IO.swift | 495 ++ .../FilePath+Extensions.swift | 113 + .../ContainerizationEXT4/FileTimestamps.swift | 67 + .../Formatter+Unpack.swift | 255 + .../Integer+Extensions.swift | 131 + Sources/ContainerizationEXT4/README.md | 4 + .../UnsafeLittleEndianBytes.swift | 78 + .../ContainerizationError.swift | 176 + .../AddressAllocator.swift | 65 + .../ContainerizationExtras/AddressError.swift | 66 + .../ContainerizationExtras/AsyncLock.swift | 61 + .../ContainerizationExtras/AsyncMutex.swift | 59 + Sources/ContainerizationExtras/CIDR.swift | 148 + Sources/ContainerizationExtras/CIDRv4.swift | 122 + Sources/ContainerizationExtras/CIDRv6.swift | 115 + .../FileManager+Temporary.swift | 29 + .../ContainerizationExtras/IPAddress.swift | 148 + .../ContainerizationExtras/IPv4Address.swift | 250 + .../IPv6Address+Parse.swift | 333 + .../ContainerizationExtras/IPv6Address.swift | 270 + .../IndexedAddressAllocator.swift | 127 + .../ContainerizationExtras/MACAddress.swift | 275 + .../NetworkAddress+Allocator.swift | 108 + .../NetworkConfiguration.swift | 57 + Sources/ContainerizationExtras/Prefix.swift | 88 + .../ProgressEvent.swift | 51 + .../ContainerizationExtras/ProxyUtils.swift | 77 + .../RotatingAddressAllocator.swift | 124 + Sources/ContainerizationExtras/TLSUtils.swift | 39 + Sources/ContainerizationExtras/Timeout.swift | 67 + .../UInt8+DataBinding.swift | 100 + Sources/ContainerizationIO/ReadStream.swift | 133 + .../NetlinkSession.swift | 1006 +++ .../NetlinkSocket.swift | 141 + Sources/ContainerizationNetlink/Types.swift | 889 +++ .../ContainerizationOCI/AnnotationKeys.swift | 24 + Sources/ContainerizationOCI/Bundle.swift | 146 + .../Client/Authentication.swift | 50 + .../Client/KeychainHelper.swift | 142 + .../Client/LocalOCILayoutClient.swift | 242 + .../Client/RegistryClient+Catalog.swift | 85 + .../Client/RegistryClient+Error.swift | 69 + .../Client/RegistryClient+Fetch.swift | 237 + .../Client/RegistryClient+Push.swift | 181 + .../Client/RegistryClient+Referrers.swift | 91 + .../Client/RegistryClient+Token.swift | 210 + .../Client/RegistryClient.swift | 306 + .../Content/AsyncTypes.swift | 56 + .../ContainerizationOCI/Content/Content.swift | 59 + .../Content/ContentStoreProtocol.swift | 67 + .../Content/ContentWriter.swift | 137 + .../Content/LocalContent.swift | 78 + .../Content/LocalContentStore.swift | 230 + .../Content/SHA256+Extensions.swift | 32 + .../Content/String+Extension.swift | 26 + .../Content/URL+Extensions.swift | 36 + Sources/ContainerizationOCI/Descriptor.swift | 62 + .../FileManager+Size.swift | 31 + Sources/ContainerizationOCI/ImageConfig.swift | 173 + Sources/ContainerizationOCI/Index.swift | 64 + Sources/ContainerizationOCI/Manifest.swift | 57 + Sources/ContainerizationOCI/MediaType.swift | 67 + Sources/ContainerizationOCI/Platform.swift | 340 + Sources/ContainerizationOCI/Reference.swift | 285 + Sources/ContainerizationOCI/Spec.swift | 939 +++ Sources/ContainerizationOCI/State.swift | 82 + Sources/ContainerizationOCI/Version.swift | 34 + .../AsyncSignalHandler.swift | 112 + .../BinaryInteger+Extensions.swift | 49 + Sources/ContainerizationOS/Command.swift | 338 + Sources/ContainerizationOS/File.swift | 144 + .../FileDescriptorOps.swift | 346 + Sources/ContainerizationOS/FilePathOps.swift | 38 + .../Keychain/KeychainQuery.swift | 243 + .../Keychain/RegistryInfo.swift | 33 + Sources/ContainerizationOS/Linux/Binfmt.swift | 109 + .../Linux/Capabilities.swift | 670 ++ Sources/ContainerizationOS/Linux/Epoll.swift | 189 + Sources/ContainerizationOS/Mount/Mount.swift | 410 + .../POSIXError+Helpers.swift | 38 + Sources/ContainerizationOS/Path.swift | 88 + Sources/ContainerizationOS/Pipe+Close.swift | 43 + Sources/ContainerizationOS/README.md | 3 + Sources/ContainerizationOS/Reaper.swift | 60 + .../Socket/BidirectionalRelay.swift | 419 + .../ContainerizationOS/Socket/Socket.swift | 494 ++ .../Socket/SocketType.swift | 48 + .../ContainerizationOS/Socket/UnixType.swift | 160 + .../ContainerizationOS/Socket/VsockType.swift | 108 + Sources/ContainerizationOS/Stat.swift | 88 + Sources/ContainerizationOS/Syscall.swift | 39 + Sources/ContainerizationOS/Sysctl.swift | 39 + Sources/ContainerizationOS/Terminal.swift | 209 + .../ContainerizationOS/URL+Extensions.swift | 71 + Sources/ContainerizationOS/User.swift | 284 + Sources/Integration/ContainerTests.swift | 5675 ++++++++++++++ Sources/Integration/NBDServer.swift | 383 + Sources/Integration/PodTests.swift | 2224 ++++++ Sources/Integration/PodVolumeTests.swift | 857 +++ Sources/Integration/Suite.swift | 686 ++ Sources/cctl/BridgeCommand.swift | 95 + Sources/cctl/ImageCommand.swift | 302 + Sources/cctl/KernelCommand.swift | 81 + Sources/cctl/LoginCommand.swift | 85 + Sources/cctl/RootfsCommand.swift | 180 + Sources/cctl/RunCommand.swift | 533 ++ Sources/cctl/cctl+Utils.swift | 53 + Sources/cctl/cctl.swift | 88 + Tests/CloudHypervisorTests/ClientTests.swift | 506 ++ Tests/CloudHypervisorTests/ErrorsTests.swift | 35 + .../CloudHypervisorTests/StubHTTPServer.swift | 203 + Tests/CloudHypervisorTests/TypesTests.swift | 328 + .../ArchiveReaderTests.swift | 714 ++ .../ArchiveTests.swift | 837 ++ .../Resources/test.tar.zst | Bin 0 -> 445 bytes ...8b12473d712b7c40666a1462118dae3c403676afc2 | 21 + ...1ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 | Bin 0 -> 32 bytes ...125afe0060b020e89275ced2e729eda7d4eeff62a2 | 1 + ...642410858489b743c97233b0a26a5e2098b1443762 | 1 + ...b997cc1d30cda01e38005a6c6625fd9c7e748bab44 | Bin 0 -> 3333361 bytes .../TestEXT4ExtendedAttributes.swift | 114 + .../TestEXT4Format+Create.swift | 80 + .../TestEXT4Format+Link.swift | 79 + .../TestEXT4Format+Unlink.swift | 232 + .../TestEXT4Format.swift | 262 + .../TestEXT4Journal.swift | 166 + .../TestEXT4Reader+IO.swift | 652 ++ .../TestEXT4Unpacker.swift | 105 + .../TestFormatterUnpack.swift | 514 ++ .../AsyncLockTests.swift | 112 + .../AsyncMutexTests.swift | 132 + .../ProxyUtilsTests.swift | 122 + .../TestCIDR.swift | 374 + .../TestIPAddress.swift | 237 + .../TestIPv4Address.swift | 494 ++ .../TestIPv6Address+Parse.swift | 734 ++ .../TestIPv6Address.swift | 274 + .../TestIPv6IPv4Parsing.swift | 131 + .../TestMACAddress.swift | 405 + .../TestNetworkAddress+Allocator.swift | 248 + .../TestPrefix.swift | 155 + .../TestTimeout.swift | 57 + .../UInt8+DataBindingTest.swift | 456 ++ .../MockNetlinkSocket.swift | 57 + .../NetlinkSessionTest.swift | 665 ++ .../TypesTest.swift | 221 + .../AuthChallengeTests.swift | 58 + .../ContentWriterTests.swift | 119 + .../LocalContentStoreTests.swift | 66 + .../OCIImageTests.swift | 164 + .../OCIPlatformTests.swift | 84 + .../OCISpecTests.swift | 168 + .../ReferenceTests.swift | 118 + .../RegistryClientTests.swift | 366 + .../BidirectionalRelayTests.swift | 345 + .../ContainerizationOSTests/EpollTests.swift | 300 + .../FileDescriptorOpsTests.swift | 898 +++ .../FilePathOpsTests.swift | 43 + .../KeychainQueryTests.swift | 83 + .../ContainerizationOSTests/SocketTests.swift | 126 + Tests/ContainerizationOSTests/UserTests.swift | 153 + .../AllocatorTests.swift | 170 + .../BridgeStateFileTests.swift | 60 + .../CHInterfaceTests.swift | 69 + .../ContainerManagerTests.swift | 157 + Tests/ContainerizationTests/DNSTests.swift | 84 + Tests/ContainerizationTests/HashTests.swift | 38 + .../HostDefaultRouteTests.swift | 66 + Tests/ContainerizationTests/HostsTests.swift | 68 + Tests/ContainerizationTests/ImageTests.swift | 37 + .../ImageTests/ContainsAuth.swift | 38 + .../ImageTests/ExportOperationTests.swift | 120 + .../ImageTests/HeaderScanTimingTests.swift | 176 + .../ImageTests/ImageStoreImagePullTests.swift | 175 + .../ImageTests/ImageStoreTests.swift | 130 + .../ImageTests/Resources/scratch.tar | Bin 0 -> 19968 bytes .../Resources/scratch_no_annotations.tar | Bin 0 -> 55296 bytes .../InterfaceTests.swift | 59 + Tests/ContainerizationTests/KernelTests.swift | 93 + .../LinuxContainerTests.swift | 122 + .../ContainerizationTests/MountCHTests.swift | 72 + Tests/ContainerizationTests/MountTests.swift | 357 + .../TAPNameDerivationTests.swift | 59 + .../TestImages/dockermanifestimage/Dockerfile | 5 + Tests/TestImages/emptyimage/Dockerfile | 4 + assets/Containerization-Logo.png | Bin 0 -> 49266 bytes docs/single-file-mounts.md | 55 + docs/x86_64-build.md | 228 + examples/README.md | 14 + examples/ctr-example/Makefile | 47 + examples/ctr-example/Package.resolved | 267 + examples/ctr-example/Package.swift | 45 + examples/ctr-example/README.md | 48 + .../Sources/ctr-example/main.swift | 84 + examples/ctr-example/ctr-example.entitlements | 8 + examples/ctr-example/lab.md | 58 + examples/sandboxy/Makefile | 38 + examples/sandboxy/Package.resolved | 249 + examples/sandboxy/Package.swift | 57 + examples/sandboxy/README.md | 374 + .../Sources/sandboxy/AgentDefinition.swift | 243 + .../Sources/sandboxy/CacheCommand.swift | 263 + .../Sources/sandboxy/ConfigCommand.swift | 170 + .../Sources/sandboxy/EditCommand.swift | 245 + .../sandboxy/Sources/sandboxy/HostProxy.swift | 460 ++ .../Sources/sandboxy/InstanceState.swift | 120 + .../Sources/sandboxy/KernelManager.swift | 153 + .../Sources/sandboxy/ListCommand.swift | 94 + .../Sources/sandboxy/OutputCapture.swift | 47 + .../Sources/sandboxy/ProgressUI.swift | 70 + .../Sources/sandboxy/RemoveCommand.swift | 69 + .../Sources/sandboxy/RunAgentCommand.swift | 1000 +++ .../sandboxy/Sources/sandboxy/Sandboxy.swift | 101 + .../Sources/sandboxy/SandboxyConfig.swift | 81 + .../Sources/sandboxy/SandboxyError.swift | 52 + .../TerminalProgress/Int+Formatted.swift | 52 + .../TerminalProgress/Int64+Formatted.swift | 36 + .../TerminalProgress/ProgressBar+Add.swift | 236 + .../TerminalProgress/ProgressBar+State.swift | 100 + .../ProgressBar+Terminal.swift | 95 + .../TerminalProgress/ProgressBar.swift | 362 + .../TerminalProgress/ProgressConfig.swift | 170 + .../ProgressTaskCoordinator.swift | 72 + .../TerminalProgress/ProgressTheme.swift | 37 + .../TerminalProgress/ProgressUpdate.swift | 41 + .../TerminalProgress/StandardError.swift | 25 + examples/sandboxy/sandboxy.entitlements | 8 + images/linux-dev/Dockerfile | 132 + images/linux-dev/wrappers/x86_64-linux-gnu-ar | 2 + .../linux-dev/wrappers/x86_64-linux-gnu-g++ | 24 + .../linux-dev/wrappers/x86_64-linux-gnu-gcc | 31 + images/linux-dev/wrappers/x86_64-linux-gnu-ld | 9 + .../wrappers/x86_64-linux-gnu-ranlib | 2 + .../linux-dev/wrappers/x86_64-linux-gnu-strip | 2 + .../linux-dev/wrappers/x86_64-linux-musl-ar | 2 + .../linux-dev/wrappers/x86_64-linux-musl-g++ | 14 + .../linux-dev/wrappers/x86_64-linux-musl-gcc | 14 + .../wrappers/x86_64-linux-musl-ranlib | 2 + .../wrappers/x86_64-linux-musl-strip | 2 + kernel/Makefile | 74 + kernel/README.md | 24 + kernel/build.sh | 50 + kernel/config-arm64 | 4201 ++++++++++ kernel/config-x86_64 | 3650 +++++++++ kernel/image/Dockerfile | 30 + kernel/image/sources.list | 15 + licenserc.toml | 27 + scripts/build-dist-x86_64.sh | 243 + scripts/build-glibc-x86_64-deps.sh | 138 + scripts/build-musl-x86_64-deps.sh | 188 + scripts/check-integration-test-vm-panics.sh | 58 + scripts/cz-header-style.toml | 11 + scripts/ensure-hawkeye-exists.sh | 24 + scripts/install-hawkeye.sh | 50 + scripts/license-header.txt | 13 + scripts/make-docs.sh | 52 + ...ofsd-skip-cap-drop-with-sandbox-none.patch | 41 + scripts/pre-commit.fmt | 16 + signing/vz.entitlements | 8 + vminitd/.devcontainer/Dockerfile | 10 + vminitd/.devcontainer/devcontainer.json | 17 + vminitd/Makefile | 115 + vminitd/Package.resolved | 249 + vminitd/Package.swift | 71 + vminitd/Sources/CVersion/include/version.h | 24 + vminitd/Sources/CVersion/version.c | 41 + vminitd/Sources/Cgroup/Cgroup2Manager.swift | 770 ++ vminitd/Sources/LCShim/include/syscall.h | 104 + vminitd/Sources/LCShim/syscall.c | 52 + .../Sources/VminitdCore/AgentCommand.swift | 212 + .../Sources/VminitdCore/CommandRunner.swift | 108 + .../VminitdCore/ContainerProcess.swift | 70 + vminitd/Sources/VminitdCore/HostStdio.swift | 26 + .../VminitdCore/IOCloser+Extensions.swift | 32 + vminitd/Sources/VminitdCore/IOCloser.swift | 37 + vminitd/Sources/VminitdCore/IOPair.swift | 189 + vminitd/Sources/VminitdCore/InitCommand.swift | 113 + vminitd/Sources/VminitdCore/Logging.swift | 117 + .../VminitdCore/ManagedContainer.swift | 286 + .../Sources/VminitdCore/ManagedProcess.swift | 348 + .../Sources/VminitdCore/MemoryMonitor.swift | 158 + .../Sources/VminitdCore/OSFile+Splice.swift | 106 + vminitd/Sources/VminitdCore/OSFile.swift | 132 + .../Sources/VminitdCore/PauseCommand.swift | 82 + .../VminitdCore/ProcessSupervisor.swift | 168 + .../VminitdCore/Runc/ConsoleSocket.swift | 83 + vminitd/Sources/VminitdCore/Runc/Runc.swift | 794 ++ vminitd/Sources/VminitdCore/RuncProcess.swift | 564 ++ vminitd/Sources/VminitdCore/Server+GRPC.swift | 1822 +++++ vminitd/Sources/VminitdCore/Server.swift | 145 + vminitd/Sources/VminitdCore/StandardIO.swift | 175 + vminitd/Sources/VminitdCore/TerminalIO.swift | 169 + vminitd/Sources/VminitdCore/VsockProxy.swift | 414 + vminitd/Sources/vmexec/Console.swift | 70 + vminitd/Sources/vmexec/ExecCommand.swift | 165 + vminitd/Sources/vmexec/Mount.swift | 63 + vminitd/Sources/vmexec/RunCommand.swift | 502 ++ vminitd/Sources/vmexec/vmexec.swift | 285 + vminitd/Sources/vminitd/Application.swift | 118 + 445 files changed, 103779 insertions(+) create mode 100644 .github/ISSUE_TEMPLATE/01-bug.yml create mode 100644 .github/ISSUE_TEMPLATE/02-feature.yml create mode 100644 .github/ISSUE_TEMPLATE/config.yml create mode 100644 .github/workflows/build-test-images.yml create mode 100644 .github/workflows/containerization-build-template.yml create mode 100644 .github/workflows/containerization-build.yml create mode 100644 .github/workflows/docs-release.yaml create mode 100644 .github/workflows/linux-build.yml create mode 100644 .github/workflows/release.yml create mode 100644 .gitignore create mode 100644 .spi.yml create mode 100644 .swift-format create mode 100644 .swift-format-nolint create mode 100644 .swift-version create mode 100644 CLAUDE.md create mode 100644 CONTRIBUTING.md create mode 100644 LICENSE create mode 100644 MAINTAINERS.txt create mode 100644 Makefile create mode 100644 Package.resolved create mode 100644 Package.swift create mode 100644 Protobuf.Makefile create mode 100644 README.md create mode 100644 README.wehub.md create mode 100644 SECURITY.md create mode 100644 Sources/CShim/capability.c create mode 100644 Sources/CShim/cz_tap.c create mode 100644 Sources/CShim/exec_command.c create mode 100644 Sources/CShim/include/capability.h create mode 100644 Sources/CShim/include/cz_tap.h create mode 100644 Sources/CShim/include/exec_command.h create mode 100644 Sources/CShim/include/linux_shim.h create mode 100644 Sources/CShim/include/openat2.h create mode 100644 Sources/CShim/include/prctl.h create mode 100644 Sources/CShim/include/socket_helpers.h create mode 100644 Sources/CShim/include/vsock.h create mode 100644 Sources/CShim/openat2.c create mode 100644 Sources/CShim/prctl.c create mode 100644 Sources/CShim/socket_helpers.c create mode 100644 Sources/CShim/vsock.c create mode 100644 Sources/CloudHypervisor/CloudHypervisor+Client.swift create mode 100644 Sources/CloudHypervisor/CloudHypervisor+Error.swift create mode 100644 Sources/CloudHypervisor/CloudHypervisor.swift create mode 100644 Sources/CloudHypervisor/Endpoints/Client+Hotplug.swift create mode 100644 Sources/CloudHypervisor/Endpoints/Client+VM.swift create mode 100644 Sources/CloudHypervisor/Endpoints/Client+VMM.swift create mode 100644 Sources/CloudHypervisor/HTTPOverUDS.swift create mode 100644 Sources/CloudHypervisor/README.md create mode 100644 Sources/CloudHypervisor/Types/DeviceConfigs.swift create mode 100644 Sources/CloudHypervisor/Types/VmConfig.swift create mode 100644 Sources/CloudHypervisor/Types/VmInfo.swift create mode 100644 Sources/Containerization/AttachedFilesystem.swift create mode 100644 Sources/Containerization/BridgeManager.swift create mode 100644 Sources/Containerization/BridgeStateFile.swift create mode 100644 Sources/Containerization/CHHotplugProvider.swift create mode 100644 Sources/Containerization/CHInstanceExtension.swift create mode 100644 Sources/Containerization/CHInterface.swift create mode 100644 Sources/Containerization/CHProcess.swift create mode 100644 Sources/Containerization/CHVirtualMachineInstance.swift create mode 100644 Sources/Containerization/CHVirtualMachineManager.swift create mode 100644 Sources/Containerization/Container.swift create mode 100644 Sources/Containerization/ContainerManager.swift create mode 100644 Sources/Containerization/ContainerStatistics.swift create mode 100644 Sources/Containerization/DNSConfiguration.swift create mode 100644 Sources/Containerization/ExitStatus.swift create mode 100644 Sources/Containerization/FileMount.swift create mode 100644 Sources/Containerization/Hash.swift create mode 100644 Sources/Containerization/HostDefaultRoute.swift create mode 100644 Sources/Containerization/HostsConfiguration.swift create mode 100644 Sources/Containerization/HotplugProvider.swift create mode 100644 Sources/Containerization/IO/ReaderStream.swift create mode 100644 Sources/Containerization/IO/Terminal+ReaderStream.swift create mode 100644 Sources/Containerization/IO/Writer.swift create mode 100644 Sources/Containerization/Image/Image.swift create mode 100644 Sources/Containerization/Image/ImageStore/ImageStore+Export.swift create mode 100644 Sources/Containerization/Image/ImageStore/ImageStore+Import.swift create mode 100644 Sources/Containerization/Image/ImageStore/ImageStore+OCILayout.swift create mode 100644 Sources/Containerization/Image/ImageStore/ImageStore+ReferenceManager.swift create mode 100644 Sources/Containerization/Image/ImageStore/ImageStore.swift create mode 100644 Sources/Containerization/Image/InitImage.swift create mode 100644 Sources/Containerization/Image/KernelImage.swift create mode 100644 Sources/Containerization/Image/Unpacker/EXT4Unpacker.swift create mode 100644 Sources/Containerization/Image/Unpacker/Unpacker.swift create mode 100644 Sources/Containerization/Interface.swift create mode 100644 Sources/Containerization/IptablesRules.swift create mode 100644 Sources/Containerization/Kernel+Commandline.swift create mode 100644 Sources/Containerization/Kernel.swift create mode 100644 Sources/Containerization/LinuxBridgedNetwork.swift create mode 100644 Sources/Containerization/LinuxContainer.swift create mode 100644 Sources/Containerization/LinuxPod.swift create mode 100644 Sources/Containerization/LinuxProcess.swift create mode 100644 Sources/Containerization/LinuxProcessConfiguration.swift create mode 100644 Sources/Containerization/Mount+CH.swift create mode 100644 Sources/Containerization/Mount.swift create mode 100644 Sources/Containerization/NATInterface.swift create mode 100644 Sources/Containerization/NATNetworkInterface.swift create mode 100644 Sources/Containerization/Network.swift create mode 100644 Sources/Containerization/SandboxContext/SandboxContext.grpc.swift create mode 100644 Sources/Containerization/SandboxContext/SandboxContext.pb.swift create mode 100644 Sources/Containerization/SandboxContext/SandboxContext.proto create mode 100644 Sources/Containerization/SandboxOverrides.swift create mode 100644 Sources/Containerization/Signal.swift create mode 100644 Sources/Containerization/SystemPlatform.swift create mode 100644 Sources/Containerization/TAPDevice.swift create mode 100644 Sources/Containerization/TimeSyncer.swift create mode 100644 Sources/Containerization/UnixSocketConfiguration.swift create mode 100644 Sources/Containerization/UnixSocketRelay.swift create mode 100644 Sources/Containerization/UnixSocketRelayManager.swift create mode 100644 Sources/Containerization/VMConfiguration.swift create mode 100644 Sources/Containerization/VZVirtualMachine+Helpers.swift create mode 100644 Sources/Containerization/VZVirtualMachineInstance.swift create mode 100644 Sources/Containerization/VZVirtualMachineManager.swift create mode 100644 Sources/Containerization/VirtiofsdProcess.swift create mode 100644 Sources/Containerization/VirtualMachineAgent+Additions.swift create mode 100644 Sources/Containerization/VirtualMachineAgent+Interface.swift create mode 100644 Sources/Containerization/VirtualMachineAgent.swift create mode 100644 Sources/Containerization/VirtualMachineInstance.swift create mode 100644 Sources/Containerization/VirtualMachineManager.swift create mode 100644 Sources/Containerization/Vminitd+Rosetta.swift create mode 100644 Sources/Containerization/Vminitd+SocketRelay.swift create mode 100644 Sources/Containerization/Vminitd.swift create mode 100644 Sources/Containerization/VmnetNetwork.swift create mode 100644 Sources/Containerization/Vsock+Linux.swift create mode 100644 Sources/Containerization/VsockListener.swift create mode 100644 Sources/ContainerizationArchive/ArchiveError.swift create mode 100644 Sources/ContainerizationArchive/ArchiveReader.swift create mode 100644 Sources/ContainerizationArchive/ArchiveWriter.swift create mode 100644 Sources/ContainerizationArchive/ArchiveWriterConfiguration.swift create mode 100644 Sources/ContainerizationArchive/CArchive/COPYING create mode 100644 Sources/ContainerizationArchive/CArchive/archive_swift_bridge.c create mode 100644 Sources/ContainerizationArchive/CArchive/include/archive.h create mode 100644 Sources/ContainerizationArchive/CArchive/include/archive_bridge.h create mode 100644 Sources/ContainerizationArchive/CArchive/include/archive_entry.h create mode 100644 Sources/ContainerizationArchive/TempDir.swift create mode 100644 Sources/ContainerizationArchive/WriteEntry.swift create mode 100644 Sources/ContainerizationEXT4/Documentation.docc/ext4.md create mode 100644 Sources/ContainerizationEXT4/EXT4+Extensions.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+FileTree.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Formatter.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Journal.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Ptr.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Reader.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Types.swift create mode 100644 Sources/ContainerizationEXT4/EXT4+Xattrs.swift create mode 100644 Sources/ContainerizationEXT4/EXT4.swift create mode 100644 Sources/ContainerizationEXT4/EXT4Reader+Export.swift create mode 100644 Sources/ContainerizationEXT4/EXT4Reader+IO.swift create mode 100644 Sources/ContainerizationEXT4/FilePath+Extensions.swift create mode 100644 Sources/ContainerizationEXT4/FileTimestamps.swift create mode 100644 Sources/ContainerizationEXT4/Formatter+Unpack.swift create mode 100644 Sources/ContainerizationEXT4/Integer+Extensions.swift create mode 100644 Sources/ContainerizationEXT4/README.md create mode 100644 Sources/ContainerizationEXT4/UnsafeLittleEndianBytes.swift create mode 100644 Sources/ContainerizationError/ContainerizationError.swift create mode 100644 Sources/ContainerizationExtras/AddressAllocator.swift create mode 100644 Sources/ContainerizationExtras/AddressError.swift create mode 100644 Sources/ContainerizationExtras/AsyncLock.swift create mode 100644 Sources/ContainerizationExtras/AsyncMutex.swift create mode 100644 Sources/ContainerizationExtras/CIDR.swift create mode 100644 Sources/ContainerizationExtras/CIDRv4.swift create mode 100644 Sources/ContainerizationExtras/CIDRv6.swift create mode 100644 Sources/ContainerizationExtras/FileManager+Temporary.swift create mode 100644 Sources/ContainerizationExtras/IPAddress.swift create mode 100644 Sources/ContainerizationExtras/IPv4Address.swift create mode 100644 Sources/ContainerizationExtras/IPv6Address+Parse.swift create mode 100644 Sources/ContainerizationExtras/IPv6Address.swift create mode 100644 Sources/ContainerizationExtras/IndexedAddressAllocator.swift create mode 100644 Sources/ContainerizationExtras/MACAddress.swift create mode 100644 Sources/ContainerizationExtras/NetworkAddress+Allocator.swift create mode 100644 Sources/ContainerizationExtras/NetworkConfiguration.swift create mode 100644 Sources/ContainerizationExtras/Prefix.swift create mode 100644 Sources/ContainerizationExtras/ProgressEvent.swift create mode 100644 Sources/ContainerizationExtras/ProxyUtils.swift create mode 100644 Sources/ContainerizationExtras/RotatingAddressAllocator.swift create mode 100644 Sources/ContainerizationExtras/TLSUtils.swift create mode 100644 Sources/ContainerizationExtras/Timeout.swift create mode 100644 Sources/ContainerizationExtras/UInt8+DataBinding.swift create mode 100644 Sources/ContainerizationIO/ReadStream.swift create mode 100644 Sources/ContainerizationNetlink/NetlinkSession.swift create mode 100644 Sources/ContainerizationNetlink/NetlinkSocket.swift create mode 100644 Sources/ContainerizationNetlink/Types.swift create mode 100644 Sources/ContainerizationOCI/AnnotationKeys.swift create mode 100644 Sources/ContainerizationOCI/Bundle.swift create mode 100644 Sources/ContainerizationOCI/Client/Authentication.swift create mode 100644 Sources/ContainerizationOCI/Client/KeychainHelper.swift create mode 100644 Sources/ContainerizationOCI/Client/LocalOCILayoutClient.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Catalog.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Error.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Fetch.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Push.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Referrers.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient+Token.swift create mode 100644 Sources/ContainerizationOCI/Client/RegistryClient.swift create mode 100644 Sources/ContainerizationOCI/Content/AsyncTypes.swift create mode 100644 Sources/ContainerizationOCI/Content/Content.swift create mode 100644 Sources/ContainerizationOCI/Content/ContentStoreProtocol.swift create mode 100644 Sources/ContainerizationOCI/Content/ContentWriter.swift create mode 100644 Sources/ContainerizationOCI/Content/LocalContent.swift create mode 100644 Sources/ContainerizationOCI/Content/LocalContentStore.swift create mode 100644 Sources/ContainerizationOCI/Content/SHA256+Extensions.swift create mode 100644 Sources/ContainerizationOCI/Content/String+Extension.swift create mode 100644 Sources/ContainerizationOCI/Content/URL+Extensions.swift create mode 100644 Sources/ContainerizationOCI/Descriptor.swift create mode 100644 Sources/ContainerizationOCI/FileManager+Size.swift create mode 100644 Sources/ContainerizationOCI/ImageConfig.swift create mode 100644 Sources/ContainerizationOCI/Index.swift create mode 100644 Sources/ContainerizationOCI/Manifest.swift create mode 100644 Sources/ContainerizationOCI/MediaType.swift create mode 100644 Sources/ContainerizationOCI/Platform.swift create mode 100644 Sources/ContainerizationOCI/Reference.swift create mode 100644 Sources/ContainerizationOCI/Spec.swift create mode 100644 Sources/ContainerizationOCI/State.swift create mode 100644 Sources/ContainerizationOCI/Version.swift create mode 100644 Sources/ContainerizationOS/AsyncSignalHandler.swift create mode 100644 Sources/ContainerizationOS/BinaryInteger+Extensions.swift create mode 100644 Sources/ContainerizationOS/Command.swift create mode 100644 Sources/ContainerizationOS/File.swift create mode 100644 Sources/ContainerizationOS/FileDescriptorOps.swift create mode 100644 Sources/ContainerizationOS/FilePathOps.swift create mode 100644 Sources/ContainerizationOS/Keychain/KeychainQuery.swift create mode 100644 Sources/ContainerizationOS/Keychain/RegistryInfo.swift create mode 100644 Sources/ContainerizationOS/Linux/Binfmt.swift create mode 100644 Sources/ContainerizationOS/Linux/Capabilities.swift create mode 100644 Sources/ContainerizationOS/Linux/Epoll.swift create mode 100644 Sources/ContainerizationOS/Mount/Mount.swift create mode 100644 Sources/ContainerizationOS/POSIXError+Helpers.swift create mode 100644 Sources/ContainerizationOS/Path.swift create mode 100644 Sources/ContainerizationOS/Pipe+Close.swift create mode 100644 Sources/ContainerizationOS/README.md create mode 100644 Sources/ContainerizationOS/Reaper.swift create mode 100644 Sources/ContainerizationOS/Socket/BidirectionalRelay.swift create mode 100644 Sources/ContainerizationOS/Socket/Socket.swift create mode 100644 Sources/ContainerizationOS/Socket/SocketType.swift create mode 100644 Sources/ContainerizationOS/Socket/UnixType.swift create mode 100644 Sources/ContainerizationOS/Socket/VsockType.swift create mode 100644 Sources/ContainerizationOS/Stat.swift create mode 100644 Sources/ContainerizationOS/Syscall.swift create mode 100644 Sources/ContainerizationOS/Sysctl.swift create mode 100644 Sources/ContainerizationOS/Terminal.swift create mode 100644 Sources/ContainerizationOS/URL+Extensions.swift create mode 100644 Sources/ContainerizationOS/User.swift create mode 100644 Sources/Integration/ContainerTests.swift create mode 100644 Sources/Integration/NBDServer.swift create mode 100644 Sources/Integration/PodTests.swift create mode 100644 Sources/Integration/PodVolumeTests.swift create mode 100644 Sources/Integration/Suite.swift create mode 100644 Sources/cctl/BridgeCommand.swift create mode 100644 Sources/cctl/ImageCommand.swift create mode 100644 Sources/cctl/KernelCommand.swift create mode 100644 Sources/cctl/LoginCommand.swift create mode 100644 Sources/cctl/RootfsCommand.swift create mode 100644 Sources/cctl/RunCommand.swift create mode 100644 Sources/cctl/cctl+Utils.swift create mode 100644 Sources/cctl/cctl.swift create mode 100644 Tests/CloudHypervisorTests/ClientTests.swift create mode 100644 Tests/CloudHypervisorTests/ErrorsTests.swift create mode 100644 Tests/CloudHypervisorTests/StubHTTPServer.swift create mode 100644 Tests/CloudHypervisorTests/TypesTests.swift create mode 100644 Tests/ContainerizationArchiveTests/ArchiveReaderTests.swift create mode 100644 Tests/ContainerizationArchiveTests/ArchiveTests.swift create mode 100644 Tests/ContainerizationArchiveTests/Resources/test.tar.zst create mode 100644 Tests/ContainerizationEXT4Tests/Resources/content/blobs/sha256/48a06049d3738991b011ca8b12473d712b7c40666a1462118dae3c403676afc2 create mode 100644 Tests/ContainerizationEXT4Tests/Resources/content/blobs/sha256/4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1 create mode 100644 Tests/ContainerizationEXT4Tests/Resources/content/blobs/sha256/8e2eb240a6cd7be1a0d308125afe0060b020e89275ced2e729eda7d4eeff62a2 create mode 100644 Tests/ContainerizationEXT4Tests/Resources/content/blobs/sha256/ad59e9f71edceca7b1ac7c642410858489b743c97233b0a26a5e2098b1443762 create mode 100644 Tests/ContainerizationEXT4Tests/Resources/content/blobs/sha256/c6b39de5b33961661dc939b997cc1d30cda01e38005a6c6625fd9c7e748bab44 create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4ExtendedAttributes.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Format+Create.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Format+Link.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Format+Unlink.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Format.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Journal.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Reader+IO.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestEXT4Unpacker.swift create mode 100644 Tests/ContainerizationEXT4Tests/TestFormatterUnpack.swift create mode 100644 Tests/ContainerizationExtrasTests/AsyncLockTests.swift create mode 100644 Tests/ContainerizationExtrasTests/AsyncMutexTests.swift create mode 100644 Tests/ContainerizationExtrasTests/ProxyUtilsTests.swift create mode 100644 Tests/ContainerizationExtrasTests/TestCIDR.swift create mode 100644 Tests/ContainerizationExtrasTests/TestIPAddress.swift create mode 100644 Tests/ContainerizationExtrasTests/TestIPv4Address.swift create mode 100644 Tests/ContainerizationExtrasTests/TestIPv6Address+Parse.swift create mode 100644 Tests/ContainerizationExtrasTests/TestIPv6Address.swift create mode 100644 Tests/ContainerizationExtrasTests/TestIPv6IPv4Parsing.swift create mode 100644 Tests/ContainerizationExtrasTests/TestMACAddress.swift create mode 100644 Tests/ContainerizationExtrasTests/TestNetworkAddress+Allocator.swift create mode 100644 Tests/ContainerizationExtrasTests/TestPrefix.swift create mode 100644 Tests/ContainerizationExtrasTests/TestTimeout.swift create mode 100644 Tests/ContainerizationExtrasTests/UInt8+DataBindingTest.swift create mode 100644 Tests/ContainerizationNetlinkTests/MockNetlinkSocket.swift create mode 100644 Tests/ContainerizationNetlinkTests/NetlinkSessionTest.swift create mode 100644 Tests/ContainerizationNetlinkTests/TypesTest.swift create mode 100644 Tests/ContainerizationOCITests/AuthChallengeTests.swift create mode 100644 Tests/ContainerizationOCITests/ContentWriterTests.swift create mode 100644 Tests/ContainerizationOCITests/LocalContentStoreTests.swift create mode 100644 Tests/ContainerizationOCITests/OCIImageTests.swift create mode 100644 Tests/ContainerizationOCITests/OCIPlatformTests.swift create mode 100644 Tests/ContainerizationOCITests/OCISpecTests.swift create mode 100644 Tests/ContainerizationOCITests/ReferenceTests.swift create mode 100644 Tests/ContainerizationOCITests/RegistryClientTests.swift create mode 100644 Tests/ContainerizationOSTests/BidirectionalRelayTests.swift create mode 100644 Tests/ContainerizationOSTests/EpollTests.swift create mode 100644 Tests/ContainerizationOSTests/FileDescriptorOpsTests.swift create mode 100644 Tests/ContainerizationOSTests/FilePathOpsTests.swift create mode 100644 Tests/ContainerizationOSTests/KeychainQueryTests.swift create mode 100644 Tests/ContainerizationOSTests/SocketTests.swift create mode 100644 Tests/ContainerizationOSTests/UserTests.swift create mode 100644 Tests/ContainerizationTests/AllocatorTests.swift create mode 100644 Tests/ContainerizationTests/BridgeStateFileTests.swift create mode 100644 Tests/ContainerizationTests/CHInterfaceTests.swift create mode 100644 Tests/ContainerizationTests/ContainerManagerTests.swift create mode 100644 Tests/ContainerizationTests/DNSTests.swift create mode 100644 Tests/ContainerizationTests/HashTests.swift create mode 100644 Tests/ContainerizationTests/HostDefaultRouteTests.swift create mode 100644 Tests/ContainerizationTests/HostsTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests/ContainsAuth.swift create mode 100644 Tests/ContainerizationTests/ImageTests/ExportOperationTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests/HeaderScanTimingTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests/ImageStoreImagePullTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests/ImageStoreTests.swift create mode 100644 Tests/ContainerizationTests/ImageTests/Resources/scratch.tar create mode 100644 Tests/ContainerizationTests/ImageTests/Resources/scratch_no_annotations.tar create mode 100644 Tests/ContainerizationTests/InterfaceTests.swift create mode 100644 Tests/ContainerizationTests/KernelTests.swift create mode 100644 Tests/ContainerizationTests/LinuxContainerTests.swift create mode 100644 Tests/ContainerizationTests/MountCHTests.swift create mode 100644 Tests/ContainerizationTests/MountTests.swift create mode 100644 Tests/ContainerizationTests/TAPNameDerivationTests.swift create mode 100644 Tests/TestImages/dockermanifestimage/Dockerfile create mode 100644 Tests/TestImages/emptyimage/Dockerfile create mode 100644 assets/Containerization-Logo.png create mode 100644 docs/single-file-mounts.md create mode 100644 docs/x86_64-build.md create mode 100644 examples/README.md create mode 100644 examples/ctr-example/Makefile create mode 100644 examples/ctr-example/Package.resolved create mode 100644 examples/ctr-example/Package.swift create mode 100644 examples/ctr-example/README.md create mode 100644 examples/ctr-example/Sources/ctr-example/main.swift create mode 100644 examples/ctr-example/ctr-example.entitlements create mode 100644 examples/ctr-example/lab.md create mode 100644 examples/sandboxy/Makefile create mode 100644 examples/sandboxy/Package.resolved create mode 100644 examples/sandboxy/Package.swift create mode 100644 examples/sandboxy/README.md create mode 100644 examples/sandboxy/Sources/sandboxy/AgentDefinition.swift create mode 100644 examples/sandboxy/Sources/sandboxy/CacheCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/ConfigCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/EditCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/HostProxy.swift create mode 100644 examples/sandboxy/Sources/sandboxy/InstanceState.swift create mode 100644 examples/sandboxy/Sources/sandboxy/KernelManager.swift create mode 100644 examples/sandboxy/Sources/sandboxy/ListCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/OutputCapture.swift create mode 100644 examples/sandboxy/Sources/sandboxy/ProgressUI.swift create mode 100644 examples/sandboxy/Sources/sandboxy/RemoveCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/RunAgentCommand.swift create mode 100644 examples/sandboxy/Sources/sandboxy/Sandboxy.swift create mode 100644 examples/sandboxy/Sources/sandboxy/SandboxyConfig.swift create mode 100644 examples/sandboxy/Sources/sandboxy/SandboxyError.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/Int+Formatted.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/Int64+Formatted.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Add.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+State.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Terminal.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressConfig.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTaskCoordinator.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTheme.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressUpdate.swift create mode 100644 examples/sandboxy/Sources/sandboxy/TerminalProgress/StandardError.swift create mode 100644 examples/sandboxy/sandboxy.entitlements create mode 100644 images/linux-dev/Dockerfile create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-ar create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-g++ create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-gcc create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-ld create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-ranlib create mode 100755 images/linux-dev/wrappers/x86_64-linux-gnu-strip create mode 100755 images/linux-dev/wrappers/x86_64-linux-musl-ar create mode 100755 images/linux-dev/wrappers/x86_64-linux-musl-g++ create mode 100755 images/linux-dev/wrappers/x86_64-linux-musl-gcc create mode 100755 images/linux-dev/wrappers/x86_64-linux-musl-ranlib create mode 100755 images/linux-dev/wrappers/x86_64-linux-musl-strip create mode 100644 kernel/Makefile create mode 100644 kernel/README.md create mode 100755 kernel/build.sh create mode 100644 kernel/config-arm64 create mode 100644 kernel/config-x86_64 create mode 100644 kernel/image/Dockerfile create mode 100644 kernel/image/sources.list create mode 100644 licenserc.toml create mode 100755 scripts/build-dist-x86_64.sh create mode 100755 scripts/build-glibc-x86_64-deps.sh create mode 100755 scripts/build-musl-x86_64-deps.sh create mode 100755 scripts/check-integration-test-vm-panics.sh create mode 100644 scripts/cz-header-style.toml create mode 100755 scripts/ensure-hawkeye-exists.sh create mode 100755 scripts/install-hawkeye.sh create mode 100644 scripts/license-header.txt create mode 100755 scripts/make-docs.sh create mode 100644 scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch create mode 100755 scripts/pre-commit.fmt create mode 100644 signing/vz.entitlements create mode 100644 vminitd/.devcontainer/Dockerfile create mode 100644 vminitd/.devcontainer/devcontainer.json create mode 100644 vminitd/Makefile create mode 100644 vminitd/Package.resolved create mode 100644 vminitd/Package.swift create mode 100644 vminitd/Sources/CVersion/include/version.h create mode 100644 vminitd/Sources/CVersion/version.c create mode 100644 vminitd/Sources/Cgroup/Cgroup2Manager.swift create mode 100644 vminitd/Sources/LCShim/include/syscall.h create mode 100644 vminitd/Sources/LCShim/syscall.c create mode 100644 vminitd/Sources/VminitdCore/AgentCommand.swift create mode 100644 vminitd/Sources/VminitdCore/CommandRunner.swift create mode 100644 vminitd/Sources/VminitdCore/ContainerProcess.swift create mode 100644 vminitd/Sources/VminitdCore/HostStdio.swift create mode 100644 vminitd/Sources/VminitdCore/IOCloser+Extensions.swift create mode 100644 vminitd/Sources/VminitdCore/IOCloser.swift create mode 100644 vminitd/Sources/VminitdCore/IOPair.swift create mode 100644 vminitd/Sources/VminitdCore/InitCommand.swift create mode 100644 vminitd/Sources/VminitdCore/Logging.swift create mode 100644 vminitd/Sources/VminitdCore/ManagedContainer.swift create mode 100644 vminitd/Sources/VminitdCore/ManagedProcess.swift create mode 100644 vminitd/Sources/VminitdCore/MemoryMonitor.swift create mode 100644 vminitd/Sources/VminitdCore/OSFile+Splice.swift create mode 100644 vminitd/Sources/VminitdCore/OSFile.swift create mode 100644 vminitd/Sources/VminitdCore/PauseCommand.swift create mode 100644 vminitd/Sources/VminitdCore/ProcessSupervisor.swift create mode 100644 vminitd/Sources/VminitdCore/Runc/ConsoleSocket.swift create mode 100644 vminitd/Sources/VminitdCore/Runc/Runc.swift create mode 100644 vminitd/Sources/VminitdCore/RuncProcess.swift create mode 100644 vminitd/Sources/VminitdCore/Server+GRPC.swift create mode 100644 vminitd/Sources/VminitdCore/Server.swift create mode 100644 vminitd/Sources/VminitdCore/StandardIO.swift create mode 100644 vminitd/Sources/VminitdCore/TerminalIO.swift create mode 100644 vminitd/Sources/VminitdCore/VsockProxy.swift create mode 100644 vminitd/Sources/vmexec/Console.swift create mode 100644 vminitd/Sources/vmexec/ExecCommand.swift create mode 100644 vminitd/Sources/vmexec/Mount.swift create mode 100644 vminitd/Sources/vmexec/RunCommand.swift create mode 100644 vminitd/Sources/vmexec/vmexec.swift create mode 100644 vminitd/Sources/vminitd/Application.swift diff --git a/.github/ISSUE_TEMPLATE/01-bug.yml b/.github/ISSUE_TEMPLATE/01-bug.yml new file mode 100644 index 0000000..c8335c5 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/01-bug.yml @@ -0,0 +1,71 @@ +name: Bug report +description: File a bug report. +title: "[Bug]: " +type: "Bug" +body: + - type: markdown + attributes: + value: | + Thanks for taking the time to fill out this bug report! + - type: checkboxes + id: prereqs + attributes: + label: I have done the following + description: Select that you have completed the following prerequisites. + options: + - label: I have searched the existing issues + required: true + - label: If possible, I've reproduced the issue using the 'main' branch of this project + required: false + - type: textarea + id: reproduce + attributes: + label: Steps to reproduce + description: Explain how to reproduce the incorrect behavior. + validations: + required: true + - type: textarea + id: what-happened + attributes: + label: Current behavior + description: A concise description of what you're experiencing. + validations: + required: true + - type: textarea + id: expected + attributes: + label: Expected behavior + description: A concise description of what you expected to happen. + validations: + required: true + - type: textarea + attributes: + label: Environment + description: | + Examples: + - **OS**: macOS 26.0 (25A354) + - **Xcode**: Version 26.0 (17A324) + - **Swift**: Apple Swift version 6.2 (swift-6.2-RELEASE) + value: | + - OS: + - Xcode: + - Swift: + render: markdown + validations: + required: true + - type: textarea + id: logs + attributes: + label: Relevant log output + description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks. + value: | + N/A + render: shell + - type: checkboxes + id: terms + attributes: + label: Code of Conduct + description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/apple/.github/blob/main/CODE_OF_CONDUCT.md). + options: + - label: I agree to follow this project's Code of Conduct + required: true diff --git a/.github/ISSUE_TEMPLATE/02-feature.yml b/.github/ISSUE_TEMPLATE/02-feature.yml new file mode 100644 index 0000000..e3d3572 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/02-feature.yml @@ -0,0 +1,24 @@ +name: Feature or enhancement request +description: File a request for a feature or enhancement +title: "[Request]: " +type: "Feature" +body: + - type: markdown + attributes: + value: | + Thanks for contributing to the containerization project! + - type: textarea + id: request + attributes: + label: Feature or enhancement request details + description: Describe your proposed feature or enhancement. Code samples that show what's missing, or what new capabilities will be possible, are very helpful! Provide links to existing issues or external references/discussions, if appropriate. + validations: + required: true + - type: checkboxes + id: terms + attributes: + label: Code of Conduct + description: By submitting this issue, you agree to follow our [Code of Conduct](https://github.com/apple/.github/blob/main/CODE_OF_CONDUCT.md). + options: + - label: I agree to follow this project's Code of Conduct + required: true diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml new file mode 100644 index 0000000..dadfeee --- /dev/null +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -0,0 +1,5 @@ +blank_issues_enabled: false +contact_links: + - name: Containerization community support + url: https://github.com/apple/container/discussions + about: Please ask and answer questions here. diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml new file mode 100644 index 0000000..4ad317d --- /dev/null +++ b/.github/workflows/build-test-images.yml @@ -0,0 +1,77 @@ +name: Build and publish containerization test images + +permissions: + contents: read + +on: + workflow_dispatch: + inputs: + publish: + type: boolean + description: "Publish the built image" + default: false + version: + type: string + description: "Version of the image to create" + default: "test" + image: + type: choice + description: Test image to build + options: + - dockermanifestimage + - emptyimage + default: 'dockermanifestimage' + useBuildx: + type: boolean + description: "Use docker buildx to build the image" + default: false + +jobs: + image: + name: Build test images + timeout-minutes: 30 + runs-on: ubuntu-latest + permissions: + contents: read + packages: write + steps: + - name: Check branch + env: + GH_REF: ${{ github.ref }} + PUBLISH: ${{ inputs.publish }} + run: | + if [[ "${GH_REF}" != "refs/heads/main" ]] && [[ "${GH_REF}" != refs/heads/release* ]] && [[ "${PUBLISH}" == "true" ]]; then + echo "❌ Cannot publish an image if we are not on main or a release branch." + exit 1 + fi + - name: Check inputs + env: + IMAGE: ${{ inputs.image }} + USE_BUILDX: ${{ inputs.useBuildx }} + run: | + if [[ "${IMAGE}" == "dockermanifestimage" ]] && [[ "${USE_BUILDX}" == "true" ]]; then + echo "❌ dockermanifestimage cannot be built with buildx" + exit 1 + fi + + if [[ "${IMAGE}" == "emptyimage" ]] && [[ "${USE_BUILDX}" != "true" ]]; then + echo "❌ emptyimage should be built with buildx" + exit 1 + fi + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + - name: Login to GitHub Container Registry + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + - name: Set up Docker Buildx + if: ${{ inputs.useBuildx }} + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 + - name: Build dockerfile and push image + uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6 + with: + push: ${{ inputs.publish }} + context: Tests/TestImages/${{ inputs.image }} + tags: ghcr.io/apple/containerization/${{ inputs.image }}:${{ inputs.version }} diff --git a/.github/workflows/containerization-build-template.yml b/.github/workflows/containerization-build-template.yml new file mode 100644 index 0000000..c67b546 --- /dev/null +++ b/.github/workflows/containerization-build-template.yml @@ -0,0 +1,130 @@ +name: Build containerization template + +permissions: + contents: read + +on: + workflow_call: + inputs: + release: + type: boolean + description: "Create a release" + default: false + version: + type: string + description: Version of containerization + default: test + +jobs: + buildAndTest: + name: Build and Test repo + if: github.repository == 'apple/containerization' + timeout-minutes: 60 + runs-on: [self-hosted, macos, tahoe, ARM64] + permissions: + contents: read + packages: write + env: + DEVELOPER_DIR: "/Applications/Xcode_swift_6.3.app/Contents/Developer" + + steps: + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + with: + fetch-depth: 0 + + - name: Activate Swiftly + run: | + source ~/.swiftly/env.sh + cat ~/.swiftly/env.sh + + - name: Check formatting + run: | + ./scripts/install-hawkeye.sh + make fmt + git diff + if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi + + - name: Check protobufs + run: | + make protos + if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi + + - name: Make containerization, examples, and docs + run: | + make clean containerization examples docs + tar cfz _site.tgz _site + env: + BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }} + + - name: Make vminitd image + run: | + source ~/.swiftly/env.sh + make -C vminitd swift linux-sdk + make init + env: + BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }} + + - name: Test containerization + run: | + make fetch-default-kernel + make test integration + env: + REGISTRY_TOKEN: ${{ github.token }} + REGISTRY_USERNAME: ${{ github.actor }} + + - name: Push vminitd image + if: ${{ inputs.release }} + env: + REGISTRY_TOKEN: ${{ github.token }} + REGISTRY_USERNAME: ${{ github.actor }} + REGISTRY_HOST: ghcr.io + VERSION: ${{ inputs.version }} + run: | + bin/cctl images tag vminit:latest "ghcr.io/apple/containerization/vminit:${VERSION}" + bin/cctl images push "ghcr.io/apple/containerization/vminit:${VERSION}" + + - name: Create image tar + if: ${{ !inputs.release }} + run: | + bin/cctl images save vminit:latest -o vminit.tar + + - name: Save vminit artifact + if: ${{ !inputs.release }} + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + with: + name: vminit + path: vminit.tar + + - name: Save documentation artifact + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 + with: + name: api-docs + path: "./_site.tgz" + retention-days: 14 + + uploadPages: + # Separate upload step required because upload-pages-artifact needs + # gtar which is not on the macOS runner. + name: Upload artifact for GitHub Pages + needs: buildAndTest + timeout-minutes: 5 + runs-on: ubuntu-latest + + steps: + - name: Setup Pages + uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 + + - name: Download a single artifact + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7 + with: + name: api-docs + + - name: Add API docs to documentation + run: | + tar xfz _site.tgz + + - name: Upload Artifact + uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4 + with: + path: "./_site" diff --git a/.github/workflows/containerization-build.yml b/.github/workflows/containerization-build.yml new file mode 100644 index 0000000..dc32e1b --- /dev/null +++ b/.github/workflows/containerization-build.yml @@ -0,0 +1,53 @@ +name: Build containerization + +permissions: + contents: read + +on: + pull_request: + types: [opened, reopened, synchronize] + push: + branches: + - main + - release/* + +jobs: + verify-signatures: + name: Verify commit signatures + runs-on: ubuntu-latest + if: github.event_name == 'pull_request' + steps: + - name: Check all commits are signed + env: + GH_TOKEN: ${{ github.token }} + REPO: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + commits=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}/commits" --paginate) + unsigned_commits="" + + while IFS='|' read -r sha author verified; do + if [ "$verified" != "true" ]; then + unsigned_commits="$unsigned_commits - $sha by $author\n" + fi + done < <(echo "$commits" | jq -r '.[] | "\(.sha)|\(.commit.author.name)|\(.commit.verification.verified)"') + + if [ -n "$unsigned_commits" ]; then + echo "::error::The following commits are not signed:" + echo -e "$unsigned_commits" + echo "" + echo "Please sign your commits. See:" + echo " - https://github.com/apple/containerization/blob/main/CONTRIBUTING.md#pull-requests" + echo " - https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits" + exit 1 + fi + + echo "All commits are signed!" + + containerization: + permissions: + contents: read + packages: write + pages: write + uses: ./.github/workflows/containerization-build-template.yml + secrets: inherit diff --git a/.github/workflows/docs-release.yaml b/.github/workflows/docs-release.yaml new file mode 100644 index 0000000..e1295d6 --- /dev/null +++ b/.github/workflows/docs-release.yaml @@ -0,0 +1,46 @@ +# Manual workflow for releasing docs ad-hoc. Workflow can only be run for main or release branches. +# Workflow does NOT publish a release of containerization. +name: Deploy application website + +permissions: + contents: read + +on: + workflow_dispatch: + +jobs: + checkBranch: + runs-on: ubuntu-latest + if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags') || startsWith(github.ref, 'refs/heads/release') + steps: + - name: Branch validation + env: + REF_NAME: ${{ github.ref_name }} + run: echo "Branch ${REF_NAME} is allowed" + + buildSite: + name: Build application website + needs: checkBranch + uses: ./.github/workflows/containerization-build-template.yml + secrets: inherit + permissions: + contents: read + packages: write + pages: write + + deployDocs: + runs-on: ubuntu-latest + needs: [checkBranch, buildSite] + permissions: + contents: read + pages: write + id-token: write + + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + + steps: + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/.github/workflows/linux-build.yml b/.github/workflows/linux-build.yml new file mode 100644 index 0000000..2d0acac --- /dev/null +++ b/.github/workflows/linux-build.yml @@ -0,0 +1,60 @@ +name: Linux build + +permissions: + contents: read + +on: + pull_request: + types: [opened, reopened, synchronize] + push: + branches: + - main + - release/* + +jobs: + swift-version: + name: Determine Swift version + runs-on: ubuntu-24.04 + outputs: + image: ${{ steps.version.outputs.image }} + steps: + - name: Checkout .swift-version + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + with: + sparse-checkout: .swift-version + sparse-checkout-cone-mode: false + + - name: Read Swift version + id: version + run: echo "image=swift:$(cat .swift-version)-noble" >> "$GITHUB_OUTPUT" + + build: + name: Linux compile check + needs: swift-version + timeout-minutes: 30 + runs-on: ubuntu-24.04 + container: ${{ needs.swift-version.outputs.image }} + + steps: + - name: Checkout repository + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6 + with: + fetch-depth: 0 + + - name: Install system dependencies + run: apt-get update && apt-get install -y curl make libarchive-dev libbz2-dev liblzma-dev libssl-dev + + - name: Build containerization + run: make containerization + + - name: Build vminitd (glibc) + run: make -C vminitd SWIFT_CONFIGURATION="--disable-automatic-resolution -Xswiftc -warnings-as-errors" + + - name: Install Static Linux SDK + run: make -C vminitd linux-sdk + + - name: Build vminitd (musl) + run: make -C vminitd + + - name: Run unit tests + run: swift test --disable-automatic-resolution -Xswiftc -warnings-as-errors diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..7f211c7 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,57 @@ +name: Release containerization + +permissions: + contents: read + +on: + push: + tags: + - "[0-9]+\\.[0-9]+\\.[0-9]+" + +jobs: + containerization: + uses: ./.github/workflows/containerization-build-template.yml + with: + release: true + version: ${{ github.ref_name }} + secrets: inherit + permissions: + contents: read + packages: write + pages: write + + deployDocs: + if: startsWith(github.ref, 'refs/tags/') + runs-on: ubuntu-latest + needs: containerization + permissions: + contents: read + pages: write + id-token: write + environment: + name: github-pages + url: ${{ steps.deployment.outputs.page_url }} + steps: + - name: Deploy to GitHub Pages + id: deployment + uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 + + release: + if: startsWith(github.ref, 'refs/tags/') + name: Publish release + timeout-minutes: 30 + needs: containerization + runs-on: ubuntu-latest + permissions: + contents: write + packages: read + steps: + - name: Create release + uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 + with: + token: ${{ github.token }} + name: ${{ github.ref_name }}-prerelease + draft: true + make_latest: false + prerelease: true + fail_on_unmatched_files: true diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..088b1bf --- /dev/null +++ b/.gitignore @@ -0,0 +1,28 @@ +.DS_Store +bin +libexec +.build +.local +xcuserdata/ +DerivedData/ +.swiftpm/ +.netrc +workdir/ +installer/ +.venv/ +test_results/ +*.pid +*.log +*.zip +*.o +*.ext4 +*.pkg +*.swp +*.tar.gz +*.tar.xz +vmlinux* + +# API docs for local preview only. +_site/ +_serve/ +kernel/vmlinuz-x86_64 diff --git a/.spi.yml b/.spi.yml new file mode 100644 index 0000000..9b46d1f --- /dev/null +++ b/.spi.yml @@ -0,0 +1,5 @@ +version: 1 +builder: + configs: + - documentation_targets: [Containerization, ContainerizationEXT4, ContainerizationOS, ContainerizationOCI, ContainerizationNetlink, ContainerizationIO, ContainerizationExtras, ContainerizationArchive, SendableProperty] + swift_version: '6.2' diff --git a/.swift-format b/.swift-format new file mode 100644 index 0000000..dcd6005 --- /dev/null +++ b/.swift-format @@ -0,0 +1,68 @@ +{ + "fileScopedDeclarationPrivacy" : { + "accessLevel" : "private" + }, + "indentation" : { + "spaces" : 4 + }, + "indentConditionalCompilationBlocks" : false, + "indentSwitchCaseLabels" : false, + "lineBreakAroundMultilineExpressionChainComponents" : false, + "lineBreakBeforeControlFlowKeywords" : false, + "lineBreakBeforeEachArgument" : false, + "lineBreakBeforeEachGenericRequirement" : false, + "lineLength" : 180, + "maximumBlankLines" : 1, + "multiElementCollectionTrailingCommas" : true, + "noAssignmentInExpressions" : { + "allowedFunctions" : [ + "XCTAssertNoThrow" + ] + }, + "prioritizeKeepingFunctionOutputTogether" : false, + "respectsExistingLineBreaks" : true, + "rules" : { + "AllPublicDeclarationsHaveDocumentation" : false, + "AlwaysUseLowerCamelCase" : true, + "AmbiguousTrailingClosureOverload" : false, + "BeginDocumentationCommentWithOneLineSummary" : false, + "DoNotUseSemicolons" : true, + "DontRepeatTypeInStaticProperties" : true, + "FileScopedDeclarationPrivacy" : true, + "FullyIndirectEnum" : true, + "GroupNumericLiterals" : true, + "IdentifiersMustBeASCII" : true, + "NeverForceUnwrap" : true, + "NeverUseForceTry" : true, + "NeverUseImplicitlyUnwrappedOptionals" : true, + "NoAccessLevelOnExtensionDeclaration" : true, + "NoAssignmentInExpressions" : true, + "NoBlockComments" : false, + "NoCasesWithOnlyFallthrough" : true, + "NoEmptyTrailingClosureParentheses" : true, + "NoLabelsInCasePatterns" : true, + "NoLeadingUnderscores" : false, + "NoParensAroundConditions" : true, + "NoPlaygroundLiterals" : true, + "NoVoidReturnOnFunctionSignature" : true, + "OmitExplicitReturns" : true, + "OneCasePerLine" : true, + "OneVariableDeclarationPerLine" : true, + "OnlyOneTrailingClosureArgument" : true, + "OrderedImports" : true, + "ReplaceForEachWithForLoop" : true, + "ReturnVoidInsteadOfEmptyTuple" : true, + "TypeNamesShouldBeCapitalized" : true, + "UseEarlyExits" : true, + "UseLetInEveryBoundCaseVariable" : true, + "UseShorthandTypeNames" : true, + "UseSingleLinePropertyGetter" : true, + "UseSynthesizedInitializer" : true, + "UseTripleSlashForDocumentationComments" : true, + "UseWhereClausesInForLoops" : false, + "ValidateDocumentationComments" : true + }, + "spacesAroundRangeFormationOperators" : false, + "tabWidth" : 2, + "version" : 1 +} diff --git a/.swift-format-nolint b/.swift-format-nolint new file mode 100644 index 0000000..8f600e5 --- /dev/null +++ b/.swift-format-nolint @@ -0,0 +1,68 @@ +{ + "fileScopedDeclarationPrivacy" : { + "accessLevel" : "private" + }, + "indentation" : { + "spaces" : 4 + }, + "indentConditionalCompilationBlocks" : false, + "indentSwitchCaseLabels" : false, + "lineBreakAroundMultilineExpressionChainComponents" : false, + "lineBreakBeforeControlFlowKeywords" : false, + "lineBreakBeforeEachArgument" : false, + "lineBreakBeforeEachGenericRequirement" : false, + "lineLength" : 180, + "maximumBlankLines" : 1, + "multiElementCollectionTrailingCommas" : true, + "noAssignmentInExpressions" : { + "allowedFunctions" : [ + "XCTAssertNoThrow" + ] + }, + "prioritizeKeepingFunctionOutputTogether" : false, + "respectsExistingLineBreaks" : true, + "rules" : { + "AllPublicDeclarationsHaveDocumentation" : false, + "AlwaysUseLowerCamelCase" : false, + "AmbiguousTrailingClosureOverload" : false, + "BeginDocumentationCommentWithOneLineSummary" : false, + "DoNotUseSemicolons" : true, + "DontRepeatTypeInStaticProperties" : false, + "FileScopedDeclarationPrivacy" : false, + "FullyIndirectEnum" : false, + "GroupNumericLiterals" : false, + "IdentifiersMustBeASCII" : false, + "NeverForceUnwrap" : false, + "NeverUseForceTry" : false, + "NeverUseImplicitlyUnwrappedOptionals" : false, + "NoAccessLevelOnExtensionDeclaration" : false, + "NoAssignmentInExpressions" : false, + "NoBlockComments" : false, + "NoCasesWithOnlyFallthrough" : false, + "NoEmptyTrailingClosureParentheses" : true, + "NoLabelsInCasePatterns" : false, + "NoLeadingUnderscores" : false, + "NoParensAroundConditions" : true, + "NoPlaygroundLiterals" : false, + "NoVoidReturnOnFunctionSignature" : true, + "OmitExplicitReturns" : false, + "OneCasePerLine" : true, + "OneVariableDeclarationPerLine" : true, + "OnlyOneTrailingClosureArgument" : false, + "OrderedImports" : true, + "ReplaceForEachWithForLoop" : false, + "ReturnVoidInsteadOfEmptyTuple" : false, + "TypeNamesShouldBeCapitalized" : false, + "UseEarlyExits" : false, + "UseLetInEveryBoundCaseVariable" : false, + "UseShorthandTypeNames" : true, + "UseSingleLinePropertyGetter" : true, + "UseSynthesizedInitializer" : false, + "UseTripleSlashForDocumentationComments" : true, + "UseWhereClausesInForLoops" : false, + "ValidateDocumentationComments" : false + }, + "spacesAroundRangeFormationOperators" : false, + "tabWidth" : 2, + "version" : 1 +} diff --git a/.swift-version b/.swift-version new file mode 100644 index 0000000..798e389 --- /dev/null +++ b/.swift-version @@ -0,0 +1 @@ +6.3.0 diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..d3d775b --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1,91 @@ +# CLAUDE.md + +This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository. + +## Build / Test / Format + +The project is built via `make`, not directly with `swift build`. Two Swift packages live in this repo: the root package (Containerization libraries + `cctl` + macOS-only integration binary) and `vminitd/` (the Linux guest init system, cross-compiled with the Static Linux SDK). + +- `make all` — build everything (`containerization` + `vminitd` + `init.ext4` rootfs in `bin/`). Default `BUILD_CONFIGURATION=debug`; pass `release` (or use `make release`) for optimized builds. +- `make containerization` — build just the host-side Swift package (skips vminitd). +- `make vminitd` — build vminitd / vmexec only. By default uses `LIBC=musl` via the Static Linux SDK; `make linux-build LIBC=glibc` builds via a Linux dev container. +- `make test` — unit tests with code coverage. `make coverage` regenerates the coverage report. +- `make integration` — runs `bin/containerization-integration`. Requires an in-repo kernel under `bin/` (`bin/vmlinux-arm64` on arm64, `bin/vmlinuz-x86_64` or `bin/vmlinux-x86_64` on x86_64); if absent, run `make fetch-default-kernel` to download the Kata-provided kernel for the host arch. +- Single test: `swift test --filter ContainerizationOCITests.ReferenceTests/testParsing` (Swift Testing / XCTest filter syntax). Targets are listed in `Package.swift`. +- `make linux-test` — runs `swift test` inside the Linux dev container (requires the `container` CLI from apple/container). +- `make linux-build` — builds the host-side Swift package (incl. `cctl`, `Containerization`, and `CloudHypervisor`) inside the same Linux dev container. Use this to validate Linux portability of host-side code; the resulting `cctl` is what the cloud-hypervisor backend ships behind. +- `make linux-integration` — runs the cross-platform integration suite against a real cloud-hypervisor VM inside the dev container (nested virt via apple/container's `--virtualization`). Requires a KVM-capable kernel at `kernel/vmlinux-arm64` (or `kernel/vmlinuz-x86_64` on x86_64 hosts) — build via `make -C kernel`; the kata-fetched kernel doesn't include KVM. Also requires `make fetch-cloud-hypervisor` and `make linux-build` to have been run first. Linux runs only the cross-platform subset (`process true`/`false`/`echo hi`); the macOS suite is unchanged. +- `make fetch-cloud-hypervisor` — downloads the static `cloud-hypervisor` v52.0 (aarch64) binary into `bin/cloud-hypervisor` for the Linux integration tests. +- `make build-cloud-hypervisor` / `make build-virtiofsd` — build patched `cloud-hypervisor` / `virtiofsd` from sources you have cloned into `.local/cloud-hypervisor` and `.local/virtiofsd` respectively. There is no fetch target — clone the upstream repos at the revision you want pinned. `build-virtiofsd` applies `scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch` and is idempotent. Both run inside the same Linux dev container as `linux-integration` so the resulting binaries are aarch64-linux-gnu. +- `make dist-x86_64` — assembles `bin/containerization-x86_64-.tar.gz` (cctl + cloud-hypervisor + virtiofsd + initfs.ext4 + kernel) for x86_64 Linux deployment, cross-compiled inside the aarch64 dev container via the Static Linux SDK (Swift) and `cargo zigbuild` (Rust). Prereqs: `.local/cloud-hypervisor` and `.local/virtiofsd` source checkouts (clone deliberately — no fetch target), and an x86_64 kernel built via `make -C kernel TARGET_ARCH=x86_64`. Per-stage rebuild env vars: `REBUILD_VMINITD=1`, `REBUILD_INITFS=1`, `REBUILD_CH=1`, `REBUILD_VIRTIOFSD=1`; cctl x86 always rebuilds. **Full pipeline, toolchain rationale, and troubleshooting in `docs/x86_64-build.md`.** The orchestrator is `scripts/build-dist-x86_64.sh`. +- `make fmt` — applies `.swift-format` and refreshes license headers via hawkeye. +- `make check` — formatting + license-header lint (this is what the pre-commit hook runs). Uses `.swift-format-nolint` for stricter linting. +- `make pre-commit` — installs `scripts/pre-commit.fmt` as a git pre-commit hook. +- `make protos` — regenerates `Sources/Containerization/SandboxContext/SandboxContext.{pb,grpc}.swift` from the `.proto`. Touch this whenever the proto changes; never hand-edit the generated files. +- `make cross-prep` — installs Swiftly, the pinned Swift toolchain (see `.swift-version`), and the Static Linux SDK. Run once before the first build. + +`WARNINGS_AS_ERRORS=true` is the default for both packages. Don't disable it casually — CI builds with it on. + +## Architecture + +This is a **Swift library package** (not a CLI tool) that lets applications run Linux containers on Apple silicon by spawning a lightweight VM per container via `Virtualization.framework`. The corresponding end-user CLI lives in [`apple/container`](https://github.com/apple/container) and is **not** part of this repo. `cctl` here is a playground/example binary, not the shipping product. + +### The host ↔ guest split + +Every Linux container runs inside its own VM. The boundary between host (macOS) and guest (Linux) is the central architectural fact: + +- **Host side** (`Sources/`, `macOS` platform): orchestrates VMs through `Virtualization.framework` (`VZVirtualMachineInstance.swift`, `VZVirtualMachine+Helpers.swift`). The user-facing entry points are `LinuxContainer` (one container per VM) and `LinuxPod` (multiple containers in one VM, experimental). These build a `VMConfiguration`, boot the VM with the chosen `Kernel` and a rootfs containing `vminitd`, then drive the guest via gRPC. +- **Guest side** (`vminitd/`, Linux platform): `vminitd` is PID 1 inside the VM. It exposes a gRPC service over **vsock** (default port `1024`) defined by `Sources/Containerization/SandboxContext/SandboxContext.proto`. `VminitdCore` implements that service: launching container processes, handling stdio over vsock, signal/event delivery, cgroups, mounts, and process lifecycle. By default it launches workloads via `vmexec` (a small helper that runs a single process inside the guest namespace); `runc` is used only when an OCI runtime path is supplied. + +The proto is the contract between the two halves. **The `.pb.swift` and `.grpc.swift` files in `SandboxContext/` are generated** — regenerate via `make protos` after changing `SandboxContext.proto`. Both host and guest depend on the same generated Swift via the path-dependency wiring in `vminitd/Package.swift` (`containerization` is a sibling path package). + +### VMM backends + +`Containerization` abstracts the VMM behind `VirtualMachineManager` / `VirtualMachineInstance`. Two backends ship in this repo, both inside the same `Containerization` target but gated by `#if`: + +- **macOS**: `VZVirtualMachineManager` / `VZVirtualMachineInstance` (`VZ*` files, `#if os(macOS)`). Drives `Virtualization.framework` directly. +- **Linux**: `CHVirtualMachineManager` / `CHVirtualMachineInstance` (`CH*` files plus `CHProcess`, `VirtiofsdProcess`, `Vsock+Linux`, all `#if os(Linux)`). One `cloud-hypervisor` subprocess per VM, REST-on-UDS control plane via the standalone [`CloudHypervisor`](./Sources/CloudHypervisor) Swift package, virtio-blk / virtio-fs (one `virtiofsd` per share) / TAP / vsock for the data plane. Same `Vminitd` guest contract as VZ — only the host-side VMM differs. + +The `CloudHypervisor` library is a thin NIO-based HTTP/1.1-over-UDS client targeting cloud-hypervisor's REST API. It compiles on both platforms (so it can be unit-tested on macOS without a real cloud-hypervisor binary), but is only consumed by the Linux backend at runtime. + +**Sandbox env vars.** `CHProcess` and `VirtiofsdProcess` default to the upstream-secure spawn flags. Per-component opt-outs: + +- `CONTAINERIZATION_NO_CH_SECCOMP=1` — launch cloud-hypervisor with `--seccomp false`. +- `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1` — launch virtiofsd with `--sandbox none`. + +Both flags emit a one-line `logger.warning` at start so a relaxed-sandbox VM is loud in the host log. The legacy alias `CONTAINERIZATION_RELAXED_SANDBOX=1` continues to flip both at once. These are required inside apple/container's `--virtualization` dev container, where the host seccomp profile SIGSYS-kills both binaries; `make linux-integration` sets the legacy alias automatically. Leave them unset in production deployments where the host policy lets CH/virtiofsd run unmolested. + +### Library targets (`Sources/`) + +These are independently consumable Swift modules. Keep their dependencies narrow: + +- `Containerization` — the top-level orchestration layer (`LinuxContainer`, `LinuxPod`, `VMConfiguration`, `Vminitd` gRPC client wrapper, mounts, networking, sockets, image unpacking). Hosts both the macOS (VZ) and Linux (CH) VMM backends behind `#if os(...)`. +- `CloudHypervisor` — standalone NIO-based HTTP/1.1-over-UDS client targeting cloud-hypervisor's REST API. Cross-platform (compiles on macOS for unit tests; consumed at runtime only by the Linux side of `Containerization`). +- `ContainerizationOCI` — OCI image spec types, registry client (push/pull/auth), local OCI layout, content store. Used host-side for image management. +- `ContainerizationEXT4` — pure-Swift ext4 reader/formatter; used to build container rootfs blocks (`bin/initfs.ext4`). +- `ContainerizationArchive` — Swift wrapper around vendored libarchive headers (`Sources/ContainerizationArchive/CArchive`, refreshable via `make update-libarchive-source`). Links system `libarchive`, `lzma`, `bz2`, `z`, plus zstd via SwiftPM. +- `ContainerizationNetlink` — netlink socket bindings (used by vminitd for in-guest network configuration). +- `ContainerizationOS` — POSIX/Darwin/Linux platform shims (`Command`, `Terminal`, `Socket`, signal handling, mount syscalls, keychain). Cross-platform. +- `ContainerizationIO` — small NIO-flavored stream/reader utilities. +- `ContainerizationExtras`, `ContainerizationError`, `CShim` — shared helpers and a tiny C bridge. + +`Sources/Integration/` is the macOS-only `containerization-integration` binary (the integration test runner; it is not a `testTarget`, it's an `executableTarget` that's invoked by `make integration`). Unit `testTarget`s live under `Tests/`. + +### vminitd internals (`vminitd/Sources/`) + +- `VminitdCore/Server+GRPC.swift` is the bulk of the guest agent — it implements every RPC declared in `SandboxContext.proto`. +- `ManagedContainer.swift` / `ManagedProcess.swift` launch container processes via `vmexec` by default; `VminitdCore/Runc/` plus `RuncProcess.swift` shell out to `runc` only when an OCI runtime path is supplied. `ProcessSupervisor` reaps and dispatches exit events. +- `Cgroup/` handles cgroup v2 setup. `LCShim/` and `CVersion/` are small C bridges (the latter injects `GIT_COMMIT`/`GIT_TAG`/`BUILD_TIME` at compile time). +- `vmexec` runs a single container process inside the guest namespace and is what `vminitd` execs to launch container workloads. + +## Conventions + +- **License headers are required** on every Swift file. `make check-licenses` runs hawkeye against `scripts/license-header.txt`. New files: run `make update-licenses` (or `make fmt`) before committing. +- **Formatting**: `.swift-format` (line length 180, 4-space indent). The lint config (`.swift-format-nolint`) is what CI enforces. `NeverForceUnwrap`, `NeverUseForceTry`, and `NeverUseImplicitlyUnwrappedOptionals` are all on — don't introduce `!` / `try!`. +- **Package isolation**: prefer adding code to the smallest applicable module. Don't pull `Containerization` into `ContainerizationOCI` or similar — the leaf modules are intentionally light so they can be consumed standalone. +- **`SandboxContext.proto` is excluded from the `Containerization` target** (see `Package.swift`). The generated `.pb.swift` / `.grpc.swift` files are checked in. +- **Squash-and-merge**: PRs land as a single commit, so the PR title/body becomes the commit message — write it accordingly. Commits must be signed (per `CONTRIBUTING.md`). + +## Requirements + +Apple silicon Mac, macOS 26, Xcode 26. Swift toolchain version is pinned in `.swift-version` (currently `6.3.0`) and installed via Swiftly during `make cross-prep`. Older macOS releases are not supported. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..7326c97 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,116 @@ +# 🌈 📦️ Welcome to the Containerization community! 📦️ 🌈 + +Contributions to Containerization are welcomed and encouraged. + +## Index + +- [How you can help](#how-you-can-help) +- [Submitting issues and pull requests](#submitting-issues-and-pull-requests) +- [New to open source?](#new-to-open-source) +- [AI contribution guidelines](#ai-contribution-guidelines) +- [Code of conduct](#code-of-conduct) + +## How you can help + +We would love your contributions in the form of: + +🐛 Bug fixes\ +⚡️ Performance improvements\ +✨ API additions or enhancements\ +📝 Documentation\ +🧑‍💻 Project advocacy: blogs, conference talks, and more + +Anything else that could enhance the project! + +## Submitting issues and pull requests + +### Issues + +To file a bug or feature request, use [GitHub issues](https://github.com/apple/containerization/issues/new). + +🚧 For unexpected behavior or usability limitations, detailed instructions on how to reproduce the issue are appreciated. This will greatly help the priority setting and speed at which maintainers can get to your issue. + +### Pull requests + +We require all commits be signed with any of GitHub's supported methods, such as GPG or SSH. Information on how to set this up can be found on [GitHub's docs](https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification#about-commit-signature-verification). + +To make a pull request, use [GitHub](https://github.com/apple/containerization/compare). Please give the team a few days to review but it's ok to check in on occasion. We appreciate your contribution! + +> [!IMPORTANT] +> If you plan to make substantial changes or add new features, we encourage you to first discuss them with the wider containerization developer community. +> You can do this by filing a [GitHub issue](https://github.com/apple/containerization/issues/new). +> This will save time and increases the chance of your pull request being accepted. + +We use a "squash and merge" strategy to keep our `main` branch history clean and easy to follow. When your pull request +is merged, all of your commits will be combined into a single commit. + +With the "squash and merge" strategy, the *title* and *body* of your pull request is extremely important. It will become the commit message +for the squashed commit. Think of it as the single, definitive description of your contribution. + +Before merging, we'll review the pull request title and body to ensure it: + +* Clearly and concisely describes the changes. +* Uses the imperative mood (for example, "Add feature," "Fix bug"). +* Provides enough context for future developers to understand the purpose of the change. + +The pull request description should be concise and accurately describe the *what* and *why* of your changes. + +#### .gitignore contributions + +We do not currently accept contributions to add editor specific additions to the root .gitignore. We urge contributors to make a global .gitignore file with their rulesets they may want to add instead. A global .gitignore file can be set like so: + +```bash +git config --global core.excludesfile ~/.gitignore +``` + +#### Formatting contributions + +Make sure your contributions are consistent with the rest of the project's formatting. You can do this using our Makefile: + +```bash +make fmt +``` + +#### Applying license header to new files + +If you submit a contribution that adds a new file, please add the license header. You can do this using our Makefile: + +```bash +make update-licenses +``` + +## New to open source? + +### How do I pick something to work on? + +Take a look at the `good first issue` label in the [containerization](https://github.com/apple/containerization/contribute) or [container](https://github.com/apple/container/contribute) project. +Before you start working on an issue: +* Check the comments, assignees, and any references to pull requests — make sure nobody else is actively working on it, or awaiting help or review. +* If someone is assigned to the issue or volunteered to work on it, and there are no signs of progress or activity over at least the past month, don't hesitate to check in with them +* Leave a comment that you have started working on it. + +### Getting help + +Don't be afraid to ask for help! When asking for help, provide as much information as possible, while highlighting anything you think may be important. Refer to the [MAINTAINERS.txt](MAINTAINERS.txt) file for the appropriate people to ping. + +### I didn't get a response from someone. What should I do? + +It's possible that you ask someone a question in an issue/pull request and you don't get a response as quickly as you'd like. If you don't get a response within a week, it's okay to politely ping them using an `@` mention. If you don't get a response for 2-3 weeks in a row, please ping someone else. + +### I can't finish the contribution I started + +Sometimes an issue ends up bigger, harder, or more time-consuming than expected — **and that’s completely fine.** Be sure to comment on the issue saying you’re stepping away, so that someone else is able to pick it up. + +## AI contribution guidelines + +We welcome thoughtful use of AI tools in your contributions to this repository. We ask that you adhere to these rules in order to preserve the project's integrity, clarity, and quality, and to respect maintainer bandwidth: + +* You should be able to explain and justify every line of code or documentation that was generated or assisted by AI. Your submission should reflect your own understanding and intent. +* Use AI to augment, not totally replace, your reasoning or familiarity, especially for non-trivial parts of the system. +* Avoid dumping AI-generated walls of text that you cannot explain. Low-effort, unexplained submissions will be deprioritized to protect maintainer bandwidth. + +AI tools should be used to **enhance, not replace** the human elements that make OSS special: learning, collaboration, and community growth. + +## Code of conduct + +To clarify what is expected of our contributors and community members, the Containerization team has adopted the code of conduct defined by the Contributor Covenant. This document is used across many open source communities and articulates our values well. For more detail, please read the [Code of Conduct](https://github.com/apple/.github/blob/main/CODE_OF_CONDUCT.md "Code of Conduct"). diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..7a4a3ea --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/MAINTAINERS.txt b/MAINTAINERS.txt new file mode 100644 index 0000000..2b40e20 --- /dev/null +++ b/MAINTAINERS.txt @@ -0,0 +1,26 @@ +This file contains a list of maintainers and past maintainers who have made meaningful changes to this repository. + +### Maintainers + +Aditya Ramani (adityaramani) +AJ Emory (ajemory) +Danny Canter (dcantah) +Dmitry Kovba (dkovba) +Eric Ernst (egernst) +John Logan (jglogan) +Kathryn Baldauf (katiewasnothere) +Madhu Venugopal (mavenugo) +Michael Crosby (crosbymichael) +Raj Aryan Singh (realrajaryan) +Sidhartha Mani (wlan0) +Yibo Zhuang (yibozhuang) + + +### Emeritus maintainers + +Agam Dua (agamdua) +Evan Hazlett (ehazlett) +Gilbert Song (gilbert88) +Hugh Bussell (hughbussell) +Tanweer Noor (tanweernoor) +Ximena Perez Diaz (ximenanperez) diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..9c99a9e --- /dev/null +++ b/Makefile @@ -0,0 +1,448 @@ +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Build configuration variables +BUILD_CONFIGURATION ?= debug +WARNINGS_AS_ERRORS ?= true +SWIFT_CONFIGURATION := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),-Xswiftc -warnings-as-errors) --disable-automatic-resolution + +# Commonly used locations +UNAME_S := $(shell uname -s) +UNAME_M := $(shell uname -m) +KERNEL_ARCH := $(if $(filter $(UNAME_M),aarch64 arm64),arm64,$(UNAME_M)) +# Candidate kernel filenames in bin/ (compiled vmlinuz first, kata-fetched vmlinux fallback). +ifeq ($(KERNEL_ARCH),x86_64) +KERNEL_CANDIDATES := bin/vmlinuz-x86_64 bin/vmlinux-x86_64 +else +KERNEL_CANDIDATES := bin/vmlinux-$(KERNEL_ARCH) +endif +# In-repo KVM-capable kernel built by `make -C kernel` (vmlinuz for x86_64 bzImage, +# vmlinux for arm64 Image). linux-integration requires this; the kata-fetched +# kernel under bin/ does not enable KVM. +ifeq ($(KERNEL_ARCH),x86_64) +LINUX_INTEGRATION_KERNEL := kernel/vmlinuz-x86_64 +else +LINUX_INTEGRATION_KERNEL := kernel/vmlinux-$(KERNEL_ARCH) +endif +ifeq ($(UNAME_S),Darwin) +SWIFT ?= /usr/bin/swift +else +SWIFT ?= swift +endif + +ROOT_DIR := $(shell git rev-parse --show-toplevel) +BUILD_BIN_DIR = $(shell $(SWIFT) build -c $(BUILD_CONFIGURATION) --show-bin-path) +COV_DATA_DIR = $(shell $(SWIFT) test --show-coverage-path | xargs dirname) +COV_REPORT_FILE = $(ROOT_DIR)/code-coverage-report + +# Variables for libarchive integration +LIBARCHIVE_UPSTREAM_REPO := https://github.com/libarchive/libarchive +LIBARCHIVE_UPSTREAM_VERSION := v3.7.7 +LIBARCHIVE_LOCAL_DIR := workdir/libarchive + +KATA_BINARY_PACKAGE := https://github.com/kata-containers/kata-containers/releases/download/3.17.0/kata-static-3.17.0-arm64.tar.xz +CLOUD_HYPERVISOR_URL := https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v52.0/cloud-hypervisor-static-aarch64 +# SHA256 of the v52.0 aarch64 static binary (verified locally from the +# upstream release artifact). Bump alongside CLOUD_HYPERVISOR_URL. +CLOUD_HYPERVISOR_SHA256 := bf004ddc1a148f47caa87ac49a783b8dbd6bf9bc27abe522ed197df7b982d3b1 + +SWIFT_VERSION := $(shell cat $(ROOT_DIR)/.swift-version) +SWIFT_SDK_URL := $(shell grep '^SWIFT_SDK_URL' vminitd/Makefile | head -1 | sed 's/.*:= *//') +SWIFT_SDK_CHECKSUM := $(shell grep '^SWIFT_SDK_CHECKSUM' vminitd/Makefile | head -1 | sed 's/.*:= *//') +LINUX_DEV_IMAGE := containerization-dev:$(SWIFT_VERSION) + +# Literal `,` for use inside $(call ...) arguments — bare commas are +# treated as the call's argument separator and split the value early. +comma := , + +# Run a command inside a Linux dev container. +# Requires 'container' (https://github.com/apple/container). +# Automatically builds the dev image if it doesn't exist. +# +# Bind-mounts $(ROOT_DIR)/.local/integration-cache → the dev container's +# appRoot (`~/.local/share/com.apple.containerization`) so cctl-populated +# imageStore content (e.g. `vminit:latest` from `make init`, plus images +# pulled by the integration suite like alpine) persists across `container +# run` invocations. Without this, every `make linux-integration` re-pulls +# alpine and re-imports vminit, which dominates per-suite ramp-up. The +# macOS path gets this for free because $HOME persists. +# +# $(1): bash command to run inside the container. +# $(2): optional extra flags for `container run` (empty by default). Use this +# for linux-integration to pass `--kernel kernel/vmlinux-` so +# /dev/kvm is exposed in the dev container's Linux VM (the kata kernel +# fetched by `make fetch-default-kernel` does not enable KVM). +define linux_run + @if ! command -v container > /dev/null 2>&1; then \ + echo "Error: 'container' CLI not found. Install from https://github.com/apple/container"; \ + exit 1; \ + fi + @if ! container image list -q 2>/dev/null | grep -q "$(LINUX_DEV_IMAGE)"; then \ + echo "Building Linux dev container image..."; \ + $(MAKE) linux-image; \ + fi + @mkdir -p $(ROOT_DIR)/.local/integration-cache + @container run --rm $(2) --memory 16gb --cpus 8 --virtualization \ + -v $(ROOT_DIR):/workspace \ + -v $(ROOT_DIR)/.local/integration-cache:/root/.local/share/com.apple.containerization \ + -w /workspace $(LINUX_DEV_IMAGE) \ + bash -c "$(1)" +endef + +include Protobuf.Makefile +.DEFAULT_GOAL := all + +.PHONY: deps +deps: +ifeq ($(UNAME_S),Linux) + sudo apt-get install -y libarchive-dev libbz2-dev liblzma-dev libssl-dev +else + @echo "No additional dependencies required on $(UNAME_S)" +endif + +ifeq ($(UNAME_S),Darwin) +.PHONY: linux-image +linux-image: + container build \ + --progress plain \ + -f images/linux-dev/Dockerfile \ + --build-arg SWIFT_VERSION=$(SWIFT_VERSION) \ + --build-arg SWIFT_SDK_URL=$(SWIFT_SDK_URL) \ + --build-arg SWIFT_SDK_CHECKSUM=$(SWIFT_SDK_CHECKSUM) \ + -t $(LINUX_DEV_IMAGE) \ + . + +.PHONY: linux-build +linux-build: LIBC ?= musl +linux-build: +ifeq ($(LIBC),all) + $(call linux_run,make containerization && make -C vminitd LIBC=glibc && make -C vminitd LIBC=musl && make init) +else + $(call linux_run,make containerization && make -C vminitd LIBC=$(LIBC) && make init) +endif + +.PHONY: linux-test +linux-test: + $(call linux_run,swift test $(SWIFT_CONFIGURATION)) + +.PHONY: build-cloud-hypervisor +# Build cloud-hypervisor from the patched source at .local/cloud-hypervisor and +# install it to bin/cloud-hypervisor. Runs inside the Linux dev container so the +# resulting binary is aarch64-linux-gnu and can run nested-virt under +# `container run --virtualization`. Installs build deps + rustup the first +# time. Forces HOME=/root since the container inherits the host HOME otherwise, +# which breaks rustup's $HOME/.cargo path. +# +# Prerequisite: clone cloud-hypervisor into .local/cloud-hypervisor (any +# revision compatible with the v52.0 REST surface this repo targets). There +# is no fetch target — pin the revision deliberately. Example: +# git clone -b v52.0 https://github.com/cloud-hypervisor/cloud-hypervisor \ +# .local/cloud-hypervisor +build-cloud-hypervisor: +ifeq (,$(wildcard .local/cloud-hypervisor/Cargo.toml)) + @echo "missing .local/cloud-hypervisor source checkout." >&2 + @echo "clone the cloud-hypervisor repo into .local/cloud-hypervisor before running this target, e.g.:" >&2 + @echo " git clone -b v52.0 https://github.com/cloud-hypervisor/cloud-hypervisor .local/cloud-hypervisor" >&2 + @exit 1 +endif + $(call linux_run,export HOME=/root && if ! command -v curl >/dev/null 2>&1; then apt-get update && apt-get install -y --no-install-recommends curl ca-certificates build-essential pkg-config libssl-dev; fi && if [ ! -x /root/.cargo/bin/cargo ]; then curl --proto =https --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal; fi && . /root/.cargo/env && cd .local/cloud-hypervisor && cargo build --release --bin cloud-hypervisor && cp target/release/cloud-hypervisor /workspace/bin/cloud-hypervisor && chmod +x /workspace/bin/cloud-hypervisor) + +.PHONY: build-virtiofsd +# Build virtiofsd from the source at .local/virtiofsd and install it to +# bin/virtiofsd. Runs inside the Linux dev container so the resulting +# binary is aarch64-linux-gnu and matches the cloud-hypervisor binary +# built by `make build-cloud-hypervisor`. +# +# Prerequisite: clone virtiofsd into .local/virtiofsd (any revision the +# scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch applies +# cleanly to). There is no fetch target — pin the revision deliberately: +# git clone https://gitlab.com/virtio-fs/virtiofsd .local/virtiofsd +# +# virtiofsd has two hard build deps that aren't in the base dev image: +# * libcap-ng-dev — capng crate is unconditional in [dependencies]. +# * libseccomp-dev — Cargo.toml has `default = ["seccomp"]` and +# `[[bin]] required-features = ["seccomp"]`, and libseccomp-sys is a +# -sys crate that links against the system library via pkg-config. +# Both are required even though we run with `--sandbox none` (capng is +# called for capability-drop at startup, before any sandbox setup). +# +# Before building, applies the patch at +# scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch (see +# that file for rationale). Idempotent: skips if already applied via +# git apply --reverse --check. +# +# Sentinel for the apt-get block is libcap-ng + libseccomp via pkg-config +# (not `command -v curl`) so this target works correctly even after +# `build-cloud-hypervisor` has already installed curl in the same dev +# container. +build-virtiofsd: +ifeq (,$(wildcard .local/virtiofsd/Cargo.toml)) + @echo "missing .local/virtiofsd source checkout." >&2 + @echo "clone the virtiofsd repo into .local/virtiofsd before running this target, e.g.:" >&2 + @echo " git clone https://gitlab.com/virtio-fs/virtiofsd .local/virtiofsd" >&2 + @exit 1 +endif + $(call linux_run,export HOME=/root && \ + if ! pkg-config --exists libcap-ng libseccomp 2>/dev/null; then \ + apt-get update && apt-get install -y --no-install-recommends \ + curl ca-certificates build-essential pkg-config libssl-dev \ + libcap-ng-dev libseccomp-dev; \ + fi && \ + if [ ! -x /root/.cargo/bin/cargo ]; then \ + curl --proto =https --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal; \ + fi && \ + . /root/.cargo/env && \ + cd /workspace/.local/virtiofsd && \ + if git apply --check /workspace/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch 2>/dev/null; then \ + git apply /workspace/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch && \ + echo "applied virtiofsd cap-drop patch"; \ + elif git apply --reverse --check /workspace/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch 2>/dev/null; then \ + echo "virtiofsd cap-drop patch already applied"; \ + else \ + echo "ERROR: virtiofsd cap-drop patch does not apply cleanly" >&2; \ + exit 1; \ + fi && \ + cargo build --release && \ + cp target/release/virtiofsd /workspace/bin/virtiofsd && \ + chmod +x /workspace/bin/virtiofsd) + +.PHONY: linux-integration +linux-integration: +ifeq (,$(wildcard bin/cloud-hypervisor)) + @echo "missing bin/cloud-hypervisor; run 'make fetch-cloud-hypervisor' first" + @exit 1 +endif +ifeq (,$(wildcard bin/virtiofsd)) + @echo "missing bin/virtiofsd; run 'make build-virtiofsd' first" + @exit 1 +endif +ifeq (,$(wildcard $(LINUX_INTEGRATION_KERNEL))) + @echo "missing $(LINUX_INTEGRATION_KERNEL); run 'make -C kernel' first to build a KVM-capable kernel" + @exit 1 +endif +ifeq (,$(wildcard bin/containerization-integration)) + @echo "missing bin/containerization-integration; run 'make linux-build' first" + @exit 1 +endif +ifeq (,$(wildcard bin/initfs.ext4)) + @echo "missing bin/initfs.ext4; run 'make init' first (this also seeds the persistent imageStore at .local/integration-cache)" + @exit 1 +endif + $(call linux_run,CONTAINERIZATION_RELAXED_SANDBOX=1 ./bin/containerization-integration --kernel ./$(LINUX_INTEGRATION_KERNEL) --ch-binary ./bin/cloud-hypervisor --virtiofsd-binary ./bin/virtiofsd --max-concurrency 1,--kernel $(LINUX_INTEGRATION_KERNEL)) + +# Builds the x86_64 deployment tarball. +# +# Cross-compiles cctl, vminitd, cloud-hypervisor, and virtiofsd to +# x86_64-linux-musl inside the aarch64 Linux dev container (using the +# musl cross toolchain + static C deps installed by the dev image), +# packs an initfs.ext4 with the x86_64 vminitd inside, and emits +# bin/containerization-x86_64-.tar.gz. +# +# Depends on linux-image so that Dockerfile / build-musl-x86_64-deps.sh +# changes are picked up automatically. `container build` is cheap when +# layers are cached, so the no-change path is a few seconds of overhead. +# +# Prereqs: +# * .local/cloud-hypervisor and .local/virtiofsd source checkouts +# (see build-cloud-hypervisor / build-virtiofsd for clone URLs). +# * kernel/vmlinuz-x86_64 (preferred) or kernel/vmlinux-x86_64 present. +# Build via `make -C kernel TARGET_ARCH=x86_64` (or `make -C kernel x86_64`). +# The script fails hard if neither is present. +.PHONY: dist-x86_64 +dist-x86_64: linux-image + $(call linux_run,./scripts/build-dist-x86_64.sh) +endif + +.PHONY: all +all: containerization +all: init + +.PHONY: release +release: BUILD_CONFIGURATION = release +release: all + +.PHONY: containerization +containerization: + @echo Building containerization binaries... + @$(SWIFT) --version + @$(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) + + @echo Copying containerization binaries... + @mkdir -p bin + @install "$(BUILD_BIN_DIR)/cctl" ./bin/ + @install "$(BUILD_BIN_DIR)/containerization-integration" ./bin/ +ifeq ($(UNAME_S),Darwin) + @echo Signing containerization binaries... + @codesign --force --sign - --timestamp=none --entitlements=signing/vz.entitlements bin/cctl + @codesign --force --sign - --timestamp=none --entitlements=signing/vz.entitlements bin/containerization-integration +endif + +.PHONY: init +init: containerization vminitd + @echo Creating init.ext4... + @rm -f bin/init.rootfs.tar.gz bin/init.block bin/initfs.ext4 + @./bin/cctl rootfs create \ + --vminitd vminitd/bin/vminitd \ + --vmexec vminitd/bin/vmexec \ + --ext4 ./bin/initfs.ext4 \ + --label org.opencontainers.image.source=https://github.com/apple/containerization \ + --image vminit:latest \ + bin/init.rootfs.tar.gz + +.PHONY: cross-prep +cross-prep: + @"$(MAKE)" -C vminitd cross-prep + +.PHONY: vminitd +vminitd: + @mkdir -p ./bin + @"$(MAKE)" -C vminitd BUILD_CONFIGURATION=$(BUILD_CONFIGURATION) WARNINGS_AS_ERRORS=$(WARNINGS_AS_ERRORS) + +.PHONY: update-libarchive-source +update-libarchive-source: + @echo Updating the libarchive source files... + @git clone $(LIBARCHIVE_UPSTREAM_REPO) --depth 1 --branch $(LIBARCHIVE_UPSTREAM_VERSION) "$(LIBARCHIVE_LOCAL_DIR)" + @cp "$(LIBARCHIVE_LOCAL_DIR)/libarchive/archive_entry.h" Sources/ContainerizationArchive/CArchive/include + @cp "$(LIBARCHIVE_LOCAL_DIR)/libarchive/archive.h" Sources/ContainerizationArchive/CArchive/include + @cp "$(LIBARCHIVE_LOCAL_DIR)/COPYING" Sources/ContainerizationArchive/CArchive/COPYING + @rm -rf "$(LIBARCHIVE_LOCAL_DIR)" + +.PHONY: test +test: + @echo Testing all test targets... + @$(SWIFT) test --enable-code-coverage $(SWIFT_CONFIGURATION) + +.PHONY: coverage +coverage: test + @echo Generating code coverage report... + @xcrun llvm-cov show --compilation-dir=`pwd` \ + -instr-profile=$(COV_DATA_DIR)/default.profdata \ + --ignore-filename-regex=".build/" \ + --ignore-filename-regex=".pb.swift" \ + --ignore-filename-regex=".proto" \ + --ignore-filename-regex=".grpc.swift" \ + $(BUILD_BIN_DIR)/containerizationPackageTests.xctest/Contents/MacOS/containerizationPackageTests > $(COV_REPORT_FILE) + @echo Code coverage report generated: $(COV_REPORT_FILE) + +.PHONY: integration +integration: + @kernel="$$(for f in $(KERNEL_CANDIDATES); do [ -f $$f ] && echo $$f && break; done)"; \ + if [ -z "$$kernel" ]; then \ + echo "No kernel found. Looked for: $(KERNEL_CANDIDATES). See fetch-default-kernel target or build via kernel/Makefile."; \ + exit 1; \ + fi; \ + echo "Running the integration tests with kernel $$kernel..."; \ + ./bin/containerization-integration --kernel "$$kernel" + +.PHONY: fetch-default-kernel +fetch-default-kernel: + @mkdir -p .local/ bin/ +ifeq (,$(wildcard .local/kata.tar.gz)) + @curl -SsL -o .local/kata.tar.gz ${KATA_BINARY_PACKAGE} +endif +ifeq (,$(wildcard .local/vmlinux-$(KERNEL_ARCH))) + @tar -zxf .local/kata.tar.gz -C .local/ --strip-components=1 + @cp -L .local/opt/kata/share/kata-containers/vmlinux.container .local/vmlinux-$(KERNEL_ARCH) +endif +ifeq (,$(wildcard bin/vmlinux-$(KERNEL_ARCH))) + @cp .local/vmlinux-$(KERNEL_ARCH) bin/vmlinux-$(KERNEL_ARCH) +endif + +.PHONY: fetch-cloud-hypervisor +fetch-cloud-hypervisor: + @mkdir -p bin + @curl -SsL -o bin/cloud-hypervisor $(CLOUD_HYPERVISOR_URL) + @actual=$$(shasum -a 256 bin/cloud-hypervisor | awk '{print $$1}'); \ + if [ "$$actual" != "$(CLOUD_HYPERVISOR_SHA256)" ]; then \ + echo "ERROR: cloud-hypervisor checksum mismatch" >&2; \ + echo " expected: $(CLOUD_HYPERVISOR_SHA256)" >&2; \ + echo " actual: $$actual" >&2; \ + rm -f bin/cloud-hypervisor; \ + exit 1; \ + fi + @chmod +x bin/cloud-hypervisor + +.PHONY: check +check: swift-fmt-check check-licenses + +.PHONY: fmt +fmt: swift-fmt update-licenses + +.PHONY: swift-fmt +SWIFT_SRC = $(shell find . -type f -name '*.swift' -not -path "*/.*" -not -path "*.pb.swift" -not -path "*.grpc.swift" -not -path "*/checkouts/*") +swift-fmt: + @echo Applying the standard code formatting... + @$(SWIFT) format --recursive --configuration .swift-format -i $(SWIFT_SRC) + +swift-fmt-check: + @echo Checking code formatting compliance... + @$(SWIFT) format lint --recursive --strict --configuration .swift-format-nolint $(SWIFT_SRC) + +.PHONY: update-licenses +update-licenses: + @echo Updating license headers... + @./scripts/ensure-hawkeye-exists.sh + @.local/bin/hawkeye format --fail-if-unknown --fail-if-updated false + +.PHONY: check-licenses +check-licenses: + @echo Checking license headers existence in source files... + @./scripts/ensure-hawkeye-exists.sh + @.local/bin/hawkeye check --fail-if-unknown + +.PHONY: pre-commit +pre-commit: + cp Scripts/pre-commit.fmt .git/hooks + touch .git/hooks/pre-commit + cat .git/hooks/pre-commit | grep -v 'hooks/pre-commit\.fmt' > /tmp/pre-commit.new || true + echo 'PRECOMMIT_NOFMT=$${PRECOMMIT_NOFMT} $$(git rev-parse --show-toplevel)/.git/hooks/pre-commit.fmt' >> /tmp/pre-commit.new + mv /tmp/pre-commit.new .git/hooks/pre-commit + chmod +x .git/hooks/pre-commit + +.PHONY: serve-docs +serve-docs: + @echo 'to browse: open http://127.0.0.1:8000/containerization/documentation/' + @rm -rf _serve + @mkdir -p _serve + @cp -a _site _serve/containerization + @python3 -m http.server --bind 127.0.0.1 --directory ./_serve + +.PHONY: docs +docs: + @echo Updating API documentation... + @rm -rf _site + @scripts/make-docs.sh _site containerization + +.PHONY: cleancontent +cleancontent: + @echo Cleaning the content... + @rm -rf ~/Library/Application\ Support/com.apple.containerization + +.PHONY: examples +examples: + @echo Building examples... + @mkdir -p bin + @"$(MAKE)" -C examples/sandboxy build BUILD_CONFIGURATION=$(BUILD_CONFIGURATION) + @install examples/sandboxy/bin/sandboxy ./bin/ + @codesign --force --sign - --timestamp=none --entitlements=signing/vz.entitlements bin/sandboxy + +.PHONY: clean +clean: + @echo Cleaning build files... + @rm -rf bin/ + @rm -rf _site/ + @rm -rf _serve/ + @rm -f $(COV_REPORT_FILE) + @$(SWIFT) package clean + @"$(MAKE)" -C vminitd clean diff --git a/Package.resolved b/Package.resolved new file mode 100644 index 0000000..2e5a69f --- /dev/null +++ b/Package.resolved @@ -0,0 +1,249 @@ +{ + "originHash" : "2b73182b4d0f81b61ee24d8e615d350d28301517488d944fafddde15bc854cdc", + "pins" : [ + { + "identity" : "async-http-client", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/async-http-client.git", + "state" : { + "revision" : "60235983163d040f343a489f7e2e77c1918a8bd9", + "version" : "1.26.1" + } + }, + { + "identity" : "grpc-swift-2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-2.git", + "state" : { + "revision" : "f28854bc760a116e053fdfc4a48a9428c34625c0", + "version" : "2.3.0" + } + }, + { + "identity" : "grpc-swift-nio-transport", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-nio-transport.git", + "state" : { + "revision" : "2ca31f06658ed288a2560e23ad649acbb3d6b3a3", + "version" : "2.9.0" + } + }, + { + "identity" : "grpc-swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-protobuf.git", + "state" : { + "revision" : "19153231a03c2fda1f4ea60da1b92a2cb9c011d8", + "version" : "2.2.0" + } + }, + { + "identity" : "swift-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-algorithms.git", + "state" : { + "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023", + "version" : "1.2.1" + } + }, + { + "identity" : "swift-argument-parser", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-argument-parser.git", + "state" : { + "revision" : "c5d11a805e765f52ba34ec7284bd4fcd6ba68615", + "version" : "1.7.0" + } + }, + { + "identity" : "swift-asn1", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-asn1.git", + "state" : { + "revision" : "a54383ada6cecde007d374f58f864e29370ba5c3", + "version" : "1.3.2" + } + }, + { + "identity" : "swift-async-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-async-algorithms.git", + "state" : { + "revision" : "042e1c4d9d19748c9c228f8d4ebc97bb1e339b0b", + "version" : "1.0.4" + } + }, + { + "identity" : "swift-atomics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-atomics.git", + "state" : { + "revision" : "cd142fd2f64be2100422d658e7411e39489da985", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-certificates", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-certificates.git", + "state" : { + "revision" : "f4cd9e78a1ec209b27e426a5f5c693675f95e75a", + "version" : "1.15.0" + } + }, + { + "identity" : "swift-collections", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-collections.git", + "state" : { + "revision" : "c1805596154bb3a265fd91b8ac0c4433b4348fb0", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-crypto", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-crypto.git", + "state" : { + "revision" : "e8d6eba1fef23ae5b359c46b03f7d94be2f41fed", + "version" : "3.12.3" + } + }, + { + "identity" : "swift-docc-plugin", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swiftlang/swift-docc-plugin", + "state" : { + "revision" : "d1691545d53581400b1de9b0472d45eb25c19fed", + "version" : "1.4.4" + } + }, + { + "identity" : "swift-docc-symbolkit", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swiftlang/swift-docc-symbolkit", + "state" : { + "revision" : "b45d1f2ed151d057b54504d653e0da5552844e34", + "version" : "1.0.0" + } + }, + { + "identity" : "swift-http-structured-headers", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-structured-headers.git", + "state" : { + "revision" : "db6eea3692638a65e2124990155cd220c2915903", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-http-types", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-types.git", + "state" : { + "revision" : "a0a57e949a8903563aba4615869310c0ebf14c03", + "version" : "1.4.0" + } + }, + { + "identity" : "swift-log", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-log.git", + "state" : { + "revision" : "bbd81b6725ae874c69e9b8c8804d462356b55523", + "version" : "1.10.1" + } + }, + { + "identity" : "swift-nio", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio.git", + "state" : { + "revision" : "f71c8d2a5e74a2c6d11a0fbe324774b5d6084237", + "version" : "2.99.0" + } + }, + { + "identity" : "swift-nio-extras", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-extras.git", + "state" : { + "revision" : "145db1962f4f33a4ea07a32e751d5217602eea29", + "version" : "1.28.0" + } + }, + { + "identity" : "swift-nio-http2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-http2.git", + "state" : { + "revision" : "81cc18264f92cd307ff98430f89372711d4f6fe9", + "version" : "1.43.0" + } + }, + { + "identity" : "swift-nio-ssl", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-ssl.git", + "state" : { + "revision" : "173cc69a058623525a58ae6710e2f5727c663793", + "version" : "2.36.0" + } + }, + { + "identity" : "swift-nio-transport-services", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-transport-services.git", + "state" : { + "revision" : "cd1e89816d345d2523b11c55654570acd5cd4c56", + "version" : "1.24.0" + } + }, + { + "identity" : "swift-numerics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-numerics.git", + "state" : { + "revision" : "e0ec0f5f3af6f3e4d5e7a19d2af26b481acb6ba8", + "version" : "1.0.3" + } + }, + { + "identity" : "swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-protobuf.git", + "state" : { + "revision" : "86970144a0b86068c81ff48ee29b3f97cae0b879", + "version" : "1.36.0" + } + }, + { + "identity" : "swift-service-lifecycle", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/swift-service-lifecycle.git", + "state" : { + "revision" : "e7187309187695115033536e8fc9b2eb87fd956d", + "version" : "2.8.0" + } + }, + { + "identity" : "swift-system", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-system.git", + "state" : { + "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df", + "version" : "1.6.4" + } + }, + { + "identity" : "zstd", + "kind" : "remoteSourceControl", + "location" : "https://github.com/facebook/zstd.git", + "state" : { + "revision" : "f8745da6ff1ad1e7bab384bd1f9d742439278e99", + "version" : "1.5.7" + } + } + ], + "version" : 3 +} diff --git a/Package.swift b/Package.swift new file mode 100644 index 0000000..a4e4b4e --- /dev/null +++ b/Package.swift @@ -0,0 +1,337 @@ +// swift-tools-version: 6.2 +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// The swift-tools-version declares the minimum version of Swift required to build this package. + +import CompilerPluginSupport +import Foundation +import PackageDescription + +let package = Package( + name: "containerization", + platforms: [.macOS("15.0")], + products: [ + .library(name: "Containerization", targets: ["Containerization", "ContainerizationError"]), + .library(name: "ContainerizationEXT4", targets: ["ContainerizationEXT4"]), + .library(name: "ContainerizationOCI", targets: ["ContainerizationOCI"]), + .library(name: "ContainerizationNetlink", targets: ["ContainerizationNetlink"]), + .library(name: "ContainerizationIO", targets: ["ContainerizationIO"]), + .library(name: "ContainerizationOS", targets: ["ContainerizationOS"]), + .library(name: "ContainerizationExtras", targets: ["ContainerizationExtras"]), + .library(name: "ContainerizationArchive", targets: ["ContainerizationArchive"]), + .library(name: "VminitdCore", targets: ["VminitdCore", "Cgroup", "LCShim"]), + .library(name: "CloudHypervisor", targets: ["CloudHypervisor"]), + .executable(name: "cctl", targets: ["cctl"]), + ], + dependencies: [ + .package(url: "https://github.com/apple/swift-log.git", from: "1.10.1"), + .package(url: "https://github.com/apple/swift-argument-parser.git", from: "1.7.0"), + .package(url: "https://github.com/apple/swift-collections.git", from: "1.1.4"), + .package(url: "https://github.com/apple/swift-crypto.git", from: "3.0.0"), + .package(url: "https://github.com/grpc/grpc-swift-2.git", from: "2.3.0"), + .package(url: "https://github.com/grpc/grpc-swift-nio-transport.git", from: "2.9.0"), + .package(url: "https://github.com/grpc/grpc-swift-protobuf.git", from: "2.2.0"), + .package(url: "https://github.com/apple/swift-protobuf.git", from: "1.36.0"), + .package(url: "https://github.com/apple/swift-nio.git", from: "2.80.0"), + .package(url: "https://github.com/apple/swift-nio-ssl.git", from: "2.36.0"), + .package(url: "https://github.com/swift-server/async-http-client.git", from: "1.20.1"), + .package(url: "https://github.com/apple/swift-system.git", from: "1.6.4"), + .package(url: "https://github.com/swiftlang/swift-docc-plugin", from: "1.1.0"), + .package(url: "https://github.com/facebook/zstd.git", exact: "1.5.7"), + ], + targets: [ + .target( + name: "ContainerizationError" + ), + .target( + name: "Containerization", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + .product(name: "SystemPackage", package: "swift-system"), + .product(name: "GRPCCore", package: "grpc-swift-2"), + .product(name: "GRPCNIOTransportHTTP2", package: "grpc-swift-nio-transport"), + .product(name: "GRPCProtobuf", package: "grpc-swift-protobuf"), + .product(name: "_NIOFileSystem", package: "swift-nio"), + "CloudHypervisor", + "ContainerizationArchive", + "ContainerizationOCI", + "ContainerizationOS", + "ContainerizationIO", + "ContainerizationExtras", + "ContainerizationEXT4", + "ContainerizationNetlink", + "CShim", + ], + exclude: [ + "../Containerization/SandboxContext/SandboxContext.proto" + ] + ), + .executableTarget( + name: "cctl", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + .product(name: "ArgumentParser", package: "swift-argument-parser"), + "Containerization", + "ContainerizationArchive", + "ContainerizationEXT4", + "ContainerizationExtras", + "ContainerizationOCI", + "ContainerizationOS", + ] + ), + .testTarget( + name: "ContainerizationUnitTests", + dependencies: ["Containerization", "CloudHypervisor"], + path: "Tests/ContainerizationTests", + resources: [ + .copy("ImageTests/Resources/scratch.tar"), + .copy("ImageTests/Resources/scratch_no_annotations.tar"), + ] + ), + .target( + name: "ContainerizationEXT4", + dependencies: [ + "ContainerizationArchive", + .product(name: "SystemPackage", package: "swift-system"), + "ContainerizationOS", + ], + path: "Sources/ContainerizationEXT4", + exclude: [ + "README.md" + ] + ), + .testTarget( + name: "ContainerizationEXT4Tests", + dependencies: [ + "ContainerizationEXT4", + "ContainerizationArchive", + ], + resources: [ + .copy( + "Resources/content/blobs/sha256/ad59e9f71edceca7b1ac7c642410858489b743c97233b0a26a5e2098b1443762"), // index + .copy( + "Resources/content/blobs/sha256/48a06049d3738991b011ca8b12473d712b7c40666a1462118dae3c403676afc2"), // manifest + .copy( + "Resources/content/blobs/sha256/8e2eb240a6cd7be1a0d308125afe0060b020e89275ced2e729eda7d4eeff62a2"), // config + .copy( + "Resources/content/blobs/sha256/c6b39de5b33961661dc939b997cc1d30cda01e38005a6c6625fd9c7e748bab44"), // layer 1 + .copy( + "Resources/content/blobs/sha256/4f4fb700ef54461cfa02571ae0db9a0dc1e0cdb5577484a6d75e68dc38e8acc1"), // layer 2 + ] + ), + .target( + name: "ContainerizationArchive", + dependencies: [ + .product(name: "SystemPackage", package: "swift-system"), + "CArchive", + "ContainerizationExtras", + "ContainerizationOS", + ], + exclude: [ + "CArchive" + ] + ), + .testTarget( + name: "ContainerizationArchiveTests", + dependencies: [ + "ContainerizationArchive" + ], + resources: [ + .copy("Resources/test.tar.zst") + ] + ), + .target( + name: "CArchive", + dependencies: [ + .product(name: "libzstd", package: "zstd") + ], + path: "Sources/ContainerizationArchive/CArchive", + sources: [ + "archive_swift_bridge.c" + ], + cSettings: [ + .define( + "PLATFORM_CONFIG_H", to: "\"config_darwin.h\"", + .when(platforms: [.iOS, .macOS, .macCatalyst, .watchOS, .driverKit, .tvOS])), + .define("PLATFORM_CONFIG_H", to: "\"config_linux.h\"", .when(platforms: [.linux])), + .unsafeFlags(["-fno-modules"]), + ], + linkerSettings: [ + .linkedLibrary("z"), + .linkedLibrary("bz2"), + .linkedLibrary("lzma"), + .linkedLibrary("archive"), + .linkedLibrary("iconv", .when(platforms: [.macOS])), + .linkedLibrary("crypto", .when(platforms: [.linux])), + ] + ), + .target( + name: "ContainerizationOCI", + dependencies: [ + .product(name: "AsyncHTTPClient", package: "async-http-client"), + .product(name: "Crypto", package: "swift-crypto"), + .product(name: "Logging", package: "swift-log"), + .product(name: "_NIOFileSystem", package: "swift-nio"), + "ContainerizationError", + "ContainerizationOS", + "ContainerizationExtras", + ] + ), + .testTarget( + name: "ContainerizationOCITests", + dependencies: [ + "ContainerizationOCI", + "Containerization", + "ContainerizationIO", + .product(name: "NIO", package: "swift-nio"), + .product(name: "Crypto", package: "swift-crypto"), + ] + ), + .target( + name: "ContainerizationNetlink", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + "ContainerizationOS", + "ContainerizationExtras", + ] + ), + .testTarget( + name: "ContainerizationNetlinkTests", + dependencies: [ + "ContainerizationNetlink" + ] + ), + .target( + name: "ContainerizationOS", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + .product(name: "SystemPackage", package: "swift-system"), + "CShim", + "ContainerizationError", + ], + exclude: [ + "../ContainerizationOS/README.md" + ] + ), + .testTarget( + name: "ContainerizationOSTests", + dependencies: [ + .product(name: "SystemPackage", package: "swift-system"), + "ContainerizationOS", + "ContainerizationExtras", + ] + ), + .target( + name: "ContainerizationIO", + dependencies: [ + "ContainerizationOS", + .product(name: "NIO", package: "swift-nio"), + .product(name: "NIOCore", package: "swift-nio"), + .product(name: "NIOFoundationCompat", package: "swift-nio"), + ] + ), + .target( + name: "ContainerizationExtras", + dependencies: [ + "ContainerizationError", + .product(name: "Collections", package: "swift-collections"), + .product(name: "Logging", package: "swift-log"), + .product(name: "NIOSSL", package: "swift-nio-ssl"), + + ] + ), + .testTarget( + name: "ContainerizationExtrasTests", + dependencies: [ + "ContainerizationExtras", + "CShim", + ] + ), + .target( + name: "CShim" + ), + .target( + name: "CloudHypervisor", + dependencies: [ + .product(name: "AsyncHTTPClient", package: "async-http-client"), + .product(name: "Logging", package: "swift-log"), + .product(name: "NIOCore", package: "swift-nio"), + .product(name: "NIOPosix", package: "swift-nio"), + .product(name: "NIOHTTP1", package: "swift-nio"), + .product(name: "NIOConcurrencyHelpers", package: "swift-nio"), + ] + ), + .testTarget( + name: "CloudHypervisorTests", + dependencies: [ + "CloudHypervisor", + .product(name: "NIOCore", package: "swift-nio"), + .product(name: "NIOPosix", package: "swift-nio"), + .product(name: "NIOHTTP1", package: "swift-nio"), + .product(name: "NIOConcurrencyHelpers", package: "swift-nio"), + ] + ), + .target( + name: "LCShim", + path: "vminitd/Sources/LCShim" + ), + .target( + name: "Cgroup", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + "ContainerizationOCI", + "ContainerizationOS", + .product(name: "SystemPackage", package: "swift-system"), + "LCShim", + ], + path: "vminitd/Sources/Cgroup" + ), + .target( + name: "VminitdCore", + dependencies: [ + .product(name: "ArgumentParser", package: "swift-argument-parser"), + .product(name: "Logging", package: "swift-log"), + "Containerization", + "ContainerizationArchive", + "ContainerizationNetlink", + "ContainerizationIO", + "ContainerizationOS", + .product(name: "SystemPackage", package: "swift-system"), + .product(name: "GRPCCore", package: "grpc-swift-2"), + .product(name: "GRPCNIOTransportHTTP2", package: "grpc-swift-nio-transport"), + .product(name: "GRPCProtobuf", package: "grpc-swift-protobuf"), + "LCShim", + "Cgroup", + ], + path: "vminitd/Sources/VminitdCore" + ), + ] +) + +package.targets.append( + .executableTarget( + name: "containerization-integration", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + .product(name: "ArgumentParser", package: "swift-argument-parser"), + .product(name: "NIOCore", package: "swift-nio"), + .product(name: "NIOPosix", package: "swift-nio"), + "Containerization", + ], + path: "Sources/Integration" + ) +) diff --git a/Protobuf.Makefile b/Protobuf.Makefile new file mode 100644 index 0000000..31e2293 --- /dev/null +++ b/Protobuf.Makefile @@ -0,0 +1,55 @@ +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +LOCAL_DIR := $(ROOT_DIR)/.local +LOCAL_BIN_DIR := $(LOCAL_DIR)/bin + +# Versions +PROTOC_VERSION := 26.1 + +# Protoc binary installation +PROTOC_ZIP := protoc-$(PROTOC_VERSION)-osx-universal_binary.zip +PROTOC := $(LOCAL_BIN_DIR)/protoc@$(PROTOC_VERSION)/protoc +$(PROTOC): + @echo Downloading protocol buffers... + @mkdir -p $(LOCAL_DIR) + @curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v$(PROTOC_VERSION)/$(PROTOC_ZIP) + @mkdir -p $(dir $@) + @unzip -jo $(PROTOC_ZIP) bin/protoc -d $(dir $@) + @unzip -o $(PROTOC_ZIP) 'include/*' -d $(dir $@) + @rm -f $(PROTOC_ZIP) + +.PHONY: protoc-gen-swift +protoc-gen-swift: + @$(SWIFT) build --product protoc-gen-swift + @$(SWIFT) build --product protoc-gen-grpc-swift-2 + +.PHONY: protos +protos: $(PROTOC) protoc-gen-swift + @echo Generating protocol buffers source code... + @$(PROTOC) Sources/Containerization/SandboxContext/SandboxContext.proto \ + --plugin=protoc-gen-grpc-swift=$(BUILD_BIN_DIR)/protoc-gen-grpc-swift-2 \ + --plugin=protoc-gen-swift=$(BUILD_BIN_DIR)/protoc-gen-swift \ + --proto_path=Sources/Containerization/SandboxContext \ + --grpc-swift_out="Sources/Containerization/SandboxContext" \ + --grpc-swift_opt=Visibility=Public \ + --swift_out="Sources/Containerization/SandboxContext" \ + --swift_opt=Visibility=Public \ + -I. + @"$(MAKE)" update-licenses + +.PHONY: clean-proto-tools +clean-proto-tools: + @echo Cleaning proto tools... + @rm -rf $(LOCAL_DIR)/bin/protoc* diff --git a/README.md b/README.md new file mode 100644 index 0000000..3bf6398 --- /dev/null +++ b/README.md @@ -0,0 +1,196 @@ +

+ Containerization logo +  Containerization +

+ +The Containerization package allows applications to use Linux containers. +Containerization is written in [Swift](https://www.swift.org) and uses [Virtualization.framework](https://developer.apple.com/documentation/virtualization) on Apple silicon. + +> **Looking for command line binaries for running containers?**\ +> They are available in the dedicated [apple/container](https://github.com/apple/container) repository. + +Containerization provides APIs to: + +- [Manage OCI images](./Sources/ContainerizationOCI/). +- [Interact with remote registries](./Sources/ContainerizationOCI/Client/). +- [Create and populate ext4 file systems](./Sources/ContainerizationEXT4/). +- [Interact with the Netlink socket family](./Sources/ContainerizationNetlink/). +- [Create an optimized Linux kernel for fast boot times](./kernel/). +- [Spawn lightweight virtual machines and manage the runtime environment](./Sources/Containerization/LinuxContainer.swift). +- [Spawn and interact with containerized processes](./Sources/Containerization/LinuxProcess.swift). +- Use Rosetta 2 for running linux/amd64 containers on Apple silicon. + +Please view the [API documentation](https://apple.github.io/containerization/documentation/) for information on the Swift packages that Containerization provides. + +## Design + +Containerization executes each Linux container inside of its own lightweight virtual machine. Clients can create dedicated IP addresses for every container to remove the need for individual port forwarding. Containers achieve sub-second start times using an optimized [Linux kernel configuration](/kernel) and a minimal root filesystem with a lightweight init system. + +[vminitd](/vminitd) is a small init system, which is a subproject within Containerization. +`vminitd` is spawned as the initial process inside of the virtual machine and provides a GRPC API over vsock. +The API allows the runtime environment to be configured and containerized processes to be launched. +`vminitd` provides I/O, signals, and events to the calling process when a process is run. + +## Backends + +Containerization abstracts the VMM behind the `VirtualMachineManager` / +`VirtualMachineInstance` protocols and ships two implementations: + +- **macOS — Virtualization.framework** (`VZVirtualMachineManager`). The shipping path on Apple silicon. Uses Apple's `Virtualization` framework directly; no extra binaries required. +- **Linux — cloud-hypervisor + KVM** (`CHVirtualMachineManager`). One `cloud-hypervisor` subprocess per VM, controlled over its REST-on-UDS API by the standalone [`CloudHypervisor`](./Sources/CloudHypervisor) Swift package. Block storage uses virtio-blk, shared directories use virtio-fs (one `virtiofsd` per share), networking uses TAP, and the guest agent is reached over cloud-hypervisor's hybrid vsock — same `vminitd` contract as the macOS path, so guest-side semantics are unchanged. + +The Linux backend requires: + +- `cloud-hypervisor` and `virtiofsd` on the host. Both are looked up on `PATH` by default; `CHVirtualMachineManager.init` accepts explicit URLs to override. `virtiofsd` is resolved lazily — a VM that uses only block-device mounts can run without it installed at all. Recent stable releases of each are recommended (smoke testing pins specific versions). +- KVM access (`/dev/kvm` readable + writable by the calling user). +- Pre-staged TAP / bridge / NAT plumbing if the container needs networking. `TAPInterface` consumes an existing TAP device by name; bringing it up, attaching it to a bridge, and configuring NAT or routing is the caller's responsibility. + +The integration test suite (`make linux-integration`) runs inside an apple/container Linux VM with nested virt enabled (`container run --virtualization`). The kata kernel fetched by `make fetch-default-kernel` does not enable KVM, so the integration suite uses the in-repo kernel at `kernel/vmlinux-arm64` (or `kernel/vmlinuz-x86_64` on x86_64 hosts) instead — build it with `make -C kernel` before invoking `make linux-integration`. On Linux the suite runs only the cross-platform scenarios that don't depend on macOS-only types; the full suite remains macOS-only for now. + +## Requirements + +To build the Containerization package, you need: + +- Mac with Apple silicon +- macOS 26 +- Xcode 26 + +Older versions of macOS are not supported. + +## Example Usage + +For examples of how to use the libraries' API surface, the cctl executable is a good start. This app is a useful playground for exploring the API. It contains commands that exercise some of the core functionality of the various products, such as: + +1. [Manipulating OCI images](./Sources/cctl/ImageCommand.swift) +2. [Logging in to container registries](./Sources/cctl/LoginCommand.swift) +3. [Creating root filesystem blocks](./Sources/cctl/RootfsCommand.swift) +4. [Running simple Linux containers](./Sources/cctl/RunCommand.swift) + +## Linux kernel + +A Linux kernel is required for spawning lightweight virtual machines on macOS. +Containerization provides an optimized kernel configuration located in the [kernel](./kernel) directory. + +This directory includes a containerized build environment to easily compile a kernel for use with Containerization. + +The kernel configuration is a minimal set of features to support fast start times and a lightweight environment. + +While this configuration will work for the majority of workloads we understand that some will need extra features. +To solve this Containerization provides first class APIs to use different kernel configurations and versions on a per container basis. +This enables containers to be developed and validated across different kernel versions. + +See the [README](/kernel/README.md) in the kernel directory for instructions on how to compile the optimized kernel. + +### Kernel Support + +Containerization allows user provided kernels but tests functionality starting with kernel version `6.14.9`. + +### Pre-built Kernel + +If you wish to consume a pre-built kernel, make sure it has `VIRTIO` drivers compiled into the kernel (not merely as modules). + +The [Kata Containers](https://github.com/kata-containers/kata-containers) project provides a Linux kernel that is optimized for containers, with all required configuration options enabled. The [releases](https://github.com/kata-containers/kata-containers/releases/) page contains downloadable artifacts, and the image itself (`vmlinux.container`) can be found in the `/opt/kata/share/kata-containers/` directory. + +## Prepare to build package + +Install the recommended version of Xcode. + +Set the active developer directory to the installed Xcode (replace ``): +```bash +sudo xcode-select -s +``` + +Install [Swiftly](https://github.com/swiftlang/swiftly), [Swift](https://www.swift.org), and [Static Linux SDK](https://www.swift.org/documentation/articles/static-linux-getting-started.html): + +```bash +make cross-prep +``` + +If you use a custom terminal application, you may need to move this command from `.zprofile` to `.zshrc` (replace ``): + +```bash +# Added by swiftly +. "/Users//.swiftly/env.sh" +``` + +Restart the terminal application. Ensure this command returns `/Users//.swiftly/bin/swift` (replace ``): + +```bash +which swift +``` + +If you've installed or used a Static Linux SDK previously, you may need to remove older SDK versions from the system (replace ``): + +```bash +swift sdk list +swift sdk remove +``` + +## Build the package + +Build Containerization from sources: + +```bash +make all +``` + +## Test the package + +After building, run basic and integration tests: + +```bash +make test integration +``` + +A kernel is required to run integration tests. +If you do not have a kernel locally, a default kernel can be fetched using the `make fetch-default-kernel` target. + +Fetching the default kernel only needs to happen after an initial build or after a `make clean`. + +```bash +make fetch-default-kernel +make all test integration +``` + +## Protobufs + +Containerization depends on specific versions of `grpc-swift` and `swift-protobuf`. You can install them and re-generate RPC interfaces with: + +```bash +make protos +``` + +## Building a kernel + +If you'd like to build your own kernel please see the instructions in the [kernel directory](./kernel/README.md). + +## Pre-commit hook + +Run `make pre-commit` to install a pre-commit hook that ensures that your changes have correct formatting and license headers when you run `git commit`. + +## Documentation + +Generate the API documentation for local viewing with: + +```bash +make docs +make serve-docs +``` + +Preview the documentation by running in another terminal: + +```bash +open http://localhost:8000/containerization/documentation/ +``` + +## Contributing + +Contributions to Containerization are welcomed and encouraged. Please see [CONTRIBUTING.md](/CONTRIBUTING.md) for more information. + +## Project Status + +Version 0.1.0 is the first official release of Containerization. Earlier versions have no source stability guarantees. + +Because the Containerization library is under active development, source stability is only guaranteed within minor versions (for example, between 0.1.1 and 0.1.2). If you don't want potentially source-breaking package updates, you can specify your package dependency using .upToNextMinorVersion(from: "0.1.0") instead. + +Future minor versions of the package may introduce changes to these rules as needed. diff --git a/README.wehub.md b/README.wehub.md new file mode 100644 index 0000000..34d4a88 --- /dev/null +++ b/README.wehub.md @@ -0,0 +1,7 @@ +# WeHub 来源说明 + +- 原始项目：`apple/containerization` +- 原始仓库：https://github.com/apple/containerization +- 导入方式：上游默认分支的最新快照 +- 原作者、版权和许可证信息以原始仓库及本仓库 LICENSE 为准 +- 本文件仅用于记录来源，不代表 WeHub 是原项目作者 diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3b82940 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security disclosure process + +If you believe that you have discovered a security or privacy vulnerability in our open source software, please report it to us using the [GitHub private vulnerability feature](https://github.com/apple/containerization/security/advisories/new). Reports should include specific product and software version(s) that you believe are affected; a technical description of the behavior that you observed and the behavior that you expected; the steps required to reproduce the issue; and a proof of concept or exploit. + +The project team will do their best to acknowledge receiving all security reports within 7 days of submission. This initial acknowledgment is neither acceptance nor rejection of your report. The project team may come back to you with further questions or invite you to collaborate while working through the details of your report. + +Keep these additional guidelines in mind when submitting your report: + +* Reports concerning known, publicly disclosed CVEs can be submitted as normal issues to this project. +* Output from automated security scans or fuzzers MUST include additional context demonstrating the vulnerability with a proof of concept or working exploit. +* Application crashes due to malformed inputs are typically not treated as security vulnerabilities, unless they are shown to also impact other processes on the system. + +While we welcome reports for open source software projects, they are not eligible for Apple Security Bounties. diff --git a/Sources/CShim/capability.c b/Sources/CShim/capability.c new file mode 100644 index 0000000..fb4d25f --- /dev/null +++ b/Sources/CShim/capability.c @@ -0,0 +1,32 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if defined(__linux__) + +#include +#include +#include "capability.h" + +// Capability syscall wrappers +int CZ_capget(void *header, void *data) { + return syscall(SYS_capget, header, data); +} + +int CZ_capset(void *header, void *data) { + return syscall(SYS_capset, header, data); +} + +#endif diff --git a/Sources/CShim/cz_tap.c b/Sources/CShim/cz_tap.c new file mode 100644 index 0000000..9f4621f --- /dev/null +++ b/Sources/CShim/cz_tap.c @@ -0,0 +1,78 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if defined(__linux__) + +#include "cz_tap.h" + +#include +#include +#include /* struct ifreq, IFNAMSIZ */ +#include +#include +#include + +/* + * Avoid — the Static Linux SDK (musl) used to cross-compile + * vminitd ships from musl but not the linux kernel UAPI headers. + * The TUN ioctl number and flags are stable Linux ABI; redeclare locally. + * + * TUNSETIFF = _IOW('T', 202, int): + * dir=IOC_WRITE(1)<<30 | size(4)<<16 | type('T'=0x54)<<8 | nr(202=0xCA) + * = 0x400454CA + * Architecture-independent (Linux's ioctl encoding is the same on x86/arm). + */ +#ifndef TUNSETIFF +#define TUNSETIFF 0x400454CAu +#endif +#ifndef IFF_TAP +#define IFF_TAP 0x0002 +#endif +#ifndef IFF_NO_PI +#define IFF_NO_PI 0x1000 +#endif + +int cz_tap_create(const char *requested_name, char *out_name, size_t out_name_len) { + if (out_name == NULL || out_name_len < IFNAMSIZ) { + return -EINVAL; + } + + int fd = open("/dev/net/tun", O_RDWR | O_CLOEXEC); + if (fd < 0) { + return -errno; + } + + struct ifreq ifr; + memset(&ifr, 0, sizeof(ifr)); + ifr.ifr_flags = IFF_TAP | IFF_NO_PI; + if (requested_name != NULL && requested_name[0] != '\0') { + strncpy(ifr.ifr_name, requested_name, IFNAMSIZ - 1); + } + + if (ioctl(fd, TUNSETIFF, &ifr) < 0) { + int saved = errno; + close(fd); + return -saved; + } + + /* Copy out the resolved name. ifr.ifr_name is always NUL-terminated + * within IFNAMSIZ by the kernel. */ + memset(out_name, 0, out_name_len); + strncpy(out_name, ifr.ifr_name, IFNAMSIZ - 1); + return fd; +} + +#endif /* __linux__ */ diff --git a/Sources/CShim/exec_command.c b/Sources/CShim/exec_command.c new file mode 100644 index 0000000..450109a --- /dev/null +++ b/Sources/CShim/exec_command.c @@ -0,0 +1,393 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if defined(__linux__) || defined(__APPLE__) + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#if defined(__linux__) +#include +#endif + +#include "exec_command.h" + +#ifndef SYS_close_range +#define SYS_close_range 436 +#endif + +#ifndef CLOSE_RANGE_CLOEXEC +#define CLOSE_RANGE_CLOEXEC 0x4 +#endif + +static int mark_cloexec(int fd) { + int flags = fcntl(fd, F_GETFD); + + if (flags == -1) return flags; + if (flags & FD_CLOEXEC) return 0; + + return fcntl(fd, F_SETFD, flags | FD_CLOEXEC); +} + +static int cloexec_from(int min_fd) { +#if defined(__linux__) + // First try close_range. + long ret = syscall(SYS_close_range, min_fd, ~0U, CLOSE_RANGE_CLOEXEC); + if (ret == 0) { + return 0; + } + const char* dirpath = "/proc/self/fd"; +#elif defined(__APPLE__) + const char* dirpath = "/dev/fd"; +#endif + DIR *dp = opendir(dirpath); + if (!dp) return -1; + + int dp_fd = dirfd(dp); + struct dirent *de; + + while ((de = readdir(dp))) { + if (de->d_name[0] == '.') continue; + + char *end; + long val = strtol(de->d_name, &end, 10); + if (*end || val < 0 || val > INT_MAX) continue; + + int fd = (int)val; + if (fd < min_fd || fd == dp_fd) continue; + + int ret = mark_cloexec(fd); + if (ret != 0) { + return ret; + } + } + close(dp_fd); + closedir(dp); + return 0; +} + +void exec_command_attrs_init(struct exec_command_attrs *attrs) { + attrs->setpgid = 0; + attrs->pgid = 0; + attrs->setsid = 0; + attrs->setctty = 0; + attrs->ctty = 0; + attrs->mask = 0; + attrs->uid = -1; + attrs->gid = -1; + attrs->pdeathSignal = 0; + attrs->setfgpgrp = 0; +} + +static void child_handler(const int sync_pipes[2], const char *executable, + char *const args[], char *const environment[], + const int file_handles[], const int file_handle_count, + const char *cwd, const sigset_t old_mask, + const struct exec_command_attrs attrs) { + int i = 0; + int err = 0; + int fd_index = 0; + int fd_table[file_handle_count]; + struct rlimit limits = {0}; + int syncfd = sync_pipes[1]; + struct sigaction action = {0}; + + // Closing our parent's side of the pipe + if (close(sync_pipes[0]) < 0) { + goto fail; + } + + // Setup process group and foreground before clearing signal mask. + if (attrs.setpgid) { + if (setpgid(0, attrs.pgid) < 0) { + goto fail; + } + } + + // Make the new process group the foreground process group so it can read from the TTY. + if (attrs.setfgpgrp) { + if (tcsetpgrp(STDIN_FILENO, getpgrp()) < 0) { + if (errno != ENOTTY && errno != ENXIO) { + goto fail; + } + } + } + + // clear sighandlers + action.sa_flags = 0; + action.sa_handler = SIG_DFL; + sigemptyset(&action.sa_mask); + for (i = 0; i < NSIG; i++) { + sigaction(i, &action, 0); + } + + sigset_t local_mask; + sigemptyset(&local_mask); + if (pthread_sigmask(SIG_SETMASK, &local_mask, NULL) < 0) { + goto fail; + } + + // start shuffling fds. + // look at all the file handles and find the highest one, + // use that for our pipe, + // + // Then, we need to start dup2 the fds starting for the final process + // at 0-n. + // as an example we have this list of FDs that should be passed to the + // process: + // + /* + The index of this list is the final result that the new process expects. + The values are open fds provided from the parent process. + [0] == 12 + [1] == 7 + [2] == 9 + [3] == 0 + + We also have a pipe to sync the child and parent so that adds an additional + parameter to consider. + + So we start by finding the highest open fd in the list, then move our pipe to + the next. + + i.e. fd12 is highest so move our pipe to fd13 + + Now start moving all the fds above our pipe as we will need to start placing + the fds in the child process into the right order. Make sure they are all + marked cloexec. + + pipe == 13 + [0] == 12 dup2 14 + [1] == 7 dup2 15 + [2] == 9 dup2 16 + [3] == 0 dup2 17 + + Now overwrite the fd table for the child with the current index. + + Make index == fd. + + pipe == 13 + [0] == 14 dup2 0 + [1] == 15 dup2 1 + [2] == 16 dup2 2 + [3] == 17 dup2 3 + + Clear cloexec on this new fds. + */ + + // find the highest fd value in our list. + for (i = 0; i < file_handle_count; i++) { + if (file_handles[i] > fd_index) { + fd_index = file_handles[i]; + } + fd_table[i] = file_handles[i]; + } + // now fd_index is == to the highest fd in our list of handles. + // Increment it and set our pipe to it. + fd_index++; + + if (syncfd != fd_index) { + if (dup2(syncfd, fd_index) < 0) { + goto fail; + } + if (close(syncfd) < 0) { + goto fail; + } + syncfd = fd_index; + } + fd_index++; + + // make sure our syncfd retains its cloexec + if (fcntl(syncfd, F_SETFD, FD_CLOEXEC) == -1) { + goto fail; + } + + // move the rest of the fds up above our index if they don't match the index. + for (i = 0; i < file_handle_count; i++) { + if (fd_table[i] == i) { + continue; + } + if (dup2(fd_table[i], fd_index) < 0) { + goto fail; + } + if (fcntl(fd_index, F_SETFD, FD_CLOEXEC) == -1) { + goto fail; + } + fd_table[i] = fd_index; + fd_index++; + } + + // now create the child process's final fd table. where i == i + for (i = 0; i < file_handle_count; i++) { + if (fd_table[i] != i) { + if (dup2(fd_table[i], i) < 0) { + goto fail; + } + } + // now fd[i] should == i + // clear cloexec as this fd is where we want it. + if (fcntl(i, F_SETFD, 0) == -1) { + goto fail; + } + } + + if (attrs.setsid) { + if (setsid() == -1) { + goto fail; + } + } + + if (attrs.setctty) { + if (ioctl(attrs.ctty, TIOCSCTTY, 0)) { + goto fail; + } + } + +#if defined(__linux__) + // Set parent death signal if specified + if (attrs.pdeathSignal != 0) { + if (prctl(PR_SET_PDEATHSIG, attrs.pdeathSignal) != 0) { + goto fail; + } + } +#endif + + // close exec everything outside of our child's fd_table. + if (cloexec_from(file_handle_count) != 0) { + goto fail; + } + + // set gid + if (attrs.gid != -1) { + if (setgid(attrs.gid) != 0) { + goto fail; + } + } + + // set uid + if (attrs.uid != -1) { + if (setreuid(attrs.uid, attrs.uid) != 0) { + goto fail; + } + } + + if (cwd != NULL) { + if (chdir(cwd)) { + goto fail; + } + } + + execve(executable, args, environment); +fail: + err = errno; + if (err) { + // send our error to the parent + while (write(syncfd, &err, sizeof(err)) < 0) + ; + } + exit(127); +} + +int exec_command(pid_t *result, const char *executable, char *const args[], + char *const envp[], const int file_handles[], + const int file_handle_count, const char *working_directory, + struct exec_command_attrs *attrs) { + pid_t pid = 0; + int err = 0; + int sync_pipe[2]; + sigset_t old_mask; + + sigset_t all; + sigfillset(&all); + + if (pipe(sync_pipe)) { + goto fail; + } + + if (pthread_sigmask(SIG_SETMASK, &all, &old_mask) < 0) { + goto fail; + } + + pid = fork(); + if (pid == -1) { + close(sync_pipe[0]); + close(sync_pipe[1]); + goto fail; + } + + if (pid == 0) { + // hand off to child + child_handler(sync_pipe, executable, args, envp, file_handles, + file_handle_count, working_directory, old_mask, *attrs); + exit(EXIT_FAILURE); + } + + // handle parent operations + if (close(sync_pipe[1]) < 0) { + goto fail; + } + + // sync with our child process + err = 0; + ssize_t size = read(sync_pipe[0], &err, sizeof(err)); + // -- we didn't get an errno back + if (size != sizeof(err)) { + // will be used as return result + err = 0; + } else { + // we did get an errno back from the child process and our + // err var is set to that errno + // lets set our errno and then reap the process + errno = err; + int status = 0; + waitpid(pid, &status, 0); + // lets continue our journey below + } + + if (close(sync_pipe[0]) < 0) { + goto fail; + } + if (err) { + goto fail; + } + + (*result) = pid; + err = 0; +fail: + if (pthread_sigmask(SIG_SETMASK, &old_mask, 0) < 0) { + printf("restoring signal mask: %s\n", strerror(errno)); + } + if (err) { + printf("exec_command execve: %s\n", strerror(err)); + return -1; + } + return 0; +} + +#endif \ No newline at end of file diff --git a/Sources/CShim/include/capability.h b/Sources/CShim/include/capability.h new file mode 100644 index 0000000..9016b70 --- /dev/null +++ b/Sources/CShim/include/capability.h @@ -0,0 +1,28 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef __CAPABILITY_H +#define __CAPABILITY_H + +#if defined(__linux__) + +// Capability syscall wrappers +int CZ_capget(void *header, void *data); +int CZ_capset(void *header, void *data); + +#endif + +#endif diff --git a/Sources/CShim/include/cz_tap.h b/Sources/CShim/include/cz_tap.h new file mode 100644 index 0000000..e293b7f --- /dev/null +++ b/Sources/CShim/include/cz_tap.h @@ -0,0 +1,39 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef __CZ_TAP_H +#define __CZ_TAP_H + +#include + +/* + * Open /dev/net/tun, ioctl(TUNSETIFF) with IFF_TAP|IFF_NO_PI, and write the + * resolved interface name into `out_name` (must be at least 16 bytes). + * + * If `requested_name` is non-NULL and non-empty, it is the desired name; the + * kernel may rename it on collision (rare). If NULL or empty, the kernel + * picks a name like "tap%d". + * + * Returns the open fd on success, -errno on failure. + * + * Linux-only — the implementation in cz_tap.c is gated on __linux__. The + * declaration is left unconditional so Swift's clang importer can see it + * regardless of whose target's preprocessor defines reach the modulemap. + * On non-Linux targets the symbol is not provided; do not call. + */ +int cz_tap_create(const char *requested_name, char *out_name, size_t out_name_len); + +#endif /* __CZ_TAP_H */ diff --git a/Sources/CShim/include/exec_command.h b/Sources/CShim/include/exec_command.h new file mode 100644 index 0000000..fba2e99 --- /dev/null +++ b/Sources/CShim/include/exec_command.h @@ -0,0 +1,56 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef exec_command_h +#define exec_command_h + +#if defined(__linux__) || defined(__APPLE__) + +#include +#include + +struct exec_command_attrs { + int setpgid; + /// parent group id + pid_t pgid; + /// set the controlling terminal + int setctty; + /// controlling terminal fd + int ctty; + /// set the process as session leader + int setsid; + /// set the process user id + uid_t uid; + /// set the process group id + gid_t gid; + /// signal mask for the child process + int mask; + /// parent death signal (Linux only, 0 to disable) + int pdeathSignal; + /// make the new process group the foreground process group + int setfgpgrp; +}; + +void exec_command_attrs_init(struct exec_command_attrs *attrs); + +/// spawn a new child process with the provided attrs +int exec_command(pid_t *result, const char *executable, char *const argv[], + char *const envp[], const int file_handles[], + const int file_handle_count, const char *working_directory, + struct exec_command_attrs *attrs); + +#endif /* defined(__linux__) || defined(__APPLE__) */ +#endif /* exec_command_h */ diff --git a/Sources/CShim/include/linux_shim.h b/Sources/CShim/include/linux_shim.h new file mode 100644 index 0000000..af9e0c2 --- /dev/null +++ b/Sources/CShim/include/linux_shim.h @@ -0,0 +1,32 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// The below fall into two main categories: +// 1. Aren't exposed by Swifts glibc modulemap. +// 2. Don't have syscall wrappers/definitions in glibc/musl. + +#ifndef __LINUX_SHIM_H +#define __LINUX_SHIM_H + +#if defined(__linux__) + +#include +#include +#include + +#endif /* __linux__ */ + +#endif /* __LINUX_SHIM_H */ diff --git a/Sources/CShim/include/openat2.h b/Sources/CShim/include/openat2.h new file mode 100644 index 0000000..2c7bdb6 --- /dev/null +++ b/Sources/CShim/include/openat2.h @@ -0,0 +1,37 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef __OPENAT2_H +#define __OPENAT2_H + +#include + +#ifndef RESOLVE_IN_ROOT +#define RESOLVE_IN_ROOT 0x10 +#endif + +struct cz_open_how { + unsigned long long flags; + unsigned long long mode; + unsigned long long resolve; +}; + +/// openat2(2) wrapper. Musl does not provide openat2 so we invoke the syscall +/// directly. Requires Linux 5.6+. +int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how, + size_t size); + +#endif diff --git a/Sources/CShim/include/prctl.h b/Sources/CShim/include/prctl.h new file mode 100644 index 0000000..c6d0255 --- /dev/null +++ b/Sources/CShim/include/prctl.h @@ -0,0 +1,33 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef __PRCTL_H +#define __PRCTL_H + +#if defined(__linux__) + +#include + +// Capability management prctl wrappers +int CZ_prctl_set_keepcaps(); +int CZ_prctl_clear_keepcaps(); +int CZ_prctl_capbset_drop(unsigned int capability); +int CZ_prctl_cap_ambient_clear_all(); +int CZ_prctl_cap_ambient_raise(unsigned int capability); + +#endif + +#endif diff --git a/Sources/CShim/include/socket_helpers.h b/Sources/CShim/include/socket_helpers.h new file mode 100644 index 0000000..c53c3fd --- /dev/null +++ b/Sources/CShim/include/socket_helpers.h @@ -0,0 +1,29 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef socket_helpers_h +#define socket_helpers_h + +#include +#include + +// Helper functions to access CMSG macros from Swift +struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg); +void* CZ_CMSG_DATA(struct cmsghdr *cmsg); +size_t CZ_CMSG_SPACE(size_t length); +size_t CZ_CMSG_LEN(size_t length); + +#endif /* socket_helpers_h */ diff --git a/Sources/CShim/include/vsock.h b/Sources/CShim/include/vsock.h new file mode 100644 index 0000000..878a599 --- /dev/null +++ b/Sources/CShim/include/vsock.h @@ -0,0 +1,33 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +// + +#ifndef vsock_h +#define vsock_h + +#include + +#ifdef __APPLE__ + #include +#else + #include + #include +#endif /* __APPLE__ */ + +extern const unsigned long VsockLocalCIDIoctl; + +#endif /* vsock_h */ diff --git a/Sources/CShim/openat2.c b/Sources/CShim/openat2.c new file mode 100644 index 0000000..3c11638 --- /dev/null +++ b/Sources/CShim/openat2.c @@ -0,0 +1,33 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if defined(__linux__) + +#include +#include + +#include "openat2.h" + +#ifndef SYS_openat2 +#define SYS_openat2 437 +#endif + +int CZ_openat2(int dirfd, const char *pathname, struct cz_open_how *how, + size_t size) { + return syscall(SYS_openat2, dirfd, pathname, how, size); +} + +#endif diff --git a/Sources/CShim/prctl.c b/Sources/CShim/prctl.c new file mode 100644 index 0000000..b304e5e --- /dev/null +++ b/Sources/CShim/prctl.c @@ -0,0 +1,47 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#if defined(__linux__) + +#include +#include "prctl.h" + +// Set keep caps to preserve capabilities across setuid() +int CZ_prctl_set_keepcaps() { + return prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); +} + +// Clear keep caps after user change +int CZ_prctl_clear_keepcaps() { + return prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0); +} + +// Drop capability from bounding set +int CZ_prctl_capbset_drop(unsigned int capability) { + return prctl(PR_CAPBSET_DROP, capability, 0, 0, 0); +} + +// Clear all ambient capabilities +int CZ_prctl_cap_ambient_clear_all() { + return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); +} + +// Raise ambient capability +int CZ_prctl_cap_ambient_raise(unsigned int capability) { + return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, capability, 0, 0); +} + +#endif diff --git a/Sources/CShim/socket_helpers.c b/Sources/CShim/socket_helpers.c new file mode 100644 index 0000000..939c6a5 --- /dev/null +++ b/Sources/CShim/socket_helpers.c @@ -0,0 +1,33 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "socket_helpers.h" + +struct cmsghdr* CZ_CMSG_FIRSTHDR(struct msghdr *msg) { + return CMSG_FIRSTHDR(msg); +} + +void* CZ_CMSG_DATA(struct cmsghdr *cmsg) { + return CMSG_DATA(cmsg); +} + +size_t CZ_CMSG_SPACE(size_t length) { + return CMSG_SPACE(length); +} + +size_t CZ_CMSG_LEN(size_t length) { + return CMSG_LEN(length); +} diff --git a/Sources/CShim/vsock.c b/Sources/CShim/vsock.c new file mode 100644 index 0000000..27c17a0 --- /dev/null +++ b/Sources/CShim/vsock.c @@ -0,0 +1,19 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "vsock.h" + +const unsigned long VsockLocalCIDIoctl = IOCTL_VM_SOCKETS_GET_LOCAL_CID; diff --git a/Sources/CloudHypervisor/CloudHypervisor+Client.swift b/Sources/CloudHypervisor/CloudHypervisor+Client.swift new file mode 100644 index 0000000..2c4a67a --- /dev/null +++ b/Sources/CloudHypervisor/CloudHypervisor+Client.swift @@ -0,0 +1,169 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Logging +import NIOCore +import NIOHTTP1 +import NIOPosix + +extension CloudHypervisor { + /// A high-level client for Cloud Hypervisor's REST API over a Unix Domain Socket. + /// + /// Use ``init(socketPath:eventLoopGroup:logger:)`` to construct a client, then + /// call endpoint-specific methods (added as extensions in `Endpoints/`). + /// + /// The internal `get(_:)` / `put(_:)` / `put(_:body:)` helpers are used by + /// endpoint extensions in A8-A10 and are intentionally not public. + public final class Client: Sendable { + private let http: HTTPOverUDSClient + private let group: any EventLoopGroup + private let ownsGroup: Bool + private let encoder: JSONEncoder + private let decoder: JSONDecoder + + /// Create a client that communicates with Cloud Hypervisor over the given socket. + /// + /// - Parameters: + /// - socketPath: A `file://` URL whose `.path` points to the socket. + /// - eventLoopGroup: The NIO event loop group to use. When `nil` the client + /// creates and owns its own group. Callers wanting deterministic + /// resource release should pass a group they manage and call + /// ``shutdown()`` themselves; the deinit fallback shuts down + /// asynchronously and may outlive the `Client` instance briefly. + /// - logger: Logger for transport-level diagnostics. + /// - requestTimeout: Per-request deadline. A request that does not + /// complete within this window fails with + /// ``CloudHypervisor/Error/transport(_:)``. Defaults to 30 seconds. + /// - Throws: ``CloudHypervisor/Error/invalidSocketPath(_:)`` when `socketPath` + /// is not a `file://` URL. + public init( + socketPath: URL, + eventLoopGroup: (any EventLoopGroup)? = nil, + logger: Logger = Logger(label: "CloudHypervisor.Client"), + requestTimeout: TimeAmount = .seconds(30) + ) throws { + guard socketPath.isFileURL else { + throw CloudHypervisor.Error.invalidSocketPath(socketPath.absoluteString) + } + if let eventLoopGroup { + self.ownsGroup = false + self.group = eventLoopGroup + } else { + self.ownsGroup = true + self.group = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount) + } + self.http = HTTPOverUDSClient( + socketPath: socketPath.path, + group: self.group, + logger: logger, + requestTimeout: requestTimeout + ) + self.encoder = JSONEncoder() + self.decoder = JSONDecoder() + } + + /// Drain the underlying `AsyncHTTPClient`, and shut down the NIO + /// event-loop group when this client owns it. Idempotent. Prefer + /// calling this explicitly over relying on the deinit fallback — + /// `shutdown()` waits for in-flight I/O to drain. + /// + /// Callers that pass in a shared `eventLoopGroup` MUST call this + /// before tearing down that group. AsyncHTTPClient parks deferred + /// connection-close work on the group's event loops after each + /// response returns; shutting the group down before that work + /// runs trips NIO's "Cannot schedule tasks on an EventLoop that + /// has already shut down" warning (and a forced crash in future + /// NIO releases). + public func shutdown() async throws { + try await http.shutdown() + if ownsGroup { + try await group.shutdownGracefully() + } + } + + deinit { + // Use the async-dispatched shutdown rather than + // `syncShutdownGracefully()`. The sync variant blocks the calling + // thread until every event loop drains, which deadlocks if deinit + // happens to run on one of the group's event loop threads (e.g. + // the last release came from inside a NIO callback). The + // callback-based variant schedules shutdown on its own queue and + // returns immediately — at the cost of giving up any signal that + // shutdown completed. Callers who need that signal should call + // `shutdown()` explicitly before letting the client deinit. + if ownsGroup { + group.shutdownGracefully(queue: .global()) { _ in } + } + } + + // MARK: - Internal request dispatch helpers + // + // Endpoint extensions (A8/A9/A10) call these to build their public API. + // They are internal (not public) because all public surface lives in those + // extensions. + + /// GET `path`, decode the response body as `Response`. + func get(_ path: String) async throws -> Response { + try await sendAndDecode(method: .GET, path: path, body: nil) + } + + /// PUT `path` with no body, discard the response. + func put(_ path: String) async throws { + try await sendVoid(method: .PUT, path: path, body: nil) + } + + /// PUT `path` with a JSON-encoded body, discard the response. + func put(_ path: String, body: Body) async throws { + let data = try encoder.encode(body) + try await sendVoid(method: .PUT, path: path, body: data) + } + + /// PUT `path` with a JSON-encoded body, decode the response as `Response`. + func put( + _ path: String, + body: Body + ) async throws -> Response { + let data = try encoder.encode(body) + return try await sendAndDecode(method: .PUT, path: path, body: data) + } + + // MARK: - Private machinery + + private func sendAndDecode( + method: HTTPMethod, + path: String, + body: Data? + ) async throws -> Response { + let resp = try await http.send(method: method, uri: path, body: body) + guard (200..<300).contains(Int(resp.status.code)) else { + throw CloudHypervisor.Error.http(status: resp.status, body: resp.body) + } + do { + return try decoder.decode(Response.self, from: resp.body) + } catch { + throw CloudHypervisor.Error.decoding(error, body: resp.body) + } + } + + private func sendVoid(method: HTTPMethod, path: String, body: Data?) async throws { + let resp = try await http.send(method: method, uri: path, body: body) + guard (200..<300).contains(Int(resp.status.code)) else { + throw CloudHypervisor.Error.http(status: resp.status, body: resp.body) + } + } + } +} diff --git a/Sources/CloudHypervisor/CloudHypervisor+Error.swift b/Sources/CloudHypervisor/CloudHypervisor+Error.swift new file mode 100644 index 0000000..942e1bf --- /dev/null +++ b/Sources/CloudHypervisor/CloudHypervisor+Error.swift @@ -0,0 +1,27 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import NIOHTTP1 + +extension CloudHypervisor { + public enum Error: Swift.Error, Sendable { + case transport(any Swift.Error) + case http(status: HTTPResponseStatus, body: Data) + case decoding(any Swift.Error, body: Data) + case invalidSocketPath(String) + } +} diff --git a/Sources/CloudHypervisor/CloudHypervisor.swift b/Sources/CloudHypervisor/CloudHypervisor.swift new file mode 100644 index 0000000..d723118 --- /dev/null +++ b/Sources/CloudHypervisor/CloudHypervisor.swift @@ -0,0 +1,17 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +public enum CloudHypervisor {} diff --git a/Sources/CloudHypervisor/Endpoints/Client+Hotplug.swift b/Sources/CloudHypervisor/Endpoints/Client+Hotplug.swift new file mode 100644 index 0000000..4eeb52e --- /dev/null +++ b/Sources/CloudHypervisor/Endpoints/Client+Hotplug.swift @@ -0,0 +1,55 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension CloudHypervisor.Client { + /// Hotplug a virtio-blk disk device into a running VM. + /// + /// Maps to `PUT /api/v1/vm.add-disk` in the Cloud Hypervisor REST API. + public func vmAddDisk(_ config: CloudHypervisor.DiskConfig) async throws -> CloudHypervisor.PciDeviceInfo { + try await put("/api/v1/vm.add-disk", body: config) + } + + /// Hotplug a virtio-fs filesystem device into a running VM. + /// + /// Maps to `PUT /api/v1/vm.add-fs` in the Cloud Hypervisor REST API. + public func vmAddFs(_ config: CloudHypervisor.FsConfig) async throws -> CloudHypervisor.PciDeviceInfo { + try await put("/api/v1/vm.add-fs", body: config) + } + + /// Hotplug a virtio-net network device into a running VM. + /// + /// Maps to `PUT /api/v1/vm.add-net` in the Cloud Hypervisor REST API. + public func vmAddNet(_ config: CloudHypervisor.NetConfig) async throws -> CloudHypervisor.PciDeviceInfo { + try await put("/api/v1/vm.add-net", body: config) + } + + /// Hotplug a virtio-vsock device into a running VM. + /// + /// Maps to `PUT /api/v1/vm.add-vsock` in the Cloud Hypervisor REST API. + public func vmAddVsock(_ config: CloudHypervisor.VsockConfig) async throws -> CloudHypervisor.PciDeviceInfo { + try await put("/api/v1/vm.add-vsock", body: config) + } + + /// Remove a hotplugged device from a running VM by its identifier. + /// + /// Maps to `PUT /api/v1/vm.remove-device` in the Cloud Hypervisor REST API. + public func vmRemoveDevice(id: String) async throws { + struct Request: Encodable, Sendable { let id: String } + try await put("/api/v1/vm.remove-device", body: Request(id: id)) + } +} diff --git a/Sources/CloudHypervisor/Endpoints/Client+VM.swift b/Sources/CloudHypervisor/Endpoints/Client+VM.swift new file mode 100644 index 0000000..b1f7998 --- /dev/null +++ b/Sources/CloudHypervisor/Endpoints/Client+VM.swift @@ -0,0 +1,61 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension CloudHypervisor.Client { + /// Create a VM with the given configuration. + /// + /// Maps to `PUT /api/v1/vm.create` in the Cloud Hypervisor REST API. + public func vmCreate(_ config: CloudHypervisor.VmConfig) async throws { + try await put("/api/v1/vm.create", body: config) + } + + /// Boot the VM (transition from Created → Running). + /// + /// Maps to `PUT /api/v1/vm.boot` in the Cloud Hypervisor REST API. + public func vmBoot() async throws { + try await put("/api/v1/vm.boot") + } + + /// Shut down the VM. + /// + /// Maps to `PUT /api/v1/vm.shutdown` in the Cloud Hypervisor REST API. + public func vmShutdown() async throws { + try await put("/api/v1/vm.shutdown") + } + + /// Retrieve runtime information about the VM. + /// + /// Maps to `GET /api/v1/vm.info` in the Cloud Hypervisor REST API. + public func vmInfo() async throws -> CloudHypervisor.VmInfo { + try await get("/api/v1/vm.info") + } + + /// Pause the running VM. + /// + /// Maps to `PUT /api/v1/vm.pause` in the Cloud Hypervisor REST API. + public func vmPause() async throws { + try await put("/api/v1/vm.pause") + } + + /// Resume a paused VM. + /// + /// Maps to `PUT /api/v1/vm.resume` in the Cloud Hypervisor REST API. + public func vmResume() async throws { + try await put("/api/v1/vm.resume") + } +} diff --git a/Sources/CloudHypervisor/Endpoints/Client+VMM.swift b/Sources/CloudHypervisor/Endpoints/Client+VMM.swift new file mode 100644 index 0000000..fb95663 --- /dev/null +++ b/Sources/CloudHypervisor/Endpoints/Client+VMM.swift @@ -0,0 +1,40 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension CloudHypervisor.Client { + /// Ping the Cloud Hypervisor VMM process and return its version information. + /// + /// Maps to `GET /api/v1/vmm.ping` in the Cloud Hypervisor REST API. + public func vmmPing() async throws -> CloudHypervisor.VmmPingResponse { + try await get("/api/v1/vmm.ping") + } + + /// Request the Cloud Hypervisor VMM process to shut down gracefully. + /// + /// Maps to `PUT /api/v1/vmm.shutdown` in the Cloud Hypervisor REST API. + public func vmmShutdown() async throws { + try await put("/api/v1/vmm.shutdown") + } + + /// Retrieve information about the Cloud Hypervisor VMM process. + /// + /// Maps to `GET /api/v1/vmm.info` in the Cloud Hypervisor REST API. + public func vmmInfo() async throws -> CloudHypervisor.VmmInfo { + try await get("/api/v1/vmm.info") + } +} diff --git a/Sources/CloudHypervisor/HTTPOverUDS.swift b/Sources/CloudHypervisor/HTTPOverUDS.swift new file mode 100644 index 0000000..96ecf44 --- /dev/null +++ b/Sources/CloudHypervisor/HTTPOverUDS.swift @@ -0,0 +1,202 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import Foundation +import Logging +import NIOConcurrencyHelpers +import NIOCore +import NIOHTTP1 + +// MARK: - HTTPResponse + +/// An HTTP response received from Cloud Hypervisor's REST API. +struct HTTPResponse: Sendable { + let status: HTTPResponseStatus + let headers: HTTPHeaders + let body: Data +} + +// MARK: - HTTPOverUDSClient + +/// A minimal HTTP/1.1 client that speaks over a Unix Domain Socket. Backed +/// by `AsyncHTTPClient` so connection lifecycle, timeout handling, and the +/// head/body/end write race we used to manage manually all live in the +/// library rather than in this file. +/// +/// AHC selects UDS via the `http+unix://` URL scheme (the supplied +/// `URL(httpURLWithSocketPath:uri:)` initializer does the percent-encoding). +/// Each `HTTPOverUDSClient` owns a fresh `HTTPClient` configured with +/// `eventLoopGroupProvider: .shared(group)` so the underlying NIO group is +/// the caller's to shut down — `httpClient.shutdown` only releases the +/// client's own state. +final class HTTPOverUDSClient: Sendable { + private let socketPath: String + private let httpClient: HTTPClient + private let logger: Logger + private let requestTimeout: TimeAmount + // One-shot flag tracking whether shutdown has been initiated, so + // explicit `shutdown()` is idempotent and `deinit` skips its fallback + // when an explicit shutdown already drained the HTTPClient. + private let didShutdown: NIOLockedValueBox + + init( + socketPath: String, + group: any EventLoopGroup, + logger: Logger, + requestTimeout: TimeAmount = .seconds(30) + ) { + self.socketPath = socketPath + self.httpClient = HTTPClient( + eventLoopGroupProvider: .shared(group), + configuration: .init() + ) + self.logger = logger + self.requestTimeout = requestTimeout + self.didShutdown = NIOLockedValueBox(false) + } + + /// Drain the underlying HTTPClient and wait for in-flight I/O to + /// finish. Idempotent — safe to call multiple times. + /// + /// MUST be called before the shared event-loop group is torn down. + /// AsyncHTTPClient leaves deferred connection-cleanup work parked on + /// the group's event loops after a response returns; if the group is + /// shut down first, that deferred work fails to schedule and SwiftNIO + /// prints "Cannot schedule tasks on an EventLoop that has already + /// shut down" (and will upgrade to a forced crash in future NIO + /// releases). + func shutdown() async throws { + let already = didShutdown.withLockedValue { state -> Bool in + if state { return true } + state = true + return false + } + if already { return } + try await httpClient.shutdown() + } + + /// Send an HTTP request and return the response. + /// + /// Translates AHC errors → ``CloudHypervisor/Error/transport(_:)`` so + /// callers see a uniform error type regardless of failure mode. + func send( + method: HTTPMethod, + uri: String, + body: Data?, + headers: HTTPHeaders = [:] + ) async throws -> HTTPResponse { + // AHC handles the percent-encoding. nil only on a path that can't + // be encoded — surface it the same way the public Client init does. + guard let url = URL(httpURLWithSocketPath: socketPath, uri: uri) else { + throw CloudHypervisor.Error.invalidSocketPath(socketPath) + } + + var request = HTTPClientRequest(url: url.absoluteString) + request.method = method + + // Preserve all caller-supplied headers verbatim. + for (name, value) in headers { + request.headers.replaceOrAdd(name: name, value: value) + } + + // `Connection: close` is preserved from the previous transport. CH + // accepts both close and keep-alive, but close is the safer default + // until we have explicit smoke coverage of long-lived per-VM + // keep-alive behavior. Each request goes to a different per-VM UDS + // anyway so there's nothing to pool. + request.headers.replaceOrAdd(name: "Connection", value: "close") + + // Body framing. CH's HTTP parser rejects body-less PUTs unless the + // request carries `Content-Length: 0` instead of falling back to + // chunked transfer encoding. + // + // How AHC actually frames the request is subtle: + // `RequestValidation.setTransportFraming` strips any manually-set + // `Content-Length` and re-derives framing from the body's known + // length. Assigning `.bytes(ByteBuffer())` (rather than leaving + // body nil) sets `bodyLength == .known(0)`, which AHC then frames + // as `Content-Length: 0` for PUT/POST per RFC 7230 §3.3.2. Leaving + // body nil would surface as `bodyLength == .unknown`, and AHC may + // emit chunked framing or no framing at all, which CH rejects. + // The explicit `Content-Length: 0` header set below is documentation + // of intent — AHC removes it before deriving framing — but the + // wire shape is determined by the empty body assignment. + // + // Regression test: ClientTests.bodylessPUTSendsContentLengthZero. + if let body, !body.isEmpty { + if request.headers["Content-Type"].isEmpty { + request.headers.add(name: "Content-Type", value: "application/json") + } + request.body = .bytes(ByteBuffer(bytes: body)) + } else { + request.headers.replaceOrAdd(name: "Content-Length", value: "0") + request.body = .bytes(ByteBuffer()) + } + + let deadline = NIODeadline.now() + requestTimeout + logger.debug("HTTPOverUDSClient: \(method) \(uri) → \(socketPath)") + + do { + let response = try await httpClient.execute( + request, + deadline: deadline, + logger: logger + ) + + // 16 MiB is far larger than any CH response we expect — vm.info, + // the largest, measures in low-KB even for many-disk VMs. The + // cap exists so a wedged server can't OOM us. + // + // Use `readableBytesView` + the Sequence-based Data init rather + // than `Data(buffer: ByteBuffer)`: the latter requires + // `NIOFoundationCompat`, which the Linux musl build doesn't + // pull in via Foundation by default. + let bodyBuffer = try await response.body.collect(upTo: 1 << 24) + let bodyData = Data(bodyBuffer.readableBytesView) + + logger.debug("HTTPOverUDSClient: \(method) \(uri) ← \(response.status.code)") + return HTTPResponse( + status: response.status, + headers: response.headers, + body: bodyData + ) + } catch let error as CloudHypervisor.Error { + throw error + } catch { + throw CloudHypervisor.Error.transport(error) + } + } + + deinit { + // Fire the callback-based shutdown only when `shutdown()` wasn't + // already called. The sync variant would deadlock if deinit + // happened to run on one of the HTTPClient's own event loops + // (commit fe1c95cf); the callback variant returns immediately at + // the cost of any completion signal. If explicit shutdown + // already ran, the HTTPClient is drained and a second call would + // just return `alreadyShutdown` — but it can still try to + // schedule the callback on the (now-dead) event loop, which is + // exactly the failure mode this whole flag guards against. + let already = didShutdown.withLockedValue { state -> Bool in + if state { return true } + state = true + return false + } + guard !already else { return } + httpClient.shutdown { _ in } + } +} diff --git a/Sources/CloudHypervisor/README.md b/Sources/CloudHypervisor/README.md new file mode 100644 index 0000000..9f8d397 --- /dev/null +++ b/Sources/CloudHypervisor/README.md @@ -0,0 +1,95 @@ +# CloudHypervisor + +A standalone Swift library for driving the [cloud-hypervisor](https://github.com/cloud-hypervisor/cloud-hypervisor) REST API over a Unix domain socket. The package compiles on both macOS and Linux, though `cloud-hypervisor` itself only runs on Linux. + +## Dependencies + +- [swift-nio](https://github.com/apple/swift-nio): `NIOCore`, `NIOPosix`, `NIOHTTP1`, `NIOConcurrencyHelpers` +- [swift-log](https://github.com/apple/swift-log): `Logging` + +There are no transitive dependencies on any other `containerization` library types. + +## Usage + +```swift +import CloudHypervisor + +let client = try CloudHypervisor.Client( + socketPath: URL(filePath: "/tmp/ch-foo/api.sock") +) + +try await client.vmmPing() +try await client.vmCreate(VmConfig(/* ... */)) +try await client.vmBoot() +``` + +### Full example with shared event loop group + +```swift +import CloudHypervisor +import NIOPosix + +let group = MultiThreadedEventLoopGroup(numberOfThreads: 2) +defer { try? group.syncShutdownGracefully() } + +let client = try CloudHypervisor.Client( + socketPath: URL(filePath: "/run/ch/vm0.sock"), + eventLoopGroup: group +) + +let info = try await client.vmInfo() +print(info.state) +``` + +## Supported Endpoints (v1) + +### VMM + +- `vmmPing() -> VmmPingResponse` — verify the VMM process is alive +- `vmmShutdown()` — shut down the VMM process +- `vmmInfo() -> VmmInfo` — query VMM-level metadata + +### VM Lifecycle + +- `vmCreate(_ config: VmConfig)` — define a new VM +- `vmBoot()` — start the VM +- `vmShutdown()` — gracefully shut down the VM +- `vmInfo() -> VmInfo` — query VM state and configuration +- `vmPause()` — pause a running VM +- `vmResume()` — resume a paused VM + +### Hotplug + +- `vmAddDisk(_ config: DiskConfig) -> PciDeviceInfo` — hot-add a block device +- `vmAddFs(_ config: FsConfig) -> PciDeviceInfo` — hot-add a virtio-fs share +- `vmAddNet(_ config: NetConfig) -> PciDeviceInfo` — hot-add a network device +- `vmAddVsock(_ config: VsockConfig) -> PciDeviceInfo` — hot-add a vsock device +- `vmRemoveDevice(id: String)` — hot-remove a device by ID + +## Minimum Supported cloud-hypervisor Version + +The package targets the `/api/v1/` REST namespace. It is tested against **cloud-hypervisor v40** and later. Earlier releases may be missing endpoints or use incompatible JSON schemas. + +## Error Model + +All failures are reported through `CloudHypervisor.Error`: + +- `.transport(any Swift.Error)` — a network or NIO-level failure before the HTTP response was received +- `.http(status:body:)` — the server responded with a non-2xx HTTP status; `body` contains the raw response bytes +- `.decoding(any Swift.Error, body:)` — the response had a 2xx status but JSON decoding failed; `body` is the raw bytes for diagnostics +- `.invalidSocketPath(String)` — the URL passed to `Client.init` is not a `file://` URL + +Non-2xx responses always produce `.http`, never a decode error, so callers can distinguish protocol-level errors from unexpected payloads. + +## Concurrency + +`Client` is `Sendable` and all endpoint methods are `async throws`. Each call opens a fresh TCP-over-UDS connection to cloud-hypervisor and closes it when the response is complete. + +By default the client creates and owns a `MultiThreadedEventLoopGroup` and shuts it down in `deinit`. If you already have an event loop group (e.g. from NIO or another library), pass it via the `eventLoopGroup:` parameter — in that case the client does **not** shut the group down on `deinit`, leaving lifecycle management to the caller. + +## Non-Goals (v1) + +- Not a high-level VM orchestration layer — for that, use the `Containerization` library. +- Not exhaustive coverage of cloud-hypervisor's full OpenAPI surface — only the 14 endpoints listed above are implemented; additional endpoints can be added incrementally. +- No connection pooling — a fresh connection is opened per request, which is appropriate for low-volume control-plane use. +- No streaming response bodies — response payloads are buffered in memory before decoding. diff --git a/Sources/CloudHypervisor/Types/DeviceConfigs.swift b/Sources/CloudHypervisor/Types/DeviceConfigs.swift new file mode 100644 index 0000000..e54877d --- /dev/null +++ b/Sources/CloudHypervisor/Types/DeviceConfigs.swift @@ -0,0 +1,242 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension CloudHypervisor { + // MARK: - ImageType + + /// On-disk format of a `DiskConfig`'s backing file. When omitted on the + /// wire, cloud-hypervisor defaults to `Unknown` and rejects writes to + /// the disk (logging "Attempting to write to sector 0 on a disk without + /// specifying image_type"); always set this explicitly. + /// + /// Raw values match the Rust `block::ImageType` enum variants used in + /// CH's JSON serialization (PascalCase) — these differ from the + /// lowercase tokens accepted on the `--disk` CLI flag. + public enum ImageType: String, Sendable, Codable, Equatable { + case raw = "Raw" + case qcow2 = "Qcow2" + case fixedVhd = "FixedVhd" + case vhdx = "Vhdx" + case unknown = "Unknown" + } + + // MARK: - DiskConfig + + /// Virtio-blk disk configuration. + /// + /// Maps to `DiskConfig` in the Cloud Hypervisor OpenAPI spec. + public struct DiskConfig: Sendable, Codable, Equatable { + /// Path to the disk image file. + public var path: String + /// Open the disk in read-only mode. + public var readonly: Bool? + /// Use O_DIRECT for disk I/O. + public var direct: Bool? + /// Enable IOMMU for this device. + public var iommu: Bool? + /// Optional device identifier. + public var id: String? + /// PCI segment to attach the device to. + public var pciSegment: UInt16? + /// On-disk format of the backing file. + public var imageType: ImageType? + + public init( + path: String, + readonly: Bool? = nil, + direct: Bool? = nil, + iommu: Bool? = nil, + id: String? = nil, + pciSegment: UInt16? = nil, + imageType: ImageType? = nil + ) { + self.path = path + self.readonly = readonly + self.direct = direct + self.iommu = iommu + self.id = id + self.pciSegment = pciSegment + self.imageType = imageType + } + + enum CodingKeys: String, CodingKey { + case path + case readonly + case direct + case iommu + case id + case pciSegment = "pci_segment" + case imageType = "image_type" + } + } + + // MARK: - NetConfig + + /// Virtio-net network device configuration. + /// + /// Maps to `NetConfig` in the Cloud Hypervisor OpenAPI spec. + public struct NetConfig: Sendable, Codable, Equatable { + /// TAP device name on the host. + public var tap: String? + /// IPv4 address for the device. + public var ip: String? + /// IPv4 subnet mask. + public var mask: String? + /// MAC address for the device. + public var mac: String? + /// Maximum transmission unit. + public var mtu: Int? + /// Number of virtio queues. + public var numQueues: Int? + /// Size of each virtio queue. + public var queueSize: Int? + /// Optional device identifier. + public var id: String? + + public init( + tap: String? = nil, + ip: String? = nil, + mask: String? = nil, + mac: String? = nil, + mtu: Int? = nil, + numQueues: Int? = nil, + queueSize: Int? = nil, + id: String? = nil + ) { + self.tap = tap + self.ip = ip + self.mask = mask + self.mac = mac + self.mtu = mtu + self.numQueues = numQueues + self.queueSize = queueSize + self.id = id + } + + enum CodingKeys: String, CodingKey { + case tap + case ip + case mask + case mac + case mtu + case numQueues = "num_queues" + case queueSize = "queue_size" + case id + } + } + + // MARK: - FsConfig + + /// Virtio-fs filesystem device configuration. + /// + /// Maps to `FsConfig` in the Cloud Hypervisor OpenAPI spec. + public struct FsConfig: Sendable, Codable, Equatable { + /// Filesystem tag used by the guest to mount. + public var tag: String + /// Path to the virtiofsd Unix socket. + public var socket: String + /// Number of virtio queues. + public var numQueues: Int? + /// Size of each virtio queue. + public var queueSize: Int? + /// Optional device identifier. + public var id: String? + /// PCI segment to attach the device to. + public var pciSegment: UInt16? + + public init( + tag: String, + socket: String, + numQueues: Int? = nil, + queueSize: Int? = nil, + id: String? = nil, + pciSegment: UInt16? = nil + ) { + self.tag = tag + self.socket = socket + self.numQueues = numQueues + self.queueSize = queueSize + self.id = id + self.pciSegment = pciSegment + } + + enum CodingKeys: String, CodingKey { + case tag + case socket + case numQueues = "num_queues" + case queueSize = "queue_size" + case id + case pciSegment = "pci_segment" + } + } + + // MARK: - VsockConfig + + /// Virtio-vsock configuration. + /// + /// Maps to `VsockConfig` in the Cloud Hypervisor OpenAPI spec. + public struct VsockConfig: Sendable, Codable, Equatable { + /// Context ID (CID) for the vsock device. + public var cid: UInt32 + /// Path to the vsock Unix socket on the host. + public var socket: String + /// Enable IOMMU for this device. + public var iommu: Bool? + /// Optional device identifier. + public var id: String? + + public init( + cid: UInt32, + socket: String, + iommu: Bool? = nil, + id: String? = nil + ) { + self.cid = cid + self.socket = socket + self.iommu = iommu + self.id = id + } + + enum CodingKeys: String, CodingKey { + case cid + case socket + case iommu + case id + } + } + + // MARK: - PciDeviceInfo + + /// PCI device identifier returned by Cloud Hypervisor after device add. + /// + /// Maps to `PciDeviceInfo` in the Cloud Hypervisor OpenAPI spec. + public struct PciDeviceInfo: Sendable, Codable, Equatable { + /// Device identifier string. + public var id: String + /// PCI Bus:Device.Function address (e.g. `"0000:00:03.0"`). + public var bdf: String + + public init(id: String, bdf: String) { + self.id = id + self.bdf = bdf + } + + enum CodingKeys: String, CodingKey { + case id + case bdf + } + } +} diff --git a/Sources/CloudHypervisor/Types/VmConfig.swift b/Sources/CloudHypervisor/Types/VmConfig.swift new file mode 100644 index 0000000..429b7db --- /dev/null +++ b/Sources/CloudHypervisor/Types/VmConfig.swift @@ -0,0 +1,187 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension CloudHypervisor { + // MARK: - VmConfig + + /// Top-level VM boot / create payload. + /// + /// Maps to `VmConfig` in the Cloud Hypervisor OpenAPI spec. + public struct VmConfig: Sendable, Codable, Equatable { + public var cpus: CpusConfig + public var memory: MemoryConfig + public var payload: PayloadConfig + public var disks: [DiskConfig]? + public var net: [NetConfig]? + public var fs: [FsConfig]? + public var vsock: VsockConfig? + public var console: ConsoleConfig + public var serial: ConsoleConfig + + public init( + cpus: CpusConfig, + memory: MemoryConfig, + payload: PayloadConfig, + disks: [DiskConfig]? = nil, + net: [NetConfig]? = nil, + fs: [FsConfig]? = nil, + vsock: VsockConfig? = nil, + console: ConsoleConfig, + serial: ConsoleConfig + ) { + self.cpus = cpus + self.memory = memory + self.payload = payload + self.disks = disks + self.net = net + self.fs = fs + self.vsock = vsock + self.console = console + self.serial = serial + } + + enum CodingKeys: String, CodingKey { + case cpus + case memory + case payload + case disks + case net + case fs + case vsock + case console + case serial + } + } + + // MARK: - CpusConfig + + /// CPU configuration for a VM. + /// + /// Maps to `CpusConfig` in the Cloud Hypervisor OpenAPI spec. + public struct CpusConfig: Sendable, Codable, Equatable { + /// Number of vCPUs to boot with. + public var bootVcpus: Int + /// Maximum number of vCPUs (for hotplug). + public var maxVcpus: Int + + public init(bootVcpus: Int, maxVcpus: Int) { + self.bootVcpus = bootVcpus + self.maxVcpus = maxVcpus + } + + enum CodingKeys: String, CodingKey { + case bootVcpus = "boot_vcpus" + case maxVcpus = "max_vcpus" + } + } + + // MARK: - MemoryConfig + + /// Memory configuration for a VM. + /// + /// Maps to `MemoryConfig` in the Cloud Hypervisor OpenAPI spec. + public struct MemoryConfig: Sendable, Codable, Equatable { + /// RAM size in bytes. + public var size: UInt64 + /// Hotplug memory size in bytes. + public var hotplugSize: UInt64? + /// Enable memory merging (KSM). + public var mergeable: Bool? + /// Use a shared memory mapping (`MAP_SHARED`). Required when any + /// vhost-user device (e.g. virtio-fs / virtiofsd) is attached — + /// CH otherwise rejects `vm.boot` with "Using vhost-user requires + /// using shared memory or huge pages". + public var shared: Bool? + + public init(size: UInt64, hotplugSize: UInt64? = nil, mergeable: Bool? = nil, shared: Bool? = nil) { + self.size = size + self.hotplugSize = hotplugSize + self.mergeable = mergeable + self.shared = shared + } + + enum CodingKeys: String, CodingKey { + case size + case hotplugSize = "hotplug_size" + case mergeable + case shared + } + } + + // MARK: - PayloadConfig + + /// Kernel / initramfs / cmdline payload for a VM. + /// + /// Maps to `PayloadConfig` in the Cloud Hypervisor OpenAPI spec. + public struct PayloadConfig: Sendable, Codable, Equatable { + /// Path to the uncompressed kernel image (vmlinux). + public var kernel: String + /// Optional initramfs path. + public var initramfs: String? + /// Optional kernel command line. + public var cmdline: String? + + public init(kernel: String, initramfs: String? = nil, cmdline: String? = nil) { + self.kernel = kernel + self.initramfs = initramfs + self.cmdline = cmdline + } + + enum CodingKeys: String, CodingKey { + case kernel + case initramfs + case cmdline + } + } + + // MARK: - ConsoleConfig + + /// Console / serial device configuration. + /// + /// Maps to `ConsoleConfig` in the Cloud Hypervisor OpenAPI spec. + public struct ConsoleConfig: Sendable, Codable, Equatable { + /// Console I/O mode. + /// + /// CH's OpenAPI spec uses these capitalized strings literally. + public enum Mode: String, Codable, Sendable { + case Off + case Pty + case Tty + case File + case Socket + case Null + } + + public var mode: Mode + /// Path to the output file when `mode == .File`. + public var file: String? + /// Path to the Unix socket when `mode == .Socket`. + public var socket: String? + + public init(mode: Mode, file: String? = nil, socket: String? = nil) { + self.mode = mode + self.file = file + self.socket = socket + } + + enum CodingKeys: String, CodingKey { + case mode + case file + case socket + } + } + +} diff --git a/Sources/CloudHypervisor/Types/VmInfo.swift b/Sources/CloudHypervisor/Types/VmInfo.swift new file mode 100644 index 0000000..f37f63e --- /dev/null +++ b/Sources/CloudHypervisor/Types/VmInfo.swift @@ -0,0 +1,122 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension CloudHypervisor { + // MARK: - VmState + + /// Lifecycle state of a Cloud Hypervisor VM. + /// + /// Maps to `VmState` in the Cloud Hypervisor OpenAPI spec. + /// The raw values match CH's literal strings exactly (capitalized). + public enum VmState: String, Sendable, Codable, Equatable { + case Created + case Running + case Shutdown + case Paused + case BreakPoint + } + + // MARK: - VmInfo + + /// Response body for `GET /vm.info`. + /// + /// Maps to `VmInfo` in the Cloud Hypervisor OpenAPI spec. + /// + /// Note: the `device_tree` map (`[String: VmInfoDeviceNode]`) from the + /// upstream OpenAPI spec is omitted in this v1 implementation — no current + /// endpoint consumers require it. Add when needed. + public struct VmInfo: Sendable, Codable, Equatable { + /// The boot configuration used for this VM. + public var config: VmConfig + /// Current lifecycle state. + public var state: VmState + /// Actual memory size in bytes as reported by the VMM, if available. + public var memoryActualSize: UInt64? + + public init(config: VmConfig, state: VmState, memoryActualSize: UInt64? = nil) { + self.config = config + self.state = state + self.memoryActualSize = memoryActualSize + } + + enum CodingKeys: String, CodingKey { + case config + case state + case memoryActualSize = "memory_actual_size" + } + } + + // MARK: - VmmPingResponse + + /// Response body for `GET /vmm.ping`. + /// + /// Maps to `VmmPingResponse` in the Cloud Hypervisor OpenAPI spec. + public struct VmmPingResponse: Sendable, Codable, Equatable { + /// Cloud Hypervisor version string (e.g. `"v40.0"`). + public var version: String + /// PID of the VMM process, if provided. + public var pid: Int? + /// List of compiled-in feature flags, if provided. + public var features: [String]? + /// Build-time version string, if provided. + public var buildVersion: String? + + public init(version: String, pid: Int? = nil, features: [String]? = nil, buildVersion: String? = nil) { + self.version = version + self.pid = pid + self.features = features + self.buildVersion = buildVersion + } + + enum CodingKeys: String, CodingKey { + case version + case pid + case features + case buildVersion = "build_version" + } + } + + // MARK: - VmmInfo + + /// Response body for `GET /vmm.info`. + /// + /// Maps to a subset of the `VmmInfo` schema in the Cloud Hypervisor OpenAPI + /// spec. Only the fields needed by v1 consumers are included (YAGNI). + public struct VmmInfo: Sendable, Codable, Equatable { + /// Cloud Hypervisor version string (e.g. `"v40.0"`). + public var version: String + /// PID of the VMM process, if provided. + public var pid: Int? + /// Build-time version string, if provided. + public var buildVersion: String? + /// The currently-running VM's boot configuration, if a VM exists. + public var config: VmConfig? + + public init(version: String, pid: Int? = nil, buildVersion: String? = nil, config: VmConfig? = nil) { + self.version = version + self.pid = pid + self.buildVersion = buildVersion + self.config = config + } + + enum CodingKeys: String, CodingKey { + case version + case pid + case buildVersion = "build_version" + case config + } + } +} diff --git a/Sources/Containerization/AttachedFilesystem.swift b/Sources/Containerization/AttachedFilesystem.swift new file mode 100644 index 0000000..f9dbfe5 --- /dev/null +++ b/Sources/Containerization/AttachedFilesystem.swift @@ -0,0 +1,53 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import ContainerizationOCI + +/// A filesystem that was attached and able to be mounted inside the runtime environment. +public struct AttachedFilesystem: Sendable { + /// The type of the filesystem. + public var type: String + /// The path to the filesystem within a sandbox. + public var source: String + /// Destination when mounting the filesystem inside a sandbox. + public var destination: String + /// The options to use when mounting the filesystem. + public var options: [String] + + public init(mount: Mount, allocator: any AddressAllocator) throws { + switch mount.runtimeOptions { + case .virtiofs: + let name = try hashFilePath(path: mount.source) + self.source = name + case .virtioblk: + let char = try allocator.allocate() + self.source = "/dev/vd\(char)" + case .shared, .any: + self.source = mount.source + } + self.type = mount.type + self.options = mount.options + self.destination = mount.destination + } + + public init(type: String, source: String, destination: String, options: [String]) { + self.type = type + self.source = source + self.destination = destination + self.options = options + } +} diff --git a/Sources/Containerization/BridgeManager.swift b/Sources/Containerization/BridgeManager.swift new file mode 100644 index 0000000..c117d19 --- /dev/null +++ b/Sources/Containerization/BridgeManager.swift @@ -0,0 +1,399 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationExtras +import ContainerizationNetlink +import Foundation +import Logging + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +/// Linux-only host plumbing for a container bridge network. +/// +/// `create()` is idempotent: it brings the bridge to a known state (created +/// if absent, configured if already present), records what it changed in +/// `/run/containerization/bridge-.state`, and `delete()` reverses +/// only what was recorded. +/// +/// **NAT is opt-in.** With the default (`enableNAT: false`) `create()` only +/// brings up the bridge link and assigns the gateway IP — it does NOT touch +/// `ip_forward`, does NOT program iptables, and does NOT pick an egress +/// interface. Containers attached to the bridge can talk to each other and +/// to the host, but not to the outside world. Pass `enableNAT: true` to +/// also enable IPv4 forwarding and program a scoped MASQUERADE/FORWARD +/// pair (`-i -o `); the bridge becomes a NAT exit and the +/// host now routes guest traffic. +/// +/// Concurrent `create()`/`delete()` calls (e.g. from two `cctl run` +/// processes) serialize via `flock(LOCK_EX)` on +/// `/run/containerization/bridge-.lock`. +/// +/// Requires root (or `CAP_NET_ADMIN` plus, when NAT is enabled, the ability +/// to write `/proc/sys/...` and invoke `iptables`). +public struct BridgeManager: Sendable { + public let name: String + public let subnet: CIDRv4 + public let gateway: IPv4Address + public let mtu: UInt32 + public let egressInterface: String? + public let enableNAT: Bool + private let log: Logger + + /// - Parameters: + /// - name: bridge interface name (e.g. `cz0`). + /// - subnet: subnet to assign on the bridge. + /// - gateway: host-side IP on the bridge. Defaults to `subnet.gateway` + /// (= `subnet.lower + 1`). + /// - mtu: bridge MTU. Default 1500. + /// - egressInterface: explicit egress iface for MASQUERADE. nil = + /// auto-detect via `/proc/net/route` at `create()` time. Only used + /// when `enableNAT` is true. + /// - enableNAT: when true, program iptables MASQUERADE+FORWARD and + /// enable `net.ipv4.ip_forward`. Default false — the bridge is + /// created without external connectivity, leaving host firewall + /// policy untouched. + /// - logger: optional logger. Defaults to a `bridge`-labeled logger. + public init( + name: String, + subnet: CIDRv4, + gateway: IPv4Address? = nil, + mtu: UInt32 = 1500, + egressInterface: String? = nil, + enableNAT: Bool = false, + logger: Logger? = nil + ) { + self.name = Self.validateInterfaceName(name) + self.subnet = subnet + self.gateway = gateway ?? subnet.gateway + self.mtu = mtu + self.egressInterface = egressInterface.map(Self.validateInterfaceName) + self.enableNAT = enableNAT + self.log = logger ?? Logger(label: "com.apple.containerization.bridge") + } + + /// Reject obviously-bogus interface names before they hit netlink or + /// `iptables`. This is a defense-in-depth check; the kernel and + /// `iptables` themselves will also reject pathological inputs, but doing + /// it here surfaces the error in a callable Swift API rather than as a + /// netlink rc or iptables exit. Asserts (rather than throws) — these + /// constraints are static, so a violation is a programming error. + private static func validateInterfaceName(_ name: String) -> String { + // IFNAMSIZ on Linux is 16 (15 usable + NUL). iptables itself caps + // at 15. Names with `/`, whitespace, or NUL are kernel-rejected. + precondition(!name.isEmpty, "interface name must be non-empty") + precondition(name.utf8.count <= 15, "interface name '\(name)' exceeds IFNAMSIZ-1 (15)") + precondition( + !name.contains(where: { $0.isWhitespace || $0 == "/" || $0 == "\0" || $0 == ":" }), + "interface name '\(name)' contains invalid characters" + ) + return name + } + + /// Idempotent create. + public func create() throws { + try Self.ensureStateDirectory() + let lock = try FileLock(path: Self.lockPath(for: name)) + try lock.withExclusive { + try createLocked() + } + } + + /// Idempotent delete. No-op when the bridge does not exist. + public func delete() throws { + try Self.ensureStateDirectory() + let lock = try FileLock(path: Self.lockPath(for: name)) + try lock.withExclusive { + try deleteLocked() + } + } + + private func createLocked() throws { + let session = NetlinkSession(socket: try DefaultNetlinkSocket(), log: log) + let stateURL = URL(fileURLWithPath: Self.statePath(for: name)) + + // Preserve `prevIpForward` across re-runs: a second NAT-enabled + // create() call would otherwise read the value the FIRST run left + // behind ("1") and clobber the original prior state, so delete() + // couldn't restore. + let priorState: BridgeState? = (try? Data(contentsOf: stateURL)) + .flatMap { try? BridgeState.decode($0) } + + // 1. Bridge link. + do { + try session.linkAddBridge(name: name) + log.info("created bridge \(name)") + } catch { + // EEXIST is fine; treat any error as "maybe it exists" and probe. + // `linkGet` throws ENODEV when the iface is absent (rather than + // returning an empty array), so coalesce both shapes to "absent". + let existing = (try? session.linkGet(interface: name)) ?? [] + if existing.isEmpty { + throw ContainerizationError( + .internalError, + message: "linkAddBridge \(name) failed and bridge does not exist: \(error)" + ) + } + log.debug("bridge \(name) already exists") + } + + // 2. Address (gateway/prefix) on the bridge. + let cidr = try CIDRv4(gateway, prefix: subnet.prefix) + do { + try session.addressAdd(interface: name, ipv4Address: cidr) + } catch { + // EEXIST tolerated; netlink layer doesn't expose errno cleanly, + // so log and continue. linkSet/up below will fail visibly if the + // bridge state is actually broken. + log.debug("addressAdd \(cidr) on \(name) returned \(error) (likely already set)") + } + + // 3. Up + MTU. + try session.linkSet(interface: name, up: true, mtu: mtu) + + // NAT is opt-in but sticky: once enabled by a previous create(), + // subsequent create() calls without --enable-nat leave the existing + // rules and ip_forward state in place. Otherwise `cctl run` + // (defaults to NAT off) called after `cctl bridge create + // --enable-nat` would silently disable the NAT the user explicitly + // turned on. delete() always reverses whatever the state file + // records. + let effectiveNAT = enableNAT || (priorState?.natEnabled ?? false) + guard effectiveNAT else { + let state = BridgeState(natEnabled: false) + try state.encode().write(to: stateURL) + log.info("bridge \(name) ready (subnet \(subnet), NAT disabled)") + return + } + + // 4. ip_forward: read what's currently on the host, decide what to + // record. If we already have a NAT-enabled state file from a prior + // create(), keep its `prevIpForward` (it's the *original* prior + // value); otherwise record what we just read. + let currentIpForward = (try? Self.readSysctl("net/ipv4/ip_forward")) ?? "0" + let prevIpForward = (priorState?.natEnabled == true ? priorState?.prevIpForward : nil) ?? currentIpForward + if currentIpForward != "1" { + try Self.writeSysctl("net/ipv4/ip_forward", value: "1") + } + + // 5. Egress iface — explicit override or auto-detect. + let egress: String + if let explicit = egressInterface { + egress = explicit + } else if let detected = HostDefaultRoute.currentEgress() { + egress = detected + } else { + throw ContainerizationError( + .invalidArgument, + message: "no default route on host; pass egressInterface explicitly" + ) + } + + // 6. Record state BEFORE iptables. If a later iptables -A fails, + // delete() still has authority to clean up partial rules; if we + // deferred the write until after, a mid-failure would orphan rules + // with no record. + let state = BridgeState( + natEnabled: true, + prevIpForward: prevIpForward, + egressInterface: egress + ) + try state.encode().write(to: stateURL) + + // 7. iptables rules — idempotent. The FORWARD rule is scoped to + // `-i -o ` so the host doesn't become an + // unrestricted router for guest traffic across every host iface + // (e.g. a VPN or a sibling bridge). + try IptablesRules.ensure( + table: "nat", + args: [ + "POSTROUTING", "-s", subnet.description, "!", "-o", name, "-j", "MASQUERADE", + ]) + try IptablesRules.ensure(args: [ + "FORWARD", "-i", name, "-o", egress, "-j", "ACCEPT", + ]) + try IptablesRules.ensure(args: [ + "FORWARD", "-i", egress, "-o", name, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT", + ]) + + log.info("bridge \(name) ready (subnet \(subnet), egress \(egress), NAT enabled)") + } + + private func deleteLocked() throws { + let stateURL = URL(fileURLWithPath: Self.statePath(for: name)) + let state: BridgeState? = (try? Data(contentsOf: stateURL)) + .flatMap { try? BridgeState.decode($0) } + + // 1. iptables — only if a prior create() with NAT enabled left state + // we own. The rules are keyed off subnet, bridge name, and the + // recorded egress iface, so removal is precise even when the + // host has rules from other tools. + if let state, state.natEnabled, let egress = state.egressInterface { + log.debug("removing iptables rules for bridge \(name) (egress \(egress))") + IptablesRules.remove( + table: "nat", + args: [ + "POSTROUTING", "-s", subnet.description, "!", "-o", name, "-j", "MASQUERADE", + ]) + IptablesRules.remove(args: [ + "FORWARD", "-i", name, "-o", egress, "-j", "ACCEPT", + ]) + IptablesRules.remove(args: [ + "FORWARD", "-i", egress, "-o", name, "-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED", "-j", "ACCEPT", + ]) + } + + // 2. Bridge link. + let session = NetlinkSession(socket: try DefaultNetlinkSocket(), log: log) + // Refuse to delete anything that isn't actually a bridge — the + // kernel exposes `/sys/class/net//bridge` only for links of + // kind=bridge, so its presence is an authoritative kind check + // without parsing IFLA_LINKINFO. This guards against `cctl bridge + // delete --name eth0` (or docker0, etc.) taking down host links. + let sysfsBridge = "/sys/class/net/\(name)/bridge" + let isBridge = FileManager.default.fileExists(atPath: sysfsBridge) + let exists = !((try? session.linkGet(interface: name)) ?? []).isEmpty + if exists && !isBridge { + throw ContainerizationError( + .invalidArgument, + message: "refusing to delete \(name): exists but is not a bridge interface" + ) + } + do { + try session.linkDel(name: name) + log.info("deleted bridge \(name)") + } catch { + // ENODEV-like: nothing to do. + log.debug("linkDel \(name) returned \(error) (likely already absent)") + } + + // 3. Restore ip_forward only if this bridge's create()-with-NAT set + // it from 0 AND no other containerization bridge still has NAT + // enabled. ip_forward is a single global sysctl shared by every + // bridge, so it must be reference-counted against the on-disk state + // files rather than blindly reset — otherwise tearing down one NAT + // bridge would disable forwarding for a sibling that still needs it. + // + // (Torn down in the order that removes the original flipper first — + // or two NAT bridges torn down concurrently — may leave ip_forward=1 + // after the last bridge is gone. That's the safe direction: + // forwarding with no bridge or iptables rules attached is inert, and + // a reboot clears it. Erroneously forcing it to 0 under a live NAT + // bridge is the failure this guards against.) + let otherNAT = Self.otherNATEnabledBridgesExist(excluding: name) + if state?.natEnabled == true, state?.prevIpForward == "0", !otherNAT { + try? Self.writeSysctl("net/ipv4/ip_forward", value: "0") + } + + // 4. Remove state file. + try? FileManager.default.removeItem(at: stateURL) + } + + // MARK: - Paths / sysctl helpers + + private static let stateDir = "/run/containerization" + + private static func statePath(for name: String) -> String { + "\(stateDir)/bridge-\(name).state" + } + + private static func lockPath(for name: String) -> String { + "\(stateDir)/bridge-\(name).lock" + } + + private static func ensureStateDirectory() throws { + try FileManager.default.createDirectory( + atPath: stateDir, + withIntermediateDirectories: true, + attributes: [.posixPermissions: 0o755] + ) + } + + private static func readSysctl(_ path: String) throws -> String { + let url = URL(fileURLWithPath: "/proc/sys/\(path)") + return try String(contentsOf: url, encoding: .utf8) + .trimmingCharacters(in: .whitespacesAndNewlines) + } + + private static func writeSysctl(_ path: String, value: String) throws { + let url = URL(fileURLWithPath: "/proc/sys/\(path)") + try Data((value + "\n").utf8).write(to: url) + } + + /// Whether any *other* containerization bridge still has NAT enabled, + /// determined by scanning the `bridge-*.state` files under `stateDir`. + /// Used by `delete()` to reference-count the shared global `ip_forward` + /// sysctl so tearing down one NAT bridge doesn't disable forwarding for + /// its siblings. `excluding` is this bridge's name — its own (still + /// present) state file is skipped since `delete()` removes it afterward. + private static func otherNATEnabledBridgesExist(excluding name: String) -> Bool { + let selfFile = "bridge-\(name).state" + let entries = (try? FileManager.default.contentsOfDirectory(atPath: stateDir)) ?? [] + for entry in entries { + guard entry.hasPrefix("bridge-"), entry.hasSuffix(".state"), entry != selfFile else { + continue + } + let url = URL(fileURLWithPath: "\(stateDir)/\(entry)") + guard + let data = try? Data(contentsOf: url), + let state = try? BridgeState.decode(data) + else { + continue + } + if state.natEnabled { + return true + } + } + return false + } +} + +/// `flock(2)` wrapper. Held for the duration of a closure. +struct FileLock { + let fd: Int32 + + init(path: String) throws { + let f = open(path, O_RDWR | O_CREAT | O_CLOEXEC, 0o600) + guard f >= 0 else { + throw ContainerizationError( + .internalError, + message: "open \(path) failed: errno=\(errno)" + ) + } + self.fd = f + } + + func withExclusive(_ body: () throws -> T) throws -> T { + guard flock(fd, LOCK_EX) == 0 else { + close(fd) + throw ContainerizationError( + .internalError, + message: "flock LOCK_EX failed: errno=\(errno)" + ) + } + defer { + _ = flock(fd, LOCK_UN) + close(fd) + } + return try body() + } +} +#endif diff --git a/Sources/Containerization/BridgeStateFile.swift b/Sources/Containerization/BridgeStateFile.swift new file mode 100644 index 0000000..34dbd09 --- /dev/null +++ b/Sources/Containerization/BridgeStateFile.swift @@ -0,0 +1,75 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// On-disk record of state `BridgeManager.create()` modified, used by +/// `delete()` to restore the host. Stored at +/// `/run/containerization/bridge-.state` (tmpfs — gone after host +/// reboot, which is fine because reboot already clears `ip_forward` and +/// the bridge link itself). +struct BridgeState: Codable, Equatable { + /// Whether `create()` programmed NAT (iptables MASQUERADE/FORWARD + + /// `ip_forward`). When `false`, the only thing `create()` did was bring + /// the bridge up — `delete()` only needs to remove the link, not roll + /// back NAT. State files predating this field are decoded as + /// `natEnabled = true` for back-compat. + let natEnabled: Bool + + /// Value of `/proc/sys/net/ipv4/ip_forward` read at the *first* + /// `create()` call. Preserved across re-runs so `delete()` can restore + /// the host's true original value. Only set when `natEnabled`. + let prevIpForward: String? + + /// Egress interface that `create()` used in the iptables rules — passed + /// explicitly by the caller, or auto-detected from `/proc/net/route`. + /// Only set when `natEnabled`. Recorded for debug / observability and + /// to scope the FORWARD rule's `-o` clause; rule removal is keyed off + /// subnet, bridge name, and egress. + let egressInterface: String? + + init(natEnabled: Bool, prevIpForward: String? = nil, egressInterface: String? = nil) { + self.natEnabled = natEnabled + self.prevIpForward = prevIpForward + self.egressInterface = egressInterface + } + + enum CodingKeys: String, CodingKey { + case natEnabled + case prevIpForward + case egressInterface + } + + init(from decoder: Decoder) throws { + let container = try decoder.container(keyedBy: CodingKeys.self) + // Default natEnabled to true when missing so files written by older + // versions (which always programmed NAT) still describe themselves + // accurately — delete() will roll back ip_forward / iptables. + self.natEnabled = try container.decodeIfPresent(Bool.self, forKey: .natEnabled) ?? true + self.prevIpForward = try container.decodeIfPresent(String.self, forKey: .prevIpForward) + self.egressInterface = try container.decodeIfPresent(String.self, forKey: .egressInterface) + } + + func encode() throws -> Data { + let encoder = JSONEncoder() + encoder.outputFormatting = [.prettyPrinted, .sortedKeys] + return try encoder.encode(self) + } + + static func decode(_ data: Data) throws -> BridgeState { + try JSONDecoder().decode(BridgeState.self, from: data) + } +} diff --git a/Sources/Containerization/CHHotplugProvider.swift b/Sources/Containerization/CHHotplugProvider.swift new file mode 100644 index 0000000..9036da5 --- /dev/null +++ b/Sources/Containerization/CHHotplugProvider.swift @@ -0,0 +1,422 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import CloudHypervisor +import ContainerizationError +import ContainerizationExtras +import Foundation +import Logging +import NIOHTTP1 +import Synchronization + +/// Hotplug provider for the cloud-hypervisor backend. +/// +/// Handles both block (`vm.add-disk`) and virtiofs (`vm.add-fs`, with one +/// `virtiofsd` per unique source-hash tag) hotplug, plus the matching +/// `vm.remove-device` teardown. Owns the per-VM mount registry so +/// `CHVirtualMachineInstance.mounts` can forward to it. +final class CHHotplugProvider: HotplugProvider { + struct HotplugRecord: Sendable { + let chDeviceId: String + let kind: Kind + + enum Kind: Sendable { + case block(letter: Character) + case virtiofs(tag: String) + } + } + + struct VirtiofsdTagState: Sendable { + var process: VirtiofsdProcess + var refcount: Int + var chDeviceId: String + } + + private let client: CloudHypervisor.Client + private let workDir: URL + private let virtiofsdBinaryOverride: URL? + private let allocator: any AddressAllocator + private let _mounts: Mutex<[String: [AttachedFilesystem]]> + private let _records: Mutex<[String: [HotplugRecord]]> + private let _tags: Mutex<[String: VirtiofsdTagState]> + /// Serializes per-tag virtiofsd spawn so a concurrent hotplug for the + /// same tag can't race the existence-check / process-registration window + /// (TOCTOU → orphaned virtiofsd). Held across awaits, so it must be an + /// `AsyncLock` rather than the sync `Mutex` that protects `_tags`. + private let spawnLock: AsyncLock + private let logger: Logger? + + init( + client: CloudHypervisor.Client, + workDir: URL, + virtiofsdBinary: URL?, + allocator: any AddressAllocator, + initialMounts: [String: [AttachedFilesystem]], + logger: Logger? + ) { + self.client = client + self.workDir = workDir + self.virtiofsdBinaryOverride = virtiofsdBinary + self.allocator = allocator + self._mounts = Mutex(initialMounts) + self._records = Mutex([:]) + self._tags = Mutex([:]) + self.spawnLock = AsyncLock() + self.logger = logger + } + + // MARK: - Read accessors + + var mounts: [String: [AttachedFilesystem]] { + _mounts.withLock { $0 } + } + + func withMountRegistry( + _ body: (inout sending [String: [AttachedFilesystem]]) throws -> sending T + ) rethrows -> T { + try _mounts.withLock(body) + } + + // MARK: - HotplugProvider conformance + + func hotplug(_ block: Mount, id: String) async throws -> AttachedFilesystem { + guard case .virtioblk = block.runtimeOptions else { + throw ContainerizationError(.invalidArgument, message: "hotplug requires a virtio-blk mount") + } + + let letter = try allocator.allocate() + let chId = "blk-\(id)-\(letter)" + let disk = CloudHypervisor.DiskConfig( + path: block.source, + readonly: block.options.contains("ro"), + id: chId, + imageType: .raw + ) + + let pci: CloudHypervisor.PciDeviceInfo + do { + pci = try await chCall { try await self.client.vmAddDisk(disk) } + } catch { + try? allocator.release(letter) + throw error + } + + let attached = AttachedFilesystem( + type: block.type, + source: "/dev/vd\(letter)", + destination: block.destination, + options: block.options + ) + + _records.withLock { + $0[id, default: []].append(HotplugRecord(chDeviceId: pci.id, kind: .block(letter: letter))) + } + return attached + } + + func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws { + var attached: [AttachedFilesystem] = [rootfs] + for mount in additionalMounts { + attached.append(try AttachedFilesystem(mount: mount, allocator: allocator)) + } + _mounts.withLock { + $0[id, default: []].append(contentsOf: attached) + } + } + + func releaseHotplug(id: String) async throws { + let popped: [HotplugRecord] = _records.withLock { records in + let all = records[id] ?? [] + let blocks = all.filter { record in + if case .block = record.kind { return true } + return false + } + let remaining = all.filter { record in + if case .block = record.kind { return false } + return true + } + if remaining.isEmpty { + records.removeValue(forKey: id) + } else { + records[id] = remaining + } + return blocks + } + + for rec in popped { + do { + try await chCall { try await self.client.vmRemoveDevice(id: rec.chDeviceId) } + } catch { + logger?.warning("vmRemoveDevice failed for \(rec.chDeviceId): \(error)") + } + if case .block(let letter) = rec.kind { + try? allocator.release(letter) + } + } + + // Drop block-derived AttachedFilesystem entries for `id`. Block entries + // are the ones whose source was rewritten to "/dev/vd" by + // `hotplug(_:)` (or by AttachedFilesystem(mount:allocator:) for an + // additionalMount of type virtio-blk). + _mounts.withLock { state in + guard var perID = state[id] else { return } + perID.removeAll { $0.source.hasPrefix("/dev/vd") } + if perID.isEmpty { + state.removeValue(forKey: id) + } else { + state[id] = perID + } + } + } + + func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws { + let virtiofs = mounts.filter { + if case .virtiofs = $0.runtimeOptions { return true } + return false + } + guard !virtiofs.isEmpty else { return } + + // Group by tag (source-hash). Multiple Mounts to the same source dir + // share a tag and a single virtiofsd. + var byTag: [String: [Mount]] = [:] + for mount in virtiofs { + let tag = try hashFilePath(path: mount.source) + byTag[tag, default: []].append(mount) + } + + for (tag, group) in byTag { + // Hold spawnLock across the existence check and the spawn / + // _tags write so two concurrent calls for the same tag can't + // both decide alreadyRunning=false and double-spawn virtiofsd + // (the second write would clobber the first in `_tags`, + // orphaning that process). + try await spawnLock.withLock { _ in + // Build per-container AttachedFilesystem entries up front. + // These depend only on Mount + allocator and don't need the + // chDeviceId, so surfacing any error here keeps the + // transactional shape: nothing irreversible has happened + // yet, no virtiofsd has spawned, no _tags entry written. + var attached: [AttachedFilesystem] = [] + for mount in group { + attached.append(try AttachedFilesystem(mount: mount, allocator: self.allocator)) + } + + let chDeviceId: String + + // Refcount-bump path. If a virtiofsd already serves this + // tag, increment refcount and use the cached deviceId. + let cachedDeviceId: String? = self._tags.withLock { tags in + if var state = tags[tag] { + state.refcount += 1 + tags[tag] = state + return state.chDeviceId + } + return nil + } + + if let cached = cachedDeviceId { + chDeviceId = cached + } else { + // First-spawn path. Walk: spawn → vmAddFs → commit _tags, + // with rollback at every step so a partial failure can't + // leave a virtiofsd running unrecorded. + let socket = chVirtiofsSocketURL(workDir: self.workDir, tag: tag) + let readonly = group.allSatisfy { $0.options.contains("ro") } + guard let source = group.first?.source else { return } + let virtiofsdBinary = try CHVirtualMachineManager.resolveBinary( + self.virtiofsdBinaryOverride, + name: "virtiofsd" + ) + + let process = VirtiofsdProcess( + config: .init( + binary: virtiofsdBinary, + socketPath: socket, + sharedDir: URL(fileURLWithPath: source), + readonly: readonly + ), + logger: self.logger + ) + + try await process.start() + + let fsConfig = CloudHypervisor.FsConfig( + tag: tag, + socket: socket.path, + id: "fs-\(tag)" + ) + let pci: CloudHypervisor.PciDeviceInfo + do { + pci = try await chCall { try await self.client.vmAddFs(fsConfig) } + } catch { + await process.terminate(graceSeconds: 5) + try? FileManager.default.removeItem(at: socket) + throw error + } + + self._tags.withLock { + $0[tag] = VirtiofsdTagState(process: process, refcount: 1, chDeviceId: pci.id) + } + chDeviceId = pci.id + } + + // Bookkeeping. Both writes are non-throwing closures, and + // `attached` was built up front, so once we reach here + // nothing can fail between the refcount/spawn commit above + // and the per-container record below — the orphan window + // (tag committed, record missing) is closed. + self._records.withLock { + $0[id, default: []].append(HotplugRecord(chDeviceId: chDeviceId, kind: .virtiofs(tag: tag))) + } + self._mounts.withLock { + $0[id, default: []].append(contentsOf: attached) + } + } + } + } + + func releaseVirtioFS(id: String) async throws { + let popped: [HotplugRecord] = _records.withLock { records in + let all = records[id] ?? [] + let fs = all.filter { record in + if case .virtiofs = record.kind { return true } + return false + } + let remaining = all.filter { record in + if case .virtiofs = record.kind { return false } + return true + } + if remaining.isEmpty { + records.removeValue(forKey: id) + } else { + records[id] = remaining + } + return fs + } + + var processesToStop: [(VirtiofsdProcess, String, String)] = [] // (process, tag, chDeviceId) + for rec in popped { + guard case .virtiofs(let tag) = rec.kind else { continue } + _tags.withLock { tags in + guard var state = tags[tag] else { return } + state.refcount -= 1 + if state.refcount <= 0 { + tags.removeValue(forKey: tag) + processesToStop.append((state.process, tag, state.chDeviceId)) + } else { + tags[tag] = state + } + } + } + + for (process, tag, chDeviceId) in processesToStop { + do { + try await chCall { try await self.client.vmRemoveDevice(id: chDeviceId) } + } catch { + logger?.warning("vmRemoveDevice failed for \(chDeviceId): \(error)") + } + await process.terminate(graceSeconds: 5) + let socket = chVirtiofsSocketURL(workDir: workDir, tag: tag) + try? FileManager.default.removeItem(at: socket) + } + + // Drop virtiofs AttachedFilesystem entries for `id`. AttachedFilesystem + // sets `type = mount.type` which for a `.virtiofs` mount is "virtiofs". + _mounts.withLock { state in + guard var perID = state[id] else { return } + perID.removeAll { $0.type == "virtiofs" } + if perID.isEmpty { + state.removeValue(forKey: id) + } else { + state[id] = perID + } + } + } + + // MARK: - Boot-time + shutdown hooks (used by CHVirtualMachineInstance) + + /// Record a virtiofsd that was started as part of `start()`'s initial + /// `VmConfig.fs` (rather than a runtime `vm.add-fs`). The `chDeviceId` + /// is the user-supplied `FsConfig.id` (which `vm.remove-device` keys on). + /// `ownerIds` are the container ids that count toward this tag's refcount; + /// each gets a `HotplugRecord` so `releaseVirtioFS(id:)` walks them + /// uniformly. + func recordBootTimeVirtiofs( + tag: String, + process: VirtiofsdProcess, + chDeviceId: String, + ownerIds: [String] + ) { + _tags.withLock { + $0[tag] = VirtiofsdTagState(process: process, refcount: ownerIds.count, chDeviceId: chDeviceId) + } + _records.withLock { records in + for id in ownerIds { + records[id, default: []].append(HotplugRecord(chDeviceId: chDeviceId, kind: .virtiofs(tag: tag))) + } + } + } + + /// Called from `CHVirtualMachineInstance.stop()` to terminate any + /// virtiofsd subprocesses still alive. The CH side teardown is handled by + /// `chProcess.terminate()`. + func shutdown() async { + let processes = _tags.withLock { tags -> [VirtiofsdProcess] in + let all = tags.values.map(\.process) + tags.removeAll() + return all + } + _records.withLock { $0.removeAll() } + + for process in processes { + await process.terminate(graceSeconds: 5) + } + } +} + +// MARK: - Error translation + +/// Wraps a closure that may throw `CloudHypervisor.Error`, translating it into +/// `ContainerizationError` per spec §6 so callers of the public API only see +/// `ContainerizationError`. +func chCall(_ block: @Sendable () async throws -> T) async throws -> T { + do { + return try await block() + } catch let error as CloudHypervisor.Error { + switch error { + case .http(let status, let body): + let bodyStr = String(data: body, encoding: .utf8) ?? "" + if status == .notFound { + throw ContainerizationError(.notFound, message: "cloud-hypervisor 404: \(bodyStr)") + } + if status == .badRequest { + throw ContainerizationError(.invalidArgument, message: "cloud-hypervisor 400: \(bodyStr)") + } + throw ContainerizationError( + .internalError, + message: "cloud-hypervisor HTTP \(status.code): \(bodyStr)" + ) + case .transport(let underlying): + throw ContainerizationError(.internalError, message: "cloud-hypervisor transport error", cause: underlying) + case .decoding(let underlying, _): + throw ContainerizationError(.internalError, message: "cloud-hypervisor response decode error", cause: underlying) + case .invalidSocketPath(let path): + throw ContainerizationError(.invalidArgument, message: "invalid cloud-hypervisor socket path: \(path)") + } + } +} +#endif diff --git a/Sources/Containerization/CHInstanceExtension.swift b/Sources/Containerization/CHInstanceExtension.swift new file mode 100644 index 0000000..8012147 --- /dev/null +++ b/Sources/Containerization/CHInstanceExtension.swift @@ -0,0 +1,46 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import CloudHypervisor + +/// Extension hook for `CHVirtualMachineInstance` lifecycle. Append conforming +/// types to `Configuration.extensions` to participate in VM setup and +/// teardown without subclassing. +/// +/// All methods have no-op defaults so a conforming type only needs to +/// implement the hooks it actually cares about. +public protocol CHInstanceExtension: Sendable { + /// Mutate the cloud-hypervisor `VmConfig` before the VM is created. + /// Called by `start()` after the base config is built but before + /// `vm.create` is dispatched to the VMM. + func configureCH(_ config: inout CloudHypervisor.VmConfig) throws + + /// Called once the VM has been created and booted but before + /// `start()` returns to the caller. + func didCreate(_ instance: CHVirtualMachineInstance) throws + + /// Called from `stop()` before the VM is shut down. Errors are + /// best-effort — `stop()` swallows them. + func willStop(_ instance: CHVirtualMachineInstance) async throws +} + +extension CHInstanceExtension { + public func configureCH(_ config: inout CloudHypervisor.VmConfig) throws {} + public func didCreate(_ instance: CHVirtualMachineInstance) throws {} + public func willStop(_ instance: CHVirtualMachineInstance) async throws {} +} +#endif diff --git a/Sources/Containerization/CHInterface.swift b/Sources/Containerization/CHInterface.swift new file mode 100644 index 0000000..459209f --- /dev/null +++ b/Sources/Containerization/CHInterface.swift @@ -0,0 +1,68 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import CloudHypervisor +import ContainerizationExtras + +/// An `Interface` specialization that can produce a `CloudHypervisor.NetConfig` +/// describing how the cloud-hypervisor VMM should attach the device. +public protocol CHInterface { + func chNetConfig() throws -> CloudHypervisor.NetConfig +} + +/// A TAP-backed network interface for the cloud-hypervisor backend. +/// +/// IP configuration on the guest side is delegated to `vminitd` (matching the +/// macOS path). `chNetConfig()` therefore leaves CH's `ip`/`mask` fields nil — +/// those would assign an address to the host end of the TAP, which we do not +/// use. Bringing up the TAP and any bridge/NAT plumbing is the caller's +/// responsibility. +public struct TAPInterface: CHInterface, Interface, Sendable { + public let tapName: String + public let ipv4Address: CIDRv4 + public let ipv4Gateway: IPv4Address? + public let macAddress: MACAddress? + public let mtu: UInt32 + + public init( + tapName: String, + ipv4Address: CIDRv4, + ipv4Gateway: IPv4Address? = nil, + macAddress: MACAddress? = nil, + mtu: UInt32 = 1500 + ) { + self.tapName = tapName + self.ipv4Address = ipv4Address + self.ipv4Gateway = ipv4Gateway + self.macAddress = macAddress + self.mtu = mtu + } + + public func chNetConfig() throws -> CloudHypervisor.NetConfig { + CloudHypervisor.NetConfig( + tap: tapName, + ip: nil, + mask: nil, + mac: macAddress?.description, + mtu: Int(mtu), + numQueues: nil, + queueSize: nil, + id: nil + ) + } +} +#endif diff --git a/Sources/Containerization/CHProcess.swift b/Sources/Containerization/CHProcess.swift new file mode 100644 index 0000000..fd1c6b1 --- /dev/null +++ b/Sources/Containerization/CHProcess.swift @@ -0,0 +1,211 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationExtras +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +/// A managed `cloud-hypervisor` subprocess. +/// +/// Owns spawning the binary with `--api-socket `, attaching stdout/stderr +/// per the supplied `BootLog`, and tearing it down with a SIGTERM/SIGKILL ladder. +/// One `CHProcess` per VM. Not safe to call `start()` more than once. +final class CHProcess: Sendable { + struct Config: Sendable { + let binary: URL + let apiSocketPath: URL + let bootLog: BootLog? + } + + enum ExitReason: Sendable, Equatable { + case exited(Int32) + case signalled(Int32) + case unknown + } + + private struct State { + var command: Command? + var bootLogHandle: FileHandle? + var exitTask: Task? + } + + private let config: Config + private let logger: Logger? + private let state: Mutex + + init(config: Config, logger: Logger?) { + self.config = config + self.logger = logger + self.state = Mutex(State(command: nil, bootLogHandle: nil, exitTask: nil)) + } + + /// Spawn the cloud-hypervisor binary and wait for its API socket to accept + /// connections. Throws `ContainerizationError(.timeout, ...)` if the socket + /// is not connectable within the bounded poll deadline. + func start() async throws { + let logHandle = try Self.openBootLogHandle(config.bootLog) + var arguments = ["--api-socket", config.apiSocketPath.path] + if SandboxOverrides.chSeccompDisabled { + // `--seccomp false`: cloud-hypervisor's default seccomp profile + // SIGSYS-kills the VMM on syscalls it didn't anticipate. Inside + // apple/container's --virtualization dev container the unix-vsock + // muxer's accept(2)/connect(2) interactions on per-port UDS files + // trip the filter and CH dies mid-process-start, surfacing on the + // host as "Stream unexpectedly closed" on the vminitd gRPC channel. + // Opt-in via CONTAINERIZATION_NO_CH_SECCOMP=1; default = secure. + logger?.warning( + "cloud-hypervisor launching with --seccomp false (CONTAINERIZATION_NO_CH_SECCOMP=1) — VMM seccomp filter disabled" + ) + arguments.append(contentsOf: ["--seccomp", "false"]) + } + var command = Command( + config.binary.path, + arguments: arguments, + environment: ChildEnvironment.minimal() + ) + command.stdout = logHandle + command.stderr = logHandle + // Run cloud-hypervisor in its own session. Without setsid, the VMM + // shares the parent process group and inherits SIGINT/SIGQUIT from + // the controlling TTY (e.g. Ctrl-C in `cctl run`), dying alongside + // the parent before our own teardown ladder (terminate → wait) gets + // a chance to run an orderly shutdown. + command.attrs.setsid = true + + do { + try command.start() + } catch { + try? logHandle?.close() + throw error + } + + let exitTask = Task.detached { [command, logger] in + do { + let status = try command.wait() + if status >= 128 { + return .signalled(status - 128) + } + return .exited(status) + } catch { + logger?.error("cloud-hypervisor wait failed: \(error)") + return .unknown + } + } + + state.withLock { + $0.command = command + $0.bootLogHandle = logHandle + $0.exitTask = exitTask + } + + try await waitForAPISocket() + } + + /// Wait for the subprocess to exit. Resolves with the cached `ExitReason` + /// once `wait4` has returned. Safe to call any number of times. + func wait() async -> ExitReason { + guard let task = state.withLock({ $0.exitTask }) else { + return .unknown + } + return await task.value + } + + /// Send SIGTERM, then SIGKILL after `graceSeconds` if the process is still + /// running. Returns once the process has been reaped. + func terminate(graceSeconds: UInt32) async { + guard let command = state.withLock({ $0.command }) else { return } + + _ = command.kill(SIGTERM) + + do { + try await Timeout.run(for: .seconds(Int(graceSeconds))) { + _ = await self.wait() + } + } catch { + logger?.warning("cloud-hypervisor did not exit within \(graceSeconds)s, sending SIGKILL") + _ = command.kill(SIGKILL) + _ = await wait() + } + + state.withLock { + try? $0.bootLogHandle?.close() + $0.bootLogHandle = nil + } + } + + // MARK: - Private helpers + + private static let socketDeadline: Duration = .seconds(2) + private static let socketPollInterval: Duration = .milliseconds(50) + + private func waitForAPISocket() async throws { + let clock = ContinuousClock() + let deadline = clock.now.advanced(by: Self.socketDeadline) + + while clock.now < deadline { + if Self.isAPISocketReady(at: config.apiSocketPath) { + return + } + try? await Task.sleep(for: Self.socketPollInterval) + } + + await terminate(graceSeconds: 5) + throw ContainerizationError( + .timeout, + message: "cloud-hypervisor API socket not connectable at \(config.apiSocketPath.path) within \(Self.socketDeadline)" + ) + } + + private static func isAPISocketReady(at url: URL) -> Bool { + guard let unix = try? UnixType(path: url.path) else { return false } + guard let socket = try? Socket(type: unix) else { return false } + defer { try? socket.close() } + do { + try socket.connect() + return true + } catch { + return false + } + } + + private static func openBootLogHandle(_ bootLog: BootLog?) throws -> FileHandle? { + guard let bootLog else { return nil } + switch bootLog.base { + case .file(let path, let append): + var flags = O_WRONLY | O_CREAT + flags |= append ? O_APPEND : O_TRUNC + let fd = open(path.path, flags, 0o644) + guard fd >= 0 else { + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + return FileHandle(fileDescriptor: fd, closeOnDealloc: true) + case .fileHandle(let handle): + return handle + } + } + +} +#endif diff --git a/Sources/Containerization/CHVirtualMachineInstance.swift b/Sources/Containerization/CHVirtualMachineInstance.swift new file mode 100644 index 0000000..122f592 --- /dev/null +++ b/Sources/Containerization/CHVirtualMachineInstance.swift @@ -0,0 +1,753 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import CloudHypervisor +import ContainerizationError +import ContainerizationExtras +import ContainerizationOS +import Foundation +import Logging +import NIOCore +import NIOPosix +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +/// Cloud-hypervisor backed virtual machine instance. +/// +/// One CH subprocess per VM. Connects to the same `Vminitd` guest agent the +/// macOS path uses, so guest-side semantics are unchanged. This file is the +/// D1 scaffold — `start`/`stop`/`dialAgent`/`dial`/`listen` throw +/// `.unsupported` until D3–D5 fill them in. Hotplug methods delegate to +/// `CHHotplugProvider` (stubbed in D0, real in D2). +public final class CHVirtualMachineInstance: Sendable { + public typealias Agent = Vminitd + + /// VM-instance configuration. Mirrors the macOS `VZVirtualMachineInstance.Configuration`, + /// minus rosetta / nested-virt (which are macOS-only concepts). + public struct Configuration: Sendable { + public var cpus: Int + public var memoryInBytes: UInt64 + public var mountsByID: [String: [Mount]] + public var interfaces: [any Interface] + public var kernel: Kernel? + public var initialFilesystem: Mount? + public var bootLog: BootLog? + public var extensions: [any Sendable] = [] + + public init() { + self.cpus = 4 + self.memoryInBytes = 1024 * 1024 * 1024 + self.mountsByID = [:] + self.interfaces = [] + } + } + + /// One boot-time virtio-blk disk. Built deterministically in `init` so + /// `start()`'s `VmConfig.disks` ordering matches the allocator letters. + struct BootDisk: Sendable { + let mount: Mount + let containerId: String? // nil for rootfs + let letter: Character + } + + // MARK: - State + + private let _state: Mutex + public var state: VirtualMachineInstanceState { + _state.withLock { $0 } + } + + public var mounts: [String: [AttachedFilesystem]] { + hotplug.mounts + } + + /// Cloud-hypervisor exposes one virtio-fs device per source-hash tag, so + /// guests must mount each tag separately at `/run/virtiofs/` rather + /// than using a single unified-share device. + public var virtiofsLayout: VirtiofsLayout { .perTag } + + /// Block-letter allocator shared between the boot wiring (already + /// reserved in `init` via `bootDisks`) and runtime hotplug (D2). + let blockAllocator: any AddressAllocator + + /// Boot-time disks in the order their letters were allocated. D3 maps + /// these into `VmConfig.disks`. + let bootDisks: [BootDisk] + + /// Owned resources + let workDir: URL + let config: Configuration + let chProcess: CHProcess + let client: CloudHypervisor.Client + let hotplug: CHHotplugProvider + let virtiofsdBinaryOverride: URL? + let group: any EventLoopGroup + private let ownsGroup: Bool + private let lock: AsyncLock + private let timeSyncer: TimeSyncer + let logger: Logger? + + /// Pre-bound vsock listener pool for stdio. apple/container's + /// `--virtualization` mode hands the cloud-hypervisor child process a + /// snapshotted filesystem view at fork time, so files written under the + /// per-VM workDir AFTER cloud-hypervisor starts are invisible to CH. + /// We work around this by binding a fixed range of `vsock.sock_` + /// listener files BEFORE launching CH; `vm.listen(_:)` then consumes + /// pre-bound entries from this pool instead of binding on demand. + /// Range covers `LinuxContainer.hostVsockPorts` initial value + /// (`0x10000000`) through the next `stdioPoolSize` sequential ports — + /// enough for `[stdin,stdout,stderr] x N` processes per VM. Bump + /// `stdioPoolSize` if you need more concurrent stdio streams than that. + static let stdioPoolBase: UInt32 = 0x1000_0000 + static let stdioPoolSize: Int = 16 + private struct PreboundListener: Sendable { + let port: UInt32 + let listenFd: Int32 + let path: URL + } + private let _stdioPool: Mutex<[UInt32: PreboundListener]> + + public convenience init( + group: (any EventLoopGroup)? = nil, + runtimeRoot: URL, + chBinary: URL, + virtiofsdBinary: URL?, + logger: Logger? = nil, + with: (inout Configuration) throws -> Void + ) throws { + var config = Configuration() + try with(&config) + try self.init( + group: group, + config: config, + runtimeRoot: runtimeRoot, + chBinary: chBinary, + virtiofsdBinary: virtiofsdBinary, + logger: logger + ) + } + + init( + group: (any EventLoopGroup)?, + config: Configuration, + runtimeRoot: URL, + chBinary: URL, + virtiofsdBinary: URL?, + logger: Logger? + ) throws { + // 1. Working directory: per-instance under runtimeRoot. Mode 0o700 + // so the per-VM UDS sockets inside (api.sock, vsock.sock, vfs-*) + // aren't reachable by other local users — the gRPC channel into + // vminitd has no peer authentication, so socket-file perms are + // the trust boundary. + let workDir = runtimeRoot.appendingPathComponent(UUID().uuidString) + try FileManager.default.createDirectory( + at: workDir, + withIntermediateDirectories: true, + attributes: [.posixPermissions: 0o700] + ) + self.workDir = workDir + + // 2. Block allocator + boot inventory. Walks rootfs first, then + // mountsByID sorted by container id, allocating disk letters in + // that order. The same allocator is later handed to the hotplug + // provider so runtime add-disk picks up where boot wiring left off. + let allocator = Character.blockDeviceTagAllocator() + let inventory = try config.bootInventory(allocator: allocator) + self.blockAllocator = allocator + self.bootDisks = inventory.bootDisks + + // 3. EventLoopGroup + if let group { + self.ownsGroup = false + self.group = group + } else { + self.ownsGroup = true + self.group = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount) + } + + // 4. CHProcess + REST client. The api socket lives next to the workDir. + let apiSocket = workDir.appendingPathComponent("api.sock") + self.chProcess = CHProcess( + config: .init( + binary: chBinary, + apiSocketPath: apiSocket, + bootLog: config.bootLog + ), + logger: logger + ) + self.client = try CloudHypervisor.Client( + socketPath: apiSocket, + eventLoopGroup: self.group, + logger: logger ?? Logger(label: "CloudHypervisor.Client") + ) + + // 5. Hotplug provider — owns the mount registry, seeded with the + // boot inventory so registerMounts can append to it. + self.hotplug = CHHotplugProvider( + client: self.client, + workDir: workDir, + virtiofsdBinary: virtiofsdBinary, + allocator: allocator, + initialMounts: inventory.attachments, + logger: logger + ) + + // 6. Misc + self.config = config + self.virtiofsdBinaryOverride = virtiofsdBinary + self.logger = logger + self.lock = .init() + self.timeSyncer = .init(logger: logger) + self._state = Mutex(.stopped) + self._stdioPool = Mutex([:]) + } + + /// Mutate the mount registry. Forwards to the hotplug provider, which + /// owns the registry. Kept on the instance for parity with the macOS + /// path's `withMountRegistry` API. + func withMountRegistry(_ body: (inout sending [String: [AttachedFilesystem]]) throws -> sending T) rethrows -> T { + try hotplug.withMountRegistry(body) + } +} + +// MARK: - VirtualMachineInstance conformance (stubbed; D3–D5 fill these in) + +extension CHVirtualMachineInstance: VirtualMachineInstance { + public func start() async throws { + try await lock.withLock { _ in + guard self.state == .stopped else { + throw ContainerizationError( + .invalidState, + message: "virtual machine is not stopped (\(self.state))" + ) + } + self._state.withLock { $0 = .starting } + + do { + var vmConfig = try await self.buildVmConfig() + for ext in self.config.extensions.compactMap({ $0 as? any CHInstanceExtension }) { + try ext.configureCH(&vmConfig) + } + let finalConfig = vmConfig + + // Pre-bind the stdio vsock listener pool before launching CH. + // CH inherits a fs snapshot at fork time and is blind to + // anything we add to workDir after — see `_stdioPool` doc. + try self.prebindStdioPool() + + try await self.chProcess.start() + + try await chCall { try await self.client.vmCreate(finalConfig) } + try await chCall { try await self.client.vmBoot() } + + let fh = try await self.dialVminitdWithRetries() + let agent = try await Vminitd(connection: fh, group: self.group) + await self.timeSyncer.start(context: agent) + + for ext in self.config.extensions.compactMap({ $0 as? any CHInstanceExtension }) { + try ext.didCreate(self) + } + + self._state.withLock { $0 = .running } + } catch { + self.logger?.warning("CH VM start failed; tearing down partial resources: \(error)") + await self.teardownAfterFailedStart() + self._state.withLock { $0 = .stopped } + throw error + } + } + } + + /// Reverse the side effects of any partially-completed `start()`: + /// terminate cloud-hypervisor, kill registered virtiofsd processes, + /// close pre-bound stdio listener fds, remove the workDir, and shut + /// down the owned event-loop group. All steps are best-effort and + /// safe to invoke whether the corresponding `start()` step ran or not. + private func teardownAfterFailedStart() async { + try? await self.timeSyncer.close() + + // chProcess.terminate() is a no-op if `start()` never reached the + // spawn — otherwise SIGTERM / SIGKILL ladder + reap. + await self.chProcess.terminate(graceSeconds: 5) + + // Kills every virtiofsd registered by buildVmConfig (boot-time) or + // by an in-flight hotplug. Empty if neither ran. + await self.hotplug.shutdown() + + // Close pre-bound stdio listener fds the start path opened in + // prebindStdioPool. Files unlink with workDir below. + let leftover = self._stdioPool.withLock { pool -> [PreboundListener] in + let entries = Array(pool.values) + pool.removeAll() + return entries + } + for entry in leftover { + _ = close(entry.listenFd) + } + + try? FileManager.default.removeItem(at: self.workDir) + + // Drain the AHC HTTP client before shutting down the shared + // event-loop group, same rationale as `stop()`: AHC's deferred + // connection cleanup must not outlive the group it's parked on. + try? await self.client.shutdown() + + if self.ownsGroup { + try? await self.group.shutdownGracefully() + } + } + + public func stop() async throws { + try await lock.withLock { _ in + guard self.state == .running else { + throw ContainerizationError(.invalidState, message: "vm is not running") + } + self._state.withLock { $0 = .stopping } + + try? await self.timeSyncer.close() + + for ext in self.config.extensions.compactMap({ $0 as? any CHInstanceExtension }) { + try? await ext.willStop(self) + } + + // Best-effort graceful shutdown via REST. The CH process may + // already be on its way out, so swallow errors from these. + _ = try? await chCall { try await self.client.vmShutdown() } + _ = try? await chCall { try await self.client.vmmShutdown() } + + await self.chProcess.terminate(graceSeconds: 10) + await self.hotplug.shutdown() + + // Drain the AHC HTTP client before tearing down the shared + // event-loop group. AHC parks deferred connection-cleanup + // work on the group's event loops after each response; if we + // shut the group down with that work still pending, NIO + // prints "Cannot schedule tasks on an EventLoop that has + // already shut down" (and will hard-crash in future NIO + // releases). Must run after the last `chCall` above and + // before `group.shutdownGracefully()` below. + try? await self.client.shutdown() + + // Close any listening fds for stdio ports the test never + // consumed. The files themselves are removed when workDir is + // unlinked below. + let leftover = self._stdioPool.withLock { pool -> [PreboundListener] in + let entries = Array(pool.values) + pool.removeAll() + return entries + } + for entry in leftover { + _ = close(entry.listenFd) + } + + if self.ownsGroup { + try? await self.group.shutdownGracefully() + } + + try? FileManager.default.removeItem(at: self.workDir) + + self._state.withLock { $0 = .stopped } + } + } + + public func dialAgent() async throws -> Vminitd { + try await lock.withLock { _ in + try self.requireRunning() + let fh = try await chVsockDial( + baseSocket: self.workDir.appendingPathComponent("vsock.sock"), + port: Vminitd.port + ) + return try await Vminitd(connection: fh, group: self.group) + } + } + + public func dial(_ port: UInt32) async throws -> FileHandle { + try await lock.withLock { _ in + try self.requireRunning() + return try await chVsockDial( + baseSocket: self.workDir.appendingPathComponent("vsock.sock"), + port: port + ) + } + } + + /// Reject vsock dials when the VM isn't actually running. Without this, + /// a dial issued after `stop()` (or before `start()` finished) raced + /// against `workDir` removal and surfaced as an opaque "connect: No + /// such file or directory" instead of a clear lifecycle error. + private func requireRunning() throws { + let current = self.state + guard current == .running else { + throw ContainerizationError( + .invalidState, + message: "vm is not running (state=\(current))" + ) + } + } + + public func listen(_ port: UInt32) throws -> VsockListener { + // Consume from the pre-bound pool (see `_stdioPool` doc). + let prebound = _stdioPool.withLock { $0.removeValue(forKey: port) } + guard let prebound else { + throw ContainerizationError( + .invalidArgument, + message: "vsock port \(port) was not pre-bound; only ports " + + "\(Self.stdioPoolBase)..<\(Self.stdioPoolBase + UInt32(Self.stdioPoolSize)) " + + "are available for stdio. Increase CHVirtualMachineInstance.stdioPoolSize " + + "if you need more concurrent stdio streams per VM." + ) + } + let listenFd = prebound.listenFd + let path = prebound.path + logger?.debug("vsock listen consuming pool entry port=\(port) path=\(path.path)") + let listener = VsockListener(port: port) { [path, listenFd, logger] _ in + logger?.debug("vsock listen finishing port=\(port) closing listenFd=\(listenFd)") + _ = close(listenFd) + try? FileManager.default.removeItem(at: path) + } + let acceptLogger = logger + // The accept loop calls a blocking accept() syscall, which is + // inappropriate for Swift's cooperative thread pool: a pool thread + // pinned to accept() can't service other tasks until the syscall + // returns. With even a few leaked accept loops (e.g. when a test's + // setupIO times out and the listener is finished only when the + // 30s timer fires), Task.detached'd accept loops queue behind the + // pinned threads and never run, manifesting as the "vsock acceptLoop + // starting" log being silent and the dial-back never being seen by + // the host. Use libdispatch's global queue instead — it spawns + // OS threads on demand and is the right tool for blocking syscalls. + DispatchQueue.global(qos: .userInitiated).async { [listener, listenFd] in + acceptLogger?.debug("vsock acceptLoop starting port=\(listener.port) listenFd=\(listenFd)") + Self.acceptLoop(listenFd: listenFd, into: listener, logger: acceptLogger) + acceptLogger?.debug("vsock acceptLoop exited port=\(listener.port)") + } + return listener + } + + /// Bind every port in `stdioPoolBase../vsock.sock_`. Must run before + /// `chProcess.start()` so the files end up in CH's snapshot view of + /// the workDir. Files for ports never consumed are removed during + /// `stop()` along with the rest of `workDir`; the listening fds are + /// closed there too. + private func prebindStdioPool() throws { + let base = workDir.appendingPathComponent("vsock.sock") + var pool: [UInt32: PreboundListener] = [:] + pool.reserveCapacity(Self.stdioPoolSize) + do { + for offset in 0.. AttachedFilesystem { + try await hotplug.hotplug(block, id: id) + } + + public func releaseHotplug(id: String) async throws { + try await hotplug.releaseHotplug(id: id) + } + + public func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws { + try await hotplug.hotplugVirtioFS(mounts, id: id) + } + + public func releaseVirtioFS(id: String) async throws { + try await hotplug.releaseVirtioFS(id: id) + } + + public func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws { + try hotplug.registerMounts(id: id, rootfs: rootfs, additionalMounts: additionalMounts) + } +} + +// MARK: - VmConfig + vminitd dial helpers + +extension CHVirtualMachineInstance { + /// Build the cloud-hypervisor `VmConfig` from `config`. Spawns one + /// `virtiofsd` per unique boot-time virtiofs source-hash tag and registers + /// each with the hotplug provider so `releaseVirtioFS(id:)` and `stop()` + /// can reclaim them. + private func buildVmConfig() async throws -> CloudHypervisor.VmConfig { + guard let kernel = config.kernel else { + throw ContainerizationError(.invalidArgument, message: "kernel is required for cloud-hypervisor backend") + } + guard let rootfs = config.initialFilesystem else { + throw ContainerizationError(.invalidArgument, message: "initialFilesystem is required for cloud-hypervisor backend") + } + + // Disks: rootfs forced read-only at the device level; container disks + // honor their `ro` option through chDiskConfig. + var disks: [CloudHypervisor.DiskConfig] = [] + for bd in bootDisks { + let chId = bd.containerId.map { "blk-\($0)-\(bd.letter)" } ?? "rootfs" + if var disk = bd.mount.chDiskConfig(id: chId) { + if bd.containerId == nil { + disk.readonly = true + } + disks.append(disk) + } + } + + // Virtiofs: group all .virtiofs mounts in mountsByID by source-hash + // tag, spawn one virtiofsd per tag, build matching FsConfigs. + var byTag: [String: (mounts: [Mount], owners: [String])] = [:] + for cid in config.mountsByID.keys.sorted() { + guard let mounts = config.mountsByID[cid] else { continue } + for mount in mounts { + guard case .virtiofs = mount.runtimeOptions else { continue } + let tag = try hashFilePath(path: mount.source) + var entry = byTag[tag] ?? (mounts: [], owners: []) + entry.mounts.append(mount) + if !entry.owners.contains(cid) { + entry.owners.append(cid) + } + byTag[tag] = entry + } + } + + var fsConfigs: [CloudHypervisor.FsConfig] = [] + // Resolve virtiofsd lazily — only if we actually have any virtiofs + // mounts at boot. A block-only VM doesn't require virtiofsd. + let resolvedVirtiofsdBinary: URL? = + byTag.isEmpty + ? nil + : try CHVirtualMachineManager.resolveBinary(virtiofsdBinaryOverride, name: "virtiofsd") + for (tag, entry) in byTag { + guard let source = entry.mounts.first?.source else { continue } + guard let binary = resolvedVirtiofsdBinary else { continue } + let socket = chVirtiofsSocketURL(workDir: workDir, tag: tag) + let readonly = entry.mounts.allSatisfy { $0.options.contains("ro") } + let chDeviceId = "fs-\(tag)" + + let process = VirtiofsdProcess( + config: .init( + binary: binary, + socketPath: socket, + sharedDir: URL(fileURLWithPath: source), + readonly: readonly + ), + logger: logger + ) + try await process.start() + + hotplug.recordBootTimeVirtiofs( + tag: tag, + process: process, + chDeviceId: chDeviceId, + ownerIds: entry.owners + ) + + fsConfigs.append( + CloudHypervisor.FsConfig( + tag: tag, + socket: socket.path, + id: chDeviceId + ) + ) + } + + let net: [CloudHypervisor.NetConfig] = try config.interfaces.compactMap { + try ($0 as? any CHInterface)?.chNetConfig() + } + + let vsock = CloudHypervisor.VsockConfig( + cid: 3, + socket: workDir.appendingPathComponent("vsock.sock").path + ) + + let payload = CloudHypervisor.PayloadConfig( + kernel: kernel.path.path, + cmdline: kernel.linuxCommandline(initialFilesystem: rootfs) + ) + + return CloudHypervisor.VmConfig( + cpus: .init(bootVcpus: config.cpus, maxVcpus: config.cpus), + // `shared: true` is required as soon as any vhost-user device (e.g. + // virtiofsd) is attached — CH rejects `vm.boot` with "Using + // vhost-user requires using shared memory or huge pages" otherwise. + // We set it unconditionally because virtiofs can be added via + // hotplug after boot (CHHotplugProvider.hotplugVirtioFS), and the + // memory config can't be changed once the VM has booted. The + // MAP_SHARED-backed RAM has negligible runtime impact. + memory: .init( + size: Self.alignMemorySize(config.memoryInBytes), + shared: true + ), + payload: payload, + disks: disks.isEmpty ? nil : disks, + net: net.isEmpty ? nil : net, + fs: fsConfigs.isEmpty ? nil : fsConfigs, + vsock: vsock, + // Kernel cmdline is `console=hvc0`, so userspace (vminitd) writes + // to hvc0 — capture that to the bootlog. We deliberately disable + // the pl011 (`serial`) UART entirely with `.Off`. Any non-Off mode + // makes cloud-hypervisor APPEND `earlycon=pl011,mmio,0x...` to + // the kernel cmdline (see CH device_manager.rs add_serial_device), + // which forces every early-boot printk character through an MMIO + // trap into CH's pl011 emulator and adds ~1.5s to VM boot. We + // don't need pl011 — virtio-console is enough — so just turn it + // off. To diagnose pre-virtio-console boot, switch to `.File` and + // re-add `earlycon=pl011,mmio,0x09000000` to the cmdline. + console: Self.consoleConfig(forBootLog: config.bootLog), + serial: .init(mode: .Off) + ) + } + + /// Round `bytes` up to the nearest 2 MiB boundary. Cloud Hypervisor + /// rejects `vm.boot` with "Memory size is misaligned with default page + /// size or its hugepage size" if the memory size isn't a multiple of the + /// guest's page size; 2 MiB is a multiple of both 4 KiB and 64 KiB pages + /// and the standard hugepage size on aarch64. + private static func alignMemorySize(_ bytes: UInt64) -> UInt64 { + let alignment: UInt64 = 2 * 1024 * 1024 + let remainder = bytes % alignment + return remainder == 0 ? bytes : bytes + (alignment - remainder) + } + + private static func consoleConfig(forBootLog bootLog: BootLog?) -> CloudHypervisor.ConsoleConfig { + guard let bootLog else { return .init(mode: .Null) } + switch bootLog.base { + case .file(let path, _): + return .init(mode: .File, file: path.path) + case .fileHandle: + // Cloud Hypervisor's File mode requires a path. For raw FDs we + // could route through a pipe/relay later; for v1 fall back to + // null to avoid silently dropping logs to a wrong place. + return .init(mode: .Null) + } + } + + /// Bounded retry loop for dialing the vminitd vsock port. Absorbs the + /// short delay between `vm.boot` and the guest agent advertising the + /// CONNECT/OK protocol on the host UDS. Vminitd typically becomes ready + /// within a few hundred ms of `vm.boot` returning, so we poll fast at + /// 10 ms intervals (capped at 50 ms) to avoid burning wall-clock in + /// exponential backoff while the guest is already up. Deadline stays + /// at 60s as a safety net for the cold-cache long tail. + private func dialVminitdWithRetries( + deadline: Duration = .seconds(60), + initialDelay: Duration = .milliseconds(10) + ) async throws -> FileHandle { + let baseSocket = workDir.appendingPathComponent("vsock.sock") + let clock = ContinuousClock() + let stop = clock.now.advanced(by: deadline) + var delay = initialDelay + var lastError: any Error = ContainerizationError(.timeout, message: "could not dial vminitd") + while clock.now < stop { + do { + return try await chVsockDial(baseSocket: baseSocket, port: Vminitd.port) + } catch { + lastError = error + try? await Task.sleep(for: delay) + if delay < .milliseconds(50) { + delay = delay * 2 + } + } + } + throw ContainerizationError(.timeout, message: "could not dial vminitd within \(deadline): \(lastError)") + } + + /// Blocking accept loop driving a `VsockListener`. Runs on a detached + /// task because `accept(2)` blocks. Exits when the listening fd is + /// closed (by `VsockListener.finish()`) or the stream consumer + /// terminates. + private static func acceptLoop(listenFd: Int32, into listener: VsockListener, logger: Logger?) { + while true { + logger?.debug("vsock acceptLoop blocking on accept port=\(listener.port) listenFd=\(listenFd)") + let connFd = accept(listenFd, nil, nil) + if connFd < 0 { + let savedErrno = errno + if savedErrno == EINTR { + continue + } + logger?.debug("vsock acceptLoop accept returned \(connFd) errno=\(savedErrno) port=\(listener.port)") + return + } + logger?.debug("vsock acceptLoop accepted connFd=\(connFd) port=\(listener.port)") + let handle = FileHandle(fileDescriptor: connFd, closeOnDealloc: true) + let result = listener.yield(handle) + if case .terminated = result { + logger?.debug("vsock acceptLoop yield terminated port=\(listener.port)") + try? handle.close() + return + } + logger?.debug("vsock acceptLoop yield enqueued port=\(listener.port)") + } + } +} + +// MARK: - Boot inventory + +extension CHVirtualMachineInstance.Configuration { + /// Walks boot-time mounts in deterministic order (rootfs first, then + /// `mountsByID` sorted by container id, then each container's mounts in + /// input order), allocating disk letters for virtio-blk mounts and seeding + /// the per-container `AttachedFilesystem` registry. + /// + /// The allocator is shared with the runtime hotplug provider, so block + /// hotplug picks up at the next free letter after boot. + func bootInventory( + allocator: any AddressAllocator + ) throws -> (attachments: [String: [AttachedFilesystem]], bootDisks: [CHVirtualMachineInstance.BootDisk]) { + var bootDisks: [CHVirtualMachineInstance.BootDisk] = [] + var attachments: [String: [AttachedFilesystem]] = [:] + + // Rootfs is not part of mountsByID. If it's a block device, it claims + // the first letter (vda) so the kernel cmdline `root=/dev/vda` is right. + if let rootfs = self.initialFilesystem, rootfs.isBlock { + let letter = try allocator.allocate() + bootDisks.append(.init(mount: rootfs, containerId: nil, letter: letter)) + } + + for cid in self.mountsByID.keys.sorted() { + guard let mounts = self.mountsByID[cid] else { continue } + var perContainer: [AttachedFilesystem] = [] + for mount in mounts { + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + if mount.isBlock, let letter = attached.source.last { + bootDisks.append(.init(mount: mount, containerId: cid, letter: letter)) + } + perContainer.append(attached) + } + attachments[cid] = perContainer + } + + return (attachments, bootDisks) + } +} +#endif diff --git a/Sources/Containerization/CHVirtualMachineManager.swift b/Sources/Containerization/CHVirtualMachineManager.swift new file mode 100644 index 0000000..ba20b5d --- /dev/null +++ b/Sources/Containerization/CHVirtualMachineManager.swift @@ -0,0 +1,149 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import Foundation +import Logging +import NIOCore + +/// VirtualMachineManager backed by `cloud-hypervisor` + KVM on Linux. +/// +/// One subprocess per VM. The manager itself is just a factory: kernel, +/// initial filesystem, host binary paths, and a runtime root (under which +/// each instance gets its own working directory). +public struct CHVirtualMachineManager: VirtualMachineManager { + private let kernel: Kernel + private let initialFilesystem: Mount + private let chBinary: URL + private let virtiofsdBinaryOverride: URL? + private let runtimeRoot: URL + private let group: (any EventLoopGroup)? + private let logger: Logger? + + /// - Parameters: + /// - kernel: The Linux kernel image used for every VM this manager creates. + /// - initialFilesystem: The rootfs `Mount` (typically the `init.ext4` + /// blob produced by `make init`). + /// - chBinary: Path to the `cloud-hypervisor` binary; if nil, looked + /// up on `PATH`. Validated at init time. + /// - virtiofsdBinary: Path to `virtiofsd`; if nil, looked up on `PATH` + /// lazily — only when a virtiofs share is actually used. A VM that + /// boots with only block-device mounts can run without virtiofsd + /// installed at all. + /// - runtimeRoot: Directory under which per-VM working directories are + /// created. Defaults to `/run/containerization/ch`. The directory is + /// created with mode `0o700` so per-VM UDS sockets (api.sock, + /// vsock.sock, vfs-*.sock) inside aren't reachable by other local + /// users. `/run` is tmpfs on every modern Linux distro, so contents + /// don't survive reboot — which is the right lifecycle for VM + /// runtime state. + /// - group: Optional shared NIO `EventLoopGroup`; if nil, each VM + /// spawns its own. + public init( + kernel: Kernel, + initialFilesystem: Mount, + chBinary: URL? = nil, + virtiofsdBinary: URL? = nil, + runtimeRoot: URL? = nil, + group: (any EventLoopGroup)? = nil, + logger: Logger? = nil + ) throws { + self.kernel = kernel + self.initialFilesystem = initialFilesystem + self.chBinary = try Self.resolveBinary(chBinary, name: "cloud-hypervisor") + if let virtiofsdBinary { + // Validate explicit overrides at init time so misconfiguration + // surfaces early. PATH-lookup deferral only applies when no + // override is supplied. + guard FileManager.default.isExecutableFile(atPath: virtiofsdBinary.path) else { + throw ContainerizationError( + .notFound, + message: "virtiofsd not executable at \(virtiofsdBinary.path)" + ) + } + } + self.virtiofsdBinaryOverride = virtiofsdBinary + let runtimeRoot = runtimeRoot ?? URL(fileURLWithPath: "/run/containerization/ch") + try FileManager.default.createDirectory( + at: runtimeRoot, + withIntermediateDirectories: true, + attributes: [.posixPermissions: 0o700] + ) + // createDirectory only sets attributes on directories it creates, so + // explicitly tighten an existing dir if a previous run left it at a + // looser mode. + try? FileManager.default.setAttributes([.posixPermissions: 0o700], ofItemAtPath: runtimeRoot.path) + self.runtimeRoot = runtimeRoot + self.group = group + self.logger = logger + } + + public func create(config: some VMCreationConfig) async throws -> any VirtualMachineInstance { + let vmConfig = config.configuration + + var instanceConfig = CHVirtualMachineInstance.Configuration() + instanceConfig.cpus = vmConfig.cpus + instanceConfig.memoryInBytes = vmConfig.memoryInBytes + instanceConfig.interfaces = vmConfig.interfaces + instanceConfig.mountsByID = vmConfig.mountsByID + instanceConfig.bootLog = vmConfig.bootLog + instanceConfig.extensions = vmConfig.extensions + instanceConfig.kernel = kernel + instanceConfig.initialFilesystem = initialFilesystem + + return try CHVirtualMachineInstance( + group: group, + config: instanceConfig, + runtimeRoot: runtimeRoot, + chBinary: chBinary, + virtiofsdBinary: virtiofsdBinaryOverride, + logger: logger + ) + } + + // MARK: - Binary resolution + + /// Resolve a binary path, accepting an explicit override or falling back to + /// `PATH` lookup. Used both at manager init for `cloud-hypervisor` and + /// lazily by the CH instance / hotplug provider for `virtiofsd` so a + /// block-only VM doesn't require virtiofsd to be installed. + static func resolveBinary(_ override: URL?, name: String) throws -> URL { + if let override { + guard FileManager.default.isExecutableFile(atPath: override.path) else { + throw ContainerizationError( + .notFound, + message: "\(name) not executable at \(override.path)" + ) + } + return override + } + + let path = ProcessInfo.processInfo.environment["PATH"] ?? "/usr/local/bin:/usr/bin:/bin" + for dir in path.split(separator: ":") where !dir.isEmpty { + let candidate = URL(fileURLWithPath: String(dir)).appendingPathComponent(name) + if FileManager.default.isExecutableFile(atPath: candidate.path) { + return candidate + } + } + + throw ContainerizationError( + .notFound, + message: "could not find \(name) on PATH; pass an explicit URL to CHVirtualMachineManager.init" + ) + } +} +#endif diff --git a/Sources/Containerization/Container.swift b/Sources/Containerization/Container.swift new file mode 100644 index 0000000..9519525 --- /dev/null +++ b/Sources/Containerization/Container.swift @@ -0,0 +1,27 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// The core protocol container implementations must implement. +public protocol Container { + /// ID for the container. + var id: String { get } + /// The amount of cpus assigned to the container. + var cpus: Int { get } + /// The memory in bytes assigned to the container. + var memoryInBytes: UInt64 { get } + /// The network interfaces assigned to the container. + var interfaces: [any Interface] { get } +} diff --git a/Sources/Containerization/ContainerManager.swift b/Sources/Containerization/ContainerManager.swift new file mode 100644 index 0000000..1b3a408 --- /dev/null +++ b/Sources/Containerization/ContainerManager.swift @@ -0,0 +1,383 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) + +import ContainerizationError +import ContainerizationEXT4 +import ContainerizationOCI +import ContainerizationOS +import Foundation +import ContainerizationExtras +import SystemPackage +import Virtualization + +/// A manager for creating and running containers. +/// Supports container networking options. +public struct ContainerManager: Sendable { + public let imageStore: ImageStore + private let vmm: VirtualMachineManager + private var network: Network? + + private var containerRoot: URL { + self.imageStore.path.appendingPathComponent("containers") + } + + /// Create a new manager with the provided kernel, initfs mount, image store + /// and optional network implementation. This will use a Virtualization.framework + /// backed VMM implicitly. + public init( + kernel: Kernel, + initfs: Mount, + imageStore: ImageStore, + network: Network? = nil, + rosetta: Bool = false, + nestedVirtualization: Bool = false + ) throws { + self.imageStore = imageStore + self.network = network + try Self.createRootDirectory(path: self.imageStore.path) + self.vmm = VZVirtualMachineManager( + kernel: kernel, + initialFilesystem: initfs, + rosetta: rosetta, + nestedVirtualization: nestedVirtualization + ) + } + + /// Create a new manager with the provided kernel, initfs mount, root state + /// directory and optional network implementation. This will use a Virtualization.framework + /// backed VMM implicitly. + public init( + kernel: Kernel, + initfs: Mount, + root: URL? = nil, + network: Network? = nil, + rosetta: Bool = false, + nestedVirtualization: Bool = false + ) throws { + if let root { + self.imageStore = try ImageStore(path: root) + } else { + self.imageStore = ImageStore.default + } + self.network = network + try Self.createRootDirectory(path: self.imageStore.path) + self.vmm = VZVirtualMachineManager( + kernel: kernel, + initialFilesystem: initfs, + rosetta: rosetta, + nestedVirtualization: nestedVirtualization + ) + } + + /// Create a new manager with the provided kernel, initfs reference, image store + /// and optional network implementation. This will use a Virtualization.framework + /// backed VMM implicitly. + public init( + kernel: Kernel, + initfsReference: String, + imageStore: ImageStore, + network: Network? = nil, + rosetta: Bool = false, + nestedVirtualization: Bool = false + ) async throws { + self.imageStore = imageStore + self.network = network + try Self.createRootDirectory(path: self.imageStore.path) + + let initPath = self.imageStore.path.appendingPathComponent("initfs.ext4") + let initImage = try await self.imageStore.getInitImage(reference: initfsReference) + let initfs = try await { + do { + return try await initImage.initBlock(at: initPath, for: .linuxArm) + } catch let err as ContainerizationError { + guard err.code == .exists else { + throw err + } + return .block( + format: "ext4", + source: initPath.absolutePath(), + destination: "/", + options: ["ro"] + ) + } + }() + + self.vmm = VZVirtualMachineManager( + kernel: kernel, + initialFilesystem: initfs, + rosetta: rosetta, + nestedVirtualization: nestedVirtualization + ) + } + + /// Create a new manager with the provided kernel and image reference for the initfs. + /// This will use a Virtualization.framework backed VMM implicitly. + public init( + kernel: Kernel, + initfsReference: String, + root: URL? = nil, + network: Network? = nil, + rosetta: Bool = false, + nestedVirtualization: Bool = false + ) async throws { + if let root { + self.imageStore = try ImageStore(path: root) + } else { + self.imageStore = ImageStore.default + } + self.network = network + try Self.createRootDirectory(path: self.imageStore.path) + + let initPath = self.imageStore.path.appendingPathComponent("initfs.ext4") + let initImage = try await self.imageStore.getInitImage(reference: initfsReference) + let initfs = try await { + do { + return try await initImage.initBlock(at: initPath, for: .linuxArm) + } catch let err as ContainerizationError { + guard err.code == .exists else { + throw err + } + return .block( + format: "ext4", + source: initPath.absolutePath(), + destination: "/", + options: ["ro"] + ) + } + }() + + self.vmm = VZVirtualMachineManager( + kernel: kernel, + initialFilesystem: initfs, + rosetta: rosetta, + nestedVirtualization: nestedVirtualization + ) + } + + /// Create a new manager with the provided vmm and network. + public init( + vmm: any VirtualMachineManager, + network: Network? = nil + ) throws { + self.imageStore = ImageStore.default + try Self.createRootDirectory(path: self.imageStore.path) + self.network = network + self.vmm = vmm + } + + private static func createRootDirectory(path: URL) throws { + try FileManager.default.createDirectory( + at: path.appendingPathComponent("containers"), + withIntermediateDirectories: true + ) + } + + /// Returns a new container from the provided image reference. + /// - Parameters: + /// - id: The container ID. + /// - reference: The image reference. + /// - rootfsSizeInBytes: The size of the root filesystem in bytes. Defaults to 8 GiB. + /// - writableLayerSizeInBytes: Optional size for a separate writable layer. When provided, + /// the rootfs becomes read-only and an overlayfs is used with a separate writable layer of this size. + /// - readOnly: Whether to mount the root filesystem as read-only. + /// - networking: Whether to create a network interface for this container. Defaults to `true`. + /// When `false`, no network resources are allocated and `releaseNetwork`/`delete` remain safe to call. + /// - progress: Optional handler for tracking rootfs unpacking progress. + public mutating func create( + _ id: String, + reference: String, + rootfsSizeInBytes: UInt64 = 8.gib(), + writableLayerSizeInBytes: UInt64? = nil, + readOnly: Bool = false, + networking: Bool = true, + progress: ProgressHandler? = nil, + configuration: (inout LinuxContainer.Configuration) throws -> Void + ) async throws -> LinuxContainer { + let image = try await imageStore.get(reference: reference, pull: true) + return try await create( + id, + image: image, + rootfsSizeInBytes: rootfsSizeInBytes, + writableLayerSizeInBytes: writableLayerSizeInBytes, + readOnly: readOnly, + networking: networking, + progress: progress, + configuration: configuration + ) + } + + /// Returns a new container from the provided image. + /// - Parameters: + /// - id: The container ID. + /// - image: The image. + /// - rootfsSizeInBytes: The size of the root filesystem in bytes. Defaults to 8 GiB. + /// - writableLayerSizeInBytes: Optional size for a separate writable layer. When provided, + /// the rootfs becomes read-only and an overlayfs is used with a separate writable layer of this size. + /// - readOnly: Whether to mount the root filesystem as read-only. + /// - networking: Whether to create a network interface for this container. Defaults to `true`. + /// When `false`, no network resources are allocated and `releaseNetwork`/`delete` remain safe to call. + /// - progress: Optional handler for tracking rootfs unpacking progress. + public mutating func create( + _ id: String, + image: Image, + rootfsSizeInBytes: UInt64 = 8.gib(), + writableLayerSizeInBytes: UInt64? = nil, + readOnly: Bool = false, + networking: Bool = true, + progress: ProgressHandler? = nil, + configuration: (inout LinuxContainer.Configuration) throws -> Void + ) async throws -> LinuxContainer { + let path = try createContainerRoot(id) + + var rootfs = try await unpack( + image: image, + destination: path.appendingPathComponent("rootfs.ext4"), + size: rootfsSizeInBytes, + progress: progress + ) + if readOnly { + rootfs.options.append("ro") + } + + // Create writable layer if size is specified. + var writableLayer: Mount? = nil + if let writableLayerSize = writableLayerSizeInBytes { + writableLayer = try createEmptyFilesystem( + at: path.appendingPathComponent("writable.ext4"), + size: writableLayerSize + ) + } + + return try await create( + id, + image: image, + rootfs: rootfs, + writableLayer: writableLayer, + networking: networking, + configuration: configuration + ) + } + + /// Returns a new container from the provided image and root filesystem mount. + /// - Parameters: + /// - id: The container ID. + /// - image: The image. + /// - rootfs: The root filesystem mount pointing to an existing block file. + /// The `destination` field is ignored as mounting is handled internally. + /// - writableLayer: Optional writable layer mount. When provided, an overlayfs is used with + /// rootfs as the lower layer and this as the upper layer. + /// The `destination` field is ignored as mounting is handled internally. + /// - networking: Whether to create a network interface for this container. Defaults to `true`. + /// When `false`, no network resources are allocated and `releaseNetwork`/`delete` remain safe to call. + public mutating func create( + _ id: String, + image: Image, + rootfs: Mount, + writableLayer: Mount? = nil, + networking: Bool = true, + configuration: (inout LinuxContainer.Configuration) throws -> Void + ) async throws -> LinuxContainer { + let imageConfig = try await image.config(for: .current).config + return try LinuxContainer( + id, + rootfs: rootfs, + writableLayer: writableLayer, + vmm: self.vmm + ) { config in + if let imageConfig { + config.process = .init(from: imageConfig) + } + if networking { + if let interface = try self.network?.createInterface(id) { + config.interfaces = [interface] + guard let gateway = interface.ipv4Gateway else { + throw ContainerizationError( + .invalidState, + message: "missing ipv4 gateway for container \(id)" + ) + } + config.dns = .init(nameservers: [gateway.description]) + } + } + config.bootLog = BootLog.file(path: self.containerRoot.appendingPathComponent(id).appendingPathComponent("bootlog.log")) + try configuration(&config) + } + } + + /// Releases network resources for a container. + /// + /// - Parameter id: The container ID. + public mutating func releaseNetwork(_ id: String) throws { + try self.network?.releaseInterface(id) + } + + /// Releases network resources and removes all files for a container. + /// - Parameter id: The container ID. + public mutating func delete(_ id: String) throws { + try self.releaseNetwork(id) + let path = containerRoot.appendingPathComponent(id) + try FileManager.default.removeItem(at: path) + } + + private func createContainerRoot(_ id: String) throws -> URL { + let path = containerRoot.appendingPathComponent(id) + try FileManager.default.createDirectory(at: path, withIntermediateDirectories: false) + return path + } + + private func unpack(image: Image, destination: URL, size: UInt64, progress: ProgressHandler? = nil) async throws -> Mount { + do { + let unpacker = EXT4Unpacker(blockSizeInBytes: size) + return try await unpacker.unpack(image, for: .current, at: destination, progress: progress) + } catch let err as ContainerizationError { + if err.code == .exists { + return .block( + format: "ext4", + source: destination.absolutePath(), + destination: "/", + options: [] + ) + } + throw err + } + } + + private func createEmptyFilesystem(at destination: URL, size: UInt64) throws -> Mount { + let path = destination.absolutePath() + guard !FileManager.default.fileExists(atPath: path) else { + throw ContainerizationError(.exists, message: "filesystem already exists at \(path)") + } + let filesystem = try EXT4.Formatter(FilePath(path), minDiskSize: size) + try filesystem.close() + return .block( + format: "ext4", + source: path, + destination: "/", + options: [] + ) + } +} + +extension CIDRv6 { + /// The gateway address of the network. + public var gateway: IPv6Address { + IPv6Address(self.lower.value + 1) + } +} + +#endif diff --git a/Sources/Containerization/ContainerStatistics.swift b/Sources/Containerization/ContainerStatistics.swift new file mode 100644 index 0000000..c416787 --- /dev/null +++ b/Sources/Containerization/ContainerStatistics.swift @@ -0,0 +1,248 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Statistics for a container. +public struct ContainerStatistics: Sendable { + public var id: String + public var process: ProcessStatistics? + public var memory: MemoryStatistics? + public var cpu: CPUStatistics? + public var blockIO: BlockIOStatistics? + public var networks: [NetworkStatistics]? + public var memoryEvents: MemoryEventStatistics? + + public init( + id: String, + process: ProcessStatistics? = nil, + memory: MemoryStatistics? = nil, + cpu: CPUStatistics? = nil, + blockIO: BlockIOStatistics? = nil, + networks: [NetworkStatistics]? = nil, + memoryEvents: MemoryEventStatistics? = nil + ) { + self.id = id + self.process = process + self.memory = memory + self.cpu = cpu + self.blockIO = blockIO + self.networks = networks + self.memoryEvents = memoryEvents + } + + /// Process statistics for a container. + public struct ProcessStatistics: Sendable { + public var current: UInt64 + public var limit: UInt64 + + public init(current: UInt64, limit: UInt64) { + self.current = current + self.limit = limit + } + } + + /// Memory statistics for a container. + public struct MemoryStatistics: Sendable { + public var usageBytes: UInt64 + public var limitBytes: UInt64 + public var swapUsageBytes: UInt64 + public var swapLimitBytes: UInt64 + public var cacheBytes: UInt64 + public var kernelStackBytes: UInt64 + public var slabBytes: UInt64 + public var pageFaults: UInt64 + public var majorPageFaults: UInt64 + public var inactiveFile: UInt64 + public var anon: UInt64 + public var workingsetRefaultAnon: UInt64 + public var workingsetRefaultFile: UInt64 + public var pgstealKswapd: UInt64 + public var pgstealDirect: UInt64 + public var pgstealKhugepaged: UInt64 + + public init( + usageBytes: UInt64, + limitBytes: UInt64, + swapUsageBytes: UInt64, + swapLimitBytes: UInt64, + cacheBytes: UInt64, + kernelStackBytes: UInt64, + slabBytes: UInt64, + pageFaults: UInt64, + majorPageFaults: UInt64, + inactiveFile: UInt64, + anon: UInt64, + workingsetRefaultAnon: UInt64 = 0, + workingsetRefaultFile: UInt64 = 0, + pgstealKswapd: UInt64 = 0, + pgstealDirect: UInt64 = 0, + pgstealKhugepaged: UInt64 = 0 + ) { + self.usageBytes = usageBytes + self.limitBytes = limitBytes + self.swapUsageBytes = swapUsageBytes + self.swapLimitBytes = swapLimitBytes + self.cacheBytes = cacheBytes + self.kernelStackBytes = kernelStackBytes + self.slabBytes = slabBytes + self.pageFaults = pageFaults + self.majorPageFaults = majorPageFaults + self.inactiveFile = inactiveFile + self.anon = anon + self.workingsetRefaultAnon = workingsetRefaultAnon + self.workingsetRefaultFile = workingsetRefaultFile + self.pgstealKswapd = pgstealKswapd + self.pgstealDirect = pgstealDirect + self.pgstealKhugepaged = pgstealKhugepaged + } + } + + /// CPU statistics for a container. + public struct CPUStatistics: Sendable { + public var usageUsec: UInt64 + public var userUsec: UInt64 + public var systemUsec: UInt64 + public var throttlingPeriods: UInt64 + public var throttledPeriods: UInt64 + public var throttledTimeUsec: UInt64 + + public init( + usageUsec: UInt64, + userUsec: UInt64, + systemUsec: UInt64, + throttlingPeriods: UInt64, + throttledPeriods: UInt64, + throttledTimeUsec: UInt64 + ) { + self.usageUsec = usageUsec + self.userUsec = userUsec + self.systemUsec = systemUsec + self.throttlingPeriods = throttlingPeriods + self.throttledPeriods = throttledPeriods + self.throttledTimeUsec = throttledTimeUsec + } + } + + /// Block I/O statistics for a container. + public struct BlockIOStatistics: Sendable { + public var devices: [BlockIODevice] + + public init(devices: [BlockIODevice]) { + self.devices = devices + } + } + + /// Block I/O statistics for a specific device. + public struct BlockIODevice: Sendable { + public var major: UInt64 + public var minor: UInt64 + public var readBytes: UInt64 + public var writeBytes: UInt64 + public var readOperations: UInt64 + public var writeOperations: UInt64 + + public init( + major: UInt64, + minor: UInt64, + readBytes: UInt64, + writeBytes: UInt64, + readOperations: UInt64, + writeOperations: UInt64 + ) { + self.major = major + self.minor = minor + self.readBytes = readBytes + self.writeBytes = writeBytes + self.readOperations = readOperations + self.writeOperations = writeOperations + } + } + + /// Statistics for a network interface. + public struct NetworkStatistics: Sendable { + public var interface: String + public var receivedPackets: UInt64 + public var transmittedPackets: UInt64 + public var receivedBytes: UInt64 + public var transmittedBytes: UInt64 + public var receivedErrors: UInt64 + public var transmittedErrors: UInt64 + + public init( + interface: String, + receivedPackets: UInt64, + transmittedPackets: UInt64, + receivedBytes: UInt64, + transmittedBytes: UInt64, + receivedErrors: UInt64, + transmittedErrors: UInt64 + ) { + self.interface = interface + self.receivedPackets = receivedPackets + self.transmittedPackets = transmittedPackets + self.receivedBytes = receivedBytes + self.transmittedBytes = transmittedBytes + self.receivedErrors = receivedErrors + self.transmittedErrors = transmittedErrors + } + } + + /// Memory event counters from cgroup2's memory.events file. + public struct MemoryEventStatistics: Sendable { + /// Number of times the cgroup was reclaimed due to low memory. + public var low: UInt64 + /// Number of times the cgroup exceeded its high memory limit. + public var high: UInt64 + /// Number of times the cgroup hit its max memory limit. + public var max: UInt64 + /// Number of times the cgroup triggered OOM. + public var oom: UInt64 + /// Number of processes killed by OOM killer. + public var oomKill: UInt64 + + public init(low: UInt64, high: UInt64, max: UInt64, oom: UInt64, oomKill: UInt64) { + self.low = low + self.high = high + self.max = max + self.oom = oom + self.oomKill = oomKill + } + } +} + +/// Categories of statistics that can be requested. +public struct StatCategory: OptionSet, Sendable { + public let rawValue: Int + + public init(rawValue: Int) { + self.rawValue = rawValue + } + + /// Process statistics (pids.current, pids.max). + public static let process = StatCategory(rawValue: 1 << 0) + /// Memory usage statistics. + public static let memory = StatCategory(rawValue: 1 << 1) + /// CPU usage statistics. + public static let cpu = StatCategory(rawValue: 1 << 2) + /// Block I/O statistics. + public static let blockIO = StatCategory(rawValue: 1 << 3) + /// Network interface statistics. + public static let network = StatCategory(rawValue: 1 << 4) + /// Memory event counters (OOM kills, pressure events, etc.). + public static let memoryEvents = StatCategory(rawValue: 1 << 5) + + /// All available statistics categories. + public static let all: StatCategory = [.process, .memory, .cpu, .blockIO, .network, .memoryEvents] +} diff --git a/Sources/Containerization/DNSConfiguration.swift b/Sources/Containerization/DNSConfiguration.swift new file mode 100644 index 0000000..e87ed27 --- /dev/null +++ b/Sources/Containerization/DNSConfiguration.swift @@ -0,0 +1,91 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras + +/// DNS configuration for a container. The values will be used to +/// construct /etc/resolv.conf for a given container. +public struct DNS: Sendable { + /// The set of default nameservers to use if none are provided + /// in the constructor. + public static let defaultNameservers = ["1.1.1.1"] + + /// The nameservers a container should use. + public var nameservers: [String] + /// The DNS domain to use. + public var domain: String? + /// The DNS search domains to use. + public var searchDomains: [String] + /// The DNS options to use. + public var options: [String] + + public init( + nameservers: [String] = defaultNameservers, + domain: String? = nil, + searchDomains: [String] = [], + options: [String] = [] + ) { + self.nameservers = nameservers + self.domain = domain + self.searchDomains = searchDomains + self.options = options + } + + /// Validates the DNS configuration. + /// + /// Ensures that all nameserver entries are valid IPv4 or IPv6 addresses. + /// Arbitrary hostnames are not permitted as nameservers. + /// + /// - Throws: ``ContainerizationError`` with code `.invalidArgument` if + /// any nameserver is not a valid IP address. + public func validate() throws { + for nameserver in nameservers { + let isValidIPv4 = (try? IPv4Address(nameserver)) != nil + let isValidIPv6 = (try? IPv6Address(nameserver)) != nil + if !isValidIPv4 && !isValidIPv6 { + throw ContainerizationError( + .invalidArgument, + message: "nameserver '\(nameserver)' is not a valid IPv4 or IPv6 address" + ) + } + } + } +} + +extension DNS { + public var resolvConf: String { + var text = "" + + if !nameservers.isEmpty { + text += nameservers.map { "nameserver \($0)" }.joined(separator: "\n") + "\n" + } + + if let domain { + text += "domain \(domain)\n" + } + + if !searchDomains.isEmpty { + text += "search \(searchDomains.joined(separator: " "))\n" + } + + if !options.isEmpty { + text += "options \(options.joined(separator: " "))\n" + } + + return text + } +} diff --git a/Sources/Containerization/ExitStatus.swift b/Sources/Containerization/ExitStatus.swift new file mode 100644 index 0000000..0848e68 --- /dev/null +++ b/Sources/Containerization/ExitStatus.swift @@ -0,0 +1,36 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// ExitStatus contains the exit code for a given container process, +/// as well as the timestamp at which it exited. +public struct ExitStatus: Sendable { + /// The exit code for the process. + public var exitCode: Int32 + /// The timestamp when the process exited. + public var exitedAt: Date + + public init(exitCode: Int32) { + self.exitCode = exitCode + self.exitedAt = .now + } + + public init(exitCode: Int32, exitedAt: Date) { + self.exitCode = exitCode + self.exitedAt = exitedAt + } +} diff --git a/Sources/Containerization/FileMount.swift b/Sources/Containerization/FileMount.swift new file mode 100644 index 0000000..518aaee --- /dev/null +++ b/Sources/Containerization/FileMount.swift @@ -0,0 +1,202 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import Foundation + +/// Manages single-file mounts by transforming them into virtiofs directory shares +/// plus bind mounts. +/// +/// Since virtiofs only supports sharing directories, mounting a single file requires +/// sharing the file's parent directory via virtiofs and then bind mounting the specific +/// file from that share to the final destination in the container. +struct FileMountContext: Sendable { + /// Metadata for a single prepared file mount. + struct PreparedMount: Sendable { + /// Original file path on host + let hostFilePath: String + /// Where the user wants the file in the container + let containerDestination: String + /// Just the filename (after resolving symlinks) + let filename: String + /// The parent directory containing the file (after resolving symlinks) + let parentDirectory: URL + /// The virtiofs tag (hash of parent dir path). Used to find the AttachedFilesystem + let tag: String + /// Mount options from the original mount + let options: [String] + /// Where we mounted the share in the guest (set after mountHoldingDirectories) + var guestHoldingPath: String? + } + + /// Prepared file mounts for this context + var preparedMounts: [PreparedMount] + + /// The transformed mounts to pass to the VM (files replaced with directory shares) + private(set) var transformedMounts: [Mount] + + private init() { + self.preparedMounts = [] + self.transformedMounts = [] + } + + /// Returns true if there are any file mounts that need handling. + var hasFileMounts: Bool { + !preparedMounts.isEmpty + } + + /// Returns the set of virtiofs tags for file mount holding directories. + /// These should be filtered out from OCI spec mounts since we mount them + /// separately under /run. + var holdingDirectoryTags: Set { + Set(preparedMounts.map { $0.tag }) + } +} + +extension FileMountContext { + /// Prepare mounts for a container, detecting file mounts and transforming them. + /// + /// This method stats each virtiofs mount source. If it's a regular file rather than + /// a directory, it shares the file's parent directory via virtiofs and records the + /// metadata needed to bind mount the specific file later. + /// + /// - Parameter mounts: The original mounts from the container config + /// - Returns: A FileMountContext containing transformed mounts and tracking info + static func prepare(mounts: [Mount]) throws -> FileMountContext { + var context = FileMountContext() + var transformed: [Mount] = [] + // Track parent directories we've already added a share for to avoid duplicates. + var sharedParentTags: Set = [] + + for mount in mounts { + // Only virtiofs mounts can be files + guard case .virtiofs(let runtimeOpts) = mount.runtimeOptions else { + transformed.append(mount) + continue + } + + // Stat the source to see if it's a file + let fm = FileManager.default + var isDirectory: ObjCBool = false + guard fm.fileExists(atPath: mount.source, isDirectory: &isDirectory) else { + // Doesn't exist. Let the normal flow handle the error + transformed.append(mount) + continue + } + + if isDirectory.boolValue { + // It's a directory, pass through unchanged + transformed.append(mount) + continue + } + + // It's a file, so prepare it. + let prepared = try context.prepareFileMount(mount: mount, runtimeOptions: runtimeOpts) + + // Only add the directory share once per unique parent directory. + if !sharedParentTags.contains(prepared.tag) { + sharedParentTags.insert(prepared.tag) + // The destination here is unused. We mount the share ourselves + // to a location under /run in mountHoldingDirectories. + let directoryShare = Mount.share( + source: prepared.parentDirectory.path, + destination: "/.file-mount-holding", + options: mount.options.filter { $0 != "bind" }, + runtimeOptions: runtimeOpts + ) + transformed.append(directoryShare) + } + } + + context.transformedMounts = transformed + return context + } + + private mutating func prepareFileMount( + mount: Mount, + runtimeOptions: [String] + ) throws -> PreparedMount { + let resolvedSource = URL(fileURLWithPath: mount.source).resolvingSymlinksInPath() + let filename = resolvedSource.lastPathComponent + let parentDirectory = resolvedSource.deletingLastPathComponent() + let tag = try hashFilePath(path: parentDirectory.path) + + let prepared = PreparedMount( + hostFilePath: mount.source, + containerDestination: mount.destination, + filename: filename, + parentDirectory: parentDirectory, + tag: tag, + options: mount.options, + guestHoldingPath: nil + ) + + preparedMounts.append(prepared) + return prepared + } +} + +extension FileMountContext { + /// Set up the holding directory paths for all file mounts. + /// Since virtiofs shares are now mounted once at /run/virtiofs, the holding + /// directories appear as subdirectories there automatically. + /// - Parameters: + /// - vmMounts: The AttachedFilesystem array from the VM for this container + /// - agent: The VM agent for RPCs (unused, kept for API compatibility) + mutating func mountHoldingDirectories( + vmMounts: [AttachedFilesystem], + agent: any VirtualMachineAgent + ) async throws { + for i in preparedMounts.indices { + let prepared = preparedMounts[i] + + // Verify the attached filesystem exists + guard + vmMounts.first(where: { + $0.type == "virtiofs" && $0.source == prepared.tag + }) != nil + else { + throw ContainerizationError( + .notFound, + message: "could not find attached filesystem for file mount \(prepared.hostFilePath)" + ) + } + + // With unified virtiofs, holding directories are subdirectories under /run/virtiofs + let guestPath = "/run/virtiofs/\(prepared.tag)" + preparedMounts[i].guestHoldingPath = guestPath + } + } +} + +extension FileMountContext { + /// Get the bind mounts to append to the OCI spec. + func ociBindMounts() -> [ContainerizationOCI.Mount] { + preparedMounts.compactMap { prepared in + guard let guestPath = prepared.guestHoldingPath else { + return nil + } + + return ContainerizationOCI.Mount( + type: "none", + source: "\(guestPath)/\(prepared.filename)", + destination: prepared.containerDestination, + options: ["bind"] + prepared.options + ) + } + } +} diff --git a/Sources/Containerization/Hash.swift b/Sources/Containerization/Hash.swift new file mode 100644 index 0000000..e5088f4 --- /dev/null +++ b/Sources/Containerization/Hash.swift @@ -0,0 +1,40 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Crypto +import Foundation + +extension Mount { + /// A deterministic hash of the mount's source path, used as the virtiofs tag. + /// + /// Resolves symlinks before hashing so that different paths to the same + /// directory produce an identical tag. + public var tagHash: String { + get throws { + try hashFilePath(path: self.source) + } + } +} + +func hashFilePath(path: String) throws -> String { + // Resolve symlinks so different paths to the same directory get the same hash. + let resolvedSource = URL(fileURLWithPath: path).resolvingSymlinksInPath().path + guard let data = resolvedSource.data(using: .utf8) else { + throw ContainerizationError(.invalidArgument, message: "\(path) could not be converted to Data") + } + return String(SHA256.hash(data: data).encoded.prefix(36)) +} diff --git a/Sources/Containerization/HostDefaultRoute.swift b/Sources/Containerization/HostDefaultRoute.swift new file mode 100644 index 0000000..32785d7 --- /dev/null +++ b/Sources/Containerization/HostDefaultRoute.swift @@ -0,0 +1,68 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Reads the host's default IPv4 egress interface from `/proc/net/route`. +/// +/// `/proc/net/route` columns (tab-separated): +/// +/// Iface Destination Gateway Flags RefCnt Use Metric Mask MTU Window IRTT +/// +/// Numeric fields are hex with bytes in network order (so `0102A8C0` is +/// `192.168.2.1`). Pure-string parsing keeps this cross-platform-testable +/// even though `/proc/net/route` itself only exists on Linux. +enum HostDefaultRoute { + /// `RTF_GATEWAY` from ``. Set on rows representing a gateway route. + private static let RTF_GATEWAY: UInt32 = 0x0002 + + /// Parse the contents of `/proc/net/route` and return the iface for the + /// default route (destination 0.0.0.0 with `RTF_GATEWAY`). When multiple + /// default routes exist, the one with the lowest metric wins. + static func parseEgress(procNetRoute contents: String) -> String? { + var best: (iface: String, metric: UInt64)? + for (i, line) in contents.split(separator: "\n", omittingEmptySubsequences: true).enumerated() { + if i == 0 { continue } // header + let cols = line.split(separator: "\t", omittingEmptySubsequences: false) + .map { $0.trimmingCharacters(in: .whitespaces) } + guard cols.count >= 11 else { continue } + let iface = String(cols[0]) + let destination = cols[1] + let flagsHex = cols[3] + let metricStr = cols[6] + + guard destination == "00000000" else { continue } + guard let flags = UInt32(flagsHex, radix: 16), + flags & RTF_GATEWAY != 0 + else { continue } + let metric = UInt64(metricStr) ?? UInt64.max + if let current = best, metric >= current.metric { + continue + } + best = (iface, metric) + } + return best?.iface + } + + /// Read `/proc/net/route` and return the default-route iface, or nil if + /// the file is missing or no default route exists. + static func currentEgress() -> String? { + guard let contents = try? String(contentsOfFile: "/proc/net/route", encoding: .utf8) else { + return nil + } + return parseEgress(procNetRoute: contents) + } +} diff --git a/Sources/Containerization/HostsConfiguration.swift b/Sources/Containerization/HostsConfiguration.swift new file mode 100644 index 0000000..5713319 --- /dev/null +++ b/Sources/Containerization/HostsConfiguration.swift @@ -0,0 +1,140 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Static table lookups for a container. The values will be used to +/// construct /etc/hosts for a given container. +public struct Hosts: Sendable { + /// Represents one entry in an /etc/hosts file. + public struct Entry: Sendable { + /// The IPV4 or IPV6 address in String form. + public var ipAddress: String + /// The hostname(s) for the entry. + public var hostnames: [String] + /// An optional comment to be placed to the right side of the entry. + public var comment: String? + + public init(ipAddress: String, hostnames: [String], comment: String? = nil) { + self.comment = comment + self.hostnames = hostnames + self.ipAddress = ipAddress + } + + /// The information in the structure rendered to a String representation + /// that matches the format /etc/hosts expects. + public var rendered: String { + var line = ipAddress + if !hostnames.isEmpty { + line += " " + hostnames.joined(separator: " ") + } + if let comment { + line += " # \(comment) " + } + return line + } + + public static func localHostIPV4(comment: String? = nil) -> Self { + Self( + ipAddress: "127.0.0.1", + hostnames: ["localhost"], + comment: comment + ) + } + + public static func localHostIPV6(comment: String? = nil) -> Self { + Self( + ipAddress: "::1", + hostnames: ["localhost", "ip6-localhost", "ip6-loopback"], + comment: comment + ) + } + + public static func ipv6LocalNet(comment: String? = nil) -> Self { + Self( + ipAddress: "fe00::", + hostnames: ["ip6-localnet"], + comment: comment + ) + } + + public static func ipv6MulticastPrefix(comment: String? = nil) -> Self { + Self( + ipAddress: "ff00::", + hostnames: ["ip6-mcastprefix"], + comment: comment + ) + } + + public static func ipv6AllNodes(comment: String? = nil) -> Self { + Self( + ipAddress: "ff02::1", + hostnames: ["ip6-allnodes"], + comment: comment + ) + } + + public static func ipv6AllRouters(comment: String? = nil) -> Self { + Self( + ipAddress: "ff02::2", + hostnames: ["ip6-allrouters"], + comment: comment + ) + } + } + + /// The entries to be written to /etc/hosts. + public var entries: [Entry] + + /// A comment to render at the top of the file. + public var comment: String? + + public init( + entries: [Entry], + comment: String? = nil + ) { + self.entries = entries + self.comment = comment + } +} + +extension Hosts { + /// A default entry that can be used for convenience. It contains a IPV4 + /// and IPV6 localhost entry, as well as ipv6 localnet, ipv6 mcastprefix, + /// ipv6 allnodes, and ipv6 allrouters. + public static let `default` = Hosts(entries: [ + Entry.localHostIPV4(), + Entry.localHostIPV6(), + Entry.ipv6LocalNet(), + Entry.ipv6MulticastPrefix(), + Entry.ipv6AllNodes(), + Entry.ipv6AllRouters(), + ]) + + /// Returns a string variant of the data that can be written to + /// /etc/hosts directly. + public var hostsFile: String { + var lines: [String] = [] + + if let comment { + lines.append("# \(comment)") + } + + for entry in entries { + lines.append(entry.rendered) + } + + return lines.joined(separator: "\n") + "\n" + } +} diff --git a/Sources/Containerization/HotplugProvider.swift b/Sources/Containerization/HotplugProvider.swift new file mode 100644 index 0000000..f535ce3 --- /dev/null +++ b/Sources/Containerization/HotplugProvider.swift @@ -0,0 +1,56 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A provider that manages hotplug operations for a virtual machine instance. +/// +/// Conforming types implement the mechanics of hotplugging block devices and +/// virtiofs shares into a running VM. +public protocol HotplugProvider: Sendable { + /// Hotplug a block device into the running VM. + /// - Parameters: + /// - block: The mount configuration for the block device + /// - id: The container ID to associate with this device + /// - Returns: The attached filesystem with the device path in the guest + func hotplug(_ block: Mount, id: String) async throws -> AttachedFilesystem + + /// Register mounts for a container in the VM's mount registry. + /// - Parameters: + /// - id: The container ID + /// - rootfs: The rootfs attachment from hotplug + /// - additionalMounts: Additional mounts to register + func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws + + /// Release a hotplug device. + /// - Parameter id: The container ID who should be released + func releaseHotplug(id: String) async throws + + /// Hotplug virtiofs directories into the running VM. + /// - Parameters: + /// - mounts: The virtiofs mounts to add + /// - id: The container ID that owns these mounts + func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws + + /// Release virtiofs shares for a container. + /// - Parameter id: The container ID whose shares should be released + func releaseVirtioFS(id: String) async throws + + /// Clean up resources held by the provider. + func cleanup() +} + +extension HotplugProvider { + public func cleanup() {} +} diff --git a/Sources/Containerization/IO/ReaderStream.swift b/Sources/Containerization/IO/ReaderStream.swift new file mode 100644 index 0000000..330620d --- /dev/null +++ b/Sources/Containerization/IO/ReaderStream.swift @@ -0,0 +1,22 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// A type that returns a stream of Data. +public protocol ReaderStream: Sendable { + func stream() -> AsyncStream +} diff --git a/Sources/Containerization/IO/Terminal+ReaderStream.swift b/Sources/Containerization/IO/Terminal+ReaderStream.swift new file mode 100644 index 0000000..1bd91ee --- /dev/null +++ b/Sources/Containerization/IO/Terminal+ReaderStream.swift @@ -0,0 +1,36 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOS +import Foundation + +extension Terminal: ReaderStream { + public func stream() -> AsyncStream { + .init { cont in + self.handle.readabilityHandler = { handle in + let data = handle.availableData + if data.isEmpty { + self.handle.readabilityHandler = nil + cont.finish() + return + } + cont.yield(data) + } + } + } +} + +extension Terminal: Writer {} diff --git a/Sources/Containerization/IO/Writer.swift b/Sources/Containerization/IO/Writer.swift new file mode 100644 index 0000000..4be3626 --- /dev/null +++ b/Sources/Containerization/IO/Writer.swift @@ -0,0 +1,23 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// A type that writes the provided Data. +public protocol Writer: Sendable { + func write(_ data: Data) throws + func close() throws +} diff --git a/Sources/Containerization/Image/Image.swift b/Sources/Containerization/Image/Image.swift new file mode 100644 index 0000000..bfd0892 --- /dev/null +++ b/Sources/Containerization/Image/Image.swift @@ -0,0 +1,130 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import Foundation + +/// Type representing an OCI container image. +public struct Image: Sendable { + private let contentStore: ContentStore + /// The description for the image that comprises of its name and a reference to its root descriptor. + public let description: Description + + /// A description of the OCI image. + public struct Description: Sendable { + /// The string reference of the image. + public let reference: String + /// The descriptor identifying the image. + public let descriptor: Descriptor + /// The digest for the image. + public var digest: String { descriptor.digest } + /// The media type of the image. + public var mediaType: String { descriptor.mediaType } + + public init(reference: String, descriptor: Descriptor) { + self.reference = reference + self.descriptor = descriptor + } + } + + /// The descriptor for the image. + public var descriptor: Descriptor { description.descriptor } + /// The digest of the image. + public var digest: String { description.digest } + /// The media type of the image. + public var mediaType: String { description.mediaType } + /// The string reference for the image. + public var reference: String { description.reference } + + public init(description: Description, contentStore: ContentStore) { + self.description = description + self.contentStore = contentStore + } + + /// Returns the underlying OCI index for the image. + public func index() async throws -> Index { + guard let content: Content = try await contentStore.get(digest: digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(digest)") + } + return try content.decode() + } + + /// Returns the manifest for the specified platform. + public func manifest(for platform: Platform) async throws -> Manifest { + let index = try await self.index() + let desc = index.manifests.first { desc in + desc.platform == platform + } + guard let desc else { + throw ContainerizationError(.unsupported, message: "platform \(platform.description)") + } + guard let content: Content = try await contentStore.get(digest: desc.digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(digest)") + } + return try content.decode() + } + + /// Returns the descriptor for the given platform. If it does not exist + /// will throw a ContainerizationError with the code set to .invalidArgument. + public func descriptor(for platform: Platform) async throws -> Descriptor { + let index = try await self.index() + let desc = index.manifests.first { $0.platform == platform } + guard let desc else { + throw ContainerizationError(.invalidArgument, message: "unsupported platform \(platform)") + } + return desc + } + + /// Returns the OCI config for the specified platform. + public func config(for platform: Platform) async throws -> ContainerizationOCI.Image { + let manifest = try await self.manifest(for: platform) + let desc = manifest.config + guard let content: Content = try await contentStore.get(digest: desc.digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(digest)") + } + return try content.decode() + } + + /// Returns a list of digests to all the referenced OCI objects. + public func referencedDigests() async throws -> [String] { + var referenced: [String] = [self.digest.trimmingDigestPrefix] + let index = try await self.index() + for manifest in index.manifests { + referenced.append(manifest.digest.trimmingDigestPrefix) + guard let m: Manifest = try? await contentStore.get(digest: manifest.digest) else { + // If the requested digest does not exist or is not a manifest. Skip. + // It's safe to skip processing this digest as it won't have any child layers. + continue + } + let descs = m.layers + [m.config] + referenced.append(contentsOf: descs.map { $0.digest.trimmingDigestPrefix }) + } + return referenced + } + + /// Returns a reference to the content blob for the image. The specified digest must be referenced by the image in one of its layers. + public func getContent(digest: String) async throws -> Content { + guard try await self.referencedDigests().contains(digest.trimmingDigestPrefix) else { + throw ContainerizationError(.internalError, message: "image \(self.reference) does not reference digest \(digest)") + } + guard let content: Content = try await contentStore.get(digest: digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(digest)") + } + return content + } +} diff --git a/Sources/Containerization/Image/ImageStore/ImageStore+Export.swift b/Sources/Containerization/Image/ImageStore/ImageStore+Export.swift new file mode 100644 index 0000000..916285f --- /dev/null +++ b/Sources/Containerization/Image/ImageStore/ImageStore+Export.swift @@ -0,0 +1,179 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationIO +import ContainerizationOCI +import Crypto +import Foundation + +extension ImageStore { + public struct ExportOperation: Sendable { + let name: String + let tag: String + let contentStore: ContentStore + let client: ContentClient + let progress: ProgressHandler? + + public init(name: String, tag: String, contentStore: ContentStore, client: ContentClient, progress: ProgressHandler? = nil) { + self.contentStore = contentStore + self.client = client + self.progress = progress + self.name = name + self.tag = tag + } + + @discardableResult + public func export(index: Descriptor, platforms: (Platform) -> Bool, filter: (Descriptor) -> Bool = { _ in true }) async throws -> Descriptor { + var pushQueue: [[Descriptor]] = [] + var current: [Descriptor] = [index] + while !current.isEmpty { + let children = try await self.getChildren(descs: current) + let matches = try filterPlatforms(matcher: platforms, children).uniqued { $0.digest } + pushQueue.append(matches) + current = matches + } + let localIndexData = try await self.createIndex(from: index, matching: platforms) + + await updatePushProgress(pushQueue: pushQueue, localIndexData: localIndexData) + + // We need to work bottom up when pushing an image. + // First, the tar blobs / config layers, then, the manifests and so on... + // When processing a given "level", the requests maybe made in parallel. + // We need to ensure that the child level has been uploaded fully + // before uploading the parent level. + try await withThrowingTaskGroup(of: Void.self) { group in + for layerGroup in pushQueue.reversed() { + for chunk in layerGroup.chunks(ofCount: 8) { + for desc in chunk.filter(filter) { + guard let content = try await self.contentStore.get(digest: desc.digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(desc.digest)") + } + group.addTask { + let readStream = try ReadStream(url: content.path) + try await self.pushContent(descriptor: desc, stream: readStream) + } + } + try await group.waitForAll() + } + } + } + + // Lastly, we need to construct and push a new index, since we may + // have pushed content only for specific platforms. + let digest = SHA256.hash(data: localIndexData) + // The descriptor's mediaType becomes the HTTP Content-Type in + // RegistryClient.push and must match the mediaType field inside + // localIndexData. Registries reject mismatches with MANIFEST_INVALID. + let descriptor = Descriptor( + mediaType: index.mediaType, + digest: digest.digestString, + size: Int64(localIndexData.count)) + let stream = ReadStream(data: localIndexData) + try await self.pushContent(descriptor: descriptor, stream: stream) + return descriptor + } + + private func updatePushProgress(pushQueue: [[Descriptor]], localIndexData: Data) async { + for layerGroup in pushQueue { + for desc in layerGroup { + await progress?([ + .addTotalSize(desc.size), + .addTotalItems(1), + ]) + } + } + await progress?([ + .addTotalSize(Int64(localIndexData.count)), + .addTotalItems(1), + ]) + } + + private func createIndex(from index: Descriptor, matching: (Platform) -> Bool) async throws -> Data { + guard let content = try await self.contentStore.get(digest: index.digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(index.digest)") + } + var idx: Index = try content.decode() + let manifests = idx.manifests + var matchedManifests: [Descriptor] = [] + var skippedPlatforms = false + for manifest in manifests { + guard let p = manifest.platform else { + continue + } + if matching(p) { + matchedManifests.append(manifest) + } else { + skippedPlatforms = true + } + } + if !skippedPlatforms { + return try content.data() + } + idx.manifests = matchedManifests + return try JSONEncoder().encode(idx) + } + + private func pushContent(descriptor: Descriptor, stream: ReadStream) async throws { + do { + let generator = { + try stream.reset() + return stream.stream + } + try await client.push(name: name, ref: tag, descriptor: descriptor, streamGenerator: generator, progress: progress) + await progress?([ + .addSize(descriptor.size), + .addItems(1), + ]) + } catch let err as ContainerizationError { + guard err.code != .exists else { + // We reported the total items and size and have to account for them in existing content. + await progress?([ + .addSize(descriptor.size), + .addItems(1), + ]) + return + } + throw err + } + } + + private func getChildren(descs: [Descriptor]) async throws -> [Descriptor] { + var out: [Descriptor] = [] + for desc in descs { + let mediaType = desc.mediaType + guard let content = try await self.contentStore.get(digest: desc.digest) else { + throw ContainerizationError(.notFound, message: "content with digest \(desc.digest)") + } + switch mediaType { + case MediaTypes.index, MediaTypes.dockerManifestList: + let index: Index = try content.decode() + out.append(contentsOf: index.manifests) + case MediaTypes.imageManifest, MediaTypes.dockerManifest: + let manifest: Manifest = try content.decode() + out.append(manifest.config) + out.append(contentsOf: manifest.layers) + default: + continue + } + } + return out + } + } +} diff --git a/Sources/Containerization/Image/ImageStore/ImageStore+Import.swift b/Sources/Containerization/Image/ImageStore/ImageStore+Import.swift new file mode 100644 index 0000000..9bc39a7 --- /dev/null +++ b/Sources/Containerization/Image/ImageStore/ImageStore+Import.swift @@ -0,0 +1,257 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +extension ImageStore { + public struct ImportOperation: Sendable { + static let decoder = JSONDecoder() + + let client: ContentClient + let ingestDir: URL + let contentStore: ContentStore + let progress: ProgressHandler? + let name: String + let maxConcurrentDownloads: Int + + public init(name: String, contentStore: ContentStore, client: ContentClient, ingestDir: URL, progress: ProgressHandler? = nil, maxConcurrentDownloads: Int = 3) { + self.client = client + self.ingestDir = ingestDir + self.contentStore = contentStore + self.progress = progress + self.name = name + self.maxConcurrentDownloads = maxConcurrentDownloads + } + + /// Pull the required image layers for the provided descriptor and platform(s) into the given directory using the provided client. Returns a descriptor to the Index manifest. + public func `import`(root: Descriptor, matcher: (ContainerizationOCI.Platform) -> Bool) async throws -> Descriptor { + var toProcess = [root] + while !toProcess.isEmpty { + // Count the total number of blobs and their size + if let progress { + var size: Int64 = 0 + for desc in toProcess { + size += desc.size + } + await progress([ + .addTotalSize(size), + .addTotalItems(toProcess.count), + ]) + } + + try await self.fetchAll(toProcess) + let children = try await self.walk(toProcess) + let filtered = try filterPlatforms(matcher: matcher, children) + toProcess = filtered.uniqued { $0.digest } + } + + guard root.mediaType != MediaTypes.dockerManifestList && root.mediaType != MediaTypes.index else { + return root + } + + // Create an index for the root descriptor and write it to the content store + let index = try await self.createIndex(for: root) + // In cases where the root descriptor pointed to `MediaTypes.imageManifest` + // Or `MediaTypes.dockerManifest`, it is required that we check the supported platform + // matches the platforms we were asked to pull. This can be done only after we created + // the Index. + let supportedPlatforms = index.manifests.compactMap { $0.platform } + guard supportedPlatforms.allSatisfy(matcher) else { + throw ContainerizationError(.unsupported, message: "image \(root.digest) does not support required platforms") + } + let writer = try ContentWriter(for: self.ingestDir) + let result = try writer.create(from: index) + return Descriptor( + mediaType: MediaTypes.index, + digest: result.digest.digestString, + size: Int64(result.size)) + } + + private func getManifestContent(descriptor: Descriptor) async throws -> T { + do { + if let content = try await self.contentStore.get(digest: descriptor.digest.trimmingDigestPrefix) { + return try content.decode() + } + if let content = try? LocalContent(path: ingestDir.appending(path: descriptor.digest.trimmingDigestPrefix)) { + return try content.decode() + } + return try await self.client.fetch(name: name, descriptor: descriptor) + } catch { + throw ContainerizationError(.internalError, message: "cannot fetch content with digest \(descriptor.digest)", cause: error) + } + } + + private func walk(_ descriptors: [Descriptor]) async throws -> [Descriptor] { + var out: [Descriptor] = [] + for desc in descriptors { + let mediaType = desc.mediaType + switch mediaType { + case MediaTypes.index, MediaTypes.dockerManifestList: + let index: Index = try await self.getManifestContent(descriptor: desc) + out.append(contentsOf: index.manifests) + case MediaTypes.imageManifest, MediaTypes.dockerManifest: + let manifest: Manifest = try await self.getManifestContent(descriptor: desc) + out.append(manifest.config) + out.append(contentsOf: manifest.layers) + default: + // TODO: Explicitly handle other content types + continue + } + } + return out + } + + private func fetchAll(_ descriptors: [Descriptor]) async throws { + try await withThrowingTaskGroup(of: Void.self) { group in + var iterator = descriptors.makeIterator() + // Start initial batch of concurrent downloads based on maxConcurrentDownloads + for _ in 0.. 1.mib() { + try await self.fetchBlob(descriptor) + } else { + try await self.fetchData(descriptor) + } + // Count the number of blobs + await progress?([ + .addItems(1) + ]) + } + + private func fetchBlob(_ descriptor: Descriptor) async throws { + let id = UUID().uuidString + let fm = FileManager.default + let tempFile = ingestDir.appendingPathComponent(id) + let (_, digest) = try await client.fetchBlob(name: name, descriptor: descriptor, into: tempFile, progress: progress) + guard digest.digestString == descriptor.digest else { + throw ContainerizationError(.internalError, message: "digest mismatch expected \(descriptor.digest), got \(digest.digestString)") + } + do { + try fm.moveItem(at: tempFile, to: ingestDir.appendingPathComponent(digest.encoded)) + } catch let err as NSError { + guard err.code == NSFileWriteFileExistsError else { + throw err + } + try fm.removeItem(at: tempFile) + } + } + + @discardableResult + private func fetchData(_ descriptor: Descriptor) async throws -> Data { + let data = try await client.fetchData(name: name, descriptor: descriptor) + let writer = try ContentWriter(for: ingestDir) + let result = try writer.write(data) + if let progress { + let size = Int64(result.size) + await progress([ + .addSize(size) + ]) + } + guard result.digest.digestString == descriptor.digest else { + throw ContainerizationError(.internalError, message: "digest mismatch expected \(descriptor.digest), got \(result.digest.digestString)") + } + return data + } + + private func createIndex(for root: Descriptor) async throws -> Index { + switch root.mediaType { + case MediaTypes.index, MediaTypes.dockerManifestList: + return try await self.getManifestContent(descriptor: root) + case MediaTypes.imageManifest, MediaTypes.dockerManifest: + let supportedPlatforms = try await getSupportedPlatforms(for: root) + guard supportedPlatforms.count == 1 else { + throw ContainerizationError( + .internalError, + message: + "descriptor \(root.mediaType) with digest \(root.digest) does not list any supported platform or supports more than one platform, supported platforms: \(supportedPlatforms)" + ) + } + let platform = supportedPlatforms.first! + var root = root + root.platform = platform + let index = ContainerizationOCI.Index( + schemaVersion: 2, manifests: [root], + annotations: [ + // indicate that this is a synthesized index which is not directly user facing + AnnotationKeys.containerizationIndexIndirect: "true" + ]) + return index + default: + throw ContainerizationError(.internalError, message: "failed to create index for descriptor \(root.digest), media type \(root.mediaType)") + } + } + + private func getSupportedPlatforms(for root: Descriptor) async throws -> [ContainerizationOCI.Platform] { + var supportedPlatforms: [ContainerizationOCI.Platform] = [] + var toProcess = [root] + while !toProcess.isEmpty { + let children = try await self.walk(toProcess) + for child in children { + if let p = child.platform { + supportedPlatforms.append(p) + continue + } + switch child.mediaType { + case MediaTypes.imageConfig, MediaTypes.dockerImageConfig: + let config: ContainerizationOCI.Image = try await self.getManifestContent(descriptor: child) + let p = ContainerizationOCI.Platform( + arch: config.architecture, os: config.os, osFeatures: config.osFeatures, variant: config.variant + ) + supportedPlatforms.append(p) + default: + continue + } + } + toProcess = children + } + return supportedPlatforms + } + + } +} diff --git a/Sources/Containerization/Image/ImageStore/ImageStore+OCILayout.swift b/Sources/Containerization/Image/ImageStore/ImageStore+OCILayout.swift new file mode 100644 index 0000000..6f149e7 --- /dev/null +++ b/Sources/Containerization/Image/ImageStore/ImageStore+OCILayout.swift @@ -0,0 +1,110 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +extension ImageStore { + /// Exports the specified images and their associated layers to an OCI Image Layout directory. + /// This function saves the images identified by the `references` array, including their + /// manifests and layer blobs, into a directory structure compliant with the OCI Image Layout specification at the given `out` URL. + /// + /// - Parameters: + /// - references: A list image references that exists in the `ImageStore` that are to be saved in the OCI Image Layout format. + /// - out: A URL to a directory on disk at which the OCI Image Layout structure will be created. + /// - platform: An optional parameter to indicate the platform to be saved for the images. + /// Defaults to `nil` signifying that layers for all supported platforms by the images will be saved. + /// + public func save(references: [String], out: URL, platform: Platform? = nil) async throws { + let matcher = createPlatformMatcher(for: platform) + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { + try? fileManager.removeItem(at: tempDir) + } + + var toSave: [Image] = [] + for reference in references { + let image = try await self.get(reference: reference) + let allowedMediaTypes = [MediaTypes.dockerManifestList, MediaTypes.index] + guard allowedMediaTypes.contains(image.mediaType) else { + throw ContainerizationError(.internalError, message: "cannot save image \(image.reference) with Index media type \(image.mediaType)") + } + toSave.append(image) + } + let client = try LocalOCILayoutClient(root: out) + var saved: [Descriptor] = [] + + for image in toSave { + let ref = try Reference.parse(image.reference) + let name = ref.path + guard let tag = ref.tag ?? ref.digest else { + throw ContainerizationError(.invalidArgument, message: "invalid tag/digest for image reference \(image.reference)") + } + let operation = ExportOperation(name: name, tag: tag, contentStore: self.contentStore, client: client, progress: nil) + var descriptor = try await operation.export(index: image.descriptor, platforms: matcher) + client.setImageReferenceAnnotation(descriptor: &descriptor, reference: image.reference) + saved.append(descriptor) + } + try client.createOCILayoutStructure(directory: out, manifests: saved) + } + + /// Imports one or more images and their associated layers from an OCI Image Layout directory. + /// + /// - Parameters: + /// - directory: A URL to a directory on disk at that follows the OCI Image Layout structure. + /// - progress: An optional handler over which progress update events about the load operation can be received. + /// - Returns: The list of images that were loaded into the `ImageStore`. + /// + public func load(from directory: URL, progress: ProgressHandler? = nil) async throws -> [Image] { + let client = try LocalOCILayoutClient(root: directory) + let index = try client.loadIndexFromOCILayout(directory: directory) + let matcher = createPlatformMatcher(for: nil) + + var loaded: [Image.Description] = [] + let (id, tempDir) = try await self.contentStore.newIngestSession() + do { + for descriptor in index.manifests { + let reference = client.getImageReferencefromDescriptor(descriptor: descriptor) + let ref = try Reference.parse(reference) + let name = ref.path + let operation = ImportOperation(name: name, contentStore: self.contentStore, client: client, ingestDir: tempDir, progress: progress) + let indexDesc = try await operation.import(root: descriptor, matcher: matcher) + loaded.append(Image.Description(reference: reference, descriptor: indexDesc)) + } + + let loadedImages = loaded + let importedImages = try await self.lock.withLock { lock in + var images: [Image] = [] + try await self.contentStore.completeIngestSession(id) + for description in loadedImages { + let img = try await self._create(description: description, lock: lock) + images.append(img) + } + return images + } + guard importedImages.count > 0 else { + throw ContainerizationError(.internalError, message: "failed to import image") + } + return importedImages + } catch { + try? await self.contentStore.cancelIngestSession(id) + throw error + } + } +} diff --git a/Sources/Containerization/Image/ImageStore/ImageStore+ReferenceManager.swift b/Sources/Containerization/Image/ImageStore/ImageStore+ReferenceManager.swift new file mode 100644 index 0000000..f898bc6 --- /dev/null +++ b/Sources/Containerization/Image/ImageStore/ImageStore+ReferenceManager.swift @@ -0,0 +1,90 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import Foundation + +extension ImageStore { + /// A ReferenceManager handles the mappings between an image's + /// reference and the underlying descriptor inside of a content store. + internal actor ReferenceManager { + private let path: URL + + private typealias State = [String: Descriptor] + private var images: State + + public init(path: URL) throws { + try FileManager.default.createDirectory(at: path, withIntermediateDirectories: true) + + self.path = path + self.images = [:] + } + + private func load() throws -> State { + let statePath = self.path.appendingPathComponent("state.json") + guard FileManager.default.fileExists(atPath: statePath.absolutePath()) else { + return [:] + } + do { + let data = try Data(contentsOf: statePath) + return try JSONDecoder().decode(State.self, from: data) + } catch { + throw ContainerizationError(.internalError, message: "failed to load image state \(error.localizedDescription)") + } + } + + private func save(_ state: State) throws { + let statePath = self.path.appendingPathComponent("state.json") + try JSONEncoder().encode(state).write(to: statePath) + } + + public func delete(reference: String) throws { + var state = try self.load() + state.removeValue(forKey: reference) + try self.save(state) + } + + public func delete(image: Image.Description) throws { + try self.delete(reference: image.reference) + } + + public func create(description: Image.Description) throws { + var state = try self.load() + state[description.reference] = description.descriptor + try self.save(state) + } + + public func list() throws -> [Image.Description] { + let state = try self.load() + return state.map { key, val in + let description = Image.Description(reference: key, descriptor: val) + return description + } + } + + public func get(reference: String) throws -> Image.Description { + let images = try self.list() + let hit = images.first(where: { image in + image.reference == reference + }) + guard let hit else { + throw ContainerizationError(.notFound, message: "image \(reference) not found") + } + return hit + } + } +} diff --git a/Sources/Containerization/Image/ImageStore/ImageStore.swift b/Sources/Containerization/Image/ImageStore/ImageStore.swift new file mode 100644 index 0000000..dc83616 --- /dev/null +++ b/Sources/Containerization/Image/ImageStore/ImageStore.swift @@ -0,0 +1,395 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +/// An ImageStore handles the mappings between an image's +/// reference and the underlying descriptor inside of a content store. +public actor ImageStore: Sendable { + /// The ImageStore path it was created with. + public nonisolated let path: URL + + private let referenceManager: ReferenceManager + internal let contentStore: ContentStore + internal let lock: AsyncLock = AsyncLock() + + public init(path: URL, contentStore: ContentStore? = nil) throws { + try FileManager.default.createDirectory(at: path, withIntermediateDirectories: true) + + if let contentStore { + self.contentStore = contentStore + } else { + self.contentStore = try LocalContentStore(path: path.appendingPathComponent("content")) + } + + self.path = path + self.referenceManager = try ReferenceManager(path: path) + } + + /// Return the default image store for the current user. + public static let `default`: ImageStore = { + do { + let root = try defaultRoot() + return try ImageStore(path: root) + } catch { + fatalError("unable to initialize default ImageStore \(error)") + } + }() + + private static func defaultRoot() throws -> URL { + let root = FileManager.default.urls( + for: .applicationSupportDirectory, + in: .userDomainMask + ).first + guard let root else { + throw ContainerizationError(.notFound, message: "unable to get Application Support directory for current user") + } + return root.appendingPathComponent("com.apple.containerization") + + } +} + +extension ImageStore { + /// Get an image from the `ImageStore`. + /// + /// - Parameters: + /// - reference: Name of the image. + /// - pull: Pull the image if it is not found. + /// + /// - Returns: A `Containerization.Image` object whose `reference` matches the given string. + /// This method throws a `ContainerizationError(code: .notFound)` if the provided reference does not exist in the `ImageStore`. + public func get(reference: String, pull: Bool = false) async throws -> Image { + do { + let desc = try await self.referenceManager.get(reference: reference) + return Image(description: desc, contentStore: self.contentStore) + } catch let error as ContainerizationError { + if error.code == .notFound && pull { + return try await self.pull(reference: reference) + } + throw error + } + } + + /// Get a list of all images in the `ImageStore`. + /// + /// - Returns: A `[Containerization.Image]` for all the images in the `ImageStore`. + public func list() async throws -> [Image] { + try await self.referenceManager.list().map { desc in + Image(description: desc, contentStore: self.contentStore) + } + } + + /// Create a new image in the `ImageStore`. + /// + /// - Parameters: + /// - description: The underlying `Image.Description` that contains information about the reference and index descriptor for the image to be created. + /// + /// - Note: It is assumed that the underlying manifests and blob layers for the image already exists in the `ContentStore` that the `ImageStore` was initialized with. This method is invoked when the `pull(...)` , `load(...)` and `tag(...)` methods are used. + /// - Returns: A `Containerization.Image` + @discardableResult + public func create(description: Image.Description) async throws -> Image { + try await self.lock.withLock { ctx in + try await self._create(description: description, lock: ctx) + } + } + + @discardableResult + internal func _create(description: Image.Description, lock: AsyncLock.Context) async throws -> Image { + try await self.referenceManager.create(description: description) + return Image(description: description, contentStore: self.contentStore) + } + + /// Delete an image from the `ImageStore`. + /// + /// - Parameters: + /// - reference: Name of the image that is to be deleted. + /// - performCleanup: Perform a garbage collection on the `ContentStore`, removing all unreferenced image layers and manifests, + public func delete(reference: String, performCleanup: Bool = false) async throws { + try await self.lock.withLock { lockCtx in + try await self.referenceManager.delete(reference: reference) + if performCleanup { + try await self._cleanUpOrphanedBlobs(lockCtx) + } + } + } + + /// Clean up orphaned blobs that are no longer referenced by any image. + /// + /// - Returns: Returns a tuple of `(deleted, freed)`. + /// `deleted` : A list of the names of the content items that were deleted from the `ContentStore`, + /// `freed` : The total size of the items that were deleted. + @discardableResult + public func cleanUpOrphanedBlobs() async throws -> (deleted: [String], freed: UInt64) { + try await self.lock.withLock { lockCtx in + try await self._cleanUpOrphanedBlobs(lockCtx) + } + } + + /// Calculate the size of orphaned blobs without deleting them. + /// + /// - Returns: The total size in bytes of blobs that are not referenced by any image. + public func calculateOrphanedBlobsSize() async throws -> UInt64 { + try await self.lock.withLock { lockCtx in + try await self._calculateOrphanedBlobsSize(lockCtx) + } + } + + @discardableResult + private func _cleanUpOrphanedBlobs(_ lock: AsyncLock.Context) async throws -> (deleted: [String], freed: UInt64) { + let images = try await self.list() + var referenced: [String] = [] + for image in images { + try await referenced.append(contentsOf: image.referencedDigests().uniqued()) + } + let (deleted, size) = try await self.contentStore.delete(keeping: referenced) + return (deleted, size) + } + + private func _calculateOrphanedBlobsSize(_ lock: AsyncLock.Context) async throws -> UInt64 { + let images = try await self.list() + var referenced: [String] = [] + for image in images { + try await referenced.append(contentsOf: image.referencedDigests().uniqued()) + } + + // Calculate size of blobs not in the referenced list + let referencedSet = Set(referenced.map { $0.trimmingDigestPrefix }) + let blobsPath = self.path.appendingPathComponent("content/blobs/sha256") + + let fileManager = FileManager.default + let allBlobs = try fileManager.contentsOfDirectory( + at: blobsPath, + includingPropertiesForKeys: [.fileSizeKey], + options: [.skipsHiddenFiles] + ) + + var orphanedSize: UInt64 = 0 + for blobURL in allBlobs { + let digest = blobURL.lastPathComponent + if !referencedSet.contains(digest) { + if let resourceValues = try? blobURL.resourceValues(forKeys: [.fileSizeKey]), + let size = resourceValues.fileSize + { + orphanedSize += UInt64(size) + } + } + } + + return orphanedSize + } + + /// Tag an existing image such that it can be referenced by another name. + /// + /// - Parameters: + /// - existing: The reference to an image that already exists in the `ImageStore`. + /// - new: The new reference by which the image should also be referenced as. + /// - Note: The new image created in the `ImageStore` will have the same `Image.Description` + /// as that of the image with reference `existing.` + /// - Returns: A `Containerization.Image` object to the newly created image. + public func tag(existing: String, new: String) async throws -> Image { + let old = try await self.get(reference: existing) + let descriptor = old.descriptor + do { + _ = try Reference.parse(new) + } catch { + throw ContainerizationError(.invalidArgument, message: "invalid reference \(new), error: \(error)") + } + let newDescription = Image.Description(reference: new, descriptor: descriptor) + return try await self.create(description: newDescription) + } +} + +extension ImageStore { + /// Pull an image and its associated manifest and blob layers from a remote registry. + /// + /// - Parameters: + /// - reference: A string that references an image in a remote registry of the form `[:]/repository:` + /// For example: "docker.io/library/alpine:latest". + /// - platform: An optional parameter to indicate the platform to be pulled for the image. + /// Defaults to `nil` signifying that layers for all supported platforms by the image will be pulled. + /// - insecure: A boolean indicating if the connection to the remote registry should be made via plain-text http or not. + /// Defaults to false, meaning the connection to the registry will be over https. + /// - auth: An object that implements the `Authentication` protocol, + /// used to add any credentials to the HTTP requests that are made to the registry. + /// Defaults to `nil` meaning no additional credentials are added to any HTTP requests made to the registry. + /// - progress: An optional handler over which progress update events about the pull operation can be received. + /// + /// - Returns: A `Containerization.Image` object to the newly pulled image. + public func pull( + reference: String, platform: Platform? = nil, insecure: Bool = false, + auth: Authentication? = nil, progress: ProgressHandler? = nil, maxConcurrentDownloads: Int = 3 + ) async throws -> Image { + + let matcher = createPlatformMatcher(for: platform) + let client = try RegistryClient(reference: reference, insecure: insecure, auth: auth, tlsConfiguration: TLSUtils.makeEnvironmentAwareTLSConfiguration()) + + let ref = try Reference.parse(reference) + let name = ref.path + guard let tag = ref.tag ?? ref.digest else { + throw ContainerizationError(.invalidArgument, message: "invalid tag/digest for image reference \(reference)") + } + + let rootDescriptor = try await client.resolve(name: name, tag: tag) + let (id, tempDir) = try await self.contentStore.newIngestSession() + let operation = ImportOperation( + name: name, contentStore: self.contentStore, client: client, ingestDir: tempDir, progress: progress, maxConcurrentDownloads: maxConcurrentDownloads) + do { + let index = try await operation.import(root: rootDescriptor, matcher: matcher) + return try await self.lock.withLock { lock in + try await self.contentStore.completeIngestSession(id) + let description = Image.Description(reference: reference, descriptor: index) + let image = try await self._create(description: description, lock: lock) + return image + } + } catch { + try? await self.contentStore.cancelIngestSession(id) + throw error + } + } + + /// Push an image and its associated manifest and blob layers to a remote registry. + /// + /// - Parameters: + /// - reference: A string that references an image in the `ImageStore`. It must be of the form `[:]/repository:` + /// For example: "ghcr.io/foo-bar-baz/image:v1". + /// - platform: An optional parameter to indicate the platform to be pushed for the image. + /// Defaults to `nil` signifying that layers for all supported platforms by the image will be pushed to the remote registry. + /// - insecure: A boolean indicating if the connection to the remote registry should be made via plain-text http or not. + /// Defaults to false, meaning the connection to the registry will be over https. + /// - auth: An object that implements the `Authentication` protocol, + /// used to add any credentials to the HTTP requests that are made to the registry. + /// Defaults to `nil` meaning no additional credentials are added to any HTTP requests made to the registry. + /// - progress: An optional handler over which progress update events about the push operation can be received. + /// + public func push(reference: String, platform: Platform? = nil, insecure: Bool = false, auth: Authentication? = nil, progress: ProgressHandler? = nil) async throws { + let matcher = createPlatformMatcher(for: platform) + let client = try RegistryClient(reference: reference, insecure: insecure, auth: auth, tlsConfiguration: TLSUtils.makeEnvironmentAwareTLSConfiguration()) + try await self.pushSingle(reference: reference, client: client, matcher: matcher, progress: progress) + } + + /// Push multiple image references to a remote registry, sharing a single ``RegistryClient``. + /// + /// All references must resolve to the same registry host. Passing references that target + /// different hosts throws a ``ContainerizationError`` with code ``invalidArgument``. + /// + /// - Parameters: + /// - references: An array of fully qualified image reference strings to push. + /// Each must include a host (e.g., `"ghcr.io/myrepo/myimage:v1"`). + /// - platform: An optional parameter to indicate the platform to be pushed for each image. + /// Defaults to `nil` signifying that layers for all supported platforms will be pushed. + /// - insecure: A boolean indicating if the connection to the remote registry should be made via plain-text http or not. + /// Defaults to false, meaning the connection to the registry will be over https. + /// - auth: An object that implements the `Authentication` protocol, + /// used to add any credentials to the HTTP requests that are made to the registry. + /// Defaults to `nil` meaning no additional credentials are added to any HTTP requests made to the registry. + /// - maxConcurrentUploads: Maximum number of concurrent tag pushes. Defaults to 3. + /// - progress: An optional handler over which progress update events about the push operations can be received. + /// + public func push( + references: [String], platform: Platform? = nil, insecure: Bool = false, + auth: Authentication? = nil, maxConcurrentUploads: Int = 3, progress: ProgressHandler? = nil + ) async throws { + guard let firstReference = references.first else { + return + } + + // Parse all references upfront: validate hosts and avoid re-parsing inside tasks. + let parsed = try references.map { ref in try Reference.parse(ref) } + let hosts = parsed.compactMap { $0.resolvedDomain } + guard hosts.count == references.count else { + throw ContainerizationError(.invalidArgument, message: "all references must include a host") + } + let uniqueHosts = Set(hosts) + guard uniqueHosts.count == 1 else { + throw ContainerizationError( + .invalidArgument, + message: "all references must target the same registry host, got: \(uniqueHosts.sorted().joined(separator: ", "))") + } + + let matcher = createPlatformMatcher(for: platform) + let client = try RegistryClient( + reference: firstReference, insecure: insecure, auth: auth, + tlsConfiguration: TLSUtils.makeEnvironmentAwareTLSConfiguration()) + + let pushOne: @Sendable (String) async -> (String, String?) = { reference in + do { + try await self.pushSingle(reference: reference, client: client, matcher: matcher, progress: progress) + return (reference, nil) + } catch { + return (reference, String(describing: error)) + } + } + + var iterator = references.makeIterator() + var failures: [(reference: String, message: String)] = [] + + await withTaskGroup(of: (String, String?).self) { group in + for _ in 0.. Bool, progress: ProgressHandler? + ) async throws { + let allowedMediaTypes = [MediaTypes.dockerManifestList, MediaTypes.index] + let img = try await self.get(reference: reference) + guard allowedMediaTypes.contains(img.mediaType) else { + throw ContainerizationError(.internalError, message: "cannot push image \(reference): unsupported media type \(img.mediaType), expected an index or manifest list") + } + let ref = try Reference.parse(reference) + guard let tag = ref.tag ?? ref.digest else { + throw ContainerizationError(.invalidArgument, message: "invalid tag/digest for image reference \(reference)") + } + let operation = ExportOperation(name: ref.path, tag: tag, contentStore: self.contentStore, client: client, progress: progress) + try await operation.export(index: img.descriptor, platforms: matcher) + } +} + +extension ImageStore { + /// Get the image for the init block from the image store. + /// If the image does not exist locally, pull the image. + public func getInitImage(reference: String, auth: Authentication? = nil, progress: ProgressHandler? = nil) async throws -> InitImage { + do { + let image = try await self.get(reference: reference) + return InitImage(image: image) + } catch let error as ContainerizationError { + if error.code == .notFound { + let image = try await self.pull(reference: reference, auth: auth, progress: progress) + return InitImage(image: image) + } + throw error + } + } +} diff --git a/Sources/Containerization/Image/InitImage.swift b/Sources/Containerization/Image/InitImage.swift new file mode 100644 index 0000000..a63f0dc --- /dev/null +++ b/Sources/Containerization/Image/InitImage.swift @@ -0,0 +1,85 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import Foundation + +/// Data representing the image to use as the root filesystem for a virtual machine. +/// Typically this image would contain the guest agent used to facilitate container +/// workloads, as well as any extras that may be useful to have in the guest. +public struct InitImage: Sendable { + public var name: String { image.reference } + + let image: Image + + public init(image: Image) { + self.image = image + } +} + +extension InitImage { + /// Unpack the initial filesystem for the desired platform at a given path. + public func initBlock(at: URL, for platform: SystemPlatform) async throws -> Mount { + let unpacker = EXT4Unpacker(blockSizeInBytes: 512.mib()) + var fs = try await unpacker.unpack(self.image, for: platform.ociPlatform(), at: at) + fs.options = ["ro"] + return fs + } + + /// Create a new InitImage with the reference as the name. + /// The `rootfs` parameter must be a tar.gz file whose contents make up the filesystem for the image. + public static func create( + reference: String, rootfs: URL, platform: Platform, + labels: [String: String] = [:], imageStore: ImageStore, contentStore: ContentStore + ) async throws -> InitImage { + + let indexDescriptorStore = AsyncStore() + try await contentStore.ingest { dir in + let writer = try ContentWriter(for: dir) + var result = try writer.create(from: rootfs) + let layerDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.imageLayerGzip, digest: result.digest.digestString, size: result.size) + + // TODO: compute and fill in the correct diffID for the above layer + // We currently put in the sha of the fully compressed layer, this needs to be replaced with + // the sha of the uncompressed layer. + let rootfsConfig = ContainerizationOCI.Rootfs(type: "layers", diffIDs: [result.digest.digestString]) + let runtimeConfig = ContainerizationOCI.ImageConfig(labels: labels) + let imageConfig = ContainerizationOCI.Image(architecture: platform.architecture, os: platform.os, config: runtimeConfig, rootfs: rootfsConfig) + result = try writer.create(from: imageConfig) + let configDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.imageConfig, digest: result.digest.digestString, size: result.size) + + let manifest = Manifest(config: configDescriptor, layers: [layerDescriptor]) + result = try writer.create(from: manifest) + let manifestDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.imageManifest, digest: result.digest.digestString, size: result.size, platform: platform) + + let index = ContainerizationOCI.Index(manifests: [manifestDescriptor]) + result = try writer.create(from: index) + + let indexDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.index, digest: result.digest.digestString, size: result.size) + await indexDescriptorStore.set(indexDescriptor) + + } + + guard let indexDescriptor = await indexDescriptorStore.get() else { + throw ContainerizationError(.notFound, message: "image for \(reference) not found") + } + + let description = Image.Description(reference: reference, descriptor: indexDescriptor) + let image = try await imageStore.create(description: description) + return InitImage(image: image) + } +} diff --git a/Sources/Containerization/Image/KernelImage.swift b/Sources/Containerization/Image/KernelImage.swift new file mode 100644 index 0000000..9a64c6f --- /dev/null +++ b/Sources/Containerization/Image/KernelImage.swift @@ -0,0 +1,94 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import Foundation + +/// A multi-arch kernel image represented by an OCI image. +public struct KernelImage: Sendable { + /// The media type for a kernel image. + public static let mediaType = "application/vnd.apple.containerization.kernel" + + /// The name or reference of the image. + public var name: String { image.reference } + + let image: Image + + public init(image: Image) { + self.image = image + } +} + +extension KernelImage { + /// Return the kernel from a multi arch image for a specific system platform. + public func kernel(for platform: SystemPlatform) async throws -> Kernel { + let manifest = try await image.manifest(for: platform.ociPlatform()) + guard let descriptor = manifest.layers.first, descriptor.mediaType == Self.mediaType else { + throw ContainerizationError(.notFound, message: "kernel descriptor for \(platform) not found") + } + let content = try await image.getContent(digest: descriptor.digest) + return Kernel( + path: content.path, + platform: platform + ) + } + + /// Create a new kernel image with the reference as the name. + /// This will create a multi arch image containing kernel's for each provided architecture. + public static func create(reference: String, binaries: [Kernel], labels: [String: String] = [:], imageStore: ImageStore, contentStore: ContentStore) async throws -> KernelImage + { + let indexDescriptorStore = AsyncStore() + try await contentStore.ingest { ingestPath in + var descriptors = [Descriptor]() + let writer = try ContentWriter(for: ingestPath) + + for kernel in binaries { + var result = try writer.create(from: kernel.path) + let platform = kernel.platform.ociPlatform() + let layerDescriptor = Descriptor( + mediaType: mediaType, + digest: result.digest.digestString, + size: result.size, + platform: platform) + let rootfsConfig = ContainerizationOCI.Rootfs(type: "layers", diffIDs: [result.digest.digestString]) + let runtimeConfig = ContainerizationOCI.ImageConfig(labels: labels) + let imageConfig = ContainerizationOCI.Image(architecture: platform.architecture, os: platform.os, config: runtimeConfig, rootfs: rootfsConfig) + + result = try writer.create(from: imageConfig) + let configDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.imageConfig, digest: result.digest.digestString, size: result.size) + + let manifest = Manifest(config: configDescriptor, layers: [layerDescriptor]) + result = try writer.create(from: manifest) + let manifestDescriptor = Descriptor( + mediaType: ContainerizationOCI.MediaTypes.imageManifest, digest: result.digest.digestString, size: result.size, platform: platform) + descriptors.append(manifestDescriptor) + } + let index = ContainerizationOCI.Index(manifests: descriptors) + let result = try writer.create(from: index) + let indexDescriptor = Descriptor(mediaType: ContainerizationOCI.MediaTypes.index, digest: result.digest.digestString, size: result.size) + await indexDescriptorStore.set(indexDescriptor) + } + + guard let indexDescriptor = await indexDescriptorStore.get() else { + throw ContainerizationError(.notFound, message: "image for \(reference) not found") + } + + let description = Image.Description(reference: reference, descriptor: indexDescriptor) + let image = try await imageStore.create(description: description) + return KernelImage(image: image) + } +} diff --git a/Sources/Containerization/Image/Unpacker/EXT4Unpacker.swift b/Sources/Containerization/Image/Unpacker/EXT4Unpacker.swift new file mode 100644 index 0000000..0e9609b --- /dev/null +++ b/Sources/Containerization/Image/Unpacker/EXT4Unpacker.swift @@ -0,0 +1,169 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationArchive +import ContainerizationEXT4 +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation +import SystemPackage + +public struct EXT4Unpacker: Unpacker { + let blockSizeInBytes: UInt64 + + let journal: EXT4.JournalConfig? + + /// Creates an unpacker that extracts images into EXT4 filesystems. + /// - Parameters: + /// - blockSizeInBytes: The filesystem block size. + /// - journal: The journal configuration to use, or nil for no journaling. + public init(blockSizeInBytes: UInt64, journal: EXT4.JournalConfig? = nil) { + self.blockSizeInBytes = blockSizeInBytes + self.journal = journal + } + + /// Performs the unpacking of a tar archive into a filesystem. + /// - Parameters: + /// - archive: The archive to unpack. + /// - compression: The compression to use when unpacking the image. + /// - path: The path to the filesystem that will be created. + public func unpack( + archive: URL, + compression: ContainerizationArchive.Filter, + at path: URL + ) async throws { + let cleanedPath = try prepareUnpackPath(path: path) + let filesystem = try EXT4.Formatter( + FilePath(cleanedPath), + minDiskSize: blockSizeInBytes, + journal: journal + ) + defer { try? filesystem.close() } + + try await filesystem.unpack( + source: archive, + format: .paxRestricted, + compression: compression + ) + } + + /// Returns a `Mount` point after unpacking the image into a filesystem. + /// - Parameters: + /// - image: The image to unpack. + /// - platform: The platform content to unpack. + /// - path: The path to the directory where the filesystem will be created. + /// - progress: The progress handler to invoke as the unpacking progresses. + public func unpack( + _ image: Image, + for platform: Platform, + at path: URL, + progress: ProgressHandler? = nil + ) async throws -> Mount { + let cleanedPath = try prepareUnpackPath(path: path) + let manifest = try await image.manifest(for: platform) + let filesystem = try EXT4.Formatter( + FilePath( + cleanedPath + ), + minDiskSize: blockSizeInBytes + ) + defer { try? filesystem.close() } + + // Resolve layer paths upfront. When progress reporting is enabled and a layer + // uses zstd, decompress once so both the size-scanning pass and the unpack + // pass share the same decompressed file. + var resolvedLayers: [(file: URL, filter: ContainerizationArchive.Filter)] = [] + var decompressedFiles: [URL] = [] + for layer in manifest.layers { + try Task.checkCancellation() + let content = try await image.getContent(digest: layer.digest) + let compression = try compressionFilter(for: layer.mediaType) + if progress != nil && compression == .zstd { + let decompressed = try ArchiveReader.decompressZstd(content.path) + decompressedFiles.append(decompressed) + resolvedLayers.append((file: decompressed, filter: .none)) + } else { + resolvedLayers.append((file: content.path, filter: compression)) + } + } + defer { + for file in decompressedFiles { + ArchiveReader.cleanUpDecompressedZstd(file) + } + } + + if let progress { + var totalSize: Int64 = 0 + var totalItems: Int = 0 + for layer in resolvedLayers { + try Task.checkCancellation() + let totals = try EXT4.Formatter.scanArchiveHeaders( + format: .paxRestricted, filter: layer.filter, file: layer.file) + totalSize += totals.size + totalItems += totals.items + } + var totalEvents: [ProgressEvent] = [] + if totalSize > 0 { + totalEvents.append(.addTotalSize(totalSize)) + } + if totalItems > 0 { + totalEvents.append(.addTotalItems(totalItems)) + } + if !totalEvents.isEmpty { + await progress(totalEvents) + } + } + + for resolved in resolvedLayers { + try Task.checkCancellation() + let reader = try ArchiveReader( + format: .paxRestricted, + filter: resolved.filter, + file: resolved.file + ) + try await filesystem.unpack(reader: reader, progress: progress) + } + + return .block( + format: "ext4", + source: cleanedPath, + destination: "/", + options: [] + ) + } + + private func prepareUnpackPath(path: URL) throws -> String { + let blockPath = path.absolutePath() + guard !FileManager.default.fileExists(atPath: blockPath) else { + throw ContainerizationError(.exists, message: "block device already exists at \(blockPath)") + } + return blockPath + } + + private func compressionFilter(for mediaType: String) throws -> ContainerizationArchive.Filter { + switch mediaType { + case MediaTypes.imageLayer, MediaTypes.dockerImageLayer: + return .none + case MediaTypes.imageLayerGzip, MediaTypes.dockerImageLayerGzip: + return .gzip + case MediaTypes.imageLayerZstd, MediaTypes.dockerImageLayerZstd: + return .zstd + default: + throw ContainerizationError(.unsupported, message: "media type \(mediaType) not supported.") + } + } +} diff --git a/Sources/Containerization/Image/Unpacker/Unpacker.swift b/Sources/Containerization/Image/Unpacker/Unpacker.swift new file mode 100644 index 0000000..d188b2c --- /dev/null +++ b/Sources/Containerization/Image/Unpacker/Unpacker.swift @@ -0,0 +1,40 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +/// The `Unpacker` protocol defines a standardized interface that involves +/// decompressing, extracting image layers and preparing it for use. +/// +/// The `Unpacker` is responsible for managing the lifecycle of the +/// unpacking process, including any temporary files or resources, until the +/// `Mount` object is produced. +public protocol Unpacker { + + /// Unpacks the provided image to a specified path for a given platform. + /// + /// This asynchronous method should handle the entire unpacking process, from reading + /// the `Image` layers for the given `Platform` via its `Manifest`, + /// to making the extracted contents available as a `Mount`. + /// Implementations of this method may apply platform-specific optimizations + /// or transformations during the unpacking. + /// + /// Progress updates can be observed via the optional `progress` handler. + func unpack(_ image: Image, for platform: Platform, at path: URL, progress: ProgressHandler?) async throws -> Mount + +} diff --git a/Sources/Containerization/Interface.swift b/Sources/Containerization/Interface.swift new file mode 100644 index 0000000..a95c58f --- /dev/null +++ b/Sources/Containerization/Interface.swift @@ -0,0 +1,46 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras + +/// A network interface. +public protocol Interface: Sendable { + /// The interface IPv4 address and subnet prefix length, as a CIDR address. + /// Example: `192.168.64.3/24` + var ipv4Address: CIDRv4 { get } + + /// The IPv4 gateway address for the default route, or nil for no IPv4 default route. + var ipv4Gateway: IPv4Address? { get } + + /// The interface IPv6 address and subnet prefix length, as a CIDRv6 address, or nil for no IPv6 address. + /// Example: `fd00::1/64` + var ipv6Address: CIDRv6? { get } + + /// The IPv6 gateway address for the default route, or nil for no IPv6 default route. + var ipv6Gateway: IPv6Address? { get } + + /// The interface MAC address, or nil to auto-configure the address. + var macAddress: MACAddress? { get } + + /// The interface MTU (Maximum Transmission Unit). + var mtu: UInt32 { get } +} + +extension Interface { + public var mtu: UInt32 { 1500 } + public var ipv6Address: CIDRv6? { nil } + public var ipv6Gateway: IPv6Address? { nil } +} diff --git a/Sources/Containerization/IptablesRules.swift b/Sources/Containerization/IptablesRules.swift new file mode 100644 index 0000000..a62e21c --- /dev/null +++ b/Sources/Containerization/IptablesRules.swift @@ -0,0 +1,106 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationOS +import Foundation + +/// Thin idempotent wrappers around the `iptables` CLI for use by +/// `BridgeManager`. We don't program nftables directly; modern distros +/// ship the `iptables` binary as a shim over nftables and it's universally +/// available. +enum IptablesRules { + /// Add a rule unless it already exists. `args` is the rule body + /// excluding the leading action (`-A`/`-C`/`-D`). + /// + /// Implementation: run `iptables -C ` first; if exit 0, the rule + /// exists already — return. Otherwise run `iptables -A ` and + /// throw on non-zero exit. + static func ensure(table: String? = nil, args: [String]) throws { + let tableArgs = table.map { ["-t", $0] } ?? [] + let check = try run(args: tableArgs + ["-C"] + args) + if check.exit == 0 { return } + let add = try run(args: tableArgs + ["-A"] + args) + if add.exit != 0 { + throw ContainerizationError( + .internalError, + message: """ + iptables -A \(args.joined(separator: " ")) failed (exit \(add.exit))\ + \(add.stderr.isEmpty ? "" : ": \(add.stderr)") + """ + ) + } + } + + /// Best-effort delete. Ignores non-zero exit (rule may not exist). + static func remove(table: String? = nil, args: [String]) { + let tableArgs = table.map { ["-t", $0] } ?? [] + _ = try? run(args: tableArgs + ["-D"] + args) + } + + /// Captured outcome of a single `iptables` invocation. + private struct InvocationResult { + let exit: Int32 + let stderr: String + } + + /// Run `iptables` with the given args, returning the exit status and any + /// stderr the binary emitted. Throws if no `iptables` binary is found. + private static func run(args: [String]) throws -> InvocationResult { + // ContainerizationOS.Command uses execve() under the hood, which + // requires an absolute path. Probe the two paths iptables actually + // ships at on Linux distros — /usr/sbin first (Debian, Ubuntu, + // Fedora, Alpine, RHEL), then /sbin (older / busybox-style). + let candidates = ["/usr/sbin/iptables", "/sbin/iptables"] + // Open /dev/null fresh rather than using FileHandle.nullDevice: + // swift-corelibs-foundation's nullDevice uses a sentinel fd that + // doesn't survive dup2() in Command's child, producing EBADF on exec. + // Capture stderr through a pipe so failures surface with the actual + // iptables error (locked xtables, missing kernel module, conflicting + // rule) instead of an opaque exit code. + let devNullOut = FileHandle(forWritingAtPath: "/dev/null") + let stderrPipe = Pipe() + defer { + try? devNullOut?.close() + try? stderrPipe.fileHandleForReading.close() + } + for path in candidates where FileManager.default.isExecutableFile(atPath: path) { + // `-w` makes iptables block on the xtables lock rather than + // failing (exit 4) when another actor — a sibling BridgeManager on + // a different bridge, Docker, firewalld — is mid-iptables. Accepted + // by both legacy iptables and the nft shim. + var cmd = Command(path, arguments: ["-w"] + args) + cmd.stdout = devNullOut + cmd.stderr = stderrPipe.fileHandleForWriting + try cmd.start() + // Close the parent's write end so the read end sees EOF when + // iptables exits, even if iptables itself never writes anything. + try? stderrPipe.fileHandleForWriting.close() + let exit = try cmd.wait() + let data = (try? stderrPipe.fileHandleForReading.readToEnd()) ?? Data() + let stderr = + String(data: data, encoding: .utf8)? + .trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + return InvocationResult(exit: exit, stderr: stderr) + } + throw ContainerizationError( + .notFound, + message: "iptables not found at /usr/sbin/iptables or /sbin/iptables; install iptables (or its nftables shim)" + ) + } +} +#endif diff --git a/Sources/Containerization/Kernel+Commandline.swift b/Sources/Containerization/Kernel+Commandline.swift new file mode 100644 index 0000000..a5ff83c --- /dev/null +++ b/Sources/Containerization/Kernel+Commandline.swift @@ -0,0 +1,50 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension Kernel { + /// Build the `init=/sbin/vminitd` Linux kernel command line for the given + /// rootfs type. Used by both the VZ and cloud-hypervisor backends since + /// the guest's vminitd init contract is identical across VMMs. + func linuxCommandline(initialFilesystem: Mount) -> String { + var args = self.commandLine.kernelArgs + + args.append("init=/sbin/vminitd") + // rootfs is always mounted read-only. + args.append("ro") + + switch initialFilesystem.type { + case "virtiofs": + args.append(contentsOf: [ + "rootfstype=virtiofs", + "root=rootfs", + ]) + case "ext4": + args.append(contentsOf: [ + "rootfstype=ext4", + "root=/dev/vda", + ]) + default: + fatalError("unsupported initfs filesystem \(initialFilesystem.type)") + } + + if self.commandLine.initArgs.count > 0 { + args.append("--") + args.append(contentsOf: self.commandLine.initArgs) + } + + return args.joined(separator: " ") + } +} diff --git a/Sources/Containerization/Kernel.swift b/Sources/Containerization/Kernel.swift new file mode 100644 index 0000000..c4c2468 --- /dev/null +++ b/Sources/Containerization/Kernel.swift @@ -0,0 +1,101 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Logging + +/// An object representing a Linux kernel used to boot a virtual machine. +/// In addition to a path to the kernel itself, this type stores relevant +/// data such as the commandline to pass to the kernel, and init arguments. +public struct Kernel: Sendable, Codable { + /// The command line arguments passed to the kernel on boot. + public struct CommandLine: Sendable, Codable { + public static let kernelDefaults = [ + "console=hvc0", + "tsc=reliable", + ] + + /// Adds the debug argument to the kernel commandline. + mutating public func addDebug() { + self.kernelArgs.append("debug") + } + + /// Adds a panic level to the kernel commandline. + mutating public func addPanic(level: Int) { + self.kernelArgs.append("panic=\(level)") + } + + // Sets the log level for the Agent + mutating public func setAgentLogLevel(level: Logger.Level) { + self.initArgs.append(contentsOf: ["--log-level", level.description]) + } + + /// Additional kernel arguments. + public var kernelArgs: [String] + /// Additional arguments passed to the Initial Process / Agent. + public var initArgs: [String] + + /// Initializes the kernel commandline using the mix of kernel arguments + /// and init arguments. + public init( + kernelArgs: [String] = kernelDefaults, + initArgs: [String] = [] + ) { + self.kernelArgs = kernelArgs + self.initArgs = initArgs + } + + /// Initializes the kernel commandline to the defaults of Self.kernelDefaults, + /// adds a debug and panic flag as instructed, and optionally a set of init + /// process flags to supply to vminitd. + public init(debug: Bool, panic: Int, initArgs: [String] = []) { + var args = Self.kernelDefaults + if debug { + args.append("debug") + } + args.append("panic=\(panic)") + self.kernelArgs = args + self.initArgs = initArgs + } + } + + /// Path on disk to the kernel binary. + public var path: URL + /// Platform for the kernel. + public var platform: SystemPlatform + /// Kernel and init process command line. + public var commandLine: Self.CommandLine + + /// Kernel command line arguments. + public var kernelArgs: [String] { + self.commandLine.kernelArgs + } + + /// Init process arguments. + public var initArgs: [String] { + self.commandLine.initArgs + } + + public init( + path: URL, + platform: SystemPlatform, + commandline: Self.CommandLine = CommandLine(debug: false, panic: 0) + ) { + self.path = path + self.platform = platform + self.commandLine = commandline + } +} diff --git a/Sources/Containerization/LinuxBridgedNetwork.swift b/Sources/Containerization/LinuxBridgedNetwork.swift new file mode 100644 index 0000000..de62ab6 --- /dev/null +++ b/Sources/Containerization/LinuxBridgedNetwork.swift @@ -0,0 +1,181 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationExtras +import ContainerizationNetlink +import Crypto +import Foundation + +/// A `Network` implementation backed by Linux TAP devices, optionally +/// enslaved to a pre-existing bridge. The bridge itself is **not** managed +/// by this type — callers own its creation, teardown, and any NAT/firewall +/// rules. This abstraction only handles per-VM TAP lifecycle and IPv4 +/// address allocation within a configured subnet. +/// +/// Mirrors the `VmnetNetwork` shape on macOS so the two backends are +/// interchangeable from a `LinuxContainer`/`Network` consumer's POV. +/// +/// Requires `CAP_NET_ADMIN` for TAP creation and bridge enslavement. +public struct LinuxBridgedNetwork: Network { + /// The IPv4 subnet from which container interfaces are allocated. + public let subnet: CIDRv4 + /// The default-route gateway for containers attached to this network. + public let ipv4Gateway: IPv4Address + /// Optional bridge name to enslave each created TAP to. + public let bridge: String? + /// MTU applied to every TAP this network creates. + public let mtu: UInt32 + + private var allocator: Allocator + private var taps: [String: TAPDevice] + + /// Per-id rotating IPv4 allocator. Mirrors `VmnetNetwork.Allocator` + /// verbatim: lower bound = `subnet.lower + 2` (gateway = `lower + 1`, + /// network = `lower`), size = `upper - lower - 3` (broadcast = `upper`, + /// also reserved). + struct Allocator: Sendable { + private let addressAllocator: any AddressAllocator + private let cidr: CIDRv4 + private var allocations: [String: UInt32] + + init(cidr: CIDRv4) throws { + self.cidr = cidr + self.allocations = [:] + let span = cidr.upper.value - cidr.lower.value + guard span >= 4 else { + throw ContainerizationError( + .invalidArgument, + message: "subnet \(cidr) has no usable host addresses (need at least 4)" + ) + } + let size = Int(span - 3) + self.addressAllocator = try UInt32.rotatingAllocator( + lower: cidr.lower.value + 2, + size: UInt32(size) + ) + } + + mutating func allocate(_ id: String) throws -> CIDRv4 { + if allocations[id] != nil { + throw ContainerizationError( + .exists, + message: "allocation with id \(id) already exists" + ) + } + let index = try addressAllocator.allocate() + allocations[id] = index + return try CIDRv4(IPv4Address(index), prefix: cidr.prefix) + } + + mutating func release(_ id: String) throws { + if let index = allocations[id] { + try addressAllocator.release(index) + allocations.removeValue(forKey: id) + } + } + } + + /// Create a Linux bridged network. + /// + /// - Parameters: + /// - subnet: The IPv4 subnet to allocate container addresses from. + /// - gateway: Default-route gateway IPv4. If nil, defaults to + /// `subnet.gateway` (= `lower + 1`). + /// - bridge: Existing bridge name to enslave each TAP to, or nil for + /// standalone TAPs. Validated at init time via netlink. + /// - mtu: MTU applied to every created TAP (default 1500). + public init( + subnet: CIDRv4, + gateway: IPv4Address? = nil, + bridge: String? = nil, + mtu: UInt32 = 1500 + ) throws { + self.subnet = subnet + self.ipv4Gateway = gateway ?? subnet.gateway + self.bridge = bridge + self.mtu = mtu + self.allocator = try Allocator(cidr: subnet) + self.taps = [:] + + if let bridge { + // Validate via the public linkGet — empty result or netlink error + // means the bridge does not exist or is unreachable. + let session = try NetlinkSession(socket: DefaultNetlinkSocket()) + do { + let links = try session.linkGet(interface: bridge) + guard !links.isEmpty else { + throw ContainerizationError( + .notFound, + message: "bridge \(bridge) not found" + ) + } + } catch let err as ContainerizationError { + throw err + } catch { + throw ContainerizationError( + .notFound, + message: "bridge \(bridge) not found: \(error)" + ) + } + } + } + + public mutating func createInterface(_ id: String) throws -> Interface? { + let cidr = try allocator.allocate(id) + let tapName = Self.derivedTAPName(forID: id) + + let device: TAPDevice + do { + device = try TAPDevice( + name: tapName, + bridge: bridge, + mtu: mtu, + macAddress: nil + ) + } catch { + // Roll back the allocator so the IP isn't leaked. + try? allocator.release(id) + throw error + } + taps[id] = device + + return TAPInterface( + tapName: device.name, + ipv4Address: cidr, + ipv4Gateway: ipv4Gateway, + macAddress: nil, + mtu: mtu + ) + } + + public mutating func releaseInterface(_ id: String) throws { + if let device = taps.removeValue(forKey: id) { + device.close() + } + try allocator.release(id) + } + + /// Derive a deterministic, IFNAMSIZ-compliant TAP name from a container id. + /// Format: `czt-<10 hex chars>` (14 chars total; IFNAMSIZ-1 = 15). + static func derivedTAPName(forID id: String) -> String { + let hash = SHA256.hash(data: Data(id.utf8)) + let hex = hash.map { String(format: "%02x", $0) }.joined() + return "czt-" + String(hex.prefix(10)) + } +} +#endif diff --git a/Sources/Containerization/LinuxContainer.swift b/Sources/Containerization/LinuxContainer.swift new file mode 100644 index 0000000..e24bdf6 --- /dev/null +++ b/Sources/Containerization/LinuxContainer.swift @@ -0,0 +1,1531 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationArchive +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging +import Synchronization +import SystemPackage + +import struct ContainerizationOS.Terminal + +/// `LinuxContainer` is an easy to use type for launching and managing the +/// full lifecycle of a Linux container ran inside of a virtual machine. +public final class LinuxContainer: Container, Sendable { + public static let maxIDLength = 64 + + /// The identifier of the container. + public let id: String + + /// Rootfs for the container. + /// + /// Note: The `destination` field of this mount is ignored as mounting is handled internally. + public let rootfs: Mount + + /// Optional writable layer for the container. When provided, the rootfs + /// is mounted as the lower layer of an overlayfs, with this as the upper layer. + /// All writes will go to this layer instead of the rootfs. + /// + /// Note: The `destination` field of this mount is ignored as mounting is handled internally. + public let writableLayer: Mount? + + /// Configuration for the container. + public let config: Configuration + + /// The configuration for the LinuxContainer. + public struct Configuration: Sendable { + /// Configuration for the init process of the container. + public var process = LinuxProcessConfiguration() + /// The amount of cpus for the container. + public var cpus: Int = 4 + /// The memory in bytes to give to the container. + public var memoryInBytes: UInt64 = 1024.mib() + /// The hostname for the container. + public var hostname: String? + /// The system control options for the container. + public var sysctl: [String: String] = [:] + /// The network interfaces for the container. + public var interfaces: [any Interface] = [] + /// The Unix domain socket relays to setup for the container. + public var sockets: [UnixSocketConfiguration] = [] + /// The mounts for the container. + public var mounts: [Mount] = LinuxContainer.defaultMounts() + /// Paths inside the container that vmexec hides from the workload. + /// Defaults to the OCI standard set (``LinuxContainer/defaultMaskedPaths()``), + /// matching the restricted capability baseline. Set to `[]` to opt out, + /// or append to extend it. + public var maskedPaths: [String] = LinuxContainer.defaultMaskedPaths() + /// Paths inside the container that vmexec marks read-only. + /// Defaults to the OCI standard set (``LinuxContainer/defaultReadonlyPaths()``), + /// matching the restricted capability baseline. Set to `[]` to opt out, + /// or append to extend it. + public var readonlyPaths: [String] = LinuxContainer.defaultReadonlyPaths() + /// The DNS configuration for the container. + public var dns: DNS? + /// The hosts to add to /etc/hosts for the container. + public var hosts: Hosts? + /// Enable nested virtualization support. + public var virtualization: Bool = false + /// Optional destination for serial boot logs. + public var bootLog: BootLog? + /// EXPERIMENTAL: Path in the root filesystem for the virtual + /// machine where the OCI runtime used to spawn the container lives. + public var ociRuntimePath: String? + /// Run the container with a minimal init process that handles signal + /// forwarding and zombie reaping. + public var useInit: Bool = false + /// Additional CPU cores to allocate for the virtual machine on top + /// of the container's configured `cpus` value. + public var cpuOverhead: Int = 1 + /// Additional memory in bytes to allocate for the virtual machine + /// on top of the container's configured `memoryInBytes` value. + /// The total is aligned to a 1 MiB boundary. + public var memoryOverhead: UInt64 = 128.mib() + + public init() {} + + public init( + process: LinuxProcessConfiguration, + cpus: Int = 4, + memoryInBytes: UInt64 = 1024.mib(), + hostname: String? = nil, + sysctl: [String: String] = [:], + interfaces: [any Interface] = [], + sockets: [UnixSocketConfiguration] = [], + mounts: [Mount] = LinuxContainer.defaultMounts(), + maskedPaths: [String] = LinuxContainer.defaultMaskedPaths(), + readonlyPaths: [String] = LinuxContainer.defaultReadonlyPaths(), + dns: DNS? = nil, + hosts: Hosts? = nil, + virtualization: Bool = false, + bootLog: BootLog? = nil, + ociRuntimePath: String? = nil, + useInit: Bool = false, + cpuOverhead: Int = 1, + memoryOverhead: UInt64 = 128.mib() + ) { + self.process = process + self.cpus = cpus + self.memoryInBytes = memoryInBytes + self.hostname = hostname + self.sysctl = sysctl + self.interfaces = interfaces + self.sockets = sockets + self.mounts = mounts + self.maskedPaths = maskedPaths + self.readonlyPaths = readonlyPaths + self.dns = dns + self.hosts = hosts + self.virtualization = virtualization + self.bootLog = bootLog + self.ociRuntimePath = ociRuntimePath + self.useInit = useInit + self.cpuOverhead = cpuOverhead + self.memoryOverhead = memoryOverhead + } + } + + private let state: AsyncMutex + + // Ports to be allocated from for stdio and for + // unix socket relays that are sharing a guest + // uds to the host. + private let hostVsockPorts: Atomic + // Ports we request the guest to allocate for unix socket relays from + // the host. + private let guestVsockPorts: Atomic + + // Queue for copy IO. + private let copyQueue = DispatchQueue(label: "com.apple.containerization.copy") + + private enum State: Sendable { + /// The container class has been created but no live resources are running. + case initialized + /// The container's virtual machine has been setup and the runtime environment has been configured. + case created(CreatedState) + /// The initial process of the container has started and is running. + case started(StartedState) + /// The container has run and fully stopped. + case stopped + /// An error occurred during the lifetime of this class. + case errored(Swift.Error) + /// The container is paused. + case paused(PausedState) + + struct CreatedState: Sendable { + let vm: any VirtualMachineInstance + let relayManager: UnixSocketRelayManager + var fileMountContext: FileMountContext + } + + struct StartedState: Sendable { + let vm: any VirtualMachineInstance + let process: LinuxProcess + let relayManager: UnixSocketRelayManager + var vendedProcesses: [String: LinuxProcess] + let fileMountContext: FileMountContext + + init(_ state: CreatedState, process: LinuxProcess) { + self.vm = state.vm + self.relayManager = state.relayManager + self.process = process + self.vendedProcesses = [:] + self.fileMountContext = state.fileMountContext + } + + init(_ state: PausedState) { + self.vm = state.vm + self.relayManager = state.relayManager + self.process = state.process + self.vendedProcesses = state.vendedProcesses + self.fileMountContext = state.fileMountContext + } + } + + struct PausedState: Sendable { + let vm: any VirtualMachineInstance + let relayManager: UnixSocketRelayManager + let process: LinuxProcess + var vendedProcesses: [String: LinuxProcess] + let fileMountContext: FileMountContext + + init(_ state: StartedState) { + self.vm = state.vm + self.relayManager = state.relayManager + self.process = state.process + self.vendedProcesses = state.vendedProcesses + self.fileMountContext = state.fileMountContext + } + } + + func createdState(_ operation: String) throws -> CreatedState { + switch self { + case .created(let state): + return state + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "failed to \(operation): container must be created" + ) + } + } + + func startedState(_ operation: String) throws -> StartedState { + switch self { + case .started(let state): + return state + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "failed to \(operation): container must be running" + ) + } + } + + func pausedState(_ operation: String) throws -> PausedState { + switch self { + case .paused(let state): + return state + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "failed to \(operation): container must be paused" + ) + } + } + + mutating func validateForCreate() throws { + switch self { + case .initialized, .stopped: + break + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "container must be in initialized or stopped state to create" + ) + } + } + + mutating func setErrored(error: Swift.Error) { + self = .errored(error) + } + + func vm(_ operation: String) throws -> any VirtualMachineInstance { + switch self { + case .created(let state): + return state.vm + case .started(let state): + return state.vm + case .paused(let state): + return state.vm + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "failed to \(operation): container must be created, running, or paused" + ) + } + } + } + + private let vmm: VirtualMachineManager + private let logger: Logger? + + /// Create a new `LinuxContainer`. + /// + /// - Parameters: + /// - id: The identifier for the container. + /// - rootfs: The root filesystem mount containing the container image contents. + /// The `destination` field is ignored as mounting is handled internally. + /// - writableLayer: Optional writable layer mount. When provided, an overlayfs is used with + /// rootfs as the lower layer and this as the upper layer. Must be a block device. + /// The `destination` field is ignored as mounting is handled internally. + /// - vmm: The virtual machine manager that will handle launching the VM for the container. + /// - logger: Optional logger for container operations. + /// - configuration: A closure that configures the container by modifying the Configuration instance. + public convenience init( + _ id: String, + rootfs: Mount, + writableLayer: Mount? = nil, + vmm: VirtualMachineManager, + logger: Logger? = nil, + configuration: (inout Configuration) throws -> Void + ) throws { + var config = Configuration() + try configuration(&config) + try self.init( + id, + rootfs: rootfs, + writableLayer: writableLayer, + vmm: vmm, + configuration: config, + logger: logger + ) + } + + /// Create a new `LinuxContainer`. + /// + /// - Parameters: + /// - id: The identifier for the container. + /// - rootfs: The root filesystem mount containing the container image contents. + /// The `destination` field is ignored as mounting is handled internally. + /// - writableLayer: Optional writable layer mount. When provided, an overlayfs is used with + /// rootfs as the lower layer and this as the upper layer. Must be a block device. + /// The `destination` field is ignored as mounting is handled internally. + /// - vmm: The virtual machine manager that will handle launching the VM for the container. + /// - configuration: The container configuration specifying process, resources, networking, and other settings. + /// - logger: Optional logger for container operations. + public init( + _ id: String, + rootfs: Mount, + writableLayer: Mount? = nil, + vmm: VirtualMachineManager, + configuration: LinuxContainer.Configuration, + logger: Logger? = nil + ) throws { + guard id.count <= Self.maxIDLength else { + throw ContainerizationError( + .invalidArgument, + message: "container id length \(id.count) exceeds maximum of \(Self.maxIDLength) characters" + ) + } + if let writableLayer { + guard writableLayer.isBlock else { + throw ContainerizationError( + .invalidArgument, + message: "writableLayer must be a block device" + ) + } + } + self.id = id + self.vmm = vmm + self.hostVsockPorts = Atomic(0x1000_0000) + self.guestVsockPorts = Atomic(0x1000_0000) + self.logger = logger + self.config = configuration + self.state = AsyncMutex(.initialized) + self.rootfs = rootfs + self.writableLayer = writableLayer + } + + private static func createDefaultRuntimeSpec(_ id: String) -> Spec { + .init( + process: .init(), + hostname: id, + root: .init( + path: Self.guestRootfsPath(id), + readonly: false + ), + linux: .init( + resources: .init(), + cgroupsPath: "/container/\(id)" + ) + ) + } + + private func generateRuntimeSpec() -> Spec { + var spec = Self.createDefaultRuntimeSpec(id) + + // Process toggles. + spec.process = config.process.toOCI() + + // Wrap with init process if requested. + if config.useInit { + let originalArgs = spec.process?.args ?? [] + spec.process?.args = ["/.cz-init", "--"] + originalArgs + } + + // General toggles. + if let hostname = config.hostname { + spec.hostname = hostname + } + + // Linux toggles. + spec.linux?.sysctl = config.sysctl + spec.linux?.maskedPaths = config.maskedPaths + spec.linux?.readonlyPaths = config.readonlyPaths + + // If the rootfs was requested as read-only, set it in the OCI spec. + // We let the OCI runtime remount as ro, instead of doing it originally. + // However, if we have a writable layer, the overlay allows writes so we don't mark it read-only. + spec.root?.readonly = self.rootfs.options.contains("ro") && self.writableLayer == nil + + // Resource limits. + // CPU: quota/period model where period is 100ms (100,000µs) and quota is cpus * period + // Memory: limit in bytes + spec.linux?.resources = LinuxResources( + memory: LinuxMemory( + limit: Int64(config.memoryInBytes) + ), + cpu: LinuxCPU( + quota: Int64(config.cpus * 100_000), + period: 100_000 + ) + ) + + spec.linux?.namespaces = [ + LinuxNamespace(type: .cgroup), + LinuxNamespace(type: .ipc), + LinuxNamespace(type: .mount), + LinuxNamespace(type: .pid), + LinuxNamespace(type: .uts), + ] + + return spec + } + + /// The default set of mounts for a LinuxContainer. + public static func defaultMounts() -> [Mount] { + let defaultOptions = ["nosuid", "noexec", "nodev"] + return [ + .any(type: "proc", source: "proc", destination: "/proc"), + .any(type: "sysfs", source: "sysfs", destination: "/sys", options: defaultOptions), + .any(type: "devtmpfs", source: "none", destination: "/dev", options: ["nosuid", "mode=755"]), + .any(type: "mqueue", source: "mqueue", destination: "/dev/mqueue", options: defaultOptions), + .any(type: "tmpfs", source: "tmpfs", destination: "/dev/shm", options: defaultOptions + ["mode=1777", "size=65536k"]), + .any(type: "cgroup2", source: "none", destination: "/sys/fs/cgroup", options: defaultOptions), + .any(type: "devpts", source: "devpts", destination: "/dev/pts", options: ["nosuid", "noexec", "newinstance", "gid=5", "mode=0620", "ptmxmode=0666"]), + ] + } + + /// The default set of paths to mask inside a container, matching the OCI + /// runtime spec defaults that runc and other production runtimes apply. + /// Each path is hidden from the workload (replaced by `/dev/null` for files + /// or an empty tmpfs for directories) by `vmexec` after `pivot_root`. + /// + /// Applied by default (see ``Configuration/maskedPaths``); set + /// `config.maskedPaths = []` to opt out, or append to extend the set. + public static func defaultMaskedPaths() -> [String] { + [ + "/proc/asound", + "/proc/acpi", + "/proc/kcore", + "/proc/keys", + "/proc/latency_stats", + "/proc/timer_list", + "/proc/timer_stats", + "/proc/sched_debug", + "/proc/scsi", + "/sys/firmware", + "/sys/devices/virtual/powercap", + ] + } + + /// The default set of paths to mark read-only inside a container, matching + /// the OCI runtime spec defaults that runc and other production runtimes apply. + /// + /// Applied by default (see ``Configuration/readonlyPaths``); set + /// `config.readonlyPaths = []` to opt out, or append to extend the set. + public static func defaultReadonlyPaths() -> [String] { + [ + "/proc/bus", + "/proc/fs", + "/proc/irq", + "/proc/sys", + "/proc/sysrq-trigger", + ] + } + + /// A more traditional default set of mounts that OCI runtimes typically employ. + public static func defaultOCIMounts() -> [Mount] { + let defaultOptions = ["nosuid", "noexec", "nodev"] + return [ + .any(type: "proc", source: "proc", destination: "/proc"), + .any(type: "tmpfs", source: "tmpfs", destination: "/dev", options: ["nosuid", "mode=755", "size=65536k"]), + .any(type: "devpts", source: "devpts", destination: "/dev/pts", options: ["nosuid", "noexec", "newinstance", "gid=5", "mode=0620", "ptmxmode=0666"]), + .any(type: "sysfs", source: "sysfs", destination: "/sys", options: defaultOptions), + .any(type: "mqueue", source: "mqueue", destination: "/dev/mqueue", options: defaultOptions), + .any(type: "tmpfs", source: "tmpfs", destination: "/dev/shm", options: defaultOptions + ["mode=1777", "size=65536k"]), + .any(type: "cgroup2", source: "none", destination: "/sys/fs/cgroup", options: defaultOptions), + ] + } + + private static func guestRootfsPath(_ id: String) -> String { + "/run/container/\(id)/rootfs" + } + + private static func guestSocketStagingPath(_ socketID: String) -> String { + "/run/sockets/\(socketID).sock" + } +} + +extension LinuxContainer { + package var root: String { + Self.guestRootfsPath(id) + } + + /// Number of CPU cores allocated. + public var cpus: Int { + config.cpus + } + + /// Amount of memory in bytes allocated for the container. + /// This will be aligned to a 1MB boundary if it isn't already. + public var memoryInBytes: UInt64 { + config.memoryInBytes + } + + /// Network interfaces of the container. + public var interfaces: [any Interface] { + config.interfaces + } + + private func mountRootfs( + attachments: [AttachedFilesystem], + rootfsPath: String, + agent: VirtualMachineAgent + ) async throws { + guard let rootfsAttachment = attachments.first else { + throw ContainerizationError(.notFound, message: "rootfs mount not found") + } + + if self.writableLayer != nil { + // Set up overlayfs with image as lower layer and writable layer as upper. + guard attachments.count >= 2 else { + throw ContainerizationError( + .notFound, + message: "writable layer mount not found" + ) + } + let writableAttachment = attachments[1] + + let lowerPath = "/run/container/\(self.id)/lower" + let upperMountPath = "/run/container/\(self.id)/upper" + let upperPath = "/run/container/\(self.id)/upper/diff" + let workPath = "/run/container/\(self.id)/upper/work" + + // Mount the image (lower layer) as read-only. + var lowerMount = rootfsAttachment.to + lowerMount.destination = lowerPath + if !lowerMount.options.contains("ro") { + lowerMount.options.append("ro") + } + try await agent.mount(lowerMount) + + // Mount the writable layer. + var upperMount = writableAttachment.to + upperMount.destination = upperMountPath + try await agent.mount(upperMount) + + // Create the upper and work directories inside the writable layer. + try await agent.mkdir(path: upperPath, all: true, perms: 0o755) + try await agent.mkdir(path: workPath, all: true, perms: 0o755) + + // Mount the overlay. + let overlayMount = ContainerizationOCI.Mount( + type: "overlay", + source: "overlay", + destination: rootfsPath, + options: [ + "lowerdir=\(lowerPath)", + "upperdir=\(upperPath)", + "workdir=\(workPath)", + ] + ) + try await agent.mount(overlayMount) + } else { + // No writable layer. Mount rootfs directly. + var rootfs = rootfsAttachment.to + rootfs.destination = rootfsPath + try await agent.mount(rootfs) + } + } + + /// Create and start the underlying container's virtual machine + /// and set up the runtime environment. The container's init process + /// is NOT running afterwards. + public func create() async throws { + try await self.state.withLock { state in + try state.validateForCreate() + + // This is a bit of an annoyance, but because the type we use for the rootfs is simply + // the same Mount type we use for non-rootfs mounts, it's possible someone passed 'ro' + // in the options (which should be perfectly valid). However, the problem is when we go to + // setup /etc/hosts and /etc/resolv.conf, as we'd get EROFS if they did supply 'ro'. + // To remedy this, remove any "ro" options before passing to VZ. Having the OCI runtime + // remount "ro" (which is what we do later in the guest) is truthfully the right thing, + // but this bit here is just a tad awkward. + var modifiedRootfs = self.rootfs + modifiedRootfs.options.removeAll(where: { $0 == "ro" }) + + let vmMemory = self.memoryInBytes + self.config.memoryOverhead + + let vmCpus = self.cpus + self.config.cpuOverhead + + // Prepare file mounts. This transforms single-file mounts into directory shares. + let fileMountContext = try FileMountContext.prepare(mounts: self.config.mounts) + // This is dumb, but alas. + let fileMountContextHolder = Mutex(fileMountContext) + + // Build the list of mounts to attach to the VM. + var containerMounts = [modifiedRootfs] + fileMountContext.transformedMounts + if let writableLayer = self.writableLayer { + containerMounts.insert(writableLayer, at: 1) + } + + let vmConfig = VMConfiguration( + cpus: vmCpus, + memoryInBytes: vmMemory, + interfaces: self.interfaces, + mountsByID: [self.id: containerMounts], + bootLog: self.config.bootLog, + nestedVirtualization: self.config.virtualization + ) + let creationConfig = StandardVMConfig(configuration: vmConfig) + let vm = try await self.vmm.create(config: creationConfig) + let relayManager = UnixSocketRelayManager(vm: vm, log: self.logger) + + try await vm.start() + do { + let mountsForAgent = containerMounts + try await vm.withAgent { agent in + try await agent.standardSetup() + + // Mount the unified virtiofs share at /run/virtiofs only + // when at least one of the container's mounts is virtiofs + // — the bind-mount transform below derives its sources + // from /run/virtiofs/{tag}, so the unified share is only + // load-bearing when there are virtiofs mounts. The macOS + // VZ backend always exposes the virtiofs device (even + // with zero shares), but the cloud-hypervisor backend + // only spawns virtiofsd when shares exist; mounting an + // unbacked tag fails with EINVAL. + let hasVirtiofsMount = mountsForAgent.contains { mount in + if case .virtiofs = mount.runtimeOptions { return true } + return false + } + if hasVirtiofsMount { + // VZ exposes ONE virtio-fs device with tag "virtiofs" + // and multiple sources as subdirs (VZMultipleDirectoryShare). + // The CH backend exposes one device per source-hash + // tag instead, so the guest must mount each tag + // separately at /run/virtiofs/. The bind-mount + // transform below uses /run/virtiofs/ in both + // cases, so this branch is only about how /run/virtiofs + // gets populated. + if vm.virtiofsLayout == .perTag { + try await agent.mkdir(path: "/run/virtiofs", all: true, perms: 0o755) + let virtiofsAttachments = (vm.mounts[self.id] ?? []).filter { $0.type == "virtiofs" } + let uniqueTags = Set(virtiofsAttachments.map(\.source)) + for tag in uniqueTags { + let dest = "/run/virtiofs/\(tag)" + try await agent.mkdir(path: dest, all: true, perms: 0o755) + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: tag, + destination: dest, + options: [] + )) + } + } else { + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: "virtiofs", + destination: "/run/virtiofs", + options: [] + )) + } + } + + guard let attachments = vm.mounts[self.id] else { + throw ContainerizationError(.notFound, message: "rootfs mount not found") + } + let rootfsPath = Self.guestRootfsPath(self.id) + try await self.mountRootfs(attachments: attachments, rootfsPath: rootfsPath, agent: agent) + + // Mount file mount holding directories under /run. + if fileMountContext.hasFileMounts { + let containerMounts = vm.mounts[self.id] ?? [] + var ctx = fileMountContextHolder.withLock { $0 } + try await ctx.mountHoldingDirectories( + vmMounts: containerMounts, + agent: agent + ) + fileMountContextHolder.withLock { $0 = ctx } + } + + // Start up our friendly unix socket relays. + for socket in self.config.sockets { + try await self.relayUnixSocket( + socket: socket, + relayManager: relayManager, + agent: agent + ) + } + + // For every interface asked for: + // 1. Add the address requested + // 2. Online the adapter + // 3. For the first interface, add the default route + var defaultRouteSet = false + for (index, i) in self.interfaces.enumerated() { + let name = "eth\(index)" + try await agent.setupInterface( + i, + name: name, + setDefaultRoute: !defaultRouteSet, + logger: self.logger + ) + defaultRouteSet = true + } + + // Setup /etc/resolv.conf and /etc/hosts if asked for. + if let dns = self.config.dns { + try await agent.configureDNS(config: dns, location: rootfsPath) + } + if let hosts = self.config.hosts { + try await agent.configureHosts(config: hosts, location: rootfsPath) + } + + } + state = .created(.init(vm: vm, relayManager: relayManager, fileMountContext: fileMountContextHolder.withLock { $0 })) + } catch { + try? await relayManager.stopAll() + try? await vm.stop() + state.setErrored(error: error) + throw error + } + } + } + + /// Start the container's initial process. + public func start() async throws { + try await self.state.withLock { state in + let createdState = try state.createdState("start") + + let agent = try await createdState.vm.dialAgent() + do { + var spec = self.generateRuntimeSpec() + // We don't need the rootfs (or writable layer), nor do OCI runtimes want it included. + // Also filter out file mount holding directories. We'll mount those separately under /run. + // Transform virtiofs mounts to bind mounts from /run/virtiofs/{tag} + let containerMounts = createdState.vm.mounts[self.id] ?? [] + let holdingTags = createdState.fileMountContext.holdingDirectoryTags + // Drop rootfs, and writable layer if present. + let mountsToSkip = self.writableLayer != nil ? 2 : 1 + var mounts: [ContainerizationOCI.Mount] = + containerMounts.dropFirst(mountsToSkip) + .filter { !holdingTags.contains($0.source) } + .map { attached -> ContainerizationOCI.Mount in + if attached.type == "virtiofs" { + // Transform to bind mount from holding directory + return ContainerizationOCI.Mount( + type: "none", + source: "/run/virtiofs/\(attached.source)", + destination: attached.destination, + options: ["bind"] + attached.options + ) + } + return attached.to + } + + createdState.fileMountContext.ociBindMounts() + + // When useInit is enabled, bind mount vminitd from the VM's filesystem + // into the container so it can be executed. + if self.config.useInit { + mounts.append( + ContainerizationOCI.Mount( + type: "bind", + source: "/sbin/vminitd", + destination: "/.cz-init", + options: ["bind", "ro"] + )) + } + + // Bind mount staged sockets into the container. Sockets relayed + // .into the container are created in a staging directory outside + // the rootfs to avoid symlink traversal and mount shadowing. + for socket in self.config.sockets where socket.direction == .into { + mounts.append( + ContainerizationOCI.Mount( + type: "bind", + source: Self.guestSocketStagingPath(socket.id), + destination: socket.destination.path, + options: ["bind"] + )) + } + + spec.mounts = cleanAndSortMounts(mounts) + + let stdio = IOUtil.setup( + portAllocator: self.hostVsockPorts, + stdin: self.config.process.stdin, + stdout: self.config.process.stdout, + stderr: self.config.process.stderr + ) + + let process = LinuxProcess( + self.id, + containerID: self.id, + spec: spec, + io: stdio, + ociRuntimePath: self.config.ociRuntimePath, + agent: agent, + vm: createdState.vm, + logger: self.logger + ) + try await process.start() + + state = .started(.init(createdState, process: process)) + } catch { + try? await agent.close() + try? await createdState.vm.stop() + state.setErrored(error: error) + throw error + } + } + } + + /// Stop the container from executing. This MUST be called even if wait() has returned + /// as their are additional resources to free. + public func stop() async throws { + try await self.state.withLock { state in + // Allow stop to be called multiple times. + if case .stopped = state { + return + } + + let vm: any VirtualMachineInstance + let relayManager: UnixSocketRelayManager + + let startedState = try? state.startedState("stop") + if let startedState { + vm = startedState.vm + relayManager = startedState.relayManager + } else { + let createdState = try state.createdState("stop") + vm = createdState.vm + relayManager = createdState.relayManager + } + + var firstError: Error? + do { + try await relayManager.stopAll() + } catch { + self.logger?.error("failed to stop relay manager: \(error)") + firstError = firstError ?? error + } + + do { + try await vm.withAgent { agent in + // First, we need to stop any unix socket relays as this will + // keep the rootfs from being able to umount (EBUSY). + let sockets = self.config.sockets + if !sockets.isEmpty { + guard let relayAgent = agent as? SocketRelayAgent else { + throw ContainerizationError( + .unsupported, + message: "VirtualMachineAgent does not support relaySocket surface" + ) + } + for socket in sockets { + try await relayAgent.stopSocketRelay(configuration: socket) + } + } + + if let _ = startedState { + // Now lets ensure every process is donezo. + try await agent.kill(pid: -1, signal: SIGKILL) + + // Wait on init proc exit. Give it 5 seconds of leeway. + _ = try await agent.waitProcess( + id: self.id, + containerID: self.id, + timeoutInSeconds: 5 + ) + } + + // Today, we leave EBUSY looping and other fun logic up to the + // guest agent. + try await agent.umount( + path: Self.guestRootfsPath(self.id), + flags: 0 + ) + + // If we have a writable layer, we also need to unmount the lower and upper layers. + if self.writableLayer != nil { + let upperPath = "/run/container/\(self.id)/upper" + let lowerPath = "/run/container/\(self.id)/lower" + try await agent.umount(path: upperPath, flags: 0) + try await agent.umount(path: lowerPath, flags: 0) + } + + try await agent.sync() + } + } catch { + self.logger?.error("failed during guest cleanup: \(error)") + firstError = firstError ?? error + } + + if let startedState { + for process in startedState.vendedProcesses.values { + do { + try await process._delete() + } catch { + self.logger?.error("failed to delete process \(process.id): \(error)") + firstError = firstError ?? error + } + } + + do { + try await startedState.process.delete() + } catch { + self.logger?.error("failed to delete init process: \(error)") + firstError = firstError ?? error + } + } + + do { + try await vm.stop() + state = .stopped + if let firstError { + throw firstError + } + } catch { + self.logger?.error("failed to stop VM: \(error)") + let finalError = firstError ?? error + state.setErrored(error: finalError) + throw finalError + } + } + } + + /// Send a signal to the container. + public func kill(_ signal: Signal) async throws { + try await self.state.withLock { + let state = try $0.startedState("kill") + try await state.process.kill(signal) + } + } + + /// Wait for the container to exit. Returns the exit code. + @discardableResult + public func wait(timeoutInSeconds: Int64? = nil) async throws -> ExitStatus { + let t = try await self.state.withLock { + let state = try $0.startedState("wait") + let t = Task { + try await state.process.wait(timeoutInSeconds: timeoutInSeconds) + } + return t + } + return try await t.value + } + + /// Resize the container's terminal (if one was requested). This + /// will error if terminal was set to false before creating the container. + public func resize(to: Terminal.Size) async throws { + try await self.state.withLock { + let state = try $0.startedState("resize") + try await state.process.resize(to: to) + } + } + + /// Execute a new process in the container. The process is not started after this call, and must be manually started + /// via the `start` method. + public func exec(_ id: String, configuration: @Sendable @escaping (inout LinuxProcessConfiguration) throws -> Void) async throws -> LinuxProcess { + try await self.state.withLock { state in + var startedState = try state.startedState("exec") + + var spec = self.generateRuntimeSpec() + var config = LinuxProcessConfiguration() + try configuration(&config) + spec.process = config.toOCI() + + let stdio = IOUtil.setup( + portAllocator: self.hostVsockPorts, + stdin: config.stdin, + stdout: config.stdout, + stderr: config.stderr + ) + let agent = try await startedState.vm.dialAgent() + let process = LinuxProcess( + id, + containerID: self.id, + spec: spec, + io: stdio, + ociRuntimePath: self.config.ociRuntimePath, + agent: agent, + vm: startedState.vm, + logger: self.logger, + onDelete: { [weak self = self] in + await self?.removeProcess(id: id) + } + ) + + startedState.vendedProcesses[id] = process + state = .started(startedState) + + return process + } + } + + /// Execute a new process in the container. The process is not started after this call, and must be manually started + /// via the `start` method. + public func exec(_ id: String, configuration: LinuxProcessConfiguration) async throws -> LinuxProcess { + try await self.state.withLock { + var state = try $0.startedState("exec") + + var spec = self.generateRuntimeSpec() + spec.process = configuration.toOCI() + + let stdio = IOUtil.setup( + portAllocator: self.hostVsockPorts, + stdin: configuration.stdin, + stdout: configuration.stdout, + stderr: configuration.stderr + ) + let agent = try await state.vm.dialAgent() + let process = LinuxProcess( + id, + containerID: self.id, + spec: spec, + io: stdio, + ociRuntimePath: self.config.ociRuntimePath, + agent: agent, + vm: state.vm, + logger: self.logger, + onDelete: { [weak self = self] in + await self?.removeProcess(id: id) + } + ) + + state.vendedProcesses[id] = process + $0 = .started(state) + + return process + } + } + + /// Dial a vsock port in the container. + public func dialVsock(port: UInt32) async throws -> FileHandle { + try await self.state.withLock { + let state = try $0.startedState("dialVsock") + return try await state.vm.dial(port) + } + } + + /// Provides scoped access to the underlying virtual machine instance. + /// + /// Most users should prefer the higher level APIs on ``LinuxContainer`` + /// directly. This is intended for advanced use cases that need to interact + /// with the virtual machine outside of the container abstraction. + public func withVirtualMachineInstance( + _ fn: @Sendable (any VirtualMachineInstance) async throws -> T + ) async throws -> T { + let vm = try await self.state.withLock { state in + try state.vm("withVirtualMachineInstance") + } + return try await fn(vm) + } + + /// Close the containers standard input to signal no more input is + /// arriving. + public func closeStdin() async throws { + try await self.state.withLock { + let state = try $0.startedState("closeStdin") + return try await state.process.closeStdin() + } + } + + /// Remove a process from the vended processes tracking. + private func removeProcess(id: String) async { + await self.state.withLock { + guard case .started(var state) = $0 else { + return + } + state.vendedProcesses.removeValue(forKey: id) + $0 = .started(state) + } + } + + /// Get statistics for the container. + public func statistics(categories: StatCategory = .all) async throws -> ContainerStatistics { + try await self.state.withLock { + let state = try $0.startedState("statistics") + + let stats = try await state.vm.withAgent { agent in + let allStats = try await agent.containerStatistics(containerIDs: [self.id], categories: categories) + guard let containerStats = allStats.first else { + throw ContainerizationError( + .notFound, + message: "statistics for container \(self.id) not found" + ) + } + return containerStats + } + + return stats + } + } + + // Perform filesystem operations in the container. + public func filesystemOperation(operation: FilesystemOperation, path: String) async throws { + try await self.state.withLock { + let state = try $0.startedState("filesystemOperation") + try await state.vm.withAgent { agent in + guard let vminitd = agent as? Vminitd else { + throw ContainerizationError(.unsupported, message: "filesystemOperation requires Vminitd agent") + } + let guestPath = URL(filePath: Self.guestRootfsPath(self.id)).appending(path: path).path + try await vminitd.filesystemOperation(operation: operation, path: guestPath) + } + } + } + + private func relayUnixSocket( + socket: UnixSocketConfiguration, + relayManager: UnixSocketRelayManager, + agent: any VirtualMachineAgent + ) async throws { + guard let relayAgent = agent as? SocketRelayAgent else { + throw ContainerizationError( + .unsupported, + message: "VirtualMachineAgent does not support relaySocket surface" + ) + } + + var socket = socket + let rootInGuest = URL(filePath: self.root) + + let port: UInt32 + if socket.direction == .into { + port = self.hostVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + socket.destination = URL(filePath: Self.guestSocketStagingPath(socket.id)) + } else { + port = self.guestVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + socket.source = rootInGuest.appending(path: socket.source.path) + } + + try await relayManager.start(port: port, socket: socket) + try await relayAgent.relaySocket(port: port, configuration: socket) + } + + /// Default chunk size for file transfers (1MiB). + public static let defaultCopyChunkSize = 1024 * 1024 + + /// Copy a file or directory from the host into the container. + /// + /// Data transfer happens over a dedicated vsock connection. For directories, + /// the source is archived as tar+gzip and streamed directly through vsock + /// without intermediate temp files. + public func copyIn( + from source: URL, + to destination: URL, + mode: UInt32 = 0o644, + createParents: Bool = true, + chunkSize: Int = defaultCopyChunkSize + ) async throws { + try await self.state.withLock { + let state = try $0.startedState("copyIn") + + var isDirectory: ObjCBool = false + guard FileManager.default.fileExists(atPath: source.path, isDirectory: &isDirectory) else { + throw ContainerizationError(.notFound, message: "copyIn: source not found '\(source.path)'") + } + let isArchive = isDirectory.boolValue + + let guestPath: URL = try await state.vm.withAgent { agent in + guard let vminitd = agent as? Vminitd else { + throw ContainerizationError(.unsupported, message: "copyIn requires Vminitd agent") + } + + return try await self.resolveCopyInGuestPath( + from: source, + to: destination, + sourceIsDirectory: isArchive, + using: vminitd + ) + } + + let port = self.hostVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + let listener = try state.vm.listen(port) + + try await withThrowingTaskGroup(of: Void.self) { group in + group.addTask { + try await state.vm.withAgent { agent in + guard let vminitd = agent as? Vminitd else { + throw ContainerizationError(.unsupported, message: "copyIn requires Vminitd agent") + } + try await vminitd.copy( + direction: .copyIn, + guestPath: guestPath, + vsockPort: port, + mode: mode, + createParents: createParents, + isArchive: isArchive + ) + } + } + + group.addTask { + guard let conn = await listener.first(where: { _ in true }) else { + throw ContainerizationError(.internalError, message: "copyIn: vsock connection not established") + } + try listener.finish() + + try await withCheckedThrowingContinuation { (continuation: CheckedContinuation) in + self.copyQueue.async { + do { + defer { conn.closeFile() } + + if isArchive { + let writer = try ArchiveWriter(configuration: .init(format: .pax, filter: .gzip)) + try writer.open(fileDescriptor: conn.fileDescriptor) + try writer.archiveDirectory(source) + try writer.finishEncoding() + } else { + let srcFd = open(source.path, O_RDONLY) + guard srcFd != -1 else { + throw ContainerizationError( + .internalError, + message: "copyIn: failed to open '\(source.path)': \(String(cString: strerror(errno)))" + ) + } + defer { close(srcFd) } + + var buf = [UInt8](repeating: 0, count: chunkSize) + while true { + let n = read(srcFd, &buf, buf.count) + if n == 0 { break } + guard n > 0 else { + throw ContainerizationError( + .internalError, + message: "copyIn: read error: \(String(cString: strerror(errno)))" + ) + } + var written = 0 + while written < n { + let w = buf.withUnsafeBytes { ptr in + write(conn.fileDescriptor, ptr.baseAddress! + written, n - written) + } + guard w > 0 else { + throw ContainerizationError( + .internalError, + message: "copyIn: vsock write error: \(String(cString: strerror(errno)))" + ) + } + written += w + } + } + } + continuation.resume() + } catch { + continuation.resume(throwing: error) + } + } + } + } + + try await group.waitForAll() + } + } + } + + private func resolveCopyInGuestPath( + from source: URL, + to destination: URL, + sourceIsDirectory: Bool, + using vminitd: Vminitd + ) async throws -> URL { + let guestDestination = URL(filePath: self.root).appending(path: destination.path) + + let stat: ContainerizationOS.Stat? + do { + stat = try await vminitd.stat(path: guestDestination) + } catch let error as ContainerizationError where error.code == .notFound { + stat = nil + } + // Any other error propagates so transport and permission failures are visible. + + guard let stat else { + if destination.hasDirectoryPath && !sourceIsDirectory { + throw ContainerizationError( + .invalidArgument, + message: "destination directory does not exist: \(destination.path)" + ) + } + return guestDestination + } + + let destinationIsDirectory = (stat.mode & UInt32(S_IFMT)) == UInt32(S_IFDIR) + guard destinationIsDirectory else { + if sourceIsDirectory { + throw ContainerizationError( + .invalidArgument, + message: "cannot copy directory over existing file: \(destination.path)" + ) + } + return guestDestination + } + + return guestDestination.appendingPathComponent(source.lastPathComponent) + } + + /// Copy a file or directory from the container to the host. + /// + /// Data transfer happens over a dedicated vsock connection. For directories, + /// the guest archives the source as tar+gzip and streams it directly through + /// vsock. The host extracts the archive without intermediate temp files. + public func copyOut( + from source: URL, + to destination: URL, + createParents: Bool = true, + chunkSize: Int = defaultCopyChunkSize + ) async throws { + try await self.state.withLock { + let state = try $0.startedState("copyOut") + + if createParents { + let parentDir = destination.deletingLastPathComponent() + try FileManager.default.createDirectory(at: parentDir, withIntermediateDirectories: true) + } + + let guestPath = URL(filePath: self.root).appending(path: source.path) + let port = self.hostVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + let listener = try state.vm.listen(port) + + let (metadataStream, metadataCont) = AsyncStream.makeStream(of: Vminitd.CopyMetadata.self) + + try await withThrowingTaskGroup(of: Void.self) { group in + group.addTask { + try await state.vm.withAgent { agent in + guard let vminitd = agent as? Vminitd else { + throw ContainerizationError(.unsupported, message: "copyOut requires Vminitd agent") + } + try await vminitd.copy( + direction: .copyOut, + guestPath: guestPath, + vsockPort: port, + onMetadata: { meta in + metadataCont.yield(meta) + metadataCont.finish() + } + ) + } + } + + group.addTask { + guard let metadata = await metadataStream.first(where: { _ in true }) else { + throw ContainerizationError(.internalError, message: "copyOut: no metadata received") + } + + guard let conn = await listener.first(where: { _ in true }) else { + throw ContainerizationError(.internalError, message: "copyOut: vsock connection not established") + } + try listener.finish() + + try await withCheckedThrowingContinuation { (continuation: CheckedContinuation) in + self.copyQueue.async { + do { + defer { conn.closeFile() } + + if metadata.isArchive { + try FileManager.default.createDirectory(at: destination, withIntermediateDirectories: true) + let fh = FileHandle(fileDescriptor: dup(conn.fileDescriptor), closeOnDealloc: true) + let reader = try ArchiveReader(format: .pax, filter: .gzip, fileHandle: fh) + _ = try reader.extractContents(to: destination) + } else { + let destFd = open(destination.path, O_WRONLY | O_CREAT | O_TRUNC, 0o644) + guard destFd != -1 else { + throw ContainerizationError( + .internalError, + message: "copyOut: failed to open '\(destination.path)': \(String(cString: strerror(errno)))" + ) + } + defer { close(destFd) } + + var buf = [UInt8](repeating: 0, count: chunkSize) + while true { + let n = read(conn.fileDescriptor, &buf, buf.count) + if n == 0 { break } + guard n > 0 else { + throw ContainerizationError( + .internalError, + message: "copyOut: vsock read error: \(String(cString: strerror(errno)))" + ) + } + var written = 0 + while written < n { + let w = buf.withUnsafeBytes { ptr in + write(destFd, ptr.baseAddress! + written, n - written) + } + guard w > 0 else { + throw ContainerizationError( + .internalError, + message: "copyOut: write error: \(String(cString: strerror(errno)))" + ) + } + written += w + } + } + } + continuation.resume() + } catch { + continuation.resume(throwing: error) + } + } + } + } + + try await group.waitForAll() + } + } + } +} + +extension VirtualMachineInstance { + /// Scoped access to an agent instance to ensure the resources are always freed (mostly close(2)'ing + /// the vsock fd) + func withAgent(fn: @Sendable (VirtualMachineAgent) async throws -> T) async throws -> T { + let agent = try await self.dialAgent() + do { + let result = try await fn(agent) + try await agent.close() + return result + } catch { + try? await agent.close() + throw error + } + } +} + +extension AttachedFilesystem { + var to: ContainerizationOCI.Mount { + .init( + type: self.type, + source: self.source, + destination: self.destination, + options: self.options + ) + } +} + +/// Normalize mount destinations via ``FilePath/lexicallyNormalized()`` and +/// sort mounts by the depth of their destination path. This ensures that +/// higher level mounts don't shadow other mounts. For example, if a user +/// specifies mounts for `/tmp/foo/bar` and `/tmp`, sorting by depth ensures +/// `/tmp` is mounted first without shadowing `/tmp/foo/bar`. +func cleanAndSortMounts(_ mounts: [ContainerizationOCI.Mount]) -> [ContainerizationOCI.Mount] { + var mounts = mounts + for i in mounts.indices { + mounts[i].destination = FilePath(mounts[i].destination).lexicallyNormalized().string + } + return sortMountsByDestinationDepth(mounts) +} + +/// Sort mounts by the depth of their destination path. +func sortMountsByDestinationDepth(_ mounts: [ContainerizationOCI.Mount]) -> [ContainerizationOCI.Mount] { + mounts.sorted { a, b in + a.destination.split(separator: "/").count < b.destination.split(separator: "/").count + } +} + +struct IOUtil { + static func setup( + portAllocator: borrowing Atomic, + stdin: ReaderStream?, + stdout: Writer?, + stderr: Writer? + ) -> LinuxProcess.Stdio { + var stdinSetup: LinuxProcess.StdioReaderSetup? = nil + if let reader = stdin { + let ret = portAllocator.wrappingAdd(1, ordering: .relaxed) + stdinSetup = .init( + port: ret.oldValue, + reader: reader + ) + } + + var stdoutSetup: LinuxProcess.StdioSetup? = nil + if let writer = stdout { + let ret = portAllocator.wrappingAdd(1, ordering: .relaxed) + stdoutSetup = LinuxProcess.StdioSetup( + port: ret.oldValue, + writer: writer + ) + } + + var stderrSetup: LinuxProcess.StdioSetup? = nil + if let writer = stderr { + let ret = portAllocator.wrappingAdd(1, ordering: .relaxed) + stderrSetup = LinuxProcess.StdioSetup( + port: ret.oldValue, + writer: writer + ) + } + + return LinuxProcess.Stdio( + stdin: stdinSetup, + stdout: stdoutSetup, + stderr: stderrSetup + ) + } +} diff --git a/Sources/Containerization/LinuxPod.swift b/Sources/Containerization/LinuxPod.swift new file mode 100644 index 0000000..8ad0014 --- /dev/null +++ b/Sources/Containerization/LinuxPod.swift @@ -0,0 +1,1335 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation +import Logging +import Synchronization + +import struct ContainerizationOS.Terminal + +/// NOTE: Experimental API +/// +/// `LinuxPod` allows managing multiple Linux containers within a single +/// virtual machine. Each container has its own rootfs and process, but +/// shares the VM's resources (CPU, memory, network). +public final class LinuxPod: Sendable { + static let maxIDLength = 64 + + /// The identifier of the pod. + public let id: String + + /// Configuration for the pod. + public let config: Configuration + + /// The configuration for the LinuxPod. + public struct Configuration: Sendable { + /// The amount of cpus for the pod's VM. + public var cpus: Int = 4 + /// The memory in bytes to give to the pod's VM. + public var memoryInBytes: UInt64 = 1024.mib() + /// The network interfaces for the pod. + public var interfaces: [any Interface] = [] + /// Whether nested virtualization should be turned on for the pod. + public var virtualization: Bool = false + /// Optional file path to store serial boot logs. + public var bootLog: BootLog? + /// Whether containers in the pod should share a PID namespace. + /// When enabled, all containers can see each other's processes. + public var shareProcessNamespace: Bool = false + /// The default hostname for all containers in the pod. + /// Individual containers can override this by setting their own `hostname` configuration. + public var hostname: String? + /// The default DNS configuration for all containers in the pod. + /// Individual containers can override this by setting their own `dns` configuration. + public var dns: DNS? + /// The default hosts file configuration for all containers in the pod. + /// Individual containers can override this by setting their own `hosts` configuration. + public var hosts: Hosts? + /// Volumes attached to the pod. Can be shared with multiple containers. + public var volumes: [PodVolume] = [] + /// Extension objects that participate in the VM instance lifecycle. + public var extensions: [any Sendable] = [] + + public init() {} + } + + /// Configuration for a container within the pod. + public struct ContainerConfiguration: Sendable { + /// Configuration for the init process of the container. + public var process = LinuxProcessConfiguration() + /// Optional per-container CPU limit (can exceed pod total for oversubscription). + public var cpus: Int? + /// Optional per-container memory limit in bytes (can exceed pod total for oversubscription). + public var memoryInBytes: UInt64? + /// The hostname for the container. + public var hostname: String? + /// The system control options for the container. + public var sysctl: [String: String] = [:] + /// The mounts for the container. + public var mounts: [Mount] = LinuxContainer.defaultMounts() + /// Paths inside the container that vmexec hides from the workload. + /// Defaults to the OCI standard set (``LinuxContainer/defaultMaskedPaths()``), + /// matching the restricted capability baseline. Set to `[]` to opt out, + /// or append to extend it. + public var maskedPaths: [String] = LinuxContainer.defaultMaskedPaths() + /// Paths inside the container that vmexec marks read-only. + /// Defaults to the OCI standard set (``LinuxContainer/defaultReadonlyPaths()``), + /// matching the restricted capability baseline. Set to `[]` to opt out, + /// or append to extend it. + public var readonlyPaths: [String] = LinuxContainer.defaultReadonlyPaths() + /// The Unix domain socket relays to setup for the container. + public var sockets: [UnixSocketConfiguration] = [] + /// The DNS configuration for the container. + public var dns: DNS? + /// The hosts file configuration for the container. + public var hosts: Hosts? + /// Run the container with a minimal init process that handles signal + /// forwarding and zombie reaping. + public var useInit: Bool = false + + public init() {} + } + + /// A volume that is attached at the pod level and can be shared by multiple containers. + public struct PodVolume: Sendable { + /// Describes the backing storage for the volume. + public enum Source: Sendable { + /// A network block device (NBD) volume. + case nbd(url: URL, timeout: TimeInterval? = nil, readOnly: Bool = false) + /// A disk-image file on the host, attached as a virtio-block device. + case diskImage(path: URL, readOnly: Bool = false) + } + + /// The logical name of this volume. Containers reference this name + /// via `Mount.sharedMount(name:destination:)` in their mounts. + public var name: String + /// The backing storage source for this volume. + public var source: Source + /// The filesystem format on the volume. + public var format: String + + public init(name: String, source: Source, format: String) { + self.name = name + self.source = source + self.format = format + } + + func toMount() -> Mount { + switch source { + case .nbd(let url, let timeout, let readOnly): + var runtimeOptions: [String] = [] + if let timeout { + runtimeOptions.append("vzTimeout=\(timeout)") + } + return Mount.block( + format: self.format, + source: url.absoluteString, + destination: LinuxPod.guestVolumePath(name), + options: readOnly ? ["ro"] : [], + runtimeOptions: runtimeOptions + ) + case .diskImage(let path, let readOnly): + return Mount.block( + format: self.format, + source: path.absolutePath(), + destination: LinuxPod.guestVolumePath(name), + options: readOnly ? ["ro"] : [] + ) + } + } + } + + private struct PodContainer: Sendable { + let id: String + let rootfs: Mount + let config: ContainerConfiguration + var state: ContainerState + var process: LinuxProcess? + var fileMountContext: FileMountContext + + enum ContainerState: Sendable { + case registered + case created + case started + case stopped + case errored + } + } + + private let state: AsyncMutex + + // Ports to be allocated from for stdio and for + // unix socket relays that are sharing a guest + // uds to the host. + private let hostVsockPorts: Atomic + // Ports we request the guest to allocate for unix socket relays from + // the host. + private let guestVsockPorts: Atomic + + private struct State: Sendable { + var phase: Phase + var containers: [String: PodContainer] + var pauseProcess: LinuxProcess? + } + + private enum Phase: Sendable { + /// The pod has been created but no live resources are running. + case initialized + /// The pod's virtual machine has been setup and the runtime environment has been configured. + case created(CreatedState) + /// An error occurred during the lifetime of this class. + case errored(Swift.Error) + + struct CreatedState: Sendable { + let vm: any VirtualMachineInstance + let relayManager: UnixSocketRelayManager + } + + func createdState(_ operation: String) throws -> CreatedState { + switch self { + case .created(let state): + return state + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "failed to \(operation): pod must be created" + ) + } + } + + mutating func validateForCreate() throws { + switch self { + case .initialized: + break + case .errored(let err): + throw err + default: + throw ContainerizationError( + .invalidState, + message: "pod must be in initialized state to create" + ) + } + } + + mutating func setErrored(error: Swift.Error) { + self = .errored(error) + } + } + + private let vmm: VirtualMachineManager + private let logger: Logger? + + /// Create a new `LinuxPod`. A `VirtualMachineManager` instance must be + /// provided that will handle launching the virtual machine the containers + /// will execute inside of. + public init( + _ id: String, + vmm: VirtualMachineManager, + logger: Logger? = nil, + configuration: (inout Configuration) throws -> Void + ) throws { + guard id.count <= Self.maxIDLength else { + throw ContainerizationError( + .invalidArgument, + message: "pod id length \(id.count) exceeds maximum of \(Self.maxIDLength) characters" + ) + } + self.id = id + self.vmm = vmm + self.hostVsockPorts = Atomic(0x1000_0000) + self.guestVsockPorts = Atomic(0x1000_0000) + self.logger = logger + + var config = Configuration() + try configuration(&config) + + self.config = config + self.state = AsyncMutex(State(phase: .initialized, containers: [:], pauseProcess: nil)) + } + + private static func createDefaultRuntimeSpec(_ containerID: String, podID: String) -> Spec { + .init( + process: .init(), + hostname: containerID, + root: .init( + path: Self.guestRootfsPath(containerID), + readonly: false + ), + linux: .init( + resources: .init(), + cgroupsPath: "/container/pod/\(podID)/\(containerID)" + ) + ) + } + + private func generateRuntimeSpec(containerID: String, config: ContainerConfiguration, rootfs: Mount) -> Spec { + var spec = Self.createDefaultRuntimeSpec(containerID, podID: self.id) + + // Process configuration + spec.process = config.process.toOCI() + + // Wrap with init process if requested. + if config.useInit { + let originalArgs = spec.process?.args ?? [] + spec.process?.args = ["/.cz-init", "--"] + originalArgs + } + + // General toggles + // Container-level hostname takes precedence; fall back to pod-level hostname. + if let hostname = config.hostname ?? self.config.hostname { + spec.hostname = hostname + } + + // Linux toggles + spec.linux?.sysctl = config.sysctl + spec.linux?.maskedPaths = config.maskedPaths + spec.linux?.readonlyPaths = config.readonlyPaths + + // If the rootfs was requested as read-only, set it in the OCI spec. + // We let the OCI runtime remount as ro, instead of doing it originally. + spec.root?.readonly = rootfs.options.contains("ro") + + // Resource limits (if specified) + if let cpus = config.cpus, cpus > 0 { + spec.linux?.resources?.cpu = LinuxCPU( + quota: Int64(cpus * 100_000), + period: 100_000 + ) + } + if let memoryInBytes = config.memoryInBytes, memoryInBytes > 0 { + spec.linux?.resources?.memory = LinuxMemory( + limit: Int64(memoryInBytes) + ) + } + + return spec + } + + static func guestRootfsPath(_ containerID: String) -> String { + "/run/container/\(containerID)/rootfs" + } + + static func guestSocketStagingPath(_ socketID: String) -> String { + "/run/sockets/\(socketID).sock" + } + + private static func guestVolumePath(_ volumeName: String) -> String { + "/run/volumes/\(volumeName)" + } +} + +extension LinuxPod { + /// Number of CPU cores allocated to the pod's VM. + public var cpus: Int { + config.cpus + } + + /// Amount of memory in bytes allocated for the pod's VM. + public var memoryInBytes: UInt64 { + config.memoryInBytes + } + + /// Network interfaces of the pod. + public var interfaces: [any Interface] { + config.interfaces + } + + /// Add a container to the pod. + /// + /// When called before `create()`, the container is registered for setup during VM creation. + /// When called after `create()`, the container is hotplugged into the running VM. + /// If the underlying VMM does not support hotplug, an error is thrown. + public func addContainer( + _ id: String, + rootfs: Mount, + configuration: @Sendable @escaping (inout ContainerConfiguration) throws -> Void + ) async throws { + guard id.count <= Self.maxIDLength else { + throw ContainerizationError( + .invalidArgument, + message: "container id length \(id.count) exceeds maximum of \(Self.maxIDLength) characters" + ) + } + try await self.state.withLock { state in + guard state.containers[id] == nil else { + throw ContainerizationError( + .invalidArgument, + message: "container with id \(id) already exists in pod" + ) + } + + var config = ContainerConfiguration() + try configuration(&config) + + let fileMountContext = try FileMountContext.prepare(mounts: config.mounts) + + switch state.phase { + case .initialized: + state.containers[id] = PodContainer( + id: id, + rootfs: rootfs, + config: config, + state: .registered, + process: nil, + fileMountContext: fileMountContext + ) + + case .created(let createdState): + let vm = createdState.vm + + var modifiedRootfs = rootfs + modifiedRootfs.options.removeAll(where: { $0 == "ro" }) + + let attachment = try await vm.hotplug(modifiedRootfs, id: id) + + var updatedFileMountContext = fileMountContext + do { + let virtioFSMounts = fileMountContext.transformedMounts.filter { + if case .virtiofs(_) = $0.runtimeOptions { return true } + return false + } + if !virtioFSMounts.isEmpty { + try await vm.hotplugVirtioFS(virtioFSMounts, id: id) + } + + let agent = try await vm.dialAgent() + do { + var mount = attachment.to + mount.destination = Self.guestRootfsPath(id) + try await agent.mount(mount) + + try vm.registerMounts( + id: id, + rootfs: attachment, + additionalMounts: fileMountContext.transformedMounts + ) + + // Mount the hotplugged container's virtiofs shares in the + // guest. create() does this for boot-time containers (the + // /run/virtiofs loop); the hotplug path must do the same or + // the container's bind mounts from /run/virtiofs/ fail + // with ENOENT. + let newVirtiofsTags = (vm.mounts[id] ?? []) + .filter { $0.type == "virtiofs" } + .map { $0.source } + if !newVirtiofsTags.isEmpty { + // Tags already mounted in the guest at boot or by a + // prior hotplug (i.e. present on another container). + let alreadyMounted = Set( + vm.mounts + .filter { $0.key != id } + .values.flatMap { $0 } + .filter { $0.type == "virtiofs" } + .map { $0.source } + ) + try await agent.mkdir(path: "/run/virtiofs", all: true, perms: 0o755) + if vm.virtiofsLayout == .perTag { + var seen: Set = [] + for tag in newVirtiofsTags + where !alreadyMounted.contains(tag) && seen.insert(tag).inserted { + let dest = "/run/virtiofs/\(tag)" + try await agent.mkdir(path: dest, all: true, perms: 0o755) + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: tag, + destination: dest, + options: [] + )) + } + } else if alreadyMounted.isEmpty { + // Unified layout: one /run/virtiofs mount, needed + // only if nothing mounted it at boot / earlier. + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: "virtiofs", + destination: "/run/virtiofs", + options: [] + )) + } + } + + if fileMountContext.hasFileMounts { + let containerMounts = vm.mounts[id] ?? [] + try await updatedFileMountContext.mountHoldingDirectories( + vmMounts: containerMounts, + agent: agent + ) + } + + if let dns = config.dns ?? self.config.dns { + try await agent.configureDNS( + config: dns, + location: Self.guestRootfsPath(id) + ) + } + + if let hosts = config.hosts ?? self.config.hosts { + try await agent.configureHosts( + config: hosts, + location: Self.guestRootfsPath(id) + ) + } + + for socket in config.sockets { + try await self.relayUnixSocket( + socket: socket, + containerID: id, + relayManager: createdState.relayManager, + agent: agent + ) + } + + try await agent.close() + } catch { + try? await agent.umount(path: Self.guestRootfsPath(id), flags: 0) + try? await agent.close() + throw error + } + + state.containers[id] = PodContainer( + id: id, + rootfs: rootfs, + config: config, + state: .created, + process: nil, + fileMountContext: updatedFileMountContext + ) + } catch { + try? await vm.releaseHotplug(id: id) + try? await vm.releaseVirtioFS(id: id) + throw error + } + + case .errored(let err): + throw err + } + } + } + + /// Create and start the underlying pod's virtual machine and set up + /// the runtime environment. All registered containers will have their + /// rootfs mounted, but no init processes will be running. + public func create() async throws { + try await self.state.withLock { state in + try state.phase.validateForCreate() + + // Build mountsByID for all containers. + // Strip "ro" from rootfs options - we handle readonly via the OCI spec's + // root.readonly field and remount in vmexec after setup is complete. + // Use transformedMounts from fileMountContext (file mounts become directory shares). + var mountsByID: [String: [Mount]] = [:] + for (id, container) in state.containers { + var modifiedRootfs = container.rootfs + modifiedRootfs.options.removeAll(where: { $0 == "ro" }) + // Filter out shared mounts — those are handled separately as pod volume bind mounts. + let containerMounts = container.fileMountContext.transformedMounts.filter { + if case .shared = $0.runtimeOptions { return false } + return true + } + mountsByID[id] = [modifiedRootfs] + containerMounts + } + + // Validate pod volume names are unique. + var volumeNames = Set() + for volume in self.config.volumes { + guard volumeNames.insert(volume.name).inserted else { + throw ContainerizationError( + .invalidArgument, + message: "duplicate pod volume name \"\(volume.name)\"" + ) + } + } + + // Validate that all shared mounts reference valid pod volume names. + for (id, container) in state.containers { + for mount in container.config.mounts { + if case .shared = mount.runtimeOptions { + guard volumeNames.contains(mount.source) else { + throw ContainerizationError( + .invalidArgument, + message: "container \(id) references unknown pod volume \"\(mount.source)\"" + ) + } + } + } + } + let podVolumeMounts = self.config.volumes.map { $0.toMount() } + if !podVolumeMounts.isEmpty { + mountsByID[self.id] = podVolumeMounts + } + + // Capture into an immutable `let` so the value is safely usable + // from the concurrent `withAgent` closure below. The container + // path makes the same decision in LinuxContainer.create — CH + // only attaches a virtiofs device when shares are configured, + // so mounting an unbacked /run/virtiofs would fail with EINVAL + // on the CH backend. + let hasVirtiofsMount = mountsByID.values.contains { mounts in + mounts.contains { mount in + if case .virtiofs = mount.runtimeOptions { return true } + return false + } + } + + var vmConfig = VMConfiguration( + cpus: self.config.cpus, + memoryInBytes: self.config.memoryInBytes, + interfaces: self.config.interfaces, + mountsByID: mountsByID, + bootLog: self.config.bootLog, + nestedVirtualization: self.config.virtualization + ) + vmConfig.extensions = self.config.extensions + let creationConfig = StandardVMConfig(configuration: vmConfig) + let vm = try await self.vmm.create(config: creationConfig) + let relayManager = UnixSocketRelayManager(vm: vm) + try await vm.start() + + do { + let containers = state.containers + let shareProcessNamespace = self.config.shareProcessNamespace + let pauseProcessHolder = Mutex(nil) + let fileMountContextUpdates = Mutex<[String: FileMountContext]>([:]) + + try await vm.withAgent { agent in + try await agent.standardSetup() + + // Mount the unified virtiofs share at /run/virtiofs only + // when at least one container has a virtiofs mount. VZ + // tolerates the unbacked mount; CH does not. + if hasVirtiofsMount { + try await agent.mkdir(path: "/run/virtiofs", all: true, perms: 0o755) + if vm.virtiofsLayout == .perTag { + // CH backend: one virtio-fs device per source-hash + // tag, so mount each tag separately at + // /run/virtiofs/. See LinuxContainer for the + // VZ vs. CH model split. + var seenTags: Set = [] + for (_, attached) in vm.mounts { + for entry in attached where entry.type == "virtiofs" { + guard seenTags.insert(entry.source).inserted else { continue } + let dest = "/run/virtiofs/\(entry.source)" + try await agent.mkdir(path: dest, all: true, perms: 0o755) + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: entry.source, + destination: dest, + options: [] + )) + } + } + } else { + try await agent.mount( + ContainerizationOCI.Mount( + type: "virtiofs", + source: "virtiofs", + destination: "/run/virtiofs", + options: [] + )) + } + } + + // Create pause container if PID namespace sharing is enabled + if shareProcessNamespace { + let pauseID = "pause-\(self.id)" + let pauseRootfsPath = "/run/container/\(pauseID)/rootfs" + + // Bind mount /sbin into the pause container rootfs. + // This is where the guest agent lives. + try await agent.mount( + ContainerizationOCI.Mount( + type: "", + source: "/sbin", + destination: "\(pauseRootfsPath)/sbin", + options: ["bind"] + )) + + var pauseSpec = Self.createDefaultRuntimeSpec(pauseID, podID: self.id) + pauseSpec.process?.args = ["/sbin/vminitd", "pause"] + pauseSpec.hostname = "" + pauseSpec.mounts = LinuxContainer.defaultMounts().map { + ContainerizationOCI.Mount( + type: $0.type, + source: $0.source, + destination: $0.destination, + options: $0.options + ) + } + pauseSpec.linux?.namespaces = [ + LinuxNamespace(type: .cgroup), + LinuxNamespace(type: .ipc), + LinuxNamespace(type: .mount), + LinuxNamespace(type: .pid), + LinuxNamespace(type: .uts), + ] + + // Create LinuxProcess for pause container + let process = LinuxProcess( + pauseID, + containerID: pauseID, + spec: pauseSpec, + io: LinuxProcess.Stdio(stdin: nil, stdout: nil, stderr: nil), + ociRuntimePath: nil, + agent: agent, + vm: vm, + logger: self.logger + ) + + try await process.start() + pauseProcessHolder.withLock { $0 = process } + + self.logger?.debug("Pause container started", metadata: ["pid": "\(process.pid)"]) + } + + // Mount all container rootfs + for (_, container) in containers { + guard let attachments = vm.mounts[container.id], let rootfsAttachment = attachments.first else { + throw ContainerizationError(.notFound, message: "rootfs mount not found for container \(container.id)") + } + var rootfs = rootfsAttachment.to + rootfs.destination = Self.guestRootfsPath(container.id) + try await agent.mount(rootfs) + } + + // Mount file mount holding directories under /run for each container. + for (id, container) in containers { + if container.fileMountContext.hasFileMounts { + var ctx = container.fileMountContext + let containerMounts = vm.mounts[id] ?? [] + try await ctx.mountHoldingDirectories( + vmMounts: containerMounts, + agent: agent + ) + fileMountContextUpdates.withLock { $0[id] = ctx } + } + } + + // Mount pod-level volumes. + let podVolumeAttachments = vm.mounts[self.id] ?? [] + for (index, volume) in self.config.volumes.enumerated() { + guard index < podVolumeAttachments.count else { + throw ContainerizationError( + .notFound, + message: "attached filesystem not found for pod volume \"\(volume.name)\"" + ) + } + let attachment = podVolumeAttachments[index] + let guestPath = Self.guestVolumePath(volume.name) + try await agent.mount( + ContainerizationOCI.Mount( + type: volume.format, + source: attachment.source, + destination: guestPath, + options: [] + )) + } + + // Start up unix socket relays for each container + for (_, container) in containers { + for socket in container.config.sockets { + try await self.relayUnixSocket( + socket: socket, + containerID: container.id, + relayManager: relayManager, + agent: agent + ) + } + } + + // For every interface asked for: + // 1. Add the address requested + // 2. Online the adapter + // 3. For the first interface, add the default route + var defaultRouteSet = false + for (index, i) in self.interfaces.enumerated() { + let name = "eth\(index)" + try await agent.setupInterface( + i, + name: name, + setDefaultRoute: !defaultRouteSet, + logger: self.logger + ) + defaultRouteSet = true + } + + // Setup /etc/resolv.conf and /etc/hosts for each container. + // Container-level config takes precedence over pod-level config. + for (_, container) in containers { + if let dns = container.config.dns ?? self.config.dns { + try await agent.configureDNS( + config: dns, + location: Self.guestRootfsPath(container.id) + ) + } + if let hosts = container.config.hosts ?? self.config.hosts { + try await agent.configureHosts( + config: hosts, + location: Self.guestRootfsPath(container.id) + ) + } + } + } + + state.pauseProcess = pauseProcessHolder.withLock { $0 } + + // Apply file mount context updates. + let updates = fileMountContextUpdates.withLock { $0 } + for (id, ctx) in updates { + state.containers[id]?.fileMountContext = ctx + } + + // Transition all containers to created state + for id in state.containers.keys { + state.containers[id]?.state = .created + } + + state.phase = .created(.init(vm: vm, relayManager: relayManager)) + } catch { + try? await relayManager.stopAll() + try? await vm.stop() + state.phase.setErrored(error: error) + throw error + } + } + } + + /// Start a container's initial process. + public func startContainer(_ containerID: String) async throws { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("startContainer") + + guard var container = state.containers[containerID] else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found in pod" + ) + } + + guard container.state == .created else { + throw ContainerizationError( + .invalidState, + message: "container \(containerID) must be in created state to start" + ) + } + + let agent = try await createdState.vm.dialAgent() + do { + var spec = self.generateRuntimeSpec(containerID: containerID, config: container.config, rootfs: container.rootfs) + // We don't need the rootfs, nor do OCI runtimes want it included. + // Also filter out file mount holding directories - we mount those separately under /run. + // Transform virtiofs mounts to bind mounts from /run/virtiofs/{tag} + let containerMounts = createdState.vm.mounts[containerID] ?? [] + let holdingTags = container.fileMountContext.holdingDirectoryTags + var mounts: [ContainerizationOCI.Mount] = + containerMounts.dropFirst() + .filter { !holdingTags.contains($0.source) } + .map { attached -> ContainerizationOCI.Mount in + if attached.type == "virtiofs" { + // Transform to bind mount from holding directory + return ContainerizationOCI.Mount( + type: "none", + source: "/run/virtiofs/\(attached.source)", + destination: attached.destination, + options: ["bind"] + attached.options + ) + } + return attached.to + } + + container.fileMountContext.ociBindMounts() + + // When useInit is enabled, bind mount vminitd from the VM's filesystem + // into the container so it can be executed. + if container.config.useInit { + mounts.append( + ContainerizationOCI.Mount( + type: "bind", + source: "/sbin/vminitd", + destination: "/.cz-init", + options: ["bind", "ro"] + )) + } + + // Bind mount staged sockets into the container. Sockets relayed + // .into the container are created in a staging directory outside + // the rootfs to avoid symlink traversal and mount shadowing. + for socket in container.config.sockets where socket.direction == .into { + mounts.append( + ContainerizationOCI.Mount( + type: "bind", + source: Self.guestSocketStagingPath(socket.id), + destination: socket.destination.path, + options: ["bind"] + )) + } + + // Bind mount pod volumes into the container. + for mount in container.config.mounts { + if case .shared = mount.runtimeOptions { + mounts.append( + ContainerizationOCI.Mount( + type: "none", + source: Self.guestVolumePath(mount.source), + destination: mount.destination, + options: ["bind"] + mount.options + )) + } + } + + spec.mounts = cleanAndSortMounts(mounts) + + // Configure namespaces for the container + var namespaces: [LinuxNamespace] = [ + LinuxNamespace(type: .cgroup), + LinuxNamespace(type: .ipc), + LinuxNamespace(type: .mount), + LinuxNamespace(type: .uts), + ] + + // Either join pause container's pid ns or create a new one + if self.config.shareProcessNamespace, let pausePID = state.pauseProcess?.pid { + let nsPath = "/proc/\(pausePID)/ns/pid" + + self.logger?.debug( + "Container joining pause PID namespace", + metadata: [ + "container": "\(containerID)", + "pausePID": "\(pausePID)", + "nsPath": "\(nsPath)", + ]) + + namespaces.append(LinuxNamespace(type: .pid, path: nsPath)) + } else { + namespaces.append(LinuxNamespace(type: .pid)) + } + + spec.linux?.namespaces = namespaces + + let stdio = IOUtil.setup( + portAllocator: self.hostVsockPorts, + stdin: container.config.process.stdin, + stdout: container.config.process.stdout, + stderr: container.config.process.stderr + ) + + let process = LinuxProcess( + containerID, + containerID: containerID, + spec: spec, + io: stdio, + ociRuntimePath: nil, + agent: agent, + vm: createdState.vm, + logger: self.logger + ) + try await process.start() + + container.process = process + container.state = .started + state.containers[containerID] = container + } catch { + try? await agent.close() + throw error + } + } + } + + /// Stop a container from executing. + public func stopContainer(_ containerID: String) async throws { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("stopContainer") + + guard var container = state.containers[containerID] else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found in pod" + ) + } + + // Allow stop to be called multiple times + if container.state == .stopped { + return + } + + // Handle containers that were hotplugged but never started + if container.state == .created { + // Release the hotplug device and virtiofs shares + try? await createdState.vm.releaseHotplug(id: containerID) + try? await createdState.vm.releaseVirtioFS(id: containerID) + + container.state = .stopped + state.containers[containerID] = container + return + } + + guard container.state == .started, let process = container.process else { + throw ContainerizationError( + .invalidState, + message: "container \(containerID) must be in started state to stop" + ) + } + + do { + // Check if the vm is even still running + if createdState.vm.state == .stopped { + container.state = .stopped + state.containers[containerID] = container + return + } + + try await process.kill(.kill) + try await process.wait(timeoutInSeconds: 3) + + try await createdState.vm.withAgent { agent in + // Unmount the rootfs + try await agent.umount( + path: Self.guestRootfsPath(containerID), + flags: 0 + ) + } + + // Release the hotplug device and virtiofs shares so they can be reused by new containers + try await createdState.vm.releaseHotplug(id: containerID) + try await createdState.vm.releaseVirtioFS(id: containerID) + + // Clean up the process resources + try await process.delete() + + container.process = nil + container.state = .stopped + state.containers[containerID] = container + } catch { + // Try to release the hotplug device and virtiofs shares even on error + try? await createdState.vm.releaseHotplug(id: containerID) + try? await createdState.vm.releaseVirtioFS(id: containerID) + + container.state = .errored + container.process = nil + state.containers[containerID] = container + + throw error + } + } + } + + /// Stop the pod's VM and all containers. + public func stop() async throws { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("stop") + + do { + try await createdState.relayManager.stopAll() + + // Stop all containers + let containerIDs = Array(state.containers.keys) + + for containerID in containerIDs { + // Stop the container inline + guard var container = state.containers[containerID] else { + continue + } + + if container.state == .stopped { + continue + } + + if let process = container.process, container.state == .started { + if createdState.vm.state != .stopped { + try? await process.kill(.kill) + _ = try? await process.wait(timeoutInSeconds: 3) + + try? await createdState.vm.withAgent { agent in + try await agent.umount( + path: Self.guestRootfsPath(containerID), + flags: 0 + ) + } + } + + try? await process.delete() + container.process = nil + container.state = .stopped + + state.containers[containerID] = container + } + } + + // Unmount pod-level volumes. + if createdState.vm.state != .stopped && !self.config.volumes.isEmpty { + try? await createdState.vm.withAgent { agent in + for volume in self.config.volumes { + try? await agent.umount( + path: Self.guestVolumePath(volume.name), + flags: 0 + ) + } + } + } + + try await createdState.vm.stop() + state.phase = .initialized + } catch { + try? await createdState.vm.stop() + state.phase.setErrored(error: error) + throw error + } + } + } + + /// Send a signal to a container. + public func killContainer(_ containerID: String, signal: Signal) async throws { + try await self.state.withLock { state in + guard let container = state.containers[containerID], let process = container.process else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found or not started" + ) + } + try await process.kill(signal) + } + } + + /// Wait for a container to exit. Returns the exit code. + @discardableResult + public func waitContainer(_ containerID: String, timeoutInSeconds: Int64? = nil) async throws -> ExitStatus { + let process = try await self.state.withLock { state in + guard let container = state.containers[containerID], let process = container.process else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found or not started" + ) + } + return process + } + return try await process.wait(timeoutInSeconds: timeoutInSeconds) + } + + /// Resize a container's terminal (if one was requested). + public func resizeContainer(_ containerID: String, to: Terminal.Size) async throws { + try await self.state.withLock { state in + guard let container = state.containers[containerID], let process = container.process else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found or not started" + ) + } + try await process.resize(to: to) + } + } + + /// Execute a new process in a container. + public func execInContainer( + _ containerID: String, + processID: String, + configuration: @Sendable @escaping (inout LinuxProcessConfiguration) throws -> Void + ) async throws -> LinuxProcess { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("execInContainer") + + guard let container = state.containers[containerID] else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found in pod" + ) + } + + guard container.state == .started else { + throw ContainerizationError( + .invalidState, + message: "container \(containerID) must be started to exec" + ) + } + + var spec = self.generateRuntimeSpec(containerID: containerID, config: container.config, rootfs: container.rootfs) + // Inherit environment variables, working directory, user, capabilities, rlimits from container process. + // Reset: process arguments, terminal, stdio as these are not supposed to be inherited. + var config = container.config.process + config.arguments = [] + config.terminal = false + config.stdin = nil + config.stdout = nil + config.stderr = nil + try configuration(&config) + spec.process = config.toOCI() + + let stdio = IOUtil.setup( + portAllocator: self.hostVsockPorts, + stdin: config.stdin, + stdout: config.stdout, + stderr: config.stderr + ) + let agent = try await createdState.vm.dialAgent() + let process = LinuxProcess( + processID, + containerID: containerID, + spec: spec, + io: stdio, + ociRuntimePath: nil, + agent: agent, + vm: createdState.vm, + logger: self.logger + ) + return process + } + } + + /// List all container IDs in the pod. + public func listContainers() async -> [String] { + await self.state.withLock { state in + Array(state.containers.keys) + } + } + + /// Get statistics for containers in the pod. + public func statistics(containerIDs: [String]? = nil, categories: StatCategory = .all) async throws -> [ContainerStatistics] { + let (createdState, ids) = try await self.state.withLock { state in + let createdState = try state.phase.createdState("statistics") + let ids = containerIDs ?? Array(state.containers.keys) + return (createdState, ids) + } + + let stats = try await createdState.vm.withAgent { agent in + try await agent.containerStatistics(containerIDs: ids, categories: categories) + } + + return stats + } + + /// Dial a vsock port in the pod's VM. + public func dialVsock(port: UInt32) async throws -> FileHandle { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("dialVsock") + return try await createdState.vm.dial(port) + } + } + + /// Provides scoped access to the underlying virtual machine instance. + /// + /// Most users should prefer the higher level APIs on ``LinuxPod`` + /// directly. This is intended for advanced use cases that need to interact + /// with the virtual machine outside of the pod abstraction. + public func withVirtualMachineInstance( + _ fn: @Sendable (any VirtualMachineInstance) async throws -> T + ) async throws -> T { + let vm = try await self.state.withLock { state in + try state.phase.createdState("withVirtualMachineInstance").vm + } + return try await fn(vm) + } + + // Perform filesystem operations in a container. + public func filesystemOperation(_ containerID: String, operation: FilesystemOperation, path: String) async throws { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("filesystemOperation") + + guard let container = state.containers[containerID] else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found in pod" + ) + } + + guard container.state == .started else { + throw ContainerizationError( + .invalidState, + message: "container \(containerID) must be started to perform filesystem operations" + ) + } + + try await createdState.vm.withAgent { agent in + guard let vminitd = agent as? Vminitd else { + throw ContainerizationError(.unsupported, message: "filesystemOperation requires Vminitd agent") + } + let guestPath = URL(filePath: Self.guestRootfsPath(containerID)).appending(path: path).path + try await vminitd.filesystemOperation(operation: operation, path: guestPath) + } + } + } + + /// Close a container's standard input to signal no more input is arriving. + public func closeContainerStdin(_ containerID: String) async throws { + try await self.state.withLock { state in + guard let container = state.containers[containerID], let process = container.process else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found or not started" + ) + } + try await process.closeStdin() + } + } + + /// Relay a unix socket for a container. + public func relayUnixSocket(_ containerID: String, socket: UnixSocketConfiguration) async throws { + try await self.state.withLock { state in + let createdState = try state.phase.createdState("relayUnixSocket") + + guard let _ = state.containers[containerID] else { + throw ContainerizationError( + .notFound, + message: "container \(containerID) not found in pod" + ) + } + + try await createdState.vm.withAgent { agent in + try await self.relayUnixSocket( + socket: socket, + containerID: containerID, + relayManager: createdState.relayManager, + agent: agent + ) + } + } + } + + private func relayUnixSocket( + socket: UnixSocketConfiguration, + containerID: String, + relayManager: UnixSocketRelayManager, + agent: any VirtualMachineAgent + ) async throws { + guard let relayAgent = agent as? SocketRelayAgent else { + throw ContainerizationError( + .unsupported, + message: "VirtualMachineAgent does not support relaySocket surface" + ) + } + + var socket = socket + + // Adjust paths to be relative to the container's rootfs + let rootInGuest = URL(filePath: Self.guestRootfsPath(containerID)) + + let port: UInt32 + if socket.direction == .into { + port = self.hostVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + socket.destination = URL(filePath: Self.guestSocketStagingPath(socket.id)) + } else { + port = self.guestVsockPorts.wrappingAdd(1, ordering: .relaxed).oldValue + socket.source = rootInGuest.appending(path: socket.source.path) + } + + try await relayManager.start(port: port, socket: socket) + try await relayAgent.relaySocket(port: port, configuration: socket) + } +} diff --git a/Sources/Containerization/LinuxProcess.swift b/Sources/Containerization/LinuxProcess.swift new file mode 100644 index 0000000..4020ef8 --- /dev/null +++ b/Sources/Containerization/LinuxProcess.swift @@ -0,0 +1,485 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +/// `LinuxProcess` represents a Linux process and is used to +/// setup and control the full lifecycle for the process. +public final class LinuxProcess: Sendable { + /// The ID of the process. This is purely metadata for the caller. + public let id: String + + /// What container owns this process (if any). + public let owningContainer: String? + + package struct StdioSetup: Sendable { + let port: UInt32 + let writer: Writer + } + + package struct StdioReaderSetup { + let port: UInt32 + let reader: ReaderStream + } + + package struct Stdio: Sendable { + let stdin: StdioReaderSetup? + let stdout: StdioSetup? + let stderr: StdioSetup? + } + + private struct StdioHandles: Sendable { + var stdin: FileHandle? + var stdout: FileHandle? + var stderr: FileHandle? + + mutating func close() throws { + if let stdin { + try stdin.close() + stdin.readabilityHandler = nil + self.stdin = nil + } + if let stdout { + try stdout.close() + stdout.readabilityHandler = nil + self.stdout = nil + } + if let stderr { + try stderr.close() + stderr.readabilityHandler = nil + self.stderr = nil + } + } + } + + private struct State { + var spec: ContainerizationOCI.Spec + var pid: Int32 + var stdio: StdioHandles + var stdinRelay: Task<(), Never>? + var ioTracker: IoTracker? + var deletionTask: Task? + + struct IoTracker { + let stream: AsyncStream + let cont: AsyncStream.Continuation + let configuredStreams: Int + } + } + + /// The process ID for the container process. This will be -1 + /// if the process has not been started. + public var pid: Int32 { + state.withLock { $0.pid } + } + + private let state: Mutex + private let ioSetup: Stdio + private let agent: any VirtualMachineAgent + private let vm: any VirtualMachineInstance + private let ociRuntimePath: String? + private let logger: Logger? + private let onDelete: (@Sendable () async -> Void)? + + init( + _ id: String, + containerID: String? = nil, + spec: Spec, + io: Stdio, + ociRuntimePath: String?, + agent: any VirtualMachineAgent, + vm: any VirtualMachineInstance, + logger: Logger?, + onDelete: (@Sendable () async -> Void)? = nil + ) { + self.id = id + self.owningContainer = containerID + self.state = Mutex(.init(spec: spec, pid: -1, stdio: StdioHandles())) + self.ioSetup = io + self.agent = agent + self.ociRuntimePath = ociRuntimePath + self.vm = vm + self.logger = logger + self.onDelete = onDelete + } +} + +extension LinuxProcess { + func setupIO(listeners: [VsockListener?]) async throws -> [FileHandle?] { + // Nested virtualization (x86_64 CI) is dramatically slower to bring the + // guest vsock listeners up than native arm64 virt, so allow a longer + // window there while keeping the arm64 path tight. + #if arch(x86_64) + let ioTimeout: UInt32 = 30 + #else + let ioTimeout: UInt32 = 3 + #endif + let handles = try await Timeout.run(seconds: ioTimeout) { + try await withThrowingTaskGroup(of: (Int, FileHandle?).self) { group in + var results = [FileHandle?](repeating: nil, count: 3) + + for (index, listener) in listeners.enumerated() { + guard let listener else { continue } + + group.addTask { + let first = await listener.first(where: { _ in true }) + try listener.finish() + return (index, first) + } + } + + for try await (index, fileHandle) in group { + results[index] = fileHandle + } + return results + } + } + + // Note: stdin relay is started separately via startStdinRelay() after + // the process has started, to avoid a deadlock where closeStdin is + // called before the process is consuming from the pipe. + + var configuredStreams = 0 + let (stream, cc) = AsyncStream.makeStream() + if let stdout = self.ioSetup.stdout { + configuredStreams += 1 + handles[1]?.readabilityHandler = { handle in + do { + let data = handle.availableData + if data.isEmpty { + // This block is called when the producer (the guest) closes + // the fd it is writing into. + handles[1]?.readabilityHandler = nil + cc.yield() + return + } + try stdout.writer.write(data) + } catch { + self.logger?.error("failed to write to stdout: \(error)") + } + } + } + + if let stderr = self.ioSetup.stderr { + configuredStreams += 1 + handles[2]?.readabilityHandler = { handle in + do { + let data = handle.availableData + if data.isEmpty { + handles[2]?.readabilityHandler = nil + cc.yield() + return + } + try stderr.writer.write(data) + } catch { + self.logger?.error("failed to write to stderr: \(error)") + } + } + } + if configuredStreams > 0 { + self.state.withLock { + $0.ioTracker = .init(stream: stream, cont: cc, configuredStreams: configuredStreams) + } + } + + return handles + } + + func startStdinRelay(handle: FileHandle) { + guard let stdin = self.ioSetup.stdin else { return } + + self.state.withLock { + $0.stdinRelay = Task { + for await data in stdin.reader.stream() { + do { + try handle.write(contentsOf: data) + } catch { + self.logger?.error("failed to write to stdin: \(error)") + break + } + } + + do { + self.logger?.debug("stdin relay finished, closing") + + // There's two ways we can wind up here: + // + // 1. The stream finished on its own (e.g. we wrote all the + // data) and we will close the underlying stdin in the guest below. + // + // 2. The client explicitly called closeStdin() themselves + // which will cancel this relay task AFTER actually closing + // the fds. If the client did that, then this task will be + // cancelled, and the fds are already gone so there's nothing + // for us to do. + if Task.isCancelled { + return + } + + try await self._closeStdin() + } catch { + self.logger?.error("failed to close stdin: \(error)") + } + } + } + } + + /// Start the process. + public func start() async throws { + do { + let spec = self.state.withLock { $0.spec } + var listeners = [VsockListener?](repeating: nil, count: 3) + if let stdin = self.ioSetup.stdin { + listeners[0] = try self.vm.listen(stdin.port) + } + if let stdout = self.ioSetup.stdout { + listeners[1] = try self.vm.listen(stdout.port) + } + if let stderr = self.ioSetup.stderr { + if spec.process!.terminal { + throw ContainerizationError( + .invalidArgument, + message: "stderr should not be configured with terminal=true" + ) + } + listeners[2] = try self.vm.listen(stderr.port) + } + + let t = Task { + try await self.setupIO(listeners: listeners) + } + + try await agent.createProcess( + id: self.id, + containerID: self.owningContainer, + stdinPort: self.ioSetup.stdin?.port, + stdoutPort: self.ioSetup.stdout?.port, + stderrPort: self.ioSetup.stderr?.port, + ociRuntimePath: self.ociRuntimePath, + configuration: spec, + options: nil + ) + + let result = try await t.value + let pid = try await self.agent.startProcess( + id: self.id, + containerID: self.owningContainer + ) + + // Start stdin relay after process launch to avoid filling the pipe + // buffer before the process is even running. + if let stdinHandle = result[0] { + self.startStdinRelay(handle: stdinHandle) + } + + self.state.withLock { + $0.stdio = StdioHandles( + stdin: result[0], + stdout: result[1], + stderr: result[2] + ) + $0.pid = pid + } + } catch { + if let err = error as? ContainerizationError { + throw err + } + throw ContainerizationError( + .internalError, + message: "failed to start process", + cause: error, + ) + } + } + + /// Kill the process with the specified signal. + public func kill(_ signal: Signal) async throws { + do { + try await agent.signalProcess( + id: self.id, + containerID: self.owningContainer, + signal: signal.rawValue + ) + } catch { + throw ContainerizationError( + .internalError, + message: "failed to kill process", + cause: error + ) + } + } + + /// Resize the processes pty (if requested). + public func resize(to: Terminal.Size) async throws { + do { + try await agent.resizeProcess( + id: self.id, + containerID: self.owningContainer, + columns: UInt32(to.width), + rows: UInt32(to.height) + ) + } catch { + throw ContainerizationError( + .internalError, + message: "failed to resize process", + cause: error + ) + } + } + + public func closeStdin() async throws { + do { + try await self._closeStdin() + self.state.withLock { + $0.stdinRelay?.cancel() + } + } catch { + throw ContainerizationError( + .internalError, + message: "failed to close stdin", + cause: error, + ) + } + } + + func _closeStdin() async throws { + try await self.agent.closeProcessStdin( + id: self.id, + containerID: self.owningContainer + ) + } + + /// Wait on the process to exit with an optional timeout. Returns the exit code of the process. + @discardableResult + public func wait(timeoutInSeconds: Int64? = nil) async throws -> ExitStatus { + do { + let exitStatus = try await self.agent.waitProcess( + id: self.id, + containerID: self.owningContainer, + timeoutInSeconds: timeoutInSeconds + ) + await self.waitIoComplete() + return exitStatus + } catch { + if error is ContainerizationError { + throw error + } + throw ContainerizationError( + .internalError, + message: "failed to wait on process", + cause: error + ) + } + } + + /// Wait until the standard output and standard error streams for the process have concluded. + private func waitIoComplete() async { + let ioTracker = self.state.withLock { $0.ioTracker } + guard let ioTracker else { + return + } + do { + try await Timeout.run(seconds: 3) { + var counter = ioTracker.configuredStreams + for await _ in ioTracker.stream { + counter -= 1 + if counter == 0 { + ioTracker.cont.finish() + break + } + } + } + } catch { + self.logger?.error("timeout waiting for IO to complete for process \(id): \(error)") + } + self.state.withLock { + $0.ioTracker = nil + } + } + + /// Cleans up guest state and waits on and closes any host resources (stdio handles). + public func delete() async throws { + try await self._delete() + await self.onDelete?() + } + + func _delete() async throws { + let task = self.state.withLock { state in + if let existingTask = state.deletionTask { + // Deletion already in progress or finished. + return existingTask + } + + let task = Task { + try await self.performDeletion() + } + state.deletionTask = task + return task + } + + try await task.value + } + + private func performDeletion() async throws { + do { + try await self.agent.deleteProcess( + id: self.id, + containerID: self.owningContainer + ) + } catch { + self.state.withLock { + $0.stdinRelay?.cancel() + try? $0.stdio.close() + } + try? await self.agent.close() + throw ContainerizationError( + .internalError, + message: "failed to delete process", + cause: error, + ) + } + + do { + try self.state.withLock { + $0.stdinRelay?.cancel() + try $0.stdio.close() + } + } catch { + try? await self.agent.close() + throw ContainerizationError( + .internalError, + message: "failed to close stdio", + cause: error, + ) + } + + do { + try await self.agent.close() + } catch { + throw ContainerizationError( + .internalError, + message: "failed to close agent connection", + cause: error, + ) + } + } +} diff --git a/Sources/Containerization/LinuxProcessConfiguration.swift b/Sources/Containerization/LinuxProcessConfiguration.swift new file mode 100644 index 0000000..7a15ee0 --- /dev/null +++ b/Sources/Containerization/LinuxProcessConfiguration.swift @@ -0,0 +1,457 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS + +/// A resource limit (rlimit) configuration for a container process. +public struct LinuxRLimit: Sendable, Hashable { + /// The kind of resource limit. + public var kind: Kind + /// The hard limit value. + public var hard: UInt64 + /// The soft limit value. + public var soft: UInt64 + + /// Creates a new resource limit. + /// + /// - Parameters: + /// - kind: The kind of resource limit. + /// - hard: The hard limit value. + /// - soft: The soft limit value. + public init(kind: Kind, hard: UInt64, soft: UInt64) { + self.kind = kind + self.hard = hard + self.soft = soft + } + + /// Creates a new resource limit with the same value for both hard and soft limits. + /// + /// - Parameters: + /// - kind: The kind of resource limit. + /// - limit: The limit value for both hard and soft limits. + public init(kind: Kind, limit: UInt64) { + self.kind = kind + self.hard = limit + self.soft = limit + } + + /// Convert to OCI POSIXRlimit format for transport. + public func toOCI() -> POSIXRlimit { + POSIXRlimit(type: self.kind.description, hard: self.hard, soft: self.soft) + } +} + +extension LinuxRLimit { + /// The kind of resource limit. + public struct Kind: Sendable, Hashable { + private enum Value: Hashable, Sendable, CaseIterable { + case addressSpace + case coreFileSize + case cpuTime + case dataSize + case fileSize + case locks + case lockedMemory + case messageQueue + case nice + case openFiles + case numberOfProcesses + case residentSetSize + case realtimePriority + case realtimeTimeout + case signalsPending + case stackSize + } + + private var value: Value + private init(_ value: Value) { + self.value = value + } + + /// Maximum size of the process's virtual memory (address space) in bytes. + public static var addressSpace: Self { + Self(.addressSpace) + } + + /// Maximum size of a core file in bytes. + public static var coreFileSize: Self { + Self(.coreFileSize) + } + + /// Maximum amount of CPU time the process can consume in seconds. + public static var cpuTime: Self { + Self(.cpuTime) + } + + /// Maximum size of the process's data segment in bytes. + public static var dataSize: Self { + Self(.dataSize) + } + + /// Maximum size of files the process may create in bytes. + public static var fileSize: Self { + Self(.fileSize) + } + + /// Maximum number of file locks. + public static var locks: Self { + Self(.locks) + } + + /// Maximum number of bytes of memory that may be locked into RAM. + public static var lockedMemory: Self { + Self(.lockedMemory) + } + + /// Maximum number of bytes that can be allocated for POSIX message queues. + public static var messageQueue: Self { + Self(.messageQueue) + } + + /// Maximum nice value that can be set. + public static var nice: Self { + Self(.nice) + } + + /// Maximum number of open file descriptors. + public static var openFiles: Self { + Self(.openFiles) + } + + /// Maximum number of processes that can be created by the user. + public static var numberOfProcesses: Self { + Self(.numberOfProcesses) + } + + /// Maximum size of the process's resident set (physical memory) in bytes. + public static var residentSetSize: Self { + Self(.residentSetSize) + } + + /// Maximum real-time scheduling priority. + public static var realtimePriority: Self { + Self(.realtimePriority) + } + + /// Maximum amount of CPU time for real-time scheduling in microseconds. + public static var realtimeTimeout: Self { + Self(.realtimeTimeout) + } + + /// Maximum number of signals that may be queued. + public static var signalsPending: Self { + Self(.signalsPending) + } + + /// Maximum size of the process stack in bytes. + public static var stackSize: Self { + Self(.stackSize) + } + + /// Creates a Kind from its OCI string representation. + /// + /// - Parameter string: The OCI string representation (e.g., "RLIMIT_NOFILE"). + /// - Throws: `ContainerizationError` with code `.invalidArgument` if the string doesn't match a known rlimit kind. + public init(_ string: String) throws { + switch string { + case "RLIMIT_AS": + self = .addressSpace + case "RLIMIT_CORE": + self = .coreFileSize + case "RLIMIT_CPU": + self = .cpuTime + case "RLIMIT_DATA": + self = .dataSize + case "RLIMIT_FSIZE": + self = .fileSize + case "RLIMIT_LOCKS": + self = .locks + case "RLIMIT_MEMLOCK": + self = .lockedMemory + case "RLIMIT_MSGQUEUE": + self = .messageQueue + case "RLIMIT_NICE": + self = .nice + case "RLIMIT_NOFILE": + self = .openFiles + case "RLIMIT_NPROC": + self = .numberOfProcesses + case "RLIMIT_RSS": + self = .residentSetSize + case "RLIMIT_RTPRIO": + self = .realtimePriority + case "RLIMIT_RTTIME": + self = .realtimeTimeout + case "RLIMIT_SIGPENDING": + self = .signalsPending + case "RLIMIT_STACK": + self = .stackSize + default: + throw ContainerizationError(.invalidArgument, message: "invalid rlimit kind: '\(string)'") + } + } + } +} + +extension LinuxRLimit.Kind: CustomStringConvertible { + /// The OCI string representation of the resource limit kind. + public var description: String { + switch self.value { + case .addressSpace: + "RLIMIT_AS" + case .coreFileSize: + "RLIMIT_CORE" + case .cpuTime: + "RLIMIT_CPU" + case .dataSize: + "RLIMIT_DATA" + case .fileSize: + "RLIMIT_FSIZE" + case .locks: + "RLIMIT_LOCKS" + case .lockedMemory: + "RLIMIT_MEMLOCK" + case .messageQueue: + "RLIMIT_MSGQUEUE" + case .nice: + "RLIMIT_NICE" + case .openFiles: + "RLIMIT_NOFILE" + case .numberOfProcesses: + "RLIMIT_NPROC" + case .residentSetSize: + "RLIMIT_RSS" + case .realtimePriority: + "RLIMIT_RTPRIO" + case .realtimeTimeout: + "RLIMIT_RTTIME" + case .signalsPending: + "RLIMIT_SIGPENDING" + case .stackSize: + "RLIMIT_STACK" + } + } +} + +/// User-friendly Linux capabilities configuration +public struct LinuxCapabilities: Sendable { + /// Capabilities that define the maximum set of capabilities a process can have + public var bounding: [CapabilityName] = [] + /// Capabilities that are actually in effect for the current process + public var effective: [CapabilityName] = [] + /// Capabilities that can be inherited by child processes + public var inheritable: [CapabilityName] = [] + /// Capabilities that are currently permitted for the process + public var permitted: [CapabilityName] = [] + /// Capabilities that are preserved across execve() calls + public var ambient: [CapabilityName] = [] + + /// Grant all capabilities + public static let allCapabilities = LinuxCapabilities( + bounding: CapabilityName.allCases, + effective: CapabilityName.allCases, + inheritable: CapabilityName.allCases, + permitted: CapabilityName.allCases, + ambient: CapabilityName.allCases + ) + + /// Default configuration + public static let defaultOCICapabilities = LinuxCapabilities( + bounding: [ + .chown, + .dacOverride, + .fsetid, + .fowner, + .mknod, + .netRaw, + .setgid, + .setuid, + .setfcap, + .setpcap, + .netBindService, + .sysChroot, + .kill, + .auditWrite, + ], + effective: [ + .chown, + .dacOverride, + .fsetid, + .fowner, + .mknod, + .netRaw, + .setgid, + .setuid, + .setfcap, + .setpcap, + .netBindService, + .sysChroot, + .kill, + .auditWrite, + ], + permitted: [ + .chown, + .dacOverride, + .fsetid, + .fowner, + .mknod, + .netRaw, + .setgid, + .setuid, + .setfcap, + .setpcap, + .netBindService, + .sysChroot, + .kill, + .auditWrite, + ], + ) + + public init( + bounding: [CapabilityName] = [], + effective: [CapabilityName] = [], + inheritable: [CapabilityName] = [], + permitted: [CapabilityName] = [], + ambient: [CapabilityName] = [] + ) { + self.bounding = bounding + self.effective = effective + self.inheritable = inheritable + self.permitted = permitted + self.ambient = ambient + } + + /// Convenience initializer that sets the same capabilities to effective, permitted, and bounding sets + /// This matches the typical pattern used by containerd/runc + public init(capabilities: [CapabilityName]) { + self.bounding = capabilities + self.effective = capabilities + self.inheritable = [] + self.permitted = capabilities + self.ambient = [] + } + + /// Convert to OCI format for transport + public func toOCI() -> ContainerizationOCI.LinuxCapabilities { + ContainerizationOCI.LinuxCapabilities( + bounding: bounding.isEmpty ? nil : bounding.map { $0.description }, + effective: effective.isEmpty ? nil : effective.map { $0.description }, + inheritable: inheritable.isEmpty ? nil : inheritable.map { $0.description }, + permitted: permitted.isEmpty ? nil : permitted.map { $0.description }, + ambient: ambient.isEmpty ? nil : ambient.map { $0.description } + ) + } +} + +public struct LinuxProcessConfiguration: Sendable { + /// The default PATH value for a process. + public static let defaultPath = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" + + /// The arguments for the container process. + public var arguments: [String] = [] + /// The environment variables for the container process. + public var environmentVariables: [String] = ["PATH=\(Self.defaultPath)"] + /// The working directory for the container process. + public var workingDirectory: String = "/" + /// The user the container process will run as. + public var user: ContainerizationOCI.User = .init() + /// The rlimits for the container process. + public var rlimits: [LinuxRLimit] = [] + /// Whether to set the no_new_privileges bit on the container process. When true, the + /// process and its children cannot gain additional privileges via setuid/setgid binaries + /// or file capabilities. + public var noNewPrivileges: Bool = false + /// The Linux capabilities for the container process. Defaults to + /// ``LinuxCapabilities/defaultOCICapabilities`` — the restricted baseline used by + /// runc/containerd, which excludes privileged capabilities such as `CAP_SYS_ADMIN`. + /// Callers that require additional capabilities (for example, privileged containers) + /// must opt in explicitly, e.g. by setting ``LinuxCapabilities/allCapabilities``. + public var capabilities: LinuxCapabilities = .defaultOCICapabilities + /// Whether to allocate a pseudo terminal for the process. If you'd like interactive + /// behavior and are planning to use a terminal for stdin/out/err on the client side, + /// this should likely be set to true. + public var terminal: Bool = false + /// The stdin for the process. + public var stdin: ReaderStream? + /// The stdout for the process. + public var stdout: Writer? + /// The stderr for the process. + public var stderr: Writer? + + public init() {} + + public init( + arguments: [String], + environmentVariables: [String] = ["PATH=\(Self.defaultPath)"], + workingDirectory: String = "/", + user: ContainerizationOCI.User = .init(), + rlimits: [LinuxRLimit] = [], + noNewPrivileges: Bool = false, + capabilities: LinuxCapabilities = .defaultOCICapabilities, + terminal: Bool = false, + stdin: ReaderStream? = nil, + stdout: Writer? = nil, + stderr: Writer? = nil + ) { + self.arguments = arguments + self.environmentVariables = environmentVariables + self.workingDirectory = workingDirectory + self.user = user + self.rlimits = rlimits + self.noNewPrivileges = noNewPrivileges + self.capabilities = capabilities + self.terminal = terminal + self.stdin = stdin + self.stdout = stdout + self.stderr = stderr + } + + public init(from config: ImageConfig) { + self.workingDirectory = config.workingDir ?? "/" + self.environmentVariables = config.env ?? [] + self.arguments = (config.entrypoint ?? []) + (config.cmd ?? []) + self.user = { + if let rawString = config.user { + return User(username: rawString) + } + return User() + }() + } + + /// Sets up IO to be handled by the passed in Terminal, and edits the + /// process configuration to set the necessary state for using a pty. + mutating public func setTerminalIO(terminal: Terminal) { + self.environmentVariables.append("TERM=xterm") + self.terminal = true + self.stdin = terminal + self.stdout = terminal + } + + func toOCI() -> ContainerizationOCI.Process { + ContainerizationOCI.Process( + args: self.arguments, + cwd: self.workingDirectory, + env: self.environmentVariables, + noNewPrivileges: self.noNewPrivileges, + capabilities: self.capabilities.toOCI(), + user: self.user, + rlimits: self.rlimits.map { $0.toOCI() }, + terminal: self.terminal + ) + } +} diff --git a/Sources/Containerization/Mount+CH.swift b/Sources/Containerization/Mount+CH.swift new file mode 100644 index 0000000..2e25e2b --- /dev/null +++ b/Sources/Containerization/Mount+CH.swift @@ -0,0 +1,80 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CloudHypervisor +import Foundation + +extension Mount { + /// Returns a `CloudHypervisor.DiskConfig` describing this mount as a virtio-blk + /// device, or `nil` if the mount is not a block device. + /// + /// The caller supplies the device id; cloud-hypervisor uses it both as a + /// stable handle for hotplug-remove and as the udev/sysfs identifier inside + /// the guest. + /// + /// `imageType` defaults to `.raw` because Containerization mounts are + /// always raw block files (ext4 produced by the EXT4 unpacker, NBD URLs, + /// etc.). When cloud-hypervisor doesn't see an `image_type` it falls + /// back to `Unknown` and silently rejects all writes — see CH's + /// `virtio-devices/src/block.rs` "Attempting to write to sector 0 on a + /// disk without specifying image_type" warning. + public func chDiskConfig(id: String) -> CloudHypervisor.DiskConfig? { + guard case .virtioblk = self.runtimeOptions else { + return nil + } + return CloudHypervisor.DiskConfig( + path: self.source, + readonly: self.options.contains("ro"), + direct: nil, + iommu: nil, + id: id, + pciSegment: nil, + imageType: .raw + ) + } + + /// Returns a `CloudHypervisor.FsConfig` describing this mount as a virtio-fs + /// share served by an out-of-process `virtiofsd`, or `nil` if the mount is + /// not a virtiofs share. + /// + /// `tag` is the guest-side mount tag and `socketPath` is the UDS path the + /// virtiofsd subprocess publishes. Both are owned by the caller. + public func chFsConfig(tag: String, socketPath: String, id: String) -> CloudHypervisor.FsConfig? { + guard case .virtiofs = self.runtimeOptions else { + return nil + } + return CloudHypervisor.FsConfig( + tag: tag, + socket: socketPath, + numQueues: nil, + queueSize: nil, + id: id, + pciSegment: nil + ) + } +} + +/// Build the host-side UDS path for a virtiofsd ↔ cloud-hypervisor socket. +/// +/// `tag` is the full source-hash (used as the FUSE tag advertised to the +/// guest); the socket *path* uses only an 8-char prefix because the full +/// path — `/virtiofs-.sock` with a 36-char tag — overshoots +/// Linux's 108-byte `SUN_LEN` limit. 32 bits of disambiguation is more +/// than enough within a single VM (handful of distinct virtiofs sources). +func chVirtiofsSocketURL(workDir: URL, tag: String) -> URL { + let short = String(tag.prefix(8)) + return workDir.appendingPathComponent("vfs-\(short).sock") +} diff --git a/Sources/Containerization/Mount.swift b/Sources/Containerization/Mount.swift new file mode 100644 index 0000000..b516dea --- /dev/null +++ b/Sources/Containerization/Mount.swift @@ -0,0 +1,452 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation + +#if os(macOS) +import Virtualization +#endif + +#if os(Linux) +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif +#endif + +/// A filesystem mount exposed to a container. +public struct Mount: Sendable { + /// The filesystem or mount type. This is the string + /// that will be used for the mount syscall itself. + public var type: String + /// The source path of the mount. + public var source: String + /// The destination path of the mount. + public var destination: String + /// Filesystem or mount specific options. + public var options: [String] + /// Runtime specific options. This can be used + /// as a way to discern what kind of device a vmm + /// should create for this specific mount (virtioblock + /// virtiofs etc.). + public let runtimeOptions: RuntimeOptions + + /// A type representing a "hint" of what type + /// of mount this really is (block, directory, purely + /// guest mount) and a set of type specific options, if any. + public enum RuntimeOptions: Sendable { + case virtioblk([String]) + case virtiofs([String]) + case shared + case any([String]) + } + + public init( + type: String, + source: String, + destination: String, + options: [String], + runtimeOptions: RuntimeOptions + ) { + self.type = type + self.source = source + self.destination = destination + self.options = options + self.runtimeOptions = runtimeOptions + } + + /// Mount representing a virtio block device. + public static func block( + format: String, + source: String, + destination: String, + options: [String] = [], + runtimeOptions: [String] = [] + ) -> Self { + .init( + type: format, + source: source, + destination: destination, + options: options, + runtimeOptions: .virtioblk(runtimeOptions) + ) + } + + /// Mount representing a virtiofs share. + public static func share( + source: String, + destination: String, + options: [String] = [], + runtimeOptions: [String] = [] + ) -> Self { + .init( + type: "virtiofs", + source: source, + destination: destination, + options: options, + runtimeOptions: .virtiofs(runtimeOptions) + ) + } + + /// A generic mount. + public static func any( + type: String, + source: String, + destination: String, + options: [String] = [], + runtimeOptions: [String] = [] + ) -> Self { + .init( + type: type, + source: source, + destination: destination, + options: options, + runtimeOptions: .any(runtimeOptions) + ) + } + + /// A mount referencing a shared pod volume by name. + public static func sharedMount( + name: String, + destination: String, + options: [String] = [] + ) -> Self { + .init( + type: "none", + source: name, + destination: destination, + options: options, + runtimeOptions: .shared + ) + } + + /// Clone the Mount to the provided path. + /// + /// On macOS this uses `clonefile` (via `FileManager.copyItem`) for a + /// copy-on-write copy when the underlying filesystem supports it. On + /// Linux it tries `ioctl(FICLONE)` first (CoW on btrfs / xfs / bcachefs) + /// and falls back to a `SEEK_DATA`/`SEEK_HOLE` sparse copy that copies + /// only data ranges. This matters for EXT4 images produced by + /// `EXT4+Formatter`, which sparse-allocate via `lseek + 1-byte write` — + /// a non-sparse copy would inflate a ~50 MB alpine rootfs into a + /// fully-allocated 2 GiB clone and exhaust the integration suite's + /// writable layer in ~30 tests. + public func clone(to: String) throws -> Self { + #if os(Linux) + try Self.linuxSparseCopy(from: self.source, to: to) + #else + try FileManager.default.copyItem(atPath: self.source, toPath: to) + #endif + + return .init( + type: self.type, + source: to, + destination: self.destination, + options: self.options, + runtimeOptions: self.runtimeOptions + ) + } + + #if os(Linux) + /// Copy `src` to `dst`, preferring a CoW reflink (`ioctl(FICLONE)`) and + /// falling back to a SEEK_DATA/SEEK_HOLE sparse copy. The reflink path + /// succeeds on btrfs / xfs (`reflink=1`) / bcachefs; on ext4 / tmpfs / + /// overlayfs it fails fast with EOPNOTSUPP/EXDEV/EINVAL and we walk + /// the hole map instead. The sparse-copy path also handles + /// filesystems that don't support hole-seeking (the very first + /// SEEK_DATA returns EINVAL) by copying the remainder verbatim. Mode + /// bits are preserved from the source. + private static func linuxSparseCopy(from src: String, to dst: String) throws { + // Stable Linux ABI since 3.1 (ext4, tmpfs, overlayfs all support it). + // Re-declared here so the build doesn't depend on whether the + // Glibc/Musl Swift overlay re-exports them. + let SEEK_DATA: Int32 = 3 + let SEEK_HOLE: Int32 = 4 + // _IOW(0x94, 9, int) on every Linux arch we target (x86_64, aarch64). + let FICLONE: CUnsignedLong = 0x4004_9409 + + let srcFd = open(src, O_RDONLY | O_CLOEXEC) + guard srcFd >= 0 else { + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + defer { _ = close(srcFd) } + + var st = stat() + guard fstat(srcFd, &st) == 0 else { + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + let size = off_t(st.st_size) + let mode = mode_t(st.st_mode & 0o7777) + + let dstFd = open(dst, O_WRONLY | O_CREAT | O_TRUNC | O_CLOEXEC, mode) + guard dstFd >= 0 else { + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + defer { _ = close(dstFd) } + + // FICLONE atomically replaces dst's contents with a CoW clone of + // src — sets size and contents in one shot, no ftruncate needed + // afterwards. On failure FICLONE guarantees dst is untouched, so + // we can safely fall through to the sparse-copy path. ioctl(2) is + // variadic; type-pun via a fixed-arity function pointer (same + // pattern as ContainerizationOS.Socket). + let ioctlFICLONE: @convention(c) (CInt, CUnsignedLong, CInt) -> CInt = ioctl + if ioctlFICLONE(dstFd, FICLONE, srcFd) == 0 { + return + } + + // Set the destination size up front so any trailing hole survives — + // we only ever pwrite data ranges, never zero-fill. + guard ftruncate(dstFd, size) == 0 else { + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + + let bufSize = 1 << 20 // 1 MiB + let buf = UnsafeMutableRawPointer.allocate(byteCount: bufSize, alignment: 16) + defer { buf.deallocate() } + + var pos: off_t = 0 + while pos < size { + let dataStart = lseek(srcFd, pos, SEEK_DATA) + if dataStart < 0 { + // ENXIO: no more data — rest is hole, already covered by ftruncate. + if errno == ENXIO { + break + } + // EINVAL/ENOTSUP: filesystem doesn't support SEEK_DATA. Treat + // the remainder as one big data range and copy it verbatim. + try Self.copyRange(srcFd: srcFd, dstFd: dstFd, start: pos, end: size, buf: buf, bufSize: bufSize) + break + } + + // SEEK_HOLE returns end-of-file when there's no trailing hole. + let dataEnd = lseek(srcFd, dataStart, SEEK_HOLE) + let endOff: off_t = dataEnd < 0 ? size : dataEnd + + try Self.copyRange(srcFd: srcFd, dstFd: dstFd, start: dataStart, end: endOff, buf: buf, bufSize: bufSize) + pos = endOff + } + } + + private static func copyRange( + srcFd: Int32, + dstFd: Int32, + start: off_t, + end: off_t, + buf: UnsafeMutableRawPointer, + bufSize: Int + ) throws { + var off = start + while off < end { + let want = Int(min(off_t(bufSize), end - off)) + let nread = pread(srcFd, buf, want, off) + if nread < 0 { + if errno == EINTR { continue } + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + if nread == 0 { + // Source shorter than fstat reported — shouldn't happen, but + // bail rather than spin. + return + } + var written = 0 + while written < nread { + let nwrite = pwrite(dstFd, buf.advanced(by: written), nread - written, off + off_t(written)) + if nwrite < 0 { + if errno == EINTR { continue } + throw POSIXError(POSIXErrorCode(rawValue: errno) ?? .EIO) + } + written += nwrite + } + off += off_t(nread) + } + } + #endif +} + +#if os(macOS) + +extension Mount { + private enum StorageAttachmentType { + case diskImage + case networkBlockDevice + } + + private var storageAttachmentType: StorageAttachmentType { + let nbdSchemes = ["nbd://", "nbds://", "nbd+unix://", "nbds+unix://"] + if nbdSchemes.contains(where: { self.source.hasPrefix($0) }) { + return .networkBlockDevice + } + return .diskImage + } + + func configure(config: inout VZVirtualMachineConfiguration) throws { + switch self.runtimeOptions { + case .virtioblk(let options): + let device: VZStorageDeviceAttachment + switch self.storageAttachmentType { + case .networkBlockDevice: + device = try VZNetworkBlockDeviceStorageDeviceAttachment.mountToVZAttachment(mount: self, options: options) + case .diskImage: + device = try VZDiskImageStorageDeviceAttachment.mountToVZAttachment(mount: self, options: options) + } + let attachment = VZVirtioBlockDeviceConfiguration(attachment: device) + config.storageDevices.append(attachment) + case .virtiofs(_): + // VirtioFS mounts are handled centrally via VZMultipleDirectoryShare in VZVirtualMachineInstance + // No per-mount device configuration needed + break + case .shared, .any: + break + } + } +} + +extension VZDiskImageStorageDeviceAttachment { + static func mountToVZAttachment(mount: Mount, options: [String]) throws -> VZDiskImageStorageDeviceAttachment { + var synchronizationMode: VZDiskImageSynchronizationMode = .fsync + var cachingMode: VZDiskImageCachingMode = .cached + + for option in options { + let split = option.split(separator: "=") + if split.count != 2 { + continue + } + + let key = String(split[0]) + let value = String(split[1]) + + switch key { + case "vzDiskImageCachingMode": + switch value { + case "automatic": + cachingMode = .automatic + case "cached": + cachingMode = .cached + case "uncached": + cachingMode = .uncached + default: + throw ContainerizationError( + .invalidArgument, + message: "unknown vzDiskImageCachingMode value for virtio block device: \(value)" + ) + } + case "vzDiskImageSynchronizationMode": + switch value { + case "full": + synchronizationMode = .full + case "fsync": + synchronizationMode = .fsync + case "none": + synchronizationMode = .none + default: + throw ContainerizationError( + .invalidArgument, + message: "unknown vzDiskImageSynchronizationMode value for virtio block device: \(value)" + ) + } + default: + throw ContainerizationError( + .invalidArgument, + message: "unknown vmm option encountered: \(key)" + ) + } + } + return try VZDiskImageStorageDeviceAttachment( + url: URL(filePath: mount.source), + readOnly: mount.readonly, + cachingMode: cachingMode, + synchronizationMode: synchronizationMode + ) + } +} + +extension VZNetworkBlockDeviceStorageDeviceAttachment { + static func mountToVZAttachment(mount: Mount, options: [String]) throws -> VZNetworkBlockDeviceStorageDeviceAttachment { + guard let url = URL(string: mount.source) else { + throw ContainerizationError( + .invalidArgument, + message: "invalid NBD URL: \(mount.source)" + ) + } + + var timeout: TimeInterval = 5 + var synchronizationMode: VZDiskSynchronizationMode = .full + + for option in options { + let split = option.split(separator: "=") + if split.count != 2 { + continue + } + + let key = String(split[0]) + let value = String(split[1]) + + switch key { + case "vzTimeout": + guard let t = TimeInterval(value) else { + throw ContainerizationError( + .invalidArgument, + message: "invalid vzTimeout value for NBD device: \(value)" + ) + } + timeout = t + case "vzSynchronizationMode": + switch value { + case "full": + synchronizationMode = .full + case "none": + synchronizationMode = .none + default: + throw ContainerizationError( + .invalidArgument, + message: "unknown vzSynchronizationMode value for NBD device: \(value)" + ) + } + default: + throw ContainerizationError( + .invalidArgument, + message: "unknown vmm option encountered: \(key)" + ) + } + } + + return try VZNetworkBlockDeviceStorageDeviceAttachment( + url: url, + timeout: timeout, + isForcedReadOnly: mount.readonly, + synchronizationMode: synchronizationMode + ) + } +} + +#endif + +extension Mount { + fileprivate var readonly: Bool { + self.options.contains("ro") + } + + /// Returns true if this mount is a virtio block device. + public var isBlock: Bool { + if case .virtioblk = self.runtimeOptions { + return true + } + return false + } +} diff --git a/Sources/Containerization/NATInterface.swift b/Sources/Containerization/NATInterface.swift new file mode 100644 index 0000000..c37fbc0 --- /dev/null +++ b/Sources/Containerization/NATInterface.swift @@ -0,0 +1,42 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras + +public struct NATInterface: Interface { + public var ipv4Address: CIDRv4 + public var ipv4Gateway: IPv4Address? + public var ipv6Address: CIDRv6? + public var ipv6Gateway: IPv6Address? + public var macAddress: MACAddress? + public var mtu: UInt32 + + public init( + ipv4Address: CIDRv4, + ipv4Gateway: IPv4Address?, + ipv6Address: CIDRv6? = nil, + ipv6Gateway: IPv6Address? = nil, + macAddress: MACAddress? = nil, + mtu: UInt32 = 1500 + ) { + self.ipv4Address = ipv4Address + self.ipv4Gateway = ipv4Gateway + self.ipv6Address = ipv6Address + self.ipv6Gateway = ipv6Gateway + self.macAddress = macAddress + self.mtu = mtu + } +} diff --git a/Sources/Containerization/NATNetworkInterface.swift b/Sources/Containerization/NATNetworkInterface.swift new file mode 100644 index 0000000..f4d6392 --- /dev/null +++ b/Sources/Containerization/NATNetworkInterface.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) + +import vmnet +import Virtualization +import ContainerizationError +import ContainerizationExtras +import Synchronization + +/// An interface that uses NAT to provide an IP address for a given +/// container/virtual machine. +@available(macOS 26, *) +public final class NATNetworkInterface: Interface, Sendable { + public let ipv4Address: CIDRv4 + public let ipv4Gateway: IPv4Address? + public let macAddress: MACAddress? + public let mtu: UInt32 + + @available(macOS 26, *) + // `reference` isn't used concurrently. + public nonisolated(unsafe) let reference: vmnet_network_ref! + + @available(macOS 26, *) + public init( + ipv4Address: CIDRv4, + ipv4Gateway: IPv4Address?, + reference: sending vmnet_network_ref, + macAddress: MACAddress? = nil, + mtu: UInt32 = 1500 + ) { + self.ipv4Address = ipv4Address + self.ipv4Gateway = ipv4Gateway + self.macAddress = macAddress + self.mtu = mtu + self.reference = reference + } + + @available(macOS, obsoleted: 26, message: "Use init(ipv4Address:ipv4Gateway:reference:macAddress:) instead") + public init( + ipv4Address: CIDRv4, + ipv4Gateway: IPv4Address?, + macAddress: MACAddress? = nil, + mtu: UInt32 = 1500 + ) { + self.ipv4Address = ipv4Address + self.ipv4Gateway = ipv4Gateway + self.macAddress = macAddress + self.mtu = mtu + self.reference = nil + } +} + +@available(macOS 26, *) +extension NATNetworkInterface: VZInterface { + public func device() throws -> VZVirtioNetworkDeviceConfiguration { + let config = VZVirtioNetworkDeviceConfiguration() + if let macAddress = self.macAddress { + guard let mac = VZMACAddress(string: macAddress.description) else { + throw ContainerizationError(.invalidArgument, message: "invalid mac address \(macAddress)") + } + config.macAddress = mac + } + + config.attachment = VZVmnetNetworkDeviceAttachment(network: self.reference) + return config + } +} + +#endif diff --git a/Sources/Containerization/Network.swift b/Sources/Containerization/Network.swift new file mode 100644 index 0000000..807746e --- /dev/null +++ b/Sources/Containerization/Network.swift @@ -0,0 +1,21 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A network that can allocate and release interfaces for use with containers. +public protocol Network: Sendable { + mutating func createInterface(_ id: String) throws -> Interface? + mutating func releaseInterface(_ id: String) throws +} diff --git a/Sources/Containerization/SandboxContext/SandboxContext.grpc.swift b/Sources/Containerization/SandboxContext/SandboxContext.grpc.swift new file mode 100644 index 0000000..6776ed1 --- /dev/null +++ b/Sources/Containerization/SandboxContext/SandboxContext.grpc.swift @@ -0,0 +1,6833 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// DO NOT EDIT. +// swift-format-ignore-file +// swiftlint:disable all +// +// Generated by the gRPC Swift generator plugin for the protocol buffer compiler. +// Source: SandboxContext.proto +// +// For information on using the generated types, please see the documentation: +// https://github.com/grpc/grpc-swift + +import GRPCCore +import GRPCProtobuf + +// MARK: - com.apple.containerization.sandbox.v3.SandboxContext + +/// Namespace containing generated types for the "com.apple.containerization.sandbox.v3.SandboxContext" service. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +public enum Com_Apple_Containerization_Sandbox_V3_SandboxContext: Sendable { + /// Service descriptor for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + public static let descriptor = GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext") + /// Namespace for method metadata. + public enum Method: Sendable { + /// Namespace for "Mount" metadata. + public enum Mount: Sendable { + /// Request type for "Mount". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_MountRequest + /// Response type for "Mount". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_MountResponse + /// Descriptor for "Mount". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Mount", + type: .unary + ) + } + /// Namespace for "Umount" metadata. + public enum Umount: Sendable { + /// Request type for "Umount". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_UmountRequest + /// Response type for "Umount". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_UmountResponse + /// Descriptor for "Umount". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Umount", + type: .unary + ) + } + /// Namespace for "Setenv" metadata. + public enum Setenv: Sendable { + /// Request type for "Setenv". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_SetenvRequest + /// Response type for "Setenv". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_SetenvResponse + /// Descriptor for "Setenv". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Setenv", + type: .unary + ) + } + /// Namespace for "Getenv" metadata. + public enum Getenv: Sendable { + /// Request type for "Getenv". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_GetenvRequest + /// Response type for "Getenv". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_GetenvResponse + /// Descriptor for "Getenv". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Getenv", + type: .unary + ) + } + /// Namespace for "Mkdir" metadata. + public enum Mkdir: Sendable { + /// Request type for "Mkdir". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_MkdirRequest + /// Response type for "Mkdir". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_MkdirResponse + /// Descriptor for "Mkdir". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Mkdir", + type: .unary + ) + } + /// Namespace for "Sysctl" metadata. + public enum Sysctl: Sendable { + /// Request type for "Sysctl". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_SysctlRequest + /// Response type for "Sysctl". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_SysctlResponse + /// Descriptor for "Sysctl". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Sysctl", + type: .unary + ) + } + /// Namespace for "SetTime" metadata. + public enum SetTime: Sendable { + /// Request type for "SetTime". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_SetTimeRequest + /// Response type for "SetTime". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_SetTimeResponse + /// Descriptor for "SetTime". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "SetTime", + type: .unary + ) + } + /// Namespace for "SetupEmulator" metadata. + public enum SetupEmulator: Sendable { + /// Request type for "SetupEmulator". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest + /// Response type for "SetupEmulator". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse + /// Descriptor for "SetupEmulator". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "SetupEmulator", + type: .unary + ) + } + /// Namespace for "WriteFile" metadata. + public enum WriteFile: Sendable { + /// Request type for "WriteFile". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_WriteFileRequest + /// Response type for "WriteFile". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_WriteFileResponse + /// Descriptor for "WriteFile". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "WriteFile", + type: .unary + ) + } + /// Namespace for "Copy" metadata. + public enum Copy: Sendable { + /// Request type for "Copy". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_CopyRequest + /// Response type for "Copy". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_CopyResponse + /// Descriptor for "Copy". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Copy", + type: .serverStreaming + ) + } + /// Namespace for "Stat" metadata. + public enum Stat: Sendable { + /// Request type for "Stat". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_StatRequest + /// Response type for "Stat". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_StatResponse + /// Descriptor for "Stat". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Stat", + type: .unary + ) + } + /// Namespace for "FilesystemOperation" metadata. + public enum FilesystemOperation: Sendable { + /// Request type for "FilesystemOperation". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest + /// Response type for "FilesystemOperation". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse + /// Descriptor for "FilesystemOperation". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "FilesystemOperation", + type: .unary + ) + } + /// Namespace for "CreateProcess" metadata. + public enum CreateProcess: Sendable { + /// Request type for "CreateProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest + /// Response type for "CreateProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse + /// Descriptor for "CreateProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "CreateProcess", + type: .unary + ) + } + /// Namespace for "DeleteProcess" metadata. + public enum DeleteProcess: Sendable { + /// Request type for "DeleteProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest + /// Response type for "DeleteProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse + /// Descriptor for "DeleteProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "DeleteProcess", + type: .unary + ) + } + /// Namespace for "StartProcess" metadata. + public enum StartProcess: Sendable { + /// Request type for "StartProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_StartProcessRequest + /// Response type for "StartProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_StartProcessResponse + /// Descriptor for "StartProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "StartProcess", + type: .unary + ) + } + /// Namespace for "KillProcess" metadata. + public enum KillProcess: Sendable { + /// Request type for "KillProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_KillProcessRequest + /// Response type for "KillProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_KillProcessResponse + /// Descriptor for "KillProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "KillProcess", + type: .unary + ) + } + /// Namespace for "WaitProcess" metadata. + public enum WaitProcess: Sendable { + /// Request type for "WaitProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest + /// Response type for "WaitProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse + /// Descriptor for "WaitProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "WaitProcess", + type: .unary + ) + } + /// Namespace for "ResizeProcess" metadata. + public enum ResizeProcess: Sendable { + /// Request type for "ResizeProcess". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest + /// Response type for "ResizeProcess". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse + /// Descriptor for "ResizeProcess". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "ResizeProcess", + type: .unary + ) + } + /// Namespace for "CloseProcessStdin" metadata. + public enum CloseProcessStdin: Sendable { + /// Request type for "CloseProcessStdin". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest + /// Response type for "CloseProcessStdin". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse + /// Descriptor for "CloseProcessStdin". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "CloseProcessStdin", + type: .unary + ) + } + /// Namespace for "ContainerStatistics" metadata. + public enum ContainerStatistics: Sendable { + /// Request type for "ContainerStatistics". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest + /// Response type for "ContainerStatistics". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse + /// Descriptor for "ContainerStatistics". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "ContainerStatistics", + type: .unary + ) + } + /// Namespace for "ProxyVsock" metadata. + public enum ProxyVsock: Sendable { + /// Request type for "ProxyVsock". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest + /// Response type for "ProxyVsock". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse + /// Descriptor for "ProxyVsock". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "ProxyVsock", + type: .unary + ) + } + /// Namespace for "StopVsockProxy" metadata. + public enum StopVsockProxy: Sendable { + /// Request type for "StopVsockProxy". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest + /// Response type for "StopVsockProxy". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse + /// Descriptor for "StopVsockProxy". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "StopVsockProxy", + type: .unary + ) + } + /// Namespace for "IpLinkSet" metadata. + public enum IpLinkSet: Sendable { + /// Request type for "IpLinkSet". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest + /// Response type for "IpLinkSet". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse + /// Descriptor for "IpLinkSet". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "IpLinkSet", + type: .unary + ) + } + /// Namespace for "IpAddrAdd" metadata. + public enum IpAddrAdd: Sendable { + /// Request type for "IpAddrAdd". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest + /// Response type for "IpAddrAdd". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse + /// Descriptor for "IpAddrAdd". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "IpAddrAdd", + type: .unary + ) + } + /// Namespace for "IpRouteAddLink" metadata. + public enum IpRouteAddLink: Sendable { + /// Request type for "IpRouteAddLink". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest + /// Response type for "IpRouteAddLink". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse + /// Descriptor for "IpRouteAddLink". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "IpRouteAddLink", + type: .unary + ) + } + /// Namespace for "IpRouteAddDefault" metadata. + public enum IpRouteAddDefault: Sendable { + /// Request type for "IpRouteAddDefault". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest + /// Response type for "IpRouteAddDefault". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse + /// Descriptor for "IpRouteAddDefault". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "IpRouteAddDefault", + type: .unary + ) + } + /// Namespace for "ConfigureDns" metadata. + public enum ConfigureDns: Sendable { + /// Request type for "ConfigureDns". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest + /// Response type for "ConfigureDns". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse + /// Descriptor for "ConfigureDns". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "ConfigureDns", + type: .unary + ) + } + /// Namespace for "ConfigureHosts" metadata. + public enum ConfigureHosts: Sendable { + /// Request type for "ConfigureHosts". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest + /// Response type for "ConfigureHosts". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse + /// Descriptor for "ConfigureHosts". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "ConfigureHosts", + type: .unary + ) + } + /// Namespace for "Sync" metadata. + public enum Sync: Sendable { + /// Request type for "Sync". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_SyncRequest + /// Response type for "Sync". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_SyncResponse + /// Descriptor for "Sync". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Sync", + type: .unary + ) + } + /// Namespace for "Kill" metadata. + public enum Kill: Sendable { + /// Request type for "Kill". + public typealias Input = Com_Apple_Containerization_Sandbox_V3_KillRequest + /// Response type for "Kill". + public typealias Output = Com_Apple_Containerization_Sandbox_V3_KillResponse + /// Descriptor for "Kill". + public static let descriptor = GRPCCore.MethodDescriptor( + service: GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext"), + method: "Kill", + type: .unary + ) + } + /// Descriptors for all methods in the "com.apple.containerization.sandbox.v3.SandboxContext" service. + public static let descriptors: [GRPCCore.MethodDescriptor] = [ + Mount.descriptor, + Umount.descriptor, + Setenv.descriptor, + Getenv.descriptor, + Mkdir.descriptor, + Sysctl.descriptor, + SetTime.descriptor, + SetupEmulator.descriptor, + WriteFile.descriptor, + Copy.descriptor, + Stat.descriptor, + FilesystemOperation.descriptor, + CreateProcess.descriptor, + DeleteProcess.descriptor, + StartProcess.descriptor, + KillProcess.descriptor, + WaitProcess.descriptor, + ResizeProcess.descriptor, + CloseProcessStdin.descriptor, + ContainerStatistics.descriptor, + ProxyVsock.descriptor, + StopVsockProxy.descriptor, + IpLinkSet.descriptor, + IpAddrAdd.descriptor, + IpRouteAddLink.descriptor, + IpRouteAddDefault.descriptor, + ConfigureDns.descriptor, + ConfigureHosts.descriptor, + Sync.descriptor, + Kill.descriptor + ] + } +} + +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension GRPCCore.ServiceDescriptor { + /// Service descriptor for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + public static let com_apple_containerization_sandbox_v3_SandboxContext = GRPCCore.ServiceDescriptor(fullyQualifiedService: "com.apple.containerization.sandbox.v3.SandboxContext") +} + +// MARK: com.apple.containerization.sandbox.v3.SandboxContext (server) + +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext { + /// Streaming variant of the service protocol for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + /// + /// This protocol is the lowest-level of the service protocols generated for this service + /// giving you the most flexibility over the implementation of your service. This comes at + /// the cost of more verbose and less strict APIs. Each RPC requires you to implement it in + /// terms of a request stream and response stream. Where only a single request or response + /// message is expected, you are responsible for enforcing this invariant is maintained. + /// + /// Where possible, prefer using the stricter, less-verbose ``ServiceProtocol`` + /// or ``SimpleServiceProtocol`` instead. + /// + /// > Source IDL Documentation: + /// > + /// > Context for interacting with a container's runtime environment. + public protocol StreamingServiceProtocol: GRPCCore.RegistrableRPCService { + /// Handle the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_MountRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_MountResponse` messages. + func mount( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_UmountRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_UmountResponse` messages. + func umount( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_SetenvResponse` messages. + func setenv( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_GetenvResponse` messages. + func getenv( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_MkdirResponse` messages. + func mkdir( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_SysctlResponse` messages. + func sysctl( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_SetTimeResponse` messages. + func setTime( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse` messages. + func setupEmulator( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_WriteFileResponse` messages. + func writeFile( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_CopyRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_CopyResponse` messages. + func copy( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_StatRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_StatResponse` messages. + func stat( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse` messages. + func filesystemOperation( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse` messages. + func createProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse` messages. + func deleteProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_StartProcessResponse` messages. + func startProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_KillProcessResponse` messages. + func killProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse` messages. + func waitProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse` messages. + func resizeProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse` messages. + func closeProcessStdin( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse` messages. + func containerStatistics( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse` messages. + func proxyVsock( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse` messages. + func stopVsockProxy( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse` messages. + func ipLinkSet( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse` messages. + func ipAddrAdd( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse` messages. + func ipRouteAddLink( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse` messages. + func ipRouteAddDefault( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse` messages. + func configureDns( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse` messages. + func configureHosts( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_SyncRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_SyncResponse` messages. + func sync( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A streaming request of `Com_Apple_Containerization_Sandbox_V3_KillRequest` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_KillResponse` messages. + func kill( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + } + + /// Service protocol for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + /// + /// This protocol is higher level than ``StreamingServiceProtocol`` but lower level than + /// the ``SimpleServiceProtocol``, it provides access to request and response metadata and + /// trailing response metadata. If you don't need these then consider using + /// the ``SimpleServiceProtocol``. If you need fine grained control over your RPCs then + /// use ``StreamingServiceProtocol``. + /// + /// > Source IDL Documentation: + /// > + /// > Context for interacting with a container's runtime environment. + public protocol ServiceProtocol: Com_Apple_Containerization_Sandbox_V3_SandboxContext.StreamingServiceProtocol { + /// Handle the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MountRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_MountResponse` message. + func mount( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_UmountRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_UmountResponse` message. + func umount( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_SetenvResponse` message. + func setenv( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_GetenvResponse` message. + func getenv( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_MkdirResponse` message. + func mkdir( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_SysctlResponse` message. + func sysctl( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_SetTimeResponse` message. + func setTime( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse` message. + func setupEmulator( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_WriteFileResponse` message. + func writeFile( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CopyRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A streaming response of `Com_Apple_Containerization_Sandbox_V3_CopyResponse` messages. + func copy( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse + + /// Handle the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StatRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_StatResponse` message. + func stat( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse` message. + func filesystemOperation( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse` message. + func createProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse` message. + func deleteProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_StartProcessResponse` message. + func startProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_KillProcessResponse` message. + func killProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse` message. + func waitProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse` message. + func resizeProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse` message. + func closeProcessStdin( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse` message. + func containerStatistics( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse` message. + func proxyVsock( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse` message. + func stopVsockProxy( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse` message. + func ipLinkSet( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse` message. + func ipAddrAdd( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse` message. + func ipRouteAddLink( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse` message. + func ipRouteAddDefault( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse` message. + func configureDns( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse` message. + func configureHosts( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SyncRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_SyncResponse` message. + func sync( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + + /// Handle the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A response containing a single `Com_Apple_Containerization_Sandbox_V3_KillResponse` message. + func kill( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse + } + + /// Simple service protocol for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + /// + /// This is the highest level protocol for the service. The API is the easiest to use but + /// doesn't provide access to request or response metadata. If you need access to these + /// then use ``ServiceProtocol`` instead. + /// + /// > Source IDL Documentation: + /// > + /// > Context for interacting with a container's runtime environment. + public protocol SimpleServiceProtocol: Com_Apple_Containerization_Sandbox_V3_SandboxContext.ServiceProtocol { + /// Handle the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_MountRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_MountResponse` to respond with. + func mount( + request: Com_Apple_Containerization_Sandbox_V3_MountRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_MountResponse + + /// Handle the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_UmountRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_UmountResponse` to respond with. + func umount( + request: Com_Apple_Containerization_Sandbox_V3_UmountRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_UmountResponse + + /// Handle the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_SetenvResponse` to respond with. + func setenv( + request: Com_Apple_Containerization_Sandbox_V3_SetenvRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SetenvResponse + + /// Handle the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_GetenvResponse` to respond with. + func getenv( + request: Com_Apple_Containerization_Sandbox_V3_GetenvRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_GetenvResponse + + /// Handle the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_MkdirResponse` to respond with. + func mkdir( + request: Com_Apple_Containerization_Sandbox_V3_MkdirRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_MkdirResponse + + /// Handle the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_SysctlResponse` to respond with. + func sysctl( + request: Com_Apple_Containerization_Sandbox_V3_SysctlRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SysctlResponse + + /// Handle the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_SetTimeResponse` to respond with. + func setTime( + request: Com_Apple_Containerization_Sandbox_V3_SetTimeRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SetTimeResponse + + /// Handle the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse` to respond with. + func setupEmulator( + request: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse + + /// Handle the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_WriteFileResponse` to respond with. + func writeFile( + request: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_WriteFileResponse + + /// Handle the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_CopyRequest` message. + /// - response: A response stream of `Com_Apple_Containerization_Sandbox_V3_CopyResponse` messages. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + func copy( + request: Com_Apple_Containerization_Sandbox_V3_CopyRequest, + response: GRPCCore.RPCWriter, + context: GRPCCore.ServerContext + ) async throws + + /// Handle the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_StatRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_StatResponse` to respond with. + func stat( + request: Com_Apple_Containerization_Sandbox_V3_StatRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StatResponse + + /// Handle the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse` to respond with. + func filesystemOperation( + request: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse + + /// Handle the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse` to respond with. + func createProcess( + request: Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse + + /// Handle the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse` to respond with. + func deleteProcess( + request: Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse + + /// Handle the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_StartProcessResponse` to respond with. + func startProcess( + request: Com_Apple_Containerization_Sandbox_V3_StartProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StartProcessResponse + + /// Handle the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_KillProcessResponse` to respond with. + func killProcess( + request: Com_Apple_Containerization_Sandbox_V3_KillProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_KillProcessResponse + + /// Handle the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse` to respond with. + func waitProcess( + request: Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse + + /// Handle the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse` to respond with. + func resizeProcess( + request: Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse + + /// Handle the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse` to respond with. + func closeProcessStdin( + request: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse + + /// Handle the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse` to respond with. + func containerStatistics( + request: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse + + /// Handle the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse` to respond with. + func proxyVsock( + request: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse + + /// Handle the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse` to respond with. + func stopVsockProxy( + request: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse + + /// Handle the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse` to respond with. + func ipLinkSet( + request: Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse + + /// Handle the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse` to respond with. + func ipAddrAdd( + request: Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse + + /// Handle the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse` to respond with. + func ipRouteAddLink( + request: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse + + /// Handle the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse` to respond with. + func ipRouteAddDefault( + request: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse + + /// Handle the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse` to respond with. + func configureDns( + request: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse + + /// Handle the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse` to respond with. + func configureHosts( + request: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse + + /// Handle the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_SyncRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_SyncResponse` to respond with. + func sync( + request: Com_Apple_Containerization_Sandbox_V3_SyncRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SyncResponse + + /// Handle the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A `Com_Apple_Containerization_Sandbox_V3_KillRequest` message. + /// - context: Context providing information about the RPC. + /// - Throws: Any error which occurred during the processing of the request. Thrown errors + /// of type `RPCError` are mapped to appropriate statuses. All other errors are converted + /// to an internal error. + /// - Returns: A `Com_Apple_Containerization_Sandbox_V3_KillResponse` to respond with. + func kill( + request: Com_Apple_Containerization_Sandbox_V3_KillRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_KillResponse + } +} + +// Default implementation of 'registerMethods(with:)'. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext.StreamingServiceProtocol { + public func registerMethods(with router: inout GRPCCore.RPCRouter) where Transport: GRPCCore.ServerTransport { + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Mount.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.mount( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Umount.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.umount( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Setenv.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.setenv( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Getenv.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.getenv( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Mkdir.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.mkdir( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Sysctl.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.sysctl( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.SetTime.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.setTime( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.SetupEmulator.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.setupEmulator( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.WriteFile.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.writeFile( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Copy.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.copy( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Stat.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.stat( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.FilesystemOperation.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.filesystemOperation( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.CreateProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.createProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.DeleteProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.deleteProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.StartProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.startProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.KillProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.killProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.WaitProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.waitProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ResizeProcess.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.resizeProcess( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.CloseProcessStdin.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.closeProcessStdin( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ContainerStatistics.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.containerStatistics( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ProxyVsock.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.proxyVsock( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.StopVsockProxy.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.stopVsockProxy( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpLinkSet.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.ipLinkSet( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpAddrAdd.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.ipAddrAdd( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpRouteAddLink.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.ipRouteAddLink( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpRouteAddDefault.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.ipRouteAddDefault( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ConfigureDns.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.configureDns( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ConfigureHosts.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.configureHosts( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Sync.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.sync( + request: request, + context: context + ) + } + ) + router.registerHandler( + forMethod: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Kill.descriptor, + deserializer: GRPCProtobuf.ProtobufDeserializer(), + serializer: GRPCProtobuf.ProtobufSerializer(), + handler: { request, context in + try await self.kill( + request: request, + context: context + ) + } + ) + } +} + +// Default implementation of streaming methods from 'StreamingServiceProtocol'. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext.ServiceProtocol { + public func mount( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.mount( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func umount( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.umount( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func setenv( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.setenv( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func getenv( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.getenv( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func mkdir( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.mkdir( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func sysctl( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.sysctl( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func setTime( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.setTime( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func setupEmulator( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.setupEmulator( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func writeFile( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.writeFile( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func copy( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.copy( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return response + } + + public func stat( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.stat( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func filesystemOperation( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.filesystemOperation( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func createProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.createProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func deleteProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.deleteProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func startProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.startProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func killProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.killProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func waitProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.waitProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func resizeProcess( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.resizeProcess( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func closeProcessStdin( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.closeProcessStdin( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func containerStatistics( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.containerStatistics( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func proxyVsock( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.proxyVsock( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func stopVsockProxy( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.stopVsockProxy( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func ipLinkSet( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.ipLinkSet( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func ipAddrAdd( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.ipAddrAdd( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func ipRouteAddLink( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.ipRouteAddLink( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func ipRouteAddDefault( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.ipRouteAddDefault( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func configureDns( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.configureDns( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func configureHosts( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.configureHosts( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func sync( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.sync( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } + + public func kill( + request: GRPCCore.StreamingServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + let response = try await self.kill( + request: GRPCCore.ServerRequest(stream: request), + context: context + ) + return GRPCCore.StreamingServerResponse(single: response) + } +} + +// Default implementation of methods from 'ServiceProtocol'. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext.SimpleServiceProtocol { + public func mount( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.mount( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func umount( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.umount( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func setenv( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.setenv( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func getenv( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.getenv( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func mkdir( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.mkdir( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func sysctl( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.sysctl( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func setTime( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.setTime( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func setupEmulator( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.setupEmulator( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func writeFile( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.writeFile( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func copy( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.StreamingServerResponse { + return GRPCCore.StreamingServerResponse( + metadata: [:], + producer: { writer in + try await self.copy( + request: request.message, + response: writer, + context: context + ) + return [:] + } + ) + } + + public func stat( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.stat( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func filesystemOperation( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.filesystemOperation( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func createProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.createProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func deleteProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.deleteProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func startProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.startProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func killProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.killProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func waitProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.waitProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func resizeProcess( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.resizeProcess( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func closeProcessStdin( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.closeProcessStdin( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func containerStatistics( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.containerStatistics( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func proxyVsock( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.proxyVsock( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func stopVsockProxy( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.stopVsockProxy( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func ipLinkSet( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.ipLinkSet( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func ipAddrAdd( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.ipAddrAdd( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func ipRouteAddLink( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.ipRouteAddLink( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func ipRouteAddDefault( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.ipRouteAddDefault( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func configureDns( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.configureDns( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func configureHosts( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.configureHosts( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func sync( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.sync( + request: request.message, + context: context + ), + metadata: [:] + ) + } + + public func kill( + request: GRPCCore.ServerRequest, + context: GRPCCore.ServerContext + ) async throws -> GRPCCore.ServerResponse { + return GRPCCore.ServerResponse( + message: try await self.kill( + request: request.message, + context: context + ), + metadata: [:] + ) + } +} + +// MARK: com.apple.containerization.sandbox.v3.SandboxContext (client) + +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext { + /// Generated client protocol for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + /// + /// You don't need to implement this protocol directly, use the generated + /// implementation, ``Client``. + /// + /// > Source IDL Documentation: + /// > + /// > Context for interacting with a container's runtime environment. + public protocol ClientProtocol: Sendable { + /// Call the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MountRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_MountRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_MountResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func mount( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_UmountRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_UmountRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_UmountResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func umount( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetenvResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func setenv( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_GetenvResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func getenv( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_MkdirResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func mkdir( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SysctlResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func sysctl( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetTimeResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func setTime( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func setupEmulator( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_WriteFileResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func writeFile( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CopyRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CopyRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CopyResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func copy( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.StreamingClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StatRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StatRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StatResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func stat( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func filesystemOperation( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func createProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func deleteProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StartProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func startProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_KillProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func killProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func waitProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func resizeProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func closeProcessStdin( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func containerStatistics( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func proxyVsock( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func stopVsockProxy( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func ipLinkSet( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func ipAddrAdd( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func ipRouteAddLink( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func ipRouteAddDefault( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func configureDns( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func configureHosts( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SyncRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SyncRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SyncResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func sync( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + + /// Call the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_KillRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_KillResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + func kill( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable + } + + /// Generated client for the "com.apple.containerization.sandbox.v3.SandboxContext" service. + /// + /// The ``Client`` provides an implementation of ``ClientProtocol`` which wraps + /// a `GRPCCore.GRPCCClient`. The underlying `GRPCClient` provides the long-lived + /// means of communication with the remote peer. + /// + /// > Source IDL Documentation: + /// > + /// > Context for interacting with a container's runtime environment. + public struct Client: ClientProtocol where Transport: GRPCCore.ClientTransport { + private let client: GRPCCore.GRPCClient + + /// Creates a new client wrapping the provided `GRPCCore.GRPCClient`. + /// + /// - Parameters: + /// - client: A `GRPCCore.GRPCClient` providing a communication channel to the service. + public init(wrapping client: GRPCCore.GRPCClient) { + self.client = client + } + + /// Call the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MountRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_MountRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_MountResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mount( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Mount.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_UmountRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_UmountRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_UmountResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func umount( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Umount.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetenvResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setenv( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Setenv.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_GetenvResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func getenv( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Getenv.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_MkdirResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mkdir( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Mkdir.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SysctlResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sysctl( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Sysctl.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetTimeResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setTime( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.SetTime.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setupEmulator( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.SetupEmulator.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_WriteFileResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func writeFile( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.WriteFile.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CopyRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CopyRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CopyResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func copy( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.StreamingClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable { + try await self.client.serverStreaming( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Copy.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StatRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StatRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StatResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stat( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Stat.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func filesystemOperation( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.FilesystemOperation.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func createProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.CreateProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func deleteProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.DeleteProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StartProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func startProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.StartProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_KillProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func killProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.KillProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func waitProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.WaitProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func resizeProcess( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ResizeProcess.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func closeProcessStdin( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.CloseProcessStdin.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func containerStatistics( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ContainerStatistics.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func proxyVsock( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ProxyVsock.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stopVsockProxy( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.StopVsockProxy.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipLinkSet( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpLinkSet.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipAddrAdd( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpAddrAdd.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddLink( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpRouteAddLink.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddDefault( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.IpRouteAddDefault.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureDns( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ConfigureDns.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureHosts( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.ConfigureHosts.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SyncRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_SyncRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_SyncResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sync( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Sync.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillRequest` message. + /// - serializer: A serializer for `Com_Apple_Containerization_Sandbox_V3_KillRequest` messages. + /// - deserializer: A deserializer for `Com_Apple_Containerization_Sandbox_V3_KillResponse` messages. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func kill( + request: GRPCCore.ClientRequest, + serializer: some GRPCCore.MessageSerializer, + deserializer: some GRPCCore.MessageDeserializer, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.client.unary( + request: request, + descriptor: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Method.Kill.descriptor, + serializer: serializer, + deserializer: deserializer, + options: options, + onResponse: handleResponse + ) + } + } +} + +// Helpers providing default arguments to 'ClientProtocol' methods. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext.ClientProtocol { + /// Call the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MountRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mount( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.mount( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_UmountRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func umount( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.umount( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetenvRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setenv( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.setenv( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_GetenvRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func getenv( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.getenv( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_MkdirRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mkdir( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.mkdir( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SysctlRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sysctl( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.sysctl( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetTimeRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setTime( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.setTime( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setupEmulator( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.setupEmulator( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WriteFileRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func writeFile( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.writeFile( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CopyRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func copy( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.StreamingClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable { + try await self.copy( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StatRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stat( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.stat( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func filesystemOperation( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.filesystemOperation( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func createProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.createProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func deleteProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.deleteProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StartProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func startProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.startProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func killProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.killProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func waitProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.waitProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func resizeProcess( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.resizeProcess( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func closeProcessStdin( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.closeProcessStdin( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func containerStatistics( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.containerStatistics( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func proxyVsock( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.proxyVsock( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stopVsockProxy( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.stopVsockProxy( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipLinkSet( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.ipLinkSet( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipAddrAdd( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.ipAddrAdd( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddLink( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.ipRouteAddLink( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddDefault( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.ipRouteAddDefault( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureDns( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.configureDns( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureHosts( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.configureHosts( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_SyncRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sync( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.sync( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - request: A request containing a single `Com_Apple_Containerization_Sandbox_V3_KillRequest` message. + /// - options: Options to apply to this RPC. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func kill( + request: GRPCCore.ClientRequest, + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + try await self.kill( + request: request, + serializer: GRPCProtobuf.ProtobufSerializer(), + deserializer: GRPCProtobuf.ProtobufDeserializer(), + options: options, + onResponse: handleResponse + ) + } +} + +// Helpers providing sugared APIs for 'ClientProtocol' methods. +@available(macOS 15.0, iOS 18.0, watchOS 11.0, tvOS 18.0, visionOS 2.0, *) +extension Com_Apple_Containerization_Sandbox_V3_SandboxContext.ClientProtocol { + /// Call the "Mount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Mount a filesystem. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mount( + _ message: Com_Apple_Containerization_Sandbox_V3_MountRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.mount( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Umount" method. + /// + /// > Source IDL Documentation: + /// > + /// > Unmount a filesystem. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func umount( + _ message: Com_Apple_Containerization_Sandbox_V3_UmountRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.umount( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Setenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set an environment variable on the init process. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setenv( + _ message: Com_Apple_Containerization_Sandbox_V3_SetenvRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.setenv( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Getenv" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get an environment variable from the init process. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func getenv( + _ message: Com_Apple_Containerization_Sandbox_V3_GetenvRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.getenv( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Mkdir" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new directory inside the sandbox. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func mkdir( + _ message: Com_Apple_Containerization_Sandbox_V3_MkdirRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.mkdir( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sysctl" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set sysctls in the context of the sandbox. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sysctl( + _ message: Com_Apple_Containerization_Sandbox_V3_SysctlRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.sysctl( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetTime" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set time in the guest. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setTime( + _ message: Com_Apple_Containerization_Sandbox_V3_SetTimeRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.setTime( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "SetupEmulator" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set up an emulator in the guest for a specific binary format. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func setupEmulator( + _ message: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.setupEmulator( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WriteFile" method. + /// + /// > Source IDL Documentation: + /// > + /// > Write data to an existing or new file. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func writeFile( + _ message: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.writeFile( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Copy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Copy a file or directory between the host and guest. + /// > Data transfer happens over a dedicated vsock connection; + /// > the gRPC stream is used only for control/metadata. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func copy( + _ message: Com_Apple_Containerization_Sandbox_V3_CopyRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.StreamingClientResponse) async throws -> Result + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.copy( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Stat" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stat a path in the guest filesystem. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stat( + _ message: Com_Apple_Containerization_Sandbox_V3_StatRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.stat( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "FilesystemOperation" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform a filesystem operation on a mounted filesystem. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func filesystemOperation( + _ message: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.filesystemOperation( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CreateProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Create a new process inside the container. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func createProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.createProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "DeleteProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Delete an existing process inside the container. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func deleteProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.deleteProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StartProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Start the provided process. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func startProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_StartProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.startProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "KillProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to the provided process. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func killProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_KillProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.killProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "WaitProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Wait for a process to exit and return the exit code. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func waitProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.waitProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ResizeProcess" method. + /// + /// > Source IDL Documentation: + /// > + /// > Resize the tty of a given process. This will error if the process does + /// > not have a pty allocated. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func resizeProcess( + _ message: Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.resizeProcess( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "CloseProcessStdin" method. + /// + /// > Source IDL Documentation: + /// > + /// > Close IO for a given process. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func closeProcessStdin( + _ message: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.closeProcessStdin( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ContainerStatistics" method. + /// + /// > Source IDL Documentation: + /// > + /// > Get statistics for containers. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func containerStatistics( + _ message: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.containerStatistics( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ProxyVsock" method. + /// + /// > Source IDL Documentation: + /// > + /// > Proxy a vsock port to a unix domain socket in the guest, or vice versa. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func proxyVsock( + _ message: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.proxyVsock( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "StopVsockProxy" method. + /// + /// > Source IDL Documentation: + /// > + /// > Stop a vsock proxy to a unix domain socket. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func stopVsockProxy( + _ message: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.stopVsockProxy( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpLinkSet" method. + /// + /// > Source IDL Documentation: + /// > + /// > Set the link state of a network interface. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipLinkSet( + _ message: Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.ipLinkSet( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpAddrAdd" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IPv4 address to a network interface. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipAddrAdd( + _ message: Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.ipAddrAdd( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddLink" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddLink( + _ message: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.ipRouteAddLink( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "IpRouteAddDefault" method. + /// + /// > Source IDL Documentation: + /// > + /// > Add an IP route for a network interface. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func ipRouteAddDefault( + _ message: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.ipRouteAddDefault( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureDns" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure DNS resolver. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureDns( + _ message: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.configureDns( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "ConfigureHosts" method. + /// + /// > Source IDL Documentation: + /// > + /// > Configure /etc/hosts. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func configureHosts( + _ message: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.configureHosts( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Sync" method. + /// + /// > Source IDL Documentation: + /// > + /// > Perform the sync syscall. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func sync( + _ message: Com_Apple_Containerization_Sandbox_V3_SyncRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.sync( + request: request, + options: options, + onResponse: handleResponse + ) + } + + /// Call the "Kill" method. + /// + /// > Source IDL Documentation: + /// > + /// > Send a signal to a process via the PID. + /// + /// - Parameters: + /// - message: request message to send. + /// - metadata: Additional metadata to send, defaults to empty. + /// - options: Options to apply to this RPC, defaults to `.defaults`. + /// - handleResponse: A closure which handles the response, the result of which is + /// returned to the caller. Returning from the closure will cancel the RPC if it + /// hasn't already finished. + /// - Returns: The result of `handleResponse`. + public func kill( + _ message: Com_Apple_Containerization_Sandbox_V3_KillRequest, + metadata: GRPCCore.Metadata = [:], + options: GRPCCore.CallOptions = .defaults, + onResponse handleResponse: @Sendable @escaping (GRPCCore.ClientResponse) async throws -> Result = { response in + try response.message + } + ) async throws -> Result where Result: Sendable { + let request = GRPCCore.ClientRequest( + message: message, + metadata: metadata + ) + return try await self.kill( + request: request, + options: options, + onResponse: handleResponse + ) + } +} \ No newline at end of file diff --git a/Sources/Containerization/SandboxContext/SandboxContext.pb.swift b/Sources/Containerization/SandboxContext/SandboxContext.pb.swift new file mode 100644 index 0000000..9bce6b0 --- /dev/null +++ b/Sources/Containerization/SandboxContext/SandboxContext.pb.swift @@ -0,0 +1,4704 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// DO NOT EDIT. +// swift-format-ignore-file +// swiftlint:disable all +// +// Generated by the Swift generator plugin for the protocol buffer compiler. +// Source: SandboxContext.proto +// +// For information on using the generated types, please see the documentation: +// https://github.com/apple/swift-protobuf/ + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif +import SwiftProtobuf + +// If the compiler emits an error on this type, it is because this file +// was generated by a version of the `protoc` Swift plug-in that is +// incompatible with the version of SwiftProtobuf to which you are linking. +// Please ensure that you are building against the same version of the API +// that was used to generate this file. +fileprivate struct _GeneratedWithProtocGenSwiftVersion: SwiftProtobuf.ProtobufAPIVersionCheck { + struct _2: SwiftProtobuf.ProtobufAPIVersion_2 {} + typealias Version = _2 +} + +/// Categories of statistics that can be requested. +public enum Com_Apple_Containerization_Sandbox_V3_StatCategory: SwiftProtobuf.Enum, Swift.CaseIterable { + public typealias RawValue = Int + case unspecified // = 0 + case process // = 1 + case memory // = 2 + case cpu // = 3 + case blockIo // = 4 + case network // = 5 + case memoryEvents // = 6 + case UNRECOGNIZED(Int) + + public init() { + self = .unspecified + } + + public init?(rawValue: Int) { + switch rawValue { + case 0: self = .unspecified + case 1: self = .process + case 2: self = .memory + case 3: self = .cpu + case 4: self = .blockIo + case 5: self = .network + case 6: self = .memoryEvents + default: self = .UNRECOGNIZED(rawValue) + } + } + + public var rawValue: Int { + switch self { + case .unspecified: return 0 + case .process: return 1 + case .memory: return 2 + case .cpu: return 3 + case .blockIo: return 4 + case .network: return 5 + case .memoryEvents: return 6 + case .UNRECOGNIZED(let i): return i + } + } + + // The compiler won't synthesize support with the UNRECOGNIZED case. + public static let allCases: [Com_Apple_Containerization_Sandbox_V3_StatCategory] = [ + .unspecified, + .process, + .memory, + .cpu, + .blockIo, + .network, + .memoryEvents, + ] + +} + +public struct Com_Apple_Containerization_Sandbox_V3_Stdio: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var stdinPort: Int32 { + get {_stdinPort ?? 0} + set {_stdinPort = newValue} + } + /// Returns true if `stdinPort` has been explicitly set. + public var hasStdinPort: Bool {self._stdinPort != nil} + /// Clears the value of `stdinPort`. Subsequent reads from it will return its default value. + public mutating func clearStdinPort() {self._stdinPort = nil} + + public var stdoutPort: Int32 { + get {_stdoutPort ?? 0} + set {_stdoutPort = newValue} + } + /// Returns true if `stdoutPort` has been explicitly set. + public var hasStdoutPort: Bool {self._stdoutPort != nil} + /// Clears the value of `stdoutPort`. Subsequent reads from it will return its default value. + public mutating func clearStdoutPort() {self._stdoutPort = nil} + + public var stderrPort: Int32 { + get {_stderrPort ?? 0} + set {_stderrPort = newValue} + } + /// Returns true if `stderrPort` has been explicitly set. + public var hasStderrPort: Bool {self._stderrPort != nil} + /// Clears the value of `stderrPort`. Subsequent reads from it will return its default value. + public mutating func clearStderrPort() {self._stderrPort = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _stdinPort: Int32? = nil + fileprivate var _stdoutPort: Int32? = nil + fileprivate var _stderrPort: Int32? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var binaryPath: String = String() + + public var name: String = String() + + public var type: String = String() + + public var offset: String = String() + + public var magic: String = String() + + public var mask: String = String() + + public var flags: String = String() + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetTimeRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var sec: Int64 = 0 + + public var usec: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetTimeResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SysctlRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var settings: Dictionary = [:] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SysctlResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var vsockPort: UInt32 = 0 + + public var guestPath: String = String() + + public var guestSocketPermissions: UInt32 { + get {_guestSocketPermissions ?? 0} + set {_guestSocketPermissions = newValue} + } + /// Returns true if `guestSocketPermissions` has been explicitly set. + public var hasGuestSocketPermissions: Bool {self._guestSocketPermissions != nil} + /// Clears the value of `guestSocketPermissions`. Subsequent reads from it will return its default value. + public mutating func clearGuestSocketPermissions() {self._guestSocketPermissions = nil} + + public var action: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest.Action = .into + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum Action: SwiftProtobuf.Enum, Swift.CaseIterable { + public typealias RawValue = Int + case into // = 0 + case outOf // = 1 + case UNRECOGNIZED(Int) + + public init() { + self = .into + } + + public init?(rawValue: Int) { + switch rawValue { + case 0: self = .into + case 1: self = .outOf + default: self = .UNRECOGNIZED(rawValue) + } + } + + public var rawValue: Int { + switch self { + case .into: return 0 + case .outOf: return 1 + case .UNRECOGNIZED(let i): return i + } + } + + // The compiler won't synthesize support with the UNRECOGNIZED case. + public static let allCases: [Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest.Action] = [ + .into, + .outOf, + ] + + } + + public init() {} + + fileprivate var _guestSocketPermissions: UInt32? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_MountRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var type: String = String() + + public var source: String = String() + + public var destination: String = String() + + public var options: [String] = [] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_MountResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_UmountRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var path: String = String() + + public var flags: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_UmountResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetenvRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var key: String = String() + + public var value: String { + get {_value ?? String()} + set {_value = newValue} + } + /// Returns true if `value` has been explicitly set. + public var hasValue: Bool {self._value != nil} + /// Clears the value of `value`. Subsequent reads from it will return its default value. + public mutating func clearValue() {self._value = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _value: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_SetenvResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_GetenvRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var key: String = String() + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_GetenvResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var value: String { + get {_value ?? String()} + set {_value = newValue} + } + /// Returns true if `value` has been explicitly set. + public var hasValue: Bool {self._value != nil} + /// Clears the value of `value`. Subsequent reads from it will return its default value. + public mutating func clearValue() {self._value = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _value: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var stdin: UInt32 { + get {_stdin ?? 0} + set {_stdin = newValue} + } + /// Returns true if `stdin` has been explicitly set. + public var hasStdin: Bool {self._stdin != nil} + /// Clears the value of `stdin`. Subsequent reads from it will return its default value. + public mutating func clearStdin() {self._stdin = nil} + + public var stdout: UInt32 { + get {_stdout ?? 0} + set {_stdout = newValue} + } + /// Returns true if `stdout` has been explicitly set. + public var hasStdout: Bool {self._stdout != nil} + /// Clears the value of `stdout`. Subsequent reads from it will return its default value. + public mutating func clearStdout() {self._stdout = nil} + + public var stderr: UInt32 { + get {_stderr ?? 0} + set {_stderr = newValue} + } + /// Returns true if `stderr` has been explicitly set. + public var hasStderr: Bool {self._stderr != nil} + /// Clears the value of `stderr`. Subsequent reads from it will return its default value. + public mutating func clearStderr() {self._stderr = nil} + + public var ociRuntimePath: String { + get {_ociRuntimePath ?? String()} + set {_ociRuntimePath = newValue} + } + /// Returns true if `ociRuntimePath` has been explicitly set. + public var hasOciRuntimePath: Bool {self._ociRuntimePath != nil} + /// Clears the value of `ociRuntimePath`. Subsequent reads from it will return its default value. + public mutating func clearOciRuntimePath() {self._ociRuntimePath = nil} + + public var configuration: Data = Data() + + public var options: Data { + get {_options ?? Data()} + set {_options = newValue} + } + /// Returns true if `options` has been explicitly set. + public var hasOptions: Bool {self._options != nil} + /// Clears the value of `options`. Subsequent reads from it will return its default value. + public mutating func clearOptions() {self._options = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil + fileprivate var _stdin: UInt32? = nil + fileprivate var _stdout: UInt32? = nil + fileprivate var _stderr: UInt32? = nil + fileprivate var _ociRuntimePath: String? = nil + fileprivate var _options: Data? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var exitCode: Int32 = 0 + + public var exitedAt: SwiftProtobuf.Google_Protobuf_Timestamp { + get {_exitedAt ?? SwiftProtobuf.Google_Protobuf_Timestamp()} + set {_exitedAt = newValue} + } + /// Returns true if `exitedAt` has been explicitly set. + public var hasExitedAt: Bool {self._exitedAt != nil} + /// Clears the value of `exitedAt`. Subsequent reads from it will return its default value. + public mutating func clearExitedAt() {self._exitedAt = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _exitedAt: SwiftProtobuf.Google_Protobuf_Timestamp? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var rows: UInt32 = 0 + + public var columns: UInt32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_StartProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_StartProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var pid: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_KillProcessRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var signal: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_KillProcessResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var result: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var id: String = String() + + public var containerID: String { + get {_containerID ?? String()} + set {_containerID = newValue} + } + /// Returns true if `containerID` has been explicitly set. + public var hasContainerID: Bool {self._containerID != nil} + /// Clears the value of `containerID`. Subsequent reads from it will return its default value. + public mutating func clearContainerID() {self._containerID = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _containerID: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_MkdirRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var path: String = String() + + public var all: Bool = false + + public var perms: UInt32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_MkdirResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_WriteFileRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var path: String = String() + + public var data: Data = Data() + + public var mode: UInt32 = 0 + + public var flags: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags { + get {_flags ?? Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags()} + set {_flags = newValue} + } + /// Returns true if `flags` has been explicitly set. + public var hasFlags: Bool {self._flags != nil} + /// Clears the value of `flags`. Subsequent reads from it will return its default value. + public mutating func clearFlags() {self._flags = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public struct WriteFileFlags: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var createParentDirs: Bool = false + + public var append: Bool = false + + public var createIfMissing: Bool = false + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + } + + public init() {} + + fileprivate var _flags: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_WriteFileResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_CopyRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + /// Direction of the copy operation. + public var direction: Com_Apple_Containerization_Sandbox_V3_CopyRequest.Direction = .copyIn + + /// Path in the guest (destination for COPY_IN, source for COPY_OUT). + public var path: String = String() + + /// File mode for single-file COPY_IN (defaults to 0644 if not set). + public var mode: UInt32 = 0 + + /// Create parent directories if they don't exist. + public var createParents: Bool = false + + /// Vsock port the host is listening on for data transfer. + public var vsockPort: UInt32 = 0 + + /// For COPY_IN: indicates the data arriving on vsock is a tar+gzip archive. + public var isArchive: Bool = false + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum Direction: SwiftProtobuf.Enum, Swift.CaseIterable { + public typealias RawValue = Int + + /// Copy from host into guest. + case copyIn // = 0 + + /// Copy from guest to host. + case copyOut // = 1 + case UNRECOGNIZED(Int) + + public init() { + self = .copyIn + } + + public init?(rawValue: Int) { + switch rawValue { + case 0: self = .copyIn + case 1: self = .copyOut + default: self = .UNRECOGNIZED(rawValue) + } + } + + public var rawValue: Int { + switch self { + case .copyIn: return 0 + case .copyOut: return 1 + case .UNRECOGNIZED(let i): return i + } + } + + // The compiler won't synthesize support with the UNRECOGNIZED case. + public static let allCases: [Com_Apple_Containerization_Sandbox_V3_CopyRequest.Direction] = [ + .copyIn, + .copyOut, + ] + + } + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_CopyResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + /// What this response represents. + public var status: Com_Apple_Containerization_Sandbox_V3_CopyResponse.Status = .metadata + + /// For COPY_OUT METADATA: indicates the data on vsock will be a tar+gzip archive. + public var isArchive: Bool = false + + /// For COPY_OUT METADATA: total size in bytes (0 if unknown, e.g. for archives). + public var totalSize: UInt64 = 0 + + /// Non-empty if an error occurred. + public var error: String = String() + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum Status: SwiftProtobuf.Enum, Swift.CaseIterable { + public typealias RawValue = Int + + /// Transfer metadata (first message for COPY_OUT: is_archive, total_size). + case metadata // = 0 + + /// Data transfer completed successfully. + case complete // = 1 + case UNRECOGNIZED(Int) + + public init() { + self = .metadata + } + + public init?(rawValue: Int) { + switch rawValue { + case 0: self = .metadata + case 1: self = .complete + default: self = .UNRECOGNIZED(rawValue) + } + } + + public var rawValue: Int { + switch self { + case .metadata: return 0 + case .complete: return 1 + case .UNRECOGNIZED(let i): return i + } + } + + // The compiler won't synthesize support with the UNRECOGNIZED case. + public static let allCases: [Com_Apple_Containerization_Sandbox_V3_CopyResponse.Status] = [ + .metadata, + .complete, + ] + + } + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_StatRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var path: String = String() + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_Stat: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + /// st_dev: ID of device containing file + public var dev: UInt64 = 0 + + /// st_ino: inode number + public var ino: UInt64 = 0 + + /// st_mode: file type and mode (permissions) + public var mode: UInt32 = 0 + + /// st_nlink: number of hard links + public var nlink: UInt64 = 0 + + /// st_uid: user ID of owner + public var uid: UInt32 = 0 + + /// st_gid: group ID of owner + public var gid: UInt32 = 0 + + /// st_rdev: device ID (if special file) + public var rdev: UInt64 = 0 + + /// st_size: total size in bytes + public var size: Int64 = 0 + + /// st_blksize: preferred block size for filesystem I/O + public var blksize: Int64 = 0 + + /// st_blocks: number of 512-byte blocks allocated + public var blocks: Int64 = 0 + + /// st_atim: time of last access + public var atime: SwiftProtobuf.Google_Protobuf_Timestamp { + get {_atime ?? SwiftProtobuf.Google_Protobuf_Timestamp()} + set {_atime = newValue} + } + /// Returns true if `atime` has been explicitly set. + public var hasAtime: Bool {self._atime != nil} + /// Clears the value of `atime`. Subsequent reads from it will return its default value. + public mutating func clearAtime() {self._atime = nil} + + /// st_mtim: time of last modification + public var mtime: SwiftProtobuf.Google_Protobuf_Timestamp { + get {_mtime ?? SwiftProtobuf.Google_Protobuf_Timestamp()} + set {_mtime = newValue} + } + /// Returns true if `mtime` has been explicitly set. + public var hasMtime: Bool {self._mtime != nil} + /// Clears the value of `mtime`. Subsequent reads from it will return its default value. + public mutating func clearMtime() {self._mtime = nil} + + /// st_ctim: time of last status change + public var ctime: SwiftProtobuf.Google_Protobuf_Timestamp { + get {_ctime ?? SwiftProtobuf.Google_Protobuf_Timestamp()} + set {_ctime = newValue} + } + /// Returns true if `ctime` has been explicitly set. + public var hasCtime: Bool {self._ctime != nil} + /// Clears the value of `ctime`. Subsequent reads from it will return its default value. + public mutating func clearCtime() {self._ctime = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _atime: SwiftProtobuf.Google_Protobuf_Timestamp? = nil + fileprivate var _mtime: SwiftProtobuf.Google_Protobuf_Timestamp? = nil + fileprivate var _ctime: SwiftProtobuf.Google_Protobuf_Timestamp? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_StatResponse: @unchecked Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var stat: Com_Apple_Containerization_Sandbox_V3_Stat { + get {_storage._stat ?? Com_Apple_Containerization_Sandbox_V3_Stat()} + set {_uniqueStorage()._stat = newValue} + } + /// Returns true if `stat` has been explicitly set. + public var hasStat: Bool {_storage._stat != nil} + /// Clears the value of `stat`. Subsequent reads from it will return its default value. + public mutating func clearStat() {_uniqueStorage()._stat = nil} + + /// Non-empty if stat failed. + public var error: String { + get {_storage._error} + set {_uniqueStorage()._error = newValue} + } + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _storage = _StorageClass.defaultInstance +} + +public struct Com_Apple_Containerization_Sandbox_V3_FiTrimParams: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var schedule: Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneOf_Schedule? = nil + + public var oneShot: Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot { + get { + if case .oneShot(let v)? = schedule {return v} + return Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot() + } + set {schedule = .oneShot(newValue)} + } + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum OneOf_Schedule: Equatable, Sendable { + case oneShot(Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot) + + } + + public struct OneShot: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + } + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_FiFreezeParams: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_FiThawParams: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_FiTrimResult: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var trimmedBytes: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var path: String = String() + + public var operation: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest.OneOf_Operation? = nil + + public var trim: Com_Apple_Containerization_Sandbox_V3_FiTrimParams { + get { + if case .trim(let v)? = operation {return v} + return Com_Apple_Containerization_Sandbox_V3_FiTrimParams() + } + set {operation = .trim(newValue)} + } + + public var freeze: Com_Apple_Containerization_Sandbox_V3_FiFreezeParams { + get { + if case .freeze(let v)? = operation {return v} + return Com_Apple_Containerization_Sandbox_V3_FiFreezeParams() + } + set {operation = .freeze(newValue)} + } + + public var thaw: Com_Apple_Containerization_Sandbox_V3_FiThawParams { + get { + if case .thaw(let v)? = operation {return v} + return Com_Apple_Containerization_Sandbox_V3_FiThawParams() + } + set {operation = .thaw(newValue)} + } + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum OneOf_Operation: Equatable, Sendable { + case trim(Com_Apple_Containerization_Sandbox_V3_FiTrimParams) + case freeze(Com_Apple_Containerization_Sandbox_V3_FiFreezeParams) + case thaw(Com_Apple_Containerization_Sandbox_V3_FiThawParams) + + } + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var result: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse.OneOf_Result? = nil + + public var trim: Com_Apple_Containerization_Sandbox_V3_FiTrimResult { + get { + if case .trim(let v)? = result {return v} + return Com_Apple_Containerization_Sandbox_V3_FiTrimResult() + } + set {result = .trim(newValue)} + } + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public enum OneOf_Result: Equatable, Sendable { + case trim(Com_Apple_Containerization_Sandbox_V3_FiTrimResult) + + } + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var interface: String = String() + + public var up: Bool = false + + public var mtu: UInt32 { + get {_mtu ?? 0} + set {_mtu = newValue} + } + /// Returns true if `mtu` has been explicitly set. + public var hasMtu: Bool {self._mtu != nil} + /// Clears the value of `mtu`. Subsequent reads from it will return its default value. + public mutating func clearMtu() {self._mtu = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _mtu: UInt32? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var interface: String = String() + + public var ipv4Address: String = String() + + public var ipv6Address: String { + get {_ipv6Address ?? String()} + set {_ipv6Address = newValue} + } + /// Returns true if `ipv6Address` has been explicitly set. + public var hasIpv6Address: Bool {self._ipv6Address != nil} + /// Clears the value of `ipv6Address`. Subsequent reads from it will return its default value. + public mutating func clearIpv6Address() {self._ipv6Address = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _ipv6Address: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var interface: String = String() + + public var dstIpv4Addr: String = String() + + public var srcIpv4Addr: String = String() + + public var dstIpv6Addr: String { + get {_dstIpv6Addr ?? String()} + set {_dstIpv6Addr = newValue} + } + /// Returns true if `dstIpv6Addr` has been explicitly set. + public var hasDstIpv6Addr: Bool {self._dstIpv6Addr != nil} + /// Clears the value of `dstIpv6Addr`. Subsequent reads from it will return its default value. + public mutating func clearDstIpv6Addr() {self._dstIpv6Addr = nil} + + public var srcIpv6Addr: String { + get {_srcIpv6Addr ?? String()} + set {_srcIpv6Addr = newValue} + } + /// Returns true if `srcIpv6Addr` has been explicitly set. + public var hasSrcIpv6Addr: Bool {self._srcIpv6Addr != nil} + /// Clears the value of `srcIpv6Addr`. Subsequent reads from it will return its default value. + public mutating func clearSrcIpv6Addr() {self._srcIpv6Addr = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _dstIpv6Addr: String? = nil + fileprivate var _srcIpv6Addr: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var interface: String = String() + + public var ipv4Gateway: String = String() + + public var ipv6Gateway: String { + get {_ipv6Gateway ?? String()} + set {_ipv6Gateway = newValue} + } + /// Returns true if `ipv6Gateway` has been explicitly set. + public var hasIpv6Gateway: Bool {self._ipv6Gateway != nil} + /// Clears the value of `ipv6Gateway`. Subsequent reads from it will return its default value. + public mutating func clearIpv6Gateway() {self._ipv6Gateway = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _ipv6Gateway: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var location: String = String() + + public var nameservers: [String] = [] + + public var domain: String { + get {_domain ?? String()} + set {_domain = newValue} + } + /// Returns true if `domain` has been explicitly set. + public var hasDomain: Bool {self._domain != nil} + /// Clears the value of `domain`. Subsequent reads from it will return its default value. + public mutating func clearDomain() {self._domain = nil} + + public var searchDomains: [String] = [] + + public var options: [String] = [] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _domain: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var location: String = String() + + public var entries: [Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.HostsEntry] = [] + + public var comment: String { + get {_comment ?? String()} + set {_comment = newValue} + } + /// Returns true if `comment` has been explicitly set. + public var hasComment: Bool {self._comment != nil} + /// Clears the value of `comment`. Subsequent reads from it will return its default value. + public mutating func clearComment() {self._comment = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public struct HostsEntry: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var ipAddress: String = String() + + public var hostnames: [String] = [] + + public var comment: String { + get {_comment ?? String()} + set {_comment = newValue} + } + /// Returns true if `comment` has been explicitly set. + public var hasComment: Bool {self._comment != nil} + /// Clears the value of `comment`. Subsequent reads from it will return its default value. + public mutating func clearComment() {self._comment = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _comment: String? = nil + } + + public init() {} + + fileprivate var _comment: String? = nil +} + +public struct Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SyncRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_SyncResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_KillRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var pid: Int32 = 0 + + public var signal: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_KillResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var result: Int32 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + /// Empty = all containers + public var containerIds: [String] = [] + + /// Empty = all categories + public var categories: [Com_Apple_Containerization_Sandbox_V3_StatCategory] = [] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var containers: [Com_Apple_Containerization_Sandbox_V3_ContainerStats] = [] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_ContainerStats: @unchecked Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var containerID: String { + get {_storage._containerID} + set {_uniqueStorage()._containerID = newValue} + } + + public var process: Com_Apple_Containerization_Sandbox_V3_ProcessStats { + get {_storage._process ?? Com_Apple_Containerization_Sandbox_V3_ProcessStats()} + set {_uniqueStorage()._process = newValue} + } + /// Returns true if `process` has been explicitly set. + public var hasProcess: Bool {_storage._process != nil} + /// Clears the value of `process`. Subsequent reads from it will return its default value. + public mutating func clearProcess() {_uniqueStorage()._process = nil} + + public var memory: Com_Apple_Containerization_Sandbox_V3_MemoryStats { + get {_storage._memory ?? Com_Apple_Containerization_Sandbox_V3_MemoryStats()} + set {_uniqueStorage()._memory = newValue} + } + /// Returns true if `memory` has been explicitly set. + public var hasMemory: Bool {_storage._memory != nil} + /// Clears the value of `memory`. Subsequent reads from it will return its default value. + public mutating func clearMemory() {_uniqueStorage()._memory = nil} + + public var cpu: Com_Apple_Containerization_Sandbox_V3_CPUStats { + get {_storage._cpu ?? Com_Apple_Containerization_Sandbox_V3_CPUStats()} + set {_uniqueStorage()._cpu = newValue} + } + /// Returns true if `cpu` has been explicitly set. + public var hasCpu: Bool {_storage._cpu != nil} + /// Clears the value of `cpu`. Subsequent reads from it will return its default value. + public mutating func clearCpu() {_uniqueStorage()._cpu = nil} + + public var blockIo: Com_Apple_Containerization_Sandbox_V3_BlockIOStats { + get {_storage._blockIo ?? Com_Apple_Containerization_Sandbox_V3_BlockIOStats()} + set {_uniqueStorage()._blockIo = newValue} + } + /// Returns true if `blockIo` has been explicitly set. + public var hasBlockIo: Bool {_storage._blockIo != nil} + /// Clears the value of `blockIo`. Subsequent reads from it will return its default value. + public mutating func clearBlockIo() {_uniqueStorage()._blockIo = nil} + + public var networks: [Com_Apple_Containerization_Sandbox_V3_NetworkStats] { + get {_storage._networks} + set {_uniqueStorage()._networks = newValue} + } + + public var memoryEvents: Com_Apple_Containerization_Sandbox_V3_MemoryEventStats { + get {_storage._memoryEvents ?? Com_Apple_Containerization_Sandbox_V3_MemoryEventStats()} + set {_uniqueStorage()._memoryEvents = newValue} + } + /// Returns true if `memoryEvents` has been explicitly set. + public var hasMemoryEvents: Bool {_storage._memoryEvents != nil} + /// Clears the value of `memoryEvents`. Subsequent reads from it will return its default value. + public mutating func clearMemoryEvents() {_uniqueStorage()._memoryEvents = nil} + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} + + fileprivate var _storage = _StorageClass.defaultInstance +} + +public struct Com_Apple_Containerization_Sandbox_V3_ProcessStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var current: UInt64 = 0 + + /// 0 or max value = unlimited + public var limit: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_MemoryStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var usageBytes: UInt64 = 0 + + public var limitBytes: UInt64 = 0 + + public var swapUsageBytes: UInt64 = 0 + + public var swapLimitBytes: UInt64 = 0 + + public var cacheBytes: UInt64 = 0 + + public var kernelStackBytes: UInt64 = 0 + + public var slabBytes: UInt64 = 0 + + public var pageFaults: UInt64 = 0 + + public var majorPageFaults: UInt64 = 0 + + public var inactiveFile: UInt64 = 0 + + public var anon: UInt64 = 0 + + public var workingsetRefaultAnon: UInt64 = 0 + + public var workingsetRefaultFile: UInt64 = 0 + + public var pgstealKswapd: UInt64 = 0 + + public var pgstealDirect: UInt64 = 0 + + public var pgstealKhugepaged: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_CPUStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var usageUsec: UInt64 = 0 + + public var userUsec: UInt64 = 0 + + public var systemUsec: UInt64 = 0 + + public var throttlingPeriods: UInt64 = 0 + + public var throttledPeriods: UInt64 = 0 + + public var throttledTimeUsec: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_BlockIOStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var devices: [Com_Apple_Containerization_Sandbox_V3_BlockIOEntry] = [] + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_BlockIOEntry: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var major: UInt64 = 0 + + public var minor: UInt64 = 0 + + public var readBytes: UInt64 = 0 + + public var writeBytes: UInt64 = 0 + + public var readOperations: UInt64 = 0 + + public var writeOperations: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +public struct Com_Apple_Containerization_Sandbox_V3_NetworkStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + public var interface: String = String() + + public var receivedPackets: UInt64 = 0 + + public var transmittedPackets: UInt64 = 0 + + public var receivedBytes: UInt64 = 0 + + public var transmittedBytes: UInt64 = 0 + + public var receivedErrors: UInt64 = 0 + + public var transmittedErrors: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +/// Memory event counters from cgroup2's memory.events file. +public struct Com_Apple_Containerization_Sandbox_V3_MemoryEventStats: Sendable { + // SwiftProtobuf.Message conformance is added in an extension below. See the + // `Message` and `Message+*Additions` files in the SwiftProtobuf library for + // methods supported on all messages. + + /// Number of times the cgroup was reclaimed due to low memory. + public var low: UInt64 = 0 + + /// Number of times the cgroup exceeded its high memory limit. + public var high: UInt64 = 0 + + /// Number of times the cgroup hit its max memory limit. + public var max: UInt64 = 0 + + /// Number of times the cgroup triggered OOM. + public var oom: UInt64 = 0 + + /// Number of processes killed by OOM killer. + public var oomKill: UInt64 = 0 + + /// Number of times charge for memory failed because of limit. + public var oomGroupKill: UInt64 = 0 + + public var unknownFields = SwiftProtobuf.UnknownStorage() + + public init() {} +} + +// MARK: - Code below here is support for the SwiftProtobuf runtime. + +fileprivate let _protobuf_package = "com.apple.containerization.sandbox.v3" + +extension Com_Apple_Containerization_Sandbox_V3_StatCategory: SwiftProtobuf._ProtoNameProviding { + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{2}\0STAT_CATEGORY_UNSPECIFIED\0\u{1}STAT_CATEGORY_PROCESS\0\u{1}STAT_CATEGORY_MEMORY\0\u{1}STAT_CATEGORY_CPU\0\u{1}STAT_CATEGORY_BLOCK_IO\0\u{1}STAT_CATEGORY_NETWORK\0\u{1}STAT_CATEGORY_MEMORY_EVENTS\0") +} + +extension Com_Apple_Containerization_Sandbox_V3_Stdio: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".Stdio" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}stdinPort\0\u{1}stdoutPort\0\u{1}stderrPort\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self._stdinPort) }() + case 2: try { try decoder.decodeSingularInt32Field(value: &self._stdoutPort) }() + case 3: try { try decoder.decodeSingularInt32Field(value: &self._stderrPort) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + try { if let v = self._stdinPort { + try visitor.visitSingularInt32Field(value: v, fieldNumber: 1) + } }() + try { if let v = self._stdoutPort { + try visitor.visitSingularInt32Field(value: v, fieldNumber: 2) + } }() + try { if let v = self._stderrPort { + try visitor.visitSingularInt32Field(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_Stdio, rhs: Com_Apple_Containerization_Sandbox_V3_Stdio) -> Bool { + if lhs._stdinPort != rhs._stdinPort {return false} + if lhs._stdoutPort != rhs._stdoutPort {return false} + if lhs._stderrPort != rhs._stderrPort {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetupEmulatorRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}binary_path\0\u{1}name\0\u{1}type\0\u{1}offset\0\u{1}magic\0\u{1}mask\0\u{1}flags\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.binaryPath) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.name) }() + case 3: try { try decoder.decodeSingularStringField(value: &self.type) }() + case 4: try { try decoder.decodeSingularStringField(value: &self.offset) }() + case 5: try { try decoder.decodeSingularStringField(value: &self.magic) }() + case 6: try { try decoder.decodeSingularStringField(value: &self.mask) }() + case 7: try { try decoder.decodeSingularStringField(value: &self.flags) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.binaryPath.isEmpty { + try visitor.visitSingularStringField(value: self.binaryPath, fieldNumber: 1) + } + if !self.name.isEmpty { + try visitor.visitSingularStringField(value: self.name, fieldNumber: 2) + } + if !self.type.isEmpty { + try visitor.visitSingularStringField(value: self.type, fieldNumber: 3) + } + if !self.offset.isEmpty { + try visitor.visitSingularStringField(value: self.offset, fieldNumber: 4) + } + if !self.magic.isEmpty { + try visitor.visitSingularStringField(value: self.magic, fieldNumber: 5) + } + if !self.mask.isEmpty { + try visitor.visitSingularStringField(value: self.mask, fieldNumber: 6) + } + if !self.flags.isEmpty { + try visitor.visitSingularStringField(value: self.flags, fieldNumber: 7) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest, rhs: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest) -> Bool { + if lhs.binaryPath != rhs.binaryPath {return false} + if lhs.name != rhs.name {return false} + if lhs.type != rhs.type {return false} + if lhs.offset != rhs.offset {return false} + if lhs.magic != rhs.magic {return false} + if lhs.mask != rhs.mask {return false} + if lhs.flags != rhs.flags {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetupEmulatorResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse, rhs: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetTimeRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetTimeRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}sec\0\u{1}usec\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt64Field(value: &self.sec) }() + case 2: try { try decoder.decodeSingularInt32Field(value: &self.usec) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.sec != 0 { + try visitor.visitSingularInt64Field(value: self.sec, fieldNumber: 1) + } + if self.usec != 0 { + try visitor.visitSingularInt32Field(value: self.usec, fieldNumber: 2) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetTimeRequest, rhs: Com_Apple_Containerization_Sandbox_V3_SetTimeRequest) -> Bool { + if lhs.sec != rhs.sec {return false} + if lhs.usec != rhs.usec {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetTimeResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetTimeResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetTimeResponse, rhs: Com_Apple_Containerization_Sandbox_V3_SetTimeResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SysctlRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SysctlRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}settings\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeMapField(fieldType: SwiftProtobuf._ProtobufMap.self, value: &self.settings) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.settings.isEmpty { + try visitor.visitMapField(fieldType: SwiftProtobuf._ProtobufMap.self, value: self.settings, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SysctlRequest, rhs: Com_Apple_Containerization_Sandbox_V3_SysctlRequest) -> Bool { + if lhs.settings != rhs.settings {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SysctlResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SysctlResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SysctlResponse, rhs: Com_Apple_Containerization_Sandbox_V3_SysctlResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ProxyVsockRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{3}vsock_port\0\u{1}guestPath\0\u{1}guestSocketPermissions\0\u{1}action\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularUInt32Field(value: &self.vsockPort) }() + case 3: try { try decoder.decodeSingularStringField(value: &self.guestPath) }() + case 4: try { try decoder.decodeSingularUInt32Field(value: &self._guestSocketPermissions) }() + case 5: try { try decoder.decodeSingularEnumField(value: &self.action) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + if self.vsockPort != 0 { + try visitor.visitSingularUInt32Field(value: self.vsockPort, fieldNumber: 2) + } + if !self.guestPath.isEmpty { + try visitor.visitSingularStringField(value: self.guestPath, fieldNumber: 3) + } + try { if let v = self._guestSocketPermissions { + try visitor.visitSingularUInt32Field(value: v, fieldNumber: 4) + } }() + if self.action != .into { + try visitor.visitSingularEnumField(value: self.action, fieldNumber: 5) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest, rhs: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs.vsockPort != rhs.vsockPort {return false} + if lhs.guestPath != rhs.guestPath {return false} + if lhs._guestSocketPermissions != rhs._guestSocketPermissions {return false} + if lhs.action != rhs.action {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest.Action: SwiftProtobuf._ProtoNameProviding { + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{2}\0INTO\0\u{1}OUT_OF\0") +} + +extension Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ProxyVsockResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse, rhs: Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StopVsockProxyRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest, rhs: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StopVsockProxyResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse, rhs: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MountRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MountRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}type\0\u{1}source\0\u{1}destination\0\u{1}options\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.type) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.source) }() + case 3: try { try decoder.decodeSingularStringField(value: &self.destination) }() + case 4: try { try decoder.decodeRepeatedStringField(value: &self.options) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.type.isEmpty { + try visitor.visitSingularStringField(value: self.type, fieldNumber: 1) + } + if !self.source.isEmpty { + try visitor.visitSingularStringField(value: self.source, fieldNumber: 2) + } + if !self.destination.isEmpty { + try visitor.visitSingularStringField(value: self.destination, fieldNumber: 3) + } + if !self.options.isEmpty { + try visitor.visitRepeatedStringField(value: self.options, fieldNumber: 4) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MountRequest, rhs: Com_Apple_Containerization_Sandbox_V3_MountRequest) -> Bool { + if lhs.type != rhs.type {return false} + if lhs.source != rhs.source {return false} + if lhs.destination != rhs.destination {return false} + if lhs.options != rhs.options {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MountResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MountResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MountResponse, rhs: Com_Apple_Containerization_Sandbox_V3_MountResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_UmountRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".UmountRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}path\0\u{1}flags\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.path) }() + case 2: try { try decoder.decodeSingularInt32Field(value: &self.flags) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 1) + } + if self.flags != 0 { + try visitor.visitSingularInt32Field(value: self.flags, fieldNumber: 2) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_UmountRequest, rhs: Com_Apple_Containerization_Sandbox_V3_UmountRequest) -> Bool { + if lhs.path != rhs.path {return false} + if lhs.flags != rhs.flags {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_UmountResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".UmountResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_UmountResponse, rhs: Com_Apple_Containerization_Sandbox_V3_UmountResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetenvRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetenvRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}key\0\u{1}value\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.key) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._value) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.key.isEmpty { + try visitor.visitSingularStringField(value: self.key, fieldNumber: 1) + } + try { if let v = self._value { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetenvRequest, rhs: Com_Apple_Containerization_Sandbox_V3_SetenvRequest) -> Bool { + if lhs.key != rhs.key {return false} + if lhs._value != rhs._value {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SetenvResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SetenvResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SetenvResponse, rhs: Com_Apple_Containerization_Sandbox_V3_SetenvResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_GetenvRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".GetenvRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}key\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.key) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.key.isEmpty { + try visitor.visitSingularStringField(value: self.key, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_GetenvRequest, rhs: Com_Apple_Containerization_Sandbox_V3_GetenvRequest) -> Bool { + if lhs.key != rhs.key {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_GetenvResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".GetenvResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}value\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self._value) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + try { if let v = self._value { + try visitor.visitSingularStringField(value: v, fieldNumber: 1) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_GetenvResponse, rhs: Com_Apple_Containerization_Sandbox_V3_GetenvResponse) -> Bool { + if lhs._value != rhs._value {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CreateProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0\u{1}stdin\0\u{1}stdout\0\u{1}stderr\0\u{1}ociRuntimePath\0\u{1}configuration\0\u{1}options\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self._stdin) }() + case 4: try { try decoder.decodeSingularUInt32Field(value: &self._stdout) }() + case 5: try { try decoder.decodeSingularUInt32Field(value: &self._stderr) }() + case 6: try { try decoder.decodeSingularStringField(value: &self._ociRuntimePath) }() + case 7: try { try decoder.decodeSingularBytesField(value: &self.configuration) }() + case 8: try { try decoder.decodeSingularBytesField(value: &self._options) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try { if let v = self._stdin { + try visitor.visitSingularUInt32Field(value: v, fieldNumber: 3) + } }() + try { if let v = self._stdout { + try visitor.visitSingularUInt32Field(value: v, fieldNumber: 4) + } }() + try { if let v = self._stderr { + try visitor.visitSingularUInt32Field(value: v, fieldNumber: 5) + } }() + try { if let v = self._ociRuntimePath { + try visitor.visitSingularStringField(value: v, fieldNumber: 6) + } }() + if !self.configuration.isEmpty { + try visitor.visitSingularBytesField(value: self.configuration, fieldNumber: 7) + } + try { if let v = self._options { + try visitor.visitSingularBytesField(value: v, fieldNumber: 8) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs._stdin != rhs._stdin {return false} + if lhs._stdout != rhs._stdout {return false} + if lhs._stderr != rhs._stderr {return false} + if lhs._ociRuntimePath != rhs._ociRuntimePath {return false} + if lhs.configuration != rhs.configuration {return false} + if lhs._options != rhs._options {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CreateProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".WaitProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".WaitProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}exitCode\0\u{3}exited_at\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self.exitCode) }() + case 2: try { try decoder.decodeSingularMessageField(value: &self._exitedAt) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if self.exitCode != 0 { + try visitor.visitSingularInt32Field(value: self.exitCode, fieldNumber: 1) + } + try { if let v = self._exitedAt { + try visitor.visitSingularMessageField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse) -> Bool { + if lhs.exitCode != rhs.exitCode {return false} + if lhs._exitedAt != rhs._exitedAt {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ResizeProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0\u{1}rows\0\u{1}columns\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self.rows) }() + case 4: try { try decoder.decodeSingularUInt32Field(value: &self.columns) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + if self.rows != 0 { + try visitor.visitSingularUInt32Field(value: self.rows, fieldNumber: 3) + } + if self.columns != 0 { + try visitor.visitSingularUInt32Field(value: self.columns, fieldNumber: 4) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.rows != rhs.rows {return false} + if lhs.columns != rhs.columns {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ResizeProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".DeleteProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".DeleteProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_StartProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StartProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StartProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_StartProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_StartProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StartProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}pid\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self.pid) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.pid != 0 { + try visitor.visitSingularInt32Field(value: self.pid, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StartProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_StartProcessResponse) -> Bool { + if lhs.pid != rhs.pid {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_KillProcessRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".KillProcessRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0\u{1}signal\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + case 3: try { try decoder.decodeSingularInt32Field(value: &self.signal) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + if self.signal != 0 { + try visitor.visitSingularInt32Field(value: self.signal, fieldNumber: 3) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_KillProcessRequest, rhs: Com_Apple_Containerization_Sandbox_V3_KillProcessRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.signal != rhs.signal {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_KillProcessResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".KillProcessResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}result\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self.result) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.result != 0 { + try visitor.visitSingularInt32Field(value: self.result, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_KillProcessResponse, rhs: Com_Apple_Containerization_Sandbox_V3_KillProcessResponse) -> Bool { + if lhs.result != rhs.result {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CloseProcessStdinRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}id\0\u{1}containerID\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.id) }() + case 2: try { try decoder.decodeSingularStringField(value: &self._containerID) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.id.isEmpty { + try visitor.visitSingularStringField(value: self.id, fieldNumber: 1) + } + try { if let v = self._containerID { + try visitor.visitSingularStringField(value: v, fieldNumber: 2) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest, rhs: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest) -> Bool { + if lhs.id != rhs.id {return false} + if lhs._containerID != rhs._containerID {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CloseProcessStdinResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse, rhs: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MkdirRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MkdirRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}path\0\u{1}all\0\u{1}perms\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.path) }() + case 2: try { try decoder.decodeSingularBoolField(value: &self.all) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self.perms) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 1) + } + if self.all != false { + try visitor.visitSingularBoolField(value: self.all, fieldNumber: 2) + } + if self.perms != 0 { + try visitor.visitSingularUInt32Field(value: self.perms, fieldNumber: 3) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MkdirRequest, rhs: Com_Apple_Containerization_Sandbox_V3_MkdirRequest) -> Bool { + if lhs.path != rhs.path {return false} + if lhs.all != rhs.all {return false} + if lhs.perms != rhs.perms {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MkdirResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MkdirResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MkdirResponse, rhs: Com_Apple_Containerization_Sandbox_V3_MkdirResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_WriteFileRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".WriteFileRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}path\0\u{1}data\0\u{1}mode\0\u{1}flags\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.path) }() + case 2: try { try decoder.decodeSingularBytesField(value: &self.data) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self.mode) }() + case 4: try { try decoder.decodeSingularMessageField(value: &self._flags) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 1) + } + if !self.data.isEmpty { + try visitor.visitSingularBytesField(value: self.data, fieldNumber: 2) + } + if self.mode != 0 { + try visitor.visitSingularUInt32Field(value: self.mode, fieldNumber: 3) + } + try { if let v = self._flags { + try visitor.visitSingularMessageField(value: v, fieldNumber: 4) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest, rhs: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest) -> Bool { + if lhs.path != rhs.path {return false} + if lhs.data != rhs.data {return false} + if lhs.mode != rhs.mode {return false} + if lhs._flags != rhs._flags {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.protoMessageName + ".WriteFileFlags" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}create_parent_dirs\0\u{1}append\0\u{3}create_if_missing\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularBoolField(value: &self.createParentDirs) }() + case 2: try { try decoder.decodeSingularBoolField(value: &self.append) }() + case 3: try { try decoder.decodeSingularBoolField(value: &self.createIfMissing) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.createParentDirs != false { + try visitor.visitSingularBoolField(value: self.createParentDirs, fieldNumber: 1) + } + if self.append != false { + try visitor.visitSingularBoolField(value: self.append, fieldNumber: 2) + } + if self.createIfMissing != false { + try visitor.visitSingularBoolField(value: self.createIfMissing, fieldNumber: 3) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags, rhs: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest.WriteFileFlags) -> Bool { + if lhs.createParentDirs != rhs.createParentDirs {return false} + if lhs.append != rhs.append {return false} + if lhs.createIfMissing != rhs.createIfMissing {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_WriteFileResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".WriteFileResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_WriteFileResponse, rhs: Com_Apple_Containerization_Sandbox_V3_WriteFileResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CopyRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CopyRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}direction\0\u{1}path\0\u{1}mode\0\u{3}create_parents\0\u{3}vsock_port\0\u{3}is_archive\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularEnumField(value: &self.direction) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.path) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self.mode) }() + case 4: try { try decoder.decodeSingularBoolField(value: &self.createParents) }() + case 5: try { try decoder.decodeSingularUInt32Field(value: &self.vsockPort) }() + case 6: try { try decoder.decodeSingularBoolField(value: &self.isArchive) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.direction != .copyIn { + try visitor.visitSingularEnumField(value: self.direction, fieldNumber: 1) + } + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 2) + } + if self.mode != 0 { + try visitor.visitSingularUInt32Field(value: self.mode, fieldNumber: 3) + } + if self.createParents != false { + try visitor.visitSingularBoolField(value: self.createParents, fieldNumber: 4) + } + if self.vsockPort != 0 { + try visitor.visitSingularUInt32Field(value: self.vsockPort, fieldNumber: 5) + } + if self.isArchive != false { + try visitor.visitSingularBoolField(value: self.isArchive, fieldNumber: 6) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CopyRequest, rhs: Com_Apple_Containerization_Sandbox_V3_CopyRequest) -> Bool { + if lhs.direction != rhs.direction {return false} + if lhs.path != rhs.path {return false} + if lhs.mode != rhs.mode {return false} + if lhs.createParents != rhs.createParents {return false} + if lhs.vsockPort != rhs.vsockPort {return false} + if lhs.isArchive != rhs.isArchive {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CopyRequest.Direction: SwiftProtobuf._ProtoNameProviding { + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{2}\0COPY_IN\0\u{1}COPY_OUT\0") +} + +extension Com_Apple_Containerization_Sandbox_V3_CopyResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CopyResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}status\0\u{3}is_archive\0\u{3}total_size\0\u{1}error\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularEnumField(value: &self.status) }() + case 2: try { try decoder.decodeSingularBoolField(value: &self.isArchive) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.totalSize) }() + case 4: try { try decoder.decodeSingularStringField(value: &self.error) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.status != .metadata { + try visitor.visitSingularEnumField(value: self.status, fieldNumber: 1) + } + if self.isArchive != false { + try visitor.visitSingularBoolField(value: self.isArchive, fieldNumber: 2) + } + if self.totalSize != 0 { + try visitor.visitSingularUInt64Field(value: self.totalSize, fieldNumber: 3) + } + if !self.error.isEmpty { + try visitor.visitSingularStringField(value: self.error, fieldNumber: 4) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CopyResponse, rhs: Com_Apple_Containerization_Sandbox_V3_CopyResponse) -> Bool { + if lhs.status != rhs.status {return false} + if lhs.isArchive != rhs.isArchive {return false} + if lhs.totalSize != rhs.totalSize {return false} + if lhs.error != rhs.error {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CopyResponse.Status: SwiftProtobuf._ProtoNameProviding { + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{2}\0METADATA\0\u{1}COMPLETE\0") +} + +extension Com_Apple_Containerization_Sandbox_V3_StatRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StatRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}path\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.path) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StatRequest, rhs: Com_Apple_Containerization_Sandbox_V3_StatRequest) -> Bool { + if lhs.path != rhs.path {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_Stat: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".Stat" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}dev\0\u{1}ino\0\u{1}mode\0\u{1}nlink\0\u{1}uid\0\u{1}gid\0\u{1}rdev\0\u{1}size\0\u{1}blksize\0\u{1}blocks\0\u{1}atime\0\u{1}mtime\0\u{1}ctime\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.dev) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.ino) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self.mode) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.nlink) }() + case 5: try { try decoder.decodeSingularUInt32Field(value: &self.uid) }() + case 6: try { try decoder.decodeSingularUInt32Field(value: &self.gid) }() + case 7: try { try decoder.decodeSingularUInt64Field(value: &self.rdev) }() + case 8: try { try decoder.decodeSingularInt64Field(value: &self.size) }() + case 9: try { try decoder.decodeSingularInt64Field(value: &self.blksize) }() + case 10: try { try decoder.decodeSingularInt64Field(value: &self.blocks) }() + case 11: try { try decoder.decodeSingularMessageField(value: &self._atime) }() + case 12: try { try decoder.decodeSingularMessageField(value: &self._mtime) }() + case 13: try { try decoder.decodeSingularMessageField(value: &self._ctime) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if self.dev != 0 { + try visitor.visitSingularUInt64Field(value: self.dev, fieldNumber: 1) + } + if self.ino != 0 { + try visitor.visitSingularUInt64Field(value: self.ino, fieldNumber: 2) + } + if self.mode != 0 { + try visitor.visitSingularUInt32Field(value: self.mode, fieldNumber: 3) + } + if self.nlink != 0 { + try visitor.visitSingularUInt64Field(value: self.nlink, fieldNumber: 4) + } + if self.uid != 0 { + try visitor.visitSingularUInt32Field(value: self.uid, fieldNumber: 5) + } + if self.gid != 0 { + try visitor.visitSingularUInt32Field(value: self.gid, fieldNumber: 6) + } + if self.rdev != 0 { + try visitor.visitSingularUInt64Field(value: self.rdev, fieldNumber: 7) + } + if self.size != 0 { + try visitor.visitSingularInt64Field(value: self.size, fieldNumber: 8) + } + if self.blksize != 0 { + try visitor.visitSingularInt64Field(value: self.blksize, fieldNumber: 9) + } + if self.blocks != 0 { + try visitor.visitSingularInt64Field(value: self.blocks, fieldNumber: 10) + } + try { if let v = self._atime { + try visitor.visitSingularMessageField(value: v, fieldNumber: 11) + } }() + try { if let v = self._mtime { + try visitor.visitSingularMessageField(value: v, fieldNumber: 12) + } }() + try { if let v = self._ctime { + try visitor.visitSingularMessageField(value: v, fieldNumber: 13) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_Stat, rhs: Com_Apple_Containerization_Sandbox_V3_Stat) -> Bool { + if lhs.dev != rhs.dev {return false} + if lhs.ino != rhs.ino {return false} + if lhs.mode != rhs.mode {return false} + if lhs.nlink != rhs.nlink {return false} + if lhs.uid != rhs.uid {return false} + if lhs.gid != rhs.gid {return false} + if lhs.rdev != rhs.rdev {return false} + if lhs.size != rhs.size {return false} + if lhs.blksize != rhs.blksize {return false} + if lhs.blocks != rhs.blocks {return false} + if lhs._atime != rhs._atime {return false} + if lhs._mtime != rhs._mtime {return false} + if lhs._ctime != rhs._ctime {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_StatResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".StatResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}stat\0\u{1}error\0") + + fileprivate class _StorageClass { + var _stat: Com_Apple_Containerization_Sandbox_V3_Stat? = nil + var _error: String = String() + + // This property is used as the initial default value for new instances of the type. + // The type itself is protecting the reference to its storage via CoW semantics. + // This will force a copy to be made of this reference when the first mutation occurs; + // hence, it is safe to mark this as `nonisolated(unsafe)`. + static nonisolated(unsafe) let defaultInstance = _StorageClass() + + private init() {} + + init(copying source: _StorageClass) { + _stat = source._stat + _error = source._error + } + } + + fileprivate mutating func _uniqueStorage() -> _StorageClass { + if !isKnownUniquelyReferenced(&_storage) { + _storage = _StorageClass(copying: _storage) + } + return _storage + } + + public mutating func decodeMessage(decoder: inout D) throws { + _ = _uniqueStorage() + try withExtendedLifetime(_storage) { (_storage: _StorageClass) in + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularMessageField(value: &_storage._stat) }() + case 2: try { try decoder.decodeSingularStringField(value: &_storage._error) }() + default: break + } + } + } + } + + public func traverse(visitor: inout V) throws { + try withExtendedLifetime(_storage) { (_storage: _StorageClass) in + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + try { if let v = _storage._stat { + try visitor.visitSingularMessageField(value: v, fieldNumber: 1) + } }() + if !_storage._error.isEmpty { + try visitor.visitSingularStringField(value: _storage._error, fieldNumber: 2) + } + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_StatResponse, rhs: Com_Apple_Containerization_Sandbox_V3_StatResponse) -> Bool { + if lhs._storage !== rhs._storage { + let storagesAreEqual: Bool = withExtendedLifetime((lhs._storage, rhs._storage)) { (_args: (_StorageClass, _StorageClass)) in + let _storage = _args.0 + let rhs_storage = _args.1 + if _storage._stat != rhs_storage._stat {return false} + if _storage._error != rhs_storage._error {return false} + return true + } + if !storagesAreEqual {return false} + } + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FiTrimParams: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FiTrimParams" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}one_shot\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { + var v: Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot? + var hadOneofValue = false + if let current = self.schedule { + hadOneofValue = true + if case .oneShot(let m) = current {v = m} + } + try decoder.decodeSingularMessageField(value: &v) + if let v = v { + if hadOneofValue {try decoder.handleConflictingOneOf()} + self.schedule = .oneShot(v) + } + }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + try { if case .oneShot(let v)? = self.schedule { + try visitor.visitSingularMessageField(value: v, fieldNumber: 1) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FiTrimParams, rhs: Com_Apple_Containerization_Sandbox_V3_FiTrimParams) -> Bool { + if lhs.schedule != rhs.schedule {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = Com_Apple_Containerization_Sandbox_V3_FiTrimParams.protoMessageName + ".OneShot" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot, rhs: Com_Apple_Containerization_Sandbox_V3_FiTrimParams.OneShot) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FiFreezeParams: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FiFreezeParams" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FiFreezeParams, rhs: Com_Apple_Containerization_Sandbox_V3_FiFreezeParams) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FiThawParams: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FiThawParams" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FiThawParams, rhs: Com_Apple_Containerization_Sandbox_V3_FiThawParams) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FiTrimResult: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FiTrimResult" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}trimmed_bytes\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.trimmedBytes) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.trimmedBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.trimmedBytes, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FiTrimResult, rhs: Com_Apple_Containerization_Sandbox_V3_FiTrimResult) -> Bool { + if lhs.trimmedBytes != rhs.trimmedBytes {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FilesystemOperationRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}path\0\u{1}trim\0\u{1}freeze\0\u{1}thaw\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.path) }() + case 2: try { + var v: Com_Apple_Containerization_Sandbox_V3_FiTrimParams? + var hadOneofValue = false + if let current = self.operation { + hadOneofValue = true + if case .trim(let m) = current {v = m} + } + try decoder.decodeSingularMessageField(value: &v) + if let v = v { + if hadOneofValue {try decoder.handleConflictingOneOf()} + self.operation = .trim(v) + } + }() + case 3: try { + var v: Com_Apple_Containerization_Sandbox_V3_FiFreezeParams? + var hadOneofValue = false + if let current = self.operation { + hadOneofValue = true + if case .freeze(let m) = current {v = m} + } + try decoder.decodeSingularMessageField(value: &v) + if let v = v { + if hadOneofValue {try decoder.handleConflictingOneOf()} + self.operation = .freeze(v) + } + }() + case 4: try { + var v: Com_Apple_Containerization_Sandbox_V3_FiThawParams? + var hadOneofValue = false + if let current = self.operation { + hadOneofValue = true + if case .thaw(let m) = current {v = m} + } + try decoder.decodeSingularMessageField(value: &v) + if let v = v { + if hadOneofValue {try decoder.handleConflictingOneOf()} + self.operation = .thaw(v) + } + }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.path.isEmpty { + try visitor.visitSingularStringField(value: self.path, fieldNumber: 1) + } + switch self.operation { + case .trim?: try { + guard case .trim(let v)? = self.operation else { preconditionFailure() } + try visitor.visitSingularMessageField(value: v, fieldNumber: 2) + }() + case .freeze?: try { + guard case .freeze(let v)? = self.operation else { preconditionFailure() } + try visitor.visitSingularMessageField(value: v, fieldNumber: 3) + }() + case .thaw?: try { + guard case .thaw(let v)? = self.operation else { preconditionFailure() } + try visitor.visitSingularMessageField(value: v, fieldNumber: 4) + }() + case nil: break + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest, rhs: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest) -> Bool { + if lhs.path != rhs.path {return false} + if lhs.operation != rhs.operation {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".FilesystemOperationResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}trim\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { + var v: Com_Apple_Containerization_Sandbox_V3_FiTrimResult? + var hadOneofValue = false + if let current = self.result { + hadOneofValue = true + if case .trim(let m) = current {v = m} + } + try decoder.decodeSingularMessageField(value: &v) + if let v = v { + if hadOneofValue {try decoder.handleConflictingOneOf()} + self.result = .trim(v) + } + }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + try { if case .trim(let v)? = self.result { + try visitor.visitSingularMessageField(value: v, fieldNumber: 1) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse, rhs: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse) -> Bool { + if lhs.result != rhs.result {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpLinkSetRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}interface\0\u{1}up\0\u{1}mtu\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }() + case 2: try { try decoder.decodeSingularBoolField(value: &self.up) }() + case 3: try { try decoder.decodeSingularUInt32Field(value: &self._mtu) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.interface.isEmpty { + try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1) + } + if self.up != false { + try visitor.visitSingularBoolField(value: self.up, fieldNumber: 2) + } + try { if let v = self._mtu { + try visitor.visitSingularUInt32Field(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest, rhs: Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest) -> Bool { + if lhs.interface != rhs.interface {return false} + if lhs.up != rhs.up {return false} + if lhs._mtu != rhs._mtu {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpLinkSetResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse, rhs: Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpAddrAddRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}interface\0\u{1}ipv4Address\0\u{1}ipv6Address\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.ipv4Address) }() + case 3: try { try decoder.decodeSingularStringField(value: &self._ipv6Address) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.interface.isEmpty { + try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1) + } + if !self.ipv4Address.isEmpty { + try visitor.visitSingularStringField(value: self.ipv4Address, fieldNumber: 2) + } + try { if let v = self._ipv6Address { + try visitor.visitSingularStringField(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest, rhs: Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest) -> Bool { + if lhs.interface != rhs.interface {return false} + if lhs.ipv4Address != rhs.ipv4Address {return false} + if lhs._ipv6Address != rhs._ipv6Address {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpAddrAddResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse, rhs: Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpRouteAddLinkRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}interface\0\u{1}dstIpv4Addr\0\u{1}srcIpv4Addr\0\u{1}dstIpv6Addr\0\u{1}srcIpv6Addr\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.dstIpv4Addr) }() + case 3: try { try decoder.decodeSingularStringField(value: &self.srcIpv4Addr) }() + case 4: try { try decoder.decodeSingularStringField(value: &self._dstIpv6Addr) }() + case 5: try { try decoder.decodeSingularStringField(value: &self._srcIpv6Addr) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.interface.isEmpty { + try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1) + } + if !self.dstIpv4Addr.isEmpty { + try visitor.visitSingularStringField(value: self.dstIpv4Addr, fieldNumber: 2) + } + if !self.srcIpv4Addr.isEmpty { + try visitor.visitSingularStringField(value: self.srcIpv4Addr, fieldNumber: 3) + } + try { if let v = self._dstIpv6Addr { + try visitor.visitSingularStringField(value: v, fieldNumber: 4) + } }() + try { if let v = self._srcIpv6Addr { + try visitor.visitSingularStringField(value: v, fieldNumber: 5) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest, rhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest) -> Bool { + if lhs.interface != rhs.interface {return false} + if lhs.dstIpv4Addr != rhs.dstIpv4Addr {return false} + if lhs.srcIpv4Addr != rhs.srcIpv4Addr {return false} + if lhs._dstIpv6Addr != rhs._dstIpv6Addr {return false} + if lhs._srcIpv6Addr != rhs._srcIpv6Addr {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpRouteAddLinkResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse, rhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpRouteAddDefaultRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}interface\0\u{1}ipv4Gateway\0\u{1}ipv6Gateway\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }() + case 2: try { try decoder.decodeSingularStringField(value: &self.ipv4Gateway) }() + case 3: try { try decoder.decodeSingularStringField(value: &self._ipv6Gateway) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.interface.isEmpty { + try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1) + } + if !self.ipv4Gateway.isEmpty { + try visitor.visitSingularStringField(value: self.ipv4Gateway, fieldNumber: 2) + } + try { if let v = self._ipv6Gateway { + try visitor.visitSingularStringField(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest, rhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest) -> Bool { + if lhs.interface != rhs.interface {return false} + if lhs.ipv4Gateway != rhs.ipv4Gateway {return false} + if lhs._ipv6Gateway != rhs._ipv6Gateway {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".IpRouteAddDefaultResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse, rhs: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ConfigureDnsRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}location\0\u{1}nameservers\0\u{1}domain\0\u{1}searchDomains\0\u{1}options\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.location) }() + case 2: try { try decoder.decodeRepeatedStringField(value: &self.nameservers) }() + case 3: try { try decoder.decodeSingularStringField(value: &self._domain) }() + case 4: try { try decoder.decodeRepeatedStringField(value: &self.searchDomains) }() + case 5: try { try decoder.decodeRepeatedStringField(value: &self.options) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.location.isEmpty { + try visitor.visitSingularStringField(value: self.location, fieldNumber: 1) + } + if !self.nameservers.isEmpty { + try visitor.visitRepeatedStringField(value: self.nameservers, fieldNumber: 2) + } + try { if let v = self._domain { + try visitor.visitSingularStringField(value: v, fieldNumber: 3) + } }() + if !self.searchDomains.isEmpty { + try visitor.visitRepeatedStringField(value: self.searchDomains, fieldNumber: 4) + } + if !self.options.isEmpty { + try visitor.visitRepeatedStringField(value: self.options, fieldNumber: 5) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest, rhs: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest) -> Bool { + if lhs.location != rhs.location {return false} + if lhs.nameservers != rhs.nameservers {return false} + if lhs._domain != rhs._domain {return false} + if lhs.searchDomains != rhs.searchDomains {return false} + if lhs.options != rhs.options {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ConfigureDnsResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse, rhs: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ConfigureHostsRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}location\0\u{1}entries\0\u{1}comment\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.location) }() + case 2: try { try decoder.decodeRepeatedMessageField(value: &self.entries) }() + case 3: try { try decoder.decodeSingularStringField(value: &self._comment) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.location.isEmpty { + try visitor.visitSingularStringField(value: self.location, fieldNumber: 1) + } + if !self.entries.isEmpty { + try visitor.visitRepeatedMessageField(value: self.entries, fieldNumber: 2) + } + try { if let v = self._comment { + try visitor.visitSingularStringField(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest, rhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest) -> Bool { + if lhs.location != rhs.location {return false} + if lhs.entries != rhs.entries {return false} + if lhs._comment != rhs._comment {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.HostsEntry: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.protoMessageName + ".HostsEntry" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}ipAddress\0\u{1}hostnames\0\u{1}comment\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.ipAddress) }() + case 2: try { try decoder.decodeRepeatedStringField(value: &self.hostnames) }() + case 3: try { try decoder.decodeSingularStringField(value: &self._comment) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !self.ipAddress.isEmpty { + try visitor.visitSingularStringField(value: self.ipAddress, fieldNumber: 1) + } + if !self.hostnames.isEmpty { + try visitor.visitRepeatedStringField(value: self.hostnames, fieldNumber: 2) + } + try { if let v = self._comment { + try visitor.visitSingularStringField(value: v, fieldNumber: 3) + } }() + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.HostsEntry, rhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.HostsEntry) -> Bool { + if lhs.ipAddress != rhs.ipAddress {return false} + if lhs.hostnames != rhs.hostnames {return false} + if lhs._comment != rhs._comment {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ConfigureHostsResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse, rhs: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SyncRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SyncRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SyncRequest, rhs: Com_Apple_Containerization_Sandbox_V3_SyncRequest) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_SyncResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".SyncResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap() + + public mutating func decodeMessage(decoder: inout D) throws { + // Load everything into unknown fields + while try decoder.nextFieldNumber() != nil {} + } + + public func traverse(visitor: inout V) throws { + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_SyncResponse, rhs: Com_Apple_Containerization_Sandbox_V3_SyncResponse) -> Bool { + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_KillRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".KillRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}pid\0\u{2}\u{2}signal\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self.pid) }() + case 3: try { try decoder.decodeSingularInt32Field(value: &self.signal) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.pid != 0 { + try visitor.visitSingularInt32Field(value: self.pid, fieldNumber: 1) + } + if self.signal != 0 { + try visitor.visitSingularInt32Field(value: self.signal, fieldNumber: 3) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_KillRequest, rhs: Com_Apple_Containerization_Sandbox_V3_KillRequest) -> Bool { + if lhs.pid != rhs.pid {return false} + if lhs.signal != rhs.signal {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_KillResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".KillResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}result\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularInt32Field(value: &self.result) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.result != 0 { + try visitor.visitSingularInt32Field(value: self.result, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_KillResponse, rhs: Com_Apple_Containerization_Sandbox_V3_KillResponse) -> Bool { + if lhs.result != rhs.result {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ContainerStatisticsRequest" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}container_ids\0\u{1}categories\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeRepeatedStringField(value: &self.containerIds) }() + case 2: try { try decoder.decodeRepeatedEnumField(value: &self.categories) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.containerIds.isEmpty { + try visitor.visitRepeatedStringField(value: self.containerIds, fieldNumber: 1) + } + if !self.categories.isEmpty { + try visitor.visitPackedEnumField(value: self.categories, fieldNumber: 2) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest, rhs: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest) -> Bool { + if lhs.containerIds != rhs.containerIds {return false} + if lhs.categories != rhs.categories {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ContainerStatisticsResponse" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}containers\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeRepeatedMessageField(value: &self.containers) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.containers.isEmpty { + try visitor.visitRepeatedMessageField(value: self.containers, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse, rhs: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse) -> Bool { + if lhs.containers != rhs.containers {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ContainerStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ContainerStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}container_id\0\u{1}process\0\u{1}memory\0\u{1}cpu\0\u{3}block_io\0\u{1}networks\0\u{3}memory_events\0") + + fileprivate class _StorageClass { + var _containerID: String = String() + var _process: Com_Apple_Containerization_Sandbox_V3_ProcessStats? = nil + var _memory: Com_Apple_Containerization_Sandbox_V3_MemoryStats? = nil + var _cpu: Com_Apple_Containerization_Sandbox_V3_CPUStats? = nil + var _blockIo: Com_Apple_Containerization_Sandbox_V3_BlockIOStats? = nil + var _networks: [Com_Apple_Containerization_Sandbox_V3_NetworkStats] = [] + var _memoryEvents: Com_Apple_Containerization_Sandbox_V3_MemoryEventStats? = nil + + // This property is used as the initial default value for new instances of the type. + // The type itself is protecting the reference to its storage via CoW semantics. + // This will force a copy to be made of this reference when the first mutation occurs; + // hence, it is safe to mark this as `nonisolated(unsafe)`. + static nonisolated(unsafe) let defaultInstance = _StorageClass() + + private init() {} + + init(copying source: _StorageClass) { + _containerID = source._containerID + _process = source._process + _memory = source._memory + _cpu = source._cpu + _blockIo = source._blockIo + _networks = source._networks + _memoryEvents = source._memoryEvents + } + } + + fileprivate mutating func _uniqueStorage() -> _StorageClass { + if !isKnownUniquelyReferenced(&_storage) { + _storage = _StorageClass(copying: _storage) + } + return _storage + } + + public mutating func decodeMessage(decoder: inout D) throws { + _ = _uniqueStorage() + try withExtendedLifetime(_storage) { (_storage: _StorageClass) in + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &_storage._containerID) }() + case 2: try { try decoder.decodeSingularMessageField(value: &_storage._process) }() + case 3: try { try decoder.decodeSingularMessageField(value: &_storage._memory) }() + case 4: try { try decoder.decodeSingularMessageField(value: &_storage._cpu) }() + case 5: try { try decoder.decodeSingularMessageField(value: &_storage._blockIo) }() + case 6: try { try decoder.decodeRepeatedMessageField(value: &_storage._networks) }() + case 7: try { try decoder.decodeSingularMessageField(value: &_storage._memoryEvents) }() + default: break + } + } + } + } + + public func traverse(visitor: inout V) throws { + try withExtendedLifetime(_storage) { (_storage: _StorageClass) in + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every if/case branch local when no optimizations + // are enabled. https://github.com/apple/swift-protobuf/issues/1034 and + // https://github.com/apple/swift-protobuf/issues/1182 + if !_storage._containerID.isEmpty { + try visitor.visitSingularStringField(value: _storage._containerID, fieldNumber: 1) + } + try { if let v = _storage._process { + try visitor.visitSingularMessageField(value: v, fieldNumber: 2) + } }() + try { if let v = _storage._memory { + try visitor.visitSingularMessageField(value: v, fieldNumber: 3) + } }() + try { if let v = _storage._cpu { + try visitor.visitSingularMessageField(value: v, fieldNumber: 4) + } }() + try { if let v = _storage._blockIo { + try visitor.visitSingularMessageField(value: v, fieldNumber: 5) + } }() + if !_storage._networks.isEmpty { + try visitor.visitRepeatedMessageField(value: _storage._networks, fieldNumber: 6) + } + try { if let v = _storage._memoryEvents { + try visitor.visitSingularMessageField(value: v, fieldNumber: 7) + } }() + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ContainerStats, rhs: Com_Apple_Containerization_Sandbox_V3_ContainerStats) -> Bool { + if lhs._storage !== rhs._storage { + let storagesAreEqual: Bool = withExtendedLifetime((lhs._storage, rhs._storage)) { (_args: (_StorageClass, _StorageClass)) in + let _storage = _args.0 + let rhs_storage = _args.1 + if _storage._containerID != rhs_storage._containerID {return false} + if _storage._process != rhs_storage._process {return false} + if _storage._memory != rhs_storage._memory {return false} + if _storage._cpu != rhs_storage._cpu {return false} + if _storage._blockIo != rhs_storage._blockIo {return false} + if _storage._networks != rhs_storage._networks {return false} + if _storage._memoryEvents != rhs_storage._memoryEvents {return false} + return true + } + if !storagesAreEqual {return false} + } + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ProcessStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".ProcessStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}current\0\u{1}limit\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.current) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.limit) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.current != 0 { + try visitor.visitSingularUInt64Field(value: self.current, fieldNumber: 1) + } + if self.limit != 0 { + try visitor.visitSingularUInt64Field(value: self.limit, fieldNumber: 2) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_ProcessStats, rhs: Com_Apple_Containerization_Sandbox_V3_ProcessStats) -> Bool { + if lhs.current != rhs.current {return false} + if lhs.limit != rhs.limit {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MemoryStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MemoryStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}usage_bytes\0\u{3}limit_bytes\0\u{3}swap_usage_bytes\0\u{3}swap_limit_bytes\0\u{3}cache_bytes\0\u{3}kernel_stack_bytes\0\u{3}slab_bytes\0\u{3}page_faults\0\u{3}major_page_faults\0\u{3}inactive_file\0\u{1}anon\0\u{3}workingset_refault_anon\0\u{3}workingset_refault_file\0\u{3}pgsteal_kswapd\0\u{3}pgsteal_direct\0\u{3}pgsteal_khugepaged\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.usageBytes) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.limitBytes) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.swapUsageBytes) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.swapLimitBytes) }() + case 5: try { try decoder.decodeSingularUInt64Field(value: &self.cacheBytes) }() + case 6: try { try decoder.decodeSingularUInt64Field(value: &self.kernelStackBytes) }() + case 7: try { try decoder.decodeSingularUInt64Field(value: &self.slabBytes) }() + case 8: try { try decoder.decodeSingularUInt64Field(value: &self.pageFaults) }() + case 9: try { try decoder.decodeSingularUInt64Field(value: &self.majorPageFaults) }() + case 10: try { try decoder.decodeSingularUInt64Field(value: &self.inactiveFile) }() + case 11: try { try decoder.decodeSingularUInt64Field(value: &self.anon) }() + case 12: try { try decoder.decodeSingularUInt64Field(value: &self.workingsetRefaultAnon) }() + case 13: try { try decoder.decodeSingularUInt64Field(value: &self.workingsetRefaultFile) }() + case 14: try { try decoder.decodeSingularUInt64Field(value: &self.pgstealKswapd) }() + case 15: try { try decoder.decodeSingularUInt64Field(value: &self.pgstealDirect) }() + case 16: try { try decoder.decodeSingularUInt64Field(value: &self.pgstealKhugepaged) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.usageBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.usageBytes, fieldNumber: 1) + } + if self.limitBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.limitBytes, fieldNumber: 2) + } + if self.swapUsageBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.swapUsageBytes, fieldNumber: 3) + } + if self.swapLimitBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.swapLimitBytes, fieldNumber: 4) + } + if self.cacheBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.cacheBytes, fieldNumber: 5) + } + if self.kernelStackBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.kernelStackBytes, fieldNumber: 6) + } + if self.slabBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.slabBytes, fieldNumber: 7) + } + if self.pageFaults != 0 { + try visitor.visitSingularUInt64Field(value: self.pageFaults, fieldNumber: 8) + } + if self.majorPageFaults != 0 { + try visitor.visitSingularUInt64Field(value: self.majorPageFaults, fieldNumber: 9) + } + if self.inactiveFile != 0 { + try visitor.visitSingularUInt64Field(value: self.inactiveFile, fieldNumber: 10) + } + if self.anon != 0 { + try visitor.visitSingularUInt64Field(value: self.anon, fieldNumber: 11) + } + if self.workingsetRefaultAnon != 0 { + try visitor.visitSingularUInt64Field(value: self.workingsetRefaultAnon, fieldNumber: 12) + } + if self.workingsetRefaultFile != 0 { + try visitor.visitSingularUInt64Field(value: self.workingsetRefaultFile, fieldNumber: 13) + } + if self.pgstealKswapd != 0 { + try visitor.visitSingularUInt64Field(value: self.pgstealKswapd, fieldNumber: 14) + } + if self.pgstealDirect != 0 { + try visitor.visitSingularUInt64Field(value: self.pgstealDirect, fieldNumber: 15) + } + if self.pgstealKhugepaged != 0 { + try visitor.visitSingularUInt64Field(value: self.pgstealKhugepaged, fieldNumber: 16) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MemoryStats, rhs: Com_Apple_Containerization_Sandbox_V3_MemoryStats) -> Bool { + if lhs.usageBytes != rhs.usageBytes {return false} + if lhs.limitBytes != rhs.limitBytes {return false} + if lhs.swapUsageBytes != rhs.swapUsageBytes {return false} + if lhs.swapLimitBytes != rhs.swapLimitBytes {return false} + if lhs.cacheBytes != rhs.cacheBytes {return false} + if lhs.kernelStackBytes != rhs.kernelStackBytes {return false} + if lhs.slabBytes != rhs.slabBytes {return false} + if lhs.pageFaults != rhs.pageFaults {return false} + if lhs.majorPageFaults != rhs.majorPageFaults {return false} + if lhs.inactiveFile != rhs.inactiveFile {return false} + if lhs.anon != rhs.anon {return false} + if lhs.workingsetRefaultAnon != rhs.workingsetRefaultAnon {return false} + if lhs.workingsetRefaultFile != rhs.workingsetRefaultFile {return false} + if lhs.pgstealKswapd != rhs.pgstealKswapd {return false} + if lhs.pgstealDirect != rhs.pgstealDirect {return false} + if lhs.pgstealKhugepaged != rhs.pgstealKhugepaged {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_CPUStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".CPUStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{3}usage_usec\0\u{3}user_usec\0\u{3}system_usec\0\u{3}throttling_periods\0\u{3}throttled_periods\0\u{3}throttled_time_usec\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.usageUsec) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.userUsec) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.systemUsec) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.throttlingPeriods) }() + case 5: try { try decoder.decodeSingularUInt64Field(value: &self.throttledPeriods) }() + case 6: try { try decoder.decodeSingularUInt64Field(value: &self.throttledTimeUsec) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.usageUsec != 0 { + try visitor.visitSingularUInt64Field(value: self.usageUsec, fieldNumber: 1) + } + if self.userUsec != 0 { + try visitor.visitSingularUInt64Field(value: self.userUsec, fieldNumber: 2) + } + if self.systemUsec != 0 { + try visitor.visitSingularUInt64Field(value: self.systemUsec, fieldNumber: 3) + } + if self.throttlingPeriods != 0 { + try visitor.visitSingularUInt64Field(value: self.throttlingPeriods, fieldNumber: 4) + } + if self.throttledPeriods != 0 { + try visitor.visitSingularUInt64Field(value: self.throttledPeriods, fieldNumber: 5) + } + if self.throttledTimeUsec != 0 { + try visitor.visitSingularUInt64Field(value: self.throttledTimeUsec, fieldNumber: 6) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_CPUStats, rhs: Com_Apple_Containerization_Sandbox_V3_CPUStats) -> Bool { + if lhs.usageUsec != rhs.usageUsec {return false} + if lhs.userUsec != rhs.userUsec {return false} + if lhs.systemUsec != rhs.systemUsec {return false} + if lhs.throttlingPeriods != rhs.throttlingPeriods {return false} + if lhs.throttledPeriods != rhs.throttledPeriods {return false} + if lhs.throttledTimeUsec != rhs.throttledTimeUsec {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_BlockIOStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".BlockIOStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}devices\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeRepeatedMessageField(value: &self.devices) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.devices.isEmpty { + try visitor.visitRepeatedMessageField(value: self.devices, fieldNumber: 1) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_BlockIOStats, rhs: Com_Apple_Containerization_Sandbox_V3_BlockIOStats) -> Bool { + if lhs.devices != rhs.devices {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_BlockIOEntry: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".BlockIOEntry" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}major\0\u{1}minor\0\u{3}read_bytes\0\u{3}write_bytes\0\u{3}read_operations\0\u{3}write_operations\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.major) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.minor) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.readBytes) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.writeBytes) }() + case 5: try { try decoder.decodeSingularUInt64Field(value: &self.readOperations) }() + case 6: try { try decoder.decodeSingularUInt64Field(value: &self.writeOperations) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.major != 0 { + try visitor.visitSingularUInt64Field(value: self.major, fieldNumber: 1) + } + if self.minor != 0 { + try visitor.visitSingularUInt64Field(value: self.minor, fieldNumber: 2) + } + if self.readBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.readBytes, fieldNumber: 3) + } + if self.writeBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.writeBytes, fieldNumber: 4) + } + if self.readOperations != 0 { + try visitor.visitSingularUInt64Field(value: self.readOperations, fieldNumber: 5) + } + if self.writeOperations != 0 { + try visitor.visitSingularUInt64Field(value: self.writeOperations, fieldNumber: 6) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_BlockIOEntry, rhs: Com_Apple_Containerization_Sandbox_V3_BlockIOEntry) -> Bool { + if lhs.major != rhs.major {return false} + if lhs.minor != rhs.minor {return false} + if lhs.readBytes != rhs.readBytes {return false} + if lhs.writeBytes != rhs.writeBytes {return false} + if lhs.readOperations != rhs.readOperations {return false} + if lhs.writeOperations != rhs.writeOperations {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_NetworkStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".NetworkStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}interface\0\u{1}receivedPackets\0\u{1}transmittedPackets\0\u{1}receivedBytes\0\u{1}transmittedBytes\0\u{1}receivedErrors\0\u{1}transmittedErrors\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularStringField(value: &self.interface) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.receivedPackets) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.transmittedPackets) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.receivedBytes) }() + case 5: try { try decoder.decodeSingularUInt64Field(value: &self.transmittedBytes) }() + case 6: try { try decoder.decodeSingularUInt64Field(value: &self.receivedErrors) }() + case 7: try { try decoder.decodeSingularUInt64Field(value: &self.transmittedErrors) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if !self.interface.isEmpty { + try visitor.visitSingularStringField(value: self.interface, fieldNumber: 1) + } + if self.receivedPackets != 0 { + try visitor.visitSingularUInt64Field(value: self.receivedPackets, fieldNumber: 2) + } + if self.transmittedPackets != 0 { + try visitor.visitSingularUInt64Field(value: self.transmittedPackets, fieldNumber: 3) + } + if self.receivedBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.receivedBytes, fieldNumber: 4) + } + if self.transmittedBytes != 0 { + try visitor.visitSingularUInt64Field(value: self.transmittedBytes, fieldNumber: 5) + } + if self.receivedErrors != 0 { + try visitor.visitSingularUInt64Field(value: self.receivedErrors, fieldNumber: 6) + } + if self.transmittedErrors != 0 { + try visitor.visitSingularUInt64Field(value: self.transmittedErrors, fieldNumber: 7) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_NetworkStats, rhs: Com_Apple_Containerization_Sandbox_V3_NetworkStats) -> Bool { + if lhs.interface != rhs.interface {return false} + if lhs.receivedPackets != rhs.receivedPackets {return false} + if lhs.transmittedPackets != rhs.transmittedPackets {return false} + if lhs.receivedBytes != rhs.receivedBytes {return false} + if lhs.transmittedBytes != rhs.transmittedBytes {return false} + if lhs.receivedErrors != rhs.receivedErrors {return false} + if lhs.transmittedErrors != rhs.transmittedErrors {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} + +extension Com_Apple_Containerization_Sandbox_V3_MemoryEventStats: SwiftProtobuf.Message, SwiftProtobuf._MessageImplementationBase, SwiftProtobuf._ProtoNameProviding { + public static let protoMessageName: String = _protobuf_package + ".MemoryEventStats" + public static let _protobuf_nameMap = SwiftProtobuf._NameMap(bytecode: "\0\u{1}low\0\u{1}high\0\u{1}max\0\u{1}oom\0\u{3}oom_kill\0\u{3}oom_group_kill\0") + + public mutating func decodeMessage(decoder: inout D) throws { + while let fieldNumber = try decoder.nextFieldNumber() { + // The use of inline closures is to circumvent an issue where the compiler + // allocates stack space for every case branch when no optimizations are + // enabled. https://github.com/apple/swift-protobuf/issues/1034 + switch fieldNumber { + case 1: try { try decoder.decodeSingularUInt64Field(value: &self.low) }() + case 2: try { try decoder.decodeSingularUInt64Field(value: &self.high) }() + case 3: try { try decoder.decodeSingularUInt64Field(value: &self.max) }() + case 4: try { try decoder.decodeSingularUInt64Field(value: &self.oom) }() + case 5: try { try decoder.decodeSingularUInt64Field(value: &self.oomKill) }() + case 6: try { try decoder.decodeSingularUInt64Field(value: &self.oomGroupKill) }() + default: break + } + } + } + + public func traverse(visitor: inout V) throws { + if self.low != 0 { + try visitor.visitSingularUInt64Field(value: self.low, fieldNumber: 1) + } + if self.high != 0 { + try visitor.visitSingularUInt64Field(value: self.high, fieldNumber: 2) + } + if self.max != 0 { + try visitor.visitSingularUInt64Field(value: self.max, fieldNumber: 3) + } + if self.oom != 0 { + try visitor.visitSingularUInt64Field(value: self.oom, fieldNumber: 4) + } + if self.oomKill != 0 { + try visitor.visitSingularUInt64Field(value: self.oomKill, fieldNumber: 5) + } + if self.oomGroupKill != 0 { + try visitor.visitSingularUInt64Field(value: self.oomGroupKill, fieldNumber: 6) + } + try unknownFields.traverse(visitor: &visitor) + } + + public static func ==(lhs: Com_Apple_Containerization_Sandbox_V3_MemoryEventStats, rhs: Com_Apple_Containerization_Sandbox_V3_MemoryEventStats) -> Bool { + if lhs.low != rhs.low {return false} + if lhs.high != rhs.high {return false} + if lhs.max != rhs.max {return false} + if lhs.oom != rhs.oom {return false} + if lhs.oomKill != rhs.oomKill {return false} + if lhs.oomGroupKill != rhs.oomGroupKill {return false} + if lhs.unknownFields != rhs.unknownFields {return false} + return true + } +} diff --git a/Sources/Containerization/SandboxContext/SandboxContext.proto b/Sources/Containerization/SandboxContext/SandboxContext.proto new file mode 100644 index 0000000..24fb242 --- /dev/null +++ b/Sources/Containerization/SandboxContext/SandboxContext.proto @@ -0,0 +1,493 @@ +syntax = "proto3"; + +package com.apple.containerization.sandbox.v3; + +import "google/protobuf/timestamp.proto"; + +// Context for interacting with a container's runtime environment. +service SandboxContext { + // Mount a filesystem. + rpc Mount(MountRequest) returns (MountResponse); + // Unmount a filesystem. + rpc Umount(UmountRequest) returns (UmountResponse); + // Set an environment variable on the init process. + rpc Setenv(SetenvRequest) returns (SetenvResponse); + // Get an environment variable from the init process. + rpc Getenv(GetenvRequest) returns (GetenvResponse); + // Create a new directory inside the sandbox. + rpc Mkdir(MkdirRequest) returns (MkdirResponse); + // Set sysctls in the context of the sandbox. + rpc Sysctl(SysctlRequest) returns (SysctlResponse); + // Set time in the guest. + rpc SetTime(SetTimeRequest) returns (SetTimeResponse); + // Set up an emulator in the guest for a specific binary format. + rpc SetupEmulator(SetupEmulatorRequest) returns (SetupEmulatorResponse); + // Write data to an existing or new file. + rpc WriteFile(WriteFileRequest) returns (WriteFileResponse); + // Copy a file or directory between the host and guest. + // Data transfer happens over a dedicated vsock connection; + // the gRPC stream is used only for control/metadata. + rpc Copy(CopyRequest) returns (stream CopyResponse); + // Stat a path in the guest filesystem. + rpc Stat(StatRequest) returns (StatResponse); + // Perform a filesystem operation on a mounted filesystem. + rpc FilesystemOperation(FilesystemOperationRequest) returns (FilesystemOperationResponse); + + // Create a new process inside the container. + rpc CreateProcess(CreateProcessRequest) returns (CreateProcessResponse); + // Delete an existing process inside the container. + rpc DeleteProcess(DeleteProcessRequest) returns (DeleteProcessResponse); + // Start the provided process. + rpc StartProcess(StartProcessRequest) returns (StartProcessResponse); + // Send a signal to the provided process. + rpc KillProcess(KillProcessRequest) returns (KillProcessResponse); + // Wait for a process to exit and return the exit code. + rpc WaitProcess(WaitProcessRequest) returns (WaitProcessResponse); + // Resize the tty of a given process. This will error if the process does + // not have a pty allocated. + rpc ResizeProcess(ResizeProcessRequest) returns (ResizeProcessResponse); + // Close IO for a given process. + rpc CloseProcessStdin(CloseProcessStdinRequest) returns (CloseProcessStdinResponse); + + // Get statistics for containers. + rpc ContainerStatistics(ContainerStatisticsRequest) returns (ContainerStatisticsResponse); + + // Proxy a vsock port to a unix domain socket in the guest, or vice versa. + rpc ProxyVsock(ProxyVsockRequest) returns (ProxyVsockResponse); + // Stop a vsock proxy to a unix domain socket. + rpc StopVsockProxy(StopVsockProxyRequest) returns (StopVsockProxyResponse); + + // Set the link state of a network interface. + rpc IpLinkSet(IpLinkSetRequest) returns (IpLinkSetResponse); + // Add an IPv4 address to a network interface. + rpc IpAddrAdd(IpAddrAddRequest) returns (IpAddrAddResponse); + // Add an IP route for a network interface. + rpc IpRouteAddLink(IpRouteAddLinkRequest) returns (IpRouteAddLinkResponse); + // Add an IP route for a network interface. + rpc IpRouteAddDefault(IpRouteAddDefaultRequest) returns (IpRouteAddDefaultResponse); + // Configure DNS resolver. + rpc ConfigureDns(ConfigureDnsRequest) returns (ConfigureDnsResponse); + // Configure /etc/hosts. + rpc ConfigureHosts(ConfigureHostsRequest) returns (ConfigureHostsResponse); + + // Perform the sync syscall. + rpc Sync(SyncRequest) returns (SyncResponse); + // Send a signal to a process via the PID. + rpc Kill(KillRequest) returns (KillResponse); +} + +message Stdio { + optional int32 stdinPort = 1; + optional int32 stdoutPort = 2; + optional int32 stderrPort = 3; +} + +message SetupEmulatorRequest { + string binary_path = 1; + string name = 2; + string type = 3; + string offset = 4; + string magic = 5; + string mask = 6; + string flags = 7; +} + +message SetupEmulatorResponse {} + +message SetTimeRequest { + int64 sec = 1; + int32 usec = 2; +} + +message SetTimeResponse {} + +message SysctlRequest { map settings = 1; } + +message SysctlResponse {} + +message ProxyVsockRequest { + enum Action { + INTO = 0; + OUT_OF = 1; + } + string id = 1; + uint32 vsock_port = 2; + string guestPath = 3; + optional uint32 guestSocketPermissions = 4; + Action action = 5; +} + +message ProxyVsockResponse {} + +message StopVsockProxyRequest { string id = 1; } + +message StopVsockProxyResponse {} + +message MountRequest { + string type = 1; + string source = 2; + string destination = 3; + repeated string options = 4; +} + +message MountResponse {} + +message UmountRequest { + string path = 1; + int32 flags = 2; +} + +message UmountResponse {} + +message SetenvRequest { + string key = 1; + optional string value = 2; +} + +message SetenvResponse {} + +message GetenvRequest { string key = 1; } + +message GetenvResponse { optional string value = 1; } + +message CreateProcessRequest { + string id = 1; + optional string containerID = 2; + optional uint32 stdin = 3; + optional uint32 stdout = 4; + optional uint32 stderr = 5; + optional string ociRuntimePath = 6; + bytes configuration = 7; + optional bytes options = 8; +} + +message CreateProcessResponse {} + +message WaitProcessRequest { + string id = 1; + optional string containerID = 2; +} + +message WaitProcessResponse { + int32 exitCode = 1; + google.protobuf.Timestamp exited_at = 2; +} + +message ResizeProcessRequest { + string id = 1; + optional string containerID = 2; + uint32 rows = 3; + uint32 columns = 4; +} + +message ResizeProcessResponse {} + +message DeleteProcessRequest { + string id = 1; + optional string containerID = 2; +} + +message DeleteProcessResponse {} + +message StartProcessRequest { + string id = 1; + optional string containerID = 2; +} + +message StartProcessResponse { int32 pid = 1; } + +message KillProcessRequest { + string id = 1; + optional string containerID = 2; + int32 signal = 3; +} + +message KillProcessResponse { int32 result = 1; } + +message CloseProcessStdinRequest { + string id = 1; + optional string containerID = 2; +} + +message CloseProcessStdinResponse {} + +message MkdirRequest { + string path = 1; + bool all = 2; + uint32 perms = 3; +} + +message MkdirResponse {} + +message WriteFileRequest { + message WriteFileFlags { + bool create_parent_dirs = 1; + bool append = 2; + bool create_if_missing = 3; + } + string path = 1; + bytes data = 2; + uint32 mode = 3; + WriteFileFlags flags = 4; +} + +message WriteFileResponse {} + +message CopyRequest { + enum Direction { + // Copy from host into guest. + COPY_IN = 0; + // Copy from guest to host. + COPY_OUT = 1; + } + // Direction of the copy operation. + Direction direction = 1; + // Path in the guest (destination for COPY_IN, source for COPY_OUT). + string path = 2; + // File mode for single-file COPY_IN (defaults to 0644 if not set). + uint32 mode = 3; + // Create parent directories if they don't exist. + bool create_parents = 4; + // Vsock port the host is listening on for data transfer. + uint32 vsock_port = 5; + // For COPY_IN: indicates the data arriving on vsock is a tar+gzip archive. + bool is_archive = 6; +} + +message CopyResponse { + enum Status { + // Transfer metadata (first message for COPY_OUT: is_archive, total_size). + METADATA = 0; + // Data transfer completed successfully. + COMPLETE = 1; + } + // What this response represents. + Status status = 1; + // For COPY_OUT METADATA: indicates the data on vsock will be a tar+gzip archive. + bool is_archive = 2; + // For COPY_OUT METADATA: total size in bytes (0 if unknown, e.g. for archives). + uint64 total_size = 3; + // Non-empty if an error occurred. + string error = 4; +} + +message StatRequest { string path = 1; } + +message Stat { + uint64 dev = 1; // st_dev: ID of device containing file + uint64 ino = 2; // st_ino: inode number + uint32 mode = 3; // st_mode: file type and mode (permissions) + uint64 nlink = 4; // st_nlink: number of hard links + uint32 uid = 5; // st_uid: user ID of owner + uint32 gid = 6; // st_gid: group ID of owner + uint64 rdev = 7; // st_rdev: device ID (if special file) + int64 size = 8; // st_size: total size in bytes + int64 blksize = 9; // st_blksize: preferred block size for filesystem I/O + int64 blocks = 10; // st_blocks: number of 512-byte blocks allocated + google.protobuf.Timestamp atime = 11; // st_atim: time of last access + google.protobuf.Timestamp mtime = 12; // st_mtim: time of last modification + google.protobuf.Timestamp ctime = 13; // st_ctim: time of last status change +} + +message StatResponse { + Stat stat = 1; + string error = 2; // Non-empty if stat failed. +} + +message FiTrimParams { + oneof schedule { + OneShot one_shot = 1; + } + + message OneShot {} +} +message FiFreezeParams {} +message FiThawParams {} + +message FiTrimResult { + uint64 trimmed_bytes = 1; +} + +message FilesystemOperationRequest { + string path = 1; + oneof operation { + FiTrimParams trim = 2; + FiFreezeParams freeze = 3; + FiThawParams thaw = 4; + } +} + +message FilesystemOperationResponse { + oneof result { + FiTrimResult trim = 1; + } +} + +message IpLinkSetRequest { + string interface = 1; + bool up = 2; + optional uint32 mtu = 3; +} + +message IpLinkSetResponse {} + +message IpAddrAddRequest { + string interface = 1; + string ipv4Address = 2; + optional string ipv6Address = 3; +} + +message IpAddrAddResponse {} + +message IpRouteAddLinkRequest { + string interface = 1; + string dstIpv4Addr = 2; + string srcIpv4Addr = 3; + optional string dstIpv6Addr = 4; + optional string srcIpv6Addr = 5; +} + +message IpRouteAddLinkResponse {} + +message IpRouteAddDefaultRequest { + string interface = 1; + string ipv4Gateway = 2; + optional string ipv6Gateway = 3; +} + +message IpRouteAddDefaultResponse {} + +message ConfigureDnsRequest { + string location = 1; + repeated string nameservers = 2; + optional string domain = 3; + repeated string searchDomains = 4; + repeated string options = 5; +} + +message ConfigureDnsResponse {} + +message ConfigureHostsRequest { + message HostsEntry { + string ipAddress = 1; + repeated string hostnames = 2; + optional string comment = 3; + } + string location = 1; + repeated HostsEntry entries = 2; + optional string comment = 3; +} + +message ConfigureHostsResponse {} + +message SyncRequest {} +message SyncResponse {} + +message KillRequest { + int32 pid = 1; + int32 signal = 3; +} + +message KillResponse { int32 result = 1; } + +// Categories of statistics that can be requested. +enum StatCategory { + STAT_CATEGORY_UNSPECIFIED = 0; + STAT_CATEGORY_PROCESS = 1; + STAT_CATEGORY_MEMORY = 2; + STAT_CATEGORY_CPU = 3; + STAT_CATEGORY_BLOCK_IO = 4; + STAT_CATEGORY_NETWORK = 5; + STAT_CATEGORY_MEMORY_EVENTS = 6; +} + +message ContainerStatisticsRequest { + repeated string container_ids = 1; // Empty = all containers + repeated StatCategory categories = 2; // Empty = all categories +} + +message ContainerStatisticsResponse { + repeated ContainerStats containers = 1; +} + +message ContainerStats { + string container_id = 1; + ProcessStats process = 2; + MemoryStats memory = 3; + CPUStats cpu = 4; + BlockIOStats block_io = 5; + repeated NetworkStats networks = 6; + MemoryEventStats memory_events = 7; +} + +message ProcessStats { + uint64 current = 1; + uint64 limit = 2; // 0 or max value = unlimited +} + +message MemoryStats { + uint64 usage_bytes = 1; + uint64 limit_bytes = 2; + uint64 swap_usage_bytes = 3; + uint64 swap_limit_bytes = 4; + uint64 cache_bytes = 5; + uint64 kernel_stack_bytes = 6; + uint64 slab_bytes = 7; + uint64 page_faults = 8; + uint64 major_page_faults = 9; + uint64 inactive_file = 10; + uint64 anon = 11; + uint64 workingset_refault_anon = 12; + uint64 workingset_refault_file = 13; + uint64 pgsteal_kswapd = 14; + uint64 pgsteal_direct = 15; + uint64 pgsteal_khugepaged = 16; +} + +message CPUStats { + uint64 usage_usec = 1; + uint64 user_usec = 2; + uint64 system_usec = 3; + uint64 throttling_periods = 4; + uint64 throttled_periods = 5; + uint64 throttled_time_usec = 6; +} + +message BlockIOStats { + repeated BlockIOEntry devices = 1; +} + +message BlockIOEntry { + uint64 major = 1; + uint64 minor = 2; + uint64 read_bytes = 3; + uint64 write_bytes = 4; + uint64 read_operations = 5; + uint64 write_operations = 6; +} + +message NetworkStats { + string interface = 1; + uint64 receivedPackets = 2; + uint64 transmittedPackets = 3; + uint64 receivedBytes = 4; + uint64 transmittedBytes = 5; + uint64 receivedErrors = 6; + uint64 transmittedErrors = 7; +} + +// Memory event counters from cgroup2's memory.events file. +message MemoryEventStats { + // Number of times the cgroup was reclaimed due to low memory. + uint64 low = 1; + // Number of times the cgroup exceeded its high memory limit. + uint64 high = 2; + // Number of times the cgroup hit its max memory limit. + uint64 max = 3; + // Number of times the cgroup triggered OOM. + uint64 oom = 4; + // Number of processes killed by OOM killer. + uint64 oom_kill = 5; + // Number of times charge for memory failed because of limit. + uint64 oom_group_kill = 6; +} diff --git a/Sources/Containerization/SandboxOverrides.swift b/Sources/Containerization/SandboxOverrides.swift new file mode 100644 index 0000000..b94024e --- /dev/null +++ b/Sources/Containerization/SandboxOverrides.swift @@ -0,0 +1,100 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import Foundation + +/// Per-component opt-ins to weaken the upstream-secure spawn flags for +/// cloud-hypervisor and virtiofsd. Each flag is independent so an operator +/// can target the minimum hardening that needs to come off — e.g. running +/// inside apple/container's `--virtualization` dev container needs both, +/// but a future bare-metal Linux host with a custom seccomp policy might +/// only need one. +/// +/// Read once per process at first reference. Default false (secure). +/// +/// **Legacy alias.** `CONTAINERIZATION_RELAXED_SANDBOX=1` continues to flip +/// every flag here for back-compat with the original combined toggle. New +/// callers should prefer the per-component vars below. +enum SandboxOverrides { + /// When set, cloud-hypervisor is launched with `--seccomp false`. + /// Disables CH's userspace seccomp BPF filter; the kernel's filter + /// (whatever the host policy is) still applies. + /// + /// Env: `CONTAINERIZATION_NO_CH_SECCOMP=1` + static let chSeccompDisabled: Bool = + boolEnv("CONTAINERIZATION_NO_CH_SECCOMP") || legacyRelaxedSandbox + + /// When set, virtiofsd is launched with `--sandbox none`. Disables + /// virtiofsd's userns + pivot_root + seccomp setup. Combined with the + /// vendored cap-drop patch (`scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch`) + /// at build time, the daemon retains its parent's capabilities — so + /// only enable this when the parent process is the trust boundary you + /// want. + /// + /// Env: `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1` + static let virtiofsdSandboxDisabled: Bool = + boolEnv("CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX") || legacyRelaxedSandbox + + /// True if any override is currently in effect — used by callers that + /// want to log a single banner regardless of which flag is set. + static var anyEnabled: Bool { + chSeccompDisabled || virtiofsdSandboxDisabled + } + + /// Back-compat alias: enables every per-component flag in one shot. + private static let legacyRelaxedSandbox: Bool = + boolEnv("CONTAINERIZATION_RELAXED_SANDBOX") + + private static func boolEnv(_ name: String) -> Bool { + ProcessInfo.processInfo.environment[name] == "1" + } +} + +/// Minimal environment allowlist for child processes we spawn (`CHProcess`, +/// `VirtiofsdProcess`). Inheriting the parent's full env exposes any +/// secrets the calling tool happens to have set (`AWS_*`, `KUBE_*`, +/// `*_TOKEN`, etc.) to a binary that has no use for them. Only the +/// variables below are forwarded — extend this list when a new spawn-time +/// dependency surfaces, and document why. +/// +/// - `PATH`, `HOME`: minimum POSIX hygiene; some libc/setuid paths look at +/// these even for self-contained binaries. +/// - `RUST_LOG`, `RUST_BACKTRACE`: cloud-hypervisor and virtiofsd are Rust +/// binaries; pass these through if the operator has set them so +/// debugging is unimpaired. +enum ChildEnvironment { + /// Construct a minimal environment for the child as `KEY=value` strings + /// suitable for `Command.environment`. Variables not present in the + /// parent env are simply omitted. + static func minimal() -> [String] { + let allowlist = ["PATH", "HOME", "RUST_LOG", "RUST_BACKTRACE"] + let parent = ProcessInfo.processInfo.environment + var entries: [String] = [] + // PATH falls back to a sane default since Command's execve needs an + // absolute path anyway, but child Rust binaries occasionally probe + // PATH for helper tools. + let path = parent["PATH"] ?? "/usr/sbin:/usr/bin:/sbin:/bin" + entries.append("PATH=\(path)") + for key in allowlist where key != "PATH" { + if let value = parent[key] { + entries.append("\(key)=\(value)") + } + } + return entries + } +} +#endif diff --git a/Sources/Containerization/Signal.swift b/Sources/Containerization/Signal.swift new file mode 100644 index 0000000..caef367 --- /dev/null +++ b/Sources/Containerization/Signal.swift @@ -0,0 +1,302 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Darwin) +import Darwin +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Musl) +import Musl +#else +#error("Signal not supported on this platform.") +#endif + +/// A unix signal. +public struct Signal: RawRepresentable, Hashable, Sendable { + public let rawValue: Int32 + + public init(rawValue: Int32) { + self.rawValue = rawValue + } + + /// Parse a signal from a string representation (e.g. "SIGKILL", "KILL", "9"). + public init(_ name: String, from map: [String: Int32] = Signal.linux) throws { + var signalUpper = name.uppercased() + signalUpper.trimPrefix("SIG") + if let sig = Int32(signalUpper) { + if !map.values.contains(sig) { + throw SignalError.invalidSignal(name) + } + self.rawValue = sig + return + } + guard let sig = map[signalUpper] else { + throw SignalError.invalidSignal(name) + } + self.rawValue = sig + } + + // Signals that are commonly sent to containers and share the same + // number across macOS/Linux. + public static let hup = Signal(rawValue: 1) + public static let int = Signal(rawValue: 2) + public static let quit = Signal(rawValue: 3) + public static let kill = Signal(rawValue: 9) + public static let term = Signal(rawValue: 15) + public static let winch = Signal(rawValue: 28) + + /// Linux signals. + public enum Linux { + public static let hup = Signal(rawValue: 1) + public static let int = Signal(rawValue: 2) + public static let quit = Signal(rawValue: 3) + public static let ill = Signal(rawValue: 4) + public static let trap = Signal(rawValue: 5) + public static let abrt = Signal(rawValue: 6) + public static let bus = Signal(rawValue: 7) + public static let fpe = Signal(rawValue: 8) + public static let kill = Signal(rawValue: 9) + public static let usr1 = Signal(rawValue: 10) + public static let segv = Signal(rawValue: 11) + public static let usr2 = Signal(rawValue: 12) + public static let pipe = Signal(rawValue: 13) + public static let alrm = Signal(rawValue: 14) + public static let term = Signal(rawValue: 15) + public static let stkflt = Signal(rawValue: 16) + public static let chld = Signal(rawValue: 17) + public static let cont = Signal(rawValue: 18) + public static let stop = Signal(rawValue: 19) + public static let tstp = Signal(rawValue: 20) + public static let ttin = Signal(rawValue: 21) + public static let ttou = Signal(rawValue: 22) + public static let urg = Signal(rawValue: 23) + public static let xcpu = Signal(rawValue: 24) + public static let xfsz = Signal(rawValue: 25) + public static let vtalrm = Signal(rawValue: 26) + public static let prof = Signal(rawValue: 27) + public static let winch = Signal(rawValue: 28) + public static let io = Signal(rawValue: 29) + public static let poll = Signal(rawValue: 29) + public static let pwr = Signal(rawValue: 30) + public static let sys = Signal(rawValue: 31) + + public static func rtmin(offset: Int32 = 0) -> Signal { + Signal(rawValue: 34 + offset) + } + + public static let rtmax = Signal(rawValue: 64) + } + + /// Darwin signals. + public enum Darwin { + public static let hup = Signal(rawValue: 1) + public static let int = Signal(rawValue: 2) + public static let quit = Signal(rawValue: 3) + public static let ill = Signal(rawValue: 4) + public static let trap = Signal(rawValue: 5) + public static let abrt = Signal(rawValue: 6) + public static let emt = Signal(rawValue: 7) + public static let fpe = Signal(rawValue: 8) + public static let kill = Signal(rawValue: 9) + public static let bus = Signal(rawValue: 10) + public static let segv = Signal(rawValue: 11) + public static let sys = Signal(rawValue: 12) + public static let pipe = Signal(rawValue: 13) + public static let alrm = Signal(rawValue: 14) + public static let term = Signal(rawValue: 15) + public static let urg = Signal(rawValue: 16) + public static let stop = Signal(rawValue: 17) + public static let tstp = Signal(rawValue: 18) + public static let cont = Signal(rawValue: 19) + public static let chld = Signal(rawValue: 20) + public static let ttin = Signal(rawValue: 21) + public static let ttou = Signal(rawValue: 22) + public static let io = Signal(rawValue: 23) + public static let xcpu = Signal(rawValue: 24) + public static let xfsz = Signal(rawValue: 25) + public static let vtalrm = Signal(rawValue: 26) + public static let prof = Signal(rawValue: 27) + public static let winch = Signal(rawValue: 28) + public static let info = Signal(rawValue: 29) + public static let usr1 = Signal(rawValue: 30) + public static let usr2 = Signal(rawValue: 31) + } + + /// All Linux signals including real-time signals (RTMIN through RTMAX). + public static let linux: [String: Int32] = [ + "ABRT": 6, + "ALRM": 14, + "BUS": 7, + "CHLD": 17, + "CLD": 17, + "CONT": 18, + "FPE": 8, + "HUP": 1, + "ILL": 4, + "INT": 2, + "IO": 29, + "IOT": 6, + "KILL": 9, + "PIPE": 13, + "POLL": 29, + "PROF": 27, + "PWR": 30, + "QUIT": 3, + "SEGV": 11, + "STKFLT": 16, + "STOP": 19, + "SYS": 31, + "TERM": 15, + "TRAP": 5, + "TSTP": 20, + "TTIN": 21, + "TTOU": 22, + "URG": 23, + "USR1": 10, + "USR2": 12, + "VTALRM": 26, + "WINCH": 28, + "XCPU": 24, + "XFSZ": 25, + "RTMIN": 34, + "RTMIN+1": 35, + "RTMIN+2": 36, + "RTMIN+3": 37, + "RTMIN+4": 38, + "RTMIN+5": 39, + "RTMIN+6": 40, + "RTMIN+7": 41, + "RTMIN+8": 42, + "RTMIN+9": 43, + "RTMIN+10": 44, + "RTMIN+11": 45, + "RTMIN+12": 46, + "RTMIN+13": 47, + "RTMIN+14": 48, + "RTMIN+15": 49, + "RTMIN+16": 50, + "RTMIN+17": 51, + "RTMIN+18": 52, + "RTMIN+19": 53, + "RTMIN+20": 54, + "RTMIN+21": 55, + "RTMIN+22": 56, + "RTMIN+23": 57, + "RTMIN+24": 58, + "RTMIN+25": 59, + "RTMIN+26": 60, + "RTMIN+27": 61, + "RTMIN+28": 62, + "RTMIN+29": 63, + "RTMAX": 64, + ] +} + +#if os(macOS) + +extension Signal { + /// All signals for the macOS host. + public static let platform: [String: Int32] = [ + "ABRT": SIGABRT, + "ALRM": SIGALRM, + "BUS": SIGBUS, + "CHLD": SIGCHLD, + "CONT": SIGCONT, + "EMT": SIGEMT, + "FPE": SIGFPE, + "HUP": SIGHUP, + "ILL": SIGILL, + "INFO": SIGINFO, + "INT": SIGINT, + "IO": SIGIO, + "IOT": SIGIOT, + "KILL": SIGKILL, + "PIPE": SIGPIPE, + "PROF": SIGPROF, + "QUIT": SIGQUIT, + "SEGV": SIGSEGV, + "STOP": SIGSTOP, + "SYS": SIGSYS, + "TERM": SIGTERM, + "TRAP": SIGTRAP, + "TSTP": SIGTSTP, + "TTIN": SIGTTIN, + "TTOU": SIGTTOU, + "URG": SIGURG, + "USR1": SIGUSR1, + "USR2": SIGUSR2, + "VTALRM": SIGVTALRM, + "WINCH": SIGWINCH, + "XCPU": SIGXCPU, + "XFSZ": SIGXFSZ, + ] +} + +#elseif os(Linux) + +extension Signal { + /// All signals for the Linux host. + public static let platform = linux +} + +#endif + +extension Signal { + private static let platformToName: [Int32: String] = + Dictionary(Signal.platform.map { ($0.value, $0.key) }, uniquingKeysWith: { first, _ in first }) + + /// Returns the canonical name for this signal on the current platform. + public func platformName() -> String? { + Self.platformName(self.rawValue) + } + + /// Returns the canonical name for a signal number on the current platform. + public static func platformName(_ signal: Int32) -> String? { + platformToName[signal] + } +} + +#if os(macOS) +extension Signal { + /// Converts a macOS signal to the equivalent Linux signal. + public func linuxSignal() -> Signal? { + guard let name = Self.platformToName[self.rawValue], + let linuxNumber = Signal.linux[name] + else { + return nil + } + return Signal(rawValue: linuxNumber) + } +} +#endif + +extension Signal: ExpressibleByIntegerLiteral { + public init(integerLiteral value: Int32) { + self.rawValue = value + } +} + +/// Errors that can be encountered for converting signals. +public enum SignalError: Error, CustomStringConvertible { + case invalidSignal(String) + + public var description: String { + switch self { + case .invalidSignal(let sig): + return "invalid signal: \(sig)" + } + } +} diff --git a/Sources/Containerization/SystemPlatform.swift b/Sources/Containerization/SystemPlatform.swift new file mode 100644 index 0000000..341ba50 --- /dev/null +++ b/Sources/Containerization/SystemPlatform.swift @@ -0,0 +1,41 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI + +/// `SystemPlatform` describes an operating system and architecture pair. +/// This is primarily used to choose what kind of OCI image to pull from a +/// registry. +public struct SystemPlatform: Sendable, Codable { + public enum OS: String, CaseIterable, Sendable, Codable { + case linux + case darwin + } + public let os: OS + + public enum Architecture: String, CaseIterable, Sendable, Codable { + case arm64 + case amd64 + } + public let architecture: Architecture + + public func ociPlatform() -> ContainerizationOCI.Platform { + ContainerizationOCI.Platform(arch: architecture.rawValue, os: os.rawValue) + } + + public static var linuxArm: SystemPlatform { .init(os: .linux, architecture: .arm64) } + public static var linuxAmd: SystemPlatform { .init(os: .linux, architecture: .amd64) } +} diff --git a/Sources/Containerization/TAPDevice.swift b/Sources/Containerization/TAPDevice.swift new file mode 100644 index 0000000..bae6e5a --- /dev/null +++ b/Sources/Containerization/TAPDevice.swift @@ -0,0 +1,155 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import CShim +import ContainerizationError +import ContainerizationExtras +import ContainerizationNetlink +import Foundation +import Synchronization + +#if canImport(Musl) +import Musl +let osClose = Musl.close +#elseif canImport(Glibc) +import Glibc +let osClose = Glibc.close +#endif + +/// A Linux TAP network device whose kernel interface lives only as long as +/// this `TAPDevice` instance. Created via `/dev/net/tun` + `ioctl(TUNSETIFF)`, +/// optionally enslaved to a pre-existing bridge, with MTU/MAC/UP applied via +/// netlink. The fd is held internally; closing it (explicitly or via deinit) +/// removes the interface from the kernel. +/// +/// `TUNSETPERSIST` is never called, so process death also cleans up the +/// device automatically. Cloud-hypervisor opens the same TAP **by name**; +/// the held fd keeps the interface alive across CH's open/close cycle. +/// +/// Requires `CAP_NET_ADMIN`. +public final class TAPDevice: Sendable { + /// The kernel-resolved interface name. May differ from the `name` + /// parameter passed to `init` if the kernel substituted one (e.g. when + /// `nil` was passed and the kernel picked `tapN`). + public let name: String + + public let mtu: UInt32 + + /// The MAC address as set on init, or nil if the kernel auto-assigned one. + /// Not read back from the kernel. + public let macAddress: MACAddress? + + private let _fd: Mutex + + /// Create a TAP device. + /// + /// - Parameters: + /// - name: Desired interface name. Empty or nil = kernel picks (`tap%d`). + /// Length must be < 16 (`IFNAMSIZ - 1`). + /// - bridge: Name of an existing bridge to enslave the TAP to, or nil. + /// - mtu: MTU in bytes (default 1500). + /// - macAddress: Hardware address to set, or nil to leave kernel default. + public init( + name: String? = nil, + bridge: String? = nil, + mtu: UInt32 = 1500, + macAddress: MACAddress? = nil + ) throws { + if let n = name, n.utf8.count >= 16 { + throw ContainerizationError( + .invalidArgument, + message: "TAP name too long: \(n) (must be < 16 chars)" + ) + } + + // 1. Open + TUNSETIFF via CShim. Returns fd on success, -errno on failure. + var resolved = [CChar](repeating: 0, count: 16) + let fd: Int32 = resolved.withUnsafeMutableBufferPointer { buf in + (name ?? "").withCString { reqPtr in + cz_tap_create(reqPtr, buf.baseAddress, 16) + } + } + guard fd >= 0 else { + throw ContainerizationError( + .internalError, + message: "cz_tap_create failed: errno=\(-fd)" + ) + } + + // From here on, any failure must close `fd` to release the kernel iface. + var fdToClean: Int32? = fd + defer { + if let f = fdToClean { + _ = osClose(f) + } + } + + let resolvedName: String = resolved.withUnsafeBufferPointer { buf in + // String(cString:) is deprecated in newer toolchains. Build the + // String from the NUL-terminated UTF-8 bytes directly. + let bytes = buf.prefix(while: { $0 != 0 }).map { UInt8(bitPattern: $0) } + return String(decoding: bytes, as: UTF8.self) + } + + // 2. Apply MAC and master via netlink (single RTM_NEWLINK). + let session = try NetlinkSession(socket: DefaultNetlinkSocket()) + do { + try session.linkSetAttributes( + interface: resolvedName, + macAddress: macAddress, + master: bridge + ) + } catch { + throw ContainerizationError( + .internalError, + message: "linkSetAttributes failed for \(resolvedName): \(error)" + ) + } + + // 3. Bring UP and set MTU. + do { + try session.linkSet(interface: resolvedName, up: true, mtu: mtu) + } catch { + throw ContainerizationError( + .internalError, + message: "linkSet(up:mtu:) failed for \(resolvedName): \(error)" + ) + } + + // 4. Success — store and clear cleanup. + self.name = resolvedName + self.mtu = mtu + self.macAddress = macAddress + self._fd = Mutex(fd) + fdToClean = nil + } + + /// Close the held fd, removing the interface from the kernel. Idempotent. + public func close() { + _fd.withLock { fd in + if let f = fd { + _ = osClose(f) + fd = nil + } + } + } + + deinit { + close() + } +} +#endif diff --git a/Sources/Containerization/TimeSyncer.swift b/Sources/Containerization/TimeSyncer.swift new file mode 100644 index 0000000..b6da252 --- /dev/null +++ b/Sources/Containerization/TimeSyncer.swift @@ -0,0 +1,87 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Logging + +actor TimeSyncer { + private var task: Task? + private var context: Vminitd? + private var paused: Bool + private let logger: Logger? + + init(logger: Logger?) { + self.paused = false + self.logger = logger + } + + func start(context: Vminitd, interval: Duration = .seconds(30)) { + guard self.task == nil else { + return + } + + self.context = context + self.task = Task { + while true { + do { + do { + try await Task.sleep(for: interval) + } catch { + return + } + + guard !paused else { + continue + } + + var timeval = timeval() + guard gettimeofday(&timeval, nil) == 0 else { + throw POSIXError.fromErrno() + } + + try await context.setTime( + sec: Int64(timeval.tv_sec), + usec: Int32(timeval.tv_usec) + ) + } catch { + self.logger?.error("failed to sync time with guest agent: \(error)") + } + } + } + } + + func pause() async { + self.paused = true + } + + func resume() async { + self.paused = false + } + + func close() async throws { + guard let task else { + // Already closed, nop. + return + } + + task.cancel() + await task.value + + try await self.context?.close() + self.task = nil + self.context = nil + } +} diff --git a/Sources/Containerization/UnixSocketConfiguration.swift b/Sources/Containerization/UnixSocketConfiguration.swift new file mode 100644 index 0000000..ec7f941 --- /dev/null +++ b/Sources/Containerization/UnixSocketConfiguration.swift @@ -0,0 +1,70 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +/// Represents a UnixSocket that can be shared into or out of a container/guest. +public struct UnixSocketConfiguration: Sendable { + // TODO: Realistically, we can just hash this struct and use it as the "id". + /// The unique identifier for this socket configuration. + public var id: String { + _id + } + + private let _id = UUID().uuidString + + /// The path to the socket you'd like relayed. For .into + /// direction this should be the path on the host to a unix socket. + /// For direction .outOf this should be the path in the container/guest + /// to a unix socket. + public var source: URL + + /// The path you'd like the socket to be relayed to. For .into + /// direction this should be the path in the container/guest. For + /// direction .outOf this should be the path on your host. + public var destination: URL + + /// What to set the file permissions of the unix socket being created + /// to. For .into direction this will be the socket in the guest. For + /// .outOf direction this will be the socket on the host. + public var permissions: FilePermissions? + + /// The direction of the relay. `.into` for sharing a unix socket on your + /// host into the container/guest. `outOf` shares a socket in the container/guest + /// onto your host. + public var direction: Direction + + /// Type that denotes the direction of the unix socket relay. + public enum Direction: Sendable { + /// Share the socket into the container/guest. + case into + /// Share a socket in the container/guest onto the host. + case outOf + } + + public init( + source: URL, + destination: URL, + permissions: FilePermissions? = nil, + direction: Direction = .into + ) { + self.source = source + self.destination = destination + self.permissions = permissions + self.direction = direction + } +} diff --git a/Sources/Containerization/UnixSocketRelay.swift b/Sources/Containerization/UnixSocketRelay.swift new file mode 100644 index 0000000..4069bf4 --- /dev/null +++ b/Sources/Containerization/UnixSocketRelay.swift @@ -0,0 +1,243 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationIO +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +package final class UnixSocketRelay: Sendable { + private let port: UInt32 + private let configuration: UnixSocketConfiguration + private let vm: any VirtualMachineInstance + private let log: Logger? + private let state: Mutex + + private struct State { + var activeRelays: [String: BidirectionalRelay] = [:] + var t: Task<(), Never>? = nil + var listener: VsockListener? = nil + } + + init( + port: UInt32, + socket: UnixSocketConfiguration, + vm: any VirtualMachineInstance, + log: Logger? = nil + ) throws { + self.port = port + self.configuration = socket + self.vm = vm + self.log = log + self.state = Mutex(.init()) + } + + deinit { + state.withLock { $0.t?.cancel() } + } +} + +extension UnixSocketRelay { + func start() async throws { + switch configuration.direction { + case .outOf: + try await setupHostVsockDial() + case .into: + try setupHostVsockListener() + } + } + + func stop() throws { + try state.withLock { + guard let t = $0.t else { + throw ContainerizationError( + .invalidState, + message: "failed to stop socket relay: relay has not been started" + ) + } + t.cancel() + $0.t = nil + for (_, relay) in $0.activeRelays { + relay.stop() + } + $0.activeRelays.removeAll() + + switch configuration.direction { + case .outOf: + // If we created the host conn, lets unlink it also. It's possible it was + // already unlinked if the relay failed earlier. + try? FileManager.default.removeItem(at: self.configuration.destination) + case .into: + try $0.listener?.finish() + } + } + } + + private func setupHostVsockDial() async throws { + let hostConn = configuration.destination + + let socketType = try UnixType( + path: hostConn.path, + unlinkExisting: true + ) + let hostSocket = try Socket(type: socketType) + try hostSocket.listen() + + log?.info( + "listening on host UDS", + metadata: [ + "path": "\(hostConn.path)", + "vport": "\(port)", + ]) + let connectionStream = try hostSocket.acceptStream(closeOnDeinit: false) + state.withLock { + $0.t = Task { + do { + for try await connection in connectionStream { + try await self.handleHostUnixConn( + hostConn: connection, + port: self.port, + vm: self.vm, + log: self.log + ) + } + } catch { + log?.error("failed in unix socket relay loop: \(error)") + } + try? FileManager.default.removeItem(at: hostConn) + } + } + } + + private func setupHostVsockListener() throws { + let hostPath = configuration.source + + let listener = try vm.listen(port) + log?.info( + "listening on guest vsock", + metadata: [ + "path": "\(hostPath)", + "vport": "\(port)", + ]) + + state.withLock { + $0.listener = listener + $0.t = Task { + do { + defer { try? listener.finish() } + for await connection in listener { + try await self.handleGuestVsockConn( + vsockConn: connection, + hostConnectionPath: hostPath, + port: self.port, + log: self.log + ) + } + } catch { + self.log?.error("failed to setup relay between vsock \(self.port) and \(hostPath.path): \(error)") + } + } + } + } + + private func handleHostUnixConn( + hostConn: ContainerizationOS.Socket, + port: UInt32, + vm: any VirtualMachineInstance, + log: Logger? + ) async throws { + do { + let guestConn = try await vm.dial(port) + log?.debug( + "initiating connection from host to guest", + metadata: [ + "vport": "\(port)", + "hostFd": "\(guestConn.fileDescriptor)", + "guestFd": "\(hostConn.fileDescriptor)", + ]) + try await self.relay( + hostConn: hostConn, + guestFd: guestConn.fileDescriptor + ) + } catch { + log?.error("failed to relay between vsock \(port) and \(hostConn)") + throw error + } + } + + private func handleGuestVsockConn( + vsockConn: FileHandle, + hostConnectionPath: URL, + port: UInt32, + log: Logger? + ) async throws { + let hostPath = hostConnectionPath.path + let socketType = try UnixType(path: hostPath) + let hostSocket = try Socket( + type: socketType, + closeOnDeinit: false + ) + log?.debug( + "initiating connection from guest to host", + metadata: [ + "vport": "\(port)", + "hostFd": "\(hostSocket.fileDescriptor)", + "guestFd": "\(vsockConn.fileDescriptor)", + ]) + try hostSocket.connect() + + do { + try await self.relay( + hostConn: hostSocket, + guestFd: vsockConn.fileDescriptor + ) + } catch { + log?.error("failed to relay between vsock \(port) and \(hostPath)") + } + } + + private func relay( + hostConn: Socket, + guestFd: Int32 + ) async throws { + let hostFd = hostConn.fileDescriptor + + let relayID = UUID().uuidString + let relay = BidirectionalRelay( + fd1: hostFd, + fd2: guestFd, + log: log + ) + + state.withLock { + $0.activeRelays[relayID] = relay + } + + do { + try relay.start() + } catch { + state.withLock { $0.activeRelays[relayID] = nil } + throw error + } + + Task { + await relay.waitForCompletion() + state.withLock { $0.activeRelays[relayID] = nil } + } + } +} diff --git a/Sources/Containerization/UnixSocketRelayManager.swift b/Sources/Containerization/UnixSocketRelayManager.swift new file mode 100644 index 0000000..f1f9d3d --- /dev/null +++ b/Sources/Containerization/UnixSocketRelayManager.swift @@ -0,0 +1,73 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation +import Logging + +package actor UnixSocketRelayManager { + private let vm: any VirtualMachineInstance + private var relays: [String: UnixSocketRelay] + private let log: Logger? + + init(vm: any VirtualMachineInstance, log: Logger? = nil) { + self.vm = vm + self.relays = [:] + self.log = log + } +} + +extension UnixSocketRelayManager { + func start(port: UInt32, socket: UnixSocketConfiguration) async throws { + guard relays[socket.id] == nil else { + throw ContainerizationError( + .invalidState, + message: "socket relay \(socket.id) already started" + ) + } + + let relay = try UnixSocketRelay( + port: port, + socket: socket, + vm: vm, + log: log + ) + + do { + relays[socket.id] = relay + try await relay.start() + } catch { + relays.removeValue(forKey: socket.id) + throw error + } + } + + func stop(socket: UnixSocketConfiguration) async throws { + guard let storedRelay = relays.removeValue(forKey: socket.id) else { + throw ContainerizationError( + .notFound, + message: "failed to stop socket relay" + ) + } + try storedRelay.stop() + } + + func stopAll() async throws { + for (_, relay) in relays { + try relay.stop() + } + } +} diff --git a/Sources/Containerization/VMConfiguration.swift b/Sources/Containerization/VMConfiguration.swift new file mode 100644 index 0000000..30faebc --- /dev/null +++ b/Sources/Containerization/VMConfiguration.swift @@ -0,0 +1,103 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI +import Foundation + +/// Destination for boot log (serial console) output. +public struct BootLog: Sendable { + /// The underlying representation of the boot log destination. + internal enum Representation: Sendable { + case file(path: URL, append: Bool) + case fileHandle(FileHandle) + } + + internal var base: Representation + + /// Write boot logs to a file at the specified path. + /// + /// - Parameters: + /// - path: The URL of the file to write boot logs to. + /// - append: Whether to append to an existing file or overwrite it. Defaults to true. + /// + /// - Returns: A boot log destination that writes to a file. + public static func file(path: URL, append: Bool = true) -> BootLog { + self.init(base: .file(path: path, append: append)) + } + + /// Write boot logs to a file handle. + /// + /// - Parameter fileHandle: The file handle to write boot logs to. + /// + /// - Returns: A boot log destination that writes to a file handle. + public static func fileHandle(_ fileHandle: FileHandle) -> BootLog { + self.init(base: .fileHandle(fileHandle)) + } +} + +/// Protocol for VM creation configuration. Allows VMMs to extend with specific settings +/// while maintaining a common core configuration. +public protocol VMCreationConfig: Sendable { + /// The common VM configuration that all VMMs must support. + var configuration: VMConfiguration { get } +} + +/// Standard VM creation configuration with only common settings. +public struct StandardVMConfig: VMCreationConfig { + public var configuration: VMConfiguration + + public init(configuration: VMConfiguration) { + self.configuration = configuration + } +} + +/// Configuration for creating a virtual machine instance. +public struct VMConfiguration: Sendable { + /// The amount of CPUs to allocate. + public var cpus: Int + /// The memory in bytes to allocate. + public var memoryInBytes: UInt64 + /// The network interfaces to attach. + public var interfaces: [any Interface] + /// Mounts organized by metadata ID (e.g. container ID). + /// Each ID maps to an array of mounts for that workload. + public var mountsByID: [String: [Mount]] + /// Optional destination for serial boot logs. + public var bootLog: BootLog? + /// Enable nested virtualization support. If the VirtualMachineManager + /// does not support this feature, it MUST return an .unsupported ContainerizationError. + public var nestedVirtualization: Bool + /// Extension objects that participate in the VM instance lifecycle. + /// Extension packages append their types here; VZ-aware extensions + /// should conform to ``VZInstanceExtension``. + public var extensions: [any Sendable] = [] + + public init( + cpus: Int = 4, + memoryInBytes: UInt64 = 1024 * 1024 * 1024, + interfaces: [any Interface] = [], + mountsByID: [String: [Mount]] = [:], + bootLog: BootLog? = nil, + nestedVirtualization: Bool = false + ) { + self.cpus = cpus + self.memoryInBytes = memoryInBytes + self.interfaces = interfaces + self.mountsByID = mountsByID + self.bootLog = bootLog + self.nestedVirtualization = nestedVirtualization + } +} diff --git a/Sources/Containerization/VZVirtualMachine+Helpers.swift b/Sources/Containerization/VZVirtualMachine+Helpers.swift new file mode 100644 index 0000000..2cbadb1 --- /dev/null +++ b/Sources/Containerization/VZVirtualMachine+Helpers.swift @@ -0,0 +1,152 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +import Foundation +import Logging +import Virtualization +import ContainerizationError + +extension VZVirtualMachine { + nonisolated func connect(queue: DispatchQueue, port: UInt32) async throws -> VZVirtioSocketConnection { + try await withCheckedThrowingContinuation { cont in + queue.sync { + guard let vsock = self.socketDevices[0] as? VZVirtioSocketDevice else { + let error = ContainerizationError(.invalidArgument, message: "no vsock device") + cont.resume(throwing: error) + return + } + vsock.connect(toPort: port) { result in + switch result { + case .success(let conn): + // `conn` isn't used concurrently. + nonisolated(unsafe) let conn = conn + cont.resume(returning: conn) + case .failure(let error): + cont.resume(throwing: error) + } + } + } + } + } + + func listen(queue: DispatchQueue, port: UInt32, listener: VZVirtioSocketListener) throws { + try queue.sync { + guard let vsock = self.socketDevices[0] as? VZVirtioSocketDevice else { + throw ContainerizationError(.invalidArgument, message: "no vsock device") + } + vsock.setSocketListener(listener, forPort: port) + } + } + + func removeListener(queue: DispatchQueue, port: UInt32) throws { + try queue.sync { + guard let vsock = self.socketDevices[0] as? VZVirtioSocketDevice else { + throw ContainerizationError( + .invalidArgument, + message: "no vsock device to remove" + ) + } + vsock.removeSocketListener(forPort: port) + } + } + + func start(queue: DispatchQueue) async throws { + try await withCheckedThrowingContinuation { (cont: CheckedContinuation) in + queue.sync { + self.start { result in + if case .failure(let error) = result { + cont.resume(throwing: error) + return + } + cont.resume() + } + } + } + } + + func stop(queue: DispatchQueue) async throws { + try await withCheckedThrowingContinuation { (cont: CheckedContinuation) in + queue.sync { + self.stop { error in + if let error { + cont.resume(throwing: error) + return + } + cont.resume() + } + } + } + } + + func pause(queue: DispatchQueue) async throws { + try await withCheckedThrowingContinuation { (cont: CheckedContinuation) in + queue.sync { + self.pause { result in + if case .failure(let error) = result { + cont.resume(throwing: error) + return + } + cont.resume() + } + } + } + } + + func resume(queue: DispatchQueue) async throws { + try await withCheckedThrowingContinuation { (cont: CheckedContinuation) in + queue.sync { + self.resume { result in + if case .failure(let error) = result { + cont.resume(throwing: error) + return + } + cont.resume() + } + } + } + } +} + +extension VZVirtualMachine { + func waitForAgent(queue: DispatchQueue) async throws -> FileHandle { + let agentConnectionRetryCount: Int = 200 + let agentConnectionSleepDuration: Duration = .milliseconds(20) + + for _ in 0...agentConnectionRetryCount { + do { + return try await self.connect(queue: queue, port: Vminitd.port).dupHandle() + } catch { + try await Task.sleep(for: agentConnectionSleepDuration) + continue + } + } + throw ContainerizationError(.timeout, message: "failed to get a connection to agent socket") + } +} + +extension VZVirtioSocketConnection { + func dupHandle() throws -> FileHandle { + let fd = dup(self.fileDescriptor) + if fd == -1 { + throw POSIXError.fromErrno() + } + self.close() + return FileHandle(fileDescriptor: fd, closeOnDealloc: false) + } +} + +#endif diff --git a/Sources/Containerization/VZVirtualMachineInstance.swift b/Sources/Containerization/VZVirtualMachineInstance.swift new file mode 100644 index 0000000..160c502 --- /dev/null +++ b/Sources/Containerization/VZVirtualMachineInstance.swift @@ -0,0 +1,587 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +import Foundation +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Logging +import NIOCore +import NIOPosix +import Synchronization +@preconcurrency import Virtualization + +public final class VZVirtualMachineInstance: Sendable { + public typealias Agent = Vminitd + + /// Attached mounts on the virtual machine, organized by metadata ID. + private let _mounts: Mutex<[String: [AttachedFilesystem]]> + public var mounts: [String: [AttachedFilesystem]] { + _mounts.withLock { $0 } + } + + /// The underlying Virtualization framework virtual machine. + public var vzVirtualMachine: VZVirtualMachine { vm } + + /// The dispatch queue used for VZ operations. + public var vmQueue: DispatchQueue { queue } + + /// Mutate the mount registry. + public func withMountRegistry(_ body: (inout sending [String: [AttachedFilesystem]]) throws -> sending T) rethrows -> T { + try _mounts.withLock(body) + } + + /// Serialize VM operations with the instance lock. + public func withInstanceLock(_ body: @Sendable @escaping () async throws -> T) async throws -> T { + try await lock.withLock { _ in try await body() } + } + + /// The hotplug provider, if hotplug is enabled for this instance. + public var hotplugProvider: (any HotplugProvider)? { + get { _hotplugProvider.withLock { $0 } } + set { _hotplugProvider.withLock { $0 = newValue } } + } + private let _hotplugProvider = Mutex<(any HotplugProvider)?>(nil) + + /// Returns the runtime state of the vm. + public var state: VirtualMachineInstanceState { + vzStateToInstanceState() + } + + /// The virtual machine instance configuration. + private let config: Configuration + public struct Configuration: Sendable { + /// Amount of cpus to allocated. + public var cpus: Int + /// Amount of memory in bytes allocated. + public var memoryInBytes: UInt64 + /// Toggle rosetta's x86_64 emulation support. + public var rosetta: Bool + /// Toggle nested virtualization support. + public var nestedVirtualization: Bool + /// Mount attachments organized by metadata ID. + public var mountsByID: [String: [Mount]] + /// Network interface attachments. + public var interfaces: [any Interface] + /// Kernel image. + public var kernel: Kernel? + /// The root filesystem. + public var initialFilesystem: Mount? + /// Destination for the virtual machine's boot logs. + public var bootLog: BootLog? + /// Extension objects that participate in the VM instance lifecycle. + public var extensions: [any Sendable] = [] + + public init() { + self.cpus = 4 + self.memoryInBytes = 1024.mib() + self.rosetta = false + self.nestedVirtualization = false + self.mountsByID = [:] + self.interfaces = [] + } + } + + // `vm` isn't used concurrently. + private nonisolated(unsafe) let vm: VZVirtualMachine + private let queue: DispatchQueue + private let lock: AsyncLock + private let group: EventLoopGroup + private let ownsGroup: Bool + private let timeSyncer: TimeSyncer + private let logger: Logger? + + public convenience init( + group: EventLoopGroup? = nil, + logger: Logger? = nil, + with: (inout Configuration) throws -> Void + ) throws { + var config = Configuration() + try with(&config) + try self.init(group: group, config: config, logger: logger) + } + + init(group: EventLoopGroup?, config: Configuration, logger: Logger?) throws { + if let group { + self.ownsGroup = false + self.group = group + } else { + self.ownsGroup = true + self.group = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount) + } + + self.config = config + self.lock = .init() + self.queue = DispatchQueue(label: "com.apple.containerization.vzvm.\(UUID().uuidString)") + self.logger = logger + self.timeSyncer = .init(logger: logger) + + let allocator = Character.blockDeviceTagAllocator() + let (mountAttachments, _) = try config.mountAttachments(allocator: allocator) + self._mounts = Mutex(mountAttachments) + + self.vm = VZVirtualMachine( + configuration: try config.toVZ(allocator: allocator), + queue: self.queue + ) + + for ext in config.extensions.compactMap({ $0 as? any VZInstanceExtension }) { + try ext.didCreate(self) + } + } +} + +/// Protocol for extensions that participate in VZVirtualMachineInstance lifecycle. +/// Append conforming types to `Configuration.extensions` to hook into VM setup and teardown. +public protocol VZInstanceExtension: Sendable { + /// Modify the VZ configuration before the VM is created. + func configureVZ( + _ config: inout VZVirtualMachineConfiguration, + allocator: any AddressAllocator, + storageDeviceCount: Int, + mountsByID: [String: [Mount]] + ) throws + + /// Called after the VZVirtualMachine is created but before start. + func didCreate(_ instance: VZVirtualMachineInstance) throws + + /// Called during stop before the VM is shut down. + func willStop(_ instance: VZVirtualMachineInstance) async throws +} + +extension VZInstanceExtension { + public func configureVZ( + _ config: inout VZVirtualMachineConfiguration, + allocator: any AddressAllocator, + storageDeviceCount: Int, + mountsByID: [String: [Mount]] + ) throws {} + + public func didCreate(_ instance: VZVirtualMachineInstance) throws {} + + public func willStop(_ instance: VZVirtualMachineInstance) async throws {} +} + +extension VZVirtualMachineInstance: VirtualMachineInstance { + public func start() async throws { + try await lock.withLock { _ in + guard self.state == .stopped else { + throw ContainerizationError( + .invalidState, + message: "virtual machine is not stopped \(self.state)" + ) + } + + // Do any necessary setup needed prior to starting the guest. + try await self.prestart() + + try await self.vm.start(queue: self.queue) + + let agent = try await Vminitd( + connection: try await self.vm.waitForAgent(queue: self.queue), + group: self.group + ) + + do { + if self.config.rosetta { + try await agent.enableRosetta() + } + } catch { + try await agent.close() + throw error + } + + // Don't close our remote context as we are providing + // it to our time sync routine. + await self.timeSyncer.start(context: agent) + } + } + + public func stop() async throws { + try await lock.withLock { connections in + // NOTE: We should record HOW the vm stopped eventually. If the vm exited + // unexpectedly virtualization framework offers you a way to store + // an error on how it exited. We should report that here instead of the + // generic vm is not running. + guard self.state == .running else { + throw ContainerizationError(.invalidState, message: "vm is not running") + } + + try await self.timeSyncer.close() + + if self.ownsGroup { + try await self.group.shutdownGracefully() + } + + for ext in self.config.extensions.compactMap({ $0 as? any VZInstanceExtension }) { + try? await ext.willStop(self) + } + + try await self.vm.stop(queue: self.queue) + } + } + + // NOTE: Investigate what is the "right" way to handle already vended vsock + // connections for pause and resume. + + public func pause() async throws { + try await lock.withLock { _ in + await self.timeSyncer.pause() + try await self.vm.pause(queue: self.queue) + } + } + + public func resume() async throws { + try await lock.withLock { _ in + try await self.vm.resume(queue: self.queue) + await self.timeSyncer.resume() + } + } + + public func dialAgent() async throws -> Vminitd { + try await lock.withLock { _ in + do { + let conn = try await self.vm.connect( + queue: self.queue, + port: Vminitd.port + ) + let handle = try conn.dupHandle() + return try await Vminitd(connection: handle, group: self.group) + } catch { + if let err = error as? ContainerizationError { + throw err + } + throw ContainerizationError( + .internalError, + message: "failed to dial agent", + cause: error + ) + } + } + } + + public func dial(_ port: UInt32) async throws -> FileHandle { + try await lock.withLock { _ in + do { + let conn = try await self.vm.connect( + queue: self.queue, + port: port + ) + return try conn.dupHandle() + } catch { + if let err = error as? ContainerizationError { + throw err + } + throw ContainerizationError( + .internalError, + message: "failed to dial vsock port", + cause: error + ) + } + } + } + + public func listen(_ port: UInt32) throws -> VsockListener { + let stream = VsockListener(port: port, stopListen: self.stopListen) + let listener = VZVirtioSocketListener() + listener.delegate = stream + + try self.vm.listen( + queue: queue, + port: port, + listener: listener + ) + return stream + } + + private func stopListen(_ port: UInt32) throws { + try self.vm.removeListener( + queue: queue, + port: port + ) + } + + // MARK: - Hotplug + + public func hotplug(_ block: Mount, id: String) async throws -> AttachedFilesystem { + guard let hotplugProvider else { + throw ContainerizationError(.unsupported, message: "hotplug not supported") + } + return try await hotplugProvider.hotplug(block, id: id) + } + + public func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws { + guard let hotplugProvider else { return } + try hotplugProvider.registerMounts(id: id, rootfs: rootfs, additionalMounts: additionalMounts) + } + + public func releaseHotplug(id: String) async throws { + guard let hotplugProvider else { return } + try await hotplugProvider.releaseHotplug(id: id) + } + + public func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws { + guard let hotplugProvider else { return } + try await hotplugProvider.hotplugVirtioFS(mounts, id: id) + } + + public func releaseVirtioFS(id: String) async throws { + guard let hotplugProvider else { return } + try await hotplugProvider.releaseVirtioFS(id: id) + } +} + +extension VZVirtualMachineInstance { + func vzStateToInstanceState() -> VirtualMachineInstanceState { + self.queue.sync { + let state: VirtualMachineInstanceState + switch self.vm.state { + case .starting: + state = .starting + case .running: + state = .running + case .stopping: + state = .stopping + case .stopped: + state = .stopped + default: + state = .unknown + } + return state + } + } + + func prestart() async throws { + if self.config.rosetta { + #if arch(arm64) + if VZLinuxRosettaDirectoryShare.availability == .notInstalled { + self.logger?.info("installing rosetta") + try await VZVirtualMachineInstance.Configuration.installRosetta() + } + #else + fatalError("rosetta is only supported on arm64") + #endif + } + } +} + +extension VZVirtualMachineInstance.Configuration { + public static func installRosetta() async throws { + do { + #if arch(arm64) + try await VZLinuxRosettaDirectoryShare.installRosetta() + #else + fatalError("rosetta is only supported on arm64") + #endif + } catch { + throw ContainerizationError( + .internalError, + message: "failed to install rosetta", + cause: error + ) + } + } + + private func serialPort(destination: BootLog) throws -> [VZVirtioConsoleDeviceSerialPortConfiguration] { + let c = VZVirtioConsoleDeviceSerialPortConfiguration() + switch destination.base { + case .file(let path, let append): + c.attachment = try VZFileSerialPortAttachment(url: path, append: append) + case .fileHandle(let fileHandle): + c.attachment = VZFileHandleSerialPortAttachment( + fileHandleForReading: nil, + fileHandleForWriting: fileHandle + ) + } + return [c] + } + + func toVZ(allocator: any AddressAllocator) throws -> VZVirtualMachineConfiguration { + var config = VZVirtualMachineConfiguration() + + config.cpuCount = self.cpus + let mib: UInt64 = 1 << 20 + config.memorySize = (self.memoryInBytes + mib - 1) & ~(mib - 1) + config.entropyDevices = [VZVirtioEntropyDeviceConfiguration()] + config.socketDevices = [VZVirtioSocketDeviceConfiguration()] + + if let bootLog = self.bootLog { + config.serialPorts = try serialPort(destination: bootLog) + } else { + // We always supply a serial console. If no explicit path was provided just send em to the void. + config.serialPorts = try serialPort(destination: .file(path: URL(filePath: "/dev/null"))) + } + + config.networkDevices = try self.interfaces.map { + guard let vzi = $0 as? VZInterface else { + throw ContainerizationError(.invalidArgument, message: "interface type not supported by VZ") + } + return try vzi.device() + } + + if self.rosetta { + #if arch(arm64) + switch VZLinuxRosettaDirectoryShare.availability { + case .notSupported: + throw ContainerizationError( + .invalidArgument, + message: "rosetta was requested but is not supported on this machine" + ) + case .notInstalled: + // NOTE: If rosetta isn't installed, we'll error with a nice error message + // during .start() of the virtual machine instance. + fallthrough + case .installed: + let share = try VZLinuxRosettaDirectoryShare() + let device = VZVirtioFileSystemDeviceConfiguration(tag: "rosetta") + device.share = share + config.directorySharingDevices.append(device) + @unknown default: + throw ContainerizationError( + .invalidArgument, + message: "unknown rosetta availability encountered: \(VZLinuxRosettaDirectoryShare.availability)" + ) + } + #else + fatalError("rosetta is only supported on arm64") + #endif + } + + guard let kernel = self.kernel else { + throw ContainerizationError(.invalidArgument, message: "kernel cannot be nil") + } + + guard let initialFilesystem = self.initialFilesystem else { + throw ContainerizationError(.invalidArgument, message: "rootfs cannot be nil") + } + + let loader = VZLinuxBootLoader(kernelURL: kernel.path) + loader.commandLine = kernel.linuxCommandline(initialFilesystem: initialFilesystem) + config.bootLoader = loader + + try initialFilesystem.configure(config: &config) + + // Track used virtiofs tags to avoid creating duplicate VZ devices. + // The same source directory mounted to multiple destinations shares one device. + var usedVirtioFSTags: Set = [] + for (_, mounts) in self.mountsByID { + for mount in mounts { + if case .virtiofs = mount.runtimeOptions { + let tag = try hashFilePath(path: mount.source) + if usedVirtioFSTags.contains(tag) { + continue + } + usedVirtioFSTags.insert(tag) + } + try mount.configure(config: &config) + } + } + + // Create the unified virtiofs device with VZMultipleDirectoryShare + // This device hosts all virtiofs shares and supports runtime updates + var directories: [String: VZSharedDirectory] = [:] + for (_, mounts) in self.mountsByID { + for mount in mounts { + guard case .virtiofs(_) = mount.runtimeOptions else { continue } + guard FileManager.default.fileExists(atPath: mount.source) else { + throw ContainerizationError(.notFound, message: "directory \(mount.source) does not exist") + } + let name = try hashFilePath(path: mount.source) + directories[name] = VZSharedDirectory( + url: URL(fileURLWithPath: mount.source), + readOnly: mount.options.contains("ro") + ) + } + } + let multiShare = VZMultipleDirectoryShare(directories: directories) + let virtiofsDevice = VZVirtioFileSystemDeviceConfiguration(tag: "virtiofs") + virtiofsDevice.share = multiShare + config.directorySharingDevices.append(virtiofsDevice) + + let storageDeviceCount = config.storageDevices.count + + let platform = VZGenericPlatformConfiguration() + // We shouldn't silently succeed if the user asked for virt and their hardware does + // not support it. + if !VZGenericPlatformConfiguration.isNestedVirtualizationSupported && self.nestedVirtualization { + throw ContainerizationError( + .unsupported, + message: "nested virtualization is not supported on the platform" + ) + } + platform.isNestedVirtualizationEnabled = self.nestedVirtualization + config.platform = platform + + for ext in self.extensions.compactMap({ $0 as? any VZInstanceExtension }) { + try ext.configureVZ(&config, allocator: allocator, storageDeviceCount: storageDeviceCount, mountsByID: self.mountsByID) + } + + try config.validate() + return config + } + + func mountAttachments(allocator: any AddressAllocator) throws -> ( + attachments: [String: [AttachedFilesystem]], storageDeviceCount: Int + ) { + var storageDeviceCount = 0 + + if let initialFilesystem { + // When the initial filesystem is a blk, allocate the first letter "vd(a)" + // as that is what this blk will be attached under. + if initialFilesystem.isBlock { + _ = try allocator.allocate() + storageDeviceCount += 1 + } + } + + var attachmentsByID: [String: [AttachedFilesystem]] = [:] + + for (id, mounts) in self.mountsByID { + var attachments: [AttachedFilesystem] = [] + for mount in mounts { + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + attachments.append(attached) + if mount.isBlock { + storageDeviceCount += 1 + } + } + attachmentsByID[id] = attachments + } + + return (attachmentsByID, storageDeviceCount) + } +} + +public protocol VZInterface { + func device() throws -> VZVirtioNetworkDeviceConfiguration +} + +extension NATInterface: VZInterface { + public func device() throws -> VZVirtioNetworkDeviceConfiguration { + let config = VZVirtioNetworkDeviceConfiguration() + if let macAddress = self.macAddress { + guard let mac = VZMACAddress(string: macAddress.description) else { + throw ContainerizationError(.invalidArgument, message: "invalid mac address \(macAddress)") + } + config.macAddress = mac + } + config.attachment = VZNATNetworkDeviceAttachment() + return config + } +} + +#endif diff --git a/Sources/Containerization/VZVirtualMachineManager.swift b/Sources/Containerization/VZVirtualMachineManager.swift new file mode 100644 index 0000000..4959bee --- /dev/null +++ b/Sources/Containerization/VZVirtualMachineManager.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +import ContainerizationError +import ContainerizationOCI +import Foundation +import Logging +import NIOCore + +/// A virtualization.framework backed `VirtualMachineManager` implementation. +public struct VZVirtualMachineManager: VirtualMachineManager { + private let kernel: Kernel + private let initialFilesystem: Mount + private let rosetta: Bool + private let nestedVirtualization: Bool + private let group: EventLoopGroup? + private let logger: Logger? + + public init( + kernel: Kernel, + initialFilesystem: Mount, + rosetta: Bool = false, + nestedVirtualization: Bool = false, + group: EventLoopGroup? = nil, + logger: Logger? = nil + ) { + self.kernel = kernel + self.initialFilesystem = initialFilesystem + self.rosetta = rosetta + self.nestedVirtualization = nestedVirtualization + self.group = group + self.logger = logger + } + + public func create(config: some VMCreationConfig) throws -> any VirtualMachineInstance { + let vmConfig = config.configuration + + // Use nested virtualization if requested in config or set as default in manager + let useNestedVirtualization = vmConfig.nestedVirtualization || self.nestedVirtualization + + // Clamp to system RAM as Virtualization.framework bounds us to this. + let memoryInBytes = min(vmConfig.memoryInBytes, ProcessInfo.processInfo.physicalMemory) + + // Clamp to system CPU count as Virtualization.framework bounds us to this. + let cpus = min(vmConfig.cpus, ProcessInfo.processInfo.activeProcessorCount) + + return try VZVirtualMachineInstance( + group: self.group, + logger: self.logger, + with: { instanceConfig in + instanceConfig.cpus = cpus + instanceConfig.memoryInBytes = memoryInBytes + + instanceConfig.kernel = self.kernel + instanceConfig.initialFilesystem = self.initialFilesystem + + if let bootLog = vmConfig.bootLog { + instanceConfig.bootLog = bootLog + } + + instanceConfig.interfaces = vmConfig.interfaces + instanceConfig.rosetta = self.rosetta + instanceConfig.nestedVirtualization = useNestedVirtualization + + instanceConfig.mountsByID = vmConfig.mountsByID + instanceConfig.extensions = vmConfig.extensions + }) + } +} +#endif diff --git a/Sources/Containerization/VirtiofsdProcess.swift b/Sources/Containerization/VirtiofsdProcess.swift new file mode 100644 index 0000000..7c73bd1 --- /dev/null +++ b/Sources/Containerization/VirtiofsdProcess.swift @@ -0,0 +1,187 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationExtras +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +/// A managed `virtiofsd` subprocess serving a single shared directory. +/// +/// One `VirtiofsdProcess` per virtio-fs share. Cloud Hypervisor connects to +/// the published UDS via its `FsConfig.socket` field. Lifecycle mirrors +/// `CHProcess`: spawn + wait-for-socket on `start()`, SIGTERM/SIGKILL on +/// `terminate()`. +final class VirtiofsdProcess: Sendable { + struct Config: Sendable { + let binary: URL + let socketPath: URL + let sharedDir: URL + let readonly: Bool + } + + private struct State { + var command: Command? + var exitTask: Task? + } + + private let config: Config + private let logger: Logger? + private let state: Mutex + + init(config: Config, logger: Logger?) { + self.config = config + self.logger = logger + self.state = Mutex(State(command: nil, exitTask: nil)) + } + + /// Spawn virtiofsd and wait for its UDS to accept connections. + func start() async throws { + var arguments = [ + "--socket-path", config.socketPath.path, + "--shared-dir", config.sharedDir.path, + ] + if SandboxOverrides.virtiofsdSandboxDisabled { + // virtiofsd defaults to `--sandbox namespace`, which sets up a + // userns + pivot_root + seccomp filter. Inside apple/container's + // --virtualization dev container the default seccomp profile + // SIGSYS-kills processes that hit unfiltered syscalls (same + // reason CH runs with `--seccomp false`). `--sandbox none` + // skips both userns setup and seccomp; safe inside the per-VM + // dev container only. Opt-in via + // CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1. + logger?.warning( + "virtiofsd launching with --sandbox none (CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1) — userns/pivot_root/seccomp setup disabled" + ) + arguments.append(contentsOf: ["--sandbox", "none"]) + } + if config.readonly { + arguments.append("--readonly") + } + + var command = Command( + config.binary.path, + arguments: arguments, + environment: ChildEnvironment.minimal() + ) + // Inherit stderr so virtiofsd's startup logs surface in the host's + // log stream rather than vanishing into /dev/null (Command's default). + command.stderr = FileHandle.standardError + // Same rationale as CHProcess: keep virtiofsd out of the parent's + // controlling-TTY signal group so Ctrl-C doesn't kill it before our + // own terminate() ladder runs. + command.attrs.setsid = true + do { + try command.start() + } catch { + throw error + } + + let exitTask = Task.detached { [command, logger] in + do { + _ = try command.wait() + } catch { + logger?.error("virtiofsd wait failed: \(error)") + } + } + + state.withLock { + $0.command = command + $0.exitTask = exitTask + } + + try await waitForSocket() + } + + /// SIGTERM → grace window → SIGKILL. Returns once virtiofsd is reaped. + func terminate(graceSeconds: UInt32) async { + guard let command = state.withLock({ $0.command }) else { return } + + _ = command.kill(SIGTERM) + + do { + try await Timeout.run(for: .seconds(Int(graceSeconds))) { + await self.waitForExit() + } + } catch { + logger?.warning("virtiofsd did not exit within \(graceSeconds)s, sending SIGKILL") + _ = command.kill(SIGKILL) + await waitForExit() + } + } + + // MARK: - Private helpers + + private static let socketDeadline: Duration = .seconds(10) + private static let socketPollInterval: Duration = .milliseconds(50) + + private func waitForExit() async { + guard let task = state.withLock({ $0.exitTask }) else { return } + await task.value + } + + private func waitForSocket() async throws { + let clock = ContinuousClock() + let started = clock.now + let deadline = started.advanced(by: Self.socketDeadline) + + while clock.now < deadline { + if Self.isSocketReady(at: config.socketPath) { + let elapsed = clock.now - started + logger?.debug("virtiofsd socket bound in \(elapsed) at \(config.socketPath.path)") + return + } + try? await Task.sleep(for: Self.socketPollInterval) + } + + // Capture diagnostic state before terminating. + let fm = FileManager.default + let socketExists = fm.fileExists(atPath: config.socketPath.path) + let parentExists = fm.fileExists(atPath: config.socketPath.deletingLastPathComponent().path) + let sharedExists = fm.fileExists(atPath: config.sharedDir.path) + let detail = "socketExists=\(socketExists) parentDirExists=\(parentExists) sharedDirExists=\(sharedExists)" + + await terminate(graceSeconds: 5) + throw ContainerizationError( + .timeout, + message: "virtiofsd socket not connectable at \(config.socketPath.path) within \(Self.socketDeadline) [\(detail)]" + ) + } + + private static func isSocketReady(at url: URL) -> Bool { + // Only check that the socket file exists. Do NOT connect — virtiofsd + // runs in vhost-user mode where the first incoming connection is + // treated as the VMM (cloud-hypervisor); when that connection closes, + // virtiofsd exits. A connect-then-close readiness probe therefore + // kills virtiofsd before CH ever gets to it, leaving CH's vm.boot + // failing with "vhost-user: can't connect to peer: No such file + // or directory". + var st = stat() + guard stat(url.path, &st) == 0 else { return false } + return (st.st_mode & S_IFMT) == S_IFSOCK + } + +} +#endif diff --git a/Sources/Containerization/VirtualMachineAgent+Additions.swift b/Sources/Containerization/VirtualMachineAgent+Additions.swift new file mode 100644 index 0000000..2136a56 --- /dev/null +++ b/Sources/Containerization/VirtualMachineAgent+Additions.swift @@ -0,0 +1,22 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Protocol to conform to if your agent is capable of relaying unix domain socket +/// connections. +public protocol SocketRelayAgent { + func relaySocket(port: UInt32, configuration: UnixSocketConfiguration) async throws + func stopSocketRelay(configuration: UnixSocketConfiguration) async throws +} diff --git a/Sources/Containerization/VirtualMachineAgent+Interface.swift b/Sources/Containerization/VirtualMachineAgent+Interface.swift new file mode 100644 index 0000000..e2fe722 --- /dev/null +++ b/Sources/Containerization/VirtualMachineAgent+Interface.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import Logging + +extension VirtualMachineAgent { + /// Configure a single network interface inside the sandbox: assign addresses, + /// bring the link up, and (when requested) install the link/default routes. + func setupInterface( + _ interface: any Interface, + name: String, + setDefaultRoute: Bool, + logger: Logger? + ) async throws { + logger?.debug("setting up interface \(name) with v4 \(interface.ipv4Address) v6 \(interface.ipv6Address?.description ?? "")") + try await addressAdd( + name: name, + address: .init(ipv4Address: interface.ipv4Address, ipv6Address: interface.ipv6Address) + ) + try await up(name: name, mtu: interface.mtu) + + guard setDefaultRoute else { return } + + let ipv4Address = interface.ipv4Address + let ipv4Gateway = interface.ipv4Gateway + let ipv6Gateway = interface.ipv6Gateway + let ipv6Address = interface.ipv6Address + + let needsIPv4LinkRoute: Bool + if let ipv4Gateway { + needsIPv4LinkRoute = !ipv4Address.contains(ipv4Gateway) + } else { + needsIPv4LinkRoute = false + } + + let needsIPv6LinkRoute: Bool + if let ipv6Gateway, let ipv6Address { + needsIPv6LinkRoute = !ipv6Address.contains(ipv6Gateway) + } else { + needsIPv6LinkRoute = false + } + + if needsIPv4LinkRoute, let ipv4Gateway { + logger?.debug("v4 gateway \(ipv4Gateway) is outside subnet \(ipv4Address), adding a route first") + } + if needsIPv6LinkRoute, let ipv6Gateway, let ipv6Address { + logger?.debug("v6 gateway \(ipv6Gateway) is outside subnet \(ipv6Address), adding a route first") + } + + if needsIPv4LinkRoute || needsIPv6LinkRoute { + try await routeAddLink( + name: name, + route: .init( + ipv4Destination: needsIPv4LinkRoute ? ipv4Gateway : nil, + ipv4Source: needsIPv4LinkRoute ? ipv4Address.address : nil, + ipv6Destination: needsIPv6LinkRoute ? ipv6Gateway : nil, + ipv6Source: needsIPv6LinkRoute ? ipv6Address?.address : nil + ) + ) + } + + if ipv4Gateway == nil && ipv6Gateway == nil { + logger?.debug("no gateway for \(name)") + } + try await routeAddDefault( + name: name, + route: .init(ipv4Gateway: ipv4Gateway, ipv6Gateway: ipv6Gateway) + ) + } +} diff --git a/Sources/Containerization/VirtualMachineAgent.swift b/Sources/Containerization/VirtualMachineAgent.swift new file mode 100644 index 0000000..05ea795 --- /dev/null +++ b/Sources/Containerization/VirtualMachineAgent.swift @@ -0,0 +1,110 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +public struct WriteFileFlags { + public var createParentDirectories = false + public var append = false + public var create = false +} + +public enum FilesystemOperation: Sendable { + case freeze + case thaw + case trim +} + +/// A protocol for the agent running inside a virtual machine. If an operation isn't +/// supported the implementation MUST return a ContainerizationError with a code of +/// `.unsupported`. +public protocol VirtualMachineAgent: Sendable { + /// Perform a platform specific standard setup + /// of the runtime environment. + func standardSetup() async throws + /// Close any resources held by the agent. + func close() async throws + // Perform a filesystem operation on the given path. + func filesystemOperation(operation: FilesystemOperation, path: String) async throws + + // POSIX-y + func getenv(key: String) async throws -> String + func setenv(key: String, value: String) async throws + func mount(_ mount: ContainerizationOCI.Mount) async throws + func umount(path: String, flags: Int32) async throws + func mkdir(path: String, all: Bool, perms: UInt32) async throws + @discardableResult + func kill(pid: Int32, signal: Int32) async throws -> Int32 + func sync() async throws + func writeFile(path: String, data: Data, flags: WriteFileFlags, mode: UInt32) async throws + + // Process lifecycle + func createProcess( + id: String, + containerID: String?, + stdinPort: UInt32?, + stdoutPort: UInt32?, + stderrPort: UInt32?, + ociRuntimePath: String?, + configuration: ContainerizationOCI.Spec, + options: Data? + ) async throws + func startProcess(id: String, containerID: String?) async throws -> Int32 + func signalProcess(id: String, containerID: String?, signal: Int32) async throws + func resizeProcess(id: String, containerID: String?, columns: UInt32, rows: UInt32) async throws + func waitProcess(id: String, containerID: String?, timeoutInSeconds: Int64?) async throws -> ExitStatus + func deleteProcess(id: String, containerID: String?) async throws + func closeProcessStdin(id: String, containerID: String?) async throws + + // Networking + func up(name: String, mtu: UInt32?) async throws + func down(name: String) async throws + func addressAdd(name: String, address: InterfaceAddress) async throws + func routeAddLink(name: String, route: LinkRoute) async throws + func routeAddDefault(name: String, route: DefaultRoute) async throws + func configureDNS(config: DNS, location: String) async throws + func configureHosts(config: Hosts, location: String) async throws + + // Container statistics + func containerStatistics(containerIDs: [String], categories: StatCategory) async throws -> [ContainerStatistics] + +} + +extension VirtualMachineAgent { + public func closeProcessStdin(id: String, containerID: String?) async throws { + throw ContainerizationError(.unsupported, message: "closeProcessStdin") + } + + public func configureHosts(config: Hosts, location: String) async throws { + throw ContainerizationError(.unsupported, message: "configureHosts") + } + + public func writeFile(path: String, data: Data, flags: WriteFileFlags, mode: UInt32) async throws { + throw ContainerizationError(.unsupported, message: "writeFile") + } + + public func containerStatistics(containerIDs: [String], categories: StatCategory) async throws -> [ContainerStatistics] { + throw ContainerizationError(.unsupported, message: "containerStatistics") + } + + public func sync() async throws { + throw ContainerizationError(.unsupported, message: "sync") + } + +} diff --git a/Sources/Containerization/VirtualMachineInstance.swift b/Sources/Containerization/VirtualMachineInstance.swift new file mode 100644 index 0000000..302e97a --- /dev/null +++ b/Sources/Containerization/VirtualMachineInstance.swift @@ -0,0 +1,121 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation + +/// The runtime state of the virtual machine instance. +public enum VirtualMachineInstanceState: Sendable { + case starting + case running + case stopped + case stopping + case unknown +} + +/// How the VMM exposes virtiofs devices to the guest. +/// +/// - `unified`: a single virtio-fs device (tag `virtiofs`) carries all +/// shares as subdirectories (Apple's `VZMultipleDirectoryShare` model). +/// - `perTag`: one virtio-fs device per source-hash tag, each mounted +/// separately in the guest (cloud-hypervisor / virtiofsd model). +public enum VirtiofsLayout: Sendable { + case unified + case perTag +} + +/// A live instance of a virtual machine. +public protocol VirtualMachineInstance: Sendable { + associatedtype Agent: VirtualMachineAgent + + // The state of the virtual machine. + var state: VirtualMachineInstanceState { get } + + var mounts: [String: [AttachedFilesystem]] { get } + + /// How this VMM exposes virtiofs devices to the guest. Defaults to + /// `.unified` (the VZ-shaped behavior); CH overrides to `.perTag`. + var virtiofsLayout: VirtiofsLayout { get } + /// Dial the Agent. It's up the VirtualMachineInstance to determine + /// what port the agent is listening on. + func dialAgent() async throws -> Agent + /// Dial a vsock port in the guest. + func dial(_ port: UInt32) async throws -> FileHandle + /// Listen on a host vsock port. + func listen(_ port: UInt32) throws -> VsockListener + /// Start the virtual machine. + func start() async throws + /// Stop the virtual machine. + func stop() async throws + /// Pause the virtual machine. + func pause() async throws + /// Resume the virtual machine. + func resume() async throws + + /// Hotplug a block device, returning the attached filesystem info. + /// Throws if the VMM does not support hotplug or not available + /// - Parameter block: The mount configuration for the block device to hotplug + /// - Parameter id: The metadata ID to associate with this mount (e.g. container ID) + /// - Returns: AttachedFilesystem with the device path in the guest + func hotplug(_ block: Mount, id: String) async throws -> AttachedFilesystem + + /// Register mounts for a container after hotplug. + /// This is used to add the rootfs and additional mounts to the VM's mount registry + /// so they can be found when building the container's OCI spec. + /// - Parameter id: The container ID + /// - Parameter rootfs: The rootfs attachment from hotplug + /// - Parameter additionalMounts: Additional mounts (like /proc, /sys) to register + func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws + + /// Release a hotplug device. + /// This should be called when a hotplugged container is stopped or fails to start. + /// - Parameter id: The container ID whose hotplug should be released + func releaseHotplug(id: String) async throws + + /// Hotplug virtiofs directories into the running VM. + /// - Parameter mounts: The virtiofs mounts to add + /// - Parameter id: The container ID that owns these mounts + func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws + + /// Release virtiofs shares for a container. + /// - Parameter id: The container ID whose virtiofs shares should be released + func releaseVirtioFS(id: String) async throws +} + +extension VirtualMachineInstance { + public var virtiofsLayout: VirtiofsLayout { .unified } + public func pause() async throws { + throw ContainerizationError(.unsupported, message: "pause") + } + public func resume() async throws { + throw ContainerizationError(.unsupported, message: "resume") + } + public func hotplug(_ block: Mount, id: String) async throws -> AttachedFilesystem { + throw ContainerizationError(.unsupported, message: "hotplug not supported") + } + public func registerMounts(id: String, rootfs: AttachedFilesystem, additionalMounts: [Mount]) throws { + // no-op default + } + public func releaseHotplug(id: String) async throws { + // no-op default + } + public func hotplugVirtioFS(_ mounts: [Mount], id: String) async throws { + // no-op default + } + public func releaseVirtioFS(id: String) async throws { + // no-op default + } +} diff --git a/Sources/Containerization/VirtualMachineManager.swift b/Sources/Containerization/VirtualMachineManager.swift new file mode 100644 index 0000000..f750bd5 --- /dev/null +++ b/Sources/Containerization/VirtualMachineManager.swift @@ -0,0 +1,20 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A protocol to implement for virtual machine isolated containers. +public protocol VirtualMachineManager: Sendable { + func create(config: some VMCreationConfig) async throws -> any VirtualMachineInstance +} diff --git a/Sources/Containerization/Vminitd+Rosetta.swift b/Sources/Containerization/Vminitd+Rosetta.swift new file mode 100644 index 0000000..af3a12f --- /dev/null +++ b/Sources/Containerization/Vminitd+Rosetta.swift @@ -0,0 +1,35 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOS + +extension Vminitd { + /// Enable Rosetta's x86_64 emulation. + public func enableRosetta() async throws { + let path = "/run/rosetta" + try await self.mount( + .init( + type: "virtiofs", + source: "rosetta", + destination: path + ) + ) + try await self.setupEmulator( + binaryPath: "\(path)/rosetta", + configuration: Binfmt.Entry.amd64() + ) + } +} diff --git a/Sources/Containerization/Vminitd+SocketRelay.swift b/Sources/Containerization/Vminitd+SocketRelay.swift new file mode 100644 index 0000000..cd25831 --- /dev/null +++ b/Sources/Containerization/Vminitd+SocketRelay.swift @@ -0,0 +1,47 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension Vminitd: SocketRelayAgent { + /// Sets up a relay between a host socket to a newly created guest socket, or vice versa. + public func relaySocket(port: UInt32, configuration: UnixSocketConfiguration) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest.with { + $0.id = configuration.id + $0.vsockPort = port + + if let perms = configuration.permissions { + $0.guestSocketPermissions = UInt32(perms.rawValue) + } + + switch configuration.direction { + case .into: + $0.guestPath = configuration.destination.path + $0.action = .into + case .outOf: + $0.guestPath = configuration.source.path + $0.action = .outOf + } + } + _ = try await client.proxyVsock(request) + } + + /// Stops the specified socket relay. + public func stopSocketRelay(configuration: UnixSocketConfiguration) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest.with { + $0.id = configuration.id + } + _ = try await client.stopVsockProxy(request) + } +} diff --git a/Sources/Containerization/Vminitd.swift b/Sources/Containerization/Vminitd.swift new file mode 100644 index 0000000..6af7666 --- /dev/null +++ b/Sources/Containerization/Vminitd.swift @@ -0,0 +1,646 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation +import GRPCCore +import GRPCNIOTransportHTTP2 +import NIO + +/// A remote connection into the vminitd Linux guest agent via a port (vsock). +/// Used to modify the runtime environment of the Linux sandbox. +public struct Vminitd: Sendable { + // Default vsock port that the agent and client use. + public static let port: UInt32 = 1024 + + let client: Com_Apple_Containerization_Sandbox_V3_SandboxContext.Client + public let grpcClient: GRPCClient + private let connectionTask: Task + + public init(connection: FileHandle, group: any EventLoopGroup) async throws { + let transport = try await HTTP2ClientTransport.WrappedChannel.wrapping( + config: .defaults { $0.connection.maxIdleTime = nil }, + serviceConfig: .init() + ) { configure in + try await withCheckedThrowingContinuation { continuation in + ClientBootstrap(group: group) + .channelInitializer { channel in + configure(channel).map { configured in + continuation.resume(returning: configured) + } + } + .withConnectedSocket(connection.fileDescriptor) + .whenFailure { error in + continuation.resume(throwing: error) + } + } + } + let grpcClient = GRPCClient(transport: transport) + self.grpcClient = grpcClient + self.client = Com_Apple_Containerization_Sandbox_V3_SandboxContext.Client(wrapping: self.grpcClient) + // Not very structured concurrency friendly, but we'd need to expose a way on the protocol to "run" the + // agent otherwise, which some agents might not even need. + self.connectionTask = Task { + try await grpcClient.runConnections() + } + } + + /// Close the connection to the guest agent. + public func close() async throws { + self.grpcClient.beginGracefulShutdown() + try await self.connectionTask.value + } +} + +extension Vminitd: VirtualMachineAgent { + /// Perform the standard guest setup necessary for vminitd to be able to + /// run containers. + public func standardSetup() async throws { + try await up(name: "lo") + + try await setenv(key: "PATH", value: LinuxProcessConfiguration.defaultPath) + + // Vminitd mounts /proc, /sys, /sys/fs/cgroup and /run automatically. + let mounts: [ContainerizationOCI.Mount] = [ + .init(type: "tmpfs", source: "tmpfs", destination: "/tmp"), + .init(type: "devpts", source: "devpts", destination: "/dev/pts", options: ["gid=5", "mode=620", "ptmxmode=666"]), + ] + for mount in mounts { + try await self.mount(mount) + } + } + + public func writeFile(path: String, data: Data, flags: WriteFileFlags, mode: UInt32) async throws { + _ = try await client.writeFile( + .with { + $0.path = path + $0.mode = mode + $0.data = data + $0.flags = .with { + $0.append = flags.append + $0.createIfMissing = flags.create + $0.createParentDirs = flags.createParentDirectories + } + }) + } + + /// Get statistics for containers. If `containerIDs` is empty returns stats for all containers + /// in the guest. If `categories` is empty, all categories are returned. + public func containerStatistics(containerIDs: [String], categories: StatCategory) async throws -> [ContainerStatistics] { + let response = try await client.containerStatistics( + .with { + $0.containerIds = containerIDs + $0.categories = categories.toProtoCategories() + }) + + return response.containers.map { protoStats in + ContainerStatistics( + id: protoStats.containerID, + process: categories.contains(.process) && protoStats.hasProcess + ? .init( + current: protoStats.process.current, + limit: protoStats.process.limit + ) : nil, + memory: categories.contains(.memory) && protoStats.hasMemory + ? .init( + usageBytes: protoStats.memory.usageBytes, + limitBytes: protoStats.memory.limitBytes, + swapUsageBytes: protoStats.memory.swapUsageBytes, + swapLimitBytes: protoStats.memory.swapLimitBytes, + cacheBytes: protoStats.memory.cacheBytes, + kernelStackBytes: protoStats.memory.kernelStackBytes, + slabBytes: protoStats.memory.slabBytes, + pageFaults: protoStats.memory.pageFaults, + majorPageFaults: protoStats.memory.majorPageFaults, + inactiveFile: protoStats.memory.inactiveFile, + anon: protoStats.memory.anon, + workingsetRefaultAnon: protoStats.memory.workingsetRefaultAnon, + workingsetRefaultFile: protoStats.memory.workingsetRefaultFile, + pgstealKswapd: protoStats.memory.pgstealKswapd, + pgstealDirect: protoStats.memory.pgstealDirect, + pgstealKhugepaged: protoStats.memory.pgstealKhugepaged + ) : nil, + cpu: categories.contains(.cpu) && protoStats.hasCpu + ? .init( + usageUsec: protoStats.cpu.usageUsec, + userUsec: protoStats.cpu.userUsec, + systemUsec: protoStats.cpu.systemUsec, + throttlingPeriods: protoStats.cpu.throttlingPeriods, + throttledPeriods: protoStats.cpu.throttledPeriods, + throttledTimeUsec: protoStats.cpu.throttledTimeUsec + ) : nil, + blockIO: categories.contains(.blockIO) && protoStats.hasBlockIo + ? .init( + devices: protoStats.blockIo.devices.map { device in + .init( + major: device.major, + minor: device.minor, + readBytes: device.readBytes, + writeBytes: device.writeBytes, + readOperations: device.readOperations, + writeOperations: device.writeOperations + ) + } + ) : nil, + networks: categories.contains(.network) + ? protoStats.networks.map { network in + ContainerStatistics.NetworkStatistics( + interface: network.interface, + receivedPackets: network.receivedPackets, + transmittedPackets: network.transmittedPackets, + receivedBytes: network.receivedBytes, + transmittedBytes: network.transmittedBytes, + receivedErrors: network.receivedErrors, + transmittedErrors: network.transmittedErrors + ) + } : nil, + memoryEvents: categories.contains(.memoryEvents) && protoStats.hasMemoryEvents + ? .init( + low: protoStats.memoryEvents.low, + high: protoStats.memoryEvents.high, + max: protoStats.memoryEvents.max, + oom: protoStats.memoryEvents.oom, + oomKill: protoStats.memoryEvents.oomKill + ) : nil + ) + } + } + + /// Mount a filesystem in the sandbox's environment. + public func mount(_ mount: ContainerizationOCI.Mount) async throws { + _ = try await client.mount( + .with { + $0.type = mount.type + $0.source = mount.source + $0.destination = mount.destination + $0.options = mount.options + }) + } + + /// Unmount a filesystem in the sandbox's environment. + public func umount(path: String, flags: Int32) async throws { + _ = try await client.umount( + .with { + $0.path = path + $0.flags = flags + }) + } + + /// Create a directory inside the sandbox's environment. + public func mkdir(path: String, all: Bool, perms: UInt32) async throws { + _ = try await client.mkdir( + .with { + $0.path = path + $0.all = all + $0.perms = perms + }) + } + + /// Perform a filesystem operation on a path inside the sandbox's environment. + public func filesystemOperation(operation: FilesystemOperation, path: String) async throws { + _ = try await client.filesystemOperation( + .with { + $0.operation = operation.toProtoOperation() + $0.path = path + }) + } + + public func createProcess( + id: String, + containerID: String?, + stdinPort: UInt32?, + stdoutPort: UInt32?, + stderrPort: UInt32?, + ociRuntimePath: String?, + configuration: ContainerizationOCI.Spec, + options: Data? + ) async throws { + let enc = JSONEncoder() + _ = try await client.createProcess( + .with { + $0.id = id + if let stdinPort { + $0.stdin = stdinPort + } + if let stdoutPort { + $0.stdout = stdoutPort + } + if let stderrPort { + $0.stderr = stderrPort + } + if let containerID { + $0.containerID = containerID + } + if let ociRuntimePath { + $0.ociRuntimePath = ociRuntimePath + } + $0.configuration = try enc.encode(configuration) + }) + } + + @discardableResult + public func startProcess(id: String, containerID: String?) async throws -> Int32 { + let request = Com_Apple_Containerization_Sandbox_V3_StartProcessRequest.with { + $0.id = id + if let containerID { + $0.containerID = containerID + } + } + let resp = try await client.startProcess(request) + return resp.pid + } + + public func signalProcess(id: String, containerID: String?, signal: Int32) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_KillProcessRequest.with { + $0.id = id + $0.signal = signal + if let containerID { + $0.containerID = containerID + } + } + _ = try await client.killProcess(request) + } + + public func resizeProcess(id: String, containerID: String?, columns: UInt32, rows: UInt32) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest.with { + if let containerID { + $0.containerID = containerID + } + $0.id = id + $0.columns = columns + $0.rows = rows + } + _ = try await client.resizeProcess(request) + } + + public func waitProcess( + id: String, + containerID: String?, + timeoutInSeconds: Int64? = nil + ) async throws -> ExitStatus { + let request = Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest.with { + $0.id = id + if let containerID { + $0.containerID = containerID + } + } + + var callOpts = GRPCCore.CallOptions.defaults + if let timeoutInSeconds { + callOpts.timeout = .seconds(timeoutInSeconds) + } + + do { + let resp = try await client.waitProcess(request, options: callOpts) + return ExitStatus(exitCode: resp.exitCode, exitedAt: resp.exitedAt.date) + } catch { + if let err = error as? RPCError, err.code == .deadlineExceeded { + throw ContainerizationError( + .timeout, + message: "failed to wait for process exit within timeout of \(timeoutInSeconds!) seconds", + cause: err + ) + } + throw error + } + } + + public func deleteProcess(id: String, containerID: String?) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest.with { + $0.id = id + if let containerID { + $0.containerID = containerID + } + } + _ = try await client.deleteProcess(request) + } + + public func closeProcessStdin(id: String, containerID: String?) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest.with { + $0.id = id + if let containerID { + $0.containerID = containerID + } + } + _ = try await client.closeProcessStdin(request) + } + + public func up(name: String, mtu: UInt32? = nil) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest.with { + $0.interface = name + $0.up = true + if let mtu { $0.mtu = mtu } + } + _ = try await client.ipLinkSet(request) + } + + public func down(name: String) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest.with { + $0.interface = name + $0.up = false + } + _ = try await client.ipLinkSet(request) + } + + /// Get an environment variable from the sandbox's environment. + public func getenv(key: String) async throws -> String { + let response = try await client.getenv( + .with { + $0.key = key + }) + return response.value + } + + /// Set an environment variable in the sandbox's environment. + public func setenv(key: String, value: String) async throws { + _ = try await client.setenv( + .with { + $0.key = key + $0.value = value + }) + } +} + +/// Vminitd specific rpcs. +extension Vminitd { + /// Sets up an emulator in the guest. + public func setupEmulator(binaryPath: String, configuration: Binfmt.Entry) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest.with { + $0.binaryPath = binaryPath + $0.name = configuration.name + $0.type = configuration.type + $0.offset = configuration.offset + $0.magic = configuration.magic + $0.mask = configuration.mask + $0.flags = configuration.flags + } + _ = try await client.setupEmulator(request) + } + + /// Sets the guest time. + public func setTime(sec: Int64, usec: Int32) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_SetTimeRequest.with { + $0.sec = sec + $0.usec = usec + } + _ = try await client.setTime(request) + } + + /// Set the provided sysctls inside the Sandbox's environment. + public func sysctl(settings: [String: String]) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_SysctlRequest.with { + $0.settings = settings + } + _ = try await client.sysctl(request) + } + + /// Add an IP address to the sandbox's network interfaces. + public func addressAdd(name: String, address: InterfaceAddress) async throws { + _ = try await client.ipAddrAdd( + .with { + $0.interface = name + $0.ipv4Address = address.ipv4Address.description + if let ipv6Address = address.ipv6Address { + $0.ipv6Address = ipv6Address.description + } + }) + } + + /// Add a link-scoped route in the sandbox's environment, used to install an + /// on-link host route (a /32 for v4, /128 for v6) to a gateway that lives + /// outside the interface's subnet so the kernel will accept the default route. + /// `route.ipv4Destination`/`route.ipv6Destination` carry the + /// gateway address; the wire format is a CIDR string with the per-family host prefix appended. + public func routeAddLink(name: String, route: LinkRoute) async throws { + _ = try await client.ipRouteAddLink( + .with { + $0.interface = name + if let ipv4Destination = route.ipv4Destination { + $0.dstIpv4Addr = "\(ipv4Destination.description)/32" + } + if let ipv4Source = route.ipv4Source { + $0.srcIpv4Addr = ipv4Source.description + } + if let ipv6Destination = route.ipv6Destination { + $0.dstIpv6Addr = "\(ipv6Destination.description)/128" + } + if let ipv6Source = route.ipv6Source { + $0.srcIpv6Addr = ipv6Source.description + } + }) + } + + /// Set the default route in the sandbox's environment. + public func routeAddDefault(name: String, route: DefaultRoute) async throws { + _ = try await client.ipRouteAddDefault( + .with { + $0.interface = name + $0.ipv4Gateway = route.ipv4Gateway?.description ?? "" + if let ipv6Gateway = route.ipv6Gateway { + $0.ipv6Gateway = ipv6Gateway.description + } + }) + } + + /// Configure DNS within the sandbox's environment. + public func configureDNS(config: DNS, location: String) async throws { + try config.validate() + _ = try await client.configureDns( + .with { + $0.location = location + $0.nameservers = config.nameservers + if let domain = config.domain { + $0.domain = domain + } + $0.searchDomains = config.searchDomains + $0.options = config.options + }) + } + + /// Configure /etc/hosts within the sandbox's environment. + public func configureHosts(config: Hosts, location: String) async throws { + _ = try await client.configureHosts(config.toAgentHostsRequest(location: location)) + } + + /// Perform a sync call. + public func sync() async throws { + _ = try await client.sync(.init()) + } + + public func kill(pid: Int32, signal: Int32) async throws -> Int32 { + let response = try await client.kill( + .with { + $0.pid = pid + $0.signal = signal + }) + return response.result + } + + /// Metadata received from the guest during a copy operation. + public struct CopyMetadata: Sendable { + /// Whether the data on the vsock channel is a tar+gzip archive. + public let isArchive: Bool + /// Total size in bytes (0 if unknown, e.g. for archives). + public let totalSize: UInt64 + } + + /// Stat a path in the guest filesystem and return its metadata. + public func stat( + path: URL + ) async throws -> ContainerizationOS.Stat { + let request = Com_Apple_Containerization_Sandbox_V3_StatRequest.with { + $0.path = path.path + } + + let response: Com_Apple_Containerization_Sandbox_V3_StatResponse + do { + response = try await client.stat(request) + } catch let error as RPCError where error.code == .notFound { + throw ContainerizationError(.notFound, message: "stat: path not found '\(path.path)'", cause: error) + } + guard response.error.isEmpty else { + throw ContainerizationError(.internalError, message: "stat: \(response.error)") + } + + let s = response.stat + return ContainerizationOS.Stat( + dev: s.dev, + ino: s.ino, + mode: s.mode, + nlink: s.nlink, + uid: s.uid, + gid: s.gid, + rdev: s.rdev, + size: s.size, + blksize: s.blksize, + blocks: s.blocks, + atime: TimeSpec(seconds: s.atime.seconds, nanoseconds: s.atime.nanos), + mtime: TimeSpec(seconds: s.mtime.seconds, nanoseconds: s.mtime.nanos), + ctime: TimeSpec(seconds: s.ctime.seconds, nanoseconds: s.ctime.nanos) + ) + } + + /// Unified copy control plane. Sends a CopyRequest over gRPC and processes + /// the response stream. Data transfer happens over a separate vsock connection + /// managed by the caller. + /// + /// For COPY_OUT, the `onMetadata` callback is invoked when the guest sends + /// metadata (is_archive, total_size) before data transfer begins. + /// For COPY_IN, `onMetadata` is not called. + public func copy( + direction: Com_Apple_Containerization_Sandbox_V3_CopyRequest.Direction, + guestPath: URL, + vsockPort: UInt32, + mode: UInt32 = 0, + createParents: Bool = false, + isArchive: Bool = false, + onMetadata: @Sendable @escaping (CopyMetadata) -> Void = { _ in } + ) async throws { + let request = Com_Apple_Containerization_Sandbox_V3_CopyRequest.with { + $0.direction = direction + $0.path = guestPath.path + $0.mode = mode + $0.createParents = createParents + $0.vsockPort = vsockPort + $0.isArchive = isArchive + } + + try await client.copy( + request, + onResponse: { stream in + for try await response in stream.messages { + if !response.error.isEmpty { + throw ContainerizationError(.internalError, message: "copy: \(response.error)") + } + switch response.status { + case .metadata: + onMetadata(CopyMetadata(isArchive: response.isArchive, totalSize: response.totalSize)) + case .complete: + break + case .UNRECOGNIZED(let value): + throw ContainerizationError(.internalError, message: "copy: unrecognized response status \(value)") + } + } + }) + } +} + +extension Hosts { + func toAgentHostsRequest(location: String) -> Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest { + Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.with { + $0.location = location + if let comment { + $0.comment = comment + } + $0.entries = entries.map { + let entry = $0 + return Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest.HostsEntry.with { + if let comment = entry.comment { + $0.comment = comment + } + $0.ipAddress = entry.ipAddress + $0.hostnames = entry.hostnames + } + } + } + } +} + +extension StatCategory { + /// Convert StatCategory to proto enum values. + func toProtoCategories() -> [Com_Apple_Containerization_Sandbox_V3_StatCategory] { + var categories: [Com_Apple_Containerization_Sandbox_V3_StatCategory] = [] + if contains(.process) { + categories.append(.process) + } + if contains(.memory) { + categories.append(.memory) + } + if contains(.cpu) { + categories.append(.cpu) + } + if contains(.blockIO) { + categories.append(.blockIo) + } + if contains(.network) { + categories.append(.network) + } + if contains(.memoryEvents) { + categories.append(.memoryEvents) + } + return categories + } +} + +extension FilesystemOperation { + /// Convert FilesystemOperation to proto oneof value. + fileprivate func toProtoOperation() -> Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest.OneOf_Operation { + switch self { + case .freeze: + return .freeze(.init()) + case .thaw: + return .thaw(.init()) + case .trim: + return .trim( + .with { + $0.oneShot = .init() + }) + } + } +} diff --git a/Sources/Containerization/VmnetNetwork.swift b/Sources/Containerization/VmnetNetwork.swift new file mode 100644 index 0000000..86ec92c --- /dev/null +++ b/Sources/Containerization/VmnetNetwork.swift @@ -0,0 +1,302 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) + +import ContainerizationError +import ContainerizationExtras +import Virtualization +import vmnet + +/// A network backed by vmnet on macOS. +@available(macOS 26.0, *) +public struct VmnetNetwork: Network { + private var allocator: Allocator + // `reference` isn't used concurrently. + nonisolated(unsafe) private let reference: vmnet_network_ref + + /// The IPv4 subnet of this network. + public let subnet: CIDRv4 + + /// The IPv6 prefix of this network. + public let prefixV6: CIDRv6? + + /// The IPv4 gateway address of this network. + public var ipv4Gateway: IPv4Address { + subnet.gateway + } + + /// The IPv6 gateway address of this network, if a prefix exists. + public var ipv6Gateway: IPv6Address? { + prefixV6?.gateway + } + + struct Allocator: Sendable { + private let indexAllocatorV4: any AddressAllocator + private let indexAllocatorV6: (any AddressAllocator)? + private let cidrV4: CIDRv4 + private let cidrV6: CIDRv6? + private var allocations: [String: (v4: UInt32, v6: UInt32?)] + + init(cidrV4: CIDRv4, cidrV6: CIDRv6?) throws { + self.cidrV4 = cidrV4 + self.cidrV6 = cidrV6 + self.allocations = .init() + let v4Size = Int(cidrV4.upper.value - cidrV4.lower.value - 3) + self.indexAllocatorV4 = try UInt32.rotatingAllocator( + lower: cidrV4.lower.value + 2, + size: UInt32(v4Size) + ) + if cidrV6 != nil { + // Independent v6 allocator. The host portion is sourced from a + // UInt32 index regardless of prefix length, and we never need + // more v6 entries than v4 can serve. + self.indexAllocatorV6 = try UInt32.rotatingAllocator( + lower: 2, + size: UInt32(v4Size) + ) + } else { + self.indexAllocatorV6 = nil + } + } + + mutating func allocate(_ id: String) throws -> (CIDRv4, CIDRv6?) { + if allocations[id] != nil { + throw ContainerizationError(.exists, message: "allocation with id \(id) already exists") + } + let v4Index = try indexAllocatorV4.allocate() + let v4 = try CIDRv4(IPv4Address(v4Index), prefix: cidrV4.prefix) + + var v6Index: UInt32? = nil + let v6: CIDRv6? + if let indexAllocatorV6, let cidrV6 { + do { + let idx = try indexAllocatorV6.allocate() + v6Index = idx + let v6Value = (cidrV6.address.value & cidrV6.prefix.prefixMask128) | UInt128(idx) + v6 = try CIDRv6(IPv6Address(v6Value), prefix: cidrV6.prefix) + } catch { + // Roll back v4 so the pair stays atomic. + try? indexAllocatorV4.release(v4Index) + throw error + } + } else { + v6 = nil + } + + allocations[id] = (v4: v4Index, v6: v6Index) + return (v4, v6) + } + + mutating func release(_ id: String) throws { + if let entry = self.allocations[id] { + try indexAllocatorV4.release(entry.v4) + if let v6Index = entry.v6 { + try indexAllocatorV6?.release(v6Index) + } + allocations.removeValue(forKey: id) + } + } + } + + /// A network interface supporting the vmnet_network_ref. + public struct Interface: Containerization.Interface, VZInterface, Sendable { + public let ipv4Address: CIDRv4 + public let ipv4Gateway: IPv4Address? + public let ipv6Address: CIDRv6? + public let ipv6Gateway: IPv6Address? + public let macAddress: MACAddress? + public let mtu: UInt32 + + // `reference` isn't used concurrently. + nonisolated(unsafe) private let reference: vmnet_network_ref + + public init( + reference: vmnet_network_ref, + ipv4Address: CIDRv4, + ipv4Gateway: IPv4Address? = nil, + ipv6Address: CIDRv6? = nil, + ipv6Gateway: IPv6Address? = nil, + macAddress: MACAddress? = nil, + mtu: UInt32 = 1500 + ) { + self.ipv4Address = ipv4Address + self.ipv4Gateway = ipv4Gateway + self.ipv6Address = ipv6Address + self.ipv6Gateway = ipv6Gateway + self.macAddress = macAddress + self.mtu = mtu + self.reference = reference + } + + /// Returns the underlying `VZVirtioNetworkDeviceConfiguration`. + public func device() throws -> VZVirtioNetworkDeviceConfiguration { + let config = VZVirtioNetworkDeviceConfiguration() + if let macAddress = self.macAddress { + guard let mac = VZMACAddress(string: macAddress.description) else { + throw ContainerizationError(.invalidArgument, message: "invalid mac address \(macAddress)") + } + config.macAddress = mac + } + config.attachment = VZVmnetNetworkDeviceAttachment(network: self.reference) + return config + } + } + + /// Creates a new network. + /// - Parameters: + /// - mode: The vmnet operating mode. Defaults to `.VMNET_SHARED_MODE`. + /// - subnetV4: The IPv4 subnet to use for this network. + /// - prefixV6: The IPv6 prefix to use for this network. + public init( + mode: vmnet.operating_modes_t = .VMNET_SHARED_MODE, + subnet: CIDRv4? = nil, + prefixV6: CIDRv6? = nil + ) throws { + var status: vmnet_return_t = .VMNET_FAILURE + guard let config = vmnet_network_configuration_create(mode, &status) else { + throw ContainerizationError(.unsupported, message: "failed to create vmnet config with status \(status)") + } + + vmnet_network_configuration_disable_dhcp(config) + + if let subnet { + try Self.configureSubnetV4(config, subnetV4: subnet) + } + if let prefixV6 { + try Self.configurePrefixV6(config, prefixV6: prefixV6) + } + + guard let ref = vmnet_network_create(config, &status), status == .VMNET_SUCCESS else { + throw ContainerizationError(.unsupported, message: "failed to create vmnet network with status \(status)") + } + + let cidrV4 = try Self.getSubnetV4(ref) + let cidrV6 = Self.getPrefixV6(ref) + + self.allocator = try .init(cidrV4: cidrV4, cidrV6: cidrV6) + self.subnet = cidrV4 + self.prefixV6 = cidrV6 + self.reference = ref + } + + /// Returns a new interface for use with a container. Allocates an IPv4 + /// address from the network's subnet, and — when the network has an IPv6 + /// prefix — an IPv6 address from that prefix. The two allocations are + /// independent. + /// - Parameter id: The container ID. + public mutating func createInterface(_ id: String) throws -> Containerization.Interface? { + let (v4, v6) = try allocator.allocate(id) + return Self.Interface( + reference: self.reference, + ipv4Address: v4, + ipv4Gateway: self.ipv4Gateway, + ipv6Address: v6, + ipv6Gateway: self.ipv6Gateway + ) + } + + /// Returns a new interface for use with a container with a custom MTU. + /// - Parameters: + /// - id: The container ID. + /// - mtu: The MTU for the interface. + public mutating func createInterface(_ id: String, mtu: UInt32) throws -> Containerization.Interface? { + let (v4, v6) = try allocator.allocate(id) + return Self.Interface( + reference: self.reference, + ipv4Address: v4, + ipv4Gateway: self.ipv4Gateway, + ipv6Address: v6, + ipv6Gateway: self.ipv6Gateway, + mtu: mtu + ) + } + + /// Returns a new interface without a default gateway route. Useful for + /// secondary interfaces where another interface already provides the + /// default route. + /// - Parameter id: The container ID. + public mutating func createInterfaceWithoutGateway(_ id: String) throws -> Containerization.Interface? { + let (v4, v6) = try allocator.allocate(id) + return Self.Interface( + reference: self.reference, + ipv4Address: v4, + ipv6Address: v6 + ) + } + + /// Performs cleanup of an interface. + /// - Parameter id: The container ID. + public mutating func releaseInterface(_ id: String) throws { + try allocator.release(id) + } + + private static func getSubnetV4(_ ref: vmnet_network_ref) throws -> CIDRv4 { + var subnet = in_addr() + var mask = in_addr() + vmnet_network_get_ipv4_subnet(ref, &subnet, &mask) + + let sa = UInt32(bigEndian: subnet.s_addr) + let mv = UInt32(bigEndian: mask.s_addr) + + let lower = IPv4Address(sa & mv) + let upper = IPv4Address(lower.value + ~mv) + + return try CIDRv4(lower: lower, upper: upper) + } + + private static func configureSubnetV4(_ config: vmnet_network_configuration_ref, subnetV4: CIDRv4) throws { + let gateway = subnetV4.gateway + + var ga = in_addr() + inet_pton(AF_INET, gateway.description, &ga) + + let mask = IPv4Address(subnetV4.prefix.prefixMask32) + var ma = in_addr() + inet_pton(AF_INET, mask.description, &ma) + + guard vmnet_network_configuration_set_ipv4_subnet(config, &ga, &ma) == .VMNET_SUCCESS else { + throw ContainerizationError(.internalError, message: "failed to set IPv4 subnet \(subnetV4) for network") + } + } + + private static func getPrefixV6(_ ref: vmnet_network_ref) -> CIDRv6? { + var p = in6_addr() + var len: UInt8 = 0 + vmnet_network_get_ipv6_prefix(ref, &p, &len) + + guard len > 0, let prefix = Prefix.ipv6(len) else { + return nil + } + + let bytes: [UInt8] = withUnsafeBytes(of: p) { Array($0) } + guard let address = try? IPv6Address(bytes) else { + return nil + } + return try? CIDRv6(address, prefix: prefix) + } + + private static func configurePrefixV6(_ config: vmnet_network_configuration_ref, prefixV6: CIDRv6) throws { + var p = in6_addr() + inet_pton(AF_INET6, prefixV6.lower.description, &p) + + guard vmnet_network_configuration_set_ipv6_prefix(config, &p, prefixV6.prefix.length) == .VMNET_SUCCESS else { + throw ContainerizationError(.internalError, message: "failed to set IPv6 prefix \(prefixV6) for network") + } + } +} + +#endif diff --git a/Sources/Containerization/Vsock+Linux.swift b/Sources/Containerization/Vsock+Linux.swift new file mode 100644 index 0000000..eacd874 --- /dev/null +++ b/Sources/Containerization/Vsock+Linux.swift @@ -0,0 +1,158 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ContainerizationError +import ContainerizationOS +import Foundation + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +// MARK: - Cloud Hypervisor hybrid vsock host-side helpers +// +// Cloud Hypervisor exposes its vsock device to the host as a Unix-domain +// socket pair, not the kernel AF_VSOCK (this avoids the host needing the +// vhost-vsock kernel module). +// +// - Host → guest dials use the "base" UDS (`VsockConfig.socket`) with a +// one-line `CONNECT \n` request, answered by `OK \n`. After +// that the connection is bridged transparently. +// - Guest → host dials are accepted on per-port UDS files at the +// conventional path `_` that the host pre-creates. +// +// Spec: `docs/vsock.md` in the cloud-hypervisor repository. + +/// Returns the conventional per-port UDS path for guest→host vsock connections, +/// derived by suffixing the base socket path with `_`. +func chVsockListenSocketPath(baseSocket: URL, port: UInt32) -> URL { + URL(fileURLWithPath: "\(baseSocket.path)_\(port)") +} + +/// Bind + listen a fresh AF_UNIX SOCK_STREAM at `path`, unlinking any stale +/// socket file at that path first. Returns the listening fd; ownership is +/// transferred to the caller. +/// +/// The socket file is created with mode `perms` (default `0o600`). The +/// per-VM workDir already restricts access via its own `0o700` mode, but +/// tightening the socket itself is cheap defense-in-depth — vminitd's gRPC +/// surface trusts whoever can `connect(2)` and exposes full container +/// control, so any local-user reach into these sockets is a privilege +/// escalation primitive. +func chVsockBindListener(at path: URL, perms: mode_t = 0o600) throws -> Int32 { + let unix = try UnixType(path: path.path, perms: perms, unlinkExisting: true) + let socket = try Socket(type: unix, closeOnDeinit: false) + do { + try socket.listen() + } catch { + try? socket.close() + throw error + } + return socket.fileDescriptor +} + +/// Dial guest port `port` over the cloud-hypervisor hybrid vsock at +/// `baseSocket`. Returns a `FileHandle` wrapping the connected fd; the +/// FileHandle does **not** close the fd on deinit — ownership of the fd +/// transfers to the caller (typically `Vminitd.init`, which hands it to +/// NIO via `withConnectedSocket`; NIO is then responsible for closing it +/// when the channel is torn down). Callers using the FileHandle directly +/// must close the underlying fd themselves. +func chVsockDial(baseSocket: URL, port: UInt32) async throws -> FileHandle { + try await Task.detached { + try chVsockDialSync(baseSocket: baseSocket, port: port) + }.value +} + +// MARK: - Internals + +private func chVsockDialSync(baseSocket: URL, port: UInt32) throws -> FileHandle { + let unix = try UnixType(path: baseSocket.path) + let socket = try Socket(type: unix, closeOnDeinit: false) + + do { + try socket.connect() + // Bound the bootstrap reply read so a hung cloud-hypervisor muxer + // can't pin this thread forever. CH replies within milliseconds in + // healthy operation; 30 s is well outside that and matches the + // CloudHypervisor REST client default. After bootstrap the fd is + // handed to NIO which puts it in non-blocking mode, where + // SO_RCVTIMEO has no effect — so leaving the timeout in place is + // harmless. + try socket.setTimeout(option: .receive, seconds: 30) + let request = "CONNECT \(port)\n" + _ = try socket.write(data: Data(request.utf8)) + let response = try readLine(fd: socket.fileDescriptor) + // Cloud Hypervisor responds with "OK \n" where + // is the local-side port the muxer allocated for this + // forwarded connection — NOT the peer port we asked for. So we just + // require the response to start with "OK " and parse a UInt32 after. + guard response.hasPrefix("OK "), + UInt32(response.dropFirst(3)) != nil + else { + throw ContainerizationError( + .invalidState, + message: "unexpected vsock CONNECT response: \(response.debugDescription)" + ) + } + return FileHandle(fileDescriptor: socket.fileDescriptor, closeOnDealloc: false) + } catch { + try? socket.close() + throw error + } +} + +/// Read CH's hybrid-vsock `CONNECT` reply line (`OK \n`) one +/// byte at a time. Reads from `fd` until a `\n` is seen or `maxLength` is +/// reached; the returned string excludes the terminating newline. We do +/// this by hand because the fd is still in blocking mode (NIO takes over +/// only after the bootstrap completes) and there's no Foundation / +/// NIO line reader that operates on a raw blocking POSIX fd. +private func readLine(fd: Int32, maxLength: Int = 256) throws -> String { + var bytes: [UInt8] = [] + bytes.reserveCapacity(maxLength) + while bytes.count < maxLength { + var byte: UInt8 = 0 + let n = withUnsafeMutablePointer(to: &byte) { ptr -> ssize_t in + read(fd, ptr, 1) + } + if n == 0 { + break + } + if n < 0 { + let savedErrno = errno + // SO_RCVTIMEO expiry surfaces as EAGAIN / EWOULDBLOCK on a + // blocking socket. Translate to a clear timeout error so callers + // don't have to inspect errno. + if savedErrno == EAGAIN || savedErrno == EWOULDBLOCK { + throw ContainerizationError( + .timeout, + message: "vsock CONNECT response not received within socket receive timeout" + ) + } + throw POSIXError(POSIXErrorCode(rawValue: savedErrno) ?? .EIO) + } + if byte == UInt8(ascii: "\n") { + break + } + bytes.append(byte) + } + return String(decoding: bytes, as: UTF8.self) +} +#endif diff --git a/Sources/Containerization/VsockListener.swift b/Sources/Containerization/VsockListener.swift new file mode 100644 index 0000000..0a20d81 --- /dev/null +++ b/Sources/Containerization/VsockListener.swift @@ -0,0 +1,101 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Synchronization + +#if os(macOS) +import Virtualization +#endif + +/// A stream of vsock connections. +public final class VsockListener: NSObject, Sendable, AsyncSequence { + public typealias Element = FileHandle + + /// The port the connections are for. + public let port: UInt32 + + private let connections: AsyncStream + private let cont: AsyncStream.Continuation + private let stopListening: @Sendable (_ port: UInt32) throws -> Void + private let finished: Mutex + + package init(port: UInt32, stopListen: @Sendable @escaping (_ port: UInt32) throws -> Void) { + self.port = port + let (stream, continuation) = AsyncStream.makeStream(of: FileHandle.self) + self.connections = stream + self.cont = continuation + self.stopListening = stopListen + self.finished = Mutex(false) + } + + /// Idempotent: calling more than once is a no-op. setupIO and the + /// caller-side defer can both call finish without double-closing the + /// listening fd (a double-close would target whatever fd was reallocated + /// in between, hanging the next operation that touched it). + public func finish() throws { + let alreadyFinished = self.finished.withLock { state -> Bool in + if state { + return true + } + state = true + return false + } + if alreadyFinished { + return + } + self.cont.finish() + try self.stopListening(self.port) + } + + /// Push an accepted connection into the listener's stream. Used by + /// VMM-specific accept loops that don't go through a delegate (the + /// cloud-hypervisor backend on Linux). On macOS the VZ delegate hits + /// `cont.yield(_:)` directly via same-class access. + package func yield(_ handle: FileHandle) -> AsyncStream.Continuation.YieldResult { + cont.yield(handle) + } + + public func makeAsyncIterator() -> AsyncStream.AsyncIterator { + connections.makeAsyncIterator() + } +} + +#if os(macOS) + +extension VsockListener: VZVirtioSocketListenerDelegate { + public func listener( + _: VZVirtioSocketListener, shouldAcceptNewConnection conn: VZVirtioSocketConnection, + from _: VZVirtioSocketDevice + ) -> Bool { + let fd = dup(conn.fileDescriptor) + guard fd != -1 else { + return false + } + conn.close() + + let fh = FileHandle(fileDescriptor: fd, closeOnDealloc: false) + let result = cont.yield(fh) + if case .terminated = result { + try? fh.close() + return false + } + + return true + } +} + +#endif diff --git a/Sources/ContainerizationArchive/ArchiveError.swift b/Sources/ContainerizationArchive/ArchiveError.swift new file mode 100644 index 0000000..0caee8b --- /dev/null +++ b/Sources/ContainerizationArchive/ArchiveError.swift @@ -0,0 +1,103 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CArchive +import Foundation + +/// An enumeration of the errors that can be thrown while interacting with an archive. +public enum ArchiveError: Error, CustomStringConvertible { + case unableToCreateArchive + case noUnderlyingArchive + case noArchiveInCallback + case noDelegateConfigured + case delegateFreedBeforeCallback + case unableToSetFormat(CInt, Format) + case unableToAddFilter(CInt, Filter) + case unableToWriteEntryHeader(CInt) + case unableToWriteData(CLong) + case unableToCloseArchive(CInt) + case unableToOpenArchive(CInt) + case unableToSetOption(CInt) + case failedToSetLocale(locales: [String]) + case failedToGetProperty(String, URLResourceKey) + case failedToDetectFilter + case failedToDetectFormat + case failedToExtractArchive(String) + case failedToCreateArchive(String) + case invalidBaseAddressArchiveWrite + + /// Description of the error + public var description: String { + switch self { + case .unableToCreateArchive: + return "unable to create an archive." + case .noUnderlyingArchive: + return "no underlying archive was provided." + case .noArchiveInCallback: + return "no archive was provided in the callback." + case .noDelegateConfigured: + return "no delegate was configured." + case .delegateFreedBeforeCallback: + return "the delegate was freed before the callback was invoked." + case .unableToSetFormat(let code, let name): + return "unable to set the archive format \(name), code \(code)" + case .unableToAddFilter(let code, let name): + return "unable to set the archive filter \(name), code \(code)" + case .unableToWriteEntryHeader(let code): + return "unable to write the entry header to the archive, code \(code)" + case .unableToWriteData(let code): + return "unable to write data to the archive, code \(code)" + case .unableToCloseArchive(let code): + return "unable to close the archive, code \(code)" + case .unableToOpenArchive(let code): + return "unable to open the archive, code \(code)" + case .unableToSetOption(_): + return "unable to set an option on the archive." + case .failedToSetLocale(let locales): + return "failed to set locale to \(locales)" + case .failedToGetProperty(let path, let propertyName): + return "failed to read property \(propertyName) from file at path \(path)" + case .failedToDetectFilter: + return "failed to detect filter from archive." + case .failedToDetectFormat: + return "failed to detect format from archive." + case .failedToExtractArchive(let reason): + return "failed to extract archive: \(reason)" + case .failedToCreateArchive(let reason): + return "failed to create archive: \(reason)" + case .invalidBaseAddressArchiveWrite: + return "got an invalid base address for pointer when writing data to archive" + } + } +} + +public struct LibArchiveError: Error { + public let source: ArchiveError + public let description: String +} + +func wrap(_ f: @autoclosure () -> CInt, _ e: (CInt) -> ArchiveError, underlying: OpaquePointer? = nil) throws { + let result = f() + guard result == ARCHIVE_OK else { + let error = e(result) + guard let underlying = underlying, + let description = archive_error_string(underlying).map(String.init(cString:)) + else { + throw error + } + throw LibArchiveError(source: error, description: description) + } +} diff --git a/Sources/ContainerizationArchive/ArchiveReader.swift b/Sources/ContainerizationArchive/ArchiveReader.swift new file mode 100644 index 0000000..0477d8e --- /dev/null +++ b/Sources/ContainerizationArchive/ArchiveReader.swift @@ -0,0 +1,428 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CArchive +import ContainerizationError +import ContainerizationOS +import Foundation +import SystemPackage + +/// A protocol for reading data in chunks, compatible with both `InputStream` and zero-allocation archive readers. +public protocol ReadableStream { + /// Reads up to `maxLength` bytes into the provided buffer. + /// Returns the number of bytes actually read, 0 for EOF, or -1 for error. + func read(_ buffer: UnsafeMutablePointer, maxLength: Int) -> Int +} + +extension InputStream: ReadableStream {} + +/// Small wrapper type to read data from an archive entry. +public struct ArchiveEntryReader: ReadableStream { + private weak var reader: ArchiveReader? + + init(reader: ArchiveReader) { + self.reader = reader + } + + /// Reads up to `maxLength` bytes into the provided buffer. + /// Returns the number of bytes actually read, 0 for EOF, or -1 for error. + public func read(_ buffer: UnsafeMutablePointer, maxLength: Int) -> Int { + guard let archive = reader?.underlying else { return -1 } + let bytesRead = archive_read_data(archive, buffer, maxLength) + return bytesRead < 0 ? -1 : bytesRead + } +} + +/// A class responsible for reading entries from an archive file. +public final class ArchiveReader { + private static let chunkSize = 4 * 1024 * 1024 + + /// A pointer to the underlying `archive` C structure. + var underlying: OpaquePointer? + /// The file handle associated with the archive file being read. + let fileHandle: FileHandle? + /// Temporary decompressed file URL if the input was zstd-compressed + private var tempDecompressedFile: URL? + + /// Initializes an `ArchiveReader` to read from a specified file URL with an explicit `Format` and `Filter`. + /// Note: This method must be used when it is known that the archive at the specified URL follows the specified + /// `Format` and `Filter`. + public convenience init(format: Format, filter: Filter, file: URL) throws { + // If filter is zstd, decompress it and use filter .none + let fileToRead: URL + let tempFile: URL? + let actualFilter: Filter + + if filter == .zstd { + let decompressed = try Self.decompressZstd(file) + tempFile = decompressed + fileToRead = decompressed + actualFilter = .none + } else { + tempFile = nil + fileToRead = file + actualFilter = filter + } + + do { + let fileHandle = try FileHandle(forReadingFrom: fileToRead) + try self.init(format: format, filter: actualFilter, fileHandle: fileHandle) + } catch { + if let tempFile { + try? FileManager.default.removeItem(at: tempFile.deletingLastPathComponent()) + } + throw error + } + self.tempDecompressedFile = tempFile + } + + /// Initializes an `ArchiveReader` to read from the provided file descriptor with an explicit `Format` and `Filter`. + /// Note: This method must be used when it is known that the archive pointed to by the file descriptor follows the specified + /// `Format` and `Filter`. + public init(format: Format, filter: Filter, fileHandle: FileHandle) throws { + self.underlying = archive_read_new() + self.fileHandle = fileHandle + + try archive_read_set_format(underlying, format.code) + .checkOk(elseThrow: .unableToSetFormat(format.code, format)) + try archive_read_append_filter(underlying, filter.code) + .checkOk(elseThrow: .unableToAddFilter(filter.code, filter)) + + let fd = fileHandle.fileDescriptor + try archive_read_open_fd(underlying, fd, 4096) + .checkOk(elseThrow: { .unableToOpenArchive($0) }) + } + + /// Initialize the `ArchiveReader` to read from a specified file URL + /// by trying to auto determine the archives `Format` and `Filter`. + public init(file: URL) throws { + self.underlying = archive_read_new() + + // Try to decompress as zstd first, fall back to original if it fails + let fileToRead: URL + if let decompressed = try? Self.decompressZstd(file) { + self.tempDecompressedFile = decompressed + fileToRead = decompressed + } else { + fileToRead = file + } + + let fileHandle = try FileHandle(forReadingFrom: fileToRead) + self.fileHandle = fileHandle + try archive_read_support_filter_all(underlying) + .checkOk(elseThrow: .failedToDetectFilter) + try archive_read_support_format_all(underlying) + .checkOk(elseThrow: .failedToDetectFormat) + let fd = fileHandle.fileDescriptor + try archive_read_open_fd(underlying, fd, 4096) + .checkOk(elseThrow: { .unableToOpenArchive($0) }) + } + + /// Decompress a zstd file to a temporary location + public static func decompressZstd(_ source: URL) throws -> URL { + guard let tempDir = createTemporaryDirectory(baseName: "zstd-decompress") else { + throw ArchiveError.failedToDetectFormat + } + let tempFile = tempDir.appendingPathComponent( + source.deletingPathExtension().lastPathComponent + ) + + do { + let srcPath = source.path + let srcFd = open(srcPath, O_RDONLY) + guard srcFd >= 0 else { throw ArchiveError.failedToDetectFormat } + defer { close(srcFd) } + + let dstFd = open(tempFile.path, O_WRONLY | O_CREAT | O_TRUNC, 0o644) + guard dstFd >= 0 else { throw ArchiveError.failedToDetectFormat } + defer { close(dstFd) } + + guard zstd_decompress_fd(srcFd, dstFd) == 0 else { + throw ArchiveError.failedToDetectFormat + } + } catch { + try? FileManager.default.removeItem(at: tempDir) + throw error + } + return tempFile + } + + /// Clean up the temporary directory created by `decompressZstd`. + /// The decompressed file is placed inside a unique temporary directory, + /// so removing that directory cleans up everything. + public static func cleanUpDecompressedZstd(_ file: URL) { + try? FileManager.default.removeItem(at: file.deletingLastPathComponent()) + } + + deinit { + archive_read_free(underlying) + try? fileHandle?.close() + + if let tempFile = tempDecompressedFile { + Self.cleanUpDecompressedZstd(tempFile) + } + } +} + +extension CInt { + fileprivate func checkOk(elseThrow error: @autoclosure () -> ArchiveError) throws { + guard self == ARCHIVE_OK else { throw error() } + } + fileprivate func checkOk(elseThrow error: (CInt) -> ArchiveError) throws { + guard self == ARCHIVE_OK else { throw error(self) } + } + +} + +extension ArchiveReader: Sequence { + public func makeIterator() -> Iterator { + Iterator(reader: self) + } + + public struct Iterator: IteratorProtocol { + var reader: ArchiveReader + + public mutating func next() -> (WriteEntry, Data)? { + let entry = WriteEntry() + let result = archive_read_next_header2(reader.underlying, entry.underlying) + if result == ARCHIVE_EOF { + return nil + } + let data = reader.readDataForEntry(entry) + return (entry, data) + } + } + + /// Returns an iterator that yields archive entries. + public func makeStreamingIterator() -> StreamingIterator { + StreamingIterator(reader: self) + } + + public struct StreamingIterator: Sequence, IteratorProtocol { + var reader: ArchiveReader + + public func makeIterator() -> StreamingIterator { + self + } + + public mutating func next() -> (WriteEntry, ArchiveEntryReader)? { + let entry = WriteEntry() + let result = archive_read_next_header2(reader.underlying, entry.underlying) + if result == ARCHIVE_EOF { + return nil + } + let streamReader = ArchiveEntryReader(reader: reader) + return (entry, streamReader) + } + } + + internal func readDataForEntry(_ entry: WriteEntry) -> Data { + let bufferSize = Int(Swift.min(entry.size ?? 4096, 4096)) + var entry = Data() + var part = Data(count: bufferSize) + while true { + let c = part.withUnsafeMutableBytes { buffer in + guard let baseAddress = buffer.baseAddress else { + return 0 + } + return archive_read_data(self.underlying, baseAddress, buffer.count) + } + guard c > 0 else { break } + part.count = c + entry.append(part) + } + return entry + } +} + +extension ArchiveReader { + public convenience init(name: String, bundle: Data, tempDirectoryBaseName: String? = nil) throws { + let baseName = tempDirectoryBaseName ?? "Unarchiver" + guard let tempDir = createTemporaryDirectory(baseName: baseName) else { + throw ArchiveError.failedToExtractArchive("failed to create temporary directory") + } + let url = tempDir.appendingPathComponent(name) + do { + try bundle.write(to: url, options: .atomic) + try self.init(format: .zip, filter: .none, file: url) + } catch { + try? FileManager.default.removeItem(at: tempDir) + throw error + } + // Register for cleanup in deinit (only needed when the zstd path didn't already set it) + if self.tempDecompressedFile == nil { + self.tempDecompressedFile = url + } + } + + /// Extracts the contents of an archive to the provided directory. + /// Rejects member paths that escape the root directory or traverse + /// symbolic links, and uses a "last entry wins" replacement policy + /// for an existing file at a path to be extracted. + public func extractContents(to directory: URL) throws -> [String] { + // Create the root directory with standard permissions + // and create a FileDescriptor for secure path traversal. + let fm = FileManager.default + let rootFilePath = FilePath(directory.path) + try fm.createDirectory(atPath: directory.path, withIntermediateDirectories: true) + let rootFileDescriptor = try FileDescriptor.open(rootFilePath, .readOnly) + defer { try? rootFileDescriptor.close() } + + // Iterate and extract archive entries, collecting rejected paths. + var foundEntry = false + var rejectedPaths = [String]() + for (entry, dataReader) in self.makeStreamingIterator() { + guard let memberPath = (entry.path.map { FilePath($0) }) else { + continue + } + foundEntry = true + + // Try to extract the entry, catching path validation errors + let extracted = try extractEntry( + entry: entry, + dataReader: dataReader, + memberPath: memberPath, + rootFileDescriptor: rootFileDescriptor + ) + + if !extracted { + rejectedPaths.append(memberPath.string) + } + } + guard foundEntry else { + throw ArchiveError.failedToExtractArchive("no entries found in archive") + } + + return rejectedPaths + } + + /// This method extracts a given file from the archive. + /// This operation modifies the underlying file descriptor's position within the archive, + /// meaning subsequent reads will start from a new location. + /// To reset the underlying file descriptor to the beginning of the archive, close and + /// reopen the archive. + public func extractFile(path: String) throws -> (WriteEntry, Data) { + let entry = WriteEntry() + while archive_read_next_header2(self.underlying, entry.underlying) != ARCHIVE_EOF { + guard let entryPath = entry.path else { continue } + let trimCharSet = CharacterSet(charactersIn: "./") + let trimmedEntry = entryPath.trimmingCharacters(in: trimCharSet) + let trimmedRequired = path.trimmingCharacters(in: trimCharSet) + guard trimmedEntry == trimmedRequired else { continue } + let data = readDataForEntry(entry) + return (entry, data) + } + throw ArchiveError.failedToExtractArchive(" \(path) not found in archive") + } + + /// Extracts a single archive entry. + /// Returns false if the entry was rejected due to path validation errors. + /// Throws on system errors. + private func extractEntry( + entry: WriteEntry, + dataReader: ArchiveEntryReader, + memberPath: FilePath, + rootFileDescriptor: FileDescriptor + ) throws -> Bool { + guard let lastComponent = memberPath.lastComponent else { + return false + } + let relativePath = memberPath.removingLastComponent() + let type = entry.fileType + + do { + switch type { + case .regular: + try FileDescriptorOps.mkdir(rootFileDescriptor, relativePath, makeIntermediates: true) { fd in + // Remove existing entry if present (mimics containerd's "last entry wins" behavior) + try? FileDescriptorOps.unlinkRecursive(fd, filename: lastComponent) + + // Open file for writing using openat with O_NOFOLLOW to prevent TOC-TOU attacks + let fileMode = entry.permissions & 0o777 // Mask to permission bits only + let fileFd = openat(fd.rawValue, lastComponent.string, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, fileMode) + guard fileFd >= 0 else { + throw ArchiveError.failedToExtractArchive("failed to create file: \(memberPath)") + } + defer { close(fileFd) } + + try Self.copyDataReaderToFd(dataReader: dataReader, fileFd: fileFd, memberPath: memberPath) + setFileAttributes(fd: fileFd, entry: entry) + } + case .directory: + try FileDescriptorOps.mkdir(rootFileDescriptor, memberPath, makeIntermediates: true) { fd in + setFileAttributes(fd: fd.rawValue, entry: entry) + } + case .symbolicLink: + guard let targetPath = (entry.symlinkTarget.map { FilePath($0) }) else { + return false + } + var symlinkCreated = false + try FileDescriptorOps.mkdir(rootFileDescriptor, relativePath, makeIntermediates: true) { fd in + // Remove existing entry if present (mimics containerd's "last entry wins" behavior) + try? FileDescriptorOps.unlinkRecursive(fd, filename: lastComponent) + + guard symlinkat(targetPath.string, fd.rawValue, lastComponent.string) == 0 else { + throw ArchiveError.failedToExtractArchive("failed to create symlink: \(targetPath) <- \(memberPath)") + } + symlinkCreated = true + } + return symlinkCreated + default: + return false + } + + return true + } catch let error as FileDescriptorOps.Error { + // Just reject path validation errors, don't fail the extraction + switch error { + case .systemError: + // Fail for system errors + throw error + case .invalidRelativePath, .invalidPathComponent, .cannotFollowSymlink: + return false + } + } + } + + private func setFileAttributes(fd: Int32, entry: WriteEntry) { + fchmod(fd, entry.permissions) + if let owner = entry.owner, let group = entry.group { + fchown(fd, owner, group) + } + } + + private static func copyDataReaderToFd(dataReader: ArchiveEntryReader, fileFd: Int32, memberPath: FilePath) throws { + var buffer = [UInt8](repeating: 0, count: ArchiveReader.chunkSize) + while true { + let bytesRead = buffer.withUnsafeMutableBufferPointer { bufferPtr in + guard let baseAddress = bufferPtr.baseAddress else { return 0 } + return dataReader.read(baseAddress, maxLength: bufferPtr.count) + } + + if bytesRead < 0 { + throw ArchiveError.failedToExtractArchive("failed to read data for: \(memberPath)") + } + if bytesRead == 0 { + break // EOF + } + + let bytesWritten = write(fileFd, buffer, bytesRead) + guard bytesWritten == bytesRead else { + throw ArchiveError.failedToExtractArchive("failed to write data for: \(memberPath)") + } + } + } +} diff --git a/Sources/ContainerizationArchive/ArchiveWriter.swift b/Sources/ContainerizationArchive/ArchiveWriter.swift new file mode 100644 index 0000000..434c51d --- /dev/null +++ b/Sources/ContainerizationArchive/ArchiveWriter.swift @@ -0,0 +1,339 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CArchive +import Foundation +import SystemPackage + +/// A class responsible for writing archives in various formats. +public final class ArchiveWriter { + private static let chunkSize = 4 * 1024 * 1024 + + var underlying: OpaquePointer? + + /// Initialize a new `ArchiveWriter` with the given configuration. + /// This method attempts to initialize an empty archive in memory, failing which it throws a `unableToCreateArchive` error. + public init(configuration: ArchiveWriterConfiguration) throws { + // because for some bizarre reason, UTF8 paths won't work unless this process explicitly sets a locale like en_US.UTF-8 + try Self.attemptSetLocales(locales: configuration.locales) + + guard let underlying = archive_write_new() else { throw ArchiveError.unableToCreateArchive } + self.underlying = underlying + + try setFormat(configuration.format) + try addFilter(configuration.filter) + try setOptions(configuration.options) + } + + /// Initialize a new `ArchiveWriter` for writing into the specified file with the given configuration options. + public convenience init(format: Format, filter: Filter, options: [Options] = [], locales: [String] = ArchiveWriterConfiguration.defaultLocales, file: URL) throws { + let config = ArchiveWriterConfiguration( + format: format, + filter: filter, + options: options, + locales: locales + ) + try self.init(configuration: config) + try self.open(file: file) + } + + /// Opens the given file for writing data into + public func open(file: URL) throws { + guard let underlying = underlying else { throw ArchiveError.noUnderlyingArchive } + let res = archive_write_open_filename(underlying, file.path) + try wrap(res, ArchiveError.unableToOpenArchive, underlying: underlying) + } + + /// Opens the given fd for writing data into + public func open(fileDescriptor: Int32) throws { + guard let underlying = underlying else { throw ArchiveError.noUnderlyingArchive } + let res = archive_write_open_fd(underlying, fileDescriptor) + try wrap(res, ArchiveError.unableToOpenArchive, underlying: underlying) + } + + /// Performs any necessary finalizations on the archive and releases resources. + public func finishEncoding() throws { + guard let u = underlying else { return } + underlying = nil + let r = archive_free(u) + guard r == ARCHIVE_OK else { + throw ArchiveError.unableToCloseArchive(r) + } + } + + deinit { + if let u = underlying { + archive_free(u) + underlying = nil + } + } + + private static func attemptSetLocales(locales: [String]) throws { + for locale in locales { + if setlocale(LC_ALL, locale) != nil { + return + } + } + throw ArchiveError.failedToSetLocale(locales: locales) + } +} + +public class ArchiveWriterTransaction { + private let writer: ArchiveWriter + + fileprivate init(writer: ArchiveWriter) { + self.writer = writer + } + + public func writeHeader(entry: WriteEntry) throws { + try writer.writeHeader(entry: entry) + } + + public func writeChunk(data: UnsafeRawBufferPointer) throws { + try writer.writeData(data: data) + } + + public func finish() throws { + try writer.finishEntry() + } +} + +extension ArchiveWriter { + public func makeTransactionWriter() -> ArchiveWriterTransaction { + ArchiveWriterTransaction(writer: self) + } + + /// Create a new entry in the archive with the given properties. + /// - Parameters: + /// - entry: A `WriteEntry` object describing the metadata of the entry to be created + /// (e.g., name, modification date, permissions). + /// - data: The `Data` object containing the content for the new entry. + public func writeEntry(entry: WriteEntry, data: Data) throws { + try data.withUnsafeBytes { bytes in + try writeEntry(entry: entry, data: bytes) + } + } + + /// Creates a new entry in the archive with the given properties. + /// + /// This method performs the following: + /// 1. Writes the archive header using the provided `WriteEntry` metadata. + /// 2. Writes the content from the `UnsafeRawBufferPointer` into the archive. + /// 3. Finalizes the entry in the archive. + /// + /// - Parameters: + /// - entry: A `WriteEntry` object describing the metadata of the entry to be created + /// (e.g., name, modification date, permissions, type). + /// - data: An optional `UnsafeRawBufferPointer` containing the raw bytes for the new entry's + /// content. Pass `nil` for entries that do not have content data (e.g., directories, symlinks). + public func writeEntry(entry: WriteEntry, data: UnsafeRawBufferPointer?) throws { + try writeHeader(entry: entry) + if let data = data { + try writeData(data: data) + } + try finishEntry() + } + + fileprivate func writeHeader(entry: WriteEntry) throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + + try wrap( + archive_write_header(underlying, entry.underlying), ArchiveError.unableToWriteEntryHeader, + underlying: underlying) + } + + fileprivate func finishEntry() throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + + archive_write_finish_entry(underlying) + } + + fileprivate func writeData(data: UnsafeRawBufferPointer) throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + + var offset = 0 + while offset < data.count { + guard let baseAddress = data.baseAddress?.advanced(by: offset) else { + throw ArchiveError.invalidBaseAddressArchiveWrite + } + let result = archive_write_data(underlying, baseAddress, data.count - offset) + guard result > 0 else { + throw ArchiveError.unableToWriteData(result) + } + offset += Int(result) + } + } +} + +extension ArchiveWriter { + private func archive(_ relativePath: FilePath, dirPath: FilePath) throws { + let fm = FileManager.default + + let fullPath = dirPath.appending(relativePath.string) + + var statInfo = stat() + guard lstat(fullPath.string, &statInfo) == 0 else { + let errNo = errno + let err = POSIXErrorCode(rawValue: errNo) ?? .EINVAL + throw ArchiveError.failedToCreateArchive("lstat failed for '\(fullPath)': \(POSIXError(err))") + } + + let mode = statInfo.st_mode + let uid = statInfo.st_uid + let gid = statInfo.st_gid + var size: Int64 = 0 + let type: URLFileResourceType + + if (mode & S_IFMT) == S_IFREG { + type = .regular + size = Int64(statInfo.st_size) + } else if (mode & S_IFMT) == S_IFDIR { + type = .directory + } else if (mode & S_IFMT) == S_IFLNK { + type = .symbolicLink + } else { + return + } + + #if os(macOS) + let created = Date(timeIntervalSince1970: Double(statInfo.st_ctimespec.tv_sec)) + let access = Date(timeIntervalSince1970: Double(statInfo.st_atimespec.tv_sec)) + let modified = Date(timeIntervalSince1970: Double(statInfo.st_mtimespec.tv_sec)) + #else + let created = Date(timeIntervalSince1970: Double(statInfo.st_ctim.tv_sec)) + let access = Date(timeIntervalSince1970: Double(statInfo.st_atim.tv_sec)) + let modified = Date(timeIntervalSince1970: Double(statInfo.st_mtim.tv_sec)) + #endif + + let entry = WriteEntry() + if type == .symbolicLink { + let targetPath = try fm.destinationOfSymbolicLink(atPath: fullPath.string) + // Resolve the target relative to the symlink's parent, not the archive root. + let symlinkParent = fullPath.removingLastComponent() + let resolvedFull = symlinkParent.appending(targetPath).lexicallyNormalized() + guard resolvedFull.starts(with: dirPath) else { + return + } + entry.symlinkTarget = targetPath + } + + entry.path = relativePath.string + entry.size = size + entry.creationDate = created + entry.modificationDate = modified + entry.contentAccessDate = access + entry.fileType = type + entry.group = gid + entry.owner = uid + entry.permissions = mode + if type == .regular { + let buf = UnsafeMutableRawBufferPointer.allocate(byteCount: Self.chunkSize, alignment: 1) + guard let baseAddress = buf.baseAddress else { + throw ArchiveError.failedToCreateArchive("cannot create temporary buffer of size \(Self.chunkSize)") + } + defer { buf.deallocate() } + let fd = Foundation.open(fullPath.string, O_RDONLY) + guard fd >= 0 else { + let err = POSIXErrorCode(rawValue: errno) ?? .EINVAL + throw ArchiveError.failedToCreateArchive("cannot open file \(fullPath.string) for reading: \(err)") + } + defer { close(fd) } + try self.writeHeader(entry: entry) + while true { + let n = read(fd, baseAddress, Self.chunkSize) + if n == 0 { break } + if n < 0 { + let err = POSIXErrorCode(rawValue: errno) ?? .EIO + throw ArchiveError.failedToCreateArchive("failed to read from file \(fullPath.string): \(err)") + } + try self.writeData(data: UnsafeRawBufferPointer(start: baseAddress, count: n)) + } + try self.finishEntry() + } else { + try self.writeEntry(entry: entry, data: nil) + } + } + + /// Recursively archives the content of a directory. Regular files, symlinks and directories are added into the archive. + /// Note: Symlinks are added to the archive if both the source and target for the symlink are both contained in the top level directory. + public func archiveDirectory(_ dir: URL) throws { + let fm = FileManager.default + let dirPath = FilePath(dir.path) + + guard let enumerator = fm.enumerator(atPath: dirPath.string) else { + throw POSIXError(.ENOTDIR) + } + + // Emit a leading "./" entry for the root directory, matching GNU/BSD tar behavior. + var rootStat = stat() + guard lstat(dirPath.string, &rootStat) == 0 else { + let err = POSIXErrorCode(rawValue: errno) ?? .EINVAL + throw ArchiveError.failedToCreateArchive("lstat failed for '\(dirPath)': \(POSIXError(err))") + } + let rootEntry = WriteEntry() + rootEntry.path = "./" + rootEntry.size = 0 + rootEntry.fileType = .directory + rootEntry.owner = rootStat.st_uid + rootEntry.group = rootStat.st_gid + rootEntry.permissions = rootStat.st_mode + #if os(macOS) + rootEntry.creationDate = Date(timeIntervalSince1970: Double(rootStat.st_ctimespec.tv_sec)) + rootEntry.contentAccessDate = Date(timeIntervalSince1970: Double(rootStat.st_atimespec.tv_sec)) + rootEntry.modificationDate = Date(timeIntervalSince1970: Double(rootStat.st_mtimespec.tv_sec)) + #else + rootEntry.creationDate = Date(timeIntervalSince1970: Double(rootStat.st_ctim.tv_sec)) + rootEntry.contentAccessDate = Date(timeIntervalSince1970: Double(rootStat.st_atim.tv_sec)) + rootEntry.modificationDate = Date(timeIntervalSince1970: Double(rootStat.st_mtim.tv_sec)) + #endif + try self.writeHeader(entry: rootEntry) + + for case let relativePath as String in enumerator { + try archive(FilePath(relativePath), dirPath: dirPath) + } + } + + public func archive(_ paths: [FilePath], base: FilePath) throws { + let fm = FileManager.default + let base = base.lexicallyNormalized() + + for path in paths { + guard path.starts(with: base) else { + throw ArchiveError.failedToCreateArchive("'\(path.string)' is not under '\(base.string)'") + } + + let relativePath = path.components.dropFirst(base.components.count) + .reduce(into: FilePath("")) { $0.append($1) } + + var isDir: ObjCBool = false + _ = fm.fileExists(atPath: path.string, isDirectory: &isDir) + if isDir.boolValue { + guard let enumerator = fm.enumerator(atPath: path.string) else { + throw POSIXError(.ENOTDIR) + } + + try archive(relativePath, dirPath: base) + for case let child as String in enumerator { + let childPath = relativePath.appending(child) + + try archive(childPath, dirPath: base) + } + } else { + try archive(relativePath, dirPath: base) + } + } + } +} diff --git a/Sources/ContainerizationArchive/ArchiveWriterConfiguration.swift b/Sources/ContainerizationArchive/ArchiveWriterConfiguration.swift new file mode 100644 index 0000000..e4e1055 --- /dev/null +++ b/Sources/ContainerizationArchive/ArchiveWriterConfiguration.swift @@ -0,0 +1,200 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CArchive + +/// Represents the configuration settings for an `ArchiveWriter`. +/// +/// This struct allows specifying the archive format, compression filter, +/// various format-specific options, and preferred locales for string encoding. +public struct ArchiveWriterConfiguration { + public static let defaultLocales = ["en_US.UTF-8", "C.UTF-8"] + + /// The desired archive format + public var format: Format + /// The compression filter to apply to the archive + public var filter: Filter + /// An array of format-specific options to apply to the archive. + /// This includes options like compression level and extended attribute format. + public var options: [Options] + /// An array of preferred locale identifiers for string encoding + public var locales: [String] + + /// Initializes a new `ArchiveWriterConfiguration`. + /// + /// Sets up the configuration with the specified format, filter, options, and locales. + public init( + format: Format, filter: Filter, options: [Options] = [], locales: [String] = Self.defaultLocales + ) { + self.format = format + self.filter = filter + self.options = options + self.locales = locales + } +} + +extension ArchiveWriter { + internal func setFormat(_ format: Format) throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + let r = archive_write_set_format(underlying, format.code) + guard r == ARCHIVE_OK else { throw ArchiveError.unableToSetFormat(r, format) } + } + + internal func addFilter(_ filter: Filter) throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + let r = archive_write_add_filter(underlying, filter.code) + guard r == ARCHIVE_OK else { throw ArchiveError.unableToAddFilter(r, filter) } + } + + internal func setOptions(_ options: [Options]) throws { + guard let underlying = self.underlying else { throw ArchiveError.noUnderlyingArchive } + try options.forEach { + switch $0 { + case .compressionLevel(let level): + try wrap( + archive_write_set_option(underlying, nil, "compression-level", "\(level)"), + ArchiveError.unableToSetOption, underlying: self.underlying) + case .compression(.store): + try wrap( + archive_write_set_option(underlying, nil, "compression", "store"), ArchiveError.unableToSetOption, + underlying: self.underlying) + case .compression(.deflate): + try wrap( + archive_write_set_option(underlying, nil, "compression", "deflate"), ArchiveError.unableToSetOption, + underlying: self.underlying) + case .xattrformat(let value): + let v = value.description + try wrap( + archive_write_set_option(underlying, nil, "xattrheader", v), ArchiveError.unableToSetOption, + underlying: self.underlying) + } + } + } +} + +public enum Options { + case compressionLevel(UInt32) + case compression(Compression) + case xattrformat(XattrFormat) + + public enum Compression { + case store + case deflate + } + + public enum XattrFormat: String, CustomStringConvertible { + case schily + case libarchive + case all + + public var description: String { + switch self { + case .libarchive: + return "LIBARCHIVE" + case .schily: + return "SCHILY" + case .all: + return "ALL" + } + } + } +} + +/// An enumeration of the supported archive formats. +public enum Format: String, Sendable { + /// POSIX-standard `ustar` archives + case ustar + case gnutar + /// POSIX `pax interchange format` archives + case pax + case paxRestricted + /// POSIX octet-oriented cpio archives + case cpio + case cpioNewc + /// Zip archive + case zip + /// two different variants of shar archives + case shar + case sharDump + /// ISO9660 CD images + case iso9660 + /// 7-Zip archives + case sevenZip + /// ar archives + case arBSD + case arGNU + /// mtree file tree descriptions + case mtree + /// XAR archives + case xar + + internal var code: CInt { + switch self { + case .ustar: return ARCHIVE_FORMAT_TAR_USTAR + case .pax: return ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE + case .paxRestricted: return ARCHIVE_FORMAT_TAR_PAX_RESTRICTED + case .gnutar: return ARCHIVE_FORMAT_TAR_GNUTAR + case .cpio: return ARCHIVE_FORMAT_CPIO_POSIX + case .cpioNewc: return ARCHIVE_FORMAT_CPIO_AFIO_LARGE + case .zip: return ARCHIVE_FORMAT_ZIP + case .shar: return ARCHIVE_FORMAT_SHAR_BASE + case .sharDump: return ARCHIVE_FORMAT_SHAR_DUMP + case .iso9660: return ARCHIVE_FORMAT_ISO9660 + case .sevenZip: return ARCHIVE_FORMAT_7ZIP + case .arBSD: return ARCHIVE_FORMAT_AR_BSD + case .arGNU: return ARCHIVE_FORMAT_AR_GNU + case .mtree: return ARCHIVE_FORMAT_MTREE + case .xar: return ARCHIVE_FORMAT_XAR + } + } +} + +/// An enumeration of the supported filters (compression / encoding standards) for an archive. +public enum Filter: String, Sendable { + case none + case gzip + case bzip2 + case compress + case lzma + case xz + case uu + case rpm + case lzip + case lrzip + case lzop + case grzip + case lz4 + case zstd + + internal var code: CInt { + switch self { + case .none: return ARCHIVE_FILTER_NONE + case .gzip: return ARCHIVE_FILTER_GZIP + case .bzip2: return ARCHIVE_FILTER_BZIP2 + case .compress: return ARCHIVE_FILTER_COMPRESS + case .lzma: return ARCHIVE_FILTER_LZMA + case .xz: return ARCHIVE_FILTER_XZ + case .uu: return ARCHIVE_FILTER_UU + case .rpm: return ARCHIVE_FILTER_RPM + case .lzip: return ARCHIVE_FILTER_LZIP + case .lrzip: return ARCHIVE_FILTER_LRZIP + case .lzop: return ARCHIVE_FILTER_LZOP + case .grzip: return ARCHIVE_FILTER_GRZIP + case .lz4: return ARCHIVE_FILTER_LZ4 + case .zstd: return ARCHIVE_FILTER_ZSTD + } + } +} diff --git a/Sources/ContainerizationArchive/CArchive/COPYING b/Sources/ContainerizationArchive/CArchive/COPYING new file mode 100644 index 0000000..1b97235 --- /dev/null +++ b/Sources/ContainerizationArchive/CArchive/COPYING @@ -0,0 +1,65 @@ +The libarchive distribution as a whole is Copyright by Tim Kientzle +and is subject to the copyright notice reproduced at the bottom of +this file. + +Each individual file in this distribution should have a clear +copyright/licensing statement at the beginning of the file. If any do +not, please let me know and I will rectify it. The following is +intended to summarize the copyright status of the individual files; +the actual statements in the files are controlling. + +* Except as listed below, all C sources (including .c and .h files) + and documentation files are subject to the copyright notice reproduced + at the bottom of this file. + +* The following source files are also subject in whole or in part to + a 3-clause UC Regents copyright; please read the individual source + files for details: + libarchive/archive_read_support_filter_compress.c + libarchive/archive_write_add_filter_compress.c + libarchive/mtree.5 + +* The following source files are in the public domain: + libarchive/archive_getdate.c + +* The following source files are triple-licensed with the ability to choose + from CC0 1.0 Universal, OpenSSL or Apache 2.0 licenses: + libarchive/archive_blake2.h + libarchive/archive_blake2_impl.h + libarchive/archive_blake2s_ref.c + libarchive/archive_blake2sp_ref.c + +* The build files---including Makefiles, configure scripts, + and auxiliary scripts used as part of the compile process---have + widely varying licensing terms. Please check individual files before + distributing them to see if those restrictions apply to you. + +I intend for all new source code to use the license below and hope over +time to replace code with other licenses with new implementations that +do use the license below. The varying licensing of the build scripts +seems to be an unavoidable mess. + + +Copyright (c) 2003-2018 +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer + in this position and unchanged. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT, +INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/Sources/ContainerizationArchive/CArchive/archive_swift_bridge.c b/Sources/ContainerizationArchive/CArchive/archive_swift_bridge.c new file mode 100644 index 0000000..a16d32b --- /dev/null +++ b/Sources/ContainerizationArchive/CArchive/archive_swift_bridge.c @@ -0,0 +1,68 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "archive_bridge.h" +#include +#include +#include + +void archive_set_error_wrapper(struct archive *a, int error_number, const char *error_string) { + archive_set_error(a, error_number, "%s", error_string); +} + +int zstd_decompress_fd(int src_fd, int dst_fd) { + ZSTD_DStream *dstream = ZSTD_createDStream(); + if (!dstream) return 1; + + size_t init_result = ZSTD_initDStream(dstream); + if (ZSTD_isError(init_result)) { + ZSTD_freeDStream(dstream); + return 1; + } + + size_t in_size = ZSTD_DStreamInSize(); + size_t out_size = ZSTD_DStreamOutSize(); + void *in_buf = malloc(in_size); + void *out_buf = malloc(out_size); + if (!in_buf || !out_buf) { + free(in_buf); + free(out_buf); + ZSTD_freeDStream(dstream); + return 1; + } + + int rc = 0; + ssize_t bytes_read; + while ((bytes_read = read(src_fd, in_buf, in_size)) > 0) { + ZSTD_inBuffer input = { in_buf, (size_t)bytes_read, 0 }; + while (input.pos < input.size) { + ZSTD_outBuffer output = { out_buf, out_size, 0 }; + size_t result = ZSTD_decompressStream(dstream, &output, &input); + if (ZSTD_isError(result)) { rc = 1; goto done; } + if (output.pos > 0) { + ssize_t written = write(dst_fd, out_buf, output.pos); + if (written != (ssize_t)output.pos) { rc = 1; goto done; } + } + } + } + if (bytes_read < 0) rc = 1; + +done: + free(in_buf); + free(out_buf); + ZSTD_freeDStream(dstream); + return rc; +} diff --git a/Sources/ContainerizationArchive/CArchive/include/archive.h b/Sources/ContainerizationArchive/CArchive/include/archive.h new file mode 100644 index 0000000..5b65475 --- /dev/null +++ b/Sources/ContainerizationArchive/CArchive/include/archive.h @@ -0,0 +1,1214 @@ +/*- + * Copyright (c) 2003-2010 Tim Kientzle + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef ARCHIVE_H_INCLUDED +#define ARCHIVE_H_INCLUDED + +/* + * The version number is expressed as a single integer that makes it + * easy to compare versions at build time: for version a.b.c, the + * version number is printf("%d%03d%03d",a,b,c). For example, if you + * know your application requires version 2.12.108 or later, you can + * assert that ARCHIVE_VERSION_NUMBER >= 2012108. + */ +/* Note: Compiler will complain if this does not match archive_entry.h! */ +#define ARCHIVE_VERSION_NUMBER 3007007 + +#include +#include /* for wchar_t */ +#include /* For FILE * */ +#include /* For time_t */ + +/* + * Note: archive.h is for use outside of libarchive; the configuration + * headers (config.h, archive_platform.h, etc.) are purely internal. + * Do NOT use HAVE_XXX configuration macros to control the behavior of + * this header! If you must conditionalize, use predefined compiler and/or + * platform macros. + */ +#if defined(__BORLANDC__) && __BORLANDC__ >= 0x560 +# include +#elif !defined(__WATCOMC__) && !defined(_MSC_VER) && !defined(__INTERIX) && !defined(__BORLANDC__) && !defined(_SCO_DS) && !defined(__osf__) && !defined(__CLANG_INTTYPES_H) +# include +#endif + +/* Get appropriate definitions of 64-bit integer */ +#if !defined(__LA_INT64_T_DEFINED) +/* Older code relied on the __LA_INT64_T macro; after 4.0 we'll switch to the typedef exclusively. */ +# if ARCHIVE_VERSION_NUMBER < 4000000 +#define __LA_INT64_T la_int64_t +# endif +#define __LA_INT64_T_DEFINED +# if defined(_WIN32) && !defined(__CYGWIN__) && !defined(__WATCOMC__) +typedef __int64 la_int64_t; +# else +# include /* ssize_t */ +# if defined(_SCO_DS) || defined(__osf__) +typedef long long la_int64_t; +# else +typedef int64_t la_int64_t; +# endif +# endif +#endif + +/* The la_ssize_t should match the type used in 'struct stat' */ +#if !defined(__LA_SSIZE_T_DEFINED) +/* Older code relied on the __LA_SSIZE_T macro; after 4.0 we'll switch to the typedef exclusively. */ +# if ARCHIVE_VERSION_NUMBER < 4000000 +#define __LA_SSIZE_T la_ssize_t +# endif +#define __LA_SSIZE_T_DEFINED +# if defined(_WIN32) && !defined(__CYGWIN__) && !defined(__WATCOMC__) +# if defined(_SSIZE_T_DEFINED) || defined(_SSIZE_T_) +typedef ssize_t la_ssize_t; +# elif defined(_WIN64) +typedef __int64 la_ssize_t; +# else +typedef long la_ssize_t; +# endif +# else +# include /* ssize_t */ +typedef ssize_t la_ssize_t; +# endif +#endif + +/* Large file support for Android */ +#if defined(__LIBARCHIVE_BUILD) && defined(__ANDROID__) +#include "android_lf.h" +#endif + +/* + * On Windows, define LIBARCHIVE_STATIC if you're building or using a + * .lib. The default here assumes you're building a DLL. Only + * libarchive source should ever define __LIBARCHIVE_BUILD. + */ +#if ((defined __WIN32__) || (defined _WIN32) || defined(__CYGWIN__)) && (!defined LIBARCHIVE_STATIC) +# ifdef __LIBARCHIVE_BUILD +# ifdef __GNUC__ +# define __LA_DECL __attribute__((dllexport)) extern +# else +# define __LA_DECL __declspec(dllexport) +# endif +# else +# ifdef __GNUC__ +# define __LA_DECL +# else +# define __LA_DECL __declspec(dllimport) +# endif +# endif +#elif defined __LIBARCHIVE_ENABLE_VISIBILITY +# define __LA_DECL __attribute__((visibility("default"))) +#else +/* Static libraries or non-Windows needs no special declaration. */ +# define __LA_DECL +#endif + +#if defined(__GNUC__) && __GNUC__ >= 3 && !defined(__MINGW32__) +#define __LA_PRINTF(fmtarg, firstvararg) \ + __attribute__((__format__ (__printf__, fmtarg, firstvararg))) +#else +#define __LA_PRINTF(fmtarg, firstvararg) /* nothing */ +#endif + +#if defined(__GNUC__) && __GNUC__ >= 3 && __GNUC_MINOR__ >= 1 +# define __LA_DEPRECATED __attribute__((deprecated)) +#else +# define __LA_DEPRECATED +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * The version number is provided as both a macro and a function. + * The macro identifies the installed header; the function identifies + * the library version (which may not be the same if you're using a + * dynamically-linked version of the library). Of course, if the + * header and library are very different, you should expect some + * strangeness. Don't do that. + */ +__LA_DECL int archive_version_number(void); + +/* + * Textual name/version of the library, useful for version displays. + */ +#define ARCHIVE_VERSION_ONLY_STRING "3.7.7" +#define ARCHIVE_VERSION_STRING "libarchive " ARCHIVE_VERSION_ONLY_STRING +__LA_DECL const char * archive_version_string(void); + +/* + * Detailed textual name/version of the library and its dependencies. + * This has the form: + * "libarchive x.y.z zlib/a.b.c liblzma/d.e.f ... etc ..." + * the list of libraries described here will vary depending on how + * libarchive was compiled. + */ +__LA_DECL const char * archive_version_details(void); + +/* + * Returns NULL if libarchive was compiled without the associated library. + * Otherwise, returns the version number that libarchive was compiled + * against. + */ +__LA_DECL const char * archive_zlib_version(void); +__LA_DECL const char * archive_liblzma_version(void); +__LA_DECL const char * archive_bzlib_version(void); +__LA_DECL const char * archive_liblz4_version(void); +__LA_DECL const char * archive_libzstd_version(void); + +/* Declare our basic types. */ +struct archive; +struct archive_entry; + +/* + * Error codes: Use archive_errno() and archive_error_string() + * to retrieve details. Unless specified otherwise, all functions + * that return 'int' use these codes. + */ +#define ARCHIVE_EOF 1 /* Found end of archive. */ +#define ARCHIVE_OK 0 /* Operation was successful. */ +#define ARCHIVE_RETRY (-10) /* Retry might succeed. */ +#define ARCHIVE_WARN (-20) /* Partial success. */ +/* For example, if write_header "fails", then you can't push data. */ +#define ARCHIVE_FAILED (-25) /* Current operation cannot complete. */ +/* But if write_header is "fatal," then this archive is dead and useless. */ +#define ARCHIVE_FATAL (-30) /* No more operations are possible. */ + +/* + * As far as possible, archive_errno returns standard platform errno codes. + * Of course, the details vary by platform, so the actual definitions + * here are stored in "archive_platform.h". The symbols are listed here + * for reference; as a rule, clients should not need to know the exact + * platform-dependent error code. + */ +/* Unrecognized or invalid file format. */ +/* #define ARCHIVE_ERRNO_FILE_FORMAT */ +/* Illegal usage of the library. */ +/* #define ARCHIVE_ERRNO_PROGRAMMER_ERROR */ +/* Unknown or unclassified error. */ +/* #define ARCHIVE_ERRNO_MISC */ + +/* + * Callbacks are invoked to automatically read/skip/write/open/close the + * archive. You can provide your own for complex tasks (like breaking + * archives across multiple tapes) or use standard ones built into the + * library. + */ + +/* Returns pointer and size of next block of data from archive. */ +typedef la_ssize_t archive_read_callback(struct archive *, + void *_client_data, const void **_buffer); + +/* Skips at most request bytes from archive and returns the skipped amount. + * This may skip fewer bytes than requested; it may even skip zero bytes. + * If you do skip fewer bytes than requested, libarchive will invoke your + * read callback and discard data as necessary to make up the full skip. + */ +typedef la_int64_t archive_skip_callback(struct archive *, + void *_client_data, la_int64_t request); + +/* Seeks to specified location in the file and returns the position. + * Whence values are SEEK_SET, SEEK_CUR, SEEK_END from stdio.h. + * Return ARCHIVE_FATAL if the seek fails for any reason. + */ +typedef la_int64_t archive_seek_callback(struct archive *, + void *_client_data, la_int64_t offset, int whence); + +/* Returns size actually written, zero on EOF, -1 on error. */ +typedef la_ssize_t archive_write_callback(struct archive *, + void *_client_data, + const void *_buffer, size_t _length); + +typedef int archive_open_callback(struct archive *, void *_client_data); + +typedef int archive_close_callback(struct archive *, void *_client_data); + +typedef int archive_free_callback(struct archive *, void *_client_data); + +/* Switches from one client data object to the next/prev client data object. + * This is useful for reading from different data blocks such as a set of files + * that make up one large file. + */ +typedef int archive_switch_callback(struct archive *, void *_client_data1, + void *_client_data2); + +/* + * Returns a passphrase used for encryption or decryption, NULL on nothing + * to do and give it up. + */ +typedef const char *archive_passphrase_callback(struct archive *, + void *_client_data); + +/* + * Codes to identify various stream filters. + */ +#define ARCHIVE_FILTER_NONE 0 +#define ARCHIVE_FILTER_GZIP 1 +#define ARCHIVE_FILTER_BZIP2 2 +#define ARCHIVE_FILTER_COMPRESS 3 +#define ARCHIVE_FILTER_PROGRAM 4 +#define ARCHIVE_FILTER_LZMA 5 +#define ARCHIVE_FILTER_XZ 6 +#define ARCHIVE_FILTER_UU 7 +#define ARCHIVE_FILTER_RPM 8 +#define ARCHIVE_FILTER_LZIP 9 +#define ARCHIVE_FILTER_LRZIP 10 +#define ARCHIVE_FILTER_LZOP 11 +#define ARCHIVE_FILTER_GRZIP 12 +#define ARCHIVE_FILTER_LZ4 13 +#define ARCHIVE_FILTER_ZSTD 14 + +#if ARCHIVE_VERSION_NUMBER < 4000000 +#define ARCHIVE_COMPRESSION_NONE ARCHIVE_FILTER_NONE +#define ARCHIVE_COMPRESSION_GZIP ARCHIVE_FILTER_GZIP +#define ARCHIVE_COMPRESSION_BZIP2 ARCHIVE_FILTER_BZIP2 +#define ARCHIVE_COMPRESSION_COMPRESS ARCHIVE_FILTER_COMPRESS +#define ARCHIVE_COMPRESSION_PROGRAM ARCHIVE_FILTER_PROGRAM +#define ARCHIVE_COMPRESSION_LZMA ARCHIVE_FILTER_LZMA +#define ARCHIVE_COMPRESSION_XZ ARCHIVE_FILTER_XZ +#define ARCHIVE_COMPRESSION_UU ARCHIVE_FILTER_UU +#define ARCHIVE_COMPRESSION_RPM ARCHIVE_FILTER_RPM +#define ARCHIVE_COMPRESSION_LZIP ARCHIVE_FILTER_LZIP +#define ARCHIVE_COMPRESSION_LRZIP ARCHIVE_FILTER_LRZIP +#endif + +/* + * Codes returned by archive_format. + * + * Top 16 bits identifies the format family (e.g., "tar"); lower + * 16 bits indicate the variant. This is updated by read_next_header. + * Note that the lower 16 bits will often vary from entry to entry. + * In some cases, this variation occurs as libarchive learns more about + * the archive (for example, later entries might utilize extensions that + * weren't necessary earlier in the archive; in this case, libarchive + * will change the format code to indicate the extended format that + * was used). In other cases, it's because different tools have + * modified the archive and so different parts of the archive + * actually have slightly different formats. (Both tar and cpio store + * format codes in each entry, so it is quite possible for each + * entry to be in a different format.) + */ +#define ARCHIVE_FORMAT_BASE_MASK 0xff0000 +#define ARCHIVE_FORMAT_CPIO 0x10000 +#define ARCHIVE_FORMAT_CPIO_POSIX (ARCHIVE_FORMAT_CPIO | 1) +#define ARCHIVE_FORMAT_CPIO_BIN_LE (ARCHIVE_FORMAT_CPIO | 2) +#define ARCHIVE_FORMAT_CPIO_BIN_BE (ARCHIVE_FORMAT_CPIO | 3) +#define ARCHIVE_FORMAT_CPIO_SVR4_NOCRC (ARCHIVE_FORMAT_CPIO | 4) +#define ARCHIVE_FORMAT_CPIO_SVR4_CRC (ARCHIVE_FORMAT_CPIO | 5) +#define ARCHIVE_FORMAT_CPIO_AFIO_LARGE (ARCHIVE_FORMAT_CPIO | 6) +#define ARCHIVE_FORMAT_CPIO_PWB (ARCHIVE_FORMAT_CPIO | 7) +#define ARCHIVE_FORMAT_SHAR 0x20000 +#define ARCHIVE_FORMAT_SHAR_BASE (ARCHIVE_FORMAT_SHAR | 1) +#define ARCHIVE_FORMAT_SHAR_DUMP (ARCHIVE_FORMAT_SHAR | 2) +#define ARCHIVE_FORMAT_TAR 0x30000 +#define ARCHIVE_FORMAT_TAR_USTAR (ARCHIVE_FORMAT_TAR | 1) +#define ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE (ARCHIVE_FORMAT_TAR | 2) +#define ARCHIVE_FORMAT_TAR_PAX_RESTRICTED (ARCHIVE_FORMAT_TAR | 3) +#define ARCHIVE_FORMAT_TAR_GNUTAR (ARCHIVE_FORMAT_TAR | 4) +#define ARCHIVE_FORMAT_ISO9660 0x40000 +#define ARCHIVE_FORMAT_ISO9660_ROCKRIDGE (ARCHIVE_FORMAT_ISO9660 | 1) +#define ARCHIVE_FORMAT_ZIP 0x50000 +#define ARCHIVE_FORMAT_EMPTY 0x60000 +#define ARCHIVE_FORMAT_AR 0x70000 +#define ARCHIVE_FORMAT_AR_GNU (ARCHIVE_FORMAT_AR | 1) +#define ARCHIVE_FORMAT_AR_BSD (ARCHIVE_FORMAT_AR | 2) +#define ARCHIVE_FORMAT_MTREE 0x80000 +#define ARCHIVE_FORMAT_RAW 0x90000 +#define ARCHIVE_FORMAT_XAR 0xA0000 +#define ARCHIVE_FORMAT_LHA 0xB0000 +#define ARCHIVE_FORMAT_CAB 0xC0000 +#define ARCHIVE_FORMAT_RAR 0xD0000 +#define ARCHIVE_FORMAT_7ZIP 0xE0000 +#define ARCHIVE_FORMAT_WARC 0xF0000 +#define ARCHIVE_FORMAT_RAR_V5 0x100000 + +/* + * Codes returned by archive_read_format_capabilities(). + * + * This list can be extended with values between 0 and 0xffff. + * The original purpose of this list was to let different archive + * format readers expose their general capabilities in terms of + * encryption. + */ +#define ARCHIVE_READ_FORMAT_CAPS_NONE (0) /* no special capabilities */ +#define ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_DATA (1<<0) /* reader can detect encrypted data */ +#define ARCHIVE_READ_FORMAT_CAPS_ENCRYPT_METADATA (1<<1) /* reader can detect encryptable metadata (pathname, mtime, etc.) */ + +/* + * Codes returned by archive_read_has_encrypted_entries(). + * + * In case the archive does not support encryption detection at all + * ARCHIVE_READ_FORMAT_ENCRYPTION_UNSUPPORTED is returned. If the reader + * for some other reason (e.g. not enough bytes read) cannot say if + * there are encrypted entries, ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW + * is returned. + */ +#define ARCHIVE_READ_FORMAT_ENCRYPTION_UNSUPPORTED -2 +#define ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW -1 + +/*- + * Basic outline for reading an archive: + * 1) Ask archive_read_new for an archive reader object. + * 2) Update any global properties as appropriate. + * In particular, you'll certainly want to call appropriate + * archive_read_support_XXX functions. + * 3) Call archive_read_open_XXX to open the archive + * 4) Repeatedly call archive_read_next_header to get information about + * successive archive entries. Call archive_read_data to extract + * data for entries of interest. + * 5) Call archive_read_free to end processing. + */ +__LA_DECL struct archive *archive_read_new(void); + +/* + * The archive_read_support_XXX calls enable auto-detect for this + * archive handle. They also link in the necessary support code. + * For example, if you don't want bzlib linked in, don't invoke + * support_compression_bzip2(). The "all" functions provide the + * obvious shorthand. + */ + +#if ARCHIVE_VERSION_NUMBER < 4000000 +__LA_DECL int archive_read_support_compression_all(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_bzip2(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_compress(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_gzip(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_lzip(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_lzma(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_none(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_program(struct archive *, + const char *command) __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_program_signature + (struct archive *, const char *, + const void * /* match */, size_t) __LA_DEPRECATED; + +__LA_DECL int archive_read_support_compression_rpm(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_uu(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_read_support_compression_xz(struct archive *) + __LA_DEPRECATED; +#endif + +__LA_DECL int archive_read_support_filter_all(struct archive *); +__LA_DECL int archive_read_support_filter_by_code(struct archive *, int); +__LA_DECL int archive_read_support_filter_bzip2(struct archive *); +__LA_DECL int archive_read_support_filter_compress(struct archive *); +__LA_DECL int archive_read_support_filter_gzip(struct archive *); +__LA_DECL int archive_read_support_filter_grzip(struct archive *); +__LA_DECL int archive_read_support_filter_lrzip(struct archive *); +__LA_DECL int archive_read_support_filter_lz4(struct archive *); +__LA_DECL int archive_read_support_filter_lzip(struct archive *); +__LA_DECL int archive_read_support_filter_lzma(struct archive *); +__LA_DECL int archive_read_support_filter_lzop(struct archive *); +__LA_DECL int archive_read_support_filter_none(struct archive *); +__LA_DECL int archive_read_support_filter_program(struct archive *, + const char *command); +__LA_DECL int archive_read_support_filter_program_signature + (struct archive *, const char * /* cmd */, + const void * /* match */, size_t); +__LA_DECL int archive_read_support_filter_rpm(struct archive *); +__LA_DECL int archive_read_support_filter_uu(struct archive *); +__LA_DECL int archive_read_support_filter_xz(struct archive *); +__LA_DECL int archive_read_support_filter_zstd(struct archive *); + +__LA_DECL int archive_read_support_format_7zip(struct archive *); +__LA_DECL int archive_read_support_format_all(struct archive *); +__LA_DECL int archive_read_support_format_ar(struct archive *); +__LA_DECL int archive_read_support_format_by_code(struct archive *, int); +__LA_DECL int archive_read_support_format_cab(struct archive *); +__LA_DECL int archive_read_support_format_cpio(struct archive *); +__LA_DECL int archive_read_support_format_empty(struct archive *); +__LA_DECL int archive_read_support_format_gnutar(struct archive *); +__LA_DECL int archive_read_support_format_iso9660(struct archive *); +__LA_DECL int archive_read_support_format_lha(struct archive *); +__LA_DECL int archive_read_support_format_mtree(struct archive *); +__LA_DECL int archive_read_support_format_rar(struct archive *); +__LA_DECL int archive_read_support_format_rar5(struct archive *); +__LA_DECL int archive_read_support_format_raw(struct archive *); +__LA_DECL int archive_read_support_format_tar(struct archive *); +__LA_DECL int archive_read_support_format_warc(struct archive *); +__LA_DECL int archive_read_support_format_xar(struct archive *); +/* archive_read_support_format_zip() enables both streamable and seekable + * zip readers. */ +__LA_DECL int archive_read_support_format_zip(struct archive *); +/* Reads Zip archives as stream from beginning to end. Doesn't + * correctly handle SFX ZIP files or ZIP archives that have been modified + * in-place. */ +__LA_DECL int archive_read_support_format_zip_streamable(struct archive *); +/* Reads starting from central directory; requires seekable input. */ +__LA_DECL int archive_read_support_format_zip_seekable(struct archive *); + +/* Functions to manually set the format and filters to be used. This is + * useful to bypass the bidding process when the format and filters to use + * is known in advance. + */ +__LA_DECL int archive_read_set_format(struct archive *, int); +__LA_DECL int archive_read_append_filter(struct archive *, int); +__LA_DECL int archive_read_append_filter_program(struct archive *, + const char *); +__LA_DECL int archive_read_append_filter_program_signature + (struct archive *, const char *, const void * /* match */, size_t); + +/* Set various callbacks. */ +__LA_DECL int archive_read_set_open_callback(struct archive *, + archive_open_callback *); +__LA_DECL int archive_read_set_read_callback(struct archive *, + archive_read_callback *); +__LA_DECL int archive_read_set_seek_callback(struct archive *, + archive_seek_callback *); +__LA_DECL int archive_read_set_skip_callback(struct archive *, + archive_skip_callback *); +__LA_DECL int archive_read_set_close_callback(struct archive *, + archive_close_callback *); +/* Callback used to switch between one data object to the next */ +__LA_DECL int archive_read_set_switch_callback(struct archive *, + archive_switch_callback *); + +/* This sets the first data object. */ +__LA_DECL int archive_read_set_callback_data(struct archive *, void *); +/* This sets data object at specified index */ +__LA_DECL int archive_read_set_callback_data2(struct archive *, void *, + unsigned int); +/* This adds a data object at the specified index. */ +__LA_DECL int archive_read_add_callback_data(struct archive *, void *, + unsigned int); +/* This appends a data object to the end of list */ +__LA_DECL int archive_read_append_callback_data(struct archive *, void *); +/* This prepends a data object to the beginning of list */ +__LA_DECL int archive_read_prepend_callback_data(struct archive *, void *); + +/* Opening freezes the callbacks. */ +__LA_DECL int archive_read_open1(struct archive *); + +/* Convenience wrappers around the above. */ +__LA_DECL int archive_read_open(struct archive *, void *_client_data, + archive_open_callback *, archive_read_callback *, + archive_close_callback *); +__LA_DECL int archive_read_open2(struct archive *, void *_client_data, + archive_open_callback *, archive_read_callback *, + archive_skip_callback *, archive_close_callback *); + +/* + * A variety of shortcuts that invoke archive_read_open() with + * canned callbacks suitable for common situations. The ones that + * accept a block size handle tape blocking correctly. + */ +/* Use this if you know the filename. Note: NULL indicates stdin. */ +__LA_DECL int archive_read_open_filename(struct archive *, + const char *_filename, size_t _block_size); +/* Use this for reading multivolume files by filenames. + * NOTE: Must be NULL terminated. Sorting is NOT done. */ +__LA_DECL int archive_read_open_filenames(struct archive *, + const char **_filenames, size_t _block_size); +__LA_DECL int archive_read_open_filename_w(struct archive *, + const wchar_t *_filename, size_t _block_size); +#if defined(_WIN32) && !defined(__CYGWIN__) +__LA_DECL int archive_read_open_filenames_w(struct archive *, + const wchar_t **_filenames, size_t _block_size); +#endif +/* archive_read_open_file() is a deprecated synonym for ..._open_filename(). */ +__LA_DECL int archive_read_open_file(struct archive *, + const char *_filename, size_t _block_size) __LA_DEPRECATED; +/* Read an archive that's stored in memory. */ +__LA_DECL int archive_read_open_memory(struct archive *, + const void * buff, size_t size); +/* A more involved version that is only used for internal testing. */ +__LA_DECL int archive_read_open_memory2(struct archive *a, const void *buff, + size_t size, size_t read_size); +/* Read an archive that's already open, using the file descriptor. */ +__LA_DECL int archive_read_open_fd(struct archive *, int _fd, + size_t _block_size); +/* Read an archive that's already open, using a FILE *. */ +/* Note: DO NOT use this with tape drives. */ +__LA_DECL int archive_read_open_FILE(struct archive *, FILE *_file); + +/* Parses and returns next entry header. */ +__LA_DECL int archive_read_next_header(struct archive *, + struct archive_entry **); + +/* Parses and returns next entry header using the archive_entry passed in */ +__LA_DECL int archive_read_next_header2(struct archive *, + struct archive_entry *); + +/* + * Retrieve the byte offset in UNCOMPRESSED data where last-read + * header started. + */ +__LA_DECL la_int64_t archive_read_header_position(struct archive *); + +/* + * Returns 1 if the archive contains at least one encrypted entry. + * If the archive format not support encryption at all + * ARCHIVE_READ_FORMAT_ENCRYPTION_UNSUPPORTED is returned. + * If for any other reason (e.g. not enough data read so far) + * we cannot say whether there are encrypted entries, then + * ARCHIVE_READ_FORMAT_ENCRYPTION_DONT_KNOW is returned. + * In general, this function will return values below zero when the + * reader is uncertain or totally incapable of encryption support. + * When this function returns 0 you can be sure that the reader + * supports encryption detection but no encrypted entries have + * been found yet. + * + * NOTE: If the metadata/header of an archive is also encrypted, you + * cannot rely on the number of encrypted entries. That is why this + * function does not return the number of encrypted entries but# + * just shows that there are some. + */ +__LA_DECL int archive_read_has_encrypted_entries(struct archive *); + +/* + * Returns a bitmask of capabilities that are supported by the archive format reader. + * If the reader has no special capabilities, ARCHIVE_READ_FORMAT_CAPS_NONE is returned. + */ +__LA_DECL int archive_read_format_capabilities(struct archive *); + +/* Read data from the body of an entry. Similar to read(2). */ +__LA_DECL la_ssize_t archive_read_data(struct archive *, + void *, size_t); + +/* Seek within the body of an entry. Similar to lseek(2). */ +__LA_DECL la_int64_t archive_seek_data(struct archive *, la_int64_t, int); + +/* + * A zero-copy version of archive_read_data that also exposes the file offset + * of each returned block. Note that the client has no way to specify + * the desired size of the block. The API does guarantee that offsets will + * be strictly increasing and that returned blocks will not overlap. + */ +__LA_DECL int archive_read_data_block(struct archive *a, + const void **buff, size_t *size, la_int64_t *offset); + +/*- + * Some convenience functions that are built on archive_read_data: + * 'skip': skips entire entry + * 'into_buffer': writes data into memory buffer that you provide + * 'into_fd': writes data to specified filedes + */ +__LA_DECL int archive_read_data_skip(struct archive *); +__LA_DECL int archive_read_data_into_fd(struct archive *, int fd); + +/* + * Set read options. + */ +/* Apply option to the format only. */ +__LA_DECL int archive_read_set_format_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option to the filter only. */ +__LA_DECL int archive_read_set_filter_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option to both the format and the filter. */ +__LA_DECL int archive_read_set_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option string to both the format and the filter. */ +__LA_DECL int archive_read_set_options(struct archive *_a, + const char *opts); + +/* + * Add a decryption passphrase. + */ +__LA_DECL int archive_read_add_passphrase(struct archive *, const char *); +__LA_DECL int archive_read_set_passphrase_callback(struct archive *, + void *client_data, archive_passphrase_callback *); + + +/*- + * Convenience function to recreate the current entry (whose header + * has just been read) on disk. + * + * This does quite a bit more than just copy data to disk. It also: + * - Creates intermediate directories as required. + * - Manages directory permissions: non-writable directories will + * be initially created with write permission enabled; when the + * archive is closed, dir permissions are edited to the values specified + * in the archive. + * - Checks hardlinks: hardlinks will not be extracted unless the + * linked-to file was also extracted within the same session. (TODO) + */ + +/* The "flags" argument selects optional behavior, 'OR' the flags you want. */ + +/* Default: Do not try to set owner/group. */ +#define ARCHIVE_EXTRACT_OWNER (0x0001) +/* Default: Do obey umask, do not restore SUID/SGID/SVTX bits. */ +#define ARCHIVE_EXTRACT_PERM (0x0002) +/* Default: Do not restore mtime/atime. */ +#define ARCHIVE_EXTRACT_TIME (0x0004) +/* Default: Replace existing files. */ +#define ARCHIVE_EXTRACT_NO_OVERWRITE (0x0008) +/* Default: Try create first, unlink only if create fails with EEXIST. */ +#define ARCHIVE_EXTRACT_UNLINK (0x0010) +/* Default: Do not restore ACLs. */ +#define ARCHIVE_EXTRACT_ACL (0x0020) +/* Default: Do not restore fflags. */ +#define ARCHIVE_EXTRACT_FFLAGS (0x0040) +/* Default: Do not restore xattrs. */ +#define ARCHIVE_EXTRACT_XATTR (0x0080) +/* Default: Do not try to guard against extracts redirected by symlinks. */ +/* Note: With ARCHIVE_EXTRACT_UNLINK, will remove any intermediate symlink. */ +#define ARCHIVE_EXTRACT_SECURE_SYMLINKS (0x0100) +/* Default: Do not reject entries with '..' as path elements. */ +#define ARCHIVE_EXTRACT_SECURE_NODOTDOT (0x0200) +/* Default: Create parent directories as needed. */ +#define ARCHIVE_EXTRACT_NO_AUTODIR (0x0400) +/* Default: Overwrite files, even if one on disk is newer. */ +#define ARCHIVE_EXTRACT_NO_OVERWRITE_NEWER (0x0800) +/* Detect blocks of 0 and write holes instead. */ +#define ARCHIVE_EXTRACT_SPARSE (0x1000) +/* Default: Do not restore Mac extended metadata. */ +/* This has no effect except on Mac OS. */ +#define ARCHIVE_EXTRACT_MAC_METADATA (0x2000) +/* Default: Use HFS+ compression if it was compressed. */ +/* This has no effect except on Mac OS v10.6 or later. */ +#define ARCHIVE_EXTRACT_NO_HFS_COMPRESSION (0x4000) +/* Default: Do not use HFS+ compression if it was not compressed. */ +/* This has no effect except on Mac OS v10.6 or later. */ +#define ARCHIVE_EXTRACT_HFS_COMPRESSION_FORCED (0x8000) +/* Default: Do not reject entries with absolute paths */ +#define ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS (0x10000) +/* Default: Do not clear no-change flags when unlinking object */ +#define ARCHIVE_EXTRACT_CLEAR_NOCHANGE_FFLAGS (0x20000) +/* Default: Do not extract atomically (using rename) */ +#define ARCHIVE_EXTRACT_SAFE_WRITES (0x40000) + +__LA_DECL int archive_read_extract(struct archive *, struct archive_entry *, + int flags); +__LA_DECL int archive_read_extract2(struct archive *, struct archive_entry *, + struct archive * /* dest */); +__LA_DECL void archive_read_extract_set_progress_callback(struct archive *, + void (*_progress_func)(void *), void *_user_data); + +/* Record the dev/ino of a file that will not be written. This is + * generally set to the dev/ino of the archive being read. */ +__LA_DECL void archive_read_extract_set_skip_file(struct archive *, + la_int64_t, la_int64_t); + +/* Close the file and release most resources. */ +__LA_DECL int archive_read_close(struct archive *); +/* Release all resources and destroy the object. */ +/* Note that archive_read_free will call archive_read_close for you. */ +__LA_DECL int archive_read_free(struct archive *); +#if ARCHIVE_VERSION_NUMBER < 4000000 +/* Synonym for archive_read_free() for backwards compatibility. */ +__LA_DECL int archive_read_finish(struct archive *) __LA_DEPRECATED; +#endif + +/*- + * To create an archive: + * 1) Ask archive_write_new for an archive writer object. + * 2) Set any global properties. In particular, you should set + * the compression and format to use. + * 3) Call archive_write_open to open the file (most people + * will use archive_write_open_file or archive_write_open_fd, + * which provide convenient canned I/O callbacks for you). + * 4) For each entry: + * - construct an appropriate struct archive_entry structure + * - archive_write_header to write the header + * - archive_write_data to write the entry data + * 5) archive_write_close to close the output + * 6) archive_write_free to cleanup the writer and release resources + */ +__LA_DECL struct archive *archive_write_new(void); +__LA_DECL int archive_write_set_bytes_per_block(struct archive *, + int bytes_per_block); +__LA_DECL int archive_write_get_bytes_per_block(struct archive *); +/* XXX This is badly misnamed; suggestions appreciated. XXX */ +__LA_DECL int archive_write_set_bytes_in_last_block(struct archive *, + int bytes_in_last_block); +__LA_DECL int archive_write_get_bytes_in_last_block(struct archive *); + +/* The dev/ino of a file that won't be archived. This is used + * to avoid recursively adding an archive to itself. */ +__LA_DECL int archive_write_set_skip_file(struct archive *, + la_int64_t, la_int64_t); + +#if ARCHIVE_VERSION_NUMBER < 4000000 +__LA_DECL int archive_write_set_compression_bzip2(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_compress(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_gzip(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_lzip(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_lzma(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_none(struct archive *) + __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_program(struct archive *, + const char *cmd) __LA_DEPRECATED; +__LA_DECL int archive_write_set_compression_xz(struct archive *) + __LA_DEPRECATED; +#endif + +/* A convenience function to set the filter based on the code. */ +__LA_DECL int archive_write_add_filter(struct archive *, int filter_code); +__LA_DECL int archive_write_add_filter_by_name(struct archive *, + const char *name); +__LA_DECL int archive_write_add_filter_b64encode(struct archive *); +__LA_DECL int archive_write_add_filter_bzip2(struct archive *); +__LA_DECL int archive_write_add_filter_compress(struct archive *); +__LA_DECL int archive_write_add_filter_grzip(struct archive *); +__LA_DECL int archive_write_add_filter_gzip(struct archive *); +__LA_DECL int archive_write_add_filter_lrzip(struct archive *); +__LA_DECL int archive_write_add_filter_lz4(struct archive *); +__LA_DECL int archive_write_add_filter_lzip(struct archive *); +__LA_DECL int archive_write_add_filter_lzma(struct archive *); +__LA_DECL int archive_write_add_filter_lzop(struct archive *); +__LA_DECL int archive_write_add_filter_none(struct archive *); +__LA_DECL int archive_write_add_filter_program(struct archive *, + const char *cmd); +__LA_DECL int archive_write_add_filter_uuencode(struct archive *); +__LA_DECL int archive_write_add_filter_xz(struct archive *); +__LA_DECL int archive_write_add_filter_zstd(struct archive *); + + +/* A convenience function to set the format based on the code or name. */ +__LA_DECL int archive_write_set_format(struct archive *, int format_code); +__LA_DECL int archive_write_set_format_by_name(struct archive *, + const char *name); +/* To minimize link pollution, use one or more of the following. */ +__LA_DECL int archive_write_set_format_7zip(struct archive *); +__LA_DECL int archive_write_set_format_ar_bsd(struct archive *); +__LA_DECL int archive_write_set_format_ar_svr4(struct archive *); +__LA_DECL int archive_write_set_format_cpio(struct archive *); +__LA_DECL int archive_write_set_format_cpio_bin(struct archive *); +__LA_DECL int archive_write_set_format_cpio_newc(struct archive *); +__LA_DECL int archive_write_set_format_cpio_odc(struct archive *); +__LA_DECL int archive_write_set_format_cpio_pwb(struct archive *); +__LA_DECL int archive_write_set_format_gnutar(struct archive *); +__LA_DECL int archive_write_set_format_iso9660(struct archive *); +__LA_DECL int archive_write_set_format_mtree(struct archive *); +__LA_DECL int archive_write_set_format_mtree_classic(struct archive *); +/* TODO: int archive_write_set_format_old_tar(struct archive *); */ +__LA_DECL int archive_write_set_format_pax(struct archive *); +__LA_DECL int archive_write_set_format_pax_restricted(struct archive *); +__LA_DECL int archive_write_set_format_raw(struct archive *); +__LA_DECL int archive_write_set_format_shar(struct archive *); +__LA_DECL int archive_write_set_format_shar_dump(struct archive *); +__LA_DECL int archive_write_set_format_ustar(struct archive *); +__LA_DECL int archive_write_set_format_v7tar(struct archive *); +__LA_DECL int archive_write_set_format_warc(struct archive *); +__LA_DECL int archive_write_set_format_xar(struct archive *); +__LA_DECL int archive_write_set_format_zip(struct archive *); +__LA_DECL int archive_write_set_format_filter_by_ext(struct archive *a, const char *filename); +__LA_DECL int archive_write_set_format_filter_by_ext_def(struct archive *a, const char *filename, const char * def_ext); +__LA_DECL int archive_write_zip_set_compression_deflate(struct archive *); +__LA_DECL int archive_write_zip_set_compression_store(struct archive *); +/* Deprecated; use archive_write_open2 instead */ +__LA_DECL int archive_write_open(struct archive *, void *, + archive_open_callback *, archive_write_callback *, + archive_close_callback *); +__LA_DECL int archive_write_open2(struct archive *, void *, + archive_open_callback *, archive_write_callback *, + archive_close_callback *, archive_free_callback *); +__LA_DECL int archive_write_open_fd(struct archive *, int _fd); +__LA_DECL int archive_write_open_filename(struct archive *, const char *_file); +__LA_DECL int archive_write_open_filename_w(struct archive *, + const wchar_t *_file); +/* A deprecated synonym for archive_write_open_filename() */ +__LA_DECL int archive_write_open_file(struct archive *, const char *_file) + __LA_DEPRECATED; +__LA_DECL int archive_write_open_FILE(struct archive *, FILE *); +/* _buffSize is the size of the buffer, _used refers to a variable that + * will be updated after each write into the buffer. */ +__LA_DECL int archive_write_open_memory(struct archive *, + void *_buffer, size_t _buffSize, size_t *_used); + +/* + * Note that the library will truncate writes beyond the size provided + * to archive_write_header or pad if the provided data is short. + */ +__LA_DECL int archive_write_header(struct archive *, + struct archive_entry *); +__LA_DECL la_ssize_t archive_write_data(struct archive *, + const void *, size_t); + +/* This interface is currently only available for archive_write_disk handles. */ +__LA_DECL la_ssize_t archive_write_data_block(struct archive *, + const void *, size_t, la_int64_t); + +__LA_DECL int archive_write_finish_entry(struct archive *); +__LA_DECL int archive_write_close(struct archive *); +/* Marks the archive as FATAL so that a subsequent free() operation + * won't try to close() cleanly. Provides a fast abort capability + * when the client discovers that things have gone wrong. */ +__LA_DECL int archive_write_fail(struct archive *); +/* This can fail if the archive wasn't already closed, in which case + * archive_write_free() will implicitly call archive_write_close(). */ +__LA_DECL int archive_write_free(struct archive *); +#if ARCHIVE_VERSION_NUMBER < 4000000 +/* Synonym for archive_write_free() for backwards compatibility. */ +__LA_DECL int archive_write_finish(struct archive *) __LA_DEPRECATED; +#endif + +/* + * Set write options. + */ +/* Apply option to the format only. */ +__LA_DECL int archive_write_set_format_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option to the filter only. */ +__LA_DECL int archive_write_set_filter_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option to both the format and the filter. */ +__LA_DECL int archive_write_set_option(struct archive *_a, + const char *m, const char *o, + const char *v); +/* Apply option string to both the format and the filter. */ +__LA_DECL int archive_write_set_options(struct archive *_a, + const char *opts); + +/* + * Set an encryption passphrase. + */ +__LA_DECL int archive_write_set_passphrase(struct archive *_a, const char *p); +__LA_DECL int archive_write_set_passphrase_callback(struct archive *, + void *client_data, archive_passphrase_callback *); + +/*- + * ARCHIVE_WRITE_DISK API + * + * To create objects on disk: + * 1) Ask archive_write_disk_new for a new archive_write_disk object. + * 2) Set any global properties. In particular, you probably + * want to set the options. + * 3) For each entry: + * - construct an appropriate struct archive_entry structure + * - archive_write_header to create the file/dir/etc on disk + * - archive_write_data to write the entry data + * 4) archive_write_free to cleanup the writer and release resources + * + * In particular, you can use this in conjunction with archive_read() + * to pull entries out of an archive and create them on disk. + */ +__LA_DECL struct archive *archive_write_disk_new(void); +/* This file will not be overwritten. */ +__LA_DECL int archive_write_disk_set_skip_file(struct archive *, + la_int64_t, la_int64_t); +/* Set flags to control how the next item gets created. + * This accepts a bitmask of ARCHIVE_EXTRACT_XXX flags defined above. */ +__LA_DECL int archive_write_disk_set_options(struct archive *, + int flags); +/* + * The lookup functions are given uname/uid (or gname/gid) pairs and + * return a uid (gid) suitable for this system. These are used for + * restoring ownership and for setting ACLs. The default functions + * are naive, they just return the uid/gid. These are small, so reasonable + * for applications that don't need to preserve ownership; they + * are probably also appropriate for applications that are doing + * same-system backup and restore. + */ +/* + * The "standard" lookup functions use common system calls to lookup + * the uname/gname, falling back to the uid/gid if the names can't be + * found. They cache lookups and are reasonably fast, but can be very + * large, so they are not used unless you ask for them. In + * particular, these match the specifications of POSIX "pax" and old + * POSIX "tar". + */ +__LA_DECL int archive_write_disk_set_standard_lookup(struct archive *); +/* + * If neither the default (naive) nor the standard (big) functions suit + * your needs, you can write your own and register them. Be sure to + * include a cleanup function if you have allocated private data. + */ +__LA_DECL int archive_write_disk_set_group_lookup(struct archive *, + void * /* private_data */, + la_int64_t (*)(void *, const char *, la_int64_t), + void (* /* cleanup */)(void *)); +__LA_DECL int archive_write_disk_set_user_lookup(struct archive *, + void * /* private_data */, + la_int64_t (*)(void *, const char *, la_int64_t), + void (* /* cleanup */)(void *)); +__LA_DECL la_int64_t archive_write_disk_gid(struct archive *, const char *, la_int64_t); +__LA_DECL la_int64_t archive_write_disk_uid(struct archive *, const char *, la_int64_t); + +/* + * ARCHIVE_READ_DISK API + * + * This is still evolving and somewhat experimental. + */ +__LA_DECL struct archive *archive_read_disk_new(void); +/* The names for symlink modes here correspond to an old BSD + * command-line argument convention: -L, -P, -H */ +/* Follow all symlinks. */ +__LA_DECL int archive_read_disk_set_symlink_logical(struct archive *); +/* Follow no symlinks. */ +__LA_DECL int archive_read_disk_set_symlink_physical(struct archive *); +/* Follow symlink initially, then not. */ +__LA_DECL int archive_read_disk_set_symlink_hybrid(struct archive *); +/* TODO: Handle Linux stat32/stat64 ugliness. */ +__LA_DECL int archive_read_disk_entry_from_file(struct archive *, + struct archive_entry *, int /* fd */, const struct stat *); +/* Look up gname for gid or uname for uid. */ +/* Default implementations are very, very stupid. */ +__LA_DECL const char *archive_read_disk_gname(struct archive *, la_int64_t); +__LA_DECL const char *archive_read_disk_uname(struct archive *, la_int64_t); +/* "Standard" implementation uses getpwuid_r, getgrgid_r and caches the + * results for performance. */ +__LA_DECL int archive_read_disk_set_standard_lookup(struct archive *); +/* You can install your own lookups if you like. */ +__LA_DECL int archive_read_disk_set_gname_lookup(struct archive *, + void * /* private_data */, + const char *(* /* lookup_fn */)(void *, la_int64_t), + void (* /* cleanup_fn */)(void *)); +__LA_DECL int archive_read_disk_set_uname_lookup(struct archive *, + void * /* private_data */, + const char *(* /* lookup_fn */)(void *, la_int64_t), + void (* /* cleanup_fn */)(void *)); +/* Start traversal. */ +__LA_DECL int archive_read_disk_open(struct archive *, const char *); +__LA_DECL int archive_read_disk_open_w(struct archive *, const wchar_t *); +/* + * Request that current entry be visited. If you invoke it on every + * directory, you'll get a physical traversal. This is ignored if the + * current entry isn't a directory or a link to a directory. So, if + * you invoke this on every returned path, you'll get a full logical + * traversal. + */ +__LA_DECL int archive_read_disk_descend(struct archive *); +__LA_DECL int archive_read_disk_can_descend(struct archive *); +__LA_DECL int archive_read_disk_current_filesystem(struct archive *); +__LA_DECL int archive_read_disk_current_filesystem_is_synthetic(struct archive *); +__LA_DECL int archive_read_disk_current_filesystem_is_remote(struct archive *); +/* Request that the access time of the entry visited by traversal be restored. */ +__LA_DECL int archive_read_disk_set_atime_restored(struct archive *); +/* + * Set behavior. The "flags" argument selects optional behavior. + */ +/* Request that the access time of the entry visited by traversal be restored. + * This is the same as archive_read_disk_set_atime_restored. */ +#define ARCHIVE_READDISK_RESTORE_ATIME (0x0001) +/* Default: Do not skip an entry which has nodump flags. */ +#define ARCHIVE_READDISK_HONOR_NODUMP (0x0002) +/* Default: Skip a mac resource fork file whose prefix is "._" because of + * using copyfile. */ +#define ARCHIVE_READDISK_MAC_COPYFILE (0x0004) +/* Default: Traverse mount points. */ +#define ARCHIVE_READDISK_NO_TRAVERSE_MOUNTS (0x0008) +/* Default: Xattrs are read from disk. */ +#define ARCHIVE_READDISK_NO_XATTR (0x0010) +/* Default: ACLs are read from disk. */ +#define ARCHIVE_READDISK_NO_ACL (0x0020) +/* Default: File flags are read from disk. */ +#define ARCHIVE_READDISK_NO_FFLAGS (0x0040) +/* Default: Sparse file information is read from disk. */ +#define ARCHIVE_READDISK_NO_SPARSE (0x0080) + +__LA_DECL int archive_read_disk_set_behavior(struct archive *, + int flags); + +/* + * Set archive_match object that will be used in archive_read_disk to + * know whether an entry should be skipped. The callback function + * _excluded_func will be invoked when an entry is skipped by the result + * of archive_match. + */ +__LA_DECL int archive_read_disk_set_matching(struct archive *, + struct archive *_matching, void (*_excluded_func) + (struct archive *, void *, struct archive_entry *), + void *_client_data); +__LA_DECL int archive_read_disk_set_metadata_filter_callback(struct archive *, + int (*_metadata_filter_func)(struct archive *, void *, + struct archive_entry *), void *_client_data); + +/* Simplified cleanup interface; + * This calls archive_read_free() or archive_write_free() as needed. */ +__LA_DECL int archive_free(struct archive *); + +/* + * Accessor functions to read/set various information in + * the struct archive object: + */ + +/* Number of filters in the current filter pipeline. */ +/* Filter #0 is the one closest to the format, -1 is a synonym for the + * last filter, which is always the pseudo-filter that wraps the + * client callbacks. */ +__LA_DECL int archive_filter_count(struct archive *); +__LA_DECL la_int64_t archive_filter_bytes(struct archive *, int); +__LA_DECL int archive_filter_code(struct archive *, int); +__LA_DECL const char * archive_filter_name(struct archive *, int); + +#if ARCHIVE_VERSION_NUMBER < 4000000 +/* These don't properly handle multiple filters, so are deprecated and + * will eventually be removed. */ +/* As of libarchive 3.0, this is an alias for archive_filter_bytes(a, -1); */ +__LA_DECL la_int64_t archive_position_compressed(struct archive *) + __LA_DEPRECATED; +/* As of libarchive 3.0, this is an alias for archive_filter_bytes(a, 0); */ +__LA_DECL la_int64_t archive_position_uncompressed(struct archive *) + __LA_DEPRECATED; +/* As of libarchive 3.0, this is an alias for archive_filter_name(a, 0); */ +__LA_DECL const char *archive_compression_name(struct archive *) + __LA_DEPRECATED; +/* As of libarchive 3.0, this is an alias for archive_filter_code(a, 0); */ +__LA_DECL int archive_compression(struct archive *) + __LA_DEPRECATED; +#endif + +__LA_DECL int archive_errno(struct archive *); +__LA_DECL const char *archive_error_string(struct archive *); +__LA_DECL const char *archive_format_name(struct archive *); +__LA_DECL int archive_format(struct archive *); +__LA_DECL void archive_clear_error(struct archive *); +__LA_DECL void archive_set_error(struct archive *, int _err, + const char *fmt, ...) __LA_PRINTF(3, 4); +__LA_DECL void archive_copy_error(struct archive *dest, + struct archive *src); +__LA_DECL int archive_file_count(struct archive *); + +/* + * ARCHIVE_MATCH API + */ +__LA_DECL struct archive *archive_match_new(void); +__LA_DECL int archive_match_free(struct archive *); + +/* + * Test if archive_entry is excluded. + * This is a convenience function. This is the same as calling all + * archive_match_path_excluded, archive_match_time_excluded + * and archive_match_owner_excluded. + */ +__LA_DECL int archive_match_excluded(struct archive *, + struct archive_entry *); + +/* + * Test if pathname is excluded. The conditions are set by following functions. + */ +__LA_DECL int archive_match_path_excluded(struct archive *, + struct archive_entry *); +/* Control recursive inclusion of directory content when directory is included. Default on. */ +__LA_DECL int archive_match_set_inclusion_recursion(struct archive *, int); +/* Add exclusion pathname pattern. */ +__LA_DECL int archive_match_exclude_pattern(struct archive *, const char *); +__LA_DECL int archive_match_exclude_pattern_w(struct archive *, + const wchar_t *); +/* Add exclusion pathname pattern from file. */ +__LA_DECL int archive_match_exclude_pattern_from_file(struct archive *, + const char *, int _nullSeparator); +__LA_DECL int archive_match_exclude_pattern_from_file_w(struct archive *, + const wchar_t *, int _nullSeparator); +/* Add inclusion pathname pattern. */ +__LA_DECL int archive_match_include_pattern(struct archive *, const char *); +__LA_DECL int archive_match_include_pattern_w(struct archive *, + const wchar_t *); +/* Add inclusion pathname pattern from file. */ +__LA_DECL int archive_match_include_pattern_from_file(struct archive *, + const char *, int _nullSeparator); +__LA_DECL int archive_match_include_pattern_from_file_w(struct archive *, + const wchar_t *, int _nullSeparator); +/* + * How to get statistic information for inclusion patterns. + */ +/* Return the amount number of unmatched inclusion patterns. */ +__LA_DECL int archive_match_path_unmatched_inclusions(struct archive *); +/* Return the pattern of unmatched inclusion with ARCHIVE_OK. + * Return ARCHIVE_EOF if there is no inclusion pattern. */ +__LA_DECL int archive_match_path_unmatched_inclusions_next( + struct archive *, const char **); +__LA_DECL int archive_match_path_unmatched_inclusions_next_w( + struct archive *, const wchar_t **); + +/* + * Test if a file is excluded by its time stamp. + * The conditions are set by following functions. + */ +__LA_DECL int archive_match_time_excluded(struct archive *, + struct archive_entry *); + +/* + * Flags to tell a matching type of time stamps. These are used for + * following functions. + */ +/* Time flag: mtime to be tested. */ +#define ARCHIVE_MATCH_MTIME (0x0100) +/* Time flag: ctime to be tested. */ +#define ARCHIVE_MATCH_CTIME (0x0200) +/* Comparison flag: Match the time if it is newer than. */ +#define ARCHIVE_MATCH_NEWER (0x0001) +/* Comparison flag: Match the time if it is older than. */ +#define ARCHIVE_MATCH_OLDER (0x0002) +/* Comparison flag: Match the time if it is equal to. */ +#define ARCHIVE_MATCH_EQUAL (0x0010) +/* Set inclusion time. */ +__LA_DECL int archive_match_include_time(struct archive *, int _flag, + time_t _sec, long _nsec); +/* Set inclusion time by a date string. */ +__LA_DECL int archive_match_include_date(struct archive *, int _flag, + const char *_datestr); +__LA_DECL int archive_match_include_date_w(struct archive *, int _flag, + const wchar_t *_datestr); +/* Set inclusion time by a particular file. */ +__LA_DECL int archive_match_include_file_time(struct archive *, + int _flag, const char *_pathname); +__LA_DECL int archive_match_include_file_time_w(struct archive *, + int _flag, const wchar_t *_pathname); +/* Add exclusion entry. */ +__LA_DECL int archive_match_exclude_entry(struct archive *, + int _flag, struct archive_entry *); + +/* + * Test if a file is excluded by its uid ,gid, uname or gname. + * The conditions are set by following functions. + */ +__LA_DECL int archive_match_owner_excluded(struct archive *, + struct archive_entry *); +/* Add inclusion uid, gid, uname and gname. */ +__LA_DECL int archive_match_include_uid(struct archive *, la_int64_t); +__LA_DECL int archive_match_include_gid(struct archive *, la_int64_t); +__LA_DECL int archive_match_include_uname(struct archive *, const char *); +__LA_DECL int archive_match_include_uname_w(struct archive *, + const wchar_t *); +__LA_DECL int archive_match_include_gname(struct archive *, const char *); +__LA_DECL int archive_match_include_gname_w(struct archive *, + const wchar_t *); + +/* Utility functions */ +/* Convenience function to sort a NULL terminated list of strings */ +__LA_DECL int archive_utility_string_sort(char **); + +#ifdef __cplusplus +} +#endif + +/* These are meaningless outside of this header. */ +#undef __LA_DECL + +#endif /* !ARCHIVE_H_INCLUDED */ diff --git a/Sources/ContainerizationArchive/CArchive/include/archive_bridge.h b/Sources/ContainerizationArchive/CArchive/include/archive_bridge.h new file mode 100644 index 0000000..91c3ac2 --- /dev/null +++ b/Sources/ContainerizationArchive/CArchive/include/archive_bridge.h @@ -0,0 +1,12 @@ +// + +#pragma once + +#include "archive.h" +#include + +void archive_set_error_wrapper(struct archive *a, int error_number, const char *error_string); + +/// Decompress a zstd-compressed file at \p src_fd into \p dst_fd. +/// Returns 0 on success, or a non-zero error code on failure. +int zstd_decompress_fd(int src_fd, int dst_fd); diff --git a/Sources/ContainerizationArchive/CArchive/include/archive_entry.h b/Sources/ContainerizationArchive/CArchive/include/archive_entry.h new file mode 100644 index 0000000..97f5cda --- /dev/null +++ b/Sources/ContainerizationArchive/CArchive/include/archive_entry.h @@ -0,0 +1,731 @@ +/*- + * Copyright (c) 2003-2008 Tim Kientzle + * Copyright (c) 2016 Martin Matuska + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef ARCHIVE_ENTRY_H_INCLUDED +#define ARCHIVE_ENTRY_H_INCLUDED + +/* Note: Compiler will complain if this does not match archive.h! */ +#define ARCHIVE_VERSION_NUMBER 3007007 + +/* + * Note: archive_entry.h is for use outside of libarchive; the + * configuration headers (config.h, archive_platform.h, etc.) are + * purely internal. Do NOT use HAVE_XXX configuration macros to + * control the behavior of this header! If you must conditionalize, + * use predefined compiler and/or platform macros. + */ + +#include +#include /* for wchar_t */ +#include +#include + +#if defined(_WIN32) && !defined(__CYGWIN__) +#include +#endif + +/* Get a suitable 64-bit integer type. */ +#if !defined(__LA_INT64_T_DEFINED) +# if ARCHIVE_VERSION_NUMBER < 4000000 +#define __LA_INT64_T la_int64_t +# endif +#define __LA_INT64_T_DEFINED +# if defined(_WIN32) && !defined(__CYGWIN__) && !defined(__WATCOMC__) +typedef __int64 la_int64_t; +# else +#include +# if defined(_SCO_DS) || defined(__osf__) +typedef long long la_int64_t; +# else +typedef int64_t la_int64_t; +# endif +# endif +#endif + +/* The la_ssize_t should match the type used in 'struct stat' */ +#if !defined(__LA_SSIZE_T_DEFINED) +/* Older code relied on the __LA_SSIZE_T macro; after 4.0 we'll switch to the typedef exclusively. */ +# if ARCHIVE_VERSION_NUMBER < 4000000 +#define __LA_SSIZE_T la_ssize_t +# endif +#define __LA_SSIZE_T_DEFINED +# if defined(_WIN32) && !defined(__CYGWIN__) && !defined(__WATCOMC__) +# if defined(_SSIZE_T_DEFINED) || defined(_SSIZE_T_) +typedef ssize_t la_ssize_t; +# elif defined(_WIN64) +typedef __int64 la_ssize_t; +# else +typedef long la_ssize_t; +# endif +# else +# include /* ssize_t */ +typedef ssize_t la_ssize_t; +# endif +#endif + +/* Get a suitable definition for mode_t */ +#if ARCHIVE_VERSION_NUMBER >= 3999000 +/* Switch to plain 'int' for libarchive 4.0. It's less broken than 'mode_t' */ +# define __LA_MODE_T int +#elif defined(_WIN32) && !defined(__CYGWIN__) && !defined(__BORLANDC__) && !defined(__WATCOMC__) +# define __LA_MODE_T unsigned short +#else +# define __LA_MODE_T mode_t +#endif + +/* Large file support for Android */ +#if defined(__LIBARCHIVE_BUILD) && defined(__ANDROID__) +#include "android_lf.h" +#endif + +/* + * On Windows, define LIBARCHIVE_STATIC if you're building or using a + * .lib. The default here assumes you're building a DLL. Only + * libarchive source should ever define __LIBARCHIVE_BUILD. + */ +#if ((defined __WIN32__) || (defined _WIN32) || defined(__CYGWIN__)) && (!defined LIBARCHIVE_STATIC) +# ifdef __LIBARCHIVE_BUILD +# ifdef __GNUC__ +# define __LA_DECL __attribute__((dllexport)) extern +# else +# define __LA_DECL __declspec(dllexport) +# endif +# else +# ifdef __GNUC__ +# define __LA_DECL +# else +# define __LA_DECL __declspec(dllimport) +# endif +# endif +#elif defined __LIBARCHIVE_ENABLE_VISIBILITY +# define __LA_DECL __attribute__((visibility("default"))) +#else +/* Static libraries on all platforms and shared libraries on non-Windows. */ +# define __LA_DECL +#endif + +#if defined(__GNUC__) && __GNUC__ >= 3 && __GNUC_MINOR__ >= 1 +# define __LA_DEPRECATED __attribute__((deprecated)) +#else +# define __LA_DEPRECATED +#endif + +#ifdef __cplusplus +extern "C" { +#endif + +/* + * Description of an archive entry. + * + * You can think of this as "struct stat" with some text fields added in. + * + * TODO: Add "comment", "charset", and possibly other entries that are + * supported by "pax interchange" format. However, GNU, ustar, cpio, + * and other variants don't support these features, so they're not an + * excruciatingly high priority right now. + * + * TODO: "pax interchange" format allows essentially arbitrary + * key/value attributes to be attached to any entry. Supporting + * such extensions may make this library useful for special + * applications (e.g., a package manager could attach special + * package-management attributes to each entry). + */ +struct archive; +struct archive_entry; + +/* + * File-type constants. These are returned from archive_entry_filetype() + * and passed to archive_entry_set_filetype(). + * + * These values match S_XXX defines on every platform I've checked, + * including Windows, AIX, Linux, Solaris, and BSD. They're + * (re)defined here because platforms generally don't define the ones + * they don't support. For example, Windows doesn't define S_IFLNK or + * S_IFBLK. Instead of having a mass of conditional logic and system + * checks to define any S_XXX values that aren't supported locally, + * I've just defined a new set of such constants so that + * libarchive-based applications can manipulate and identify archive + * entries properly even if the hosting platform can't store them on + * disk. + * + * These values are also used directly within some portable formats, + * such as cpio. If you find a platform that varies from these, the + * correct solution is to leave these alone and translate from these + * portable values to platform-native values when entries are read from + * or written to disk. + */ +/* + * In libarchive 4.0, we can drop the casts here. + * They're needed to work around Borland C's broken mode_t. + */ +#define AE_IFMT ((__LA_MODE_T)0170000) +#define AE_IFREG ((__LA_MODE_T)0100000) +#define AE_IFLNK ((__LA_MODE_T)0120000) +#define AE_IFSOCK ((__LA_MODE_T)0140000) +#define AE_IFCHR ((__LA_MODE_T)0020000) +#define AE_IFBLK ((__LA_MODE_T)0060000) +#define AE_IFDIR ((__LA_MODE_T)0040000) +#define AE_IFIFO ((__LA_MODE_T)0010000) + +/* + * Symlink types + */ +#define AE_SYMLINK_TYPE_UNDEFINED 0 +#define AE_SYMLINK_TYPE_FILE 1 +#define AE_SYMLINK_TYPE_DIRECTORY 2 + +/* + * Basic object manipulation + */ + +__LA_DECL struct archive_entry *archive_entry_clear(struct archive_entry *); +/* The 'clone' function does a deep copy; all of the strings are copied too. */ +__LA_DECL struct archive_entry *archive_entry_clone(struct archive_entry *); +__LA_DECL void archive_entry_free(struct archive_entry *); +__LA_DECL struct archive_entry *archive_entry_new(void); + +/* + * This form of archive_entry_new2() will pull character-set + * conversion information from the specified archive handle. The + * older archive_entry_new(void) form is equivalent to calling + * archive_entry_new2(NULL) and will result in the use of an internal + * default character-set conversion. + */ +__LA_DECL struct archive_entry *archive_entry_new2(struct archive *); + +/* + * Retrieve fields from an archive_entry. + * + * There are a number of implicit conversions among these fields. For + * example, if a regular string field is set and you read the _w wide + * character field, the entry will implicitly convert narrow-to-wide + * using the current locale. Similarly, dev values are automatically + * updated when you write devmajor or devminor and vice versa. + * + * In addition, fields can be "set" or "unset." Unset string fields + * return NULL, non-string fields have _is_set() functions to test + * whether they've been set. You can "unset" a string field by + * assigning NULL; non-string fields have _unset() functions to + * unset them. + * + * Note: There is one ambiguity in the above; string fields will + * also return NULL when implicit character set conversions fail. + * This is usually what you want. + */ +__LA_DECL time_t archive_entry_atime(struct archive_entry *); +__LA_DECL long archive_entry_atime_nsec(struct archive_entry *); +__LA_DECL int archive_entry_atime_is_set(struct archive_entry *); +__LA_DECL time_t archive_entry_birthtime(struct archive_entry *); +__LA_DECL long archive_entry_birthtime_nsec(struct archive_entry *); +__LA_DECL int archive_entry_birthtime_is_set(struct archive_entry *); +__LA_DECL time_t archive_entry_ctime(struct archive_entry *); +__LA_DECL long archive_entry_ctime_nsec(struct archive_entry *); +__LA_DECL int archive_entry_ctime_is_set(struct archive_entry *); +__LA_DECL dev_t archive_entry_dev(struct archive_entry *); +__LA_DECL int archive_entry_dev_is_set(struct archive_entry *); +__LA_DECL dev_t archive_entry_devmajor(struct archive_entry *); +__LA_DECL dev_t archive_entry_devminor(struct archive_entry *); +__LA_DECL __LA_MODE_T archive_entry_filetype(struct archive_entry *); +__LA_DECL int archive_entry_filetype_is_set(struct archive_entry *); +__LA_DECL void archive_entry_fflags(struct archive_entry *, + unsigned long * /* set */, + unsigned long * /* clear */); +__LA_DECL const char *archive_entry_fflags_text(struct archive_entry *); +__LA_DECL la_int64_t archive_entry_gid(struct archive_entry *); +__LA_DECL int archive_entry_gid_is_set(struct archive_entry *); +__LA_DECL const char *archive_entry_gname(struct archive_entry *); +__LA_DECL const char *archive_entry_gname_utf8(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_gname_w(struct archive_entry *); +__LA_DECL void archive_entry_set_link_to_hardlink(struct archive_entry *); +__LA_DECL const char *archive_entry_hardlink(struct archive_entry *); +__LA_DECL const char *archive_entry_hardlink_utf8(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_hardlink_w(struct archive_entry *); +__LA_DECL int archive_entry_hardlink_is_set(struct archive_entry *); +__LA_DECL la_int64_t archive_entry_ino(struct archive_entry *); +__LA_DECL la_int64_t archive_entry_ino64(struct archive_entry *); +__LA_DECL int archive_entry_ino_is_set(struct archive_entry *); +__LA_DECL __LA_MODE_T archive_entry_mode(struct archive_entry *); +__LA_DECL time_t archive_entry_mtime(struct archive_entry *); +__LA_DECL long archive_entry_mtime_nsec(struct archive_entry *); +__LA_DECL int archive_entry_mtime_is_set(struct archive_entry *); +__LA_DECL unsigned int archive_entry_nlink(struct archive_entry *); +__LA_DECL const char *archive_entry_pathname(struct archive_entry *); +__LA_DECL const char *archive_entry_pathname_utf8(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_pathname_w(struct archive_entry *); +__LA_DECL __LA_MODE_T archive_entry_perm(struct archive_entry *); +__LA_DECL int archive_entry_perm_is_set(struct archive_entry *); +__LA_DECL int archive_entry_rdev_is_set(struct archive_entry *); +__LA_DECL dev_t archive_entry_rdev(struct archive_entry *); +__LA_DECL dev_t archive_entry_rdevmajor(struct archive_entry *); +__LA_DECL dev_t archive_entry_rdevminor(struct archive_entry *); +__LA_DECL const char *archive_entry_sourcepath(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_sourcepath_w(struct archive_entry *); +__LA_DECL la_int64_t archive_entry_size(struct archive_entry *); +__LA_DECL int archive_entry_size_is_set(struct archive_entry *); +__LA_DECL const char *archive_entry_strmode(struct archive_entry *); +__LA_DECL void archive_entry_set_link_to_symlink(struct archive_entry *); +__LA_DECL const char *archive_entry_symlink(struct archive_entry *); +__LA_DECL const char *archive_entry_symlink_utf8(struct archive_entry *); +__LA_DECL int archive_entry_symlink_type(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_symlink_w(struct archive_entry *); +__LA_DECL la_int64_t archive_entry_uid(struct archive_entry *); +__LA_DECL int archive_entry_uid_is_set(struct archive_entry *); +__LA_DECL const char *archive_entry_uname(struct archive_entry *); +__LA_DECL const char *archive_entry_uname_utf8(struct archive_entry *); +__LA_DECL const wchar_t *archive_entry_uname_w(struct archive_entry *); +__LA_DECL int archive_entry_is_data_encrypted(struct archive_entry *); +__LA_DECL int archive_entry_is_metadata_encrypted(struct archive_entry *); +__LA_DECL int archive_entry_is_encrypted(struct archive_entry *); + +/* + * Set fields in an archive_entry. + * + * Note: Before libarchive 2.4, there were 'set' and 'copy' versions + * of the string setters. 'copy' copied the actual string, 'set' just + * stored the pointer. In libarchive 2.4 and later, strings are + * always copied. + */ + +__LA_DECL void archive_entry_set_atime(struct archive_entry *, time_t, long); +__LA_DECL void archive_entry_unset_atime(struct archive_entry *); +#if defined(_WIN32) && !defined(__CYGWIN__) +__LA_DECL void archive_entry_copy_bhfi(struct archive_entry *, BY_HANDLE_FILE_INFORMATION *); +#endif +__LA_DECL void archive_entry_set_birthtime(struct archive_entry *, time_t, long); +__LA_DECL void archive_entry_unset_birthtime(struct archive_entry *); +__LA_DECL void archive_entry_set_ctime(struct archive_entry *, time_t, long); +__LA_DECL void archive_entry_unset_ctime(struct archive_entry *); +__LA_DECL void archive_entry_set_dev(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_devmajor(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_devminor(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_filetype(struct archive_entry *, unsigned int); +__LA_DECL void archive_entry_set_fflags(struct archive_entry *, + unsigned long /* set */, unsigned long /* clear */); +/* Returns pointer to start of first invalid token, or NULL if none. */ +/* Note that all recognized tokens are processed, regardless. */ +__LA_DECL const char *archive_entry_copy_fflags_text(struct archive_entry *, + const char *); +__LA_DECL const char *archive_entry_copy_fflags_text_len(struct archive_entry *, + const char *, size_t); +__LA_DECL const wchar_t *archive_entry_copy_fflags_text_w(struct archive_entry *, + const wchar_t *); +__LA_DECL void archive_entry_set_gid(struct archive_entry *, la_int64_t); +__LA_DECL void archive_entry_set_gname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_gname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_gname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_gname_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_gname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_hardlink(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_hardlink_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_hardlink(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_hardlink_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_hardlink_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_ino(struct archive_entry *, la_int64_t); +__LA_DECL void archive_entry_set_ino64(struct archive_entry *, la_int64_t); +__LA_DECL void archive_entry_set_link(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_link_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_link(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_link_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_link_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_mode(struct archive_entry *, __LA_MODE_T); +__LA_DECL void archive_entry_set_mtime(struct archive_entry *, time_t, long); +__LA_DECL void archive_entry_unset_mtime(struct archive_entry *); +__LA_DECL void archive_entry_set_nlink(struct archive_entry *, unsigned int); +__LA_DECL void archive_entry_set_pathname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_pathname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_pathname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_pathname_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_pathname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_perm(struct archive_entry *, __LA_MODE_T); +__LA_DECL void archive_entry_set_rdev(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_rdevmajor(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_rdevminor(struct archive_entry *, dev_t); +__LA_DECL void archive_entry_set_size(struct archive_entry *, la_int64_t); +__LA_DECL void archive_entry_unset_size(struct archive_entry *); +__LA_DECL void archive_entry_copy_sourcepath(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_sourcepath_w(struct archive_entry *, const wchar_t *); +__LA_DECL void archive_entry_set_symlink(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_symlink_type(struct archive_entry *, int); +__LA_DECL void archive_entry_set_symlink_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_symlink(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_symlink_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_symlink_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_uid(struct archive_entry *, la_int64_t); +__LA_DECL void archive_entry_set_uname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_uname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_uname(struct archive_entry *, const char *); +__LA_DECL void archive_entry_copy_uname_w(struct archive_entry *, const wchar_t *); +__LA_DECL int archive_entry_update_uname_utf8(struct archive_entry *, const char *); +__LA_DECL void archive_entry_set_is_data_encrypted(struct archive_entry *, char is_encrypted); +__LA_DECL void archive_entry_set_is_metadata_encrypted(struct archive_entry *, char is_encrypted); +/* + * Routines to bulk copy fields to/from a platform-native "struct + * stat." Libarchive used to just store a struct stat inside of each + * archive_entry object, but this created issues when trying to + * manipulate archives on systems different than the ones they were + * created on. + * + * TODO: On Linux and other LFS systems, provide both stat32 and + * stat64 versions of these functions and all of the macro glue so + * that archive_entry_stat is magically defined to + * archive_entry_stat32 or archive_entry_stat64 as appropriate. + */ +__LA_DECL const struct stat *archive_entry_stat(struct archive_entry *); +__LA_DECL void archive_entry_copy_stat(struct archive_entry *, const struct stat *); + +/* + * Storage for Mac OS-specific AppleDouble metadata information. + * Apple-format tar files store a separate binary blob containing + * encoded metadata with ACL, extended attributes, etc. + * This provides a place to store that blob. + */ + +__LA_DECL const void * archive_entry_mac_metadata(struct archive_entry *, size_t *); +__LA_DECL void archive_entry_copy_mac_metadata(struct archive_entry *, const void *, size_t); + +/* + * Digest routine. This is used to query the raw hex digest for the + * given entry. The type of digest is provided as an argument. + */ +#define ARCHIVE_ENTRY_DIGEST_MD5 0x00000001 +#define ARCHIVE_ENTRY_DIGEST_RMD160 0x00000002 +#define ARCHIVE_ENTRY_DIGEST_SHA1 0x00000003 +#define ARCHIVE_ENTRY_DIGEST_SHA256 0x00000004 +#define ARCHIVE_ENTRY_DIGEST_SHA384 0x00000005 +#define ARCHIVE_ENTRY_DIGEST_SHA512 0x00000006 + +__LA_DECL const unsigned char * archive_entry_digest(struct archive_entry *, int /* type */); + +/* + * ACL routines. This used to simply store and return text-format ACL + * strings, but that proved insufficient for a number of reasons: + * = clients need control over uname/uid and gname/gid mappings + * = there are many different ACL text formats + * = would like to be able to read/convert archives containing ACLs + * on platforms that lack ACL libraries + * + * This last point, in particular, forces me to implement a reasonably + * complete set of ACL support routines. + */ + +/* + * Permission bits. + */ +#define ARCHIVE_ENTRY_ACL_EXECUTE 0x00000001 +#define ARCHIVE_ENTRY_ACL_WRITE 0x00000002 +#define ARCHIVE_ENTRY_ACL_READ 0x00000004 +#define ARCHIVE_ENTRY_ACL_READ_DATA 0x00000008 +#define ARCHIVE_ENTRY_ACL_LIST_DIRECTORY 0x00000008 +#define ARCHIVE_ENTRY_ACL_WRITE_DATA 0x00000010 +#define ARCHIVE_ENTRY_ACL_ADD_FILE 0x00000010 +#define ARCHIVE_ENTRY_ACL_APPEND_DATA 0x00000020 +#define ARCHIVE_ENTRY_ACL_ADD_SUBDIRECTORY 0x00000020 +#define ARCHIVE_ENTRY_ACL_READ_NAMED_ATTRS 0x00000040 +#define ARCHIVE_ENTRY_ACL_WRITE_NAMED_ATTRS 0x00000080 +#define ARCHIVE_ENTRY_ACL_DELETE_CHILD 0x00000100 +#define ARCHIVE_ENTRY_ACL_READ_ATTRIBUTES 0x00000200 +#define ARCHIVE_ENTRY_ACL_WRITE_ATTRIBUTES 0x00000400 +#define ARCHIVE_ENTRY_ACL_DELETE 0x00000800 +#define ARCHIVE_ENTRY_ACL_READ_ACL 0x00001000 +#define ARCHIVE_ENTRY_ACL_WRITE_ACL 0x00002000 +#define ARCHIVE_ENTRY_ACL_WRITE_OWNER 0x00004000 +#define ARCHIVE_ENTRY_ACL_SYNCHRONIZE 0x00008000 + +#define ARCHIVE_ENTRY_ACL_PERMS_POSIX1E \ + (ARCHIVE_ENTRY_ACL_EXECUTE \ + | ARCHIVE_ENTRY_ACL_WRITE \ + | ARCHIVE_ENTRY_ACL_READ) + +#define ARCHIVE_ENTRY_ACL_PERMS_NFS4 \ + (ARCHIVE_ENTRY_ACL_EXECUTE \ + | ARCHIVE_ENTRY_ACL_READ_DATA \ + | ARCHIVE_ENTRY_ACL_LIST_DIRECTORY \ + | ARCHIVE_ENTRY_ACL_WRITE_DATA \ + | ARCHIVE_ENTRY_ACL_ADD_FILE \ + | ARCHIVE_ENTRY_ACL_APPEND_DATA \ + | ARCHIVE_ENTRY_ACL_ADD_SUBDIRECTORY \ + | ARCHIVE_ENTRY_ACL_READ_NAMED_ATTRS \ + | ARCHIVE_ENTRY_ACL_WRITE_NAMED_ATTRS \ + | ARCHIVE_ENTRY_ACL_DELETE_CHILD \ + | ARCHIVE_ENTRY_ACL_READ_ATTRIBUTES \ + | ARCHIVE_ENTRY_ACL_WRITE_ATTRIBUTES \ + | ARCHIVE_ENTRY_ACL_DELETE \ + | ARCHIVE_ENTRY_ACL_READ_ACL \ + | ARCHIVE_ENTRY_ACL_WRITE_ACL \ + | ARCHIVE_ENTRY_ACL_WRITE_OWNER \ + | ARCHIVE_ENTRY_ACL_SYNCHRONIZE) + +/* + * Inheritance values (NFS4 ACLs only); included in permset. + */ +#define ARCHIVE_ENTRY_ACL_ENTRY_INHERITED 0x01000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_FILE_INHERIT 0x02000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_DIRECTORY_INHERIT 0x04000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_NO_PROPAGATE_INHERIT 0x08000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_INHERIT_ONLY 0x10000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_SUCCESSFUL_ACCESS 0x20000000 +#define ARCHIVE_ENTRY_ACL_ENTRY_FAILED_ACCESS 0x40000000 + +#define ARCHIVE_ENTRY_ACL_INHERITANCE_NFS4 \ + (ARCHIVE_ENTRY_ACL_ENTRY_FILE_INHERIT \ + | ARCHIVE_ENTRY_ACL_ENTRY_DIRECTORY_INHERIT \ + | ARCHIVE_ENTRY_ACL_ENTRY_NO_PROPAGATE_INHERIT \ + | ARCHIVE_ENTRY_ACL_ENTRY_INHERIT_ONLY \ + | ARCHIVE_ENTRY_ACL_ENTRY_SUCCESSFUL_ACCESS \ + | ARCHIVE_ENTRY_ACL_ENTRY_FAILED_ACCESS \ + | ARCHIVE_ENTRY_ACL_ENTRY_INHERITED) + +/* We need to be able to specify combinations of these. */ +#define ARCHIVE_ENTRY_ACL_TYPE_ACCESS 0x00000100 /* POSIX.1e only */ +#define ARCHIVE_ENTRY_ACL_TYPE_DEFAULT 0x00000200 /* POSIX.1e only */ +#define ARCHIVE_ENTRY_ACL_TYPE_ALLOW 0x00000400 /* NFS4 only */ +#define ARCHIVE_ENTRY_ACL_TYPE_DENY 0x00000800 /* NFS4 only */ +#define ARCHIVE_ENTRY_ACL_TYPE_AUDIT 0x00001000 /* NFS4 only */ +#define ARCHIVE_ENTRY_ACL_TYPE_ALARM 0x00002000 /* NFS4 only */ +#define ARCHIVE_ENTRY_ACL_TYPE_POSIX1E (ARCHIVE_ENTRY_ACL_TYPE_ACCESS \ + | ARCHIVE_ENTRY_ACL_TYPE_DEFAULT) +#define ARCHIVE_ENTRY_ACL_TYPE_NFS4 (ARCHIVE_ENTRY_ACL_TYPE_ALLOW \ + | ARCHIVE_ENTRY_ACL_TYPE_DENY \ + | ARCHIVE_ENTRY_ACL_TYPE_AUDIT \ + | ARCHIVE_ENTRY_ACL_TYPE_ALARM) + +/* Tag values mimic POSIX.1e */ +#define ARCHIVE_ENTRY_ACL_USER 10001 /* Specified user. */ +#define ARCHIVE_ENTRY_ACL_USER_OBJ 10002 /* User who owns the file. */ +#define ARCHIVE_ENTRY_ACL_GROUP 10003 /* Specified group. */ +#define ARCHIVE_ENTRY_ACL_GROUP_OBJ 10004 /* Group who owns the file. */ +#define ARCHIVE_ENTRY_ACL_MASK 10005 /* Modify group access (POSIX.1e only) */ +#define ARCHIVE_ENTRY_ACL_OTHER 10006 /* Public (POSIX.1e only) */ +#define ARCHIVE_ENTRY_ACL_EVERYONE 10107 /* Everyone (NFS4 only) */ + +/* + * Set the ACL by clearing it and adding entries one at a time. + * Unlike the POSIX.1e ACL routines, you must specify the type + * (access/default) for each entry. Internally, the ACL data is just + * a soup of entries. API calls here allow you to retrieve just the + * entries of interest. This design (which goes against the spirit of + * POSIX.1e) is useful for handling archive formats that combine + * default and access information in a single ACL list. + */ +__LA_DECL void archive_entry_acl_clear(struct archive_entry *); +__LA_DECL int archive_entry_acl_add_entry(struct archive_entry *, + int /* type */, int /* permset */, int /* tag */, + int /* qual */, const char * /* name */); +__LA_DECL int archive_entry_acl_add_entry_w(struct archive_entry *, + int /* type */, int /* permset */, int /* tag */, + int /* qual */, const wchar_t * /* name */); + +/* + * To retrieve the ACL, first "reset", then repeatedly ask for the + * "next" entry. The want_type parameter allows you to request only + * certain types of entries. + */ +__LA_DECL int archive_entry_acl_reset(struct archive_entry *, int /* want_type */); +__LA_DECL int archive_entry_acl_next(struct archive_entry *, int /* want_type */, + int * /* type */, int * /* permset */, int * /* tag */, + int * /* qual */, const char ** /* name */); + +/* + * Construct a text-format ACL. The flags argument is a bitmask that + * can include any of the following: + * + * Flags only for archive entries with POSIX.1e ACL: + * ARCHIVE_ENTRY_ACL_TYPE_ACCESS - Include POSIX.1e "access" entries. + * ARCHIVE_ENTRY_ACL_TYPE_DEFAULT - Include POSIX.1e "default" entries. + * ARCHIVE_ENTRY_ACL_STYLE_MARK_DEFAULT - Include "default:" before each + * default ACL entry. + * ARCHIVE_ENTRY_ACL_STYLE_SOLARIS - Output only one colon after "other" and + * "mask" entries. + * + * Flags only for archive entries with NFSv4 ACL: + * ARCHIVE_ENTRY_ACL_STYLE_COMPACT - Do not output the minus character for + * unset permissions and flags in NFSv4 ACL permission and flag fields + * + * Flags for for archive entries with POSIX.1e ACL or NFSv4 ACL: + * ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID - Include extra numeric ID field in + * each ACL entry. + * ARCHIVE_ENTRY_ACL_STYLE_SEPARATOR_COMMA - Separate entries with comma + * instead of newline. + */ +#define ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID 0x00000001 +#define ARCHIVE_ENTRY_ACL_STYLE_MARK_DEFAULT 0x00000002 +#define ARCHIVE_ENTRY_ACL_STYLE_SOLARIS 0x00000004 +#define ARCHIVE_ENTRY_ACL_STYLE_SEPARATOR_COMMA 0x00000008 +#define ARCHIVE_ENTRY_ACL_STYLE_COMPACT 0x00000010 + +__LA_DECL wchar_t *archive_entry_acl_to_text_w(struct archive_entry *, + la_ssize_t * /* len */, int /* flags */); +__LA_DECL char *archive_entry_acl_to_text(struct archive_entry *, + la_ssize_t * /* len */, int /* flags */); +__LA_DECL int archive_entry_acl_from_text_w(struct archive_entry *, + const wchar_t * /* wtext */, int /* type */); +__LA_DECL int archive_entry_acl_from_text(struct archive_entry *, + const char * /* text */, int /* type */); + +/* Deprecated constants */ +#define OLD_ARCHIVE_ENTRY_ACL_STYLE_EXTRA_ID 1024 +#define OLD_ARCHIVE_ENTRY_ACL_STYLE_MARK_DEFAULT 2048 + +/* Deprecated functions */ +__LA_DECL const wchar_t *archive_entry_acl_text_w(struct archive_entry *, + int /* flags */) __LA_DEPRECATED; +__LA_DECL const char *archive_entry_acl_text(struct archive_entry *, + int /* flags */) __LA_DEPRECATED; + +/* Return bitmask of ACL types in an archive entry */ +__LA_DECL int archive_entry_acl_types(struct archive_entry *); + +/* Return a count of entries matching 'want_type' */ +__LA_DECL int archive_entry_acl_count(struct archive_entry *, int /* want_type */); + +/* Return an opaque ACL object. */ +/* There's not yet anything clients can actually do with this... */ +struct archive_acl; +__LA_DECL struct archive_acl *archive_entry_acl(struct archive_entry *); + +/* + * extended attributes + */ + +__LA_DECL void archive_entry_xattr_clear(struct archive_entry *); +__LA_DECL void archive_entry_xattr_add_entry(struct archive_entry *, + const char * /* name */, const void * /* value */, + size_t /* size */); + +/* + * To retrieve the xattr list, first "reset", then repeatedly ask for the + * "next" entry. + */ + +__LA_DECL int archive_entry_xattr_count(struct archive_entry *); +__LA_DECL int archive_entry_xattr_reset(struct archive_entry *); +__LA_DECL int archive_entry_xattr_next(struct archive_entry *, + const char ** /* name */, const void ** /* value */, size_t *); + +/* + * sparse + */ + +__LA_DECL void archive_entry_sparse_clear(struct archive_entry *); +__LA_DECL void archive_entry_sparse_add_entry(struct archive_entry *, + la_int64_t /* offset */, la_int64_t /* length */); + +/* + * To retrieve the xattr list, first "reset", then repeatedly ask for the + * "next" entry. + */ + +__LA_DECL int archive_entry_sparse_count(struct archive_entry *); +__LA_DECL int archive_entry_sparse_reset(struct archive_entry *); +__LA_DECL int archive_entry_sparse_next(struct archive_entry *, + la_int64_t * /* offset */, la_int64_t * /* length */); + +/* + * Utility to match up hardlinks. + * + * The 'struct archive_entry_linkresolver' is a cache of archive entries + * for files with multiple links. Here's how to use it: + * 1. Create a lookup object with archive_entry_linkresolver_new() + * 2. Tell it the archive format you're using. + * 3. Hand each archive_entry to archive_entry_linkify(). + * That function will return 0, 1, or 2 entries that should + * be written. + * 4. Call archive_entry_linkify(resolver, NULL) until + * no more entries are returned. + * 5. Call archive_entry_linkresolver_free(resolver) to free resources. + * + * The entries returned have their hardlink and size fields updated + * appropriately. If an entry is passed in that does not refer to + * a file with multiple links, it is returned unchanged. The intention + * is that you should be able to simply filter all entries through + * this machine. + * + * To make things more efficient, be sure that each entry has a valid + * nlinks value. The hardlink cache uses this to track when all links + * have been found. If the nlinks value is zero, it will keep every + * name in the cache indefinitely, which can use a lot of memory. + * + * Note that archive_entry_size() is reset to zero if the file + * body should not be written to the archive. Pay attention! + */ +struct archive_entry_linkresolver; + +/* + * There are three different strategies for marking hardlinks. + * The descriptions below name them after the best-known + * formats that rely on each strategy: + * + * "Old cpio" is the simplest, it always returns any entry unmodified. + * As far as I know, only cpio formats use this. Old cpio archives + * store every link with the full body; the onus is on the dearchiver + * to detect and properly link the files as they are restored. + * "tar" is also pretty simple; it caches a copy the first time it sees + * any link. Subsequent appearances are modified to be hardlink + * references to the first one without any body. Used by all tar + * formats, although the newest tar formats permit the "old cpio" strategy + * as well. This strategy is very simple for the dearchiver, + * and reasonably straightforward for the archiver. + * "new cpio" is trickier. It stores the body only with the last + * occurrence. The complication is that we might not + * see every link to a particular file in a single session, so + * there's no easy way to know when we've seen the last occurrence. + * The solution here is to queue one link until we see the next. + * At the end of the session, you can enumerate any remaining + * entries by calling archive_entry_linkify(NULL) and store those + * bodies. If you have a file with three links l1, l2, and l3, + * you'll get the following behavior if you see all three links: + * linkify(l1) => NULL (the resolver stores l1 internally) + * linkify(l2) => l1 (resolver stores l2, you write l1) + * linkify(l3) => l2, l3 (all links seen, you can write both). + * If you only see l1 and l2, you'll get this behavior: + * linkify(l1) => NULL + * linkify(l2) => l1 + * linkify(NULL) => l2 (at end, you retrieve remaining links) + * As the name suggests, this strategy is used by newer cpio variants. + * It's noticeably more complex for the archiver, slightly more complex + * for the dearchiver than the tar strategy, but makes it straightforward + * to restore a file using any link by simply continuing to scan until + * you see a link that is stored with a body. In contrast, the tar + * strategy requires you to rescan the archive from the beginning to + * correctly extract an arbitrary link. + */ + +__LA_DECL struct archive_entry_linkresolver *archive_entry_linkresolver_new(void); +__LA_DECL void archive_entry_linkresolver_set_strategy( + struct archive_entry_linkresolver *, int /* format_code */); +__LA_DECL void archive_entry_linkresolver_free(struct archive_entry_linkresolver *); +__LA_DECL void archive_entry_linkify(struct archive_entry_linkresolver *, + struct archive_entry **, struct archive_entry **); +__LA_DECL struct archive_entry *archive_entry_partial_links( + struct archive_entry_linkresolver *res, unsigned int *links); +#ifdef __cplusplus +} +#endif + +/* This is meaningless outside of this header. */ +#undef __LA_DECL + +#endif /* !ARCHIVE_ENTRY_H_INCLUDED */ diff --git a/Sources/ContainerizationArchive/TempDir.swift b/Sources/ContainerizationArchive/TempDir.swift new file mode 100644 index 0000000..6b0f207 --- /dev/null +++ b/Sources/ContainerizationArchive/TempDir.swift @@ -0,0 +1,34 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import Foundation + +internal func createTemporaryDirectory(baseName: String) -> URL? { + let url = FileManager.default.uniqueTemporaryDirectory().appendingPathComponent( + "\(baseName).XXXXXX") + + var path = url.absoluteURL.path + return path.withUTF8 { utf8Bytes in + var mutablePath = Array(utf8Bytes) + [0] + return mutablePath.withUnsafeMutableBufferPointer { buffer -> URL? in + guard let baseAddress = buffer.baseAddress else { return nil } + mkdtemp(baseAddress) + let resultPath = String(decoding: buffer[..<(buffer.count - 1)], as: UTF8.self) + return URL(fileURLWithPath: resultPath, isDirectory: true) + } + } +} diff --git a/Sources/ContainerizationArchive/WriteEntry.swift b/Sources/ContainerizationArchive/WriteEntry.swift new file mode 100644 index 0000000..4330a04 --- /dev/null +++ b/Sources/ContainerizationArchive/WriteEntry.swift @@ -0,0 +1,318 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CArchive +import Foundation + +/// Represents a single entry (e.g., a file, directory, symbolic link) +/// that is to be read/written into an archive. +public final class WriteEntry { + let underlying: OpaquePointer + + public init(_ archive: ArchiveWriter) { + underlying = archive_entry_new2(archive.underlying) + } + + public init() { + underlying = archive_entry_new() + } + + deinit { + archive_entry_free(underlying) + } +} + +extension WriteEntry { + /// The size of the entry in bytes. + public var size: Int64? { + get { + guard archive_entry_size_is_set(underlying) != 0 else { return nil } + return archive_entry_size(underlying) + } + set { + if let s = newValue { + archive_entry_set_size(underlying, s) + } else { + archive_entry_unset_size(underlying) + } + } + } + + /// The mode of the entry. + public var permissions: mode_t { + get { + archive_entry_perm(underlying) + } + set { + archive_entry_set_perm(underlying, newValue) + } + } + + /// The owner id of the entry. + public var owner: uid_t? { + get { + uid_t(exactly: archive_entry_uid(underlying)) + } + set { + archive_entry_set_uid(underlying, Int64(newValue ?? 0)) + } + } + + /// The group id of the entry + public var group: gid_t? { + get { + gid_t(exactly: archive_entry_gid(underlying)) + } + set { + archive_entry_set_gid(underlying, Int64(newValue ?? 0)) + } + } + + /// The path of file this entry hardlinks to + public var hardlink: String? { + get { + guard let cstr = archive_entry_hardlink(underlying) else { + return nil + } + return String(cString: cstr) + } + set { + guard let newValue else { + archive_entry_set_hardlink(underlying, nil) + return + } + newValue.withCString { + archive_entry_set_hardlink(underlying, $0) + } + } + } + + /// The UTF-8 encoded path of file this entry hardlinks to + public var hardlinkUtf8: String? { + get { + guard let cstr = archive_entry_hardlink_utf8(underlying) else { + return nil + } + return String(cString: cstr, encoding: .utf8) + } + set { + guard let newValue else { + archive_entry_set_hardlink_utf8(underlying, nil) + return + } + newValue.withCString { + archive_entry_set_hardlink_utf8(underlying, $0) + } + } + } + + /// The string representation of the permissions of the entry + public var strmode: String? { + if let cstr = archive_entry_strmode(underlying) { + return String(cString: cstr) + } + return nil + } + + /// The type of file this entry represents. + public var fileType: URLFileResourceType { + get { + switch archive_entry_filetype(underlying) { + case S_IFIFO: return .namedPipe + case S_IFCHR: return .characterSpecial + case S_IFDIR: return .directory + case S_IFBLK: return .blockSpecial + case S_IFREG: return .regular + case S_IFLNK: return .symbolicLink + case S_IFSOCK: return .socket + default: return .unknown + } + } + set { + switch newValue { + case .namedPipe: archive_entry_set_filetype(underlying, UInt32(S_IFIFO as mode_t)) + case .characterSpecial: archive_entry_set_filetype(underlying, UInt32(S_IFCHR as mode_t)) + case .directory: archive_entry_set_filetype(underlying, UInt32(S_IFDIR as mode_t)) + case .blockSpecial: archive_entry_set_filetype(underlying, UInt32(S_IFBLK as mode_t)) + case .regular: archive_entry_set_filetype(underlying, UInt32(S_IFREG as mode_t)) + case .symbolicLink: archive_entry_set_filetype(underlying, UInt32(S_IFLNK as mode_t)) + case .socket: archive_entry_set_filetype(underlying, UInt32(S_IFSOCK as mode_t)) + default: archive_entry_set_filetype(underlying, 0) + } + } + } + + /// The date that the entry was last accessed + public var contentAccessDate: Date? { + get { + Date( + underlying, + archive_entry_atime_is_set, + archive_entry_atime, + archive_entry_atime_nsec) + } + set { + setDate( + newValue, + underlying, archive_entry_set_atime, + archive_entry_unset_atime) + } + } + + /// The date that the entry was created + public var creationDate: Date? { + get { + Date( + underlying, + archive_entry_ctime_is_set, + archive_entry_ctime, + archive_entry_ctime_nsec) + } + set { + setDate( + newValue, + underlying, archive_entry_set_ctime, + archive_entry_unset_ctime) + } + } + + /// The date that the entry was modified + public var modificationDate: Date? { + get { + Date( + underlying, + archive_entry_mtime_is_set, + archive_entry_mtime, + archive_entry_mtime_nsec) + } + set { + setDate( + newValue, + underlying, archive_entry_set_mtime, + archive_entry_unset_mtime) + } + } + + /// The file path of the entry + public var path: String? { + get { + guard let pathname = archive_entry_pathname(underlying) else { + return nil + } + return String(cString: pathname) + } + set { + guard let newValue else { + archive_entry_set_pathname(underlying, nil) + return + } + newValue.withCString { + archive_entry_set_pathname(underlying, $0) + } + } + } + + /// The UTF-8 encoded file path of the entry + public var pathUtf8: String? { + get { + guard let pathname = archive_entry_pathname_utf8(underlying) else { + return nil + } + return String(cString: pathname) + } + set { + guard let newValue else { + archive_entry_set_pathname_utf8(underlying, nil) + return + } + newValue.withCString { + archive_entry_set_pathname_utf8(underlying, $0) + } + } + } + + /// The symlink target that the entry points to + public var symlinkTarget: String? { + get { + guard let target = archive_entry_symlink(underlying) else { + return nil + } + return String(cString: target) + } + set { + guard let newValue else { + archive_entry_set_symlink(underlying, nil) + return + } + newValue.withCString { + archive_entry_set_symlink(underlying, $0) + } + } + } + + /// The extended attributes of the entry + public var xattrs: [String: Data] { + get { + archive_entry_xattr_reset(self.underlying) + var attrs: [String: Data] = [:] + var namePtr: UnsafePointer? + var valuePtr: UnsafeRawPointer? + var size: Int = 0 + while archive_entry_xattr_next(self.underlying, &namePtr, &valuePtr, &size) == 0 { + let _name = namePtr.map { String(cString: $0) } + let _value = valuePtr.map { Data(bytes: $0, count: size) } + guard let name = _name, let value = _value else { + continue + } + attrs[name] = value + } + return attrs + } + set { + archive_entry_xattr_clear(self.underlying) + for (key, value) in newValue { + value.withUnsafeBytes { ptr in + archive_entry_xattr_add_entry(self.underlying, key, ptr.baseAddress, [UInt8](value).count) + } + } + } + } + + fileprivate func setDate( + _ date: Date?, _ underlying: OpaquePointer, _ setter: (OpaquePointer, time_t, CLong) -> Void, + _ unset: (OpaquePointer) -> Void + ) { + if let d = date { + let ti = d.timeIntervalSince1970 + let seconds = floor(ti) + let nsec = max(0, min(1_000_000_000, ti - seconds * 1_000_000_000)) + setter(underlying, time_t(seconds), CLong(nsec)) + } else { + unset(underlying) + } + } +} + +extension Date { + init?( + _ underlying: OpaquePointer, _ isSet: (OpaquePointer) -> CInt, _ seconds: (OpaquePointer) -> time_t, + _ nsec: (OpaquePointer) -> CLong + ) { + guard isSet(underlying) != 0 else { return nil } + let ti = TimeInterval(seconds(underlying)) + TimeInterval(nsec(underlying)) * 0.000_000_001 + self.init(timeIntervalSince1970: ti) + } +} diff --git a/Sources/ContainerizationEXT4/Documentation.docc/ext4.md b/Sources/ContainerizationEXT4/Documentation.docc/ext4.md new file mode 100644 index 0000000..8962833 --- /dev/null +++ b/Sources/ContainerizationEXT4/Documentation.docc/ext4.md @@ -0,0 +1,4 @@ +# ``ContainerizationEXT4`` + +`ContainerizationEXT4` provides functionality to read the superblock of an existing ext4 block device and format a new block device with +the ext4 file system. diff --git a/Sources/ContainerizationEXT4/EXT4+Extensions.swift b/Sources/ContainerizationEXT4/EXT4+Extensions.swift new file mode 100644 index 0000000..6442423 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Extensions.swift @@ -0,0 +1,97 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension EXT4.InodeFlag { + public static func | (lhs: Self, rhs: Self) -> Self { + Self(rawValue: lhs.rawValue | rhs.rawValue) + } + + public static func | (lhs: Self, rhs: Self) -> UInt32 { + lhs.rawValue | rhs.rawValue + } + + public static func | (lhs: Self, rhs: UInt32) -> UInt32 { + lhs.rawValue | rhs + } +} + +extension EXT4.CompatFeature { + public static func | (lhs: Self, rhs: Self) -> Self { + EXT4.CompatFeature(rawValue: lhs.rawValue | rhs.rawValue) + } + + public static func | (lhs: Self, rhs: Self) -> UInt32 { + lhs.rawValue | rhs.rawValue + } +} + +extension EXT4.IncompatFeature { + public static func | (lhs: Self, rhs: Self) -> Self { + EXT4.IncompatFeature(rawValue: lhs.rawValue | rhs.rawValue) + } + + public static func | (lhs: Self, rhs: Self) -> UInt32 { + lhs.rawValue | rhs.rawValue + } +} + +extension EXT4.RoCompatFeature { + public static func | (lhs: Self, rhs: Self) -> Self { + EXT4.RoCompatFeature(rawValue: lhs.rawValue | rhs.rawValue) + } + + public static func | (lhs: Self, rhs: Self) -> UInt32 { + lhs.rawValue | rhs.rawValue + } +} + +extension EXT4.FileModeFlag { + public static func | (lhs: Self, rhs: Self) -> Self { + Self(rawValue: lhs.rawValue | rhs.rawValue) + } + + public static func | (lhs: Self, rhs: Self) -> UInt16 { + lhs.rawValue | rhs.rawValue + } +} + +extension EXT4.XAttrEntry { + init(using bytes: [UInt8]) throws { + guard bytes.count == 16 else { + throw EXT4.Error.invalidXattrEntry + } + nameLength = bytes[0] + nameIndex = bytes[1] + let rawValue = Array(bytes[2...3]) + valueOffset = rawValue.withUnsafeBytes { $0.loadLittleEndian(as: UInt16.self) } + + let rawValueInum = Array(bytes[4...7]) + valueInum = rawValueInum.withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + + let rawSize = Array(bytes[8...11]) + valueSize = rawSize.withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + + let rawHash = Array(bytes[12...]) + hash = rawHash.withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + } +} + +extension EXT4 { + static func tupleToArray(_ tuple: T) -> [UInt8] { + let reflection = Mirror(reflecting: tuple) + return reflection.children.compactMap { $0.value as? UInt8 } + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+FileTree.swift b/Sources/ContainerizationEXT4/EXT4+FileTree.swift new file mode 100644 index 0000000..db69c99 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+FileTree.swift @@ -0,0 +1,101 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +extension EXT4 { + class FileTree { + class FileTreeNode { + let inode: InodeNumber + let name: String + var children: [Ptr] = [] + var blocks: (start: UInt32, end: UInt32)? + var additionalBlocks: [(start: UInt32, end: UInt32)]? + var link: InodeNumber? + private weak var parent: Ptr? + + init( + inode: InodeNumber, + name: String, + parent: Ptr?, + children: [Ptr] = [], + blocks: (start: UInt32, end: UInt32)? = nil, + additionalBlocks: [(start: UInt32, end: UInt32)]? = nil, + link: InodeNumber? = nil + ) { + self.inode = inode + self.name = name + self.children = children + self.blocks = blocks + self.additionalBlocks = additionalBlocks + self.link = link + self.parent = parent + } + + deinit { + self.children.removeAll() + self.children = [] + self.blocks = nil + self.additionalBlocks = nil + self.link = nil + } + + var path: FilePath? { + var components: [String] = [self.name] + var _ptr = self.parent + while let ptr = _ptr { + components.append(ptr.pointee.name) + _ptr = ptr.pointee.parent + } + let path = components.reversed().joined(separator: "/") + return FilePath(path).lexicallyNormalized() + } + } + + var root: Ptr + + init(_ root: InodeNumber, _ name: String) { + self.root = Ptr(FileTreeNode(inode: root, name: name, parent: nil)) + } + + func lookup(path: FilePath) -> Ptr? { + var components: [String] = path.items + var node = self.root + if components.first == "/" { + components = Array(components.dropFirst()) + } + if components.count == 0 { + return node + } + for component in components { + var found = false + for childPtr in node.pointee.children { + let child = childPtr.pointee + if child.name == component { + node = childPtr + found = true + break + } + } + guard found else { + return nil + } + } + return node + } + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+Formatter.swift b/Sources/ContainerizationEXT4/EXT4+Formatter.swift new file mode 100644 index 0000000..5f7ff44 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Formatter.swift @@ -0,0 +1,1414 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint: disable discouraged_direct_init shorthand_operator syntactic_sugar + +import ContainerizationArchive +import ContainerizationOS +import Foundation +import SystemPackage + +extension EXT4 { + /// The `EXT4.Formatter` class provides methods to format a block device with the ext4 filesystem. + /// It allows customization of block size and maximum disk size. + public class Formatter { + private let logBlockSize: UInt32 + var blockSize: UInt32 { 1024 << logBlockSize } + private var size: UInt64 + private let groupDescriptorSize: UInt32 = 32 + + private var blocksPerGroup: UInt32 { + blockSize * 8 + } + + private var maxInodesPerGroup: UInt32 { + blockSize * 8 // limited by inode bitmap + } + + private var groupsPerDescriptorBlock: UInt32 { + blockSize / groupDescriptorSize + } + + // internally accessed by journal setup + var blockCount: UInt32 { + ((size - 1) / blockSize) + 1 + } + + private var groupCount: UInt32 { + (blockCount - 1) / blocksPerGroup + 1 + } + + private var groupDescriptorBlocks: UInt32 { + ((groupCount - 1) / groupsPerDescriptorBlock + 1) * 32 + } + + /// Initializes an ext4 filesystem formatter. + /// + /// This constructor creates an instance of the ext4 formatter designed to format a block device + /// with the ext4 filesystem. The formatter takes the path to the destination block device and + /// the desired block size of the filesystem as parameters. + /// + /// - Parameters: + /// - devicePath: The path to the block device where the ext4 filesystem will be created. + /// - blockSize: The filesystem block size in bytes. Must be a power of two in the set + /// {1024, 2048, 4096}. Defaults to 4096. + /// - minDiskSize: The minimum usable capacity for the filesystem. When a journal is + /// configured, the actual image size will be larger than this value by the journal size. + /// - journal: The JBD2 journal size and mode, or nil for an unjournalled filesystem. + /// + /// - Note: This ext4 formatter is designed for creating block devices out of container images and does not support all the + /// features and options available in the full ext4 filesystem implementation. It focuses + /// on the core functionality required for formatting a block device with ext4. + /// + /// - Important: Ensure that the destination block device is accessible and has sufficient permissions + /// for formatting. The formatting process will erase all existing data on the device. + public init(_ devicePath: FilePath, blockSize: UInt32 = 4096, minDiskSize: UInt64 = 256.kib(), journal: JournalConfig? = nil) throws { + /// The constructor performs the following steps: + /// + /// 1. Creates the first 10 inodes: + /// - Inode 2 is reserved for the root directory ('/'). + /// - Inodes 1 and 3-10 are reserved for other special purposes. + /// + /// 2. Marks inode 11 as the first inode available for consumption by files, directories, sockets, + /// FIFOs, etc. + /// + /// 3. Initializes a directory tree with the root directory pointing to inode 2. + /// + /// 4. Moves the file descriptor to the start of the block where file metadata and data can be + /// written, which is located past the filesystem superblocks and group descriptor blocks. + /// + /// 5. Creates a "/lost+found" directory to satisfy the requirements of e2fsck (ext2/3/4 filesystem + /// checker). + + guard blockSize >= 1024 && blockSize <= 4096 && blockSize.nonzeroBitCount == 1 else { + throw Error.invalidBlockSize(blockSize) + } + guard minDiskSize / UInt64(blockSize) <= UInt64(UInt32.max) else { + throw Error.cannotResizeFS(minDiskSize) + } + self.logBlockSize = UInt32(blockSize.trailingZeroBitCount) - 10 + if !FileManager.default.fileExists(atPath: devicePath.description) { + _ = FileManager.default.createFile(atPath: devicePath.description, contents: nil) + } + guard let fileHandle = FileHandle(forWritingTo: devicePath) else { + throw Error.notFound(devicePath) + } + self.handle = fileHandle + self.size = minDiskSize + // make this a 0 byte file + guard ftruncate(self.handle.fileDescriptor, 0) == 0 else { + throw Error.cannotTruncateFile(devicePath) + } + // make it a sparse file + guard lseek(self.handle.fileDescriptor, off_t(self.size - 1), 0) == self.size - 1 else { + throw Error.cannotCreateSparseFile(devicePath) + } + let zero: [UInt8] = [0] + try self.handle.write(contentsOf: zero) + // step #1 + self.inodes = [ + Ptr(Inode()), // defective block inode + Ptr(Inode.Root()), + ] + // reserved inodes + for _ in 2.., entry: Ptr)] = pathNode.children.map { (pathPtr, $0) } + var head: Int = 0 + while head < queue.count { + let currNode = queue[head].entry + for childPtr in currNode.pointee.children { + queue.append((currNode, childPtr)) + } + head += 1 + } + + for (parent, entry) in queue.reversed() { + try _unlink(parentNodePtr: parent, pathNodePtr: entry) + } + + guard !directoryWhiteout else { + return + } + + try _unlink(parentNodePtr: parentPtr, pathNodePtr: pathPtr) + } + + private func _unlink(parentNodePtr: Ptr, pathNodePtr: Ptr) throws { + let pathNode = pathNodePtr.pointee + let pathComponent = pathNode.name + let inodeNumber = Int(pathNode.inode) - 1 + let pathInodePtr = self.inodes[inodeNumber] + var pathInode = pathInodePtr.pointee + + let parentNode = parentNodePtr.pointee + let parentInodePtr = self.inodes[Int(parentNode.inode) - 1] + var parentInode = parentInodePtr.pointee + if pathInode.mode.isDir() { + if parentInode.linksCount > 2 { + parentInode.linksCount -= 1 + } + } + parentInodePtr.pointee = parentInode + parentNode.children.removeAll { childPtr in + childPtr.pointee.name == pathComponent + } + parentNodePtr.pointee = parentNode + + if let hardlink = pathNode.link { + // the file we are deleting is a hardlink, decrement the link count + let linkedInodePtr = self.inodes[Int(hardlink - 1)] + var linkedInode = linkedInodePtr.pointee + if linkedInode.linksCount > 1 { + linkedInode.linksCount -= 1 + linkedInodePtr.pointee = linkedInode + } + } + + guard inodeNumber >= FirstInode else { + // Free the inodes and the blocks related to the inode only if its valid + return + } + if let blocks = pathNode.blocks { + if !(blocks.start == blocks.end) { + self.deletedBlocks.append((start: blocks.start, end: blocks.end)) + } + } + for block in pathNode.additionalBlocks ?? [] { + self.deletedBlocks.append((start: block.start, end: block.end)) + } + let now = Date().fs() + pathInode = Inode() + pathInode.dtime = now.lo + pathInodePtr.pointee = pathInode + } + + // Creates a file, directory, or symlink at the specified path, recursively creating parent directories if they don't already exist. + // + // - Parameters: + // - path: The FilePath representing the path where the file, directory, or symlink should be created. + // - link: An optional FilePath representing the target path for a symlink. If `nil`, a regular file or directory will be created. Preceding '/' should be omitted + // - mode: The permissions to set for the created file, directory, or symlink. + // - buf: A `ReadableStream` object providing the contents for the created file. Ignored when creating directories or symlinks. + // + // - Note: + // - This function recursively creates parent directories if they don't already exist. The `uid` and `gid` of the created parent directories are set to the values of their parent's `uid` and `gid`. + // - It is expected that the user sets the permissions explicitly later + // - This function only supports creating files, directories, and symlinks. Attempting to create other types of file system objects will result in an error. + // - In case of symlinks, the preceding '/' should be omitted + // + // - Example usage: + // ```swift + // let formatter = EXT4.Formatter(devicePath: "ext4.img") + // // create a directory + // try formatter.create(path: FilePath("/dir"), + // mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) + // + // // create a file + // let inputStream = InputStream(data: "data".data(using: .utf8)!) + // inputStream.open() + // try formatter.create(path: FilePath("/dir/file"), + // mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: inputStream) + // inputStream.close() + // + // // create a symlink + // try formatter.create(path: FilePath("/symlink"), link: "/dir/file", + // mode: EXT4.Inode.Mode(.S_IFLNK, 0o700)) + // ``` + public func create( + path: FilePath, + link: FilePath? = nil, // to create symbolic links + mode: UInt16, + ts: FileTimestamps = FileTimestamps(), + buf: (any ReadableStream)? = nil, + uid: UInt32? = nil, + gid: UInt32? = nil, + xattrs: [String: Data]? = nil, + recursion: Bool = false, + fileBuffer: UnsafeMutableBufferPointer? = nil + ) throws { + if let nodePtr = self.tree.lookup(path: path) { + let node = nodePtr.pointee + let inodePtr = self.inodes[Int(node.inode) - 1] + let inode = inodePtr.pointee + // Allowed replace + // ----------------------------- + // + // Original Type File Directory Symlink + // ---------------------------------------------- + // File | ✔ | ✘ | ✔ + // Directory | ✘ | ✔ | ✔ + // Symlink | ✔ | ✘ | ✔ + if mode.isDir() { + if !inode.mode.isDir() { + guard inode.mode.isLink() else { + throw Error.notDirectory(path) + } + } + // mkdir -p + if path.base == node.name { + guard !recursion else { + return + } + // create a new tree node to replace this one + var inode = inode + inode.mode = mode + if let uid { + inode.uid = uid.lo + inode.uidHigh = uid.hi + } + if let gid { + inode.gid = gid.lo + inode.gidHigh = gid.hi + } + inodePtr.pointee = inode + return + } + } else if let _ = node.link { // ok to overwrite links + try self.unlink(path: path) + } else { // file can only be overwritten by another file + if inode.mode.isDir() { + guard mode.isLink() else { // unless it is a link, then it can be replaced by a dir + throw Error.notFile(path) + } + // root cannot be replaced with a link + if path.isRoot { + throw Error.unsupportedFiletype + } + } + try self.unlink(path: path) + } + } + // create all predecessors recursively + let parentPath: FilePath = path.dir + try self.create(path: parentPath, mode: Inode.Mode(.S_IFDIR, 0o755), recursion: true) + guard let parentTreeNodePtr = self.tree.lookup(path: parentPath) else { + throw Error.notFound(parentPath) + } + let parentTreeNode = parentTreeNodePtr.pointee + let parentInodePtr = self.inodes[Int(parentTreeNode.inode) - 1] + var parentInode = parentInodePtr.pointee + guard parentInode.linksCount < EXT4.MaxLinks else { + throw Error.maximumLinksExceeded(parentPath) + } + + let childInodePtr = Ptr(Inode()) + var childInode = Inode() + var startBlock: UInt32 = 0 + var endBlock: UInt32 = 0 + defer { // update metadata + childInodePtr.pointee = childInode + parentInodePtr.pointee = parentInode + self.inodes.append(childInodePtr) + let childTreeNodePtr = Ptr( + FileTree.FileTreeNode( + inode: InodeNumber(self.inodes.count), + name: path.base, + parent: parentTreeNodePtr, + children: [], + blocks: (startBlock, endBlock) + )) + parentTreeNode.children.append(childTreeNodePtr) + parentTreeNodePtr.pointee = parentTreeNode + } + childInode.mode = mode + // uid,gid + if let uid { + childInode.uid = UInt16(uid & 0xffff) + childInode.uidHigh = UInt16((uid >> 16) & 0xffff) + } else { + childInode.uid = parentInode.uid + childInode.uidHigh = parentInode.uidHigh + } + if let gid { + childInode.gid = UInt16(gid & 0xffff) + childInode.gidHigh = UInt16((gid >> 16) & 0xffff) + } else { + childInode.gid = parentInode.gid + childInode.gidHigh = parentInode.gidHigh + } + if let xattrs, !xattrs.isEmpty { + var state = FileXattrsState( + inode: UInt32(self.inodes.count), inodeXattrCapacity: EXT4.InodeExtraSize, blockCapacity: blockSize) + try state.add(ExtendedAttribute(name: "system.data", value: [])) + for (s, d) in xattrs { + let attribute = ExtendedAttribute(name: s, value: [UInt8](d)) + try state.add(attribute) + } + if !state.inlineAttributes.isEmpty { + var buffer: [UInt8] = .init(repeating: 0, count: Int(EXT4.InodeExtraSize)) + try state.writeInlineAttributes(buffer: &buffer) + childInode.inlineXattrs = ( + buffer[0], buffer[1], buffer[2], buffer[3], buffer[4], buffer[5], buffer[6], buffer[7], + buffer[8], + buffer[9], + buffer[10], buffer[11], buffer[12], buffer[13], buffer[14], buffer[15], buffer[16], buffer[17], + buffer[18], + buffer[19], + buffer[20], buffer[21], buffer[22], buffer[23], buffer[24], buffer[25], buffer[26], buffer[27], + buffer[28], + buffer[29], + buffer[30], buffer[31], buffer[32], buffer[33], buffer[34], buffer[35], buffer[36], buffer[37], + buffer[38], + buffer[39], + buffer[40], buffer[41], buffer[42], buffer[43], buffer[44], buffer[45], buffer[46], buffer[47], + buffer[48], + buffer[49], + buffer[50], buffer[51], buffer[52], buffer[53], buffer[54], buffer[55], buffer[56], buffer[57], + buffer[58], + buffer[59], + buffer[60], buffer[61], buffer[62], buffer[63], buffer[64], buffer[65], buffer[66], buffer[67], + buffer[68], + buffer[69], + buffer[70], buffer[71], buffer[72], buffer[73], buffer[74], buffer[75], buffer[76], buffer[77], + buffer[78], + buffer[79], + buffer[80], buffer[81], buffer[82], buffer[83], buffer[84], buffer[85], buffer[86], buffer[87], + buffer[88], + buffer[89], + buffer[90], buffer[91], buffer[92], buffer[93], buffer[94], buffer[95] + ) + } + if !state.blockAttributes.isEmpty { + var buffer: [UInt8] = .init(repeating: 0, count: Int(blockSize)) + try state.writeBlockAttributes(buffer: &buffer) + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + childInode.xattrBlockLow = self.currentBlock + try self.handle.write(contentsOf: buffer) + childInode.blocksLow += 1 + } + } + + childInode.atime = ts.accessLo + childInode.atimeExtra = ts.accessHi + // ctime is the last time the inode was changed which is now + childInode.ctime = ts.nowLo + childInode.ctimeExtra = ts.nowHi + childInode.mtime = ts.modificationLo + childInode.mtimeExtra = ts.modificationHi + childInode.crtime = ts.creationLo + childInode.crtimeExtra = ts.creationHi + childInode.linksCount = 1 + childInode.extraIsize = UInt16(EXT4.ExtraIsize) + // flags + childInode.flags = InodeFlag.hugeFile.rawValue + // size check + var size: UInt64 = 0 + // align with block boundary + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + // dir + if childInode.mode.isDir() { + childInode.linksCount += 1 + parentInode.linksCount += 1 + // to pass e2fsck, the convention is to sort children + // before committing to disk. Therefore, we are deferring + // writing dentries until commit() is called + return + } + // symbolic link + if let link { + startBlock = self.currentBlock + let linkPath = link.bytes + if linkPath.count < 60 { + size += UInt64(linkPath.count) + var blockData: [UInt8] = .init(repeating: 0, count: 60) + for i in 0.. + let bufferSize: Int + let shouldDeallocate: Bool + if let fileBuffer { + tempBuf = fileBuffer.baseAddress! + bufferSize = fileBuffer.count + shouldDeallocate = false + } else { + tempBuf = UnsafeMutablePointer.allocate(capacity: Int(self.blockSize)) + bufferSize = Int(self.blockSize) + shouldDeallocate = true + } + defer { + if shouldDeallocate { + tempBuf.deallocate() + } + } + while case let block = buf.read(tempBuf, maxLength: bufferSize), block > 0 { + size += UInt64(block) + if size > EXT4.MaxFileSize { + throw Error.fileTooBig(size) + } + let data = UnsafeRawBufferPointer(start: tempBuf, count: block) + try withUnsafeLittleEndianBuffer(of: data) { b in + try self.handle.write(contentsOf: b) + } + } + } + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + endBlock = self.currentBlock + childInode.sizeLow = size.lo + childInode.sizeHigh = size.hi + childInode = try self.writeExtents(childInode, (startBlock, endBlock)) + return + } + // FIFO, Socket and other types are not handled + throw Error.unsupportedFiletype + } + + // Completes the formatting of an ext4 filesystem after writing the necessary structures. + // + // This function is responsible for finalizing the formatting process of an ext4 filesystem + // after the following structures have been written: + // - JBD2 journal (inode 8): Written first when a journal config is provided. Includes the + // JBD2 superblock and zeroed journal data blocks. self.size is expanded by the journal + // size so that minDiskSize represents usable capacity rather than total image size. + // - Inode table: Contains information about each file and directory in the filesystem. + // - Block bitmap: Tracks the allocation status of each block in the filesystem. + // - Inode bitmap: Tracks the allocation status of each inode in the filesystem. + // - Directory tree: Represents the hierarchical structure of directories and files. + // - Group descriptors: Stores metadata about each block group in the filesystem. + // - Superblock: Contains essential information about the filesystem's configuration. + // + // The function performs any necessary final steps to ensure the integrity and consistency + // of the ext4 filesystem before it can be mounted and used. + public func close() throws { + var breadthWiseChildTree: [(parent: Ptr?, child: Ptr)] = [ + (nil, self.tree.root) + ] + while !breadthWiseChildTree.isEmpty { + let (parent, child) = breadthWiseChildTree.removeFirst() + try self.commit(parent, child) // commit directories iteratively + if child.pointee.link != nil { + continue + } + breadthWiseChildTree.append(contentsOf: child.pointee.children.map { (child, $0) }) + } + + // Generate UUID once; shared by filesystem superblock and JBD2 superblock. + let filesystemUUID = UUID().uuid + + // Journal init MUST precede optimizeBlockGroupLayout() and commitInodeTable(). + // Reason 1: optimizeBlockGroupLayout reads self.currentBlock — journal blocks + // must already be written to be counted in the layout calculation. + // Reason 2: commitInodeTable writes inode 8 to disk — setupJournalInode must + // have updated self.inodes[7] in memory first. + var journalByteCount: UInt64 = 0 + if let config = journalConfig { + // initializeJournal returns the number of blocks written for the journal. + // journalByteCount is fed into the newSize floor below so that minDiskSize + // represents usable capacity: the journal is additive overhead on top of + // the content area. self.size is left unmodified here so the existing + // lseek + write file-extension path handles the physical resize. + let journalBlocks = try initializeJournal(config: config, filesystemUUID: filesystemUUID) + journalByteCount = UInt64(journalBlocks) * self.blockSize + } + + let blockGroupSize = optimizeBlockGroupLayout(blocks: self.currentBlock, inodes: UInt32(self.inodes.count)) + let inodeTableOffset = try self.commitInodeTable( + blockGroups: blockGroupSize.blockGroups, + inodesPerGroup: blockGroupSize.inodesPerGroup + ) + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + // write bitmaps and group descriptors + + let bitmapOffset = self.currentBlock + let bitmapBlocks: UInt32 = blockGroupSize.blockGroups * 2 // each group has two bitmaps - for inodes, and for blocks + let dataBlocks: UInt32 = bitmapOffset + bitmapBlocks // last data block + var diskBlocks = dataBlocks + var contentRequiredBlocks = (blockGroupSize.blockGroups - 1) * self.blocksPerGroup + 1 + if blockGroupSize.blockGroups == 1 { + contentRequiredBlocks = self.blocksPerGroup // at least 1 block group + } + if diskBlocks < contentRequiredBlocks { // for data + metadata + diskBlocks = contentRequiredBlocks + } + let contentRequiredSize = UInt64(contentRequiredBlocks) * self.blockSize + // minDiskSize is usable capacity; the journal is additive on top. + var newSize = self.size + journalByteCount + if newSize < contentRequiredSize { + newSize = contentRequiredSize + } + // number of blocks needed for group descriptors + let groupDescriptorBlockCount: UInt32 = (blockGroupSize.blockGroups - 1) / self.groupsPerDescriptorBlock + 1 + guard groupDescriptorBlockCount <= self.groupDescriptorBlocks else { + throw Error.insufficientSpaceForGroupDescriptorBlocks + } + + var totalBlocks: UInt32 = 0 + var totalInodes: UInt32 = 0 + let inodeTableSizePerGroup: UInt32 = blockGroupSize.inodesPerGroup * EXT4.InodeSize / self.blockSize + var groupDescriptors: [GroupDescriptor] = [] + + let minGroups = (((self.pos / UInt64(self.blockSize)) - 1) / UInt64(self.blocksPerGroup)) + 1 + if newSize < minGroups * blocksPerGroup * blockSize { + newSize = UInt64(minGroups * blocksPerGroup * blockSize) + } + let totalGroups = (((newSize / UInt64(self.blockSize)) - 1) / UInt64(self.blocksPerGroup)) + 1 + + // If the provided disk size is not aligned to a blockgroup boundary, it needs to + // be expanded to the next blockgroup boundary. + // Example: + // Provided disk size: 2 GB + 100MB: 2148 MB + // BlockSize: 4096 + // Blockgroup size: 32768 blocks: 128MB + // Number of blocks: 549888 + // Number of blockgroups = 549888 / 32768 = 16.78125 + // Aligned disk size = 557056 blocks = 17 blockgroups: 2176 MB + if newSize < totalGroups * blocksPerGroup * blockSize { + newSize = UInt64(totalGroups * blocksPerGroup * blockSize) + } + // Snapshot groupDescriptorBlocks before self.size potentially changes: the bitmap + // loop uses this to identify which GDT slots were physically reserved at init time, + // so it can mark any unused slots as free without accidentally freeing content blocks + // written starting at reservedDescriptorBlocks + 1. + let reservedDescriptorBlocks = self.groupDescriptorBlocks + if self.size < newSize { + guard newSize / UInt64(self.blockSize) <= UInt64(UInt32.max) else { + throw Error.cannotResizeFS(newSize) + } + self.size = newSize + let pos = self.pos + guard lseek(self.handle.fileDescriptor, off_t(self.size - 1), 0) == self.size - 1 else { + throw Error.cannotResizeFS(self.size) + } + let zero: [UInt8] = [0] + try self.handle.write(contentsOf: zero) + try self.handle.seek(toOffset: pos) + } + for group in 0..> (j % 8)) & 1) + bitmap[Int(j / 8)] &= ~(1 << (j % 8)) + } + } + + // inodes bitmap goes into second bitmap block + for i in 0.. self.inodes.count { + continue + } + let inode = self.inodes[Int(ino) - 1] + if ino > 10 && inode.pointee.linksCount == 0 { // deleted files + continue + } + bitmap[Int(self.blockSize) + Int(i / 8)] |= 1 << (i % 8) + inodes += 1 + if inode.pointee.mode.isDir() { + dirs += 1 + } + } + + for i in (blockGroupSize.inodesPerGroup / 8)...init(repeating: 0, count: 1024)) + + let computedInodes = totalGroups * blockGroupSize.inodesPerGroup + var blocksCount = totalGroups * self.blocksPerGroup + while blocksCount < totalBlocks { + blocksCount = UInt64(totalBlocks) + } + let totalFreeBlocks: UInt64 + if totalBlocks > blocksCount { + totalFreeBlocks = 0 + } else { + totalFreeBlocks = blocksCount - totalBlocks + } + var superblock = SuperBlock() + superblock.inodesCount = computedInodes.lo + superblock.blocksCountLow = blocksCount.lo + superblock.blocksCountHigh = blocksCount.hi + superblock.freeBlocksCountLow = totalFreeBlocks.lo + superblock.freeBlocksCountHigh = totalFreeBlocks.hi + let freeInodesCount = computedInodes.lo - totalInodes + superblock.freeInodesCount = freeInodesCount + superblock.firstDataBlock = 0 + superblock.logBlockSize = logBlockSize + superblock.logClusterSize = logBlockSize + superblock.blocksPerGroup = self.blocksPerGroup + superblock.clustersPerGroup = self.blocksPerGroup + superblock.inodesPerGroup = blockGroupSize.inodesPerGroup + superblock.magic = EXT4.SuperBlockMagic + superblock.state = 1 // cleanly unmounted + superblock.errors = 1 // continue on error + superblock.creatorOS = 3 // freeBSD + superblock.revisionLevel = 1 // dynamic inode sizes + superblock.firstInode = EXT4.FirstInode + superblock.lpfInode = EXT4.LostAndFoundInode + superblock.inodeSize = UInt16(EXT4.InodeSize) + superblock.featureIncompat = + IncompatFeature.filetype | IncompatFeature.extents | IncompatFeature.flexBg + superblock.featureRoCompat = + RoCompatFeature.largeFile | RoCompatFeature.hugeFile | RoCompatFeature.extraIsize + superblock.minExtraIsize = EXT4.ExtraIsize + superblock.wantExtraIsize = EXT4.ExtraIsize + superblock.logGroupsPerFlex = 31 + superblock.uuid = filesystemUUID + var compatFeatures: UInt32 = CompatFeature.sparseSuper2 | CompatFeature.extAttr + if let config = journalConfig { + compatFeatures |= CompatFeature.hasJournal.rawValue + superblock.journalInum = EXT4.JournalInode + superblock.journalUUID = filesystemUUID + superblock.journalBlocks = journalInodeBlockBackup() + superblock.journalBackupType = 1 // s_jnl_backup_type: 1 = s_jnl_blocks[] holds a valid inode backup + if let mode = config.defaultMode { + switch mode { + case .writeback: superblock.defaultMountOpts = DefaultMountOpts.journalWriteback + case .ordered: superblock.defaultMountOpts = DefaultMountOpts.journalOrdered + case .journal: superblock.defaultMountOpts = DefaultMountOpts.journalData + } + } + } + superblock.featureCompat = compatFeatures + + // Fields intentionally left at zero: + // s_r_blocks_count_lo: no blocks reserved for root + // s_mtime / s_wtime: never mounted/written; kernel updates on first access + // s_mnt_count / s_max_mnt_count: no forced-fsck-after-N-mounts policy + // s_lastcheck / s_checkinterval: no time-based fsck scheduling + // s_def_resuid / s_def_resgid: reserved blocks owned by uid/gid 0 (root) + // s_block_group_nr: this superblock resides in group 0 + // s_volume_name: no volume label + // s_last_mounted: no recorded prior mount path + // s_algorithm_usage_bitmap: obsolete compression field, not used + // s_prealloc_blocks / s_prealloc_dir_blocks: block preallocation not enabled + // s_reserved_gdt_blocks: online resize not supported + // s_journal_dev: journal is internal (inode 8), not on an external device + // s_last_orphan: fresh filesystem, no pending orphan cleanup + // s_hash_seed / s_def_hash_version: kernel initialises htree hash seed at first mount + // s_first_meta_bg: meta block group feature not enabled + // s_mkfs_time: creation timestamp not recorded + // s_raid_stride / s_mmp_interval / s_mmp_block / s_raid_stripe_width: no RAID or MMP + // s_checksum_type / s_checksum_seed: metadata checksums not enabled (no csum feature bit) + // s_snapshot_*: snapshot feature not enabled + // s_error_count / s_first_error_* / s_last_error_*: fresh filesystem, no recorded errors + // s_usr_quota_inum / s_grp_quota_inum / s_prj_quota_inum: quotas not enabled + // s_overhead_clusters: kernel computes dynamically; zero is always safe + // s_backup_bgs: sparse_super2 active but no secondary backup groups requested + // s_encrypt_algos / s_encrypt_pw_salt: encryption not enabled + // s_checksum: superblock checksum not enabled (no metadata_csum feature bit) + + try withUnsafeLittleEndianBytes(of: superblock) { bytes in + try self.handle.write(contentsOf: bytes) + } + try self.handle.write(contentsOf: Array.init(repeating: 0, count: 2048)) + } + + // MARK: Private and internal methods and properties + private var tree: FileTree + private var deletedBlocks: [(start: UInt32, end: UInt32)] = [] + + // internally accessed by journal setup + var handle: FileHandle + var inodes: [Ptr] + let journalConfig: JournalConfig? + + var pos: UInt64 { + guard let offset = try? self.handle.offset() else { + return 0 + } + return offset + } + + var currentBlock: UInt32 { + self.pos / self.blockSize + } + + func seek(block: UInt32) throws { + try self.handle.seek(toOffset: UInt64(block) * blockSize) + } + + private func commitInodeTable(blockGroups: UInt32, inodesPerGroup: UInt32) throws -> UInt64 { + // inodeTable must go into a new block + if self.pos % blockSize != 0 { + try seek(block: currentBlock + 1) + } + let inodeTableOffset = UInt64(currentBlock) + + let inodeSize = MemoryLayout.size + // Write InodeTable + for inode in self.inodes { + try withUnsafeLittleEndianBytes(of: inode.pointee) { bytes in + try handle.write(contentsOf: bytes) + } + try self.handle.write( + contentsOf: Array.init(repeating: 0, count: Int(EXT4.InodeSize) - inodeSize)) + } + let tableSize: UInt64 = UInt64(EXT4.InodeSize) * blockGroups * inodesPerGroup + let rest = tableSize - UInt64(self.inodes.count) * EXT4.InodeSize + let zeroBlock = Array.init(repeating: 0, count: Int(self.blockSize)) + for _ in 0..<(rest / self.blockSize) { + try self.handle.write(contentsOf: zeroBlock) + } + try self.handle.write(contentsOf: Array.init(repeating: 0, count: Int(rest % self.blockSize))) + return inodeTableOffset + } + + // optimizes the distribution of blockGroups to obtain the lowest number of blockGroups needed to + // represent all the inodes and all the blocks in the FS + private func optimizeBlockGroupLayout(blocks: UInt32, inodes: UInt32) -> ( + blockGroups: UInt32, inodesPerGroup: UInt32 + ) { + // counts the number of blockGroups given a particular inodesPerGroup size + let groupCount: (_ blocks: UInt32, _ inodes: UInt32, _ inodesPerGroup: UInt32) -> UInt32 = { + blocks, inodes, inodesPerGroup in + let inodeBlocksPerGroup: UInt32 = inodesPerGroup * EXT4.InodeSize / self.blockSize + let dataBlocksPerGroup: UInt32 = self.blocksPerGroup - inodeBlocksPerGroup - 2 // save room for the bitmaps + // Increase the block count to ensure there are enough groups for all the inodes. + let minBlocks: UInt32 = (inodes - 1) / inodesPerGroup * dataBlocksPerGroup + 1 + var updatedBlocks = blocks + if blocks < minBlocks { + updatedBlocks = minBlocks + } + return (updatedBlocks + dataBlocksPerGroup - 1) / dataBlocksPerGroup + } + + var groups: UInt32 = UInt32.max + var inodesPerGroup: UInt32 = 0 + let inc = Int(self.blockSize * 512) / Int(EXT4.InodeSize) // inodesPerGroup + // minimizes the number of blockGroups needed to its lowest value + for ipg in stride(from: inc, through: Int(self.maxInodesPerGroup), by: inc) { + let g = groupCount(blocks, inodes, UInt32(ipg)) + if g < groups { + groups = g + inodesPerGroup = UInt32(ipg) + } + } + return (groups, inodesPerGroup) + } + + private func commit(_ parentPtr: Ptr?, _ nodePtr: Ptr) throws { + let node = nodePtr.pointee + let inodePtr = self.inodes[Int(node.inode) - 1] + var inode = inodePtr.pointee + guard inode.linksCount > 0 else { + return + } + if node.link != nil { + return + } + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + if inode.mode.isDir() { + let startBlock = self.currentBlock + var left: Int = Int(self.blockSize) + try writeDirEntry(name: ".", inode: node.inode, left: &left) + if let parent = parentPtr { + try writeDirEntry(name: "..", inode: parent.pointee.inode, left: &left) + } else { + try writeDirEntry(name: "..", inode: node.inode, left: &left) + } + var sortedChildren = Array(node.children) + sortedChildren.sort { left, right in + left.pointee.inode < right.pointee.inode + } + for childPtr in sortedChildren { + let child = childPtr.pointee + try writeDirEntry(name: child.name, inode: child.inode, left: &left, link: child.link) + } + try finishDirEntryBlock(&left) + let endBlock = self.currentBlock + let size: UInt64 = UInt64(endBlock - startBlock) * self.blockSize + inode.sizeLow = size.lo + inode.sizeHigh = size.hi + inodePtr.pointee = inode + node.blocks = (startBlock, endBlock) + nodePtr.pointee = node + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + inode = try self.writeExtents(inode, (startBlock, endBlock)) + inodePtr.pointee = inode + } + } + + private func fillExtents( + node: inout ExtentLeafNode, numExtents: UInt32, numBlocks: UInt32, start: UInt32, offset: UInt32 + ) { + for i in 0.. EXT4.MaxBlocksPerExtent { + length = EXT4.MaxBlocksPerExtent + } + let extentStart: UInt32 = start + extentBlock + let extent = ExtentLeaf( + block: extentBlock, + length: UInt16(length), + startHigh: 0, + startLow: extentStart + ) + node.leaves.append(extent) + } + } + + func writeExtents(_ inode: Inode, _ blocks: (start: UInt32, end: UInt32)) throws -> Inode { + var inode = inode + // rest of code assumes that extents MUST go into a new block + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + let dataBlocks = blocks.end - blocks.start + let numExtents = (dataBlocks + EXT4.MaxBlocksPerExtent - 1) / EXT4.MaxBlocksPerExtent + var usedBlocks = dataBlocks + let extentNodeSize = 12 + let extentsPerBlock = self.blockSize / extentNodeSize - 1 + var blockData: [UInt8] = .init(repeating: 0, count: 60) + var blockIndex: Int = 0 + switch numExtents { + case 0: + return inode // noop + case 1..<5: + let extentHeader = ExtentHeader( + magic: EXT4.ExtentHeaderMagic, + entries: UInt16(numExtents), + max: 4, + depth: 0, + generation: 0) + + var node = ExtentLeafNode(header: extentHeader, leaves: []) + fillExtents(node: &node, numExtents: numExtents, numBlocks: dataBlocks, start: blocks.start, offset: 0) + withUnsafeLittleEndianBytes(of: node.header) { bytes in + for b in bytes { + blockData[blockIndex] = b + blockIndex = blockIndex + 1 + } + } + for leaf in node.leaves { + withUnsafeLittleEndianBytes(of: leaf) { bytes in + for b in bytes { + blockData[blockIndex] = b + blockIndex = blockIndex + 1 + } + } + } + case 5..<4 * UInt32(extentsPerBlock) + 1: + let extentBlocks = (numExtents + extentsPerBlock - 1) / extentsPerBlock + usedBlocks += extentBlocks + let extentHeader = ExtentHeader( + magic: EXT4.ExtentHeaderMagic, + entries: UInt16(extentBlocks), + max: 4, + depth: 1, + generation: 0 + ) + var root = ExtentIndexNode(header: extentHeader, indices: []) + for i in 0.. extentsPerBlock { + extentsInBlock = extentsPerBlock + } + let leafHeader = ExtentHeader( + magic: EXT4.ExtentHeaderMagic, + entries: UInt16(extentsInBlock), + max: UInt16(extentsPerBlock), + depth: 0, + generation: 0 + ) + var leafNode = ExtentLeafNode(header: leafHeader, leaves: []) + let offset = i * extentsPerBlock * EXT4.MaxBlocksPerExtent + fillExtents( + node: &leafNode, numExtents: extentsInBlock, numBlocks: dataBlocks, + start: blocks.start, + offset: offset) + try withUnsafeLittleEndianBytes(of: leafNode.header) { bytes in + try self.handle.write(contentsOf: bytes) + } + for leaf in leafNode.leaves { + try withUnsafeLittleEndianBytes(of: leaf) { bytes in + try self.handle.write(contentsOf: bytes) + } + } + let extentTail = ExtentTail(checksum: leafNode.leaves.last!.block) + try withUnsafeLittleEndianBytes(of: extentTail) { bytes in + try self.handle.write(contentsOf: bytes) + } + root.indices.append(extentIdx) + } + withUnsafeLittleEndianBytes(of: root.header) { bytes in + for b in bytes { + blockData[blockIndex] = b + blockIndex = blockIndex + 1 + } + } + for leaf in root.indices { + withUnsafeLittleEndianBytes(of: leaf) { bytes in + for b in bytes { + blockData[blockIndex] = b + blockIndex = blockIndex + 1 + } + } + } + default: + throw Error.fileTooBig(UInt64(dataBlocks) * self.blockSize) + } + inode.block = ( + blockData[0], blockData[1], blockData[2], blockData[3], blockData[4], blockData[5], blockData[6], + blockData[7], + blockData[8], blockData[9], + blockData[10], blockData[11], blockData[12], blockData[13], blockData[14], blockData[15], blockData[16], + blockData[17], blockData[18], blockData[19], + blockData[20], blockData[21], blockData[22], blockData[23], blockData[24], blockData[25], blockData[26], + blockData[27], blockData[28], blockData[29], + blockData[30], blockData[31], blockData[32], blockData[33], blockData[34], blockData[35], blockData[36], + blockData[37], blockData[38], blockData[39], + blockData[40], blockData[41], blockData[42], blockData[43], blockData[44], blockData[45], blockData[46], + blockData[47], blockData[48], blockData[49], + blockData[50], blockData[51], blockData[52], blockData[53], blockData[54], blockData[55], blockData[56], + blockData[57], blockData[58], blockData[59] + ) + // ensure that inode's block count includes extent blocks + inode.blocksLow += usedBlocks + inode.flags = InodeFlag.extents | inode.flags + return inode + } + + // writes a single directory entry + private func writeDirEntry(name: String, inode: InodeNumber, left: inout Int, link: InodeNumber? = nil) throws { + guard self.inodes[Int(inode) - 1].pointee.linksCount > 0 else { + return + } + guard let nameData = name.data(using: .utf8) else { + throw Error.invalidName(name) + } + let directoryEntrySize = MemoryLayout.size + let rlb = directoryEntrySize + nameData.count + let rl = (rlb + 3) & ~3 + if left < rl + 12 { + try self.finishDirEntryBlock(&left) + } + var mode = self.inodes[Int(inode) - 1].pointee.mode + var inodeNum = inode + if let link { + mode = self.inodes[Int(link) - 1].pointee.mode | 0o777 + inodeNum = link + } + let entry = DirectoryEntry( + inode: inodeNum, + recordLength: UInt16(rl), + nameLength: UInt8(nameData.count), + fileType: mode.fileType() + ) + try withUnsafeLittleEndianBytes(of: entry) { bytes in + try self.handle.write(contentsOf: bytes) + } + + try nameData.withUnsafeBytes { buffer in + try withUnsafeLittleEndianBuffer(of: buffer) { b in + try self.handle.write(contentsOf: b) + } + } + try self.handle.write(contentsOf: [UInt8](repeating: 0, count: rl - rlb)) + left = left - rl + } + + private func finishDirEntryBlock(_ left: inout Int) throws { + defer { left = Int(self.blockSize) } + if left <= 0 { + return + } + let entry = DirectoryEntry( + inode: InodeNumber(0), + recordLength: UInt16(left), + nameLength: 0, + fileType: 0 + ) + try withUnsafeLittleEndianBytes(of: entry) { bytes in + try self.handle.write(contentsOf: bytes) + } + left = left - MemoryLayout.size + if left < 4 { + throw Error.noSpaceForTrailingDEntry + } + try self.handle.write(contentsOf: [UInt8](repeating: 0, count: Int(left))) + } + + public enum Error: Swift.Error, CustomStringConvertible, Sendable, Equatable { + case notDirectory(_ path: FilePath) + case notFile(_ path: FilePath) + case notFound(_ path: FilePath) + case alreadyExists(_ path: FilePath) + case unsupportedFiletype + case maximumLinksExceeded(_ path: FilePath) + case fileTooBig(_ size: UInt64) + case invalidLink(_ path: FilePath) + case invalidName(_ name: String) + case noSpaceForTrailingDEntry + case insufficientSpaceForGroupDescriptorBlocks + case cannotCreateHardlinksToDirTarget(_ path: FilePath) + case cannotTruncateFile(_ path: FilePath) + case cannotCreateSparseFile(_ path: FilePath) + case cannotResizeFS(_ size: UInt64) + case invalidBlockSize(_ size: UInt32) + case journalTooSmall(_ size: UInt64) + public var description: String { + switch self { + case .notDirectory(let path): + return "\(path) is not a directory" + case .notFile(let path): + return "\(path) is not a file" + case .notFound(let path): + return "\(path) not found" + case .alreadyExists(let path): + return "\(path) already exists" + case .unsupportedFiletype: + return "file type not supported" + case .maximumLinksExceeded(let path): + return "maximum links exceeded for path: \(path)" + case .fileTooBig(let size): + return "\(size) exceeds max file size (128 GiB)" + case .invalidLink(let path): + return "'\(path)' is an invalid link" + case .invalidName(let name): + return "'\(name)' is an invalid name" + case .noSpaceForTrailingDEntry: + return "not enough space for trailing dentry" + case .insufficientSpaceForGroupDescriptorBlocks: + return "not enough space for group descriptor blocks" + case .cannotCreateHardlinksToDirTarget(let path): + return "cannot create hard links to directory target: \(path)" + case .cannotTruncateFile(let path): + return "cannot truncate file: \(path)" + case .cannotCreateSparseFile(let path): + return "cannot create sparse file at \(path)" + case .cannotResizeFS(let size): + return "cannot set filesystem size to \(size) bytes" + case .invalidBlockSize(let size): + return "invalid block size \(size): must be 1024, 2048, or 4096" + case .journalTooSmall(let size): + return "requested journal size \(size) bytes is too small; minimum is \(EXT4.MinJournalBlocks) blocks (JBD2_MIN_JOURNAL_BLOCKS)" + } + } + } + + deinit { + self.inodes.removeAll() + } + } +} + +extension Date { + func fs() -> UInt64 { + if self == Date.distantPast { + return 0 + } + + let s = self.timeIntervalSince1970 + + if s < -0x8000_0000 { + return 0x8000_0000 + } + + if s > 0x3_7fff_ffff { + return 0x3_7fff_ffff + } + + // 32 bits - base: seconds since January 1, 1970, signed (negative for pre-1970 dates) + // 2 bits - epoch: overflow counter (0-3), how many times the 32-bit seconds field has wrapped + // 30 bits - nanoseconds (0-999,999,999) + let sInt64 = Int64(floor(s)) + let base = Int32(truncatingIfNeeded: sInt64) + let epoch = UInt64(sInt64 - Int64(base)) + let nanoseconds = min(UInt32((s - floor(s)) * 1_000_000_000), 999_999_999) + return UInt64(UInt32(bitPattern: base)) | epoch | (UInt64(nanoseconds) << 34) + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+Journal.swift b/Sources/ContainerizationEXT4/EXT4+Journal.swift new file mode 100644 index 0000000..5e3511f --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Journal.swift @@ -0,0 +1,197 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOS +import Foundation + +// JBD2 on-disk format reference: +// https://www.kernel.org/doc/html/latest/filesystems/ext4/journal.html + +extension EXT4.Formatter { + /// Entry point called from close() when journaling is enabled. + func initializeJournal( + config: EXT4.JournalConfig, + filesystemUUID: ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) + ) throws -> UInt32 { + let journalBlocks = try calculateJournalSize(requestedSize: config.size, usableBlocks: blockCount) + // Align to block boundary before recording start. + if self.pos % self.blockSize != 0 { + try self.seek(block: self.currentBlock + 1) + } + let journalStartBlock = self.currentBlock + try writeJournalSuperblock(journalBlocks: journalBlocks, filesystemUUID: filesystemUUID) + try zeroJournalBlocks(count: journalBlocks - 1) + try setupJournalInode(startBlock: journalStartBlock, blockCount: journalBlocks) + return journalBlocks + } + + // MARK: - Private helpers + + private func calculateJournalSize(requestedSize: UInt64?, usableBlocks: UInt32) throws -> UInt32 { + if let size = requestedSize { + let blocks = size / UInt64(self.blockSize) + // JBD2_MIN_JOURNAL_BLOCKS: the kernel refuses to mount with fewer. + // blocks == 0 would also cause a UInt32 underflow in the caller. + guard blocks >= EXT4.MinJournalBlocks else { + throw EXT4.Formatter.Error.journalTooSmall(size) + } + // Safe: any journal large enough to overflow UInt32 (>16 TiB at 4 KiB block size) + // would fail at the I/O layer before this conversion is reached. + return UInt32(blocks) + } + // Default sizing: scale with the usable content area, with a floor determined by + // JBD2_MIN_JOURNAL_BLOCKS and a ceiling that follows e2fsprogs convention: 128 MiB for + // filesystems up to 128 GiB, and 1 GiB for larger filesystems. The larger ceiling was + // introduced in e2fsprogs 1.43.2: + // https://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.43.2 + let usableBytes = UInt64(usableBlocks) * UInt64(self.blockSize) + let scaledBytes = usableBytes / 64 // 1/64th of the usable area, matching e2fsprogs defaults + let minBytes: UInt64 = UInt64(EXT4.MinJournalBlocks) * UInt64(self.blockSize) + let maxBytes: UInt64 = usableBytes > 128.gib() ? 1.gib() : 128.mib() + let clampedBytes = min(max(scaledBytes, minBytes), maxBytes) + // Safe: clampedBytes ≤ 1 GiB and blockSize ≥ 1, so the quotient fits in UInt32. + return UInt32(clampedBytes / UInt64(self.blockSize)) + } + + private func writeJournalSuperblock( + journalBlocks: UInt32, + filesystemUUID: ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) + ) throws { + // Safe: blockSize is UInt32; widening to Int (64-bit on all supported platforms) never truncates. + var buf = [UInt8](repeating: 0, count: Int(self.blockSize)) + + // JBD2 is a big-endian format regardless of host byte order (§3.6.1). + func writeU32BigEndian(_ value: UInt32, at offset: Int) { + buf[offset] = UInt8((value >> 24) & 0xFF) + buf[offset + 1] = UInt8((value >> 16) & 0xFF) + buf[offset + 2] = UInt8((value >> 8) & 0xFF) + buf[offset + 3] = UInt8(value & 0xFF) + } + + // JBD2 block header (§3.6.3): https://www.kernel.org/doc/html/latest/filesystems/ext4/journal.html#block-header + writeU32BigEndian(EXT4.JournalMagic, at: 0x00) // h_magic + writeU32BigEndian(4, at: 0x04) // h_blocktype = superblock v2 + writeU32BigEndian(1, at: 0x08) // h_sequence + + // JBD2 superblock body (§3.6.4): https://www.kernel.org/doc/html/latest/filesystems/ext4/journal.html#super-block + writeU32BigEndian(self.blockSize, at: 0x0C) // s_blocksize + writeU32BigEndian(journalBlocks, at: 0x10) // s_maxlen + writeU32BigEndian(1, at: 0x14) // s_first (first usable block) + writeU32BigEndian(1, at: 0x18) // s_sequence + // 0x1C s_start: left zero — kernel treats zero as "journal empty, begin at s_first" + // 0x20 s_errno: left zero — no prior abort error + // 0x24 s_feature_compat: left zero — no optional features (e.g. data-block checksums) + // 0x28 s_feature_incompat: left zero — non-zero unrecognised flags would cause mount refusal + // 0x2C s_feature_ro_compat: left zero — no flags defined by the spec + + // s_uuid at 0x30 (16 bytes) + let uuidBytes = [ + filesystemUUID.0, filesystemUUID.1, filesystemUUID.2, filesystemUUID.3, + filesystemUUID.4, filesystemUUID.5, filesystemUUID.6, filesystemUUID.7, + filesystemUUID.8, filesystemUUID.9, filesystemUUID.10, filesystemUUID.11, + filesystemUUID.12, filesystemUUID.13, filesystemUUID.14, filesystemUUID.15, + ] + buf[0x30..<0x40] = uuidBytes[...] + + writeU32BigEndian(1, at: 0x40) // s_nr_users + + let maxTrans = min(journalBlocks / 4, 32768) + writeU32BigEndian(maxTrans, at: 0x48) // s_max_transaction + writeU32BigEndian(maxTrans, at: 0x4C) // s_max_trans_data + + // s_users[0] at 0x100 (first entry of 768-byte users array) + buf[0x100..<0x110] = uuidBytes[...] + + try self.handle.write(contentsOf: buf) + } + + private func zeroJournalBlocks(count: UInt32) throws { + guard count > 0 else { return } + let chunkSize = 1.mib() + // Safe: both operands are UInt32, so their product peaks at ~17 TiB, which fits + // in Int64 (the width of Int on all 64-bit Apple platforms). + let totalBytes = Int(count) * Int(self.blockSize) + let zeroBuf = [UInt8](repeating: 0, count: min(Int(chunkSize), totalBytes)) + var remaining = totalBytes + while remaining > 0 { + let toWrite = min(zeroBuf.count, remaining) + try self.handle.write(contentsOf: zeroBuf[0.. ( + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32 + ) { + let ji = self.inodes[Int(EXT4.JournalInode) - 1].pointee + // s_jnl_blocks layout (§4.1.2): first 15 words = i_block[] extent-tree data, + // 16th word (index 15) = i_size_high, 17th word (index 16) = i_size. + var words = [UInt32](repeating: 0, count: 17) + withUnsafeBytes(of: ji.block) { bytes in + for i in 0..<15 { + words[i] = bytes.load(fromByteOffset: i * 4, as: UInt32.self) + } + } + words[15] = ji.sizeHigh // i_size_high (16th element per spec) + words[16] = ji.sizeLow // i_size (17th element per spec) + return ( + words[0], words[1], words[2], words[3], + words[4], words[5], words[6], words[7], + words[8], words[9], words[10], words[11], + words[12], words[13], words[14], words[15], + words[16] + ) + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+Ptr.swift b/Sources/ContainerizationEXT4/EXT4+Ptr.swift new file mode 100644 index 0000000..bcac4e1 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Ptr.swift @@ -0,0 +1,36 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension EXT4 { + class Ptr { + let underlying: UnsafeMutablePointer + + var pointee: T { + get { underlying.pointee } + set { underlying.pointee = newValue } + } + + init(_ value: T) { + self.underlying = .allocate(capacity: 1) + self.underlying.initialize(to: value) + } + + deinit { + underlying.deinitialize(count: 1) + underlying.deallocate() + } + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+Reader.swift b/Sources/ContainerizationEXT4/EXT4+Reader.swift new file mode 100644 index 0000000..640b16f --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Reader.swift @@ -0,0 +1,277 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +extension EXT4 { + /// The `EXT4Reader` opens a block device, parses the superblock, and loads group descriptors & inodes. + public class EXT4Reader { + public var superBlock: EXT4.SuperBlock { + self._superBlock + } + + let handle: FileHandle + let _superBlock: EXT4.SuperBlock + + private var groupDescriptors: [UInt32: EXT4.GroupDescriptor] = [:] + private var inodes: [InodeNumber: EXT4.Inode] = [:] + + var hardlinks: [FilePath: InodeNumber] = [:] + var tree: EXT4.FileTree = EXT4.FileTree(EXT4.RootInode, ".") + var blockSize: UInt64 { UInt64(_superBlock.blockSize) } + + private var groupDescriptorSize: UInt16 { + if _superBlock.featureIncompat & EXT4.IncompatFeature.bit64.rawValue != 0 { + return _superBlock.descSize + } + return UInt16(MemoryLayout.size) + } + + public init(blockDevice: FilePath) throws { + guard FileManager.default.fileExists(atPath: blockDevice.description) else { + throw EXT4.Error.notFound(blockDevice.description) + } + + guard let fileHandle = FileHandle(forReadingAtPath: blockDevice) else { + throw Error.notFound(blockDevice.description) + } + self.handle = fileHandle + try handle.seek(toOffset: EXT4.SuperBlockOffset) + + let superBlockSize = MemoryLayout.size + guard let data = try? self.handle.read(upToCount: superBlockSize) else { + throw EXT4.Error.couldNotReadSuperBlock(blockDevice.description, EXT4.SuperBlockOffset, superBlockSize) + } + let sb = data.withUnsafeBytes { ptr in + ptr.loadLittleEndian(as: EXT4.SuperBlock.self) + } + guard sb.magic == EXT4.SuperBlockMagic else { + throw EXT4.Error.invalidSuperBlock + } + self._superBlock = sb + var items: [(item: Ptr, inode: InodeNumber)] = [ + (self.tree.root, EXT4.RootInode) + ] + while items.count > 0 { + guard let item = items.popLast() else { + break + } + let (itemPtr, inodeNum) = item + let childItems = try self.children(of: inodeNum) + let root = itemPtr.pointee + for (itemName, itemInodeNum) in childItems { + if itemName == "." || itemName == ".." { + continue + } + + if self.inodes[itemInodeNum] != nil { + // we have seen this inode before, we will hard link this file to it + guard let parentPath = itemPtr.pointee.path else { + continue + } + let path = parentPath.join(itemName) + self.hardlinks[path] = itemInodeNum + continue + } + + let blocks = try self.getExtents(inode: itemInodeNum) + let itemTreeNode = FileTree.FileTreeNode( + inode: itemInodeNum, + name: itemName, + parent: itemPtr, + children: [] + ) + if let blocks { + if blocks.count > 1 { + itemTreeNode.additionalBlocks = Array(blocks.dropFirst()) + } + itemTreeNode.blocks = blocks.first + } + let itemTreeNodePtr = Ptr(itemTreeNode) + root.children.append(itemTreeNodePtr) + itemPtr.pointee = root + let itemInode = try self.getInode(number: itemInodeNum) + if itemInode.mode.isDir() { + items.append((itemTreeNodePtr, itemInodeNum)) + } + } + } + } + + deinit { + try? self.handle.close() + } + + private func readGroupDescriptor(_ number: UInt32) throws -> GroupDescriptor { + let bs = self.blockSize + let offset = bs + UInt64(number) * UInt64(self.groupDescriptorSize) + try self.handle.seek(toOffset: offset) + guard let data = try? self.handle.read(upToCount: MemoryLayout.size) else { + throw EXT4.Error.couldNotReadGroup(number) + } + let gd = data.withUnsafeBytes { ptr in + ptr.loadLittleEndian(as: EXT4.GroupDescriptor.self) + } + return gd + } + + private func readInode(_ number: UInt32) throws -> Inode { + let inodeGroupNumber = ((number - 1) / self._superBlock.inodesPerGroup) + let numberInGroup = UInt64((number - 1) % self._superBlock.inodesPerGroup) + + let gd = try getGroupDescriptor(inodeGroupNumber) + let inodeTableStart = UInt64(gd.inodeTableLow) * self.blockSize + + let inodeOffset: UInt64 = inodeTableStart + numberInGroup * UInt64(_superBlock.inodeSize) + try self.handle.seek(toOffset: inodeOffset) + guard let inodeData = try self.handle.read(upToCount: MemoryLayout.size) else { + throw EXT4.Error.couldNotReadInode(number) + } + let inode = inodeData.withUnsafeBytes { ptr in + ptr.loadLittleEndian(as: EXT4.Inode.self) + } + return inode + } + + private func getDirTree(_ number: InodeNumber) throws -> [(String, InodeNumber)] { + var children: [(String, InodeNumber)] = [] + let extents = try getExtents(inode: number) ?? [] + for (start, end) in extents { + try self.seek(block: start) + for i in 0..<(end - start) { + guard let dirEntryBlock = try self.handle.read(upToCount: Int(self.blockSize)) else { + throw EXT4.Error.couldNotReadBlock(start + i) + } + let childEntries = try getDirEntries(dirTree: dirEntryBlock) + children.append(contentsOf: childEntries) + } + } + return children.sorted { a, b in + a.0 < b.0 + } + } + + private func getDirEntries(dirTree: Data) throws -> [(String, InodeNumber)] { + var children: [(String, InodeNumber)] = [] + var offset = 0 + let entrySize = MemoryLayout.size + while offset < dirTree.count { + let dirEntry = dirTree.subdata(in: offset..= entrySize else { + break + } + if dirEntry.inode == 0 { + offset += Int(dirEntry.recordLength) + continue + } + let nameData = dirTree.subdata(in: offset + 8.. [(start: UInt32, end: UInt32)]? { + let inode = try self.getInode(number: inode) + let inodeBlock = Data(tupleToArray(inode.block)) + var offset = 0 + var extents: [(start: UInt32, end: UInt32)] = [] + + let extentHeaderSize = MemoryLayout.size + let extentIndexSize = MemoryLayout.size + let extentLeafSize = MemoryLayout.size + // read extent header + let header = inodeBlock.subdata(in: offset.. Inode { + if let inode = self.inodes[number] { + return inode + } + + let inode = try readInode(number) + self.inodes[number] = inode + return inode + } + + func getGroupDescriptor(_ number: UInt32) throws -> GroupDescriptor { + if let gd = self.groupDescriptors[number] { + return gd + } + let gd = try readGroupDescriptor(number) + self.groupDescriptors[number] = gd + return gd + } + + func children(of number: EXT4.InodeNumber) throws -> [(String, InodeNumber)] { + try getDirTree(number) + } + } +} diff --git a/Sources/ContainerizationEXT4/EXT4+Types.swift b/Sources/ContainerizationEXT4/EXT4+Types.swift new file mode 100644 index 0000000..12eb7b6 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Types.swift @@ -0,0 +1,633 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint:disable large_tuple + +import Foundation + +extension EXT4 { + public struct SuperBlock { + public var inodesCount: UInt32 = 0 + public var blocksCountLow: UInt32 = 0 + public var reservedBlocksCountLow: UInt32 = 0 + public var freeBlocksCountLow: UInt32 = 0 + public var freeInodesCount: UInt32 = 0 + public var firstDataBlock: UInt32 = 0 + public var logBlockSize: UInt32 = 0 + public var logClusterSize: UInt32 = 0 + public var blockSize: UInt32 { 1024 << logBlockSize } + public var blocksPerGroup: UInt32 = 0 + public var clustersPerGroup: UInt32 = 0 + public var inodesPerGroup: UInt32 = 0 + public var mtime: UInt32 = 0 + public var wtime: UInt32 = 0 + public var mountCount: UInt16 = 0 + public var maxMountCount: UInt16 = 0 + public var magic: UInt16 = 0 + public var state: UInt16 = 0 + public var errors: UInt16 = 0 + public var minorRevisionLevel: UInt16 = 0 + public var lastCheck: UInt32 = 0 + public var checkInterval: UInt32 = 0 + public var creatorOS: UInt32 = 0 + public var revisionLevel: UInt32 = 0 + public var defaultReservedUid: UInt16 = 0 + public var defaultReservedGid: UInt16 = 0 + public var firstInode: UInt32 = 0 + public var inodeSize: UInt16 = 0 + public var blockGroupNr: UInt16 = 0 + public var featureCompat: UInt32 = 0 + public var featureIncompat: UInt32 = 0 + public var featureRoCompat: UInt32 = 0 + public var uuid: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var volumeName: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var lastMounted: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var algorithmUsageBitmap: UInt32 = 0 + public var preallocBlocks: UInt8 = 0 + public var preallocDirBlocks: UInt8 = 0 + public var reservedGdtBlocks: UInt16 = 0 + public var journalUUID: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var journalInum: UInt32 = 0 + public var journalDev: UInt32 = 0 + public var lastOrphan: UInt32 = 0 + public var hashSeed: (UInt32, UInt32, UInt32, UInt32) = (0, 0, 0, 0) + public var defHashVersion: UInt8 = 0 + public var journalBackupType: UInt8 = 0 + public var descSize: UInt16 = UInt16(MemoryLayout.size) + public var defaultMountOpts: UInt32 = 0 + public var firstMetaBg: UInt32 = 0 + public var mkfsTime: UInt32 = 0 + public var journalBlocks: + ( + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0 + ) + public var blocksCountHigh: UInt32 = 0 + public var reservedBlocksCountHigh: UInt32 = 0 + public var freeBlocksCountHigh: UInt32 = 0 + public var minExtraIsize: UInt16 = 0 + public var wantExtraIsize: UInt16 = 0 + public var flags: UInt32 = 0 + public var raidStride: UInt16 = 0 + public var mmpInterval: UInt16 = 0 + public var mmpBlock: UInt64 = 0 + public var raidStripeWidth: UInt32 = 0 + public var logGroupsPerFlex: UInt8 = 0 + public var checksumType: UInt8 = 0 + public var reservedPad: UInt16 = 0 + public var kbytesWritten: UInt64 = 0 + public var snapshotInum: UInt32 = 0 + public var snapshotID: UInt32 = 0 + public var snapshotRBlocksCount: UInt64 = 0 + public var snapshotList: UInt32 = 0 + public var errorCount: UInt32 = 0 + public var firstErrorTime: UInt32 = 0 + public var firstErrorInode: UInt32 = 0 + public var firstErrorBlock: UInt64 = 0 + public var firstErrorFunc: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var firstErrorLine: UInt32 = 0 + public var lastErrorTime: UInt32 = 0 + public var lastErrorInode: UInt32 = 0 + public var lastErrorLine: UInt32 = 0 + public var lastErrorBlock: UInt64 = 0 + public var lastErrorFunc: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var mountOpts: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var userQuotaInum: UInt32 = 0 + public var groupQuotaInum: UInt32 = 0 + public var overheadBlocks: UInt32 = 0 + public var backupBgs: (UInt32, UInt32) = (0, 0) + public var encryptAlgos: (UInt8, UInt8, UInt8, UInt8) = (0, 0, 0, 0) + public var encryptPwSalt: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var lpfInode: UInt32 = 0 + public var projectQuotaInum: UInt32 = 0 + public var checksumSeed: UInt32 = 0 + public var wtimeHigh: UInt8 = 0 + public var mtimeHigh: UInt8 = 0 + public var mkfsTimeHigh: UInt8 = 0 + public var lastcheckHigh: UInt8 = 0 + public var firstErrorTimeHigh: UInt8 = 0 + public var lastErrorTimeHigh: UInt8 = 0 + public var pad: (UInt8, UInt8) = (0, 0) + public var reserved: + ( + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, + UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32, UInt32 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var checksum: UInt32 = 0 + } + + static let JournalMagic: UInt32 = 0xC03B_3998 + static let JournalInode: InodeNumber = 8 + static let MinJournalBlocks: UInt32 = 1024 // JBD2_MIN_JOURNAL_BLOCKS + + struct DefaultMountOpts { + static let journalData: UInt32 = 0x0020 // data=journal + static let journalOrdered: UInt32 = 0x0040 // data=ordered + static let journalWriteback: UInt32 = 0x0060 // data=writeback + } + + struct CompatFeature { + let rawValue: UInt32 + + static let dirPrealloc = CompatFeature(rawValue: 0x1) + static let imagicInodes = CompatFeature(rawValue: 0x2) + static let hasJournal = CompatFeature(rawValue: 0x4) + static let extAttr = CompatFeature(rawValue: 0x8) + static let resizeInode = CompatFeature(rawValue: 0x10) + static let dirIndex = CompatFeature(rawValue: 0x20) + static let lazyBg = CompatFeature(rawValue: 0x40) + static let excludeInode = CompatFeature(rawValue: 0x80) + static let excludeBitmap = CompatFeature(rawValue: 0x100) + static let sparseSuper2 = CompatFeature(rawValue: 0x200) + } + + struct IncompatFeature { + let rawValue: UInt32 + + static let compression = IncompatFeature(rawValue: 0x1) + static let filetype = IncompatFeature(rawValue: 0x2) + static let recover = IncompatFeature(rawValue: 0x4) + static let journalDev = IncompatFeature(rawValue: 0x8) + static let metaBg = IncompatFeature(rawValue: 0x10) + static let extents = IncompatFeature(rawValue: 0x40) + static let bit64 = IncompatFeature(rawValue: 0x80) + static let mmp = IncompatFeature(rawValue: 0x100) + static let flexBg = IncompatFeature(rawValue: 0x200) + static let eaInode = IncompatFeature(rawValue: 0x400) + static let dirdata = IncompatFeature(rawValue: 0x1000) + static let csumSeed = IncompatFeature(rawValue: 0x2000) + static let largedir = IncompatFeature(rawValue: 0x4000) + static let inlineData = IncompatFeature(rawValue: 0x8000) + static let encrypt = IncompatFeature(rawValue: 0x10000) + } + + struct RoCompatFeature { + let rawValue: UInt32 + + static let sparseSuper = RoCompatFeature(rawValue: 0x1) + static let largeFile = RoCompatFeature(rawValue: 0x2) + static let btreeDir = RoCompatFeature(rawValue: 0x4) + static let hugeFile = RoCompatFeature(rawValue: 0x8) + static let gdtCsum = RoCompatFeature(rawValue: 0x10) + static let dirNlink = RoCompatFeature(rawValue: 0x20) + static let extraIsize = RoCompatFeature(rawValue: 0x40) + static let hasSnapshot = RoCompatFeature(rawValue: 0x80) + static let quota = RoCompatFeature(rawValue: 0x100) + static let bigalloc = RoCompatFeature(rawValue: 0x200) + static let metadataCsum = RoCompatFeature(rawValue: 0x400) + static let replica = RoCompatFeature(rawValue: 0x800) + static let readonly = RoCompatFeature(rawValue: 0x1000) + static let project = RoCompatFeature(rawValue: 0x2000) + } + + struct BlockGroupFlag { + let rawValue: UInt16 + + static let inodeUninit = BlockGroupFlag(rawValue: 0x1) + static let blockUninit = BlockGroupFlag(rawValue: 0x2) + static let inodeZeroed = BlockGroupFlag(rawValue: 0x4) + } + + struct GroupDescriptor { + let blockBitmapLow: UInt32 + let inodeBitmapLow: UInt32 + let inodeTableLow: UInt32 + let freeBlocksCountLow: UInt16 + let freeInodesCountLow: UInt16 + let usedDirsCountLow: UInt16 + let flags: UInt16 + let excludeBitmapLow: UInt32 + let blockBitmapCsumLow: UInt16 + let inodeBitmapCsumLow: UInt16 + let itableUnusedLow: UInt16 + let checksum: UInt16 + } + + struct GroupDescriptor64 { + let groupDescriptor: GroupDescriptor + let blockBitmapHigh: UInt32 + let inodeBitmapHigh: UInt32 + let inodeTableHigh: UInt32 + let freeBlocksCountHigh: UInt16 + let freeInodesCountHigh: UInt16 + let usedDirsCountHigh: UInt16 + let itableUnusedHigh: UInt16 + let excludeBitmapHigh: UInt32 + let blockBitmapCsumHigh: UInt16 + let inodeBitmapCsumHigh: UInt16 + let reserved: UInt32 + } + + public struct FileModeFlag: Sendable { + let rawValue: UInt16 + + public static let S_IXOTH = FileModeFlag(rawValue: 0x1) + public static let S_IWOTH = FileModeFlag(rawValue: 0x2) + public static let S_IROTH = FileModeFlag(rawValue: 0x4) + public static let S_IXGRP = FileModeFlag(rawValue: 0x8) + public static let S_IWGRP = FileModeFlag(rawValue: 0x10) + public static let S_IRGRP = FileModeFlag(rawValue: 0x20) + public static let S_IXUSR = FileModeFlag(rawValue: 0x40) + public static let S_IWUSR = FileModeFlag(rawValue: 0x80) + public static let S_IRUSR = FileModeFlag(rawValue: 0x100) + public static let S_ISVTX = FileModeFlag(rawValue: 0x200) + public static let S_ISGID = FileModeFlag(rawValue: 0x400) + public static let S_ISUID = FileModeFlag(rawValue: 0x800) + public static let S_IFIFO = FileModeFlag(rawValue: 0x1000) + public static let S_IFCHR = FileModeFlag(rawValue: 0x2000) + public static let S_IFDIR = FileModeFlag(rawValue: 0x4000) + public static let S_IFBLK = FileModeFlag(rawValue: 0x6000) + public static let S_IFREG = FileModeFlag(rawValue: 0x8000) + public static let S_IFLNK = FileModeFlag(rawValue: 0xA000) + public static let S_IFSOCK = FileModeFlag(rawValue: 0xC000) + + public static let TypeMask = FileModeFlag(rawValue: 0xF000) + } + + public typealias InodeNumber = UInt32 + + public struct Inode { + public var mode: UInt16 = 0 + public var uid: UInt16 = 0 + public var sizeLow: UInt32 = 0 + public var atime: UInt32 = 0 + public var ctime: UInt32 = 0 + public var mtime: UInt32 = 0 + public var dtime: UInt32 = 0 + public var gid: UInt16 = 0 + public var linksCount: UInt16 = 0 + public var blocksLow: UInt32 = 0 + public var flags: UInt32 = 0 + public var version: UInt32 = 0 + public var block: + ( + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 + ) + public var generation: UInt32 = 0 + public var xattrBlockLow: UInt32 = 0 + public var sizeHigh: UInt32 = 0 + public var obsoleteFragmentAddr: UInt32 = 0 + public var blocksHigh: UInt16 = 0 + public var xattrBlockHigh: UInt16 = 0 + public var uidHigh: UInt16 = 0 + public var gidHigh: UInt16 = 0 + public var checksumLow: UInt16 = 0 + public var reserved: UInt16 = 0 + public var extraIsize: UInt16 = 0 + public var checksumHigh: UInt16 = 0 + public var ctimeExtra: UInt32 = 0 + public var mtimeExtra: UInt32 = 0 + public var atimeExtra: UInt32 = 0 + public var crtime: UInt32 = 0 + public var crtimeExtra: UInt32 = 0 + public var versionHigh: UInt32 = 0 + public var projid: UInt32 = 0 // Size until this point is 160 bytes + public var inlineXattrs: + ( // 96 bytes for extended attributes + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, UInt8, + UInt8, UInt8, UInt8, UInt8, UInt8, UInt8 + ) = ( + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0 + ) + + public static func Mode(_ mode: FileModeFlag, _ perm: UInt16) -> UInt16 { + mode.rawValue | perm + } + } + + struct InodeFlag { + let rawValue: UInt32 + + static let secRm = InodeFlag(rawValue: 0x1) + static let unRm = InodeFlag(rawValue: 0x2) + static let compressed = InodeFlag(rawValue: 0x4) + static let sync = InodeFlag(rawValue: 0x8) + static let immutable = InodeFlag(rawValue: 0x10) + static let append = InodeFlag(rawValue: 0x20) + static let noDump = InodeFlag(rawValue: 0x40) + static let noAtime = InodeFlag(rawValue: 0x80) + static let dirtyCompressed = InodeFlag(rawValue: 0x100) + static let compressedClusters = InodeFlag(rawValue: 0x200) + static let noCompress = InodeFlag(rawValue: 0x400) + static let encrypted = InodeFlag(rawValue: 0x800) + static let hashedIndex = InodeFlag(rawValue: 0x1000) + static let magic = InodeFlag(rawValue: 0x2000) + static let journalData = InodeFlag(rawValue: 0x4000) + static let noTail = InodeFlag(rawValue: 0x8000) + static let dirSync = InodeFlag(rawValue: 0x10000) + static let topDir = InodeFlag(rawValue: 0x20000) + static let hugeFile = InodeFlag(rawValue: 0x40000) + static let extents = InodeFlag(rawValue: 0x80000) + static let eaInode = InodeFlag(rawValue: 0x200000) + static let eofBlocks = InodeFlag(rawValue: 0x400000) + static let snapfile = InodeFlag(rawValue: 0x0100_0000) + static let snapfileDeleted = InodeFlag(rawValue: 0x0400_0000) + static let snapfileShrunk = InodeFlag(rawValue: 0x0800_0000) + static let inlineData = InodeFlag(rawValue: 0x1000_0000) + static let projectIDInherit = InodeFlag(rawValue: 0x2000_0000) + static let reserved = InodeFlag(rawValue: 0x8000_0000) + } + + struct ExtentHeader { + let magic: UInt16 + let entries: UInt16 + let max: UInt16 + let depth: UInt16 + let generation: UInt32 + } + + struct ExtentIndex { + let block: UInt32 + let leafLow: UInt32 + let leafHigh: UInt16 + let unused: UInt16 + } + + struct ExtentLeaf { + let block: UInt32 + let length: UInt16 + let startHigh: UInt16 + let startLow: UInt32 + } + + struct ExtentTail { + let checksum: UInt32 + } + + struct ExtentIndexNode { + var header: ExtentHeader + var indices: [ExtentIndex] + } + + struct ExtentLeafNode { + var header: ExtentHeader + var leaves: [ExtentLeaf] + } + + struct DirectoryEntry { + let inode: InodeNumber + let recordLength: UInt16 + let nameLength: UInt8 + let fileType: UInt8 + // let name: [UInt8] + } + + enum FileType: UInt8 { + case unknown = 0x0 + case regular = 0x1 + case directory = 0x2 + case character = 0x3 + case block = 0x4 + case fifo = 0x5 + case socket = 0x6 + case symbolicLink = 0x7 + } + + struct DirectoryEntryTail { + let reservedZero1: UInt32 + let recordLength: UInt16 + let reservedZero2: UInt8 + let fileType: UInt8 + let checksum: UInt32 + } + + struct DirectoryTreeRoot { + let dot: DirectoryEntry + let dotName: [UInt8] + let dotDot: DirectoryEntry + let dotDotName: [UInt8] + let reservedZero: UInt32 + let hashVersion: UInt8 + let infoLength: UInt8 + let indirectLevels: UInt8 + let unusedFlags: UInt8 + let limit: UInt16 + let count: UInt16 + let block: UInt32 + // let entries: [DirectoryTreeEntry] + } + + struct DirectoryTreeNode { + let fakeInode: UInt32 + let fakeRecordLength: UInt16 + let nameLength: UInt8 + let fileType: UInt8 + let limit: UInt16 + let count: UInt16 + let block: UInt32 + // let entries: [DirectoryTreeEntry] + } + + struct DirectoryTreeEntry { + let hash: UInt32 + let block: UInt32 + } + + struct DirectoryTreeTail { + let reserved: UInt32 + let checksum: UInt32 + } + + struct XAttrEntry { + let nameLength: UInt8 + let nameIndex: UInt8 + let valueOffset: UInt16 + let valueInum: UInt32 + let valueSize: UInt32 + let hash: UInt32 + } + + struct XAttrHeader { + let magic: UInt32 + let referenceCount: UInt32 + let blocks: UInt32 + let hash: UInt32 + let checksum: UInt32 + let reserved: [UInt32] + } + +} + +extension EXT4.Inode { + public static func Root() -> EXT4.Inode { + var inode = Self() // inode + inode.mode = Self.Mode(.S_IFDIR, 0o755) + inode.linksCount = 2 + inode.uid = 0 + inode.gid = 0 + // time + let now = Date().fs() + let now_lo: UInt32 = now.lo + let now_hi: UInt32 = now.hi + inode.atime = now_lo + inode.atimeExtra = now_hi + inode.ctime = now_lo + inode.ctimeExtra = now_hi + inode.mtime = now_lo + inode.mtimeExtra = now_hi + inode.crtime = now_lo + inode.crtimeExtra = now_hi + inode.flags = EXT4.InodeFlag.hugeFile.rawValue + inode.extraIsize = UInt16(EXT4.ExtraIsize) + return inode + } + +} diff --git a/Sources/ContainerizationEXT4/EXT4+Xattrs.swift b/Sources/ContainerizationEXT4/EXT4+Xattrs.swift new file mode 100644 index 0000000..6ca01d0 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4+Xattrs.swift @@ -0,0 +1,317 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/* + * Note: Both the entries and values for the attributes need to occupy a size that is a multiple of 4, + * meaning, in cases where the attribute name or value is not a multiple of 4, it is padded with 0 + * until it reaches that size. + */ + +extension EXT4 { + public struct ExtendedAttribute { + public static let prefixMap: [Int: String] = [ + 1: "user.", + 2: "system.posix_acl_access", + 3: "system.posix_acl_default", + 4: "trusted.", + 6: "security.", + 7: "system.", + 8: "system.richacl", + ] + + let name: String + let index: UInt8 + let value: [UInt8] + + var sizeValue: UInt32 { + UInt32((value.count + 3) & ~3) + } + + var sizeEntry: UInt32 { + UInt32((name.count + 3) & ~3 + 16) // 16 bytes are needed to store other metadata for the xattr entry + } + + var size: UInt32 { + sizeEntry + sizeValue + } + + var fullName: String { + Self.decompressName(id: Int(index), suffix: name) + } + + var hash: UInt32 { + var hash: UInt32 = 0 + for char in name { + hash = (hash << 5) ^ (hash >> 27) ^ UInt32(char.asciiValue!) + } + var i = 0 + while i + 3 < value.count { + let s = value[i..> 16) ^ v + i += 4 + } + if value.count % 4 != 0 { + let last = value.count & ~3 + var buff: [UInt8] = [0, 0, 0, 0] + for (i, byte) in value[last...].enumerated() { + buff[i] = byte + } + let v = buff.withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + hash = (hash << 16) ^ (hash >> 16) ^ v + } + return hash + } + + init(name: String, value: [UInt8]) { + let compressed = Self.compressName(name) + self.name = compressed.str + self.index = compressed.id + self.value = value + } + + init(idx: UInt8, compressedName name: String, value: [UInt8]) { + self.name = name + self.index = idx + self.value = value + } + + // MARK: Class methods + public static func compressName(_ name: String) -> (id: UInt8, str: String) { + for (id, prefix) in prefixMap.sorted(by: { $1.1.count < $0.1.count }) where name.hasPrefix(prefix) { + return (UInt8(id), String(name.dropFirst(prefix.count))) + } + return (0, name) + } + + public static func decompressName(id: Int, suffix: String) -> String { + guard let prefix = prefixMap[id] else { + return suffix + } + return "\(prefix)\(suffix)" + } + } + + public struct FileXattrsState { + private let inodeCapacity: UInt32 + private let blockCapacity: UInt32 + private let inode: UInt32 // the inode number for which we are tracking these xattrs + + var inlineAttributes: [ExtendedAttribute] = [] + var blockAttributes: [ExtendedAttribute] = [] + private var usedSizeInline: UInt32 = 0 + private var usedSizeBlock: UInt32 = 0 + + private var inodeFreeBytes: UInt32 { + self.inodeCapacity - EXT4.XattrInodeHeaderSize - usedSizeInline - 4 // need to have 4 null bytes b/w xattr entries and values + } + + private var blockFreeBytes: UInt32 { + self.blockCapacity - EXT4.XattrBlockHeaderSize - usedSizeBlock - 4 + } + + init(inode: UInt32, inodeXattrCapacity: UInt32, blockCapacity: UInt32) { + self.inode = inode + self.inodeCapacity = inodeXattrCapacity + self.blockCapacity = blockCapacity + } + + public mutating func add(_ attribute: ExtendedAttribute) throws { + let size = attribute.size + if size <= inodeFreeBytes { + usedSizeInline += size + inlineAttributes.append(attribute) + return + } + if size <= blockFreeBytes { + usedSizeBlock += size + blockAttributes.append(attribute) + return + } + throw Error.insufficientSpace(Int(self.inode)) + } + + public func writeInlineAttributes(buffer: inout [UInt8]) throws { + var idx = 0 + withUnsafeLittleEndianBytes( + of: EXT4.XAttrHeaderMagic, + body: { bytes in + for byte in bytes { + buffer[idx] = byte + idx += 1 + } + }) + try Self.write(buffer: &buffer, attrs: self.inlineAttributes, start: UInt16(idx), delta: 0, inline: true) + } + + public func writeBlockAttributes(buffer: inout [UInt8]) throws { + var idx = 0 + for val in [EXT4.XAttrHeaderMagic, 1, 1] { + withUnsafeLittleEndianBytes( + of: UInt32(val), + body: { bytes in + for byte in bytes { + buffer[idx] = byte + idx += 1 + } + }) + } + while idx != 32 { + buffer[idx] = 0 + idx += 1 + } + var attributes = self.blockAttributes + attributes.sort(by: { + if $0.index != $1.index { + return $0.index < $1.index + } + if $0.name.count != $1.name.count { + return $0.name.count < $1.name.count + } + return $0.name < $1.name + }) + try Self.write(buffer: &buffer, attrs: attributes, start: UInt16(idx), delta: UInt16(idx), inline: false) + } + + /// Writes the specified list of extended attribute entries and their values to the provided + /// This method does not fill in any headers (Inode inline / block level) that may be required to parse these attributes + /// + /// - Parameters: + /// - buffer: An array of [UInt8] where the data will be written into + /// - attrs: The list of ExtendedAttributes to write + /// - start: the index from where data should be put into the buffer - useful when if you dont want this method to be overwriting existing data + /// - delta: index from where the begin the offset calculations + /// - inline: if the byte buffer being written into is an inline data block for an inode: Determines the hash calculation + private static func write( + buffer: inout [UInt8], attrs: [ExtendedAttribute], start: UInt16, delta: UInt16, inline: Bool + ) throws { + var offset: UInt16 = UInt16(buffer.count) + delta - start + var front = Int(start) + var end = buffer.count + + for attribute in attrs { + guard end - front >= 4 else { + throw Error.malformedXattrBuffer + } + + var out: [UInt8] = [] + let v = attribute.sizeValue + offset -= UInt16(v) + out.append(UInt8(attribute.name.count)) + out.append(attribute.index) + withUnsafeLittleEndianBytes( + of: UInt16(offset), + body: { bytes in + out.append(contentsOf: bytes) + }) + out.append(contentsOf: [0, 0, 0, 0]) // these next four bytes indicate that the attr values are in the same block + withUnsafeLittleEndianBytes( + of: UInt32(attribute.value.count), + body: { bytes in + out.append(contentsOf: bytes) + }) + if !inline { + withUnsafeLittleEndianBytes( + of: UInt32(attribute.hash), + body: { bytes in + out.append(contentsOf: bytes) + }) + } else { + out.append(contentsOf: [0, 0, 0, 0]) + } + guard let name = attribute.name.data(using: .ascii) else { + throw Error.convertAsciiString(attribute.name) + } + out.append(contentsOf: [UInt8](name)) + while out.count < Int(attribute.sizeEntry) { // ensure that xattr entry size is a multiple of 4 + out.append(0) + } + for (i, byte) in out.enumerated() { + buffer[front + i] = byte + } + front += out.count + + end -= Int(attribute.sizeValue) + for (i, byte) in attribute.value.enumerated() { + buffer[end + i] = byte + } + } + } + + public static func read(buffer: [UInt8], start: Int, offset: Int) throws -> [ExtendedAttribute] { + var i = start + var attribs: [ExtendedAttribute] = [] + // 16 is the size of 1 XAttrEntry + while i + 16 <= buffer.count { + let attributeStart = i + let rawXattrEntry = Array(buffer[i.. Data blocks. In this implementation, inode size is set to 256 bytes. + Inode table uses extents to efficiently describe the mapping. + + +-----------------------+ + | Inode Table | + +-----------------------+ + | Inode | Metadata | + +-------+---------------+ + | 1 | permissions | + | | size | + | | user ID | + | | group ID | + | | timestamps | + | | block | + | | blocks count | + +-------+---------------+ + | 2 | ... | + +-------+---------------+ + | ... | ... | + +-------+---------------+ + + The length of `block` field in the inode table is 60 bytes. This field contains an extent tree + that holds information about ranges of blocks used by the file. For smaller files, the entire extent + tree can be stored within this field. + + +-----------------------+ + | Inode | + +-----------------------+ + | Metadata | + +-----------------------+ + | Extent Tree | + | +-------------------+ | + | | Extent Leaf Node | | + | +-------------------+ | + | | - Start Block | | + | | - Block Count | | + | | - ... | | + | +-------------------+ | + +-----------------------+ + + For larger files which span across multiple non-contiguous blocks, extent tree's root points to extent + blocks, which in-turn point to the blocks used by the file + + +-----------------------+ + | Extent Tree | + | +-------------------+ | + | | Extent Root | | + | +-------------------+ | + | | - Pointers to | | + | | Extent Blocks | | + | +-------------------+ | + +-----------------------+ + | + v + +-----------------------+ + | Extent Block | + +-----------------------+ + | +-------------------+ | + | | Extent Leaf Node | | + | +-------------------+ | + | | - Start Block | | + | | - Block Count | | + | | - ... | | + | +-------------------+ | + | +-------------------+ | + | | Extent Leaf Node | | + | +-------------------+ | + | | - Start Block | | + | | - Block Count | | + | | - ... | | + | +-------------------+ | + +-----------------------+ + + ## Directory entries + + The data blocks for directory inodes point to a list of directory entries. Each entry + consists of only a name and inode number. The name and inode number correspond to the + name and inode number of the children of the directory + + +-------------------------+ + | Directory Entry | + +-------------------------+ + | inode | rec_len | name | + +-------------------------+ + | 2 | 1 | "." | + +-------------------------+ + | Directory Entry | + +-------------------------+ + | inode | rec_len | name | + +-------------------------+ + | 1 | 2 | ".." | + +-------------------------+ + | Directory Entry | + +-------------------------+ + | inode | rec_len | name | + +-------------------------+ + | 11 | 10 | lost& | + | | | found | + +-------------------------+ + +More details can be found here https://ext4.wiki.kernel.org/index.php/Ext4_Disk_Layout + +``` +*/ + +/// A type for interacting with ext4 file systems. +/// +/// The `Ext4` class provides functionality to read the superblock of an existing ext4 block device +/// and format a new block device with the ext4 file system. +/// +/// Usage: +/// - To read the superblock of an existing ext4 block device, create an instance of `Ext4` with the +/// path to the block device +/// - To format a new block device with ext4, create an instance of `Ext4.Formatter` with the path to the block +/// device and call the `close()` method. +/// +/// Example 1: Read an existing block device +/// ```swift +/// let blockDevice = URL(filePath: "/dev/sdb") +/// // succeeds if a valid ext4 fs is found at path +/// let ext4 = try Ext4(blockDevice: blockDevice) +/// print("Block size: \(ext4.blockSize)") +/// print("Total size: \(ext4.size)") +/// +/// // Reading the superblock +/// let superblock = ext4.superblock +/// print("Superblock information:") +/// print("Total blocks: \(superblock.blocksCountLow)") +/// ``` +/// +/// Example 2: Format a new block device (Refer [`EXT4.Formatter`](x-source-tag://EXT4.Formatter) for more info) +/// ```swift +/// let devicePath = URL(filePath: "/dev/sdc") +/// let formatter = try EXT4.Formatter(devicePath, blockSize: 4096) +/// try formatter.close() +/// ``` +public enum EXT4 { + public static let SuperBlockMagic: UInt16 = 0xef53 + + static let ExtentHeaderMagic: UInt16 = 0xf30a + static let XAttrHeaderMagic: UInt32 = 0xea02_0000 + + static let DefectiveBlockInode: InodeNumber = 1 + static let RootInode: InodeNumber = 2 + static let FirstInode: InodeNumber = 11 + static let LostAndFoundInode: InodeNumber = 11 + + static let InodeActualSize: UInt32 = 160 // 160 bytes used by metadata + static let InodeExtraSize: UInt32 = 96 // 96 bytes for inline xattrs + static let InodeSize: UInt32 = UInt32(MemoryLayout.size) // 256 bytes. This is the max size of an inode + static let XattrInodeHeaderSize: UInt32 = 4 + static let XattrBlockHeaderSize: UInt32 = 32 + static let ExtraIsize: UInt16 = UInt16(InodeActualSize) - 128 + + static let MaxLinks: UInt32 = 65000 + static let MaxBlocksPerExtent: UInt32 = 0x8000 + static let MaxFileSize: UInt64 = 128.gib() + static let SuperBlockOffset: UInt64 = 1024 + + public struct JournalConfig: Sendable { + public var size: UInt64? + public var defaultMode: JournalMode? + + public enum JournalMode: Sendable { + case writeback + case ordered + case journal + } + + public init(size: UInt64? = nil, defaultMode: JournalMode? = nil) { + self.size = size + self.defaultMode = defaultMode + } + + public static let `default` = JournalConfig() + } +} + +extension EXT4 { + // `EXT4` errors. + public enum Error: Swift.Error, CustomStringConvertible, Sendable, Equatable { + case notFound(_ path: String) + case couldNotReadSuperBlock(_ path: String, _ offset: UInt64, _ size: Int) + case invalidSuperBlock + case deepExtentsUnimplemented + case invalidExtents + case invalidXattrEntry + case couldNotReadBlock(_ block: UInt32) + case invalidPathEncoding(_ path: String) + case couldNotReadInode(_ inode: UInt32) + case couldNotReadGroup(_ group: UInt32) + public var description: String { + switch self { + case .notFound(let path): + return "file at path \(path) not found" + case .couldNotReadSuperBlock(let path, let offset, let size): + return "could not read \(size) bytes of superblock from \(path) at offset \(offset)" + case .invalidSuperBlock: + return "not a valid EXT4 superblock" + case .deepExtentsUnimplemented: + return "deep extents are not supported" + case .invalidExtents: + return "extents invalid or corrupted" + case .invalidXattrEntry: + return "invalid extended attribute entry" + case .couldNotReadBlock(let block): + return "could not read block \(block)" + case .invalidPathEncoding(let path): + return "path encoding for '\(path)' is invalid, must be ascii or utf8" + case .couldNotReadInode(let inode): + return "could not read inode \(inode)" + case .couldNotReadGroup(let group): + return "could not read group descriptor \(group)" + } + } + } +} diff --git a/Sources/ContainerizationEXT4/EXT4Reader+Export.swift b/Sources/ContainerizationEXT4/EXT4Reader+Export.swift new file mode 100644 index 0000000..2fd4109 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4Reader+Export.swift @@ -0,0 +1,215 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationArchive +import Foundation +import SystemPackage + +extension EXT4.EXT4Reader { + public func export(archive: FilePath) throws { + let config = ArchiveWriterConfiguration( + format: .paxRestricted, filter: .none, options: [Options.xattrformat(.schily)]) + let writer = try ArchiveWriter(configuration: config) + try writer.open(file: archive.url) + var items = self.tree.root.pointee.children + let hardlinkedInodes = Set(self.hardlinks.values) + var hardlinkTargets: [EXT4.InodeNumber: FilePath] = [:] + + while items.count > 0 { + let itemPtr = items.removeFirst() + let item = itemPtr.pointee + let inode = try self.getInode(number: item.inode) + let entry = WriteEntry() + let mode = inode.mode + let size: UInt64 = (UInt64(inode.sizeHigh) << 32) | UInt64(inode.sizeLow) + entry.permissions = mode_t(mode) + guard let path = item.path else { + continue + } + if hardlinkedInodes.contains(item.inode) { + hardlinkTargets[item.inode] = path + } + guard self.hardlinks[path] == nil else { + continue + } + var attributes: [EXT4.ExtendedAttribute] = [] + let buffer: [UInt8] = EXT4.tupleToArray(inode.inlineXattrs) + if !buffer.allZeros { + try attributes.append(contentsOf: Self.readInlineExtendedAttributes(from: buffer)) + } + if inode.xattrBlockLow != 0 { + let block = inode.xattrBlockLow + try self.seek(block: block) + guard let buffer = try self.handle.read(upToCount: Int(self.blockSize)) else { + throw EXT4.Error.couldNotReadBlock(block) + } + try attributes.append(contentsOf: Self.readBlockExtendedAttributes(from: [UInt8](buffer))) + } + + var xattrs: [String: Data] = [:] + for attribute in attributes { + guard attribute.fullName != "system.data" else { + continue + } + xattrs[attribute.fullName] = Data(attribute.value) + } + + let pathStr = path.description + entry.path = pathStr + entry.size = Int64(size) + entry.group = gid_t(inode.gidHigh) << 16 | gid_t(inode.gid) + entry.owner = uid_t(inode.uidHigh) << 16 | uid_t(inode.uid) + entry.creationDate = Date(fsTimestamp: UInt64(inode.crtimeExtra) << 32 | UInt64(inode.crtime)) + entry.modificationDate = Date(fsTimestamp: UInt64(inode.mtimeExtra) << 32 | UInt64(inode.mtime)) + entry.contentAccessDate = Date(fsTimestamp: UInt64(inode.atimeExtra) << 32 | UInt64(inode.atime)) + entry.xattrs = xattrs + + if mode.isDir() { + entry.fileType = .directory + for child in item.children { + items.append(child) + } + if pathStr == "" { + continue + } + try writer.writeEntry(entry: entry, data: nil) + } else if mode.isReg() { + entry.fileType = .regular + var data = Data() + var remaining: UInt64 = size + if let block = item.blocks { + for dataBlock in block.start.. self.blockSize { + count = self.blockSize + } else { + count = remaining + } + guard let dataBytes = try self.handle.read(upToCount: Int(count)) else { + throw EXT4.Error.couldNotReadBlock(dataBlock) + } + data.append(dataBytes) + remaining -= UInt64(dataBytes.count) + } + } + if let additionalBlocks = item.additionalBlocks { + for block in additionalBlocks { + for dataBlock in block.start.. self.blockSize { + count = self.blockSize + } else { + count = remaining + } + guard let dataBytes = try self.handle.read(upToCount: Int(count)) else { + throw EXT4.Error.couldNotReadBlock(dataBlock) + } + data.append(dataBytes) + remaining -= UInt64(dataBytes.count) + } + } + } + try writer.writeEntry(entry: entry, data: data) + } else if mode.isLink() { + entry.fileType = .symbolicLink + if size < 60 { + let linkBytes = EXT4.tupleToArray(inode.block) + entry.symlinkTarget = String(bytes: linkBytes.prefix(Int(size)), encoding: .utf8) ?? "" + } else { + if let block = item.blocks { + try self.seek(block: block.start) + guard let linkBytes = try self.handle.read(upToCount: Int(size)) else { + throw EXT4.Error.couldNotReadBlock(block.start) + } + entry.symlinkTarget = String(bytes: linkBytes, encoding: .utf8) ?? "" + } + } + try writer.writeEntry(entry: entry, data: nil) + } else { // do not process sockets, fifo, character and block devices + continue + } + } + for (path, number) in self.hardlinks { + guard let targetPath = hardlinkTargets[number] else { + continue + } + let inode = try self.getInode(number: number) + let entry = WriteEntry() + entry.path = path.description + entry.hardlink = targetPath.description + entry.permissions = mode_t(inode.mode) + entry.group = gid_t(inode.gidHigh) << 16 | gid_t(inode.gid) + entry.owner = uid_t(inode.uidHigh) << 16 | uid_t(inode.uid) + entry.creationDate = Date(fsTimestamp: UInt64(inode.crtimeExtra) << 32 | UInt64(inode.crtime)) + entry.modificationDate = Date(fsTimestamp: UInt64(inode.mtimeExtra) << 32 | UInt64(inode.mtime)) + entry.contentAccessDate = Date(fsTimestamp: UInt64(inode.atimeExtra) << 32 | UInt64(inode.atime)) + try writer.writeEntry(entry: entry, data: nil) + } + try writer.finishEncoding() + } + + @available(*, deprecated, renamed: "readInlineExtendedAttributes(from:)") + public static func readInlineExtenedAttributes(from buffer: [UInt8]) throws -> [EXT4.ExtendedAttribute] { + try readInlineExtendedAttributes(from: buffer) + } + + public static func readInlineExtendedAttributes(from buffer: [UInt8]) throws -> [EXT4.ExtendedAttribute] { + let header = buffer[0..<4].withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + if header != EXT4.XAttrHeaderMagic { + throw EXT4.FileXattrsState.Error.missingXAttrHeader + } + return try EXT4.FileXattrsState.read(buffer: buffer, start: 4, offset: 4) + } + + @available(*, deprecated, renamed: "readBlockExtendedAttributes(from:)") + public static func readBlockExtenedAttributes(from buffer: [UInt8]) throws -> [EXT4.ExtendedAttribute] { + try readBlockExtendedAttributes(from: buffer) + } + + public static func readBlockExtendedAttributes(from buffer: [UInt8]) throws -> [EXT4.ExtendedAttribute] { + let header = buffer[0..<4].withUnsafeBytes { $0.loadLittleEndian(as: UInt32.self) } + if header != EXT4.XAttrHeaderMagic { + throw EXT4.FileXattrsState.Error.missingXAttrHeader + } + + return try EXT4.FileXattrsState.read(buffer: [UInt8](buffer), start: 32, offset: 0) + } + + func seek(block: UInt32) throws { + try self.handle.seek(toOffset: UInt64(block) * blockSize) + } +} + +extension Date { + init(fsTimestamp: UInt64) { + if fsTimestamp == 0 { + self = Date.distantPast + return + } + + // 32 bits - base: seconds since January 1, 1970, signed (negative for pre-1970 dates) + // 2 bits - epoch: overflow counter (0-3), how many times the 32-bit seconds field has wrapped + // 30 bits - nanoseconds (0-999,999,999) + let base = Int32(truncatingIfNeeded: fsTimestamp) + let epoch = Int64(fsTimestamp & 0x3_0000_0000) + let seconds = Int64(base) + epoch + let nanoseconds = Double(fsTimestamp >> 34) / 1_000_000_000 + + self = Date(timeIntervalSince1970: Double(seconds) + nanoseconds) + } +} diff --git a/Sources/ContainerizationEXT4/EXT4Reader+IO.swift b/Sources/ContainerizationEXT4/EXT4Reader+IO.swift new file mode 100644 index 0000000..c2c9364 --- /dev/null +++ b/Sources/ContainerizationEXT4/EXT4Reader+IO.swift @@ -0,0 +1,495 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +extension EXT4 { + public enum PathIOError: Swift.Error, CustomStringConvertible { + case notFound(String) + case notAFile(String) + case isDirectory(String) + case notADirectory(String) + case symlinkLoop(String) + case invalidPath(String) + + public var description: String { + switch self { + case .notFound(let p): return "no such file or directory: \(p)" + case .notAFile(let p): return "not a regular file: \(p)" + case .isDirectory(let p): return "is a directory: \(p)" + case .notADirectory(let p): return "not a directory: \(p)" + case .symlinkLoop(let p): return "symlink loop while resolving: \(p)" + case .invalidPath(let p): return "invalid path: \(p)" + } + } + } +} + +// MARK: - Public API + +extension EXT4.EXT4Reader { + /// Return true if a path exists (file or directory) in this ext4 device. + public func exists(_ path: FilePath, followSymlinks: Bool = true) -> Bool { + (try? resolvePath(path, followSymlinks: followSymlinks).inode) != nil + } + + /// Get the total number of blocks in the filesystem + private var totalBlocks: UInt64 { + let lo = UInt64(_superBlock.blocksCountLow) + let hi = UInt64(_superBlock.blocksCountHigh) + return lo | (hi << 32) + } + + /// Validate that a physical block address is within device bounds + private func validateBlockAddress(_ block: UInt32) throws { + guard UInt64(block) < totalBlocks else { + throw EXT4.PathIOError.invalidPath("block address \(block) exceeds device bounds (\(totalBlocks) blocks)") + } + } + + /// Metadata (inode + inode number) for a path. + public func stat(_ path: FilePath, followSymlinks: Bool = true) throws -> (inodeNumber: EXT4.InodeNumber, inode: EXT4.Inode) { + let resolved = try resolvePath(path, followSymlinks: followSymlinks) + return (resolved.inodeNum, try getInode(number: resolved.inodeNum)) + } + + /// List a directory's entries (names only). Does not include "." or "..". + public func listDirectory(_ path: FilePath) throws -> [String] { + let (inoNum, ino) = try stat(path) + guard ino.mode.isDir() else { + throw EXT4.PathIOError.notADirectory(path.description) + } + let children = try children(of: inoNum) + return + children + .map { $0.0 } + .filter { $0 != "." && $0 != ".." } + .sorted() + } + + /// Read bytes from a regular file at `path` into `buffer`, starting at `offset`. + /// Returns the number of bytes written to `buffer` (may be less than `buffer.count` at EOF). + /// - Note: Semantics mirror `read(2)`: partial reads are possible. + @discardableResult + public func readFile( + at path: FilePath, + into buffer: UnsafeMutableRawBufferPointer, + offset: UInt64 = 0, + followSymlinks: Bool = true + ) throws -> Int { + let context = try prepareRead(path: path, offset: offset, followSymlinks: followSymlinks) + if buffer.count == 0 || context.maxReadable == 0 { + return 0 + } + + let want = min(UInt64(buffer.count), context.maxReadable) + return try performRead( + inodeNumber: context.inodeNumber, + start: context.start, + wantedBytes: want, + into: buffer + ) + } + + /// Read bytes from a regular file at `path` starting at `offset`. + /// If `count` is nil, reads to EOF. Returns exactly the requested bytes (or less at EOF). + public func readFile( + at path: FilePath, + offset: UInt64 = 0, + count: Int? = nil, + followSymlinks: Bool = true + ) throws -> Data { + let context = try prepareRead(path: path, offset: offset, followSymlinks: followSymlinks) + let want = count.map { min(UInt64($0), context.maxReadable) } ?? context.maxReadable + if want == 0 { + return Data() + } + + var out = Data(count: Int(want)) + let wrote = try out.withUnsafeMutableBytes { + try performRead( + inodeNumber: context.inodeNumber, + start: context.start, + wantedBytes: want, + into: $0 + ) + } + if wrote < Int(want) { + out.removeSubrange(wrote.. (inodeNumber: EXT4.InodeNumber, start: UInt64, maxReadable: UInt64) { + let (inoNum, inode) = try stat(path, followSymlinks: followSymlinks) + + if inode.mode.isDir() { + throw EXT4.PathIOError.isDirectory(path.description) + } + + if !inode.mode.isReg() { + throw EXT4.PathIOError.notAFile(path.description) + } + + let fileSize: UInt64 = inodeFileSize(inode) + let start = min(offset, fileSize) + let maxReadable = fileSize - start + return (inodeNumber: inoNum, start: start, maxReadable: maxReadable) + } + + private func performRead( + inodeNumber: EXT4.InodeNumber, + start: UInt64, + wantedBytes: UInt64, + into buffer: UnsafeMutableRawBufferPointer + ) throws -> Int { + if wantedBytes == 0 { + return 0 + } + + guard let extents = try self.getExtents(inode: inodeNumber), !extents.isEmpty else { + return 0 + } + + for (physStartBlk, physEndBlk) in extents { + try validateBlockAddress(physStartBlk) + if physEndBlk > physStartBlk { + try validateBlockAddress(physEndBlk - 1) + } + } + + guard let base = buffer.baseAddress else { + return 0 + } + + let desiredBytes = Int(min(wantedBytes, UInt64(buffer.count))) + if desiredBytes == 0 { + return 0 + } + + let blockSizeBytes = self.blockSize + let reqStart = start + let reqEnd = start + UInt64(desiredBytes) + var logicalOffset: UInt64 = 0 + var bytesWritten = 0 + + for (physStartBlk, physEndBlk) in extents { + let extentBytes = UInt64(physEndBlk - physStartBlk) * blockSizeBytes + let logicalEnd = logicalOffset + extentBytes + + if logicalEnd <= reqStart { + logicalOffset = logicalEnd + continue + } + if logicalOffset >= reqEnd { + break + } + + let overlapStart = max(logicalOffset, reqStart) + let overlapEnd = min(logicalEnd, reqEnd) + var remaining = overlapEnd - overlapStart + if remaining == 0 { + logicalOffset = logicalEnd + continue + } + + let offsetIntoExtent = overlapStart - logicalOffset + let absoluteByteOffset = (UInt64(physStartBlk) * blockSizeBytes) + offsetIntoExtent + + do { + try self.handle.seek(toOffset: absoluteByteOffset) + } catch { + if bytesWritten > 0 { + return bytesWritten + } + throw EXT4.PathIOError.invalidPath("failed to seek to offset \(absoluteByteOffset): \(error)") + } + + while remaining > 0 && bytesWritten < desiredBytes { + let chunk = min(desiredBytes - bytesWritten, Int(min(remaining, UInt64(1 << 20)))) + let dest = UnsafeMutableRawBufferPointer( + start: base.advanced(by: bytesWritten), + count: chunk + ) + + do { + guard let data = try self.handle.read(upToCount: chunk) else { + return bytesWritten + } + + if data.count == 0 { + return bytesWritten + } + + // Copy the data to the destination buffer + data.withUnsafeBytes { sourceBytes in + dest.copyMemory(from: UnsafeRawBufferPointer(sourceBytes)) + } + + bytesWritten += data.count + remaining -= UInt64(data.count) + + if data.count < chunk && remaining > 0 { + return bytesWritten + } + } catch { + if bytesWritten > 0 { + return bytesWritten + } + throw error + } + } + + logicalOffset = logicalEnd + if bytesWritten >= desiredBytes { + break + } + } + + return bytesWritten + } + + // MARK: - Internals inside EXT4Reader + public struct ResolvedPath { + let inodeNum: EXT4.InodeNumber + let inode: EXT4.Inode + } + + /// Resolve a path to an inode (optionally following symlinks). + /// Paths may be absolute ("/...") or relative (from "/"). + public func resolvePath(_ path: FilePath, followSymlinks: Bool, maxSymlinks: Int = 40) throws -> ResolvedPath { + var components: [String] = normalize(path: path) + var current: EXT4.InodeNumber = EXT4.RootInode + var parentStack: [EXT4.InodeNumber] = [] // Track parent chain for proper ".." handling + + var symlinkHops = 0 + + // Process components one at a time to handle symlinks in the middle of paths + var componentIndex = 0 + + while componentIndex < components.count { + let name = components[componentIndex] + + if name == "." { + componentIndex += 1 + continue + } + + if name == ".." { + // Handle parent directory traversal + if current == EXT4.RootInode { + // At root, ".." points to itself + componentIndex += 1 + continue + } + + // Use parent stack if available + if !parentStack.isEmpty { + current = parentStack.removeLast() + } else { + // Fallback: look up ".." entry in filesystem + let entries = try children(of: current) + if let parent = entries.first(where: { $0.0 == ".." })?.1 { + current = parent + } + } + componentIndex += 1 + continue + } + + // Regular component: verify current is a directory and look up child + let currentInode = try getInode(number: current) + guard currentInode.mode.isDir() else { + throw EXT4.PathIOError.notADirectory(name) + } + + let entries = try children(of: current) + guard let child = entries.first(where: { $0.0 == name }) else { + throw EXT4.PathIOError.notFound(name) + } + + // Check if child is a symlink + let childInode = try getInode(number: child.1) + if childInode.mode.isLink() && followSymlinks { + // Enforce max symlink depth + symlinkHops += 1 + if symlinkHops > maxSymlinks { + throw EXT4.PathIOError.symlinkLoop(FilePath(components.joined(separator: "/")).description) + } + + // Read symlink target + let linkBytes = try readFileFromInode(inodeNum: child.1) + guard let linkTarget = String(data: linkBytes, encoding: .utf8), !linkTarget.isEmpty else { + throw EXT4.PathIOError.invalidPath("empty symlink target") + } + + // Parse symlink target into components + let targetComponents = normalize(path: FilePath(linkTarget)) + + // Replace current component with symlink target components and continue + if linkTarget.hasPrefix("/") { + // Absolute symlink: reset to root + current = EXT4.RootInode + parentStack = [] + // Replace the symlink component with target components + remaining path + components = targetComponents + Array(components[(componentIndex + 1)...]) + componentIndex = 0 // Start from beginning with new path + } else { + // Relative symlink: continue from current directory + // Replace the symlink component with target components + remaining path + components = Array(components[0.. [String] { + let s = path.description + let trimmed = s.hasPrefix("/") ? String(s.dropFirst()) : s + if trimmed.isEmpty { return [] } + return trimmed.split(separator: "/").map(String.init) + } + + /// Read entire file content of a regular file given an inode (used for symlink targets). + private func readFileFromInode(inodeNum: EXT4.InodeNumber) throws -> Data { + let ino = try getInode(number: inodeNum) + guard ino.mode.isReg() || ino.mode.isLink() else { + return Data() + } + let size = inodeFileSize(ino) + if size == 0 { return Data() } + + // Handle fast symlinks (target stored directly in inode block field) + if ino.mode.isLink() && size < 60 { + // Extract target from inode block field + let blockData = withUnsafeBytes(of: ino.block) { Data($0) } + return blockData.prefix(Int(size)) + } + + return try readFileBytesFromExtents(inodeNum: inodeNum, offset: 0, count: size) + } + + /// Low-level read using extents, with explicit offset & length (in bytes). + private func readFileBytesFromExtents(inodeNum: EXT4.InodeNumber, offset: UInt64, count: UInt64) throws -> Data { + guard let extents = try self.getExtents(inode: inodeNum), !extents.isEmpty else { + return Data() + } + + // Validate all extent blocks are within device bounds + for (startBlk, endBlk) in extents { + try validateBlockAddress(startBlk) + if endBlk > startBlk { + try validateBlockAddress(endBlk - 1) + } + } + + var out = Data(capacity: Int(count)) + var logicalOffset: UInt64 = 0 + var bytesReadSuccessfully: Int = 0 + let reqStart = offset + let reqEnd = offset + count + let bs = self.blockSize + + for (startBlk, endBlk) in extents { + let extentBytes = UInt64(endBlk - startBlk) * bs + let logicalEnd = logicalOffset + extentBytes + if logicalEnd <= reqStart { + logicalOffset = logicalEnd + continue + } + if logicalOffset >= reqEnd { break } + + let ovlStart = max(logicalOffset, reqStart) + let ovlEnd = min(logicalEnd, reqEnd) + let ovlLen = ovlEnd - ovlStart + if ovlLen == 0 { + logicalOffset = logicalEnd + continue + } + + let offsetIntoExtent = ovlStart - logicalOffset + let absByteOffset = UInt64(startBlk) * bs + offsetIntoExtent + + do { + try self.handle.seek(toOffset: absByteOffset) + } catch { + if bytesReadSuccessfully > 0 { + // Return partial data that was successfully read + return out + } + throw EXT4.PathIOError.invalidPath("failed to seek to offset \(absByteOffset): \(error)") + } + + var left = ovlLen + while left > 0 { + let chunk = Int(min(left, 1 << 20)) + + do { + guard let data = try self.handle.read(upToCount: chunk) else { + let blk = UInt32(absByteOffset / bs) + throw EXT4.Error.couldNotReadBlock(blk) + } + + out.append(data) + bytesReadSuccessfully += data.count + left -= UInt64(data.count) + + if data.count < chunk && left > 0 { + // Partial read - return what we have + return out + } + } catch { + if bytesReadSuccessfully > 0 { + // Return partial data on error + return out + } + throw error + } + } + logicalOffset = logicalEnd + if out.count >= Int(count) { break } + } + if out.count > Int(count) { out.removeSubrange(Int(count).. UInt64 { + // The Containerization EXT4 Inode struct exposes mode and block fields; size fields + // are commonly named sizeLo/sizeHigh in this codebase. + // EXT4 supports 64-bit file sizes - always use both low and high parts. + let lo = UInt64(inode.sizeLow) + let hi = UInt64(inode.sizeHigh) + return lo | (hi << 32) + } +} diff --git a/Sources/ContainerizationEXT4/FilePath+Extensions.swift b/Sources/ContainerizationEXT4/FilePath+Extensions.swift new file mode 100644 index 0000000..53bcc20 --- /dev/null +++ b/Sources/ContainerizationEXT4/FilePath+Extensions.swift @@ -0,0 +1,113 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +extension FilePath { + public static let Separator: String = "/" + + public var bytes: [UInt8] { + self.withCString { cstr in + var ptr = cstr + var rawBytes: [UInt8] = [] + while UInt(bitPattern: ptr) != 0 { + if ptr.pointee == 0x00 { break } + rawBytes.append(UInt8(bitPattern: ptr.pointee)) + ptr = ptr.successor() + } + return rawBytes + } + } + + public var base: String { + self.lastComponent?.string ?? "/" + } + + public var dir: FilePath { + self.removingLastComponent() + } + + public var url: URL { + URL(fileURLWithPath: self.string) + } + + public var items: [String] { + self.components.map { $0.string } + } + + public var isRoot: Bool { // platform agnostic + self.removingRoot().isEmpty + } + + public init(_ url: URL) { + self.init(url.path(percentEncoded: false)) + } + + public func join(_ path: FilePath) -> FilePath { + self.pushing(path) + } + + public func join(_ path: String) -> FilePath { + self.join(FilePath(path)) + } + + public func split() -> (dir: FilePath, base: String) { + (self.dir, self.base) + } + + public func clean() -> FilePath { + self.lexicallyNormalized() + } + + public static func rel(_ basepath: String, _ targpath: String) -> FilePath { + let base = FilePath(basepath) + let targ = FilePath(targpath) + + if base == targ { + return "." + } + + let baseComponents = base.items + let targComponents = targ.items + + var commonPrefix = 0 + while commonPrefix < min(baseComponents.count, targComponents.count) + && baseComponents[commonPrefix] == targComponents[commonPrefix] + { + commonPrefix += 1 + } + + let upCount = baseComponents.count - commonPrefix + let relComponents = Array(repeating: "..", count: upCount) + targComponents[commonPrefix...] + + return FilePath(relComponents.joined(separator: Self.Separator)) + } +} + +extension FileHandle { + public convenience init?(forWritingTo path: FilePath) { + self.init(forWritingAtPath: path.description) + } + + public convenience init?(forReadingAtPath path: FilePath) { + self.init(forReadingAtPath: path.description) + } + + public convenience init?(forReadingFrom path: FilePath) { + self.init(forReadingAtPath: path.description) + } +} diff --git a/Sources/ContainerizationEXT4/FileTimestamps.swift b/Sources/ContainerizationEXT4/FileTimestamps.swift new file mode 100644 index 0000000..5e81924 --- /dev/null +++ b/Sources/ContainerizationEXT4/FileTimestamps.swift @@ -0,0 +1,67 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +public struct FileTimestamps { + public var access: Date + public var modification: Date + public var creation: Date + public var now: Date + + public var accessLo: UInt32 { + access.fs().lo + } + + public var accessHi: UInt32 { + access.fs().hi + } + + public var modificationLo: UInt32 { + modification.fs().lo + } + + public var modificationHi: UInt32 { + modification.fs().hi + } + + public var creationLo: UInt32 { + creation.fs().lo + } + + public var creationHi: UInt32 { + creation.fs().hi + } + + public var nowLo: UInt32 { + now.fs().lo + } + + public var nowHi: UInt32 { + now.fs().hi + } + + public init(access: Date?, modification: Date?, creation: Date?) { + now = Date() + self.access = access ?? now + self.modification = modification ?? now + self.creation = creation ?? now + } + + public init() { + self.init(access: nil, modification: nil, creation: nil) + } +} diff --git a/Sources/ContainerizationEXT4/Formatter+Unpack.swift b/Sources/ContainerizationEXT4/Formatter+Unpack.swift new file mode 100644 index 0000000..0833eb3 --- /dev/null +++ b/Sources/ContainerizationEXT4/Formatter+Unpack.swift @@ -0,0 +1,255 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationArchive +import ContainerizationExtras +import ContainerizationOS +import Foundation +import SystemPackage + +private typealias Hardlinks = [FilePath: FilePath] + +extension EXT4.Formatter { + /// Unpack the provided archive on to the ext4 filesystem. + public func unpack(reader: ArchiveReader, progress: ProgressHandler? = nil) async throws { + try await self.unpackEntries(reader: reader, progress: progress) + } + + /// Unpack an archive at the source URL on to the ext4 filesystem. + public func unpack( + source: URL, + format: ContainerizationArchive.Format = .paxRestricted, + compression: ContainerizationArchive.Filter = .gzip, + progress: ProgressHandler? = nil + ) async throws { + // For zstd, decompress once and reuse for both passes to avoid double decompression. + let fileToRead: URL + let readerFilter: ContainerizationArchive.Filter + var decompressedFile: URL? + if progress != nil && compression == .zstd { + let decompressed = try ArchiveReader.decompressZstd(source) + fileToRead = decompressed + readerFilter = .none + decompressedFile = decompressed + } else { + fileToRead = source + readerFilter = compression + } + defer { + if let decompressedFile { + ArchiveReader.cleanUpDecompressedZstd(decompressedFile) + } + } + + if let progress { + // First pass: scan headers to get totals (fast, metadata only) + let totals = try Self.scanArchiveHeaders(format: format, filter: readerFilter, file: fileToRead) + var totalEvents: [ProgressEvent] = [] + if totals.size > 0 { + totalEvents.append(.addTotalSize(totals.size)) + } + if totals.items > 0 { + totalEvents.append(.addTotalItems(totals.items)) + } + if !totalEvents.isEmpty { + await progress(totalEvents) + } + } + + // Unpack pass + let reader = try ArchiveReader( + format: format, + filter: readerFilter, + file: fileToRead + ) + try await self.unpackEntries(reader: reader, progress: progress) + } + + /// Scan archive headers to count the total number of bytes in regular files + /// and the total number of entries. + public static func scanArchiveHeaders( + format: ContainerizationArchive.Format, + filter: ContainerizationArchive.Filter, + file: URL + ) throws -> (size: Int64, items: Int) { + let reader = try ArchiveReader(format: format, filter: filter, file: file) + var totalSize: Int64 = 0 + var totalItems: Int = 0 + for (entry, _) in reader.makeStreamingIterator() { + try Task.checkCancellation() + guard entry.path != nil else { continue } + totalItems += 1 + if entry.fileType == .regular, entry.hardlink == nil, let size = entry.size { + totalSize += Int64(size) + } + } + return (size: totalSize, items: totalItems) + } + + /// Core unpack logic. When `progress` is nil the handler calls are skipped. + private func unpackEntries(reader: ArchiveReader, progress: ProgressHandler?) async throws { + var hardlinks: Hardlinks = [:] + // Allocate a single 128KiB reusable buffer for all files to minimize allocations + // and reduce the number of read calls to libarchive. + let bufferSize = 128 * 1024 + let reusableBuffer = UnsafeMutableBufferPointer.allocate(capacity: bufferSize) + defer { reusableBuffer.deallocate() } + + for (entry, streamReader) in reader.makeStreamingIterator() { + try Task.checkCancellation() + guard var pathEntry = entry.path else { + continue + } + + pathEntry = preProcessPath(s: pathEntry) + let path = FilePath(pathEntry) + + if path.base.hasPrefix(".wh.") { + if path.base == ".wh..wh..opq" { // whiteout directory + try self.unlink(path: path.dir, directoryWhiteout: true) + if let progress { + await progress([.addItems(1)]) + } + continue + } + let startIndex = path.base.index(path.base.startIndex, offsetBy: ".wh.".count) + let filePath = String(path.base[startIndex...]) + let dir: FilePath = path.dir + try self.unlink(path: dir.join(filePath)) + if let progress { + await progress([.addItems(1)]) + } + continue + } + + if let hardlink = entry.hardlink { + let hl = preProcessPath(s: hardlink) + hardlinks[path] = FilePath(hl) + if let progress { + await progress([.addItems(1)]) + } + continue + } + let ts = FileTimestamps( + access: entry.contentAccessDate, modification: entry.modificationDate, creation: entry.creationDate) + switch entry.fileType { + case .directory: + try self.create( + path: path, mode: EXT4.Inode.Mode(.S_IFDIR, UInt16(entry.permissions)), ts: ts, uid: entry.owner, + gid: entry.group, + xattrs: entry.xattrs) + case .regular: + try self.create( + path: path, mode: EXT4.Inode.Mode(.S_IFREG, UInt16(entry.permissions)), ts: ts, buf: streamReader, + uid: entry.owner, + gid: entry.group, xattrs: entry.xattrs, fileBuffer: reusableBuffer) + + if let progress, let size = entry.size { + await progress([.addSize(Int64(size))]) + } + case .symbolicLink: + var symlinkTarget: FilePath? + if let target = entry.symlinkTarget { + symlinkTarget = FilePath(target) + } + try self.create( + path: path, link: symlinkTarget, mode: EXT4.Inode.Mode(.S_IFLNK, UInt16(entry.permissions)), ts: ts, + uid: entry.owner, + gid: entry.group, xattrs: entry.xattrs) + default: + if let progress { + await progress([.addItems(1)]) + } + continue + } + + if let progress { + await progress([.addItems(1)]) + } + } + guard hardlinks.acyclic else { + throw UnpackError.circularLinks + } + for (path, _) in hardlinks { + if let resolvedTarget = try hardlinks.resolve(path) { + try self.link(link: path, target: resolvedTarget) + } + } + } + + private func preProcessPath(s: String) -> String { + var p = s + if p.hasPrefix("./") { + p = String(p.dropFirst()) + } + if !p.hasPrefix("/") { + p = "/" + p + } + return p + } +} + +/// Common errors for unpacking an archive onto an ext4 filesystem. +public enum UnpackError: Swift.Error, CustomStringConvertible, Sendable, Equatable { + /// The name is invalid. + case invalidName(_ name: String) + /// A circular link is found. + case circularLinks + + /// The description of the error. + public var description: String { + switch self { + case .invalidName(let name): + return "'\(name)' is an invalid name" + case .circularLinks: + return "circular links found" + } + } +} + +extension Hardlinks { + fileprivate var acyclic: Bool { + for (_, target) in self { + var visited: Set = [target] + var next = target + while let item = self[next] { + if visited.contains(item) { + return false + } + next = item + visited.insert(next) + } + } + return true + } + + fileprivate func resolve(_ key: FilePath) throws -> FilePath? { + let target = self[key] + guard let target else { + return nil + } + var next = target + var visited: Set = [next] + while let item = self[next] { + if visited.contains(item) { + throw UnpackError.circularLinks + } + next = item + visited.insert(next) + } + return next + } +} diff --git a/Sources/ContainerizationEXT4/Integer+Extensions.swift b/Sources/ContainerizationEXT4/Integer+Extensions.swift new file mode 100644 index 0000000..51a07de --- /dev/null +++ b/Sources/ContainerizationEXT4/Integer+Extensions.swift @@ -0,0 +1,131 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension UInt64 { + public var lo: UInt32 { + UInt32(self & 0xffff_ffff) + } + + public var hi: UInt32 { + UInt32(self >> 32) + } + + public static func - (lhs: Self, rhs: UInt32) -> UInt64 { + lhs - UInt64(rhs) + } + + public static func % (lhs: Self, rhs: UInt32) -> UInt64 { + lhs % UInt64(rhs) + } + + public static func / (lhs: Self, rhs: UInt32) -> UInt32 { + UInt32(lhs / UInt64(rhs)) + } + + public static func * (lhs: Self, rhs: UInt32) -> UInt64 { + lhs * UInt64(rhs) + } + + public static func * (lhs: Self, rhs: Int) -> UInt64 { + lhs * UInt64(rhs) + } +} + +extension UInt32 { + public var lo: UInt16 { + UInt16(self & 0xffff) + } + + public var hi: UInt16 { + UInt16(self >> 16) + } + + public static func + (lhs: Self, rhs: Int.IntegerLiteralType) -> UInt32 { + lhs + UInt32(rhs) + } + + public static func - (lhs: Self, rhs: Int.IntegerLiteralType) -> UInt32 { + lhs - UInt32(rhs) + } + + public static func / (lhs: Self, rhs: Int.IntegerLiteralType) -> UInt32 { + lhs / UInt32(rhs) + } + + public static func - (lhs: Self, rhs: UInt16) -> UInt32 { + lhs - UInt32(rhs) + } + + public static func * (lhs: Self, rhs: Int.IntegerLiteralType) -> Int { + Int(lhs) * rhs + } +} + +extension Int { + public static func + (lhs: Self, rhs: UInt32) -> Int { + lhs + Int(rhs) + } + + public static func + (lhs: Self, rhs: UInt32) -> UInt32 { + UInt32(lhs) + rhs + } +} + +extension UInt16 { + func isDir() -> Bool { + self & EXT4.FileModeFlag.TypeMask.rawValue == EXT4.FileModeFlag.S_IFDIR.rawValue + } + + func isLink() -> Bool { + self & EXT4.FileModeFlag.TypeMask.rawValue == EXT4.FileModeFlag.S_IFLNK.rawValue + } + + func isReg() -> Bool { + self & EXT4.FileModeFlag.TypeMask.rawValue == EXT4.FileModeFlag.S_IFREG.rawValue + } + + func fileType() -> UInt8 { + typealias FMode = EXT4.FileModeFlag + typealias FileType = EXT4.FileType + switch self & FMode.TypeMask.rawValue { + case FMode.S_IFREG.rawValue: + return FileType.regular.rawValue + case FMode.S_IFDIR.rawValue: + return FileType.directory.rawValue + case FMode.S_IFCHR.rawValue: + return FileType.character.rawValue + case FMode.S_IFBLK.rawValue: + return FileType.block.rawValue + case FMode.S_IFIFO.rawValue: + return FileType.fifo.rawValue + case FMode.S_IFSOCK.rawValue: + return FileType.socket.rawValue + case FMode.S_IFLNK.rawValue: + return FileType.symbolicLink.rawValue + default: + return FileType.unknown.rawValue + } + } +} + +extension [UInt8] { + var allZeros: Bool { + for num in self where num != 0 { + return false + } + return true + } +} diff --git a/Sources/ContainerizationEXT4/README.md b/Sources/ContainerizationEXT4/README.md new file mode 100644 index 0000000..8962833 --- /dev/null +++ b/Sources/ContainerizationEXT4/README.md @@ -0,0 +1,4 @@ +# ``ContainerizationEXT4`` + +`ContainerizationEXT4` provides functionality to read the superblock of an existing ext4 block device and format a new block device with +the ext4 file system. diff --git a/Sources/ContainerizationEXT4/UnsafeLittleEndianBytes.swift b/Sources/ContainerizationEXT4/UnsafeLittleEndianBytes.swift new file mode 100644 index 0000000..06d3ba4 --- /dev/null +++ b/Sources/ContainerizationEXT4/UnsafeLittleEndianBytes.swift @@ -0,0 +1,78 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CoreFoundation + +// takes a pointer and converts its contents to native endian bytes +public func withUnsafeLittleEndianBytes(of value: T, body: (UnsafeRawBufferPointer) throws -> Result) + rethrows -> Result +{ + switch Endian { + case .little: + return try withUnsafeBytes(of: value) { bytes in + try body(bytes) + } + case .big: + return try withUnsafeBytes(of: value) { buffer in + let reversedBuffer = Array(buffer.reversed()) + return try reversedBuffer.withUnsafeBytes { buf in + try body(buf) + } + } + } +} + +public func withUnsafeLittleEndianBuffer( + of value: UnsafeRawBufferPointer, body: (UnsafeRawBufferPointer) throws -> T +) rethrows -> T { + switch Endian { + case .little: + return try body(value) + case .big: + let reversed = Array(value.reversed()) + return try reversed.withUnsafeBytes { buf in + try body(buf) + } + } +} + +extension UnsafeRawBufferPointer { + // loads littleEndian raw data, converts it native endian format and calls UnsafeRawBufferPointer.load + public func loadLittleEndian(as type: T.Type) -> T { + switch Endian { + case .little: + return self.load(as: T.self) + case .big: + let buffer = Array(self.reversed()) + return buffer.withUnsafeBytes { ptr in + ptr.load(as: T.self) + } + } + } +} + +public enum Endianness { + case little + case big +} + +// returns current endianness +public var Endian: Endianness { + var value: UInt32 = 0x0102_0304 + return withUnsafeBytes(of: &value) { buffer in + buffer.first == 0x04 ? .little : .big + } +} diff --git a/Sources/ContainerizationError/ContainerizationError.swift b/Sources/ContainerizationError/ContainerizationError.swift new file mode 100644 index 0000000..2d1b36f --- /dev/null +++ b/Sources/ContainerizationError/ContainerizationError.swift @@ -0,0 +1,176 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// The core error type for Containerization. +/// +/// Most API surfaces for the core container/process/agent types will +/// return a ContainerizationError. +public struct ContainerizationError: Swift.Error, Sendable { + /// A code describing the error encountered. + public var code: Code + /// A description of the error. + public var message: String + /// The original error which led to this error being thrown. + public var cause: (any Error)? + + /// Creates a new error. + /// + /// - Parameters: + /// - code: The error code. + /// - message: A description of the error. + /// - cause: The original error which led to this error being thrown. + public init(_ code: Code, message: String, cause: (any Error)? = nil) { + self.code = code + self.message = message + self.cause = cause + } + + /// Creates a new error. + /// + /// - Parameters: + /// - rawCode: The error code value as a String. + /// - message: A description of the error. + /// - cause: The original error which led to this error being thrown. + public init(_ rawCode: String, message: String, cause: (any Error)? = nil) { + self.code = Code(rawValue: rawCode) + self.message = message + self.cause = cause + } + + /// Provides a unique hash of the error. + public func hash(into hasher: inout Hasher) { + hasher.combine(self.code) + hasher.combine(self.message) + } + + /// Equality operator for the error. Uses the code and message. + public static func == (lhs: Self, rhs: Self) -> Bool { + lhs.code == rhs.code && lhs.message == rhs.message + } + + /// Checks if the given error has the provided code. + public func isCode(_ code: Code) -> Bool { + self.code == code + } +} + +extension ContainerizationError: CustomStringConvertible { + /// Description of the error. + public var description: String { + guard let cause = self.cause else { + return "\(self.code): \"\(self.message)\"" + } + return "\(self.code): \"\(self.message)\" (cause: \"\(cause)\")" + } +} + +extension ContainerizationError: LocalizedError { + /// A localized message describing what error occurred. + public var errorDescription: String? { + guard let cause = self.cause else { + return message + } + return "\(message) (cause: \"\(cause)\")" + } +} + +extension ContainerizationError { + /// Codes for a `ContainerizationError`. + public struct Code: Sendable, Hashable { + private enum Value: Hashable, Sendable, CaseIterable { + case unknown + case invalidArgument + case internalError + case exists + case notFound + case cancelled + case invalidState + case empty + case timeout + case unsupported + case interrupted + } + + private var value: Value + private init(_ value: Value) { + self.value = value + } + + init(rawValue: String) { + let values = Value.allCases.reduce(into: [String: Value]()) { + $0[String(describing: $1)] = $1 + } + + let match = values[rawValue] + guard let match else { + fatalError("invalid code value \(rawValue)") + } + self.value = match + } + + public static var unknown: Self { + Self(.unknown) + } + + public static var invalidArgument: Self { + Self(.invalidArgument) + } + + public static var internalError: Self { + Self(.internalError) + } + + public static var exists: Self { + Self(.exists) + } + + public static var notFound: Self { + Self(.notFound) + } + + public static var cancelled: Self { + Self(.cancelled) + } + + public static var invalidState: Self { + Self(.invalidState) + } + + public static var empty: Self { + Self(.empty) + } + + public static var timeout: Self { + Self(.timeout) + } + + public static var unsupported: Self { + Self(.unsupported) + } + + public static var interrupted: Self { + Self(.interrupted) + } + } +} + +extension ContainerizationError.Code: CustomStringConvertible { + public var description: String { + String(describing: self.value) + } +} diff --git a/Sources/ContainerizationExtras/AddressAllocator.swift b/Sources/ContainerizationExtras/AddressAllocator.swift new file mode 100644 index 0000000..712aab5 --- /dev/null +++ b/Sources/ContainerizationExtras/AddressAllocator.swift @@ -0,0 +1,65 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Conforming objects can allocate and free various address types. +public protocol AddressAllocator: Sendable { + associatedtype AddressType: Sendable + + /// Allocate a new address. + func allocate() throws -> AddressType + + /// Attempt to reserve a specific address. + func reserve(_ address: AddressType) throws + + /// Free an allocated address. + func release(_ address: AddressType) throws + + /// If no addresses are allocated, prevent future allocations and return true. + func disableAllocator() -> Bool +} + +/// Errors that a type implementing AddressAllocator should throw. +public enum AllocatorError: Swift.Error, CustomStringConvertible, Equatable { + case allocatorDisabled + case allocatorFull + case alreadyAllocated(_ address: String) + case invalidAddress(_ index: String) + case invalidArgument(_ msg: String) + case invalidIndex(_ index: Int) + case notAllocated(_ address: String) + case rangeExceeded + + public var description: String { + switch self { + case .allocatorDisabled: + return "the allocator is shutting down" + case .allocatorFull: + return "no free indices are available for allocation" + case .alreadyAllocated(let address): + return "cannot choose already-allocated address \(address)" + case .invalidAddress(let address): + return "cannot create index using address \(address)" + case .invalidArgument(let msg): + return "invalid argument: \(msg)" + case .invalidIndex(let index): + return "cannot create address using index \(index)" + case .notAllocated(let address): + return "cannot free unallocated address \(address)" + case .rangeExceeded: + return "cannot create allocator that overflows maximum address value" + } + } +} diff --git a/Sources/ContainerizationExtras/AddressError.swift b/Sources/ContainerizationExtras/AddressError.swift new file mode 100644 index 0000000..dda7cd9 --- /dev/null +++ b/Sources/ContainerizationExtras/AddressError.swift @@ -0,0 +1,66 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +public struct AddressError: Error, Equatable, Hashable, CustomStringConvertible { + public var description: String { + String(describing: self.base) + } + + @usableFromInline + enum Base: Equatable, Hashable, Sendable { + case unableToParse + case invalidZoneIdentifier + case invalidIPv4Suffix + case multipleEllipsis + case invalidHexGroup + case malformedAddress + case incompleteAddress + } + + @usableFromInline + let base: Base + + @inlinable + init(_ base: Base) { self.base = base } + + public static var unableToParse: Self { + Self(.unableToParse) + } + + public static var invalidZoneIdentifier: Self { + Self(.invalidZoneIdentifier) + } + + public static var invalidIPv4SuffixInIPv6Address: Self { + Self(.invalidIPv4Suffix) + } + + public static var multipleEllipsis: Self { + Self(.multipleEllipsis) + } + + public static var invalidHexGroup: Self { + Self(.invalidHexGroup) + } + + public static var malformedAddress: Self { + Self(.malformedAddress) + } + + public static var incompleteAddress: Self { + Self(.incompleteAddress) + } +} diff --git a/Sources/ContainerizationExtras/AsyncLock.swift b/Sources/ContainerizationExtras/AsyncLock.swift new file mode 100644 index 0000000..a3c14b4 --- /dev/null +++ b/Sources/ContainerizationExtras/AsyncLock.swift @@ -0,0 +1,61 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Logging + +/// `AsyncLock` provides a familiar locking API, with the main benefit being that it +/// is safe to call async methods while holding the lock. This is primarily used in spots +/// where an actor makes sense, but we may need to ensure we don't fall victim to actor +/// reentrancy issues. +public actor AsyncLock { + private var busy = false + private var queue: ArraySlice> = [] + private var log: Logger? + + public struct Context: Sendable { + fileprivate init() {} + } + + public init(log: Logger? = nil) { + self.log = log + } + + /// withLock provides a scoped locking API to run a function while holding the lock. + public func withLock(logMetadata: Logger.Metadata? = nil, _ body: @Sendable @escaping (Context) async throws -> T) async rethrows -> T { + log?.debug("acquiring lock", metadata: logMetadata) + while self.busy { + await withCheckedContinuation { cc in + self.queue.append(cc) + } + } + + self.busy = true + + defer { + self.busy = false + if let next = self.queue.popFirst() { + next.resume(returning: ()) + } else { + self.queue = [] + } + } + + log?.debug("holding lock", metadata: logMetadata) + defer { log?.debug("releasing lock", metadata: logMetadata) } + let context = Context() + return try await body(context) + } +} diff --git a/Sources/ContainerizationExtras/AsyncMutex.swift b/Sources/ContainerizationExtras/AsyncMutex.swift new file mode 100644 index 0000000..83652de --- /dev/null +++ b/Sources/ContainerizationExtras/AsyncMutex.swift @@ -0,0 +1,59 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// `AsyncMutex` provides a mutex that protects a piece of data, with the main benefit being that it +/// is safe to call async methods while holding the lock. This is primarily used in spots +/// where an actor makes sense, but we may need to ensure we don't fall victim to actor +/// reentrancy issues. +public actor AsyncMutex { + private final class Box: @unchecked Sendable { + var value: T + init(_ value: T) { + self.value = value + } + } + + private var busy = false + private var queue: ArraySlice> = [] + private let box: Box + + public init(_ initialValue: T) { + self.box = Box(initialValue) + } + + /// withLock provides a scoped locking API to run a function while holding the lock. + /// The protected value is passed to the closure for safe access. + public func withLock(_ body: @Sendable @escaping (inout T) async throws -> R) async rethrows -> R { + while self.busy { + await withCheckedContinuation { cc in + self.queue.append(cc) + } + } + + self.busy = true + + defer { + self.busy = false + if let next = self.queue.popFirst() { + next.resume(returning: ()) + } else { + self.queue = [] + } + } + + return try await body(&self.box.value) + } +} diff --git a/Sources/ContainerizationExtras/CIDR.swift b/Sources/ContainerizationExtras/CIDR.swift new file mode 100644 index 0000000..8b562ec --- /dev/null +++ b/Sources/ContainerizationExtras/CIDR.swift @@ -0,0 +1,148 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Describes an IPv4 or IPv6 CIDR address block. +@frozen +public enum CIDR: CustomStringConvertible, Equatable, Sendable, Hashable { + + case v4(IPv4Address, Prefix) + case v6(IPv6Address, Prefix) + + /// Create a CIDR address block. + public init(_ cidr: String) throws { + if let cidrV4 = try? CIDRv4(cidr) { + self = .v4(cidrV4.address, cidrV4.prefix) + } else if let cidrV6 = try? CIDRv6(cidr) { + self = .v6(cidrV6.address, cidrV6.prefix) + } else { + throw Error.invalidCIDR(cidr: cidr) + } + } + + /// Create a CIDR address from a member IP and a prefix length. + public init(_ address: IPAddress, prefix: Prefix) throws { + switch address { + case .v4(let addr): + guard prefix.length <= 32 else { + throw Error.invalidCIDR(cidr: "\(address)/\(prefix)") + } + self = .v4(addr, prefix) + case .v6(let addr): + guard prefix.length <= 128 else { + throw Error.invalidCIDR(cidr: "\(address)/\(prefix)") + } + self = .v6(addr, prefix) + } + } + + /// Create the smallest CIDR block that includes the lower and upper bounds. + /// + /// For type-safe construction, prefer `v4Range(lower:upper:)` or `v6Range(lower:upper:)`. + public init(lower: IPAddress, upper: IPAddress) throws { + switch (lower, upper) { + case (.v4(let lowerAddr), .v4(let upperAddr)): + let cidr = try CIDRv4(lower: lowerAddr, upper: upperAddr) + self = .v4(cidr.address, cidr.prefix) + case (.v6(let lowerAddr), .v6(let upperAddr)): + let cidr = try CIDRv6(lower: lowerAddr, upper: upperAddr) + self = .v6(cidr.address, cidr.prefix) + default: + throw Error.invalidAddressRange(lower: lower.description, upper: upper.description) + } + } + + /// The IP component of this CIDR address. + @inlinable + public var address: IPAddress { + switch self { + case .v4(let addr, _): + return .v4(addr) + case .v6(let addr, _): + return .v6(addr) + } + } + + /// The prefix length of this CIDR address. + @inlinable + public var prefix: Prefix { + switch self { + case .v4(_, let prefix), .v6(_, let prefix): + return prefix + } + } + + /// The lowest address in this CIDR block + @inlinable + public var lower: IPAddress { + switch self { + case (.v4(let addr, let prefix)): + return .v4(IPv4Address(addr.value & prefix.prefixMask32)) + case (.v6(let addr, let prefix)): + return .v6(IPv6Address(addr.value & prefix.prefixMask128)) + } + } + + /// The highest address in this CIDR block (broadcast address). + @inlinable + public var upper: IPAddress { + switch self { + case .v4(let addr, let prefix): + return .v4(IPv4Address(addr.value | prefix.suffixMask32)) + case .v6(let addr, let prefix): + return .v6(IPv6Address(addr.value | prefix.suffixMask128, zone: addr.zone)) + } + } + + /// Return true if the CIDR block contains the specified address. + /// + /// Compares network portion of the given IP address. + @inlinable + public func contains(_ ip: IPAddress) -> Bool { + switch (self, ip) { + case (.v4(let network, let prefix), .v4(let ip)): + return network.value == (ip.value & prefix.prefixMask32) + case (.v6(let network, let prefix), .v6(let ip)): + return (network.zone == ip.zone) && (network.value == (ip.value & prefix.prefixMask128)) + default: + return false + } + } + + /// Retrieve the text representation of the CIDR block. + public var description: String { + "\(address)/\(prefix)" + } +} + +extension CIDR { + public enum Error: Swift.Error { + case invalidCIDR(cidr: String) + case invalidAddressRange(lower: String, upper: String) + } +} + +extension CIDR: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/CIDRv4.swift b/Sources/ContainerizationExtras/CIDRv4.swift new file mode 100644 index 0000000..d7823b0 --- /dev/null +++ b/Sources/ContainerizationExtras/CIDRv4.swift @@ -0,0 +1,122 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Describes an IPv4 CIDR address block. +@frozen +public struct CIDRv4: CustomStringConvertible, Equatable, Sendable, Hashable { + /// The IP component of this CIDR address. + public let address: IPv4Address + + /// The prefix length of this CIDR address. + public let prefix: Prefix + + /// Create a CIDR address block. + public init(_ cidr: String) throws { + let split = cidr.split(separator: "/") + guard split.count == 2 else { + throw CIDR.Error.invalidCIDR(cidr: cidr) + } + guard let prefixLength = UInt8(split[1]), let prefix = Prefix(length: prefixLength) else { + throw CIDR.Error.invalidCIDR(cidr: cidr) + } + + let address = try IPv4Address(String(split[0])) + try self.init(address, prefix: prefix) + } + + /// Create a CIDR address from a member IP and a prefix length. + public init(_ address: IPv4Address, prefix: Prefix) throws { + guard prefix.length <= 32 else { + throw CIDR.Error.invalidCIDR(cidr: "\(address)/\(prefix)") + } + self.address = address + self.prefix = prefix + } + + /// Create the smallest IPv4 CIDR block that includes the lower and upper bounds. + /// + /// - Parameters: + /// - lower: The lower bound IPv4 address + /// - upper: The upper bound IPv4 address + /// - Returns: The smallest CIDR block containing both addresses + /// - Throws: If lower > upper + public init(lower: IPv4Address, upper: IPv4Address) throws { + guard lower.value <= upper.value else { + throw CIDR.Error.invalidAddressRange(lower: lower.description, upper: upper.description) + } + + for length in 1...32 { + let prefixLength = Prefix(unchecked: UInt8(length)) + let mask = prefixLength.prefixMask32 + if (lower.value & mask) != (upper.value & mask) { + let prefix = Prefix(unchecked: UInt8(length - 1)) + let networkAddr = IPv4Address(lower.value & prefix.prefixMask32) + try self.init(networkAddr, prefix: prefix) + return + } + } + // Same address - /32 block + let prefix = Prefix(unchecked: 32) + let networkAddr = IPv4Address(lower.value & prefix.prefixMask32) + try self.init(networkAddr, prefix: prefix) + } + + /// The lowest address in this CIDR block + @inlinable + public var lower: IPv4Address { + IPv4Address(address.value & prefix.prefixMask32) + } + + /// The highest address in this CIDR block (broadcast address). + @inlinable + public var upper: IPv4Address { + IPv4Address(address.value | prefix.suffixMask32) + } + + /// Return true if the CIDR block contains the specified address. + /// + /// Compares network portion of the given IP address. + @inlinable + public func contains(_ ip: IPv4Address) -> Bool { + (address.value & prefix.prefixMask32) == (ip.value & prefix.prefixMask32) + } + + /// Retrieve the text representation of the CIDR block. + public var description: String { + "\(address)/\(prefix)" + } +} + +extension CIDRv4: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} + +extension CIDRv4 { + /// The gateway address of the network. Conventionally the first usable + /// address in the subnet (`lower + 1`). + public var gateway: IPv4Address { + IPv4Address(self.lower.value + 1) + } +} diff --git a/Sources/ContainerizationExtras/CIDRv6.swift b/Sources/ContainerizationExtras/CIDRv6.swift new file mode 100644 index 0000000..b336124 --- /dev/null +++ b/Sources/ContainerizationExtras/CIDRv6.swift @@ -0,0 +1,115 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Describes an IPv4 or IPv6 CIDR address block. +@frozen +public struct CIDRv6: CustomStringConvertible, Equatable, Sendable, Hashable { + + /// The IP component of this CIDR address. + public let address: IPv6Address + + /// The prefix length of this CIDR address. + public let prefix: Prefix + + /// Create a CIDR address block. + public init(_ cidr: String) throws { + let split = cidr.split(separator: "/") + guard split.count == 2 else { + throw CIDR.Error.invalidCIDR(cidr: cidr) + } + guard let prefixLength = UInt8(split[1]), let prefix = Prefix(length: prefixLength) else { + throw CIDR.Error.invalidCIDR(cidr: cidr) + } + + let address = try IPv6Address(String(split[0])) + try self.init(address, prefix: prefix) + } + + /// Create a CIDR address from a member IP and a prefix length. + public init(_ address: IPv6Address, prefix: Prefix) throws { + guard prefix.length <= 128 else { + throw CIDR.Error.invalidCIDR(cidr: "\(address)/\(prefix)") + } + self.address = address + self.prefix = prefix + } + + /// Create the smallest IPv6 CIDR block that includes the lower and upper bounds. + /// + /// - Parameters: + /// - lower: The lower bound IPv6 address + /// - upper: The upper bound IPv6 address + /// - Returns: The smallest CIDR block containing both addresses + /// - Throws: If lower > upper or zones don't match + public init(lower: IPv6Address, upper: IPv6Address) throws { + guard lower.value <= upper.value && lower.zone == upper.zone else { + throw CIDR.Error.invalidAddressRange(lower: lower.description, upper: upper.description) + } + + for length in 1...128 { + let prefixLength = Prefix(unchecked: UInt8(length)) + let mask = prefixLength.prefixMask128 + if (lower.value & mask) != (upper.value & mask) { + let prefix = Prefix(unchecked: UInt8(length - 1)) + let networkAddr = IPv6Address(lower.value & prefix.prefixMask128, zone: lower.zone) + try self.init(networkAddr, prefix: prefix) + return + } + } + // Same address - /128 block + let prefix = Prefix(unchecked: 128) + let networkAddr = IPv6Address(lower.value & prefix.prefixMask128, zone: lower.zone) + try self.init(networkAddr, prefix: prefix) + } + + /// The lowest address in this CIDR block + @inlinable + public var lower: IPv6Address { + IPv6Address(address.value & prefix.prefixMask128) + } + + /// The highest address in this CIDR block (broadcast address). + @inlinable + public var upper: IPv6Address { + IPv6Address(address.value | prefix.suffixMask128, zone: address.zone) + } + + /// Return true if the CIDR block contains the specified address. + /// + /// Compares network portion of the given IP address. + @inlinable + public func contains(_ ip: IPv6Address) -> Bool { + (address.zone == ip.zone) && ((address.value & prefix.prefixMask128) == (ip.value & prefix.prefixMask128)) + } + + /// Retrieve the text representation of the CIDR block. + public var description: String { + "\(address)/\(prefix)" + } +} + +extension CIDRv6: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/FileManager+Temporary.swift b/Sources/ContainerizationExtras/FileManager+Temporary.swift new file mode 100644 index 0000000..d03acdf --- /dev/null +++ b/Sources/ContainerizationExtras/FileManager+Temporary.swift @@ -0,0 +1,29 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension FileManager { + /// Returns a unique temporary directory to use. + public func uniqueTemporaryDirectory(create: Bool = true) -> URL { + let tempDirectoryURL = temporaryDirectory + let uniqueDirectoryURL = tempDirectoryURL.appendingPathComponent(UUID().uuidString) + if create { + try? createDirectory(at: uniqueDirectoryURL, withIntermediateDirectories: true, attributes: nil) + } + return uniqueDirectoryURL + } +} diff --git a/Sources/ContainerizationExtras/IPAddress.swift b/Sources/ContainerizationExtras/IPAddress.swift new file mode 100644 index 0000000..8b40f16 --- /dev/null +++ b/Sources/ContainerizationExtras/IPAddress.swift @@ -0,0 +1,148 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// Represents an IP address that can be either IPv4 or IPv6. +@frozen +public enum IPAddress: Sendable, Hashable, CustomStringConvertible, Equatable { + /// An IPv4 address + case v4(IPv4Address) + + /// An IPv6 address + case v6(IPv6Address) + + /// Parses an IP address string, automatically detecting IPv4 or IPv6 format. + /// + /// - Parameter string: IP address string to parse + /// - Returns: An `IPAddress` containing either an IPv4 or IPv6 address + /// - Throws: `AddressError.unableToParse` if invalid + public init(_ string: String) throws { + let utf8 = string.utf8 + var hasColon = false + var hasDot = false + + for byte in utf8 { + if byte == 58 { // ASCII ':' + hasColon = true + break + } + if byte == 46 { // ASCII '.' + hasDot = true + } + } + + if hasColon { + let ipv6 = try IPv6Address.parse(string) + self = .v6(ipv6) + } else if hasDot { + let ipv4 = try IPv4Address(string) + self = .v4(ipv4) + } else { + throw AddressError.unableToParse + } + } + + /// String representation of the IP address. + public var description: String { + switch self { + case .v4(let addr): + return addr.description + case .v6(let addr): + return addr.description + } + } + + /// Returns `true` if this is an IPv4 address. + @inlinable + public var isV4: Bool { + if case .v4 = self { + return true + } + return false + } + + /// Returns `true` if this is an IPv6 address. + @inlinable + public var isV6: Bool { + if case .v6 = self { + return true + } + return false + } + + /// Returns the underlying IPv4 address if this is an IPv4 address, otherwise `nil`. + @inlinable + public var ipv4: IPv4Address? { + if case .v4(let addr) = self { + return addr + } + return nil + } + + /// Returns the underlying IPv6 address if this is an IPv6 address, otherwise `nil`. + @inlinable + public var ipv6: IPv6Address? { + if case .v6(let addr) = self { + return addr + } + return nil + } + + /// Returns `true` if this is a loopback address (127.0.0.0/8 or ::1). + @inlinable + public var isLoopback: Bool { + switch self { + case .v4(let addr): + return addr.isLoopback + case .v6(let addr): + return addr.isLoopback + } + } + + /// Returns `true` if this is a multicast address. + @inlinable + public var isMulticast: Bool { + switch self { + case .v4(let addr): + return addr.isMulticast + case .v6(let addr): + return addr.isMulticast + } + } + + /// Returns `true` if this is an unspecified address (0.0.0.0 or ::). + @inlinable + public var isUnspecified: Bool { + switch self { + case .v4(let addr): + return addr.isUnspecified + case .v6(let addr): + return addr.isUnspecified + } + } +} + +extension IPAddress: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/IPv4Address.swift b/Sources/ContainerizationExtras/IPv4Address.swift new file mode 100644 index 0000000..eb7546b --- /dev/null +++ b/Sources/ContainerizationExtras/IPv4Address.swift @@ -0,0 +1,250 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +@frozen +public struct IPv4Address: Sendable, Hashable, CustomStringConvertible, Equatable, Comparable { + public let value: UInt32 + + /// Creates an IPv4Address from an unsigned integer. + /// + /// - Parameter string: The integer representation of the address. + @inlinable + public init(_ value: UInt32) { + self.value = value + } + + /// Creates an IPv4Address from 4 bytes. + /// + /// - Parameters: + /// - bytes: 4-byte array in network byte order representing the IPv4 address + /// - Throws: `AddressError.unableToParse` if the byte array length is not 4 + @inlinable + public init(_ bytes: [UInt8]) throws { + guard bytes.count == 4 else { + throw AddressError.unableToParse + } + self.value = + (UInt32(bytes[0]) << 24) + | (UInt32(bytes[1]) << 16) + | (UInt32(bytes[2]) << 8) + | UInt32(bytes[3]) + } + + /// Creates an IPv4Address from a string representation. + /// + /// - Parameter string: The IPv4 address string in dotted decimal notation (e.g., "192.168.1.1") + /// - Throws: `AddressError.unableToParse` if the string is not a valid IPv4 address + @inlinable + public init(_ string: String) throws { + self.value = try Self.parse(string) + } + + @inlinable + public var bytes: [UInt8] { + Self.bytes(value) + } + + @usableFromInline + static func bytes(_ value: UInt32) -> [UInt8] { + var result = [UInt8](repeating: 0, count: 4) + result[0] = UInt8((value >> 24) & 0xff) + result[1] = UInt8((value >> 16) & 0xff) + result[2] = UInt8((value >> 8) & 0xff) + result[3] = UInt8(value & 0xff) + return result + } + + // TODO: spans? + @available(macOS 26.0, *) + @usableFromInline + static func bytes(_ value: UInt32) -> InlineArray<4, UInt8> { + let result: InlineArray<4, UInt8> = [ + UInt8((value >> 24) & 0xff), + UInt8((value >> 16) & 0xff), + UInt8((value >> 8) & 0xff), + UInt8(value & 0xff), + ] + return result + } + + @inlinable + public var description: String { + "\(bytes[0]).\(bytes[1]).\(bytes[2]).\(bytes[3])" + } + + /// Parses an IPv4 address string in dotted decimal notation into a UInt32 representation. + /// + /// ## Validation Rules + /// - Exactly 4 octets separated by dots + /// - Each octet must be 0-255 + /// - No leading zeros (except for "0" itself) + /// - No whitespace characters + /// - Only digits and dots allowed + /// + /// ## Examples + /// ```swift + /// IPv4Address.parse("192.168.1.1") // Returns: 3232235777 + /// IPv4Address.parse("127.0.0.1") // Returns: 2130706433 + /// IPv4Address.parse("0.0.0.0") // Returns: 0 + /// IPv4Address.parse("255.255.255.255") // Returns: 4294967295 + /// + /// // Invalid examples: + /// IPv4Address.parse("192.168.1") // Wrong number of octets + /// IPv4Address.parse("192.168.1.256") // Octet out of range + /// IPv4Address.parse("192.168.001.1") // Leading zeros + /// IPv4Address.parse(" 192.168.1.1 ") // Whitespace + /// ``` + /// + /// - Parameter s: The IPv4 address string to parse + /// - Returns: The 32-bit representation of the IP address, or `nil` if parsing fails + /// - Note: The returned value is in network byte order (big-endian) + @usableFromInline + internal static func parse(_ s: String) throws -> UInt32 { + guard !s.isEmpty, s.count >= 7, s.count <= 15 else { + throw AddressError.unableToParse + } + + // IP addresses should only contain ASCII digits and dots + let utf8 = s.utf8 + for byte in utf8 { + // ASCII whitespace: space(32), tab(9), newline(10), return(13) + if byte == 32 || byte == 9 || byte == 10 || byte == 13 { + throw AddressError.unableToParse + } + } + + // accumulator for the 32bit representation of the IPv4 address + var result: UInt32 = 0 + + // tracking octet count, max 4 allowed + var octetCount = 0 + var currentOctet = 0 + + // number of digits in the string representation of the octet, max 3 + var digitCount = 0 + + for byte in utf8 { + if byte == 46 { // ASCII '.' + // Validate octet before processing + guard octetCount < 3, digitCount > 0, digitCount <= 3, currentOctet <= 255 else { + throw AddressError.unableToParse + } + + // Shift result and add current octet + result = (result << 8) | UInt32(currentOctet) + + // Reset for next octet + octetCount += 1 + currentOctet = 0 + digitCount = 0 + + } else if byte >= 48 && byte <= 57 { // ASCII '0'-'9' + let digit = Int(byte - 48) + + digitCount += 1 + + // Check for invalid leading zeros: "01", "001", etc. + // Allow single "0" but reject multi-digit numbers starting with 0 + if digitCount == 1 && digit == 0 { + // First digit is 0 - this is only valid if it's the only digit + currentOctet = 0 + } else if digitCount > 1 && currentOctet == 0 { + // We had a leading zero and now have more digits - invalid + throw AddressError.unableToParse + } else { + // Normal case: build the octet value + currentOctet = currentOctet * 10 + digit + } + + // Early termination if octet becomes too large + guard currentOctet <= 255, digitCount <= 3 else { + throw AddressError.unableToParse + } + + } else { + throw AddressError.unableToParse + } + } + + // Validate final octet + guard octetCount == 3, digitCount > 0, digitCount <= 3, currentOctet <= 255 else { + throw AddressError.unableToParse + } + + return (result << 8) | UInt32(currentOctet) + } + + // MARK: - Address Classification Methods + + /// Returns `true` if this is the unspecified address (0.0.0.0). + /// + /// Per RFC 791, 0.0.0.0 is the "this network" address. + @inlinable + public var isUnspecified: Bool { + value == 0 + } + + /// Returns `true` if this is a loopback address (127.0.0.0/8). + /// + /// Per RFC 1122 Section 3.2.1.3, the entire 127.0.0.0/8 block is reserved for loopback. + @inlinable + public var isLoopback: Bool { + (value & 0xFF00_0000) == 0x7F00_0000 + } + + /// Returns `true` if this is a multicast address (224.0.0.0/4). + /// + /// Per RFC 1112, addresses in the range 224.0.0.0 to 239.255.255.255 are multicast addresses. + @inlinable + public var isMulticast: Bool { + (value & 0xF000_0000) == 0xE000_0000 + } + + /// Returns `true` if this is a link-local address (169.254.0.0/16). + /// + /// Per RFC 3927, 169.254.0.0/16 is reserved for link-local addresses (APIPA/Auto-IP). + @inlinable + public var isLinkLocal: Bool { + (value & 0xFFFF_0000) == 0xA9FE_0000 + } + + /// Returns `true` if this is the limited broadcast address (255.255.255.255). + /// + /// Per RFC 919/922, 255.255.255.255 is the limited broadcast address. + @inlinable + public var isBroadcast: Bool { + value == 0xFFFF_FFFF + } + + /// Compares two IPv4 addresses numerically. + @inlinable + public static func < (lhs: IPv4Address, rhs: IPv4Address) -> Bool { + lhs.value < rhs.value + } +} + +extension IPv4Address: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/IPv6Address+Parse.swift b/Sources/ContainerizationExtras/IPv6Address+Parse.swift new file mode 100644 index 0000000..f6793f7 --- /dev/null +++ b/Sources/ContainerizationExtras/IPv6Address+Parse.swift @@ -0,0 +1,333 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension IPv6Address { + /// Parses an IPv6 address string into an IPv6Address instance. + /// + /// Follows RFC 4291 and RFC 5952. + /// + /// This function supports standard IPv6 notation including: + /// - Full addresses: `2001:0db8:0000:0042:0000:8a2e:0370:7334` + /// - Zero compression: `2001:db8::8a2e:370:7334` + /// - Leading zero omission: `2001:db8:0:42:0:8a2e:370:7334` + /// - Unspecified address: `::` + /// - Zone identifiers: `fe80::1%eth0` + /// + /// - Parameter input: IPv6 address string (with optional zone identifier after %) + /// - Returns: An `IPv6Address` instance representing the parsed address + /// + /// ## Example Usage + /// ```swift + /// let addr1 = try IPv6Address.parse("2001:db8::1") + /// let addr2 = try IPv6Address.parse("::") // Unspecified address + /// let addr3 = try IPv6Address.parse("fe80::1%eth0") // With zone identifier + /// ``` + static func parse(_ input: String) throws -> IPv6Address { + var ipBytes = [UInt8](repeating: 0, count: 16) + var ellipsisPosition: Int? + + // Extract zone identifier + let (address, zone) = try extractZoneIdentifier(from: input) + + // RFC 4291 Section 2.2.3: IPv4 suffix must be at the end (last 32 bits) + var remainingAddress = address + var ipv6ByteLimit = 16 // Maximum bytes available for IPv6 hex groups + var hasIPv4Suffix = false + + // check if the IPv6 address has IPv4 address in it. + if let (ipv6Part, ipv4Bytes) = try extractIPv4Suffix(from: address) { + // If IPv4 present, save directly to last 4 bytes. + ipBytes[12] = ipv4Bytes[0] + ipBytes[13] = ipv4Bytes[1] + ipBytes[14] = ipv4Bytes[2] + ipBytes[15] = ipv4Bytes[3] + + // Update address and limit IPv6 parsing to first 12 bytes (6 groups max) + remainingAddress = ipv6Part + ipv6ByteLimit = 12 + hasIPv4Suffix = true + } + + // Handle leading ellipsis in the IPv6 part + if remainingAddress.utf8.starts(with: [58, 58]) { // "::" + ellipsisPosition = 0 + remainingAddress = String(remainingAddress.dropFirst(2)) + + // Special case: "::" represents the unspecified address (all zeros) + // But if we have IPv4 suffix, the IPv4 bytes are already set correctly + if remainingAddress.isEmpty { + // If we have IPv4 suffix, ipBytes already has the IPv4 data, just return + if hasIPv4Suffix { + return try Self(ipBytes, zone: zone) + } + + // Pure "::" - Return the unspecified address, handling zone identifiers + if let zone = zone, !zone.isEmpty { + return try Self(ipBytes, zone: zone) + } + return .unspecified + } + } + + // Parse IPv6 hex groups up to the byte limit + var byteIndex = 0 + let utf8 = remainingAddress.utf8 + var currentPosition = utf8.startIndex + + while byteIndex < ipv6ByteLimit && currentPosition < utf8.endIndex { + let (hexValue, nextPosition) = try parseHexadecimal( + from: utf8, + startingAt: currentPosition + ) + + // Store the UInt16 in network-byte order + ipBytes[byteIndex] = UInt8(hexValue >> 8) + ipBytes[byteIndex + 1] = UInt8(hexValue & 0xFF) + byteIndex += 2 + currentPosition = nextPosition + + // Terminate early if we have consumed the whole string + if currentPosition == utf8.endIndex { + break + } + + // Parse separator and handle ellipsis detection + currentPosition = try skipColonSeparator( + from: utf8, + at: currentPosition, + currentByteIndex: byteIndex, + ellipsisPosition: &ellipsisPosition + ) + } + + // Validate complete consumption of input + guard currentPosition >= utf8.endIndex else { + throw AddressError.malformedAddress + } + + // Apply ellipsis expansion for the IPv6 portion + try expandEllipsis( + in: &ipBytes, + parsedBytes: byteIndex, + ellipsisPosition: ellipsisPosition, + byteLimit: ipv6ByteLimit + ) + let value = ipBytes.reduce(UInt128(0)) { ($0 << 8) | UInt128($1) } + return Self(value, zone: zone) + } + + // MARK: - Helper Functions + + /// Extracts IPv4 suffix if present at the end of the address + /// + /// Follows: RFC 4291 Section 2.2.3: Alternative form x:x:x:x:x:x:d.d.d.d + /// IPv4 must be the last 32 bits and preceded by a colon + /// + /// - Parameter input: The IPv6 address string to check + /// - Returns: Optional tuple of (IPv6 part without IPv4, IPv4 bytes array) if IPv4 found, nil otherwise + /// - Throws: `AddressError.invalidIPv4Suffix` for invalid IPv4 addresses + internal static func extractIPv4Suffix(from input: String) throws -> (String, [UInt8])? { + // must contain a dot to be IPv4 + guard input.utf8.contains(46) else { // ASCII '.' + return nil + } + + // IPv4 address must be present after last colon + guard let lastColonIndex = input.lastIndex(of: ":") else { + return nil + } + + // TODO: maybe refactor for performance + let afterColon = input.index(after: lastColonIndex) + guard afterColon < input.endIndex else { + return nil + } + + let possibleIPv4 = String(input[afterColon...]) + guard let ipv4Value = try? IPv4Address.parse(possibleIPv4) else { + throw AddressError.invalidIPv4SuffixInIPv6Address + } + + // Check if lastColonIndex is the second ':' of '::'. If so, ensure to include it. + let isDoubleColon = lastColonIndex > input.startIndex && input[input.index(before: lastColonIndex)] == ":" + let ipv6Part = isDoubleColon ? String(input[...lastColonIndex]) : String(input[.. (String, String?) { + guard let percentIndex = input.lastIndex(of: "%") else { + return (input, nil) + } + + let zoneStartIndex = input.index(after: percentIndex) + guard zoneStartIndex < input.endIndex else { + throw AddressError.invalidZoneIdentifier + } + + let addressPart = String(input[.. (UInt16, String.UTF8View.Index) { + var accumulator: UInt16 = 0 + var digitCount = 0 + var currentIndex = startIndex + + while currentIndex < group.endIndex && digitCount < 4 { + let byte = group[currentIndex] + + // Fast hex digit parsing using ASCII values + let hexValue: UInt16 + if byte >= 48 && byte <= 57 { // '0'-'9' + hexValue = UInt16(byte - 48) + } else if byte >= 65 && byte <= 70 { // 'A'-'F' + hexValue = UInt16(byte - 65 + 10) + } else if byte >= 97 && byte <= 102 { // 'a'-'f' + hexValue = UInt16(byte - 97 + 10) + } else { + break // Not a hex digit + } + + accumulator = (accumulator << 4) + hexValue + digitCount += 1 + currentIndex = group.index(after: currentIndex) + } + + guard digitCount > 0 else { + // No hex digits found + throw AddressError.invalidHexGroup + } + return (accumulator, currentIndex) + } + + /// Parses a colon separator between IPv6 groups and detects ellipsis notation (::). + /// + /// - Parameters: + /// - utf8: The UTF-8 view being parsed + /// - position: Current position in the UTF-8 view (must point to a colon) + /// - currentByteIndex: Current byte index in the IP array + /// - ellipsisPosition: Inout parameter tracking ellipsis position + /// - Returns: Next position in the UTF-8 view after parsing separator + /// + /// ## Example + /// ```swift + /// let utf8 = "2001:db8::1".utf8 + /// var ellipsisPos: Int? = nil + /// // After parsing "2001", position points to first ':' + /// let nextPos = try skipColonSeparator(from: utf8, at: position, + /// currentByteIndex: 2, + /// ellipsisPosition: &ellipsisPos) + /// // For single colon: nextPos points to 'd' in 'db8' + /// // For double colon (::): ellipsisPos = 2, nextPos points to '1' + /// ``` + private static func skipColonSeparator( + from group: String.UTF8View, + at position: String.UTF8View.Index, + currentByteIndex: Int, + ellipsisPosition: inout Int? + ) throws -> String.UTF8View.Index { + // Expect colon separator + guard group[position] == 58 else { // ASCII ':' + throw AddressError.malformedAddress + } + + let afterFirstColon = group.index(after: position) + guard afterFirstColon < group.endIndex else { + // Trailing colon not allowed + throw AddressError.malformedAddress + } + + // Check for double colon, return position after that + if group[afterFirstColon] == 58 { // ASCII ':' + guard ellipsisPosition == nil else { + // Multiple :: not allowed + throw AddressError.multipleEllipsis + } + ellipsisPosition = currentByteIndex + let afterSecondColon = group.index(after: afterFirstColon) + return afterSecondColon + } + return afterFirstColon + } + + /// Expands ellipsis for IPv6 addresses + /// + /// - Parameters: + /// - ipBytes: Inout array of IP bytes to modify + /// - parsedBytes: Number of bytes already parsed for IPv6 groups + /// - ellipsisPosition: Optional position where ellipsis was found + /// - byteLimit: Maximum bytes available for IPv6 (16 for pure IPv6, 12 if IPv4 suffix present) + /// - Throws: `AddressError.incompleteAddress` for invalid address lengths + private static func expandEllipsis( + in ipBytes: inout [UInt8], + parsedBytes: Int, + ellipsisPosition: Int?, + byteLimit: Int = 16 + ) throws { + guard let ellipsisPosition = ellipsisPosition else { + // No ellipsis - validate we have exactly filled the available bytes + guard parsedBytes == byteLimit else { + throw AddressError.incompleteAddress // Incomplete address without ellipsis + } + return + } + + // Calculate expansion within the byte limit + let bytesToExpand = byteLimit - parsedBytes + guard bytesToExpand > 0 else { + throw AddressError.malformedAddress // No room for ellipsis expansion + } + + let suffixBytes = Array(ipBytes[ellipsisPosition..> 112) & 0xFFFF), + UInt16((value >> 96) & 0xFFFF), + UInt16((value >> 80) & 0xFFFF), + UInt16((value >> 64) & 0xFFFF), + UInt16((value >> 48) & 0xFFFF), + UInt16((value >> 32) & 0xFFFF), + UInt16((value >> 16) & 0xFFFF), + UInt16(value & 0xFFFF), + ] + + // Find the longest run of consecutive zeros for :: compression + var longestZeroStart = -1 + var longestZeroLength = 0 + var currentZeroStart = -1 + var currentZeroLength = 0 + + for (index, group) in groups.enumerated() { + if group == 0 { + if currentZeroStart == -1 { + currentZeroStart = index + currentZeroLength = 1 + } else { + currentZeroLength += 1 + } + } else { + if currentZeroLength > longestZeroLength { + longestZeroStart = currentZeroStart + longestZeroLength = currentZeroLength + } + currentZeroStart = -1 + currentZeroLength = 0 + } + } + if currentZeroLength > longestZeroLength { + longestZeroStart = currentZeroStart + longestZeroLength = currentZeroLength + } + + let useCompression = longestZeroLength >= 2 + + var result = "" + var index = 0 + + while index < 8 { + if useCompression && index == longestZeroStart { + if index == 0 { + result += "::" + } else { + result += ":" + } + // Skip the compressed zeros + index += longestZeroLength + + // If we compressed to the end, we're done + if index >= 8 { + break + } + } else { + // Add the group in lowercase hex without leading zeros + result += String(groups[index], radix: 16, uppercase: false) + index += 1 + + // Add colon if not at the end + if index < 8 { + result += ":" + } + } + } + + if let zone = zone { + result += "%" + zone + } + + return result + } + + @inlinable + public var bytes: [UInt8] { + Self.bytes(self.value) + } + + @usableFromInline + internal static func bytes(_ value: UInt128) -> [UInt8] { + var result = [UInt8](repeating: 0, count: 16) + result[0] = UInt8((value >> 120) & 0xff) + result[1] = UInt8((value >> 112) & 0xff) + result[2] = UInt8((value >> 104) & 0xff) + result[3] = UInt8((value >> 96) & 0xff) + result[4] = UInt8((value >> 88) & 0xff) + result[5] = UInt8((value >> 80) & 0xff) + result[6] = UInt8((value >> 72) & 0xff) + result[7] = UInt8((value >> 64) & 0xff) + result[8] = UInt8((value >> 56) & 0xff) + result[9] = UInt8((value >> 48) & 0xff) + result[10] = UInt8((value >> 40) & 0xff) + result[11] = UInt8((value >> 32) & 0xff) + result[12] = UInt8((value >> 24) & 0xff) + result[13] = UInt8((value >> 16) & 0xff) + result[14] = UInt8((value >> 8) & 0xff) + result[15] = UInt8(value & 0xff) + return result + } + + @available(macOS 26.0, *) + @usableFromInline + internal static func bytes(_ value: UInt128) -> InlineArray<16, UInt8> { + let result: InlineArray<16, UInt8> = [ + UInt8((value >> 120) & 0xff), + UInt8((value >> 112) & 0xff), + UInt8((value >> 104) & 0xff), + UInt8((value >> 96) & 0xff), + UInt8((value >> 88) & 0xff), + UInt8((value >> 80) & 0xff), + UInt8((value >> 72) & 0xff), + UInt8((value >> 64) & 0xff), + UInt8((value >> 56) & 0xff), + UInt8((value >> 48) & 0xff), + UInt8((value >> 40) & 0xff), + UInt8((value >> 32) & 0xff), + UInt8((value >> 24) & 0xff), + UInt8((value >> 16) & 0xff), + UInt8((value >> 8) & 0xff), + UInt8(value & 0xff), + ] + return result + } + + /// The unspecified IPv6 address (::) + public static let unspecified = IPv6Address(0) + + /// The loopback IPv6 address (::1) + public static let loopback = IPv6Address(1) + + // MARK: - Address Classification Methods + + /// Returns `true` if this is the unspecified address (::). + @inlinable + public var isUnspecified: Bool { + value == 0 + } + + /// Returns `true` if this is the loopback address (::1). + @inlinable + public var isLoopback: Bool { + value == 1 + } + + /// Returns `true` if this is a multicast address (ff00::/8). + @inlinable + public var isMulticast: Bool { + (value >> 120) == 0xFF + } + + /// Returns `true` if this is a link-local unicast address (fe80::/10). + @inlinable + public var isLinkLocal: Bool { + (value >> 118) == 0x3FA // fe80::/10 = top 10 bits are 1111111010 + } + + /// Returns `true` if this is a unique local address (fc00::/7). + @inlinable + public var isUniqueLocal: Bool { + (value >> 121) == 0x7E // fc00::/7 = top 7 bits are 1111110 + } + + /// Returns `true` if this is a global unicast address. + @inlinable + public var isGlobalUnicast: Bool { + !isUnspecified && !isLoopback && !isMulticast && !isLinkLocal && !isUniqueLocal + } + + /// Returns `true` if this is a documentation address (2001:db8::/32). + @inlinable + public var isDocumentation: Bool { + (value >> 96) == 0x2001_0DB8 // 2001:db8::/32 + } + /// Compares two IPv6 addresses numerically, then by zone if values are equal. + @inlinable + public static func < (lhs: IPv6Address, rhs: IPv6Address) -> Bool { + if lhs.value != rhs.value { + return lhs.value < rhs.value + } + // Same value, compare zones lexicographically + return (lhs.zone ?? "") < (rhs.zone ?? "") + } +} + +extension IPv6Address: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/IndexedAddressAllocator.swift b/Sources/ContainerizationExtras/IndexedAddressAllocator.swift new file mode 100644 index 0000000..f7e1820 --- /dev/null +++ b/Sources/ContainerizationExtras/IndexedAddressAllocator.swift @@ -0,0 +1,127 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Collections +import Synchronization + +/// Maps a network address to an array index value, or nil in the case of a domain error. +package typealias AddressToIndexTransform = @Sendable (AddressType) -> Int? + +/// Maps an array index value to a network address, or nil in the case of a domain error. +package typealias IndexToAddressTransform = @Sendable (Int) -> AddressType? + +package final class IndexedAddressAllocator: AddressAllocator { + private class State { + var allocations: BitArray + var enabled: Bool + var allocationCount: Int + let addressToIndex: AddressToIndexTransform + let indexToAddress: IndexToAddressTransform + + init( + size: Int, + addressToIndex: @escaping AddressToIndexTransform, + indexToAddress: @escaping IndexToAddressTransform + ) { + self.allocations = BitArray.init(repeating: false, count: size) + self.enabled = true + self.allocationCount = 0 + self.addressToIndex = addressToIndex + self.indexToAddress = indexToAddress + } + } + + private let state: Mutex + + /// Create an allocator with specified size and index mappings. + package init( + size: Int, + addressToIndex: @escaping AddressToIndexTransform, + indexToAddress: @escaping IndexToAddressTransform + ) { + let state = State( + size: size, + addressToIndex: addressToIndex, + indexToAddress: indexToAddress + ) + self.state = Mutex(state) + } + + public func allocate() throws -> AddressType { + try self.state.withLock { state in + guard state.enabled else { + throw AllocatorError.allocatorDisabled + } + + guard let index = state.allocations.firstIndex(of: false) else { + throw AllocatorError.allocatorFull + } + + guard let address = state.indexToAddress(index) else { + throw AllocatorError.invalidIndex(index) + } + + state.allocations[index] = true + state.allocationCount += 1 + return address + } + } + + package func reserve(_ address: AddressType) throws { + try self.state.withLock { state in + guard state.enabled else { + throw AllocatorError.allocatorDisabled + } + + guard let index = state.addressToIndex(address) else { + throw AllocatorError.invalidAddress(address.description) + } + + guard !state.allocations[index] else { + throw AllocatorError.alreadyAllocated("\(address.description)") + } + + state.allocations[index] = true + state.allocationCount += 1 + } + + } + + package func release(_ address: AddressType) throws { + try self.state.withLock { state in + guard let index = state.addressToIndex(address) else { + throw AllocatorError.invalidAddress(address.description) + } + + guard state.allocations[index] else { + throw AllocatorError.notAllocated("\(address.description)") + } + + state.allocations[index] = false + state.allocationCount -= 1 + } + } + + package func disableAllocator() -> Bool { + self.state.withLock { state in + guard state.allocationCount == 0 else { + return false + } + state.enabled = false + return true + } + } +} diff --git a/Sources/ContainerizationExtras/MACAddress.swift b/Sources/ContainerizationExtras/MACAddress.swift new file mode 100644 index 0000000..ea29270 --- /dev/null +++ b/Sources/ContainerizationExtras/MACAddress.swift @@ -0,0 +1,275 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// An EUI-48 MAC address as specified by IEEE 802. +@frozen +public struct MACAddress: Sendable, Hashable, CustomStringConvertible, Equatable, Comparable { + public let value: UInt64 + + /// Creates an MACAddress from an integer. + /// + /// - Parameter value: The big-endian value of the MAC address. + /// The most significant 16 bits of the value are ignored. + @inlinable + public init(_ value: UInt64) { + self.value = value & 0x0000_ffff_ffff_ffff + } + + /// Creates an IPv4Address from 6 bytes. + /// + /// - Parameters: + /// - bytes: 6-byte array in network byte order representing the IPv4 address + /// - Throws: `AddressError.unableToParse` if the byte array length is not 6 + @inlinable + public init(_ bytes: [UInt8]) throws { + guard bytes.count == 6 else { + throw AddressError.unableToParse + } + self.value = + (UInt64(bytes[0]) << 40) + | (UInt64(bytes[1]) << 32) + | (UInt64(bytes[2]) << 24) + | (UInt64(bytes[3]) << 16) + | (UInt64(bytes[4]) << 8) + | UInt64(bytes[5]) + } + + /// Creates an MACAddress from a string representation. + /// + /// - Parameter string: The MAC address string with colon or dash delimiters. + /// - Throws: `AddressError.unableToParse` if the string is not a valid MAC address + @inlinable + public init(_ string: String) throws { + self.value = try Self.parse(string) + } + + @inlinable + public var bytes: [UInt8] { + Self.bytes(value) + } + + @usableFromInline + static func bytes(_ value: UInt64) -> [UInt8] { + var result = [UInt8](repeating: 0, count: 6) + result[0] = UInt8((value >> 40) & 0xff) + result[1] = UInt8((value >> 32) & 0xff) + result[2] = UInt8((value >> 24) & 0xff) + result[3] = UInt8((value >> 16) & 0xff) + result[4] = UInt8((value >> 8) & 0xff) + result[5] = UInt8(value & 0xff) + return result + } + + @available(macOS 26.0, *) + @usableFromInline + static func bytes(_ value: UInt64) -> InlineArray<6, UInt8> { + let result: InlineArray<6, UInt8> = [ + UInt8((value >> 40) & 0xff), + UInt8((value >> 32) & 0xff), + UInt8((value >> 24) & 0xff), + UInt8((value >> 16) & 0xff), + UInt8((value >> 8) & 0xff), + UInt8(value & 0xff), + ] + return result + } + + @inlinable + public var description: String { + bytes.map { String(format: "%02x", $0) }.joined(separator: ":") + } + + /// Parses an MAC address string into a UInt64 representation. + /// + /// ## Validation Rules + /// - Exactly six groups of two hexadecimal digits, separated by colons + /// or dashes + /// - No whitespace characters + /// - Only hexadecimal digits and colons allowed + /// + /// ## Examples + /// ```swift + /// MACAddress.parse("01:23:45:67:89:ab") // Returns: 0x0000_0123_4567_89ab + /// MACAddress.parse("01-23-45-67-89-AB") // Returns: 0x0000_0123_4567_89ab + /// MACAddress.parse("00:00:00:00:00:00") // Returns: 0x0000_0000_0000_0000 + /// MACAddress.parse("ff:ff:ff:ff:ff:ff") // Returns: 0x0000_ffff_ffff_ffff + /// + /// // Invalid examples: + /// MACAddress.parse("01:23:45:67:89") // Wrong number of octets + /// MACAddress.parse("01:23:45:67:89:a") // Invalid octet length + /// MACAddress.parse("01:23:45:67:89:hi") // Invalid octet content + /// MACAddress.parse("01:23-45:67-89:ab") // Inconsistent separators + /// MACAddress.parse(" 01:23:45:67:89:ab ") // Whitespace + /// ``` + /// + /// - Parameter s: The MAC address string to parse + /// - Returns: The 64-bit representation of the IP address, or `nil` if parsing fails + /// - Note: The returned value is in network byte order (big-endian) + @usableFromInline + internal static func parse(_ s: String) throws -> UInt64 { + guard !s.isEmpty, s.count == 17 else { + throw AddressError.unableToParse + } + + // MAC addresses should only contain ASCII hex digits and dots + let utf8 = s.utf8 + for byte in utf8 { + // ASCII whitespace: space(32), tab(9), newline(10), return(13) + if byte == 32 || byte == 9 || byte == 10 || byte == 13 { + throw AddressError.unableToParse + } + } + + // accumulator for the 64 bit representation of the MAC address + var result: UInt64 = 0 + + // tracking octet count, max 6 allowed + var octetCount = 0 + var currentOctet = 0 + + // number of digits in the string representation of the octet + var digitCount = 0 + + // separator character to use + var separator: String.UTF8View.Element? + + for byte in utf8 { + if byte == 0x3a || byte == 0x2d { // ASCII ':' + // Ensure separator is consistent + guard separator == nil || byte == separator else { + throw AddressError.unableToParse + } + separator = byte + + // Validate octet before processing + guard octetCount < 5, digitCount == 2 else { + throw AddressError.unableToParse + } + + // Shift result and add current octet + result = (result << 8) | UInt64(currentOctet) + + // Reset for next octet + octetCount += 1 + currentOctet = 0 + digitCount = 0 + + } else if byte >= 0x30 && byte <= 0x39 { // ASCII '0'-'9' + let digit = Int(byte - 0x30) + + digitCount += 1 + currentOctet = (currentOctet << 4) + digit + + // Early termination if octet becomes too large + guard digitCount <= 2 else { + throw AddressError.unableToParse + } + + } else if byte >= 0x41 && byte <= 0x46 { // ASCII 'A'-'F' + let digit = Int(byte - 0x41 + 10) + + digitCount += 1 + currentOctet = (currentOctet << 4) + digit + + // Early termination if octet becomes too large + guard digitCount <= 2 else { + throw AddressError.unableToParse + } + + } else if byte >= 0x61 && byte <= 0x66 { // ASCII 'A'-'F' + let digit = Int(byte - 0x61 + 10) + + digitCount += 1 + currentOctet = (currentOctet << 4) + digit + + // Early termination if octet becomes too large + guard digitCount <= 2 else { + throw AddressError.unableToParse + } + + } else { + throw AddressError.unableToParse + } + } + + // Validate final octet + guard octetCount == 5, digitCount == 2 else { + throw AddressError.unableToParse + } + + return (result << 8) | UInt64(currentOctet) + } + + // MARK: - Address Classification Methods + + /// Returns `true` if the MAC address is locally administered. + /// + /// IEEE 802 specifies that the second-least-significant bit of + /// the first octet of the MAC address determines whether the + /// address is globally unique (bit cleared) or locally + /// administered (bit set). + @inlinable + public var isLocallyAdministered: Bool { + (value & 0x0000_0200_0000_0000) != 0 + } + + /// Returns `true` if the MAC address is multicast. + /// + /// IEEE 802 specifies that the least-significant bit of + /// the first octet of the MAC address determines whether the + /// address is unicast (bit cleared) or multicast (bit set). + @inlinable + public var isMulticast: Bool { + (value & 0x0000_0100_0000_0000) != 0 + } + + /// Returns the link local IP address based on the EUI-64 version + /// of the MAC address. + /// + /// - Parameter network: The IPv6 address to use for the network prefix + /// - Returns: The link local IP address for the MAC address + @inlinable + public func ipv6Address(network: IPv6Address) throws -> IPv6Address { + let prefixBytes = network.bytes + return try IPv6Address([ + prefixBytes[0], prefixBytes[1], prefixBytes[2], prefixBytes[3], + prefixBytes[4], prefixBytes[5], prefixBytes[6], prefixBytes[7], + bytes[0] ^ 0x02, bytes[1], bytes[2], 0xff, + 0xfe, bytes[3], bytes[4], bytes[5], + ]) + } + + /// Compares two IPv4 addresses numerically. + @inlinable + public static func < (lhs: MACAddress, rhs: MACAddress) -> Bool { + lhs.value < rhs.value + } +} + +extension MACAddress: Codable { + public init(from decoder: Decoder) throws { + let container = try decoder.singleValueContainer() + let string = try container.decode(String.self) + try self.init(string) + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.singleValueContainer() + try container.encode(description) + } +} diff --git a/Sources/ContainerizationExtras/NetworkAddress+Allocator.swift b/Sources/ContainerizationExtras/NetworkAddress+Allocator.swift new file mode 100644 index 0000000..995bc6e --- /dev/null +++ b/Sources/ContainerizationExtras/NetworkAddress+Allocator.swift @@ -0,0 +1,108 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension IPv4Address { + /// Creates an allocator for IPv4 addresses. + public static func allocator(lower: UInt32, size: Int) throws -> any AddressAllocator { + // NOTE: 2^31 - 1 size limit in the very improbable case that we run on 32-bit. + guard size > 0 && size < Int.max && 0xffff_ffff - lower >= size - 1 else { + throw AllocatorError.rangeExceeded + } + return IndexedAddressAllocator( + size: size, + addressToIndex: { address in + guard address.value >= lower && address.value - lower <= UInt32(size) else { + return nil + } + return Int(address.value - lower) + }, + indexToAddress: { IPv4Address(lower + UInt32($0)) } + ) + } +} + +extension UInt16 { + /// Creates an allocator for TCP/UDP ports and other UInt16 values. + public static func allocator(lower: UInt16, size: Int) throws -> any AddressAllocator { + guard 0xffff - lower + 1 >= size else { + throw AllocatorError.rangeExceeded + } + + return IndexedAddressAllocator( + size: size, + addressToIndex: { address in + guard address >= lower && address <= lower + UInt16(size) else { + return nil + } + return Int(address - lower) + }, + indexToAddress: { lower + UInt16($0) } + ) + } +} + +extension UInt32 { + /// Creates an allocator for vsock ports, or any UInt32 values. + public static func allocator(lower: UInt32, size: Int) throws -> any AddressAllocator { + guard 0xffff_ffff - lower + 1 >= size else { + throw AllocatorError.rangeExceeded + } + + return IndexedAddressAllocator( + size: size, + addressToIndex: { address in + guard address >= lower && address <= lower + UInt32(size) else { + return nil + } + return Int(address - lower) + }, + indexToAddress: { lower + UInt32($0) } + ) + } + + /// Creates a rotating allocator for vsock ports, or any UInt32 values. + public static func rotatingAllocator(lower: UInt32, size: UInt32) throws -> any AddressAllocator { + guard 0xffff_ffff - lower + 1 >= size else { + throw AllocatorError.rangeExceeded + } + + return RotatingAddressAllocator( + size: size, + addressToIndex: { address in + guard address >= lower && address <= lower + UInt32(size) else { + return nil + } + return Int(address - lower) + }, + indexToAddress: { lower + UInt32($0) } + ) + } +} + +extension Character { + private static let deviceLetters = Array("abcdefghijklmnopqrstuvwxyz") + + /// Creates an allocator for block device tags, or any character values. + public static func blockDeviceTagAllocator() -> any AddressAllocator { + IndexedAddressAllocator( + size: Self.deviceLetters.count, + addressToIndex: { address in + Self.deviceLetters.firstIndex(of: address) + }, + indexToAddress: { Self.deviceLetters[$0] } + ) + } +} diff --git a/Sources/ContainerizationExtras/NetworkConfiguration.swift b/Sources/ContainerizationExtras/NetworkConfiguration.swift new file mode 100644 index 0000000..a72a5f4 --- /dev/null +++ b/Sources/ContainerizationExtras/NetworkConfiguration.swift @@ -0,0 +1,57 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A network interface's addresses. +public struct InterfaceAddress: Sendable, Hashable { + public var ipv4Address: CIDRv4 + public var ipv6Address: CIDRv6? + + public init(ipv4Address: CIDRv4, ipv6Address: CIDRv6? = nil) { + self.ipv4Address = ipv4Address + self.ipv6Address = ipv6Address + } +} + +/// A link-scoped route — a destination directly reachable on an interface. +public struct LinkRoute: Sendable, Hashable { + public var ipv4Destination: IPv4Address? + public var ipv4Source: IPv4Address? + public var ipv6Destination: IPv6Address? + public var ipv6Source: IPv6Address? + + public init( + ipv4Destination: IPv4Address? = nil, + ipv4Source: IPv4Address? = nil, + ipv6Destination: IPv6Address? = nil, + ipv6Source: IPv6Address? = nil + ) { + self.ipv4Destination = ipv4Destination + self.ipv4Source = ipv4Source + self.ipv6Destination = ipv6Destination + self.ipv6Source = ipv6Source + } +} + +/// The default-route gateway for a network interface. +public struct DefaultRoute: Sendable, Hashable { + public var ipv4Gateway: IPv4Address? + public var ipv6Gateway: IPv6Address? + + public init(ipv4Gateway: IPv4Address? = nil, ipv6Gateway: IPv6Address? = nil) { + self.ipv4Gateway = ipv4Gateway + self.ipv6Gateway = ipv6Gateway + } +} diff --git a/Sources/ContainerizationExtras/Prefix.swift b/Sources/ContainerizationExtras/Prefix.swift new file mode 100644 index 0000000..70500a0 --- /dev/null +++ b/Sources/ContainerizationExtras/Prefix.swift @@ -0,0 +1,88 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// CIDR prefix length (e.g., `/24` for a 24-bit network mask). +@frozen +public struct Prefix: Sendable, CustomStringConvertible, Hashable, Codable { + public let length: UInt8 + + /// Create a prefix (0-128). Use `ipv4(_:)` or `ipv6(_:)` for version-specific validation. + public init?(length: UInt8) { + guard length <= 128 else { return nil } + self.length = length + } + + /// Create an IPv4 prefix (0-32). Returns `nil` if length > 32. + public static func ipv4(_ length: UInt8) -> Prefix? { + guard length <= 32 else { return nil } + return Prefix(unchecked: length) + } + + /// Create an IPv6 prefix (0-128). Returns `nil` if length > 128. + public static func ipv6(_ length: UInt8) -> Prefix? { + guard length <= 128 else { return nil } + return Prefix(unchecked: length) + } + + /// Internal unchecked initializer for known-valid values. + internal init(unchecked length: UInt8) { + self.length = length + } + + public var description: String { + "\(length)" + } +} + +extension Prefix { + /// Computes a 32-bit mask for the suffix (host) portion of an IPv4 address. + /// + /// Example: Prefix `/24` → `0x0000_00FF` (255 host addresses) + @inlinable + public var suffixMask32: UInt32 { + if self.length <= 0 { + return 0xffff_ffff + } + return self.length >= 32 ? 0x0000_0000 : (1 << (32 - self.length)) - 1 + } + + /// Network portion mask (high-order bits) for IPv4. + /// + /// Example: Prefix `/24` → `0xFFFF_FF00` (255.255.255.0) + @inlinable + public var prefixMask32: UInt32 { + ~self.suffixMask32 + } + + /// Computes a 128-bit mask for the suffix (host) portion of an IPv6 address. + /// + /// Example: Prefix `/64` → `0x0000_0000_0000_0000_FFFF_FFFF_FFFF_FFFF` + @inlinable + public var suffixMask128: UInt128 { + if self.length <= 0 { + return UInt128.max + } + return self.length >= 128 ? 0 : (1 << (128 - self.length)) - 1 + } + + /// Network portion mask (high-order bits) for IPv6. + /// + /// Example: Prefix `/64` → `0xFFFF_FFFF_FFFF_FFFF_0000_0000_0000_0000` + @inlinable + public var prefixMask128: UInt128 { + ~self.suffixMask128 + } +} diff --git a/Sources/ContainerizationExtras/ProgressEvent.swift b/Sources/ContainerizationExtras/ProgressEvent.swift new file mode 100644 index 0000000..38e80bb --- /dev/null +++ b/Sources/ContainerizationExtras/ProgressEvent.swift @@ -0,0 +1,51 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A progress update event. +public enum ProgressEvent: Sendable { + /// The possible values: + /// - `add-items`: Increment the number of processed items by `value`. + /// - `add-total-items`: Increment the total number of items to process by `value`. + /// - `add-size`: Increment the size of processed items by `value`. + /// - `add-total-size`: Increment the total size of items to process by `value`. + case addItems(Int) + case addTotalItems(Int) + case addSize(Int64) + case addTotalSize(Int64) + + /// The event name. + public var event: String { + switch self { + case .addItems: "add-items" + case .addTotalItems: "add-total-items" + case .addSize: "add-size" + case .addTotalSize: "add-total-size" + } + } + + /// The event value. + public var value: any Sendable { + switch self { + case .addItems(let value): value + case .addTotalItems(let value): value + case .addSize(let value): value + case .addTotalSize(let value): value + } + } +} + +/// The progress update handler. +public typealias ProgressHandler = @Sendable (_ events: [ProgressEvent]) async -> Void diff --git a/Sources/ContainerizationExtras/ProxyUtils.swift b/Sources/ContainerizationExtras/ProxyUtils.swift new file mode 100644 index 0000000..63804c1 --- /dev/null +++ b/Sources/ContainerizationExtras/ProxyUtils.swift @@ -0,0 +1,77 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation + +/// A small utility to resolve proxy settings (HTTP(S)_PROXY / NO_PROXY). +public enum ProxyUtils { + /// Resolves the proxy URL for a given host based on environment variables. + /// Malformed http_proxy or https_proxy URLs are ignored. + /// Uses Go-style handling rules: + /// - Uppercase environment variables take priority over lowercase counterparts. + /// - Leading dot on no_proxy component implies prefix matching. + /// + /// - Parameters: + /// - scheme: The request scheme. + /// - host: The request hostname. + /// - env: Environment variables to check, dafaulting to the process environment. + /// + /// - Returns: The proxy URL to use, or `nil` for transparent connection. + public static func proxyFromEnvironment( + scheme: String?, + host: String, + env: [String: String] = ProcessInfo.processInfo.environment + ) -> URL? { + guard let scheme else { + return nil + } + + let httpProxy = env["HTTP_PROXY"] ?? env["http_proxy"] + let httpsProxy = env["HTTPS_PROXY"] ?? env["https_proxy"] + let noProxy = env["NO_PROXY"] ?? env["no_proxy"] + + // If NO_PROXY matches → skip proxy + if let noProxy, shouldBypassProxy(host: host, noProxy: noProxy) { + return nil + } + + // Select proxy based on scheme, defaulting to http. + let proxy = scheme == "https" ? httpsProxy : httpProxy + guard let proxy, let proxyUrl = URL(string: proxy) else { + return nil + } + + return proxyUrl + } + + /// Check if a host should bypass proxy according to NO_PROXY. + /// - Example: NO_PROXY=".example.com,localhost,127.0.0.1" + private static func shouldBypassProxy(host: String, noProxy: String) -> Bool { + let entries = noProxy.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) } + for entry in entries { + if entry.isEmpty { continue } + if entry == "*" { return true } + if host == entry { return true } + if entry.hasPrefix("*.") { + let suffix = String(entry.dropFirst()) + if host.hasSuffix(suffix) { return true } + } + if entry.hasPrefix(".") && host.hasSuffix(entry) { return true } + } + return false + } +} diff --git a/Sources/ContainerizationExtras/RotatingAddressAllocator.swift b/Sources/ContainerizationExtras/RotatingAddressAllocator.swift new file mode 100644 index 0000000..c2a2960 --- /dev/null +++ b/Sources/ContainerizationExtras/RotatingAddressAllocator.swift @@ -0,0 +1,124 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Synchronization + +package final class RotatingAddressAllocator: AddressAllocator { + package typealias AddressType = UInt32 + + private struct State { + var allocations: [AddressType] + var enabled: Bool + var allocationCount: Int + let addressToIndex: AddressToIndexTransform + let indexToAddress: IndexToAddressTransform + + init( + size: UInt32, + addressToIndex: @escaping AddressToIndexTransform, + indexToAddress: @escaping IndexToAddressTransform + ) { + self.allocations = [UInt32](0.. + + /// Create an allocator with specified size and index mappings. + package init( + size: UInt32, + addressToIndex: @escaping AddressToIndexTransform, + indexToAddress: @escaping IndexToAddressTransform + ) { + let state = State( + size: size, + addressToIndex: addressToIndex, + indexToAddress: indexToAddress + ) + self.state = Mutex(state) + } + + public func allocate() throws -> AddressType { + try self.state.withLock { state in + guard state.enabled else { + throw AllocatorError.allocatorDisabled + } + + guard state.allocations.count > 0 else { + throw AllocatorError.allocatorFull + } + + let value = state.allocations.removeFirst() + + guard let address = state.indexToAddress(Int(value)) else { + throw AllocatorError.invalidIndex(Int(value)) + } + + state.allocationCount += 1 + return address + } + } + + package func reserve(_ address: AddressType) throws { + try self.state.withLock { state in + guard state.enabled else { + throw AllocatorError.allocatorDisabled + } + + guard let index = state.addressToIndex(address) else { + throw AllocatorError.invalidAddress(address.description) + } + + let i = state.allocations.firstIndex(of: UInt32(index)) + guard let i else { + throw AllocatorError.alreadyAllocated("\(address.description)") + } + + _ = state.allocations.remove(at: i) + state.allocationCount += 1 + } + } + + package func release(_ address: AddressType) throws { + try self.state.withLock { state in + guard let index = (state.addressToIndex(address)) else { + throw AllocatorError.invalidAddress(address.description) + } + let value = UInt32(index) + + guard !state.allocations.contains(value) else { + throw AllocatorError.notAllocated("\(address.description)") + } + + state.allocations.append(value) + state.allocationCount -= 1 + } + } + + package func disableAllocator() -> Bool { + self.state.withLock { state in + guard state.allocationCount == 0 else { + return false + } + state.enabled = false + return true + } + } +} diff --git a/Sources/ContainerizationExtras/TLSUtils.swift b/Sources/ContainerizationExtras/TLSUtils.swift new file mode 100644 index 0000000..af1b057 --- /dev/null +++ b/Sources/ContainerizationExtras/TLSUtils.swift @@ -0,0 +1,39 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import NIO +import NIOSSL + +public enum TLSUtils { + + public static func makeEnvironmentAwareTLSConfiguration() -> TLSConfiguration { + var tlsConfig = TLSConfiguration.makeClientConfiguration() + + // Check standard SSL environment variables in priority order + let customCAPath = + ProcessInfo.processInfo.environment["SSL_CERT_FILE"] + ?? ProcessInfo.processInfo.environment["CURL_CA_BUNDLE"] + ?? ProcessInfo.processInfo.environment["REQUESTS_CA_BUNDLE"] + + if let caPath = customCAPath { + tlsConfig.trustRoots = .file(caPath) + } + // else: use .default + + return tlsConfig + } +} diff --git a/Sources/ContainerizationExtras/Timeout.swift b/Sources/ContainerizationExtras/Timeout.swift new file mode 100644 index 0000000..f2f04b3 --- /dev/null +++ b/Sources/ContainerizationExtras/Timeout.swift @@ -0,0 +1,67 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// `Timeout` contains helpers to run an operation and error out if +/// the operation does not finish within a provided time. +public struct Timeout { + /// Performs the passed in `operation` and throws a `CancellationError` if the operation + /// doesn't finish in the provided `seconds` amount. + public static func run( + seconds: UInt32, + operation: @escaping @Sendable () async throws -> T + ) async throws -> T { + try await withThrowingTaskGroup(of: T.self) { group in + group.addTask { + try await operation() + } + + group.addTask { + try await Task.sleep(for: .seconds(seconds)) + throw CancellationError() + } + + guard let result = try await group.next() else { + fatalError() + } + + group.cancelAll() + return result + } + } + + public static func run( + for duration: Duration, + operation: @escaping @Sendable () async throws -> T + ) async throws -> T { + try await withThrowingTaskGroup(of: T.self) { group in + group.addTask { + try await operation() + } + + group.addTask { + try await Task.sleep(for: duration) + throw CancellationError() + } + + guard let result = try await group.next() else { + fatalError() + } + + group.cancelAll() + return result + } + } +} diff --git a/Sources/ContainerizationExtras/UInt8+DataBinding.swift b/Sources/ContainerizationExtras/UInt8+DataBinding.swift new file mode 100644 index 0000000..40abedd --- /dev/null +++ b/Sources/ContainerizationExtras/UInt8+DataBinding.swift @@ -0,0 +1,100 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +package enum BindError: Error, CustomStringConvertible { + case recvMarshalFailure(type: String, field: String) + case sendMarshalFailure(type: String, field: String) + + package var description: String { + switch self { + case .recvMarshalFailure(let type, let field): + return "failed to unmarshal \(type).\(field)" + case .sendMarshalFailure(let type, let field): + return "failed to marshal \(type).\(field)" + } + } +} + +package protocol Bindable: Sendable { + static var size: Int { get } + func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int +} + +extension ArraySlice { + package func hexEncodedString() -> String { + self.map { String(format: "%02hhx", $0) }.joined() + } +} + +extension [UInt8] { + package func hexEncodedString() -> String { + self.map { String(format: "%02hhx", $0) }.joined() + } + + package mutating func bind(as type: T.Type, offset: Int = 0, size: Int? = nil) -> UnsafeMutablePointer? { + guard self.count >= (size ?? MemoryLayout.size) + offset else { + return nil + } + + return self.withUnsafeMutableBytes { $0.baseAddress?.advanced(by: offset).assumingMemoryBound(to: T.self) } + } + + package mutating func copyIn(as type: T.Type, value: T, offset: Int = 0, size: Int? = nil) -> Int? { + let size = size ?? MemoryLayout.size + guard self.count >= size + offset else { + return nil + } + + return self.withUnsafeMutableBytes { + $0.baseAddress?.advanced(by: offset).assumingMemoryBound(to: T.self).pointee = value + return offset + MemoryLayout.size + } + } + + package func copyOut(as type: T.Type, offset: Int = 0, size: Int? = nil) -> (Int, T)? { + guard self.count >= (size ?? MemoryLayout.size) + offset else { + return nil + } + + return self.withUnsafeBytes { + guard let value = $0.baseAddress?.advanced(by: offset).assumingMemoryBound(to: T.self).pointee else { + return nil + } + return (offset + MemoryLayout.size, value) + } + } + + package mutating func copyIn(buffer: [UInt8], offset: Int = 0) -> Int? { + guard offset + buffer.count <= self.count else { + return nil + } + + self[offset.. Int? { + guard offset + buffer.count <= self.count else { + return nil + } + + buffer[0.. { + AsyncStream { cont in + self._stream.open() + defer { self._stream.close() } + + let readBuffer = UnsafeMutablePointer.allocate(capacity: buffSize) + + while true { + let byteRead = self._stream.read(readBuffer, maxLength: buffSize) + if byteRead <= 0 { + readBuffer.deallocate() + cont.finish() + break + } else { + let data = Data(bytes: readBuffer, count: byteRead) + let buffer = ByteBuffer(bytes: data) + cont.yield(buffer) + } + } + } + } + + /// Get access to an `AsyncStream` of `Data` objects from the input source. + public var dataStream: AsyncStream { + AsyncStream { cont in + self._stream.open() + defer { self._stream.close() } + + let readBuffer = UnsafeMutablePointer.allocate(capacity: self.buffSize) + while true { + let byteRead = self._stream.read(readBuffer, maxLength: self.buffSize) + if byteRead <= 0 { + readBuffer.deallocate() + cont.finish() + break + } else { + let data = Data(bytes: readBuffer, count: byteRead) + cont.yield(data) + } + } + } + } +} + +extension ReadStream { + /// Errors that can be encountered while using a `ReadStream`. + public enum Error: Swift.Error, CustomStringConvertible { + case failedToCreateStream + case noSuchFileOrDirectory(_ p: URL) + + public var description: String { + switch self { + case .failedToCreateStream: + return "failed to create stream" + case .noSuchFileOrDirectory(let p): + return "no such file or directory: \(p.path)" + } + } + } +} diff --git a/Sources/ContainerizationNetlink/NetlinkSession.swift b/Sources/ContainerizationNetlink/NetlinkSession.swift new file mode 100644 index 0000000..c6438ad --- /dev/null +++ b/Sources/ContainerizationNetlink/NetlinkSession.swift @@ -0,0 +1,1006 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import ContainerizationOS +import Logging + +/// `NetlinkSession` facilitates interacting with netlink via a provided `NetlinkSocket`. This is +/// the core high-level type offered to perform actions to the netlink surface in the kernel. +public struct NetlinkSession { + private static let receiveDataLength = 65536 + private static let mtu: UInt32 = 1280 + private let socket: any NetlinkSocket + private let log: Logger + + /// Creates a new `NetlinkSession`. + /// - Parameters: + /// - socket: The `NetlinkSocket` to use for netlink interaction. + /// - log: The logger to use. The default value is `nil`. + public init(socket: any NetlinkSocket, log: Logger? = nil) { + self.socket = socket + self.log = log ?? Logger(label: "com.apple.containerization.netlink") + } + + /// Errors that may occur during netlink interaction. + public enum Error: Swift.Error, CustomStringConvertible, Equatable { + case invalidIpAddress + case invalidPrefixLength + case unexpectedInfo(type: UInt16) + case unexpectedOffset(offset: Int, size: Int) + case unexpectedResidualPackets + case unexpectedResultSet(count: Int, expected: Int) + + /// The description of the errors. + public var description: String { + switch self { + case .invalidIpAddress: + return "invalid IP address" + case .invalidPrefixLength: + return "invalid prefix length" + case .unexpectedInfo(let type): + return "unexpected response information, type = \(type)" + case .unexpectedOffset(let offset, let size): + return "unexpected buffer state, offset = \(offset), size = \(size)" + case .unexpectedResidualPackets: + return "unexpected residual response packets" + case .unexpectedResultSet(let count, let expected): + return "unexpected result set size, count = \(count), expected = \(expected)" + } + } + } + + /// Performs a link set command on an interface. + /// - Parameters: + /// - interface: The name of the interface. + /// - up: The value to set the interface state to. + public func linkSet(interface: String, up: Bool, mtu: UInt32? = nil) throws { + // ip link set dev [interface] [up|down] + let interfaceIndex = try getInterfaceIndex(interface) + // build the attribute only when mtu is supplied + let attr: RTAttribute? = + (mtu != nil) + ? RTAttribute( + len: UInt16(RTAttribute.size + MemoryLayout.size), + type: LinkAttributeType.IFLA_MTU) + : nil + let requestSize = NetlinkMessageHeader.size + InterfaceInfo.size + (attr?.paddedLen ?? 0) + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let requestHeader = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWLINK, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK, + pid: socket.pid) + requestOffset = try requestHeader.appendBuffer(&requestBuffer, offset: requestOffset) + + let flags = up ? InterfaceFlags.IFF_UP : 0 + let requestInfo = InterfaceInfo( + family: UInt8(AddressFamily.AF_PACKET), + index: interfaceIndex, + flags: flags, + change: InterfaceFlags.DEFAULT_CHANGE) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + if let attr = attr, let m = mtu { + requestOffset = try attr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let newRequestOffset = + requestBuffer.copyIn(as: UInt32.self, value: m, offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_MTU") + } + requestOffset = newRequestOffset + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWLINK) { InterfaceInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Set link attributes (MAC and/or bridge master) on an existing interface. + /// Either argument may be omitted; if both are nil this is a no-op. + /// + /// Sends a single `RTM_NEWLINK` carrying any of: + /// - `IFLA_ADDRESS` — the new hardware address (6 bytes for an Ethernet MAC). + /// - `IFLA_MASTER` — the index of the bridge to enslave the link to. The + /// bridge is identified by name; the index is resolved internally. + /// + /// - Parameters: + /// - interface: The name of the interface to update. + /// - macAddress: If non-nil, the new MAC address. + /// - master: If non-nil, the name of a bridge to enslave the interface to. + public func linkSetAttributes( + interface: String, + macAddress: MACAddress? = nil, + master: String? = nil + ) throws { + if macAddress == nil && master == nil { + return + } + + let interfaceIndex = try getInterfaceIndex(interface) + + var masterIndex: Int32? = nil + if let master { + masterIndex = try getInterfaceIndex(master) + } + + // Build the attribute list. MAC is 6 raw bytes; master is a 4-byte + // integer holding the bridge's interface index. + let macAttr: RTAttribute? = + (macAddress != nil) + ? RTAttribute( + len: UInt16(RTAttribute.size + 6), + type: LinkAttributeType.IFLA_ADDRESS) + : nil + let masterAttr: RTAttribute? = + (masterIndex != nil) + ? RTAttribute( + len: UInt16(RTAttribute.size + MemoryLayout.size), + type: LinkAttributeType.IFLA_MASTER) + : nil + + let requestSize = + NetlinkMessageHeader.size + + InterfaceInfo.size + + (macAttr?.paddedLen ?? 0) + + (masterAttr?.paddedLen ?? 0) + + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let requestHeader = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWLINK, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK, + pid: socket.pid) + requestOffset = try requestHeader.appendBuffer(&requestBuffer, offset: requestOffset) + + // No flag changes — passing 0/0 means "do not modify IFF_* flags". + let requestInfo = InterfaceInfo( + family: UInt8(AddressFamily.AF_PACKET), + index: interfaceIndex, + flags: 0, + change: 0) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + if let macAttr, let macAddress { + requestOffset = try macAttr.appendBuffer(&requestBuffer, offset: requestOffset) + for byte in macAddress.bytes { + guard let next = requestBuffer.copyIn(as: UInt8.self, value: byte, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_ADDRESS") + } + requestOffset = next + } + // Pad attribute payload to 4-byte boundary (NLA_ALIGN). + let payloadLen = 6 + let padded = ((payloadLen + 3) >> 2) << 2 + requestOffset += padded - payloadLen + } + + if let masterAttr, let masterIndex { + requestOffset = try masterAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let next = requestBuffer.copyIn(as: Int32.self, value: masterIndex, offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_MASTER") + } + requestOffset = next + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWLINK) { InterfaceInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Create a Linux bridge link via `RTM_NEWLINK` carrying + /// `IFLA_LINKINFO/IFLA_INFO_KIND="bridge"`. + /// + /// Sends `NLM_F_CREATE | NLM_F_EXCL`, so the kernel returns `EEXIST` if a + /// link with the same name already exists. Callers wanting idempotent + /// creation should catch and inspect the thrown error. + public func linkAddBridge(name: String) throws { + let nameBytes = Array(name.utf8) + [0] + let ifnameAttr = RTAttribute( + len: UInt16(RTAttribute.size + nameBytes.count), + type: LinkAttributeType.IFLA_IFNAME) + + let kindBytes = Array("bridge".utf8) + [0] + let kindAttr = RTAttribute( + len: UInt16(RTAttribute.size + kindBytes.count), + type: LinkInfoAttributeType.IFLA_INFO_KIND) + // IFLA_LINKINFO is a nest containing IFLA_INFO_KIND. + let linkInfoAttr = RTAttribute( + len: UInt16(RTAttribute.size + kindAttr.paddedLen), + type: LinkAttributeType.IFLA_LINKINFO) + + let requestSize = + NetlinkMessageHeader.size + + InterfaceInfo.size + + ifnameAttr.paddedLen + + linkInfoAttr.paddedLen + + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWLINK, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK + | NetlinkFlags.NLM_F_CREATE | NetlinkFlags.NLM_F_EXCL, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let info = InterfaceInfo( + family: UInt8(AddressFamily.AF_UNSPEC), + index: 0, + flags: 0, + change: 0) + requestOffset = try info.appendBuffer(&requestBuffer, offset: requestOffset) + + // IFLA_IFNAME + requestOffset = try ifnameAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let next = requestBuffer.copyIn(buffer: nameBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_IFNAME") + } + // Pad NUL-terminated name to NLA 4-byte boundary. + requestOffset = next + (ifnameAttr.paddedLen - RTAttribute.size - nameBytes.count) + + // IFLA_LINKINFO -> IFLA_INFO_KIND + requestOffset = try linkInfoAttr.appendBuffer(&requestBuffer, offset: requestOffset) + requestOffset = try kindAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let after = requestBuffer.copyIn(buffer: kindBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_INFO_KIND") + } + requestOffset = after + (kindAttr.paddedLen - RTAttribute.size - kindBytes.count) + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWLINK) { InterfaceInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Remove a link by name via `RTM_DELLINK`. + /// + /// Throws on netlink error. Callers wanting idempotent removal should + /// catch and inspect the thrown error (e.g. `ENODEV` ⇒ already gone). + public func linkDel(name: String) throws { + let interfaceIndex = try getInterfaceIndex(name) + let requestSize = NetlinkMessageHeader.size + InterfaceInfo.size + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_DELLINK, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let info = InterfaceInfo( + family: UInt8(AddressFamily.AF_UNSPEC), + index: interfaceIndex, + flags: 0, + change: 0) + requestOffset = try info.appendBuffer(&requestBuffer, offset: requestOffset) + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_DELLINK) { InterfaceInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Performs a link get command on an interface. + /// Returns information about the interface. + /// - Parameter interface: The name of the interface to query. + public func linkGet(interface: String? = nil, includeStats: Bool = false) throws -> [LinkResponse] { + // ip link ip show + let maskAttr = RTAttribute( + len: UInt16(RTAttribute.size + MemoryLayout.size), type: LinkAttributeType.IFLA_EXT_MASK) + let interfaceName = try interface.map { try getInterfaceName($0) } + let interfaceNameAttr = interfaceName.map { + RTAttribute(len: UInt16(RTAttribute.size + $0.count), type: LinkAttributeType.IFLA_IFNAME) + } + let requestSize = + NetlinkMessageHeader.size + InterfaceInfo.size + maskAttr.paddedLen + (interfaceNameAttr?.paddedLen ?? 0) + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let flags = + interface != nil ? NetlinkFlags.NLM_F_REQUEST : (NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_DUMP) + let requestHeader = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_GETLINK, + flags: flags, + pid: socket.pid) + requestOffset = try requestHeader.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = InterfaceInfo( + family: UInt8(AddressFamily.AF_PACKET), + index: 0, + flags: InterfaceFlags.IFF_UP, + change: InterfaceFlags.DEFAULT_CHANGE) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + var filters = LinkAttributeMaskFilter.RTEXT_FILTER_VF + if !includeStats { + filters |= LinkAttributeMaskFilter.RTEXT_FILTER_SKIP_STATS + } + + requestOffset = try maskAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + var requestOffset = requestBuffer.copyIn( + as: UInt32.self, + value: filters, + offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_EXT_MASK") + } + + if let interfaceNameAttr { + if let interfaceName { + requestOffset = try interfaceNameAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let updatedRequestOffset = requestBuffer.copyIn(buffer: interfaceName, offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFLA_IFNAME") + } + requestOffset = updatedRequestOffset + } + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, attrDataLists) = try parseResponse(infoType: NetlinkType.RTM_NEWLINK) { InterfaceInfo() } + var linkResponses: [LinkResponse] = [] + for i in 0...size * ipAddressBytes.count + let requestSize = NetlinkMessageHeader.size + AddressInfo.size + 2 * addressAttrSize + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWADDR, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + seq: 0, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = AddressInfo( + family: UInt8(AddressFamily.AF_INET), + prefixLength: ipv4Address.prefix.length, + flags: 0, + scope: NetlinkScope.RT_SCOPE_UNIVERSE, + index: UInt32(interfaceIndex)) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + let ipLocalAttr = RTAttribute(len: UInt16(addressAttrSize), type: AddressAttributeType.IFA_LOCAL) + requestOffset = try ipLocalAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard var requestOffset = requestBuffer.copyIn(buffer: ipAddressBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFA_LOCAL") + } + + let ipAddressAttr = RTAttribute(len: UInt16(addressAttrSize), type: AddressAttributeType.IFA_ADDRESS) + requestOffset = try ipAddressAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let requestOffset = requestBuffer.copyIn(buffer: ipAddressBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFA_ADDRESS") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWADDR) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Adds an IPv6 address to an interface. + /// - Parameters: + /// - interface: The name of the interface. + /// - ipv6Address: The CIDRv6 address describing the interface IP and subnet prefix length. + public func addressAdd(interface: String, ipv6Address: CIDRv6) throws { + let interfaceIndex = try getInterfaceIndex(interface) + + let ipAddressBytes = ipv6Address.address.bytes + let addressAttrSize = RTAttribute.size + MemoryLayout.size * ipAddressBytes.count + let requestSize = NetlinkMessageHeader.size + AddressInfo.size + addressAttrSize + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWADDR, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + seq: 0, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = AddressInfo( + family: UInt8(AddressFamily.AF_INET6), + prefixLength: ipv6Address.prefix.length, + flags: AddressFlags.IFA_F_PERMANENT | AddressFlags.IFA_F_NODAD, + scope: NetlinkScope.RT_SCOPE_UNIVERSE, + index: UInt32(interfaceIndex)) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + let ipAddressAttr = RTAttribute(len: UInt16(addressAttrSize), type: AddressAttributeType.IFA_ADDRESS) + requestOffset = try ipAddressAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let requestOffset = requestBuffer.copyIn(buffer: ipAddressBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "IFA_ADDRESS") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWADDR) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Adds an IPv4 route to an interface. + /// - Parameters: + /// - interface: The name of the interface. + /// - dstIpv4Addr: The CIDRv4 address describing the gateway IP and subnet prefix length. + /// - srcIpv4Addr: The source IPv4 address to route from. + public func routeAdd( + interface: String, + dstIpv4Addr: CIDRv4, + srcIpv4Addr: IPv4Address? + ) throws { + // ip route add [dest-cidr] dev [interface] [src [src-addr]] proto kernel + let interfaceIndex = try getInterfaceIndex(interface) + + let dstAddrBytes = dstIpv4Addr.address.bytes + let dstAddrAttrSize = RTAttribute.size + dstAddrBytes.count + let srcAddrAttrSize: Int + if let srcIpv4Addr { + let srcAddrBytes = srcIpv4Addr.bytes + srcAddrAttrSize = RTAttribute.size + srcAddrBytes.count + } else { + srcAddrAttrSize = 0 + } + let interfaceAttrSize = RTAttribute.size + MemoryLayout.size + let requestSize = + NetlinkMessageHeader.size + RouteInfo.size + dstAddrAttrSize + srcAddrAttrSize + interfaceAttrSize + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWROUTE, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = RouteInfo( + family: UInt8(AddressFamily.AF_INET), + dstLen: dstIpv4Addr.prefix.length, + srcLen: 0, + tos: 0, + table: RouteTable.MAIN, + proto: RouteProtocol.KERNEL, + scope: RouteScope.LINK, + type: RouteType.UNICAST, + flags: 0) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + let dstAddrAttr = RTAttribute(len: UInt16(dstAddrAttrSize), type: RouteAttributeType.DST) + requestOffset = try dstAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard var requestOffset = requestBuffer.copyIn(buffer: dstAddrBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_DST") + } + + if let srcIpv4Addr { + let srcAddrBytes = srcIpv4Addr.bytes + let srcAddrAttr = RTAttribute(len: UInt16(srcAddrAttrSize), type: RouteAttributeType.PREFSRC) + requestOffset = try srcAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let newOffset = requestBuffer.copyIn(buffer: srcAddrBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_PREFSRC") + } + requestOffset = newOffset + } + + let interfaceAttr = RTAttribute(len: UInt16(interfaceAttrSize), type: RouteAttributeType.OIF) + requestOffset = try interfaceAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let requestOffset = requestBuffer.copyIn( + as: UInt32.self, + value: UInt32(interfaceIndex), + offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_OIF") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWROUTE) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Adds a default IPv4 route to an interface. + /// - Parameters: + /// - interface: The name of the interface. + /// - ipv4Gateway: The gateway address, or nil. + public func routeAddDefault( + interface: String, + ipv4Gateway: IPv4Address? + ) throws { + // ip route add default via [gateway] dev [interface] or + // ip route add default dev [interface] + let dstAddrBytes = ipv4Gateway?.bytes + let dstAddrAttrSize: Int + if let dstAddrBytes { + dstAddrAttrSize = RTAttribute.size + dstAddrBytes.count + } else { + dstAddrAttrSize = 0 + } + + let interfaceAttrSize = RTAttribute.size + MemoryLayout.size + let interfaceIndex = try getInterfaceIndex(interface) + let requestSize = NetlinkMessageHeader.size + RouteInfo.size + dstAddrAttrSize + interfaceAttrSize + + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWROUTE, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = RouteInfo( + family: UInt8(AddressFamily.AF_INET), + dstLen: 0, + srcLen: 0, + tos: 0, + table: RouteTable.MAIN, + proto: RouteProtocol.BOOT, + scope: ipv4Gateway != nil ? RouteScope.UNIVERSE : RouteScope.LINK, + type: RouteType.UNICAST, + flags: 0) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + if let dstAddrBytes { + let dstAddrAttr = RTAttribute(len: UInt16(dstAddrAttrSize), type: RouteAttributeType.GATEWAY) + requestOffset = try dstAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let newOffset = requestBuffer.copyIn(buffer: dstAddrBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_GATEWAY") + } + requestOffset = newOffset + } + + let interfaceAttr = RTAttribute(len: UInt16(interfaceAttrSize), type: RouteAttributeType.OIF) + requestOffset = try interfaceAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let requestOffset = requestBuffer.copyIn( + as: UInt32.self, + value: UInt32(interfaceIndex), + offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_OIF") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWROUTE) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Adds an IPv6 route to an interface. Used to install an on-link host + /// route (typically a /128) to a gateway that lives outside the interface's + /// subnet, so the kernel will accept the v6 default route. The chosen + /// `proto STATIC, scope LINK` matches what `iproute2` emits for explicit + /// `ip -6 route add /128 dev `. + /// - Parameters: + /// - interface: The name of the interface. + /// - dstIpv6Addr: The CIDRv6 address describing the destination network and prefix length. + /// - srcIpv6Addr: The source IPv6 address to route from. + public func routeAdd( + interface: String, + dstIpv6Addr: CIDRv6, + srcIpv6Addr: IPv6Address? + ) throws { + let interfaceIndex = try getInterfaceIndex(interface) + + let dstAddrBytes = dstIpv6Addr.address.bytes + let dstAddrAttrSize = RTAttribute.size + dstAddrBytes.count + let srcAddrAttrSize: Int + if let srcIpv6Addr { + let srcAddrBytes = srcIpv6Addr.bytes + srcAddrAttrSize = RTAttribute.size + srcAddrBytes.count + } else { + srcAddrAttrSize = 0 + } + let interfaceAttrSize = RTAttribute.size + MemoryLayout.size + let requestSize = + NetlinkMessageHeader.size + RouteInfo.size + dstAddrAttrSize + srcAddrAttrSize + interfaceAttrSize + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWROUTE, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = RouteInfo( + family: UInt8(AddressFamily.AF_INET6), + dstLen: dstIpv6Addr.prefix.length, + srcLen: 0, + tos: 0, + table: RouteTable.MAIN, + proto: RouteProtocol.STATIC, + scope: RouteScope.LINK, + type: RouteType.UNICAST, + flags: 0) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + let dstAddrAttr = RTAttribute(len: UInt16(dstAddrAttrSize), type: RouteAttributeType.DST) + requestOffset = try dstAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard var requestOffset = requestBuffer.copyIn(buffer: dstAddrBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_DST") + } + + if let srcIpv6Addr { + let srcAddrBytes = srcIpv6Addr.bytes + let srcAddrAttr = RTAttribute(len: UInt16(srcAddrAttrSize), type: RouteAttributeType.PREFSRC) + requestOffset = try srcAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard let newOffset = requestBuffer.copyIn(buffer: srcAddrBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_PREFSRC") + } + requestOffset = newOffset + } + + let interfaceAttr = RTAttribute(len: UInt16(interfaceAttrSize), type: RouteAttributeType.OIF) + requestOffset = try interfaceAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let requestOffset = requestBuffer.copyIn( + as: UInt32.self, + value: UInt32(interfaceIndex), + offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_OIF") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWROUTE) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + /// Adds a default IPv6 route to an interface. + /// - Parameters: + /// - interface: The name of the interface. + /// - ipv6Gateway: The gateway address. + public func routeAddDefault( + interface: String, + ipv6Gateway: IPv6Address + ) throws { + let gatewayBytes = ipv6Gateway.bytes + let gatewaySize = RTAttribute.size + gatewayBytes.count + + let interfaceAttrSize = RTAttribute.size + MemoryLayout.size + let interfaceIndex = try getInterfaceIndex(interface) + let requestSize = NetlinkMessageHeader.size + RouteInfo.size + gatewaySize + interfaceAttrSize + + var requestBuffer = [UInt8](repeating: 0, count: requestSize) + var requestOffset = 0 + + let header = NetlinkMessageHeader( + len: UInt32(requestBuffer.count), + type: NetlinkType.RTM_NEWROUTE, + flags: NetlinkFlags.NLM_F_REQUEST | NetlinkFlags.NLM_F_ACK | NetlinkFlags.NLM_F_EXCL + | NetlinkFlags.NLM_F_CREATE, + pid: socket.pid) + requestOffset = try header.appendBuffer(&requestBuffer, offset: requestOffset) + + let requestInfo = RouteInfo( + family: UInt8(AddressFamily.AF_INET6), + dstLen: 0, + srcLen: 0, + tos: 0, + table: RouteTable.MAIN, + proto: RouteProtocol.BOOT, + scope: RouteScope.UNIVERSE, + type: RouteType.UNICAST, + flags: 0) + requestOffset = try requestInfo.appendBuffer(&requestBuffer, offset: requestOffset) + + let dstAddrAttr = RTAttribute(len: UInt16(gatewaySize), type: RouteAttributeType.GATEWAY) + requestOffset = try dstAddrAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard var requestOffset = requestBuffer.copyIn(buffer: gatewayBytes, offset: requestOffset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_GATEWAY") + } + let interfaceAttr = RTAttribute(len: UInt16(interfaceAttrSize), type: RouteAttributeType.OIF) + requestOffset = try interfaceAttr.appendBuffer(&requestBuffer, offset: requestOffset) + guard + let requestOffset = requestBuffer.copyIn( + as: UInt32.self, + value: UInt32(interfaceIndex), + offset: requestOffset) + else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "RTA_OIF") + } + + guard requestOffset == requestSize else { + throw Error.unexpectedOffset(offset: requestOffset, size: requestSize) + } + + try sendRequest(buffer: &requestBuffer) + let (infos, _) = try parseResponse(infoType: NetlinkType.RTM_NEWROUTE) { AddressInfo() } + guard infos.count == 0 else { + throw Error.unexpectedResultSet(count: infos.count, expected: 0) + } + } + + private func getInterfaceName(_ interface: String) throws -> [UInt8] { + guard let interfaceNameData = interface.data(using: .utf8) else { + throw BindError.sendMarshalFailure(type: "String", field: "interface") + } + + var interfaceName = [UInt8](interfaceNameData) + interfaceName.append(0) + + while interfaceName.count % MemoryLayout.size != 0 { + interfaceName.append(0) + } + + return interfaceName + } + + private func getInterfaceIndex(_ interface: String) throws -> Int32 { + let linkResponses = try linkGet(interface: interface) + guard linkResponses.count == 1 else { + throw Error.unexpectedResultSet(count: linkResponses.count, expected: 1) + } + + return linkResponses[0].interfaceIndex + } + + private func sendRequest(buffer: inout [UInt8]) throws { + log.trace("SEND-LENGTH: \(buffer.count)") + log.trace("SEND-DUMP: \(buffer[0.. ([UInt8], Int) { + var buffer = [UInt8](repeating: 0, count: Self.receiveDataLength) + let size = try socket.recv(buf: &buffer, len: Self.receiveDataLength, flags: 0) + log.trace("RECV-LENGTH: \(size)") + log.trace("RECV-DUMP: \(buffer[0..(infoType: UInt16? = nil, _ infoProvider: () -> T) throws -> ( + [T], [[RTAttributeData]] + ) { + var infos: [T] = [] + var attrDataLists: [[RTAttributeData]] = [] + + var moreResponses = false + repeat { + var (buffer, size) = try receiveResponse() + var offset = 0 + + // A single buffer may contain multiple netlink messages + while offset < size { + let messageStart = offset + let header: NetlinkMessageHeader + (header, offset) = try parseHeader(buffer: &buffer, offset: offset) + + if let infoType { + if header.type == infoType { + log.trace( + "RECV-INFO-DUMP: dump = \(buffer[offset.. (Int32, Int) { + guard let errorPtr = buffer.bind(as: Int32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkErrorMessage", field: "error") + } + + let rc = errorPtr.pointee + log.trace("RECV-ERR-CODE: \(rc)") + + return (rc, offset + MemoryLayout.size) + } + + private func parseErrorResponse(buffer: inout [UInt8], offset: Int) throws -> Int { + var (rc, offset) = try parseErrorCode(buffer: &buffer, offset: offset) + log.trace( + "RECV-ERR-HEADER-DUMP: dump = \(buffer[offset.. (NetlinkMessageHeader, Int) { + log.trace("RECV-HEADER-DUMP: dump = \(buffer[offset.. ( + [RTAttributeData], Int + ) { + var attrDatas: [RTAttributeData] = [] + var offset = offset + var residualCount = residualCount + log.trace("RECV-RESIDUAL: \(residualCount)") + + while residualCount > 0 { + var attr = RTAttribute() + log.trace(" RECV-ATTR-DUMP: dump = \(buffer[offset..= 0 { + log.trace(" RECV-ATTR-DATA-DUMP: dump = \(buffer[offset.. Int + func recv(buf: UnsafeMutableRawPointer!, len: Int, flags: Int32) throws -> Int +} + +/// A netlink socket provider. +public typealias NetlinkSocketProvider = () throws -> any NetlinkSocket + +/// Errors thrown when interacting with a netlink socket. +public enum NetlinkSocketError: Swift.Error, CustomStringConvertible, Equatable { + case socketFailure(rc: Int32) + case bindFailure(rc: Int32) + case sendFailure(rc: Int32) + case recvFailure(rc: Int32) + case notImplemented + + /// The description of the errors. + public var description: String { + switch self { + case .socketFailure(let rc): + return "could not create netlink socket, rc = \(rc)" + case .bindFailure(let rc): + return "could not bind netlink socket, rc = \(rc)" + case .sendFailure(let rc): + return "could not send netlink packet, rc = \(rc)" + case .recvFailure(let rc): + return "could not receive netlink packet, rc = \(rc)" + case .notImplemented: + return "socket function not implemented for platform" + } + } +} + +#if os(Linux) +#if canImport(Musl) +import Musl +let osSocket = Musl.socket +let osBind = Musl.bind +let osSend = Musl.send +let osRecv = Musl.recv +#elseif canImport(Glibc) +import Glibc +let osSocket = Glibc.socket +let osBind = Glibc.bind +let osSend = Glibc.send +let osRecv = Glibc.recv +#endif + +/// A default implementation of `NetlinkSocket`. +public class DefaultNetlinkSocket: NetlinkSocket { + private let sockfd: Int32 + + /// The process identifier of the process creating this socket. + public let pid: UInt32 + + /// Creates a new instance. + public init() throws { + pid = UInt32(getpid()) + sockfd = osSocket(Int32(AddressFamily.AF_NETLINK), SocketType.SOCK_RAW, NetlinkProtocol.NETLINK_ROUTE) + guard sockfd >= 0 else { + throw NetlinkSocketError.socketFailure(rc: errno) + } + + let addr = SockaddrNetlink(family: AddressFamily.AF_NETLINK, pid: pid) + var buffer = [UInt8](repeating: 0, count: SockaddrNetlink.size) + _ = try addr.appendBuffer(&buffer, offset: 0) + guard let ptr = buffer.bind(as: sockaddr.self, size: buffer.count) else { + throw NetlinkSocketError.bindFailure(rc: 0) + } + guard osBind(sockfd, ptr, UInt32(buffer.count)) >= 0 else { + throw NetlinkSocketError.bindFailure(rc: errno) + } + } + + deinit { + close(sockfd) + } + + /// Sends a request to a netlink socket. + /// Returns the number of bytes sent. + /// - Parameters: + /// - buf: The buffer to send. + /// - len: The length of the buffer to send. + /// - flags: The send flags. + public func send(buf: UnsafeRawPointer!, len: Int, flags: Int32) throws -> Int { + let count = osSend(sockfd, buf, len, flags) + guard count >= 0 else { + throw NetlinkSocketError.sendFailure(rc: errno) + } + + return count + } + + /// Receives a response from a netlink socket. + /// Returns the number of bytes received. + /// - Parameters: + /// - buf: The buffer to receive into. + /// - len: The maximum number of bytes to receive. + /// - flags: The receive flags. + public func recv(buf: UnsafeMutableRawPointer!, len: Int, flags: Int32) throws -> Int { + let count = osRecv(sockfd, buf, len, flags) + guard count >= 0 else { + throw NetlinkSocketError.recvFailure(rc: errno) + } + + return count + } +} +#else +public class DefaultNetlinkSocket: NetlinkSocket { + public var pid: UInt32 { 0 } + + public init() throws {} + + public func send(buf: UnsafeRawPointer!, len: Int, flags: Int32) throws -> Int { + throw NetlinkSocketError.notImplemented + } + + public func recv(buf: UnsafeMutableRawPointer!, len: Int, flags: Int32) throws -> Int { + throw NetlinkSocketError.notImplemented + } +} +#endif diff --git a/Sources/ContainerizationNetlink/Types.swift b/Sources/ContainerizationNetlink/Types.swift new file mode 100644 index 0000000..81d62e2 --- /dev/null +++ b/Sources/ContainerizationNetlink/Types.swift @@ -0,0 +1,889 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras + +struct SocketType { + static let SOCK_RAW: Int32 = 3 +} + +struct AddressFamily { + static let AF_UNSPEC: UInt16 = 0 + static let AF_INET: UInt16 = 2 + static let AF_INET6: UInt16 = 10 + static let AF_NETLINK: UInt16 = 16 + static let AF_PACKET: UInt16 = 17 +} + +struct ArpHardware { + static let ARPHRD_ETHER: UInt16 = 1 +} + +struct NetlinkProtocol { + static let NETLINK_ROUTE: Int32 = 0 +} + +struct NetlinkType { + static let NLMSG_NOOP: UInt16 = 1 + static let NLMSG_ERROR: UInt16 = 2 + static let NLMSG_DONE: UInt16 = 3 + static let NLMSG_OVERRUN: UInt16 = 4 + static let RTM_NEWLINK: UInt16 = 16 + static let RTM_DELLINK: UInt16 = 17 + static let RTM_GETLINK: UInt16 = 18 + static let RTM_NEWADDR: UInt16 = 20 + static let RTM_NEWROUTE: UInt16 = 24 +} + +struct NetlinkFlags { + static let NLM_F_REQUEST: UInt16 = 0x01 + static let NLM_F_MULTI: UInt16 = 0x02 + static let NLM_F_ACK: UInt16 = 0x04 + static let NLM_F_ECHO: UInt16 = 0x08 + static let NLM_F_DUMP_INTR: UInt16 = 0x10 + static let NLM_F_DUMP_FILTERED: UInt16 = 0x20 + + // GET request + static let NLM_F_ROOT: UInt16 = 0x100 + static let NLM_F_MATCH: UInt16 = 0x200 + static let NLM_F_ATOMIC: UInt16 = 0x400 + static let NLM_F_DUMP: UInt16 = NetlinkFlags.NLM_F_ROOT | NetlinkFlags.NLM_F_MATCH + + // NEW request flags + static let NLM_F_REPLACE: UInt16 = 0x100 + static let NLM_F_EXCL: UInt16 = 0x200 + static let NLM_F_CREATE: UInt16 = 0x400 + static let NLM_F_APPEND: UInt16 = 0x800 +} + +struct NetlinkScope { + static let RT_SCOPE_UNIVERSE: UInt8 = 0 +} + +struct InterfaceFlags { + static let IFF_UP: UInt32 = 1 << 0 + static let IFF_LOOPBACK: UInt32 = 1 << 3 + static let IFF_POINTOPOINT: UInt32 = 1 << 4 + static let DEFAULT_CHANGE: UInt32 = 0xffff_ffff +} + +struct LinkAttributeType { + static let IFLA_ADDRESS: UInt16 = 1 + static let IFLA_BROADCAST: UInt16 = 2 + static let IFLA_IFNAME: UInt16 = 3 + static let IFLA_MTU: UInt16 = 4 + static let IFLA_MASTER: UInt16 = 10 + static let IFLA_LINKINFO: UInt16 = 18 + static let IFLA_STATS64: UInt16 = 23 + static let IFLA_EXT_MASK: UInt16 = 29 +} + +/// Nested attribute types inside `IFLA_LINKINFO`. +struct LinkInfoAttributeType { + static let IFLA_INFO_KIND: UInt16 = 1 +} + +struct LinkAttributeMaskFilter { + static let RTEXT_FILTER_VF: UInt32 = 1 << 0 + static let RTEXT_FILTER_SKIP_STATS: UInt32 = 1 << 3 +} + +struct AddressAttributeType { + // subnet mask + static let IFA_ADDRESS: UInt16 = 1 + // IPv4 address + static let IFA_LOCAL: UInt16 = 2 +} + +struct AddressFlags { + static let IFA_F_NODAD: UInt8 = 0x02 + static let IFA_F_PERMANENT: UInt8 = 0x80 +} + +struct RouteTable { + static let MAIN: UInt8 = 254 +} + +struct RouteProtocol { + static let UNSPEC: UInt8 = 0 + static let REDIRECT: UInt8 = 1 + static let KERNEL: UInt8 = 2 + static let BOOT: UInt8 = 3 + static let STATIC: UInt8 = 4 +} + +struct RouteScope { + static let UNIVERSE: UInt8 = 0 + static let LINK: UInt8 = 253 +} + +struct RouteType { + static let UNSPEC: UInt8 = 0 + static let UNICAST: UInt8 = 1 +} + +struct RouteAttributeType { + static let UNSPEC: UInt16 = 0 + static let DST: UInt16 = 1 + static let SRC: UInt16 = 2 + static let IIF: UInt16 = 3 + static let OIF: UInt16 = 4 + static let GATEWAY: UInt16 = 5 + static let PRIORITY: UInt16 = 6 + static let PREFSRC: UInt16 = 7 +} + +struct SockaddrNetlink: Bindable, Equatable { + static let size = 12 + + var family: UInt16 + var _pad: UInt16 = 0 + var pid: UInt32 + var groups: UInt32 + + init(family: UInt16 = 0, pid: UInt32 = 0, groups: UInt32 = 0) { + self.family = family + self.pid = pid + self.groups = groups + } + + func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt16.self, value: family, offset: offset) else { + throw BindError.sendMarshalFailure(type: "SockaddrNetlink", field: "family") + } + guard let offset = buffer.copyIn(as: UInt16.self, value: 0, offset: offset) else { + throw BindError.sendMarshalFailure(type: "SockaddrNetlink", field: "_pad") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: pid, offset: offset) else { + throw BindError.sendMarshalFailure(type: "SockaddrNetlink", field: "pid") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: groups, offset: offset) else { + throw BindError.sendMarshalFailure(type: "SockaddrNetlink", field: "groups") + } + + return offset + } + + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "SockaddrNetlink", field: "family") + } + family = value + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "SockaddrNetlink", field: "_pad") + } + _pad = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "SockaddrNetlink", field: "pid") + } + pid = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "SockaddrNetlink", field: "groups") + } + groups = value + + return offset + } +} + +struct NetlinkMessageHeader: Bindable, Equatable { + static let size = 16 + + var len: UInt32 + var type: UInt16 + var flags: UInt16 + var seq: UInt32 + var pid: UInt32 + + init(len: UInt32 = 0, type: UInt16 = 0, flags: UInt16 = 0, seq: UInt32? = nil, pid: UInt32 = 0) { + self.len = len + self.type = type + self.flags = flags + self.seq = seq ?? UInt32.random(in: 0.. Int { + guard let offset = buffer.copyIn(as: UInt32.self, value: len, offset: offset) else { + throw BindError.sendMarshalFailure(type: "NetlinkMessageHeader", field: "len") + } + guard let offset = buffer.copyIn(as: UInt16.self, value: type, offset: offset) else { + throw BindError.sendMarshalFailure(type: "NetlinkMessageHeader", field: "type") + } + guard let offset = buffer.copyIn(as: UInt16.self, value: flags, offset: offset) else { + throw BindError.sendMarshalFailure(type: "NetlinkMessageHeader", field: "flags") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: seq, offset: offset) else { + throw BindError.sendMarshalFailure(type: "NetlinkMessageHeader", field: "seq") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: pid, offset: offset) else { + throw BindError.sendMarshalFailure(type: "NetlinkMessageHeader", field: "pid") + } + + return offset + } + + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkMessageHeader", field: "len") + } + len = value + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkMessageHeader", field: "type") + } + type = value + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkMessageHeader", field: "flags") + } + flags = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkMessageHeader", field: "seq") + } + seq = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "NetlinkMessageHeader", field: "pid") + } + pid = value + + return offset + } + + var moreResponses: Bool { + (self.flags & NetlinkFlags.NLM_F_MULTI) != 0 + && (self.type != NetlinkType.NLMSG_DONE && self.type != NetlinkType.NLMSG_ERROR + && self.type != NetlinkType.NLMSG_OVERRUN) + } +} + +struct InterfaceInfo: Bindable, Equatable { + static let size = 16 + + var family: UInt8 + var _pad: UInt8 = 0 + var type: UInt16 + var index: Int32 + var flags: UInt32 + var change: UInt32 + + init( + family: UInt8 = UInt8(AddressFamily.AF_UNSPEC), type: UInt16 = 0, index: Int32 = 0, flags: UInt32 = 0, + change: UInt32 = 0 + ) { + self.family = family + self.type = type + self.index = index + self.flags = flags + self.change = change + } + + func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt8.self, value: family, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "family") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: _pad, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "_pad") + } + guard let offset = buffer.copyIn(as: UInt16.self, value: type, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "type") + } + guard let offset = buffer.copyIn(as: Int32.self, value: index, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "index") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: flags, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "flags") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: change, offset: offset) else { + throw BindError.sendMarshalFailure(type: "InterfaceInfo", field: "change") + } + + return offset + } + + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "family") + } + family = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "_pad") + } + _pad = value + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "type") + } + type = value + + guard let (offset, value) = buffer.copyOut(as: Int32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "index") + } + index = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "flags") + } + flags = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "InterfaceInfo", field: "change") + } + change = value + + return offset + } +} + +struct AddressInfo: Bindable, Equatable { + static let size = 8 + + var family: UInt8 + var prefixLength: UInt8 + var flags: UInt8 + var scope: UInt8 + var index: UInt32 + + init( + family: UInt8 = UInt8(AddressFamily.AF_UNSPEC), prefixLength: UInt8 = 32, flags: UInt8 = 0, scope: UInt8 = 0, + index: UInt32 = 0 + ) { + self.family = family + self.prefixLength = prefixLength + self.flags = flags + self.scope = scope + self.index = index + } + + func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt8.self, value: family, offset: offset) else { + throw BindError.sendMarshalFailure(type: "AddressInfo", field: "family") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: prefixLength, offset: offset) else { + throw BindError.sendMarshalFailure(type: "AddressInfo", field: "prefixLength") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: flags, offset: offset) else { + throw BindError.sendMarshalFailure(type: "AddressInfo", field: "flags") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: scope, offset: offset) else { + throw BindError.sendMarshalFailure(type: "AddressInfo", field: "scope") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: index, offset: offset) else { + throw BindError.sendMarshalFailure(type: "AddressInfo", field: "index") + } + + return offset + } + + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "AddressInfo", field: "family") + } + family = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "AddressInfo", field: "prefixLength") + } + prefixLength = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "AddressInfo", field: "flags") + } + flags = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "AddressInfo", field: "scope") + } + scope = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "AddressInfo", field: "index") + } + index = value + + return offset + } +} + +struct RouteInfo: Bindable, Equatable { + static let size = 12 + + var family: UInt8 + var dstLen: UInt8 + var srcLen: UInt8 + var tos: UInt8 + var table: UInt8 + var proto: UInt8 + var scope: UInt8 + var type: UInt8 + var flags: UInt32 + + init( + family: UInt8 = UInt8(AddressFamily.AF_INET), + dstLen: UInt8, + srcLen: UInt8, + tos: UInt8, + table: UInt8, + proto: UInt8, + scope: UInt8, + type: UInt8, + flags: UInt32 + ) { + self.family = family + self.dstLen = dstLen + self.srcLen = srcLen + self.tos = tos + self.table = table + self.proto = proto + self.scope = scope + self.type = type + self.flags = flags + } + + func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt8.self, value: family, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "family") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: dstLen, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "dstLen") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: srcLen, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "srcLen") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: tos, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "tos") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: table, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "table") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: proto, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "proto") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: scope, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "scope") + } + guard let offset = buffer.copyIn(as: UInt8.self, value: type, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "type") + } + guard let offset = buffer.copyIn(as: UInt32.self, value: flags, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RouteInfo", field: "flags") + } + + return offset + } + + mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "family") + } + family = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "dstLen") + } + dstLen = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "srcLen") + } + srcLen = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "tos") + } + tos = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "table") + } + table = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "proto") + } + proto = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "scope") + } + scope = value + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "type") + } + type = value + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RouteInfo", field: "flags") + } + flags = value + + return offset + } +} + +/// A route information. +public struct RTAttribute: Bindable, Equatable { + package static let size = 4 + + public var len: UInt16 + public var type: UInt16 + public var paddedLen: Int { Int(((len + 3) >> 2) << 2) } + + init(len: UInt16 = 0, type: UInt16 = 0) { + self.len = len + self.type = type + } + + package func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt16.self, value: len, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "len") + } + guard let offset = buffer.copyIn(as: UInt16.self, value: type, offset: offset) else { + throw BindError.sendMarshalFailure(type: "RTAttribute", field: "type") + } + + return offset + } + + package mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RTAttribute", field: "len") + } + len = value + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "RTAttribute", field: "type") + } + type = value + + return offset + } +} + +/// A route information with data. +public struct RTAttributeData { + public let attribute: RTAttribute + public let data: [UInt8] +} + +/// A response from the get link command. +public struct LinkResponse { + public let interfaceIndex: Int32 + public let interfaceFlags: UInt32 + public let interfaceType: UInt16 + public let attrDatas: [RTAttributeData] + + public var isLoopback: Bool { + (interfaceFlags & InterfaceFlags.IFF_LOOPBACK) != 0 + } + + public var isEthernet: Bool { + interfaceType == ArpHardware.ARPHRD_ETHER + && (interfaceFlags & (InterfaceFlags.IFF_LOOPBACK | InterfaceFlags.IFF_POINTOPOINT)) == 0 + } + + public var address: [UInt8]? { + attrDatas + .filter { $0.attribute.type == LinkAttributeType.IFLA_ADDRESS } + .first + .map { $0.data } + } + + /// Extract network interface statistics from the response attributes + public func getStatistics() throws -> LinkStatistics64? { + for attrData in attrDatas { + if attrData.attribute.type == LinkAttributeType.IFLA_STATS64 { + var stats = LinkStatistics64() + var buffer = attrData.data + _ = try stats.bindBuffer(&buffer, offset: 0) + return stats + } + } + + return nil + } +} + +/// Network interface statistics (64-bit version) +public struct LinkStatistics64: Bindable, Equatable { + package static let size = 23 * 8 + + public var rxPackets: UInt64 + public var txPackets: UInt64 + public var rxBytes: UInt64 + public var txBytes: UInt64 + public var rxErrors: UInt64 + public var txErrors: UInt64 + public var rxDropped: UInt64 + public var txDropped: UInt64 + public var multicast: UInt64 + public var collisions: UInt64 + public var rxLengthErrors: UInt64 + public var rxOverErrors: UInt64 + public var rxCrcErrors: UInt64 + public var rxFrameErrors: UInt64 + public var rxFifoErrors: UInt64 + public var rxMissedErrors: UInt64 + public var txAbortedErrors: UInt64 + public var txCarrierErrors: UInt64 + public var txFifoErrors: UInt64 + public var txHeartbeatErrors: UInt64 + public var txWindowErrors: UInt64 + public var rxCompressed: UInt64 + public var txCompressed: UInt64 + + public init() { + self.rxPackets = 0 + self.txPackets = 0 + self.rxBytes = 0 + self.txBytes = 0 + self.rxErrors = 0 + self.txErrors = 0 + self.rxDropped = 0 + self.txDropped = 0 + self.multicast = 0 + self.collisions = 0 + self.rxLengthErrors = 0 + self.rxOverErrors = 0 + self.rxCrcErrors = 0 + self.rxFrameErrors = 0 + self.rxFifoErrors = 0 + self.rxMissedErrors = 0 + self.txAbortedErrors = 0 + self.txCarrierErrors = 0 + self.txFifoErrors = 0 + self.txHeartbeatErrors = 0 + self.txWindowErrors = 0 + self.rxCompressed = 0 + self.txCompressed = 0 + } + + package func appendBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let offset = buffer.copyIn(as: UInt64.self, value: rxPackets, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxPackets") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txPackets, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txPackets") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxBytes, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxBytes") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txBytes, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txBytes") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxDropped, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxDropped") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txDropped, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txDropped") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: multicast, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "multicast") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: collisions, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "collisions") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxLengthErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxLengthErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxOverErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxOverErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxCrcErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxCrcErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxFrameErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxFrameErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxFifoErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxFifoErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxMissedErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxMissedErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txAbortedErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txAbortedErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txCarrierErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txCarrierErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txFifoErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txFifoErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txHeartbeatErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txHeartbeatErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txWindowErrors, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txWindowErrors") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: rxCompressed, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "rxCompressed") + } + guard let offset = buffer.copyIn(as: UInt64.self, value: txCompressed, offset: offset) else { + throw BindError.sendMarshalFailure(type: "LinkStatistics64", field: "txCompressed") + } + + return offset + } + + package mutating func bindBuffer(_ buffer: inout [UInt8], offset: Int) throws -> Int { + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxPackets") + } + rxPackets = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txPackets") + } + txPackets = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxBytes") + } + rxBytes = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txBytes") + } + txBytes = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxErrors") + } + rxErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txErrors") + } + txErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxDropped") + } + rxDropped = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txDropped") + } + txDropped = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "multicast") + } + multicast = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "collisions") + } + collisions = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxLengthErrors") + } + rxLengthErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxOverErrors") + } + rxOverErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxCrcErrors") + } + rxCrcErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxFrameErrors") + } + rxFrameErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxFifoErrors") + } + rxFifoErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxMissedErrors") + } + rxMissedErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txAbortedErrors") + } + txAbortedErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txCarrierErrors") + } + txCarrierErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txFifoErrors") + } + txFifoErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txHeartbeatErrors") + } + txHeartbeatErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txWindowErrors") + } + txWindowErrors = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "rxCompressed") + } + rxCompressed = value + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: offset) else { + throw BindError.recvMarshalFailure(type: "LinkStatistics64", field: "txCompressed") + } + txCompressed = value + + return offset + } +} + +/// Errors thrown when parsing netlink data. +public enum NetlinkDataError: Swift.Error, CustomStringConvertible, Equatable { + case responseError(rc: Int32) + case unsupportedPlatform + + /// The description of the errors. + public var description: String { + switch self { + case .responseError(let rc): + return "netlink response indicates error, rc = \(rc)" + case .unsupportedPlatform: + return "unsupported platform" + } + } +} diff --git a/Sources/ContainerizationOCI/AnnotationKeys.swift b/Sources/ContainerizationOCI/AnnotationKeys.swift new file mode 100644 index 0000000..73f8889 --- /dev/null +++ b/Sources/ContainerizationOCI/AnnotationKeys.swift @@ -0,0 +1,24 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// AnnotationKeys contains a subset of "dictionary keys" for commonly used annotations in an OCI Image Descriptor +/// https://github.com/opencontainers/image-spec/blob/main/annotations.md +public struct AnnotationKeys: Codable, Sendable { + public static let containerizationIndexIndirect = "com.apple.containerization.index.indirect" + public static let containerizationImageName = "com.apple.containerization.image.name" + public static let containerdImageName = "io.containerd.image.name" + public static let openContainersImageName = "org.opencontainers.image.ref.name" +} diff --git a/Sources/ContainerizationOCI/Bundle.swift b/Sources/ContainerizationOCI/Bundle.swift new file mode 100644 index 0000000..fd10e89 --- /dev/null +++ b/Sources/ContainerizationOCI/Bundle.swift @@ -0,0 +1,146 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation + +#if canImport(Musl) +import Musl +private let _mount = Musl.mount +private let _umount = Musl.umount2 +#elseif canImport(Glibc) +import Glibc +private let _mount = Glibc.mount +private let _umount = Glibc.umount2 +#endif + +/// `Bundle` represents an OCI runtime spec bundle for running +/// a container. +public struct Bundle: Sendable { + /// The path to the bundle. + public let path: URL + + /// The path to the OCI runtime spec config.json file. + public var configPath: URL { + self.path.appending(path: "config.json") + } + + /// The path to a rootfs mount inside the bundle. + public var rootfsPath: URL { + self.path.appending(path: "rootfs") + } + + /// Create the OCI bundle. + /// + /// - Parameters: + /// - path: A URL pointing to where to create the bundle on the filesystem. + /// - spec: A data blob that should contain an OCI runtime spec. This will be written + /// to the bundle as a "config.json" file. + public static func create(path: URL, spec: Data) throws -> Bundle { + try self.init(path: path, spec: spec) + } + + /// Create the OCI bundle. + /// + /// - Parameters: + /// - path: A URL pointing to where to create the bundle on the filesystem. + /// - spec: An OCI runtime spec that will be written to the bundle as a "config.json" + /// file. + public static func create(path: URL, spec: ContainerizationOCI.Spec) throws -> Bundle { + try self.init(path: path, spec: spec) + } + + /// Load an OCI bundle from the provided path. + /// + /// - Parameters: + /// - path: A URL pointing to where to load the bundle from on the filesystem. + public static func load(path: URL) throws -> Bundle { + try self.init(path: path) + } + + private init(path: URL) throws { + let fm = FileManager.default + if !fm.fileExists(atPath: path.path) { + throw ContainerizationError(.invalidArgument, message: "no bundle at \(path.path)") + } + self.path = path + } + + // This constructor does not do any validation that data is actually a + // valid OCI spec. + private init(path: URL, spec: Data) throws { + self.path = path + + let fm = FileManager.default + try fm.createDirectory( + atPath: self.path.appending(component: "rootfs").path, + withIntermediateDirectories: true + ) + + try spec.write(to: self.configPath) + } + + private init(path: URL, spec: ContainerizationOCI.Spec) throws { + self.path = path + + let fm = FileManager.default + try fm.createDirectory( + atPath: self.path.appending(component: "rootfs").path, + withIntermediateDirectories: true + ) + + let specData = try JSONEncoder().encode(spec) + try specData.write(to: self.configPath) + } + + /// Delete the OCI bundle from the filesystem. + public func delete() throws { + // Unmount, and then blow away the dir. + #if os(Linux) + let rootfs = self.rootfsPath + if Self.isMountpoint(rootfs) { + guard _umount(rootfs.path, 0) == 0 else { + throw POSIXError.fromErrno() + } + } + #endif + // removeItem is recursive so should blow away the rootfs dir inside as well. + let fm = FileManager.default + try fm.removeItem(at: self.path) + } + + /// Load and return the OCI runtime spec written to the bundle. + public func loadConfig() throws -> ContainerizationOCI.Spec { + let data = try Data(contentsOf: self.configPath) + return try JSONDecoder().decode(ContainerizationOCI.Spec.self, from: data) + } + + private static func isMountpoint(_ path: URL) -> Bool { + var st = stat() + var parent_st = stat() + + guard stat(path.path, &st) == 0 else { + return false + } + + let parentPath = path.deletingLastPathComponent() + guard stat(parentPath.path, &parent_st) == 0 else { + return false + } + + return st.st_dev != parent_st.st_dev + } +} diff --git a/Sources/ContainerizationOCI/Client/Authentication.swift b/Sources/ContainerizationOCI/Client/Authentication.swift new file mode 100644 index 0000000..9ba79c5 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/Authentication.swift @@ -0,0 +1,50 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Abstraction for returning a token needed for logging into an OCI compliant registry. +public protocol Authentication: Sendable { + func token() async throws -> String +} + +/// Type representing authentication information for client to access the registry. +public struct BasicAuthentication: Authentication { + /// The username for the authentication. + let username: String + /// The password or identity token for the user. + let password: String + + public init(username: String, password: String) { + self.username = username + self.password = password + } + + /// Get a token using the provided username and password. This will be a + /// base64 encoded string of the username and password delimited by a colon. + public func token() async throws -> String { + let credentials = "\(username):\(password)" + if let authenticationData = credentials.data(using: .utf8)?.base64EncodedString() { + return "Basic \(authenticationData)" + } + throw Error.invalidCredentials + } + + /// `BasicAuthentication` errors. + public enum Error: Swift.Error { + case invalidCredentials + } +} diff --git a/Sources/ContainerizationOCI/Client/KeychainHelper.swift b/Sources/ContainerizationOCI/Client/KeychainHelper.swift new file mode 100644 index 0000000..7d64b8f --- /dev/null +++ b/Sources/ContainerizationOCI/Client/KeychainHelper.swift @@ -0,0 +1,142 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +import Foundation +import ContainerizationOS + +/// Helper type to lookup registry related values in the macOS keychain. +public struct KeychainHelper: Sendable { + private let securityDomain: String + private let accessGroup: String? + + /// Create a new keychain helper. + /// - Parameters: + /// - securityDomain: The security domain used to fetch registry entries in the keychain. + /// - accessGroup: If present, the access group used to fetch registry entries in the keychain. + public init(securityDomain: String, accessGroup: String? = nil) { + self.securityDomain = securityDomain + self.accessGroup = accessGroup + } + + /// Lookup authentication data for a given registry hostname. + /// - Parameters: + /// - hostname: The hostname for the registry. + /// - Returns: The authentication object for the registry. + /// - Throws: An error if the keychain query fails. + public func lookup(hostname: String) throws -> Authentication { + let kq = KeychainQuery() + + do { + guard + let fetched = try kq.get( + securityDomain: self.securityDomain, + accessGroup: self.accessGroup, + hostname: hostname) + else { + throw Self.Error.keyNotFound + } + return BasicAuthentication( + username: fetched.username, + password: fetched.password + ) + } catch let err as KeychainQuery.Error { + switch err { + case .keyNotPresent(_): + throw Self.Error.keyNotFound + default: + throw Self.Error.queryError("query failure: \(String(describing: err))") + } + } + } + + /// Lists all registry entries for this security domain. + /// - Returns: An array of registry metadata for each matching entry, or an empty array if none are found. + /// - Throws: An error if the keychain query fails. + public func list() throws -> [RegistryInfo] { + let kq = KeychainQuery() + return try kq.list(securityDomain: self.securityDomain, accessGroup: self.accessGroup) + } + + /// Delete authorization data for a given hostname from the keychain. + /// - Parameters: + /// - hostname: The hostname for the registry. + /// - Throws: An error if the keychain query fails. + public func delete(hostname: String) throws { + let kq = KeychainQuery() + try kq.delete(securityDomain: self.securityDomain, accessGroup: self.accessGroup, hostname: hostname) + } + + /// Save authorization data for a given hostname to the keychain. + /// - Parameters: + /// - hostname: The hostname for the registry. + /// - username: The username to present to the registry. + /// - password: The password to present to the registry. + /// - Throws: An error if the keychain query fails or returns unexpected data. + public func save(hostname: String, username: String, password: String) throws { + let kq = KeychainQuery() + try kq.save( + securityDomain: self.securityDomain, + accessGroup: self.accessGroup, + hostname: hostname, + username: username, + password: password + ) + } + + /// Prompt for authorization data for a given hostname to be saved to the keychain. + /// This will cause the current terminal to enter a password prompt state where + /// key strokes are hidden. + public func credentialPrompt(hostname: String) throws -> Authentication { + let username = try userPrompt(hostname: hostname) + let password = try passwordPrompt() + return BasicAuthentication(username: username, password: password) + } + + /// Prompts the current stdin for a username entry and then returns the value. + public func userPrompt(hostname: String) throws -> String { + print("Provide registry username \(hostname): ", terminator: "") + guard let username = readLine() else { + throw Self.Error.invalidInput + } + return username + } + + /// Prompts the current stdin for a password entry and then returns the value. + /// This will cause the current stdin (if it is a terminal) to hide keystrokes + /// by disabling echo. + public func passwordPrompt() throws -> String { + print("Provide registry password: ", terminator: "") + let console = try Terminal.current + defer { console.tryReset() } + try console.disableEcho() + + guard let password = readLine() else { + throw Self.Error.invalidInput + } + return password + } +} + +extension KeychainHelper { + /// `KeychainHelper` errors. + public enum Error: Swift.Error { + case keyNotFound + case invalidInput + case queryError(String) + } +} +#endif diff --git a/Sources/ContainerizationOCI/Client/LocalOCILayoutClient.swift b/Sources/ContainerizationOCI/Client/LocalOCILayoutClient.swift new file mode 100644 index 0000000..7e0f79d --- /dev/null +++ b/Sources/ContainerizationOCI/Client/LocalOCILayoutClient.swift @@ -0,0 +1,242 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import ContainerizationExtras +import Crypto +import Foundation +import NIOCore +import NIOFoundationCompat + +package final class LocalOCILayoutClient: ContentClient { + let cs: LocalContentStore + + package init(root: URL) throws { + self.cs = try LocalContentStore(path: root) + } + + private func _fetch(digest: String) async throws -> Content { + guard let c: Content = try await self.cs.get(digest: digest) else { + throw Error.missingContent(digest) + } + return c + } + + private func calculateFileDigest(at url: URL) throws -> SHA256Digest { + let fileHandle = try FileHandle(forReadingFrom: url) + defer { + try? fileHandle.close() + } + + var hasher = SHA256() + let chunkSize = Int(getpagesize()) * 1024 + + while true { + let chunk = fileHandle.readData(ofLength: chunkSize) + if chunk.isEmpty { + break + } + hasher.update(data: chunk) + } + + return hasher.finalize() + } + + package func fetch(name: String, descriptor: Descriptor) async throws -> T { + let c = try await self._fetch(digest: descriptor.digest) + return try c.decode() + } + + package func fetchBlob(name: String, descriptor: Descriptor, into file: URL, progress: ProgressHandler?) async throws -> (Int64, SHA256Digest) { + let c = try await self._fetch(digest: descriptor.digest) + let fileManager = FileManager.default + let filePath = file.absolutePath() + + do { + let src = c.path + try fileManager.copyItem(at: src, to: file) + + if let progress, let fileSize = fileManager.fileSize(atPath: filePath) { + await progress([ + .addSize(fileSize) + ]) + } + } catch let error as NSError { + guard error.code == NSFileWriteFileExistsError else { + throw error + } + + do { + let expectedDigest = try c.digest() + let existingDigest = try calculateFileDigest(at: file) + + guard existingDigest.digestString == expectedDigest.digestString else { + throw ContainerizationError( + .internalError, + message: + "file \(filePath) exists but contains different content, expected digest: \(expectedDigest.digestString), existing digest: \(existingDigest.digestString)" + ) + } + + if let progress, let fileSize = fileManager.fileSize(atPath: filePath) { + await progress([ + .addSize(fileSize) + ]) + } + } catch { + throw error + } + } + + let size = try Int64(c.size()) + let digest = try c.digest() + return (size, digest) + } + + package func fetchData(name: String, descriptor: Descriptor) async throws -> Data { + let c = try await self._fetch(digest: descriptor.digest) + return try c.data() + } + + package func push( + name: String, + ref: String, + descriptor: Descriptor, + streamGenerator: () throws -> T, + progress: ProgressHandler? + ) async throws where T.Element == ByteBuffer { + let input = try streamGenerator() + + let (id, dir) = try await self.cs.newIngestSession() + do { + let into = dir.appendingPathComponent(descriptor.digest.trimmingDigestPrefix) + guard FileManager.default.createFile(atPath: into.path, contents: nil) else { + throw Error.cannotCreateFile + } + let fd = try FileHandle(forWritingTo: into) + defer { + try? fd.close() + } + var wrote = 0 + var hasher = SHA256() + + for try await buffer in input { + wrote += buffer.readableBytes + try fd.write(contentsOf: buffer.readableBytesView) + hasher.update(data: buffer.readableBytesView) + } + try await self.cs.completeIngestSession(id) + } catch { + try await self.cs.cancelIngestSession(id) + } + } +} + +extension LocalOCILayoutClient { + private static let ociLayoutFileName = "oci-layout" + private static let ociLayoutVersionString = "imageLayoutVersion" + private static let ociLayoutIndexFileName = "index.json" + + package func loadIndexFromOCILayout(directory: URL) throws -> ContainerizationOCI.Index { + let fm = FileManager.default + let decoder = JSONDecoder() + + let ociLayoutFile = directory.appendingPathComponent(Self.ociLayoutFileName) + guard fm.fileExists(atPath: ociLayoutFile.absolutePath()) else { + throw ContainerizationError(.notFound, message: ociLayoutFile.absolutePath()) + } + var data = try Data(contentsOf: ociLayoutFile) + let ociLayout = try decoder.decode([String: String].self, from: data) + guard ociLayout[Self.ociLayoutVersionString] != nil else { + throw ContainerizationError(.empty, message: "missing key \(Self.ociLayoutVersionString) in \(ociLayoutFile.absolutePath())") + } + + let indexFile = directory.appendingPathComponent(Self.ociLayoutIndexFileName) + guard fm.fileExists(atPath: indexFile.absolutePath()) else { + throw ContainerizationError(.notFound, message: indexFile.absolutePath()) + } + data = try Data(contentsOf: indexFile) + let index = try decoder.decode(ContainerizationOCI.Index.self, from: data) + return index + } + + package func createOCILayoutStructure(directory: URL, manifests: [Descriptor]) throws { + let fm = FileManager.default + let encoder = JSONEncoder() + encoder.outputFormatting = [.withoutEscapingSlashes] + + let ingestDir = directory.appendingPathComponent("ingest") + try? fm.removeItem(at: ingestDir) + let ociLayoutContent: [String: String] = [ + Self.ociLayoutVersionString: "1.0.0" + ] + + var data = try encoder.encode(ociLayoutContent) + var p = directory.appendingPathComponent(Self.ociLayoutFileName).absolutePath() + guard fm.createFile(atPath: p, contents: data) else { + throw ContainerizationError(.internalError, message: "failed to create file \(p)") + } + let idx = ContainerizationOCI.Index(schemaVersion: 2, manifests: manifests) + data = try encoder.encode(idx) + p = directory.appendingPathComponent(Self.ociLayoutIndexFileName).absolutePath() + guard fm.createFile(atPath: p, contents: data) else { + throw ContainerizationError(.internalError, message: "failed to create file \(p)") + } + } + + package func setImageReferenceAnnotation(descriptor: inout Descriptor, reference: String) { + var annotations = descriptor.annotations ?? [:] + annotations[AnnotationKeys.containerizationImageName] = reference + annotations[AnnotationKeys.containerdImageName] = reference + annotations[AnnotationKeys.openContainersImageName] = reference + descriptor.annotations = annotations + } + + package func getImageReferencefromDescriptor(descriptor: Descriptor) -> String { + let annotations = descriptor.annotations + + // Annotations here do not conform to the OCI image specification. + // The interpretation of the annotations "org.opencontainers.image.ref.name" and + // "io.containerd.image.name" is under debate: + // - OCI spec examples suggest it should be the image tag: + // https://github.com/opencontainers/image-spec/blob/fbb4662eb53b80bd38f7597406cf1211317768f0/image-layout.md?plain=1#L175 + // - Buildkitd maintainers argue it should represent the full image name: + // https://github.com/moby/buildkit/issues/4615#issuecomment-2521810830 + // Until a consensus is reached, the preference is given to "com.apple.containerization.image.name" and then to + // using "io.containerd.image.name" as it is the next safest choice + if let annotations { + if let name = annotations[AnnotationKeys.containerizationImageName] { + return name + } + if let name = annotations[AnnotationKeys.containerdImageName] { + return name + } + if let name = annotations[AnnotationKeys.openContainersImageName] { + return name + } + } + + // Fallback: Generate digest-based reference for images without annotations + // This makes sure OCI spec compliance as annotations are optional + return "untagged@\(descriptor.digest)" + } + + package enum Error: Swift.Error { + case missingContent(_ digest: String) + case unsupportedInput + case cannotCreateFile + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Catalog.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Catalog.swift new file mode 100644 index 0000000..38cbee9 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Catalog.swift @@ -0,0 +1,85 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import Foundation +import NIOFoundationCompat + +private struct CatalogResponse: Sendable, Decodable { + let repositories: [String] +} + +extension RegistryClient { + /// List repositories in the registry. + /// + /// Implements GET /v2/_catalog from the OCI Distribution Spec with pagination. + /// When prefix is provided, pagination skips ahead to the relevant portion of + /// the lexically-sorted catalog and stops once results move past the prefix. + /// + /// - Parameter prefix: Optional prefix to filter repository names. Must be at least + /// two characters long to enable the skip-ahead optimization; shorter values are + /// treated as no prefix. + /// - Returns: An array of repository names matching the prefix (or all repositories + /// if no prefix is given). + public func catalog(prefix: String? = nil) async throws -> [String] { + let effectivePrefix = prefix.flatMap { $0.count >= 2 ? $0 : nil } + + var allRepos: [String] = [] + // When a prefix is provided, skip ahead in the lexically-sorted catalog + // by setting last to one position before the prefix. The OCI spec + // returns entries that sort after last, so dropping the last character + // of the prefix positions the cursor just before matching entries. + var last: String? = effectivePrefix.map { String($0.dropLast()) } + let pageSize = 100 + + while true { + var components = base + components.path = "/v2/_catalog" + var queryItems = [URLQueryItem(name: "n", value: String(pageSize))] + if let last { + queryItems.append(URLQueryItem(name: "last", value: last)) + } + components.queryItems = queryItems + + let repos: [String] = try await request(components: components) { response in + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + let buffer = try await response.body.collect(upTo: self.bufferSize) + return try JSONDecoder().decode(CatalogResponse.self, from: buffer).repositories + } + + if let effectivePrefix { + let matching = repos.filter { $0.hasPrefix(effectivePrefix) } + allRepos.append(contentsOf: matching) + if let lastRepo = repos.last, !lastRepo.hasPrefix(effectivePrefix) && lastRepo > effectivePrefix { + break + } + } else { + allRepos.append(contentsOf: repos) + } + + if repos.count < pageSize { break } + last = repos.last + } + + return allRepos + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Error.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Error.swift new file mode 100644 index 0000000..29e1794 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Error.swift @@ -0,0 +1,69 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import Foundation +import NIOHTTP1 + +extension RegistryClient { + /// `RegistryClient` errors. + public enum Error: Swift.Error, CustomStringConvertible { + case invalidStatus(url: String, HTTPResponseStatus, reason: String? = nil) + + /// Description of the errors. + public var description: String { + switch self { + case .invalidStatus(let u, let response, let reason): + return "HTTP request to \(u) failed with response: \(response.description). Reason: \(reason ?? "Unknown")" + } + } + } + + /// The container registry typically returns actionable failure reasons in the response body + /// of the failing HTTP Request. This type models the structure of the error message. + /// Reference: https://distribution.github.io/distribution/spec/api/#errors + internal struct ErrorResponse: Codable { + let errors: [RemoteError] + + internal struct RemoteError: Codable { + let code: String + let message: String + let detail: String? + } + + internal static func fromResponseBody(_ body: HTTPClientResponse.Body) async -> ErrorResponse? { + guard var buffer = try? await body.collect(upTo: Int(1.mib())) else { + return nil + } + guard let bytes = buffer.readBytes(length: buffer.readableBytes) else { + return nil + } + let data = Data(bytes) + guard let jsonError = try? JSONDecoder().decode(ErrorResponse.self, from: data) else { + return nil + } + return jsonError + } + + public var jsonString: String { + let data = try? JSONEncoder().encode(self) + guard let data else { + return "{}" + } + return String(data: data, encoding: .utf8) ?? "{}" + } + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Fetch.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Fetch.swift new file mode 100644 index 0000000..08bece0 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Fetch.swift @@ -0,0 +1,237 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import ContainerizationExtras +import Crypto +import Foundation +import NIOFoundationCompat + +#if os(macOS) +import _NIOFileSystem +#endif + +extension RegistryClient { + /// Resolve sends a HEAD request to the registry to find root manifest descriptor. + /// This descriptor serves as an entry point to retrieve resources from the registry. + public func resolve(name: String, tag: String) async throws -> Descriptor { + var components = base + + // Make HEAD request to retrieve the digest header + components.path = "/v2/\(name)/manifests/\(tag)" + + // The client should include an Accept header indicating which manifest content types it supports. + let mediaTypes = [ + MediaTypes.dockerManifest, + MediaTypes.dockerManifestList, + MediaTypes.imageManifest, + MediaTypes.index, + "*/*", + ] + + let headers = [ + ("Accept", mediaTypes.joined(separator: ", ")) + ] + + return try await request(components: components, method: .HEAD, headers: headers) { response in + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + guard let digest = response.headers.first(name: "Docker-Content-Digest") else { + throw ContainerizationError(.invalidArgument, message: "missing required header Docker-Content-Digest") + } + + guard let type = response.headers.first(name: "Content-Type") else { + throw ContainerizationError(.invalidArgument, message: "missing required header Content-Type") + } + + guard let sizeStr = response.headers.first(name: "Content-Length") else { + throw ContainerizationError(.invalidArgument, message: "missing required header Content-Length") + } + + guard let size = Int64(sizeStr) else { + throw ContainerizationError(.invalidArgument, message: "cannot convert \(sizeStr) to Int64") + } + + return Descriptor(mediaType: type, digest: digest, size: size) + } + } + + /// Fetch resource (either manifest or blob) to memory with JSON decoding. + public func fetch(name: String, descriptor: Descriptor) async throws -> T { + var components = base + + let manifestTypes = [ + MediaTypes.dockerManifest, + MediaTypes.dockerManifestList, + MediaTypes.imageManifest, + MediaTypes.index, + ] + + let isManifest = manifestTypes.contains(where: { $0 == descriptor.mediaType }) + let resource = isManifest ? "manifests" : "blobs" + + components.path = "/v2/\(name)/\(resource)/\(descriptor.digest)" + + let mediaType = descriptor.mediaType + if mediaType.isEmpty { + throw ContainerizationError(.invalidArgument, message: "missing media type for descriptor \(descriptor.digest)") + } + + let headers = [ + ("Accept", mediaType) + ] + + return try await requestJSON(components: components, headers: headers) + } + + /// Fetch resource (either manifest or blob) to memory as raw `Data`. + public func fetchData(name: String, descriptor: Descriptor) async throws -> Data { + var components = base + + let manifestTypes = [ + MediaTypes.dockerManifest, + MediaTypes.dockerManifestList, + MediaTypes.imageManifest, + MediaTypes.index, + ] + + let isManifest = manifestTypes.contains(where: { $0 == descriptor.mediaType }) + let resource = isManifest ? "manifests" : "blobs" + + components.path = "/v2/\(name)/\(resource)/\(descriptor.digest)" + + let mediaType = descriptor.mediaType + if mediaType.isEmpty { + throw ContainerizationError(.invalidArgument, message: "missing media type for descriptor \(descriptor.digest)") + } + + let headers = [ + ("Accept", mediaType) + ] + + return try await requestData(components: components, headers: headers) + } + + /// Fetch a blob from remote registry. + /// This method is suitable for streaming data. + public func fetchBlob( + name: String, + descriptor: Descriptor, + closure: (Int64, HTTPClientResponse.Body) async throws -> Void + ) async throws { + var components = base + components.path = "/v2/\(name)/blobs/\(descriptor.digest)" + + let mediaType = descriptor.mediaType + if mediaType.isEmpty { + throw ContainerizationError(.invalidArgument, message: "missing media type for descriptor \(descriptor.digest)") + } + + let headers = [ + ("Accept", mediaType) + ] + + try await request(components: components, headers: headers) { response in + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + // How many bytes to expect + guard let expectedBytes = response.headers.first(name: "Content-Length").flatMap(Int64.init) else { + throw ContainerizationError(.invalidArgument, message: "missing required header Content-Length") + } + + try await closure(expectedBytes, response.body) + } + } + + #if os(macOS) + /// Fetch a blob from remote registry and write the contents into a file in the provided directory. + public func fetchBlob(name: String, descriptor: Descriptor, into file: URL, progress: ProgressHandler?) async throws -> (Int64, SHA256Digest) { + var hasher = SHA256() + var received: Int64 = 0 + let fs = _NIOFileSystem.FileSystem.shared + let handle = try await fs.openFile(forWritingAt: FilePath(file.absolutePath()), options: .newFile(replaceExisting: true)) + var writer = handle.bufferedWriter() + do { + try await self.fetchBlob(name: name, descriptor: descriptor) { (size, body) in + var itr = body.makeAsyncIterator() + while let buf = try await itr.next() { + let readBytes = Int64(buf.readableBytes) + received += readBytes + let written = try await writer.write(contentsOf: buf) + await progress?([ + .addSize(written) + ]) + guard written == readBytes else { + throw ContainerizationError( + .internalError, + message: "could not write \(readBytes) bytes to file \(file)" + ) + } + hasher.update(data: buf.readableBytesView) + } + } + try await writer.flush() + try await handle.close() + } catch { + do { + try await handle.close() + } catch { + // Use `detachUnsafeFileDescriptor()` as suggested by the error message to prevent a leak detection crash when `close()` fails. + _ = try handle.detachUnsafeFileDescriptor() + } + throw error + } + let computedDigest = hasher.finalize() + return (received, computedDigest) + } + #else + /// Fetch a blob from remote registry and write the contents into a file in the provided directory. + public func fetchBlob(name: String, descriptor: Descriptor, into file: URL, progress: ProgressHandler?) async throws -> (Int64, SHA256Digest) { + var hasher = SHA256() + var received: Int64 = 0 + guard FileManager.default.createFile(atPath: file.path, contents: nil) else { + throw ContainerizationError(.internalError, message: "cannot create file at path \(file.path)") + } + try await self.fetchBlob(name: name, descriptor: descriptor) { (size, body) in + let fd = try FileHandle(forWritingTo: file) + defer { + try? fd.close() + } + var itr = body.makeAsyncIterator() + while let buf = try await itr.next() { + let readBytes = Int64(buf.readableBytes) + received += readBytes + await progress?([ + .addSize(readBytes) + ]) + try fd.write(contentsOf: buf.readableBytesView) + hasher.update(data: buf.readableBytesView) + } + } + let computedDigest = hasher.finalize() + return (received, computedDigest) + } + #endif +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Push.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Push.swift new file mode 100644 index 0000000..dc056ba --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Push.swift @@ -0,0 +1,181 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import ContainerizationExtras +import Foundation +import NIO + +extension RegistryClient { + /// Pushes the content specified by a descriptor to a remote registry. + /// - Parameters: + /// - name: The namespace which the descriptor should belong under. + /// - tag: The tag or digest for uniquely identifying the manifest. + /// By convention, any portion that may be a partial or whole digest + /// will be proceeded by an `@`. Anything preceding the `@` will be referred + /// to as "tag". + /// This is usually broken down into the following possibilities: + /// 1. + /// 2. @ + /// 3. @ + /// The tag is anything except `@` and `:`, and digest is anything after the `@` + /// - descriptor: The OCI descriptor of the content to be pushed. + /// - streamGenerator: A closure that produces an`AsyncStream` of `ByteBuffer` + /// for streaming data to the `HTTPClientRequest.Body`. + /// The caller is responsible for providing the `AsyncStream` where the data may come from + /// a file on disk, data in memory, etc. + /// - progress: The progress handler to invoke as data is sent. + public func push( + name: String, + ref tag: String, + descriptor: Descriptor, + streamGenerator: () throws -> T, + progress: ProgressHandler? + ) async throws where T.Element == ByteBuffer { + var components = base + + let mediaType = descriptor.mediaType + if mediaType.isEmpty { + throw ContainerizationError(.invalidArgument, message: "missing media type for descriptor \(descriptor.digest)") + } + + var isManifest = false + var existCheck: [String] = [] + + switch mediaType { + case MediaTypes.dockerManifest, MediaTypes.dockerManifestList, MediaTypes.imageManifest, MediaTypes.index: + isManifest = true + existCheck = self.getManifestPath(tag: tag, digest: descriptor.digest) + default: + existCheck = ["blobs", descriptor.digest] + } + + // Check if the content already exists. + components.path = "/v2/\(name)/\(existCheck.joined(separator: "/"))" + + let mediaTypes = [ + mediaType, + "*/*", + ] + + var headers = [ + ("Accept", mediaTypes.joined(separator: ", ")) + ] + + try await request(components: components, method: .HEAD, headers: headers) { response in + if response.status == .ok { + var exists = false + if isManifest && existCheck[1] != descriptor.digest { + if descriptor.digest == response.headers.first(name: "Docker-Content-Digest") { + exists = true + } + } else { + exists = true + } + + if exists { + throw ContainerizationError(.exists, message: "content already exists \(descriptor.digest)") + } + } else if response.status != .notFound { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + } + + if isManifest { + let path = self.getManifestPath(tag: tag, digest: descriptor.digest) + components.path = "/v2/\(name)/\(path.joined(separator: "/"))" + headers = [ + ("Content-Type", mediaType) + ] + } else { + // Start upload request for blobs. + components.path = "/v2/\(name)/blobs/uploads/" + try await request(components: components, method: .POST) { response in + switch response.status { + case .ok, .accepted, .noContent: + break + case .created: + throw ContainerizationError(.exists, message: "content already exists \(descriptor.digest)") + default: + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + // Get the location to upload the blob. + guard let location = response.headers.first(name: "Location") else { + throw ContainerizationError(.invalidArgument, message: "missing required header Location") + } + + guard let urlComponents = URLComponents(string: location) else { + throw ContainerizationError(.invalidArgument, message: "invalid url \(location)") + } + var queryItems = urlComponents.queryItems ?? [] + queryItems.append(URLQueryItem(name: "digest", value: descriptor.digest)) + components.path = urlComponents.path + components.queryItems = queryItems + headers = [ + ("Content-Type", "application/octet-stream"), + ("Content-Length", String(descriptor.size)), + ] + } + } + + // We have to pass a body closure rather than a body to reset the stream when retrying. + let bodyClosure = { + let stream = try streamGenerator() + let body = HTTPClientRequest.Body.stream(stream, length: .known(descriptor.size)) + return body + } + + return try await request(components: components, method: .PUT, bodyClosure: bodyClosure, headers: headers) { response in + switch response.status { + case .ok, .created, .noContent: + break + default: + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + guard descriptor.digest == response.headers.first(name: "Docker-Content-Digest") else { + let required = response.headers.first(name: "Docker-Content-Digest") ?? "" + throw ContainerizationError(.internalError, message: "digest mismatch \(descriptor.digest) != \(required)") + } + } + } + + private func getManifestPath(tag: String, digest: String) -> [String] { + var object = tag + if let i = tag.firstIndex(of: "@") { + let index = tag.index(after: i) + if String(tag[index...]) != digest { + object = "" + } else { + object = String(tag[...i]) + } + } + + if object == "" { + return ["manifests", digest] + } + + return ["manifests", object] + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Referrers.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Referrers.swift new file mode 100644 index 0000000..2c076a1 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Referrers.swift @@ -0,0 +1,91 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import Foundation +import NIOFoundationCompat + +extension RegistryClient { + /// Query the OCI referrers API for artifacts that reference a given manifest digest. + /// + /// Implements `GET /v2/{name}/referrers/{digest}` from the OCI Distribution Spec v1.1. + /// Falls back to the referrers tag schema when the API is not available (404). + /// + /// - Parameters: + /// - name: The repository name (e.g., "library/ubuntu"). + /// - digest: The digest of the subject manifest (e.g., "sha256:abc123..."). + /// - artifactType: Optional filter to return only referrers with a matching artifactType. + /// - Returns: An `Index` whose `manifests` array contains descriptors of referring artifacts. + /// Returns an empty index if the registry does not support the referrers API + /// and no tag schema fallback is available. + public func referrers(name: String, digest: String, artifactType: String? = nil) async throws -> Index { + var components = base + components.path = "/v2/\(name)/referrers/\(digest)" + + if let artifactType { + components.queryItems = [URLQueryItem(name: "artifactType", value: artifactType)] + } + + let headers = [("Accept", MediaTypes.index)] + + let result: Index = try await request(components: components, method: .GET, headers: headers) { response in + if response.status == .notFound { + return await self.referrersTagFallback(name: name, digest: digest, artifactType: artifactType) + } + + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + let buffer = try await response.body.collect(upTo: self.bufferSize) + return try JSONDecoder().decode(Index.self, from: buffer) + } + + return result + } + + /// Fallback for registries that don't support the referrers API. + /// + /// Uses the OCI referrers tag schema: referrers for a digest are stored as an + /// index at the tag `-` (e.g., `sha256-abc123...`). + private func referrersTagFallback(name: String, digest: String, artifactType: String? = nil) async -> Index { + let referrerTag = digest.replacingOccurrences(of: ":", with: "-") + + let descriptor: Descriptor + do { + descriptor = try await resolve(name: name, tag: referrerTag) + } catch { + return Index(schemaVersion: 2, manifests: []) + } + + let index: Index + do { + index = try await fetch(name: name, descriptor: descriptor) + } catch { + return Index(schemaVersion: 2, manifests: []) + } + + guard let artifactType else { + return index + } + + let filtered = index.manifests.filter { $0.artifactType == artifactType } + return Index(schemaVersion: 2, manifests: filtered) + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient+Token.swift b/Sources/ContainerizationOCI/Client/RegistryClient+Token.swift new file mode 100644 index 0000000..5dd9350 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient+Token.swift @@ -0,0 +1,210 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import Foundation + +struct TokenRequest { + public static let authenticateHeaderName = "WWW-Authenticate" + + /// The credentials that will be used in the authentication header when fetching the token. + let authentication: Authentication? + /// The realm against which the token should be requested. + let realm: String + /// The name of the service which hosts the resource. + let service: String + /// Whether to return a refresh token along with the bearer token. + let offlineToken: Bool + /// String identifying the client. + let clientId: String + /// The resource in question, formatted as one of the space-delimited entries from the scope parameters from the WWW-Authenticate header shown above. + let scope: String? + + init( + realm: String, + service: String, + clientId: String, + scope: String?, + offlineToken: Bool = false, + authentication: Authentication? = nil + ) { + self.realm = realm + self.service = service + self.offlineToken = offlineToken + self.clientId = clientId + self.scope = scope + self.authentication = authentication + } +} + +struct TokenResponse: Codable, Hashable { + /// An opaque Bearer token that clients should supply to subsequent requests in the Authorization header. + let token: String? + /// For compatibility with OAuth 2.0, we will also accept token under the name access_token. + /// At least one of these fields must be specified, but both may also appear (for compatibility with older clients). + /// When both are specified, they should be equivalent; if they differ the client's choice is undefined. + let accessToken: String? + /// The duration in seconds since the token was issued that it will remain valid. + /// When omitted, this defaults to 60 seconds. + let expiresIn: UInt? + /// The RFC3339-serialized UTC standard time at which a given token was issued. + /// If issued_at is omitted, the expiration is from when the token exchange completed. + let issuedAt: String? + /// Token which can be used to get additional access tokens for the same subject with different scopes. + /// This token should be kept secure by the client and only sent to the authorization server which issues bearer tokens. + /// This field will only be set when `offline_token=true` is provided in the request. + let refreshToken: String? + + var scope: String? + + private enum CodingKeys: String, CodingKey { + case token = "token" + case accessToken = "access_token" + case expiresIn = "expires_in" + case issuedAt = "issued_at" + case refreshToken = "refresh_token" + } + + func getToken() -> String? { + if let t = token ?? accessToken { + return "Bearer \(t)" + } + return nil + } + + func isValid(scope: String?) -> Bool { + guard let issuedAt else { + return false + } + let isoFormatter = ISO8601DateFormatter() + isoFormatter.formatOptions = [.withInternetDateTime, .withFractionalSeconds] + guard let issued = isoFormatter.date(from: issuedAt) else { + return false + } + let expiresIn = expiresIn ?? 0 + let now = Date() + let elapsed = now.timeIntervalSince(issued) + guard elapsed < Double(expiresIn) else { + return false + } + if let requiredScope = scope { + return requiredScope == self.scope + } + return false + } +} + +struct AuthenticateChallenge: Equatable { + let type: String + let realm: String? + let service: String? + let scope: String? + let error: String? + + init(type: String, realm: String?, service: String?, scope: String?, error: String?) { + self.type = type + self.realm = realm + self.service = service + self.scope = scope + self.error = error + } + + init(type: String, values: [String: String]) { + self.type = type + self.realm = values["realm"] + self.service = values["service"] + self.scope = values["scope"] + self.error = values["error"] + } +} + +extension RegistryClient { + /// Fetch an auto token for all subsequent HTTP requests + /// See https://docs.docker.com/registry/spec/auth/token/ + internal func fetchToken(request: TokenRequest) async throws -> TokenResponse { + guard var components = URLComponents(string: request.realm) else { + throw ContainerizationError(.invalidArgument, message: "cannot create URL from \(request.realm)") + } + components.queryItems = [ + URLQueryItem(name: "client_id", value: request.clientId), + URLQueryItem(name: "service", value: request.service), + ] + var scope = "" + if let reqScope = request.scope { + scope = reqScope + components.queryItems?.append(URLQueryItem(name: "scope", value: reqScope)) + } + + if request.offlineToken { + components.queryItems?.append(URLQueryItem(name: "offline_token", value: "true")) + } + var response: TokenResponse = try await requestJSON(components: components, headers: []) + response.scope = scope + return response + } + + internal func createTokenRequest(parsing authenticateHeaders: [String]) throws -> TokenRequest { + let parsedHeaders = Self.parseWWWAuthenticateHeaders(headers: authenticateHeaders) + let bearerChallenge = parsedHeaders.first { $0.type == "Bearer" } + guard let bearerChallenge else { + throw ContainerizationError(.invalidArgument, message: "missing Bearer challenge in \(TokenRequest.authenticateHeaderName) header") + } + guard let realm = bearerChallenge.realm else { + throw ContainerizationError(.invalidArgument, message: "cannot parse realm from \(TokenRequest.authenticateHeaderName) header") + } + guard let service = bearerChallenge.service else { + throw ContainerizationError(.invalidArgument, message: "cannot parse service from \(TokenRequest.authenticateHeaderName) header") + } + let scope = bearerChallenge.scope + let tokenRequest = TokenRequest(realm: realm, service: service, clientId: self.clientID, scope: scope, authentication: self.authentication) + return tokenRequest + } + + internal static func parseWWWAuthenticateHeaders(headers: [String]) -> [AuthenticateChallenge] { + var parsed: [String: [String: String]] = [:] + for challenge in headers { + let trimmedChallenge = challenge.trimmingCharacters(in: .whitespacesAndNewlines) + let parts = trimmedChallenge.split(separator: " ", maxSplits: 1) + guard parts.count == 2 else { + continue + } + guard let scheme = parts.first else { + continue + } + var params: [String: String] = [:] + let header = String(parts[1]) + let pattern = #"(\w+)="([^"]+)"# + let regex = try! NSRegularExpression(pattern: pattern, options: []) + let matches = regex.matches(in: header, options: [], range: NSRange(header.startIndex..., in: header)) + for match in matches { + if let keyRange = Range(match.range(at: 1), in: header), + let valueRange = Range(match.range(at: 2), in: header) + { + let key = String(header[keyRange]) + let value = String(header[valueRange]) + params[key] = value + } + } + parsed[String(scheme)] = params + } + var parsedChallenges: [AuthenticateChallenge] = [] + for (type, values) in parsed { + parsedChallenges.append(.init(type: type, values: values)) + } + return parsedChallenges + } +} diff --git a/Sources/ContainerizationOCI/Client/RegistryClient.swift b/Sources/ContainerizationOCI/Client/RegistryClient.swift new file mode 100644 index 0000000..14f3142 --- /dev/null +++ b/Sources/ContainerizationOCI/Client/RegistryClient.swift @@ -0,0 +1,306 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationError +import ContainerizationExtras +import ContainerizationOS +import Foundation +import Logging +import NIO +import NIOHTTP1 +import NIOSSL + +#if os(macOS) +import Network +#endif + +/// Data used to control retry behavior for `RegistryClient`. +public struct RetryOptions: Sendable { + /// The maximum number of retries to attempt before failing. + public var maxRetries: Int + /// The retry interval in nanoseconds. + public var retryInterval: UInt64 + /// A provided closure to handle if a given HTTP response should be + /// retried. + public var shouldRetry: (@Sendable (HTTPClientResponse) -> Bool)? + + public init(maxRetries: Int, retryInterval: UInt64, shouldRetry: (@Sendable (HTTPClientResponse) -> Bool)? = nil) { + self.maxRetries = maxRetries + self.retryInterval = retryInterval + self.shouldRetry = shouldRetry + } +} + +/// A client for interacting with OCI compliant container registries. +public final class RegistryClient: ContentClient { + private static let defaultRetryOptions = RetryOptions( + maxRetries: 3, + retryInterval: 1_000_000_000, + shouldRetry: ({ response in + response.status.code >= 500 + }) + ) + + let client: HTTPClient + let proxyURL: URL? + let base: URLComponents + let clientID: String + let authentication: Authentication? + let retryOptions: RetryOptions? + let bufferSize: Int + + public convenience init( + reference: String, + insecure: Bool = false, + auth: Authentication? = nil, + tlsConfiguration: TLSConfiguration? = nil, + logger: Logger? = nil, + ) throws { + let ref = try Reference.parse(reference) + guard let domain = ref.resolvedDomain else { + throw ContainerizationError(.invalidArgument, message: "invalid domain for image reference \(reference)") + } + let scheme = insecure ? "http" : "https" + let _url = "\(scheme)://\(domain)" + guard let url = URL(string: _url) else { + throw ContainerizationError(.invalidArgument, message: "cannot convert \(_url) to URL") + } + guard let host = url.host else { + throw ContainerizationError(.invalidArgument, message: "invalid host \(domain)") + } + let port = url.port + self.init( + host: host, + scheme: scheme, + port: port, + authentication: auth, + retryOptions: Self.defaultRetryOptions, + tlsConfiguration: tlsConfiguration, + ) + } + + public init( + host: String, + scheme: String? = "https", + port: Int? = nil, + authentication: Authentication? = nil, + clientID: String? = nil, + retryOptions: RetryOptions? = nil, + bufferSize: Int = Int(4.mib()), + tlsConfiguration: TLSConfiguration? = nil, + logger: Logger? = nil, + ) { + var components = URLComponents() + components.scheme = scheme + components.host = host + components.port = port + + self.base = components + self.clientID = clientID ?? "containerization-registry-client" + self.authentication = authentication + self.retryOptions = retryOptions + self.bufferSize = bufferSize + var httpConfiguration = HTTPClient.Configuration() + + // proxy configuration assumes all client requests will go to `base` URL + self.proxyURL = ProxyUtils.proxyFromEnvironment(scheme: scheme, host: host) + if let proxyURL = self.proxyURL, let proxyHost = proxyURL.host { + let proxyPort = proxyURL.port ?? (proxyURL.scheme == "https" ? 443 : 80) + httpConfiguration.proxy = HTTPClient.Configuration.Proxy.server(host: proxyHost, port: proxyPort) + } + if tlsConfiguration != nil { + httpConfiguration.tlsConfiguration = tlsConfiguration + } + + if let logger { + self.client = HTTPClient(eventLoopGroupProvider: .singleton, configuration: httpConfiguration, backgroundActivityLogger: logger) + } else { + self.client = HTTPClient(eventLoopGroupProvider: .singleton, configuration: httpConfiguration) + } + } + + deinit { + _ = client.shutdown() + } + + func host() -> String { + base.host ?? "" + } + + internal func request( + components: URLComponents, + method: HTTPMethod = .GET, + bodyClosure: () throws -> HTTPClientRequest.Body? = { nil }, + headers: [(String, String)]? = nil, + closure: (HTTPClientResponse) async throws -> T + ) async throws -> T { + guard let path = components.url?.absoluteString else { + throw ContainerizationError(.invalidArgument, message: "invalid url \(components.path)") + } + + var request = HTTPClientRequest(url: path) + request.method = method + + var currentToken: TokenResponse? + let token: String? = try await { + if let basicAuth = authentication { + return try await basicAuth.token() + } + return nil + }() + + if let token { + request.headers.add(name: "Authorization", value: "\(token)") + } + + // Add any arbitrary headers + headers?.forEach { (k, v) in request.headers.add(name: k, value: v) } + var retryCount = 0 + var response: HTTPClientResponse? + while true { + request.body = try bodyClosure() + do { + let _response = try await client.execute(request, deadline: .distantFuture) + response = _response + if _response.status == .unauthorized || _response.status == .forbidden { + let authHeader = _response.headers[TokenRequest.authenticateHeaderName] + let tokenRequest: TokenRequest + do { + tokenRequest = try self.createTokenRequest(parsing: authHeader) + } catch { + // The server did not tell us how to authenticate our requests, + // Or we do not support scheme the server is requesting for. + // Throw the 401/403 to the caller, and let them decide how to proceed. + throw RegistryClient.Error.invalidStatus(url: path, _response.status, reason: String(describing: error)) + } + if let ct = currentToken, ct.isValid(scope: tokenRequest.scope) { + break + } + + do { + let _currentToken = try await fetchToken(request: tokenRequest) + guard let token = _currentToken.getToken() else { + throw ContainerizationError(.internalError, message: "failed to fetch Bearer token") + } + currentToken = _currentToken + request.headers.replaceOrAdd(name: "Authorization", value: token) + retryCount += 1 + } catch let err as RegistryClient.Error { + guard case .invalidStatus(_, let status, _) = err else { + throw err + } + if status == .unauthorized || status == .forbidden { + throw RegistryClient.Error.invalidStatus(url: path, _response.status, reason: "access denied or wrong credentials") + } + + throw err + } + + continue + } else if _response.status == .badRequest && request.headers.contains(name: "Authorization") { + // Retry without basic auth + request.headers.remove(name: "Authorization") + retryCount += 1 + continue + } + guard let retryOptions = self.retryOptions else { + break + } + guard retryCount < retryOptions.maxRetries else { + break + } + guard let shouldRetry = retryOptions.shouldRetry, shouldRetry(_response) else { + break + } + retryCount += 1 + try await Task.sleep(nanoseconds: retryOptions.retryInterval) + continue + } catch let err as RegistryClient.Error { + throw err + } catch { + #if os(macOS) + if let err = error as? NWError { + if err.errorCode == kDNSServiceErr_NoSuchRecord { + let message: String + if let proxyURL = self.proxyURL, let proxyHost = proxyURL.host { + message = "failed to resolve either repository hostname \(host()) or proxy hostname \(proxyHost)" + } else { + message = "failed to resolve either repository hostname \(host())" + } + throw ContainerizationError(.internalError, message: message) + } + } + #endif + guard let retryOptions = self.retryOptions, retryCount < retryOptions.maxRetries else { + throw error + } + retryCount += 1 + try await Task.sleep(nanoseconds: retryOptions.retryInterval) + } + } + guard let response else { + throw ContainerizationError(.internalError, message: "invalid response") + } + return try await closure(response) + } + + internal func requestData( + components: URLComponents, + headers: [(String, String)]? = nil + ) async throws -> Data { + let bytes: ByteBuffer = try await requestBuffer(components: components, headers: headers) + return Data(buffer: bytes) + } + + internal func requestBuffer( + components: URLComponents, + headers: [(String, String)]? = nil + ) async throws -> ByteBuffer { + try await request(components: components, method: .GET, headers: headers) { response in + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + + return try await response.body.collect(upTo: self.bufferSize) + } + } + + internal func requestJSON( + components: URLComponents, + headers: [(String, String)]? = nil + ) async throws -> T { + let buffer = try await self.requestBuffer(components: components, headers: headers) + return try JSONDecoder().decode(T.self, from: buffer) + } + + /// A minimal endpoint, mounted at /v2/ will provide version support information based on its response statuses. + /// See https://distribution.github.io/distribution/spec/api/#api-version-check + public func ping() async throws { + var components = base + components.path = "/v2/" + + try await request(components: components) { response in + guard response.status == .ok else { + let url = components.url?.absoluteString ?? "unknown" + let reason = await ErrorResponse.fromResponseBody(response.body)?.jsonString + throw Error.invalidStatus(url: url, response.status, reason: reason) + } + } + } +} diff --git a/Sources/ContainerizationOCI/Content/AsyncTypes.swift b/Sources/ContainerizationOCI/Content/AsyncTypes.swift new file mode 100644 index 0000000..518ab9c --- /dev/null +++ b/Sources/ContainerizationOCI/Content/AsyncTypes.swift @@ -0,0 +1,56 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +package actor AsyncStore { + private var _value: T? + + package init(_ value: T? = nil) { + self._value = value + } + + package func get() -> T? { + self._value + } + + package func set(_ value: T) { + self._value = value + } +} + +package actor AsyncSet { + private var buffer: Set + + package init(_ elements: S) where S.Element == T { + buffer = Set(elements) + } + + package var count: Int { + buffer.count + } + + package func insert(_ element: T) { + buffer.insert(element) + } + + @discardableResult + package func remove(_ element: T) -> T? { + buffer.remove(element) + } + + package func contains(_ element: T) -> Bool { + buffer.contains(element) + } +} diff --git a/Sources/ContainerizationOCI/Content/Content.swift b/Sources/ContainerizationOCI/Content/Content.swift new file mode 100644 index 0000000..acaacfc --- /dev/null +++ b/Sources/ContainerizationOCI/Content/Content.swift @@ -0,0 +1,59 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import Crypto +import Foundation +import NIOCore + +/// Protocol for defining a single OCI content +public protocol Content: Sendable { + /// URL to the content + var path: URL { get } + + /// sha256 of content + func digest() throws -> SHA256.Digest + + /// Size of content + func size() throws -> UInt64 + + /// Data representation of entire content + func data() throws -> Data + + /// Data representation partial content + func data(offset: UInt64, length: Int) throws -> Data? + + /// Decode the content into an object + func decode() throws -> T where T: Decodable +} + +/// Protocol defining methods to fetch and push OCI content +public protocol ContentClient: Sendable { + func fetch(name: String, descriptor: Descriptor) async throws -> T + + func fetchBlob(name: String, descriptor: Descriptor, into file: URL, progress: ProgressHandler?) async throws -> (Int64, SHA256Digest) + + func fetchData(name: String, descriptor: Descriptor) async throws -> Data + + func push( + name: String, + ref: String, + descriptor: Descriptor, + streamGenerator: () throws -> T, + progress: ProgressHandler? + ) async throws where T.Element == ByteBuffer + +} diff --git a/Sources/ContainerizationOCI/Content/ContentStoreProtocol.swift b/Sources/ContainerizationOCI/Content/ContentStoreProtocol.swift new file mode 100644 index 0000000..29bd139 --- /dev/null +++ b/Sources/ContainerizationOCI/Content/ContentStoreProtocol.swift @@ -0,0 +1,67 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Crypto +import Foundation + +/// Protocol for defining a content store where OCI image metadata and layers will be managed +/// and manipulated. +public protocol ContentStore: Sendable { + /// Retrieves a piece of Content based on the digest string. + /// Returns `nil` if the requested digest is not found. + func get(digest: String) async throws -> Content? + + /// Retrieves a specific content metadata type based on the digest string. + /// Returns `nil` if the requested digest is not found. + func get(digest: String) async throws -> T? + + /// Remove a list of digests in the content store. + @discardableResult + func delete(digests: [String]) async throws -> ([String], UInt64) + + /// Removes all content from the store except for the digests in the provided list. + @discardableResult + func delete(keeping: [String]) async throws -> ([String], UInt64) + + /// Creates a transactional write to the content store. + /// The function takes a closure given a temporary `URL` of the base directory which all contents should be written to. + /// This is transaction write where any failed operation in the closure (caught exception) will result in all contents written + /// in the closure to be deleted. + /// + /// If the closure succeeds, then all the content that have been written to the temporary `URL` will be moved into the actual + /// blobs path of the content store. + @discardableResult + func ingest(_ body: @Sendable @escaping (URL) async throws -> Void) async throws -> [String] + + /// Creates a new ingest session and returns the session ID and temporary ingest directory corresponding to the session. + /// The contents from the ingest directory are processed and moved into the content store once the session is marked complete. + /// This can be done by invoking the `completeIngestSession` method with the returned session ID. + func newIngestSession() async throws -> (id: String, ingestDir: URL) + + /// Completes a previously started ingest session corresponding to `id`. + /// The contents from the ingest directory from the session are moved into the content store atomically. + /// Any failure encountered will result in a transaction failure causing none of the contents to be ingested into the store. + @discardableResult + func completeIngestSession(_ id: String) async throws -> [String] + + /// Cancels a previously started ingest session corresponding to `id`. + /// The contents from the ingest directory corresponding to the session are removed. + func cancelIngestSession(_ id: String) async throws + + /// Total bytes allocated on disk for the content store, covering + /// committed blobs and any active ingest sessions. + func totalAllocatedSize() async throws -> UInt64 +} diff --git a/Sources/ContainerizationOCI/Content/ContentWriter.swift b/Sources/ContainerizationOCI/Content/ContentWriter.swift new file mode 100644 index 0000000..87b4c38 --- /dev/null +++ b/Sources/ContainerizationOCI/Content/ContentWriter.swift @@ -0,0 +1,137 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Crypto +import Foundation +import NIOCore + +/// Provides a context to write data into a directory. +public class ContentWriter { + private let base: URL + private let encoder = JSONEncoder() + + /// Create a new ContentWriter. + /// - Parameters: + /// - base: The URL to write content to. If this is not a directory a + /// ContainerizationError will be thrown with a code of .internalError. + public init(for base: URL) throws { + self.encoder.outputFormatting = [JSONEncoder.OutputFormatting.sortedKeys] + + self.base = base + var isDirectory = ObjCBool(true) + let exists = FileManager.default.fileExists(atPath: base.path, isDirectory: &isDirectory) + + guard exists && isDirectory.boolValue else { + throw ContainerizationError(.internalError, message: "cannot create ContentWriter for path \(base.absolutePath()), not a directory") + } + } + + /// Writes the data blob to the base URL provided in the constructor. + /// - Parameters: + /// - data: The data blob to write to a file under the base path. + @discardableResult + public func write(_ data: Data) throws -> (size: Int64, digest: SHA256.Digest) { + let digest = SHA256.hash(data: data) + let destination = base.appendingPathComponent(digest.encoded) + try data.write(to: destination) + return (Int64(data.count), digest) + } + + /// Reads the data present in the passed in URL and writes it to the base path. + /// - Parameters: + /// - url: The URL to read the data from. + @discardableResult + public func create(from url: URL) throws -> (size: Int64, digest: SHA256.Digest) { + let sourceFD = Foundation.open(url.path, O_RDONLY) + guard sourceFD >= 0 else { + let errCode = POSIXErrorCode(rawValue: errno) ?? .EINVAL + let err = POSIXError(errCode) + throw ContainerizationError(.internalError, message: "failed to open \(url.path) for reading", cause: err) + } + defer { close(sourceFD) } + + let tempURL = base.appendingPathComponent(UUID().uuidString) + let destFD = Foundation.open(tempURL.path, O_WRONLY | O_CREAT | O_TRUNC, 0o644) + guard destFD >= 0 else { + let errCode = POSIXErrorCode(rawValue: errno) ?? .EINVAL + let err = POSIXError(errCode) + throw ContainerizationError(.internalError, message: "failed to create temporary file at \(tempURL.absolutePath())", cause: err) + } + + let chunkSize = 1024 * 1024 // 1 MiB + let buf = UnsafeMutableRawBufferPointer.allocate(byteCount: chunkSize, alignment: 1) + defer { buf.deallocate() } + guard let baseAddress = buf.baseAddress else { + close(destFD) + try? FileManager.default.removeItem(at: tempURL) + throw ContainerizationError(.internalError, message: "failed to allocate read buffer of size \(chunkSize)") + } + + var hasher = SHA256() + var totalSize: Int64 = 0 + while true { + let n = read(sourceFD, baseAddress, chunkSize) + if n == 0 { break } + if n < 0 { + close(destFD) + let errCode = POSIXErrorCode(rawValue: errno) ?? .EINVAL + let err = POSIXError(errCode) + try? FileManager.default.removeItem(at: tempURL) + throw ContainerizationError(.internalError, message: "failed to read from \(url.path)", cause: err) + } + hasher.update(data: UnsafeRawBufferPointer(start: baseAddress, count: n)) + var written = 0 + while written < n { + let w = Foundation.write(destFD, baseAddress.advanced(by: written), n - written) + if w < 0 { + close(destFD) + let errCode = POSIXErrorCode(rawValue: errno) ?? .EINVAL + let err = POSIXError(errCode) + try? FileManager.default.removeItem(at: tempURL) + throw ContainerizationError(.internalError, message: "failed to write to \(tempURL.absolutePath())", cause: err) + } + written += w + } + totalSize += Int64(n) + } + close(destFD) + + let digest = hasher.finalize() + let destination = base.appendingPathComponent(digest.encoded) + do { + try FileManager.default.moveItem(at: tempURL, to: destination) + } catch let error as NSError { + guard error.code == NSFileWriteFileExistsError else { + throw error + } + try? FileManager.default.removeItem(at: tempURL) + } catch { + try? FileManager.default.removeItem(at: tempURL) + throw error + } + return (totalSize, digest) + } + + /// Encodes the passed in type as a JSON blob and writes it to the base path. + /// - Parameters: + /// - content: The type to convert to JSON. + @discardableResult + public func create(from content: T) throws -> (size: Int64, digest: SHA256.Digest) { + let data = try self.encoder.encode(content) + return try self.write(data) + } +} diff --git a/Sources/ContainerizationOCI/Content/LocalContent.swift b/Sources/ContainerizationOCI/Content/LocalContent.swift new file mode 100644 index 0000000..24a8e2f --- /dev/null +++ b/Sources/ContainerizationOCI/Content/LocalContent.swift @@ -0,0 +1,78 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Crypto +import Foundation + +public final class LocalContent: Content { + public let path: URL + private let file: FileHandle + + public init(path: URL) throws { + guard FileManager.default.fileExists(atPath: path.path) else { + throw ContainerizationError(.notFound, message: "content at path \(path.absolutePath())") + } + + self.file = try FileHandle(forReadingFrom: path) + self.path = path + } + + public func digest() throws -> SHA256.Digest { + let bufferSize = 64 * 1024 // 64 KB + var hasher = SHA256() + + try self.file.seek(toOffset: 0) + while case let data = file.readData(ofLength: bufferSize), !data.isEmpty { + hasher.update(data: data) + } + + let digest = hasher.finalize() + + try self.file.seek(toOffset: 0) + return digest + } + + public func data(offset: UInt64 = 0, length size: Int = 0) throws -> Data? { + try file.seek(toOffset: offset) + if size == 0 { + return try file.readToEnd() + } + return try file.read(upToCount: size) + } + + public func data() throws -> Data { + try Data(contentsOf: self.path) + } + + public func size() throws -> UInt64 { + let fileAttrs = try FileManager.default.attributesOfItem(atPath: self.path.absolutePath()) + if let size = fileAttrs[FileAttributeKey.size] as? UInt64 { + return size + } + throw ContainerizationError(.internalError, message: "could not determine file size for \(path.absolutePath())") + } + + public func decode() throws -> T where T: Decodable { + let json = JSONDecoder() + let data = try Data(contentsOf: self.path) + return try json.decode(T.self, from: data) + } + + deinit { + try? self.file.close() + } +} diff --git a/Sources/ContainerizationOCI/Content/LocalContentStore.swift b/Sources/ContainerizationOCI/Content/LocalContentStore.swift new file mode 100644 index 0000000..8594d8b --- /dev/null +++ b/Sources/ContainerizationOCI/Content/LocalContentStore.swift @@ -0,0 +1,230 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint:disable unused_optional_binding + +import ContainerizationError +import ContainerizationExtras +import Crypto +import Foundation + +/// A `ContentStore` implementation that stores content on the local filesystem. +public actor LocalContentStore: ContentStore { + private static let encoder = JSONEncoder() + + private let _basePath: URL + private let _ingestPath: URL + private let _blobPath: URL + private let _lock: AsyncLock + + private var activeIngestSessions: AsyncSet = AsyncSet([]) + + /// Create a new `LocalContentStore`. + /// + /// - Parameters: + /// - path: The path where content should be written under. + public init(path: URL) throws { + let ingestPath = path.appendingPathComponent("ingest") + let blobPath = path.appendingPathComponent("blobs/sha256") + + let fileManager = FileManager.default + try fileManager.createDirectory(at: ingestPath, withIntermediateDirectories: true) + try fileManager.createDirectory(at: blobPath, withIntermediateDirectories: true) + + self._basePath = path + self._ingestPath = ingestPath + self._blobPath = blobPath + self._lock = AsyncLock() + Self.encoder.outputFormatting = .sortedKeys + } + + /// Get a piece of content from the store. Returns nil if not + /// found. + /// + /// - Parameters: + /// - digest: The string digest of the content. + public func get(digest: String) throws -> Content? { + let d = digest.trimmingDigestPrefix + let path = self._blobPath.appendingPathComponent(d) + do { + return try LocalContent(path: path) + } catch let err as ContainerizationError { + switch err.code { + case .notFound: + return nil + default: + throw err + } + } + } + + /// Get a piece of content from the store and return the decoded version of + /// it. + /// + /// - Parameters: + /// - digest: The string digest of the content. + public func get(digest: String) throws -> T? { + guard let content: Content = try self.get(digest: digest) else { + return nil + } + return try content.decode() + } + + /// Delete all content besides a set provided. + /// + /// - Parameters: + /// - keeping: The set of string digests to keep. + public func delete(keeping: [String]) async throws -> ([String], UInt64) { + let fileManager = FileManager.default + let all = try fileManager.contentsOfDirectory(at: self._blobPath, includingPropertiesForKeys: nil) + let allDigests = Set(all.map { $0.lastPathComponent }) + let toDelete = allDigests.subtracting(keeping) + return try await self.delete(digests: Array(toDelete)) + } + + /// Delete a specific set of content. + /// + /// - Parameters: + /// - digests: Array of strings denoting the digests of the content to delete. + @discardableResult + public func delete(digests: [String]) async throws -> ([String], UInt64) { + let store = AsyncStore<([String], UInt64)>() + try await self._lock.withLock { context in + let fileManager = FileManager.default + var deleted: [String] = [] + var deletedBytes: UInt64 = 0 + for toDelete in digests { + let p = self._blobPath.appendingPathComponent(toDelete) + guard let content = try? LocalContent(path: p) else { + continue + } + deletedBytes += try content.size() + try fileManager.removeItem(at: p) + deleted.append(toDelete) + } + await store.set((deleted, deletedBytes)) + } + return await store.get() ?? ([], 0) + } + + /// Creates a transactional write to the content store. + /// + /// - Parameters: + /// - body: Closure that is given a temporary `URL` of the base directory which all contents should be written to. + /// This is a transaction write where any failed operation in the closure (caught exception) will result in all contents written + /// in the closure to be deleted. If the closure succeeds, then all the content that have been written to the temporary `URL` + /// will be moved into the actual blobs path of the content store. + @discardableResult + public func ingest(_ body: @Sendable @escaping (URL) async throws -> Void) async throws -> [String] { + let (id, tempPath) = try await self.newIngestSession() + try await body(tempPath) + return try await self.completeIngestSession(id) + } + + /// Creates a new ingest session and returns the session ID and temporary ingest directory corresponding to the session. + /// The contents from the ingest directory are processed and moved into the content store once the session is marked complete. + /// This can be done by invoking the `completeIngestSession` method with the returned session ID. + public func newIngestSession() async throws -> (id: String, ingestDir: URL) { + let id = UUID().uuidString + let temporaryPath = self._ingestPath.appendingPathComponent(id) + let fileManager = FileManager.default + try fileManager.createDirectory(atPath: temporaryPath.path, withIntermediateDirectories: true) + await self.activeIngestSessions.insert(id) + return (id, temporaryPath) + } + + /// Completes a previously started ingest session corresponding to `id`. The contents from the ingest + /// directory from the session are moved into the content store atomically. Any failure encountered will + /// result in a transaction failure causing none of the contents to be ingested into the store. + /// - Parameters: + /// - id: id of the ingest session to complete. + @discardableResult + public func completeIngestSession(_ id: String) async throws -> [String] { + guard await activeIngestSessions.contains(id) else { + throw ContainerizationError(.internalError, message: "invalid session id \(id)") + } + await activeIngestSessions.remove(id) + let temporaryPath = self._ingestPath.appendingPathComponent(id) + let fileManager = FileManager.default + defer { + try? fileManager.removeItem(at: temporaryPath) + } + let tempDigests: [URL] = try fileManager.contentsOfDirectory(at: temporaryPath, includingPropertiesForKeys: nil) + return try await self._lock.withLock { context in + var moved: [String] = [] + let fileManager = FileManager.default + do { + try tempDigests.forEach { + let digest = $0.lastPathComponent + let target = self._blobPath.appendingPathComponent(digest) + // only ingest if not exists + if !fileManager.fileExists(atPath: target.path) { + try fileManager.moveItem(at: $0, to: target) + moved.append(digest) + } + } + } catch { + moved.forEach { + try? fileManager.removeItem(at: self._blobPath.appendingPathComponent($0)) + } + throw error + } + return tempDigests.map { $0.lastPathComponent } + } + } + + /// Cancels a previously started ingest session corresponding to `id`. + /// The contents from the ingest directory corresponding to the session are removed. + /// - Parameters: + /// - id: id of the ingest session to complete. + public func cancelIngestSession(_ id: String) async throws { + guard let _ = await self.activeIngestSessions.remove(id) else { + return + } + let temporaryPath = self._ingestPath.appendingPathComponent(id) + let fileManager = FileManager.default + try? fileManager.removeItem(at: temporaryPath) + } + + /// Total bytes allocated on disk for the content store, covering + /// committed blobs and any active ingest sessions. + public func totalAllocatedSize() throws -> UInt64 { + let fileManager = FileManager.default + guard + let enumerator = fileManager.enumerator( + at: self._basePath, + includingPropertiesForKeys: [.totalFileAllocatedSizeKey, .isRegularFileKey], + options: [.skipsHiddenFiles] + ) + else { + throw ContainerizationError(.internalError, message: "failed to enumerate content store at \(self._basePath.path)") + } + var size: UInt64 = 0 + for case let fileURL as URL in enumerator { + guard let values = try? fileURL.resourceValues(forKeys: [.totalFileAllocatedSizeKey, .isRegularFileKey]), values.isRegularFile == true, + let fileSize = values.totalFileAllocatedSize + else { + // Skip directories and other non-regular entries. On Linux, + // `.totalFileAllocatedSizeKey` reports block allocation for + // directories, which would otherwise count empty-store + // inode overhead as content. + continue + } + size += UInt64(fileSize) + } + return size + } +} diff --git a/Sources/ContainerizationOCI/Content/SHA256+Extensions.swift b/Sources/ContainerizationOCI/Content/SHA256+Extensions.swift new file mode 100644 index 0000000..783a848 --- /dev/null +++ b/Sources/ContainerizationOCI/Content/SHA256+Extensions.swift @@ -0,0 +1,32 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Crypto +import Foundation + +extension SHA256.Digest { + /// Returns the digest as a string. + public var digestString: String { + let parts = self.description.split(separator: ": ") + return "sha256:\(parts[1])" + } + + /// Returns the digest without a 'sha256:' prefix. + public var encoded: String { + let parts = self.description.split(separator: ": ") + return String(parts[1]) + } +} diff --git a/Sources/ContainerizationOCI/Content/String+Extension.swift b/Sources/ContainerizationOCI/Content/String+Extension.swift new file mode 100644 index 0000000..cff8cbd --- /dev/null +++ b/Sources/ContainerizationOCI/Content/String+Extension.swift @@ -0,0 +1,26 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension String { + /// Removes any prefix (sha256:) from a digest string. + public var trimmingDigestPrefix: String { + let split = self.split(separator: ":") + if split.count == 2 { + return String(split[1]) + } + return self + } +} diff --git a/Sources/ContainerizationOCI/Content/URL+Extensions.swift b/Sources/ContainerizationOCI/Content/URL+Extensions.swift new file mode 100644 index 0000000..6c6fd06 --- /dev/null +++ b/Sources/ContainerizationOCI/Content/URL+Extensions.swift @@ -0,0 +1,36 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension URL { + /// Returns the unescaped absolutePath of a URL joined by separator. + public func absolutePath() -> String { + #if os(macOS) + return self.path(percentEncoded: false) + #else + return self.path + #endif + } + + /// Returns the domain name of a registry. + public var domain: String? { + guard let host = self.absoluteString.split(separator: ":").first else { + return nil + } + return String(host) + } +} diff --git a/Sources/ContainerizationOCI/Descriptor.swift b/Sources/ContainerizationOCI/Descriptor.swift new file mode 100644 index 0000000..4606ade --- /dev/null +++ b/Sources/ContainerizationOCI/Descriptor.swift @@ -0,0 +1,62 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Source: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/descriptor.go + +import Foundation + +/// Descriptor describes the disposition of targeted content. +/// This structure provides `application/vnd.oci.descriptor.v1+json` mediatype +/// when marshalled to JSON. +public struct Descriptor: Codable, Sendable, Equatable { + /// mediaType is the media type of the object this schema refers to. + public let mediaType: String + + /// digest is the digest of the targeted content. + public let digest: String + + /// size specifies the size in bytes of the blob. + public let size: Int64 + + /// urls specifies a list of URLs from which this object MAY be downloaded. + public let urls: [String]? + + /// annotations contains arbitrary metadata relating to the targeted content. + public var annotations: [String: String]? + + /// platform describes the platform which the image in the manifest runs on. + /// + /// This should only be used when referring to a manifest. + public var platform: Platform? + + /// artifactType specifies the IANA media type of the artifact. + /// + /// Used in referrers API responses to indicate the type of each referring artifact. + public let artifactType: String? + + public init( + mediaType: String, digest: String, size: Int64, urls: [String]? = nil, annotations: [String: String]? = nil, + platform: Platform? = nil, artifactType: String? = nil + ) { + self.mediaType = mediaType + self.digest = digest + self.size = size + self.urls = urls + self.annotations = annotations + self.platform = platform + self.artifactType = artifactType + } +} diff --git a/Sources/ContainerizationOCI/FileManager+Size.swift b/Sources/ContainerizationOCI/FileManager+Size.swift new file mode 100644 index 0000000..fdbcf3b --- /dev/null +++ b/Sources/ContainerizationOCI/FileManager+Size.swift @@ -0,0 +1,31 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension FileManager { + func fileSize(atPath path: String) -> Int64? { + do { + let attributes = try attributesOfItem(atPath: path) + guard let fileSize = attributes[.size] as? NSNumber else { + return nil + } + return fileSize.int64Value + } catch { + return nil + } + } +} diff --git a/Sources/ContainerizationOCI/ImageConfig.swift b/Sources/ContainerizationOCI/ImageConfig.swift new file mode 100644 index 0000000..fcd20be --- /dev/null +++ b/Sources/ContainerizationOCI/ImageConfig.swift @@ -0,0 +1,173 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Source: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/config.go + +import Foundation + +/// ImageConfig defines the execution parameters which should be used as a base when running a container using an image. +public struct ImageConfig: Codable, Sendable { + enum CodingKeys: String, CodingKey { + case user = "User" + case env = "Env" + case entrypoint = "Entrypoint" + case cmd = "Cmd" + case workingDir = "WorkingDir" + case labels = "Labels" + case stopSignal = "StopSignal" + } + + /// user defines the username or UID which the process in the container should run as. + public let user: String? + + /// env is a list of environment variables to be used in a container. + public let env: [String]? + + /// entrypoint defines a list of arguments to use as the command to execute when the container starts. + public let entrypoint: [String]? + + /// cmd defines the default arguments to the entrypoint of the container. + public let cmd: [String]? + + /// workingDir sets the current working directory of the entrypoint process in the container. + public let workingDir: String? + + /// labels contains arbitrary metadata for the container. + public let labels: [String: String]? + + /// stopSignal contains the system call signal that will be sent to the container to exit. + public let stopSignal: String? + + public init( + user: String? = nil, env: [String]? = nil, entrypoint: [String]? = nil, cmd: [String]? = nil, + workingDir: String? = nil, labels: [String: String]? = nil, stopSignal: String? = nil + ) { + self.user = user + self.env = env + self.entrypoint = entrypoint + self.cmd = cmd + self.workingDir = workingDir + self.labels = labels + self.stopSignal = stopSignal + } +} + +/// RootFS describes a layer content addresses +public struct Rootfs: Codable, Sendable { + enum CodingKeys: String, CodingKey { + case type + case diffIDs = "diff_ids" + } + + /// type is the type of the rootfs. + public let type: String + + /// diffIDs is an array of layer content hashes (DiffIDs), in order from bottom-most to top-most. + public let diffIDs: [String] + + public init(type: String, diffIDs: [String]) { + self.type = type + self.diffIDs = diffIDs + } +} + +/// History describes the history of a layer. +public struct History: Codable, Sendable { + enum CodingKeys: String, CodingKey { + case created + case createdBy = "created_by" + case author + case comment + case emptyLayer = "empty_layer" + } + + /// created is the combined date and time at which the layer was created, formatted as defined by RFC 3339, section 5.6. + public let created: String? + + /// createdBy is the command which created the layer. + public let createdBy: String? + + /// author is the author of the build point. + public let author: String? + + /// comment is a custom message set when creating the layer. + public let comment: String? + + /// emptyLayer is used to mark if the history item created a filesystem diff. + public let emptyLayer: Bool? + + public init( + created: String? = nil, createdBy: String? = nil, author: String? = nil, comment: String? = nil, + emptyLayer: Bool? = nil + ) { + self.created = created + self.createdBy = createdBy + self.author = author + self.comment = comment + self.emptyLayer = emptyLayer + } +} + +/// Image is the JSON structure which describes some basic information about the image. +/// This provides the `application/vnd.oci.image.config.v1+json` mediatype when marshalled to JSON. +public struct Image: Codable, Sendable { + /// created is the combined date and time at which the image was created, formatted as defined by RFC 3339, section 5.6. + public let created: String? + + /// author defines the name and/or email address of the person or entity which created and is responsible for maintaining the image. + public let author: String? + + /// architecture field specifies the CPU architecture, for example `amd64` or `ppc64`. + public let architecture: String + + /// os specifies the operating system, for example `linux` or `windows`. + public let os: String + + /// osVersion is an optional field specifying the operating system version, for example on Windows `10.0.14393.1066`. + public let osVersion: String? + + /// osFeatures is an optional field specifying an array of strings, each listing a required OS feature (for example on Windows `win32k`). + public let osFeatures: [String]? + + /// variant is an optional field specifying a variant of the CPU, for example `v7` to specify ARMv7 when architecture is `arm`. + public let variant: String? + + /// config defines the execution parameters which should be used as a base when running a container using the image. + public let config: ImageConfig? + + /// rootfs references the layer content addresses used by the image. + public let rootfs: Rootfs + + /// history describes the history of each layer. + public let history: [History]? + + public init( + created: String? = nil, author: String? = nil, architecture: String, os: String, osVersion: String? = nil, + osFeatures: [String]? = nil, variant: String? = nil, config: ImageConfig? = nil, rootfs: Rootfs, + history: [History]? = nil + ) { + self.created = created + self.author = author + self.architecture = architecture + self.os = os + self.osVersion = osVersion + self.osFeatures = osFeatures + self.variant = variant + self.config = config + self.rootfs = rootfs + self.history = history + } +} diff --git a/Sources/ContainerizationOCI/Index.swift b/Sources/ContainerizationOCI/Index.swift new file mode 100644 index 0000000..26f7c47 --- /dev/null +++ b/Sources/ContainerizationOCI/Index.swift @@ -0,0 +1,64 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Source: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/index.go + +import Foundation + +/// Index references manifests for various platforms. +/// This structure provides `application/vnd.oci.image.index.v1+json` mediatype when marshalled to JSON. +public struct Index: Codable, Sendable { + /// schemaVersion is the image manifest schema that this image follows + public let schemaVersion: Int + + /// mediaType specifies the type of this document data structure e.g. `application/vnd.oci.image.index.v1+json` + /// This field is optional per the OCI Image Index Specification (omitempty) + public let mediaType: String + + /// manifests references platform specific manifests. + public var manifests: [Descriptor] + + /// annotations contains arbitrary metadata for the image index. + public var annotations: [String: String]? + + /// `subject` references another manifest this index is an artifact of. + public let subject: Descriptor? + + /// `artifactType` specifies the IANA media type of the artifact this index represents. + public let artifactType: String? + + public init( + schemaVersion: Int = 2, mediaType: String = MediaTypes.index, manifests: [Descriptor], + annotations: [String: String]? = nil, subject: Descriptor? = nil, artifactType: String? = nil + ) { + self.schemaVersion = schemaVersion + self.mediaType = mediaType + self.manifests = manifests + self.annotations = annotations + self.subject = subject + self.artifactType = artifactType + } + + public init(from decoder: Decoder) throws { + let container = try decoder.container(keyedBy: CodingKeys.self) + self.schemaVersion = try container.decode(Int.self, forKey: .schemaVersion) + self.mediaType = try container.decodeIfPresent(String.self, forKey: .mediaType) ?? "" + self.manifests = try container.decode([Descriptor].self, forKey: .manifests) + self.annotations = try container.decodeIfPresent([String: String].self, forKey: .annotations) + self.subject = try container.decodeIfPresent(Descriptor.self, forKey: .subject) + self.artifactType = try container.decodeIfPresent(String.self, forKey: .artifactType) + } +} diff --git a/Sources/ContainerizationOCI/Manifest.swift b/Sources/ContainerizationOCI/Manifest.swift new file mode 100644 index 0000000..ad3560e --- /dev/null +++ b/Sources/ContainerizationOCI/Manifest.swift @@ -0,0 +1,57 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Source: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/manifest.go + +import Foundation + +/// Manifest provides `application/vnd.oci.image.manifest.v1+json` mediatype structure when marshalled to JSON. +public struct Manifest: Codable, Sendable { + /// `schemaVersion` is the image manifest schema that this image follows. + public let schemaVersion: Int + + /// `mediaType` specifies the type of this document data structure, e.g. `application/vnd.oci.image.manifest.v1+json`. + public let mediaType: String? + + /// `config` references a configuration object for a container, by digest. + /// The referenced configuration object is a JSON blob that the runtime uses to set up the container. + public let config: Descriptor + + /// `layers` is an indexed list of layers referenced by the manifest. + public let layers: [Descriptor] + + /// `annotations` contains arbitrary metadata for the image manifest. + public let annotations: [String: String]? + + /// `subject` references another manifest this manifest is an artifact of. + public let subject: Descriptor? + + /// `artifactType` specifies the IANA media type of the artifact this manifest represents. + public let artifactType: String? + + public init( + schemaVersion: Int = 2, mediaType: String = MediaTypes.imageManifest, config: Descriptor, layers: [Descriptor], + annotations: [String: String]? = nil, subject: Descriptor? = nil, artifactType: String? = nil + ) { + self.schemaVersion = schemaVersion + self.mediaType = mediaType + self.config = config + self.layers = layers + self.annotations = annotations + self.subject = subject + self.artifactType = artifactType + } +} diff --git a/Sources/ContainerizationOCI/MediaType.swift b/Sources/ContainerizationOCI/MediaType.swift new file mode 100644 index 0000000..89a1fb3 --- /dev/null +++ b/Sources/ContainerizationOCI/MediaType.swift @@ -0,0 +1,67 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// MediaTypes represent all supported OCI image content types for both metadata and layer formats. +/// Follows all distributable media types in: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/mediatype.go +public struct MediaTypes: Codable, Sendable { + /// Specifies the media type for a content descriptor. + public static let descriptor = "application/vnd.oci.descriptor.v1+json" + + /// Specifies the media type for the oci-layout. + public static let layoutHeader = "application/vnd.oci.layout.header.v1+json" + + /// Specifies the media type for an image index. + public static let index = "application/vnd.oci.image.index.v1+json" + + /// Specifies the media type for an image manifest. + public static let imageManifest = "application/vnd.oci.image.manifest.v1+json" + + /// Specifies the media type for the image configuration. + public static let imageConfig = "application/vnd.oci.image.config.v1+json" + + /// Specifies the media type for an unused blob containing the value "{}". + public static let emptyJSON = "application/vnd.oci.empty.v1+json" + + /// Specifies the media type for a Docker image manifest. + public static let dockerManifest = "application/vnd.docker.distribution.manifest.v2+json" + + /// Specifies the media type for a Docker image manifest list. + public static let dockerManifestList = "application/vnd.docker.distribution.manifest.list.v2+json" + + /// The Docker media type used for image configurations. + public static let dockerImageConfig = "application/vnd.docker.container.image.v1+json" + + /// The media type used for layers referenced by the manifest. + public static let imageLayer = "application/vnd.oci.image.layer.v1.tar" + + /// The media type used for gzipped layers referenced by the manifest. + public static let imageLayerGzip = "application/vnd.oci.image.layer.v1.tar+gzip" + + /// The media type used for zstd compressed layers referenced by the manifest. + public static let imageLayerZstd = "application/vnd.oci.image.layer.v1.tar+zstd" + + /// The Docker media type used for uncompressed layers referenced by an image manifest. + public static let dockerImageLayer = "application/vnd.docker.image.rootfs.diff.tar" + + /// The Docker media type used for gzipped layers referenced by an image manifest. + public static let dockerImageLayerGzip = "application/vnd.docker.image.rootfs.diff.tar.gzip" + + /// The Docker media type used for zstd compressed layers referenced by an image manifest. + public static let dockerImageLayerZstd = "application/vnd.docker.image.rootfs.diff.tar.zstd" + + /// The media type used for in-toto attestations blobs. + public static let inTotoAttestationBlob = "application/vnd.in-toto+json" +} diff --git a/Sources/ContainerizationOCI/Platform.swift b/Sources/ContainerizationOCI/Platform.swift new file mode 100644 index 0000000..7455e01 --- /dev/null +++ b/Sources/ContainerizationOCI/Platform.swift @@ -0,0 +1,340 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Source: https://github.com/opencontainers/image-spec/blob/main/specs-go/v1/config.go + +import ContainerizationError +import Foundation + +/// Platform describes the platform which the image in the manifest runs on. +public struct Platform: Sendable, Equatable { + /// Normalizes a raw architecture string (e.g. from uname) to its OCI equivalent. + static func normalizeArch(_ raw: String) -> (arch: String, variant: String?) { + switch raw { + case "aarch64", "arm64": + return ("arm64", "v8") + case "x86_64", "x86-64", "amd64": + return ("amd64", nil) + case "arm", "armhf", "armel": + return ("arm", "v7") + default: + return (raw, nil) + } + } + + public static var current: Self { + var systemInfo = utsname() + uname(&systemInfo) + let arch = withUnsafePointer(to: &systemInfo.machine) { + $0.withMemoryRebound(to: CChar.self, capacity: 1) { + String(cString: $0) + } + } + let normalized = normalizeArch(arch) + return .init(arch: normalized.arch, os: "linux", variant: normalized.variant) + } + + /// The computed description, for example, `linux/arm64/v8`. + public var description: String { + let architecture = architecture + if let variant = variant { + return "\(os)/\(architecture)/\(variant)" + } + return "\(os)/\(architecture)" + } + + /// The CPU architecture, for example, `amd64` or `arm64`. + public var architecture: String { + Self.normalizeArch(_rawArch).arch + } + + /// The operating system, for example, `linux` or `windows`. + public var os: String { + _rawOS + } + + /// An optional field specifying the operating system version, for example on Windows `10.0.14393.1066`. + public var osVersion: String? + + /// An optional field specifying an array of strings, each listing a required OS feature (for example on Windows `win32k`). + public var osFeatures: [String]? + + /// An optional field specifying a variant of the CPU, for example `v7` to specify ARMv7 when architecture is `arm`. + public var variant: String? + + /// The operation system of the image (eg. `linux`). + private let _rawOS: String + /// The CPU architecture (eg. `arm64`). + private let _rawArch: String + + public init(arch: String, os: String, osVersion: String? = nil, osFeatures: [String]? = nil, variant: String? = nil) { + self._rawArch = arch + self._rawOS = os + self.osVersion = osVersion + self.osFeatures = osFeatures + self.variant = variant + } + + /// Initializes a new platform from a string. + /// - Parameters: + /// - platform: A `string` value representing the platform. + /// ```swift + /// // Create a new `ImagePlatform` from string. + /// let platform = try Platform(from: "linux/amd64") + /// ``` + /// ## Throws ## + /// - Throws: `Error.missingOS` if input is empty + /// - Throws: `Error.invalidOS` if os is not `linux` + /// - Throws: `Error.missingArch` if only one `/` is present + /// - Throws: `Error.invalidArch` if an unrecognized architecture is provided + /// - Throws: `Error.invalidVariant` if a variant is provided, and it does not apply to the specified architecture + public init(from platform: String) throws { + let items = platform.split(separator: "/", maxSplits: 1) + guard let osValue = items.first else { + throw ContainerizationError(.invalidArgument, message: "missing OS in \(platform)") + } + switch osValue { + case "linux", "windows", "darwin": + _rawOS = osValue.description + default: + throw ContainerizationError(.invalidArgument, message: "unknown OS in \(osValue)") + } + guard items.count > 1 else { + throw ContainerizationError(.invalidArgument, message: "missing architecture in \(platform)") + } + + guard let archItems = items.last?.split(separator: "/", maxSplits: 1, omittingEmptySubsequences: false) else { + throw ContainerizationError(.invalidArgument, message: "missing architecture in \(platform)") + } + + guard let archName = archItems.first else { + throw ContainerizationError(.invalidArgument, message: "missing architecture in \(platform)") + } + + switch archName { + case "arm", "armhf", "armel": + _rawArch = "arm" + variant = "v7" + case "aarch64", "arm64": + variant = "v8" + _rawArch = "arm64" + case "x86_64", "x86-64", "amd64": + _rawArch = "amd64" + default: + _rawArch = archName.description + } + + if archItems.count == 2 { + guard let archVariant = archItems.last else { + throw ContainerizationError(.invalidArgument, message: "missing variant in \(platform)") + } + + switch archName { + case "arm": + switch archVariant { + case "v5", "v6", "v7", "v8": + variant = archVariant.description + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + case "armhf": + switch archVariant { + case "v7": + variant = "v7" + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + case "armel": + switch archVariant { + case "v6": + variant = "v6" + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + case "aarch64", "arm64": + switch archVariant { + case "v8", "8": + variant = "v8" + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + case "x86_64", "x86-64", "amd64": + switch archVariant { + case "v1": + variant = nil + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + case "i386", "386", "ppc64le", "riscv64": + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + default: + throw ContainerizationError(.invalidArgument, message: "invalid variant \(archVariant)") + } + } + } + +} + +extension Platform: Hashable { + /// `~=` compares two platforms to check if **lhs** platform images are compatible with **rhs** platform + /// This operator can be used to check if an image of **lhs** platform can run on **rhs**: + /// - `true`: when **rhs**=`arm/v8`, **lhs** is any of `arm/v8`, `arm/v7`, `arm/v6` and `arm/v5` + /// - `true`: when **rhs**=`arm/v7`, **lhs** is any of `arm/v7`, `arm/v6` and `arm/v5` + /// - `true`: when **rhs**=`arm/v6`, **lhs** is any of `arm/v6` and `arm/v5` + /// - `true`: when **rhs**=`amd64`, **lhs** is any of `amd64` and `386` + /// - `true`: when **rhs**=**lhs** + /// - `false`: otherwise + /// - Parameters: + /// - lhs: platform whose compatibility is being checked + /// - rhs: platform against which compatibility is being checked + /// - Returns: `true | false` + public static func ~= (lhs: Platform, rhs: Platform) -> Bool { + if lhs.os == rhs.os { + if lhs._rawArch == rhs._rawArch { + switch rhs._rawArch { + case "arm": + guard let lVariant = lhs.variant else { + return lhs == rhs + } + guard let rVariant = rhs.variant else { + return lhs == rhs + } + switch rVariant { + case "v8": + switch lVariant { + case "v5", "v6", "v7", "v8": + return true + default: + return false + } + case "v7": + switch lVariant { + case "v5", "v6", "v7": + return true + default: + return false + } + case "v6": + switch lVariant { + case "v5", "v6": + return true + default: + return false + } + default: + return lhs == rhs + } + default: + return lhs == rhs + } + } + if lhs._rawArch == "386" && rhs._rawArch == "amd64" { + return true + } + } + return false + } + + /// `==` compares if **lhs** and **rhs** are the exact same platforms. + public static func == (lhs: Platform, rhs: Platform) -> Bool { + // NOTE: + // If the platform struct was created by setting the fields directly and not using (from: String) + // then, there is a possibility that for arm64 architecture, the variant may be set to nil + // In that case, the variant should be assumed to v8 + if lhs.architecture == "arm64" && rhs.architecture == "arm64" { + // The following checks effectively verify + // that one operand has nil value and other has "v8" + if lhs.variant == nil || rhs.variant == nil { + if lhs.variant == "v8" || rhs.variant == "v8" { + return true + } + } + } + + let osEqual = lhs.os == rhs.os + let archEqual = lhs.architecture == rhs.architecture + let variantEqual = lhs.variant == rhs.variant + + return osEqual && archEqual && variantEqual + } + + public func hash(into hasher: inout Swift.Hasher) { + hasher.combine(os) + hasher.combine(architecture) + // arm64 with no variant is equivalent to arm64/v8 per the == implementation + if architecture == "arm64" { + hasher.combine(variant ?? "v8") + } else { + hasher.combine(variant) + } + } +} + +extension Platform: Codable { + + enum CodingKeys: String, CodingKey { + case os = "os" + case architecture = "architecture" + case variant = "variant" + } + + public func encode(to encoder: Encoder) throws { + var container = encoder.container(keyedBy: CodingKeys.self) + try container.encode(os, forKey: .os) + try container.encode(architecture, forKey: .architecture) + try container.encodeIfPresent(variant, forKey: .variant) + } + + public init(from decoder: Decoder) throws { + let container = try decoder.container(keyedBy: CodingKeys.self) + let architecture = try container.decodeIfPresent(String.self, forKey: .architecture) + guard let architecture else { + throw ContainerizationError(.invalidArgument, message: "missing architecture") + } + let os = try container.decodeIfPresent(String.self, forKey: .os) + guard let os else { + throw ContainerizationError(.invalidArgument, message: "missing OS") + } + let variant = try container.decodeIfPresent(String.self, forKey: .variant) + self.init(arch: architecture, os: os, variant: variant) + } +} + +public func createPlatformMatcher(for platform: Platform?) -> @Sendable (Platform) -> Bool { + if let platform { + return { other in + platform == other + } + } + return { _ in + true + } +} + +public func filterPlatforms(matcher: (Platform) -> Bool, _ descriptors: [Descriptor]) throws -> [Descriptor] { + var outDescriptors: [Descriptor] = [] + for desc in descriptors { + guard let p = desc.platform else { + // pass along descriptor if the platform is not defined + outDescriptors.append(desc) + continue + } + if matcher(p) { + outDescriptors.append(desc) + } + } + return outDescriptors +} diff --git a/Sources/ContainerizationOCI/Reference.swift b/Sources/ContainerizationOCI/Reference.swift new file mode 100644 index 0000000..af5d25e --- /dev/null +++ b/Sources/ContainerizationOCI/Reference.swift @@ -0,0 +1,285 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation + +// nameTotalLengthMax matches the OCI distribution spec which allows up to 255 bytes for the +// repository name component (domain + "/" + path). +private let nameTotalLengthMax = 255 +// referenceTotalLengthMax is the upper bound for the full reference string: max name (255) + +// separator (1) + max tag length (128) = 384. +private let tagLengthMax = 128 +private let referenceTotalLengthMax = nameTotalLengthMax + 1 + tagLengthMax +private let legacyDockerRegistryHost = "docker.io" +private let dockerRegistryHost = "registry-1.docker.io" +private let defaultDockerRegistryRepo = "library" +private let defaultTag = "latest" + +/// A Reference is composed of the various parts of an OCI image reference. +/// For example: +/// let imageReference = "my-registry.com/repository/image:tag2" +/// let reference = Reference.parse(imageReference) +/// print(reference.domain!) // gives us "my-registry.com" +/// print(reference.name) // gives us "my-registry.com/repository/image" +/// print(reference.path) // gives us "repository/image" +/// print(reference.tag!) // gives us "tag2" +/// print(reference.digest) // gives us "nil" +public class Reference: CustomStringConvertible { + private var _domain: String? + public var domain: String? { + _domain + } + public var resolvedDomain: String? { + if let d = _domain { + return Self.resolveDomain(domain: d) + } + return nil + } + + private var _path: String + public var path: String { + _path + } + + private var _tag: String? + public var tag: String? { + _tag + } + + private var _digest: String? + public var digest: String? { + _digest + } + + public var name: String { + if let domain, !domain.isEmpty { + return "\(domain)/\(path)" + } + return path + } + + public var description: String { + if let tag { + return "\(name):\(tag)" + } + if let digest { + return "\(name)@\(digest)" + } + return name + } + + static let identifierPattern = "([a-f0-9]{64})" + + static let domainPattern = { + let domainNameComponent = "(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])" + let optionalPort = "(?::[0-9]+)?" + let ipv6address = "\\[(?:[a-fA-F0-9:]+)\\]" + let domainName = "\(domainNameComponent)(?:\\.\(domainNameComponent))*" + let host = "(?:\(domainName)|\(ipv6address))" + let domainAndPort = "\(host)\(optionalPort)" + return domainAndPort + }() + + static let pathPattern = "(?(?:[a-z0-9]+(?:[._]|__|-|/)?)*[a-z0-9]+)" + static let tagPattern = "(?::(?[\\w][\\w.-]{0,127}))?(?:@(?sha256:[0-9a-fA-F]{64}))?" + static let pathTagPattern = "\(pathPattern)\(tagPattern)" + + public init(path: String, domain: String? = nil, tag: String? = nil, digest: String? = nil) throws { + if let domain, !domain.isEmpty { + self._domain = domain + } + + self._path = path + self._tag = tag + self._digest = digest + } + + public static func parse(_ s: String) throws -> Reference { + if s.count > referenceTotalLengthMax { + throw ContainerizationError(.invalidArgument, message: "reference length \(s.count) greater than \(referenceTotalLengthMax)") + } + + let identifierRegex = try Regex(Self.identifierPattern) + guard try identifierRegex.wholeMatch(in: s) == nil else { + throw ContainerizationError(.invalidArgument, message: "cannot specify 64 byte hex string as reference") + } + + let (domain, remainder) = try Self.parseDomain(from: s) + let constructedRawReference: String = remainder + if let domain { + let domainRegex = try Regex(domainPattern) + guard try domainRegex.wholeMatch(in: domain) != nil else { + throw ContainerizationError(.invalidArgument, message: "invalid domain \(domain) for reference \(s)") + } + } + let fields = try constructedRawReference.matches(regex: pathTagPattern) + guard let path = fields["path"] else { + throw ContainerizationError(.invalidArgument, message: "cannot parse path for reference \(s)") + } + + let ref = try Reference(path: path, domain: domain) + if ref.name.count > nameTotalLengthMax { + throw ContainerizationError(.invalidArgument, message: "repo length \(ref.name.count) greater than \(nameTotalLengthMax)") + } + + // Extract tag and digest + let tag = fields["tag"] ?? "" + let digest = fields["digest"] ?? "" + + if !digest.isEmpty { + return try ref.withDigest(digest) + } else if !tag.isEmpty { + return try ref.withTag(tag) + } + return ref + } + + private static func parseDomain(from s: String) throws -> (domain: String?, remainder: String) { + var domain: String? = nil + var path: String = s + let charset = CharacterSet(charactersIn: ".:") + let splits = s.split(separator: "/", maxSplits: 1) + guard splits.count == 2 else { + if s.starts(with: "localhost") { + return (s, "") + } + return (nil, s) + } + let _domain = String(splits[0]) + let _path = String(splits[1]) + if _domain.starts(with: "localhost") || _domain.rangeOfCharacter(from: charset) != nil { + domain = _domain + path = _path + } + return (domain, path) + } + + public static func withName(_ name: String) throws -> Reference { + if name.count > nameTotalLengthMax { + throw ContainerizationError(.invalidArgument, message: "name length \(name.count) greater than \(nameTotalLengthMax)") + } + let fields = try name.matches(regex: Self.domainPattern) + // Extract domain and path + let domain = fields["domain"] ?? "" + let path = fields["path"] ?? "" + + if domain.isEmpty || path.isEmpty { + throw ContainerizationError(.invalidArgument, message: "image reference domain or path is empty") + } + + return try Reference(path: path, domain: domain) + } + + public func withTag(_ tag: String) throws -> Reference { + var tag = tag + if !tag.starts(with: ":") { + tag = ":" + tag + } + let fields = try tag.matches(regex: Self.tagPattern) + tag = fields["tag"] ?? "" + + if tag.isEmpty { + throw ContainerizationError(.invalidArgument, message: "invalid format for image reference, missing tag") + } + return try Reference(path: self.path, domain: self.domain, tag: tag) + } + + public func withDigest(_ digest: String) throws -> Reference { + var digest = digest + if !digest.starts(with: "@") { + digest = "@" + digest + } + let fields = try digest.matches(regex: Self.tagPattern) + digest = fields["digest"] ?? "" + + if digest.isEmpty { + throw ContainerizationError(.invalidArgument, message: "invalid format for image reference, missing digest") + } + return try Reference(path: self.path, domain: self.domain, digest: digest) + } + + private static func splitDomain(_ name: String) -> (domain: String, path: String) { + let parts = name.split(separator: "/") + guard parts.count == 2 else { + return ("", name) + } + return (String(parts[0]), String(parts[1])) + } + + /// Normalize the reference object. + /// Normalization is useful in cases where the reference object is to be used to + /// fetch/push an image from/to a remote registry. + /// It does the following: + /// - Adds a default tag of "latest" if the reference had no tag/digest set. + /// - If the domain is "registry-1.docker.io" or "docker.io" and the path has no repository set, + /// it adds a default "library/" repository name. + public func normalize() { + if let domain = self.domain, domain == dockerRegistryHost || domain == legacyDockerRegistryHost { + // Check if the image is being referenced by a named tag. + // If it is, and a repository is not specified, prefix it with "library/". + // This needs to be done only if we are using the Docker registry. + if !self.path.contains("/") { + self._path = "\(defaultDockerRegistryRepo)/\(self._path)" + } + } + let identifier = self._tag ?? self._digest + if identifier == nil { + // If the user did not specify a tag or a digest for the reference, set the tag to "latest". + self._tag = defaultTag + } + } + + public static func resolveDomain(domain: String) -> String { + if domain == legacyDockerRegistryHost { + return dockerRegistryHost + } + return domain + } +} + +extension String { + func matches(regex: String) throws -> [String: String] { + do { + let regex = try NSRegularExpression(pattern: regex, options: []) + let nsRange = NSRange(self.startIndex.. [String] { + let pattern = self.pattern + let regex = try NSRegularExpression(pattern: "\\(\\?<(\\w+)>", options: []) + let nsRange = NSRange(pattern.startIndex.. { + let (stream, cont) = AsyncStream.makeStream(of: Int32.self) + self.state.withLock { + $0.conts.append(cont) + } + cont.onTermination = { @Sendable _ in + self.cancel() + } + return stream + } + + /// Cancel every AsyncStream of signals, as well as the underlying + /// DispatchSignalSource's for each registered signal. + public func cancel() { + self.state.withLock { + if $0.conts.isEmpty { + return + } + + for cont in $0.conts { + cont.finish() + } + for source in $0.sources { + source.cancel() + } + $0.conts.removeAll() + $0.sources.removeAll() + } + } + + struct State: Sendable { + var conts: [AsyncStream.Continuation] = [] + // `sources` isn't used concurrently. + nonisolated(unsafe) var sources: [any DispatchSourceSignal] = [] + } + + // We keep a reference to the continuation object that is created for + // our AsyncStream and tell our signal handler to yield a value to it + // returning a value to the consumer + private func handler(_ sig: Int32) { + self.state.withLock { + for cont in $0.conts { + cont.yield(sig) + } + } + } + + private let state: Mutex = .init(State()) + + /// Create a new `AsyncSignalHandler` that catches all signals. + public static func catchAll() -> AsyncSignalHandler { + #if os(macOS) + let range = 1...31 + #else + let range = 1...64 + #endif + return create(notify: range.map { Int32($0) }) + } + + /// Create a new `AsyncSignalHandler` for the list of given signals `notify`. + /// The default signal handlers for these signals are removed and async handlers + /// added in their place. The async signal handlers that are installed simply + /// yield to a stream if and when a signal is caught. + public static func create(notify on: [Int32]) -> AsyncSignalHandler { + let out = AsyncSignalHandler() + var sources = [any DispatchSourceSignal]() + for sig in on { + signal(sig, SIG_IGN) + let source = DispatchSource.makeSignalSource(signal: sig) + source.setEventHandler { + out.handler(sig) + } + source.resume() + // Retain a reference to our signal sources so that they + // do not go out of scope. + sources.append(source) + } + out.state.withLock { $0.sources = sources } + return out + } +} diff --git a/Sources/ContainerizationOS/BinaryInteger+Extensions.swift b/Sources/ContainerizationOS/BinaryInteger+Extensions.swift new file mode 100644 index 0000000..59c813a --- /dev/null +++ b/Sources/ContainerizationOS/BinaryInteger+Extensions.swift @@ -0,0 +1,49 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +extension BinaryInteger { + private func toUnsignedMemoryAmount(_ amount: UInt64) -> UInt64 { + guard self >= 0 else { + fatalError("encountered negative number during conversion to memory amount") + } + let val = UInt64(self) + let (newVal, overflow) = val.multipliedReportingOverflow(by: amount) + guard !overflow else { + fatalError("UInt64 overflow when converting to memory amount") + } + return newVal + } + + public func kib() -> UInt64 { + self.toUnsignedMemoryAmount(1 << 10) + } + + public func mib() -> UInt64 { + self.toUnsignedMemoryAmount(1 << 20) + } + + public func gib() -> UInt64 { + self.toUnsignedMemoryAmount(1 << 30) + } + + public func tib() -> UInt64 { + self.toUnsignedMemoryAmount(1 << 40) + } + + public func pib() -> UInt64 { + self.toUnsignedMemoryAmount(1 << 50) + } +} diff --git a/Sources/ContainerizationOS/Command.swift b/Sources/ContainerizationOS/Command.swift new file mode 100644 index 0000000..63fbe7b --- /dev/null +++ b/Sources/ContainerizationOS/Command.swift @@ -0,0 +1,338 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim +import Foundation +import Synchronization + +#if canImport(Darwin) +import Darwin +private let _kill = Darwin.kill +#elseif canImport(Musl) +import Musl +private let _kill = Musl.kill +#elseif canImport(Glibc) +import Glibc +private let _kill = Glibc.kill +#endif + +/// Use a command to run an executable. +public struct Command: Sendable { + /// Path to the executable binary. + public var executable: String + /// Arguments provided to the binary. + public var arguments: [String] + /// Environment variables for the process. + public var environment: [String] + /// The directory where the process should execute. + public var directory: String? + /// Additional files to pass to the process. + public var extraFiles: [FileHandle] + /// The standard input. + public var stdin: FileHandle? + /// The standard output. + public var stdout: FileHandle? + /// The standard error. + public var stderr: FileHandle? + + private let state: State + + /// System level attributes to set on the process. + public struct Attrs: Sendable { + /// Set pgroup for the new process. + public var setPGroup: Bool + /// Make the new process group the foreground process group (requires setPGroup). + public var setForegroundPGroup: Bool + /// Inherit the real uid/gid of the parent. + public var resetIDs: Bool + /// Reset the child's signal handlers to the default. + public var setSignalDefault: Bool + /// The initial signal mask for the process. + public var signalMask: UInt32 + /// Create a new session for the process. + public var setsid: Bool + /// Set the controlling terminal for the process to fd 0. + public var setctty: Bool + /// Set the process user ID. + public var uid: UInt32? + /// Set the process group ID. + public var gid: UInt32? + /// Signal to send when parent process dies (Linux only). + public var pdeathSignal: Int32? + + public init( + setPGroup: Bool = false, + setForegroundPGroup: Bool = false, + resetIDs: Bool = false, + setSignalDefault: Bool = true, + signalMask: UInt32 = 0, + setsid: Bool = false, + setctty: Bool = false, + uid: UInt32? = nil, + gid: UInt32? = nil, + pdeathSignal: Int32? = nil + ) { + self.setPGroup = setPGroup + self.setForegroundPGroup = setForegroundPGroup + self.resetIDs = resetIDs + self.setSignalDefault = setSignalDefault + self.signalMask = signalMask + self.setsid = setsid + self.setctty = setctty + self.uid = uid + self.gid = gid + self.pdeathSignal = pdeathSignal + } + } + + private final class State: Sendable { + let pid: Atomic = Atomic(-1) + } + + /// Attributes to set on the process. + public var attrs = Attrs() + + /// System level process identifier. + public var pid: Int32 { self.state.pid.load(ordering: .acquiring) } + + public init( + _ executable: String, + arguments: [String] = [], + environment: [String] = environment(), + directory: String? = nil, + extraFiles: [FileHandle] = [] + ) { + self.executable = executable + self.arguments = arguments + self.environment = environment + self.extraFiles = extraFiles + self.directory = directory + self.state = State() + } + + public static func environment() -> [String] { + ProcessInfo.processInfo.environment + .map { "\($0)=\($1)" } + } +} + +extension Command { + public enum Error: Swift.Error, CustomStringConvertible { + case processRunning + + public var description: String { + switch self { + case .processRunning: + return "the process is already running" + } + } + } +} + +extension Command { + @discardableResult + public func kill(_ signal: Int32) -> Int32? { + let pid = self.pid + guard pid > 0 else { + return nil + } + return _kill(pid, signal) + } +} + +extension Command { + /// Start the process. + public func start() throws { + guard self.pid == -1 else { + throw Error.processRunning + } + let child = try execute() + self.state.pid.store(child, ordering: .releasing) + } + + /// Wait for the process to exit and return the exit status. + @discardableResult + public func wait() throws -> Int32 { + var rus = rusage() + var ws = Int32() + + let pid = self.pid + guard pid > 0 else { + return -1 + } + + let result = wait4(pid, &ws, 0, &rus) + guard result == pid else { + throw POSIXError(.init(rawValue: errno)!) + } + return Self.toExitStatus(ws) + } + + private func execute() throws -> pid_t { + var attrs = exec_command_attrs() + exec_command_attrs_init(&attrs) + + let set = try createFileset() + defer { + for nullHandle in set.nullHandles { + try? nullHandle.close() + } + } + var fds = [Int32](repeating: 0, count: set.handles.count) + for (i, handle) in set.handles.enumerated() { + fds[i] = handle.fileDescriptor + } + + attrs.setsid = self.attrs.setsid ? 1 : 0 + attrs.setctty = self.attrs.setctty ? 1 : 0 + attrs.setpgid = self.attrs.setPGroup ? 1 : 0 + attrs.setfgpgrp = self.attrs.setForegroundPGroup ? 1 : 0 + + var cwdPath: UnsafeMutablePointer? + if let chdir = self.directory { + cwdPath = strdup(chdir) + } + defer { + if let cwdPath { + free(cwdPath) + } + } + + if let uid = self.attrs.uid { + attrs.uid = uid + } + if let gid = self.attrs.gid { + attrs.gid = gid + } + + if let pdeathSignal = self.attrs.pdeathSignal { + attrs.pdeathSignal = pdeathSignal + } + + var pid: pid_t = 0 + var argv = ([executable] + arguments).map { strdup($0) } + [nil] + defer { + for arg in argv where arg != nil { + free(arg) + } + } + + let env = environment.map { strdup($0) } + [nil] + defer { + for e in env where e != nil { + free(e) + } + } + + let result = fds.withUnsafeBufferPointer { file_handles in + exec_command( + &pid, + argv[0], + &argv, + env, + file_handles.baseAddress!, Int32(file_handles.count), + cwdPath ?? nil, + &attrs) + } + guard result == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + + return pid + } + + /// Create a posix_spawn file actions set of fds to pass to the new process + private func createFileset() throws -> (nullHandles: [FileHandle], handles: [FileHandle]) { + // grab dev null handles for different purposes + let nullRead = try openDevNull(flags: O_RDONLY) + let nullWrite = try openDevNull(flags: O_WRONLY) + var files = [FileHandle]() + files.append(stdin ?? nullRead) + files.append(stdout ?? nullWrite) + files.append(stderr ?? nullWrite) + files.append(contentsOf: extraFiles) + return (nullHandles: [nullRead, nullWrite], handles: files) + } + + /// Returns a file handle to /dev/null with the specified flags. + private func openDevNull(flags: Int32) throws -> FileHandle { + let fd = open("/dev/null", flags, 0) + guard fd >= 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + return FileHandle(fileDescriptor: fd, closeOnDealloc: false) + } +} + +extension Command { + private static let signalOffset: Int32 = 128 + + private static let shift: Int32 = 8 + private static let mask: Int32 = 0x7F + private static let stopped: Int32 = 0x7F + private static let exited: Int32 = 0x00 + + static func signaled(_ ws: Int32) -> Bool { + ws & mask != stopped && ws & mask != exited + } + + static func exited(_ ws: Int32) -> Bool { + ws & mask == exited + } + + static func exitStatus(_ ws: Int32) -> Int32 { + let r: Int32 + #if os(Linux) + r = ws >> shift & 0xFF + #else + r = ws >> shift + #endif + return r + } + + public static func toExitStatus(_ ws: Int32) -> Int32 { + if signaled(ws) { + // We use the offset as that is how existing container + // runtimes minic bash for the status when signaled. + return Int32(Self.signalOffset + ws & mask) + } + if exited(ws) { + return exitStatus(ws) + } + return ws + } + +} + +private func WIFEXITED(_ status: Int32) -> Bool { + _WSTATUS(status) == 0 +} + +private func _WSTATUS(_ status: Int32) -> Int32 { + status & 0x7f +} + +private func WIFSIGNALED(_ status: Int32) -> Bool { + (_WSTATUS(status) != 0) && (_WSTATUS(status) != 0x7f) +} + +private func WEXITSTATUS(_ status: Int32) -> Int32 { + (status >> 8) & 0xff +} + +private func WTERMSIG(_ status: Int32) -> Int32 { + status & 0x7f +} diff --git a/Sources/ContainerizationOS/File.swift b/Sources/ContainerizationOS/File.swift new file mode 100644 index 0000000..25cd05e --- /dev/null +++ b/Sources/ContainerizationOS/File.swift @@ -0,0 +1,144 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#endif + +#if canImport(FoundationEssentials) +import struct FoundationEssentials.URL +#else +import struct Foundation.URL +#endif + +/// Trivial type to discover information about a given file (uid, gid, mode...). +public struct File: Sendable { + /// `File` errors. + public enum Error: Swift.Error, CustomStringConvertible { + case errno(_ e: Int32) + + public var description: String { + switch self { + case .errno(let code): + return "errno \(code)" + } + } + } + + /// Returns a `FileInfo` struct with information about the file. + /// - Parameters: + /// - url: The path to the file. + public static func info(_ url: URL) throws -> FileInfo { + try info(url.path) + } + + /// Returns a `FileInfo` struct with information about the file. + /// - Parameters: + /// - path: The path to the file as a string. + public static func info(_ path: String) throws -> FileInfo { + var st = stat() + guard lstat(path, &st) == 0 else { + throw Error.errno(errno) + } + return FileInfo(path, stat: st) + } +} + +/// `FileInfo` holds and provides easy access to stat(2) data +/// for a file. +public struct FileInfo: Sendable { + private let _stat_t: stat + private let _path: String + + init(_ path: String, stat: stat) { + self._path = path + self._stat_t = stat + } + + /// mode_t for the file. + public var mode: mode_t { + self._stat_t.st_mode + } + + /// The files uid. + public var uid: Int { + Int(self._stat_t.st_uid) + } + + /// The files gid. + public var gid: Int { + Int(self._stat_t.st_gid) + } + + /// The filesystem ID the file belongs to. + public var dev: Int { + Int(self._stat_t.st_dev) + } + + /// The files inode number. + public var ino: Int { + Int(self._stat_t.st_ino) + } + + /// The size of the file. + public var size: Int { + Int(self._stat_t.st_size) + } + + /// The path to the file. + public var path: String { + self._path + } + + /// Returns if the file is a directory. + public var isDirectory: Bool { + mode & S_IFMT == S_IFDIR + } + + /// Returns if the file is a pipe. + public var isPipe: Bool { + mode & S_IFMT == S_IFIFO + } + + /// Returns if the file is a socket. + public var isSocket: Bool { + mode & S_IFMT == S_IFSOCK + } + + /// Returns if the file is a link. + public var isLink: Bool { + mode & S_IFMT == S_IFLNK + } + + /// Returns if the file is a regular file. + public var isRegularFile: Bool { + mode & S_IFMT == S_IFREG + } + + /// Returns if the file is a block device. + public var isBlock: Bool { + mode & S_IFMT == S_IFBLK + } + + /// Returns if the file is a character device. + public var isChar: Bool { + mode & S_IFMT == S_IFCHR + } +} diff --git a/Sources/ContainerizationOS/FileDescriptorOps.swift b/Sources/ContainerizationOS/FileDescriptorOps.swift new file mode 100644 index 0000000..4ade9a5 --- /dev/null +++ b/Sources/ContainerizationOS/FileDescriptorOps.swift @@ -0,0 +1,346 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import SystemPackage + +#if canImport(Darwin) +import Darwin +private let os_dup = Darwin.dup +private let os_S_IFMT = mode_t(Darwin.S_IFMT) +private let os_S_IFREG = mode_t(Darwin.S_IFREG) +private let os_S_IFDIR = mode_t(Darwin.S_IFDIR) +private let os_S_IFLNK = mode_t(Darwin.S_IFLNK) +#elseif canImport(Musl) +import CSystem +import Musl +private let os_dup = Musl.dup +private let os_S_IFMT = Musl.S_IFMT +private let os_S_IFREG = Musl.S_IFREG +private let os_S_IFDIR = Musl.S_IFDIR +private let os_S_IFLNK = Musl.S_IFLNK +#elseif canImport(Glibc) +import Glibc +private let os_dup = Glibc.dup +private let os_S_IFMT = mode_t(Glibc.S_IFMT) +private let os_S_IFREG = mode_t(Glibc.S_IFREG) +private let os_S_IFDIR = mode_t(Glibc.S_IFDIR) +private let os_S_IFLNK = mode_t(Glibc.S_IFLNK) +#endif + +/// Static utility functions for secure, symlink-safe filesystem operations +/// anchored to a file descriptor. +/// +/// All operations use `openat`/`mkdirat`/`unlinkat` anchored to the supplied +/// file descriptor, preventing path traversal and TOCTOU races. The type is +/// never instantiated; it exists solely as a namespace. +public enum FileDescriptorOps { + + // MARK: - Nested types + + public enum Error: Swift.Error, CustomStringConvertible, Equatable { + case invalidRelativePath + case invalidPathComponent + case cannotFollowSymlink + case systemError(String, Int32) + + public var description: String { + switch self { + case .invalidRelativePath: + return "invalid relative path supplied to file descriptor operation" + case .invalidPathComponent: + return "an intermediate path component is missing or is not a directory" + case .cannotFollowSymlink: + return "cannot follow a symlink in a file descriptor operation" + case .systemError(let operation, let err): + return "\(operation) returned error: \(err)" + } + } + } + + /// The type of a directory entry yielded by ``enumerate(_:_:)``. + public enum EntryType: Sendable, Equatable { + /// A regular file. + case regular + /// A directory. The entry is recursed into; symlinks to directories are + /// reported as `.symlink` and are never recursed. + case directory + /// A symbolic link (to a file or directory). + case symlink + /// Any other entry type (device node, named pipe, socket, etc.). + case other + } + + // MARK: - Public API + + /// Creates a directory relative to `fd`, rejecting paths that traverse symlinks. + /// + /// - Parameters: + /// - fd: An open file descriptor for the parent directory. + /// - relativePath: The path to create, relative to `fd`. + /// - permissions: The permissions to give the directory (default 0o755). + /// - makeIntermediates: Create or replace intermediate components as needed. + /// - completion: A function that operates on the new directory fd. + /// - Throws: `FileDescriptorOps.Error` if path validation or system errors occur. + public static func mkdir( + _ fd: FileDescriptor, + _ relativePath: FilePath, + permissions: FilePermissions? = nil, + makeIntermediates: Bool = false, + completion: (FileDescriptor) throws -> Void = { _ in } + ) throws { + try validateRelativePath(relativePath) + try mkdir( + fd, + relativePath.components, + permissions: permissions, + makeIntermediates: makeIntermediates, + completion: completion + ) + } + + /// Recursively removes a direct child of the directory at `fd`. + /// + /// - Parameters: + /// - fd: An open file descriptor for the parent directory. + /// - filename: The name of the child to remove. + /// - Throws: `FileDescriptorOps.Error` if system errors occur. + public static func unlinkRecursive(_ fd: FileDescriptor, filename: FilePath.Component) throws { + guard filename.string != "." && filename.string != ".." else { + return + } + + guard unlinkat(fd.rawValue, filename.string, 0) != 0 else { + return + } + + guard errno != ENOENT else { + return + } + + guard errno == EPERM || errno == EISDIR else { + throw Error.systemError("file removal during file descriptor unlink", errno) + } + + let componentFd = openat(fd.rawValue, filename.string, O_NOFOLLOW | O_RDONLY | O_DIRECTORY) + guard componentFd >= 0 else { + throw Error.systemError("directory open during file descriptor unlink", errno) + } + let componentFileDescriptor = FileDescriptor(rawValue: componentFd) + defer { try? componentFileDescriptor.close() } + + // Open the directory stream using a duplicate fd that closedir() will close. + let ownedFd = os_dup(componentFd) + guard let dir = fdopendir(ownedFd) else { + throw Error.systemError("directory opendir during file descriptor unlink", errno) + } + defer { closedir(dir) } + + while let entry = readdir(dir) { + let childComponent = withUnsafePointer(to: entry.pointee.d_name) { + $0.withMemoryRebound(to: UInt8.self, capacity: Int(NAME_MAX) + 1) { + let name = String(decodingCString: $0, as: UTF8.self) + return FilePath.Component(name) + } + } + guard let childComponent else { + throw Error.systemError("directory entry processing during file descriptor unlink", errno) + } + try unlinkRecursive(componentFileDescriptor, filename: childComponent) + } + + if unlinkat(fd.rawValue, filename.string, AT_REMOVEDIR) != 0 { + throw Error.systemError("directory removal during file descriptor unlink", errno) + } + } + + /// Recursively enumerates the contents of `fd` without following symbolic links. + /// + /// Each entry — file, directory, symlink, or other type — is reported to + /// `body` with a path relative to `fd`. Directories are reported before their + /// contents (pre-order) and then recursed. A symlink whose target is a directory + /// is reported as `.symlink` and is never followed, so traversal cannot escape + /// the tree rooted at `fd` regardless of where symlinks point. + /// + /// `fd` must be an open file descriptor for a directory. + /// + /// - Parameters: + /// - fd: An open file descriptor for the root directory to enumerate. + /// - body: Called once per entry. `path` is relative to `fd`; `type` + /// identifies the kind of entry; `parentFd` is the open file descriptor + /// for the directory that contains the entry. The last component of `path` + /// is the entry's filename; together with `parentFd` it allows the body to + /// open the entry via + /// `openat(parentFd.rawValue, path.lastComponent!.string, O_NOFOLLOW …)` + /// without reconstructing an absolute path, preserving the TOCTOU safety + /// of the traversal end-to-end. `parentFd` must not be closed within the + /// body call, or used after the call returns. Throw to abort. + /// - Throws: `FileDescriptorOps.Error` on system errors; any error thrown by + /// `body` is propagated unchanged. + public static func enumerate( + _ fd: FileDescriptor, + _ body: (_ path: FilePath, _ type: EntryType, _ parentFd: FileDescriptor) throws -> Void + ) throws { + try enumerateHelper(fd, relativePath: FilePath(""), body: body) + } + + // MARK: - Canonical path + + #if canImport(Darwin) + /// Returns the canonical path for `fd` using `F_GETPATH`. + public static func getCanonicalPath(_ fd: FileDescriptor) throws -> FilePath { + var buffer = [CChar](repeating: 0, count: Int(PATH_MAX)) + guard fcntl(fd.rawValue, F_GETPATH, &buffer) != -1 else { + throw Errno(rawValue: errno) + } + let bytes = buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) } + return FilePath(String(decoding: bytes, as: UTF8.self)) + } + #elseif canImport(Glibc) || canImport(Musl) + /// Returns the canonical path for `fd` via `/proc/self/fd`. + public static func getCanonicalPath(_ fd: FileDescriptor) throws -> FilePath { + let fdPath = "/proc/self/fd/\(fd.rawValue)" + var buffer = [CChar](repeating: 0, count: 4096) + let len = readlink(fdPath, &buffer, buffer.count - 1) + guard len > 0 else { + throw Error.systemError("readlink", errno) + } + let bytes = buffer.prefix(len).map { UInt8(bitPattern: $0) } + return FilePath(String(decoding: bytes, as: UTF8.self)) + } + #endif + + // MARK: - Private helpers + + private static func mkdir( + _ fd: FileDescriptor, + _ relativeComponents: FilePath.ComponentView, + permissions: FilePermissions? = nil, + makeIntermediates: Bool, + completion: (FileDescriptor) throws -> Void + ) throws { + guard let currentComponent = relativeComponents.first else { + try completion(fd) + return + } + let childComponents = FilePath.ComponentView(relativeComponents.dropFirst()) + + var componentFd = openat(fd.rawValue, currentComponent.string, O_NOFOLLOW | O_RDONLY | O_DIRECTORY) + if componentFd < 0 { + guard makeIntermediates || childComponents.isEmpty else { + throw Error.invalidPathComponent + } + if errno != ENOENT { + try unlinkRecursive(fd, filename: currentComponent) + } + + guard mkdirat(fd.rawValue, currentComponent.string, permissions?.rawValue ?? 0o755) == 0 else { + throw Error.systemError("directory creation during file descriptor mkdir", errno) + } + + componentFd = openat(fd.rawValue, currentComponent.string, O_NOFOLLOW | O_RDONLY | O_DIRECTORY) + guard componentFd >= 0 else { + throw Error.systemError("directory open during file descriptor mkdir", errno) + } + } + + let componentFileDescriptor = FileDescriptor(rawValue: componentFd) + defer { try? componentFileDescriptor.close() } + + guard !childComponents.isEmpty else { + try completion(componentFileDescriptor) + return + } + + try mkdir( + componentFileDescriptor, childComponents, + permissions: permissions, makeIntermediates: makeIntermediates, completion: completion) + } + + private static func enumerateHelper( + _ fd: FileDescriptor, + relativePath: FilePath, + body: (_ path: FilePath, _ type: EntryType, _ parentFd: FileDescriptor) throws -> Void + ) throws { + // fdopendir takes ownership of the fd passed to it and closes it via + // closedir. Duplicate so the caller's fd remains open. + let dupFd = os_dup(fd.rawValue) + guard dupFd >= 0 else { + throw Error.systemError("dup during file descriptor enumerate", errno) + } + guard let dir = fdopendir(dupFd) else { + let savedErrno = errno + try? FileDescriptor(rawValue: dupFd).close() + throw Error.systemError("fdopendir during file descriptor enumerate", savedErrno) + } + defer { closedir(dir) } + + while let entry = readdir(dir) { + let name = withUnsafePointer(to: entry.pointee.d_name) { + $0.withMemoryRebound(to: UInt8.self, capacity: Int(NAME_MAX) + 1) { + String(decodingCString: $0, as: UTF8.self) + } + } + guard name != "." && name != ".." else { continue } + guard let component = FilePath.Component(name) else { continue } + + let entryPath = relativePath.appending(component) + let entryType = resolveEntryType(parentFd: fd.rawValue, name: name, dtype: entry.pointee.d_type) + + // Pass fd (the parent directory) so the body can use + // openat(parentFd.rawValue, path.lastComponent!.string, O_NOFOLLOW …) + // rather than reconstructing an absolute path, keeping the fd chain unbroken. + try body(entryPath, entryType, fd) + + guard entryType == .directory else { continue } + + // Open the child directory with O_NOFOLLOW to guarantee we are + // entering a real directory and not a symlink that was swapped in + // between readdir and here. + let childFd = openat(fd.rawValue, name, O_NOFOLLOW | O_RDONLY | O_DIRECTORY) + guard childFd >= 0 else { + throw Error.systemError("openat during file descriptor enumerate", errno) + } + let childDescriptor = FileDescriptor(rawValue: childFd) + defer { try? childDescriptor.close() } + try enumerateHelper(childDescriptor, relativePath: entryPath, body: body) + } + } + + private static func resolveEntryType(parentFd: Int32, name: String, dtype: UInt8) -> EntryType { + switch dtype { + case UInt8(DT_REG): return .regular + case UInt8(DT_DIR): return .directory + case UInt8(DT_LNK): return .symlink + case UInt8(DT_UNKNOWN): + // Some filesystems (NFS, ext2/3) report DT_UNKNOWN; fall back to fstatat. + var stbuf = stat() + guard fstatat(parentFd, name, &stbuf, AT_SYMLINK_NOFOLLOW) == 0 else { return .other } + switch stbuf.st_mode & os_S_IFMT { + case os_S_IFREG: return .regular + case os_S_IFDIR: return .directory + case os_S_IFLNK: return .symlink + default: return .other + } + default: return .other + } + } + + private static func validateRelativePath(_ path: FilePath) throws { + guard !(path.components.contains { $0 == ".." }) else { + throw Error.invalidRelativePath + } + } +} diff --git a/Sources/ContainerizationOS/FilePathOps.swift b/Sources/ContainerizationOS/FilePathOps.swift new file mode 100644 index 0000000..7dbc14a --- /dev/null +++ b/Sources/ContainerizationOS/FilePathOps.swift @@ -0,0 +1,38 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage + +/// Static utility functions for path operations. +/// +/// The type is never instantiated; it exists solely as a namespace. +public enum FilePathOps { + /// Returns an absolute version of `path`. + /// + /// This is a purely lexical operation: it does not resolve symlinks, + /// perform tilde expansion, and does not access the file system. If `path` + /// is already absolute, this returns `path` unchanged. + public static func absolutePath(_ path: FilePath) -> FilePath { + guard !path.isAbsolute else { + return path + } + + return FilePath(FileManager.default.currentDirectoryPath) + .appending(path.components) + .lexicallyNormalized() + } +} diff --git a/Sources/ContainerizationOS/Keychain/KeychainQuery.swift b/Sources/ContainerizationOS/Keychain/KeychainQuery.swift new file mode 100644 index 0000000..0c45df9 --- /dev/null +++ b/Sources/ContainerizationOS/Keychain/KeychainQuery.swift @@ -0,0 +1,243 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// Holds the result of a query to the keychain. +public struct KeychainQueryResult { + public var username: String + public var password: String + public var modifiedDate: Date + public var createdDate: Date +} + +/// Type that facilitates interacting with the macOS keychain. +public struct KeychainQuery { + public init() {} + + /// Save a value to the keychain. + /// - Parameters: + /// - securityDomain: The security domain used to fetch keychain entries. + /// - accessGroup: If present, the access group used to fetch keychain entries. + /// - hostname: The hostname for the authenticating server. + /// - username: The username to present to the server. + /// - password: The password to present to the server. + /// - Throws: An error if the keychain query fails or returns unexpected data. + public func save( + securityDomain: String, + accessGroup: String? = nil, + hostname: String, + username: String, + password: String + ) throws { + if try exists(securityDomain: securityDomain, accessGroup: accessGroup, hostname: hostname) { + try delete(securityDomain: securityDomain, accessGroup: accessGroup, hostname: hostname) + } + + guard let passwordEncoded = password.data(using: String.Encoding.utf8) else { + throw Self.Error.invalidPasswordConversion + } + var query: [String: Any] = [ + kSecClass as String: kSecClassInternetPassword, + kSecAttrSecurityDomain as String: securityDomain, + kSecAttrServer as String: hostname, + kSecAttrAccount as String: username, + kSecValueData as String: passwordEncoded, + kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlock, + kSecAttrSynchronizable as String: false, + ] + if let accessGroup { + query[kSecAttrAccessGroup as String] = accessGroup + } + + let status = SecItemAdd(query as CFDictionary, nil) + guard status == errSecSuccess else { throw Self.Error.unhandledError(status: status) } + } + + /// Delete a value from the keychain. + /// - Parameters: + /// - securityDomain: The security domain used to fetch keychain entries. + /// - accessGroup: If present, the access group used to fetch keychain entries. + /// - hostname: The hostname for the authenticating server. + /// - Throws: An error if the keychain query fails or returns unexpected data. + public func delete(securityDomain: String, accessGroup: String? = nil, hostname: String) throws { + var query: [String: Any] = [ + kSecClass as String: kSecClassInternetPassword, + kSecAttrSecurityDomain as String: securityDomain, + kSecAttrServer as String: hostname, + kSecMatchLimit as String: kSecMatchLimitOne, + ] + if let accessGroup { + query[kSecAttrAccessGroup as String] = accessGroup + } + let status = SecItemDelete(query as CFDictionary) + guard status == errSecSuccess || status == errSecItemNotFound else { + throw Self.Error.unhandledError(status: status) + } + } + + /// Retrieve a value from the keychain. + /// - Parameters: + /// - securityDomain: The security domain used to fetch keychain entries. + /// - accessGroup: If present, the access group used to fetch keychain entries. + /// - hostname: The hostname for the authenticating server. + /// - Returns: The keychain entry. + /// - Throws: An error if the keychain query fails or returns unexpected data. + public func get(securityDomain: String, accessGroup: String? = nil, hostname: String) throws -> KeychainQueryResult? { + var query: [String: Any] = [ + kSecClass as String: kSecClassInternetPassword, + kSecAttrSecurityDomain as String: securityDomain, + kSecAttrServer as String: hostname, + kSecReturnAttributes as String: true, + kSecMatchLimit as String: kSecMatchLimitOne, + kSecReturnData as String: true, + ] + if let accessGroup { + query[kSecAttrAccessGroup as String] = accessGroup + } + var item: CFTypeRef? + let status = SecItemCopyMatching(query as CFDictionary, &item) + let exists = try isQuerySuccessful(status) + if !exists { + return nil + } + + guard let fetched = item as? [String: Any] else { + throw Self.Error.unexpectedDataFetched + } + guard let data = fetched[kSecValueData as String] as? Data else { + throw Self.Error.keyNotPresent(key: kSecValueData as String) + } + guard let password = String(data: data, encoding: String.Encoding.utf8) else { + throw Self.Error.unexpectedDataFetched + } + guard let username = fetched[kSecAttrAccount as String] as? String else { + throw Self.Error.keyNotPresent(key: kSecAttrAccount as String) + } + guard let modifiedDate = fetched[kSecAttrModificationDate as String] as? Date else { + throw Self.Error.keyNotPresent(key: kSecAttrModificationDate as String) + } + guard let createdDate = fetched[kSecAttrCreationDate as String] as? Date else { + throw Self.Error.keyNotPresent(key: kSecAttrCreationDate as String) + } + return KeychainQueryResult( + username: username, + password: password, + modifiedDate: modifiedDate, + createdDate: createdDate + ) + } + + /// List all keychain entries for a domain. + /// - Parameters: + /// - securityDomain: The security domain used to fetch keychain entries. + /// - accessGroup: If present, the access group used to fetch keychain entries. + /// - Returns: An array of keychain metadata for each matching entry, or an empty array if none are found. + /// - Throws: An error if the keychain query fails or returns unexpected data. + public func list(securityDomain: String, accessGroup: String? = nil) throws -> [RegistryInfo] { + var query: [String: Any] = [ + kSecClass as String: kSecClassInternetPassword, + kSecAttrSecurityDomain as String: securityDomain, + kSecReturnAttributes as String: true, + kSecReturnData as String: false, + kSecMatchLimit as String: kSecMatchLimitAll, + ] + if let accessGroup { + query[kSecAttrAccessGroup as String] = accessGroup + } + var item: CFTypeRef? + let status = SecItemCopyMatching(query as CFDictionary, &item) + let exists = try isQuerySuccessful(status) + if !exists { + return [] + } + + guard let fetched = item as? [[String: Any]] else { + throw Self.Error.unexpectedDataFetched + } + + return try fetched.map { registry in + guard let hostname = registry[kSecAttrServer as String] as? String else { + throw Self.Error.keyNotPresent(key: kSecAttrServer as String) + } + guard let username = registry[kSecAttrAccount as String] as? String else { + throw Self.Error.keyNotPresent(key: kSecAttrAccount as String) + } + guard let modifiedDate = registry[kSecAttrModificationDate as String] as? Date else { + throw Self.Error.keyNotPresent(key: kSecAttrModificationDate as String) + } + guard let createdDate = registry[kSecAttrCreationDate as String] as? Date else { + throw Self.Error.keyNotPresent(key: kSecAttrCreationDate as String) + } + + return RegistryInfo( + hostname: hostname, + username: username, + modifiedDate: modifiedDate, + createdDate: createdDate + ) + } + } + + /// Check if a value exists in the keychain. + /// - Parameters: + /// - securityDomain: The security domain used to fetch keychain entries. + /// - accessGroup: If present, the access group used to fetch keychain entries. + /// - hostname: The hostname for the authenticating server. + /// - Returns: `true` if the entry exists, `false` otherwise. + /// - Throws: An error if the keychain query fails. + public func exists(securityDomain: String, accessGroup: String? = nil, hostname: String) throws -> Bool { + var query: [String: Any] = [ + kSecClass as String: kSecClassInternetPassword, + kSecAttrSecurityDomain as String: securityDomain, + kSecAttrServer as String: hostname, + kSecReturnAttributes as String: true, + kSecMatchLimit as String: kSecMatchLimitOne, + kSecReturnData as String: false, + ] + if let accessGroup { + query[kSecAttrAccessGroup as String] = accessGroup + } + + let status = SecItemCopyMatching(query as CFDictionary, nil) + return try isQuerySuccessful(status) + } + + private func isQuerySuccessful(_ status: Int32) throws -> Bool { + guard status != errSecItemNotFound else { + return false + } + guard status == errSecSuccess else { + throw Self.Error.unhandledError(status: status) + } + return true + } +} + +extension KeychainQuery { + public enum Error: Swift.Error { + case unhandledError(status: Int32) + case unexpectedDataFetched + case keyNotPresent(key: String) + case invalidPasswordConversion + } +} +#endif diff --git a/Sources/ContainerizationOS/Keychain/RegistryInfo.swift b/Sources/ContainerizationOS/Keychain/RegistryInfo.swift new file mode 100644 index 0000000..d81bd0d --- /dev/null +++ b/Sources/ContainerizationOS/Keychain/RegistryInfo.swift @@ -0,0 +1,33 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// Holds the stored attributes for a registry. +public struct RegistryInfo: Sendable { + /// The registry host as a domain name with an optional port. + public var hostname: String + /// The username used to authenticate with the registry. + public var username: String + /// The date the registry was last modified. + public let modifiedDate: Date + /// The date the registry was created. + public let createdDate: Date +} diff --git a/Sources/ContainerizationOS/Linux/Binfmt.swift b/Sources/ContainerizationOS/Linux/Binfmt.swift new file mode 100644 index 0000000..e065f7d --- /dev/null +++ b/Sources/ContainerizationOS/Linux/Binfmt.swift @@ -0,0 +1,109 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +#if canImport(Musl) +import Musl +private let _mount = Musl.mount +#elseif canImport(Glibc) +import Glibc +private let _mount = Glibc.mount +#endif + +/// `Binfmt` is a utility type that contains static helpers and types for +/// mounting the Linux binfmt_misc filesystem, and creating new binfmt entries. +public struct Binfmt: Sendable { + /// Default mount path for binfmt_misc. + public static let path = "/proc/sys/fs/binfmt_misc" + + /// Entry models a binfmt_misc entry. + /// https://docs.kernel.org/admin-guide/binfmt-misc.html + public struct Entry { + public var name: String + public var type: String + public var offset: String + public var magic: String + public var mask: String + public var flags: String + + public init( + name: String, + type: String = "M", + offset: String = "", + magic: String, + mask: String, + flags: String = "CF" + ) { + self.name = name + self.type = type + self.offset = offset + self.magic = magic + self.mask = mask + self.flags = flags + } + + /// Returns a binfmt `Entry` for amd64 ELF binaries. + public static func amd64() -> Self { + Binfmt.Entry( + name: "x86_64", + magic: #"\x7fELF\x02\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x3e\x00"#, + mask: #"\xff\xff\xff\xff\xff\xfe\xfe\x00\xff\xff\xff\xff\xff\xff\xff\xff\xfe\xff\xff\xff"# + ) + } + + #if os(Linux) + /// Register the passed in `binaryPath` as the interpreter for a new binfmt_misc entry. + public func register(binaryPath: String) throws { + let registration = ":\(self.name):\(self.type):\(self.offset):\(self.magic):\(self.mask):\(binaryPath):\(self.flags)" + + try registration.write( + to: URL(fileURLWithPath: Binfmt.path).appendingPathComponent("register"), + atomically: false, + encoding: .ascii + ) + } + + /// Deregister the binfmt_misc entry described by the current object. + public func deregister() throws { + let data = "-1" + try data.write( + to: URL(fileURLWithPath: Binfmt.path).appendingPathComponent(self.name), + atomically: false, + encoding: .ascii + ) + } + #endif // os(Linux) + } + + #if os(Linux) + /// Crude check to see if /proc/sys/fs/binfmt_misc/register exists. + public static func mounted() -> Bool { + FileManager.default.fileExists(atPath: "\(Self.path)/register") + } + + /// Mount the binfmt_misc filesystem. + public static func mount() throws { + guard _mount("binfmt_misc", Self.path, "binfmt_misc", 0, "") == 0 else { + throw POSIXError.fromErrno() + } + } + #endif // os(Linux) +} diff --git a/Sources/ContainerizationOS/Linux/Capabilities.swift b/Sources/ContainerizationOS/Linux/Capabilities.swift new file mode 100644 index 0000000..651d8b0 --- /dev/null +++ b/Sources/ContainerizationOS/Linux/Capabilities.swift @@ -0,0 +1,670 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +// MARK: - Configuration Types + +public enum CapabilityParsingError: Swift.Error, CustomStringConvertible { + case invalidCapabilitySet(String) + case invalidCapabilityName(String) + + public var description: String { + switch self { + case .invalidCapabilitySet(let value): + return "invalid CapabilitySet value '\(value)'" + case .invalidCapabilityName(let value): + return "invalid CapabilityName '\(value)'" + } + } +} + +public struct CapabilitySet: Sendable, Hashable { + private enum Value: Hashable, Sendable, CaseIterable { + case bounding + case effective + case inheritable + case permitted + case ambient + } + + private var value: Value + private init(_ value: Value) { + self.value = value + } + + public init(rawValue: String) throws { + let values = Value.allCases.reduce(into: [String: Value]()) { + $0[String(describing: $1).lowercased()] = $1 + } + + guard let match = values[rawValue.lowercased()] else { + throw CapabilityParsingError.invalidCapabilitySet(rawValue) + } + self.value = match + } + + public static var bounding: Self { Self(.bounding) } + public static var effective: Self { Self(.effective) } + public static var inheritable: Self { Self(.inheritable) } + public static var permitted: Self { Self(.permitted) } + public static var ambient: Self { Self(.ambient) } +} + +extension CapabilitySet: CustomStringConvertible { + public var description: String { + String(describing: self.value) + } +} + +public struct CapabilityName: Sendable, Hashable { + private enum Value: Hashable, Sendable, CaseIterable { + case chown + case dacOverride + case dacReadSearch + case fowner + case fsetid + case kill + case setgid + case setuid + case setpcap + case linuxImmutable + case netBindService + case netBroadcast + case netAdmin + case netRaw + case ipcLock + case ipcOwner + case sysModule + case sysRawio + case sysChroot + case sysPtrace + case sysPacct + case sysAdmin + case sysBoot + case sysNice + case sysResource + case sysTime + case sysTtyConfig + case mknod + case lease + case auditWrite + case auditControl + case setfcap + case macOverride + case macAdmin + case syslog + case wakeAlarm + case blockSuspend + case auditRead + case perfmon + case bpf + case checkpointRestore + } + + private var value: Value + private init(_ value: Value) { + self.value = value + } + + public init(rawValue: String) throws { + let uppercased = rawValue.uppercased() + let normalized = uppercased.hasPrefix("CAP_") ? uppercased : "CAP_\(uppercased)" + + let capNameMap: [String: Value] = [ + "CAP_CHOWN": .chown, + "CAP_DAC_OVERRIDE": .dacOverride, + "CAP_DAC_READ_SEARCH": .dacReadSearch, + "CAP_FOWNER": .fowner, + "CAP_FSETID": .fsetid, + "CAP_KILL": .kill, + "CAP_SETGID": .setgid, + "CAP_SETUID": .setuid, + "CAP_SETPCAP": .setpcap, + "CAP_LINUX_IMMUTABLE": .linuxImmutable, + "CAP_NET_BIND_SERVICE": .netBindService, + "CAP_NET_BROADCAST": .netBroadcast, + "CAP_NET_ADMIN": .netAdmin, + "CAP_NET_RAW": .netRaw, + "CAP_IPC_LOCK": .ipcLock, + "CAP_IPC_OWNER": .ipcOwner, + "CAP_SYS_MODULE": .sysModule, + "CAP_SYS_RAWIO": .sysRawio, + "CAP_SYS_CHROOT": .sysChroot, + "CAP_SYS_PTRACE": .sysPtrace, + "CAP_SYS_PACCT": .sysPacct, + "CAP_SYS_ADMIN": .sysAdmin, + "CAP_SYS_BOOT": .sysBoot, + "CAP_SYS_NICE": .sysNice, + "CAP_SYS_RESOURCE": .sysResource, + "CAP_SYS_TIME": .sysTime, + "CAP_SYS_TTY_CONFIG": .sysTtyConfig, + "CAP_MKNOD": .mknod, + "CAP_LEASE": .lease, + "CAP_AUDIT_WRITE": .auditWrite, + "CAP_AUDIT_CONTROL": .auditControl, + "CAP_SETFCAP": .setfcap, + "CAP_MAC_OVERRIDE": .macOverride, + "CAP_MAC_ADMIN": .macAdmin, + "CAP_SYSLOG": .syslog, + "CAP_WAKE_ALARM": .wakeAlarm, + "CAP_BLOCK_SUSPEND": .blockSuspend, + "CAP_AUDIT_READ": .auditRead, + "CAP_PERFMON": .perfmon, + "CAP_BPF": .bpf, + "CAP_CHECKPOINT_RESTORE": .checkpointRestore, + ] + + guard let match = capNameMap[normalized] else { + throw CapabilityParsingError.invalidCapabilityName(rawValue) + } + self.value = match + } + + public var capValue: UInt32 { + switch self.value { + case .chown: return 0 + case .dacOverride: return 1 + case .dacReadSearch: return 2 + case .fowner: return 3 + case .fsetid: return 4 + case .kill: return 5 + case .setgid: return 6 + case .setuid: return 7 + case .setpcap: return 8 + case .linuxImmutable: return 9 + case .netBindService: return 10 + case .netBroadcast: return 11 + case .netAdmin: return 12 + case .netRaw: return 13 + case .ipcLock: return 14 + case .ipcOwner: return 15 + case .sysModule: return 16 + case .sysRawio: return 17 + case .sysChroot: return 18 + case .sysPtrace: return 19 + case .sysPacct: return 20 + case .sysAdmin: return 21 + case .sysBoot: return 22 + case .sysNice: return 23 + case .sysResource: return 24 + case .sysTime: return 25 + case .sysTtyConfig: return 26 + case .mknod: return 27 + case .lease: return 28 + case .auditWrite: return 29 + case .auditControl: return 30 + case .setfcap: return 31 + case .macOverride: return 32 + case .macAdmin: return 33 + case .syslog: return 34 + case .wakeAlarm: return 35 + case .blockSuspend: return 36 + case .auditRead: return 37 + case .perfmon: return 38 + case .bpf: return 39 + case .checkpointRestore: return 40 + } + } + + public static var chown: Self { Self(.chown) } + public static var dacOverride: Self { Self(.dacOverride) } + public static var dacReadSearch: Self { Self(.dacReadSearch) } + public static var fowner: Self { Self(.fowner) } + public static var fsetid: Self { Self(.fsetid) } + public static var kill: Self { Self(.kill) } + public static var setgid: Self { Self(.setgid) } + public static var setuid: Self { Self(.setuid) } + public static var setpcap: Self { Self(.setpcap) } + public static var linuxImmutable: Self { Self(.linuxImmutable) } + public static var netBindService: Self { Self(.netBindService) } + public static var netBroadcast: Self { Self(.netBroadcast) } + public static var netAdmin: Self { Self(.netAdmin) } + public static var netRaw: Self { Self(.netRaw) } + public static var ipcLock: Self { Self(.ipcLock) } + public static var ipcOwner: Self { Self(.ipcOwner) } + public static var sysModule: Self { Self(.sysModule) } + public static var sysRawio: Self { Self(.sysRawio) } + public static var sysChroot: Self { Self(.sysChroot) } + public static var sysPtrace: Self { Self(.sysPtrace) } + public static var sysPacct: Self { Self(.sysPacct) } + public static var sysAdmin: Self { Self(.sysAdmin) } + public static var sysBoot: Self { Self(.sysBoot) } + public static var sysNice: Self { Self(.sysNice) } + public static var sysResource: Self { Self(.sysResource) } + public static var sysTime: Self { Self(.sysTime) } + public static var sysTtyConfig: Self { Self(.sysTtyConfig) } + public static var mknod: Self { Self(.mknod) } + public static var lease: Self { Self(.lease) } + public static var auditWrite: Self { Self(.auditWrite) } + public static var auditControl: Self { Self(.auditControl) } + public static var setfcap: Self { Self(.setfcap) } + public static var macOverride: Self { Self(.macOverride) } + public static var macAdmin: Self { Self(.macAdmin) } + public static var syslog: Self { Self(.syslog) } + public static var wakeAlarm: Self { Self(.wakeAlarm) } + public static var blockSuspend: Self { Self(.blockSuspend) } + public static var auditRead: Self { Self(.auditRead) } + public static var perfmon: Self { Self(.perfmon) } + public static var bpf: Self { Self(.bpf) } + public static var checkpointRestore: Self { Self(.checkpointRestore) } + + public static var allCases: [CapabilityName] { + Value.allCases.map { CapabilityName($0) } + } +} + +extension CapabilityName: CustomStringConvertible { + public var description: String { + switch self.value { + case .chown: return "CAP_CHOWN" + case .dacOverride: return "CAP_DAC_OVERRIDE" + case .dacReadSearch: return "CAP_DAC_READ_SEARCH" + case .fowner: return "CAP_FOWNER" + case .fsetid: return "CAP_FSETID" + case .kill: return "CAP_KILL" + case .setgid: return "CAP_SETGID" + case .setuid: return "CAP_SETUID" + case .setpcap: return "CAP_SETPCAP" + case .linuxImmutable: return "CAP_LINUX_IMMUTABLE" + case .netBindService: return "CAP_NET_BIND_SERVICE" + case .netBroadcast: return "CAP_NET_BROADCAST" + case .netAdmin: return "CAP_NET_ADMIN" + case .netRaw: return "CAP_NET_RAW" + case .ipcLock: return "CAP_IPC_LOCK" + case .ipcOwner: return "CAP_IPC_OWNER" + case .sysModule: return "CAP_SYS_MODULE" + case .sysRawio: return "CAP_SYS_RAWIO" + case .sysChroot: return "CAP_SYS_CHROOT" + case .sysPtrace: return "CAP_SYS_PTRACE" + case .sysPacct: return "CAP_SYS_PACCT" + case .sysAdmin: return "CAP_SYS_ADMIN" + case .sysBoot: return "CAP_SYS_BOOT" + case .sysNice: return "CAP_SYS_NICE" + case .sysResource: return "CAP_SYS_RESOURCE" + case .sysTime: return "CAP_SYS_TIME" + case .sysTtyConfig: return "CAP_SYS_TTY_CONFIG" + case .mknod: return "CAP_MKNOD" + case .lease: return "CAP_LEASE" + case .auditWrite: return "CAP_AUDIT_WRITE" + case .auditControl: return "CAP_AUDIT_CONTROL" + case .setfcap: return "CAP_SETFCAP" + case .macOverride: return "CAP_MAC_OVERRIDE" + case .macAdmin: return "CAP_MAC_ADMIN" + case .syslog: return "CAP_SYSLOG" + case .wakeAlarm: return "CAP_WAKE_ALARM" + case .blockSuspend: return "CAP_BLOCK_SUSPEND" + case .auditRead: return "CAP_AUDIT_READ" + case .perfmon: return "CAP_PERFMON" + case .bpf: return "CAP_BPF" + case .checkpointRestore: return "CAP_CHECKPOINT_RESTORE" + } + } +} + +// MARK: - Linux Implementation + +#if os(Linux) + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +import CShim + +/// Capability type flags +public struct CapType: OptionSet, Sendable { + public let rawValue: UInt32 + + public init(rawValue: UInt32) { + self.rawValue = rawValue + } + + // Individual capability sets (for Get/Set/Unset/etc) + public static let effective = CapType(rawValue: 1 << 0) + public static let permitted = CapType(rawValue: 1 << 1) + public static let inheritable = CapType(rawValue: 1 << 2) + public static let bounding = CapType(rawValue: 1 << 3) + public static let ambient = CapType(rawValue: 1 << 4) + + // Bulk operation flags (for Apply/Fill/Clear) + public static let caps = CapType(rawValue: 1 << 8) // CAPS - effective, permitted, inheritable + public static let bounds = CapType(rawValue: 1 << 9) // BOUNDS - bounding set + public static let ambs = CapType(rawValue: 1 << 10) // AMBS - ambient capabilities +} + +private struct CapabilityHeader { + var version: UInt32 + var pid: Int32 + + init(pid: Int32 = 0) { + self.version = 0x2008_0522 + self.pid = pid + } +} + +private struct CapabilityData { + var effective1: UInt32 + var permitted1: UInt32 + var inheritable1: UInt32 + var effective2: UInt32 + var permitted2: UInt32 + var inheritable2: UInt32 + + init( + effective1: UInt32 = 0, + permitted1: UInt32 = 0, + inheritable1: UInt32 = 0, + effective2: UInt32 = 0, + permitted2: UInt32 = 0, + inheritable2: UInt32 = 0 + ) { + self.effective1 = effective1 + self.permitted1 = permitted1 + self.inheritable1 = inheritable1 + self.effective2 = effective2 + self.permitted2 = permitted2 + self.inheritable2 = inheritable2 + } +} + +/// Interface with Linux capabilities +/// https://linux.die.net/man/7/capabilities +public struct LinuxCapabilities: Sendable { + private var effectiveSet: UInt64 = 0 + private var permittedSet: UInt64 = 0 + private var inheritableSet: UInt64 = 0 + private var boundingSet: UInt64 = 0 + private var ambientSet: UInt64 = 0 + + public init() {} + + /// Get the highest supported capability from the kernel + public static func getLastSupported() throws -> CapabilityName { + guard let data = try? String(contentsOfFile: "/proc/sys/kernel/cap_last_cap", encoding: .ascii), + let lastCap = UInt32(data.trimmingCharacters(in: .whitespacesAndNewlines)) + else { + throw LinuxCapabilities.Error.invalidCapabilitySet("failed to read /proc/sys/kernel/cap_last_cap") + } + + guard let capability = CapabilityName.allCases.first(where: { $0.capValue == lastCap }) else { + throw LinuxCapabilities.Error.invalidCapabilitySet("no capability found for kernel max cap \(lastCap)") + } + + return capability + } + + /// Set keep caps + public static func setKeepCaps() throws { + let result = CZ_prctl_set_keepcaps() + if result != 0 { + throw LinuxCapabilities.Error.prctlFailed(errno: errno, operation: "PR_SET_KEEPCAPS") + } + } + + /// Clear keep caps + public static func clearKeepCaps() throws { + let result = CZ_prctl_clear_keepcaps() + if result != 0 { + throw LinuxCapabilities.Error.prctlFailed(errno: errno, operation: "PR_CLEAR_KEEPCAPS") + } + } + + /// Load current process capabilities from kernel + public mutating func load() throws { + let data = try getCurrentCapabilities() + self.effectiveSet = UInt64(data.effective1) + self.permittedSet = UInt64(data.permitted1) + self.inheritableSet = UInt64(data.inheritable1) + } + + /// Check if capability is present in the given set + public func get(which: CapType, what: CapabilityName) -> Bool { + let bit = UInt64(1) << what.capValue + + if which.contains(.effective) { + return (effectiveSet & bit) != 0 + } else if which.contains(.permitted) { + return (permittedSet & bit) != 0 + } else if which.contains(.inheritable) { + return (inheritableSet & bit) != 0 + } else if which.contains(.bounding) { + return (boundingSet & bit) != 0 + } else if which.contains(.ambient) { + return (ambientSet & bit) != 0 + } + return false + } + + /// Set capabilities in the given sets + public mutating func set(which: CapType, caps: [CapabilityName]) { + let mask = caps.reduce(UInt64(0)) { result, cap in + result | (UInt64(1) << cap.capValue) + } + + if which.contains(.effective) { + effectiveSet |= mask + } + if which.contains(.permitted) { + permittedSet |= mask + } + if which.contains(.inheritable) { + inheritableSet |= mask + } + if which.contains(.bounding) { + boundingSet |= mask + } + if which.contains(.ambient) { + ambientSet |= mask + } + } + + /// Unset capabilities from the given sets + public mutating func unset(which: CapType, caps: [CapabilityName]) { + let mask = caps.reduce(UInt64(0)) { result, cap in + result | (UInt64(1) << cap.capValue) + } + + if which.contains(.effective) { + effectiveSet &= ~mask + } + if which.contains(.permitted) { + permittedSet &= ~mask + } + if which.contains(.inheritable) { + inheritableSet &= ~mask + } + if which.contains(.bounding) { + boundingSet &= ~mask + } + if which.contains(.ambient) { + ambientSet &= ~mask + } + } + + /// Fill all bits of given capability types + public mutating func fill(kind: CapType) { + if kind.contains(.caps) { + effectiveSet = 0xFFFF_FFFF_FFFF_FFFF + permittedSet = 0xFFFF_FFFF_FFFF_FFFF + inheritableSet = 0 + } + if kind.contains(.bounds) { + boundingSet = 0xFFFF_FFFF_FFFF_FFFF + } + if kind.contains(.ambs) { + ambientSet = 0xFFFF_FFFF_FFFF_FFFF + } + } + + /// Clear all bits of given capability types + public mutating func clear(kind: CapType) { + if kind.contains(.caps) { + effectiveSet = 0 + permittedSet = 0 + inheritableSet = 0 + } + if kind.contains(.bounds) { + boundingSet = 0 + } + if kind.contains(.ambs) { + ambientSet = 0 + } + } + + /// Apply capabilities to current process + public func apply(kind: CapType) throws { + // Apply bounding set (requires CAP_SETPCAP) + if kind.contains(.bounds) { + try applyBoundingSet() + } + + // Apply main capabilities (effective, permitted, inheritable) + if kind.contains(.caps) { + try applyMainCapabilities() + } + + // Apply ambient capabilities + if kind.contains(.ambs) { + try applyAmbientCapabilities() + } + } + + private func applyBoundingSet() throws { + let currentData = try getCurrentCapabilities() + let hasSetPCap = (currentData.effective1 & (1 << CapabilityName.setpcap.capValue)) != 0 + + if hasSetPCap { + // Get the last supported capability to avoid trying to drop unsupported ones + let lastSupported = try Self.getLastSupported() + + for cap in CapabilityName.allCases { + // Skip capabilities higher than what the kernel supports + guard cap.capValue <= lastSupported.capValue else { continue } + + let capBit = UInt64(1) << cap.capValue + if (boundingSet & capBit) == 0 { + let result = CZ_prctl_capbset_drop(cap.capValue) + if result != 0 && errno != EINVAL { + throw Error.prctlFailed(errno: errno, operation: "PR_CAPBSET_DROP") + } + } + } + } + } + + private func applyMainCapabilities() throws { + let data = CapabilityData( + effective1: UInt32(effectiveSet & 0xFFFF_FFFF), + permitted1: UInt32(permittedSet & 0xFFFF_FFFF), + inheritable1: UInt32(inheritableSet & 0xFFFF_FFFF) + ) + + try setCapabilities(data: data) + } + + private func applyAmbientCapabilities() throws { + // Clear all ambient capabilities first + let clearResult = CZ_prctl_cap_ambient_clear_all() + if clearResult != 0 && errno != EINVAL { + throw Error.prctlFailed(errno: errno, operation: "PR_CAP_AMBIENT_CLEAR_ALL") + } + + // Get the last supported capability to avoid trying to set unsupported ones + let lastSupported = try Self.getLastSupported() + + // Set each ambient capability + for cap in CapabilityName.allCases { + // Skip capabilities higher than what the kernel supports + guard cap.capValue <= lastSupported.capValue else { continue } + + let capBit = UInt64(1) << cap.capValue + if (ambientSet & capBit) != 0 { + let result = CZ_prctl_cap_ambient_raise(cap.capValue) + if result != 0 && errno != EINVAL { + throw Error.prctlFailed(errno: errno, operation: "PR_CAP_AMBIENT_RAISE") + } + } + } + } + + private func getCurrentCapabilities() throws -> CapabilityData { + var header = CapabilityHeader() + var data = CapabilityData() + + let result = withUnsafeMutablePointer(to: &header) { headerPtr in + withUnsafeMutablePointer(to: &data) { dataPtr in + CZ_capget(headerPtr, dataPtr) + } + } + + if result != 0 { + throw Error.capgetFailed(errno: errno) + } + + return data + } + + private func setCapabilities(data: CapabilityData) throws { + var header = CapabilityHeader() + var mutableData = data + + let result = withUnsafeMutablePointer(to: &header) { headerPtr in + withUnsafeMutablePointer(to: &mutableData) { dataPtr in + CZ_capset(headerPtr, dataPtr) + } + } + + if result != 0 { + throw Error.capsetFailed(errno: errno) + } + } +} + +extension LinuxCapabilities { + public enum Error: Swift.Error, CustomStringConvertible { + case unsupportedCapability(name: String) + case capsetFailed(errno: Int32) + case capgetFailed(errno: Int32) + case prctlFailed(errno: Int32, operation: String) + case invalidCapabilitySet(String) + + public var description: String { + switch self { + case .unsupportedCapability(let name): + return "unsupported capability: \(name)" + case .capsetFailed(let errno): + return "capset failed with errno \(errno): \(String(cString: strerror(errno)))" + case .capgetFailed(let errno): + return "capget failed with errno \(errno): \(String(cString: strerror(errno)))" + case .prctlFailed(let errno, let operation): + return "prctl(\(operation)) failed with errno \(errno): \(String(cString: strerror(errno)))" + case .invalidCapabilitySet(let message): + return "invalid capability set configuration: \(message)" + } + } + } +} + +#endif diff --git a/Sources/ContainerizationOS/Linux/Epoll.swift b/Sources/ContainerizationOS/Linux/Epoll.swift new file mode 100644 index 0000000..3566e17 --- /dev/null +++ b/Sources/ContainerizationOS/Linux/Epoll.swift @@ -0,0 +1,189 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +#if canImport(Musl) +import Musl +private let _write = Musl.write +#elseif canImport(Glibc) +import Glibc +private let _write = Glibc.write +#endif + +import CShim + +// On glibc, epoll constants are EPOLL_EVENTS enum values. On musl they're +// plain UInt32. These helpers normalize them to UInt32/Int32. +private func epollMask(_ value: UInt32) -> UInt32 { value } +private func epollMask(_ value: Int32) -> UInt32 { UInt32(bitPattern: value) } +#if canImport(Glibc) +private func epollMask(_ value: EPOLL_EVENTS) -> UInt32 { value.rawValue } +private func epollFlag(_ value: EPOLL_EVENTS) -> Int32 { Int32(bitPattern: value.rawValue) } +#endif + +/// A thin wrapper around the Linux epoll syscall surface. +public final class Epoll: Sendable { + /// A set of epoll event flags. + public struct Mask: OptionSet, Sendable { + public let rawValue: UInt32 + + public init(rawValue: UInt32) { + self.rawValue = rawValue + } + + public static let input = Mask(rawValue: epollMask(EPOLLIN)) + public static let output = Mask(rawValue: epollMask(EPOLLOUT)) + + public var isHangup: Bool { + !self.isDisjoint(with: Mask(rawValue: epollMask(EPOLLHUP) | epollMask(EPOLLERR))) + } + + public var isRemoteHangup: Bool { + !self.isDisjoint(with: Mask(rawValue: epollMask(EPOLLRDHUP))) + } + + public var readyToRead: Bool { + self.contains(.input) + } + + public var readyToWrite: Bool { + self.contains(.output) + } + } + + /// An event returned by `wait()`. + public struct Event: Sendable { + public let fd: Int32 + public let mask: Mask + } + + private let epollFD: Int32 + private let eventFD: Int32 + + public init() throws { + let efd = epoll_create1(Int32(EPOLL_CLOEXEC)) + guard efd >= 0 else { + throw POSIXError.fromErrno() + } + + let evfd = eventfd(0, Int32(EFD_CLOEXEC | EFD_NONBLOCK)) + guard evfd >= 0 else { + let evfdErrno = POSIXError.fromErrno() + close(efd) + throw evfdErrno + } + + self.epollFD = efd + self.eventFD = evfd + + // Register the eventfd with epoll for shutdown signaling. + var event = epoll_event() + event.events = epollMask(EPOLLIN) + event.data.fd = self.eventFD + let ctlResult = withUnsafeMutablePointer(to: &event) { ptr in + epoll_ctl(efd, EPOLL_CTL_ADD, self.eventFD, ptr) + } + guard ctlResult == 0 else { + let ctlErrno = POSIXError.fromErrno() + close(evfd) + close(efd) + throw ctlErrno + } + } + + deinit { + close(epollFD) + close(eventFD) + } + + /// Register a file descriptor for edge-triggered monitoring. + public func add(_ fd: Int32, mask: Mask) throws { + guard fcntl(fd, F_SETFL, O_NONBLOCK) == 0 else { + throw POSIXError.fromErrno() + } + + let events = epollMask(EPOLLET) | mask.rawValue + + var event = epoll_event() + event.events = events + event.data.fd = fd + + try withUnsafeMutablePointer(to: &event) { ptr in + if epoll_ctl(self.epollFD, EPOLL_CTL_ADD, fd, ptr) == -1 { + throw POSIXError.fromErrno() + } + } + } + + /// Remove a file descriptor from the monitored collection. + public func delete(_ fd: Int32) throws { + var event = epoll_event() + let result = withUnsafeMutablePointer(to: &event) { ptr in + epoll_ctl(self.epollFD, EPOLL_CTL_DEL, fd, ptr) as Int32 + } + if result != 0 { + throw POSIXError.fromErrno() + } + } + + /// Wait for events. + /// + /// Returns ready events, an empty array on timeout, or `nil` on shutdown. + public func wait(maxEvents: Int = 128, timeout: Int32 = -1) -> [Event]? { + var events: [epoll_event] = .init(repeating: epoll_event(), count: maxEvents) + + while true { + let n = epoll_wait(self.epollFD, &events, Int32(events.count), timeout) + if n < 0 { + if errno == EINTR || errno == EAGAIN { + continue + } + preconditionFailure("epoll_wait failed unexpectedly: \(POSIXError.fromErrno())") + } + + if n == 0 { + return [] + } + + var result: [Event] = [] + result.reserveCapacity(Int(n)) + for i in 0...size) + precondition(n == MemoryLayout.size, "eventfd write failed: \(POSIXError.fromErrno())") + } + +} + +#endif // os(Linux) diff --git a/Sources/ContainerizationOS/Mount/Mount.swift b/Sources/ContainerizationOS/Mount/Mount.swift new file mode 100644 index 0000000..b4f4061 --- /dev/null +++ b/Sources/ContainerizationOS/Mount/Mount.swift @@ -0,0 +1,410 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +#if canImport(Musl) +import Musl +private let _mount = Musl.mount +private let _umount = Musl.umount2 +#elseif canImport(Glibc) +import Glibc +private let _mount = Glibc.mount +private let _umount = Glibc.umount2 +#endif + +// Mount package modeled closely from containerd's: https://github.com/containerd/containerd/tree/main/core/mount + +/// `Mount` models a Linux mount (although potentially could be used on other unix platforms), and +/// provides a simple interface to mount what the type describes. +public struct Mount: Sendable { + // Type specifies the host-specific of the mount. + public var type: String + // Source specifies where to mount from. Depending on the host system, this + // can be a source path or device. + public var source: String + // Target specifies an optional subdirectory as a mountpoint. + public var target: String + // Options contains zero or more fstab-style mount options. + public var options: [String] + + public init(type: String, source: String, target: String, options: [String]) { + self.type = type + self.source = source + self.target = target + self.options = options + } +} + +extension Mount { + #if canImport(Glibc) + internal typealias Flag = Int + #else + internal typealias Flag = Int32 + #endif + + internal struct FlagBehavior { + let clear: Bool + let flag: Flag + + public init(_ clear: Bool, _ flag: Flag) { + self.clear = clear + self.flag = flag + } + } + + #if os(Linux) + internal static let flagsDictionary: [String: FlagBehavior] = [ + "async": .init(true, MS_SYNCHRONOUS), + "atime": .init(true, MS_NOATIME), + "bind": .init(false, MS_BIND), + "defaults": .init(false, 0), + "dev": .init(true, MS_NODEV), + "diratime": .init(true, MS_NODIRATIME), + "dirsync": .init(false, MS_DIRSYNC), + "exec": .init(true, MS_NOEXEC), + "mand": .init(false, MS_MANDLOCK), + "noatime": .init(false, MS_NOATIME), + "nodev": .init(false, MS_NODEV), + "nodiratime": .init(false, MS_NODIRATIME), + "noexec": .init(false, MS_NOEXEC), + "nomand": .init(true, MS_MANDLOCK), + "norelatime": .init(true, MS_RELATIME), + "nostrictatime": .init(true, MS_STRICTATIME), + "nosuid": .init(false, MS_NOSUID), + "rbind": .init(false, MS_BIND | MS_REC), + "relatime": .init(false, MS_RELATIME), + "remount": .init(false, MS_REMOUNT), + "ro": .init(false, MS_RDONLY), + "rw": .init(true, MS_RDONLY), + "strictatime": .init(false, MS_STRICTATIME), + "suid": .init(true, MS_NOSUID), + "sync": .init(false, MS_SYNCHRONOUS), + ] + + internal struct MountOptions { + var flags: Int32 + var data: [String] + + public init(_ flags: Int32 = 0, data: [String] = []) { + self.flags = flags + self.data = data + } + } + + /// Whether the mount is read only. + public var readOnly: Bool { + for option in self.options { + if option == "ro" { + return true + } + } + return false + } + + /// Mount the mount relative to `root` with the current set of data in the object. + /// + /// Optionally provide `createWithPerms` to set the permissions for the directory that + /// it will be mounted at. + public func mount(root: String, createWithPerms: Int16? = nil) throws { + let fd = try secureResolveInRoot(root: root) + defer { close(fd) } + + let realPath = try readlinkProc(fd: fd) + try self.mountToTarget(target: realPath, createWithPerms: createWithPerms, targetResolved: true) + } + + /// Open a path relative to `dirFd` using `openat2(2)` with `RESOLVE_IN_ROOT`. + /// + /// All symlink resolution is confined to the directory tree beneath `dirFd`. + /// Returns the file descriptor on success, or -1 on failure (with errno set). + private func openInRoot(dirFd: Int32, path: String, flags: Int32, mode: UInt64 = 0) -> Int32 { + path.withCString { cPath in + var how = cz_open_how( + flags: UInt64(flags), + mode: mode, + resolve: UInt64(RESOLVE_IN_ROOT) + ) + return CZ_openat2(dirFd, cPath, &how, MemoryLayout.size) + } + } + + private func secureResolveInRoot(root: String) throws -> Int32 { + let rootFd = open(root, O_RDONLY | O_DIRECTORY | O_CLOEXEC) + guard rootFd >= 0 else { + throw Error.errno(errno, "failed to open rootfs '\(root)'") + } + + // Determine if the leaf mount point should be a file or directory. + let opts = parseMountOptions() + let isBindMount = (opts.flags & Int32(MS_BIND)) != 0 + var leafIsFile = false + if isBindMount { + var sourceStat = stat() + if stat(self.source, &sourceStat) == 0 { + leafIsFile = (sourceStat.st_mode & S_IFMT) != S_IFDIR + } + } + + // Normalize target to a relative path for openat2. + let relativePath = self.target + .split(separator: "/", omittingEmptySubsequences: true) + .joined(separator: "/") + + guard !relativePath.isEmpty else { + return rootFd + } + + // Fast path: try openat2 with RESOLVE_IN_ROOT for the full path. + let openFlags: Int32 = + leafIsFile + ? (O_RDONLY | O_CLOEXEC) + : (O_RDONLY | O_DIRECTORY | O_CLOEXEC) + let fd = openInRoot(dirFd: rootFd, path: relativePath, flags: openFlags) + if fd >= 0 { + close(rootFd) + return fd + } + + guard errno == ENOENT else { + let savedErrno = errno + close(rootFd) + throw Error.errno(savedErrno, "failed to resolve '\(self.target)' in rootfs") + } + + // Part of the path doesn't exist. Use openat2 to find the deepest + // existing ancestor, then create the missing components. + return try createMountTarget( + rootFd: rootFd, relativePath: relativePath, leafIsFile: leafIsFile + ) + } + + private func createMountTarget( + rootFd: Int32, + relativePath: String, + leafIsFile: Bool + ) throws -> Int32 { + let components = relativePath.split(separator: "/").map(String.init) + var currentFd = rootFd + var resultFd: Int32 = -1 + + // Centralized cleanup. On success resultFd holds the fd we return, + // so we avoid closing it. On error resultFd is -1 and we close + // everything. + defer { + if currentFd != rootFd && currentFd != resultFd { close(currentFd) } + if rootFd != resultFd { close(rootFd) } + } + + func fail(_ savedErrno: Int32, _ message: String) throws -> Never { + throw Error.errno(savedErrno, message) + } + + // Find the deepest existing directory using openat2 with RESOLVE_IN_ROOT. + var firstMissing = 0 + for i in 0..= 0 else { + try fail(errno, "failed to re-open mount point file '\(component)'") + } + resultFd = pathFd + return resultFd + } + + guard mkdirat(currentFd, component, 0o755) == 0 else { + try fail(errno, "failed to create directory '\(component)'") + } + + let dirFd = openat(currentFd, component, O_RDONLY | O_NOFOLLOW | O_DIRECTORY | O_CLOEXEC) + guard dirFd >= 0 else { + try fail(errno, "failed to open created directory '\(component)'") + } + + if isLast { + resultFd = dirFd + return resultFd + } + + if currentFd != rootFd { close(currentFd) } + currentFd = dirFd + } + + // All components already existed. + resultFd = currentFd + return resultFd + } + + /// Resolve the real filesystem path for an open fd via /proc/self/fd. + private func readlinkProc(fd: Int32) throws -> String { + let procPath = "/proc/self/fd/\(fd)" + var buffer = [CChar](repeating: 0, count: Int(PATH_MAX) + 1) + let len = readlink(procPath, &buffer, buffer.count - 1) + guard len > 0 else { + throw Error.errno(errno, "readlink failed for '\(procPath)'") + } + return buffer.prefix(len).withUnsafeBufferPointer { buf in + String(decoding: buf.map { UInt8(bitPattern: $0) }, as: UTF8.self) + } + } + + /// Mount the mount with the current set of data in the object. Optionally + /// provide `createWithPerms` to set the permissions for the directory that + /// it will be mounted at. + public func mount(createWithPerms: Int16? = nil) throws { + try self.mountToTarget(target: self.target, createWithPerms: createWithPerms) + } + + private func mountToTarget(target: String, createWithPerms: Int16?, targetResolved: Bool = false) throws { + let pageSize = sysconf(Int32(_SC_PAGESIZE)) + + let opts = parseMountOptions() + let dataString = opts.data.joined(separator: ",") + if dataString.count > pageSize { + throw Error.validation("data string exceeds page size (\(dataString.count) > \(pageSize))") + } + + let propagationTypes: Int32 = Int32(MS_SHARED) | Int32(MS_PRIVATE) | Int32(MS_SLAVE) | Int32(MS_UNBINDABLE) + + // Ensure propagation type change flags aren't included in other calls. + let originalFlags = opts.flags & ~(propagationTypes) + + // When targetResolved is true, the target path has already been securely + // resolved and the mount point created by secureResolveInRoot. Skip + // directory/file creation to avoid following symlinks in the target path. + if !targetResolved { + let targetURL = URL(fileURLWithPath: target) + let targetParent = targetURL.deletingLastPathComponent().path + if let perms = createWithPerms { + try mkdirAll(targetParent, perms) + } + + // For bind mounts, check if the source is a file and create the target accordingly. + let isBindMount = (originalFlags & Int32(MS_BIND)) != 0 + if isBindMount { + var sourceIsNonDir = false + var sourceStat = stat() + if stat(self.source, &sourceStat) == 0 { + sourceIsNonDir = (sourceStat.st_mode & S_IFMT) != S_IFDIR + } + + if sourceIsNonDir { + // Create parent directories and touch the target file + try mkdirAll(targetParent, 0o755) + let fd = open(target, O_WRONLY | O_CREAT, 0o644) + if fd >= 0 { + close(fd) + } + } else { + try mkdirAll(target, 0o755) + } + } else { + try mkdirAll(target, 0o755) + } + } + + if opts.flags & Int32(MS_REMOUNT) == 0 || !dataString.isEmpty { + guard _mount(self.source, target, self.type, UInt(originalFlags), dataString) == 0 else { + throw Error.errno( + errno, + "failed initial mount source=\(self.source) target=\(target) type=\(self.type) data=\(dataString)" + ) + } + } + + if opts.flags & propagationTypes != 0 { + // Change the propagation type. + let pflags = propagationTypes | Int32(MS_REC) | Int32(MS_SILENT) + guard _mount("", target, "", UInt(opts.flags & pflags), "") == 0 else { + throw Error.errno(errno, "failed propagation change mount") + } + } + + let bindReadOnlyFlags = Int32(MS_BIND) | Int32(MS_RDONLY) + if originalFlags & bindReadOnlyFlags == bindReadOnlyFlags { + guard _mount("", target, "", UInt(originalFlags | Int32(MS_REMOUNT)), "") == 0 else { + throw Error.errno(errno, "failed bind mount") + } + } + } + + private func mkdirAll(_ name: String, _ perm: Int16) throws { + try FileManager.default.createDirectory( + atPath: name, + withIntermediateDirectories: true, + attributes: [.posixPermissions: perm] + ) + } + + private func parseMountOptions() -> MountOptions { + var mountOpts = MountOptions() + for option in self.options { + if let entry = Self.flagsDictionary[option], entry.flag != 0 { + if entry.clear { + mountOpts.flags &= ~Int32(entry.flag) + } else { + mountOpts.flags |= Int32(entry.flag) + } + } else { + mountOpts.data.append(option) + } + } + return mountOpts + } + + /// `Mount` errors + public enum Error: Swift.Error, CustomStringConvertible { + case errno(Int32, String) + case validation(String) + + public var description: String { + switch self { + case .errno(let errno, let message): + return "mount failed with errno \(errno): \(message)" + case .validation(let message): + return "failed during validation: \(message)" + } + } + } + #endif +} diff --git a/Sources/ContainerizationOS/POSIXError+Helpers.swift b/Sources/ContainerizationOS/POSIXError+Helpers.swift new file mode 100644 index 0000000..233e78d --- /dev/null +++ b/Sources/ContainerizationOS/POSIXError+Helpers.swift @@ -0,0 +1,38 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#endif + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +extension POSIXError { + public static func fromErrno() -> POSIXError { + guard let errCode = POSIXErrorCode(rawValue: errno) else { + fatalError("failed to convert errno to POSIXErrorCode") + } + return POSIXError(errCode) + } +} diff --git a/Sources/ContainerizationOS/Path.swift b/Sources/ContainerizationOS/Path.swift new file mode 100644 index 0000000..1281a84 --- /dev/null +++ b/Sources/ContainerizationOS/Path.swift @@ -0,0 +1,88 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// `Path` provides utilities to look for binaries in the current PATH, +/// or to return the current PATH. +public struct Path { + /// lookPath looks up an executable's path from $PATH + public static func lookPath(_ name: String) -> URL? { + lookup(name, path: getCurrentPath()) + } + + public static func lookPath(_ name: String, path: String) -> URL? { + lookup(name, path: path) + } + + // getEnv returns the default environment of the process + // with the default $PATH added for the context of a macOS application bundle + public static func getEnv() -> [String: String] { + var env = ProcessInfo.processInfo.environment + env["PATH"] = getCurrentPath() + return env + } + + private static func lookup(_ name: String, path: String) -> URL? { + // Return nil for empty names + if name.isEmpty { + return nil + } + + if name.contains("/") { + if findExec(name) { + return URL(fileURLWithPath: name) + } + return nil + } + + for var lookdir in path.split(separator: ":") { + if lookdir.isEmpty { + lookdir = "." + } + let file = URL(fileURLWithPath: String(lookdir)).appendingPathComponent(name) + if findExec(file.path) { + return file + } + } + return nil + } + + /// getPath returns $PATH for the current process + public static func getCurrentPath() -> String { + let env = ProcessInfo.processInfo.environment + return env["PATH"] ?? "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin" + } + + // findPath returns a string containing the 'PATH' environment variable + public static func findPath(_ env: [String]?) -> String? { + guard let env = env else { + return nil + } + return env.first(where: { $0.hasPrefix("PATH=") }) + .map { String($0.dropFirst(5)) } + } + + // findExec returns true if the provided path is an executable + private static func findExec(_ path: String) -> Bool { + let fm = FileManager.default + return fm.isExecutableFile(atPath: path) + } +} diff --git a/Sources/ContainerizationOS/Pipe+Close.swift b/Sources/ContainerizationOS/Pipe+Close.swift new file mode 100644 index 0000000..748bd67 --- /dev/null +++ b/Sources/ContainerizationOS/Pipe+Close.swift @@ -0,0 +1,43 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension Pipe { + /// Close both sides of the pipe. + public func close() throws { + var err: Swift.Error? + do { + try self.fileHandleForReading.close() + } catch { + err = error + } + try self.fileHandleForWriting.close() + if let err { + throw err + } + } + + /// Ensure that both sides of the pipe are set with O_CLOEXEC. + public func setCloexec() throws { + if fcntl(self.fileHandleForWriting.fileDescriptor, F_SETFD, FD_CLOEXEC) == -1 { + throw POSIXError(.init(rawValue: errno)!) + } + if fcntl(self.fileHandleForReading.fileDescriptor, F_SETFD, FD_CLOEXEC) == -1 { + throw POSIXError(.init(rawValue: errno)!) + } + } +} diff --git a/Sources/ContainerizationOS/README.md b/Sources/ContainerizationOS/README.md new file mode 100644 index 0000000..7027797 --- /dev/null +++ b/Sources/ContainerizationOS/README.md @@ -0,0 +1,3 @@ +## OS + +This target contains general useful OS related definitions or wrappers. \ No newline at end of file diff --git a/Sources/ContainerizationOS/Reaper.swift b/Sources/ContainerizationOS/Reaper.swift new file mode 100644 index 0000000..84a31db --- /dev/null +++ b/Sources/ContainerizationOS/Reaper.swift @@ -0,0 +1,60 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#endif +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// A process reaper that returns exited processes along +/// with their exit status. +public struct Reaper { + /// Process's pid and exit status. + typealias Exit = (pid: Int32, status: Int32) + + /// Reap all pending processes and return the pid and exit status. + public static func reap() -> [Int32: Int32] { + var reaped = [Int32: Int32]() + while true { + guard let exit = wait() else { + return reaped + } + reaped[exit.pid] = exit.status + } + return reaped + } + + /// Returns the exit status of the last process that exited. + /// nil is returned when no pending processes exist. + private static func wait() -> Exit? { + var rus = rusage() + var ws = Int32() + + let pid = wait4(-1, &ws, WNOHANG, &rus) + if pid <= 0 { + return nil + } + return (pid: pid, status: Command.toExitStatus(ws)) + } +} diff --git a/Sources/ContainerizationOS/Socket/BidirectionalRelay.swift b/Sources/ContainerizationOS/Socket/BidirectionalRelay.swift new file mode 100644 index 0000000..649a212 --- /dev/null +++ b/Sources/ContainerizationOS/Socket/BidirectionalRelay.swift @@ -0,0 +1,419 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Dispatch +import Logging +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#endif + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// Manages bidirectional data relay between two file descriptors using `DispatchSource`. +/// +/// Uses non-blocking I/O with backpressure: when a destination fd's buffer is full, +/// the relay suspends reading from the source and installs a `DispatchSourceWrite` +/// to resume once the destination is writable again. This prevents blocking the +/// dispatch queue and avoids head-of-line blocking across connections. +/// +/// ## Concurrency model +/// +/// The class has two distinct synchronization domains: +/// +/// - **Serial dispatch queue** — owns all I/O state: the `Direction` objects (`d1`, `d2`) +/// and their read buffers (`buf1`, `buf2`). Every event handler, cancel handler, and +/// `stop()` call runs on this queue. No locks are needed for that state because the +/// queue is the exclusive executor. Fields in this domain are marked `nonisolated(unsafe)`. +/// +/// - **Mutexes** — protect the two pieces of state that cross the queue boundary: +/// `activeDirections` (written by `start()`, which may run off-queue) and +/// `completionState` (read by `waitForCompletion()` from any async context). +public final class BidirectionalRelay: Sendable { + private let fd1: Int32 + private let fd2: Int32 + private let log: Logger? + private let queue: DispatchQueue + private static let queueKey = DispatchSpecificKey() + + /// Owns one direction of the relay: its read source, optional write source, and + /// any data buffered due to backpressure. + /// + /// All methods must be called only from the relay's serial dispatch queue. + private final class Direction { + var readSource: DispatchSourceRead? + var writeSource: DispatchSourceWrite? + var pendingData: [UInt8] = [] + var pendingOffset: Int = 0 + private var readSuspended = false + + func suspendRead() { + guard let src = readSource, !src.isCancelled, !readSuspended else { return } + readSuspended = true + src.suspend() + } + + func resumeRead() { + guard let src = readSource, !src.isCancelled, readSuspended else { return } + readSuspended = false + src.resume() + } + + /// Resumes the read source before cancelling it if it is suspended. + /// GCD does not deliver a cancel handler for a suspended source until it is resumed. + func cancelRead() { + guard let src = readSource, !src.isCancelled else { return } + if readSuspended { + readSuspended = false + src.resume() + } + src.cancel() + } + } + + private enum CompletionState { + case pending + case waiting(CheckedContinuation) + case completed + } + + private enum CopyResult { + case ok + case blocked + case eof + } + + // Queue-owned state. Written by start() before activate(), so all subsequent + // accesses from event/cancel handlers observe the initialized values without + // additional synchronization. nonisolated(unsafe) declares that we are taking + // responsibility for this; the serial queue is the enforcing mechanism. + private nonisolated(unsafe) let d1 = Direction() // fd1 → fd2 + private nonisolated(unsafe) let d2 = Direction() // fd2 → fd1 + private nonisolated(unsafe) let buf1: UnsafeMutableBufferPointer + private nonisolated(unsafe) let buf2: UnsafeMutableBufferPointer + + // Counts active read sources. Set to 2 in start() (possibly off-queue) and + // decremented in cancel handlers (always on the queue). The Mutex provides the + // cross-thread visibility guarantee for the initial write from start(). Whichever + // cancel handler drives the count to zero calls closeBothFds() exactly once — + // no cross-source isCancelled checks, no possibility of double-close. + private let activeDirections: Mutex + + // May be read from any async context (waitForCompletion) and written from the + // queue (closeBothFds), so it needs a Mutex rather than queue-only protection. + private let completionState: Mutex + + /// Creates a new bidirectional relay between two file descriptors. + /// + /// - Parameters: + /// - fd1: The first file descriptor. + /// - fd2: The second file descriptor. + /// - queue: The dispatch queue to use for I/O operations. If nil, a new queue is created. + /// - log: The optional logger for debugging. + public init( + fd1: Int32, + fd2: Int32, + queue: DispatchQueue? = nil, + log: Logger? = nil + ) { + self.fd1 = fd1 + self.fd2 = fd2 + self.queue = queue ?? DispatchQueue(label: "com.apple.containerization.bidirectional-relay") + self.queue.setSpecific(key: Self.queueKey, value: ()) + self.log = log + self.activeDirections = Mutex(0) + self.completionState = Mutex(.pending) + + let pageSize = Int(getpagesize()) + self.buf1 = UnsafeMutableBufferPointer.allocate(capacity: pageSize) + self.buf2 = UnsafeMutableBufferPointer.allocate(capacity: pageSize) + } + + deinit { + buf1.deallocate() + buf2.deallocate() + } + + private static func setNonBlocking(_ fd: Int32) throws { + let flags = fcntl(fd, F_GETFL) + guard flags != -1 else { + throw ContainerizationError( + .internalError, + message: "fcntl F_GETFL failed on fd \(fd): errno \(errno)" + ) + } + guard fcntl(fd, F_SETFL, flags | O_NONBLOCK) != -1 else { + throw ContainerizationError( + .internalError, + message: "fcntl F_SETFL O_NONBLOCK failed on fd \(fd): errno \(errno)" + ) + } + } + + /// Starts the bidirectional relay to copy data between fd1 and fd2. + public func start() throws { + try Self.setNonBlocking(fd1) + try Self.setNonBlocking(fd2) + + let src1 = DispatchSource.makeReadSource(fileDescriptor: fd1, queue: queue) + let src2 = DispatchSource.makeReadSource(fileDescriptor: fd2, queue: queue) + d1.readSource = src1 + d2.readSource = src2 + activeDirections.withLock { $0 = 2 } + + src1.setEventHandler { [self] in handleRead(d1, from: fd1, to: fd2, buffer: buf1) } + src2.setEventHandler { [self] in handleRead(d2, from: fd2, to: fd1, buffer: buf2) } + + src1.setCancelHandler { [self] in + d1.writeSource?.cancel() + d1.writeSource = nil + directionFinished() + } + src2.setCancelHandler { [self] in + d2.writeSource?.cancel() + d2.writeSource = nil + directionFinished() + } + + src1.activate() + src2.activate() + } + + /// Stops the relay and closes both file descriptors. + public func stop() { + runOnQueue { + d1.cancelRead() + d2.cancelRead() + } + } + + /// Waits for the relay to complete. + public func waitForCompletion() async { + await withCheckedContinuation { c in + completionState.withLock { state in + switch state { + case .pending: + state = .waiting(c) + case .waiting: + fatalError("waitForCompletion called multiple times") + case .completed: + c.resume() + } + } + } + } + + private func runOnQueue(_ work: () -> Void) { + if DispatchQueue.getSpecific(key: Self.queueKey) != nil { + work() + } else { + queue.sync(execute: work) + } + } + + private func directionFinished() { + let remaining = activeDirections.withLock { count -> Int in + count -= 1 + return count + } + if remaining == 0 { + closeBothFds() + } + } + + private func handleRead( + _ dir: Direction, + from srcFd: Int32, + to dstFd: Int32, + buffer: UnsafeMutableBufferPointer + ) { + do { + switch try Self.copy(buffer: buffer, from: srcFd, to: dstFd, direction: dir) { + case .ok: + break + + case .eof: + log?.debug( + "source EOF", + metadata: ["sourceFd": "\(srcFd)", "destinationFd": "\(dstFd)"] + ) + dir.cancelRead() + if shutdown(dstFd, Int32(SHUT_WR)) != 0 { + log?.debug( + "shutdown(SHUT_WR) failed", + metadata: ["fd": "\(dstFd)", "errno": "\(errno)"] + ) + } + + case .blocked: + log?.debug( + "write blocked, applying backpressure", + metadata: [ + "sourceFd": "\(srcFd)", + "destinationFd": "\(dstFd)", + "pendingBytes": "\(dir.pendingData.count)", + ] + ) + dir.suspendRead() + installWriteSource(for: dir, from: srcFd, to: dstFd) + } + } catch { + log?.warning( + "I/O error", + metadata: [ + "sourceFd": "\(srcFd)", + "destinationFd": "\(dstFd)", + "error": "\(error)", + ] + ) + dir.cancelRead() + if shutdown(dstFd, Int32(SHUT_RDWR)) != 0 { + log?.warning( + "shutdown(SHUT_RDWR) failed", + metadata: ["fd": "\(dstFd)", "errno": "\(errno)"] + ) + } + } + } + + private func installWriteSource(for dir: Direction, from srcFd: Int32, to dstFd: Int32) { + let ws = DispatchSource.makeWriteSource(fileDescriptor: dstFd, queue: queue) + dir.writeSource = ws + ws.setEventHandler { [self] in drainPending(dir: dir, from: srcFd, to: dstFd) } + // No cancel handler: clearing pendingData from a cancel handler would race with + // a newly installed write source if drainPending completes and the read source + // immediately produces another blocked write, installing a fresh write source + // before the old cancel handler fires. pendingData is cleared explicitly by + // drainPending on success, and freed with Direction when the relay is torn down. + ws.activate() + } + + private func drainPending(dir: Direction, from srcFd: Int32, to dstFd: Int32) { + let remaining = dir.pendingData.count - dir.pendingOffset + guard remaining > 0 else { return } + + let n = dir.pendingData.withUnsafeBufferPointer { buf in + write(dstFd, buf.baseAddress!.advanced(by: dir.pendingOffset), remaining) + } + + if n > 0 { + dir.pendingOffset += n + if dir.pendingOffset >= dir.pendingData.count { + dir.writeSource?.cancel() + dir.writeSource = nil + dir.pendingData = [] + dir.pendingOffset = 0 + log?.debug( + "backpressure relieved, resuming reads", + metadata: ["sourceFd": "\(srcFd)", "destinationFd": "\(dstFd)"] + ) + dir.resumeRead() + } + } else if n == -1 && errno == EAGAIN { + // Spurious write-ready notification; wait for the next one. + } else { + log?.warning( + "write error during pending drain", + metadata: ["destinationFd": "\(dstFd)", "errno": "\(errno)"] + ) + dir.writeSource?.cancel() + dir.writeSource = nil + dir.cancelRead() + if shutdown(dstFd, Int32(SHUT_RDWR)) != 0 { + log?.warning( + "shutdown(SHUT_RDWR) failed after drain error", + metadata: ["fd": "\(dstFd)", "errno": "\(errno)"] + ) + } + } + } + + /// Drains srcFd into dstFd in a loop until EAGAIN/EWOULDBLOCK or EOF. + /// + /// Looping until EAGAIN is required on Linux: libdispatch uses FIONREAD to decide + /// whether to fire the read event, so when the only remaining readable condition is + /// EOF (FIONREAD == 0), the event is suppressed. Reading in a loop here ensures we + /// observe read() == 0 on the same handler invocation that drained the last bytes. + private static func copy( + buffer: UnsafeMutableBufferPointer, + from srcFd: Int32, + to dstFd: Int32, + direction: Direction + ) throws -> CopyResult { + guard let base = buffer.baseAddress else { + throw ContainerizationError(.invalidState, message: "buffer has no base address") + } + + readLoop: while true { + let nr = read(srcFd, base, buffer.count) + if nr == 0 { return .eof } + if nr < 0 { + if errno == EAGAIN || errno == EWOULDBLOCK { return .ok } + if errno == EINTR { continue readLoop } + throw ContainerizationError( + .internalError, + message: "read failed: fd \(srcFd), errno \(errno)" + ) + } + + var offset = 0 + while offset < nr { + let nw = write(dstFd, base.advanced(by: offset), nr - offset) + if nw > 0 { + offset += nw + } else if nw < 0 { + if errno == EINTR { continue } + if errno == EAGAIN || errno == EWOULDBLOCK { + direction.pendingData = Array( + UnsafeBufferPointer(start: base.advanced(by: offset), count: nr - offset) + ) + direction.pendingOffset = 0 + return .blocked + } + throw ContainerizationError( + .internalError, + message: "write failed: fd \(dstFd), errno \(errno)" + ) + } else { + throw ContainerizationError( + .internalError, + message: "zero-byte write on fd \(dstFd)" + ) + } + } + } + } + + private func closeBothFds() { + log?.debug("closing fds", metadata: ["fd1": "\(fd1)", "fd2": "\(fd2)"]) + close(fd1) + close(fd2) + completionState.withLock { state in + if case .waiting(let c) = state { c.resume() } + state = .completed + } + } +} diff --git a/Sources/ContainerizationOS/Socket/Socket.swift b/Sources/ContainerizationOS/Socket/Socket.swift new file mode 100644 index 0000000..3c97d3b --- /dev/null +++ b/Sources/ContainerizationOS/Socket/Socket.swift @@ -0,0 +1,494 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim +import Foundation +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#else +#error("Socket not supported on this platform.") +#endif + +#if !os(Windows) +let sysFchmod = fchmod +let sysRead = read +let sysUnlink = unlink +let sysSend = send +let sysClose = close +let sysShutdown = shutdown +let sysBind = bind +let sysSocket = socket +let sysSetsockopt = setsockopt +let sysGetsockopt = getsockopt +let sysListen = listen +let sysAccept = accept +let sysConnect = connect +let sysIoctl: @convention(c) (CInt, CUnsignedLong, UnsafeMutableRawPointer) -> CInt = ioctl +let sysRecvmsg = recvmsg +#endif + +/// Thread-safe socket wrapper. +public final class Socket: Sendable { + public enum TimeoutOption { + case send + case receive + } + + public enum ShutdownOption { + case read + case write + case readWrite + } + + private enum SocketState { + case created + case connected + case listening + } + + private struct State { + let socketState: SocketState + let handle: FileHandle? + let type: SocketType + let acceptSource: DispatchSourceRead? + } + + private let _closeOnDeinit: Bool + private let _queue: DispatchQueue + + private let state: Mutex + + public var fileDescriptor: Int32 { + guard let handle = state.withLock({ $0.handle }) else { + return -1 + } + return handle.fileDescriptor + } + + public convenience init(type: SocketType, closeOnDeinit: Bool = true) throws { + let sockFD = sysSocket(type.domain, type.type, 0) + if sockFD < 0 { + throw SocketError.withErrno("failed to create socket: \(sockFD)", errno: errno) + } + self.init(fd: sockFD, type: type, closeOnDeinit: closeOnDeinit) + } + + init(fd: Int32, type: SocketType, closeOnDeinit: Bool) { + _queue = DispatchQueue(label: "com.apple.containerization.socket") + _closeOnDeinit = closeOnDeinit + let state = State( + socketState: .created, + handle: FileHandle(fileDescriptor: fd, closeOnDealloc: false), + type: type, + acceptSource: nil + ) + self.state = Mutex(state) + } + + /// Internal initializer for wrapping already-connected file descriptors (e.g., from socketpair) + /// Ideally we just get rid of the state machine in this class. Not sure how much value it provides.. + init(fd: Int32, type: SocketType, closeOnDeinit: Bool, connected: Bool) { + _queue = DispatchQueue(label: "com.apple.containerization.socket") + _closeOnDeinit = closeOnDeinit + let state = State( + socketState: connected ? .connected : .created, + handle: FileHandle(fileDescriptor: fd, closeOnDealloc: false), + type: type, + acceptSource: nil + ) + self.state = Mutex(state) + } + + deinit { + if _closeOnDeinit { + try? close() + } + } +} + +extension Socket { + static func errnoToError(msg: String) -> SocketError { + SocketError.withErrno("\(msg) (\(_errnoString(errno)))", errno: errno) + } + + public func connect() throws { + try state.withLock { currentState in + guard currentState.socketState == .created else { + throw SocketError.invalidOperationOnSocket("connect") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + + var res: Int32 = 0 + try currentState.type.withSockAddr { (ptr, length) in + res = Syscall.retrying { + sysConnect(handle.fileDescriptor, ptr, length) + } + } + + if res == -1 { + throw Socket.errnoToError(msg: "could not connect to socket \(currentState.type)") + } + + currentState = State( + socketState: .connected, + handle: handle, + type: currentState.type, + acceptSource: currentState.acceptSource + ) + } + } + + public func listen() throws { + try state.withLock { currentState in + guard currentState.socketState == .created else { + throw SocketError.invalidOperationOnSocket("listen") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + + try currentState.type.beforeBind(fd: handle.fileDescriptor) + + var rc: Int32 = 0 + try currentState.type.withSockAddr { (ptr, length) in + rc = sysBind(handle.fileDescriptor, ptr, length) + } + + if rc < 0 { + throw Socket.errnoToError(msg: "could not bind to \(currentState.type)") + } + + try currentState.type.beforeListen(fd: handle.fileDescriptor) + + if sysListen(handle.fileDescriptor, SOMAXCONN) < 0 { + throw Socket.errnoToError(msg: "listen failed on \(currentState.type)") + } + + currentState = State( + socketState: .listening, + handle: handle, + type: currentState.type, + acceptSource: currentState.acceptSource + ) + } + } + + public func close() throws { + try state.withLock { currentState in + guard let handle = currentState.handle else { + // Already closed. + return + } + + let acceptSource = currentState.acceptSource + + acceptSource?.cancel() + try handle.close() + + currentState = State( + socketState: currentState.socketState, + handle: nil, + type: currentState.type, + acceptSource: nil + ) + } + } + + public func write(data: any DataProtocol) throws -> Int { + let handle = try state.withLock { currentState in + guard currentState.socketState == .connected else { + throw SocketError.invalidOperationOnSocket("write") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + if data.isEmpty { + return 0 + } + + try handle.write(contentsOf: data) + return data.count + } + + public func acceptStream(closeOnDeinit: Bool = true) throws -> AsyncThrowingStream { + let source = try state.withLock { currentState -> DispatchSourceRead in + guard currentState.socketState == .listening else { + throw SocketError.invalidOperationOnSocket("accept") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + guard currentState.acceptSource == nil else { + throw SocketError.acceptStreamExists + } + + let source = DispatchSource.makeReadSource( + fileDescriptor: handle.fileDescriptor, + queue: _queue + ) + + currentState = State( + socketState: currentState.socketState, + handle: handle, + type: currentState.type, + acceptSource: source + ) + + return source + } + + return AsyncThrowingStream { cont in + source.setCancelHandler { + cont.finish() + } + source.setEventHandler(handler: { + if source.data == 0 { + source.cancel() + return + } + + do { + let connection = try self.accept(closeOnDeinit: closeOnDeinit) + cont.yield(connection) + } catch SocketError.closed { + source.cancel() + } catch { + cont.yield(with: .failure(error)) + source.cancel() + } + }) + source.activate() + } + } + + public func accept(closeOnDeinit: Bool = true) throws -> Socket { + let (handle, socketType) = try state.withLock { currentState in + guard currentState.socketState == .listening else { + throw SocketError.invalidOperationOnSocket("accept") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + return (handle, currentState.type) + } + + let (clientFD, newSocketType) = try socketType.accept(fd: handle.fileDescriptor) + return Socket( + fd: clientFD, + type: newSocketType, + closeOnDeinit: closeOnDeinit, + connected: true + ) + } + + /// Receive a file descriptor via SCM_RIGHTS control message. + /// This is commonly used for passing file descriptors between processes via Unix domain sockets. + public func receiveFileDescriptor() throws -> Int32 { + let handle = try state.withLock { currentState in + guard currentState.socketState == .connected else { + throw SocketError.invalidOperationOnSocket("receiveFileDescriptor") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + var msg = msghdr() + var iov = iovec() + var buf: UInt8 = 0 + + iov.iov_base = withUnsafeMutablePointer(to: &buf) { UnsafeMutableRawPointer($0) } + iov.iov_len = 1 + + msg.msg_iov = withUnsafeMutablePointer(to: &iov) { $0 } + msg.msg_iovlen = 1 + + var cmsgBuf = [UInt8](repeating: 0, count: Int(CZ_CMSG_SPACE(Int(MemoryLayout.size)))) + msg.msg_control = withUnsafeMutablePointer(to: &cmsgBuf[0]) { UnsafeMutableRawPointer($0) } + msg.msg_controllen = numericCast(cmsgBuf.count) + + let recvResult = withUnsafeMutablePointer(to: &msg) { msgPtr in + sysRecvmsg(handle.fileDescriptor, msgPtr, 0) + } + + guard recvResult >= 0 else { + throw Socket.errnoToError(msg: "recvmsg failed") + } + + // Extract file descriptor from control message + let cmsgPtr = withUnsafeMutablePointer(to: &msg) { CZ_CMSG_FIRSTHDR($0) } + guard let cmsg = cmsgPtr else { + throw SocketError.invalidFileDescriptor + } + + guard cmsg.pointee.cmsg_level == SOL_SOCKET, + cmsg.pointee.cmsg_type == SCM_RIGHTS + else { + throw SocketError.invalidFileDescriptor + } + + guard let dataPtr = CZ_CMSG_DATA(cmsg) else { + throw SocketError.invalidFileDescriptor + } + + let fdPtr = dataPtr.assumingMemoryBound(to: Int32.self) + let fd = fdPtr.pointee + guard fd >= 0 else { + throw SocketError.invalidFileDescriptor + } + + return fd + } + + public func read(buffer: inout Data) throws -> Int { + let handle = try state.withLock { currentState in + guard currentState.socketState == .connected else { + throw SocketError.invalidOperationOnSocket("read") + } + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + var bytesRead = 0 + let bufferSize = buffer.count + try buffer.withUnsafeMutableBytes { pointer in + guard let baseAddress = pointer.baseAddress else { + throw SocketError.missingBaseAddress + } + + bytesRead = Syscall.retrying { + sysRead(handle.fileDescriptor, baseAddress, bufferSize) + } + if bytesRead < 0 { + throw Socket.errnoToError(msg: "error reading from connection") + } else if bytesRead == 0 { + throw SocketError.closed + } + } + return bytesRead + } + + public func shutdown(how: ShutdownOption) throws { + let handle = try state.withLock { currentState in + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + var howOpt: Int32 = 0 + switch how { + case .read: + howOpt = Int32(SHUT_RD) + case .write: + howOpt = Int32(SHUT_WR) + case .readWrite: + howOpt = Int32(SHUT_RDWR) + } + + if sysShutdown(handle.fileDescriptor, howOpt) < 0 { + throw Socket.errnoToError(msg: "shutdown failed") + } + } + + public func setSockOpt(sockOpt: Int32 = 0, ptr: UnsafeRawPointer, stride: UInt32) throws { + let handle = try state.withLock { currentState in + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + if setsockopt(handle.fileDescriptor, SOL_SOCKET, sockOpt, ptr, stride) < 0 { + throw Socket.errnoToError(msg: "failed to set sockopt") + } + } + + public func setTimeout(option: TimeoutOption, seconds: Int) throws { + let handle = try state.withLock { currentState in + guard let handle = currentState.handle else { + throw SocketError.closed + } + return handle + } + + var sockOpt: Int32 = 0 + switch option { + case .receive: + sockOpt = SO_RCVTIMEO + case .send: + sockOpt = SO_SNDTIMEO + } + + var timer = timeval() + timer.tv_sec = seconds + timer.tv_usec = 0 + + if setsockopt( + handle.fileDescriptor, + SOL_SOCKET, + sockOpt, + &timer, + socklen_t(MemoryLayout.size) + ) < 0 { + throw Socket.errnoToError(msg: "failed to set read timeout") + } + } + + static func _errnoString(_ err: Int32?) -> String { + String(validatingCString: strerror(errno)) ?? "error: \(errno)" + } +} + +public enum SocketError: Error, Equatable, CustomStringConvertible { + case closed + case acceptStreamExists + case invalidOperationOnSocket(String) + case missingBaseAddress + case withErrno(_ msg: String, errno: Int32) + case invalidFileDescriptor + + public var description: String { + switch self { + case .closed: + return "socket: closed" + case .acceptStreamExists: + return "accept stream already exists" + case .invalidOperationOnSocket(let operation): + return "socket: invalid operation on socket '\(operation)'" + case .missingBaseAddress: + return "socket: missing base address" + case .withErrno(let msg, _): + return "socket: error \(msg)" + case .invalidFileDescriptor: + return "socket: invalid file descriptor received" + } + } +} diff --git a/Sources/ContainerizationOS/Socket/SocketType.swift b/Sources/ContainerizationOS/Socket/SocketType.swift new file mode 100644 index 0000000..acc05f6 --- /dev/null +++ b/Sources/ContainerizationOS/Socket/SocketType.swift @@ -0,0 +1,48 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#else +#error("SocketType not supported on this platform.") +#endif + +/// Protocol used to describe the family of socket to be created with `Socket`. +public protocol SocketType: Sendable, CustomStringConvertible { + /// The domain for the socket (AF_UNIX, AF_VSOCK etc.) + var domain: Int32 { get } + /// The type of socket (SOCK_STREAM). + var type: Int32 { get } + + /// Actions to perform before calling bind(2). + func beforeBind(fd: Int32) throws + /// Actions to perform before calling listen(2). + func beforeListen(fd: Int32) throws + + /// Handle accept(2) for an implementation of a socket type. + func accept(fd: Int32) throws -> (Int32, SocketType) + /// Provide a sockaddr pointer (by casting a socket specific type like sockaddr_un for example). + func withSockAddr(_ closure: (_ ptr: UnsafePointer, _ len: UInt32) throws -> Void) throws +} + +extension SocketType { + public func beforeBind(fd: Int32) {} + public func beforeListen(fd: Int32) {} +} diff --git a/Sources/ContainerizationOS/Socket/UnixType.swift b/Sources/ContainerizationOS/Socket/UnixType.swift new file mode 100644 index 0000000..b05fb77 --- /dev/null +++ b/Sources/ContainerizationOS/Socket/UnixType.swift @@ -0,0 +1,160 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +let _SOCK_STREAM = SOCK_STREAM +#elseif canImport(Glibc) +import Glibc +let _SOCK_STREAM = Int32(SOCK_STREAM.rawValue) +#elseif canImport(Darwin) +import Darwin +let _SOCK_STREAM = SOCK_STREAM +#else +#error("UnixType not supported on this platform.") +#endif + +/// Unix domain socket variant of `SocketType`. +public struct UnixType: SocketType, Sendable, CustomStringConvertible { + public var domain: Int32 { AF_UNIX } + public var type: Int32 { _SOCK_STREAM } + public var description: String { + path + } + + public let path: String + public let perms: mode_t? + private let _addr: sockaddr_un + private let _unlinkExisting: Bool + + private init(sockaddr: sockaddr_un) { + let pathname: String = withUnsafePointer(to: sockaddr.sun_path) { ptr in + let charPtr = UnsafeRawPointer(ptr).assumingMemoryBound(to: CChar.self) + return String(cString: charPtr) + } + self._addr = sockaddr + self.path = pathname + self._unlinkExisting = false + self.perms = nil + } + + /// Mode and unlinkExisting only used if the socket is going to be a listening socket. + public init( + path: String, + perms: mode_t? = nil, + unlinkExisting: Bool = false + ) throws { + self.path = path + self.perms = perms + self._unlinkExisting = unlinkExisting + var addr = sockaddr_un() + addr.sun_family = sa_family_t(AF_UNIX) + + let socketName = path + let nameLength = socketName.utf8.count + + #if os(macOS) + // Funnily enough, this isn't limited by sun path on macOS even though + // it's stated as so. + let lengthLimit = 253 + #elseif os(Linux) + let lengthLimit = MemoryLayout.size(ofValue: addr.sun_path) + #endif + + guard nameLength < lengthLimit else { + throw Error.nameTooLong(path) + } + + _ = withUnsafeMutablePointer(to: &addr.sun_path.0) { ptr in + socketName.withCString { strncpy(ptr, $0, nameLength) } + } + + #if os(macOS) + addr.sun_len = UInt8(MemoryLayout.size + MemoryLayout.size + socketName.utf8.count + 1) + #endif + self._addr = addr + } + + public func accept(fd: Int32) throws -> (Int32, SocketType) { + var clientFD: Int32 = -1 + var addr = sockaddr_un() + + clientFD = Syscall.retrying { + var size = socklen_t(MemoryLayout.stride) + return withUnsafeMutablePointer(to: &addr) { pointer in + pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { pointer in + sysAccept(fd, pointer, &size) + } + } + } + if clientFD < 0 { + throw Socket.errnoToError(msg: "accept failed") + } + + return (clientFD, UnixType(sockaddr: addr)) + } + + public func beforeBind(fd: Int32) throws { + #if os(Linux) + // Only Linux supports setting the mode of a socket before binding. + if let perms = self.perms { + guard fchmod(fd, perms) == 0 else { + throw Socket.errnoToError(msg: "fchmod failed") + } + } + #endif + + var rc: Int32 = 0 + if self._unlinkExisting { + rc = sysUnlink(self.path) + if rc != 0 && errno != ENOENT { + throw Socket.errnoToError(msg: "failed to remove old socket at \(self.path)") + } + } + } + + public func beforeListen(fd: Int32) throws { + #if os(macOS) + if let perms = self.perms { + guard chmod(self.path, perms) == 0 else { + throw Socket.errnoToError(msg: "chmod failed") + } + } + #endif + } + + public func withSockAddr(_ closure: (UnsafePointer, UInt32) throws -> Void) throws { + var addr = self._addr + try withUnsafePointer(to: &addr) { + let addrBytes = UnsafeRawPointer($0).assumingMemoryBound(to: sockaddr.self) + try closure(addrBytes, UInt32(MemoryLayout.stride)) + } + } +} + +extension UnixType { + /// `UnixType` errors. + public enum Error: Swift.Error, CustomStringConvertible { + case nameTooLong(_: String) + + public var description: String { + switch self { + case .nameTooLong(let name): + return "\(name) is too long for a Unix Domain Socket path" + } + } + } +} diff --git a/Sources/ContainerizationOS/Socket/VsockType.swift b/Sources/ContainerizationOS/Socket/VsockType.swift new file mode 100644 index 0000000..f819881 --- /dev/null +++ b/Sources/ContainerizationOS/Socket/VsockType.swift @@ -0,0 +1,108 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#else +#error("VsockType not supported on this platform.") +#endif + +/// Vsock variant of `SocketType`. +public struct VsockType: SocketType, Sendable { + public var domain: Int32 { AF_VSOCK } + public var type: Int32 { _SOCK_STREAM } + public var description: String { + "\(cid):\(port)" + } + + public static let anyCID: UInt32 = UInt32(bitPattern: -1) + public static let hypervisorCID: UInt32 = 0x0 + // Supported on Linux 5.6+; otherwise, will need to use getLocalCID(). + public static let localCID: UInt32 = 0x1 + public static let hostCID: UInt32 = 0x2 + + // socketFD is unused on Linux. + public static func getLocalCID(socketFD: Int32) throws -> UInt32 { + let request = VsockLocalCIDIoctl + #if os(Linux) + let fd = open("/dev/vsock", O_RDONLY | O_CLOEXEC) + if fd == -1 { + throw Socket.errnoToError(msg: "failed to open /dev/vsock") + } + defer { close(fd) } + #else + let fd = socketFD + #endif + var cid: UInt32 = 0 + guard sysIoctl(fd, numericCast(request), &cid) != -1 else { + throw Socket.errnoToError(msg: "failed to get local cid") + } + return cid + } + + public let port: UInt32 + public let cid: UInt32 + + private let _addr: sockaddr_vm + + public init(port: UInt32, cid: UInt32) { + self.cid = cid + self.port = port + var sockaddr = sockaddr_vm() + sockaddr.svm_family = sa_family_t(AF_VSOCK) + sockaddr.svm_cid = cid + sockaddr.svm_port = port + self._addr = sockaddr + } + + private init(sockaddr: sockaddr_vm) { + self._addr = sockaddr + self.cid = sockaddr.svm_cid + self.port = sockaddr.svm_port + } + + public func accept(fd: Int32) throws -> (Int32, SocketType) { + var clientFD: Int32 = -1 + var addr = sockaddr_vm() + + while clientFD < 0 { + var size = socklen_t(MemoryLayout.stride) + clientFD = withUnsafeMutablePointer(to: &addr) { pointer in + pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { pointer in + sysAccept(fd, pointer, &size) + } + } + if clientFD < 0 && errno != EINTR { + throw Socket.errnoToError(msg: "accept failed") + } + } + return (clientFD, VsockType(sockaddr: addr)) + } + + public func withSockAddr(_ closure: (UnsafePointer, UInt32) throws -> Void) throws { + var addr = self._addr + try withUnsafePointer(to: &addr) { + let addrBytes = UnsafeRawPointer($0).assumingMemoryBound(to: sockaddr.self) + try closure(addrBytes, UInt32(MemoryLayout.stride)) + } + } +} diff --git a/Sources/ContainerizationOS/Stat.swift b/Sources/ContainerizationOS/Stat.swift new file mode 100644 index 0000000..df9590a --- /dev/null +++ b/Sources/ContainerizationOS/Stat.swift @@ -0,0 +1,88 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A timestamp with second and nanosecond precision. +public struct TimeSpec: Sendable, Hashable { + /// Seconds since the Unix epoch. + public var seconds: Int64 + /// Nanoseconds past the second. + public var nanoseconds: Int32 + + public init(seconds: Int64, nanoseconds: Int32) { + self.seconds = seconds + self.nanoseconds = nanoseconds + } +} + +/// File metadata returned by a `stat` call. +public struct Stat: Sendable, Hashable { + /// ID of device containing file (`st_dev`). + public var dev: UInt64 + /// Inode number (`st_ino`). + public var ino: UInt64 + /// File type and mode (`st_mode`). + public var mode: UInt32 + /// Number of hard links (`st_nlink`). + public var nlink: UInt64 + /// User ID of owner (`st_uid`). + public var uid: UInt32 + /// Group ID of owner (`st_gid`). + public var gid: UInt32 + /// Device ID, if special file (`st_rdev`). + public var rdev: UInt64 + /// Total size in bytes (`st_size`). + public var size: Int64 + /// Preferred I/O block size (`st_blksize`). + public var blksize: Int64 + /// Number of 512-byte blocks allocated (`st_blocks`). + public var blocks: Int64 + /// Time of last access (`st_atim`). + public var atime: TimeSpec + /// Time of last modification (`st_mtim`). + public var mtime: TimeSpec + /// Time of last status change (`st_ctim`). + public var ctime: TimeSpec + + public init( + dev: UInt64, + ino: UInt64, + mode: UInt32, + nlink: UInt64, + uid: UInt32, + gid: UInt32, + rdev: UInt64, + size: Int64, + blksize: Int64, + blocks: Int64, + atime: TimeSpec, + mtime: TimeSpec, + ctime: TimeSpec + ) { + self.dev = dev + self.ino = ino + self.mode = mode + self.nlink = nlink + self.uid = uid + self.gid = gid + self.rdev = rdev + self.size = size + self.blksize = blksize + self.blocks = blocks + self.atime = atime + self.mtime = mtime + self.ctime = ctime + } +} diff --git a/Sources/ContainerizationOS/Syscall.swift b/Sources/ContainerizationOS/Syscall.swift new file mode 100644 index 0000000..097f314 --- /dev/null +++ b/Sources/ContainerizationOS/Syscall.swift @@ -0,0 +1,39 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#else +#error("retryingSyscall not supported on this platform.") +#endif + +/// Helper type to deal with running system calls. +public struct Syscall { + /// Retry a syscall on EINTR. + public static func retrying(_ closure: () -> T) -> T { + while true { + let res = closure() + if res == -1 && errno == EINTR { + continue + } + return res + } + } +} diff --git a/Sources/ContainerizationOS/Sysctl.swift b/Sources/ContainerizationOS/Sysctl.swift new file mode 100644 index 0000000..7a265f5 --- /dev/null +++ b/Sources/ContainerizationOS/Sysctl.swift @@ -0,0 +1,39 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(Darwin) +import Darwin +#endif +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// Helper type to deal with system control functionalities. +public struct Sysctl { + #if os(macOS) + /// Simple `sysctlbyname` wrapper. + public static func byName(_ name: String) throws -> Int64 { + var num: Int64 = 0 + var size = MemoryLayout.size + if sysctlbyname(name, &num, &size, nil, 0) != 0 { + throw POSIXError.fromErrno() + } + return num + } + #endif +} diff --git a/Sources/ContainerizationOS/Terminal.swift b/Sources/ContainerizationOS/Terminal.swift new file mode 100644 index 0000000..8522b7c --- /dev/null +++ b/Sources/ContainerizationOS/Terminal.swift @@ -0,0 +1,209 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// `Terminal` provides a clean interface to deal with terminal interactions on Unix platforms. +public struct Terminal: Sendable { + private let initState: termios? + + private var descriptor: Int32 { + handle.fileDescriptor + } + public let handle: FileHandle + + public init(descriptor: Int32, setInitState: Bool = true) throws { + if setInitState { + self.initState = try Self.getattr(descriptor) + } else { + initState = nil + } + self.handle = .init(fileDescriptor: descriptor, closeOnDealloc: false) + } + + /// Write the provided data to the tty device. + public func write(_ data: Data) throws { + try handle.write(contentsOf: data) + } + + /// The winsize for a pty. + public struct Size: Sendable { + let size: winsize + + /// The width or `col` of the pty. + public var width: UInt16 { + size.ws_col + } + /// The height or `rows` of the pty. + public var height: UInt16 { + size.ws_row + } + + init(_ size: winsize) { + self.size = size + } + + /// Set the size for use with a pty. + public init(width cols: UInt16, height rows: UInt16) { + self.size = winsize(ws_row: rows, ws_col: cols, ws_xpixel: 0, ws_ypixel: 0) + } + } + + /// Return the current pty attached to any of the STDIO descriptors. + public static var current: Terminal { + get throws { + for i in [STDERR_FILENO, STDOUT_FILENO, STDIN_FILENO] { + do { + return try Terminal(descriptor: i) + } catch {} + } + throw Error.notAPty + } + } + + /// The current window size for the pty. + public var size: Size { + get throws { + var ws = winsize() + try fromSyscall(ioctl(descriptor, UInt(TIOCGWINSZ), &ws)) + return Size(ws) + } + } + + /// Create a new pty pair. + /// - Parameter initialSize: An initial size of the child pty. + public static func create(initialSize: Size? = nil) throws -> (parent: Terminal, child: Terminal) { + var parent: Int32 = 0 + var child: Int32 = 0 + let size = initialSize ?? Size(width: 120, height: 40) + var ws = size.size + + try fromSyscall(openpty(&parent, &child, nil, nil, &ws)) + return ( + parent: try Terminal(descriptor: parent, setInitState: false), + child: try Terminal(descriptor: child, setInitState: false) + ) + } +} + +// MARK: Errors + +extension Terminal { + public enum Error: Swift.Error, CustomStringConvertible { + case notAPty + + public var description: String { + switch self { + case .notAPty: + return "the provided fd is not a pty" + } + } + } +} + +extension Terminal { + /// Resize the current pty from the size of the provided pty. + /// - Parameter pty: A pty to resize from. + public func resize(from pty: Terminal) throws { + var ws = try pty.size + try fromSyscall(ioctl(descriptor, UInt(TIOCSWINSZ), &ws)) + } + + /// Resize the pty to the provided window size. + /// - Parameter size: A window size for a pty. + public func resize(size: Size) throws { + var ws = size.size + try fromSyscall(ioctl(descriptor, UInt(TIOCSWINSZ), &ws)) + } + + /// Resize the pty to the provided window size. + /// - Parameter width: A width or cols of the terminal. + /// - Parameter height: A height or rows of the terminal. + public func resize(width: UInt16, height: UInt16) throws { + var ws = Size(width: width, height: height) + try fromSyscall(ioctl(descriptor, UInt(TIOCSWINSZ), &ws)) + } +} + +extension Terminal { + /// Enable raw mode for the pty. + public func setraw() throws { + var attr = try Self.getattr(descriptor) + cfmakeraw(&attr) + attr.c_oflag = attr.c_oflag | tcflag_t(OPOST) + try fromSyscall(tcsetattr(descriptor, TCSANOW, &attr)) + } + + /// Enable echo support. + /// Chars typed will be displayed to the terminal. + public func enableEcho() throws { + var attr = try Self.getattr(descriptor) + attr.c_iflag &= ~tcflag_t(ICRNL) + attr.c_lflag &= ~tcflag_t(ICANON | ECHO) + try fromSyscall(tcsetattr(descriptor, TCSANOW, &attr)) + } + + /// Disable echo support. + /// Chars typed will not be displayed back to the terminal. + public func disableEcho() throws { + var attr = try Self.getattr(descriptor) + attr.c_lflag &= ~tcflag_t(ECHO) + try fromSyscall(tcsetattr(descriptor, TCSANOW, &attr)) + } + + private static func getattr(_ fd: Int32) throws -> termios { + var attr = termios() + try fromSyscall(tcgetattr(fd, &attr)) + return attr + } +} + +// MARK: Reset + +extension Terminal { + /// Close this pty's file descriptor. + public func close() throws { + do { + // Use FileHandle's close directly as it sets the underlying fd in the object + // to -1 for us. + try self.handle.close() + } catch { + if let error = error as NSError?, error.domain == NSPOSIXErrorDomain { + throw POSIXError(.init(rawValue: Int32(error.code))!) + } + throw error + } + } + + /// Reset the pty to its initial state. + public func reset() throws { + if var attr = initState { + try fromSyscall(tcsetattr(descriptor, TCSANOW, &attr)) + } + } + + /// Reset the pty to its initial state masking any errors. + /// This is commonly used in a `defer` body to reset the current pty where the error code is not generally useful. + public func tryReset() { + try? reset() + } +} + +private func fromSyscall(_ status: Int32) throws { + guard status == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } +} diff --git a/Sources/ContainerizationOS/URL+Extensions.swift b/Sources/ContainerizationOS/URL+Extensions.swift new file mode 100644 index 0000000..a5c6331 --- /dev/null +++ b/Sources/ContainerizationOS/URL+Extensions.swift @@ -0,0 +1,71 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Darwin) +import Darwin +#endif + +/// The `resolvingSymlinksInPath` method of the `URL` struct does not resolve the symlinks +/// for directories under `/private` which include`tmp`, `var` and `etc` +/// hence adding a method to build up on the existing `resolvingSymlinksInPath` that prepends `/private` to those paths +extension URL { + /// returns the unescaped absolutePath of a URL joined by separator + func absolutePath(_ separator: String = "/") -> String { + self.pathComponents + .joined(separator: separator) + .dropFirst("/".count) + .description + } + + public func resolvingSymlinksInPathWithPrivate() -> URL { + let url = self.resolvingSymlinksInPath() + #if os(macOS) + let parts = url.pathComponents + if parts.count > 1 { + if (parts.first == "/") && ["tmp", "var", "etc"].contains(parts[1]) { + var resolved = URL(filePath: "/private") + for part in parts[1...] { + resolved.append(path: part) + } + return resolved + } + } + #endif + return url + } + + public var isDirectory: Bool { + var st = stat() + guard stat(self.path, &st) == 0 else { return false } + return (st.st_mode & S_IFMT) == S_IFDIR + } + + public var isSymlink: Bool { + var st = stat() + guard lstat(self.path, &st) == 0 else { return false } + return (st.st_mode & S_IFMT) == S_IFLNK + } +} diff --git a/Sources/ContainerizationOS/User.swift b/Sources/ContainerizationOS/User.swift new file mode 100644 index 0000000..b76098a --- /dev/null +++ b/Sources/ContainerizationOS/User.swift @@ -0,0 +1,284 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError + +#if canImport(FoundationEssentials) +import FoundationEssentials +#else +import Foundation +#endif + +/// `User` provides utilities to ensure that a given username exists in +/// /etc/passwd (and /etc/group). Largely inspired by runc (and moby's) +/// `user` packages. +public enum User { + public static let passwdFilePath = URL(filePath: "/etc/passwd") + public static let groupFilePath = URL(filePath: "/etc/group") + + private static let minID: UInt32 = 0 + private static let maxID: UInt32 = 2_147_483_647 + + public struct ExecUser: Sendable { + public var uid: UInt32 + public var gid: UInt32 + public var sgids: [UInt32] + public var home: String + public var shell: String + + public init(uid: UInt32, gid: UInt32, sgids: [UInt32], home: String, shell: String) { + self.uid = uid + self.gid = gid + self.sgids = sgids + self.home = home + self.shell = shell + } + } + + public struct User { + public var name: String + public var password: String + public var uid: UInt32 + public var gid: UInt32 + public var gecos: String + public var home: String + public var shell: String + + /// The argument `rawString` must follow the below format. + /// Name:Password:Uid:Gid:Gecos:Home:Shell + init(rawString: String) throws { + let args = rawString.split(separator: ":", omittingEmptySubsequences: false) + guard args.count == 7 else { + throw Error.parseError("cannot parse User from '\(rawString)'") + } + guard let uid = UInt32(args[2]) else { + throw Error.parseError("cannot parse uid from '\(args[2])'") + } + guard let gid = UInt32(args[3]) else { + throw Error.parseError("cannot parse gid from '\(args[3])'") + } + self.name = String(args[0]) + self.password = String(args[1]) + self.uid = uid + self.gid = gid + self.gecos = String(args[4]) + self.home = String(args[5]) + self.shell = String(args[6]) + } + } + + struct Group { + var name: String + var password: String + var gid: UInt32 + var users: [String] + + /// The argument `rawString` must follow the below format. + /// Name:Password:Gid:user1,user2 + init(rawString: String) throws { + let args = rawString.split(separator: ":", omittingEmptySubsequences: false) + guard args.count == 4 else { + throw Error.parseError("cannot parse Group from '\(rawString)'") + } + guard let gid = UInt32(args[2]) else { + throw Error.parseError("cannot parse gid from '\(args[2])'") + } + self.name = String(args[0]) + self.password = String(args[1]) + self.gid = gid + self.users = args[3].split(separator: ",").map { String($0) } + } + } +} + +// MARK: Private methods + +extension User { + private static func parse(file: URL, handler: (_ line: String) throws -> Void) throws { + let fm = FileManager.default + guard fm.fileExists(atPath: file.absolutePath()) else { + throw Error.missingFile(file.absolutePath()) + } + let content = try String(contentsOf: file, encoding: .ascii) + let lines = content.components(separatedBy: .newlines) + for line in lines { + let trimmed = line.trimmingCharacters(in: .whitespaces) + guard !trimmed.isEmpty else { + continue + } + guard !trimmed.hasPrefix("#") else { + continue + } + try handler(trimmed) + } + } + + /// Parse the contents of the passwd file with a provided filter function. + static func parsePasswd(passwdFile: URL, filter: ((User) -> Bool)? = nil) throws -> [User] { + var users: [User] = [] + try self.parse(file: passwdFile) { line in + let user = try User(rawString: line) + if let filter { + guard filter(user) else { + return + } + } + users.append(user) + } + return users + } + + /// Parse the contents of the group file with a provided filter function. + static func parseGroup(groupFile: URL, filter: ((Group) -> Bool)? = nil) throws -> [Group] { + var groups: [Group] = [] + try self.parse(file: groupFile) { line in + let group = try Group(rawString: line) + if let filter { + guard filter(group) else { + return + } + } + groups.append(group) + } + return groups + } +} + +// MARK: Public methods + +extension User { + /// Looks up uid in the password file specified by `passwdPath`. + public static func lookupUid(passwdPath: URL = Self.passwdFilePath, uid: UInt32) throws -> User { + let users = try parsePasswd( + passwdFile: passwdPath, + filter: { u in + u.uid == uid + }) + if users.count == 0 { + throw Error.noPasswdEntries + } + return users[0] + } + + /// Parses a user string in any of the following formats: + /// "user, uid, user:group, uid:gid, uid:group, user:gid" + /// and returns an ExecUser type from the information. + public static func getExecUser( + userString: String, + defaults: ExecUser? = nil, + passwdPath: URL = Self.passwdFilePath, + groupPath: URL = Self.groupFilePath + ) throws -> ExecUser { + let defaults = defaults ?? ExecUser(uid: 0, gid: 0, sgids: [], home: "/", shell: "") + + var user = ExecUser( + uid: defaults.uid, + gid: defaults.gid, + sgids: defaults.sgids, + home: defaults.home, + shell: defaults.shell + ) + + let parts = userString.split( + separator: ":", + maxSplits: 1, + omittingEmptySubsequences: false + ) + let userArg = parts.isEmpty ? "" : String(parts[0]) + let groupArg = parts.count > 1 ? String(parts[1]) : "" + + let uidArg = UInt32(userArg) + let notUID = uidArg == nil + let gidArg = UInt32(groupArg) + let notGID = gidArg == nil + + let users: [User] + do { + users = try parsePasswd(passwdFile: passwdPath) { u in + if userArg.isEmpty { + return u.uid == user.uid + } + if !notUID { + return uidArg! == u.uid + } + return u.name == userArg + } + } catch Error.missingFile { + users = [] + } + + var matchedUserName = "" + if !users.isEmpty { + let matchedUser = users[0] + matchedUserName = matchedUser.name + user.uid = matchedUser.uid + user.gid = matchedUser.gid + user.home = matchedUser.home + user.shell = matchedUser.shell + } else if !userArg.isEmpty { + if notUID { + throw Error.noPasswdEntries + } + + user.uid = uidArg! + if user.uid < minID || user.uid > maxID { + throw Error.range + } + } + + if !groupArg.isEmpty || !matchedUserName.isEmpty { + let groups: [Group] + do { + groups = try parseGroup(groupFile: groupPath) { g in + if groupArg.isEmpty { + return g.users.contains(matchedUserName) + } + if !notGID { + return gidArg! == g.gid + } + return g.name == groupArg + } + } catch Error.missingFile { + groups = [] + } + + if !groupArg.isEmpty { + if !groups.isEmpty { + user.gid = groups[0].gid + } else { + if notGID { + throw Error.noGroupEntries + } + + user.gid = gidArg! + if user.gid < minID || user.gid > maxID { + throw Error.range + } + } + } + user.sgids = groups.map { $0.gid } + } + return user + } + + public enum Error: Swift.Error { + case missingFile(String) + case range + case noPasswdEntries + case noGroupEntries + case parseError(String) + } +} diff --git a/Sources/Integration/ContainerTests.swift b/Sources/Integration/ContainerTests.swift new file mode 100644 index 0000000..9c8edd8 --- /dev/null +++ b/Sources/Integration/ContainerTests.swift @@ -0,0 +1,5675 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationEXT4 +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Crypto +import Foundation +import Logging +import SystemPackage + +extension IntegrationSuite { + func testProcessTrue() async throws { + let id = "test-process-true" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/true"] + config.memoryInBytes = 250_000_000 + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + } + + func testProcessFalse() async throws { + let id = "test-process-false" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/false"] + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 1 else { + throw IntegrationError.assert(msg: "process status \(status) != 1") + } + } + + final class DiscardingWriter: @unchecked Sendable, Writer { + var count: Int = 0 + + func write(_ data: Data) throws { + count += data.count + } + + func close() throws { + return + } + } + + final class BufferWriter: Writer { + // `data` isn't used concurrently. + nonisolated(unsafe) var data = Data() + + func write(_ data: Data) throws { + guard data.count > 0 else { + return + } + self.data.append(data) + } + + func close() throws { + return + } + } + + final class StdinBuffer: ReaderStream { + let data: Data + + init(data: Data) { + self.data = data + } + + func stream() -> AsyncStream { + let (stream, cont) = AsyncStream.makeStream() + cont.yield(self.data) + cont.finish() + return stream + } + } + + final class ChunkedStdinBuffer: ReaderStream { + let chunks: [Data] + let delayMs: Int + + init(chunks: [Data], delayMs: Int = 0) { + self.chunks = chunks + self.delayMs = delayMs + } + + func stream() -> AsyncStream { + let chunks = self.chunks + let delayMs = self.delayMs + return AsyncStream { cont in + Task { + for chunk in chunks { + if delayMs > 0 { + try? await Task.sleep(for: .milliseconds(delayMs)) + } + cont.yield(chunk) + } + cont.finish() + } + } + } + } + + func testProcessEchoHi() async throws { + let id = "test-process-echo-hi" + let bs = try await bootstrap(id) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/echo", "hi"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 1") + } + + guard String(data: buffer.data, encoding: .utf8) == "hi\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout 'hi' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testProcessNoExecutable() async throws { + let id = "test-process-no-executable" + let bs = try await bootstrap(id) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["foobarbaz"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let _ = try await container.wait() + try await container.stop() + + throw IntegrationError.assert(msg: "process didn't throw 'no executable' error") + } catch { + try? await container.stop() + guard let err = error as? ContainerizationError, + err.isCode(.internalError), err.description.contains("failed to find target executable") + else { + throw error + } + } + } + + func testMultipleConcurrentProcesses() async throws { + let id = "test-concurrent-processes" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + try await withThrowingTaskGroup(of: Void.self) { group in + for i in 0...80 { + let exec = try await container.exec("exec-\(i)") { config in + config.arguments = ["/bin/true"] + } + + group.addTask { + try await exec.start() + let status = try await exec.wait() + if status.exitCode != 0 { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + try await exec.delete() + } + } + + try await group.waitForAll() + + try await container.stop() + } + } catch { + throw error + } + } + + func testMultipleConcurrentProcessesOutputStress() async throws { + let id = "test-concurrent-processes-output-stress" + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let buffer = BufferWriter() + let exec = try await container.exec("expected-value") { config in + config.arguments = [ + "sh", + "-c", + "dd if=/dev/random of=/tmp/bytes bs=1M count=20 status=none ; sha256sum /tmp/bytes", + ] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + if status.exitCode != 0 { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8)! + let expected = String(output.split(separator: " ").first!) + try await withThrowingTaskGroup(of: Void.self) { group in + for i in 0...80 { + let idx = i + group.addTask { + let buffer = BufferWriter() + let exec = try await container.exec("exec-\(idx)") { config in + config.arguments = ["cat", "/tmp/bytes"] + config.stdout = buffer + } + try await exec.start() + + let status = try await exec.wait() + if status.exitCode != 0 { + throw IntegrationError.assert(msg: "process \(idx) status \(status) != 0") + } + + var hasher = SHA256() + hasher.update(data: buffer.data) + let hash = hasher.finalize().digestString.trimmingDigestPrefix + guard hash == expected else { + throw IntegrationError.assert( + msg: "process \(idx) output \(hash) != expected \(expected)") + } + try await exec.delete() + } + } + + try await group.waitForAll() + } + try await exec.delete() + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } + } + + func testProcessUser() async throws { + let id = "test-process-user" + + let bs = try await bootstrap(id) + var buffer = BufferWriter() + var container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/usr/bin/id"] + config.process.user = .init(uid: 1, gid: 1, additionalGids: [1]) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + var status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + var expected = "uid=1(bin) gid=1(bin) groups=1(bin)" + guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + + buffer = BufferWriter() + container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/usr/bin/id"] + // Try some uid that doesn't exist. This is supported. + config.process.user = .init(uid: 40000, gid: 40000) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + expected = "uid=40000 gid=40000 groups=40000" + guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + + buffer = BufferWriter() + container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/usr/bin/id"] + // Try some uid that doesn't exist. This is supported. + config.process.user = .init(username: "40000:40000") + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + expected = "uid=40000 gid=40000 groups=40000" + guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + + buffer = BufferWriter() + container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/usr/bin/id"] + // Now for our final trick, try and run a username that doesn't exist. + config.process.user = .init(username: "thisdoesntexist") + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + do { + try await container.start() + } catch { + return + } + throw IntegrationError.assert(msg: "container start should have failed") + } + + // Ensure if we ask for a terminal we set TERM. + func testProcessTtyEnvvar() async throws { + let id = "test-process-tty-envvar" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["env"] + config.process.terminal = true + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let str = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert( + msg: "failed to convert standard output to a UTF8 string") + } + + let homeEnvvar = "TERM=xterm" + guard str.contains(homeEnvvar) else { + throw IntegrationError.assert( + msg: "process should have TERM environment variable defined") + } + } + + // Make sure we set HOME by default if we can find it in /etc/passwd in the guest. + func testProcessHomeEnvvar() async throws { + let id = "test-process-home-envvar" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["env"] + config.process.user = .init(uid: 0, gid: 0) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let str = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert( + msg: "failed to convert standard output to a UTF8 string") + } + + let homeEnvvar = "HOME=/root" + guard str.contains(homeEnvvar) else { + throw IntegrationError.assert( + msg: "process should have HOME environment variable defined") + } + } + + func testProcessCustomHomeEnvvar() async throws { + let id = "test-process-custom-home-envvar" + + let bs = try await bootstrap(id) + let customHomeEnvvar = "HOME=/tmp/custom/home" + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sh", "-c", "echo HOME=$HOME"] + config.process.environmentVariables.append(customHomeEnvvar) + config.process.user = .init(uid: 0, gid: 0) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.contains(customHomeEnvvar) else { + throw IntegrationError.assert(msg: "process should have preserved custom HOME environment variable, expected \(customHomeEnvvar), got: \(output)") + } + } + + func testHostname() async throws { + let id = "test-container-hostname" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/hostname"] + config.hostname = "foo-bar" + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + let expected = "foo-bar" + + guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testHostnameDefaultsToContainerID() async throws { + let id = "test-container-hostname-default" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "\(id)\n" else { + throw IntegrationError.assert( + msg: "hostname should default to container id '\(id)', got '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testHostsFile() async throws { + let id = "test-container-hosts-file" + + let bs = try await bootstrap(id) + let entry = Hosts.Entry.localHostIPV4(comment: "Testaroo") + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.hosts = Hosts(entries: [entry]) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let expected = entry.rendered + guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testProcessStdin() async throws { + let id = "test-container-stdin" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat"] + config.process.stdin = StdinBuffer(data: "Hello from test".data(using: .utf8)!) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + let expected = "Hello from test" + + guard String(data: buffer.data, encoding: .utf8) == "\(expected)" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testMounts() async throws { + let id = "test-cat-mount" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + let directory = try createMountDirectory() + config.process.arguments = ["/bin/cat", "/mnt/hi.txt"] + config.mounts.append(.share(source: directory.path, destination: "/mnt")) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let value = String(data: buffer.data, encoding: .utf8) + guard value == "hello" else { + throw IntegrationError.assert( + msg: "process should have returned from file 'hello' != '\(String(data: buffer.data, encoding: .utf8)!)") + + } + } + + #if os(macOS) + func testNestedVirtualizationEnabled() async throws { + let id = "test-nested-virt" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/true"] + config.virtualization = true + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + } catch { + if let err = error as? ContainerizationError { + if err.code == .unsupported { + throw SkipTest(reason: err.message) + } + } + } + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + } + + func testContainerManagerCreate() async throws { + let id = "test-container-manager" + + let bs = try await bootstrap(id) + + var manager = try ContainerManager(vmm: bs.vmm) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + config.process.arguments = ["/bin/echo", "ContainerManager test"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8) + guard output == "ContainerManager test\n" else { + throw IntegrationError.assert( + msg: "process should have returned 'ContainerManager test' != '\(output ?? "nil")'") + } + } + + func testContainerStopIdempotency() async throws { + let id = "test-container-stop-idempotency" + + let bs = try await bootstrap(id) + + var manager = try ContainerManager(vmm: bs.vmm) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + config.process.arguments = ["/bin/echo", "please stop me"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + try await container.stop() + try await container.stop() + + let output = String(data: buffer.data, encoding: .utf8) + guard output == "please stop me\n" else { + throw IntegrationError.assert( + msg: "process should have returned 'ContainerManager test' != '\(output ?? "nil")'") + } + } + + func testContainerReuse() async throws { + let id = "test-container-reuse" + + let bs = try await bootstrap(id) + + var manager = try ContainerManager(vmm: bs.vmm) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + config.process.arguments = ["/bin/echo", "ContainerManager test"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + var status = try await container.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + try await container.stop() + + try await container.create() + try await container.start() + + // Wait for completion.. again. + status = try await container.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8) + let expected = "ContainerManager test\nContainerManager test\n" + guard output == expected else { + throw IntegrationError.assert( + msg: "process should have returned '\(expected)' != '\(output ?? "nil")'") + } + } + + func testContainerDevConsole() async throws { + let id = "test-container-devconsole" + + let bs = try await bootstrap(id) + + var manager = try ContainerManager(vmm: bs.vmm) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + // We mount devtmpfs by default, and while this includes creating + // /dev/console typically that'll be pointing to /dev/hvc0 (the + // virtio serial console). This is just a character device, so a trivial + // way to check that our bind mounted console setup worked is by just + // parsing `mount`'s output and looking for /dev/console as it wouldn't + // be there normally without our dance. + config.process.arguments = ["mount"] + config.process.terminal = true + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let str = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert( + msg: "failed to convert standard output to a UTF8 string") + } + + let devConsole = "/dev/console" + guard str.contains(devConsole) else { + throw IntegrationError.assert( + msg: "process should have \(devConsole) in `mount` output") + } + } + + #endif + + func testContainerStatistics() async throws { + let id = "test-container-statistics" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "infinity"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let stats = try await container.statistics() + + guard stats.id == id else { + throw IntegrationError.assert(msg: "stats container ID '\(stats.id)' != '\(id)'") + } + + guard let process = stats.process, process.current > 0 else { + throw IntegrationError.assert(msg: "process count should be > 0, got \(stats.process?.current ?? 0)") + } + + guard let memory = stats.memory, memory.usageBytes > 0 else { + throw IntegrationError.assert(msg: "memory usage should be > 0, got \(stats.memory?.usageBytes ?? 0)") + } + + guard let cpu = stats.cpu, cpu.usageUsec > 0 else { + throw IntegrationError.assert(msg: "CPU usage should be > 0, got \(stats.cpu?.usageUsec ?? 0)") + } + + print("Container statistics:") + print(" Processes: \(process.current)") + print(" Memory: \(memory.usageBytes) bytes") + print(" CPU: \(cpu.usageUsec) usec") + print(" Networks: \(stats.networks?.count ?? 0) interfaces") + + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCgroupLimits() async throws { + let id = "test-cgroup-limits" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "infinity"] + config.cpus = 2 + config.memoryInBytes = 512.mib() + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Start an exec with sleep infinity + let sleepExec = try await container.exec("sleep-exec") { config in + config.arguments = ["sleep", "infinity"] + } + try await sleepExec.start() + + // Verify we have 3 PIDs in cgroup.procs: init, exec sleep, and cat itself + let procsBuffer = BufferWriter() + let procsExec = try await container.exec("check-procs") { config in + config.arguments = ["cat", "/sys/fs/cgroup/cgroup.procs"] + config.stdout = procsBuffer + } + try await procsExec.start() + var status = try await procsExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-procs status \(status) != 0") + } + try await procsExec.delete() + + guard let procsContent = String(data: procsBuffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to parse cgroup.procs") + } + let pids = procsContent.split(separator: "\n").filter { !$0.isEmpty } + guard pids.count == 3 else { + throw IntegrationError.assert(msg: "expected 3 PIDs in cgroup.procs, got \(pids.count): \(procsContent)") + } + + // Verify memory limit + let memoryBuffer = BufferWriter() + let memoryExec = try await container.exec("check-memory") { config in + config.arguments = ["cat", "/sys/fs/cgroup/memory.max"] + config.stdout = memoryBuffer + } + try await memoryExec.start() + status = try await memoryExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-memory status \(status) != 0") + } + try await memoryExec.delete() + + guard let memoryLimit = String(data: memoryBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse memory.max") + } + let expectedMemory = "\(512.mib())" + guard memoryLimit == expectedMemory else { + throw IntegrationError.assert(msg: "memory.max \(memoryLimit) != expected \(expectedMemory)") + } + + // Verify CPU limit + let cpuBuffer = BufferWriter() + let cpuExec = try await container.exec("check-cpu") { config in + config.arguments = ["cat", "/sys/fs/cgroup/cpu.max"] + config.stdout = cpuBuffer + } + try await cpuExec.start() + status = try await cpuExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-cpu status \(status) != 0") + } + try await cpuExec.delete() + + guard let cpuLimit = String(data: cpuBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse cpu.max") + } + let expectedCpu = "200000 100000" // 2 CPUs: quota=200000, period=100000 + guard cpuLimit == expectedCpu else { + throw IntegrationError.assert(msg: "cpu.max '\(cpuLimit)' != expected '\(expectedCpu)'") + } + + try await sleepExec.delete() + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testMemoryEventsOOMKill() async throws { + let id = "test-memory-events-oom-kill" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "infinity"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Run a process that will exceed the memory limit and get OOM-killed + let exec = try await container.exec("oom-trigger") { config in + // First set a 2MB memory limit on the container's cgroup, then allocate more + config.arguments = [ + "sh", + "-c", + "echo 2097152 > /sys/fs/cgroup/memory.max && dd if=/dev/zero of=/dev/null bs=100M", + ] + } + + try await exec.start() + let status = try await exec.wait() + if status.exitCode == 0 { + throw IntegrationError.assert(msg: "expected exit code > 0") + } + try await exec.delete() + + let stats = try await container.statistics(categories: .memoryEvents) + + guard let events = stats.memoryEvents else { + throw IntegrationError.assert(msg: "expected memoryEvents to be present") + } + + print("Memory events for container \(id):") + print(" low: \(events.low)") + print(" high: \(events.high)") + print(" max: \(events.max)") + print(" oom: \(events.oom)") + print(" oomKill: \(events.oomKill)") + + guard events.oomKill > 0 else { + throw IntegrationError.assert(msg: "expected oomKill > 0, got \(events.oomKill)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testNoSerialConsole() async throws { + let id = "test-no-serial-console" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/true"] + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + } + + func testUnixSocketIntoGuest() async throws { + let id = "test-unixsocket-into-guest" + + let bs = try await bootstrap(id) + + let hostSocketPath = try createHostUnixSocket() + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.sockets = [ + UnixSocketConfiguration( + source: URL(filePath: hostSocketPath), + destination: URL(filePath: "/tmp/test.sock"), + direction: .into + ) + ] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Execute ls -l to check the socket exists and is indeed a socket + let lsExec = try await container.exec("ls-socket") { config in + config.arguments = ["ls", "-l", "/tmp/test.sock"] + config.stdout = buffer + } + + try await lsExec.start() + let status = try await lsExec.wait() + try await lsExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls command failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert ls output to UTF8") + } + + // Socket files in ls -l output start with 's' + guard output.hasPrefix("s") else { + throw IntegrationError.assert( + msg: "expected socket file (starting with 's'), got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + // NOTE: Once upon a time our guest agent created any proxied unix sockets at + // a path that contained the container ID in it. The problem here is if the container + // ID is comically long we exceed the max length of a unix domain socket path. + func testUnixSocketIntoGuestLongContainerID() async throws { + let id = "test-unixsocket-long-id-" + String(repeating: "a", count: 40) + + let bs = try await bootstrap(id) + + let hostSocketPath = try createHostUnixSocket() + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.sockets = [ + UnixSocketConfiguration( + source: URL(filePath: hostSocketPath), + destination: URL(filePath: "/tmp/test.sock"), + direction: .into + ) + ] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let lsExec = try await container.exec("ls-socket") { config in + config.arguments = ["ls", "-l", "/tmp/test.sock"] + config.stdout = buffer + } + + try await lsExec.start() + let status = try await lsExec.wait() + try await lsExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls command failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert ls output to UTF8") + } + + guard output.hasPrefix("s") else { + throw IntegrationError.assert( + msg: "expected socket file (starting with 's'), got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testNonClosureConstructor() async throws { + let id = "test-container-non-closure-constructor" + + let bs = try await bootstrap(id) + let config = LinuxContainer.Configuration( + process: LinuxProcessConfiguration(arguments: ["/bin/true"]) + ) + let container = try LinuxContainer( + id, + rootfs: bs.rootfs, + vmm: bs.vmm, + configuration: config + ) + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + } + + private func createHostUnixSocket() throws -> String { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + let socketPath = dir.appendingPathComponent("test.sock").path + + let socket = try Socket(type: UnixType(path: socketPath)) + try socket.listen() + + return socketPath + } + + private func createMountDirectory() throws -> URL { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + try "hello".write(to: dir.appendingPathComponent("hi.txt"), atomically: true, encoding: .utf8) + return dir + } + + func testUnixSocketIntoGuestSymlink() async throws { + let id = "test-unixsocket-into-guest-symlink" + + let bs = try await bootstrap(id) + + let hostSocketPath = try createHostUnixSocket() + + let buffer = BufferWriter() + // Use /var/run/test.sock. Alpine has /var/run -> /run symlink + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.sockets = [ + UnixSocketConfiguration( + source: URL(filePath: hostSocketPath), + destination: URL(filePath: "/var/run/test.sock"), + direction: .into + ) + ] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let lsExec = try await container.exec("ls-socket") { config in + config.arguments = ["ls", "-l", "/var/run/test.sock"] + config.stdout = buffer + } + + try await lsExec.start() + let status = try await lsExec.wait() + try await lsExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls command failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert ls output to UTF8") + } + + // Socket files in ls -l output start with 's' + guard output.hasPrefix("s") else { + throw IntegrationError.assert( + msg: "expected socket file (starting with 's'), got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testBootLogFileHandle() async throws { + let id = "test-bootlog-filehandle" + + let bs = try await bootstrap(id) + + // Create a pipe to capture boot log data + let pipe = Pipe() + let bootLog = BootLog.fileHandle(pipe.fileHandleForWriting) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/echo", "test complete"] + config.bootLog = bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + try pipe.fileHandleForWriting.close() + let bootLogData = try pipe.fileHandleForReading.readToEnd() + guard let bootLogData = bootLogData, bootLogData.count > 0 else { + throw IntegrationError.assert( + msg: "expected to receive boot log data from pipe, but got no data") + } + + guard let bootLogString = String(data: bootLogData, encoding: .utf8) else { + throw IntegrationError.assert( + msg: "failed to convert boot log data to UTF8 string") + } + + guard bootLogString.count > 100 else { + throw IntegrationError.assert( + msg: "boot log output smaller than expected: got \(bootLogString.count)") + } + } catch { + try? await container.stop() + throw error + } + } + + func testLargeStdioOutput() async throws { + let id = "test-large-stdout-stderr-output" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let stdoutBuffer = DiscardingWriter() + let stderrBuffer = DiscardingWriter() + + let exec = try await container.exec("large-output") { config in + config.arguments = [ + "sh", + "-c", + """ + dd if=/dev/zero bs=1M count=250 status=none && \ + dd if=/dev/zero bs=1M count=250 status=none >&2 + """, + ] + config.stdout = stdoutBuffer + config.stderr = stderrBuffer + } + + let started = Date().timeIntervalSinceReferenceDate + + try await exec.start() + let status = try await exec.wait() + + let lasted = Date().timeIntervalSinceReferenceDate - started + print("Test \(id) finished process ingesting stdio in \(lasted)") + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec process status \(status) != 0") + } + + try await exec.delete() + + let expectedSize = 250 * 1024 * 1024 + guard stdoutBuffer.count == expectedSize else { + throw IntegrationError.assert( + msg: "stdout size \(stdoutBuffer.count) != expected \(expectedSize)") + } + + guard stderrBuffer.count == expectedSize else { + throw IntegrationError.assert( + msg: "stderr size \(stderrBuffer.count) != expected \(expectedSize)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testProcessDeleteIdempotency() async throws { + let id = "test-process-delete-idempotency" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Create an exec process + let exec = try await container.exec("test-exec") { config in + config.arguments = ["/bin/true"] + } + + try await exec.start() + let status = try await exec.wait() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec process status \(status) != 0") + } + + // Call delete twice to verify idempotency + try await exec.delete() + try await exec.delete() // Should be a no-op + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testMultipleExecsWithoutDelete() async throws { + let id = "test-multiple-execs-without-delete" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Create 3 exec processes without deleting them + let exec1 = try await container.exec("exec-1") { config in + config.arguments = ["/bin/true"] + } + try await exec1.start() + let status1 = try await exec1.wait() + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec1 process status \(status1) != 0") + } + + let exec2 = try await container.exec("exec-2") { config in + config.arguments = ["/bin/true"] + } + try await exec2.start() + let status2 = try await exec2.wait() + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec2 process status \(status2) != 0") + } + + let exec3 = try await container.exec("exec-3") { config in + config.arguments = ["/bin/true"] + } + try await exec3.start() + let status3 = try await exec3.wait() + guard status3.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec3 process status \(status3) != 0") + } + + // Stop should handle cleanup of all exec processes gracefully + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testNonExistentBinary() async throws { + let id = "test-non-existent-binary" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["foo-bar-baz"] + config.bootLog = bs.bootLog + } + + try await container.create() + do { + try await container.start() + } catch { + return + } + try await container.stop() + throw IntegrationError.assert(msg: "container start should have failed") + } + + // MARK: - Capability Tests + + func testCapabilitiesSysAdmin() async throws { + let id = "test-capabilities-sysadmin" + + let bs = try await bootstrap(id) + + // First test: without CAP_SYS_ADMIN (should be denied) + let bufferDenied = BufferWriter() + let containerWithoutSysAdmin = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities() + config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp || echo 'mount failed as expected'"] + config.process.stdout = bufferDenied + config.bootLog = bs.bootLog + } + + try await containerWithoutSysAdmin.create() + try await containerWithoutSysAdmin.start() + + var status = try await containerWithoutSysAdmin.wait() + try await containerWithoutSysAdmin.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container should have run successfully, got exit code \(status.exitCode)") + } + + guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard outputDenied.contains("mount failed as expected") else { + throw IntegrationError.assert(msg: "expected mount failure message, got: \(outputDenied)") + } + + // Second test: with CAP_SYS_ADMIN (should succeed) + let containerWithSysAdmin = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities(capabilities: [.sysAdmin]) + config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp"] + config.bootLog = bs.bootLog + } + + try await containerWithSysAdmin.create() + try await containerWithSysAdmin.start() + + status = try await containerWithSysAdmin.wait() + try await containerWithSysAdmin.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container with CAP_SYS_ADMIN should mount successfully, got exit code \(status.exitCode)") + } + } + + func testCapabilitiesNetAdmin() async throws { + let id = "test-capabilities-netadmin" + + let bs = try await bootstrap(id) + + // First test: without CAP_NET_ADMIN (should be denied) + let bufferDenied = BufferWriter() + let containerWithoutNetAdmin = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities() + config.process.arguments = ["/bin/sh", "-c", "ip link set lo down 2>/dev/null || echo 'network operation denied as expected'"] + config.process.stdout = bufferDenied + config.bootLog = bs.bootLog + } + + try await containerWithoutNetAdmin.create() + try await containerWithoutNetAdmin.start() + + var status = try await containerWithoutNetAdmin.wait() + try await containerWithoutNetAdmin.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container should handle network denial gracefully, got exit code \(status.exitCode)") + } + + guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard outputDenied.contains("network operation denied as expected") else { + throw IntegrationError.assert(msg: "expected network denial message, got: \(outputDenied)") + } + + // Second test: with CAP_NET_ADMIN (should succeed) + let bufferAllowed = BufferWriter() + let containerWithNetAdmin = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities(capabilities: [.netAdmin]) + config.process.arguments = ["/bin/sh", "-c", "ip link set lo down && ip link set lo up"] + config.process.stdout = bufferAllowed + config.bootLog = bs.bootLog + } + + try await containerWithNetAdmin.create() + try await containerWithNetAdmin.start() + + status = try await containerWithNetAdmin.wait() + try await containerWithNetAdmin.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container with CAP_NET_ADMIN should perform network operations, got exit code \(status.exitCode)") + } + } + + func testCapabilitiesOCIDefault() async throws { + let id = "test-capabilities-OCI-default" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + // Use default capability set + config.process.capabilities = .defaultOCICapabilities + config.process.arguments = ["/bin/sh", "-c", "echo 'Running with OCI default capabilities'"] + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container with OCI default capabilities should run, got exit code \(status.exitCode)") + } + } + + func testCapabilitiesAllCapabilities() async throws { + let id = "test-capabilities-all" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = .allCapabilities + config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp && ip link set lo down"] + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container with all capabilities should perform all operations, got exit code \(status.exitCode)") + } + } + + func testCapabilitiesFileOwnership() async throws { + let id = "test-capabilities-chown" + + let bs = try await bootstrap(id) + + // First test: without CAP_CHOWN + let bufferDenied = BufferWriter() + let containerWithoutChown = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities() + config.process.arguments = ["/bin/sh", "-c", "touch /tmp/testfile && chown 1000:1000 /tmp/testfile 2>/dev/null || echo 'chown denied as expected'"] + config.process.stdout = bufferDenied + config.bootLog = bs.bootLog + } + + try await containerWithoutChown.create() + try await containerWithoutChown.start() + + var status = try await containerWithoutChown.wait() + try await containerWithoutChown.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container should handle chown denial gracefully, got exit code \(status.exitCode)") + } + + guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard outputDenied.contains("chown denied as expected") else { + throw IntegrationError.assert(msg: "expected chown denial message, got: \(outputDenied)") + } + + // Second test: with CAP_CHOWN + let bufferAllowed = BufferWriter() + let containerWithChown = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.capabilities = LinuxCapabilities(capabilities: [.chown]) + config.process.arguments = ["/bin/sh", "-c", "touch /tmp/testfile && chown 1000:1000 /tmp/testfile"] + config.process.stdout = bufferAllowed + config.bootLog = bs.bootLog + } + + try await containerWithChown.create() + try await containerWithChown.start() + + status = try await containerWithChown.wait() + try await containerWithChown.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container with CAP_CHOWN should succeed, got exit code \(status.exitCode)") + } + } + + func testDefaultMaskedAndReadonlyPaths() async throws { + let id = "test-masked-readonly-defaults" + + // A default container (default capabilities + default masked/readonly + // paths) must have the OCI standard set enforced by vmexec without any + // opt-in. Probe from inside the guest: + // 1. readonlyPaths: writing under /proc/sys fails with EROFS. EROFS + // (not EPERM) proves the read-only remount rather than a mere + // capability denial — the default (restricted) caps already lack + // CAP_SYS_ADMIN, so a writable /proc/sys would fail with EPERM. + // The write is wrapped in a brace group so the shell's redirection + // failure ("can't create ...: Read-only file system") is captured: + // a trailing `2>&1` on the command misses it, because the failing + // `>` redirection aborts before `2>&1` is applied. + // 2. maskedPaths: at least one default-masked path is mounted over + // (visible in /proc/self/mountinfo). Checked via mountinfo rather + // than reading the target, since some masked paths (e.g. + // /proc/kcore) require CAP_SYS_RAWIO to read and would appear empty + // even if masking were broken, yielding a false pass. + let probe = """ + set -u + rerr=$( { echo x > /proc/sys/kernel/hostname; } 2>&1 ) + case "$rerr" in + *"Read-only file system"*) ;; + *) echo "RO-FAIL: writing /proc/sys expected EROFS, got: ${rerr:-}"; exit 1 ;; + esac + masked=0 + for p in /proc/kcore /proc/keys /proc/scsi /proc/sched_debug /sys/firmware /sys/devices/virtual/powercap; do + grep -q " $p " /proc/self/mountinfo && masked=$((masked + 1)) + done + if [ "$masked" -eq 0 ]; then + echo "MASK-FAIL: no default masked path mounted" + cat /proc/self/mountinfo + exit 1 + fi + echo "MASKED-RO-OK masked=$masked" + """ + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + // Intentionally leave config.maskedPaths / readonlyPaths / + // process.capabilities untouched — the point is that the defaults + // are secure out of the box. + config.process.arguments = ["/bin/sh", "-c", probe] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + let output = String(data: buffer.data, encoding: .utf8) ?? "" + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "default masked/readonly enforcement failed (exit \(status.exitCode)): \(output)") + } + guard output.contains("MASKED-RO-OK") else { + throw IntegrationError.assert(msg: "expected MASKED-RO-OK sentinel, got: \(output)") + } + } + + func testStat() async throws { + let id = "test-stat" + + let bs = try await bootstrap(id) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + func assertExec(_ container: LinuxContainer, id: String, cmd: String) async throws { + let exec = try await container.exec(id) { config in + config.arguments = ["sh", "-c", cmd] + } + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "\(id) failed with exit code \(status.exitCode)") + } + } + + do { + try await container.create() + try await container.start() + + // regular file: "regular file" is exactly 12 bytes + try await assertExec(container, id: "create-regular-file", cmd: "echo -n 'regular file' > /tmp/regular-file.txt") + // directory + try await assertExec(container, id: "create-dir", cmd: "mkdir /tmp/test-dir") + // relative symlink so stat() resolves the target within the same directory + try await assertExec(container, id: "create-symlink", cmd: "ln -s regular-file.txt /tmp/test-link") + // FIFO + try await assertExec(container, id: "create-fifo", cmd: "mkfifo /tmp/test-fifo") + + let vsock = try await container.dialVsock(port: 1024) + let vminitd = try await Vminitd(connection: vsock, group: Self.eventLoop) + + let root = URL(filePath: container.root) + + // --- regular file --- + let regularStat = try await vminitd.stat(path: root.appending(path: "tmp/regular-file.txt")) + guard (regularStat.mode & UInt32(S_IFMT)) == S_IFREG else { + throw IntegrationError.assert(msg: "regular file: expected S_IFREG, got mode 0x\(String(regularStat.mode, radix: 16))") + } + guard regularStat.size == 12 else { + throw IntegrationError.assert(msg: "regular file: expected size 12, got \(regularStat.size)") + } + guard regularStat.ino > 0 else { + throw IntegrationError.assert(msg: "regular file: expected non-zero inode, got \(regularStat.ino)") + } + guard regularStat.nlink >= 1 else { + throw IntegrationError.assert(msg: "regular file: expected nlink >= 1, got \(regularStat.nlink)") + } + + // --- directory --- + let dirStat = try await vminitd.stat(path: root.appending(path: "tmp/test-dir")) + guard (dirStat.mode & UInt32(S_IFMT)) == S_IFDIR else { + throw IntegrationError.assert(msg: "directory: expected S_IFDIR, got mode 0x\(String(dirStat.mode, radix: 16))") + } + // A directory always has at least 2 hard links (. and its entry in the parent) + guard dirStat.nlink >= 2 else { + throw IntegrationError.assert(msg: "directory: expected nlink >= 2, got \(dirStat.nlink)") + } + + // --- symlink --- + // stat(2) follows symlinks, so the result reflects the target regular file + let symlinkStat = try await vminitd.stat(path: root.appending(path: "tmp/test-link")) + guard (symlinkStat.mode & UInt32(S_IFMT)) == S_IFREG else { + throw IntegrationError.assert(msg: "symlink (followed): expected S_IFREG, got mode 0x\(String(symlinkStat.mode, radix: 16))") + } + guard symlinkStat.size == regularStat.size else { + throw IntegrationError.assert(msg: "symlink (followed): expected size \(regularStat.size), got \(symlinkStat.size)") + } + + // --- FIFO --- + let fifoStat = try await vminitd.stat(path: root.appending(path: "tmp/test-fifo")) + guard (fifoStat.mode & UInt32(S_IFMT)) == S_IFIFO else { + throw IntegrationError.assert(msg: "FIFO: expected S_IFIFO, got mode 0x\(String(fifoStat.mode, radix: 16))") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyIn() async throws { + let id = "test-copy-in" + + let bs = try await bootstrap(id) + + // Create a temp file on the host with known content + let testContent = "Hello from the host! This is a copyIn test." + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("test-input.txt") + try testContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Copy the file into the container + try await container.copyIn( + from: hostFile, + to: URL(filePath: "/tmp/copied-file.txt") + ) + + // Verify the file exists and has correct content + let exec = try await container.exec("verify-copy") { config in + config.arguments = ["cat", "/tmp/copied-file.txt"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat command failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output == testContent else { + throw IntegrationError.assert( + msg: "copied file content mismatch: expected '\(testContent)', got '\(output)'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyInFileToExistingDirectory() async throws { + let id = "test-copy-in-file-to-dir" + + let bs = try await bootstrap(id) + + let testContent = "copy into an existing guest directory" + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("host-file.txt") + try testContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let mkdir = try await container.exec("create-copy-target") { config in + config.arguments = ["mkdir", "-p", "/tmp/copy-target"] + } + try await mkdir.start() + let mkdirStatus = try await mkdir.wait() + try await mkdir.delete() + + guard mkdirStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "mkdir failed with status \(mkdirStatus)") + } + + try await container.copyIn( + from: hostFile, + to: URL(filePath: "/tmp/copy-target") + ) + + let buffer = BufferWriter() + let verify = try await container.exec("verify-copy-target") { config in + config.arguments = ["cat", "/tmp/copy-target/host-file.txt"] + config.stdout = buffer + } + try await verify.start() + let verifyStatus = try await verify.wait() + try await verify.delete() + + guard verifyStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat copied file failed with status \(verifyStatus)") + } + guard String(data: buffer.data, encoding: .utf8) == testContent else { + throw IntegrationError.assert(msg: "copied file should land under the existing destination directory") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyInFileToMissingDirectoryFails() async throws { + let id = "test-copy-in-file-missing-dir" + + let bs = try await bootstrap(id) + + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("host-file.txt") + try "missing destination directory".write(to: hostFile, atomically: true, encoding: .utf8) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + do { + try await container.copyIn( + from: hostFile, + to: URL(filePath: "/tmp/missing-copy-target/") + ) + throw IntegrationError.assert(msg: "copyIn should fail when copying a file to a missing destination directory") + } catch let error as ContainerizationError where error.code == .invalidArgument { + guard error.description.contains("destination directory does not exist") else { + throw IntegrationError.assert(msg: "unexpected copyIn error: \(error)") + } + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyInDirectoryOverExistingFileFails() async throws { + let id = "test-copy-in-dir-over-file" + + let bs = try await bootstrap(id) + + let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("host-dir") + try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true) + try "directory content".write(to: hostDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let createFile = try await container.exec("create-existing-file") { config in + config.arguments = ["sh", "-c", "echo -n existing > /tmp/existing-file"] + } + try await createFile.start() + let createStatus = try await createFile.wait() + try await createFile.delete() + + guard createStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "failed to create existing file, status \(createStatus)") + } + + do { + try await container.copyIn( + from: hostDir, + to: URL(filePath: "/tmp/existing-file") + ) + throw IntegrationError.assert(msg: "copyIn should fail when copying a directory over an existing file") + } catch let error as ContainerizationError where error.code == .invalidArgument { + guard error.description.contains("cannot copy directory over existing file") else { + throw IntegrationError.assert(msg: "unexpected copyIn error: \(error)") + } + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyOut() async throws { + let id = "test-copy-out" + + let bs = try await bootstrap(id) + + let testContent = "Hello from the guest! This is a copyOut test." + let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("test-output.txt") + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Create a file inside the container + let exec = try await container.exec("create-file") { config in + config.arguments = ["sh", "-c", "echo -n '\(testContent)' > /tmp/guest-file.txt"] + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "failed to create file in guest, status \(status)") + } + + // Copy the file out of the container + try await container.copyOut( + from: URL(filePath: "/tmp/guest-file.txt"), + to: hostDestination + ) + + // Verify the file was copied correctly + let copiedContent = try String(contentsOf: hostDestination, encoding: .utf8) + + guard copiedContent == testContent else { + throw IntegrationError.assert( + msg: "copied file content mismatch: expected '\(testContent)', got '\(copiedContent)'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyLargeFile() async throws { + let id = "test-copy-large-file" + + let bs = try await bootstrap(id) + + // Create a 10MB file on the host with a repeating pattern + let fileSize = 10 * 1024 * 1024 + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("large-file.bin") + + // Generate data with a repeating pattern + let pattern = Data("ContainerizationCopyTest".utf8) + var testData = Data(capacity: fileSize) + while testData.count < fileSize { + testData.append(pattern) + } + testData = testData.prefix(fileSize) + try testData.write(to: hostFile) + + let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("large-file-out.bin") + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Copy large file into the container + try await container.copyIn( + from: hostFile, + to: URL(filePath: "/tmp/large-file.bin") + ) + + // Copy it back out + try await container.copyOut( + from: URL(filePath: "/tmp/large-file.bin"), + to: hostDestination + ) + + // Verify the content matches + let copiedData = try Data(contentsOf: hostDestination) + + guard copiedData.count == testData.count else { + throw IntegrationError.assert( + msg: "file size mismatch: expected \(testData.count), got \(copiedData.count)") + } + + guard copiedData == testData else { + throw IntegrationError.assert(msg: "file content mismatch after round-trip copy") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyInDirectory() async throws { + let id = "test-copy-in-dir" + + let bs = try await bootstrap(id) + + // Create a temp directory with files, a subdirectory, and a symlink. + let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("test-dir") + try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true) + try "file1 content".write(to: hostDir.appendingPathComponent("file1.txt"), atomically: true, encoding: .utf8) + + let subDir = hostDir.appendingPathComponent("subdir") + try FileManager.default.createDirectory(at: subDir, withIntermediateDirectories: true) + try "file2 content".write(to: subDir.appendingPathComponent("file2.txt"), atomically: true, encoding: .utf8) + + try FileManager.default.createSymbolicLink( + at: hostDir.appendingPathComponent("link.txt"), + withDestinationURL: hostDir.appendingPathComponent("file1.txt") + ) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Copy the directory into the container. + try await container.copyIn( + from: hostDir, + to: URL(filePath: "/tmp/copied-dir") + ) + + // Verify file1.txt exists with correct content. + let buffer1 = BufferWriter() + let exec1 = try await container.exec("verify-file1") { config in + config.arguments = ["cat", "/tmp/copied-dir/file1.txt"] + config.stdout = buffer1 + } + try await exec1.start() + let status1 = try await exec1.wait() + try await exec1.delete() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat file1.txt failed with status \(status1)") + } + guard String(data: buffer1.data, encoding: .utf8) == "file1 content" else { + throw IntegrationError.assert(msg: "file1.txt content mismatch") + } + + // Verify subdir/file2.txt exists with correct content. + let buffer2 = BufferWriter() + let exec2 = try await container.exec("verify-file2") { config in + config.arguments = ["cat", "/tmp/copied-dir/subdir/file2.txt"] + config.stdout = buffer2 + } + try await exec2.start() + let status2 = try await exec2.wait() + try await exec2.delete() + + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat subdir/file2.txt failed with status \(status2)") + } + guard String(data: buffer2.data, encoding: .utf8) == "file2 content" else { + throw IntegrationError.assert(msg: "subdir/file2.txt content mismatch") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyOutDirectory() async throws { + let id = "test-copy-out-dir" + + let bs = try await bootstrap(id) + + let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("copied-out-dir") + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Create a directory structure inside the container. + let exec = try await container.exec("create-dir") { config in + config.arguments = [ + "sh", "-c", + "mkdir -p /tmp/guest-dir/subdir && echo -n 'guest file1' > /tmp/guest-dir/file1.txt && echo -n 'guest file2' > /tmp/guest-dir/subdir/file2.txt", + ] + } + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "failed to create directory in guest, status \(status)") + } + + // Copy the directory out of the container. + try await container.copyOut( + from: URL(filePath: "/tmp/guest-dir"), + to: hostDestination + ) + + // Verify file1.txt was copied correctly. + let file1Content = try String(contentsOf: hostDestination.appendingPathComponent("file1.txt"), encoding: .utf8) + guard file1Content == "guest file1" else { + throw IntegrationError.assert( + msg: "file1.txt content mismatch: expected 'guest file1', got '\(file1Content)'") + } + + // Verify subdir/file2.txt was copied correctly. + let file2Content = try String( + contentsOf: hostDestination.appendingPathComponent("subdir").appendingPathComponent("file2.txt"), + encoding: .utf8 + ) + guard file2Content == "guest file2" else { + throw IntegrationError.assert( + msg: "subdir/file2.txt content mismatch: expected 'guest file2', got '\(file2Content)'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyEmptyFile() async throws { + let id = "test-copy-empty-file" + + let bs = try await bootstrap(id) + + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("empty.txt") + try Data().write(to: hostFile) + + let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("empty-out.txt") + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Copy empty file in. + try await container.copyIn( + from: hostFile, + to: URL(filePath: "/tmp/empty.txt") + ) + + // Verify it exists and is empty in the guest. + let buffer = BufferWriter() + let exec = try await container.exec("verify-empty") { config in + config.arguments = ["stat", "-c", "%s", "/tmp/empty.txt"] + config.stdout = buffer + } + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "stat failed with status \(status)") + } + let sizeStr = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard sizeStr == "0" else { + throw IntegrationError.assert(msg: "empty file should have size 0, got '\(sizeStr ?? "nil")'") + } + + // Copy it back out. + try await container.copyOut( + from: URL(filePath: "/tmp/empty.txt"), + to: hostDestination + ) + + let copiedData = try Data(contentsOf: hostDestination) + guard copiedData.isEmpty else { + throw IntegrationError.assert(msg: "round-tripped empty file should be empty, got \(copiedData.count) bytes") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyEmptyDirectory() async throws { + let id = "test-copy-empty-dir" + + let bs = try await bootstrap(id) + + let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("empty-dir") + try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Copy empty directory in. + try await container.copyIn( + from: hostDir, + to: URL(filePath: "/tmp/empty-dir") + ) + + // Verify it exists and is a directory. + let buffer = BufferWriter() + let exec = try await container.exec("verify-empty-dir") { config in + config.arguments = ["sh", "-c", "test -d /tmp/empty-dir && ls -a /tmp/empty-dir | wc -l"] + config.stdout = buffer + } + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "empty dir check failed with status \(status)") + } + + // ls -a shows . and .. so count should be 2 for an empty dir. + let countStr = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard countStr == "2" else { + throw IntegrationError.assert(msg: "empty dir should have 2 entries (. and ..), got '\(countStr ?? "nil")'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testCopyBinaryFile() async throws { + let id = "test-copy-binary" + + let bs = try await bootstrap(id) + + // Create a file with all 256 byte values to test binary safety. + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("binary.bin") + var binaryData = Data(count: 256 * 64) + for i in 0.. /tmp/custom-bin/mytest && chmod +x /tmp/custom-bin/mytest", + ] + } + try await setup.start() + let setupStatus = try await setup.wait() + try await setup.delete() + guard setupStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "setup failed: \(setupStatus)") + } + + // Exec bare command with custom PATH — this exercises ExecCommand.swift + let buffer = BufferWriter() + let exec = try await container.exec("custom-path") { config in + config.arguments = ["mytest"] + config.environmentVariables = ["PATH=/tmp/custom-bin"] + config.stdout = buffer + } + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec with custom PATH failed: \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to read output") + } + guard output.contains("CUSTOM_PATH_OK") else { + throw IntegrationError.assert(msg: "expected CUSTOM_PATH_OK, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testStdinExplicitClose() async throws { + let id = "test-stdin-explicit-close" + let bs = try await bootstrap(id) + + let inputData = "explicit close test\n".data(using: .utf8)! + let buffer = BufferWriter() + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let exec = try await container.exec("stdin-close-exec") { config in + config.arguments = ["head", "-n", "1"] + config.stdin = StdinBuffer(data: inputData) + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec status \(status) != 0") + } + + guard buffer.data == inputData else { + throw IntegrationError.assert(msg: "output mismatch") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testStdinBinaryData() async throws { + let id = "test-stdin-binary-data" + let bs = try await bootstrap(id) + + var inputData = Data() + for i: UInt8 in 0...255 { + inputData.append(contentsOf: [UInt8](repeating: i, count: 256)) + } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat"] + config.process.stdin = StdinBuffer(data: inputData) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard buffer.data == inputData else { + throw IntegrationError.assert(msg: "binary data mismatch") + } + } catch { + try? await container.stop() + throw error + } + } + + func testStdinMultipleChunks() async throws { + let id = "test-stdin-multiple-chunks" + let bs = try await bootstrap(id) + + let chunks = (0..<10).map { i in + Data(repeating: UInt8(0x30 + i), count: 10 * 1024) + } + let expectedData = chunks.reduce(Data()) { $0 + $1 } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat"] + config.process.stdin = ChunkedStdinBuffer(chunks: chunks, delayMs: 10) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard buffer.data == expectedData else { + throw IntegrationError.assert(msg: "chunked data mismatch") + } + } catch { + try? await container.stop() + throw error + } + } + + func testStdinVeryLarge() async throws { + let id = "test-stdin-very-large" + let bs = try await bootstrap(id) + + let inputSize = 10 * 1024 * 1024 + let inputData = Data(repeating: 0x58, count: inputSize) + + let stdout = DiscardingWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["wc", "-c"] + config.process.stdin = StdinBuffer(data: inputData) + config.process.stdout = stdout + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard stdout.count > 0 else { + throw IntegrationError.assert(msg: "no output from wc") + } + } catch { + try? await container.stop() + throw error + } + } + + #if os(macOS) + @available(macOS 26.0, *) + func testInterfaceMTU() async throws { + let id = "test-interface-mtu" + let bs = try await bootstrap(id) + + let customMTU: UInt32 = 1400 + var network = try VmnetNetwork() + defer { + try? network.releaseInterface(id) + } + + guard let interface = try network.createInterface(id, mtu: customMTU) else { + throw IntegrationError.assert(msg: "failed to create network interface") + } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Check the MTU of eth0 + let exec = try await container.exec("check-mtu") { config in + config.arguments = ["ip", "link", "show", "eth0"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip link show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // Output should contain "mtu 1400" + guard output.contains("mtu \(customMTU)") else { + throw IntegrationError.assert( + msg: "expected MTU \(customMTU) in output, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + #endif + + func testSingleFileMount() async throws { + let id = "test-single-file-mount" + + let bs = try await bootstrap(id) + + // Create a temp file with known content + let testContent = "Hello from single file mount!" + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("config.txt") + try testContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat", "/etc/myconfig.txt"] + // Mount a single file using virtiofs share + config.mounts.append(.share(source: hostFile.path, destination: "/etc/myconfig.txt")) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output == testContent else { + throw IntegrationError.assert( + msg: "expected '\(testContent)', got '\(output)'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testSingleFileMountReadOnly() async throws { + let id = "test-single-file-mount-readonly" + + let bs = try await bootstrap(id) + + // Create a temp file with known content + let testContent = "Read-only file content" + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("readonly.txt") + try testContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + // Mount a single file as read-only + config.mounts.append(.share(source: hostFile.path, destination: "/etc/readonly.txt", options: ["ro"])) + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // First verify we can read the file + let readBuffer = BufferWriter() + let readExec = try await container.exec("read-file") { config in + config.arguments = ["cat", "/etc/readonly.txt"] + config.stdout = readBuffer + } + try await readExec.start() + var status = try await readExec.wait() + try await readExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read status \(status) != 0") + } + + guard String(data: readBuffer.data, encoding: .utf8) == testContent else { + throw IntegrationError.assert(msg: "file content mismatch") + } + + // Now try to write to the file - should fail + let writeExec = try await container.exec("write-file") { config in + config.arguments = ["sh", "-c", "echo 'modified' > /etc/readonly.txt"] + } + try await writeExec.start() + status = try await writeExec.wait() + try await writeExec.delete() + + // Write should fail on a read-only mount + guard status.exitCode != 0 else { + throw IntegrationError.assert(msg: "write should have failed on read-only mount") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testSingleFileMountWriteBack() async throws { + let id = "test-single-file-mount-write-back" + + let bs = try await bootstrap(id) + + // Create a temp file with initial content + let initialContent = "initial content" + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("writeable.txt") + try initialContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + // Mount a single file (writable by default) + config.mounts.append(.share(source: hostFile.path, destination: "/etc/writeable.txt")) + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Write new content from inside the container + let newContent = "modified from container" + let writeExec = try await container.exec("write-file") { config in + config.arguments = ["sh", "-c", "echo -n '\(newContent)' > /etc/writeable.txt"] + } + try await writeExec.start() + let status = try await writeExec.wait() + try await writeExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "write status \(status) != 0") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + + let hostContent = try String(contentsOf: hostFile, encoding: .utf8) + guard hostContent == newContent else { + throw IntegrationError.assert( + msg: "expected '\(newContent)' on host, got '\(hostContent)'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testSingleFileMountSymlink() async throws { + let id = "test-single-file-mount-symlink" + + let bs = try await bootstrap(id) + + // Create a temp directory with a real file and a symlink to it + let tempDir = FileManager.default.uniqueTemporaryDirectory(create: true) + let realFile = tempDir.appendingPathComponent("realfile.txt") + let symlinkFile = tempDir.appendingPathComponent("symlink.txt") + + let initialContent = "content via symlink" + try initialContent.write(to: realFile, atomically: true, encoding: .utf8) + try FileManager.default.createSymbolicLink(at: symlinkFile, withDestinationURL: realFile) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + // Mount the symlink (should resolve to real file) + config.mounts.append(.share(source: symlinkFile.path, destination: "/etc/config.txt")) + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Read the file to verify content + let readBuffer = BufferWriter() + let readExec = try await container.exec("read-file") { config in + config.arguments = ["cat", "/etc/config.txt"] + config.stdout = readBuffer + } + try await readExec.start() + var status = try await readExec.wait() + try await readExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read status \(status) != 0") + } + + guard String(data: readBuffer.data, encoding: .utf8) == initialContent else { + throw IntegrationError.assert(msg: "content mismatch on read") + } + + // Write new content from container + let newContent = "modified via symlink mount" + let writeExec = try await container.exec("write-file") { config in + config.arguments = ["sh", "-c", "echo -n '\(newContent)' > /etc/config.txt"] + } + try await writeExec.start() + status = try await writeExec.wait() + try await writeExec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "write status \(status) != 0") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + + // Verify the REAL file (not symlink) was modified on the host + let hostContent = try String(contentsOf: realFile, encoding: .utf8) + guard hostContent == newContent else { + throw IntegrationError.assert( + msg: "expected '\(newContent)' in real file, got '\(hostContent)'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testRLimitOpenFiles() async throws { + let id = "test-rlimit-open-files" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sh", "-c", "ulimit -n"] + config.process.rlimits = [ + LinuxRLimit(kind: .openFiles, hard: 2048, soft: 1024) + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // ulimit -n returns the soft limit + guard output == "1024" else { + throw IntegrationError.assert(msg: "expected soft limit '1024', got '\(output)'") + } + } + + func testRLimitMultiple() async throws { + let id = "test-rlimit-multiple" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + // Read /proc/self/limits to verify multiple rlimits are set + config.process.arguments = ["cat", "/proc/self/limits"] + config.process.rlimits = [ + LinuxRLimit(kind: .openFiles, hard: 4096, soft: 2048), + LinuxRLimit(kind: .stackSize, hard: 16_777_216, soft: 8_388_608), + LinuxRLimit(kind: .coreFileSize, hard: 0, soft: 0), + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // Parse /proc/self/limits and verify the values + // Format: "Limit Name Soft Limit Hard Limit Units" + let lines = output.split(separator: "\n") + + // Helper to find and verify a limit line + func verifyLimit(name: String, expectedSoft: String, expectedHard: String) throws { + guard let line = lines.first(where: { $0.contains(name) }) else { + throw IntegrationError.assert(msg: "limit '\(name)' not found in output") + } + let parts = line.split(whereSeparator: { $0.isWhitespace }).map(String.init) + // The line format varies, but soft and hard are typically the last numeric values before units + guard parts.contains(expectedSoft) && parts.contains(expectedHard) else { + throw IntegrationError.assert( + msg: "limit '\(name)' expected soft=\(expectedSoft) hard=\(expectedHard), got: \(line)") + } + } + + try verifyLimit(name: "Max open files", expectedSoft: "2048", expectedHard: "4096") + try verifyLimit(name: "Max stack size", expectedSoft: "8388608", expectedHard: "16777216") + try verifyLimit(name: "Max core file size", expectedSoft: "0", expectedHard: "0") + } + + func testRLimitExec() async throws { + let id = "test-rlimit-exec" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Exec a process with rlimits set + let buffer = BufferWriter() + let exec = try await container.exec("rlimit-exec") { config in + config.arguments = ["sh", "-c", "ulimit -n"] + config.rlimits = [ + LinuxRLimit(kind: .openFiles, hard: 512, soft: 256) + ] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output == "256" else { + throw IntegrationError.assert(msg: "expected soft limit '256', got '\(output)'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testDuplicateVirtiofsMount() async throws { + let id = "test-duplicate-virtiofs-mount" + + let bs = try await bootstrap(id) + + // Create a temp directory with a file + let sharedDir = FileManager.default.uniqueTemporaryDirectory(create: true) + try "shared content".write(to: sharedDir.appendingPathComponent("data.txt"), atomically: true, encoding: .utf8) + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + // Mount the same source directory to two different destinations + config.mounts.append(.share(source: sharedDir.path, destination: "/mnt1")) + config.mounts.append(.share(source: sharedDir.path, destination: "/mnt2")) + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Verify both mounts work. Read from /mnt1, then /mnt2 + let exec1 = try await container.exec("read-mnt1") { config in + config.arguments = ["cat", "/mnt1/data.txt"] + config.stdout = buffer1 + } + try await exec1.start() + var status = try await exec1.wait() + try await exec1.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read from /mnt1 failed with status \(status)") + } + + guard String(data: buffer1.data, encoding: .utf8) == "shared content" else { + throw IntegrationError.assert(msg: "unexpected content from /mnt1") + } + + let exec2 = try await container.exec("read-mnt2") { config in + config.arguments = ["cat", "/mnt2/data.txt"] + config.stdout = buffer2 + } + try await exec2.start() + status = try await exec2.wait() + try await exec2.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read from /mnt2 failed with status \(status)") + } + + guard String(data: buffer2.data, encoding: .utf8) == "shared content" else { + throw IntegrationError.assert(msg: "unexpected content from /mnt2") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testDuplicateVirtiofsMountViaSymlink() async throws { + let id = "test-duplicate-virtiofs-mount-symlink" + + let bs = try await bootstrap(id) + + // Create a temp directory with a file, and a symlink to the same directory + let tempDir = FileManager.default.uniqueTemporaryDirectory(create: true) + let realDir = tempDir.appendingPathComponent("realdir") + let symlinkDir = tempDir.appendingPathComponent("symlinkdir") + + try FileManager.default.createDirectory(at: realDir, withIntermediateDirectories: true) + try "symlink test content".write(to: realDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8) + try FileManager.default.createSymbolicLink(at: symlinkDir, withDestinationURL: realDir) + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.mounts.append(.share(source: realDir.path, destination: "/mnt1")) + config.mounts.append(.share(source: symlinkDir.path, destination: "/mnt2")) + config.bootLog = bs.bootLog + } + + do { + // This should succeed as the symlink should resolve to the same directory + try await container.create() + try await container.start() + + let exec1 = try await container.exec("read-mnt1") { config in + config.arguments = ["cat", "/mnt1/file.txt"] + config.stdout = buffer1 + } + try await exec1.start() + var status = try await exec1.wait() + try await exec1.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read from /mnt1 failed with status \(status)") + } + + guard String(data: buffer1.data, encoding: .utf8) == "symlink test content" else { + throw IntegrationError.assert(msg: "unexpected content from /mnt1") + } + + // Verify mount via symlink works now + let exec2 = try await container.exec("read-mnt2") { config in + config.arguments = ["cat", "/mnt2/file.txt"] + config.stdout = buffer2 + } + try await exec2.start() + status = try await exec2.wait() + try await exec2.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read from /mnt2 failed with status \(status)") + } + + guard String(data: buffer2.data, encoding: .utf8) == "symlink test content" else { + throw IntegrationError.assert(msg: "unexpected content from /mnt2") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testWritableLayer() async throws { + let id = "test-writable-layer" + + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib()) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + // Write a file, then read it back to verify writes work + config.process.arguments = ["/bin/sh", "-c", "echo 'writable layer test' > /tmp/testfile && cat /tmp/testfile"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "writable layer test" else { + throw IntegrationError.assert(msg: "unexpected output: \(output)") + } + } + + // Validates the on-disk structure of a journaled EXT4 image on the host before + // attempting a container mount. This catches geometry mismatches (superblock block + // count vs. physical file size) and missing journal metadata without requiring + // e2fsck to be present in the container image. + // + // Uses raw values for internal constants because integration tests cannot use + // @testable import: CompatFeature.hasJournal = 0x4, EXT4.JournalInode = 8. + private func verifyJournalFilesystem( + at path: URL, + minDiskSize: UInt64, + expectedMountOpts: UInt32 + ) throws { + let attrs = try FileManager.default.attributesOfItem(atPath: path.absolutePath()) + guard let fileSize = attrs[.size] as? UInt64 else { + throw IntegrationError.assert(msg: "could not read file size for \(path.lastPathComponent)") + } + let reader = try EXT4.EXT4Reader(blockDevice: FilePath(path.absolutePath())) + let sb = reader.superBlock + let blocksCount = UInt64(sb.blocksCountLow) | (UInt64(sb.blocksCountHigh) << 32) + let blockSize = UInt64(sb.blockSize) + guard fileSize == blocksCount * blockSize else { + throw IntegrationError.assert( + msg: "geometry mismatch: fileSize=\(fileSize), blocksCount=\(blocksCount), blockSize=\(blockSize)") + } + guard fileSize > minDiskSize else { + throw IntegrationError.assert( + msg: "journal did not grow the image: fileSize=\(fileSize), minDiskSize=\(minDiskSize)") + } + guard sb.featureCompat & 0x4 != 0 else { + throw IntegrationError.assert( + msg: "COMPAT_HAS_JOURNAL not set in featureCompat (0x\(String(sb.featureCompat, radix: 16)))") + } + guard sb.journalInum == 8 else { + throw IntegrationError.assert(msg: "journalInum=\(sb.journalInum), expected 8") + } + guard sb.defaultMountOpts == expectedMountOpts else { + throw IntegrationError.assert( + msg: "defaultMountOpts=0x\(String(sb.defaultMountOpts, radix: 16)), expected 0x\(String(expectedMountOpts, radix: 16)))") + } + } + + func testWritableLayerJournalWriteback() async throws { + let id = "test-writable-layer-journal-writeback" + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter( + FilePath(writableLayerPath.absolutePath()), + minDiskSize: 512.mib(), + journal: .init(defaultMode: .writeback) + ) + try filesystem.close() + // 0x0060 = data=writeback | barrier + try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0060) + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "echo 'journal writeback' > /tmp/testfile && cat /tmp/testfile"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal writeback" else { + throw IntegrationError.assert(msg: "unexpected output: \(output)") + } + } + + func testWritableLayerJournalOrdered() async throws { + let id = "test-writable-layer-journal-ordered" + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter( + FilePath(writableLayerPath.absolutePath()), + minDiskSize: 512.mib(), + journal: .init(defaultMode: .ordered) + ) + try filesystem.close() + // 0x0040 = data=ordered | barrier + try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0040) + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "echo 'journal ordered' > /tmp/testfile && cat /tmp/testfile"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal ordered" else { + throw IntegrationError.assert(msg: "unexpected output: \(output)") + } + } + + func testWritableLayerJournalData() async throws { + let id = "test-writable-layer-journal-data" + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter( + FilePath(writableLayerPath.absolutePath()), + minDiskSize: 512.mib(), + journal: .init(defaultMode: .journal) + ) + try filesystem.close() + // 0x0020 = data=journal | barrier + try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0020) + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "echo 'journal data' > /tmp/testfile && cat /tmp/testfile"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal data" else { + throw IntegrationError.assert(msg: "unexpected output: \(output)") + } + } + + func testWritableLayerPreservesLowerLayer() async throws { + let id = "test-writable-layer-preserves-lower" + + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib()) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + // Get the size of /bin/sh before any modifications + let buffer1 = BufferWriter() + let container1 = try LinuxContainer("\(id)-1", rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + // Modify a file in /bin. This should go in the writable layer. + config.process.arguments = ["/bin/sh", "-c", "ls -la /bin/sh && echo 'modified' > /bin/test-file"] + config.process.stdout = buffer1 + config.bootLog = bs.bootLog + } + + try await container1.create() + try await container1.start() + let status1 = try await container1.wait() + try await container1.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "first container failed with status \(status1)") + } + + // Now run a second container with the SAME rootfs but without the writable layer + // The /bin/test-file should NOT exist because it was written to the writable layer + let buffer2 = BufferWriter() + let container2 = try LinuxContainer("\(id)-2", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "test -f /bin/test-file && echo 'exists' || echo 'not-exists'"] + config.process.stdout = buffer2 + config.bootLog = bs.bootLog + } + + try await container2.create() + try await container2.start() + let status2 = try await container2.wait() + try await container2.stop() + + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "second container failed with status \(status2)") + } + + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output2.trimmingCharacters(in: .whitespacesAndNewlines) == "not-exists" else { + throw IntegrationError.assert(msg: "expected 'not-exists' but got: \(output2)") + } + } + + func testWritableLayerReadsFromLower() async throws { + let id = "test-writable-layer-reads-lower" + + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib()) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + config.process.arguments = ["head", "-1", "/etc/passwd"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // Alpine's first line of /etc/passwd should be root + guard output.hasPrefix("root:") else { + throw IntegrationError.assert(msg: "expected /etc/passwd to start with 'root:', got: \(output)") + } + } + + func testWritableLayerWithReadOnlyLower() async throws { + let id = "test-writable-layer-ro-lower" + + let bs = try await bootstrap(id) + var rootfs = bs.rootfs + rootfs.options.append("ro") + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib()) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + // Even though lower layer is ro, writes should succeed via overlay + config.process.arguments = ["/bin/sh", "-c", "echo 'overlay write test' > /tmp/test && cat /tmp/test"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "overlay write test" else { + throw IntegrationError.assert(msg: "unexpected output: \(output)") + } + } + + func testWritableLayerSize() async throws { + let id = "test-writable-layer-size" + + let bs = try await bootstrap(id) + + // Create a 1 GiB writable layer + let expectedSizeBytes: UInt64 = 1.gib() + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: expectedSizeBytes) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + // Use df to check the available space on the root filesystem + // The overlay will report the size of the upper layer's backing store + config.process.arguments = ["/bin/sh", "-c", "df -B1 / | tail -1 | awk '{print $2}'"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard let reportedSize = UInt64(output.trimmingCharacters(in: .whitespacesAndNewlines)) else { + throw IntegrationError.assert(msg: "failed to parse df output as UInt64: \(output)") + } + + // The reported size should be close to our expected size (within 10%) + let minExpected: UInt64 = (expectedSizeBytes * 90) / 100 + let maxExpected: UInt64 = (expectedSizeBytes * 110) / 100 + + guard reportedSize >= minExpected && reportedSize <= maxExpected else { + throw IntegrationError.assert(msg: "expected size ~\(expectedSizeBytes) bytes, but df reported \(reportedSize) bytes") + } + } + + func testWritableLayerWithDNSAndHosts() async throws { + let id = "test-writable-layer-dns-hosts" + + let bs = try await bootstrap(id) + + let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4") + try? FileManager.default.removeItem(at: writableLayerPath) + let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib()) + try filesystem.close() + let writableLayer = Mount.block( + format: "ext4", + source: writableLayerPath.absolutePath(), + destination: "/", + options: [] + ) + + let buffer = BufferWriter() + let dnsEntry = "8.8.8.8" + let hostsEntry = Hosts.Entry.localHostIPV4(comment: "WritableLayerTest") + let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "cat /etc/resolv.conf && echo '---' && cat /etc/hosts"] + config.process.stdout = buffer + config.dns = DNS(nameservers: [dnsEntry]) + config.hosts = Hosts(entries: [hostsEntry]) + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.contains(dnsEntry) else { + throw IntegrationError.assert(msg: "expected /etc/resolv.conf to contain \(dnsEntry), got: \(output)") + } + + guard output.contains("WritableLayerTest") else { + throw IntegrationError.assert(msg: "expected /etc/hosts to contain our entry, got: \(output)") + } + } + + func testFrozenExt4Clone() async throws { + let id = "test-frozen-ext4-clone" + let bs = try await bootstrap(id) + + let diskImageURL = Self.testDir.appending(component: "\(id)-data.ext4") + try? FileManager.default.removeItem(at: diskImageURL) + + let filesystem = try EXT4.Formatter(FilePath(diskImageURL.absolutePath()), minDiskSize: 64.mib()) + try filesystem.close() + + let cloneImageURL = Self.testDir.appending(component: "\(id)-data-clone.ext4") + try? FileManager.default.removeItem(at: cloneImageURL) + + let writerContainer = try LinuxContainer("\(id)-writer", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.mounts.append( + Mount.block( + format: "ext4", + source: diskImageURL.absolutePath(), + destination: "/data" + )) + config.bootLog = bs.bootLog + } + + do { + try await writerContainer.create() + try await writerContainer.start() + + try await writerContainer.filesystemOperation(operation: .freeze, path: "/data") + + let writeExec = try await writerContainer.exec("write-hello") { config in + config.arguments = ["/bin/sh", "-c", "echo hello > /data/hello.txt"] + } + try await writeExec.start() + let writeStatus = try await writeExec.wait() + try await writeExec.delete() + guard writeStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "write exec failed with status \(writeStatus)") + } + + try FileManager.default.copyItem(at: diskImageURL, to: cloneImageURL) + + try await writerContainer.filesystemOperation(operation: .thaw, path: "/data") + + try await writerContainer.kill(.kill) + _ = try await writerContainer.wait() + try await writerContainer.stop() + } catch { + try? await writerContainer.filesystemOperation(operation: .thaw, path: "/data") + try? await writerContainer.stop() + throw error + } + + let verifyContainer = try LinuxContainer("\(id)-reader", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.mounts.append( + Mount.block( + format: "ext4", + source: cloneImageURL.absolutePath(), + destination: "/data" + )) + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await verifyContainer.create() + try await verifyContainer.start() + + let mountBuffer = BufferWriter() + let mountExec = try await verifyContainer.exec("verify-mount") { config in + config.arguments = ["/bin/sh", "-c", "grep ' /data ' /proc/mounts"] + config.stdout = mountBuffer + } + try await mountExec.start() + var status = try await mountExec.wait() + try await mountExec.delete() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "failed to verify /data mount, status \(status)") + } + + let mountOutput = String(decoding: mountBuffer.data, as: UTF8.self) + guard mountOutput.contains(" /data ") && mountOutput.contains(" ext4 ") else { + throw IntegrationError.assert(msg: "expected ext4 mount at /data, got: \(mountOutput)") + } + + let lsBuffer = BufferWriter() + let lsExec = try await verifyContainer.exec("verify-no-hello") { config in + config.arguments = ["ls", "-1", "/data"] + config.stdout = lsBuffer + } + try await lsExec.start() + status = try await lsExec.wait() + try await lsExec.delete() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls /data failed with status \(status)") + } + + let lsOutput = String(decoding: lsBuffer.data, as: UTF8.self) + let listedFiles = Set(lsOutput.split(whereSeparator: \.isNewline).map(String.init)) + guard !listedFiles.contains("hello.txt") else { + throw IntegrationError.assert(msg: "expected cloned /data to not contain hello.txt, got: \(lsOutput)") + } + + try await verifyContainer.kill(.kill) + _ = try await verifyContainer.wait() + try await verifyContainer.stop() + } catch { + try? await verifyContainer.stop() + throw error + } + } + + func testTrimExt4Clone() async throws { + let id = "test-trim-ext4-clone" + let bs = try await bootstrap(id) + + let diskImageURL = Self.testDir.appending(component: "\(id)-data.ext4") + try? FileManager.default.removeItem(at: diskImageURL) + + let filesystem = try EXT4.Formatter(FilePath(diskImageURL.absolutePath()), minDiskSize: 64.mib()) + try filesystem.close() + + let cloneImageURL = Self.testDir.appending(component: "\(id)-data-clone.ext4") + try? FileManager.default.removeItem(at: cloneImageURL) + + let writerContainer = try LinuxContainer("\(id)-writer", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.mounts.append( + Mount.block( + format: "ext4", + source: diskImageURL.absolutePath(), + destination: "/data" + )) + config.bootLog = bs.bootLog + } + + do { + try await writerContainer.create() + try await writerContainer.start() + + let writeExec = try await writerContainer.exec("write-temp") { config in + config.arguments = [ + "/bin/sh", + "-c", + "dd if=/dev/zero of=/data/trim.dat bs=1M count=8 status=none && sync && rm /data/trim.dat && sync", + ] + } + try await writeExec.start() + let writeStatus = try await writeExec.wait() + try await writeExec.delete() + guard writeStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "trim setup exec failed with status \(writeStatus)") + } + + try await writerContainer.filesystemOperation(operation: .trim, path: "/data") + + try FileManager.default.copyItem(at: diskImageURL, to: cloneImageURL) + + try await writerContainer.kill(.kill) + _ = try await writerContainer.wait() + try await writerContainer.stop() + } catch { + try? await writerContainer.stop() + throw error + } + + let verifyContainer = try LinuxContainer("\(id)-reader", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.mounts.append( + Mount.block( + format: "ext4", + source: cloneImageURL.absolutePath(), + destination: "/data" + )) + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await verifyContainer.create() + try await verifyContainer.start() + + let mountBuffer = BufferWriter() + let mountExec = try await verifyContainer.exec("verify-mount") { config in + config.arguments = ["/bin/sh", "-c", "grep ' /data ' /proc/mounts"] + config.stdout = mountBuffer + } + try await mountExec.start() + var status = try await mountExec.wait() + try await mountExec.delete() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "failed to verify /data mount, status \(status)") + } + + let mountOutput = String(decoding: mountBuffer.data, as: UTF8.self) + guard mountOutput.contains(" /data ") && mountOutput.contains(" ext4 ") else { + throw IntegrationError.assert(msg: "expected ext4 mount at /data, got: \(mountOutput)") + } + + let lsBuffer = BufferWriter() + let lsExec = try await verifyContainer.exec("verify-no-hello") { config in + config.arguments = ["ls", "-1", "/data"] + config.stdout = lsBuffer + } + try await lsExec.start() + status = try await lsExec.wait() + try await lsExec.delete() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls /data failed with status \(status)") + } + + let lsOutput = String(decoding: lsBuffer.data, as: UTF8.self) + let listedFiles = Set(lsOutput.split(whereSeparator: \.isNewline).map(String.init)) + guard !listedFiles.contains("trim.dat") else { + throw IntegrationError.assert(msg: "expected cloned /data to not contain trim.dat, got: \(lsOutput)") + } + + try await verifyContainer.kill(.kill) + _ = try await verifyContainer.wait() + try await verifyContainer.stop() + } catch { + try? await verifyContainer.stop() + throw error + } + } + + func testUseInitBasic() async throws { + let id = "test-use-init-basic" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/echo", "hello from init"] + config.process.stdout = buffer + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "hello from init\n" else { + throw IntegrationError.assert( + msg: "expected 'hello from init', got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'") + } + } + + func testUseInitExitCodePropagation() async throws { + let id = "test-use-init-exit-code" + + let bs = try await bootstrap(id) + + // Test exit code 0 + var container = try LinuxContainer("\(id)-success", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/true"] + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + var status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "expected exit code 0, got \(status.exitCode)") + } + + // Test non-zero exit code + container = try LinuxContainer("\(id)-failure", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/false"] + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + status = try await container.wait() + try await container.stop() + + guard status.exitCode == 1 else { + throw IntegrationError.assert(msg: "expected exit code 1, got \(status.exitCode)") + } + + // Test custom exit code + container = try LinuxContainer("\(id)-custom", rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sh", "-c", "exit 42"] + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + status = try await container.wait() + try await container.stop() + + guard status.exitCode == 42 else { + throw IntegrationError.assert(msg: "expected exit code 42, got \(status.exitCode)") + } + } + + func testUseInitSignalForwarding() async throws { + let id = "test-use-init-signal" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "300"] + config.useInit = true + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + try await Task.sleep(for: .milliseconds(100)) + + try await container.kill(.term) + + let status = try await container.wait(timeoutInSeconds: 5) + try await container.stop() + + // SIGTERM should result in exit code 128 + 15 = 143 + guard status.exitCode == 143 else { + throw IntegrationError.assert(msg: "expected exit code 143 (SIGTERM), got \(status.exitCode)") + } + } catch { + try? await container.stop() + throw error + } + } + + func testUseInitZombieReaping() async throws { + let id = "test-use-init-zombie-reaping" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + // This script creates an orphaned process that init must reap. + // The subshell exits immediately, orphaning the sleep process. + // Init should reap it when it exits. + config.process.arguments = [ + "/bin/sh", "-c", + """ + # Create orphans: subshell exits before its children + (/bin/sleep 0.1 &) + (/bin/sleep 0.1 &) + # Wait for orphans to complete + /bin/sleep 0.3 + # Check for zombie processes (Z state) + zombies=$(ps -eo stat 2>/dev/null | grep -c '^Z' || echo 0) + echo "zombie_count:$zombies" + """, + ] + config.process.stdout = buffer + config.useInit = true + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // Should report 0 zombies + guard output.contains("zombie_count:0") else { + throw IntegrationError.assert(msg: "expected zero zombies, got: \(output)") + } + } catch { + try? await container.stop() + throw error + } + } + + func testUseInitWithTerminal() async throws { + let id = "test-use-init-terminal" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sh", "-c", "tty && echo 'has tty'"] + config.process.terminal = true + config.process.stdout = buffer + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output.contains("has tty") else { + throw IntegrationError.assert(msg: "expected 'has tty' in output, got: \(output)") + } + } + + func testUseInitWithStdin() async throws { + let id = "test-use-init-stdin" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat"] + config.process.stdin = StdinBuffer(data: "input through init\n".data(using: .utf8)!) + config.process.stdout = buffer + config.useInit = true + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "input through init\n" else { + throw IntegrationError.assert( + msg: "expected 'input through init', got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'") + } + } + + #if os(macOS) + @available(macOS 26.0, *) + func testNetworkingDisabled() async throws { + let id = "test-networking-disabled" + let bs = try await bootstrap(id) + + let network = try VmnetNetwork() + var manager = try ContainerManager(vmm: bs.vmm, network: network) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs, + networking: false + ) { config in + config.process.arguments = ["ls", "-1", "/sys/class/net/"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls /sys/class/net/ failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // With networking disabled check we don't have an eth0. + let interfaces = output.trimmingCharacters(in: .whitespacesAndNewlines) + .split(separator: "\n") + .map { $0.trimmingCharacters(in: .whitespaces) } + + guard !interfaces.contains("eth0") else { + throw IntegrationError.assert( + msg: "expected no 'eth0' interface") + } + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testNetworkingEnabled() async throws { + let id = "test-networking-enabled" + let bs = try await bootstrap(id) + + let network = try VmnetNetwork() + var manager = try ContainerManager(vmm: bs.vmm, network: network) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + config.process.arguments = ["ls", "-1", "/sys/class/net/"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls /sys/class/net/ failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // With networking enabled (default), eth0 should be present alongside lo + let interfaces = Set( + output.trimmingCharacters(in: .whitespacesAndNewlines) + .split(separator: "\n") + .map { $0.trimmingCharacters(in: .whitespaces) } + ) + guard interfaces.contains("lo") else { + throw IntegrationError.assert(msg: "expected 'lo' interface, got: \(interfaces)") + } + guard interfaces.contains("eth0") else { + throw IntegrationError.assert(msg: "expected 'eth0' interface, got: \(interfaces)") + } + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testNetworkingEnabledIPv6() async throws { + let id = "test-networking-enabled-ipv6" + let bs = try await bootstrap(id) + + let network = try VmnetNetwork() + var manager = try ContainerManager(vmm: bs.vmm, network: network) + defer { + try? manager.delete(id) + } + + let buffer = BufferWriter() + let container = try await manager.create( + id, + image: bs.image, + rootfs: bs.rootfs + ) { config in + config.process.arguments = ["ip", "-6", "addr", "show", "eth0", "scope", "global"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 addr show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output.contains("inet6 fd") else { + throw IntegrationError.assert( + msg: "expected a global-scope IPv6 address on eth0, got: \(output)") + } + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6AddressAdd() async throws { + let id = "test-ipv6-address" + let bs = try await bootstrap(id) + + // Pin the v6 prefix so the allocator's first allocation yields fd00::2. + var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64")) + defer { + try? network.releaseInterface(id) + } + + guard let interface = try network.createInterface(id) else { + throw IntegrationError.assert(msg: "failed to create network interface") + } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Check that the IPv6 address was assigned to eth0. + let exec = try await container.exec("check-ipv6") { config in + config.arguments = ["ip", "-6", "addr", "show", "eth0"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 addr show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output.contains("fd00::2") else { + throw IntegrationError.assert( + msg: "expected fd00::2 in output, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6DefaultRoute() async throws { + let id = "test-ipv6-default-route" + let bs = try await bootstrap(id) + + // Pin the network's v6 prefix so the gateway is deterministically fd00::1 + // and the allocator's first allocation yields fd00::2. + var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64")) + defer { + try? network.releaseInterface(id) + } + + guard let interface = try network.createInterface(id) else { + throw IntegrationError.assert(msg: "failed to create network interface") + } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Inspect IPv6 routes inside the container. + let exec = try await container.exec("check-v6-route") { config in + config.arguments = ["ip", "-6", "route", "show"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // The default v6 route must point at the gateway we configured, on eth0. + guard output.contains("default via fd00::1 dev eth0") else { + throw IntegrationError.assert( + msg: "expected 'default via fd00::1 dev eth0' in v6 routes, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6GatewayOutsideSubnet() async throws { + let id = "test-ipv6-gateway-outside-subnet" + let bs = try await bootstrap(id) + + // Address in fd00::/120, gateway in fd01::/120 — subnets don't overlap, so the + // LinuxContainer wiring must add a /128 link route to the gateway before the + // default route. The two prefixes are independent so we drive this directly + // via NATInterface rather than the VmnetNetwork allocator (which always + // derives the gateway from the network's own prefix). + let interface = NATInterface( + ipv4Address: try CIDRv4("192.0.2.2/24"), + ipv4Gateway: try IPv4Address("192.0.2.1"), + ipv6Address: try CIDRv6("fd00::2/120"), + ipv6Gateway: try IPv6Address("fd01::1")) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let exec = try await container.exec("check-v6-routes") { config in + config.arguments = ["ip", "-6", "route", "show"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // Both the link-scoped route to the gateway AND the default via that gateway + // must be present. Without the link route, the kernel would refuse the default. + // Match the link route on a line that starts with the gateway address (no "via") + // so it can't be satisfied by a substring of the default-via line. + let lines = output.split(separator: "\n").map(String.init) + let hasLinkRoute = lines.contains { $0.hasPrefix("fd01::1 ") && $0.contains("dev eth0") && !$0.contains("via") } + guard hasLinkRoute else { + throw IntegrationError.assert( + msg: "expected an on-link route 'fd01::1 ... dev eth0' (no 'via') in v6 routes, got: \(output)") + } + guard output.contains("default via fd01::1 dev eth0") else { + throw IntegrationError.assert( + msg: "expected 'default via fd01::1 dev eth0' in v6 routes, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6OnlyDefaultRoute() async throws { + let id = "test-ipv6-only-default-route" + let bs = try await bootstrap(id) + + // Construct a NATInterface with a nil IPv4 gateway and a v6 gateway, so + // LinuxContainer takes the no-v4-gateway branch in setupInterface. The v4 + // address comes from TEST-NET-1; nothing in the test traffics over v4. + let interface = NATInterface( + ipv4Address: try CIDRv4("192.0.2.2/24"), + ipv4Gateway: nil, + ipv6Address: try CIDRv6("fd00::2/64"), + ipv6Gateway: try IPv6Address("fd00::1")) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let exec = try await container.exec("check-v6-route") { config in + config.arguments = ["ip", "-6", "route", "show"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output.contains("default via fd00::1 dev eth0") else { + throw IntegrationError.assert( + msg: "expected 'default via fd00::1 dev eth0' in v6 routes when ipv4Gateway is nil, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6OnlyGatewayOutsideSubnet() async throws { + let id = "test-ipv6-only-gateway-outside-subnet" + let bs = try await bootstrap(id) + + // No v4 gateway AND v6 gateway is outside the v6 subnet. Exercises + // setupInterface's "no v4 gateway, but v6 link route required before + // v6 default route" branch — the exact bug the helper extraction fixed. + let interface = NATInterface( + ipv4Address: try CIDRv4("192.0.2.2/24"), + ipv4Gateway: nil, + ipv6Address: try CIDRv6("fd00::2/120"), + ipv6Gateway: try IPv6Address("fd01::1")) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let exec = try await container.exec("check-v6-routes") { config in + config.arguments = ["ip", "-6", "route", "show"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + // Both the on-link route to the gateway AND the default via it must be present. + // Without the link route the kernel rejects the default — that was the bug. + let lines = output.split(separator: "\n").map(String.init) + let hasLinkRoute = lines.contains { $0.hasPrefix("fd01::1 ") && $0.contains("dev eth0") && !$0.contains("via") } + guard hasLinkRoute else { + throw IntegrationError.assert( + msg: "expected an on-link route 'fd01::1 ... dev eth0' (no 'via') in v6 routes, got: \(output)") + } + guard output.contains("default via fd01::1 dev eth0") else { + throw IntegrationError.assert( + msg: "expected 'default via fd01::1 dev eth0' in v6 routes, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + @available(macOS 26.0, *) + func testIPv6DualStack() async throws { + let id = "test-ipv6-dual-stack" + let bs = try await bootstrap(id) + + // Pin the network's v6 prefix so the gateway is deterministically fd00::1 + // and the allocator's first allocation yields fd00::2. + var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64")) + defer { + try? network.releaseInterface(id) + } + + guard let interface = try network.createInterface(id) else { + throw IntegrationError.assert(msg: "failed to create network interface") + } + + // Capture the v4 address vmnet allocated so we can assert it ends up on eth0. + let expectedV4 = interface.ipv4Address.address.description + + let addrBuffer = BufferWriter() + let routeBuffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.interfaces = [interface] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // `ip addr show` (no family flag) lists both v4 and v6. + let addrExec = try await container.exec("check-dual-stack-addr") { config in + config.arguments = ["ip", "addr", "show", "eth0"] + config.stdout = addrBuffer + } + try await addrExec.start() + let addrStatus = try await addrExec.wait() + try await addrExec.delete() + + guard addrStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip addr show failed with status \(addrStatus)") + } + + guard let addrOutput = String(data: addrBuffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert addr output to UTF8") + } + + guard addrOutput.contains(expectedV4) else { + throw IntegrationError.assert( + msg: "expected v4 address \(expectedV4) on eth0, got: \(addrOutput)") + } + guard addrOutput.contains("fd00::2") else { + throw IntegrationError.assert( + msg: "expected v6 address fd00::2 on eth0, got: \(addrOutput)") + } + + // The dual-stack default routes must both be installed. + let routeExec = try await container.exec("check-dual-stack-route") { config in + config.arguments = ["ip", "-6", "route", "show"] + config.stdout = routeBuffer + } + try await routeExec.start() + let routeStatus = try await routeExec.wait() + try await routeExec.delete() + + guard routeStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 route show failed with status \(routeStatus)") + } + + guard let routeOutput = String(data: routeBuffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert route output to UTF8") + } + + guard routeOutput.contains("default via fd00::1 dev eth0") else { + throw IntegrationError.assert( + msg: "expected 'default via fd00::1 dev eth0' in v6 routes, got: \(routeOutput)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + #endif + + func testSysctl() async throws { + let id = "test-container-sysctl" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.sysctl = [ + "net.core.somaxconn": "4096" + ] + config.process.arguments = ["cat", "/proc/sys/net/core/somaxconn"] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output == "4096" else { + throw IntegrationError.assert( + msg: "sysctl net.core.somaxconn should be '4096', got '\(output ?? "nil")'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testSysctlMultiple() async throws { + let id = "test-container-sysctl-multiple" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.sysctl = [ + "net.core.somaxconn": "2048", + "net.ipv4.ip_forward": "1", + ] + config.process.arguments = [ + "/bin/sh", "-c", + "cat /proc/sys/net/core/somaxconn && cat /proc/sys/net/ipv4/ip_forward", + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + let lines = output?.split(separator: "\n").map { $0.trimmingCharacters(in: .whitespaces) } + guard lines == ["2048", "1"] else { + throw IntegrationError.assert( + msg: "expected sysctls ['2048', '1'], got '\(output ?? "nil")'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testNoNewPrivileges() async throws { + let id = "test-no-new-privileges" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat", "/proc/self/status"] + config.process.noNewPrivileges = true + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // /proc/self/status contains "NoNewPrivs:\t1" when the bit is set + guard output.contains("NoNewPrivs:\t1") else { + throw IntegrationError.assert(msg: "expected NoNewPrivs to be 1, got: \(output)") + } + } + + func testNoNewPrivilegesDisabled() async throws { + let id = "test-no-new-privileges-disabled" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["cat", "/proc/self/status"] + // noNewPrivileges defaults to false + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // When noNewPrivileges is not set, NoNewPrivs should be 0 + guard output.contains("NoNewPrivs:\t0") else { + throw IntegrationError.assert(msg: "expected NoNewPrivs to be 0, got: \(output)") + } + } + + func testWorkingDirCreated() async throws { + let id = "test-working-dir-created" + let bs = try await bootstrap(id) + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/pwd"] + config.process.workingDirectory = "/does/not/exist" + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process with non-existent workingDir failed: \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to read stdout") + } + + guard output == "/does/not/exist" else { + throw IntegrationError.assert(msg: "expected cwd '/does/not/exist', got '\(output)'") + } + } catch { + try? await container.stop() + throw error + } + } + + func testWorkingDirExecCreated() async throws { + let id = "test-working-dir-exec-created" + let bs = try await bootstrap(id) + + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let buffer = BufferWriter() + let exec = try await container.exec("cwd-exec") { config in + config.arguments = ["/bin/pwd"] + config.workingDirectory = "/a/b/c/d" + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec with non-existent workingDir failed: \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to read stdout") + } + + guard output == "/a/b/c/d" else { + throw IntegrationError.assert(msg: "expected cwd '/a/b/c/d', got '\(output)'") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testNoNewPrivilegesExec() async throws { + let id = "test-no-new-privileges-exec" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "100"] + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + // Exec a process with noNewPrivileges set + let buffer = BufferWriter() + let exec = try await container.exec("nnp-exec") { config in + config.arguments = ["cat", "/proc/self/status"] + config.noNewPrivileges = true + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.contains("NoNewPrivs:\t1") else { + throw IntegrationError.assert(msg: "expected NoNewPrivs to be 1 in exec, got: \(output)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + func testVMResourceOverhead() async throws { + let id = "test-vm-resource-overhead" + + let bs = try await bootstrap(id) + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["sleep", "infinity"] + config.cpus = 2 + config.memoryInBytes = 256.mib() + config.cpuOverhead = 2 + config.memoryOverhead = 1024.mib() + config.bootLog = bs.bootLog + } + + do { + try await container.create() + try await container.start() + + let cpuBuffer = BufferWriter() + let cpuExec = try await container.exec("check-nproc") { config in + config.arguments = ["nproc"] + config.stdout = cpuBuffer + } + try await cpuExec.start() + var status = try await cpuExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "nproc status \(status) != 0") + } + try await cpuExec.delete() + + guard let cpuStr = String(data: cpuBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines), + let cpuCount = Int(cpuStr) + else { + throw IntegrationError.assert(msg: "failed to parse nproc output") + } + let expectedCpus = 4 + guard cpuCount == expectedCpus else { + throw IntegrationError.assert(msg: "nproc \(cpuCount) != expected \(expectedCpus)") + } + + let memBuffer = BufferWriter() + let memExec = try await container.exec("check-meminfo") { config in + config.arguments = ["sh", "-c", "grep MemTotal /proc/meminfo | awk '{print $2}'"] + config.stdout = memBuffer + } + try await memExec.start() + status = try await memExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "meminfo status \(status) != 0") + } + try await memExec.delete() + + guard let memStr = String(data: memBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines), + let memTotalKiB = UInt64(memStr) + else { + throw IntegrationError.assert(msg: "failed to parse MemTotal") + } + let memTotalBytes = memTotalKiB * 1024 + let expectedMin: UInt64 = 1024.mib() + guard memTotalBytes > expectedMin else { + throw IntegrationError.assert( + msg: "MemTotal \(memTotalBytes) should exceed \(expectedMin)") + } + + try await container.kill(.kill) + try await container.wait() + try await container.stop() + } catch { + try? await container.stop() + throw error + } + } + + // Verify that mounts are sorted by destination path depth so that a + // higher-level mount (e.g. /mnt) doesn't shadow a deeper mount + // (e.g. /mnt/deep/nested). Both directories are separate virtiofs + // shares; the sort ensures /mnt is mounted first and /mnt/deep/nested + // on top of it. + func testMountsSortedByDepth() async throws { + let id = "test-mount-sort-depth" + + let bs = try await bootstrap(id) + let buffer = BufferWriter() + + // Create two separate mount directories with distinct files. + let deepDir = FileManager.default.uniqueTemporaryDirectory(create: true) + try "deep-content".write(to: deepDir.appendingPathComponent("deep.txt"), atomically: true, encoding: .utf8) + + let shallowDir = FileManager.default.uniqueTemporaryDirectory(create: true) + try "shallow-content".write(to: shallowDir.appendingPathComponent("shallow.txt"), atomically: true, encoding: .utf8) + + // Add deeper mount first, then shallower mount. Without sorting the + // shallower mount would shadow the deeper one. + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.process.arguments = ["/bin/cat", "/mnt/deep/nested/deep.txt"] + config.mounts.append(.share(source: deepDir.path, destination: "/mnt/deep/nested")) + config.mounts.append(.share(source: shallowDir.path, destination: "/mnt")) + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let value = String(data: buffer.data, encoding: .utf8) + guard value == "deep-content" else { + throw IntegrationError.assert( + msg: "expected 'deep-content' but got '\(value ?? "")'") + } + } +} diff --git a/Sources/Integration/NBDServer.swift b/Sources/Integration/NBDServer.swift new file mode 100644 index 0000000..982c875 --- /dev/null +++ b/Sources/Integration/NBDServer.swift @@ -0,0 +1,383 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Foundation +import Logging +import NIOCore +import NIOPosix + +#if os(macOS) +/// A minimal NBD server for integration testing. +/// +/// Serves a file-backed block device using the NBD newstyle handshake protocol. +/// Supports both TCP and Unix domain socket transports. +final class NBDServer: Sendable { + private let channel: Channel + private let socketPath: String? + private let group: EventLoopGroup + let url: String + + init(filePath: String, socketPath: String, logger: Logger? = nil) throws { + self.socketPath = socketPath + self.group = MultiThreadedEventLoopGroup(numberOfThreads: 1) + + try? FileManager.default.removeItem(atPath: socketPath) + + self.channel = try Self.bootstrap(group: self.group, filePath: filePath, logger: logger) + .bind(unixDomainSocketPath: socketPath) + .wait() + self.url = "nbd+unix:///?socket=\(socketPath)" + } + + init(filePath: String, port: Int, logger: Logger? = nil) throws { + self.socketPath = nil + self.group = MultiThreadedEventLoopGroup(numberOfThreads: 1) + + self.channel = try Self.bootstrap(group: self.group, filePath: filePath, logger: logger) + .bind(host: "127.0.0.1", port: port) + .wait() + + guard let boundPort = channel.localAddress?.port, boundPort > 0 else { + throw ContainerizationError(.internalError, message: "NBD server failed to bind to a port") + } + self.url = "nbd://127.0.0.1:\(boundPort)" + } + + func stop() { + try? channel.close().wait() + try? group.syncShutdownGracefully() + if let socketPath { + try? FileManager.default.removeItem(atPath: socketPath) + } + } + + private static func bootstrap(group: EventLoopGroup, filePath: String, logger: Logger?) -> ServerBootstrap { + ServerBootstrap(group: group) + .serverChannelOption(.socketOption(.so_reuseaddr), value: 1) + .childChannelInitializer { channel in + channel.eventLoop.makeCompletedFuture { + try channel.pipeline.syncOperations.addHandler( + NBDConnectionHandler(filePath: filePath, logger: logger) + ) + } + } + } +} + +private final class NBDConnectionHandler: ChannelInboundHandler { + typealias InboundIn = ByteBuffer + typealias OutboundOut = ByteBuffer + + // Protocol constants + static let magic: UInt64 = 0x4e42_444d_4147_4943 + static let ihaveopt: UInt64 = 0x4948_4156_454f_5054 + static let replyMagic: UInt64 = 0x3_e889_0455_65a9 + static let requestMagic: UInt32 = 0x2560_9513 + static let simpleReplyMagic: UInt32 = 0x6744_6698 + + static let optExportName: UInt32 = 1 + static let optAbort: UInt32 = 2 + static let optInfo: UInt32 = 6 + static let optGo: UInt32 = 7 + + static let cmdRead: UInt16 = 0 + static let cmdWrite: UInt16 = 1 + static let cmdDisc: UInt16 = 2 + static let cmdFlush: UInt16 = 3 + + static let flagFixedNewstyle: UInt16 = 0x1 + static let flagNoZeroes: UInt16 = 0x2 + static let clientFlagFixedNewstyle: UInt32 = 0x1 + static let clientFlagNoZeroes: UInt32 = 0x2 + static let transmitHasFlags: UInt16 = 0x1 + static let transmitSendFlush: UInt16 = 0x4 + static let transmitSendFUA: UInt16 = 0x8 + + static let repACK: UInt32 = 1 + static let repInfo: UInt32 = 3 + static let repErrUnsup: UInt32 = 0x8000_0001 + static let infoExport: UInt16 = 0 + static let infoBlockSize: UInt16 = 3 + + // NBD error codes + static let errOK: UInt32 = 0 + static let errIO: UInt32 = 5 + static let errNotsup: UInt32 = 95 + + private let fileFD: Int32 + private let fileSize: UInt64 + private let logger: Logger? + private var buffer: ByteBuffer = ByteBuffer() + private var state: ConnectionState = .handshake + + private enum ConnectionState { + case handshake + case options(noZeroes: Bool) + case transmission + } + + init(filePath: String, logger: Logger?) { + self.fileFD = open(filePath, O_RDWR) + self.logger = logger + guard fileFD >= 0 else { + self.fileSize = 0 + logger?.error("NBD server: failed to open \(filePath), errno=\(errno)") + return + } + var st = stat() + if fstat(self.fileFD, &st) == 0 { + self.fileSize = UInt64(st.st_size) + } else { + self.fileSize = 0 + } + } + + func channelActive(context: ChannelHandlerContext) { + guard fileFD >= 0 else { + context.close(promise: nil) + return + } + // Send initial handshake. + var buf = context.channel.allocator.buffer(capacity: 18) + buf.writeInteger(Self.magic) + buf.writeInteger(Self.ihaveopt) + buf.writeInteger(Self.flagFixedNewstyle | Self.flagNoZeroes) + context.writeAndFlush(wrapOutboundOut(buf), promise: nil) + } + + func channelInactive(context: ChannelHandlerContext) { + if fileFD >= 0 { + close(fileFD) + } + } + + func channelRead(context: ChannelHandlerContext, data: NIOAny) { + var incoming = unwrapInboundIn(data) + buffer.writeBuffer(&incoming) + processBuffer(context: context) + } + + private func processBuffer(context: ChannelHandlerContext) { + while true { + switch state { + case .handshake: + guard buffer.readableBytes >= 4, + let clientFlags = buffer.readInteger(as: UInt32.self) + else { + return + } + guard clientFlags & Self.clientFlagFixedNewstyle != 0 else { + context.close(promise: nil) + return + } + let noZeroes = clientFlags & Self.clientFlagNoZeroes != 0 + state = .options(noZeroes: noZeroes) + + case .options(let noZeroes): + guard buffer.readableBytes >= 16 else { + return + } + // Peek at the header without consuming. + let readerIndex = buffer.readerIndex + guard let magic = buffer.getInteger(at: readerIndex, as: UInt64.self), + let optType = buffer.getInteger(at: readerIndex + 8, as: UInt32.self), + let dataLen = buffer.getInteger(at: readerIndex + 12, as: UInt32.self) + else { + context.close(promise: nil) + return + } + + // Wait until we have the full option data. + guard buffer.readableBytes >= 16 + Int(dataLen) else { + return + } + // Consume the header. + buffer.moveReaderIndex(forwardBy: 16) + + guard magic == Self.ihaveopt else { + context.close(promise: nil) + return + } + + let transmitFlags = Self.transmitHasFlags | Self.transmitSendFlush | Self.transmitSendFUA + + switch optType { + case Self.optExportName: + if dataLen > 0 { + buffer.moveReaderIndex(forwardBy: Int(dataLen)) + } + var reply = context.channel.allocator.buffer(capacity: 10) + reply.writeInteger(fileSize) + reply.writeInteger(transmitFlags) + if !noZeroes { + reply.writeRepeatingByte(0, count: 124) + } + context.writeAndFlush(wrapOutboundOut(reply), promise: nil) + state = .transmission + + case Self.optInfo, Self.optGo: + // Parse InfoRequest to check for block size request. + var requestedBlockSize = false + if dataLen >= 6 { + let optDataStart = buffer.readerIndex + let nameLen = Int(buffer.getInteger(at: optDataStart, as: UInt32.self) ?? 0) + let infoOffset = optDataStart + 4 + nameLen + if infoOffset + 2 <= optDataStart + Int(dataLen) { + let numReqs = Int(buffer.getInteger(at: infoOffset, as: UInt16.self) ?? 0) + for i in 0.. 0 { + buffer.moveReaderIndex(forwardBy: Int(dataLen)) + } + + // Send NBD_INFO_EXPORT reply. + var exportInfo = context.channel.allocator.buffer(capacity: 32) + writeOptReply(&exportInfo, optType: optType, replyType: Self.repInfo, dataLen: 12) + exportInfo.writeInteger(Self.infoExport) + exportInfo.writeInteger(fileSize) + exportInfo.writeInteger(transmitFlags) + + // Send NBD_INFO_BLOCK_SIZE if requested. + if requestedBlockSize { + writeOptReply(&exportInfo, optType: optType, replyType: Self.repInfo, dataLen: 14) + exportInfo.writeInteger(Self.infoBlockSize) + exportInfo.writeInteger(UInt32(1)) // minimum + exportInfo.writeInteger(UInt32(4096)) // preferred + exportInfo.writeInteger(UInt32(4096 * 32)) // maximum + } + + writeOptReply(&exportInfo, optType: optType, replyType: Self.repACK, dataLen: 0) + context.writeAndFlush(wrapOutboundOut(exportInfo), promise: nil) + + if optType == Self.optGo { + state = .transmission + } + + case Self.optAbort: + if dataLen > 0 { + buffer.moveReaderIndex(forwardBy: Int(dataLen)) + } + context.close(promise: nil) + return + + default: + if dataLen > 0 { + buffer.moveReaderIndex(forwardBy: Int(dataLen)) + } + var reply = context.channel.allocator.buffer(capacity: 20) + writeOptReply(&reply, optType: optType, replyType: Self.repErrUnsup, dataLen: 0) + context.writeAndFlush(wrapOutboundOut(reply), promise: nil) + } + + case .transmission: + // Request header: 4 magic + 2 flags + 2 type + 8 cookie + 8 offset + 4 length = 28 + guard buffer.readableBytes >= 28 else { + return + } + let readerIndex = buffer.readerIndex + guard let magic = buffer.getInteger(at: readerIndex, as: UInt32.self), + let cmdType = buffer.getInteger(at: readerIndex + 6, as: UInt16.self), + let cookie = buffer.getInteger(at: readerIndex + 8, as: UInt64.self), + let offset = buffer.getInteger(at: readerIndex + 16, as: UInt64.self), + let length = buffer.getInteger(at: readerIndex + 24, as: UInt32.self) + else { + context.close(promise: nil) + return + } + guard magic == Self.requestMagic else { + context.close(promise: nil) + return + } + + switch cmdType { + case Self.cmdWrite: + // Need the full write payload before processing. + guard buffer.readableBytes >= 28 + Int(length) else { + return + } + buffer.moveReaderIndex(forwardBy: 28) + var writeData = [UInt8](repeating: 0, count: Int(length)) + buffer.readWithUnsafeReadableBytes { ptr in + writeData.withUnsafeMutableBytes { dst in + guard let dstBase = dst.baseAddress, let srcBase = ptr.baseAddress else { + return + } + _ = memcpy(dstBase, srcBase, Int(length)) + } + return Int(length) + } + let n = pwrite(fileFD, &writeData, Int(length), off_t(offset)) + var reply = context.channel.allocator.buffer(capacity: 16) + writeSimpleReply(&reply, cookie: cookie, error: n < 0 ? Self.errIO : Self.errOK) + context.writeAndFlush(wrapOutboundOut(reply), promise: nil) + + case Self.cmdRead: + buffer.moveReaderIndex(forwardBy: 28) + var readBuf = [UInt8](repeating: 0, count: Int(length)) + let n = pread(fileFD, &readBuf, Int(length), off_t(offset)) + var reply = context.channel.allocator.buffer(capacity: 16 + Int(length)) + writeSimpleReply(&reply, cookie: cookie, error: n < 0 ? Self.errIO : Self.errOK) + if n >= 0 { + reply.writeBytes(readBuf[0.. Containerization.Mount { + let clonePath = Self.testDir.appending(component: "\(testID)-\(containerID).ext4").absolutePath() + try? FileManager.default.removeItem(atPath: clonePath) + return try rootfs.clone(to: clonePath) + } + + func testPodSingleContainer() async throws { + let id = "test-pod-single-container" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/true"] + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + } + + func testPodMultipleContainers() async throws { + let id = "test-pod-multiple-containers" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/true"] + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/echo", "hello"] + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 status \(status1) != 0") + } + + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 status \(status2) != 0") + } + } + + func testPodContainerOutput() async throws { + let id = "test-pod-container-output" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/echo", "hello from pod"] + config.process.stdout = buffer + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "hello from pod\n" else { + throw IntegrationError.assert( + msg: "process should have returned on stdout 'hello from pod' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testPodConcurrentContainers() async throws { + let id = "test-pod-concurrent-containers" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + // Add 5 containers + for i in 0..<5 { + try await pod.addContainer("container\(i)", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container\(i)")) { config in + config.process.arguments = ["/bin/sleep", "1"] + } + } + + try await pod.create() + + // Start all containers concurrently + try await withThrowingTaskGroup(of: Void.self) { group in + for i in 0..<5 { + group.addTask { + try await pod.startContainer("container\(i)") + } + } + try await group.waitForAll() + } + + // Wait for all containers concurrently + try await withThrowingTaskGroup(of: Void.self) { group in + for i in 0..<5 { + group.addTask { + let status = try await pod.waitContainer("container\(i)") + if status.exitCode != 0 { + throw IntegrationError.assert(msg: "container\(i) status \(status) != 0") + } + } + } + try await group.waitForAll() + } + + try await pod.stop() + } + + func testPodExecInContainer() async throws { + let id = "test-pod-exec-in-container" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "100"] + } + + try await pod.create() + try await pod.startContainer("container1") + + let buffer = BufferWriter() + let exec = try await pod.execInContainer("container1", processID: "exec1") { config in + config.arguments = ["/bin/echo", "exec test"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "exec test\n" else { + throw IntegrationError.assert( + msg: "exec should have returned 'exec test' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testPodExecInContainerEnv() async throws { + let id = "test-pod-exec-in-container-env" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "100"] + config.process.environmentVariables.append("MY_VAR=hello_from_container") + } + + try await pod.create() + try await pod.startContainer("container1") + + let buffer = BufferWriter() + let exec = try await pod.execInContainer("container1", processID: "exec1") { config in + config.arguments = ["/bin/sh", "-c", "printenv MY_VAR"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec env status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "hello_from_container\n" else { + throw IntegrationError.assert( + msg: "exec should have inherited container env MY_VAR=hello_from_container, got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'") + } + } + + func testPodContainerHostname() async throws { + let id = "test-pod-container-hostname" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/hostname"] + config.hostname = "my-pod-container" + config.process.stdout = buffer + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "my-pod-container\n" else { + throw IntegrationError.assert( + msg: "hostname should be 'my-pod-container' != '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testPodContainerHostnameDefaultsToContainerID() async throws { + let id = "test-pod-container-hostname-default" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "container1\n" else { + throw IntegrationError.assert( + msg: "hostname should default to container id 'container1', got '\(String(data: buffer.data, encoding: .utf8)!)'") + } + } + + func testPodStopContainerIdempotency() async throws { + let id = "test-pod-stop-container-idempotency" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/true"] + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + // Stop container twice - should not fail + try await pod.stopContainer("container1") + try await pod.stopContainer("container1") + + try await pod.stop() + } + + func testPodListContainers() async throws { + let id = "test-pod-list-containers" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let containerIDs = ["container1", "container2", "container3"] + for containerID in containerIDs { + try await pod.addContainer(containerID, rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: containerID)) { config in + config.process.arguments = ["/bin/true"] + } + } + + let listedContainers = await pod.listContainers() + + guard Set(listedContainers) == Set(containerIDs) else { + throw IntegrationError.assert( + msg: "listed containers \(listedContainers) != expected \(containerIDs)") + } + + try await pod.create() + try await pod.stop() + } + + func testPodContainerStatistics() async throws { + let id = "test-pod-container-statistics" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + try await pod.startContainer("container2") + + let stats = try await pod.statistics() + + guard stats.count == 2 else { + throw IntegrationError.assert(msg: "expected 2 container stats, got \(stats.count)") + } + + let containerIDs = Set(stats.map { $0.id }) + guard containerIDs == Set(["container1", "container2"]) else { + throw IntegrationError.assert(msg: "unexpected container IDs in stats: \(containerIDs)") + } + + for stat in stats { + guard let process = stat.process, process.current > 0 else { + throw IntegrationError.assert(msg: "container \(stat.id) process count should be > 0") + } + + guard let memory = stat.memory, memory.usageBytes > 0 else { + throw IntegrationError.assert(msg: "container \(stat.id) memory usage should be > 0") + } + + print("Container \(stat.id) statistics:") + print(" Processes: \(process.current)") + print(" Memory: \(memory.usageBytes) bytes") + print(" CPU: \(stat.cpu?.usageUsec ?? 0) usec") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodMemoryEventsOOMKill() async throws { + let id = "test-pod-memory-events-oom-kill" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let exec = try await pod.execInContainer("container1", processID: "oom-trigger") { config in + config.arguments = [ + "sh", + "-c", + "echo 2097152 > /sys/fs/cgroup/memory.max && dd if=/dev/zero of=/dev/null bs=100M", + ] + } + + try await exec.start() + let status = try await exec.wait() + if status.exitCode == 0 { + throw IntegrationError.assert(msg: "expected exit code > 0") + } + try await exec.delete() + + let stats = try await pod.statistics(containerIDs: ["container1"], categories: .memoryEvents) + + guard let containerStats = stats.first, let events = containerStats.memoryEvents else { + throw IntegrationError.assert(msg: "expected memoryEvents to be present") + } + + print("Memory events for pod container container1:") + print(" low: \(events.low)") + print(" high: \(events.high)") + print(" max: \(events.max)") + print(" oom: \(events.oom)") + print(" oomKill: \(events.oomKill)") + + guard events.oomKill > 0 else { + throw IntegrationError.assert(msg: "expected oomKill > 0, got \(events.oomKill)") + } + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodContainerResourceLimits() async throws { + let id = "test-pod-container-resource-limits" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + config.cpus = 2 + config.memoryInBytes = 256.mib() + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + // Verify memory limit + let memoryBuffer = BufferWriter() + let memoryExec = try await pod.execInContainer("container1", processID: "check-memory") { config in + config.arguments = ["cat", "/sys/fs/cgroup/memory.max"] + config.stdout = memoryBuffer + } + try await memoryExec.start() + var status = try await memoryExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-memory status \(status) != 0") + } + try await memoryExec.delete() + + guard let memoryLimit = String(data: memoryBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse memory.max") + } + let expectedMemory = "\(256.mib())" + guard memoryLimit == expectedMemory else { + throw IntegrationError.assert(msg: "memory.max \(memoryLimit) != expected \(expectedMemory)") + } + + // Verify CPU limit + let cpuBuffer = BufferWriter() + let cpuExec = try await pod.execInContainer("container1", processID: "check-cpu") { config in + config.arguments = ["cat", "/sys/fs/cgroup/cpu.max"] + config.stdout = cpuBuffer + } + try await cpuExec.start() + status = try await cpuExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-cpu status \(status) != 0") + } + try await cpuExec.delete() + + guard let cpuLimit = String(data: cpuBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse cpu.max") + } + let expectedCpu = "200000 100000" // 2 CPUs: quota=200000, period=100000 + guard cpuLimit == expectedCpu else { + throw IntegrationError.assert(msg: "cpu.max '\(cpuLimit)' != expected '\(expectedCpu)'") + } + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodContainerFilesystemIsolation() async throws { + let id = "test-pod-container-filesystem-isolation" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + try await pod.startContainer("container2") + + // Write a file in container1 + let writeExec = try await pod.execInContainer("container1", processID: "write-file") { config in + config.arguments = ["sh", "-c", "echo 'secret data' > /tmp/container1-secret.txt"] + } + try await writeExec.start() + var status = try await writeExec.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "write-file status \(status) != 0") + } + try await writeExec.delete() + + // Verify the file exists in container1 + let readBuffer1 = BufferWriter() + let readExec1 = try await pod.execInContainer("container1", processID: "read-file-1") { config in + config.arguments = ["cat", "/tmp/container1-secret.txt"] + config.stdout = readBuffer1 + } + try await readExec1.start() + status = try await readExec1.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "read-file-1 status \(status) != 0") + } + try await readExec1.delete() + + guard String(data: readBuffer1.data, encoding: .utf8) == "secret data\n" else { + throw IntegrationError.assert(msg: "file content in container1 should be 'secret data'") + } + + // Try to read the file from container2 - should fail + let readExec2 = try await pod.execInContainer("container2", processID: "read-file-2") { config in + config.arguments = ["cat", "/tmp/container1-secret.txt"] + } + try await readExec2.start() + status = try await readExec2.wait() + try await readExec2.delete() + + // File should NOT exist in container2, so cat should fail + guard status.exitCode != 0 else { + throw IntegrationError.assert(msg: "file should NOT be accessible from container2") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodContainerPIDNamespaceIsolation() async throws { + let id = "test-pod-container-pid-isolation" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + try await pod.startContainer("container2") + + // Start a unique process in container1 + let sleepExec1 = try await pod.execInContainer("container1", processID: "unique-sleep-1") { config in + config.arguments = ["/bin/sleep", "9999"] + } + try await sleepExec1.start() + + // List processes in container1 - should see sleep 9999 + let ps1Buffer = BufferWriter() + let psExec1 = try await pod.execInContainer("container1", processID: "ps-1") { config in + config.arguments = ["ps", "aux"] + config.stdout = ps1Buffer + } + try await psExec1.start() + var status = try await psExec1.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ps-1 status \(status) != 0") + } + try await psExec1.delete() + + guard let ps1Output = String(data: ps1Buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to parse ps output from container1") + } + + // Verify sleep 9999 is visible in container1 + guard ps1Output.contains("sleep 9999") else { + throw IntegrationError.assert(msg: "sleep 9999 should be visible in container1") + } + + // List processes in container2 - should NOT see sleep 9999 + let ps2Buffer = BufferWriter() + let psExec2 = try await pod.execInContainer("container2", processID: "ps-2") { config in + config.arguments = ["ps", "aux"] + config.stdout = ps2Buffer + } + try await psExec2.start() + status = try await psExec2.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ps-2 status \(status) != 0") + } + try await psExec2.delete() + + guard let ps2Output = String(data: ps2Buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to parse ps output from container2") + } + + // Verify sleep 9999 is NOT visible in container2 + guard !ps2Output.contains("sleep 9999") else { + throw IntegrationError.assert(msg: "sleep 9999 should NOT be visible in container2 (PID namespace isolation failed)") + } + + try await sleepExec1.delete() + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodContainerIndependentResourceLimits() async throws { + let id = "test-pod-container-independent-limits" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + // Container1 with 1 CPU and 128 MiB memory + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + config.cpus = 1 + config.memoryInBytes = 128.mib() + } + + // Container2 with 2 CPUs and 256 MiB memory + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/sleep", "infinity"] + config.cpus = 2 + config.memoryInBytes = 256.mib() + } + + do { + try await pod.create() + try await pod.startContainer("container1") + try await pod.startContainer("container2") + + // Verify container1 memory limit + let mem1Buffer = BufferWriter() + let memExec1 = try await pod.execInContainer("container1", processID: "check-mem-1") { config in + config.arguments = ["cat", "/sys/fs/cgroup/memory.max"] + config.stdout = mem1Buffer + } + try await memExec1.start() + var status = try await memExec1.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-mem-1 status \(status) != 0") + } + try await memExec1.delete() + + guard let mem1Limit = String(data: mem1Buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse memory.max from container1") + } + + let expectedMem1 = "\(128.mib())" + guard mem1Limit == expectedMem1 else { + throw IntegrationError.assert(msg: "container1 memory.max \(mem1Limit) != expected \(expectedMem1)") + } + + // Verify container1 CPU limit + let cpu1Buffer = BufferWriter() + let cpuExec1 = try await pod.execInContainer("container1", processID: "check-cpu-1") { config in + config.arguments = ["cat", "/sys/fs/cgroup/cpu.max"] + config.stdout = cpu1Buffer + } + try await cpuExec1.start() + status = try await cpuExec1.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-cpu-1 status \(status) != 0") + } + try await cpuExec1.delete() + + guard let cpu1Limit = String(data: cpu1Buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse cpu.max from container1") + } + + let expectedCpu1 = "100000 100000" // 1 CPU + guard cpu1Limit == expectedCpu1 else { + throw IntegrationError.assert(msg: "container1 cpu.max '\(cpu1Limit)' != expected '\(expectedCpu1)'") + } + + // Verify container2 memory limit + let mem2Buffer = BufferWriter() + let memExec2 = try await pod.execInContainer("container2", processID: "check-mem-2") { config in + config.arguments = ["cat", "/sys/fs/cgroup/memory.max"] + config.stdout = mem2Buffer + } + try await memExec2.start() + status = try await memExec2.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-mem-2 status \(status) != 0") + } + try await memExec2.delete() + + guard let mem2Limit = String(data: mem2Buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse memory.max from container2") + } + + let expectedMem2 = "\(256.mib())" + guard mem2Limit == expectedMem2 else { + throw IntegrationError.assert(msg: "container2 memory.max \(mem2Limit) != expected \(expectedMem2)") + } + + // Verify container2 CPU limit + let cpu2Buffer = BufferWriter() + let cpuExec2 = try await pod.execInContainer("container2", processID: "check-cpu-2") { config in + config.arguments = ["cat", "/sys/fs/cgroup/cpu.max"] + config.stdout = cpu2Buffer + } + try await cpuExec2.start() + status = try await cpuExec2.wait() + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "check-cpu-2 status \(status) != 0") + } + try await cpuExec2.delete() + + guard let cpu2Limit = String(data: cpu2Buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to parse cpu.max from container2") + } + + let expectedCpu2 = "200000 100000" // 2 CPUs + guard cpu2Limit == expectedCpu2 else { + throw IntegrationError.assert(msg: "container2 cpu.max '\(cpu2Limit)' != expected '\(expectedCpu2)'") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodSharedPIDNamespace() async throws { + let id = "test-pod-shared-pid-namespace" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.shareProcessNamespace = true + } + + // First container runs a long-running process + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/sleep", "300"] + } + + // Second container checks if it can see container1's sleep process + let psBuffer = BufferWriter() + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/sh", "-c", "ps aux | grep 'sleep 300' | grep -v grep"] + config.process.stdout = psBuffer + } + + try await pod.create() + try await pod.startContainer("container1") + try await Task.sleep(for: .milliseconds(100)) + + try await pod.startContainer("container2") + let status = try await pod.waitContainer("container2") + + try await pod.killContainer("container1", signal: .kill) + _ = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 should have found the sleep process (status: \(status))") + } + + let output = String(data: psBuffer.data, encoding: .utf8) ?? "" + guard output.contains("sleep 300") else { + throw IntegrationError.assert(msg: "ps output should contain 'sleep 300', got: '\(output)'") + } + } + + func testPodReadOnlyRootfs() async throws { + let id = "test-pod-readonly-rootfs" + + let bs = try await bootstrap(id) + var rootfs = bs.rootfs + rootfs.options.append("ro") + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: rootfs) { config in + config.process.arguments = ["touch", "/testfile"] + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + // touch should fail on a read-only rootfs + guard status.exitCode != 0 else { + throw IntegrationError.assert(msg: "touch should have failed on read-only rootfs") + } + } + + func testPodReadOnlyRootfsDNSConfigured() async throws { + let id = "test-pod-readonly-rootfs-dns" + + let bs = try await bootstrap(id) + var rootfs = bs.rootfs + rootfs.options.append("ro") + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: rootfs) { config in + // Verify /etc/resolv.conf was written before rootfs was remounted read-only + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer + config.dns = DNS(nameservers: ["8.8.8.8", "8.8.4.4"]) + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat /etc/resolv.conf failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.contains("8.8.8.8") && output.contains("8.8.4.4") else { + throw IntegrationError.assert(msg: "expected /etc/resolv.conf to contain DNS servers, got: \(output)") + } + } + + func testPodSingleFileMount() async throws { + let id = "test-pod-single-file-mount" + + let bs = try await bootstrap(id) + + // Create a temp file with known content + let testContent = "Hello from pod single file mount!" + let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true) + .appendingPathComponent("pod-config.txt") + try testContent.write(to: hostFile, atomically: true, encoding: .utf8) + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["cat", "/etc/myconfig.txt"] + // Mount a single file using virtiofs share + config.mounts.append(.share(source: hostFile.path, destination: "/etc/myconfig.txt")) + config.process.stdout = buffer + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output == testContent else { + throw IntegrationError.assert( + msg: "expected '\(testContent)', got '\(output)'") + } + } catch { + try? await pod.stop() + throw error + } + } + + func testPodContainerHostsConfig() async throws { + let id = "test-pod-container-hosts" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry.localHostIPV6(), + Hosts.Entry(ipAddress: "10.0.0.50", hostnames: ["myservice.local", "myservice"]), + ]) + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "cat /etc/hosts failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output.contains("10.0.0.50") && output.contains("myservice.local") else { + throw IntegrationError.assert(msg: "expected /etc/hosts to contain custom entry, got: \(output)") + } + } + + func testPodMultipleContainersDifferentDNS() async throws { + let id = "test-pod-multi-dns" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer1 + config.dns = DNS(nameservers: ["1.1.1.1"]) + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer2 + config.dns = DNS(nameservers: ["8.8.8.8"]) + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + guard output1.contains("1.1.1.1") && !output1.contains("8.8.8.8") else { + throw IntegrationError.assert(msg: "container1 should have 1.1.1.1 DNS, got: \(output1)") + } + guard output2.contains("8.8.8.8") && !output2.contains("1.1.1.1") else { + throw IntegrationError.assert(msg: "container2 should have 8.8.8.8 DNS, got: \(output2)") + } + } + + func testPodMultipleContainersDifferentHosts() async throws { + let id = "test-pod-multi-hosts" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer1 + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry(ipAddress: "10.0.0.1", hostnames: ["service-a.local", "service-a"]), + ]) + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer2 + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry(ipAddress: "10.0.0.2", hostnames: ["service-b.local", "service-b"]), + ]) + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + guard output1.contains("10.0.0.1") && output1.contains("service-a.local") else { + throw IntegrationError.assert(msg: "container1 should have service-a entry, got: \(output1)") + } + guard !output1.contains("10.0.0.2") && !output1.contains("service-b") else { + throw IntegrationError.assert(msg: "container1 should NOT have service-b entry, got: \(output1)") + } + + guard output2.contains("10.0.0.2") && output2.contains("service-b.local") else { + throw IntegrationError.assert(msg: "container2 should have service-b entry, got: \(output2)") + } + guard !output2.contains("10.0.0.1") && !output2.contains("service-a") else { + throw IntegrationError.assert(msg: "container2 should NOT have service-a entry, got: \(output2)") + } + } + + func testPodLevelDNS() async throws { + let id = "test-pod-level-dns" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set DNS at the pod level + config.dns = DNS(nameservers: ["9.9.9.9", "149.112.112.112"]) + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Neither container specifies DNS. We should inherit from pod + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer1 + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer2 + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + // Both containers should have the pod-level DNS + guard output1.contains("9.9.9.9") && output1.contains("149.112.112.112") else { + throw IntegrationError.assert(msg: "container1 should have pod-level DNS (9.9.9.9), got: \(output1)") + } + guard output2.contains("9.9.9.9") && output2.contains("149.112.112.112") else { + throw IntegrationError.assert(msg: "container2 should have pod-level DNS (9.9.9.9), got: \(output2)") + } + } + + func testPodLevelDNSWithContainerOverride() async throws { + let id = "test-pod-level-dns-override" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set DNS at the pod level + config.dns = DNS(nameservers: ["9.9.9.9"]) + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Container1 does NOT specify DNS. It should inherit from pod + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer1 + } + + // Container2 specifies its own DNS. It should override pod-level + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/resolv.conf"] + config.process.stdout = buffer2 + config.dns = DNS(nameservers: ["8.8.8.8"]) + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + // Container1 should have pod-level DNS + guard output1.contains("9.9.9.9") && !output1.contains("8.8.8.8") else { + throw IntegrationError.assert(msg: "container1 should have pod-level DNS (9.9.9.9), got: \(output1)") + } + // Container2 should have its own DNS, not pod-level + guard output2.contains("8.8.8.8") && !output2.contains("9.9.9.9") else { + throw IntegrationError.assert(msg: "container2 should have container-level DNS (8.8.8.8), got: \(output2)") + } + } + + func testPodLevelHosts() async throws { + let id = "test-pod-level-hosts" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set hosts at the pod level + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry(ipAddress: "10.0.0.100", hostnames: ["shared-service.local"]), + ]) + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Neither container specifies hosts. It should inherit from pod + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer1 + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer2 + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + // Both containers should have the pod-level hosts entry + guard output1.contains("10.0.0.100") && output1.contains("shared-service.local") else { + throw IntegrationError.assert(msg: "container1 should have pod-level hosts entry, got: \(output1)") + } + guard output2.contains("10.0.0.100") && output2.contains("shared-service.local") else { + throw IntegrationError.assert(msg: "container2 should have pod-level hosts entry, got: \(output2)") + } + } + + func testPodLevelHostsWithContainerOverride() async throws { + let id = "test-pod-level-hosts-override" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set hosts at the pod level + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry(ipAddress: "10.0.0.100", hostnames: ["shared-service.local"]), + ]) + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Container1 does NOT specify hosts. It should inherit from pod + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer1 + } + + // Container2 specifies its own hosts. It should override pod-level + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["cat", "/etc/hosts"] + config.process.stdout = buffer2 + config.hosts = Hosts(entries: [ + Hosts.Entry.localHostIPV4(), + Hosts.Entry(ipAddress: "10.0.0.200", hostnames: ["container-specific.local"]), + ]) + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 cat failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 cat failed with status \(status2)") + } + + guard let output1 = String(data: buffer1.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container1 stdout to UTF8") + } + guard let output2 = String(data: buffer2.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert container2 stdout to UTF8") + } + + // Container1 should have pod-level hosts entry + guard output1.contains("10.0.0.100") && output1.contains("shared-service.local") else { + throw IntegrationError.assert(msg: "container1 should have pod-level hosts entry, got: \(output1)") + } + guard !output1.contains("10.0.0.200") && !output1.contains("container-specific.local") else { + throw IntegrationError.assert(msg: "container1 should NOT have container2's hosts entry, got: \(output1)") + } + + // Container2 should have its own hosts entry, not pod-level + guard output2.contains("10.0.0.200") && output2.contains("container-specific.local") else { + throw IntegrationError.assert(msg: "container2 should have container-level hosts entry, got: \(output2)") + } + guard !output2.contains("10.0.0.100") && !output2.contains("shared-service.local") else { + throw IntegrationError.assert(msg: "container2 should NOT have pod-level hosts entry, got: \(output2)") + } + } + + func testPodLevelHostname() async throws { + let id = "test-pod-level-hostname" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set hostname at the pod level + config.hostname = "pod-host" + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Neither container specifies a hostname. Both should inherit from pod. + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer1 + } + + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer2 + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 hostname failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 hostname failed with status \(status2)") + } + + guard String(data: buffer1.data, encoding: .utf8) == "pod-host\n" else { + throw IntegrationError.assert(msg: "container1 should have pod-level hostname 'pod-host', got: '\(String(data: buffer1.data, encoding: .utf8) ?? "nil")'") + } + guard String(data: buffer2.data, encoding: .utf8) == "pod-host\n" else { + throw IntegrationError.assert(msg: "container2 should have pod-level hostname 'pod-host', got: '\(String(data: buffer2.data, encoding: .utf8) ?? "nil")'") + } + } + + func testPodLevelHostnameWithContainerOverride() async throws { + let id = "test-pod-level-hostname-override" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + // Set hostname at the pod level + config.hostname = "pod-host" + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Container1 does NOT specify a hostname. It should inherit from pod. + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer1 + } + + // Container2 specifies its own hostname. It should override the pod-level value. + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/hostname"] + config.process.stdout = buffer2 + config.hostname = "container-host" + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 hostname failed with status \(status1)") + } + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 hostname failed with status \(status2)") + } + + // Container1 should have the pod-level hostname + guard String(data: buffer1.data, encoding: .utf8) == "pod-host\n" else { + throw IntegrationError.assert(msg: "container1 should have pod-level hostname 'pod-host', got: '\(String(data: buffer1.data, encoding: .utf8) ?? "nil")'") + } + // Container2 should have its own hostname, not the pod-level one + guard String(data: buffer2.data, encoding: .utf8) == "container-host\n" else { + throw IntegrationError.assert(msg: "container2 should have container-level hostname 'container-host', got: '\(String(data: buffer2.data, encoding: .utf8) ?? "nil")'") + } + } + + func testPodRLimitOpenFiles() async throws { + let id = "test-pod-rlimit-open-files" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["sh", "-c", "ulimit -n"] + config.process.rlimits = [ + LinuxRLimit(kind: .openFiles, hard: 2048, soft: 1024) + ] + config.process.stdout = buffer + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + // ulimit -n returns the soft limit + guard output == "1024" else { + throw IntegrationError.assert(msg: "expected soft limit '1024', got '\(output)'") + } + } + + func testPodRLimitExec() async throws { + let id = "test-pod-rlimit-exec" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["sleep", "100"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + // Exec a process with rlimits set + let buffer = BufferWriter() + let exec = try await pod.execInContainer("container1", processID: "rlimit-exec") { config in + config.arguments = ["sh", "-c", "ulimit -n"] + config.rlimits = [ + LinuxRLimit(kind: .openFiles, hard: 512, soft: 256) + ] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "exec status \(status) != 0") + } + + guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else { + throw IntegrationError.assert(msg: "failed to convert stdout to UTF8") + } + + guard output == "256" else { + throw IntegrationError.assert(msg: "expected soft limit '256', got '\(output)'") + } + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodUseInitBasic() async throws { + let id = "test-pod-use-init-basic" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/echo", "hello from pod init"] + config.process.stdout = buffer + config.useInit = true + } + + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + guard String(data: buffer.data, encoding: .utf8) == "hello from pod init\n" else { + throw IntegrationError.assert( + msg: "expected 'hello from pod init', got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'") + } + } + + func testPodUseInitExitCodePropagation() async throws { + let id = "test-pod-use-init-exit-code" + + let bs = try await bootstrap(id) + + // Test exit code 0 + var pod = try LinuxPod("\(id)-success", vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "success")) { config in + config.process.arguments = ["/bin/true"] + config.useInit = true + } + + try await pod.create() + try await pod.startContainer("container1") + var status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "expected exit code 0, got \(status.exitCode)") + } + + // Test non-zero exit code + pod = try LinuxPod("\(id)-failure", vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "failure")) { config in + config.process.arguments = ["/bin/false"] + config.useInit = true + } + + try await pod.create() + try await pod.startContainer("container1") + status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 1 else { + throw IntegrationError.assert(msg: "expected exit code 1, got \(status.exitCode)") + } + + // Test custom exit code + pod = try LinuxPod("\(id)-custom", vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "custom")) { config in + config.process.arguments = ["sh", "-c", "exit 42"] + config.useInit = true + } + + try await pod.create() + try await pod.startContainer("container1") + status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 42 else { + throw IntegrationError.assert(msg: "expected exit code 42, got \(status.exitCode)") + } + } + + func testPodUseInitSignalForwarding() async throws { + let id = "test-pod-use-init-signal" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["sleep", "300"] + config.useInit = true + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + try await Task.sleep(for: .milliseconds(100)) + + // Send SIGTERM, should be forwarded to the child and cause exit + try await pod.killContainer("container1", signal: .term) + + let status = try await pod.waitContainer("container1", timeoutInSeconds: 5) + try await pod.stop() + + // SIGTERM should result in exit code 128 + 15 = 143 + guard status.exitCode == 143 else { + throw IntegrationError.assert(msg: "expected exit code 143 (SIGTERM), got \(status.exitCode)") + } + } catch { + try? await pod.stop() + throw error + } + } + + func testPodUseInitMultipleContainers() async throws { + let id = "test-pod-use-init-multiple" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer1 = BufferWriter() + let buffer2 = BufferWriter() + + // Container1 with useInit + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["/bin/echo", "container1 with init"] + config.process.stdout = buffer1 + config.useInit = true + } + + // Container2 without useInit + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.process.arguments = ["/bin/echo", "container2 without init"] + config.process.stdout = buffer2 + config.useInit = false + } + + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + + try await pod.stop() + + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 exit code \(status1.exitCode) != 0") + } + + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 exit code \(status2.exitCode) != 0") + } + + guard String(data: buffer1.data, encoding: .utf8) == "container1 with init\n" else { + throw IntegrationError.assert( + msg: "container1 output mismatch: '\(String(data: buffer1.data, encoding: .utf8) ?? "nil")'") + } + + guard String(data: buffer2.data, encoding: .utf8) == "container2 without init\n" else { + throw IntegrationError.assert( + msg: "container2 output mismatch: '\(String(data: buffer2.data, encoding: .utf8) ?? "nil")'") + } + } + + func testPodUseInitWithSharedPIDNamespace() async throws { + let id = "test-pod-use-init-shared-pid" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.shareProcessNamespace = true + } + + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.process.arguments = ["sleep", "300"] + config.useInit = true + } + + let psBuffer = BufferWriter() + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + // Check if we can see container1's sleep process through the shared PID namespace + config.process.arguments = ["sh", "-c", "ps aux | grep 'sleep 300' | grep -v grep"] + config.process.stdout = psBuffer + } + + try await pod.create() + try await pod.startContainer("container1") + try await Task.sleep(for: .milliseconds(100)) + + try await pod.startContainer("container2") + let status = try await pod.waitContainer("container2") + + try await pod.killContainer("container1", signal: .kill) + _ = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 should have found the sleep process (status: \(status))") + } + + let output = String(data: psBuffer.data, encoding: .utf8) ?? "" + guard output.contains("sleep 300") else { + throw IntegrationError.assert(msg: "ps output should contain 'sleep 300', got: '\(output)'") + } + } + + func testPodUnixSocketIntoGuestSymlink() async throws { + let id = "test-pod-unixsocket-into-guest-symlink" + + let bs = try await bootstrap(id) + + let hostSocketPath = try createPodHostUnixSocket() + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + // Use /var/run/test.sock. Alpine has /var/run -> /run symlink + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["sleep", "100"] + config.sockets = [ + UnixSocketConfiguration( + source: URL(filePath: hostSocketPath), + destination: URL(filePath: "/var/run/test.sock"), + direction: .into + ) + ] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let buffer = BufferWriter() + let lsExec = try await pod.execInContainer("container1", processID: "ls-socket") { config in + config.arguments = ["ls", "-l", "/var/run/test.sock"] + config.stdout = buffer + } + + try await lsExec.start() + let status2 = try await lsExec.wait() + try await lsExec.delete() + + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "ls command failed with status \(status2)") + } + + guard let lsOutput = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert ls output to UTF8") + } + + guard lsOutput.hasPrefix("s") else { + throw IntegrationError.assert( + msg: "expected socket file (starting with 's'), got: \(lsOutput)") + } + + try await pod.killContainer("container1", signal: .kill) + _ = try await pod.waitContainer("container1") + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + private func createPodHostUnixSocket() throws -> String { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + let socketPath = dir.appendingPathComponent("test.sock").path + + let socket = try Socket(type: UnixType(path: socketPath)) + try socket.listen() + + return socketPath + } + + func testPodSysctl() async throws { + let id = "test-pod-sysctl" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.sysctl = [ + "net.core.somaxconn": "4096" + ] + config.process.arguments = ["cat", "/proc/sys/net/core/somaxconn"] + config.process.stdout = buffer + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "process status \(status) != 0") + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output == "4096" else { + throw IntegrationError.assert( + msg: "sysctl net.core.somaxconn should be '4096', got '\(output ?? "nil")'") + } + } catch { + try? await pod.stop() + throw error + } + } + + func testPodSysctlMultipleContainers() async throws { + let id = "test-pod-sysctl-multi" + + let bs = try await bootstrap(id) + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + // Containers in a pod share a network namespace, so use different + // sysctls per container to avoid clobbering. + let buffer1 = BufferWriter() + try await pod.addContainer("container1", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container1")) { config in + config.sysctl = [ + "net.core.somaxconn": "2048" + ] + config.process.arguments = ["cat", "/proc/sys/net/core/somaxconn"] + config.process.stdout = buffer1 + } + + let buffer2 = BufferWriter() + try await pod.addContainer("container2", rootfs: try cloneRootfs(bs.rootfs, testID: id, containerID: "container2")) { config in + config.sysctl = [ + "net.core.netdev_max_backlog": "5000" + ] + config.process.arguments = ["cat", "/proc/sys/net/core/netdev_max_backlog"] + config.process.stdout = buffer2 + } + + do { + try await pod.create() + + try await pod.startContainer("container1") + let status1 = try await pod.waitContainer("container1") + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "container1 status \(status1) != 0") + } + let output1 = String(data: buffer1.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output1 == "2048" else { + throw IntegrationError.assert( + msg: "container1 sysctl net.core.somaxconn should be '2048', got '\(output1 ?? "nil")'") + } + + try await pod.startContainer("container2") + let status2 = try await pod.waitContainer("container2") + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "container2 status \(status2) != 0") + } + let output2 = String(data: buffer2.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output2 == "5000" else { + throw IntegrationError.assert( + msg: "container2 sysctl net.core.netdev_max_backlog should be '5000', got '\(output2 ?? "nil")'") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodInvalidVolumeReference() async throws { + let id = "test-pod-invalid-volume-ref" + let bs = try await bootstrap(id) + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/true"] + config.mounts.append(.sharedMount(name: "nonexistent-volume", destination: "/data")) + } + + do { + try await pod.create() + try? await pod.stop() + throw IntegrationError.assert(msg: "expected create() to fail for invalid volume reference") + } catch let error as ContainerizationError { + guard error.code == .invalidArgument else { + throw IntegrationError.assert(msg: "expected invalidArgument error, got: \(error)") + } + } + } + + func testPodDuplicateVolumeName() async throws { + let id = "test-pod-duplicate-volume-name" + let bs = try await bootstrap(id) + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.volumes = [ + .init(name: "data", source: .nbd(url: URL(string: "nbd://localhost:10809")!), format: "ext4"), + .init(name: "data", source: .nbd(url: URL(string: "nbd://localhost:10809")!), format: "ext4"), + ] + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/true"] + } + + do { + try await pod.create() + try? await pod.stop() + throw IntegrationError.assert(msg: "expected create() to fail for duplicate volume name") + } catch let error as ContainerizationError { + guard error.code == .invalidArgument else { + throw IntegrationError.assert(msg: "expected invalidArgument error, got: \(error)") + } + } + } + + #if os(macOS) + @available(macOS 26.0, *) + func testPodIPv6AddressAdd() async throws { + let id = "test-pod-ipv6-address" + let bs = try await bootstrap(id) + + var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64")) + defer { + try? network.releaseInterface(id) + } + + guard let interface = try network.createInterface(id) else { + throw IntegrationError.assert(msg: "failed to create network interface") + } + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.interfaces = [interface] + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "100"] + } + + try await pod.create() + try await pod.startContainer("container1") + + let buffer = BufferWriter() + let exec = try await pod.execInContainer("container1", processID: "check-v6") { config in + config.arguments = ["ip", "-6", "addr", "show", "eth0"] + config.stdout = buffer + } + + try await exec.start() + let status = try await exec.wait() + try await exec.delete() + + try await pod.killContainer("container1", signal: .kill) + try await pod.waitContainer("container1") + try await pod.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "ip -6 addr show failed with status \(status)") + } + + guard let output = String(data: buffer.data, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to convert output to UTF8") + } + + guard output.contains("fd00::2") else { + throw IntegrationError.assert( + msg: "expected fd00::2 on eth0 inside pod container, got: \(output)") + } + } + #endif + + func testPodFilesystemOperation() async throws { + let id = "test-pod-filesystem-operation" + + let bs = try await bootstrap(id) + + let diskImageURL = Self.testDir.appending(component: "\(id)-data.ext4") + try? FileManager.default.removeItem(at: diskImageURL) + let filesystem = try EXT4.Formatter(FilePath(diskImageURL.absolutePath()), minDiskSize: 64.mib()) + try filesystem.close() + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + } + + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/sleep", "1000"] + config.mounts.append( + Mount.block( + format: "ext4", + source: diskImageURL.absolutePath(), + destination: "/data" + )) + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + try await pod.filesystemOperation("container1", operation: .freeze, path: "/data") + + let writeExec = try await pod.execInContainer("container1", processID: "write-hello") { config in + config.arguments = ["/bin/sh", "-c", "echo hello > /data/hello.txt"] + } + try await writeExec.start() + let writeStatus = try await writeExec.wait() + try await writeExec.delete() + guard writeStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "write exec failed with status \(writeStatus)") + } + try await pod.filesystemOperation("container1", operation: .thaw, path: "/data") + try await pod.filesystemOperation("container1", operation: .trim, path: "/data") + + let readBuffer = BufferWriter() + let readExec = try await pod.execInContainer("container1", processID: "read-hello") { config in + config.arguments = ["/bin/cat", "/data/hello.txt"] + config.stdout = readBuffer + } + try await readExec.start() + let readStatus = try await readExec.wait() + try await readExec.delete() + guard readStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "read exec failed with status \(readStatus)") + } + + let readOutput = String(decoding: readBuffer.data, as: UTF8.self) + guard readOutput == "hello\n" else { + throw IntegrationError.assert( + msg: "expected 'hello\\n' in /data/hello.txt, got: '\(readOutput)'" + ) + } + + try await pod.killContainer("container1", signal: .kill) + _ = try await pod.waitContainer("container1") + try await pod.stop() + } catch { + try? await pod.filesystemOperation("container1", operation: .thaw, path: "/data") + try? await pod.stop() + throw error + } + } +} diff --git a/Sources/Integration/PodVolumeTests.swift b/Sources/Integration/PodVolumeTests.swift new file mode 100644 index 0000000..aa029ba --- /dev/null +++ b/Sources/Integration/PodVolumeTests.swift @@ -0,0 +1,857 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Containerization +import ContainerizationArchive +import ContainerizationEXT4 +import ContainerizationError +import ContainerizationOCI +import Foundation +import Logging +import SystemPackage + +#if os(macOS) +extension IntegrationSuite { + private func cloneRootfsForContainer(_ rootfs: Containerization.Mount, testID: String, containerID: String) throws -> Containerization.Mount { + let clonePath = Self.testDir.appending(component: "\(testID)-\(containerID).ext4").absolutePath() + try? FileManager.default.removeItem(atPath: clonePath) + return try rootfs.clone(to: clonePath) + } + + private func createEXT4DiskImage(testID: String, name: String, size: UInt64 = 64.mib()) throws -> URL { + let diskURL = Self.testDir.appending(component: "\(testID)-\(name).ext4") + try? FileManager.default.removeItem(at: diskURL) + let formatter = try EXT4.Formatter(FilePath(diskURL.absolutePath()), minDiskSize: size) + try formatter.close() + return diskURL + } + + /// Create an ext4 disk image with a file already written to it. + private func createEXT4DiskImageWithFile( + testID: String, name: String, filePath: String, content: String, size: UInt64 = 64.mib() + ) throws -> URL { + let diskURL = Self.testDir.appending(component: "\(testID)-\(name).ext4") + try? FileManager.default.removeItem(at: diskURL) + let formatter = try EXT4.Formatter(FilePath(diskURL.absolutePath()), minDiskSize: size) + let data = Data(content.utf8) + let stream = InputStream(data: data) + stream.open() + defer { stream.close() } + try formatter.create(path: FilePath(filePath), mode: 0o100644, buf: stream) + try formatter.close() + return diskURL + } + + private func createNBDServer(testID: String, name: String, size: UInt64 = 64.mib()) throws -> (NBDServer, URL) { + let diskURL = try createEXT4DiskImage(testID: testID, name: name, size: size) + let shortID = String(testID.hashValue, radix: 36, uppercase: false) + let socketPath = "/tmp/nbd-\(shortID)-\(name).sock" + let server = try NBDServer(filePath: diskURL.path, socketPath: socketPath) + return (server, diskURL) + } + + private func readFileFromDiskImage(_ diskURL: URL, path: String) throws -> String { + let reader = try EXT4.EXT4Reader(blockDevice: FilePath(diskURL.path)) + let bytes = try reader.readFile(at: FilePath(path)) + guard let content = String(bytes: bytes, encoding: .utf8) else { + throw IntegrationError.assert(msg: "failed to decode file content from disk image at \(path)") + } + return content.trimmingCharacters(in: .whitespacesAndNewlines) + } + + private func assertVirtioBlockMount(_ output: String, path: String) throws { + guard output.contains("/dev/vd") else { + throw IntegrationError.assert(msg: "expected virtio block device (/dev/vd*) for \(path), got: \(output)") + } + } + + func testContainerNBDMount() async throws { + let id = "test-container-nbd-mount" + let bs = try await bootstrap(id) + + let (server, diskURL) = try createNBDServer(testID: id, name: "vol") + defer { server.stop() } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.mounts.append( + Mount.block( + format: "ext4", + source: server.url, + destination: "/data" + )) + config.process.arguments = [ + "/bin/sh", "-c", + "echo hello > /data/test.txt && cat /data/test.txt && grep /data /proc/mounts", + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container exited with status \(status)") + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let lines = output.components(separatedBy: "\n") + + guard lines.count >= 2 else { + throw IntegrationError.assert(msg: "expected at least 2 lines of output, got: \(output)") + } + + guard lines[0] == "hello" else { + throw IntegrationError.assert(msg: "expected 'hello', got '\(lines[0])'") + } + + try assertVirtioBlockMount(lines[1], path: "/data") + + // Verify the write landed on the NBD backing file. + let diskContent = try readFileFromDiskImage(diskURL, path: "/test.txt") + guard diskContent == "hello" else { + throw IntegrationError.assert(msg: "NBD backing file: expected 'hello', got '\(diskContent)'") + } + } + + func testContainerNBDReadOnly() async throws { + let id = "test-container-nbd-readonly" + let bs = try await bootstrap(id) + + let (server, _) = try createNBDServer(testID: id, name: "ro-vol") + defer { server.stop() } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + config.mounts.append( + Mount.block( + format: "ext4", + source: server.url, + destination: "/data", + options: ["ro"] + )) + // Verify virtio block mount, then attempt a write that should fail. + config.process.arguments = [ + "/bin/sh", "-c", + "grep /data /proc/mounts; echo test > /data/fail.txt 2>&1; echo exit=$?", + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + _ = try await container.wait() + try await container.stop() + + let output = String(data: buffer.data, encoding: .utf8) ?? "" + let lines = output.trimmingCharacters(in: .whitespacesAndNewlines).components(separatedBy: "\n") + + guard !lines.isEmpty else { + throw IntegrationError.assert(msg: "expected output, got nothing") + } + + // First line should show the virtio block device mount. + try assertVirtioBlockMount(lines[0], path: "/data") + + // Write should have failed on a read-only mount. + guard !output.contains("exit=0") else { + throw IntegrationError.assert(msg: "write succeeded on read-only NBD mount: \(output)") + } + } + + func testContainerNBDRawBlock() async throws { + let id = "test-container-nbd-raw-block" + let bs = try await bootstrap(id) + + // Create an unformatted disk image, no filesystem. + let diskURL = Self.testDir.appending(component: "\(id)-raw.img") + try? FileManager.default.removeItem(at: diskURL) + FileManager.default.createFile(atPath: diskURL.path, contents: nil) + let fh = try FileHandle(forWritingTo: diskURL) + try fh.truncate(atOffset: 64.mib()) + try fh.close() + + let shortID = String(id.hashValue, radix: 36, uppercase: false) + let socketPath = "/tmp/nbd-\(shortID)-raw.sock" + let server = try NBDServer(filePath: diskURL.path, socketPath: socketPath) + defer { server.stop() } + + let buffer = BufferWriter() + let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in + // Attach as raw block, bind mount the device into the container. + config.mounts.append( + Mount.block( + format: "none", + source: server.url, + destination: "/dev/my-disk", + options: ["bind"] + )) + // Verify it's a block device, write known data, read it back. + config.process.arguments = [ + "/bin/sh", "-c", + "test -b /dev/my-disk && printf 'raw-block-works' | dd of=/dev/my-disk bs=512 count=1 conv=sync 2>/dev/null && dd if=/dev/my-disk bs=1 count=15 2>/dev/null", + ] + config.process.stdout = buffer + config.bootLog = bs.bootLog + } + + try await container.create() + try await container.start() + + let status = try await container.wait() + try await container.stop() + + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container exited with status \(status)") + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + guard output == "raw-block-works" else { + throw IntegrationError.assert(msg: "expected 'raw-block-works', got '\(output)'") + } + } + + func testContainerNBDVolumeIdentity() async throws { + let id = "test-container-nbd-volume-identity" + let bs = try await bootstrap(id) + + let volumeCount = 5 + var servers: [NBDServer] = [] + + // Create 5 disk images, each pre-filled with unique content. + for i in 0.. /data/shared.txt && grep /data /proc/mounts", + ] + config.process.stdout = writerBuffer + config.mounts.append(.sharedMount(name: "shared-data", destination: "/data")) + } + + // Container 2: reads from the same shared volume at a different path and verifies mount type. + let readerBuffer = BufferWriter() + try await pod.addContainer("reader", rootfs: rootfs2) { config in + config.process.arguments = [ + "/bin/sh", "-c", + "sleep 2 && cat /shared/shared.txt && grep /shared /proc/mounts", + ] + config.process.stdout = readerBuffer + config.mounts.append(.sharedMount(name: "shared-data", destination: "/shared")) + } + + do { + try await pod.create() + try await pod.startContainer("writer") + try await pod.startContainer("reader") + + let writerStatus = try await pod.waitContainer("writer") + guard writerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "writer exited with status \(writerStatus)") + } + + let readerStatus = try await pod.waitContainer("reader") + guard readerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "reader exited with status \(readerStatus)") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + + // Verify writer output. + let writerOutput = String(data: writerBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let writerLines = writerOutput.components(separatedBy: "\n") + guard !writerLines.isEmpty else { + throw IntegrationError.assert(msg: "writer produced no output") + } + try assertVirtioBlockMount(writerLines.last!, path: "/data") + + // Verify reader output. + let readerOutput = String(data: readerBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let readerLines = readerOutput.components(separatedBy: "\n") + guard readerLines.count >= 2 else { + throw IntegrationError.assert(msg: "expected at least 2 lines from reader, got: \(readerOutput)") + } + guard readerLines[0] == "shared-content" else { + throw IntegrationError.assert(msg: "expected 'shared-content', got '\(readerLines[0])'") + } + try assertVirtioBlockMount(readerLines[1], path: "/shared") + + // Verify the write landed on the NBD backing file. + let diskContent = try readFileFromDiskImage(diskURL, path: "/shared.txt") + guard diskContent == "shared-content" else { + throw IntegrationError.assert(msg: "NBD backing file: expected 'shared-content', got '\(diskContent)'") + } + } + + func testPodMultipleNBDVolumes() async throws { + let id = "test-pod-multiple-nbd-volumes" + let bs = try await bootstrap(id) + + let (server1, diskURL1) = try createNBDServer(testID: id, name: "vol1") + defer { server1.stop() } + + let (server2, diskURL2) = try createNBDServer(testID: id, name: "vol2") + defer { server2.stop() } + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.volumes = [ + .init( + name: "volume-a", + source: .nbd(url: URL(string: server1.url)!), + format: "ext4" + ), + .init( + name: "volume-b", + source: .nbd(url: URL(string: server2.url)!), + format: "ext4" + ), + ] + } + + let buffer = BufferWriter() + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = [ + "/bin/sh", "-c", + """ + echo aaa > /mnt-a/a.txt && echo bbb > /mnt-b/b.txt \ + && cat /mnt-a/a.txt && cat /mnt-b/b.txt \ + && grep /mnt-a /proc/mounts && grep /mnt-b /proc/mounts + """, + ] + config.process.stdout = buffer + config.mounts.append(.sharedMount(name: "volume-a", destination: "/mnt-a")) + config.mounts.append(.sharedMount(name: "volume-b", destination: "/mnt-b")) + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container exited with status \(status)") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + + let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let lines = output.components(separatedBy: "\n") + + guard lines.count >= 4 else { + throw IntegrationError.assert(msg: "expected at least 4 lines, got: \(output)") + } + + guard lines[0] == "aaa" && lines[1] == "bbb" else { + throw IntegrationError.assert(msg: "expected 'aaa\\nbbb', got '\(lines[0])\\n\(lines[1])'") + } + + try assertVirtioBlockMount(lines[2], path: "/mnt-a") + try assertVirtioBlockMount(lines[3], path: "/mnt-b") + + // Verify each write landed on the correct NBD backing file. + let diskContent1 = try readFileFromDiskImage(diskURL1, path: "/a.txt") + guard diskContent1 == "aaa" else { + throw IntegrationError.assert(msg: "NBD backing file vol1: expected 'aaa', got '\(diskContent1)'") + } + let diskContent2 = try readFileFromDiskImage(diskURL2, path: "/b.txt") + guard diskContent2 == "bbb" else { + throw IntegrationError.assert(msg: "NBD backing file vol2: expected 'bbb', got '\(diskContent2)'") + } + } + + func testPodUnreferencedVolume() async throws { + let id = "test-pod-unreferenced-volume" + let bs = try await bootstrap(id) + + let (server, _) = try createNBDServer(testID: id, name: "unused") + defer { server.stop() } + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.volumes = [ + .init( + name: "unused-vol", + source: .nbd(url: URL(string: server.url)!), + format: "ext4" + ) + ] + } + + // Container doesn't reference the volume at all. + try await pod.addContainer("container1", rootfs: bs.rootfs) { config in + config.process.arguments = ["/bin/true"] + } + + do { + try await pod.create() + try await pod.startContainer("container1") + + let status = try await pod.waitContainer("container1") + guard status.exitCode == 0 else { + throw IntegrationError.assert(msg: "container exited with status \(status)") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + } + + func testPodNBDVolumePersistence() async throws { + let id = "test-pod-nbd-volume-persistence" + let bs = try await bootstrap(id) + + let (server, _) = try createNBDServer(testID: id, name: "persistent") + defer { server.stop() } + + let rootfs1 = try cloneRootfsForContainer(bs.rootfs, testID: id, containerID: "writer") + let rootfs2 = try cloneRootfsForContainer(bs.rootfs, testID: id, containerID: "reader") + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.volumes = [ + .init( + name: "persistent-data", + source: .nbd(url: URL(string: server.url)!), + format: "ext4" + ) + ] + } + + // First container: write data to the volume. + try await pod.addContainer("writer", rootfs: rootfs1) { config in + config.process.arguments = ["/bin/sh", "-c", "echo persisted > /data/file.txt && sync"] + config.mounts.append(.sharedMount(name: "persistent-data", destination: "/data")) + } + + // Second container: will read the data after the first is stopped. + let readerBuffer = BufferWriter() + try await pod.addContainer("reader", rootfs: rootfs2) { config in + config.process.arguments = ["/bin/sh", "-c", "cat /data/file.txt"] + config.process.stdout = readerBuffer + config.mounts.append(.sharedMount(name: "persistent-data", destination: "/data")) + } + + do { + try await pod.create() + + // Start writer, wait for it to finish, then stop it. + try await pod.startContainer("writer") + let writerStatus = try await pod.waitContainer("writer") + guard writerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "writer exited with status \(writerStatus)") + } + try await pod.stopContainer("writer") + + // Start reader after writer is stopped — data should persist on the volume. + try await pod.startContainer("reader") + let readerStatus = try await pod.waitContainer("reader") + guard readerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "reader exited with status \(readerStatus)") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + + let output = String(data: readerBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output == "persisted" else { + throw IntegrationError.assert(msg: "expected 'persisted', got '\(output ?? "")'") + } + } + + func testPodNBDConcurrentWrites() async throws { + let id = "test-pod-nbd-concurrent-writes" + let bs = try await bootstrap(id) + + let (server, _) = try createNBDServer(testID: id, name: "shared") + defer { server.stop() } + + let rootfs1 = try cloneRootfsForContainer(bs.rootfs, testID: id, containerID: "c1") + let rootfs2 = try cloneRootfsForContainer(bs.rootfs, testID: id, containerID: "c2") + + let pod = try LinuxPod(id, vmm: bs.vmm) { config in + config.cpus = 4 + config.memoryInBytes = 1024.mib() + config.bootLog = bs.bootLog + config.volumes = [ + .init( + name: "shared-vol", + source: .nbd(url: URL(string: server.url)!), + format: "ext4" + ) + ] + } + + // Both containers write to different files on the same volume concurrently. + let buffer1 = BufferWriter() + try await pod.addContainer("c1", rootfs: rootfs1) { config in + config.process.arguments = [ + "/bin/sh", "-c", + "echo from-c1 > /vol/c1.txt && sync && cat /vol/c1.txt", + ] + config.process.stdout = buffer1 + config.mounts.append(.sharedMount(name: "shared-vol", destination: "/vol")) + } + + let buffer2 = BufferWriter() + try await pod.addContainer("c2", rootfs: rootfs2) { config in + config.process.arguments = [ + "/bin/sh", "-c", + "echo from-c2 > /vol/c2.txt && sync && cat /vol/c2.txt", + ] + config.process.stdout = buffer2 + config.mounts.append(.sharedMount(name: "shared-vol", destination: "/vol")) + } + + do { + try await pod.create() + try await pod.startContainer("c1") + try await pod.startContainer("c2") + + let status1 = try await pod.waitContainer("c1") + guard status1.exitCode == 0 else { + throw IntegrationError.assert(msg: "c1 exited with status \(status1)") + } + + let status2 = try await pod.waitContainer("c2") + guard status2.exitCode == 0 else { + throw IntegrationError.assert(msg: "c2 exited with status \(status2)") + } + + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + + let output1 = String(data: buffer1.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output1 == "from-c1" else { + throw IntegrationError.assert(msg: "c1: expected 'from-c1', got '\(output1 ?? "")'") + } + + let output2 = String(data: buffer2.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) + guard output2 == "from-c2" else { + throw IntegrationError.assert(msg: "c2: expected 'from-c2', got '\(output2 ?? "")'") + } + } + + func testPodNBDVolumeIdentity() async throws { + let id = "test-pod-nbd-volume-identity" + let bs = try await bootstrap(id) + + // Create 5 disk images, each pre-filled with unique content. + let volumeCount = 5 + var servers: [NBDServer] = [] + + for i in 0.. /data/shared.txt && grep /data /proc/mounts", + ] + config.process.stdout = writerBuffer + config.mounts.append(.sharedMount(name: "shared-data", destination: "/data")) + } + + // Container 2: reads what the writer produced and writes a second file, + // mounted at a different path to prove it's the same backing store. + let appenderBuffer = BufferWriter() + try await pod.addContainer("appender", rootfs: rootfs2) { config in + config.process.arguments = [ + "/bin/sh", "-c", + "cat /vol/shared.txt && echo more-content > /vol/second.txt", + ] + config.process.stdout = appenderBuffer + config.mounts.append(.sharedMount(name: "shared-data", destination: "/vol")) + } + + // Container 3: reads both files written by the previous containers. + let readerBuffer = BufferWriter() + try await pod.addContainer("reader", rootfs: rootfs3) { config in + config.process.arguments = [ + "/bin/sh", "-c", + "cat /shared/shared.txt && cat /shared/second.txt && grep /shared /proc/mounts", + ] + config.process.stdout = readerBuffer + config.mounts.append(.sharedMount(name: "shared-data", destination: "/shared")) + } + + do { + try await pod.create() + + // Run the containers sequentially so reads see prior writes. + try await pod.startContainer("writer") + let writerStatus = try await pod.waitContainer("writer") + guard writerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "writer exited with status \(writerStatus)") + } + + try await pod.startContainer("appender") + let appenderStatus = try await pod.waitContainer("appender") + guard appenderStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "appender exited with status \(appenderStatus)") + } + + try await pod.startContainer("reader") + let readerStatus = try await pod.waitContainer("reader") + guard readerStatus.exitCode == 0 else { + throw IntegrationError.assert(msg: "reader exited with status \(readerStatus)") + } + try await pod.stop() + } catch { + try? await pod.stop() + throw error + } + + // Verify writer mounted a virtio block device at /data. + let writerOutput = String(data: writerBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let writerLines = writerOutput.components(separatedBy: "\n") + guard !writerLines.isEmpty else { + throw IntegrationError.assert(msg: "writer produced no output") + } + try assertVirtioBlockMount(writerLines.last!, path: "/data") + + // Verify the appender read the writer's file. + let appenderOutput = String(data: appenderBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + guard appenderOutput == "shared-content" else { + throw IntegrationError.assert(msg: "appender: expected 'shared-content', got '\(appenderOutput)'") + } + + // Verify the reader saw both files and a virtio block mount. + let readerOutput = String(data: readerBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "" + let readerLines = readerOutput.components(separatedBy: "\n") + guard readerLines.count >= 3 else { + throw IntegrationError.assert(msg: "expected at least 3 lines from reader, got: \(readerOutput)") + } + guard readerLines[0] == "shared-content" else { + throw IntegrationError.assert(msg: "reader: expected 'shared-content', got '\(readerLines[0])'") + } + guard readerLines[1] == "more-content" else { + throw IntegrationError.assert(msg: "reader: expected 'more-content', got '\(readerLines[1])'") + } + try assertVirtioBlockMount(readerLines[2], path: "/shared") + + // Verify both writes landed on the host-side EXT4 disk image. + let firstContent = try readFileFromDiskImage(diskURL, path: "/shared.txt") + guard firstContent == "shared-content" else { + throw IntegrationError.assert(msg: "disk image /shared.txt: expected 'shared-content', got '\(firstContent)'") + } + let secondContent = try readFileFromDiskImage(diskURL, path: "/second.txt") + guard secondContent == "more-content" else { + throw IntegrationError.assert(msg: "disk image /second.txt: expected 'more-content', got '\(secondContent)'") + } + } +} +#endif diff --git a/Sources/Integration/Suite.swift b/Sources/Integration/Suite.swift new file mode 100644 index 0000000..440384e --- /dev/null +++ b/Sources/Integration/Suite.swift @@ -0,0 +1,686 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging +import NIOCore +import NIOPosix +import Synchronization + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +actor UnpackCoordinator { + private var inFlight: [String: Task] = [:] + + func unpack( + key: String, + operation: @escaping @Sendable () async throws -> Containerization.Mount + ) async throws -> Containerization.Mount { + if let existing = inFlight[key] { + return try await existing.value + } + + let task = Task { + try await operation() + } + inFlight[key] = task + + defer { + inFlight.removeValue(forKey: key) + } + + return try await task.value + } +} + +struct Test: Sendable { + var name: String + var work: @Sendable () async throws -> Void + + init(_ name: String, _ work: @escaping @Sendable () async throws -> Void) { + self.name = name + self.work = work + } +} + +final class JobQueue: Sendable where T: Sendable { + struct State: Sendable { + var next = 0 + var jobs: [T] + } + + private let lock: Mutex + init(_ jobs: [T]) { + self.lock = Mutex(State(jobs: jobs)) + } + + func pop() -> T? { + self.lock.withLock { state in + guard state.next < state.jobs.count else { + return nil + } + defer { + state.next += 1 + } + return state.jobs[state.next] + } + } +} + +let log = { + LoggingSystem.bootstrap(StreamLogHandler.standardError) + var log = Logger(label: "com.apple.containerization") + log.logLevel = .debug + return log +}() + +enum IntegrationError: Swift.Error { + case assert(msg: String) + case noOutput +} + +struct SkipTest: Swift.Error, CustomStringConvertible { + let reason: String + + var description: String { + reason + } +} + +@main +struct IntegrationSuite: AsyncParsableCommand { + static let appRoot: URL = { + FileManager.default.urls( + for: .applicationSupportDirectory, + in: .userDomainMask + ).first! + .appendingPathComponent("com.apple.containerization") + }() + + private static let _contentStore: ContentStore = { + try! LocalContentStore(path: appRoot.appending(path: "content")) + }() + + private static let _imageStore: ImageStore = { + try! ImageStore( + path: appRoot, + contentStore: contentStore + ) + }() + + static let _testDir: URL = { + FileManager.default.uniqueTemporaryDirectory(create: true) + }() + + static var testDir: URL { + _testDir + } + + static var imageStore: ImageStore { + _imageStore + } + + static var contentStore: ContentStore { + _contentStore + } + + static let initImage = "vminit:latest" + + private static let unpackCoordinator = UnpackCoordinator() + + @Option(name: .shortAndLong, help: "Path to a directory for boot logs") + var bootlogDir: String = "./bin/integration-bootlogs" + + @Option(name: .shortAndLong, help: "Path to a kernel binary") + var kernel: String = Self.defaultKernelPath + + #if arch(arm64) + private static let kernelCandidates = ["./bin/vmlinux-arm64"] + #elseif arch(x86_64) + private static let kernelCandidates = ["./bin/vmlinuz-x86_64", "./bin/vmlinux-x86_64"] + #else + private static let kernelCandidates = ["./bin/vmlinux"] + #endif + + private static let defaultKernelPath: String = { + let fm = FileManager.default + for candidate in kernelCandidates where fm.fileExists(atPath: candidate) { + return candidate + } + return kernelCandidates[0] + }() + + @Option(name: .shortAndLong, help: "Maximum number of concurrent tests") + var maxConcurrency: Int = 4 + + @Option(name: .shortAndLong, help: "Only run tests whose names contain this string") + var filter: String? + + #if os(Linux) + @Option(name: .long, help: "Path to cloud-hypervisor binary (Linux only). Defaults to PATH lookup.") + var chBinary: String? + + @Option(name: .long, help: "Path to virtiofsd binary (Linux only). Defaults to PATH lookup.") + var virtiofsdBinary: String? + #endif + + static func binPath(name: String) -> URL { + URL(fileURLWithPath: FileManager.default.currentDirectoryPath) + .appendingPathComponent("bin") + .appendingPathComponent(name) + } + + static let eventLoop = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount) + + func bootstrap(_ testID: String) async throws -> (rootfs: Containerization.Mount, vmm: VirtualMachineManager, image: Containerization.Image, bootLog: BootLog) { + let reference = "ghcr.io/linuxcontainers/alpine:3.20" + let store = Self.imageStore + + let initImage = try await store.getInitImage(reference: Self.initImage) + let initfs = try await { + let p = Self.binPath(name: "init.block") + do { + return try await initImage.initBlock(at: p, for: .linuxArm) + } catch let err as ContainerizationError { + guard err.code == .exists else { + throw err + } + return .block( + format: "ext4", + source: p.absolutePath(), + destination: "/", + options: ["ro"] + ) + } + }() + + let testKernel = Kernel(path: .init(filePath: kernel), platform: .linuxArm) + // Intentionally NOT adding `debug` or `earlycon=pl011,...` here. + // Both look free, but each costs real wall-clock per VM boot: + // * `debug` floods printk through hvc0 (which CH writes to the + // bootlog file). + // * `earlycon=pl011,...` routes every early-boot printk character + // through pl011 MMIO traps into CH's serial emulator. With CH's + // pl011 wired to a file (see CHVirtualMachineInstance.serialConfig) + // each character is a synchronous file write and ~50–80 ms of + // dmesg quantization showed up in measurements — adding ~1.5 s + // to every VM boot before bootconsole hands over to virtio_console. + // Re-add either as a one-shot when actively diagnosing kernel boot. + let image = try await Self.fetchImage(reference: reference, store: store) + let platform = Platform(arch: "arm64", os: "linux", variant: "v8") + + // Unpack to shared location with coordination to prevent concurrent unpacks + let fsPath = Self.testDir.appending(component: image.digest) + let fs = try await Self.unpackCoordinator.unpack(key: fsPath.absolutePath()) { + do { + let unpacker = EXT4Unpacker(blockSizeInBytes: 2.gib()) + return try await unpacker.unpack(image, for: platform, at: fsPath) + } catch let err as ContainerizationError { + if err.code == .exists { + return .block( + format: "ext4", + source: fsPath.absolutePath(), + destination: "/", + options: [] + ) + } + throw err + } + } + + // Reap any per-test artifacts left over from prior tests. With + // `--max-concurrency 1` (linux-integration default) this runs after + // the previous test has fully completed, so it's race-free; on + // macOS where tests can run in parallel we just keep all files — + // disk usage isn't a concern there. Each per-test bootstrap clones + // a ~2GB rootfs and a ~512MB initfs, so without reaping the dev + // container fills its CoW layer in ~10 tests. + if self.maxConcurrency == 1 { + let preserve = fsPath.absolutePath() + if let entries = try? FileManager.default.contentsOfDirectory( + at: Self.testDir, + includingPropertiesForKeys: nil + ) { + for url in entries where url.absolutePath() != preserve { + try? FileManager.default.removeItem(at: url) + } + } + } + + // Clone to test-specific path + let clPath = Self.testDir.appending(component: "\(testID).ext4").absolutePath() + try? FileManager.default.removeItem(atPath: clPath) + + let cl = try fs.clone(to: clPath) + + // Per-test clone of the init.block. The init.block is supposed to be + // mounted read-only (kernel cmdline + readonly=true on the virtio-blk + // device for both VZ and CH), but sharing the same backing file across + // concurrent CH VMs has surfaced "internalError: mount" cascades on + // Linux/CH after a single test failure — symptomatic of the file + // entering a bad state when one CH instance is killed mid-flight. + // Cloning per test isolates each VM from any cross-test fallout. + let initClonePath = Self.testDir.appending(component: "\(testID).init.block").absolutePath() + try? FileManager.default.removeItem(atPath: initClonePath) + let initfsPerTest = try initfs.clone(to: initClonePath) + + // Create bootLog directory and per-container bootLog path + let bootlogDirURL = URL(filePath: bootlogDir) + try? FileManager.default.createDirectory(at: bootlogDirURL, withIntermediateDirectories: true) + let bootlogURL = bootlogDirURL.appendingPathComponent("\(testID).log") + + let vmm: any VirtualMachineManager = try Self.makeVMM( + kernel: testKernel, + initialFilesystem: initfsPerTest, + chBinary: Self.chBinaryOverride(for: self), + virtiofsdBinary: Self.virtiofsdBinaryOverride(for: self) + ) + + return ( + cl, + vmm, + image, + BootLog.file(path: bootlogURL) + ) + } + + private static func chBinaryOverride(for suite: IntegrationSuite) -> String? { + #if os(Linux) + return suite.chBinary + #else + _ = suite + return nil + #endif + } + + private static func virtiofsdBinaryOverride(for suite: IntegrationSuite) -> String? { + #if os(Linux) + return suite.virtiofsdBinary + #else + _ = suite + return nil + #endif + } + + private static func makeVMM( + kernel: Kernel, + initialFilesystem: Containerization.Mount, + chBinary: String?, + virtiofsdBinary: String? + ) throws -> any VirtualMachineManager { + #if os(macOS) + _ = chBinary + _ = virtiofsdBinary + return VZVirtualMachineManager( + kernel: kernel, + initialFilesystem: initialFilesystem, + group: Self.eventLoop + ) + #elseif os(Linux) + return try CHVirtualMachineManager( + kernel: kernel, + initialFilesystem: initialFilesystem, + chBinary: chBinary.map { URL(fileURLWithPath: $0) }, + virtiofsdBinary: virtiofsdBinary.map { URL(fileURLWithPath: $0) }, + group: Self.eventLoop, + logger: log + ) + #endif + } + + static func fetchImage(reference: String, store: ImageStore) async throws -> Containerization.Image { + do { + return try await store.get(reference: reference) + } catch let error as ContainerizationError { + if error.code == .notFound { + return try await store.pull(reference: reference) + } + throw error + } + } + + static func adjustLimits() throws { + var limits = rlimit() + #if os(Linux) + let resource = __rlimit_resource_t(RLIMIT_NOFILE.rawValue) + #else + let resource = RLIMIT_NOFILE + #endif + + guard getrlimit(resource, &limits) == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + limits.rlim_cur = 65536 + limits.rlim_max = 65536 + + guard setrlimit(resource, &limits) == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + } + + #if os(macOS) + private func macOS26Tests() -> [Test] { + if #available(macOS 26.0, *) { + return [ + Test("container interface custom MTU", testInterfaceMTU), + Test("container networking disabled", testNetworkingDisabled), + Test("container networking enabled", testNetworkingEnabled), + Test("container networking enabled ipv6", testNetworkingEnabledIPv6), + Test("container IPv6 address", testIPv6AddressAdd), + Test("container IPv6 default route", testIPv6DefaultRoute), + Test("container IPv6 gateway outside subnet", testIPv6GatewayOutsideSubnet), + Test("container IPv6 only default route", testIPv6OnlyDefaultRoute), + Test("container IPv6 only gateway outside subnet", testIPv6OnlyGatewayOutsideSubnet), + Test("container IPv6 dual stack", testIPv6DualStack), + Test("pod IPv6 address", testPodIPv6AddressAdd), + ] + } + return [] + } + #endif + + // Why does this exist? + // + // We need the virtualization entitlement to execute these tests. + // There currently does not exist a straightforward way to do this + // in a pure swift package. + // + // In order to not have a dependency on xcode, we create an executable + // for our integration tests that can be signed then ran. + // + // We also can't import Testing as it expects to be run from a runner. + // Hopefully this improves over time. + func run() async throws { + try Self.adjustLimits() + let suiteStarted = Date().timeIntervalSinceReferenceDate + log.info("starting integration suite\n") + + let crossPlatformTests: [Test] = [ + // Process basics + Test("process true", testProcessTrue), + Test("process false", testProcessFalse), + Test("process echo hi", testProcessEchoHi), + Test("process no executable", testProcessNoExecutable), + Test("process user", testProcessUser), + Test("process stdin", testProcessStdin), + Test("process home envvar", testProcessHomeEnvvar), + Test("process custom home envvar", testProcessCustomHomeEnvvar), + Test("process tty ensure TERM", testProcessTtyEnvvar), + + // Hostname / hosts + Test("container hostname", testHostname), + Test("container hostname defaults to container id", testHostnameDefaultsToContainerID), + Test("container hosts", testHostsFile), + + // Statistics / cgroups / memory + Test("container statistics", testContainerStatistics), + Test("container cgroup limits", testCgroupLimits), + Test("container memory events OOM kill", testMemoryEventsOOMKill), + + // Console / boot / lifecycle + Test("container no serial console", testNoSerialConsole), + Test("container non-closure constructor", testNonClosureConstructor), + Test("container test large stdio ingest", testLargeStdioOutput), + Test("container bootlog using filehandle", testBootLogFileHandle), + Test("process delete idempotency", testProcessDeleteIdempotency), + Test("multiple execs without delete", testMultipleExecsWithoutDelete), + + // Capabilities + Test("container capabilities sys admin", testCapabilitiesSysAdmin), + Test("container capabilities net admin", testCapabilitiesNetAdmin), + Test("container capabilities OCI default", testCapabilitiesOCIDefault), + Test("container capabilities all capabilities", testCapabilitiesAllCapabilities), + Test("container capabilities file ownership", testCapabilitiesFileOwnership), + + // Masked / read-only paths + Test("container default masked and read-only paths", testDefaultMaskedAndReadonlyPaths), + + // Stat / Copy + Test("container stat", testStat), + Test("container copy in", testCopyIn), + Test("container copy in file to existing directory", testCopyInFileToExistingDirectory), + Test("container copy in file to missing directory fails", testCopyInFileToMissingDirectoryFails), + Test("container copy in directory over existing file fails", testCopyInDirectoryOverExistingFileFails), + Test("container copy out", testCopyOut), + Test("container copy large file", testCopyLargeFile), + Test("container copy in directory", testCopyInDirectory), + Test("container copy out directory", testCopyOutDirectory), + Test("container copy empty file", testCopyEmptyFile), + Test("container copy empty directory", testCopyEmptyDirectory), + Test("container copy binary file", testCopyBinaryFile), + Test("container copy multiple files", testCopyMultipleFiles), + Test("container copy directory round trip", testCopyDirectoryRoundTrip), + Test("container copy in create parents", testCopyInCreateParents), + Test("container copy file permissions", testCopyFilePermissions), + Test("container copy large directory", testCopyLargeDirectory), + + // Read-only / writable layers + Test("container read-only rootfs", testReadOnlyRootfs), + Test("container read-only rootfs hosts file", testReadOnlyRootfsHostsFileWritten), + Test("container read-only rootfs DNS", testReadOnlyRootfsDNSConfigured), + Test("container writable layer", testWritableLayer), + Test("container writable layer journal writeback", testWritableLayerJournalWriteback), + Test("container writable layer journal ordered", testWritableLayerJournalOrdered), + Test("container writable layer journal data", testWritableLayerJournalData), + Test("container writable layer preserves lower", testWritableLayerPreservesLowerLayer), + Test("container writable layer reads from lower", testWritableLayerReadsFromLower), + Test("container writable layer with ro lower", testWritableLayerWithReadOnlyLower), + Test("container writable layer size", testWritableLayerSize), + Test("container writable layer DNS and hosts", testWritableLayerWithDNSAndHosts), + + // Stdin / stdout / exec + Test("large stdin input", testLargeStdinInput), + Test("exec large stdin input", testExecLargeStdinInput), + Test("exec custom path resolution", testExecCustomPathResolution), + Test("stdin explicit close", testStdinExplicitClose), + Test("stdin binary data", testStdinBinaryData), + Test("stdin multiple chunks", testStdinMultipleChunks), + Test("stdin very large", testStdinVeryLarge), + + // RLimit + Test("container rlimit open files", testRLimitOpenFiles), + Test("container rlimit multiple", testRLimitMultiple), + Test("container rlimit exec", testRLimitExec), + + // useInit + Test("container useInit basic", testUseInitBasic), + Test("container useInit exit code propagation", testUseInitExitCodePropagation), + Test("container useInit signal forwarding", testUseInitSignalForwarding), + Test("container useInit zombie reaping", testUseInitZombieReaping), + Test("container useInit with terminal", testUseInitWithTerminal), + Test("container useInit with stdin", testUseInitWithStdin), + + // Sysctl / security / workingDir + Test("container sysctl", testSysctl), + Test("container sysctl multiple", testSysctlMultiple), + Test("container noNewPrivileges", testNoNewPrivileges), + Test("container noNewPrivileges disabled", testNoNewPrivilegesDisabled), + Test("container noNewPrivileges exec", testNoNewPrivilegesExec), + Test("container workingDir created", testWorkingDirCreated), + Test("container workingDir exec created", testWorkingDirExecCreated), + + // VM resource overhead + Test("container VM resource overhead", testVMResourceOverhead), + + // Pods + Test("pod single container", testPodSingleContainer), + Test("pod multiple containers", testPodMultipleContainers), + Test("pod container output", testPodContainerOutput), + Test("pod concurrent containers", testPodConcurrentContainers), + Test("pod exec in container", testPodExecInContainer), + Test("pod exec in container env", testPodExecInContainerEnv), + Test("pod container hostname", testPodContainerHostname), + Test("pod container hostname defaults to container id", testPodContainerHostnameDefaultsToContainerID), + Test("pod stop container idempotency", testPodStopContainerIdempotency), + Test("pod list containers", testPodListContainers), + Test("pod container statistics", testPodContainerStatistics), + Test("pod memory events OOM kill", testPodMemoryEventsOOMKill), + Test("pod container resource limits", testPodContainerResourceLimits), + Test("pod container filesystem isolation", testPodContainerFilesystemIsolation), + Test("pod container PID namespace isolation", testPodContainerPIDNamespaceIsolation), + Test("pod container independent resource limits", testPodContainerIndependentResourceLimits), + Test("pod shared PID namespace", testPodSharedPIDNamespace), + Test("pod read-only rootfs", testPodReadOnlyRootfs), + Test("pod read-only rootfs DNS", testPodReadOnlyRootfsDNSConfigured), + Test("pod container hosts config", testPodContainerHostsConfig), + Test("pod multiple containers different DNS", testPodMultipleContainersDifferentDNS), + Test("pod multiple containers different hosts", testPodMultipleContainersDifferentHosts), + Test("pod level DNS", testPodLevelDNS), + Test("pod level DNS with container override", testPodLevelDNSWithContainerOverride), + Test("pod level hosts", testPodLevelHosts), + Test("pod level hosts with container override", testPodLevelHostsWithContainerOverride), + Test("pod level hostname", testPodLevelHostname), + Test("pod level hostname with container override", testPodLevelHostnameWithContainerOverride), + Test("pod rlimit open files", testPodRLimitOpenFiles), + Test("pod rlimit exec", testPodRLimitExec), + Test("pod useInit basic", testPodUseInitBasic), + Test("pod useInit exit code propagation", testPodUseInitExitCodePropagation), + Test("pod useInit signal forwarding", testPodUseInitSignalForwarding), + Test("pod useInit multiple containers", testPodUseInitMultipleContainers), + Test("pod useInit with shared PID namespace", testPodUseInitWithSharedPIDNamespace), + Test("pod sysctl", testPodSysctl), + Test("pod sysctl multiple containers", testPodSysctlMultipleContainers), + Test("pod invalid volume reference", testPodInvalidVolumeReference), + Test("pod duplicate volume name", testPodDuplicateVolumeName), + + // Mounts / virtiofs shares (cross-platform: VZ on macOS, virtiofsd on Linux/CH). + Test("container mount", testMounts), + Test("container single file mount", testSingleFileMount), + Test("container single file mount read-only", testSingleFileMountReadOnly), + Test("container single file mount write-back", testSingleFileMountWriteBack), + Test("container single file mount symlink", testSingleFileMountSymlink), + Test("container duplicate virtiofs mount", testDuplicateVirtiofsMount), + Test("container duplicate virtiofs mount via symlink", testDuplicateVirtiofsMountViaSymlink), + Test("container mount sort by depth", testMountsSortedByDepth), + Test("pod single file mount", testPodSingleFileMount), + ] + + #if os(macOS) + let macOSOnlyTests: [Test] = + [ + // ContainerManager-based tests (ContainerManager is macOS-only) + Test("container stop idempotency", testContainerStopIdempotency), + Test("container manager", testContainerManagerCreate), + Test("container reuse", testContainerReuse), + Test("container /dev/console", testContainerDevConsole), + + // Nested virtualization (VZ-only feature) + Test("nested virt", testNestedVirtualizationEnabled), + + // Filesystem operations (TODO: promote to cross-platform once verified on CH) + Test("container frozen ext4 clone", testFrozenExt4Clone), + Test("container trim ext4 clone", testTrimExt4Clone), + + // Unix socket forwarding (dynamic vsock listen exceeds CH's prebound stdio pool) + Test("unix socket into guest", testUnixSocketIntoGuest), + Test("unix socket into guest long container id", testUnixSocketIntoGuestLongContainerID), + Test("unix socket into guest symlink", testUnixSocketIntoGuestSymlink), + Test("pod unix socket into guest symlink", testPodUnixSocketIntoGuestSymlink), + + // High-concurrency stdio (exceeds CH's prebound stdio pool size) + Test("multiple concurrent processes", testMultipleConcurrentProcesses), + Test("multiple concurrent processes with output stress", testMultipleConcurrentProcessesOutputStress), + + // NBD volumes (test infra is macOS-only) + Test("container NBD mount", testContainerNBDMount), + Test("container NBD read-only", testContainerNBDReadOnly), + Test("container NBD raw block", testContainerNBDRawBlock), + Test("container NBD volume identity", testContainerNBDVolumeIdentity), + Test("pod shared NBD volume", testPodSharedNBDVolume), + Test("pod multiple NBD volumes", testPodMultipleNBDVolumes), + Test("pod unreferenced NBD volume", testPodUnreferencedVolume), + Test("pod NBD volume persistence", testPodNBDVolumePersistence), + Test("pod NBD concurrent writes", testPodNBDConcurrentWrites), + Test("pod NBD volume identity", testPodNBDVolumeIdentity), + Test("pod filesystem operation", testPodFilesystemOperation), + Test("pod shared disk image volume", testPodSharedDiskImageVolume), + ] + macOS26Tests() + let tests: [Test] = crossPlatformTests + macOSOnlyTests + #else + let tests: [Test] = crossPlatformTests + #endif + + let filteredTests: [Test] + if let filter { + // Comma-separated; ANY pattern matching the test name keeps it. + // E.g. `--filter "container mount,pod single file"`. + let patterns = filter.split(separator: ",").map { String($0) } + filteredTests = tests.filter { test in + patterns.contains { test.name.contains($0) } + } + log.info("filter '\(filter)' matched \(filteredTests.count)/\(tests.count) tests") + } else { + filteredTests = tests + } + + let passed: Atomic = Atomic(0) + let skipped: Atomic = Atomic(0) + + await withTaskGroup(of: Void.self) { group in + let jobQueue = JobQueue(filteredTests) + for _ in 0.. 0 { + finishingText += " and \(skippedCount)/\(filteredTests.count) skipped" + } + finishingText += "!" + + log.info("\(finishingText)") + + try? FileManager.default.removeItem(at: Self.testDir) + if passedCount + skippedCount < filteredTests.count { + log.error("❌") + throw ExitCode(1) + } + } +} diff --git a/Sources/cctl/BridgeCommand.swift b/Sources/cctl/BridgeCommand.swift new file mode 100644 index 0000000..2714acc --- /dev/null +++ b/Sources/cctl/BridgeCommand.swift @@ -0,0 +1,95 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import ArgumentParser +import Containerization +import ContainerizationExtras +import Foundation + +extension Application { + struct Bridge: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "bridge", + abstract: "Manage the host bridge used by `cctl run` for container networking", + subcommands: [Create.self, Delete.self] + ) + + struct Create: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "create", + abstract: "Create (or reconfigure idempotently) the host bridge + NAT plumbing" + ) + + @Option(name: .long, help: "Bridge interface name") + var name: String = "cz0" + + @Option(name: .long, help: "IPv4 subnet in CIDR form") + var subnet: String = "192.168.64.0/24" + + @Option(name: .long, help: "Host-side IPv4 on the bridge (defaults to subnet.lower+1)") + var gateway: String? + + @Option(name: .long, help: "Egress interface for MASQUERADE (default: auto-detect from default route)") + var egress: String? + + @Option(name: .long, help: "Bridge MTU") + var mtu: UInt32 = 1500 + + @Flag( + name: .customLong("enable-nat"), + help: + "Program iptables MASQUERADE/FORWARD and enable net.ipv4.ip_forward so containers reach the outside network. Off by default — host firewall policy is left untouched." + ) + var enableNAT: Bool = false + + func run() async throws { + let cidr = try CIDRv4(subnet) + let gw = try gateway.map { try IPv4Address($0) } + let mgr = BridgeManager( + name: name, + subnet: cidr, + gateway: gw, + mtu: mtu, + egressInterface: egress, + enableNAT: enableNAT, + logger: log + ) + try mgr.create() + } + } + + struct Delete: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "delete", + abstract: "Remove the bridge and revert the host plumbing this tool added" + ) + + @Option(name: .long, help: "Bridge interface name") + var name: String = "cz0" + + @Option(name: .long, help: "IPv4 subnet in CIDR form") + var subnet: String = "192.168.64.0/24" + + func run() async throws { + let cidr = try CIDRv4(subnet) + let mgr = BridgeManager(name: name, subnet: cidr, logger: log) + try mgr.delete() + } + } + } +} +#endif diff --git a/Sources/cctl/ImageCommand.swift b/Sources/cctl/ImageCommand.swift new file mode 100644 index 0000000..6247067 --- /dev/null +++ b/Sources/cctl/ImageCommand.swift @@ -0,0 +1,302 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationArchive +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +extension Application { + struct Images: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "images", + abstract: "Manage images", + subcommands: [ + Get.self, + Delete.self, + Pull.self, + Tag.self, + Push.self, + Save.self, + Load.self, + ] + ) + + func run() async throws { + let store = Application.imageStore + let images = try await store.list() + + print("REFERENCE\tMEDIA TYPE\tDIGEST") + for image in images { + print("\(image.reference)\t\(image.mediaType)\t\(image.digest)") + } + } + + struct Delete: AsyncParsableCommand { + @Argument var reference: String + + func run() async throws { + let store = Application.imageStore + try await store.delete(reference: reference) + } + } + + struct Tag: AsyncParsableCommand { + @Argument var old: String + @Argument var new: String + + func run() async throws { + let store = Application.imageStore + _ = try await store.tag(existing: old, new: new) + } + } + + struct Get: AsyncParsableCommand { + @Argument var reference: String + + func run() async throws { + let store = Application.imageStore + let image = try await store.get(reference: reference) + + let index = try await image.index() + + let enc = JSONEncoder() + enc.outputFormatting = .prettyPrinted + let data = try enc.encode(ImageDisplay(reference: image.reference, index: index)) + print(String(data: data, encoding: .utf8)!) + } + } + + struct ImageDisplay: Codable { + let reference: String + let index: Index + } + + struct Pull: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "pull", + abstract: "Pull an image's contents into a content store" + ) + + @Argument var ref: String + + @Option(name: .customLong("platform"), help: "Platform string in the form 'os/arch/variant'. Example 'linux/arm64/v8', 'linux/amd64'") var platformString: String? + + @Option( + name: .customLong("unpack-path"), help: "Path to a new directory to unpack the image into", + transform: { str in + URL(fileURLWithPath: str, relativeTo: .currentDirectory()).absoluteURL.path(percentEncoded: false) + }) + var unpackPath: String? + + @Flag(help: "Pull anonymously via plain-text HTTP.") + var http: Bool = false + + func run() async throws { + let imageStore = Application.imageStore + let platform: Platform? = try { + if let platformString { + return try Platform(from: platformString) + } + return nil + }() + + let reference = try Reference.parse(ref) + reference.normalize() + let normalizedReference = reference.description + if normalizedReference != ref { + print("Reference resolved to \(reference.description)") + } + + var startTime = ContinuousClock.now + let image = try await Images.withAuthentication(ref: normalizedReference, insecure: http) { auth in + try await imageStore.pull(reference: normalizedReference, platform: platform, insecure: http, auth: auth) + } + + guard let image else { + print("image pull failed") + Application.exit(withError: POSIXError(.EACCES)) + } + + var duration = ContinuousClock.now - startTime + print("Image pull took: \(duration)\n") + + guard let unpackPath else { + return + } + guard !FileManager.default.fileExists(atPath: unpackPath) else { + throw ContainerizationError(.exists, message: "directory already exists at \(unpackPath)") + } + let unpackUrl = URL(filePath: unpackPath) + try FileManager.default.createDirectory(at: unpackUrl, withIntermediateDirectories: true) + + let unpacker = EXT4Unpacker.init(blockSizeInBytes: 2.gib()) + + startTime = ContinuousClock.now + if let platform { + let name = platform.description.replacingOccurrences(of: "/", with: "-") + let _ = try await unpacker.unpack(image, for: platform, at: unpackUrl.appending(component: name)) + } else { + for descriptor in try await image.index().manifests { + if let referenceType = descriptor.annotations?["vnd.docker.reference.type"], referenceType == "attestation-manifest" { + continue + } + guard let descPlatform = descriptor.platform else { + continue + } + let name = descPlatform.description.replacingOccurrences(of: "/", with: "-") + let _ = try await unpacker.unpack(image, for: descPlatform, at: unpackUrl.appending(component: name)) + print("created snapshot for platform \(descPlatform.description)") + } + } + duration = ContinuousClock.now - startTime + print("\nUnpacking took: \(duration)") + } + } + + struct Push: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "push", + abstract: "Push an image to a remote registry" + ) + + @Option(help: "Platform string in the form 'os/arch/variant'. Example 'linux/arm64/v8', 'linux/amd64'") var platformString: String? + + @Flag(help: "Push anonymously via plain-text HTTP.") + var http: Bool = false + + @Argument var ref: String + + func run() async throws { + let imageStore = Application.imageStore + let platform: Platform? = try { + if let platformString { + return try Platform(from: platformString) + } + return nil + }() + + let reference = try Reference.parse(ref) + reference.normalize() + let normalizedReference = reference.description + if normalizedReference != ref { + print("Reference resolved to \(reference.description)") + } + + try await Images.withAuthentication(ref: normalizedReference, insecure: http) { auth in + try await imageStore.push(reference: normalizedReference, platform: platform, insecure: http, auth: auth) + } + print("image pushed") + } + } + + struct Save: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "save", + abstract: "Save one or more images to a tar archive" + ) + + @Option(help: "Platform string in the form 'os/arch/variant'. Example 'linux/arm64/v8', 'linux/amd64'") var platform: String? + + @Option(name: .shortAndLong, help: "Path to tar archive") + var output: String + + @Argument var reference: [String] + + func run() async throws { + var p: Platform? = nil + if let platform { + p = try Platform(from: platform) + } + let store = Application.imageStore + let tempDir = FileManager.default.uniqueTemporaryDirectory() + defer { + try? FileManager.default.removeItem(at: tempDir) + } + try await store.save(references: reference, out: tempDir, platform: p) + let writer = try ArchiveWriter(format: .pax, filter: .none, file: URL(filePath: output)) + try writer.archiveDirectory(tempDir) + try writer.finishEncoding() + print("image exported") + } + } + + struct Load: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "load", + abstract: "Load one or more images from a tar archive" + ) + + @Option(name: .shortAndLong, help: "Path to tar archive") + var input: String + + func run() async throws { + let store = Application.imageStore + let tarFile = URL(fileURLWithPath: input) + let reader = try ArchiveReader(file: tarFile.absoluteURL) + let tempDir = FileManager.default.uniqueTemporaryDirectory() + defer { + try? FileManager.default.removeItem(at: tempDir) + } + let rejectedPaths = try reader.extractContents(to: tempDir) + let imported = try await store.load(from: tempDir) + for image in imported { + print("imported \(image.reference)") + } + for rejectedPath in rejectedPaths { + print("warning: skipped image archive member \(rejectedPath)") + } + } + } + + private static func withAuthentication( + ref: String, insecure: Bool, + _ body: @Sendable @escaping (_ auth: Authentication?) async throws -> T? + ) async throws -> T? { + let parsed = try Reference.parse(ref) + guard let host = parsed.resolvedDomain else { + throw ContainerizationError(.invalidArgument, message: "no host specified in image reference") + } + if insecure { + return try await body(nil) + } + if let auth = Self.authenticationFromEnv(host: host) { + return try await body(auth) + } + #if os(macOS) + let keychain = KeychainHelper(securityDomain: Application.keychainID) + let authentication = try? keychain.lookup(hostname: host) + return try await body(authentication) + #else + return try await body(nil) + #endif + } + + private static func authenticationFromEnv(host: String) -> Authentication? { + let env = ProcessInfo.processInfo.environment + guard env["REGISTRY_HOST"] == host else { + return nil + } + guard let user = env["REGISTRY_USERNAME"], let password = env["REGISTRY_TOKEN"] else { + return nil + } + return BasicAuthentication(username: user, password: password) + } + } +} diff --git a/Sources/cctl/KernelCommand.swift b/Sources/cctl/KernelCommand.swift new file mode 100644 index 0000000..bde0774 --- /dev/null +++ b/Sources/cctl/KernelCommand.swift @@ -0,0 +1,81 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import Foundation + +extension Application { + struct KernelCommand: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "kernel", + abstract: "Manage kernel images", + subcommands: [ + Create.self + ] + ) + + struct Create: AsyncParsableCommand { + @Option(name: .shortAndLong, help: "Name for the kernel image") + var name: String + + @Option(name: .long, help: "Labels to add to the built image of the form =, [=,...]") + var labels: [String] = [] + + @Argument var kernels: [String] + + func run() async throws { + let imageStore = Application.imageStore + let contentStore = Application.contentStore + let labels = Application.parseKeyValuePairs(from: labels) + let binaries = try parseBinaries() + _ = try await KernelImage.create( + reference: name, + binaries: binaries, + labels: labels, + imageStore: imageStore, + contentStore: contentStore + ) + } + + func parseBinaries() throws -> [Kernel] { + var binaries = [Kernel]() + for rawBinary in kernels { + let parts = rawBinary.split(separator: ":") + guard parts.count == 2 else { + throw "invalid binary format: \(rawBinary)" + } + let platform: SystemPlatform + switch parts[1] { + case "arm64": + platform = .linuxArm + case "amd64": + platform = .linuxAmd + default: + fatalError("unsupported platform \(parts[1])") + } + binaries.append( + .init( + path: URL(fileURLWithPath: String(parts[0])), + platform: platform + ) + ) + } + return binaries + } + } + } +} diff --git a/Sources/cctl/LoginCommand.swift b/Sources/cctl/LoginCommand.swift new file mode 100644 index 0000000..d48311e --- /dev/null +++ b/Sources/cctl/LoginCommand.swift @@ -0,0 +1,85 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import Foundation + +#if os(macOS) +extension Application { + struct Login: AsyncParsableCommand { + + static let configuration = CommandConfiguration( + commandName: "login", + abstract: "Login to a registry" + ) + + @OptionGroup() var application: Application + + @Option(name: .shortAndLong, help: "Username") + var username: String = "" + + @Flag(help: "Take the password from stdin") + var passwordStdin: Bool = false + + @Argument(help: "Registry server name") + var server: String + + func run() async throws { + var username = self.username + var password = "" + if passwordStdin { + if username == "" { + throw ContainerizationError(.invalidArgument, message: "must provide --username with --password-stdin") + } + guard let passwordData = try FileHandle.standardInput.readToEnd() else { + throw ContainerizationError(.invalidArgument, message: "failed to read password from stdin") + } + password = String(decoding: passwordData, as: UTF8.self).trimmingCharacters(in: .whitespacesAndNewlines) + } + let keychain = KeychainHelper(securityDomain: Application.keychainID) + if username == "" { + username = try keychain.userPrompt(hostname: server) + } + if password == "" { + password = try keychain.passwordPrompt() + print() + } + + let server = Reference.resolveDomain(domain: self.server) + let client = RegistryClient( + host: server, + scheme: "https", + authentication: BasicAuthentication(username: username, password: password), + retryOptions: .init( + maxRetries: 10, + retryInterval: 300_000_000, + shouldRetry: ({ response in + response.status.code >= 500 + }) + ), + tlsConfiguration: TLSUtils.makeEnvironmentAwareTLSConfiguration(), + ) + try await client.ping() + try keychain.save(hostname: server, username: username, password: password) + print("Login succeeded") + } + } +} +#endif diff --git a/Sources/cctl/RootfsCommand.swift b/Sources/cctl/RootfsCommand.swift new file mode 100644 index 0000000..cd5fd36 --- /dev/null +++ b/Sources/cctl/RootfsCommand.swift @@ -0,0 +1,180 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationArchive +import ContainerizationEXT4 +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import Foundation + +extension Application { + struct Rootfs: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "rootfs", + abstract: "Manage the root filesystem for a container", + subcommands: [ + Create.self + ] + ) + + struct Create: AsyncParsableCommand { + @Option(name: [.short, .customLong("add-file")], help: "Additional file to add (format src-path:dst-path)") + var addFiles: [String] = [] + + @Option(name: .customLong("ext4"), help: "The path to an ext4 image to create.") + var ext4File: String? + + @Option(name: .customLong("image"), help: "The name of the image to produce.") + var imageName: String? + + @Option(name: .customLong("label"), help: "Label to add to the image (format: key=value)") + var labels: [String] = [] + + @Option(name: .long, help: "Platform of the built binaries being packaged into the block") + var platformString: String = Platform.current.description + + @Option(name: .long, help: "Path to vmexec") + var vmexec: String + + @Option(name: .long, help: "Path to vminitd") + var vminitd: String + + @Option(name: .long, help: "Path to OCI runtime") + var ociRuntime: String? + + // The path where the intermediate tar archive is created. + @Argument var tarPath: String + + private static let directories = [ + "bin", + "sbin", + "dev", + "sys", + "proc/self", // hack for swift init's booting + "run", + "tmp", + "mnt", + "var", + ] + + func run() async throws { + let path = URL(filePath: self.tarPath) + try await writeArchive(path: path) + + if let image = self.imageName { + print("creating initfs image \(image)...") + try await outputImage( + path: path, + reference: image + ) + } + + if let ext4Path = self.ext4File { + print("creating initfs ext4 image at \(ext4Path)...") + try await outputExt4( + archive: path, + to: URL(filePath: ext4Path) + ) + } + } + + private func outputExt4(archive: URL, to path: URL) async throws { + let unpacker = EXT4Unpacker(blockSizeInBytes: 256.mib()) + try await unpacker.unpack(archive: archive, compression: .gzip, at: path) + } + + private func outputImage(path: URL, reference: String) async throws { + let p = try Platform(from: platformString) + let parsedLabels = Application.parseKeyValuePairs(from: labels) + _ = try await InitImage.create( + reference: reference, + rootfs: path, + platform: p, + labels: parsedLabels, + imageStore: Application.imageStore, + contentStore: Application.contentStore + ) + } + + private func writeArchive(path: URL) async throws { + let writer = try ArchiveWriter( + format: .pax, + filter: .gzip, + file: path, + ) + let ts = Date() + let entry = WriteEntry() + entry.permissions = 0o755 + entry.modificationDate = ts + entry.creationDate = ts + entry.group = 0 + entry.owner = 0 + entry.fileType = .directory + + // create the initial directory structure. + for dir in Self.directories { + entry.path = dir + try writer.writeEntry(entry: entry, data: nil) + } + + entry.fileType = .regular + entry.path = "sbin/vminitd" + + var src = URL(fileURLWithPath: vminitd) + var data = try Data(contentsOf: src) + entry.size = Int64(data.count) + try writer.writeEntry(entry: entry, data: data) + + src = URL(fileURLWithPath: vmexec) + data = try Data(contentsOf: src) + entry.path = "sbin/vmexec" + entry.size = Int64(data.count) + try writer.writeEntry(entry: entry, data: data) + + if let ociRuntimePath = self.ociRuntime { + src = URL(fileURLWithPath: ociRuntimePath) + let fileName = src.lastPathComponent + data = try Data(contentsOf: src) + entry.path = "sbin/\(fileName)" + entry.size = Int64(data.count) + try writer.writeEntry(entry: entry, data: data) + } + + for addFile in addFiles { + let paths = addFile.components(separatedBy: ":") + guard paths.count == 2 else { + throw ContainerizationError(.invalidArgument, message: "use src-path:dst-path for --add-file") + } + src = URL(fileURLWithPath: paths[0]) + data = try Data(contentsOf: src) + entry.path = paths[1] + entry.size = Int64(data.count) + try writer.writeEntry(entry: entry, data: data) + } + + entry.fileType = .symbolicLink + entry.path = "proc/self/exe" + entry.symlinkTarget = "sbin/vminitd" + entry.size = nil + try writer.writeEntry(entry: entry, data: nil) + try writer.finishEncoding() + } + } + } +} diff --git a/Sources/cctl/RunCommand.swift b/Sources/cctl/RunCommand.swift new file mode 100644 index 0000000..cc5a00a --- /dev/null +++ b/Sources/cctl/RunCommand.swift @@ -0,0 +1,533 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation + +#if os(macOS) +extension Application { + struct Run: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "run", + abstract: "Run a container" + ) + + @Option(name: [.customLong("image"), .customShort("i")], help: "Image reference to base the container on") + var imageReference: String = "docker.io/library/alpine:3.16" + + @Option(name: .long, help: "id for the container") + var id: String = "cctl" + + @Option(name: [.customLong("cpus"), .customShort("c")], help: "Number of CPUs to allocate to the container") + var cpus: Int = 2 + + @Option(name: [.customLong("memory"), .customShort("m")], help: "Amount of memory in megabytes") + var memory: UInt64 = 1024 + + @Option(name: .customLong("fs-size"), help: "The size to create the block filesystem as") + var fsSizeInMB: UInt64 = 2048 + + @Flag(name: .customLong("rosetta"), help: "Enable rosetta x64 emulation") + var rosetta = false + + @Option(name: .customLong("mount"), help: "Directory to share into the container (Example: /foo:/bar)") + var mounts: [String] = [] + + @Option(name: .customLong("ns"), help: "Nameserver addresses") + var nameservers: [String] = [] + + @Option(name: .long, help: "Path to OCI runtime to use for spawning the container") + var ociRuntimePath: String? + + @Flag(name: .long, help: "Make rootfs readonly") + var readOnly: Bool = false + + @Flag(name: .long, help: "Run with an init process for signal forwarding and zombie reaping") + var `init`: Bool = false + + @Option( + name: [.customLong("kernel"), .customShort("k")], help: "Kernel binary path", completion: .file(), + transform: { str in + URL(fileURLWithPath: str, relativeTo: .currentDirectory()).absoluteURL.path(percentEncoded: false) + }) + public var kernel: String + + @Option(name: .long, help: "Current working directory") + var cwd: String = "/" + + @Argument(parsing: .captureForPassthrough) + var arguments: [String] = ["/bin/sh"] + + func run() async throws { + let kernel = Kernel( + path: URL(fileURLWithPath: kernel), + platform: .linuxArm + ) + + // Choose network implementation based on macOS version + let network: Network? + if #available(macOS 26, *) { + network = try VmnetNetwork() + } else { + network = nil + } + + var manager = try await ContainerManager( + kernel: kernel, + initfsReference: "vminit:latest", + network: network, + rosetta: rosetta + ) + let sigwinchStream = AsyncSignalHandler.create(notify: [SIGWINCH]) + + let current = try Terminal.current + try current.setraw() + defer { current.tryReset() } + + let container = try await manager.create( + id, + reference: imageReference, + rootfsSizeInBytes: fsSizeInMB.mib(), + readOnly: readOnly, + networking: true + ) { config in + config.cpus = cpus + config.memoryInBytes = memory.mib() + config.process.setTerminalIO(terminal: current) + config.process.arguments = arguments + config.process.workingDirectory = cwd + + for mount in self.mounts { + let paths = mount.split(separator: ":") + if paths.count != 2 { + throw ContainerizationError( + .invalidArgument, + message: "incorrect mount format detected: \(mount)" + ) + } + let host = String(paths[0]) + let guest = String(paths[1]) + let czMount = Containerization.Mount.share( + source: host, + destination: guest + ) + config.mounts.append(czMount) + } + + var hosts = Hosts.default + if !nameservers.isEmpty { + if #available(macOS 26, *) { + config.dns = DNS(nameservers: nameservers) + } else { + print("Warning: Networking not supported on macOS < 26, ignoring DNS configuration") + } + } + + // Add host entry for the container using just the IP (not CIDR) + if #available(macOS 26, *), !config.interfaces.isEmpty { + let interface = config.interfaces[0] + hosts.entries.append( + Hosts.Entry( + ipAddress: interface.ipv4Address.address.description, + hostnames: [id] + )) + } + + config.hosts = hosts + if let ociRuntimePath { + config.ociRuntimePath = ociRuntimePath + config.mounts = LinuxContainer.defaultOCIMounts() + } + + config.useInit = self.`init` + } + + defer { + try? manager.delete(id) + } + + try await container.create() + try await container.start() + + // Resize the containers pty to the current terminal window. + try? await container.resize(to: try current.size) + + try await withThrowingTaskGroup(of: Void.self) { group in + group.addTask { + for await _ in sigwinchStream.signals { + try await container.resize(to: try current.size) + } + } + + try await container.wait() + group.cancelAll() + + try await container.stop() + } + } + + private static let appRoot: URL = { + FileManager.default.urls( + for: .applicationSupportDirectory, + in: .userDomainMask + ).first! + .appendingPathComponent("com.apple.containerization") + }() + } +} +#endif + +#if os(Linux) +extension Application { + /// Linux-side `cctl run` — boots a container in a cloud-hypervisor VM. + /// + /// Mirrors the macOS `cctl run` UX: `-i / --image` pulls and unpacks the + /// container image into an ext4 rootfs automatically. The Linux-specific + /// surface is `--initfs` (the deployment ships an `initfs.ext4` containing + /// vminitd; macOS resolves the equivalent via the local image store, but + /// on Linux the boot artifact is a path on disk). + struct Run: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "run", + abstract: "Run a container via cloud-hypervisor" + ) + + @Option(name: [.customLong("image"), .customShort("i")], help: "Image reference to base the container on") + var imageReference: String = "docker.io/library/alpine:3.16" + + @Option(name: .long, help: "id for the container") + var id: String = "cctl" + + @Option(name: [.customLong("cpus"), .customShort("c")], help: "Number of CPUs to allocate") + var cpus: Int = 2 + + @Option(name: [.customLong("memory"), .customShort("m")], help: "Amount of memory in MiB") + var memory: UInt64 = 1024 + + @Option(name: .customLong("fs-size"), help: "The size to create the container rootfs ext4 as (MiB)") + var fsSizeInMB: UInt64 = 2048 + + @Option(name: .customLong("mount"), help: "Directory to share into the container (Example: /foo:/bar)") + var mounts: [String] = [] + + @Option(name: .long, help: "Path to OCI runtime to use for spawning the container") + var ociRuntimePath: String? + + @Flag(name: .long, help: "Make rootfs readonly") + var readOnly: Bool = false + + @Flag(name: .long, help: "Run with an init process for signal forwarding and zombie reaping") + var `init`: Bool = false + + @Option( + name: [.customLong("kernel"), .customShort("k")], + help: "Path to the Linux kernel image", + completion: .file() + ) + var kernel: String + + @Option( + name: .customLong("initfs"), + help: "Path to the ext4 initfs containing vminitd (boots the VM as PID 1)", + completion: .file() + ) + var initfs: String + + @Option( + name: .customLong("bridge"), + help: "Bridge interface name to attach the container TAP to" + ) + var bridge: String = "cz0" + + @Option( + name: .customLong("subnet"), + help: "IPv4 subnet for the container network (CIDR)" + ) + var subnet: String = "192.168.64.0/24" + + @Option( + name: .customLong("gateway"), + help: "Host-side IPv4 on the bridge (defaults to subnet.lower+1)" + ) + var bridgeGateway: String? + + @Option( + name: .customLong("egress"), + help: "Egress interface for outbound NAT (default: auto-detect from default route)" + ) + var egress: String? + + @Flag(name: .customLong("no-network"), help: "Skip all host network setup; container has no interface") + var noNetwork: Bool = false + + @Flag( + name: .customLong("enable-nat"), + help: + "Program iptables MASQUERADE/FORWARD and enable ip_forward so the container can reach external networks. Off by default — the bridge stays internal-only." + ) + var enableNAT: Bool = false + + @Option(name: .customLong("ns"), help: "Nameserver addresses (default: read host /etc/resolv.conf)") + var nameservers: [String] = [] + + @Option( + name: .customLong("ch-binary"), + help: "Path to cloud-hypervisor binary (defaults to PATH lookup)" + ) + var chBinary: String? + + @Option( + name: .customLong("virtiofsd-binary"), + help: "Path to virtiofsd binary (defaults to PATH lookup)" + ) + var virtiofsdBinary: String? + + @Option(name: .long, help: "Current working directory") + var cwd: String = "/" + + @Argument(parsing: .captureForPassthrough) + var arguments: [String] = ["/bin/sh"] + + func run() async throws { + #if arch(arm64) + let kernelPlatform = SystemPlatform.linuxArm + #elseif arch(x86_64) + let kernelPlatform = SystemPlatform.linuxAmd + #else + #error("unsupported host architecture for `cctl run` (expected arm64 or x86_64)") + #endif + let imagePlatform = Platform.current + + let kernelObj = Kernel( + path: URL(fileURLWithPath: kernel), + platform: kernelPlatform + ) + + // Wire up the host TTY when there is one. `Terminal.current` walks + // STDERR/STDOUT/STDIN looking for a tty fd and throws if none of + // them is one (e.g. all stdio piped). In that case fall through to + // the non-interactive path so `cctl run /bin/true` still works. + let hostTerminal = try? Terminal.current + if let hostTerminal { + try hostTerminal.setraw() + } + defer { hostTerminal?.tryReset() } + let sigwinchStream = AsyncSignalHandler.create(notify: [SIGWINCH]) + + // Pull the container image and unpack to a per-container ext4 (same + // shape as ContainerManager.unpack on macOS: reuse the existing + // rootfs.ext4 if it's already there, fresh-unpack otherwise). + let imageStore = Application.imageStore + let reference = try Reference.parse(imageReference) + reference.normalize() + let normalizedRef = reference.description + if normalizedRef != imageReference { + print("Reference resolved to \(normalizedRef)") + } + let image = try await imageStore.get(reference: normalizedRef, pull: true) + + let containersRoot = Application.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(id) + try FileManager.default.createDirectory(at: containersRoot, withIntermediateDirectories: true) + let rootfsPath = containersRoot.appendingPathComponent("rootfs.ext4") + + var rootfsMount: Containerization.Mount + do { + let unpacker = EXT4Unpacker(blockSizeInBytes: fsSizeInMB.mib()) + rootfsMount = try await unpacker.unpack(image, for: imagePlatform, at: rootfsPath) + } catch let err as ContainerizationError where err.code == .exists { + rootfsMount = .block( + format: "ext4", + source: rootfsPath.absolutePath(), + destination: "/", + options: [] + ) + } + if readOnly { + rootfsMount.options.append("ro") + } + + let initfsMount = Mount.block( + format: "ext4", + source: initfs, + destination: "/", + options: ["ro"] + ) + + let manager = try CHVirtualMachineManager( + kernel: kernelObj, + initialFilesystem: initfsMount, + chBinary: chBinary.map { URL(fileURLWithPath: $0) }, + virtiofsdBinary: virtiofsdBinary.map { URL(fileURLWithPath: $0) }, + logger: log + ) + + // Seed process config from the image (entrypoint, env, cwd, user), + // then layer user-provided overrides on top — same precedence as + // ContainerManager + macOS Run. + let imageConfig = try await image.config(for: imagePlatform).config + var processConfig = LinuxProcessConfiguration() + if let imageConfig { + processConfig = .init(from: imageConfig) + } + processConfig.arguments = arguments + processConfig.workingDirectory = cwd + if let hostTerminal { + processConfig.setTerminalIO(terminal: hostTerminal) + } + + var interfaces: [any Interface] = [] + var dnsConfig: DNS? = nil + var hostsConfig: Hosts? = nil + + if !noNetwork { + let subnetCIDR = try CIDRv4(subnet) + let gw = try bridgeGateway.map { try IPv4Address($0) } + + let mgr = BridgeManager( + name: bridge, + subnet: subnetCIDR, + gateway: gw, + mtu: 1500, + egressInterface: egress, + enableNAT: enableNAT, + logger: log + ) + try mgr.create() + + var network = try LinuxBridgedNetwork( + subnet: subnetCIDR, + gateway: gw, + bridge: bridge, + mtu: 1500 + ) + if let iface = try network.createInterface(id) { + interfaces.append(iface) + + var h = Hosts.default + h.entries.append( + .init( + ipAddress: iface.ipv4Address.address.description, + hostnames: [id] + )) + hostsConfig = h + + let resolved = + nameservers.isEmpty + ? Self.readHostNameservers() + : nameservers + dnsConfig = DNS(nameservers: resolved) + } + } + + let cpusCount = cpus + let memoryBytes = memory.mib() + let networkInterfaces = interfaces + let useInit = self.`init` + let extraMounts = self.mounts + let runtimePath = self.ociRuntimePath + let dns = dnsConfig + let hosts = hostsConfig + + let container = try LinuxContainer( + id, + rootfs: rootfsMount, + vmm: manager, + logger: log + ) { config in + config.process = processConfig + config.cpus = cpusCount + config.memoryInBytes = memoryBytes + config.interfaces = networkInterfaces + config.useInit = useInit + if let dns { config.dns = dns } + if let hosts { config.hosts = hosts } + + for mount in extraMounts { + let paths = mount.split(separator: ":") + if paths.count != 2 { + throw ContainerizationError( + .invalidArgument, + message: "incorrect mount format detected: \(mount)" + ) + } + config.mounts.append( + Mount.share(source: String(paths[0]), destination: String(paths[1])) + ) + } + + if let runtimePath { + config.ociRuntimePath = runtimePath + config.mounts = LinuxContainer.defaultOCIMounts() + } + } + + try await container.create() + try await container.start() + + // Sync the guest pty winsize to the host on start, and on every + // SIGWINCH while running. Only meaningful when we have a tty. + if let hostTerminal { + try? await container.resize(to: try hostTerminal.size) + } + + let exit = try await withThrowingTaskGroup( + of: Void.self, + returning: ExitStatus.self + ) { group in + if let hostTerminal { + group.addTask { + for await _ in sigwinchStream.signals { + try await container.resize(to: try hostTerminal.size) + } + } + } + let result = try await container.wait() + group.cancelAll() + try await container.stop() + return result + } + + if exit.exitCode != 0 { + throw ExitCode(exit.exitCode) + } + } + + /// Read `nameserver` lines from `/etc/resolv.conf`. Returns + /// `["1.1.1.1"]` if the file is missing or has no entries. + private static func readHostNameservers() -> [String] { + guard let text = try? String(contentsOfFile: "/etc/resolv.conf", encoding: .utf8) else { + return ["1.1.1.1"] + } + let servers = + text + .split(separator: "\n") + .compactMap { line -> String? in + let parts = line.split(separator: " ", maxSplits: 1, omittingEmptySubsequences: true) + guard parts.count == 2, parts[0] == "nameserver" else { return nil } + return String(parts[1]).trimmingCharacters(in: .whitespaces) + } + return servers.isEmpty ? ["1.1.1.1"] : servers + } + } +} +#endif diff --git a/Sources/cctl/cctl+Utils.swift b/Sources/cctl/cctl+Utils.swift new file mode 100644 index 0000000..4c5673d --- /dev/null +++ b/Sources/cctl/cctl+Utils.swift @@ -0,0 +1,53 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Containerization +import ContainerizationError +import ContainerizationOCI +import Foundation + +extension Application { + static func fetchImage(reference: String, store: ImageStore) async throws -> Containerization.Image { + do { + return try await store.get(reference: reference) + } catch let error as ContainerizationError { + if error.code == .notFound { + return try await store.pull(reference: reference) + } + throw error + } + } + + static func parseKeyValuePairs(from items: [String]) -> [String: String] { + var parsedLabels: [String: String] = [:] + for item in items { + let parts = item.split(separator: "=", maxSplits: 1) + guard parts.count == 2 else { + continue + } + let key = String(parts[0]) + let val = String(parts[1]) + parsedLabels[key] = val + } + return parsedLabels + } +} + +extension ContainerizationOCI.Platform { + static var arm64: ContainerizationOCI.Platform { + .init(arch: "arm64", os: "linux", variant: "v8") + } +} diff --git a/Sources/cctl/cctl.swift b/Sources/cctl/cctl.swift new file mode 100644 index 0000000..e2c5413 --- /dev/null +++ b/Sources/cctl/cctl.swift @@ -0,0 +1,88 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationOCI +import Foundation +import Logging + +let log = { + LoggingSystem.bootstrap(StreamLogHandler.standardError) + var log = Logger(label: "com.apple.containerization") + log.logLevel = .debug + return log +}() + +@main +struct Application: AsyncParsableCommand { + static let keychainID = "com.apple.containerization" + static let appRoot: URL = { + FileManager.default.urls( + for: .applicationSupportDirectory, + in: .userDomainMask + ).first! + .appendingPathComponent("com.apple.containerization") + }() + + private static let _contentStore: ContentStore = { + try! LocalContentStore(path: appRoot.appendingPathComponent("content")) + }() + + private static let _imageStore: ImageStore = { + try! ImageStore( + path: appRoot, + contentStore: contentStore + ) + }() + + static var imageStore: ImageStore { + _imageStore + } + + static var contentStore: ContentStore { + _contentStore + } + + static let configuration = CommandConfiguration( + commandName: "cctl", + abstract: "Utility CLI for Containerization", + version: "2.0.0", + subcommands: { + var commands: [any ParsableCommand.Type] = [ + Rootfs.self, + Images.self, + Run.self, + ] + #if os(macOS) + commands.append(Login.self) + #elseif os(Linux) + commands.append(Bridge.self) + #endif + return commands + }() + ) +} + +extension String { + var absoluteURL: URL { + URL(fileURLWithPath: self).absoluteURL + } +} + +extension String: Swift.Error { + +} diff --git a/Tests/CloudHypervisorTests/ClientTests.swift b/Tests/CloudHypervisorTests/ClientTests.swift new file mode 100644 index 0000000..a5678dc --- /dev/null +++ b/Tests/CloudHypervisorTests/ClientTests.swift @@ -0,0 +1,506 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import NIOPosix +import Testing + +@testable import CloudHypervisor + +@Suite("CloudHypervisor.Client") +struct ClientTests { + private static let group = MultiThreadedEventLoopGroup.singleton + + // MARK: - Init + + @Test("Client init succeeds with file:// URL") + func initSucceeds() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let socketURL = URL(filePath: server.socketPath) + let _ = try CloudHypervisor.Client( + socketPath: socketURL, + eventLoopGroup: Self.group + ) + } + + // MARK: - Invalid socket path + + @Test("Client init throws .invalidSocketPath for non-file URL") + func initThrowsForNonFileURL() throws { + let url = try #require(URL(string: "https://example.com")) + #expect(throws: CloudHypervisor.Error.self) { + try CloudHypervisor.Client(socketPath: url, eventLoopGroup: Self.group) + } + } + + // MARK: - Non-2xx response + + @Test("Non-2xx response throws .http with correct status") + func non2xxThrowsHTTPError() async throws { + let body = Data("not found".utf8) + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.notFound, body: body) + } + defer { Task { try? await server.shutdown() } } + + let socketURL = URL(filePath: server.socketPath) + let client = try CloudHypervisor.Client(socketPath: socketURL, eventLoopGroup: Self.group) + + struct Dummy: Decodable, Sendable {} + + do { + let _: Dummy = try await client.get("/api/v1/missing") + Issue.record("Expected .http error but call succeeded") + } catch let err as CloudHypervisor.Error { + guard case .http(let status, let respBody) = err else { + Issue.record("Expected .http, got \(err)") + return + } + #expect(status == .notFound) + #expect(respBody == body) + } catch { + Issue.record("Expected CloudHypervisor.Error but got \(error)") + } + } + + // MARK: - vmmPing + + @Test("vmmPing sends GET /api/v1/vmm.ping and decodes VmmPingResponse") + func vmmPing() async throws { + let expected = CloudHypervisor.VmmPingResponse(version: "v40.0", pid: 12345) + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(expected)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmmPing() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .GET) + #expect(recorded[0].uri == "/api/v1/vmm.ping") + #expect(recorded[0].body.isEmpty) + #expect(result.version == "v40.0") + #expect(result.pid == 12345) + } + + // MARK: - vmmShutdown + + @Test("vmmShutdown sends PUT /api/v1/vmm.shutdown and returns without throwing") + func vmmShutdown() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmmShutdown() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vmm.shutdown") + } + + // MARK: - vmmInfo + + @Test("vmmInfo sends GET /api/v1/vmm.info and decodes VmmInfo") + func vmmInfo() async throws { + let expected = CloudHypervisor.VmmInfo(version: "v40.0", pid: 99) + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(expected)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmmInfo() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .GET) + #expect(recorded[0].uri == "/api/v1/vmm.info") + #expect(result.version == "v40.0") + } + + // MARK: - vmCreate + + @Test("vmCreate sends PUT /api/v1/vm.create with encoded body") + func vmCreate() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let config = CloudHypervisor.VmConfig( + cpus: .init(bootVcpus: 2, maxVcpus: 4), + memory: .init(size: 512 * 1024 * 1024), + payload: .init(kernel: "/boot/vmlinux"), + console: .init(mode: .Null), + serial: .init(mode: .Tty) + ) + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmCreate(config) + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.create") + + let decoded = try JSONDecoder().decode(CloudHypervisor.VmConfig.self, from: recorded[0].body) + #expect(decoded == config) + } + + // MARK: - vmBoot + + @Test("vmBoot sends PUT /api/v1/vm.boot with no body") + func vmBoot() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmBoot() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.boot") + #expect(recorded[0].body.isEmpty) + } + + // Regression: cloud-hypervisor's HTTP parser rejects body-less PUTs + // unless they carry an explicit `Content-Length: 0`. With the + // AsyncHTTPClient transport, that wire shape is produced by + // assigning `request.body = .bytes(ByteBuffer())` so AHC's + // RequestValidation re-derives framing as `known(0)` per RFC 7230 + // §3.3.2. This test asserts the on-the-wire result rather than how + // it's produced, so any future transport change that drops the + // empty-body framing surfaces here. + @Test("Body-less PUT sends Content-Length: 0 with empty body") + func bodylessPUTSendsContentLengthZero() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client( + socketPath: URL(filePath: server.socketPath), + eventLoopGroup: Self.group + ) + try await client.vmBoot() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + let req = try #require(recorded.first) + #expect(req.method == .PUT) + #expect(req.uri == "/api/v1/vm.boot") + #expect(req.body.isEmpty) + #expect(req.headers["Content-Length"].first == "0") + } + + // MARK: - vmShutdown + + @Test("vmShutdown sends PUT /api/v1/vm.shutdown with no body") + func vmShutdown() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmShutdown() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.shutdown") + #expect(recorded[0].body.isEmpty) + } + + // MARK: - vmInfo + + @Test("vmInfo sends GET /api/v1/vm.info and decodes VmInfo") + func vmInfo() async throws { + let expectedConfig = CloudHypervisor.VmConfig( + cpus: .init(bootVcpus: 1, maxVcpus: 1), + memory: .init(size: 256 * 1024 * 1024), + payload: .init(kernel: "/boot/vmlinux"), + console: .init(mode: .Null), + serial: .init(mode: .Null) + ) + let expected = CloudHypervisor.VmInfo(config: expectedConfig, state: .Running) + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(expected)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmInfo() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .GET) + #expect(recorded[0].uri == "/api/v1/vm.info") + #expect(recorded[0].body.isEmpty) + #expect(result == expected) + } + + // MARK: - vmPause + + @Test("vmPause sends PUT /api/v1/vm.pause with no body") + func vmPause() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmPause() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.pause") + #expect(recorded[0].body.isEmpty) + } + + // MARK: - vmResume + + @Test("vmResume sends PUT /api/v1/vm.resume with no body") + func vmResume() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmResume() + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.resume") + #expect(recorded[0].body.isEmpty) + } + + // MARK: - vmAddDisk + + @Test("vmAddDisk sends PUT /api/v1/vm.add-disk and returns PciDeviceInfo") + func vmAddDisk() async throws { + let pciInfo = CloudHypervisor.PciDeviceInfo(id: "_disk0", bdf: "0000:00:01.0") + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(pciInfo)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let config = CloudHypervisor.DiskConfig(path: "/tmp/disk.img", readonly: true, id: "_disk0") + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmAddDisk(config) + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.add-disk") + + let decoded = try JSONDecoder().decode(CloudHypervisor.DiskConfig.self, from: recorded[0].body) + #expect(decoded == config) + #expect(result == pciInfo) + } + + // MARK: - vmAddFs + + @Test("vmAddFs sends PUT /api/v1/vm.add-fs and returns PciDeviceInfo") + func vmAddFs() async throws { + let pciInfo = CloudHypervisor.PciDeviceInfo(id: "_disk0", bdf: "0000:00:01.0") + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(pciInfo)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let config = CloudHypervisor.FsConfig(tag: "myfs", socket: "/tmp/virtiofsd.sock", id: "_fs0") + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmAddFs(config) + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.add-fs") + + let decoded = try JSONDecoder().decode(CloudHypervisor.FsConfig.self, from: recorded[0].body) + #expect(decoded == config) + #expect(result == pciInfo) + } + + // MARK: - vmAddNet + + @Test("vmAddNet sends PUT /api/v1/vm.add-net and returns PciDeviceInfo") + func vmAddNet() async throws { + let pciInfo = CloudHypervisor.PciDeviceInfo(id: "_disk0", bdf: "0000:00:01.0") + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(pciInfo)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let config = CloudHypervisor.NetConfig(tap: "tap0", mac: "AA:BB:CC:DD:EE:FF", id: "_net0") + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmAddNet(config) + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.add-net") + + let decoded = try JSONDecoder().decode(CloudHypervisor.NetConfig.self, from: recorded[0].body) + #expect(decoded == config) + #expect(result == pciInfo) + } + + // MARK: - vmAddVsock + + @Test("vmAddVsock sends PUT /api/v1/vm.add-vsock and returns PciDeviceInfo") + func vmAddVsock() async throws { + let pciInfo = CloudHypervisor.PciDeviceInfo(id: "_disk0", bdf: "0000:00:01.0") + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + (try? StubResponse.json(pciInfo)) ?? StubResponse.ok() + } + defer { Task { try? await server.shutdown() } } + + let config = CloudHypervisor.VsockConfig(cid: 3, socket: "/tmp/vsock.sock", id: "_vsock0") + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + let result = try await client.vmAddVsock(config) + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.add-vsock") + + let decoded = try JSONDecoder().decode(CloudHypervisor.VsockConfig.self, from: recorded[0].body) + #expect(decoded == config) + #expect(result == pciInfo) + } + + // MARK: - vmRemoveDevice + + @Test("vmRemoveDevice sends PUT /api/v1/vm.remove-device with id body") + func vmRemoveDevice() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let client = try CloudHypervisor.Client(socketPath: URL(filePath: server.socketPath), eventLoopGroup: Self.group) + try await client.vmRemoveDevice(id: "_disk0") + + let recorded = server.recordedRequests() + #expect(recorded.count == 1) + #expect(recorded[0].method == .PUT) + #expect(recorded[0].uri == "/api/v1/vm.remove-device") + + struct RemoveRequest: Decodable { let id: String } + let decoded = try JSONDecoder().decode(RemoveRequest.self, from: recorded[0].body) + #expect(decoded.id == "_disk0") + } + + // MARK: - Malformed JSON + + @Test("Malformed JSON on 200 response throws .decoding") + func malformedJSONThrowsDecoding() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.ok(Data("not json".utf8)) + } + defer { Task { try? await server.shutdown() } } + + let socketURL = URL(filePath: server.socketPath) + let client = try CloudHypervisor.Client(socketPath: socketURL, eventLoopGroup: Self.group) + + struct Dummy: Decodable, Sendable {} + + do { + let _: Dummy = try await client.get("/api/v1/vmm.info") + Issue.record("Expected .decoding error but call succeeded") + } catch let err as CloudHypervisor.Error { + guard case .decoding = err else { + Issue.record("Expected .decoding, got \(err)") + return + } + // Expected path — decoding error correctly surfaced. + } catch { + Issue.record("Expected CloudHypervisor.Error but got \(error)") + } + } + + // MARK: - Shutdown ordering + + /// Regression: with a caller-supplied group, `Client.shutdown()` must + /// drain the underlying HTTPClient before the caller tears the group + /// down. Without this, AsyncHTTPClient's deferred connection-cleanup + /// runs on the (now-dead) event loops and SwiftNIO prints + /// "Cannot schedule tasks on an EventLoop that has already shut down". + /// The singleton group used by the rest of this suite can't surface + /// the bug because it never shuts down, so we spin up a dedicated + /// group for the client here. The server stays on the singleton so + /// only the client-side AHC channels are at risk when we shut the + /// owned group down — otherwise the server's own pipeline cleanup + /// would race the same group teardown and confound the test. + @Test("Client.shutdown drains HTTPClient before a caller-owned group is torn down") + func shutdownDrainsHTTPClientBeforeGroup() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + let clientGroup = MultiThreadedEventLoopGroup(numberOfThreads: 2) + let client = try CloudHypervisor.Client( + socketPath: URL(filePath: server.socketPath), + eventLoopGroup: clientGroup + ) + // Round-trip a real request so AHC actually opens a connection + // and parks its post-response cleanup on `clientGroup`. + try await client.vmmShutdown() + + try await client.shutdown() + // Idempotent — a second call must not throw. + try await client.shutdown() + + // The owned group should now be safe to tear down without NIO + // warnings. + try await clientGroup.shutdownGracefully() + } + + @Test("Client.shutdown also tears down the group when the client owns it") + func shutdownOwnsGroup() async throws { + let server = try await StubHTTPServer(eventLoopGroup: Self.group) { _ in + StubResponse.status(.noContent) + } + defer { Task { try? await server.shutdown() } } + + // No eventLoopGroup → client owns its own. + let client = try CloudHypervisor.Client( + socketPath: URL(filePath: server.socketPath) + ) + try await client.vmmShutdown() + try await client.shutdown() + // Idempotent. + try await client.shutdown() + } +} diff --git a/Tests/CloudHypervisorTests/ErrorsTests.swift b/Tests/CloudHypervisorTests/ErrorsTests.swift new file mode 100644 index 0000000..4674222 --- /dev/null +++ b/Tests/CloudHypervisorTests/ErrorsTests.swift @@ -0,0 +1,35 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import NIOHTTP1 +import Testing + +@testable import CloudHypervisor + +@Suite("CloudHypervisor.Error") +struct ErrorsTests { + @Test("http case carries status and body") + func httpCase() { + let err = CloudHypervisor.Error.http(status: .badRequest, body: Data("nope".utf8)) + guard case .http(let status, let body) = err else { + Issue.record("expected .http") + return + } + #expect(status == .badRequest) + #expect(String(data: body, encoding: .utf8) == "nope") + } +} diff --git a/Tests/CloudHypervisorTests/StubHTTPServer.swift b/Tests/CloudHypervisorTests/StubHTTPServer.swift new file mode 100644 index 0000000..9ea545a --- /dev/null +++ b/Tests/CloudHypervisorTests/StubHTTPServer.swift @@ -0,0 +1,203 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import NIOConcurrencyHelpers +import NIOCore +import NIOHTTP1 +import NIOPosix + +// MARK: - StubRequest / StubResponse + +/// An inbound HTTP request captured by the stub server. +struct StubRequest: Sendable { + let method: HTTPMethod + let uri: String + let body: Data + let headers: HTTPHeaders +} + +/// A canned HTTP response produced by the stub server. +struct StubResponse: Sendable { + let status: HTTPResponseStatus + let body: Data + let headers: HTTPHeaders + + static func ok(_ body: Data = .init()) -> StubResponse { + StubResponse(status: .ok, body: body, headers: [:]) + } + + static func json(_ value: T) throws -> StubResponse { + let data = try JSONEncoder().encode(value) + var headers = HTTPHeaders() + headers.add(name: "Content-Type", value: "application/json") + return StubResponse(status: .ok, body: data, headers: headers) + } + + static func status(_ status: HTTPResponseStatus, body: Data = .init()) -> StubResponse { + StubResponse(status: status, body: body, headers: [:]) + } +} + +// MARK: - StubHTTPServer + +/// An in-process HTTP/1.1 server bound to a Unix Domain Socket, used in tests. +/// +/// Example: +/// ```swift +/// let server = try await StubHTTPServer(eventLoopGroup: group) { req in +/// return StubResponse.ok(Data("{}".utf8)) +/// } +/// defer { Task { try? await server.shutdown() } } +/// ``` +final class StubHTTPServer: Sendable { + /// The path to the Unix Domain Socket this server is bound to. + let socketPath: String + + private let channel: Channel + /// Recorded requests, protected by a lock so the test thread can read safely. + private let requests: NIOLockedValueBox<[StubRequest]> + + init( + eventLoopGroup: any EventLoopGroup, + handler: @escaping @Sendable (StubRequest) -> StubResponse + ) async throws { + let sockPath = FileManager.default.temporaryDirectory + .appendingPathComponent("ch-stub-\(UUID().uuidString).sock") + .path + + let requestsBox = NIOLockedValueBox<[StubRequest]>([]) + + let bootstrap = ServerBootstrap(group: eventLoopGroup) + .serverChannelOption(.backlog, value: 256) + .serverChannelOption(.socketOption(.so_reuseaddr), value: 1) + .childChannelInitializer { channel in + channel.eventLoop.makeCompletedFuture { + try channel.pipeline.syncOperations.configureHTTPServerPipeline( + withPipeliningAssistance: false + ) + try channel.pipeline.syncOperations.addHandler( + StubRequestHandler(userHandler: handler, requests: requestsBox) + ) + } + } + + let boundChannel = + try await bootstrap + .bind(unixDomainSocketPath: sockPath, cleanupExistingSocketFile: true) + .get() + + self.socketPath = sockPath + self.channel = boundChannel + self.requests = requestsBox + } + + /// Stop accepting connections and close the listening socket. + func shutdown() async throws { + try await channel.close().get() + try? FileManager.default.removeItem(atPath: socketPath) + } + + /// Returns all requests recorded so far. + func recordedRequests() -> [StubRequest] { + requests.withLockedValue { $0 } + } +} + +// MARK: - StubRequestHandler + +/// Handles a single inbound HTTP/1.1 request, invokes the user handler, and +/// writes the stub response. +/// +/// All ChannelHandler callbacks run on the channel's event loop, so the mutable +/// inbound-state fields need no external synchronisation. The shared `requests` +/// box is still locked because the test thread reads it from outside the loop. +private final class StubRequestHandler: ChannelInboundHandler, @unchecked Sendable { + typealias InboundIn = HTTPServerRequestPart + typealias OutboundOut = HTTPServerResponsePart + + private let userHandler: @Sendable (StubRequest) -> StubResponse + private let requests: NIOLockedValueBox<[StubRequest]> + + // Mutable inbound state — only touched on the event loop. + private var pendingMethod: HTTPMethod? + private var pendingURI: String? + private var pendingHeaders: HTTPHeaders = [:] + private var pendingBody: [UInt8] = [] + + init( + userHandler: @escaping @Sendable (StubRequest) -> StubResponse, + requests: NIOLockedValueBox<[StubRequest]> + ) { + self.userHandler = userHandler + self.requests = requests + } + + func channelRead(context: ChannelHandlerContext, data: NIOAny) { + switch unwrapInboundIn(data) { + case .head(let head): + pendingMethod = head.method + pendingURI = head.uri + pendingHeaders = head.headers + pendingBody = [] + case .body(var buf): + if let bytes = buf.readBytes(length: buf.readableBytes) { + pendingBody.append(contentsOf: bytes) + } + case .end: + guard let method = pendingMethod, let uri = pendingURI else { + context.close(promise: nil) + return + } + let request = StubRequest( + method: method, + uri: uri, + body: Data(pendingBody), + headers: pendingHeaders + ) + requests.withLockedValue { $0.append(request) } + let stubResp = userHandler(request) + writeResponse(context: context, response: stubResp) + } + } + + private func writeResponse(context: ChannelHandlerContext, response: StubResponse) { + var respHeaders = response.headers + respHeaders.replaceOrAdd(name: "Content-Length", value: "\(response.body.count)") + respHeaders.replaceOrAdd(name: "Connection", value: "close") + + let head = HTTPResponseHead(version: .http1_1, status: response.status, headers: respHeaders) + context.write(wrapOutboundOut(.head(head)), promise: nil) + + if !response.body.isEmpty { + var buf = context.channel.allocator.buffer(capacity: response.body.count) + buf.writeBytes(response.body) + context.write(wrapOutboundOut(.body(.byteBuffer(buf))), promise: nil) + } + + // Use NIOLoopBound to safely capture `context` in a @Sendable closure. + // The bound asserts event-loop access; the close runs on the same loop + // as the flush completion, which is correct. + let boundContext = NIOLoopBound(context, eventLoop: context.eventLoop) + context.writeAndFlush(wrapOutboundOut(.end(nil))).whenComplete { _ in + boundContext.value.close(promise: nil) + } + } + + func errorCaught(context: ChannelHandlerContext, error: any Error) { + context.close(promise: nil) + } +} diff --git a/Tests/CloudHypervisorTests/TypesTests.swift b/Tests/CloudHypervisorTests/TypesTests.swift new file mode 100644 index 0000000..8826643 --- /dev/null +++ b/Tests/CloudHypervisorTests/TypesTests.swift @@ -0,0 +1,328 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import CloudHypervisor + +@Suite("CloudHypervisor types") +struct TypesTests { + @Test("VmConfig round-trips through JSON") + func vmConfigRoundTrip() throws { + let cfg = CloudHypervisor.VmConfig( + cpus: CloudHypervisor.CpusConfig(bootVcpus: 2, maxVcpus: 2), + memory: CloudHypervisor.MemoryConfig(size: UInt64(1) << 30), + payload: CloudHypervisor.PayloadConfig( + kernel: "/path/to/vmlinux", + cmdline: "init=/sbin/vminitd ro" + ), + disks: nil, + net: nil, + fs: nil, + vsock: nil, + console: CloudHypervisor.ConsoleConfig(mode: .Null), + serial: CloudHypervisor.ConsoleConfig(mode: .Null) + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.VmConfig.self, from: data) + #expect(decoded == cfg) + + // Verify snake_case keys are emitted. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"boot_vcpus\"")) + #expect(jsonString.contains("\"max_vcpus\"")) + } + + @Test("CpusConfig round-trips through JSON") + func cpusConfigRoundTrip() throws { + let cfg = CloudHypervisor.CpusConfig(bootVcpus: 4, maxVcpus: 8) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.CpusConfig.self, from: data) + #expect(decoded == cfg) + } + + @Test("MemoryConfig round-trips through JSON") + func memoryConfigRoundTrip() throws { + let cfg = CloudHypervisor.MemoryConfig(size: UInt64(2) << 30, hotplugSize: UInt64(1) << 30, mergeable: true) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.MemoryConfig.self, from: data) + #expect(decoded == cfg) + } + + @Test("MemoryConfig omits nil optional fields from JSON") + func memoryConfigNilOmission() throws { + let cfg = CloudHypervisor.MemoryConfig(size: UInt64(1) << 30) + let data = try JSONEncoder().encode(cfg) + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(!jsonString.contains("\"hotplug_size\"")) + #expect(!jsonString.contains("\"mergeable\"")) + } + + @Test("PayloadConfig round-trips through JSON") + func payloadConfigRoundTrip() throws { + let cfg = CloudHypervisor.PayloadConfig( + kernel: "/boot/vmlinux", + initramfs: "/boot/initrd", + cmdline: "console=ttyS0" + ) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.PayloadConfig.self, from: data) + #expect(decoded == cfg) + } + + @Test("ConsoleConfig round-trips through JSON with capitalized mode strings") + func consoleConfigRoundTrip() throws { + for mode in [ + CloudHypervisor.ConsoleConfig.Mode.Off, + .Pty, + .Tty, + .File, + .Socket, + .Null, + ] { + let cfg = CloudHypervisor.ConsoleConfig(mode: mode) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.ConsoleConfig.self, from: data) + #expect(decoded == cfg) + // CH uses capitalized strings: "Off", "Pty", etc. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"" + mode.rawValue + "\"")) + } + } + + @Test("DiskConfig round-trips through JSON") + func diskConfigRoundTrip() throws { + let cfg = CloudHypervisor.DiskConfig( + path: "/var/lib/disk.raw", + readonly: true, + direct: false, + iommu: nil, + id: "disk0", + pciSegment: 0 + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.DiskConfig.self, from: data) + #expect(decoded == cfg) + + // Verify snake_case key for pci_segment. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"pci_segment\"")) + } + + @Test("DiskConfig omits nil optional fields from JSON") + func diskConfigNilOmission() throws { + let cfg = CloudHypervisor.DiskConfig(path: "/var/lib/disk.raw") + let data = try JSONEncoder().encode(cfg) + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(!jsonString.contains("\"readonly\"")) + #expect(!jsonString.contains("\"direct\"")) + #expect(!jsonString.contains("\"iommu\"")) + #expect(!jsonString.contains("\"id\"")) + #expect(!jsonString.contains("\"pci_segment\"")) + } + + @Test("NetConfig round-trips through JSON") + func netConfigRoundTrip() throws { + let cfg = CloudHypervisor.NetConfig( + tap: "tap0", + ip: "192.168.0.1", + mask: "255.255.255.0", + mac: "AA:BB:CC:DD:EE:FF", + mtu: 1500, + numQueues: 2, + queueSize: 256, + id: "net0" + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.NetConfig.self, from: data) + #expect(decoded == cfg) + + // Verify snake_case keys. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"num_queues\"")) + #expect(jsonString.contains("\"queue_size\"")) + } + + @Test("FsConfig round-trips through JSON") + func fsConfigRoundTrip() throws { + let cfg = CloudHypervisor.FsConfig( + tag: "virtiofs0", + socket: "/run/virtiofs.sock", + numQueues: 1, + queueSize: 1024, + id: "fs0", + pciSegment: nil + ) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.FsConfig.self, from: data) + #expect(decoded == cfg) + } + + @Test("VsockConfig round-trips through JSON") + func vsockConfigRoundTrip() throws { + let cfg = CloudHypervisor.VsockConfig( + cid: 3, + socket: "/run/vsock.sock", + iommu: false, + id: "vsock0" + ) + let data = try JSONEncoder().encode(cfg) + let decoded = try JSONDecoder().decode(CloudHypervisor.VsockConfig.self, from: data) + #expect(decoded == cfg) + } + + @Test("PciDeviceInfo round-trips through JSON") + func pciDeviceInfoRoundTrip() throws { + let info = CloudHypervisor.PciDeviceInfo(id: "disk0", bdf: "0000:00:03.0") + let data = try JSONEncoder().encode(info) + let decoded = try JSONDecoder().decode(CloudHypervisor.PciDeviceInfo.self, from: data) + #expect(decoded == info) + } + + // MARK: - VmInfo / VmState + + @Test("VmState round-trips through JSON with CH literal strings") + func vmStateRoundTrip() throws { + for state in [ + CloudHypervisor.VmState.Created, + .Running, + .Shutdown, + .Paused, + .BreakPoint, + ] { + let data = try JSONEncoder().encode(state) + let decoded = try JSONDecoder().decode(CloudHypervisor.VmState.self, from: data) + #expect(decoded == state) + // CH uses the capitalized raw string literals exactly. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"" + state.rawValue + "\"")) + } + } + + @Test("VmInfo round-trips through JSON") + func vmInfoRoundTrip() throws { + let cfg = CloudHypervisor.VmConfig( + cpus: CloudHypervisor.CpusConfig(bootVcpus: 2, maxVcpus: 2), + memory: CloudHypervisor.MemoryConfig(size: UInt64(1) << 30), + payload: CloudHypervisor.PayloadConfig(kernel: "/boot/vmlinux"), + console: CloudHypervisor.ConsoleConfig(mode: .Null), + serial: CloudHypervisor.ConsoleConfig(mode: .Null) + ) + let info = CloudHypervisor.VmInfo( + config: cfg, + state: .Running, + memoryActualSize: 1_073_741_824 + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(info) + let decoded = try JSONDecoder().decode(CloudHypervisor.VmInfo.self, from: data) + #expect(decoded == info) + + // Verify snake_case key is emitted. + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"memory_actual_size\"")) + } + + @Test("VmInfo omits nil optional fields from JSON") + func vmInfoNilOmission() throws { + let cfg = CloudHypervisor.VmConfig( + cpus: CloudHypervisor.CpusConfig(bootVcpus: 1, maxVcpus: 1), + memory: CloudHypervisor.MemoryConfig(size: UInt64(512) << 20), + payload: CloudHypervisor.PayloadConfig(kernel: "/boot/vmlinux"), + console: CloudHypervisor.ConsoleConfig(mode: .Off), + serial: CloudHypervisor.ConsoleConfig(mode: .Off) + ) + let info = CloudHypervisor.VmInfo(config: cfg, state: .Created) + let data = try JSONEncoder().encode(info) + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(!jsonString.contains("\"memory_actual_size\"")) + } + + // MARK: - VmmPingResponse + + @Test("VmmPingResponse round-trips through JSON") + func vmmPingResponseRoundTrip() throws { + let ping = CloudHypervisor.VmmPingResponse( + version: "v40.0", + pid: 12345, + features: ["acpi", "kvm"], + buildVersion: "abc123" + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(ping) + let decoded = try JSONDecoder().decode(CloudHypervisor.VmmPingResponse.self, from: data) + #expect(decoded == ping) + + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"build_version\"")) + } + + @Test("VmmPingResponse omits nil optional fields from JSON") + func vmmPingResponseNilOmission() throws { + let ping = CloudHypervisor.VmmPingResponse(version: "v40.0") + let data = try JSONEncoder().encode(ping) + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(!jsonString.contains("\"pid\"")) + #expect(!jsonString.contains("\"features\"")) + #expect(!jsonString.contains("\"build_version\"")) + } + + // MARK: - VmmInfo + + @Test("VmmInfo round-trips through JSON") + func vmmInfoRoundTrip() throws { + let cfg = CloudHypervisor.VmConfig( + cpus: CloudHypervisor.CpusConfig(bootVcpus: 2, maxVcpus: 2), + memory: CloudHypervisor.MemoryConfig(size: UInt64(1) << 30), + payload: CloudHypervisor.PayloadConfig(kernel: "/boot/vmlinux"), + console: CloudHypervisor.ConsoleConfig(mode: .Null), + serial: CloudHypervisor.ConsoleConfig(mode: .Null) + ) + let vmmInfo = CloudHypervisor.VmmInfo( + version: "v40.0", + pid: 99, + buildVersion: "deadbeef", + config: cfg + ) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let data = try encoder.encode(vmmInfo) + let decoded = try JSONDecoder().decode(CloudHypervisor.VmmInfo.self, from: data) + #expect(decoded == vmmInfo) + + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(jsonString.contains("\"build_version\"")) + } + + @Test("VmmInfo omits nil optional fields from JSON") + func vmmInfoNilOmission() throws { + let vmmInfo = CloudHypervisor.VmmInfo(version: "v40.0") + let data = try JSONEncoder().encode(vmmInfo) + let jsonString = try #require(String(data: data, encoding: .utf8)) + #expect(!jsonString.contains("\"pid\"")) + #expect(!jsonString.contains("\"build_version\"")) + #expect(!jsonString.contains("\"config\"")) + } +} diff --git a/Tests/ContainerizationArchiveTests/ArchiveReaderTests.swift b/Tests/ContainerizationArchiveTests/ArchiveReaderTests.swift new file mode 100644 index 0000000..c7c0e56 --- /dev/null +++ b/Tests/ContainerizationArchiveTests/ArchiveReaderTests.swift @@ -0,0 +1,714 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationArchive + +struct ArchiveReaderTests { + // MARK: - Helper Methods + + func createTestArchive(name: String, entries: [(path: String, type: EntryType, target: String?)]) throws -> URL { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveReaderTests")! + let archiveURL = testDirectory.appendingPathComponent("\(name).tar") + + let archiver = try ArchiveWriter(format: .paxRestricted, filter: .none, file: archiveURL) + + for entry in entries { + let writeEntry = WriteEntry() + writeEntry.path = entry.path + writeEntry.permissions = 0o644 + writeEntry.owner = 1000 + writeEntry.group = 1000 + + switch entry.type { + case .regular(let content): + writeEntry.fileType = .regular + let data = content.data(using: .utf8)! + writeEntry.size = numericCast(data.count) + try archiver.writeEntry(entry: writeEntry, data: data) + case .directory: + writeEntry.fileType = .directory + writeEntry.permissions = 0o755 + writeEntry.size = 0 + try archiver.writeEntry(entry: writeEntry, data: nil) + case .symlink: + guard let target = entry.target else { + throw ArchiveError.failedToExtractArchive("symlink requires target") + } + writeEntry.fileType = .symbolicLink + writeEntry.symlinkTarget = target + writeEntry.size = 0 + try archiver.writeEntry(entry: writeEntry, data: nil) + } + } + + try archiver.finishEncoding() + return archiveURL + } + + func createExtractionDirectory(name: String) throws -> URL { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveReaderTests.\(name)")! + return testDirectory.appendingPathComponent("extract") + } + + enum EntryType { + case regular(String) // Content + case directory + case symlink + } + + // MARK: - Benign Archive Tests + + @Test func extractBenignArchive() throws { + let archiveURL = try createTestArchive( + name: "benign", + entries: [ + ("dir/", .directory, nil), + ("dir/file.txt", .regular("test content"), nil), + ("dir/subdir/", .directory, nil), + ("dir/subdir/file2.txt", .regular("more content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "benign") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "Benign archive should not reject any entries") + + // Verify files were extracted + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("dir/file.txt").path)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("dir/subdir/file2.txt").path)) + + // Verify content + let content1 = try String(contentsOf: extractDir.appendingPathComponent("dir/file.txt"), encoding: .utf8) + #expect(content1 == "test content") + + let content2 = try String(contentsOf: extractDir.appendingPathComponent("dir/subdir/file2.txt"), encoding: .utf8) + #expect(content2 == "more content") + } + + @Test func extractRootLevelFile() throws { + let archiveURL = try createTestArchive( + name: "root-level", + entries: [ + ("file.txt", .regular("root file"), nil) + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "root-level") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("file.txt").path)) + + let content = try String(contentsOf: extractDir.appendingPathComponent("file.txt"), encoding: .utf8) + #expect(content == "root file") + } + + // MARK: - Absolute Path Tests + + @Test func convertAbsolutePathToRelative() throws { + let filename1: String = "/tmp/\(UUID())" + let filename2: String = "//tmp//\(UUID())" + let archiveURL = try createTestArchive( + name: "benign-absolute", + entries: [ + ("/tmp/\(filename1)", .regular("hello"), nil), + ("//tmp//\(filename2)", .regular("world"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "benign-absolute") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Absolute paths should be rejected + #expect( + rejectedPaths.isEmpty, + "Expected absolute paths allowed, but got rejected paths \(rejectedPaths)") + + // Verify nothing was extracted to /tmp or /etc + #expect(!FileManager.default.fileExists(atPath: filename1)) + #expect(!FileManager.default.fileExists(atPath: filename2)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("tmp/\(filename1)").path)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("tmp/\(filename2)").path)) + } + + // MARK: - Path Traversal Attack Tests + + @Test func rejectPathTraversal() throws { + let archiveURL = try createTestArchive( + name: "evil-traversal", + entries: [ + ("../etc/pwned", .regular("evil"), nil), + ("foo/../../etc/pwned", .regular("evil"), nil), + ("dir/../../../etc/pwned", .regular("evil"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "evil-traversal") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Path traversal entries should be rejected + #expect( + Set(rejectedPaths) == Set(["../etc/pwned", "foo/../../etc/pwned", "dir/../../../etc/pwned"]), + "Expected path traversal entries to be rejected, got \(rejectedPaths)") + + // Verify nothing escaped + let parentDir = extractDir.deletingLastPathComponent() + #expect(!FileManager.default.fileExists(atPath: parentDir.appendingPathComponent("etc/pwned").path)) + } + + @Test func rejectPathTraversalWithValidEntries() throws { + let archiveURL = try createTestArchive( + name: "mixed-traversal", + entries: [ + ("safe.txt", .regular("safe content"), nil), + ("dir/", .directory, nil), + ("dir/file.txt", .regular("also safe"), nil), + ("../etc/pwned", .regular("evil"), nil), + ("more/safe.txt", .regular("still safe"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "mixed-traversal") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Only the path traversal entry should be rejected + #expect( + rejectedPaths == ["../etc/pwned"], + "Expected only path traversal entry to be rejected, got \(rejectedPaths)") + + // Valid entries should have been extracted + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("safe.txt").path)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("dir/file.txt").path)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("more/safe.txt").path)) + + // Verify nothing escaped + let parentDir = extractDir.deletingLastPathComponent() + #expect(!FileManager.default.fileExists(atPath: parentDir.appendingPathComponent("etc/pwned").path)) + } + + @Test func rejectDotDotInMiddle() throws { + let archiveURL = try createTestArchive( + name: "evil-dotdot-middle", + entries: [ + ("safe/../pwned.txt", .regular("evil"), nil) + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "evil-dotdot-middle") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths == ["safe/../pwned.txt"]) + #expect(!FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("pwned.txt").path)) + } + + // MARK: - Symlink Attack Tests + + @Test func allowValidSymlink() throws { + let archiveURL = try createTestArchive( + name: "safe-symlink", + entries: [ + ("dir/", .directory, nil), + ("dir/target.txt", .regular("target content"), nil), + ("dir/link", .symlink, "target.txt"), + ("link2", .symlink, "dir/target.txt"), + ("dir/passwd", .symlink, "/etc/passwd"), + ("dir2/passwd", .symlink, "../../../../etc/passwd"), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "safe-symlink") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "Valid symlinks should be allowed") + + // Verify symlinks were created + let linkPath = extractDir.appendingPathComponent("dir/link").path + #expect(FileManager.default.fileExists(atPath: linkPath)) + + let link2Path = extractDir.appendingPathComponent("link2").path + #expect(FileManager.default.fileExists(atPath: link2Path)) + + // Verify symlinks point to correct targets + let linkTarget = try FileManager.default.destinationOfSymbolicLink(atPath: linkPath) + #expect(linkTarget == "target.txt") + + let link2Target = try FileManager.default.destinationOfSymbolicLink(atPath: link2Path) + #expect(link2Target == "dir/target.txt") + } + + @Test func allowSymlinkWithDotDot() throws { + let archiveURL = try createTestArchive( + name: "safe-symlink-dotdot", + entries: [ + ("dir/", .directory, nil), + ("dir/subdir/", .directory, nil), + ("target.txt", .regular("target"), nil), + ("dir/subdir/link", .symlink, "../../target.txt"), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "safe-symlink-dotdot") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "Symlink with .. that stays in root should be allowed") + + let linkPath = extractDir.appendingPathComponent("dir/subdir/link").path + #expect(FileManager.default.fileExists(atPath: linkPath)) + + let linkTarget = try FileManager.default.destinationOfSymbolicLink(atPath: linkPath) + #expect(linkTarget == "../../target.txt") + } + + // MARK: - Deep Nesting Tests + + @Test func extractDeepNesting() throws { + var entries: [(String, EntryType, String?)] = [] + + // Create 50 levels deep + var path = "" + for i in 0..<50 { + if i > 0 { path += "/" } + path += "level\(i)" + entries.append((path + "/", .directory, nil)) + } + entries.append((path + "/deep.txt", .regular("deep file"), nil)) + + let archiveURL = try createTestArchive(name: "deep-nesting", entries: entries) + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "deep-nesting") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty) + + // Verify deep file exists + let deepFilePath = extractDir.appendingPathComponent(path + "/deep.txt").path + #expect(FileManager.default.fileExists(atPath: deepFilePath)) + + let content = try String(contentsOfFile: deepFilePath, encoding: .utf8) + #expect(content == "deep file") + } + + // MARK: - Normalization Tests + + @Test func handleDotSlashPrefix() throws { + let archiveURL = try createTestArchive( + name: "dot-slash", + entries: [ + ("./safe.txt", .regular("content"), nil), + ("./dir/", .directory, nil), + ("./dir/file.txt", .regular("more content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "dot-slash") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "./ prefix should be normalized and allowed") + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("safe.txt").path)) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("dir/file.txt").path)) + } + + @Test func handleDoubleSlashes() throws { + let archiveURL = try createTestArchive( + name: "double-slash", + entries: [ + ("dir//subdir/", .directory, nil), + ("dir//subdir//file.txt", .regular("content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "double-slash") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "Double slashes should be normalized") + + // Verify file exists at normalized path + let normalizedPath = "dir/subdir/file.txt" + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent(normalizedPath).path)) + } + + // MARK: - File Permissions Tests + + @Test func preserveFilePermissions() throws { + let archiveURL = try createTestArchive( + name: "permissions", + entries: [ + ("executable.sh", .regular("#!/bin/bash\necho test"), nil) + ]) + + // Manually set executable permissions + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + for (entry, _) in reader { + if entry.path == "executable.sh" { + entry.permissions = 0o755 + } + } + + // Re-create archive with proper permissions + let testDirectory = createTemporaryDirectory(baseName: "ArchiveReaderTests")! + let archiveURL2 = testDirectory.appendingPathComponent("permissions2.tar") + let archiver = try ArchiveWriter(format: .paxRestricted, filter: .none, file: archiveURL2) + + let writeEntry = WriteEntry() + writeEntry.path = "executable.sh" + writeEntry.fileType = .regular + writeEntry.permissions = 0o755 + let data = "#!/bin/bash\necho test".data(using: .utf8)! + writeEntry.size = numericCast(data.count) + try archiver.writeEntry(entry: writeEntry, data: data) + try archiver.finishEncoding() + + defer { try? FileManager.default.removeItem(at: testDirectory) } + + let extractDir = try createExtractionDirectory(name: "permissions") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader2 = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL2) + let rejectedPaths = try reader2.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty) + + // Verify permissions were preserved + let filePath = extractDir.appendingPathComponent("executable.sh").path + let attrs = try FileManager.default.attributesOfItem(atPath: filePath) + let perms = (attrs[.posixPermissions] as? NSNumber)?.uint16Value ?? 0 + let permMask: UInt16 = 0o777 + #expect((perms & permMask) == 0o755, "Permissions should be preserved") + } + + // MARK: - Duplicate Entry Tests + + @Test func duplicateRegularFiles() throws { + let archiveURL = try createTestArchive( + name: "duplicate-regular", + entries: [ + ("file.txt", .regular("first content"), nil), + ("file.txt", .regular("second content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "duplicate-regular") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Last entry wins - second file should replace first + #expect(rejectedPaths.isEmpty, "Duplicate files follow last-entry-wins") + + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("file.txt").path)) + let content = try String(contentsOf: extractDir.appendingPathComponent("file.txt"), encoding: .utf8) + #expect(content == "second content", "Last entry should win") + } + + @Test func duplicateDirectories() throws { + let archiveURL = try createTestArchive( + name: "duplicate-dirs", + entries: [ + ("dir/", .directory, nil), + ("dir/", .directory, nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "duplicate-dirs") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Both directories should be accepted (merged) + #expect(rejectedPaths.isEmpty, "Duplicate directories should be merged") + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("dir").path)) + } + + @Test func regularFileToDirectory() throws { + let archiveURL = try createTestArchive( + name: "file-to-dir", + entries: [ + ("path", .regular("content"), nil), + ("path/", .directory, nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "file-to-dir") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Directory should replace the file + #expect(rejectedPaths.isEmpty, "Directory should replace regular file") + + let attrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("path").path) + let fileType = attrs[.type] as? FileAttributeType + #expect(fileType == .typeDirectory, "Path should be a directory") + } + + @Test func directoryToRegularFile() throws { + let archiveURL = try createTestArchive( + name: "dir-to-file", + entries: [ + ("path/", .directory, nil), + ("path", .regular("content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "dir-to-file") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Last entry wins - file should replace directory + #expect(rejectedPaths.isEmpty, "Regular file should replace directory") + + // Should now be a regular file + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("path").path)) + let content = try String(contentsOf: extractDir.appendingPathComponent("path"), encoding: .utf8) + #expect(content == "content", "Should have file content") + } + + @Test func regularFileToSymlink() throws { + let archiveURL = try createTestArchive( + name: "file-to-symlink", + entries: [ + ("target.txt", .regular("target"), nil), + ("path", .regular("content"), nil), + ("path", .symlink, "target.txt"), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "file-to-symlink") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Last entry wins - symlink should replace file + #expect(rejectedPaths.isEmpty, "Symlink should replace regular file") + + // Should now be a symlink + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("path").path)) + let linkTarget = try FileManager.default.destinationOfSymbolicLink(atPath: extractDir.appendingPathComponent("path").path) + #expect(linkTarget == "target.txt") + } + + @Test func symlinkToRegularFile() throws { + let archiveURL = try createTestArchive( + name: "symlink-to-file", + entries: [ + ("target.txt", .regular("target"), nil), + ("path", .symlink, "target.txt"), + ("path", .regular("new content"), nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "symlink-to-file") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Last entry wins - file should replace symlink + #expect(rejectedPaths.isEmpty, "Regular file should replace symlink") + + // Should now be a regular file + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("path").path)) + let content = try String(contentsOf: extractDir.appendingPathComponent("path"), encoding: .utf8) + #expect(content == "new content") + } + + @Test func symlinkToDirectory() throws { + let archiveURL = try createTestArchive( + name: "symlink-to-dir", + entries: [ + ("target/", .directory, nil), + ("path", .symlink, "target"), + ("path/", .directory, nil), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "symlink-to-dir") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Directory should replace symlink + #expect(rejectedPaths.isEmpty, "Directory should replace symlink") + + // Path should now be a directory + let attrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("path").path) + let fileType = attrs[.type] as? FileAttributeType + #expect(fileType == .typeDirectory, "Path should be a directory") + } + + @Test func duplicateSymlinks() throws { + let archiveURL = try createTestArchive( + name: "duplicate-symlinks", + entries: [ + ("target1.txt", .regular("target1"), nil), + ("target2.txt", .regular("target2"), nil), + ("link", .symlink, "target1.txt"), + ("link", .symlink, "target2.txt"), + ]) + + defer { try? FileManager.default.removeItem(at: archiveURL.deletingLastPathComponent()) } + + let extractDir = try createExtractionDirectory(name: "duplicate-symlinks") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + // Last entry wins - second symlink should replace first + #expect(rejectedPaths.isEmpty, "Second symlink should replace first") + + let linkTarget = try FileManager.default.destinationOfSymbolicLink(atPath: extractDir.appendingPathComponent("link").path) + #expect(linkTarget == "target2.txt", "Last symlink should win") + } + + // MARK: - Empty Archive Tests + + @Test func rejectEmptyArchive() throws { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveReaderTests")! + let archiveURL = testDirectory.appendingPathComponent("empty.tar") + + let archiver = try ArchiveWriter(format: .paxRestricted, filter: .none, file: archiveURL) + try archiver.finishEncoding() + + defer { try? FileManager.default.removeItem(at: testDirectory) } + + let extractDir = try createExtractionDirectory(name: "empty") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + let reader = try ArchiveReader(format: .paxRestricted, filter: .none, file: archiveURL) + + #expect(throws: ArchiveError.self) { + _ = try reader.extractContents(to: extractDir) + } + } + + // MARK: - Zstd Compression Tests + + @Test func readZstdCompressedArchive() throws { + guard let resourceURL = Bundle.module.url(forResource: "test", withExtension: "tar.zst") else { + Issue.record("Test resource test.tar.zst not found") + return + } + + let extractDir = try createExtractionDirectory(name: "zstd-test") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + // Test with explicit filter + let reader = try ArchiveReader(format: .paxRestricted, filter: .zstd, file: resourceURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "No paths should be rejected") + + // Check extracted files + let testFile = extractDir.appendingPathComponent("test.txt") + let file2 = extractDir.appendingPathComponent("file2.txt") + + #expect(FileManager.default.fileExists(atPath: testFile.path), "test.txt should exist") + #expect(FileManager.default.fileExists(atPath: file2.path), "file2.txt should exist") + + let testContent = try String(contentsOf: testFile, encoding: .utf8) + #expect(testContent == "Hello from zstd compressed archive", "Content should match") + + let file2Content = try String(contentsOf: file2, encoding: .utf8) + #expect(file2Content == "Another file", "Content should match") + } + + @Test func readZstdCompressedArchiveAutoDetect() throws { + guard let resourceURL = Bundle.module.url(forResource: "test", withExtension: "tar.zst") else { + Issue.record("Test resource test.tar.zst not found") + return + } + + let extractDir = try createExtractionDirectory(name: "zstd-auto-test") + defer { try? FileManager.default.removeItem(at: extractDir.deletingLastPathComponent()) } + + // Test with auto-detect + let reader = try ArchiveReader(file: resourceURL) + let rejectedPaths = try reader.extractContents(to: extractDir) + + #expect(rejectedPaths.isEmpty, "No paths should be rejected") + + // Check extracted files + let testFile = extractDir.appendingPathComponent("test.txt") + #expect(FileManager.default.fileExists(atPath: testFile.path), "test.txt should exist") + + let testContent = try String(contentsOf: testFile, encoding: .utf8) + #expect(testContent == "Hello from zstd compressed archive", "Content should match") + } +} diff --git a/Tests/ContainerizationArchiveTests/ArchiveTests.swift b/Tests/ContainerizationArchiveTests/ArchiveTests.swift new file mode 100644 index 0000000..079261b --- /dev/null +++ b/Tests/ContainerizationArchiveTests/ArchiveTests.swift @@ -0,0 +1,837 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationArchive + +struct ArchiveTests { + func helperEntry(path: String, data: Data) -> WriteEntry { + let entry = WriteEntry() + entry.permissions = 0o644 + entry.fileType = .regular + entry.path = path + entry.size = numericCast(data.count) + entry.owner = 1 + entry.group = 2 + entry.xattrs = ["user.data": Data([1, 2, 3])] + return entry + } + + @Test func createTemporaryDirectorySuccess() throws { + // Test that createTemporaryDirectory creates a directory with randomized suffix + let baseName = "ArchiveTests.testTempDir" + guard let tempDir = createTemporaryDirectory(baseName: baseName) else { + Issue.record("createTemporaryDirectory returned nil") + return + } + + defer { + let fileManager = FileManager.default + try? fileManager.removeItem(at: tempDir) + } + + // Verify the directory exists + var isDirectory: ObjCBool = false + let fileManager = FileManager.default + let exists = fileManager.fileExists(atPath: tempDir.path, isDirectory: &isDirectory) + #expect(exists) + #expect(isDirectory.boolValue) + + // Verify the directory name starts with the base name + let lastComponent = tempDir.lastPathComponent + #expect(lastComponent.starts(with: baseName)) + + // Verify that mkdtemp replaced the X's with random characters + // (should be 6 random alphanumeric characters after the base name and dot) + let suffix = String(lastComponent.dropFirst(baseName.count + 1)) // +1 for the dot + #expect(suffix.count == 6, "Expected 6 character suffix, got \(suffix.count)") + #expect(suffix != "XXXXXX", "mkdtemp did not replace X's with random characters") + + // Verify we can write to the directory + let testFile = tempDir.appendingPathComponent("test.txt") + try "test content".write(toFile: testFile.path, atomically: true, encoding: .utf8) + #expect(fileManager.fileExists(atPath: testFile.path)) + } + + @Test func tarUTF8() throws { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveTests.testTarUTF8")! + let archiveURL = testDirectory.appendingPathComponent("test.tgz") + + defer { + let fileManager = FileManager.default + try? fileManager.removeItem(at: testDirectory) + } + + // this test would failed with ArchiveWriterConfiguration.locale was not set to "en_US.UTF-8" + let archiver = try ArchiveWriter(format: .paxRestricted, filter: .gzip, file: archiveURL) + + let data = "blablabla".data(using: .utf8)! + + let normalPathEntry = helperEntry(path: "r", data: data) + #expect(throws: Never.self) { + try archiver.writeEntry(entry: normalPathEntry, data: data) + } + + let weirdPathEntry = helperEntry(path: "ʀ", data: data) + #expect(throws: Never.self) { + try archiver.writeEntry(entry: weirdPathEntry, data: data) + } + } + + @Test func tarGzipWithOpenfile() throws { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveTests.testTarGzipWithOpenfile")! + let archiveURL = testDirectory.appendingPathComponent("test.tgz") + + defer { + let fileManager = FileManager.default + try? fileManager.removeItem(at: testDirectory) + } + + let configuration = ArchiveWriterConfiguration( + format: .paxRestricted, + filter: .gzip + ) + let archiver = try ArchiveWriter(configuration: configuration) + try archiver.open(file: archiveURL) + + let data = "foo".data(using: .utf8)! + + let normalPathEntry = helperEntry(path: "bar", data: data) + #expect(throws: Never.self) { + try archiver.writeEntry(entry: normalPathEntry, data: data) + } + + try archiver.finishEncoding() + } + + @Test func writingZip() throws { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveTests.testWritingZip")! + let archiveURL = testDirectory.appendingPathComponent("test.zip") + + defer { + let fileManager = FileManager.default + try? fileManager.removeItem(at: testDirectory) + } + + // When + let archiver = try ArchiveWriter(format: .zip, filter: .none, file: archiveURL) + + var data = "foo".data(using: .utf8)! + var entry = helperEntry(path: "foo.txt", data: data) + try archiver.writeEntry(entry: entry, data: data) + + data = "bar".data(using: .utf8)! + entry = helperEntry(path: "bar.txt", data: data) + try archiver.writeEntry(entry: entry, data: data) + + data = Data() + entry = helperEntry(path: "empty", data: data) + try archiver.writeEntry(entry: entry, data: data) + + try archiver.finishEncoding() + + // Then + let unarchiver = try ArchiveReader(format: .zip, filter: .none, file: archiveURL) + for (index, (entry, data)) in unarchiver.enumerated() { + #expect(entry.owner == 1) + #expect(entry.group == 2) + switch index { + case 0: + #expect(entry.path == "foo.txt") + #expect(String(data: data, encoding: .utf8) == "foo") + case 1: + #expect(entry.path == "bar.txt") + #expect(String(data: data, encoding: .utf8) == "bar") + case 2: + #expect(entry.path == "empty") + #expect(data.isEmpty) + default: + Issue.record() + } + } + } + + @Test func unarchiving_0bytesEntry() throws { + let data = Data(base64Encoded: surveyBundleBase64Encoded)! + let unarchiver = try ArchiveReader(name: "survey.zip", bundle: data) + for (index, (entry, data)) in unarchiver.enumerated() { + switch index { + case 0: + #expect(entry.path == "healthinvolvement.js") + #expect(!data.isEmpty) + case 1: + #expect(entry.path == "__MACOSX/") + #expect(data.isEmpty) + case 2: + #expect(entry.path == "__MACOSX/._healthinvolvement.js") + #expect(!data.isEmpty) + default: + Issue.record() + } + } + } + + @Test func writingReadingTar() throws { + let testDirectory = createTemporaryDirectory(baseName: "ArchiveTests.testWritingReadingTar")! + let archiveURL = testDirectory.appendingPathComponent("test.tar.gz") + defer { + let fileManager = FileManager.default + try? fileManager.removeItem(at: testDirectory) + } + + let archiver = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + let data = "foo".data(using: .utf8)! + let entry = helperEntry(path: "foo.txt", data: data) + try archiver.writeEntry(entry: entry, data: data) + try archiver.finishEncoding() + + let unarchiver = try ArchiveReader(format: .pax, filter: .gzip, file: archiveURL) + for (entry, _) in unarchiver { + let attrs = entry.xattrs + guard let val = attrs["user.data"] else { + Issue.record("missing extended attribute [user.data] in file") + return + } + #expect([UInt8](val) == [1, 2, 3]) + } + } + + // MARK: - archiveDirectory round-trip tests + + @Test func archiveDirectoryBasic() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirBasic")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "hello".write(to: sourceDir.appendingPathComponent("file1.txt"), atomically: true, encoding: .utf8) + + let subDir = sourceDir.appendingPathComponent("subdir") + try FileManager.default.createDirectory(at: subDir, withIntermediateDirectories: true) + try "world".write(to: subDir.appendingPathComponent("file2.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("file1.txt"), encoding: .utf8) == "hello") + #expect(try String(contentsOf: extractDir.appendingPathComponent("subdir/file2.txt"), encoding: .utf8) == "world") + } + + @Test func archiveDirectoryEmpty() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirEmpty")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("empty") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + // Empty directory archive should succeed with the leading "./" entry. + let rejected = try reader.extractContents(to: extractDir) + #expect(rejected.isEmpty) + #expect(FileManager.default.fileExists(atPath: extractDir.path)) + } + + @Test func archiveDirectoryNestedEmpty() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirNestedEmpty")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try FileManager.default.createDirectory( + at: sourceDir.appendingPathComponent("a/b/c"), withIntermediateDirectories: true) + try FileManager.default.createDirectory( + at: sourceDir.appendingPathComponent("empty"), withIntermediateDirectories: true) + try "data".write(to: sourceDir.appendingPathComponent("a/file.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("a/file.txt"), encoding: .utf8) == "data") + + var isDir: ObjCBool = false + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("a/b/c").path, isDirectory: &isDir)) + #expect(isDir.boolValue) + #expect(FileManager.default.fileExists(atPath: extractDir.appendingPathComponent("empty").path, isDirectory: &isDir)) + #expect(isDir.boolValue) + } + + @Test func archiveDirectoryDeepNesting() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirDeep")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + var deepPath = sourceDir + for i in 0..<20 { + deepPath = deepPath.appendingPathComponent("level\(i)") + } + try FileManager.default.createDirectory(at: deepPath, withIntermediateDirectories: true) + try "deep content".write(to: deepPath.appendingPathComponent("deep.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + var expectedPath = extractDir + for i in 0..<20 { + expectedPath = expectedPath.appendingPathComponent("level\(i)") + } + #expect(try String(contentsOf: expectedPath.appendingPathComponent("deep.txt"), encoding: .utf8) == "deep content") + } + + @Test func archiveDirectorySymlinkInside() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirSymlinkInside")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "target content".write(to: sourceDir.appendingPathComponent("target.txt"), atomically: true, encoding: .utf8) + try FileManager.default.createSymbolicLink( + atPath: sourceDir.appendingPathComponent("link.txt").path, + withDestinationPath: "target.txt" + ) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("target.txt"), encoding: .utf8) == "target content") + + let linkDest = try FileManager.default.destinationOfSymbolicLink(atPath: extractDir.appendingPathComponent("link.txt").path) + #expect(linkDest == "target.txt") + } + + @Test func archiveDirectorySymlinkOutsideExcluded() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirSymlinkOutside")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "inside".write(to: sourceDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8) + + // Create a file outside the source directory + try "outside".write(to: testDir.appendingPathComponent("outside.txt"), atomically: true, encoding: .utf8) + + // Symlink pointing outside the source directory + try FileManager.default.createSymbolicLink( + atPath: sourceDir.appendingPathComponent("escape.txt").path, + withDestinationPath: "../outside.txt" + ) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + // Verify the archive doesn't contain the escaping symlink + let reader = try ArchiveReader(file: archiveURL) + var paths: [String] = [] + for (entry, _) in reader { + if let path = entry.path { + paths.append(path) + } + } + #expect(!paths.contains("escape.txt"), "Symlink pointing outside should be excluded from archive") + #expect(paths.contains("file.txt"), "Regular file should be included") + } + + @Test func archiveDirectorySpecialCharacters() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirSpecialChars")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "spaces".write(to: sourceDir.appendingPathComponent("file with spaces.txt"), atomically: true, encoding: .utf8) + try "unicode".write(to: sourceDir.appendingPathComponent("日本語.txt"), atomically: true, encoding: .utf8) + try "dashes".write(to: sourceDir.appendingPathComponent("file-name_v2.0.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("file with spaces.txt"), encoding: .utf8) == "spaces") + #expect(try String(contentsOf: extractDir.appendingPathComponent("日本語.txt"), encoding: .utf8) == "unicode") + #expect(try String(contentsOf: extractDir.appendingPathComponent("file-name_v2.0.txt"), encoding: .utf8) == "dashes") + } + + @Test func archiveDirectoryDotfiles() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirDotfiles")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "hidden".write(to: sourceDir.appendingPathComponent(".hidden"), atomically: true, encoding: .utf8) + try "gitignore".write(to: sourceDir.appendingPathComponent(".gitignore"), atomically: true, encoding: .utf8) + try "visible".write(to: sourceDir.appendingPathComponent("visible.txt"), atomically: true, encoding: .utf8) + + let hiddenDir = sourceDir.appendingPathComponent(".config") + try FileManager.default.createDirectory(at: hiddenDir, withIntermediateDirectories: true) + try "config".write(to: hiddenDir.appendingPathComponent("settings.json"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent(".hidden"), encoding: .utf8) == "hidden") + #expect(try String(contentsOf: extractDir.appendingPathComponent(".gitignore"), encoding: .utf8) == "gitignore") + #expect(try String(contentsOf: extractDir.appendingPathComponent("visible.txt"), encoding: .utf8) == "visible") + #expect(try String(contentsOf: extractDir.appendingPathComponent(".config/settings.json"), encoding: .utf8) == "config") + } + + @Test func archiveDirectoryPreservesPermissions() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirPerms")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + + let execFile = sourceDir.appendingPathComponent("script.sh") + try "#!/bin/sh\necho hi".write(to: execFile, atomically: true, encoding: .utf8) + try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: execFile.path) + + let readOnly = sourceDir.appendingPathComponent("readonly.txt") + try "secret".write(to: readOnly, atomically: true, encoding: .utf8) + try FileManager.default.setAttributes([.posixPermissions: 0o444], ofItemAtPath: readOnly.path) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + let execAttrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("script.sh").path) + let execPerms = (execAttrs[.posixPermissions] as? NSNumber)?.uint16Value ?? 0 + #expect((execPerms & 0o777) == 0o755, "Executable permissions should be preserved") + + let roAttrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("readonly.txt").path) + let roPerms = (roAttrs[.posixPermissions] as? NSNumber)?.uint16Value ?? 0 + #expect((roPerms & 0o777) == 0o444, "Read-only permissions should be preserved") + } + + @Test func archiveDirectoryLargeFile() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirLargeFile")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + + // 2MB file with repeating pattern + let pattern = Data("ContainerizationArchiveTestPattern\n".utf8) + var largeData = Data(capacity: 2 * 1024 * 1024) + while largeData.count < 2 * 1024 * 1024 { + largeData.append(pattern) + } + largeData = largeData.prefix(2 * 1024 * 1024) + try largeData.write(to: sourceDir.appendingPathComponent("large.bin")) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + let extracted = try Data(contentsOf: extractDir.appendingPathComponent("large.bin")) + #expect(extracted == largeData, "Large file content should match after round-trip") + } + + @Test func archiveDirectoryManyFiles() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirManyFiles")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + + // Create 100 files + for i in 0..<100 { + try "content \(i)".write( + to: sourceDir.appendingPathComponent("file_\(String(format: "%03d", i)).txt"), + atomically: true, encoding: .utf8) + } + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + for i in 0..<100 { + let content = try String( + contentsOf: extractDir.appendingPathComponent("file_\(String(format: "%03d", i)).txt"), + encoding: .utf8) + #expect(content == "content \(i)") + } + } + + @Test func archiveDirectorySingleFile() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirSingle")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "only file".write(to: sourceDir.appendingPathComponent("only.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("only.txt"), encoding: .utf8) == "only file") + } + + // MARK: - archive tests + + @Test func archiveURLsBasic() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsBasic")! + defer { try? FileManager.default.removeItem(at: testDir) } + + try "alpha content".write(to: testDir.appendingPathComponent("alpha.txt"), atomically: true, encoding: .utf8) + try "beta content".write(to: testDir.appendingPathComponent("beta.txt"), atomically: true, encoding: .utf8) + + let files: [FilePath] = [ + FilePath(testDir.appendingPathComponent("alpha.txt").path), + FilePath(testDir.appendingPathComponent("beta.txt").path), + ] + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive(files, base: FilePath(testDir.path)) + try writer.finishEncoding() + + var entries: [String: String] = [:] + let reader = try ArchiveReader(file: archiveURL) + for (entry, data) in reader { + if let path = entry.path, let content = String(data: data, encoding: .utf8) { + entries[path] = content + } + } + #expect(entries["alpha.txt"] == "alpha content") + #expect(entries["beta.txt"] == "beta content") + } + + @Test func archiveURLsEmpty() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsEmpty")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + #expect(throws: Never.self) { + try writer.archive([], base: FilePath(testDir.path)) + } + try writer.finishEncoding() + + var count = 0 + let reader = try ArchiveReader(file: archiveURL) + for _ in reader { count += 1 } + #expect(count == 0) + } + + @Test func archiveURLsSingle() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsSingle")! + defer { try? FileManager.default.removeItem(at: testDir) } + + try "only content".write(to: testDir.appendingPathComponent("only.txt"), atomically: true, encoding: .utf8) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive([FilePath(testDir.appendingPathComponent("only.txt").path)], base: FilePath(testDir.path)) + try writer.finishEncoding() + + var entries: [String: String] = [:] + let reader = try ArchiveReader(file: archiveURL) + for (entry, data) in reader { + if let path = entry.path, let content = String(data: data, encoding: .utf8) { + entries[path] = content + } + } + #expect(entries.count == 1) + #expect(entries["only.txt"] == "only content") + } + + @Test func archiveURLsPreservesPermissions() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsPerms")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let execFile = testDir.appendingPathComponent("script.sh") + try "#!/bin/sh\necho hi".write(to: execFile, atomically: true, encoding: .utf8) + try FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: execFile.path) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive([FilePath(execFile.path)], base: FilePath(testDir.path)) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + let attrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("script.sh").path) + let perms = (attrs[.posixPermissions] as? NSNumber)?.uint16Value ?? 0 + #expect((perms & 0o777) == 0o755) + } + + @Test func archiveURLsNestedDirectories() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsNested")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir.appendingPathComponent("a"), withIntermediateDirectories: true) + try FileManager.default.createDirectory(at: sourceDir.appendingPathComponent("b/c"), withIntermediateDirectories: true) + try "top content".write(to: sourceDir.appendingPathComponent("top.txt"), atomically: true, encoding: .utf8) + try "a content".write(to: sourceDir.appendingPathComponent("a/deep.txt"), atomically: true, encoding: .utf8) + try "nested content".write(to: sourceDir.appendingPathComponent("b/c/nested.txt"), atomically: true, encoding: .utf8) + + let files: [FilePath] = [ + FilePath(sourceDir.appendingPathComponent("top.txt").path), + FilePath(sourceDir.appendingPathComponent("a/deep.txt").path), + FilePath(sourceDir.appendingPathComponent("b/c/nested.txt").path), + ] + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive(files, base: FilePath(sourceDir.path)) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("top.txt"), encoding: .utf8) == "top content") + #expect(try String(contentsOf: extractDir.appendingPathComponent("a/deep.txt"), encoding: .utf8) == "a content") + #expect(try String(contentsOf: extractDir.appendingPathComponent("b/c/nested.txt"), encoding: .utf8) == "nested content") + } + + @Test func archiveURLsWithDirectoryURL() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsWithDir")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + try "top content".write(to: sourceDir.appendingPathComponent("top.txt"), atomically: true, encoding: .utf8) + + let subDir = sourceDir.appendingPathComponent("subdir") + try FileManager.default.createDirectory(at: subDir.appendingPathComponent("nested"), withIntermediateDirectories: true) + try "sub content".write(to: subDir.appendingPathComponent("sub.txt"), atomically: true, encoding: .utf8) + try "deep content".write(to: subDir.appendingPathComponent("nested/deep.txt"), atomically: true, encoding: .utf8) + + let urls: [FilePath] = [ + FilePath(sourceDir.appendingPathComponent("top.txt").path), + FilePath(subDir.path), + ] + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive(urls, base: FilePath(sourceDir.path)) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect(try String(contentsOf: extractDir.appendingPathComponent("top.txt"), encoding: .utf8) == "top content") + #expect(try String(contentsOf: extractDir.appendingPathComponent("subdir/sub.txt"), encoding: .utf8) == "sub content") + #expect(try String(contentsOf: extractDir.appendingPathComponent("subdir/nested/deep.txt"), encoding: .utf8) == "deep content") + } + + @Test func archiveURLsDirectoryPreservesPermissions() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsDirPerms")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + let readonlyDir = sourceDir.appendingPathComponent("readonly") + try FileManager.default.createDirectory(at: readonlyDir, withIntermediateDirectories: true) + try "content".write(to: readonlyDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8) + try FileManager.default.setAttributes([.posixPermissions: 0o777], ofItemAtPath: readonlyDir.path) + defer { + try? FileManager.default.setAttributes([.posixPermissions: 0o755], ofItemAtPath: readonlyDir.path) + } + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive([FilePath(readonlyDir.path)], base: FilePath(sourceDir.path)) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + #expect( + try String(contentsOf: extractDir.appendingPathComponent("readonly/file.txt"), encoding: .utf8) + == "content") + let attrs = try FileManager.default.attributesOfItem(atPath: extractDir.appendingPathComponent("readonly").path) + let perms = (attrs[.posixPermissions] as? NSNumber)?.uint16Value ?? 0 + #expect((perms & 0o777) == 0o777, "Read-only directory permissions should be preserved") + } + + @Test func archiveURLsSymlinks() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveURLsSymlinks")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + try FileManager.default.createDirectory(at: sourceDir, withIntermediateDirectories: true) + + let fileURL = sourceDir.appendingPathComponent("file.txt") + try "symlink content".write(to: fileURL, atomically: true, encoding: .utf8) + + try FileManager.default.createSymbolicLink( + atPath: sourceDir.appendingPathComponent("absolute").path, + withDestinationPath: fileURL.path + ) + try FileManager.default.createSymbolicLink( + atPath: sourceDir.appendingPathComponent("relative").path, + withDestinationPath: "file.txt" + ) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archive([FilePath(sourceDir.path)], base: FilePath(testDir.path)) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + let extractedSource = extractDir.appendingPathComponent("source") + #expect( + try String(contentsOf: extractedSource.appendingPathComponent("file.txt"), encoding: .utf8) + == "symlink content") + + let relTarget = try FileManager.default.destinationOfSymbolicLink( + atPath: extractedSource.appendingPathComponent("relative").path) + #expect(relTarget == "file.txt") + #expect( + try String(contentsOf: extractedSource.appendingPathComponent("relative"), encoding: .utf8) + == "symlink content") + + let absTarget = try FileManager.default.destinationOfSymbolicLink( + atPath: extractedSource.appendingPathComponent("absolute").path) + + print("absTarget: \(absTarget), fileURL: \(fileURL.path)") + #expect(absTarget == fileURL.path) + } + + @Test func archiveDirectorySymlinkRelativeSubdir() throws { + let testDir = createTemporaryDirectory(baseName: "ArchiveTests.archiveDirSymlinkRelSubdir")! + defer { try? FileManager.default.removeItem(at: testDir) } + + let sourceDir = testDir.appendingPathComponent("source") + let subA = sourceDir.appendingPathComponent("a") + let subB = sourceDir.appendingPathComponent("b") + try FileManager.default.createDirectory(at: subA, withIntermediateDirectories: true) + try FileManager.default.createDirectory(at: subB, withIntermediateDirectories: true) + try "in a".write(to: subA.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8) + + // Symlink from b/link.txt -> ../a/file.txt (relative, stays inside) + try FileManager.default.createSymbolicLink( + atPath: subB.appendingPathComponent("link.txt").path, + withDestinationPath: "../a/file.txt" + ) + + let archiveURL = testDir.appendingPathComponent("test.tar.gz") + let writer = try ArchiveWriter(format: .pax, filter: .gzip, file: archiveURL) + try writer.archiveDirectory(sourceDir) + try writer.finishEncoding() + + let extractDir = testDir.appendingPathComponent("extract") + let reader = try ArchiveReader(file: archiveURL) + let rejected = try reader.extractContents(to: extractDir) + + #expect(rejected.isEmpty) + + let linkDest = try FileManager.default.destinationOfSymbolicLink( + atPath: extractDir.appendingPathComponent("b/link.txt").path) + #expect(linkDest == "../a/file.txt") + + // Verify the symlink resolves correctly + let content = try String(contentsOf: extractDir.appendingPathComponent("b/link.txt"), encoding: .utf8) + #expect(content == "in a") + } +} + +private let surveyBundleBase64Encoded = """ + UEsDBBQACAAIAA17o04AAAAAAAAAAAAAAAAUABAAaGVhbHRoaW52b2x2ZW1lbnQuanNVWAwAQ8XMXJm/zFz1ARQAnVVRa9swEH73rzjylMLwmu3NJexhDLqxroPAYIxRFPsca5UlT5LteSH/fSdZdu02LqMiEEl3uvv06e5zwzRwyS1n4q4qmEHYwjECGn6VwKrSXGluu9Urv50rXSbBxWBquZImgR9+/Wgcz226IVTKBP+L2We2R0E5rlULrapFBp2qYY/GQoYm1XyPbsdBbJRosERpaQ7cmBoNaBTMYgZW9V4FMmGLdwBfBbqrpIVS9KckxgH9mXGPHSGYJFh2ZdK0qJPli9mucpTtuDwIfF8onuJytNTbl8ibj+NTzr4oC4x+QgzsZDHcdIGElGmESquGZ6gh45qeykDpyAgeI3s9mcQQNEzUhP8STougn4W0UyW2BbMTQB8h9e9KD5kpogVKRcDowUom2QGhHABP8m9emv8b6m6W29KacrVK3wMzwMAiK6HldPvyPFPPI3vzUmQf/lhNxSXm8FQrH9JQdWVA6JgEljUUwKJrNnIwKPIJiLf/BeLnksvyYW5uK9fPjBDnTBg853h6vNknOkWnKMpr6QUB0EGlC6yxoYa6CA3TkNYMGuMNsV9dRd7Kc1gH63brGtKL0upi0m0aba3lXK9C9mhiP47alVHrrxaw3Wk0FYkXmvU4G5KFQOP+LADVyoEsZn65cOR2/4s6LSZRCfb4IXgsUB7ooV/DxgV0dPymznNBJaMOHaWXKlFannOnNatUlTFLWxRCUtJ4diLuS+epeFluhSPgxtWya7vvTh+vvXdw6QXWP7hTYG/q4BP5SexgV+sGB81vUJvebRNfDt+BQEcyEtrvh5XSyRmme5eBwGScOTqi2c2uon9QSwcIxOijbWkCAACaBgAAUEsDBAoAAAAAAFV+o04AAAAAAAAAAAAAAAAJABAAX19NQUNPU1gvVVgMAMHFzFzBxcxc9QEUAFBLAwQUAAgACAANe6NOAAAAAAAAAAAAAAAAHwAQAF9fTUFDT1NYLy5faGVhbHRoaW52b2x2ZW1lbnQuanNVWAwAQ8XMXJm/zFz1ARQAjY/NSsNAEMcnRfHjVBA9eLGiHjy0m5qkDa2XtGlrwVKxAUUUWZMpiW4+mmzrxZtP4pOINw8efQXx6BMIbmigUBAd2P/MDr8/MwOLG0uQA+hRu9AfFM4LWaQ9WBHvAED6Eln8c9vwrzAs63RapQ5pVxTfc8hC1s8DbNqhX6JRxLDEaMLHCToO5bhzMpiikipEA9ifcT5yKhhau+uZXY6+Gd4HLKQOOqZwph5PyAPA3u+eMxdjbMehn6T8h5BDgPUZPxrTmAbcCxDen98u002cz9dymm8i5iVclp8kxXghV7j1eLO8mi0rZQfm5g5em5mu8z2X8yipERJhFGFsu5RnU8V8MvQYJqRMNLVK/LDV71iMWW583OyY5Agp4243mIRsgj4GvHSb/Dn7YkRkWVfqmk1RV3RaH9Ahjb16y6hUKxVNK8rtcqOo6kIastooNlXT1IyWoTYVA34AUEsHCAK+cV1ZAQAAIQIAAFBLAQIVAxQACAAIAA17o07E6KNtaQIAAJoGAAAUAAwAAAAAAAAAAECkgQAAAABoZWFsdGhpbnZvbHZlbWVudC5qc1VYCABDxcxcmb/MXFBLAQIVAwoAAAAAAFV+o04AAAAAAAAAAAAAAAAJAAwAAAAAAAAAAED9QbsCAABfX01BQ09TWC9VWAgAwcXMXMHFzFxQSwECFQMUAAgACAANe6NOAr5xXVkBAAAhAgAAHwAMAAAAAAAAAABApIHyAgAAX19NQUNPU1gvLl9oZWFsdGhpbnZvbHZlbWVudC5qc1VYCABDxcxcmb/MXFBLBQYAAAAAAwADAOoAAACoBAAAAAA= + """ diff --git a/Tests/ContainerizationArchiveTests/Resources/test.tar.zst b/Tests/ContainerizationArchiveTests/Resources/test.tar.zst new file mode 100644 index 0000000000000000000000000000000000000000..da79af3fbf7a0d75283515d77e850038014db7ac GIT binary patch literal 445 zcmV;u0Yd&LwJ-f-02_S`07er=IB>K*4IOa*OWnRV2mEM0nBr zy8Q>vK!oTBi`GQ0+)|P?U8n&gz+>aqQZfKJ05|{=%nmkSDCq0I5|C9|hCADOxd7fA zA$*`WmC)gw4}@SpGP=7vG-*pY-JNfD-{t;lUJf1XZ|X~3t;jSaNFbnqpa44>{8U!6 z?`U>=e{EZRm_{u$5SZCO<#LG*Fau!b$jk@aooNe2Q#Bot4-AYHAu82HPFT@o5lNoC zw{|ZAGf9(5^e|DHLXU?+pb0sgk2)mM8JQGH9^=JkV*(aDLoRW zeBxggNAtd8Rg|s0d5(L#VH(w&%MEBuvz*qh>m@p4l>WG&Owz;>IUvx25gHk>1N3Bm z7$zVn%$!gg3l^~W*y@NNGUM_;0dQ*3TgBjvTi^uRa)kpFItCydC;@Y_=#~On4)~D` zKy{#-0b*bnF24z8AS>$5TO7pB43UlAV5>VF4$v{&0y`m7q=Iypzu`NrRU0g$%>5m> nycV2cHxY$C+1iQh$v#s_Dxs1j%UCKRWSwj9!7;OE8}jVq1p+;d;Q7LWX3>Iikr%+#W&eD2c#fttvWn44yR7V_s!Or#)v z3G*gDez0h9Q9|N94-Tclqf<6^eqJ<+nr;!Gr(v#W`(_s|uIHJBPv8m(BPCLtg9Y{B zH~!2uQ?zz!(60MXRW5`Z)`{FiKXQK(!?+@uA@m{%V516{h)fA$-+r z5$hve#8?&C^L_g67S)#5;EN~WFQ!Bu0*H1tk2oiSEm1_xTVJt5i+Mz(2|#sJcNo1m z25{1QyB^M)gocEKGz(z*k3}%Js8_SRVJxsRCsCQX)ni&TmT36rWX9d%&hO5}WApZNlXqq!uSx>h}WblCmX z-4UW%XxWfO_s^=~AHT!T!JTn7tA3>0qT-aG!GwJMPEafxGOfN7QH#6c;eHhyIAR;D8&=>R6^F>t6vwFB_;$Rqy*R<DG!BkF z7CGCIX+JIyMO@f+HvVmSf3&371@m6_vtk+M=T&9fQy1B}dJTo78B`i6H2V!t%KHra zavQ?kp$h(fhG?rNRDGg2jxL!IHGS$A@DjQBv;9JU-VEVnFy339mH9$U_qH7IR6h#m zg(8&r5>ExY4u3zx_OcSukEF20t$4wS%Nh=U9SkGF7*18hla4`&_`r@C!kJ63<5nU& zD-l~Qc~Mnk6=@rc-;#(T;I8R()b-EN1FU#miO3nJDpj2E#Pv30f9d;Ht;DIUd}H`! z`MJf5oLg4P6Yn$VwenEsV7!rLJG$CS<*@pYz`bp${9={rWhF*P8;9(e%^22f7iD=( z9M|AGTjfk^(5O4DcusQRbtm=@{K1-V$wWi3Z zUYQ;*GbXN-^ugPfZfUfKrg_B#T`nEAm+y$ekm%}sPpcgM_28znj!KNd#D?C>^DN?3 z&bGGIl_Rv!H(urquLZ!OdmAFFWBuFINw~%c8f?=du_5dI`;yE=)Q|>Wsx4UHtcR6( zq8bxJcKAyvn4ue53EryHMA}vsBIipmrz12vJ&{W(XZp*tSeahgwuw^~PQk*!%h^O# zjiILVdSsqFYx|YIEQdCJG`v66Mo&b!`UIUgi5Qg^T3T7S;xfqhtYAM9m*V9F{EPjl z#@Bt7a;z`;@6#9>iyd1BV+x9!yp$89VhKQm$OZAb2=V#Ebwl#3%SVILF*jo81m_sn$U!F(4(uRMbNo(;`Yzh<= z8<%HH;yI5eSC_M6{t9c=+mShw{CoC#K|bmh1eQCW%5KZbt3g2OJ^)8swE16z3?Z!Qa$|fI9VrKAXh5yf&T) z(pYtV+sXSdiNHB#TR)Z*y?70kQE$KP^lcQ9xHMLnAyPdu%f%%kcU>&)KG$YU*J%Hd zKjZV<%e=M-Wp^eVTW}4h=aVAj|4~guUDcokRC*~($|Hipe^2PuwuIGG^eN|ELu@vR9uf{3l&)y|!E*T%A6_qdNTp3W}G z6BT`p?T~e%hNrb(W!2rCT#_$tGW7p^im(TEg>&j8x~#Ck*rR6m?Tha2P1@IPNBp8} zZuy)g3E%v{QNAVoBoSA$6@JYbveofL%RT$2XD%(4l@@8nC1zc8OvV|D{i-(1eOkM7 z9n{|0*-}>-L5y$GNg4OQd>5 z`Ow@JZeH;aL}Mj>)-S(LwfN&hD&=R1VXDc`vaKhYo$lXmhW}!p>~v9JUKxB)i*K)N zhcNFnuV0F9W=L(AU02bfxOs5!zX#xIAEHa2L^@XEY65R;>*))2kK2bXGm$2Y=-=6J z5-x3rw!N*py?FGe^n=<4?U`2Z(&92n#|^VX+_)hRf6H){_sidgHkQOdVRk!eG}wbL zSZ(ji3@Xc{R@b$hhld+(lE0r=tgkNPxr^~RsP{4YfXXR=-oZ_N~UlS@Rgm}U6jMftz+ zrxf!?T%2q375x0nQS-$G$8XduU0wa0XmpiZ+?{v)+MSnzhU-CY$*`YNUOTwv;_!ug zn**7gxzF9bl{o#2jpchDD8>zj%WogM=G}*S5&k*T=SsB<{?|$PdyN@3_w(MLnr#-% z{1nyC-RApJ4H=H|C*d=P=d#&BAb1(@pV2RItp`e_y$F7At)8*h`o>XpBU>=33m(lkxqVyM2RS#cX0y z%>5GqZhGZ@?~BV7&Iczi{n}@*e&fY1+qgm!q_p8j0(|OhkLTp>hlhTZXq9Zv*!WY* z^ZpRm5>XKrG7OL)R3@JaZoQgqNGu+i6#KS8^DgeF3mt2txo2}MrBZt)E~L~f8w&4q zrB#bp2J&y+->5l^`CQ@qfN(Kj`;dhH)T<~*OkrtH_P)yedZVAK$j^bN-gh|tymiN} z0G;zAvfeSa<)ZU=!^P-Y?eRxR;=k$!EyawcvJ8iusc?wo^+WiA?<1#sm3PwDX}&g{ zVU_8r^$~Y`?(OZ%x`?)F&hA3o_m-I}_7rr6AAyD&4jtZJTKvAeq^#NW)4+GQr(4;n zioUVDnXj0+xY36c+2VM=(4n5>ifznTO}`3n)xcD7d&e&l;&9vXd!-#uRd+ZI(JTF= z)JlrCo-&%^Z;Wo4%rf*J=B`uB|0-KrWH?-2SJzPdEy?GYc4Tlx@&4^32Sxu~b43rX zcAFzVnrw_8JZ<7{(dop~qW9x+8oWSsPbwBybE^G9XO z6CUL2mnL~QT4j>Q5=v$-OkA7OlJSapRjs@^ws1uDeG3aVU1CzL=#6^s?36Uxy~*Cu zccN4BRoC5nOwuoSLgTe?$1)k*#RF>d)kbu43|xGY-%vcF54S+9huU|J`TISPUy>}@M0CW^x>V!ChknV|W=P-sDShW} zf=3SVj^+DyxXdrbb&mT~3zjq5^z`du$yw#alBvUE8qA+l{(){>i~Nw#=j#Z2RX!N% z7!M+lOYyUxZ{I3{ztz}`EE`pGRV4nf^=Q)B{%O5Mcv*||Lv1}83NH1FcFyP{?D{AS zVSzfjJzH$<=o{%SrF(iquT9MIO|QY-A=l#QRfgN`7hIWFc$yY14YAc$p8Nhw&rBl@ zorX859!JC>6y-Lg4$oDte2mq3WDVcFbz^CAGyausBpI>g-sjIVDS4CM-hHh5?!su< zfh-PoQeOU4T#N}f44?C}4E^xFDRutgk(O zC1xbRrp?qoHtWl;R{VcoHuigu`^q_e?j{ullo-dVxngvV`P@e`uUfr|`(!~La~W!r z+DNb2IxNq>WkG%MnQlba-u1~c5kA+$k_t+@3)3Zs`)d|EJGf)gcf;R@<%B=REjb90 zp}oBu=Ekz`hDN?~-ulq|{>5PFiM~zt<9}EEdR$Ji&QG(af;aup`dK91nQF6ule#(x zNq;q}J7JSPl^f{3i06=&e^vRsqRYEAP8Eg)y9F$t32mD7>nU%z@tj`_Cikl!b~)!6 zBuCgZ*}tkUN)oxJ#Hn=NyZ0MuQ-_Uy!HkM{m86l~RE z?wsDy=&x+8pzY8k{3TA5Vi{a%M4O&J@kfC=?7+K99qk%@N4beiU@mfG47anWZvZ_R$Qw}|dGs7-iP+si{=nmcfg{c)uR{)wh$PFs=a&z&TL z=JLbkP`so5d}&gLp!v@NiE-V3c|e1|^YiGw=-tR#re;?Z2Av*#f|ERLNn+orG5@_h zAc+2Rf%y&MI=p9JQ65}YE!NvknXPrT|$&F{fn>>R4ua0f>}Jpa^evF(dzG)bEg)f z;?tk8C5gGKkGr_YK0nxA{)S}(^)Va4)-4o!LG!CO?6iaU#MR&}xabx?ti~Ak^{+r` z^*8$hW|Xh_4^n7nC?+Tmb&Oj3oGwMNB%J4<{_Lk>)6zFbQqF~I;~$Ob@HhRrM`foa zU|@D2Ba=;f&5P>>ak6s4xXsCe@0l_pZ;<)*d? zB>`UL>D28)Qzy>T*AqWeCsBW#fu`HEHgzP-A9g`r*ft&p*WhnP7BD^k+@Y=ngpJEV zQ(R@CFF=ZZt}U%Qi#U#a%-ol#iK)F9Ma))BoWmGh9NTN2-2Ow|JPB`wpsD(z6>@nG z1y%fDQP)5fMG|W-U~8GT@JFqs81$?QFL6V`GEXhZ zzlGOy7Q9KLs*%@NNAOc_-461L3Ix`XZUao?wrja%Ojjz?sN0a5kXvaE=VV9Sc8j+c z#FnR$($i`s;THs3H>0asOo^K?u)(uz8xn(%x{?t2DLmW!9LExHnwnN98Kf2|g$5;n zfFNs_Mj*mOYfycfNCHz4b!r$wg@O2qNHro@5_iE@}BPe=zf&zN3M(m_00 z382C+^7c`!yF63tu>0(HLTQ(Z(Nym)2TbAfMhy1kRF51=yqc^4#hN=I442<*fuCAn zVc=GT^N9aekL(og2XSUNz+Ob1fkTK)#rH8yUMi$Sr0)))vLB_v=Wl~wI?GZJwpkSU zN1F;e%(zktHNWdyr?AP1MbW!q%ruMeLh~7aj4p*!gCF8w1zc33JYz2HkEU;%OFB<&f_)$`r5Jm05JHamQGEPr z(9@~Hm1L43prkRYROfm;)_TDOV|0lZL9L%wCK2Zg8swpZ)GM_lDYN&17)aBZa7{c* z28<2fi%wF}$fQ|^p+QEejw>T)G3tFxG1KXNObru;w+vS|=hY5DO5_%j;$<$0P}H_C z*JV;##McHX;Gomamr&d zk=YK$jCU*bB!eP>29+#&L4zYgqJ4t#N6tKkV^+7@ky7 zA13JWa6R+6&-*?MMIIMQWgjgtg$Umua=N+s#6TAv{(Z1E@)9^}RTF{Y*pVxAQsk#O zR|Is>vxKQO8LmBc4ji_ywY7St6M$ zgBM1%t+vm>IgLxJ5aD_4K_YVkA&^1`DlM=`q8&KVL_bcdo&-x7M&rD&5FrvT#5CS+ zN{k2YiOdArMS&Dd;h&bnGU@)JCh4QaLWwj<_I=D7<|wS1@LfB4U3Jj2xmOpKb)q$@ zgVF`|d8-iAwra+6mi+=KFMDtq7}D@k;yt%f>oeW-mHLI zaXSu8Rr#}xnm%@CnR1A)Z(6QGZ4%`*$h+^rxloH#zd{(;#ldgT--7>+lyjs6+gKtb~O>bu$fLH1U|#$6Lr3K90ypq92UNY*Dpe zNE2$T?Dk{qgl70wgYzkF$jE`ylUk}1f??#ZWZlhMDTx>T);UHdMRt(QOmaC$HU2oK zp%d?J%7{mwSWt{dE5WUi_~oh;lFn<^Yb#Fr63dR$5A-^?MnEU^0I;2mcj1^!Taa}2 zGUSCvkQX=*aPYOpgc0})VZ>DYS%d-TqO!fN>rl165l(Vsr$;fO=Xghi8R(O6fp3wr zgfvjXjDxD%h3mLanZuoFLhTi@Gq~`C3e{vep*FId$(~~A;B`QCN=&kJ_%`6~wO)I; z0V>ptcRLpYfG9v8m|`a=Dh^?zRPYH{&Td24p}N$Ln&zpylBZs^wDnjzEev@8N4~#%t_JP|Gk&QfOD2 zaNnXT$PnD#NGS@|t1PO3N$xbX;zd(U!72UeO1CC}A|nNRg+GZfMJBzDDPcNKyCtrS zlOWGK;&l$FZbuz5`DDlDkQEPZf!i*OC$40Y0Mq|Wxck9h`@)Yz+eQoJ0rwJ9EF3ry zq8-+TjTnjo7HtK}e{_;XDa=4q*&TFvKh%Lko&;)G9ScAXdN;@{Vlp_tq{#W;06SJ4 zBqvnjMo`C>mUjx>`O!PTCL^d4oo4YeZNpA=Q%A4Esj^+5G1<#_!8)NLn`;SGH-AM7 zILmqQO=Z=dz5mZaDijpO^*>jrik;)6+NVB}q8;G=lmPcI0fbS_pT z(Fymju+@8xE2#u`6g8@I4kOCJpX7L5$DN^KFY*>h#DhUQP*3oVoL#HYL^l-(NB}u- zXF;AuN?~m$4n*%m;+Th~^{8BsK)A!I|ApH?5Ax51e2;8Mf2Ottmng~xQ6$3}F}yAV zOhRWRCg>npo`7+c1$Q-p88BTEZ{3*`Zv^@@k<6d-R9tdl!?@8ZR7pX&Yk6QVKYcox zgxyEc<{tu)9-l5FQIdx%nW>Y@NBJK3T#Q;z-aQ4B0x}hZtcj$vFLetsEBZuTLi9z1 zGWThzY{++XgD4(!6ltKN5S`1_;Kzj2GVMDJFzA!HT1vMr=SZnqmoKQszbBy0jUX$7>j0$S9tw#zzvMbL`V(^?bWP(*d{P7UB#r<_?-5Qc)T zoc!EJN+b(PCMD=#mdH=_^IYREE=gc;6yQ1i@|P8f8r^LZFVp)Gf0?sPzrF~8o|q~E zCv(9sPbwF3ePZvJ;Q*)zr%SL=Ov3NF>+weY92bm8s~13v`>)oLqje1CMsg?;1yc9T z7Fw@{bw}NF|C7NCa02@eI;gr+Sfcno7iKz+RRc|i0Z5)k(CJVvFeDl*4lFry(a+NmJlM-;5U0_4ny7xDhdlS$*4;a zqqCQy?Ro&@(II3BlkvP(N@pKqJK-VTrq2Mptn`9&NU<{tW8LXZLfb+2f}ZUp)jmyT z3j=u{sw3otp|ypPGVzgVjq!{__VPmUdKZp3U~P##Scy?B0KEcL8=UvDoh(dHAv+ng z!+!!Buseh&4#xx@G8edm9)002+iVUab1U0ZsCX3-$9!lxL=Q_Q8R+B@JNDz%(u68W z%<`le#)r*h?R+5O7n=+rOmDzyzc65*gC|ZB6Esuj4*ByfNIuY8%M?w#;qadfC7;}7 z;x~)EeEem9ejLe7)dhNRE+SSaQ6UjO_m^A5wCp$T4RVsQDtIA zK^HQL9{5wi+y$DDZ4j3Ub@S>$({k|cSO3+IvVTmV-0gx%_&kF;!`YG}RC$(d6bC+; z9kgo`TKLsHnn9_|5=kw_i>dsEB=){rbuy0L&)>8vu%#0JToW|L z`;%Q*SPectq@>A(qfxj_e2zV0K6HwxrpYTrggXVLb-5sW?EfN#R^9`rNj zdE9c;mqR3W>W6mt5q|HU5;T$NqVk%kxu0Koy%=pGL>Gc~;`=QStK`Q+h?;Kh76(E1 z(m`j?gv!`f;N3WXHmpV+AXPGIM{gi~ln5Jf~EmELfpysv&s=9MtEj%8{1^Xwy}sn+~3OsRUawiBO#8 z&sVJ8mRo#H#8$fXwWj@LN5}!hYC$!$LbsvT%qt=iBx*)zjbMxqaT+m=Xiw#!)NH!x zT#|b|;cwJmJt}d(>UIKO=WpcMcq5CzU&=cPqTAin*lQge21819Z{!v<#@rDh1Jat( zX>b!(S%&OZfTH4-t;$J;81OR7b(%xne!*<u*TPdl`ZbqJHFWfRBk_XK+uP8?7^M;aMzEfC>27O>;b-z#t-{qt1 z^p2TR{Wo&(#ssuPbdQRa{tD#NkA6v$a$p|`zH+&W)$R3eeWR4yqV&1vHasE;bQ~II z0BGm9Dp7a%2WK?wtqZ3|ZEa6tNL;q4qfEz(WN&W87Ln4?w*_YE(ahni;GHdKTfb1m z{p~*eu^oHRJX~8KP@wjumkPmwMtHO+!Z^Xt^N4rZ`X$gxjHv7tX!ekoMno9+vfP4* zL}?t`BhsMiflB~`91>pLkDoRk7pb>TL7*(7A;>Z|6$MjJ$mMSWy6Hq)0MGI-uXq%E zh0`&(KiVgK*{X#3GO|oK`pa~&hA{J#b!P7SA^yHBY#?>L8b}fjr+bDWwIu=OJoR`B zIC(Gj(DRu5b@znwDrm}9!uD{)a{!UT(gG3!7G%Y+?zl(_{Uil6fnv%|HB6_K%L1vO zvf9=Dcp}$rm1jkQ=oGTi@n*yVIt4x3k%iq!RYn)^RH>NsuL2_TWCOMc0-Ci1jFI~p z&~Cp>hLWEzux5mCm7sMoxraI|8J0CDz147{8&z47aT!s|!%rDd-Io8k(+*yC59kYqy*n=aK7n) zmlf#T&TauI2<~0x)Wm!q-5}Z_{9IcW^X4SNa$l3^0NxOAjsMdaCep!AxquTQvK*X! z(2568(Q{VlZVS<8ZvT7XO`ch)FzQCr;1?eDqn*lYHcWobY_Iw4q8E`D0WQ)$DpmFR z)P3A(5%!uWLMDl|R5(P>Xd*dyzBW{$j&FG>vn8n3W%2kYbN*%>4ZayEh zFTb0-DkBv+U|cH&M|G~&T7kL94{iwPGG(86I^G(w9<(PMyv*iQG-~Uy35SIvc01jn zsVJNSqA_6dc84;1UVM(CavkzY)??2TKExZP$2v(X$&AyRy!j+8gO}Nuf%DG&%-=@a z!?Mn#8;F!yjy-5H{t*(w+DXId;%*2xg~C`ynZpJmP1YuwDeDYv6YDC?q-F=hOBg^K z?;&=Ww?|6>qmc%xUMLv`-M@RmPE10PE*7c=q}~}adiEaMB&^M!1@B}Xq-oQ9bnS0K zU)I0k8q+d+It<9SP={HrG}#RQ9yNWk&!QJ0(L_Ya)bZ*QvAu0F>^Ik4G9sG2I5Ra4yO$I!^>uJoS>oGhDPmnsSUjU4guBr#h1dyYdDWgaB*_L3<9|ggH zw~V#%&jTLATOqcOwD!2YIt>sT-TC1A#s_M>N5A8gvATu%l> zN@XolM3IgcAs5({?$HF4unj1k_*`ypPis$*=R`A~l4+z*d;y@m%BoM<+0=O^??WKepepK_1WEPEK9+pMkm)_@vHH=w4Y z#{rm&G)UDY-$1E?0I@*`CO)}(3uS5C9#s!QBGLe`Fq)aJD>}kDPm|GS8;EwZ?$KoQ zWDGIV4;cd@q7h#nJd{9r&0)?=a-{{lqnI8Bds ziMGB6-38#_KpLZWa*WRKkF=lbLHCZe;d780EQ)TVfk=yWfyNi4-JzLf()B5A0M9X2 zG>xnaZv%|)VA+94VQ;#3@l8P9kPUD?!gVZN79`V17yTG{fHe-_i0o-vJ@A_opZSKg z1&}R~x}xc5FQ7?vH-y%wkrMIL1{I9%x&y(>!GaG zv3<{Y4_lvnL+Asd6$S8!q(YOqJdnqtWUdAc?c@H5za9V*wcwv4pVVWKs(>E>2p3x~ z$b*0dcw|6X33sp*XsRGw&}L9pY9L(b&-f&+IG_jSJ<-Y!r8V^sJyg7fhgjmErX(`a zZJ?@#d#K+Zsou!`#NQ68sue^_)pPL{>OYV>`v96$J@QRdc6~d417Jrj6Xyl(!9OxV z!|?GY73_DKnWG?)M?nrnf<%b~MGk!k&};zVRMQXg%>9Ia!QI_6nwffYq9s~MZyglGc|02PEA<0w>L3>)V0R%fJn1&FfIO(Bv{XS{lr*xf=$E-PhEWfdB<&hr!-efV%mb;YY(F=A$*I(H3A@5tzq;O+_C7 z1EV#<9s`puYv3Z+>;lix24Kn)47lVESM({L0m^_ilzreqdF`PKJh*`eBj8tP`A?Br zWk3N0nuxgBX|LSxnEj6J?6TFVjxb5IZ)(%4``vcjY5!KcVz=VP^Bq=WD^*Rm13R#j zA|I4a#g)i_YJyMuT>5Oe@=*e^XmO->(gh4q3PC`9e#&~%42-raP@1kp{`$aiSCUF% zwDOOl#8{P_lRe}~tT#%5(aiTr`IHKtto2|?SQ7uJP>bfXG?0O9BYU9~h_PH}ydukf z*JF4aSg8zFYJrs&U^)uuQ#yb?FjuF_vR8TxTU#v$RHT3k4os(l8&MT_RB7iQt)c(c zZuCEB*E!&}`>4vR!p1+>%=g(xzW9g;$z2@zJb4@0;4hI>NdH|veiW)^AGus|#}ZCtQg9;qZe?ybyV_0x_>Y{-R@YOLv&lkt8*p0XG+C^MK67k(SBd-C@Il z3fRgE|A!=O+dpJSfzc$eO*+7=(+sw^0eI2}Lh~M2&cE$Bt+AHObq0r&Gv5Nt%mEBR zpZG_$+xQ0Gxv2n%EMO4CKN!RmVF9+<3$|Jd3AOAFrfV2rn*`6o`*qWieKtKk5 zBRzzb|5TLLsF4KDYk`_QpcDou<*x&3fj#JLW+I>qU*ky%_>ciocYuTqgfIYlv4j7A zSp5IaBb{Nl2qQD_5(hFn)vbIjk38!aHEu3V|7!5pOe)kGb~C$X9#g+o4WTdRKsESy z2*V*U3U)2)#zlF@U5JSknRVVYKrp9&{Lx%mE4LlN1;&{G$_V zYEU4Q075~AXx%@s=tLmh2&BV6Y7MNV0(BX%&rzot?Wn_MBBz;u9OeJx2=k94`F|Xh zefh@`<{w8_XZ{aIQvag&ziO@W|0Kzp%R%6Btr96~Wws3j`%Dj7V=?neB3Eb6|E=24 zLuaGafQ@mmo(+x*$GSGI{(jHS~| z0>=^z1{9hC)@t`6>e3d}@yRX%t0a#WBmbvKtztsYA;wS;6EC&kK zN`N@4f|?bsS>M+4|0AEI{zZ*%3iMro*(hLOjdddM#Ro+Y45Pt2|7Es4fJFo-glp&8 zW}vPI{CW0}y?EyVOE>AF^W!gCCO>F~JEM?>GE zF(k=1!m=*!Q=m)O-RuJFSXJYT_Tlw$n&G{h%WjBCmM9q6(F9!2y#h8_ER zc}`XOz%Sd@vsA241`g+5L>E8kZEmg?FmpV%KtXXjBlKg;yTw>$F2c+#o_(~1v3`21 znzpij4DY;hhgbXd30YVKpBT5+4a~&)YMqe%zE5q!9_xKxj@KqUE`F>&;OW%a_>)0h zPd1};Xm?L9gtkUCr0njMu#Y(-J0UAFoq(mVd1AJQ#8`UhXr+kbw-n>q=5`%U`kVIj zPHn+LT8>*zhv3Do)1{C5uG?&{{lU`5oY69vTC)&o{8~bJWhUeF3>SlbhvG=o)U^K1 zIc;5SffAug{=w2-k7exX z{x|y=v(}^SKTS>NFZt~MJ7&j<{3K4p-@K8){yC-`@%^>um%raT@}?SKFXbk@MjpgLG9kpQ|{`IF*Zsmx|E&nr+6&9-yCb2dxVx5}Yv(z$3 zu3ZTI4gyf~?B2++%l5Yx-d?K??et7tjQsw_c-T1Q?@QJJlhPDBGs1rZsX<3nCmF!i>L`1kAUhD^LuRf3IQ!#4RQ{&=XM5_Vz;+EL|8^!BSFKT}H1TR*K-WvP}T zK1`n}z&mto553SODSj;98zpRd#y9J^*P1oCOp9gSP?GI47<%pO55Hc0_4r}D#N2lB zukZRU8|D^gppWKx3So=(!8LA{)wRItf)Ts;znPMU{d{{mE8R=F{hHyeWY+r7Yy`A@ zXTYza{G}@qv8qDl02n|P(-`p+YULU=0 zey^Ttm*J+?G#Gvs?&(>|Lt z9(R^fOI`iE44bX4mG;ctofovxmO&Kj@pmbf_TLdgv#b-_nXk;(Toy_l8{d?bD^ar^ zp+cCBC%u`#*JOD6y{z}?X||Yx^)4wzoVdD+w9zudu$n4`%LodbT2ohi3 z<{S%20j%kXb;ZCIN9qp#o^L*&_JpK$e3R#H)09*z9vSjyh$;Q5|kWcep zxRB8C%auJWQHGw#9;8U2Vy`>$Xx z@<||RtI44_Q{~B;O641e+|v^2cVDjGBe^H+4cE#{>8@EmQ%&v3Ei>Pown~ox&f81A z6FScH+VG>0Y}8SmAHVr4w4AH5I)`(VH>(;+P9ax&Lu>Q%9)`4CR>?&*>s~&dtD6Nk z9Wd1iMu!g=-bn7lL9UTgX7=g95Q0x!li3RE;J}EAtccd?KF|A5qu1-%`1_Ee9E#jNbfw1< z>!mV@9B*yc&J5N6b&Qpx8=JlYTzoiouIQmFO=x{_Qq@>9G*8C5s)Q2)V}y} z(J=e*7ZlG&Gdx=@Ci%@mVO~G~`(! z3I(56235r*WmJr^c+bz2R|dx3xJxpmx$|ru{p2r~JxoU0Jretl-N14>6kva9SUJgP zl-exQtEyZbGoI zFnIH*fqCA~0-q6gz;LX9jjNj7HT;Gw^-MUp{YUz`93RjcEPWsFbzKtNqnx*`WzCgK zOD>Jvy*r><>c42Xy=A$@-$!E6cDpv`v+m{n#wu#Ap&GifjMU^XR zwXMQ~eFt)<5|p$Nx3>7yPj_PLAx)pU1{KrkxE;WU;F(F z5^|Gs*XJE-0wS8l6P(SA3wG1Eu842ZD8pe->+#>iwqp?Yu#8Yui@JNaN2#jQ)ym7- z{sY5DgUnDnpaX=P<@S%gKOY~1uPyb?6hgLo>;7d{>LV z>KSu;h%0SMUHvZNStK!&7@DEa`MK&iahb zIF}1n9ESZ|hVDwvAZ%wtzkgg5vlZPvPTR`R+iLAnBpoqnsKSs~G7-(leOVH&CUBI3 z61Wn|M~qWS-#8qzKSfsDQXl83jwFzO zbX`gwe>E2U-FMUI7gFog2^jzVat!|E(V7YWOf(`p(;6A%xmYG^UH&}UUn!rkPtcpXbM8z1 zhHQVRxO!OFxO43AGi%20&2Qtpm1jCnv}|=^ ze3eWV9l+JLH0NG!9PGGU5#X|eq1IxW(!bi`pR0H*X1DL^EiqR8I(nHryX;_@fzG+P zqnobDHa0h?K1wyqMQ`+7h0c1L^kS6T@z1vP8JdYnp5z@-5t&_QK0aaEY#bePBzE!K z$38uO{`NMX>q?P_laW%&jcVdy&|7p^6Y)lq3gZRuaMtiWe23rct4C}Fhu6O|IY+nI zO8gcyS$oXvp37+6Xe0iY6Qu*68A8QIo%p?*W^wuCriJz9aDH{&)umw;<5l>#y36o& z6%p{sR+)0KY?-l2<)CQaCbi*3i>k})2L-%xQ?$#v6Z$pMjek;p<Kw5(HHs)1q z^&gaeme7LwxwTcj%Ave+AD*rhni~Jec{I@H;6kO#Vx{=Osqc5~b=fJoFIK;fR_`-_ z51b#zKg8Exwl}@?_Gj>9eTBS7y5di1-)k${D>;h~JM~7Uwxx_;j*TKW=zV#_>nq3G z9N9)~otE}atu-(Ht<6EBXYL3SHJY}5x8LkzbrWVPz%^f>dfx8Xb2v$Ne>2PC!3nJ^K zqQMhx%Z7}wW+l2*fD5CpX|KtSd-{2YDsGZeCC|5?Fq^hZ^3ZCk8W@VN-a)u9K+%12 zE86`?l3&MN_`No9+uYmN1F@bx5^AoaUb|Q>?I#XY6mjJz|gz#l2sIv*NW zkIjVoyWVJ$&AJQMopNcnT4(1=GDrEz9Pd2W9bb(Y4_0g5Ta~-JDCCsv&<%`i)^%q1 zDEUdW=dL49H(Lzx-qxre9r~-FZ`P<28v4Bh0s{;bSy)14+qUV`VbS|wgY;i$L?L{&elb~5+)rh8uvAl54;1*J!FDxw;Ox1^Ehw0oBiHcyA9 zQzCL|p#jSQnL4isCR>IG8!paR#1C)lJkqj^3Us~kVSQHM`V3LmjuKHoL;n-@Ua75b z>UG374S4%l>)(sB95VFnayMs;#Z~y`uFoo^`@ce397{Fui9RSqZHDSdW2IIl#B3Mk zzVEjC@|V|f!ro@x{MWs%%mB4xS{qpthI3@^ydCTp6MA1l|32-)NL4g3HhSu}C~KlsJ93riJ4{$?C^|SCkrZn9B%w>pMdiu3 ztNsSNN5{b?o#cIJ3$_ z_w!`)x3CRsr6VjnhW~1tcVOeHwT4V4zSA=lFw;fPoFjbwR7!q3$mTC)>Q%_{K5@?l zW$bzUvx&PagJOPiAd*11Eb7`dv-`F8#PaOxv$G#75BT&)7ku|fkE#q<-kGqnobu{? zNVQ9L39G$z+I%x?^Q-d-O!E$(LT{RdN(S54llQ#oS|M$sER*i!GZHcvqZ9p5{Ua5n zZ((X>lr_~sP~UM_3)x#g6iQOZ_v&7bKvi8vV~0ATgYs^=ev10$yKU41g(xkERMw5~ zvPf9SgPALYvAw>uww|dRJzk}Y%7sFogc~e>vp_g(I$fcRQYCL0tJF3q9l37ygwFYL zYHlL(d|38LvQCnrfP~07Zkrt4DsKDXG4+A!7ibFoDYq$mi8dif@O*QMUqzzK@`rq$YQ&g>71`39!J=7-X6uZFeyMwn8S@xx}dACC?D z3xC*wzR`z?nos%sbqvz-p*>(1f>=r4m3#oD^MHF-=Ig^Jv{u@^3y<9s$(6dxCo-ia z<08H*ppR!FzBSZrSdf7s5NY9XRU*8FH!%fXmx7@F@lr4E*Ua2(P?%&l**(I0?K08S zXsV|>-V0TIsONuv>lRCL2TeIv{~ zQ2Oy|E@ViTGk;_x2r6;GpaV~@=zkJ*y31BEq-C3lj9PQ{yH-SRZr1+;l0a?0h2OVZ z&+ZXC&+u5yYud0e|5L+ANx4P4AJ1jXgY$;3!Dq&$0Q1dz>0~W;hhfaOgSKd^VdSJc z;aZ)oGp=u!9d@n8bLHL)^ZB)JOt|1%08Lx$+M*@T!CJs;48T|E3DBOG0PX48d6B$( zGR*hZ@P07QwdFzc+L!=?IM*F4g+~n|1?MKi203=8wrB@{IakGyz6Rjo2hGoBoe;q}!`eJy=6cFp^S*5p z+H8r?h|e^!8R1L&(!!VapBuh(-v!}I_g@sg^uyWVOFx?k=SjHw%Bcs2tH5662g;XtD!SCF+4f;edy%-joS`6+rBoM&G*Le zIcyn3z^Ofn$LV&$lbW?BSmU8*NT6pdy!UY(GMe#g^VxaR9-43KSRfG^@fg6rQva`x z1CN;>iw!irZ?^Tm-hby<@Y+)JUmVMs08N+Kpvn9k+pzAFyKqmcc1KzaBL(kexV>c< z&5lH9Jh=MFHZS|!I)3e+o(S#7gU+_$i$E{I`ER!7U%N=_)W$*1ki!-|;;={80qpv2 z0<`bCHzP7L5!zEATo7KO>FGzU_emcB*ooJJvyYmee`L+TJ$NikDoNDz)T2hTj?aE$ z@tGv~N_>{szt0}o_p&YWq#X(&QF}7xwMX_Z1pT1b5$VTkz%APS;DjejcIRvhKNfBoir4fvewjN)rAIBGNx zIUuXWIkXU88!Ogyk3D5vI-E5weLPIUd>>&QY}W3_`73e4E^IR;5hg9QnfpkAtuiAQ z=cNl^!5FL$(2+Yzt^SW}jJ#g4) z#y%Fts7$~edXf#7t&bGc{&_DXhXntskrVkb4 zbK}hD?j!g-I5Ud(I2B)6edGPE%^5Dh*VtoexoG&cZ7?l&fgN_X*tJD5fSi5BnqHCs zlS;eiyPnhoy&$iwl?z_zy z>ATC()_0pD(vRoM1)%pOgeUi{hR(i;;mLj9hfX|)G^h5Y`MHP_o?L7g%{Aup_ET+B z5}^^t;tBls_NxEeG0ZTG=3v0uk39B~HOHFx>}#WWWFLAS$Jo9b??;{5lcg6!Xa6#Y z^f~NN%?W0INrur}0^x#^i=p%2rk79cU;op`hR5~Ze{oz-v*Y4>)StvY_TVV{Sdi|~ z&>>&bHS)0^FB8@EBlD` znKC}x$M1pUYcCji?E-s!^5pny(?@x2hWS2CxM2DbBgJkH@98*br0jD*7T)`8wL{Jd zTe!fc{j}g?$C#`HY#V$cP?q%4^xN*S&1isxtV)3SOPsKFsSOJAoUk?qQ2447Cf(iz zlbp$ro1XOA^j|n(t!LOM#C+I?dA|mb(*i>aVh*@6&k5H)Iwo9jZZhC=aSG;+zi)I# zBD7!l)kTp~TezUlaYpnn*82>LVvaMSr+$8Fly(E7w7Y!_4E8(hSsytddi(No%%36I z40iKA1e^}@-u3)SZ!X?5J~4CoyT2H(-FH`IMeZGyzTA&t#@yG=gWO-hjJf|gn3ika zFD63!eg{PDTE?~tP19ethYR)rbe<2|BHX*rPk@|z6i_()IG9Dng1!l}mxZQT`t21HpKd=uQ6aw}EkcIu+2C(QC!^Zq{Cq&$!ElL}J zwMzjCF}~dik#`Lv<;4M5`&g=W^CS2Se~WYVLBmL~LAYQK-6y?c*7i9=8F+4OhDdBP zEW+!@vagNi;l#Wl{+`JdhpqbnyoYqtdn9|tKyv*1dF=ZdegAd*{_5wGXT=g= z5bwS5I*#`-=DkUpb#L-w0?e@`L81AxOb{;k=2zCwv|xW(Us>lsNg~X@0Ix6RpItKF zlj(t?jL0_*Ti?eV{V!XeuX(oKU9b?s1;#w+{OC*Ty_A?&+lbE|M^hf2{5?uSpFYYZU2HP5&BU}KDTc&r}p>t>aH5J-MXv&Bb4jRoR zj!|AS)_P6Y4xQ^@XkpATHR}ev<|e?P`7<49r++rpVuQknd5lxDrb2k~+lG;{8o~vC z#ODVH7d(5&X#OjG{mdbw`9r#{#T+U0%tD{#YsCj&^259zJM2zxAa&Jl*^` zJBKZc-is_aLCKrgNefEsTBofgJQ=_?w!{vdKLOW*k_4?2>d&5Bk^r5%Ak}QMbl|R2ZHA|q_ZsH= ztMTW*gR48ux%39CpNTv4C`8IY)A8QW3E@5a9CoYT95(ak#a=b=97v8@KPNaf>yL-5 z`R-fz&vQKu?_bQHhkK23na`+MBj<`eYg!^S;vDrmre@Kzb5`b;Msu1I=HNN~QXckc zeZC!|&&c@aW7hlD<~mFs!0TE94C48Y_c^>aa4oO0KF64BzJKRmsqdS3`sY8I9ST1g zG@7xF><})%YpeOW_pnij^<+DYB$G^p)XXF(7_2BJ zB%^3{0&k&S+A@xpwzf=&Z4vCJgm^2UISHuL*uL2^axB<40qk3I-d z+Yl_?$xOmMTyi7H0nGkAYwt735Nto~@A*96KX}N@oU`}ZYp=a-dtKswJtXq>4<0PKX@yL-+O*M{=ocWzq-#zd@hji+^%_g;LNB`L*X*g zuXy&@dv5vO)bkhXHTZt7lwZ|>xSvAOL9c`_e{|mDT%Lda!o5qpFMF^@`f=p*aa_TD zxqPNQXQB>9&yB;oy{~umjiaZlui(Ewck#I$?i;uNFI>TE6V`|F zR^njeGOL<(zDNw zA(3!?S;4t2Ne^`Psd$T4g0_r%&ob)1HTw-xv5`V>X)Ecy-R3z_J9Z#V#x#RD<8)jv zcbgR_?faiqi>&CEFZ698J%07Hx+g-J|K^DD)!>}HHt$kA^zD~s_m7?Ly|$km_w$N= zMSHgMYYVlF1ZFz-Z3G46H=#nV?^;2)DzV2?mV=G z5@YvN?BX9Tl0pA-I?gxabniCdwk!GWvlsJCTu-l1G;zoI3)g9#OjzezS915ci}`=g ziE-!a;FbJiJ155Lf;wO`_>pmZy-V>*b4+e1zP|PBKbFz^doGqUyUt$3$5B7ZQ#_gG zefN|wTIuk-sxLrAD}i8DDO5!9|2(L`aq!&3gEP5r<4o=YeG7iqrKRT~|AE$-+&n9c zoldCpHQgkA$C6Jp%;bZpTT9(+42OBA6L2+U7XS0v3vua6q{$hx_|9>^AJQCo2Q|&q zKo1;|V-3F|pJlW7D`zjp`?tr-wR>mr$Ip)Ef7CpBO6nN-h|?D@z}K%N4;#=l6ZKaa zYSEImwrbE~3Hytk2Z#r_Le$zqE+~;xs>F~Vh z0tb(-cQi(KYdks!tf;1^M$2u#@pq)(xGwHD-g812owR($6u46qgtE&)X{@Axqs57Jgn`?RgpRDEfv%-kO z6fI;{HC*Up`rN6+^SC$R91|%QOHN#%|1`yrE?=0%_gbIf6SDP%{1c;cu_>md$>)cy zv3-xZpsj!HD~&RSwH$aNpGP|CoUFHRIxUP4k?|zvou5jc-S%1Ww5XGuI4KO2l|xeJ zdV6#YD6c4$F|j7X0?}C<&!v|__!|xgzkXU6e?FmjU^?jS?WcrMw&I~8uUo$*w4$J> z#RdG$Qs^xaBG@eH*PZ7EJ@E6>!Wa<36Pm{S>K=RA+|V@ehjN%7+>i>P%jSl1z(4+c z&QoVf;sr9V;xQ}nOi7!#?Xzs+?dKETyZS1=&-&*!@=GT#w2@DJDvUYGzNmOw={HT_ zzKZX(guw^|V?r2YKBW2_u%vict5}Y5G!s%eg)rJm@Ah2CCy;h#kMZRuxa}(b%Y?Py z@5QGTzjdeR?I?%i`C9S&)jj9OY!r1jo^Jlv31zPl8H=1I<@b`_QN4APABRf`uP!A^ ziUC&s@KX`2dfQtxWZ$96IE}Tm@vZZUzrRY+&P_9S_Xs210aHBy?jaXcpdENauP{C* zOT(-CJm!F4q(>Mn6ei$1+a70|w%OyH9Tvu*eXg2%l>HyoGR!->mA)YTJvfh0Iz#ll zXpw%D_#OW}P~pfdU8BR;+NSl6%2IP&&X(D)xy{sGVeB0zxBf>ccyt06jUOTqe6CyR z#P(S=;kB!H>SxHb8YeWB>Q_lQGSN}fF3PXo)4vwR(O|No!3DrOP6(s&yv-9QFTRN8 zCPJ0w2F(&!D(nSgwvl3%y-lPzT#n+=jO9NGL*gg$$iZr!!*v7e*ZvJnNt&3@HbC>=1f%u---@nn5fOq@OWh8ejZd7-vxwZiW z!!F>u9Y?~1kZ@hwBk$4o>Hy8vD?&v`JGu}-Z~%`v^}uEdwZ@82QT+;U5kBuw`j%Nw zp&Q5a*);VY1^)pdJgq`BqkekUDShVV3qlyLQ}7QX%p;=N-6La%_+{(Zv+;FK?hyt_ z1|HQiO&?rVJ9JJM)0X>-!Y-KV26t`0{hYJM&H>fjrg>Z#T|#(1T^o_H`$Oeg_!m4Hx!nbk7Z-2QC9W)dk@8Xv2lm zKo8Ui(c%X^kmhY@&jLL#-P_Qf33~h2DYU$yL4MV)`Q2Nq*rsJWHf>RGdGe|O!niK9 z1#fZ4*t$Bn?P~tqurTVASjCAX2xfx*>|6l%;HRRnicas2X`a0D_N`l@T1Fny;BOTl zmt*WXFM@cMvjE&77wpYGU)=i=Ku{#Hy;)Er^9l~g+@Xf{*g3T~X#0T>!THb-cuxoq zqY!+U3>PYYv5NOD1_%n!lQBn zGB3^zsQiz{PuD6xT`55GQ?~t>sE3^u!l2{H1Lmye5+cN1t%jElbqAPi*q6**U`zU8yx;wvfCwos@IQ`plp7XOmyTQmn< z&|~`+<8mX9oD@bBhF{rPD)oTK(kY6U7Xw5FZGUs(JpT;t{Bdx1sQa7V6e9C~{vqrk zA%X~dr49e7F&-^-rYEsRzeE*$S4J8s*Zu#RmSd;ed< z)!FWU4_C;mz2`59#P>btB(AGP$^=|n$o4Ux*#TVMiQH|+YiQ}_krRr~P?hVE_np(W zthoDP{Y3AM`<3_DF-*k#`spzm$d`G{Dh4VY@skGDZvYC$!&^n&D;fastletgr{_I% zLh{O~;WgRvE~!)Uw%^G6ol-lV1Lwdo2X}+aTgEwL9>RB2EC)^1+oN5;FGu@$I#>wL z^#lrVEF2^H9cGmz=+P*5Z|%mjbum1@6l3t5z5wTcvG-Ep*Vd2n26g~PJYR@kx4G$< z#BUz{J*8XeAJS(5dSIfB>*(DV-yvTy4%h$ce2*l|H*kDxJ}>Bjo>TvLzDvf>xAx6O zV&|nzI-&f69kzdPKiY-#vbpn538Vjx=8NbI_W{qUgl(w}+YaEboj`qmdjRd7GihK& z{|6#Sb9cn=j+R~wSJ&}4T<_R;_}Axq0cm?Z@?Ccx&gcIp^Za?-Jn?&Z#M`c;2|DxQ zJf1c@rZX!#eNF0lrK9<(gd?3k=Y%HY7cJXotDLH0n@*E(uQE*00sc3Sp$*LZUMCbt zeFaEG>m?A}>C^)cXE4N%dBZ8hn|sfh4&bO~m8AkNn*c#Pe_ghYQ0;^!-*6tEd_vg^ zm%1Pr>tOyW3X$U1ph8cFV93QH*(adlY9|CkDJ+tGFI2qafM946i)62ZiU;uTRFy+E z(E-6|2lKaTP=GinlsOG)W?UzE=%l=xl=_`lLwhgXESanaj-Y)pBAUxGm{pYnkq~7O z0CH=H;$Ekj*(e9H!IJW8SOoFBUUNd_doT@Jye>Tu?EwF%9(=8jUo#YsyGb(v!b0s6r?8u|CJCP-37c<=7{O--zN~pc@lN)hVvr-sEip<nKt5T5KzsJMSF z@G=6ygBmdp$$AROW~X+^*gMfY{vy7U3>DAGx;0R-q7*ox5Im$2^RSjKpF5}}n_b!^ zW~Y{7`rge$S~fT1dlRAJb_u` z(w*w0|La;Ge{L|*zxBIDrLR-7)1~qs&S)eLX{02fW=R7;OaFQmzZ&UQHp|*>VRR|o zQ}W;%C)Aa$o6Vm%Aq<^DEsiH?&2u5GN&Ej;oCodx{~Hd&hU2TB1;;(JdHKHp$CKmX zSo=HVxlN<;#-2A?4*Zo7VZ_py1&`_N$Xn^+jqSdPty?-tLtk_O;vD03iSHgm zeE;9a|F8J?i#N7MNkbpC=fOGt+4y(?I)P4an4 zWc~y4#`V&sO}G6c>E?Re4+1T%rMA7l5i0Z%A$1)3O>1_e<5Ctpd zf;J79e+FY#Su3b{W?{}=Uh=_|DBqx_37B79ZNieG3B=0}+SU&9+ofcKiC3f>=o7QA+> zO1bT8E=!=tJM43uh}ZmaaQ+!ChVv*uu%4>9XC4(stcv|Q8%Xyk{8Yl9Itst%Likbl z{ecbh140;sw(Sz9!G8zt&%*V;yM{GKh0(bd*Fd{}_%E&j_uw9UZ+)43Z{>&x;(Chg zJxE+n{~f;`jTbuOf~JPmi!4<$Bi*!CYK`aCI;8I;_C2+})_Hm$x)LJttbY7?{_a^} zKngS?Z@zLf4G*dNsOEPME8l3WobX>+O81uUOuUBI3=5-kC5!kL>w!TH%*q_#Zw;v$ z50?)MV+f%6tP9$1lzP0!{7yLy%Ul%e$i2F7_ z91=!mP`qce=DpX=llKmtVuPpQYh=Z4p9- z3(HqLBWnbd9ANs+&yjbx>F|@lL(s6gPYBPOG;QUm-ZfDVfMX6X91uo4hd8FC z~a&*85Osq=$lX$g4!GpFGY49`Qnt~xG^8cA1fvottI#^^RC#N;Q|=joI@?DbJQ z4S86<6M9%eE{>d|Z4Qrmz={!Q)+w_p+i&Fkn${Srax|h%`F5CwM|Gz;7wS$81cHS} zY?(eVhexM_d|%ICk@peLf72Rq%;-$8#B8umjPfN_(?Mw3Ug^(uL6gkETdjP$Lu<9h zMB7&Jlxw+|2@>{a4_!#}D+g>C@~`D*v@{d#&cXGBuUtmMs|JN3wB*KUIi3lyjw~Sj za4zA8aw$L9MR=D+d0bzVXC*q9`<~C|58g+^ul{n8g*0`&qi9}qwxYQ>y?Hm&aI_L4 zQL0CbNl>e=2@OZD2WtV+=K^N60<^@aP5TdA%WobMMsxvKUg=Zy@n|7f(V5IjbIh8j ztGoI-sJm9?5mjna3gzdfYk71LSRMfP_<8o77X>jqyF}&ZY!Jd|!85g#S=$rNRD&CW ze?2UW&)IN=&WYynFc8pFLjcVUcd0WRy`EXIM<9}QOr4|7>zReP@g2Q(^c+3WKX#6M zq^NKw%$kSx)6hCS5UYfUyKOd~1mMPVg`Yj}lfWa;u==bJ9zkLBTx^@9&P7GPysMZh zaazeDv7^H9CPPa!=}T7?JK#D!34-yzL&*^A+O((<-#@g7S#bVZ9-Hu`s}2p?ansi; zyvy34>^eSNN5jzx!-YumwMT_Pu6;V-!+lKNIZdu-)pdM-!n>pA@3rgru{s(?K7}}* zEtLIy*AZcCBG(ooKDXVZ2l7y+I3Qojt%O`zFT%WlSwHL(#`VeG!mcx{-0P_E}eLv@Q*~&6wdLv!@_7776lR~ztaQ$!@}?mi-KKt z?X#~cKY!qE>4UcK1lBHS6q?4B?0an-9~jGHAJtEa6ZioX@Mx8@@#{7(2%${$dinBx zVH_+cylVlG=X#kFddd*T;d$IwRLCDMr(xw=Pcw0C44^r4NEi*jUSvJugq}y8&@;5U zfM@>pI(`}QO6@X}l~H-`0|Z*|j75u?wJpJ)2FVaSb4VB^NqV6Cn0-$O&>~^VD&QXp z;i<|1dB-*#^!A;1((q;ig?B;nyrJ1(#bz_>?0STEnmKPH4J+GfntA6&Dbvhz8kou# z<(4^NNS|ksC)ZI~2X7)#wIV~H2iR zXt)gYK*?-~;8?RqM9|JdS7Tf~k9YN{dXhM{^v6hl)O0g^Oc<}(@<-O}yg;Y1eGzxO zhBQ@|sM8$Qh^*&vNOPG7a|ut}TL~8w@UDK~qkH#GA@?mW;-VNLXAlP{o3u1@LOBiV zzeK%Ik9c|>+ZUPywPh-26doEh8xtqbF|Xq!l2z@{po6)Md>O4fiGDPu{J+6_?+2{dY89a33J+ldYwVQid?aj5qVA*-cQSuD=;yv?a(L@9sbA-X|LU#XPvO>`T`G1rer~q(2_qf!0P^QeE@pM4 zs66P7Nl@XN06`o(ngYS+Qka#YV)D)RgX&!T#s$p}I-v*03U9uKquz2E$}BC-#P@to z2=2C@eU3mrOkq~63pgB=`OXE=TUi7qx>K{Ku!?Gw3#rVi20f7UG!2iA`}%bp=@rlI zJkSGaGG{>fAW+U#{U;4)JK#E18_jKoHE8K@L4~fVJwtp-9cJk`9mWAc*CAp2G>G^~ zleLU+eYYP~=a^a2w;Rz@S)>?XWr1AEVj<|ZLL51dkGY=2yzleD0G^Ni?$+YhRE&A7k!s`J7K z!EoV7QpxbopP}x!e;(;U<^U{Y7U+bp>Q^y2a-Zw`{8U1WO#E3#Lrs9{H358wgjhsd zRpQS9n&$&YUR6F+WJihL2Q|}32qNSG7Fo8aI^YAEM;?GknZ7CYEg4D`t6Nl;s}CN#Wk5?DK3C^MKJ5^~O#0|d(^sr(zH zS8F%n;cs8dV>hbWF(^aG5p{phD75TMLHdSfnFD$BW`1x$7>AD7F|N+xd0*;Me}_wYFP}xW+53%W1E$=- zr}Zk`Dl``&*|VVHyXS-&Yw->Igi`Ab2g#8BC{Y8nj~vO`j<9C z1)&h64(6v+)ouR85xM5n>}05bBpY`pZs30q!tbb^RsY|P|R^7;N z9uP+B&1$T#_bS}r-+TKN-th0g_ACAJ=1z5|rEh0zS_uSmP-m!qT0WE1DeI%C^Zfjc z{4rav`uiDSu=AohWZTLz{t@&*{gH(8-+Cjj5W@3l4dJrJx0Y%C_E5s_M{nf!3*osh zMb+=v33_0?6Y9#ByZQP5q~QnWu}DmaHeYlmZzX!*16g-V5B#x9!ChqkzpHC(P2HWs z2&-C(vKH&i!@?MHK~rc2i^T4)322+E1D%7nL}J8T4M0-JX2dJW1JLr8LRBA3sh$>E z0g+|kod-bX;@=I>+8&w<7I^hQ)&GG=)h^->or3T091%uz@Rmr(KGQGus?Xpkn)l#p z%Bv0#|7#<{Xb<4txMln%!dPq9MMa$7j^}Kbx3*@NuQq!Xm3$%_Xm<^PAOYt0CHVE; zazSwG$k@Bzl`(Uf=BYz=e}@Ca|H6nc2tXa;%h#I0A2}%N4n@A-Wy9)RTqt2o`AXp$ zC-fkkUrU?MWxb_$>jGYASUnf%%f_eCsov9JR$-9A-&WjERuyG#7YFC3Y- zuZf-&!NhUUp3QbZZ*)Wi+mHs)_POn9{=ta--g#2tbwV(7Nl{^TP}xFnB||VfU+ERI z&WRw7-9RAt)>#qE_CiI220`Sf?5qezosbU`Z651@ikB=A4B9o%>oxG>9LUE*t4sa* zkjO`vW^@VT))8TpN&i&3i8fZJ6WY+uLK`c5Q2nNKp85Rs5#b5_mH6vvR`>QnA?q5w zkOX@(dWG?_^yN)6V})R)_6j3b$Sj`&_SRF(0uDSPQ z50i?;eL|jjRj-xi?HLqCmzHJ9HM^ncyr!8yi05s&RPC<99${2IzDVAcRQ3v^>}DqI z0QkdvJ}D*)Prstc`8~oI>J>(pl)o>J`nbo}4U;uP9#OJaEVAY6JvZ@{F_niGbwV4o zd3oluG>l`FuUlk==0oIwgnk+LQSPaI5(J&M8 zN6#7L^PhAHBXl#1)ORYL^h1;at#e%en`a+S5uXrz2=bOk#fG5ZsM<=7Dnt=W<_^UPLuWatA0SkzeReq zKVR_!8h*ppHQ~OS`Oo^)xxn*;`t#S4pkn8F5j-Y@N6UiL&f2>2rOR}C2_|NX3(q?@Y?V&kf zMbT!`(#>ZNDISsyr1y(Cl zq&ev)xt>`-pb+PQDJ;^eLB9Oko-cGxNWCGgQ^6;namYPsgQ8-7^gq@8gx3Mh`Je}0 zA$q`L+d*5R>P|xLDS=>^s`!xiyM*DlZRd)ZFrKhuF?MaF;gBWrQBGIosk(1bEiG?A z^W@Fx6GpeXN65RnPZ(#_KDWUG#oQ4S#&ID$e?%NsLFC{fX4O-u=-NR!+VvZteoGAW zz|uu;*VJmd2TUvW_8Cltit)G6{Jy`6y`Slc-Yr`7uumG#Lb zu9g%2&Ot>tY(y0P%GL>y4sJiA;?8CqQnb){qpT;`(~9(6NBEj9VH~ynYIWmk@~HUm zzuCT*ZH@b6T>F?$4S83hopsIyb!clzAI#9G52j7}*KR~Ppa(*;AreLYJD*v1bPA($ zxALt?{{08StG_AliSjCcxyY)ddgS4#FosjISD(l4`X1XS{Yd}?`ijb72GH{Iaa>8%D~cb_SN?)XHe{`Awf#~m?({MfJ|?{Dq_hd@ zL@`*MJ2W24r96W%E80c)L8OW6!3t4kbx??CUcG&d6WShfLfh>fvJOK*XEC!n0h-a) z>?{NsCwD`aFggpF)k-11)sFR#+H)^ha2?)qS&|kM&*e zg1X8dLl?(=-WnZ^y9r!e z$E#yB_V!&D^o+lUj_ZbrF}OlF8`pHG8f;zVgmaKg(0R;!O zG!yOGLt2K}rCny0e3ZnOIrTtRr!aowf>g=RUC^AFgmT_ve*G&njNi4;%U4%RIZ;2Y zib6%F<}rQl>S@DI(y-KR0h+_5uvd@!tAfc~ryy%;+422(MNiW3pc9(*Ps-)H;`{xh z9KKfw&szaSYkvU+BWd408^t^vS7&m=c@d%_7lp{WN3IE_; z8di3J-p(d9te!G}@>=#*sPi>k$!iCcjqVFw$cWdh=yq#0X~&TBtWdQO2&OFst)KJz6S_O5mC2M(y%q0R+F!i8|G{6y(T2Tls( z%6n+I|BlzCP7&89&S*r{oQ&Vu&q=t)x#totazU;iTzY%;DLcQ-1$FL)U>!o6HoU_D;jZ!bZ)+Dc#^WpE@wEM;Jws%kO8ZC}So)fWBoCIgAYH(xMuia) zq5!|o2I#G%pPf_Gf5(e*|6|vKRTh^GYiVP2fn5iqL*)ZcMZNcX5ZU^P!sRkNkLz8$ zbk?PO8`azWpD3Snb`UC(9S{utdXd$i3-Vqp8uvHccB#}sGgQ6bfXD_bx`-7f0lZVvMVh(rfU^0*shgy(Q2#i}AO%zOYx%?BE5p-d z|B{cDzd+ht&rag;TxZ<3N+ItBn^8Y{0%6Q%*0fGx)Z6-oA1jM4Ahleur!WF9RBx%PW;yqRDT7xLyb)0h8wc}I4aP_^Q=57>6xdKX`PN*KsD zq}?%aOQba^c^=wvpPm%Pe@E4M4QWsit!I%BQHF0-_qR!>gkj^U4Z@T85Ak!c{rRoQ z{0I1Xrv3ToWc~zxo^5}gIE5pRLRtOlT{K*Va~%`L0bJ`=7D0O$=j*RkcbPsJ1EmKj z>bbL-)fQ9yp17dNH|rWcze5bEDqUszoZs*VYm6W4q>1S#5IO4NiIwS zrOW&-CX8*i-=cH2%DIYtm4oX5E+MtaJWZho6Iei{rAE@%HfIemnh2ya>4q`31J-4z{IsW z)qP|e$}*H+XEee^6*P8g>1Gn>?JiX}tX%_@3nllXc?$pa*H8{u^`T6Y`U>cgos&qd zZ_0C9erm_+<6e!A)Bh^+Ks%0RWID6N0>a}pbsls=Tlj{l-0qbp>*~Dcf*xGUAO-2i zYIQ*y;xkkFS~AV2>^($z*(!69(oI-3iBC8#jMx{L z-miJdG1)&)DoW?l2iG6$7GJP|Du`^F5pKK=9hKyHc(lIEJPqE7nRJ{~gmq4?7t~OKV4-zO? z+NAnCbO>QIj@3~b)dMz1g{S^$s6f4;3?Q%&?pm`GW$v$`qSI49EeB{yOw;mq0p!2g zmtFK1Aq+z(e;e}XE{({#K?jBK1Rbi*<)>?#NBi`>>w-2t9t&EoHCihjjb}Ato~v{= ziUqJ&=K0&Pp>K-h#+mDBI4tb`tS-I%NVi>o%LP4Y3Fk7D0hXn7&NgUD$*`%-~#&sBbK zTUTxKdDHnDUsdro-d{eXU(H7=qYWz zly57ieEXNd!u6I0lX+AlW{v}_+;ya}fyn+CZNSoa--n8pR&@yDS0728q>X@{3Uz6` z5YN&ots-_Q1WU42{lmFJJ%jow98HsF?!d^{nH&8r+09F{^}u^0!no5_G%u9GESx7a zN&erWgC6K55Jn!n^C~^iGI8-d3DYb$zf95(@P=Zr@V)PM2;-avCcgV{hcMP^Fd;M< zrow#Suxj12qTIVDx&U~?jbMod;9r-bYOAm8uxqO?0`B-w80XPeoTTbTAU?`Fgt4uV zS$Y!ia3izICcxA`5C}IEOIwQTKg!`{pVI>aBf@A{#H>~VEf1zJD-6(5_>nOF z`_{Nz_L%)Yq+zs6VsX0D-TcNA_@45I@5cESF$?h`e}CT1@A})k+APomKO7N;CvJ1< zseBsff$2!2H`+Aakjfhh!3w1^%X7Dy6ZO-x6CnS)0PgH2Qqgc)#(K0>yMV*HsoXfK z_C@bg-@}V(e7cP1(@dYH2VVH0@=>>RkJ+^^bqk|pVJWkG<8oZ?`bZd$42yi^5l@Z?L!>|joE5>}*)@*e z5W;gC(rPhS1tY>ZPoQ9zi&5KiR))mxC(wiPq0t~-9Wl4*W- zH4X320sa=^<*6?;;yY(l?`rd*)im4&5dO1W`$P5$`^?%O?~K+~j%Gt7yGZE>GH&Qz zH-Ge~(jC(lGAl$`q!sO+O5i!52U3nJn)p1Gc3q^3LWItTRFVm)r4CrKbXcp{X!9F* zF`a*WL>M~(3dsD$`>Ji)fhifP&)nL0jf$5OYidiqNcEL6-LIBg($L zlc=5x1LcHE{Sw#UVt$=MKFYa{jmlT=cR}5B7xegVb?~$0l&}5I9R7C#&0Vs8wA;){ z(%aFFcKA&f75qUt=Q+iOo;x2l_$X>R>k7(=TUSI_tDBI*tp& z`^i}Cu#jCl?AM2dQHJzV$Rb}kAnmlsmkvl9Puh!XkIVbH2=cl|j|;;AdLXV3#fa(^ z_V@?Fh)!nK+&gG^rwe*~3z_8w85n7-I*-}lM)9V~+SBLm3) z#)s19+Z?yuwx~Qhvr7o0?)X2hC5iS|ycRvmdYtomS(lvTsUEg^`yAO*NX5EdJ*KBHIAwal9u3>H+{HFS-^Y{V-)7+Vnri-xsOh0kY?+-!kV#3z_v({O#`e zZ`1AHyz`x{zWg%Y^PVu`_>TT;TrC<3!IwS|Mr;R* zWCK~DY_kk=P|LLM9X)3BJ=-4q*zO0G0=$w!?MFg*q%R~3q#p|949HqMO4f|zqCM>7 z@wz4m*Y-dCC;+Y5yu`ge@S#D%450aiBPvE2?7p(Z!7MsO#d#42Si1n4wTaB?(J1QZ zmKU_GK(qHJ*1~o>zGHaO&tPs$xUMSwb%*Cvw z;Oj;SQNcvz_d8wChI}dKeP;RIQFQ`j zO==gkjmCqwI(d)GVPY1pyI;tDCdwBO&vV#FR6lCF)-74gEc^|h57{ut=NB@Ie5J&K zg(X(}dz2B`8=x^;2fy@j0r>IzcrOvu0r9hAd3n(l%gc*4fb&+z^4tJCC@D_EgjM0I>EP0QXfo^A{6M))&8uXt#PFW1A4xB)MOXJ+mCla+0Jy44nUi z&;0pQkssAy&j}$sR{^tHfms5QyRV`UJOs&mj%djy0cWia$$J2jYP}Si9S+!=v;1Ju zmG>VkDh1cdQUduTsDG&7Aa4U`weJhz@eyZjIY8i;24;`c!5s4c1_$i*fpbqbIJ?V1 z)gXLF2v5%PXwh~{_Ve3oA+04dtC~PF%K97!>@8p3S+pBuPdE#4Sqg|V)%O?wNBYEl zMOz*BpP+swduc+%n{3Bn&w>h+X{B~AK0LGDWUz+qcc}di1BjF)BkeL7U+N_g9Isn% zwEM4=B!h)Gj?;L~LT2H+xxoBY14?&1Iuy-=rtvODfqiRN*R|#R1|CPzJTjpRE@__gmCJ(?8NQNcFS3?DCELjtMO7*0U zpF7{x%*yp5E}7+XGYi&fTXU9srCiSiW+9E!<>f_7Kh|WAny5zekk)hU-pcHKZOH~j z)3shuvIk|-dN(UV-L~AjbBoUlQvoy+$0!jZ*q2bd9~^pnRSh(HkFMQU_B3e>9}z}~ zf|Xbw56|a7f^W$UP=~m%5D(iy<*N|Ay;}$)yxPk{rGyizw^M++(p5S9kln8#)JZr# z7mI(cq4M)5Lg^7z-yXwTF@xUtd_eW~e6Nb{!Fg965k^%F`0<_4^x<5*`99QtX9_Sp7y`6~f}54nINe;d@&%;O2P1#PTR%EYr(`+NYk#o+E|d{*BHq(P*;>%ICGT$dUv zP4@oKsp`qFSLOFxnf-pL+3&?`lDDZ|B(hGy zZ&lx`Rd#P6+}~8D^zfN>{ukPOb=myPdf>$X-9(f3R8}^)yK@NyNA=8^7wVaeLU7W1 zYQ5bf@fx#fvcHg$o9VdTzyyGB{I@sptl490Ld8+5`cVISVej)SSdFqv^2fStPMmuC z3nNNr_1U)4Thcbd-@P2=V40@qDBic5B$vo@QcX$iQXo?925g#ImVz?UUHi?yE8Z3F zhqV2D<$II$Ho;ws^rqqk-L)YXTtHhmS1=1waW14Wd6$s|sW?}Std~Uhd}Q~9IQOX< zHw4fers=mlSaV@*@Dd<s%#w&sR2{@SK2W%i!`U_G;=1ch7k$3!m-KTP+ko>4A zz78Oe|5<%25$SKL&J*tih&D-UIx;WhoYQ$u#R2`*$jhfb4tuYhy z_E*3C9~ZFK@KHQgF!W&8nAKd3?{MpE7_tLDU5d256JTa>czn!13E|010zOm<{Jl6|viTayA4;YCsqI=@_3Nde zbvMesNjqOscSKJ9s%@ttAJGWv{A3T>w#Y}0omVsy*FBNP>>5$Mn1}3qMOmL1$BH`n zi$Zvu&#*@P{R>2Ie-pIs^~!b$uhld@m*On?`jRl&wnta097D z`T3{!6|YBLjy4SHN@Y~(b&`)A6rP=SJuje0T=Kvh1#ec zd;IdJ!gyHHOuG5Y_l2>adTQ7;Qa;4 zh8pIN%O$-A{3vtur$N^E!FRU<1T~CkkA*Pa1!zW@gmMDs2Y^7xwi(nNgW~mv5Vy(9+6K@Pvtwf3v1_{#o%w&3 z%o@vT!0&RfMx@yV-s&yoBhXmmfZzhct@ zWbOC+4;7tUey9lG(g^@$0!e;nnpdAVU0;4h(N7(~JB9EpyFXe~3S>e_^8ZfD+31{J zv)o&RI%-s&U*Nv`y+zAX!1{Rtjmmwu_oL44=Vh;k6!W(=q-FdKb)HS1s=h6#OG|qQptdH3S+|^1debk?2?O_T^QWS@g+k!?D1J24F^V6M z_&K9dvmQwIF$V-gfNLh^Zpy40AbZ|yhsH7>wN+0;<3Br3<=_}SPb>FHAFYflmG4M> z)GhsC>qkTob;f1;l>WQ^+{LjRkDn8sVvpxymKc&g4rW6Z9@TBU>k?1<8p zWe-n{nu&5SUcW)znK@*<)R64a?lh(TUa0i zW!r&g+kP#?BkFL=Qkg}k0NQN7K)4XTGdA57fgadyX<&9~)Qo9Kb}eR?=>TZj5V}_O)t;#{zXnj3tTTUkPdax1)NPnDnP-!v zl}XRD#tl=}Z^;cK|4Q2PQ_%Lj39jy+dY{}<1xelI-lw)8U->C$wYeaD4W7?}W!pc8 zrESA1Dsyc<>)mJnZ|{PeFBifyBbiywWM=(zonxz9Ur#DWURGxNy7sxC?qHWNLMv1p z<(~bc^`F{cAc?=yA&koXi==Ph5Br6|geVy8&**|W=?iaC@4k`v?yO|~vkqY#v1@!i zw_o*3weQrVKIyh)VOZ8&bIUy0$?u_F;sgil|J_&KX zvglJ=KX@iNp3Bn)Zzc0Cc&nzuo>~U+4faz2J4^@218qG;pH5bKUDN1`**aZ2)Jv@ zHYfU(-e|ld3sU30rFi^5p8Iyyx1)kM^Z?G|1%2A}ptrB-QaX9YLT0tv^R{jV3vKXi zF4&9wp_J(DxW>fdaQsrTZ%o0(Oa^8S|ioZU7ZfwYNqx($F)t2&Km$`sne@+-m zA4|9U+@{sOIj+y`Hkvlt=QdvB{)4@$2KFY`nC{sbr^P#d-8 zL`og7mo2X>(l(GK#O~ehvuoUXH-2%={Q$x2bwtJqRJzpN4xR;l7x2FbSqpQoKI+Rz ztJPEB0{>kiEz2|Lb@ELvW>rsO7QPEFGOLo3t<|Zjo>x@%R4?9NGYQXJx|tYXIdSip z-#0#96@>_Rot#)>y)ipS8b|v)d(^&H9ng9=5(viXf%n&gf9^TC-*wWK z_gvVo6XnWx+g0uhA$kC!qCFeZj?24?^NaWS9I)iP5FXzQSaPOb_HQs__25VNv(An6 zMZ$S1M;7n%oD)W+5G@Bs{ZhL}V``8;j_=JDT?&3&Z)_=WX%}D3EZ4cQI^g5&#?tn& zzHIT{u*Yn>I%eZ2KF%wOM(S|x(YOt}CUu5?S+7jy{%s_(ZcpeM zW`RyQ+VRn|b{!^755&}*buxBh@`bSzXuoH+3nR2Eh4)<$&-1#pj~;eH)BcnquIe1C zeT*)J2xP$$Yo#X7%?%5gHIfU~yDLIPcWWB|@gztM)2vkX9Xvmok{87)36E+X^YybA z#;&M5>p$8x%RT0nVPT{Ji&WJ>MQB6>Lzlyn))k>5mOEI@)7Y9a)DtGD z`>su@pQ%|ktn|35094#JZPA)oQvDVHvZsN9^|271?J`d;BF{b>?GHmG??oQ`o(t-5 zU5`4UX{c`|KUe8!%uy;4H@H9-@o(@L4Y0U&?B3;4wI!th$60C`$y^&+ct zT+gcNPgPHMUlrSg5#c#kPh_km;zu78vX+CdP1VH;36Y=efa_H3 zb-MXK?+OD{&T|v$5Su>{MphQ2MzyTGBj<#{G{}o-(@k72&UrSee%kqZ;=l5&Fgo&} zB6eN`&kl)vUmCM~{i0cpbK52Su1^%+NA-XdyG{jxg0c)|`3N+Jc4>T#5JqSXvqF?K zh8|~DwgY+>qu!gL;$-Dn1?G?Im)$}b*;%l<6(ERbB7UD5zds%8&HGzJY|*g!EEC1w(N795M#h5=z*bBeOkxsP%-SO zpVkU`AVeX8FuQ^IgAT~AUrj2u5!t)NA`a#+o&^=vXfr3PI~M8lMjgflR*MjZI}1{g z7wEgj;_@#ccw#k^Sc#fWC;(5-oZK`B+!4~6h7OF^3!S~ibBV|@+yKN7;@LHpeS zy+ngx7ljr%C$!>s6=f8HuL2ar{S4nYCyc)e;W?N~IYYj62UyYFRMta|Y7X;TL&E6N zGR$}nGW>4ed135A{i2-k6K91H9TEk@>j{t9bqwA*Cycc&X5CGoAU20t9dvs4{+z8_ zyz8cKT?^2R`sZ?hUHrwe}n)#8avC9Gzml0F@oWskYdbt*KkV(+prg zl2Kcf1ReG0aPbCe5$jzKGm{{faLJWq<@Wqu&suvzg7o)#eZPNw|4L@>wb%7o&tSu!YfaB73}&>bJ3)tm+V(4*J2yyJrPmv&!l zX4w09zG4K8OrjaJ^Pxh}AIt*&8KQ^kZcsos95R-}n9z2^2BJ_1>HX#Mm+#(=U}~R&h)L>z%^}r9~{cdY}qg%@5F|-Xl6p29(`;8t>HNi zyNoyb$N*ZW%U$;GqUi4i(CXjqG82tX`D_;OUlTuUx4)SU{J-ov6IwxZ%>Y^>^%?f} z`Oyak&>GM(?cc@G6$5D14Xyr=bf0?%&^k0n_{5viU%4=vH&XLqA^`Teqci%QVYE8t zk&RsxO$nNpd;Z(Q601e-f$0+47$qiOA_M%X+4RmU#z60GvEM-k@fxbDKzw(*{hYbL zpLp;(5x2L*eim_3S#LC@6^r@%ak_qygM#*uXB_L}kHdET;$3kxC3A<0cb5H5>p_95Mdd%TU(^gGQHO|FF46+&he zM=!T!*LMbF%x1-a#GAQfK=>;2Zx2XJ=NaO!H(DnCPLKKqq%L?7t?fz{n~CUo7-&B* z{_syzRj~Bysy7{Af^SMu2q0U_+~*A$*+uN9rB%OC8Lt7?x=1GD*Z(wGRRXTgOU6*o zRJ82te_C4QQ$#KW|7w6R?V(af!v+MU^RTaB!)!#421d{Y#(|T9{}@5Hu*+CWLQ^Ux z$uV1p!`+$Yc ze2p6xgVs66*SMh;U>*HW^K;Ys#tqG?r?aWd+Hl2CI&Ygd`VT{BVY^bD#(%{|wfbT% zaZ*C#xl6p!GW%Iv1AofK{igD}$K-R+z)w0#pXwHOI}NI`?uG%Wr<8!ZvsMAU-sUw+ zrjq^v`$7Qgp4e~eGPZxf?lr7Bsd=KC*RX1;=WZ8pZm;#zr{!Az=`>p7`piw=)Ms9O zKdqA&R!p{o(m5Nqj`QRlF6bgXhUR&Q>}@;e%p@NDx}0zJAZsE1XWxJA1K%2PUZXf_ z))CE49YAYQHre^m);b0)udjh>k~!3dz*TsCGOj|Yt>;Y2vodZwd@3=O8(Fnah01e% zPh)L(|14c6HP&BL1x!eV2 zQ<<@0aEod#7wcOn_}a|VHXog%iP-t?()#Rnnq?%LRs&D8YXZxExZG)`)&Vc;mpH5< zCw(Kyd1rN^(IN6X_|kQ0MbQgS%e`FCj~2~&DL|*8fF1zWvrG788bQced&U3c?1H=latH ztuGsr`bCKNsr@b`@&-?j_Kw=R2knjd>30R9-&fn;MKszs(*++quV3Pr?#yCbeaiT} zS%c0}Q1_*lU*E!@W{CKH%ClxeYBuo2InbS2!1%yp)&}~f7HWo;s?y(_)@0WpTARdu zx+2c=OToQQ;QF1GJn>+^aH0@UE0I>f~TI1-%s`=*$swE#yJ}589k&%I(5qc%z&lO);`XN>Z0N8;}nMt`5idC&@?_w`G8MD>IQ(fR|~V>9L1f~tVNDGLN< z|M^tcOz8u$Nmcg!`7~OjcPG9}y0^UdA>KjnpPuke1!Z6AyTBKNN8ahFuulqMCb+b5a6J=%{JzfAVE$N}c?OyGfK zzABjqJ1@FI%iovim;SB9mj&*hO8m5FUoGUX1Msf9;;#}L@VX56V5CL(USp2P+i(zMLKzzN^&GWno^*3t^+>MmUdKq zYiUPSJvf)OD^OXhulZb626xn{j9)9J_0SP4XCERoU85{``l-uEJ)WWd@rXkJ~&4)hcri&YpT%i zKI|jgi1fYbHs(%2bc)QCE%ds@8g!G6`XlWR8|ZzzEwfWL4@;=vm*2Z>+pHj3$nEdd zw7r-w{ZH-taiVF`zM`7274~3+~a+Au8UdUJTKVx?)ZIk#TkF5w`^S@CUk|(HVyUKK2_AKXFzjA{paZaA0U6->#Ew>CiPW5ezZfZb)mhk1<`;#5BJ;m)IaP) zYjZmH_F4DTaRB{i@5+0c>0ksu>yucne}8_S7H7SY@%d3IV0@3MVvli6i%!y~-Z~>o zB8uD}f^QJ-fxyR+bR6PalXbgL4(Q*1SNdm>F5EA$7rjwMF%BH*J)^taM>b)*W(wY_ z6-0*{9p+%U(;V5Nnyx;X3qaUeeP|iK68gnHagN+8<>g=x*~KCcDd{L=3s#6YH?27O zf9d->xmFBao;fN|hvL@Pu#qL4X7(PgIv&Zzy{ z8{I*4A!NTMber~>z#r+6u~q3g_i2HT+h+>DHQ{3?$5br#kaJLANeMlOelHR{9sJ3F zoP#Bk=0Mtg8G~rWRcSj?8>z;cYHCAbgB6eG20A%_7S=;7q=3JX*6J^Ee$E>~{bd_B zR^V;ZJkA0x{5CbH*nY13gyZ_|XOnWmj_32&6yev>(JL^j_%B>ic9$w?{VFfItWWw^ zo}CxJ&&F>cS!CET262_~&)<`||HyuMU6pb-?Nd$k_=_yoB62Y}z^n!LzCZj6Y^-wu zuU!QjX}%&VtedtMttC^X-!9GP`FkZk(k2lT^s3lfrMAC$su4^dFrFxpzADKrU`Fg1 z^k1kMX6OLpeT{01@J&I9wYqsKryh-F3-VuWuLgu-Y@O|OD5j|f(rW2_SyIc ze?{wD-_sbU_Q-p}n|o#1{9cIxeC8fg-haz+#KgU%Ed#n}9m;GRThZoTw0wEc7WtmM zZ;NLd!N5a`z+#AG8o^BhhYKpG?9920(|*5OonnR_0UoM7-#prb7Or-*FvU0!T9elj z+C0Vd+WjiD|7tyGg_gKXrN}stLflr{oMuOx9#IceB$1y>E~r;Xmf_}vESWe#~syXin?F# zk$WYS$`tQkNxxrno_J4v+0i3on#A+6ED^8te7f8&`TMyZ84q^PE~lxu?D1?X5%}t= zjoT#Z(-d=aPns_lM7Q^%722hVaudf`C*x(;Lvfb*-|vY1-TH&i(F(n$@c#BQ@m2zt zPIE_p+avMT9{jo5Bx#XV`vl&Wq`?Cn{P`z?20rUx6hjF?;Uc0{xW@k z5_O`dI}ttUoJ0;gZ^>pCbSbbc7vc@xTE_UM?~$xwu~Pfaw`>gk!q3(L3pZsNL9!*l zXz>16=2i{w%p^Os!Fw~JXK^oD|JIAvFGYMTn8_00B>>esCgnYsGIO)o6EC%-^9l89 zN(JqSnhAO+(LB+5zXSYtZ_Y56*Jg@5s;PD`4RP+Hh#ZWx*WMTtamSUfs}Sy=qnJrg zvsc*gy=U&^D|;p8Nq-6B_mJ)I0BofB|4_|e_rYgq#qaPB3ZFq2<7=kMy}tSH8VUy(QAm;l#P}y)TLhpB!=TT@1Nf>^$A|cg+)+?rDB- zkm#YD=EDdkXG3hY3gLJbTM==9PWDN^2GPHuX-vwG8HXEbFDVZpb0l)D1`azbtr&nSJgbKmms{+Z~*j_}>>M>{``&HslK^R=158C%ds>=vc z-;6P=EO`mS)E`Gq?TQeh9=J^6hY4(|Ou44#zbEd`qcDoCibLk^FYG~Ur_%@uIrkn~ zssqdhwP0NdKzAvq`+Pag8|Zz=1spV1?Hk5Q>PKM)wN)e9+TvpTpbNU|RL~n#R_%+! z!jc&>zxF*@z&8oHg=!j4lS}vcvt){r?Hj3qi<+F3`D&P(KFbtn8Uj@ zaqcm{Tk5~bdWV@<4t%IwGZPPzF6=Oqw*yaV(<`boU}0h<2%R%2%1aD*>O0j78t5e* z5LV)_u;5ErNV?z0YZ|=L?_b_={Aa(!L<(pH%LI1IqmOytAIC2Dj_Zj994#1?cYWXP zMyrAJ*+#}s3w+ap=t#L{dcinwLATW3GrQ0-?pRUfb3i4v@AwiHQeS?Q0p?nx!7KIE zqH%q-<4%ap@0al^9e1)A>G=W8v8?pbwccoVTE8tGFW)mLv6!SjTQuI!t7UGhO3|k- zwEiY^c5gIgpBvG0y9eva0{c4 z+RqXW@UKxBkE>E|5V7B&E(@uk$5okMSIL2e0SAOHRY2dQ%C%XdLR;w+#!FRbyBDC6 zc(tK^v(Kp>^oSU82ZSFQMUfZ&?lH7{qgYApX8^cA0ogBVE1e(fowLr8CSg$8ewj3X zy*B=ivQ_#?HUPAx<6aK-poiqyRC|6%{{3(at+)byai>mtl0CL}07R}y8rv?AW1Cpl zww}rOHfi5C+h=DRt)n^tze=2;d{>^KkPfnFF5^q0GKTAI1$1#X@ZE3T`+V>1bKy3< zx%Jr|^xRkG6uj+28{7NfA0^F;9LNrtmoH!5wQoCD{iT2R{Mn9sv-9{)8Izd5@lm98 z8DIbN&Ii5kGR6&C&oHJk?z;e5|I&w+k;QmigEnv(!CO9+KF!p>Hrgw;?{i22eWK3Z z01`8fY@JtoB;Q+c60N_|o>Gk9yicW$zxpvagO|c_{F}e@$g{c7X2z{G0^g#$P6Pc3 z7vrA*R7RXe@TyNI`(ImGj8|t!KiB~me1Ix+wgc$YSDzDf|7rB6b&8J>Jv7#U=IKm% zn!U8YVCjoh4Sh03Bi+V@XSGqcnepZ|P#s{LbB}lR z3sGv%-uwKPef(aaRC3>dRM6m`YlfAy2%M$vtKDP2VTfBTUA!wsz~25vdLc-Jl9=O zy4Uu3*Syj6ob}tWihDmni`HV(Db#7KZ+?Q-d_+&Hi&ejz1*ZR%B2(r!%#XJ3mG@F> zy=(>PYeu#aeEE~fYtb}<{^K+^kl$G+e6)>6>I6L%?d!WER3*>Xx3_G!_pqlJa`6rb zr!n_CJk4I()9qU%2Gv+O@P2{E%Q)!~;=G;gl}5$<^_bM{d@k@0F8hAVEgFjzXe<`+ zK)5sm^n+Otj;CWtZ~vwrX5g)J`Mtik)$B$OWH5euw<7SmHjSW#t24ye(7^|kmV>## zYqF)?mAr}cFxbyGLTuJt#*p--TdD07;BJRx&78GY&d^t|Zj zr|fg)+b5qhE5m7??5;SwkHkL?RzNuJtyyv8?~IZ5E`3k(QrtUynq^L`V|6cjdNZzT zq4`%F@*HYMH(Ce15FV&k%{|`hR~Tf=YAjY#41(s8HXi%GbxWUAMPsql0>(=VVd23t z2-j$!6RozdW-mxwCWpBgw9dCxfh8b)UK&-ixJUX1FX}^UC!%K{2n!97WBwwMW5)66 zy@P4FuRSi$j|>QWZ1ki5Q`?6qQw2ReZ=2OK`b$kW>Y}d1g{JUPyt!`h?D>1G>x^DO z;}!nu35VI}Fb@1p>czREc80iKCVkpB8gG+|?u8{#}Lud{{r!c;qc&OYmlsEi+c zTb>y#SDQaS8w)uPj7Nq=-L2z$VUYBuGr1=!CfzkHPWx}be(zky*)#Iaa=Go#cs6Z6 z^yax}``xXlyU=q>xl{N>%{XD(EhNu!Bp&JODuffBW^Vvs*`_pIomGFStt*^e_wFwA zB(;2z3-xcqQf7)AQ^Y4V(A!4QkE>lRy^V@V`w8a&-?`w()k6=Uw`JPQ(k}Ie6~A2>DtsbD~#{pao;-Pxq~Fj%q$Tj8^Y=86S{&yM-O+ zJ$a_xzOM8cm?zqEQu>hmTZN4-wtz@n3Aou1G5eJT@v5TxV3u0rRo)2K%t@NR5#fvIS)F0R75 z8Qo}+{EUbgn^#+OC+yFgE8|6*epMu57k=o3{rCLh*Fma>^zgRLSDB%EL{78VX(jUW zkW2bZlgu+TsHD26KXp@qPn3lr4fG{076UL2G~N-aS`6AUNC7?IgK*0X(937Q!qvJGzJ3Pi2?y+loNt?ObNzkw z06C$pzI6a4AD6CGWd7aTAe>na`h7I_4%n}U6L-3RI^BWjPfMs1|~VmM)cZO-|!AC7YKi<4-veDMGJI9huVJ-*t;;8Vw? zuWy>ZN*mHz$r+V@ZNf81dNUm%+h(NpS!g>@># z?j+q#X$&Uqc14`fv*{dRc3qkgq_MCijloZ-oWlqnomjqga`}XeCGv#UGzRxg7|+BU z?xc&voknn1FIrDh-7eY3^f+sOCg+Ogjppn3C((Lj;@oVN`ax(y97DSO-^n%1r7{f) z=(IjQ`<>6hs!Lvla4Di*nh9o|9oIm6e5p9=6z6pN;i>b@&rhQD3p>xNB4drm*Sv$| zaam*VQE_&mRJ@Pqq50iHbXnRE{4Ld`H3Zku-X2{N}gEO1PkYg_(&yusRnwWPzhh+1U>LD zgnb<-{%&=E9#{+ExC8X->3;*l#+N8CO5WDwxpXG|o&n+b7bt$G@vzeLz`zL3K=f?h zyQFG~3bDlw2seC=df;a=FE_QjRQUcW;iX4V4|K>g)4;0`K5`iKz)KKLsPcE+FzTf? zJ-F>TE(2D*xKHNAT-+tk$rleoxFIQRBo)9NQsg-`%^}hCePihHDMoPk@9aU^e-9l* zy<`F}tRgvU^TU^pq4i3SQwHs z?#boK?R~ZLtbKJ1(bFN%b+(ONP%@~^Wju5R<4+xv@$9!{0uOzMXaHUa0r2z3WbEj6 z7pza?rpb7Oaou#AdoJUKm+^o45UoTWaN}~u6~?&FX#}6@MvHzY8^MHxVm^5st-(<{ z4~*xVd0;--oyJq!J$??AZiCuBYWpPl6mgy<^i0xg(&t7?y3j*?x&7og26V;5_*+_= z%3{b}R1CRP-|gK3lf|E>fXJ6T@%$-?Xc>rpPCO>V2>!SmEv6a4ACVp8GJ-dE%lvZb z^Tsw8tdGzf<-sJp?}!~MzEfqfK&Fh>5;jc9WZQ3(OP=k?d!Id9|2&GGJ}p05Rt4d; ziY+e({U*Gfsw#27KZXGGS>0%n>yU^-J z^c?F#>y*H>l{^D7jo_bX?cRm3N_vu~*$aa(Z8P!eYhYm+$lRU>Cfx__+1hf-*0IyE zl&Z`*^lyk(1hFz5>%U3l#NW~41|wKz-y!FN%$MvbhFr+GFqiC2fQzmia=`xK<&Ku= zU<7B=KDZ2cF&IH{#=2nqjCC8?Z8f_uF&E8cJmoNgsRtpJoDKZGpD>W5=Vw*ll^nmZ<4JDu)OB8?}FMx$5e}i!5cR^3iX54pk z=)O9D9G|Tp>nc03iA~_#;NrybIpQ3?Y^0t&M&#Isk&jJN>X8LqLo!pSIoZmWy)&S{v z4kI|TOZq$fW0$m{sqd8_d}Fqij{H+>=P3GFFIHMqPe1xCL{F1Fwul1$jVkz`1n|>* z4IGuRz>3gyjbLhyY9?vDwZdrP_Yk{<_RE991`~4m>d26#)M=h+-~Uj|yGQpDb5R>VKOHrX4*d@KroTW3mi=8yQ92uY!Mts+rVw=qGmU zeIe-MW$6F;@(!)05OmLlFzd4-@PBe)<}8}ad8AL!cNz#RIO(YC?zm^AWU)fyJ5|<-IyRGmc0?%m<$CNBaos|7*|5lc(i)?>vf@?=N%@@Gbf48G^}&JY*=K*7ptbI;scspQ zze8j8UR*16t%L7FxWQor$yR}!1~2vLpHIpASnAWO$7P>1uOnAXv^LS#xH)EHAJI}hWo50)KPoO9AZ?KSLZe%Jf?0c};OSI5^60O&R zlK!6ZPNr$N|hxdzntLP=ew!V=A{shhcLl91CpqI(>R}o_;p09^+ zQUU!5$eH!T3HfdsfIF@kLC_#pV3#Ky3^W#d>ZJ51e!LT{D*@aQyPVH+QSOOR+oxs> zMLwWj&0X>K9<(X|+(HgzgML30UbW_g%!^324}IHzG4PQI@lFYwUcd=@_3{gI-C!K3 z)-Jj-p-r#&o2^HMR9Q~=h&&8oLjhgTmNS8D&vWi^mj{K&Ul@R@#2%`?i1~!$Kq&(_n?*b1Dn{lmLc>Q_PR7l9JY!lZ5-hA zUAaN@wNe%L7fKrE=VBXQ*9GhSbA{a@Y>`b0=y_lSg>HNCWZkxA%7poufcG1CTw=nI zo=#=f+VhK*F@aoc|+*AE(b|{KYg#m$S$zQ)-!@0Esf9MG=hITf!2M*2cMGn+>!4w9#Wv~ zT=i`l!b$V=z;X0Mb}8nszDA4qn&C8p%_q{y~ir#)8&gsERA?dQJE zGjqrsa_!zpV?(%%;5{eM$~$(ZOwBOr2kmd!QS{TgC_XSD0_LhC_Wc*hx^m$0sbD5b zfTzC=si2eGe?C3_!xP%pK)>NQS|)&dvlF^V9@M^DDrAPByQXR8wMXT5U()z?fthl` z`r1{~%u+B85KaE{1X^jCQ+r>|q;D@jiWce2+w8uF+R>jZVLakAf-f#n&4nk>+L;9= z&EY?vAU-3poaP-tYvLH^9Fe*5i8uP3a=w0Pk0+k6$Fml~n>gw;f8RbK@1?2UD&nK< zU{ZZMb}44M&dZOS!9uvqZcpUUihy}B>5oKniCpt70FgJ!_=03?TA3i)D|5=eN2Y&dt9Pe{qOW$?j4^Q>QbIsKNO{5!8om)sBDq(!f*CIZ|BgQ== z*Zi0NLF?ccdM;1X|A%(pb7YKau`T~Y2ha~rBe>(Zz1|N)c+&?mj|#0hj7YrTdpgmI zTqR?u&b4Qiuf}}_B!79;E%-~%5%ip&j`RDg9DjU+)Y z-R_(59{LZik!MN~mz;O9Rly~(RmOFxOY(&-b*H`7@qOqgo$6FNK5E~D_5Bj{qxN%S zuiV!=mZ)a0rkF2Ipw-61GB-Z$aav>A=R|kEJe;OsPjtoM$uxY=VQDLEPxt?=GxSoI zK%Hor=;N+5ZA9GW6q`1DZ_0g2w7&GXT=UDnmNZ^+NYecGC*=Piolan8&t<%AP~`fM zXPKGuK4sgW^q)&VOWNm~Y0OPQC-Hpq)+5qiE{z+Fqi5xZYs~(Dbb>#)plj35CC1Fz z*fK&lxKk0j!HOZY$R6llB+h>;B8A}J;ez#|y>|=DL_P2iue0-5dZ3bYiR3)srPtVZ z6b~t3r5N;*XCa*Qg8slDT1K92b4--?z5?^BV^W`d6u=$wGEVeRY805ikIUzG4x$yA zCckYx5B&6f-Fcw@bP%mX4)`l&{INU(8AYAyXn7B;mxLMD%^b6tgh>?OF&c8KB=cjQ&M~X!)kveQkp9rd-fNSJ~(0S4ms&=~1-mu9CUR z>aGGFnF4;I|BpM-3cb&GXw2C{-z)cBluPnrMj>0F$#=<`aMfED${J%EM?GL$(c_Df#2`185~Uj?-bH6Xl#GJm&8Xqczj!?T%5ju8@Aw z>q#Fx@0j$d`ii4v9LLJn?D(QhF5vu*P*osX315F6=!shyhnw%8bjF&P$0qq!kPVUu zFy7UURw;n{qw5%dX_wP%vwdUpI%Hg^rvokgLWvD%5Dn~>cXqTE*&Wi4W>K%mX$fy}??LljIyFC99bikmvQhCc z?pqofjJSaJB6`~FGDM#*cF35jLw4Tm?Nsk4!1uP>dEFh1#{t^J`u(8L^c}(7fRnz;7vcnjIC44`0Q2vzFgU zdcrHYMH>fc9_+cS*Q75n+wC-IUqlf-nwGyWp-qqev0bcbtbSF|#{U9s-6n_3qqo=r z-Khtgy`+02Jk8$40LwxE`u7jZxCLWr{ooHy%f5&5z)x%Ozoe^ajMrte*n%E=t}{f8 zj)-IapN_PRJUvR~SIzn%d$pMf;k=bbt{&mZs-v;2&zt5HaPyp>=(R@xTIkuebL) z#&4+0Hj`Rbw5c7fhz6~RPpBVR(e>@rHne5}xC8S++~H0v|4_To16!%yx^}dt0=Q}4 ztZ7F}#2~4l2QG$iLIFKcBF{wvA+C(Rqa6wlq!@6b3FF+NbAVZt_vdrQwBJ0^JFf#P_Nt`w z)vw6+D+GNrPV#x!#_T(ruhePM7WomEWyWpy`!4!f(c0&rJxc{We_=EA0d`RlK3x*kKnpp%vC1(NMY!Jdz2r<*x;naC*mKcjC4 zK;)gIe&{HD5E3huShC$|5>KNw^(}*i^q%-cpi$E1EzOJ%3%V_eeo6dSU=I~VS9VBV z%*vf2o-D9V%A#8~GU0D<%N8bL62H8TapM^omr(aLT6F+!qugo!J|+46kOt9@yJcUE zLG&|iLaYgZKKu#e#21(fZJ`S!eoEj`8C&;{U!(PZ0Nk{X+uG5hZ;9tLkWBeR;H8Q^ zexogO3PfyIhAI3=H6^;0_Q*!5KT8aPqUf59j9+lVUWoOQWV*B@l3Oen(GGHxB0NTo@Fy5#@YiXv$=7}qyZyLt7nC-aydXN+m`#cS$>1iMN11OnfxTc%%Hd9<<9dQg`)-)=NEh+L>qV}WgqB&| zfO7oDd!@cZ^v#~JeH}YdPqb?$->sSL8bni#nn^THbC4i9sn^W=?Y4||^b@_;klryL z_$NuUl3O&BX!u(;4TnTLh@*8t_@7kJhgQq} zQ+qYpk}uKUj+KmW(xBDIkl34sL)O7Eh*qIh?DeP4GYe=B+$r+U$`~;P^u%(;Yc&}+ zwiuLU$q^JZKHO#V+ON=`64)Knqo?g>#+T^tN$ZD+^GxiJ&sVy@pP0}1{YkX$8AFd@ zuxbN9>Z~D`NxDU17ULZYfOE}Z*0;<4(;Dtfq1CZ~agxW0*}xkz8GkkXOmjy&ZkNwq zOi6y5c#-yIwwZVaIIVMH0q|#%Xr;92Q6_wkv#Y5s4U7YSqWKrGoW;>Gd(U><&Nx$` zlIngTCGj1%rKDf>pHmXU?Aa7rEwm>DE~X>eNcMKKoLkb}z6;<^&9-w{h<>U955;}b zra1@r69?s8EbV)Vg)@B|d-Jbp-Yf77r`z$S62s+hc0c1P$h+<@7>6-zBYriGZ90nL zZYy0cefRR$XXKy6`aDzT>*+d&QH=X;d)z;_$9-1{t>4o=pW`%Bn!^+_r(F~Ke3wnP zk$2HQwA*EJTSuu&p*8%BT*JC-#uuc}`cmjdMNyJN?V2~bb|dw1dh~s}eM4XXO^?zZ zR%vYY8RntGlFt**$7hsS?HGDKy^e9PWx|&oXe}5;k5|MRc%$bfMP1Rr7Z6smL4S2z zKQ4}T**dturo1CmrDy`P%OqWzbXt-Rq&p30`O$uDdQ|4w&yT)x3a#FRl>5}bi(ixH zEZ=%f;>}Y(B2yWUtI+zSP4hX#vqW63CwjoPxv75Afu71@L-7&RsU2~bFWQ+No%Wiv zQ!aQ-V(UDYK&yQeJ+HVJzdsuUulvOAhtQcEjQd>BMtW^pKdOq!HJh1|xILdGq)hPH z`ZB2CpE_W#nF4<1GJ?AgqXnAu=Xutqll)W~i%8a87DMX`6@=aUbONnU(atCAmU6o& zlZkv#kFFI~;`_MEYF~$2MgO;|j;NA_wDpQQpsTys#ylkZrE;rp=i`BC)TUnXN%mM6qrLM*Wicygr@3tS@o zYyv(AA0eIC4dLsFZz`ZG3RH^N*h~m#Dl)fn$vbEzb^~_+xD_9*rOWIm9jIN_|L`b! zR3Dg0&1EhIMPP0%2KP9&mdG_q|HozS)_O!eov)GQFz(BdzUed$;w$fP)NdZmNEaiyeGY%w9$@}~FlM?G@ zBJU&{Qpjx${8ImMN1ty$!=s1id|%+tl_b$Bn^(iVU>qo&UnAn@Yc$Xq7zZAH8!h^_ z2%wtemaja^Je3rF4biTo^o1t9dT0RnFGi&8w0KPFjXOza&u0AKLAlS1fXUce6Sk6V@zO!LH;7lFEwdv3jeg&R z`4ur9_MWZ-5PN!)0BOPn$L9~81 zd`9P6YU?R+)3$r+GtBGkwep$hCp$Az<}?=^L@V+d7;XL9||X0k5HQh;5-E#u@!B%QCM!DD$?=Jt%!}dKa;lbNQ!%E%)u1xI zq(H{FhYc3TKdCUd-M7`uH!v))jmx(ybZS(lV*af1ecMv^!EAJj` zvhg2o{E6C>)bd2WxLxB|i}}&HFU$MR|9=<+5El4UBESBh-a@Ov1^az-fs3*9dCi{V zXRsT8pG0e>0+pigeK*A7P&mu5b1(bs+{>$Xr2WfxZEdstCeoO;kDtN+te|$&I0Fy9 zg%->M{)7v*iF&RmGXHiQt*aa7@mWsj`hyGh5Bz75*>>PEGtXfJQ{%b+3M$%TG9L6j z4fK+PBJfV0C7#J56okHrVmVD=bO(Z6>*o5UOTa#4){kH zLA_+X5+BjBCH1ZCraeU|ie&=(LtY8*^I@Hv=zSHBaJ{ z2BiOYN^_d2by^GA9jS|fr(8yEY7xXz7Z|yzn;@2ImwBsG^@_x*fb;<~((!#N=nW25z1;;1 z|H}a)M^vB{!p0Qo0~2@^!aFlTk2pvdE{fJFMo@bZtwXaJX8`Vru}*IboPZ*s&r-Ro zmBFh9cc3*>gKR3l$&O=W=Yc+?D_!4-sFHdm%Yf?uWnZMo%6X2jX`uuQEola;KWNj{3R;i~}9BfVb>G zt7DdkGd9WA4}lSEn8K?6YYLdlv*O;Xhj5n9o}bbI)aPWtLe(&WrC9Wbrb0pZ)G zeB^C>IKQY)V6H&L$lmg*S_gz-i1hfpWx`jN=6;*>yL(E`d9Lu^)0F6Eh@R~*cvY|F zt)O=_Pk*rE_Bx1O2GDOjAozv2r#+(Ca{3b6=Z=1VJdfYwg!LcalWEd;3qfLrrtVl? zMfT%z7non~KQp&ZlPC6T%f==aff_6CiAxcPw?lQ z$^3chZo!|||2_VEs%`QZdKW#@@~EAoF^x%hP9Kw}<$P}#lf16_C4r+Ru`HhcCYHrV zZD(lh{v-MvMckW4Nll!I;Gqkeo^XQ z32Y8d_Zh+JJj0t%86Vd2qBpmql`PlHi*}IhO?s13kthZ~IE@2YZ%8Z)sw?jew4N*j zvpNG7dIcV}&_DOXmsbni=0v?}7J_l0fb9EO_PgU(i!;*pjO$u<`3%xSqNyp7pYOU+ z%5|Rxl_@(fOJX+TzeKbW3m7k@eqS-$d@3&dj9L>~LG(Xk@*UN$6tn6EfJ!I^^TZzM z%UGQO;hiI>Q@d0jth(AUq3b1Fqx<8O7Z>AmrI2H zwfGY*#yfwkHue5kZ94j6wJA{#JX9v~49dL79hKr7Iz;yDBH*D4FcUWc4_yi7@~gp2 zEXZyFk8$8Pd(bj8;D;74E_}AqebJ#x!zts%!0cC5n7kdKxPau7Z|>tCW^M+j)`5 zhOX;J|LQ9t)|?IZHy1(m(}rL9EV>QBJJW zT9Wf2c6^77uZ}3tmMjrA?S8Ta;M3XWy*tHyNQ}YYtQ%gM82c=3vP3!K?i|LO0NQ8{ zXq*(PF`VsQ=pG}baFtf#WIdZwv4 z{w^V&4_Epwf!KJx9oLvD*=_=(;u>?-8}f{T>Q(@P)Lz*hv})`) zyv5sPP8j;0WN?`i_Sc54HL0y<+hp8`&{r0)m~sikj`c|UP0*10QuFG##NFs!^gQVS z>+Sqf6+T52Y~|Tb*uQf4dm;}m$$y&r)V)%+R^~8XDQ$ZxzwbQ@vwaHa zxE(FSEAAKkO{%=#f7Hb|*$B;Eh%HBK4dt>}33!(^*jS%`$YOkT7KnTMl$Iy3d=)Tq zNjClv1)q!6yX2jFLl)z|$YrsVmR}JXAw3hq$1*^FlIm9F9sAxFL~ikl4lQ5gpBUJp znAJ|$U%mWVQ^_GcX1chmx$Omcx1(NR1WP|Pf|W1IoV5vUa2B;kbhczFkS)JyyWqJo>Z^^PD$blPwfoy{)7o?5&M!Zj_D9OxBk$|`ZNIHk+oitp+ZQEv zj4bPk3i@z=&wL`D#-S~!&}_S$zB|+^b1{SlQGfCxi0wT4ykwj={Z-oPbFw~2*tuq& zaKZX-t(N|}rOPE9JQV_gpR|R6*{@BHPSUOBN&j6%F@l=_Vq*X40dvz7;3>^Xd#)w=M1b;~SpXRP0*;_?*e4+@SS$hA^ZQ|^|LYcB_gU?Vm8Y;|> zy&%7x*CutMo?*0TT*-3PgeikbsKn*K#q;His}6aN8UfH12XHIH2;Mt}mImM+ zaLG8}tDUg_M-R>x_nAd?BG+>?Wa}t;lh~|t~NP~57yrw#$L8Xyp|DIA)O}eu&)&Bjnn(7FE-|*VM<1!DP zk!%0{l2u0(s9cgE^PJS>vDoGjv_g5r;~;##0y@2;`KSKEC8~MlFj^}$#=k)H>_pU8 zw z_53_qQoqWJ9&fYbbhW(b8{5%Zp$^VUmOF@cD-OMYRzw+`l`N@=CCY1rt>aU`pKNB_ z=P_bLi?k0CMKv*);?6DcG2yRI-(Ix?EgDOF2>l-u?Rg+(`$CBG=W;NDAC8LL9I?|P zcl~QEi43Kst5w=wzX8zG@@~y*wC6#;ZReSs{E2MFUn^6aQrV1`YDSQ`8DD&hb#l&`Vr)E`@^Vecx4^mj8Jk@6({- zUX{hJxj}7;15`G06S+a-Aq{olO{t>#<^M^w<8%ODI6i7j~XcC@Z?!nT{7u-}^jTeHSy{x{Y`-R7gA69fcd6rhAvvFq7_s`>^Zu(O~mh1sP_Kdzf=AWx23Tn^P+Q6>hshF)m3Y^v4Ql$i{;&gv@x9K zZ(l>}{~~&ps50l#$`{a*n3e8|k>^FuD6uzU`aZ?*w+YmhyF{R}l+52MeG`e8@ zZF3oKtg4BvwsUlruF@7kW>Icw=0&+w7ZlcJQ`yy-^31pKnwl8Q*zIk+jm0$IZm%)7 zCRRHm?lo4iSgkMaHCRn-38>kn^z1GcEA_>_43uo*PmDn}_>}D9h@LerSYJDr@!G1I z*y0?CySo)c9%+fAl_~!!0QZ-!%2}jjLbVFuRsgDHj&`_zO!%%qYy{CWc0tMDQBA8j zqCv%BO{qAhsTG@wA$M0Xb^{%;$zfo8di&xde_5kCDRym8{mr(R4 zfOQ5q*UeQj=O;C-;uAz`XH`vXtpmaU%DR6?)DJsgT0qHI<{U#keP?jOuD5s5|FmS= zn3Z?`W6h=id2Q{bV|lH*f(0<6;%ZC$3Ku1jcIG^x2N zo)vVIDgJMvx~gkphaC{EXQk^hYf9I>F^2k*={2!XK8xLc9*fT)l?;amjb?y&8 zd+(V^Ou{9}Boij+%mj|$NL65R18PqP z=eC~b`dE@$c-A`MDi3FDc{wKb9cypBu;JKb4^dTP3JFr)2og zD---rPYFmRisp9%(Y-+PJTbnq0aXADdYV3f4u`TgAQ1-IrUxl<`yY)^JK{Si(>PCqS*ZP zOyCWCwH6msCcR(ffPqi?fu8A4r9R8Q+TTBsUVqybaUSAPxZeD{{y5*;1?%lgE7m*m zE7r?P_pJ7M3epr&vd9eZ>`0?lva0z4Kmwej|Vx%+O5PG zNeA!jxIyiC?^qJs7+SIySpLi9 z4tif7&`Qadr)_AI9zkv+En&_v*id{BS8T!*=LAZiAN9 zcIfckA=A5w8brPGzDhZgSC94!=%v3;rQ6e@D~I}J>H=`~E)%-qW3LMN5QRh$UgKkl zIq0>&WLmt2n61}~IDE9x_<#4N()F)0ZPnX>W;G2AWUdm+vgXuCOn52f^RV!%qTROtn4oEOmPDo4qrnTunN}WqG+4cdV+Z*Mjx(+5hr}pT zq0TEqC{+>|aY=q&<`sA`Wkh^(x<8mgkG>}I;_!Vx5qTv30_0mOhylEYmQ-1Ft7KF? zObq_LLNcnFxO}S&e_JxbKO_cBhD=zmEDg_*jBt<`1fVdym>5;=a^sBR^xHx0LH)7< zUf?#C>9N6!jbM%EwG?{xRi;&cpBTL|WZgTb+^BJv8@=^lRNYOCiuJa9 zU#gNXfz(_jbBs&B`jVCFh4x%M>f{hW8X`?kfZF5hPN7kxtNTkFR-Y{NuwDrYV@DR6 zdBAO;?%$(rRh&wP6qkNko=D3T*E?l4ftOe1w$|}yDfC~tyi(ix!3g~BM%d~%rO#8BBD&mzV>+qtO zXHN#yNkc3Yf07uUA*Jr%6&4!&{EizgJ6!2^H;}E|ru-Gt(C!Q0M2za|iBa`!VmMPj za7P@@bSF3~TOCjrz6L_`K}v5;L%HCpTm?<;$)E;TL853#aaN)Y*(W>Gmw{A!8$hTS zoRw9e2JiI~15%H>s}_rz8EOiInm|hTq(WT<fG`Mz(km#|eMAgK5hYI9v5O z3#rPa8-IjyAO$kf*2guU25NA*Ow7NP@f^easyXFG<3?QfQgf;V&C4WL?c*aX~2%J*w9A(-?Mb>c-v4vp%2>ERd^7cd#-|JJ;=o_zy-2d_vHF$+J1}7d7 z=UY*LPL7WTP+IOGCFK$n#%qwj=X30sIWIDe$f6zm4G*NzpT1)GLS?n*?iY9ss7?u7 z@A#%1cdt_<|Nk=PiWC4XwnKM9aq5G=Nu#Bp26LYziAz^lSM0If!A8b9ARb-mi%+8^ zcIcK*GVPHxSd#Zf8pZXz%>ga(cVLZ|-DapbrcDx+LCwN-+t?v&`L`t=bI<}r)DrSc zggSMEaXeFeuJ=w+mm!JE7*B&x^!@!I=_2PW42ScVX+CtG*? zQuyxrmZ=7>lTkyA^GdFMdA>{^IDz*A_l3-mAQauWko&iymstpD{4YnChJ5rF8yA`b zXkVp~H3fFyIZHTyO#nqoZB@y9fPmtJ64c)+)=Nvv2z=pVEX4h5#l)bFV0P60wL(Aq>Hwv5*D4{hKKzkLp4zPLq{Rf#AT_JeTr?}1?#E8S{ zqCp2NVKUVH_7V$K$;7~SyX6I@VIN2bAAwAii}fdb&A(yHrCNPmR#Mu-6+mHP>-PA3 zFynhAy6ql0@<0DD{_Y*Vw!;n>kQP{ZT^AM`1wf1`dBjkqk|Lbv29RqNl;hKh2_ID_ ze2>n*0b zg8Quv62*kKTb1B#+8`6#;&DP3q`H_4AXE~!Cl4p?4(x(hVlUS zfgNi{zH)(y*vy?Lm}XtmKee9kQ?m8*>yGc|?M$`$`oTErv%!)N4+z}l3l_bRKXI(r zV7Y zxe?w-%sl{s<8K!a%mN!^R;NjZ^CREUhyybFEIOZG z`iu5tod@Kf54(whJoLB&GLtq3%JcYpTY``sU5RV#(QF8xlt_iwy#KMUetn zqUJ*8BR?!RkRKp#efl+~FNiawG6l|t0YZZgf#2Nw zT`*7Lc)v?bQ;~GERdDXEC^>pV8po^247WenmQ% z>r&wTau0AioWT7vxY&U4q=?*EZa^v&;##S&0d1A#+8ZV7*>o`RnPbxh-XA~zOb3%J zlMHerF(s)nSdmYRb3c?L;eB&Ka5P`q#I>VibMho7q& zWLY^sAMn{Av)ltlc|I{>W7f-KX%JeL4<^z8-(MdGA(6Lg$swe_h+FKzIf*N|{#(R( zQWi;(jDLm=%-5eJ-aVXPfn|3}2GZ}?RH*A6WT6T#(29W#TVw!dk|xawHcFFe08VTp zJhHIp*aM=bCAJkGW`SrjM)CsGEgEK_zJ|sg8IGTm;mkQQHMTt}K`}`uCiV%uZKyqP zQM65x^aiLy9qieOs(T!O^H`_E>yx7WkN=Z9C1VL=u2z&U=NYGg51={ud|b)b?M^6Z zNP$w^AKzxo^~ea*P{x<1lp7?yoaA3aydHB{24hgj z2VS2+v_lNvN8yBzKO@z~h8WstT$Y_25m-X_p5umC=**ODolFDy2^K#YPs zVodQ8V}V>! zsz7-LN;p6yj^0m<>WyS;cp)5ZRr1fa1BAkg+}x_b z*%MaYT@%Nrmzx_DI4g9K$vl7X&pOkh#e)CzDLMY0f0rZq9~CB|#k@{iCXV5^_$;5} z+}gdU)16#)G>V;`%k{WYu57TqBX=gjpLs9 zlsj4jMzXyclZCFx`OR(j6JvFXpbxI4wglt#)&9qd30VJv7^mt76Wc;tT$RDVx!j%x z=2LDka6VgulCkF>#E-TdVA?SS==r7P?HBK3~(~w6>jTP1S_gBf&M>c%P-mwWQN~+nKf*b$!L=pEWGbF0kFE0%G7^ zi`q(xwq8g0SxbW~*Vb=oa`!5VzfZ~b^EN(6r%T(J_H)Lx#IRI z&V}z+ZPA+R(Cag3YCCiJ?9kzxoI%Ao^zr?CjAt^a)GmGt{@KO(rwnTFt2{K9`wW!! zVmovsdFhqKS(NkBJ4eriJHR`Rezsre@wi6#wW;YeS_WpcjF@X3FmP()hEx6fnMMW| z8&N5*NWGqzjW-b!me(gdAf1IY2qkT#=#wDUO~yFd_9QVr+|M+Af3V!hUS6M2uO~*; z1Rgt?*^6VI2h>!ub$D?7mbUp|A|H=0&Y~9;pvcRkbHVf~q?DvUVO*J{_Z~{(y-e1B zx}RxB?Jy9nk!jwO1+>%-9g{)rK|6szw{RRq-nnMjtrHv^`sIYhMPo zvx@;j@l*)3D)2>{9R_?)6wp2;NB674)^9z`wCH>;Q)y#?;Gt!Z zTYKUX3n6U^Qq`ab@^eg>?A44owkG<$2qC6Hi&GG+4F&5GRomJFdX#dfxz=c@>M>?;Nn z_tU;&)XVeqA$~5F&*Q;Xk()~ux%oN9TziID$fHa? z`ya!M%PQpaNSkM6xp_0lmHkSNE-5>=KlqBspT)L@lu7#FA*Mx_5_2l3!7dq^>t$%( zW9ciVHP3h9dp@{+OI~FP#d*d#4$Fkcy`X%V)y}js1!z0U#Kl=W=klS0!Uh2eI@in4 z99|JFiH@)Uw>i1o%+u%X$9wYm8TNM$F>Q(+T54X; zACT)%4pqN-Z^@n&z7lZ;24~wwSm@XaUrD_zHG4U>V2+M^Zt8x4>BUC)KH+&0d+z+Y zT>C@&Ka*>tK8@}w+_MXa>En6|F{Z(!tSYIbNLs&Pt5<@+{OQEJcX?I9=Y{ucmRBV< z$Ce$fK^+g2+NcDf1$k&|sKIY}iO~vBTfyr^*=rv~eSIo1=g%Ofa+fcGHppemr+~8i zwr3W!pZqACz&TkSTXuBHzxfg#u+=V?Ahb||fU=%!eQR}1;)dhPj(VhPYTE!pHK?B} ziXZzfU|gTi#J+ADVxjm5*C%=YFXxMXQQIggK_{;n;U^~C#q(z~Q3v^dhxi!;xACzp z{Qo}=F|EN5X1swM36BReTtrONnN=A&@f~k8L|o7#hOmLqzHAs#+QVx_EK~T0l94&Y zwD8^Kh6)hib>NoYL|=aX%lz2ANCVX2-@K0Y9A%n?gPHYr)a7yf>yEY0UO>#M`>fj7 z$djuDZjDdq5H0Y;IEsAt_!Z_txfHizp$I@g1}PoKU40)Ih4_y55u<7j*O`}~p5JBl ziO=I6=k3MD(a)^@YaGzc^8ptSv&Qms&6i4wQ1AAABy?^7Dg7@)OgnvrX%mKpuFdmW zK~DFAi02yHR)N)4IS^xtR8mwiotWhxRq?jG0F|ePc&Y_6ZP(4KeL9Kkwms0l!xUFfJzPyYyG>fdxVa;QBbO zKmgm$j<&khv~r_ChT3<8Ud!#39|MH8IwWJq6{g|;Q3(QgPbEMo+XhS2jeL#N)$eI_ zOIEF`t+HgmNA*W>zTdZGH`1Bw1h(;X>6NSHc@?ki`AWObicc=IL(5=|+}>3%jt)+d zsJTvQ_X08FH;Y(Jd=Ff2tP%`dEAbt$=HZnNTIC={?@}=02VhOuL5w~nmtzW)f*Snk zL8iTTna7C*lD3%nMytDeJTXo{qPVJn7-%cSQQo9NX4>;i%Ql!6u3lJ*Hf;#hU__o& znfP64b7UjgD&lnVbQ#pF_jIOJ`H4}bKp|l)fPGh0r_cgWv#wN%Ga%G)%aijr*1rG{ zT5yGFe;Q%hDaKs?GR(BkF7q>fk&Pwe;CR}4S>R_P4Y+P!M9kcSOjG9|4<_c;A~3T- z)W1__iM+$7M)~zGNBx}PjfB^EOF782hK<1evJJ9iG^9zKpN1=J6z#Q!pkzGkfbQDM zOzX9)!Puq6h6n1-#Z!3xfcyTV;tajTdY_Bd`+RXgoM9z>xl4zc>%^tS2Fi47yJEd< zX$5$)X5KBtIL>fT;&q$u$Mu_5ZiMA>?*Dij z<@-ir&i^QUv|1)c1IV@GBnTb9wAk=TtBaFk!uzq!(<4dWio|o8h0jG2aiB|IZeL~P z{$J$rArh~5@(<%t7FzKr-&A{UeA$ZabU=6Z0x)?#=+F!rzDeLPOQ2>|jRzxqAD3l4 zVKf#Oxh&2J4j|^rPp6{_%z`Y<#Y79$;GF3M>BeXgp&s&+WY0C;QfZHCJ{*Dl7>X zfDwCacd(bS0e)_IOA7t)Ri^#ny)FEjs;EKVEq3~Sw8ILB@v;pD2K#2xB7AonWV*AX zD`8;6ss9h@cRiSUhnW`pMJCVLT<<5w4@Aw!tmuf~NglAxl#`9CN#CR@K}z|3$8ud_T;O@UD3b&%y9lgGbkkcE2trP4B!Y4O<{qtt(; zU!wCs?YZSyrl~2Ac}bb1+NU-(kJ9^xRi|e__SwAb)&fm}xIF=1QJj zg=H}2o5D|l_aqo|O}WBt(H2-gfu@*Di-8(UAHnsXKWl7#?@uKNRc$0jSqapY1B4nj zf`PyL6v>bFLCtu%Ijn-g>p5=5|G@b03e&Wt?)%IH`guas)8fBBoj}hfn5If<@bh8e zM}0rRw6Jn@o#N>uEEL{IjA~itw%wG04X5TWuQ}QP`L)MUXaAkA8Q+C$CdM7ZOv8IU zB~a%ZVxjOkVl*gF8@s}UK0kRP{TTIL?oX3y(eAyF9M2sS=^F_VFY?D>A&r4MCNv}1aU!IbY>pFm!)GX*k_Jtu6PUSU7i{%u5@@0aekXgqZSJ)97D zdee2L-675yI4``M9LJmEDe7Ajt}ty8{(ot)0jnowMK7fp<42e_ALm;x=ktC2Fw@Gu z{Jmr-c|T;%!uQ&cU|Q6!1~>dd$myqsndV7IbzTKRGtM)C1tUY~-E%DDxm}!ZKY-s$ z1lCUmes@Z|&YUM8)ir*>LZW?75XbZAXn)rQzw8@==IHmy!AqmxC-G;#ImEQJqt~wG z*RGhtmUvhu#(Fm~K9(nQ`?khU%-F^ar*NP5)`GDPpgFueocM7&(|T)(5e4YtxeDti z(z_B&8yXSyww(!4-#PpsS9foVcx>>-%CXB$NJ$`^ z8D_=mx^)S>|JHV{}>9?h`sTuF)zvb|y4|EMN?NL#eC2QEK8-To{ z^?#(gj5k@R^`}x@h7Cfk*GU`$>47&`sC5MDP(Ebf_sgQ*QtLU9-_d#r>d0?csP$J+ z7qvs^vtP4N>(ip{))V->Nnn)E!0$x@NBP~?S*Ue9%#2D9YE6Tg<*(y@&i79lVwz`! zxgw8COIoX;?$MJhbm8t*oTmr&2bxvca~kh+3^6TdMC64dU9v`)>uuz}mS6gIq|J52 zSl0mgYKFjL38%;07p*-VRv`TwLrk-cT+IhEhMC5OzufCrxW20M_=VLDXz4pIQK+ zg=Rje#=7$xPDNL&ONjUd(D|BuH;XP8`7wG^Kn?otQiG4|M}EqE<{hK9=mJr9P2@H? zb#P|W5s?q&Kfjl0*ms`-e%}wW`8iA9vmyrN_5CQDBEc%gx*tZHH9n0t8iKFIMy@e% zJmucT;K5D{TkM)d@#PvDtpGKMwv<_;(B}O~{m`xVOFZw)|Kv+di#HJCSGUU%5rgQ~ ztDa|C*NSzCK90|r?Jq|g2m5zG;jR0a7EXo2Kc1ULFHe!_mCq#}fA;anHOBWq4W4fX zBc3mRxGso2l7=p`0tv_psQ;4Snos0W5eeQ7=g#*D39}b{H5`BpL={#-|DY z(CME#X`Zxy}4C*Av^SkD4yFV8RP zJLULqMg3WVfVb?+=Twfxl+Eh^s(YBGjweRF4C$XR=E8B~c;nNESp`?ekQVMs+RtNa zL;l)2KYFztpB+|!)>vmpxMwfkgYPT*XWL-OU_O|=9&vV#?;Ew=SLM0!LeHH)4`{s% z{+b8ZZ>e`cCaan9&Y*&J7|=gG%e0T>?Aj?P!>w^fzcNm=H`DhqttpEbJSQF0pskZ> zT>ycm+%K>3oc}ChoR%T|EMu;#eC_$f9A5Y9q>sJj{L&ZO&nwa>#@H$gd+cj?J{IOc zxgENFX9BeMyI{8A`rKSXdzXTVYpC&7!sEVt6G>@Vi&V#XqRmCi(;?Ka$ogMS%Ct|B z^kj~SFHhh_-sTf|7#v^fR${`zg=WD-QVO6NxdR(cg~vnlGHY(Z#`8Bi<4eJeFXg!D zrOP@64zg?`rPUGylKuM@p?qj{-}@5Nu-)YKURSI85Yp&YVh&AFXmag@S3I2PO=)%e zR(qD-`4YFU{l4g9!9HcOF4;O(?&(5WrxwMPJbyK)Jym-i3-0O?c^BOF4GK&@Y&Y4a z&jz6n6>m}ePI1q#f^y`P4C%e6(C*LW=UaGxeN*e*$!FSR2t6fFFB-hZ!X6oNQk>h@ zpXGJJ0zwYBbeNn&k3GwCBLW$RnC81((DS!mIdYJ3{Ijh8wLb6RIJO)^*@%zYUAZe_ z$=ubF9QsxV)8>N8^-r^w7;$Bie&h(+gr5fzV|o*MI30F|dCZs9PYGLvatp z=Yx5A%T{-ij?0wX+UoHlZvD*fi2<%wcl;+{fYR!YH-n)H8*)XJ452fMjrY45+*ZFf z|CuMjIA!&XZJv3O7)e@t?IOp$S8@ASwc#Fg*Itv3JjBg&K(USQzQnZN*#a*;-b{>d zy)0__#IAwPG6l{aazJS8oJ)3IlXCzj`zgwbvHvwDSg0XI)K7jyc2zD_T+3_KkVp zpAh5h5wTZB-$8=VLlP7<;@;?&sU#m=iFCUBDj5IO$+X_N#Kh5?)!};N>*tBT+4Ilh|KA(+E2F$Z z8O{0D69x3*I;mau$`Ry)$aAtmHMWk=ZVuR?CG!8g9B&G3l(Bwyq|qHmn0D_^NupnI z>Ks$9vMGrC>-tWCJ9^)9q9)bI1WzKaNc!x>a)jpzA7L8a-&oKXe6mxV4dIx@_WR$WLbQB(wKQ2jYc5XQPjvI&oS#CK1||5jLe%X^LpAHO_` zk&^A-bwpt9C4bxYCUNz%{iV+_t#FtX3p`3mM>+Nv;WuwNzx1Vcu;fF)M!x3H<(M@0 z3;FN?KxbhpF=IApc?zJ@XJJ#HIlwgOBPYk`-m=fCF_{Vhlo5E%_nM17v5(i>52OJ& zllT5?ACFtU>b|CZ+&A#$wN4k^fcFit!Via7=l4Mk-UW?81;F_7UY-{J9gOrm*q=$>SUfxPEkbX=5arCW1pJRjeKWB7LalxMcX zs!7xlMScD&*JG0?L`4qG_Gd+2&NI(4?FH1`%ZPbpp};Ttd@nx>;5AZmUKD)&L&jW^ z9lG&c9#IXgHZ2fn8 znC9hYdD;5M`}q9Phyya~WoRC-_)?ND>^Lg;km#?oeW?QmaQ`RqGXCM&%`##C;@(3# z`F?Oc?YPduZ8*Hpd{|bE*trd-o*tjueB2@Or@G|)Sx-5q7jIn=PLx9<$1nN0Q|zU< zoG4D5l<4tIj|cmdJbhy;(_)#4;_rdCh;0G`*V!vJ=s2(B>ZJ#~^zN5t(MKG_d|867 zKI`0~chlp+2V0p2nF+CfI^DDZz={3*`yr-zC#k_Z_A%{>OiEF&X;>%K4d!awQIC3# z;TjOnalLBZWIB9^X%c}YWqDASDnqC$jhJl!U2&Ur&w3B{Ibu7gm)BPS_51+p7F}VX z^2%^YHNeF3M}5s+@SLtM0E+iXjD@5;SW-3>>i#Biy-T#EPNrvgeJf(fj;1Uh$Z5Ts zz-Y5Ux9`($Qr}16)wo{)B)9G;G=5O{IW`IZU^iss(<@fa^2U8k z``CfJRSh1KVMSPm5b~P5173=2&0C+(F_KQn#C$movXbkyFPq~s)!~{w^Gf;JC_nSa z)_;AFX|bP^ggU~ymL_pamR*fo63cG9o6d&v$h zPCInh|Ga=k&gIj~xP}}}K}l{35(UycAk~ub5PCp@kjF;q!V@5rf!||LMi154uMN8Iu|vn2PrpgmrA(oJ1hvPzZvAT1#p9B=w-F$uPJ<;L zC)C}>^Y{h-f8Ba7Tw|IYItKM|yk5-K-Avn=0e^(fn+yW-7!9wQj9Ck8ps0%sIiN4oS)5Hy-?hmH$27^r{l z8#MC6Nfh3_mOivw=-Nm}y!VqQxn0tY{YLE2!D*X105dv@4GoRQ8z62(z|z~eqFw%5#=f5Pq$+8*t zrO-L8OgnFb0X}!z$I*y;GNs9NoOdlv@Y?7w0E_bJ!rh_K9yQgujA6(LZ0N zeN$xmHQDi9D@TFH68mU;A(%WC?M;Pp{&41c%5%1q96kS9ITBxpHhxDI$`u@Ay-bWR z{#D2gaeha(=D)zS-b!Mkomv2-w4y~4`ObGh-KPK{FEnn64<9=R(@$&<0~C90q?7;z z%G#Os@Wu^WIbChjsJ%nv$iMWv+0D@v4=21f!S8eU_^zW}Z(mRA3*h~*4CYz~v_u@R z(cy z_PByJowGJS1?b-ZLVtdNX$d7?$N4F=LwDE6EG{3=PLmcDl}Iv#(C!8xh6<@g0@Eo+ ze|;Cz8Wm!wvWjbJ1qXYDM0bP-eJsDiu#Wg*QUV07VpsFQ#Gk4 zw!?aPN5Oh|M*~P_D~1-IB3^a-*qSAS>*V%cMQQ)6i)p?2#PsG##>Z`6Vu&H_!FdC% zJHTsChT{`5y2&=SulX08_~ekSA123tj3 zeuE6PXiNXr>f4vcG14lN<3Jmv!3HyZBP zu<@MtQ8frsbfs^R8kF!8R5z{@&C1`@?VWwTUnV9eGvd#`_ zi6PB{ET0XQlqHlpDG#!yE0!FaI*ne7>o0v#d+r7`*gKb)g`fs`E$%WNKi4d8PhPdQ1>4Iq3=m*@WZqZ-D-v!MEP8bGP-g)J-rd~OE=A;Spd$eVOA*3TXf1d z%mTcx{nO|t+&|BC1O4VUk%J$WA<(Bd^~i}i&A9hCjTfcR!JSOoA(PS_BdieDIXf)Q zJqzYRR)r0gc;_uTwQNYK^W{O7_ZHRts7sDCXd?Ghb&yiXkd}Bp5NG{uHt6t8oK1aq zg;$3GCQAE-{^zwr_hrKX1l=`~6K(*yJ zfV~!Fu5zL=D5aisdsQXBUy=QC>g#S!tI%}%@=m73t(v4YsWDFLdsAcXO;13+Sa;L8 zp4+>O<861q6IoQ>DPmK4?D7ZRhu$ znNFK_GVK8J%lX9IoTBzf8Lw|IP;EOr^Gd!r1e_i{QpU;cURBxg8p?dDotli;_LJCd znbmH+XqV@6&HZ{??+&w2e;F}F{c&O*wQ$Vw9e+6@=1WRFzWoSak5-P)52n+%@pl6; z4_fbyv~S8#gWlAbTS-0Pu2$uIoL66J%#HlD_Yq>Y;pd&i{2PAO6LS}S{)Cu2Ec*B3 z=Q?6)`1yQ!=_mYr^Dws`i37R?&akBOT3%!L&!8e-jV=46<>z<6fbW(EO3PBAjwley zwL?da9XgzL=s0~{A?=z~NF(1aq*IP9GDc zC2a!d1$kzVCCdi*?|l8~o#O2CAD;>KjK(9MS0o+R)%P6GeL>05qbnDhqq&D3q4%+T zFtvqpB``#eB?XOdA-hw~mp)gva!XaVGtl7fu2l$p&7pb?i9t*{Y_;gZJ!Unkqx# zh5N~xi#22oj+@xIOz!AYa{RrD(+{_&(jV;*aZo=w#Bqc~j-=;mf1K9_q5NH~s2dn7w_ppNC6UQ8$N622?^{a94IFW8DH-urr~968UJ_SpfZ zRao=R^)Abg#`P_a(6{Q)`T8O1a{jpMfImnR8ZV-?yBpa$nGmLng) z#3Ixw+icL{>kiPKN;!h}pPxpIfFrfIextNB_SkNYCCB4fNe-Rzq8JD2PN=65P>s&D z;RNotc?VIyRfCTnWZG{mY*D9y5Xey}eWDb-zlNBbRZ{ zyS{w49hCw@{9VRe71laAKSqajTIT`r;#EgR^1&>}Jv7bo4^9CS>4|*D7b>QAERZ8% z1v+~biQDn-tdb(u`Gbz@^zY9Ly#U|;U<&X!cNflg8qm}C71Q%djz0K!F+FgAX?b?& zP#s{#rw|jS!~0Pgnj2&|Tf^;`9R1p;pm&9J-d{fE96juSQ0dMj56{-W^*ql#?W`{l z=ck`LAkt@pj>c-B75CmkQ&S*<*Pm!*TD=U-^$wt-{%1cCV$FlT^($vtRSsb{em4aossx>~?OW~TGr%mE z4m@wwX|uP>8N~EX2UEQXOp#ZUqyLQ|9f2xl^t4q9sfdMxu|h~H0a*Vee-C8cW@fKSwLfB^3}w9 zzS?f(!05@EX-S)^g6BradIgZuJ{tu36-h@q(VLXP(@W^!HqMI%(1yqHWy1o~iM(GX z<{ZVDUbtvg$rZ)vFHxN7u@!4ezGsI(!~vPdWT*wkLipZSbdlp3M!7@+&B_6OmSnD~ z0E+U$n*yeHK2Q%h&lX4!^3Bhnt+I5sLK5dGJcc!tNk7=eG}LP!0|-@BWKa)CXSwdJ zICVL!_C&Wct*Z%^U_V`HK=B&#V9)ZoCAeoA9AH-NV%nOug^3SVtSt%25QsFvlGcq9 zkK^a>e0vFfZ$Hyk{cE6kQVL{lO(W*k1na{0cuN;~7+cf8j8&92zpo42MOp-8Dm0A5tw(hMgZf*p%$GMwnD$cJAosZ3uBgl_%KB5YA`BGzdn@c6y z&t>2w&TD(`1OuOQ>}J|i4r01Q4sh3LS)Qdjgr8~5rO z@8`sP?7xQ4<>znvOWcf**{IxC6g|xJ&hy!IW`{* ziNwxH-uOAxtGG>ZVX-0Erx%az!6!=Sv;$(@T@pAE`fnDA9H)K-c)h+xQR72Dx=ZX; zCPUqx%L`4{0%BH7Y~7A@>XjFmKSbF%AK%r<{ayWvQ)jZx9NWh8y98a^b~4Q?0Y4+l z+RkflbwJ5YG<84Ivh6TXzv5bow5ZAwV`|Wu*0oZ|lD4nl4?eejtiMO_-;5t_>R~lA z-Z{S%+Lv;D`0HnCxDU9_`N+7WPjmptRPNUSsj=sicBUcCybFNWv+1jmsPg5xTZivx z3GHzST>ALU#H^Q9<7Wq$_RzTvr?!sIZdO-3lprb4d1k4^@$CB*o8G6`bl<9L=odSf z=E;D%atDMOS3HzJ*>`bo3gvThp@g1!mT9XFpl;XL6BjW9!N5*|pDqKmcq}`3e{NNx-T|GfWr=NV>tW2*$lJ)(U$X(vcW9Kq)$W}ErZgSQNYLK?Ik%zm^nafzN2=0< zA9Cpk&jaH1q_LgfG3JUmfVRrEFUn2+{w?_alJ)-h&OY(}E%CLbbc*% z?#scw)3~nL$7z$ROVAYb?c%X$yuQ^^2Xy>)hj^A_-6DN(uRQXdtFikf2>tiABz{}2 z{yQ5)gihh&z60$4uNFoN@Z8q&cHBo}c~KIth387!L>_$zpzHR%xUVI?PQeTGI=j%p zxPR0RT!)PV1PPe~oKtLS@Ip4#eKXaHO(YNLcUVZP=q@B}yDKV;LHF)26VtVd? zx(a~Ge#NC%+|nw>|LI)1T@ySwu#0IQj*&M)e|>X|{t8@o{hkB5_gq?RRIHbm5+3U( zuc(rM=hfgmqE1^Op{;mgKhm=TTHXA7>49R}pjns(uS;~jCVbTmw?f^F5nfv`6Kra* zsa@n);e6v-7O}meR!EhVzdCqQqQZyv6@OXTsK2ZmWn1r0z>r{IOYdCZ^&Ym=NfA|n zE~KO9HK+^oSXd|5Lr2%jKnaCg=FuOuTe;GTOW#~4Y@@L7HMH>c8k$GVXPJg$theg1 zj@@5s3WStxBBm=J)ShAobZ@gm$Dr(^rN!T%-v>1~nY9MvKOqK8KkZf}C`u@9UA^(N zn*bCgnwBL5MoON3!w$Z`3&n4zzLSY_qrn28A6GzK?=a(b)&(VBKe3Z(|IPDpoO-`i zpR;c+>R~zWRDkr3q>$3~Z9>M!hgm1;IiK$3?TdOR7oZO3v+CTklCnHDe|R zdpC%42Ytp)VSj}kq8`yz`So9^Kf7zERWtA_G?E7YdCgj;WV~<5?2Zdcw*J*~&8x72 z8zf=po|GuN5zOvqm==GBpJTT4&zC65Yu~5ew9aXA^uOlF5l`T{m2ChaTrb`Wiw(Ht z+F9NUX@+`up{dxRrSE29*32lQ*`OLC|2MDL`;9iS|9xTL`~R`o zf)|;o(Upl!sDC0anB*7dAvyZ)*>WT-K_Tkj;kzG7fX%A6+)#d%Uk!P}gU<-xW_gMl zoU)H;(P7r<0VuuFpF;Cce#|E3;9lX^yhnkEyJ5qr@QSqwGK6!S&tng7+%Dp)`cl5t zj`vSvOnYR-oJ3v*L}m+~g?4Ao0%E@02E=S4Ojlfi%LkHGj4o zA;}uQH(%|mirFDF?HSZF$MRdJ{;k<^#5=+Q-0zU020z%#w6H}xy!O)Gq@Tm3Kd3;& zJH$HW>BQIrP?Y2&Ww!j4;VUdu4%f|+ri0OzMU1}76N=Ct-*cIDWru;|#&Uf$3yk|l zeJ9!aw43Ef{6=DiO`L~pz0U>%74bRrv<#8oe2w2GF)4o8o~-A~`Q_AGsio)hc+rXT z7Og$cME--F`dA zZ{)RE8*-sU=mAdslRYBdm-B+7!0YMb-uvsQkHx9~aSx9J9lfVff>1WvU^bv_DWVob zV28--k6U%6@05Y>g_nj|7mxqj!8Fv-<5rE~QOsNi(C_T9YEA(ujbCPgdIwOHP56m4 z!+9xKfchcmM0HS`0?wq2LLDT*#Pi&*d10|pD zx|21TW0w{iW8*LO$PW(#&OA=XcwbCG0b=^y=^zi zkt+)51ACa(ZqW|M8<(dSh5h^tyLgiI9M9KIBc?P_4bE1$U(k=X+qPjAsItb4dM{tM z17*~90Xtgs&po}ZdV% z143xCiF|RZ-fs`uW;(lufbZ~#_F~aMR11M*)&+vE%eeyKZnjFL^2Q|11_xcD6$%?=$L*DDV1!&() z5eLufD-W~Ii#8ZoP1GRTJ6(UCLkBlW^z^q&IS=mVHYM^@;bR?`DM!4LXz$N6MNzYFy3XLw#4?>9Cm#vQlt z7hp0md*|}noe}jqFn=-j+0TH!`V8l#h4{=m#a@Is;?*ZaS82`Rb%P%Obb^7UGp^4!YgF@>bVW4E{@M>{?7AEi==pqxLn6| z5C)3!{eqICFPh2EEOhm!BoULL>w={(MgBa8Ci*2hI7Ox=Ut`WOx>2@%=S(>g6Br>u ze7~-h3(ej)uC8woc0tJhG}HRh)nJ=l4gLWj@)s*V1!etzwQ)Z_m-SIAe+2*g)>Bq3 zy)t56QgZYoZNd&7CqX186Ek`RWi_{hgMZdIuP?-Vi=SfJ=>p&}7!jC=ylAvGYkbAJ zL>!y60lOM(m0?9J1wzrElElmrrXhWzjCF-&VumlUPCoAeiT-xPvPD&izCFUUa4wez z0UjT@x|IHUglXz9)52LCpFmunT1t(Qs(btDXtRIh=-z(AEp5Zt@UC%i3vm)}OEY5Rg2wggAgRYNdQGaW#6$>&noZLIW z_fCg(eRdnuE{^^;ng4eb|68#xabZ~07Dirr2_O=7fO*`~arQ+;Zk@{4fv~}*J|p;A z@9@?8G{KlFnkD?s2FLN4r2l$`h&?=Q-P;Cv#pM7+s{sOuVWypyf#<2*xs7S~YgdNvXo7^FdDYzI`Hh{XCazPTi-@q5wI~uV_pY?Feiy><@Lwiph|r04bdh zP{`{Wf>c`$5Rw5(!3NZ1qcs%tBsSXj?9kD*dm6ozt_DZ4!EAcFzNBg+*{YtH-FyO| z@T-_v*zU4U;P?;A9uPPX^$y5H9pvd1zLH@p_j{YhZP9em=WFfGQ7kq|zo^JM*PZ); z#y!>=Q(St7X6ZRdr~jX`cMp%MI`_xleaR#wTtYHrLK2yo1QiD_6egDeG%E=eDt@a@ z=F}EFWkPJF;HidKAtaKW1Vs%<78%?Y(FCxqnOd7u63g^x4d6M&W9x~*gH~8D~e7kl4lKo zcl9BtI?VO#N}$eTbBmlHo#t~Hcph!e*yg~_$#x=5g23qz)A{_AraqD-ueC5iN0qbg zi!8v~{#4*j^nK2l19ROqsaCGL7svIBSigmSA$$0@E(`$0{>pKC? zmZb0Ab5gN~xenVXXRHj$+0E}i#q>-CQa-fy`mi;wbJn`W))Dtzx@8l!;@ztOx?3%O zdAv7}+Wkj#feD7WRtEs>@v^M-rSd*3g{pb7z>dm%n(4;M2Y+Q`<9%^w^e9j}A*Lp2 zeoYqs7{9$w*u{tn-65Go1{M2C2Y}reAU?z~yvPE^C&cHpOH~#8_i5sDE|97u{`+&{ zb7o3a`$if1(8O}vyK=R@H+G3T0NxKg%R19v9%0?%`{wFPupT7{%nLESKU?U814??h zO@@eTn%4L7E`C-qk5za?XZq(8wknUHGyfj*3GO^s`&vgiA!ffKc~G~UruEg!5c$b2 z;inbDuy#Hz@E8TBVOUG{z%DefdemC8ridm2?l^H?K0`_pN4rbF(A?=9l7UHU6&6 zr9j}#R!cVcFoB+KW4iW!#qd*axtk3Mx&{Y;a#_kX#=7ok6FzL+=!co^;r)7^F}=r< z7to%1rkK9i#`GJX6*AV@ulPraGtQ1qeVgxtTnkhGoMj)rT&_*77Y*nV-h*=f?5$gl zF_jH6F>~#Lt`I0b5yW`X^ze1r;=Y&51ahjlOXBap*e}lW$blq^;~h+(n@i*npUZv) z!gt!BbEt2=@N-nM!>>NY^ehVp5Pcc0wNaxC%>F_V=g8}IJ;h}%=xR^U{6@J_W0WV< z7zb<^XF7TynMTWqX&g}LUzQN_!U36ntU&k^B`18cT&5V$!S$+Q@x5qB+#g;mL16JT z@Zx&uC6m_6mts)P-lu6LP7gVmtlZeqOu@wWD=5=_i7>OBF~|Nb%gtfLd&vwB;`$P^e>s?nU95Ky zicb(}xUgT~Dn$M8BiO!~}aH zEv5n^FSZ8z0Pz0_E+&+%^d0D;C!cG#t-#X()BE8lQAUUT{fdGz7Sf)bOT(ca#(G0-HFeWoB%DQ zMbQjJ#8$?@RwFhgbP=n9^TSd*%3e7+K{-)uNWNDr2 z8VEcc+uQF?;a}@)XKSAz~_4ZcrJ1VaU=iWc$S45%eZA+yr1}^6b+W zDizuY5GYnM#{FCP^Tz=KMwv{R45up@3v99x(@0#=VQib)G5-D3Wb7l_#RqSR7&cPy zWs}(7hLRQjnA6_5)PK^-gQ+AyOAs`F<=SNWrvnr8z%2=S5Unh!fmA^ctX%pnU?fw_ zr+HMSPRKa@11^s%8K;ka$pZXu-giS$@ZG#GS-?nK*G0?a}b~H#O5n7 zm)!|D2eDvLk8Mw(m2D!X5C8T~rK5<$Ao3RPdWPw^&yv98V| zbaHV>#D9yv&kh6MW4IS`;`TyL_{rIF$T-O7a5m0o^qfMA73uVW&-omSy$~&v(GN}e zoCW&Jfu4}F7xMi;wodEddtj(c6??DjAMZW#DJ$fA3)iekrNs)IZu*o3#`jy3*lz=; z`8s~1!$_Rj5!)jT7SG`O!zhz$G|>FdsL;vhvbH>*eyPHl4AA_eDx5JENfDAV9eE;O z>xKle*0|2;3G|_9kpB>9{u{0JuCUe{WAt}2olF}pAn~~_GX?J22?@N$qLN6g4!{)) z`L}r8<2#w&{u%pfy%ceWiE9Yc=%029Tz<4E{c^HRsXZA2yD8I+LSp{=Ua^Ocone9C zSN0I#9(n`!jC0{dj0r4>z@{tGcz?{;-;jei!?FGJU(Yf9i_7e%_P?{P_`P(HF~?>b zF~9tjbv58#$_oFi^{abH@U1N5TVgL|h5v=Oe_Wl|OX&%?m&*PWx0jm4UOMn0-%Ck! zSjh_W^(N}V4$<#yoYy}w=6L5hreFACM&Y*x6AQ11^*u0+{_t6*7Ys13c8=vcV$WNq zq5R7C+wO}@|Jnb7Uv{qix5&53ZP21!xCOEHLCP!)-b_p>X~i{){TtV)x049A-7}s3 za3|AwxgJO=;ALQiz#=pf+p?B~m`(r+Zfj@yq<4fwWSZ8}dh?eS;IE^*>020JzYe*#c7g24g-%_!%;O4ZijZw?rhO`PY1t`1%im z&k0+;;AH_CvW(SGv)WM3#xOq~^aC}H0_Ad4xJCF4HiFjovlgcByKqaS{~+;630$7H zhxfNIoxiJ)<>oeC_5e^jNN={u>e&}AvcNqXfc7i)@FOzjsl+pQ<9Ws zzBg)x&-A(S<1hTKg*jN6^7grMsbkS3?2F0y)y5WC^2@!Jp2PRX-Km%tA95S}zHAdd zsGJUDEd%qs!1hbSyvTU>r5tj}n*Z&6LdMzA&UE8|j5&0;j2czp%*RbKJy|JJchFAH zb9s1)i0}O4G&vNMiV#CA_ff>{@OKu=A$i4Pe!kZIQu_wJ-k{3aWC=vtUs`UKS4uQ` z8^%yX^v%Ix?C%4q^!M#T&*l9@JMtOuaXo~W9eOr)mz^H2xQhBus?f{VX6x3a^z(g8 zC+kUszaujsQjsfY=RfafIyv4`(+*H5FjF$Z?o-#&>z-x0G*k2QbLIpI@cOR6$p2W09D*bgA&C$%%0({ssFD@_I~9Hg z7>mfqdPd+D^KVG1xPL~!3xz}~0P;%`Nu)%9NDz_=2*ylZjhSC}!n!g^@s(Vt&=8{ns zh*p=>ki62GT(xJF)0Mj(^8jQ{t*RK|JWs81kFWr_y0pgWf~vz`vH-brna`ODRTW>d zKxz3hAGwYAR&yQLWC60tSq=nd*2}Pdy~zS4L6s6kYIZ^<=0-fZi1SW$Tvq4LIiH18 zpiV`|>dV$w94Z;EKkj}&r6-#qBI*m?`*At1pKv;FOz`7aU6jQxvcR3|D-Q8>9BKv3 zl~i(`1@>OJB~o6g(t&!2)J;t)Wcv2kJ>AXG&&a zy#iHyE=N(`NTqw1r_$^M=-ivG?Wz6ULRt?=Rd|1$xro-LYkQ1l5-Fh=mmeke0*2<1%jBjiaxQcrL@<{^pLQyiU+QIbiJBW|>;d|-C z2M?yxdu9+{WeV}FNhH3CbsLM;^6wUsNRJBM13zJUNg;{I4|D!0t(20EWaVmdHjZI9 zo&Ga#uZ`(srIkl@B}9zVrD)qAw^`3_g9y2yw1)4U27mx5x1N_nM89xL#38#1-oD6m z-hWQB*S0VnPBAYZJD+>kAoJq-e8K|H#bl#-c6!y5Oph|=`1N0IDCBhJH8~w)PugV} zW2Tz^&H^!C(IGi&q3ubg>lczE*D&Vz24jJsEH}R^zfVm6POP5GWcRP&HDdz6}2-KkX5*&q>i*!{^y#a`gwpjNrobO>eso8 z&Rc$&Uf!nV<29r}cvz7 z;A@=z)&CU6<(okj&V=My=tG{iOV|#N%jsxae|fuzwS2?EDB^s*Az`@i>Db-lyjk=Q zJDA>u<8>en98%#7mvM$XS5q)%(LZe$d~Ae{)97%!)$T!tIY)iY9;n)FAy^O%Z1`GlOp6^~xg?d#+aOIljMQd+z*Ez#Ng$Lb1n6mu296M}tl4`_=Y|eRe^y zhjFjHb;(}al7V||BNcn?ptaYsw~IUC>lxGE;kqk``^l2 zJ~_{NVU~r*^4`_-pMEUp>Yxg}{8{KG2ZhlLI@en3Qfo}S-A|gC&i51cV~c|hkBM<% zTYFuoPh?pA_r~?-kMZ^X=AeHYv-D^X&C9eDn@#TM*MI*8DQ?uwQ ztNc*QMESk(7VRj`nO_q1n+Er zXX*ckIFIT@IvIDKWB1V~6)7yo`SuT3aj*R<^p+%PeWf{9&`7g|iS((S|-9b;Z8iJ0!C!Cl3WaXL6A?tkG{pntt6 zWRuXZ+Ol}vj3L(LRH5paB=XT>+!$#7foGZCCPUSL3cZq-`cEnu;Y#BQyc2V)4Ov$| zCvbF}UZ|3iA#kozM&Elw_+R%{s9IlX(i}QJwr{q_bkO?x6+7~`259t$ZjwW?j96G-x zRZlZLWCQxS6;nLG7?)EzD|?sHVTM@~T{Le>PuBMqt}ePKcXd%^+UlY;^6H|B zHLHu@Cy@O&1CG1{TFU3;X&3#TRj0|S!+G#LQKuK{G&-p7 zqBW17x@hl3QGR2rd=}80`0_Wo>2y| zYgXO6&htSot$~^l_{FRdMCtj4%JxT>4?G{I}=Q zhpqBiaphl|G?puAZ>;>Mb7_@TetKN_gYo5Gx{|&gEC1k?^m`X4cy9D@QI|bAQTO@B z#UA`MuM@{}jd-5>>6Nt4`o@WcSD~%!v$!@|tu}r-YTcv#BVHN0iuOEi^=I@d`s(AC z>I(KS*N4$B_XO*D$D*Z9&Qt%JbzMqB-7KDl+E2HSu>hx^1sBEL!p7;uEc^rO;<6&* z6UK0IpPolso)Va{$V;XRUh*$v%n?MMVzEtW&PZY<9AcZ@k=d}a8kgm$i5_X@f%);Ke~ z`)Q^JrxTOQk46(j+5z(Uyx}*xuBK0pF-Kdn;6){qcu^+uBF+cy9^-OPnS~F{_4Q>P zX6@HIm=g2H>)`rLZ#rmx?NaQ{N{RNDiFn6h#U37ycl-6Y?YkH5PNjTa+@se~W4?%Q zyCF#qeW`$Fm6}>`;Ra$39+2tCahaM&Wjb_Frk|XX>0bt9`mvH7KB>$`eX1YlB_oV& zZNHYT+%94?ol~LeRuux5D~owW)=r@$uI#5W#sm4q8M>CHJuU3)e6C%x=0Eq0nB&1F ziNY_JBbEt(7U@O|o>^h{4iV2B!#MfF6HF%(cnd;IH_8u_d8lHotEf^1S}!Z> zw=)*_MC3rd|9quFjY<;vjsj^HY87gH0I#+u!^7`OQ23f`M|)eFJaN~~pW&U@GZKAG zme79JkW6Zf4X+ALr6&Ypt(>l{n&L^f=7l()M$LL(@ue|#@ zI`9nBjg{i=J~j>~NT>6LC+_c~l`@W_X@~`)dEYn$Nu(w^FzpcUe{~Xgqh$&;7A4R% zTS#j$0Jfum+|2tqaGv)Yu$?@Ro1LJXE<4Wx)qT>;Z#~X*Q{YN_$`;F^ahiDSI=bp9 zrsEh6h%x*|7kFH}Y{ga7f6ZQ|8!14YqqYvdZ;azmWBeP5823Y@htK7INj~GaMA;D3 zIAN9;$7!*KWoP-=X5n1&F&;g`0?`jhWZ-~AqZ=W@$FVP&)NGYCzmx%38tigw?c*9cT_mz4gxK3 zX@2=iITZTyVvOlOKLGTh@fe5lhUpJU9y+gPzy2d2P@+ph9Onjp2Q)eDHeOAG4u2V|Kb(oDOul1J~1>M1eaM zdTF`&luRPuT_A_tmd@s0N=(EUXMfCeKGw@&)CCm?Jo`A)E1o370O;p(_GLM=XKV9>pZ9-n zWBR9zIgUeS0q^@YJ5Vq2As!$0&xM#{oNqkBnEo+ij{WaHG`z-Sh;hW%=F5M8@0N!# zV4WR7EB>p%1@y8xJS<&tUQhIE{)2>EU`iNIU6zUHs}ql zxt3PnWGjccTpxzy4277h6!4VWlM1R+p&*JnMMl_dB+^@(neNH~FP91M9E@I1jb{LJ zaeST2Wm6!ZwLzpBNP*EtBF4QC;WV@w=83=8Lqy9UHSIDqb6UGU6#_EhG+#bFFckv1 zQ%Q$B6*?NyI1S=-dscX$nCs-TJsbBhy)~hz0AmY5^ZytzMY6+JH#1#RAfJyXB&V-y zmm$z*%h}*oAkdFAW45Ovm-;{0!}R{6B{glfIU9@&QX_%vA>c~pW!y_49r!6D2*Fz`TOME~fV+6SD`P z`yjizuv*SaJD#?nAY|oOG0KSfUMbK)8QugN^g{bQ8j_)TKVyy_E^EIi&T)@rTR#UY z3RX9%cqbffy7d|txI9K1L^?zs(r`3E^Sib)o!t+S5q?Gix;R~sQ^h@WZ=oEjSHQ>l zLVtp|yX4RNn;~-2C!^mf=V#7&P-RSkz%x^ztG}5<)+pfPdp(*b_+f5}kOwSXv=i=L zMBi;i8^PCt!z_@UNX#X}tn0!7nL1Ud5;9_TSdt)+I8)>!FcRCcdI0h>^MLaA^^7?R zr$ET^DeH_X*Y@;C0tjRPuE&wjpYJSA7gr@ZO(>)`yuj72C2EAK$z3l z*g8wsQ-8%CrVrdtBJ~Tz{(pJhlA`+Wo7t~0BP_?dF45O{(yM=*&*_FA$sKl=mA!EF4o$X~?y z0_W8??GZk_{R1*J21vyCFNhfTlZf#qM1l*%7>^Bdo-8Auu6zLKYEVu$4RX1ObQs%G z#?OMGqT=>9R&FDRMe^J6h=J1IPfvbl_WZY%}NU+flmG5tz>iQkBzawg;tqHEtxstQDJxFeeRh@{ckX)bAIY2 z!~|)W^T&v@PO2h8cN2Jfzh6X8w&Hz2Uu>T&X%qF_%ZTX$i12z=4BmL1mqJYE^MJV) z^{?hye1Ds;WeOg3JdQ{GTZem-Gp*9XA?>%Y2IBKaMk}F4%ccHk6VRtc+_-1r`}Q!* z_0p}aao@j8uE*bOi^uz!z)OsM&o!5h=i8~bzQJY0efxn1bE$tb6Eb7944!?Z5;f*h z|Bnz?7d-L!io6eFGjfJ`yCRQKN~|W+B%`j{GVC&oM1~YWr;e!*cv^*)%=I_X zJ)rsT0?iK!sp&^-21ocBE6>bGo>ar~rVO(KQx36WsRj~x89SD7F~n8$Kfm_;HLyF`9zP381Sls8%-LgrF`8WR}Q?MmFf$jqlR0POs{jF-=oYI<_1KmPlQ zRo5706Lk-H=>;Xz^Vu$@yJA=%cTSca+EXAfcN^k2U*lH6t0h5x#eRWFwuLcWlj8ak z%%>mhVtQ~FiCo(Efib54l+(WrCFAn|01J6v`M&>PjOpzO;I;0yI^p$vdTbZdD;gF2 zRwWa@E5PM{d^RimU50p+xIUbh2OB5WA-?U`@h&LV&skyK_P_GBaU8S4w=$;J+aSW_ z(Tc{N8vcyWb&tvNKel4U#D2-A|JBO$W0r4x&<2RpG+ZfBb5Iz4<~c zm(?P~@cF;xvI3{pH^sUeaUm`YnEjT$xAb`*MS1M@0y;+(czZ(%cqA3EI3va2SjW%Y z{1&D^{g$ga^nP%-3!s~y@jH?slmVJQ6~G?jWn6~+FJ0Itnx7K(ybWVaPfsLfx(waS zM!wJ_2z*QAWb)806X?q zn%v*qR;K%e4XIP~Gd&C^izwfBpHrr10@(R8^MFK+0g3*6d_1$mu7%V;c#-KnFkH~D z%nrM)eY|ojV*eDj%Oo;dCQ~ATSNk_kgZS8T!o~q{?mxcB^z?0H_@K$UAK~k`;cyL? zHx^rCxm=z1E;7AljCtSTX9K(wpF^LG6&M??}4fp00N~NU>+jb4n=&= zmGyvlKNqTgz*wLRvKLmy)p=u#1yW0O17N>W054ZjyWW}RzS#G8S zn7q6bX05+A5dw|L#QdiOXzA{|iqpOpw2|Jvm_~%0V`?JLTZ?<`Vk+>OXN7;o-`T)K zEL&AzAjaPPoQb&XehY^T-#@>Y{)9iD&YwFbo*!CF+xYV|Fi&h*ZXU4_^N5A(gn4X! zpG9^4K0{y=UoK9%Iu~fp;{va=ow05{MgU?u9%uS*7;|W8#Qe9<>W)imYcUVYy)8^f zIXI2;_3Y+cm6+mPR=AFT>roi)wgLL(=3-9N$fR68oNsU$KON;SVj6`)#%s?KInK9B z5IA=f=z!(((9g$d)A~w#7t^0MS$D#(L)9CykoESb5i|H%-Eqv}wKh2Xtog@ZP$ zO;D(uB=Eg4j%ti~2UTbZJ-UR(cmsd8j7|85Ja5GYbGma{;0vVvH4b}xyx;0q`;Gm5 zX$kt-<9B|w0O=%ed%no2gWqWWzw}$3+;5zdV@qhPpAHMB5clwkV*1ek&~JgwF0jK6 z0(4vYNI3qxyxr$^TDg#c_?&}K)icHd)iN>9jkklCWvDM*bFCbbfcQ#e@bb0~^M15U zqn|x0{1)Xpva9lzU{NK2S5jeS{kq(uV5z$~`&v1q$zWdE2fmj_CiPdw{_c82;L~X9 zs*4N-R!+tudj-qJaG@_?{H-MB%~<1s~1`12~$$@W`Q|+R~2Q z7EXE$Lj=gR-J!wZ_9%blYZ4d>q-QK98RrA)a#5u@pxh7TQ(D5u$6Ml}^V zylVbZTFY(_w(^aZtvnqlD+F_}8Y0fR#13a&QU}u^(j&t!dSvMrJ!#sF4GQrc2FO2G zNX#}HRB1CrzDgf}z4$??DyTx>6hNT(0SPhpibGJPB|xC~KJhn~HFA+BJJ3gUZz7;f zrzH}fi!m?%d&v6Rd7o6(FvbFHS3%XSV+`}qNWwncb<;M>&V5v(hu`-OyFv3y?|Bb} zWGQ8D3gDe8w(+1;RWZr}ysxfN76{qkj_6T|YFkLF`@IJb?HgnHJ)48WoW>Qebrqdu z%+Z=Ce4+EV2|PDVf^PopXSboxjGxc-eQOF}n(cUq)Fg3)|{^5_K*M$38n81+CAAe!kEZZIWoo zBbYOS)0?y#so=wdkH&KKq=yeM<}fNr1d@7I^((M4s<=F>!L^RhF{qlKuPYg2`I@!`7gCI%zJ!@bp>Vg4M6;~Z*3DikpFfm7*~!yMYnHbI-mPN zM_bmf;xH@zQBL)KVF%#4Sqm&%O22N=ihf};3&(6I<7Hl0N|%n?Qv^mMKF_?77BGRQ zQ=cqi=Qs_9P0sQOy7E7?`{0fAs>`)|-%ZqIwL9r~pcwsOgEFKzr$QBe3)-?`--;Vo zC)@*c#{WF7PIv{V?H`N_zWV)60GWO{cA4j$G99#@*QdqJ!-I4FFZ0j|4=D8H*k$^$ zY$^J~{{NicPIynDZ(Xk4%p2*k|E1kYbGcTfuZ;aKbGgDs4_@wD_uYj4uwR|aB>Jd%WyIK=Y4U{BC@{ z@495Zd#9q`>$k=b>(HBFgU%EE3n=HY4n^w=ZgD)*vo1Jn8<9d>cRi=1kN2Z`mE)P1 zPb!yJIPY6FCNNX$(*SYi@f+GS`qEBe^PR}ab#xqeHr)oD)%^=-OpfOKnDNP-zY=Akgc)Ogw!+X=HzLV*R0QR7Teb4D}uE0z51jm>c-f8i>pnXGXL(GqA zR=Axp9l$R3%w1y7#P`dMGX5*$`0wL5N0#lDWrK-h+d7@jT!5I$UH{G3T!C=+u4(kb zQNfpPzbN5-v}R%DD_hZij=4!u|8-8*e_av;(i#O%(Y7+ZZJnzqX2bv5Y&mp#lKlR< zHHW|M5b^_r!3JkyYdmh_jkk9#7xKeyfNoHo_yUdrjJ;d{DVq% zxQpxP%Ixs39ufAdh7`^J_zsi{1y-_>5uSNb3K?Zw4noY(?h!?%gJlAPhFlbRcgC@U zw*$sa@wT3Qgy~$ah%O=Kg(jxEvcP*-g){tnTn;_U&)O8ohXk!Jg~ss1vcvPOHu>*) z7tv=3e_we~^xeuwB=FczO{djQGTkU6<}KIA*iSB}TlO(g=DryyBk}KEY!N!}Mj5(t zY|ygzz_s+p3Nil((B)FlS30~m59oh3F`Y1$Un7I*lb~yH3W+#C>r)l2Z?)oBKUIQ2 z4rqO;0QPzr_hAd#a(icB&XQa%$8S-ei7MIQlf_`(4bVJf1IqQtgH237Sxn5Hi!8s+ z2Iec{xKdw!x8>%OU&0{R=7D+4)JomqhfxwFIZQ*@D&gDWXd6J4E^cE{5_UR z%XY+c%-LbLeJ1_RcBEBZyp7jJ#ky4Oimlu1@Mjw8Ox^tVn_HP)7v~cWj0L1yMUKax zZx=En@9Par;P=jWMBsHXo5-!slA%ibJJK7`pQ&lIi804W88L$ju66$SJ2I2 zV@v3rLbuQNIS@ay1u+!5u0TJxb{H<$oJAshEmtc!>t9raKVbtj`q%L1i)6$huE^3b ze@|T+n2SHHJHEb!=`~qeL|eajn3tcOIve8{zt_TaS0b3fEGtGn3nDkh_vh9nbWs!2 zdq!BkFCB2NRHhMA`@HTr?-!TngKLAso+hSiBWz+^T{G#;j5+QE&3}z`XZ&^}(;*gb zzx=B?{GuAug-ualZBLdT-JT|cv*`WxOb^vBH#HlWj!`L;)53Hu8BDGh^q0vLmZHtj zXE1gKU=}TYN2=m`tvgNI<9 z{=0`I78omq-t){D-Xn$ibC96`6k;07!Q?t$@LfA)>mhVjhmS z?K>c_Q)7C?x(A1iJej`gkV8VJB^ClZsShG)*|SfQBF+Gukj9{Ql{59Af8&kjcyfmy0CJ-UdPdliwl_;P+<#(EN&xXXLBgUcW>JNJ1NT3j}*uY1lM z^sAV%lj&1FX$os=^)huH5wp00Lt(oWs+n$f2>s zlHuadBzt@v88rX5E>rKQRj=QvrPU;fx(hC;%ir7V#FvmteCkxST_uRocuA?9WSX#Sfe&A)nd#@ROj0%da{ZR=E^rK7hTudK6WSJow$yHybjKCb7#H-|Pq z%p5W7TRu0Es`(pb%`eS`O;JS&r|l4P0TxeTO3K@^4bGGzc4I=v`MYc#LzRgrD+_$O zq>hpVIOD$cN;*PS;ST?H>1Yf8ZuMMHBd|W@1}bmJM1456E;?rLa?@FB#GND;h;y zTQ+F^+t42`Biwlv#^fSqOf^Vv*53qYf1eD25k(0H9i+&43aSoI0rcs993Y^{>CMFe zrw@R5)(8-&2m82B2|pLd7z^}UcZ7*sxX!W2(m682_c5j`Ju>xH4vV!v3GL7lQDFRpTI{^9hTc&o@Z<*0i z-w5Us(EPP8LBw%^b;V*WhPfPgp5=2Hq~PC>ddPK=!@Lm?Ilv_i$hDFqCZ1`MYlJ7^+;}VXj}%F;e@D4yL5gm|mZ5gO=(e zOK2?b>Vq;dyT-Ax?c?@!yhBrFh2PQy#unz_vusV+Mrr>4xs6vZX+yH%ne(_wKILbc z0Ce;6N-BxegS@_-v4GnpFtgcFTih8@JM0AL`MVMX&S|AehbnC%-y>*#bA4jRNOe-j z*h(vB#JfTtj``;Pc&E6xxnTL__BV_3VJI2sC%UbU>kh*O{O_Db^rxA?O}iDU+S4HL z+q#$?)UtKF;-pKO1%BEi{2Y{**2t+^U+`wAk%W&#TJS1}1os0?(PH;Tv%*K?z8#%Q z{cG!(?vjTKgSj$|{#-@>OMV{Kl*;HMdldclCB$2azA4_9j>l*wQE2xM2X6+Gf1iIN zSPJL^(-HTbeRz$!bUpPiu0!0~ zeC)&44IM$7(qXg_GnhM(llQT>IwkX{|GN0LubOCkOSAA9M4yXX>Nm>e8thLU#){>m zzfKq;mt2ZW+?LWrwHR%GDrSd7h*1PQLpj*FoU5hnapvg)^m_ob*1%9BX!w z8Y2PDNIgqv0TA;c1-hYU3C#dvzN|oZO=%DMCNE%?ZYunE(yq1s?ziscdJs>`ML(%! zdUQH5D-`JJ&mfV?IWpzvVKu<|7bOT73rVC$0&hBi{b(AAtOjMhF)GfU!R6&N5~&zv zUT_I)NKk>^vo=_yjxjIar!FWy!RbAI?{yb_vlemYYTBi>1r=!}J_B=xda1OjVi?N| zy66$Bj0O)B;Im9OeYIBPr~lm!rU%1_ZRb6bCgKU+mHA$h@XoZ~%0Gwoyl(nSt1Xx0 zDu|U2t`TL&`?cLoe==S!X`$%*YK!@&4pkJ0JP~%Q8jp77q+y!R8eoKepNT9}Q zFpZ-MjaCwq^Q3{*#54{n^wfa_2%pLZ z^DjzP_@tF5{=HrP4qxq@w2D<2i+^U# zI%2}oD{18hVt&1r>BWh{pS@y>cn?Ka(c)UB^ZGYp{XhqQUh!RG!i!hYH9sU~PHne*tiyxdh>rxEx$Vjbqut72;wnn&~aSl1BqunK3~$L7(7 zi%buGAM?rgx}TngF}T6x5}yH(AIu_%ryI;ACe)E#@Zs8BngU(Czccx_l1qFI0A6hS zy?Jyhf7VE9ibs{I4(t2wrDPYRUPBZ3yDVbv1L#^a$Le$N8p<{^y<&P?JMGudFE@)h zR(FX1LnPsgrKL^G+ zsfNode;c**y7k2DKTRUNo2_}Bmq-7wnd!#oBmz@&(wrbyfdYYBCFED=v;8UOT^dwr z5(KvMxdHGx2~@dcYn@)mqY8i>f3L`+`)Zl)6}Sp#;8qDSLGj%^c_U+a zWWcx#O(wqJ7|Sn4d1qP2`MbW}F;sbThq-=v$4K>xj540V`*5A6yi^w}Vb%h7ysMPwz}QjmH>-|qZN-aT~;xFcAwiLhZGC%Qie`H*B$Et zs*1Qinc9}+PU=||T?vuXj5*vOdq9P^OY5ZaJS(n|(~uAN8raab*!6Ub_JzJidmm$Z zG*6=LhnY@f$ZxP&w9>v1<&Q%WVrWK;)#O()9P;yT<*9NS>I|quLY3jv`l76@584~{ z7%L%i4xoVV&)Xjs^b6YyETrujg(pQ<(vuZUce=8j=Iqp^)vOtBZ2F3)v`*b1Ic-yk8 zAch~>0Gj{!W?>WMd}n+eQa03jQ5{>XWWlT_)$KaD{`q}t^kPT?G!$oLyw?d($$^@^yVj+uBCxF zWP_Q1#yvP2%Y62T@SSO&1N25-CIif&@jHoGVRuVD{Ww-87pT`GhqQ$d;WVuWw7#?_ zn9j?NC=hmciE;n&5n($q65IAfmF#ePGBkhfVWw--!GuxPJwA`e@-dFEA=z3_wSb0^ zW;~BH`_6@~c@XJ&X*pu@J~$nkgPViHK^3~r4M?=nM$A%x?yRj$ZxHcl z;RhJg8>W{GyBX__j~(b~W_pPVXU=o|K8W{9z3*AJs?1*&(8p$pTwvH=S0Un|pDQM2 ztIfJ+_-OJygDVvRKiVwrG2c<4EBBxrpQT@X<I;F{$suEydAZ)@OoFQaH_QUj z<-{DUlqq9V&~{=TS7_T7sbl2lG94{XplxYj9@@tAXgN?LT|qz8;<}WM!}F-$StlV@ zv~iT{#EQ@>lvy5DHhnm-iRp4C(riB;*QZ?eMR^V)T+iU`@HS#~R&0u44a`D&#Ij9H z|FW#ihd3da10^TCvJT@P@`D+%XS2gMbKU$r%MbD~sqnQR+9|RSqcu1kWoXQ|d<3+< zO0GK(vius6Hxy$N3hJ0n23dZEOgdZ_SeFC>AHU*r*5y*cthpSv!1!I=hZZf{k9TwL zsL(6&Sb+y@(8^BEmqrW06d2U8_=MRW6|}yKwF2|0LWV&5ONfgY2~L-qYc^L5FSdc#On@#> ziP@e2-6hs~eE)IbHzQT-_WyOGz-Dd;?)Lv>Bh!Zf?9N`Ps$GV_R22fw9;u2b5O`66 zfb)=46_g?1d_}5q@xNO{x!?0=MH0%`&c{R?e0!ttD?c$$4jJ_jd7JNXnV5a^7W9hT+sZ7LGwR& zjU3|p#Zc@XS=Rb~euW&u+&@ZoSeCTDzRkj)3BRiq(xZtoZ~G$LX6JuA;X-&U9l5F{1-A#!Bu72=p)EeN`~NH%Wqkv67hlU5AQ1 zv=`nf#Im`nMO*SPHqIl@)cPK{LJkew%XPEtusgWh&-X;-)SmYTmVg=D$n*jJE$jK3 zq!0Ftlq+;q+}^p9|2|G4F!vkBjh{iJzZK(dJo{EQ`fuOJdG>Gt_TjxkTJ{LjT~i+K zi{1vN>sa`U_ET?s0Z;tx3u85y;A$5%rI45p)d^cV;{k>|BLBNA0mpPCRqI>A$Mo~dk7@qp#VjZE)9SX#q>msITb zm#RIhN|!=f4j=2m(wf*<`CcuOz}v56dU#oP#cqH4M)b81du6nc9%am7Vbpn~;BJ3P z{QIRv^xqhBd~-AA+RTq8h`pOpBl!7%P1|z>v9+?pr4JO*!!xwL)f+9ndRVG@;VcVa z>^o>N`)0w6Q&MQe@-gAhudZV{;t78K)!bpPY-0KzfPBkl>`$!|>sk@q?TYAR-x(*fPj)z!u43h8FPDm^!z4a*T#9=?xUO@@;)@~U^>^SBtYLY zkK2`n_~<)o#CxtYJ-LZFxE|-`GK{48AFY|VBim-Z8)oRw(aZHu-X{o3bnQdD?ca77 zPKe;VEF-3o0w$;=GQgN_q=<5j4_Wz&Q-~>L64P*!NbWLnsOup?lcFrv7jb97+d4cA z{mRn#TuUHwnw~4~?if^Lk8JUk(s;l4TBV~T&etQ91YXICL(iW|Oy?P>Dgg-OClT{q z6?$J*p~bvGqC;UHJ#q6KYABK~sBZNe2NO4?%bLIKCK00rC#BoYDRz%bfnT^%v>OMM zSsv8o6D3+PRqK20p%`A{1kPu-oSrg(x|~EgAG4{N|KAfdKdfInzQWq>+9|* z+6vhV@9A|GsZ+_W@xKjck*dKRTXP`o`)8a*ZFN%BGLV{K!6R9vDo||@eD$)te&0nF z=pT}3NKRi#B+Z{$wy2q`SX5MPgPEm}-mHP7PE?r=RY5g&VL&Mw)?RffKaoY#y%%^LoHid4hbk<~&3PbBx9u^U-LNki)jt3crz|4a-d~ z1NO&bU#CIf&_KADvSxFtz_?#Wx%4 zA!5upT%)Prg@s%DHp|c)#XRC$G3UTbn?(O_RUlx%MB9&p#jjEq)2=3_pRmClqfHRu z{mDk$GVpFLwNc(qROA!!KV!9ZZ4v}{dAF56WwaI|JvB^M0qk5a7*?{vA6(?LDcb|m zR`hB4k?<|XJk7k{zuzc)=XiTNBnY?^5^0Cq3;LC8ETbiA{%nlfBWC8&CC%M(_DZ#9 zN%K8i*Gwjn%{Ja%mM6&95j6km6jGHWiFkaX*i%Y?_=@L2m0N*8DcIjERbggn9cjh8 zGtm4m#(n=q83MdbP$A#AAOEl7eXjVD;e7R+Wnz83i|I34nf?T0ju8bsgGv@+>Xi!I zi}e+wEWrEp7rr)=#$ylnBx?Ro#ss!r=*W`hRf;v9>0&%wcOFr)Jo_JF`h~x-e8lzG z%=AYXbKIrO^4vAT^7&pi{~=b<8-JAZ8V(>;E!_F|y{gA7OlDzL7^vUE#Evm=AsdH0E2x$8hI% zI;CHtIOOs@y9$M)uu$C&;uV~#Z$1o2HuQh~m@8S{FZkP4K`&IuT+ z4;V+o`QA_7S#G*Rizy#-!A4<2eql4yx%^y_MNCc6{K3T#*(XCcrzgdHUDrtTqX(JZ zo+{>`OxSVJriSywW#2D=elJ7lmp@%b4)r+YP*B2tcY>NuPc$;!rIKF+`+>s$N7}!~ zM^&Bs1Msug-ZL2jLNWH%wJ5|BW+m;`|Uk{!Tm zrKio3X?KhMOd__LsrKa5q_W$d8lt)^B_BT$K6h=9dowva!5_Aiv>oL7XoP)dteI*d zN?nrmKHeq19|JXf)0eGwTPe8n(&Ki<9;zK+I_`F?zj2;&dB20p`i&CXA(*Up`jvA%yLu)YtXH%DsaE|(qJjK)fH zxJv4}v<`{bMLTr=6HnC|3)f=tlLK@Y=;6ny)^P`ze^j7*RCXn<%Ci!0E6}}m-EuPW zh2=z*+QQr)w9iF$KgHI!Lt)mgkk!$+<0+=cB(i-tnJAlyuEP- z@x#HR9M@_dw}l1vv^;j?PrtqG@SivD86A_L=Xv%m1^Q2LOw|m+-l>MiE?C&CN23|o zyl_*RPog04k9jB_b%V*ukw2~C)ZPrphACMkMuosQ|ByYO1t!O^l=A~DpSQlu*SA27 z@6q!EZI27RFl_iX|>@!+z;8mN)6xiIMrG~4L3YaHI^^7uwy`hdpC?z zttBPmWcC5%avp#lXy`o0V=sw_Wz0>yv72hG2o4|E99>!+ml`_%K_mQZ;~%uReY0;V z>;H~Buo=t5rj!L{OD33)S@J^?m_a>~12?mEIQl%0=jWj~YnS^+Xc3n^_P(|L<=|v; zrSB#b@3G#+0KISRXZkmOB{m4er@$*QWN|`f0a-O)_{MS$$1%Y}*O~D^36`Pw1mu-6 znG?-`;)p}YF!wms_J-^nt1v0&^Y;!v%I!)G)_Ha}>{w3jZRI#VI+JhhJD5Dn=W(zc zpTtVd-xf{pgcPP-2?6Q9TqkY zYlAczl*?XU8~~L*RdQ3oM>@DRuRY(xSgm>Vmf` zO|~z2WAmQT6FfE!oBp3ICl5bLwbv?BwhBuu|3V(d=2TY%`ER?drkJ< zzdmYVlCHTPla$G)k9IKm6tb{|%m0}R=pf?fwl!`wEIHnA`&E?B_a`f{Sw2lV>{qba z3ebyf&<%%{5*t8np@Pk7fU_}xhz|pQ-w)WlOsR{?@|)5G|F)2OOcsiG=}ElX)xdeT z5#ZqSQ=lk$N+L-a%*#Tj=>D(*kq=Hvxyt?GPEP#Ae8@mXzBaC4&{*=b_(Jpv|9~NrG2PNj1Rv zU{32%?gyR=4Pb}J-FAqSWkExf{htO6D*LZMLkIisfQADKocp~3-Q}YzNc?LnNF22u zW&0fV?v@O}_s*`p4ruV%AriGiQMx>AkHf}r6>HafZYND&Dsb&QOe{A>+@taHj#X7ucT%{Wa|#9{hs63t>E^*xB}HCc zlSYIro0)iRNBaFI#rrvB{QYlCdjIK9zCUv9{TCdjG&D-@kP2eQgKT z+&1W5+diMaw`Ujmhs;gw40?Kx(s5 zeAL?O?*0@GFwO}sTl`;D$GPw7MOjM3th2TEb0qGke_EEvVb>~x=1=2H>1&#dGx&>% zSc0PE;I#Y%0&IUZM~31N?k|rLaeLp|?wiDU7nY$%y&W1=86vD4FFZ;$AA%kPBA$fn zm*+Cb$U$*N%k=aX%htlyo5}H{?N**e5)^gZ4$iw;g^%n1TDD8gdVZQx7x!1Z=pY|5 z*;gTPZc=MM+0EqMMHzA5^}Lms^OS;&_3=4i%4`jipmcKojL*R)t&n)%U^=7ZlAM!} z!Q&hh{;Q<(=b__278rhsm|ft}$uiUFXC`XF{6gZVPl-=dzFU*qpz%3&8#P*6gQR2ZA0W2b;-*0s{(sK#HHT z;-Yc{2flZQIQwCJHe(m}6X#euhUV@ouhzx0I36jf%MNtaV9Gz1)D8MI%}9T!rJ2eb$qvCEYg!x-b~kV zxC$olTG(9R?OH1Fc9j&&`7~SYP}J(iLCkcNKDgIk0M4?x(C`ZzMA$y`(hv~8P59P~ z9Fxc!3iOB00C}WAaHR0q^)m51-@*c6Yt0FHw3MGI%@X?p`YZp^B|9xXl>PV!6u_Gu z2oAsXh~Te!aKCt0bpu(xpK7ONNFac=P}{8>pWlzv@USIIpK|g2GRL(zx>IoX7#Si) z9!+2+m0$1w1rT|)k&Q>(mEM2RlT%3Am*bj^l=BaAJ1LuY&-<8e20gtBw7si9KaT-F zdIJg0kvNxK`mFrzvm!9}&)TOA;5Y-0VJ zooH?mwvfxRJFtGI;LDk8i%RDs`Wd|`xS_#ufufW`G$h6nfOdg~0b$8=OE+%d-+ga!!KdJ3lFrzcf+J>w|`Wv3&1N zJj#EcpMoF~3jz1rXdb6p><7U6dgr*Xp-O2Sxcje zA{#qRRC}}#nrq&G35?sHuzPEvIc=8}SWBUKR*?<* zhveKq=%t%@8+>(ql6QB^@UjMbax#gkEW8b+bY7;1aB}c~Y%FL!S(h>H=s`73eRw zK^u&&ApWlw61E>s*I#1wKfL`&FVjt(e8eO<7Vb0LOmJeo^h(N zGJaZpRS6<*H*o)+ZvSz_*E`v&d(x`=S*BBhh?NxhRJs3u*L|75eko2aQF+}BrZ0EM zWN0DQS=mE4gZtBSe4PJpf;i{i@!CUG8ldr5?=hcZdp)F@6m_853 zgx614IHUeEi2PN=F$Q`7_#O>*dz}E@#VlPM9O9k=*6%#=8$A4XM8f=cE80H*;BopL zsOqj?4))>#E?$#Vka z2G}?FzR^+8*nzD5a$F(b-Oh3L1kd&~Xpp8^&m1<=zMX0t!WHJv*#0tc2X9~Y?9gc& z3C*<=c+gIgvK;t^l}A+amE;1n#gUCz=bhbe*?#R?iLF zsTK=Y2#&nd4ieig;;Y$je@8BXkEd`Pm;WRDsk)xMF=^PJ56xK(h7GCyJ?9qDH;+sOa<#IsYA zp7mQeF~c@E7lVW0rv2CB8t!mnUA04Y)CqcYI>)&QTr5QK=yWh8Sq;bccRn)o;+zG&e81L6wH^B_O?4JF4S?ReT`11^ zHFj{HW{&Bv&H^*GztZ&O@-$4p4^|%+XaAsZzsKUTTrfHQ?)>uW_8Dw1{@q8I{wxu} z&pL~jI72?so^1cR>01&S=DgU{?2C(6oMMgg`C4rECw>OZpkR{_*u}I zoLakG*q6rhv8iT)&h`gXmPmU4#^mFKpZ8wWhwBZ1Z9~ zv+JaVb0Osa$(Op>-tFMrH`8ke8}Gvw{?f(CKET#FJC9-by28))_<0g)E9GO~cLVvt zHmaFJT)qVcxnFHg;@`G$+@65yhoYIFIw#hsudlp5w$%@j@$GzH*2d2SQyF6ZFS>za zhzee=2@cM4Yz)t-2(o)j*I@NHfwZIW)f8mE!JQ|daBvVJd{#^WBCtbREyt54rR{=8Ml zYGZrIyi$=%o@^AhcUF!e*_~kJU}Xq7fOKx78a_X{9PY%Qkal$S4T4*Q$={@$FV?T6 z)5(8rrP|Asx;p+ri!N>tnMV;0x-Ze9p^98ms9uZPu4oXxX03K0Y+sS)9{|p)1w00} z3}o(S=L2-O1z=JPtej}sCf>hRE;;dgq#eC!qJ6A2^@Zu=8H>yFhO;!n>Nr-BOD^)Z zF5qo_zzt;MHmbo#*S9z8(_|@_xRGjC*ci_QvZ7I(rKnCI%hK&87bG%nK=EWLHs9wQ z3%P+IIX}SaWypC6bt~02vNGHa4S)ZDM%Xv5R^*cF#!e)g?A%H<(Fgg7i&h`-F|$p4 zAKs^>6K#F>46@lufAo!IhuJ%WvYXeZNXYzvIz&qiIX_`c6S4Y{lSPO5yN70wbz8;$ z?Qh#A+2wvQgM4u-_n#+2lkY28WDUDt2;?u5@2|`vce4A7fxJEW{=O_y!S08EygB*) z@hq}pE7j&w>bk5z_d84u&XLJm&e=U6<=#xX=@ z`%pZ|_Jk|(apP6c3srvhYqIsc(~eE!RpDcH(Szdbdj3ADMKiFTY{9zE(dRY}gMQ!R zR2wSACR>NcEIt3SEGNKcBgPtm)jT_-4(ytNb&7K89X7VN!TQJ^Z`H7z8&DBUHNFly zZ^K+C_qR2^&h~puH_KUVoJ8ccN5pyaD-uMEA;j^~`1uj8fouCO+F} z36HmX(nF5#q1tC3xBTN;upUJPtGyuAKaU`iJj{OQ^4|x?Xyl@t6ZiwAu2>E>WA@q4 z6gsee06`J^#-NM>{zX9E-9|M-8vS9Xh+XN<1JwzmS)_aq)mXanMyhe&|LXGVeE-!O zAhL6tz`FgZz|m#;ZFZ*<^bQG%)A_-oZ1VCJs$AxVTd2l; zsHQ=~XG|LTHmCzttlW!%7`I_F#Mb``Fm4@#AYPbVeK;&%@?J#18ds$m(+o+bH)YXy+ z`df!A|8G0A`7hq3p8zO9P_Q~F&kpc1KbuW()2*{~x}&b_><^jL~B5*Icja zms7>}sgiD+l{ND+en>p8{?0q?7#17OMSqVvgp0`W&?|C^3mObbe0xxy&25J7q`&O|{UVRE z6XinC?R+!+OacAx!rx!#JSqtEzgcm2K0EZZW@1wsp}mPQs$ISTioc1lIb17oA1XGM zlJcxX4x2NXB4+D=#Lq(7{3~aY^GtrXmj``QpvX8Tk%OH71QN9?J%r8M|FWs!8YCTN zbJ5oCUFuih&CqfjTsaLt9V%FPYJJ`Mr8RXm+~-v3^DYfR{$gZ!m)g#GmzH7p5C1rg zoKm2zX>$(OhyU=1btZ_V^EXRkz5k}gF$`H)hby#LRiGd4c1~afGC94yUg*d_-$ymW z20h$9%XFS^&o0~^0`R-FeLc#xu%Cr4GRd4Zn$b@N!WfzIR-SP3eL1U|E*% z>F8v8=?A2sgw(JUk%Ha_Kxb*oEdCC^q=rW+bx97K@;Pv7kuT~o-fnlpJ?(3G+bcNb zQ~vpWlC|qfY!*I%bp&W?;RB#ocR<4p5=4CL`wxKby%iejEWSM715%LljC8=~z6TKL zptOXg^Uj5aJ1M>PPOjh(0R`@5`)eowCwteQhfVD3b0<@@r%=IWMIIYVqa_m5cyJz0 z!P1xq=RwL3n8#+a@(u5Oy=w`mVOCE61LeV{!V~Tm1ocf%tL~buREu%ng#`CtT=N)V(If@JTErxSlS`JuJv-<)s>U~3%bSG!;M$Z8=VsvYZn zNW>@3xFE$3Ovk!7OUX&hz97YsT^&estIxc^^cithQ+`2;v+vbfKJ}A1or>|(|E(Pe0DN{Ib1F36PqD0#_qgP_<~05 z&=W=29Nf)>Cgfos$7d5~?J$~0 zjNMdw6k)R?Q`r2I2qKr~h%>sMo|obXsRNyh#W~I|&P(y+khs2hUWyyHVLe(X>^Q7m z(eFc$^8;0j^BqY0-%AjAr=DsZnV7Gy(eL9RWO=LDI(p$6_Pm8R_nYfDj`=yX6{|3w z59Yk>R0C`$v-hTPd}k*7+l9YCw9rm|zDZz5MctrB6*U}1HjbMULpGAj{dW;j5l%(j zkOBo#-b2zTlO3HLlQAa|od>C(jf?*N1{HS0Z@RJhLkW6!WdipFP~QOZON8R;7qHIb zfE371b6Tih06mS>+{gAf3g^e|+0FV)&P)7uE639<9+dMq7A;>R=FTSjcMJZS%~t=` zZBP3ah;zdUs-d^UvIuwb@g+9GrfoZ>hn7&m_Ud`#^<-euUJKP3a_uo$kAx^nrxQ21w=bHIF8fwqt5 zLn?T1HaRojwsl(87SBfu?OQqSLz#uiV1sjcY>ckKx+@=>pukjV-`*p%*8l5a83;Y) z`!$o@mt-JQUkIhxb>_37)Gh?Q?U~T<O|oH-X=~$*sG&Zqm=n z_-Lic3o_+G+6MaC(lz`gV4;#A?ZJGS1WRBo*X z*xX@*2y)!*J+$;;53DN>&H*(X_4T9($C`4 zA)7s~u%2fE#0#7)pP(z3xc!B6pieVpm<{Zenca0DA2~*J@llTa9PluPxkJj z+8Ta7%JFsswW^DsCo@^Ra}(9tr$fUgyWqo-KHhh#b8~Few;ZQ@Ht5OnZStH}Ai{K| z!Xlhvp6j;Bcs|{pg?T zsCER+TFuflJ>Bkp3*}55pwu-5M?LRS>SB3amLYJOQWq)}@te;B^i;fngT5DVumzz0 zD-uMQ+?PthoND2v$sg}K_1fmz(Q0s=?K5bEmzB~88!x>fc++R`7`-k7_kX<3e{Bvn zKc0_MXXbx?>qiUk*qYjF`HAi2XJP%(M$3L>`5GCuK%QrNohQn-vN_SzSZVs-i9H1G z#2!N3VxIUQCFHs!}ZTTYOc*x8{R9<5r%BgJzS-89@^+5*K<~m&jIty zd`Pi2;^irwke%rmlvHdMHlt2RotOeW(YvsooNDW$OTbits|uWJ8ZRIrU!R-hxo{7+qb7RTI$R$0SiW=TAn!)9V2|*B zd}R~Wj0%aAxlo+rq;3>3A@6Mz_R_y>6zlJw`2W1bceV=dfMfi>JJGq7YOMXZzE=9r zoWK9MDZO^OuJgG$GasjhtN!~XvX#0%?cMTm!3qCq?^wE9_i)vJaGf-*yIr=hL|mXc zC)+}~F1JhQa*x+hZAZOWmstP#I5t@*1xO7??~{Vj5TvRp)pk7u`oo11*?=Un{&^rA z8=->7%qKb(IOksTykmoE$xP+%#eTxi8F#b%>;FJzUxA*s%E?DS1_RC^79 zvlpP0?X54)LUC3X?*h9mOw!qlD?AzKeJ10McUL#Y}F?TeXR5Dts%P9H-~}#(ctY zNvyaR3>}R>e2i+Wf4Tm;>w5jwHwz*QHc`!&!S#utAMzKM^+^1DD_M%o8c+wa*qD~A zxrc8g4Lhl}Y$`T|ubexve3LlS@OD7MFBOQiF2*`f`?DL#Umm5}@`d5Mc9y758<8QrC|ZIQLBj&f#_s`H4>rpOjI2whg-9`s*?h+?YrB`GKRO z(Wpgy>?W6B3!|if$GH7cPGjKYCSH?Kd>y5(p*2iq&Q1)K3cQOyY!+t`9WoRfRoINm z(8KnXDuSM?>#(`k@?Z5UW#m_zsn#b!v8Z!Cw}tk&tXQNK+w#txu0(72IBiO~j$Xq;+Vt zLL%w4XmX6%#2T~=>;IM~u!k-SyRY7}OZaJia0fol_pHmJHON#sASQjN*8C~&Us6qoCnIAt7^2y3s? zaxQPP7q5ynFKWjrvlPsOV^lM0B@&&EQ|cJiqG7BvdG~XKb)y<|?xTrC|C9mn_Ww~9 ziocHFtSaIp&q2gTa&}OS=?zQ|-E@g^*?WGr@O_wQ`$InR&JL<|vN>&=6pMc=H1rKq zkyqSHlpT}&;IH#d{nbl9tmp4??1A+7x_DB=2wa*Yku&q#(dy7N>lbzZE&5C&)i4soR55S2i1%v|D1OG zF{*L@P_FCbigvrlPiBGY?At-LDJR(e52rG-ws{_PGySm66Gd$O#wmV%J6q4KYbT_N zCFq?P+n?ZCiP|9Y<&9M9u`^kMNGr0DMgGm67liL#$_v2u)2S(JAEk&q*>3=xa`>X2 zD3cva>$rXjQQ(-@(m0K|trDMCJG#bJw zl(pGYK0E61L9-{e45y@E%oBYIbiX6!kq%+6-%;ZM1$&FGP>qePw2k;s7DVdiWo(Vz zSI%`Z^}9F-3S^f7)EjJ1RUY*)orCvrQ308eqM9EdH$9KK03xk+Z1U%4{A9`w;rE=@ zD~7&)z29@k42U>43O%`$irCI5I7-+%zRlwP7q3u_=hs(AhR3Kj<>pNu$7xvDvJA{k zw?itkT#PTKs~woF4lp^QK97UZuoOIC|NK_95bMz}=>7#Y9zKtr4W-!sm>p8B^KeR9 z8uO^jaEk9^UI?X(B@%%Jn>}fpdF$;ssEfs!Ky*5!Ua6y+)Yd=Xv#a3~H=ViQ zWAkk_=rA`vAWeyS4CuJvhuzPW0i5;st4EDF@uz{leu4k)P>*sSfF{tR4`Drd3z%Nu zShhvK0*Ls>)*LAVXz;(#y4HUyWXB#7=|F*dqYr`Z%M$N0ncNDCN{l9~0~9P~_gZ18 z^*f*cX7ah_DXc>l+*_?c1MI^`Bn95|sp?TLz4S~|-?YA?(Zw(!KkB&Oj2eEDQrDcm&~vQ6()~ZU7wa%uNLmYVswRX} zUv8q>CCjJ#%>2;SkMh~RV!*O>{!sYs+n}4x2R8TFoS3}sM%`F9|DCh<69c_#0qgL&lmL^x;yGwUkIu102HCD8V{34i+oYf&!#}cr$E1* z%cF-qhcY2zlwrN*c?i~i7lIoOC|k)Dj@_su9Q8y$3#os*LbcPCSYJO+*x{p#A@x3M zR}a?x3S=9yRPX0{3pjl%)wPb`Mo;b14IXJ9J_1==JW&tmAgco({G%`ExVhHjyBnTy zOo@6NxsI(qPzSziA1(Pnwyy@?&yUJb``nz_wH}tfcEQ6ut-K0S@7tj0k`21Q1F(2Q z0)kAAwcf?&p%Xv~fL)x){O>5$wq4=8@jacF@6u0PTv)o#Iv0*!q(%QCL8SF5te0g$ zLzfLA>Rs1tn;i=DL*IPT(@3?}wdFw{s7~KL$e+vBy3-#HNU-raCbRAai2OUHE~}6G z;m}Rw#YTZ4(}$y;mnn6n>+)MlU3DQy)qMd{b!#D2_b{aD8X;A;A5wKsL8|VXkouLC zS1aq!@~DUBxqKe^Wh2#oO{ptAcIy6@Mmj(ZD<;(*q1463(HNyJj^CZ7hW%}-`;kfW zKaKS;T=hzqVS~0|i^FlK7IAJ&I!z;Orp zTpznr_t~NN%o?1MvbK4QYMh$MRCyDEx0aoKVc(|7sRQZn!FBRnFL*`jT0K zqY_jvxealf1+UklJygrdz-G)X&TFS2U@|2Yb7MWrSLcDd>pYS)TH3Myu~WTv$UcDJ zaO-B@akfVr-s~GKcR+KVj7>J@eH(9P=1)}0W>=Hn~z@oHdukJ*XO zK1{VT8P2l3xP*is&EH0-_7ansW!Sv*2*=dXzg0)IeQwa1-Z(<3D{lQZeq15ulhuZc zMyUo^4c|9PHCE3d83Hv49As@~RA95afpc60qZTghORU`T?7$$Uu3_07VEN4v94LXL zoD-<^^|^Ulb=*uk8>q&{QF=_(>__=OeOQdCy;nF_R>LcQr+ggdfg0vxk^8jtH7{jj z9H6Ml4)-n^qZ-qFO&fFvPu)V;dmYXP_S`8$#NG1PDHXX7!?eEUs02j%6C+%o?1xnWQhkMLHujAt zu$cdI17z(Lsx7}lwGSzEasR(OrgztQHUUJKZa>6rDcJ0!wD(^|Eo^32ySoWNV3bnV zXRc6fXd^ajuhO2Va{c?Ymfa%#zVtE<`geG$Vj~2Pv3fRWyKe*4Ufo|Q z#`kD|)C`2WVj;|ZxDVD)E#|@Iusk!-3edyTEVz|CRztPu{z_BI6&w*h$o=(!Y3cy% zL(fQ#6GwTvEw_>;D;-*i^=bt^$8;pA0GrAJY_=lluzeNQ;W0IQ$Z_K6e>wWx2OWLx zaz~&0yWfKR^=*(}_$1^Dxp^yz)(9V+TnT!b_H*3laO@$0UlR3jJpZ$X*6t24nN{_Z zu3;OrSyE`dE?mIp<6++d zFnucpSHPVBk)oBL^Lnphx>9a^2q2QX3iJ*8E6sWHD^C5q8xj9ha0>sp6K<&hoG;cr zywnRBoBL#lbQECoRR#K+zV;ac3XqNhYc05Vm)<8sDXZ&gIWI88=9lbBB;{EFc=Kb%6HcY+YQuy5|{92FWtC=jNPMdtoIf|_VfGk5!<6wdmRC{&qX;t_h-pDChI%`uP`dCOWztT)f9gQf8^$N!ccl1dqKRLwX*awCVDjaLHy@qO^hE4C2A)?j_ ztg=TR=Jn-gLK1!5=>@5N=DwV&-UFIj0%&93^|uueb^WL3bs|M0BYQ&=zTv}FKYyvY z_EUHys(#AHFdOURQ^Aa7mIrs-j?EgkrROh#>^U2#1_HAo*lverjsd6ityQN(bMydi zW;#NDGu5JNL02;&jV-48eUN?mtQ1%6&>G6)i^2Y;S+8_m;q#Q^Tn8@8h~OsS`!FQWN<>;J&5>G} z`=(rNvUNRC2;|F8OJsZrn2$F~3 zcc*#>=uAH_GT6QpaeS>#jt%Qd_@RUh%kIQIh7_L(GXuTg9#p+?I>t?FXQ1rgRU--ePO?kXLY^Omm_*kBxIk!RGyyW>GcP zBN7yCY^GXlT5GudYyO7#)2(hcUfEcUBPlCu z{R03=k=s3a04<&c~tWqWGix zE6qV+-|UA4OGsx3o6p|?=D8^MPvS9wkOk!XxhOutOOa(GXQI}clE>|W{qW!tG8Cnn zk@lOCAQH+@!!c09pRb`>pFCQ^Whcfa)32%(;eX6!!%IH$+BRWdI8LdH>31;@aZl&j zdTiw>S$UQ-J&4Is7%k!N`+Vfx?Si|;kfnfW`7F1hOr5n&L!(tz1)DJoJ8Zub#rN#5 zG%p=PBp;v+=VKjwC>z&<{__T^;oHDu_r@}DbNemO;GYW-SOnyC_N)xd@~PM~LVe3e zY7xQn)fK*zearF5uPkT%*Xn?tzNt{mbl6wfej44Sg9D1#cOP=1I2(_WB+e2KxUn9B zrP-m~-l{cD6t7^q8K~i;S3ECwqBvrGZ4eqoMEgTdKBm%8J0-gUPPp&!lnXsSU0M;jWPVOz$b7TEugbG znUrTHI4964v8Vpe4dUz@re5pQ2~65?DzFEY9CG_M!OsH{6ti?gvO+i(V}_%Iwq$j+ z?322d1LPW09mKnDQI{b*h}V}rIwqrLT8f%SWrZA&g+9u@JNOLfPt}Ncflir^oqot# zK>RVm>*r!JZmNR}&QY$*&$kFjI!`Yk&T%+Ys}L{96Y*W_{sDl9{}CY7Af2t{yr2#O z3hu&(7IpoF`%}Bpv8>_WY!KyW6?^e+=vcz>oml%OGeXUh3e5+EkH&Tksxu1kijgDf ziX!$e?A~8#UTwj; z#K!7v*!25=l=TJAp2>g+a^Pm^Aa1S(sXmqg5eaaxOhFAN><}qi2n_|(aI@P7WbmLu z)*fs>nmi`+7(pg$-?eOIr{(+r+hZNf=v$kV-HD?qs(}~l9aDM#@fb?{4_C=9N?n~- zX^#*44i`GGUi|_zNC+Z@)39FcgN9BCB88Z>qw6fwbE{$2*`bRx!hW+hF1!Z_Md)nB zMH(s0!untf=!HxsEQf}_jk0z}0U4xUhYEm%&OP?@N(`hO)=ZE6gk9?N!Jw?9w25TcWPEuo3gGG?t{)mu26;rY4 z%fMYYV@em3FUM|xp1w>dUcV9_M;1@eNKD|*^YOW*h`csVT}*Bqxi`}tXD`-6tec*EKPxRzfie$&y~&O(p|cNpvVUu;URfu;t-Q>l7$2N zJs~>=CYK3{$>J#0(rE`Led8CC)2YQ|L6mAgRG|Ac1-jp|7m<;t7m~E>%dVl?Y$V=$ zE=4sa*Uj&N{=PgjaavZ0Y~@*g8#Y7rSZ|IB--8Z?%dfV{^2;|)BPzFr=8)-IsrGkD zUF;ji5a>|{)-NBF2|^-%W$=5T8y|{#t&a(L5d9Myzm`8SYtQxKzVTNY;j-bs%eidm zWU}ERElTGN7G_I%KGs8GZu4`Nx@iz;MLd?OxE!!PDx-vdnx`rsq}8E5|6!JA1)KXS zZf;?7Uxr9I;9wF#v5`@(w=9H)wLTyZPQ%S?-ha17%yrgRD|u`&6f1LZP{bzX^SS@* z*tPL)I3~^gORkddvbpCI_86%E>zx;A5#(Xhi~VPF0CEeb!M$uAJM7$c+YKGX1Xk57 ztpUiwPx=l6c;8Bob3>k$IJ9-r+`4dWZq=Njk*}ra#P1hfn_ESnyEeDxF8cJjRrk4T zbF2Gv*XGu_&+)m%ukm8eLCUY6TulCwzW(!K@<&V7zmvZA>>`fKhrL+${hbz-=VSA2 zrej!TMME_58WmgutRIV0R1?>S!i!UEf7{b_$_D46jcFe#vA=!)BqFDeA?{Z&REx;q zK}4=LDP69|1ZMpBEnvF&oWN$XTIkDsJ{ToDhSSITh3U>!VDkGHO9V#`k4Y>fY)$c> zTgrJrSzCYkFH+p71>IO9d{&yiFEA6DkgBhn!DE;MJhr$>aFjM(cUUDjC<8OexmRWfkc{=^4{^@mqU+?xZ=?n#Z}lES7W_FX zg2<6EDSlm=pGbVIG?rjAo^6-t%DEWy3-OrvZAu|AS)fTzx8xK+K_MKEq?!|f`r~^45t(I)i z&GPiWbOX78>F!tQYXvsw-1qp%iJ1g+genVZ&QX4?<^8m#x&Evak zj)xQ=WnkO<#wTW>V$ZCzKJ z>|NuxS-v@MPns*Y21)%5!vBuVWi}_+{g4_Y{uhD-ejg;gU!s~JBXW5N5#vwLWh_B_ z?y$Y)hjS45AP156y$U&9g~(6^B7@J!#BVI)epL@WL^bbR;5?)%jFtk^hwr|X9IO|< zo0&CKi&Dz5zbj%?OV?%a?N9hJWJ08>nregXGGS}r=?`J?=QGrB#kuOGvINCt9nj!U z(FkiJw#T7V4kl$`WArJIee75MrG5uw&)Mh7Zvln-o`2_8zNIX!cY)Nf1%SWHxi}AE z-N0(toFkKtxgCvT2NCfDWU@WsHz->l3KGM$;@nbjxK8O>C#m7lV+x`7gGpZn{e>?H zJ64jmhOaJ>n!k2Nil07$^&!#DZK13=M9NYJuJCh~yu{025`H_EYefFZ34YiqUFkf( z{)s%BS)STGH?#HXgRf)#Lyo&Po9p1iV$a$Qci%=nZ@u?k4b{Fj3HNNIc4e1Y|M{+~ zO?PyS-*$~tmD@|$9vLwAw*cUNPCXZ8De(=&@$E?`!sh&#@I~t=1fn9rG1v#bk`BRx z*}JWdYP}&K->{xt+FRb0#+hQ}DXS52rA-J9v**4P<(%D@c^SLY@jL-GCOH4zL5atb zr1=q(3&C6hSn!avSUe;?AgyelF!ou&T_EQqQc;f0S@aqa~J4b2k{bk!|%e+yj1m`Rl#sWi`Q~N?V)ID2@e!&SN3d>;fIcYaBwn{egER#qF+T~jG@Bop zG&ftWpPS%-$d-rrISR+gd4y689fEt43$b~dT0L5=K*ItFB9eli_VGPw8Ig9!b{oS2 zCy&+Rw-!E2CqKu^Pn@5I;!N-R1-rk>!qyvR`+7&oI~xTKBum%wp%jn8Xh~AePrS&| z%5J`gGHPYscNG_CgxyQGw^xR<$IgrPHlCQ)CCcDk{2ryQNQ(A)AFz0x7Gg73tsZ@e zQkObLi`lqhVP_jEp2KeW@)#B zd5oov2wMb83y?RF#>vv0l$u*?C=QNy-N}>X&9G0(XZOCrbpMUmeB-Q`E1lL{0oKMF z!TdMY4j)}VUx3n{F!%F@)n1TzY<$NA2Ez)njXi6@x)AcPLoo!A z8ptZ)Hn(=rCv$Kg+9u=}lT+o}xs2kme1p5Lmr*_mA{Ae{p1=E1>s>aF&wnabs_=KF zvhB?`Y=RejxJtG##uR}OU2E$y>+M}vn=-n_D=e(8cHxW2>#^l_k~3BK$-a)b4W+G< z$8g?G{O_zF{w(z>uGFtj01-gH%K=*M4y4NlQviBH} zy!$0``Bg+ljv+F31d-Ehtr$ie+n8g`%mC9kg@`c~Ort^;=L09j`G7ej6Q(PCAiEOp z%LR!c9xE{W8h+IpFwd={+UYge1>w-5h zC-K}vR7>~0(f-f;Y2Sa4?O!XpF0EVHHB$TeF0=lQuB%OzUE>wlq_U0cQ++nUQP1=z zWcf5RnV9B7eNBOGbFbhmc+}sqe~R%9prrBJjSQn z{|kw{^RD13e^r8#%eP>&Re^rLks)HT***-QsFian&r0}lA<-Wa9OF&s#>E{L=Wy$E zILyAQ?um}>KsP!&5cIa7mJ0@L4MSGD`}YzQy+1~^2mc_&)B4Se4{>b4qI7)wG4`!1 zw73~T@DG%_{&xe_V#woMM5)I1WvtDUb0h+PmdM5w)qv8XvoUFJcef*9zco%t z#0xIYKg!QlvVgQBiQClyB+`zq;ifh1uQU&2r~|A&o18$HO#I9`u{UCM_`-u!ORw{9 zKPc}1Hx*c7_y1aovvxlz;?8-DlZVw8W1|SDcDFgV>NJ}72_6c z@^|wTvf@^VUzTSkywjjzE33PthFQ91p4uo zQ|ZyRF<5I`&v8$Jtvy(aa?6I0^?N>R?Fj*W&-*^l@A>|f$y#f#`}*83_1e&$Eh26N z((n08!R~qSac_J*wDo{C^ygg?4MOts_(5ef4%*P4%4C{UlAp(GT%*=52lqBRy7^jx zdp}ZSdUQmhBl{#ed`QI2;CI|Njo$ITr1$gpi+oGt6|dN6fZ z$@TbK@&EPE_AadBx_KG)d$HYoEWZKFldzflTFUdk8=DD2_BaRYuE)B2E36g7mIwba zb}*yoK7=tdvF;Wy--T@zX&GlzJu#9o>`MvTbzc6j?9ukhXX>*ayObzY2jiBxNN(Z!F>b zj~U8^y!tIXXPC|H41t()@qaJa!Az0Iys<(vk^YTm$vV#CK(^4Mr}g2MQV@o_nSsAw z-@**p(XHV9`nPOZuT-Esr4;b|TSWlAwEi9W<Y#>@<%PsZ=|XJ4#y#!v)8 z)}wj!AMRjAnxFp*@}}~l3hP>N7jR9lX7T)1;Sncyx8(Hw&1_jme4m!%4J*ar(4%e& zKXlV=cQ8YTV8vdiZ9AT8g=P-j#bch^cit*&Dx@XgZ486iC=+|;y+E5Xz{b5EkU@PF zAfiZGtZXGjgY%&c>vSL$sY>M6wAj7bvTn#eZ^RR?aQvUbIJdnyA|Ka}#5)(T_JaU@ z}?g_tSDm%#dGTA0zcju~THnDMP!nIX3b9|MHf)l+1BV9U1A;k2ymsGDwI#|&I! zYM~R`FxO2VSjUXUdSW8%z;onnmt@d;);YAw+KXwGqzvlp^oY*OkXUlqH zw%DtgOUY}?@h*TCyCGZHk08&>*V40)F1~{q>AY^gzEp0vtoCPNuUg!Q%NM|CB zhm-Xt;`Z@Uur2re3SO>A;licFPEHkTm#4`34-a#?F_H8Vdpt+hpE@k@__4_a#M~{D zXwn6d?p%=zxyKF1LCd1<_cx7Z1NbzMg^$E6Xr1i>wZliAz&4>EP~L7^7b_1oz=1v7cBsDE}r*FV3W!Sz?|Q_1JZm$u9BSxU(dTk`jxcCBMZ$Cj;&;KNM1 zH3KNDV+PNs!~M(pM7{^dm-W&(rIYiAePdkkm`+|}4yWY1nDI~zF>P^=x~vAUvCZ_s zE4jXj`~QHyWjU7xh@5~0pv6i+i^0iE`k!mLjcpfnc_`ZfrnLg>_zn0?Nz03p*bnP2 zW>`CjX;nf5=Un5&O`6P)Se2lD_f}>cxr-Uwk)FAQn1hEUJ-&dLMVXM-xSsTCE{Md# z#EkR+P0C&S~r)vr^LGo1M+rl%D6e%bDzVL4UG)vZ-v$+W_(PjCr_?9=_EHyP_7U&1xYgD5I4)4&prI!QWz%j(o$-GN_xr zU){T-MxrUDRQNm-kxTHArR24sEbG=DF2hYA|E)Rxvyt1G@fgnUTCm>}@eI1)6AxX! zmKp0aA+MD&Kb}XYLd+g7lsCtS**s-NLwq{qeJDfAqcW(nG`}K_u)ssizpNMgkWvc6 zNH0X!G9&f4$ZZE8EtkHj#lSOAl4>Dl5MVjqhpl2C-oUXAmF?N|R`a3(Sy^5K0k6+R zqV0>p?Dj%yNCH)vLfV>L$@R@kz}vhS%x3}0yQe^F^<|(o0QiQpAhJ6H%H=7fZKR!; z8$oGloC2zZG(%X};dY#3s*bpPD$gTH&jLhbAf}}hCsLJQ&qZ3dlGsTfL@Y&0{71H| zZ+cV2pyl@^uc(6W)6NA{TFVS9vv3a!ebTWb{B2+v*71W=CqIPByR#k;jITh`zCg~Vft z6M%laU&D%&_IvMwt}J@@8fLUG=I?Z3qgN?#?3-MMRGh%~gzqJ_i2f*i}i^UPycQS)DCI1GUS3)Rg0kY z1)0ZTIu1P*6qYqEY6Qp)I<_QL;NrGje4LZn6zSf08HwWFemgB|otsUUtP%W^wFAt* zjdNK|7c9!A6>FH$p8DmP(e&?kvuP^*`)D?|9qdP(c7yQk4M0K5uij+pnGDFA zJ^p{!v16TkocRg##FTM77b!8oasO+*>DW9+4~ck@0I5J$zaxq(@uxEBqCA9%gF^Z= znkwb?)m@<%r_tdNpdTp`O$D4XUmiX6uB4|*iG8wGqO9G`{WS=5#=0Mtdb_<~TZfGJ`)ZJ^DaasvhSXU4`AG9ZKdy~fjN(}HZfsdK)``l(` zd>@J`tTJNX{HCB0J9xYNiMe6h&o(n7Jtr)m>C_$D%#1>5b_K5Uu{F&217rRVRx_gj zv?op|5JtLQcEe!Jqcf=!1EC8@E`4TodQJHWcq*3~tGWFDe_zlS6eQqyE~TqQp1^1B zWX7S%vOw-{aQKDEI_z|QrA8;t%VXf9a8VfUBL6BokDmB#J1)MS$}s4j=^KLyrgAo*Hr`bzZ`eyI>@IVFy!Y* zbhr#mIKFWa-d~9^6?uV;MIv_=Z~Jy0eTOjvfJCh-Fw^!n1hm+Vo0+jGgXh;tG|s27 zeJ%V8re;@-|;T%)3T{@Sb$R#CYv0N9kl-STE{0_&b1x5v2 z@zL^4%$Sgk?>NxQ>FLLW@5^5tSQLK(%yjHnY{So!30sDL^~m~w8wNv5iCxtNCVzjs zeRT0UW+03ny`359Zx1=K(@rQ-xOpO1q#SOX6f5oWJ49@u>P#(Wui<_41puPB_apm+ zO$nYw=dF|Y%`P8(r->P7?qJ4WHVZkKbtN(XZap)sdE8zo_VgXh2s!qZ$kSU&K9@o2 zINlZ9ma7Y1_ff0V`TenvS^?+xsE=A@U|Y2kMc5}|Y%dXV*k+0H^`ERaJK)|5zJ6B$ zm3G5u0KiTi0&0~KTSmI5l;`U2g5VPRP?M1B-R8`(2LE1({BnNyo;#Rv=zoZlwsj3N zgbl}=6K`x_+!(@r!#DQ$8h#H4hZP7bZaCh&%taS2Hk_U*7(Bh zLau>(^WaqAxgJ6{70_$eG9#G6!n!g2ugIr}Nj}yN(%gHF!BIjsf;)k~~qtT_sPCEZTbt^NRG+> zdpw4O<|SuA)1MCbU{O2+Y{?_u8{&T++e(7I?m}3Ee9ehlnUQ{r-}_wB@5l9IgMGhO z;J;M#Qr7Nl+dyA@=jPGNZi&><64&#YdW%(Vh+VWV<7t$IQuTn$BPLq2THF z^H@mG6DwRw>~}jw9KBE1@%P@(_uy~={cR&NK72y>o>fa)?1ozruaT%VA(tZ2y#SG_ zozS`&>9tuxe~PeVp#=To`Fx$>$vMwtfGD_t^R~&f|Kzy8BI!oH*O%b<@ZCCYBXM>$ zGydl6@qi2V^E*A5M{%Ej$(T_v9lY3ww3OIEttN{6en^w)9c4Il>ORH+8gLmU55#Ok@55)h6h1}=h?1N7q1gPl#7+Se6Gw#EzLb{}h8MgyO zM-)hW!kE7uAewt#&c!`TjpmS(r!sNjOiccs9sN|-X{8{s z*U?YC?}q)8Wigy4t8{WhyJ0`VmxmrB=En`pu$sZ-{P$bX250I`B6%u%-m9}4JCTni zb`|myZcsT-i0in&kp5(y@a1V>%)op1dpGPSnNV&u6LWi~OviRf^c?FR`o04<3)eEE zyq4GpWH9kwf(s%|GO;&8>9H3TP&Wd!UgZ*U%3(zgTS^J%`(Iz<TeS|z0mp>M~ zh47AyvwocGu{F3S#C)(xtSy)U5l62$bUovGMXqm_MMXutF3Yd?m z0*1z6^wnyGm>mkoL&rHS27dapMrQQLBF0xx5@&un?&%og{#@tBxgGEz+%%VFG~ymk z=dl=YPrh?b(!plsXGU4%Oa`>>9cAig<6N(F9BG8PP5kZkaa!PMFrVSMTa!cank=r@ z{FBJTXk#1x%{o8lC2(&gL663sRYk6&fJ@MkcrW5GT8VAGr7|OZPm-716XYc)?#ZB^ z&R*x_$f+b3<;cN%{*ua!iL;qrMDtcVv3tHWhTfYmT*y@?{E>MqcSYbMgiVbA{rPU# zzxA=1G@VBm_m%g5QxUaQ0k05F1f^UKC$KKv7GXtba}mY0e5#6jyUh9KdoCF4Uz0}> z4!1uhM^jGUKf}H3tcgMrF35EmQy+Y+Ci-C~v<{3j72C%dW!=4j7MiCTWJdt`~)hZM>f z^#16eMD1x{|MRfO{oS)b=;EGxR-*elg)K#=3y$L+){vPrR5Y9Z_#H_<-3<2V4q_)? zuCx6>%x!MyM_AF*31)De7VG&gm^}-KO|qTxN5Jf8Q2c_zN}5m(0*OHhx;RP*8n@a*DQ(BIQZOah~oS8c-Y#P9GX{;q9q z=kzZZ+d1{D0X0iyMn2M4Eq56TdJwn>U^J-BGke{-40^aNQeY=7U|9%%TX0(<@@;ymy@tCmD= zO^~1*-#+d)-d*`*y;*aAz*_^-0{LXN8C)jLU@y`y`&=}2C)lhVZ1yd%nE^KI2K#~Y z%uwsN9l>BI*H5*@#I{#619Bl^?Q`C&UPO^M<7e=C5#9Kd)C##BPv041Mslh+%Z{lK zSpr%tHKNe?d1jn`p4ds5L<4tA!p4v5akW^mbBdB^;A6yx zWP2ls7*T(BR?`3IhW*9JubrtkK`yGao+0-9jXaMVk0D$2I<(FzBHQ_VKQ7{Vmpc}K zt<4~|l?{FD>%!+0+iMGm9l~#sZaq_Pc8lB&6}%j@*hg!ap>=W_jY>z}KJ<^x%+NBx z23dTMdGDyKb!m<9)@{x(94LhwhrJQL6#$F&C8cy!%f{t(H=hu&w~LV@&L6 zY7Y_bkh1)#cL+sF^6316DKapr)#w-9I zj%n=y+iIvbrz6c!CYjdr#C`_xd^_-Xf+9ApltA3y%YPRozCOkboX3eYZgA!zN#ZPj zu}auia2vx7#BLm8#@JaF8Ez1Ja`YKuhX#x3$n$~+dZd9FT2pm22~auwylBJi|Fja? zK2hhX?7V(b-HRo3TLX@hFXnK(gldTEyNMl?ps%B;I+}uDCBOff+j` zh*;m6+;(>5KU~_Dl+uk2%;?M@_Auhtrs`-9qOos!5uGX7epau@RT5sb1O0L$o@$ZYS*0*I)1B;Ya!2jnftyA#tbfxu0 zN#vmlbV=N175gtd&x|Bv{YRa=Sln*%x$CKK4KoIvd|(8iuWHPB6Gbzq)dKcx03X)H z8S76qIO|(-IsN)ZVGlNY4TqoaFd2>^oz7u|hA`sB?MWF_{Knc!?AN}=48;X`L8NIF zf1*a%L=27m4b1I#@pun*5=LJ|_&V}8Vy6ADEJ)LN{scUCIUQ!qA2=CUgzMP#H1a?B zi4Vs_oG|Si>p#PDt`#M2Si=m2Il;i@O084GE<(7|@m*qOH3_(b^H9!QZeA(3+KU}-L(PpZ3jMMb32>&|L{LcF` z=yx`X`&NSV6vF-2MZ5)T1+la6?PUOc6zN-pozH;%);RO0?!-6lPrQ4M8DsCWa;u%# zv^&6QHArj9lUOOA~ZiJ>~@w0>4RSvJkG5O=)hQI+MWh+WUeghc)q_nE8dOs zt_R_;gG1y=4_Jo%4P$@X+}v&|nL&C1q_=R-QX9lv_}EsEzK`wJ$*q5vVi(pq8l=Bq%7hKDSDKVmZR>c4A+*ni-Zs>}&Dww}>5G zEpS)mYLU009RIE$_QKW7xb8gjpJ=G%a^)|zvEC(Ytl6QN?+ANVNc6bj_=yJS<+%bK z-A(~$LuolesT;c59-m3auLL`F517MgzsR*Nd*Uv>J)6fL6f)PMw6E=Pgxyvh*hiJR z-VvoZF?^4RSzZWQ%nw>@%L-*NZl;^6So*0X9yQK1@{bEtKWMNV+sTf}i$Z38n% zj)-e_RPX>p2W0rH>G7Gg2EO++w&P=s&Y@%lGhzU~R2|{=r*}6nLv}%4i3{?oB`vmI zDa`4p4=%Elf<$#DEdtaI43!lzoKXL--u;SQfU*W{~b!#!J3QT^c zMPbU<@LX8v43vVz(61zY>&tca{jz5EP4(>&ynmP)GO-Im8#+-&>{JyohaFmI9!uv) zD@>>=Gfp^k9ro3C3*v|TM59}a;oH|9BcsXltRLsf{m8HQV*Z*tS5C6w;m5;~1h`bZ?#Q+F2)LeDj2iFSQS-JfOvP6QDtWmxf!QZTROvH-d}j zA-9eI4S?&|jm{m5KU`q_|7gIeZ0JR(7*b8GKUWJ>F<-TaF zL+6~jTw;DSqPzyPNgMG%+wfMP-5?*c$|Tyv>+I*EeBKaK%3Q!eTjA> z%OxJmM>)gz-0$LRkdN&;&D3VxFIkIOrNpdpYeUwEi`yH1tI*oY?V; zN%C}Xt1$8Rab|SO&{{8pitVvKY!4rV>0=wXe2e3J9}x4T;#=_Lj z3V*k=nRvIuWh-8TWk6*s@LI@2+9VgW9Z36jEEK*ShtG?)(lVe2WNG64W4jRtHbAiY zHF*^?Mgh2A`%lIs9p}yW?*6%S>21uga;mwk|Kx%0SpG_8Ag$OvGuZNDXD(2L=j+M? zkaF;xEZpmd>+B-XVg;bZa2-}9w>umPLh^G?ALdt^PK^BW@f9Lwt>iga64K<-RK8@k z-_DHT{AyGBrWPY0m0AyhDFgWG8B?*`;_(i&p}nU#eG8t3 z**PwFVf-F>Xlx5-wOFH*OTF9~BZO;J>Z#S-O#Xy@S zL8WyvP%&|SZ_K6txIy@*{tCpLJ9ym1;zY=E75&*bGnRlB`;f~fWs0yB@8|Per!o3d zF2BBME*)6U46CKOEf6efO?}4Hu^rWIK(tu5;%eQUPqtTo#(2&s>zqsvf;RN|3TE^i zXOW}%3bo2y6k%&8XhYUQgeR`V(JHY2vVs{$tB8%T6Z-)fBGTWODskUZS0V&oq4*7+ z5BZdprxp_1x>n(3f586#%F1zF{{WzFaqK+sTux4_HuVh1J2_1f0J`A2eJj9jB9}5-LVJK_XTmqd1k~M8#xXiJy+4Y$C<&VN#@@s z^1MzDe^G}rbdinEcn;zm60Q0`wn9a>2#} z%R1azY=_eZ?{zx1Cyo>F!J@R^#jOrb>Tru#)!(><8QM7Oo7`sQc`oP5!8LSD(_**Z z!i@NN#>eWICccZ`!i?mY^BwEv-=)VS=OrKFRow;qaeewPuHrG?``vK7|0{Fp_g%0b zX+pf$AsPD8Irax6P=hWKeP||7{68gw8uXAT!tszt*gw_XD)f+uLm%O?YCq?fI&zS| zs_q3>y@|9Mwjn&`Sx3oUHyjTJ=SBtXD)4B?1>D!7F@x9xjx9cywYjoQ?DO~do?Swg zKQPAnIPBN1qP|<5xRe>hZp1TR=b;rdKnD-3I-}$#1|GbMo|y?WcsRbOM~3KM8S|gm zaR6!J!L1K-9bIozn3xei=$5dF-Vf8SrpIm-@}soP55kr9FqmUZ*o&M{q{QU-zd;}- z(kjTGdcWrIG(kW*#0)?_r!A4EX_uvA2OYeDFuu{@Y0f$Fyn{C}LzB7Ar~iAh$oGqQ z9cfoz3FvA1cQOsaZC4ocKg<1sU*dBk4xd`)A#FU@ks>E1$L)`=gjKKvyp6KRC9*6V z)KDB+|2>V1w`I^a;S1-z3BX5oBCRWAv+XOPb-)Aah$4kK?b!shQPN^xDF&VA49kE% zpNp7Q=2v^G@r}$we1d<8ZCwdA&!<0sA}+D8;mrUQ%NuVYQMrhiA&~3k={)DymPR+I zl4t3h4q2+l|5GlJgRDn^{vLrBqe(ZE?|rzA#|KDGfxe*Yt8;MgVG88I{WH7(at@C3 zZ4ao}4(pKCDRU89w0Zc6W`I5IvU2P&kM9U-T$cABZM+1)cYi&JzKv(Jkk}~+`a-!t zacr5}Vi9`^!nt!oN6qu>8yDx_l5NGIT(af7_43h8a&caKyxsGt8{1raahpdcw|QR3)f5R=emo{3+PYkh3)O@w=v@y#{5;YC*6;aucqH&%+G)O z=F#Wtnehns2f%kyn3(76d6PK5{jhQ#{ik|nbTQ`Fw-K1|0*bsrT|F}%EFq?rsl`^_#*CmxizQ{q#x+iy zS?)r5T|G1Sp1vKW2e%h{Yq8t~UCo>3Q1+tLN zt><<=T`*Qm=hX9@L)>Rqa*26Ed?78XXGUtd$gzNB_zpo^NH53s8=P3$E@D1kH0ce# zu#gtibN>mhuat6~yYu>Dy4caH^Z(ynNOS6$!Ovw8F_SVx&QuY5vi)?+a*pT2mNZ&< zdIV^S$N4TyFsAe}=IUkhz`pKQW(;#%$bxY7Y#RHguQ7vUjaK0Q53O+eA52D(K5`YU z+K%)lzQ0rZvbgVlVesx~{41m_Q3QJ0r%KQ$5jt`sGptIHLq%Fjwv8wSiKefRHkU_> zg>qq4iy!nqZ(xRXEwPgbt4fF&&j<<{XI+FIxlzHh;T;8Cd|n zn!#jrBS7oYqE*}X{*|e?-?$$)-^`5QUj^>_TKc_eSJR*0$c#Jq8!QOlF!>Bd7tp>N zdHjIzsv^)&DZy~R4Bor2Ew|O0OE)>+UA=;zu{m&>iMuhjkpAtbZ zy<>`;kju28@hibD25o4h3hYwQhWJ|#NKXEv{6yBx%s9D1ZUe>9`yV51CzXP*wOnq) zvt;bDIjlW*4$QhcY8`Tk`?kB1%l)lpMa1IgF|b6O(GG>!A>=i-5;HKSv@R(Ek>x8_hSpBK-qaYW(vINXlEOpC2A1l{^`b({63EBeDSpa>r&53H&RLhHwQ zLSHGZYupwG$dz6Q?FmBQJ)FnQrJ&>ZI2R-RuKOx^+*i(DyeQ%@A%Ecq%^N(=A~-kX zLHCq^J~6klrDASZERBvVbn&@$I&)iC2>O{TmPUD8tv+a##u@Lg5;X58j$P1|&VE?C zgx(JKfzRcWO0MJO`%>oO`|@}HmvNtU#x1}-xngP5+65-kO+N+bo9K7SBKn*&_LNf4 z3!Obcc<2Mo8#;LnhY_D3oqvjPIV6XbQx?&yOM&x(KVr=Pv&nr%7SYF@KF^eZUNWiA zf{8v$62H5N8P@06XNl-DvWOO!0=H?V&iCvUF#lBI?8zaS;ut?I0`3>9DO@kSKlEsX zeuR7R3NfwUxT4&T>sw%IP9N`;fL`j%VTV)pP6_D6P8sswAKZ*|V{yXeg1jaWJSy(p zFA9MB^l30!iQgSc&*dIs^7W>DA$r0zuM~K`DLk9f$!F8-+}As6qa$0zeXViM=H&v= ztvhR@);(aVjQN3xe2uG+*4|3EodJ*IP^QJU7Jz;wWByx_K2%EiyuY@Z$6@5}OvJD% zO~A(y>RZbUoMS+NR+oot@5uz!dWe`v&q^7fT5m3m#$_nCUKMYJ=iU4k@-Yw#fV4%E zKutB*@^YkKQvhn}&RTBUZEdZM2F9e;WI&5q`C19?`I$p9eNQgo@efz$gN}cvBaf<- zCZ^%vO36H(4SlRVyZ2oWlv`C7=}q^;>R>zmI0J8Mj@-^%PRDcZSqi#EzsJfnaIS{<2g7u;V? ze>;x6?TX&iuH0TrsWz=r$qenx&9B-9t#`|yTGOh{VMU9%V1I1atb--Zp5%I#0oM#j z$mc2H8W*gp0=eZX#?Qd-kSmar}s(JZWi%m`n{mzI5n~sJImN{Y1SuEEdLKL z(j>)+>VHxLtP#IAE(MpjV{T8!rq`c~b=`G_tD z^|l*1pV0+HmGtE`B4*onRGuTB>$Cs481$zfuH$xhq)ei??wTXXs8kF(Ig;e}oRn2Z z$q|Tdoe3OQa5`5Jc37+hOuZPmjpEZH-z8d|Y_ec=gA&cDX_-^l6F7ziI zF6hGl5zg)@2HgsX*h?D&VDdanEyR?Hz~nYk9uX4}%eg#^fcXKIPjT#pl>Eef&OERU zjx7P$N3cz<6MIz2Pu%6S!TP5F`jWUekp=X%V$eqwDe)%qUQ401+6C(AdBi^BolT#5 zxXvy-#riCnm?RG(lkZP57t|9AiT(Q-#5|JAY0I|2N|Bc$o=wcaZP1#P3#!OHR@}mE zaE~OTobPEOQRI7YU5ztEjwt|bXyrL(Y?X=qiIc-0@4_{B$973HeaDhs(BnfF=;fZX zOg*g>C(hQ&bhJUH4FJBz8N>_*ocygh4sSJh@z@>NqP+1NUz9iP%>q>p60>m&iSqJU zqCDjRRSH%|8@c|4*j5JgHD?pk+9y-w(;6i$)*Odbn|z>K8;Ov4As@04Y|W8VSqen3 zu1A5sjrm}1Y=>T)Q>s>uB7I!8lx%C_vYsL?>v8co04_(?Q^aLG0Lq?#0$-5z;Jf=t z9Wy$(yr*PB-t*OB&_RK6J_itdPpbKX97~%d$68;{j2;QfaZi6Q6Wjb7>%(*2dW!W2 z6=El4;5qd0TvrubkYnMwong$MoC!2CCgR7vClmW##PyTzP2;CbJ?p^GwBOR?ShuWp z37zbpi7>H4;rv|}K$QNtLD(tvz-R@+Bx#9=Wos6Jj_(xjyomV%swQi(MhPNSQ=nB2 zYB8w?dAH7zVI@CtV#mM>qhrk9BYab0=a8;VYB8HJf3-ueAdQRdQvU9eJ>w$&-Q;+m z$Lg37mqshnag~Cy7W-43$m2YoSv@*Ae)2bNW&U)GKvwI0N8YUsAztWn!~PTdB%1ag zJFQ4uCp?}HcB%?Yk&|AY;59zIks099hCoh!9t7)is}k%q4zNZf4nuFuLtI#pa2J3+ zasudX&|=(9bGH_=+J&vv_j_VLeUq#p{`W$$FML>xuji>p4>Qe^`&=iC^Xl zIe?<Wm-+Elw z2#=J>)Fo-Lnn`moagO&8Qv4?mHX*#k&#XQ(08IapAI|rZjwujt;+`;_ka|S^7z1e)4B88Yc8UlgC(HW)^VE#PESz3 z;D7Ke5Dq=z&%Ao%BQxOM;)75WO(HmmIwgcB2mq2Zl9XfmN68eh< zW(0G!*hs19A9-kNn$-4Z>@)9sNKg8CU)K^l6k~>n2|k_sIj)IK$m6pa$9zTmGscGL`~{Bm!Qm(N&$^Pafp+I95oGG+vivGScV&o#Y&{l8pB#ao@8 zII(Opy*E7(y8Al%Lq{g<_JfXlif!lP8SDWQ@BVJ*45~%kYxOkurz=c6fjr=Ez{~{j zSrVwH-OzW6%M}X~dz?Cik>fWqLvq18Rg2)WzbM?M_&An_a-;N{jQR1KTe(edapIf# zpr^-tHvOLWi1++K9_Wky%=#ZV&-z82|56TDKh3?s3q_HK;xN}I3zlV*R_#pT4jwue_`05R5+sop_7i|fC{ldNDf^P5eaarzQ2x0E5xlt~wy|>ODzUN{eyN>fr zo!p-I;I=KLZzZA#ac4LC-w;Y$51U z&pe8I`Sn6B%L#wrz_;}G^@X4ZE_{D{;`^@acsw7e>pK4ZErrO7K=^I^J}BNMe!sX7 zc&tZGb1ww@4XmG?=6{M43ntYc_5zRh`*UnF7h1ssYG9TV!(J&)T;a5Bbir|KAA0UO zI=>LOPtnWHH+M;(2Ii-Er{YA3^9|1Vw{D*2`8e`UcNHRRElzj~g{;$dVB+6aGGn7( z_>SOR`VZuD@I2;TLwWwp!6j6SF(WSf7U;5X!Pf2h-mPA(}Y+kaAv8;V zUr!4`^Ok}(bVex*k12)WQKc}P4_eG8?7)WDLa@`gn&a&%uv81mixc==C(k4I;(Y?{l!V!G zu-P+U4y+ORKRS61_mc2vpM-QuID8{B&aSA54wqH8;aH4$_`9iUmwK!6!5-cUriEi~ zC1z66V#5oiwnkZtZFE8F@IqpTa>x46JWX8|swCu1T@lYMl3lkYWBy#y!ikvv5$cfiE z9>X>YHDk>9bWG&B8deGtryOgVdCK!GhP`JIYU`LuV;`;&x}qO1bM#$b z0z(^*2pIb1F}r>}5%cF2CvS6OA+h5#h~2b+nB`N2?GJw&)32tVto#z&p9RA9ht)2A z=UF#&347iz>Vr=^vb}UZ7Qyd0GQBIoCOhkFwgLGd%?ki8Nggl(q?ZaMh;Z4PB;a?D z=O&dn{C;2+GbG@-+{-yVI_s0D1YlZz5hEDusuhSpk>>s0!*%vkF6b%>WYZGRVrC6c zzsSSJX>kK}>=yDZ_mwJpz)+qu9DW^w&*7x!~oBJ-GOlgB^m z_^|$Bh0sBz9D4TGKG6M>XyLRROL99ttv-im0U?tJc);8)JGuulkLxm?yMgCLEB{c2 zR>h-vn{&I@vZ<8#wT-n3|s+PwurZVa}Sc;ne%J}`sxKAdJd zsA#c=E(5*&D_}~8X7aN^TFX5ZbSF+{7d$1?`jyOxe}$Mq8Ok4&#M!_HGQF`j&EsAy z2en+FmMrDDjl#TbP@!vTL@bHx7&DMRzIzojn!ZBJ_c9<)yk&pl<{D;v7=~8q9M8?! z#q;dn@1jRmGGn+_qPrw5HlS!Rs}}k5f<)r7N%JIb`X1u+N$WUr8R&41iTWNltzRYh zZsCJYbdx#^Eq zG9z>^wElfsAF(Ne?p?_YZD*Z*QgJ1~Cv0Fg-V3cEk0UDtVV}`dL!tqYd469kf1m~^ zxJ2Ev8N|f8jto)vte3QbhnO1ywjf=yFHE9`ps2D2?>LakIQBJPynzu#3OC&c)GCuG z(uV7%fj)92vCG`h=h%VpSjqoi*@X4hq-BJKi4XxUBV6JGJt&Es+1#GwadMG8Nw5Ia zZ`C?FgegLodcl5(m}H!lbGYFnb}$3_g036B)c)?U1Zqdx{%$@o%Y0w7znd+A+9X}D zzeApfjx&Rda~lKi`;%#P@6HZ1a-qR-;^e$dTqMEP=a53QUi z3yLz;Ll;bx%@$?%d+1dYW%C`_=b^KmvL|7YD0|IA%c_Na%2f@*?)yRvGhxq-aH1NZ zKYv`<{GLef^G(^b_!cK`g(J5}3Y+8oX?gPh%14@Bi^XRGMLOVbjQRJup=*3vU{uZ* zvb^S<_=c3kcb1BKhj%mH2W@ee)Hab1W-`r@L2Moq)=SKyDHqcmzq#d0Xbx}M-uML$ z3lUzWefSV2BAu}>o3tUV!Esbthj_rT@r_@wLHnfys`hRjmkT{Nm9&L+X7hMHXKNhX zae!QeJK|AL_tXeDIbru3ht|F0Os$>_Pq$^zn^)larLd*Q^x6A>B5o*~3i>NGK&^IS z_hdnzAMe(~b@tC{NEG4g#w(#UlqL8aD+|gCbF~=P$CQw$9CY+Cj@||FP-$*;^c+BB zqf*+^ah9plqsg{-28mVyv`jh6I1HBJ)lo^pHd0HY%~a@1wrMb0*_a`8K5vaW?e#hBVNI5SH-RA+Jbu_<0G(JT}J#s>0#7a_pcYVD&>@ z6755NFb7%-U0UotxqChC)n89DH30sW#?P6G^^MuMSAOpn0CnIq7C|1i<11tZHWb(FFou#H*vk?fl+f9ktTG zp(aW)9G%r%Vp{3nE@E3b(AP7Qv;}4hIUrxlbVru4LB#JuxEyf7HNn3yj&JaN1YI?A zF2zTGae?Y*Jg#bF&Wbc%EKY=Sh3@P@FX-@RR{mSY{K39tTk zkW1Kuc8oCf-|-yN^UnREo%#V;IW|WD74hH!8ICo7ig>Vq1`Zs}$eqBIU5G2q zDrOAV5xY5qMCDxQL;ATo7ic>awj`&5dY#v?KW<-~5zCefx#z6nkP zb$I`pBC`}@N$Pn*=fFNZ!{#bfW8nzXDkUP7Wof(V{t2w|BE zuEG7OzwpfCj{D*jcC?(9t+vcMSsvMhc9(O34 zUR}kEPR9JNOduYATXe7`w|&a7g_E_`D$&-KLVtle%nzI$h#-7%Y( zDS&c3*B@OrslQp5QD2py9cHZJbfy24lAq||{6;}S3f?X5RNoYuUB!$CvWfZIQ5G4Q z2KwIYWC^ePcnVdjcr2bT#tP>-Ti~E6I@AMPhuS6d zi5XGkV+R2Gtt)PbCbOVi?CE9neTI|gn(5=ks zHtULvXd!@)=bFnEyf*fQePZ9i|A#(noIZcz^jV2}a%Bd$)p^6wvAmdjLFabXDSJLw z*ktlEz_KT+O`fatNy+>youkp2(=QnFM?s4nW6VFwZJ~-1_hoTAvqbbV(0k;! z7W5_4m=z)f~rW#RYxU0td7K@LWUhKPY~WMCw6>{_49d0 zrc#yb3NP%-;`1U`+oxZqOWLutm+dMP`uttjzH@G?tM`X)IDQU!fUW6wI6d(Nncaj= zDKo88>hjI{Br2U}hSpwZ4{)DMFxO;?cVt})cKqQw`;_7fTa{q@K^rQLOI*%hGMFoD z>J(v9_bxzr+`%76%bm*XF6rMMXgGOD#0LJO2Y8H?2}W$PALUE4_}R<#Xj(W z&N9FhabCoJZozwO~x1B6I!4V5rDNajZ9| zfiAg(efbNypjry-hn~tWY&F@s>f>Wq2ECF@*+>zpfS zX{`VHm+jSliT2|<=U-^2epx$^>5s8pB&|OyP1HN>upZmudNoC+Kbi`<_KHMz`BYWro}qkVO1WS*JM!-z=QwY3Hkhvtv;HE+{0G9&8XsXQ($gG%sk!v;ZV`Do zh%{P>@2Lj)!S|<9cNLePfA)47wjZ5J->PQ@&rz3RY9VMb9(&-Px{G5ExIumPdY+d! zys1XS(2Dao!x!FqDpSA|9{Yx|! zg0vj~&y)RUK_4Nlg?O=yFhf(sJQ0qc*&wx@-00X@jmXg;XkP1t9A$SvYsw?yPgv*V zs0LcB&BbxW{^*Kn^lYt6cO0ptAobig-O-UETrcFY!CgYHk_r7M_DS5H{H{#U*Kr$* z{KUK*K`+eAxs*02NHieKee%XOq_ci0f%+b&ZwkX!S-!Bp4{EW!S)d<%^2WB2h516B zE@`pdxv&cR*qR0U7}7|rCMs>4?&W^5rJx3#byy=c7wC==5t~_d?Cy4YK<{+JAnXh@ z;NHTvKtt-!H9R+6$gy<@mV%mnJu`R=^fR*X17ULXH7CZxvKx84N3JtjHPxZxMrtPL zxE~E;e0=k*8jgzM6-y<;ez$=$ukzraN5LW2e#fljpBEB zcHAzlET7`pEY1Rb$muulOZq)gHM!rS1)fX$-8qfsIsM|f{qvkG7WqY->etBUrD9t&JmiFs{d=vw&mW);jY-iz1E_<77N)~uAiaj& zPKZB_WroGTH|;iGoj!?cd(?jR8~Z&$w0&`&b}uDort>*C0$P}1zmKB5Ik&<*3dX~B zJ!AUhotzhxDRIR=g?xU$KxVNsRX*Q8nhx=}cufTxQ;T9C-D2H1IIF$PS9l?@rb9eU zN74X!K!(5Hp&@fYFlK%ra@%8r$o62`p4sEXca&AEr_>|l!Ft~uV0&;gfU1DzDzh#(LLK)OS3A!TX zKtjuENyyfh${#K7RG{pHByoN+y#4TjK_*ir|Fh%NGf(39XNJk%e)xboMm_i&zvG&- zdYTsgB>lZx3;!+sUE%A6GLFS?%YrlM^YhP4hd3*f)WVbPw1-VfJya@u9eFh8^+KZE z&NF(pStREq@cV3DpT0w9w(q8?w(oN{QyuLG#^1lo{bPLd9}JvZA;io&A(q-N1{y&N zr+zL54(+mY1Shp{s!oWRhs3}(83rr~x{ALri(F_HNT9Wr-OrXXyRvYZ}BH(5^3@7R6+ z80|OrXYlF$yuT+z2%Db0C1o({fe6?<{h$~aZssy(APeGYTL^zUvmxGY^K+lg&xbZm zwX3uuP`|yB>YH+TY!|FIly_zSl{{`!WB+j+3={eTF))z!{d7X~WxM_xcKybQ{XC0| z$x^jI-r`h=~ zkhfyL=s_`XTQ=ig^Db!NG+%GIyj;>l;&!=b1TFle zU9K^Y`;`vc`u2l$91ouM-&}8(yW4IL+p0{rld;Zovmws%%N`N~4R)Q|>^hs)LNo}V z?zn~O{0zyH=$V|4F5gQ_$pU+Q&s>E!GJJqk$oQhh;xYV~@eic6Md)1Jd~5wSAM z+~jD0>c2~$-6~7Tp#as7QR?|rUgr6B5itTh=0>|i2?R$eum7N%91KwXKTv+iilGS5 zC(4SkNroHE^xZfKxt9AirQ1kyT;u>7 z^JWi$2aAXv;6C$zw_K8!`zDsFQ!G>9aWJ}f=5N5c{^!g&dbEgi1gPG9Gq^PSc@pO# zzm`0L>ob?1q5C9IQ!JM0B$hzPoS(iT5)JUP=T!_cZIac~3VG=8CX74Ql4GM6aO&ORG1wb9WiR$CIJZIbRhF={J z#<`wQIRB#n%DXlZqOC5i1l#Wxpzp;~LL7A@>?^i^d7JH*sLJD-@z}3tJ9r$jJem3b zaJyI5!t>-wyH^0{@+tGk|CIsTX7P5@^TBiX2?=bcaf=-*c7Yu$mhnP&V%-|5pDP6` z)Awt1E!77lcS5+Cgi&WXu#V@nHKihd`^|Q&)2qa={n<@C=N(@gJ_e2@>|;5rG+P%! z8yF^RUV+)XBNBAQWEeo5sCa)Zsrp7a(^=R$Zn81(PA#lBwN;7+0l@F;Ahu~47<9kL z{Dw`BwhGr;a6o_L`$_;7Kvg4)Ggz4LJv*B;fp+{aNMrM$%FNQjk?%tQ^%JiMm1mC% zB(-cZ>OBMwhp2P+@Qi0cCI_|h&`6bEX6pCdX1J_@f7aCSqvwgh_7Pje|`8poCER5TreUf zU>vvoff{8v5|=^X}1>Dxv z(;BG$o(R#%%_MA!%EO2ML{-z1Ts3-BAe-969_;I;eZgXi`TAzF_-wD;#Ie8Wy@+cZfrT}=zTNLEt&X7m{_JR-u3S{QC<53t-?LWeCgOeT>Y?liK_oGPCd;j(K_gn`MoWH#y zw6wFc0+uVdG9`&@EqiaB%3Fs^!TRiNES9=ICApd3K*?I3`}I#Nsos&!vAW>O9IGV( zE^l}qT`q5Su|B@ggYAXB!gT@DmVrT(B}=(1v2#WG?-{4MIgjNOsx%*0Vj3`B+za`o z_fe{2f3P2^rOK4^ zM@0bj!&<(^tj?>YWH_@8vy{b)=K8>|GsgBJvkTH=!*OA|Lkqy-d8L)W5s~Kw_{>%2 zTC(RF-x0i-gb&@u=NjoZ-B+CJV8&dd?Qp1;`zwBE_bGGEhc`UW@rPN^i}D?5i^Vp_ z`L5&hjq<53AEFT#sCB=9sD_`cMF& z&QF5LN__rP{`~XPm_KV`NGeLCbAPh+cykVUqnhP|#l2dYo`ds8ftd9uV+8-TwoJV^%^Cwc~$o;Q3}v7ULiIJJf5)3)MVdpt_Rkjn60nVLIa} zy|C>XauDDD&q}})?PqUZLw;;Ov+*pwaOxV;V?RUr`hS>jl=2C)^^40~ZdnV*#rBe) zIMVUa+yhVw| zEkN)&KKl~tLVhKtI2TqUuh6m=R!1E5i|PPceA%3~S*3o0NWaMl-WXDXDq4zNJ)ASMFx@*a? z_l3A7LEk+x^u}c9E&j5X1X_LM{7@Fbbw*kj6rK-nw!LnQ78NaAblLBM6)bjhAN~$z zYvEf~a9Y&_=x5^{@eOW>af1wz=UxK`7uu%)k`N4;U zb5upUJh2>Adhu9oY{BoJKTfz@+Y(kc^WI* z%*&=erYhrS_-vD1AD@-j&(`v1`_52yZuWz5Zb$c^9?xvN)jj9#y`|?u^Q}Eri=E#` znqm8wynyy!?-lm&(n))`aT>FSd*RG{^34#BbDiMl!2@ZV_`BKMCf;Y;!&l315vW1A z;7)jNCgHTKDjT1SXMMGLjpID84eAMLU)_`p>acC^4oZbgHbuuK<*#`a`O9**v3V{` z$N=t0I`(Q`DXAK#I?e&JvzJb_vl~a#b~cx*6ZKv#<-Vxt-)1S(DKqtbwAF0ZcaWwZRfk@zI%l%-aGD*ww=(^2wE6K{4Vsgm4g9mSe#fx5Vdgo9k6Ye z!1G4TX3rId)52$;{ysamIR5Xo{JaD0ripyi+keSut$9m>bw4Q9Ne@^u>Q{>)Rvyv9 zgG(VM&QXjGQ40?hf)SFTKzvkM1fUp$ZPKD$qINvh0fAIKko~vXXA7Py>1=N`)rYs+ zxpR-^zm9rgXos?=*~T5F^XfBQ)Wh#nG*L0$ucmrZ7^%VUqNW`m-VdbSiQ_Cx{GpQP zON?Z(v!H==4z#lCA!P#ZlqY00L59DO4C?l3s?T#Ou{I~aZzy{VqA!E34{p7d zyj0J99#Dt#<|{^f77X|lv>9Qo7r?O4ezWn~A%L|$#oM`QCC`uG#XhWr=s&UiP-4q( z$Eb>Q^sXI8{k(mCjB7!U=97tYmhC@hYjOXU2J7pfSnoH0m4$0j2UgP#WzS$e^C2dw z#SrsFv~X%E#DqDDak3uuDd9)W3KaNcC{O@?B<$vEq$E354mJy9un;Vyg~7#O4DJ`m z$r`X^Q9C|Z3RVdC+NMguNOb@iTmc5s+{uFwJGla^bv1llQw>+1p)F$T`r8cqqQ9qk z!rv4U_8C!PL=ssnxrb%wwT1<9al72J@z`~Qt@qvB_5j#@{GMC5{KM~OB}b1YXknZi zb2}Jjhd?gY3nX<^V6j~JTgf1=dm;~1ANc=KAax}NKXuLandCi4xfucvxyyJFNWgQ%Hhm(9P9 z^o6M2G(#~C=P1S|5Lymrf!dU#7>CRG?_d_FjX6rJE)SxO_C3na1I#w+Vz$xUQ*EPe z2dHmUQJuwNv}yBEu-~`!S{CQDJqvnKer3`m`(L|`3#sk;?J7^RiXqGB}XK|%A@xvqXuTH6|$*Lmn>h~Ccp-8fBe z9;d3gUolLyd71xZkstCGkV7bo_oM7vSZzuriL)W96G}ZrpU}$le;0>*%(g%Jm`#+X z87&LCkZ#V|=Zu*-@iWg8u}{NNb`R3ZE30{)K}IXfMe_Ds#h~*XBgNTJ@HVrd;YW~c zUx_q?^n!H7{Q8dyEXFO;&$b*e=vxpozY7M#A06e`(Z~!X1~9iGG6P~rUl%3Rdsxho z@Yk#PSu~sb$O7hjHwVBSlcDQj8M*=wEhI?i7givR?>=tUft6&unb-eIEsu@!_vkb- zK1ruv3{oBW(P5aR)2Bi#_noU6z@6&kwAr0ANt@F{RNpEpMtcaN?HkmG@g3$tzD}%6 zasjhb`C7XD;9SV;*vL4oLYhu8nuZo3+m4+lLCZb|`yONQ|71|>)2-bzg<^5^FUtitg`p0 zb{*+PS_9}Cl-&LgDD~{ZeJ*l86#N~Z0R^TsI}!idT-VwV)t{E!YgsXY6BkN7R*)<}kWHFp;~Z@G7}m__@n&=9@QnWcOEW zzCM%lbr}@n>(@iU_qNV;9Ri_coeb*kJSf<`b>|ZT$eraf#6&?0i<{?fE6)dVas$ux zwhKVL)@$caW4YC2miy^sGygw5m-A#6)6DQ)4+Xxhb6o-e%Rz+w!M>zsD%P$Hxu^lC z{gqtq;aJDBLnE2FXX5!#fOLs+8fD+tMaWI}{V@sDtgSnrh=^I8kk9f-ZQHd&*|YV5 zYqynwG?`-rF3T|jnK?$JM9*@ryD-@b?p&0wsN+CJ&KTPV(KSY?=O4^%EOTzxr02Hw z|I@jRWz22tznk07UUhDN*>hGB6Xh}#3`>$9d0=SABYVzCg8w{=F{p*d3&HYKQ@w2l zMDs*Y_lQt6Y149@s@Y%9QK>*da@{u>*e84vn%7cQ?*14`$QCu4jm3N{px=U1I zoAS7BvIz=XZXf5dDN<4)%N>Wbjb-2$3kkMe7UcI)!;cH4~d1RUuK^?r<>W#|4Y-JdADM8i(qJ=g|V;fe6nWh`D9W8^~iFr!vwRn z@Y0&8Igfe#XpXU8R%M?Pj8fISlgD-6JWAE>2bS0V44|*o0pzSSD?!D=mdB8vI-p>X zQqS9{%Pkj3@t1w15VYeXX+LM=gWKzShBy3%ttHE+fO2ge_kS$Ud*lt++%%#9^yB}c zlj}*{l(O78qm+8+QRnO2E?^j}u5;Uk9^Y3QINr)5aQgsdkOI+mC#W4LQ|^Ok&oqvq zXx3o;u3bO`rxsp7scx1jmXZy9s9#6!VEyQaeC_yugs2|511xQpVtn-u#S-!!d81zx zIuDA9bx?wSaA?O5hIp>fZc(u!A}<@s0pp+uR?4GT+I31SG6M{)L@^?>z=$*f5wf7K ze6_Mo60~qAAJ#Xyz}V!4XlS6L1nr(WfYYB6CjC*H1irS7Is6U)_0w}wVFGQ>OdnO$ zr6LtnKU=0)aTm914^(p-KC%nQ?Kg6p73YlkuXv`$)kYh4<#MXGxxi?f0oGqx{5;Kd zHjQc79_*nbQ2}*})Oefbex?zHVL6wTNu1r#k+3WS`(x zWHT}EadB$_LPQh&Ll_L2=9oia)C*tLV zL@hjQ^T<2Kc+T>PJM~X5B=3&#xtOT4;g>zFGISwLwZ5<@9S78ZVY}G#mIP-mRMat_ zH}m1IZ7YMKmZXg%JK+FwXEnA&2WZ625 z<2;p31dy$LGMw>^<5z3ruE{oDOt*0td-njGtekAa%iGv_wKl?v)h+Ti z5<#j5W$5+2d_#Kd1HNuQ8+#DHzn#m*9>npEEn#Dign^A2+hy-kZe%%1Ch7hcJ!frP zoSnNi!SlLG{xt1rERL&~_+lkHkFL^k6x7#^DRFSvy1m5O{7wiM&#&FyI#SE(^4MMf zyK(|o?tfAQYflas$YW53w2Ap2w~teG(2mQ6^zu)iqB_!B4?iPuy>Fj??O`z`AQ5R& ztTYZrv+1J|=_3nzWd%riGM7Y}z}gEU)7>OfAZ;L?b_$?+lesJ}@Nbcip!|tUXTQ^O zRGh9I_a$?QDanc48~NHX-gV!N#7(J=?`Cn(wxizRPN427ffjy_QV;eS_ux}?6WC|} z?bNnY?o%vyb$KT^xtzhdz_mCxWlhp&d;&Z7x|#B`x%54l#`pz)AGY`SlygB|=Z=3= z=N`q{mC?_yWb{)>_w%0rzMtv(k&ODmbba-IKF*52*Jn`+V|$;;=yQF>JFC*~{Ph3) zo!9-NdHS?s)$%y6{<7;K>dXQ)DWMG>xWcawSWf(GCf699)K-v7lzQ0rNCg>9e}A%q zTu6U^zJi=hf3IB5d>q(!c{w|qX5Y;UaytFJdpS9k{{HC-@_zdJeal&_vhkbk-`a8( z^Q?*G|NkZ1-|0JLmSd6WNnD1c``WP*`8QOGGB6$e6oAV9%c~&bnx$^lSW&pTT z9Xx*$%9rFas;3H>9nbs#>!9#-H`*DXuz2&E#-xuIjZ+o-!gNv3R9%!|S8t?x2(;rL zOx%ed&B&=OBpS2e431%{p2z#2vh$D91z4=TxTm-3j}EU)Z5#eg-BhE1V+OC3N=X<9lOrJ^tO!A8N0K3}?T4ndurKUv zZt2vsx#ToZeajfulKDUU|CaMJ+HL{*Q3v2ULt&yB?Xyd?3iqUtuZ7DNLKI|9ClLq4 zPVsoMfy_F0;k-#OQD?-#`PJohc`X0p1eJuq9UKSZ*X-Q+0E&UM8F3_Idqrq*GJQYD z@b-!b>Q)EDOyoTx1b)NL(`VWGvp}jT)w{=OWr$%J)9Y50z&TE@+mBbW7)6H9ncR3* z64u5=-vg-s?1PMVj#Cx+N8AAgzHMb2tPDMQyma!86Lq*&n@6VaghOe3Z5clgN4ppG zl$jYc6`bgso72=sRjhB{SUG_MHd19*-s>D(n&t~!-xFkp)9*)Hj`6LLDneIM9lYEY z#OH&OkVx?}_yLg1$d^`99r@r^U?tVBc&^kCpFL-1CDFfOM^+*3@mcvms`7!17lKuY>-x318&WogB(y`> zb6^?OCD2^m0#tRlU`s>*wRPvtJwuYTRs_uz@*XV-Ig=Zc541kN?}66m0fgJiKzv{* zdv6K1RV9DsS)#2!`C;1}7t$H-hjsx})TfeJ+VS?Ass8f63JlYf#?PZ3b~H;1BTrsa z!DT#-34g=c8b%{NfMdRVSla9B)tjLUz!R2~;7-bG9 z-CHyV7(KU8J@Q%6Xxtbwg18?yiUziIgzgRF+Oe2;8$+lUtQF+s#xf9Fd@I3a(!F7C zmsX;=Ag1|&q-7AwSTP@MutPobKnweJG+6iVkT%Q*x$|>QaP3ys1a>d{RmpCE>W~x2 zCbO)z{!CeIvkV1oAoJLD0LSX`;bX4=s+82i5@|Cgee&d2G!d$q4~d5)(&2 zJI>>Fi{#NI%pN*}?_54VXte_Lr{zVXs95E)5(~-6jiHsw6QO({JC;zr)uCADDfMt& zg=0d!>9Yycn+w6J+R?z}iS2XH-4rtVJ}(*?jMRL&f}dq~H;Kkx2ahMdb!UU6tk%Nq zB|+;a*$~&7MB{3{2AT-!cb8DTlG4hr?rgA*^nQ0DN6pW2LdGj~RQHKm82fa%_r)!{ zL@k`U*Rd#d6bLN?i`Ii-)=|B$Nn|m0C(puvHL>45M>$q}JUcid?1JD>+?y0skEvz!;8g=eAe*({KzoywlQqQLB3O%yxp0N7mxKI>ul1F>^&#(D83 zZJM2f$(>k#gH0=6X|T*q{A>_1?kK93P<^?5N5OqT3jM36|;t3~R$ zTZVyqWEi;ED)(I26(Ge2Z({js{!@YhChP9xvaU)Psg9(5k?y?gPH+yW(h_!$6fnnW zRU}6VbdS@jtuvIsUa_cU-8fYv4kb{wMv5MgKrK_Gs8a^D>Z2mZ1!-%zF1Rx&@`bAjVdc@oL8l@gphBG(S3nacVi)f+}Xmlunq>IIIOZ@vyR3Ani!387| z0@5hDJD;OeNBeQ_XCeB3E>X471?22eft?5Uxgq{-%Kc1{H!DmY*OHkxQ@ybXh#~>Q z-=||D)`5G1R?;yM8@B*Knb%CI`f!P2?4lf(fo*NfO>Trw*OHV};vZeb;w)Ilke8GL zNw+(CR3QJv+AcX=e`zw-Vq*nwcmEhwx92FvgBk5^$9CsqyQThs4FuaZrIJLO z8{*q5lt9ETKPZ*@Q&I^Z+tyn0_A08QJ-l~@@`-Scs_~uj2FTLF_hP#*))H+el(IX; z9m<|VEBV~qPN`l3*nVl^EvBcIu$-D-S@hJlpi_J>}rB@q{p&RlgTcFC-({kJZ_ z&l$3nz{Xs*4lT&Hn;dER04^mT3L;0mo$rZox>*3V*##sW53Fq!)nB#!F*=v=^YFL` zohm=07=VR0k+0oE^);Diy;JVPUzxCBT5Vr4o`*|hI&B&&gmz3O-jT&JIwM$RrzE4e zIB2~$K1nmEkHf%Cp+w5$Sl=h=sSJ|b}c z|A<{SD8m5u(O0{Iz&$INPwq*nI5Eil&u6X0{(Ww>7Or2dg_APG*?4xZApaGhx*|g_ zIBy_7p?p0L+p)lf&7xu69lRocTF3R1`P0&8*Xi8bs2|`wPWyupM_GtEfp?)|z_v1% zcOe)|uIy;AU{26l_*=o9-WK=5hqYOv>7+XPg?`gqmmZQUVW0~L>M&`n2-9^!z+}rsNC5AHHg~r^((0EleDn* zSHZ&mwF_Dp_3OW0Pxbb{1}#x!xFUAWg};04Hu1OP61$&awxsX*9L8I5z48L~xuE1p zY^78`v4!hbhc8>N|5|(*T~5Rf$hG54P0~-AcFyewGL?Rc5;(WXF{-1^-TtS^{rvUC zRB!(<$oOD;#(r*F%;WA}xt}GrpC7XS$KS7wu`v#?F&3|!7~>nY=`j{1R?u`_hb#Bq zvx~1nlO2=eO5^;_4e|YPVLRvhT)&$f<37;B-?+*c*ZrL_-umB+@#c&%#>X<&am}=e zF+NpG_45Mson-f=$d`)NVqemH=_v`~Y}|KF9d{By{ruv|`57Lk`uWRq|97PK=Zx1k zBaew9pBH&y*E((RK0?GZ2<1eC++-Gx)63~vL&ij@G1E}*}2ni&X1!tB5 zxU1>X>I*H37jPqeBw&CqW*d2wHg8B7XL}?h;i~Eeap+ zz)JFJ4UZ*z^ARDA^LJ4KhP}KkM0H<1JLfSP0jkPIr08#%Pb<$Uck4`uo40y9K~@6$ zb~aez4rv28!Q}(76J?&_O_r1^YXShG->WzS=9d*KIY#@>L!@Ru$|wm2e2PHkqirj* zm>5-;kGUAYT@Fe>6ui~qoccGg{U#7QHE*)y7S?u_Us0R^pA#5P6M0bH5g~s4O;ksH z0sA$?a0s3RzQ^aCM&8foaozrH3DwP3#fps6{)4uhp3Pzhi2lfRL2E`n#3KUqvp9g| z)5ttK7wgUW5TES@!uYov0xa(K90+vpY_KG760vtC5xh64I$Z`evggS# z$lY7^iqH~2u9YkfG9KU;A7S}#k7J#o4ls7@6ifg4dXB{{$1)v^Cf2r!!s6EO-jcW| zERKiwmh6=v>KE93@|jGWu6dEFUK!57%K`F@YO3!m1a)YGVl^F{Ng|~|t8t!_oDrEl z;O{PlDno=mbAw{lNnFOIHYk?2l-ovWY)3bX>**wQlECaVD8}z_dLE@J|1V_tBrw3a zI_AxV7}A1wbI3qD6LLUZC)oZrdE5q#Oaqn0l5v9CZReIyWKiAE>tgYWjwwb2pM$66 zi!!Je?6^-4U8MSg#ax$U@5mF4ufewJUtQu@HkA28m#BXBH;Qq=0R>M}>ZukUt!8WV z?ke)d8mjNVM0Jzu;cj|p%Lx&3PKd6Gvqu#J*S_oWcLS(5k5m04N1+TuK5Mt>9G~HwmS3cLn+Q?!mC(bl0;oSb*H*)FL4kI> zYMkmn;<&7E@kJh6eNK%X6UTW2`Rf>ePuV@9QMOrRb67{I=Y>3om#yS^1)sCy1$iZ& zFVJ)VqnXswBQY@&G8+FxE8+f-G1e@Tlr$%Sw1DGk%m%eVfOwenX#kgh>e>c|sc$Dfs>}N}eFs;Pe0-xgG-%RMtj^{=7*HA?kgW4nK(HP7JOlm?CZypZ9$uh>-wQcLi^ zs2bcHGV0tA{pek));T%OJq1u%Cqp#&E>%;_s{?g&AewrIsxp9^{dPh$NU5qF^>&)| z?9Mm*{ZXo?>J`gumB}+`i#33?a+K;x3HpS5B_O(4{sn*C9N2PcK zThkMgVIY(TWSPDGu$j-h2B4yF)zP{03E}V#O%Q2ja8swQbJi zM&IgXWKb&h!)}3${0@w1xL54?=+4!upT&9nC}^GB1eRgXNx7tj?;550$xVu-eI!^{ z^!toJUZD0|bVKw2WX#1Gf&7wEkDL!ABx&Jxd;ABkHh!nbd=%LDBN^j&isU(b?wvaR zlWhF*Y3bFB@h`K-e~hYbC(EhO%WTzwDzYahxe>=bC>8pTRZ+c6f@pE!o|3&RcG8n2 zZDMf?K(DLy3H%Px)@QVmyQFP3$RCo(8=lchZmr|@vPiFt#@9?Et)e?u*c@W=A1YT8 z+;5?L?J1nQuUw>hppNRTBDA1vu1=NJ%o4s*ed6J{uI_Q_8J3FugOqv-m;Fn4IdpHq z^_OtZ*zzYSLe4C3ReWol^Ba^K+pyk-P|vx0>w7LVukNv0Zt1z$dTY=43dJ&Y#Yp?+ z4oN~{c>5t1<9ApR{b);w>$Kxb{Zz+K9+#=mzj-Cg^;g5rX23q1sm&&dDz-SXa&iMS^{0c}d&E9$EtyZ3W}D1yskn$=(;Yn9X3I zT@B8VVSWLOB+k=Mgn)TaV0Jl+{c;Sy3-;Xu&+FD+!gZMRd2+j`7^58mNqrfNU7{9l z&rxE66Jk8pN|FCN3wcgN{Qif?zJp zZq(TKX+0Ml$&Hb6C}{jC6o8!EXkLVvxmJkbI7})8%wd6y)C;i-4MOZduMkH%HSZK+ zp(GG*IhKLgCMDG^0-rp$*agZebi2V1}Fo_ZW`UerMD@|7 zigivZN%Us{i#z4@Q#~$0^?BSUcI<`|l~f-rL)oTqfa*V+p;+f-=<9YU7WTDq5%ayPN{ULXY&ArKBB)7r$5Y67L>ZJ$ zIm0`A8;~}U`+FUpp%~bwMiFfoC5HV?I{0|HXRtfHSlvSIGmH9A-H60+aKd~g;FC*S zbs#dIBiOC<#6@svhh-=+^7V=W)!>E%>EoUsR|`lIr7Zn9$#owZ{S z*?BnFop=yz|DUCNO>wW``dm}X>GOjVLL6xbKap0ke=Mf+%Qp~#`Qz|7AEgU8eWJWh zv0V9u{&!CZEYIbVN*>Q6{rtoUAs(T$O3Bv3-68~V-=>Cu;2w!Pk{i!HgnL%%VX;kH zA%=D6QF+8uOZBF7OrWJxarz2?`oeV+z6v(}_GNSbit${qUde@cskPHR)ADQ3Tk(2@q?=U7s z+sCQ8OMuG8Bi_y-hZdfflmdbb1&v31o#pu52?ah7a{)9LKJzA}0JH7R-ex4Bt2#1+ z#o4He%;Is?BC{Zd{ldOf&JS8~fc{K>K^AjNDonKILOkwJtTa9kbt)Dc-JyjEjxh^* zaa{YdwJ^H_m>;xW;xW$Iod&jnvb!-C+-Vt(bNnj_dhd5?;qSdIlF*I@O9IVxt21Qm za%$o6Y;X@rqJI#e63b#aEOSe7(8B+BIl;|hMcMZfLvOHqiGi!!OZ2AiCB&nG8`o(o z(yEPX`cXE-zqPZ$>YfoYA`URltfYGPXGP+hS#||7I8u>6SGM>a$ZmK8awZlAIESO^_~u!Z{ErMyc+Fz{4Y_CB|N(njJqk* z|05;ss3@M zFI4)>wto8SO?GbWP)5uOCXbs1a=u<9X+ObjSqCJux4`yj z>ds&cv_~0EMZn)1g0V=L=kCNduzv6oRnOG~W60auMJ-HggxKvr7UGA>y)BJnR2{5S ztW<|$)UAZ5qV0VusQ5aQ0`#A|I~X%J1Y>k9SnriXz+522=-oo>oWSDm__4hec00aN zs!juNGhe|ua&(^rs+gxRpSmD^&sPjlDy~j_H)urGb%i4jJjXH8BUIgW2anC(x`ktD zRwKO}6#pTPW|26Fqd8*x=82#fn^r>fQ=?QJltlkLfMcOKKtg98d1AE!WG_gkn=GmV zh@CG}>e)0f?c+7$9CywbxE!u|!)}Ok=UWP(6vo5`^xnVzD0Kanx9zh?G|g&;7j+?`slS4))8jS!o|X za4OcTRaB46QUVcx%7{a;K3T|p_*hQcg_Ai2K+=xiUupYR;U3)4U@doo1kJBJNC>8lpuHmykOtWKTj`P^JKe&!# zv1c#jIF2#}KK|513-hW+N=2N{el(5z?#9Wn)}_a~>B_No zXN;BIgQf2}J91ucw0$IOe(GobD;+?*8T{X8zhm_{)%yS{2N_@I<9ya0*Bh7YHQ1d) zUeD;)>~VJYz}{irITi1QeT&(BW3hN_UO&9y`5u%PZkhYb6@kLfAtJ?$$JgY6%a^A- zfp*u3BqmBXH`cQM&(2`?>IcQrT$D9vi^1l`+V9BF+nV!EN$XB1H6<~D@@KG)@8i}S zAkQygI(z4LmUAENL8+M0?DG-~_}S+*^h{Z%X$zscwR)l0AzTE=P;c`F6`$3+WEi-@L|mNHnUbVLzYEsy zALnb9T8{tEW_vT&UdKUuu7Z!3lkXspZ~?*RLsD_#kPD*gE>iUcNAt#ZLoguTB<*E#M{}P1MH6Z^EnV7KH}{Zklt9=aM=gn)-mMIHySCyO^(kVPefVr|}>Dg>t$T=XAzq z!8WuXgul?LbU)vk)HM=Uo@dy;*Bknod}VRDn7?gFLTTlC2lBae%%#+Fus+k)V9Q1O zOi6|=7`Tb-D+yY$kr}{w=`uFT?up;F_i{)rrjyxPJvtA^016Vx+LOkLRTFgJc zcP9Dr3qrijFIZegPQ}-GJ)pYgQQeY6Hg4oY??}+~^=ydm*dvhc&@`q)r}LL^`n=l{u4?)vp@+HJArs)CBX7JFAQ1{0s2uF@>TG&1C+ zDAvzKFrIgS^`Rle=K;8jWX0O&QUY}_t3}8GwOeH8D!EWW^?eS-8kHdNjHno~a?~3< zev|<{c8s1fNtkkGBS@JsdWsWCAJwrv08ehW2u8Q9!*x3ptNl8DFVsB?0xvkgdT5V8 zOb7q}JrPo}5 z;A!Ov>`%K0Dm#Z77TB3HkGD7bbp0q*%hGoj`TXu;Khw(<1N8!MCO4V_^S|tck8;Rw zE2#dtOZ;r+_HwFs=P1^l*HQgvIbdyO_l}CSk5bQt93Zc8IZ^=I$~NGhWAm`BYy->( z(sLu#pK&RH^Bm9D>&wd}znxF@WXRizbB^;}yo{giy#IGGvOFf5kL7C9j{BT9kXe*^ zXnk%PKh<^Cz8m0rVc`UJb^`1wVuGYrM<6(q8h>W3)RlQ!1#L>lY)g)1?2&hn|4I&M?hI;J%9 z^)*>=hGVT{JI-8I&$(uqoUfNjI_B@iR%g%nTCj>AvH9G4!X%%2ERUEpzlY(j-m-C5 z?{M7Jsk^~4-vfjBhToS@=m%iX$H9V9!D3@sx01j-j<{T*U~t5VojbN|i;Yo7#Xd|d*$7PN5F zj40|{ab!b0wOz5m3FMiboR@@Llj9s3q3SohR6i>~4YP^u^T6)wg4SUN#JvLav)|=> z{sut{f9!y`C(oWkCj=tA-f;<>6IiLuGQ>yFw!amsR3TE0wrnO&>PzL^R>{Ok;rstr z7M$Vv-?VV|+@K}>yAWrzwQv>r_7bZ9x`yiW=28971ENuceHo|vO>GUF{%nktA~}h< z39KDE8!WR!Cg$B>wKs>15*gxc5=8%!Gl`XIlb~h$8(N83a~W3ZZpCV96HAAF2gZtd zR5y=;@fMc(onoYpDn>KF+7qI*_(XVb$#zLvynVyok~)CshuI7-)s=~tN^-nZ7rY!G zD{kPt_pawTK5x{<=QY*-J$#;r`C)uE3*ykg@p+B^5Ab=PqtsKrxv4f2Yqtx;&TenA z#`$C;!`jVa_L*#B?Q&QSTTkNXe5(I%N`D9=i^UGTE|$yky)*`^sO6gy zsK2-IUmGt{9rshCjr}q|P>g~xs$YCZG5Q@)&_b!lEj(Gx=JxJB!Bym*OH@}cEvT+#_(?be z@m1sxH&C6?l8y0-*ch+h_-u^)ds8v;uozU$dnLx}+KW^_2T+Cm_}`;c*I=Xu$5RDb zxQ0^Cdl|T{l8aQ2*to8DY+RQIz#Xx1T}2tVu9+8k4wCLyLJvQOwEBU<#U}nb z$zfxee{*Xf~GX1{=#|j!_loVy}(m zI$>kErrTJqh&@NIkJ{tdEE>Ns%~nYwB$bNCX~J1F&(jZz);FY`YslM|_$prPf3j5>gp;D1upJhnPeRt(Y9 z+f;1_Coz|2kt3iTKiLe{CLh(kZ__HAmwgUqgT=ewqJ1Zu6|3FGcwPV2B*v>fhhx0j zPcXePfMacU@v(k;lw5J+z6(0b5-fWO~p0#}s3O1o7@{rYCp7*mQF7da8fVOLb+Y$i|+k z4;s(mKDTKGb+Pazs(afe=^6DQf$Pu=J0`qJRh);z4lPWFz=+8ZPYMis)&+0ok-_V! zj{Rb1ejo50@wm5;#&KVu4Emx7@gI&;PpV^b-Uj#Jck#6J;+498^9x+}H;2IZGvn)` z{|i2r}vhqAJ)`tg-5I750|<=8K<5ci|Xd3z2WZhLtE1P@S}0+ zVfp)yX3WRmz^LN$(U&@yF}9<8Z1eiA99zdhdu)FL!yHnK)ZY}g9}XvZ9Fo%(*Sp!? z8koWMRwK@_G$+BvmIq|~B44vKo)Fj3v~h&{=3cp;|4OL`dGfR4Jdc4X75g)D8C+~# z(=)zSv8XiDK2J4Ro}u))LNRDzt3~P=l?1=VeXbdX1$p22Vz9QB^IY_(>uy=Xef{Rh zTDTCj@Jm@*_*c*o-Xs;a9I$am-6Gn35SRtvE??VPdrm6!SJyA^3^I&>6cr>;TXUeG zO)P0ygM3SZ==N+VC@$Pnvb^Q1+gcsTjjh$-YAc24;1jnzyyz0YvvGrV{I&A*9l84| z=O{eBfM75SpW0` z<+YX_3*oFJB+~cw^UA4?`t7VGRF|AUkj9&4DYcuPhv@2J!j|_=S@wCS6QbsVy(J(+K}3XrH>rgqF4&g7^NakI_1hIWA_da-1ULrd`8bXzC2(iH z6K(1AJ8$-;{de4c{Qsc}s%yeXP1!HF-r4k5#b{jD6>fasxh*VSDaZA7L2WkaTg-8N zne#=Zyw~}iu;>r5I19iqe8W;!ViH#(+gL70;C{HcUG70W_W4i_Scgi$pi9A`&0u`y8jk4$p?iz@<(x$f$MXX0?fdW0bvHBNyb_) zfxu{57DF^@{55qlKWk%8Gk|S##9vz)FNt8-K&J*N!79UpZtrwUzPxJ(Z}1F-g$xY`KC zdia@6-78}CUME5QdbH0jU3$$ZQ<>VV_V>w5S~ zyymfM44}RXdKm2jl=%YzS!?ts0r~qe`*&x68=yZH7U%bn&ib$B22EmcEV{53VF~v0 zJPdhkPvG=`9=37abM8%pt(OIMHOcEAYS7Sj`MJ0b!?A5}O<2 zIb8tO8C4NJ_pxF<9G$c8c#GDDGV7IXr0&=fC^uczja0_I!F?ESGgYC6)^QQ8FP4->}&WB7vLYreG(G;O5XKV8nD4ar!_llQ|` zen6ezYrx!p#T=f$^un0RFBG01Q~BCVjgv7oeR;^Htt75|55whnNzfE)38Fi+b2uvNriLqF{Cu{)Q|>EFir{flNpTN7%`6!YIJ=G*$luXz-Pdab+Uj1TX7p@L-D~K2onxllXc+ilWXyhCUh}PuaUqkAFl_f2c{FAU-{uC?H!W zuEVzSk0sVC0y_qElKLqgX|ZD!HX~iCu44x#d1QP%buXmD)_A?do5A~I^@^~Q4xE#C zGpOT83>r9AdX7gDcTh87fSG7gX5Za=N(iN|#=HcBE^WS0X4{a&>NZBRa=sm?>Jfr3X&bAX41U-E3HBzS-Q$2yW z>W%q9AF&R?*7p6Rs~Dj1@{>Fw>Wv5*y*2%eWC&CMxFgYP5f#cor*0R|JMnxvsbl zeh}csolX!n6IGQ)qXQL)_hE(N;=@>=3AH z@%K|_d4)1m+JSv)8HPr*(bQCwY1AyykY}g?AAtD==N|lRW9pC0^4yn%>0D3<#P1qvdXzO-)fxirkDHtg^<(!)iu@$ zRf~NAsCC36>(cC2VYt4NusbyxypuqAvR+=DGOOd&Y7jZmbYPF5&zJJpFP3so50Hj^ zDnt_P5InpYSS`>X>JRnNeCE%fkJWCftsL(FmUtL~Ep{E7L^rS=TaG8%f#G!=OUoR) zZmd+<`$K;5x_zjZ{@BZn`cz?j5RbaaD|MAKVqE)YFjmp_n#H9e0Z{Z2A*Y+vzO99j z)4yDvNBvQO@^^|L=l&wdiKapJOUt>D4-nK9usj+BdlhOWa|Zk%<1k9?nm1NcO`q-r zQKNG}0SkF;a<4>lAiHllH}*M)HlQ6w0JdVAE)BLGQG7j)F^}; z)KSORf$0Mpgbc_j_CX_YqK=@%zPDVSaR>~xVm+L?OxPR8{Z#tdb^(-0zUzuXp@&Uf zhH}dtBj7%mSSRZ1$u>VGv4ur!&I-b!=VtQcVxUqB<=kr`-pUcUhfAFdG#DIPN6m57 z6Ts_nH9xkSb7O3sZhnS9Ir5caa2+clcC9E}S36G74f;p|X($T>wz{YtrN}*b#;&XA zT`cQU#4nkxfiCq=se_5W^D9^4+9cLdGf$(zeF{mhnot{WoaPaK24q)@`N<3PDq#6j zfnnbONC)<-Zce}IQJ+v%JH4TA4-?peq%DUB`Uybor8H8uK|gPvfabZdAI?2NMG_CO94HcceS(~ zS5lF4XSQn6XL_RskyGP@5rXiTZZnlefT`I;ugRzqdk#8>MMxs>4g#G8V$XyQ% zErhZYr3(8jfIE5by=iGT;C$hD{ChkMzw^9@8#Dt3R%Ad~Vudn;sgkUL^4eA0h?gqC zA%&W#JHDKOBJ2bGDXatuGU#}E?OZ2|*yQzxDuV2>QiXMGQ`fiVLH0?N#Qa(CW;KwGA9C)gRcJ7->EWtJ zpm9kSeE{{DElyy#M~^NMnBapr2k{DO9aakh4nSYVI%U|2MLgdX8>j~QY{U^tPoobSG zbI|smi+7H5gtpr&sE4j6vVL_95wSC4syp`H3c`+-5_ZHz*kP5h@e?3o+{HW&dD!O* z>^i4cUU*LMK|VK5tgr4nC2*Vwv(J6{Ppp4YrY$sQvVN`0&XIcFD|kS^z!vfJcm?kNn)$f@x&o1(=X0Yi1T*=jSK4jXf^1Wt5}5YG zZFRu>z9NRtT$cRqIWC@wPV&fww!X}v92e(mN^DFefrP3CuI(jmD(34cQENTv3!1^K z|3I!G=z2JgvP+}ZkYekd1JGEjpuJCn#RH@REO@ z=SPUZ#VCG~2rO1-iH#An4$K=g=)Y8h;a@)LWzRGhu_YP|mufJ)eNPdqf3=9UNi6>1 z(96{yhQEHx6A#h>^wW7PGJ7xaaic8$4;tx%iQ8Uj11~r+-bJ-S(rN=x<(Qg-+gV`Za75 za%uqvlXb~dpw^O9YW0A640WC{fO1u%))Gx#i^^Ik)(IQG=7epVMC{zmu5D{9{abWG z)VH={c&}Q@4b-(!w-a@qoYW#3SaWR&ysxBEYa@_j$d46`is$h6(6o#x2cQ<}g}i;i zo2Xmd;eh_S&B=V4f*GIdnPjcT%R%bfSIYRtr(Yvo@pKpv{Iq3_h|lU(p?q#_e!dp0 z&q(|?h%V0fb5!48dFj)fJQRK zBl@;A7SiO{IuQN#DNr7-(b!?+Q$CrKfpWa}TyaJGVU*{dhU#-X60cF%6Pz1wbMET4S|U!=kZpYM}algLg!(P#R)|In#T?O46isjPVAfpckIV#vz+D?I47t_ z9kumB0(v+d`6}lgyH08#StoT?KN_~})}Kh-$c_cKeHV6(w>fyqUy<~%C)bYU)4=o* zJ?wLXIrJ?$f%be--nMccA)5Sqp9T?vXBg z&a5n9F3`;vGF=@gUk1}kn7~}tU{IWAyp_T}C2K(jkXI4{Wz^2=k3v?3z%aN>V*ElD zHATIRugtHv0Zxc?C!D;(TZclu{o(V^mUjR;(Tz} zj_dr>Vmn@I)!dkOsdqKI1$MkOzE)*pF6jq-&m-$FRg1IsJdqRn`NaZnsXVa;X)!O> zGcEC;U*+6`?@yFUJdfd}5`VG@?Uf7krQhwbYhxU%hA(|@tcCtWp`o*JmBdP5Xv7an zhyR`0ZT?Pur!W2e5g*il5Ath^2z=>#kXl%n@(Nk6Ivh~#Q;O?*AIwuXSA zEdkH1vGPDSPiN+JAPt?lwt&5*P%Gks0Ud4iAv@+{2{dlXl6CXHjPmN+5^oZ}U4}B+ zNv$qt*M=y-z!zT=wX_0%fMqKM?uJ$>#sbh9j@E(s2k^=3Zh0MT6ucg719o<|Dr&*U zRd4KshZ|?wovgMEZ3J)Zg?w(D9?uYYVraK`^0-mo28?KEcjU#|H0TfA?Pq2_H@@hk z=8+v~?68^_8-F;3jdi378WP`KQpyV5LO1G%r%Oc~w)i_^sff>pbUnPdh3-~YXb8;P}4^sO^r;*0G)K)T}Vz*5pBZZodaH$Argr{=|ou7|CB@hy?3rgxGq zALnK94{iw->(ICld25>fn3k@OOsbyP(Q%FWTAZBsJ?50$REYYC<$>CCg*ZDAxp-P-<^b1+vt}?&2gmt*(enUGJ=O>{S#$d@3_Sq8T z9U@L3w%;T4iZcAW>Sb9&P2`BDQS10~q)Qh*KzA&zE{;9@9O*h#0&ElKo-GQPQ?{>z ze;dquktaO7rthdLqwmNlm;i+xPnH6MO|=vIHr+V^KststEt$Zv6ueBjj*L?CsOy%# zXEexu3E!=v);iQ@?x$8;hCWi8MonKcbVKU?onxB?-|B{RePm2^i21GFA(X8{}?znSJnB8OTEjTY%H*~aVB+)%O2BD>9EYVDuqhKA29lGhTM)OvZE z8xDMqMvI1Mv`F;%bCKpD!3+b-qC3|$e3Al-}kQynbW0^PJ3=WgqS zZ&P$4Uxi~hCtv(HwI0@>|GirZ*`tJ$wnS1%W}F(_iOtLjiCfKFiCozky3dTwUY; z0f=;=jhzXR__wKfqnjHOxK5mV5*w*?W_Jb~vu*vG^0ru~9sD-q!RJGS#b;jaqO6-%<-1tHr zHSyZGlUh$febEus5m=srx|VjC=G&kyD!9gXzu4q4`9E{p@QlI+T&Q{#J z$Ct7Y{*5%0!;QF;KJQC`=O4%Yy8D)3;`_G*;Wy+~e=x&ho|s+=Y&Y7Xr+AsA7RH`bsr5Z&?R^>jmh zXXfzgY5|1a-L`U#Anvc!8vzFXVXz%-}#g>k&TP zj{8P7R=(h*)_MYiSGZ&>^SeKhXC;De|GbPn>gUEv(8IR?xRZJ7LmEWUpyzzY%?&r`Be#Jb-r#_K5$j6y@ctJhFQ&OLpnnndcvpju z^9XQWrf()Y4Y`d<2l?U#mg?bsF?<_#nWVi~!5Cb31STCh4-|*@LMs zg!0OCC_5x#ofpSiJ>1ywEjlqe%?AfL_ux8Vdr#PZ>wPLSsL6IH}c?!;SCCH50T+oDlhZE;lA_hFe8kUf+dEIQNtQ4Ho)< zZA4oJAX1{y;KrAT$XAhiVSpk1f62!UeD|ggd8FE=>$r;>U+3I&T`DktDh=)eC?^`V zY5@icDX?>*RspVIfmp+%0d7>+%=4f1C)9!%tPZgEIQO(}kZ~IDo{aUso^#LWI3K{i z;yMkTo#mj8jA=g&HzAL$S0;ooil7JlzKA2*&6^)PcAd_?5J1qNKQKIanv z<+TdhBHoyzm>akzn{xo|FH@i9=>cFc5Y=KYG z$&Mp@;5D0Gdnb4V*ZbxF*5-XZ8S^OW>ATRDnRA|u{4uCOKho}WDOkaZ%h`s8%VqtH zs##v?_vzs$ej?8@d;|t(_I1^Hag0ug9M9p#pR&18FL;+K&Lk#k2pbcz&-t-hO&_^G zTh2wX23Lz3was)#@guXgB|bOimbvUO$p><4$~#c*K9nQkA_npAx;$?Dk#i5Zg$Aqk zLL+bn zXdRl{{+%Izi@%|!FAC5R0_gB%&^`dQqg1>H2YsnXQ))-4+y0#)e~Z7hnm*LiDZoJ~ zM|bzFcR=TiFaLn7H8Sl2>*Tmo(!+a6ddQ3I&f&(mnj0gE^dlwhx$AS~nR7zTiyax& z*kRQjgVod;f1R+gg9>w|Qd7|Mlb5q+v+OvE_vi(6dN$@rpR|k#{L4&S3<2mIB6`># zzmCt|{reWwoC7)cc~zNCH_E@dl*Bu$U05NmZxpU{?E zfiE;5Y^>dOZE0Joc|+%k^-AAqRk7>;X?+votisWEW}L8~ z2A$`coPAymhJ&t;*?U(JYqeqX3MTS~pDtw+uSh*ZV$67iz59t=>8r#w{5$IH$=bwK zp?Ui{o(hq(_8$4!qogZ7g?4eZ;8&0$=AyG;HMOGY)PyNsHa1Em@B4tTJ6+NbRz1lh zc>l!xQpfp~^owP~0zJI>w%%^gU|m!ptfd63df~rY9Q)FKU|(zl_Jum+%kcc2Az)*w zD;8DA^YL`BqECVFTSmt~_${%2H@dh{uh72QOx!2Xfx0--dac*~on!ybvws)K-}rZO zOvsZ}6|6xa19D@?XX5u$(|4Me4=L1&pW*`t6tJG>7s0`9x}lG&IX0d`_M3jYe&k#X z#BvQfS8C9Crb+1=JoGVk=q|sc&tfG>pJL5AUXk>9W?YUtxo*FAC)dptYj$xX`HgsS zXdZ2${C+e$SsTj}d!kUpHxEcZQC=*52H0c{H{L(L_Kun@`ajk5)4nMc*r_`dp;!Aw zUXH9ef2LmTn^2X2)u8pAQPse?&5l0&_EYPmZ!)0*+qDKPr2F7%YWdTt=|8z`)V~Ut ze@pXYyxxEC)2|R&Q^f(td)H74+bsrQz3b-hk)cHp*^n*efiIn!=Tu;j1=)pn7p{l9 z3)g?gC(qx-yk%U$dTYSytx;HS6<8AEr%+%Kwc@-140=HiX8^cS9uBMpYgY}mde>6x zYAIg^u&-6%YS^Pfn>axDCO7B`|z zEB2x;@wV*?s7}$t54)wm4`t&ng<1-@4{oH;7$^G3oyRv;hOW|g;`c%tWbdv5E9!*q zP&3_ua`EYQFd+-rn=g{C-Br|bfYM3~dJS0p@drl}o9ZWg)YlQ;R62p{@JkKYyPSJo zQGtm#g7a*^sit4gtCNcS=lv^T>PGm|_wM=Kk`CJr3?x)XO#1WGK&1wq`NdZ-+y66i z7WDAq)gs2R6aMirhIV41ol{u=diZD+SW}tYXjk-+SCqVl3>6}j=wZ#zjp*+xI^x%X ze7EunhV&%jJ=WOQqF0EsQKZ#k$Zx1qA#yQa)%#b{sbt)Su25@8QM*Z&%ooHp8m|DW zdatY<-KrL>MO~&^B@IoNL$?3ZJ>EZLa^p!A(#I>Pb;t<UqdaV-Pbe48BHfNU%}!vU`?v7z$=QY;Wr@1c+kg<{1nLEpysCko^ucO z4P__N)ScU)8)cXWw2pWV4N@nR#jm5*nH*q;*Wuhz!H4ftwT^u`z@E=XU0ZK&G|o9^2SK-L1(7x@aPDfP1Y zqWD^Bp>Ecm$ql6SUvTb08i?aO)==xgOj);vA5h+mr(`XcvY7O_R#OZ4Uc8-}$oC%j zov$OVk^u6=rr-HGstc&_EBHVk*-}8Q=@nqTUjb96RW+8cl4G@L)EuhtkR(I z8!AMqms0EArPLZ!$g#m3eP=X}nxH}j{@?3LmH&IQ#Q)KP{FS&Lj;eVv+!JGJZVdNG z^eKhm{;18NChnW*71TOXMXhnyrmF@c+x7fbG!rJ3A7TJ)z-3pO=Rl(>Wpj``E6b@(&l3^-Qev9B$Xzvca! zzU1H0R2WE}SC>t319f^JFbLJrqG|wld_A@Bn+oVT>6x;2CVq2F)nZ>Sp%&THJb~-K zv{d%N4=D!$oCi~0#l|`dP*gt$;o#I9|jTY%?@;CN#dXgLByf(+a=AxE0DbH+m zuYIk6S|=y%GutBjS~0agn3QL>dY*mFL#@A0$}?pAolsL^an%_+GRX}+lUga*mqqf~ z_$0~{nDU3BMG%S>EfRQpT5RU*K9d`87_Lk?3|HcFM`^U^2#ppUrqQBtY~MaBj^n>| z)OvNHI5RcRIDr*|r$PCUN9yO&##L9b3e;7;bro}iKC*WqHzr!>Pw-x08@A<=nGKtI4Wo7s2dU+OIs;V9D2_4TBK;ADgcXDH+NsQSFdI834 z%A(nrU#qER#_l+={^dS#HqfN>{p}^vrE4&7(w48MRTw_>!)%83j!WReQPd-{J+=;3 zUL@m|rEV$COJbMihu=cR75YeF(Tp#*)3sXIggH?K z%rXr+aeW^BhVahWXI82X~;}fNSz(DX_Dba6@k|o)GdA|3;f8 zlbX<6&<)Mr?vL=A2drq$?6rU5wNkK()xu-@rg-GgHq|vzs<0s^WJim@JaP#)qIqDA zi(0`7L!RK*pws`ctJzx}vi@Z64{<(p^V&tw;cJRcLSY z@vGT)7Ym#4YAWLhS>(>bU)mZI*U`r+?&Sex* zS4KZct;g)&#ai*#h5#aUnbfQeDGb+N1wH&T`~DE*udK_VX6;i7Lps2FFHDNFVzW05 z%I`^|rr?Ju`bcz4WnE6lUbT=L$^sG36OOK=R@=6xy1%37BY$7Sjc5peKRAl_jxOQ` zepfvADfwKeIj=j8&*jMLZQFXgqZ_D&*Z*UY%+dJEv|Yb%-TauEp~VncV9VWWK@UGr z0_GtV`VW0k)Z-HNU{Hh3t1`F|ysm(qQz7>AlYBs878Jy;$r3haIj(7PonKzWjpVxm zhblwj`+Owy&;sGhMqQ^0py3gjgL)ipyqc{l5PLhjE^qcMtY%YfB`qED0;mDH$zO^4 z9ls^wk^q9+?ft*)oLp-$r~5VbeulsuwW1|p;r_$9jb0}7;q2OLs1^M(I)47omNAJpDVt!P+&Bh;+Q@1)Pc$eZMm zUt~y{=_Qh8#Cx|!9v{g}S;}+kSk;P@`0hf#i$t00)nc}&&~!21O4VZil*un)l83^16i z+Y(Kq)@xkW9H@2Tb5(~nE7UrZti|HgM{Xz-KK#y*&(HANiUyXV!ST?tYnYND$39c1 zK+{LAE#w9P==Wc>fDsL>{h)_y6&kD|de}b%w^rptqkp)~TLOBx3ZT*7+v6qqVB+;w zfQV8EX0m^wX0^btLAGW0=O~wXs-k^J5$&JtwG53D&H5c5UDwuPBxa^|+I$2=P<8TGTIjqAz zMj@E&3+ibnRdptx?Ubs-P-kmh$PMa*0a<@NFZRzx(#L(9z>kprB`yD^2Yf_eKs9Rl zH$OmZOuF;+F|>zIaPB#y<^{Oo{(F=_T}!mY9vLVoOU0XIS|bVovU#aa{yo>3ui(?WR$i8k=rMH0L4 zn*<^o)w~8jfygV$;)Z_!L%N0N0!@VS2x&$&DBnfT=*XEm7IXVD4yy>mj3 zA?#+(ja`}48Y?C20O%v>oEwRy)bdZXj3$6AY)scSIAJ|hp%{{F+e=cgZWr9@&$}xXu+fID9Uc4*wm#e3_$YrNM4&r;u z`Tt#CeeHkfH#x80?@!5o$6eIYMZe*gzf<2iX7@XEUcbTa_b~RmN%ngNbLjm3QiXj3 z=e8aM{R=vHw1nMc_mTb=eS9a48z-6$?7=<`O>xip&k)WdiT3I~fe8R`@Od$ZFU|C2 zX8ww2`{Q0sEqy;>Uzp|w&ezy(VE#w15o>;N$TUfEX8w8R&>SUZU+9*I93>XSVB)jc?u@Ya2!4^B%ND0p?#EUy-0SbE-^ z4iQ#1&5hl4G?>VgG|uY;9PH_*8Q~296R*3ent+%J-SbOVeuy~k=T!4$U*^1+KQ47a< z6@YtY{>xS{lxdD0^xt`z`t<}NWaBT$Z_Bp=3!8r;St|k_l-&) z{%d=(rn%?*XR1%z;{H9oth$$c%>b~mt#uB%SiFQ&xa7P(?I)vY5fQxf;;zgnkE zdz~ne>vU?8ds^#&jjOq_t}$6N5OoUQc9_@*a4giR??gEg-3}8~;68@?sMkrY^$tDk z*7R^Oz=yiB!+U5_V4;ci?af5nSYBV@fd1c4+Op=n{_Hx(BfV+VO3u$4Q`}Q3@>^dL zx?Q~;r?I05?Z{cI6`w{em$p9LC+hP)5>AlbueB(o0qyn8BQ>|8O}SZFaBJKJR=ge9 zegb7(>D+K+(d9UoYAQ7qk!O(`3k|GbMA1iXPnBm6#Z;aNq5bb#C^44Xz0|BHP`15@ zn(+gGy7w?4`bg;b3U+7OtKOTE@A{xo)~d^m>66?jP1b=eo?oX3*WtMZ^YLB$4(Oj= zbjgJOt83$V5fL1y-USm;!qEM_l;+ z`!9xl7YB%Za{)K}!!<0V!JB?qz{VaXeIKHIlu|Qc_hlGuD?i$tI0B^F1}XXg_9VK3<-sgR9)tF{D8QD4r^$@GIBK5N$wB|w9%3Y6iz zVBc4u&5<%vgi(dyO%Fn0*&qverPmE6r zIWRn?x?=v+GIpR?AK5)A&cDjyYHpxpa?ZS0&7XJ3fXI~#xS`hpdrx)69tsh5Sak`^ zrdFULf18LsM~;O$TX*_FIoP@#Ch7%lhT~Xbnn$|AgpH}Wftm#{aI_tm1~RYc2vF<# zW=D5#>Vchpfb{rwn1C*|duYp&z1uZlJ%#WgzF!5o4W$l<>~lyggi(~4ms6`YP5#Dl z{Vt6gW2Mw;S6m%&RgLXR)5E_?leSqreRbcy1$tP-#HecQK=S%hYPF{7;jtAmb_Vag zH1p04ef~M`{4{yJ==gD(jE8vP95?zo_Z%*jc<-g4kG!^}e(x)wHTtu!W1IY>$@6SgyIa zipcZM$5ccblll!|w@z|ntOi)ABJ`VK)NisU=jb*uIbpV&83F2)Ol;KPT}?>|8czSz|@hz(QFOy#|7C<0Iiy zX3?YMm^bqL+MaB@k{37Wh59(p1nG}#49|_la!9j zYLB;0)W_ZLh3!g#z#B>F@kZ0Y9J2ix`UBAk3NUymn;RYthP@6r{=A19XI7Sp`1K9- z3)y1ONAf`*IVWPG3Szr7J^Vtt$U}||rNF>B6=Jo;w6dxTME&f9S`bVB5$QsEbwc3W zx?`3K0$UC3?y9@VOwOm0D&rHzD!}?)Iyc5DsC80RVy$_!vg#fpYK?X;5_N%t@w0pY zz;m#=DLR4u@Ilp~Aq56s1JNBQPdnQ$P?4(*K+Vjn^dvD@A zQY&((Juy9<8$Bun-xtpp#7^2doOh)ouXV?I73g^ThotMI82{qfZ)9C2!Oua}NB*~m z8wt*j`-ig_c}vEuZ2=JdIVtPK$4;D;wT6&pqF!p=+XifiOjO`^HhH;G>!l{r5YkT- zfQT!p&!biy%J+=@JK<5K+Xt}LbaErQAJ`pUZXDXS#`4_w$Vk*#(|3mSeiU^o0!RFv zv%*&s+|BjdwZsh<+p8J*pI(nu8yn zP?bQ5t(ObznN`#(cffE+qrr_&l19G*k>1lci?eVb5JBE#V>ASO8Vn0;wSPF-xI^-- zgs649e~+jabz=ehi-UVoQ@Md{0I6Il-xsx-V~~9R)iO5fNb)_&n^3-;Sl{1Q=73>| zmn~xV1cs6?iJ!DvVM+cVFhyFV9>V#8KK+x_iYxGZTp`cLbM#MuMuUm#z$$)@hysipy$lqPZ#%d@0U5W@$~TWRlmQs!~drTCIFPQHYGQ$ z7?iu75g5WSpr=qP3NY}aEN<)r7-&(NKPnMeMV?ql>+#l`q${dGju-S1O!wSJxo zgLjOo%n5o`1~5mpt5zaC zJ|pyxg4nV=ZXgeTn{!WSDcy?S9EGe3yf@YaW^o!fj;atCYog|UfU;<5Ne3L?SeeAQ z3IVJQX>cp@pN%%YE{-L7ikH2~xhL9CS6SRFvHeAz)CS?_c@ufZIW;AQ-+P90&kZn9 z(Q@#zO6=#DnjgUV|JyV-R-C?ar3o+)Z%AHW92=kJM!aDbXRDlZ&yJHzSB~9}x`7@p zImty`uV_Pbrk_v#mv!@o_soe~>DSN0K^SW%>@>=`2DQ(v!Eo1oO4g%5KJ~|cmodz}00W;*<;Eg6H&D--;M{|9`>YDb&nd+@8}3-f&?az$ zZVqI+J9LE#{FluDA|LeGJZ>Da<5}j`wDV~YS?}b=@fOlGsX)#OUGRd~DOm^6>;))~ ztNF365@466apUitd#)o;zDwl(xB^s#juUEOpiSe(lLX2KbAWxsxyM>TEo+(&AkTSg zfOPFrbfoQLNVh?iS{COX7wF-?T?Fs^{QR4_^(M$NkCrpkN$=FS@fLxVb&u7c zT{4Wa3i``g?Pb*Z7ftG(wRMEmT_fKUJil-yyG`RBd-7din>VgxpU}iwswAo3p$VSD$(_Dbfl$BHr!zjb2$ALsbRh|p1p2L1k* zDn(83+Z=j$+69)oUGj3D13FP2xj;8}WV$-s(m#g0e=v#VD|1hzucUC0bZr(n3Auqi zT=Ky#ymUK92GU~5e?HOB$UR_oM6yQ)Nk9RWNO@F*VfG5o}!P`q`tZnuWwvc z`QaXb$eoX91&Rj!p?4~os&UU3QeWM9^vZu5xeR(g+6c~LZvaG|epEg)t~vst$x3#b zbC0I#BS&A^Ir7D<-j8;tzPb~i-6Qatp#RP;tsvwJvVU;y5pAyyvVW-D6Iw>C_6&U_ zlzL#NppoV^R=t~Ab)XzXIUmYc-B$-nNAj7`Ip-Ki=k%-8#J%>H-6F&@VP z!g*Qv9C6QkXOnzq_`i7v&VT0~`OX{v%{wQ4aNaw2%XfbM-@J452gF^2>vy|cr}Sru zyXJP34J07w{BuF}KnnNNd~W`=d+}Oy{W=+K8n83lf=u8he@XJ3+f`RbT=18Cfw!IM z6tRKj_>HKN*CDWHzce3v78Hp5S(9f5GS0{o+uR1MDuo+e`+XfPZK)qtPw`04N5z%M z8zlBsZVbADY-jeI7{?j^>Tl;@*UDU+pQh+x9FKuKq5!N`hs@jkc&hY2?n;rr1F15; z@g5BZ#F=LfJzGZv=D)yf9JKwRSzN@bJbyy!=+EDu2bIS-_oUgFZLiqRPpG-EJ;Fyv zpT}?NPIx}g1C>uWLB!-_rporB3Jmr-X;9WU$d65=a6?yMYbt>I)U<5#-YG6}fx7JW zu&w#HIr8ig?N!}r*Zu@3J7TxB*$HevpYfA)+HnP<9%!wd2N+kC*vSL7AG&y+AG$wu z%eCy;N2MQnT&z`IU`98%F@=pf?Q`La_)bv%&F1>aeufIE^%vaN`P7mz0K!)-^89Bo zo9ZPUCTjxB^;z>P!P+@3ahp)4`P|rlTPA$hJ*)-dYMFO-1UrOKQI)WLq7W5=w5t6_7S?#26U zqV}Y$FT51=@C~Wdd>2T=Zxx8F25K#PziG54i<%F)Nk?BkHS1wPpe75<-5T0IG*|;r zwk8A2_D!3%EYX0~3tVqCy~amP71XsYXbU?af_$MmRn*oM=cc#1xM6HtV~M=|OlqFW z1k2}yvUr*}2QACjpg;eEYgr!3Dur76{@ygIxbr#=If1R$s5O>`dUjrePlbrGsdme_ z@S)57yV1#w!Tr7t)RS^G=pTIQT9F@lYl@8%b<2F5s1xlH!|OvLQkz4~ zFYgv>D{=w4Y#;VKEI9{6URUM00M(%E-b`wF@cOnj*4e)|jgE;}Mrskar=v8LT4d7$ zTd+@2s5;cEh}zucy$(?WL)0g6r*H#l2^`o(!;7PTnApvWI~V?RhkFXs`+r`B29=Pk}c zQ}hw3>nj1=jCC@|; z%<$D@z3tON2Uh|zFGl8IA%7j^BFAKKOjYe#)_Ji%+Pt$z$!!?S>G8(Z+`zAFei;|I zM7aS4bubWh=>L-n!za|d*oKr&G9c2WKsrA62A8z# zT1~B?9BMs)w&5Zeknzd64V#F-{jmI?W!DPbdfVuN9OM%sCST~?jvSHqB!2JOMt1~N z2zM#@>5Dh{E9=q(280RVT?^n&r(67cYZba2X{2wrK%9KMbreMA=_KXi#&&{2Rgw5bKQ_X=wLlXK5m75eFmOW2=O=tSLb zl>_?YE5M4Tctjq5mN9{?Q5f3=`p7ugepxp(zCS5( zL%MPxdo7oEsb`#UYj3(9zLs<2MK1BBJfP7u}wYU^St+ry-eXLsG zU{PyB3S>hHwS20qjdJnx9f>RL(_ml@KMFv;v^9!>G}I~(K{^z%F9BK08t3InjT=jB z?3!^^3yi5+z#*~N!@wmjv>pI+E>A-KwS)74sNk8x_BW6(o#QrdS--c><$&XJ^|y=S zGuiqZIQ5Yg5+g+LnOvEp6aH)#H+r355)C>9e$w_;thj}AZT=zJ$+rK;A#pk9;s`C% zAadD{rOxLDeWb~$hdml}o^2=WOwlT~7(~6)k%H9TugP<(g23l?$#W}EVelTOz#IuI znU-^d^O2kzarQCI4IJOaV&-}s5cvV&Mr)(QUs!49mtsGrIQP`z+>fYi%LZyT-$l)0 zl{EMih#Z#nk0d^cqK9i0ePnr(&ToOnzD>zSuXdGH4n zhH-AKCbjR-_g1kpMW0~v&kThg-s%7JCs_YB(lvP7VutItS&?Tk_b4)N6Q8>~gBuiJ zpvwzvE)MSZ^JT4lq>X$^El|ZdAM(Ra;Tzezig`1+ak7-y*l_NcU)4wc$fxD}-8nmd zc<*HwH?}Hh3rH*w)H$%tTF}GAsn7^nt=?z(w2j-nSm>zt@o8a~W;wVK{T7{|XZhd^ z4OCoc=LE=k^Exl@?&m_Tu0-3*u3`E1>6^`@ZPT1(Ho>Or)sZ^V^sixxL;pUK;UQ3 zw6WxqqV5CQb^y5t_pj8${u}jh%U!-o{Qm8l#PXrq#7ZI8Y+PbddscynSnE4KA@C~% zjk&8>UxvgK7B(X2;Wc&}KF5V^3;{%n%VaJ0Y7LJ2A1PueqlQl3Y*K5{>{y@tBzui> zPnT0-FaJsA8wNTxZVUdwhBoYs}!rZtSB%O&wrmQjh%G^t5rUiuCOj?|wKvZJ^!oN$8DAoVtuH58i@v*#u{XVm@N7m7hc*flTd%27Pazt{mKy2wY%i9 zku5-MyNnRyeTGaz^htpgENm%aPec`t#Zfb^cv3%c+B9T@I$U^(?MI1Yk@O}5Gq``? zwGp{}qJAc(s-4N)nY>F@viUJtn|bKV42xP8pHT!}Us^>?dIK?0=qau&B8di7#4&_r zC*I$|gngUZ4(>`>>X1SWDTljKe|`*5w}RN0Kn>|y@twY#oc%KG_%06!j2THKArwGo z=Mw1XJWP4M2FDXQt59RuIU~EBSom?L#tFNBO5t%U-V$iVZ_M&R2s_G)Gj!UMhtZsW zCs+H(tD=YV-d$?)eA-+lX!Gl<^?&%T)KRJ;+VZP9i}TLK+M~=)ZX{#yl zujrF2ma*&oH#TIu8O>DD(^Q3*0FKvVja>s>!ktleoqZEU3-x~`TJ(qWsWI_?p)-E` zlgqnrellO!-zOU-{bZ-`-|(28B1Y%EDZ$?=_!*k)6gK?0%;;ZP@Qorte__);Hr5N} zJWHymC6%iuoU0|AqrXh<{p&BJj`U^3`tvVDeG&FMNJSig&x6{`a$baV@@?(YjB|xBexy1?^YS!}`JIVRj$>ky7t`N{#sKB)gtcqfchzBUYT! zzQdGyOQA)lm<;bBX23&CKd?d6t>ZX)JT5z(-{ph9>w12@h?s$*S^L%rQ@uMZ~IFL@f4qOCd3N|Ju8* z&$Y>Ml%B;)jQ5`2#N+x>>|CGOB`0gv5=*MpqP@{PE+2ef=9pl;`=eh8F+RKcE(gzX z$iay^Bygf66+Pd0;2gHp4H4*#RRUuv&@qR%^&5!V3I8Y~)-aDGH{TOZ{>Nf&n{I1# z6Kf5}Qd8Ub-(|$w14aDiI8%B2cS9Ad0OZ3BpMy1159e9vPR&7Hm!7Qw=NnHi;l3(1 z?-xBP=mlFB*{uySo%P#QvL4^8=xjYcZ`%&0lP6_T(a#qlcr9xy@Zb_1OPA_@o14q6 zL`|+Pe{Ov~0`k>7kZY>(`WaIlmbaNzZx_>Qo#5-X%M8akOef!wEKV{!4 zLV~^bLm?w9h({#z6tCZin&vW?*xk2p?L2D4e+mmX-WTnkwv7zaaehjyQfPx^Zf!8` zDoL_7Dp9)iA0}yx^?|j&-&MA+&jtN9DzM*~?!xqyCxq_a&gLQR*39OhWa5L}N6P0> z<3=|z*<8J?Af-YZjDMM98b#;kYlHQYy0uV3>=&}I_c5Ji+m~U*TVdvOm(5(>bOl=r z=I&ePA?6yDSPvJ#{25?P<`p{-A4*Br|qse#O#s^wl+wJxwd>W+X&Z& zHAOHt2g7Cr%G}LC$-GU4{t$uwjv@u$q|_TwvEb5zKllRQ%ddD7($@XcG?vSolvT7x zuDw!E+%9!Us>pTDzF*cGtKKh766`8vV#81IxX(gwdKbcJ@r zKcnw>M9{R^wUT}(fjwD(+n;PTXibEtu7 zy0T>VclR_%t~^iQBB@g zs6{86TuJ*XSUje8zNqt`Zd7%)H|qCF33B8Rfo z4Sh9kJ;m{((c0NGW%K>X=w^QzF$qw8G!izOT-X>_(cUb3w&JcTecND%ublP!pCJ79 z_emUEr%Nv1`oTPo`QOv`8=1=tw@QvJypqw(lRjjIGHAVks)x8`tIQd=HMwIvZcV zf*ySRB4>QQAh4(Nswtb}228m7JE@(YxU(3s{u_yP@E*?RHXICwxh*sT#QNFUyc#!` z`u9YSL5r5|F0B9#6!(>N`TD-IcvJaYEOk zl(sOGwnw)#X6GLu$>N8@$+Tm0KSt@+z;0Bq z^}4?q73KNRcQvD8?QT?@*o}(kccUUu@Urir-KZGaB(T2jpZl^eQv#EnrCoDh_MIqr z**7&8=JN$F`z95b4;8%ZyRG15pEYT749Oo&*~S`5y~F=Rtk)^^PTVSQ3eCmFZ&K>* zyH#d;WMd1Z-b@{_hW?FM_sjpD)#UmE>3uNM%A(Zgz9)5Phw2Y>est@l@9vX280{ab zC)PVlT>7x$3#JuU>Mf-r*rIBK?=-@CZPGU0X(ZNJ$1a)9*(LA7$vfYqu}Q_1s^5e} zTtO_oTp=OL!M7NGkkM=sTCE98P4(|xLy>I5V|n@u{Q8<~ z!=Li>-}CEhvJFFd`XPROZMNZTp8gE`PO&TW<{=T&&H6N~cv1%sVPm}5rC;~oxwtg3 zUL6rhH_qC|!B4e)|M}sc6bhTjm;&y5^yXnSJ-*)L@^uBQcPlX+S1wsuii%>kS0xf( zJWeU!vvCFOuMA$I7rYpm-d>!i2MV?<&hR=NTC@t=7w_s4I7y6->}PY&&P2{$^#vpd z;}zrUO`u{~dfaWwfQM{j@|P!A0(csJLqZ(ioaq(Mi{HF1V*#!RGx~D9sExJRP0Uhg z#q}bdcB6kl^YQvY-Ce%;^)P4avrL|Pw~|cH#Ca5om{g~&1s_uCtt`hCL`JM~5w38s z{Y@S#uaXVi$8d@Bj*plP*Aw$ByY>ZKk(qVPuaddP9Y5nSO1%;)maTqHN_0=s*y;lk z&zIo2G@}>m@nx{KJ%4-DBX!>_y@ktuMX7gn@2qDozl1--f45(v$B(;`W9*r3DdAV! zqqoUqC!^C$p6`&|(ce(pX#O&+=2n;=u;=Gq&$V^=CEPx^df@zTeMfdBXP&(h z*5BAOFN&Oucrh`Dphc_I_9&Y#sqm1`ugMkhVwmjv#;kAunZ5UdsE@$0x`1eW9?Uvu^Bze|fQEh0NxMrn-WS;?qoy3g&@Hkf{O8~dN>a-Fc4KF9PV_FQvBnu+a=m%-dQ zMUBTO^)}yHlFT|ebc;KsjvQ@`%fw2se#z%BO88zJTW@xwXeDyFqc=hSg8MulZ*W}T zxCFH#YRJ6i{S!QHGIG;}eKYS~hG{aZ7AqRH!NYE0TNM3)^~o`D+}jH5)peQhB%7@xb)zKXAKeh-K}#ON-Oi&n6+jtRHf|NWmb{jDA8?wbRnm*|hrr$&hF zDULzt3Hsbx^tdf--F*sbmH{3%jzLPj4L3ut0?(_6o|+@{F|f97xE-IG_3=D+hiz}O?4%XlFw08y2Qyllf z>|ZI~R{&3C)|I%E(wGO@;G%pj+U#aBh9{L#N`pV?bnFo_`WW44DTMGB-I=d{rGOfY z=X`lCHR4q4r--9RhG)g_q6o3~&f3N^^1`iJ9%8%P#5{;QqVaqzh`TwioHe9W1a~!G zy>H|Zsl$tkwwCLO8JA&Y%3!wqJ25jpm@PhHNn5VUYOb{$!@lK^qNiQ3v>S<;Ud;L| zr7|mFeaW_s%t~UVTcIDx+D6NuqOs?979beR+DA(y_30xn5-=(=lZ6o@f~DWzT!dxCn?`UjNb%pr!KXM zE8;edF~0UUTga8H-N0_Lx3MRv%WiFu?b-jDrp8DA4;(Flfh=qRY`!E;kA9v!s$ihw zX1_jz;h)36`RlpZ!|q$0{34|^6=gc=&!9hN*~W60@Qp2)vJI(#m`VY;l<(JT-TIwb z+sJr{mA>o;e0~`JU6+qo+DoiG`C3#}v?vOm^~nX#`oaaz`2u&U6%kFTXvydH$Wa`t z)o;n##(&zjq2+VGPf*xd=IRO7_WU(Ttxy|$dkL|Ael@x0hO5avRacXH9(ww^BaKgA zcjWoq*cW*Ex+Ayk#=gjI>|^gf|MYc7&^}kc?dj`|M4rCx$VGrBogZO)?l8}7S4vZF zOxlL5MlN-E$fXe#3)I5!rGcK$EZ}{*->pZpHlrCLC;6}E+i?5}V(zoHfy;jojqp0A z-8V<>s?q}m{XYJF`COgp4iR*8lB{j~mdEDFL4I%TT>Yx7Z9K>MegBTti;xIpX$(CA z+os92*Y{f|79SiF;<)2`crxkXHGQR2&i^p9=KPq=cQ3{?*BdU&`5(}ZZ_Q;o)M((r zLOuO?5nuMXTcnPTU)5QRW^1x$jwxvGcq6FaG7oLv-WkuHzMEtp&qH7O^E~%t^q7KC zOTp+wq);z!TcGbt2!0W&FVua|irHCrWo_eYO2JA3ExJa;`UdM2@H#Q+n*G%za#Kg+a^&p;7%rJxO-2x^`DgX+4a4KJOIyBg}&yV$%JAVK&Zm4m>-WgG`VC1${;H4%cB zx*(5ypVAnUf#Zbi0Lque33f2qnvI=QuQw$X8`;~m}nRPpv1|KL2NSS}Rr=3=CB@llYlVvNaJs9eV6Bzvy#Pvm?C+hmfwXUgWa2HP3m zQA$#GPua#erQU9!R|YX7DiSvUF&W|;w@=w#>2eZUy$Cn=ONg;=dI|`~BRZ{kQj8CG z1AVigyPioNmb3PwB1mT^Ct%6KqHXh>lGMH?hkN8mZkc}vd~dee6nZ<4lbu8k|`!Kkcb zd&72Ia>R#1*8Z%xS4r%NfVJ)a)}l@OCDde8Em~4=(AU%|RdCzK0b-RD zmb86aCRVA0K9MhW4#NSE=7txMT1H#;yTrV2KWiKPHmyFblyV$fMsJ$V+Wh~33jL*ht7X#W`F^?hYu3-D8aU=xvaR$<8vLL;rF;rV$G-G}LM`+K2{g z^%f)^mJuWDKDkoIx`x^YpvZrxzYVB-B|eYW!8bIgR^_|ww;NX6MXa|eHJCoYeqRoB zXfA%;)Ew+*wpTSdcP7rwC2RAQS#2Jf)#d>E?SeJRXwp1lJw>VT3A%~($63$yQEI&9 zJhOm(+iB~6C^bHGuKzaojWS|tWiXlUt`)<4$GP9<+&?Q~M0#?$J~5?Ez< zyq^0E)=-m#KK6W<44#9Yt{~QM<@tH&nuOSa3EOzNl~~;o=>4st-#?bQ9Bwqp#Ojc_ zt={^;k$Gq5wdDNmIeTixiCJOi72jI4sY;xa8q}gVqi9jN;GmCaQU&)f+)1qE+vC}q zLbNSc(Dw?{krhvBjLCIz=qFr4HhElj@XU*a{`SFHo5%CVzXn}DV{@Az>r?4%A})S* z{65>?fIRmNE}MvVdYNuu)9N!yNs5h6V0lWZZ(jwE3bZSdHh5eAXY?vr8{~WdpVe3M zJu9%}&p240Y@GXd#L|8Y@6yK#Az(a(`{arwb&6$=>MD9yuw z$bT&f9@Mnx8;tfLyJEjnUvf1OHRV&#BBA;TpqgWHs`5-tLiVr21>KsaHEiy4d*G8X zUIKSj=J6o8nE!99c!~8Tt4OH{MM(*42{m|D$qP>IQj^cfWg}G*Vx`aq9s6YJ{CFD? zL$}ZA|4!cja;N`Z-v39kwy{q}2sW+mcHyOel~CQ}LgFDH#^&Wsxnx9<5Gz5+h9+P| zlM5TW-FT_Pg_qb~V{&!FsruT@F1)l_m3iIn(~8V#xu6HXOES96Xz6lrjJ}Q4yUE^$ zLxHxyfp92L=*Yw>65j-30ceANn6Ql|+0&-6{r033n$4Hkn&sj)7%gG%{ZK({#cru& z%*mlU=;HpMjZBy5lL>p~iWW*^^?;R8%7Py|`7bSU8P5+oGYtKGCGMJ&xltS2XI zBQ0fD^vdAzMH!%PuMD13_enZ)#^E2iz4S4qUPc#qOcBt_&N8Eq+hjqLb2O4Y&&JZH zpuJ4RXkYPS{gvaZoR|YSRnBNf1$d2$9FMy8jBPZ_r6Wvlf>YbF(l6v=)<4Ea@4dS+ zd;0JE|Ig)YmObn|F&UAab9Sbi{}0SRx^uYVsEN0RLrg{#@l;y0al$s(|6e?78{PAH z?FJt280IOp#|LVlW`>&mmMQ3E*%5^Ytt%$E@ z&p$`0G5Z;&|FZU=VxxZ@I9`E&*7FBuJFTLJd;E z$`+aDK_xC?_du-uGOWXvZFI}T^4qkJ(O-^{pn&UEZ0}hPJ${GpISh3C<+D1YGwe+E zGrhJ$>>swr`c>%vFhvbNk5zH;7?e88=5^YdTv*^z1%_}5v|>I-bBR@Qxrp!it@9l= z*1erV)_z<4MHn|?* zwA(O`Sdxrh_ACmS&Qo8T!%1f2WI8Zey50n^j4XAVfdXR1i$&c50>o}%<8>2j^C9Sr z9!Q0-8j6W26~Sz{l9-YPQ%XzvYRJ64fdrXj#?P*Auz3jlK3jtZAF-sX!DH0fxR}mb zQY*%Gz2j^6+_Yog2eJD9A9KcNN)NAj0c!&lH7Ihtj-82VC&tb374SI2^X6&RzAVc_ z50l~2K(ACz%&P5`#d0~!1{AD-O046Q8b{s4`gR$yv_sIFWsJlj>@{DqY~y7Izk%)F zt}DU!@aLQwj_=Rf3v502vbE@U=}Z=2?Pv=3xr-dd@xdiyGE)jO-TRVUVH ztKQyMoIKG5>jn_(tvXmLw81^c>-gV$))BK&#ezNSU=AyJ`tXm`ilBTjP)Y*q5mzR_iA) zFWwo;&CSu-7%9O(Ic}c8xm6Li_Yf*9^_oEZMf2nGzb_J(9u8X*ix+E*~UPf=8K4m+3 z_oW-oTO$Rj&6L)#zU)^p+6*KDOXurD3I-zSLOoK{(kaQ>;7=$u9zW!78x{7Jc1E+q zN9(MJ!;{v4Sew^z`@n+D>tK4$*v5BlLBH>?bM*Un{EV=@Py&JP)6g0YWh7KHT?{g6 zIG^hwR#-xBwMIf+E)lPiRxki^k)ENH^T@c1>jA;p`v^`vG22I{MT|%LIe8N)$-xMl z?E~bt_bw;K&>2hMI%579=i*+(*1|mWgp^D5Mc_2Dhu1CH zK+K&xD~j3q(l)^KE5xkNM`AL+%SV9fT}tIL_O6%7{ih{8y&M*e!ptleJ|d>yeCL!c z{18B5y^L6TC9!7w@I^>;+cdUQUR2yABXO;Y*ixGsSI$Q@#}MlJ1cuOj#3Ez1(PGos zl`^Wwc-L+J}?!@NtcLmf)M}<6+{u(ive9iF>9GRq;?V%_!`_IyvdIgEGlCJC1 z4mKs7u#J&;`1N&rn~}fuzl01M zRm)*U2=r$lkGwEVWB;t6cfW+1H>Rm^rGlDgWba5f#}PY!Jv+wf$_{QX)}m}rrz2zs z;8~WAV8?3sd42CpD?&`}-9JrZyhbgw=+Dnm<2@0xZavT5V{H~7(GA4dw+^1>zQ*DL zz>{$kE4|o}fr`-PQHjZ(+0S&VW@1h#D)-MZ8E)Jbcne`ki)Q}huVs6P{>fjqxmMd`Yw`h#X6*tV}N0eUxqv>c)4sFlLp`WDxTvoe{@UzHxrUX%wt5Oxd<+zJj z@}$5vxQo%4T?Ze&bDEv6N0TLaXwS6GPv&Ylq${;mnI+n)p^LRu!=Kkyy>*$k>h0y) zs&`gut4>^{ts352lze;Ng5(LqIddz;nQJ)y_qL|Yv#OrCLrrF$RrH}HlAgH?R>q|j zXBuH<=4-{7Z@|p#flgHNs9(jS3&zBmX_$8KI4+QXiu{1r7 zJ{UZsNWt{I#M0zXmk*$5gZ;9DFL1BO&kr-%;$B!2yCTW&d`-G^TQN+wJ~`dJBo94J zhg4n{hkaZ4kr34GC04FJU0OnKX&!p^A5wLHp{ObSUkYMnd1!y-c%9XKNY(du5-T8~ zPbv`gd@qs_>$=y$1DI9ogwcZ8eeUigoc1i7u#G1=VU6WefZ)OjWK;}NdY^{C0lQ_DUWach*IzV zPxRy7dx_OAi@uDH+s3OhtW#40!;H;~#P+OXD_C)?&dQBrwoLVHH?g)Y=5-HwtXSNU zE!bLT#%&`WAv+kI!FEq^Jc1o;4?khe#$K)T9p#y5v|@G)(c zcEn}pw=C_5KS0Fq2e5;UeP-N|^=9*}NH*UpC7W-RlNwOX@58%{-DfnQ$qh^DAy!Eb ztcEgJ;(jT=|E5b|Sohz$d+#Yp;0An}ZDkGqJsar9OApCXTQl-_9!w+Dwl!FsU8B`! z8-ZT_w^o^r^y8&xDfMoSkR3y3>sN66Qm8+uFDN?6bca10->xLJn~J>OrbEzw>Bzbz z95V;0_;Dd4e)4Rx^Ya^v8r^PUc?w0$PWp^(>~|BZ>5V#$*X}P8GXCl!SkTs({sN&} zT{o4J>!noArpfl*z!{tSF+YtSFd6@ln^?pn_+Pk|Sfn5NL7*1}+F+kVje~At1w4Yz zvS-(%B|Tio-r>1BR=7y$K4FcRQY}o@2Ge1rex~CnLI+AiZ~lZ1v<5Q2&vc;h)r6g8 zODc!;IMCbR<1v@Z8hkK4MX=c3|7sD;SRt(XT3GekIU2QK>Kx7o(~lTk_bY-1N*C}6 z;Ql(x?z2%bdU}(|`ql%-=H2wt!1^sqJv?d~aTf{QAd}FuH^#H8)riIO?sgCank}kMCsP;dTxtv+j~P|K@!28-j0^f>_;uscyq|p`Ue^5i>5KdO5Uc*EL8m*{!Kq z^OXUfoKO99=U?9VR1EIsolz{r#M+kn`w2pJ#LD^Kb#Wl2J-h9KYgYq01GY6mr<- zCfQkiGC8CQyna~fE{Z9Y7<^Upx+0Ut3l3VOJI;Mhg_ zT_6ipe8GpVw9mU#6{kYq_@S?UmZ9cdpV_omkD}%LU1t9f0Yg!>eH_&;}zs zz8Rs6lBZ|xP?8x%)p;E%CQoj1o#^@URcc5f$@+{bI==i6Ei}z zC?LBl9UJ5=Al&!$>oMDCatoVrzl=~0tM40QwjrV9u!yZe4=_)EoKhpKpr&CS)2q;X zi+cGAQ5*I%H**=@O|1VOvyIJeVy0CsnwH@XV{tJc1uHcq0t#Z>M=uN8&OKwcfhFR( zN~l~9V12r4%r<8D{wx_2D)jm>5kD`3gj#u=&FWX)baX^s7wlrKI0CpQWI6cHxMan| z&az_m4JzZt7N>oSav45#iyP)Px4?*RnPT+T>5GO0;kek^;1CtIjBc4&aT(U*vhYg^ zd%u**`RB%&Y~LvJ*!ZWnNF8h***8kZY@-~dBU&*z+b?VjJwpx#9IlYDxyd`y4a6$p;rhp~Pus?;K3LDl zIC)#~SI>s|-r-n_gNsk`{+%o-GCGg=V7<)iet1%Dz{6yii=DI4EPF->r7K3y};E5|Ri)-AtC<#cM`d`~MG;rK+Gito`XT0$;FboEnVIACb^^ zP+q)j!ukHqw&QnDwP<%S%#Zl_mV!>-24Av8Za6z%-6B53WY0leyo{ZzCxBj&E96Pl z+thf&`R=_`V9qePa!5g{{|xub*NA;6r!YEC4?1?(v?8be?7+UA1!KWBIy%4+uf`wlKNiaL0m6HyOO<7fSxo&UE-1liw>8`t&xW`7v+#@fi}arOV_F2+|IG@&%_r?5Oy)gKsaIR(#FNRyI(o`BUa5l4 z=RG8wOyl1+kvvzDxAr&iT4NEpTo4-&fDqe>hEzwJHe_ z6?&uqde^&1M4)xPCE^v@m%b?cG;B^Ee8H&|EOgJFrlI*d9KY$9gSr1SrA9ZUHB9y_ z84!6wOpfpBlz1-cQJWe~RnX5mHr?08si9HYiy~sO>y;{atjN=6c^!KzZPPwyFGpwZ zWA0~ou1L@A<)2bsJFtf7m~21yUH=8$lZW;R1wHo;3Og25^uCwnzTE0GufWLO==KkodoEbtK7JjYbDcRVR`|MZz%Qu4=h zL=COYRL~D6rZAYBn`dNfB^$zYy!k3VQd;BIYQQ zhgi3ZgwisqA8?b9te~dy5vGfUck&!Tb_Qe~Z_~c50KFY$#A>>^NZ+QS_d854jgTGb z{Baa_q6QmF&7!^jxk877O02ZZacz3HP1C+HWnt>H;!B0R#2Tm6J3(pB z#O4B?Q^@9kW4y99gA4RG&*8W9;F7Cm&cbW9&~s`Ah_zoPR)Y(DV=4wp7NK}t#c0Rz zI*ZZggO3sGOn#SdHE{AlH`&Q#?9=nP9_E>SKQjltevNRQ($8bM%a-{Gb_6`44h5GV zWi480QG>~pffzAc@=BmD?MVg41kdcg zn`ALX`(B}x@#+D_FBrWqi4l{HW5B7=@fS+H)4R;%kcxq61$yMBI_vZ%DJkNeWNw?D zXjGEcRy8@CsA+*6o=^sUREhc6qZaK9pzspCDTy^-20{yEBtY&55)(?0c zafHZ^NLHJseIm}PEcp9l)L{K*ec!+Ge4PA#8L{FIMLc@oo_B^`UJX7^eoO`2)l%1+n__&^NB4nymw`{rboBVuH`qKLFO>cR^b;dCk6+;R4rl3TaTT!xAK1nUXwg4Y>WvgZ|H^1(?fX1l zwj{{&mtJ3>%a*|0?UqSsc71ZD8#YxTDxNJ({oqciqjD-gkrcXhJFi_Zwm`pgk{XOw z&(6=`dZi!HZ6Dek4=`sx6}sZ@XRXKYk|m3v`|q!_nofQ99>%lSnsAw`Q22f#3S!M~ z@xxZiZhn=@I9+JGl5B(XaoR>y4=*^HvGWlJ; zz;3el-B}pjj0ZpXv2A!%fiK#_W%v>&hDz8VX8R9vHit>a7N4^_urXXSVtaEoN+t^p ziJI_SPCfmheXg#mENW4nq31BynGV2fOuAt4Js($fraLVMtP*v0%-R3U;BTi@3`{nu z$tfP=xo9S4V^RT+%gri_QkEhI?a#yVa@!uUhVBsOa7f_og){{<9%#{*Wn%S3mbBec zfEqm@sv5m@ynT!$HsWBPjTN3BjZ2sbI=t~!o+OFG}&eGD!Y3NN-;w^7i zr{vK(vE_!^%BPV~%gIhCi1}6M0hNS!O+}l>5kyx)i_QZ)?02s3ahI^?kL7py8veAc zR=bt#&0(P4lI57U`gR#@9WE?rI#k{El)&ZXu`!j(qLJ_OJgY^iTz^^|%*L?5n$;x_ zsoh_O+DZi@@7k2pZ8i`4WgKR5V1sk6QM6FcEQj^zhqiH+t=%}sN)Ba~^PHb*&4mTc zGD2*fnhyEfppejRdC}o2WzmMI%2qy}p+=bS-q*?Wrt~hD@z;dCC%qDue>b@&eHFMr zAJ-C7%VRQ@FSYPv+b~Yknl2fM4w>xbG0bzdXeLjKqNv3eKUG=V!Oq-AwvodD+5Mid zHKg;jXr_^v-OiYvbrZ8s#^F8}76ec_w`xjR&O=F?|wqhE$K z)J)7nZkR)j#2i*iInF;@>wluuVEZk76|wqcv>oC4xi2+u#5Uq*X|Hsxz{g~Bo!Lc9 z_B(9R*urZ?&12Ee@>JD_Hm}>ARu-nbXKD3gv&Qhx@7Y{_SVF1s)TiQvy!7x)o|vi) zE?{R?61uAl$NqE^vE%|+{P(wrB^L_)Ylzd?-zLNN3!YaEV%ov2VG(qUe)pbc86y#)C$wo_BT1RjELk22D~PqWiagJ>jF|se9k0(w z9G!=(gURR}`({HGbf&*B{`l`_ZG-1^K=_@RF2nUF7dY0t=7zO*o`{LejER~X+iYq) zBV#1V>0MddGqdPjD-hc+m(9?-A-;a4slxZq*(h1t+B|_JuQ_ec@S$DLBw0V1{@yT8 zU{A8~{#w+>nZc|Wa-NOcUuQ)?tO%!j^5M9QwvTu`X~|4|tDK&bqkoLv{fnwaalgPM zvQ#bV1+h-Mh{g1tjLLMivQ*<%9B(Z2pjOcEvQ+E)!XCJz47H4J zSKg0Aiwus3a8~i8I$Y4ZZ`@YPu4|NXxk|Eb#>Z8nk>vB7e;_4th|$i*kJ@7WgK<$ee#VBBi_zPq zCbc=}bjdoB)YR$d07SbjYHfgyw?2KVOTE z2)QgpWc0CTDo?R>A(keg&;M#2lLOj^of=Jn59aGD9X=zX~hF`nGbuUf(C7x7)|#?N)ZXiM8S*;SVz{+vs+~V)w9padEc~ z<`>7P@s6l>F!+$=&@aW4`W1WDCHytNbl&^60v>;BF+EX1&$uF`%IiY}&v5L{w2j zFvevKbH>;5$(YI(6}=POFDdgpk*~vBoJkQ&t6F#DDY>LAhVtT&tVRD73*C&)$Imt& zsip#xn61aL`C9RlWu*2=3Dy59p*pjbm}$iq>^Mn{%F6}zSO-we^A~^^+lxEPP%8tT z*D0-eMy?oB!`ipQEDQ{du*rH$9y^ z&FjFOdv|OP^adtlE1uNsno^RY4IWZ38i^I_&yP_<+D-NjasJ^+JxWE~TBh>vYv>KW zXP;MRKPThmVxxl}3d~g2|6yD7akl){`X0CU_BeeVn8Dn1d>3QSLNCq9QBGg!9}x0< z$bCP0!>@>i(eEC4(Wb^{6^uTwVDvc!qkm8^`htSdKPnjglY-I5RBiCEg3*V1uGF7@ zq*%Z0wqpInfnvR2N3nkCe;4cPzgetr&0MZ4(4s$7wdh~+wdjxXwdi%K7QF)6V6m1y z_0zdp^q@>a2PM=r0xQC*@Sm~%$A1N@5(x1e#>(??Ao}MZcISJx@uCYllV{c`h^@X& zz5+&!W4~Fsq#kld&?A!J+N+b?JYpj z&=0EG2r6GW=pvyP-OyjB)cdmYn}6pLBm&Z%oyU3qmIT>a1VHX-+%1&^kl)76Z6gpZ z@}QRK`-|CpJPV#@#&os$>~BR){fScVJP&H8DfM3DK`rBLWm|ZCR(-{m&9%Rwlw&6d z3=CK5cjv_-%+8I=`FG^hn=(%FJ==YS?&QY>4{{8PD|mgp09rd4KRWY)&2(B`f8MKn zrnuIH6${}xyypYk2;@We18uLW+$Pq;c;}T&$6|Z&VPb8{CsvKX4odBnOAg2KiPdpv zdD~ujVcW1$n)(~iE9&2QxD51{cWqvOzg(#-z67m1qElMU82m&*Mq4?=bqi*#-S=1;H-Aoak1C z{iEw9DbcMU)}_kaCUT#I>IN4Ht$rAZrA60pjIY3L4jmm6I2Y1q4|axu72n`%hTv&M zP89+k_WNrRdJoB(*(%Fz&9clf>fjwLb&nJhV)P`d$id1EB#tT=4HqD` zJRf?;^Tm2DFYcC;l*{_vKyR;tc1uC(tWuKd_|*dEnT4s+5!<**LE8jtcWb=%v{I4c zxla;eVIIp+k=mUPefbC6Z|=}p53hSuf0Elr`gX|`hbQEUHa3suRzmQ? zvh?$OkFfFkpbfsjYX~h$y(X~YicgEV=DC+lR&#P12Di-S{ z93|&W@VtWpAx|=%_CBRXi3hdkWW=X=-s+GlVo)a(1c@W3M_#Y9tX)ddlBHldkD($K z@`?4eZs=dt^7JDzvE;eLS}vpSl`80O%B3R>B2SZl>#vj=F`$>p)|Iy*%jQDLCl<$a zhjcg>g5=YisW7m?^d=)b8Y;NQlr65Ea^66n`C0W(&f|726LC93Yb5=cg3$@3B2|8*Snqf23fAX|HB4!{ENO#{qjU9u zg2RESHG8w~aNQ`h^R+t0ClYjflN!Gz> zCNp`Q+~b!OjP}VT`U>{^E?MA)TGYTI+5j2y>hji?Pn&}){OAjyIx6!?&N}}LKD=O2Y4zENQsW(dwp*^^$Gv!BT=7l z^GDR+ahW#l^%rpcI0$&%{sNds?k3sg)3k49Y_sg(>W2jfz91)~u&IWkK{JYF|Y&EDrYR$njCzd0_j0V5;qd!@lMDh4`$6_0!* z;)E-UVD-9*r4hP}8DP0neMYt~q(m?>0L>pPf&pdqa3*&NsD&+N=?dWy@qtlx1b*JHNr8^8dxpw43^DILH~pVQNou;R!6UcXQO z4Enb&g{T?g6*-0qn}bm&Z{y;>&)XK9;t{e#lh&=6{f<;b zOupx;iTS@w?~jljagY@}pXzA~3AK)LzCBP$+~%8ZB>aVlb+dVyvu;H;4>jG3iAnNM z^Mkj=xn*>N(UQC0v5nubeyAAW*Q$wmC#8laYti41QKMhhqEC%cLu(C(*qLT?{KObF z(vlYK8>2=XTJ-TTYAgmkX_;7QNz_T(FQGcHCv4R#66a4}f8RE!469!8j_{a2*>|`S z1t-77&c&T;jyy0%jfpDghbi^4vt9~fzDlY0O(*}5efQ@di|;-7F*VqDG==;72RuE* z+LVW0UMDdRHE}nw`c)B&#OM3#LH)jWZNsmgt5@+!J4NKQ_*R1~zSZV@>-)~Px+T=G z`RY?Ju;6{$=)3VVdakC>qwk4$T|w_kQ;cSQ@eDO;Cuz-NPMlEiG&MTPh}BC49lwyB z#K~vobxvzkEErcYz-W-rQw5&LpWYL>R^3u|MSsMhxde%{O=G$I#2gJ4{qb=6JLim` zzo!*XF!P>$LE6b>sa?+`v0da)XbJ|9_ULEF_}=Qt#eKwQ;f^#_@p=r=e;s#nh<821 z?MNEOPs0Fi^62l6QDeCuI(wJtu?=^V?0!o77@bIayL>Y;mJ_p+i~srMxQKmv5r{Ro zh{f9*ou|JtCgOn^O{n_9db1wbN*o;Hf0PhoG>q|q0OQ+tNr{ZN%g6mp)ozo$m>QTB5BQzF1rJ*5|cVZ(pXZdS|(|>cmQI)$rc= z$+!0vB~Sdw$)&r@!H(RciWuiTias=q3&%OHIhQwg)0jhdFZ+AC+spXKuEF!|lPcQ# zkDtq-Erqa0cHb=NM}=Rr$1@;uqFYt;y`o^?)k7Y=1lnMCYuLi}rYup=``lUK7jJe+ zCl3monbZRc2Ko123HV8-or5i6^drB3sBJdXb|cxHrhA5TXWbf!O<3I>iV7zq8MRKK2jbk>I-%fxzl zlJ@3o@IODnYh_il-^LF`%_b(hv~c`YUuq?^=v|Z=tj&{@dTR=_C|>*f_@2`erx!f# zQIdpDCoQ9zJsWWBjM4!mBmLhY3tuftk1q@8%K7+dPbHK z4<08wMZ9Ne@V`z|W6{Ud_+Jq(!1EJMZ!(kT)l-{gw_`fpu!{D^V|7*>LM9ql(Zj}c zaFB4D_v5AL-7J$(JWq?(_ad>ji0qU~5%c?@_YcBi*Y+19w%J8O50s#~-ibTg>?Wbs zVpNA1%?CX7FABdC+rQ*4DYSxJdr(}H6=D%h3SGgj^+^2vCuEpkWPkSxY{*J1yphqE zh8awvkiPnaZS7oG@ z`sF8V!>^!5bNo-f{wv%5^%g0_-jg75^5Be-jlXq*RhCD4Afac>gMl01PZ9!u$ ztd|PA<-XVIEVf^-r=_}I`=ZWc)mI9CnY4Xd)~}LKT0(VP5g2diuWnPeg+qUnP~8k9 zprYpxr)ihyks_}if!4{tf2>r`KS>Ry-*jDrlP%Mf>33fCj_9v6(_gmdr$(v4>oaR# z)S3RfWP3b&14yU~@>aID8&wi|7N~A{&58Hy_qQ$FCWU?_>i6oEYjLu{J~tod&BYhW z^qr@vu@G8xN<}-H$NOHZv$`ntepNzWKqZzWq0jdrHC%wF59m8@4`1in&S>qg&eaO% z`Mwh>deRYronHyh*6ukx7m4Tg@!TpVd(A=3wmGN{LyN|locS+R`rrxM7-w>!l3kh8 zMe>A=fyvXs;Jdc5SIMs6ecxTCf8VCYGq+12kEq33d^zB0a$#e$3s*25l+iJB*f!#n zR&)KtX>;_1Xp_;dP0*s_lzRXFZ`npA$~eaUepz5@zwtKr9|W&;`jxin%(riJzP)^k zu4K%m^}8mx45l@^Z%-8LF30F zZnLCX>l<->UCr@y^0WR+qzh!gT?i%O2Yn|^#PEq3(VNYpy zV*I(x$?e>%T@Y*ky!B?hH5}qO36Qq3`RktNHkrJ%?39p~EEp zsH$ske4Up};t)fa44IHbW+qU@vA4D`A(`TBc7kmv^rp+tfn+oeap{h-v|%h*sb;4$>=K&3piuV8CX z4;fNE(AZJ9+0Rz6=Fksm7e09-SdpPj-Dr2znIGL{C89qBQPk<@}V z*xe=1x15TLS`iS>m(C%+n?`#YzY`P@Go-D%=3==p5U zSew8qlS0y@dXbaw_qcv=uh0*EEtSlNJ@vE%2wmeQ)RJL-56b_0MLb_t{_80Jk7P_( zRZq`d!WiH>Yl{Ly$cusrzmerf8)RY)FMDgt)b}&|K5S%`Y#?8eWW8VM=2#cc$G-K8 zGj#!hTemCF#_Mwj@{RaM%se2&6tumLZ2xlW_h%C8*Pa=zdLC3BRG@F& zLZ88F+f)I4?^wn>Qbnk!y{IHx(ixNZVcI4I+7_s=wHJA6uFnYSK4aa_D>%M7eiw}S zjPwGa4Q@iOQ}yU$E<$U-doo=`=y#P(n{0r_LB*F;ZtW;-uM@GMs;WniH-q)&k&Jn~ znOHT7_oS4A=e{HM9ymEyMah32V&Ybt=dv-%3beI9KV7Npu+Upf$T5@?oQH1l@z~eBD)beru(fAJ ziLp=qoPqMgRG{rEA2V}g)74zRMgAU?^l0p(^}A6{-#OLw7=I7ybZH5W?vr6!ewWlZ5Ri4CS@!3>{X&o}e@qJK*tQ=&_N1VFo zUT3{zAXbYTrh!W6@|z(ZR@+NsjP-1Mm~3ovgVA*62fK0I3(jQBhC0~g%>zpUskPk& zODjP4@c$o&>w^K<)!`D@erXlja6N;Ege#re zn7x;K_&ecST&z_TP>%U*>t#`u8|3kQ_&rK<;gfm|IY-b)*pGz0o;rB zig}!#D;4NFuSm(B!7p=K{-p%nDVbO;e~nc)$}66u^t$V|y1F^Ys>p&;3l` zC7|Au{r&IGJ1G~T_c(20drdM-ImnprodQCA67;0pgns9W-}ku$UQgN?=gUr8BQl}G zPQL?_Fx{MW+RD#;bb+z2^q=@zy`#X^-G$<=2iGYt2eiZ;v4{9NZ4v7fR-vsudV>-3 z5bMVuXUxDT{A~%pzxs`+*^`{COYRwA zKAiIiV?M5T$7UFB<9jYbUr=Cc({KNY+t#AL5~C;k`Slsb{~clGbXDN(^(3!0dPkhT z_s=l?G{Vd^E<)SSF+TSna{Ok29g1UlaRhB1LU|sZi%?werhO&G))8jD!u$TUGP~_a60MMHFIu#`||8VBwEj2EDEbiiaCD2kL zzbcegijxyqq(}pIF%ztL0IlIwfo(iL(gjww z4YUEA80a=2i!J*C3-7zYx<{U_=ii-^3GH+dD*X=SQ*m-2!*hRVm}8Ux-HAHc4s}<` z!OF-eFoB8iS$GJ8QwzJ^_f6|M=J$wN=r!4VZ`H6LQMznJHPQ>gu&)DZ=ja}L8CdpI z-DBSdmVE>aP|5G@m68D}{9c^*Ajd;k`7tv$o)EUynh%&cyzFIBYa8@v_8xK)#&bwg zMUHSbXX~4z%uMI#(Ge%E%Kd)Ev|WN137`G+q~`?J9ov9#Y%*(y3PUZR_e*l(O!IFc zj<&s2kvbEcy?av-z>}J)M}wo%wBQ%@(io4IhX~4x7S!1vy~${Fd}X~n&)=I2{!7rn z@grZ_=Ysfm0W|Ukp#h20UI^tvC%?~|!Lix!{HHQ(KHAQp5Skq)>Q%=-yfjvR7w+KK zq{f+sXL-L0Lv*ENpbdXPg|?E8ditTG-_BE^t*QSi!?AJOUVBUECoQL$nPRLGb**`Q z;%+uAL-%$kcU%KPJGR63E613r7dw8MVz6*dt3P69=Ud{Q9PP&j87RJ|fF7+oBz%$; zAE511l&tfD(dNXpWpxL9mSa1v`fO~+|FSdO*Oqfa__X$@Fcg>+TY@rj6lF`J(lv5- zsX>RO=W*}9|E*t~DFzbJC!LG0iFl8;>3zb#nve;V&j?@tz$PiKO9JQb&12#@sawcG zxV6-1kfoi$v70vr*UxwoZR+~NB3B6a1$FtgGl_*fdy}WM745O*iuYt*E@;pw`tL*= zXCjtThzj)mW8go$-%l$o_M&z}sfO=oxg?Edi(~t}Jt}zK?>=N4a~S1E;%8*k zKF@k4c-*Jli?_H$?OOG4#@ylL?DIWQVQBQgr8|Q2DzwpcN>^$v+KJP7ywQYBISJDX zdDxX}gYQV+AYHv{fj)L5V>SWwZ1_;rGWdR!bcGe@!E@43K&ZS%;+Vag0W{bqazQ8O zo&;_NV>tki#h&dYT{nB7D?mtu5Qv~``i~*{4s!O2K!dM>rO)g>B(`x*K?H zfcF(hqD`Y5L;F%q79SIN{u@OOc7N7(L7PK|Me`d9L@W^Yf#2Dg8>^6iBW+|cE#$%i zj$wduP0<%xoB4fbfl;?6&*+r&{+mv4d<~v^Cyg^c_L{R0PmD1Q*GrCx_tP1sNoQ+m z13*tug|^^ND~yUfy&oPeFs^<~Y8N@b+q$s-vnsR=?*PNW2-=#(mpUiv7u>RML#e1o zRwH_5Jhn*pBJyM%R$dy@J#u}Fr6`8`O@757v*pt%P!rhkvb z>$v1!WSYNEirX@1{=Z4_0RI1`6i?y*DT&t?^1m*{Qkd z}1JC@gWfFn)WaHTBY+h|iaz#30#>QBc-AXLT_j>$= zB%Z#=w3?F;pIt^cjvTf3 zy_nGU`y|5;-jlUXJ+&gx`>!6znEDh5*M1;$R$f2fE;YXK59Adk$&F{3Im-2&qU4{_ z8U7vQf$`ulGlRK2<~wo|@+I6G1vGhRc{R=t|JG6WRKXa`(W5dzq(kv?UK&uvzSRO~ zH|2q0FCg^74#_A%9b@5aV^AsO>vJ(jkH!yWOrk&!zFP;NwYy+fhYXQGE}=GMJZ|@G zuDe5WLorkjE+DiH`&?gAAIKM+UVU(RHI51A69dpX0xT z|B>W<-N{uRR@CHUjt^jZi{6hsq$(dgwNUIqIp1^bJDYlB@Vo(p9={G~F6jL|vJ`p; zpz{8!pz_plPP=WOml?O5=lN6dI`GY%FYBIto{l^A$+8<|=urid`{j~l%R%Bbp&yq) zTRsNyR1Rp%--mb}{{1S%=S&4{c{jvUF2PrpZ-IEg4O$+4ZWFcMwg70$ABDKBg0}pp z5D%z$rgD;>%ZT%`25BQ(W33Qvwc-$-|INe9^sXlxdjP_{sC#bV@wGbxTY!FA99ivD zq1#Nv-EjRz=t~pr1BrZqyn6y~ide{VCVnqjXu%k(^n(7xamIZ6uwR+q`}X%H34Qbo zGgC>R4F~G!4i(x~>i=Y@PF@A~QLK@SudZsSJ_->2?n4cu&jN}35Fp&{0%JDl(Ht*S z2UXZrqrxA0GfbOJSs2@U!|}VSWn?Yt39-XM9|Kj7R;;SE24PNBa2x7})gcHh+88V( z5dg^z<=|12S?&^0Lio<8U*dG?%OiAzvTo{^xW8D$pBIN}hM94%AUqc4KDoXASe%n$zb+t&F7o*TrjFPBZN*Oq^%<;yqmdP7g5+_Zat8>~k^S=PUO( z1)$~PId;xqNx6tYp6t8I?t9sfB=2^9ZeH$Mcx7$qb!r!{BXFa@r@=A&6nHFC8@yg- zymJz1Q%<5SbsOqQE@JufAzq8LD-&y&+aEB^4|3xQl$DRfp112@)b1zOvwA7=<@ZUK z1iGhq{SP*#U1064;Ji3~zdXHF-BP>u6!-1&Iyl_{aAYNbR-uweKm}t(E>wOQ^yv9q zJ<7*)Yq>G~AI!wP{3d`G@?hzeeb0-5VRL-U<)bt0jM*VW6 z&+?~oqjH?%NAWnknpCzS?IR&@}NhOoU;(CF-lG{bK>utY7Fm5W}bd8WA0Xcr1mU0xOL@JX zH-oK#hlusx<!agkMhNBDHwVB0mu#}@^k`p?4|Q~H4(oxWZwLp|#o zz-!BSV4$8JRAJ~{6^7nXpl!ttLT?(rj-QQ@{%Z{QfY5KLV1XA5q5^Fi7k5{sKxl^o z7FpuN+Ajf1+>;k46=;b{uM!&DLFmE%5cAX(aZf2~QTdW9_&tRlZ9SMV3y(4r*K?T+ zm6Lya^q{Cs<{HTGKDnN&6WR&TO(Z=!Pvoh6{|}7$I;ZL$2_SNiF<^LFh-CLwR>7#q7d0(!=lOwBvIWl@&Ml8nsOElHjv2W2sL;>9#PON_ z&{b0i@o|nhBz1inF4N{E{EoKonR~$^tLv!(gg*12$b(80Nyg@Sp#HJkF8^3w*J}e{ z;d)gZ&+yLS8GDHTZKs)z^ zI`s6a$m0%;xP;IA=oDxlW6U>jpA?@xg{)1fpuND*E`|_3C-(C?Bkyp=Oxy`Hl?&ae znczu0qHv6%?ne{@b=mGaf%?lKK1Tsv!ae zyxuKoW+v_=Jcl^3LpHFzuRJ8R7nj3*WzBzDgbZdM~Z=SK7i}1l zwTX*NdtEM>i(~p_Id}pxbjLg-azybZV^U$2K1Gklyih%&C`tT2Ar)5Pp2Q@m#AhDx zLUjXxH_+A^jm?IK&NJr2@3Vj7d-!*1s_x0QgEsH~V9XqJgW(4?-l>3w&)YJ5e?*a! zx2J{gn(O4(fL7=1a{~2U@a^>H!|5#!KhaU=`Iwm_3M3nN+)#1o*|f;rUsM8G5M}-s zZ!&_n#~z9S6iQoytpV`w>wJ<}{x*ou&LeA65@^A;)@WLW?>Bfzq*pGi!f{~x+o$TD zirG+YyC5>6NZj|7=m2X!V?KN~o$<|A+hA$O5XApY2F?GtxP$0iLa3Bs-3@MH^^UX3 zTmY}i^R4wKc-sTxXM%HH-;^H9osa8-{Wm!4HOR3-d_2d`e^%mm_9&ZpEh-r-+$$Ji zJ@}qoaA{p%aB7U>Gq_iHR%0HB@cqiLa7-o?#|(OGHvmK>fO!obh@3)w9cfa6?(e&a z^*>LuFt67pLwMjP5bu=*518T1{UcE)c;fd2T>kq3;rqotD=&!q^GLG{7Cdx~2gif& z1SHV#`QLrU?=9o(vNqpl%=ZsBwDWVULLbatY{le~s)5ZAk4+V{9J>~@frq6y+z47q zo^(dO1M$Di2QBp&EcLI4_#z3k&e|uU>6&f#1!kv8?MkTP^rnhCAv_gpx> zf8J*19nQW7Kgg{TF+ULh`*B`>c4^ElYEQO6-uxyHp$`=5(JE)HxV&f1a|K{g$FIP# znmu6sQ`XM_5dU{>Q@~POyRB|$_y0!daoFbhLOoi+nD6H{GXp{<@U?bcQET@R>v?N?{= zdN(+(lmeC57DHM1l#umBDwh>~ogKuIyl#tszKu}n9-y`h41l7YzdXfl_r9XlKx3ds zQPu_u-BxEkq4QVQ)6NG8-98E5BK1wsO5f!^I}2?!K8`tl;|-+!Pw5}WYhPqN+4*z2 zxS;a0km%sL1<#ZC-T*TLvZxW9a&s&&59H|mZ=G`diWeX*<%{!y`+O7b=P1O}C_6 z{m9-Y4K1`%0F}5tyv~1~<4?;2E3uH!;sDR{%-0IIT-|=z5YX`1{ zc!DwQF!CTMZsdN*ac16;3kLpv(5d&XKTI|P+K>RPgR-=f$x@>}&a{Dy5}!Y`yxM-J zqqGj7(H>(OQDIu$da@Dl-%Vh^sr65=m4TfX6fkV1G(qJGIES@oIYIV zg9k+}SQn0GNaSe{S&weTzklWUZ)Cwwz**Nnk8anJNd zDWIKFK*P2I`2P^Z8x-I*0Pb}55)?hUSA{-o8^8b7DP|U_Koj2s`e$sX8{!RPOiO&v z$=@vjOM}s>H6E@b_Z6)Iiah*VI44<;qE4sFdbAnOf~-e(GvuXiqEviobO>5(~%oqy+70nb1THp*ps)fS{g3 zKOAIcVjkCI>t{cUJKw6H|51Lo%^0xWT}&>cvo< zaB-a5C1Xl)D6NzxZKXVv`dDB{{OeWFK8AMJdMO@2K3oo-$$Hg~GwgD`>N^nsaGYs( z7D8ndz>9rif7mbfS$0LAU%N`kCN6)*nASTJJUEWP6>VOBk!gWRc$TXa&}Qj+|H|11 zH$4F4iR`$aaK`;bXWTCqL-%AH%)exq_AdMXUW-GF`R=yc|6Ep1$K!pZ`XgrYl#-)lsJ9UIp#gZs$}z3Wc?6 zbp^EJhnaby01RA%n5su@H$*y4iaYvz3AB#aAf74!?RNkgjsfyP>o6gnxEeHE+h-IQ zdSK2RBdwJ4-0`x5853O44N$z3%S;7AW#!@W6!k6~JI;U14Ut!;>d}r7 zDIP0ZymnntN9jMD-#MMRA@U$&zCY)QeL`D9$d)9OY~Y z&nYWujOBpVoC|T1_vvTbuRuI|w$r&Cr6mAXaLvqRc)o++pPN17av_P-t+~b%1UZD~ z9QpEsH^bE^>-bu^g+54f3g@FP!oMp3>spjMvL1bwF<+UaM}LtA?Hvj<_DZ0w%Y|v{ z{J`m|M1e}K`(MbdLb@t@GhB`1PRXDhXUumHa=`HG}R@w=0Z`H)tVjQL8?o=4f|w2fyVk*h~{eI(@F_?VE_*H4oYs=Rx}jzsFJIkRxc?uS*=i8EM)-2RMF@f3*|`j?szj`$A8B z#LO`TlBWbtX8$pckyM@p(4)Wjh?!EZxGR$saSl2%%qNdA6WhW5)WSR0CdQeDwo7cB zX}B*jD4frJ0&$eF*cRGs8=QUyMO^I=-0nAiI?jA&-V-^R0MgE{o?vGE`vUiE#Hqvf z!;G*q{uKn@Zp6KuBlI64>Ct;XcI3wXOL0~6-)H8v0PUSheHZd`TPD25-2G{0A|LVP!?Y+r2_GV05DNi;}fp|+FB zG3MKlVOon^$}ts({#$(IwtbBVZ;bER&p6u{dFdbCmjD}66m^WB^uqt4cU@USe^b2!xH= z3wrb{*S&=8*TQq7!OD)~y-yj(KG{DP*8zEEwiYiw+y9}^1$o_T#|Fp!d5{@>EyRv zyH#jQ*MQaF#Pf`-le>64)!QPT%KVU-b{Wub9$}_EOEMn&keN*f>M2_w>QO?#iKlu* zGCtld^y`=kmDuiH6}IlYQ*}7SFF;L#*IK{%8<@;|Bc_pgp~S-=&`pfL>}Z0G{u){s_0}wnBKZ6&Pn>95asP zfg{XZfi~*X^)y{ZL_8ahk&t#u`P{~9#j}OKA>U~@P*3eyMEHOLK-U0|1qnT|J0ma% z-u@&8!N$E#p3b_uE_(s7hL;@>b!~Z$XjfNYwZNkZI#{xUFNrk{0HL-IXxb>Xe{xtnA7R&xKx4lr;Wfrmu?Sj|J6C$#NRVQcVEJ?)t9wm8P?nT7mJHJni_3H0cX z7&BvM7V?_Tu``MVsE^HeTdrYIzvcK4GnWi7({}payr28S+5!%5mNjD4#yI2YFQSab9vkk&+kJsa+4k==>5Ok&=9{{2Ex~U_HhC@9Cdo%;WiHg#P+P*?4lh zVgwqSs%-_r$Rh(1gg1U$8i2KJC0EM;A{i6&pRCnv=c)lU( zVW|6{JbBxxfn@tSN_AQIHE=8m7qOZS*K@iJ=!&J6g2gdibD$mnFFzx&rH-ha_lD5^ zM>>|k@4>b$CkF|ii6MUjJz9H)nHyz@Y-h|@0nk?0cZ0!cUkQYoWWOiP>$6Qy5~$gS zV?kcMiV2_1Z%WD9#CfLa57+XVG&n{aALk8yw?rBgsBEbqG(8K1E!;OXA`OYXmWC7y zc}{DsVyoP~Lk`LjDHii~j{=TUZ?z_Y1XA!Db0ByO0aGyguA2hvy-@`Mpg>>0H#{sY<8?Lw zLcC5h_&tr2_QMZFjrK>}$F#L5yx7|K5v%NR^PI%Cy4X~sJKJumg6E=S_w)`SQ@73w zFSdqHvC3G6g?kDJ{Z@wcbjT1{!I*Dyj3AHq2R-`vGt4YnPc}AH0QdF2b|hm;0e=6I z#4+rai&`ZeC?C&yptx6GJ0$WsaLs!TIrkQYLcZC~9moSNpfL|v%~6Qlc$k?3P7c!M zgTmj5dxLAO%OrwlQZE1t_jzST@R=LT%aG`u<9=9@>{N%K$$U>+Id@s$14xhfAD&67hsRlE5529b!v&F8E{W(8RK{@Z-?+($pJnDo7ew?? z*4-(W%zghuW^U*DeOWRg&-9=j7Rv==-acM)pa-9|&>koxlw-EIz~~6c@edTxIx6J& zoC44SZqPbP<+wcyw2qlFuVLHak>liQ&^n6cILiGFx6E<4ItpZN?{v6i9<$eRLd>J% zyzs*c%=)sq**MPFndQ|N<+4`XC;bf5hLtj2UuZ-rNzD&t-=F~z6GfLq;A>uK$H2tDHKC_Sm=y_+CxLk#J>;k z%b5EP)bl!O{xwo$@q1{Wmhsr$)8ouU9>Z#Y9%9UgV~r`GVf%6(uTL2*pMa?*TOY?u~sJ6Z=lzyZ0k?xVMmq7POg<$m_{$xHojveRG zgKgvcHH40=jcv1+5&EJn){f+YcJ>*?IHLGCmiJ}_`lLd=ziv*zXxin}PX#&tV<+du z2f8Pl`-$UEf56Na4ly%5Wl>k)IYNUfp%oyv`a$Nk7L=jo)y;E+jW$?CXy7@Zn}JkG zAT6<*IjWOR~BeA6QWFz*s@dHt#(pG#Sxlr%_rw62V zT(46Zrr~$%aGpw8a_dQE_GaU?REX?HUUh+0;XH=~X3wtuybe%l$X*GS4~jiV<4@)i znpS+F@NufJd}i&8cO046(>1KfA(VHA(4JcWw53VN#Jvt?<9Vf==eJE@tlTDS57a3j zuePh=H$YoDgbvl>BD6CJ6nW9?3^S46Ca!|+&LrVFz3w9Pr4_32eHlD>o?k!8%n=u_ zeV81+2Ih17tDVqPA$02lPVCL9TB{*%P8Dn;6bb=tGM;nSv|Z)6Wq5}9IbU64Ag{pv zeb7U!bd9L}`w~DH_xQ^|Xl;|kF;3RIb<36^REF=jg7uVK-Wn^=QJ>@Yb_;VrVxFT)X)-(4+Z3q8_1Yvu>vE;!;yIm&Kb^%3QyTL^wDC=qhay)evXiaV~YE(Ji zBDa+I0&ErhPw%j?BcKa@N5ip!Jt?#-C@9Au`TnWB?AWg60m z#P4zluUWf6g`T|!m>H9S*X_cykz%aJR;1(`LWhn7E(rWJoMT!kO@4i^z|o6Q){VBJ zKOo2L5yo>9aIaz+#&Z+=_edi5X|)tjaV*yvq1SkuV02E=qX+kJ+^(JzqIP2P1IB!H zz_He*9S}ax{x2P6X4=JZ0#H`-HNW{Y`OnTRKRL*J!^{5AwONIstj$bTU&36>>fj0x zdc=tl+j|{!ll}E{RFRWcV(u1$-roWc28VAH=M(y_3T-#-1_N#4ZV$1f+hHl%Z>ayi zP)w{2xu`KX9kd=7q31HJr=+Q#+7Dh4(>x2b8+K((DJI@sln0vqjAVRe*MyF-6?Kd$ zHZv0iJa5nPLDsorv-;;6fugK{wGHASR+P%a=U2;k~ zW8&vNe5O&1Rq}xL;sw^deJ*hPIcewzq9$V=e5s)TwA5RHR+RJJN2Tj`@;wrLYSWyt5-Iu+O&)B;8}Uh>t$ z*_t`NBwy3V1ICL3%=9mUczT>^+vn@i;37S$0C@3pZ63-wUviGqE{w4GvjM!>m`!-9 zme>Ei@QlQDLOc(KqZjhFO7tk#Pu4m4bOFL`2Yi1M zj9Jg^u%Zz1*>5Y*-3}1O@s;HfTBblxYOdhJ3J|L~55Cl*h;}R9Wo8OS=l9~=2*1~~ zYGy+mf0qX8>Gro4w4(l`>C*KT0UVRuh&E#&AZj_hhkRtJGgeU>HxxL*%-B@0_A=&M zrx0p0=2KOCMr}+xP*6Wb<*V5P>{{NKEnF*{_XF*eRL2!OFJ7pCnMGSF(4p%HRG z+vv;*@(2wm&@*3x?j3Go;oOi0Yd~rI3CA2F*77{~lBi$DF}XrN`v)^0gwZP0ABJ~l z#68;05DyNZUFZ$r9(1@M-g%g58t74!LsCBWEj0!t(2(YiFy@n0V&V9jWw{agJMzdu zVF$Hw94m)55Uurn`S=eY<-_w?^P8Ei1 zAJ9+SAHR0#{#XhSn)U;QMZ~hJz_Jy|nDUmO`%b5ZH|lmEL)i9TehJ1@o`i#4GI*oFHmu9$aOZ;d z>$iCw28+F;b|LTNzS^50o-c#e#oSLE8dx~E82p2gr>`YzIKTFWcdB6xL-v;vt!=poDb>m4*hdlJ;>K|Gp|kl3a^=x&GAF}=ed2?iQK+`D)^%RW;dU^ z4WQNJL7b?dk^Pr)=W_tO#EIi88YQ&J1BU)|Jw3Mr1pOnw$S3@+_pw1{ws2dsDESk| z510BAp|AFfI&U?HGiK^f;$HaKL+n%Q@umQ@J#S^qi9YjcIS;*b9)%x=pQ%sA7q(p) zUx?rFIEh7zt(P5)^!{PtdqCY5Y4)vQX7cz50PVfKm*b5dV>I4Y;g%7$7 z3Kv@(^N;)F{@BI)xmn=q;(9;LnE5_qreB9R_NSJ7eXY)z=Krb4tKRDLi!#9vD#zvc z<6dSCGv>pw@puhT<2?#&B{?F71Lf$mdzty7Yn~zQ_llFKk8vC#1-gr&c;|o{;(rIw z{;#Mx7;1KOf_4uWJ+65Mp2>E3`c61B*XZT`soE}BwWb=^H&E!dvOI6oUS>9Lf_N%d zj}jnjgBhkx#;#X5uH=p_Sv%{|Vdm?`wr9>Wj%D%p9RC;6$}g^6Z0(EAG1{M)Bk<%@ zXiGYNpkFA3Rl3Y|0;{)oc5IQI4&A0C(bpJloN1?k@g{{HZECWE= ziF1Ilg&XtjptSc z@&ta$_6sa*9c1PnhZcBE=2aXgf#VtaVB%lai{R<+mpWBu(ocH^D{1jy&{;j)#2G)rB72!2NCu1N^wgtlg zyqHZi$Z8=AzIN1+wd9k0{)5lp^Ej_j#(d8VqRbIE2nn8F+|vbD z$Ko8#gf2- zen19G8(|zbtO3{lJ7Vo|O}~4Lndg)u?#Eh!&$xl!j?dgI^6~i|6r%hPaVp#&IfC{Z z&~{mm-iLOCs`sx?3;c%e0ugWUOBt-H5oYSbw&i`cj4}THImMg&BL3zEdQ_~-5c2HT zaP3Rn)(MWOrT5?E%wu8<_dwjv?I?xWFfHcPKbz^y>jv!OCWw=(KtoybSH^tTI&`K3 zkCkr&J7`>UjF}U3#aQKwDh#FWBh>n;)Xsgx8CHq&S>*H`lk{j0($>Gi_4pj_r44#C zajn}b!1iMh59EmW;|1wUaYdcDKR=ykNO{0(T~Exx!S&3}8RwgA?`@~9=k;l3_TDFA zl7jaVS^{86`9O6Us5bz{P)5uvAuwO5y^vhqhYE4E%7?WgV-i`8*R6+Db_lB;BwYMm-HyE!LH1uv&*r?oH1j&7j0%DE#n&C zcyJwXeS=M6F17cH*eaZF>RPw;r;J#?n261Z{x8OS+f*1@QwPSrC*~L>3+EUIL6089 zbC1t{LtsjPB5FDz&;NZ!#B?39#XZwG1(LszfucRG=Sth~x4pKYO{9x<1?bs@d@Zd& zli(NRUPAQ(pqsFdfZ$h8Rev#^f*q^hrWTOEDO(8G*0lt$5al0I}>@!FgXX^<+3*j;cSF}**BDg1=_N5pm zl&#Xg!1Zg~K;Oc%sObH_ww*l#J*qkThWowjyf`aAboRen(WBoy?>vihnnLJH9Ggxy z&M%aWFzC@&L@uLMg8Iw7VA+qz#@SN0RW7jW`%x#0ZJfh>gsl0hF18Hln(N$FJS_^N#_vG95dS>N@jQqJ3PD4fN==G6v*!^yAOo#Yc#Thr`?%7Xmwhj> zIF{lPLXmduTbz3G%f$KoDS&rOkwPVoO+DM8*_IO`S7}s%5cYw(;!|TR+@L@kkA172 zY9OCqp+H+*>}mrFH*5;57Jc8G?OSqkyHpsOzM9bc-TY3y&8`7%SHP+{#^$$#FUjWd zOw*G#>iUaj8&AC@FfAo`subT}UjYW{wK(SXTv0zHy$-Bj-Ym7hCd0|}I%1_<++L3O z&qBPx1=>6XC{@anC6tBn*%ateeisg4ofsE6>*-RrwYwRhq-oGJ7??3!kkprK_Y)OsfR;8SM zLS7TQ&TYlqf<}LAadGB{WuPmZ_EQSQcyehy09)^rhL$nUAo3Yp!P#dJkJAvyN}BT5dBANh4Y zcrGYvD697j-UZf?7r^57?SsO;4OYQYy9y|eBYFv}IXqrmU|el1Zs&do-34L%JD3An zvkZ{|8BUMN#h%$yzOlAU@z1T5^{AvspW31Rnf|Q>c_#lonr))g>0ofIp1lE*AbN=g6)(!_fHLz@5QS@ z`|i$+>CcyW4J^MZa~Z?2&H%U{0{{KZsmX(S0JeE?keSHe6G^lU%af&7^cRrz=!gt% z>^GacZNH#f$cwkR@H4TBb_7~$<^hj=|D6Z4nj+w_?=?P%2R)z(T(;umPY(*csAvoD z_uhL)V23b%2@p&UtMAE@IW@>e2Ie>DKfefmY;& zkH3{Mslevw_H+E!>B;mFN0vX*@O+01C)+pco9uN&eD2pbkz73*P#|J2;CC52XQ;4r zM1e}F@qy}u3yhi%Al|Eh_Vy8GrXOi|-j92fXyI*e?2A5q(=`BI?CZ~yp7A=*Wc&Gm z$B>c8a#eP)Wx$B!!ctzl2Bed-92<(qdAMK~$7b}B>g69m{N@s}wv*S@pAo{p6Bn7L z!RY*UdB&6uc}C*~8Fh2-l3Ey@9|V}f@$$deQhFPwy`p5h0+rjR>K)f|8CPSSQ+f}^D?SIdhHvWxcTqg9FBG98cj;~SZF*x5J z=YaM@0Pm*lf!2<{2CDDK6_`!jH+&1B*V`({NmYi>zmG38C*RzR(d~bH0SfVSEns=(W3<8Mw&0^8vgMq7AK- zw~p~MQkLX6I1Y{B8Nz>0<-+M&#K0C+TG82Ta3t!RK)tKbf?S_$)rta$G#~R4y2M z(dKaxs$aI=B_|t>F|FMN2Cg->WoKCB_vErAyTLo9Hz{hDG);PEg$t(PxvE=FHXd0? zs29)IazZz5pVt}$Wv7%1a@t?`X2yIh!+eo4Sejt04fm?DSt^Ps;DN-Kj2dNnHclIezG5CTi3HHY(1+;p^18^rmHLQl+YcvsnCbILlu;GI&<}CR(B`^ zLaky_UHY83Z@uuhj5(&v2tANXxQ=v0@r4EzZwUD<{=V%bGyf+9=7S2mTx0id3{C~l zx0T|ZD1#3`v8TohanvzKJZw|&5|CiP-ORVRpj3PPe zW+3$a8lW4t)JC?uApF#BX1@4eL@C4x>_>o_cQYjr8r8I zV(zO2@P;IiIIjFP=Y%fTE|-SFIk(RLY`s%p$9`2Qjs|2d8{F?JGeS9#6FS22^@=z? zxeR*LbZVmO@|Qzo{I;su>&iU1Mo*Q4N32shU#I^#$xK`yTocq0UuVo$<6!CFT6JH% zt;!E@nqyukIyTh~FcZ%R=bb9@Ln+>Jf$><<8Heg=KoNdjo3d~f>gBl{H$5ahM`#dW ziLDfe5__5X2KJ*uJT}TSoOd_eS|vRvX#Pc;neZG?eD|p04av_TuPNtqC|8ERMMbysqo@nIf2o*H5_#T}+wzT7kH$X#$w9zq}B6 zN_cYoH|pi%d&P68lMMPgO4CYla_4boCM2lb-p^xD<~FUJ>1mQ-EJ>!m5Ts7us3 zf_gm1#tpqP%*-Nj2gduvv$|W{y@a;*e|lYM$49i)E&`gZ!`yVBo(|3enx1;q_53dJ z9p^652O=K)ceRlgfJ$k7ElvA?`qxVo+kgO}*}R1ceW5it53GuO(lz+=oUU1Ugl<-$ zFL<_=9;pIaH)pXmSOr$v4;&xa-XR%(`LoDNdSOycn>9HQp8WUZI%n8d+D~YcOlZS- ziRa}=dE6)1$91+n`u>5ur!l7I@z$@c$ouwJYX=E~GQG->{GL4TMhg69Brh zpP8L1^l^;H@L~(rlzReUw{@j|DwYGF|j_WFXC;(O< zkI>k8i3anDh2zFCf3=^-U5Z>Fv_EGNigq)DPS5@dU zch519SElcEa%^r9bP;nAtHp_PMf#t>D!QQzx7EMh&8-}V1R&?e7u-ODjeEA^_y zR^S4wOcV&bW1I)-RFiXt2-^Q|WIi?CfafSK`|Fm!pJBdzE<*b*)sjSem)G*|QK4@> z_&td)Eao-tk!})SaP#;$9OIwPF!Ox{LVMq0Ccod4K_e1W>aw_-ArfdeOAyxG$RmnF z&x;xep}*ks56!$UHO@2{z^gJA7JYDCXesuAyaLBP!7CIsG~(17-|Wy#Hm3vS?foth z3vm7j7@R(?yF?$zH`zg@E6X#HPHG(**(*a2(m2kwUG{ra(4&3;isL!&Clho2whTSk zFMeOQy8hBQue&@}Lzh9@^oFQ4kGymR=+WRgW+H8%KGuu-j(hfwz`;k^bC0u*k2ven zJI1tqGMVs?+KL*Q>?0js_FKU>X9>QU&B+`r6MVDDiL=k zu^`pSW*I&mz?SCQzN@sg>~>2o1TQ z;qz#(6|02qQ$)RRTZV2NuTRyZ_p$!`e^b_iQeEeP3&>JqWhvd_I58p1s#zYwdM;ZtHp8&q^YFuFE(LQ-pndXyZ2o zefGc43{4p;(^N_4xbEX;tXSfT(u$=7C6%Lv}^e{g}4UEQF^%BIA*Yx!j2_P18M`H&s&0n3irz?3RM)j}MDH zPl5doW>KLF&)2#T>QWH=U_ToCKz8DtPA@r%IInwsRYjPfBz#1U z$Ku~R`NKQE;0K~0^wfUa5PexbO+R%|r4L*OIj(v^q z5u25^JN`rT1IcTIeen}Hms~F#^K^PS&pD!8Ju8{V|Jk>ttnO3Ln~V<(6M1feba`$T zSFj=hgz_;ZTTAzq0z&>b|Hzo<#c`Qs;UKMukC*2QPchb}D%#+t#MSzS6m77@g;9Sv zU!U+B+u-`Ok6dO)&vTc(n3rEB=--VpPW;Px2u->;qfCXCokP$o>IRC1pOhO7{nEBQ zpx#IYwvae8s*~%V-xvE%#PMm_A_n1R>5o+eEjZE+^Nv3=<0BP;k#;Uqjg>YlIG#xB z^cJdE!N+FtATuUeX{GHd1{!Bg7x9*SoR+=K3|xg?k|}+bx+V&|XKQ$)^eN~3_T+8p z-Rw?Svo11YrxQz={MN*otID8g!CyNzSWY*3oolW~)TLANO)i^MQtQbyWV!cIaqj8` zwf=u;)N=E2BebG$v$O}D&p<43KQ(iK+#}3W=2M;A3<^Tcm{OmiAT*u{To4i8$>)pr zM@xlOFV91IzL-BsyU0R(Ja;hWk!x#m^pgd!MhdcLK7GJ8_?QV=@y6#qxBgUwK3PDm z11fqyGN>7EqU|^RQJxd=_b0zEW7L0PGox`p=6vJhnfZ3|4Ds`I7w7au#lWySS?0R> z(=`2w!_25k<6{7eUd3gn$!`Fpm0ktww~Tq70802ic`_Yl2_L_I62m6@k{3PsmTYs1 z8)ji9%$2`m#x6b^~ihmyX*c~Rac+~wDIe87w<#yq=#5-RO! z=GIhLp8rd`zjxZ@@2qoTZioIyfBeH&_&rL#qy)CP(8gtmGpZuwDy|y|fBYMyKYpzX zv83--?kCjhm<0V)q0H^|dle<0yu}RaLX7`c-eQIa)GAAn|Ap;k8qqoLc*~ahg~&tY zM(7dgTO)8p;;9HdI1VL=tF+(|F3;X@WgH~NAvEtdToxu#{(b2mN}cMrZ!seR^ol+8 zQ@N+E6*lmk=m&4|^+B!pdDctZ)DmOuzDD14kQq~fT*~SBT^0J-qcZmDC-2Jjlwizr zY6&$v$XMCg5$Koaf9XiY;_#nDexIAF7z@RJ{yCms$puy%mbqY~a8DNgQjec!#iHHY zuhIW}RQPVU;fV?QyGNP9dEn#cSaIU|%l0yGDOS?|0MW&}9oOiGI6qM_;6FNDKQH{D zF@V2bqaQfRj2+4O7QRvYFZs**T=bHkU_^n84e6EpI1gHI3ADjt9}aRJl>+1rt9il> zv6?aCh=M?4Ds*jaqs%#+BV@HJP+z0V{Ze97k9iLfm+|A90#DvxjZ zj4{u5p#_g!;YXOXE$r-;dL#*SU53?gMkP_7BXcGBrSOwpAbBO9`)#Sz+M^=Y|Ly|8 zN2?s&y6P5~&mR@YEf0_sU%WgfsO(bj#o@bTyRRq+8K&xp9$?;c`CGSAw! zRBA395%_y0Rc|vR@gpu@j+G@gQgg-uTi`Oh1%!z72@O29SLW;Y9k4}NzL$Rund7c? zue>+;fQ*GADrVjIcV;vS|NERk&H>vvseWf>p$j*0{&>{^E~``PxzEq2|A}1mTW5~V zZbwgTJEi7DBP%b9DO%@}IU>s(EDpZszIBaW^Lu7cf@1&M(q1KeRm-mQRYe9uGxyoX zi&D=F#0TZxjJwclzQ4fQ& z^GdAYe4)$z!@P=|46iwJ`n=e;J6&kIov*J;ImA5CE9UiKXI?MMyZFgraR%IzH$bgk zg<7lJ=uN!8z~b_64yYCW)cL0CB^~m;W*cD@v2#CPU|I8szT1T!8A~j4WPbdvIJ*l_ zWvq;<)T(_=>N_n!uOGCc@(Cg^YKOKH{lWdV;j^!d7wWpmLTIM#DeuTL-<_${dWXxL zskA$hmeO6DPAwm_!RA@05HaU6U!A^fZFp=OW3gBf^jZbxgXt36g!lQ+@|?RT_ptO+ zyzheSWAWR}IP2t@J@`5^5^0W&akjKE3Yzoq7xF{_q5JpR#y{vEVm^L%DTfnpd;BS8 z)Itls!rRAK8E<>x1&Ilt_crqg>?kpR&n10A+mg0w+UWRB)Tu(p9h;|0TVAVU%lnaI z<9!$w*Db2vlfD46`7<>?8c(HWWP@sky)cEn>oy^a_cW)XLf9AXlz69!^Ds3o>-+Nc z#70<&?W&$w1S_!)7W-gAcRZb1;(Su|MF0IHGtS*AVi#kMzei62wBQtIL9FI-u@>Yq zG^>ZnWq#praW70{APY@DXm2~h4C{Uev%n`YCf4L4RtQ+N8zlC=;BD6}G;4v9+kxWA zTFqE|BDLyHGK2qqGr>e`UZeg414dEkb)NxOV*{y9Q)fpmHedU0y7flrQAl`2n}td*6_X5^f~mb#)X@@WRCaj;d@~Y ztG>XUK=x!z%@%VKkv1ZE?bR=MI=v!yM+!pc?x)rrDz)APV)Bg66HPfOaY?z%Ler#; zp|V$Edk`0`Ae^rDN`G?2O)Iu>9;phy>0Vyfx%**lfsCR4eK8WQhx zdJ8dS#gK{+Uo$&h=t-=l7GFE-{>F;K&bdo?q4a_J=%8&3Rf_m9E3p>Vy>Bw(KE^yG zL-MSIN}~JbkPbcV zFm@+no_A8Ib+#UsCj&9Q&U`5%H?)~>p(Nt160~J^5jAVmVImWH)=9bcYE`r))PjKj z-+cPl_u9t!hdE704<0EJa*kN5%dgd&(_toRM2^e>JTpO0)WJGG4zct1JMy+`n!xY4 z^t=XEq==e{c9`#FAXX*Xfyj|j1Z{B35&P0w6LEwaKj)kA@$Rx!K&ZB-_ z>$rTCI>d~4I!aEx!3^H!FxP1uJO7AUWi}2mV`!1&c_ZtnwEgy%s4M_bEwsoCgO>#&fnM~&olpa3KZA5po_8F z4wK8pBlp7UdxsgrWz_mmMfB(*Y6<+8?bIB(ms)jjEjqHtHWGCbr(&H-t)Dq3g02+K`yt4i{!Vz-e((}UI|+e6F42w1Mf;&_T(FqHp<-cQv$O-kg@dm zlZ;(T=Q_$4+WOlV6FGtY=Gcj^`M`;jbMgVz@;2_Imj0%+AC3+&!{l^T#AQy7BAljQ zIOw$VzyfRdM_2k$az6QVf09pn{)s$#@RD7=-G$LaCCsE$!y=kn z`01lr8ypyrF+&nROW5aoTDGO=@XgRS6iw7sP}8qLpN6Ts5QeUzW^9@^bxhT2#-^cg zESY<^T}4mhqt^;udjCG#cszTeqXXwfSM=G&;|qx;$~=3m{`k^~qTI{-Y$I8wmY2DM zSeT&={&GOXpS1aQ!9t-n_=^GIPh^UFo8=kAeSPwb3lmYy$MEC#nQ?j^HIrwexwliZ zWulDB|1A)T0mVeCs;K3ADwmpkZ#;KQ$VMV2xX=x&P!oR6ZHTAp*}@K>4K@rhBUi)- z68+rU%)lGW=u4G+M92{HU{WXV?5-hZgo#`yaL>?RxyXz(Ah+>|JXhHNJ7(}T*O!il zT7nSoci5@p5>A{}RT1}~gtzzp+ssgb+`fs@hnAPuobpMVy_QWa>Oo9~pL9-`lcK>Z~mbVYaB~@vokt-}|P_{dLO8+gf>0 z;%2whB=Se_3m)QS|r+S6wnk!+Yx9hLZ?>ko^4Xlgq_NC*GneIS%;v);%Lt3)oyS|AkJ zP*oB6A*o2HlcL*RBDy$F0kTOh$_t?!aA z@|@mGnS6}z!44HY9dnBHmSk*s;YdQvNup=Dcx8f%U;e8DrhIN5#1A)47G~(tXu(E>EhnMLwO#LI=;@ zg$6f~{zk)UUVyGH$ma7NcOg{sEi^pD*UIakm)#6e_TaW`Wb=CZ_M^dffrTp7NymH^ z3q7R5idWN$zHBu36^Yj;zIk}IzLzo28HF4i61m*+qZ1W$_&kUWDR+$}6mpQi)1@HP zWwF?jG-`3#nCq3YH*uQvo~rAGw?=V|z$6kD}rQ{tZ7-MV{Q{S0U7wt_mCxH^2Ug(hwhy&@&VHeWf9h zfzU1d`dK2%e=>oWAtFcjW`6w@BCyFmAqe%oDsfN$bv%lNhctxUTJWiCy0$hAq2^RP&*zS%kz@PaE+?Kq4r*lgvdA+l9%VNen{-&I*d`vEiaHUH08Z{JI32)pFCcb#YdFz){Ghqk=Km`BMFm}^nK7AY!^^nF|IE#8Nz zd_BF5hL#cGgQ|O-9N#X+JYpYgDb~p)8`EW2~)sipcnjL7}7FLpr#Q5UGUKw8u8! zMiyD!{MfJx9dn^qWs*1WK+|KDfPPwq&gy(`SSs|0s_5s{$BxGZ71b`3Fa^iDh{zWx+U0$ZE3hI8wRr!#7Eo&*xNNN+Q@MQUN630r*mir+ zQ6}{6gqXJ}0dcRbOynB4pymWdINhH|t;hz5a=6GsqD*t0<1e)l-mNGaU`?aRO_kjjyF0^Qcu!sns02JY7aDUY~!TlW)a`hUG4Vh#Lnh$8g;3Lg-@^0p3>^w85`~R&;%W#g!lpe*r>W zaV%ya_1y|WE|+U7FL#zP&wry}R{vdOabX*dk7F#<*F+i)*et}yv=2mLEIfjSPk>PW zDJ=dwW1gWjZSXV3JpF0f;4#KL+nn4E%M_stR9v2$<;SO3=!^MV{&JFqDw{|{+t6*nuep5-*;S7?Z&Xu;{3bZwVQ#^Dr#)K|F>;^SP1Jb^a`t!6BuA{I`E?!AX} zh<3lw4*yo(FWwfPQ<6)|dx;k0>qA@T&E{?KvO7|=U}JWNxA0p|KKmtTsG5LKvpV@$ zS1LlygJ__CW1+7AxldJ6OUj%j`mpMX@_oYF9#T+}|9iE%QgdUL7t7ij)A8ZZu_a5l0rBfcf_Xr zB)d>^z6 z5?g5d&D0teF_x2}doD5~e3Zp_9Z|+SB2OA0>vS}@&$CeC91ES2vAFe{&#{o-W+6J` z@D|^>v@))TEJ>9yY)cd^_$H^}ii{)Y;}~HqG&@xb?*CtNS;%vh4Ne|$zTc}ai}kk) zB>hX=AnA~AJhdo6%%MpGyzI~oU!X-UgpRx-&unW`spUiEk<%hy0(u{wNUbL(QtOQB zi9SRSiz!&+}k+>n#fz9R5(jhAghQO3kkR zM}mp^p9lSFWM%w6f3dO-q#&$Nvn~}TSzWk<>oZ}2Sh z3pXKU;joH;Hs$LJJEwfTp7XRCHySui@k3p-R3S3~l7Vt$Cvi%qxi}AWmretd^&zY zEz)*j-AqN?jk!aiT*r!W9WhX+uz|ESmX?d0uSeFC0=Tfa5NP-nVYSGdOlB2|XDHxO1)%>KoFu!E?K9<6Yjy zYt+Q*so9CwV8W*b6P;wuF6Ta(pk)Ijoj*&|Q*+qy!vQc$w6}wro8q=1#tP`Y_mFKI zQIMe(QH#&(P&@x#>7S5jhsnoH#ERBaGY{HedGc%qh1u+3m?5ykP7o&5kskEbN(LLGq*J{Ps(lLTbpTn5wyXhx5E1G zS8Suuh2uwWrB)>EvNjZI`L06m#xyKm-9+0jsQH1yG~5&>2z9MkUGAIi$Ow0#0r~US zJ|p5PCPz>7*#=3&K}4BGmPIQ~8!=+Ae&n`fOnfdO4Nry57KA zg5s9?wf|$icckIqdws&!FE*r37IwUMUbPLV?O5eBq z|0>eCoSt};j?pu$cY{Np`MvX87BZ;0ZN;+k7J`zYhp9;jiuoMYTnFLbCGr^`XCb~1 zb~EOwd4M!TIE`qhW+9Y%%2;UFX2rbSh>P=GCBXYTycOnid~c~}7~V=vS3W(*$AEs} z`^H^lp~4J_S(%WSa1x(Z%@cJ@kv`uQi67Fjjr=((kMR1cr#mv~U1*^B^Vg33sME{G z`!N5eRBH8KWU+i`!6(y@C1Rc*hROGJxpVF`rjlqY=eMuVEqDC9+AzIB=i|f2=3b#^ zN#B@djCsT!f2dqPX#a2V`G+szIVb(}A9rD(Yh^M%JufPAu0Z&M7C;Mr5zo2n*#%Z5 zV1E5Kwvo7B*n!$|U#>`=0h;1$L-j_Vk?Zy*pMp@KPv*jGR4|Ln#D(8V{x6&*aIH2a z|4*I8<=?^!5c>SOG-UDp(VR+8R7o9fR*oyP^pt{u$5pg(y7YvKwvL6W9@{@hKUb&d z6+fDz=T}zflY~D#t>At6i)kB0^$(Rx*&si9Bo#VdvW;Y46KYPN#FqYl9qG^~_X#_N z9#hcz!PjuSUt-AwZ|3~t*##o^qvqgVB>AcEd*;`h=1AIev-HPM_}JV}&1KGbM8?bU z0AnFO4sn}>hAKsl@dm3-(N8NFDBmy{3_%a_lpBtf-yKQ6m*#%bDLRH^*uK5rJHOrURm4ElW z@YoRrv1C6UF>Rwc4Gs4ZkykDt#%A9f{jL4BF|>eMMax%}b9yK4&#lm(G;L$sLRIJQ zSI?i@%I9R@A~U$o(yvH+uJ5AAO`Jsmb01@#*g{qBP0ej>Nu?F=^>10iY3&kNOW-a| z+{)>x?8|@dwhiqhD-~`1TZJBe%@%QXfc6+)e>WdzC8z2XoqzX`nj8H;d<=yzM^0c^ z!9aCb)qj1F8O{F-PH{4Zlj|#d?>yMa*^ewuypB&p`i;A}4?L_x$mHIv9 z0JA_$zeMC3doUfPoOdWh;>*rmA@t|KgK(D#JMnVTp}8)n<=fSRvtPP3CN`GR8 z{@CwqZk?E+ANjsd&*Oc87M$>kZSZ}F_bT;6w~-E?N==`F zlCA3(Si{X)kaGD9d5aqNmb7xc$9ly!G=_!W)uiL`jR|b^!?L#GikGGabdu| zs&I_U6#k|KmhR9ZM<3|H1JFD7+eXq4hnH>qoo$?4Vv6-F#`!7em#^cb|D#z(IySm6 za8^ZNNWnl+T-C!(3#>D$8ZCr!Y#Z09Z-LIQzv<+B*t33t<%_F&4REX*!tOc%w@Z|9 zbA2YR>POZuu!_dhZl8~?;orJvBD(qf$BVEg@yzC6eC9JNui7oYL&$Nwk3G=E_w0lI zRk40Hi1o7Aw2k;gi9sOBO(zm}q$1M0gFDeBIP=9sq8_xhajTXeMF zYR)2>hAiHX>z#feesk+Emrap-Y*_exDy^LgIkxxjEW~N-iCwnwd&WH7jD=bhMdZx1 z81oFDV<8`u);>0$q3zI5ziu1- zrCKoZHAR2g6g;^{oH^b4k9fw9o3?R!o%DN5#*kiI_d@qYVT&Q%Csif7!G)gFcPc`6 zKdlmBdpTRDc3btXZee%6|8u+Z(95=ne+#EeKZ^f!A=CkBi&?u{`T&H}sm13k?m}o) zIxJqc>=l7aYzYkVXIg@XUbc;JI?Twpu~NUUC3s{#Z5Q-Atmr@glH^&#>Ld}T5KkK` z<$U1Qw`_y=mG>`l|CRBN$Ux{0(>8nr;>fe9U%x2d@>kUO7R+O^b# z8^yINX+?h;ifg@G?kDw2(-6`E0z<5r*L7BfUan#^zx}Iv*UPq{W+JO2K+U=)+FmzT zV!G4`8}u|`W9Pr;ROm|;;Ug4~eqi3{mfg0|tD>0S=kI*}Y;v@HHY%FWW|(F;7<=(Knj5K?Dy)Nu>UB-_IdWr#G^IT468D+LfsIjm-Zk zZ6~XVj(^jJ|KhFv;BXt-CbPw_N5%O zCsh))Go+2#e_7sfw}Ma-OSI@^Tjc7Q`;y4bQNr849A~t#8hS17tIha&%C?*{mh(>D z*qXU$Nal*woOnjQUY~Gq$gFkh6~5P>aoRPJRupOyi#g(z*M5F|Ev+d0MB0ENv*dLx zzy6vmLtF^q>_T&AHRlW0m9ZJHI4|V)`o4yW;`!7fS8W<>S4e9_U0(Wl`l6X5sz=xl zxxBMSQPTY#ihlKO+fbVL_zM4&z|Y^b4c>QQBP#oXjVK49?p>Vrd7>w$5&f)Vk9_JS zNk6=%ZRBM_f1fdr&*dwvRWZuj6u20PTp81~+cy5VUd=g@j_k(+)GFh=z37OyqM5dz zor-KO|NLtzVu|ytL@T1^2MX$ca-NBAr4znWs+Cd;6VR*8qGroE=u4pub|iUaiem#j zrRdxC*+$rf(LLU)v*Ei*#6A-Rv85{7M$}1x>I><5Vjj_36m8J8(>6BFq1K10Cwg=q z(TAPy;^XA+RrJFz*#@V>#7)f_ka{g0AyDXCf1Bo}W;2v}j6=vzp-%_3mN6Fli0^|H zYs#5IR>XnOHi1u`6HUyZ)&X1kQ^c~V^&1CEYR7Kd$a5i!e;;vCbJ8Zds|_9 z=a`T^W;lL;YEJY&ZHe=zf?6B6UOA8G)zeim?*ILwZER!AQ_JTm9ohawsorzB9ljRCv>w$Shu`p8@wMyksE}pwgCvK8qu4%+(r;e-v2ESTI#}RweKeJzuFmpf8+*T z8LthVeo^vJ-q)P@uo88uo=Ah0n5XIq71rsEs{YY5RsUGci+-r8`q2?Z_!A88RRs1S zUvsNB5ZyoO)+d*c4o*uv(6SSa)Y38#JA(YuM9t^=(_il)9pNIFXK-U_qK;b1g}!V~ zcR#v^bRaZoN%&frM^IjxxR+W>$4hze1O84x*dxVx&F~WXLJPFPs^mMRFkb{Mi!#{bD5<(NIEQmqlw;i)kOEH7@f=Yv_H)e zG1()P)LKfl;Lu)G#5WG7M^>6a(t$LT@c+LEl8$NLBOT#6u=-Q9;EdgZ)>k~_=!M?9 zNk_*;Hrg>fLl^oh(SpBt(>5M=VSxYV{CE4CpX+_CyKLhHnNu$Kz-zVH41;^C)iUbD#x36*NkT z4ljarbSun}C9rBtTlnuD-AYZ3>wAl+RY#%ovP<36q*IVxNF}cChG~1e)l-mtRK$EK zfofmXp`}1E1p*gE{0jnWh0a(M;N=pE(_c42F321=Eh$=XxE&^MfAveYG2Bkg5fxG1 zJ|Cy%T$CpkP%FiElimetRar9bh`%#(E3Bj2VSacUtebehZ>83Uw^57NadbO1DM9hm z6#5C?mqK~|&gsh>2WR%IszyIx%oA~Q`AZc(yO=)jkTxyu-2?U(K!k-H+ZLna!qlZAtetaUVNIJ|!GqwEtg?(G(6glVQ z#h@y+xIPjFO14ad^$Gv3Y-;`0`BqL3Uya#DxD;05<>zT|>0jk@TB?Z{{f1q(QCmu_ zVWtJcrPRc9EcO9nPgOa(<|baxEV-wIFBYfUNn6N#>GLe=&Ufk8UZ$%i-(Pjv`*E9v z_}-0><)xh7iT8?K`j_|HM)(exTPW!m>ePa@h^*wYae~vFfzCU^-;;Js+~v|6Y-X$; zCOWxl!yvzRUd@lLQAq0)XxWAf10q%>;nMG1BJC?wLCLCNzh0;o9P3b?*z(g<9OQd^ zm`VH0>Yd`8FG^iwFY@wy&N$uXb^GTkI*_9K_Xt0eHWa7mi*4x}&)c|b3F!!bMaHZN ztnE^2arq;8PZO~sQlERVmyd(IAL0BcX%mAMY>(N7=<6G{G3Pw%jjvc+&Shg){=&6< z@86MzgXj2~J+sgRxxKVz@7!bkKxkO?MkT!}i2ih^SSQ7r;%((Lni4Ijt(a3z(;)1; z56z+$pS#2&ST7R9cwHA%Zvf<$(nKY-e!6E)E2l%J9)^ga`ar?4&1ndoS97D!GUjP*8;8bN58$Qzj(9bP~!)x9|wR;l?P^Xaa-okAvgo~jTSFGo3FCy4ES z(>7|;s7XK;RsM-IEC)hOD$KJokFHrowO}}dTGjWGj&K?*A7jFAKe?XZrfX)&cs4PP z|}h8-|&`g3_bi$>|_taD!g!2!*wd3i^J^sKDne_Ekd;5 z$3i!GsoOaZX*;8mOYxwm)V$~=oy5uCGqcw=9=wKhB(8@wJdNlh^N5~MCq=m|?_ZUo zpPD6gUy)<;dTQ0CRvq#$FIcjh%ROl*Jv&3nhG9jXVY~9_+99sL9`%WSGRLL zeB&&A60~5RbCzkTlLEVUN&CwY1sPnH=ubtKzlpYY?X!(x&I1JIL4FkRiq>5_Z6on0 z9rM{Nwk=iU9uM$u^#7Yrzi+2)aGn%bXhr-SD=xfFuB~_~t)S;v@rLyagpVM9=X*PC z<1I&?zJ%E&Wa|Bwu&fpUNChDcYc2080~ghrIfKQ4q>e(W|9XYiSW( z6Hz={NhV#xb)qT-p{3W-HRMM5zn|+4Q>eLglGK^12tqlT)Y_pSmIH0@@^ie)aiSrbA?T z?U*Msua&pM%YG_oChI+!D)X(ey(tGbxX>nj9hGjGKTGBNq~~m%tJ|ti=|10>+HK$L z`1kCTb|$etmyHuNQd~bWPQ+7+>w$54;#TK+O1g;e64!U7>xtW(>yC6iai_$e5A3sz z$TwiIW^{kNSJ6M(uIQ|pbbq)}(T~w9!4iPwMsjzM^VD%%#@bF?p}nIcG^Mq1GQ2 z^!R5(kKHQ$H)%S0%T)~ANwr}92Xpju+g1I%JF;>_&5sVN1p#Rj@(u}!3ln9f+Xwqi@cXIKrYPd((qYCJ^K^ZKayfqhzB#%N zGA`HWhWR369@*x91jBq^d8v69Z_`W7F{jPd>9C$`F5CLcy|zIVEr|NLW4x{V>PW|G zFEwk^sg<8rwiP*8!{xs&uDfK2K3M#DzFM}G>mfg{BOREHHHjZl>xnPETL?4JN-d%H zfBXe}08&;V2KOg4L1ij6VvYoae$2vFaM@#Vfdq_v^i60!|`VPkD zv~oKB(-r<*ligUeg}-wrwYIp>vrfh6n)S5(jzib$>&~X@2fjl(+jdbuaylbaz zU^*J+bH2XFS1#x*w86NOx0?6=cROw4kdpLWEQnHPt!Nn;dZKQEpjE69)|`IZ;C!C{ zfAvL?@3JIuo|;4RR2^73i1KeA@{LF9qFU0y>os@U2JhpMBIr!XtM^$f6rUJh6FHYw zMj0#S{XLtC#l}wC(B3X-?NdDUi!2tZNW;NbIqx1(bVbz$dA~k<%{I91&~lN562Fu7 z?dwFYT7i``_=xj8Z#(?*&waMR^%h|l858-Iiut&Y^$I(+pnHj(SK6s55bD`s8z+}k z3!ZWM&UxKu>*jY`^)>1cd*fyMV^Ri+kvP|?iTi60!&Ry;U1Yp*;f zN=%~`$+=mdvQ*NhQq^6Wm?7_ZmXeNP7180El`p~yG1UIdC zaE$Xr-rwOmqSvVytqV`o&+fA&u36cYxMp#J(D!%PM%A}B1c!wTloKGNXJyTAY-9L( zYE{GY#)ph~cpF`}ZU{boVS@hg7kI7YYYu*c@TVjq=R@tIbgT=A?fwQjM6PAWr!k?D z=zGq+vvS_rB#$OhT$a~PjAx-7&su>wiP-Dnyh7x_>h(ETHnog}d@gxS7z_E`kg`?g zRr-Ce%D6&mv$DcmsW(7{z>R;X2>NMH=azUXwdh6G+n-J?a*@Rb_SnYh0$5`1{xnhV z44`3nFZAln$G6PBWmUPbd&Iw{`)^;hYti%4#z=^eO{}l=$^Jc54Smg0(vjCh+qt|n zR6wmI@Rj;6eDhG4Xu(DW>CLGSd1xEcvAA(6vibkbKuE;$t*X#(d0y}>k&AM;@Jbss zm*cTR$or#QzQVqV`l-w2MPlLXOWG6za3Q-gTp;QfIPacLugGx+lxX9%V39lSt=@zJ zK5x~Gl_;|~-QMHHCZ*t%kgdhpLO`5Nt&^Bh^hMjKRj_DS&5ce2viGUzsdH6jY^v=p`y{6@@Xy{{G!iQHxQ}> zDn5JO7FdBNgw0oto^bGnPO3`al&VIRJT7a=Gl|nG2_#gN(~4}qj@I`|{@=H>pdp_A z&9&}R3(Z!&EIO_Q;J{dSehpz6j)oueJ>>59B95#uP$8~2lLGPIg^KWa=$kU3cRqmQ{TEn>uhHb$*VE&X1*Ei& zak+Wk%!5gNlIxNumq6ItIo)q}q33cR3W+(JB52iZcX6JW%jMVs|5KTI?G2t4xdRkBZ_7|J`t_j+VEIdLG08tX&X=PmFLfI?y!ygTx#Y*3+C^*I%^Fw z%W^ZR*^!E@2hS`Nxq)KqQLycYie3{@j{jDXHu|nqYWWrPcBKoN+53atw!!N#ky*CE zv8U(PO4&MAByy%(!$X_I{p?yHO9Vb~@@`m+dCqLSR_F7@<@-zhw>MM7(-bZ*DL<`FiVEJ>nZ7`vFqa*F9-AA{>d`f($ zH+nWyA~7wI^sB04FSJk!mK?tV_T`JXX~(R)?QHew1|kE&Cm$@dR2 z=HdT4XX7|I$3lH43d_%Lcj+A|C{C!k0eNOz5FJ)02Zq%A!232cM%JzxJ3Vc>zEs7) zQ8hnM{br`X&g@sU!E1XYkI;Y+X`=0wt8o0l2^Ok7v(OxN{F08UlcFQShgm7uqoS?) zks{sy9b|DDA!Uh7-QPr(?0wEQYSkQ(U*=l5S1TG5!HL?`#IhC|J%&CW4ogF&5}HLjk7*+l-$}lc)k9viZ)(vMKcQMe--JPf?v;F zf-FrTzt*y~uky9Rny;-$-0|SpkUAw$4J}w_%esMd6x8_^8t(a zb09B+KM(OanN6*u!gpa(l)op&aeS7(@;RBCIRTXL^~vv#a2-59OXu~ic+NH`(Sob` zZNqmbvb@j+SMzr3VY;05IIXTiUIy~C;L%2y!_6@L%OhL0>glbuDrxPrnUScc=FvuK z4mVSC6Od8O^$dlYP_d{GNXejH9&riOzo@M>CVT1$caQDtT;9W6C1H6F;CGGGhhka+Z$lv zoEA*f!5k`sS?NZ@j|oCUi#CYXMevf@G@7yUFNU-iO?PT zm;FTa&^B>m_~fSADiIta=1} zTJyZ4t5RxFz>EOJEh`=z6Z7iM(a-Ic`rFWqf5iB=pK~z&1@@=Jhz|=oVP2tAJ*Z-U z%Pz6~IRe|8%P*54^U$nI(SmcGSb@v+*wv5HvD<;zznQi%S)~<~JJB#b=gzfUCYxOS zXmC#TqrtIuqW=s%E4Sd8l?5&>DE+>);QBs^D?cnSv?d2$@0YkgaRmXOEIn~A%(&tS zL{yaUwc4>iN8}6grJ#h@G5V}+c!69_C%lEU{3W2I@;Mn(c|^$#{88uvUSaq8@($t4 z6qDGi-T;>8=$l@)4Iu9gZCc#hp&;;g#yn@0+`tc}BL1^1^wlQ?Cki+y!&=bhq>ivs@X@n-Sgn!rDU$jSG;nVxtW&T=-o)UCO ziE_Qh&VaS&dD~d3NNh+ugUfKm>D9;$RA;t$mntxmvMSrC9ISI;w9fGbk$Ap}@b^8V zDk7GBHJ|foif+}ry7T{@qu=4vg6G$zbek&LDjvR0oR24SX`FLMRyHjZ^eHOsp5B18 zvFAoNFC-md1;vR4RQTlo?0I2h7P&PeHtXeU_**^loYrTvUM?%{dciijR)ov9DQN8{ zD50Y@<%OGN3;?euo`T*I6+O56wBSQ324e5e(T^y(`j|Via;=I1ACUXSSf#&QWTDE< zXdvfVC~`v97rDqnhZ*yn7k!%~>{<=a+lFrrz7Nj&Nl8@ z3jOX`(3cfKugiu$EbMKQB_Aly)qmV0;}^mwi13%WcbMq+3=;kBJw#vj0@3TX5q;@n zM8EWoFIR8sk$F^HZY+)~7yzKxspuJ2Cr9gc&D6;smhB2>EBXq?j2>PtQgVK#poW;0_RVbd2n&tkBwW@wt>M3^Qr02Up95` zHJ_YVhI@bh*+!UZ=D$rv{<5hPZlUI9>tN2iu5Rjta%z6o2(u2Wr%sql&Clv#PWTcv zKdXZ|;YMnHb|=gUK5Blp1m=Y4)Ev%$Ijp7xKFWdlaRJOvrosHn^)Nr34fEK|Tt0*K z*&>)EpPEA|%puhkNS#tOQ_6O^`p#e3hP{Yd$+1$7;)W_3o=RzW>H+B!F*t4c(p}9C z4z0SpXjgS6^cpI2*A?Ycv&MO*vyNqiVu{$ z`q$5~5WS986h1>5A{hv6R^&N7G7u_!iU^xwVFwX-2+wdjRxIByT>ieo|NobKpWQ_|67BN+3;f!U?_2zOt9<_qzwRVv*h{UG{CYbv!&9j>%CCPx z%nk*!#CgCkt4tAd{7Yhij?A{Jwja?BA#2yD`g& zF^m>7W~@SfDco8x@d4kP(x2EL-yD3b&o(;XE=vJ&JM6TwUdBrJJAbg5vDCpwNPPT{ z=MaznTFP(#TvqtA;Pqr|K}BVV2s<4vET|}aM!96e6>=``w+o}n{Tl``pIRh*oen6i zm7A3EO5j+(vp3<6-@$)5|5_HFDc0?OxTyKGvqm@hpx4ZoHubvjOnrXS589W$S=1U{ zK7Ch}3nqV;>sDx@?Hhl3Og@Csu_Gf-bk5aQ4FUG}Wsd6rN+@4)mVp{_amXIfk!X3 zqXb%+z-tX?<5ODIUe#1~sU}ji!KX8^Rm2*Gud7J5{lAq-u8X26$i90%wbUls9y#D^ zbxmJb@k11)SHiVo1C&5De&|)Er&sXz>vHA$Vdwo%9KX*RzzjeOrp~9!4;ONvXevAj3}( z`Z^%m+2n%$u@5?L@68J=lpLclsM!b9?*&5l0Vbz;g=?nos$4yN*9pcv=}sR$8!qpg`v2ZHzPEYblKpyx@98h}#k#C7XPmxpTE^D}Z^zA;ad}%V#*9~Fu4iFO z*9byBNMAb;gv9>3uF5L3XQt_?KyDFe1vuS-T2I7T z9`xi~a2m;Jl)AjOT;zv_5~!p&-ojX@=CX4vA&<|e*1eRP%bu7&^JAcRZU06KLz2AGcd!P52M_dId<55w!DYf9~CS}Rf%e>ic7b@yp$f`q1 zKy{;n*VEtRDwyZ)_clBA_(PMH6uGdt%Dvw^&Are2|1tLN@ljRh-uScko+OimVlopl z$xLcy0ty){Qket>(X5#Su|QRZ@ly0HGl{j9c-k|fLLi6iKvXKW&64QG1Z5H~lF`$X zwqUcp)PUE%wQY=+TJ1SZ61;E`k!wc6Ucb+?)*c8}&-?pp_Uyg(+UxSH=d#xGe4jg8 zEH0%4{GRohuDV8faowFxo23B!9+df@c%>rnU&LcT4dHsd%t!P|kJgkw2;fs26&KHC zowwHME)aYc%QHoKXK=73gkzs^577-5q`De&7gt>|x4uh(a1g9?*s6wtqx0X*^b!3| z1&*P<+OqH(x*s6sX)UE5Xlb`>3YHIMLF#}V^p9PjKirt<+Sa(@-A^WhE=>`-qhuke ztVu-Ayn^UlM|iH3PEHt_;UX!fNL+v1nyrRDHtFHS>Q}n=+}aVc*N{~3LoHNyXkJ4T zNcBilcjg6G^#O#d!Z|w1r>3hwPoMubfm|OM%A!M#EzUbX$f9N89KH5~OZfiOQm}Bp z-%g&>8G4|_Lo*YG_8TT*NhC=PMQyh1s5 z&3!QQ+cHJGQ~LgoyA7@BTHyJ$u|7Mfwx44CW7YuDf8=tZ=SRFEP9QpsaJnCqO}e?w zOT*oUhUJi!xX-lJL2tx+-ZA&CchLFW!cW?yxnpqbYC5-@pY``ZkC%EABK9@Co=z-& zxm(cER36`bp8`GiE6`)uAyt|X@nOq37Ar~dJZKh(MKer0;L)kHFk#kxaw@f_udly? z=B2NDub|&bUyu6^%}HOY-=SFvLyLd#9h#B8*Eo&J2}4tlPNRVL?z)m1>9!xclAcXp z-#49(q_01nPEVz;@Axh~p1ywnyR;mjfaBz*+k4Md^icZwKd+*nq_2H5=z;DF?H%mC z(BA*)zR=zeyG48d(S4!4`?^JY-|H6b9T?Nzzm93|+hf}M$1&|4>ksg1x507SkniAk zUNP%_*{qxE5(N-LdhRsKJl}0-eQT!iXS~jBGw5%+FU-lW)7MrXeRfPAcaG`f_A!0z zGW!@e>)mY1VB{TK?%w@v>Ucq51w=s&)xIG3k8#PRBeLPx=9O-hEjDMH#%$=Q9S+uUq*%KR@MoBWQXc6Kzw$nz1N zyUs^HV~k@XL_iJA?iMjEZg#HAMNS2;6JrG(A~5K&im}(x9-EfDUeVr13Zts z3b0$fs%7BOUPDtWC7vs3xtSm7b%SXeD+8%F8Pl3811T9=2JqYSUN*E+EBRvVH-BfA zxi5#%wO0w82oG3kCytdI(T5W2Ls<9T`91emfh^(!9*Xc-fI$hu&4qym)z&gFq)1-4 z$+ICM!-l1E#9n0;fmpXVyKR+aH3aYb=z?d2Y#$qsAGAPzX(N;a0b1HuI_ntU4}Xc{ zL_p338r!G{U1>y-yvv^`pvW5+_8Qtohd77Cwl988;6|hr@OCNC-@LbS10b#D!8@u9 z8$8FB&N`19Fa=_PN6YB)tD4&bsJoI&sq0xDpHQ(}f!2T6VA1lf3VvpN&2xr!vkbni zGAyW7p!E}_$osKkPkf{lBn~LW-a0ER3hu(Pj)at>4n&_hpHCz4RbKnCQsn(eu_q2F z1&Lv$nCog-C-+}DP(ee_2wVoCGr!b5!xuP@&xG@YdSOzA3LN|A73g1~KW%24kF)4+cNki9n)yFIi~bt_UuFJ3Hj5_k|7`RB^?teo|5uv-xA|$; z4nu2xj5P572mJJD{Qrdc-#VMN`#WTg85dpkKrhnF zzD%Gib{N_#a$)^4#=?z4ziNe@Gihvxp>0E5%mUw?khg{BVg89s^z3Z#!90@cd`QZ# z%_RB(CEE)=qW5KhZ~bhdug?G1xF6+!lB0%vHALjn z19bpp!N#ske*SvX)gs1XAwc-U=eeKEB6Y8OgA~8c&v_k>hs^YE6nMja$zt-sM&VO> z5k^WT@bl9&elX89i+T`az6h7Idv{4Q!y2ZE#5(83+U9~9*zlz>gLNTOYLLJVzkP$3`hH_1@{CxeB#F4-b2;=1JI zi*-q~>F<5U&`MP)_LFnM9vA(3{aG4m`)nf_nEA+*urtF2*D*A6`J1@j2*c0oq9Dy%>4yNrnU0{y!n9rBYoK|?hU!upv zen7u0s{>LE;dzl!PpH~yXyhCdds(eAUA$e$_m53KY2*v2Hw#06`w;~Vh(+M$_U-gq8R0lS)xS=oa?GuwqYCZ5LQ%#|)8U zF)h#SKvF9d=s8oFLGfKt-oaz2ux-J6GU)W}2B%@XS2iW0qplvw0^bvrfmBM7OntF9 z@i*DZ{lf~j8yen|%)H&V?KHHnt-CFQ7H>zrHIR~~M0EMlh#mxKfkZqUKTTsyb6dc- zFEpO}{gy)EVIG&Q6eq+tCnQqa_`Xj+%nGEkN0~P6+{L=?PoEdhze$g|``mdwrU!1y zq}#Wd`wK5+(yncWw*49YzQ9lV{Q7_Kk@~?7>>J^EFvWWrv~8Q1>$|!|jPL+o1Ed@0 zeXPyR>aN(3j=QP?s6T;n<94aL%pF{X@&o4{>2gF-ykmXv56pm6c{YUaQ=q5qhgsam zZM6bDt2buR7Zm6xzY=*1S0Vj#-(b5JWzCQ>fv=l;wh6rFg9g*?m`75oLQ=)J)?U4^ z)+TM3zY2M1)$fJBY1MxL&+{t5>jOba4S6R0qg}E>rN}#=4m`7+`}ldA6_T1{0otMn zT=PkNu&AX3Y+EKlEZYKM54f(X>X%|kMdUuH+9kyxL*zcF+APJA76?~8Xa4?P$f~3Q z3jm68y8wKHJSNeVxO$sdSE#?r?ps!UFT><<$FgY2c0=34F*cxeCa9sdFEeSciHq?* zV-6`p4e?x6?mg`-4+qOVjTV>164-!ixe6?YuODUM7VDmN)dGw5Gv;WP#o5yyMGYNi z%n^{pxfu5QCuYCbDFQ2VEWcX+B@5SCgwMn}1yX0e5tH@Jw7%VXV)3)x@ReKyeBD1| z`qK>mmBI%GWpW)fw+FAcQpv3jOvkaV4i1r?U zZx81I>SLZ+5#3{rckHbUq&!fxAURLvKDZA4$icJ#(=yBtHY( zZfNN-e2@E87I;yg+5a!O7yfo$zZep6WZpX!XvOhpfoy*EBkW#C$&6`s3oHuD;5&e_ z(E>ek4M~ydL`R*h$^x;25`^(Pkf9FLTA_oC)}$bh?_E_yIL?p73pLqv#a2T@-D9jQ zEVYPy+;}gT%%XvDu))(8&;thZ5i4wfIYIwX5nJl*Kf^TCH$FDo@u?ztQI>wBSQA+_ zBxMoj6}IdQb>NfaWV!{chq3P8$s;qd9nnn4hks_%o41N}nbt4V#_W#d-H{Qu1iRiG zVOkQP;&(7I6Q2(%8Q!Fl>D`U|QL%ViECO!`>%(ustQ=at&CreroudcagYC%Ra!a*k zW~c+(las01nAs7(J2FBf*!AlXrhx>$rc8mcg5PQ8zTj%8W6XE9$`49`zk>`rK`XEcTnzxyHw0kFGc)a+Gqp7b&NujZnTk z6Jp>7+R1osw$?A}B)ad7Z}B|_#mpg{R3><@J;QTJ`iiq4AOGL{;jG>frPy12hH0fm zWMWYqL(G63-JbAu-HY|5_Y3_a*f9t%f#yJJFGMl$dRcDiCg( zB4SkwB(oi_ji>Q0gXg6mJ#g&E}z@ueo#Ymcx_RH`^pKZ$rh3`G_K|GV_{im6Rw$fe+!tVi(DO@CheSwJU zcP5r~85)**!)z;neZf8%IG*`$Pcv<6rWl_;oHqHmqIj|Fav5^{S&+Zm2DDTut`B_4 z!cDTHzAOX6N!h+&P!{#Pr+{xb6Bgn3cweX6==Zw}ZBTJ=Iq~FaroDBVX}>wmbyCjH z;C&md=`yspPYb`F#A%-AQ#`xdPOs@QG&k3GbLbnRVyz3?rhry<8JY#4AYFg+X~xHd z`z5`%#rZSF9BqvGhB?nuyien}j)Rzbj)hCDa*Uia?YR*aCsPKdBTZOiZd+zyjg@IS{*VD2sNY{rkh9zq9~i0lfZ8 zKnEErP?t~#0=g$WpZlp@ewt~~M{3GFjk2qD8qx6=b=gji3vKeRo(c4?orb376mDo6 zU$~)kj_lvESJKChuQBn0ZO+d@B?#lQq*BPwsT3Z^QO$9+v8=>nlV0EX6l0G4<01B_ z3}Ip?{;}sd67u!=L@$Lx-X0ayP{aoMD{@AvX_<(t{JJ)5JIfqN8}aYAK}?mPf@DJY zy-ZjXu@Sv(4cQ15yav7PhT;xYo}1cqmT8-6r}*DSy0Sp{Z<(+tnMt~LuOS<$q_*dXfNHDVjA9?lDcs37b&LUyhLq8$A0|60%0XX4V7775w=xbGqD5P zTLlI6*k(zcLb2VoHqaqCnMP%a@4W}1U;*|e*toSL*tezqzd8*Ewjby7JLgz9bSn7{}@M&wYKtBF|6d*hnuN`^Xu2W0{#wz}KifOOnoMr_^aJ>kd(c+zK z)}0}#A*F_-?#d(je#kgq_jU{9xS^>cR@8S|u_s2A2?>1Sq(uZs4fuHepF>+DE(M`Zs7}$a`e2cobIHporX5}BGIcX z@ZD(I&boU%{UFY5W1%zu>?_#9*${rL%g~w?qDQfRt5)?sEE9dNOmqdZa+iWqkNRVu z47vxha+?*;mpnqb_aT&Tyi! zS|4;S#kqB>PPA)x#SNaX8ppKugJ>_(rt?5edBGJ#0PH{$zwa{j3!by-j$+y!H?)-; zL$EMWw6vJp(vd6^yHA2}?L4*jOeW+9Pp)})>$2M3=(5`0+7BYVNu?+e1u6H*xS_F2 zAr>`QxbK7C_pV*zbiv6r?*cM0byeifRS=(RTa&M48*PeBWPzV`$^9j2jx6IECA0@fnb+wiA6+ zDe|H&+yqen+&BpDmrLr`T>@d^;Bn2lrBG6Dl^{IG_autEM1f-?N{JWVE~W)>ft6mW zl+?QcLPL%%&a+C1cPYTKILfJ+MDH61zMzBX&AEG>dvo?WQHKk1eNOToP#oNTUUimf zXBF^bc@L-|T=V$-A7{a$Pa46+prrn+d$Y4tan+XrgiucgkiE%FsA#f5>^~(4OBw1w za3ay0mq{HFMPA^x=IGV+9QTyVMDF8if&A5u4ktbf+KFC0aSFx0TQbxETvy|)*nd}j zS2jN{J_ZY&^wqeb;Wxg2jG^4sQ6>^Q=xZ2r6hU?_j_+k-=H+K+nD&qYxj27lhjp%s z^kV-#*1b;D89Ghuk>bqlYd8wC!?K#J#@a(OqQ{gj~&Y@0z+a--a_ z_U_u=rBK5CVX&{86*(961f;F+oAOMNR5_`=-tuYDsa{Roa3|<)?W`0MjFL_eBFJl57#%&9kD{i zDaD1lP&iG8Y5L=P9=n|M?^_HF%Ys$VMV(0(btYXL;PJCE*TGMIDR34!9ho$-dkwgD zXTqXaxi5`>W-;PY)FhhIot1|70>z8=Yh zMUR|eT6~4j6#|2dmtDL7^tNTt5w9XCRnAD=UJp8P5&iaObM$}fF*Io;lakvrQZOrv zlEoR^_cw53Mv4r3{a9B6j)jBhr<6i(G`G*$m(%COdG7o2!aTny^2qSJ4-GK8affpXwxfO^=~P*N}}!H=dj14tXS#x~-zU zWuumq8$_F{tU0@2wz@jG&<_K`V$Y;CH`$aut`bE_N zRaVxn+zQ~ExU#G_XyNft{JiMIt1_*6zpNMag0(hv;NRkgR=QCBV!gRP@ZhylTmEkh zEs&1uf979vY`hdl+g|K5jT^Ui0L!wvEB=J#hpHuhj&M=_o3wp@rIp+FfqxgVnCPeL1a>I$rUy&FhV=W;oa^5Wx?Qy8j+@?L}ZFvd&}T@)vOYzE`#yT10|f0?W2A@nV;G&SS8O zvE_De74gsZG~Pg$p}oVHBcQ-B?z2)-LhtM}Q2*QIaD$2G;z;b@YG|beFbm6hNC~~Y zQ=C2ZonyPUJYe3BlyF>{Fus3|?YhkZJ%#J$&{6>ZKV*`ctq}hUoZmZmjO&h0j<;L! zVJ6{wuY-y!F&E#JVb@XxV$0X8-dMD54$t$`#n0ovMT3u)(P71v2!h&gX z8cXOyPa7KQJj*j7f8Sc5O*aU=?R9n`PaZ!<7`Jv{tX-NuM;I1UTka1yvw(Iz$_luc4LE-WmYkuH#G_TP9%oIHk*>Zhhvwj{GwB1x6Y}+tIK? zDsF*_NbTMJ2!N0KX9d0fi2Rd_|94&d|32AE?*}z>%kD>P+%|y;^;bxyj48U5dbeE2 z7nMF=n|+o!)FAOA-%~S5s&G_kXwF2QM06>|__=*s7tkY&Ie32hYzW_Pf!3zuijH<| zd}uz;&x-T4i!tqi<4jY(lsM))+S|uQn1-|vk+Z4iWC=Z%Ff{cn+XX}&nDJi%_XF#Y zl4|G{1&(nYdg_CrB*gFaT=wj}o;=kFZZ!l2Tbxmu=Q^`RZJZ5o*d4M^Wp zw;CGvV^}3otmm&!8QQ*Iew(kaN$F=nnf~!9p4aRcelsAi4ejgtHs$dX!L=cPW@n^Q z=Jh$!@7!ylFFj>wSUw_wPYn_Mn&W6++7tQ+;}}%yw;I|rd=I1`v0R+xJFwgt;U^N4 zPO@;Mb_$Kweuv6H{Cg$vMTfHJ@((VdLyE-5X(`wbqyFF?RT}Vr*9g-dW6V)KiL8tO z%pXCS9S2$p(&52#EW82vKaZE)CG4x!QunE?CKkog^LA4!_c6be=zS9KbuWEi>~B8% zl)ySqP9-|eHRD7*!5TAt*p5NZrS$oy4DCKA(FaZJjeW?AE*Y7bTwvy_DIzh?cnA+( zNmB07$h+=^))}SaAZ97LWmVs|faj|o%-Z5iI<`1#k!CIjy{QmVftzylDE>Dxy0J~} zg*mz>B76cLd`je&Np2Ekv!P-sWYnurz3L5E@AMF$45Y)&90x7aO8_c< zWXmm&gap1%WC_vvnLsVk2TOULPag9Zxg7M!EoPY?nq}@H`e4?WGG5R*F5)_%lGJlA z_Up!{3@w=f6-hfu4K|VA!sz$jP1+%a^ZCd0n9nJt%bqi|WE1%s{W!PUY z(c9K!FKz;eMSco;5SpE}WuVtyF7}8#jRh{*y2n{N4Yrd!qWxAv{DaFumkNl#z)JkZ7UFjl z5&z)NKo6Z1Iv=jz%_qfvEL@2^GcPtJ2g3W-xLoZIT)KE&A=n025PeBjk!^`0d3WUO zbH4Xpq3hwC51l9bU9PrF$X}{t*6+!HaFvo(-<$#ACMc*6WI*_LvOV|Y1D7sdo(YSR z%Zc8WS!6p?2(~sEyeo6|IqiQfbUl#sq4V9pxLiE9n_N`C2lbYpi9I&dznN^Wk7q!* zIScYRjlAul{hJMK=x3;pI=q8Q0k@T4l864^&4z|DY*?{-(e@oO_xjMDLivW}&>n_H z4?VH?t(||^Y&g!>>vq%Oj`8K6G=bi`+0cep5MAJOInUSs+s%gdap{fa!|87}qRx@! z9aJ*C&u%uf^!R;mgoVG}4i`BIS+)GmnL11Nh}gqzJ+WBsc9?$oyxz7ldg^wi8|6@{ zKBK#38qwGOvZnm(^33jzp~=*^8d5({;MgxW8yYWv(?q)bDMNG5oFsCwa@ptLvhT#= zVE5Nzv{nmTgXIe8E>$4*WhUe=m(})-7TDF0L;R8P#9y)E(#5+oi)`Cv@ZRqv{>Y`o z|Ix2NfBu0>7w^j~vh9-v{k(D_ZI{^-*(aG6wGsa_gt+eUd1sjxpLc#A zg6HV!y7epjQcegTc}id?HG{~LJuAhu<2>&saIB9(#hDm9!L-QmWE!u6RQyIraX)Fo zKYm76?b`iJp|f7g?a{jtq6+76tnEoi3-FKplX4 z932xzYf`Ac-f=>l(c|@w6HIH9A@^nl`r9&L(e4Ml6zd)2ISGsE7v@2DxeXRAmy2?1 z*VU8<8^IO1lIZx`B+K>PHV6+YcCTpbRC>I_&|YH95xUa($HU+OTlx~W8uZxs6&Sf)!O`uR4#b~*hWmbsGX zTa*iRtj#j(SU;IQ+hJ%CbNyQ-2)`mb>iYn~@tGurd}>IU;Kj0?9U@*XE*CAZgFUwd z)PeZJ_+Cl<+gScao?DNiu7h;4hB3#?)s4N?s~dYu6-Rv?K)6&<>bn8Iq11nBeru}) z;rP`gg**>=+ExwphdK;xt44Hu&oNPRV)-+&J$LJ4>zpTKWx?hwpo5G#wpNjp+~nw} zy}NcKm`D6U2`WnM@CEW;9y2a-Q{!qAZ|4Wz12wdSx%t z+cUdSc13ueimdKby|w%7^6YM7vAJ*FB-TII50^rU=Snosq?+>~jC%gkxX`_SUP<)7 zS;2>8TV~H|c<7dS4G#`wQ3%i1AHH^8!@A(ShP5}$Ye3z%#nQLr4NKpWPb_^)>MVUr zf|kA|Epx#3#vHJHG6!sRbHEmy1GXxOJ>ig3voSaT?wZO646zI?EFtn6n_ii2-PoKCn zhn@+Q)1o&;zT+3hi+u&uf&QdGIJuOh3eXO3x;QUIpd4kx-0oAiU)O!6ZeDk){`&5- z%fHucEG8+YSh#G!Hep{LD&%Y77`6`-&_8fqgv_1bec}Yu z4x&AsL;P75H8g*`8v3(L{6CUixp%FR7MB7!zR>=#vlJSSAA(1mO)@zi$xuU|fa**t z-|~L<7}GWs68$p;^kF5(duIkLN@hW7J6LjCz?D0sjPnjE+1z( zooq+?xT9z>(#KK>V&60AqWt@5y7+nf&kKouSOGx~H(f;!+CkUa4GqU*i30uHFJQ$? zy87A4+&`jci^0$H_kbF*$D5te9LQfj9`cJp4P8VtzDoKa)?*|38D)a^6&dQEMO{j^ z(pxNWEKN^sayH#J1oX_>skG=4KmP`Ai***gzunOKWTNA{iO*QLWjxVelfajhiM}p} z+X4Kny7%Y>{Epp6nRbBV*A*lNxsPB`qOM)|z_$g3EsZpVlKOc$D#+3~Gw`l8VFo+)?41=FftBK|6Nupi=D3I>EF<3MBq|lxa+cdR2k& z-lI(Wi2|+ozx+q#R8ruW=ebF=TxxE|y8i1Z(>_tayY+KHHy$qF>Gg(hbtjb_=}YZ8x;-j5!V}uEb$8UUknn2(SAo(NDjsP!(-S zr7(eGE3U?mn^uJ&%?Hf-1pu;tP~~)KO-S2c+OAP z{*>tB+YPPRDdZFs&89i+Tp#R*#@RHh-OwUe1yb210e{vg@n;?*{*05vZ%Gora)9{d zPl;bTLi`7-LC-D<_zzwUdUip;e{crq*?9r~!Kt8Uj|=z@P6R#M8t@-nfV zA>col3p$Jte^LSQ{p4(V=t=QS=_a#HC$FX-rSGi|3i{qOhbEsi+o@hdUvD?Gq)A_0 zAF!}nA$q_9$7Wm+NX5k-bUw!twUJbx!FJUZk`#^|j$<9bpKweg03A!raT2(-6TG$K zgWWhkujBWJfOdb$cr3=BpEa}tj5$_(&NMC)@`P_b$KhAPpgzxV#G~|;=gWtp} zpF7SRNPnk54gK+HLtx5C;KRA{^tmsN4Vwh9>w)Lw%U@aoF?{Fd_~Xu53iSLyfqrdh zGA$a;qGz`%)c>%b=Lzb}ghdyv>-e?wS5Jy{jds!z8N%3?ct6M38-OpEM*5lWn|OaT z#W?TBwTFFzHlSbEuOGG>juSFT{WBBt7iWtYz(Yrwmb5}eolN{950Wd<4C=s(Pn!F* zd2oK8mizk`k>i6VcD`g$LnMRyD>{=~760Hf3Xhlh^D(AB;z zGxY@LQHfe7@ka}VJv01cNL_Y<^Q*)%8}Wa{u`P4Foky8Ac*(-ih~l?`b!9TrAqB5d~V&MunmZda<4Q&z)yB8IEL~Oh<+#I;cQm_+5z( zy()2^1LWuLea5uW`WwoZDkb%I%finGWC*vJ-@S<5Mw!^(IUv!mw~PO|^TSPsVYaShag%KeCu?j*N5@a-oJZN)h79Z+0}vH9-+)X=qP zi&hd{vV!maLZVM-oZ!NCrW{+GugDOa*| zou8dfBl?mia7Dc07t4IPLfEcYc3cjGtI>8{0eYm8=+z3Bt=umeX}M@)DOHqp?c%K1 zmB79P@3GR)HW?bWC0a=Iq+^TIuRzY7!Oz@h_uU*DOF-w#^%IK_FL?6sa0zF^q5 zz<8)gS)pPpsG(bPpdz_~=yiE&s1#)Gzwmv4g0w$Xg#{MvmLYd{&K~FPHInOP#vFq) zNy@V_(mM#?lUGN2m%;>&i|he8w+bfI-)&+?quuxWGpqvJYPNHkB&Y4T3H+RT*(O8# zQ6bTTS+GdWO1D2F7a+sz!|P74zU~ZIARpHUk3R%8^bBK;^tVOc3YqWUVSgur$d~sF z&lwGi{2Aa=tb3e9fn2O#w(fDF{()upo)Gixk-%45NOZYTcHwv}Rpk1+Gk9)8FOHKH zpkS#2^*?7UoLYfAw77m}7Cr|rj-8P0h2Bq&FzxH;dGMoe+TZynw^fE#5PhpG+84CI zqB`pyXAq>^;Fz{*W?T6@9%sHtp|HDu!I%Tvv=oZ#euuF#zXo_l5l!TCivF0Clz z7j60<#vK1R$9zkH>*ahr(qn=B=3}8iKaNGvJ&yiCGc^20y06tRAvXxcxmb4{e!~Kb z(mn9llRtmkcGGT#O zmkzJ*6w{nYx8op&Jm~9W-JZA1d9E4vjWXx*O@<>fG?_+gy;N=q^1To2`hUN^r*E}?J}aDzCf@2oL+B|XkCwVUOwK8vZWxO?mm>y&;O(xbzre(Xn0-r1=FMwu<un=dp|@m_`O!1SX=C-GvGD_h z=Sn9j71Yp*p~D6eizBgeD2t{PNW78*F?S<$4?DIvJ#nB_>ZQH2 zpmYQX(1~j4tfe3w#`O}^THktnFlO|ELV_q3y+N>i?TXuwLY6et9 zz6|JPQyvdRJ2!{A8awYrJ-}13^Il6{U==~Wv8kP7$^~ZWJRh>>2b)68vwQjTJqm;` zJHj+gvS6n_e!|dfN0>&^ zb;)L3_@1POq*=gmzFs%;13qzxX{fil?ZjW&t8lrHd{yA9pxyri3-l-Fk(7Ie#C7KQ zTk8kh+1rkT_pRgPkweFEy{Zy~v2RE-e>}=G$T58bW&>~Ie;i^OWJ3kgQ4K%=^7Gk2 zsg2xTogx6c3v;D5&x`=loUQuy>Qq^Opu8#%ba$@QmQ>u{Eizo-O|Lm=p=M}hGXklA z1^TNk&`)k6y8F`{JrE{(^gxbY3KothTxB7#odDtLaYV0m61@pzuIKQ2ZgWwKCicw= z8ztAxJa)M-;e5u>;?ty*8{2a|(U%=%TIaMtYDg(e;QSnV7U`$(aOdYNY~J@`o3ZUD zb3}WwFP_`PUf}t5kGd$XPk#Mq3H|5^LyMbpw3(SQb>X+^{wG9y@AN}FCIanB+s%hr z1%KXhDgFBshPDf!?N^LB*kPtEQK0{kBTOp>HAFU)(V`4>0A=FeWR839t+f%|p9T4G z8}TbeU~3wKk+d{V;4lbXve*j;O6lJpH?)0SK&$K!8$8Ftwu=+c%NkXX=f@ z$D^SB&!4gIHkt36=O-0QLOCSj!q$$?^A9Tp-sX{cejL-ij~m+W%fP?83wR#j=zOG$ z35maDLTdbHOjC0~^smuPw_yJnb8I;({2m|AL|IlK&KBGr`d^P5T6_)J$j^=!7IjEG zzG7~w`*X(UlE)GsVVazwhE^{l`q~@HI-&~XlH_EXbyWDmt32QRgv95#=9U4E1=xH; zQOD!Cb5k#TnMvbcX3?{XGm)HuHkT`L)n|;KJ4e0}mw@Y5RpzFW0J~6!6FQ)WqK@$3 z!6m%#VspJfjT3rpa6kLa!&#|z2Ls5q`T9fJo*e$`_)KWz{jQq?wYDw{DFgF#D zVKbTA9g(T(p-7`3F@ZYb)A zm_Bfi%X3r63y>D>vk`r4U(}NE^(;A_qlXAbio7rb}j3C4Z5+cJS3{YL+25r<=3QaTb4`z*&izRM_# ztE3f=i@Y$%w-i$bMe;z8yg!~cO$WV+^D&VZhU|XC)^s=Mkt10R^#=tnk3^>Ui5ZU& zG??SW;$L?s?fgu#$H;{g{QJDr;FZGHdhl20&n@}~?IgujD<8d#o_tlNN&(R3aRL`(u^5lUb2U6acS6m8T|){a zn#ZAzUXVEPq@h73?2;5{<$iB(Rnpfxg%4d)u_rn<85&8)t^evPzSubse)b7N3n&72 z!SnuQ^!ZLhBL>@z?>;Kt?Y9$w;o2mF&d!N^c}FY|hAi-HJjCOO`p;u6j)PdU1;Xwl zOdG=WWGAV?SAqWINrUV5C##80Y-(tW49mz_GiSS5Ci0}Akx@|wzkkmrfji0TC;U8@ z$DsU=*@kb8vM`Q!T8_`|GPKtPUWH!jgP5DK@E+4=c*bW;<7Lyb?#N~Ixi*2@kob&g z@1=R@ZI{y>ZHCrw>OnW9F7!{DF7|ZXDHfLUh+dTku|JQnF!K5Mai+a`9$REU;I(jl zY5Vy&lAFzZG^Zyjba(A!dOoK6?Ll zo;1*o+kJjs|Na&Km`n&)pf0BrCJxMy=w8IZz<<;kx2 z1-1@=>#EWNQY@Ma;ae=wGY8aAYIY#?Ze<`n zu7Y|zvei10REiT#lck27!%U03;MSw>%EE_ZCil7N@i$GSH{rAA-TL56l1eHi-j_ff zxC7$HtEPj0{Tu!KfA>K`y{h@p z*T38R8RO@je6CBpw4O0XpNS6x1%ZampD}H3Wgr#kcW=P8?XePCMY2b#RM{V}5<0OU z(9i@>-#o&??t(xASYT0gzk5SnTSOl|!z$bbQp1;wIo_`fq;6NBXZ6)nsd8mR=lMZq zM09&Dp^-*#Wg=}|?bf9$Bf2sp!si-okDqhj_Tt118--6n1%Cv{XUga@x=g`{@GHos1|D0*6DGN}h z{Rd+XtBLC}`jzpm`AnRLr|TH`oN0S11F0GPGd4&zf$0_rg8v@I9N#&}v}H`3Kc&|# zuGcpXk6EvGe}^g?4GqT|*E)`G=#Yp7ik`<=v?rQuQiEidHh2I`>=OC#r!w~eN5ybjH1!*73w{wjSveHwi|NC^hB7Ob-bb4R<`kwF7So(V8yY#2&>&R8Kek0F2=3uWX@0_|_?!MUqt)~?! zA@cJ|-C+y#jP;{4W|%T=g^+Pjzjol^t-@zUy$({%pbofstWV$ZXbz+#qK2YQ;CZYf zLC}ADkZHBGKz|gH=$%1{)?FoHJ@^{BX9iuCFLL{K$wZG!P#JX+UFq8rngrHGTR^Et zUE!&x3~izX7Bzvitdp^@2h@Q8es8Zd5)E8Syy|YY-ueTCRT+*!KTx=>b|ueEv{U3J zdf+Oe?^B>6YObFLjxw#Vk!;*_9Z5+U>cE~_sbl77O={3a{AER8TUr3INv7RBC=-7t zK!s#6^?{QH_|eAQpK10HZ9k>Zd+Slg&q81R zm}&nPpXWfVQxebdy&I1*O|tYY=^C1^r*jGLTr$w?Y`%`9+#^cEON==@d*tyrrdEgrG9Vn4t&~5vR?GzHZnOZtUR|3y(03oMb*6qe4&ziifjka@hksS1HISTO5hMKOy#4el9^6pLt%b+^{bbsM`(x z{XzJm+2H%KJ(6Ojuzn_emKxeG(tDnaIev1EX+JmHO=PIR{!J8qH9cj7=(Qj(C?lW` z0r<+M5WUO|I_m76N6RQ!W^o^xiEa=wXZ>c^*WN0ua|WhvZ=IC#(uO;JXvx9JKCL1w}5ikDnZ!8?~6D9 zEaxfsHvfMf}=W)-%w~u!|`q^>GEu|74Gp+d(rcFnB`PKz``5ra26y6(Q zS~+8m+)>8;3vpgPKgG03XrD=HXu(!P%Mx*3J!mg^HqYYrzMmS}Z5HU!t`oMZ49x>@ zYmR<;D2qyFt}?U-e&1$jr>h|qpS0fA_odQ6Zk(^Hx!@}Sbzo?#Ow;ik`P9&$7%Gxm zgZ|{@peLUR`jcMJleY#M0yoarlhZ&SECQc&>wJCxT}p#g1is`F(om*87?Rv-2+W*I zd*>?+eK#l#`$I~@o*ya=C3e`|qCii}qh)li0zJcuC9&N)gJL~F1$y4RtGXdL=UR$$ zGw3DyU@quMv#!C*iJq1BuyYXY4y7<5<*5T7Pb2z#Z0oJ_b+`z^tO*tT?=s&AaH_th#5gOAjdC#MlznFK!6h3fLed6(QMyKvke|A=W=W-E^0G@k3z zm3~e@4gCV2e{c!KvioJ}@Se*cJXkI0wD=>jkCLpN;{VOZVsH9bifO+U=YKu$-YmL{ z8k*k%{dXzQ|F8l*cPP+v*}6IOjh)}3pFCPdH@jw2E>mhb`CWJFeR=>Mlo&Ju0-5mN76mLMUQs@@f&-UQJ}wt%dT%xq_ZdxKhjeRsO@+0{3I9pwI0&_ za=(MTzjPF0oo7V8QUIcpGtBpsFL<0lLLFhdlM6`dhpmRT%Uqi*D38p+>p5UsdzpwK zu15K4`d`SZ8mdvC6=|U*d^LUZFw?N@NZbGN{GO}nEBM?C`rtI8*QD{%wp~q!*p^Ud zHuyYNScGMFW4UR-%OLHyynQvrvREzvYDl$$58L*o{DL|jyQuI@g}v_J4zDJgespYd7rFynh?*pD9`X4+px{&nx|hne=i`TlKa zo1o1TQW|)y_+-+MrtLIcr)fG(&uLn|5$n60=$tQkiJs<3|7|db(kQtOu*X9!5Wlys zQFfIz%C07`)c;Y2umq2VJP^OvW8Le_1ZhFAG4nj1!ZzJ=fN6tkYs#zh)X)&e9Re5j z0qfY)D7o%Dz_h+wf_?zFs_z!r|F*##u(EV<6x2|rb&nI}_1??LN&+zduLg6V{77C! z^g&au0>=S?@SG#UXSLJ<-*xw}aIu;1z`YbYN=9q=I~+SH6T-=y;tkG{`F?IgEv%x* zbB-Kf+I>fa4;Yp`oe33Ke!08~2ybh4B6yIW{_!MWZ?K$KxqV44}g!dQn+)ts`oHwqD0RER_gN`lEwRYmKHqVo4if&vr ze0srwlQ0UB7D28I#wy zDf9(q%9)xB`kR9cb>kG*$!^M~m!nN}hWV0;)BE@VrVS~D-eCn2QhI;QatXccR|d~B z;a@6rXLsEczjBT_)ZF3?P!sg;9}lsBFhV3=O_y6-OC! z%o}Ff=X`F!|0l*Ah5sLC{~jMzbuNtK&)$172}yvEOftFQ%mh>ztYF9$uvtm8v0`hP z>{DCxS0=>w=mC3b0ELi9b}n4QB@4!G1x}MxZOMLZO>0Kk)*c46YKy0aP^ncNY9Q_25vpa@2DYVYVdIOfp8_yYvVh`;gre;51zJS-cot& z_?rL)q9tE3n;d}biNV348Tf_Wrh1s-zp~~5klr{D5}|$iX`;5o!?K736mGl~07-0p z6wl92#gTT@qU%!U( z>;E8yKO83NkF5T=emV^wwIf5`ZL0K)SdCta%LI@^gYo#SVWQSjINy|YV9X8}R{NvB zrFhzke|&%t`C&qwA6Lx5>#3X<$8)|+z!!z#FNw_jYblLD9L~f!NVj0EgTk6W25Yvv zCt!`9(a*lPk&Yq?XBNGs?|l zY)Hi67et&9rwo)(p0^SVde%En(er`=S2EQ7Py$(uQwEeYq&HX2!>@7w$Yr04usX>O za!VT0e_ZRu`zilqgJmluY4x#0kPp_*!3rn?LYy)%i^bc+>f~w6ccmX@Psb8~gUiur zIK10brxM~E{=bS2jcA`JDg)V1W*lgHGUEV}?lqd>UZY%!GZctp^7QlL_Zat*dyG^2 z5_%$1oHl2-sh+ax-P3QwQk*txH_Ow=@?6kouHB|Oyc8MF`R9~=uXau;r4^-s^gr8S z#-g1Shs&hw)&FG!`QuG!-`FO!@1z};Wv&$uoTUG+5f4b@9wR#`Q8yA3^{^yqLrDoe zGfxq9s1g|-DSN30Ac;PI3yPWU5#{)BrN?8+O`rIKPAL@S#o+`B*gg_5gCK+p#M1o8FXDk`#>Kb zj^#^sYQ`{8m&e15cNQW206*@(4JPWbIQCV$OqI&2biOfp_5bWLnQcAtLPhCOOI{6mLC>5D zg_I{6+cc#*T#XD!KDr+g{+vzkI)&TN;O#gnIknFQ<8c-!0~C)^_~mpbgULxQDuYV7 z+JOl7^Zyzmk7QOWl~7N4g2>M+NOapBmGV$SiAZk+D2ODYxh!|(mqa~jhZ$q}fIm-#I)M;5&m_*HmY#9& zq4IiI;J|O)3A%lksXkBf<3r{3gHooK&M^)tzBaq!qjTl+%w+TY^UZjDI0K7ro?H6p zZAf2DX~u1!hkT$P93*O-Nt{fVWYtCVgos>WgN~wbJf?Wl^FUR7g?zuhGKM?fTrz<> zsr>TL*&Ah+^Vf)zwu!xe@GQrjlgAK#d(#*te2f-r3@TSqc`7yzm8JYlk1Is`x8^${~xA$!(PpH;=y=pue?Zi)4lS7 zezXGVq3?p;e3=x4@+|rK2`ApR%Ty_^_rM5IU%f`0W&a@RuWsUdx`RX(mi#~X9+de{ ze2;kcMp^S9-BXl#1K(qu;cI0+gx{Hm>3v@=K`$NKBSC+plG{1ICqZv9ZLet9no`*vBn*mc?X!Cj^b^Kj!X>fy(Omp5Cez_{ z(0M}w=MUJsj+yw71oGFcInJ}@I5+m~f?M!yvEK)8!LzLSdaQZ5ta;7cW!Yjf7vStk z^Kwp_m&2M@zDb-jtnsE><4v73USjNbiHpTuvwr&uaqdo2{qI4dUNeYuw3^qmzc~)t zT!;+vwuEE3;0tVs)xnVgg4L?2j!FW{X~p!XDW&-2bEX;+An4Bne98lXut^GP>|Cc= z1`bvqj^fl)JO8=Pj02Q`OB1!yc)t}AbkM#l4wqt&e-WNsPr#ML>ZExubDL#9yj*3Z zgQ6e4@XU#4r=_=dQQQ;_l`ypCHzgzcwtcFvX_vU(P3+a8HsHH^DNzndUAOy-m z@%{avsXoeW!UHwmRD44s^w&P&#&7@R#(F)Y)p`#-+lsUNObcz$AF~UNHHbZ@W(ho} zQZcs!4odP$hdy5jhVsiQ13=L~+USplrF8ARgQn`4 z-tHS@JkjAbLZ_*ofXt%7`HT*BM5J^Lwk^Wl+e3)!d_XU7l zIotX_1z0Wh6$iQP?N)$#PYPfWN93 z@Fb5%EV04J)wQ;sF-g=eN}!qZfaf19=J^MOF)FjA6hT`R^PQt-u~>o*$}eS}n1>tI zPsgRL`8b#R>*ydMeR!XMhop3Ekoo6lXd$Vji1I|ot@}dTG}+-Uw;kjr6Y9$272l(& zZs^K5DNtIfSd9cf z#d#F3?##mpEO&mkH>KTFhX`>t*?Fuw$_TdP<1|2eX!+VG5+KO@ ze-3^%Jc0o7@|~tyLkPn3=2TJ&x965RN_se*(`U46Xf&N>nLD4us;yk7^%&Uar-WHv!h#}XD>^`kwsJ+yB; zz~ZO18W9;ayCE8}!!n8G@=4RaMY!JBs1@<4N)exyvb5n@A|8@NR!eh&MxDJIdk!wa zS6W59VTurVSb`3gYw7bPJbv{-hL3}X6Wv9ZmU4UnkCrjN#(65M$y)cf1dzL?M2qM% z_TGOt4nJqA_c55t(&o<+0^w>fSUqI{`dVAyINi@nlAw8Pfb-5aoLKqz%4iEA!9gio ztNDBhPTgTL`v;7ZJ}RGleGl`CEf8$5tmSP_d)u*^lFqYGchm-QH$Y*h1YGw!vIM_O zh_ifTMM>FNsB=po&*n0GX{-iQGqm}Jn?V2QZtm;Zy{Tc}a1+u2g!af{Fept3+F^z* z0dygg%VDkqrW#p{3}uxk8YxBwohN`YaFP%w<)u20xl3T26x?IgU9*AW8@ArjJ(@E{ zp~1)BfVRIV9h7~DCN&Q|3msBRmdm@2-5Q%k{lY9scSxQMDIxh)&Sq;7S0Ur{D zK&)T7e=ogE@jzuyHz@kmhI@LtrwQ$JZ%3`Diw@Y0_z1bFR8RO;FZb+$~z^z?M>Eo|-Cnz@_jQ7`)q zk0F~pPU9jW;7f(}3x|V>JsaCFrevU&53(qBOEbf)UToJX{fiWfi%Qx?(oed6d@ui?^F9eZLZ* zFvc695G-SM+}WH4mqSi|I7#t&+OGR--pAG`dMVv5I$$#W`Dpd87z{45K|fl{{faM3 z*;=f|_zig2@~=Xm_`*%o=8`HfW>|20S`zW869OK7TfjrJL_9bousqLPcW=j83GA+W z(JNI3U3WSl{UYVJ%8(&JZ)z+SK2pl}_9ErEs_46sy|I0~+uFnM9}C+lpQUelX5Vw- z%+!L6IYpyY$Pg7}AhfB9#lBr!RUfV2X{w`EOh7EJ;m^C7AGbD{|3v_We}?F55h+ar zN{{dH;(u37)d|Xg%)WPMJ4-lhIe^#u`z(&Ho5EMKBm_dgt}?O!8B|`4CP5(`vxvf3 zrHC&{poya5+tzKW6bCIv$f%K+j=XMm=65%C$APTGMPE+`XZsP+ajqr~w!xz#H(P|0L?+GYpY4d4yf0Y`W8SR;DZgM>IktEvq8o9=He zFdt)$>@ZbDf&#jh9WmS1pCtU`k4=@HPoL;G7N;l!O%muVUT7gQI>nUp2L?9pAChvl zh9pl6t^jZ+z0%F_JSc`G9H zm7FI96u11E=PSlFA}V!H+OOY_6WMLqlGrl`)Xg0ya<@rXpJ#TN%yuv;WwWy!r?MNM zqHraT+kC4;2>3I=h^$BYa{$XgG`}Jg)BqHQB*hnA4|;e#(!*;(4^RL0TtBOMC9Qs2 z0-5p?muf{^ai5LVxf2qVf#z*iJOdKyzL2_sQ_S&4!up3hi4; z)9w+3z!^&4#7S)&HcVx>ElTE-MZ3E=vXILq*FXp`-fsPkyj>^( z)@dPIVbhO0L0Z|pj7@IkFpW$;OHkC=JNe zp4nxx7#S+xN7f=8B^}L%vqFxW)jZ14jGdJ4&SAXo@_3kmx0)*L^BjZ2T;xnH z0^sSCH+LYTCSKVK$w&8x7gCsWXn&>hgjK))R|ia$jz!0yGI=@NC=V~%&TIa~^b29m z%l3{|zj{4ZdkC@wj5#j)@D5=k1(6b=uJdB!ZjI887^-iuIp?pN27R|vHb68A{5xSn`*hR+h^r}_cq%Ots!eczp$Ut5EgSC ze(c8l_+SJ1;x3=5u`qi?N#};+J-q zJO_~ky%mS%Fu6rYPzGLU=f3j{#$L2z=T=kw)PgaX$XEVf6Fl!i8}we31kJyOpUZHX zz|UnA@StSrY;KR`LACUP!wHy>c*UME|-VV5L3jT4xRE3hM)f9)*u|`E0S^M1?IMNzFm*33vW7ByUJk28Jp@&)CXjySthJ z9NUksn#xaYC@-f!Gk1Ht0qD83F)1)1(6JrB3d;xYP!x^l_V zMSj5RH3|u+wCtcz=eMz%9=+d_pu;Iaf9B$3{7FldF=j8rX>{IFrpDnu-J8y3M&>Vc zGzsLBzpOGsBF}9vh#)TmaIpTb5k6Lz!0YP(6w@)* z772kcKw-Ir3_4%d_xnlsqkyUICd7GA%E|A1&w>R|eE-pIs$KSIk=u$z6#?lhUWPiw z2J#0skXIz|I*ls|xE-V1suk+FI0bt^*&k}DV&e?5nm!gyN>0Xlz*N^*HHkZ47nq)l z?)m0zrrI@5ieq~+cZ;cJ0yyaJpKdYL&{a}ABxOzPY1~#*O#yH)eDOdc%Q3-a+C*lv zV83@JVk)~<6$t^lwxbfrvHpYGO%=W*1$2E)64d2Uy72e{OxIeGqV8w9@t1ktj5{Qd zUEkxsKM=WpTA2PVfVxU+?f$P=J6-o%ggEIsJy(eQ``El5NW^24=6G?^+?h^Qf{vPt zQ&=2$OlO|w;5B~PK0c9*E8LKJc(bYcry>2d?W}fppAg&UgUR?;n^~S}-MNL?e{OiE z(RX&FAKGrJVe!UyFVJ_1NT0HW)%fV6GUmklVJ|+g*>u)SW3l@k@Nqg;H=F8dLY!7S zKYO-!v#Fk?&+ONq?b>XrU(#oZ{28lF@1KXaZZ?@5YQ>TDQrt!9)!;;}FOJ8|SvSS` zfZ}Tw6kp|bQw<5xBD#OHU(d(M7#ve^-DXpD$Kr+8-&EH)7v#BHc}#Cp2GqHyf!ve| zb?zx3v$|Y%kelrMjGGcUd{elGzNwgk0f3vCHCPBx&68FEUm7t&TvOF%oUZhLeFu05NHD;j5DkF5+tI1PUdz(LnnWBK2tZa3AgE2Ma04Lhe|Iu_b&s)N&) zGI|rKMLM{r;l-Ox7PB%jm%iz^XfxMm4y{IdBDIJ2so@yW;gZ zS6aMKtlhig^YKga4BWP42Cn_i3|#T(4D4x~fgvyh&)m#&s!a4bCzbW-+-$1$bbSSdk&tj$X!U&Czy7p{FV6<3_i6~p!h!6#&g(oLA02jiy#4$2^JIXTR_B&)vHV*Z<)N-1!-(v=i5v*w#K$c({OEL z8jj5^HWvn)U0!^;%~U_5eE52#4{hUoJcS2(-zj`_#al7}tN)jdKWQ`7!YR=AQ!!@4 zad=@{I{s6esSfU0+QXi0MLJwe#~wGN{;`eA5{h)wH|reuy*5(~S0jVo-*BsluWm6_ zAqBAeQwI*wcMq|6|Gw}GBED$7qjIF)#%l8#e){fh5&wPSU8eTyHtxeWxSrw+2geyN zJMhbG+%J>C&EaHxX43C-lYajXAx^*W&vQN4W~z~-<(&VyBOO22W~x8=igEU~aXNOx z^LNtmPHSHOTzm9Gi+6eX20SoWDd4Zf0iD-zz)?Z*{iN+C9N^DjIN-^)NjRYMMjQ~H z3G$pR*Kq*-t}BKIk~toLc#a3$62}7&2QoaD!S7w}O#HnzQ@ve+k=rB~IfG{6cORLF zPl+%xTY{07p8Pt$`x5l#Nif22z!N!Gkf7Hs!3e_z8)o9FHdDO|z(M=<(C5!h#T68e z-j;9-Km03QpFxTT(;n=h-$q)I0d6NAYDY%J`28n}+DzudJkdvJI=+j+;=Qc>u=9+GeUh6Jg|5iO+wQ1S53b^gZq4D{;dUISe;sw3%wD z1S2I9jNEXanZ1MG=Wapq6|~)WpDB+{?{k%T<9*&Yd2Vev*lab`mty<6t_Zh{$%l8eu`a=B!ppT1oDw^mb)t*z~1F0M_ONpV6ieb4%MA_p^Hhb}LU zwDOu%;jKvj>(=WyAuMs608>DYv?86ge>@$3)M~2FCh|MO&d9_%Jfy z&{RD1BV?4p`U`X}Z4YGNwiIQ589aUAlnDJVy;FqaVDo;8H(1}ZZ^8fB%I{4Ke@yQG z^;T02udwjPkciK1zK%b7>APABe@GG@-h3T@^w4*YS@>g?g#UZ|PR+Gh?-#kuBtA#&qdfwP- zs=xS3{P8CXfBZUzKROs6Q7hn~NqodgQSse?M}Bl2kJMQ>WCD&}yoKSA6|D@1d}Xay ze+I~u{!QSJDI9-vC2{;g`-$-qT^29F_=x^nI81&p3s<$8YV6LvbavK1rODO)kLW(1Mma;t`O#9YcxX*=8H6VR%tHnpe z`Up+Ov+4P)=P*6kgmh3m*wt#XI$0C#7UbdV*8dN3ee-z8GRU(F|{e$k&kE_Eq#hTU&hXMtt#{1$+G5@-V&g=UXP-b(n=~3ub-wU6*I! z(=8lV(7Qgg3<8S0zm7tk%}^5UWid*K>8Py~kW^`C=U5 zdNw-d;4Be)KA4T47h=9bif>)Uy(gN)jTZt>-%=eAmFy<5{z4ZhKK^^dg@C;?yGdMs zAt0*RY1zQ+Ku?Lesn0LuI=WZw?xMj;5l1Aax2uKgNmxBLx}Ndb*w8HoAU&J}I>VC^7~F^MR$SA<@nhJ+kI!0r z&)%opj=xXeuSQ1A8_8G!=nGd$jK7&^^T_S^JG4!$gttt7e&}|5e~YP(jzfTc`!`nG z)rKz**>GBNX3>z8sSQd_R=4zlR<4U>-`VD1DnEt~AS1HShOf3()Q>yM^@Wc#%`JT# z%?;Zq{Mhj7Hd7szvb=**n)kGn>pdl9dt>#dw$6gos}eAt0Niu%oEDyI^9L6FrgOAQ z*YC9?K}Vi-uhN?QdrRZz;dlEJ@k=9faa*z%*Ul-%6?428?(yPu+E;5u{SgsX4*|$X zP<*)o&X=(94kzPJSe?@}miN9zVEMefX%yG9xDx*SE$jKzR#W{%y#9PpP<&%tZ|SwS z^1Ms2cl6mxLGb~lPt0crya3r=1)@c1JL_bFDq4 zi0ibR-d}9Ku7hKJDD&{Y(fwa&!>66)`k9|2gYK!A+%%WMmCb?Xh94`}!#Na|%6a{$ z|BH-pJQ(3uCc)OhdH4^_rb^GTOXO!p`I`y&@P7@zMc;Q$f-NaSyEM5?@7J(S+q}Tr zpudy8uoQ>?mCDy|@H-#fX{u`>p|~mWmNn%7^4i2(^68npzRy%&g_I(?XL;ki*1)gX zGdFwYy2hXVVxOswe(7S*ye3h1@?0?;qt)FL`MoClFo^W-kMXF z!U)Wni7)Im)sIE!h?Ah-w%UPTx_Bq9q;&3y`IzE|pNcR-X+Y#|v5g(=>091S2V}rfSqOy}A}`nU7CucjAbY#q{!GzA{jy znmmtM638xOXE{{Z+;YA6zCETo*2?wd5y`1l?>1RHliLP`ku;IdC38Oh)^1Z}H4y;n zegPn_NQSzQOJO+$2498x$g83HvRtl1D2qyUC?4dp6sY?k4&<@~sQZ9Ew?Um^=l=_F zATN?&WO>7#j4!L*!fasJ<+h*yy=Auxr&W|f928tl6S1(`!SYhwwVBnRF9^RHs&~1$ zA8NR@oYff(gW?On3iUkCU5@5?QNXuuHdXgkQn(_C`|v4N8%mc}#6w;A6(Upoe3jYk zC>?fcXBAToe~Jud7pN4lOnHobBDSRfX8v+%jK9}1noTuOVL#p}!ubaPXtyJaC%aNk>F3};o?4OUoq#SfkttXq?pTod&A#(qo z4DGPObDR0Lm}ljFLiZhmv+v_P23@yQJ08}0LxANbkr?C z@ZEOibI?coxOmM~6rP8S6ASqHQrg*NM@HD>?;S!WdwuTHX6 z-N^5}KiQVpFMaM#F&x*a?bn zJfUk1U@_H|^rNiE2dX@GJm4b*2!wY}t&`KpFUaGv(v6wLvM@8>Fo&39x7vQ)yUN4q@H;?<&Ywu2Ob8!J4r?OU*ur_&^^Wnd>&dWXNysq0lem`Nu zwt+H0;fUGO2%$Vnf5msoFm&C8*WV@t%=q#sJ#*R~Y&TFdrrBVG(hmO` zZri@u|1|OfU_i5R;yzQ2IFYe(Q`JO0T?C-J#~(Q1&V_}@20A;Bi+AD2noYF^6yLDq z&?JBk5ump=Y{wO02j*v%j~~2E2rxV0L;qaYr>Qw+>$dy|8;-DfiYdy#TFc+bFADf> zD$oDEb1y*G1%HJtI^j2OwWn?U`N*iEbfX9v_c9v*rx*S~0UvKO)roeCka72BQ(gN5 zWUK`U(!MA@^V^Y8OuwrD{JS<&T`O{*rt4M6pL~sxrzmkx@Pk`cMhdrN(DY%znH!YKw+EpuJ(ZTI-ds3p^b zhZll@oXBYLD?SQu6yFX)*P7qt2!W6T3jU8s_mcaNhn=0-ND@k418Bcg%x%Qo@rv(S zE3donwsC&`cTos*ig1qd1~u`DkMj57#Y{%%gG6QEAGg983xz7U{vM6nB{ zR2KCoBBS{mNKeWY0?Ic)e`*>s3T@EWEuvE1e*xap%3`qkC@uZN?Lt6+^kbK;n1|*) zrm7SHJL5NQ7XtL0+#>%zA~3nVA08;co9Nko)%+hRz`wF`u>Wgp-X+#O%|?d*0_hV{ zlmUw0pV-6XWQ{&=hGyT&MM$^N{mcfVW)af!Y%pWxBG5Cw=ZR(!;-v6u%Mk)AoM6QG zq=TEd3>o^I^ikNcvAQkF0OM&XuKAo421R5f(mhS(^68#U7To@o^o8uGv}=$Q4AqL5 z@+P4{-baO?3>>H5|2HWNKZuObXCydUjhHXd{8m$K5@EIHGa}mwank!w<OyFp0}?*m;b@Dr+pY_fK85A}6Y82BAeT;og0gt1 zi===|aRKFd+fzWM_~1zZ$BF>dv6wnXbG8Vmw1p7nqZ_FOJ-(ImB6O}cDr46oJt7HS z_XBX?5|07W-p)YAumsxaS`nXV6>+T%updyVTYy43pTIN-p7@mX(K$cM;x2gZ=Tj^; z07_i}VE*cU8!CkmEOX65zu_MM#1Sg)As6aYtTydHSLGJU?5kl^<(kpg=5 z@$_8>k9T8hALnhJng&6-?=MjNcnIoh{y=2P>yOa?JD{#RnYWK5gM3L!(?)sCv4Qi1 zIIF+l{$7zd#kZu1-^H*1eUt~F&%3V?H5{k-6cI`lJ1PYM3S;pfwL7f#%y-Jet=2+M;3yy?Hb`esH`R;l*Z1)EkMEV_E#_-XmGl3 zE_~^<0^BCqy#GmIA>KE4R^z&TVx#|rCl~FledLL~aL0xd6%WXJ0R-)+9qAPy zX%zrkvm~(kge#w6GDZQjyTsyD@8LQQ4vT3TIMVRO9i~dZr{DZ`lc^rvQ8AbP-oJ^% z4dqFg-x3I`sVpzpuJa`nZauLWl;m0X`--VPB|uOqm9jlcX-|k*}y|(=gxp-gU z^I#^NaGuJp zwoG)T96&z0)v7JjQH0MlaygOx-&cf(8Y#?YX%Sw#pFi(igja0mI^+Fzeoh`m@j-tP zZf`c#uH1#eX*VUlQX@>SP{P8nnM~Wsmdk}gCIh|dMj4+sT2rSNicF|XC5As z;x*c4NCM+jdsWYnl%d%Ym>sH@(hpcrf=}!))uAe64g&X27gkDsf!y8CUL{Xb2G%I1>K3C#R{yCR zn@#oCgg6V@O?7<8hC}g+FWkvw@Lp&v#-(&GtHJP#&;g+g9DWFlbA&iMkGV_2L-(-U znzqdQHR(*5Q{9opC_r_v~-rQxXvHhkz$*v1TX5$nT<5N3KwZroNHxyHi9N@Ud zf1b!MTp@D300oo3{X2l16pQVxru&+!4IM!GlRHdx@FB$Vhto0lHkoQ@j1+}CS#GI1 zy0-E$BFFmj|AQ3JZ|VJ}bMZXl!0@+X{DU2)`UD})+gaY#bnQ&E5L4VW`3!T%iRzM| z?!`oOrRzLjOC~6(a8D_=ZQ?qcnD2NU%KR3saV)KS_>4quUg#nTxt2srcAQalm6{<_`ZxWUPM{Rf+x2ja1% zvqQ)TiP6{Gl>WUauo{BMqBlIoB2&9>2d^KbD-_3cvwWLjLGc~Dlk3YVj{4?R!u&CL zy|-KN)a|BvRfP6Sl9TBi$trir5i#eSf6Nww@MdIo^TU2sm9!n9%pkR7};80>}NLqn*-i&w_kBvdL6mvm=A9qbmUl zJ2#b`-xkkfIcF$5PJyoFwT-6w`Kkh@Q%SPs;+26$148#m`vzV;1CNdiHBKRWZ4a%`?0RugnA7Z2*Hc*6zMV*q;hU7x0=# zbS{vh4E(g+RH>{g3kgL)VH*^mC@DTzf{Y(L!{OaM2k8K=eD@sCWih2_GCZIC8uuY! zxdyHf^&(^zPkgh%l}f*%^L=Y>ET$!0%OtcN6w%+?t`PN71K0b<@>gjchrOG*FF(sq+raGmg?xV(3uKTXsTBq0)yGH z7EH3MJ&0JYfp4{Q-iz*8WR{KPQ3~gj>yYe7b!DPDcO1ywc4WBRi0AqN2y(t+G5-5D zQ_XCcnd(4_kG2sNCP%Sa(Bv`%xZcj;9jujDo^{G6zL6N(Pum3Rd7ZT3$0|$Tk)U9_ zwzBk~1OGwi^i|-1H;}=$UIYGAHqWInyKz6~`>J%r)kJI1Et#y7U$O-f}N@BlVN=BXArTFZy zB^&ybf#qq+ew#z_Jz~{DyeH|MY-I_Lm30e>ug$GwKfeT0%X8p(Su&jeS_a51o5bou zP<;2=U`As2mDF=98h_oh(N!ImoZh)G<=EUQq5Wk-;<;_%Evb}06u*H^e<|`fJR5orX4&El=4_xHpOB&Gqrj3rs{YV zHiSU&Ig6nbTs#jRR6=Q(bPjw`i;NW#oI8C0>GuK1*$agYh~ANhpwtba3t0=H-Vfmm z@U|Fr$04i{&Jo%3 zBCxswJzPfZ_q@aZul$n8N9SxCXkPWR3+48AE(o^a3&O0psNfQC8DyMW$#MgW=cF%) zO#j~wAP+uh$7LX%t36BP!S|3MuC+zqT7wSfJqd?t-+58ME)ZF*1L+|VH-UIA;S7;I z?D?cQ3=8c4S*M8{S&EF6@yY<*&;52sQjR3Fe^CuaWCb#w-{`8QZ9Urn57(RO;8J9i z-@n86MKv-|a7U`=jzepJNcF<%yu;<+-tC(k2g^KjUS3mkM$qYf{I_$0&hn7_kDy1S zOwCWEdJ3O!P@Y)I)~q;P?`u1Fy>K3%nW;U~XsYx~!Vua^$9(sJ%=|EkT(C=^LnTCG z-%(lM=R5ekj)+;SzZoC1cc!s=Xk9yaU54!bmH`U$%joaNn+LAZzjrhb+~!hz576Js zm4TnR6yG-qaZ} zBvg-OyQ+gC5Wp{AHu5e(@MGPQQ)xGM2NH%29j|9@}B6tUfn|kEO_%ynes6 z{)?L&IkCMRlpNZvjoeRBc%SFg!i`i0g94Y7!C(jG1O8lubF)4oGJVEsUp;8YE(y-H z{)x!p_mBY+7@;-jFsy~cASgbV52dj=(J{(*@OX#pC##I`hsY?Oq?_}LATQZys?gsu zK<}S>lrS8$Li*bI&;`P9(2CYu&%-E@4*|$4DwEjn6|EWP{TGNl?oxb4yyEL&wJj^H z+;#W#jMd)TW32v0&(*b6J!U24?d>?0Z!G4kl3|1XK}o!N~U{ytbm`809(d z-e9U9ZK`5Z!E? z96^QO%Cp&8c@xVG=}s z?pos+iNguIEuOn0j^!&4{kqCX2V^KBGD190K(FV4Tk%7d%_*G7?Nek07}GbHY9_tw zvqb!-dQ;6|xj7V{6BJ(>D5*aqg!LU>3`TJR6pYznS$HvBLmbOFRd!6M3&(e6cS^9z zp9C^J$DgdXue`lkq4z56kknorNZ2oiN z@SgRinkhljatZnuOVGP~PabY)h{OA~b34Jg^`@Ge3#m%Hl`q4pFWA}&Ga7Rt)sS+% z7T#z1&KlO6YUg`GT}T4CvlZ&va_-;Q6$f(XF`>>M$7>3#vF3YbA|IJU`)8f%@k73| z;9z#W^_&M}_KYzi(`Qo}Om)?EW(#0)oU$85L!%`4mgRFn;q3hwtZ%&$)+1I;L-bhtl&4 z0p!{Qq-Vy%43{LWUMYZFHV^6!I(Zw~_oLbOZ)`qK*OTVm-e9T=wwr3Jl@D%=5N90I zS-jbEQ3CBHgsd9(+%My@Bx+-lq)}WKm2BD(06nF_(o@7TIN0x)BC$WPVvz@ zyF`Lsa~{XB&2ftFwnlE}K)~%52O6fbT(T5ihJFP4v_?}E8_`~a`Oc*=o^Nm=7|(4m z)uA6Ty=md#LS*vi-RI)>+H}sDmk=`8Bj7r>3cjZ^RM=o zxGq9nmq}zwH*0M$qe04QZ+es4ef%OSMJ6dIGD+WGL|*godFIQTrG44JYo{Z0p}sJ;teWi21VGx@&t-V_rT2jhzR;sLY#E(DSXqj`0D(8Z%)v?OFT~&_s?vQ zdfayC13;zWI4EHHziIK9t}_HsIAOPFsO-6(mxG_r=>}8HfV5+}h>VXnp?w#nERFkF z^IW3;UT^t^t=drH>g74PczrVm`~H^=rb_Ri!v-vdVTkUTl;Mq7zKUCUoT%0%B4c`^ zsrHFrtQ9lc>D*|4kt;-AYX>}T`Gd4?<-Qdsm~JGUJ!7@=kYiTA!As|(EN7PGbE*JD-)4X zCV@VS5FXPK4+UuKejVBFE3QdIhG2ufB@$w`gX(RjN^vnAkJ6oPSWv|9DI{Quw-L)d z4Kr${p`OSm?bc~Kz&W?Tm7qcU(sasnRw#1j=#Ut(IP} z7#Z(0nCdzS3YJKqyCtNj+n|_^c~r_Qb`{Wb_`${+3FIJbD6ZjgE4`4JfZuO3)u4!e z{XVNTc^wZ-5kRgbiBFO9PaGdhI;~QhTKxn7;dEahsdxA>KM#=05-`z;p z6OP#_ZC<>*%~aRff#oQme3lzfDH5QtQ-o46mgna7oATTUAS-lFdZDiS8p~hEbRkP` z5ds5~?8B4qGsmg1JRmPIxE4Vfi19v#B;v{ZPgKfgI_ayD;GN)utlHeb_9sgtm0&m# zGW^q!K}67>H5vSB{zT4;Fkb0J58hSJauF6bC4%vkh>RK=&v$cVBiG}HCFo;5b(HU3 z3PzWRnD1d(o8{kADdLrOWQZSoq8=N}aDD8F9-Gbbu6e^E(p?DZYP=v{oeG72nFViWM7>t?j7id6{GLiX?!%cnTC| zfs#t$|B{r&`S-3we7wa}D*+tPi1vXE@M|Kpe|BL-$r6(kbglB2gs+i;&o8)2xX*ot zwzl3>kN&}5VrxYEZk3?74503%1ygXF4e+1@+B>4Hozhm;e<*?F0__52|2MYAY>Zjj z9VSs@Hk&)=2!YQoxJoFTDpyF~Wmb0rdObU*FgfmWv#Ev!2=cwj&^+6w;DPnb{vPZ~ z1ss{f^ChyH^B2ANj;*}b039pU(E*LvglpeeP zf4<4@A{XS}J#DI;_H`F1&*>MD5vdgMbM>YQGoTP`TLwBs__8|%*n03t~{By zEx1JpG>Kpsmd%%~@3Se4mPSp&WEHx8&p3ZJY7&;)s7-`a%A>TwE%`CO%*^SGr}m=6 zXc0SK8@5ZEPe{(%`M#4@MG?K&F{m(DR>=) z1A_#+E!z(5v%j9NV~`N%Petgccys~&drZGEClRl2FDv4N!GO5# z*BMl9x7Hdv!;lCvy^mKIFO<#b`)l z1mhpp*eq9FQ~NRz z36mkbRQ@_{a(ajAoHG$zZZDD@So2V0xUPvA)cQw z50t%wn?Ao#KIiEEZh)ePH(U1U#mJa5RS3{;j@O&4hFxs$P&{HbCc203T_Y?ft8#@D zESHdRJQla|5s}voohg3VoS-A#f94B6wdlz&SdRULz9 zKcn}#gZAxdOvCn3;C7(Z$WY=T_$s6nb&Jp+rteb{@prBf^;O6$qTjG*k0#-z*N6(1 z?I365nG?!1Xs7V-{Hlg%X#xaC6WzrH5_AOelkh|ivIlO(ZY~#U5C?sZrYfUQf{w9T z2?uv1;Xnmop7)mf_(+=+U*^*+Ry;U?=hPeVoZ<$#{V7v*TfV{`DmU5qZ&rsZf$P>> z*N7U-1FRF`Z2n|nbgdm`j9d5eH^~-0mNK;TYrMXpo9F1z;K?Lh*1~)kjmzti(QL&I z{%k$VFH;z4{}%K87;ZoY?d#B54l`6{rgsO4(6=9;fYosR%!Pw3rfRfK?HR3=FpG~} z4@P(eGQtfUuIi^iAm-~he2p->|66RHS=xuWRzBVp$guP?0~P)A*j;NI=lFM{2nDX_ zlNXxDiQEJY7w9@Xto}g~_AE%k?i6Kz>@4Vgee-GVBLpG@BgO2l_rmPicwV!qx{`l% zA$*O<&8r%s_gM922PK;pmTcNL#);}5B?Zc=hUmAOxo;RfN3g+zqmok-5Kx}b2X0DF zr}TtH_(fP0ei2Sp?rsvD=L8Yt!3QaAvEgtf_y3m46yL$87#|R%V>XYFz7XY+r$cbC zn9;-zcrF=#+RSy$mnElm-rDP2K*nbx^wo$wXKJJhjJww}I$S_;4c))e^``0{(TwRM}#;RT_A-N=TaCrKTQa@2`Qkwo0a!!;MQ@Xx@@%< zYD`Xt1PS^*hi=DrJ#DI?YouWOG0y9StH5|Oj^}MA2@s&q?r!6@XuqB3D$V)_1l)Gs zhVpf_*Ep^Y+MmrX0B~f0;&UD5HQSVURO)(@*Sa{E1h~kmeMIs94>nNVC3op?6*4Ls z(LQ=+5h+(2PD<=K^OUI$C*9xEB|xF__{s_Sklvl|MoFQvdSyxY3Ze2bJ}8Opio|or z4KO&gvHl0E!I-(hR0pfMF2`mAmb>D+mr210Ax@#Gisg8V02GMHsE5KJgT)0&7>1MZ z&SsWp%h<5NR9_;*8JdQSH)vaHPy4SD)qnc)BKrJdYs_~jLlbri(a2(C%o``nKjs$+ z^uBQ4iURWg!nr3bocn5z!v-Bx9#_`fDBCdH`q&LR%MMSM1OMlFW_R=kepzKGqN1q_zt38050})__x%2XS$plZ)?Vvb&+~oOdM@U9mn#)YV|Sv-yUwm;cHYNd zS#zAb;y=#k!7^@*Z5fsKa;fsnRzoG@p>|svXWDJa$skGF47K8ZL-pGTW`m(FUiJYZ zv;x{>Kk2ABkOb1jv6VDtCfz5C?aGgLGan5yPNz9OutF)(i}GR4sV<^ZEhPWvoI01Z z$C=I9$_^T9jvp}m#}nf_cs(pT@D1Ctty>NCelDkseDCJZSndmgNxFDA?Vk7-h3IB9 zzF5qzY}`urne5xoLz7#_QYTMi0S)n_&BqFqsz=JHt$S6v{1hGQZFXhtR)g|g@{N>V zA!?(jx!%cAE&!Af8Tr3WTlWJz^tkSEDVL~Utv&o!r$O@?{o`2}i)rPH;F!R9 zp5MY^tS9U{{T%FD0Z`ht(@ z!9YYMc!8rn-O)II^V5_D&)b!Nz=iJZG}JjDXa1V`vS{TG8tS+el$I(`uoKP@y|_%6 zSbmO&qfc@Z%VWYE&;5jlXU@qWx#jQ?K_p z*lDP-*N|rHGSqEQUKV>5X~J$ph5zz~j?CryjO+3z^3$N1(CQoQhU(gl27kSk$h?WN z&#s&4(@E;mb|)Ol!?K~8w$eQ`?ra-7*PdxBoy~ZrI9F*t&FHD+=c{x-FKg$X1!dn3 zKfPc2a*LsI06im|>~k-^NtwURPzTJjjWb2m)+pQ!a@6^-q2{NwokYTiv#iwQhh^YSXn4G|T<$xf`IG8*zu?S)iZiY-O=s zpghoG`t133m(~;Mog1oUSxTGZolszfT zw};FjneQ0W>wDLcapX4KCXvVBDlTC%-WeXF`Z}LV`k?VUnhn)I zj!OcwWgq$GQ6bx-o9mM}>z^KjVNc$)93YPsD1)CvABbcgm=5)Td5=wG>O}!gzuWyK z1zd7eWp?agyNmhB6Fgk)qW~Ffi9C#@8^Y#$L>dNyMK(kDBV@LSpHp&l6Wu8;)X%f8)A#$~=E8)kL9VTljU+g&E z(#6g%WPss4yz^AT_KWFlS+wruW@f{=kY{mk$^PX;=4-O|Pk~6?0>;lc8`QYlQ7`!h z>etGFG?n)xE37p$fBVnxXZ$f68iF}C*{ z;m=wOb>xR=LcWOi5qf?96X+{9V{rhDMeu*=I>F5>mmb)WH~&4L@k{dGgl6DDYHy?G z>rsxyLkYWoGgtZQ=g>#=gFgPgR|pmw+Cu1aq6}F4sW7}VSNY3ML$z~q^ei08J<=aBO%`H2X8$V}f07U-( zZ(gRk1mxLsXkL)_&h9*3>wq%3sg=@araQR~gw%;{<77 zfl^vFoU8nDGt2iye;>_NUL$pO@k*@#J>fX?J;}pS`YbO`8QN^96UTYQ|HA@h-`$HT zect-&yd#DVacihK6r=+X-u%QHXq4T_9n)V^Ce}t!%zoyY>V_+L3w5~ix!oX970PnOnqn9W<&ik4@d9+VS(~48+(*K+x8`8$7bf^G(F}+%p&_rwy?eY zDA})MUEcYU@|2mwf!>kOvrxOo7l%IbJ$qh&GY76>sh^+Ocl~BVCG*%aHE*nM*Y(Ps zbpEIMra8rU*_VB7-;Z6dv`zL+^mBR_?pbzC-~Ma*Ua^_-tkVR0tm!h;eWtE8BSy_E zkn}Bv+QQ|OnLfOfKFK_ch_dhOW)?S$j$`C{<+~U=R345lv)alouR^-Mi>K${m+oGy zd?^ln7mt&D;AHpWLUuTFGs7Du<|}Ip z^Oe{)K_9)3$%0n__7Ohdis9kdGNjjk%+9Nhnd2mLpO`H7`Tkg(fKckF*Bvxzcrb=k>$e7Vtnl}mqKvr+n<8z zx50REHXzMtA?rC&rgbyfcd5lthXG0oK=vKzdX(Cd58P*{{Cm&wSqVsU-<+OFbNN69{jRC}p~Hhr4}jC> ziOhC@PGk?2F?FVlc@~tFqKS2GMoiBBglit)L5ew${`W1D_Afnfezn$bgEE-zqk0E4 zi#b(0;z=Np`S07hirU0>PxrA*0x5;aVF%LVW1zgh)s!U`D2-Pmjg-67?3ooVL~$t1 zcUOV*iX#5hr<8vJ%Tx7^OZl*!*|~j)v4gAu%}Kk}oU8MzwF3ZU)90-MLGwAs9w(6> zG7lxwzhwk$Grz?K%`KUGoSi&0y8(Q$q&?0GfF`74Iu{dd2F-CuWa8%-J7|6a^Y=MZ zhd5XJCY}3HN`J3WdPj-;ECNsMj79}safr}EWdB?ddS=M}Rc20^6`;E+=vn1y_ae6< z*pZj<6Sva&6Rvq|j8oj{@>7IfjK4!)|Ib(Ha{y_vi>oz1q|@9=6&S1RcMi=v)_}1Z zzqnc(>Dbx(z}sb^Kq{1xJ`!s#3m}niatbh%E5PZsKbx<#?Qv5%Pp~bBsmeoNGVhU= zBYo#q(*{L^eJy;Bhx7%l`I)hcDH_4SkPQ1MFJCp2myg&$dMF`p*SMAYzQp2dxvt=0 z(tjF&y^BZQir1N6IVZ}#OmmMAOtczfwS{N-T)x#pcyUg6_!G)Q!pOk;juI@Kf^@=9 zpKE6K0Moyd&~|^vDmJ(6ZY7V*n_v&`Bm9JieQYn=!|sS%8M=?z;XpblSr}8>I1k2Z zjsPCgMjn9nD|*hAOV1jgyU$QvSMhL!;MhD+{$^kro7CUrpFjZn{;QSw!tBG?k%O`N zZUHFdTZXSWAN!)1Pv_d0-A?>E&Au5!apKQ{lDCECmM)E5hxE7u=@kH{ zDv2KP)v2?{12q2x^o%xu;zo<M@if>uWtnbW>nMLHeb2G#EcWhyCiqEzEZjz_F z*MM?f;KPK+KJ`BIjQ|XH@kl3QJx*v)$O?bBmHAjt=h5eCe>QktU~!QWXT76^EbiEN zp`hq(!XVufKb<=BrEBIYRPcPz(chsjaprrThoQdAxk^G$TP8qHOI49_x^v1W{kyWE zPHbc`I!M{S$}HY#KIEJtyuY#4P~W_lo%`gA(A`e&G6$uWM*%Yd&znuBE$tm9GA+VtVBcIe`(@ z6ex~%GESC{i{-v$XV(mK?WUOP(=80+(0AS|P~O|Y;!^x)r=iB?BkEg6Wcdc7gK!fx z2TFejivddJy|;t;V3YrQIt+Ehiu3~opyY3%F$Hv);Aq#)O5YAcHEqOBCvq5FG;Jiu z4skTsA>myP0ZxxEO{Kca1mQ#1yV%C{$sCyzIeK`f zsSmF}`hzK;j|*Ahw{{w;-wKom9ob3uw>~Q5h8gy=hXq;ooxIOb;VRKX?cwu+BmDVh zLml9AGvgaU8~M}ri9fyV4PD?DEC&IG^T>X%LMEXL!Xv$PMM~Q*3u*kjSP-;+{`$<= zX3)MZApLa?hGhZiFPY=|v4He+0DD`R z%(aD}LVbZ@WKq)CFv?y(%e7b}@Z^w9FHsQ?zdv^O4ntQn< zQTOXa#!p~c_lkk{{oeext5na<4KFuy)Gnuf8FQ!|=i%*)ul%jqP+z^~+5YW@dNanu zeNii+>p6V_=8>$gm4x; zGobtID9e-0&Q74eNO^0!p)xstFd^rUo~zXcC7#)|k-gHl*UD@I1n@WnIBMjAenH^E zeVL$)-*kgQZSxb0(8@LeT&G%0#G^+!kMnCSR&)1Hg?PZF_+v=&AGYO9{~&EF+FG*yd<#PsEN4O z7Z34Dwg5-R8$>flDvNzh_j)JW>nZmbYAgiWZRGEdK%=%(?<6U>Gj(v_Y_W23j91?8 z;08Yw=7c}kMgHdpPc-n#*a}{WRf8UD5ZHal3W42+6f&R4m>|&m5T3^Ca)hhySfIpl z@}OG=<)craZ|yHu=|p!}Cm`)oEz&RX%*KY^@ou?6d2Tby%}e<9JC^b?p#I=DD8Hn< z)2!D%PkAa)Poz5J(NVz}cDK)0X#Jjf%Df%yd^rc?=vo0iAp7>ZMx1qE zr@B6Wdgt+i#`=g?;5`R-_$NRFnKkQO6*;b%xI zF#WI>+?R;w=k!!!Ox`_8{X#lt`h~bsL7H{1p=R^_XFsGiOOHg!w~m>1oCHUc_GOq@ z{%f<3|J*|3s}8pbG)Jqas?$*ObI{oUfRuIfZO31|f=eY>T;}VfJn3j(Qh6DCYrc|L zLq{&xHx@$Lxm|)XM}VX6zA&HKf)V}_;N|G{pt+CMK=W_SeRMR)zGpVZ>c=d{e3-8J z$b3a0?fnR8)7xmA)`rc%5+vd?r7cj#om^ip4@WPX=MaQeT?|<9}KL<-o81sB8%&b*CL&}iigQJ ze?al#3W^uc)m9CTH>@1ggSQM`Zn<^P_$tz|ASwwx^BjwF?(u)ElIGxdb5Ozq^nd_E zRgka1;-$*;bEU=%u8-86(j$L0I85->VNN0Zjqrkf&V@9m;YS!#*+l01RbclIEH~dF z`YyBOu!oN{8EPPf*#WaS4%y-VBxSRw%0^Z%R7OZyCbQ$A>#%L1^2;Wc-}FD*S^Uip z={hk#jzqlL@irD$lj7lgn9N0ebTf^cvYhaUzX0@AexsY}+@ps;i3xTO#|>@$Q4_N% z!MUKvbD1pb2cWou{Qr9Z>LVVfJY|(Wme25ULn6Pv2$GNN-BIKve8&GFjWJs4cOo4O zJnSC@#ch+Lue7nV`2kUm`ak59pSLm0^MI4}`AdL4!sEsTIK7AYorL3GtJFCTh6&$w z1JVy*ybmmLG}K1(nCT*bo&0{7{QerJXT1Z1_V+j%JNBJKY^AoU!70BJb_PT6I!Z?x zJzF15DU72VyzANDs{bug;=P*`N0POiTMB~@R1TOsigN91>UOl0k{)LM7UPA=~ zmk^xqnt}8GFSS)CWu(75O`0L}V(J9ZMBN090LSvFmfXiMx8I8N#QDh`ZH9x;!D)J* zGqdfL|E%rVj24&O`;Tp|Fxxz9wn@H=w3`J;cMmO8NZVu{PCh{Ot6`!Cf*q8Y*&nkD zk$n}Ab;=JQ9p_*l8`IR84|#|3s^2VBe*b`>`VGw5$pPgxjA{P$ULGdLK>dT-xWNH{ z;cNl=h-~s(k>(d!zU?OkdTv9@Mg%CmAi&VRy>sZY>%W(@kuO#)pyV-Cg=!Zvg^t_p~m&}Py>hUm4 z_ER^z13KzHu~0dBk9l6jL+QXP9JOui=H#eE+qH)WxM&>E96LdCq z!b{CK86am~HrIi7c11bpj+$p_;Xko=htIP-=TYzjlR@@H%Fwj_y9!ureO{EKB^Gx6 z-?f+ZeC`>F=`u}PFzoK(Q6?SL-6h@1(fXH^mnipFZ&IIkn^+qUY7$B1Z=->^z0&@>CB4PT@H@+IkO* zk4>=4=VlyavNq?;wdu7$AL7Y75Z?RZ!$jB2+&lOAt%ZQJPT*-wI(kkzLVb0kpNZz! zdZxyfpb_%!)x;X4o9i#jQL-1eo9j>dt-Sde+RwoCuWzmAS?s$3j_TG&;iW}%eFHqB z1=8m+k2-en;Bz`o0h zyp;Y@fM5|{Ltf|cVG;Uh+(((G_p0MN@-zPcP;v%iN0$>=u5yrlLy0x|Xc47VX2Unf zGv$B7WXtq-#&=wwxmSd~zhmr}19IlM#5$sx>zHJLK584W1#PD>;y?L!x|U=O<2*=# z(W!N75TP%ym;EMvJW75qCHzy4f@S1v1;8g{-Rtk7cZ)~KTEK!E6*t_d)IrBtH^@)X z9GXthr>`~JyEoEY@1$?t9BcQFW{&kQBJ_<2jOI9gH>0_`{_iBsRVHZe<{K%^`BTt# zg1zGal7BYZPGrutbSBv3XyB~*jUfBJNxtcosc)LfV_J#E~)DisNDd+2zgi7A+z&lXa)|XD)CF1buJd`o?n2r*8`ODC1`trflELJ znv;jf22s1P2#DQKw3z$N#u=4gH| zYLE1-8VG|Gs3Sxc5}JQWXg-ieeK)-Mh;Q!FvE(m9+mVh-{AI`sIxgWvsHp&G8koS6 z|J%sRT`&9c{~|PtJ(W8+QdWh$1S1WMW6A#tYUO0vmk&1TQ`Jvno4A@e==PD{T^F%b zzqGQo3ZS&U0BH?3q3tUGN*m@OZNv3wyC_0UpbB{j&$vIcvUPVm>V2>bdEIs)R}f`i zL;Aj_8*J}BRRu!zE@O|c3b^Vj+aH{DAOwGF1!=qka(CQB?;vxZG4}W-1kUqxn(Q0x zu+)xspx*3u)O!UFY#rSUT3Zs!^Gd$6G8Jk@1xMKJ?|+(}dAHAbxzr9w?Uym%KO*fC{e#+(oBkD~?3)7gB>~v)|2Zhr z>+UCY4O|-d55_C0O|3wA;1Eo(y-oHpqUTyu-};U@2G>bE%)WE(7ADNnDsq z`=D{61?UUR=4c-$nNBmr?u;Ou&}*_m&P@0sPtUEvK~I$Q`x?Q8rVJu|(wNU_H_?6Y zIO)>{r49jxas(I}pLdgzv-~C{o0olaK=BbQLNS9VN7Dr8JJ5l8>2D-Q2LvW#Vj`0< z`Bwy*$1mT^-}7(voWjo4=Y|RX-`Yg|0!r8!HY>ZgiJhZO&c(``6jHviiSEPF3x%8_ zigL6NWMB7QCObHr9MyQBu{em{MEL%lO%$(}B2@DEsY z$o<$&%8gCauxLF$DaZa7Z(`8`p5l-9%x{7IoBrQeR5bhMnM_(PP(5`xOMs!4S8k#< z?*xw$em9HFTWRk#@-BgGMhU&O{c5mk%PQvE?O?v$qj*oW0{Bz6aa6u!l6s_0+<|C4 zHwdRlJ(mTfzD7fJzrN)OO0x(ZDL@}G@GuWZ>w5nOzQ7Ipwo*)X6-%5QY5Y-8 z;<=#3TUd;z9{@;W&yxRzQ-=T~QnnXB5`a@GKsZ%pp49+aF%dh&O&}Z6$h^61pqVkv zm4_2^_|8p}I5JA{>7i*p{tUZK?uYBYtmIUGc?wTMw~yeuIL(um6?QLxV^y3S{TpxY z1(+%Krehzn7f9WqO@=xmCia1ymi=rKy>~G8fj#Wr_GP7jlcUdXGSq%AHg~M|ZO^4s$NFeROlTuLAgBKL^riGy5NLAh}y}Gx^7N)88Wm%PdCQ zD}VNbNz6FF?$m~$Wbr@OC-P@vyA3?_xda&I(-;ozdg!6aHaUVr_nQ0HCPxo&rv6aR z_U}g=nIC39(3R+a&EiQp@!#nc3Au5tUQxwEpKN0|lkgLQp$L{DI4Wloi=!kbL21C$ zFAG5S{hEy771SCiL*54dfOowU>7#;B?QVx$7xnWx=D&MrMb`C1SW2Em1~^&fUoJQw5#?bN}1JIUMu_d`!P3zbiQCOQmtO z6L@8J^hH85m+&yP*FVZ+hTKT=ZkN*eSh-}9hL2$E2t2_}why#@j?w=YoC7FqPKP-_ z8r=IspX4deZ~CFnKl|maMd@e<+0U-~e&~aH*)y`A>t{bs_g(!>q>P{1&y7p| z`~6J%PM_*~D>ropQDEIg+v5-R&p3miZ9c}@bPsWpeDZ>M*87h<v@*O9W+(xn>7mSVD2gycuhp6?VVQ%3as4@jI;C*+}DKO_l$hmD?Mq%a*Kg z0{hKwoGx3k!ftUXEw?pJmn~UgcOEO}$v(e?OS3?UCTtIgEYBx%spDY~+1Yjr?@~Ie z(3!Y_r8h8k%q6&^0M)$v!V<;1e~FRKaUBGZLhE~J$sJ7 zs+eHHcTnBr}RC(+giWZlnF%(8v2flGumqz&*nshz+D z-3FHGMCK#G`H{E610rn*_FT;&So$G|(|Y(|6{UWA%1o(s8S$m=eG8h0LKR;+_&SI){EjRw&- zdCzH#9VY}K3^B46yk}J4!fu-!eF0+!KExfXOM~VU0`ECjYZ>eV+1FQa&`E7WMK~sl zaDh zP()t;hn%v&hP=gT)Lu_|j)Rgh0ko5X%`=(`+J{22=Z19TEwUqTVGi;Zk4^q+lo+myfd1;OrlfW`1R^|1hw9pvbPq)(pa$EN3P zXoI2d;o+2D1Sy91M9Kdji|ma09gOMS`xoK;34ssSA#}!uu{1}j8r;uwr))&7*k}%^ z5b5&~0I3wRt4FFzL!V>pXiZ`9nYYa$Iz~=-T*wI%UiG7GW}d4|(ErGMvNY;!DjZHz`f7TDx?*-@~ z{khYZDgUyO+K*G+p<$b$9x&~pD>fLad(97hoCw=Lr?kX{O<%y%P$Vd~-ETO~)xJ2G zh*1_3peOz#>!5>RKl9vVj+wJmXST!C#`cN;Lr)%GNb?X}7Wgp8CCc>t?Xe2b?E=!b zS%Br*8aDH~S&^6Ew0<6GF=1kPd`zHN@?~=l$p2@y7-|`dHyM2{fwN5inU-ya>cW`X zBm3xe!R{}<@< zU%|_1jx!!aeNddmEiUWlVTgqeCajNTu|}uI9W^E#A~#FfaNj4 z>3MRSp-KYm1A)acfFGfW*jceO(mm@9H8D3* ztD(9s;mP*NyF0fTYROeRJZ_nIE%qRb??wHiI&Fio&SXlz`|H`=q_)vePY4k14Zu}@AY_H( zG%tyr#vB}6&uGIB>C0*S&KAO(vQD`suyh@Ooje1M&C5l>>G=kkn{hnc@^_Xm>paGe zZ2{$ea_6Y{P(8a<1)VuUVt95hpX0= zD()*K%ENJLH#|i4p!;T|!%M4lw}`v|NUL~^qxTJ?0t{82U#+=CZfWKD6wUv(Dy*^*e-O6zw-F2^_Ci*1xT<2G70I<|`K1Czr69lr) zpr>KCsE~1z{>V4FPkR-heufYtWBRZErvDV`D+WW)It!e39eiNAki2Mt@RP1b$!IrS`^tWf+DmQM5;tkE)x8- zV%D)!j0g98_ADr$k6D#8kbUkgEO*I`L~m;2249Wr@@)gzR|H5u@l#G0L5_|t1a0h> zoc62*Y69&Yy<6K+?{7B+A|GuEL^v+Fx}wO;56{_xF#xF|4VvF1INQQ}Pb)Ys_?7@t zVFr|v{^^f7p5*h6l;n*zz+F6VpyVD`#R*{Pkj7#4azuG{$o3{ zav!rm#$#T{>`H#e=@z-vZjKAOccR`n4-(%Rh}3Vdj}VN_*|^Xrg3WV5NcNm2SP#;J zf9FBE0g$%-yBi|Afv?^J&|Jhr>2n<&y+pULHm;A%1JEpuMG>MWxYJpz&^j}xbpdBf zt!n48`1k4~A7bp_-)oGVz}WG!fhB7P>g56KhebGs!5Un|gJfyFJ7V?~JONO;a%V^H zY75k)H?EJQx6X@@eh81*U|^{Tkakprni~K#v2|XA=sElOl;E3Zu@r~w>Sy`nYN9*c z%2}%$j&?cYLb7KRgz7qsRe?*XjtfbiPOt_~LUL-u(TAKTA-kIAgla2it*#<^hX^$i z#wyV}Mj^SHNp0@b;w< zg0mBOUzQrl`#c2ixeg@#5J%&tuz2Nj!|{Njj<&3%Sd++_LXpPw&Zq(*wO|cI@YLn=d=RP5eu(EX3aDRzC2OVY_fBZ<=nXXaBW@5q zfhJd^-wGM~QXqqCw`3vL2yJJ5Qy?OPE5+aBj&wpc)rY@Iuz`^4Nz4Zwe=Z(-*B zB4m(01~MVDyYPV1|0jQ>4xowX&0Wb*N}iFjd=ZuqIX%!}$&w3y?+pAY5FwZ)ZUgE6 zSfS>9-Wj|x6{Pb*wny%;WOZHBUL^<8fg~uE&G!0}prnho_0D8lC<&xpv@Id{mJOu+ zygit58B3#7Hs(-Ykg=>;#fJ^7j%D3mT-8Z^-ZMLa4~8uu_3_!&eOAcW4ffO{7(3!k z{&ITHcE00ycT<4y$&BtMccg=0)h2&=)%lL&T}|~7H_=<03L@}lH(i^DF?I-KeF{gM z4S#Bg)Pc}c0J4*7BlDjdyoK-*n3GECj{eCVi3_|ZjIo34b)rA*>xPV1%-=-5lQI30 z{OyK}5%c!}j2&ECedNO(0_E#(t1sUVV$e_Umb%ADo)MnBp>cir zN)a;FH?F78-55(nHnZF|RURO`D$OiUn<^i;iX|c&XnFcndHf2NitJ{&eOmjZJjX20 znb!VgEEVOM<$2TEzl5bCms#$b*1nFVq9U`rXj=QEe1TcMU|RbVSSng%mM@yt{y3H_ zcOcEZ7&63kq*pD5j2B#x(R5p&{3C($Y`U$!{G`Bp>bT@!)>Lgp8)f#_~;#8_P*O?!wG^UFWg1zy=wsY%}W}I5)Fi5#E1eP+GNGuMpoG?o_FA!C*On(>{!W_+JxX+aKTtjf7&e4kx2zR$3< zAP+KD=X^L0fBqnu$W2GTty-L7g4F-|R%aZ#MZOvx5G}XHEXd0GC!>u?CvovVioy7n;{t zLGu6co=D)gi$e8(yf-q!LFz${Pwj8=m+x(=FV6=)Nbg*!&o%EE6$H;NZdPhTJD1h) z$A-uuPDp*WsiB6(=(Sm(X8k6AWc~Jek%mpK2*DobFm_Y`G`~djY!A}< zEfdS1vOvkV0PHL3lc?``eXBq6xygeF2KWKS(&rYa`Ftnp#THnC3@o+p*c_3$ywtfO z)a10I-u+xouv!GEZF_5ET*&d%3$s(l1czsw&#NY~d-S?l#V0yCj-OZtdSKJ~$N`Q^ z9WyY^Gd+6U?Ztk8(s4oXSODz)P3t56?-oWX1V?b}Dwf*5yF8MU1PU4N$Q4{h)|{+$ zOs&!bFf(Ssn|?$6+yckm#n@2@NSihW*7QwX5>x6g|ZeEvrZWDxxPGJteRNb%@9z8v{PaC){9eGihW z3%N9c^@DLC&C_sHcE*I%Fu`I3YhAvA)n_@|BpxGJ>;=wRy_XXx4m)=Rt8qw6eS?e# zlB@eUvAR%%ntDj9t^)|3qI&Qw55ZoHo z=lMXG>mlRPh1v8S(*8lB1edM)VhC0g2Fag$T_qqTASj z=2Ua16TB?@xDj{g2E=>28w<<1JCH_Xom+$q?herEf8+iim+`w-7f&y%N{1R!?f|fh ztw?)bgp7m!m8(agAjI4FP?Zg7D_!Dhu@$tpF?J;SPrOgs;_i^O`bPKvsGOe9Z=?BM zC-q2fG1B=rE4_t8hg=ML0f3j=f;9KKoLX)RXr#W|1vT6@(9RGYEA1P_oq5o_hyzI! zW#4WPs&@ld-2hx_mFo>>6<9oc+U#Pw7K@Soe0xsqdJzLnuroF=-po#+BvR_XUU(TrGwfhw!wui_ORkhdP7 z#15jD;6TDFsqZ(&(w-Dp(wzbs+a3jt<_tRDaok^(qEz+odFq~kp~jyD%4hfR5PXvd zY5iJ6^GXst_!19NpaALJR>&xL&(#_@QW7FMOhI3jRz?5vn*Sm4J#d=lVN|cl!)OC3 zRA;Er=%$$YB*u=9Xbx`{gM|8%iclK=DJY{qMc$J?1uv1eZYz<$w%>j5EO_e+kbZ** z8G$42P=g2=x4h?Sy><+HKnT8diQ-n@-aj=EY}%5F`A@@V|cOAS`#4}PYXLgQEH zniJh~0AuM{qNm;{`x>)lA8NPd^6kmB(E9b`D}(;>xB#B-i;(e9-UG*2lpgfDQ9Dt&fm>x~r)uvL>Npugj^ebX9r^*AX3@?)RGRrossPxq#@}$G(fPBdN_# z=9BV)lQ1{+qaz#3L&3)KQvjunDYlSpNu`qd*MN491v1k9>eiC}ypZbY+W+|74dmUL zw7=evc=y<=7&{10I!t|VlTvL94mxfB0-0P}Ao82F?$(Ok(0tnjmfQlD`kNi@*8Lbe zCVA&KD`)UdqATBg*FVvfccmx^o7BH*@nkAwP#(8=GNvxet;NZ{{dI;a*hHlh>{Pz_A3_@0uT?JD_sGU4qWO73^T(X* zJO770&ir-B&3!45(f4kjGynC>X8O1N2KskQuzRewL(UI`B#%htoi(_3@wa!3rGYd+ z_j6KkclU}NE)Jwlk;VLbh!?6~04Q_!@Je7uAVRRpfDLLIM5wWX?Azel`}79h5_%uz z1RGL8nlC~IfLML#3NG!x*l~PMDlCarfG*GJI9?8NW^4uM^0Pm2#)6=M4KiBGDwWt~ z&~naM75@=e=t&~?7gs9KUq<7|@3^Uw#_U~tE?XHBoZ-<5vStG1y=_U5(MsmVm9FgJ zbLpALhKG=LS;z{1IL6cbU_TY1hRo5|U2^oJ`6+|@K?r_51*G+FKt@ckhDTQ*eLsl7 z-SWdu8sk0$+R0wfKDaKcI8bM(A6!>k{GkBhkLIr)JP|@#pdIy|>_yrh;DWpbr1&qH zy`Kx@=#f@`q>kf)_3UoOL-;b;Uj%0?!dUXGDh$O1!E?Jy_SH8yy`+tUB1kg9fYk0q z3=-ZDdsuch0HnS{ZFVdkf@`PEf9ey2cR*6`psRAnivZGo056fz&x@e^2gZ&;058#> zTy25YPXsH?;{sp{`FRN4-k$t)l?cl0#(T?e=aBX?H#_zATOhKB=jj-UjQlOe4s-(| z@-hR#%TN1LAOx;TWp?}h+S?Y$nB88g9mCk+FRN67Wt9p*lCtaZhoYYej&N|vd>Y>X z?tLga3uIp=jkVl=)@AxxT3oX4eVz-h5kRV6TB#hcz_Iu$&^IitRNNqEK0i{X5FMlL zrCD0t>ls?*n{&1Ic`dvU%6n%@*bDq{JoeWczgJ4i%N zB09`Z0PHK<0uh4iy4U5@o~TB8Rr>dx-K{h>r}8&4SLrLYu6ES>9Dw$UD@|L_&Skj) zLe`N5p+E{3x;w=h`gI!8?jD&>|393DviryJ zhsT06qW|AIbi3vT*|&OVmbPWY6WWrJ9=f45zc!z<1VaKy8;{%&I=Q$~IrGxv+7ey} zHK$~Rmdr-lr-Tm=J+7SuA+#|iDReRoX&5qs&p-ElXVSZL^5fdy1R>Osa((D;*CFi_0BQCAdR$x038AKxl+fx~NUP(n51xGPVQ0$7 z{LrG=NF(KU%|cq!$k!(8?BP;ojO}Z5Y)O-2+i>KD(DREcmAjA3qt6d7u2fD6qGxd$ zXwSVlS9{~lx!Qr(YqS?$uhBetkm+8Rllh-{kXgsg3m#sVlllD7N1bl4rjq^gJa8UM zTTz6p$JXsdks=PX#gl8hcyeuz(6#kUuI+xX(lPE9K`G9FW1m}~hOFxbvZiExJ5cXu z7&}NGNpC+Coe%wI#6^ws?34Up=`~#Lw ztPm82JB!K_eC8#BS68g?R{i@AqHRJ}^@e(a5ed|edv;D4oCu z8(iJaeBgu7)9oaCo$wXHTRQ=Qo-~li-0ilB%3;d4EkW)ImWWPQUuC7^;nL6`AW+;O zgew5f#FO?oZxAi1bpWRbkEcBG=JZ-Cu(*X)SFrkhZlVlK`x73lsRXwX-KPpwc`HRO zmBuVL{kO}mVD&J9jOSbPYu^Wv#&V}Q8U?#20J6_<1*@Y%u7}88`xUIBfB!*r0}mmQ z@|huDryvF&Ne0OVvhSqe2!F^UZ?ZWSqWcVh?6Y3MY6UkZxRBJdK*o5AsO;fw!7c+! zj}P`nH`Y6q)h;<2+W15?txJwR4*h3|T;I<_aBm7oFCK=Be6Z1TSR28OfV|0zQl7S! zq&>ZfPY&(pZNW`8kWQNU5+81?FDKYF03aP`Eg<|Yql(g*$=6%+YssAK!Pr6M!6m}K zA3$2Zsn`3LBEA0YO0PgL(o)cQ0Iz>5(qLUqt$!YD-)_a=Wi zjpJ|`tNR${JW4U=X7mr3bI+Yq@quRAgS#aQ?*Oe%gywqzB>z05`g7tA<=T|^S)h}*!1EiAohc08)zn0}7oW+B5peW>HemgI09lVTHckoeP zC&9iukoNp#tUhs>(6QCS39_&LGFE?jnZ>4)u41*1gA(qikI?rkKij+Y-!5a7%Y4+g znY`bDv?niPbuw1OW$c&{%hUAHw^RFXZZI41${d#*9dF|YzXP(*KM#4yw+vW73h+p; z=WiV>%tIR4zbkks`8p4h+s5#CeHrM~r<>3lk901No*C6}d7yDNdM=@GHqg0r^Z#_v zPhsqMF%=|#0rKXjn>m(pkQM_d_4|-Ubl(?KK=OZ^&DHHGAa$+u zwJ{V({cV?691k*|r_FtKu2!SxI0?JNFUqG5@JLi_GIQt=eenEh4ce1y0dkhUYlRFy zz;bBkYOiAKfSdn4YJaE4Cqw_)WaeWSE`k27F@aNFOF@dC2YsZ&o_k(^Fr4o={@Er& z^{0UDcY^LO09}3*GWxy&HRRdJP0U`F;2;0>phIzQl;GkYz6E^`c)*L0>?8Ey&xGyN zFT+E}>+AHT7TaOBkL+<}YS~kWip{3C}q(KhST;kLoc?72R$UOq#Ww#Di z0Gtv8km_uR(($=vNPnM)GXW>M4Ud0s8XA+^uBa5q@a;jnMOh>n>8-9~$Ffh&*dR%sy=tl-; zDDIJxDI2xggD<9Dzz)32a*Vvk(X#?8weN+YRrP%)}O&jseoJNgS|&nu6w)?_}tEGFbqzo1Xwfj&ZivIzTP4T8d_%hB;17>-wg za`6sBJ!eIFd^OVj521;e74%Ag;dl$^vIF*w^GGkJbe9{R`+Ml4eB^pmp8q;Dk6;$l zJU;@>aVi6mmy`p>l1o6^r3QhS1GBSUA)-hjc8c)cyu_kNNPi>*+grEMNp&m13 z`-^K0^+F=oBg;9wgvjXFInd1fk5gsipv6uhjf1Cr9B?TWX1>ta=Pak^BWXa#GXioM z*SSh}iAX0H)+K@-YXO}+^FwPH-V8eK1U>ff?St`+pr3pg=^s9g^pm-%gTfX6aq-HU zXKjymkLtsVWju**`XK@!(={ae5(bh zxhsXqf@Lh`T^P<|>LVtTcJFa117^E1!5RL__YC!m+IOc=d!W#}XYsxm4@co8htkQz zsjg44L}O9@VrDE#NCv6;yM{`}fFCBZ1vPh_!_t3{^=(1=1;G)%AizGzlA}LvG*m(- zL*uXm4+syg?^zx$HOkYLD6CYdlGGZRo@v|2F< z8AY=);U)nwlPw}%GD*C|OiwjHZ2~FT30SnFN4BKht?hdVC>}Gfp3(}MeU2>wZ7apL zm{_gtIdvvMip5ssn$2ae-)F5of#~u5{gF@hUbENjSE~NAF`S!-q26Q1gk|u2rPVHo{(A(JZxvS^4*)xZz)l>57VLFt zK-Y7Oci4sE@|Z{rv`uvb(`GaHl?s7!#aqrom)$<@Mm_b$ami z%scq|a^T>%BhcPo71XwgJYVx}wtlf2ZCPP>CVKo+v8tEtwLW5M*P|zPBQgCle%2t` z_Y?m~skhX;vpjVjkA)lNc^FSpWzFe@r19N_*33|^Z)Lk~L# z-@EY0oW5pD#|H~dh6{~15;OSL91S4m-W8U9cr2#gMITT5oaATxJYov@ZcRKkU8|gj zwn~Uc_cB>ORi=ppbG}g4{f+KH>9OuX0b)XglwiNrL*T!$@d-{>yFeZv6d*7@S*s+I zMumVH^&iSH{A;pIAywGU`rRkt;Pf_sU1T0H7yYTBZQh?6+HPh4Atx4h%rl%$XJVsF zw0c2`2Rq1?7C^bRE!f8DF8EVZ+rqb|C+7dDsqNP%*AL}3KiGDe0Ohbu+W*G>POcxy zZhokZA~)VGLb2~&o7%Dk($4DcIJtf(tNDR8imZ6k1*)V0W&XgGiA||!c!x~19jPe4 zXMOTKRTi`b+tQL0YHIV>u{~z*1*$9b0e}6JZ{BxcHD{*sDqEUHTE|lE0^{20IEP$ zzh=gUy`JFnDoT|ssL?$c8{&PLm=+9I#>dB1MJONLY3Y(o+M5KFHg>Gv@>X+W|0Wr( z-!zx-yRA)tyGcgtFvJj#rv$X`kl{i;v?G*yH+Behkv2cS6SlG!@cdwVGw~|_DIs~y zJUc&F(Nu>2#OxCCwe1TB2HAd=rFRdq{cWR=m6!z8J(xwzl7Z~e;f!zdN1_m)m;+@x z)acXSnP=?DLhILZp}g`Pq2Lc!Fn;^8&^k)>SF+H$jZ#I{y9Ym5Pqy?3a-!=y^Ngpn zNPAdDZP$klZCzPt|Iv43zPEgnQvLf~^Ng-6(!TxX^+T`bp!V?T^+P}WRaruYn3z6y z{ZJO9#APG?wx{=gEwQCbHeSghn((H-t!r;E5tNB0HaE6O%}s3)NV#J3m2KP8(Qq&o z4OgNh9t?DIU0zqqoQl1-z`adIdzXxMCfl%aurZu*KwCnoUYU*7m(NnAJBzgM&OoLww%fCeAEL$o!rGuLK~xQZJ*O@yGSYoUKo1LD`stGDfFqX;Nss zKlV2$_09)r-|(Gz#uWle`Mu(IWaBeQ2z7lpy=`lAkn8Ot`OtRQw)E}iGiM#mLhCmG z<+Cif(l^8XN)}vCe@8Y-=B^*=`tWNP;UG1av{k0u;jU9HTt@9W6*7K)obHN}$d3Put%r4` zrR)%c9~Go{t^{S%{$S$cHig^!eB9Jh;^tL_u!Jaa#Hy`@Vy0`7Tfvkx|=}k9W^f z>dk6zXrn?_{QnA2cFbKrl#Q&!A(^z-L+19*6Ph1j`(MrDr&^4So(WSno(dVmGTMJF zqc$kx-A^g?if;!KjK*cC?(f;U*w#4I=)8$&XM5_WP^0r*YILD1;d|WmxDUn9oKOen z%_HUnsBX3o{Eq8`o$gd^UY1%*P4|BC?S@wcZZ z{{8I-+at)%-TwBK?T1B_vTs;>c3)5XCIcR}_f!f}ycc$z?W~Rr7pv2~=pp{xz38fT zCO6d2MC(KmO84!V^4qU!e-S8SZ9bHlhYWb^y-SUL%y=_N3OTc&jYy8rA1L*9ugKJ0 zaaH^0lzK;`30#lOV8PCodAMt|`cRAU06PN?g^aF6(<|88R6B{*>p)qRQ%D4yx3)9> zKH!|t9(yYuMzOyx_SV(mszWVCrIQ@55}=SzTMSu-Yu=|JgOET1GSTiIh==9PSBDW$ zqp?(Bd*wCcIFpAz7O^w%=;d__Q)SwY|DLO{J^uca>xT|E-{1B^b5li=3~i$a+5qG! zoo)C$NU2hNq{ZlztKy;nr5gA4&l|Y6eK*{=4?0 zN8LBIU+uoHA1KIGyQlSkIkt(dpZY~#DSD#?nRBV^qpi`^`-FF`0+^32C&oubGS{QU z8i~;hlzutJN$fUaye}fRODw9XlyQBp1BxGo@jjWyJv2pZ=6ufOcUXEXN{mDF8F!AqgcwF>n+@!6c z&HiQs|Avg&Hw6gCi*&YYb`V81Yz{G#mNhOXyk9^}H0BYL0Ez9C>OAJ(L|nfgHjcy^ zVeFyQ8-(g+bkVS!7y%$Rwj73G>-Tn^ShuH-!LD)Nef`5gX@j_Ol)-OU5<{$ww;!jhO6;D7^RB>73`hKpFxW%WAzVS^2-nX znNmHrKEIBQ^8-6RSZE+KR*oC%gg!RT`~P*xtThmFN#IQ%AcwZDx8tdgNK#EtH)`*g z@uu%6&-+psV)zytoH*-}uH5L0xYQ`yPdx+mZE_~Q-KZplwu)#q<5J&`phnk1jRp&z z^PO8Q_nm_pZ7k^ac{8z+3ZX`=tHE<9_$BWpUF`oO7UjqsVx~^7A9~dR*JI7Gwt5uA zpBABP6^r5|8%iY#;+Kh>mUd2^N6eobC{1+z;lXzGz=Q33DAiXx>|8MA4wSMw`!Zu= zV=90eod$Tu>Yfx(x)mNC%SJs=nm8d9hJ<$>Y{%OVw!ciN-nHzZcD3fA_C5ydJk(Y} zjlP(PJ>MC!_wlYfA8J?Y9%}EURPW6}Z3EQk|DjYb7g5Uk>w+2`h8jI2c|we5Iwci^ zPD(|gUr_4ps(+|mz5AhdjnxgIHVrlUInT>2hfZd4RM zC&Jlqu|2+Mb3Cj{#FU!9Rq+E6bDE~EA5ujrA;_d%ZE0$IfWhN%i?Q1Q?fvya9os+N zzCgcnUAr8M+EsB;J6qp7DfPzoO;3zG0)zDk=J(nZC=$(Kp)z{%lcw_j+etPYG&2 z%jCUPM0L>CnOs`$Q<4xmEr}u4FI#iA#tk_{<2j4}*$t)^O_2N2lUQ^?U|V3?{3Yp<+KeBxMHVUjBReXnq(=riS4%)tSn^2&bAm$F}N@j zuBHyD4jocmClGJktorI9#2Ic&GL$nC&z}?egGG5)+dkL6oHzM7w&(A=ufI`TIXYd2t7+e~{*jh771fJ^6|sHy^^d`Oy+!pN zhn-)Ujfe3V137U0)S|k2Z}(t>h(zq?VQmJb`XRR7Zn$2usJ`w>#n=Wl`t92kW97oR zT1=8_w_9xQ^zwW2trpc8eW`h9%6v3lhw-Hx(Ka6bqECT(ksnwdP&q%qV~|6QKCqk^O}7!_0TE>% z0Hy4VZ<0|fG&fZ+K4mpq`-p9C*nrVF>~{)tW74Du(tMH zpk@4Qz757e0m>Ns7_1l_>|!`H+s+@m|14D+A=gxW^h}iD>!Pz%X(%Vgzg$a|{zwqxT@sXQWfJbr zvfmlc-8}(X&+!Q!O{{sK7=WuzwmgnMVZmRh3JmvQ&UxjN7zeIl42{n5ysxw}X z@sgb9li}h#=5qdAdr~S4&0)OWau_|7dY4Tk;cF+_bBzH?WFoX*vGRNpzBYecc|J78 z8!q#Z@U@3o}t{A`Qal}Vg217vFFTW>mcNs*uabgdbd8;HE#YZ zDfQlw(SJ6{aP=~|`Zk-#wQ2v2zQ^zF9%QuN{ov!=E`aR;u|d51Eio&>&kqrsttl}7 zN3ryn+pWdK95WD52OVnn;K1~O+>$ZJw*e zX6KkOQ5{TS;CNubF`8=9q7ZslExW*DHAR=&|J}~Y4TBGePVVz?CDiD@|FwHiy#?H_ zMT|F892y8D?iXbqhorYH*uO8ZkH^wp;(}7o;3q?i^ltS5Vs7Q5_`JdPC8*uFbi?4` zzs}Vj5amQ{Um$T6&x=X4m#pqV;k_y0F@N}d&9Mr3Z}4It+u8#C!hkB2!U2Hs)_k{EGINJZw?r&BE@% z*nft#22o0gf*KX)q0OJsGw)l<&LuHX@}=^>-=?3Y)x$9{c9d+hgDw8!4Rq8*YNjs3u5pgR{mJuG&*U^7{Br!SuIA}n|FD`;ubO#&a@;fH8)luSdRHDX)dj>T z0SOZi7PIqAT>v8}lW<_%`-hqMqGPenPD=>kn~x7N8GLhtr56qeTE?b+XW=~XJW**8 znwAME@16reEqJS};WV{v`hS)2Dy>J>Yjb&%C4!IjtQ^kn_BDoJM2goBG5Hr3uNStjsY!hxIS}N;=4vlaiRU z^OosgldZXiWF$36)uRFETM_{CGf=SoGc-hYT6zaVUrG6RLca6b)?k(C2_gOmB z-e{)??q|=-`)}cE_-~ZzXY3r*wQRjgC{?yf1zcbGEijp-FgfK8OJAEOxXw!jp_K)7 zxoqqMBHXD?7>@zvPgAOoN(c>z#hEfv{)C;UA=D{)vV0*wm0jE%sDVDc|*HIPr}Y~=1JC_LJw=JPl6JYh;d>Q42Vz6DH5FJ zhaMq@1Z-w?ng&E|EWXXXl3t+V4SvNo49*|yT8;`?7VNc7Iir>Kq0@DeLo)G&wZ(JL@yd zC<&(=D2qXjrYOP=p63m%U0L>TaG>l2ML1PW3`YN{ zY8ZhF^>Ye5?p48TDCz2|a05`9S}159O7-urUudSQiSe39W>sR%@%Kg5m$IntM^QY@ z+N>rOY?c?Zt`EdS$zvUZ>p-lb>*2a}s%R#s> z9~$d-^=I`Js~uQ{=}_3-^RZNz99y4lUs|6A2Woed8xsEwAu&L1NNmi7HneDUMZF{+ z-QK^zdH#UgIy{E`%{u9 zInShJAHjEY`|RasXPu?V!sTacZ=WGyteNI! z>&*I5bL}y(e$+__KbXt*LzJc^M{-yaL$OKF4&MNCmRkDZ8;Cjb2r(Kxa5XvM zYRX0U@d9Y646ckHZzrW*8LFGnez${!yMb_}6F+MJlno*YH&W`|kVC>TO1+)y(fV*U z!+oquIiQ@8iMLBiV{3|8vk<1GypJ6eJnzak-?k&$W-OWq_VLfb7O@qJ3Y!Sj+! z^^l4IN=pGD_W<{sv~fF@gH@32d9H~T*7b<1o=x+)MuvJsA;IR(=Pe3}U83i}9?^4j zuLz}H@*Yh=bvHnDL+$c096})KNV6d}t?C#~uV;N>+fjyQUH+h%sr;N^1 z!~Tk~819Vz8B91%9`{$UGx)#QcR3_{*4D4KMvAM~zT|+C&O+GXg!hz zr9%{RyC%WK)}c9T+&W}%koCd)WM?2dGmiT!QlgEA!}#BLxH5x--BaND$t1WsauNR6 z0qy^_SN+k-%mpZPCl&M@|@QtJJ9-2Q&d;(DKp@0Z&?OVKHu z*L|&TOsCKInej0rz8EXQ=0#NW4xYc)mPcaFC)oS((R*z^Fy*uTRJvp+O#V84ucert~2|)|9|8v0Q%Wm{?{^pfN`)=9~w7w%kNuLmS&NsGpv=hcAZVz9S zygzE&$2Uf8`}kON93Qsqi+q?m5lY8xj6dq-dGbHWAx5!tVCCor82f>8+o#y(?Y?{7 z=70Btl#k~DKR8eA{MJ4aJ|q<-N2Dp-kDSx6RKWSrDgjFIbo3AbrTau2i?mg0Oit?+ zu`~EmrG|Tg+Ld=(dif0WoMHI8ju@3Fh({RSFqln5>ox(($Q(PCFPqniP8gC!8E;pX z>a_V=CY$m04^?tIvC(zJD9#;N$>ue>3C5^2HTfh^K6-W-8?KUvQps*^GVn2^L-ajpsTT_gh*LHTJzI2?t8oMd13^o#uP!ILBSB0v07T#Q%p z`(^gJa~%ZZVNNbK1WaDlh;HBTIfS=CjRvv7=XVyYx+v2YLtA>crKc&vg4i7uu79n93doKl_1&*`6j zQFaapP=34A(qlXiPw%P^DfRZ!O?;e)^{)D32DUc8_&$dvgAJ3d8C-fXv;5=pc6=ao zkS*-@9hB|FnUY?Hb-Kz7VOQ^{_P0$mS9@+ zQ%b#+ZwRdo7F8mcGMn*J+qiAXe_hPceQE?eXZUGJ&{F3$j4_cA%GgKVjc;qzNFxe`Pa)NI>VlIZ5SGY z;W@frU}uG$Lt}$w=Tp3GiKTDLo!Y&X_=+7J^g!tLPYF@XO?#3 zU6!7jLyVvVN=ZVZ@%5q(_UhHc8{gA_I`1@rKheVMnFI*`#yagF<2b|Fxc2w z+X&3n4z1wr**;hP|1I19ZHc9ySZC{TY4wD6+4=dpgo8{T%jDt;i9{Vtts09DEQHK; zQs3$6f_74pLL6>ajm2InO8)pZOFywi3J-}mwmM|z61w(w?(3rY;k>x+V>tJR#g@Ls z0T&Jn%SK)mwUktx{Lxx}T?}|7cC2eI{eu{$pNU~QNea_Pr0|s6EuG0IU4j}-6-e3| zho^?&%ANd9o9EF9osbG@o^YUNbqRU4oA24hyu9xoOE2jpTi7$-AIJ>tg?lW0SSm;g z8JRnNn{}}rR{oQFEd9(XhG$h~S{xToA5ea{Ze>>Irsi_ z=y7+>B(2+c%$~`~oO;_=GL?&6#Gyvn`i$>mRi=-DOdrEiQIhq;`l#WyS4GJQx7+>- zo%y7d(Q2`eZxN+2H>+2i?3$oPxsOynX=QCOx#mVnb(QByDNG*ELXYYohU!Ea zqsyDPA6#MbTgxn+?XBBd0u@Zw>U0wBry0xi!{8rt6H`1N8xof|Z%A!&XpG0`v#8F> z+3(`{B}3v=+>rWrhxWWh_5Wn;6q8Ke4O_R~DH9%le<0KD&sbT2w04P58hyk}Jwtw8 z4;+1)`}+ElY^^t2REI;2p0xEhgU^dXf=q=wDC6_U`9(vqPlYg#y&ao8J5?uzPf_Z% z_3)FEhzZ&|D|igED5Hb)byeo@xbvKyLGRaCda7li*(KUG{7jBuV@|!#{q#&mYYbNz zy^V-C*7Q_~7MbXA*XNT~2J@!;uIILKdc0A)dWoeczakc;HJzAr!vyV8E*vrGk%^fa zmk;NRBqXgVFdv(N9@|cogku6qf9N1)n}FSHjrrPsowNqCY(9$TbMF_lEh{YU+dLKU zAe--#;mSAAx=n(@*1befqs>e0{9?rtF+b%o-iwYxfU@^^eFgiLop0|upbdy59H6x9 zG^Jku8)%I&*k%)x;Vo-t`BFQlE*Z-`|E2r1(^6sbGfKT%^K2ivfCMF0Wcw}d7on&* z+~;k#ng^4J?0hdw{_!?ThYIbrl{T%gZw5r3-^ctx4$J|Eod;-u=iMnx?&teSVRE1m z+Ba{txF2wr+xCBJ;CM^St|I$AEsTSeENZ(MFYF+u;3Q@}grnO4r7`1^&fdv6s<3tc zfXR1x#8k(_K0tUJgOudud+r5$ydf2KjE*-lInqaXybN!0EJyLn42LN#{m6mq2aZ!4 z*QKHm!#Q_7m#0Fbw^{o05)Se_Gd^NAbu2X5S-{SLu{>KRmausvY3~yS$r*QBdN;?n z|GbzJwO_))Gg5I9t24ZsBxd$$A#_@jl5C&mvddGVX7AHB-w+dt(a;U;se3H_2f!{n zw^C8^&;_a&1DlISuFyPCqc=j0mdV&XvVNf{s$((qrQ|!Av9WrroWX`Y@4L;?d&czQ z|1D}YD=dAvfL-Z2J6|#wyza7jEVgHI-sGBD+N3)(XV-P)3ujkMg!0K^+yC*9RFE8z zij%`U_WR_}%b%f#@i@ChV)nS7^Sw{0H+3g5gt?1`Pz-kf;PLl+99w;#T=bQ;b5xGe z>4~~uXZQ*6-7`%x=O=9bLF_wqx5V=^otC^wb6r;7_`4;ZlXYW-MjwGerR+Xh4YO^U z&BvyoMq?rjdaHd$VEfBW;r?>3JBaxKw{i2@eE&O=_Q?`EH)u>inSGxiY46=?>F=+y z^BnIT2anzvPw zQX9~hk{Is-vn>Lxy%E|&je>SqnwH4I5+RysQQPdxCcMHK@jAIu-~A9R)jIEaJLVkPW7V88deGVdhgmw36`_AlI- z@h|jc{0+za52t3{`^(3}a~B3K)(0kMzS*29^Yb=idBi+$p4;u3>1tx8v#~ptL(JEI zKPT}kR-Oa%lt|3)XJdCm4lz~H>lP+pcLU=UoYlIq zv3J#0QD_;+gW_fMQOWjCZzz2izaKYBCp=N^oq$qSzE{M-pyvi{*&UWnfL%SJd-lb0 zQl{N{vApn7`R!#|^~G}6SoyKwMp?W04oeR>Soy@+*8v{Eg9RaxgDBA&95CPb(tEm+ zm^edA1F&(D$u)BpsnK8BXY)ZUlC`CGT6#bxVM1xySS~b%FL?B8TI@=gshhYh|E}XJ zExpvSsC*67@;{0=xO=^%t-+)A^LF;U!hU{@J@?wr-<7pBXk*VicSp-Kc+|n`@3Qnp z2Qj+VPpA_CqeqMn4nIPSApCAohS9V9j-kdp9=pYC%war&Cp01zCK->za6FjtcV>GE zUjtRvh80W4=X95i3u<&~33}K(0%vJCg8^am_I8Q(^E((1@}p>g;{{pi;{c9{ zz%ktJ)gq71&>~QuWAhP#ospe$`Fz;#kz-*#pAz6;B;eIz4qGPsRS-SnVYW-c!S5fx zisuAlvdcCRM$HuTuy6fSu_~7Fx!uLa$?zK3tq0N5W8G?eVo@(U0~u}nbTWEkf=v^= z%uUSXWIH$RSQ%f(AIe&Exuvr*hD(fY{?7N+>OMPuM5OOb)4V=&-TXdUEpq;6JNL7A zjh|PMM;CIR%`u&3x(V8Si|wj&{c#<7_?ZcJviM9c1Tj>LD)k?;PV5i`m#O#iDVuGu|g+^U7+c zc5b!YHyP^Sn197os8JqI3yPB3*Iy}(kWng@!W!)${hwkOP zfj4>Pd6CQ1!a_^0dWMWP6kvBOb8c-bu;XpS3Q*PnHTvfjmcB+Yhhz7K(2=}Lyv zlav3pgssu!(($8e;Ls0 zOII&!9b~-UArXm@4U+cpn@moXkIu@s`NkhCv2;F$PiJXtZM{$j=|eE+9GI!<%)0#0 zt)&*itjxysXSax&P{{arAIGt7sDpp~6g}yGCk9%cj0Q+A&$--tD-`yg!Z!XMbU{%C zb#NKA;~4oA#u32IG;kT`@^ClK&!_`Wu_b1tK^@y1LO-j8zqJQ=` z`2T6MTloLWXE(DpZX)Isb)nfH5pzgjvVf2rtg&(E)jKVnm2+F6YH(TUK#ird^O~*o zqYEtkPSzHjb5hTX+LIrlr;fGxrl?(@)LRBMx-4TOyOi4pc$4Z!=xLjk| zmJir@QDf<6qF!ySh{Tl4-pTgNSJ_xZ9@p5_Imx!MVC%#8pUrt%y@arv?Lm?^`9h72 z<4kTnQv_|%0*k|);qvt>EPYufuCCxA6_rHbazvF(!j;$9IpK(tg#8}0avw$~v|$O! zRg`+GCXz6j2(7XhJjYa3KD0_mM;`{1N@N{dAujfu zx&cahgQT(VBU$R;RqXo{Rqg3BRqg193lMVC=c?M-|FDFsW3w3@Il1g0#BT3r^@90u zWv%$)mdo6mQ_oKvO`Rb|YWijUsZG`VuBSnOaxOR0epZ?iT7%*_>%Q%A zvu8e6z@BR$pWBT8xm=B&t5l$_8T61G3@_DGoX zkprz=lc21eXbuW6<3v_pCWJ&)*i|QkQXJkuN`#C8~JN!&ldrF#;ygwiAeIgD%&@rJd@>IU| zo0;>6b{w1L`gKQcT~lEGP*79{y$kHQ`sbnbiBGBWhJdoO)0g(MxsZ?1Ga?~5EKNz; zG~)~5Sibh3^DR9!eQEz05s4I~-jPIA``Hm$V|2s%OG6!u%yelOYkMkMU;2ddd8z`+ z_?lF>xV|}E3G>&BGy2)7_`LZDRnk0;vM<@p`bku^`vYjL5~1*V%B6b!2ws zj5{0u`_Q_T->-K(c@PX=cn!=DmiGcS`c*3pU++^8(e!+S+@8D(R;A;mSioYrqAiS%6ac zw$Pf&gW_b*{X#49puEI$xd^=P$_k;im+>=|#4Ma|>E8xCcVzbd$1YHvOtNE53GyWv zCdR|?{sJvKgUf6WaHgn|PE@rAWt1_zEnIHtj3!TKcmzh1$GHBvD9QCXnK<4%{OCzZ zMM=iPJ+s)3^TX;heh(J)4rlVd1{ZCPE?jQwo7z&8kLRH;jb~(@rJuJlGS*84+W%P8 zo7y08zOH;4dQP8#ksevnpMC}=JD1WYV6ZVW7*qz(x>tZQH~~E>MqlG?RCu&^SR2!; zj5NpVK!}|c0U@*BJ?hckvZ%N6>-N2Qxs0Av0%pLXuXDICT=)xv3o$E6;Hdf+s-&uk z`P({6|B%(Iux01-x#&4gskgF2;O_?t?YL|lq#&P@3MWoo|vtE^z;ZQXT0PR0m_JogHuJ6 z9eRiuO;45ZbI#V~NlEk+YTsl1F<$7=h34=FU%HbLp+pw&J2mr=h@i0w(>{;v8 zPDsL7YyoZq(amKOPcr6^wX5dYxu9`KSQd+l{LG9+CY*0*SyR#DfEIy}yH#|4-bE?f zA9n_S=+)LPvh-oeleF)+Y`^alb^BhLu-x*VsC%_Vi~ zEAId1+xD4^|GK1y{@qJQ0FOstd!dK7x%5^`PhFt91et`lU7)2N8QN+GG#+pIJXKO6 zF?t1O`Pdj-3v4?Y2-xKZ!rhm6!e^Zyp(mB4M!Bt;NQ{^>zx?7H^GRzg4~il)UbY}f z7ua$W;~SamHg+%SccOLML@0Y_6Qg9J$6fz*(mGHGWu^$FekN({^+0)BfKneIt$~U5 zepX*>m$Ut>p6$sldq1m}No%UWj%(Rl!0B=)Qj@h)Q9E87gTWsca(y3%@t^;H#w0kQ zd=;$sp0xe9*}lbK%`Kqxte0Is#d<-APV!Hl#!6n_o z7sjOEi~an`tIe;q^j&A@Zk_EDT;DE)f{WCsAMM8j#f;}vd0g3H#n#pCb2GRglyVT` z^1HYlNl3cY(l5?sCTUgA+PD@F19RS6K7UqB`1+gyTMx5q^Fmvn=gB9=K%QN8_aeKj zFrW2b7#j1BaLwoXUPHyqIShwb*)^H6*qQ8d4o|iYRPIaBEFKS3t+u%TDtrDNYxf*2 z9S;MvUG8Rl92?_BILw=@9lYJr|3ImCuY>JZ1$^Dvxpn4p^z5h9yRXES$6lzm^xjcg zdTFgDYoAl<6+DE;wk*lF<;C|`SiDS}!R=MdW0II;zeDt2)RiDW%y$-D(#7mwWO*;e zW+uj%zdMh?Yx^?0_lTbOJ9f-Yqem>PVSNPyfAsPEPcz>00Yc81b&)>6_M=)O!nhds zBquVfA&;2#K%B`0u^eKE=pOuNKKEPVab%wYlvs$ERZ!h~BbMG-Wc#~py$`Lw1C-sO zr{;9Yd%hx+=XlsWOaAC<%p+z`30w_D#Na;XMKG$~Zm0+Z5Q;fq3{mQ(8>YRxEt3!X zL>;)lOJRVRWBcoP`#-M3`GdswRYBsml$;-6&x|Hsr?#$AknQ(ZDb-WuFnSmLYgB~l zPKmv%J`xd!`+HGj_pVY!vUVT`O5o}zq9st>0f+s2ApX7RfNcN1cY>|AVDQ{ZslJbW zHvwg1eLlzfcnC&nF)`8)5rfHek~4EhCaO`h+O26BKNkiU+63cILRO)@^FJu`1O zQR~k~t5b$zRu^S*2!y|oLx9yu3u^QmY}^}Qq$Gq?5v4a~Lp#^#(u$xCrZ%v76!H9k zsU~7{eQ)#NxoV#_Dhdgo6RxSS=f2I(7pfP@sFk4(esmjJ_e)T^p}NP`H1&sSb2_*2 zv2~J|1tmO>?HNL7Uq(-|Rh$}+S@a^D=ToW^O3Nw^bX0VAk}bBszc2ZJBbMG4FRyst z0d2IpDEvO9-l>_mz^rZ+)aao(Fv}>_56$5*6-9ffE3!n{4*-05{6tBug z*6XtIi6n;hK#aFs#&hntj+|US#CXLLpyqV7sEy^T8_3B{M0&SA_qRDPKVA*vNF~f) z%(wKv%^}?O>PRIqKVD6YhWMr2%=`|Bk;=S)u1#rwnP9%S=adOJGSZ-I%7( z)5`%7aa{;jN-0{=3g8moLs& z7imYT-P(sJ{&B#eMpJPZf$4ZRbrVdsHo;ft86t%E{aLo3>#zs|fxW)8!}efeU!nt*`Z2qxqTfxSLPe>^t(x~uvHh&5I1SM~obBs~F>(_-7sVtSTfD8Yzf(XwPN`Dz>O3O? zA^yT)svKo7$Q2Tpxz86D#N4AIjNt9W0E8O9EVn-KF;xNw0txX2!t)Qzl%TW#Wd%^9 zA+{cii4h6z^Q{)eTt9N+w*t!Ic7I(e&f(X};QgzUR9Tk|?fY!(dBj{I!}VzqgEL$V z&W-yUE2;uQDCNMcA5-d0iYR66E|v;%>jlJ{(~M4*hjSl}Re=4STtBpz=in~L-P;mi zGJi;r(fY9r?ytl6jE3!7eJ5VuvT~&)vE`xuUkA7krS@XWRsDxEwlgV741IN;v}xM-JPo+U<^`+*n7!iY zoRgA}yni+^8uI4NIwgsr$4ZD9yM-8C*(hx&vGWWxlz{s(GT#4jcGlm*Yq&NuhHGJT38QlwL&SK~&T(1GzHgWccTs_%t9v&&qSEsnJ^!7 z+qsuwje^#?8$Il7XXAMG0@Ve_({2GmZe_ss;Sk^392Lk9qb2BFwJq@SD#+rL*kTwA zXJ4$f^;oeIZj1YsHb!v&VDJ~2aft4oK|o9tNHF)UCtJRi10$9P^V=atXCAH>7q~60 zaCBcrFa9K;bctfZ58>!JP6wW3bCu2KvN3;cfu$#xahoc4%C>*re4=iLZU4MZ=u1t{ z@M4+!w5mmkDD}fkO-7IELK)CKxPi^X3p4emprx*Yneq~o&f&S?wA9rwQ_l-Lwsq<% zV%8Gd)^qIxwy^d%-#!^Vog$6~xc!nRdBp{)voWoP>i(SZx$Ij%Oa<_y{Ol|) zNU--qlzKZIxSj}5(o#W)+mOulX{T?q^&AD6c2e^#{WD6vY+PO43wUmgn5`$;j1Hf+ zbeU~ipPl*sz4?}YLpG0t=1%k62$5M0B5KleV07gXbG3+?;6Nb3zGZSDTQfE$p2vaB zAydx%9lXR0pdeA7u~%Sg%zkI{K2B^KXT}RLnL0g(@SN<05Nhmi3X=kx>vUowpBNw9 z!S5Z9?iHXA+dsx&-w7b?WKn|0@Z)*~KzZ*xEncS$(L z`M?jpXzQ&4%Ij5}*LZe&#>Sh$eN4wgCC9s|0+_0VW0qvwc@Jl2&Ehskd&c}P1dUFD zxwq2NA);)gfSBnKXos$2dj;o@+)hgMfPk{p)vED_+bumc$+pi=PaTr@A`k!?Wjq>su04mTpPJOidytl^ojG{dU1<=d-JU-DCIGu?XH>-CaL=_k2q~ zYsVi7l^NNY>Gcd`vx34C|NYz36Sdv0rWO`z3y$?4*tArzS#|2Ky!F=$z z!7!TW>;bFU5g8h{ecuvRE0e1dRj#o{D0*5;I#O;>eaE%%TfhGX$Lcorv+$Gs# zgcWU;753kfmq0LqFd zpiGsB!RXnKf_M|R@hOfAn}6tId`t<{=s5|=NMOjv`u0nRznu-`4iv@%PzPT)N0siC z75&3aS=v~f99l0JoL^>h%Z74jgH!9?%y3jrru}O4@En+LMlAi1gyi8l#AJ0jUaf2B z9{@_xv3_V_bFBY}4A-LOK!4YYt9UNMN=b+xv8b{sXG((g{SQgf&PfOz-QdtBK#k@@ zjpk+i={#(|Zh}b*1cTl!7<33`r&t_cDzW{d%Ge{KRh3}KQ>xacnz+6u36P&7zw5b| zDD~a|b?{Y6y~xMA#o4IcMX9%IZLFX1sfXNlj_636zwQl6y&D-%137n|6NxSv#$HOj zEe_Nk0Wm(UmbI4Yzx5r-M=6tIKWoa;diIwlc${6p(=PgIo|K3YoBpBCFCbnbK*^JQ zHGs3GQpk(X(*D)=PboVY&W5W}m>h4;g+ipsxlATybWtxA#Tov8DEewx`NPvc^r<;8 z0$Ff<5{H3LJBI#t6U-x>Fb>Ue_6=X{o|XRbguc&S&FMQ@5A&bPEd9`&MSXb$TKdPg z_8qM!=6?t<|8^5Gzu6uf{p{7neV@dMaio(N!&gUVRf#BVy-Y}K7K!mM)Bo&yB@4B$ z2x3mS8m{ZR>qlR?;-K&6|L7Q+<0r4)F6Gx8mhzHcb6=JiZV&c*r?tI0r)Bo&e`LYD zEC7wIX^$J)G07Kt&cS%ef_UN#Ra6k;k%?-Q@hj|%8d*n-jhxn{c!|vLQ*Qk%d#mrW zo8fYFkXK`3evM};+^y3Gd}PK!pC1$AZ}NMioX|2LCju;9CZnuWM(yVe{_Dw>*z|+G z>(;JeG+Eo_z`KB$sOr~Pv0i>Fd8;JP` zkchR#+CDQ$_i$BhcXN9~ zKjTp|bn5zBKC~5f?3qF5SJ;hTeyXc(N;3H-%LX2)E11{n+zbnS~P+|lF`+U1aA;e@fRfO@! zOl+kw{hx6AqFIdh?-7NXJ)$T6I|&M#_Yc;SEhuJZdr?v#!Nk3{SUMZCh$o_~zX&`v zoe>z34zeYPqQtQ}d;9@mw4Cdumt3O-m)d>Ko0(4mwS# zmr6zNc8~c&X7qU{hXgG%-sG5#_IRBhw}0Cs^7DLH@+5_wB%J;>3}GfQ{*_W)0NmR| z82nD=+r+4b8f7vB|E5EzVDQ+8KSy}@+b}wvXeF0H>6{2| zk6)dIGU9|gG8OI!P;+ub(1J4td{TyIXJ;ep@0*nB>2-uZ7tV#7{T?K!O|N5p=kvZF z;J!!M#L~ivcG-HckRj({R9zG9T2h+!@<~b5P6#+%=~Y9ms!j6(gI)-OLKVU7N?f>P#>4Y0 z+lu^Hb)8jDx4r|sFVZn5i>*Fd9kP~u3Oc>_{v|Vxv92xQ1u(*Xrt@6bFS9`SZs`1O zPR?D`;T6!60#0MhuC>@FSBv+wbl{#yN6YQd!=L5%U`8bD=5q6w$-R=^>bAymUgl4Vjp%YulYqn{jHhf1Ml^U--g0 zUxD@eoDWPz$Vbs1L~LGIfWnGSxp`4nxkj`ogF2j&D*Pk-j#+V{6>8}1v>6v2D2lYN ztE=dgnv+j4eMJs50Gkd2{c_EJ_# zQ`?tZGI=f0rI*Zjryu&s`D8zo`00J(hw#e?aGny>5b+m>OL8T?n1LaDDreyk!Mg$a zz^uoQ5ih2sQokx9M(-1E5l{USwO;@u`F762)P_5&&tI@>Eq7NfxzR^=kXqdG~$WG~FHseix1KL3rVHHmfm*Ff)Fmp0=O@%HMzAewgAS>S}^@)Q60st%S##JuV(-%`8O ziibLO*qK3Nc!4}D?mYI7Kul>1*S*JUSl(VueN23x#%v%x&1zbqF4#5dzx5HO z3+p2tJ|K^15?KdbsQPVL_-+edfUA+_M(_XOQU+%{XTOjaS-=eO{mx^xZ7p>*1&Hkr zB04BS+5Zh8s-80yf^lyUO+6e}C7+0^S1y@x;qwo7^jw201&IA)TexmCgDZNU`XO3= zQa>+WGUGjYOpmN!x({OGh*aVqS=Z7Lr2eYjD5JjVIl&cqoOD=8Bgyy@Y!0%B<0POQ`+wqLCu# z$(;VOa1ZnzD<_2BXGb(VnHdc-3L}~KW@Pw9T;5VAF89?PNSn(0rs+fH#vXE*xzdj)*|pvdchJ|N;K_I+CO z-UY)uAZne9((z;tYR^jW*O1)xFry?aYV_YNsG%uyMa@$Ho$qyRWID@54gdUgrh6UM z=W|lAU-)_h-;0BT>5pc|b&zZq621cK&L|+n_;Z^7*R4KGhqDaqFKww+|2@>3Pf|sfAKJb`Wm6EAJh9^w9XUMKIrQ6R()>ud28%*lItp(6#Wlq z@*?qW7H54Kob^HXX8QJK`sO&_%t#M5HEf37(8qMuFl*V1OlJkq+4D?qm;;^dMu6J8 zHbQ?e)A!fXJid(AVt+G}&x6Q zo#FwJbQo#}ikO~SFK9ui!~b?yI_`1c%zyyJ1$D~+&p%qO{pq%JT>TrhZ-+{tJh3<( zPwi)GM|N%v)kAFOu|=X)m-=5}<@Mls*;+Nef9ktrDukC`H)hTfpl&(8LD0t53!2N? z(=rGzFK6&Va|}<09?4r?9p?U<(AaV-bn@-qxg{MZUyj?pf*R@=H{%0N)U=c_BNAl# z2}$rX=8JjY9vuXflRE|S7cTD~((@kr?1g5E7;QC8<9Ak>&MNwDqCYxJ6<~? z2;I9pT$fCnwaKR%0)jlPs6GrHbBBk@i;_E<+#Gf9Mnu^$m%5DiY&Tk$y~_38Lp({yL$Z}V;G`1#B^3em$w_%W?G z<;O4ZdNz7W^7*rO4mgiJ=+ZvOyz?-%5t-qE&`x@*Pn;6V&QYMg#?8xcS1u3Nt?Wd! z`=Y534t#Abb@exhQQ@MgWMNoi&FwVJ8+GN{^|z(t?_at5o4ES!Z?;zQp25`4t)Yo~ z!dZVkSr6m>V)UsqQ42@+aCu`URuDbIrH$!$a=w-GxFo~dDh7s&==magm-`HfN~pu6 zl#~QN$JcA++H=d(@lulO zQc0q_p669Dx-v9*tlo-IU0Obj#XA%#($fpdxZpN@>#1^IJ@q5Wq8+J&LlMA!D-Djzhpo3WPR7m zVG*(9=V2uKnO-lU-AQ9U%XD_ptnHT&{mVzDlA6zqzAmQd|nd#zsw&h+x0xk0bAo#$WA7sDH((QW7BjKo(2y3Vs@DY;9vp#?7?Gp zuRSsFt4Q4;AmMeQC?L6=hvp1zOU6|Fx4_d$E6(Q!-2#;Uv~=bfYfbUB_(NJ#^O^DC zQ_x+nEv|bp2ZcnVpVRZ7GQD4v&%nXf`90oM|J)!9eo!%%~iz52O|{qkddElOyBx zd>Kk)RirMJQ&63fauOp_Fd&}x)Fm64AtL9<(~{^+N}_+|B~SD>IZ#A&hnAtD(FEF0 z9aYOrAnF~O9ZP-=#z-gI`V84m^O=F6#r$kn6rtpC8#-^aQp}tSHd^tk$H|99@#x?= zQ)yWhsY}xMKwxAMGa5P~9ltY8H@CNkW^;R+Wap{<(Ek)j$4~8N`ioMIv)}YYCkf!Z z^WtURsYsMc6){>P`-;%V$NLKI!qbS&yfO2I&Q z)uOs=tO~&s>||Rlm~uvgf_0v4LKxj(mlvz zbEfGgS#c?y%`=9Cpt8ZV6Z{PIga9QhGX0?);5ncxF);ki&szDSzMhrQU$4-T%hGYs zTn51F2tCw;!SHmZN9@cm(eV5H*qyy)?HPoFUzoJP{0dR4Fr?xik8#&fE76EEWuco#-_xS`hbZ%?ozLKyS5*!E0j*H^xn_GIe&Bzy= zbrmQAq()Srh}P@?`6G^@GC1Iz4>TsFDTya;v+ji^W2C=}oqH>X%J#lhQ8@5;*Ve~x zOUDIO4Si_YJj31Vyd5OV_Ge=g7cqn1+a(*;rVe{C@WF=L((w{NzbGM50yVUm=L9NG zd?WM!>zV&gXZ~;G@sw)F#`87W2jLtlt0Ubx<5=0aRO-JVmHN+0rGCs9DkHz*oK#fp zmC-aMxxXm+U29)9?14^vH%me+d8~2lI52wfPAFlIbyn~$-^(aZyi*V3?G4b|O*8&Z zJu}|k!1QD*(^GMReX7$S84e+j?|FT-qB*re)$emIsrC+eW5QV1u~a<_bzQilq0`yy z>qL2E2K0K!?VIdSA|B`hxUO5;nW3)ob)>$l>d6_wfDiVkecqvM5O@uV z#(_CQWxVepbr^REF9^E>+Ws;`zwU!l$zyZ6Lo3In=nZqOz%oa$V4=B;Y=D01S?CK* zGfrcTY+(ASXPN%R@+H;FJG-`ef8WyaN~g2Aw-e>}&4AtyTYI%1%6%T_CxJ$|dYwEb zaxsc}WYOtuo6~X9G~Hyc_Cjdnc@bQ!@jjnHll=j?eT3=G(7mJrv+dI3qb|3P_ z)VIPNJ)O?xU?<93WD%j}pWFcbooAuH_X6}(GmJlfANujM8BaAcVF?>x)&_g-N7pTE!aFU?p|ef=v{G4Jp1>kuECh=ZK=!?jQd#-KpB?s1A4TpyCr z6c(^{sVqB>%eeW#MU%%-+PuFkQ(xb@8N1KDq}nmob&U9V`!)Rh z-dqc(Db6F^P9ZaIb=91XN?CLsk`e7De*i*LigZLiqF=E?S=uQSGoa`R8BN9T%v)K5 z==W}hg1gn>mdan22}8ak;mTi@d4X8315K(Ov0?{ap9wYeu4MD)PN2z4S(D zqrQ0U8`09qBGloN>q!Sqjiu&;*V-pIv-c}Ww)M)0Ci8gRoza~aO@+rlJ3B=pbkp34uN)I-&^BRRq?W)S zI=uS=^zt;%Q_9x^(cs+|m`?a+kPH6>9a{!bTBHtnV?>Xyld=_f_T)t^;)*h@%bS z1UzTt{GAhUy#2goGmm8Cz7OJM9P?bM85|punD|QCbd%gW1-bDMo#UrMwM3t4yXA|}T85gVb*~C{ z?BH@($jBhM{Q;XLgUA*oxlS_qVL=V~Ts_Y2Ro)J-poaDyRLh8mQk-`z-sbn%w^}iq zhyP-7-ri{vOlaH%GzMM4MuLatLNMJXLm?QvVYc>KU63nJoP#9`yz;bmzm_IZMU7K02Q&C5-MIRa zr4#>XUQGv@GmU)}9mq${v?pA8H?y@nu7W{szfJfA7&c?AHP;INxCDQeHzv;cN}EzY z>A-V*K0@Oz2z)-Iqpsx(;@{vUOYhNqn9SB*E2GJN{FvSoGI~#*sP{y!_kwBDy(^>F zY21bahxQJ=BdQ^4Pjj^iYABH5eTN`6o+6wrMiI${FU^puL+LDhnSK_di0n{$cWv5q zU#q`q4HjIoWOYPZQqA>Wr_fA%OupwvK%u!)|B-U&&2q7SmyD+U1&D6HWGXFRt!Tav zYG`ZGRPE8rYf@-Dlo@-MjKUxsep;8`NSp5N-&-~*$yt&EcV34+52lVD_?@Yc-#Hai zWBb!qeBZyOvwJF2KVh%Ix`TH@LgF1s^dp}c9#%Q}o($!_xjY^@)DO|(c?UDX1w4LF z2W&@9N}`|IVsq~{;**mS`~xyxuLRka_9Mq(8*K%Yh|AjZZE-L|kfD7M%(zvCcE1D0 zKwG$Opslhl?Be@Mquzr4Z6x=%r%fd+HwGwzq6+4Et@GShdqwbr$IWv3)VmkL<*Ot7{0cRHI7b=u00LvGKt zLy^!OYK5)Q4(K~w8=NzMwHu%gx7<}30Sr+MJ>cy{EJ5SZ{}?*-^o&t0BfJ+gdtok2#xn zb&BQt$)2)9u>txQ1+g*cdcqkb-W0Hw=DKm*R9azgY=!Kk@d+pNy%+XIsQ}fxT%T#2 z39Pko+}PTe{~g>AUhebCPFaR-cd_ajGFxle(Na0t&<_YClc8I3S!xV+b{-2B$Xctb z*EvJRTEfW^K@I)HG~J{pT3t)HuCTjMZTG4n-lo8zEfKAHFCh$7CMk4O zp!%?Bx+e`ldtX9gdm%H@*LlVUa;-Sx_W(uJth(quk1@TwLDZ7cq(rl6#;;56FDgQJ z=tiiaow>}QcU6JuT@d)5ZuchQA#wCDpa{wRMYI+-HCT6f#sJq7&oI6B|3_>2I*upu zkyQb@n#+t?GPEZr!RWCu9c__1ctxjbgWdxv@7tZ7$9f^uLtR0brL@Tg&M+q~6GG71AB!0&# z^pe1gWxyUh&{Fs0rckvksG%UFr-`;f@1bp|dWF|Z6o=Fh=I(gGK6kOUzZB6qb_=F% zf%MpQoELrfmNs__(7Puwqc@isGi7K`WZ>y;i`4nNqO;ou{fR{$ zvwD?u!6p$(j{rR=3XP;keTz|aplx=CXIzR7j+;tEhPFKy1|FDEH(CViB6YzI zPqWR->k4vMPf4Pmo_!L`n{t`qm!Um92}ZAt>AnXDW|_mh9dMq4EzgG>C&B#mOjdpU zSl6)w9g&Wuj}iY1<^9Ozy0BM(zEmVVHapMf>doNbdX9tlE}F{z3|zMha$~h1Uxw># zDaZfxOjLhlnr^WaO+r4JJaZ8B&h05vpMkFM+vpb#5r#j_w6H{NK9N8za0E?{zMV8+-aOrav{6RTJ#u0}phZ;BbrOU9h)T3t6~H=5KI{4^(%M-X}Rs zGXIcix=%rBJOrunsi~+YSxRjPo`b$$mIaaL?0F3OS<`eg7n*3^e~UI7a+y&jL+j1R zgUAGV&|_oO{GM5-z~SQcoIAVof)F?ygl}4NK^cV&o!w3v=fJqBJgJpyzAslala2HD z#{PSJLHw|c%c7PJ8e`*QOrOXbS8!zU2FW6xi>Scz(;qX*_OobBG$z_p8=C6@-%yzk z4nE(reC_2lwjzhGyOljQ3? zD6j3pb?t{`D7}+d^$9e?9BbOh~^iOi&$*c?*kk``seyaPr>H@%} zPGSbx1~gyd2|2?P;kIy{;1xJchBJ12E7`)6P))We&5`CSOq}O4(7Sy%Xe2lO`H~qg zGfnpf!r#56%_Kt!kN0PE>V~$~x=5z~*Euc7p0Qt{#lYXDMOH6Qq{WkktXep_bnV6` znEs0i{E~YOzX(U=wNE_({gmYJ|D4+_7Oy;+;T8H_-Nf{bo1nid!B4Wg$JQ`-*)Fj0 z7zu5|Bp3~CJYN8}3EsbCy2;L53e$ znHi_NuWUPnoP=G5VH4^WJ^|F;2h=1p_O3^^V!rwp#x{WhbK5X;YywJYH*@ zi8eOPVLX%H-2;Bsu6uSP;2D<(J>#}P&$xZiGoCZ(8FvhN#&ZWfy?KN5KKTYc5_Xdv zx8$BBMz$ttQmXQQ{W~A8VR}|VVupha!oiFNfY*d;3G#D+SW6H_OC{5J-O|dd>z4AG zA?vLeZsFIr5ANt;gKI>A-_7k3F}h}px=kGsHS#~UTlwW<*%&U7-&qr{is7n6am)je z$8e2E#fjVITluWJS6KJ%2JA4@yZIeBUdOXb6hSmYz`NRofAXgjh$IAe70mM6EZ1V+0>W&}5@+q@Dp_KV`^-Yq@be2`Uk)D^1dvh8F2Sjij-v%h&>tOiYmT!lG{%u|-4E4!| z!5+Ki6LwFe$=oY_Ztz)szDIpJnc>ZWp%&3QB{8)KhHB4zw!=6`{3-JMz*>(ThPN$T zH*_OvJe^Whe!gLyPlO_P)lk>t(qPx)@?hixto4iwQL-^R7Qpxyey^yYIlS89|L`j7 z{3!fY=w0s!ffr5F9T{l|2!gdHuZmY)zw~nb7wYo?35rlq&>UH9-MNjdg6svFb`)@MITzIV{59 z^U8z%sA;-+{m_f1@}Hjoe`Gbk|Li1~SO%t5f1{msM_J%)!vxgSOO{X7Ca{8gr($h4D4US`^PR4MxIN2Vf?J-HjvwnuZLS^Xw7A8RzHC-P?$_s~{c8#w`huVhuvgt0IAzOj)6Uh?>34c)VdX<90F36(|%ooGl?rq^B zE2b6Mwil z9VZ&J5UwOR>mjypcR&d*@y3YHMsn2QAaG%usnIt+1XB&^33eh2p`=liL>sjUK4m*?}gvK3{Z_*ElLX2=)d2>4M zdzKA)-OL~#w}E6k$-}1`2G@b>tXRtw(tiSn@t}=hEaNar29Kjp?7G>KhkSi!WMU=C z8kqzx7h6_C?~zeUa~gQdtPO8rdYJy(neKhdti5(EbghDZU)prn--YOFydDfQwsV@7 zbJ_Y^vdt7U{miQK$z?V9=-qZ0`zPO|-(i~W2mVUyvMhF7#OT*d(|!1YsRTKl#8I*x zv-LjMf165o5950Tsn;yL5x(nz_SV0eN-%A@5C6tgDpA7UU6nT7@BQbM@9WdneXfDD zl^Y?eQ@t|dcZ7c=V)vV0n5JcQ>pl^?&wt?1N*7Jj(&gYe(8D6rJynRlOLAdFxP#|W ze#y$C{9GlpM}wkvk5wO(-%;C;XXVh^bcx4(`aLqD12dpx<3V4)WX5xN?pEvjA1_(F zA_(BQ3@6^(n;5^JjTbx!by(-nMS&EX*QuAaO>mZ^`Cg>PpDKCfXakrm8%ctqs&CqygP@9U8jFuE_9 z@zxd0*uJWDAI&>*!BpDb2?iL!bvF!83HzYof~maZn7g25hp1&^8RuF#N~5VUlh=s} zm%(@~r|zmYvomcDoX@nG4kLUwzb}8JUdEZ+^QICJ5hLByayJZLG8m}uMfAWqQ)v;! znBagGxf@0>84RqH5f#pvN*9Dt_7S}&#E=h-=J@azg4Vk)BKj`ZJ1FvX3eCP7PzVPK zN&jsB0@DXpSo`~JUMmK0yC25(`>mY#WOrTya#O=d+j|2{OHP7Bhxch3m*pjLhSA5M%V2-`QHg z3_((Pevy{dOy~FedIW7`+>CQO=0;x2NDJSXiRTuf6O102eb6968MyL{=bwNC<>2k% zI+Bwfi0vCBC|!2wrGSfgDJ&vJ{DfpM5I$+vZYR0+G~;{ALrGKV5t%U~W9N`xcwoe= z<>SwSF_Ot+Lj3#9@hft~ciggPeAL%Bs4rb;0oW)jE;3Y#wQlO9Y*+8W`zG>?#fdzcp(k_9X%07t&V;j+sg=)X>JX>D~)9^kmw~XWyGP-QR>7 z>PegK2+v{h&(rbvU^Y z2A)@ke}7XZwqL*=F5mso@#klThi^*9hcfw5n`_c>@@b7$L32YLuHpIHZ{@nA!NzmN z@)&ecRfnTXt$4&dna3mYJKAojTYmh1((z&edmj2i&`_r^w5Nc6Bb6fm|rc+;m(}2SOef4B=kr4Hz00=8{Ykxo-Z$MKk^;uld}tP8~ND zbh53cWFJh;XGXsr(UfS_4JNyE$Erx3D4>P`HL3Y9R(>c&Qx~ip+OJ+T!b zu{1Wq>rGBc=z}JyQm+)C@k9cC<-77xoVQzN_F6(R!4qm&(CQshRpSv~~t~UVB$!YNnqNcYj&hNw^UG**%cT zOf7P2zs9<2PksFm*lV>dPGsAXPN)8;?;SU%d2O~eA~VP*&A0aqw@5f`w%%~$@*VyO z{qg(yZU>J^oiAW-OXd!H(!HGjcDcr;3}ydK={SwWYZZV6d_=3AJb&tNN;#xax))`n3anq`PQM9-O2O?^u$KC)=T``Ka;i6L{?kh&YN0zxKxBbUf^52FXU> zi_Gxki=_+6DHg2wX|wF+9&2_xAo zXvv&R?kows?^DMF?VUA(_VzCX?c@&y?ZgH_8`&yozI&!?$%}$!z90qOn46A!=2*2g zc>nKC*M86MBQaf_2Yye|BjaWUD9Nu`_b4xaUjts(O!Y%gu3@@*BlP5>OjoDFNVYSb z{Gnts(=iuC$!05u9La`nemWf=X;yWf``ym;ZV|?V$IwUiakf6=0j}4OsH|XhD}RRQ zkZCI7o9H9FrJ7YsPx@hWXL132*5KrOY$c#ekg+m3~AvFx&O@~uT? zT$q=RKOAI6$t3J0{W?^Hy(AYF04{YN)BEk2ocwbbuN%$xzvi+n1Q+pH>!+={13hHp z5gc|HpFV~@vg!D^nK||o9#&d*&Og|os1x#jACRFW2_6;N|M_&LM*WwV{+!5+fjsb- z;ep8(UI&USd=E^q@I6pQ{_d2-9rLW(wgao7owKst26UrZNOvecay#1{(QnA~sy`AA>OFAFgiaV4ot@nO;i|>YxW5Eix#Ro9~NC`kl zknN&YT6-j3)W1o3pX}~PCigKti%hrjvC-#iaYOWYK0}Y^=B4BPk7MwS%zdYSf6t76 z$nPjIBOK&7zq7v*MmC4kK#|IMjo?eJwlF&z%r7;$M-e z!{&PE&B2VlC0gs33E1PE$iMXsSM%>YDA(V}^Sp8Sx^_{T^Nk0N=s+g#bxJDXv0uJU zwsrhd>A32^-fXS7FWS)u2Wq?gF#d~deUdTDmIVNZC6`Y$1OUO$_Z39&To*&6gTG+a zbhP@n=3f;gTg-7LY?{ikO#Ykj7p%OQN68Oa$c(NpKtF%Vrjd=1A4tcOz}{{Vr+JR! z(n@Uy)Zx$Fl#a6tX06++hQ=hfpKy3!m6i9mR1%!$dwfpMUE-ODX)0>*C;SEn|LvpZ zrGeypnb(Q_l4-_0C~cPuKDRCjShkMWt4Sp9==1MA+Kv2f__Ba1qGoK_GG5;}IXg$Y z$28;gncv^Y$)Jai2AetFCJ>1+$&PSCUNN*H6yasuQp zmgJ(AWNL|B4Y{F)yt&wu%DFYb?|T3>$sD^T$m+1~|D@w;o@JM(p1L)_e|yUMt&Dz~ z3|{LxDaqPA(~Of0;NOo)+Ku$R2)yoc@`sY~=37Ek zoebrD3CjL?LiEe@|L2H)MS`;ZAe!nQMARWc84|D?ELX!lk*oH<2sb}Ih^Fv)(;EN0 zsU$zQG>|-J)+9eCYu)+k@LP-1agskTa~U}$@gIxR@jscSd;ba{8g^SWO-Utw{LH7# zyCogxx(0>wNCy#&c1~+%B<nfQbm4*EZt8TOmg@mZN#o&W#3bR34c$AYnF-VpgG^Ju;Ig=j7REb|>G zo~LI&%f<74bose!-VaUF{m(_rNZ!d_u9q;{mJg-Q%qe_9#Ocz{yNk|CQ~k(6;hl@E z+RRydhWv!}9-p@8b@Uxy6{xf3T^bvcrX;vL`Gue*=fn81NInqZp)?T`)X?oq)A92n z8U?uh5n*g0`IKDdW$QfN16~i!Si}sU!~*pyqLZ(S6_Cblh7GZ4ud}^Q^pVDXE;dJGn3&AG%=f zA%6HbYIi-fo2lIb7$nc={g>vZ<769o#_P{)%FgHB0_`tpzMrX0U7V?ZJP$_JR{HSh z$7%X#+H})6eG~e7>5|EF3p%oWEP(Ofe10W2n9-gJ((_pL{_042Q7 zz3JPwe)MZ|4~@Ckj@Pqt`nN~XcOheE>^#Nmz#EUu&FbgBl@ljVv(Dz3@#E{$ZgYe9 zde%P(OE~(`dWqlF6DHK{437}b1#Q_)>G(r=%;*!ax7E+|4`+xPt%;zB%?AW^IC$?I zE${kFU9UPsZ_AviJUp2h-=sBhBh#nel38Q(n4UZ#Xj=}UFGB0@I$o<+KOvPQQpK5k zXv>(Mazalvl5PUGwNJfpTQ%YAz9MEEl2Q2f=a`NgDz#m^rxm{7PseHPc3U#wG)`7( z&-v4FCa9qSqIdSb;GG}OeR{_Y={UD()-M?}H;9+>@u5f^-nJ;S*O99Z#}}pJ;VC57 zu^ZlnT6j9It$P%wt@_6N`OyVh*q;4-J>S0r)GgspTQ*lV_TbNw;GbLo?enX@~N28}&2Ee_V35&#^<85!cwn3x0tQ2xb zmz$>Yo@7gWV47|-AJLZtD7mSXb=5+SKR4y6%Y{1puWb+1O?sfZuG$98Bj)lvRE~z( zv0ZF->_6$f<%s6mpuGerf5}JFB!T9Xn>b^d?!PQYlSe>cjt$!WOA?PA_>_RapH0*K zua~5z_asNcbH-CQW}5E91uXDtp@okypd2oNM)Ll!iv?aSneconG?Mp+OIhI6sS}=0 z1K;P6anulk5~Iqlm&G?iDYpw$c3x#(ZO0<#4A&E7sF zK_NO!vOzNoS#*wU(P4itqRS;HyBuiB0bKN-+HiUmvgk%+=!Nomq_f{CWKFMjI-5^n zTG1}#_;;aVo{i&YQsS2`qNlytHWPK$> zWt}_H_@`j=pF+jFoD5!fRnfDGc|_A)<5JUKq@09#+Ee!(qQSVt&$)I92+;FCW%5sw z50lNUNwSL9)i35YM6_ClQe>L(`@r;GQI0VYHJ*J^v|EOzZdNXIOHjn6C=6Dhs0RqF z33`v5l;Gbh7RSiW-?^%#Zbn;WU6AKB6gmG?L5_JvHKYP-`yB}M=0od+>j;mZDrUwj zqLsfZ>&GOeV*g1=Or*#^$hTncPOhvIAo#nJp1PDIC&*{>EC=T?F&|Cj6Nt;v)DHws zNJ4_wkQldkum#|?MuOu~Q~ha+|NdvPY2*LBY`WwBW3s94|0S}i?tf*||H`KSl}(={ zo9+kG-6%)Y%E0-dgTLxw6QZ(_JQ2B`d#tr2-6>|j+fnN`KQNoFiY^fen4Rb~NSMevx<;f*yw zIO3DNukVL2$~HG#sIGtlK|JDdAX;4jMRh={0t+k!0>OM}RWb`KO?v8l4i;!Q?WvQK zE9-h?tR8Sd5d`r_KZN$S$xu?jktbyo9*5BWZYj-?1sZ@rzl`YiLMV0_8qp^y*%Pvh z)tSKPavPK&Y>h)ui)I2Y-?&sr@b{6QEJLdwM|7hMrM?qUhXcwi2Ua%-P)wkGs04}( z7C1QxHOI$uZeCsjrMCk7{X>wQxdiiFCC${vht*r)fL8s*vgWGXrOv9Ms@PJo@3hv(tb!}BCns6>6(kFG9!J=jg%}O3-}!VH@r71}_BjEgBwn&|HP~+>0ishYGdmfN8o9W$1B&=CK%2$A_kJKxTp7 zir_KotJ~o_(f}cr<)y>98D5eRJ0Nwv{_(*C#z8B%fLJ$$%(H{=>O}c>FzCH zufN6P)@+GYrs)XjkLTR{ngpeHv4t}qWaq4W6v~2lgx1`<=S}4#aHP6`@FKUj ziPpQcCS+O&MkYh6BSVd-zgx@gK zq6aeH|Apt_ur&@qExOM%-7OM!pKbox<=PJ)N$``LJSPc$UgyDM?ajfd4p-J$etAg& zbn^2U)KC!WuvfP2OG+jF3%^ERcn4dXYSls>;wu5lkZGRAU2g8@(OCS9(8I1eBTU+$ z{Af-(p4z$9dJmcR9<1W|&>EJuPnET; z^U3eV9>VXh7N+9|O!KtwbU+hi7{vw9C&sta=S=NOe%`BDu}j0}NiR69`V%+!(;1pt zwV?>#X=kQphuflMI1|G_x+zPOl$%{$PeX*#G$$Po7cre+Av&jCfcB-uR&GSXOX^Ox zwjQqbA!{G#C{V6_vzF)CEF!%f7NMWYoV{lCUUpujo2C5BnZkN;@Pv##ZUhJKhCB91 z5sWTO8LbqclGouU0@zLm>!3gG%k5)udO&{i+Z?l-t&9+YJ29l2ur zuc>#mU36WpcVyM~ElFHIo8D!Hr)@!9QgS7-c|fyshKuPJ7p3FGFJ9AB!1MZ7X>)3< z{aEWxg_t;On(;0XqrA>aZ91Oazlab$*8hAkbDpB{bDrz0a~@ukMk-GHYEC-t6~-1O z-Aq@3ny`eUKA!6@m*+%0vmhNOolbr6*p2J1j@_U!-=0llX757$XmE{$-5*NuhgWA~ zVg$anKa#}6#C@ye326HkrsGAoq~ilLpG8bRD+$^+ueV}H9x%;#vYzSZmO%edvho)X zi1lw`yz7{Q+SD`s>Far}J)QXT#|zW(HLI5y$vc@55hug~0Lss1TWiKzFTZ*zyMOej zv>6v=X6yj=K6^c{ITgBm_e4Sh1&qh||H`!LTR(ZdRhQs=Cf0#?ywWt|10wcNKm5$9 zfayW2{;{9l{b}aiN3XZeyXbj#ZAEwF&#J0=6M)@a6o{<_W-kXfgiHY=m}?;TFM-6 z4(lxGC{U$6Fh6^SXyKFoMkFB-0rm(`i^>+I-P!d|b0K^YF25<_=yM{D?!Bc-dvigR zM)(YiEa3T>RTF)U9oo3H2h8Km7R^h?!@!<3lcAl<)b69_Q|4IDiwnSGCb~q|XgC9h zaQb##5Ukv0ytc&YJT6NjqN@?ht2A59C*wKeM@*<6LUfn-8k!-X)(dN%B>x)tnO{`Q=790F=c zSI~PWGJW}6Gc{Dr)Q-=axQ?!ttzikf`Q4|J%M6-p$!p7a{Li)RAF?w;wL@E&*$*Zg zu1`daWMHL>)vW}gJH+Raajzn|qT@EjM+@BnABaa373l9Yr*-G88OBu5PqyPlwjlS+XfRMlsaT*kxPmCxh&oI$Ial%Yzb_apEQz61S&#ZTLN7Ja$k_{BZz% z=Oy?z5YN`k(!!4~yHX2IftIZWN6+c^%QeC>zh%!CT5D!$&x<(v$m7e5()}~Fu*?RH zMnN00V=ya^!bjQIo715UwP0+-Yu&TkIV&9>TJ=!ffQXt4lFNT_iJ+B04ZSUu`AY2ygIT0ny+uR*0$54 z)qL5zpg12z$zo<4txd<**ibvN23mL9rchoT&k3$GiPwybh9xNEtE!TfFKvMS7a-aq z;%I}2qYTxWufVNkcz-u`&(@Yy@fb_1?y>u7Jq-!U#hK~&{R8M5;dizG$3Qs0u-mtB z7OxS`Kff|d`)l^IJX;&hepY5{?{c~J*at0-3(XO3dv})wJJ^=(ZJR>>wJ;q&VcCPB zv+I9x*#<~{33^z<=D(F&lJni27T>MR$C<$#C|s`n9?@RxS<5R5o zG!CnGjy7$6I=(oc1&)jCgEFrg0#ie8+8d6okkqn;1<*c}D*Ppa8Y%)@D?4#!&<14& zn9ly~xez8os(IWY)v@XiY)&g&1_B5ylr5lD#lB5v)$fpPP)D zuvmIzYDTZ4^YN`aYpgRl(m(H*{h^hT)czYMl<= zcm22+z0C%t{(URYsShaH12v?;)p!u7ktG&*0%Fsy3KZ=hw{k`E_vP!gyXpP^k~r`B zWEAyf>V?<;Ec48PqK7i~E$cfo&+<{EKn>Bl^A(_|hGZUnt}1Kpb)ks-_@Hdf+qW1+ zE8%KCaM4tVPa4MS7k(&-ytX<0KSVhE64OV1A!x!^HigVJ(9Kb-{p*5s+&GK1{5Q#+ zNPT%z=qYQd1HpV2AU*Ge%JrQ`5jg#_?d!jXDA|LsKO17eTGE$E?mwuZJCC6+d#@ZrXcBl{ zShc9W3em%9Q_0#SYb0#uGJ3V;i(Vt2cl-9-pb0zB$1pIQ+5jzCY{f9X{u=sJU@xcP zeb;M8=ceOiJG%SPH&SfHF29;KEnma^alNs<%CbqhOuTF({g}_^LrF+v{h|}U5coZ| zk)49}vAny>GCq=k(==DyQ>oE>lZ#;ZT;S*W!`sn!PJ(~Uzb!M8iGRu`Oh8@Ys2uBvnq#I_kCyuR?YQNaP(SpH^h#;lPkTJy?R zHif)xn?ik}S~kLS@Vopp-mMGLal#kJ@v^INOzU)cRXYCk{LA$Vh6R~5MKbw(J&@0I zn^ulAw}_+v#MIFFKi#5@oe;E|woRei_j9}@jJ$!>7tH?9=fAQkbi&GK=}%?i@0<6d zFD#&zePvUqUqrk2qRIE8!|Ng);Z@ciW_@OyVOnGL%xEyp__zdratSj&ZJP0ZQ;Le4 zSFF3Nw>I9OeeLFS+yglpers_@-^(wQjbvi^ud*>NuPG~@Kg{bNf0xI>V}cErF3<4F zcPw6kR~`OL1}CcBvgMxmR672^w=6yx;kH&W;Vbm1*U(3N#eIkOZ_uQh((%hYpZ_WC zGdHK>=Vu7om}J$2p!Y|hK=;!jYX7b;9Zz1zj0ayN*PyGHB5KyyQP?#ZQJ+aX z*d5}2Ls-;CXIXWtRg5j*bbJ0&+V5!1N>dW_{&#)pI5W*!^2>NF#-XP}s|PF z`Z&#N&n{tlmx$>1E|^NTpRL3Xf*QJX)bd;A&L(|d%IiQ}H$NSJUYuT(9fy8jQJaqU zp(Q|v{l~)C|Haq4$461#`{SRP*<46MNOm{7n@wPM6GU9RAlYmZ zFU^zCb7Ij}UDnI7_Q!_U>LGrQ#(*G1G67m`V@O*KoI9*+dI)rz$t zp=hl=?j~yW(0U?-umfS{_xe1~YzW9Xf8>>&nP+C6c`l#(=l$seNc^b+4(hltl!sG@z}B-nx--!@Sc?t z^x(b7lbB7qqe&lLz->q|oSWtQnB8U#()}@@eGhQGc<)9leyg6ZtK(7$vuUFqWR`)R zb&;X;iY|t2mmCqO4_rq-1+HiHiooiqz&N)pXKcr7Ha6*-a&V1u+oH3=P?AfDCKPqC zSj6N~(2`9=YnEg?fRHBu^aP5opvflCWZ|jE`Wjp}PByHpe|tg zcRxfgXED^@!fQB=6^1f;kYm=f>p#7muDpon39#d#%V}f*e{R>NAFwgX4&ZSKdst4A&x*wZ2qRs*0U)~IQbT!Cg#KAShWL@Eub{}6PntU;NSpmUcd6$> zehJjodMXTMY|gG>?291Ek%B`IPyNqMyD37e07Cw#PmVbHy1Y1!a$!UIcok^sA&7r0 zLGUBV5ge0T>ga1ICzJ$t|LgZ7AJ>3(rpi!KGx-g(HNQU1V~~a-?G;>jkcOEr-?HrI<6(}5+1g4c4E7|Q5Upk14P5Q&Cn$dhxvOw(_z z;A5Pj$+(|ThRo0e<07WZhj7oa_uRRd-gCL(p1B86-#lkd&eJuS58_5E2Xl@*y!A@X zBatpTz6v_$gHAOt|4O=A6lg~;#MjvQy2d^P=JR>PW4^~q)N2AfuW_=H|6e0P{~^;< z`X-lYV1w{>5&BP<0&SnSgbqGg zOi5DkM!%sX%?73iHydUY`?$|EmBviY+l}Y>vt~n7#65}Y|DNx&@tdeJl$b~~$byis z0NVUn5WP2x)eUQtv$&06RA9EX9+JM620mDvu_^SxJxl22enWXkf}W=*mub7LXI>@3 zcq4Q^UU&Rr`azYU+;R2QbnyE>i8N1{{gCW?AdtM6ZU`HS_1!&zx0ldzzoCRBqTMP& zXr(AmKkMx(LwSqa8hQc~i|J_Qx9v*$A9FPx1PwOuMqC|utNIPiKZz%XouMr@+JYXoP zN}`X5aIjBwbU#vQC~(HC{?y8G`NFa@{f{+XXZbkCW@==)*aM6fe96{n(Sp$`Yn)bO z#>vUY>GdkQ@h4nnL!E~_*M#&!+gS+R^7>eMLK0P!WBNqs*-#0GU`s8HNuYP;kz;*1 z5M7yF{y>8uN5C&fDvM-qr?}x5%RecSy~u0QIlW#N^49x6V|(klDyGYgZ2&DM5&hyn zLi_~7R!-OK*x1B$E>T9g+N;h*Uf#m%d;d~`XrBa8{WX!6gFO6CtsS+u3lK`)M;N|( z5;$)B$!sW2N$%jsouFOoGn9`ziNlGuudd@RXTA+5LAvf_QABZFy&Q$1&tp2N*5$JrIDwW2m8bm!KtI0IgZ#c^lqWAl@!Q5Z@Cs@jZ^< zC#LC+qYSWu=w0W@0B`y;GC$@!H?U$m81oh>qY8(1JEX$CeLRt z$f33?4W&=y*lsiZO&Wl6DO+3r!PZvGj9mYWUo(b0=3>rc2D6Fgw?TDE67d=88srf+ zs27S;#?vPz;-+RhSDcNHRG2P%d|nrt%-?6VOD=ngk`=<$+4t> z?H$477|>t-2I7(p=*r8%ZpmOh@YN7KFwao30Gy=A$^l(S+5%G?hhi3h^8oj!^uSaV zZM@9l&lAfuB6z~Mzwle}8`&O(vwO4;AiB!W^ZOsU)KE@X`;g0EzkT*>EngwyW9yle z1T`@nq8WYl@K%zJ3LJlc?YmDywC~3dClZW2AV3;AK zYg(nD44yF){sQLPs>A0nJ@(TO{o#4fQbef3=dJr5Njm|09+aRb{;G=}8D7ME2{jBW zgXkYg9`%4ov@yxa{apa|^y@6&y)Cwtq!V_~jyV8&+8cdTd1roi9mo+U z$dOyYw#tr8IwHf_QyFd>dl5LQ)kR*i%9e>BJ^zW z*HHYAlq zW2WhrTPtc|>bj9e8_-jx>Ani&$mcWaw=%sXA9TmWGVK6B^>PtvtQZQ0C-HCd40pYS zPt-2t)>N4}HGV;kd=M~{Nz-(XKv7LQ06X_?z)-5pIpOi?*q}_z%9qzZ?%NBl^?PgR z>RnuxY8PcKV`q(vj&29Y!&m%)jh%|T0A;5|d~Q^f!IF!3JjRI%t~3104#o%6qz`nI zt^TKi)7IrXAda%vWF^s$h>++MxxX25q1XWrkCXt|k^VdHX-|i;U|_ORpsW_Y4*$$hgJ0tU5$j5qQ-dVd0r%k`J=0s)mr}52N z#yf74U_5Q{6LTI6M_TzKG~A z*&q=Y3zlpbeUT`T@OII+WbpYW7IPwXJiOigM}K!!zFgBM!u6?l{M`Y0MH=O5)R|`6 zxXzT6Ai72@wr`i#)g(otPh3p&ky$-qp10~$9YO9hFfU_zi2BrAL)pabS&zT_Yl!=2 zK{fXAfeJ&p0>C-V!yc=lzxNvooHj$vnb?k>2I%X4Ly=FJq2h&xGPt)%?-VY zr&Ftt~n0t!iOQZrVnz%$k!RYdbWl( zE;5u6=n2b^Tf@$!Yv}J58A`i2cS)BB!2^&RZik|96mr8cfDrrUbY~d97imnAVdyy+ z?^&>o)7NA+(Gx%K_4-8^z<2pTI65dm^kfD1TU1vV%1fr{#`}L|n(nDfcw7oz`|Txs z+)y{F201eLK$AZD!k6s^*UdAOFZ1FfZ0(3ZG(QlH09=p9gvo9%?#bBBC&xs#rcO$N z`pHs>`CdM*l;}s2OGTQ@Y$uXSo%Y4tmswM8Zdb|$YMKRm9@xq0Wb$rK_W($p3{VXs zj6;!&Chuk#B`n_<+ay~-&&VcTAlm*sa*XkFY(I4ky=Rf3+#(i*k>{la=>L%jgw7kI3m!pqmvH-d&T zAkMW{pYff0ZS_~E&aouw{AbJ%_v4hRoBf88!Obbdxo$za3j=sAB|+%AKd?OQAfCs2 zV*-RaC871}0{^B_sVoTNU!i+~hH~v6Af7y9hRSSk^XH6)^xLno!Of#Qu2k)UuE>Xf z|r5%rwVSk~7$H|Fw)K zi-J7-t8zn0zP~;_`Oa0$_AHAqex!oyY=a``v2TRB&9$Hhobv{(+qUZr?X&@iLPCZcbs#N)D~U1!WF5#)%+ z&+YfO1`MSx2a1tiqrUx)WdmV8y@k*g$lUHKYnOTk`mxBHttErpS+BIcHWylG}B&f!|=*K4CSL=5bgEjX6R$zEtlX}d}h`88u)S_n4+T(_ievZRyE9msD1_L9?7>v&xL`cRBG9>>ghZ` z=MNRH`MdoGW3@>ELcV>_)|CUe?&@IB!n2wWZJ%aCl;oa!?m9eIKLX@ z0f^RH_3T%GdpiDYl*LxM)fdW;&y}iv$=Qu`%3WqCC=+FB;0xgFHbvoRi(#_5^(=3| ziW`6Jj2Y!Ioo@BVWrl)dMkJ!c2{SPE(B`1UeG zv3!p`&>_%G3k{_z2NI~?_RWH5T!fzZZv^)Kmwn9Ni8Shqdrop($m5k+^l-K-AJ<&G z0*b%sH56ACgg&(MSe~)XM8kEOygQ3Ff=E+Y^6>j!W-q@|#_{SP+w1qi7oSd;QRi2o zIQD9&drWexn?&dr1bMg-a;V*BC~*<;eNOJHPR+@pPiM&yc_Y~#cyo1a{d3SZzo>D2 zg8)&%28WR6tX$PxyKGG&-3L&I z|8FQW6sC*5ajq^ZOAwt~&gJ^Dd4{qJY2g(_{|=*xZuOg28cN@US^aa=uSw@KztUjb!5L zC#>h$bGbf6-b*)R2CO4)H3_Y?<`EsK}he#>oO2_{?DeV$c9;cp;&H) zM|p*z95Xqd^@L@&zg>bMlrub?8C#;Lo{%IJ^_k2*$9`^@@lL43citYx^DmpGGH969 zABv8nT>?bED#6f}jwW3Oj)^M+k7YX7PR_@?S9Bar!Hj!s);%^J*PoI~xGix)qKhx) zy%hP-^5^#)mn1c2$=fa>592qV zkX-6hBJ?0Hs__H;kqA8~Z+mXbp>^A{DA?del)0JzaU1tPCN~Sz=V4eK{|>qGwXu#S z-PZwod>z6bUlHi1M53?HMfs~l{eLFI4Z zK&~A55kO)EkYknC$&oEI_? ztORO&u=ZFD$ioLjWk*tS2LqkL&iA~AB0JOJR14B?ckq7X6_Bn;{_-rYAH!2FB5e&0 zh+@C~3&2SvZr45l5G6VMcQgLZCv}4&gp!h1-JK&x?wL2ew-X)nnf_nLaeF*!p`w+8S8hT&Mbs0R1A2Ki<-R6%Bwq-1d7e|Ds;^6Vr72{LmKoU)p}>_dMq6 z1h$(GZCzG7r0=+f8k05}7|N#a8m6*xW0T(CXLaI&4Svu*#d{WB;GPK^4P2T{-!e=k zGbh9eL7eBm;60b}7{qh#DafLM*R$w<&b((n1X(>TmJ{{mzSmgaiT(dAKG(*ddvS@pTmhJ z(0_)Pr`~wGv(_LO;^zMlzTCvTZ*4&lekPdPG*RIev5=(~nY1iJn=v2eKi7@-H5Xc$^D~hj2V9i58o6 z50eQ~MKA!f7KiJh?MkBl_;FqHsCL!}l+k_K`Cm z@xKL;uMjPn?XSVUC$A=KebmGHW1HQ*I{>7EIM%&V$~~__%%`9f%-?FL)v+w)KK~+&Akqb z*8axA?CSyuGaY_@7X4s>p>&<@e4N`Ih3=^u;PrLVW>f_7P@`?|4skxLJB{nM!1~?- z(7V!e!cU9k2W7FG)xMaLO4Q$$8OkfB=|*|7L2@&BvYhEd$h*Dj2Fcx>TWTn$t3dCR zTt`_f!t_|V7)`j@8mj}7X4I?#eV61uc!%Wf-ZgFxoUS7JyJFcvkjlDEvHa-C$9L`U zf%oX9DKjd7yL*Ks9DRDqWU}xnl>1Nzv*u+`^wgm2DM*mO@qTiyp~Oy@H7p)$uAz`W zn>9|5Bh&N}?ytdi-^#?_Zadee*e5{rKq=>0E6NRpyld7V{m6U|e#<=TTbjqs=-Byw zfOGta!Bz=`gISZuU~*H50ABo zwB0W67~RZkDm05Q9=Il-PF@ZAe?7_VcOdo+_lj$ewTtqO0da9SeIwCd5};@8i?!6n zZEkfSKy}NDwUosbg8Vqrso8IG`$;aVRpDVe$KEoAAz0o1Vl92}opAR^HqjK(XWu23 z*?Y4~8P;S+HdLD;v|+zTb9#5643oc`WAL%{IFU>L^AeuphtEcOe zPCeth`;S8C?pq&A4+@ZYP=x*?OY$l5Z)StL;UfBm*TS-8_7|7>or?^G_2Zgc`d{3> zILw}H%cG^1UeAv2&tvrM1k2GZQBgiec>p9XM;!24{kXqLA63q^J;v-1y`x=Z4@cQ=(83QU2*_&25w7whGo39?PR1H;?sv5p|rU5yqztd{@rCLt4-4lQw<}5sfH2c>yp)vuMq$SFp*;F$ z7oR_?UiSs)&d79JYElx^ib04!>Nb>@+&mt2WTD}1WI28PdnP3DoLHBWlAwNxCUtU} zgz`J1H;3~nTw~e%dW1Hl6KQv^*OLRq|M>*B;d><6D?i_)mw>FvFE;5X3QM}nfavn7 zCcPX8-$(uV3}f;)BGGlJOg$-;tEVK~Q(kp4Xq?Rfki2T=d_(!#?;x(D4Cvx9YN;`S z4qaj>$ts@T`%`W=Qo9x!%1H@=scxc)Zm#b)TYf2)OOPMA1ZCo@*&1*Mzw$e7vqjnG z6PM-Zw852v08y`v+mGgZ4J9U~!}yGcN)6>70}x*kg0`4pMprC^Hf-z5$zX!J)jmOv zjNS*@dVJn}MB}_)3_j>GluwvX%&pEr8U2h|lhKR+b}?U*XUcdk_31K0>9c&IeOpO- zaMDb$c$UsD$Fn#+7sxf7UJpa(#J4s`&>!gF`GzY21{!Q|2o^SUH%KrPm{_LO!`fp4 zk%t4e-W@;cwbnE0=pu}xo(xb+Yh8x>`0|%neDW<4^y9eiws=~)QlR<;_)nWnY$LooXeMgxJd1UgNXX96zMTkDJu}R-8HeON>(E1M+2gCg! zKgM}DZB{2ImudJ6-;8JU**PXUuUXb_XZYrm%QPa?)@1O~KVxglqh7rm;z`|1;BV~r zay-uTp@_6~W$`um24A13BM&^qVzu1rO>V|#nIGV?GCnSXlW363Yl+;zY+l^oy45t5 zy+}(6u&?4#k~X8L2h1GH=S|Zs+yIQ*(NFDS*{P^@>N z1n7a<%jxL~P8;`n4F$)hQ*<6p=Ja|Q*7_CaV#5#GAUfnS6t@la@e=hiFQ=!dEB(%C z=tpO3Dec7bW_n6Q&c*>0W2DxtCmp8)?P|j`syYp~= zm8z*lpsyW(I9^LFB09?V_?=ISqz-9*#Tm2uqZu)$XYH!Lo8C9eCFn=lb7p)l!!vpf z=gy@z!fYzc$P<{B{ogF0W*O)?aUN5`a8pECd&!c0LE!#YTnoFAhS^A644^tL!jkq1 zpizMEzq$-1S;lh;)`&zek+@vDJ4cRuUdplGar~~_263DN?cX7Olgm(!Gd@8B2R6yeuhJw%j2gj-jVjDdErPEOI0G#-(?N2x9?IO_~0u1zuoyXRQ&>t1#NaEjW zXk6^|qD~et%*1uua8D%mSTP*^Y2>3b#^_73%57F2g$P4%_;Q+D4*CxUSxny$%9vxD zMT+A*Ex*KtwgXuZZ5*0?R-cN`rY~*hx>RyGtN&t0y1MeWJnj-+;QGa0YmEDNPDl^) z5x+T)`-nvtN1XwFI-8>2fb`(v*SQ_2&j|y}XF8(~gCazCiZB%0RzbOcxJ12)a=FAW z!N4YQo*iWfHpxq4MY_R%VaUIaW0MPGQeO`SkC+u7|*N!rxB0_(1YX#kaH0Ns2 zWAEloKfjhje2UAmOmBH>E5ykhsD_uCES!pxqs^AzHt9AL=9|{dga@xnME}suaPC8c zNYCG#M_m<$a!LXf`@B;GJL;J+5kflwLOvPVY@V;JPYDn`nGMu8AKC=djGD)MwJ6_J z4MJSZ9r30luX;*ytBtawY)op}vr-hVpX)S~f3UUYRWDwEd%0X4C^eKnnx=cc4G!U+ z|5y^$MjO!0_pGe#lzCk4-=wVIRgl$P4q5q~^Z7oO^GCc5IY8kCM_C1sI?*tz?EubB zvAmUG8Rn08MDp=Q%;}6w?U@k5AiL zYADn+-2ofi>=)!nsvERX1+?othJy0ws6w>QPzGI!dX!iFn*v&i$51{&8LOV?V-f`a zrV#BTt~(4t|7`Y-Pntmgi^EVpY2x?2+Cd&4Z32Di_1~#&Sh}ElOaX00YX$S~C-+1A zyAtG&HW9rqcf>oU5G{2h(U-PX)I!`*_Nr;RaXq3g__KhaY%xtY{(h8=acS`X+X`{P z#xZncfa>}gcqKSyNT;7RO@_m@Vi4LIOq1g+0JKd`<4UnSZVd#eZq6pUAHOAPr~h%0 zp~SL*)hmpNGwO6_?h)nTz4HylVFUgA8s2!#$OrxT`J9Glo{^NCYQoByj#+h2GO>A$ zR(?+gQ*0(}ZJ2>2HNs-iO4LK9sqDu7;=Wubv{~^rL-1@Ny`;im*Ctv7=4(h=HK_e`w1&b=8~UpR%~;7X*W*`%%!AfMGuv-XB))!xrweBB~J&!hlDxV~2i5KnAu(vN&+Hs$NarH+}V zG6--%Un8r1?+3bD1pOu<6Zh#*&lo1l^Tn||Wtc3-70>_9iWPm`G!vinBzJ*2Jx5K8Xu)ZxRo$lMq|3}|Y&ICWoo1p*J^3!3PBZg_&wjAoy?EOylAJ+RP zB!~KA(^O7deTYiX6W@3?KG&+{r8h{B$Xwfw@~lX78TEbvde&3`g;*(di7*s5O~r46 z&=Vr)2d!@%{P|@R^)ZlmjuQ3}b&?Bx16wz-V){*=p_JI*%Gi|2YHs_jd-i9uoKmEv zEKWQ?fOd(X&jN5V`gvD~WtZ6El zwz9#mZ!|b9#rNLn;(EjPtmn9F{QN(=`S}k;I2t%(Mmw$jzTX9HsS{@OaqGFLt4>zA^LKHtsg&C$2dm?-}< zjIRH8#*7YHzh|E@qsV{GRGj5Ko3e?1Ae-5;G`t6FaEJhOdn-AQ`*6m(V?KHT#*aK- zOiykQ_uOf%pE%S1U2KodT>CR|9A~bpZ=5qP4)r?2R8CsIN3C%=F1ghY4U^>uqHe)_ z=pu|CnapJ|U28??PYW=9vT;83e7KO|6dak}Q!e#=K88V#@#tpbjK_VzV~&S2$0CF> zv}AoCr!N<60o<=Ur2 z=*PalVVcU3jZOMVuSh+Q)LQh!tv<`2JKgV}TE{4p4q9W1vih&5`|Av5#`SLFERA{0 z>hBK>PVfG7hJVZ7&a;JFsJ~B$(DR@OLkZ(rdStSQ#|`7yf2EX-`&-lFUZQqn##O@p zy3}=m13w z@H{?a#W~>h96`jX8ov8;ndi)o?Uc6_C!S7jYm`ZFT*}j3-NmVuE!=G?jjJ1EG*E@mdCZVly zjvTqm-nf4Hn!DGF^uKfcjP^ObUWP$-3eKK;x7UljiT(a{uQ&OBuDw^-9wrj><9=-f zIUDUJz>=wH%z7RJg>=nV z0AI|qLG*8&Csv=2Nqd~j3HCbFUU zz_K;9A#g5g6d=0)$(**t5{1n_(t;?+krI$2zXmyiGyrAW&TRPNUzy(OP+vm+@y&)k zM9AP3y!Px962K$D z9&46ZU0Avz2CPmVTVoO=*qrw_=`P^Dz}tSvWwn?D1II0zmCzuL--m0YOMuXCH1694 zAa(dHoi3?hLg_S%Vz#S6w+%d9y3Gw|&wy6&HY0Ue;Wj zu?xjGzTM3@kJUEbJ|&d|yG@hT_ewhqWu;hheOF_3w?#wLcjp*N36EnR?i6jU&jLj8 z8&XnPaObkB+CQScw(2fi=fN#Dpm%UtlC7=d%M&cOyTV5PSKnu20Spi;&pVa><@oUH z@*x_}hMQ~rK#2`ljDUyL=H>OG>#f*1q%CzIN4f+U3iMw?|8qazi)%#aPyEDAd7LPV z4GNChc`n@z*$}-(f^qo;o>z9_9e;P~{aAW8ufy4ssDML(EwxNni;HmmhoZCf$cw$+ zQq;{_J74UyaDHM8cf_H>SM5}v%jDAH9Vuf zhC!rJZ_cCUeV`?;XZFl~D6-S!ji940Ht`ClImE{65hw2ht#2zypS+RiV48{KeMEcv z`w;iNC$#m65Pe&KsPA>5O%@?~FaCZ^V08g~`vhi}!*AWSxk;BL!eZKLt$N_!_8Q8} zaa}IR!!Meq+Xb?n|L?c=Bh6~cVCy=$&GLGVGyNn$Xg8}1=~naS7|NgXA@rUNLdmNM z^VQ7q8!Vm-*VEl|xUU%dE4S9vCbNOAkld}7&9c}O%UVy`d%Y>i9ZW3+UA}&8ZN$NC z47XeN4gy3|ONlPG25OHpoDonzV>Go~eZ*-fpIiCw_kADY@}wEUv3$MUP+qVw;L1TB zp7a@(Oz%|x*bQ-6f`R1vYtnKK_NScTj_%5V;!df&b(f>pD|bFTl3WV<*s551>^9Jo zlBE9Cde8oDh$ok`dZ7bjw-J38%iWRGyPOQ)NgrKK^wCxR^gmdB6sTh?KS~}>uJ1_i z$^m+Z(@^9bxOs&Ht;mCL9N)q3%7#M@hoLCCIe_o+Sl?ZOshFuIW@Oi1B*qtnQFUWG<-piv;7xEYd)o-|Yjd_V-e1iZ3Ywd=DGE+T3 z8}#uS^3yfpfoKzwsHP-Q{TI8TpiTy+8D_jPg9mQarp)9Y+-S9nF${Ho5ITI0qi1u6 zr*R*i24)Kw$7jR6e)>?Mq1+-tPv7J+jflD75$if$!@bs4Xec~}%8B3A4|gu4_ZAuq z+Xs1XpODL9&}PbJGut*>ZT$j-28}u4sxxK+ud_Y4&rWmZ^7yoI({zuVF$Y*p;aD|I zom)RYh~xG~C&Y1_cuY8x4HzcH8y9H%>i^RAWz%$5upG$Wu=s&5;UsOa?IAP#k!;K} zzKvZ%TZ6=9F_we#SOpFJ5aJCY@;@PnZJiT&8a}`Axh9=}tUa_omVQX&aTlvQA?}Vg zUNR|_1k;i`cvyr`be6wH7U2QpCr895ydFvM-U;BG=F!hOXc?D@m=E*2g*>0goXxQ< z8wxqL57L8^5(JO(c#I&sH{_r%n5Kfiaa;mU2gATha9?@Q6g{kN1oBnZ{!#~h#=5p& zbg^sf{B?MrEBFiR8u;bm&*vG+spSI2y$!i?WK8m^JchC)n7obq-j||`C8Wct+hmRT zh$l9Vd^XQeu?s zELYjyTPbq?ceMoLlaiqJS+OObw1`$Nnn*u-O=K7dW1B_VctZ(Ao_)I@M@}((xS6@! zF1{|_bkYBO%<|!Z?}09mBShE|VX;cECE^F!i+pT3EDU=jSVCTC(tmv|$}B{C2}n5k zO_s|PocBwPYd#`g7f#;B^tYbC_&nlSMLU|-n z0d%iO^dp9uAnjkyllJF9)F?ERi5rPNB6z|`=f646P*7eNlR)hNs6I9u*Cwd^9TI!T z75I*Nq93#yN|^v5ydU4c!Fx7O`rU0Ya(#Z(PD`5QUs42?9jxtQrdV zOxz=ZT}}$GJL#jWPi`hpAGF#xoHV1UCQb+0etO+WH+p%_`Gn+R_U)KhZclCo4Q^sS zs5}-Q`Uvt8=!fzWCPVG{KV$TcOxqSRn1k$l?{qWW{%AME{Z_8G6J+g)V-Jt4E_8Os zR;@{QWfT3U#k|f!%c?c$W)XTeaXVyB;8|X0;k#Z#naN*{FMom2>N=()i8Oq*`=Rw;KEm;)qchgtO4CVMcRo$^{f_y#k;3i*sO$8ic^C*?5ug*1;950U}*_q46 zw|}QtmIrUTsTarjYS8@*AG?zIvO6Vc!+TTiUT@`75Ql7zXVnJ~iZLuUmkQ6;PxDZypp}QL`C`awgUb=3^PrtKZ5(=Dz+a=)GMra|97#W zpiUnLPtAaoTT}WsZX-!{H|@duZkxw3+%xskzfx!@L`a9(+RMmIxzN^U#Q~IhId1zw z?kiS@i#c{jXpW&wo#I$)c)WOyp^R9+FPp>r!1sdp0(;?*B?B>A=eRVnOzX5cA0Q$` zD+-+UWR@IRQAFDM1fH|kBE-Tg{DjGJBukD|%#tJZAg*GzfopCU!8wPaG79%J*Jg6) z4AXRvSvC^U!cM$v-OBV9fJ6g8bq4F1vKZx zdab?&a!K88fRJ>1MY_=j#Ug-nz%)a+Ho3oUU^=fc%<>w=Aj?BKuwJSO-?S;0A|@mC<&fmaf?p1A{#=DMTP<_kIboluhdZbGBJxbhAFH% zKpwuf*vf@nac(Z`pbesT%w{=sTC4)~QliBcfR?Nwddvkn>U=RT==km!^n_6lYxaU3 z1DWw-cCC`=v3bC7VPh4bCtv$&I<^3Glx<=Wp06xS#YTi1a;ute1x=W`VMHj0s^&X* zPS}D%L-C(7tJ%Bff%f4{9{{s2zRl*Rg5@z<_31VU=U}|Dz4i>y!z#oB5{w5XmTAqx zx|;jv8p`o1g0k??g>YR5MTmN5^ENm?PvpxHVv{57c~IOx$53REn6=jL!3!uKe& z*@|vq_VM;?D3!M-=4Ymce5Bk9=d=hg$+f z$2}SX!tz`l6U(&a;-_JG0nv6ZI4gtT+Dy88y|_M+E&~XyAV9QJY&`}YWIMAT+T=TC z+7BJVQ(@Uf^xZD@%?FbL48T-u1OQkK)$Qx&%7k|QleoTuP#StR<3qO1Ip1DD zG|nS!%szzjt5JC_k4#Eg!6Cy`Jmp}=@o`No(+-Pe_DNV6X7pqs;jtvyL|^0MH1|*9 zT>BC5gq!Da-VGrS9nIr9%98>K$0~^ap!3ae0QcE@Ye$f7RmZ3E4|?Dx4?U7+CDi$oJYpV8(n5B){du0Dlz=loxsltsViJT_&m-CZu0T=0VSs8D zBhn(!ugx|Te+g7iv=U7&l^aIjt3ZW&nrk!X;&|>+ zpyEBNt#hUH(LByOUEKc`%)B3IHOpB%TtGY7*gEr%WIOFzHVm+PCrarN@_g$a zzYRjGE6(k6?i@oQ!26t(oWZYIYh(I7B7`pZErn;l1-}EohmGS<8Et%&f0z7~8%7%M ziA{gYEqRWp=m^w33lhH@{; z&fg$fhst9ivE4?MVQj0`y6Az|J=C9PD9zZ`Mf9-1_W-W{HQUc!|1PWD^tpwl^t5TZ zuPZPVZxPVc#wLBGm*|09hC_L<@!9Refr3IR&g(l?4#}Hdox)DNMDDL?g&=wcdZ2DNOxQ(muV=YAIUC%0A+NRTXCC}=UxMPDhHy+TSV#| zS;TD7JM-m8vWn<%`$OqL8zkW5GHo}=5eLk*`(WKM%xItluJn6(*V^Uib88$ z4iq1$=<>d8n(h^kLL1nCezoYE>jTa%?5_~PfM=gDXAm~Ba0YT z59$sqHxK1nSbOX`$4;+LaJG&LtTuCKbaT_5fFxZ1={C?hXBo<;+lZEuN`p9#b>PTP zZ37K%zbE~mVJfL@EXO?mjvOdXiY56Qr1E?pcv}SvGwDb+6rYg1!Qam|l$Xzo|2`}G z9-PJytdd~7eRxquH)A*tX-Npq^hvNdD1q0+`|`7XXT=#Iy|yDC8e(x}xkU2=1c?Bl zbtoSQawKZy7I~QL#rV$<$Uqxs@$+6Ak25VVw{lfxL&9&>_GG?J8@HPZ^W}&SgjLKY z25;8jo?voeu9sdh%TN*(Kv54seFoQvAFoX{j0o0#hQkkz$dAw1(;+Vn%rcZ)nNQdi zL>=aXGu+RG$6?cCc;tTZ{xGjK;8riU;si3s*=I~{Qx>?K`Sux8;h2L?_2*X1+D{7& zrRKCbfPI>{x;gd0d*{XS^xk|4@$&Sk4mei5YH8sR1`KMP1xu8BQf z59JJ}n#Y{+*poYvCNuw=TdgZJlz~Z>>lr*V#p87tw)!3ZbUcsfQ3(c6KbV@%+3~6l z7ncz(cX1g-Wc@EyOV6-ayafJkFXXaKfZ0KXd}l7`f``kbF3Z38O<9h7kTp2`7iP0K zJ6~|ZjK+jF!^&}Uz`_a{wgEUB{XG5yKN%d*njUiD57!RiwSuw@?gtpze5S4kpl2$Fj_>)i+X1M?B zitT-qdDC zaockt`Z3a+Wo2|>39HfE_BQJEC(W9fW4M>a+QQ8%a-r>>Ni(_%=VsEZ#_zA5WhjFu z%+Lf|caGrvDIP0`^Z)K0{`AQ_qOXOsdyI{zz-!H*?EgBeTg89RGq@i+VA&PjQ#=Mr zu#O$p{>@xJdYb!`+eK&%u$;mYR;%ZQDegPR->CmQYM2Z|fxpMC{$l!_ZWjM`i(yvp z{XcSqDp|hn^Lu7uhtJHb(dw?X^}wmW=oyIKKy+Lz3xo|YV1nkz?sybakBVqCudJqruk%5hpVBbEhagoG8#(kFuMhrZ!DkD;LK$!bcy=VNg#C}Mpm@a6JA43jOS9w% z()FVX(HzjVgUi?sbq=rZrfw3!o@6opZgq4UXn)N!l+kUhwte*` zV0Fw{`wz2uuG2#W+?KnxfZI`7o29(Xk?ga5J7M()-;3`&Zp9yh00U1mJ29xqdZPb6 zo5vTn6c|dvinVxYdd+z*V4po(L!?oJ@x~rMwe*tyF-f4%J|nND4C%i|J-?O+uC+ji zpZ@i`oVV^3A)Krvda7QIEc+?MeKxp~`Q|Ixybi%s6ysVMZWxI_IB)r_P!x`f zjwQ+G&&|I>dFU_2hT;JE@e>vABNvB2f7N0o;qU= zjGA4;I6mLs3vo|JYy{h7&UtQ(KE8P`#NpC)BOY9TH1dmMzud9`w$s=dt04{$S zWytoAl|jOK*k4_}p&sXs6OL>ZxZ0=3hUJW0~;@uFdS}GPU7Ofqu4y z?`N>$)Ykmb-~FWEuURR=_2nH8Z|{4jq8sED>0}kKSn(SGqT@w|f^r;)5Z!C~YTO`4 zkVhP^BKj;x#wP1fhwb>=%W}#0USwgD3+ZqT)APZJ*ZQsVvBGqX8+`Vtm|KI-nUJ8m zPvm3%{TxGyWu?Q&|M1*24&-&v7R!NXhL^yu3Tks0%BQF+wRWU$J?#tQJ4*6cUBBw& zhO_o<79&w*(W+-_C^(s2UdL~7iA6Qxshk@82GmIdI4@GV=E>7@!v1%g^ajS$koQzj z0HXg8`=^^VFRy`k?37u31Qv!fePXy9Z@TH7SsdrY2M(4m$9zHfT$axU1F0&WOGmOH ziaPgmmjCJBvJHhynIYsG6~AuM@q4~@5vPS;Pn*%z5`=oKoF88SpA%dg%_0mnepEpN zk5y1!XTFkt=HU7owmSe2wQ7lvH$GND10Pk;NiKh@SLWirO^3N09MkH=4g z9Qoy1h!1{Y*5J7=L5>{!CB#YE41eD=-8jFDcdtE{cOz|nKRZ*m$9(}l^~ZC3>cH{x zBS@zo%QBRfY@#ErehnbOaL1AM_4#O4mZ3b~3Go<^y44jx8UCRJ(U^_vYYb!B2DB@i z=nVoSNRgq$a#zvjx=?3Bd~FZR{#}ZpIv}`5!+sfmq1Crz+w%ATNtFvv|!C^=HpOJT5{owl!1J$r-F+W5VOs zP^U@F;qxnuLtTdFy*G!`&lj?|UXH(u@(d*@z>vV?#kutJ5*|bM^DKkq?&0s{B8+F} z8OoZxg)FaLTr5WdkIIqVs9#FyFw1kl;Trmx%}@qKRu4nnQ*0>Mj^)ZeDo5TaF_h_b zzjz@ncNhu*IfCm?1_(898(0MQbAanvuok_5w(HaOLvq|=>-{)CtPne+g z^S;0LubI8~+Rs{hU7pKY&+~nD-vgaABddb*tS1+1Ia$IF!fS(m)KPLdPc4kVS3n!H z3;!I{9sl=5{H&;L&*_a-wF9uOb^$mxE{1T^B^_>#6OobBX_EEFDrvNyz*?Mt+(&bD zvF3ZF%YC^msr#%L;h5)o-cGRO8OWf#n~~ISBrwSR`To9G8)eLOW&|_|_6`kOzM8jX z30-jD94klrwsnW_g%+65xguXP@;Cs8Z@T7K6CpVXzPChsQaHBQe<%xC!_qe76a1`G zhW1qi2KU-3G#r;pcGVd&s6(%2(Wpm~M^^*zeBg((sNr+UZ9bbCy>D~83i-#doarA1 zDCcp@yE2QVtix^`&juT4rx8EWvNi^RBX!ud!9wsLJOo7*!rk{ZnKgHDxzF_3|B z6#^<>Pu>Vjw;a1LhZDZ{&Jn@?Lv|W~X19a;w}&Lo<0T^SoRdElG(SQ+NfN%(ba6Ph%6$qEqvKOQ$(S$N&FC zXMBcE(F`3S>&pQC;aJxfQXcP=Ju}w-r|%8$_ohkey`T3il%ak6f;@hxOP`Sm-;1jR z)D6z(^JCwY!n7Ea*n^UY9Z?{>S^}jU)S+6~GjyPIVE-N)Kac!??;*OOlIL2@75PR5 zj;hNKfA(u%&r9mt>@@H%1O@|#mTNZ?7)<#C%UJ?X3uSd{CY1Ldfpyqd{UzWybP0r? z%LIk+JkcVa=?}#M>&}}N=jPcbu+cYqA-oSjfst|zR&T0`0hF&KFxar-GSmkLxts`H zrq$*p_3?$&C>kl(kcS`Nzg#n9;>Y$Dtldm?ZTb!Tg27wuRmslm$T zO$Q|z#(XiC=4;-RsMx%{3gwpX=H*&x7HQ-EUtOkwZQ&D#91xC6A|5U-7y5ggNnHkL zZ|I(<%?EG-%sd!^SFQmrg56ZQPHJhpqxq-*<94Zlg zG%TsXIN^JFgV5{ORyvdVS)vAc--YIAd32>Y%Ym3wCy8dFWcjN!%HqaVEOSC%${`1gFpa#o94L)Q&$9`&v zeSYToA1v$}PG=yOfAc5zUw@VI>uTrcRRC?NIEb?gMXr>DEJf~+U@Tb-#tj4pCo3hb zb5piflXh;^|AQqO?~AHRja?@NxXyMd7{1%-!NXhOU<)bY_{pUyY?mu9z;>~N^0D2#MmS`WR{{L|a*FE|F50`MCM*bg`YJW@pcP`~VgVHYhdfx!##jlnEl5^!T z$N~opKpwwWEd^pLv3;({A1$BIIpUg@cDk{y*$ruMA3!oYXfF8mKJ-$Hr+Xe89pE#d&jIev-#2Y*Zo4 zbGOK@$ncd?z~J9S{Ix|b$7%uER6^QXw`^*LEE* zWkN3G*sS>N;|nE@7m#>b(r&Wi^i%d;w}t1-u`?@YV`s)>P%f5*&(*MnGkRT;>BHGH z%CQczsnH61gSq|C8OsI(?-M6!+X(qQrwmm=Yat>x4c_}V{#!I!Yvra1+3Am4ch?!z z20!*@iJVT}Ea59T`#XO$VAF1aEfjK#xPy8EeUcZndN!`M3f>9sD??t(NDr2@T>Emlz?Ai&PT_s>NZK>l} zEbm%&XE*BSRaa;vH>n>$+4pJ*$HYr-87 z8Ttx#)fwF-0&9S`t9hyR!Mvn?m6X)uBcPonNu6c@_fJjbc{ptO;c!e78z>&gAB~{Q zB5*XynEnJ~I@(-F7wy(kP=iZlE?>A^+)W@V@+jBNnp+_P%AF*sKV8BxqDSw1Sly2{ zt-wilMKWzk9qV|90FTLRA#m#XBvXFM_mi1xa)fB0szc{2J1vD3z~p=l`(`76(Jez? zD$mNewKmFSD=+YF(MMSS(_s0;q+tz&_`az+q!TzgK%i}y=eyxCgoY2Gt)76v2#lg$ za2I3xzc9ve=2HGRIA44g4(AzJj^Mn*wOApG93<)IZ9aK(;P5|`yjo6Pqh%De3~fdPPW?n`$jOZ#7v*o)}4OM!pn*E6uYj>qkyJ}~)UsaEt( zw&t^9swEY+<8z7Q#TGRF#$?JP8Bk8<@O8m`M<`Sue|vYG@w44KkHuwYB!o5;xZC7? zl*_shR3A^>lZt3mlA%nt(P%A!-dbCQR=2+iEwDRQ)+a4Gzo1 z@5?%}ANyFcNyW(Pt^~dp(hIqlYXL`6-zXQ49*{s$Gu7Z;o7n5>w?kg5P2gEexix`d z9tT|%@eRN_4}oLNkOHBnK#R#>yw^aqzsc^%yDN!yVj~i#VumrTwr9==!-H`#8y&6A<*0T!E&t#Xh6ik7x^#F;O8K? z-h1&Hp1)kXbuQ}E&ZB52pv@9zY|NLNq1Dd?19s64tjqW3<=QavtIeURnj$H{?+q^3 zyqiN+G*=1~fjV>+vMOSA)YxS0JJt5C(Bxi$L;on`R`B!vS8}zRlT3dUiYoYcZoWcO z__bG@kv_jzyPjV!7SHdvLi-B8zDm6R3}~zQb(MIoUZJhx*Hm0TaD_&bOwZ@-SzQrZ zJG(va{D(M0dK9h~0YS^ZJ!kF`YGlCts5h>x7(EQ29G-h)4)Pe3W2fec zI#mxfs3fphciED9>;-`dcrQunP{8#Gj>+(gIZ1s5GkL5c>UXG@QVGgZ_Q2+IOzGb8 z#i|XNpoL@_4NcFh@W}b2OQ)G4<~WURlwowC!IVQ=zE~9^?xVNxzJNDM=TPH}ToBp$ zyCvFJ3G_-fHHdOUB{UGTd`Ao9r2aF;ToIG$5133JvTTiR8I_`QQmxKDRXE{+(fd$A?r zys4TRXHxgFmhyd9)w7h_Fndg<|Clk?x!rZf)Cke0Unbm^rzppoJ?rnEm(*h$!9ZOb z@1c$mYY<~jGqZS~-DU%Y-2%qBTd1+0K;Iqb7{{=x&4f3QrZV7d+x7OgL_dLGXZGR! zs_bs-+$}wUyk!q@A3ZB2^-XVYOW+)CBJQ>kc>&J}cM|9I?mDAJQiCX?@j3Q0)~$l5 z`zrv-I#XcR?PAQe3fnE`A8mMhTcQhf)IoLsFsCO+MykQ+!}W9vHSk+J;2gzyfbBxs zBh|Quoe^wH6LGe^YBK#*##~4X-$gq39@2X10y>KmpH1gQQ^akjVh!S3>x_|a%*Fv# z0hAA!$#opDhgQ=waZ7E_WW&lHqj6QwRMS88B$rczt&}yPdmZHGJE&U~%P=qpUExMxSZQuY55g7BSm*x*zx}%a*!6-fajO;oKPjdGGzc@E`sCajBn1EL-o z!XHVXtZ3vu8bigP2CoHhR)E;|c>2fC8QM{mK%0HQWc}uxq#kG#HiS1r(&R{V5<|XyvN}T&7 zLb1Ky!1-3t7?MDVy|%Mz8*h6-W51)zJtY_T2TWGhDpLdhKVzC4-*7@M=C}jrENl_9 z^U%KQCeRNuj6pY#Nj8oF^gD$Qxc`!7=xizl?K?@6#{hLR){lH;+%!?o>iZ_%w{WhI zx0IzYR%I!IGz<$vO%gU4&(HEgp>@V(`4$`&I86~C&m!oL|ijE5C)*;19o9|lwDlZF+mk6; zeOHxdb7d7@mv2^Te`2Qa*Uu1VOE-|29M^Aj5g5fb@67MopUMmHwJqDL4#lMKVhNN( z`=oFd0p(Cg3diiA>;q7qZ7y*fa!O&E2@1Bec}r#0v)10uf%Ltdi$HlTY3k2DAgw#3 zK=`>NQ$i?HX^sY~zgG1%fZXnV-ZlWw@fw+OEVtyesgGLNb zGX*GPOTZXjLXBG_=e~QN>6OQLGY?T?F zHaV_2*0(BE-#|b+!Q-vm9CH%u#^?Om^;c`#8Pj7+sChN_TNGIRgVUz|Uuku}K5gpJ z3+l!?#eQ;r3V1FP!<&Y^Ghku# zrpi2El}X!IJJ;)G@-V~!6v-z3b1b|pj>%VkycD!Q+o|!S#A9vF zW9SS>e4k$EJ(b#)9N|+i%$V!@nMwV4Eoiq8Xm^7e41K4Hu6Xg)&bk2<)xfr7$f5?PO-nXdTvsmsHR50 zUF3D}?32RMMLagfs9~({j7&5yh};s$TPFmLn}&77B@p=V1L6$FoAt?D8s%BQ^E^+i z1ml?}L@teqmDJb)!UlgI>wG{8$CFIKZ(0Z7?6gDPq#d-$YA`0NsgWQwP?P~>A|F(d zzgkM_u_WvF{0PD|7A8ZgJihA^*xG&HOER9XVp0Y_>XSt&{I-J-Zng2e&KlP-aLk?) zXGHO8%4y&?r(?qXn;n!Q9uEgjlpAje{FXeQMFZcv@STeoQ?M;@v>CEQ-(y=lvmp=L z_cg1139Eg@Km(iP;$<6qrEo|FrR8ZU?8V+YGbj`~y-r z_90VZBa$Xrb8#Q)hSgSn&T25O`OJ8}-^}EEbjmP@`ef@?vFAK4J4HS$9a26zW4?n# zyL|_A#_UkR<#24S_QsTukJK)FQ$4?ca6CicmX-3chw}K-V!iyGnL1=ZIldcznrM(a zUwfaKddLRl@nUMkZV~(0aT%1ji}E;3ysno;48#@FrpSY-&(4F1^NLNIy4MEU#$Skh z>ZLXs*my97@he4qb3h|YX%*h{g1VotnO{J7Q4!^Mj&T_xZ(6wqp3gt;Pn0(;bj+7= zZO`n7AA9cdi<7QTYs=v&#`pJ;*QRpYrQ_z*5NP*h1vnP(=XO{*Fl87_`D2H6gc5f^ zZlxr{SoLCvo{^y9$UG}Awv~V8hy;VRw|O=06R6~I95;YH`;+HPzW?wTB=u*vLFaep z2~4K*?GdshrF%~7lzJ#Yf2BRCFZTksH*tOa`@HktkK>Eqe-9+Np2_hNc1jy=k#kR))aU%M!&BX8?| zkS4rIfdz|t^@Vu-aXH_A!vW~*PO?gr2kW7z@>E7r$2!L?Z1U6?))HvP@2ge5sQLDK zwHaG)r`$8R{gY$5EzQUN&%%GK{V@WL<3j-rdFf9HH6AA($K#fci|uZ+#`66sQ&&l% z;!Vh{NaqutC&hVqB|kUMkMOdk#Wa znr2)dADCk00^jUlPreL;+-G^~?7WMKmqp&Zlb71Q^}!M_(`{S6_w(4rT3mu&-}BiT z+D|zD?oXQf@YARdy2Si&Uafs~yRdih+nRn-XQ1xiL}(Os|4x#>cKhzTJG$mVc>K4^ z+fWa99zf}`L%7=xN>?_7y>?LU%dqlx$VHJaPn&uc4VA>M=I3+)v>gB>{{Vq#Y|Hip zmZ8(8e$i)?x#PEGZCFO#voTRIZR*)HRD#cA)2!Tz#SW;`tlVkEk>5mM48JY@V5t_g zY_!7}YOsl!{OqO(q@z{%|3R8~hZHp)FMZ7IGt#T;|;S5u}QlA-*}Mrw2sICZfM%9BWMCC|mh?T7Uai=U>gU(}%$NWAz*TT^rE_2pUD1kT=hw@d$q>-=At*Fh|HW9HS-+Pow^V7^B5g=0C{S`NoV-z=gab z6$fOQqpGPqbp~{T($eMR%kaji?b#i<9b4)KmDz*t)zlKP*fO}$z!Xq0k5ISxe?s9*b5tHJMQb06m5 z`&^gYb^2yW4F(7dZXnQJBzL)+{<*yEIPo|F->K9#e0;UmMG6{EW`lC92|B&I?(TS# zcpTkZLWvtQvMNwd-C|4XXO>XoK!%7xy-v)VNH@1xokDl*y;^%VQ;dCAAymbdP~+P@ zsr;?ZNMnz{66nt0xN!kSq|tApF0zCgV?3_cbu_lK7+>D_P{;}l?b6XR1{(v#p6H_L~CEX?^Dy6L7yS-{balakb9oT*M zG1ztYu}xd*6AfEJiH0q{#HKCY#1o9U9-K0DsD?FXL_PsyST6FP1t{}@t1TwGBmH*B zL;d*mgsFF1m~A{C&dy)#|TuYOf4xLM8WYh0c>X)D(MNDQsJaBV8(}hk?^76 z4<6Ss0Y3;ga5Ts&}^U%Ena+Epmpr-V>REbKiGOPlwAV0 zoD5Kdmx3CUK@GkGnT;p2Ksf{uj%RkctHHJvZXY<;`gYNd zyDk!Qx?H-s!ZvW<(1;9?MKEw0dDV%Q*y#|;UOSYxyjEIOAZ@PT@kS^ofCgl2=MisP zO(vALY*|>f?V?cSr{y(j*hM=wOHlT;Ee%!A0+iLG-7jS{wgT^?y!UL7_aA((ONyYp z+_a^kDlW^B1{-L#i>$fuRR~k7pRnDVw$xXR$dZ3;v)hrAWMx~ zUgSS9&ic>DvVRe%Lk}|M@|=M1a{x-~qJjOA1eI9Ne{&zp;$^K69XA~Q#vHvUT2_8aLX`=IzWKH*!syeQPc&d?jhRAOYPqZ zxiN*@5DvlAcpL~4U z)FBu0;Evr7-?1fhaNN2-Xx-;{F?Z~KIJ6~n5P9i}y{#Ltz1Yt9cQ`+o(SxWHlud@I z=NHpx6F@oI+xZ}J>7q`BIwYj>Or_nMvU2r=9N_R!2vZr9*NHe^9Jm;i+X&Cm8-@%} z=HUM<;PI`VIS^JQPzGd$^5&i9B3m@ahWf zd-kL*aBB-9cTb!8v<&_MB64PiEUe5N)6`=`VA6-I+zWQo)Qe=Em(P`Y|DVp89D7dW zge-`B%dm85u4@!WzL{!Q+n0Ngek=FEbB<2ST^mLib75QY8m5`z^?kEM#rf$Cl}zV% zZFn2)Z*Qn%xDE_yiYZM}ZUySw8$>L+f4Ghs6lmZ^#`G>38nK;E%CPo-@V(q`mqpEC6mZ8W+Ipx*;z>JfE-+T6?Z#J{t{iKM0(k3$D@L%}Ao08}u$-8Ym|)Rw%<@zvEhM z6@b&SPmKYT**10PtxSP6w4HzvlZztA3kDt%ddnA)kF6xy_*yWQ0XRE$de+C};z&-C z>C2BUZwqB}98M#(cW~G`$BL~*TE!gOBs3SI!-wy4$j}=s0dQ9LLb%BeT0MaBRSC*O zPJ)8S@VtvJ8=5lp;d%e-vH`GiZilYX{>K{2zw*7Lf}=GH2i(;_I5tjdJ-))23waf` z6NuTb9Ni7e7uet9RPg;wKc{ulCAw5=bjbY z{a9L@A|)_bv{0P=f(!=s=i5U|xSa?xHTLhmyMz9_$g>`jX*4F$3e>f5e813S<^8=t zH$;7KSw!@6!R9X}HY^lzWBA^tCg>cu{-3xVI^iLj7?@`L1u_hF*VY&VJoZf;YRnWm zcz3O2NLdgaIJ+j=Enihp;QXhK3e;VQv#}8bZth$QBOmp*xSSvPPLk;!DB!v9W5?@^ zVY$$cbIe#f@Nu!UX5&r2r6nck=G7pJf_Ug9?U0*>wV;G05W2>LqCR4X)4%t!Jqm*Yn5jJ{F$~ZLuxe6Cnb9%Wc$X0_a~)(6;qy zk3I{XsOxOb6!CpS=S+RLg+?V>+EzU+pZYh+TBFZgs}0zadg0yb&@f}JZVB3v2E1CL zA)VNkKmuhTwL#vC_9Ul)GTk?a`?n5VJx2{LG)&#Hza!jt*0xalp=Ap$XsI)XTLi9i zTwV~lLF_3+P!>QY^kv&X!EgAMoYZmdA%FeIF6Lh#Q}|3ww9x2N=S+T2roN+liQKkl zOGDMh6H@p&0?LG3h`N2=o-GTjz9>W4A(B7()KJI%enO67ow!zpE5W!TQ}{JJDU-G) zLPot)OnD^9`ju%Wc-o0;xlW0?;~^q7HUKD300c(3KSN=}3F^>Eem zkOb{#WH|!eIXvcQ6F@Gt&fZa8^>3=?XFAtfd$udinYuV5%8%SIY3i+{?lMW0A{J%} zuQz|fbn$l|cJOzvwBEfu?cFcoyQS1P&6w*30`2{;&EsVkS!GMp%3jUup*$byCZJJl zGr(L8`&VwRKe!R(Mpfjk(yAX2Ioh}_`->c{mOHSqC-x7@O5cf3wP-NGofeHT70I z75NL&=)P^0{Zm@m(^$5U8b7$8?4VWlw`pbH!?JE_bXYhM^>frfqXnP7kQAt5t3juL{dAIk?ZvrS?WWne(Uz-Jj56RBRmnTfU zYfE_*^4t~zf!+3`9@?^v$I*4$)Zlh|lKX+^nV@+(#rfGCc7f@1z@`QtF|2*ADS;P> z^acf%lYc}mjttB5c|BCFK92IHion>UTo@^8s^)u0WG2VC6*IL{>Y2C)wDkPuXDoc( zhbK%P?}F=<^P<~`_G?M_CJ`$pisy@PV3%dyyh%M?fpJVqaV`^kO?k zHUf{yM;&V9?3$=AR%h&avCe3LmeaM+x<4)#a^Fdw`$H~>s3;r0x>(b!@9ISTW#eqz zL9YzTuP02sLxTPo&*KD@!)s|2;L#wr(dTArwE)@peH*iA7zSmn$&vcLLf)6$|EBvQ z?FQ@n{>GS#zgr@6-_-N*D6h}>QRQ3Tir@061Y@DCbsR_i_=Y7~I=&^&UzRX=Ze-7s zaO%s}96a+fk6#rzb;nKpscahMa{tUl+SH`Ub1@))+_t-p=V*~sm18L2{f!ChtoO=K z?nm#PF!f}7x$6EDtxe=S&WQREQ@+WV%acnv#*wFphP`|*h=wWt+NkhRUrc#? zv*#)rE+sG)m!OyC=4ie_r{)8d$7=fs^!mE1cnmCGdkeC;uR8y~Ia`aR{=bsV;~)6{ zKW1xhrN)@c-oi+x)fX9QeNplmeNposQw|i;X#E8=&Q1y%XC}|nxcD<@_}*p80XL0a zkNsIhqrX0D>M_Fo(u|*8KsRR5{c9TC$upl$w|$m9rG>zWt|A1cn&qzQW^fSKuz+1dOjp-!UsRmOzm1fa+XfmbyI3v$}294G~GDV{5&}edY zJ5-Ct?zDF3pVj}znR1|%8gC_MkKuPL8sAEz@!ij$QS&BK4t!CK{wB#>A+My}kQ6!5 zFK5hkT!OLV*?FAi28-s+X*9#1)jw}A<-jG>=tG(ziR1dD)2g#*{ZksPfBmfX{f;RI zuAs&Nq}46)+;!=+$}C#T(rB&y3|jHmnR1|l8V{yq${aQL%jr+&XRSvCKa0yQKk_sz zk9;k0%H;klP74b}ojIR%^7E+SmqBv^w0AB8EggT5W8fe^xNV-siorN_J9K(r_h|{B zz56G1hA&svIvuV13qg(EIk&KFIjF&b@6v=DP5%uVmzkaOv_q%3ZqM;gesRjw zQ8!NI6sMB#eLBMNexB;F_CedvHV`e|=I$An3nB-soI$a*>NWA})N6*%hCtwFu!y>F=3jC2(DjJyomyH70WdGBKj$Lb;BBNx9XQ;Xl1(G$PNu5p=O z2}azmI^sUKFqWHb{$w?lI^IbWq*YB<~ zj;y(>$~%Wf`Fr5Zf!r>)cMe4PJbGyMJVHBh$vEnBYVhx~bi==ja~&&>JIoRJI=a!; zeC%Sa$BIWz&hsQ@a>PGZsI5tw9FMsMd2Da4=6l`Smdvb4c)Ppyf1>`96qxun z_(C_@thunR+6G~+SHk>d>F2AdeQmU@xXqi$)NmXpWDN*56d7OBjsk{vpfM%&inF@B^qRbR?lNBsnMLYc#LcI zcn?UR{KsiiPrY*nZN|)1mmMMyUPxf9AuCs`v#;iA0Qc;_k})1rBkZG>XT^M2=iGke zE6G!)$X6rhN8TATc^qUHfm1OV{Cger+;V~Cr!>7)qTxDk+8}8+0+cmf!u>`4Yxi3@ z`{V-u>is<(0$U9t@7^PE3_5FnlH*hSO?E|2 zG)UUWN=f7ExKgZR9K+#-lICm9)#Br(?#UH-$~Z=&g$*}SIXiBQ+Ccf&)25C*IYb1; zV8||Vbn$bC<8x_jmLjIOyib`kz*H+Bc<^Iz@z_B`1+*cZ5VeY?c`%1@g5c{$@utxNxeEcw+`PPUh4 z%a~!=6{+8Ie-Qf?WlUhq)I(xk&&q||ErAl+E!IM}mB08E)0)qo+4C98PMtD!q<14E zD$h2+_8TBkIq?nHj`g)#^_5^^9biodJf@9E5}K4A&8g{%ZJGa zYOtCy{VofKVh&?^Yb_0|mtYL_oB)BrrahTjqCwJ74+vBjaDQ8#zyFW9+J+?4Lv|Wa z3ADi~8tBdv{;QWwSa$W|^LDkEA4QSZJ~s6fo|fO_d;EEEk*74m=`POWvFlCQpdGpv z!jj39JsW5MpSAug4Zv6OwDl4URuLF<6X#D=HNDay$XE%V&Z@WZw0NAoQ_M~mWGRVEhO|u|+F@SRsfx*2?3p9MT zcXLCPY@^%3Mx+0<`PPF^!@}&Z0r*4U&4%22-E{M!gE(J#onxX-T+1_c-YV)u8N~eF71HdE3U=Bo|PnGSp z$`Y$T`IyPs*hg`IvIZz#CM{Bf0FocaZY4nU`;578JR6$b4!k#&qBSUJ9Y~{Pv#Aef z*ifd+*{`s7POk)Nd>#f)-wL+-8z3Wc7@+I|`o_H$eY{=;V6>*_w+s4U&Bun@#q~hy z`g#YyuE+TZsqc0=01Cu+14O^gn5$lba-0j$>~U-axD5LUZvUJE`vtsekS>Mow=(96 zCs{cKY8-wBdEdZk04YKN3|`&_%YKq-*X^R-IL=9%Rqq}74zP)OZ<}eqD2MAu^u6PJ z-vc#lR2`D3`tT|kIQ=wx=d=xM5gFwBvA$M-GH4cUe2JgCmn_5o2N`qKNHFNjMOqTa zX~gnUZ7c87dsEM^63-96%ajnPLAnY8srj5<9%*9VL9^4*XXRf+{WDHrEal&qPt>5- z(lZJ`9YR@A1U%+K)oopqG?C5BO$x|?=j|Tc~au}%TT61 zmjy~ok;G+j%U&t$%M$S$hMd81n1;Ur(Upy%s)i&hM?K8Ani@^ybIWiIJOa?i+trP_f0t206L#Qz1*UOGWmX!>5rz}^ICp<-2i1B;H~8SJttp#hA~&U1bqX$ z>x=>bzHi>hOrB@#S!Qzi?lrldaoq%`RlwZ_ub$u0DR;@+Uu>rkg=7D4idhI_f#|ZPWm3KBAm}Owhv9 z+;5?8ST5lH_Ln4?K1pENxLoYtX@|T}%iSH1Z3!iclC0llW>%!iVSBGYn{|qn<9CcN zl)2wXC|kWIMBvAvBYReCIc4f_j+KkEu!6{*Om*muF;gEn$I5tL9n9Cb@4Q?Txz5TH zHO&2=gg+1JA2E4BZ9X644b#lZCtVcz@-)*aR8?RZoOc6u zP+phByz9n!mrKH5!Rss%ex08Ufa0-{Fxq4uCxk&3b8|rE`Z?G8UY! z;rH*GW_s7mS>k*?KkfoG`2IB0A5XjQ6}-;1g23Pg2?n36F3>hC&*gDW?Up|EkK+h_ z(esI%f;;6N_xHt`^Ab=Dex?XKhoTeIp+HL=&u<=+U4EjfLy|1cT0H=#K1BUeg7UL6 z@|c2%b4twjPs_`J@Bim%Q}0f)GUP9wObEX(e8k@HHHNC1h?LXKSbrxeY&&7a3YIp8 zs_IGJdgPHlAUVrz>vNi}1;;xCMtzJaNT-NE8PY=8Tz@S%_9QbkA6=i*R4dBj+~e5x z(_cPTUt5y{on9^HBjL|MUWezB_|4 zE=8OG4t|ab9tVy;+8&a(mB%Aqn-qHo-6T@Q~d1E|E1Fc`(hx;`o(@{p5$7oC<*}=&;k83QwvpT0)wAtw$OOgncT?{y1??nbuBw&P@W>GT z<%c4cipxq|M>36inoG7)lkZy?UpQy#e`CzGz`~npDW<1)w9pQLVY(nvlTWl8OyNtr zM|QXE%!Iu4xe#dai@a#{Ewls6`Eo&9Yx$<5+`k$i>b(~_TkPh~6BtAtiSvnFIG-ROFu|YhIYD4>y@WhT?E9e}sm| z*h>%{uu~&uVKzLKp$4(eMY***Y9tXG>l-+a&Ho&L@+M$;2FeHvv7IMoeZWanuBE6>JH z>Wuk7qy1$5+NzejJG$+V_ov?m+F;l2j^oqV|6mMkX-=pT^v4%wXs16ib&fT8ON}@` zwNZ}Q(YeFpP$lR^-PkLGF}1tS*iYP!LQscLw_brd$j&Hp#-)rYH%oj^v=^@TX}>vV>Ks$)=Bk7Ep7$1xYm|4!!iFkV(IyjkOLst4MTq2n zVdp~C9hwWv;_RWI2c$;S?V-KZ&8oqG6}jtUbzE0(2d9I_BJlrTS*pd>gAvQD>w)I_ zgRutGkHD|m5|si!sHky|1WM`7`UH<5T}h40|8DY}TW~*g#;Um0n)>?6V#UJrK_EZ0J5h!P}vMQP+D3j>&Q7q%TzH2{0J}l?^Z^U`uK%>Jr&Y%V_ zl4h_1G>;68o2QwAeZ%ty*&xsRs<%zT{utP3wZ9;8JC0o?7-c@FNPTB9@+IrLu`gmT z(Wo2Lp?~|()MItj;O$>4@)=j`+>t0~-f{5F1y@y+I}?>S_Q=n-;`mE=E%SLe{IRK1 ziT9Ne|DnJFIE=iZksA4+I^sVP_hR|Nrvhb7{g_z4sv}Wh`Be16t)*HtVd{^depHu= z%amsNCeP&0`cdz`YT6Vr8@ua_vvL9VDPI6;kTpUyb{!Zh@*Mn*1{&S;@`|IVlTCrh zArDgG#n^gkjNAmqxrC|ne11Gq*b*xSXaGR;J0kZggm4hGnrD#So!N*ca!}eG3Husu(DR-abSH<%5qMZ zoZon{1WIcQ?UUFf%oVc1I@m=!p4t+sLVaoD zVhH=3t#0I_^(aFcd5m>VtP!Ff$Zxz~0tM@Mq=k0$lU(f(DIV=H1+V6PDi=hKPnleg zLmu3JWMLcjQ}^kORi4EVMtT#OU2d?cZh-u?RD$w*WI5;aPA~21=hdf!tVfs-XT>hb{ z$6Lfaj)+*Cnb_RMX;Y6^3OcCQ)Y0QZF#`Q>?H0Mqh$_zO{=x)L!SP>e10^NP)IFX=QD&EWz{1W95immE zr3v4CG?6haumn_&w^8JO=2o=HXyBz%(DutH30Fgg#LUu($4?*H>9P3JIJpMRz zsxlZ}#`^JD6{tbv4U=+yWQ51074Us-?3*Y4ZtAfIX@WA=k9uu#o+mLNK_3Ac*dsyN zuq;KmekDOWeATCMzcC_Wf#9TQKd7KR@;;yM?Qok<+m|r)NeesU41q!HzgA1XJ)Z;0 zIy)yYRx7E&3QCRm%b>kOAWB9>zYP!??FJ}|OEBnjW^tYRkBsTDVv%DG`5M<*u3E_R zQ208a6Zve2F@ZDhnT<2gaYsfk^dX$>cYxoc2`TsqO2@!&*n{48*dk9Y|lIs+3(1^ zQNJ8t|9p?vI;--X6z6SxkFiViaRrFIn3ya@3ii^(00F~mqsGgO=>z{tdz?0ENM6tm z6EOM!`f*HozkYS0whMJVLIa^YEi5P}gjZ*X*ui~559DW-_cEr(2@O==A>>U9fl;*e zvH_gc&1v^CyWAOgZ`>OSNvxTapA+&~}Fs_T1uYdA+zxDi0e7+UJlFW7d z>&8cjmWm@N<+wTU;}DU4{JjswKH0z?&~RnI*+hKy5V8Dfe)r+|v+)&wH}x(8 z;TKVkZaCk+n`MEcgni6DG`^yt_LA}_7iyq#GJYS3 zJhcV@)S;gxnO*>tV?X2C>DmuriGbqsf_8v_F_vWdFo-z0?zHycv-gus_dE$Ukf5*IPPyFl*u?zKWK7TBMLPy@-0d`==8N3Y*pBXe z=u5SsYlDT=2f{bte;9Lh{i|i4TKC2?yY~MQ?^lSjdXni6zHjn;qFq-&80Q1>tAbHe zkL5sFKF@(cJN}a~*Yt;`J}HAA=fiSPgIx{?dl^&I5^zX1%ht?-@ZwB?(SvjzI%(=u zhH^$AJnrgpBhTuZE84X0r10}cS~dXZUc64SvJSL~*7Gx?#sd;4O<#AfkFBNA76Mx) z^Sd^1zPFY}y%(uLFTfU`$&`;db`#Ir<~nl|jb46|udPO015H~$w|s38^6al$LYX& zU*!C~lke$6m9@^ZAiNK0sA{n5T8l<4gn^>Y*g8YQ1Jai9%r18a_VY5)&#Al`y^X#Yvv)f}dA}0Qy=8oQh|5xtH&v z9U?EEh*{#kXYp-2{Q&t~hr_k=kL%^WP<}5^ zj-?lOf$`oMt|JJnt=ptL#&ewfy@W=W@jg1BlOHj`DlkSi>-^Tt1!egb| z0TyXEw;wrc>Q?>!)Ly5LK)Y}CB5m8KsSnt!@{1R7UoKp`T?7nRq7L1kF!ea{o|AQk z7r@BB9RjGgt$k0}&8cT)!1t8Ov5nvb4Zkhs0`5B|pb$KG%tvYuH7N+AP#Vp%4GB3V~KThZ=h%=>LJqbTw_h9VVi` zupPfLnf|VoHyVF=8*{l|kZ4D@h+Fd7M6Mx<_nr}Ro!SKMXBU7mVto(JVUaTy!jdHV zobN-qsL@0qh~JOjewZw?}=lejmW~+ZFmGUZ(43YoFfBhdz`#hi!r&!H*kp-n@0^+3DI+36Zv!h z)DE4oC1Rhd8xj>Ly9Xo~gwSQ$)(KOOEu;p!6rw6X-_{W7+07-fOCgGNBdz7n3*080 z&lI5Fd)m}}Hpr_d5dFGUK0c2cu`3}OB5Ksz97@EJtS?qcqbRHAj|zS3e&BXeJ2)@X zesspv56ht3`2pW|LcSbyJPMt$D=FHX(VsBJeJ|rnXcXz3Jjwm=xWCaysE<_A=(9}Z zgTUuLNe#YpQtaFF`HuSLrL*--F9Br>(s>!Q6=>5er%`Fe>SIs@4ljT|22jr5eID15 z8pUt&&Vjc4dg%08nCas?Q+fD*g!WHwDS`Hs@AbR)h*;^fvJ^QXXYf7Vkp@Yt{o^It z)J_}s&E|W(KRh2}#nD#Cgy9ta~ z2kKtHeSCRYo$~T6_Rnn%5l|+dmb5c33rxN%Q2*ijqbu_92mG6Ptn9bU8J*A(>kz(- zc>nsOsmEA$PmJaCgzUu*59;P<6EwBFfOT~Lq|Uf&)BN?5q{v}BO|+c^97W>HE_#l@ z;G1)uZMc3$WS4(fo*xO#Q5_%s&D1G@GP=_8{mX)Is|?D|B`C+WccelM)?}%{Z;bN2 zA$}&*l3lV@V0g}t{BLZxTA`o0s@i=(CX7zWz6dM zMIW<(ZOMMy%F`y5sXk?awvQF7Ay7b3nN1?1Q5y*%nS{ytUH3V&A)tM(>-R^l%uGm+!0O>~7`rW)==nTK6r;XF?s!2NV?>?A_ zISpJcf4{{19uwb$^g2g%zR8L2F9u@qSXYtd-7gbi`vO4?j(-)bJQwrbnuzy@duKD8 zXH_KSEH{0kPt{lSDG%hIe_-p1=*sXxPQ!-)@&VD6k;pyLeZjHKio7k~0|KMhVTS2F zJ$il-SmY-VjxQoskqeIa2Yh9!o0LB%avuZK6Vwz^j`AMXd1dMRvej9*8P@ZG(6EJ4`8AZK?iWJwERcO?A#@-EZC}A8E_0 z00_BK|7`=-S?Ly*`IFV)7J$@9{Y+lxK7rS%hYVhJF)Lg9Q(>8Zni{NRWu5jvzEoEA z@;>cxf&B8)`DMO*2q|vJs7Zkgmj6^xgS+beWs0B%BTEa*lr+d_#@_@rxU=40R+9-C zN)BYK&V!6y^@U}BT!g?2l5ah1d zutWkm;;aXhb!WQNAW>nNZ@mzDRRpS>r}m z`(%7ZP}S~_koR8?7G8gV*Ym*wMeV*Y#POd|zEJBK7K7#k*JnE&8pL?kujgnzb==oH zUMFZV2eW3KgNxfY&d(9|yUDo-$6^j3FKc&xH{HZCr#QKSd2GXWaLv|E4BC2ptDqel zr+T0MZ!E_J&b8!LgH58)fO9&0J+Yn@T}-!|3HDeC=b@@!TMT2m|nqx!SgK_`BHfLjZaA5{8SH@zYf`xF)r& z_1BcW=h*1*e{Vhiy|!T%`@PP&7aL}knUs2wKVX0Q>TAj#0w}6$SXs7Pfa0z7E6cJ4 zC|V&&4M?9>Hmoe`11Rp3@&c}gm1Wxiibo|WP*>0J;WUQv0MLKHrgD!(xvdh^;QR}= zewb44aVPiYfh%mH*PZzS3=YQY{wIOw7M#d8D8kDimO#Fns~@Q+PJ) z;1&J0+R6geIGUE#!t6Q%bcUTc@yRycm<00Z`$%JR11K}x{h=c-2qPto|By@aMJ0gT z2~b?aY@_+nQc#1x`OIcG_AG~mG(Gy_`#gsg>JYqK9xJ!|GcIq8;6C^wUxCSaDK_qJ z$9GqO8Wabh-0vdR^UPMQ2HzaEbrYbIVa43AKto;WTp!13{lz^H&T?dZx@aoP!FgW1 zB9>2tz2jMqf55c@$6>zN$;og`2yqPctf(l$0FHUprhrx`2ehl}ARPW}wbd-DM$Lwr zkxGD$`Tw+azeq|^e$Mi=<((IxD=f~@E-)KmPPFTNTc2oqo4_&F2VL4<`)vIY?5oHz zvx`L7JLpq`;m2n>SW%wn&{-#*!7omVXYfSLF}L<~FV`18PL!D;e3ncpw`tNO4g2x) zURw{>-oR{k0R}n+7zo!+)nMB^t#ivfZ4jVji%1?i zAc`#q>lv0y(cWH;MG#H_ZS`hh`QSKZxx@Z2Wb3apJ?*8>jdx!b$1v`dMC}W4j1#gC z?9F6rJTh0K^r|`LBdA+tMW3(b^iXwZ;o3B4S+_wMDV3nZbmSG(|4lc~9fE5lJ>iQ|bLniTsBnoIeD^%Z3Ys%y>*3#3Tl>X_&fzz{ zBIae9S!!OM2-}}!c-3lm4(`o+!65gSGVJa_DK|Qu?brP1y$bUQiN*jr|KNhoILm>V zAN}_sTTi|R!lO;Z7?eEG9U>H)TZy5F&{89k@*035lvA5UkV~dON6#a~;C`67(S;%u z(LS#CnMrMV%$4M}1a;rSB+%gFVr@Roc_}}8@41&4*RwT{6aCv+TVG?*ju9y< zdO`9;4_x6J#^&;!x!QHL5H^tyO~UPe=KSTpV7R}>uktZH_?}N~Jt+*~_Fh{bPpTZb zL`z?uh+%YO+wHino)%zxsUs&_8>RN+JHDh%#;>p>K^qRt(8?gvjk*($3CfO+%mQol zdwhJ96zJ%gMXV|pEUVf?T6e)nsZw9d&d*)B-`o&k=LKGlcXP(pBNCI%w=>!N+RJ5g zB^l&j_St$9=P^eqQ+Y4t?H1jiCuW^IcBV|Re22wuDMas9WDOkQW zeNkW$0J91CC6KRnk@8u|qe^c)_lNn zqk6GU)iltqo<_?qFR+1z*!Tzw!*RuW8FZ<9xxK1(y3U2;;XQuL4So zUcJ%>dD0xxLti@5lO<>@$F&ICKj)8`n8TMie^sZd!NeRE&H&A<<~a4&)^LAJmd8(2 zjpj){nYg|S{oE(h4`BI$Snp~O9s(%AclP+y;Ocs2L$i9eL-_aKh44uM2I_ijeR!6j zp$wDTU&^o?hi18v9|st|&qB5PtzmltNA739WYjK{QBVET)=_ThuxSy}d^pcBFM1e` zeKxcA%o3riZi!3#-gXF^)janp{(fPQ`)Ia_5L%rAS~ye9QyBg6MpviAcC5az`RG%d zNo&)=qW;dAtvfg^$_|9Z>;{zOneA{%l6E4_ZNNzHkHu|0vYE85K3LpuT2ww?O^k90 zT0UjG_W!jPiO>~Z>SA)^mHVX1k~Tccr2)rq*$Y=+rxiXnlVPl|HK$&uwZ(Dm=HWUI?3$u>ubng(5f^m4CS012 zb^o;WSiLfWe0+E&Xcx|L*%Wo7|LV2%o(5u6`62VPGe^A)M=+1g)6f$T#yNaq(AKeU zxHr}M)nzS%whj%BA4adO*QS7m^Mv%hDmk_T<^QVln~%;LwDseZdOL5CG#sNgF}uHT z@pbImVC8ihq&M%lFK+AE--Ynt^1YYQv;;l-oUGHt$N%o1LwJI&ja;XFUx9GvZ>z2I z5(IGk6+sQ+`iY2_a-zgs(5axz`)YyKITMaVM6gr`PrzKjavWLUg3e|)EJOZX0iJqT zRj6f&FtEDkI!(z`cUX%g?c#1x84QC?v-?vn)?ZTb?6y{c#u+AFfaqIF=H6=1P% zedjvnPx+EataSo(`jQ~@>kN?1I%53oZV0m+lgBbNoCAE9(sLcd&|x^4GeJAO9m2Uu zkil>V(xIbIguUBtn5$)h+MNe#cT*FzH#G_EO<7>!I_#?kYeSst5Pj9eYIbv<#VKcO zz4u-gBhGSA^v(yX|5IDr!IjoOg2&v<*g1=fG!$baX(``7bai7*2)?@EFUp9-NGo61$O`7J$n z1L}I+dnxr!xf+)3PlwQ+Au4}=Gij}i&2RBt&Fv*ssW9&@7i7fm29{qJ#|y^}^^4Ja z!Kx9V1)u$%QZL^Bno{ov_Y&)jloz1nMmBC|?gb0wqBzPYcW{4L^O2PH#C$$Msn<6b zLgqy(SHTq4H;Yp5a0Rh0O4FI2*e{$jDV(2r)YZ1Sj+i_?kYNT4E*IK|?iSmJ>!fz8 zf$yKm_#tfHEV)6`S8(0nDM&71Yc>6P?f$r}Ul5=xSA+rU`k!?l&n(w+U%p-|hse3- z&e;0>XE?p_3(%Q(pZNqo(@5Y-nNvY7?y+^{ccfe$r$tWzlqzEEA>RxL2{^Y&YS26? zJjC)3z5jVUw_zzOdj60!f$0`7ZGCjNq?wPCvY9Tm+xH5D%oF(B8-?`nj`tshaGd4) z@kIaG$6~&U&$G3xc4zh3x(J@bD`0y6s}jhrgU#J)lG=R$)b2&o{=8%5qpoK~5xT0> z>$Ppku^p&yKW(x;W%zO-^ynCsmERJ}oDY_{RnXS;*m})8L5oXZxzj&iCVD;V-?!htq)YA@N$8S!(a%nE{x`Us%M6oq z0gr!`SahpPyF%9QsOz`&<)*Daz6`=boXh)#=WMTuywI~iOT_9h{_o;v#8_{>AGGsQ z7K_oyJ;%>4RDcd}slmEF99pP0RV(8+g6pyIg6?Ht>Au1V(0 z5Ufb%Iiv8~ST51;&em3c!gQ9*$>)kn0aMS#4et8nEF8chYO_Z|rQ1t>97d7iC@9_Hs)_zjAK_uSB9>j%YuoeT4k zIJbo)@^nl~-qIZtVSv`nJq&Db0nahe3)+Mo#Fw1FOzB?N%k7l7c1762YhUePOb0RrkiQ>i{-3s9yP32m{JGCd z+0k2uY@Oq~koH8}8TNfVi&(U7ZVNlR2flV#{`6jUKEJ*2{8FP5(o0MUZcE_ZfQuL; z35xi9a~uyAn<|2QRD^+MXb!I4%yTl=rV!(nRxXp*q!8ml=IaL;N(vbBH$B|SFc}AI zJyJiP#U4z?^{7n8^%4$N0Mw&=L7ZIJSf}%2dm{H5p;TT;w?4U&(sL4^j(>U1igp3y z+72gY#;ZJ*ZnsUDZeIv$(A{V2ew!8_q13x&_Q4$oFD8}Z9{j|iqX}E%F%brk7N}R` z6&hY7XnnJI9N)Z_DQ5WuY z@GsOJ`qPEq?40@2Oe) zWew^4&)?(w80VD9_j|vt9sVAKEsKE6#E>vzgy9-f+Od6kxdG4{+R7CM(?U_)FIb+I4Y` zIW;lQ-<_?|ep|=7jQ`(%1^@pN$i*nn{?>F3}5>esb6rQSm4 zU07BS_BMLn!#(;1?Xu`bSd?i{3YkAuA|0BkS3{VUp= zKZLN(ee?|_g&4gJ#PEYZrN&K+x@n$F03pznPC~-^t1|uRYTkj%@bTW5@U1KS2FeQ} z(V*MTMI>yd7O1lRHT&4dz5xg$RDMb z+hA1zt@T+IV%9_C)ypEr+q}Jcc)E@+5O7-OjrHi&hiGAztWy1LRXOhT{!P2 zMHqNVfW62|S9j0X!rl4W^oD9{xL~f9!0{^PapA^k5$XxIsTV^7$K*mf_xNdBFO;}n zWHzY5pPlA5!1X=0F1SDoXM(m`6j~IKl*epZ{Gb3uNUK1E?X0g$(zL==)z;*=e1=V|b?k#uK+50>EVIFl`x)=5 zyh4T=+74kw1Pf)TnJ&nvO#uU5FKn5J_g?-=`*}%9;NC@tB+owEdOa4Tq&@#ZB}4bC`i>#78u zM;&a$tIY(~Y1QS}umbZ%ZpV3{i!zvA^+n}yKDWMS>sU4}Wi!0Gm;l?c4qSb;cJoKJ z*G#Hv@40GGdtWs%bV_v=6UAa$xLgTW$h--iEb*;}zA1u3fog1JVbSVLzD29Sl*JO^k#s8P|jfQ0$+CMKO6k zaL%$fRa=o1e#TvsMl80sl?rVwI|uX!V3Th-%6~bac6+&BU9gPdwh#-}uN{er(6KX( zScR+BmZ9#4d-g1V+$=ybwm0mCj31i(+%25>OdiU)*j`O0u{tT${bRIv%(?$BO7+Mn zEkZf;r7>C*naOgP7KKF!p0{Yx$w~g!4}ZdCwC}6**&y;E24;dz4hmywgoySoQ&%8V@{Sy2whqoD*KvwducrJn5 zQ~>2j7m*g!q^Ut)Lu}Lm--{Hob*}I)oGyl=aRCCHfBR;^}OaCEHBd)dd@2R z1~-(y>F7uvP`h7>b6*R#_b%RQp!^VHJfPYV$`}rQG18o@8;CUsfHc30;n=X}U?k`Z z%0VhXDar|PK@EQWJzHNb5^K=GTE(?>jK$VX;4MZcuoeaA`bQeECgUx}9h%aA+SZ#l zS6ir0`loR}h))1yQG~r!d&)ErVK2i0I##BgJ!R`_SWIJfRK1zUg{wD%5qpocoB3cp zEwZ(_7alFwKK+F0&z5-zw3kCvS5t`5BdAaI<`av&?r+&55^K>a|A>m;l?=t|HN+sv zP@K@2te^4xuec@;r-B@t3NlPlyWjcP)^n19<=IKZ9jK`H(_Hu30S*9a&;`cJWu|w3< zYlyY>tgWj8bUt+rnV{9(Cd+AJ!~htk$tM>mAHP-Q+Fo2|n>j{qVr+MD`EhU6%4r(T z1CFhB%GQT|S*Y!y)Qe+4Mfj{YbL$S=)5wp9x6ISyc}S5gDRI%4X**0Ep#@e=$xb(u1$RYdg7vz0n_^vh{vSy@~O?^+Q|# z^b4>t2baIxen8|oo%#7D1QKzFC_gZN*K4_+;@?zl!3``fw&SD#+pR1?%YAmP)+2cX z4vtXf4X3!CQB0}6Uxd(80u;R_g3R_#!cQk1LdrOmaUVAGvy{DXwpYqd6aPJB+%y8g;#H+;_OAe30FMdVOy-F_eXn2`*UX8<9d&T_8WW zaLG}W11`9r1J|^gm`@jk{th5JGnIw&se|1 z|Cz+vYjU~hw8YvduQi{N}+em4E5b`RHyg9-V_lstjQDV^|Xa&rF!67+Yq2!XJe z9pD%xe`p^ZquW>aT&oe_I3+nut`yn%ir2xp%R_yE<-8FX{~!MhxJKdP^NX*CDd=pFv6DIH0$ev$*<)l8E*1)7V+> zUO2f>`}!$%_S>N(;^2$GV9&~K(gF_M5@2s;a}^jUR~>1Auv!JiHk;~OZK|8k^0Q7> z=YgBFr%u^AyMFa1E$jwvDVCjBAg3`WjmMW%7xj)ihKn+-x6V z@<9z^{p@R?(=QR^C&kL7_4pgE3+#oNp+$j&o zZr1KRW$XE~p!olc^V~3NoH`S};r}8JT(LyTm07@ig!cal7+?RR!2JPsCUN=SFF@xU zo9fd6tS_;ge*D?i(_BU%EYBd%KZmmS^vAgkW%|jIk>hU27%L^#R!Y75{{W!_HkJQq z(_(+pB)^1IQm$r0(MpDGrv_(&+Wi$!gI@>m__~CUk_BSI)P1!Ui1A>_yVGJ)q}T_`a9)prs2bC(eE zXMnuh4H-MrAOmH9-mPF1ZX&Hct;y~0w}COM-`0CtmoR%y?^a^G-$slfNecKIYRlBu zW|g@BJnA%uw@w42$^{xeGc8&?G)#-0I#}F-`iv?<`F=N)AG=6(4}i7L;WJaN1_Nb+ zpUeg0v&3&VfPwV;C$qu$IKhvuChV-?#`kT#$^{wzLo-_n57(CM1SnQgiA5;ws96LW z>ienvwmv376zhE#*WlGWPbTuetkbq0b3^CLBsxROM(oTMl9E=@-ohk^P@SZZN1Ow@2tUxkM`aMRx{)uo|4Sl z=<_DGzxR=?_j#AJ_ufXV$f{W*Dv)v*qDAFNpgrpX?F6OX=df)j4>RlIHV9RYQF&t$ ze_n$$*U$FR*Rk&l{a~EtIXxR9W0dc!2Nq~Ap5+*B=CfctMyVI~_0K5v-Uw=NDc-+F zi%*F#Fe*UTbP)zN4qmI>^{Yay{E3;Ghxx=1LrsIC`)!WF{P;M|d2S%jkuyKy7==aZ zb;JOGdFpjwghgWYj#F=^NUWiEXb0*7Oy+q7LN%1K*fu|fl^A zIPYuZxrzfwFMfTR$`R*1k?X+d8mC?%nb{Z1SG>Ywe4V_m#Yoo*0p;;rd#%U*h^K~}W zCx0KK&$Ee9DMGQJR?n#bX!u9~8OOD4oO+wHh}Fz+OTE$DcX{r4yf)tB{)*2@#6q2D z0dQYf?8}qm{JldP){M-U&HLXYsuA z|I?;AfsxW&2?GC$zMF5^de{xxY0=Yg-zQZ55y}lo9Q)$KcWga&krp+lCcY;-+V_sF z`!CWW{Du?!tgmZu`5!OCLLbj^@XwvI7QwFt<&SJVGG(OnA0iA4N)Xt2VX09m%r0TJ z-(Jv~rM-;@PBPm^alD!s%>MtvOfP3rd@ zm-pM80`h{lZC(8q(p&C_!DQ+4OAY_{RVC(v|Hb}q^SF(zlm9E@ozxj)n0 zAKChAlzK1Ost-?KK^$eV29td8Hj3OPz2XucBGcc(pe?!M5*A|XB)_|e00XOM!VyTH zt|=l|{}7?;0;L1Py`Xh=e^om^bD_3IuE5m8r6FHQJQ;26AK2jPz$dVUS1`iGP4wv%G%dF;3v zTm+yGcL{QP~pg5u%MvAU2>bAu_%I z7K;s+RvfPYu*MxfYLL|K56?O|B$L#j;syh5QoH-kayuxCslNaR@X{L)&w{{0InN+PYvF?fyK)!0b6ygJde@1?m%P#RcWoWVsaJw1>Q0M+7;PXl ze9U-wbE+vx(Ly3*R05Y_*POMzm-;C1oJ`I+JovW-ce<t$M6g9g^d8G(NYqtm**28(kef8kmz|Q4of*Sl*3xv7vO-{5H<)jt}C$J?r zEp@(I1cPBMY~*-NF~?V4nB<4z_p8Agk>Q8b$GMHqYQi;^3d|NH0x7SOpeViwv;}W5 zye&gX0oyMuVZJI~LmHS0mV*UZgwJ7pPA0yaT|+Kgi}-FOh1l%O=BmrjY*0@)iM(ok zPG*e=#yQsKgO{!EH*qbC#3&?>1_3gIJ`n10U16Kaex<-nYRgNk*%~*ekIj^JOkge~ zasQn0t9&D`P^#zpm4erhrjwci*caan@Pp?~2@Z=WBf&$@U&^0!Dev)vBC$H$psf+X zia4>gJXcayv|%legY`M|1ZiEHC@@U_h?~XJ7ImcXy1v;Eir75wR$^@*5Mgg(eHS`> z@BCH=o50Jl2?n$HemKR(0?K_epb_=S15SLt>An0c8+q22lPm^OJLm9?OSy=+e~jcJ z1|$=!GWk$m;iFQ1*7}+eeE07GINkp9BW~9Cb2F!WBR@X(LNUcAw-`a zrwr>0$1pCrqNX$@+II=_gO!=^QQ0WAKgn{_Wk)Ya5a@C6o=#G#$C9B_ag#Zy@8KHq zO%odaCW2g(LW~Lzu>6h*e;q%{Ns+0V_s*L2fPVuIAARNnTmL}{^A(BS>n6q&P`fEi zX_)Q8Idez7@7Ve}HyCSDINrN{iscr|FgKG{h=KO#2VDQgXWLJ4zk78TXvN1-J|o7# zlvrNXNytZfQZ?}KQDIf>NOLAwo>enPlr&uX-c%(GjLY+j^6~%k`tOgd1nB&Q3$#;6 zgCd~aK2CKZ`9$8M>BK5jz4?U$4m zNM~*ur+ST>7yzYQt?IHN3mBDG?ZC-vIMPgFKC0y!MNouTlaY&^m75^ z_#$Fd3Q%NL6T|oGFEih%LdZ&my98 zSf8Zrr&LeSz(T(o1Rw^(`~x8cb*P;JlbgFdi;1Oj*+NH}{4%AwdN55pbcUbfPUZ#3 zV-y~X(glyr)F%5?9%6LxCHB6$2NJ$)Vl;uNFxjuZW|E)Op0{lsMw*VoG|+aOVZJC9 z-@94Soo_q#Rml^*fPm@5#cWz9AjKueEX(FxveVo&^wj3ynR}gEpD6sg$ z!cki6b3r-I0gk;{P1qPudUMrQ$J zCgLSmZ050GIOk-97S*C0<_4{DeO~5HfTGH)9qh7njyuWvAwv0iE_0WgHZAUOVl44D zallvhPfES{lY9V8DgR&M3~;``ue~tgVl`15|Js0N3q|#l(8HPCB9-CdN}q zDEC8A(_t{wB$S17>V-m(I|CV+op&W=4rM@5C4fhHlNct-XGe+A^d^=CLpebVRpRni z&7rDt-F~sK{cppjq=mBlf)zz=Q25PL4lU?$Qm-l*;dN z+(v$%u=A`;*1pN?>)z<#0N_vU!6$n*2eYXw?+KAKlVcb7C zq|E2o@q7}Lhd~Xly92Cn5*Rxty)SZ+%IBrrD7KCAV2#M}Qid0R6<-Zu^_;KFbmT`C zndJYo=PcJXt20rKZnm;#FhNnmn{pay?=!qx%mp2v5qTQe^v{FZT!K!ok! zPu6Z8r}|_+fwNb%@f2(0Ue*TI_s3uvwt?j#_tp(R#PL5_v-tzZ7KHU?ALnO{9@rC9 z?f^^0@te)hD^Txl&H_UcU?5k7?R7DqmU}8iD*`p>l}NcRF&u*O$yg&(1zanaV~pT? zD>ezC0~VEW4*&nusZ8c;0OhURB+%%%#QGNA;9Gv0#ZY_dV{VXpByW`Gyvd68mV)&L zepe~O;wV-`Z%dn)S052TuB~5JRyirhz=tl7E3fd8xYY&nicKt+lw1SEXqLdhu@Tlk z&wR8FB!N76pOBBK?BAva;gJ^`+eE03^;5QQ)P5@O7Z-=rl*$dl8SZ0)`#mN?%G%G8 zN)9-&FTE9)<9Wdpkk|gh*6Y$i%ayz>zo68+U%Z`R&*Jy}Zj5rj_6UzD0vGPzUBM<1 z%CVnUQR+PoCrhyGuM%bN6WE!w>BKPOeKREL?qt5%O(OJH0?0Lo#Bz@s34V<0f8o=D2*(O56tpM`! zK3i9U#A>dBjG7%_6t2o&UeA65t9A!5c5dF-DuB=esv2AY*$p2ee{w@cp^AE6!M+N$ zUPDe`at>Vl9{iRywbBvwuf&K*+>c8AD;UaM z#6o?W`FWwdHjh}3*i^4QC~7qar)q6BWxfUmKD&!pA8ZBY$Dd4o7BtzIxEkh)AS>S@ z)-EjbE!0=kpa5VrKTQlj)D}Q8*s(;My!Q%yUjX@?W48X2AhCXWcH>b~N{W7MjOy(k zSIagRX#Oc+MOOV_A3$;-vg(?BeV@yt`x1*|IWEHXAt@(%;0t0dnLbhN#Ebzk;;!3q z-S0&nJ%2H=YQDv>b(>Q`-Zw_|JXl|_14c?1&AU&~1e@xnlowc!-7aJc;AhO; z3vJ3U_ft=Dj91u1TFv=j#SWIXmCq`gpQq&-xc~gBm0jc&4{Zx2ZlNLGo7e7^ajTy?KnX zb54jYY}vAzwE7^oefJ-vRK1-Jq#r?ehbdur8zL zofx&l<5XYc=Jwu2lXH$vI$LaDh{rxD9 z4G_|QT!3Q;vug@I;xw1p>5#Uby;l5@a?hpM#3%k?>r>NzT+nn6SWT~i(bNrwQbMfA zDAki^|FA&0ky!sZO7-+YrJx?^X9=xQE9?D{q6L1UN2b2;1oq zneKh|+NvK-whQ9-<2T`+H3g7yJ3rVzUjAcc>o5Ww+N-7G%aRscHw z+LQ3z&Wb)Y{srrn=cEq|PT0sH`W@KD?D=6gg#H2`^IT<@>`HS_*k1m=oD^R&_oKl! zV;0p%Ey{eyAemS*PjEjn{|V0fBXDOamRr3Av|*bv>~4JClm^U?!<$U3>=PU_h^?LF zo$U!9(U^lX!|-Jqr1nush+Y=ce@BAX66?=LY~5@CBbGx9Q|I>X6Pd*LhnrZ_7ZdAP z9x>);Ei#4xI^jk&DBP%aV>z6+@Aq)~fKmXN<~lIg{}wPxe2qMFqG%Tv; z$4XmzbYd`Eo(5vn94cz50?%y;Je?2D*!orxQmlsTMTKZe-W{=DAnB@ z|3BDtcve}D!lTlY)Q0g!+AqQmRiIim~fC=+!CB{8s5gyI)b$7vzP>O(VIaNYGh0Y=7g9=q4` z1YvYX05!Np6mP@v`N2_+%Q7f=0vGX{85SOYSC$JhdL>T)$1dDNT9L1BI=rc@=1>{S z#bQc%(WZu?vh|xuYwtQR&a{BB5%;OYFn=uo?>r)bv8kb`Y{TKzWlarbW&Uf4)i_S| z4Gm>wz3Yf^riB>M2|I=R3+xn!6LyO2D0e076o1&peH(Kgd9iUs0+#Q+{GuAnft&#D zkp<&wF#nMk8*#7XLw;cTBQG`%?-sP_Fr8t3o7LQ&0p^RrJW#uF?@*e=@)N#1#^q0+ z#A9gi-DU-`n9fptxy};H2l>`+=Et|!vzS;niqL^Hil|$Hiupog1waGyg^g?pmTXgl z=FS%y4~%dd21x=7`=2)rEbIf*@p1e&s6o`PYNoQ-BO}M926NP%jlXy5;cvog+k%z; zosEMjj7~NbPJ?Bx^vVqpM;|*bs(GNMFI$&}@-o!>Z7N@o@&f>Su1y}waa;F*pdsz3VRl(y{_AT}P<~c}McW{p$n#MP zYVd|_5Pk{QcN(z-!NKA4Cu=36RL3z{RJ|oADSH}SxyhLqC2w>%jpZ^jsys=VZ6G!* z8K?3V3H2wjf#=(hSdM_6Uu_G{gguS;JIj;)t8GDlY)_+#d_^S2|4EGdRm8&aR&Y$y z@*0shZDBlNTW}Ndo5%}|D*zg5m~I*g&KcuphM)-SJo17xJ*|)^MST7@ zo9f@e=l-ohR)>wzT_bZW{!RjFFq=~5>xI{uC@-aeHOSAg`J8nLS}Ubq?=-L$QR>A$ zj7nKiLa8?cAdK(13F+nR=Yl6kojkg>V@D8u`%3<$F3xomlrgdF-$p6Jb-;cMj9?|Vd`L_J{SCOoa(9@tlz`ll8HXvkfcQ{CI@b3=Oiv-)WE6|=2Hy5eUr}&u-)Hp z+Ywy-$cv3AgPKxSAd3C=lTd_G+2_sXIx!%kQNDnn%r1I{>*a*)BcR6FDxQPKmZb=Qw zUyj_Rvi0^{@c&|&6kbM=R+S{aAs4^{rW#ybD;>da`MJ~XGnBXaJ4$u@&PRqRmp=k5 zmjH_yiEMj5Xg=~{+hc+YtmYJAF@F?LyKe*t3$f;4Aw(LP{lY2p zH>bZiZWY5+_qee9qrscU9o_+IaKSj$1J3vTewcO&gxf&==+yoCFx6|sJ4b2~v~rrr z&U*1#0H1BSbEG-3-dBp+G1Swh@w2j8N2mJzw&&TpJ|@C;T-(JgUOp>u&Z4?6`SNv* z^MGp}D3#S)h?Nb#edUxg%vF@R6S6jwYd4Bahr#uM-?;Xk_3cvvXX^@8O`FYx|nyTI~H1Iv&7{^`2*#QMQ|GnF2D7MQohPK2R8Dky<4kQ35!RTY|eRmd{(C2jCI> z5hgn`Tl^OB$S||z-yRa&!1%Fl@wJ2c*_*?T9mK`s8Q9#tDrygo@VEdaiQ!HKe#Yj9 zpA{$)F-*ZJ>rZCBWURd#iS;tB1IdY-mB0{k!61G$xWTEv)28yqS)grX{eCjI#=1n; zm~HAtV*T*~>Z-YcAK|lf5)wwJybs^eBOa*d{!4DHFb zxsR>~`|P#uA2A(jor8z-ZLrpe(8+u?*L@z_rt8fF4u4h@-_7tnC-I(-t|#`{Yj63{ z;PN;3{C13bAzAItJ#Fi#E8%+2S=x2LEje}ugy&rae+_Au4si@1;cUn!@TGnNxec$OFv%s5=(+1mfy*0voRV0%f? z2=~L@0g)2alOh+WK9wj1Zwrr>n2U%dsGzAS#Ok0_wIyx0Z8}n@wWi@j?VzK`vXe7xSl}S z5;TPa0)6#5xz4Ei6A;jP)ojI_Ka^>KCYfkzG%ZzB5Ewp4SN0lkO~eIgMDo6<{gTh%p1y zAZ!Eeckl5S;azFK&LBVmjR3UYoeY-ZB1W484Z8)9@ABnlu8?v=d+r7q`w07qq23L} zYtGTmw?*&(WY5b7wL2n$f#0np6D$ADO(PotI-g5|j8AYZc7qmQj=Y7Rp_-Bq?Rg@# z{kd*_ejZ;=tm40OER~)oZfoC|#bQ5L-oOaTxyht`1ql7S0p$E-Vx=6l^_SClObPfw zYZ{`CT`W5~V~py*!EyLDvA~Jj!gu0a1L}|q2(v-{=>kpUIkG^6&YlXe+6D!l7o?h4 z2Uu?GuV}aZo!eruKNE71N78OM#cf|?1{jI&BEH;AAIcAIkY9E|$Hh8HGo=~PdxrSB zoldDP0x@vUi&LN^mPxFi4O5-vUY7Es!$WvYtZ(8vuOOCrH?iv8v~}}-Vnsygh~*J$ zv-9kGZ`#ZUx9v2G0qVm3!k^PM>~kTgJMbIUzIUnbCn)vC<`L`1PW^AbY3s29V%0nM zx4y~e;@LNBeJiEjm5Dx}uCW!rBR~4F3&PlUerBb1$5#{Ur6abE&wkO(agCAA3g)&T z%)qe_SU$8(Nl3$(pHc^o!-;XKe`7d7`({LMVDpzB{mlicuVi-8t&A5S4UDZNR&A(ZV6B-#x_Tah8Xv8m#5)jFaQDer=5E-*#jeI0Od!zn|M4 zWsB-dDD`dx=^ZnO@k`|ZT(KE}zx?1Epwy~|r`59MrvACze2NlFRvz%C`A&J@aP01ZSa>Uk~ zB%bH0?GXsYSsr0wDL`#O9LFk!Smym;vAk4^2=b?XP(ka=Y~4{IL4P62;S%##C@pki zFv>^y_f{lb@bWqx=^EDDt}) z)>d!TT{oW7l6|+b0g3F1e-RtHoeQ^zf9b3xR>tdK0Me4 zwk=f?t9Lo~^L}S7u}-Z8tHhBZ;~NP(TX|)a>b=W}B~^p<&RVbzVqcdN>;Ch6?*_&> zjp^Blw2|x1e;(oay|y%MZ0)%htU5_->3t-%-ISy#(!R$>sorxhv3ei5tzBuT-3O30 zPidIBuVxzGk7F)}9!cKljv*dPgY+mOKqsRm$%Od;n36Zja>{<=E84ZMv)B?@;Ghf=U+loIQei?lN`Db^X+Qml$tQ?N|>=7QTO^)9#$I z&2!lr=z_VDcGWob&NkxrB)?U24^%1zH&g2U-5Y!z?|sA8^GW{F-@ak%%2tRbL*4VB ze$WkY@AJu1l>(HZ{gq0=+Ba-HnJ5JV&i(N>ZN~fX`sKqs2OwTQ^MO9r6V0}T8$n(CjHGOP~c9%`P zNDq$ABUXn^y<@{v2c59|@%0=>KJY)oR2N*RH>yu6V&St{%URC8mOVE0Cicn-2^uN| zkYm>oYugZ)PkO8QT(B6lY2_Mu*VcbcskcXffvU%5Y9o&P=RHq#=!5IY-+6q~ZzKr+ z#G$w8_$>X$1%iuz?O8q-NULysR$1^B)>&X~`csuUn^O!g}U&57}QCrL}O zsdvtFrQlO%uYUS>o5|`QIb~6Q^iNj`U|;+mI9YSg)E6p!z0P+>2dR$xZ^1-NLVmqp z;=W$H2Pwm|OZ={gJm%v+2l?8=GCKyTj_ZJUeVM*=?nCz|_DzH$)cvrnxK0crK_=&) z5WL&T$+63+pS>%R+STBv2~2=Dj3!Rb`4Unww8wB?yP7#}9?Uuw&{ z=zK5oY#g^0v?BB$FHjlzb0w(3EQ{)lRyaznb|ELPMn!Z~D(SxK1TF z-|_F~sP2uGwTwAD?t?cHe(v7rV}G-Ca{-UfON=**b!QKuU+o=XC4L~;eXDE0cDfe;ZvcE?~@ z&##Da!0~zHdG^G5zX0;iG@i%t8CUadNlm1+Q-ntR9otnJt}VmyL0J&Xxj_wLIc9&j zgIIsvw5b)x;fyb}ed?+ojQAUVFj6AGZ8+Bg%Jj4y;{_p-9q_2fX)XICx_zs^CW!r=W{z!XNi$9HcSm3QPnI9 ztrvWdA6yPs_``nc;qp#1hL-)sl{#M)bGlY5J;kI0`Is}N6-UJRug6v0UAkx`>DU7+ zza6hry}j+9vdwQEhnY3B!e$Myi?|2f9Vvr zZU6!Uxk&s?ll~1QbYD~jvm2nqp+Fy274zt6ZvEgGr@428Qam1k{5V-s_P9`$iKe|J=t3WgXal8 z`LtG&nkLE*L};%NYg#K#4V>hH&(vvP0;8kg4Z%B+qW1ls+BfYdGf~|*vji(}9)L}*)ea^I6(rCV0B4*y@y#b>QO zDdXMRVMMPyMe-WE#UA_9&%`nWp#SnUSM0%mJ}Ui>RHt1>xz(rQp>DPL*H3x+{3}Pf zh{wh)q08`2E5%lOp#+o_cl$sw~_8$H2A9n-o2+M z-RqI>z4qS{JJfmUUD-|*tmervUa<&eSKM}=vh=Wn1AZiEUKU@+oL{ICOZ6h^_x|Bq(^tVg-oTueEX;;X<#Q z=lM>C8<;cf%Kh^vp6}vBEptvbGejo6KYX8Cm$j<;*>Yy(?pMCC;ak%HUs-+@pOxBlFUW z;iPA)0v~Dq5ia*0vHr8n;rVb5JKTzW!mY2o>k41F&=W`=U8)G|EAjUYiio!z*9ud# ze|Gy(@klnz@=ge>!bh`N%{~nk`yZ8Y>%FSvx*|R7kvy2Q-j%ubr&RQvp>_%VtSI#{ z=fQEUNUVcFwd{(`ewdSU1$s2-`%@A-LewMRGmjnR)}tD$Iibx+-8I20>08AxqMd3m zDR6=OFh6|9wSowq-M5`x=l1Pizv5cOg6E_#bxbQu{p595;Br!VVh&U>=fi(+Yj{3$ zo^qtly57$O-qG+{*!v$=5@8?owMS%3#^iiyvXRp&^wuLZFYcKsFz129mOLZ6a9Vq* zh*x?5_RH_O)@co?y}M*g@yG+rUISW7g@W(lEg{?MYL028sct_+TmQ&;@T8b;tcLn) z{~Hp+^5{{1R@QCw%6-8rm*njKIwJQEsgo2(Ufv}+trTU2@KbJhSNcxGywr*#FM9WB zkD>dIzbkP>ME|eIHoH9=GxWM^-2(ImG&o)k*8ebHWz52QFV|Ddy+NP(4M)Z<#E!_b z)6AYu>wRyNwkP(S%num!@JVBTWgF3cl{t@1Mc?Udig{*(Vjf$on38{_EHz4VPg4bVrl0Hv1slUZ_nBY19-V@F z?f0TA`?0B^s&@c!jz;o=zB#;zIWN%n<}(LV(bv(W?YZn9+=^Wb=TiFrN~tRiP7!A) z8^N;7*!5Bm#x(SGufDhAtv4!@<=HcD7k>Zcu`zZ5di!R<{1(|%*9z?WAsV-bcDdsB zgS%YIxRyC>*TNZ5uu*{#ty`95{^2;co?Lm?*cLzXpS%El#+A$op=stLTm9x=j?42} z(Y6&?=G8~IHTMQ8Ik)ax^PMrlDfaiwTJ)v9bVTmk)ORrzR8~#xxF&pEw0>Uw`?+(iA5h=c zdUz?nm1o-PWgfVg4`CEvv0jDUG7Dxa=Rq964N_)ba6A(^I4Pu+5yTPs!6P~YE?S=T#!=K8l>YmJw)`HKd0-bVB62(R4ZodG@A zfKD3IAKZn`aSah#2hBg0e7I?CM#Q(v6}s^7DX9~e>~gJDqP)`7Jq_r5?-aMF?lh+R z{4lRM&aH?-RV&xSl!G&bF3sjq^6{3j?tR$SFv&Q zCe?(;_g42#{#jntGg?XNtSq?ElLhg`a^4t)rtryDNvyfFCC{P$<*NcqFoHiwj?O!$ zAbHQq*jTThIlVpzY&2w{SH+Qkr}FN-3!NmxyQeV0J4LcMbMLOZJYGc=yBETUDo0S0 zR%J}{-M|96UOtz;J3aN`osxHj_M}61N^Zsh6^CiRUe&VLA>Fc3o0NNeKJ-7o;#$WQ z?56K_-d}B&!WcTpc`(C2HNtstSS`Pu=FAw)o6QAgNxZ-uPQorJG=A0X;Rh>oVV7#? zYthgbdwa1XFgX=$yxNPgjx8#bvdv=lpgJbb@b#CapSr~_`F+3nvTGgE5NXp84{Old zEYOZ$ovJ-^c9x zfr>Xdw-}6Q4iMOexmDdhi7nhtbzT;$W{T7?Hh6jY!#6Xh3Fq>dx>e{ouL#TofzL$y z!QDeLr(k#k%y(avzD1fZe|gQddV$KxxMd-i>yvY1{`;&CP{w|1KIXJRIovJqpoL#A zO7*i|Ifr>PAHgd`T)4nhKx*I6B?9B)4z;LYzWG z&XN2{nyzc*Ie(1GaT$HZJ35ci>gIN9_T6!Lyge4+Q)fC`CKHz<6Li1i>??s z{nIL{2YqJ^auysL|KS4tG_Pz~Sy<5W?c#z$6nZ$Xg^|g)DH)#+*^ue^!tb+D@@uIk zt(i~xeKhrK?#P+>9^QDy*Yk!k^xj*7V>b1U3MZy9r!8CdGu?mUd}HY9S6r)YWkr9v zCSuj2GC!j3 zB_104%bA-OockRcqkgCB;#;k)9qQgtvJMSnO1yC_40UI%4@bL;q0@cjARn#wcKn~W zT&szmhcOgdRWa58CH_$n^nJ5nu37{$aGLj?Ib7ePYQ|8bD$hx4f%q=~z1h#~HXwd} z5p>cKoA-v3vw->;Frp2Z5&stjdZVA&b5K&>g&Fa`3HdXl{ZzP9E2{cyp~h1M z&{fqK3b(QjKuwNX{+>g%a0<7()~I!T&!Jl8+?sA`P$~ye5t2?OexdkK>kx%>hGk)Z= z_(lEU*3})P%j{ddx?|~E($1ni@%ddLN6+V0+E5!J%?)Wl|-xM}46Vuxawf=jU zQGZZFqydO8nF_soHS2ieMs%)Mv2g~Bg7EPrb~~n3mBW{q5i+7PLQj<9QDf-Rx4c*i ztvEIBE$Mgj!-zh3z7f3`M)V=Yhz_={?s((1i;@FsFrK)u8rMWN$#Cht1!)#r<_Ym_H=Fv;fKfyL)yr zJBQgX=P;YYA72CLbw1>m=fD_H8w}>6RkQj@p3H*8U%oJh*=RlW`DGb+3(kWbKb{Om(Dv>6`gnR@^8%>ZjC%1 z)0E^-gSD^*WJ3hW7qOn|0~Nw{riy>-Y*gx$jk;kVAc{VM6c!KM@ROnegW)^r#{)ZW3BEo1aNpzJKi^us@f#3DK5`H8-=P3ln#y>F%!tfTLuKVW|L+o^4? zh&3l!)b58Ju2QL&!%G<9y30wbFJro?a)wvqN;|?U+ zHR11Fho_3nGqZh?PxApd_!%3EwP1{7i~gqAgN1(9xLxp`i?Yvq$F&TMJ#*I{*P?ci zUDYCDHVPx}iMr8qrDy9f|4oUPEc`-WztCJwWsRz4Xj#RW?(p8L+9alb07mpKEyq0F zz#NqsLt%mWTb3HtN>l&OcGo)9EUyb3H*v2xHL3+u|Gr(sVn^Ck882Cm!Z_`f>h6xx zH7Y7XZHq}qjb12pDkXk_%XJ@EjfNX)4geLJf(qKt`qY0dC7D8U|D@DAqo=+9PiTP% z*=FDRgjaL|72SdZVu_6a7Nlou!uNk>gJ!0;spg0{+eb?H_O-Iq>AT^GdDjMKj)%KZ z1taQ%5q-Hp;Cw|3VHBL+#O(BH)}fI-`X1~pD`NfBE~-<5hWL{6pf93+eh>Edd|3Kw z0nG6S%I48N^F$l#n0-%c|NGjENP{*bzAFbh11iS%!*2Fr>FE2gIaCo(MRGQtD|CX5 z;yjULuODAA6zKmpG(U+IZRXqlfv>b4rX)Fn(Br zzHQ~z{SR{p+~@Fa4EQ%!d)Bu~M#MP6*P*4FUF%2_C!&MwI3yjbF^=dS+fS7z=(g&MRW$ zRaJCt#&yhjNCwzyWu(EOzM{aBG1 z+ah@A%tOsu#)rNRKQ1z}Xe}=Ce&1JQrWZrR=yV^sckkM4W*;oe?YVDxtUt6Y*580&YfTP`6Ml?LlC`~V74z16Z&d0np zyVsVEJ`VeuEv|K-gW02xQ~67J=zbdVY`zh``r-d*FFh1IuV?-i*E$sZTF=WNnBPCf zdqo{Pi_D^}t~E~c@;zp!M`e53)ES4@e8Tn7{md48`&wDb=QEHg?Zu4i&+ z)=Xvdp2{+!vnQl)`L--0Ivi)tnyCxtJ+TPpmnOKiW>Ev_zxf}YJ9GSk_=_QL@BTwi zuZne_X3)CE%1`y9MlR^F&NR4i&XQ#Y}Fjqic=#B)^&d! z{dI#Sf)`B4;;|X#Ooq=l#Enx|CsirkN5 zs9E4cMeK@mew=PVkNxS~?{H?HN*9@L{n@o*xiVga*2wYfuF^Z+s7OBdztCyq!l5-B zRE(kjBHd8v26F``z>@8*#m0FB{cXg*WYRwQR}aU{CH=mbIk9g`ETx4S^u_|_#G>-| z78QD9ggLS0-hKLgEpuY4z58UJU(cM_{oZ~0UCNx;cf9+6-ZWEUIXB+wVTor$r#9c= zwX<`IZ0nYC=v@W!|KrV?xmm?V5l_bXk<(gHs%HL|#Xe)~y~O1Ff}T^HA1Q$`)U{ga z=~}J!i2bJEaxs^mS-E12Wy^eQ>ML`*;N=(RMF+Hi$Uzwqyj;v~6mfz-`9#PaUsvfr zen9=noc1ZqF1-SsWbec@^nGVG_H;JEd`Cs^N(CFg6aSJa;%d9AMZMBfzc+67L-bB*53oY*_Dv9$NS|MWrU--Qz!=e?v; z6bqlS5p6%U#9o*^w`zEUY6AD}eRMVJsCeg&vGvPiVPhaVT47Y$0>m2)^dfz%6R zBWuRc$Xd-DT#d&UE{pXGZ2e`S{;e_|&QacJ92@>Fob_Y8mvn}cT0rn`jc^_uS<9S- z-hFW1yYLL}^}QrH8IQl+ReI9n>KZ=H_4JL*A^l+ZX6Bqy1Ch$tT`S!H5$~4%A)H5F zaz&og+X^b_8EWID^h`6H({VUcfB=>8rXLl<-(}8)-uv{<=^w(OYa#FX#x<&$j>Bnx z$+fK2tmCdMRMOmZM(cYrYj8LVdgGs%9X>x$P&^s&PTke|J#4(mBUvtk&^)g z>I1E;BlJ#eEJky7_4LP;xa?~s9_s%gt#KGpo7OmtXc&QdOf#b4uZJE_kE&+afQc1% zkA34M*Ls6&`VdP9j$&=P9N&td`TGIadW+WmpO~%U!Ki3gh$ZGst6Lcp&z7W4(7V%E zVkFpAN^KT?SSWF*(CPY<3XV{DiUR$*l3C`cR+5r>-}Dsbl$ehUxYlOQg9oaZL-*=R zW(nUu>56|H=R*Je#Nig{AGGGzt8(oN4)g4;U-hqyiSy32TU?6)y(K=F;=WdrIu-2t z)$w3g>8Vfd-P^tV?y=wPa;@&=Rb%byJ$tGBjjEFT&5*>#+wVu>#~xPy;JCz}deh<7 zjQ?G|v=G^9!zDBYWC#IH#$C%HS$e|G6Ho>tsGxYTE?@Q%czF>x!;pPPbqBl*$nhbryY-{*pQ8 z4Vm+sIb)j4{d!9)>k#(2rbf^JGjF%t$MH>=``#KPKxYwO+rR)Rf4251XRV&+M@90Tss|%Jhpq)BNk}a(@1Q`5VYa zC%f&?Hpv@lU~B=ciT|@p=FG&VFo$HpbQsa^z=*cx!j2WdSyjNCg^Cev%{4@B+K4tI zMfze$LvH|OJ4uduv67JyEf9H-bC1`lD00b5uJsoxyFkd^Jlbb4SdpZ1W4W{^1nOhC zuxm9Wc8zl#ep*{4sTI4t{LLxMY143+Bsj8yGcO>y+{4=RnDz$uP;8>CdR11qITsn z`;>}2x<0Z^oYSo%J0k`Ntd568dxDW}8s8hr%x}HuTBil~h!PprRB=xG4F&oEZ_Q-v zPSO>UkQ`T}!(T92wmdP@Ji1HDmXOEioH?u8sz~msy5loF-f|@}Q3!!Wm-e`!{ygDf zf@tWaZwh>ORpu4tDbUMN9Nz^I_h|1|5l^Ym2mQ!DH6i29_Ns;TWWUmL|03#GSZ_$2 zI9vSfhux+k@wA7zVt8w4^7&eu9|?Ll=Eu^HNY<+|XXP1{^|bi0v=}1ZU-A!V#iI3oE5AY_(^$5ycJ#Hi#R=zMsVrf7#}(-5 zQOV^*I%)cSR+GUhP9J79gFwYyLRS}gzmaVd+zOGs=+z-zUiUd(jwc34UKI=dM(}xi zZReWg^d`9(m?pWf?`&lqeNmX5s#bqeL#hZx$xcjm;C+KOngLP>ZTVYUr*0gc~(U40L?%$zlOcsTEpeN z18PvLiL;z!E6UAFcgc8+G!i%u zdU-Drq)#j7iFG9SBh#D*ML9kuxG&*jHMmb%Dq>nQ`^=l==5@P-k8&P!c+`X%Cp;gTNoC+bXdY%EzZ3{hBAohqW0glKZ2ZX)Mbk^!E*0 zU79PsR+ywZDmiQ(-EXFSW{g*oeR@p6x|WA!{^6=^Sh}hl1#K52vEw8c zvd{+vkW*SleS|?QZBkjyWbEyEoa=uixh(MKjp*|!n(!s9MJ{9%%M8&yr;^(T&*B*L9tcwWk z(;Y6i=$lCq>%bf;pT6@k=fNjevksEIufKTi`3GDsxYPG>9#k~329}0`tQsh};=p&& zd5G4-qS<>46-N|LzJ8HDBj)=LePX_+7mL^kv4@Dc)j3DzaRIx5iv$i!dnt2H%+^ej z!=r6d2LEFzI>p{s1YK!m9bq5#tXGxfEU=n7FXp4+dq}X7>sCGp=(WeotKmaJ;auSM zu`F62MX6JoW*+=LI!_i-`9Y!c<#BG2jeD&5mU(~uK01Z}Wg`S{e&!jPw~FNW?;UwX zaBwEbZfYrLFKyCLadI28$227(-u*yHJg7jgH59>bQF|PT^wrQmpnCNq5xPp|c5b;E z6}7$cclu`LTml3H?hcUn-RTU*8f;^x#8KMKdGJv`vkwWJw!%pNIIrwbnN5Gw-Vwe} zSsL`gti2712VJg@e3v;3Z)sf71Wa4_+i)_3@_jKs@~@iU)_({+qgb3nOo(%+!pP}K z*BqByzov2bv6^(55v>K5cSFd7-T0@F$#%Ndqh7wg`TcXUCPsT*F>}@fy)gyruxpAr zXR~W1$!?%`?+BSWFSynNoCl3!=Ga?gZqU`QyOvQ5r=9a){~2DH>4%o$uF`kC@7(Q; z4YiZnxJ+QjORh0d_M7D<$(!~i;p74x_D{qawGqvFvI2QuVCw9C#|xY!3(|iPAfNmAm_~y z{Ct)vI0K$ggdd`IP!YM{;<=}0ncwqb5~)oedOWgZa}Hm{oKbChWaOvJrurW0fc^gS zu>VtHrAN}r*n&eH%zpoQW*-77hPA@8=YH>Zzlw?aG3lt`~g%$pICIU-dy?$|_Kj1FCX((Q&Si)XI3@ z%Qm|fmBmz4q<_lnkph{+Scj5&vPHtJtRvLMI>O(CNw)2h@*~4o^ zJY`wwgB_g=rMRHf|zYTRE&|Ps*eG8`quZ1+S-LXtMqP=KoClKR(y~zd!F< z!#`y#@Pl!0rVCvC9*E+3!zR$8JxMgX~*~EG9-<)%~pd=$^oj%uZ zWYd3boa?j2eeLjHMJz>Gh)gp>hS-F8j}3<8yp z6pQ=`xy}yEHoGQx@G+p0_JsLl_eEjP65O}Nk-Demh&6xvIJb=LT<}zHSztuhKQCen zJs&_(>WLk$HAj4}F!HT45?5qU@I;qHt{il&FHP{^NP%I~IMcOTce~bb0kg{o!-oye zAC}zV3S7a=ysFWZy!~one2L)tD2dD+bgk}jUS(wXaJOVvbqm=vJwi6_6VJJpHo=3_ zy_`Dg7uvIFZyfaYOwxrF9r>!{^$ree5Mu)!OCOrxL1nJIhfA^a{s|r|Q9N1B=9u4_ z5U~=1t1fzmTX=z2w5!Zky*OJY`GO^n(dND4Ty8+-t5IJ$KZR}3yAQwyrq`#}!cIS6*nThGJe&Ss zYuMBmh(Y2AJ;3blt)XQ4MmW^3%irbt`_D*UuV~|p*`~9@wf^LuvmZaFuP&NxX7Eu_ zVhm+?1)^Rq28~VOb#P!9(byE&FpQy^or06JXGAMZ#YSMp)@VH$S-O@wChxFjmIK(m?O^R7Noz(v_||!>t%l(H4b$yDPEaC3msJVK_kYID2ft z0S)yb7zG#mu!nTUOG!RyT59&P=IT+P;-IER$hM6DfjS?|*~^-$XZuj;`8#$GYrY7^ z=a~P#LvZ%X`2-Ru!1g{+CJXj~}9Djt$-f%{i9dh}CL*h&#E7JBeC1ITA zdfShc#9+?CD+kYTy$!zj@M*~*Ol{gG;(D-~<`i-SmQwGVnHItv~%Y}JT3#2wl{MpDyoCntmT#n5mPP_3e$C@g5 zM}-eV(^A4#DVMQH=`#BN)Ar&H1^Vzdn01N~t$W_J#JN@(bNX(lc^}w0T+W;)C!fjr zq0f2VwHnq*e-Vwb&xl?(jjdeoay^}8L>qo4xsfu@8GcrCs*E|O z{4h_INes3M&aJ{$*0D*I`<0Ye!PEvW|dFSew!M#<)_i5al zn$SsOzfduv(HBJ?`QfwrZuLcG?hema23FIppyF;duv2gn`e6oNbFKC~5mVwQ%c`oW zKQg|v%)F#$vtE-Nlw%%_Z-rI~DXnGlu>qb2L(SWcXBHbp=K< z{r#`YG z`~A!bE9j*?K-zB?nOk1-_Kf?P^R*XUtK)vj@A29TvfhJ0h2q0f)rX~x%Nwgn=5$M$ zQ{Szk>TLzPPo17;zN=t&=C2dBMwJJi~kU za2~{Y#!#C#Zi)d@4MD_*j81TC)7DV3eHOFZFM{3uTCBQ!BNB?o#aI3`1SeoDm(@(> z)e~|?Q_WbelrScuv18zYh`@xnN-pfGdmwrKZ~t^H<(8>s40MF4yx$ z9KT3#`nH!UH6%Ya`C+aln-;;HtpAVh-e$5EX;Zemrt*Pes6eC*VlbjbPK73&WxLji zMa&Upsf9cH{8)OJbo0;nglE{q&fP50=@PrB@y#M z7e1UP1g@!G+pP#4w04es=eMMn{v3&z2EF!U`M>C!ii^!(a~|xfgZ-L_)u;ZPDf;te z&Vw-@OsacKMe@HUxOHX`bNWW(5MQd;0>2sG(VIT%&7pJzzPw|5v&a$@gR-GG>G*_ z^$eZiqMqr~ysv#ke(zy#{ureTYs&vi5j+;gOy=}>{l^p|Y7{FqTc}KL{s>H@7&?cm znBYJ71KEdXctw%G5GhQN9BomHl21}!&V=(0y*n2I_j|L@EmSd=>DjMN$Q-M&TIL+k zW<*A{8MOBnNPLl!)T1sJ^YPR7iiH0EOBwT>YTGRRFBogvo7f@xZ-~B&cvCg$$m^Fk zRVxZAzmtu8dj21qX)Ld#eK7U$X4l$C`pit`EF5dw8(S8xruJ`G-c(IGD4--YA8P(a zZCHjx&v7p1CXF+0nQK1q|HIjk;qSV6hxF|n_i}S-k8Ip52cJy3kgA$ZslD?1~+s>Q8e(2u`WgO<*;d^O!aj3EJ;T zXC~d~w$ddl$$q`b%MZzZR`Na#Yk|~UTlfxYf>R~#TZ?Ly?$4EYA;+{}Bol{s`WboV zlz!f|1{GA0-rnxzI)@ajL-l3m>Futy-w%O3@8$AFj%me_!_UaG_f0BlK8uM@_3u=% zv2%6iJPD~sM>KI(nbwL^yKnSztG|H1z1`285v?e-NHL->a>-j3+w5AOh%tCx=s%B$ zSi~YPpFwi)ufKh<g&6*o8H2=c6^@!MOubWp6MdaO8 z%DAwhc|c&(Oy+c`=v!aPoX|V5vGzYLcIJaQ>O{O zog?wPjn#{t!Wkq#fdr7zGA5K-NMx4&$w3S?TeigDr(XfGpBu$4nXq#s($H*##hiu-!7j4hxFh|&nNLM z#fXya|1B6%vTJDV&{$Ca%X1rvd%s5H{r2``bS#l0@t!L3^2w&p=vgCGUJPo3)U#*~ z3iHl*$XCe12o; z!Wt?QKtb)tir|?JX{Zn}qNNLK#5KQ&`^axmnbRU|n2qS2YX-Kv7CXaru_w=xby^7M z&z$DHRKBueWflR z@rlFPU8Q?u42Y9zQ^e;=U*|@$IXgKIKD&Cc z;44g5F=td&%=GOLTy}MeF+|s{x5b)I;276QFZ#EaT`T<%9OMiRr5}cKN(-c}h7sj! zVe__vdBVmGNlebNIT9aoWR;XdXV&J=i`6lkWus!agNZ##*hAUS8=%C`&x8I1P?=uE z?3jiK$^Y0)=A>_gL*)u=aMDe0WDa(;RvWqU*>aS{L&C=gyKyS?^lPiCV^dL4J;AN3 zC1*%}`j@cNzhw5Qt)V2jux#WEO=sDM-Zw;?ycHlwgEIiCB zXpL{dv<1}vqgrWXMCc@e)KwGQYAltpq3I;-;SYH)-ES&Z%tt*=P#XW?8{rg9aBKKR znI|TA>XtWFQ=2d4TyJb+|K6q{5$^8#)hSg;4zHrVDHC`Oq_>>%!^|R`Kw?G}lW6R@^ zSRIdKzB@Iy=S}+N)FnM(FNdl8F(lTL9=V7)3Nvi_A9LjUkqNGg_ilpoGQD?`?7LH( z2e-Oh@FUQCNP77H;~FB=7o>;LoN>2HY&0+?X0zSAg6etqOy*Rbk$p$|ZJ{FN zlsF4GGS@u5)wSsP!8dp%+1w=8%Rlh=e`ZQ-FM9Ud{jSyhy4+6$r-YW3nzJlceE_J) z%8|L@jhyRYAQ|$p8V1ymexIC>a{41%_7TpPd$*94Kc8j($ZPYrCwTB?7|~8Z^iz{9 zu;%h)zZy~Rz25JMK0stxRq}*Czm;_?^2*@3NGue&fT*cbu-w^Kx z#hCoy8Q1!bVnnI@;Q7pX`(+xRVCp*W*}6&3e)k#Ix@ zH~(**RL?8C`qTb?hu5Yr+phII$v_o(RPWeS=Fr|An+j)g-8ZjZ>|CW_-Kxhg5F8@b zROZaIrOrP?)T>O)fy!rGE3k$4(tRqw$a|*H&cvDpQ+vF5pXv7yj3I1yE!umj{T1g! zMGG`KNUF;~`nyIW1 zG06^8^sZO1F}zDNH$N-$S!0Uu->k!mdFFrgN_{we_osE?P%-oseXe!?>c!6KX2m?U zD1*xuOpUHpgimX$f^}OItgBlVF~jRFF?m~751$X`zpoHFdc^qsV&@$d1%+VtGr)p& z6&ur>?*`_Yp&Q`r_m|(^4d_De_j!4EKG^9?n8OtGr7vfWp`b6e`reLBZ_H2b_s_UJ ztU>Qy9vkac(f9U?a!elnIy%2K&aF>8?5>Btj?Qm4OW8*EAN(hY`IV7p=Upc8xnDRf zalcA!$;;3(3+AG6!Rsj2Pv2>78Os+t)4?3F1*ZGp6qX1drQq&)M#1j873@B}K{5CJ zDbGCRpKa2;cQjOHa<_)P*c93WA$Y-NnlTm5*f_Uh53{kff?m=7xt`rK7dFX&cgXgq zdMG#&4pfJc_*(ptt{>DfLQJHh`7FXOC_*Nm<${ZOx zuFQcwOfp=RIJq}&ccnd-3+IyU64UCFCUkZSUvpW6_V%7lt~H$Z&3W|u&?eW~G0rWT zUz>VGoV*hzy9vVf-I%d`MO~{eGq2hzpV{?{YuSD{BlDS4r=VAUKbX3FyN63edZx;p zU%%uEUqWxctQS4koy(lZUUDt^|M&f_HINHu{awr%KEZp*W(qh;Ri&zY_Iurz%BU}-o9Wg#E(1%KYSl0Zqr%J6;drDx>1oP7QR zW|!ZF#Dg@(_bK^Qrg;9xNVMk|(e7MBU=n5CQLkeT%VCZNR?|4gJ4^Z=5+TpG);1R+ zUvHsL+O_3S4lg>JcL9^-z&YZTwNNvnREP2>U@IR;u69~q;p><)%O~@t>wMVL0OfEG zpw9-YX)}kMWCnp5#q<1p<$*?^8741@eR8Q<7on}3~>ti*fuTcFAi6^qB7V6=2 zu&XrVCz{BE^ZGWqR~RC1QexkA1ATWafHT=I6T6Z**YvyA9aln()3KZWv!_GFy5VGg zPvh;AnjcZ2d8`m7DGOjszm2u6XTH~7c7a7-#b` z|HF$dTw8 zPOGI)-zA$n;G1= z3;yI<>1M?o-3A%&7&L||6ddW?cRtyDze|rQCVco^_n-1jYWtm=mpjUjlLv61Er%@dK&vOsd>Hv+wZXM}vKp!w1F ztZNBe#VaND+JbGaz*?LkqW zrVshCHN|#0y+?Z^(AnunBFy>c%Aoe&19a+~S4?h$;c^jIYPejqAw9wM%$j6AqhL@) zE?r;fa6RT{Jzy0{TI;l)A5&3}#W3I4D%*?eU>?^>QsoGq&7b0*$)6hjT>exrb?=`< z&ZpBm1@<$_+y#x-);l4fe&5Q{f@kVb)13=Dc4fWOt-^_2#_T(<%yUHBFM};@DcUZzQ$?s60#)-q2YVpntUUpq8 z>)7~5*Ag6WgY$P9e!;1E_y#~P@?j6@Qq(8Q0G;%;c0U|1mmxLzT)0@YLrJ~Cd9X>G zofJmuIT!hqPm+!3$@^og1_U=N&AVD4@eA6wcCQ&~R*`IKs;fcB7{Xw9XADTzq3nt) zIk(zqPUaZVSd&_l$-$eLT0ZtM=a%8&ACTM(-uA`{*=>%xUv-j5F|%Qp_U*uGP4N*|k2F_>t)IHPOZ; zup9sRGuQqZ_PM#UN$4Um6-Q|9WbipjZxFiI52fy9(7p~-_L9!zztlW2TQT3xGomN8 zqSRQn5$#Y}%_apE-F}$I)anIfckGh$HPKS=SSiW&<(&ClYL z$ngwaY9?H6Q9We7z^8Eqp+fKcqieNID2Z5U!^#I;uD7VAS3Iktre!7yXkOF3bhZ&~ zDKJV8csvz!{oP6Dyi#{~{j3anb&J5USSRw$sXs&0%(6i@*r?*ju~m|rKm0Qh|Kg;l zN`Ca4fQsk0xK^EFL_-2Iz!>6%u$xw^W$8Ty)(^EXPYfus#<>n3BOO%iJx{98Th!^vA<_p5q|a9NX-R5H zFX^3@<@#E+?26|5l%>rxP|$W85?tF*yEtKD>$9G}hbC&i$>P zye63z4ox%T18#7wigl#RG+)P@<{8XhgpvhoHo8IkkFJ+K2i$4PMr^!tVhc?Nw#@}5O9e8!|_ z#3s1lGyA*1b`ySWarXX-E8l6^x?m@LLvy)4`Q2AZHy9W1?iu?GE`+6E_o*p0CduJv z2V|@XmGzj4bu^dS6;#xETrOD5oZ<@R6#HZ>3ay(9dtFP&Ro|D*vhhi=!k@99YJV>0 zgeaq0`rm7RrieW5n4i^z6jZi&Sdk$gs|f{A9RjQA=3HENJg(6*A~#?1$I#kt5%HnH zR9gVmcYC=}w2szpa;+8>;!I+bT9`bp6{SvZa;;1bbw_GR2RCyT>N_xpOs&J9}=1TIC^Gcz_q9zbt0Fa zIScV=|3?q?%c@MgvF&jlo$DjouQKtru_&`AE`dXH?at`e=ItOo;GYG)Q+;d+v-?!k zcdA8^5-kw9Ggoq7r^mTPdlmJc;H}Greyz)e{&UB*Al-9mxo=_ogY%%@b*;qpxMvBo z)AGD+DOab**XBVdeg7#x_K0{2PuC}z+J9Q=`mu=Q%WQ*B#6x$htcGNrA#5h?a853C z`c~{#W|u>We*@4PZ-q_uZ@QJ)DpY|V^Pu!O)(ac|R@eh-K=>9j<&j?8M(^Fq>@ZLt zd$Gj4`~KW{L4oxOhx!53CIsU<{Lo|fFPXQRWY3c8?8aM}O)@9;9hvhMyWVGi(V0r) z2<&4wy&`>(lG7vq*W;2CCR6@?Ka0=iT;Ifbu-L<^ywv3)9{kl4GIs00xa{XlA1^!3 z^ zYl%3MB;Eb3sYdj@JR?f_YtzHjFKS*b0`UiZ(7V(b@uq)f_7g)-ly<5!>aX5*b+Q40 zc#p7|0`?9mZiM0+9ML@CxwAIE-HW}QC)C}T9&atvyTv zT92rNBqXyTd)DvsthFZu+Vg(i_peO$UVGiwb6d~zeGV2e{KX=MvyA-d()FZcc@}8j z1#qHVbVh<0llujbzvm*=d;JhfoS|}SCgg9GP#!MwXaAPV!|@C?*i)doE8Z)w-joUX z^^X#x2BtPWEO0E%#RA9;>q&?2ZC_hLni4zqGcdll$I_KYiE->_#Mmyu;zryfnYjNY zzX#kW9vVU2(;e$Uew`9R5%;pS*%p=eUIrm`1L^2RedSSNpk5>9?sM0vLMg5v?#+5; zvr&VeA}yc8WB^TcsKK%o-s(Y0UGti})vQhcxknW8QNHN81PTr?%m~4MI!g`ynNkf1&8%PJk#1TMNBqy`w z?H4$$Liv2F?Qif8#=Chv>Hi;M=hE5MBEgA4+gB(dmBt>~W9i)9;_^S6;(7`0{W8== zRxC0l;FyiK|JKrRKbMT-Uyq|cQ3z)6EY&}}ftVe07n_5&k0SCjr0cNjY7J?-aE7{+ zIuh{Y^1F|031m+;gdhXtgagXAio~p+L<}WIMLNj*UPtl#-2hs{B-N;aA|}s9M3Iks zoILAgGA^7rYv*3M755Of<$%x?63CEk%We(`p{}6LoxtK39+E&VdfC#|8Dsf9n7wd3 zKT<`)axtVahUzD&NDmGQAhdmWhUdw{GU@kf4%3~253spB*A|vL^IP6lx}BG~&95Ex zGj>0Zy!J-^zBa{kka-2@f@u@9AHHQVef=I0`cb$4-dijdsUP`Eb3?v{vWaNp^(|V$ zbH>!7{GG-wzKYw2k5j6zAEhWW9e~^!+IN1RzSpqtY#7hAZCy_jBO*XW{cSuZM7f2S zq64&sTfj`m{-Zql4(hA7alQRxN?k`N)$5-jM$M2A!hP4W|Dt4C4=-~-e*J!5Tf;M8 zc;n8%8HOn#9Axb-<^1yW?P7GKQHtLCOulwc12Isq=+1=-oX<5m+*jiP9&_nmz47`h z_KMKt<@p|1&PZIJ)n}=m5MjdV*}&#g`5X-8b7E}FFz~<#MG^LCf&k1ngc>(&L+dMS=H&o%&(QuMx%__w zb=%%cq)?(n4fbqN-3s?(%4w>b9Uo0hIL zuzr;@eCIAp$M2B#0SJqcw=g~iLeo!hO&Y-P0EF=`^4RArst+!$jh?=}E;`c4br!ln z(0>1>#c%^#J_qAfN?oFhREI@z!e4p*%;3>6yCU;9Xa|z3{q{{u&l-O#1Y}?V;9DaDE_S~Bm-;dQZwP)V6bhhU|%+)&IwDccRs(Wl(v!@(Ft(3}X zT&q4xU3}lX74?C7sE`mdE~>$ML}K6>`Ob@$KAmIw=!&QYi+{`FlF#cG)^mXJ*wlMO zlpDsKgQagV*%<5f-8@NCrE_&xy=dvTo;_C=IKFj7wME%I;v4^>K4xdJ_51RLJU>yf zx_JxI&ox~<2jtfM#mwJg>TfK)^A0eE>01Ly+u#0&Z}PkHpLTKIj+Qe5!;Hi8-e6H% ze?R}uVIt1mog6n~pFh5BM=Gnb^{$%(HDKd?j|w42$&G7~PBdr25_SKaHcz}b@Hd9p z3!$r7?&+e~wQpMb*DOvOmeeGr(2W+ATlddtYtDpxZ@f5wziZ;ff!S|z47hV~car~7 zfcH>OZ4{H0$0cbo(hHo6@2@8vI1jB3VE+FdAC$F)MOWLsYl(U78MY zNb9N5F3WXXlKdyf*-M7T>?M-_wB%rTW+*G;J|ARy6T~(GqaRG}^@?TN(U)r{`-OeGR|qAjY*ZpiNZeIVxGea8qX^lSeCMPMOe{#g~@B~kMwO9vrY`8$9L9y9NZ!SI8ndoZ4|U`c3ZkC zB`e35!!kce@;n1KbXmI2=z%j<3upI>NY#}#{cRD(&0EunU0KlG>;7}@!uWi*!hZ(WEjMZE^MEvO-oXJUnU&H@9RZ@ z<;NLHQvHvtOekbyX@yCuzs_x5%w~pVS0<_6Gv-6$ z_MdOF`QSXBILGGEg$KZZsl&!3@VbnPeh zJN)*yDQ*uLv@z8xr$PbOAw|ErPKqif)p3vDSvh(ej~(=}xZlE9_ZfcAajyt%@d;{B zSy@qy^x#LMRG)gsgftsR+gkj1WvLK}WND7j*-Ny=!)(E@%~zXsN5pDPJGKAEB3j8<3q%5N!s}{vA>r=sP-b>eniZ!#CoTg zRNwk2F^U~(P{{qr?Nf_NdqiRJ_l9UWUyDMv7ClKGuYUIk&yFP3 zl`QD_7Nt6t@5uzMSuASvp3JH|>W5J8H&ovG0Wr2_CE1uhNb(r--eJnIEktNL%ICpv zWH;htwT#<@ z`@UrHh6g_zrMhg(*!aBcODfloTZ_RFeowa;*P@ck3E2M~!&JUSP=i+{sg82?lQ|qy z3(v>nXQ>VuYH*)P^(XCT+F7c?-w9 zV!S#j?*8Zqlzu1{O|WxI`~PgFX&YZNe0F35>8MUp`%a)R*0X_hG>gS;K0ys0-Ob~X z`s}*`T#HY3Tl)9T-P6U=@;=LJI04MhU$k_9p9d8;7yv&%bo=W}Cx|LJU@F&ff0~O& zkbZDqp)yc|-{&_LV@sT6|m?Vb1-xjpMKYOlEKT0$A)W`>jIAQSz;|L;@M< zY40L1Jr6=?&O%~3O32!H4zmMCOF%6cl}h}#3u+Mch{hz<@5>=(q7jVyE4j^{Hi5B2 zB!LHc6}m@jFP>R;gdPM+&#MDRhU|nfJ z%NxLAxOQf;xM_bvl48f^f%%U;9Ov`cJYu#0oJe514aEGn7cG6CSo9vY@sfc$5SVdX zZ*Vu&0?0=)LBsZz?FEJvz8civN=kPEZSeNvW$Yue223)x}}Svmyy>il3|R3QA?) zNm|~S$z$63Byll-IAN8IeTRHx*(<>C)0Um&_LsgUV$=Z?)Pmq|6`>quLfrRHh%mvo z#1jeC{P_LcRPEL{6v68E1lDRteJ1zN3i?!2j# zG9Q21j5@4~`HwJPn$7%<$J6hrX7NYOU@&xw8^uX@9#(^XwywDpLmbc?iI-El3a)UV3++JKsg)F z=2@EYf~Eg0N%g6tR4=B~l{`Z$3z@yMG=_AD^=*j9LMMK_Fu-yNx7abH%!jILryo$xA{48dnJX4{}AO@h$)6DKOP>14iI)9m^ z6`rR0rzz?p5(#)2KBznP_av8R;-AoNes?z|HqGXd%ICzKxX034J_l3zk{GZCG-a)l z%-&<^`2W2>B2j$SveujIWx7dm?BijoFE1lTrwE~E1nAl!z=66CXKKEO%e1n{#%-Md zp`8MBHEy1v9hbm=DQw#InOMBISDF%IYx3YV+N(oUeu`O$i(S%oxL5tiXNC${)B!L)jsX8-Zhe#+F;v!?fFVn(Et9)YWna7@XF7IYafkN0_~^3)IZj$QlXQ}>Bin{iJ{oP-j?7N9EOOI!s zzqT{St?dSTZF>ah`keq>J%=i_kt0`XZ=In!vmYf3wb2(Wy;Cec@x>^WRWTmu5J>=7 zF787AshFj!cFwe7!_u=EUv$NshNZ_d)L_2B`rVFt)?~xd!NKqGL!x92uv|I+p#PR#&!AsbfG#pblRNy{?EWXdO?K9<#Q|=sM<%)avMs)FsIl5ZSnIMIYztj48Cv2bsrqRFVm3O8!czCq@Why8Y54yXSrZXV?N~?_T6<+OOH?BbE#%Pc`d`+bH{vS zrnU&rw*$(11UT?2o|{`hI}!_M?0k3A@)FcfY#bw!MFO5TgizAe=`LC4S&DV+`7VTA zKmt3mm>v`0e8nC6$!|DTVeQ-1ZHj}(e&ZSWw^uA3%lae;s2R!1UdheYV*eo3b&=zJ zJoa4(BfmUKsq2nQi1BX%bfIkYTzjzw50`02feZ+FKi_r~S_VY+cf)|h{ys3^V1L&S z-0>(eo&$9ooA+?F78|5`v&HXm9IvqaQ&q5DDD*fXlsHS7?So-4d*g295@M7A_yzFg z`0_To>n{Q0uavsdb3uIg_CrP~gdh(01tw_ve(lOm;S%3@f`1)ZoYV8D@ALbC|s^)R)!iu5&;> zp23TTsD8$d;Y5Cn-z*$P{SVp#613gVWyt)NPEM=BqMO|b4-D};`JGHAniAWd1^J%S zysbZt=YyY4XJ_cAyKHPUl+mwpXvYSqesq+&1OeJvIfj$!iZ$+HGKhV~TruBJjdoYm zLLOA^6QGMd+dg0WNtD@5IIT_yq27sH4vI|V=QLr{y!VDVZ;d=byV-dcpu%AGmLeuo ze4o>V^4>;~+4u*eyq|3D|1wwmYJlpmj^ey>+@R+MsD9rJV(0)BDC1$<-Yk^ui({NF zPKkXp%xRyRk*qo*I^R2z3HiwlC~rAqLKYls6@|7}hN#Xl72zCxYoDk68s|lHHTgPN z{(sYhbd~!;nNP4dkCGFN58Ac>95d3FS_x$21#P1oM?(BO?+U^0W-#f~EG5(t(Us@QbNeKMj2YK8h*iYzc z7~_$|s0D%XK;&ybJxk?d&BSN~C>H??l#$ZBaO(iomyM32)9=pH()veSI$u_C44soz zmJV@QrQu6rTx!drIJfUIU6B92eaMy-$H|9|7{lX?^`D};G!+VZC8wYD<dQs zjdD!czYS5ndi4LoX8L589S_)@wyUssIjNBObexT*t0-an$2?im$MO&7VpciMjP z+q2ZwSq#;xefJTe+!p#byZj2^SXnQerTU=cjG@ePVeHl5($~gv9;_CjYgj6ZMOJbD z>Eup9J1;)DhTm%_A{?Mq!1Vo=LtwPrn7@Lz+?<|9BZW2N6oB`MT3HP0C z15_lCJq`$|Su7?ef7>NcP%~W&P0t584$uzq=^ETxzos4_&%4Xp2H-iOUIO_@?;lFh zv3lyWK*l!qNj3)O2i&%z_`$erkm?$Mb9D~kcB1J#=SD(u`hT#?(n&s)E6i5uYytsf zu7?ycJp|7tyJIl9T!3_p`Q}Sb|D-eg+1d;0-e>2z!M3voscvK9ganhys3$zk^PBkR z?y_`cB9u3P8a%=Mh}gdFybG9LX}V7e>WL{KwAp>*+Q0Dg#O$3o-d2ms#BK{|3ieGY z1M_>*6&9*4PikpOZTl+Lc(EbwQ`f%(zbtQSJPoADjaf#~0fyk&@w zvwkCqrehx(?05%ed$jBKT@d^FE`Zz!Y7pzH1vU7EU5_%C`#dOf*`0JK_bipK0B{yL z)Zp+S)yKE9;QJt7SpKUNl{1(gP!c<{QwY!(gaDr7S*NJ(LOJ>-VlcTY8K7IFA>!c_*cEy-1?ir+q9YirY~iF}dGIdVcUd z(lEo`8@Mm_imnr0E{C_bUIGQsb*+{aWqM7w(ok!zZV*i64#5oXhb7@lpr8PkKxn`7 zGVYVuGM8gg{%wHAUzFK#SSY*qi0~fr+&%VLQUEG&&gyf(WH^{L=i^{P3&?Aq<9R_* zMo7-#z7sbN+V?n8N$m7YFbf9x9SZV->rAS@jdL@X7^mledET0(sNDG?gjVN(x!L{i zYgH%6^*1bJ{jEWIe;3GffX@Lt3pY88F56$Je}w9L>^V=b(^DLyreHfh_Y;EvR9s?G zy~PhkFjiln=er2`w|R|QrGqNJHgH`u}c8C z{sUi|H_7Lu-nLgSNK$4eW&W2Vl*PcjJwWv)0Hg1$aDM44@sVQVG9T#j?`B{76G zpsiV3pG?jKGYQahOFz|xsZfCX3BH)G{k5O!Kj6L*ZL8-J1NQ}xMS-5;PB+pDq=}t% z0*hDG1}Kvk%f{$fN$h_H`Fz&#{0isRm~!l^qIg9cuJiT%RKMKTgB~2BZm70 z$N0aLy8b*sncs8geu4RaesPN9)!=#g7Rq6xv#6LD0QvfNTP-S?ST_lYPd&E&mrbAsffiH zzJ~PvN(jY2N7<&tk1|^RE@mU>PUpsW8^=Bq%s4>L$|UxY^N1aPr}A{xFEG>h2zbVj zA3udUXt3al`p1dU`7-yR^+9QH`4(b$H*?!O&IRt7y70!^7XFQv+yTI_R;eX2RY?F=hV zQGI`kx*FNpkWMrnrSdnFx@v9~LaiTD8Q0PJ{CL*TGQsd)pfJ zJ2g+-86YSReKAq1f1Mc7ZcA4-=0tbncMZ&6E#P?r7~WG6^6mzfuPT7D8r$P5=4#%4 zsz(?u&N-TYxqSzX-!uAjn3nIzBuvMu6*yK0_Qh@MUFmjuM=8TKM7;*r3)d<93fIAg zDRsTJ*0U7X{B;4^OC*^6`wgTc@cnDG+ZJ8Rcxj(h!tMzGO51!6(88!2&SCgw-T!KT z-I=0tD8*vrLOwBl*HAKc*Ra|CK4O2*$2?!d@~r~u0B)8)_UK8DHI=@1ILT$+c5uwn zkXH;bKhG(sgR*#z&S4>hG}Y&9y=~fh(vd#%EIwX3e}5diywffHk(Ot$eE*KNz0)~f za>k0~)%Y9xu~C2u_U(Aye<5!krE+D8-$OL!usnlo@3a7%_=n9)I`?z@S2i~Q@|~xs zenpD9TKB^e)Y-uymSTO=Qq;w;Mt0|GyNCHXGLuxlB*pJrkWSuriet6*Nlt(7CP7Oy z3fcmZ`$MXGseJmE*GB_3-N1IZ-dq&RJjM48@;r~kbFd~Pw|~niP9y%1qOQ&X2=z+m zeA(;ST1@e$v0iWP=XUmzELd{yDXRYf)F9T0vYbcdvHhi>2D1R1>#`spzx{zNTjF=5 z-=+sDg!WlfRvzW}al2Dg{?hhsopFluW0VK+dwk{-)ZouXsE)dN>=c*z(s8KXU36@1 zuCu7CGe-#Fnd-^hdfRIoNC%ef{E-k+M399QYpO4l*`fl&sy0#o;dt$mf9?N4H+Nf9 z{=J2JuE@W@zNh?|T^64;+H&7Y`x&=c>qrR zJHNv`i2Ub#xx9qQo8?@yGa*t5A{q|aJ<{496ZUMgqfzQgj@aoG=LnR$lgb&Vc+BsM{ZzmE8>)Xen$BY-`s+^e^+cW~I6$jscd8KZ*=HB~5;)1_ zK`)%U=k9%;vfL2(UF;;)la#uK`t5c5f7!RMU!(H>ub=mA^-aVm!8WhsdEwZd-v(i+ zM=EOa{(;K{C0UUFn%xF|v$mh=%h|d*VoSeaxnkRb`2GVhlpLO~xWNww$^m=R>vo+G zYTZI*99_EWuml=mHFape~z3J#80BR)%+ZieH;J;3sOou+!{D0Ou<2qAoT zy0G&Tb{<#7hl{{}6quDpk z)0)1a`iW6?_a9X%x$L-lfa-BES?RI!eXz23U#ltKP+hr<7>TE71-8lV4#wRJu$;nA z@tktXWniT3IPCk9D(yatx*9S`)Cb~wHF58W9TsJFov)Ek{OTNy=zLrV-3n?D`Cmy^ zr~7r}eVeY*8ge)m3;{QbCEclW89A+|P1m{HP`6@j^@aKR-eq^xMeM#1X~G>gjs5?s zmvUZM#B@?T5Av!1gD#z+@>XVZnG*ZxIUduQNO2hnzu#nk-_PSB#`s1LFf4pO&VA$& z%Ip%z1I?MZr>Dg3KgoH}aS39bk8<1llV9_F{=`YX&l7Wqx$h+B=jvK_0k-E^&i7{G zm)A#+Wp%p0WA8T>Gb@6Obs=wAZJ!N1!y|T?@pDY>r*b8(*A~8?pFTP|@RSnEmDYuxX7;(-$@0p#7MsXk?t^ND&!AB0%z zH++1!Cvd#KPmkBuLvT;m&t-m#On!Rz8>(lIa-OKzYpSl}Yl?JblTANAI!j&e4N~3n z8iZUd@dkbp3*OtuIzs60M}*mNDoyV|aI|JPLC z{>{J8Z%3*8?pf**9OLRrQLHQf>kIMT86MiZV=>)!jABf&V-!auA$D34{Z2bp@$npD zrY;3@*>Zv5>Z}{&Id#V8tC%i=+_E1+J_pF1bHSJh;0#Fa(!1@l%6?cP*g15*MX9XX zyb_$9?m!EaK8gB;Sk%OF6A94IVokrgR{O)VmhKgyTeZil+T+~=Ad`t|@b71+t{x%= znFJL$_ay*Mmd9LBgU2X!&6%tQzv8jFewD=qU#E3F%lzy8M1pSiOu0_`&9muP-9rDn zSZ5B$22v-0yjO%%r?WcUJ!?Hn!#Tt}DmqV0&jq;;#`U%9I&IstmY$dZ-Qi3)SS*1# zB!YP}fRnXx&vn`se4hc`*v3m|sJ3ql1bOeHJRf2U2qz+TxwLO?YYv#-12uS%Qdi6W2%&n5%B^@luwUv`TKHLh zUdSk|IL>oau(li0_9STCc9c@r*jUx;v}Moodn+7EC)T?WLh3{{xV(U@MVh#EF7u!F z?-e1`Q{3rpw&#>#V8kn!4GhoKZkBVHw>OIQ+{OF+!Vt4V6mXn%?sI=(?0iBhjtw(> zTZlb9zJJLpwJMzJLE6nQ%s>qmd_(o4BAj3`P$CK7UcvcE=aRneE6QRNPrEwZJuI)L zGZy%Y>hV*wq9YRy9u*5&j2YG!&VhreuX%m@`l&o56~;E(`1*t6&JipmX5w;Sc5&pp zy_XX+RSKqe8W>_f)$xCj)I*RHAMj2C6KNPe^WF?bT!eC!>3K7>-Y!f3dzYmrE+^*3 zTs0^t`OLTK-~tGHz;O-ohGUl#Q+Q1|EW*ZM4Tw#?_KoiPZ-XHu?>@|83e{G3!;N5I z9pL!Z6=Uo}_t5MpBj3-~&4>)GNAF zQ4RX~bG7?-@P0AdDVdH3=O`n-1n!`%AW*EYYk-@o}aw_o)! zU+f~5dwk9y)sLm?xRsd7DDC0%KnxhA6-p*7@eB!}U1zDxb5%NHYj;{KKQWdQs)3@;#kcOwb03-NE@)W$>KdWmBPC=8niOl3AP z@Z2%}GaC#7>LKzHw~v6J29-y_P(C0=LtVbsDnP&QtLrpY_5&EhB|}-`ii;Umt6ztb zN|b?Fj({>SbjYscv}v|xJ#FbU)3XX`!VjXBj5A_Uj4D8t^|LX&A0`uLQuif=DyYK5pUfn7|IqU1R8tuy8*tn#Z3fd#j zFdyoQ-rI>mL_0=C0C}j97z0nUd|^$30J32FwZ6ZA=M%%<8+Tgz|JZa1=GSQVo#6I> z^*b${J&V+6U%q7NBO6G^M=!Fx-bO@J4FFdgtW%O-rI`NDbO&%ienbQoYkwj|8Q+0- zYP3&YvUFz8|MB_ue4MXebaH$dq!kxp01YmEBU*_1knKmE&S{^NM79UIMPh~lx|`Q} z3LY1UIc&%ADk20g#L{@1*{h0UJpYX=ra;XR00=gV;E$Iv-0JdX5rW||&|a~!DtpR6 z`+`!JH;)*#d3O8|2u*2R(FKGA*gGdN8rED~uxz*O#|gs9L>4d8(#@aMfOjQ+cNY1` zRWMf12&JyNY+`z^;`aB%3;a8ugJZF#aS!ns$s>lZgvX|w_iXC<&yGoAtPg1-o`q~; zzC@`D`$}?&=_?^-%kFfa;6&o%3;W6YaF*qb;BBK0u7Da$kJ;xW25}Mt>p{NMV&e$2 zK3vZ0W54xIx5evWeLKVMMo6F`Lk-q+LuguF-P&GP=QaSLEsc}5RD}NKartCM)`?MY z5TkJt(oCsoKhL`nyf7C{V*!7UIu_FIq@Ax}gyql^V|Vc!CH`&zc7~aMljMp`#de|J z?h}dW%ZB`(fd>xz`X4x)Sh+e`_@bpJR#qe%CJ_V2Q|o~I`bl6oZ!JrDZuKRVIudwX z1XC^JzDq52JP*(K96Upk7%N+!y%gIWlq7%gRUFr3*=B+1WyRBoSuqs~kk0%jV(G`E zLO;qk4eOmx?R^nKaRKDLud+NVEH1MK#1m}-$c-Sjp`3<$BpblF>|ue~_lnDjiL&b0 z`~U28Ux2-1bPzLIuUa2tl;|TXR?VZeQ z7(IzXVk#?@YOEXUt+O#xdR>I!w)j9gA%S{G1(1LEG|Hd+o^@~?A19tQh7G8Y0QMEn zTiu;gmtGwC7yY&UA#lA?6TtjSl;=}mdc6SUh1gCGF*i1l0M?NkvGitu?%oVFST90= z)i;5dSYO)D!N+V$g)DE8w|`l+=M4xcl*-2>A=UzgClmo>#eNRBrVcoG#>NU_?TylM zEbDWCHYf?P8h}8rB*l;)SnFPoS`uidZx`8Aj{DiiaOk9H38;t6CP(y10S*Mt zUa6s67MaO$*ji^3LoMT&C&(9I{R15^A2j%C{TABjeQ#L8Hj87eWyDa6k=B(oeTDj& z2nv0?$obKkYY(hpPW z+Kb~J7qf0QEsR?0{y6SDLu^nIW5mhht??`)|F4@x3_)lO{_(p!$5j1nV%%E{rq==a zDBo19e}MT=74EV0_{xeT{+_(U(uHZDDV2O3aITa}FnsG5nZBzyCeEd{TySA*u*&pN zXDp3Xj{#9s z)Q5R_8xJ)&9(UA-{4&>BP?JZPe+#=ydkx0$wBp=HJ0|=Z^+p~;_&}87Y^Sjxwmoez z97-a>0X*|82l6yxtcX}T{*Px`1U0A#Z~*SC(jI;4LSFG(kI)7=hBP!3v_1)+;1koV=llA6sB`eFvi5r8i6 zUj0x0ObOta)H_mCW_c$fBmm%^odG{Y{@@Imd<$sDmAk$vcJH8EJd^Y#pxou=J z7})lE={!;Fn~P@;A>F;57z*mWxAQy<^^+jKIS2BQpAvg6JZt78=`xOZ#U(*|9pq{Q z`ca2 z1ucPdz22ie6t#37Z&b?UOhMv#8{#5V)Y$SI2euN=s5KoOTVv- z7;a!W)6L-x8#;a`Kn1RCe2B_QF)`I4%56+f2--;0((!xjBg4Zg0|WKMhP!H`M+)Fz zuQVk#k_k)VXIc)E6-u(W4#G-P(jRG*^kxi3X4zyYCN7S{}>AgMu|Gqxtm4DA^^_l;Tx z+K^NjyMj_Zp2M)p+Tq!&Sssd?;y$py5gcl;EDw`60A&91d+?F~_19se*947+9{leZ5pxxV2L2oS3ciL$EX#?*53r-;S1L?nzy+jt6FHA71e73yjyhV(g6GDQb`Hvh>TJyCC<^ zxcnpw8D_|vQGl+3jq5oNL-`RL@LkkPJa(s{q~1m!O;Dszx$-92omQ8{|k1^Ifl4ok`3&1T>@xNGlmm zM3<<&RRZBSK;^~_i_A?9HCP)V0Ut>I+6V;VkX_ljVUbzqP=lPOh<@ZjIRC3r=3HB! z1Od7kPJB0yH(jr+-0`TOH7YvPyWvBD3`}Cad|? z%Q)u4cs&=_D3S@S;Fwg*@ID@VDAxzD|2p-Fr1rPrb2;|%i>zQ6(^5<^g3Wk{dBHx zqrS!B>JH4)F5715SQoZ~^(am-lw4voPX~tmSU;8Jhd$6J75h=%n*F4ue@}$|$nZ@@ z+_ur-J7#m=m8tokwDcXrHyI#o4tl`1GJXzEeN6VfXq)A_P^aax+wa&t)b~X=keCN1 zp4XBCS86!6BA#P5h_V~<+VOc*Sw56`#GF{n?QW_Ux)U1~nNv%MxgMZL0yS6)-~@>n z9a+RoWY4NRD>-BMKf^%~sw)#xX>8|HTxay63@s5u71}FXB!OX7;u;n{ZRtvrQjKS3 zyF{2DBYyYmr+9ANgz#Y1rP!|xix|G7GJ)Go;+KFtRU$?NHU>K-SP7H(eZ#t^Eq#7& zUgdvAExiVuClUh4W&O*l$+$bU6#())2WTImOlCWvtx&3;IZMmO*Y#h_5B&T(uCRC=wP&dOIqt{Xh_Mc36Ct~b*{WlR7pOK3EwSQTg^hwY?x?z#Iu;qacwGd^%<;jReyL+Wl|1%kC z@OTZFw`D>8u}zG3>sV%87UUnV;br@NZLw$g|FKQP@T{1YR7;6bJ2~#2`vsJK$z$pB z@tgFsK3p4VR+UmFXo(t>cR@=m08{zJ!sw=(>Z?a3!QXk4ullJvUmMGbDuMjA1m*J` zkl!dlptWv(+p$fHqGzS4{%PEg_)y|0MpG+r9{`lLDVKqXdx8D-bD!XycJ4Bq8=RLv zq$rE!#sAehZyP>4_81s@QJ;8>7&}LK4%FzcEgk1IarBp!pB$xZt{J`|Olhh;O65cq zF=6N?BO*+%BqGZEi%cPx;pdeLQ;7*k3*Qm6vpUN`)ZQyi@k7L;jp&x1{+39}*tam1 znD9Yw5!0(X^ScSiRS!MMaSqs> z%p3soKW0G~`6-ng2R90EpboOM<2wayaH$ZLMd(8PN@ex~jypLb2{E(D5k0#ugWC&Q z?3{}t96))b*3NsE=n%9-3q)UN0PXozpnWD4#dhuot#%r)_%d1rX1Ex_AndAC;EAf< z9}{E8C19u!sjA<=az7YlC1C7uYz%%+gaaNBR(f+lMt%!xE-8o%=NQU{MW!bgO#D0i zwxA)u_2n)&EM$X0=Yi=gA*P%IJ@@h)pNHaZV*X$jgpo(a-C$x}3GvoS+}lU?gQi}@ z%VIrP7DVW&fx8A!w+J)rvMMe7Xqgrk)onPJH`sF--w#?jfLSmL!top?_XOiPOwK+a z&gXtDo+r3Y#rhBK+1P*lEjSAce0NVSXa%UiaZ7?4ywm|kEs#J>SYY@65$LLHV73jm zUuM@jz=%L~W&K#rNDs>ysl15iT{VU$L0j)yC5iJQmJsuq4CwJ?K+m_Iv2^>Hu?!&e z@559U;H`pXHfFU@0>(WX7MZGBHK6~2!;^Mdx>^9{F5J7BJO{#$D90s=QRh*TQGdBgg>Q(3G*cREjHy#TV{AOW8M6fjiX?dl7Tcv&~A9j(g9`nwsZG9tqzcRUvI1$-&g$ooS+7M>nANe{>k#sYK|l@G15|hIJZB-xdp{Lc?XzV?A2{-T>mTS?^#Z#)HnDuOEk`MSmTNM(=6SaEMMAwmzne|&#M+iA%e+q=!u_lnLF0*{xx2I+Wj z1GE1$c`22J3;ehrN>Mo?0=pmS$pr1FSahP-qH;d++)QHnR@|Gc0XTtY@xW7-j{7uW z$Lj7Am`_xondw{VAtjTTMJw(_9kYk^#l{2pCmk!@pA?mQZA>eMWqK{kJMBlEqrrZ5 zOmfEVzLxVE{2$xjL8<98cQzMJc$=-F+S?rK?Nc8Jinb$>Ktm&kyp2N-x=&`ra!5{4=Huk zvOJV;Fxkp$W3nQzMVUebV)l7BW*pLp2+XSVuD5e#Uqy_mFWB^CE|1s6Gd6q}wAPI` zT!H)gJqOS0Bw~3`3!KmMyUIs0K~^jI-8l1MtYp|zhA299IF`tWJCme^_O zxYp@800GLeAGa>#IiLPrHEsKyCmTXTu1dn2`WhkZxo^H_)bwf zwn@|=gljG_J6h2Li_F2LViaY-kw!=Kg*wol-w2x7lo9<*%8b=jPteXbXGT-=Y@euQ zc1|z>x*&O__Qe7)>Fvx;b|8`iCgFKe173(9+FJmo@9vAVy?!tvby70%wy5phFD3UD z2!Ve{U?wJj8R-Kpk;U&}Cpq~&>=z4&8JSCrAt^hSj(<{f)nH^U7>V0iUfphn4g9>t zumD@1xAem>y;9}85%)--7I|YHn1zlT+4CZR_MVN?G>-xS)s~n3Itkk1Yn3F*D_#Nm z1DC=M-P0 zCYGLS^MUKRe^^Uq@v2A$$my{(i=Np%eICuT9HJeQ6|;{@bqv zBO=xuF?n9aL)4=BZ4xm_)B2<$K#x}<0d^K}?C<1g`zUn{TT~~%B*{3XJs(r*YR<^6 zY80mwc=Oa?iwG-8CdiwQEJ7OB?%O8M8*rO#j&cqeGB zkE87AjfRJB@7S=&Y?%v2Pl~b}@yd0?xKK}20pxGCTKdj2v|@nq zxVq@++ZRMf8W%>*rt70;n{SAw<`I)hlE%;B#Dn5&_0Zr_KpCe!EI=2#qg^LNPw&js z*!k)d%(Nd}r*7%tUrf+&zCT1=e3QU1ORur_k*7Ul3`3CVflITrLmga~Oe~e|kN@{$ z!9=5Ue`2R}e_|78C%0O<=v5E(wuxHeaF+I~`8a&2&;QL{weJ{`R!x_32K=W7-*h)6Dbnn{W(sa9+mwlE}D+$K-SF3x_hhYbq3Uh=k=m z!TJ9A6PAwp-I`~)jbakBX%)qkS3$c)w{#*w1QB*~KXN~%JiwGze zGP(G^*$}w<36`UU)lt-8=_q6O+PL^w56au3Lp^kG9yn1?`G(;)7RH)IVt$hLv%`6n zBEe13b3PRR5w%>Y$(JM(9x!Sg5Z*5<8zy8wGd`=x}NiL71&+Op|rn;kWGvlC~WdkDtofQNas8xB6Kaa<>cD4^nfpM zxmHAoNkldHsz{8M)I~<~z~#&i^w+H{-?ZVm5m*jytpB~8%tyxm31wJO45wg%!@hq6 z_0aoUd49uJMSc%-&gXAuv~RLIihKFk+n}Y-HOlHNr~8jZZKzSy5{uPqd%vq*+qYD` z_SpB;YmeWqUi;ZH_1e!H)ocIpWA)nOuF~k|o~cm+#7sQKeYW}}Ar=wTV4_hBBo<`Z z`P?&kKKG3C^SLJ)1#RDC_0ahI?98v$0edEfExphI`7LLJP<*l)Y~G@}howS)=gP|J ztpYGRr6{pA3c`G1{(7sW_erjpfPCgouNFs{>~Txqxz*AeG9e#nzq+!rx^rb&^;XDc z82czIFW+V9V`uuYe?HSc3y;t9{`awbXGq)AzBj1vpl-v?a@9H6sTH6Lw&!WSS)et} zgm6THZe4&b)Onr|xNbdi%S4uIwd7c?_GETs)iKExI~QB+jIEjpVR8{vV0-xgvY8NO z^t|8CCy5QNYT+O`j*{!+SP>R0%~wNrTU}i^25Z^?IC?fe$TM1Kn+gHg0NSBa)rg1 z7xKAKCTb;=GI=gdKbXy?!_sTHz7gKcjx?0_u z^;^~ycWk4LW$(4}eXEVQI=A`WpQxeiwMw^iZw7StF~9gCK91>=wCu+%y+eR5tQY0b zhzN4?ixV}Fv$YNpqFXlzWBEn$bv(a?Z2s8yH%`)yq^OSL!ZAf`pG-*mqd7o+u*1^R z^>JBZqSk8Hi}ZV6>#x{+#WbGtk>P(m&U4OSKa&6lS~N>9IW||r`7#y=S`q5RSF(6a zhBYTW&UEsg&QB_m&7!Lf$5MZW%3s*N==)N%TwPm{?8yY?OY%>?nU@mtoNwkE(S(cL z`L?4xh&)&rCqpG%#DrNSKtyllAHrNdVX=cEl*a&M93#$;FFZ+mEJe@panJdDJe~n^ zZHJ{J{Xa>m>$()x-$Z%ZMNDToXh=tXK&hUN@4wf6hi!XBZ{^@o&?-PZv_C^Vgl)3> zky{J3DKFp}6|tNpIImZ~!0Z&K7{2UL9*2kW)1)m72hQK?BIYrh?#$`t^4@W&Fy@O- z(w3!oT-Fl4*9(rKUb~Lx{~WU~+4)kDFX333-78lOuE|w{$ZJ!jU={)~58L-47uu(k z*(BhBqLmQ|WDmGjDk8^xd)oHpXYVCg8DVxO2>sONtAFg^^um!szFOQAv2n_f*L=Uj z(pd~Oe(Sh+Rh;Dp=lL12?q70zcOxx>APqoThv(pZO7-T~Cu?JSoJ`g(Mmj2RI|}LG zd$UY{_PQ^wV>wBSQdBPpTY8ZQVV_;D(k_SZ8SR~(r%g!l98+0go;SBof*AM7Wpx|CJYU^8KjQoFT`tG@IV=*h<1Fn~X2$~xB&)EUQA%AKEUM$0C*FKA zs8sxRmAk{zQGR?P#m+!E%9k(U?`di<@usorev9g$ZV3YHS_RV&yA#Q*%AZFHJ7@W>RdqM#X{YR%wK3U(=ckX|vtiMBv1-T%)H2YfZ?W`x`}eN*4r9vvh_HxkgUSZxK4|;bKc(f3TQ%{^9UcdF%ilS0~=>M%Q162U%NcabpzJ+v-#TF znx#KBYGZbjY1)ZrEd7qHj7J;*rhtYiPwe;`u0N?HnX&xFxOjK0s7gq2aB|fFpoE7xxC(i(7tT$Z?0xT#YO?z_W>NJ zd$>&VeRZ)0f*RCDsV)|(hX&sUmd9kszAN9=dpAA4(ZZ!qf`e>K z)AG6SPw_FYq-X_;=eKh(2v9oPHx&xz zPhF1o@r*kIhiBXwXwHQE$lCk<|BStRd{oudKfLzdljLMhAjzCbCQMQ?6Hv%#D@p>1 zpg9>(=+URu!&oiy%7l1{K&?qo5zw4mkU+TPkl<**lAyF^Dt&01Sf<*VOQk;8S`3KR z_NkLZ#g;ygTqQ@CocFW$J`)1^w7NYb}YdGp%XnKIfTo zqBnNLLJb}9JpK&dH7&8wa5>WXcM`5k(gtpA<~Xj=hZruQ3M(f$q7Sh=2H#&=Vp*cn8m|Idf`a>|N47{>E7COfAN2G8M($w{PDIJ+UpB@W2K^u@j z8>qE&xh!jsg|fieME$Na9OG_)KJQE7^iAF#3n6g&Y6;s5W&1*luYp#2r1uzVjfEZu z?q5qfeYZ)>Ha@)9iU~RHmG70-80$%PYey_JuOk+U^E8@NdU?+`41rV4+(tHCGy^jA z3y55tTflpXFg#g+Kx-oCyGKh-4H{;E(phup#-hKOmwM!#StNIk@2h6c6WE%XWt-W& zvvFKMKPp40jtLwg@XM&~%v21*FGhZhIG%}mcalf>%99FTK6Q{4SH5R%H zMqZso&)+JK1V_zo-XAg3H(sWw|B>GuV;Gdvnqw|6>+|-TPOr5l#d-?4c&vb*(o`b! zxyv-14GSC9C~B|ru7m914b*p+nD71%I(M38A-xa12lXY#`|8vtyg=vNwU=rR&kz)L z+Ah`Q(s$MXx_C~LbA_|L)lK!MHj(!%_pW=ov_1Oxav@o0j=N=oM zHvrb&pnrSJHAs+;05oHy4V3qI^mAKdt~{&PD18=N(^`u<$JcNUwXhhZ**i5;ue5xT zT8?=T$!&+q3Jig~|D%3W#t``DwpgeT!{P2_Svs9}+SgQ%P`h-4&U}l4>O|0M+Tc{F z$?DddS%1jaGxYE-?uY!{igDs{IYf}Jq!lU!1OYFG!`@()o_Ei(5i37;KiH<|saxs0 zG7SD^$jQ{jt+BCwV{{H>wQ>lWyFbj-b8Qf5U%sly!l7oh6vwx*_1?lDmLsJvX(~c5 zRpkO&p%Dm7M-V^{YATxfBKxfeL7>-Grw#%?C&)2snqf(%j$hzCMRrewQ-c@z`+=OP zAF}e=Xv|Y~1E0$eZHrOcT{ynJPL9{TTC^i4!|h^uB{w&7JzUrv3pp{%<7*z<1AT7H zUu=f^bM&9>jD@Nla^#O&SzX@>%InMeIA_X{8{2u$wxC01eQ0lPkFm92>JwkTlj}q- zKyh3~OA&OjdLpZyFwZ6z_W=|vwd(rv1i9D`Q1DS(%r&<5Yt7lRg@JOGAYXKx5dG<;oGvYi)v>BwiSDXi!wj6uN}DzIzelc&`XGR&LgC;~<%q}1 zLyb;_0ETDPJizv)0`Co*J45F9{WiI>b~*%xmU3MBbz5Q~m@qPnjt_e`r^McADBH4(x@b7~RJ5FMKCwNTp4gJ-fG1j~BF_=Ef$@?$6#=j3rhrk@r z)C`n1oAWa>47SPo%R6JNmsB=rs$p_`xSO(|wcUzM*m+&wU@__(1O?G+O2_UQ6vxT# z{gYXbA!SQ=&nc;2Cygx?|hOYKCnGX8iIrKl~pH2#2w>1{h z5~er{Tl0yA%(p;89LmNtIukSg$ms;E4o%T28WRz zHIq7{rojA(cQ^CvyyLGsa1Fa|dRr_sD1I-Wo_8CyxoCvRO&ROEAceiVoI0#>I-);? z2phXQa`o&s&M%g~yfqdIW^$V1^t=M#%mPh)!!%v!cB?1LY%ty%WjL?l_7Ssda5k5# z$n!ksa_Av?KQ}wiW^$aT);+rz79EZE`S~bJabalg{vj*47M)WlC%W*`GK zkLl>|M=$BLqo!+!^;(p|^uD`Z;MZ$RRwwzo z^jPTAQPb5;o}1;Z-L7)n*(_fzyj+#BncJ)=KtVTdpB3aaLVRu1>Cs<&KF0bey{OZ; zeT3?#gZ@X)gJzGull?!*w^NUW#?LWje>MY4*_^;|w0*zsV1CNa&q})&|I>;$y;xJ} zJcfYI_xv4~jPmim_Ah3D(iLGC(V5|%2FM+A?aoivHIus2`Wx^ndjQnZj!3Cyjh!^%@U? z%xa^kU0zS1tKB9WLj;BAu^vJ)>!mU^ZQhy=EC06)L18<{#>eHL57vWDJlcSn3Pz-f z%}a&RR9;gCHrbeB^#rGSvkWffgwQ$u;Vo>9<|M54vUzeeX#w*k@>tEGzG>c>KxoOI^F&`Fbow@6GlpLznMUQvc|d zEj0GyJ{H4~W4_msF`k`S^a}G)$}jEpvY6`&g2Rhgp0R8U?zU(g2K~o8&M59dls>1A z$~KFyL38}|g4Oeg_4(m>t9_=0Ek>N->S@p#=UsI7<^9xYEa=|C_w%Sv%>9?6jLtrQ z{Z!}u?X&eGmakX>P|0fkL@>_2TCbw}o7IBn+N;p7epA)zsCCmg88mHR;jUQ72HHSf zjHsJhf6W=wbkWbHF*9(I@3Yf5e&9VT-{7KYhNzFlat-bw29pUnuc-v^iBf<7 z{XW$x7c~TBr6K3(BllO_e?aqqGGdypuRG5MwsGgl>^v)e_QmUEy6L#D#htSu;|432 zD~xAo>Qu|G1~f9OJCWmXkLlOAeB~PKS|OVz^)Gz2psC+!j)lHp7$gv;?^I@C)0V75 zmHr%X$XVZB^KJZ9eA-R~fn@-MNg*h4Q+rTv;3Mpo!lq+&ul0=XuUXycbVA2Zj2pParr+{nZ<7vN2X8ITMU% z)pR{N2aFFfbhjtU3`?GXY|wb4J{P)&X3EB1haB;Zo5cH3ci1%b z58Gm)CE0R>={{m|s|H1gtV#t#&Xyy=EGSq^cyGPA1PY>aWTR}dT=d&*ya%vmn%yHr z3cFl#k+~IB4kk0q26hj|v&KBVG@IeH7TDhPr9mKB7#TTIhszQeJPAx%?*)hK_-7iQtJ0PK1QPSNw2UCs<&*cuCk>G@BiN`(0yz-l|_ zxkpiDdjiLO$n8Ou?KY14kh>XGf(-&Mvv`E(s~3E8pKe%i2ml$)H_Vm)tU&5hGNjvYfaNd^{4%~*+o+12$gBR z_Cv(dY@R=5OOqq>hf-(TvgC+u$Sm+f!fpPP-?_bjMdXBtXqqmn*IN+RYiiR!w$@mC zOtZT-h4s}O@BrVV^aFI&rBPia;WMMA>q_j|yyo3)ROZgod79bNU-J0hvZvoeaFWhT z=Lilzf#C3HHW(vQkbdlEGxYP{xk?|ue;0Jih7)9?fIt^`Ko7e491_PY&^TrR$KGEI zksy|hb`0J0`z!!w`!8s0?FwVy>t(lYjfL7r&2IX68Otw$Uj+RLBk@{iNVxo7Ju$QE ztYy!6?oU?uKX=7K(R(lXp|$Z|;3cw=3;2YHAW-IDYr1a-F;HKqsmuXJ@PgU(2P*%+ zSit&}^1VRW_+t~p%`ISiOraR-#m{iL*ga5F(7|eMjkm4%vAb%4G5FBsm_yW8NNtK; zfo;lh9ldM}x;bXvqnGj%SuU2ZEUaD`1LOq7?Tj}A0aMZ@p(aaa-8Z&^cpBMan=eT5O{o| z9BF-8Zuw}<vhgqi=U)>!e!%%exRdHt@M@Nm*=;65WmJHG#_Idi7*6A744YD@)N&!v z2oO*JoLZ`EeA*Zb(Q&O!)grqHAKzBY$C&l>ckmukD`RFLI8ipD2)fvK-~H9`ZrOAN zX2`gA`Ey&$RZHh}jpLIJe#v{jX(B{4Q8vmZ^1h*U)Q5M{yR0HuR9fLF0voHnD(t0mmSokS+2CDG0;Ajp`sZ9$2hNWB zKO1;I(>R|z5(E}XoKJEl1U_@n&o=h^XPAD*l|AVYXk?#JWqTUO@X6JnGAeQmpIjL# zb0N^d@=`&|7>J=?CGD(kqt`!rCjy|me--B@|rEc z{9StuGY~Du`fdy-HUb0&>*;57qI{I~3_MW>5U9-qW{>-0WPCw(X$6)!omELn^AUb8-{jag^Z;ZRY z-MYVF25NE7ll0!6##pG0VIc8q89oDcpCBV&rK|iry-tptrnF$W7-`(!?xk_;j9T|U zEiAnzPOFjJ$T1J(kIk-ZfMSnny69NYu_;-{_Y~s#z;NUqy-KJ5Bf;CWhT6u9yl+SR z9JUT{?X`L}{ci+SCZ93`C{lbkTMFEWk$ zNly6X&Ai7twa=g}9oe?S+S|AfBI`$49cQHGK9)1i@&>#Bx0Tr;l0{%eM*;-aO_U>a z-rl`-GFuC$v=6aDryj_bZ}gQuyIUi}r~Sp}eDZYdrt%95r37 z7{u?=_qv+prF7GI8vW7iD!UpCr%g7x{$O@#c3uO>*0t&Uh9J<2WkyFZQ#RfxXBI`+ejK&Q#n7<*N%M`<)K+IQtY#L+9gaReT_2BgQ-GkGcl}y*&eBZp7ky(zd05Pnr8PoB87Lq#(SPn|N5Mr)vjOa0fBfw{jAL_*7LQ0O&oNF zPaG>?G07I`IU;~_cMYoSFwHNbFt7+jr5Tdo{#uN+)rCeI{!(1L%VEr*q}RT2P3Oz!*-{K zAxRSV+Ub`X9QS%)c!jKNbrKuXWZk0i@LAa);O-3+_&Xa6ia>iBqO{|^(g}opfy{6eM0~mj{a){fSVxb7e`P8>f zv1np>S+8>(#b6@niQ|4BPfrEr`#5I_4$C>0)AX=u2Cj@dDlTw5lBb$tp>{V!G&|^@ zUpMZVjlgh?=rieW%dpI_(5S2|ZR9;ty#R0jI1~%DJHR;0@^>LT<7#OAscE{FjhF>z z#`jGbS7+^IHN?EvgV*x0cL2}BrSZ*Yxe#NyBGb5UO>I?6Q!Jz&L%<_g`vFqD6 z@%*DQ1c$x*r|XY2#X_qO1&cD*$t|n;JWU=<`Hpm#EE_e;XBE+NO$?DGjj@m*2Pa3d zm0vrB=kCh@13gue zlxdgerO;UT{DxSFUPGVRI15?<%71ir96xBx@ma1Mi}zIUVAwyJ`i+q+PjK>B{JoKY9Pub-800D-r zcwq3p_E-Kq&|du6>A_Tpc|Rz-4~ohr)AK+mn+yjA?~6(h`;@Ic&tq$3Y`xpUi@LHW zPcq_bitK-Y!1!KMFOQl5lp_~;O|$U4X}Z|BuYGlF+}Rj^myfX*H1$WDn9XGQR&m}A zfA@0CF0C{5DT^P6}MRD4fA$mHL}YKp5J&$ZF>PVqdS@FCL-J%*qg7-q9G z9BATsXmRYeE9IZg&rfDTQ9JPS7dFL0L#FAHKpQxM!8mQL#m=;FGJ;hcC*v}ipz-D( z-1>xPVxg!6#$Y|qzkieOe}`u_@p{bN7*0i#cDn~%m*acTnCLqjcs|2e{npwyItN)k z4PVdb+r(t-u=k4Eamrs9LFt~8P+Z0_SDL{ySHG?$7K-OZQhJwf;<=aY00s0u9dK!X ziOH^&-KoytDf2zE4S?bS{uG_+p1sujr(VMcOs;JY?>|;=d5@ILEwBIVfP=Zfym&~a?4fE zGJDO|f@??)>yzA;1nIb9Zqa|!d3pKVqAy8?uRCVW9-1Q?9+K0<_R}yl`5I%P=tZ+| z^_ONLz2;rhbP>=7Flg$2wr-CZHp4!?R<-}kqF;25tMQBXz+gNz$`QkdW_wgWwDy0< zr0~X#T*oQz=snoJ(+@A-cZw!K;3rhBSI7|r&#EKWvH$GU@5&Wq=8KM$$i|JJsbvWE z%Lw*+Z@)^18KOR^k?SPH%&vP8oLo#mU0ZEuy0K;>&-2r4(DgXOO3P-sA-`*6c|`?f zi5xqnr!f`^5{6I4_Ml#GWOcIzriJC63-0B$F*DF(*=7&-=M4IOcW#V@+Ao@g(d(#O zXR*HIgUo-K#Gdu-jciS=Fj~U@FSYQ*FKmc~ULTj^c{#S}J7f8cl2v;_`K^IA!1iaR zYU=(S{Jp9FI~&@oc#ew8cjhW?)1$1`Xx4$R#g!o$;otz#hmbZ27X&BDhDLoS z2U~CM>cDbw$?Lqg)M1_1&pzJB_3snb%WZx!jdzADOt(@^Q~gDJ-!ZsYj%XjwI&drz z(m%BNU(oT{x{=55Wmn5j<^o!={Gu5snop)v(QKpKZn|J8XO zSU;DM4SfHjebnq)oe1eIeKVW7pO#yq37R_6SJd?9gr0$59xkTxv17d@qZqn|NJhBq zJHTq;es(R#jimSc!!ullY8@74e3s1C_-h@qq4{~vMMsRvl`A}p*D)~JyKiGG^d61F z(`3E}^PMZO?k|qVx}S7HyTE1hHEUlv8sk_DURJxmm*w@c{nL6YxA%Q+%PF1P=(rIm zjLwuJGZCB|lw^b1=PbFh`i2{H?sL_)MHlgyK-_5I5`b+SE`bz|zKHc#>bXz$Jl_Ll zb$i3_U(ri}&U5QoUfKX1M{d{t68Ei|slOSZcGH@#GBICQKbH3m{d_Lc>DU%w*w1Y2 zG(KOww`SEysny%~cq6xEJ+_fqljhNRQ;y^o@K`R63-CAVoOUuYYwUmE|5N|wnDzfT zt6#)9YTwu%xQq48D|>LGYUZNi)_RUR*bO7Iqa?#8f##UDk>dokCc?YB6XECH3k<({ zKSZbNKi^J$70GAS4e;8%XgTUiUe-FCT3)lxo(VZUPc`@;R2V7=eq4Sp`?(?4m zILt7ahe1Do1Xz!b=x&~K(S6@^ovmlTG(~sJ$xww@ZK3Vwr2v7HRvrh{Vw--Ib^T+@3yPji z1pVAaliICQ?QUgF`$aQwmSl$i%6#MBQvb5KtjhAkQ!U+{$JPRv?>LzHRiCl9Ar?Bb zwl5yXHIJrF9vSoH$K8X@8H1v1^a6CzITlxx6)m04d+p~|c#FpLIQ8;zq0e}^;ZjaK z_2HO*Hx=n>J@1)FQy&ZcH}w+$y1*I7_K}Or01D#!`|S*C;~V~bzB*YgbwlId1+g&qhoOg1&S2)r}=h8-=JFp)D`T8+E7OH+4cJkiF zPG4Cfyn9ar&!wVq-+KTB)F+|;c{k_jd7uqcvhi{H;@A&5{cdg;sKIbTK-Rrq$=CmG znl3+R>PBk}&s?fq4afaplepf!8bfnzEwCOqXBMH(U(UmNye4~u`nCi!yiL4U8(5Pi zM=n$+bhgg{qvz2D#*Y_(vC6`w>i7ureM6gUw9n)7aQZVmPwOWeVxb=|kPSrS;x9;I zxMVe|tWAbMRubqr^E^%T_l_Eflr-=$rN2{KK8N8ZfDVuHUOKENE&;uT#%xv{cTrs| z)V=^%%-xZospp6k&Z55ED^O`mD_zsRKsLaswXq(siBLE@9l9R_INXihx(hT%mW5%R z4Vrp!3Uv4UY=Myr5NV$y8{h%`2U}txw++&J>K3r~>X;)N!z3fTX94x^+&&v<13T+1 zY`8qOA6eW!4GNzGD5xQmmItTvzSA_`2@tp~mpE7aVHyOO|F_UQUbYSRaxq(ziZBUq71C^UknE{j~M@j*T2R$FSO9hA^L5_G4 z6nts%<5S}Hc~3sIy#doWE75nBpz!<@VExfS1J=jn9C3wrIY?F(F^|=R*nx-p}^{z`?(H=7c{&vtmFiqF3Qy~2#fXXcZ z0ZIdXe$+HwFV2%0Ztkj{8=L4n`b?5sOveup1WGRQp2!D#;LeXM{BatyohOMtdaNaK zaqXyC7@$6w)tfGUu3(z%+!2!KJ4gRN3zc31fe(7%PJWLp-{%Y~2Ce8o5cudbzHhQA z3G|O%fyxfd_Rosxc-yk%HC`J87TO?kk=VmD{-EzAgIo-wEMI3ojO6R?W{!>UrD?k2 z*VY0AzHNgD<;ybwg|Z+=iV64*o2Kg{3-5INb4oD;N(DJ0r^%7E1o;4vPfi1di$!@# z`O$_)W@|TtK1kd?IQi7}dNz*8M`@#WeO?+EvIq2AXMldY40?SM=>9uEF9XiosaZ11 zvs`C`cYkJ@u2L$u*4WVd(tDn;#wKcw&2hFD#rwDn5*#kK@pZEkao$rN0-Weg+uUZD zrc3Dn{Wc^QpP+L9LMv)bGk`#jD9Lif3w9sRiRD;8{~%JBj?qHU)O^s?O{VFB9B{;C zy98iGDS-gxNezMJg9+@j5qPvTU*k3^LUoqjvwa@VYoIo))Fwx$e)qDv1qjP2vXSYA zRt?Yf)#JH#fNXm$&asyR_~rmn4zV5{P(a6)@mt_BMdyX08~7Yhnj#w>;5~=v=Z=`! z8Er@&6>M9W!i0c5jd^&ZfFJ!-nzYvf371CRT@y*U=j2F=kw%JC?oB-cq}vRSS%0wszBCu6EPV6z!(rY1&O6U!&dh$#vRI zpU%{7IzC&w>0?)F=cl=8ovbe8I;$>Zo=qQWBAr9^L?509`p`5mh7vT#&?1NorD~3$ zyCE_(47zNS_pvoX8|<59;l2!B_f;RJxsLiU@4h^qzTuXMo#p=z^nJ23we$D}FzyH0 z`1m?7s4W?uXVZtbkj88i}~8d zU0N)(3WGu8Yn$`7e7vnyP0CX88zDhSo-XGLDA6vU1jYY9zpnD4BvC+E6c7^o!KU>6 z<5{&7C5S^=zo`-)Xq4UpL0p-=RV@d>p3?AARXNy{KmPagYB^xB4+NzgkhpL5fhtih z%`d;BULuHy|9h@h^#ie&A)DxjL}lxL{Gxk+^VS@OBzDCsxDdI}N%7n!3s?@1+g!0Ziy;dp(ByL8?{@%t` z$7Vzn>Zfl;f+(cPktc50s=9vpMiq?#C!&esJ19lG9gs4)NRGVoz*gy7Fj3r$CfYY6 ztZYU^ocHE)>hQ^ztL9-MmP3koElgDC`}89sZbrnu86l+(VKF63j%+~_#C-^heTXRg zZrURK049ijm|*wAM1|6n*S=ltd-;v3Wf-&fErSV)e|nv?2l03G0#Up$QJmn$*pCLyIuv2Wsnc}N>g3|h6tJH;@;xX*B zAHx~SF-$~KAV;16mw29@gPh8FH6(?wOFV{M_UEumIff@F@8JybSY@L+>rY)($4I7l z3}=Xiwpw+^tj?-qH$N+VfiuM{l4;K(P9=*>5GTx)Bi)F;OP1K}+ab~GKfoDE7IE3L zNT!lSoMPaW2K8wFZ>s``(w8N+KGG_6VW)Ti(|gc+vGYY&#j~nQI8YTrl*TOa{C%80 zN?R7mu%4MI&QhAxV{gAy^*x~UWr@cWPS*%#&$DL{cD{Jmx#!gPX8oqBFizhMUr%3` zSf`$S^Vd}Y{IBVIVpE+OTG(DS8~zP_hj*#7oUc{AivBfy8Bgw3AN%t4s*Ha_-_h5f zR}1F8RCV^>@bCREHTC?12ddsD|C+up_SdSfw*9s$6aQ=ax?iYM@A~P>Rqy>f{&`+d zSIzCNS_S`Rd}~_O^Dn$n^~Ap$-+MLni~o70>hZ6kZxV6Zi-}7qrsJz`RPWmR^QuBj z>6F6XCMBNI{Sb3SG{l1L+L&LJx&wnL8kb< zshibTf4Of=)|j67$Mk^lX$RV%cEA2c)q8~ViPG79_2sm*E_^{f8tNL;fv=_K-1F-D zYdfo4|AL;(l^fN^-~a6xZ@!M6jIAN{-21<(;&aT`({uELZR#p%@7S1q9X)rO4eIQ` zZ>nbh3wmBndq(}@g5Qn%3=liPh zWThHA#Z^U3>Z+fuUX_L=F^$p$ z^Y6@`@U1)37B@>XaGEIL8+_F`U8%;C#e5`*`L}G8l5w)=Mc4bhkfwOSA>Q!oCUyJ% z{Z$HbhzdfY^36?>581_1G{fhGWW@{V;;H}Irlz0USM?4`7vDiheCOe<(s$5Au@~k0 zykJ+nkS3=6b(h-w<{MS}P@1?8A#vaLw@80P6T}YW^Lb&S;)P^!gHQEORu05vHTyut*S-e@(GCAQfhDQVm>|pn;WH#h|>Q} zpBGY?t)~8w@NlE#MS}S9tv^zyz_q@GKlxQvIV3B75X5qrARY%K`hke$cekm-i}zNQ zBO?0msgv>miwhy&w-=b7r3m!d^qTqg(mWty1$celsy0>+$Te>Pvw zJN{O(PW@c_@Ap)l2>!V0lX4o%LHJXW5FVoO8_0&=1N!Z0vT@J@`hOJ3MmeM$x_zo_ zY(^6fvCp^j-}<%Ok^VF=auH^GU-bGHZT$Klr^&`%59s|D`w!i!Egd-s+t)&J zWCQ1bfv=T~^3VEP$hBbjKj>>A^JN3i2LmsZjq>01w~&Qk_+RO3At|zfQ^3GZ*(h)B zZy`=F{Ezmv5Lq^`3S+aQ5+1{4DxAz|E$SOVbfTzD@udV;ki#hWS-J&fW@d9a@ zN5>r!n&{`!xnS&;5$gr}G{F9|Bq@A~2;tKtIXpz{;WI=Ge?n5ipOOjTVKOoNw|cjp z2HL<~;Mi2Uu&>2i)OTnq&fC-g8HcW|#iJu>d7w8yM$>zcu!;V5 z|D*jaUT`)Yg@i*5js1sOG1=6LGY&QE>Oa%~&Za_;n$D8+Fg^DSNeJg+`>75Lfp-vU zqP)vTxM?3EO_WEQQDV~yl+dK0j3xm&nvO$y)5HSQnQ|@ev`;0SLXNF7dUxq%W8y&& z=y^I8Iz=4ePe@|;G{NCd2?-Ceo+BvyHd|-6u)h24`uP6xG**YHGOJxZOOOwo;6OG= zU$)#+6eY-q1y;Y)bQhr8{D5vlps7F5Vxc!CL*+&U0oMQQo@U$ZXD zqxUTBJW0?Pz6<@0{^x;`V_<{t1~KdlVzlpbM&GYH3ubOp19$wiDqhzyX~}K*G*-;I zN6GgRm*SW&=X)X3?gf{EfB2l_1uWvA98v8(i?6r$EcSy_9L7!>qltOqF~tvA_EJpe z^hrvB_?+a2baC3sS}ARAX+E9jj{_F>2=qK;Povih$CN3=Df%Hz{5+Z7kBGx7H%R5| zyk5l*N%n*GXC*%*CArr(~R@O=MxG%Y9@j*yZDujCJAlSs0kW-|`sVi%xlxyeZ)6esT zI;l?RS2i=ckbS+-tIQMnl{(}U%OOeJ3yF3X)31Dn#o{a2vu#Q_a*BJY9TJ|A>{I9G z?*$^xTUjU3W53X=lmoUa$vunnlY16V6KbV0dS66&XcMQhBN1O*xnAL0S7TzY6Z#YzqI^pf zj|=oYY~uZlXEw1KCn%qSQ>1=RHBJ=Eg?i~Rp;x(eWt~L7C(e)~-5A>`FAoYmi#zPS z3gz9KKxs@6A9$pN@$xaDPe~}C=Suc&Oq6PSi?mnhS=^0n;!EHZ*Vy|M`kB&5kG3K? zvX~(I5}{6Npfrhn3LW=)HoioB@sS-8J+8I)DrBx4SxYkPYl)^bT?=WsLV&*@r~M3)$j3Pi>Xvta?G+jO@yszwE0z zin2v7IK{vZ+a!AIf;43xaw@CreM&2KD~rW8sTF64`<~h&b)#&N(oDY>uB>Ip9gwPQ zMi~mF|1p@TtU%O9L(1l-HcNhx#1$w*X+hcIUF=;XvE`9g{`*r+Qa5%g3KEoVoFlG7 z*&;pCF`>uTkwZ~Xj?!vxmGV)NGLw#py;o75+C=9PML>y)7u@1vM!#G9^&>kZdTc}K zNcG-KC zYK%qy58EVmM5)Sgz>GJoIEU)Ka(vweX$Z1K&MPb~d!&UO^Uy@)AYf(m8Zh<(QEnD$ zrBbn1Ik@f_Do08mP}(!ZyTl`OjKsP}TKPPQCMbIWE0jOoc(T|44rTAU_0k^57AZfv z>AjgwU~vdilm@^`o&5;o`#L+76Svr~u0d*nY_S~D8Q*`&bVCx4fT)y%q_nX2%1|8G zp;Y4>v3y;6E0OBNjX0ahYpbOb^tc8DrW15rmeDc8Ny>ksRIU?%6sikU?lW+-) zVF#0;xGp%At!Sb`b>Sk)W;(Hi=|YY;7bhz3STghjG=b>^l_9DF^c`+TG~STJBTR-Q zaS_u2NtAGcvJX)nQJLU6P<@3CR9iYgkLQqWOa~~<*C0`$_KoU5E6Nt_$j-j6Vmj;; zk0PS1Ku#qf_A(w(x~MEsomh*q#UJeqsjWC$ymuwlwQTVQ;S2$w# zLbi|U!qdY)uiDAvCR@B0O&00#?<~frqkwRpsS zL3qzj-=FGCHO}_E2K4=M#9au}d0L#q-ZNWlfE;D6@O$5{?K`9$;(PYF!td>`;~XE= z9r}(tNQSrzCX0N2N>s`rM_Fg@^>tyVctO}8Z4iHNU&r1h$4B+&OK^)1!DMkUNfI|a z(kjs-)vpC8fsOHTa46gDM|`FBUi)_Y5&I3`@X@)0>Qw0u+a&7$oM!Lj5b0RacbkK3 zN+n5G?iG)+ce__SYNzkSZA^w(h$oBLh_E#Xs%!Bve3YaqbA%6l+wHB=D)Fd&j_{#< zC(ia!y`uU>WpNd8irILwNM-CUHh1NSOCU+vMpD^(wuv9I_ghSId{oy|;t;8r8khN486~1c`rTGD_!_G-V5! zpe(T;_0c(SjlD%`5s%oH*y;P__^7T`GufXk?t)Y{Zp>y`W4D>4D077Y-wu1L)G8je z&lLvjyKs(=>KwH}^!-|iQ{08<`%$|;QE4I~doMcg+-u)1Z5IdF`>8m`M|DqSvOih8 z2on_gncAiu?ENytO~lUL@5U?MkLqAP!ej5Z#CpHEI7Qh=lCAg479YFf{kZPA#T(IN zF$asxo{jevb`e3DE)4i~+FK7_d8$)3>W;7xQT=9%+#pu^_gR$)Z4g0sD4I zKy)s$E8Q3?%j~^Azc660viI8k;P7=ny+isfo-FzyTlB+Z(eZ;u$qx=@zXnh;^Sy4x ziAn+WEA73?YbZzYg1~GQwOs=@KBua;N2;h^JwOta55Xa>wZFw}F!PPMzO5x#X@De! z%GPV(V6rub&Gp$Lok!|WhC*%9e6T6Y#JAXd=}vBBwu$OpHA++(!6BAo!q$4K#a^Y6 z&G!PcQPtR~9EUWyoXSz~=eSQMTg5 z4(5l_?@q>RC$m>;iJ(v)Z4GgY7m!0-O!z!ckAH!5=SV^zpR=_;#x%c&*`Vf3ot=hPVCIy&cP{c9LD=>`6z?&JfG5l z9E|t$dz}ANCn*1Skwhg8i;T~79MW)(GKca?sAJox8WRb1zI1jTQ4cy#dvp4g7gOdbxAZJMKxv-mkt5}hz~a}^xe(b6d@aZ^U&((OpgFbZw*0@< zyY&e(ZqGkMCi?82|HwZN`sW-`|Pd_bEyD4HJhi3ABOVt$k>u^x8Vf zo7Jb>1)|-1f1lEDF?fW>%6aw%$WSuYJapi=jja!f??Hl{{&&An&-~bGMe?E91u-w?_04HM)$ zG=^2nF~q#VhJlXHUODZpeD8FJ5j&mRVC(GNy>p<{^~=+}TMwNsO&mInt_5SzG!J{D zb9LkaBc5}6#>%l}ea#6D!&KRb*LOLc;Fu(6DgbV3zZwh=ao$!$oVVpd=7}hA`aY<8 z&fSio={(8u<$`o#4?qBctEmQ~6Ma_x`9^?18Fn@00y=TQG+jJDSPHk|EKzzg7TS#w ztAp&wlZ|88^>#IOHAP8A*a@2Ifs$jx|402}yhh5xEoOPvvoDw-&5!gN42+gCKd)^c zPm5N^|EIKQiMMnH6QOfdlnua|8qW{?f8{5-d6!zc=0FwIAI4j)XpFaI0L|Eg^eN3V z^rb*pt-Y-W>AQijeAW2x{{;{z2WT#zaXtI)w`lb?&(J+Kd7n2;HcHdLkZrJU&@@ka zPtG2D#{KjvXD@b*sw`Jg~a#z#a`Z;nm&|hQ&0U;~sOqy=GzV%a`G@ z1Tp^U7cA$MbdF8|*88m<7~YKmHqf<1Fsj|)c;1intTaspBHiXDk|hh0@58z_w}((! zaQkv0V@wv_xIz{>z9I`5VQROVSI0s%7+bmi&M=jQZtQB3KvNfeX@))?F9#N8`}n;3 zGX%nCSxvB}(mAW^OEbjQFHQ3>XhnKAFkF%ofHbumb6mAvOWTbnuz%eR;;juw_8AeS*shT5CM#VUd_fGpBz-@kj+uE_G>EfDL=%bsV zGMP|)k`2$vr;f1o+Xul2(lI*Q+rqvtG zVk3e;Ek;a7>JWb?mMd@2>oUSPjrS7x?=`Uy)x%}Ldsm+`O&8eYeOe;y16%1n5HwXw zMEkD9JdR_mV>iFg+iPMWNY>QgI}jPeGq-Am!0NSk#_D4Tk1jCIuf?4^?)!fJ_&!W` z5h(naxO^Y^XP?L;yeH5{7*2Q-AwciZjWfj^hamEGy_cd15Exp`>YseeGUcM~L`XlD z2=8jk%ZdQ7qAm9pnK*;tZ+|grcC)@zPm@K1#2Fs$2mRAw&}%SZSRpky@x(AdpgIrq zWqI&!4Pb_uLI01}-aJsZbOdZrnb#nX_#xp?o|Zd;M$N!6Y-6}+J4C|(L`LZG}5T$l`UeQ~Z)k}<@|F}%yx8w+`ZLL^V$Mx%R!9vxGV<~WoukvUof$BA06Mz`oypO8OII4 zus@ou-9-8QuX6qdnh(B85FR*w@++3%$9X*Q*W^2=@T&hm{`vm}!PQ ziO@xV|Cm6y#0IQ3%C-*ei~<~0)T0Zzil1#B;9 z_(=1>6lg!43*^M#6Cf}TX#>fisbn4588x>J$o=i7KPDucp8)CQ7nLKs0ZufUX5bd2 zsUH*Kdr)}O{rk-c*&A(8P_rxb6n*Af!kcbb>C>kmIQg&ufux}Zb%XGGx4q(_qK6tw zbRR(R(psprKc%VBG_9>cION_Wyy>2=CuG|y?k}2ZgW}y9RN9i?bOUT?OL{&byP-WH z8!GNEDsL>&JpvR57d}+vNr7T{;loAK0GtaLJ>W|ee((OhmXwW$8dTQfZ>3MK6Z+hw zVp&lhf|FAKiWfGP=rtNtlBYBk(&_X2-Sd#9t{3{5X)+~v>NvZ12fqV1s~PZ|_^oWOW(UszFee`AR* zJfDyq=Yf`{wLwKik;ewbJqemh^>cWzVStT?jgLpt*m!Ih&?G({$8DF7hm16p`gQjU zJ?{0JA$tRXf|||f6di+aCqh7YN>i!K>|N>84+?L&U#@tt=)uMkeL6sKZY@+c3O(+F zY3th(bjY?P_qero$nL2Ka(>$=zaJ=~e5db}&E$_h4}3P^P4{{&AsauXjq#g4^Pte@ zrelpO9xTeE@2WwiAMx>S6#CqW$$jpF?Km6jI6JZ8!J?~eQ2dbwm2|wJVi|i@ls+>B zialwZf5FBQ9TwhS%$O)A%V+i<{aBS0tl$=Gt_Qq}EG|<%fIpD|z;Y4rD4BQV;Tm$F?=Jia0 zD8W8T)6&m)y$!vN<+PioYXd;R8=pbtOIh+7dDNtK#X;>H)zK0gR9=f9P{#VpvVH@i zJQo~T_KSYmFGfioyDyn4ul5RXryq!T<`Nbx>nAxL*S8Eqq!(bn_u{wo$Dd@iR}2HN zCXx4o9dAQdIY5sxTo7mYFRNoAj*pNLZg`T_adlHV>9Zh(=fKnXJCD+8;c&(MNjiT9 z6CnbismD#zwb3*KC=D1M)Om|m0`imbJn0$%DuamG)WhBsUZ)?&9T=;r8<#tsVUr`& zj+b03pKiB$!Nvbi$_M9T2nq*b^(;0oU;LIn{{Q=)iMd!W^s|EgC9{Khb}u*_nHUcH z0r{2!RQB9A&p4m7+pS^f-a|O%!>Q?3T{e-zw^JJt1pS-O@EUG<|znqBla!s_>b z&BnOgij{|6WHlFKw#_tgXDQNDI`+f$pf6pAI+w1)ou&lzoCrN< zm1mQUkFVC$d33&Rv}MEU@)5usKbXc%y)>o**|6DUgT`2;^n02du?6Mg@)W0|CQYs! zcI|fW2Exbpem*~ez_F32KgE0cK^P@K_aX#`tGDJce3b4dVnBfgnUgRa)*b}?wpFoEaM?WGgL-!DK{Rgj{6FF|1Gu)0#j-BSXj}AJAA*-f-CTMDW?J6VshJ)2azt3x; zqxGOqp!%`_>(%#VEdm5xP8-L45uc2OdJ{CY8iPo`FL;v1q!}yzILh*?nj!jz8pI%e zUF|&8iMJo)y%pm%^SKuZ>z{cgZd7ywujgj{f>|64K6WmG0LlRewFOgp;Lh?KaMV~f z@Jh@e8iOodhsJ8d*N;yI{E)+?A_y|s?Po4@7{Zugn(Rw~>uflFM(1djri2ceLzA z4oWlc1r>w?h7#|;3i>V&rZVbdTe`V*qO1e^3g@DR{L0Dl{oqw7U6q3)vPL?R0&BE6 z-CSuPZipN_|B2+M2WBO$lc=9VGEa{4 zF3v6bHd%j0OPVykgd88qX=64!KE%X%*eOOIV8J(#sl3&(BiK5+wREHCQ%pcC5}DMg7O*pZ?6PLDEk&;-Ax! zU)}6j#*Hi$9EZ|rFrr3?r2?4Nm^}{q*GiD0F$`2Qlg3azTlz}sUA-bP4!X6;v6{SC z`t0A$YwMlK?Dfr#b$ljlvPb(>p;MPOkbL3X-@Nm&qfK5+?QLitTGi}W?>AHoQQz=j zs&OMyvhTdcrrgfL_c-^{-}Jn|gvjkI>|Ne86yv=680Y@?mp2XhFY<2so!&`n{vw>+xc$e+KNgGcl86u;F;MV)ANcW_a-$1-k1W2r&iiFm5o< zZxOx)QEyCOZDft|(-A(o>_>vXiQ0IOHRp{eQa{<~SpT|N)R*hd;C+4PamO-BB$oC| zbbSr%%j)D^!7mfQVcfaEtW}x4S3!62L}u42=nkUtSO%wo~#>z<8I2pq>$T|P^-6e2}BMl2U8(lcU{#`@xV zBsRB-_Dj{OnXZH#Ymzu4(_CDRL9Hm+Ji&0Ica zc%iraPKn2^g5GjWi3i6)Z~3(n57PZUC7#frx4fXl)8n8&NxyAY;^}G7=g{>dO5B(R z-3OzO#$(XEIwc;Q;{N`i5|53C-V#-W9rmOLdP|8CPh>%#L)XtB-kT+Sc2c+SAihR} zezsl}^`S|BDJI+fDaQ&N4pf|740{6Lqj@D7He7nTopZ}55qQ}>Ou;@pU1Fve6P+7< zS%B}_LWvtgdJ)|ZZ4tF^BI(7E{9>15ou~I)ET!X{rC#vc&6!-NNiQ`1Wm_EUQR3tnLH7Q_Cgz+Wg7Iq|fH{j*f_qUKA^qqVGLwyGM@ z{`nH`!%)e-C`xvE5&6+Z;)$BT{-!nQpHJUabf`te$$wFx6aQ{GG_Qi5r#5I`e0QT` z<;}pxbe5by+80ldtgRGvI?N8Qz#$R)za^I_k0H9G43EHyBnWDX|O z`;ppo#Tn0)SotnSP;@L--aQKT4Nkh=B>A~yv&5-*Zh{dd+hoBmX|H`>Ws&nh=~yhu zu~CK|v<&Cg?_lonlsiae9)7o0NvHU|>zm2gC~iHA zea9ZW-Xt4p(q>7k!6wHVeALA$1A3-xbS$!&5?)NbtiG@+u{ZwvF@gEnO>&3!;-7Xo z)?1ug@;m>t>nw2C#rSHMcuY!&bc=%<7u#d;9>>N7wB}AX` zArHdm9#_o;LYMX@(~pW8p`Qu7NPlNxx&^6#hPWr2ZL7Tsx{*8GOjk=>$mwKj?qJWP zm%vWHsEYmEsZDQuX)^TmDs=&( z!Hd#oe;Dr+n&&o1o<=%vZ0BP~pKXxwi2hrvsB3IfJHPQ_YL~l?z2|v%z=w*& z^0J}x+KkW;=l*;_2ma(i)qm)@R%fJESzt(s?{zV;w|HR+ykiCWhYq)7Eiixb*~c>d z<|WT)(~=h-b*w=xKY3;u?5~qfH%_k2Q;*8$1fSRZ$@nJ6qTlwah!D+S3bO~bX~{p* zH@b6IKy#-t8`;c`spu(y5&bIX{$pNDrTa>@taVNN^#YBVb5WmcKwvuhle3##Oh>IS zxxCe}zQDQl8MR-|?0gu}={wjn|I4{Qv2E*+sC!(^>3ZFx0%ym3#MNaNDkxR%WRXf2%TM`x7O5TP;Yzp8 ztfI3>zr(`=OPKAu6J`cS@cc$c)O(eG7bU;=m|W}r#mw&9MrJPi<$&ScR z4%`KMLhGokoAGF-#%6x<;CjbO|A3_i?sD<|rZAxc1hQmZi79}uf3e)Rdp0^297&5` zdDOAqq&aJ0BYSBf=X!da5$(OBq=Iai;|(POzv5@Z-1@;^;kW5VmdeDIxU%mQ>6WUB zc3SJIo7Y7IpUY=>#Q~-IasfC6{u)0n0JF|H+s6Jt7tDj zbFHZVv$tI8tlx_}78p!?DzUfDXfQil9n09V*e(RKXQ*grn#A#iI;SkH3Lj`VumN#H zfo@bYyH)7H!k3xbv2n4zx18C##$c4ha-g%gtO39pMV-jxfR-I+B?Kcwf(W9%+FHw zz><0ombL)#KMityp|N7AGX^F1J>pa`UXpG%wx8*UB=XiJ-_US z!cGM&74>IykpTme4n5nef9DnLKTxj#cY z?wLR+^DNE5CU*{=*cRKL);yv13)~{RTM^&k34L@?{@toVuT^EcyGRyuZshY8|6T68q+gxILKJR{K=Kd}Z^x_>mj~WfN`)_dD>>uX( z6AiUu?r+KThD!wSM0%38dsGn&U>dC+hY44bDv2l&|5ec{*%YtZ^%6V z8b+Tl7}M`qU(S`^MB^8j?PKPH=8@LGu}A0Quk~}*ea3KYflNPlb8da!9A^3>TBP@d z95N73E6^8ZXi$NE8;!?(CeU0c+F#)Q9=xJP|9sA^Pcwau@l$1JuO84dGJ9~CTNm6q zCucdgF56E9ELAIVjAb35;jD#2OfjNAZ*lw?T+x1)#}sdpXEk9kyS0#|sGq!GYvGxj zkUFX%Onjvnc}rS}$GE(OsnCr{EY*LLls&I$0=qdS{CZDbZ@%=fV|C^twY!jsGw+Iv z+%gKK53)po{?;(JE|LE8GE9CGQcYgOe@r&?O)SM6?$WtiQ>BolTJwcoJE6Fl_WZPD z!?0Wvl6S@=2sxdt$eN#DYjG@UhiEu`6H+nGOKDEU*fv~mwm$4wpM1`G(i+ivracJL z+LA1Kh4w=sOD*&uoY@Br_UN9^?1T08<@?|bmu3yx2Zb!fRKcg05)J(D!YKVyAH{toKh|X(~n6aq~+`5wsJ7^#7oM;w5Eb*8#GX23! ztsWTB<&QZQ(IwF+(d8^KyY7jq>tfkRt(?J9B~T~SPhqK6(sQzV3so4=0JKH~A20mX z$oMYjt)yQD*N8K6LCZeI?60Ye^fW8G#j(DoO4*rrX?$ude+{mbax1t}*46xL^G);f zf82G8sR$FlAwEEIrD_cCqTe&~PQOEeeyjWYUPxLfa@!$WZ0vgUyM1ST%bUECe^g$@!7d-A(-Hf=fThyJk0u9(=zEV3a}nD|YyXoGx&MQ%jE@Pf|AY8WCN`S*59#{U zZXOKb_fcv8?%a8Fp^w%&R*|@4UPVknxXFvDw01)ZPK7;KnkVs#qXkGkHCHy;nkMQpZzj3~_eS#{&ttzw6ya+Qm+eo1R=Co6f9Su%I8$8VZFz#3iTE)5P ze{flEimvM)bF2<^TASg8offt47TW{_KJ>6-jbdN~O?Mp+XXsyyMU}o9qQkuk z$}pRyXwK&Wx$kgpiQi|-I9O#iQdibPp|$YaQih4P$DU)mZP!w}o<&0TxQ|t#qeDGjm>>Dk5zx?B@S;)JFEN5cVHi=NV{1yXe?IJwTafy| zj}BGClI_}zwiDWIUCXmDwSPXd-)wZOk6UEyfU;)$P>tqmB>m$}Oq;+}Z{w$;#)6VO z=7l+b0y49;_E!n%U`c( zd$y{qEv@;Ji#Iq{zo-i_E%|AKtkGSyA#>K`PyW6^w!ioych^5ZdFzE@SVBuMJ{rS)LblNtMB?<& zc1OfYhG z9{T^aZB0Y{T3)EhE8|w*Y;Y{2MC#o)kX?Iaj))r@mZ`~8N_;8}v*$H=zVVriG3w6b z`1pcGO2l>b!t7KLCtYGJzW;3-9DiclrlAfmj#O`u{tbb9^?3G?4Bo%M_*Zb)ZuE2! ztzpDRs3fKDP)(lKw9v(-ab3bUI9ZYP!s?B_1HVV=+uL2g`xcTFu#sa#w~@Y+gVZap zd(3UO!cM%dnbJ?=PtJl7P1K9{v*_=)IoAFauoK6TN^1!90;LJgQVSI$3Me_GTPT{$ zftoSItvndHEjt`5v4YwCT7C%oq^?18yL!FgKizcw^m%d7_w?6TKvX%Bs;zi9Y zhS8U(f&Hyqbd1zi-=?NSeYW-+&8i)a^`#w-mFD~u(qS`JrP#m=(O8a_im5s7JR_O7 z3$~#d(MKP4ERvN%@4NX1GqDWzffM5*wRJ2Ndq~=sF+h*iA*DLpN}L#H_G?9<#A?{< zE{HuS=-=8_5Q;q_@=&6{OB=b0#&tS$T*6Yi{!|lj!s0r(3_5Oh@BagIY?9YEc%buP zCC&<=^G6VW=O3W+@8g!A(*1npmh|64=ehF#MAo86dMUyI_!?^+c7PI)?SaS@RqP$ex7DV6}_?Txm zApX+Q%(L_U;@ST1V`^nki9h-G&>892!LW&YYny94^GhlbBO5;hg z#b+?PD)T!O6KR+})a)m|vCE64Ri_?1TGiXR=eKJei|%#2*;&}(#nNV#+0P2OH!bp(-K!j(Uv;YVmJ1&yss>z{LOU&=l%wy zDznwbx5tSy_S93uQdW>IT2jF5;yEm(%t1;mfW7j(+?)9Y%+76)_4I-YPKo-di*7JC zZkKXRjQ@5c+WLrN8R}5^uYvZw>F9WV049xR`8`w3=`i{v|DN7B@o$JP6(sF-?wl6L zGpN696nv&P=j`kPHO18W`Orz1VH7+6C5>XVCH_+~C$;-Ws9 z)b)*&uxn;8J2n^H^KF-&X?+3$wxqsOuX@`@oTAMF&aF+&~WBX5@9reWsJAIH} z_WKF<_x|%-uev1tI%G$Dc7a=43R!AUoxUWk`9sAQxi#oT{F~>vu=}$wNq-nU^YKO5 zH}S8ovs@qaVktetFS>I)li7(Suw(fw^-8_hJkSU`@c~jqV@O|bCMsbcnB|QesP{$^ zl_a)U2(`Y%ur{(2UcW&yrP7M7;( z*jfQkVQv7b$SvB+c`3gmQcEcdYfO~Zn3EO0`tHY z*onokzuGW*7TK@)LNC-Xo7V>qCGKJNsfVRbAMoJ2P@(U=huJb866P0Oe)eSrIzJSy z=ul@&=p0sLjF1N5f9%&_rmGgTU9-lq5{sD~0L=F|_tSVgFDmgh7r6d-7N(xPV?hOP zm{su$_c!q^9xQ!_bALy3{ZNN0V+&}Xe{+Jj>&5x7?FLz!=$jL6>w0lMvttUnt7l6c zVBHY6_AX|2F?@$=RqZ-ji(ftLSlx}VALZO%@4=B*XkHqbT{|TASqITvAxmw#z=d1~ z=YG@XmczOK?hD+y=>E=*^DxnA!v!wRR+nAm);ZTceBI{OY4`e{ZEpQ}nER((;MSjp zx&K!-w@wao|2r4B^@m~Z-*bUmzaQp)>MOBY(%VBr-0D|wxR}w{S*kW4rJX7oi(Q}Q zmoJQ-&!`{BJvHy592@Paz;BfJoxkRKz@x<9AzC#MPha4ApdE2G%=JUV+^=RUOGy_h z4!*XBY%|r9IISwZr&Uk-bS2b3?p2^y0;lmyt_Pk};{6`z>o3T?O7>vY`=fi+=k8VN zm(iZ+P{iI4`@|=&1NSTOUIjYwhoI(PGGnBz>5T*La-Ha!+EU!M(po`?c;8v~`Vm|D zWS_FR^?z)6ruGAOUAA7}!j7jo{2$K!U$D8g;<^C*oin2oj?4I;-$f!bE1DVOCqE!5Nz ze1U$gFu84w)HfoUe*)QwL{D$q@;l+dRABm&*?=#z&Yuo)Ye2!_Dn?^ssgf*|ss@(U z?9fEcMcY|!#fG`RE}z-;M03rv_J4h=V?i;Z)>g;5Z8!}Z~YlB6?Fy`9LCcn=DK0-|LqXB?r`bze{60o9_IchE^zB_hPi*2&8_NTN#i!> z{;%8IswAG2wI~8b>Whj0;(EfrC=&b$7k`rtF^;~=zbIn7$-_je3*Y2I{w6#q6}~qn z_PvNxAbVt`Bil3_UP|xvz9HK>&Ecciy3Y4)sFDt_}47hf494q|4RI6`_>^^bJ9^FSupQf>sUveOr4#)zg}nO@oe)- z90{mK-|z(3)0-XP?;D=LY~}CKMRw6BuEXf_;@pGQUDU8P`mS!4XAJbb&oky74axI@ zHf6lHh#lX4pi8}zb(H}2v+G84WrSU=)g0>wy2<8y0qCxQa!~scbYI0~y zzUkQ)VTyAkKm8NFnx3&Ws)-M$Ik)C<-W^jbj}4BD$LL!KX~&m{ICojgxnEO7eXFsU z1JwS@Zo6Y^>&Y6vzGQEMV+A=6H>u1%FKQ(o=o0k4?gsOg)iO@571$^0n13_N>~0XT zS%NMDWBd~RK)a~@JR{5ePJ?4H&c!nei7(ATirVInPdGB5$UL?)%P>;!=bWaPXI*@g z^Rr}qQbxA(dPU}fY15Jqx_+T2*N8mab`0g2t*hPG!F+V|D(Jo!Xpbm3OzjRtJ+u&Hcn;k1Np7i>Km&aaYLtjXJRcA%`;;cwuj*LO+*Rsuo zVnl;eu5M1t8tJ~k1|`1NV?;eu7H+HMT(p1eA;&sFde1MF_|ppXz|-=7`i7P}m3UBv zPVyyP?loJc$a?cF3uFxWiR!G#A2|1;U0F&x(vzI)SQ4ucw%wD`wo6~HnGZEPLN}o{ zMXu&e9vRO#Z=7knwe8+rOLoQdJ*Ilapk=ZB?^lNnUw_S=sDZ^P5Na$WI$(KH1Hy zrT?SuArTMLNb@jH!QrOw-5}QK>?(In8)b}elZv*O$|6C|OAT80*wyCCt7S}9hW3aj z(f9W&*mq{xe~bF0nR>nAT;wYwcv#V!8y%}x87ddGUmu6L*LW&=W|hqC?hi0~pk6V> zH!Qfx%x%up6ZVC6HHz~_QKvusmA}Mp|NiQcv&!U|Wk*K%P6qQRw^4pKl%aCcVT+BY zqVKJ8^NHQsxN93PKkv-6L3@bCq$r7vxc4T(Glm-^JrlhwY=0_B?HpVs`=IgO{W)#T zgOPht?8EU#WNmnH?y>KjHajHFlH44p9yPE`)HT4(vGLBU}WZ>)_MXCu8Tv(IS$P(nlZ3bHw>RZ&B_ zMMLVk46l08&8011apr*@(`0Rb;sx|RQ_zzxXZFC)Hyy3If88@pGubm$$V;|{pN>{# zH-GQ=Dzdvp9rxTv03UtVFG;?0Ze4Wi+y(_!590l*(Kk@d>=WNJ3aQQBRkH4P;C{q2 zF_s@(;N>)LG|s0R~y89J8WzZ zV;m18k4!Y39p+5WwV7pu?*G@qbP#ds=u9nFKNdtM}JIJX*4MQ77J z55noY7N%m_lybVCq3^5ZUJkw7;8>FYAFYp=`{qoo=mJ42wBC2P^N=3oW#X9vS@Th> z&sp9x=!MDEMW3~v;`+Z4Z=8aqG!7a=<{K26>r1?p-jU}$fA)aI?8WMd@)huW@e{bo$LN@YLWlyevZV5*+5GG!}s= zu;p@0fy8*|&pqT==QJfLd~yyC?{#C!Ne;a-lU48^$(pDKR7Bpt#KXtExJ429A4YVQ z%Zu|j6>O9_UHPHdYUvB=uQZ~iB*(SU{VQT=o3G9dEJA$YIOy}oA>99>BH|$bZmnY_ zJVWK_?W1|?WGBC`$(%;|#$H><#?a!`j&(@Ln!M1W)sFQV=l*X1VHqn~n0#@iWBFB- zR%YS5!C|iVi#o2pF-h)(XoAu&0p~$?_@2YpYg){6X*U;FFp%;WKG_{enp%o#JnsLcvXqlYS24! z@L5`e-joBA=J32$AnJmPTJc(ba^Y&p-+CK1RRs3Qye6np$Dnbxu5~Q3>GM4>$u=l; z>kc1uxbEf;9XaXVCw-$wMYQw+5Bo3jo}asTS3etrxzMknTja2SMQA?4)ZTuXn;Z1F z;|BD3*)V-DqVgOrFFCwHj8o=cWyb01VKmNr*2;XIJP*t>oclXeL`U&0r0k-;NOsLy zaOcqy(%C+_*}O)NZvlli2h-c5zU!wM6<9fTJ1vx z10G}9_~HR54J5N~2O^rljrm7W2Xq#U=-+w}smzvtR}){#M&t<(rhaROmUnW_8-*>3 z(vTKdfPvi3iHO%v#MFA<K6IQQ=2k+ zOn&myHIAivu#{-1Y6sh0rw)~o+){V2XQ~pNduYw7dV`0WRJD!zexGy82O$HJKj#vs zj@HY~(F%<{BYeG~uA<6=BeQ&{_@fxt4@UNq$VJ-j={l&Or&S$N4tVgp^S|ID%N4GUJSFo?R`I;*ce{vl34i$6hy&^%^ zg`wmcnJ1EvwQM8X<(a=(%z0^LR#D^MdS#vPO0A&rNg5lBXs=>KOJGDhRaMX*vaz(P zIk2qQBl$H~(RjiG{n(()WikeNIFoPr70xXT^01h@DRa&5O8%K_<=hI|?)?wvn&08v z&$33xz6Lb*z+BSz+3Q%^s?MBCzjdfr&kf8*ykl2u;ZG%>+*kbEE#~u?>yEkRbD8To zx0qkcTyL0bK9jK%Q7P*7L z6hD8+v0^#Q?xnvcG5berMs0^5ta03UukT+@PpEY#Xu(pw5de$Xwg9vd?9LbK9qV0@7m7$iot&HAg4C8AX7}L9GP3_#y)b`G<53~vG5!I) zW!Fwb2l4CJAP={yvd%LGNyjZ}>^;x*_wZ6#%*$+Dtdl?aev@Oxys(WdEZwi>TVz3dxt#|ku-RXls1mu0YR{xW{!rz5=SZQ+}dIdU($?|jag=jE(b&E280q-~tA(#1ncl)uv0)yrJyladcGQWxV7Jq6cQHHR z@a}pKj@TnHYf7kJk=PW)8%AT+F3b0<%-FpwQrzp-)Sn@7YUV4_r?Vq3Y?A(wkoj++ z34pKvb;VQ_BWl*m+-b5MRFN-ibm^r%WGINpeo9=2CSPF1cE zJwQBMrQg(0v6wr5$gc=&ndpi2Nd4yLBpA2)+l{Mg~8L;oM~Ngugb zIlp)7Abz5Glb&g;;t3I3HZI9e1uE#d&i_C>n9T(Ci^pR`fA4|$v6h|uFde8M-rw0F z<=pEY7OCsS(wf@#beik;mHdNmKBFxTu=?h9|C{53I?VTWt z7i%&$`|OLV863(^N^}u&rn`M9383pacLuxn5Z#kR6f_Hg9@pz+8=*=uF?6p0$ z(#|`;WqtN^C9`YCU~&-MEA`Tcl%WGLU)xh%!k4&Vu`Ter%3ZuJ+FwI=q=E{X?gz_Ct3~ z*FPk2ph=HnoOl0bqhk%Z`57OL$t#0rdalfyQ<4FAg}n()JW8?}EOG(@x2C%a${{ry*Qwbw?@ChSF&i#!TeBi`d+qrqpk%2St@GMqRxJ zQ>o7nH6_$C5%JbbTqoOp)-W%nZ!V_2_06zJc259WW2^gZv*)nLCqx4?SVhpaKZhsJ z93r0nNj=Q|$*|LtnXP!_wXoGUNZUTGWhW2HyqpN}^z$+{Cz232T3N~Atf~>rL7JmI%yP_6+g(A8UlJJ@cr zu@(s&GQ^*xZ_0*Qmua^bO9wPhvUmsE4bQme1s<%ARn!=WACx(m@zxQH!&gPDE$L6f z2TnSarY3tEsz>m>1n#59=*y2gR&Rr5A8V+#x9r@poA}}zee>FS8@3GX&St3=RcU-$ z_(=0YwO&kZ+PQsqYc^5~@kI1TdFbeEC?E2znYX_Hd2Pgt5^AN$)8C~TeaM5kDVv_z zG6dwcVG7J_z*q9g_M@6lX)E@?RM*t)uYs@e;3cldrobGFnU&#ZM6cgoC;cZxvyt)e zW#WD_{sqOw+W%~&W2Kd$a*{g(Ek+;Nzt7cWd;`-$f4fTND92vt+|w!Ql#cFgHxJ{P zp$z{}(7wB&TF9C_1>I!BEnOvTxVzjloG-6(tj-4QGF+{G4WSn}ZzsN2b@*!Y8}dw3 z+#~)}6`N^Vu6>!o>N>fSYzt;Hp!<`R(mpI(CGv&s@TyTe@s?GNpTC}WM9K;^`I^Xu zf|Mb%G?DY2(UWaWOP*rpPW?hSYOK*IKk1^+m7Bs-4N~^j)xnKwE64#A6zHXHluS@rrj!xLb!|nfp!&?DyQ*40`XOE1u7%=ku9O z_Op0CUt+uUi?ab=a`_d{=g{-H%uZLk&*#Ga;n*>~TWWs!ig%o0Zjrr9wz_y{66}3r z-MepP=J3ZfhCkOV6?mK(O8PNr_2X2B*He2Eh@192Q-6PHmx~2VAAn;1l z_00aiD;+Ddc69$A>xdSNXs?RM$MuSN_9n8=y~)>xx%H9QL*C>^D`5XBE4qZ zpX(Xo1gZu(Av z&9$h^e6LRU1xwSvuZjeIqX;|?ffIBO6Fv|?X^W|_N8Z^`X1-M?eZ;Xs`J8yB5Oyhj zx0atQ%SOj>6(<*}(1Qxv(NSi8xZbhS^{`{tjCto8*h@)vcO$MiTo>^J)Ni@luUFET z%n!*=k}dPs=5_H($GYvxGiBG`$6wDA=P$h4cO(-d(5v7S?P*a*IkShiYw|4eD{{}y zQ_+KBqpwTG*C%hSaje=Z7Qqf>nE`|ao>LVf7diJA&%x5#+Yk|$$M0sDO>xJfdHdy$ zzZ!iXXn#&iY#jX2Eb}?FAcwv)4RrspM&>Iq6+LwC&3eab@yb||6Yg&@_dMXpFt=#T z;*9evRhMHK&4PY?%&`)G2eV3%G00oCxN*re|L!>pyTnVo{riNEC8(n3T(xGN5cpTq zlEj~iy+&VEZ<+bhgD!u1V=RA~mdvk{{+P`nq<%rV;A=3|B1y|fYaMIza-`}*EJf{7 zdmn1~p{k)Wp{r8c&pas4m$8HGCfy{^i_hjbT<=lQb{4_1{%XZcS8L|sI>$<%=cS~} z$I4*edlkaO&!Y9CIX(6)k9qz9c{WM!EFb0;JIBk51&-15~&X>s&hR^djDsEzZX5*dO`l?*&$F ze)NE2EfY0wU}olQom`JYq-Pu)FEA)a{B-v=I9B2U@BY+_4jM;YpJLKjeh`zfM$~_| z!ph1Nv>$t>T+GKe#>~gU2c!;?S1;$~zlo3J!Zxm%o{RgZKRpVRV^ z9}jbX%Qe_a_cuS{SQlKrn#pAwiPx$2xv_Jp%XsQ}(t~FyW`?hx)wCq(z$Y{{L~~n} zC>OX({VwhjwYyg{`u_O=m+x#Ehq8ljmz3E9gNuF$q)O-^q3#SJ6nc`yUGQ6Phon)_lQ~ z{3;cEh2Yhu6wG}lx5WgMJUF_f^{ha$>Q?caH*MeI{j~feL;)P%$DG$}h*bV+! z?=QA1HN`S0 zN&%&Gk10m<&iiGoT|v`gd+%aqtJ)|&TCWOy=mE!SQvFMSX-hn>wMLtE?tQ-h7ymbU z(3{xUl=HzJAa6ndN+a4^3l#;Yir=U()$BJ4nc*pVBFl(s*>4oCG(1H#H(!2GOc>t6aKCQ5potocGbr1A#D*8zHPKc#Hq)kg+t0gwR`7i&zv8gbtD7JITvNY#b zVm2ybJM)+Qmab0)DxUBlu5hk*c(F9$^|b}E1@8)7USIAI}#JUmSiSM&5s_G{59?GEL0RDigz(J z=9T%`KjGXOi&HB7FY^0`CkKX3KPY_$q{FlVr6PxOV#NGagRG%-Vx8kZv+NaNJ0Enh z5onKR&YCiDP+Pn(FKDWHvB}dlUBRj0>mmKZi=|)q+;*8qn!bpw#QS`V*}-`c5xdu^ zB2}-l$Se;^16jCbf(Cs+D+r}eC?eN1UL(IRDeB)zjJ0qb&zu!L`^rA z3fv%bpjuQ!e#yB%l7*?g4Ld3Z8g^7D1<0*|(n$OMm^!1aSM7~J9V$DP15;p}UgD** zvM}}H3B}xz19S5Zw)_SX|UPAUX|7u?il#`;i2b-Sk zuWA0Cf>WpI+k*y@>)mN^xb{z*f`6O!KM7qt98oC^%gn2@Qyll^X7+RT_77sPqfWEAX`q$QZ)VEQ#Uy-Gk!0{mFEV&;j~J`0MJ+`D*!A)pw${s1>MM)wN|4=RM1j`A0JH|OBa{=1?JBhH5xN&Dk0rFBvY5(JF=b9U z{m&)@%Y3dbmR`?nMH@Y@#RTYITj5B*lj}ng*q(ykrJcF;e#h!{c&U4in9Rgy#!z{T z=1=5(G>*pa9vtSn=pQJrpTz7loco!lKwN*``{@fjOnt^=PJAkXo69VqJAD)BxqeaW zi^j2D>hsB%&AZdu^kkkKcMn~kdQkANRC*{-_IdsE4)Sm>=l-x;A5Xbc;+Lckae*Oi zIJ|q{Ceo*ojCtJ{EpgtOmu%>6>lATi6l5~r8it6l9_-*Wr; z=19!A?+VoKv4X?HlV=QlYr|su+hF#`0oYy`ef=%kbsy%zt^;~hpuMX73+8|y zc0JIe0qyneWOE`Z_EkO16GgCBb8b<4-x76Nnf<~Q{Bp($($5yT=Q}S8J@$-?vH!k; z!~Gj2Z$Gd3lf*j&?X8xyM?7O_g<~bup|UIKB<<2a?Iqkl$9&@P;eOty){$_-h z@{(UZByolk7kPKT<_mq>rJJ-?knDNk>xI^Xj&+ReiNDsiKHn@{;aGRP&8^sZ9zNoZ z@yj$%HYYo+U3|w-iTQ2L{hO46vTjw*$%iW(3!ImCoE`J6mu8s1yVtQg$9(I*KHylf zVO};e?{io@?TC7q(KGi6Y`MSw?Q<5GrsTw}HqW~FKJ?sz71CFq zaDDYJJs@lUk(~bWy_p!~{1F_evG{&3sCkDn&tAAs=GBo-`m$QkcK$x8cYG{kTo0dF z)+6$%$i^I7Ye%f-h6U!dY?-s@Q*cVet-c7eXO#4aY^J(v5Dpg_-Cp24V}mJF?XbWx9E#RHC|Xe?F9q%Mdzo{GMCuVWqaLdcNJbGz3%7E^^x zi!epReA@jk&5hNKo?7epMZc#Pn7iHDpkI1mG#~J{f8hs{dKo;pD|2p~)|61O@~=^v z&sNXAjV*<+V=DeLmScSJV587+a$_Z<`Kt?o(yrx>&@p@p4tIRKz|8muXuTh~ccf;= zDcrA^&)nx&v_3S)&o9r^Yw#uCxW}=YNC%vRBTwDuSby(6b7h@*>93P?eqK{Tw5L>$ zIREVfe22hbo?j!|744}k5(7$`fcB=-R|`Hhca^M1K{Dj~K)9F2_Ue4|!?p7MCKWxI zeV4OB*!z<21Q(bss~ihK2;c5O&U;R{wLUL#?%&%G9HQS^8)8FyIqxC5=_rwP_cA!b zBBo5{hgj4G-CGEBhx)iB^r+d2S$wZ!37u^Fx4Vui*caO@)^~hO z$ZHpL6Niz(~Ed%V_seC0J(UGW+;ikzXD@pgwlGA2?jh zW}9MvEhsiIrFG9oYaQ!7ZAw`Wu&?KjUlMxW)AvZ8{-b*x>sfKOEOlFbtz+%V6}oDB zEzpkctIZl9UcBjQvlzyn1hxB4p?Swz$7)sGdTuM{o42`t$LRMP7MN9Q9gFP7173DI ztw8S?o?LF^in#33)?D|wI~SN0ZVn9XCz5wW^F#|o_qVKd{C`;sRp$7d(3Ipju*gau ztN4F7dk?TCmS}PO>~095hZ>p^Kt-Zh5EX1JMX@6xDpqO~q&Ec{OR?A3Vi&Oz^~zOH zv4Xu9?CnaiqhbZ3hW&rDy8&)_|M$M%&Ic#E(`U}ioS8Z0%t=TN=Yee7Nl2z}kZn5# z$yEf%+Ve;+cuU(0TE1^*&O->51K_NVjo+c3-X~dpC-mK!2MR|X z!w=RIg`pTd9HbWtLvl8?9f0MjL*bur_hvi*FRlJ&#s&iy#}NbBUsJWbLguRL&F70P z`>Ssp|5uMhb}dA0Qxn-NL#-Mzk=5(eTK=O9ptv01v*Yc)iY?^{domnIFQ0Z06iPv|qdl03t^H>X0g!QPfTEG%u_wKpGHlHX06ZMqapy=v z_AW;ou7N8H%Ae71AoNlMN3v&IAY8pso1YV+-OG9@(46J`eePYq=*WyLfLOGj@wx1{ zgs`EcPCPQxkyn;UdV(3++rezY4vKPYIUB7C@7eIhk+oOO$g#Nqtb9#?=@Pn>xe z%h$-s{y0)#it6rT0iN|Oyq_v9-=`yxUR3}+r%cc&SL3jxwT?#Zo|&C5EmR*v7}}Jv z!;9KWyB3g$-X6oA8@IOQf$|u|(OchG-ic!1!JX`BVV=!>G7*wd|LHM$6D(AVI6H3J zaA4+5F<4wn#o<~dGpCuWCXUf4DcpQX7H(OK@Oay_9-jX^WB0`<>38OwgQ`GfaNu+< zIsld&!v`6L!EJ_zsJOo(0;r0kV_CdgV+;yQ3~ra$4p5jk%P(4}4901c`8-xfbV*xK zWaU7zBTdT~nH8{eci73EKT>?|{UpZNSflhwufqhxFXX{|zl|kl1EUY$>n_^+wvahcW?Wx2%Se{s=EEr47QT|I z1V-0i?2aZ{mWqSHcQh`v=|5xB<tVv|#Jgr_e+PY1b11hbtt0bonC{lw6C zy#_FJ7Srza{S}B#W#mx+JWzjEG4kh@s;#3nO0<_qZ3~KRIgnh{M9UOoSRJTnP4qqA zU%{kT-=Cq4R*lvu-8lc&IL(B8)?cxBG^>vSXU||I7*JAgU08$K(}~aOmT=Ueq7BgxWgLQhf^35rTTD6J&)CGA5rN>n#g-l_mnUES)eVf#;7hRVvEf9X&a zB){xyWp7YZJTBdNWMQSQZsB`&-3a_P>uBLOLPvE0gQ8tY0qQ+Ks^0{FS{LD=flgu7 zYEV=Ygap;^wKJ580S<`Evinu}VTvjds1Yq$h3c1!DNr3T9ZFi|2c@XIspBgNv`&S9Vk z1%f$4k8lD-Rx5k^%o%zT>(B6pS(ByVd??k{1GP)*Gng7NvoD6*mBbGxUqM-_DTINi#;m{t~3D~;1{-$Ns z1TKjJ?3%AVD11N9Sv8OZ#Tnq$`u?J2j({&Y%dA~jn(e`UXU`>zTH7ja;O^*tGCFcO zSxM&3zGXkk>?1i_9hH2L)$qWBLLOsn_fAA8n(6Oc_Aqfz1%1fjLk z*B;DJIYVb-$dd!`JG;YkSx@QUQ< zfl6mw@hcKnShMF$jLr$Pw*A(nq?LU^T^Y>U(XAo^3Tp^El@m}EbRek3A)M?rABx{| zwmY@9N_zn%{jG#jLja3K9~l|wKSVZg7YXT#)D)X9AuSz2=XFC1`a&vZcT^`DhsyRmf&Ep8lXfBRK-v( zUe?f_p2eT(;G`Ou<+L-jw}5S?{~vEhl*tDZ$3LS_DQ zG<#Q(4eT8anxj3(p?SQ#nHRnigAxpbBFCjp3Pfx9hcJ7L+pr!})N*${O>?V}ORdro@~BE_M|Oox?k zkvKE-2}^GSL)YzPXlgXhf3bH-|B?+=6NHM<j`zlhcvYl6OsRCftVN(XC{_fQ{QWA)QA`fsf%X?ci7 zx!IRg|3rIs!^Yl~*T~YU8bWbmv_@HG0v^`7aAzBV;@C=t5v(oZd>u+!HqDcHxsB*V2*VW(VJu%!p%}Ga zI|K43WrXnBMwJ`F$^-l8vV7+?-k_d5njNn--lRHgHn|GTRm?mz7Sshe%fs%+V{Nij z2BSO(MlQN$i9uo8FpaV%lvG#hL2;!wsgB}}y24vP-+EYpRaB%{xRCvhl(WM9bL z7z*H(4RE`fuvR(BOqn~(DWf$?RF+2}8s%;7j^q)}%0MV+TEw)eKg-jAaDZu33v0E0?+(iCa}^PWG~RTySGv*hWwPGV8+&c zvQHf?dri}#Dgz&;za7P3wkTMmtTJcct3^Jg7lJj)Sq$F?dq(hhtVT(Frh6_xV<-~T zFKO-_Qh+=u1nQ`KW#>i49MPyVr#Y@6Q6$#lJQCn9H zWBGLqMr)MA0W7LyoLqPysYd=;7T}4UXZ7tMoWMpi^Uq3%6Dts2AeQGQ4`UWuYsPbmZQyogGU(1*~ z9wv{EG%ZTy?9q6aVaXAOl(e1DcP3Ux%TRp{LNv;k98U*DKyfzOWA1}e@3*YZd^Bgh z3PM#kWTX$b1q6@v=@plQ)z9C|)N^SC#sw>J+%I0t@IhnWSFg8q>&fywmbpXpFj^=>}V>L>4t`VtX$Fls1sEm!l8l@NW+g5UC z3^PA6->t@Il-2}DtO*;*F$_GW^U+?zN)|7|s7HUvWH;a{{8=TQ~SdTabJMfp!!S;CyhS*j}U zVhZGc@+YkhcZ@{<@+T}k&fE;9LDhd`i#{m z9Sq?MqUBPJK~bPjuF~GWSdG>wdxo&{iCu_BiHETK)C~T2Y@_HCqEVvyqk31?k?QTO z^=1Lct_EwA-_K!+wVX`s-|rLt;^^vv!h5I<2@B>f74^T^TK?z#t&p1JHz8=U>d0NX_m+69Rcd$lD@mZa|K25ZYDj>a}iT23G z%QD3l5Cr|e%)tKUr)YgpJ7b(oxee2wyQCWBkJXUb$k?8+ zRt@C(P1|R(pS1EQXLDNHXMsOyBYVx>162|>lGfn@(cJrw^tRXkJH4E-8W9hu3N60~ zhEdX$G%X4RNL~u8-I{8GJtOlqgrHCXbO!=t?RcaYA1G-k54t0otAl{_Y7e9r2tl#S z-uJFNTJEV+=HS`hgY?|Rvk%@S^f$;eY#W?sJ;>mq1-XjxzwO`|6&>Ztt3+^$C-1X^ zCmOSSP9_-9yW!yD#pq1_?cj;%!&l6?9Tc|*Qq9tKlyoPMUg!DXF~1CgcJV;*q8%_Y zzw?D)8p#9Gv(~sIk_Rc}O|;A$z+yfR3wjX+$*wdlo1e%2jz;0_v7qlXE!wsplEVo0 ze3^mYA-U=|Eo0<{F_8I2*#`T9z};`QFqi=F^5d0_CxnpUig9T91JZ_HqmWwGkJ}8wnWB-NaLH|MEjJ)PJur{;)hASvESB0{3 z)wTgG`c-EHX_O9BPe%6no(_2Q0ZPiqmh+%{K20+^y$x}Y*#afay6WLs%IKc6X3n*L z%UC&qsz{7ENBY(k)N7eLF7s>NgRw7#+_^#6RS(ZKh>oIZQ4M#ujP{KAqczH3T}ky5 z0FN+&^eV%^gQ5L+gaT*eO6*hyXsYH@N$6ng%R&t;W925zRqcW_${Sp}Ky4Z;O+fuDLZhU+LaF^|_6*DcAbB4SG9N_im@s>Iwaysk zez{1?2U6J;N-K>h={ZDeb|p)lFz~?G@g$84XTw%?B}-9w44@Qa=sHZ&r0dt%y#JzE zJAIkqnr1x%KW1TtYXEvNwgAa?io{5b(g!Fhh2EpvD6WlW&p^wdu@@t2$%WHpWs@Zy zxS$uK-w`P3pa@o1h9gi?Kkhe5i;U1H*WlK@8J!9kcx18qCM4@+Y#Ld7NM1zKGPK`C z`LQyc=91Y#8l@xmJ2R*yz3D+Hy|!jq`mBwVbjC)Cxdg^&lxzNBU-uhfDXFJv5nz<` z9HNB*ikUtiuA|5f)!qY=U(W*E_AP3!K<$JfdUtqxg(Ku_gxOf|x?tuExA#g*We-n4_#sV;wqx+wv54KT`T*Q^yxf-2M)C`+6`afDBnTG6xzE30OydJxR&)UGG2BxQ5&ZbCGC z>RhW$S-7Y+!YSnEJ7D&*MKz3$ND;%Y3ww1G6DMnwsNM`6)b;Ol5SmLC25IlJTh3xw zo|lWPtwf+I{-kNqO9EFBK&?V+E7}inYc2C$$oLbg8Uj~U6PU^eV|nJ#JCETXX1{G? z!ePznpl=&leOMJgTWqqjd=ay-!U7#iifB@XF5eHyJfSah?-{`-y$JZcDvS>b)HjjB z+$Si#1+2|S2B&;j8yeRfz@irNNBJbt?=r53tmYY2|}XPeHih7z^h8^zwpXj^_0V_{i8TulPvPk z860X+zmu#?dTG9vzr$am_-m3ziEuBBrhESEM5;px^ID*3*;5=!)r6&_7@&kCNUyLa zx~Cz4#TqA2tmBiV(;1v&W&XW5oGY7KvWdGPR=1STj899A zaPG{c|9_mT9i_!N8_D0-uoj$Cwcwl?T7P!8;2iT_z~YyL!!HTyk1Z|u#e_lM*8ewt zNm}8T1&HG7g4zlzNMiC_OL z|D)zQ7MbBt#FYOoqZ6gb49$z@x%<{?dK+V#wv1bA8QwHTcJFv$3l9m)r}w=E6!ip1 z82uJq+5HK^|7?PiR`rF_s&Amk$GsmgwkGmtHT)W8Jzs# zST$$=3dJel^i-fe{+sT69Aqh@G)i9~n4wFfYJEAH zN~`a5MxaLdj;2NCKvleHbym#sQ(WAu<$c}3&F9+vSa?!^8r8Wq&npIGrZ*3gF&t!! z4&|wT*P)E?F@VFz9DPurJhF`_>9^n;dr^PFZN6eRTZtMeXS*oM%gpV(Be3zPBSf0b^(v)u)fNa(SpmiOS5#LQMU;EJW3>)-ob2 z?yQCXP~5w+?Yc6h}PBb%$*d=ui(S!*e~baS$t#VNqjjz z#~-<%AX~|ed}nkfTdGpnF(5&6FHeV(IuVR~k#zegmNv@=hDI)8)+~En#jXh&WixKM z{2jMYe?1M8;BZuuRc9?(io0MP~QMl$;Tdxha-rUeE?jNL|zkyk1$31ZKm zvKQ+r82+yHdWzBs8YQ(@SMh3sR`(fao0?#4Tl#V`JDgq}#`cKrRMvJ|Su6bwjNMgw zn=}+4b`djvSlkv$8GRfjY<*GR=_*nuYLvK;EcNA;jrZ*bW+-2>ADC(LM!z|}mrT^B zp`4ykF^|mT0ayS~W}yN|rZ^o(D4aG7#)C`(zykT_bN-rHN1A1R>j_MR6`(3eE)9yHqy;Mm7c%K! z9GA=Texi=9ce zX4ci_J2o$x7Wn}s?M>4n?YWEx_YM8-PSc`u-0v=}bZ^&lx`!EAKn!|T5tfV{1XQoF zBRSh2yvAP5-+_|82xY&^fRb9`l+=i^ErBuqEYGxs6*65$Xp~huK#_yS`a>O86n04{yT%nyXjNB-f72SBN48$O z&NuU{q4uB3$*-X{W^8BxB^?vW@+ga&Xsw)r1hs8I6RV5;dysaoYa#ikoHv3 zutXKu%xA4?%}4v4<2!88dC%&*pC8EDXhCzD_6!)+RW?eav|@CCSgC}QG|C#nisdO_ z?k*VqKFP3AEqmbBd6{eX4NRReRSiuuI=QMj-d4sg%_xB)cYF(PDx!PR$7w{GStpn^ zR%@?%J0mlQx2&;ttekv4M=P;+y%s8qAZ~8NSbGR)EJffJ*Z#R4)f1rj&fIHSsUp79 zN>(?E1tU{k6QyC+S+w@_CP{S_PL^Ug^vuVh^m-t3&Qxq=L6#ojL#a6i#cW)2Chol` zjS__qN8$PG`mFWL$Q%eQQ8kD$q&EEfb<{um`e(A3qvGlHuons-6ayxp5_2(B4?tOtUY!lk_sTxWOG z4?(5w#32Y;udWM3aD&_G(FkrF6di&fa8G!8S|WlGDe~}G0EkRXNQ+5Gmq*E`#3aZ8 z2k;uWADQtRi;i-&&oIGJ_S~NghOngjQDnL?7Oak&q zPLE;yQ{>@MEKEyJNdQQV439(Uq$Z~@{xhOun0J6OnxQ&@Xs9e&dKc6@uzPciiKzt)MDV~z4BlW{Q{3=1-tHe>g*0$;^{WN zm(jWrF}4G*tuc0&+ge_@TcERlVep#WOV;TXxCQqaX}U+JIPR|dz``9C?gJ-me7D%i zxH$T;gEyOWt{w4E{FZ z>=-Yb+d4 zx2rCu@1L7vI686BtgmU4PN)32&Z=+IpMOz3%`Uay!+*AEO^29UXXr!QrVJ9Bo$-u~YVDlfL* zqrW;pvFCnb4pA8td6l1(V5~pY)z#v6*NQ>&^pCo9xYA*wr=wk$kCOA_f5&$o@#65> zE#^j^!GA>_Tp~-=m+w6^qu&YrY13c-@iCywm9yD>d*)co>zuMGiuf{o``a@GSU2C3 z!=~8oRVW*8CoLIvw%chLe@9TjsiIBaO|b#1Xv%}~{& zk*PJ2GXk$}p0MNCp$Fd*yF~v!R5$5U&Wg0Kt|Gt0$XyvJ`#x{C$he&M!7IvEfL~hL zv2CRDPx|!Acc*gxs*M}9(=zkop@tpm)187-YQAP9U)&tt;r-14E?0HWmN{NJHvdlB z+R7Ub<~(_yaVOzZR^Xf;#}h>P-<=b`+YkQpyAXs7>;OfK|6%6;TlfG?06;Tuov=N?y0-WQXmQ`L7H7!#bjDk|O3WJ@ zhz-ORW9f`b!WLtIEyg}zAFwaj2W%a02=oLg2ms&>rUPB^kGKh8LKyHOd8>)F#Cl>U z@qn1eo5x$kTg}^qR(H5b|L>099LfT2(*58pyyCvBgPZh%|4f6xQ0RGJ4Xa!E+hI3p z>%WCx$-Fs0uYaX-7H-n7n!oD7P1+Cu_+Y_&10digErz9l@R1k5NAKsFPuwVMY5SkUTyW%I99Ab>Tn4%S052w)>@W)|r9RJ2sH z&s(C^peA&5^^AlfAawK$h2}P>D^aft8T2x6bv1T%HMJ1gwh=pbK=Dypt;2{pB7ps> zr3S>z7jr8eo3;{(o1;s&ZjS9-xOt-=1i=)T0kdHTmkzGYPY6JPww&lc-@w9tWJY&j zJv)FG42Cff3$ZX4l3*qPv}q#-;OiL}7@Jxkq7aN+JUoWVCQpuzP6x1pPS6iX@Q1-L z3`Rl_1j87}hX_c3bjXKAun4vQI1zk3LlZMgYrD2@;0=s|Q6K?(Cf9DTA4=dJJO=a{=@Sg0Qx>wzRf(AS|6a_F|qcU3&Gh10eM5{;F~|v9SWM z0W0RQv9dCW&j9AngK+Z0fd_Ygqi{97@9ft_Ue!0xG^r|a0KJ< zMT>{1ovIlpXZ}xxYKVnuh=(M=AsJF38>%6fn>qVHG$^1>hjp8oU#H=#&PBKkSK$WK z>D-1XxQMVJ?1(l50c{}`a$yskfFP_2`-n}%wT_QF;;#7V-<_Ga{XVS#HG!iR#0jZglVYOS8YQH5jb}D0fCKk~$3+rw36WexF&9aQ zGSki?XcO2G05Z`Y2m=_%1GsGnklX=4mI|O5he4we58k;N!pS-902p@E*;qaM#uCNfclWUdC{rKsVQ=KgtjeX zxwh4|adXoe{x4AQ5BR@@|9_0flnHAYeq0$zw88+l(g-;y=3qB%JoIPS@|)Rc>#*}f z^J2`VM`3(68%&48Jsy`ekDEJrEXpE?@~!GZ21`|;KGZ! zcM<^C;pRa;n?Hig8n44uozLcvpqPUs2T}ewnu;(09An7<90xw|ImqK6&iL~=e`~Pj zppb(C#^0Lr7o&`DjBQpN2a+i##x^641BEiiF}67guKWboeh4BT1O?nXDnDV!K^?Xp z1XmA&s|SKS4x$7Z$YbL%P={?t<{jtW1>C!U3oqm#+ayeRSaidhryY`8Cz$RRa38db zM{^7cTKR|(C<7080TB=ZVrTVE@rnOCbn)WsQ(e!6iansSJwN2NXDw?XA-ZufP zY+BQ_t!YQo?xw<~{Y@oJrA?=rt~T9ks%EI^^-u{0&>K#}Ggtr%;1zrUHB16I#6k*W zvSnu2?QmlTjenZQrQ_Ztm6rH+SrSo5O!S zXfPu})}8ATJ=BdP+i|Gx4Y)Dxi~;DI0z=%PPo|J-WC}jUrjTo53b{g4$Tc;ETtlmY zpl>x046JkjOd%Jy3If6^2*4@`cveAxSpn!+1p(hG2z0GXLC+K(=$pb3%oH}^rm%=G zg(c7qz`zua@JwNa0EIUN1HLI3=$gV1fhi2pLuuRU{zqkA(*y|MHEjs5>DRO?yr#QA zKj!yq+6Vj~0%mbA!2*WT;kMYmO z4r4!?({;uw=?>5vGr>Gy665cHRbl!7uof1=EJ6Uwurz!<0Co!o^KxJ-{1-><3s5=wdmr4BLd|fHB5?y#>dy!Ms-(jV0p$ zcC+x~ST>#m**J~mz&ZRH{ssSnU&D`Kc7!wGPE3a!7)p#IzF|{{zE}?ULk=9nreis9 z4WCDt^YRHcmo`jp=ka@lInSJTk2r=2i1i=BIv-KLChEla(<5 zq7JDb>|YotxN`Da-#u6JIyJ6o`qHaS=$)L`2OQ!Cbc#LY^DEPFZu1zN`dV+=yg#O% zNcon~ug{ObU0G7&prz3|oAy17k3j@+LdWStY<`mGEr{hKdx zCD?WBCUy(E%=pCOhp`**9AY?MM_hpqX%2f1JN38tu{b~&J|EYE`FJVl!C9D(SHOIn zb@yOCUeo-hb(1+5g9Chk2AG4lxbgTze9r%aTZ_-Z!|=)YSbQ{I3W0bUK8Jam!+al& z&%w9BP5{`$oJ5tv9Q+E*!2v`5*I*9*ge%2h96+z3p~1SLp}|Vm+P0wq2-5}~ZpCs3 z9EJe_3BZH-pabiG50^m~I%5I|!S$esrw;;M0|?VIgfcTDpxPS)3^Rc;3KNR6aUq#Q z2&p`t5Ek);vV+Y7YT$5SL+LhZ!r)G_ZSNA6&VTFA2$|GJZ~Zt-y9a> z%iv!u2ZwR^sKv_>=sO4@o`WNp(h3Y?YU0Ysl`Xl@~s4X9tUw}UcxpHaq|K~W=)=T@? z0l<5Bg+0I@67P68zn+f)4m=Qm5X8(53R*reF%kJ76m|n1AW{v55NN}QEf-lW5-qY` zWV6V2k=-KuMgN(W0C*q-Tns{%a3v6F#s@LsNLYgj0T_ni7=c0(7$G3^37W=%03PUo zE(pK`%s~V^On@0e_ z>7!Yaromb}2V$sj(9$A$U<9UM1CG!gd>|aMp&T$Qn{7lM#>WJhAtuDEF)`K+Be5_p z6$~{PkEf%<=j-YU1bTY<`UVDuhDJufrOanqTMzWX0F1x{Oqq7K0|#)1PS6ATf*%A! zB&0$v?0|DngJ|eh4~F^?XS#*p@lZ}WIuOZ@2Lg1#1RTH{vVaB}qX}ALaIDUoSqORPZ0-<8a~~T)D&(rlcoCGBGEFr%X+cmnWp9PU_O7%OriVSe%&B z641>pE+#c?g4>kzxVZoDj7dmMLrpiqEp?K3g8vX{bC~}j1ATqHR&5gg@8%b$MTe(} zBNO8zViM%3Y%@hB#>Xcnh({;HWa#Uqr^Up@q{YZn#W4wKiQ;f^YD~h^IJsD!A&*Q? zL!H${EFO`VnkG(?Cnm+o#WP~!;>3|D^6)gdI9y*ZE+!!sb(ppisOjY4k6Mx$Wqsd906LX?;*wZ0ycTzF)fI4&kuE}jt`o+h6zPZ7tYiD!hPGEGm6l}Cxg zQKS2%r=-Xe(&943EYm?$a~`RE^r5ppu&oQt?FcUIQ(aKQBqXMZ!xO~e5vhrB>1lFt zQg~W4xTQiLad=WvoSf-d@sz~$geZOJnx2}{H8mn8p)327`4!#0yU(}|!Q=W3+OQR1 zdnlEblts5ZVU*KkzmK{3K)gx#89H_3vY4sU7xaEQ>-6(Lm3jEWUPV8NvGL!3)*0<{ zm9A|ky8diQeDM-l?bvC+CvAt?y-0#C6r}rX*|O#ByIV&$>z+P!*y{X|BXfp4AO7y{ zffA?3<9{uGzb5VK$H+ZtCqEqR_i;*kK@XsLi>Ymz=2P{N@hGgwXtC4-IH}r zqd#K1q#0#*{(4=KF%VZ#{cpaS^;htNCv`nMzm|lBZ~)X?d;+f-x)Kl?pU4sxZ8#Ur{5?lS-kbH*wjxy z(nAu{eiiSY^f39^tQ``6yBRws8SR_2|I@YN*fF;+uUYprJK^r_d*^w;yNz}C0Kw(; zTX)a*|Gss{y*s-%?s z;Q5Mes$RkOJnCif!n-6v0z~sR4iSjgljbA%IqkjgxNj|deRpW!{eJg0wpHYJHzG!K zTjaX)d?veS^j<^qw2DTQ+y;yhD{QPKC|x^&{=n>n9C2ZC%t4dK)|6 zequE%jsDT?uli|{opF<0x38N$JNwEZt09)DM`d&R5Yq2})cczyj-8Z$n57k@n3{_3>6 z^WS|+e^yE7t~9y!UDIdQ?hZ9z9Hy} zcjl`y+r}4{_H?@z68cMMe0R?5#Fr-mzAQe~XJ+j+i^msikB{}$=<#m#zV2qfF=Kni^FH}KLOs5Q z@%;r7tECUtT`tZt?DufUg^|H}_e!Uji(CyKAG$T|?JKeOZ!htEC z@k^V=%Br74#>sDx9#2OcN~IsZdwb&N_c!OPJ4b;qiuBLMdA>#E?L$j+SEUymcA^Y< zo4;=Qb?mFS#NEiXvgwOxsEu*;ji;BkM7YNu3%Z^yR~%U0?$dR{?yv3kyY#ufyqe6- zxH|2!zgHizYrz&9mu1<3S>Fy#n$hD4U9j`)dyjyaKxKk&O106UiCv0Px*qKG*;RE4 zJ1#xgG1)X{)Xw1=1F@m+-JaiaVo^MpF5gRb$_w^nS~@NV>l zb`KifFK)NTApXT6A^H8f@lMa~XYSM{w|z0{+YP$g%bJVt(r(#q*s#OTI5#A?xLcPO zw(Atu2WE(4#>{BE^h?@iOyAs4{`<2_C#H8E+p$y8Vv)|L+KXS5lHzqE=S|w_I(gA` zT=+n_K6KUjnq6t44HDj;Z!grSG&++r*Y56L`o!^AZr}2#yv3U1nu$wBxO6skU*>$K z^Niw2JFg3lEgF|JKrV@I3Vd|6uTw{doeGy@PC~QvFW+wO#$T-;J)zq^%O!f*FZNfg z3z_0CRgCU#GG!3{G%xYtjrogoD(-g4mwmb(zB|*h=v;Kg9QWysUDTgNoufKkUi-s1 zPdsP&-JO2H_x!s(?^_fWBNu&h+^Y=eMV)Xv-22Sx(e`WJoxl9@#*&H+-HQhnI68Me z{pt1H^M76&|0bhyP}>eS8{DXbfF2UbprRDw#Oe*T6~6Vkj@P=3Da!lwM6_+O*QG3Z z=GHkjQP=W4gqO*3JbYBy4Vy=V!A2GSaB3&h`9fSguwzIq&#GUKBSRZcs8en=W$HRS z_E@$#W%9H!r+RzuC^=a>_T6PGy%!1ceRz+1H->J`%`{3m*kkGR)b-i5ZHKwz-Ir{* zRz5{Q&C2NTGw{rW)ALWy-Fo~%wd<^#U-%XuU&y7OQ}4g<-u>p#(@i=@U6S90i28jq z?R4T(M8=`zR(~GXANAg`xBKflujzj}9*AACU|pBVzk~L9o)|Uq>8#`F;T;zLY`~5W zFR;te?cvv>d)vh6+vE>2CLHZJb9UdS?Y6vVn4kV7p|tOy+4GH0xfkN|&-S1BbHKB$ zO{Gn$4;zOrS($41>0m_7!^rVgU2Y5TV|l$6$@~X??A)WypC}q#I_-I4#QUsmewQpy z^f6ZDg+f9!g&ehl6 z{du~})crz^U@O?8~o?)D7LEmGvZ>}#J%hPI(S>JCOVcj={dhPKJT5yqpj!V$$RF_ zomyJEbV8X=irVf&!KpX(9!E3V9Qe-9mCsBnt6H4Z*8bV;-~Al*8dfAWj8GeC-YxHy zm0D|b^KJTS$*jI>V*iMWkD9uE(aP8Ru9QBhmnkLg@)O@I=(|}vKOKE_;pS66oxn%I zTg!hx8?h_=s!{nLmv@`PLhAM^#ipC92YgBz*E@4WgWt1VUk9`g543RbT%T*?WtLE} zZgipDWUR1ZM8eME$iYTS7xZ7bHp6qmMcU-PTZH~!@hiH>T;I?7Xx1g*L`i~gif6|m zzI@GMk0Ih*eXp$Yxc3A46|Rmrk$56tw&uXK&vSP!i0f=W^GQ43+)gXbd);tXd&Q0( zT@vf~Drk@D^&f^CbvHabdhM3!(g!1bhV|&yG51^h@wWx$8I9-te$+hg@gk%?F3@Fz zV_n^oIlnHRIwlRicryE8LzlbDPtv;|stOK770tYqWHwHA6CN({?sPG6ziNE{V;{@k zy}SOqPs64slMS_4~5s*p{2C z@-BZ^Fgzn5z;5v4d5>Ra?9ZCmv77gd6IZB{dUEG0KQH-hsQ>ibX@18gCsjojkLEuU z`0O7T5W0BK9)P-d1LUp@@XG$R}3j$CGE7uiFjAF;?}JJn`axgIXwJX?<_0jyP;l|^HxkP(FArV zI1!=>g1&vNm&)*oUB^FG?F?%B*WskOHSR%4`%*UsP7Z&4Wo=u--^b?;Id(eyU0ULn zC+RPR0b3pPMVsa%G#O2kh~^kA%oTL2w)^yQ;KM(LJP6`Nk2k9xQ<8V$^p|HJ2j$Nz zyD_ls{C-0=7hg#T@Ji0uKin_vL_}og<%_IDvh1r3f6986FX*uFwCNa~xU+tPVc|Z%e$+gjGcjRqVsHJI4;_r2#$=XHGaT8$Zg6D&f~7h< z-!UHJ_>UE}aR=rL<_&%Dtj)*8c~?~NUxdAk?|;7(J>c*kH$TK2lTIjDd~^BqV;d6p z8NVO-=u5q?!NA9z2d;xTy&pS0zxDOh^QTo$|Lpx&=J({)6V*3r?#}oe@Z!J`(PHoZ zH*KrZMQ66?+q8YKFr?X#DDA9X3<*eCUb>82UI zJZdVp*IQ28u34se}3&t(#--cUpZ{un`;i=lQ|np7$`;)DwKG_a<^>$pf^G(^HVsS@jShsf8hpv}GJTJUD z5;N}Rjc1$I{JLIT`2FFkQ%h&d2MrqLXlpy?c^7%t+_b@c*M8`AX@jf4{Ki7-3B7AN zuXoEBcX^r7#?khkF^pZi`#&TBL^ltPq+pQY?+o1Bt@iI1xPdQtOod;i@Q2G74P-w;{h_8>LO z>wBAiv%56Ol(z(Dey4RTi|;bR`NB@gns3QlPaCR{De^V4X=-R#O|AUb=>v*3!V?Y>vZln^NFQqeN_EM!|^Nfb1uw#xj=S# z+{xeP;QY$Eq4XpU7CaZe3{_1kJ zK0K;q%RRmRr&e0+RY`W64G}Du>N_Cp^^YO+`}RMpPWE{=(ev%W2FuTr`_`U$wfl_f zzTD=1mqqiR*bnTzAS--db@g7K$;AVk6ZeGGQlINWM{$v@$9m44D; zciqkxNwe$2N~(H>9*>y+xO3IPr;d}#cM5Tn_dd^_^cZW>bwm@9xWrvFw!6!LKPGLH zS=(G%xPR}8=j$~(limEnG~vS6<5dn0e=WP3WxU1y%e%KD8;)RC{+#$h??lGupS=pY zt{CJ0q{Gr8hp#UhUQGSt)__y{$NoCeHoep4MgF_=`S-`2E$_7|=g#a}pLZP^P5pbG zH;c~d;CeHo`=t|8!uy|E6vbWpK9tXAsx{O#A)85w3zr!h?x;1>0Zj}iU1py20=cf-5&rZ|*eS7iX zHUk&zxY#*$TK%b<=!(E%-x+uZp=in2kO$ZGN8}8zdH*1{Gj+be%(=%aGOl~-AgRs5 z$VZWuw+E65gMa%ZZ9mu6XO(By`vs$G-O^)o>$;!G8#b!F^4rdl4>s(LogNj@KPq$S zgTx4lQIxy*v1j>(;Zs zoM%iba-Cmzv+C{TS?LS%XrEWzV>%7DzJB+qTOld_ zaXaP4Sox7ZeppnGyVi5~%({Zor_=VWNwezwKw@D3wacuIMI(>anuqUMwX0a~GM;Jb zw(?++MYp6YpY3@muTLNMkRM+;%kJp%`~@e6Ep2~jpXjp3wO36}Bb?n_s@en%zwh__ zQ14~M(Wa3PpFV8pe#Skd@@==-gNU!2{}M#;w@ZJUH@-B2?^hG-KLc<82ar- zd3t25^|i#HAM2iOzBu8{srfrSgYK-iEBG$7pFY>n?(&3J#&aer(<=+lmWB@fts`9Q zw0BUoFlzA74+9&QTB&1Z=^jjqQe0YMeJLbx!JVpef&S?pD^snp&Hg2Se$3*_!V-J? zEcK2&GD`P8*=vZ)+m)-Q@E))H>yb%9y~8rA+-)Dn{oXCulj?1}WisCG+^}ijm9_7-yjtzld+4Hu+CLV5348iECvmO$DytQT z`b&jX75v7M%Tp7C`}U|t4YPXoWz|w+i`;^bd86l9eDd)W^B?x}ip;B7@bKvI9U$sS zwKZAuKH_5i!r{}VWzOHEal@TDzqZ*hY^QQ^PE*aEk##a+=YbQic5ctAHviX4KFhzV z?9+E0dl&1+-+pt>5$N?<<4=G;&A5 zVCm4Rk=eTjOUmkq9}g#Qc`%t)(7_=FD!0%o8JpcC6Rvq~i;c5Lyl&ayY{VV#$SdFL zk?Yc>tGLIlP?*^9!>yfD-LeVqx}u=A1$STP{qx38l=NXNlM@EA3O;gqV0Tx3Rw<-Y z!4(i(`Uo@ZYdn`KV;I(z)yiElNSsvyl6qSpa}}7kP$+F-&~sd)u*44s#(qCXPH&6d zQ+^b7f*j@f37BxSM>h-Sqo5Op^JsNJ1>;7fmAJC1T7orUwN6HD&a>jS_N<)|Qru-F z_M;RzSQ?GQy}{Typ6TX$Nb7s|T72$i99_tRh(xMQ#~y%ZmF5wma2^Jq8?->*Tbx zyd5sF+H526!*%fWOaXvDFBY?=yr3qm=y(VH<7jJX!i*RBdw;K&hgqS`a)b#aEOWJn z8KE|m04%fE9eyfn8rwzUNLNS;may5v?nD5+Cjtbw5(0A7r`4gW42Do#QqDmf95P8| z6;9{yj(N?|>(A(KgYXR5evX;gbNJEhhvJm@HJeYLq!8YQKNsdjv^HkyM}H3(?)N?iZ+KunKyL!*~xXSUu10Je&pNe(j)vABhY%k#ubLpf5SEMQ-tUQ7i?G;RTL_N< zf~+jQ(bede7i*LmZ2QzD4O)J8TknUM8-aOoTlfw*zfKa5t^Nn|K+!^4H7YJOq})r{ z!PkIxk;v$ckGOW3e>bKm$s_0-%A=G8;3jF%SX~D6btw zh0uDiO<%{YkrT(-m~XkVt)H6AmFu((xgf8n(H(}`oEh!aW#qlsUve@T$I~(=q$6*L z()xJAS0+%k@*5dldlt$CKzFWp;v?EUV5>#bZlqk&DrK$a3DL@Xm)C)@TBA<==PUhm z66j*lMLMkrLXI$LLvv9i9_C_ZP+mqS%F*!Xx@y?6P;lM0FtlqSop&qB8@D>L^1TWI zjCDLAJ^YuJM%?Md{*v%?O3ypkxD|s4)=RD@iY;|6m(<(ATNrE9CvUFvV2=l27q=Rv z@2+Hc=-Hf9=GZanoY{7!ECp6Mhg?v+{xiXcX74UCpyi_xTs(D-ZQd;JRkvy8WWugT zk7TScOqU`_0vrU>O|cS=dNNKQzJqMXOa-MBGE-AbEFxCtAeb0ME-Q)BSZs=12!d4U zWK=@luV#o!M5#-y+&K7oQKn%Fj8>XT%nei~7rlUVhSrWlVO~LNFfm}5*CKG?hQO%H zoA;{s4?zQ{b>o52#^JY#>%Xm3Sen*Nlc^COLZq9vT9ogedPCsdbSE*lEBG31yydeW z8;x1Ej=H@KlsRBQWmN=(Qf^VbiixD3O8?F_ zz&vYbR35^f%s8UTq;`X$;eb`5$>6-*Fa+V6EoS{SmZ+%9g@`C1C)E)!vn8&oJLCD% znv}9g5LYtvgxP%Okj;!|Z$xV^xxeA>*sxOdRkC-m$c!$EIs z&~frbmT{|whJlgn8$t9%TZNYVBrbm>(A-%h%8$MMd*gA-!%O%tb zEp51O!fBOj_zzNoAU`KgAVTA4p@mNk`EzmJDL^E=WwVwX?_oM#eHG)c&9)-r1L}Ri z)rHpwuI=eKw>_SA3?qtRqa`gz$8Q`*tDxIS$8gu$H&pKOVsP>v1Bxs%%CTY*b}=ms?(xz&4d2a_h}L(Cc3CG8eZS(;*o_AAsjN zPH9Z4v;%O9D`A0^fZMW*xUn8Zj@IrhHs$J>eXJiE+r7Da2W`XeqB0)0{SZ1&aWiBc zdDZyYka9bD>rd&dFxq4FVI@gFbV($&yDzm+^E`&O9^%2R0L6kWmDX zg9bq{w7~hii02vQlabMYw%BcCEuYIYvYwCX{>%9x<&0cm2Wa=Y%iFbQ$iQSnMZ~Bi zm1FYrWx)ok#dcbvN5PRt#(C1?yGYp7t82MkD*oRLO?C$3ksC$SDg2-e?OWLuJPq4G zkfB)^h~k!Dj!RDB9@7YU-ofVArf8iCfJ3Oe_MEb_;_?NQ_dpo6Hxs?%vjMKtsfk>o zxp+JW1@uO*b+*BB=)2J7FK|m~(~B#~*_LSCr9rXj%U>Lp5xv@dL`Bv!?dt2wn{a$T z6}ZF_0dHp@t_(+K98Ta!`FJh+NR;Uf@|>TsE@!3oxc23F97z02BYp~+Jng<+zVXqV ziWoWXaP>Z?j@R7g&85lv@9AOImk>K5AmXMeQ_QL|rU)nmouE17c3~5{KrpBmZMD-~ zAB_ZiAkzg*`^T-HWeQZ8zgTShx;9b_A2$v-&2iUEj7EwxNXxRCmLmkfcVuJNWy_AT zJ7t6`^D_(Z%z(?eE>soFafjga1ljJQC<3^Fw(8o@t$@Gv-@KRh?4nc$;&3oR=qAi6Q991IYrUo#G!~(?XEEgDTrT}D1`|^K;chJM8iau-F z&{(?8JNjZ32UW~NeLZiE9|>$+|8bDy@|8>`7Vn1zGZeMxZfY4Gb;P9D&C^S_LVs7V zl}1DgP9fx-)|Y{2^aJq<#$iZAN*`(R>tJV`05uv07x(mqW&hk`s}|b**ZTcF&tupk zevZ_~*JhaN@n`&E)gf~5BTZPK%5(7f%hSsQCEYKTMzpqz%y?qVy3R=7ConcR&a`k} zk1=ygM6w9)g+*m^YgrbNk^ymNCYAPCRmU@$<){<7`dZTBp|wW_j`r+iv9JQoH!evyMP3uUSJVgf*1zqq&7?TNpE}TeGIRb{%)fW;TTNvmirP{H^|1`KBZmI?NLP#^5fU(y>URZb%pA)Q|OjtxZ?mwx{=Ct^-Tp zV{$|rdgB94wiQ^655v{0osP^RnQHPIOfE@37OEj`VTqFvqaW*Q091Z)EB+lmI?yJk z@|?9atVW1+O5iZ{jTs`26s1DQTWzW$syKy^L|BmoW-zH2y47{;vKb&7TB@Z)DPaU+r^maApQ0V#m#ae0^z(!coJyjUETD?5VPd6PL(}eeLu&Y}}%V;U#>erL<*xhGn(_UQlI(AUm?BWuumX;UR^LN_*V}}|!wB=wE zXo!;1soQBBQYeaS&O&;g6Qf`8ucRy}|946xA`CDpiYs9h(WR&)#|k)HZfRV5rD2qYjhXm*pRm_fu7Uxe#_W-PB_@b@j^O zE`**-7=|L3J@%xMdBgc};nw&aN^*FA3OAp5d*3GydGpzQQ2D#Oh5qcx%d3mu;j9QM4rH6q zg2dt%4us-R@B}rFf86o;{vOQc2lW1bjCKsSLz?y+C&HlbyvdqI0nI7sI#;LolmlSUV`SrYqf%G5StNyZ@$XUMp z|2Z9>uknm=ZbHu*;K5;Khk(|i z&0p?3-^?($yZ4rea}64nAL*rri&ODtY|56<-c>LASkD$-p#Ecy-zmb&%9*lK^j`()sxf}?>g+Gn)Q4pvO^{OpTS!b*udd3PMKQR|Y zA%1RsN?1&Ss3>CC?2l0P(**~pgB^HYg7*OoAh0xoRaACseB+2wwn-+CDnM73y#Uo` z)IMRgdBJeqUmZf{rPwj?V^d(+!1H@l|4Y_Hu2{;8zI)8gGr+;+_tCOFi2CbwF8X%f zQBoJUHT3tL;pHI5EA6bPg+R0l4U)R{kg9Lm$fKG0h)^+sL!zhJlbJ;Wh)^t)s3-9H zS7!b1^XJ!X6zPUz_BuNbk`5}I)UidzsF*#3DP>C9J|v}fmMYC(5QYa|n-h$Utw5~i z403u=s~`$cMy`d8ax4;bBYOHL_coV(M^{`mr`+@O$45kT?V45|Pnr43cKMeWyXW2> zGKRff@`E{B$kE7;zFj-D1p(jCs>6&BALT&XuPnlNKc{ zX0`iQm7U*c?vo$WK+r?XoPJRlF4cnZ=?(#*)br6bUSla@X0ljs#3B!Z|D`Yk`4#aD z(3bGapJ-dz$eyy9^au1*Z*!0d4hd+@5C3HvO(H%_C(?YZqtmQA@y)s$9LjtT&(%c8 zH=maU#MKQ(p~NyFx98T`RxucR_8J<|9CgA}H!`b^-B<;Q5ASB+fm?&w8 zkwryk6Q214na7R(l5m~>jm}6KfY?*Lr;2#%P1AXH3Ya*h8iNV8_Ta&fJmu!?`MS6A zgo`ALngbv;2tka1@AyDR_ASSd8F|+i< zq=T|bhPE;Ojt5qP7_s7dL@|n3yUibjl@*vpPiL3(zPLiSpw70@jCJL|3^_Er%RPJp zBoab76-x+`R7zsf({>gK6-kO8<*;%NM%R7_J4k-5Kr|Y^X5ca{2gN(UX5*m-;pz&I zsC&xkYK74YkpE}8g2hWv%cc|{&59C7%!(Z-Zgd)7vr)b;#6BMru*+j=2F5Wo#wO|& z5JV7qSym)t1QcS$k%)?jB8P6T^#1OrbUVQhueHy|SCyLi*~Zabkf{6^us27krHO

wv<0y@s795()04%r=k_+w;#Qv;8^V!?CjXDRi9;356i{(ga(zNi6 z4Q6XazYD&o_Pg;<gaMkyuALAPD3hrBtrl+$Q?xxnXQIW(gLjeexHhBAFcb)^>|Vp5d7JS z>VUE!X@MF%M5BfoAH!F$(wUOw%szG~eT<&x+{xt0G|#D>te+&r-!RGWP1qVh(;~r1 zDqPI>H=ra;uyeC49#~~sg$dm^VGq{^ZzI*1C1!z8e4V60Muj~(zU=h~qQWZ-o;p8% z3*0_T@euP1$~O(jXU<%7hOCo+FF!}P+GPM_c9IarD8osea1g`b&34;qJNxvNSbB+6 zkb&8g5)j8?%QDiWI^~)DKSb7Q`#DU|XhJN2*zRUWXclP^s%(xS6~EBYh3E2Qi_TI8 z3Dq?xwGGnVvH`I+UC#p1>#c=4PTw>S=#xhe_W6PD`br3$5G`v4JZL?^1%SV}u{at`afMZFO3>FFoLvMFNih z6|KX6i7}h0QMiT1Ad!;=dUnl2a2AZ_5cR^J|8l&~jo~>rX7v!%Cg}o0njs*`!ww6m ze|`swZi~)s>;(|7kS^klqZq))?N?KAVTDau5J3s+d{RYBV0PR3I4?#e?D4~;zqZAy z-bl-HX^k|1WChs}$dw1zrh@2jklldV)}js*%7RVJBe9d4F-YdRzL*|roQy!&*wKp- z03Fuz^kWzK*ia&dke9X2{)b8b4mRld+28vAvRo@gejjgQlHm_gtx=*@{m`uc$)nV3 z1-+WG*^BAufjdWpGpn&E;${{WK4b5`aD6I0 zdhzHJDwdS6_-KZ~`vCV`F4iDhi;m zhx)FevF+JB6UjfX!$I_) zM22(glgRe5Vv-_=__C3ce*BbXBoOxGhcEEr8DEHprRIn4wt8(}muPwOMp@Zw^TNTw z57?B3Cm9YsZ(G5mJ~Q39v5AA$41oOX4_avacCJ=0GoStkmE3=gsm;L=f}Vj7JiPx) zHs6CTOED$lfTYH=Q9p*oob3{ws^K`_F>{KwC*x^8kvA!FEU0!y2spxqJCG#(&_9mJ z@J5MYP&0M-S2^E8ufCXl6W^m>vrBa8J|U|L&vE7=!<7^hzz53@PaJyCS*{4FSQ7CH z9y;eKAHAr8u7j*mu=`O+_c}2pPeIvAbD&EaCjT{a9hn9uNilS4Kg*}ek8}ZZI{cx& z#=C!Btx3;LU5U*+X;d4&%+pK0$B20hPeJC$HV6CS;zWJBEW05h4$o8flp%Zl-JB0| zVlmY?Vmw_9NVG-WnM2lK2;?l0dorx%8Oz{)@}D!h=y>IjzA_xJlJvF=VI$j2n*r44 za|Wb*(A&w*3vsfH`z;`Ld32|^hbO3OYub>x2pB5e8+~e|Q)89PqYyyAERGynFk}U} zH2`f9%pf-$C1L)}v8>c>AQv{UaE2ztKWE>b23_MWg;!4-4g%DTw$+90R?5J}AO;BL zmQQFs1zs^TYl0vU&J{qjH(CXK%*Os4Htl~y2_hra0Jn@iqcJmFKCmIBk`Hy8l}3ck zi%M>5%*5LCFi>mH;Y~>W&UpQb^1=Br62Eb1d5ryRqdmebn))HW0wE50wgKrgE!QGm zPtFcAfb#OZL`XqG(F^55zM^fhN#*h0RDC~HI(bhN9(GYa!qH-%T`3VG5s4VYR7N62 zP(Xx)kdR`T0d_u#mG#2xG4WWb3*XWUxEs;ugYaUJ_eBlR7YHH=>bdZO?LtYxkPJ}- zI&^N$z|00HJxEJNtzZ-jW2EsGIX&mOZOstWB1_ot<84b^8bf{Dm5rQNI5m^L5K}C>NSF)8b z^?Wmd-3`S7kY1d5f(nJlS8ksT{cb&V{BgOFFm+22?O&QG!cKxmOGzQZ@I?{92rV|$ zurv>5zP=_TJ7iikiP}X8*}}POB<>lj*Bq`dmF_&z~VkJLdZH##8{jcNXcw9XJw zRZyPlbfPz%+Eip#LlMeQTFTi2LD;}WZk8eF1#6B&EC?RK>Q;N1Xa4TRJ))>chqc3jn*76=I=G{Q>@r;hnv{vc%}qg0*Y=d^xk~6%(mF16H?R&p)sfWjUJPPYXM?N z2xs$V|GfEk3?Q+avST(uHZ{}|%BUb{Va0@`ma(YRxT_M+Q&*nOf~jO6a*#QKMkxI4 z5k?9V@SS>m%kt~CwuSN#ByLQaA{K^{&kB7s-|hMHD{l1+)55MK`V6KRy2r>yENGEJT@O~u?fklu| zorNcm!h7E6&!so~EDFCC@6e@UhCYpJ1yv8*Y4VZ!^7dLR1V!a+;xlwK$*AvawrI>r zjT!#DutRjIB(+lpBoqDMcEh0{wu~c`kl=^!`nJQ$Z(ha^c6#j6(Xqfo*V=(!Z*lPR zNG}Y^3HAO@^{_lVKAP(x#U{R<%lb+i@qFMV7foPdFBZe?MMrKiidiBHMqV$K5LeL}o_wv=nhIyy!fsIdMnd7&3|@ zEG6}~dnIv#SICB>R?Ylriv(KyT2HL4vYJD|eeDJ{W65_TXjB;#9B=Wge?2SZ%_o$Z zqngsk@~eY!aMlrmvRLLxmm6i0QTb_eq#*sAmYn_UOe8C^)d^LqUe0=O>MWpimx?=>6zuV6wV%|e+nUdVR5mWHxpHV)UDk=ikfkz=MvJ?Kc z>Ye!S&kYAQo~?;g5%{k^K4L(h&Ibw^+Sa->)}u8nMV-klZ( zUAHvTbt_QGuc9rsR8ifRq8S$l3`s2a{9LY#V9rT$YJh0wW*kvB#nFU-DV8y5G^=7> z@oA+|)&6nr<>`FCVLn+$O6KW(+73a0`b55RF(&Ukb7bE7C#Xj!O1JBG&_*-G4@JbI zXE5f0_AqQw5mx`%tL)*?a$=nWX!Y2>=2rh6pGJ`!=I})sv`1Km-A`mOO?^@h{_a?` zE5Jg*Pcuc7HBD$38rvH~6e1SZI)mwq<7tT4t-aY9C?FnK&LK=!6}P{{ARTz9;W9u= zk3tD7fW_*aLEx18%~Bq&lsw+&Nwe)_+4WoI_axybYVKaa9a>D*cM*P%kMW~6zo)=_ zmMz?EL0!P{?xL005jW_}Wwrwx8n6$$Br~slBh$u+iXzZS_2ou1j2J9I3rhTz`VW8R zgW?DQSGK%2?W|xz+xiA}WLgtUJPj*Rm-P#20#f8+EYBO3R2+A|=6Xn2=Cm~mlc9-? zvmB9Y^r1~fJ3d`@ba!@<9`ME>(1!KzcISq$oX49yn8vg1FNE58_rr}+kUKxh&zhud zkTYpy|EHNl^m%M+HHJY^P)olGM$s-UKm?0Ru6FWwdOjd9&9aZza`C=#2i$+O%KP4Z zn#8Gk_#RwR*PvV)Z-Ga3txo1pAt=DQ7*gaae6X<@M+sJK5jhG9sE>g4?0daiLUxC# zkYX`AAc;xt5XHfuv4qHD;FDl}PY;u!{f*uM@(bxic8b`GHdKSa&r9o@6z5sA$G z*?|yAA|l8dQop(cU7FTh1o`uT(jmKlOQp00lL>?QLO}l`^x30GrqhE1$K7}uX5U_H zW7xnC&xe^n$b+hQdf3~ay^xS3+7^pafFQg;vU(5x`})`L7k5ehff%Y*v?m!}d4`i~ z(vcc3ar10!8ep61dpsMF@4V9!cH`uCn9CcP4)^Cd{q)>KoFCgw;VoOI06MfW2+j+; zZy*{&M4(MB39QSy|AAG_AFdm2uHIJ&Qqo2&Jk3&aS*v_CmlOUgkJUO;LCe>e%c9JOKkG6g`>kJf@jr{H?<$ET$ya-B2LCdSvI zg!ejfp(A4?cAoND@AA6&9dOP)ECb&Ep+1%yBOr?u_^=AKEU%&@+W}Ty%u(&KI_}su zlVVGLy`tH_B{*J*zxtq~Pn-b@gE4@25j^#>GXk(y>`%TI#3r>07af}$HMg8C_&)(? zNS7fMM}JUy&7Q>U!}6h*659QW^PHQ)WlU>Qe*F~F^FXZ1fw42c@l>)M@Ymeuk?1^& zcBYBUS8gYRaa!M&WvodPY$OU8>Nz?(>eVkY2PPkH*_fn;d;G(>L{Ei1re$w|pde(; zB1RmH4PwU%Zd+738(L7P(#?fnjBvzIEh`x7k@pFMCl7}h4pLIyqm(SJGbIn80U`1O zzS#%XBw6p;dc690h=(=UmePG9bQy6~S*;ibW@Qqh7+CtjSdn^aXCIX@Gzz3LfM{St z6JHeNp45Af>2ItKC z3VZhHX%Uvl(ku{G(%Ec!h8US+X(&*%1~TL@m|$BIF*6RN{$9#>hS!a@JT~KzY!#MR z(x~bkixdVb#ypwnK3gk*6$Z@a&;^bTgo%vn>DK>I1}{DGjs_jMfQ5mVU48@S0Ra1zGi40x|Lel9FA| z9?kdNd9sU?v00l4KsEv?_d((94)C6Np$-rc;lLzE+xDClhJK97#63*S=~&xltjS_N z4|w6(ip&tz<36lRnCjAYkf=?eOl+D!Q1}>aFVy%3UWj8w0yeZ6!))(V6E<2@!5EZ? z7#6DVEipw`(h`KgQ`y4c#So1G*=Ds9t=-adwL)w#Sk%pmXb^GMBlcmwT_IPN_)IRP zYf{Tag&xiXd00;F@{} z7YnjcHxjs0Nz&Y|l*Ph^ZB0E=hObBawYbTi%SLQ`_zmF|=z!EAQID|YR>Eu2*VusEy383CyuIT1~l^T+A!&DWo+~Kxc^IO+z*xKu<%&4&~+IgqVlSSfPutm=rY zRHQ`4*DYE0{sx#8&_(4l?`!rLvdtGqX24tEqx2tU-$p+UrN?uBQE8(m@-$`vg5_K6 zjAC6^v0F6gW6d_+h{?`AbKD+*bVcqE+Os5+5$r)It8D?BlcRd+bh(|G*f&^QFqaJA z;;TnEnHytJZnh%h*Bgzqj4Z{Off>q*;5G_{Nt~C)jAs(ByI9=$WwpcHd zn<%qGW6CYQ)(u46gEojI#4Zk1XKPz>J|~0ZD{SemBsm*`2BTvj5^9Gh4$>5~*xb89 z+@iiEC0IxrHCr%*By(OEa%T-DDK*WiHZTUY&lW->sL;5qSr{BKvAV7 zuI`MSLvse{n+D%aicxR^ol5Cogf`4<%rLnpD}h}#8BC%Ur6IWI%3M)}oz+hS5TcJ5 z3Pf1BjY$rdoNEvRjxea=;oM^oB*P8dFgBfr!KBkHUrRQTw;Hy?Qnh$YuuvjZLg>J5 zATVDC2~rP5;gP9w28ghO8MZOgZe>xkz!Vz2Huer$ROTnL^hZmusY zA1|N`ON1a~dGWB@vbq}x8XPE5)0T%Su9R-h_hpYfz}{zs36#Hb{wN3pTTFp4tPurB zWRtQ>C1mw8IQ_P3W`BZt5|S=L3XLBkc;-_XJm|cl4RP9sia}s4Wvu{7u1s7ZYDSC( zkHQquX1`U~c0l?qHDXw7!tSM$nt)hDRS`r01P?ESK>;=h53Ju{p||tLk-?I>3)rLB z^_6odNc1Zi{99w0)x$8ymg3s-IGZ%Rl~u)+-2wRBJ-S6(2L?@r0J z*})Lw*OyK=)^Y{4d~_JwVPgwWv(9DUfRc+U{E$#pCjVwP>n{ws=m`&2+S#H{*@9W+ zkbG3|{oq4>bL%$p^uyx9K|oRwWKmTRQv=c-h(VG_eWyeCne?cSUgPYb6iCOAcjnwJ zT+1F|RaZXXbG0@)2xCOO%nnu{yt<-i0U72V`QtrW+~O)Iiw1N_&*44H{}u-aTMb6! zyq76PD;5$Uy`60<+CfI4IWH@Qy_KfruiZg-HBh_;Fc{t^QINE5P`T`8$%oF5v%cz> zVG^lT;Zbq~ia@ayL_iaNlHaQo+Qpc_Ho2L-Fd_z5ftLt^5d#CRWVKtqE~1yF=8bF@ z{8)e3eF5BgPJi5py*std*N-ZLqwZk?*cu)gQVNEw@cLa~W?=?0B~j6aHxX-ARJ9~r zuDVtR{(Qm}sEp9oIT|9t(qQhCj61-uk=xKF0Q3qGu9Oh76fMfchJABc;BXqn&kPd~ zAoqB3F`DYr2wB)HaUyz^_PWrK(8(~30oGnp!lgqFS7-#f+=asSGRa6H;jt+YGYUlv zq`4+Jw1;~=RS}z1t8+rPl)XjOkYYtA7XvDTvA%C9U1u;BHK9z^4TVz6eJ%fGgbRqv zs##PUjVnp3P}Ts+h17vx7>2EzUd4HzostBCFxihSX!Ak}tBY8Aw3K4;Nb|7}3`R#l zJxw+O&Qo8B{@8h0gytR>oD8ydkXp%HxFb+=2B~>9>O}WpN?AhCG;bOfbE`)%M#jgS+Js~*g}*id z%*0G@0tJ#;np&Jbv+uN~0if2qmj&*Wt(U!%bRQ#!Sa@PBr3L3&I1_E*BWQ|PL!=lY zbc~c@tZkG*f~=sF5LQHHN%t@_6j;TPPYGjCqR-6%$q)v}S@(_tyxt`*H8R6B0t-(+ zcc%BDij{j>Uw#&xlMqUL@lFz#Y}pk=L>X-uk+!60z`6xdZK;hY-u4WuGpxw(ZG@(2cjZ79a;Ywe7opSFafJq?d4QPh% zhGzpGF%qRL zq*%z3m&Xb*?$+6KP*o}{HcD|ylV$}_NTgO4fk=X-jcQYLx}a79olu7x(}r|fg&=e< z0`j5mp!YIt4=KSy4!ikE>4Jy|RF5jzWX9V~q-iYhVXR3CB~C2SmMLkR5~s>>~(0abD6X|T+sU+jAT(B`$cx_&6up3%*8;SEDa&D z7NbC}=}=HcHic&C3dM#blvC1$20;ZNq@)kNJAJ6I^e|rWKCV-v<84Q+n1O(IRG!n0 z-e=VHlj5HCYf7H+q6*1Uq%zegg-6uuTExgQkr=ktD3rArnwE+PkWf_wD?}{?lvxHp zE4O72#(qWJZ%SeY{Ecq`17EsrA%Z52K`ay{s>pnjLe2N41KRi9q{9CTem@MbKDeMr z0Piw*i1xwrUpIEHn-U=fim(L)V+m(SBIap$eHuaAF}7UL=woA@0<4?-e0Ff3CbyNjUQM9nkAxcRXMQ}^rY6ST z5P#Y#7=M|Hbi-vZ?(fm**3f3>S}5P)Q!F z^i*}WtV12Ct-Zf9wK%hPGXlB5>>(gEvu9v5Ux2cl_8-OR;>I=@3_H%Pxd6Kwg2;?f zL`E&87^G5KQB_dCeF3#L+T=#~B!U!dO%gY9*Rr3G;PS?&fMV*m@B;ind|CwBT^a~U zmT4TEj!#IQ2dg8}9=NK*-}gNJ%~-Enh`1AWYrn@N-J61>16I$Q0}Ux_B%(sTK zKy*;L7y$Uf?5czhb=_!Yj-Na5m?kgJdEtF}U%JRmrNy9Z3&g+_{e|b9$B_zGZd+^B zYOnQ3g9W|ME+@Tf5ot6F&u(&*^Nmgtfd--Wt5H}oF~Ef7Ef=h}#6LWX_zYUrYdzJM9h*Ksh&K^>uvv#q5xQig0nKGNcg*C`BL$APZv7_{DvqvWkbGJ*S-V zG*4emunrVb3lW0BoTtWq2hV#JKt+NIs>N&cd4@wsnrBy6wpP^*M#+Oa5oZn=1;sO= zeAEg})l|wL75&98YN2H?EG^8~I4;47(r1_*5D5ZRZu=_WpdQ2U4*aJv`y zclL;EadCo1dG!rLLPGIp>_KG*37zY~d|&wfzToQ@L5Uc4S=0%YDUtiy^*CL7IR~1> zynomHbqX03? zm_GS%!iUJ(hM0(|f^lV$2Zwe{l(euyh;G@1wz@XJ%}VOvcMh=)S|cXZ8<=7mMb)b* zQ4=`BT2{2rhoIolRI`&C=8Z*jq-1*XF2Ie;VE;-7$qSbeDDuXFrbUhCFOEnGhPwIl z+asv0D56wo8wS`kfwf{bZ49KnjAr#(NN83_7}{<9-k2~|6o}8llsO`p3=cIX{#6U9m#DXCprG2yFWfOdrXGi2WqQibjRj!@mzt zL)obp1Gw3}g~I^-A_8}#sPmklsOeZ)$BUO*(4ysa1bsz2o35S6LujOkmW4n}_|RPt ztvy%^cqcW6Ao@>^9u%*;$M&DjG?DW*eqVuBi?3876)F{wt-uJo+J zB@;4N3NVa@o3+m$huf!a5Gm4v5W+K4y=QO;ThutpHZVu(8l@b&Jn=2u0aT(BeOIny zlz}1hbQ@Q4reNheitW->`(fe>rsH9$TLE`PdSdd-#$;&Qjps#;hz|z$Ev5dj)xQKg z4i$i^q+*Ox3NR65Lzt3snMDQQ#3XgKdUO4~vbkqt0-5z)CuP(s!?V(qM|$e=O!aBziG zbMWyYqm|rzY!VdRkd_%_$q%gSPKmO#wB-(LHHZ6Bk7;xJodR@GilBRN3}sbnTcLT` z9g)i2@4NTNyA|g6s^)k};K@H&kScn3+mal%x)9S<*@bXr*|P1JDVtO0z7q|`?(^1( zp((4elr-tEILnjlyAWnj)Y^hG33oPXssu=p3;W9kS_dg;R9T1+%{Gl-Cs0BiQVt@Uvw!W+|vbid=SdNi@ogh;1;ojZKbsBHC9H zEIw(5A3xQtGAJl}(hJdw(>qE=r|Ht_GstyIEIb1Urm)6Q}2U@;up-Jw-t2l zkSdi$6kwo+6dSe{X$u(?D3lomT_IK^GYbVKBoz?GvWb^69IVGfMYDmx)!Qx+WWj*P z0m0dn6b&{oe;Y+esKzFct2)*0`-o8Foeo7&*3?*FEzyE37m1gk6_wsn7|sBrA)(C_ z`xB6pOjsPrMnh>OPj<=m^R!-kngf7Q>I zZQ+zl$U3HpqG(Pr8Zv@9;KB|K*O;4IZ1gte;JvgyhNL?XlI-(x*o}9#;YTE@%BfJIQD}{kY*b?y#@TVI z8D*A~8)ax)22i4spp>>&iiK=tq$(n)Rkn-`o zrBR=c>ZH$Wuq?#(_VfD=huzFMVKlAayPoZ~G!thWgCN9_9fW^v%Ks8vK!OrUj2!=A zbk6?XS6V zV}sXttB$&n)A-Xf=L3Q|c5`ewfg36^Hw;EBl-na2e^jqbetW3Wxee}FA6_#{_qk5I z+IC%T`!&Tcr?0Yu-nkbm_0Q-!5Mk3N@!izsnp0v~j-0llX6#bE@~4HF9zPHGcvMuL zbP16Q&P!2!%1zca-)r#T*e79jcpjK)06ZJYD_q@c+O{!9M}dZ5b3C6^`DmZr;=|E) zs_eD(aV`itiFW zNryLfzF2oKx34GG65L^5`BJO2(`1=u+vTM!Z~e3Zj+4{2dE^}Pr-fkMKyrf+ zQF(gSV?l{hw3k*$v~W@dwnqicCduOZ`jrnKdG&xoRT ztGd=-d-Ji$w#KmWm6z^{qPRkHV@KhW!8gN_xdkOl6waC33PrEMin^EEDYo@&egXO6AILnBP?$wrA?@=o`LvUl6W%Jmjn$6oxg zT2FQBk4rlrg5=U$6I*`#ef+ePw%!^UEl+>X{OrJHW0k3D#szt%*V4{KKo{XN&)cww zmo_geKA!d2oYC~)mic|7kHLz1JBO^gV(ir5jYU5SIPX6wW%BlpUH>rddTx)o%BcUB z)5)l>pV^bDId5L;jNh8F?q~dAZ}oU z;p2;;P01ccFV9>U-I7vV)5!ViG+p*4FMn9Q42(PVHec^kkMFS~r&JE?so0deq37M# z3-<47m9|Swn|mp(^Zmjl7Y&D&jo;!}7;3YtZ~pVw93587ti^&UcfKV*y(Yz)*UdGu z+KqKz@mlz@S8ubahpKR`rT09~TaKuqouzA2<%8j1K{z=$;&aA1vTVJI+-XO8JFV7a zuw}QiZeZNuA2Yw+S){57ThuD#886~W1iVO8N(z}9i9OHgTj73g<>*R%;!25Mtf7Ke z8LY}Y5L3A_VdjHZp6|Bq+L8Y*>|LGxs_y}M$47mZZh80AQQV@HJXg{?Hk}-2JfXBdfmo3w$+W`xf3meFfQ!^1RoM#2Z%4 z7ee!E&!x%QIK+9y4a7x0G18LIwpazt(d=#xEPrRUe9{0-gXsFf`w45*RT&}y5&#ALJT*ev} zthRiZvDiTH@>=B0^{nSq#Fgjq03|Hk4Sw=+Hv56l*J^QmsOn__B}v9*j_z!Hm7Ww zlA3Dvc1x6`C0}X<7gg z>$>Hm&3e`3HAioMQ!*`nSVC6J@s(L?S0R%fZ ztX<9Q{>2-XUXW95Nid30pE{Q~QJywzS7qTNSD-jTC@RL^6VPO0zg>=7J_|eSdi3c% zKY6_aH(lT6S}&8;u$VD?qM+$p2Mo9&fhuZmoA_hmXYb@k=)2Pr@B;m}fq@sI!33{`>Y<_q~j% zM8N{-v`ys)9)2vT4gkIMOUv)o89cwasPK+-9dpj5-O-EY$ODU4A;(9I88Sah)<|x& z+cfW*=VRfCi>umQtAgI$C^)O^eye`iH_W6S3HSTR*j_Tf!SzcFi=>k-S0 zlmWfNOV8_9-q6%POhZ@Q9y~eAx&7Yq7q#rB$Pv;a#CE+!Nr>!=Yr-Yw(RZY0Ppq$v zyV(Ic4hG33mg$6UwtR6~*Id_US!KCW#NyTU4QQ^!D*w%Ly)x)vlv90nheOi}I;*5$ zNsrXJwYDo9l2_T>KFIy!T?Hp}G5E8Umh=lMN4 z>eCam;rM0aM*dvJICoQsbxhaZ#+Rzm&zk~X&A*w?ySiV0K_S2D{R)8b{;khd|0@gJ z=Dk0dcw;$oohR*VB^CT4ufZP5Gd%Dt(u8ex0cm-+PelNufs*=3<#c~kz9c+!0T z%6pgWS29;sDqe&*`<`VzFRu9fwfY$09dtWsH+*~f zCDSLfx2EoG%iZgzG$3@VsQG6H_r|N)%h5afKVxUb#@q{Cc;K-%V`-7nu)*$-)ab9_ zM-P4Jn(#XKben#{-sHMj_fyTKm%lx(*yXJMaNZ{!8^@{*>q4iz-C26aw7=lx%bT}l zvwfx(tlYgx>Z|TNm(O~cnr;23t-DU0R+bK6SL*ilgUvQ8n{z6xk}OzG*-8a&JGO74 z>nRPEysU3(kA%aVuXlEAnX#!U*g?ZzS5Gj+H`Se~JRZN^^jpjgy)9hhy*q=M4{yzH zJ2v{}Mo)A1d(O$J`ymJ%U%9fFdvG{&lVskqcUPQMjpV`beXCs<9aq{D z8w80PpLN@|zrOeI%=29GWCp0wkW-m#Zm61Pm{T_KAq?>2c>DMERjl7rdaNOM!-(|h zY3lMPnip>fq)Qw4Zw_>gpEjtYQhdZ-sX_bvp!UX8*&(NEHf<{!WhGxq%Y!kRP23&* z6-EiSq7S~+T{HMCeTM9m4F=~VT#F3yV={uaOX$}x48D2bq`!^%_>ljAxpth>+%`s7 zW4(jg-lLX+vtCEnw2aXfU8-LaGR=JZIgKkj5;K#{s~l3;Z}Ptwoo}#eH&a^@9(gaC zw&(Aru*COCUWdvnc4tZyPmD^d`73EkJYTW&>HvDLJ6!G2C)*dbTLwf7yn=% z>oXmHs>Sz&+)Gd8m}8Dv!;$%$$HlrC3s@}5wA`aOQpejT6T}8uZnnKusyoy z{0vUB&N;ofn7eRS%Q?UPv&OR@?Eky)?2QBb2bwtzGI>f*rJ5YnuUI@BxxGM7S0Qr8 zGh=!P-C=oP+h!@7htF^L2s;cdY%fbbcs#Jmb0@J;^+iU1<9r#(Dpv*R(qm>z_dI-F z@1Txp)vegI?alb zQ3iUFrsnf1SUQ(S!@=ongTNvL(#!qE6ZhD}t@l3TN`A>} z>Ni#CvGtC->>qsmfrVP4;-fC@yp?fQ1JmQVt7UYK^%OO%b6Zzr86Ul5$}NReYn27{ z&3k+#6`B3FlzMhGclzfabIwV;$-R8g(pY|nTtLcRD2`{T9mtTV3%Vtye1>BP@xH>iBS;&u~SvQO`huS4-2 z=eiHeTH_^@qCH7fpK7;Fm2K|V6t*_pJ!gJAVV+&~Z5@R}Gh9^;JmnxWc~gcGZO+mI z^G@zi?X0$b^><9vcqVUD>fMN1u)CJ=!E|h2k44N&d`I8s&^MNx+^Iej@(ot9p2iEM z+^#e{y6^bnQ%>t&+wp|dL4S+w7iuotEZ5X5Q{Hf9caB}Euim%z>^^_F`1==%YL}06 zYE`ztt^u-gn|$5=9_Jl|4)D+o^#wgGhKqKyn!A$E&Nvn4IL+j>$?Jv%CMpItzD$;d zPWtu7rT{DUK;7NUtLe$#7G}!3o~_}OwA!T1h$|o8+pe+%D3whAW+}Dd<7cg{=5cXh zE72T)2=KsdiTU28zc1C&pEYr>81;eWEA5TvV%*^*vh5l z?Sc&QThijY#8Yg)RqE%|C2_C+eiJ@D>FA(*tJ5kC|EAf~R;<3bPCJ-?=L)yrku^9b zebu|#Tl#4_siLVGo_?ZKuJ{s{&+AkT2A3W;lfSrh}-+a=g)^L#}~0AN2Oq8;h~p9 z2M!gZoNUekCG7FLoJUPwy07wQBRZS?czm!A8zQpd)~IqDA!iT zh;zRQ%sTS1np>#q`$0La!S>X6+BfV#!ZL+@svWHUXVJ}9ls&fXZ3H+E4bG?zjk2zd zZQ{+2cy?i%Kp5CKbNPVTyL*RM&g-?wsq%SP8ZyJ_MR{gtsN)^39qsMhxTsfG>&Fzz zb6<};*y#r*6b|1ETO)Jc@sWg*30(0)rha40+@VdS_aj=T1kZ|AdSMxuvghVzMjPkh z4HxMv0q!!UyN|&xmu6+ceWdy zDSSO&Q;pdwyC&WAwG@ul^BRVrz6=@ht6EPuj`?)o_p1ZfolWH{6#*SDvrG=6NP2p|U4% zXVJMm3;h#(P8*poY`d2cBpo;-PHoMSpPMaB2OejxQykkdltZQ$XBIac)U5=_3Z7N7mrt-*wr#WrsQOF?7`fg+=kiemT`Li`C~Jfej%)tGZcFB zv`;RXss63y%$ty?VusnX`j0*bEL~g{59xp_m*w^_i)<6W-ucUF)uo*$EV-WP=LUBK zjk{p}REz#{?p<}eYDqz?oA9b*Q(t24gHuW-cYC$#js_hZzZw4K(d)Eq zLPut$Ri*A*$)bjp`*Z(k=cUtEi zJ#o^rmwjbNd3$nDY?Bh#cL%H?PEyxMwfxqLgsIO~s|1!DU$~@jaZY^> zT=ONl|8JdyGb?o;%+!uZavjzCx!kJfc$x8xN6v37^E4I8b>yXQ(j=?DDOyQ1oY<)o zyx4&7I%0T79+Hj{T#xOVJ*%$$tV?Y3dODQvKAiv7?_gnCSDsd>V`;QKn5zi#G90uI zZml<(R=L+;UW;d*JhY(x?#}a$%^bVzY}H`J$O5_~wjoUaV4l^G=L5wbg|XQy-9eSk z3lHLq^0dJ{qoZadnc|Rr=EEhVmmS>+%YE z6?tw~rZ|-J8JEaDu*)_!Fw|KHyy~v5aCm>Y``b%{zh9eyP<81AAU2N=#?6rvhMS&U2-cHd9)=x>VElU;K=d0;h(Oq$#^~Y^qm_Yx1Gp5 zIC_e?a%kVWi^8vZvjUf#^WvOcVgJ|p@5&2zcr5xmxDH&I_K)m^@oi&^fA*jB>V4hR zZPKc_;^TWVp=&TxCrkPtcdf7ME}woh5j#5f$C7@{2i~6VblB;WZw|R;jVb|v>Y{8< zRZodl32DIN$t7P9h>pxKL7lc=J6Sd~_`EnDzFbyWM?7!#jT)j2CjC`htK8GRU;q5- zc6}W*`Jvk4ciXS;YkX`fJx}R1d?{j%i@T@ak3|zVkFGU8m7gzZ9+D0~0u~2=1bpfb#gYJs z-~dos3c!R2#K}RFVGs`im`oOqvC$-e$pV-N!Uve#6c{B~kN~DYluB_{3XG%zOaY7J z0!$&6iSq3LW+n?F0j3CML0o_;u{aP(3IG--Nx%nK93Bn>EDoNA0W1z5B8W7qD8O;5 zV=4)-QV1arU~v&h0I+y`fQ9pT0E-W>_$Usr1ULqZQW9bUEI|gJAM2|FQ% zrUS4LfQ3AM3J>A~2#bRQ2n--e0)!7B$q0)C5G)lyNDd;Pr$H$QfTZ&w45l&xz=l{P zPGuB56oG7rOHe5(;s~2bAS9LYxs)K-FqEjB|DUjU<4ORMF5m7fS2;iQg|su8pH>9DI~(<13Vl?F{(Qb^948)0eHB8N`x3GPWd=W zfqW6;d8q&;Rg?{25C)3`P625GltciG3Da3z6v0RUV*waKiiU{fhH(LmhmeQ>z;KR` z4`8^MKNw$tvjB`hFi{)9#qkuXndHL&4g)wJ!BR4H4jMHozC47)hC*2w($z0^k!Y z2m|;8Nf`*Ank@}Z2LuobLqZZ42r)n)@)QC}5R`NwkpWPUNJ|6=#1*}!CqS6gv;u^U z3q%qWAUr%3`Q>2+h=?-+gfd_OLZF#cAr%m?MPv$ifPhDdRluVZMXbaEAx5W|K>!2- z0|bJ>JP73i1hNbu5R!#s1kOb$P^6LsLZ%=YEF4Ct{v;PqqIysuUx21kIe`dJh%16n z7$7(R!GUZkB_lYHoukt)$o^OEXlo~i@U#>p10Xm8iU^L74G>(2Bq0_DAh?vLCvX7? z5PU950wNWl{0o*u00iYt2q7TCk_Pc90f=%8Akt8h#SzO%Ms|WiUO%3znO}2Mf0XXB#R?XVLS;) zV*zPN2nnQdP^y}PQ-2T-r81NN(jh?-0i>tHK)T4SWFQ0}0y0@B9{{XVA%Qg)PqI!U zd3+$kD>~3!^u8nG_e+lq>)%BtiUD-dn~wws5ap9^kJ{MU**iEoIlH)edHeYK`BT!y zU`POixRB%v$$!fzMio&k72={WIQd>DD0+;N#6>wkBR~PNOo$2)Li94_uTDS)E(9mv zLKWLFBH*C}f#MhlBN&Rnpcy1UK&l_rKGz&zL6|8y`68zPN&^X;m4c9fnGj3C@HEW) zHz|}Qi>JqhB#5&?9>T)~8NZ)ZO|`YMce1ht&FpOK?CG|)bQ>qo)|O#!$FOq%W1@Y` z0c#jZwWgFPBq+=;3h)UJi3tshqV{{{FFGhMCZ0oF7P|qEjdGDct3{Rn;mCiMLAkYG zHL#G+MJeSKgRH|rL?ECrB4iTf8xT?`&X8Y4gew2S!-23Q1cXrmLLF8zelLK{;!rN^KfNds z{Xe<}h51E`5+@+cFFGVBY#tyMnwgh>0*$bw!Il)^OzJShMF|qYME;M&e_^K_jTjS( zvq&yTGfJOayGTMp0ffOg4@hO>f)pSPLP@@O9U}L^hM^2V^du@sWbj0$OtFClVN@mM z+Ci$40n&(HJQi*1qN7bhk{F3uXn0t7ba+^hkNM=xG&|vcepvv`;eTr4=rkUk27|Of z1}&69ivnno04*Az@vLYtor1+cG(d~9`nU2o91YNzAT>N1q{aP#E%FaI`p?VSqaQvC?3`8X;NMqCJZMXoMBzF(}@Ml-0sa|4Q zQV=c>LY=|D7y=PkT3Q0u9Gr(((+B{=e~}@2u6FX6Av)8F=A(WI@vj)!uM>p<)ndbN zrG6OB3`p#7aJ~Jgct~<3{gTT;)+BH zu$03{Vi1e~hHq4$kdeX=Gm;VI`)dmaM7|SC0x=}*H?h>=5`ZwVI6<7n5()$e3<~)$ zL{fc!FN%!|C>!`sStMeyb;AIHiLO)#3;+m)6yS-ZPosRH;h+oJVAV82XiU9yIIUk)30}>Ggb@7mhnncM1mJ$(+*-;E0 z17ZMk?Zj^!6C}#zf*k0V3PJ=(au8Gi@&zal5@diP<{M0&$;7Pu2OwDlBEDIPb~>^8 zh*SY32q6M6As8h12m*^-0g2c&g5l73Mo2g>~)B^3F*r9q64Kn9z^LAeYb$(T)P zs~w=M5JJ%pQr=0lCxZ~1Ljz(C5LXnZti2v?>)P{k;|AWJaYW;s0ngS5c{kJy*1b*}Oe^3PdPYV$ChlMjh zAQB-n_{g6%la@w+FfKZRhz^x`{pZ|E?aOvj8!t1qgM`V37z6iaqQCR6q(L zF8J$OL?b4dFCxTB0aywF?lu6#7ayij9J9t*Btp`un;*mjgajQTSSSjx7zhJr_%Om4 z5W@nX3F)F=AQa^x^aY53I*2krTPqs{ADmKDk{+GGM;PLV=c(J8H4jZkU^kG73#rp^ zhPxq+FjN2(=yV$Kf5y-VH;P{Z0wLZ1X!J!1K2D&dXeN}pY9MYRep6QiF}mM)1Q15B z5dqzgx=^545(5uK^FB5NzyK?#O{ z!D8?j790l72xkE4bb2f!mQGIx1PCjYVM?>IAWVTspNMEMI-D_wMtA_;5KI{~%1055 zWPqYN_t^<_D^HR4hhSKM5aL}0u(flxvazzUvIU}XN_v*Rav&-+IwCMUDw?_jPSON= z#Y6{!;$3U9Pl8uibWl`;S7?H-Ux-&65EdRDA!-0o3?(Pek$!<8;navgKXEQX6cOST z6eb2mZVjLjo-_go^$H3B{UgIe#jA9mF+tJ5Qj*QU8E6_~b|52) z(rHF2kebQ}q|>7qQFMABz(KftL;$9sT&~z$2s8=)k-y(IXODoJAv+?EuYUbR}i6u(nUuX#^h*GEkcn0k6P-cAS8az1cPRP zxdNRJindA0S&$GV_sQ;jN*Ba7{x4w^Na9>XKHa6-16YOK^h59j{#&)e=d_YxC9JwX3+rpM>4 z`q@)g+`0J5H6>f}_FzLxuuHv;2R}_|P5dw%IjZ?ehv9Sujk|cYJk@4qQsP+GO|uqW zmrhH~@QLrL*Lrj$fOVnrJKaO2W;m2fR7f;>t}}!~LyQgTD*ynH@~^rTg@#sTW&=~b zGs~;cF&)`*36r(PI*onhM$r@CNgxl9uqpP9LLHdEW;7d6Yc#3NGx9Q21wD<`JpsT$ z%2WT|-?MHnjW@rtK2PVoyjo?%{OBO1;JzmcyTM*Rwb+ugEXm?>_li9YC4Mdv9@sYT&`dLsiK!ftJ#dhvp^sAJWoW6c@3(;ba_3p?Q9&!F#ry zpXM|LeL){fMy3+7-F+a9eVct#Cn;c$kG2n|p(p6Hf$y}yx`y07BZ&om`MWjQL+imE zYQ}a$k%kB6`#A=i9nh@pYExHY7SuFaOlggdk*V~Ih|`RdiB(WAZ*Q7rqy@F_IT_pU zT{YW#^-eS6V&lXhxw#hti?(dr*K&7Xy3GJ*O9Pw|JhHiej@{Ppvb1MQZ=ZT%-F+%w5~ z`)zc~kBi@5-3%(2vRJ2tZdc5$Pt0405*D=#4^VWLYU+ud}YTJ!hyZEzS zbJ9CYpLcrgJiD{)#m5k=!@DxORnsOoz<2(Nf8=}X9(H@&m0KaSj|S@{4rs;_UsUfk z1<#Gz9`je_yf2sc8hyFgq5W5R@?49oyMJvgHBio*xA@-mu=y7?`z3;QFVbo6u1!tN z1$07VTrE6EzYMT7D-yrRIXa%C72N&Hl8^AP@KWn{)H;E*pE_WbmkDvt#4R3z=GX zZ%;RK>PQOsSQ^~mw4PsI^6Bz^wQ1cJAKWVDMkeZ=Lw6GBvi)1yQVxf#+}F0<`A}ZN z)ywUR>vk>O+B|-5<-#z_&vO2?Kj%4I02TCo?=w}4Z0%TrE#!O5sS4h0PAGQ6q^X)h1>h{hGx|E48v;O!ATeRb}vSay>#>SR8 z<;-PZkhW!-R#Y>Ym~gFS)nz3)P6Y6=rOwWJ+YCTjD^G!4ckR{674a=64hwDc3l-Fi zC#0%Bj8;C|a|_uxl4$p)Q~e(ol%FEc9+0fK=|WybGmKU*wC23LT>JT+LH*fjj=PN( zJv!FEKYyFWsH?%F_8g(Hn;Ji{tI+D@h8oPwaN}B=AQ!)zR}FZpYfc2LJo0tl9XaVL zMU86}PAc~g&uifvecbwF_UtQT^}KVB-hOwUe+*ZWESRzu{MI|zgqW@W3)!-u^1`j@ zZ;zPC%9QFhMf0cJQJ4An*m&5pWxcY)5%i$DYc{;>PWm{nAuZc$%JnVxa@*#$cC|GI zM;M%!)UCEr=sMS0W%i_Q{@tO^-n`s1(l0AcR?BYA3t3;i_MFtQ=QVRpwBJ@2ES1Rc ziR`(z`^?0T8s15Bhm#R&4Qr-Hyp9K6@()#iDd5dX822uS;Et+>7A-VEvhbJVvp;VC zc(7fvS1r4%T_z$Xw?t9a&c;v6*KeAUOo^YbTBVwrzi*83`~_z9(+s`l8*8e1` zqX|jTa~0JLCA}?U&6>Tm4a=H*7uZ=&lkD50U}i28VY>?UEmE9jXzArQ-z%}WYP)8; zMXpy-8PiglDe32L(X1(5CTj~7M|8)%j!cWm&hTjRy(X>1JD8#N=2%hb z!-L_rlpdL4=i|?_Wj8k9YH!iM7vfQsWsFwW@iU5L^EHectavBMxPil(5*IfOoG~fh z4w=T!z7-mK+;_lXBKQ+aUZc5k@t4Kf!79^wPWkFCH#TXQ0Uz4m#m%2p5OXZpYq~*N zYLC{}+P@aKoYXVZ>OJi+klfk1=92k!%SBD6f)4exSbp*Q+2zoqf7E=vtc%|fCFk+c zRM(T`K~u_3T0S=Se$*`O;#cHOPo?#D2gmbna*fUq9aKvNm8(%Ej+vzN$-? z_F6{q^+Ha($UAX9kdeAP#NY41V=J>OHv{?|&!JVj;@2-O*qt**8t-U!+I0O*WtVY` z(ZL&vo6k*|(YWy({8nkt_#7Se5AJPc#|?#o^}6z<%31 zyqJzw#os@)?)E9)iG?BRmzlkt4$apuPrq{WPC$O3a&qYTtP`_t>*rn6 zLT}21TAVH4lw&@dKZkUfOl3OU0|;?}pf{qTq4Gj?WF*Z2^@y9d{3z0uJ z4~PxhtyN$X8(fuTv*{%~w(fjT`vZnu(t=Oe*OPBHkXg$)GnZcSHEdSsTQ~$orj5m_ z-c6B{ZF&1S)P1q1324#(E+HxQ!}PCr-@J41+jViIO=87&e};?%iJ57jz}o6Zh>@v( zU(w39s>@$UO3NmX3*VhHKU6X8m@3inJi2f26WPW-M{C??<6AE%m~;Bm-5X)fgPY@a zZ7H4?@)(v>@JTc`miA^Mz{vQsySsZ_zrM7(o~L4=PgfuC4YHL!_&NFGN3PxGIRB}; zFU`XDUucNWzq#V_R?g`9eNQA--^LQ#{q9c;Pd${m^=6)S_V@SNxF@Y(%FJm+9l6u* z*YDL-vR!0o)?AdIO|Miv2Q>RtO7u=UpB;%Bj~Xkkl9M&gx9|$AOISBzeK5|;Y>yMf zDSBLZb8EF-mE`E&m&OjEN+s!BW$(e<=^n9564pMxs$p_Ld;Q(0vqjop;G9O;356gT z%>u_fPUwe~IuB=ja6hs7=cT425{VI;vbT7%s@r2F{Pxn%spkl<|FA!slB4}pn426k zb6;qmro)E8fPJgyKqzm+l-?&}%PxS!2eXuP&(xGfddew%3VwArUvTB!fmEsWWX8wi z((Si=X53$4Z##V4X-sp<+9SF_mJI-Y$-N}2!|mP{b7yeQD|_3;{oQA4CX6KBM+3R+8z4sJW4Ksf_Kgj$p7uP&ErhAp$IX1XCbx)CT@r88@I{k1* zHieU{&6lfG+JHV?2dDF8UyfT_R{wC( zt!dhZ!Hn?`bgRdOT_khOu|#!g=^fLa`H%8oBe_oh_jTq=9>p1@_#M5II-@|>oadqP z>IKRT`(%`0WgLt*-wCWs)nESAWBHrT(^)?I*JzBC%1o0<4r|;*EcbuvT^$gY_U`_x zF2wO;zjjA$;mhsKJN9j4UCDOzKm2CI*Ht4~Zprl--R=)M-!t|7msD-LQI>W0$R*UB z6FZ1^hNI`a9#Kn7lY?4qPUD~c?;dfZ%A^Q4=SjZpz}O1E(0G_15_PrzvFBC8cW zhDieZDSYjDs<*=5mVP<^^?c@sl6y?2#F6W)$|{renMa;Z1K7L29a%9`{c-o4c!}Ch zgZg$Q{wYm6pKBHO_NVPqeZTd~Duba}jT*c?o_}eaKPIqM%mQMS~EG}4wsA74C!H88!E)(B0Q}`EoNsD4D z<`4CD{Dne1)z@RMp~{WMR!>W(e*~AyNj*7ha%89J?UD~NdXAn+nn8rwl@#NOmSbyO z_j9N2Kc@aE{P@Gy_LtZLtFphhYA-5M&f9t1r8?xq`O7vdbRvM)`4u&rK*bLEu}{)Z z1E(7roeUdHQQn+kzgN#!Q}vx+ud%)T-G27ah{=z!hKC=QjJ&n5zGL;ZJo3oE9+OPF z^kM&u%j~=^ne>N|^2RiS_RT4qul3uVJfKqFvVM(ATZcibf{JG4l_vGLC#q{r*INEi zJNU&T)nURi+`~L{;qfPDoz?_o4D>F0)^|3=^F+}}zwa%=h|2h{8?*ytFZXXBIxtc- z)RuM5K`nDQx@w1kcm7iI4Jo4~QJKNRzH*7TZrpW}DvGXSoltKr=u|KmdH$^K(n`Z! z&WY(WEcDz@0Ix4>J=4(sK<-V^%Wc-a_A1u?z8r_jwF7eWON-t=x>SG1dgaOHYo`8X z)BHC1`S~>kuTSx9=wKe2zca=nju+T65fGh4Zqd6ub9Ju=`9irz+t)+iGRgRBcZ*Dy5in{r69uS;=_h79AFJe%iNV;kwE8MtQp6vgs%6 zQ>QuIZo6~$@8es?K8%c}<=T6ho7$)vUmj4tS=?mq*uH+3w7sfl$-y@HBE6?@gY|OB z?hS`e4xH9nWwYSg22Rmcr*>1?hR`;NxlG;4|XPR4U)b*x+Ry>I-@>_FsdV~0!f`~%CM8gwZ6z-Adr z*G>1{j_bM*(62PEUda7fSL0~4`fJL?=di<|{)zCzo<3Pm+}I{_t`sypS6y3uiMCZK zT1z4I`a9_B0Bk^$zXijN`&;kV3nka~n&p0ad!~Q$S#vOB_ws|Bh;y5_s{;vz(T$ z&-;Pe*sfz2bIk45FKDto_BQy97T6u2WSp#JT=(Md*pV$xN5gE^bgFeH7|`=e`t#IR z=$W=kOY$WB9!^hvY;Rw3RgSZ0l|%NbdowGm-}8D@wDsqA-DAcqKWo`3<#Uy81#+`X zTN+gUiPAnlkX)nJwpqB%s7|@@!@RW3x79bdPSKhE=q^XSBd>c=)%^7A6K9%3D-cdzhJ750 zJx%85SWR2j)>~%wNt+W|9>09i?X#xo^Qsr8-{Y;>f>zKKt9**P+? zo@*CnJ<7a&Ix+}L?w`1@@6M|iuQa@*2h>^lMP4`Z-iV z$v^!uy|?7h=RHZ*;Ear#0=ZelNMQd&>Wr0k5TE*un-)UG^f8*TL z#hIU8yxiAz$%*R=W$=C34)f%b_MTo~0hVnz*WLb+`{c>CsWA&K-+e3_9JDOwqKk8? zm+7jd9F;Z_0Dff7DA+m2HNIoy}OrVhMsAD zRG(jH);_ED_PW2CP5YLoZ_?<}Df*yI(%*hwW{uuu?2kw*Ube$KD??s+S?Q9ITbk=6 zlvo>|zD2+F>oO-~wKLxry5O{L3sN8Tmp@x!aFB_BPi(pB4ST2NcnXF}%?_HG>8VVS z%%4`nlz8;y2FY0eEPUSn%)EhF7X%-Yqx%+&Q>&Cow|4gQ_! zu&HmQ$DxvK!_3^pLKgSw=QZ8VkqU-KTi3m4y7t9w_OYE2;}iD=qWrHtHSVd}RQyTs z>fwf>?VIE@;Hu1vZWB(Hn)j!ZyL&YjS-D?*G~;8=iG*E0jv1}4*+_yg*vcBz;|d&@PLSVRYe-ujqsWD<^_ zTsiB7mg&?NYrlHmup(TuOw6KQoKNue?SAx%btyG_@zO(M?7@Fxek^$W4{0Fx^-({r z>U(6<{gN)#{Gi93$5VE_lk+xh{am``>$_91iRPi>1NCzLjFoL~U*{X>+i54Hw&ok? z8p!!SYuj`8-97&vG)iXm_Pppj2lth&yD#B;Wo7T}$}ml1m5RSW&$Lux85ad2!lQy> zL*f#A!XqR7e4+sw0gA&06}(`GPa?25R)Ry4e1c(ZorIDcA=8S5^Q@DgR21XjX^;T6 zX0jB*1!xkAiN0CG2x!JK2kmTZUBCdU7wBsR28w!u5C)4ry$VpKki-Rqf+!%1Mlfhx zA@E0Vpb%q`D2{=ANC1hVuR&Y@LP8P;MIoh_kjF#>Ac^B37srwqzoRS{*;+c-xjMKy zIor89ECEs>0SYm>2#6A3ngGX=MBjS>JQWeJxp*3YAxRL4rXrviAwZB2D@F7@i9*dr z(m;fZ@DPk70F=u`lBo4@AOXapD6&bX+1RB6VKE{9R*Jr}{@cZr#u9~R@`dEDcr#Hr z=`WZ@fTGAh(T7}WAd=1(AfoV4QIW(`5DZX2F%l67gd%B(LuaTCzoQ-}V{=F(ofHQG zVjwjn2@wD=nu@{*$jksU5djW(`y}{rCvy=t2@({-Np}C{FC`s;0Lqx;7r?}EE&^d7&PN0gC22R11z9*xEEE$Hz|=|< zA!W*i2-5Vw1Alb`XavcjcxB~6n1U%thUk;7m;fB(W{4*zKpaE<5FMpw|A**FQ7vB% zuy7t95}*YB#|lAQNQ$_FvMGLWahy*8NIJwKxfx>Q|2qieBLd1GU{Qp`FQR_O64MBg z3`{A-HwB3djD*s~aa<%siueppE?1;Z5C)2Z??4*yhc1CA2AZ;Qftk4}r2*bvQGN-b zUa_LDyzZc@tE+;yPl9hy=&q@g4SqzOff5g-t3X8xz+5S!toXLS41GyW^o zB_d;|@PQ(iCn{3R4)qEO6BS^HgeKd35<-H){1QU^!UCcL0pI@?5eA!)4#>$XC@LvW zH>TOyYdK&LlPw?-u>(Pw5P|$bhMlFY(-Kh&{y#0QuCC%Hf(3E^Y_j>+t2-_MM6K?2 zHVR@6f{0nVd6t4`cVJo)mYAi$61GGw|3BW|t-Wz0OAtIt+hr47?ylF$~8>55Dj zY*7+;(sKr+fFC?cL{o+kM)fvOlGN z!MxAz)PCng03?;^>Y902rV#Wcc*G z$&pw|bFp2w;^x8{H|Nc|g;P&98=ucV-`K*c zp-+~p_2QfPC(0{*WEy;6#mz?1C(VX#SHoH~)pe3?F3LrV7GE?g`|o<4G!y1BWi^6f^sx@Rq%=HAxz7RU0h?M9g(%+zzc zL2X`G*G*@!wJ4g&SDRVglv|t9sh7*xR9?Weea6{1Pn~lY}WIks62eMzx()6 z{a|-`LxI zxO-6FdsM52Wm9IQQ50H#{BZa2{{H^sM|+PSJ*qw2f3*9sR@;00@L<3Gc<uu=p=4IAmrz>=R5>8s+79ZSNM- zgHp~2XCTB^8s+L{eY?`wGV>rKTtP6Au7H1te4o8HrGyYegy=H|~J%V9Af}s^PL%U&pZ}AnxCckKggxfeGwS21VZz&5W z_?xg?ZM+Gq+)6Y$q=r`a@~#U+I7z3QyzFRX%gd(VdVw+L&H2{2Dyy5}wk+ou;2j7u zD)Xkp^UmN~dWyiG{rKZQ|BIje^bgh_{=gpG|K(?`Pe1%%ckd5>*njMP{zbF?@X;UW z_t}$Q{B&dEuQ&eUFE@U+@so|>_shTe_@f{Ht$Db=@ozW&-R{O;{k(FpvxgB6H~wy8 zW8=?1+;BEFx9rb0HmV!-#>Rf_-~avgzuDOM#m1)_W%gj>la0To-@Tvx>}P-VR~vux zHy`L9zzt7AfSb9N#s!$?nr8s&I+G#=xSsKJ8pshqKzjl1;hqIR!q^R5-%VVtCxZJZ zBpQ@aZo%D!tw2t~2r1~Lq7>UCVOVcU(vIb2=0Ym~i5dl;uoAs<+EhPsT@RFVpRhXv7u1!67&X8T5|pUO%y zU5H;X`nNayN@Owf)21Exq%DfI!#zZLOCtM$&t@{rQlXeHQcYNzM!BFVQ(FQ1CK{0} zChn{XI7uQ;sHF(I83Ymmz7;$PZh?nJ4QLjH=`^^78zHWOTkyHWNa=@iGEHF`WtjRK z9*)Im#uFYVGk*I`7JicjJew#HM_w96b6;G%U3?W4}H+Xo!)46mWMSsz*fY zt+a`KlewN7h{T7l>aL$?HJ9pTGL5u^$jQ+v}aJXess%FdhBD=@1Tw&>zC-862KL z{|ru_z~K|R-O-91Tw>bkgoTJsDE)w0*1t!)}l6eY!rS>l5glJ=IAtfJyM) zI_*3?2izE4i6j(3E^iLp_ZjKtlB8}fw#_|pQ%h#Ip?`D+S+szkzp}H>YbQT{^$e;A zI#nftadqrhYw+_|4`&Evn;P;YL8dHg_*2Z5jxC{TOJJMr^P@5_hlOI1Qok}=+O{d- zZUH}kH8XE8WIxQ9u7#bQfUR&VPH*WxgY$?=rGCbTI1zIhWvYlE4H2QVXg{KJh^fibd1i>j3-wt z5NRqBcp4$>&2$1xr$v)R3a6$_mtpO2Yk4JTx0^;WbzM->*M2?2C`!|4rt>ft zT-$?RX|?93C!JqCJ3Tw^_I}+T3@@I)c=`2jUj6pO{Pr6xQmt{I~yJ`U(BT^U~nblnA*vGM%Gnu@v1HC+M|U9>Pp5V z?nBIdyb&TTv>6QhE9MiycpxXC@Zm)wN%?Q349$2`@>`MTAnpOF3gQq^etf-yO968z z@>`MM8y`j^*!Tmyi9+S#nu{%Z6Nk#EC_;8Kf}4Pcq^+KX)Bw1VV+mQ1Cj3VFV#GtE zRA05CfFHqO-awHG>FEj?li63 zXF=(NC;oaA4+34qQILr=iqfgBwVd$<+}!XGCb5F?405exf&UZ914dRh3_8uyNbC7$ ziC~04maF_~@`AkqJM1{%6Xh}}<$+weZX9sE;OH`BI2VZ~Sq!uFqSYS~%a&5fkQg=s zaGAzeq_@I)QIfhi&Xv8z4(s%Pjcc7@uIgB}DU)l~WVT->tt~9fRxIQ6HEKql5);}! z8}ZD)M8Z-RwZl$nE%pD^?^;lLlIL|P1L*}``Xb=BF0(TvFy>Oxx`L_kwG1bhH(aJJ z0~Pz1VU)~xK*6b`+uYohx!>?4rhu2J6coRLag-%A9Mdem)Rt&y+FX*g2^_XdnOtkr z7MH{{j1(x%GrB}LiLw;pNfH+i9uI;jOE0zAlOVde40tL+?-uAgSej`GU`ImHWw6p> zSZy9Gp$EX&Gk`~p{TkE{_UO8wUt4e}lO$76KRBScgZ^neY9VL z{-6ct1C#$HF)g8g_PAE7LHBUj?w&)d{}3(?E=>}6GkVJB-%hS^7LOeM)P3skk;|RY zQ~15DzIPe$aTL0#3%30*uoZ*DXg1?WPb|62t4c;zk-(@K5w9+cLWeMk*59FY_HV(? zrp(S}%&s*u1r*9E`Gal4SGEl%21EhSH#`U!Dbe=Fh9N_li7b2mY}Oprz? z58g`f%qpGng`8zGmIx(%Y%HO)JL%4r1^v- ztm3cg=vt)#S*c(%p%kA8#T1?L*y`;!iSUG+(^8UHr2&CE zZaD%u7YRjQS*2dSg0jt`+kRt}+6$Q$nrrrgj0`bbSb8UNVX0fi>;XlW>^4Q0>#2N|b%j7j8 zedkMB4lO$?OnFG5c90%NYD`&rk@ox~nt{FBsO&bBwX|OI{LOLd4v7G$Tt(mu++L_A z@IZ3agv-k-bvsM>=n^JzurwcZI~zrTOUn+Oa9Ol3m_>dT2z{iP&SKocj${bDHFCwV z8z$NHp$pYOj;cDP0&}m>=k!Ne5vjkjOf<@5kjk)FT}j^#2{*l^Au>KM_>AsgJB>Xx zz%gVOijZ4Q?%%4a-Z@lL(rWifA#$k02#fg7qR8_oWqBf7*;|U)j})^Ty5Y1B!>yQU zeW3xXNn4(!(3{>Lfyb{y-kfrJ}5rM$9M}}l5X)cl(pGXhh z)UMoPH{^a0BLwNjcr%}fWiu>!O|(vT-fPRqqH;*I=AG+{*jRdFd5frdcj9vTI17Vl zIpQlea#o{p4`kE4Q4mqvNpU>Ld;z0?dsl%}X|D3Gjh>H&kCfuw6* zP;{mtW29ixe2r(ipO?M2gKJ0rvN+|+dwk0C!+Mi1A8)gBEe?%yb#BDSLg8|&k5w`4 z&6q1=fJ~2hDAFoYO}0XkZJ{qTW;ASM!w}2>Ams>K48D+|7tP{8q~c44FJIZ}HG@#3 zGp?>MYq3XL0*IXvuS^O829ZL`jolMBb*0Pw@JP)e-?@zWOa`|k0g-oxtzgO%|Ar?* ziz?tt({4JeHf>hyGc5ZvBR)ZNMwF$j)$bKM`%nm+-D&17&veh?BA|^|Oila~! zDGfkwsxqxB>lxu9l<)+j5a?<^EZs3~i4hcWo1=T9)$j4q%G6R(mUu;1lNNrLI=SDy z7`Dl53sUZJiV%$Rv(qaQ7h5*}PU*x64uU*k8Cv~b=lm(LW=QhKOpio(^D(W63LC-_ zVXGp+E4$WMxIc7x4Vtdq&1T91c5y!Fo^}p9!}ifv@aE#Ebv+(=?)Ht_aTPAB?$Ow7 zU4UJwAE@dmk^V$fLEkT>Z$bpoB@>o@sWccObdV{cQqiHf+LlVTDnSW3jAe3_+;{zz@lxu!VcD8c8N=j3@32dJwNU|z3jEm zj}WFnn^U>u-W3eHz3yrE>DQNsC$00R?aS8TGX_&GlURn@xT(d=BN<(w-ZZ0zw9Arr zf*95Sf~}TogIM5FS-dC)-1I?V&yMGVV9o(_2aO0MSQwRN+@r}+DoL`!!h^3$d{S(} z5)16ztYlXZ*ni+sA}BPFhxCudRv_0_WVr`nd#&p+5?@-{kP!_omV*5};|l~7912s? zj4u#QN+p65ieBx|)mcuBo* z2}!9JE?-1(6hxETO9Ll)_B=i}L}UPW;w_7rct2FiT}WeZeWo}#xeJp=?P2?H*gj%l zS(X8%s!HQa!Uc33qhjIZZ{kEoiA--n8e|T+aWrG~52r*RctQcwnHVHC9R_L;jmHo| z7(pGP5N?T`h~&Zu3F2UsU|5bZEXSbIn20*Mi&T#QnNTI`fYj?4nDGSyixMd!Cz|9K zj*=9sjA7jZ{WOhkX51rNfj5x1ZFQ_o)H>Xl$Q9r-F*&FjRJ+8Kc|_i8HqMr}|F2He z7yL>%-OxF0os(%6TJoQEj!#~+j*j{)3TY1O1B^lU@=3qjIy!6(hVW)2-I(@l*e|(# zXMZf!u{#HC_8Pz+U;81zm>B(V3`XQneFnauO*?&$_>hMDxp5FRFhbvHB0ZR;8KjHr zOk^SuA^0jKQ_neFF}(q@NgQd*#8*PZ9JkOAW$9Q30nEhglDOL-qf5$4l!{0cl43Kd zJZ;wq*I?j5Ko8*GhI}SH7<7)$+QWY5kV3-?ybWLe`m}wHp`*bNy9tBm?crH#@C<`b z`bT-J?nW3qYqxu?)6VlY47wM?KYL{vZK9jMT@g#R&&^Z^QE9Jm+?xZ3>&x}Grf67(k#A{s-S%RF<*J58Q5t` z`*piGR^V*LRjRiJCTguj%tq_qS{~gFos)RQ6v0*+rcs$W$yfR5$9lO1W87?R*^=hU z55~j1V12@AmRKj35b%6K#*M)rM~No@#?U#wv{lnq&^c}$wgJcSxOE0+?cquH2+q1k zZRnk}2JNNAW~S}kiS#B)uBvkE*s9_~oCt@;P^D1}aimiHi1C?;$YPBQVS1DI`Y5EC zAnAzfiU!1{G`5Ba8Pfpag}H8>`C^_YcxNX3#7Y+1e8;ZZX42WKMZ9{&0zMJ}v*~8P ze!W`gt5>MyQsYV`t|B}U%iqsnfeo^w$&P&OU~>GPsI(tUHdYX zr?CXH_1%13TXn}(b+w@;mfB=KiF6QCQd{9o1+zuy6C$BzA!)*Fy6KOlX~66>%^Ufr zcF})tvx>6GeE;3?D!y8n8>>EAOEZe1H1=M-Vvd7BeFB_^u)`f^ef%6piDXXGitf6x zj-y8@A1$3z3j)b8t_elP5h2eX=n)N`_?=?Y#_S@9rLNZ|7Fd%Nq^_%T7s&4Psaa2c zxLe-^E3aQe9F51XUNJjPqPg^`?GQ)d-6&c?9GsVq&&4bXvF<GiSkW=Dy?sb7EGA zoam@Z4rY#GjUOn2C+VM9#)vsH<~Vn2_JgqUuTIQAJ{7}=`BN`u+J=9A#($$}EtkFX zHR+;Y3uCb&e8Y|3IQO4{Y^dX-IV?1--~wI{6-)SSV|6j6FSy zTXF$>;RSRuLIQi~jr2@5%>ZzGnHc7vK3&oh|737Yr(3Ggm}C??lPV6lM@+J1>^f>+ zZk%~IA4_+gH<2&XtIUMe_qg<}ywi3$r?@=vAShHtl;Pi0S0&T(9$78#tuY}%A8nc# zG`v9^$7H8pdK!@c4l@K%6pwJ1NmlTEb3-gKWp+;f8N4BxJr|)L<#?pSYz-ym86gta zUZiPPfX*#*nL>fZgncc)(! zvo(WXKij(O%P3B%cGMy3z47+f*ZX3=XZ)jNF}y{IPz2bu#!ClYop;aMY|tLQrU>_k zF7T4kIhJb&LB=+X;ZbI*CuO9xq8aI22p^6}hGpdp1Iajj`ZN|serE~UGSu90sRa|k zb{;EsikMD>9*EIJwtaR{< zt1H)5)(RI~jxS{>(gVoNiQoBK`2eNU-=Hb$0~>fzEL?aRL?a%+K&Ao?qgl*TIKge* zg*n!@_tZQ8m|c6cV0Nvsc4^dy% zTiGdM`@mY}>;q#%=;Vrj^!f?z0L)_I))scKK+u>)$*pS#3x}SM&RVp!aP0+yiykbu zz(?&T7f<1|+wDDR9X^9zw{t%1(iP6T#3OI_2hhJbKkuABh4XH!--BMid)65oLhJPO z?BaCTfx&6(c^l4JgJHW56h&p@@0o-%2~Q;qCDdypu0+G!htRs{K)q%j^1#bHbo_F4 z2ic+E6AJd`2aXJ#PH(;kJtVH2G;%1wdgfpP+PDP`Nt_M|;L{xSXCd)sF3tzN_956I zj-|c&7t+7Gu|Wnp?j5P$75_u&&EF5bp|-(MtKVxe8f9!jzC|()bF||ogVWM141nA~ zY2Q$Ee7t1vyGFE^#fccp1&b19X!{*POQR^AYK>1FOX&?4po!R_02F#UZx3H|`}$3< z-#+fVY}ztE$sEhjFYtUW?RU~049{CyTuW9P4h2gcOb0q>g?a#?S zQ*(WE%Dt42KzZ)E&2u@XuNK>Da9IiJwMVtb;Ges2{^W=bu(Zppob}W>X+3Xudqa3~ z`mEm_w1=4Pa?lP=4BHPuxeL!8>$-T4(1&4>=TPbN$f#*a_=Ah^Ir}? z(cx4OWIHVJ<~{{2h_f)gZvnF(RUR!E#8D97KrrKDh(<-b{wOF`qnMlsI;~uCDGevB zQmI(LJx|0bcu^P%FV*Y^eK;%QDly4z#fXl>miG*CX(SW#T-15RagnwN><9?6d2sbD zWPY3qg@Bc)+yhL05F5oJwBSt`yUNW*^BZ?NxRP$~7GZ?lB+u2*O%k1Fg^1uEIGG>SH zib3n}kiiQE=L~FTUoqP`z;{l)j^TQZuDgoa7!9`5s41{(k6y0+$0jkILSLLMm0#)& z1$G58X12d>@DAA_HN@<&3W8%j=3{_ z?P43=j-e*H)Xc4yuDwNf(hk`2sm;(H3|mi5JA;$<5d>U>X?C+nUc}Jr994TsG)eeO z&qiFT4P(vYAtMrlIc&|P5iycAPzATS)`8F`)|kp@UUZJ2MNF##A2I_y2u=((_2ymC zu1%Qt!Y{+7J{Q-o%dmM&L{t=n z!_)4dt*<)bv^5xBA_<}A552-kM0hk2DhlRWCdIJTNspd}gETfOTXZT*;L|knKqZfd zQ7Ca_*5j9XP271DI$A(TrrK}=57muGTno;TyerwtYAu&U3(j8V9xf2;k^dtqnbd#8 zLZf*q-OoQtLUv82JssGpgcU&YzFBB(Xc6m(EMAz3=>mynHxWh{y2*$rEG1%`2sK@K zPLtc>Ni1TSh~jZ3Ly}xH&)Q#6?rv&89paX-t&lgiL>f-N&O~y{KC#L40g0^`iIkag zE!f&J^Mb7`a(%=8PR;z`<4-QFAAO7O(CB^?__>w5&`-A>-y#Kg2>{ESP=U?NU zqiZ$2v0biF~;v+HcMS&>j}( z-5AuA1EKu0qkUQp1}CjLyAro*MSy6=1Kec`A73z@nsqXRD{&h}F5Yk=n**C%RY7yZ z(pV#~)l(Teb6FNjoK!Or=Egoh0H>t`ao`O1g&F0v4v&B-5Ei^$p;=}G1^qn04@ z1!=13IaZwXWJyAnKIBYjD5%)AgAB}Jm5wJ0i{ja)?k#3-k5w6rtDEJ=jcbc2@I|s5 zS-nlr?r6yOrHGe)lUK@cZI%1Gu(!ur6u`B|OF+`1;*18=wYMv~<2atNl(y~IK}6N% zrf@WPk(Vu`D&nd1*p#d3Tb%}ph=bc@D+o}@xsSRHJ?g);_gccmCSOoXXwTV=cT>Ns zK}KL%+xTGwvbYP!or~{kog$i8MFzrLCOzEnFlB1Sg8=Jkz&QUV|7QCcRhL(H}8}hjz5So6bmBUeUC1?M&qago`kqf1VPEL`J?Ot;O5WgE!&z z`QpmGiQTP%8+2TM?|`>PlT&EcT;F$ZLbnruql!|F5LS1gbL<=F(o*w(*;PSY0I&AlsM=_Hq)jecf!>nkV6_O3PsAIAB zhZn6r?$mHB3n|A=kLcIo@U;BH?}y#qa8QOf*YlR=ZYwu+w{P6-7w&e)4P#fjdk4_0 zyVnj$Ks(o3b;)eMg%9;wV-NOgwHgdOo-3&{Er5$46)`)rND-_=gnEfc@zOw(j277Y zSt<46lC6kZvoqr*j>JN7Z%cvYeBX?cTx+kaKV!igZxp*dH`h8?;p4{hgGWjlK{rFRsXvx>V6+(29?!8+LO7TCKDWiRY4 zyy&3*hi!58aL4QHKE|uw6#L9}8a}fhV&D;pjpBa5==Pg~&fIkxGhC*nICbUGf);d= zS=OhexDW@@OF{2?my*{-F3eDztQNwql!vji!GOJxpaCX+OUw_3Wo8KbT&dhJf1 zt)dD1JvFV#e@_J+9T(5KXKht<<<_e=)@uvwgI#3@3;cU&`}8kZ=m2(VeZNwt&Rhl# zleKDtt^aQX(d?UOR?$0709{9H*e3A%q zdXL}P_yp^6?-QyFcq))_Ax%!If-E6h5g4!E;^jbx4}kkT)*>u#VpqAIE2gv4V}$=s z@A<*y;Ys`O+2G;~2HnfS`O%Y$V;FV^>oU;fba&}N+c2RB=jre(U^c8!WrFw{XF_yRhg2T_(L*tT#kcK-s{{SL7ELtyv6u>CLdWrvm&MBsIO zYY@&^TRHQEOD8zcw}(^!^l>Z_*7D~fN%N;c6i82|dQmMF)M6o{r3a9MN{YNgUl`V6;1Y+?d$ z#%}8RZstzh5z=R=@4@P0p6Gq}5E03H8y_ZO2Jijor%I%kxW-=+ne)MiKgNi0z$fs*dw+>x zK~CB(XFP@v?jgKi%5WLwM>kp$T0#OSX2;}K ztGTtyX`05krx~X)%aVW&H*{xA%pNIM(4aFAZJUpFgp~Bg7z;=vrc$4H<%-Wu433gz zta@hQ71P#=i~`q^tzn$M#)+7ba!YVa#ik-$EmnK?<#U0kUfJqn3mno%B<{^PjW6RQ zTHFFQ$OL8Ri$!Ic&I0Il2Sa$;9s&=e@OBnu3SLYExum3O=n5AM_NVP3;-{+7O*_8Kr!_IEpdVXB@lojNW`1lz59{W%G$-y`bC&&tE9vPx zeWX`ijf9$ZkU6@X6?dVlzDpO*&CQL26seOX0lCH${z{Hh>T{Rb*~iw$maV|Bv9x%X z@K@}#7`L8|8756?On5Tl69F`W!iUuO?qus;IN#DjDh^5#gV0DJkE{VfuQeDj95U^4 zSNlKyy4PkM7<7KqW&|=6(vmp@Fzw#pIp%zBY&UA4%oh?{L9gE(vL5u?gCTC9px++$ z8C}5${gHqiDK{vBm>+C=(Ml(8B?OV~aG<0z%mjd!+nCaQ>J&2tHzR4BrH&tY8JSVt z=$aT3klu(2Pxy{G(A(%~nBDj~Lm=W4%5{NQRqimpf=@=BCU;8ng(3u7PYwFPhF)Q#P3T+VXcNRV+8=bSdZt7A0|-XSXo zI9riWsUJM9H1_u@wMwmE?U*y)LgqS;C&9ivlF<6jy6ji3LxGc$WOsaF3`e{fUng$h z&Y?*Mfb%ijvwli?mRhKVPR$_-g+4RWDwcb20JWuMlh8L3h(=Klj)Z2G8@noy%f2vJ zO2JT2mxlxvS)S zX7oeC$ONdpk7|ud{aW9+4R>L)OnCo#4^-kNvHrQUj-8wvJJvqhjVA!I& zc9?E^y?*xzJ|DL_r|l!KJv|p~uh+&Ih4bz|-TM{1zwyyeSS*qm50O$?ZnVP)!7_|O zfykD0#q;h1t(T{*K$tBPk9hE}JwpjCGnYdc8Fh#;LEN{G1=CX-$=Q*kZyJ+@H^o zkRilZ%ya4o>hMU8vF{DLO*b7@467J!?w)2rR`sY9<>VzuIi@e_a&;|8C%?eCJP1gc z7_^xN@;v}rxseiL2@&a!&P{LUdsy1-0C2)B+GghJf@81^?lzZ;O`MQ1kzzF>OJfG2 z#y7-J)S%EgLb|G?VFhY9UyMD@jA5uoBvcwH4N*5_KhgeVQMEr=tUfc)qt6goUS%-_ zks$RMnGc#_0acjs*wGtd#Ld^4NVqRnk>;`qMgPTxxql$!425258Yxo+^9|Ggx(a~1 zMPh8|Rom>nidZ?GBoVGHVotpu^3>E%UCFcz zGM*nG)nrVYRAtNxjW@+|MK?q$q(6iKQg!o9K!#J1NF?2H=<-LfJxUrz@hqi^1BnJ8 zhL<|PfJJ!-anMl`#l;aOu0qk6DO_kmPgE>Qa)|p>mCcw8muJ?7TPs!GnSO;54@}-= znV}KEtgIJiq=J_0Yf6=@M_W)Tacy!rkfS7+a37ak>B*GHrX=N;c}lXU0z?c;#fr@|(JCOvwhymt|20fRC~%=E^q}6- z)0RSrN3{l|Ngk}!>lCc-KHdYF`1}WtX5u*3kfP`D0RafY3pr5{`dfU_*vAzN_vPM{ zM+$i2k&ruf7WjcDfu}RGBt|nxR5JJVu@5AX5`YCvZ|Ld=9t1odf$w{>7!rO%QR9UB zB%}iY6*~5P2_sx6qELeqU&Rw%VgHM>kZIiL^7tuyirZkOIv}@Q$8{}+(bL)9-Ru=Bp)VP zrzVVUrXms8uR<^EDqni?nL$gC(j)@DH0LeaP!t`s`Y=mU_*RS(4kMZPV7>R=`yYJt z;g9}oqoijZE=BL&sxEguaS~1CNT!gj9Pf}#v1t?tSm^Uz0a>Wir_%&i)g^+8l{XbW z*ju$n3w<&FH5AYIE$--u)nXejH!>~s=*_YvLv5haSU?0G8a9+v%bi@p5%BbKNs@_% zDcR{kE~-WSEY;dJV~3^5Eqj3L@T%q{mf*5{rjf57;^Sy;E(l2<%ikCI$go)+o3ow2 z`syn}piSbX%@1_NE=e7)X=f{OO`?gw4^wq}{z+RJ5^Yy|=n z>ys9Gm+v%XIF5?lnU*Ys5$VWPGnG`y2B^{OtD22QMROXBhRgh*z}TN@;Xz|Wf3D5y z1APuRI1om(9S}Rjp2Wtk#6-!J*~ubCoX|c}=Vd{p(j8W`K!(O%rGP=_>9E~DgJNkX zNi@DZaG33|MC2AG^#Rs0@zKd)kDa%kkxeNG`4torudH*l6h|`)J#<=^=PgWQ=R=~+ z6r15OqHJ^k>=t~BPKzvYV6sulWk~)7s97WzXlGb#?+7|At;hrL8Qg>A;KGIsamt3V z^fhxmzRqL{aGj4b^z-rCNK7bK;PK5+ZKx%WKi4MNNYmt&PjK_G(Nec6h$a97Q-Gt} z1RLEja?H3pxy3_>#!({75P{bH4T$j(tc)FuaGscHLURMsZ%K6STcnnA69Si65-cA` zM;qb=F_Wpe@j}Ero#riqH_{Db_qw0BN^|J92Q7EI>uyC0cWWH@qdDZq@kC9N8Bacu z-immk1_aHUl%cQ1ob)~mE{=L|);c8qj-zSWRUj|sR3bugLuZG%wSy(HF5ZK!R>ZE? z6Zpa-4)|K6o`Hop;SZFJlv<<(_M5ncxdbs zRg>{DBs1@u6KxAmQ(omA(``74`SgXKKG@j!;KLt(48Lq`{8S%HOWz@`3mj_YaWX{) z8_x+0H;(@YXV?E9vuSMxt*GZc;R&q|_c**ceC{5*e{>!^8FAO01A%uM8G)b`rkpm2 z4b;yo76P(3cK~XP1bkK4u^~nQndU&6oy=Hjbei*v4Hm>jV27625Ohk9P_uqCZ+ zGHIg8JQ$H)U;0{O8|jTOjcAcKnAq65_lp9ISnsmnsaP1llzLfWrKSrztc3ro4%n4F z<^Jmzc>kk~jg5QnzYib$cw<9lBP34?6lNHYh~0>DLC2`h~a-dPNQ8zrs1W6Q; zkuQ)jZmMSK3R2MJDF~&?Rdb}mOkqlSZzO)mEbKV#q@VACKtnmC<1{XiDWu=3G=cP6 ze}s2~h?S(mv{450#d*L(>C>%XtNbty*1m7ZhM0^G5+7!2t+bn%`#Fg@6EpHQa7bDs zu2$LGQWl(vS!>Q^fMB%}J?Lwz+;^f!*?3$vY(26{4&y`!Aj{b|N-u2%)6El}F z2CI>44;DDpZHC_viPE2O84PZC>|!=j+&kD?Q`1{8du!p^TXbIyuf*jFdqD%7Bd7p(K={t(My|y5TZq%vP!30lt@hAPQA``(dRq{^M5*E^m@Fgfv#hUW04b z_mzF1Y*k&m(Isz*FVz*cMlJi8hIh5Y5sHF4m(0Av!O^OrkEkm3#@ek$sp)3H8_!R_ zy_&(5ij-l`aBIlMbK`FPVY-iQ6Uj^IO!p&N~xquFgS%(eCJLFHjkST8lmR7UH zLI69ps=z4T?qy)tYn8^hfP?dDYc)NAhMg$_C=F2*B8&3{Oks>nuJxN}oYGx`nQc#S zebq_)Kv?F}xHE-61?t`fhj%K7t*j~wnEjYu>)tJVKIbzRYbKLx1+9+Tb2B>LNT)nC zwukhXMTr9A&A^5C?|t;=*l8pti-FeZDblVJ0qklvNn`QtEqLi7rH&?iG(?2wQt&tt z!X-aC0!aoJF{*ieCT9BW6OGc`9R0!|;3F68S|f9d3smgdRt8?2F<_0#UIjvLrp9s+ zr^8VKLBxGNpMbhm)v>DLdflccA1`HQnt;?$gJqiWNQi-u=T4ol1y}^Jnb|jOO1iZ0B7(0u6 z!PuEG4CUPUG4{vr7Of_w(%q`z#Qd2;w|L7J<6sD}^mh;g?;z6N;mHIi z+m>R`d)hgI_Gzm(Xdl6O2l`L@-HRUdF9z*C42ST1@EaI(j$kls4WU06fV1tu?;QBf z0o&ht1;4dxyAk}}u579AVToi4cU*5`_$t?JD3DW*iDYhvv%oyKcD=zaQX);k?8Zrm zFBcMs#@ZoslxSV`reWOZq)S3B*P^5HR|}Gg@vtyVbtP_%NU2TxkSlSUBTd$1<`ph$ zYcID$(cQ?DMC_NoOOlCrnxhK~qu}rSvG~zzv28}Ratk*eW3?~^Q z*+-fY!`6^7_I&UgX5$5snT?mj?%7%E{0Qv*jM0DRQRR^WOD_$~uI!uY*t@`cx;UL2(sY=Od+bls8KdHHh7S(BK0zywiF`8X-ZEscv=IcGT$)zc%5)uyy#XXr4tZvNxCDyP-QenXSMy8F<3|C5>@` zH*>U!_kkud2h*9D7JB4vZ`1b6z&5=o5hUy({4#tUW!kcwvERqOiAJh|HJlk$2W5L; z`0B3qTjA;xIV6O_;MPPT&de>-X*UVl%vbFogYM~3@5K>xj4v`xD!Hrf$qYs1*dC5Q zPqd<@V|(Te%*VNdhQc_Q1?LgVb$Y*vMr*zb@fkDl*+@>ZC{sC6M!q)i?Kjb=u(d~G zYCg;8Tnk@#QJ5xC0L-y7Z~`39$SP_(i+nBcPWE3dY^e{w+}wm;{vI|fl}Z_Y`TI|x zT!shVgYA-ly7v2FK^Pl4Fp5Q(yO5b_Il@awe$sl!PnCpit*Sbq7IF1GE(@z<&@4jO| zKB5_9VJZU#pR=)q&zX<=|IIS{J*!kI?0fj)i%O*eLU9ki{0_eS62ANtzW5a67;~gk z5#n70N-)aI0O1f234zBc_Ve6Q%Q#A|sNbnAz`nztirvgjQa5y!??UHz0Eb7t*6<`3 zmGKJ^^%tbzx^eH!O7|K)4~Q749~h3LwIv& z!H4fwr6%uKE*aQ#f@l(DDa@pzh5fT~`7<1hrGK~UEK2D-gLu0|y6-=u17;c0fdVC3 z?}9aVnXx1vhBM=DmSo2AX-zzkmFZ=40m3LGIe)|xg{b{qN4Ks%lJI3>l+7WkF!@B*FI9SFe6cds0HZGcE%QtP3UB1F?|l z0|b&l5LTXwAgIuOaK*d=DXFXcH10Bt(o4dKms1|nZl1J4DKC;xH&NmPO>-VFF!Y%A zcx7~)bcVbokh^x&CFE|L+*Q;Y&!5AS*5Ksw<*?s6Y#$#%j^p68bKXAhHsScA_x2oJ9^g@i`j-Mw}Xp zl529h5b{C<@k<81L8JL4-u9Z?44yo>#PNUL?hiWM^QJj!=(o;~x@XYtbq`Ml?ZfW* z(Lg`++pW`K=d2AvBnkEMIE*GiG=h#cdM2VV%w|z2(+qC^thP!XB*M$c6PU(lh2xGdzG%Y#{pFWU_?IuffFFPPCG33n9enWVr|_fu zP1yRP30Ge>;aRf@)^|;K@@W$uY&GG%Y7;)On{c?@gnx9J@P9cD?7nHjXnPxewzUP- z`%wD={_IQGZo<9q;KNU$v;}`&g^CU5+widi&KvmXKf+ITVB;%z--Tb6VQ&)vvXFqB zj3XN_x46LP{_Ixlp5&)Ig&mYA)6%_WyZbKcwBPQXehs#>+fbX1?UnPbXTFWq6U;do zaL;vp*A=cic3tVZf$Pp(H+0==*G*hkxo+yZnd{D7cj3C=A&w4a;dP?YY`y@ZwyEOA zp<@tvSE>x!Tc?;5{xQoy5*`_eY8Tx7cjPoqfeihoV8$0rTRLDfvSO-B!)Wuo`~)qF zb7w zQDY1R(ySw?)MOhy#49+6%&_}Ok zikN=uo%SSCw@;!)A>3gSXrYVT7Eqom@4(nqsS9K7$pA-u=}J%Q#ucW-gJ@FCJ(`l6 zNxG0zIBnye^!2Vp5<(CsKq9}PxKW@G?+`HQgV!u0BjX+qYWh~!w}!s$>f4^a?d#it zzC8pUh$ICsk*P8CC1xU-kT|x7gjgs&vX+vYOo2BuH|)BBJ4lr~a{KPq>7nZ$jooL^ ztm%>9UMzL55@B1_-ouMF<7>Y{!=0!0SKLP8b7jWkrM-2XB9`R6GlNPMY0TUk2=rd` zkLgma(eF_WPCG|*S;n-VUp{Mp4bR$NU-r5$+I<*hX&QyqIJyxD!`!S$d-v57wpz^K z1q@zXo_3D%bcibPgUeKJJl7ZQIB>ap=Em;Cow>>#xO4Ewu5cUyPfni=+J{G-!C|X^ zgim?UY|f2-#GA+sTs4Mfo%Y5Slu8>L8z2Ad-h20~k3Lc&O~_kPasv|zPeiH|UPtO% za-*car8s?+--`TxutzyK<>p#Oew2-oa!1IHQviEQ*;@*}ncaf@1Z+;TkWTh&Wod`C ziXLF&-dq0q;TM1Ri@*QH-~WOxo^rQCcRR@ukI{rslU&zFTmPa6GMx*5Pqf3&0Z9kE z-h(&kP{CJqH+7t$J9L~B#ylYPVRN4JCU7G%M^h|bQ=V`yrL!dOGf1Xt?(>6(3_f9{ zk3ob!Nf_Itakc&jq(QUu))g$05Px823p;b{?15GKgdMreuI!H4*~zy%?8H1=;lp$D zaPqBHnuusd_7#^F8}ZL7rR0!V-HFfNA}$Tc|8X)Iab{;#JKK5dYMI7ZmYzT3Q3W4! zkF868wt8FR7YJ!CeGzG~cdc$UGF02fhF=8l@q(E9Gg$Q??JL zWX=nNKbjZ856R&J1wZnm4EKHj8zrs!fWMDb@rjRl5ab_TBtpN~@NbKtnCH^~wI*pETooh<;#k`Jh$qP7xlmK%(`8c? z))HmNNGE+J!mMn8HJpn43_2RG6pR!M$^2ql7^${vGtyZF^CY<(FR3T$22xwoDNnT+ zG3Azu1w5JLa>4alV{gaOB1l<4weduflEqz-X0c)(*H+ZY0*y9O>{|6QQ_(opPI;$1 zWl0t)q;f`4Wb86-Vn^)|UNzo|X{=5=r`@vEC{s!jgInz|Ei`HhCh8_4vEuGPS-82< zWgc}0?D(iNc(%j3gK9&E%N86?c{nlRdU3#StJ*tmhQOlvbx6y3c4NV8r_rc18VYI) zySDq%CFcLj+*gAh>`hh1UUva0<5Vkdk>Isp0=KgTpGE1xgF`c6GJR65y!)bfUUo~E?s9bEgUQx%P?9YMS*(PCkCr? z5Ykfa>}^^0XR2`2??aX+c*j7(yfhby9N)gPZZ{=k8kqVnjr43G3)u^q!lJZ3avbSn z&7Mz4{V2FC11}k&Py|sbXW4=I$mNc?sAAydIn+clb;IM894k;zlt*K_Hr{@uwTF2s zM?|!nH0Gp0T z!6!y)M4J`TKN0#Sl6>GZ#>OhumbPDwDQ;xmc=6;lmSJO2DcQ6^GR=fC3veuuCfQP! z)`ZU=$e4r6fN*zJV^vpMdS1i(CXT|Yn&ZYhDepuV7}Pu`@l4l7uV;eKP3?54SK>xL z7Ws-8Li#r{^`=x*sq_h($smws+iXg3(#W9z4VzARHz84(K2JFvCflCN>_ zZX9ilxObJscbj7TZ6jP%DixYPSZS3eJjUrn>#Or6Rl^9DxlC)0WZtMc^Mwaw-3k+6 zNGDttLT-8j9vgQ9gdS-w-e36=Bcp{RY($PPEEwE|o>^J1R9;O75l-GjUF+fnK3pg* zc5ht!k<}-hNY5!G3l-9YR2h%S*@dm(lw1rd9O!LAEqUOq2t8W?U~{ljpvEOUA_2*j zS%MG^SuilByw_6Ex!N*9s^Wa+R;2f#6$C6!(gN_^nA!u8~DEuCt{&Z9&Qq* zJf(9WT&ppXM(mIW#2+L(b(>|kQ_G60DbbsHr9r}xjAYk#EZUosb@nSAhvU-?#mWaaKdB=Ds!O0xzy0OjvI%xZ zlg`d^*k_~L)m;Z%gk-v6g0o}1@`gD@h+x`K=QIbGEm?Q4Zqlq10e?~&1l2Iou^L!Q zg;0k#jg$zr_*JGd9_UICBGR~O**ke7^TPlOI%9G^LMFJ=h_)L<;SaK~JE#t#fG6?} z`LV;iC{&WH0t#dLZz`3wg6tK0F^vK#!jH}l(aL38<3F5npz`c9p3~_vrvZ$X>d!qyzXouAwKi;GHc^8=!%RCQKL8|)aQ7T;1Et(7@>XL0DMDN!dWeW@=4f8H-G&J7q zHdgk?+WEB7&M&nz;%t48F}p8GH7QJ4JiS%Y<3TluCgci5Ba2O>5Kd*7Exszd#<27eV2IOtdUGPgv`iu@j#SgvZ$7ZE)woxTYy+ z>jCy<=Ll>qTDGwFGW^@mmVtVm{?lt~xyX@t33;TA#$+xK=fe7$w$@xPqA9QPQLL@M zcd2!laLv+JP7dBJt^kHVJwq|S|MV<{4A^oWBeLO>MC9I*NPdyBzI*vEu*Q1VygRWp zq=E&f1`5_*6Z)nlCb)gOw@E;8iA`4Pyw=>qlR@t8g2V^2@U1*cxMTkxd;cCKNp=s(wdLO;0_ts&b}YlbO}iGu2(C$cUSnF%=mR9XBE~ zt7k?ao0mbxIzPh?&RJ}8z=riM1|1`V3<3mbc~~ofh1N&50PpURpV%M}4eae6H?Gm9Jd)!_EEwO0#}7Rr^ae zE2-t@us+hs+lZdRLpux&Oh34>YigViw)HfgC1B{?bfCR+txYeTLpEU3SFcPcG-Mr6 zj)g?ii%wbgkCuaPnJ}@C>516Xxl<9JQ3a3YqW@&QBy7&u7^6`9iARO?KM4cy@d6`Gnig z*@gVeCJK!>BCmo80WMouRYCY2u2}5p6UD;IGB;6$8P5k9vbGwacupvaK9A_dqH7imR)VC2|?!=iYTtbwYKL7 za(>z|_ZSb+4n;dzb<~Fl*5j_kjG8R=I!+k+lJFcYT#$9a)i$-2iq%OGE%nYuQehtr z<8^sD;R@NFkT^KQ#ZdM@$F$mx$BPFm+K>wca;0Z0w*nqUqs0OgQin}T8}-Cv!hCf; zXLl^0DfSWx6nR{h52eH8U}a1s}}r$9WmYb(kwUF$ljzk%BYQm4LQvTHYVF8w|kT1Lq=xxNhZul z2ivaA-9SdX+Kdf&sSbCyLFxa{zlnBqz*@=WL zjfxZ?P#-I^d;JwP2XeK^YY&j($4J_EO0q0QQ#FBsHj)7J&*0i{pt3%SB?rIj!o;O> ztm*neum@_Vjz#2mpka*98{^ByxLY&E;|xeHnfB?pFE zDiYc_z`uGRvQz-gGSYL~Y6L48L~`sh6DK&z{qY8wjKZqne&H!0E8g>7_K3kya!8NI zo}v_>aAqziE6vdl|@m;86jUG+{t_3l?yMCb-@W#*ntitS8CX5@V_( z*a+^JZ8Nk{pC}QCBoaw63KAu>5HBRgI*A7f3mmzDZ7$z1!Af{f<&GZa&!haU0LyY_ zDmjCi@Gzf@KA1hsjDw9s93!au5!vk)0p~Uw34_ikR5F%P(?qSha>`YbGI zl9a%-IL&QuPwDrF!ic0u(OQR3DDG&HEt8BXw|D!^LPP~hd@oVZi#>^@74Z`lVtjZ- zAnR56x!`*!MMjK95_l%e9~5t8PhWU|Y^z|31L86|nJXkMhw4RL?kR+wgrrVXc&nFO zlP^)&t3oD6N~5HT7vx2&rbsAJm3!p!s3{nVW3xJZHEf6+Z51WRRjJ?zwz*iFVC7r& z>BU-pDJ5KPy@n#mBHM@wwV{ucafJwXPdU^QngVg_gZPX5Cb?RmJhxcDaq@DxCb9iJ zKRzE~pX?C^kNYR&tS)j=zFe*;GJ0=t2FS0kn=QF|$#why zawh(}8ZY4qoKrl3wjG|Ez(=r)R9hnchLQt0Jmt_YkRiLS(sPtMReGjX;zpirx^mb? zzV8ZZ3}K2k>5ue_g>}y*g8W>@j5s&Iv=GV@n{0@#)w!Yc$3}M1LPft#eNcJlsLQ@a!Gczr{?)vh`kpeVdB%amXZZ?D=#dS>*ynm92hE(NQfpB86$<7 zRF^+RA&Ikxoc&?}$v}!x#)LE5+Znzu*t6`yh2mAVG*>J@o&0J=KHKFyVCms!aj;7Z zx$j0iGzY7_DEpk`2%f^-)vS?qkemO2zCo^-!$K4=6O7J#%bvClXUh`poJMPC_EIwL zL0Y8za6$ax+im-BZfY7QNpKGB-u{`?gY^S;dvUnL0V)Fa4rh2kvo+2jE9B7VW=PTH z@qfhZ4`Yr3TB$a#N9);0ZK*PPsKJ_Nnod7YJ0U;*#n|+sxC0xZPng@)QY{0fN|$Od zzc3Fkh1_G6o9x=fsVh_Zg^L%VGPeo~8|9jQVXAbs1Pklcntow=>T(Gd)-d+!g-a!< zm1mb`>t(3bFI>EEWeRGWYo)2uMGU7)S1`OVt-^~X3@=Vo`lSn(FuZ*Enhd9kr6mI|~f>v&>!kcs(nvRWVDIv5lBv+Ft+zol)!mtDcw-7ic zfza&1ae31aHk`oZJ<)}e*|q_v$f9p_1tFx5_7{YHFzNvIjF2k|p_6i&)fg!sICoUGJ=4uOYvh1|lQJa-*8k(mr z7N=$W>D8LPuwH{R7mF8H7Hd#YwF;DL3l*r5b! z3@)>0E=;e&iE<)GI*GAxO1^(`tuE_?hY^qzT1D3-Aw2Su<6XPN7H8`hrs2^Xz(!W) zW=G+%G-~RyiuxLgD)*!Fwu*Y&vSZuaV^p25MXKp8vmLYL`66;G0dLRcP&Iu=J_`P- zg0k8^pjC%V&Hub$hCRoV zh%x-5H6F>h|5e4|`1*ndA4% zixsxCQHMW}HzSL)b$x1ja_aKrh3QfF0)E!y#;jhg)aL2QKav||>Ms$#RGyow=2*aR zi2hfIhSJ)cNMtKclu0dh)3zP2RY1c$Hd&&U^t{9{2&oeZx{53rRfQ6euQEgmImDD-^qJo3iWh>;seu~0xqC|%lqEejf^ zEw?-XC`)V|AVaSKV$|{@CLZXCJrLbuktsw`zd#{l1#pk!9!DsxFbt$n4%4d8SEinmXJbj;`SCpojmRUyod$CkU&Ew zP>(&b{sRyvC>XY;iN+X)JivE|Hbj>dtJxa4xww`;48tIyuG8AU%z9BiSvUs`%l7;8+-Mq}A&hR4GkIb1 zlq#=u!KcR#CtcXF4kh8c7}H9Z;)kSZrOSs)RFAQ&mODG3I2OpJJ;!pbVX$+c#aIW~ z0tvuMeS{|lQrS63nhIO$T#_bRs&EcsPdF`)(+Omz3D~;BX4q>5c;k8@O_QjwCSb?q z9-CpB8(%NLwrdE(44klKj9bRIZ@>+7ddo^hI$6%r6D)XiAMF@}8%GvEOh;(LwiWqe zPXGu>82W7speOI{0YqVB!B7*n-8dAzsA+T|)b*Z-jGnHCA~J-o_rl1CB-ArpU5|}e z*Ik^6LFo8QvkNfpVdVm2oE&1Hp?Rj+;P^7nj%M+Q8~}z~Rk6WEr1NIe4 z+DW38dkzsskSv}gK}@Zcq*E#}>5!iAcF3qjV!;`aZAZDpAp1WfVpJ``c4}sAm+z66 z*333A+{FX>FB+>x%>YfGD%q&m6XJ$tgst?nf4f~<~4n*{e{L07Y(xHX4I@=b0@^gHe0-a0 ztDpcjdZfXfQtkN3z#;3LY?aV}L*pk;rMA$XE-fiEfO4jB(lMdZNPTzUm24z1Te)1Q z;-8c-PynPa%LbKZ7x3|XlpCwKkPFo4W4Snqtp!}Ro{U4Ar~wbrv7BcqgZL&XI*Bt9 z5V1uTaSBkQ_a7RIqTO+9n2jRSYELe33k= z@<-JHU53l~<(W}rwZEEypNzF^ER@`s0y!iu3;dC-oEXtbM?(_xRwDsb8bod#$!zfi zJX9JF4@!ODD&zOJ4@LP^&^-4xQ;fu z9N!!4Lsxc1BIt;6YNm^v5j$^ zunRt#Bbdo`#67Yr=20Mc$BR2)9nAI>whbB3e6bJz7N8^0(o8|^xwI27+?Kv#$DB#N ztYBpwaW{AC#U1J#p?U>3of+I}xo02jfzaw6j7mQRN9Ys{+vy_iL2}a5B&0*656xPD zF!o&D<*ss30-_y9=rkPO2d}~Fkl5Ao11$zmov%`+>W~W!+m^lI8%;BW8`FlZ>l=R4 z3=I=+LRcu@M3br;)%AtV`8v#P*48#xWwZ=#PtL$xj98S?R+5-vWdV_HL;e&1y$LsB zF&T@-Wb)G4`Fdr2ZN{{1O1F6z&~+-FjV{RI$=)TBg_H0cCg@s>80T{x^VJEtG5KC< z)l0@d&Ao2d3}-^#;{AMLf4as(qy*yk^$;7p|&|!d%0FG zuc~&D31}{Iu~J=qX|`I1TKPrU-W{8F(Q1|^$VIAz1-}cVIx6^GWCTRqlele?IzvP# zdhIx`#pe&D$q0J0p$SIs!n>qi5>S;@x3YQ$$*i#lW#BrE$)*!_dS=Mci2@p@m0cU7 znlGy3hOsvx5dlew$@EDPH)ybv=_0HcS_0EVYEDg#6GHC+wnfcucA?t^N3cEl<0*4e zQM8B7Fp5)C0-TPV^oX@2hukw7Ju~G(qxR6rI*8hwQ4xucyN=xRP&gYsZD?*h z!PJ`u%Ty;~pb?ApF)3ZTzp4A$0} z903x~g~z_}=X3a=@NR~#T_Nd!!C{Bml7x){;dgreEp ztSroE#j8TsiWdieaD}bCG`msTn4K?AZ?B*gc$+s}5reL;`XSeK1|wRmX(;?lN*#r> z+L$;CBV|wafXDmF{9sMihu{D=B?B$FR1MU(Ldh5x(I}wxnGu|~*$>hcZXbbBL$g5> z6KM0F#Pzn%zVc&Ka#0hYH$nG-JeDH&P*-eCxz=GW^66*VIvUxHJ!|InZB5*kubd#q zSb-U}$rWcV4J@ZAVDdIhIKd2fO@X>C=$eoG-U%Mffb0mg3_6opV~>OU)&!m}*N(I* znjkT3Vj7Puor%b7B%ZfqP61($99Ba507?@SrC$Kkvi#6i(pC-6A>}!@SV|)D&3iG` zgt8V*FHY4oMB@1?A0@v75;Z6Ad^3)G5IyvYCQ;)M$U}kWqfy!&k4N%jN$(+=0nZnb zmc}1)jW2)ElCLu8i)OxTC&bXCUu3p;K83auCK2gv$lW9^y%kaDSWyz4hg|dCo{G-h zioH(LcU`{+$n^Dm3|v39A#6CFjUM;_7i+mZ>WcMC_pX^l2cgq7BL&2sdjGRj(6oUXX_}ZU7S&wP zgh^unwUZ05eb?@LFf)~TdeJ0h5_w`|)L^OeFd=-)K?M&V74>N4p>1Dw_wc3@STO9w zk$~aY;}Hydl71WxsKUdY$P8ONf}u#x1jmMNez3GR$0E>7K zBGhG3&596C?UN=VDx&a#5jg0Y{F}`GshlbHJj73m}ewp$Cs%8UX;N)o! z62(M}BP2*9PVaFfY>R-n^lY*)fMMa>vv`y_)@#K8L&M`$2zV%z(WjA8UvvATnYBhU zFqIx6IjXVm8*du0RIcx=t?#UrU)tHIR&LfH2(8FP9E!)t|BDO2TghE54g#0UIb?== zbP_@s47NPq<9DFo`8yu(?Z`nS3?w}(oa0^tPSQbOaxWA?t;9+z9||&kF$dJzw{D59gm8E{@mMWl=D6Up=J2 zH(`6+l0EEuXa%;#$@K>+l(tR5+P=#Lm>f)Q%Yl~IR*?HH*p9Hw&`y@VAar2T@ti0< z)kD)TLvlC}CQ7V{Dlz2>%}!HHMxCH3lvUr3kIH;FEw;xk1N3P*4jZx9V>(l7 z0Q#;^cCU;@93$U7m(+A^FEk@#-LSfj${2e|#stwzo}(RQgbZe>A)KxZo|r@*n&>4Q zbX`th9D*|#gQ{b?-Z2ARR$a%*Vulh!jbc0=lS#*H?(LzAbIWge&OL4$D8rIlXb}2= z*&@+t?BPl&CsSGx!QJL$`f4c2aXXbyiyeCht?On{Efu8}qc7kx^@q4*{Shu!U&O`g zk7+IY6Iy|q1789V;?p|%7#e;vU(KQWS$&4~Az8#TU1hc2(@GE9*!yz0GC@b7r ztj$4#Tx%bxd6@SrhwJjOO-Vs0X<`|T3cAJA$SOX?#d$O7fPim&?cV)ZE_y8 z$ui6@RM%I*5k9I?Jil0*f>)aYTqlZLjyGQ1m($$d>2S2VB+*kH@zWfp3bm=)W^JRq zwg9#1S zP&d=*-G%h-B81!#T(+9H8=Iot6td}?0@iBP(lq{FfVuK)X$t1n*Xz?TzwlCN8tUcQ z(gld^CTOMUTk=m&Zqk^C{Xx{ahf7i_bB&u#r_XdcF~n_&Pob%PZj;^>E+?tsZsk$M zoj{`~dQ)zJWGvK)Nct=hdmSAyn^vOsN*431=5F_{9eK$OH1179{~n0Q_Tvb^ihMo2 z$3g*`B*Km43T$>bO1stL_k{AsarGLAX((MOT`5gzrK`98GJhp?X+pEWiAr(T?yM{t zRl{F40zm2n4Kow~mFcVqz;PX{5-FLHXXcI>!O(JG3ZX~s(2rYffWYs0JcOZYCSXTb zEKpKX>;2sK-lyi*ZQk{KfHy-(~qA%b^5u}ryqZg z6`p%Pd-VP9f6E5VYGd=HuL11X%K@s<6X|*rE$~h?F!oxmD;|H_*TU&jXHFJQJaYWe zV`qmS8~PeJa19?jMaGebhmRdQe*DCVlP6D|I(_=gnL^=_M;?9j>{&?7C(ArCm&_+~ zo;U%TD9YMvqUhf9Avv9@Eb!B*V|7-;WFl~#h`IOtK>6bF(esPmHgT>~2T- z1Iz|KdZO}BO~6%e^3h`PJzALCPOHswnUyHB6QJ6wBZv2aU&94X!!ln#JM|Z zb*O4U(Y@C(Q-XmEKsjETtmaKRk@}fGq@j88tKQ6w*mcj>h1uac%_Hy;$i(0RAjk&u zF6V*nyEedXGBGWiha9!P<-l*#2f?d|E$OlaV5pARgUuCq3%?xh_3r^ZpUsC?(8W{+ zn~@(|ZGeuX`~plsk0%0#zJyHxfA0Bu>gNRD%U;~!p<^YV@)yac4Sda;ewT;HR{*%L zDkiu7?WjL*G>vsX=uEo1E7^RJklFBuR;Mz?G18-`^>M&Gb>J?a~gu3LSh zuj^K1d}%!Iu9=kdLz|pu0b4u1my#kz5ei<2H%hsot36a(QU)^{3y8Ff3^F-HL_{GsJC4^H1(}FvyR?*ZmQpP+#YVV?7=hz^qqwppV?1@c zsB5K*Ip2$*U5gp|&LmfOmt&|!IHwnQ(>2yWyNc=BwOBdU6bwb;n4K{?7m6C{G6E?A zGFggdvQy#!^*C_rWtzCbw)XCDF~PRHJN^XQn!V$?6Krekj_>gawiVvtC=UJMR-i|?S|Y8`Qg?a!u0x|ri^1bP<;WxP&zkf@$VK3Lg0n5nx>JC(pS9^J zkqBzh?9ud;&|)HX3XqM95)Fe+9S!F39uJuxGCAFu*;4L!sO$0^ zaoY*AGL`fWYd8@Z#v_$QW#VD#GA88TTwY%!(a^n)sT5_DbA)5ZPn|1fZoL98 zzXEXl`0>-HPe1Iiqt6HH2+SUF8{*O&vwo(Xe zvtzc>f(Eez--=9E$>ALjw@p=B91)qLCo@c2E{jp;;1bj%=PN5cnm}15Xp`o)q)2v= z4GgJ4g=GIuibL-k2}&S4TdqY0lO!u)OQ?r6sU@bW-ooK4iq7Vy z>T}4q5S@KeQX6vBLn8}u1>`TGP4A}ZxN*o~vRIrX2@`s(Qm5e0OH}_nJwxOcvGzc- zB#MoGe>w-wOnDpS31cSmYSDik_i9ws6AF}*oP2Z!#ybsAw3WTYj7P8A{ z_fcd^Un2P3SmHdi6geHm-OH)-;iqPW9B_QC-s^i28EHmFL*idbMvDi;N1^En=$L_; zr?3q(CD`s5^XOnk^_CJl()4LKo*C{jl`?J_J>fRHdHDfu<2UQ@g!RP8+!I@!C$^q{ zV(Z5Ar8bBt+5=&F9G&vnELiuHalpc2!?P;;f z9$A7%W)zW49ue7&2e(#c>t$FiFH|;HtFte`=2}HQ59Y1_-;*mO8?mC$)fYx#L$0&T z^sqt11PemH6`Co<9dSA1jkARUXcuBuLX}`Lzj3wzFC-%s{nGSInYSqOPL&diB4~MS zm+uh{s|>p|0cNJbbbIEWNI9-%&SxubfVv)-p+xoR zxU9`Zbfw5uDiyDZG=_ZsM>}Z*j2;PJ;T!-NHGJG42%2C#GOvM5{U`995x;9 z+5+U7h%~m>!XwZ&S3Vh0Ff0&n5=?MUa7}>8lJqb+Lz-$YXaY3*8O=@)E+p>{e4!2v zk_TBJqy~+JlcP&K=HMk&+HM$@(KKvh-4F{NG<3aTH6_s{gC+)`nG@&|tHHFFnYL_b ztA+ zp}sGwxPzo3!=|NQot_4$%DZX0#ls(hl-}|AAv+sWLm_Neg%R6EXjBYi!2nxzrEOGo zy<${!y{h(zo-))zIxucLE+>-2PD5Mnk%fa%ejG_^!s~*A&O!XVi;$k#NEHAQ4~M7) z@A-Xsj|j&O=^&dyz&#si5CcerNu{7hoVstuu1m*al8l~@Cy7b+>-mHqHxZKW2WY4g z@MTyoI8E@IiFT^f5a45`10Nx&vI=qMQp3n(Pl7I(Hv`jhqCMCYTmwz$#7cz4Ok9&) zn$YyAOJY-^+Ox?aa*1-Rrowgdpq|?vNy36cR}=)H-atW{E(wr}n|5IeZ!|fswQGWb z{LwBDd0Bw%-Hm!=n9iKhUhcrI-kCEx`rNKDr|)(^6Swe!Z99fo4h37+W7syAcUMH; zHpX46(e6N7-|ZN?db?wE^!Bc?tgjd=`m!M~zkqS46dPj@#1WURM?6mMb)C@n@VF2- ziYH30bBAJZA_LAabeSh7q~ke}W4ZuNWHtm0MWnbzawur3Nc4JU!gezxdy;aow1Kc119yZVK8(jM1;g z41eTp5p_>70PSKtftVH`)t0XCgS!MOw1QT=BDBjwqO$RIE$$!<2g-IhIuxQ?{fa2S zN^NI;ePz8`!v#>MGfw;1PHB5MTxXhHSLn{3Tsjd!LCLekt(~SW13-mX zBsrgh86@9f=#=~i_qgH2&ox@EvF{p@UNdTXl&%`{dfzqr`n+qndVk)S*QbmrectF}*f%U3f0of3 zM;b^swHQ~#^%rPmT%4_}lotw_r6~=;28)SyferyPqK0xNF7(9m#wbz`AYg~_NBK-39} zYNgH3fJF3ShkJS$djN6N32Y~X;eFV)??!5FHCW0u#!-5Mr3@=HeuW#gT%iW} zSQxE%rRnpU$gH^#yC;i)LBusdX9p12{|59EwwsPuk5GxxXzGq3H zd`KjQ{d9a(16&+S_#z5Aihgr@@{E`y%+$=|>Z4oNl)CnGyv+dN}I&**=_7aHMc4Aaz)mZPm3G zDjRH^k+~b%chNOvhH)e>#xcXRI5Bss+32B)o2-3jR1;6sH-d-)f^?Cl0)imDDkT)9 z_ud0imEJo+G$2Y*5D+N=l-@yli4^G_>5$MnN$3GW_R0TwKE2=HoINLdX7Apad*^p& zXXnn|D;ZSHkE{Q9DZA?nT18k-&bxc1N!)Z*9r87odOiH4R_RID6V`=|dI?9%$$I~e zdcly*irM3!e^pwEhY24E>D9=;766oL|z)|(Yjq@!mK2bYgaWEg^92T*62i- ztaZ>ybuawv0FAv2Y~Nd=OvsY9mcEkk484+RUx|hHjJ(;3Nr1^-_s#uB1vzCwoT7MO z6DrHI{ga8ZXIOA>FCk5k$JxJ7m0o81aNFw$4k9<@NRQg%E$Y##)%)F@Zr-vZd#|+X z8*Qw!%4^H#b|*I92AA7BV?;;Fk7V<$#HkJcGGLia;5he`2yUu#xHIb!V(rc3R6teM z^Y=IjB?o?%oksCmVqeKHaNXdxU2lNW`~0|RKjthwHTC*Q-jn7xFDeA}C%WI>{}bWS z!G^x0Y|xTly=s;`YxWW5A+;8oErK|pBT>^)IPp&X65>&2UNy|tB^I{E?#0GmG`Nu; z+w}FNj*AEXc%6a8lZc}4KP=u$qItz;zirNMgbqj(4Gm^VKQ}grT+-nu$F|AMo>?4B zWmI#cB$Qfq{NAc8VdAarpNamN@dtZ6pyAC=?f#h^)nwa>l(c`;;=dsAAbN4gQ){gV zqQN0#V)oRq!q$!EdF7Tk+Dg&DC52S^wGS2f6Kj9uOw$*_Zde!scbWAiBY`NqH<_R+Lv@;CoCv6X({KwDDU|FWKyfZyr}g{Y|z)O z%p#HyamsOABdgtPnoULI_csCs0=9GR&ss))TlO^vLEl8oQ_fqwQ?oktc1}wCSy@t+ zOh$JHe3o8srgrd2;5U!Ng8X~1>Kt2-32P#I`#+r##iy{0@ed|KL#r#&@8ezaKX3ku z?tSO1%Dmv`#vJ@K`(K4ef@n{w(Mwl@mS*uE@`a}qrR@je=adBp4BPj9J*wUVI$)D{ z4%6d2lV(OS?H00MG4XW6ektPo$zLkB^Ndt{ z__i#3(3&YxDaYg2ws_8{W9(~PKcQ8$xLE|tYxBFkTnw@kLE2Nh-$Y+;uL&Uve+0bN z6(@D8XsfEnPdso_<=6f!jr2hFUBAmcwX=+wtqrDAg7bLkHiSu`a$xOy3K3h>@tSPuKEDSZ9JPor^?lXQVg8xK-P?0x zFz`^do+{hyhBz%56{$R_*MkJmZjk=%KzknI-&NEt346rn8Gpi=n~i){ z7}`i)!AZkV_27|IUv>A9ZH;BM{J#+K5*T6up%hlX&u`pBcRL3@ZFAQk+heh z%-ZYY-bzpf!vN*c47nUrW;?nc=0x{+vNo73bJj<|>$0GMOs98Ws*!>aMYuAG1N)d5 zS@)VEENs5_C~UMBEVWL9)tX8LW0+RD^UXW^^z1So@~(H5?i`Rtw;Q_(cTlU9TTxq5*5lFg z^#SYlu)$vs;~w^b>|P0)ea&EO{LH<2yR&+E5K3-JHTF^oF=_Xg#PT&tk8?Nlu`g7G zU!-t&wtWOgLK8W+?$7(^356D~HJ`OoVh{OZeTMDc3k`C&+4>EiwXgC~L?>cNMZ-}w zGL^A=aXM7F?;`SwWD!57EGBZCzHgYkQfo#!xkx0JHM&U&5cbQE+qbsd{;a)yqga_w zRLWY3_C`EwzEV1V!-g?SO&8@57EGj=ysZuCH_T_d;lidB{$-FR(7o_CY8%DqmxOY(8ozPKVx zRLPo$1f*AL%I~T<*_&7@XMZEf z-IShaYYJT{-#-8$u-k9ZQ*J*Pmvr}{>b6-T1PV_$tgQmn)fDZWmzqP7xCs=fV3 zJ>Q}EMG~dFS-_%r4^#vp){_-lC9uObp2|f;W%>J{SW2ry2<&iE@o+CgylWlAlH z0qN3{Qk{kR$>iHt^hGhb7zD9uEk=y+BjwY`tMB_Xhw2+?5xJ|?68+n~(!TtUQ@NF# zZ-EWuVkmu}Q{zIbt;Ry$H(H=_W;Z9Lz+D+1iOvg8*8D5-n>DAC|F)H&jy0o3e)xh_ zbULjc<@f9!DkTBSBvwL9SVM~Fp+@^p*7rXt3tE0B342Fh2Iy_3{(2yyx14CZAl~!Z z==-ds;}*}fOR}LjEpteUB~9rwg+1GO%AH~^$+y-zTC!~VQHPm9`klOZ3Nh z_w%yh9@HK_FP|xN*OB)Ab}m0EO(`1LVw#ckP;${F-UW>-TCU<*F>;E0)IPeH_i96W z5pq!lRRN!WL<-cT2oLyWy;-F?(c%Ped2r$G5`O)yBFfkzR{_b}7T=E5-SK#G+Eq5Zs}by8+)g=V z5ngYh`c-eH@Fu5Hqu>(OlR+@BoEQd4lz?Da8Ik z0e|~ieuFIKyW4B;QWbURnt!H^s~J3sd4An<7kt}_=x;VtdidWQo8yfM)my1mH*V!u zrQGPT)^LYbdFg#?Nq^d;f)_kLq9Ir1e8S`McW^i6#(QG5Z->@ISHkf20AKGqs=XuU z>Ra}EpC!yHr*kacSHERj|Dt<0>zmZ_oBJ8%g2vN~w)M^8LJ$w7CJSrJn7?&=1W&K9 ziMfSkW$ITIX8y{hGNYLpB3l;+h>IV@#Rr0&bB@Vo3kin=g@u{T7z>}A;4wo(V?!A1 zP?fxxtfZLibFs2vO3zWscO zIqyLHryWR^d3C9}og@3p_h%q=&A(Xnzu{$Ty==_eoknL*lT=gm3XID zMi3P}e&m zj$V96Gz_u~7az${FfKa)U(A@eesdNi*o)e6AVR~w^9vbIpCzWuFe->l$#K)t#};I$ zr8f(@{7w1;Qh#HG*#Ilfz2&059W7cGD{n?uQ8IOh(n!h3<7Yi|k9qB*g!RzBCN(gr zwZ&I;GQMgrUYm+r>k-qUOT_dZwGz+Ygkt5z9_YQA@wVsxgT+c`d5t|Aj=nQ|>uk}N zmpSWqRsn4sp9C>Se#tM3*bz?OPXXKJ#QuIeL|v`O9V|PYHzyAuSu=C3&4zj^L z+nG_jmy>NMNGXSytgf^bSoaB@nH-slb%1KQY4kR{bupgxyRrZN+qAq}#@z*Tk)CN( zbe_}8Q*HZJCNf{g@99t2(?z=r=g6#1BiHWec+3oa%%3ixKmE}eTRZqHdY#F^f}VbU z_ad0%fHq5WdN=cR3T^DFoy!ZU`=~s2ndNUWg%ldAD@WaMvND=Sx^oVEKZ?~2N?Dn` zMNzjnSIDIf#OGwNUIl|6=evFUz4N43pKiz(6&s)P%26I8H&<}iY^hqi`%j`U zg_L>Wfu%MbY3%!~zZOrwioB7xXPb!DeEWfRQ=!QwWLuLKEx;R)@HaBoBcy*>ks-yp z_Tib&HrDlGJf%q_OagUtCq1S$rGT)L`-%5{H|6Bt*LObbnAwfGygZc)&8_=q6VO&? zyXFDetdsh4=;y%NQKjr&RG7N?$cQB-&5hLtbrs$CBIwSH`O1E}s_lYET-Cn!%hf-} z%dzGBZ1&dN5*4VSFSnVyLO=F9$We9WBtd2gH2=fH=i;THIccM4rp7Rjj`EU z@~V0_hLeeF25Z{?kbA0cVL55*I`@^Ey8=h+woVnEJ^jv5IArUtt)=THWB{4u5btVk z8k?u~R~4(bISPzJ#d;oM!%yiQHe4j{^wxeuyfcVp5fMM+nhWxE6D)Ep&ORKtIk_5q z;rHUlo9KL0VDi_+btn25D+RXe{U;Amy~Uu%KfRt5%L#13xZ01}_Vl81m>XuH>DFuddCGvZifz3Z2Y`jiO=rsU2}?qUi@ z#alu3NP8buf0XwPT^KhF$)`K(%gNuE4aRFURlAGAJ}yvE<%!#@+ml7Rr7DG|oEr6Q zv?$U!v0l(xzTD&ay`bXs{!QM_52YmJ?_|y2k#Ced{xu4UHgT#(2>;ZQG+29B=kl@j z#oL;s{6YBrB5r@72&&zB0Vgu5xsT&A;)r!EovfFo9k8&;?45(o!GZ?+}%>+j!$y*+G8JZtthQ8_tvk&HpJtxN>H}%L6TQ6GZfsv6-ry=3t404erwZEb> z!=lgTS+>$rO-<0+2(#lqHRsvkx9aN(HRGSFi>sd2H%JDroz5VnueBedbIxg>2~@`I zm74~R!UX;V6pJ(ziDu!SRK-{(V5+Q3W??$f zFedYz{?WjcIdF^*siHA?1x$;Lwo_}7)liYKE6%Tt`Q2z?Wu>T*CmVnFd-4%&&Lx|I zD!=2-Enj?{)JS2njR({Bk)B6q#FKY6TZo>GwHGr}t2yx3;!ssFB1$P?cv2oH-vEV{>zxZSDkX$5yKw znDhJxDd+o`B~``ZHdI&r-qHcN>$thcq)NkT%v6F1VsG@pn(sDwotufRxhKo<Fzy|64fWiDSva{k&>=eGk)_~86ax9c{HH9E4;5#ZFX~XrfYUG%PEhW z-l@RL-G0&ajJ0NgNBu*d9J58;$-f1^kibW6Ew@G3)W)<6V)~vRXJ{8>Y~QzJd~B+S zdi4mk7wbM-7}p_oC4F_;AHAmiNwO8)rYqleon8HPJblI!e%3RcwYN0_I^MtgdpFJ3 zKBw&O>d%rooEMXU=kPmwF@bE`uQlJCxbB-4@N$|B_P#P+9d_LllDi`@=T$e56s_65 z)2!96)ELRc$Im||xpbRYedcQT$p@=BPscYu`y~{-tHza>+cfBMkkAjFe0v^w%n_2L z$9t}IrzxWU2B)UdJ;b3s5hbN!E?u|Z4sN8Rr2lf1blupc{Bd03QBnTQGu2dKD)IXu z=gIibx7!Tn+EjD1gfJ^f8nd#mczG+E8sSx<7bB<4C6`Z7OzAH+%pD${-F(2km#*_N zU_?ofxOVH^(*X63#ZO8zew-OCa~};VNnG+x%4zwaWfZRFFXJS1JKj5?#O=~MsMuR6 zEo4JJDmIS} zP=~jMDj(Y4SQdP|C+gnh*55L=|BlW~CWuxYF~;AWJ-dSq*!O9@JDk0?mNnIr@U20S zUPG4MQ+qH^jn5n*krbBw(}&wb=HA1-Z%0q&7apBIa0p`_nhnTfs}WQ>_erJ-H;wQ% zjPT|`s?p{&oDEsG+c!JSKKlEU4H{i+pjP^bL7=$eRqlpjo8QLImpcNh54k5a5FgeL z>4&*^54arVxliB8cHp{=!+SCwh1(d3IKK}#65Sm8<9$q$Xkg*9{F2R}KfkDOf^#=# z(Ng2njqt2h&04Xe_r2@1^QbCPvM|a9lJ2i{^5308~QDzfc2WLaem)ma932Xiq zHjIDuSr}mxy~n#h=iEi$@M3@QCBjp&bYV_WP})t6WqNwn{zbyZd3ms!AKs ztkb5g!Q;~(aj?=dfqg<~4lcCwjMQGtz@I)VMS>v@o6M{)QEZ52H{Nhh9oZbo<)WDK z5%mQ^Y990X(==sojFgDLiw*YOXhilkJ~d>Gg}|UY#yNBwN-VA-BFX zeBshpaS>62?Ack4#L*^&tjTukR*L7M$9@Gv*)CSaqy^c)Ct-M!2Qu8?E|K#uqul2c|SE z1i!uVHN$R+aLq(U678Z)XJ=5J#Lbe7m*edJ_%!v(D@~@?(fa~p1#9}O#T%9>FNmIb zdJqvAO>+?mdA$Dha_~luO;$>5t*%eX81_`#o_>A6 zK-6g7Yams!_n8P|;OHK~Y-`W9S954!EUy>JymwKIes|}eIqPWm7D=O8*YAL}Nb`ss z#&nW7Jvl48fgi%Z&FbfehK48|bn0R~FA*fH3vQDJtqXHa7to{C37?G%CKHpHX(^ks z>D>$|aP#RAfA>^)Q1e`s8^WzF%QSE)VT&wKnda}34TO-kE$OhI+2J#n1zY+vc^cAu zO7C9f@`2Yh{`|2EmtV9boixm9iacGH^^XL!7ex&6^dBGlD0chCYm0tQ)p#)8*`Q@S z-Lj$a$(O0T$9BP>L*v`z>h%X=25O(IygRZluDYxD=!m>niR4Z2tL?11U|xtfz)19s z5#ER<{zJwDZv+(mF*}Fd;+t)JtY~=XcC0F#X04r_DDQ~rT(c>xW|2CTKos}MKIk>m z^3M$+6x>v0NWKS;I)n$hq0p2wkn_NZJ&}jnH>++eYZ9)5ztK=6%HacJ0L0h?8b4xB zb`ZpFtvWOA@5lE4{qGbw*pmWj+U0ao<0e&waa0WLxt*T+E7|10{^rm7?FZcCJVw~` zwnuyox-0Ia5D0CA3^b7s%Y)DyO|c~}u%(RHCBjiW52EZ@HZ?R;;>P|XlD!3cP6Q-G z_5On=MJ2nQ*45rmxS|J@cRCw47IpHE8n!dZMS=AWrHmWPJ57y)q|}8be1RF)o1lnH zLOv3zKfnbM&Y2vqO^W8JD#0(b#}8beoKxBd?fPqAa|XbAm_nou&om-;`EJSx)gMms z2;9w%NwQ_gFB@Fr5z(0d-3cCPM7GL4_uvEkT5tnIf{e>O3?UYy++ql$B_ivjV2;LLG14nS;)L`AKlj@Bu0cBb&kKQum3J7;5(r(47l#pHBe;o#f^j=nnEqd2 zd6Wisg8^Z17*4vt*IK>`Khci@l>S=s;g88y*%*-c;HX4^7@GYFh#Y|EL**C%d4`A= zPfek~E9m|LZ)<+13?Ghg&@kZb8Fa#1e#9WZ#_2Z8|C(Pi*#Vu^8YQBExej!e9wufg zko(}mp5p=g?PT=j(C9s!2!s5&&TcOf(9r-484#u`m_U8(M{+o-<>3f%ml>%@Jzx3#RRRRK^G|kA%KGijqtKW1MV(Gp3grviY~dhykKb4B^52NS%D50lb+Y12G!7{CSA&9b zIyv-LVvMk2e7NuApxn;UB8)Fz>v0>s4?}>_tnrFeF=oLCyTpf+XTXOu;ETv1N>G9+ zkXlcvc7O^y6N@oxpqDG2MHp}iCeSDdPsWQ2Ck4{U(WRJf>e9pF&Pvl2=F`PsQm{d8 z>8dAh&?_kL`4d3O(0!+c+7Gj&(-0X z>QlF3jAI>&=c=zuP0QL zR9=}R$Fq}yjaN8u58Ae}V85#HGM2mCoM^|&vkksoKNkz^WDxe zAFi2C?Ytw9j{jT|!JU#_7G4{MipW>7Z;9E%+0e|Jxw~9^x zoMG?rR1Dq2s%yOaQELgXbHe}1L4^p=&xi9rg-EMYL%$p=0hr*zNlV^hdK#|U0l(nwuREi0!9kA&&c? zoXvizQoL;Ovgd{FH~jY~5GFtaXy&>Wi9(hyuaQsF<2o8>a4WC=rs*9r8DYaYa2 znlWlGg#E;3kRuFoic^FgHp>MB>x!0>V-OwUeJ?)(%u!z#3fK9mo>oDOcjsuQB@ z>4mX81HH3>sNs-7YPdjoF1(b{wY3C_y`Ba1EJCR~5L7h4@jU$XL%gan?kCwQsB9JP zrSZ4)NIrM|+#2wxT9PkcT~WXRhn2Tn&ooOGb&D_!N$7fBoHZ#B%Ftd~*%Pyi1nC_@ zQf1E<=;iY|1B)G`^8$=O@Ay)hEc zs@CKXb*ZOwr>}*Hdpjmu72KPLNbA6 zMU_?n%@s%~rZ+-;)d4Sl_w{`uH2vCP8UvX zW}hu~-tdA&n9&M{9*V;VMYn-p0snC8G{!cC3^$O3<;mr-BAiq;UeJ5LS)yDG?@3bo@`HHnJ;52_q+`Ku@*&U7@zmFY-WSiUjhjH{{xw7Gz-N z*!V#ChAQ4p*nU!0kBQ=i(4ty(u9Gk*Ucfm!)M;gDRIZ__ zX)G9!&Md(YsICd55gL<>yA(Y$aa|zUPmn8XS)4V6zdpc)ODw`5Ypbpn#V9J}&)cD$ zFY!nTa-d@?+Z$H{!kF`cQZyk&@C@P<0UeG#0iwtu9xJNI)1l79)-Bh9 zBLJ_DL)Lz|rM%IQkJF`BAtxh0XTVcI;g&0)QVb6R-VO?}TA888 zgKY|}Am9~hJxc2_!c51EUb|P~z9ER8ydb|x3$n1pZufXuT{U>zo5Dh3$)d^&Ef{HPP4EX0z zAf*#X>>LgM*$uA5XhYKo4Da)4(G!{l_(CB@D}ee6Bo8CRkMm@(39{L#-Qu~pBKvmr z3JTX=5rBe&BWl2x18n>_YjOzezk1+h7_cc8&4)XuCvYbe2=U@L=6h8sAg+94pcC4AlPGkk9m*GDxCUt@cSkl8f0~J4zeCGt^1^*`=2% zV%b+4vf>8A1t-1X&khTYPuCo6{}1R@?x>3u#07mPY-!BR0fDBYMAH*}|^mMDe3oQ5+}i%TCxMy+aV+VPU&< z-AoJD^?A6~INY)seqs|llbw7R58_;^Jb`8Op{39olw!d_W(cxj@TBcr?VK#P8+JkW2@b>$r1c#ECG#_vG|(A*bvN>y zBnjmUQBKi>LTpxG23ThXJhU6ce|)ivuTAU*;dS$6!wxT~&zsL^#Hn@E9rz=nH?Dy0!)?J~BP}v5dYz zs1MaUT!Jqn(h;tp%F8)W64t(6EA2XRb;0=;uuR6Y1T#dvq=Kx#G=X!#k()>D!1ER@ zWH-$Sa+TLziT}|(8qqM1#PW+GmSO6bi78JG6T?haGr-@lwdgNm(_0XuQ%@)oAQ5dt z;z}pl&d`ip5d4n`5IE@~yA|96L~N zU=F1=<%ZZ?$8SB^h5>uDJV!@YcvItcz`8%hA`OVr*y;r*qjd3^d@}&=63lqx@`DC& z41aoP3Q;R3!YSwL((4>8$bLCh>tV*g99lsa?gagk!_O=y07JgE(Ne#N-7Ri>?z@3<9W~}gjus!P#Jj44!sS{o z$hh&tkh0xF-4wk1*NxB}ru-{=ps*WsHCQ4Cv7T}@+)3VYxX_jSCw0QjQ~_29bGD<5qJ$NVn`~TxRztyNOY9b zp~t6_uA(Hf@X@S`NH^UuhKhg-;>ySdxRhuadG@g#3ELj?*aU=y5h zj0Ek>U0VoR+Vvbx~V z%7N|=f>mmqr^)}CfDmRAMU==h$L7lL)uz~^w$N7-+-uXlcrkS_;5fI~A2QA}C8}5R z;KZXY=ewCVOz&)AhW}g>Bruv7X0KFYJF?u5a}0c!ZEW2cDT>W?zztRm8Whb8UU zIVGQxC+X4QDLy=Vg>Z-+ZIXYhE)bdysS(8Xzlw#x2<7j=gtG>yWDJ8HeV6*{Wj?W^}$3GvH0c$euMaU#XEfBtiq{*(0oQJOsBz1tG?w<+FeeGNM{lU>RG`0-h8Viq)C(oWRHuK4K)93QY!nsodmwpT0}%TlmiII0nT(An8p z8GbRy6`MK)(1jJ@k}s}W3RfY?e9E*Sa}G6(Gr<_mQ&ea{=`c9qDz-mFISPI#=V^tH z(+K?riJ;}#BbnULJrXLxmJVc&jpGC!b92xNH3dV~4o#-H=MS9WJXF8ym)h_1^H*I)yucL^_bymgt}^9GI|-F#(Gh zz1e>89d~Gi)BCH53Dgo;Xw5jE}g7f;q8rW$G9 zMWtAO27spm?tKBYt}Ycp_~oup;ID^Z!(m|G2={>+m@>lmUoI8`ZE@g`QI<4-tYB3r zu7^5(qo_`{pYb@e-AtS@GG!y*wa0Ik>-`{~l@@axBjs8{#)#iWL`>u|giMst z+J@aT3kX2)4qbpKzTiAnJ&|SlVwg4>!42+6o z>wo3*JwAl|$0z>&9ihY9%dbWt!w0}zsx0?0y&6kv|qXF5rKbH6DE+hvWJ4n|-rr(btPaa+fArqRO zHGa7U!GO`5Hvwg`khDf3FPaNjB`|y|h$1ipMFMNo9mjeyQTSdFZonqWp+%1y$8Zoq z;6L{4RLyDWyMJ$GtEnSwLzF za3cu$`_S zLVkQq&__QY-8jTzE0hOp5jr;x%Rw7vp0!MT2Jwi%2TDG~a>$2o!8gy4gsS0zO~F6{2cQVOr~yE5!23Ui5}L!r3>+VygZ~40+7+(%?+HLK zBf4dQA(my)mB&}0p0Mlxl%V^1OSCZZ_#BdLa}SreT6lniI}Y^%=>+9tlORN4Uy;D@ z0sKGwJIdp|$B~es|1+GlRw8LQu(m^r=nU`6esSd)0Zh6@Hei~LPs#ztO*ruVPGeD8 z+rBI%r!)QWMZ+IR*YYtO=g8z{Hv;L-EKCM^{u@U|Alp!Bh4kCOw zhIn@aR^v%mzy+yrvPxLSG15jfd(j;!T`d@o)Qa}ktLaK!UYu~i`r;N~K zFNhOV7dlj$rH!3WZ%y$ne_h)|uir@DGc1+dyLJK@uVNa?e6vvRK3C9WYgTW^KtK-T zmz64urJ{qV%kkZSa^m`uKxkpRVQKlaj%k4D!cwgcljpaqp51{6|8Pgg%9%-xJ%tA^i{{m{d7qBqg5oDiBW!t`H4WhgZMDJk zh)&f4@afyD!T>2tOQ|xMe4o&Re|#J0`YUJtrkc<7i2meb|POuv!Q2d77N%$6Bg2TKs5 zvb=o1vTQf%>C{qP4EAJU6|hVNlFS8L5`5>5V1vUO5Jt?0btEdKM){lENDVG0r6pds zUN;BPR2!i%@@APVAV&N=K)}B1v}OEa`oe~hEo0@fz@7`rH6oHl*!!@v6{s@h_4KAr-4+7`C-Sh8KetvX<|ChF7hDMu_1CIyLu-pY1h43_b zNhu%ie~W_*W{#w=b3U>V$Na{+>UOaY9yDM)?k9-(EEH4?Cu=;#d5SqW-FuR?{`17cYdaO z_Zz5mJpNe*>;!qe&xHBKg}uwVM74R4vhQJbl7J}l$c?;|P{Jd6)2HVf&JwyBcJ28D z({lt4CcNiTTvXn^@H91z8i?OitZ14W@L)Py`e}7P@a(kS8ReGuLJm|ko4*;14hlcm zmOSP6Dy(rIZ&WI0aFsTD<0(F9XJykA9vJ$UW8c&VpAg<0I{jvE?ydLzuBj)x^P$oH z?HT@Nl^aX-M=F4gW6;`SV}m}0_N>5%>fpDVZ?Cl{P6rADR>B(UIxOVE9S?#=y}M-U zx=#HoBc?%Oqh*UFcs4hb6IaK zrxef9a@8IOWVy|l< zG`uZnzAYS$YBrV;=s9(&NFQaNZKHE-lenL0EH%n&?fF}CZ%?%)=6vL!b}95<5i2XT zCI3d=lpt~kF)edyVw_H6N?>Bh#+hO$%-!wJ(%SWPo9NtZ{cdSWruoca*6C4?=xDZVaqqkG zmdkq+lgp`;lxxcdLG>m)RpjSwNCPx`9fzj5L`r_{u>wYkv%la$VkR>)Lv@*^Ec-Gi zWe-p=jvYeWB~-%Qy-n|WiTkWAF->(cZ7KquNQCUZCrTMIxYX2D!t-(IxySVJR{Z-m zBIJ?<$h-EvOL}^91Z^Mz($%6_)+LrIagywjAHZX=P@ZvBD${#f^wt3#tZGtQGybr<+0+KPh+9E~Ca?qC5cBwHk zH)?*0+I)LjMh7#Te<4u2`p}fJOXc~DTar#i4s|_?D_OZoKwy6VWsF_rq;2onc*hdT zHhit;uCuE>$!6d#Pw99LBjV4w#YX%?cGi~ouCQv_E__z^?7FKW|M!*INyx!wbkF|YW0vn<;9)zrL6sIOQ9^R_{WpF9 zC4_vt@6YDRK5>eU?Uv1rKdpH-n~f9eGlN6&4tTZ4Kk#!EAW=PBEk zM%ZfWD?HD3dir-)swZE(+43P<=sK7PkaBIhdS5rZG<=-Gxw|C)ypno(bGLrfW3h@a zbgX1rE39{~`Z%W)?LQc}o8N=bI5_F~BgYvuS-h_Ed3qOd=*==i<=PM^_0#D-qBN6X zWS30J;(!jgiO6vsQR$V$McK5|NphC{TSB~XTix~87|GR~Ioyd~x>lA#_Ay9(=7}K- z&A4%bs`$INsW{tM&4{u;7amQhqNYAwIG@gAk($>VYV=))5?ymcjdQ}|9SPL-F7UX0f6q`UG)cqT5RX;m2x2n-z%Cd)C^Uj&_NE7H6d zZ9|$1Z@qIHCCshOIaU=Q{4}hqSKg6xUKJ+UCTi<&-N)z}k9XnwSn%({Q3%8TzUki> z7;shkBrDA&GMS>wbhntQ%Ojd*Rp0uWT=(2-vcH=$)K72{&JsBYUv=N?AH{LCo*u*M z^?ws~wVD6UB8Srw|tCOdI*WgZLA?1}z4u$Hv-?zYT3HPAVE}G=?%qcg{S~?S{ zHKB`r88Rf>oXpdHYGa)T-bG^gm%OYptree(NjOazb9Vd>x09uOg@_vo)J zv&Kx%hNBcxee%0lw|8j8Vr9NmtA*G9)C<4pHU|IVh&%Rw@#xoYbV2xIrJnTXSvCXX z`PHC+;M*$pX`qT1Qhyvhp2F`X8wt|fS@br0Nqj5g>AA3j9b`YjamlK0tZ&l)7gCy; zNpX}jfloNa24MvD{wjsy7bH)P_O@K}^Ws1FsL~o3{?f71n`D<(UWCSu(?Y3S`p^4n z)n~=_p#4j|BjV?5k3kMSMQr&YcVE03Y3$Jdvdj6=U+>#a7fM=L{I*>Q+xSCPv0tQY zDib;g$<`YwpPzuW{J!f;mOpu=r7N$TNb%9Dk+Afk@xwx}z`(?U?yu*H!l^fYDsPPl zvC;cK0JcC$zb@j9OWlePQgNu$O}lPRw9ZMYIOilxbh!_^$j2!K z33VWMUt=1`y@&};((36LV^=#C_1e8?8y|kSmD-~i2)4U zkr88h=fQ94MOf@VCQIH<3LKrdGZV5$dbXLyP2p9@w*G!($S6|Am5wB~j zuhcusvO*#55%yqWpbsZxG~^N@Nl70?q@_|)Fi5!=*YHjGXGL`u83ICt!uN;ZNHl3nXzuR_XCi6e{RG-Vt(X#<-#Sn6AJcu`#z2cxRT zZpR77wUth(cjB?Wk0;FJIGD0q;{czf9RtfHH03cN*l{2R&a^W%e8vIoz$l&9;5_Bv zrr*dFiq>w9t|AFnG0rrSDnmdTw?qq!N>5_2*{c!{K z+bJ#6@8A@p`yG=0hCWU^@wmYTFlwhOcq!XbF#b@FJakl z1Q+=Iw`I)Ff6N2~|K+UzY5M(tAwR$WWhOAee?GciLLOrM_hG(|_@A@w1v8hk3c0*( z7wrYZwDR-wzq5fw;1b|M>yv29{ZcT>MhFPn>xsUL3r%>AKRRgf78g%fB!WT$hxSPb=-*f zTGmG{hRT5{DHjTc77!RSax)^p0ERB8W7>2v?I!dwZEC$1WK*PH>59$aO#zpGu{wW= zc|7j-KUVP}`8Q2_F8{LtZt^V;mW}0PWo3D=YzoKCCJt`85cwp~C0ZUVTMq@%AzdCU z+hc#|`Z{#|<-u}JdP3Jvh#4C$50>-GI#(degXO}ALifVu!E$lg3w0my$faeyE5FLi zdcT8^$4jQl+44vj@}x{zR^5kKgj>sEoi0FqUMkaG=3jaoJ3MtWx6HqEABtM$mwg!M z-1z0L!ZQET)oLF1DK6_Ub}`}KrDa{{MgCpp#fKh=dBa&ri5SnpGM9BqJ1+mUmUSG2 zlE_}xq4>xzL#8tr@(e6ld%cHU#51vq(j6e?q8|4sE$b12ZWs}Vx3RIT)3X@!)NONF zeCmUiXnuQn(4u;`#|voZmb*P)Z$lr6u>7)4JJ2P4&Js&hgnyQdWxe0;XI#i2cUsGO zOq={GzpVE{5~?;Wm3aV)M1vZ}vPf4CM14(Ovw*a)C$h2(UPRxgqAiT_viR2Jb|?4B z<(GBXjIk%`z^P;AbK;y)Sk^-vv^l@aWuBN_kUW``afTo-~Tcb;IirQ4loy}w^tNZxOis;{da#ZU4v0&)5HF0SW&va|Q5m^M9lG zko}i4=j(qnfknCct-64&FE7&}<*sFUPKAUhh#a6iUoTjk=~-Ux!|4DQwP5TqU0(zZ z#6TPZ2pkfJ9s;BV#A(s1RA+2xE-y!jhOi%~1Vk9HOF6>;Je(6*k0G)+k^LAVn-k?8 zLzLr0`Nt6DIZ@#;L3&;sZhwF@2G-VZ(TILYZwKLV;=KEyDmk zW*UZQPZqaYfDzyl&?1pY)XubU&_)rU(2E(;mzNzDdC+4n@|Lsd16WfDG*OF02*^Mj zv^k?YF>}eNG)YHLzHgK5k>B+ogrCw&eE|Bg^Z!C&>i!4QH0JxiGl4tEbBK?)8dwoO z`~=%LhzG!4GE4dviUQ<;S0b*oU;tk6!L?Vs>vP%v-2+_yJ<^T{gA85LB;c*v|CUvl z|Ne6(FwKAQtG_3l$K&+BWlsP8)3$Q+-+#^ovOO5_4j>u70`3Mka zo;4Jx^z@I;N0qMtaIPgk61uE4pbO}KqiD|c|14mN|IovbBD&;|p!LM^c#QtH4RiYZ zN6ya8?|+*KEP@ruay|oK$n${wY3ry{0P))g;1f6YBvnk2t}lY4z#+bm0wz`-0>t_x z>VhyLj5x%jU`S%%lHe)>eHbv{5$Ga!SziRAkMRhZu$3_ZX|*(sCx-{qfmRY&tM_u# zfp!wO;zNew2pm8c6R>i!WaX!6bK`_gro-|{*xFhhWC09A4>9O8TX{0Jvcqnw#CI@?sD#%V{$P)zh?fOH}Mp>>nBnm*)Apv5#E{U8Dj50nv zB~ivSGG;Na!FJe&5qo5~Wf&TZgNMUPrq*Pv_ozrEEeyj4Z4{sgJBmP@7YxHtdqfyx z!;I%*>SSyY3dK*lro+sf2;^am4OMU$h8c(WVT35nSfxP*?zyj)D_cWEbcqIu2S>}2{VHhiZX2!WDJeFd4(Se zwq;NY(~kAXxaLEV9UOL0l(96;MRd~7*0gj=$~UKJO^@_>$Yel4)3A%+q-RmnD2l>D zYtp-$RM8SBSXfy77}Tu9cYR_nM9@*c^d_7 zv5*51&ER~gz`vV>PzFL2wMgWPv-~mzh{XR<{JHV{_Jk?>ujxUj>tV{Cqy_jG`!8qO z#Tp9muY_post_!T~7p5g@FCBH%{2ha%9&o(GyZZ~;!y#B&S^_T04e~d^07nk-9|->kPV**k{T2e(mX?;TgANQ_4*?2& z1YFd^4x;)LBc1Y|A7D%fbph4(i2QzP&N=C#Nh4mPU0>}_3nRZz< zk!o1!<-o}0h9+_W>tG6Kh#cI)j-utPV;vH=J4;KvD~$8tv7L}-Qsw*)5Cep_f2~@r znszy-dfXBKwSbo&_%Ij(M@~q1PNJvqTIh?Q-$7#UG(uM??<$COL>iJ0yu(sH9l3TI zQwCr#&V(Bn*V8qZ5qYr=c_ymcJ22+?iXzkkhCJYlUfU$1`iuZ4g0v%=SniZAr4q%Z z!63sNB2z^`T8ThBqay19DY$|LA&M}cHbL*oP0);`9BB)fWM733eiP34nDH0biO4B=mSs zL_;7Nu^A!QRf(&tIETk&qk)@&4C6tV5t&Z~Vcv?Rfidmh!?0ux1}Y9`ElST7V=4*( zLWlP>*hSG){LrCcy655^N|?w9*o$yL90Km(2ziK7P~rSb7rR3!gW*FS4;;!W`Z>I+N<|9&LyRFE2Me)I=j|dg<>&Si*-zzPYpm@87e``j7$(P7 zxWx8_Vi8>dc3k|3d^;`2k3EJby+UWoLtH>Lk!z(0oG=Eh2%Rm7J`bG`XPhwRKFP3{ zR$C9m9Y7TJP^70@PhK%7~T zd9e9<*Lg!O`81o6M+Iosw94gjx)b1FC=2(X88b%a2SIiYqdcZokD zuAK)FbLJZ2semc@@A^-8?`Ppn{r-RY{tr8E&F}x82`mB>KyDRqQ=B5ElaOH&P-Vj= z-nYzA04|&PM|cM$?jabbLcY>fo5Py`CI5Urd1-k({`a2`{r+n{{?7p=*eE@Cykic=v-LfRf$V6mB9}Y*`VX$(>noKih(quZ(2h_DGH2ilc)rztnD`RMS!_}@TJs|fR0XYPjoBL!t!voix`T093ar|K&CH( zka*Y`@}L&+Jknp%7eQ66#*0;Y5fjUDMM(bW*hTJ=F7B;e7U2}Q0e!p5@NWmW{F9Jf z-sPVcvj2=iZa)8;2?+kvOoTiH=_OqP_t^V?in*!#-z>wNpZ}Q&?5^xoZ(T`W{dPsK zt=&?)rpMKTMs08RL2d1py=0b_3VQvZdU$yE!Nbu&k5gRHH}`g`4~`DDZ(T|Da;LX( zujs2s8xIbu^}U0`Ny@kMBZMn+b^ioFJbfnKw!XYP9wYyjWlf*|Fs=Oj{+F4+==~r0 zj?Hpb{^fH*NIRnkfy`z8l@)&`USdzZ3}h`UhoG3ElP?0<%eiI#C2k!P9}`644WOKO z1xS+6kPt8Hh3*s~9R`kgNXS?gpDM@k!_djywS(mXr}*F>?@vqRjvr1^ZzrY8 zFWnRLqZg7ab6Jw|hT*1dfdFOD8);{SIK>yldB#QQH(zyF=D|IGx@KJ3xede%&CQ)|X_ z*dzl0X-CH`@G{5*;K~cDD~-(uY762D$Pn(e`e4HI{A&&< zxcbQ4&S^(S-Z=StubxUq0=4R4OMTLI`SyewPkSSg%5A; zH4b-IcB;#_UbvP#sC@mSS5$)I@E2cP`qqywzfixkc2(D223KCVhFy?}uU`Qfbf!+T z@U(ATdEvwLhWXJ&a0PtiBWa&kUI1707S><4r9=`hEAK1dn{RX1*Wp5h9)KDrtq z$%bp34*_97kqY1IH|6b#l*ExEclEh<H#DGf&^U4c-NNzB{zW&y9i(=UMC~0Ga^~ysfdFCD4=m9@`Frc_TpS{&Oav#_Y=G%0Z)gcxb?z^IadY3 z%Gyr#N$2s{^Pk0O`M2`Lx%|%r#Qn!Ej*!DhG)%4xRyRHXX-*}Ve#`qr;|K?BWiVy> z*hM-DdN?A1cngLE;udatRmP=Dy1p*XXO8Y?;6@M{FceTs0?-n73*$gqbmM}+2m#cC zUJMy>L360Dk~j)bCUuXg%m7^Ta2N5JgR(-UrGH)C7M;911}T8Lv@k`qrMX^`Fe(2I z@ksO_jEEnyCE8hXF@;SJ{Wi}AJx=}$#p(OM3i+UkCaVubvXa>RHrw>C>e>T3^qa)Hb#?KonukwOSrb$* zT;&tAH#7Uc^5TbIkV(Dx(HDL2GIz?-zWC7>|8Oes{tGH~kS4jJN+Xhb%7%Qw58NRN6L9wYw+)0}?)!{Whn z`JVwSikA+=!wlDI_3PvJ+w?_!5gdiC7=OicAE_6xFbtqPnoB8ei;x=|*G{U(a! zbx`5~1${ADZ{d1l7xh!m#L1^X5P+_WTy8!@=qyH*0o;-g5s1eznnDA$TG+wr0Rx${ zunj`Z2sJY$mFT$SXdp2_>GROC;*FKK*ejb zBp6k0R0`A%wUSnqW#u+wgh>P*E^Is0%34j5!GMS09%M*1TRO_M3Z@RZu7`1`nU+>R z5>e_a2Ne(p;$DB~0eK(hIQiHOHM6K4tqEd2{EcfgBI@wwH?&RJ{2f9W@JWDqFAUma zvOz#I*bOzy(oS|8nVL-V1Vv;3b{n9!R@WmQT+|L^(3J>zSPYvx*8rzFF|oMx4^ zT4OJBSkDRGH}=3GZ&$e*pY%q@gOq}t=wxLhe_wYUC)8|PTdPQ3tR|(rE^QHT%o(+bpo=15=ZL2nMU++q+aQ;dG1ep4))oOrV#4!K3^xk3TwbfK9gHP0 zvqpSApGvYB)jOiSP|FpxgT}F-K0p*jJ$Y;1h^QSQEmzbw4yv4FLtd~qN~<~&NlXGA z(NN2C9o48-GSvoeLO}o;$cZD&hM*3I9)Yf4rj;`a_jTCO@}`QivZ*bCm6%&Y3_G$Q zs){Otbzi4l9BTQZ*4UD|kYm|YTyKGVNj8aUHQC|m@`sONcUh#rvqeCLb zhnPBK9k7lg$|kfJC%&%td=_dYQ#;;~o&1<<2gc3Zhr1!d?I_erC9PW9kZi989T+&s zmHg*AXqxvUWkh&EOJ!}ZQD0X|Y%fH?Ba2zvsOxaBWaYK8t%;{j#e<*XO;GV{4b^do zL#@nvt7J~Cp5b$E9As+s$<8wFVTg~?JX%q!9&T0-WX$Brrq_+ndxUKlOZRm-T9iwg z94oX%a2GMK63AD-CI*htKxgI5`}(3*E^E_z8wE}@ltUtQI><+Qh<(j8Y^`3~5gI#b z!&=~?5Ctxm#GTmVU6yjK;1E838oVP`_SBGAA9ekTdirys4SG=&YNlyv#|M&y$2j5> z7r{6bfdk~mfeQm?thPiw^2KuLzV2C!$Iffpmh3LuaEKys*eBpnJO??!dLc@Mf_Y!Z z6jRN#a$2oXYe?;#sWsFiS@m8{rw&ipwzNh?Cfr~Vl1f_W#KZImI;u>|(M;Rc)+;>5 zI&MY?R60;ROX-s)_Anb}I#SF`I}dgeKP7sLBcF-)IfdCGm|iUA@AHAt!whMrUErhR zHviTZ!O>bh!@nhE$tvB~{m`Qs9At0^OuMM<)VCWM(V?_OFm}lC#jx!Ax(@@yG}A7L zzOl2iTRj|Aj>=}w@n-K}-Z*7#Q})Dtpk-62Y zCsw6UdCj3PcjYhn;hPF>k+LdHU_j}9w!Zmq80?ALWDRSJ0e|ar_ z)1Bp0m!(rm0{zWUJH+?n0JEWt@|CXO9NrL={KpYuYn7 zK#7NR#)c;UWAQ&W|C8f?^88PM|0(i6CH|)@hz;@A)H^*#d^Y4?k;uxG?Xh$VYMZxFOJ=rG>{OCmq9M?@la!Tq7p)K_1e*dG$xJ>swl0uh2O?fgvyi!x0Hw^*2QA%mJ_h#Xoh z)HKVK-&B5!Xe}DLI;9;=v#fFZH5!}X0QrO=uq{scjMjb_@&d#(&5|{vzDPJPqxukg zx~!?KD#Nf(#q|zje_7m-f4@U8)wG-~BLvvtompqlfe!aCkBcSCB37lw%f5#zm6b~4 zdOCvOrr09Tw7flzueJ?#p^wz16KOIYt4Rn8siqZ*W2d8Og_3YG(ToL|L7Rjf6lq$~ z7-ulvClrBt3kPjMBPt>6eN8K=2>pIvEQoQLxr1GF2Q|Uw;bC3xqNs@?LbXy!QYIdG z(2bgTkT^3GIocxFQclpzPec{%{N|&I-7gA5%`{X`5H4*IgfJ3vS!?XARdwh@nE?4v zGmV_2bFo8w(Z0Bi8T3HShwUZsEucbte+k%zp@$^2xs<4?ha}9{V&!?SKH5>Tbs7f| zZ*DUYCoaQ23_}!Yi{PMM0l6guj6EkJi0Y=oV9Yu^MDZU^Zo)7a0`dB~9t4~zW+G-0 zf^LBN6vW(r5gawDyVXOkK_9gvC*xYS%$?UL(f^0oN2wiw(C2Mw+DcM9;$&#l6OC4> z0u;C*!2tsiqQr~E5@3K>6BC*VsAeWoBQmHSuGaP%<6ev%G$MA}zGm8`hp9)Kh0`%8 z4K&kE30V?@sug{uLUruJ(9$$B5mfBU-XV8ne6Rzt2UZ*hQ3~q75(7j|r-9GwT}UbC zhPdI9Hx$@u`z*DtJfh|D#a$T|@eWx~9g=$qpGD4!Q0`7Oc6aJi#8OEsV%_m^nDJqt znT3=ts5SP0&$Cy11K?U^XYcU(BsDLG@PKU;FwHE89zX5HskrJp<2qc)gtjOe1VwUB zUJOR!+80sgd%g(M2d>YF&0@meMQ{SvFbzF8RHqE0iA`hCPR+K6lj7MbiCh$c4Ye;n zZc#ZfmQ$p>xxi6?2Ws(Ij)`Ydj~gk%{TMr4$<>GZ{kdJv8+;T=bQ$D2d=c#OX1!;Z zm-2?#VQ)f;bQ}&iX-Y_H^%J#eW#{heAqz98$6M2uqnYqgFP~|)Wk^5R=Uq|L>|B0a z$~uZ#U?qUwkYdVpX}5_2r=y=Iw1qM4J=BaKP{U3XI+oHFnq83kdD?GO-U@MHTJJc- zg{+ZFH_T zk+*~|<9I@ZdXYyQP0LxuR0j~*gKZ*+l_3av7II# z)tZlDSzD(;81j(Zqhwzw$vSLL?BDy?i3lYvmT{?;OY?ar2?4vXi(F8ttvB?pylPL= za!N2KJVXn`O|_XvwOm1^N4eDk_#X=5$OVg_F(MmPPHqp`X70XDVT);6u2dW`Lsesi z4g;qXk$}V$tYZ(2Bt^#*cDXjo8%Da@H>wrTMML0^PY^|n+hh6sSaBR6=*jV8YIAaY z&S4Zsn3HGRVlh%YPTF@rM)CM~xejS76LF1GNJgwhu+mshOug~3CZW6^%Js}YEpLheLT}<$OS(km9O6^RoLov=kT|84 zDUQ@=THaDUCz2cH0=c|<)arVh+pW9{*rjokZtNaWhC<*bjml?u%~RwsIuU_q630AN zKBx3Ice>&{R_ug8UOcFGla@=X0%)oUk6M64Oj_*Dcg?1FZ z+i}8PA>(+MYyQ0Aw(^xaQp@LL3&B>%<&r0x&!uX-vR+pLTd4~}j%r#y8Re<8>=wc9 z?x7;%3Tvzqw0tS87son4Y@Fwe@_nICxp3L(p1Zb^N-jkqrU*FT^M!m$b#brpVLTGC z6p_$T*mL+aq99dRVxdFV*NW-c&&XJRwJYBKRPDH^<}ewml_n-TyNyX@RxIU9_a})* znrTG5Hd1{?Id@-=xQ5fTQqfMPkyOqr%cWGw)>G{ZuJQ2ef>hJWWjQ>`X`}E+O*0RL z@3<|wNhxU3cG^z5wfQ_kP^3+Oy?VwTlW={p9uXhB`szxuW4|jG6Ruue=D{Bl+x-Wq zjVVJBazR}zjU=aC6{|eCcELJmyx<{T@aMB^`N}F!%7FoB$}<3*oJ1}TU^J8m8^eh3 z@flG-go9h)6mX>#vq^fMRPs{*{yi>IdXeR@QU@>R@;6PRa33%N_)J*@punYkipB-f zfu1PX=rjRUKfrci6b*q#f;M0%@;OCMp28vlT>@a8L?W>;jzU5aAT6Fw7?B=!#VDfm zF3&j*x&i42z=58JB6<_R(OQf6wUfi-0t^<7KPTjgnsi;Es6BV#FoRjuaDllA>W)2T`Qfz%UbKB8Y-Wbpp;GQL0DL zLkgg1EQ|saIO2yHtb=4>lHECdQK!V|QcW|BWQMOT0^!GNF&HL>Ul;c0G!!9mH~l&nU?eX~IL)k2!vZI;N516F_rpw;on@K%WIF;iD zkk&<3DHD0SFV}W@4+WfOR?Z$bD4)YQB#>itnjmSeW9}zZUK2XqY`^KqLticEAQ>S; z5sxx11am?_v5Np|wS*xyNtUD>yCI-0HbE=qlwy&{%GuT^MXue189Eu9q?G7QUI#^? zab%2SYQ`W94J?KvK0+#W*veA8SI{7@`AxlpVU6jI9z$|*lJvI6Y|oL(Ap8jYK3%~qPt$pY@^hZI!KE^CEUJ`!h|eQxn3%cZS+2A{1YFJ)@9P*2G%c4ejJ3J^ZNv(G2FsW ztt^PCg&Z|=rIcN9u)+gm$EH}UY!t?vX{g2GT7VgzIt@Rjmb0BO!#pZ{q+n0_aGHT1 zhNFq0r8cHcVY7*%#G4yB+zl$i4JzZavm$mffwWY&P_dQwD7F&URBWe(f;JA2mbVSL z(BZpW)bnNg9DfJ6C;2JNJ7aY?zV*68oB>J_TH@7QDsRN?APR1WLufFRkdti0RjZq>^=lD zh(Uk=fmvG_lb8oFh~d|_No%cKD|7E%Rj2nkb^GD)kSoLSh;T%N`{y1W#Nkyw{3v6u zGWMg4zsmTJGVv-CKg!2f`S^h`#-yr(--bu@jrfe({>%4|JAc6Pf)O9oe(ayr<9|@` z2g?h@Bys-o+uzsbhBW!@{`QUjZ^TE;a!8YZ{~*325$-iQz8i1UANt{0{pr`m&&v3Z z%5S8ft8y>*?*qU*E5A&_Z!ag|S^e|j)%7`Q&d(cA7=%gn?HfT*#E)@Ezk+DL+Xj{Q z(eT^!;yr$7xgW;POsZi0&Sb&({gDSh#!VOw-@YB+2L=?}hQn{Klfd34$m_;iBxX4L z_JM$&{GS-+gZlChUk3oZhdKMAJo#Pp^!RCqMZMRQqjg-__FhH>UUI`+6MKR}Y^WzJD`SKmE8r z7U*tm^9CdGDEW3oKBo9>c$?rqj#_x~X5-lX7F6Rm^21r3lknB-w}1KWy6&rsFFrri zO#AUU`VZgL>G`UDtbo0?pu9Ut zVf^O8e_eWMrsan@e>>HaOxfqkex*u&MhDfxoZ4BM9>Djb`O*HT&?zTIgNUoQ3miS>}m9-Uo3U z{#FgIl|=lDSIPEm7q-iHC1|XlkU<l6pzEsS5>(}PF3Q?3Yobq_L;PU#pZMylyZVC>`j`Lp_qyJ zsDj7qg9KfWzDc(wUAFeGv=J2fVnF>D{iC;cuBaNHT!%m6`Yo%!?lpU_k=4%%*sm3` z*U?2UO9SPv$M}XK=%;eYo2Y*~uC)3|+F|Nm_@RG%Bfsb(tG$i$b6nb8+6Qs+^GtrF z^t|fDVfqb0&>!&S&+ElWIHhUcq;I;y`Uq0LWjNm6W7_On0-~VV`!{tSe_45i{srpV z?)lc@ZwUNlsfU~5why4X&HLcDIQ(`zeq_2mDgPdaPmK2b?n2ZHFbu&kYe~O8ozx*P~_7keW!l^?YHkk@I=-5n0z1mASz#B%zBJ& z=_?`X6T=F95am@qd_TWF1d%j9P|WN5XCLo<8K3ADIUt_~;MONilzp%BCLfdP#WBBF zus>tjlCXcp#8BdkN!xzpeY{Nev-IuBf&9Yp7+0vzyZCkU6O24b&wJnh^~LsYPo5@y z<2rohYSN$i+M&C>v3&~sqW#1brtdv|n$;)icP$ZbT*OaJ5x?gPy8OlX=?Ur9ng0!( zrPuE0w^lyizGO+(&yC#P0t@(O13b9?{ArPorJjFntN7obY^{QiN}s4nT&v(&@y%iX z?Q=cnJ#Vu~=6{3gsmYsf-!SSubY1m*{N`Xcc?0!N2l(Y9e?oHe{B&P}SD5PKl{S5s zJe^$P^T*MGG;fEG*v`3{(!6>1yxJaWhA4PdIR0AU1=qg+_Fc0W07XI5y!gK0uovw^ zSG^JeUcn0j|1v7A7yakeR~$p}{|6d^CV3045cs>aPty12KTki=0vh+d`A8vu_VxNa z%4_!KeH1@^x-UZifl~)n3me@WuBzbo9E(b(4moD*7#)@+$uAP15fq^(AP>wDpr#ZjrPbf*91J5x_f`0G3 zVctBQ3l#gBtn?y&zvXfJ_3KSg@Jcd29=_y5f;fJC*TzbMKFU7f@E6uszU8ns5&G@h z0Vau0l^DGX^pSCuZ|`}$?b9{M`{->Tf-f$~|L)Bw|GfU&uh;&sEQs6rAJ@m*{;yy5 zec|Zm_dhY>*YCfh_&@i5{UkBoT7JnRb`?dbp#=jg``$>GALi<^~jXw!I zWbxNW`zqVpIk2DQ<@Qy!w?kaNbn`l_^|SorMAk1)_jA{;16IE@_&PfE3-{Z(sGo#? z-1~o<|4H=^`}pU7VgEOb{qFo9^q=4V{qMQ{<@+P3^7#9gZ(|S8`w=kEk7L09cT4%t z>mPN!=KoOrqmKT4U4Q%eFED{2|NQ>Xf5-Ll{-dNH|3{b9|A;-`51*fQ>d=cqPWlTq%(^Se;01J$D7c40}um(p1!v+A87sOL-tnMR!~l`W*SZ;4CN2;90b23$A|$z9^|n$dZ+Y8`+o@!W4I zemw)7);svrIx!mr%Qd{#MxwjO$UeLWw`!-8(6mHCfD)@<>pmR=jFtMVha^DGC*E>y zJ9gUAu5Mx;C@z-wI2_D|?ZfpRklh|jjw)k3M&oY6V>y$>oeXIfSN0Hmk{rrW<;dLj zrm1sy?k78)kwnmwd>^#Y9AKoNbKuSj?zAN3FWLa2LGSEdNp_&uUKUVYdI8X({0%h0VR1?E=|&APazHU-tHs4+Xgt_sgJ zAJIy!o?8)~s}*sqq zl^rj|VT+m)xuTFW-D&(1ss)Yh9~W?b>IczOX>cPs`T|&Bi2G-6&jzH~@Kibgymk^t z{e08b z+N1sa>pdG5NDu=00fY!ZM}y9uJteOeRp1-+`V>7d==v#%H$O#JL13`kvtbF){8Iw| zDXC~YAK~pr@DiN^3V3VCGHBuT2nK)w>j4#j1+W~@41fa81}6i&9`X4I2H@3a%hh`i z?X%?=&@*6Lpv>R_#0bPQeElBehBC)-EYMS9c~vxoA2aZG)*7M>z^180136kiw{P~g z)>xcj<4i3c?YZ?w=B&k?=7sU8f>8v;*_5_0eQ6ql?BWh$k1%Ia^$tDS9ojwo{$Be? ztdgpHMv6da_aM;B^X0^M4yjU0o)hU|$J{)|g2N-3+K{|5ozGqN%IG8adeJ-%_?E5N z9@XcY($%<4aY^;?gO=+J&Drk^u5p=7I@-B;V|O(K)IE2)s-`v)f^Z??V^*I8%AJoM zMm0gr=944AQ(W#rLtI33|< zduuCaJm^5aSi428h9)+Eya@8)WMsFdst0Inh_OM8SxV2e*zo24QDRKzc?UzXd*-ar z*_?DDsj>86^3|Rm=tj-y^rdpI>nL@zV2qDs$UytprzAorAdRIXn z_x0@eotVmEv)Wj{Yq=7!5`$ zJfE4(x>M#Y9S>7}Mp{&ay0haNOW-SKt8{t;o&@f&MzWXEQ(6%s>3WBbyM-nTkB-K9 z_Z;(%&`zXCjFwt>nH3&dR z>^0zkJ##F9AEIkAc}jsg;aRH#dz_Gmj|1JC=`obenfRbU0## zX4?sqE`wtwC_6onX?tEy8+V%;gRY=cG^yKL;r+S4iE(5(7!M(i`Ux zxpdXzei~IfDb6-s@G+U<-tuB~9PABP2zLj$myCs>4UQS*%dQ zt)PcayJt?sv2xWDe7uuKvDhntUyly6Yj}-OccNH#%k9=&M!l{gk3T|liHp_!ipH&5 zoTPo13IuHv&Uig$(k@bP?e0z1ZHHCENu`f^nDYfmEJJk2ks0d%J3z$05(`pKf{Yy( z=g!<*Ylj-W_aMC0@s%J&4$=Lp9=B?Xk{C|5$2G-ICGcvGKymb9kMyxaA>UdD2cswo zBsPL^OjV%;4L43Q($}5&Xl&R=?mdkg!`Mbf(Rm7t2hkDkNzFCXWQ6RyB;&$PFtPSV ztZ8%g)U=;3a>xfk4u=RxRT==HNIi82S8^)$^jauPlvr) zTplb7H9TL{_?)+Gt7bQCJGrB_PsRLhECmQj&L`Zs=JymZ&%{yga>5IDW35-XX3YXxJ88k4mf5shVEjbzbmP zNO3gSLG1(yl~}^KW9NE>j7D;?;}7@ptoaTn9Ub1=PaeLDMlm}X4tWiZolcZGY2KjY zQQE4E^G33&9$AsK#3kBg1r8tQOTATurt}x%_8`=@y^rf8Flf!{%2CU6Oo>jY2FaZ= zi4U7T&ApFwNf=H{E0{AOd4npJ%m{Y3*l&)=WC0EAa(Cy+Ji<0<3+NcZiyFH5coUI& zaC#(tPH+UTlkkI=^xV$_nqxTeit~Z5UAO6>?|7QLEXzc5dbo?dqqGzqM6^fqVh0*| zd6dC$Cw8lTsP}gtSXJQi?TGCgJ2bGmkN8Pb=5+^VepkB%x($bPRXPY6msQ;(F_|+| zT+9WU7l)ns=w0{X9C&KI3c)f;`u-^TOEmF!4ROhyMx7C@GP2aoSPxQoZcE6#b5c)*foaw*!mF{1 znK-Gk2XnVm3epz(4pF`Cus72S29q_)F%F1tn0p_plP7r(Xqw15-kCPm=UnaN;GXG< zed*5DIZ(!4{a=52_tSt1iVX$DM zu|EhTai$8$k2sHHmbm6Hh-JX=!WKY%Gp~b6+gcSp9ZEBuA^sJ%GBXxXuHl%xy&|Ss zq^nkdS>xJ8VZr?)*d)O`EAg+8SNhR7WWaE0!;a;Y6?Z{o-d^d8X~<QWurRuIz=w z)QhyLEWp(*+Ek>yvKM3fph54%IbnYnky^NSSC$5?%5c7Zag5O}HBB|JnFVhFH;4re z>tE$6+Bi?8y;lRCF`u21w@pVK?Tdt|g*U6Lc~Y%;KD|ZiSeDUfW2G&~u&Y4&(z?WJ zyj}US$x)W+sL#g}9Y;Rf8;zdA)&Tlp4uF6w zyWO7i{FE&BhT#%@wCo$W#$^?>0>ivLI}KD8pe0ZRk5LU~f~-mH4ON4=+sWxouQ-&L zDolRdS!NQz=5fy!`GuS!(~QguZ8UOapzWg_y&CwiumA0c5jJ{J#R z!-FIDE0R=b1I(#syn?aM-xQ*OePQefRW}LKHv0*1e>a-t4OH)=`68CQZss%{U(H8U zS0&`RM(PW8YJBmRJ+yj+1!t?Y^fs#(RWWQ_kT{K&_@^J;E>Z!~cL~&sV82?u_^yUT zwVm3}#%gDkc=-_?jMRX+S`LU0vxvq*!~t(H)jEb=`#0| zjK#OoUOhmH#5MMA9d(CRf!D`8q%YE8f6+;J$fyccDvS!yE()8+1xe#B#$icLvZI@+ zhfca$$F<+1ZqPhN5kj4KCFeTp8=vD)B2sJvf1DdpCrs~b3)HB}a!aNf+(i!>bu4g- zr}ad&$FpHqy?=#7BxH4;?8D@;ogW_JYpp7t1kPG1#o9@OEF)tHv;Ao4x;k_ZGuGSu zIwae2BwScmpe;gM7VS?gPvA|NoJp-lnRN7gGukHWT*ga9t#CV)&3IN8`Y?F#BaoMT z(`jR;uO`$Xrs~X%6W3>+5bWewBlm5t<6X0ydlyK1C-B+D9ulGkcWlWDxE144NzS)R zJmkg(xyKx7;fvgh)Zt9S#ZfwS-K0o#IWznF64idGC<}Ay9_AkLVwiO**}R2wk8$Nv`3x9Xw4C8?vdSTViXbIn#?>@cY{hA4B3t~i zdE_ap?}iuaU4$!Y)5IlL?LWZ3x6#?}qPp^OgN3DlT4Z-wJKbYWsG1S>a8EGu5!$UJ@0S|nV<9D#!f&*;0Ui3Ct?;}*vnzjy=by^AsS+rpeRFHi^?d&^)v3UIFP-GQrtj6?Y#)J#CXh>MI{!c zON?~fn{7Ir3|$e~F=lrdhueZ36>YYLC#d7cJD&^I;i{!g2E0SD(!`W{^I?_Ab~MgC zY+{+s-dUegXMV8g>ou1dpH{Cbp59>Sakh-3dCrOU!4`zNu_V`BXiY~m$BnMqnpP}Y z7aH02LMs#|>^qwdCsS|lK#*$19n#CDlnW-r&GmFYm5$m5ewnt0gm@Nq4)u$EIzGlp zD;t&eb1Fag@+!kNdbAN2!xJCcZ!L1ZJGNEHzJ;>k@quI9l{y`06ZaIq_rW>jy>r&~ zM^wUNg9PQK-Q%UouiIqH6ohW+Ug7hB;FOFVi;E7=Q##eGQV$CnBVtxkV}*0mWhb@K z#dhJFyzO(lr{Spd)|&+F&Y>UdXG?WFY34Pi$2UVg97*~C789s8=@fUeZne89tm*N{ z3q2_kRTH&XiX8C;h16ov=v>kHMGQ_WIXOe>rXo6PuPR%j+828a<~cE34ffoni`EzJXnhxlpD-g9sz;d9R)|tC z^u!kLxP4LCa#ag%Q448St0!((=U-?)iT{)y`YYl;rHB5C_)qCyUX@h*s+73*AOi`W z_nGwc3OICR$aPj-D*C<>RCl&d+5@sL(~YTmc`j3o8KkJCvwa!5;$(yU!9-ed&RN8Q zll;VD1rnS?zhue|xQIhaq10R zBOa^-XMk|)axSK9ZdBlnf=;JHn&07keY?Ol_7r2d+2n=F=)`uTDGs@TYkXn@ zI8&F?bW8az)cb?nt0F#+fOuUWLj7`)TtZZH^O31cNVf8DOM_Sx=S$yiwMBP3A3p9cL`fM9-R!D1 zO3uO+ZI`r6G0%W-#Ms^04wbnbEk)OYofWLaO;J)FI|Ljrfzrf_c<0hdyEtMKqxfc# zX%Z@ZK%OU*hr)!cxZCL}lyXMF_bVYy3kPn5?+I&LG-qnt_QLrgkj`Ck6N%}?$$~k| zz91D(rAq>x_}xsf6u*(XM~&`}nWi1w&Uy5*#WfQ_&fNWMb!W_E#9XzV%;qoy)m7xi z&HkuiJoF$`p&@f*ON<+`L;`!gJ27u-0o{`vJ?6fQjF{}EGj52^4BL1Q^Sfhy!^fS1 z4PgV_x)8NV7ic_a-7~Okk-Mr&Unhc2Qp#zp*J<5P9A5AQ!K{pZXeM?#?+d3z4_s0n zq2hd6W(SQsFsdi2UWK!ZH1NQHnFAou3RU2Kj^^=-m$SXp9J2c8H5-&{*<7h51B%di z4-UlK+X@@6g4Y7^EWR1_f~M1%Z-H%(xug&IEfK;I%5U0H7a4msBt{$G^IS~${DuGw z_UQ!w(V7ClBnB8jfs(^XoCT(~>{W7gFV4@A?Q?mJ^67~!$%__~h!|f+x)7!Gg5QxC zJ_?00l`L$+`4NVSK`WG8s|O+3g~t$ZTb17L5-j@~Vvj`A1hAfAl@+8xPPd-v@Y3 z!)G*jRG0%YpE+;b9C(8wYuF9pn;1d zlyFHEP&Zc$V_rybYM4~i&dNXo)Z~wr-VtD6FT|SCa+SezL~l}!UaA|6-@@UJ?E?l| z*DG{|v0Le1h<&~msOSX~hpsxe3wIeJd16^(k27_TnScJJvTQ@jI+*fm z9};dcgPz?sK8yJ?f4AuCeohl~@ZfV%Er!{v)MFOB%Te|nF4}40h=opYft2Qa_wx+f zOxS)9%vo6pOlglRFZC)BI^+&rWA=2-s`P*T6$HRuo*rgl{XhWmArj;@=!WYbBLI{A z1pzpYy6`NpeuTbYzV_>C4IOihuNthH#s zL+%3nMjM?p98JP5+(Sp~SamGTbvOTwAct{y?pimdGqqPaV^O*tCy`9J|f-y)#x=bl28*1fJZm7uxra*Z|8@ZoYLo15(k(A7Q*S&r?Zqg3DQ z-Q^yJ+^M_wk{{VaOsFt1$$XskvUXYc`_b$8&AuUmel$~h@U;SZgd660OwjbAZZvFu zzruoig`4(uF3fx)%dz3V90#1Zr-ED zEKbZ1E9A-Wd>K|QOQd02h-6;`y?TfcQ%jL5YbkBY2zD$Sli=@x_we`1K=e%&Ah(Mf zg;M~PjMmqEBE?dqiq#Hp@&j>4)c&B1=(*EW2IQ)EmkLoc@4a;*YJ;0X_o_T{vvw>~ zfeg-C1nQQ}?G+p{usRv;t!3|N+ZXxO*DzR&MtdXcA)s3KLQ_w-g zwg@DPq>qg<;Bl@EM@V=!X6TbPJ4700J9ykRkEsBCad!h*h(>xBBb-)?XRL_@XcZ4A zC7)>RaR{|Dzuq3I%J(SD{|8EoUiKD_Z^2v>Iby)ImA%KJ67TO)JTsu3b$z3iI(X;+fH)?3g(p0hw+<(=39XFS4=?+m+RS03Dxa+sgf zZOk_&2_gYOIflsJv+C6r#aPboy5>;b4QO@nbs}_&1zOzMOQ00#H7ta}m)~ zIn@Pjb`+N{;NIw5HVpe_e+wo7a&|g_vXIn+eo>qV~LMxTvQ<6j=XF) z>T%y1a4f)S?(;P`*3Hp^@Cn9zuhn?fEc9V+>3k|j!POi9=;C^Az3%qXG8yC7h^_KyUseDPkqKv(&>Qk zx{+|$C_GR)gfCY}pLw_{l@#dG6zqEb*qnyxxZe@?d%M#%bZF|+SVtd`kJl>q*T@IN z%Lm{So+^!HP1$bW)sDqkH_r@~;?E)|a z8sI9h{RM?i5`y2WSm3EEVn2d|si%^ukY1)qN~#`s?g0bGaIy>*qtUXGvwHE?^Efv- zg;lMZLfVLvELvXjlY?koDs@A6>(yi7YQf<=5(K#$U_;CE^yXmab?pWp8xHfk|9fd?paSO6r(o7m0yde-yl9Q&E-O)PvLIlA@ zwK4oHsf_@3aoC_IkpZV16S;%SG?h;&66{e0>ine#PYw?nrjmQXRE39E&2 zmxrrC65ZjBwKp0wA3dq9`zmiQ+hLD!Xu!8ELzY-tJM`!}>%^7SG?G-O^3b$HHo`iX z@uj)q>m@`v{AOUg1f~uAfjF}zS64N(qGNgY0Pf8q3WQ@e6#JG>rKJ-guXU@9F5y(z zZ9Ux=&7MA5r-K9Hsu}OqTJGA>@7;CM4eG2YkBhY3i81~!pR30n1x}_w<*vea};7;>qUNN@Kw8U zvSNqZVu(Y@Vl9r-SwC~IFu5yp2ih6kALpPrI0c_w;9apN66lmL=me@(FlW!0|57xA z-al=u=YB>r=)t0GFblya z9@oN%ILk7zW_Gl>%GNM`L~n=6Io}Ipm@VRA*wW>kBq3iXw z;q|@%Esi~CEHBS>RrulhJES%65MTlROJR=+_w_iCCiy)k z6VYSU370yS-V6J=EbIwhPr{Yz!zF2039|9C$}mMyGuN|3T<}9KUT%^t_cjs4m!4tJ zyPSwVXD(S4N(fyPpHn%KYtU`0>hmoj8N}6waCMM&t7;m%j6GfDybY@Onih6>A~00N?0KXevJKHi z*4P;Jvsr0cBTlY~0NAkXR;a&U&0E+SP3sQ=cE{bz86!x`csvCBueiQ1CAI#nq~Oj& zvW`5lJ6A}~St$3@N&8)P&iwaRQtO{9DP#VH_V-p&#ov(bcS7A}MI)|mOsgoBM7WN8|iWv4ep%>+JMo^W0NYbUN6d}xvGwV|0iBJoy6hj|!;eBz@Q$Z^a zYJHz6Rt9}J8iL?5g9e*;<_S#ivm2GLP&h7E$`ZCyXJJe z<56WJQeEsOiSNc-zWSPySwg8BgF+2-Sfhz@yTiIcoN4*uJ*X2zHq%Zs+>R?Q1&Nxl zm(LX7s^E0SR#Tb8gKIaS;f`q8A4ICxsFin0jyxYv1cUih525z;GVSSGwu4E9tp&8$ zCr43sh(lfU@gu$|3?ZsV@=%gUJdo#|nBIcIH_bfG++CeO+n&jtD?-X%_fU=(e#4CE zw1+j@q=y|sh7Wq&Edh3{0k@P7QgQZHF!a@x2p$ji8k!KPAK|SH8caBLqfloDv_VzU z@02dOGFM}Z-+J$?YjjxLg_C3QPv~l09-C~10z&y za@zLwNN+a3gKqYGzKJrPRE>5mTfLX3t`;@?rd;4nsWEz9*O*_i1>H%l&otDj#~)}! zP;~2f8F7G`BSsBY{qPCSBCFI89FvIPtIeH@TfT)i8Pn(`ZA6r;Hl2LRflOYrx}jf5<@X_Pbra042wiUTrSFQH;`aA__k|%L`UaeoOL?3^Vz48uzIH2dp--2To368_&eAT{=ncVGS3e5IZGyok>& zqH6m=I3@7ZCa|w~M>>b791hVrTclV5grHM(emjzEHC>aI>Y|#y-?dPZGyZCZ;XX-? zFwrAS*QqOJ=H!7cA(dbinW5&X&9l>;Ms|`gd1=U{@qmYUJ&TWax}N^rLxcWs(eYOg zO*;?E)>YxKWoQ!w&SQ#5%paYdOGCfkeU$=Luo;!TE7DD%ZkaH`I^|XQ-X(BkS4wcd zp}sS(TX8y7GsKjUPO`DjJ;<^4jrNjvXU&E;H~ zd@@yQoLmSwtxAB7GFPcvAK%JHej!JrLy?n9a{n)L@3HK-v2=~j@hTh;-VEWr_m}}7 zJP5+Or@zrwQcLIP=vRCZchoxy>`hd6RjxEESJMA3=kmH)mhK2YzE7B^?P+<$WI zzjCH5jxTiP_^HPg*paj67xOKbCkEZOLrY&e$DhCIaJ@w8{{5{0_(S0x@23tIqI3Ca za6YQv%J5H&k^BkIqQCX!O@C!g zJG_5X75|^~x0rAGTf9ntzQ*K1?QKzZeF&}Ht#Q{!z{m(oRFB8B4yc#X53wt-U71UA zCv>YTKgF1_ii|>(+UZYOqq1DM;-;YR_da9jtOEgu+rIvwAtfSkEo33a6V|B@l%UL( zfP)v2>B49n@54m01AbgBw!b88np%3wVf6vHiBMmR^x!IeqTo-3&~m^9XpruATP-4V zCQ!$QR~sgkq>y>mH*5WpgvEYJh!J--fGWfiq&y-|s>IO#;vg_6X?>%H@#mV$x_gFQ zPn*dWvBFv;GX8<=r!f?_NJ`uaYCt~1w9dp*?~xyFM}(J8dC=gdD{F6Ur8+l~3GWjN zUdoBenRI9+uMMOY^mSE|g53bc=a7DQ+oi`4zre~c+UcpOu@akv(?9xSo)1C{?@a#Q zrwaV7=8{_U%*-!i)mOwSMtH<-JGUg6vD7+Keap1UwC(6L`Q_YeU$v=d@z89Yr)~bP z!S8ox2KXKSmZ5F>{kpxZ=NnP&#FxgQVkdHZs~%dQRpl1#9&-=fqs54&g-jwLTVPMh zJB99@*dcmcA9aWGYCYY%Y%my|K`3<&vBL2nLyPaN4%6c*bC@Tso2lC;)>!~I3iHd! zYPq~)WqC;}o>`%!oaH>%UJ^(q`QEcs1drlUsM)qmEou_u=x;pBaBR$hcPa_2K~UH_ z2T(r>obDpW?E3^^JI@0R)-r-%GNo{68b~2-ChzP6Jq{)f7Ka7qfc{KJ5k_RmVRD8t(}N)Be*}dO#16qQ~y`qf)nWH7a!?|0W$r+ zZ?ly7uhotk$R%Y@-ogE4F%FN)276KFd021b+u&%}N&q7(s*lGiYXaJIw4G?3Y;O=H5kaY5E~ z<9sSz`+7nszhb$Ip&SZ6-z8|hGY5P+^bKJRV9?aTv}h#?vq>Rxri7RGVqEWom?t+) z63-e*bkTz7muo8HF29VgrxDM~D3h}Otbqt8t9@eN63KdknZ(%B9~iQM7EW93q+;p& zfz?;C+ulil7Pw?pq}7Q7M@ltFR^ zA07F`cXic;A?oB$zJ4vgUJ82w$dpgKkF$)D_Zp*ps;~?U8&7Hi z@wYrpuV{;hW`I6wY7NcYrU0KUk(Rt){N;!g88xu-FiWzqULuq(TYXXKy(tX4YNwYz zFF17uLE1a5+zu(Dq^Ad{GI@r|O;kvX(lg@tmM17pwqk4+FU-|pp8<2uA>*oBL+GBU2L=AptLm*!AqxeV3iDs ztH(~eztvfPU=YjE;un~pE1uD1@%{CgOY>EN9#yg&RZ@wJ;J*NwrjIHn5ABHMpIV3& zAIk6__1?Y~ZbRY7-_$#aj4^|;I%BaG$Y5}f5$4u~L;Qmdpge;iGlG<^VH)%5-g zt?$oNWSOBQS5j$tex1}CXhLso5qop$i*0JtfokS0wr$SCm8{JfMh2G43KlMF>trMD5*>zEMljORzpxJ;AB ziX&coPv?b{W(rW3DP>qSU5K)sbJL^r7pzJ<8&VQxd)B2yFE7?o&qeNWaxW@WcdZ6# zAQNhO8O1ChC{fsa(E3V#CY|T2RpyL&KjCCBKl7WYOXI`gid|ui+Jel(j$FnQ*d&5` zH$u*Y2Y8w<8ZouzsT%kc(d*1l=r#G6|Kn>3-?kmn7)@vf?%Ut!CpM+LWh7bQ~8#Oba&MvU*HvB zmtFtBMW#v~|EBWPqMdmBsINJH5!v%W_uGKB;Y5iF{d$63+6gk!T_j2OF#D=j2f)ru z3Z51ENK4~=DLw(4hY&(uVjF7IP1Q0LrfV~aX+#nwGaVJ;fv;6gSqF#7PX|y^9Ip=? zEtXHkWIue^5G z@wwu7<#bYx+KtQ78T^}~(d&!f0sZtl>>#9il<<;H{ABD)SgeIvWbQB8xjDxFHIKk~ zE&tY8`$t^!vb#WWyWVszhI0bNcl|`MLBV%ih6w^k20Tbn0--x4kIsHLE&{KpU!r>l zKKJ+w;{T>p@uTvM>7IO=9(@D47oWyA{TT4eqTbT?_q8MVMR3Cg(Nk&Z?g#Tk@)ZGa z{Za9{yt2W-4ftMkeS-;jzp{hCcX`Tn11HfP@DPt5loW?`JA;w=*OI|X4P@+ZeWv<9 z5t^`sH>)8Da5_PKp*C-)!Dt})>&O`5u^5P}&|d!boK3oHBLU+gZrlFgNe7iKZc<|| zL7&EhPJm_PE~mcS#T)B;pAct6xq8j-Y(o$yK4F8xwtkcl2tnuiEQ98bwptOcfI6## zG%)}pUxUILR(y;t^-d@k3I_|RJ2&jy{=w+nOIJRee3<)G9+sM)jy!4g1u>kJj$Gvc z=}L&Al}KizF!iO8r`&x4qtQo?Rv%0rUekd*qxaA`FVs}tYiPn3vRq1OoB4wFJ%BxQ zVsTZmJ(9JcOR95}=OQk7V}A;y7&>jS_1n8?LtR7OA_WFB>P^6)mnvlw z6WN1fjZ$NNzaLuT?2aog=gS!tJLTqRlxs&{I6Fl%sSls3G3Xx&3h+n;0#F(8;OOGw z+2~AdI!Ya6$jo+Bm8>g9I_Ssox?X~>#;2>zcbgmISH{9Q;gLzx6Bye^W_lniOnSV) z#S-4+QeEp{#zMYDxDSQiYxq#xywzk#cv0HDWC+1;h=t8yNKD{{hcoM(1!BFab=_Lj z9#rte$F~2g%!-G1!xDt+g!c1RN~Gp?CYE?`1Rqts8|^2uzw9Wc zzsAoA8M&<#(Ip5mU*~L$DZI|}h}t(mdT57D*5=^V%1iIATyWOIFUfYc;bC?2{RLJ~ zZz-bshJv|=8!Q--4X54~z7Yhr0S}mipTQui_41U#$yYdfxa2p9gLd~`7HaRFL9yVb zK(5X48Vaex@F!@BhM~o=V#RU2AxT&G|^OhBGGz0?ydGxr=@og z?J@t!L~NB(R8#q;whEmAxS!J>^pL2Mr%|TS&R%|DHe4oINBI_WmR+6OVXVxL?KH5B z5T%*Ni_V^=?p)H#`~VhQozY8I&I{K=*s5^jD8TKkrClqq;t9W_q|zMR&j(3lug`U2 ziV68yB$e+`v}YN3jFFkSW;|63Iwxbug%5-Dc)HQ~XwbpLXro6Em=($$cZ4Mc+G-PUndRS1Z{U!LC$^PR0ovA0(U@RDF7WS*$QoDs`>~{d+YPgK6dm zB0nI)rhp>2V+rT)f_k$)eR%>tE{LwO+o43p^oW(~gZZX-G^OA72qvWr3lfs0E?DU( z#tj4UM1MdcY&X$G8c|_y4D#;e{Yb>d@=nxst18H{q!G{U*#wtzk9XWP3D z#Q<{kKKww5p=JSF(s!NO6Pk-$YKvU5sSQYbXz7dhPhO`=onKCVo!kW(>jy(ojrsr{ z-RNu_t3C^<5E)sex&pz@;;EpsZ~IqhiEMb3U?8b~Cb0{Kq5?}GJei$ys+uyh{xMh2 zQ-(Cw`Csc{z&8^6f2bBP6B$zFV|pn**Nrdm4WG7ggEkep?${-KpV9z@>LBU`rYnLx z2j!>E(d&{fhDFeytYpbVbvf_bZb4U;Nhe7q?Xb9Pc+xGq%2*gx_-`N9_+#XXQ0epj2Ul4>Wcr&-8ONVJ8;2*DhR~kB{mMrACW(|E#O1F};YWAC+UPrE}|J)4E9C9^2bD)Q_+0AAApIB`#FpJ;wPI7N~XH0rl)%{(7<^6&$(6 zS_h-4%(A8EYfyD$M4-K0wo>>wydv|IMjw;A0nwX#tWzvJHSfhh9SaFv{1z=}46Ul8 zPb$h}vDi%k-*%tIv7+X%@_9yUn%$V`B^U6@Da7xP`%36#^N{{>4bM8s?#&80gLUJc z$2eiWwz?hX9&uWofIcE89fb_R`|~P*wg;zrdKsN@3}V~;pm_>9um903nBgn*Sk{4B zeYQSwz@=hwPY}TH$njkq@P}EDbvpiH7FgQW|5mKyYqfx}e^d)tffHa86DcRkAO`8-2dzALd4-~g;;jyQx`-TgTf&r@TJejC$cJJfSaOzwG`8fQzOc$j*O@cwf}!s-Ot?sk_$0ErocqUt4!19d#lB(HS_tFuaYMvq70 zh%HCb>}u7nad$kFc4tvH&ks9;06z}M2Mk&CJ_{;=i#2bGk|pF(!AzEMw5)`VEL_r< zfI6&xAotE)!-W$fQC_}W-$1u$4SJ@=yOr4qMPsDsY`(xAM!MPajUK%;+xiU;iT#A0 zGG4?BB{}TDMA`CMJuFH@ zVeJ_DuY6{XF@Ldirg!r%Kxckd9({WVuv`@G{9+jY0x^@*Povduz0FUVql=%o4=PX* zF?EjU6=1{X*B|uXNi6;BcJ%1WXlYcxtK++{>#u7E;QeCRypH^xm+|@HW&Hd$JJ46t ztG-0_w|>ir?$QVFy9N>V74=6P8Mn+E%hx|S`8Oi!e+bBdzm|S1rD!i1hH{VxsMnO` zL22P_dL?BaG%hirGq&voRgg9VczxD_-w={rs;!D2h?2hW#i+VZ%Bqr?2UYfTVejDB z58`G~e;+4F?1H)>`jM1Y0BEQQmzyaWKq ze3(8``aLNGIwn6vmVy9Cg+({tf*G>K%&0^jg|g>^e~ZCDE84{5(c5+e=A$T1xoNsX zx;+!826J6H4CT@Z=sj(F!xOAWYpD&>-1+Sp(Spg`NG`~e&raTyKNrm}Dvvo^oZI;s z4D6uv?wTU(1hC()CK}4>(?`p?_M<@g_zZfhyMzTMeTLEuAPAo|r6|kvm@^K9J#T8N zJ6blf?-(GRb7P|mru;0Zc(-r1FA}RjYh1M;j>%rl;{e<7m?WAG1QhyIlyVGbCEt$l zf%1L^`~~5i&of_3D-IC7z!Mu|w5Nx(ZLtd0k~&vYF0O?!>oJ#V^C)*jcsuVjp%g#W z8bEOBf$7F46kd>*={G7$bCeO|nS*AD%(<^!icYAB$&x}6Y0)19lx5DQi*0ck@q3Yiq9ANZR+{?Ns;C#97Vvjm(64$< zzlRR}O}`#Y(|t6^8Sfj|_LqK8IQqds?AM6=Zv%3OtN|*U4zrgrO;L}G<`jZNE8@tm zek8_Ga-Kz|<;82lNzA8(;_w2{Fu3I|zMrPKeh5(K(*k^g(^Z_b zE#a@o&NO=7?InCA5-+#69Pp#Ak5xTU;&dV_VD{V58yJs*y!=_DMS5kFM`WQx(LPJg z?`sZ-7lJVogmWj6>SmH27M3!0NL8JweSk-~H2JHimKzdx!sTa-&N-BH)9JYrHHOcX zqBeCtzjk~H;G z==5hkPm0W32bMp{p_uJUR?o)<1Dx!#n#|00{E-iH>r?8H@XMw`0Zwy@R4G*jyLyD1 z3=ci8kkd*9->I2ucf7wqe*q-Ym3aBmeAA~xZT!h(Ih@ME@&=f&ZUi@AY4>x2+&k z_yv2vt^J>4um1mty=s)QqaXUF8IV2xdbPZ$4^u`u47|~7x&|_QyNlGFwQd?{OH*zF}xGI${_1r!&U@MX6X0JQ3QX&F!Q-19zz;c+jEY z!taC1^pDXW{wWBz7cLs<*%Ex_7(^YP0^XtFsc(l*Mu1v#_pQ$#{0Ys|g{Q*>vsvZ& zekFRE2a8XMAdv^fN@+3^L|2`AL4DLBc&6pMalIJ0KfhaV)c@(@My?X;xA_4XCbq!ACF zfk3$rO!XSme~_?=Y?e_FNF)_s$*GG$H~>LUK^HO+gxxvWEjk+0{2;ykK+d_jN30|a z<-U=oNgkEXZ^D*bz9PM?GTcTdtSmsKxD&2#EzMfh4VCpWm^NOaii4V|#YK`ygZF14 zv)8Qhi6-b~pwYTEA1%MIi9w8WkJr`SugbPL#? z&v&{)$8T;&+dzlz$AY%5y{W?f+CQN%IkIuxW2bAEWmW1xH4K)m8Ql2GsJ;RqckPQ> zDvg}a>7kg*Qk86kJ+oVH)M>`1>>((;ew+}>5*yjZp9<@O$J9`{I_gg30`XL@x6fZSBPBWR9jtXIdN2gWQhE_T5zW0>a-fC!Sh!gF2~mekTNXYnJ4 zQspDdG!O09*m3htnd}%0|G-y<6CIN4Fj{{?JQX}0 zCfg+KqY?8JT1J-N-GfV~R6*7~fTNtZjkQ7{05N$z%C^c+Jguy=nRg#;*F~}?Ny)Ci z6Tg3n8pK(<7mO4K26vVA8cjZ^kBIl$&H)=i^@X8|MM){uiXkbhFqfNwqjhW5LRp2Qy`o4*AxjlKX_QvdFm z${!;DNID}&Uc|?kL{Ezj+`-v&-(S|PvEzQACK+6Jm?2mnMF*G<+FfvgU5k0kgfQb zB5Ks{4&>z2iow?Pf-%!P`k;mOEX4(pffK&o^GiQR;{ITT@P<~6pb3Xb^3I+sREWux zPT$?}d}&)}l7>P(%099{)Q!@N$qK;sDiHtdBv@3uAo8mn;me7<%nK6y2ZXyKv+&`& z6|daG*VC-tTJESs83yD@4t41O*A+eL4(+r))(ajkXh(gkc+MmtM#eSF*T!=?#0?tV zDX2)peYnI`oXg;*zhR}@;n=38WeU#R$RlyEB zyJa9Te`!vNF~x9E5DZ8ZoxHYcVKOTmI4|zkv#v2-z<68MNh#gzx`$N!GAd-=+6L#$ zFdMebNLDzxsZ;^%GUmI_XH-LIHtTzMMIf8o#C@0rb)Ca&2-)j+C)GOhJh2S#dVZ%# z$9}L=S}Wh@faaMDVbL;7EmBDSpy`h4ZK=*3h?C!sxU8bRbJRMklet0qIXIsk?udzo zaf)A>&H@aYZdy*!EUoQA1Aa~Xn*gKF$JX#hsGlXqP;jAlj9;XzL!dZ3vL~w<~cn<0#kJ}R^NgStgP)e1GMsv zhYVVzV)IofD5i^fGw#t$Lw9Uuad2f*D}LSx{1}Y3B+jj{t9*#35)eP5H?9o`nP#`y zlcPXFDPGPa>Ceb$Pfc9II2kT{vV zA??&&FD`^_^CChL>Yhx=om=Y|>jT+m-QaRBeF{*P_JAj>=T%hazEvpGHMO{D6S$(T z8C2;LrOj%H-YeNj8BOfZyFK5M#IFcx3NN}(Gq3>$cVC$@5gq(q4~z57hqe%7l68z> zN_~vu1h@C|7RslHlbtEPL^rtD8bVGG+Ey6>s=M|~E+%gH9v|Uig4V+0JcU58&lGa3 z7cE-HyYP$=UcVBGhw*Co4B;dD@DGUOW%?zUq=N z-SiLJ|JX(54H?}I2sN^it>IKq}q;afAp-dre@`znjXZjnncBo=aYK( z?RwK?>ZMZ;g^O^B&dv7?HrGa;fQDWRKO?)%wxk*s%XVD+=@LA@B75{fk=AtOv4W1)QCKv+7 z2N7VgiRI01rr;oW2QE?72q!OSksmsTuqZ+5!=@0z<$fI5v9WDJ#rmw1%{);^z>XT= z$)o2FGeZH=%NYqm#jn$h#Dp5v~jv@J!4u zkQv=y9e27g1;IFD6CMwX!t1L8D~OFgHQReDAlY6OTnNi@z; z#HkV?yph4mxQbS5@ON!w%@romu7>4&p)0cK>`mN!x}2glX9x+aw{rvh=sXefcn`a9 zMFG=?F*PpetI*$1PLwC8j~_?TmPOe4#Cc~m0hf;XGNTYN8qu#-pgs@rfw-~E_cuvL zu1JX0hsd+sFy%DsQ>bmhcs=?CX`T(jlG2DMcy zjly9Ig%8PyF0^C=iG_61Rfot`q+xU`c%7f3Gag-dPoEV?RZ^`&AJ26$n|){v^v|UE zn;;SFbv!B@Vi_ zOIEH+R+s39mmPn6S@dI2*cZnVXVYToR2_=6lmTF=*4mSLVOSsZVOJ(fGA|XioZvkx z>s0&xg`xU8r>cPhL2IwqDyX)I%i3zkc&OfiJfv;EX0gNP6#|jV0IYUjt(ovYo855sRpe9Yc|23#eFi^0KaAl{P?PbU%*+R{|1M?MYCTT>2Nd23`Ly5NJYs|RrWh7pL>}9$dfw$b4E6ivwQpH3tl0*;_yg@`{X-v_HDjjD!GgpZszn}hPXaM z#}`Bar@R=vLwVPUUjmVQUeH`Y`Ytm#0htYM8boQ+{>rIQp_@rzRsD?mMW}q3c1R`a z1+Wc4e8Aka(zq>_m^sm>9L>~P3F)J0TwH%lCF;q}uuHCoap$yzz;;EEg*E(%y+eVYn7E#{w&lmt2IbdQiC+S@mTblzNem1fb~;&7NWa z_lZEGl{&zs4Mp#Bk|8>?5w_?!oP?;(!8FY$-b9#V*7HRN{vpN4V^08V$aau52@~(J zh4NW7hm{W&TW%W-UZ>Ho9F*=yyx_>P{R;r+r7r+}`~+~@`|xY?QF@eKSfWKCy32a& zFKIL^1603g`#GR|iZ`8ni$W`p?_O6D3Sbh+l@|(I4A*^*IDOvo_74#`o;h{NhlM41 zQ&+CX3|C|?r{FE0+ycZMjP?tBiB{+?Vo11X_pvgEYQ(;&}k4WhN3vm=0?^I1TBP3CnWK0$H31mV03i0yocc}{~2z~UsnK$i%^H1Y);gxK?N^k-^d0h@Zq zaZ2Lt?{w{@QoOZ2DJgiXD9BZvX*|^l3E0>Ygha6!iu8a)`7QEkYCU%5QHpl(*p{M# zH5ieP^qmDLpSHPie&CYiUAae)IU0cn{95heO_~{a!J*8OnfS3n6d6o;M_02^KD)RH z0oRy(YfX`>aQ)=q3k|8_J-N{X;Jn8mWwYn!yfzxsVwzOov$l}mX}%t#d_zW(|C)N{@CvY08n4^>=fv$8Q5NlO>{&>48En*Fe|D*_r_SN2 zKiw7J_fD(!Hm>YXZ6E&k!^G3p*c9()oZ+t=TajjyA~^=!mnmVq$>R4@nfCCr7F1BO zf}4~>z!kzmak$M&f$pv6Prx}}`e%{Fz8XUKi9RhpVGyWof{G+f zlFz$4N=!jrh^1Y$mN9!S1QmwT3UNruN=AWO3Eb|<97^!cWwGRm{jCMC1a?D0S*U9S zS^2@zJ0MFx38o}{V01oX){Hr~pJ1;Sz|i=EMa{Q>nwZY0)#>R0lXb>}%!Sux#qI|o z4W?+%hX3p>Bj^qx6&e=DUbC1FnE{f2CsoNdUo3j{lL%=`V6jhcna%~q_h_+r!)BuX zNfd-->R&b3{;4(p)`|T8V9nK=9)Bb*0r@v;F4&;{hvB#1$GUwT^_C&Z_>#JB@f}wk z`c1>%EjoRC4e;*j&^;d2TOBezANxAH_J05@;P3YMcUuJhZjXPrMc~&x{*A6I=OD}e z%HOOIN5rde9Y9#!IUWbd>Sc{tFou>M5o&)rivbzNL@DqCD*bU+ufoG0NTI5`&&B)# zH)q@m6Q}@r>8KQ2+pC4kl88PtmfYE(&&FWUbZlsj8&)3SXCVm9W48C7xCH%U^Y6KQzbmbj#DkVPwU0Aq72NE83P%A`k_- zQy&xe21>gX#ZN(rYJKl+rpEO3y2p2ULx-iC;zQu1iEe41QgqTy^Sc-s(IJesbj-|~ zUppXj1?@kHmu%9|yUm>Q5HW1MU*wZ~Y1}6asJCmr;(t}ofH{_>N%lAQOP#T6UEAzI zmlR0E;bDrypWLtGoBQ>@oaX-%_v^=D27Wost`GA6+lBS$FLx9BdRhO?g$4c>qx9dl z2>dTb>A!6e_^UnsgDQ&y;DYOd)fg`6VJHS7+@LeOlx{X~gOU-N&a=})NDo(Q)p8Ni z4raK_B^8OIr{W%D1dKP*F0@kvArw&F@f7xy6X0O8*_CAu_f5*FeuhUhEdPg4C3xHQ;I> zN#PHOa~1tyM1~Mzf?CZ6?Kfnp?8YBMx`T&L+nqg`@SGMgAiYgma{6N$$Skl?W$BA! z;LMNebJcZ;aQ1<#lg5gZL!zI7PK4L|U`4h7p%e!%hyN^AL?$NDI1iVZP*Ziih1`6P5~>?m_=+oWdS2<+Oh7)Lk-I9|kS+F8 zV|2TSR>^}3Re|$cd))qO8k|SS`^R68-T{Ql_BWh*&@F`{CQf-w<-%gpOByOD~>rEd|jT;`?O-{gTD8`A$Zn@4NZCo5e^Te4>roJQdnFUP}fhj(FBas-`OwyJ;}#0Q$-wBQt-r!vg0w|Kgct8s!x~ zOH>#)iH4T;F-*9n5+CYawsC&+vGc~?gXKjEWd;D;7F=H6UjASk2kSUfKms@FXw|tT zLRl(_&bu^tp-VfE=Etqp@I%UXFo~1CKGvjG>vea`x9i> zhQJ+yO~g1s51-DV5Az;dIr6zmZd4%qNMc>8ZVU>o)EVy78)ekM2p z83=PI!Zy@v=Q3RF7;6v0cit61+jZ3T@RhA#EH{xU;iJ&EekSJ@Fqzb*9eJ6O7f=ckx02fT!XGMdy#4!i)u8}l3(8|5->>evcniA#2QCH@spl3AYKXYAiNjuLm;ts~drMQi+;$6NFpYmNe$MIFD}Tgrx@AxO@vDsC zO;f-200#d3OQX|QBooH$ePX}MPH_Awe2ov|u-|}8>VA;=1pQkQ<>x_Y*D8yClk9s?qcubyfu)vKm$9WL^ANr~@pgYR<&9>nPHg50f61 z@g&Ng9sA5;BP)%#S0;%eOXHqP#Y_hSwh@o@(UDy=!#kt5NYI;%Kv)+o=b~US`m0T4 zv*+8wfxnx@Klr%7e-G#XSbQe0D!yO`BARZ(AMhqa6$;eFF3VN^>wpa|rRgKF<&)M# zGi*3+sr$xz;fF_28#u5knNW}PbH9OY#kn*e#|7_%HA!6oEm?4z?Sdp?J6OrNk`HGk zrVD~og45Wa^130Z!krGSzEKQ9oe``6!8pah}gY=qL_9uiV1DAo*U<1jqdt# z%CDc1t3%7E_3$@459?lsJP_h-Y<uY7-8JC*HTZGY+<&AdVbCxDG0zD}_YTam z_v6xN#Lq*Zg82#rw|Ie4fJK7Zy*vpu@`VPd-N0sG{9JmbTrOakt+ z_F_zDR#y;_V0wX{5%P(yU_H*GZiv&|D3>B{@BMshdqtFbR=j{zxZH7%dh+;yYe^BG z&6PfRx(f%l)0nhQ&S~Zz;x_Q5P*Nje?@{^aI0Vk@{C;L20I@`y?;U(@OR!#{Zth3V zWqOle0(kLL7$+K}9ZNix?uu?0v)cmp7*oA{GQI3}AV0+JS)AUJ?x9h0oiX!dq^w^re1PsWTQ;Z;Kyu31x5Ns?!sWkYgGEoow z#2?idQREgC7mYhZwR&78c*FAG^qIg6aa}fWNGtEntAf&)8jLD=5z(t~3Z;8tbrZSn zWa?L)VP>5=T9_~M88v1ecsAV@NoxiQfNzYSPqxD}q}J*}w$EX`2*x&Ob=5gkl0LhY zQf##+qUDTYE@0N)pGUpx6URsy8i3g$n|lQ|FYvIHO$B)+T(v@`Q&%z}GrUthY@fz^ zs*Cf4x$5wBfiv+egqfY`F9`^*60;ex7&wbrA3hWu!BZj8NS2TMX-Nd!@}pZI5R1Bl zM@q1_$e+QQH&i91$E`a+(FhiM@%Gx$_;krQqg>h>b;W#~-4T!YRSKQSUD`kLXMZc} z0l%y3{dEoSkJ1y>)RKLhP<*8GIL_i5@B%O1dgnUzSK2k-3A9^K>>Hz{0cu()z1)&* zctPm~xoOXUmC+dfoRoM+5U8$r?czbC6h5R8hT%%Em1;3eH?(3*^m^l; z+e;7R1&~3v9G=M=Zx(>U^v%+nXbp#seg@D4xCu|avKl=B$bC|Q5t=hGTp9M#+8uJU7 z9ghMZL?c(x3|cCZGFlXVMn+sxcMLv63+h0oF8z z7+sN`*g(|=mET)mRBX+V12RY>7kfzjsM^DLsy_D^mK65=A~t5e-3L-7djjZle|qAR zf}rxrA=;B;%ZRP9kQV5IQ#hudqgaqbVm!d`C@V=}HoQ*xl(FCRHU=$ldGn$q)N{zD z&N;)(k+?JM_RthCjy&s!FA`(ewC|)y5b>TVDMLABvNFgNiE@kwKs}LdwDwd9Y>%c; z>|FHHOSq*yR~4-9wN8B0mwFLeMBC@YF;d1&D*Ze7Y{UDdUBJa2cZbQx3F7+y$J}=; zIgTvL?(r*JK&vIR)*3s2P=qD{LVf+SuGT$0b7s!mYws@FtSSx0P82geBO^TAQ{Qk> zwxU(GjGzSNtYLZ)ho!r=(ooQpt!PofH$<6by|>(3IOg~W>@nlo`3BvD0maTNwr0?a z(Tm*Gp0d2LE)N9cv(knh9h5(u@T3VReo@&W<jaF!JHHTUyVUzJhU1xD$fSNPBO1zL;}E_`y|9d7a9>MS z2;LYh76bf;kZy8Xz5pA(v6~;_5X!G(yZMVagxf10hdJ=gG%RqZEQ0YIb?5sfd=)|v zn0;5iWM{^F5dNT_3;el&F0W*^tio${nQ}1H4Y{m3`HU@LAYD;TO6gItDF!&4+$AcW zos!)gx)gOAmE=*^V&3|oY4l+}ZZ1pq%C(bAnI{W=x%!={`{_Dm=@?I-cJ8*NGAVS( zx8~)aP>7ZCoSU_DS=J@_>!#I^HiW{6^uuzzPQ{HLtu^DP5(Y=U0~cE@Aq>t_{Ys2O?B7Yx3zESK5*Klj z$4Jsm__Vk_4l{=R!FUJwwW8KIM%j%r;yl4-LZp%aZH5Q69yXsLzGk<9uj>p*p{%ho3_pyaaA{A*X8qCZpyG_iHC!*tk9^>H*$9{QnK4He!2CvF)PU#W5-#uanR>&E4 zE@xhFu#fE)nvW@EZTBv3psni_2-%42uyQDP7U>yG^URz{ub}Xzvz7)rI}n{RC8Pqh zb@Eo?NL*C6xW98z#DUK@l*jLzpX&9$DyT`(#c`})eZQ6%uUW#zBXkUNx}|J>_uKjX zdzD_`R}GJ^NcJZ{b~o7R^MzsG{mGQ;OjmTe%MDp=m!1AY&q})0n(KCzL)ypAOx?(O&7Gu?6u-8?VNWPGYSET$WpP~b}Z9f%W$2&a8Za+7~Ony0|A z1e$U78&K$QzXsUNT>d@9FAnmQW1ln;+SIV0mY>|@#j6LBHkTrN4aN z01l_OnZMn}(0*JfGVAh@NORTL{vDO1WP&e$qx|2hcl8K@wL;IfhF%Ddv%9t834vR3|U0rr;&=0d4}}(4Ue1 zj;Dh%seODuhsh#z#vytV4Rn%>bM^f=M|f42K7{WeUxtdprJbyDa0jT-dr+bw&sG@n zqjy|(68$_XykiTcy>eVHViCC!&n5`j+X4}8E>3ux8UxP8Bxm73v$x#Aj7N_pPfb7{ zg~4Zsa^>hvYeaaoRI!JQVg^B(Qb?F{Z#>lyQE9{mLTLQwgJ z3Hp$pI`aMZ`zI)qK8P!4&NIjK=|hs_1!S@d-T7(L5%bJBy!!!}-U&jlfAJw7=P&TP z%V4iRN+0Cg-l-or1y4?OzlTLgF_yAgQ(t6!y#=14dlRYyM7|dGYrWgKFoAE^4_(`y zQYL2_xJtW3HO{u-JukkSh9lqRF2pl3E?(oI9JVjH5+H}CjKO2+tWy4ziQ!Qowrq5J z{f5ZVKpDav>ujyL!Y^O+4TG}E@$#!c{_v@jG@ z=q9&_+mPnb>1QLN^0R&@X+d4v2%a4b)b`OixIbXWv29Pt(grKlsQ%Ve=|M0F-&bVW zLiIgbJ&)kFH-5?ayLO)q-i}8IZa|gYAM`FKel@5NLu70?bmQEn`MGI#9q;x&YH4fO zc3hcJrH)j!qgpRZ*8YuN27vfN{$#Nh9z$p_Hqq^=^wbesPb#>GEhWT)8Pz<9P|8kso+_`XMUT1k+Gj6 z^PV+;ud;)mdBlB~4?U5_?xu)tpCHXUM~*E;`u@lL_Tw4_{_Y}GTBiQGMy24}8V!K2 zmP(3%_k~<+_hI?I_deo(4I_LmhY-q7 zHb^6L$_IMMkz!6`qXvQ#XZ7|wRhm1D^5b>naQ%-RS)Q^3%D3`M|83KL^J?N)D~(+= zN7dJdz{+o^)xe)|t1)n;CsZT$jaNmbg0o$;un1>Za$Z#!25ER%7x*OuL3n%3yf!3B ziRAT7f?9^_!8XpqvXS_{$OacbYB7EB`{A_>1=YUio$aKE6v-000r;_xs01f~BcSQL0LwOFnA6%(EwY;~qqzH-#LeoA)fsBMbnR-D2k&*3fH3ta*~O z!FR8=Q4Q)qnv}xbLhHs&@mf*FD$7|bFk0f<5{;y=Lix)8x=6f*$|L7ZWvbf zaCd_v*23#xB7+_mpf}-}%XW)(-@3nUGF?OWErJ|_IsoQwFK8pIA`De;k$2-}7_$PC zjkDDPHO6Py*FzxR8- zc<^AcQC_`Mk8!~$8;y<0P!1HJ(yrX*lj$}GdL3RT>qBSUy}KqmylGRH?XeIZeGD1~h%;ae`zV-|&%A{uYN@vv|0C@i!1a`z1;|3f#5&>5WanS{w4 zM*a=F#LwEYY2?)Y5JCk)pV|4vQ=3x~{!(_s7Y>7G5QDET!14nmYHHhP8OUsf-Qbhm z;tkyN)67sL=0CwK@K-qdcVHIybDVW{rTz-D>z~3b@D*njUil~7N%|JI7`{dfz)N1y zH18;t?x506W#Nc439k1PyVOfOUe8n>-htjL!aGOim3*gtfuwK7qf5czmJxt%55mxw z8|OYpFO4@1V!C~<e%5Y4+O2IcMxmkl#`-&a{o=+~H_y#Q3*+N#PR>8%55 z!Qnm5=eS#%t0@D%iyJN%;wZAx3i-goLB)yyD-Fq9VKe_Q&tolUEuMvUuXWlQ zvTohg;6tm|e%agnRCzOw@Ag9uHZ&uN!`18Z0{o41xMJQ(yd}bSx*}v4d-T=oTo9fr z_AUhyL*}z=9+wt^Muy)X-s5<3{rKWHk@0}6sI92WbnCqgw}-8+FOJ0L(D^_(7~C-s%?zWHv1La*mHpV$pU}Fqz8U;h?(CFj-;Mn$d1S<&@v-6S{yE^ zR^xD;SWi|vKo$oO!J}`CyW^#NiBR{U!|EYN`H1N;e6maXiD&Tan)ljuSALQ>!F_A~ zlG<|tKjhA@04^M%2)*m(ZO|1X$G8rAN9^@7Xx?rHUPZPyqvN=dC@yAuVh3+4D<8Fu zQ$2jo5gLe13~DZ%T^JI17YWF@RwQy@IW%zg4s*-&pL>k5X8bm0$}^^WKOj#^Gtx(L zFV1}ciZ;?Ut(YgfBWcer8kdF6l;Oi!9$(}v!>kqyp59K~5ad>g_QIRcGe0x1)tEaU z1fuqm_i-%(e${iM8kga444{3$r8QgI`p2&Qg5eDmd?%ktc%GbM&cP!02w8N1~P*xA*)UF!!gyMf3aK9B+%BE)KrYC41vBZ31#KBXY&$ z3kuP?rfkN3#l#jCvDQ4%QXI~C^v`=RfDSydLiS$QA#Zgo-CnXpHDe3JjIQZsvw3xu zo_?G;a(o`zJIMV_Ax9I`-OEvVP#X|fZQ+zYC{jq@Z zJ>wxDA3h7baDB~q06z`3Eb&iY3HV+1=AXP0@asGMomcuX3IP6tD2A&i1i4=MGxtk( zgb07$<4$vo{%TH+M$Z%&AwjxIq(h2s7e~IqPJi9|e0Co`?`1 zT|rhB%`wb$*%kvnff+t9A@kW&3GZrQ`^)>@Uxygs0p1UQAGtk>(D(l4lb zf(mlsKBmZx^90QOt=PtMr;V1IGJ@K3Y);|$0cvm>+XNk+=iVtONBSjFse`f>0Y9`* z$omlS)EW_>)X-AHuDH@>e$%#LEQ3j6^6eEP>YJQvftve1Dr@Q(5eCkKY&AygDXlfg zYQjTB0htLetmzMD;g=%FvQBL4Y{Fi1knF62rAt$_+jAf)I6qXzj+cip6*Yz!!hyqq zlmWx@ftmSaSeq(HC#TR<(8CuhVHeJ$Np(A{7aUx;kyaGxEh`ocOC0a0yhF4#Jf07L z3=30vtJ2U?cIP`?6~=9=1}JpAcFtQCXc^3vftV+9pEa{)X}1&B2Dud*e#V9;0_UnR zPCqPZG1_gwp49UC4=TP=(mj8Oc}Qf@rV+^SZ0QXZf5GfAscvRRar}G z_N+@py1%Iqv|=TmjKy0a`@Ll|a$kMJOU5=)iy<9Ab^?j631l7Hw}f?o4L#wj<`G_! zQ~Y#z%re;8A!tMipofl}=CdJVrtMvYGjg!rU{BU$_i}EO2RF1p0RB=Ss~;-s-w~?% zISMdt#{mNyqx&O-y*+cp6VZDfx@q6qzh!gy5d{DrVSw;>zz(D9D+6xq6|SMH%KiMJ zE&s#>2E~j$D9KU1wGmvnrJvQ|+@zQ3A3X*{$G}pEaoZ_8Z^2-TYY`DHYGL%z?0W_G zB1rI;c;>Oh#H!~NV~R)lFDtE+&g8ZUxQy4B6{kGj6$nO07eY(y+4l)JL&L3oNcN0q z4dTYQdnd4MFyEzdm4@UXdRwfR=>oXn8wwprm6f^>1wqE0N8Hzy@7yQ6}&Fl1Z%x7swb}Q zBTj(#@Fl3P`eB$~i)Mu+TW)Vfyra3aIvH-=i^ zxq4mo)hI@ltry7yHc4$L?{&9xX|AZWJ&nC<%cRlQBiPNtBS>o zfSzdu2#8Q^ShTDfva+e8)CUfWw0T&#=_v3}lm6+3DvU5j%)j|I|2H}pM$2)`@%%2@ z{CjH{@^_jKz&FtcX8#a<_)nS-JoB^W1MpS!foDZNN8l}${-F8r?F?r2J#hk&{V|F8 zp)#R}p9a!7LBi{ckId(G3;#0-{j(w_2DsH&_Gnet9+CDOR90%ZN-kbtd-1{Y zfH66hB5oHR`%{(iB&88WY;)#dP_#5Z#EVTUvGN} zG~$Lnmn%wO`fANd9I_gF8cSUAsSCWUp`_)SXz!Gb1o~rO&X$p}%E^4*YU(}!C{)x8H?R{ zj@|s9S$V+33Yu~e5#>}1_M~PK)B1{L_F4bW?S0_xh``t4Q2ChwQL(bK-&+Qo_^dXS zD{!9Y{_)6L1#GGO_E+_0;cUx2P=sf1?K;ftoCNj=peeHo4)k5)Z z2eL;OrlxCnf*n8-sKKx07JqR)`MObs=&~D#Qo^g1efR}EB1Wtb4rPPaMQ<{ z8KTGV>oWBVa93zM-t2Ry42U@ox?kaJuZfYHN0v?AFP;Ohn19(hUxZvzl>x*qkp)ug zbM5omM*xZ5DNLNgV=lC(dj`1{!V@o2UHGYF&{xKUk^&O%TDRu&oCVfcU@K76 z=kfr0gvUA&hhR<10unu+QCm*~$-&5ZO#7|eZtH}@`T5%PR=a9~OC&hM;&^+Yt9?9C zU>WQO9Vtt_x=%(B9m*g05sznc&XWA!QT90G6P66$+v+Q0ury;O|T zv8$2~!=@6KWW>_PenNl~YIy#R-_G;XUW4|!7Sz90XO=Bj&^8bVb2F=$u7`7t;57F2 zJm~fJb!Lt|>MvNNNH;@~$iL9jan|DVU;Ld9A@muf=uVG6C+%ZIJ!ACK*X~w8f{2w7 zQXk*@XDngyNiORmNv~XTo6jic&i5f~3yD5U5C8T-pYRDNIGXoc_+wRlT2!j9>`t%r zM*I1z{P-ObdZT5IPd|TrrQBiL!RK`W+)?M#!yijk7Yy1J0x!pfBRt|w8GILRl z?(#0%h#8*qPLcnU&=Bt`3!_iD5_Wzf&Zw<65c(tO<$n|!KD0mo12hOf#B@JG!`TjMDDdzRF?8`JhDN3d3P#xISv3# zkRJnbH%?oCS{;^kzA}!YI4bUVY~%LM@4@-#wY|R06&m)QH|;6tb~K%21^wcIeJ&bj zT-8_hPoaTw7&k!y>*-9m$YZlzE!m|Z;CuKJ3d;W|G=#|iE;P7d^8XPU&i0bDG3Mei zd{}rEQ$(2Bkh^ME~lJ_z4=0Z+tkO zOYG~nrUC-=3tQe5fgeeK8;3mLe2u($zoIhz&#ToHZ2HFo2zJe0?DQZ~|hk zFLlsQn{c5=Br}iPh-IEru9!|1^jMWzn|6bZ)(7A?LkfJ^cI?M zZ!|odHeo%$C=epm^j}g&Z#QITr>Dj6f(xNQz&t8Hn5UkPu7H+;gt*t?6D)(cU9=Xx zJfU&y`c=7oq^k(Z3j$8!Kw26sY9l9>-(x#=1c80OR(-tJXVc864 zjZBY=#knk3HpJ=<~sizthK%#q%!hn~bPp5h83HC03{a9wnCG!&$g-%OdrndOR>N11xB5t}x0hGF zu1@M&WcO1XJ`zxhgPtS}ki#_K;)18?_*kL}Vd29pcp8;-Zx#YmeOAjmpHs~?If<)Z zFH&-YKtkP7jLGb7AUk$afUQJBwoe0Ja{eH3?`lc99-EsOm#lPF)aJ^~2fnQKmb$RW z2a)%nYfv{ddG(tCO#pRjcKG&mFQ35Ag>&-$CB>uL!|-*RZvVH~ji3aySu z!@K+YaYGG_v$l8_E)sui>PXjf<(2h30)1Pnbi-P`r(Q#XW}=6VY_+HNQ$yRiW;TAO zUz)hw=oD9j_evQ@hfMWN%WIn}3YIT5IBMI7!Nq ztwCz=BQ7jn2h(0!{2rma2_#bB>G+0N9(Bg&D<{8EI=}g3lpHm7Nq66q{ib@pu(#W~ zN91JK!-O%EYS0w&AX7(r7nn(Wn5T)*UZ^a+SmzX{IFkUn(1E$*~q|T3c{`xqZ-oU3b<9Fck*+iRx$au|c%?lnDl?ibm>!f|N z?WqjB{MCTT44`lRfQ_W%%8|X`AYXYty_(mJ?WIA?oRuV1eLI;+4MulvQ`EGY4u!Qt zxEEKsKsYci+S^r$YVuWjUCQbN4ef?>Ko7N8MJKT2q#F$fljz@mzq6hyQ4*vS-1em`ocl z<8GC>8)4%SPf6eh9{;XR)c;QH=jU{Q)Q{N*W!|a12ycJz4%3B$MS+jd0bzwLKYSCN2;4+**j{&_aW>Qp%)ZU-GHCiAAIsXXYfr=Q}}tTW&0mz4g5FL{&Cj8 ze>3gx1P|c>{0YzV7i9)+<(t^T1&fJwNv6o6zQuw!XXG7FXHR)}+YbhL zc46Sh!eFJuP<6GWN5spg0M{O@e$-|5Jb`7>M z(;r>9=6$Yh;w?i**Ur%JlYe*p+^PXZrnB42>4)(e8QoMLS2Hsqh_aH;OnoY0C zuN!%_+_D(_`JBp}n9VU1FA;uCA+0T-sQ_xO;pJOARK?wLjliJbin zdCnk*9$5|cZtj4D6cKwUmZXG_$=_l!+)wcKGg(;-t?8S%=3=UU9W@aeaI8z?Q%d7Y47H?op3Rh z;mfKn0}C|0Gkb)+3*C|6ra{+GFGlJe&fMqZ-sb2ShnKK6W1aXFQ0*PnTN$Q4_ImS? zOH)QP2B`-&mx6rjdlIW^loCfTHw%JPRPDVCWc;{QKJ}u=`v8~`Ts<5K@xph-I8pw* zpnkufNJZ&Kj^)yAa3=y2*4|pV6?_`<3O}eEcT%!gw#q&L8CeXozDLznP|t8(%T4gy zf#c!xE^OUq^(4us=R66;jluW*N?(-EyY8DpsVX^`61YuJu14_E5)qm>(g8hp>2Iu8p^P7Ii}3see~&;ro{3n34Dfqa1GBtu?{Z+dL{H$iMIx z$}8}T3_0&IuR&Hn?vqkA5<$D|f-buK!oUIDt?_(5ZtmFolKBlr|Ee4E zkJWKW`UOUPYloir5XR@*TX9mA$1%O(0*pnASofJV*d<(0R z1ciLd(Cbwov}T3&iav6Ajgd`*bhn7~)_W}60kb+LjSrw7cFUC#$5n1CTW(mHor83% zQB#HeGm@TDuWjDQM9rcQr!M$+K2NS23306-M$knAEPg)TYscRE>+;jds1FLKilKAig)YIb zp;I$A;=K!WgtnEjqqir^l_Z3gSh6m0rS21;H0G5X)IcZGjPL)h4()z|#`|~OR*n#} zTZ2}U9;&VenySVwu2`NsViz~(JmDgZozs)5qXP1LSvC=mVq?|&%!AY-HKssU-UhKIWclu?dJ~ty~ z?C9w;980EuA-y+Qt>0*mZj?47;Vq`9!eYL05&5WK(g9qLv7~9agZcuR}UAV`(i0nP{4X#+P@(l)YEi{IZ|`W;aKMXFH~4`dJZ0W>`EA4I!VZ zTMXsTBG$`F8TShp&m_f5K~>Z6HSov5kCxRZfZC=sTslzGcAO#aNB}ZB9;vN0kB{|f zki+E@@;W))D3+aTjcDe+yJbJ&Eojo^z5&FXw%HJh-5jth^Y6lq*T=1`{Jy97tqy0F zb6-+ZL@zZ;W!d`!T7KNxn*XhEgW2V83$*xgfy%i=Kayzwp7?XVyHFk9n0ucEl&_Dr zz8}U6N%*DtJM@1_Jqr8r#d7Z%_= z-e6K|^ji)Mz=A)djtOz}(RzB(>?y-2f_g1jUXx&T`Rn1n^(bBL;({ilIMF09HbhvJ z1nOyqf~?tA);rD)A?Wo`wXqfUB+0jC7Ep!G*bok4CgFGGQuPfY8A6;_07E&jI5-ew zWTYuRg~@DUJbPF&V|RMtGWIB*v^rfkp;HoN3u4kC8vWKhyVA{mMSYw?G*a9)2E+VoGYjAb9$@3nM zyEz@KiK0uBpFT5NEYYrB3zutrYdgc*)cq$HMGN=?;XCfUmCurP&YZ z*!Z4QXebPJdHTe0Tm!m%p-0%|exV>v!a|Nd|q?Xae{NuS(_ieUj5V1p? zDQW;BEN~1Ll`0|&gKelCY{Dk0e3kMl8S)5<>}$TgH_`QHL>bw)-z?ZHE{~1w-toN;FP@Q3uf>XMMxlaQbEgA1CfG?1 zp*fNkH<-hpmHiqR!F$~w$}!haj6s@h#i@^+DIE?l?bbby`f^TF07ohWg{v+soUzKT^2bodB znW^0BjWOuHriQB@ChhjYS-lki0j)RHKGn`Y2>iK7(y-Yt4xQq<>s)<)3?ms$M03ML z7gm^P3H0)w9P?tBS0*3B0l)`Yf<;xIxW}6WxyX=dq4BanFX%mcVE4=)tF?ORtS3E@ zt}jO7yu_w$CFl|wDIMU62-2v4=leZCM5>$_8DHV8DI^Lp^>R?Z@Q2^J|ko0mD*R~t6MWFNi$9#o1}T(RXrN2;;)X#}QZ%k^** z33*WNFS@=34zMX!&n@n#+36*+4(*OP-yEK*_^$cdX_41bb;_UQXhesB8FTYXuMO~b zO=X*3OyT{98Yt`|1n{@{#%qwcy*iI{lDNIPKQWaRSVm$;O?5ZEYg*!x3u3q@0G#x+ zZA7{^g7da6FOk0OF>0b(tN2zTj?Uz?R2PnBc`6(Duop=%OwD^M!YLf-|l}fnrH%44V=l7V9*C{AHNI z%_udqQOWkPzOuf>V1WoL%I^0-W@X0}V<{k+mcXP#4SeyWay6x4fO<*Rkcpc>itN22 z6m4m2fn!4$Gy=DbYuEOl4IZ4`PTm42Cv+7BAE$zRUjnoK$RZQUt5B=jzULo` z)Qyik%n7vM?+IF!5Z^UhU%)g%wx@ZBa1;@GnhwNe`c)4YuYYB}#o3=C$@_QjQ#K5v z%~s2q58$0}Y&cuR`yW}t&HvWz?C(RNaWN(EZ=moK5(57Q3O^ws@DHHy`kieD@RM&x zR;6$3iE-efSEuYzI&r&$#ud9y%CuhPF~2EDjS~0mzJs1(PN$-h z+wf3er^$-;mSQJ5WIhkd#^MY%8lA7(u!6wED7zJ<`965&Tg4qzYeO&7*Mq)XFQ#H9 zZq?x=5@L&x*g zC4KR`%s$U9|65_jvTM$ly>zNSu5KlZib)Z~>yC!!hlhXa{mg*<(p!am5n1_>hkN`o zw&(mWy;Wgo{KCWiaa;87SOpalx(!^cA(HS7$ywM&5ddMmU!G(5{9FE4_RF2>vS`5t1* z>KePTlU};rjCet=hllNXg|99+YO)uu;N7gnP@nK^CV>yF;q2@Av(HQcwkQ1{MF zpW{n{7*U*rm7IJ67PLVSSwQLVK1oW}3Av#RPZe!?Eu@1t-b44`JZ^&lWo(mmnQS{I zA9uPcJVX>B}C7?iau@P$p?#c~}u!*>pJRVFVQYw<6552&sWzwGf&k}L72*O)gUm75#P3DkE2+aGeIySLx1*S7d?4$X1~ZdUge2ooh(TKhNgiS%hFr{DPrT*>)qcA?1qf!oclv)uHi zezixvSnGH3No=seS4_2jz?0hr zFnL8}J`^**Mn|Uqxpe{fwRhorSCc4AcgpQyE<+y{XF8P$8A~!2`ca{G*uS=-msJlS z?+SUdE}}%%M6u5FwTx7zoAA3>RMMz@Iv^#kfd@l4Ng29pwj?;tqo-!4wlGeg0q6>+ zYhK$C^WY(XlSv`r&?>_-GdV+Ge%|SZ=(-`BJ}+|A#TTJ)iU+V5r&O%?{71EUW|BDW z^Q!|aWAF@8Glmp!hQq1Z1k3pCqVhiAk*HYIj^K|CRd46wZ+bzry4yoTKPQLTT4(A2 zdM!1jleuH?0QVQh8A8R2@%xxmDfLoovgK=X>rB^edp25m0C+w>-;pXQbothe*7T;ynhNe%-@9@|9NZp zO#4lBR{rro|GYK401_aB?~v~mh~S%b*hh`z2UZSX^2w(`=)27=YyOj20l%Bp-lxVVUTG}SBRl39 zu{|}K@UR_XxfN(_#7m%R6Pp^qEFnJOQ^fyc?mxC9H;ybT|xs1 zEfV7C@984DDW=I8{&|1rd|U>ztD?Lr+}tC~&8T*I3_+9A0%<|~+FlZh<5l#!&Chz= zGK`Sf6ezsqh?|k#T=96^xlA}bF!%_R$;=bs7v~AF>yUgHQGLeL17S@$dC!EqV%>%YXnw9rYUlYyw@d7X9H`Qu<{H2{xrRTGRk%b$LBFXAF;Fz z@pWjcC40P2&t6nS%!@yPWGS$FhfK=6x;&d#928rcYHHSK9>q=Px)V3Sjwo(P4m$Qe z)MO`L7Yq&FM-ag*2lUV9y2W$?ZSG*gVqd#784mju8~K zG~H#?OIJx%KM|l^F$B5eCo7{+)d|Q*a4Rhu%Y)I@f*uID(Q5RTtok#YIo9bC<+f1+ zQBI}XN&PH5nf6uO8vkwjAlZu*5?68ky4D0UWVq5 zPt=&aL_^?~gxw#G%sl&2Vk>H`sQYP-Z<{#JV1<_o1Pw|;iR ziJsjDKJwL{UTYFpS!|17^v6a+cnyNBWx0TJ1yl&1Z$FQPs}^f zia2eK@7UXyQ1YN1&xW`OS&Y7F9ZI(eqRAE!cEf7k0F!H?89dlNNj_n>9g?4db@KOZa$^JMql|>D$7EPJ zi#_1aZ1?LYVM*ql;};jtZEitOdE!lX0EVAI`IGU*&saB=9yC?&=NEN_ZljkX=W>05 zo5~Y8_24zLvP5K3o^+ArKim(3g(5KfiWlrho#T=hR`=X(oqElJ@|ZFzO;$nT9HAW! z_OTruDw0ya2m}g+j?pj9G;kU)e#&AJLQ$Qoq7~sOeAGIsPBViL$72kvRMZ}NGzK`g{Z9xE&Hoj_;eX%qw;lfjZ8Q!dCiZ?kNs15=&ElEHklr_CXoKof zs^Vc6&}?;b?7}qNNIYY&*Zm?W3Adjo&yz0>6p zr3B6i52lC&2eOOAt_!l69^V+xt;>Y;;dC35=Lmvr>l?^DjzS;?n@S_O(d{Fp8a@Cn zm&xPnz1{m+cx&T>0ipzBj$%Qc#MYA6*~tNQ>c%0O&PfaiA1 zBeMey()}8?949f=L#XaqWasq_F}KTXasIVUQf#X%abT^yEwZqMV{9^p4YYadKS_IM zBUGVd1r${An30gPJv~AX=hk}CVWOkZ-lFM}(k?=*!8Rk$%$;acbmOoVQ34`6^oDee{YZlxW22eUzaNrQ8q}nB<1yw?N z(8|nehupk|M(n8mEALg19=QVq>-W@JPGgt#CoOxMv}0h`5{xMXt7DE@PE}uXLp3#h z)9*w%*YSSQ6E@EYauLC&_2?fkEI2~<=>(Bqj4aZCtd1Klryri|Los;N(ZjC%aQm#U zU20&6L*79-xcp;uDDhChW{q%7od$%E-k+X@H-OIjX|1tN`Y#fxe{~-V{Q13xdX{aq zsb>^A26hpH1r}tl;TaGA++F?`Z8UwW(FmPV9gj{`NDoqK7zJw+sj`BV#+HF6pk&he zbWjWNFnAGq6SX}B)rtacfCw?jZG#%eNxinbhY)0lEJ)|!aC@^h%IO=^$( zuv^ZDG|W=-R_QATK)2WpB_!xRf0`|6h2FdIVQ;xan7?+!E(WAg?3uabXAi#^F&3e5 zO5I^0TP*d$3@F7}LuLi<%O~DI&J%7J9jm;(RX4ecl;^?P7j?6VK2udzsv#lGQA((G zn!KJbd42(F8~a6-UaJ09g@BJZUBa7a78F$Ev?6Tpmr~hz=?s#Wkj<-ZPA~G<{_+L! zv^@F=WSlAS!je_FZWxm*@OGtk=V=`#u_&^Az&k@cSx!_OpXJOtFgD_J^Y36gG^3*0Nf0-0`~ zzHXuyEO_)80%2YRy9a~Q*L!lEJtZ*m4%s|RbE)yxJ|@9~?Q~9A{ZwZk0id|cKT6QZ zp6-s^=2OWO9r=e8j7PHJns2cAK7@87WKeEfaGgC|HU%m>!wS%4c<7Oo^Tob8#aFtT)P3| z%UR~f;vWL^zr+Xly8!(!@d5rWK>tg8fWHgS{}P|C3(G%SWc*+{R9{R7?u+SA2@L-6 zq4yCu@)$IMNRS-l#{i3)dpXk&ns&7p8MOA@6E0NpXYZ<3V()>%x~BJ*UHFsNc8=DM z3(|?exMg&((o+U_qCP<766L`)-#wh#PbuNk4N2E#dJzj#^U~*fTRM5IFsXpi>yT2! zCNxf)()ZwsfK8jsGD}KGk~i5=x;RakV>C70Ipe*NR(I`W2s0cn+0mhg-d)J2fTkud z4<9%YMqoz3O6Zg$JA1PQC4(h(eutNXtRKN_;@zz|63DI%MH!||jjO7+qAuRPY}I+9 zV?6Li@Nv2y!z0EE_?m3?^$gJLGnj$J^eSltlBTN*kCidDF=Q1t&POg^X;i#pvYSiu29b^R(HMEJD!d?K5*bi;~$&G2zG$;MO-a7?;PM zvvuFoU23NMbrXnNlGX%j>KT^N;K!cVil}+H_fU&nJ#P?oVm_$f1F(owwjq-oiIEwk zc9R8L%0aw^X>6UC^Ms(47L#SgdtkND<_r(i$A9s??{2}n_9MW5>{wC}y=S#V?q4=> zs>ccYe|XRN!^JH}wJ4>kuzLDMaFc*~E#NIsE-4WHU(V+KiD{?rR=U0idk`H0h^%qY zK9u2Y`sj6kC9L<;aZ`@584-Bi3+$!2h`$3wRX{XH^ih6R_8X1vNB5Q{9xt@w%;B6{ zN|VvvLXA^C88gHHY7*xFvd84R^nA=_jBMrN#ZlTLRjyxs|5`_f%!#Kco?)pzxmY-L zXeXH+@(H7cS~Jq-7?6&rVuVDiMy@mPb;L{lU8FU1cx;lv24+8AfzTeF+4_KZ@~%HaqC!5B5r*91|Qj|Az7f?O-(PnfTTFv|5?i z$(Kl|0Uywun~T5TlVsD2y)9(n!_?lUk4`? z3JHi!ID|~Ar^u5XgbH`i>W1@DZfOTra*t;dmV_Q;*yuu_1#mmlY&ANng?;Sk_Vf<8 zQb@5$jMhi$TtFS}t*Qx7-F@yUFkBf?8mB*jBI)tbNFzSOt zSDBQtiR3azBgSg(2vBVx7>kexdAD^^zxPjO?=Whqhetdv0W^;ZDLZtVc;Lcq_|dci z*<-M_L+lGnUm!+OwRgMzLw$Y*xps1yR?zGzU=ekr!Jtg&zA}Tum5&^F>JX?983wll zY1y#EQC@12=8_^uz75p4;tEXJNv8h0R{?JFIF4z42)z30J5KUju08ZIJ~y23ZHsAA@C0b4kJ1MJ_JF{394zrZT+4Obmsl@&qQ{R=;3k4eANXGGyQ?ENmu zWuw9Vr5gL|^A_;y`_}L9_CJZ(iV*Pj#iGXj#e=*Ip1BRLI!w<-fnQ~T;HUR(QTbZ@ zw)PVT7~gLN>s$KxdWky?$qtDHh$FTB-F1Z~ob2y*^HqzmdS~p010T|lD-GwzXMpd< zHQ!2wboi2w?G4WU&SJd(4x*|!a7*{z4MY_xjgig?d!la3ywoqLiV4D_pVwj=wzT|D?+Ua)1#jAecFQs=@fMNrxXd-P^d4|Is0D0=~;}5mgYsLb=nk z@p(Z)!s%ED1(GWbL>n-!{Z2;Y?ez&*6;m>qwj~qe`$>V#i<5t_v;z*>s0>(U#BMdaO#Gs6hKvj8q>OG z(@1fUFToU+vyCN6)Df8!nCNk1d?5ta)Q~ndjU>Xc=e1m=?C%k`W+$+>R0K8Qq>VUA zKZVap6;tF{nIZGIEuH#0$7h@iu*Jh?u@;|GD~8&XqRFgvy3QW})gCfcXj(vDC(h0qmTxV<(0+z7HkXujaAfL(j#aVOE z8>tamnSQH1bHRvGtkU&<-V{u~pasuChFu@CUF1Dih&s@LIreeIO-qyExDb%a6C%lF z%Un`t4TvxfSTbA*)8{3IA!?Zb?YI=2*Ezel`A8+;xR)a}O#RYahb=7xOiQr?)&vYl1=Utt*%-zrGeIr&VZUr*8*-g3Ty_Z` zkGst!KX0QU3L<$Uk8y@mgSgjvvqudegek!k0dZkB5UOdIUNRIOj0~^50eaA5xUGw^ z8Y5MToNcg^0GE6-KI~@^VS=&MvT)#tYOMHMq7P;;>N_Tn08#7 z9ldGqxcNM-YAlO96+KX<9|1lnF-M7xi*dn7L|*t=n1S@1O1Og)CN#!B&gcAw;wm{s$ysXZC&=m;eh6DfJJIry~%f0kg;q4bFCV(4OggISmNCq z=QBM&1=iK+deb9Z$_L#m=C(B<`oX-AG|^$V7wy`_RyVia-@vKYcjM#`TbCw1thNRn zd;gJC9uefz3er0wO3AZR4C;2sUZZp{hdF5m%aU6M8lX2+4(c{uxig5>l;mW>eOrM( zHKbe`YlR*$IEpZzV`yWsMykCOFL*Ju$Z4OHYHgsew+pjvJFcX0eT`-?B1*Q%WR<)iEnc$7xXcjBs=vuv@ROH z1S*=cx+p6e7z!=Xb}TFq7fID?W&r)zK>54;&=jM0XzDr!UHMg6Bkrl0O$qlf5N6gs5?2Rn(y-*w8 zGC`2d;%D-2wBEEY_Xq8JDIu7WRe(QHc4v5w-FU$_SmpbZo(?!6@q2y1-`!}g{uBG6 z#(zV`KPVmg;%tZ*CH<@`1yH}F?jq}inERVN^$<<)^zx3`^e+# zyDL(+$0&Ve9A3r4yUO~Y*BfR`e{sjS73rLSI8=7c6FP%4zLTdjO)@5h7YNgPSAY5~ z{oY#RHhAHO@bUcT5B?V?u1e#T}{|0csw^xqmg2lU-2_Bb!kE#!abTYvSacJbt-EYz#22tjL25dmk7Ty?S@49arjtJpzo5{a9H;Ce__S zI*PlQh&KK^fiiCV#C@AwkTg)|DTN%a7w`2-STq@SAD?L)=>rdlygM9p-O_A}&`HN$ zH%GZE{|e%TUVF#jcQDqTXMKP!r43<+`csl!F z^@DGbY?arZ>g!49iZ%AgxCHJ9i3AQzS*Cl{da$D`Oyc>gfWwoBhIb|!Q40%~XQKXt z%D=Q&y3Sen%^CPlK%~G9Jz5H_lIzqw6*+i4d>k-KqSAa9;iq)wxf-SqK~$MT^xiYt zYwef|mP=Jj3pNS_(%9BHWdqw{iF!_!9$@w;T)G&Zq9MjuO>qi#s}s)=Wmc)&b480Z zg)2o2QtJZ=3s8#WE8n~1Z3K_%_MIdU{*{{N+v7L}>wjc;C*17dFEaf4C+&3Li;3Ja z{tqUy|07xbAc1~MgWr?0A^$P!1HYwxqk2U~^$LkL#ndCk)cT9P@jdhR!IgwWn|MO` zYkl`Ek%ho7nM^qhKK@-MJH9w1dMj)Ow|?)q-oO3-A5CNj{P(x3uYs29c`Jv}8nDrQ zynT!q z|H$?deZ|q232;-m>;)uY(q(KtmQti}Kt@p?1#j#bzSDvDE3sTyipi37OaF_~A27o3^hHH`5*E$C{c zsK9v^eUP0vNto_y5sqJcNNQS}%B>djpc+XEu%zUpB~Q0|@3S9cZ{ZdaQXrlKy{{{} z1RuWhvuq-Z0kp9Q&Z}q7?#R18Y8fOZs{v@7e<$S%KM#DWWcIn-jigTm6p&yclGGv_ z>!<`EDnHv{tn3ENtru#nKU{}^mFL*yC&spali8PFx-CXfd8Pp>=JEB%^2fjTnf-Fk zZsXJN6wGKD#JKG%Z2v=^ZUo+@GfZ0IRYoBtvv<<)#)G&^r++d-da3+7A>H1`dAaUi z??;*IHna=CCxj3A2Zkgx3kwX(G6!F;O3-Gz;f=7~GCWhc_Rr>WfL{i4I1k~u138RJ z+jt@d8;587Y7QRBHEfr+xhG0qDTyg6=O=rKU&W@NJCcy8(h92q<<^bm!czEN+N|+1I;=*n6jI7yNUR zEQ|3?a!{@VZ z_$_CQKP*I^jP}wC_sx9!&wp|b=>2&nhhsnYFPH=TVfy92V2;K!{f~wKd3K5Wo%Hyp z+?qOTm>!#vj3o`<_09>s$H+{`6fc-DUd}Q>yp}WK7?ZGLoTwm7>I2c)wK8 z-wSBqX8`nf_@i)e<@m<=D~I9&3{N@DZ{0-e-_I`~GO+J!Pw#8(sM5z@;t=qcK=d1X zK^IQiOG3Z;MdbI7-3OqfXP2Pjsz*+j^~n7V!F~fUW{j_QWwgv`H0*zTlW#u`ko5GW zNI!6dOhUWLqi3f`^q$J^ziP{VyBhslP;!|~5dz-ue(u4-GE4(}4KgXVcjX+J`XYt* zw@o5JnN-S4wVbpGI~k{1t}Nw?S;KO)k`#$oNs1H8KiLgnFMAkYJdXHT68k58O~ybD zwn3p_$dyD($!z|dks&83b%@Tu;pZksgpw|v4We~2z}}RhXuk|H{V&#Ue;#iHewlB~ zTjE^uwst16Bv3Qp0Ed2LOJ^n`m3(9wt3RjY z!?vm9h5Kw?u9m}Tk%sbz`9#!~Lk9GwAZQ-?=}?Z47$TtdGHHue1uE8|foC5qWOBms zo-^ymyRWy5u0QI0)XdT(+m*246;#W{D$R^c9S6;wBNFCq)@%Pj*ea{@gKS~|n#X0%+@w^$#@UjbddOrLM zOPe{3_G=OOT5JC^U_Xo3pR?fK2JC0?0{%(Beikp_p9Jh@@dExXU{xjj)oaTSSy13t zd1bQJlM5wq;{|F7=`rktrL(a#f$c0R+KXl=>lXBRaYahsu^nrZTgEE_d4S{NS+*sn z@lmg)g0Siw?AORKjNlimQ4am`aDyw$Mzs2HV?n?A)r|V+mgO=)l<)~;oCL48J~X5r z)a{#F)7Et!)cf)W!6eH9L>xMxsDqR!u1FP)zKB3&4qxr+-zcXh|Lc%QdDT|DH1+t$iX!&N_W9SZ_l@4XzBMtc}%%q}#G4_gmZ%9n^&Y~0tl zgj&PMuO$q-ovjh@)H|U~nvbwKHF}H*;JnM5g!1NY2txBkDxPThL@Pl z$dbJtR?Z2eIZD~WK21->KR50G1GB$}WUL<$mvT3YqYpW&VGI07=IdG`PBsR)EgzK7 zRSL1hG$oI#_u2Vw#SKg9Wgw8vclOXc2odas4SXhVA8abAV?@IhF{ucBngu>7DZYvH zzf(;9GvU@@o;_k?;Ai&U)>joN2Hg@=KPBG+Rf_-f2K{$+5%70~(f?8x0pALvr~C85 z=)cxQEpq@r3M2m?HtSz?Q3eCQR+5Op``7aqnfvp1h2+=TlmA*feikp_p9Jh@@dExy zzs zpc*Ko9(zO)b?ckz^@R+|2$i@RoeMaYLa1?jxxp~YEr3r!;#7wSl`+7Y{)S3S06egn z@tL8D4252>abbA}3;KZ3QtR(DCnK*(Z<^_&RW7p5sXWR{?`j_x4h91m@D?DZe0>Od zhl!#t`ts)bi;C4;gbXQ5ksy+EshMGX4F|zVOqaM^G-q&Aa6UYBe!n1=S&WbA`ZN^g0sQ9qQBTT4Khlna zIg#^$Nqb&nb)cHmgL>|^N*0@#c@+AZ#4)Ab)%3Y0pX~9ro)K`Q#)l5E3w+Eq$o081 z?)U4H_Q_Fzx|C^JO~2Nbh|Z@`E8(;ACm~&v-Yg=jCvlho&|sd)!5Sw;;T$3bL!9vA zm$m5ddaTOY=8^hPyj!6^B8;#nH6B4gE!)$)HLxG@9vJ3xdUJ{_qXOA2RM)>DgY}Lv z%q^A|-7yR$`jSCrODAE zC}tM4b~v2SXzQcqQJ=$leJRfMh9gk9X7%WRCw`GV!$l3;hw=yRn)%Mqt z+`~A^;!28+L6{Y}ru6VPgj*LNe626=)#6P@n$o1QmBLUXa@(b94<8AWw+9azT|!&t z60f-3rp_x-&hgOM%f3Aqkd64MbxE!-zJuJ9Ym*6G=VQc?esicz}MbKis`-cVUb|Y zo!tPKKK>gg4_uf-qrwjTtm;o_{1e%OhY|3c_XnKwuG^?*^Yp^5AYz!bql6ILGdd%o0Fs5Gsuokb`XO*2Rk`^hTSM&wkgydqz_BTL?qy%~| zAHzzXv@ymkMPi3v<_td*mCCC9vZmn8)D$n!$!p>tEmmfNSMP7Q7x+B}2FOy{dc}iA zoc+Y|-q|FfV~<&Z$?Hs2HaP8JCAiA}PTO2;zD9q4+=3~k-AB-emC0fJY2gz8t}6q+ zwPiMp{|?R!5 z=hr)hubGuZcD`73zhLdxKjK*T>9Vc|)BdlO0}Om!4z~Sp)nGywR5tK8za9PcyDpv+c zZ;cH{MQRK16RBgKy)vEX9OpoXfh%04xUBGXkVP#;UMr1rwhKW)R(0463camrr*R*B zX(F}-ykQVFWT(dtJs)p@(@1nOXKO9&WsUBog$j_dG#KvBd1<(W3TBO~YiN1KJzpZ= z4ro43Z#}gxt9+=$zT=R$QX~P>G7HJkM5X?jpiIo>#U=hnheKf9e6lmrD!! zi0uAIw*h}SZHgt5LE-m1R=|A79WTg(!hKRG_^Q|5w-i*ZUiKL=Y$72jknEC!qPToW z5~DB5uH)x1(E?@Zrb9?1dh*-x=r6ZBhNpwU@nME~-mt^VcsxHj6v{_8_q%RnnDhp840bC$_Y5H^T*OUy zv{a|8y%a;@C>3_Fhr)s9NWleM^*h}qs$%o*(qIFBN>afAtt1z_emgpGQ#{Qql(V6G zVG}{w;-iD&^T;rsq7UovPjSDZR)D6($9NuUSo7yd`owy z+bgfSbAErl2>e&0jlTqM-f@Gn0;b0~hWg0z*P7fhdc=OX3I)>o(tyht2#O;_55=m_ ztt#i6I;bW}m%MRx*CMlV(gVDc(<1Aqi20#qVnL%RpSE-CCT70h9$h}?OQ*zQwDy8+ z>N+yx0G8gmOa`kL;Sd3EX7A<-hB&mgm~=`NQer*_j35(zVxJW4hSno3S3gUhgAV7~ zMh%eMOm`;4#|K$1K*#zHk6{BX`zyW+SWXb#LvNVDZFd0|v8 zLFP*W*G~l~azgHNs?*V3#B+EyAXQZTOY_?CkZ+K=NO;(*vp{I>4Au$DQVq#pqCNX8 zFFuqJKr`BHkdG464rk5GUA*I+KE}%F9PssioR3%p?ZL*A$QY6F0Pj}_SiT5b5@jNX(qq#2r5)H)Mjh?G^sWgeQiO=hz*RF0&0p z4ldkxS;}+Wukqb0((-|X+RW9OTdwY-_lpc-n3J?Zb1N}Z_Aj0nbok@B?r|;wP18wjy#IgUYpOv~uud#A(CW;NZ1ObY*}0PcBz zdcv{;`&4eG{(i42_5K#4^p=Lf6{CKYhV=f5oNt}zo?O4W;ydpH5PyhWu(Bu6ob8{# zdeQ&H3I7iYoc3Yx@d^B1g7f>f{>iR@pKa^E?&^0q4E(nd*QFuC#aS~7dIc@XV$${T zVjL7aKWun{P66k&B?ThDU~%cq(27{Ne?FO4zG1)k5CYDTxGC;An?Y^5(-Q6%yk6bg zZAt{zRCEHwSNfc;#SE++$5-~@Jcz2~!7GDwMoM4Wd(03%Va9Q{16DG?eTMc@q>O3Y z?6qw%zz!|#{?Jp4R%Yj=-L3ZqmrXk6Np`okh72KL*LrDN-?OfhqTXBiJof<%!Bgj0 z2XLv4hq`d+5R6li3aQM>7?An`t(>80TwfO1Y_~gCNoE(HkK~rGE16pkMqw-kRS;l1 zIdNjU6juE0_pZpn4dac)sWi$l@B9AQ84eftaTPR%L8N(;$=P}4d|aB%>wKwz`*Pcf z+cjo&a9V1#qj1RQB7P(yPII__BF0%X^|lK|5a?tJv%Iu9lN|yeQO*HVm zi~h}O_Sj`wte@EMp6Mu9PxXB9$ox`|=06zl&tnJv^22`#+MM$c6z(PP`+>F$5O7dQ zNjiTJq&D)xIFF_|iLX$oIVo7?DBD!ukgrY3{rn|Clql$NYg6}@OC5fw91v~y=ya9* zw3P$bPuN{WUi(0)v~kCR-aM4;HyzO%a}h}}!JF=d#=0fEcwH{HZaF|Ihvi}{4=Xw} z8y7UG9`hLsy4g*yc)YCseB~+{K8iKqs{YJanwyTet{k(EYbPlIP=PeY;Y~HOh?w20 zGbwrax)kH3(S~{3u)(;GOdxPDLcnLDVV?H{QHb?GgK3bo0p6c%T;D2|HP7L^AC8#n z0&|4meu@;gfMdFsP$*bdj}}$M6sVldTUt!45aC;{S`=_B7wG$*NTF4y;(U8)yf5r` zGI?44#4h-qEiXiu!m6OhNRDmyMT3)9FspOAAJ1d~Pk{(5j1tj6H8p5qd=2@@?rlUm z{Fn+D4E!*V;lyPH`{J1UDoTWe%n7@6T*5$dfZ>}ULL-myh3?3_R>JZ4s_OHxT;d61mAsyMqew5D40tnQ6I&Xs+tjkGu7e`suf32n(g(}Qgcj`>b;PaKr~BLcm^xQ<$0S_+@tB=bIO z8{pGi9kadIdUe73!6ke-g!ZJmhCHU8Yq>;)8<5Mz1$F!F0eG3t6=S3A)MACs5H2`) zuoPDqrNkW>U+QzRrR>|>@)}g@Nn~#HC|<6wX|PpZX$QByUF*MlH+-Zc2)1O*$1Ow$@`#FKG(05SAt!KkGR82t~Nn*K>>f< z^n+BgL!Pm=u?{3@^%0h`N& zUTuq^YE@3gR6;?!TBZwf2&$W=lhG(}mBv&W}mJsKK9sYMFAS%DoqrwV>4sLLj7FT+uWaB z%5}R9heE!{sZc#^lLh%;c>+OuJKYfy7yQ{wf6q=Has%hNt2!TMSUD{2W`}0uVUgqIH)yMi8 z9#g^DZqgLsh#iDZGJH2UIQD_|ni^7BH~R3FxT;3!{Jc7BWz8B*h_USZP`zd_jr!Ou zD^eELi;7&Elj8eQ;QRiF%IH<6O=_ixDg^Jp?`Z|4&Mwkz zzkr%79}j3|1IKB&uAh|3Kdn&@scnm%`f+!;5lLV*jN<@JK(fC^c}@H(y6L@b()xsC zdbA82pk)0JqA_zH*p)+DDMq@D9R`09#2z^&l-C7>&Lj zDv(sAVx9Nn@!Uk?NjHrlAv}Tc1H2Sr(8*_z^BkU|L< zRhdhm!`;=vIHAOB_F9E*hkwd0xKK;9gd5&IQ2Oc~=ZokI-4GXF^CF_I{7>vdKtgWP zK=P11XJm=odX%zlWRZld9g_kpqpY?&;4%KzUE`b zD$WEGbqGR_-d`v4p@>yL=G$pQRv{P$gK5>=r74HBp#8$q6i6-7_*m-kwC}8U-U#+A z6{oj?=OFC?v}09|W&i)i-DM4*Ea$)GQ|RWOi%tKZjhsMWHk6ev?jM42ArI3ksdZz3>d4%I%&RzWuiIxHditMilq$EAOh*wtIO|o3Li< zoq4LXkcjq(?-9uPc_q%V$#C8^tgN%wtTFG^U6Ob|*C)!7W3}CZ8i2j)7Bwmk%9&hy zSdMdh5>5yx3q89S&MK+W8XNTP-_8~WTTa_tC95B)P>bi=0@F*I;pG$^GoTU>EjA=r zox%J6G4~$LZyVbe;2vKE3j`uAkuyl-utOqpCgP``k}TPlEWhXf^Hj|&RK@Bhe`$SZpe-KUBwDeNzNZ1p^FH6+<6E)$~h4SBvMiLV#zsm$}L=x6&m z{@;qb8w6=h{d~LlprN2TPP6B$XI7xre~7y*q}`u~4D7S?MxET?=p*b|ajs2_#s@LT z7Ojw4B14=lQbjaP9@}AHin`}iXK!;fEKv%L1_i*qS{;`Axi?SS5|b8=<5{3LR;X` zD%x1Lv=biws9JkbLwgQVSCdK0D1nR7pTR=L#ExEWX6+J9zl%M@YAW3fckDdhADY0r z3a~E@Oe3`VG0BTtI!sbSQn3T_rEnRvmfQ^HzOYsIn=WmVfx?1H{RIt`IQnoOu^8Nv zv(XEuUs0o`b(u`#k{=BLoVqZ!TpV%yUBBlgd<7t3M5V?S>+nfLm7H18m-k*pgIM9D zaU^e2QWMhaDT9nm8*rapjMZ#;W@^`tnn9h+n;++J9||sY!I$i#l;afiEl@8k!_lg= znls}Jq1$N`b4oyci3)_;6s+T!_>uQMc`!1x>&tRrN*VRBxg_0zK^p4|vp_M|&Ly`& z!^vWSujl3iq#nA#r)K-2<0byRtmJM7lFCwO>NLcJb-q;|$hhU)?!ze-B^kFOiTiq{ zlU*@p2M~eIL^~O|eh^?E#s=FG7K*DNEicE7CXl04|2KUWoXc@cMEnqUH$`8RSJ|m3 zOviuKX8S$J0skiEehG5GucMstk7DlExchHn?w8d7|2^jZXRaiGVXU`%KV{?UwJ~yw zi^{4%kW`{eat+?ZvqB7&JR!9cuN2hY$o$f7!Sn2K`;ZSp0-EP_zH11YLn)UOTVw^% zPwRbF2as$TxpB^(z(pspt^P!U%eFOC5HKQX7?k089R)D1_*?Mn-^!Q#q>0Z`PC|?v zx>b?r<2M-V&yfSIi;gSQpfzfo2D|}UNYpCGE)xXE7aYF=;s@{8zk=?N$IjgBb&Zyc*YN$K4-3H`n{~*aFfG%(3gI9p@f$$>{D4n4(HuWG7z^= zdEs|>hS+DM)TK_}9IBHd_2rLHl0X3yA znfPl{Vaw_j*(X}_BVPiAQjCiMzKFl8oy6|oBL)7%4vLU zk7It&4FC*RzzyCwO`drKe_Gl?O`V`KA!?U7MpMy@4Wps7R4iY*qxsxMBz7vsMcamiI5!kp_U<%PI{v~%>G47f7@YE*8z8mO zbB}s)_0Voe>u)-2ztbi%A4OCU!!{1V`VMEGWZ=*H>ra#Xm&qUIzO`h2)wR6;xM>G? z*Z3+d`}|5gXB{RoeqGu>T^aCqOZ%rQ1AZkK`)9pa8}^>v{-MJZnx45(fhwhcK0YZ= z3gL)t22hf6>KRLDFD#jm>;9})h{K^5ycRo05q?}bId&~gek?h0ANQCAxtrL#6?@p5 zY73xx?)K33PK7%%&(EUMC-1@UT{q4vc8sOF)%d9Sos5|f_cd%gLlx`;e?m>kgJ?NjbRKM{e@eKZ5W*PXVvwVFOjA_b0 zbe6^J$3~M@6@Q{${JO(|-yOe%qk3pohW)L7_DgU$@;`)V?e&npo5!jCZXUqb4}VL8 zELiwQ&3?c2`tb?BB{9%sM1#Sg_TKli#*8ijCq;&YdDVMgupF9_UN+X}{e9l~eSQ=T zB+NP@lI7}|IN2xQykO@d*36X|d30gTFkrv&AncJlhR1ptiSXOWkq_wEIn*T5nDp>X zmwSe-c~h-C0Z6bk>(~;0(_-lnQMJ^iTKf?d zOS0W$xdg0(_pG)uu0Q@KHGNE+f||%m?fKjhZ5F3tdCsp4jUJ0FED~4A0yVVySNiX3%+K!%foc6qdt3fI^Hzh7Lz=PnM z2=P*CS@y*pDvNBf5sdb_j!2SVEq@;*Zilfuv-C`qybdn~;6a)1&h-4tw%Nh3^E|M8 z{!RPF^O72fGRf=0BRECp{eJJ#K}e={sl0p;D4+mpWgVSOKn@Q#66wo z8EvF?sl_THsCMj?T=m#|iqYBS>`+JE0tQzfdPxrO+RWit!%H_1b=rsQZwc~}-V6or49d{bxPoegwEY|qjR1x?`SuEck z#w}om`=>0n`E3mNeXwDTKS|We-RfhJ%S7?5l{C2MU zY3@h;YT!Q$SRY+Ju{b-FwYY~&NhZQo*9BzxsE`GpTGlDRE>->{HEpo$w`#1L1BzwY zrj<9ZM(O28Y9cLM?1-)zud;y+jUYmVjJ&F1@$Ft+pp*-Pdx|RDPqlv11vtgy18axQ zt>5e?1FvlD0}Hty3$GAP^eoR%B9TppOS`<^AscltT~Oq-KiOa47+o{vas^Ga_~gR)7pZT-l!$vzxB;>oJ4B6 zCl{A_s=advw8ba5DZ)T49^*Tvz!`xM1L0DKB!N6WsFM^6{XXp1-lICn2Y2a9Z7^G} zB;9(xeTeAU_hMOPKXg<9{|mvxS1_0Y9nJ$B0loFwr9~{Te()Z&ntAQmVZ94ODc@6(ocsVKOaA(L4hni)lK0MmGvi#s#a{1OFI?3k@xo}n`9v1 z>G!_^4uA1x=C6Lbfmb>I&nlM+3gNw14K&qJMiXx6ZHPyFZ-E ztrPfR@c-!1%tmm5?_TTw?9uAKdA!s(&BwsMPnjgugv6L5^P)R zS}wK%oZBaTX#~Fsl4G1sn?9gPTW@Jqs^v@*70!|iI^CydTNNoRxr8hdGQKz09es8~ zS|Bbrr!*$vF+4qYe-3p>zY57vE>^WtPwjOW#S5o0y=vB^k$Xsy@O-b1woA65*e4Gp zW=6l1MO^#TZ`Ju>SgE*g>c=RPUfz40Am(P%L9pyi3w|+CokK1E7!YDs-r7e!0Dahp zU44?N|EeANG6W{WAT+shR0Of-Y`nA?o?hwQd85Ok54zDc^`^Np3g1c~I|qPp20OApAY)^-gv6RywP$F4je#ogeo8{w~N!wDlWTuwIU*p zrH0x}8_3rGe$?@)WtWsdK_0c7c^d2adnq!QB{B1T68%*(u8aOp8Wo%jPT!+-#<}e z|3GuSrA*MY=c^vKca5BPa6&9}Nx3`nKNGb%8}J|A{8vQASCqcMlvns6OquR{-2{e} z5k^&<@b0!MlgySxeGx*AA$<_d{x-gpoMOhsPM0jm!1#TLPK1OGcw~=Sh@}spoF)Az z#LHF_xbsP-z=*hDV_rbwa3!?+N&1h6z+Q{?TKd}qSF5bX;w@NrjvEVs062cEu72`b z+&>NTxhe(U$nPa$Zxi(yrq-6uR5<)d%%$_7ix16bPVKb73wBR^^aj|yh>?1j+iE{= z65;f6#Ivi@MDac#&oN`gs}~Cz!{h-B^A()i(}&{Gp983x_WccHJU<;E&e_|8YmYz$ z2c#)($jTy-VxD!hlsIM@Mh6mPZWC`VaAZ>tZDLL>#UH43ffFq-O%1GSicuxCXaDpF| zf9tkCJx9S-F0(%R%=0T|K#{gn4=KO^yqeB*=0+;gN880$q|`&MFL>5p)QM&Ol{OCd zC1}Ue_n_?vxkhe{xgq-9t5PHKk(Kw)ivO8!%MhXy_$MWezg9GkL;9v72MDM6%eZR0 z7W%FJh#S0d{nY7$ejfwAcly{rx8wf95)dHsO!9lF2mWQLM>P59Z?BVpZ^|4T;a^VIPQPGP6B@Ouhz*; z-0QO@Io#TMsRuP)fv3cgIcQurBpBKn6#ce7*#m3M>9@DLU{3{C(gD)u*KdDciO&VpA~cgSY+j zfrMu~2KZtI|HcZwi97w;3cTjOTfqmqcs z!_(zsT~R)bt!by@RO?zR2d^Bagq8CP6?i71PXrm9ALoXPUhdVQBcPuGv(f4EKvkoo z%weL|qBl#61^ZQxu?FwFuB@VEvm{`b6p^VCXd%jmArp@$&n-1{9Z3?Be-7wj>7

_OXB?YMgX24JB8W0th_0KFo1^1pxsNnBLM(2&WiY4d~A_{%8t2ASDl7-ZY`KZ=UtnYinS>H;qt5OdMv0Kfz~T3 z-ptNW)|?3_&^Tn-@IG4+9)$0dSV^1P%jhQp&k)~3Em)@&ylTg3t@w{Yl&ecOZ zCjfhiOBq4wDGtP=))`j4o4H%j7A)yKoU6h5psTgZ!~5~-wNg6vavlkZAN8!uW{(4~ zv*;&lC!z9(e~-67jQ zWj?mb?Y@V7;zrVz+F~&~afC5yqRZAxRZmvU=lP_`7V}F$-A2`U^2kQLr^M9Aq!G_s z?l&Q6j{g1VWb)W&;|z&MDkw=Tdx&o)Iwej|GF0bJ4WO;@a6n!96v0)VEpgJX)QvHv z*k9Xy<26X!V`SX+Nr+hqhk~8mw}`IZWm(+oqqM*@43oSPHBO1K7*jdcZpmw+QI10v zRG&i8oOxm=48IsGcOH!VmQI@$iBK0n__Repw5wWWU(N+To}uz$&0VoR7NMkRQ~499 zKBl;TdU>l$xViKyxuYyBrB$$~+A22s2Uvp2ho+iB1ktQrZ=2?xg93doq%Mea4ofe2k)2!V9O|=qrhPEm=-LjV3ws^@JQ%tz2X&~R> zQJQ9XMaHa@p~c=GXFslDu6G>R!06pv0Z~P8D3>}I`i$UH5U8j39vVzClgV2((szbd zO3NJ{&C`ywxz2UEd=v~X0NdN>OvigTorV=rJbM>NXEvxoiOJzQ`di)e_Fe{oP>(1E z_XgafGYl~UO}$*o2*7+48BU`u|A_f`oOo)2NM2B}h?Z*}rAb5+=v*zt4_x9_9+i;E z5G%BdDdlL}AUuG5+`=_1PnUcRpVDye&dHbBk8hbm!lQXuf_E0&MEo1B)34Qyt^OW+ zS>~6t{A}|Jv`__n>lYQc%7}ca>J%a06~V4z$;K5SztV?){6Rx69Qt?ewX2fTixq$< zu-n36`BW0`>|(BeCiKj}1|MBdS9kzlUi=n}jo$~qjUCbbSEfB>RKg|1>!2dsS?-QL3~hv5n=nw9vE49!3cm^*`aT|BGtH_ky_z{8lk9 zf2)|AM2>({C<%QPfO{CiwL~mr4uS3-pEn!__3b~TG8_t$j6W(7at!eDqbNG69o=;U z=4puOtlDS!XdPwmkUiRYKypqQV4(~ax@O%5$t2du0KCv4G6R1>UsTK5XyNajKW$q z8ft#`WNfjwi6)X*`1GVM>y)DhUbCfCkQ%AHe0IR9lh;Z0hYF5{cR?r6>laJdNie!GTY?P6Al##}K z`M}Tb2flw`42m{(e{C@T$zFheVle;7UVh0qTb2T2FvquxfIqRY{6a$o_)SDb)hSZf zUXx4-Yf`b;^~?$8W-B{uSuCQDx_?#czeWp?`zs)^%sd&os)@%|UYidp zgj2~1PF(z4f+&B-`Nrw@;?@b8U3&{du>sZbiS>dFV83hd42Qh_}8mW_s=J+uY{rZmw&)_+OIM) ze!;N%J4Qnhj-1W?85w|HMvzAg z?uB~?x&fLC#MDHJi|Y|ITTdRGHL$My`AuW`K}NC2gc`9vM^?2+dpItDe;Z6(>q--J zA9FlxNq@U*b(SB#A(-)g!ZaeWG^V|_PyRM43M84uBOE8{J6pB<3XocdZMbW)@ThqZ z2T{i3Q_H+;F1lP^l458W?U|8ht?;CSJPc#I#HckolTicpkZjc{?>+>AAmgLA2tJSK%pJ5+6#NxO1xyo3wwukQ(|j6i zfpTKXi&sL1w0yEQL1fd0G-f%>?DOlbB;3c)4Yv{PDIof*p4Fb>EvnK-!M zCcUnh7Y^L7_qSU(x*Q z&;6sa*L+Dmz25?Sd2Ej4uc_p3Nnn&#U{!&N6UqNxdRjQD$ z^Y_=Wh(MqEKys z^BzWnG-89D=F zjUD;tEO=mhpviD`gUfq19RZFj8@+&+LX;!$L-SezOa;!HXSw|B6UzoF<7abGeTZMX z4&Yb#(aZk0rLBXk=>>2yQ+*FUM%9bcb^Hqn9`G9r-ropnuyV2NP3DgEF~6C5$yD2V z(q-m6w&u`<&@vCeNgRh*J+GFz9zM`xUdPo^Z<2`AtuK{BgNuZvQu`Q1>MFND5`=Vw ztb>aQM7c^67)}R$iO&s@x%)_+sroxa!@cKvQ+&un((C(Tn- z@@%O$94jsM{!5?smwbj@fu9oT|FfL|UkvSkw6m}J*ub9v-M_N4!*sp-`J{uev*x~~%EzvF7Z+1Ve6hyMzAP<9R{=nm))f9TfMRQ18)dzZR5 zrIol#ct3LcIxO2775L;3`V7Tuvxar5BUxvNXMBxy!NH7b zxvv!ODgsJ~I5XIUrz5u-ggx&Esx==epa-N)O*TaliDQS7X)X-xf8m^S5;_6aFR z`!+Fwg4ov`ER+q~3hDF8gt6_CMF6vTHXP}xXz@nmzFBR!5-jJ46=5ZE)Yie3G4OiT z%)u&|W~l1W`X0*PPx1OZpECEZ%Z^cx3$MT|CEo}_P#YmdnfoeAc^$-1@C zv?^xlTr9;r!N(XyUVs2?8g+aa1#;RnYps@!B@v4dSuf-=YJ6&Kd5&#haj$dP7t_+Z zg`R~nvOkGsshS0Fqg^Dtj1eGg!skPJ$8F^M(GWX?X=h$b8f5b$+V@8s9PmpZ95X2j z5toyyXa+dD0p*88?VG!;Z$IDY0pG6l{_3v2ff!yBtIR!Ki;mwH$L%-DrVjc0KQh~w)ONH=^y%Kdr_GD_6c^PG%r04QCNR#VNdTEJ zr`=3TQmQtWq}^cXh_lDf$y<|?Dlgu?Q+?6J7w0`H%{?5?isu)g-a3nW zZM;MBb&T7{HSMYCHXSw5>K4b_AY(8`5zu>aZ~l|n4Mjy~VGK~6?ri*c0r&kDVR=uU zBokE3L9}!NiuC$=l~`ObgFIX6rL_CQd?ZAkIU<8h4U&oon`!tSJ0GB7gLuMCnqI?u z9^4nJ1YXbZFt!hxDg_WGY5Qe_#Jcu{-!@6{MuWTxz!AfPQ#W7$(s7wKBzS(^zM)hj zxo+DPyo7uq)+gIkVRyflW~{wpw`=lsYquf$%A5G;id&GA3$T*H4sV%pL9%*&99>~~ zg6ZBpNeTJ~XQhE{r^Y<@QJAJAb{?t}ln`-1cPW#KL()LgQE zK#rY%x*Pox3Hje7a(=5ou&oFulD}oQC>X-;BH!e{itt}f=lYMT(WlL`-1p1YCtP*F zKS^|d6@S0yu|WE;zoiEP@`wIOc9^$t7WAoc!|f`1!3%4Gan%>e$mzRn%P z`dXm-TDB05n9ZfCO9$gm%O1Zj`_HQe{x8e^s;bTXSSbVy&pNDcun^(?C~4A zM?1sz@)Y7;iUmwn9Wb{XN?RKLm8-$!1@_Ved;fZHKE?QgO~ltzWYNx26QG%~aoF3B zI}N)oRJ+T06Jd&HKvVerZUOev&jMfrY<1rRt<2N z7ORZ#9Q3{AcN7BgtZeai{wcTT{t(N1KgC|b#`&!6q?mxtaT%#DGNajbQYN>1do6Y#GIkDLn%g)c$R|5}%veqsFp|Fvo6f46?%`$78uV*M7+ zfZwejFyVi8%>9)a{dNEsO!lidwCjCCH+$cN@R-wZl{2U^)8v`MY>eagvF4BG0sQO^ z|F6#j_*G%y|MEP5KR=NF<#_;qejtB-9)HI<^)prlU@V>kwHA`FfqL@;Rgi%u#Q7y!GPb*V-6uAl@8VJA2wo+tYw#D|Ki zG`Gc8E1uUvsTF(XIbeJvg&HRW-UXNz)j$Qzz`h`3x0fyO{ zFFe)$a66|*&HN0)W{Hi@3KB2IiVFk=Fb5po8a0^uI=$l!y^le`b3=oas*6KQd&ou> z8VIx6xAz$x!xi~gq7Y+{kemt=956OvF21ZcM5+%Y%J#X(X_b2q=eqXz7J~7SH>lv5 z4|j@Vw~LBNi?asJDv?l>wDAF&yD2ne9rsaVyL&7(9z=BdvJ-W7Itr))Z1Kfj>%6+0=&jtXu~mU0HnN)U>Uqm9u4b^5%JJj=!Q-P&kWz91(!6Y$A|bH_iXmbT!iqWi5j zL!vSS;*i=A(BF!gh|-J^{^Oh-i=Tx@eG83E2`cyeZ1kf}5lp8lj*A_;M};;yLD=`j zxo_g+$^iC&=7c`pdKq7&k|@GveNcoFbD@!{HLu$k_Wiai7=-{QRnTRx8n71bL*2GSt3Kuo9ckHBog0okMS|zM%jHCLMnD z1o2MHP<7Q@c+33G;0O;w`GB8YPxT4;NEJtRrF$`QNWPRsXdO~%&r9#7 zw6vzsisT7nN4Hi{;zC#-sE?X$(05}Gw%2@GGbvP!77&<$z$*t)ABgdHyJo?%qhmvu zj)%3@7_GLB?REVRZ!MFKRGv`VW#P$&h%`*cUx zy^9MsPC_(;&($Gi4JM&-d5@=aD4XEF+Wobe{%oH8nhzBa()HblEgU4y;-VKRpG}%4 zdvxKt+3{7ymzgBPA4zx#{yw5&$bU2q6LFrjrvdIPpo1R|zKioi_2;8Wc?oS)+F3Fi zpTTt{MYU)Mh8z;mj<+^)5t(Zgh)WIRyexmt-#~hg!fqf~ZEa8f0-L!7Yw1*Iv8)&# z5+&Cx=Hh5rZudVbjd2aN@E>Q_h+J_<3(%Qlctk+zhe?6l5)-i}vbWEEf*g5em|qA$}6Wh{K=!d#;%x zKqWC2xT#e$bMaqJP@!^Ca$y{3FtGRZJVD-SZSb|EQ8g^YztQ#{WAYxUq9CoJ^vOOgA=~j5fclokhIUo92H7m^4B;p_tate^uks} zIAI{>us`>u8$w%6p72qBYDJQb-}=(er^{SMqa4q#Kv6pZ!~?#~Teyr{I8E2XO}9%7 z;b$dnJ2V{QP`^#CG=_2S^{B9#6pg1PJUQM$6->Wz>ZZ2P^6={Qnn zIdJO7fn%Rz2mGvjyiTw^)a%COJR5}+%%L$E`DP~L z>3Y-~-H92oZ6}T+G;Q@3UepmvU+#f8AOUo7X~#1fnt6;c5nnElBSg_*${kHrcwATs zv{c}Ng>PZ284q+hjYKPIe)y^s^TQ2TD;W>vb+2*}#_G+`nz6~aC$H@LZI~+~sj)Fe zqW-Y#k4G3Z#1t!Hc#m@1+s-OuKvQ(bYUTzNUuzL{r6ci5HmTNwdA`aUysR!yP;{Au z_?=fyO&P+qV3c;+o-NBDrvYMF1aK|9Jc|F!A?dl>m2$qUic&)sf*mnJdqiisKW=L$@q8047MfFs}`=fnH*a=MS2 z-GLdbMKTy6)Qe!Ji_N>X#pg=!_S^DSmBc9ZZrT`Qn{p+@I|1U=g{K!ANUkvjec-TO zE;;ii949u6Hf6U{JLIwP+WCm=km99wtFht73z4vcrQHk&?|6)xp6}|cuh&L+zKKK$ zAU_+^>5b}L2a}d+vdn6-2&WKq^28Jb#VJ8%CFyaOK&@*$;|$omWRgi^>Z zTjqSX5r<^3Q$g?%V&UHKGeV%2c-Pdi0B!51Y3-Mlmzr=gA9j~83?l3v|Mu0}(Dk&&4X)m=Dh zu|~}MCQ18+L{`sjenklHA+S6k;@fpSSYO{QsT_w8DaxeeYsP4}C4;MZ$8<@*?Hy2|zR$KO{2{CPS5 z%W8l>FXxBVC<^Z&(r!k>v{jEcgFN{s~5{qZ_Ksso!E zA17750<<<4tQmE2`=r7Eyzb8Big`)43SL*W3l#!-8zxp6Xd&)5qPJA3mGwJ^UZT7@ ziPuMkBa)54Brj!ZDj<%qG<3}VN!Fdw$x1cP)g0qcKDpe~Uk~fe`xg^o_{TD^-5^~F zu^PkSRZ4Ixv891w@Zry=5vnhYCg6tdu|viFc_jE` zZGwov7STf$Fyo#bqA)cgr&%KVwVu6JDyv?7KcZdHq4JFL=PoRcXQVHVohbz#_|-A( z{L9bx2crw$rv6JK>x%A*GFmyH7X+mdE(-nZn|f{>j!q)UCc29SB}J;o?$5!tPFq^w zQjL;>RujQ`wl_gK?^#zK06EoTM@HMH&jv(`Rmi^FI7|wwhBBqU5*Jbv(e2MH&laz! zKC;>{sI$Ohq>@P1vA|dxY|dAHeSo;$7q!Az4|F7eu$--2VXzmaCLr=bFlL~rrM>R;T#Pdetxm$3x>I&Y;96aEvw z0WX~S*LmR2Z}{`c!nl7sRhTz}8oY5Bje?teoQMYu8_geMz?VTo`sq~BR=Qy;hroOX zNp@fVH%0h-`6_?DzLLx5aHe36y;Qr%rh;>yp$oO?FJh))PdIj)D zHUo8deLY3P$7&KLd!M9snf{Dt&ec8MIV$Z5=e2pgw4xj)^U3q-NyK^~eLDF79k_PH z5O?kMSY1;hJldirU#~=DoZ@xpAOEEvQ<+uTvsiVknam}-xV1ogT$IN?0?@r>^fH}z z{&OHc)79#r-=SI3bO@QjTO8A~m?=ctgmAf}vfwS)vn#!Ud%Lb%EdqAkl{lusprkTl z^+cHz-sj-BdAfu&y`&OLXXz{FPV|vy4vb=jVW}k5$fcTF`YP*GJk|Id84gaQm z1eyxdj;Lfhr%PiehW{RKP~(VP<^}w+?f2Iu!JilutZ>NS0;uT-*B-nZnohZ~;K96Z zF>-&bAByMbA9^KqdS#j?LS5^AQfA&VVScma;p5NVL-c6MjBb6in{Qho!k3%!QNnn$ z4*G&hm!?}l9RrJ$Y65y7h`LMCyhJ$4=3ufA%7BQt;&<8gY6i>cU9eRs);*CRQiyne zhn619KpEltAbr+-YN=>hP{Fwi^L#*#k3(CP@ecucS15ZT^TQL5>?$epL&kK}82Iay!fi?b2hi{4 z@r=yl-OKF$sXUf^@ac85g z^BgtFEsIR?ttI+HbBGPYNmKN5%^8jv$?LvyIQ zvE_O`-*=Xt%ThTrgM8dHtWtK~I)9_K*`x?1o!&Iv^??p`4EV_l15mI>pRHUa?@P7a zf;o+EVN}HWszTi53f70T{`9??gjx!RjOc09`J94hcwpRHreZ*mmi3Gia*iwEO=qf3 zLK_dYgu6RKEvmCeH}0$P?3Iz3@YA)7#HT%0Oc|BDg_Grh&$vVX>i+QC(E$EYtF%Z_ zG;e~jO%{aWVbF%g(cw&?R|#*PbIM-A=P0IjZsnHH=(3I5Bd#d{DNvUs&x7V+NJGd zP!vcT5CvxGKD{Ojeq$&6v5apa(w+t6$vLF+mE&!I|%d}(SRY2Qt zel89KAV+;|Z381gUo1rPV0X6qv^!M~(HXnrC;D7Q(VWMQL!($GH>NV5QYLB}1(8pH zy8wwj91F`{AGd5=utewfB`2u5L2ef`A_cAMutQ9(<%f2N)(XEG@&yjyhGb(ifr}3~ zFIi{Z6}*pqcn}_6)Rv%(h^RgfR?*~!0j1%|S;%w=0EIbF zhzN_aNxP5L6dHD^CUi@-y@-~VFl^o0PyPCw8EK*>kv}b3=k^VG;|+3xE)7svZD?if zVW5a~CG^Z9f?#_26r$}#K01lYY6>xZNM0ifj}IyvU72||1)M;(aJxGoQ`rKI4K{f>BW8W(x;&QPN4mz+X-1UnV3DyxpSSHuY@EddbdmxTSD(c10lnk4s@d`)kbAcD zP(O!2Hz+;&(2XV|cPbIV92!y^Q8{+Md3>Wx7CD&~vG1#QdZ4LZ6s?g5%&n(3o5HrR zhsvGeii*TXj^3d-)x-6nZ)JLyhnWn6%9yd>Qw5tGb8-NaaPc}64>moCh!Drw{3_zf zee>aC)(x#imU3pyVR$@>1g$(8rWI3ykt#3H5JPAYm|f!Y3>W-dq2Be0$Id&j3Tb~^ zDDp^%_sH5~N^BkK5G1AUMVCp)AQ?G?Jrv_!A6X6g5P z+J%j9XTWI#-(Jbjt$Wv1R?`>-4HpZ@s3VfXfgSh&7nu~dea(ms)Xp3uedx$?tJ7ZE zkyrRQ``0BV)f z5?4&-d1?)V=LiYTUK42S|?|1TqA7E2q!LYz&A7Hh(&N)w~|EhD4|Axu&5BVe0 z%;XFTl!=&f^03bZw?W|-ZW_j~{M&wsdjAXbfWL!!YV$qwzSQqJ)8_9Ih2LeSA>jL< zlb+g_&h%gEd7h)%?IC^1(Oi_2^j4RCur8x12Z($P{*4Uzr{r)C0^_c!I8FtTt9N>S+uotZC&nu?b%#OEvoj2-xt?};Cu>W`t06)pF zA34(LR!6f(YYSGja;fnSKN$f%V#oI4uv7xa*OZeQV5%VP%m-El?K3mp*&2gCBJ$m0 zqkecuqB&v|&n11`8z(`%hC7&xdlp8282C|}s<+bpF~h)PLdjUqRoeug3A`p;q4fXe zs2YAdNkKoZ)lItO=#nH!(si4Qwc+nF#lNP^$Um35zio{lw^VecO15uxN%xzri)yEb z^h3uSlOo>R08fzM6fsNlhc$m!C4aif`8uMShw89T)hSQ45%1rnJil9P{AaMCiJaF7I z5jg@AFDt~EGB@^g1;;8)_;p81H9_v53t-LbePL$XSCRu}%E-1TO*t!~wT13jo2UG$8~2PlxmxF0Axy&$Xa zd5#d`4}}VTF~VZ#bx1_{_rA@ePiLouVD3ySz#bM@b1e;BYft@=-e}sAuV;_hxKcXv z3AXo#r5+iZ3Is^ObGO8|#jE$F<(_1ljSP58`v#9!ScD64SO)Ec56L-D1h>G7`OHOF z6N+X=R&L*-70x~V)$O_}wnjU`I5yBa?~+`zD>VkXu&l1# zAprPL=VCfIvX z)Nq2Fjn7YYkL5({pSiQ%XxV%|A1`d~&I`#W44d@h!DB&6xZ?8>TA?Ka{xjHX^UgRq zEw8igq{P%fQ#giIfk?H2nu(ok5$m3(!J@Sr6!`{L@DhleWwp@g0OYYRK|0)oue_}^ z-Tn6&4kC$R`y4zf)g3qJ-LWH`X%3UY-F=5|e(zkAc+5lVC=<}ZB`dBddc3YzlD4=0 z8RXaj%S#`x20fdq*58S9`TZD_wtG#(+)g}pJj}Fz zx@KUM)=r3r*rq++-A2p{BHIHu2jzadIS0vL2TFJm0Ux*1LD?stmum>TR@X~=N6+QO ziUvPt_;6dX-V~&uA$;+g_Lo@%R1F@a2163&;v_&krZZqlezaB@%??y??sPgqlV3f# z*9j}-ZgnTK_K`PGR*{uWvXEd;{V?4K|eaPi6)DYFdAHR^PA~_&dGdq)9);(Rqz*z2j^) z)BDnAn{yfHKmd6=EUG=JO+t^y&CQdLJu5nX<%MW;1(UP2_w1iUQ;s_@^?l#TfQs z&gQ7dY5WCPR082EgA4ULf4v|^YTZNd}= zrmNc7K$0!OHGr`HpqUr+5R^C&=XCQ#**s+~3;oU3cx;;c5>j8~aO<{+(PO&3U=7(^ zivu2^qi8iv`SvqTp0H^1g6wE-2a4bJ&f3Lvz2_29_AF##s!@|5ZQ}41X?J{n)D*D* zq`?K2NvbWjaNyA)ywdV+AJnljxIoO7EHM+$ddPiCJBWSHC@gKd(xe1A*HT zbZRcU`Fx&a%EQ(8l$c{dJI)#K^~w#~f4Nt(!tsJli$^+~JukBp0nefd(sfC9{`ro) z$6hn;6xEOIJ!{>I(X~RVsMrk+^E^jz++c|3raK*#r+b;!w0M9YbAm^=TX|K5pvv`x zhyh8)x|LrF+Nkg1Jw%pn)#+js;*wn6>SO`tU4#!8Z>VGd|ABDw#5~hWXIW~Yuz!ff zz<o&hfL&(j`Sspd#lnD36!L>&8$G<9%bcYMS}Oyn?53X z7==o41KqESkFm-FXHW0|#$wjORmcV;$WPgLW)`JP&5g-GRZJC-oBH5vOR{eT#c$2r zbTY`b0xA-sCS$3515V7yCLh=-a>Mnzl{@DV8ke^6D?3S4A61DO5JcR{mfRNEM)0fdzDnw9K#3r$%y+Hl^kZ2N_2+)ImoD5 z^%wvq9fnX34adQmS)t?!1#P~iG&*|OgYOUb*;QTOVKj_+SW~8*+(jxzh-qM91VD~Fk;*^OfnLcb|w?$OR9fL0ukrX0$2VC^>=Yf1MP61<{+cT)uv#FqWO3MC(tR&fIH#Oz5M=8~Wuk#SXmO94>-m zq4aa;6HBrv21?r{jr8J$eKr&EyLVhbq&NA^LU;pu&zg`S{d-LC=Q;{YkLC7pK zC%%kmGH@Sn0+v)vEJr%KtOr?cS7$Kqa+5de)R14DcfOGv%&>2#DRZ&3I&a6t)hD5s zBvPikSO?Cm{B*hy**d!#>maA=v-wy-T*k8S7S>JbbIF$xA3v_k48}Y8AW7a=6mHfc z+v5VDd_pUHo-TM_S-Q|KWq;7?8`82(#oPgRB z0Bo@?e^g`9Z-?t#ZY=tMHfV+mlhLwpvTP;2YT5mE`irwXJBCd6VzX+vl#1?Hq=v9K1YOvQMUAkNpy;|2&wv+KR^ z;#E=oNXWdnvesCM#$9I|L`}U)zY`j%bIzp`nIjr0A2MH|21@u`Ad5pLFe`5Rc4}+L zBIUXB1hitpTJW#3h@$xQid^ucap@{wc(+@+o0#dNs-{AQ_^H_0O9QAzi-#fTTE;KK z?(m(RX@-4Z_}N_2L<IQ`7enQ_|)w z5eJaN1b6Y3uH1Z*l1-){Z&O~VN)`$HK9 z{AqKQicK-L8P4QYI zmhN4i=1oz*v$b1QZ@Fj0vt`74i^#%V#CK2>NLT1%U2;*}w;v2YT^spqsXAt<*yMK- zD4^1m9|zW+e!5C=vnoZbE)IsjO+E(x!ak;;G&1qwReQuL2?nO{CpN=g#vk0TM9F~P zJJ!*$JbZh6t2Hx|*MWCj|137QDtPgwg-!Cjt!|#>-FuJRd+vqXAXGgU{RHS@vlrcr zw)<1mcaJL+Rc$&Boh8>nmgHR|W!$pY+?IwwxFU6zk8mlby4|=ki7_0AkI!`0{T8!b zuZm=wH>|IFEBLaG4e<|YF2wT)C4EbFY@c6KLBl|uEK+-md3;c}+n6?WrwTc65nLGX_fj*o|N<#<~t6YT)rwda*-V6jsueP2yf;&5tE zON21>RnBAiedl|HVU>y(DTzf#<8CcIoX_0i@|JG_rP33P#6CInnIow%twqE7Kr%x- z4*es3+dLBLp?2U*a8MaP?Yfa%q%sx8lYTBz0=SL8eVA$88s8D|w6HY@w#NEm`KBEm zfu_51<3rZGJPLm3W6Uk61%t%yisc#>uLofED%Y`w*EFY2Izu#CZ{Fz(Gst~Pta;%v zTJK7$ojHpJ6RNK#xZaYUTLo;l>p+4)AFD4%P-yREm#})E(u?q@5wC5nANvhGT_Lc_2}Ze1u(CW(tNG-!j{qdAl%wH@{GrZ3{0qGEDC$*N@LaA z_}s~Zj>Yr%R}G>p{VlEEf3V0TQk6jSuypHwMZelAs>stn1G(rqto6IH3`-q{X!c$k z22__K<{$gWRmO$K5Rvxu=`}xCWYSG`UnnoMe|Ug*R~H$_=!xxr>iulULwDFhr63;o z!}KK53eDKZJ_$s1N}%DfpKZy74cTuLv_p5ur|N{~w{wc>RNtLZ0o`FQ^(KD|{&9VO zXL-Q?THoJU9`L``_ji^Dd^f4J|63o*Pl}p)k2VjjnX`$1%0+4Jy8*Nr{*m@N8h!1U zqiwqyjV%19pG>T7=|sh1PuJ|^cn^FoqpyLfp3Yj;NJC%4{a8~VP5PKHh@luBt#UrE zN$`cIl2@3s8y|P%AyJKrl&;w7@)CE3o@(AXj=EJ&M`i))0)T030G!?5=~g;bG8FjV90z~tPWbIp{!hDv zqcE?eFk3@4(hat0z2f`nBhL#I|HWGBKhFZccsThwGH?uOmlic9pJ+FEcTIoaSjwk@ z{~L#k`hIjav0PaLbwLjBdK~Y^0S#TGvX}CR@8E-)7;}sYvA?!g1$>m-g*k|SZx~H5 z)H2A^co|VL$zimpG zo+-bmtf516n1wmDYlS`(m;B(k3UuGICI}vCzhj(8fv53#@=xiYZ|Hfs%B8Lu9_ESt zyb@1wRT=O8 zNmxf@!~;;B^!JO}_FIyOs*QSRjS2sz4k8}f{eA4z8WQrG-=_V?Sp)ws)BfYEf&Z6j zf1CA}?Go^_@6vC!OOCrU5N-Az#a@P1k~U9v>>f`w6_#sv8;RUo*lvF!3m8fx>LUSP ztN3hqA}>@V$>VUp=Uq?jM>odHK=3LXjXetPvcr-=RoWGezM|o+hY3*elw8M;H8)?x zy$esvaH(9S8;_yvzhk@fUp$>1@xr<*A$j^lp+k${;h|-zU6p+)1T22mZNY>N%DfzXa~Gcu zmE@*C%rH9v^`#c9Er!)cr;S?WETET~!weU9Um1y2=Y=pyxh3lDn9d$cXo~T2nq!N3 zAdD?rRXSW`-#c?x&ULFQdu;|hPH%ZB*Tp*DHY~{2n-e8O$|`X8tUMB<=()QijRQU| zhLM-r{j)GY~}lq}|vM|sl53)X3%R5e3ivW;~fAM}i^%2?M*ctM%`l*Sj1 z!SB4Nc-!7bznaa?QQyc$Z=>vn*zUy}4y=*I&%^n6%91JhURkn9q8|2^D1Ml6W`{^d z3+kH3IZrf6Re7WoDh|C3c{-w(|&R9HXAW^_Fnstu(XMV)mJyP+Q~gL=->k`piCg z;o|2M`|1O8+NI(bi?@Jt>>kal_oId_O^X&3^Y)MU1%1@9Egy^Hy#?yUoOmM#)FX1M zK@h0+nVsx588tbM0Pow82q(l$4_m5WpOd^;0`!#^rcxk3ne8)EmQUTRzHHzQsOHU@ zGhnW6YV;!R;tgcFB09Hrp^=Ft31rU%syaRO;-8?l+_IBGrk~^u^ag3K6hS|5>h>+~ zIo;4g`>r&A6u8>5GevJ@)<@pm`b;6Wex}@Kn+)-{f49DraI!G{*Ipv z-RY(mac=!(+j#uaXao4G&(aTmEUG%?p))S3F;e`S=+5`COTB*=-QnAxty5Q9wZlUq zzf^bNuUXKZr%6uhIqpT74$HY#`?ejMVt@pZ4y9o)l_9^BcSfh>e9IHdFNg78BY(Fi zHAMk`5aIg=wH^8i8@v-J9tqUuG&2#ExV*l#k_B;)cftMI`E{p^a9r9%xto13K7*z8 z8?KwqG=Llxe_BFnGO++4uWZ8YDEGq=LBUGw8P*3I+*;CE8bGRM~ zb_jFk2}V?cP`^4B5C+@f*$L`F*N*t!lm@RRlSCq`Cs@Kf5oj|yTi*03a@#Xf$Ok_U zy#7$^YB_Bb-$3il*<++`*;o#14rH1vgfvj3XjP%^5vy;ilF^KO`>p?s<8%ZsL$9^c z?nz3V)ic#sF80RW(xz|BITHShaOrnQr1k+(M-rEJy|ec8R3SHrEHq4B zda@1^u+uMaNS}rn!OoltLpZo6kjhJfYp7LA4t%Pa2lYu{>BjHV6 zD1bgfZcj*b_a3NmlqiC*eukFH<@oOYz@M;vR!ji21@(%+5= zCRXq-aYl#R+c1P8AsO$qv6vD@zF9~npll?sR}DVc;hx`_%lkviKkrN-#S^~<0LmAz zH_nV7)J=YE@C&jteM*Bcit9Afj;`{w6*_OC>eAC&K(oM?%qI!{Y3QVe!~iW(^{Tro z(bj!@=8>o1g1zZuP+BT}QmdyW`zvp*uu7DY-&Z3?VBw~_x!olee98c63ev`L;lYRa z;z!DcyxLm#}+&+-!%Tz59yZm>I_ zryiKO>B1vO>B^@tXM3)fxYN<$a5J|sj4LMb+5qW>r2BRY9vB{?Ao%dfP%P|H4Lvd# zE1dT|;x4A>L#c9%(-h>qn9AA`(757<%zpq-aZhZw;4A5zPv8k+H@IAyp*#_1xOt;I zlAKlO6Ax|Mv?T;d(sO|exMOS}op zo}h#}(rt7~7C|d)oayW3(UD^2KqoAslvd|0W}JrxPJeZ^IA~UPkYR^p(??RIf~OYb zdA{wGAG({*H;Roo$3XQwM@5IV3Gt5k`u`xHd&+3S5`Atd2XS+nH@|&NCD?RzLpk* zi1ND5d{E0?nOs&ZK%txmV^>!?`bkjsN$uL*rnN79V0U?lZmRta9adVaiTf>_aNfCDc+Dt@SywS6SnXA7r_;6u+~ z>-TfzP*B!^ta`>xYVwT}Bb=dU9{)j_=JrPZ>6A&nzGt}2Uy2knpRyfqO%r3QHOAJB z5b&{W9qhg}$NyX=CIr1@V89R1G;@c%Aw{9wxrD#K!3#-4ll zTuS>HK}z%8mhty0>~U-!&us@W-Ukjt*`ilT-_5blwFjZiB3=E}Jdx8nAnm^mc(?pr zM_c{E*TwmGki);5_@b!v!)>`u4qsM`*7LnYbX!`BZvoj~-rD}&xlx{K!=9?+9y;@z zJg?e(8zY}T#u}Oe#-CL{IQL|o-!7CWGF53-f+LmNKg?VW8cB$Yy)Oo1@4kTpRrLt^b!q5%8r^M4Bvl(pH`ln37ly zGZaqKVblgS6el$I7QMR`r6##}4aYSYji?IEo0%P;<6d#Wt?PbMMnxCT{(MWj8b|cV zT+G9Jn5c<_Ft6m3cRYkKyhA)8QjJeU>j<*>2FQqP9xQrH0Z~a$qbGdxH7JdwJ`Io? zna83uZy0aLL$Vl}NIXA|b8jVE0im$@y*-zTDZ%#Kvhw7wpF#bA!g$(XWf`@Ayh2f(nc_6Yg2-H zjVdw+9HE75-87IWl<9j<)4#WYaTsGq;K#l5SxF$0^+C&V?|=7#$J*hNc4RUY>-0OMo;TtvQYJv-$AQ~Do~e9!*h9@IIJyLP$5)+$YY zx!gt$)HxpOmVotn!^y|`ia}iRvG%mrx`<&1l@7mHiN)6+{P;opx6}>zL+&P+HN}`; zDH`)FX=1+xvO~RpOVPd;rN57{hkA3d%0oY=Xqxy3pGTQJvcUGV&VG8BYKwhG$$ zeT$e+Dn|f;9a?#fgC(77VPD_64uq|b8e~Q0%0}gpks@`1jIM*^?N;;-ALcI_J!WYZ0GIS|avHeOfA70#aR2m!KlptZn8 zWOVcCpRf>S#rW(uE|*E7<%mLU zWv)bgYU=!gCoCaXcB_Rb&+}c{OhG7s*x))R#a>kQcB1&xy%av61k$rgJ%ly+;VE|M z3$UHMM_>9V?o-<&)qkZgTA`t*m;zb~tFh&|{78q$w&cNUM9$Zy8?H9?(ilRtNg(G+ zc0CHup&&RtkJr?{s%6pfw-B2Dr*16TqtD1h%*ZQgC9ip?AsqiJy?p(-Zv2nK=eOty z{G0IkEqVe!!sqpe@OhK4%Cv{>n5cSNUkY%)kGZINYv04?Prfq$JbZqOp1{8epWmV< z@O$`VzK2gCJpLD7-O)SqP(vfF>etiY@dfQ`Aa|#Ro3h!Xoy093)0=GD<5=qcwN4T$ zQ%t6i^DVTQC~a3AM2+BQuWUCzlcb0N>I36bH=(9?moP(vv-TO7Of)Ao;w4F+mZps& zZfaos_HW+$RapY~U*yW4!-_4Y?yMV3KT@T>7IK{v4lsuouT8`69Ca%ww09 zZ1mr^2VjKKU*x4Ws*&a4k%aF+az{&dLP<_f{3=Czlu}CdKd>bG6v~1UXzOcBHZ1wP z%@R<{=J9D;dL5daliyh)b!TG@kNRDdLlg4?nbUe7IgeDXiTq70B4zmGTXFBt`~OEC zyPI=Wp-j-iyL+P@DXdZIuttd+Me48B7;Wayd6?NkC-0EKm+TVDac}}hRm69<$ev^3 zcTnV;r_hio@I$TD`@=(jY&^3m;Y(OiZGJOn(QXmZ80&X=ho1&jw){z0QPNbaJ-9D< zhm*20|LupqHKrG(0T!byd89ZW=qGsw+09gX8 zrIoH`y%UM}C=sT@aGqho5zoDfhJnL3`Z8XA2~J`ku2;;OLhd*gt(&#<-~o9{f_F6C zK85b8*or)C*K1TZ1X&@1(g@m4(;;10(%9jB8kp~SD@TA z)fO)5i^L7KEmYKtm~2<*z+>XTAYz1jzqAMI2nau1gxCeWlH#%sI4#tIFws&9cJX-F zD{dEmf;kAtwpqRF^^6EtRqL)S98*7Ky_mA&U@k{ZQm9b>O>*xhL@WfBR=ZQ%mEQ0`g_dTD)O;R+vTJ?L3 z7By)e#A2+5+$rxTUAr1E1q&_6y{W@5z%L8li`yb{2;x%&oz}8pa-FK+a3*wocP&8 z**Tm%3-=y>>_GAiu;+~|Vt(dt!&a^j)p;6sMuvlplTN93c&7#3=G5(t^yC(^?Kzulh{b~dz z7{v+U9CtM(Di_bW;C?P`B5J#j?p3NJ-`257VtR*q!2BBwUT>Nvu^(q(nljs8OSC(G zg<9b6VC^4VQ5?4WGt~akdiZ-!y4J9#+L))#h{*3UO1J9#7`wk8Us?AD%mRN0Xa57U z%fbJUj*-4U1N;?d#eY(7jR9UAm5zi+C4Mn-I3Eluh;w^Hl?91CzKoU_+zQICYK5ED z3^r9A#=?$)0#)LHbd~^j4R|K1w<^GuM+piM?Fl@U$eQez_3&H>&Yt%oc_2Y``D)Zz_ytDFn<<2fb&$iGW zpte}-%T6;Sp@4Z#>3HDq$@Lku3_hEeP#u#Sw!k&wb_9``dv&`P%`1xO%|B51oyR9X zGscI*A!h_Y(z;(;4+c`Lz5{)a2@AY4D<$hy)pP#pB6l^1B7hU!G>L3sA3}~42@8tt z0}28dXcygr!%2iBW_1Tq}-05N_F%+jeKndJv!S zQ3Gyz;O=pXSc$){#ClSl@?kBVOFt?@=_ISwOUawckjZJWE}b9k6f9+Df0$SmiuDZ` zD?dDBBNh_IT5QclAnTdrF!faVOPnJ|&|a{RT~&4sCq^SMmIukDGY>3e0{W?!z~j~{ zh8Pyk3Z{-Q>|yr7*KqklH5r0`wV{(^Rj=MKmizx7Z{M*sDUvR^=T%rB0ue0HT5EQQ z2($<^JpG)Mm7P`9w|i>lZvAjFo%r$3%|2l^)CN_49KC$06`V~&g!>XOUb#b7vHc=X z!ELXLG1Qr)B8n3v(-%isfAElPQP8xI(^ zFT?I?Mv+6_s9y^FCe2G~KyxX=pR;u0q08d>qht#F-kZ;Uqcqm9effX1#@cBms!x|c zZpHR|a^+Bfe%gt%ihg=C+mF8dzekv#0cQN$ z(DuCwjHyD4z5%A&#(5A5?eO;mj6El|cw^7*gN=1A3#3GNV5_7l&d29Owg~E|qKfSk z8ZsTp#ytQfR2vZe!qAQ~wElHf)+2GO^Wn=<|JFQ(v)9XqDwH`2#=&D91X)&@jG(cw zT0)r)cni>=%+^Dn*w{DhM;=6ITMHP42ROKwt1=dS&@hjwDKH(8?NG&_I3}-jmUdCX zRUiy4wMmr_N%MUd;`e>zpJwf-5f8chexWaA{fY}5*xcM3dT=1EeZ(;)VTy&^`b2Hvk| zAt^$ZH)mGQ;qCt=`*wsJR)meIlLdJ$1g73=HeK0KxPLNj`QKpQ^`F_d$@%#An!q3I z`^Vz{XZ9`s*X+BR>+qtTCJ(R@a<(0xL2Z^FQr)jYmDIu;__sph zdsGs!skHR8KC5XD#gSN{^BKIUFpw%u!z-6(bm?u(dI${I++4*L8#)>5XFfXnHC%7b zU5&tCBSitK`P8PHWBR0&V~~6=GT@IanM$(yDgq*~e3yB@D{nl8v^kSi0@5&V|kuUgnP zPL|&ee6>!X#)D>Ik5>ikhVO`vm`RSNwC$ZE&R_#oJ3&)*oP#-(i{E zuS`BisLYy*@~=k+kV$=ap)tOp7NHDKK0_L57v`BdXVp2GO;DIN-x$yHK^F=%Hp9&o zW^wpz4x^T3b_km*bRKjQ4736vegP5J%pBhGgVc&}ME;)*0 zBm6w}_q<@Wg$3fZa|i;uRdH!o(m&SXvqdUq&ksV=yn#XnJt7EzPG>1?d9pQZIntCe zow(!DF)rSFjeM`0x*nqE9TSJOVck`_OG9HNN*_y7`vP=WU>@tnMk@UMA=N3+jgN;M zyGti=>MW*pa{4AQ4g_JO#XEANhJ&u5A=-zpi`H#eOo0$e5;1OGL0mq3d&MGpe2uV1 zoj59UPwslravLb-UdJ!_@;|inn(eH?E3HXM!^Q@n+mYVj)+!&YQ|L~K=^TZYrkI~; zmBb=y$;!J3Kc2*BeJtR+6hVq~Sz0BEZ)sF`01Uu2?)f+ zlw``A;%#jK(|{aF?(fl=ZO}M+V=aIpla0`R34*KR$S%D3|fNmp29^(=?K1HP|AlhVlv?{%&&;U-!NM$}-1n&r#t% zHyTxD;enULc*nEu#}orXcSfBXPHOfsRxj~I%D$Y=!eZ!cLGtBnKAJUIT=Nz7++zUs ze`1h6cr44v;UDZf|5GQ%{|5WMe`DWY8MpDT?AxQ!Z%OX|zwG-za{>B3%tEQf(| z_q}0x-irju{Pni)PE9gv6vh%p4Qk{qH5o0Ker@( zole(rh1QnY&KR6L$W6vRHfAPyN?n}J9BPzYFM26759pJFAp12qhbQorHw9vWc?yu3kX4z7s*j5*_Ua6LXdJ>3D%-R(@2` zpw=kkhLc;TuqBT9q#d|n*M$@Qeh%JKRf{GEJe)Uq@_u!x_pb3CoR#ISO%N&5XLi<# zcUhT4PPxD6!Sf|(@>9pR0%iGWYd=NJtw2cgk*-*iIPPVRT1h&ozUve4?0e;NZh_y6& z?(Ps7{nwsaM*!8g*7L|YLmfo}Sgpyc=CmG_5^ui*KVqvRO29Na)dcZw!{ zvTvE`JeH*s{%h?J_;c})Ww385E+r#Ni7rc_E=%6eq0pWy@+jDgUTD+E7{1rSw-}{X4K)rR z|GnemcPSi8qj`{J?VBXYni}*eMj~Uwu0ykR5&I@PARo@4iy{5*9v=O^b#6xZt&@rc zJdaOw=BL!W?MJ~LeBG{IdSbVxk<%sIFP_Y&?*97BueOzUS<1rSIt`XQ?Gb3H@i%c; z%1)t4@VRstAh&!%7b9C|mO~59#%hUtqU>NINa~b{EM2 z*c&=!ta3~Rx{@wI@q=V;6&BIamo7EC71i;4q+Cu=}aWA=rcXrvGw-?hO)`TKV?Dp#0hXQ!yhT> z$#?PIu;8iU@(EG3tcAVW^FbwY}Qzdp5P?VKBe{w+tkXL z*{hY6{H(E;XSSX5GtoZX3L$5ws1_FZH?JGw$Fz%4~v357@83|1z* zYtK*}_P`O9+0q??QyY@h0$Ruh6|vMUL%VcdIXmWZQCnCBH$ZqHu&roGe6~hTA=54@ z(rz-aN^0{v!x@o`XlDs4d0F4y!jJ8W#oOwCRBdtU^W_1((v_WXG&eF19fE0$oqEQJ zk*Sx>p9HU@_<5ltrXzz5zK*sZSwY9y?;k4fVn}XlS(3j%7)xUw3g_^uj4-& zK>s~$q3vNt*Y$utW(Y~miJW0>)Sqrz{h4X}FQhH5Kcy`$os-eu(-uD$|39ZK^#3|- zabE{!Cm8t=l-HowqZ%{`l=8Qj;4~fKQqyxrAOC%b+m(qw|qo#MmmNZ(@v}s?{DO4vA&i z!B@OCP@h5`uZqUmeDsV3%z-&Y=t62|x_QD7G?r=f@W@_5w%HnVgMP?Za>c$sxk5K) zk5{jaBFMnVK0is`aZCpgBwB1v@D0kvwAkc+U~NKxV;;XxB9rGFDRphAQ-WU~e!%s! z^3iW%2pP0~7#s|>08L4|kmOm4a{@iFUQ)`{;=f-tKB=YF1q~V2+LH@)^qsyJcUWnM zC*U`UcQsBO_W``F?K~uUI$);Oyj4z%qp|pAejOeD2_NZ)W8)iRE*h)*5Kgyz=$2{AfvQwSuaZz)(kW zryk491O#{aqJzx{UXAp4a(Z#;up0$WYAPM#db~)V-vruc-yjFd=7Qj-xX240Sp})+ zB5VUR78%bss0(w%EDa%NA_KKN7*J5W&Nh!Thes4KL+x;9lP^d)r6VUW21LosemE8g zT!on;bI$MOAAP~KW?UmNv`j}2Y6?-cO1-CWkU~lGbeI%b?q^k$= z=n3!h!aWil`$1C6&mr>fT$UKh|L9;C-ORQOG9dU&bq!jWtGByCbdJmM^wh~c6)k&p zSyc$d^gX8Wst;_j@A}rz;jJ3gIoKW^?mIA^(T9dGuSUHVeo8JOd!$?Nwik6hLCh2- z!>2UR{#@Lz=WRhcV0gK{F|&AJ$2@SVsZZWPdq=HK6nE4l*K@68 zO8YY^8CHVyOBs5uva$|%>Vm^Bv?i5y!wGKZv6OQ9v$OVi$%Xqf#Wq0^-A8Q`v*H(- zrBk4rJtV@OMRYGffU9yDhU*BHME6NQajS7YlJtn5wYqKS0PCdNyF%n}2i6njg|Zhq zR9<92!5|NmWB^t-PKMS}l}?;V;UsM$goP_H1y16xO(=)LTp6Z;-{$&iG0Jmmc>?)z zwpvu2g%tv>BTd4Pi$gIC8sBrM2L&n*ike3bVc-k3rt=JxmUkf}29xHWcqOvkS6}y^ ziK7cSdjxkOQk(9S zhfw|)prSm$hmX=msVf($D~_BgL$TA~=FFusG6B{<{b`L+3gJ zS36Kd2K;5)B1eZmhvmL*o8hvDa%2zXTW@f~!#XGb7;&3@#L%_g*n!Mtgy0WZ{a^Xq zm*3-G)noX8vu_5~8CqnnkLcESZBU9wF7KJKMJ_vsm zN&tRWO87-6;k%xaeCZ4paUTEBIseu@9@9PhHjpvmJo^H^E^!cC;b<(Kh>E=#4+mu2t=c3i@M6};OfDXS6&+4dmMo^mf zIM7E^Ri7x?$}UPxB(gr7&GI6LUlpS;P?J}YO*=Cg4Ro_C+Z!-nmUa51*!FOL4jZ{p z<1pACk%;*R^Cpixl9uDVr4w09nRX!BeM6d<|pz17vls zjS3yGdW>BfenClPptDp^2I~st^AUZf%Lc^hS!oi5t*DEkX5CX#eFyo*!;QwjRHA86 zskqC^n_rgkA66($K77m#@GR1g=$_krAUjhiwhkZb{0)fbJ zj?$OjnOknwzWHn{F-)|&8{l(oEwGukH0xamfy6v|#!SnDhrN!GKU-Jnon3;s|8z4* zf3%W;J;Bc&GVSU(TevstJOcWKk-=G zeT?#9YHko_q`T>1WlrCZ!*4Jj3|SH}t-!ES44~|kR?^}|;bi(K*x%d;f1Zs0E|MJr z3r1?}gec7nwx=SJNtFwJQXwE1*qZctJspquP^N0_prgiAQ&Tnk32cVT2(PLk9B})G z6zxF-=2IXsD(D@vZ^-bX9YbyQbyH_3Yb_QDSj zauzGfi?#Hokb52^mOfeSQWs~LL`$V}&q(-Hz_y49diKTlfchpyzZZ!mvY_L*ay&dg z9ryIFmJYkvyTi0!BKWLY^x>G#tM2Thp88^NSOP~2RR!$K=vibY->%s`tIq*ZL{{SV z27A!EonOv;_+*m5%1o1txYD?m*&8Lt;9aC1#mw8l0p)_YaN+!LYL_VuRO7sFP@_ht6tdox3j4v^~x+tJHP%tR;~QkO?Lmc{vbRulqg~dv5 z!Hr>_tnI?PZPd6o%uv|&K%EA(Nl5@26F1MY?d6MupGWzDG~{lIUZhcS$8 z_r048iI-oE@we@&zvKRL6@~of2E+Eerc_-J3|lz2D?*3AerUk|jQew17j0G-p@BeJ zXA(Ip&e-q;!UE_%J)kY_6@Q<0dJ3X5>$z+*^+u8$4mJjZ4>)J9Mc$D7r<4zgya*PQ z55-!aSc^ zXP<%mx~>d9Q(B+?)Drs@^Z$BifiI`_pB!4?%c=b*hxYFXyX(XJZ-+L&O;5-F_0Z-w z@OAMY9NPbeu>a+u{X*FPGqNryp8e&oRm*>}`1&qkFMpG;FGu!k_R(ssN2<^7e7Dt| zToNqo@e9kg;ay=+xKHLyxE<;Mr%*`gSv}H6c0q~NS~kQA6Q(7L5q1g|l~`m38*~Xf zOvk%lvw=4zPGQ>FPuNytD zPdl~Gd)|b-0-)~MeHtgebiN4`IO`dSGnEsx;$)d@imrx(rG$g^u11>&@y*?{tV5Wi zc+m&aW&wz~NAhNxVEGJQ5tUqCYpS{EZ}Pf3?K2QVeWAXeQS)JiM9+-G=!ZtX34}w^ z3-#au#kgp76qqcr!OP^7(&y=+BcS)wmwQ!?HC~|?sM}4p(7cg@tyqvSxq1@SZLU#} z1HOyp>f@Q_bu-Xf

8{;a|dgVPC;-!|uc8;i*hC6Un>-i(x?Y5pWpn0q=pE*wySBb}f4g zdn5Zga{~MXoCg=ccfmX0r{G=iGw`?I=U^Qh$xdXG*;MvD7@f|bzsGo=ah-9MagDK) zy_LOk0#YVpRQgcLV0h>)|3!l^ECdfBLgAr^|I<#64aNPZU7Hv}hEO4N z2ou7Fa3OpsDMSbnL&>3(5Gh0sQ9{%ZEkqA7Ld*~=1cbm4JH!cbL%a|_BnSyZqEKom zEd+(cAxTIYN)Kg(GDBIR>`+c9Hw+@f+g9;v?cW#Ye@B;$!0D;uGSN;#15aK>!7%_qvLyRMQ2tOi#m_SVakLy7=7!RUA zB8UUYpb!MWbTA(b0}&t+#DXM{0J12Iair8lG>NN-9%lzt@rSb9r(TlyR6l=Oo1 z9qC2sobij>V5mX1izO3z8pOIM{nX|uFN+A94@`nmLX(l4YQ>DSVE>5_Cz zIw^f5^-KTfd-ucUVZVd1!(cE;7!0NeQ-wW*xx@Nle}HWcGl#)o)sh;?2FXUrCP}Si zvt)~;PO??9O|o6GL$Xuynq-$`w`7mxb;({yy`(|1PqJTfKypxWNb-hc9#{YtfhAxW zSOHdnHQ*ueCGdOTE8r3EHSh=E8{jeUE$~O+JKzcMJ@6;s&%jgQ2cR0L0X6^|flWXy zuo>6_)B#(8ZNPS52e1=(4H$$KFbWx7*buCOQOT%ctYiEMh7NlU2Md1>6RH1AGG90X_wO3w#FL1wIFU2Ydl|fM%ctXa(AU zcAx|31iFB3pdM%d_5u5W1HeJx5by?Y7&rpF2^<9)fn&gNpbypo>x9+QkJ69PkJC@k zPtsM88qz>oNC)X517w6ukQuT-R>%g~AqV7yT#y?ofC`}^s2D1NN})2S9IAjSp(vL4YM>3!MradM3vGtBKy}boXdAR0+5zo^UW0Z)yP-YM>(E}P9%_L0LHnTt&_U=B z^agYoIs&~39fca9W6*Kv1auNQ1-%8m4V{M0Kxd(I(0S+r^bT|pYJx67??RWM|M$+^ zhJFKm0^NZ=g? z%{!WRHt%lU+g#t=(7dntjpoD6N1Bf|A8S6|e7gBe^ZDkc=9|qQHs5LPX&!DKX&!H$ zXr6CgXkKc5)cm;lN%PC*VDqcyP&2G0tR=c7rX{W=p#|3hwTN5NTe4cRTXI{JEvgnx zi>^iAVs5dv*jnr@&X&TK;+D#ms+RRF)h#tGwJmimTU&Ot>~1;Ga(8w(T3@!p+QQnx+v3|$ZMZga8>Nlg zrft);8QaWl);4=vL0e&4QCmq{SzA@x;kF}fjcq5}&bM7?yV!QA?ONOQwi|6X+dgi) z)pon>H*I&@K5zS?&C}N0*3#D6*520H*45VC*4yT78*lTq1==RsCfnxQ7TT8E9=1Jh z`@Su@J*GXbJ-!{)j%mlX6Wf#9N$uozN;|6^Xb0Q5?ZWo-_Kfzd_U!hYc4fP&UE6MK zcecCQ3)_p@OWP~ktJ@E>A8bF|-q?P;{dD`8_H*qQ+TU%z+5lo1#g2y^Uv_-e@pZ=^JDzlW-|?r8ryYOkc-HY_$6q^s>iAp7i;iD9{?YNWBiQlJ zj(>H8I$)h)o#CC)ov2Q9C$Aqg)7LrC`Ji*UbGCE7bGdV+ zbFK5s&aXPZ?tI+&r1NR#t4>rGv5VYA@8Wjxx&&S6UCu67S7BFaS9MoS*T$~et{q*C zU8lP~?7Gu+x69Mj-PP08*EQTV-ZjxR-?h^9sO#&l$6eobJ?Z*W*R!r4yMF5Wx$9*Y zt{dM?>?U=SyMb=7o72th=5_PCp>A<^dUtlWvRl=y>DG4Zx-H$-ZdR-FLe0cK@#Xi|)4W_U_K^uI}#cfo^a2VE1tMc=vSoO!r*(eD^~4!|rF@ zsC(#pxO>EV;635J^n1p8o9@-!yLs=!d$;c0x%b6A&%O40%lDq&dvWjOJy=gzPec#5 zhu0(QN$Y`nvU_rR@_MvA#vW@=VNX#{bJkaFT>W%J=>5cD2^%8rNdr7^NUZ5B3<@O4D(|a>|vwE|8b9$A%+Fn<0L2qSm zRd03grrsUBJ9~Ha?&&?yd${*P@7>-r?Sn-mzX^?{x2c?{e?gz2EeH+xxWl zhu&ws&wF3?27CY2`)hA_AF+?#m)|GrQ}${5tbL9?S6^vgSzl#ebzfcI*1qk1JNxSU z8u||O9qv2XcdGC0zB7Gi`!4jo)92}H?rZDo>htyu_TBFr>6_@A?3?bJ?VIbH?_20w z?0eYvW#3nQU-$i?@7uob`kwTC-}kidS>KDkU;6&h_p&e8_s>39e^`HXKfXV^Kc_#x zU)itjH};$QE&aBBdw)THVSiD7X@6z^rvBRgE&X-=-ybaDJd^;LgC^0nb3! zK+nMN!1%z#!2H0{z{`Q)z^j4K0L%;bMtfttao%`uf*0vUdvRX8H_1!z61^lZ*-Pdbo9$J4RbGu(>(zNpUaQyUb$YA3C%vbu}p}=Wy3>_wc=8@9^O8{o&!^kzwEP z#PHQieuO+i8KI8Q zM(87~5nzNp!Wj{ch(^*zpb_y%=1BHP&Pe`O`d8nKL6M{Fa7BSj;nBb6hYMrud4 zjMR;69oaonKXPE?)X4df3nTB0G>u#txjJ%l;!(+H`lxZ#IqDiM94#HK9<3eSF}ibf_h|j-;n5?bM@Ns1o*q3j+BAA?^n=k4 zNAHY&I(m21Guk}bHQGJeGuk)$X!PsR$D`kkJ{kSX=(EuuM}HdqdGzn2FGqu;{~CQY z3LA?aiy4a_OBlnB;l}V|#4++1Fb0ls$9QA9vAVIXV>`xnkG(#2VC>-7;jtrQC&x~Y zogW(>dpP#x*rTy;#vYITaqQ{X4`V-$y%_st?B!VWIBFai7mh>Y>Erq1vT@`1rt#YG zy73+3_2UiW2ge)7uZ-Uu?;ZD!|1kc1{O9o(<1femIUX8^`NDkhK9mpVBm1~Mo=@n5 zeA&JnU!G6q)B1EiqtE0s`>Z~j&+aSm75a*NCB9N$nXk&X&R6ZL@ony$J`fm9?_jUQYeZ9Uu-+<5S8}tqN#(h4Y z-xu&r_$GZ*zG>gAZ{D}yTlPKlJ@$R;`_A{h@0ssM-(P*teJ^}}_x;27%J-}9-@cF! z<`45n_#^#M{%C)^ALS?dll>$=*$?38`H{DuA^f2F_5U+v%F-{s%qKj1&;KkRSxpZ1^epYvbvU-7@^zvjQ`zvKVZ|C#@D zf1AJE-{tT1_xbz%!~PNfnBV80_Rsj|{mcGG{;&Oy{oneZ`hW00^FQ~$^auUF`ojYe zf#^Vd02jaq2!Z4PJ-`S60d4>ahy&6um)@aN5BsG>H^yX^?`=KfxzLwk-(dQ6M>U~Q-QYwrvqmKX9Mp9ngW*sR{~c9?+300 zZUk-xZU;UI+zEUd_-()wXb!Xmx&q$7VBmgWI4}~J2uud11G9noz{9}TfhU2dfoB2O zMA$_5MD#@L1Zo03ft|olBu$VfC=>JvU_v+{nn;@vPh?NzPbeph6Q&94gl(d5V)w+J ziTa5H6Ne@mCyq^=m^d}@*2LQr=O)fiT$s2r@!`bB6SpVsPIxB+AV^^=DuPfwniJU`hqd2RCgq^2y|%C!bCJIQi4$^U0qlUrq)mUroZMqNie};-=!K5~grd#3|mCb;>s7 zoGP5EoT{2yKUFKQ)9#1`+dNCFK z0QCU(fcSv^fbl@}!1%!Q!1}=Xp!7l6gQ^Fc9vpaZ@WIUoy$_ZjJbCcv2R}TBpH7%Y zP2;A?)0An(G;^9W&7I~=3#U`3q3P`Doawyj{At;=d|ErLn>J2crwgZxrc0(vr^}|R zr#DS+p01nTJ>4*UZTkB3&FNdycc(v}{$koQ-8|hj-96nq?VTQ<_Du(-C#UD9m#3dh zKbw9&9X1m^6EhP(gPI}EB+rm$C^NtecSbmqGgCQJJ+o8)gs89-cipdusOW*)y|EvzKPC z%wC(lHG6yZli547pU!$_n`cL6pUi$g`*ij%v(IK<%>FX_kJ*>A!CBZ`*j)Hr^c-pq zJ%^pc&ynZobHJQ%PBfP`2hEA+vgZotisnk^D(5!M)y{31+d8*%ch2vgub)3We`NmH{GItv=kLyY=DX&*=X>V+=7;A;=EvtJ<|pUp z=NIOe=9lMJ<{!;}J^y(A$^5hVALoCXe?I^7{LA@-1!zIMkiL+;kh`Ew;~;xlp)JxlpyRexYWeZehp5;f0e6rx$K5++Mh|aCf0?p?#rqp?jf!!MiZL@NnV9 z!pnuI#h69ZqHs~P2rZ^B<}bC)1*rRz&Kmu@ZHUHW|Ki>2nJuBF~3@6z~^Z)sv_a%q0);nKHD-z_~``f=&` z(u<{6OTR9Kmco{!mnqB2W$kk1a`p12<(%TJe|Ek9p=x%{u?UzfvIqF3Tqa4Yx~!b<*%Y(=@EU9qm%Rvas? zmC}{6mCBXsmD-iMm8~n=S9Y${uQaS2SUJ3Ma^=*@+bgG6&a5=8e7Z8RGPyFnGQYC8 z@^IzLm9JL5UU{RK&aEm|#Itz6x*x^;E;>Ymm5)f20yR?n|qSZ!Lpvijlb z$E&wj@2+}Q+gAHl2Uf>deXA3z)2j=s%d2avU#>o0eX{y=_4(>AtFKmnU4^ZMuc6n7 zYsqWmHToKNjkhLP6RoAMWvped<*#Yi3~Qz}=bCG+aIJW)WUX|qY^{2&W^LnI?b_D0 z9c#PS>emjh9a%fJc6#m1+WEDnwQFnF*FISLaP9x^udV+t$Q*ke24~QD%l%V9L*e&@ zF~uY0_bT4rd~Zw7mY=p*w~y`}ZOA|L)$#BXC8tlH&OAGDe(u7*-uctTmFs!#`hxJn zZPlAGrF8jW?{l6TD zJ`_5{IQ(JbYsdE-|I69S?`^k#SoDw0>92iq;KxH1CsAkYZ{L0Yq1#@7%mSm4vFE zb-C-!>-X2J-*Kqnt%k>k_a13Ka{g%HF~;#rr&MQ1=U%;QyK1=k!2S<=obzXwqcp2V zUQ<_-Q~MuV(Yrovcx&J4zPI1_^!S65u;6Ex&%M`J^qUG-Nm#J+aNp7HO8{U%pTAt^ zK!L9EY1QI}*Ears)1NodU-Rs)IQaDi>O1h@ktW@{FW-IB{&#z=^WRnfTo+kWvUSg~ z!nX|XG+Y+kSZBZF+`UCv7vs9%e%Jk*ZQlK;cb7l0JUshQohqjuNkfz2;AzhC$E&QrU8 z-u-d?r}b0yUpDMG@a(`hhyH#@cjWRBe50a~bnNPh&FAnJ@lD@eMqJCjR(|8@2cwRH zqTEtf*~SWeWp6cRgSxJ*?rGicUb8kF*f)DXcIaP+x4(J#&FHhY&nnKpb9MZ~Cj~zg zm<#t5{8gDmVJocyK zzaD>nV&s(gbl2%m&mw|1FQ#4&T-|c*;SKD^KNfya``42Q^~eE8ad-D|I3 z-HWKdzyF8*`wksF64UtVSj6$zl6S;YuI}Is?T}H{lq<1bEh_^F0}Q{ddnMq$NzGo<4n%Eg^Q-^F~KSO`(=xp z(3{`cmR^7C;NZc}kH2~P=;`%mVuS3bwgp@!lf^Ya$Rx3_#nCbPc;d_ zxecKWi9uu#6+{OyL2U4oCR`97ObQZ$#NfZrCI?f3q#!wXbu%ScyoVa31;4vW4>~p; z+E`M+2wvP$y>;(v%wSdnD+mO^V8Ri0kQ03U^i(mioEzi?`9VQY7}VHB!7VOh+4C)^ z#?;{6vify5HccJ;W&Muoi4AXT{By-x#qZo{!TK`ZdQ3GG6bB{2vU+JSJ(v;93}ywh zgA3Plg1N!GV17^*lm`_-Wl$AV2Q|U5UD}{7c>h?(#hUmHt>a%RG@|zh~Dw zT8fAzfzsmjJ+*(TZQRzq-S*m#`+qt_J^Y6w58itBwB%C7<$+B@yAJK`Z76IiF0z&M z*DP-eZ2op<#cMlv_3e7zplKXDraE=vOyF$!IojpRI|>>K-$1@o)r2a7mzI`pSQoY7 zqfL+N_BE^??tJ^{N8i~`m%LWODNCqqugqL`YJK{KZ#Q-B{pYcBr+d$zz53Nhrz(2Z zcUEJZFgN5*D#<750zx`m|q41NRpZW3p-!2&6K{Vl-3YvaxvR&SH_0ju_+aq_EzW$rn>-KKkfB)c< zH$Hf?@!aR7f$Gh*zt#?IKEH#yXL3*ZdF-{F_G5>>wtHMNt`&ED;b%2_wm9p)siW>Z zyvy6rx&Qk^FB&(VJoRp+>;2lwEtj`EYzQ3Md!jt3KTl{9UE5VTeC)Rx z|6x_xwuwD&>@&UbJ3Y0Iuw~oMSFcCZ@2Wrk_8*$wawJsUS|59|$8~FCZ9|Ja(z(?&={i=2-qv!s z{qUa;?>fGCmUMCM(mh9(>le4W@Y%Z8YUCSywZGr??_KD5i z2X6o7{o5(K1qU}=RKMR;1KYr=W$iNUIaB}Q$gak}o@8HSHJL9Dx(M!1-0?dnc8{K( zTz9;-W&7wZ`Qe7WPwbhFVDb83e`S9axw>Po=#3jkXOHR|sZHtc{{5=)ed4v6kIy+i z+tqTg>r&6vKe(%dr#FpnTH3a57jZZ0^*`?mYm9uW@~xjPL|l}-zw3j4e%SEQ`2$A} z-a0aQBK-2vk1l_-diI;r@b#Q6oZWNv)ra3~WVpDyH@rS|VD$X&&%ZeTkE?IlfA9Qj z#p=52wX=KF`szx&pf$oxq8OE zSo^mvU0YQ z1&T`vg}5gqB*a|_F-SrJ5g-YH2wHb{Z>hV>sk`f`oj%m={N~R47u@^qPiyw4J+o)6 zz1PgbFv+XSq3ksrfzT-XA?v58RnWmFN`X#Yv!}*Zd&&CPdft86{lt5weGIxvc?5cB`@!Dn`m%&qfRvxH&Rkb02Zr|VafP|rp7k3!f z*IHfup{1x9#H(dcDxH>5!Dano{T0m;S4g^4v(3XS>DFP+fb~ik2FuDrb z2N>-QCEo0|m0eWQFu^GK=gNnbq2_f6kF6BZia3Kj!)X!pQH@s}*1yx!eLK5Oh=y2J zBErymbU3S%HI3UXI$Y^iMb{oRch_^>{^qY8ChI0xGvXogBq4)>p;a-|j7_Y|>#7`ql!D>5hhm>1>yPE&EW(QWa{}cGmEl1rrHV*#WZ{<-rFC z4=I-_5?OL~nrN2%mgbgey5~0XZP_N;IocrlDf)WGBPM~%;-BMBkp3qxQx;Z_H3ir5 zEX(bO8>abaoon#_bPa)rBh%3^Og*zwFi1aGPchi*46Pr%f03;Mu1t<@BW98pmz7XA zQD?GuaVoeAMfswED!Hzyrrr|n_|Hl6eeK#!-c=q(TTg>Ae=>hDhX_6jy5(o&kM%9B zCrP90BOPT(BI*J?g0YQ}$X>uZD>x$WQnYAWb)%~7#$=P(^41A@djg5DV$=oHUDSE{ zYzDw|GmmjU2=LSvoC)n9iG^?&pqLtdw^WK0$z#Jb9J zja%LH<_~Ro?UUe*@M7E=!gTT?ii(;=&t&dp_Am#s9PAG6QPGL23Ho&ggK?H=yJ@Mp zp>C!<+Of)&;B|F}!N0&NKoIAr-lI2Hh}n6fSn09K^M*TyuhwtYSlgq98O~BS&pQ_; zfsLYEVo&7gE2}H>+i8?RJg)S*l&55XIn{ZV*Oq(!NEl2jsae_j7}1Zilancc3hoLv z%Z_V9YHtYA6hGlsWDouyhL5*efvsF!6=S%=xkj^WM-*bR6jij4A*)>6aRPPN)Nw|2Otzpc)e>P&a83=Hj<&8~$0fI$dB z&Tq*w=`6*p>UZYg`iZWq&0jjgp#MNW!YptsQjDC6cA+2PW)WCKB1uU) zPwJqsz)HG`xtb{wt`sH9rfRcv$u)2z!q{faHU&&;YeVcy8eTN~Y)~}rYkcLp=N|3N z_udY??1)D7L(V`eu-oxyf{5^!x`HO6N3yB~Bc&%RZMp}#QTh$0o`z3eHb{a+Q){S4 z=`+d(v+r{9HS-{*`sFUEtW?5bLJ+?)uZaH(+Oy1k?uR zcHU+_S@^GbgrrQiQNFt2T0^?uO-m8r4MATGqn zx<~z58?Be=>kMJ0rrIm!Q*{rma6835#&NHK)wt2Q&h^XxFwogmjO2pD**wq>pNW)` zE0`F;S@|Sor_!hGFju+f`Bczm#y&npy4Erf$_F9r51eRGw<*TLxBgdQ6c26Q>>mW( z4Zj2*hbY9X!$f1VNwMTdSDV~U zYk1Hw+DE}3RQzr@g%N->%|yM-B$JI(PEiWMSgi&B6Mvx0N!dklQ8DGs^qPuNrkiz} z^@A0~`OGoMC<>8Qq`#?`)jT&0HEp)k*gWCR95X?rmj)^F74?e43PI&M^&LH?dQFYS zxZRj)8d>+QUTJ^YSmkmzPiZL)Y-;DA5M(s>xL}5GmMGNJZb`Sr+1J_Mc-h@F9rNZ8F8%boC5-@aIrR^3>K&GrIASKd9{cO%4pLirHT!{ZoPCu&$Q9~OK}tY`q^Zj5kyvlJKfrFGeq-)n zO}O9qqeLrdJ^2WE3MGgZMqf;~R*YsOGpm@XJUc&85G#xqzm&d~RmuA+wkf7o(o{#( zIL#Z)UY%3FK~Jmhs+nPouXUO4nBQ2u)-86IV}Uc*RqGPCz0G@@9p2U6HQt+Ez&F6} z4P0v**?t{WjgKWrNQX&RghX+-bb?~9!eaPc`?##0x{jJ#{*F16Bj%!bHhz-ui}0!Z zPvr(xsdl)2l5w;tyY{QO!a}znx7WMJdiwcy1VZU3>nA6(xqsQTGHw}F(P`w=-w^+y zU#&^D$!uexc<4*`edHok4ZS~$Tiw@6@ixL@QOVeIgcZaEWGK0m984KP%_~31oXg5( z9b$iFkCs1CrKwNUw3siLy*8GeYkzFVG-w*W;;xe-sN(YX^f0cMPZpV_SGAaWyyH*P zL;oND0+j>tL;JhimokGK=b8?*CSlf+ZUZbLGHks~Qg6npH*R2(Hy@TJd z8{FQ!2OQ>$^tV96U}s?4;6+@?nbE3SZT0{o9%tBgWWOThcJc zJH-EqWuW#lZET*vA&-NH5PAF$swje>>_XWTIZU|^+z&p7gNV8KID(gOhwz+q06YjT zE4xLHVt5#T7>B@ntixat?+Ex;%24!xR?TM3qH0PtV2~J(f*lkQoAp_O4 z1inHzu6l}XtMdwMBix5Lg*=6`;rEjEP;zOl+y)_Av`f??r7NZ@XDj7~1+{0)gPK}A z4?M@gCMW_{37?5LjXH<=f~qH7BTXicq?u@6nIxG{o~<}q30J$-d)58)2WuRr8x~64 zQRgDpH`g1t#rw+p+IthproLy!v*vQh(qv7KYmna!Jpm$lU3{0=CXF%dF`+DrU9H~F z-k-jamiTrT)Gj^l%|mpf9;1ihhT@jv+KI=B$4Jx5vuIx{EP_;_Oym;HlV!k!*0c?9CrMVOafj@vtQDM02gdpNTvV`Vh#fcJRixnUB#|+_SmO0Bp zttVMyY{3qU>zohPE{D2dLlHd0DR3@kEk;9HNzzgDltYvymTR$c@zfgAOIj0?;+tbY4l`+NJm zrrf4tSEftjg1FDPMV`yx6>uQ_DtL`=Gi))j2|=g>j0 z```mGh46~-5d2&=ib|qRD1QV#2A_aW!A#k6`7=qV^^D z3Ov}by`kRq8hitO^@j%Dg73f-$=S-YHRo%7)r@rPgZ4l}kP_5;@F4mT_9x*4X$18G zRV4ZVegt{?q}orQr>@cdFDUe>e4oKDAOI!8s$n4hIdhq4foqFrZ{R2N9o|m3O~@(# z3Vs8JYrcc9+G7n&L_X?2@COKj7oc1uhIH6;9h!z*gFZv}OMsJbBr>U@yoh#A6p)Cd zb@KldJC!|Ev-EupZ;aDxqb+AFAMB?Z&U?wQUgQDndggSNPO?XmBs-{YG?loIcx9bZ z(o2q?uMt0}bd%S!Na7vZnYv`_J?{YME$DbuB7Q&qBVIu0Po7UPQ4*IhJ2UO zUOtaLjB}VjK(JK|m5x`;Q!Y>(a-mf z4fIFOr2FXvA*1rF=7_dZUyeFN_E8py_e%V_A-<;e2VE;GG>ppnAZROeBa{qR!i&(y z2yLWn%0|k66eIOSd0IslQ^7pXtYlTO{;)Y*8?S<&EjS{4B^)QBh{j5mN}A-qtfjEiwT+oXV%JtGK{; z&CFr-vOv}tb|>c+=QnqRSR`gkpG#-T)+y3dST#}oP(5DLs`2R_>hkrH>UzUZ%ZfU* z{jfdIXlxqq61twc)4eym&pR$L`|Gwh9`oQygUCqKZTcAbG`Nq{Mcq=)r`_P(7S2)3 z(d6no^zqevpK#p3Lvzr7Ffc-Z^q}kx zrHmEN{+B(I^Gc8)EEYA2cS|10>y;(CVEt_UGW|Hy-MVzU#V%>IH_dm(yP$5QJHO>} z0MxA1orMJzwy*AgDGD`Waeiz2MfP z?(+ED9D&B%g>Rz$VSS|Emkd#!QX;GOm?4eKp98z&?$K8fC7pm9d%>4Z2!o z=#ROMQR3%TOk_YfxSv(x-hmC`uK|REX%RZD%;4}E=s@k-FKuFWsCXowLk;%wb znKg4gH7&gEEsV|L7t%F~JBs6)p*mCbHl4q^%`vD^-x3)p38W$)l3p<4*mLyn;m1&F zJf23N_0l#lZ)=(zUdKTA1h^6zk6B23M3GPvX%uECE19*7b%A?alpv0hPpI^0QjG-D z&DsOzo$yb%BcxX(E_G?e)T*8Od$kiRr`+G%cEmR}R=c6$IATBHU^%94H2g1!My8SV zw2|~{^v{fy%=4o0m4l4sO;qoG??Y%F%8!{rxLw4Q5WDW8a zx`k$@-=#0(4CNBJNxWvsRB2gNkUCs_RUM}B8mde;OpscL#nfPFq`MvNP3~i`E7|TUCfqd^@XA6N|W%m>Bggqg(vaNzD;V8wls{3x8=Xm`y zb-d;+^(J%$Iuo-Azmo8&97VrLPiAAdNv3S?*1-M1Y&Z&)kI~_Rdhzt&-X{z`>pr_j z{82nnu|N@RU(kX;_rtPqMbtJLl#iEeli)nRyiQto9toEYey6I%&7S~pPpWai96=FA|4-<-rM32LT+o`ll zPT$_UN~Bh*AL;6cKhLc(&a?rpRDTs5N7z7UrAN4CwwKY=vYV|mTp{smnVr6o(aTV= zp9nIAvt`MO#41(IM$_HKX#ZqnF0O`MBzvk@+px+xq14LqEjvV|RH#@NTB zqevB$CzL_dTIN1OhQ-!O@)p7RqQX!Ss5*2nIs_L&i7IcWZ>3`@`t?2*u!LKc2~`ga zbBzy7H1jrdqjjilu@3VdQ(vgsVAuC1?S~-r9)Y${bTA3 zz@Q6VgP|DMDpUmFG-V!Zy8xq5)w1f3G{9YBeIq)q;HyaRy5Wu;omWYm^2YLinK;2j z@pAD<38v;#jk~qE74E&}lOgk+zY(+0d(agaJ7zy`r|=&=%hb`V@~XQApiiT(Rz9m+ z(R#g=>|F*O2>U>ILHw@_S?;3?**Tm#!CcXTns&oX(}3QAy?y;Fp&0mfv@V#m*ZaVpwnNAToG5q|1;$=fTVh=g9fID3eIXy={_7hUzy$&U z6t){rs*AU8qkZRTi~_B-UHOdWl)SSN=ynLshEE z)6?~ns#8oz>!98z4UlHBA3;)RvaLb>^TbCmG%Azuo19sp7J{rrp<1L z4+?FD>d-gvy?8xgCwUq*nO;O6#A37F^0~rGLagYAs73rp{90Tlxh$KaASxayJe6ei zS>4#`$A(oVzWJ~jT1Tx@)Tq716ol&R;bYD^$k1tUw8`X!@TTLHprS=@hng)e$aPL>fEatwd z{Z)L;0%#isPFO|KQkIwBt)TIlEEFeJ#FTDP4A7fh+_otl>B1|bOnFYj+15{p63QBC zY5Di^d9)H*9xI=# z6sF5|7?kePw#~3ucpEAly%24~oWNvJ8mJj;mh`^7uj?-I3zC7qi0>nHN`FeXScciH ztTmR^7&EI_8gGW60+=2?fqIbop~A*mB>mSu#(Ah~2rP|pPQp^M>lo!w$B)iMi0_C2 zsAS;}!M;J&7 zr37exT0EV?dcg`v_e%FkSIbtb0nN4=iTzVvLP<#Bs)DKlwoFyJyp+lYWs!Y>%ZNKvQ%olnYQ}x{@c9zsr1p|CaVk z_j`-srYlit8u5}&jM%S z&&HpNKOY|+bRqs?JP_0aTnIV>3=KL1j0`#rlmuM^t^{2LfP06=_PKXt>{%cv=rM3H z=n;Sj9v1W(7!~vim=*LMxE%BjC=L1oTn+jR@Pm4R>p>uJGw7e7J3;q?egOmS9UdEc zuV?HVfEIjb(%nh_e`N^&Z`a!81w#N}5c7XH1A1Qs?R@C|A5K!a86#oSVQXMmgaXll zc!pStT!TzUK~Yyw|Dc{=KjHfj`V$fei3Ap@i_}eOBiB*V%Wcd*>^>YO2P!-uNm8z; z-cY@-`c(C$>W9_+YEo)6rb{Mq?Md4q#}fz3$##mILlnPs7xabPGn#40|1(j8druX` zeZT+!gB!maUJm?UuiJ2{>q5zy&d{#RlJA}2l0jYbm-Zw9K$|Gj6srV)ArL{Evn|kF zuNIikj=9|T#mvc2Bh&z`haQH$g{Htt5)ZKx$*fZKU1%XcuIqD$h=&QeAGOch7oVMVc*sNXP<@Vrn?)6xkgj`;onFt})KP;ZtT z-xvn~rwe}d@s*cEc*E3~{n`8S0ANQkYi4KUI^#EgN0_?ePpWd-k;bK19V0Ij0D@Kx z48Jt<%xnNS9eFghIkjI}yQwM(LOC@aiH(ogHhaA9Kw^d<9s0j*D3p#l116GIU1-pR zCx(vZcxo<1hD=YL@iXZuq9MF7VqLf=YhJ{nFxZfiZ~#~zzIJd?*pbMLAz+qwY64?p z#Mk+$l^17Kht-53W@Bc@r1`^7Mb3#xSOw=_Z3r};ZCKZO9(~-j7Xtvtx~6vQYNMz= z#AQo`#&?F%WEnHj=u4rZ4jOj3d&48bRpCFw?k>4Xba6`gdDleFJMrgyU5g{qNA`C+qp@8<%837o`J80KPKO2)dPY_KK=|qa5_CT_GieeT zK|N0GT~I<#VruwFf;53ZGD|iax>5GJ2w9V^26dj)jKU$i>g9f)$$( z5%mMJD|q{sP0Ed^6AzlHSrm9<$M{MmlTp>iX4kkE1mYc_`Sol`}0D!D-L4*8m=CI-sq`it-#|m;Q)}wi+ zJ*E>>|1kM1Yr9?6b=`ZL)^}fWQZ0`H6Ph=4?`_N)F3nz+JCgYSGM(e+vnz8mZ~$=A zqJi8vHo6vI<2yXX3Bqsg#um9wz|J^VZrqUZD?A-r~+H5wxqK3O~L7`h{d$z2l)r{ z-{)kO6_sJjeq}@~SW&jOZ2W=+3vww3DO0Gm)B&l(Q?pV_Q*V`L(4LcRsk>==X_shw zQfJd$^yl=LiXW+4u_0+sDt=br;FhyRAJ6s!}RTNo_tC!8uY3O_DfA>1k)A&L>r5Y>r}*!GK_i0+7Lx?hQ2izbT` z#f2F;Sw`_8F)u@zv0EA-+cRcM+!=5QS|XOzNNkcRAw7BjCjAqBEAtTUnkZBH2nS7G z#(nKjkRY1J_}eW^jb5{XuwS!9b5wIob4A+7IGb}vb6@jD^D$=|I*2@2i_y-|hNJ$F zmubb?j@lih8o_1l1aq?%0LGVX%wUq6&AnOxNYeF?^L4d4Q_(7&o>f(FMt4g0LZ{Gu z(S6ea0K0ljLB6O=e^b<`u<6(9lcd}A0D#M$QT|LnEaRIVjDD^c)&jr;8j&WdZmyn{ zCuo^gon4btv#2IneVP6^;HyDYEU%$OaR71wDJm}{tCa!inJ zSZJUbhEKCWrm~)9ykbpZuQn9f`x{3Zx8T1|tr7Scdtfga_Te!mN(_p}EN(5<4_<( z){(hf*q86)UraijF{bt%#!@@DV5M+FEdX4rtxmiy!tsa}Z(^?K;~c#C8A)osmhmiq zHLuvbb0J<00A9XIlqY&%1^{>Ml6;T(nb}Rw&OJiTD@e3_CI&>)3gnikg2U{nx+!(( zbv+iVB)HBr;(}xw$Sas$SCqUg=08-Myt+aT-SQc(Jv z4SxMW{m{mc#>m*a4P?oX#xo_CGXY?2W3XX(q#dG5KVS@%zSL}N+SPQd>3ValGtSAZ z9co_b4Doa?gAdy7oC$eg%dqUv_(7p3fX?Ad4%7u%rc5%V-V&v_7FrHzXfAIl0Kj&CN?Yqb?%trAZ?laJZ|)Z4G}D{^cWqAE+ZTp9?qcG@W_$Ra$M&}l zr{oy%iT$~q3CVAM=SXe%>yUd$EeDz`t*ct6wk&D=F5a7~nfgziZs?rMhmg?%t=H=n z=o% zNTYlJaKnxB6_eh&slF*Km*KnT9hhhHb^EsZ4*8DwuKFJN1n3XG(Te#k0PxK>rbVN^ zQk>|Y?_ca^`NPwdQbfkQe&n2fxU>G<{?q^Hl_}}@fJgI>h#j?dX zf8W5jKxkWfTVxx)Z3^yq@>bW4_D5|`+WNMCZ3{0M-X7Nu)Fr|b+t+Z9Ezr+{w`aF! zb`}sTVw&0)=LUEDZ4d3>bY1V<-QB!&{nE!vCM|uqw7RplGjVBnmz8t8lQhAzbo{dP z*!jy+JNGWxvCP%g+SS#ytShl}UDxI=MqW=>dHVCzF&PQ4Ln*Twg1ZNFdlye`Stg9` z27uJ=ZmbXb zjd`4`h`tiDm^vxtNE8V-rTEXVHA7Dh+ciAIvMLz>FygDI*rX%n;xw#zt~**;y%%vmMzHITHlu&|TQAtY+-Ph&6-5!cTgJIXXN)ptBIM z3zG8>K$(4NLKeg9Fa(xETpx5UB#=5NWO$#X#2K(7!P}dZ!FTMT!G7okco4ebTaICU9(fuRA;bDgWsm_aKWzs+OH#&?yT}wu5ycy;i~W#x zfdV6i#P*2|N?8(fKlxA8wd9$`MfQDTWQl8Rq115dwAl60d}4ZZK52N}Z)Lf)y1ab) ztf_aYdonjqIW)!Ul8cYfGJ!&1)YShuXk~f(?EZ1r3rpQn2D6YiYew3{S@6U+{;D}C z6{Hor81WTXDxN~vaVzLcXQwmxOd0oUdegj(2{y?3gfPsbgxfJ$Ef-m~gzfQ<(p))a z%tVJ1^DByknS%aM6%s!)CNY7L7?EI#Ka<<5-WgtB{?OPVOh2cDcPm}P z!|{(~wJluY`P}@*an5dQ9&5N~W4Ejn4i>+I06A{n3CqWjdj5NbYvh0m>@M1sw?465XWJ={D)M z@$TvSS6|aZYiM*btw`(Bn<%_oB|mE5O*Ry`lyn?7l<}j24!K`5O*?zQYhqqms5YGP zB2Z9Q(KecwmG~s}KgdSrxV9xsgL#_tir`ItiZM9<5oevK2qucG1+aSSVe1Pk(^hJ$#iDH%m09)8 zaof@10BsvHmz%#8UMl>Yl3^chFKQ{J&T2O2UT4mb9+wov2s^tQUN_v+w-Ju1J`qHD z*OO;9t!^4vGS6A;{F;jw>=#d%)Lx_(J4AP)U$^f}o(tLU0stwdA7sC~Ps?IEJ^Pn^ zTFaP*^oHl=S@uBd>Q-N?w>7b`KyftlZ&7aXo4l8qQxcrsmrblDX4Co1_mHaM4_QMM ze8sQK9N!k#BF>m%kLw{005~3-ZEC|@$DxXS%|l3B$3h4wAC=qgllm3}rbhIXop5X` z9_PQ)^1b<1>vQ*!e7J*M%y8WE7ubQUnaxum!_Db|(m+4$?~L|p*pAJCZsgJ8If5wa0aJw|`suXUT-lO(lJDV!F1Jgm&&&`hLlmC36ESI}e(NiXMth z{9l&&1uKMR(I??}^9Ktcx|PBxf1>V4%1(}hJb=(M?s^V27kLf`@2yfbm$p2EWhXLR zWtfaAbk(k^#Z|cIGx0f)wqzOXj`+410LDs&qj%=)$9=)uaZ#POaEa2*i5qg>O0xw% z7y#^yhS)=C7m0(32Xd|Xvs1K-f7$kX_IPf_jERt$j|heh@6DY$yC<)Ousb7%y+%)> zttj6MaX@-)&zqmfUuW)6R5-e09%pVZ{)hKP{!@N4Gqbp*_;xg_cy-9+;m;vOiYUlR zNhQSG{6bFk{OJ?#xoD5F*Lhw#ZeWriCOco62l*Si0z0zb+rfK6gE7a|z0rU4N2B1y z$e1|=K`nz)j@UOswh#`-)W(<?Zf0+`^}Wz`Q0TWc^i{= z3o^|Q^DpL46(WQt!2@x$c%U?+HZA&ntwDg2+>N#oOvLTcG@_K)H}+RfT*^nn!st`U zO;VSqjkPjYM4UzR(JrsFx6G&BYIPmD zhTJ{6mfZI`kMoG+Qs^c9b^T@iZ~dm49W~uDU*34b6ho?Zjv?NFHk{Acfm@D^kc0|MVhR+S78~ux@_+yRl7kz-HHT{D@ zl3u;#Il>CO0Ne)HDmP0fd! zpEkd3{?h!l`FC@k$L!hYDS#j#hr6O%f>2{x;#x9Wco1}px+Si4S?g-Z*Vg&o=a41r z$;H{eq~dM9qdqkDS@Em#z5dw6|N8Us;ept|4#em{N+35-7N7?ti%$eP7cXp!Xs^|9 z+l}q_+y8C<+Ab^^-yu#pIttR6*72tcj`egN>^#!>tMhxyE~mC@L)X@>gIy=P?zKGW z`nT&x*J(|DcMGsPcuB}e?y;5)gj;>G@jWejQ*QJf(XX=Kz9<|{EX z=LUD7e-2I$MTIg$b)hfI8$&hNouT(b--n9BwuPMz!*J(ztgP=79v*%x+!YZQArBu< zJ`gdOLXLz*Rz{9xYa^|Z-pEDCha;~=&K;6Ign`;(d0l+>80E|qIN&$evke&E&b_{oQ8m{sQbx7vk%s*V)3Af z5UkfJJSd1sR@nk<5oZX4!U2F&oLub@*N{O|xd4#LEzkf!FL!EN9FLmJWlR8S)rmY3 ze|A}H5&(4aFBh&5q$`=$O~PIH(J75n7E3Nj(F+YSi_F-pnc$Gk^SqEf1d5U3SV^-`!IV@)Y8^AqgL@UVve=k4WMMMfW%z2CV_Z58X0#bM z8%LV@)y}Q8*Pcz{nAg?y7QLvz+6Gi%n)lc~=e@K&%zI@kbX<4*APj5(fD_JlE&zyh zFLeKxL2;igzU*|$9N3pFuUogY?rBZ%UGYN#yuh)*^tSMJVrP42clD31N!=?-7PWeo zEtCFT<}MxTI=8Z;v?KJ8vj?-!xn=TRr>A&eK}|JQyp{I``Yds_qq8b4#nALEda^;_ z2skn|n^|u&FqOL(CSkFJHmH$;rys@&!^4||Bx`0@$%6_2_#Ul|na7O77L!M!hoDYo z_&fC_6R~5lkeYueN$`~h z2N-2!Ctc`kL0@S2F0FL`s@Plcr-F;gnI16=2kicC%N>w=~}*_EG&yTUb9 zb81%O4`=JJj&?;Ex-xNvrR#AC0Q^jerQMnLIS&BJuxp2|##KQ2btNJNjtN>S_c5Rx;ov6j$hh=?Eo;UBNIaGmSc{Qe#87-pJC<5ewkO0Y#bK8n=q7e z+PA)w?Bt?%__720e6vyWXtTL@P=h*xJJU;Yyaw(nc%f1leJ3DC0sz5n^pf2GfN=Yo zYAPlP&+>*~o7@_uh5jo9CYR_Ykbf@(fLO@Q%Fgzg(CeXxYICgsP)t6;1pp0h9P(S) zMQFU>b5JU*1APbGhBP()NdkcXX)ThkbFb|7wa@YI@b7C|(`D|`NQY|ypqC$Gt*QZl z@z~;3swPx709-JHXSa;_GKzdAH5dc)%M@<2M-{tJeTW$HBB9F8E zTmAoZ=f8&8@(I2z?KhLQ$@-Tdbj1MzjX>*D;_cGY0Dy`U(^k<_=>R}ZdqP`>`Zk|Y z5zM)ogeyDhxZ_N10)X4_!ZH2S38)3$^ay4)0Q^w_z){^u>K$F2hGnQQlW2w)1S1@``9}{l)sz#)f)`ePctOW0vZN;*L2fc^h|CBLJ+m z0l;2iPyLYWmx{X?mC_aE9keS80YFs_0MeQ`2LQY-uU#p2#Y(?9BZr--&=E=R%&@ z@;!HBKbTH0Tv(OQen_7WS!Y`kyq({7*m~Ie$phdsgk}wpytR1P6ac6WSwS^~EDE_R z8rKH^f)JX-aD>30ml9=O0jcj(j@U7uhxj}A*ZAkb^QJWQou5z}Ya;3ExAzS!+=keL zNbEd=xP-WZxVP{cVpZ{W#1lj=>OJB@Z6-G^MN1uwoQhnC+=;{?TabH^Cy*m_xt2%B zu)1M<0C-@BU~Y>HS?Gc9vgV@z;K|@~f~nD?I5*_Q&9 zmdwK7SR|nkjp8f9$}mp!3iPT)VbS-)cVv`?9kBVQF2cMonTw8A)M3_Q0N_?kS~jvE zDSta_M`Q~20?VGTg0+!ViiKhSt@;;R@B4!Sa38Vnu`I`=WZ2L`+{zr0z#+-SZB4Eg zyud{b55c2{SL98_e_Kq(ufx-l9^vod7Y_Z2|4Yil!IxI$Uh^zX8b?^gIhITiWkyXV zqA<--eJy7Q&@iK5rtn_$ZNks!ZPBZQQsMNN8&M#kK(wA%L41+C76JeRQoKZ_;u>+O z7(K<3F(fu2WlvNsLf*$_9f?!8b-b- zA5LC5dO9CMzF%Y^zb1bqJIcT@DPtqcV#*53R*c<8zE$?i6t^G<0vRu#P;W|Ja5Q}m z#m)l&4dp=owa`_l-B18ngOWxMq1CcAJu zrb*S=nO)@ou)W*_aY9g<6^h63B}4{ovN@Nw>c>@)k@gjV?N?7*N7|i5oqmnh=_m_a zrX{2rX7o&-R8FRiWjZQif=v`W zocFFR@(*UL$O(l2kTVOPC%;{o5LVj` z#=9pwYf?BYWAnB9a&j94-wcL zTuye*ecED4wPdx#C^;{=A-O4eDCv{)Dr1M#D^=yrk`_p<#9}D`bdZ^OFe%;BlRH~V z%%4^~v3Q^KmE)i!T$bB1LNX4AO|@Z8BX^9koH$mZTw%~@DDT< z+R{?@7AVw9hq{-#XCf1sBt#}MflP$B5`z#zh(Z#)`mMXWySuyhTX%*3x_JvllyPx`Rek3ScE6p2a}Q8usxGKjtH!s^%sZu; ztA0H7Md$Q+eMQGc@0eRQ_xIfIs!r-Ax&7viQy*!1V{%;Fx&d7EX5Vb}Q3Y4@Q^%*nmpG#k2BRU&tE!=*~DAd^`zR}t&JuwuD9lvZ+`b1%(cFv@IuWz4XTl8 z93XB=hlM^(j=D~>Rg<6{q9tlUtz4_se&q+W@9jUvw99RiyI8wiyF+_cTQ5fnYY7%& z&)&Ut{dC#74T2OBUAK1l2A!ZpTym)M7hPPOwnO`Qr^OreC-hhJ%OjbFhm;%ok%mqB z*4mx^LigZOC%0!mmm#hsA=hT0(Q6IkOcM>O41;9-@>fniZb%AVHKa7<%xFt;?EDcI zmz}Z-{~xPiWUKi9Z*Zq|_J3D6dfdeS6gJknyPx-*n*Q$XvbOyWRck-JzyJH!_qM}l zY-o7@x1k+(V_aNnH+xF5dnGqDH$84f$)1; z9KaE{SK}@Z>RKxv6$NkpNIB~0Il!SQPZ*oMXz{V+{Dnu8V!PPP`04ePP4p>``?M&D zKb76QNm5mSbO|&!Nk~mODC^+dcIWFeT>$J-HM&ddIN9#RVO%J#w_cp4pw?x4_U-7> z>iu(F7iNz`$+5EbUAJF|&r)`04%vP%p??DZ1_ zy=M&W(!%8!-E~pPiyCH&!X^o~18?pW7adr#uGUu@OUalOH>=+IHDARKkF|y`XwJ<9N4{H*5&=(6_dAb z)13<4SiXIpta_JyA=&_atVSB-q#L6f4h)=W|G7{2&$MxIanrc|xbp1m%NuT7x)Zl3 zw%OE-loIQFa#CVk+<*PW_?DYn*#2u2cS^_P1^+eD;u* zZ5sQh^l0qf*rzeR5oqX_l957aAU2R1cEmvqlm==8t%23pAtkG!W6FpIb;igBu%Sg` zV&kZW(GASToW?N?V;edGoq%x-;~SEJcEE&&i484*R=}i&$qg-lL|{roc0+3*37Fb2 zt)UIj7MR{JqXBMUG%y=j4LJ?$hX3}_dI7zGQ7OYynlv_RY}q&=Wkp;Q;7rDa|F~x7 zGn(~l+V8)mvwazRGnNi-nz|wGN#m5pa|v@B<~1yAz&FfqSkS;};5P6YS~Vs$-iZ4i zw<)fBTF=JbjlCL0X=oZZt#=wJjhBWr@EZgT!UjA)PHg-xAH{cqdHMR#HHa==> z+L+SVBsDQLw;``V(s1qnv6#+}So|M@>F9`!aWIidWD|3UJR+a?g7Qjz-fYisWH>Vl zGm0`?8O0gy41b0%qb$RlQJUe&D9MW|A~S2zw3Yf?|NTNvzlc!&uWpCnAI|?RaWb)q^vesZL^ZI+GVxR>X6kjt5a6z ztS(tyv$|z<&+3uYGpkot@2oyqDOssmX<2=<(z7zM`epUc8jv+G>sG?4gwqKp63!&V zrN^fyq&G>&r8iA)mfk$QMS5a-%k)<1t<#gz+oZQmPfl-_-afrUddKum>7CQNq<2m4 zmfk(RM|#inUg^El`=qC)uTA;Ch-l(rd_2AhemXt}@4|cWyYW+qLZXEDkQhgbCsmU= zk*AVb{eQ{*S)KD2-7o#6hk z3MMd#OfvHavn?x)HI|jnx|j1T=VQ*NoX7%@uxMr=lEPHI8= zO==)Dk~)*ek>`+SlV_6I?CC9{WWOw9r z;vC_$Kt?0;5j-+XSS*YRmkD_&mYn7#{ZurjlPWX=auJ{S~g?JE;$3Mg0#9zf8}d8yEAmV7 zAMy|KSMtB)=j7MqPvno}59DX$x8&dCJJj3M&TuB21*>5#Okp~i6Im~FUgSK_Nnkf& ztJr3CJf|zC3+EW8B|=6ZgoF^0<-+H}Omql32pxTydx4wpww9zuhT~V_7lI%- z8>E43a3shCDIfq6Kq5E^91o5Kr-KkU5u63`K^Djbhkv(TKEc+CtiF8lE*+I@KU%Ej=*K`GB^x-;N@@*lf`5(nM^OUl<8* zAzGvaks=<%j1(XSM1_P9ITAx;NCgr`f`|(lC!8Q0EBq+@BI2NU6hsLq5oMuNl#R|s zXQ5n_jM7k{Of!JLbkpup+D)%fpOV08?OIOpHaa5N5%gm=Y_%)R+s?Vr5u4 z7Q-BvR$*3H6nX`s_aEo`f` z#cb8KD%)n8+!1n=I?5cSC6`O$JY&4GycBP(S5T%X+fug1ciLC&-{?Q=Kkh%~Kk9#! z6AUZ~tPcDWSQ?lcJRUq793IJxWJLx=hD7?|sd&|Y-a)Fvufeay%fVW(3{-(u5Cf~h zQqToDK?SG*-C!m^I8wW;L@rYYuBBYZhwHey9iA!m`J$N}UqvJ1J4+(FhLSCFg7 z8RR6g64{6BMJ^(@kQ2x`WE*lD*@WCgt|K>)OW0A=LDX8*Oq3vM zBZ?EX6?GD|6g3wmp{-CUT8dVn`DhKQLUm{{T8l?QUY+k~CPo?%i4wjR5I9m76i z2e3WZBkT@#8e5CK$L?a+v4>cN!lwu+Jc>%i5am$iSmhigs?1d$RGwGfQr=KrRIXC3 zRMo52sFtfHX=*iAKcpkhD?f_}T z5HUzxM8uP(lje~Yk`|EWlV+1nkWP_~kPeZO$TYHvTt&V^UJD(BRzl~YQ_xQ6A7~47 z0y+%sgH}U_prg=9Xalqc+63)^RzWME15hK?K`W&#qAjH@p`E9#r-f-0mq}`xmWSgpY+8 zqM@P`QGd}eQ6JF&QI;rO^j*}5UO_*iSJ8{;8+1Fm0sV@;Lf@lD(M#x7^fvko-HBd6 z@1vj5jp!}(F?tWZjOIz45|?C~wao~XcKjO|Ze~lJ% zf~Bb?&XQ*bZ~g!JpZZ_=PY2Ei z4h4<`<_G5m&jlS7gvk8Jg2=)M63vaCiN1|~j>gAU#_q%(#3GfIm2~_Td}~4yp)cV* z*pHAw_yG6#N)&>L@J3zf=EnK4rvhCO0Fl@k{^&?LdleP${5NY=o$10YDW15 zb)>w4-a?O{M9MqpHS`?nPiap13$>**q2XwUX;*1yXh&#?^tLb!ro#-l9iuCwC!-Ie z2crYy4V=R0%NWSWV6g)8Oea^>7YZaue(TgENt zdbvg12zNH}8EL_9MDYB{{9$|we;R)lALP&FkLMHkllX)9gZTsa3;7H9bA)q+mBK^9 zW5Q{oxgtPFDefTdDxNC#NJ=C-Bz>{|*Z`~_mX3YE@}w0~x3pL)lIo>8DJ%_3 zF=>fZCS^#~(p;%m>X90xMN*-(TzXn@Q}I-BOL0UXM#s@JOfDoB%~VQCl|ShHVqOmjlBS+hm6PqSCEOLJJWQ&Xzls6DMcr#-J7sOzIk z(GAeO(gFJZ`my?6`jPrE`V9S0eTu%1ez=}uAQ-p?j)7`m8*&UZ1HZ3*@dwx;&CwlB73_8+#-wifokwwCrkw)eKT_BZx8N3vs( zW3Xd@V~AsqW3ZFtgq-u7W1R%&T<0j~NGIqV?i}YF?d;;rc4j#TIHx-ym&di*6?QFi zt#Wx?OI;%^f8>u(zP;jaih3fv1k4v>NigA0N;gZF|rf_HBgsjZNw-KhN!Lip$;IlwlMBWh^C=!lDeJ@F^oGQz zce1y$x3TxLM{&k*XdH}_%aL%RoJvj|C&pRKS;VQ~Sh-8NCEP{amE1Gjt=#9_ecWT* zJ=|^FyWG9po7`*M96;jiQu^4+y@^ge#AyEhmX+jPK6w-whAtbC3Rtwh( zF9^>F&kD~Ab3_c0KqMB4L~PMd(G5}$)Gpp2ULp>Qw~4J{t$34og*YnSD0YgEir0x< z;v#XmxK_MUTrXZMc8G^dc1!-1ypasXeA2zr&(d4c&C*BGv(l&1-_l>wrm_>#Gtv#x zOVahy`_iA%ozm~puhL`E%hK+$ZPMG)f2B92ucaTQ@1!rK$E8Q5tEF$G2c*xXKNX4j zE%W~>-YX_4ElRtxr>cjlv#Nuto2ppVRNYeDMBPl?ph{9dRDV-{SNGJUX@nY)2GJ-q ze$7?QHO)57Y0Wu}PkU8+S$ju2MmJeEQ8!vQRySTJ(NEXo^+JQ#AT|6pgp3u&6w?4x z57Q7+KT|hTZ&RizWR99E%(E=hE%}yA%Q(wKOST2DjIhkG46{tL47X%iCRyvORo1iC z^VZAOp0;_mS+-&J&i20c!S;c6z@BbTaEx+{ag271bNHNf&X`m0T;hy4_c_-%Lr#w~ z>@0CEa_XEWr`hRpu5eOZd7KljgRbqaqpoePg4D$5y^z~$TvOGgQeLOupX`Z=WhIf^Bt#^%grFXS=g%>RomF+LvU3SO!z}GF1 z6zCr466hP~6X+F44s;6i4x|Ly2GRnZ13dyA11|$_1Ahaw;Q8R!;Pc><;EUkf;HzLs zMP5V`QAP9-MMNFZMsyJ@axn5b@+$Js_`sMDYZ7BrKdaHyS?iY9?WtQrC?gaRDhWY? zjSwNk2vvkQ^dnJ8Qj;{KT+)5gJ<=T#gS?zQcH_eyMP^G@D^?b3K@K5jWX|lIzd1A6li1np>FfgbY4#!Z zVfIn>M2?iRinE%tl5>gsh`X7)o%@j6lh>E`i`$9!f%}{Lg)8QL$|A>E`|CaxbujPN?zvkcJlLWWSsC*m{WbK<1j_PK3xPl<1fWx2n_lO^LNlO!=oM6y@%UXqCo!-inPWMgHJELApK zhRWv2Qe+vjzOo)Nri?C2mr-Rh*-%+OnOrtfwoo=+HbgdE)=M^7c1Bhr>n6j?__7%? zr7Ty*k#)=Op5HGY$WP55oiEGpnZH0;sI)0Zt1?t0RRdMy)q~U{)M@Gr^(ggd^+@$F zbq{qv^#FB-rk_Tl$ty_)!x;Dy0^Lw)W*>#ggm z>yGQG>!Rzvi{?J$KJ4D)c9uj+CV03Wiiho)=$Yz)JWLP4Gs`p5Gu|`WL-p{y4(|r< zUhfv~KJOv#9`8Z#R__k)cJBf2POqn|sLWn=zU*GvnX=num&(qT-6=a>_S^Tv_s3V` z&kT$TWCg|sh6hFm5`td?iNS^dKPU`d2zCs03iS;ohI)sRLdl`#p?0D23V%guMX(}V z5vuT2cp|awu{vax`*0aw76R@+opQ+BDWI)*|*I_B!@H_A2%% z_BOV@a$V(-x^s1x>KyoWgl&Y)ge`<)g#CoIgdK!Egbjof1S?5LvXCB-o|B%E9+RGs zhLImoUQ(`5o>R_K?ov)rE>WIPo>JaZZc`pnj!}+No>5Lw+S5AF*mNSDPN&fsbcimY zFQ7~5^XLejM4wMb;X{m5jI)gWjD3u~j4h1AjLnSP9C^+Hwt;<$eUjat19R4L)^ob^ z+VbY``tUw;d+>g8<9RK3c-{iu4BkTCWZp<#e_j%=8E*_P6-h%n2qp`93kC^>3ML7L z2-*sI3OWjs1fvC=1ziNq1ema1xKS7tm57Q(Zc#*3D2j>7L`~50Txl*NSC`Apg>p5y zK&~TqUamM-lFQB|=NfWdxjDJ~TxRZUiBfVjA%wn279wq15u7Le7-PRNeQ zmdj$Yy|Uf1HL^>xh^$6-RCZOiTDC&ARff-p^K&&n6) zQ}f3wNy;&*nW`zO$tt;;p{A%gYPNc+dWsrWGu14$R-@O%X+LP5ZybSPrp$g)yMQ+eTm+z59-5utKMj^8tjH4 zh5HOWjopnY#*W55#@@zy<07NZbkM{#$xNtelX;7In>lPTSb`S2#cyF+WY%13o>ggG zWnF1qW~JKbHkYl?mTy(3MW>?uIc7xq$7ulOSW;+~(y243?S%sQHQK6)8ZXs64 zESy+4s*qR6FU&2J7S1YUyI3xc>!+(jaf{;S#c{{r?AvZrOw%QpL(_!IpNzLx%a z|7QREz`OuCFf9NDCI%=0LSS|P4B!I`1H{1Oz|=tdV3!~k%nRlQPX)(>XrZy8Nulh} zHhcZ6qz>x8$2+k|U` z3xrFAkA(AtR|JIkndl@rNLl1{2MyL3qN8!XS`zEU|eV1WISPLnD?14n2(sx zn9rFnnU9%InGcvrEQD2PwtW2rMYt@3nU}35%P}m23ZIB7ui7hWO<5w zh`g;lL7paWl)aZVlV{1t%7@GQ$~(yi%ZJI`@nf=Zy~tMk+fwN#DM1U3D&N!nK0L~RG{BkdDyq0XYS>Ug?C`g;8e{TBTy z{ZhTp;5U>RGL2cr)y7rEx5oFz#ij~VsYzpsnrcnuCckN?sn}F#+GXBn-f!Mx*=VV; z?6d5*EV7)oY_)8*Y_jaOEU_H0Y_sgNtg~FUoUp95D69{ykE{=@Y#YN?Y$MohcE8p=hy8{9m%X{8qocQDzT;Hkfx_d3M+++p>k2m)))by8+*x?A@JeBzaBtzI!qbIQ zihCAMC{8QRC>~kdwU|;org&iSXLmx$7xz#15BFd9OLzB@_wIi@UQeB8si(}d*c0|F z^Q`tP_pJ29JV8&DXN4!vTjuq8uXrzcFMB0rm1PxWf66-g+xt8DJNTFSxdD2B72pTp z06TyLastdiw_w*`@1Q2A59)&Ipgv>^6@_A70WA@ zRa8c5BGr+zk;{>|s5x2`{TA&K>l)h-+Z1b3*|f5CWn$%_$_-T;tDaX)t)5o>rRH1B z=bF8B6YA&H&zGD8% z6tIM>+MMzngw0{|*pJz_*$>$F*iYCG*>gDgoE@BP94!y!$#^+D3eUka^AtP@uYk9L z7vQbo`FLx2RlH@qa^8AgCXy?V3k-rf!DfM55D;t>EEj|Y6@pcQkYK%FonVciO0ZT? zDOe)dBG3qRLcMUkXpLyAXp^XKUZ1>|x$$|u^Sb5z%}vegkk>Nrb8bRj)4aF2?eYi` zykwc=nB=%*irg$OloRD5IV5+y8N0`J3`r z=2Ml`O1z4u%2k)Do$3O$O>NbrXa{QhXw$X*w5i%OZIyPn_NmsVE7o~+L0zftjQ*H@ zxBj$#zy6wjul}NbigBVb+c?QM#yG*a!MNVI&a}yN)U?%f+;qZp$h63G)^ytZ(DKFd z-tyaW)AGi0&+^jp#B$qm-}1^*XSrqhWcg{)SasG7)>qbkwrYEgz1F_SUS*HjyA(|- z>R$A&a7fY6q7Fsviux9%7IiFoQOk1y5N+qc`-%iqJ_ z$3M{D&p*iD)8E^l;m-}o0^)!)pbG%Op~3#atYC4lBv=}B29JgIgm#2pht`Ikh7N_c zg!YCmhfah(gf@rPRcxxjMVm#NM-!vmXj!y0>W`+z2FH5Fw!~UicBpJ$*|qXs<;BVe zm3JyHRbH#STzRWX@^o7E=PHmO}zx4-Uu-AX#CzCE!ku_G~= z*okN(t|s0i21#MkXA(@6Pz}^vs(`Ae=268|AvK>Wr(#rus-+&H@28)jAEV3QUd)k9 zJ@W&z4Qn1}GcU+n#q;pa@wW5!^G@?l@&M$R;E>>qV2@z0;I`nX;Dq3?;GE!q;IiPV zV81{uJT5vV+9f(FIw9IAnv^#-Z+sq{C&{Ddjmw*nhvf0{=I71M8tb{9E~V^N-{o z%@?a`)JxSdb-lVy{aD>vlcX7`9jhI$eW87(U8Jki)$5k)Ug~e_-{@cH|1m5y;*GP6 z3ykxPyN$O@?aZf4Pfd4Bk4&#j&rR3N*Uc>p+7+}Y=uyzOpm#y9g2aO40)ut4^@H`J z^__KqZHs-CeWm@ky@iABfF1LS;G#K2;-cK5=|yvkq(yl}>>_7zeQ{m!lH#&ro_kQq z@RE#@!6m6Bt4sbVdG7h;`PcK&6IXiI^TPAa)8L6OO(^~DdF%P?`R4iKk$9!vu=k61 zhA+!E(l^aF&Ns?8!9UDD)<43((*KWN6Ho{A0cF4(Fa|~jL&22r=&tN3KQMMB7C>N0Xu*qHUwhC@U(8#-c!MY-~bo zOl)XuTr547Tsfe!cV&;t)XMIaZz~^HeyrSCwYTbb)!V88)xqjcwS8;*)efj_U)!Vh zX5H1gvih3(LBu}9RN`>rSCWrvqXwu&)MBcidX0XCeu;jb4loBX)0sx*7?zl|H)nUw zzMP#o67~YlKF%rLVcrSebKV)=aAYKMUT|7)Q}9smLGWDgM(|PaSnyWh5ITjoMAt>O zyz;!lyd`-xd3W-b<`v{c^8$H`@>r7flG~CN*iHFI`2+bw`5pOF`M>h_a+~~({E_^X z{F?lo{Db^O{)7B?`Oov8<-g5;lm8|EVg4xPETuxFRIO5PRR5!1sh*{srd^@zMHqeX*jLpqS<_6PuQ)}}>(?j!J^L_JU^8@oO z^F4EB!Q_Hj1!D?^7fdf0TrjC1t6*lq)Pj)(;|k^!j4GH?FsxvP^|SSlHQ%PRDQt3^ z%68m-#J<~p*nZG{z`oCZ%D&(J(w^wZcdRZdEGj6fDGC;q7i}o2E-EfsS>!1~T?dOV z6>llNTztHEP4S-M-Nh%1&lFE68C^1?WNgW#lC>pmO1qSHEA3I*vNWZ%S1GPExpb;` zidW_R<^AjZw-1G zg<(f{Kv)x=7Z!%+hr5Og!dRFYR)iU0D15r&OvTxXlNHA+Hbr(uu19)Cdq)>VuS93X zw#Ph9Owt-Duur*3ln{QAe_3hH|5E&5IRSY{6A z32y}QMes?`AZRB1CHO7)F4!TwE9!@C$y=LuByUgN&b-5U>+?3`aU^=l21%l#m7+o3 zOz}(JPSIBJJO599L;jC^ol2uxp+2DQq@il*T9S63?tpHOZm+J5VZDK8M2uYHQR6Y= zU~_--AaieXUvsMYg&8WK6tD{z1-t@M0bDT0`qTQ`s$6o zXk*dtqFqJ*6umEgQ~as;VX>=ZbIF&I0j1+ghm;O3C3u^b!9KoEg{#8R@YRaz6&EY6RXmQ|jogadiQJE* zN0&zbiLQ(Oj4q6Uu>~=Fj2zn?n_M}ia#CexZu`C*F77H{MrXoUpC%q3E9IS>C<8 z+j&>=dMNrR1}M5KdMP?7x+t@(wkQj4~ zlg(4iW6hJyW6arRNrAM$P>@@YS5RbC6>PWevhK9rw7)94SM<8*TG7*@XGPzOeit`& zC%JzXHxzSAI3?5)cFELIRw=!7ZYiS_UkaAaDuqj1l(j4~`;@+7pVo)@j6Ssw^5gyM z{GLE*U{i2?@KN|u_(Awc_+WCfrYu1HpzR2S5UR;cY~7-Se? z7;HFU{AOHWo^D=fesBI@UhlUQmQ3#@Ur+jf!TchS$HcCKGV&0MWq&0Q^B9o?PW zf|A`OKS~s(SgEK~Udkzzl(sEPDl75XeMLTpZ)@;Ouxojf^1tCn6+rZ8j8sXiTv<7| z3aA=WHL9vZO;U}aZd={Ux?%O4dVW2xehhIe@euVO^)R&~jIqw;{NXk5dI@_9D}=8^ zzw>aCUwNA)3lu$+E0ovOSJk=ND>{PNU*Ij+YwhA1>gw+5>rQj0y8F2EO0bfBCF)XL zsim|-na5Y=EA?^w8~nS2ndKwON0pB+A6q`Wd~o^Wim}mg(c#g?C>j&SXq7XordMTG zO|H671yvKPht_1&Y^dE@d$@LIZEfBAx^DHXdQm-EKan_rc#?XWdWvdgUd_3jgXc8z z(uFN0JPA=jSJ+ff)gFyZi)ptQxMq&Iz-F;Muq#XCC4Wk6rJc*Vlm&fZAJ0E0IHR0c zPAZ=iog6(9JrtG1D3z3|g;kfUx>wJw$*P%LGoj{6?Ty-z^;msgeR=&^>h+vBq_1$W zaFFngC|Pn_ecC86^UXqYxFAwcUhvpH)-}bI<@S^Y0{#HMoLep^7f0nWRwbi~Sw*Y5 zQgyZJQWaD~tD)9BtF5p5Qg?~^iatchR^)4y+8a88)omT^9_L2f;nGlPq*UkVQFbtx zS3WH|Cpsf~JgSIss?w_I)ts82wZCf3b(Xs3^}2dx{bzP(315MkW#$R)gC&c7hl0v- zMR|UVU3tB#Z}r(af#SBVs#I5gDvDGIt7-~rN>}@i1uf+T<>qo-jlSl49ptr^cdr|u z%&W?(?orpfPHE<*^U{%Ye!3uCm@Z03)5Ynz>FRV%x;9;xu1`0l8`Dkc=5$NCA~io% znW{=vr)pBQsk&5ssv&hWehR(_zXfmy(8 zU=A=Bm zpcrriC4dJg1-w8R-~;?X00;shAPg)9mH^1?&d)0DFObz<%HWa1b~I90ra6M}cF&ao_}S5;z5%2F?Iy zfpfrl-~w6Si0C$0Vz!9Q*hb1skmvl>9`rVnYdZF*|<5lxwv__`M3qRg*ZG8 z#Jxz}nYt_WLe|+h2Hq2wKnl*-Snnoos&B6SzsNcNkKg0Qr;W`U6B@IIcTP=Btp;iU zTV`RVE3-J$o$1N+W|n1EWY%QXW-iZMk-0i^ZRYyS?U{Qs_h%l@Je_$q^IYbI%GAI2ZXpTeKS$B2JO7{FaXgn)FyMq|^lDcA&T zy>g?{quOck*m_6WfL*~M;8%P{@FPAB{Elw{_5u^YreGS_0mOk{@a@4(#15oHQZnfu zQX07rc_GjO2GK^+Cc-w@3>U#BxB%9{R+!4{#L8fqSw@zLRls_XqhS}a z6FA*DYR)yzRn7$t3t=MygolU_1c4DQ!a#(`d*M6bWON)l7M*~ON2j0@(Gh4@Y!*hs zSQv=S!ys%vwgAglu$5bt+mt@lAdOY4F%qqMhuL9sSR7WzLRUdaWgr@e1*!w(fwV|^ zBqh=}LIo#)2sjrcg930eh=L@L15O3$;81V`I0fW^e&Q}-Pf~AEDrp^QJt>jQCo9Q5 zvY!kqU04N=r4ZWkjpgyBcrOl)*pv|Str;%vQ;B5FG zI0i3*qp%NN0ta9}yaHYf`3# z>4tU3^cadsutKa9^JDp#9LvS3Fez4yRbVxk2vcD~%!K(cwZf?2D-S65DUT?RD-S7m zD~~BFR8dt}RjvxD#%soD$~6@lyLOUcq^-hMX$#mwwi;W&;dc}{e2$N)#5%&`J6GxGTlSYtck+Mj8NiE5($P>vSayhvevO;z! z2st1(B!P@j0VISlNDYagGDr^bATAVx_z(&SpzqY5R5?valhP!#e42u$rP*j2nu(^O zsc8sJOta8h!!zM+@NW15d>-BmpM?*>+u^gz9cu||HERW{mbILn{L@lTt)uRTq9L=SkwyN7MXJXkGe!|r1T zF+h3_JArM)eqtA}SJ)-2ToF?gDZ&buqEHc3L=+B1mBOjWQ(jk|QQlOZQr=ZwR$f)! zR-RQ}QZ7?1R;^S0qgtX`q*|-0Rozp+R8P@lYbI;FnwVyT_Ote*_Jj7T_J{6|?x*gz z?w9VnZkl0=;g~^hG#P&zHRiwOQ8vGAy=|#&r)`^Uoh`+&$Z^oI#!=;nIjSAo94j2_ z9eW*hj@^!}j+KtZj#ZAsj%AJ`j_r;m4uwnZlDcFrs`s-0jQ@)Nod3H2n*WA>b6{&= zLtsl_V_;llQehPphOYr&ZA^XkX|_Fd2RX--qA9ag2}fJ@^;= z7ybi(gP+2m;P3Dq_!aya{t7>Y8{jYSTX-dN0qY{`ChIKg2I~y#4(mSaHtQ7Y1nV^G zI_nDSD(eF4BvzM}$vzv1=IaH2|Gln~k z3vrcPHg_hM%$?1h%VlyGaI?A7xEyXecLtZv6>(+UX~=Zs0+PgU#s7-5;Wy#`i~K~| z@>}zNAm5NUeg}R>{x75x|2OghnJSzvTrE5x94$%}4Hu0P^%V6JrHMv}28+gvdWlAg z#)&dTZP8@(5c&x{iS9=4qI=LE=uPw>x&u9i{);|EAE4XNbLbZIJNgZMhdx0Mqr1@a z=nM1%x*7e09!KAzXVLZObMy}S3q6INMvtJc(KF}(i9=E-*)F**xhZ)lNx@RF0n(Au zq0&CmiP9<3_R^Np+t>&xPTEa6UfNySP8uieC7mXXmv)tokv5UGm1awuOH-snq%EXr z(nM*pbcdo|v0t%Cu~D&Du~o4EjX`q0O|eQbRXJBVPl+iNN|jQkJgt1He5w3b`9S$v z`CR!#S)@9vI;=XWI;PsC+OFEB+N%0jbwG7OwO@5abzHSmbw>3@{Z5^!nXQ?lS)p02 zF=&r!Tj-kTaJr_tmb&lS-`Zc=7rK|aX8Lye_WGv!WPMwG8-1d_iN1q=o?(GuzG0?e zhT)pwoZ*7uy5YRRW-KsXGRB$WO-8fcY%p8RHnZK_#L~hNZ=qX*)-vmUYjay0TU%R4 z+ZfwT+X>r4+a=pc+hN;9+cDb{+b!E&+iBZ1+bP=x+YQ@u+c{gKJ=Ia}xaDYY{B$&T zzI4PnuQ|p$|8-ndt_H6Jp$HfuM#zzQ z5qzXKp(&v`p#vd}01$c*zJg!C5ri>>A%t(>cd!egCn1HCrjF3fWLtqfgiDBYt z;!)x;;z{CpB9Fu%kw|P3heRPEq;sS;Jo3N-Xi1mim$a=^6$okHT%lXL~ z$R5C6$zIQ1&0fnM!2viZCx^@6qTH$6C0sYx#tm`p+*+=aTfwd7M!Ch@8m^Dq4Vi^} zLX!DZ{t*5Q{!IR8{&fCR{y6@8{yhFf{y_dz{zyKZ5Ak9CQ2uQG2tI>P4gfAs#92C2lY7DDEd7AkGvo6pt5Yh*QKvB*P>_C0UY@5~;*tb4#8}o=RRyo=6@` zUPv-9qm(ZdNVU==DNh=b(xr%0DwRuv(lY6Lsa5KdvZbh$D~(DOQnQpJbx32Xz!6>bh#L>V@iw>XquQ>ayyN>ZbB~J>Zac0Ac`iuIjI#t8ea5Nh=hctUMM>PjE2Q=F?yEPu|DQz!Z4_&gZgRZ@< zudbc0ldhYtyDm-FU)NVZM4zS~r5~mrpwH9~)~D(R>PP4Y>9h2ZfoT8@ECbmu3}fz<#Ls}s$4~`<*rKCV%G{+g)8RrxoTYjSGjAtdxl%;*0{B9rQ7DtcU#?Z zx6@tVR=dsa_MX{Zn%CrA=3VO5mg&p3mF+0oUUtcM#n<5f>Q4wX`u~4CorQZEi5so! z?(UwtckAvBGXvw0gaQfDAc5c#f@^{#=s>;Qdb@RZx81tCyL)?|+xvU&pYeU?yzlv5 zTCMCy>8H|5Wp~Q1mR&2mUv|6fVcC_k>t&bAZj?PJ1A??5J$NyAFL*7;s>rF>RdGLd zJ24<>rpW*izyY#>Tz~=02G~F$FawwiOaw?^7BCNJ4on4d03jd-xBw5B2221XfC4}P z5I6^lp#o?=B!MnL=b?U#6r%`M!DHaLFaZAr_l7}u9y|;l3J-)Kcq&{E9t`tg8axu7 z0r!JP!xP}ya2>QJ`W=k++eTP0oU!Zr< z2G|d@5%w6ZjMc;5qEFE`Xnm|2#=>(6jDU%JBAXaN3?&K(fXE^E#C(E5@CcNcOt1-v zm_m@m3?e{`Bjyq#i8+Lf5E9b~kU)q@1dAvnCFFi`ABnR%uvMPH zp3l9Idp7q$?$z9zxyN!hcCLjR?wFyaHHU6!S#X<1t$u27rZQZQ?R4pV!?revjxWs z&K0~XIA8Fy;Bvv~g8KzK3%<$f%RkFn%0I~J$=}GT$=}Nw$$!Xx%WBA*$}7pg$Ue#H z%B#p5$W4X%LPMdsu)U(CqNbv;qLreKqL$)!VM9d+g-h{C@kQ}bQB7G{`BPC-SxNa# z@k8-jQBPS{`9V=j$t&U(ohkaS=xou+qEkix7M&|9Rk>B?RU_2{)cw?h)PvQ3sfVb? zs~SdX0B$IW{#%2W~v6z@U;0_p;n~jYQ`HJ6)HX3Cs2pD>>^pEjQ}|7$*KK5IU1?pWNR zxNY(D;>pD`id$K-EUhhVE&VJVEqyH=ES)XQEj=vlEnO^)OGcCoDH&DrSIOWKWl5QJ zv2}&jZ`D~9)+JV@wbW{{mRsZ2B5TC@x7BF1T76c^nzXL8daWkwQtLXa%Nn(=x0596RxK_J-uCOcMDsf+OUv*z}5A^i#^!0S`jP#B6 zv3zWw(YMrR^y~dv|1SRl|91ag|9=0Kz^%Z|z>UD=z@5O|K)15GWsS?)mDMZjT=u%` zS=pPi4`uJl-j`h{dtUaU>}eSi#DYYS5rl&;f**o!gYSc1f)9dUgU^D`gP(&>g0F(Q za!0wV+)zDZB<&!&8w(a2R&MrSN9h0xyO`@DkVv``~4;87_wx!U4D*+6x6E1gguH4vB$Cpv2pe!_DJ?j_6YVE_F(of_5}7+_LS_2*;vl9 zoTWLda*pS2&pnlUFZWFDq1zU2PM{gt~vw<@OEdc@gdg?t1PS?nCYq?rZKrF2#G#J;A-h{lvY7w)BLskbNv7KhP?TC`n=*id7d^; zlvkKnIlrFpyr7!!hM>3bh2WXst)QXslHjx8x!{4|lc1@vk?_6XuArvyl%SSSCfp=w zEPO3EB4{T3A~+}bDfl6HBB(2@BWx)=BRD3wDYzwgB={isS5QNELGV=2T$m+1Di|pq zEgml(BaVop;<&h6yj%Q6{7(E{JaGPxf@zZJl8%y@5|?C*WUOSWWS*ptWV~dege_4> z+DV2;W=keWK*?xHRY`wIwnQLdNjQ>0lAe-WiCiLOvK_G=vp%=px9+u8w%xQov|h3P zw%)a#w4SkEvVOE4x7M~bwB52cw$-p5u)eomw0^T5wf<{;W^HOaXnkRQWj$p5ZoO>1 zXKib{ZvADw;<)E{BksjPL!Gn4*&lJy859FEQ0X?%k zb3AlUj?dyN_U-WP@vZl5_igss{KbB^|BC;-|Fr+8|C0ZP|E&L_|Em9(|FZwE|8?MV z;9KBp;8EaJ;9=ln;Bnwd;8Wmv;BDYV;6vbPpkLWvWdq7;1p5Z71%H?QD619xTK2uH zaYbh++Xf1FDrLem?~Tq?h0!~am9g(V-*K0-d4P+m>-ozCDEF(zhlp1 zk5XULR+^2rg|-{m3mgH~0*8PTz$V}rZ~#~j><4xL8-SC*abOFu4Y&;IAPuC44A4RN zI(!N~2cLvbz&GK2@CEn~{1n~`{|Ecwv+zau9()Nt2ET((!&l)0a5I#F2{0Z;$L3-) zF)0RPG>nbm7#}0Cu^1PVV?VH?#3AA&v4hw~Y#=rh>xsR@F=8iigxE^#BTf*Th%Llv zVmnbrTq3WKSILg7AuKtY%bvyNvkTet+1YFXJD)v|{f14?re)8{o|`>8`*8ND>?7GH zvyWy^$XS=OCg*eROwKG$AI?hZes2J(9HCh~^z2Jq_e+VCduvUojs zb$O4uZF&89op}v-Qhtbkp6|%><(21^<$3cwdGWkRo+htTex5K#I6_Dh&J)Uo8kBq1uqg*xF3;Y{IB;e6o`;aDMG_(q@+{v{L&CkUm&DMFPH6HXK=g>!_Xg|mgj zg)AXm2nq)aA>ja_UN}ZLO*~aRSv*NRLp)KO6xaXuUHn7*Rs31}MVypek{pwiO7=-I zlCUHqSs>XU*)BOE`A@Q2vR{&x9G7gBte2dYER&p-Y?SPg9F*LUT#>{jAxS{umn@Mi zle6oDDTqe(v19FCZ zihQn|kkbqOg}%aIVOe3IaExM-VzgqEVuE6pVy0q>a+Y$o5>kRnR5?LOR{~0!a*}eI za;}o8ysP}J{H6SPc5J2eSSL{qA3@)R?SZwqg%|^RXXABtiMyt_a^cf>Yo6%?t84Ju}bG}(%o^M`e zUTR)$zHYu@?p(~X_bDeUXbJ^WV z_igt>_XGD`_Z{~=_YLY@tkASjL1=!69?A{nhoqrlAx=mZ8WduNxFH}^7@~z3p*bNW zG&qzgPnD<3ljWg`a7C~pT5+c0TgA_cFBKmv6j60l6D^E3jMa}dh^>x&ihYf(i*Jmt zk8h5zNvukc$!DpTsmH0}^w0Do-~wHY zoIu;uZ0bxJW!Bt`RSZ=fr#B9&v}bPP`y)5jTme#1rB+ zp(gK;_en0Rgk8)wvK?$4+rn0}J#07I#Wt}GY(HDeHnXv8Je!eyCHvp(%h_kLZ)9K0 zzMB1C_J!;zIg@jwIa_l2a(Z$maY($zgJI9FoK5jOK_q91gvGM8_%216Z3E$ zpQq+2_zU<8^A_Y~@~Y=o%kPrELAXVDT)04ZMpz+SFI+9$B@7DV!hmqO&@cR3xJS57 zxL0^cxLdeHctN;bctV&Eo)!Kh3=3BZ7YftDtHP+TOn5-JS-4bqL^w-4S3Fys7H7l@ z#0SNP#J|L6Bp)SjB~_(a(l3(X((jV~(%Mp*w6(O2w1>2nbhNaI^rfVZbeL2j{VI7S z=_j2a9Vi_m9V&e;sVQwBoh+>`{VDk*87XZi{UI48?I^7;?I5is?JRZ5%j9l(vD_{% zk(bK#a);a^kIJVMG76)G<%QwG$%?rOP%%d_PpMGKl|{-zWxi6PtW;E`sA`e1sH~`k zs+Ovrs=2DMs*b9eYMaWUHmL3D617BKtd^=xYO8vqW~FA6W{qZr#-v%LNo$sB7HC#$ z7HO7fVp@;ZtF6$MYa`mQHmY@LL)tQJAKfh7K-~acPhEH23f(H*YTYZHOP|tv^g(@@ zzC!QU`}9eDKyTN_^foB2U!pJ3?=@w^yEH`d79xyI8t~Bm9?lT@XQpPjJL&hV< zlg3lVb;j++3ga$g#<XLW$sqYE@luo_B$1%j&)!EZ2c202icXn`gcD8o5bxwBn zbxw4Sb53)1at?O(cJ_0QaW-*|at?A1bxv}2clL0OaCURHaSn7gc7Ap}cD;4IbA5CD za=mi>aD8%pcfE1Fa6NZX?uG7*JMDhze(rwaUge2l65dzKg!IzRSJ} zf9*h(z;A#3z)ydjK-ECaK#f54z%PHLK(#=l(#E9?O6!+)4Ymt*3U/Lxp33dy1 z4z>;If`vhCP!U`jS`t!)k|AAaK`0Vh8S;mgg%Y7vA#ErcGKUt2UWEdol2CbQQOFo_ zg%*Z9AxFp;iiehmOd)6J?+_L8hWdrl6$>kVS71?NR2MZxtAqVV2iPJ*lKJkwh;S`{U$yTKZ(!8C!#9(g{VS)B`T9O z$?9Z7GM^P^N7)&6h`op%W|y-Uuv6@X>;yZ_7G|@vbF*35?~T{9Z)M-jo|&^T$IG#D zw44o`^_)c*{KM%tPr{S&DtHTcc3za1;+68eJP*&u zTg=Pw1iTHr7*EC5@wI$Ce(d4K0^%-fo`GH+d8B~cAgOVLB&7h!YJTj2v? zC(&==3*kLsTTy$_FJTYSJK-x~Gtp<^W8nl*Ezu+4cVT_e58-oRZBaE*D^ZrHq3Dya zyQrqDMu=n8m0NtGATpql?tV1X}OduRZB%uy>z2|ojfUD zFJB-}$p4mamQ(Vj^0a)3e4%`$JSAT)|3@AxOcY`YNRh3`QRFJv3R1yQ5DHu|PvKO$ zl^&%-X;B)LcBM;cP->O6ifR^_in3H4RIOF*Rqa$=Rc%x~Rc%!%6{Sk6k}AKtRP9!~ z)TcE&HD@)aH2-SOXf9}uX%1=*X^v|W+J)K$+LU&YHmOyKN9s1}HtGJ+ZPlOD@6oT; zpV6<=Z`YsDZ`L0+95b9UoHTqkUN=57J~m!9-ZfS=eKS5Xelor_zA?Ts-ZrYttIg}p zYs@dr&&|)wFU*h3Pt3gH{Nlxyj3sR;w=A;6Em2F05_$=v1S$baXeD4tH~VONLwhBA zFM9)fZF_xtM|&N64|_ZNcUvF(H(M=xJ^Ke+Z~Hr2bNgr8bK85{4_g!aGuu;J3;Qoy zPkVcNe|r`CPg@83C)*%4cmdC*cI0+0Fu|$O$-U&KxJ(DRs_w>YNfM%gJ}roqA`HbDlHbDRdI9>h5~( zX70M~mhM*W*6tea7VgIG2JYJKMeZf;#qO8xH|`hivz{ZKZJzUF*Ti8psNC3-k{( z53~)m2s93~4s;Ln2s8^c3A73{4YUii473UKE$vp?sZDT!R8)LQN-(rp9&EhTM zE#uAOH{z$`XXEGN7vg8)$K#jcSK=q*m*c16|0G@{o+sWX-X-29rX?pQ^OMS?JeikN zC5w`>q#(&l&QJbGeM|jJ{Z4&O)ubv>UsK;xwW#V;HOiVkpKh3GlxYVx1zUn`z{cP$ z@Gr()h78F?B!~jZL%2u*Qix=o>d>^1Cl>`ma4I;5Ih!~~IQu!LI6F9dIomis&Sl;u-Z|b`-f`Y;o||`&cb)g1 zca=AUZ{{2Li}=U#_T=r$JCS!X?`+=gyq$SF@=oP-&Hqc3Cz>hB7Y!B(MB_wkQGrM$ zB1NF6r-%@Z7L6B86p2JU5g?+Am?Ei2D9RO$5oL=I5iFW3qKT%7U@=pSh?k33idTt` ziI0k_&96GY#{4zXlhVb~qtac{Gty(yZ0RBCZfRP2Lb^g)O}13JR=PvFTDnqtR=QWZ zO}a>WT)IknTDnfUQMz7wSbjjhSH4YtNxo0MUw%@4L4HDhRDM>zTYg2pOMXOtO@3WY z6{ZV?iabTWV!nc}5GzCqvofJvpo}O(%5vpGW!<9Uq5-OYszIu;sv)W|s-ddEs)4GV zsz<7Xno=)Rr_@RHBK2Z*xjL?ns&8tZY94ByX>MumYp!eVYVK)XYHn-pXqITF=w|4q z>$d2&={D;&=(g%^>F?_w>u>5W>L2Q_>7VGo>M!V@>F?=p=%4Ga=x^))Gh8rSHk>p3 zYiMHXY-(w$XXv(CK1{My{R zxL5J~;tiH%mbI4cmd%z`mi3m^mQ9w8maUfMmUkAo1SvsF5c^cS*gn_JuygE~eS&?O zooAnDpJ$(92kq1CT>CgXX_wn+c8R^n4%_qXxptpD&(5|p?R@)uJJ-Q?@El2JsWa*f zJ3~&F)8edf#++KG)4AAbca}MWPReO>Mw}^U!s&K)aCdhPboX=jclU4)a(8j}a(8tP zaQAh0biZ}q@!a#g^L+4p^xX6`^FHw0_Pp^N^W5^>^*r(X_Pq9d_XK?*UzzWt@0IVZ z?~U)hZ@ypRU+Q1(9}*ZB7!jBdm>L)s7!w#9m>3us7$4Xj7*^W9bZF_|(vhXZOaCfW zm1)cLWsb6MWkZ5PgTsR1U|BF2^ao3WJ;EKrwZa|4HNp+Uy6}kbm~h*0*Km_?SYv^<6uW*%cxA5;!ukgt5&~Wc?vv9p|-SDqa?Qo^=_fU)Q zuJY66d&;+$?C zo{qnYzlcAKKZw7H-;Y0wKaD?*Z%^z^Y)b4*d`f&vd`)~#3`rIz?MY|SkTfOr$&zF^ z8A_HVb;WgzS@^~L zE&OZz|ML8z3Xw&$ROA+AL`l&?QCj2_g+&2TxyUM7AzC5|ip-*AqJ+pU@`*wsQoKf7 zd;Tfu-_j4#3)1`28`783$I?gAThe#Zo6>vIC(^s}xAG_Qck&1FH}ZROg+ii`Dx%7b z%2moTgX;)}jI#P$|Fdb7z==SLL>GtcY8yXtk=_?t2 z>%Z$87(VFh8s6)x7-}1;8Y&yU=zr>K7~bgL>KhsA7@ipVnZ}qVnTD8V#73BUn`W9O zn5LV0ndX=Vnns(3nWmUVnWmb}W|P@y{$PG*?pwUma>#PZa>8=ha@4ZR^3+0>5GAY< ztG(D>YF}4C|m6H4u6 zrm_*iL~v0s8H@)r!G%F8xFEPNYz?mq^TJ4Yde{)g!mO|=JTnZ0!EkQ4AY2-r6BdQF zVKfYfp)frx539raFejWH=7#gb#bH_)4<9YxSAM+wVEN(lt>tSg)>o{q=oIZ3Z53@F zZ5>TS7e-Ujbd-u-j9!SojZTbBiOq`5j7^PAj%CIB#QVm3$A`oR#|Omw#RtU)#$)lt z@rCg!iEr@_@z3$E@h|aD@$d1U@n7*D@v4bEiC>AIiOR_zi5ba6az!$oOeU8l7bce` zmn0p@Mac!pb;%*rL@J*eM)ju#P=lxu)Ie$~HHn%`jiZKB6R5G&M{_^QlXj>5>GkPj z>1*ll>EG#YnXZ{G8D?fdW)Rp9><`9}6cR-e2!+HE89s&-vP7(X?1F4b_7%=;&P&cK z&Rfni&Ku5i&Lz%M&Tn2d{!iW)US)n&{tsS+f1Q6V?|R;qyu+gHqTQmqq9dXmqAjAW zqNAcsqBWvy@o{n8`88$rWc6j0Wz}WPWDR7$rIlpgrQKyeq@SgAWR(kl%fHI27XFm0 z6x)>hl$(|Nm3x$1lslCNl+B8o7O_-36|MqQ3>B&(RLfMmRWDQr)H~F_HTASjwav7( zwT-k*w2ifEw5zo_x^{+MhSr8ohK`1QhW3W;hMtBlhAhKC1Iq-M5EIvgndX^tOrR;( zgqj$p&E|j1pUq#)MaBPG{ zUUpt}R(5@GK5^c3GTgJ>boU(hG&kS|-80?2y*<2Ly+gbMy+ggzy#u^syyLusyjkAi z-tOLE-u~Wh-qGH%-cjC3z9L`T7xP7ZzkJpFRs5CwtiZfLZU7A+f$RW3kRKoeM1T`u z2ZRA;U|Q+)(ix?*OM3=K1xE+R1y=-@2A2od1y=?)hkfBtcxyNrro!&<@^B!$GMo-C z3zvso;dnR`_J=owgW-+gCE*p}P2t7irQ!d|&zJvO{!hi_ifa`I*taXLRNSoS8toFz zimr~Xjjo8UiY|$+j4p~Ujb4skjb4ggiGGU$F)#+jw#6pK$HYg)8z$-|YA5O^swEmH z>LjWsY9?wV_9bp4Y9*^Bt0#LUhbCtw=Okw*k0y^K4<`2}_a`?ewDmp2;ExI8(CweYAD>^N@CCU}A7uTELTGm6>N!CKvN7h-^ zMb=f;OV(1>P1a7m&ZCh<;Z98pCZ3pdoZN5&R8)6t^7-{Hh7;SiAcxF(UicA`l%%nC+O*&JdNof+8 zW}9c3t!9ULtNEw-mswMM*>cgsE8&!IOP<@`+F#nQ+V9$**ss|y+h5q<*}vGY*l*kK z+i%$awZE}HvcI<9vfr~;a(#1Fb$xPvcGh;)bJca#aQ$%Ba{YGJaaD26a}#dTjk-B* zmK$@k-MHK3-s;}s{^SO{GrY6B6TA#B;$?bgdtoo=o#chQsCTkY?Nj*@z8e0T{@VW4 z{+0eU{#E{hfF_^_hyv1pK5!ram4c=8QlOMkx~X(RaC~rma82-5_-OcS_(1qt_+0pF z_(k|s_-gp?@T2gF@P+WJ@cr<`@S*UT@V@YW;m2WP`L*)v<##K3Mf*hiMterPNB@a# zjc$qFjNXdgj`pfddcC*XUXTuJIPzg2gygtd&xJ+3(3pL7s(sRtI3DSi^;pm zYe_X_p*)n0a#3=sn9@)V%1ikuBPFJkR1qbkgp{39PHrDVrc0EgK@6C~I2S ztZ+r4QDIQ*P_9y~RP9l{RGm_vQJ+L=ZSi%>RZHCxL5Z-Wi{rPwvg4P%t)r6Tlf9awwxhbE zp5v#zwX2b&|m;cYk*0dPQEgSK#G(`QChQfp@Ln5pV@;0lX9`MN8pQ ztduDAmrV{%3~mi>4sHzo6RaC)8u=dX6loY~7Wox!9%&Tm8EGA!xa@J}0ZE znxwuYC!}ho8l-BZTBe$%YNs+(oLWLrREUaEWmJ+{Kt-q&wUUZb3#kOPh+09Vsm0V@ z>TjxoT1G9W;^|~Mk$#wdkbazglpdJrpCL23nd}TZgJ*)7QQ$~021TKR$Zlj0GJ~8> zo@Ae8zs>&1Y0Ix7{voO={vxU*o-CUpn`p-IuQNTfQa?x!83 z9iU|z7>0KSkI89rnY<>4$#0r#-f13KeACj((c978(b3V>(azD@(ZkW-(b>_-(aX`n zk>%*+YVT_6>g4L?YUk?Xn&m2R3*8d8*!|6|^=iCRy*jVn+sNO{zs?^B_yXCbWGTCJ zT5w8mYH)jSd}MTFSfp2EY-CJiU}R*ZcVu{^Z)8GbP~>6xgYx_3L!+ajd!u)wyx8&B zk=VW%7DwVE6Jrz85>pbB5)%`n65|u66U~z?ldY01lB1GPvQMggs$HsYs%xres#mI8 zs&i^9wT0S6?Wc}XC#bX39_lc4klIOYrp{2?sU6g6>KL_wT0@rmLS@b5yi;)?R3@~ZN(vOu*)HB`GvE7Qq!sDWj`4WxlEd@#H<1Wk0a z(|pS!F8Rwb)G@@-*D=^J%+c4?)79P8+m+>#yZ5^HxWBtiUYobX>+ssWW^Z$Uc_0!< z1VVwbKt&)L$Ss{$Iz2ci0z_s-W=H6e>5-|C8IhThX_4{K`%zI$7&{qb#>qG>!ALL@ za}xB#jKr+O%mkDG66X@FlYNq-lSmRyPD{;5jZaNUjZ6(mO-zkR4Nv`*8k`!N8kV|F z{YTxRu2CncbJPv$U+OmXl)6e?p)OG$sf*N2YD@Y}dT3@yW^iUwMw}_nEXs@pa7Qcf3Jg>31iMXNogqV~OvMz-s3X8(3kf|=H^9^~1 za?|{hQH}|Yk&ZErL5|UmagKqm!LI(UAug3$=~lRZxqaS%*Xwn8r}|p^V*y?%w{%x< zUIdP?BWNT$awvK@S}BGk@I;4X$7H7@l)_R#YF27)YIX`v;i)+(TIxIXnR-p#r=C+^ zs0Y+1>Mr$)dPKdW-ca|b7t{ypJ@tfoNgYU^OTSCMPuIw_%Z$hj&kV~<&d@XRj4UI` zNHgb=(+G_$VD;m_%zKsBRGcH@$k?)6S=Ykr%7@B}>Ji$l+AUg4)3rZ$CM!1H% zhPr0EBHnUuI*8j}(>FVi9>B{Na>EF~(s#D+{lvuc}9Cg$A+VlObV>nUbcs>5k>DWtwBUV}?WP*0~LCz5BO2=8b!o29^XC z2PBb#h%_RPC?YeXg|VEtASFo^r0S;YryHdkrkkW2rx&I_rfX-WXEYgoMwiiMI-q$n zsbP$3qkmc8U{D#+L{yQYNNz%zQl#XmqExeV)AXlwoy?MqK*pDSHi#VKTw`71U1@L1 z_jllUV0KgyQ^rokIPq0+ULr4%pXioso^F|*k*PVagSbcG9LI`4Nu)Spi3k&dME_*# zbg#nMj*QnD(WbVhi&Wx-F4aCQl!;_Z(x%MJOe|y3Y!97v?Zlwm<%VwrGb=9(&C1Q1 zpT*50vV>XeEGUbY1^;h73(LySBC{A-{469ZCrg|)FAL8SWU;cqEa3kyZH2R{(5lg@ z(`wKf(wfj((mK*Q(K^$*(z?@n(fZQ{&<4?l(1y~6)5g#y&?eF*(WcO*(Pq&=8caiJ z1dXK4qj70G8lRR=6VOC7F>OArfF_|yX@xW;t%#EVL4u zm1d*aX-=AlRz|C!MQL$bibm1Ww8gZQv~{%gv<B+X&-1`XkTgHXg_GbXqD(y=vC>}=+)^p z=r!rJ=ymD!=uPNN>CNcP=`HB(=0RkP>AmQE>HX;a>4WG)=tJql=_Bc*>Er0* z=@aM^>67SF=u_#_=`-jv>9gpw>2v51ok>UN9Qr(Z9$i2e(Z%!vx`ZyL7t)L9YPyE5 zrR)CCq!xM!-A;GVopcY~M-R};=plNTUQVx|$LMi-f}WzM=^6S$`Xc%g`YQSw`g-~X z`bPRc^iA|F^sV%5^zHN=^qurw^xgD5^nLXG^aJ!G^rQ4+f9Sqb^waeJ=;!Gd=ojgi z=vV32>38V&=nv=*>5u8p=`ZMS=EG!;=s)Sd>6L)WKoy`WPz|UK z)BtJ%wSd|{9iT4I0B8g>2ATrRffhhZpe@iI=m2yAx&U2)Za@#94=?~22n+%S14Dqn zfT6%JU^p-W7zvC9#scGk3BW{P5-5`kOWcy1*CxtumD&HECQAQ%Yc=@Dqsz; z7FY+Y2Q~oz0Goi#z!qRDunpJ_>;iTJdw{*bK43p^05}L70uBR5fTO@M;5cvsI0>8r zP6KCvbHKmAf53U*0&o$y3|s-O0@r~Xz)j#5a2vP-+y(9d_kjn%L*NPU6nF+a2VMhj zfVaRq-~;dp_zZjjz5?HXAHYxG7w{XX1Xc#CfK|b2VD zB*t%us+xTYzQ_28-q>3 zW?*x$1=td71-1s;fNjBcV0*9w*b(dmb^*JB-M}ocJJmz_H*sa1uBjoCVGSX&@a0KnP@jD2RbLNP=uI8_WT7 z|7`a0z&tP?6oMj93KoJo&;*)6D`*29pcC|fUN8Wbf@NS341*Cc1|~oXOoJJ4A-EV^ z1}+CzfPaH4!8PDoa1*!<+z##l_kerB{on!c;2*l}1b7-e1D*r_1J8pOz>DA|@G^J> zyb4|eZ-BSJ+u%L$KKKxP1U?3zfKS0^;0y2-_!fKzegHp%zrboxb*MH}7pey}gc?Cj zp=MBXs2$V+>Iij)xJH;?K534wMVcgSZe6%7X-u7@7|iKoUp>$sxrbqqYiCLmEg6>Hc&i zO;9mpg=~-=azIYV4S66h2p(D^S=mc~MIt`tH&O-k}=b;PGMd&hg z6}kpphi*VOpqJ%ye@&!HF4OXwB!8hQ)8gWf|QppVce=ri;M z`VReoenOQQRTxzn)fhDywHb97bs6;-4H%6XO&CoX%^0m1Z5izt9T*)MT^QXMS&SZx zo{V0MK8(JMevAQ(fs8?n!Hgk{zZgRq!x+OEBN$^CV;K_|lNeJN(-^ZEa~N|O0E5ZE z7&wDuuo--YfFWYcXB03B87hXBp=THvMuv$|%&;)53@5|I@cc0xlre&g5F^ZpFe(^P zMx2pkq!?+&0>;8Wo&S}LRgBe)HH>wP^^6USjf{U7n;4rJTN&FJ+Zj6;yBNC}dl>r| z2N{PLhZ#p0M;T`rXBp=h|1r)pE;6n$ZZK{#ZZYmM?lB%SJ}|y9eldPCDlw}tt21jd z>oS`$TQOTR+c4WPyD+;kvzWb^1DQjZ!A5GnsRkbD1v@@Md7t_u3 zF#XIRGt7)KW6TsY&CDO_;WltPxINqf?g)2=v*7MCSl;Dzuacrm;L zUJ5URSHOS6E8$h}YIqI27G4Lhhd08T;4Sbrcn7=--V5)8_rnL^gYXgfD0~b)0iT4= zz-Qre@J0ACd0^hWw1 z{r@;nhaf|d;m8PN6fy=Gi;P1iAQO>E$Yf*+G8LJIOh;xQGm%-yY=n*g2#7!k1A!3) zArKN_BiTp}l8bNq#UV0qDTyhBMBslq!0>8BN=1?vJhE>EJ2q3`P!{O{zg_J ztB}>m8e}c99@&6wME*fGA)Apc$Tnm_he=2atovA>=S}1UZTvLyjXS zkyFTNx@(Ov4yhGk2pODYU z7vwwg1F3{oMysIJ(VA#ov>sX?ZGbjJ8=;NSCTLT%8QL6efwn|jp{>z2Xj`;B+5zo^ zc1F9P-OwzwJK6*7gAPImqko}8(P8LtbObsE9gB`fC!&+lDd<#m8am^D))NNGL}3&` zF%(DVpG3G@_t8a;>pi=Ia>p_kF?=neE1dKbNi-bWvzkI={H6Z9$i41JEi zKwqJ6(6{J2^ga3!{e*r-zoS3UU+8bNGFBCOEVYRV3SUs!()(~riHNl!<&9D|& zORN>v25XD8!`fpVu`XCwEDP(7^}u>!y|6x5U#uV29~*!T!UkhQu)nZj*l=tFHWC|! zjmE}cW3h4Acx(bT5u1cf#-?J^u<6(gY$i4fn~l*hItE}6#=u|?C#y zJB^*e&SK}V|FHAe1?&=b8M}gA#jau3u^ZS;>=t$#yMx`u?qT<_hu9@s@#;fAh@fvt7yf$73uZ!2i8{m!b#&{FF zDc%xqg}24q;~nr$cxSu|-WBhT_r&|+1M$K55PT>;3?Ge;#mC{}@d@~3d@4Q-pM}rC z=i&ek;S3zdNt}hV@oYQ?=ipqNhv(t>xBwU8B3z8m#|v-?F2!ZI952L+a5b*O^|%2y z;by!Tx8rWyi~H~ZUW%9DK|F$&<1sveC-D?c;Te1Zz7Su8FTNwg-~5N(O}Lgo!97EJO)m zC2WM9a1c(yMYstM;U#>8p9m18L>Unz!bF59Cn|_25hLP6ilB%zks%fk3yDRyh=z24q9B z5!sk*LN+CvkC8UG&kbW{imXSd+L`KL8 zGD9vWSCD^`tI0LwT5=t^f!s)LC3lcJ$z9|=azA;HJVqWTPmm|c)8rZQEcq{afxJjw zA}{}8i>{H^$y~j2T;6fpKfG+)cFS5`Ud!gPmzQ13TJ{;vZ0yW77nW_?T0P(Ex_{68 zp#S=>dYv7g<9L%~7wDe%%Jr2JrO!>A96s1Zxu$!1R`%Eyc?x=!^QRU|5*slxr_;jI z($sR(Qq=mWWvC^h<);OsMWcnIrLOf=%T7yQ3qea(i$TjuOIyoBOIeFu%TbF$OH3>I>>C!q$96|^>sk4frnLOtedM|q0%%p#lmb!7dFW9F*6Pvf+3Lya1;G2C z3U3P^3!e)g37-k?2pBLxPcIKg0ULK%O6QuzSW{sH}0AVnS&{^kdA%)k$n zP+XX>xZ-d;lxT!#F;Fu>b=?BS&>UFlunO?SAJl_vx_=nMbKneru!PDG$LAnPhZ%?4 zhg$0PHHNCi)Inv1N`)Q^!t0hd#;YaPfvJR>hdK#D>y|ObsU=#3298mvl_0WiC1ZkG z65#%XyN7xS3hAcWE>L64NG+6TARQHjr*a5cIX%ViVa3uNi&yg9CI^ z;7T{yCYuvRGluX7a_IQLp>Fj}xI7s4AcIY`OLR{RU)WBljiB6a_D%jvgh!O0fgH7z zI#5S~fD4L#k&J^#0<$^?~FlH!W>M0T6#fdcjd;JRwKxM-!O*9>Hb?a`D0(bC#^4_4eL+rXCn=-&E zPqYf{0M`^E)SUzThWyP0fVUnhK6t1bXLICrbe8Cn)e~J9kBW6U=%259r$VUD+dA3XO!PP3!D1DOGW;Q@%q6ZRxBvD=Rbd# z|E$t5z&8@AiZQjk^t==u(ZO_fmt23dg&K^7nz zZc}cZbNPhZj*P5cl~#>cdK{3DLdXrT!yJ9 zDJPJVoRg3f@JYi-^hw1@+e!FI+DX$%O+`doX)o<c2IZ)sWSz zb6Af8p{1N{@_q7i@-6Z`_twu%V`uJ?4m=yz+pF#RKM+>yePVnneX@PpeG+}@eWHBI zeSmBUpH!j0IeVZp(8(Wnb|>~9>@MtX>>f2PHSRTTHLi~T@$kAkdR+XtaK3Q8@St#_ zaG`LgaHa6bb;|vb>yqo9>zwOmNg7T9!D=yH`Od zrI|%KMs*8n{k)b>uA&U!`Xt9NccIUcF!?v~cFrpEo#Rkpf*G&mn3-dr_A}R*c zORDFUP4QR@^5BdHa^&ADDu$WMOgQviWAfh@}Mp8JL{VKR^@)$`sup z^AEIE^tC_-36DIVDZfLgTTE|QkuZ?Ba=sOi#{^d>37-tp@zaG0r#@eM%I?3XNZPyK z9n>?TU$Cg8QC`iI2Qa2_p5gw5y@?0p2dI$a?jt?m4tFi#UE^Ni-e_EE+-ls+-p*dn z-b;A{fyG|OKE$5H-o!qc-kCn8BF-Ru&^(9_?lGZk}I+yEGE(=+$9nqY~loKfXN0+5Ek7> zx0&d~)QoC?&z8%+t{Gg>t+{3Eq}WVuK;eMMAC%QQv8f|~?ts)3tlww9*$99eG^o>}J!@OvoQ#?&gg+?#OxiRTfFp;;2$$_H`wzl#`V(pqjpn~tMiK|yi!r>V2|2zo z7JBz*ouI#))0cz-WaJ0{1k#(dIdX|A00Tms1fY&3!0(0CP6%|Yh5{w?TX>huz)eEF z4t){m(bERlVEz9WZ|p7E{Ci3CNDABrh(=*G-P&9K8L(`=7y$hElcFbni{VoJk?0lr zPmrq#PNOl2KU`PnM$dZ>#b*3}=PueC)O&D1U%+OU6FF%Rt`stj^sfRr&O!k-WTx0; z$x)h=>ntnH1Y0?`LVPub0ABK>E-c4D9w}m)iC_D2tk~hd#r3GG68Plw3(024k0O3Z zv{J79B9~Jx6yw4q`iUyDod9c&m>5AzBbi__>_m%46d5CtjTqRB$q!9M4l9ERE6o8b zEB8~v7crItG1}=VOCAe}5}TTaI58|nW{~n|SjU`{3o0W+m;gu- zMk=dBS@Mf}Sa(<01*#>&KmuqG0-A);cJW;hTB27a&uQX+4GrV$GF_v31sz5NwM!}V z%Y37%N#GyW|Ig<7gz*#z?5rcO-^{}e`2kDqP1{NlI;D0@K{xc0wQb$}BJqTd1 z&p_!d)iR=eFrT#9v;Y9dV%tZ%iwouFOgmV6{6<*DISal2{89ij6?ACKLrxYmQQcvUy|pMTkmJfR(380Ic`ZGc@m1 znl;-qyk9f`YUCMBJ02?E55nZhKF!|O*jk*+P!sq?ji0QHG1@tT9>#+r4< zI%t*jS|riE1$C`Ds9G3y5xl*`W{S0zI;`{1c9D>QWs|cybRF4B?s>eEFaY&1>8SgE zP>;dwIw~D%KIpFlGA2r>-Qwf1UL1syoa{2jv@#~5{o6(uWVVqo87X;I=kRwJQ)@W+8vGnU$vMdt6kjqv)> zRekejS+x_3_}^I?(f$iln6%Z2EQ)>?bN?U&BrnDp%hs9we_@LMfE3j3OaVx)cx_>Z zLk`CLb^43;Kut73Tlm@#xiLoF(4y-pT(KE^YSO!qr77P%vQJ3Iz`Dr=pcuwjWH=?c zCwqzfH~41!UhCut<@mEHujyA)ZBs;3VbkxXn5OKe_NL&bdO(Jo+0@!p+|(Z^BNk-?F`QQOhOk=@bJ(dgpCh4_WBV^dEkBEb>KtbmFB7KsqL-pwcx$r!|&DP-Q?rp<>B+-jp2pi6Ym-C z9q$$IqwJ~dt?V=DHR;3d$-XaCsNJsJvCzKI@zDOzfzhtq&fXsOP{hAr=VgDvazS#T zf8lcxus*r&xPGxtv7Wnbw7#(}w%)Za>?rWvsBs25XSY)H{g86CD(t)f~F={{?d_61%j#}rC(;LZE;kkcvRDzFz+IsrC zBg{=1Ib#Sv7h;1E8Mde?dnGAh3FJn9!P zh31S*R~o0Z#BPXCppO0@#ONjxuAkbJvo1zQsghC)`~MB!Q1jvFN1pYgn=;g8ElQr! z+~XibO7@#zxI)j?U4QSc0v?J{L(YEoOvzjGWY0hylBEtJ= zwmGkoJ!OO$P^rT`zwBbun_%%>MR_W=Q>|lPM7&2}^viDJ{Qt0=tMJFKyI3aX0=j`Q zlqiXz!@cHM^^CeP0Gv+yHKAyP%UrjfR2Nh!u0_j|kTPOx?p6=4n^Y-1Pfs&qUC%}& zDLCwH?pIIsf1^Hi<|y@aOHtn?8|hXO&PLG9W$SVNgZa2K`1}$XSvRMsr&!7*6-TE< z*keD(9+u*YRG?QM&If>aflrA)5m#T zP!3)$GI@luERpzACaGj`($4VJF02dor;Ka~CAyM?zavDu3S1%Mv#QjNVMQC;_xz zft)HnacFpF7wMW7aPljHs3sE+hHn7ypV}+3T>*Gi6BmY0cG0fsy`tL{*QqWNABJCc zVXmp3B77BqC-#5fAvFdxu5jNk`-${634BjczKWex8;KXg4^Qvy6eG&JR@W#`DX%jA z3<19Y;Aq$J8sjPLRdzptiYo@W1Q`gk{alWzna-T}-lmhy{5hpiUbU!VEQhTCZ!qzf*n(_a z@u1{r7j?`~by#Ut(NX1TT**3I*{fvnNR7Zm#tdXNX5LI<$s%>LvM;k5w)DKwqlNXQ zOS8hvS$g6h3-MLImRY=4=v5ZatJsyf&3fCyKoWqiwERZ3mD00WbXx{U^s?ev3A$Q% zY2Pf?F{4|Ipi<7b2ge_Eg3{<&x??W4lvbs+LI+ihvY}b^V*QJTq&;iDEIc(mH$8bgdptcnK0H6XU_4?xVZ6jY#y`hD#lI*&DZflU zvOlvwvA@(j)x0=9IzBtTTs&Sp192FS6fe1txz9$AuCMI>iZ|}NuDkBLuDTuqE(2}@ z?gQ=uZUP?OZ{P3VZw{U$-#7%b*~De1;EsBKV6`$D#;|=(%OCrTcPRfu6ClAts=q80 zpG-{yTcRj%bxQH)XHD1rAYJ1!I3Y zL@4EjPeuN~7D*;oDw(0NVL+RrJS(PJmh9t^0Q1QB*ksdNC*Du{XXfi>g1z+eqy@#l z{#HP+3DvTRRRYWYH9K;?_4K9|2?fb3msm}4AEA2Vi)4Y4YQ9_iy*YxrrS|6h&r-@> zqCHb_$a|~jEz*&&F6EftG_!JecB|x#(Gf2y2M};GLq|BbUjPCwRa7>&gncIMaO_s| znbPIG`WNH>W#yLS`QyJhf8}@CfIP98+`~y=izWG&^Y;0@FyL>% zVb`sgU_AP?iGl!553V^fr*wLOf^#vfdLq+6GT;>4OTSjI02&KNZ6(M-mZ79zRm}1?_UO;8u{T#o`nrNx zu^4wCQGY)-(l{o4!WYxT3|vb_?iiv!gc#~ug}H+=`V}mTIsRr4DbObkj9cz=xMp}M@NolT0#O&YmY($B`xEg2f3mnKdv?l}?CLjX|% zqHFS}K~gIvj*@ilaov4VS5Qm0fjJwuc6!A)@4ldGNXy8o$vM|U`pY=XKGjWx*SN3= zh-)&PKmq+Gal}Gl(DeI0-c6=gU%SOR=S4>RIKw{oP3Y68uURLzSbFX_`#%3o_|w>{ z*)>2y4u&PLJW$2W8MD-1sts0p( zwQF!&9Dc>qKs_-&sk>W(2cA}}m2~@FK8vini6tGrIQyPPbNxE|#m4VKjWEEY+wX4K zR%^KA@ZF;kVI}D-rOV?mtILYJQ+q zH{!0ABf6F`y6zjk6;i6XO{$rfma(*!C7zZAuRD)W9NDCjF++XQ64R-MJG@ZRgfaIL zt2>`inqfDaIYGnM#l2Hxce=JH!wG=JtUp=20}x-Dw#c>db90Y_2l)Gj@TDC=HN!&mN#EVxv-3ZIDKcgYBI%`b`C`D8){C|m=G@nUWx&jzNHPGG z9qsChd9Y=SzK0mM%lK#L=~I~5r#PIJ4-C#+B~HX?gRxsPEp@8`4#EHw)33N+?4;ge zvx@3KpVl+6UEjO}$WGYOCMFK>ouXUlR@EGcnzHo=s`lrd>{{Gby&YhhB3H)kw;G*S zTF6$F90;1SR>sZ_(47!k`c|>d89icz{^SgM;48UWwYaW&0jN$wTfgCcwG$AkyNY&B z?-AWLv9@*YiqRat3ikEeVtR=2`O~q9$``IeQsIpzQQLLHoi2eZu_&ThZ48kK4XTowP<#>=VFUaJ~0< z4G2!CjUsEtwYMs+=N^xJ(K_jkvTFKduT_0{jMCz_$b3aQMK^vqj`QzjT}?dU`+n`j z+X%Yo_tClE(FEmv^~d~IC*Yt+^th(H*f$~HQYAn5 z0^0U#&$aT3Bk)W}^UT25|GEHvx_X86#}>=TO?2$~vukyw`}*CVO)P$L|KJAYG4z$% zpR?;Hkny~ecEj?d`D*Kr*2Nc4)f}`j?6}Q;qyKpJ%I44C6}~YUM1f+-+zkb`cOTXo)@i-wP?H4?0*~U0Qt~7 zSe{p{uC#c#TzNKKA4{Rdc44rv!PkHm(?bf>uZ+9cs(%r+I4#>t+lvVvNXrbEqNPSb^9u9=DF;$ z+{Wd&M`QR-GC7O;P@~b}KVte&o~i|*!10Ai_v1%Z5h8^#%g#qv66=1fw=}OBj;c#B zjUL30{z$G*-Dv*3Y;mT}!jxr5EAk_WKAXGtVn{88iG9I|EPn(WfgydX>W{v|f@ynj zg=|f-5U{>%Q`EU?jebXt$wz8^ z85t=&)GD;Uk}`~ZE|NNXrM-8^b8XwrTg~Uqn*tX)dpbvpJBw$Bgr69gS!~^BS4)xW z?#7=jVH)z6hQEL37DH>{)CQluK9>dI#@gB?e3}bXooC#X)B?Zp#%)arheMIg#Qkyug9D3v6 z;;|oDzm7Ofa5zxogy?xok@% zeyeou2~^kA3>(XghKW!62CkqC`#<~y=_nJ@`=+juEwcueZ2a2kEEAghwyv=)^9EMc z{QT)86N>wmuF)-XtCkM@9_d08hWie#@huChR_FW}=?D{&`zFA{I4f*P&aa%#FrmJ0 za}(n=FKh+kXHO@X__}X#6XiA6ZuyPhF`a)xf8YKl&TFCFYMq}V9b-av-|QyxY1Y?L zl;0@5)h7MZ{#Wh=o{3A9AQh=$R6JxnbUY+HG&~eMj1K*bO`W@08+8xRr z1{xw7DjG5x`an3ggrr1dexZsBBOMP94=ax_4|OszF%dDIOIYC4*e{FaeU=-@)1a?i zC-+9ydj`dL{651?!_xpTdbqo?#Kv>?*>9SjhF2xG3 zrC3Jf8`UcFfyJtsw^tq_qX%X!fz!#`t6#-8_hMa?V4dw{tqIltDXo{h*YJvO&xvp6 zjPHn)Y7NIal30~jq*Gp`Ycp?c7n9-;3mMeisY05UvPC3dR z(9@m&ZWqV9kZEP1e^UiFFJYGeS=2NA2ual)tHPU?w@ZO6>zP$S=5^oM-K1n!%uav! zREqo|cT}!rSU#yjo0qXmf-EhY+Cv(3SE|V7mF&_WE6ZkQkbB*iDwz4tC%@bl1x?8y zak@iQIP+gllHHaC&2k`rbPuXf=A};(-IiKS4I$OK3sofZiYKXVE3Ia0kaOLKDuj7S zKbe)_SWGq^ zEV`b}d)Z$vAGi&lWG;NHas8Ioe(oi5?Y)0Dnq_6RLUtp#2br)-BS_=laL8C-b`0v6 z`ex4Fn6~)!%;Mg~C)99}&6EHVy)IW7EDbWYw0DN=F5Q-BxCEsCLn@Z$ z&WPO=+fofzs?B7VRo#CZF2vQ5xr?-Qu5~+D^VgHCD4rI(bGNmS*$pjyJWX|HX@jf{ zI@mQetgMio#t)?(-dpQJsBz-zYS+sj1gqu{(v_3;J{bi>S3@ zJ^zaSY1KWSPusuuE}gc%b(@QNj}@QOj(bs`E?_scrl`kQkv$!QtH$-z$dfQHl9M$* z8J18TDApF<3-4Hn>erf0o=l;t} zvfr|(SuSL9>EP_riRRS1nOuwN)lDb%Qrjf9ZzFsSHGqIm;Pva`+2y2(#^Xh8+g4Za zdAJyA0O=dgtK(u;Z9g=@>9?(ay#b+;aBNFyXDs)cZ7K#^&D74)J5d98@hn){T-6!| zN6lQ$7CWN@De)DU+MLyD27ArS&YC;r1Df#_SlZmxS_Ws$g3bxfs?O8SZaby`ig~wv zJj5GeN9Zxp>9A4jxZHHQ0uTh%ev_S!Vzm^@@ux%gI4@=Y#{C_-YTZ_9!KPrdlfl7$ zLDQ3g`FMNG6%KdBXx)$8`fT+!(_!HwIqk!i^2-Y9ny60Z`|`&M>>Bw_=DYIS z3a%Q^H2}r?qQ56j?kTQs+rOc`r@jvc90XjwKMITXhaXQY3jP`%7l@qetIB$lIhIQ$Sa*w}lCnC2XZ}yI+b=ixGhrcf;Ftmi7KHDgH%ej;!08{o3l-SSzl>$cl}R@-@_=*Ttl$R$hk&&`~3u zgrfDzm^9RCF4CW3-y^^L{MY+=>z9*;06i&z5@N|u?q1!kY^QHPfC^SM@`%Gxa5B#;?_=#7)M^P3gexGr?UT+fhCFES}*UuZSW=Rs8hdySirq zzjo2jxuwc83@7ThWzRf*t)h~-Wmbm`w+bR(bE_t&4~}nczx#CpD)LhH8G@6qw?)rf zel496MrAcK+9!6mkY_=^j?T{;rH(WFC;GQl&wPGuost`67c(9wKDQmuqJCZe;$o!~ zGZ-hbx4FISTTPd;0EvWi{qq+leONSHf3PW5U8#-)D^n`=*XX_eYg4$o0-Z0FtXfzV zQFHy7fOfV~M;0h!>2EcS(J}hY$cLX5H8CJi7Yb;&85#)yHgw>RDFIMRr+7+rkLwfJ zF(7JcRF}Ib*7bo?j+Axq;DG{rfR zF`Z+3MEmr2Y>PT~d5Q}&l4Hk5$PSooJ74|uR1>BH;ZH_b4Y+Q5T?Kopw$pyYuZhqe zu-kUK3InK4x^=9JsQ(eI=ReB%vWjBmMzTvu@<{9Z(skl*L^uw3Z2Me+AHTe^YVq3= z^2X}P*n{J+Y@~>$WejNsoe1w@o@HRb`P0MJ-+4GQi6>(AWh$|(esky%SH;ZBkbtYE z|5!Wz;1DFviTNW#0IryxICQw>@FwnvS(l*z*Gx|yI-+vG6Nkj~$h0RIqjF-$(gHpf z&M@M>n5{uXnmIz77_Mx1nCz4-VoW?MmDlpvb@D7;pHY#D0mn6S?2rGMt+NlT& zusCQX`8p#u`g6D0ubLiZ0fH0froUF)v-7tRql$nEtqP9{tBSA+wF;MtpbDRgs0ybF zlgcL*Iu#lf78M~(q6lOugkyM9=sV~;m{{lu=qhM?=rfoc=o}bBm^By?Xc3qWXg_E_ zn13)Z&>=9A(2+rf;x5M4#yZBH#!?>;1EI9L$pWE4A4tWa*FTU`LThvrTp}EPz%hm~ z5J!ZCRue}rh5GmlAMmgNVQD~g8bvx`I&L~PB5_ncG2rx#;Tt488q_h%=3GxVR^Xv0 zN{VF~)G*8BTuV0@=i!Rcl_^fJ80Xsu%ErB98aX#~j9Gc`iK1ia2Gz_m>Q;43DtWYs zDq?vD^~`eW))$Sx^Y9U6#eN*rGRvx4TQoW40gMo_B7@(|a_cq(j7fRWiNa%P232>` zomT}+vU!wUhq`-R0J)Ac?3RKK6pMjK7>Y~APyZC9U%@@2`GtEg8Orj23>>T z0P6tn0Cx^c4oeP4jsV){Z@3M_;()1vxq!Zad505)6-DTT?S$(@@Q3w>_Xjd$-{7vH z;R=J*Ov)lOG??jAe#w6+D&kW6RMrkqc#N8<4C8|n0+4P?jT{HK1CL<>z$7~Y*a+NgA${uI2 zm!toJm%maA=8=+5PAoLHDdjOBrYe%BDN@CzY@uy}{X&kEpn{atj?IRJ4J1l;Nqw#C z|I$t?SAYx9ys5ZfQf3N&*i`Z;Wl}087JvC$l%W=u%w+M!wa`ng5zuNeeoRe$twHaS z&||7f)cR^y=r-eR6Y^VinbtnFQBJ?e9`LD^{FYs2I7>s9LnxA*F#$AP8iMp>X-e`X zh1@fN`GyC%MC%_qL2BO*N0OIjD9ip9zVCAGa0ffT_C67z5I+{jKIf>QehVb~@kYLa zu>th@x*I;H2%xTw`pM@CxIJL<+;RO5U*hw}%-;3NH4rPRm7%Lf^MyP2t~QrLDfTIk zg$rxa-~8e@6rbwgIV9(Y$=8!`HLEV26Wd9UNf}%+^5~56x8tAZvg_Pm=B*+DN-wXO zJNE& z*k}n-qsQp>W?YC`Dh-s_*a7T(G-Y?x1+S&tK(d+%z{1B=T?{|TxDVg$$+(!cM6N2t zO|aWFChL!!?ZvrR0WveqbE=0#pD{n66fD3?+~2~XmXw`g_=`(@HZ?{{_(&3RV?>z>50}v7_iCdLqmkUH#DMOx$7^Ut)3TJ@>fS51^IH+6E@ zYR~oB>nYe*6~NU~Ylh!xkk*qON1FD8t_`0+zDE9xVu=)Ele-7kD7tBApR`2@es$9X zi<*#Jk2W}di*q!;&M4#>KJvQxy^qA(&9}o6pC!r`)_ID9j}e+P(xpCC_I#;!g+(dv zrs$KRxnxhp8>+4z?up=2!0qeOr%PaoQ(b~nK%ZjxL-3Q&HR^H4ONvlV2cM|JYtAED zCrMH@Rs75wR#)vCPJL3i4GFd-J^Jl~)3eoD7&{$*#*}67(HhBVOgka(IeNdn)ei% zV7QRb;Ls51VCj&75W3)^5Q|`o5WL`&;JIMlU`R+pPpR<_4*EsPMaD&eMb<@OLIR-v zfap8fcbrqwQ{q$dQ>;@WAiWmnl;D(t6qA&YlvDwc9zH3AsRyfPc5`^MG>;n*-te;r zCbD<1lfMWSig$?TFGQ}-e8X^0d6>8%L3y~S@F{u3v%%mHv*4qix*q4As~)5t^gg>! zD?vv~N0M4`WVxsX9Wc(4;4p>J^g~_In$)HNj?57#y^?X0I)%Xod|ep3>ay{L%CsGK zOD(tUMTP|)qpqhNE?;#k8j6&YKJ}4$kUta6_Se#yHJpqg?imqCgC*-9O=`7H_}(qs z5r>WFabh-i=b^eImSXxJPSivPGYk1ci|dhXIAtT!fhpiPFW-g%@e$nwTY*Arg6)8~ z4BE8l0I_PVnG317)pTJCt)5eo8|CTY*M$E5*XO0#&D+fwV@nPe0R{o~bh2y;16%`q z19F3m4R}3@Rl-%=Rnk@LRpM3rRq|D=Rf1ItVN78{VNzjiVPau?VJu-H;hc?g0g86a zcEWbzcKmkocC2>1b}}HGjKUYwm(Z8g7u%QE7vC2IB>nbeZ;lx|Orh$17J3wXq<`dl z6n!+hl)N;%RKNUssekEnX?3Z6seI{pX~e-!h#bZQmyB4Hr>4VHfU6nBG?0P~JfZqd zJHHTIbo(>4IPU0PQRTFSa1xNthS*7$sr`M7gN~s}LMZC(Xd%iOf8?DM?jN_%D_J-# z+!OMRUWEpwlH&m+0+Z4s9X)%=~Ycn&aB#+AD6_u+g zmQ~NH*fK+s1?3B|i=dDMtm6qAePxr7|dahAMlDE~ZLp23L zwPB?-prZ;Iqlycez$u*atz6$S@)Wd+8P!v4Mo}$_6Z6N_>XVm7N$Fb@lk@UvJ-`Sxl*EACVN4s%a6ItfT{h*>=tfj0|}&s~(N zfSY$tnJiE5blLKJgzn(*j6kE0)2p@cJQ1J#=^g}^x9460y3NfihI^;q$O@q26t*EY z5VkmPkI2yGUcO-oo=JYlD6%{raZT}(Z{#x4&12QTXZo64G|FYsQZJ!fR;i}NVwVgV z6}0H6S6wRnuGPq>pJG4iZV_IuzEpIob z>Qxm7W{>2yQNO*QYdNn!<^&AA zXH0wlq{bL^@@}(WCvPK_+EyhAqd(iZJNd?+$m@N&Y4$yLy^QmW5 z)Y)b)OV}4RYWv~O4?SX+;h6NK#JTS%>y8uYv35$tp&*Hsv5Lhl_$>t<)tXfMPOtFOnRt$ij;B4 z!M_y}Fx>2Zx@nE)#Qu1%cfB?qfrQ5Ge)%S?><{|D78oXK)a>vbyc@txt&SdV2t|GinOqd~-#rau;`I$pLXUAqtN9aqrTCR3{h3{K zH!6s)WMD8{sL2yW;pvby!Ow3iu3L;x&`#F0>eh_=xn!R{PQEm4MnF?$Ar37jQMg1z zH>0CRu+v*F<7YThQM=tN`U{a3}ZI@*z7LyS;McG*fuV+ zV)>Zm4)QGHSJA2dt}a%dJ3Dzya98oH_^$Cs^?~HZQOn{e$=a|m|GyWRpednTFNau&D0y16R2I}X1bB={kudm zwZDTs^bsyR28TPnaO5w%WwLw@&#sB@#FM?Jg+WeC1$ch^kT*cy_U^V4*GA{aWIyKq z(9?9f{bhzH6QKhB+0)TW^0>ZEO@{2Sef#rPOj+bylGdbMTBrHxIVVc?giX^!0-vOJ zvw-Vr`>l@+B!Ozla1M&ea+H#plf%^!1Pq#O?lgP{1(*{1Cktcq8Ab& z`O8ipHC=7<_Gc*3<}uOcI3_B#i1QPGG7FxrLF-C->jHY4&x&(1zo+$D`IJa%6sPEI zlORmX8upodhFSR&vz9g)%irze__VWXKF;FXL__G7UF<^})%3wtbMrPU5VB<@`=&8n~ovMmw zPy;pfFoKiPL+6m0miD{%!Sofz|L!t!y_m>NEzR;<`mdbC`~iB>8!E6vk(N$Emao_K z;DEhVHSr1wS;OT+Ey_(6od{kyEfE;G8?G2Fy6ebh_bnDB5=FL3L0H5-h0kmH*Dc2R z=kGT$Z;?mFv8-CcLRCkX>pip!QFvVqSK~@wV~9SNA-v7L(1YD%4hoMl;*ab+^G_di z-@`uMy=8h+-I$JkIx7HZp-RK)YMTWJ3849Gbk}YxSz92t#(*#^tDm*pOZ) zc@^xk=V_~K^csHe+tk@O+kBkSD~8D1<;>Gp+3UT$#~1osI`}x_eh^)0v|q8DX||uC zRUGC0a#mwsq*zzgaCY`*el5p-?Qu)iHU5YV zl3JDJI&`%u`Cw;E&4HATssL3C{WtKa8`YSe17!-zn-Z1dgG@JUIuwdA+;?#SOeiU6 z_iiXDD5Y+=<{;~C7|$R=O8f|z?I2i6taKP!DA8^V*#8)$<=|!l6(~`L;avg^C@}&* z5dNPyu@BgJABc@Vpl?D!VL~DOf`UVYh7(6*gpv6S3Ys)f}-ul%3|T@lFJt!GSD z3$=*&zb@xZ3S<7MxgxN)ZmKuWn(cic*t`%{TzbFS+Lr`7h5nljXf@_Lv*VTzV zSt4Iy7IyUrnn}DzWLwgnbg`^;c58pvD(He|yP+UH`QLEev>}w>NzPWZkJfR2v+kdz zb3qAtc`J673pcOTv{Iq@kS}oOkB3LaKIhHNb=w!K_|FGS>VEo<7_YpH@HHd^M4wEm zd*0{7z7ZZdRx8Ud1@T{Hdn~XWGw<)d@x;{qtBsAA93jnl;A`Rt_)mHnEGc~4hatd{ zZL=x1dHTLuhSDv)iS2~e47CdD0F09|QRmx!LI!cZXS$smI6ubX(6#DFmwW*vqi zFut2%llv0x5!n|A=jsaF=%(0YS3zgR(E7jVy0r|M*WVv6#Z`}nWV@v!l7D{b5%my;j)D%O)CV%G|ttY zF#?pXMm@8&s$NEJD?9l!AqnC$PnB}|I71Py%Au_q-L=SHdR(ZPdkn8&kZQL1_skE3 zZ>4+^UKgG}4K{>vyjq%u-RqvRlbgTbR*$_GkRYSOgon^{Cu}l0@d&_^qQt=rh2V5Y zZqhn&3BY9|E5Ve6aCc{HvO4jV!rU1XT7QVmL*fa+pF&>lcH)4Jfj!HEiGj|^L-`Rh zoriE6%xTO@h%gv}WK1o9paAWcN1*_(-mSrbrhvfRt-yf-M7H$+ac!{Tm_Nk{rNnUo zM=h;5cA+@2xj6o=I61C3Rx;pN7ss3Jrqua>A52w?$O>=P_iO@h=JKWE1Ch?w`_?O| zJ4->7S=7cJn9GZrs)x8P!_i7!(<;0;2@QMf!2Qd=VAi=Dwc_WL z#g0Mi%5B~IDX760;f#a2=e+MR#$V#}V>N`jf5kuYIRfCL3}Xw% z8L0iUYU{5-3;Zu+`sbrtpx4jNEq;3e_Yb@l5C3U*Y8xG}4xpM4hduYr@jcAN@O6ZIIl_Pr~A$7i5)lYT?C7 z#p5U~zrBke_U!TSX~R>W+_4A!ia&CcV;yVls}KCIQ=-hAwx!~JyuJ?fu~l(bSiFpE z8_y5%%zQ?g^0m#1%UcbJXIOn7-#OS89+UPAo=bNBDh2*QTle#B6d+4URba~z zRQ=0^7xGR3?<1uOd^zHR|B3K@-ircwDakyHB?7yDhVVq*!T(_5&$;1CgeM zCTq5acDn*pI+HZC{JF2p-jUB$77E{r4GJA&yIbndY~vC?WmzW;{U3$Zq@eB< zk-F|dTh`$=Y0X!Hu^Sdx-TtT6uW9IxLblYnH-dW9P!Yj9dG5f^P|$&(@zhgcxH4zvwN&uiUB*y3^0V5?j@tcK&cR)dgjf0VlL!gO+vrs^x z{SKFpq5^>_LZLvzhMa+%EOeS*HEnB-> zHYdlQF@Bdm^J>|>!aXw$U6XS={7}~Sw?c%0o}<8a^CN^8NgJFu^}a)%qqxvcO@s2} zpQPezr#HDvtOBYk-kmvtn6v^t`Si=~ZwPZfh|lmOH!5=aKRSi#2_m-Ry|;odeF9h= zLi3j!SU$?W)|~mgH#cmwA|_TCAMN~6O`XI`9@{bPsBX3BH7BrIHO5aANpHhT|E%XH zXBSNN4N%(^e4{!G>9j|{hac*>wnsY){0(&Nz)Jek?Xj{D4}W_6K_?LU6oUFG&>`)+ zWLkhln!jdRsF+3wrbaOP7Z~hbk`@@o5b3SfD_(b!e}MA9)c?6td zHxd8+hUf!ac)(*6Kj6ZX?=#z~zv6o0{f993ujyUd#=DXQ1ebVSw*p?TLI=mZh#CiL zgc(--tT~yvrxU}bZ!uX)?z1bSoj-q#Tf`ECywju|Zzei^(n8K+%Y)7QZd{odlQ31T zuq=D^VfSEHch_1mO@evN)i` z2(ape=|M8$#iVm_$6-h_WCmd$nMttvBbMV}`eVMtQTK-ft8U_YtDSKfs0 zUxrgr-Q)fs&_3%~cz4 zwa}}AIm9zT6Ei91bPepQST>Ybz_|FX@BX_K{+WfOE|Iy-S@1UXU+*JAqV93#kJhixO{ zZq}WJM7l~3Be88*oliRwU*DZWGN64hyZ$nQI@(+9sqreg8cR{QGTVu>Lf>HQZXcG> z>(`kQd)pD#m8va;vuhFfl4ES$pBJr}p)>R>D)dzozYsXYdPJ(|4KljE98krwCR4mm zOh+6KslpC@c&Yr0^2zIi*Mr%y5oe1Z_F}lUpc}oHuEH8Zh8HXs^X~LDU}YuchRu$W z6DujGS0pHxh%Uu!%-=30aLH3FMR&=cDTTfVF`MIOe4i9bR3OTTD$YMPr_2a8E#RV# z*rE1Mpbnm;j=U-T9#I-ZTM9@I!5UBy^To_zwIWggt4Qz>sWWpMhHgl;pnAU5bmI{> zfO~!12(uODEYO~@IdXM|ZbRP)z7To@y-xo=ivKf``mY!O;e`l*vO)pxVIKC(dfJQ1 zE7$F`8CN*-L2ElN-|o^DU0+Rd)petEmr*WeIZey#3m~x7)TJO$o$Ao$#AjmVZ6@p_FGOJPKPpXW@twR{B!nT0nLS)>Y;GN-{!gd92)9pumcl<9O ze1iDJbMvOA509kp5MQu-Lc1gc@^WXGj?@8IjNrHbyZ9dvW^K6!dnLCTct!X^&xzrE zZHR_ZCF~-GRS5f#*0-u!R}CsaVE}m=;WG5{4g3e{GBq&D$HEJZ9-{n)UOTdk0r&{O zGlM4voi#q0{)|e4Wi|S9`9b2F>$ty|f!uhsm=WQ4&DZwqc~+Lb<=OZStIYku`G$Cx8p38 zgpGS#cQFllgFoB8_NNVS<*!(Re5>t3_cheIvyyWzX_V@I-AA;#1O)?Gn)~HN_G9}o=h)aVX>Kjam;TLg33~?iR%5QL3 z{ct~o>4TCDooZREN&c!Bs(x}9t^GJ(7Ff2mMs6bF`A*P_Wb{|JAbE!G3fUe5til>0 z|0r2zJ>vq5(!rgBo8K-0fr7*t>jNafL;dtM0D>~h`jz;4;5Fe(gQwewS0RAr5wHQ+ zMK|}X?VMjd0BTsWP1wsQK)A9C2%g;qyg%?`5QWDM8qpg~Po$sLhh$zDza!vXUR@8} z-Ww>-MM%|Ps(5B|E2Y0RG6z*5v(Nyjw1)YE)9prUrpap!|1B^$=w@_A2v7Y?{7NmwdRwxPH3h*yzPLE`xiogiETn&Ncn-eD`#Ht zss8#a9bV*6`%e<~7(@2>RQ9-L_DF{gAF&;9)a@~ue!^d)=mn*26+LPg)h zyV?h?)(l-p`msQU2mq3No_ya>d_M^U5cSD#QC-gg9vXo+d|$%u@A~~ryXx1cPl#`n zzR-T(1^S7$<*!PfSl=k#;ryaYS|nas=XQ9NdS(K`ivwAb{M47kzB{Lma$s81q}e!= zdnJ#&3kmvIG@8VeXo+DXfJPISIXg{g zoZJ+(9+n`VsuzaLfOI@4_y^jyD8@FqPEh6*3bQCZszg6JY(GA!AUQgXC~mxvF?y>g z|3?&c84=QFNa_BKV#_AX0rcI&aw;F#5ao0tKC8J9oI^Z`pO7?tbu2Qhqpsvojz~e( ztkT;gWueNNeFIMtII+E%0~bH4cj~2-cvJH)FP3O(dXZ1wXR;mm7+%V>N7dOJQLTvU z52G#|tO=$*zmabbh_w;B055dE!BmXD9Cu<&k@j5=%7BaH5JWDMmz;vUYeOcj>(;5* z0-a6g>Aclj*8hAuy__|~eQHPjcz4BX)}mWk&0`J*8}=PGNbnzTL>^2G3T(OpO!9OX zv7#Ub8VM+kn&JTMHk`%qV{M#<3_VE-+F00rKb#>&ZG?twCCMV%Y1n~J z@v_<}PYULQ;p{k+V*&mgbgBUr$4?;5KWXbeZ_`=+>CXoSFYL2ke(l2rajdD=40UE= zO~dP*7bcw3N<;LuF+?s)vl8cl8>M`PJ4E`TADOqMB z!++GIF=v9V#jzQ%rzAGqT1MUf~&_`+=GIK{$9=fs)9(7S|MV|*NW$^@rj@>z+O zkq_xI#c^fE-0700@hiqiuyMq&i7?>_`}KCF6u5RI1U3s>%?WG6=X-KDM2?)Tq3hBBb(#o0EV5^C1LKkOuY$E?cy6y7kgy8e@B$K6 z(f=#l$m|f=q_~WK9D&{wxnX_|@|FV5)^SWD>U&ly_Iy;SlQAV1lHxl#B)@0k^so0qgD(?iVWUjFNpEb(h-WsZKVL4?{SSEBLX zrj}J>@}M}PhtQPFMbsC?mxhE`MTNJ|g#mbUj5Sved~ar5sxn_(sScX=>9H#G7Mj7= zXyL!d8iZUS`u~1N`eMn)#KTOB;6$@Q+A{*cSHA1wp- zI5g-c`ISl0a3!SFJo|YdYV7@D5DgQi$X~MvZ?YhTk`uL`C*Gw@S@j)}BdqqRhneT0 zQ#l{$XuGm^y$!3OXBc074)hs^@npMSydKvsN%R_*aRSrEWp*bW*Rw7beIY!Q`-TSj=Rr_sVIhO|1CLhp?b&zI6O%k{;_b z;sqw&Lk7ki@{d@F?{-<%oo9@9@@#T$&aqF&@^F`_E3|Wmwn4H&r(OlSM8jlt0uh1z zfsnFUg=MMF_7S;%bti1J*`s+ZW%RU}qxtp`d0!(y<`MZCQXpfgd=;qzxKb2VQA}kD z6&m(b+5#*E_%gA1Lra{-EG?0$f<@)bGKT-rnB+ewy_Wu-7dk<4N#mBv&U-JKRQRhg zF*$()G$um8L|6H-^c84kkld$v3iB1^C^D6%&eNSR+^4??`xN;q2$bp11A%AN96=?HPeD(TXFF1D(xr;B>zS3B{CUM{ zyc>RFd>o1H4k4nn!kZO;Qtb9!gI%2r^0uA8#^!$9wD0UE_^FiLk5A%wb9~E=Qg}{v zyB|CU&@YZ-kr?r?;gZ0LI?+?bbnc>R*{%sW^-IK`>BRX*(uT$*Ezy{zk4^)?DrS3j z4BBdF0y?S98aP=P0cwtKiJz~od@^A2`uaH1*}CJSxQ>9K_MpBKD(XI2<{ZQEqO*1z z!NyV*Vy9`tPBF$u6|{e>@pP%O51XlC~q_D<9jjW0b%cq-3q zw%&q|KpfAU%%+&3AsMNJ%!21UufUw@98_R|Odv5d2kT7A7b*wxX~>l;Rz7Cq&Ymo+ zKgQ=yoh&fG%~#CGqsb@+G#rpxAQP>8RjmT}BVle)>^TZ&8otyViK&vYqu~DtH>7gI zwJxRD`Dof0&#hWd3G*|v-(b087DyPy8WtX>V;w4kJ^P!9=O$jp`(R9Grn0Lp z3CyWg+zLgh(pOD^P&Ed@YrQ=-+br+r8mOn@tFC?GH_C#>W}41n0fCw>GezqT;BxlZ z8ReL!jx|0j_NsTyO7LiSXh4THmn(El^nDx%@PV)udC%j8WKfh*n>FD&IOJF9zRTKg0 zkfYE$G626x@)Z{-(Vwk3TDsE)?u0q-f`CD0Cij@>P92~P0^cS7fB=2Sv7?MfF_?0A z*|>^9Im<%YiHvM97VvM;H~%~L`^I;Rem0W~=86C4K|(CX8jQGE_HPn48nY_B_*cK| zq-1{e$*ki>IS`o*<2p^-lxwz?-s2tX3n+fi6_hNkKKw*(BBCOpoC%7P8QO58pYN8d zDATqr$D5gsa&O0!W7S!j$ZW<~wYVV9NY7sm6(0FDaBsJl*3v&cc*lSID(gY5SqGzM zGldi!{2=nH4lA<`PFjj%U*50}e5Os>-ueRlz2G&o2C>FRWjlOUj7oH1 zwxx^-H#_+3OPMZdGMkP-nK)wTn5IJ+J7V?$%D_Iv&^*NC%U}PWDTcU7fXqkbVGQO0 z8Cd1fagzg9lW{OplKL=!|2IlurAtd5r!{3)UP3jo%S91(q`$u{8OT6CJSnC;Ht+gs zXL(A1TCbIk?S)cCmGp^&axblGjtUg}J-W;w+1Ge#N7tYU%$G*N2LY5wI*% zb0_BP=MBONTDnQ1izv*{yp6PQ`x1<2-=&kGTTJ+&g z`KmuwX~yvxFMVPh%apD@dS&v=*p>Ou=l1l@aeh+)r|(?j_y#eoRB6iN76o&k+q{C2;)h?}h9Qt1s%iA|!mhSX!8LlQ? z?RcQuU|R7*b;Z)!rHK;IAxh%cY8C=r?&U$K&7B93vOn zLv~wM)Dk9}4MTH9m2N9voa8t3=t*q|7szP?R<;Cix$PJiYz`|*F4)zPH)NkL1X33? zm#9lVc8*>TXvSo!>rjywojuA%XzUXt^JQ8jWyRdXcW2S2Y3<=7BscfBz7*LuHlqY7 z@s`Pp{;Df!g}vsNuk%%;gkHKsMsT_BoYNg1=R}bGlo&-#V@^#amvt52D zR%S+<@>Qlr8yKy)bNI^|AO4W6jJ>b_$dN8OiDt~craz`;c(P`&s%A7|9i%l0o?+y&VN(!;$zk2?^0PHg`*+=8M#GXpXP16j zOFfBg@qR5QE_xh^700jLqS-DmENtfjF6})6s3 zKKh^a^+hgCl6LY@Irhyi;5T?gC;Gi_&!$L0I?3pYxI zzPiSf>0aF}St(vhylT*{DU?i_lV8VQr3 zp|f`lblc7jn-t~cPkxtw2&1Y~(#<#2muqinKNupcdH?K5>Qr(oQyOxYoiIV<6X2JI z>`KJxItGzFaR9f@l6rS#KYm;E+}jaEV(`D!2!{a+&BF?Q_m1JWKb(g6x%pWlpcI!Qz#gx~ScI$Zyvknj)+jwH=*FMAA0`r3UH zs@6tx$%3p;Dc*#5cpDSvu$__GNDey&4w^k!LrQsCZ;o#J3ap|Fe5#}AXu`XQhkFPt zQjPsSjCIS}nIZc!VMN*Xvj|1j4S{v$N2Y7WwkVMUTm#{Ty7LlG$?ZS&`{W%Z-)@)1 zMx<#}GK_3WzG-UG#47VdOz}-bcl#9db6?ci)4a%MY0rB!X>db%4h@Y_hdO+buqT&r zU>maMrLrgeM`J`=;sB{bg1r;bVpttSw}0Sx+w!b~)BIg~m|+LYNxG$IoyC@`IY4`) zYDdky`rD~nSmZv#zZRC9CecRQ^tEF?D-&VlwJI^q|4w92Z zOTjwx#TT~#o{{VwIj294W-WhO>esn0c-{Qlhjn)tozz<@*4Zz(-2&T3Hg;^C+*;b# z`7Zc@%-!$?)05gVL%U<|sOToIb~Ecf1QB81P=YI|o#-;_>&4ltWUCJIk100}D^=_G zb)M0kPvWZ5_L&(T)rTwK-T6&U7yCsmP?XJ1u$#%gR^IHod}i3!vIwq}ZR3-2cSY0w+Jiv~#ROg3+6-&8#<0@F^0Uom!5Zd*Jz*-w++ z>RouhvM+lc_q?t3{pI%#uOvHik*`L) z;c`byu8+N;a!1UrSG_qpeg^A`L%tUCX4daby>WW>c=PUx(*Ier&w1Vcy!*!W4ymtePIh!Z<*nHITqGnP z+wdzVq>Yk`-@{0z(4Ag@+25Yfq%^E9jdOc#?u6Wx@r@xg(pH5~&8-9%!4H);vE#2b>A{8a)H1S3@M8PoLY$IQ;1^)Xn!Lef_z z^FlAY25CvudsMRyH>c(>@wpWZs|!V6<0F`c_78zjnwpI|Z}=@CWXi`_kL0v6epLJ{ zpVEkp*EqW0Qia%>l!+Mg) ze1;M4Ay0#>_=esa4AaB-C5XC*rUjyT3)3)2gG4S28!bq*hw3T#J5ZN{DHG24hjJ;0o{G5v#r@FG*YK8|D(C2`Abz__m}eJ{LpFWfcQzl-M?6W;t$Pb zQoscWyB18)D`${;75hUQ2!dfgz`h29|HJufd?CfhjDZ~rM(>r}PO{f}QvX8sMwNv* z340g}-z&DAV6WLis)Jb#yA+JqE4!UyuMNomF@f)%VCY_v?f5GVcT!%=9N4K~>|W{Z zE3ut;rTIh(_?}^Z1rznkZ>L^qKass*j)w0Kz!{3wCTM6@k^+^t z@Pz?fL)qFC4Q=ORo0pF-GcWW$A$kk-o;pmYBtBifjfB%R3)n~hlx&Y;Pwb9}PVA1S zPA^ZokK02h;9g5FG1WLLu76%{qdK)|&jP9AXWBxw)Ms6hu~AA`#;CnjA=V#AHYI>DN>C^NGpgGgk27<7MJVr z%}I;g!bBS6Pg*X6;6F>J+q8)vK|+lX7}pG+1ucEzz?GQ|rI1U`-Av z0K#MkOo5SI@Uqh1q!uDbu_2t1Sxp87eSixjj}SIuSe{0C5Y}p#lg0!_N-a!EPfAL; zLrO7AN>&FVjsTI5f=De573eWU4C6KEQ^JaNbR2TN=+mQPM@04y>?i^8Egc;az*ZPu zF~Gi~<&fQ?w@wTkP9oO^2zD49np@O)i3u@~!zBiGcVMpz-KBWRa?qK=um_}f97KkH zEdLn)5vM;{v!#Bk{cQ7w^p4_}CNPn^|7Vx!3j0|a(ADAkWdpjp{mbiEV4~v$_&Q?# z4Et?&-*!KBdvoOn009!(d9)KaAl@oW1_VDu%^4doGGMEMn}m7tJEt{|Xn_C+oKH|! z?+1gt&l;ad$un+bszeBc&qaQV@Cg@)6bPdW&xstw(P0qX1kVcNkWi9`Lhx) zbSZ%2;GYhE9Dv?20)`DL-i&{l{mcHx9q8*sAnr!-j`}BJ zzwky05(sQdmXoR`mrJr2tpZKT92I@wr7{UuTDGuQiM6bCUf7bRF=18myhu*T4B$Rg zPblw`Jf(jZew-Dwhy%(Fw1|n~QUyT3Qo{norkO!Hkzgv#Ey)xtNjXBVNnT-`*jw~< zgpsR|dV~f5k}()O$ZIgj2L54|C8QF-l*${FS4y)~V*p0TX%uz8#Zl1%#H(OSqn?~O zD!pHIBT-i9s<2i{u<&lF@6y7pm*vKc)x+b>iuKkN){)i8l;p%6l&kW`|Og_87BD_IGi;^K#?JHf8>a3+jc7xt3wN1jmK((tyXoK=9#d*rZSFa+US>NOD z&I;V*1Sv6JC5nt@9gc&XmAEOgQ{Iy&znT>}&3YUMI4ic1>!wtHRWGudbvX`kR&Jx% zNV)jxR^&D7bL@Yo;7PuKP($#(_OPnP*dgnFdnLJj-fPt7vu*wbPY*XHsD|F6Ys=1= z5z6p0r4fD;8rf%9m9v4Y+*=yOZ7_J-ROJ_Dj%oc>3EU=7McHpSQGms z@k{0wG0mzUXWr?)kN^*6lHElDv-)LOI(pT_>Pd7X$@{bbRhFTnTTQZ*WHr*b&+Vw& znxms{OU#*sHxj*1>8RYAzODldL;%9NYM;YVyES`V?}FGZ2{;JvGdilbX0Gc3z;%+> zNasGkqke1dx;`N>auW1N;6BNXf=3#!4j?K|k{Bu2XTH(!$l}$@A(l^~8i93}=0$zn zcCr^B{K>h)1uVSLb)o1-LtlG*2?u|2^~OZn;kowi_{7wwzVm0x>nhOQV~5!nu?BZD zs#J1)&~I1$O0EAhh+i?dCFs|{DH>+D-ILoJq%VfRcQ=yF?MDY_17gx}7}D%K*pOi| z4bsq0VlpIX;q=19Mf6%(aU>tGN1qb8gSYmau_~K>AZbyptq!K7i zSW<7)qS=9x5jWb{JU+$${GqW3M4K_rUVa`z$`$VyZgk28>8D`K`CB;Zl z71aakfMRELPinqoJt={rZWckDQUs+C+P-AeQFD_@7P<7&zl7*q((zwHltp@m#&iIr zkqkqj3DXFNG%toO*qEwfRPoX}de1j?IkD)?> zp_GrIWq>J%ilG>fp{a-=OQRqxRjX7!t~{CqIVx;YRwtvGU#X%-W0mAGY6@VP62O~> zIuf-9GmoL`U{e1Zx)bq%&iF!_1T(T>`H*YOIlA_oOV0vteb<&>yi-qMk zTf=I@91D&NS=0Iz%N%oCyQXxqae@i(@wC>TSvGR)Lut|zP7^^~WB6t{cKl{~X8gvR zmR;ZU4D@Wf%)5-`SecmhIW9RaIsaI7*>)Lpndq75+2~nz+3;I+8QEHRSlXIB+t?aE zn_ql8HZQX(vpcptHVAJXPO(Wj#_Bfd7%;@Kf~}9L!&gG08%jbSmE3Q*sc{r<&C^k0 zq*G6_8g6HLDKejb@)=kJS0X5iQ5z~XT5td$$^dRj0?S%0 z76#1}>oGxTfylmIZAK0IG0HJUcq1VOc>1{g2(iXJ?F+33tp`mwdWsb6l$w;pl%~bo zl++aU6zLSIl(iJHl;)J76y%iH6h8(t`YHNchFE$?M?5QbD+VhMD=I6AQzB_DD|IV7 zs}`4*1=DkrY@2)FJdSiqU$G*kX;fLZNN&}I`6FR5&n56a;lBL7>Avf}{=VqG{l2C# zp(>=Rttz>yy1unOzP_uz+o{kg$*GQ8HMs-QUGb?MS7W>ml~kDM<8@&c`G z!n$SEN=v0y3(+T(F7<6<8`T#IZsqOs8z+P=HEr@6HG~St<)QO^C#d(Oo-%y-Icig7 z*z=Jm6!&$2NUU5>xu$}1KJ&!pKE_kMvt(19s1zCSdl|WuIwj1VHSlClnwM-1JB1+) zpgMkzF_Z`waY^Dn;A-N+;(6d+0?_CeHJ_3$b%9c%1^E-R`^Xp7-^IS_ex(8n z`X_exu`lWjCCN*)=9rCA|KUW7RhKNy*&DUAY^q|^)GJB=R@593@Prywg)gdD6|*mC znKLx1X;}gJC^f5+#wBiZf<`$2zKmQ{JuP-w@-*jb)YG!7id|GcExBKUG6!!ITK#4d z#-V~&jJPCjPS&WnYHkz7p@vryy+mn_-YB_hd~T*ScNcPeK4(?fENPd$`K43jSfuKtf1(uz zQRhpypw)`fC`t!VKvD!#gekk+OvX8-JLNm2I%PWLIz`Tr>)GeHZ94Nib=kiM5;|l% z>pEn+s5*B$s5<^~<8%D&pz5mb&~4x8>f^-jhV1I*(CobAvgGRK_UOE1AM4WWcG%*y z@qEGi2=Ryk0MxRX)f3aEmh}xQ8FF)01{p%EmXs5fnrs!ObG?l)3`+G@NDNX=mW&fs zVpfC`6$9qAT3J{%6z1Wp_zaS_7QPI56jn4^WlL zaLWyFt5I>w6mhGVaVs2fYhW`0TV8O4x|U{wn67GhepYM^9Gr$&!e?sQzThfRd_*| zU6@^@QMggWMFdeeT0~Y@R%AkiLAcY|Xb#s4>UEqy)Gov>Job*J3oLg_`ikO(#aokq zw0YER(ru)9@^RsD;&Ib$p?Sq^%5C7W?{W5VuzAF7=5g_Hs98z7sA>^V%{IEMLfI5F zNv>7e%rsf9HJq;^*_1R%ze=oCozFa2zBc>@!t8mjUwJACW@0Rd8g_vjMv|-6t2$4? z?~?3=NsGfq_*Jp<1Xs;=knX~N5!Mt}?e>C=g$s+vM(9S|X_Nw%G z@`ILFLFWRX5N$+Wl{ilXtg|4Wg)WOoe>?W{~mc~`6JvtM|6k% zMBv*@bmjG%0c_~E#BaAZ7qHjgk8k(j@^8(*mwwBFS-mxao&M$n_y5iqhp~)r4_W%1 z<{J_Mj5Cr9+&ZE)90v3Sq$iaC3_W}$%o*Yt(iw~nqBUX`;;_GnKjcUGo20$6k?aIK zDnH~qS;7QfRxYwu3CH`rixKO(GL@Nj@C@V-S=u?POs8h&OXgml! zC_G3!=uC)As7%OAXl)2>C~Zh>=rxEns5QtnXdVb2C>}^2=yr&9sCLM9XfFsaC@)Aa z=vRnWs8`5WXlMv%C}>D%=un7Is8GmIXbA`jC<#aj=pm>f$RTJd2r4KlNGj+Oh!Ut0 z$P#EX2s0=%NHb^`A)n9m<}kQ{#d%!79(Z8WH}}t^pKuzW33>qQ%Mn~#;Ea&`G+q?! zAk=Qabx+VY!_PGCEFNMv)qCe7p$V5%-I862-b~Lnj*&?*Gz`iiB?xjeC0~?Lcnp{t zpwGw7c+P!T$E2VKc|C7H-2XustVed zf0$mH6x<$DW|dM^-PCFQQRvB0VESQ@9EbxT;K}J9+uGa5nlCP_s+#8Swe6ftA9Cu= z9^NnOrv_TTaCR^4zf?YY9i)5YoXY1lw>Eb-S2Y(kCpO2rRk~%lrMU&U#i*Y}Uxj!z zZfexb(%oJtA9}!dFxsUz4{IMIs`pa^Tig*NH;D1uj%B>sDfH@N$g9wFP&6SlH#*7~ zi6aQD%39?2Uza48q}9L9{dE2eJ`Pd;)A}>?IOMG$xH*Ju9!|q|wP~n>K*(<-=FkLr z=+6FP-EP5cs~L3E-C;Wr^gh-E zEd4wM;>wincmUN4`G0uvv+Dx7>;Go4Zo>snKtVh{BuHWJ&(9?dUS*8LoF z_ctddhBEd$$9>{osong5V8WtD;H|O8?_1#;sDqCleYYV8(ceG(P2c`a+71fu=3P%i zn3J->W+2G=7Yonj<4nt#W3l07fKLP;2mv))1?mPAEeM8?6hTsI1h~+C1qgC~(tK)a z+z5X|5*iHX5n?V3WC}qzYE-F!Bn6fvurgxyLjQ(1B&p!pJZEa~(V)6KYij7x;2UCa z;~<$hoH{|ZVW@o(NCgt(Q2aP_MwD8E+K3y@(hRx zuxPn@soljwOGoxJ)9ArG%?bmyOtxg)L`wZzp*a;Vi8+~9rFzvlVK4Q1X(#!5ky{02 zc`xC5^*#$Ni&%?yb8!m^E8zH~6|Yv7T_8JyW#MI6&|rBkQzgzL!Xw+RfLBgXxKUI! zb6_E>rBJa%xMX_dYvpws;4IJp4&+}|+&MZv=s`&IIM|bBeLU=eT879pfVU2|vFF$M zfZdC<4BNg%+VY9fU)q3E2P(A>)1E>H(re4I1?r)fzXc1*04Br$Lfimh&;X3m0O(ml znQj+dvAA<}fa$^31gQ5}Z8ZX6ZoZC>n=p0(oPGa;`T>vA0d9R>Tb=(Q8(@e6kozRI z3V>|)mwy<6fWM4@-@oMFy8NTinvS|YcEN6=jq^%dc$?@3y>3UfM#&PFbJ}DjUO{`F z)9I*ls`EZ~BcrC-One)A8+aRHn`|3in@yWhn^W5mx5lIB;morOnbNNl?h;o?)gs^7 z3CZk~Ha2!%)f8@yM(%|KZg!V%me!WOA}T^zd#KB<%4#aZ(!5Ab1VR$qW zv?%hjF0!(SY9jMG<+jylm1oswRS0SiiXqgmG@-QmUw$3>jNBeJax}0va7HP1DtD^; zD6lKLsUDhx%@Zu#&r@jrn&(?EnkQS>oi|#D#)oq$^epC_}Rbp@cHkN_9^53@d{rD~YRgmX_SBg7`S7|E!#%cd>j44T(tR!VRXCU z+wCFmNZ{suG#6>WS;e>UZxUJqolheHPzCEM^b(jdV7fglV?I5baWX8Q=nnH=C317pO7@^@z> zkBosHIA(Utq@Wq7etP8y-AtpF!K$}ztD>R?F~aki|s0K;l|QV z8?!;G7T~Hx7K1$55M?D;r)AjSC&Zl;z%7L*N+BCT91R~BM9)jXT|kTtFbv|-ikw;@ zDFvA3m|D?`d4Q4G07FO-LjpEQlqN|$mP?)I^?2x%>cs5y@VMxuVwwGn+ZDY%a-+}n z$c#GXR3Oz$)euXCKqXr(TP0gTS3y@vS9wE;tFDxuJaUpd&V|iNeleudM$<*}ux{13 zdFmpGkJQW9)fU(|%jDzaq4F|l;#$jyHn|+$Oz!0HvUo^5!&_mh^D}-N$4N^}S)kC) z?qu@Ha4dIha`b0W;aXwoW0^v;jMv=53a6L^HS}wsF{EQf4_MOFs%XHB;f^7VsSaR5 z2G$+1ICHh3=>}JeFXdUyxEy&pleOV&MA(YB<+V?591#Kwx5yi@go4PR(CNM-)H`ZV z1ily`t_~`ho;$+1Bf6vaMBmzgMe&$f|sAA8R(6pBlQ_Fa6K z>ni>&_s8ru?5$w_Kk?WEC9P(WKT=^XRoYK*_-geu?C4=m10jukYJD|e7K!k_BlbfX1lE!O1I14q_;~&w zm%mzLaNyzvMh^@c?AF3Ai&~=r=Hmd_fntNXTAXDWYb*}Df2+;6wU8RrO(@zy41+1( zNa+#ahx#=jD0@h2sp)YedkmRrutG;Za{<)kH#mA!>E0v_mXv_9&+NrL4QWWy19uv@ zDKRGBq!LGsIXz?`DMQOf_gHI-i;Am?b&ExcB|~ta;tk>r{Dn-1nKcl^LNvS*bPed&#-=k(0G&Am6gG%DC!c_>H zpe8}>{PSr!b50=d4Syc^AOf8)GL3pfeuwOg#SNYP|JZuVsJOO8-8Lb?g1fuByCt~0 zYjAh>KyY`r;O_43?oI)P1`iONH`m(dyt`k!FOC2CQ*Bm_IlkU|DC1YGUox{8$Fwd8 zfZsn5_(1;RoAm`gf!JOUj&UCZe(Ha9ou#8jo9M5v!>7lZ7@)1Qs>J-sf)99VhJa0G z9Rff)p*7=d1lkTY8*bDQtjgP9HREmkJRiC@e6IVn`t1za4Vy2JU?|3L1h^WKIzxBE z<@@>i6WA{r9@W9Eik-0nQ@nt!emmp8bfddmHLD+Nr%DIC%@1~;xk57gr$8wVbgdklh;~T8#Hl|U#OUDOO0@}hfdD=5 zbC=|b81O%!{^xkJzYF{C@rED=GB)_A*Ll~|fw~hLv(M1sGkpLVa47~A6I@gaFaHC> zfj{dr-7dN&WQ8F@Ww5IQZDr^JNR}IKI>32X>I!ZFZ$S%Od{7nK(%H;jKOKuy%UOG0 z?^es%m$^4}b?5;H-0I`nN45-X>=RtYcu)ZnX~@e6_kn*1(Hsw^PA?^p&=EqFkb8LlA-M{vLsP09(Cf5xw z0a@{5aqVMnhG6Y6cET`?P-&0o3@uMg((+Gen^kfKif^{gKTuyvZ7Yf(qfNq_K(YKx zCz(_zMXiNhvrC$fwx)<59G49fyIZP+WB&zR5H&p5K!ZP;u$vY7F?Hd%GquR?eS zoPU1zu=Oy6VfJHx;e0@_jk=3Mh-Qe&j-HAl8D<=g8Ll3t?Zl;WKm{6q<_?%Z32z{E zpYAFd@Npyj2PEa%%ew(aRsT*l07Fb;EgvPXbzkN&-nDj%*cW@AwiMgbl_%#y+vQ!2X?f zo_3_U7v^w`zZR44#CF&lQJed~^uqN9{T}&z?Ir4){}JWuXH^Wo-_kHuZ6ypRRL^+oMT!;VEhqxpvWiNeg~Vt<7vheG)oPBN%y zgw2wL{q4h`q!Btx2DV5P#W2c#IP9RP5h_c1ny@TIG0H+X&Y-LjCQD|T$Rx!f3Xt&@ zr3N5PQF_W0WKz;77^*?h&m<(I;nbuVVI)SdG)ggQhJ=++KbaxOSfGsSOjn(N4G*r4 zGOkvJdWMn}Q&Y-e>bmqwikCE<3|Gp0k+rl&QZ*B#%u4bFqkvX>#jWzm^89PjhIC6( z4nvo2d&8~i$;iAyk-dyisy>bFrJw3k(XHc2_IyRr$BW^M%ObhWsZEA0xh>zV#I3GP zl8fC7y9>(;$P1Q>_=|5B*B2*tseG$?AV!ys&F~BQzeesM9rFy1R2_e|Xza>#4xqMl zHm$c-HXVba;{J)A{~|^WCl{6ipxdAbMKoMtnd2~3VFfUV39b`7#5zf~QHa7~2dVbhfL3`b5S%CLMiUC(86?_c+NC;;zZ-)xAzq8K z5zTQ+ZIju|+$`-F?dp4-?3(ME=o;|d_TBOw^lteytJ)if8^_w+yvTUoTzU$aTwot6I+Hhvhrx;H(d)ijmTHAQr;@LLZR#go)Z;P*`Y;XeG zjOz86HO5uK^^3KfwVVz8HEr;F(`$3n^kvcxe-F!Al8rbgl}_A0ASzxx18}zZzd%%S zZ-90tVof`f2#I?g`w0H(gv^tMFN{bL8b2WQ179kJawN`p%n|J21i=#z=tur1f6nhj z(iWyG8!_s@8kiKPWWtUkGMu2y8j}?7#F`^ZjA25WE=oIQ!Wyg^Z>20^B}I@feLBX@ znmtL(Hb&2yIZ5I?#y|fRR|?INlA$oUF}~{$^wHm$+&CdNfAKd1b6<^58hO8?o#nNN zG-@kqtkbN6tn;kHtOJ2FZKHLRb%u2e-D1-y#$kjrjjpzap_Y`E)>?M`h$-wrV|G(b zoqe5slYPt4QE0i(ql;kj447$VC&!=pUGc5%h3ygRhUxG<(VzC+%}>uS#JcJ!>^0%F z_%;2t?6vK+=r#Mb;nlml?7M5%w#=9v=vQhz6FzEo)+!~G5S zG3-V+5Y+mLncz16jaLdwOB6Ga!i468a$?k}KCqI!LJ~5vp6X{;Ga8FW(;jD|wGUmI(0}-@$HH23p zyQElArOa~ie=yvs;zLE}GS5XHtB)Ac4276Vk!2J~VP6XRX;?76NtH^{Mnn`Fm1;^$ z4=J%q%MYo*CIw0tCQwr(%N8lpO3PVNGZYml(+DJs7pdT=QYMR;s_>{XCQIN@lbPmE zCI#0kbC&<0EyPzvQIkzp!BE9e6A3^U{)H~Si!N7H!l|rN>bq!o3IkkTixZT*{hC(R zD6?J^I28n>a?*NvjLNB{6N?z9yskgnrM8NJ8}u^hMUhjMA*DwP*i#W}B^cnx|5uH? zjk)Y&P9wUy&@fXswCC`jgDiX0juG7QSyYV38sTkV8z(^=X-4AIIHP(*>u{uzf-A`v zmg^)B`A#Z*w4Sh*L8N@xwG0~tfYMJ0O&gd53uEn@ji*T$r?f%N!%u9Q6EY(K1ekG% zu|6wPn)xK%p#a(>qNzkJ+S)Y`t;XdGJ)jBj5*H}ZS9D#JImNik@Dk}N+E)5UmMn3K z_78~rD&t$!t+Z1{w5R~+ku#q}UW;B-|INfB=6wS8Y-H^$TS0cxTm=BxdYs}y*UqsO zVkgs5u(3dJ9OFXO&ITBTq}>ZT7XAlxB@q4l>*qv112uA~--B9xEK z`v{agA_(PTe~rxVA79^o2Fmc^IkF1BO6C`iPj2D8CB9EOPtOi!(oa8DPt7e(V*^Us{eGaBX^B>Xs|}c zxOuQ*{p#>?y_{nM~6%L@fLzN zNna8uuPw+}pb&_ME*S9!rp(5>pcBZA%+@s~#T1wV|78i91!T4))toeMy8JJ-#*F1z zZEcB?c`x2*`4YBcS>DL$V&`LB-dN6A@paKmOE}viTNgpSuUPYL>)-e+vGo4K@SYb> z96PlKRu@)SAnD1i%<8X8tN@1QIp*kD>gYLcxmj|#IrgbpdSJFE&QxN}6ZexlO@upX zfIEwfJE4F(!$|l|g!`~S1 znW{XE`HJJETU;-Ot{8m<`#i4s%;TwBOdviNy)A#4=RV(Yymd@ zIXJrh^9bof-4h4Mdk#~tKFSg=!~tlsSq8IQx|ytVG2}vmO;KRPnkGvbI`$vP*KD|7 z69+GG2Avskc)S&V(d@^swci3jYk0Gyz2I8l8#fh0H)hG|8UtU$XvP;0Ex z2#D*ZyH0wE4~AavcBaLGD169?h9v&5_|P*Q?0eua9qm7U*6*Xbk?KqU8tEPwHHRFX zDJ$1yojD5o3y<)Ei8Ff*kNASAGy4dg@m$wt+xm=02}Cmu0?uWyW= z41zdoKwxn%L>KzgS!RYa;s9t{a)3lXIyhDaRF^|1ICW0)v=}eP7 zlNyJ3f3hFPUJPGk1)2pnejt4Rv=(AR*37aIWIN7jtW#UH)@;Mq{AnZpe9+CXqi$=B z&_N{_?E_yN!62epXzjr2E`4u|3D-^L!_*6=A6-xM&h#b7{ifq# z>xIydsV8=4h6sdo6Z$alf&w&YqJ*Y%K?*k|4+}3iZ$!W%G)8E~0K|0jzcKjep6MNs z{Y}fm#tXq4qknAAj1Y+ECiY?E1?`Py=9-`BYUbhS1+F{Bf2?QE;E(-73vm1v0K7`0 z{(C}y3?BR+Yk>1C-}}$^vG+ayKmHFrow+qsi&(fYABFP(B`Y~QW(JI0u+o`@8$4eM z!HE2Ksyda`lQVcXO1{YKscF-rx<6}>Hq;$)dV`DrbV|w@75$yUh8%B5yn)4rp3Zb% z6Nk=xf9lu^SPK4W>-@@|)juW%{DiRC!HmKhzcOd_j!ACOy|w%QWnb$hAmjD-^MWJ zKg16v%&-3?e!_y7Npz9nPy$86(DQ>VNW{Z13W4J%8d$h9j+i<~ltfDL%b0LP9_nJC zxW#qD!Hl|)&b!TX!|M#9P{+&JE8DSoZmzHY{WA~fs5kegA8)98`ET8oqG}J1i?m1M z@emEfOSO@xbI$6e*7DustEg~2%KMrQ{_E?(O(_jZ#4s*Eg_gRvxz0g2`4avdRl zuMnfd!`*%JOYCm%hn(HS-_29o+|RvNp$+y^QW-5C+h^_Ff1sykaxc^U?H*nftu4Nl z(lt^yk~gv^AyA0?4Z1*#u8b_#sY}!Abh)k{Dju4^YB88Mlo|on_AdJKrcx^unW=?~ zmXO(Tw8z2hBzmLBtikjoI-@8~!Tf#1*pP|eG3f)jPtZ18!n`bVS(DV6uLt-82VX zZjvl?dDy!jPhUUf1@|PsW6e(OZ0&3q>?lB>*EVd!zpr~Oymb1vzaw4!?KuY_eISg$ zg^2z!+-sj_teBa%?C04<__c(%t;b(cQZY5J`kO$Y7Zk@e*PZ(ZUWmk3l~-2(&K}rV zbPFhUXzdRS0qS3^^AKh+EiUY_I;*zNy>?FTZmFRDUj4nP_{q`N6*%&F=2WQQec7uZ zP#hZa*7FeQmZ_#CUth%kM^AiDy3lA(v3|iD!gDTC8@>|_Sa$Rz&Xhz(#4X4Mi3i<@ z*~CeaFRwYaCAJ1>wM0Pi(!WB=;SXs3yL&BNE47EiRUYWwRgl=@`_-`5%G2ht3KKV| zNA|rV52V(2{=^Amho6OxkCKI3iFAR<&(UgrwF)BX6M0Xaj1&B-X!d^lR`&Wc@agmU z8_~{A=*wltyS?p;?d$o=`76N-!E5$Q_N(5D-s}4xBHx$3x9>fco)&|M33xo%sFx zJMz2YJM+84I}Gp~Iw3kBIw#sE`b~61beRhRxT{+sj>+4Zo0zTWmKQn)su0o%% zp0FOVo>L#h-kAMc4bEb(WM1NdM_;4RFwyVSr~NkxKOh2-hA{c@5aQ2|$6g3xbWIp~ z2+U71A5f5?f<74$L&SZE|B8-`F!-VF2YT2ilOOnD(5N3E<6y`?N)zKqepLN|JNrTV zD|8`*7cqh)H0ysQ0scEHAgK5O{hzD=_eU(n&*+~hzS4l8#(y~FL6m+j|A3^3u=qj0 z7kUu_^ge)~2}KVL81Dnrdab@A)M9EvS3+}szzdM;HTw=%i?Ir20}VX!1N3_B{&m_z zpFtyjfDRDpH3Y#ppaV8|X!#FR0V;riAN~r-0h1d#3mR~l2gvlAg1!LzBq&{IyANCe zI=!|aL|~8vy$MbD0VzPD*BAu6q6d8-ME+sk>kNWagzo$dOnCyhdUZeqSA-8Ad_DuN z;Q*%Ip5B#rCkTVDwjZ!RK=yu={DAud67*5@1I|~-*^jax@M_t=YxPF_Nd8y>p$=UM ztBF_32=bq@hg&7ACHrpPTm56}qc_Ao)EV3=kpnU4d+)Cw10N+IVgQLfH;Mx*NVWIm z2iwQ@&sncbkMB(DpPLbEuvP_YMZS;pJ_Te$@Ikx5p5d-C)Ovr9?ac}3g7Aihg1m=? zM?Aw@Wnw0;^#}dv4G8!N0S%1^i;v4q@8AIn>wR|?Lgr?5Pz4?LvIH1^8VcBl7=f0D z$-?HQac}}9^_B%JK$JjF!(`!b19AXRR&QItABZDpMi_VmUF=qB2S-rCSEcW(?`1-T z-y|dBI7#$`d4q0YaB%0DOk_us;+{x8l2nPThq@r0;LmfJxQxcdjgdqO2MUV^!NcPa zu?iHL!yu!gvXYoAzfb7A$G$)O``4qGFR%2`aUs4Sek&1*(mxr>8(~NwqQB}lS}tX% zNvB#_q(;XZ#kcbxX{O~i6f_;AP04Foc;=0Z8jRh3nr>vU%jF3^9(c0 z^UVxp`j2a8uN3C?i?|B!_A|zbsG8-+rLAi0N;h&b%tl#X>TPH}3>^CB%DLMrznLbj zoMzJph*gNj8aMOBc!4V?ouB2-QSdUCmvrllnVhD(WQ%6M z5!XQFV4R~d-1rIiM`(i-C^`y0Xf=~czG@MaX2;$0*ebTuUlJ9J@kq$@Zq~nP0_{H3TM>d| z^oeAa&G}!iNgpo?7vu{#fyKuYj#&*baY6dS~byybSv(!3c&~@373S6uuYQR=rwXqC(VW4 zlSh%p<4&~8KfJ>mZ<`*r<}q0Ori$j(o5WBqj(bOc!zv^{D;HZ(Ss)!dJN?bPQ_p|V zZresv{IlEv5rRxmo^l?Cbqw6eM#&=9BS%Q&>r9Rr#7j zt09aJg^AQ}2uW4M4;n6lH2+(Hx@CzaVAxpQri0n66E{72}2Ag0)jAiM>%AK z@J+fN!jh?3bplwj=C$%*a8bx+lY`{(1`4B+e)ENgqp&RqN2`rvXE z$iBNB6fB+M{FPNhAIo3vQFM)ihnlR~#biii=I{DbdIf_cSbGj?P8D77=iCWu>R8Ovp4PqtY1H zrOIsVFvxKbdQRk;xlJXzI+NtRkn?!ld7x?fMP*lb@FlJ1`n4~)y!)x_iN#ZXf@Fep zqb<<48cytT4QE@``j9kr!F z-MnAjQ<(+>4PB-s51|`(r|lqq9l4d}WX0wrzAG zIoo1L*|Nc7B-~Y?Sg@COMSidtmQ1E9xkf47yQ=$u)p1v~42NqWUw%tH^??Ot%;e%z z|Igdy#?eWBYmdID`fdz4b^|fAf#=YQ{y#%#qzPopqD?WD*xn=;=Kc4Dmr}XOJYxbb zKb7H}I1k}x&c9Ey>wM8pTjrsi=umf3TPaWMf|`vGH9Uu9W7C%6(_x>((QukRxTM!P^f-M` zB&T)NSo9oT$@#{v>5YlH6rml$5EmpaABm5mQKVV?9c{&;LS_FZ%dFVQG`MX3w+wPN zg+|29Ky#2Q!X-K(tvp%-$}{PkI5MjKJZHU{iDweGnWt<3yD}zIMZ7?yKgv79c9vq& zSMoEd z{#ZFqv9>C&fULJ}sBQ}7q|y=5O$?oZQHJ)nep~0M`w~x0U#cG8)=P&QMdxSBu-yj& zBUXmURpe{AdGZ^xGp>Wg$wgYRDM7P%52wNYQK31uN=gG#-{|zj4R*GPwdE@bMzdauI?b_^6(cvr(P7IT__MJt)hX+T*?Q-7@cWp5z7!1L0Tb6VQW0vy<5)#-scR z-x=Rhp%f;jtiL1HeC-`E-DR;x4I#h$vV(nrva*mBEgL34yhXb}lR}+Jp|Es#nrVV= zl6}qN#GCO9y#HLH%>#X#tE(^OAWuMLVW!kgv@%d{QsJjFV`imk7H(On6R1~vxx`+5 zNlXc4h$@ZBN?}#p`u3-$coo+cjuHFgcvI$Rcyo2am+ObHk@}kPDViCT5X<}DE6KWI zox?idJ+L?k>L!ducuO@Xm?+g`;y0?bN`l&#^FL?KZN3PlQ))1&m}=WKtk3HpJT<(< zKh%R+&Z0vhh*hEGO{hJ!m99v-y8jE z?nm{>KIX?J*t3uoneVHQkE5OAM6)8{>8sV%dr>IZ@a!6}H_}OU*A{9R(qSEs&hAukpt{wThMk=3dNsHO~=qwxG)z*F2xKIEXb7BBp(YN+zsy% z-)JR@h?=rmCTTU5J*M84*ES9qax_v@E~+Lg2$k68J4RCv`JxrO3-W7g+xF5?73ZWq zMcCM?JjI>t-uolF^Vjhbs^`h-D^9Lcc7sj)4CympRp@D+6`dK+Qu#%@<_2}VTVEb5 zuf2xw)QYQh-+2heB*$K?&lIoNw?VGYxP~)B0%T^?zNa0hb~qhq)fnK_o{E+vAG$~V zI>x8j|p4}?W3MbWCgqu)&K&avgbC2JEk+SG2Ss2 ziAIZ>LvBKIHg0s_YpPaH(^l6W?3K1&%D70saxYJi>BU?{-(@LoGn{nxww7_m7V=c= z;p`hZe$#g|xW3#>>2LILuT@P|3tt=6;J&TWeJCknG-5NNuv|io&i8a(xE4;71bba} zQFKuTolJO03nkTPcu+qKAw^D-JNbc&LJF-aJ+YgQY9-EQOD9XEZ3XLdOw=3dA1v<* zn=+AG`vx*NxfuMFKQ|+qN!~hBCXYe2C59dSxDt>6#?Y0Ntr(UdPHwNppxm>N!0Y@p zayu8|8?s&edBS<(7-G9^sHxk;_pvYnVaa5Q`clNe*rn$w4pP;oAWzXEtJ$K zpA>t{%8+?kiuJPB1sTrRuZ-$;pj}>9FuGH}Cu=?Ku0=IBTj?8T#98**7t65Y zR>gVrl7U|b(<=V+Zu6AC@yx*BTh2``!s%EypRiXIGbRJ=kLp=9$0t>HVtLAqx=Z8h zqn;mdQm%;WGM$pkf38~#(Oc|(aoxdSK%Pktzjo;Swm1Dkjcr_<^1Ft&99QA7w4;Q z+G1C~MW?CRx@_m_<}T+_#W+^ls(M#5a>n7wwe(~a37P^Ygzc5WrtjA`?V-x3?jjx) zy$sFmtv211IV2SC z{w~-a3Xv)~R2^3a3sCs%9f^86Dc#(HKaF9j=$HGIK0ZXY3$@3j&(u$dF(K?k=iNEJ z9YB;5kD+Lz>m;fB)IMm8mDSTL_}aH)L3-z%hfVBS*tpKS9<3%&<`7?o*LGe#qO>JU z4$hhcn^_DaD%fA1*M5F%E1#gvCl(G&!Wp7UFgEqlV)L9puM@xMqBx}_pr4XP(~ylk z#qN-PB2micFUI*DF+cTHe(w{klxD$dPd#Uh?F|YnMMU19n3Qpn-(6^<1Wqcx+Yy3> z>DqR=*Y@uA7qFmnE?A6+{8OQbE#Z#Q8T2c&@z)elR;qGQ%nFmFmE?(qZF8t2*Xpzn z1QRbhEWeI}AG}ZK#$?7iYb7t2GgMC`k8&S0mdQB&Httt+AJOL(7u!{(QAYsZKk6e{ z%8Uwr)u<=A#S^TYrd=FeE!8aq)M=;O=iCNgG)BJ)KFOZ34^d*|yA@u{$8u$r9b>&s zejaquC`GM09c*L@v0H|J#xlqHt9yy~QYmNmV2H6HkJ)nF-MFYdf*}x{X^2btMBZtA%8cjDzGZ}Z5b;-yU{~I3xjX{w!Lzut(nX5NPsf5%hp$D7K zYJ8sYFsF1K{*aX9MAe3F3vw$L7oyYt_%J%sHg7BaMTU#d#^R7*Dj?&Hf)9?g@1(tQ zaxu-mPQ+9M4(f0E6In# zGtx~wV?)>0(#}_zd1ona&vPj2^nSZ*+pwFjTm7t|aTT3$DDNpj$>z*%!LugtnN3ja zLZwnxOZiW;nS7O2Wh?=CbV31a&%E^)Z)`+$$0b%91NE6&vM1a0AG=tjs4e06cz9?X zN*UBOYI(G6#R?%)53R?xYS5QNm#EBx{9~PhMy|q_Y5bNQgKoQyd(nH5dtNBE`J~3c zzrxzHicZ$I@1&LZDG62SRRX2Hm0h--i8<-tip|Yl6B(2?S<>i#0fLdBb9FzrkI3=5 zm2@c5+G?NGrz@=V2tc;y=U;H*4Y9v&1~7%}L|LG$5jQ9M$e||A)A@#;q~Ar7)oSiB zl=+g{%POSiMG$9;6MXeMBP`M<_@4xQ#xhC#er#4vNv;+oT4H zwKDMw#uu}g8K>JotC!fS4TCGJFA}o0y5XD}sR^%C z<_b$Ct5j-bk{UHz44V3BP#Cc=Dq@3DjI>PF(?uBABzRdu(`vdm?T5d3sT-8!|Mnw@ zja)5F5?yoZ#CX;J z^g_l#TV^u)19U#>%=us9NF3x8k+4Yu1qAjs!`dN__m+9t$N#7 z)yrpFAxCLUHppxzBc_B=yply0UIh6J-47}jiM4$@QQMj|kle6awYg2d)SSjjJFCFQ z8^2e>FRk}Rn|;>&vk3d>@xcCQ7OdkeA;eizR<Ln}lTBU5-bu0eW&N=Z##vS= zOPLzskBv$v?zuG$&Ps9KEO+D0POYlg%Hp-$%{4{H%KY@4Ynoc=C|kk7+0$m{ zIuEOB)b<>TPoZAM*EXR1+&iV?{Dm~Y+o8V%H7H8)`&I-VX`FX)vR*LegKfZTID$2foCRlIR% zh1hlG9@K@~!B09&^{RXQir1gM#q-C^bFA@H{JchnliDYXL3|M%5hvr>rxzJ?8P@CC zj=6z%F-_B6$!cm62R~xsAcK-aYCRRx&ui@lW*c# zm9s+K6E4oo!!SXCN7^7MCDpI*ZNrbfYp{FgwM({WO`RQx4!I~O0J7n%(+Nx*^4;rz zr(%Skt>K*zGnT%&liS4?hmPyxhIa4>)*y( z8&KcSwx+9A|J|?j7gM6@Q$U?zEpxtv_!4zH?Ez z$@}~OmC6Z+qAX}cNY^aGH>Ww}wY4gIQL?|~Mg|e=eDje@W-$&m=XGbYCzA>!wJ(WC z&Xs^=Nir7N7$iy|mf$4$NbaWvYbiT@9P~w*uk2@I$}LJ+Vq^3z#tHlh`w8<2%n9+y zmlMhpqB1t-PA}y2!dj{49lh59(Lx zpo+d7=v<_3OdrMvyQ|o~#4$Et&I-*MZzG(8`=W8>azlS(bCU^z?n^PD_oVTJ#2G-O zN(82?7Octi#3gY{z?xFflh2dxk^AwpC*C9RBkLpOqr?pnm=F96#sUkCk%{CX7sOqY z>4Q-;bSr4zAonHY`+BIhFS#LdR_B1^-Nfjx1#g0M)xD20N9bc<4g(L+^3R6`d- zDq+izw1{q`MkPpcgKgj+`Au|2Q{t*fvPt-a??Zg>ocO`daXE2Ufd;~FFrL^q=A)U& z`?E^F)PJ?kA_)@+XNw#KO~WA|-XZBl=ZMI|9t4kzwEe1ARI@O%@U+mgkh4&>P_l46 z4jEUV;|lgeX{U0LI1ZRy_@yCiAF>VmN^=`KoHI-H%RfXA$rmL80T1P{3Y#DVsR0HL zi<4)Pagt(^!A3sKJFw}8C)DW#;ejs7MssD6fIm9^PWtd~bF3uz9F=u<{UXb$`gZYP~9UaD6b7mhzDB@bXai zF!u0%NZrNRZQIQa#tN~A>A`%neW+DQOXUDE$N2!ClCyNBFz$|P_d`* zRO~9f04AKd zQm#?FR54Ke78GKI&%$aXI#?Puhhj`dDIOKejVs7uBtEzaa|xq77zncy27<8@)eu$s zEFg@b6qU2o$zbF=I2<+|CW0bC+D^tOsvE@|*@^E+Wuyu&9JP#}A3ceW8eNJ{7-jUc z0OyY`j=qfQ#S_HmO8B99vN^efr$?E{dZIhAJq2&1!S3-IWd2c|gq~bC>foQFsqsvt z24eT(-7)MDtdac^a^X)wB2gIx2j~Zc2Lw&rr^4DE=sXcYIZzW}`C@eipOrRClSNm@0=I!N^eRp^Q*;B3T*Qk3QELdqjK=i@fgDNan5nhF{Z)}#keFc z!?&?~S)ab&ZXff_Y2^Dyyiq(k-A){9%pI~6%sQ7$i}4M54AIAE;Wp3@b5W90@>B9s zQbNT5aIldHOGH{y8Ywq}I6)%bAF0XdG!YgFDMhlY~| zEDA=lMsmgygE27#crsy4(b+h^3HX?nncO_-X*lUq@bU07(aFLvhFB%XR~J|7S5H^l zS5r!7jNM24FgmF2f3Mmb{~aQXer3E*U0tbTGJX$Zh|fRSlC#&5)nECRAGrjH2YunZ}yz_1S6~?H_-o@Zf>`hx7O_64-&-k5xBEl z2yY&=UhexvdgK2!-zQKj2-j?DfRHlf1dT%v|>jz7xJvze&9eJd|9|?C%U3 zql!}wQVdc?N!Q9^$L0hbW`k0ZQ#ipD`&K32pct2+br6F&$c&6yUg4vt{JJ&k;I(G({ zE!0#XXD+7PpMqE3_>UkX@DG6W;jNAq|%wTVQ5*niGoK6jqucI8(8 z36J-C)b}WpD6=%SN^BME<){;Q=n%Gn}z;RvXF1a4%j$R_~I;NkxB!l zri*OtIBik9!x+P!!*;`3At8=Ib5p#-t<&5?+x_vTO=u

T{5?36P+b%J3`I)z8hL=ien(Kivl%_3PJi zb!wx0P}z0hhKUK<-{sc)Qqs%gz^JRd4&mOLJ76#n3L?Au_`vM*rTc?Fl0WocAUY^f zn`E03CglS;v6>UEA5Ivqg7y>b6-|TkiDH;)n4%taEj(*5NK`zZoQ127x{kDtn}w;4 zrHt6NXe)u!$UvfhE&2$f*Yi%Qid?YX7xq(3;v|I}9+L4B;HMUiv+Ah4TH9??a zL9~%6klK|+FjHJtuqw+LsW+KYD`ae5>j}`3G|y=Fp=Un#D`(JW=Vv=>8>>CF?)8`T z_VxC){@-`ZFO6~yi41p)TW%_OCU_dSyR(R6_(BKQh8@A8j%isYF%b)WWniDavi(L! zZSJ-#CeIFTr)k7#?P)H2I6EGy$WM+64&n|qPBv|9tt~uKD{0=r z&Y>dUZqTg*p@W$dL2F{0+vdq8S(YlG>QBk+KX9hmq^}O+i={ha+!J@yYjd&V=ZeXk zI&f@p>H+8MUmOvF^uZVVIlFK8&Vk-PJ2Jh)o@rLnHKz0?Y!9k;?T)s=Z<8E*a=VtT zW-nNqBb(m3Xxo_89G6Jd7?)htIQHQjTWWj-)*GJJGkl5dH+TyI{zxPS55} zT74dS2Bz4*DE0)v0OZ$qu1n-gVtXokJbScD%1i!BOnb6R+)IsZx*S-4pFWvw>^F~Y zok)b8OrcbNJ)T(q9!E%j8h?u1$=E%We+&+S*}1@2wc^3bk5DMpVA>vBv)l4#BZOuAa{r|orW<1u*@tG8bd~Bs{HhBS0OISbfxt6V zj8C0aYLz@@$RfW*pGJv6$$(4m*Cvs{W{|}YhouX$4ssuQ?8oYNBxRdJ+*R6D=+Eva z>)#3H3N8r}f@6Z|!RSW!qw1vVB!5x!FgPYh4bKuw6jfFVw5S`EAH?E`NXjRUkG3eY z=nf;V$FdY%5Z%tlpA%OqIBq?*o)eqXpEH{?oKsh7IZh~5zGd+;D$QM0#;1PNyVboF z2b1~HJD~|7w?!(1V@8fdii)yNu=ND*j58-u?G zi6T}a-NR$UxFYPsnZo_C+#_ouh{7);d$3}Yq7pjMb)<>IgTc`r5hnGbj5(C))OGQ# z(wH)v6eOs{g;L67YxJJvYvgM*Ym|@5PBKo)P9itiCMNUNV~d4SQVz-<%1X*csAM$E z;ThzT<+5JMNvVyLmLl`Tg>+IK3HKCwlDs*K*)Ei2R40E6y`}sq?W_6^(}{(Em1BxI#n*wb5z%)!9;Y;2uBK&zGIz`WPgmCHJo0oIId`7 z-ekmN!^GUA!&I-H$n>u%mnjhdE*bGCz3Cn@<}x9rK98b-m5yNpb=yRzlm39EJu$uP zKqWV5Hw`y-k7Qc0FEKAUFIbPhkH(K8k7SR|k8Evq5CzOiX><+|a}kaabziK9;D>C6 zgoArXCF=mSCrW{4b(p#X20f%sp9TyD&6lG5uS%tHbkgWU5%^-+`C4mJ$4lcKKuZTY zwa=?t*4!$#(_&F;P=89ANUj@~1hk`yPD#2H3S;VDl2D6O%T$Z0*^;bGtLr7T$}1I@ z3(QN|>G+a2lKGN5l6I((Xcg#~=$NSOY3=F!Rku~%%3WwYityuYGHkN=>DC0-c+=DP z$vmZRHcc+U7{`{3)zJ;>RwuS{)@5^__-m!%BOD?#o6*&jIu2u*;Z&Rs)_XG- zQ=d#n=6$Q-;Hcj?LMHSUo^jW}seIS~hl#B=T|8ZdZNxOglyO2g`y}fm=OpnYy^UWb zMQV!NRGN(^J%17;Yi4F^=4d8sW@=_;CUeM@ZeUhDu^I2l?reW}lpa|xIKG+XDd22w zCShiNxHO5E?#^a!);;c%<;k}|K0!ahXzjI}M&Cl8SsAZYP;b+aVoqVkFnTkYk=n#= zZI|M`{6g=hu8YY*CrC$2$4kc%nL0EzJ}NykKGmL-o_=RqL|Z{!!CgULL0Lgt!CApr zAy`3LK~cdmp~GR&B#Tk{MLAy8L@kU~S4>H)995MaLt;p+PK~AcjHM#6m z^}L)@t-&hWs==zlD)m%mNuxZwyl~!LO+uAQHC1)1U4=NORKK*E%V=r%ROyuEH2hTR zwCwccG~J5m4&sjX&dIeDP{>xvE3z%(H_0-n$t+5{mh-AqDIb-=Ek2%Nx>mJoy#}|_ znj}7X-^HF@E^;k~F0Cx4E|E15l@gVen9PhfPq>ZgXX|PA@OwMDX}U?e)$r2jBq5kn znN2h}H$>LU)Gw{^tXVg#nAFVZr)J0LWxi^;ncv5p`L6Lb{55koC7OJreD=6MIs3D= zV`?xZnBvRutnQ|8-*uL{R#V?pVvz<;J4`!>n(jM_nn@4N$z!1!;i96YVx>Y9;QN_8 zFuDuAa(dvI=8@tVKk6RCIN~~>n~0p69+#flKlYBN7#knmKcbt?%%+%g=ZSM8yLQ|P^_ahB^N_zMKaiiu&9+Mvpx>tM=9uQlO(#qz zjJr;?Q?B6_;ML3S=I^HL=I$o*73pH^rtkjwwfxcdvGj59QStHbWB+ygAa`;**_ZxH z5g7eJcwc?oJ;FhQt;P6nM;18#$J*bf_W*PmG&dkGz#g@jDBn*fPFX>#rfR1?AR3|= z!URGO!>A{SSMHx ztQ^`6trZpbsvF189(z8vAmf>|-U8NHvw7&?>Sb>Ip+-Pz0_ZGP)O_78ub)4k0#aOsd>+Enkq1ZjwGqJ;DZiK0*`sg8R)^|3Pp+T6HJ(&fYwN&F+{UkxbZESyfgw2#t&*)8tro3fuP2Uw zxXO&IUr(9K?`}^z$4XSx)plsCsZ*5QRa;cul`HP`rkK{Fal7i+vl|efU zJL(B)S?Xbxn6fNot|mvzV%ftasrxaUWG8AY<*9OQ)z%_M2NV6nv9ZJCqOq_s_04PI zMpakks`8HlN2kN(Z$z?h#Yg_#@)%Tdu!=m5>_1)Qu8M{VTs5{%OXp;l#g~7-RS1SvmDkCZ)s`r$`%ac^_&WcsIRMJ&eRnGn;{M-9C_76cN zv%E?9vh*$g%vJ@k|4v< zQl8Df>=Z%EGI-wCc-`&NK8ZX)X1ZUY5C+<^DBRW@}ri@pLcMy9(J@(^aw; zswzuYUW!ipR+n$8c(p!BT~0R&Ea_JADSH(@Xbr;5lzz_EqVw_fh*y ze@lEEK9^sH!qBTG+_WzPigh}GH5rKZuRv-CngojVzl2C4JRu+=R3Y5sVzSZN-q@*c zAP&8uvej2;c_r5O8cry_fG!Lq>|F(-~X#7JDr(l8flt%MEL!WiidsL zMt7;BXtmkH;(qVw<|ywd?I`Rh$W)wVW5V)?{XWxUQjgV*{o3Nnl7IbA*Q=qE+x_H` z)=8Pk8jIl-hk%XG!bioc3QLoT;rIb&CgwV3JEq~bq|Ou_J>3-@kWN}FKr28~f{vIj zp6)JXEoCFc@o~h_jrGb zL#1jZsn&2)Mzf*TuZ9>4HY+w;7u)PPDeJ~>D)`x2Tft(di^uui(ut}jO}ol!#++yM ztlz6H4cG6Ra@T<7UNcW^ zHjeK}uIH{|UY1^_UhJOCavEN;?-@^LPfbs;>jGBWt6jC9k*=QoWlt=ZX6w_9Zq0gj z-QhWD_eSs2mq=^51tr+#(_!A5wrflU`&Nf7F{eN3c`)57&Y&;zoEcrNcPU(Jc))*j z#2g@6gw`3!{<0cgLrfhh+$g0^`S6rbn)9tMcqBvx7ZOK?WDb!bqBVw%_7fL2ouM4T z$3@sBf`dlV5H`xIopCn@WktyVmks$VsFZIJ$7T$Ml6M+MXAHF}B5Dr#0K$rv0l_60 z6UTA@+A3@t2Xz4BA>>4CXHLLM_+5k*geeqBEMN}PfPNR6A~c?lp#W%r)kJ_07DC2> z^%u@(3K2o-geHLCm|?3 zg4pn;WJ8FFA*1~VMzD-xX@)W|f8mw<%LbGUfT!(scucuQ>;_#uf5KOzP6s-^WLELz-Vzst7CAg1B7av3{L9dwLBBu0{NlBdehXKFLGTHa-kvL#;2R%LE5 zwpuuj7Y!dYjUth|$y{Z8nBOIi@+IcV`Y^pN9^{XbCJvL!%j9IF8I|bU)Xdj5sq<9u zrG#bse*$>Wc;L?cTn46wxDB#v>DARL@Rok?K%M(P4tN?I8+O*-*WA~3sS8}7UMN-w zxZ=2Sxk9i5+ELqK+i~&25c(2odexcP!SN!#eX$JSYQ$D7tx2C)F21$NE8Z($D{$)2 zWYw}9GGUoc%gW)nSPmJnL(LRnE{y* znIZK;>49X*0$|!Sx33_1U9qbH+qO z_K58j*w40LXT`G(txb3)H8wUzH&!?1vMqA=Wthq~A8FiIE-tMuaV@njc`Usy#a8C3 zXQGLt*@MINsRv*f;2VH?V)h$9utHja`ZH$hOQ#9h|C}J5peTjTMP*0jr?4imCXdRs zmg%N3!L zhQ$w18nQBlU`t1l4xyoiv65tu5Phd|NMvNl>ca6!Qb$Pd!a)l%(tgpBq@a|CEe_xs z(mBwffQkdaqWoccK$RFlqrgpj@YVg8dSGQh*?R~$0d6~Bpa2LmP>fO#yk4q2kSAma z%K%mdzgclow1NQUk=5|{b8 z=}LBB)9y+Mo14f%pvwkyC6KvbEIky-DAz+ z>d%U!Wy@nrvBfT_`mxf8=tH|PN|Q_}S!s=*p^@Q(gJREcWx+ZSF%Yt^q<2d9KGVhD zbZ6pY{At}3Z-vWp_PHHhG`&i9Vy~v#X}w%`Uiv@o$G`}Irq8F|>T@69&ejrP>Q*OE zWX(o+dNebggSSect?9D;p&aDLTjav}WVssG_0taAhW=l%Y~zhcx(Vd?hBQR13@so7Y6aqgri`x4Ov21-w> zeoBH|58~$+nLzInPc2GMf|Gbig2wV%gAed>YwIj8=gaOj?hUs_OdZC87BiGgP$pNS z^y3J$zv>CDFR22ZY~v!pMYy|!X|V-5=^Rs`oeBs0(V$o8led!poP<%M?mJ~ZWafs3 zTCk_mz&^cBJ|HOw36?yPk^p8E=ih4|w^hn$m>$5(zKgBWK{161(Wt{Wb0Rw^~ zG2c%*q8NwB)#p)2C&klahctHRhNBvBIehvCBoj-_`%C2Nn}}ta8|x{iUi6P>p@vuG zrs%6|ubg;!XZ6jnx_?T4rqb!5)Hp7l^$;mCa*?q{p~^*vMMV%KAdDR(EwI`^LSx45 zoLyX8Ff(w|Inr}jV}u`Gk;7d-gP)ZU)Mho&>2?!_@1<-e`Us#JZ!I zh?+sA^8rj%_w#-q?ME{fQpm6lX~;15?or4yHR7|l42;yyU+`VJj3VPhFZl>QIhBS3 zdFwV76LD*_518D_BGa0A*Q{J9xukF>z9}o9I3QEBz&oxebB3F#C}3iS*D7glmt~9- z_BHe*dxl^73G3+U%Ahf`Ys9%Shtf03ytw9c?JeUyz8GWfl?jhq1IN@TM)AnMtol}uy=gp12i#!B(((!!aaOrW$S(e zlylr;YiiU9Oi7h8J5}jLQc`yT{V$vzC&gHD^F;FTRd3`SS+#OoSRjV3V%jC-md259 zZynQjHbi4RgwE#jg6^?$Wo~p8BGzrtYIM>YajPFKwi!RBBLv~KnHB5xu4w_c&^K-h z>Wjbb;j#Y0D6Kfg=!HLJaA0V6AI)4s=M?_05VN$j^wLfR?d~&{S^CJ(KG%l9%^fY> z>-8kqqm?b%)U#>&6X5Wkv#8%_8-27@*%EqI zk2~|;F1}bk+u``T42@L>*GZH<3|qz<8uvjve|(xXV-j~V06gFbX6=>qu@~T1H**vX zS!nWiQt-80*Zl4LEKn-MZ%g3(UZ+U2sPpWH=PJY8FyrEpS*a2~zg-CGvHgO70L!Hl z;i6!M7N%g~tha6S(xJC%q5p!rO*BFrDYIz&Lo$-WmAZKz{enfItetC1go2K$2>_(D0vqZJ3-Yyi5grg`ThOE!z9zf zoM+t0%Aj+0GdfoGWgEyQRZ=!U2FQ2iJ$>Y;7n{6i%2|!jwbd=Oi$!Gb$y_OX7s3en zAU?wKX@GcOQq^yeEI0)>dmgtGCBcsh-2 zg3)J{QhFBANPDWMk&5Ynoyu8Sa19L&!Ep<+*}S$i#F7-u`U zh)MO6UTp2T!wP!b3s0G6oPYNNf=zGj-@YHwKQV!?w;~>656xHNCetu`!i7KA)k|w6 z7&DeF{FmB!^}o}E-ZqNeA_@833zyw=HWkQ;WQYDTbj8vWiVic1?3_2lc{U-ofKJw! z%@H4#`5Q#Cz$<}(K?uFqZ*|QnSXInV7vjR;I*IB1vC2!&n*_r_aDF+vSH4`lSYB0N z{S52^vb3AI1FcxwW!YLou59`jBttRd{qwuZX#M@YmtO?m7Q*O$t*!FB6yjLByt~KX ztTCTuC|n+#J})?}pA?x>s5_Oe_QZmmIx1I#{;RSErVQpr`Ql zdAAOwA(5Wdu+MbE>(&|JRreA^&f<`Y1uH`rhj;8Bn+1Nb-`%;+jf8c+^Vr`q1h>Pm z{6>OZk@gfIoeR6B#f~3{ae5t+wr)i|Gm_^k)F?%*dGxoCNP} zb`qrBZk~HY+zx*z*cKoTblqu3b&(Mz_^3MTBd(cY{QXJ&EbM$u{qzyEL5z3AiNm4VyrF`PJR#fkp3SN+ZDnu4HY^c*1V8vQpqD@~ z81c2StqSvtAkV6_dNzojdbTYI;@P8W#`RcSoGUn%cK7d(?==+|x z%FDB|0tfh;o4XJbgiv%q+zTCr2~7od!uMJ>M_d zV-mZ1KJuUBKDDuG85kPia&#Z3Kr&z-I&jI|>Hb0y`LaIVcbVZW(oK>k`_vSEh6r*W zZTL@0`?XFIWWzhyHUCbQ>qcl(w4t(-waoTDx46)exuhECz&QcyT->W*ApsIn#Rq z_}POP<*x}2=bh=XavXatEY+8XL<(4}Lb2?(wE6?tAfjW~*hSfh@-GrhoWt&Z?47V_ zx>+)E)V#*+dgpdbzrxdT5y5VTDf{elwrwrX&V&EOK)x8XYVFpcSWb@bq(SqG^eJvS z)Vs)+zXtoCoQT8G4>YMTn>3p6Wu6MjImf|$@PZ~kWQo@u+ckp2dL z$C-1uC8F<$K!?3wzUV~&3SY!+r@e=S1bfAKkyD>jj7#FjFZhFb@lHHa-jyi_N)1uJ`hWKW^MnO7d-i0jHxrHxaXP&&f!*Y|Gn?n?7~N;8S!ckFxo zx^3@x>CHNU1I)$*yZ3^6HGkjTRRtqr)F(N$sR;SR;N zmks}>=42s43R#`GdX;m*foe7lbGv3~|2VXJFRg7rU~mdK!YR!QQR+-?ikIvtV_N=cGU-j*tNm$2Q}LbLjjsNo#bGcx@Ft0nm|4;w zXPLRiU)leLmN{+R)vzkOBK6|==Cf{h8MB(*&~EUxa>cM$j{{!vIu)sn+5Xn@+D7N{ zoLfH;c!9Hr!Oby|$;@EsGZC;7{2(?lSR-G+FdW++bUdy{eS^gysY$L=r5=wHS6^qZ za(kB0GuKm>hpVV%&*PyX`qmI-kv^{+5Aj=Uc5wFRtO*lFZE|hqURT%`vyan9Z;(>M z`~%BFeU#J0eTDSR;Q-A=Xx6Wd;SP$Ak^q5V2GQzo3p|Ugkqu;9N{%S$-4Lg;4QN|3 zjtIQT=-na5{g&Gea9hL?2oEAcbU$GQ@Cc#Qy$VI0ES&_U3_Vo^dJAbw5nt6R(neAn zo42(nBo={PT_}vRRgWLXe1BfiR!kObWreWm^QL?L?JGM59}4j2i_rKF+G|^-(*_%K z%QGQ5WKZ>%WR-6u5PMCl9S33kSK)WL1#k=0jti2fNnpYf|LF@QI@fQ|kOByWBQM-V zevYpM5Be7f6>LyD4@}hl!qh;z{QNSbYj9gY0jE^{fq-H|0uaQSU6^GO$8x|(w%ijZ zcrlZg6SM1pdQIGjk|_L@$VjHo07}-3Q-GYnm(Ds(?KRe5VIUDSyXLOccQI-!UVHi` zP_F!NcF=-~<|i30+YI_>8n-V)i^-|~10P@3?b^Np5}NYY$SohMHh3sV)%>_T4`@Ll zRZwu>tY(N(nfTKxboBVt6l4#IHDC27*vM|&*$BTCyG9DIvDYtP~^&S$E@ zM4vn)5CH%q*xe8kzw$+lKskn=hIEix*5B3*SAL6M^U(WG+E1k|Fzp z`D}a0l3tL(x1P^1{Och$V~KyC&w=RIus*d*Q(=Tu_VEd}T=7$T{V}!SoYC**S#l!) zWDt*H*_BZ}sUIiL`Aafw$%VD{5^pjmsIi$@G?+#jNS0HBn>F?Vvcgjtifm5v`wwB< zf#nN-=Rfm;+#I-Z8&OS!oc4zipIUVKH`~cH22iTbdaaIw#sJk5-)tFA3It34!r#+A z71z@}0BXznfO(^Bpp&DsOrvmB8DcG=`R5W?{iXSz3FHkQwP>)nt1aTc-3aUG;3w-- zTJtu(iIC{{wkx=yIa?eKp$s{{Y`z-c!rq&CRQTiTEKT zt?KOxG+0(xj@z1Nc=svO>K%(Mx9+??paik>Cy3p@J=O$P7Cw+haD@!+V=C9|&~`h= zvrtiY|K7*W?p3r~7Qu1(?W6yaxqs|eGqHUs)ocC}I%4v3Pcq!+&?>Q-qMv~Yl$+MI zmT2S4S5Hcz0bY;2Q(BiDgF}{$9V^)HfK5;O1Y?I!kyU+0&8?$(#}V#(7|F%<#So!}RWLJ-l^n zASr>syKkNDS4!5+6g_v~^Yh53-9UQau$TK@=h4{{#bp2f@qS}9j-{S%Up2HkmvNuU z7eGRw5^-SvR_KfRlu;CSj3uq29Y&~Iq@VJHEsNWk;ChbX2I)Q4?HX=|>ccD5OChpB z?~CP>zpb)aLK>&#ZLP7}DBf1qYvxTMbt{3dnFuiRc;@f={E(NQ+H`uFpwXEQgxu`O z#}nJHggFU8)YDlGWk?GRS~+bO{^&Y2cdw@RNoMQClC9SB4sfQ)PvMq;!kmS_ufB6x zw8fsSH7cm;@L`T&v*%@3L1G+=wSmuIg7j-_v)(SXeKglg$Eo@C@7RR|u!9U<0TRh* z9vcVJ`Ky3Wq$K0td)l*|KS(xzmmO`xVG(?kESTLjJY`VSHWRJtIV4WkKSG-vx0ARh z2a)yS>`cGA&sK=B>0mf#s-;s7g{&VW+h!Td^S9UQ)Ss}MCi&jJpc`}WF}FFtv>vrq z%b||_w%}L%pJGKVSz7+GS3$LEv_?&uiCknSsj>_}0|I^Gcv<(dHi| zPGwKNZNe@naK;A7K#67a2iVH_Zz+@K0W{Gg*k_Gh(3GxonO~z2`B|jMt@`Ii!*&-@ zakmjgFuAK=R?cy(kC_dotFSki7b~y?%#y>YJHOm)+W!6WJ&MHR3vk0e&z8G z*Vw`(UyV&PQxykrwrK7d9N1Ui^!!Wx8Hw?P<0tSF1L$9rI=sD7RcZ%w_G}xJhcIl* zcGP;5GpO|hSzOj%G>c%@m|ctj!h{UwirZl)-ATXnP697`ZLJP=k8fKfgNmkKrcC?O zUM$?OEROy-LQKC{5Kw;#3QDSih-Pe`0E)?Eu)}~k*GgjJj0`)D4$37&mV#DPBMLjN zAD=aa+~fD%Jppg!#fUQ~i=#<&7$gCO!*npfgih&EYyfA?28T%1@SZ-|(8nh}5 zN!WmUT#^>G$kM8G68GiYD%=qaQ|h2hzf7GhAe}N2IcE$eN;v>Lq!_Xy(J7cQl1Oy~ zN?cBPL?06xdHevpDyrujDDj358;|~%g^N;A08<)v+!(wnEHAEC|9h&TV&E`ppn=Ks zz1+KJtySfL>QZ@DiT*!9nG&m?Q~M-gs}=-(xG}9%^7O)JOu(|xImN0>z{eg;s2CIT z7Ws5;J#FWTt%H#5{bz;)6 zL@~xWb;t%i6elQ8(kXw#o?n4_)X z+UinqeZsYE&R$EJV$#nRQpuPVlL)6s3|cox zK8E7Hg^Zqps;{$iIitYYND9~DlRx0qA_uF>QS?yBV4I#c<_xMp!-N|Khe41i)Sh=J z93m+~A85y@3+Iia@WlEdEuJFzBb6ZTJy~*Ms2FpK1z4tSMN>DSt46$XPaAU=gz_fg zLARUKpf@J?FyqjQ(WFQm!|E^n0sSqWCYeOM{0dHDm4dSqf!az^#fuSkLc%!9a+)j4 zP9%>N2c)IU9$x`EYr9R~x z@1XB52w4Qb)3+0$ZH&+IFqY&n0YHfZ?H}<;0wACK(gZ=x^7c1>BWZ^4qg9YN1uZ!= zEK^`73?nO5YJxVm!}Lcn{cBn%4nZ%gE)`C~AQEEYFO4R#D>N>wMlW_vMH8rCci>}T zub)R~g5ybuE~6=a3l}YXof;hcTB(i+8ODrNP!Hx=kpSn&;Di|gqA-Hi*_)rBhY+OxwtyJiV4!uXW8h`Ic@>9PoCTXyZMp1%RfB%!_Nwy zejSam4H@_Pp;{UgnfdFZ*fbNO~Nn>_arB{3driUC*6Z|z9aGj_G)3Qnsv zf(q{%4T)=UxK8@@u2O}Q?UCq_$8&g&+gQrpm%Ha|;W{k;C5|%CL1DqA^ZYIZ@(dz4KqU#1%{lZJo}MO0o`Nlm zRw5+PEioR=F{gk61y@}%1<^hP{R_U@)zT+K#L=W?yNcP&nq zh&RnVm$TV@+?QN9x^8Rdo?9)_PF{Bx_B&S>ZBF+-y4_b3AKT5_T=f9_CZ6^i3&`_} z0xE$jp7xgJuob9Yu)~1Q!I{VCq{w=9g|HM5CLZf*&hP2V!mn?Q{gYk6ImJOmw%S`2 zgd}$@(MHl@8duHNuDRVo|$302YO2=-XJw>%#%>8u+6>R`nhYv$SaZjSLV#TW~A z;JJ!Z)#$n@0q4Io&Cz-Ib2Uq|)p2tPEc33N^sEb_vw7SovGt?FfM z@RpCF9J|}tmkmb;knV><#C_5P{AXVbdeKi8k>Jcq#Tg^4X+W_DS=J)4eTF8N25O6IZPO>hZLwgC7KW;0*BAOqi*tNF)-jxV^OiGf!{QJH zm9c#CtRQijd8q|@mHGaSc;Rg!%SoQE4Fz5Zg}brK$rHMfzkX-e>B|;e#3V?yGIy&C ze!<8d%&}@>{6}!Yo#RpnlJpVJpC<>WjQ*i%cAx#5SFG(0=aq)Tfj`3xuG-R0ACAk_ z+nlyr?{~#U#~}3(_04~HxV)d1_7U67?0ERT7B4Q3)#&Wk9H_WAVNA}|wr^c|yuC>; zljo<_f5K(CeXe9(eM~aox$#^B_cPU|ya=+@cj}fEnl}_g(0JYlCLURP!!^{F?JmX1 zwDv-zTt6^|BukFnkX%U<=(5c|(jAhw4QNaoySZ+sUQB|(Jo1HheVz5bZS|&jFGqp5 z7H$KN^n1yzc#hwVBvTiB~ zz$`7=UXe^QxJC&l`u^aawb>mk3sgjS+@9MVt95uz=yh(tV0`WRuw*hXSJ4|)O32}0 z^Hj;v1++C-5^uYDNHp%8E)>*Bmt)E!>0Bwn$=fh6BKc`NA>^l;{uTh91o_8EGcd_< zkNSL^6x~OhrqZ{=2k&Kl2_A}~8&RSoAt5PGmAFkkT&m%GIo_M|yO(BN-AbcvB&7pu7pY%C+qM?M`ZdcL>!KNi# z%@y+`fRiGzd@@4PyETy7*x=IdGd%a^Zv5gh-7^Xw6YGT;l&?31}dg7LE#h{~6?9TALj@%$m?J)I0W-aKAANVeoal z`4e_+63~DL2!azrkrbmee?M4iDqK$JvXv%}dlNGIuy;Nh5?`NdysNfJK5urCo8bPs zO~5N{z{n28nUBb3V3FfqWt|50dO*6+7ruP8wF?Qgm(P0{yX6t4lP^G0)@V?Hd78Mj<(<v>(XXfkbEGB{by#Kc=WMzf^<_Kt@H+dvI~G$Bi2gKjs2;vf zkpDg7gdjNm!}tzauKLp;;9fs_i^Y^=CMFbcS*eQ#@tOOWp_zDW16X^vd32X9nQRBv z%B8+OojVgS-}N#i>O7uYg*^wBTJbYKhI7@-gXPAQCR{47D6*e3Q?t%^$@yB%Yll88^0!OH z2#!-_M;}^h=DzQAFb|^o(D4qoM4+7trB8rCtgc&uQ^w0kYJ52A7N}rjq9Z!a^5vB!6F!VDsu9ayQF+r< zj>yAuy)4^mhPiRAjeFwS5pU6TQf;&zfMrF3lsv7i#xcZq_4LG*97*_EP2;e&?P8fc zp3_lDk!2Aqr(1IT9`(fA?L26;`nninvo1gFUH8k?bgEwIE)t}WnU5h}*G5shpi1}Q z`1LT&;%+?N&Co>6a9;1r!$XU_Uh?j?C2Xz;p|3h47}0ffJJ+83&HY@mIS~hwf@j&Z zf?tU9^olK!>Q;Oh<$93I^Oifqx`B8q8wzTNwUNc`bAqr}16Q+Pxb-HgoS@{mBDCxK zbA)hxONaf~8Y!UuaHnh>izOw+>q8QT=CO5j74zUx6F4w&8rk2ZrQKzjtjXzCm0abz z9)bpV>D>b1s{ z2^mWmgOl#{;B0UM3<4XnQRUK^r>KJ-zWh7pg_!m)+9np|&QuCfKk`C=+f>U`>^$J# z2M*N5Ib~G50_l0-K1&59-=KQH8YV|Ig&m^BR%gHK&qBN_?)xns9JH- zA4_gWa`tN?jBe-5IcO)Y3%M5T5or$Zaf40+QurdCT}o$2NYOVoe5pKpmRk>`Xc{gL zq=}s8%~|$7FAs7z7gGpYHA+D|ga#$#Ki+EwUP}lFlw_bSr7&P>owr)#KJMW){-U3x0`cpujjwdlcU99D93MSIEqJ|+o z1elv(VM_U1Tb{4l>iKJzkJF;yVr7_d2nW;o$L<|_vWVoD`-4P|2sRr;3Oldcavs{I zG~M37cCeb952beC1^>ucD&vR6qQvhBQqzKwFhMJY3C5{|Q^I14_RtFMQua7fVFk?| zN?=FkM1YfGMS!LdFGHvOoZI@%2}|W!uRSJ4Z{XZ29I;VR5ZU9H1`=?hxI+;iKr|pv z3|fv3x>KSb$fyn)knSjmO5-muA-YF%GN()yjot}UAf1j+Mx~Y~4^LXA6n_Aljz21d z2!~UHKKd(4Thg$2sh`l)((WSwzy*zb3QiIz7z85<>yHf)CX7Wg9-Ian267)RbRTZu z*P`epLL>z^LE_*9`r2c@B}r%ZQ;lbL2<^;)clQViA|h(xzy$R5gQ9^3rdpQBe#M#! zvY66pHkkh&iV~a0VsLhLBx(~B$BwG~KEh!zBOyeg%tA%;GT)N@%g`#JmzI{;F)>w5 zP1!O3CQj7uPsj{KF*emQW=He`r%RfkULX{Y(0b}-W_D&?!I5{dq%H?^ z!#kIfAYN%lx!APvM^h5;uci|pLTT%8bG783UFEB@^Wgq1Xf_TArw@8>B?&e$^hbq6 zx1jd_c4QLsBg5pvsn|MGTZvc3=T7)e1m%Ogu^rfp^v*)j!xX^ft<6EygwY+tN70?@ zh2W#-X*t1S-HPoQe-gy_YZ3P~;1M_rNvUU0B2xqkNrurLcllP0!1y1_q)MIm(cI2$ z<&~3t2|R6q^G8shfAKGF>O*UdX%7`kB4W@-pyW*XO*#H9{grq6-3NI6 zt|;}-cf0L5N9#Gq>#FkVtZGhy3^yN1hIJkVTjL6@f25RS!Z4WKQXP&0bxj9uC1vf{ z`AbK-=~JV$bqynN?X8q$)qCP0R(o0ej8y{GM{@~d+LysE#v@%4cD2dG-Jl=0l z-sBZKSI7A94_aLO#oOS7;=S*N!k3Jd1eX9Vkh;JC`{F)$*Sed5Hufe(teSMqcgNce8-gxj6FmNaG*W-K;X3#8w5roK7`U7PA|%4K)6LHIKkd}10WI?wz;#Nqu+7W z?JI@o(u#ai1Ws`;B@}7XihwO;K6xr9&0%GP`CbKEb4$>a(mxf&T3jkTL_i)l=TK9N zHmwtQ70=@Nwo1v`J3x>SRpoJpBw_{p$|8BU#Nz!Z5@@l*rBfn)YINRPHwmEj1|4fV z$=y9FJiUcDY1Vs+^p>JWi8I#exQU=PF9|+@OUrd4(9(*1j`GYKkJ7w0#GW@^D2ibh z!pqhEogra(>=`lFz@B;3KW+Wj<2wlSJIJZFt)xAnnx74;cs(|qbTgSGj8}26RSl*o z2VDkZq%cE#2^?hH(@q^vW)mm}4cW0~N1up{p@Ae-A3l*dJ#3u1GbVUg4K9H@9Rv%)XmWCb)Jiu{ScT< z>vUJG<_rM{^|Ue#UGl1|?Dm$L@VgXGz5ccqA7$9y$!FM# z3He(?s!GD}tpO@pYhU#ifkQIPFc z*rWqjcVC0jZ2pRU0hqhl?qs;uxZUgs5!=@&`7gjdEyamRWYFFv-qK^<%v(`zZ@J99#`!b$IjO8#M%yjCv z9-?@U{(LViHc?!-R1Y zFd0;c@LYHV&g+;yjtA|5CFD<*`Wi^^NMBDWhp0)M_?n$|ChLEQl7xK6tE+}TnW&C6I zfX?)+GXmwSP6<)_Dz)%1$1g+Dw$q4K9udO|EiYa#zbiPBMYTrsuB`bmL?k{;uk(ws zA?eDRI<@g#3E`OvD+(vtcW5WK_Qebzh!g8ezLOjNLV^{Ln;1o5CzdwAZ)m)G>QV<{LP1>1XS9f5d-ayN1 zSc3$a#kNxcvX(1=pj*Xs0V8Fl&bxRm#C%A4xWz1k4jSdj=Pmz(`nDVYI69@yB%# z6QL*EWGIOd?)Hg2+>uxx^k~H6(z-6DNn>*xTWC#O%sj2QOTx1)pGOQ1So5w6r2CgG z;GzmFKI^Pi!uxSY2tRgnf4VJ87 zGpW;z)x!E)H3{Dj~i@stX$qzh>9MvcH*T|j6v7|YtL;V3M}xlo!SYD)zR=V zMQ6{>N2B?ut4c>170M71+Sq7}TR zFv3HOD>F>W6#jbBxq|`|@(!G=ELE-A3o|YIrQ0EJX=q=8*;{khHBS%=cAT_ygBoFS zVA9FdAL^qMOS4A^qbXbYdi1B{4VmRSf&C9Ak;W6fOA{0Tp1cEr*Ot8zdrpZ zBJ$8D!Si!JJ1!e;Ub{NDYViPav^H{oAOQWTY!q^Up7z?K0eg_0_w`J)dT>9v#mR6# zz>KfA(;hp>&YM>znmjDv+SXjIg9f18S<5xM4S92=mx*?~4!Ekelhd{VYq?B68lc7# z+*v&uz{Kl$o@S@mY6Q{#)OOmVk!ddGnjJ;7e_T2mAmS0!*K#t9__4EjoQcNI)AP!} zPI1)?mgQc|RlA&{?F>79*ZbQcWu|%_kX*b=UERU8Tk|tDu-_rOt$~Xvtn)I^8WsRw zW-Yg|O#pCgV}(U}@U79iTI)K0Tk(`Je&%A%>XreKb;-; zcHC$9AMdBz%!ikEZ`U)>=(S7Md=5ev_qA?bHYZ_10f3)6Sx74c=qELve;5E2T_s$< z{f2Go;bCrG>;N_8ZCvps1i1#B{BYAM0CSD)EOnOi!mo39Ng=dFJj2>P5Ao_-~P6g=G%c{;}uN9~ORe|DH z1Z@l6Tp>UW%)P*7mO?i~YN1JP-I6O#Q>87;JIE&_a4l=aN`^yAo+Htu2gpkdSomt> z`fZ^3^jrf{w8%m6@-CzvyUXrp@9kt*pik+GSPgZ=Py~N%|>ywe+#>RTMM`;Lddh1b}Cq~t?5>1)~o7HOQ}FP>UXFGzJ9N# zQI}tir6k^~J^Vv6Sc~pA_m7al!IP&mdrQu)qz`h4Cle3fpXkv2F!R7am|$2YH0k4!x_H2;UNFOP@njs7Q|2p-Y-K0O&P>et)l* zGxyGOpL3q~Ip=-O^_sbNE`GGLew(^ZR}CM-RDG7H`;@uY<_xNTV?_ZMn zwpYcGSRiOj++tRKI#Ewk$(10#`}=mD>%zp`W1}(b=ls9HK1hge;UAlu(C-#s@?emU zv|q=m4><3fvC*gUU?ry4VHFVjd}X|3$%*5g2Wm#8Z|00-Z)R*1KlfM7`!=FWXRp6a zHYdS@0*uenil~25;OCfqZI?*N8}kUl7A@-0%uKkfmo$|V4=JWHPK$*7Sm`egDxx=j z5^pL&OuTJuT0zwBGEPI}Ny(Uss@O)cqA@zHB-x?@d4$%s91e%O+@wYz#xVPk6&k&5 z}d_^wsowxZx3^u~4MQ?#^+ z8mvYAO$e=Hf){V!y7W_5%#Ad@aR-R%&atjh_rPklWl6DZvv%W%^dcJllkfF5eD=MLJCE zFO2#uW1I3UU*YIL+X8?^Rfy{Ce?Bt>Z>Fix!*eRUb5;+ zYriI5ZXL(!~KGHF8tqC9R#O%RLsxYCn}zLl9$QOp?WM`8gq7N z>;A;Zp3;Y8?~JDoE!IdC2|s!P`n*U+UhF=!NE>8=zD22!E}T=P(;U84jG zt*eJJc3~O*vN1#$Y@Al536ayab72h6L^5e78DNjdybPp?_shzASbGKiYh2a5@hc2gxG()132bzTe zmmzF|yz&iJ$na+P^%(fDqLdm#A3mbx+8-eG{m&VM6vMY`BJM40W9|^@y!Fc0{Obxv z9{p8>`2!V+;N8`XhT0NGF6)l-cKCqQY^t? zSr~j7^GzB4*0?xm9#*$@-Ytm`g`3LK;mzmm-1Sj<3@1)Y7Dc|(DI7e@+0$PR z%d|t2iV0Dx^*2K_~30=Ra73~v&4S)wAWnNpPxk{ zi2VT}$pqfmt-YM^@tMb)Zn(x07|moUwkVfpLi}?!O-6(}@#8_|&$f9;&3-;HHrYEg z5YOrHA$UAs-oR!5sW6?^!fTjyfo?Ut6HGl=3T)aU9frpA%Nj#x3LHnaXyxE*PwI1N z$&TbSZ~wlmgtnQP^x0q&)vdqw!r_QGAqV0{=di_(%^4C(DbbqJoBc^rrrD2Ff%J{w zXsmj1Nm;5LPw~@*Og`>0K^l`*EBeV01VjVYRMC&mgIk_E_?0u-gv^=l7Wu*&&v+}5xz{Kr_E9DH4ppe?OG$o z)e*_wVap#eZN<6rPnQ=K4f2|IqC&kapkz`ir^QFv%5$v;72(YD4%;>n3lNRXU6wW~UCxTXw zZVHFp42QxC)<+_{>px}1l+4nn$5As0$YZS!f5$_Nv%?2sk%l3PxV@q3X81C{i%U_p zp-OV`9<4C@@1H9QaFSkU7%?*SQ$iY4ggX_SoZ*N%T!sDf=VIx(_I+LWf z9769OBrN0L*Uxv$u_!g)f(VbXF3$b?GfiPzD}naEiz<}h6SaR$yp-8!8}8(ham?1v z?9-8#i4}8jS3Tm6+eYPKr+14FPI(w2CDOk539eS-Gc~$C(o+6AD``J4ycSz00-N2t zH}_n1G6=ph_3p~1@b=z;EsTvlyK`@DU@nrlW&hX9brtRtQni%b_0=}nYCf=kFbKkK zOX^7#na#8x#V-s9Dr-b8LrNn@!9#@KMWTe~>caa!>K1MP>hps>iNx-Al0(e)KVcpI zfM50^N%hCD%22iuKWqnSiXD{BVrCJR20`oQ#zVxDKM>W!1f(w!JbwnZjE;OR3(eIC z&_msA$_wx3gfddq6CpcO0>Q0K!v^6E!|>HHC6s8f53Dg}RwS%(IMSy*{e>;6 z)29?QKdA(D>85-7W&1(K79*tBppIs=6A60}y7YTSV?pULvrFYZJL#lg8oX2lYKmJhXt+7(`CZ-l|zm4|Q&=kd|ya zCFJ$bWtxEdsIPE>${P=-;5uz}4r|f`7AQ4&&FqZxB!sZ@5bzgSA(^hD$r$TI-E{4r zf<9*SZ0TvAq?p-q9;)xB6(mM#x}YLvc9>_?pw))-=@Whr_2n~CLTZtMHhZn0cv54qoe=txz7^iZQE$mzha+Us%s*wGZu$HWgCi-jpo00rTnRwM{Jg z!Gr%cQ8>$E+bfye*M7!s~}d$s#~pbfKC0(C7vLx^*H>Uc6*kazfkK)A=J0=FFlvXzhtyf z!$oRZVYV7&Y^mW|! zg8dZU{6LuZ9Std`g}QPi`5l-u$+Y_PZhi}4ihPEgPbcK&6TUa6(JZL#WjP)5?sh1S zrLiCZq(Fr~RpGC!#dYCH$k!5by9v=x#g>W8c5J7NRuMZ&efbpi1?%SC{!HVQ#D`t% zlwxNn0{uyx>SM2%r!8_+X$|i&7Qz-eRi8^@)Zemok%EKUb+!sQ%$Ye+d20u&Cz4Q_ zlr#;2Erh4S?ojObh)a27wHVDEFHQ^+$tjwcMJSji7ts` z$uI<(xYb4~gR;ncBN2O{YgL3m-RsqGzlYaT=`*?LosRt6`xt&VcjEXw(Z~Ey{(x39 zBI>yuymhV7p~HD1r%Lw^BO?dkkETyi6+a3XQ=InT(Mp zSdvr)WVeDxNpEzMaLzX;KE-N06Q?GPkKCg+?6QsfHvG0S&Q7a&R_9aXPo6mKf})%d zpy#2}X@W~dWvD-Xa_CIWaoRnvs~V@_?W(y}Md)BIRQg)LB5xA1l#DD5a^LV)*mY5D z`@`|c5SBO36v_d8>q?x0z zrc6CrkUK6&H=>_Y#l$ttRN&!ZqarMiUH8c&Hx zFZ7`9P{ZO8in&SDYi0=OoP6FE7q{C;DaRjT_?zPv@VHA!xTn_-@Imnvx#E%XxmdDW zIjvVaOIJYTI(g>-H#7SLUqAN9cEFWDZt#4yTR8tQLzhS%v!AxQ{>b;F)7t@W1wt-1 z%nV)c{4+LuZr_4@ZoA^+Q)wrr$mec~!@+GHoy}QmxFVWFem38(pvR1vde777QR~IX zS0aVk@lR3H+OT)~RsQxD%7_~$JVMc1cOQ)%R6~0BOwv*iUzqm6~mnd7;05sAh^Qa?l-4j zKA|)C!zcv$AxJW$OC|YKA=$4bmZA&AnniA}{K+EriWHGmX`VSKC5yw2Vfm4v=(1c6 zvu9Y`gaWsSR#xze*Y%pj5!Oz*>iNx*?ZYujF?{|h|AA9?O4cOx0%D`ll)ko}=Fl6Q zGRyz;li#N~b_{<%)7UlX@(zs=kM-TbhVwcQ3_Twp(mySaBEo+);Y@ebTx zf3-g^KTwh2RjzSwERj$HNg7*#@Z;cqo|uEfMA#Fy)UAyV4LySIVaf*>>I1ZYeZqI} z+@xY`DSqgSNM24^G4cXTy{~p5Sb$oC%bbpA5=>nGKI9>!g7~A`p}tj0`c~AmA?!qr8AQ5quZdP}@g#p@@?i!|i#Sk$a<`=($evfmI}>SuN%+E;%2 z_I3q#tA`m%)=w}Mq3dr;w~u0MwU4(7JA~hbsjNpDtz(2+Uwwz``y2W#4-o@Z?6+3- z4d#uB$bsu*TkR|jSwW-;>Vto}_Bww@F6zTBV|-5-RpbN7P9NJsRoQ z@yHJG+q~@t`MZiJe5AyG6vu`mVg)21G1dF~YsAv9ynJHD94(Rl`7qk#a zT<`LleAh~mY~2duBPPaj z=p81qTHsrM`|ELoCI#EXeaVr_8ZmS5Z%Ad)wf%$Zo4dr{w7Vx%=Wau^&g8@FP~FWV2lt@MCd$@1)XPjDk>PJ7}z9b`XLR!>r6-Fv|APyLb21em7FMk%a`u% z)0vY9jd9Zf#5Q!uq4+^h%5RRU`O;wC!)VxJj8q1G?{1ytVzQQKi{sw!TjJtpL*kFT z3#!Cl^7V^hX8n7VGGr=dkPi*|%balMS5T9-`hvD^vQ)UlY#n#^M%@SX^?E~z1U)li zNE~+{Z|WhFMicqm(wVCg$I@?Ime9Sk^!!=Y2l3MqPr@&m@&DY^8^_uI-b<5tlKwv2 z74e)qoMQ9xZ{eAyCaI0RgG&p~O3%bcKg=s@;x=H@>vqjt*w!m255CYZW`Tx2$l&Kl zjZv?Af3!GHuUz%wT@C7k>WAi;%68>qrpXH)3#F5T89KWrs% zb3+woQn75dA}Qc*d1eP%@S7l3;izYLK98J)q*MQFxrf3 zTW4@6U*!x@OWjNy+&Em`cQ)MMjzMi#dHQmTn~A@POvV(GcXTJlOhfzXJ}6rIcUhbnbvR&JOF>OE%5og1bZh5{e=+}N zAr@LV(D?T*<5dZQ@J^B6z>;QgujFBm&G$0hAlX!^*?{!1qH(rqr{MZ)QrhFNU9HO< zvXR=GeM|4`R&@eyYQ~y1qzkhf!p`k|;k=r82HJdS&7ywR=|+9;R?6>J4lgmXZ9~y@ zmS3OW{g`$`t{HLeBs0aV;d60a9*b?lQUb{!%Ga;{vk_+6BWoKSX*Ry1I4%aQbcAWiO-Z)wK zhwU2lcH~l;L}6Wj#gE;)PEC+SnH??BA4s%n6(-?MT~h<%i}4fEaiUy|u1zGHuIMAF z9j#f1AoL&_p=z*Fa zYmsX`gDFfl@0Q+dpc%&nSX>8$QmLY%QX4got_8J8Ga#bDx@@URd(9?q9ha>hBy7E86l^B#v~a`+kuPJha`6 zerDi{`;jqp;!T`;KlRD_1&vteA9?xjH;nwsf7}0d5O~L=G1tAIEy|~3!&Kz|ruK+@ z?b<*=vF2SR?gftH)b2CNjW3n_)^#tL-`dszPX#yMZFte`ck2GTvCjJou1^A`$|feL zm1^z+7s6D_gkuyJ6*z}w-XB}$PY!-ts`Xt$@H)Ex%Kza=I|UlzLy*-X2zecI^D3Z1+fiv2NF;bWN@Jv|~k6NupKA5BbRs z4flr32f#m^cV#TT2AHq+Zb=q?oinYOf)<+aaV805=@{_F4bmLrTKdZUC-#EcW;FEh zRk=Z4vSs-0G)2y*3W3@^j&a<>Ptp%mwvS&<{%Y<}ecU^+;Ao$)?8vV?SEhpO#%aU6 z4;r}g&sUBa=ME4bin5#UpE2n|R)5{~xQADq74^s~UP{2cNx47Gy)c+AUEw{vcrxrr z>d*%Z)vuMY_55uH4GgjQag&!mK9B@2OTo+8SA# zEm1qw)8y=-rR+#<=+zO`%|*H2M!8i<0~g_6a+PKGfzHQR+tNf=+~10mfy6Qs#;QxV z(snBfe#c|f-u-=5{#HuR7}`)~eDC5h>cCZ9A%a+t{`J3iovyB=M9mFaeE)Jr;JxwP zDCtCXn~Mf-PuvL+(3H;k*6X!s{te3`^Y+ftf)aauYGa_8`(oci9~(P?cab({FBNp1 zxr;85+|l)~V^1qnUkD1nxK?blezrL5hLyvglb#B0m)BTRbqktROsgHL4=9@AGH(kV z0+$SHv-Po+6+4cC_iva5AHRh?x-qD|<@+H1J#*oj;rBGbGS)eBo}VA`WfvXRlGCzY za*Ryi`m?MA1*F*1buZO?$au-2FI#0;`-l@MbysuW9F?puEq@38MUc&L=hs8G%M!5( zzqQ9NWfeJ|hdK)&a5b9`3q;RwkF9+>O;0Jh5?bp&*r%IW`nh@9HNBhmrmd{q8n4q( z-oQO)+I;4*PSs=H3SLLPj=@1SCvi!R#gQIa!HEf{m@5LQ4g1QKuW$QziNtxz)-FCR zh^sEtyrZEQNvB_hQhQuuv5-vnO1<#wDpI_mrPu0S!>GG2__k|wni zOLTe9ggiwIe*VsC)5&|m@uZf-(5`X(O0MNa?NQD~j`F1F=DdWLQPZK# z(HCr#!$fba$?jFqiiG0z%y!{(3;_-N@vp6PY?8gwnWhZ_g-vB&QQxv4P`x5C?&7Cy zBvw5l&1;#XZ>e0asK|SDS+?M$Bp+L<&ewt8rrO16)~e?X)+$TlF2cXX#)L#@WZwHM z$Z}j%c1gVJzW9~5vf72hH*WsmI-$j2-=yev`M3RL4@H(x-k8s3Ct{BKVKHihay)inExs&Od%Wpd{qYY5vo%+2JPq@O+_m|he`EXk)?F{n zk=9)4y@I2A^A;5wi+!J*#;2-d(t$ zOlZB@MSrW_fnkwx{iVCxuJkh|maSSJ4TZ`s@pAPV5%Xba&!(X%I6(I+{8Cmyotp^i$7Ddh9 zjSOU}PYAK-ukFrfjflj(H>gW93=T*R;;E9A%MEh+SS`s9j04c)@6P-sniMY5br=Q>mH_OW&G`?At=VKNI3ebh!FskLLwM>Fs=) zLorz_B44pRojGN}`A_k~GPS|%#z#Y!26zW@#CJc0E=kSX5sh4^ z_pU{M3@LO?b2a!?;mUK5pfw=%Nj+hFK+h-o@x$$-HcUM5T&ui@q!Qa>Jkt_?j`60) z7MkZVw>@X9H2tpIaL@(KIhABFKEF5_)~052(>B3|JETEb2i$@FuD+}xY%NZPpyhs7 zTi!ZcStq-thAw*dzL^KN%kgTn>-1Y?FCXVX>aF=e6<^;-EACq|zsyo>CU(*6#u@e_ z#;-*m4oGnSUYKYm-+xCIHnpa@UU`?pu0Qyud1+G06I>~${Z{Y%ziZc`ksVJSstAA^ zf5zvPmjUjeI|4IT zJvP?hKdU>Eawh4b`01H?Pi1^cf0E*-Pm?zqboM5%4KKTWa@WjWh}bA8+Jm_7kI||0 zbx7n>-_?ppna$7e<(D%|Qww_YzgK2|Dj&3fC#p?`+0k?D+h}&ots)_9ams21_~6Wt zxd?o~&a9Y5R7g=A)So{R)zg~}Ehq4Bp)x}TIdovmgzH?WSkh^(`CAc%aS*MDmvIK^ zWBVC~6n}lF=b{N0QjQ?hYn4qhUR*b#NH1m^MaUBHVjBHb1bZ>sjpBK~MP3WC4i`d~ z@+NLxw|$^jL~PD^F_|+~B*|{i0+L1Yc|Yf|c&~TNFha;bJq~$AqqnyrK{4;);?*+; z(Qz}c62v-}Y__?${7hDN4AoLe5nPxV!~Kp7(nPO;k(%MYZj4d;^Y2y}B%;Z8s->8N z=De!4&*CS~RhS&tJiQ)`%?{zvhq^2p>!W`3Zo&0&M6u5FHPmdc$!R}10#7SFAUzIY zvM;!$#9*8R2`;!x5)4uBHu&xCmVv+lFSnnqAw^f6owa1gMvvyP*u%3n z54pCz6PF<7a7PW(ix6{gUqo_pWRv=PUBqaDz`|C89!^oLvobMH(s42PjGr7fh2+ac z&jCaTKKY&EzDRww&fz|K;Js+f1vUKna8dG=TP8`USDOo!9Fi9Y(QN_0YFzj$Y(|JEA&d)^5E9*z*BhKoQtcHq zqNpw!iOt!U>;>~3TnFgVro#_R-#X(K**e1ZQlJ4vovdG>+AvjB3<=i6F&ga!DpD z)`6$)w=|A$UotZzD zD5oXq(2aV#${e3WOw+G>JQ1p&h7R5wEe>|ay#LlDg+5TwxpHj;@#Dg^x!htzHz`yq zQW!_cyexm;WMui%ZqI{*m_(%WssTSetC&MUBbUH}hAtDGav&A%inwEmR`Q+C4+U{n zwY!RmvaS&dxa3by)>`b*O$sB3?$NFgU39R#1DfQE7I7y2z=T{$>wN1^`JHx0HgE71Q?1TH)dLo@#+%lW#ka>&C(4d#1Q_USxmp~`b4#esu>Idi^c z48fZS(bJH#GTOYKGJz~tlV7ek74I_SsWMt{J`>6w3UKJGyztbqXvQx|D!-Vf{OuQ zMpLh8!~#|712PNxV5i?XksenJKDc@SVmyK{X~^@ZwU-N^nQNXXDU85nYx4-gKk57? zZmWVI3W`&G&AAxepGa#m^`{A+pKF91F1C4on}i{S3Dfx@*{Mvr@7mLfO`Is_(tZw* zPNT>8M24scLN~A>GB`NkoCE3ixrm#u*}aIPyzNo|HhTwMav-ITHE_#yPgwYu*XzyE zx^lvg)KUNikT@EKq?ZO$#Lde)^r^u2uwm$f9uF^|WrP^_3*dl89)SnFe~n!?g`&AhPefpF5FDh|`8yw? zt2u#C@XyDEbrJNHx+h}S@`jtgfHcmYLLWY+yG5LlbOY$*9lnsbC}A&}I1EG{~=#1Qa_CJ)=66Gnj|0ozPh&`3)C zgz%@C{?tLcU4y+MB=Gw=Q_i4m`IOaA4L1hdzP0&57xjbfe#JAn&L zbd#q^CDRk3=SL4V?d_D~W2$_BF6K#WcS z4&UA3+ppQ(;YYmyOw*Q%yoz%`_aq+jAsy|U)zBgGAY}7sB%J?WenU=5mcB&DLg{iE z&%x~C${c*+j@x5pxlOkSUeF?z+W3RF_g(m*z2B9u(fDz(d>nFfpeP;%v*J=hC|2*< z6BoGA(TS@3sP|C%HCiwr;xeX9=yS-cR777$1|cp{_K}^d-J^)(I17*gVJA?n!VlZu z5KQ=Fmxv1l1i?&=rrB_u&r`=fhgfaW`=?spBmY5Z47%2tb2bIt zoDL?-|H~%t4iRMF#u67eTE`1szJQL%29ktI10Fc^fgmf_lGCpNipk+5`H_wkqfVNW zTK9M4qjn}hg4j@sTf|uqHUdPUGZXZh-7qwC39xtPUy@NZ+rjc0iC}G$B~U(Al{q?S zzekkQIR8!hPsl%2MM>t@R}Q2>LSd3PV>DJS4^5H+1e!;G2MG;Ae+mivM<)y@Tvh8E z3Vd7t?L8nLfF9xSWhNGwW(H9PJy-%%qF=JS#!C>lgG(tDe9$3M7#b_@&_kL{^n27U z2)MQ7wA!TLFdV{!^X;U$QTPl{*#u(ZmK((ZEy$1gO#tQ4P8UNDwa^thpQmzMc}LNB zX~8$&)0{%!1FV2S3_!FQL4Tv2$2~~I%4xhM^du%E(o+chiIA@$!Z@Qu%rX(!A(Z|z z@ivv~5rq>i$v58{l1ShH8He$Jm_hzUwSxrWWA_h**?mM9dS(aE+(jyq2`33OX)6Da z4FhEDX#^cKI5WH=+(c*d!J|Oum|t8+q}-)l?zsvq0c558CN2~tI5i;MB2M5ia(R8t z$sh)ZhpXD?bOIT@bYKYT2!aNSA{<9UT|pTju61S;()s2wq@hGm1uUQn;MxDCJzTZr zGg+q5!`~^(f!5&#%3yvVL;&~lFqaRWOSq7T>JH(-K@>pHQ1UXMI?!(590d~V0q6!# zNwxSA!V6MKPXlLN;ROIlCQSoPvIVW9T?9l;_Fq^z!BprF2%n!q8!^#u84OiLP%$Lc z${hPd5w{3s+}VF`U1?f6=JL^#NF;E*SDCE^7!tpfP z??B{aUi}>k*!uX^wCyX}?|b@mFtlN$M$B^fg>W)6&mx)Z_L7P4wc3~)@d{R|C2Nka z7p0tSz;Ve8hj&FP%GWxibp1D7$>?)^p>I~t-iRNYyjo6=3UnghugB~Pxg%EFzG;l@ z=SP+(0};_WH1yLt%uON7*JGXvO}mjjz^qSTmJbkKFcS%81s76f?oxxnkr^<$KdLbn z4vriGL4czW-9tlQ$3BHD2xbI>86sc?3LHr;1X2)L0tYi@o}4Wm&K$=FoOL@sR^Ae? zkiII@694Jds&7ktz_GE8Cuf&+N)G=>jN}?3QY%zAuH`=8!x*l80;YPvLYctqC=ddW zyFggMc#AvA*4*UIp&>MJFEcNCFLMN}1AV=h*~x-eh?JgoYdwJvHd%89sBQ!APU97% ziy}+X0kCuc3b<{EymhEPMFLv$@j#0SXz_v&2m^)VK%&7qN$#jCf^@KR6AX-jts7W) z1^|);W}upfhFe;P9sij?CGBOxMDPk7%s@Es3e=OpQ~=P@te?+Lf`gs^F*IV5#)N{I+Sih@`UxC}HgwCUYIswCGqJ!C1%Rjs z2o6XJK*kHA9xw`nD$&3IFPO9ppzeVEbg+-S4MLQ#mnn1mkoq5NSr7(haPZo+TNpqb z#t%^I0I)3e^N9aYR{^J0f!ScN)E02q@7AFq3sO9pCCpr#AZ^n)!5 z!1b}KU+a}-ho-u>@2RU%;E%zXf+@5UV?Jq!z-u*F6V;8b)Ew;It#GcfB(8paIHQ1DK%+;T3$c zOH_OS|4b}$_zg>qEpl26gELE15;8WGjQpz|Td~*sTHda9j&Uy=mte9={%^<8tt9|= zg@K6?U@{pXO9tJ+lkD^lb_ZxSLcqchKr0I5ArL`;TJjss z`ajf7ph&ksCC$fx@cio-{~SLL9KSRz(*OUfs*wLo_<=0W12F%Jatp)~4gx^?m#EWt zlm8e_{nyWRLCj>q>P0|YfXo9FjjQovN^g_stMLlatK;Am^y0CzZk%JYC6Xg&4fnIE z!FgmhxOMU8!0v;wv&)(#3g2K#|1sJLm@ot;-GPJvxeO!*jM>#g;{Gd|KJexSkO**K z32Z9>o3X&zgm1La|C+(S_5?bs2S0Ec^ns330P!W@__1lo|J!gnOT3Owu_;m)Iaq5{ zJ4&FGi_d!47>;qUnj$(QTNfFpzPs|SbtySQqh}-a$xojJUo)1XiWAY6#nS5md?PsN76O&l_L~a{f2G)9!rDo~h zDcf0Hup!w4x5`Fc%-ClV1s5i@VwF(odb=>?w=3XHx+kjsPOc5I+jK(1LK5_;9Ts%x0gMhvqt!qLb#nCXRz8S zIUaMZm?k5pTU_I}C|5+y?8Uoy7<)IKGNS*m)J8Bmhrd3D9g!AtKFG72GRt7mx41Ye zc)oG@Ggq9a=-UWWPYvdtCzwJgHGB79XkD`Wi`M`ZM`x+Qt*a|YRUm3JtsMefp-JFvKzT=8F6cRVtgU9kI#y?A{P@+4<9qLfzyr&_Ek+)>^bR^ zVQ#PVZ>mg6F)!4Vu9dKnL-;c;P8$2)YA;Li89vV}UdY6K3sT#*?}VB;-^hGuv<2V2 zs@BhV<;+BklH4xU=&Fja!^eq8igH_(@%|2v>bTKy`S633n&w&|Zi*-G8apGm6!chv z*R*E$_Kc%{0TYW%tTl|~R`QaqV=e2A6A9{ZTHR+}E%B6#Z;S&w`){>iw^xKQoPT20=prlp!C#=f6xVm3JW z0hhtChXWdAeXWk_#t!@BKa()dGLzkFnwBB_7!ec8e((IQHkZk=<;AGxIg?4MghWHX z2_Bn*?f7N`H?+ER>+HCp)o!Oxo>cGH`84FIqs7TWLuXT&E`cZs;yc!(;a za%KSEi#7r3s55e_y>w}QbbX`jY7}W0I2+9H5X#w0mwda@!8Rl!y(!LZZnHC&p=Y^& z#Pmkjvr)DpC*2;FS5~HTRobWNZzz8UvCNMk@3n|;Hw&YdR*Byu?M3dmi{K~_ zZZ#1+QA0c1Duu|shTh1#?ZUctQTy)&@^bIg55k<^t@fG|i%jS7e;J=0sUX-lUoNdf z=P3#=kA039PM3+wi*=hWV3-qXI(|-KsB=ZsT577`*Rzgb`{TXa7?py?{^rj^+Qkt? z(ys%(k4{ayZ#~#|y=bP+a4XJUX7kqkYkPLpH;^>o?_{UZc#%_ShJA?h=NEdsX5C@% z9KGGSY2ig^+0NDwI^e11ISk>I(0E{%es)=i&}rz8zRpK2!?39e+Bq{R6w|Hb+u3D~ zsx#iT6io7!kDAZ?zX*8e|H|=vE&cY?E4W|Qj{jF>259{p(s2QiZRv>k( ztk@@ttVu92^q`NvD{~+O+fu|7C!ZqQG-ZRWN=eKm^;=DsKl&rsYt@+sMfp@Q%M6>Za05Ciryl0{*6n;B?k{7k8hT~4H&DAQdi8S`vJh&m^qncOddz8;= z%AwN!K&jWtPV&CH`zFN+*mXI`l- z)fR*}WyC)a>mX-*ryJ4TF{dEn|I@$|dT^PM5>}hw^107n~pY@zg8UMqB zE0qy(JIJZpnm_xxqoI?G<)VNFGwy(zlA6E(GY+o)`Rm}ECu`fYC?6STJ8HBNBy={Y zC#M<%nYPhAPp_E(jconB_G_EI&9a#{{>FB>g0kQLpreBukulYU&OI4V8m!AlGTYA2 zxo_PIc05&Wwh;&c>Ej5CQEB9IfSfo&4xMl9(dC+8Q<@?dcbLpFh9g^}J*A8)X5M$n zvjk41F@xSE=X1)1*qv#!abwC!cik@Zt$%edao19Noq6}t4l%aQT^~QN9#pTw-(Xf9Uzi#lo12dEfL29T*-MFx&5u^1vC>G!4P(D3(g&R9PiUf- z0M$Vw(AT1WCE+8RkFg<{BPqq{BO<5h;N~ zAv?dPksIpk!kqboGuQ0RTx^ql2}OJ}$KwYpadB(L4C zgl6(_xLo0Ksm*gcva900{pdTqC8PR29*)VJxPzsG9p&`SQdoo2a@ zVXx-JG;OHNy(^Qc3=n4)c}{w+Rd}_7)*j;W`M$07b(Oq8?qs9x&_?00@IEJhJA=+= zw7*f-C%?HpU0^jW$DSQ)T=G+Pj#S;|`>T)dUaF;FSEf-D`{unutJ006;E$*{RV9b~ z;=3lb{V1_Nfqi=$=TQ1MkGN1JJy-nFa9_vzWC}c0ag7`c-`#Pj5vnr@pIrBlsCEA-z zp(nk{r-yP2YExZY4pyV5`+ROEQL3T>tcFOXuP=WbWfsIgJ_${i^7Od0HDNPH)i1Q6 zsLL0e=;!F&hTnJyYbqxM6fxXu3CSH3dY{ag)i^h%uE8(Ivydg-xZJh=CO1GwivDZ; zG~}+&sc%w$pATK05;>XR624Ror8u3YDCW%%|7f9dU`B?d+%>-wuoS>M$YSG_}E zv+LfsrBJhPwF13kGNf7Lc*f>k^x?`SB1r*y`>i6`69*kEVNVn0AL%#!5pR1W;F!bw z4GZ=A<6^PDzkCY&Tm>OmeeCeLxzE_(P1D;hM2TAS`ktxJxokfi{rI8H7GE8&Q=xb?j+ zVD4CCS3Z&8@JX}#`5FIyZH5FjC2@Ck#F;V0d^VO%Z(~c|hp$w>iA~quk)m$^m-*@w zlZ(H%s+|qmRm44mg-9~rpfysKi#;Fn3~QhdtDs=e*lg^algvZfkIs9glW2~>&}b@ zcg54q+FY0cu|4V-yuN$9wmDI~qMNAP^tqNF*NvN+sZ6pt>ln?UUqXCDi&nmk%Ff*d z@tg*C#ZN~x4!AzNTC5apFt!1p9_ri0zdm7F{~tl!OMNZaV|!K~Nv_*>0yN>e{hvn? z)msyZ-f9_J+QomO{=hMzUC+Fw_C=?$tM(+k!{0f19T?VYdOPducwD#PI_-F*UG2xc z$cI00s(qwhPh8(U-Z&W)HDBX&rExAOueP7~^QOMyv6?uCvk4 zPI&F{To6WoY42Zmz@Aq3K}({#yB)T8QnmLh)19JnpdD<*v+E$?R3R|>Fy@Kn2?aY6>@aTk>17;Co7po#q``^)*@+>n3A7ZV`^nC>YR>2q1{ z%q21b^w-YwwsiUP=F5x~RX{gUH{DNg&&uoeldAZBQiZs!T;Td)&V9|L3N@Yv`soF3 z0q5l{*(8?K3TzxRuBpN2kY8NjWjj>D4r>K=w>H)G7s$PGxdTM$KAK5-*qGZ@1Af@r7a zv!5U2*3j*QEya6P(ZJrNn**xB-RA#(#-(65hSt1-N^S~De4n`fFSmzz|`5;&&Yl*8Ot|7 z1%1~5xAHhIOVKXG*9c^ZxhAwcG0$q$mv@q?&WWZ6KnWsG?r~_Uq^Ey&c-tSx&{5P) zM)pSNGGlcY)HB|=z^%BFu4m*0e?P!2qNH>eubt$47t;2I_)Qdbmv;xG?s66KlhoR- zxl~U1`GAyD1RqY*Ba{fKs!^aqT~|}3Dg_mR<;5PgfW)*ZgeeiI5;o{8!oG4=`ccNp zf4DAX%(|Xepto(ySUsf9O_-uU8!rMDFD7iWinLJ9Ev|t6Ao4snVJII?KF_WAFfZ>c zCTxpJSisRMI)}MFUd}QEZhGzeCe=h!?>dVJ>(yK~wgI(x51*H{JH^w44PFEL6M$Xm zvPQvcGw7N3=a29>D$>Z_e4+gmP zbpY>x=CwC&QR&MH^uGLBEsM`n=^vh$H;8lq`5!3I))oT#aw*X5YEe%e=lTY>u>J2o zigdM-Fm*p3J8nqwp6734?55~27zn@z*@2WzsDIJh)c8+Vaqn}%*M%aIh zd;Z7%OJ$PR`?-Z@+gYj#8&1gpw<70w#R&Xn)?5O=$IeJvcUd|&FN>zrIpiUDuDLGh zi}1RnjMb@m?Rot|moHEGwNkdbsprPp@sbXm?9^1dKFjeBs>Ne`R8qEA1 zm2_fI#kL&En!m?_Q7U=wj}_p%&{%tnIc^FYg({&NcaSTe$LAm zD^T{@0>TP3vtwBa(8vP9q+hmRV}l=PldAP30d#4f@&?EI$0h#wgk22B`0|jD3(A+( z13k&P4~(nn+n4Bka;^o&)%2XE*zlVa-l+C#&e{jW`hB*PO$+So(~`dt4ce4RW``fl zj_yABETTfI&>=LRP5QZIxM9Q&1z>i3cxKcV^{YW?i~7Z&gu#TCXCs|_4)v2ikQK1J zz+?UaR{XtqfE-WD7#TO+H;_&b|qyv9Y2|NDs%A&S z9g~C&>AC@K8CysdEHCsJTc8TtjP;$4_5J$4Nmd|EfeY@0o517$Caf@AP%ik*;YBf& z8w8BF;7;@KgqSf&+ArrJyi5Xy@`j;8*>*QHHY=bb&lb8yN(LCm-|OB7suDB&`+jbr z?tuJ0u6ga+)7)x8_(PsQ!3+Z^+1SS@FOvSCoG)DpTaMo&I6^D7x@cIG4Eb|FAJV4TFP6e?axOH8a_7eYJb>Xi_V*6QwFe`MTgNw+yLI-DxBy#I6GH z8rdW^xK*Y1ZJ9xnj(&!`payx+1zxU{D%4yG^k@v{xD;ng`W-#sOD+FU4^Y2JR)kz|rTR@+A#CjJGwE%^NZ(_ZqldfFZ7~S1Z|n2_mvrExv%*!P~<0fI(^17%&_qeR2lChoaT@C z!VZn|h3&Y+7nX1TqF4IDQv9d*J*dKSebf!?p?hJ)_5G5zNS>K1*3y55Tam+3XOA47 z5CbruGeYX1h=;oeRy?Fa8`2J>AplpU=#M7-128YS?AiDg-z$DoLg!EVW{(jvcR*%1&uXXFgsywDy)I4gbw7(Aq;uy-t)ZG zcn4@_h8Z3x0eWp8w+dW9S%w*otAxcpk}qvnp{IU`>#w8ChVQg|`znXGkql@p2B=EG zFUq!)&IrG3+0Rv|LKzoj37i|Q5%=~!&aF2p^jY@ zEpEba&tX@^T7{4*uL~HiMi8(nr1|HWvyMx~W7wiWAHMDcB5=}IKpu5TSYP8}aw?=UKGCrb#zEPiK z&h;tVqY}M15BFUiv74uGW#C&{^jw20`e;a@Y-vXH{4#g+f~MLl?;_I9@Ox>4#QooR zPReG;H&H$_3X#uEvtQ3AGM;T7?!V7|vsd~ZuW*5G%tBqWy#rjvb4V99PXYaTRoE)4 zir<9B9jc`F2*-gJ-Si5S^>U!R9bgwL)hKv9bSSCPRp+>M0NZ6|McV<^!GE|Z&ZBeU z!f0HZX5W5_TPawoQJ@XwtdV{C{T*ZW$(#@Rulu;QTqW$GY{Cwy(D#>%To-eC1{#fv zT=2{#=SJngZf&aFr4aHaIco zUN^nPY5S|eenq; z>IY!I7I>ZV>HBQtzrW(#7jXmq$!X~yDR#jP@iSasT|#0B4T7E8G_g0`r?^#@Pnc0i zV#ScRGyr71h^a%`;l!cUZGkGp#W&7#>jgo>a_!dh+%lf4sUoK*SGP#&ixiI7ao4$AgazhgQVmENEu)u|C8u;@=&(*a6Yo0}7fgG==dJ1VI zLD0Llsx;Yvdc4#>kSF~M@=1Vl&L>0%k7P&VcN11zAY+W<-;#6M31&y2HvGQPc>zXmTDAwtd7IJf{;#%L;*^+-R!M7GF$Qy8^Aa&coVNvCeL-AUI~NIa#A? zeM+GyZ~Pa+%GyPOw*Gcl%Aw{g5`!GCr`S&#cW9tnZo(`LS`n6>KFh7HQjI2)D#bP3 zfaj2neD>C8(!np}!Ec}C7Gy)K&qWw_&*|$bBtzx|&=b$z7VRp5-SJ6;b^a&Nu6ZDA z##>Kwt7{%%{wydzr@3r7ry@JK{+8&=pG&$$CO})~+FOJUnXD#^ot4jjuE4IUy|v7* zjmn@cs$92-Cn)$L{lVwlYMFHNbuT@lP&_M13ySP}&v6ST12ZO)SfW9bc)wD{*G*^K zQc7Do5)Fa10?q_|%(Dwnznn)H>h$-2i^RG)-xgm*f#PrFo2htJO~k7%0T6M48knAJ059@JVau5ZY(}5l59}l2f-=$H4{KH+ z{c@%CD`Iy?`gM);J5K|>$ptsm?c%z?-FAt)?JlSc6cL8&pOH)077t<9xJVS`>`o2D zUIZSPK!2FSI!&fm|RO@pg@_R zxj(E~(FCyc#0Om8u1@WNlU%QN`uQ-WbEMIilfzv9ALsey?90#dy-fOxQ`|a?=e8E; z-EL^@d>VueH431shwy)OL`H7`(9eB_JisSp^pYGBRdXO3*hL1FT`&j-NL3tpO$vt# zh@ibkU7#1cNF!*V7iW>ib`^AE3#l^ItV)450FB>s=;S3d@{{Z_G;;Z=u{2WHFQ9mq zu|?=trGHDULKTr?qkd-*o%WSa&g z%|u;}DA0y&Chi2gO@L6s}JdzG#@N>_Na1My#*r9%74*m-$O=;} zs63jwfy1IG1HZ+=?UKWRob4xuG8D2mKP}ANnd`d79ZF#{Ft) z+`N%-lM3h$h0@xDE^X6tp6j@t<|k?f118XH#;vmmKPq83mf5modB6Z#k~JDz9}=}c zLM(e3G8ivb!%4T z(txCgu{Bf7my%k6T`S-vPw4Gi0D41D<;u0!axh2QtEOE+rM*1Q-gS~&hj#jVjwztu?dTGSqv`m`=PANB^5a4h-7Vy0DJxg? za_bDz;wwx~Kj*%~8rVlP&5mmsc2aZMR|8>h&mn9(xOz4tJ(@ydodB^;O|x%5!+rPV zn4T_x7|LoHV0N_o3HxCm_vPHua!DKs>T=#GB4%e>$~Qcqxq_(};ImqW6Z@+QpUL@U z8PN-Gsq~!Ywv#`AnDmoQaBT0>>_<*<>&%TJ|El9mX(l~W4Q$2dj;~!oS!gyDKCQPD zT6B_I|0@Gpx6x|nG1$Ov$uxYF>T4l~VeE&-~68D7^T?HHZ235!2T*c^Zl zj4+86YtZw|5ZC8UGCfI=gC%8J8RJ#GC;kHxBQ7Xw$S1MEw_HMYM}0E@X85fhZY7>X z_${)H9MfZ+FCy0?#8M>+QmX$8SgF7Wb~!1Q1rDf{i4C%LtWb6-;E z#t`fhI+a-abN{PH>g71sHW4#8H8|sQ>1W!}$E`!}D>v*wS;9kNsr|=2d*g)EIl)KR zfQI^Xo~;7ndx1@$dXL1nsX+ms+SK4=r_bLwea267z1~A&`-gbt>Jp&RFR2Ejz1%WB z=M~jGGH!E7gIj+n=qo|JK=|?y*ZzLYN831?uCS$SOZRc5{0{=Z?uJwh*EaBaDCe2c zMg0hq?kMuof9~TJnE>Ve8U)Xtlswo}pe+|n558aC=fFI|_ub>-3Nt}paZ<+LA>BIt zxzu6(!@PB^;baCYeqxoai%^eEJ zxcC&U+@Qd^uYAs}4eD3L*hc-;RDJs=;S-;8t2qJG*m*To6Kldp@%K)J8aro-_g(mV zi%Qj3n#1)FdC(}ih93HyTgH|d^p~f&RTr8`>)v;9<3_WSs(0+;Ut@L;IX3`BMu-hz=Hhd);^oLqhS`KD7Wv_W)BIplQIJuG)65f<4 z%G!XCm6V=&6G2bS^Q)=(&l=5fsB+ecYkC6Z#CPV8yqlF;)6T1D68EqEYTAi^Q~SAd zCjHde*JAuD<$=~3#SB}=Q^@M&oSXe#Li+`<~AyBQcl+ zbsy;~4ZopEId)QyjHw>beD=gs+!_#hx-u38>7}U>*5-yQH|zweo#K|+vSd&>#jStE zckY_O;m;*qP0xRI=)<oju!p;gx<7Q#glXk{Z;iD_CZ#c;AIP(7$wo zTkRpB*d9)-dTyT^C~xq8Fr-PFpyGu&qj_HWm&xppXT-;}f%^9|N?No{;)Dt`*nGZwHply(OB^ih`-WUOFaXBFlz4LzhN$Gz=-r0itc`Gn6r=ps<0Tpzn6$P7~R2t(spueJl-gK+dXm~(> zKn1<2NNMzEf!oS`J7t>z}xhJ(ioo%`a%Wtrj1IYAIE)HY218)>(~zI=AFm5 zWjv^?D8u$2DvdkNbG>uoEm2(GAC7UW?va`miWg?rJ)*4m0)SV@`R%o0uN07ScL0h# zO#nULbAjISfH7yupOwb;9MG4<<=U6Ls5B~9fL{Md&596AomKycvI1N{QU6K7g>i~o z5f5RJ9B9Sy&(Bk7msTY7PYukDg?&=?i37AHCf^dpcd2tYJ?O|qB|!an4z~k~-%S{t zY56#>{4xNnlk5j%98TlaJBE9AWO%rI}g;OqzLIXTC;Rg-Ck<3B+B zm}Y9E9zD%|;W)Rt-co71 z0%e_=OFZkU1?K;pTV1t8_{I{?e(k!>M@ei~AGZ)T5bjM6us?I|I$((IN#}<`}Sp-;oqgj+K!c}QaL5Bj*)xKvH5~Br{o8zm|L&?`_Ba}F59F+-)pMr zS?^h2nEEF1gK@bf8KA#=9C1wzp4GHqiw0#|^GOV8&)KHJ>&_-+PAckA14Y1ocvR>^ z>!f~!I=k2Y;|XqUMcwEvakbjIKx7h~EBZtoDc_!Vj9a-Ecx8OAa3*bHiF-;mZuSrsA}UR<5%9fZ+=qSOcY!ZYraPQ(6PhoGG#=X- zzk-;AmwbCPe){cK-Z?63F{GdKh_ATd^7e&PtR}9h#mPrY*KuA@VBMZXEfaZZOR_}l z3i2S%v!WlXBvz9Nt^Q1CEdf%s1GA$SWv$1HHY!VvL45zc6WnTc1C6LqE@clh9Pt0G z@Z8s7qw#eT3jk!tA6$TcgPjk$WBAPm*=M*pm20|W;TZl2SAjnHIMOi1MtHliiLCd! z&5i=M8TMzwl|~`N9=hGTaZb~l8#CWhXhBk;_p6y}H$9#iU9J|aeQ7SRO^;_qH$6Tf zdZZHAdnj}C*G6%TowI>me}Y@)EVZh0Hesm8C4}BIP1uic-?p9L)*LXy=3K%qBvo2a zy07rrBa)6BsU(a{hPE9li8X^!iE9KX2pV69*p95_6-EhR-3=<0c{iEDhJ$OuvwQ!9 z(Cvef$-<7a?h-rBdSS=e)qS^P$9YZilb4ThYr|cWX&&kwIi{ymnqCoTAs1X(ADR%m ztA|@{lb}51pZM)$&<`I$-j^3V-@hn&cs8(sque^8fqi&3VckftwIVS-!rTbGylD!B z_cG}%$GEi=z>7MWp-!pTsxI%qJ;AxUQTOm?Eyg{c;n*;a%m()9F>W21O_=bRzo!Ua zUId`rSRiAYj0F>7xDN>})5d)OXz3_8#;sO)?R;>;5T2Xo%3Qypq3`BPB=LX+?k3>94`*@8R+NotPr(z0@nv8-m$1M1ZF1@?;<3))CHq zogV>3y}A(Te~5CRMuOxU5aoSxi`b31K+4qJrL8inLq)ZdL@$2T^x^Iem{djgu8s z&~G}*txnFjB~}9sw9gW{^&h+C98PoYTkj#U++kjc&;R+z*tTb7ypbcv{Y}=yxSlXr zQ@0+bL2i1ES*mVaN+(L`;t0pA6j&rML zm35Z#?fGOLo40&HOvHw3KKoyfaI4J?S1zju`Wfdw!E1#5La_sPkSb`ung;quW0lk6 zk_XdZVI=RcQsO{*j89z#=<8L&&IzAiuHAl^TRSq4r%C@}PLC7E>5_4rO)B)XYoOPw z@By|9xnQ@}BlUIApw(~#J#|#_eWZtm3i>iP?2fpBE>rV9=+|7){&|X%%cs!yj?21G zC=*ZZ7BvT2!7E_BRmP{GJnyr=dN>WPDlg6D`_+-OT)q+c_+5vVzdlATPT!Zani5R6 z!FAp)_b6Zea;1?i>QwGZtX61XMh2xvL@rKwJaa)5X<#WP4`hHvB+Zpt)M@Dk(J-DwO-BP!36@=#Q&_vF)Yu@gD8k6qC)4#`fa4-8WI0n zd0M<{g)EsnI-F zq*dxd5-S1qI{|1ZL>XRDvMNy~Ut&5jHth;^19(ek>@1weGbBtG}*5R_`q|?fR>J@jyS$nb+EGTcO+)sB5HnoXTZ0q5Zf$w@UU}h z7R`s}3*$}Fb}{|1q-ozhF71p%T3&E_wzPE`a|tU3=mXRA{J~=u8XlQXX%rHct4m+x zU%R>0E#y6+i)@P^41d=vs2HhASNX zY>wpbWdiooWcRO0KQ1e9)=@ZxM7t`1btR?j_mZ=ou1aAC5$j26g+UxEFqkWJtiEnZ z69zQJ9-OCAwN%(;gm2*MN4RzFk?D(9=aZO-TbfPSxnD!fH&3B8V201!J|W5$1H14o zVCPr+gpIR1$t?jd!dB!HYx?q0Zmo9w=qMWm{8Q=gyHoyjpZ#VRxAHY86Y|SeH@!!N z@=`z0ga*N>h@WY3RE5sm*7OQHjLiS@jf+E2K%abA`1ismySepa&V4WS@^X~Z3bRa4 zGv~g?T&AaKydQeOKk`HW>5>`&xThkH=R%G{pVZ(DN4Z4=9Tz&owm{Am^!lR$Ui;4a zHWecLqYhqqIHh~%1(9ElkI#bhvexVw&V6D(+htsxqJFtjA&X+o0OiWUMX2A0H!Dyk z>QXyrEb3CfEa7%Vx0J=x>ye4N&6lZZXQb6U7-&$0Ja$%7>_aN_30jc3sc;EEUwTcu z?ZY7QeYZ~nHmGSf|0iHWn#-P1L>?n<&`AMd;3CnL$Zy=h+6(3HNAY(yFc}Z-wTq89 zw*QA}R={`jJtD{P5oJZHCa3T{K3x;7cLA%b2RaX=Z@2CVC5rPn*Uc>>3@m;NVI&J$ zlcF9-o-OS&Q-e;uGyC0P;rkA@yP@om>g$OB=&5%IFYSGJE^R@?xJ;)dkY*%zx*3`i^{=?iV z05cqM6ZR?c-E6`R97%)kadrEM3-r6Yxs}@68P1%3E8?Q$xL^I8Th$sgzU{et2<5pQ z(tq2w#mUV}&6(l8-HZCq|2aLVZMx?W=RTRg=e2*-H#$e$U&NpMVcv%CN9*qt1jq92 z_byv65pgCRzJ&Z%>f|FkuylrJL=(@tqx~7sit=?NL)3<(50?N%7(@7aWD=}pTAtlM z8`vRrYEPC5`U~|}Q*4iIjY+U}y9zy;D&w|Ccy{$zo^5KNySusN*9fc0FvA;ET^-VB7j#d)u&e`ijj=euQWK)Su;Y8Q##yaopG z`@Zopj~a;jz5klzR>TEmhKIyfmzm)$0Naqxgtisaz?pIy=#p~pvq!mQXi$!@wMy!S zcAg(-y-HZf1+;#Wx^}y&_H0o=$Gug4Lt@n~Xlw`2>j27d{{}esDGLeP%y}Ea=5q;d z5zZ@Q?SWC+XdQL-Gc9kKug==-lJ?i|*xFBusO^@51BAWj6J9PDDP%fm~O)0%#WS}Ag`Kk zVB&Wzw1%L$13-PcI1Bnv77=z|5oa=8#F>~f7PSp&H{3Lpn)$%s^(Q(|$0eR^r`x}F z=yY>FVe!2ePuHoL(Rf93M`XD5G->|ubkpNm(fH1;(?$rG|B4sF5%{+Uji(`Is%F@j zrB)d;2~)D33^zSKAqoJm8Z&{#HF(vSB<3gN2$<4bXoMkVW)nsL+S(t_rIU}yy5J~J z?RY$wu0~xBpj^&-nwYnU5mO?{&Kp4{w=4O$A!b zNkrVu@Zm9TRSMfK>IFz^rB7+Fi(5tsFprZrjk=-W%@0kb6S_nUSFk-(>WC+fNSrTC z`~Il&J?e=M9~OD_F=J;b{r+KD?$s4rqC|#Eaf- z$Sd=~?C>d2W|T9Y|BZ&N0q%EN}g#z!8uA$y^CGK$vVS72>)dtXOPK8$U ziFwg3m*(CPuZl|VTV6YPBFo-fx0Ll{$gkigfJrJw&03$%2 z3qe)|K+~%sm{I}o_^Tl(r~vrUt0B0f0^pHXL-5TCfQMfVfl&dl^wkjfD*#r#8iFrZ z06g~UYByoVbYPF+d6{NM6R5|L-x3un&TDQO7xH$IfX6*?ZbkB-OvFfy%SrhQfW8@E zT?AlV;6I9lY@VGIx&gyA)d95O`@mEA6xUgbu#gWi&`1oF2P$B>#{(J&d2mj5Dn>Ea zW}UL`q|o`#JGq2ea6_E~d+`zpd;fi0zJn4dPqp9VwEs8&IHaSJQVK7;+_Ku3$6L%X+h;8sPX2 z0DTANQoi0cSJdeHYTs^7<*H>B(zoN>Qaz5|^p-}Ui(BoS zZ-dBOI)E_nC@_F+;m)lZ6*->ElvulBhQFT__Y}k)>XtEZs8d~qvRo&x#B=<#WQzF0_~I?Andoasr( zI6TL$ye{A>qCe|GdLhoJH}J!0G!*AnkaORKw*(E4u-ThS;k!ljwN4rP8ac*WV*u-_ zwiXH7*0C~0y4 zI5PJKrU}|tmf%+YUM_UBKgGFa%Dn#IerHeG0M@m=>Y@*OfTeg`E%E>l#LOhGNY$;C z_~@c1lJYxji_ecHMXdPjsa@PcoD;sEb=T3q z9O9O-U{NfRlzyDm7bQI5|8+U0=dNSi8syyf(ILrCUI$pW=ko%=QX3-FBty zPyG$5(6xm=x>cnpzpYfDH(u%3o$k(-@vmk}N9U0V(R~RS>s;suiSrLlr}0`~ph*3cT-*DdIe{{#LbN$JlP($8=H8Ju zM7EjsMS9n`Hs2U&vrxAA?sWRKacypM=36`N`GPpN+VX|pVjVm)UDP)a|C`fAT>MC^ z@fEVBPvw!ZI9U)zhrjCK9EwqHP6mz+koc!bW*mH_m~y6n03<_Tu_+sC+- zcy>_~>1Dpz(t-1vo8(sf$qCV#9^RU8=%J20;da8R+x6xYaV5 zFk{oaF>?;&nBjjq#x3&zsR9+s;aNDFr&An_KQwyul0q zQ@p|J;$+ZptFXRMd7-34Cm)bO-l9G2g|fzR1x zzCT(_125;&Y0mdgW4ocz?{Dvs-~SsvKgTQaS@Qg4)~x$!;I>?v?ew!8Y3(2{f4yTq zdjnuwTgyy(?yEk!ryh2HGsEm?7k;Tcr-o&&{cM-?55TTXg}*?(MkS1GRcO3Hp@T;< zqJg(nx;2h)ce8*yl3{i%Nl4ocexG*oKN)iKo_?HPm)2=@24`B8fCl3FKZK$J}<6$c8{&UHWnUJ z{^FEPY)qVbwJL3C^3F77xS{o>5}+)p(DwSPX&#szMJT6M0y7<(nK?=Fz|{)qH)bGg z<=Zbg_SlD?AcI41DRe5B9o1T1Pas3u)xHeiMSgg?I}M*J3HweDw=QU4FLvx|xbC+T zBHpEKngVUIezVML7WKr{>OF|7pK|Uyz(k31h*oY>1UcZ=1fuC<4%k^q$r0JF4qwW?`Y>3hHhI$1e;aG4uufB@~~ z+_&X1V-VL~(;lh{EHC!dw5wHbId)qaPbklB?{R6jTA2y7tpr3J&@GPr7GWa=6Tmsb z#J0=9MBEMf%0t}3eNU$CZ$OhZb8(OVdRXF1IhY-FDq#^f?5+mrSv0`)RgXP9h}&$KQ|nkM4+k;n3yo68!sj4?g{O+K<17EbFtse-D}B zBC){ot3*xt8pPfCvL>;SmbY9C%TGrpr`_@8+%1~Aw;}C*i=Z(k*Gt~@HK1u@?r_-T zhDQGc(2X#u+LSHpaz?VUD%(}4taHoUJYz0l9Y{y!5*7e6eD@(4vz&o+(+!oICPCxo zVXngzArnZrs~sy7#IFSX)6ej`;#o!*s(fIEjf^Q3*k>vq>MOX1VNw;(m{PGf1IqB- znNpeSDe6sk$~mn5j9bGfn_l3eP19%G8j5pET}9T{-36i^-#z&LJTDjXiPtjhHz0CS zrit;Dq1wtgE3U-7{7Br*TI@;94Pd&b5+L}f0_C{2_z>4qYyZusat^6EPdUV`KMB28 z3I4^=J%7ffOklW4tau8DT%H^abdf70YM?-4U_kacP^!?BT_oDct@>ZpRMp+3P^3%O z;hqoha-6#YSIw#mLsebBPwaP~pX=bdO3e2K&V9vRXly>s^@at6B~@s}zUxAS)jvjJ zzyDO&GG*PBG*~iE*H+ZINetUozy33B{Tq(^E2T>GahF1IZY`bMT7|fp_Pu|& zwsIRjOPgQwMLEBki=*>9f^Fs!miHOA)?KFWrFgE+Ue%r80v7!zd==(o)AQYQ*+S$` zI(K7aU9N7h8mw1fTWB=CBPj2@$#P<96yX^CCAz)Tt7Qf zOFrNJa+}e|p{j)}8|517Wk7ND$ZvjoMOV|;vk^W_H zk!U{uvufNuu1+3Xk#65kc z8`wi`V0GCb?lKu)m;AEp_?8-dP1NgAY*3(8Il3seBU{Q|rUq?Bcr+LLp#;!Jwy5-P zpUOQj?izjf;isc}aO1GNpOyf$b{^u^h7izAYQCtQk83%2h+Et9fsMbbv;K*iXpIYG zu6RAr5&&kjDABrbs>Y7gO*W~}6FSdz^9eHe--o0pv%I4_@x-@2r~xE`Pt z`{z^p4A!a2 z#(-bep?XgNz0M6+s+!rc>~XR_u!^i-`6;)sZObGQji|s3RoSRM1JUMe!jv3f69ByP zfw0x8#G8QhcSMN`qQcLa@E2?Yhies5nPc#Cd>?bGUB}8EgS{qr_FMC#rz{ z&p_CAPc%HtCeeSH2GKP+gx!|~>}#K1D)TfLKtI3a9ulE5Y#Vd$ zvZmUpn7ol%?#{g=oKJ`vZW;SxxJmSRfZpU*g>E^0o$#mq;E;@S#CP#0-NJu{?eTqQ zC1El~QCW*{ZpeErKEQcm`-eW0GIX6vqS&TMg=qXn=U&`3&?t057tr{P(nmT6%rL?N z>L~Fi7erf6Ungo~p#HL<1*pvVDHL&biw?=S<2dS_Pc9U>m$HV9*S_mBZlSK0cy?hF z=}119VK12B8HyQR0?_jtai+zd;sR(iU7*LGTonCZ2e{>TK{R)85E;@r1E zEuJ+f{!X8DR{VuoXOM?IxgdH*F~g}mJUk2BSCLP*RTZ_oL!i(}haA5oK$)zIIMr_3 zFQ3WW6_elYYYw{VSn zzEtcPQXzV_1XiSAX8gS{$bW7*IIjM*QwM+au9rWIj|aP??t!@fR#RyDo!9Ynt4wNv*sWPB$5gvKy$jh7PUALhbug!q%Xe>#Qpk00a~;`%bR zU}M}(qQ(;tjc3cc%JFgbl+j%O*DuK#HOAC$0G~i$zfy#Zf3`uPzAWc1bH~OPFI8yG z+bTVGz!mi!@=o=@UH+W8cX+JnZ^BUhHVTcb5~|4|)4n>j6Wu@Au8a(&j~B?TbrPAs`e z!a2A^?DDq2E48w&m>?V_xLCQ9@Rv>aV5K zE2JB#-@m(fDZRw`rOyd<$P%IBtAfX+=4d!`G!)SN1#&((uhg8r{{J|qpIj9AO+uzk z@td20ux=l)3@|&IHE7KMS)Uc>mDCh_JE%Q76wv?oLFtPoQqGmRUB0ohoL>X|(E~^m zrCrKDpD?#(b|C+%SwjW`;2z;!D98E144>rOM+A=mp|2yaL0UpwgmpFmO|Dj=am{6) zJRocDjhAIouv+6MEAGl7Ed4&FJzvUNycy6 z(@r~tUm5E>8ne~2FFhCRt;^?gZv|?k=R!I6Zi;yQ4^@y$xCwPCv($ET+ljpPO7M9k@5-L<(EFm7Xf$Ih{^y^aeN3J@r8O0cjhS`|@w{ZuLqL zCo(4Qe zp&aVueZ;jQ+uSGplrq=9Na$OMXKSOKTA>Yovtz?SS@)#Ishc&j=kJcouTwz(?S5`0 zs%36eo3qxX=egBcEo<5;!(3mc!o&kk9hZ~;u-??ZvGmZnyEO#JFQ64+Cr?h~O9k*&IBh)u-iiC2@9t7)szy(pt%D}+s6?f=K@RF#3mi&7M^VY%&;+6)_B6TuiJkanVU%c=;t`61@iyz?~`_< z6rG=RV6;{f?n~Ysq-uOkxNj&~6=hC-S^C{kqcA1q1W`*<16$k$<#CK&?n+m;!0HnUMOpWSPf!-jx8FO!trt1>wYlNSdu9XO?t#Y5jO*(; z_myRs9?H4TJH_-oJFYgDqa&?Lm*vvsQX_lpT?oxC&;`A4LF;xE`mS(+E^@`5fyRgi z`q@&2ngF}tKiu@*A#QbxT3PZwf-X@LMaIluyI;hLmx;DBO6cMtq>uBW_a2b7K?FR& zbO8_F_(bB-rUTqkR+07fcgfl+kEZjgf4Wo_T(WO$Zse#ud+EJxskK*pBJEHoRe2w5 z`q~4kjJprCx)Wm+b?3J z81i`3C;X|HqaOki(~d;UH?4+8sBTEDSWzhPi+IBWgIURf9LwX}A> z-@`2JRRG>i z8ua~TnCph-+&?nRb)-ji3~|126z8`hotkEMYDM-J_K7>e%TOLPKVS6`Jn-<~HyGmm zf~c`y)_HC1C|hf|Ni?~>Hri4`s_xw*{3#V9dc=7Djt2Taf5I)40XKaW`f5JNGCK)i%*-Y;S=%8hY#Jif^Im|F1oji?2`utd~?7qsfVOggZa zTmSiYYfni(L3I}N{Y3%2OVCPEwdAPutzBHXJzAOtyT#pla&Q(6Mr~YNu*8pVKr^=Qi;JX|ql?DAdR?JxC86yHxo=lPh}W3&6gE z{OTHD#0{+|zbd!MdyugGyiY{lqf;ZxYxnPS>SGC837-G;^ufKdW&)m}{4Pk~y*qmF9ouR6@Hl9qo@Mnx69`xn23eQGMpG zm)r-Os#leQZ&4#(Q-kULlTJ+wCXzrm?%~$iz4M}*3Zd~QqV`0dU9x{9CQ9PRc%O*^ z`oHew)`rJdeY8yVt~I91bN9;c!jIggMf=9o7?FOJoSeURKjtXCO38_Pvq@~Ej=(?3 zdkZ(Kge@t6#-kHKU%YD7N2pJ|rsl3qYHASY;GYPsM1fw|R?Ap}LSF*d)&j6CD}H6o_kGhBEcEgjG85w-?#H=+V0M&PM%HNbZQ zS)h|~xxRl9c|))*VJS3lQ>lnSnE5fcWL;@d^EbHlD>6@H+CC{;wkv}bHT~C7b&eSh zm`KZfK|Xl-Zzen6#9^?q-aSvq%HP?Ga?arE`2YI7-1_U^qz`Y+9$8Zc=VRiWHYqgl z!%`9F_URrc9uo>?MIKRB$h$|p!PR?Fj!50zo^P-Hgj?;yys~{~DZOLAtm%pKQNawu zUT0r~Y;@^8fdzY=djfMVjp-Zj-%I%!NLt;1{*;{P+*ytEVA)=7#fyQ(RjIRey(Qxo zlbrXq0Q5GHGI3A!K+*q4+`orMRi1m}_-7rG3?V{D1||e*Wd@C&pZU_Yk++_Q^WP1BZoee>)y1v9?Zn?y*DMHr;sD z&69q6;0OFJ+F%)uJ}vFR`AO)TYUO#%ojWz5kgKYt5u* z|B3p)nI&Z0bAEhhzx(XZN~{MbJ^N*PcH{W7zwn;jSz_Hc>De0k=6tUX+4%iMUSHlW zvHoe&Zwu+SFEOWX(*0|_Hh(IyZlCnqm4{?blQ-59`up;<`T0wUwPaG8IqoxFn*jYC zPHS_n#JYY`n`!PdUYl(CyDqIw&Sh4~q&5o8*EX3~Ky!8<%~zSUw~01$FS7!Z+MIk( zJ~Ly|{lC%uy6UK@2wiDAzId7CoAk`l_qg3wR~_}fcdJ~VV;#BE$+=8f;Wr4#MAI*g3NQg;)zqtVv)pYMBdpflrx zPinE`XWSkrlD4V_6~?+H@_WLbcjPkbYiET`VBxx(rOYMnm(H}la#rBtEL>NU_WZHS zth>(&nXuG^nfHfD@mIVyWL;?QSK__ID=|X)_AwEAP5K(lz8`J% zC_W_4aM^E1%+roo{W+~=94AT*pC*0vt7>ef7VTr0lhvr5uy8gYbqmrdf9+h5Kd`x;{QVO<$1nvMHO>42Vpf- zd4B!5vi6pS;lWXEcs2Ak9wL3JU=_{bJx#DkemgRKSxoxYWW6*KRfiXHUOM2~PP{pE z?b~6`ru?uP?fXpA;xvZ?ni{4#9LLAjUB7dN@H;R4z3{^=+)@myP&50UP?@vuuEH(* zL>y!0@E%3tjMMkOA^Mmv`naY^#;Xho{O(youS#iwI5gSEi~A<`jrj_WXj(kY7ZUdL zO_Jf=nxbPhs_ASl(9FJ24s%-g#cCxLjMXFB`#H9I^NH#afsraP)5A)Rj5YZh=l0(? z4`@CXtM_7Za#^B8JyxbF=nm@4skwzYfZ7q%;RJJ~O)r>>#Co7R{qG>$Yao#c_(>mD zADX@#709axnzx?khS*QKw1?0>llyDZ-=s%Bdg=0u)gaFgN;znzX7;tI%n98!Q~0M^ zRb}{DZ|rGy=twb(ny4s`s3fOuuhW31RyV?u7y;w*f4+}7X*FfTv@d8q0@z+hb5Arg z8{6u3U!*?#5H8$np4`)*GAEdCB)y? zAtA=SlsO?6zo2$0?O)~~N776cFg#C(!4@&+dCu)lHPGCi_dmb0^$ZudaI`0o%bYI& zPto80rEYx(_q~$-3diVgaD*E~YcqhSPIDeu3L2X(a^9Ef<8fa#5m>+DJaAH*8GeWJ zKyiEZ2y^?*u0!I`q?*6}T;_Otn7&VIHH-LQp410JIxHne>F89I&)ow*Qkj$Q@;pqP zSf7IEhj<>ndzkZp7+Je&xkJ}zg-LYYo zpz&R*GCXvi8-L;)Bp-4Ka+_!}g5PX9MTm z8{gyhR+x1~P*$bRb0d<;Vjj-pNs$90-w{;MEox~2-J@%EiEpeYT}rR+pKLdojGMBl zc%r=j*?Nh~GZSXrY4>~^(bV{lf$hYbD^Gt>@Z@w{71Fnw4{^I)WlsBDgFqdu7%-jj(LULMBkgWM*b@<*3$PKbD7v+wkn?O|s4!n0uim<_x}!7<_A*I8BW&hXl!9q35o)zH*4$qOLRjZNi#*klSN&Vcy`4es2Gxg5JY}%N&O9*6mg$9$NKzZVU-b+jYW6zE0$~f6-doC)QKstkbik zvo|PanaEu~#|`Sspynt2eM4yF7p-T%6Bz-_zPy9d)?K8#7?;^5&EE!kHuU27bH0N@ zE+50l{}IXMj?9bha`?g^%)Ga~*xPg+eGYTR_45m`+{2zeI}6xA^LY4|Q!I565&@D+ z`?#(6&AO*lC4AJ)b5r3DOB|zsuq*C)kK5nq<93^h@Q{}8*6E)a-+oZ~9V0dLz3Q== zGT(l0e9x-|%t^Ov7ZV*bSYnR;@L?+LqOqO}krJ~eU!5|Kid2r9G}{BiHyv}26>M?C@j6~?cYpm>pE?v+*e_@i(NrkbePv))D zJIZuflYYUyEJp7e>hrMiq+dwP%a5*+81hX@6c!_ZWDO2Z*Ptxy&KCfMl&>eDWN>FoCwx=hpL2IGPf#m#LUwmvXC&fKP3SfM*kK35XqNynr z<$h|99eL(_l0B5>Tc*&SSLd7aCFahzYhbOzTO zqh-K&2H5aS`L$NtBw3Agj=j1(C*u8H{(62~Jiq!Han@YRx&3gaJhvM%C(1Vhi^~UN z{XyZ22|qDS%14KSq<2k}L+Gqt?~~v9K|i+(nqX}uIY+M^sm*0h<8@48&0mK^ALjw4 zF=u8jbGBtO=h;RU-P*{aHIVvjNQJR2lR4YO8KlMs7r^$4PMJ!Q3@LyW58sl1P zj=NsnZcZA>c?}ATu3{DqDi!74KBaa!;(VOz`s-)KgT37DX@vEX+xB8P0wh0e(_zd5 zb0W!_N>lfhMSLvLsi8Tj!)RDU`&be3@LC@d-g=NMJgCB`2K7l1a%FXpMH^62=EbB% zNG1!4+y^JM08XSp$W0>l@yPV7Sn8mQD>;2xjC43}K0kez+e8E3<2(>zu-^Y%KhuA> zm|gn8(KTvpbUn$Yx`;77rK$1iF}w#YcDgAe<}_!<&aTdqI9)%Geuae!de*!AkoaO# z`(i7!cD{wB8CGMlS@-iknWHeE&5VEiu4~&?Q0hG&+CE>{XRklVZ9mMsvAz6*N%GGk z7;6u5dtWwlGV?@?`<)}2X8k${YoJLJxs?H!eOa2>S2PC>G`xhV=Hevnfr2c#2Y}&P z9mfB3>z?1Ep!c4kWll(A38qOLv^xL;*>{ztrufR!b0>BmX05iR2+FXk!O);~R6!dq)@001O3R4Xo#Xa4uvkPvw{{D2 zPODl+5!B%n>9Id!iKg3Fq7$0X*>MMR)@bNx1iG1c76+b>z}nAw;D3YYPwgmzHvBQ? zfy{ShY_CS^VP0ZUAC-1Ca&Mo!Py1tl^J6t7rB-M|*t%(y+jNikLQS$%_I~7=AV%Mrt*428Kl)k`57X`=0#HRQG#- z?U(VQ?`KQCcDfjrr|)`uj;k2nTLL38pE<-2p~Bee#yH=4P-6Vh`qA1&=0oVL-Wt|i zKE8(9r`&ky9r@iY2ghm%*DV^AxJao_vdT{lX;$fFDDBKdiwX3$dv$o{USrW*%UZtv zaLvg|5znINX5X=Q$K^%gZ_?57(mWVnKeJTG0{0CHywMFSKD;#%D!svK`tz-cedmmR zqR+?Q;r8`zO`oy#UAfQ-^@gqAos(<0&WqEWTV{#%4OUqDCjYk6{Vn%uYu7n$n;NF3 zI*>Rwq*|{j=pGQYFz3X-_Kx&Dd06bf1B}6XVPlneOe@Q+$UEHTDvpabKe7LC*Q7T8 zs>n9<4AFs@qd#41wX^H2_AYbt*t<|+efb?pyB?kWXD_!?9qxPn!VRKN_Lr}e33_^} z!n&&8oy)hyTsl!t=K5Iv{l9y;tvp(oSG7WEG5^esqASs&7gXO6{4+QH>pTxUt}*AR zita8yb8xT3xpML2I@pi#e%faEA7>#L?w&nsm%~>|JgjUCx{v z6?8Y|Gv~4_^fb(24)MvRx39CZWDOn>W4SF?-rriloTicMESj6PY;=n`RbZG?nWJZz zeOKr#HlV@5LwEKM+{ql=p>J8LGiPuab23@2lkw=yqQ;E&4!6xLCiTrV5Orfq&I!z% z1e@wBZ<|WGu{t~e7-l|8bY&kaoA)y&YN50OtAg1uhB!ZVL@S6lb(IU>RB=DI%_%4? zhpY!SpcTZQQUg<;X@V6x%k4bQ1G_M1c(*Fw8Bvavz3?+(|KG6Uf3O7hUvG)A-+R5q zp|28Sg}M3HZeF@lfjm4keR&noj8SgT@8bD_>#dzaf6ov!cXVoY%&&?V%sDz0 zPCJ-$WGWINVS|UD=}>#6b+P$=;dk7Aj`M){R>^$pDCdFqKjRB&4I)4ft@E!q4+va- z&b!;DGDm%=IvRRt`to8w7N`#?QPQ#DNg+~3P>YU}NjeDOD&(~Yopp67vE|G>x2ig(Tn zye%o8mfT?dzE9Y_0|R@x(d6=+6@QjIN9@DY4OY`Rqkq-!xIIf?NqMoHwXsuQT^c*x zbW_Y}zBzVw^|BaWuS*Pu^-~W{*4NYZfb@Kp39;1QRHVKR9BTlMk&FsZC;guOOreW(DZl8F6O6$}{J=(6^`nyjg;LD76Qsa7^cV7d zGt_;fHSZj^#dYdNF-I$YC(p8tz1)uEGv^WD*y&k|thqipF9oI7TF=abMZYP&iTVkh z)AOdlxPO^!=geAUoeRQhSa$I-)5AaNByNTQ=@dnbzH+%wlcCK@^fkPF@)rA;w~v%F=b0>sdOxPdoK_9PA|EJOQ`x2X%DngNI?HX6DT4*f z3FS&Xr&#cyg1FRo^5bXU=JqqSusYp$Jxc4ctaMv$JJe%fi zz_ab^zB1xfMJN<@?!ipv)T3~?OM~$nptMy}#QlLx>CX&`+O@Mqe?R#F5*ul~RMK(g z3SW=#ed@Aa3h63Bw`$6=j{G1i*8PsFuZSFmg7~1T!|r>V+n@Y^B~I7CI>>oo3e39E z{|*yl{Zwmm4Ag=}$U7-@mhGXjm<+@x#z6Vwyj6?wd2oLHwygb>4>ONwgy`GTMW(%z zws)_%uvXDM?{NFGy@L0OdTB$heQV{r+!irs8o~qay?g}=_x#SS$2f1CFO&TE5$AzB z-{tn13+gON{|kM$%EkJs0*-rii^g#?cEw7dSVL}XAL*GXO^<)dWlS;aWl^U1%BzzC zD>yF*gp)vNB!@XGa^N&EShdh&I^cNr@3D9tcm9ICESet6pHfkNQd8o=uIkDiDsw_U zv+jr4B2P7JZc{1`7sJ{_d{kvlBu~=b2P%e#6d0?EVFfg^Z?bKpRmHG2{qy}${q(Lf z7KIuqYnaBI!!@wXGUkMyy00GvH}?Zdc3U5dDkxmg)`w`@J1iOrvuIH;)Qn(Tq4^G? z!oJ;DJuRPk(ECc1<7N*PaJ{6+LFc<|rQdQd7^qm#?;S_o1ELh zcUiO{%%adSqXoXx6_RW*z5lPwu`0pTlfEiE_VH4_xC?>9*7dZ z$!E^2T;>ps(6y2~F<+kOq)CBMwoE<~TIT&8*fK^(fU&v;);Bp1?0$lYelO?TCf@o7 zl{u`RMI%7j;YR7N{HJ{86wHHFoj>tgMH+?&&vQe0Qof^xbDQL_t(oJwXXEjTYCM?B zCSXS8=Sp9knRnqhT3veIbhGq*i|20k{9y%SKHpm9;=aBHcU(!e>hQ;|UnY>toYSuF zQu^w~?RDJs|E+F>^&#>0wDu?6T(+XMdaNiZYU$TWKQ`_}5*C1$0Ocj`e$iSb=3NiD z`#-4p%8AzibMi`PR&S(4yPI!u@$-F z{3XeGX*F(&dAJVsYcpbw+ebw~cX0)a?!k5CH7J~4T!E-^9ZQ6C%uudF!pn2;baV!7 z%nw`(2>*O>kVOYkQBHinCdiz1KzD7DMM*EKO(GhKNPp-@8sbMaC4PAj);36N{B1dE z#|Kb{YgPHK-C#~}FZBmy+eDw{&M)poG^J(5x1JZa8)sh-R(ji}^W5;p>b0){${KN9 z89jT{<=Zree{rur)|B|4T^>&7{#4EEqyOLM+@5k1bFK`*3MtG9l}r`1Q>4iC9`ji~ zUOhrIn9{Q2zvZ&t{(m>Vd6UMs4JfO@7skf6>T|}n{vu;*1j^~TkJ85V*R*kc;*G16 zMRRCekIu+b79y(5U`{B9Ifps7r{2VzRUudnG{!IHh%weHGA4q)H=z0ADQ!x;hw}iV zv5NSQDe<>Bw@+{$Abl2DFg_J=?bVfCnJ6D!^Lp%WniBuJri$-hvBlT#@#pU@40xl?Tf<0i|6TG6$6@FoH{E zUh}$kHd2F`0;8f6s(5Eg%Zu;e+IvY4I7{!_?XH;?~*BxkQ`=Me~buv{y>VzorjEfzhh^#T+mp2j`32aeD8~ zoZEFZG6sUaMe{-5qTi-m;1AoGhDE3f43nAqcn*12Hgod9oYQmQ2)yM?%pje=_-$FE zhxqYn72T;>%u()TPRPhz{<4Z5Xl7kxT5!wi$JnO8ImAF`&NOU^6tV=MhrddZkDLIQd?J9HL`Vx!o`FECJI=XQ$b22;`B{xIJC{N5~iN}+( ztr{Tg%aC^RBO1aV0L>q(Fm#x8)VKBuM>>2?sHsXpO8+d z&Klkd7${(g2#%FkL2oukxY3pEzAqbzWIDc#JO9B77G-)txj5@JC9V`me1}l3l*1z$ z45gPvhlCvx8*1*#v_iOazS4_mwJLIHB_{q25OK68e=}ZxNIc)GTOW_6-!uEx@bSMr zTDctXr_)VwE_3J%TMsO(DIi@0JqKN$AnI9`FlVcR?%G}!ZBlZ}>6u~$Jtd4e86qA_ zkJq-dk*3^?ElnhQKpnotJujDnIgj_U=;O#OYcF8VQlRGu=Yg6CM9okc^Q#HoJ29S3 zi7!~h#`G+bab{^|pSgr|9O~n&v6`RHro}X+$F_AT73CtvEGX-Ss7V&B(Q$XpBIKz_ z(7Cjb#?~M(HfF}3;xbl+&Kf#<=FwcxcyXyXyVe8UjkywspL8Z_TMcwS;m(yf>!#$E zPmFnxm|DUoJqOO8=^KU2>CX~4bWt;_pu8cErQ<P*LzAl>lmquhRYiQ9h3L^)UZYBd<5R-^0ZKYre`ljKWU>dLkLVU*jE zCCqtkl-vKPqMPvbx>!_`mO>{Z@IrBHUW?kve zSR&-&x_Q`JyLEJj?q!aaVfKZLyZS@WwuBzMIq{ULgjaltMM>|SXXGvqJuqweHVxe@ zhdK9ctKNYJW-ZsCg^9=C=f{EpEhDV>3x&SNzR05OKzPNM5baW#)9@u0z5O@bE`onm zWEyh@vN{WcYgw4|L{CSYEbq{n@B!z6ZGEgV1U1|QH5~FIud$3poBYUYC{V&Rclh(@ zw}vuAw|N>-R_* zzG)Hi*6%^IRYyxm*x>x}!{=mu7Fw@tL0^7hd)aZ8+ncgoJuO?r3^-b@)**PHDt)n! zirN?w&+x(Dx_R3g!b&-dBA+GTHw%%E#8y05W&))HE{4c0quhQ8D3vkZ^4=4~J8Gni zPjYDRTvpk|^gFGKRfZNJkN8{@=FZo;Pzj%u7awnDBN@3F9nTAYwLZqDpU|sE_U14r z^1wg#HyL;JGax*V*4>XhT8Bsh!h1_uwCN6i9-xJjrBYuXUGwt^HJyWtkeBK}f~Do( zdGd&i$B}Z$+0_}bp*!IWael1HER``iPs*4aiK9I`zW=vEKHEStVyaxkW8HbCR&iX(AUn;lOrW6npKW@Tz--yZ@spZnksM!6x-03( z|1@)pXIq+=1B2I2A35F39Ih4)hc1CJu$nnDX)H`RI9SUZl27Y_;p)XOPF17l{ zcH-{eaNEq5cEnT@bA*rd!OJW}F0(${$L*s{5_{-*cDeN{2%0-cbQN^t4hHUlaYW0H zo9^Gr*I=B|G;5$q;wgsM$QE{#@@7hxtCin@8fnG=Yg&ui<&_BR?uF|ivRTtx1W!|+QfMv zBI0dO9?53Tpo|abLqT#0t1lnW@~%p4W0iPlPF`voDuXcVQfrWSEnCPI+mTYN)N%;S=bvOV z=PfYjt=z1Rk3_CS*6_1Bows*hHL$n3Qsf2yq53-^-<;*C_d5$i1!_1r7vX_ztTL1< z>+jPyPSg5{vn&wrIm_+UbJ4SH8gsh(n9RHEBY8oMEA4C~q{FJtQ95Xi_Y8AG$VjE6 zm$QxabUs}LL$rG|kVozQf%CvxjXCCxbngp!=8cG&wh>}SzVRcRJD zj+vOD>_@aAi;4Q>r0=Vx%ozxD7S@#9+D~VX+RLKF2rN*05nZ=Te)ow?%t-&v*f%bL zVU{POPi11pKr2h6v|u>6mQ78yBC)0x)}y48CrPhIX`4^xA3W}3P8XQd8IbH zye)R5o;f(rOHb3cr!%KWzxUHN6~?++cMeyxN?L0?RG0_Moo}v2Wm~N$H|patWsost zB&R_0l~X%vL(dCZ`t*vj_FC$nW|3~t9)v~Tpf(|2hM1#HqS0gAXlt(?No~rG6}z!_ z?~HOgwduAPwL9UCBjnQ0*8P%xsIOhXLhrl4ocRN;K0$J)8f4Kus3<4;zv)d{=B7C7uq&Ea%HTJS-&7-sO z8ha5Xy7}b4xS_RIkEGu}Lpq8sZCh$r^^VYY8~ckfeSzAg?0Cn+nSYZ-i{3=EN=FOn zw}aXoSB4M7UmE51nkHDk_4vkHEZX^&90OBi&KHe&vM-j#z5YBm_7L6eWzpn$5jS3E z?nPAcfk6DRGqO$%UH|fojFF`4h{Ns2r!t3RmB~2zbjCHFM3gz=X&5Gb3NrOx5Yd+!TJfwRY6!kKhFb1-zHdDaZ=bx0wmEbqbLiYx={p#vEbW7qP`a3KgZ`%Z z>{M}_^aDT<>-1&7c<4?RBYylV&I9YFF=uERa~QO^ZsaaEeLpHoeThXy+>Z~2>0a;7 zf)QC;v>a<|ns<+K&NFEU$U!3u0|UqugkmMzRHqt=unTiBjjdh$Ax3al_1G z&On|Vi>TjA^ISNNh51#t4Ld8_q|R_7HA~jBEOPyCRTvvf^Hzr&H1@W->L~pka=6hp zjX5-rp+_%W4*CbBxnYDG=D)MVz`wh-V3E8BxygG{Sth-&C4}TXq1@y>16gf_uW%kX z;snYfk6yaG=Fv-+)1Ig6o5Z^^nw8JE5ovGezp1^UpZ;z;CB~IFnn$u=MzeB?8_69k z%7C&JKw0Nnv|L5&Hj6orr;TG5aQvtkM@DnQ2|hNj$_Z{f2RW}diFwUvZupcNO=hIO z#*Fkwpf(R2=f;~Sv&!k6>(bs?4;-g`^KYC7woYTQ!8CgN>KSg|#d$!;rzy9#Kn{!1 zS!JBzHql{fD=#HE7CL66P9QOLlm~*4`DFT1<}^VU_?>Dy8>z|76gH?LsKe_4BczM7 z{NS8X9-uSjqjKhSB1_nEbuedr5Dr}bkV*Sv5pz~J+-}#I(;mdZ8Kcq$K)T)>lJ_#D zoIib3+Ed)P*FG9c_gQY!^CA~7SGI|ywaFiq=Uhzza~gr}nhF+OhwIAde5?WHt3i2| zT`Hb4`$!HS;JlY)@IUMoHTC;Q4j1=wFSicu<#x!;qoVm4dh)_tsxR)l2=1_m13x$c zci77%UFiB5#;~NWhO@h{JUF&iu~qABsJsc69z7;gi{e`qMJ%0dei7%I%X0>EE2 z9W7lx7{PqpP5bi}&J86?@(Z$`^Mt1$9mZoCxm2Xz+%JBgN%sNH~rr7-)bT^EG>XsIh3D(aJH ziD)pM%EaBpFzZfe{@YhS#x_xZdiInaSpOK?6ik+O%+wHjdOEu6bzI+&1EY9lQ$XDQ-C%*kn86U5%Wt(>G2@d}h5OYPp-S;N9ld6kdnTO*I=ecp(ZGUI@jWGI9Kp3>b>eDy#M@0?QCOte#99+y=9b<`G$LeaEb^T8{^z!Ku>J=D(ie zMvaEj`W&=0oZ?1RzN{@0qkc@4xR2FI++9U9ah4mjX4~ku>1b&<%g286o#n?nN%qQ<}cJMRN`T!UKYJsU|Dg;_^B<{nqC{8#t7gYy9KbZ9WXugF>_qUK2sT7qs3 zlty5C1F*g3$|Y8CWU&RT+bsO%E{^g`DhwrvyXiTS(;~q3YAmsEIYvrUPbOi1xrqv{Vau z2lEBSgAR+i*bQ`T!mRr&&GwecQe(k%OrG_yPWD6Edy1sJCn)QbB~s-qLF3d5s&AmP z+v7KMPt@8dn#gmKfHD2oh9sq>+an%*@uJp2~CNg%7?&}*|1k)js8mH zYURhjzgOli4!M|Sr}D>bdIT0d-|1rMn(%j!{F{!Y+ok$DIst*DJ1BfEGeun8b$ht| z&^oxd9@1v~(zrFVFXi^d{~lrjkDTcF#bwSPMcfptYy!47-BM+>&#mcSv2sO) z4pd$SR#~F6%IEdD%b&|#8eXw~MTM@TvR+3EovB;1%sRz~O7VXVDrr2I>8!HE$10!C zxpet+1#TN3D(ih{NuK9M$j2%}ezvh;WkbaYAT>-O>^u=ZugC-a7U%v9biWhZQznNRxzt4xf4}<#(Z(aF~iYg^@RY-wR z3v}P7Bi0Ud0~rTG$mlS2#5{bRqnc0XWdCp8AN+st{>i=_+EdkYk>}O0baA5Nr!+n8 zdyCsp(fw_pTS5MT-TwozLy&xCvXASjOdM2nl7IXi5fulzG7o>EUiF!Dxoy1;<2zuLr`&ZutEq8E(*&l>X^~%{#P_H;FrXENH~-q* zQ!2V!vvB;cW44Cb@ddw@{w|`0lOi_Fe_*vbr=v&BKY-cyt;A%x0v(5Ds9U+eU>>T+7seVY>B`sl%D zzxCbU?)+9KGMeeU)^y}OvG%b|CHqS{T76PxY0Z(f7g}|+G>AMrvu--zpZDl}JD%5J zHLcB@)3kJbe$(2lIgL3a!=VH2w04x}gW3{Z?pcTR#0=1Ld|F;I_z@e_R)Nefzhz?t8kfhSl6w z{f|4o#nxgDO4)5#tIPpox4C{GB!^=K(s(@fQ*jcyeWNIbS__rZIPJZ6FRLa@nBkA%o8q_@ky6% z#o1df&)#jS%;U}2BXNpHKFElTG%42Ud5V>K@}}5Ptss6x3yA!5IyZLhmG#O7t`$1< z@qboe40PNie5& za4USxQ%L86dLX4`#7PERwOioe_g)P1y5Sr*ygizsGw0Vpw+7~1InvtS3g7T=RTxEU zA0+xOOl(RqeE37 za&0+qJk`~?S<%s9PJwvdf1cY(oz`?pM^c9)@`y3zKr$^>{sVU&NcXrc16GzR^Ib@X zN<4HItE^&DH>NY9>Mkj_(_E(0pzw{UW}kQOg(MGD!|ZDmHK?nsvq^3@)UnFJNijo< z-;}sIsv_5`6*x}v>{77GPAJV0jIUb_@jV>}H6LPhPB#G?NG@s86>Csp1J~UI<~$B` zFV&gz1X$(Gz(Q*K_5EM3s6uA*OPm|+I;`h)91Ip<&P}<9k*txWGv@_W_MuAGhJU8P z@ZSHimKCRO5dCMutgC`P{D2~J8;ZL+HxKG+#|P)M7N{^(9U_jXT2};(2ztDXRZKZv zUvb~c`zpS%@*5RlB_q5K+2PA(WK6wjWl06~hxQ(g^JIE$h_9-#nQ3z7E>#(xs=}D1 z%US~i0<+97r6NQcpuBlXLm4r31Bf0AU{99ZAaVU_K10y;OaLZ^p9lM-R+hzOuKdBEE7}#g~*E+@15Dj19U#t>lMeB7O*n|fKl(p?9v`82Am>y57GSy=f;3rujRy~ zI7klzh~zI-)KHe^e%o$YKcVe0wngkunt4Yq-l*z{OJp*74 z>3*iPg<7Jvu?|bi(K=dHP2_l_*EmSmCSBI3Y|X4VzM_zwF*O*b%AAMQf&+>!ZNouS9Ujt@_&O1f z6o@a)WsZkKVxsCWRFtk(ne%tj=iIgf0uM0|*Zi)18C8dceNSbM_pPnxxj{O5dOX{N zSR_A-{e=1q=G6N3ZN36}N8@)hw`|K%J1$GM_0{U~ENRMpeDl1OB_m2MODxmjh@6aE znUgUYi`<(Z1#GNdBGF+5nDel2&*q;0qi#XY%nrZKoS>gM&OA850Czx$zYO$rW>y?; zFJxze84&n=KOUQ(*<DYSwfFwI$pZt4QWebidpw`Qs(N`N?Gn$$lWhW(z8MTdW_E< z)ztVAH_kuPSAA7_J$|(T-QdO#<&e(IF7If_ zV~Kq_tPh|F{Ug0y=nkK?W;eIRyk#RX8Lw|h%ZLwZdbk1D5W1zrdT=+lKX&aT)c>ND zSqZwPF?ey49zXZ+02k2jwC4kEZJAZe5+c_z)2tg@4=b`NE77p-dvzi&?G0{s0Si;h zShQ#bT5cu%a#dDB*i#?$S5woSuk>_{gv{%=qaV8?Y#Tk_b;(R^xO`mWnk33_rP>(F5S~}Te>n~MI%Z}^*PaI1MZk&k)B?J+?K6p-Fr)OEs_I@a&v_YBij0MTj+cynyPs&&kFX= z7`Ms$b6a*hZrhT4>#Ve;Z$NjB#8;y0H?yr%-u2Guo=tuO-kajtbcMP2$kpcJqt}{?KU`og{;1qsd?YYE_F++OOkgZtD=`)aYjta|LyHZr*Q}vh zSc6x<8O$*A2A3l-INi(}{0b6-L$H|6Uh?p}1zo+p%!%lDiT3|{=fxhlXq`}^;i6q6 zGkN~O|Bw6KJKpb~{9pQg{EhT}zkb2_M0~httr8RTS&(N%REYDjAsde1PY>l=LE^0% zy8St@8a({I_I&Gq?UuF=rlMQ;Vs=U!)7Uc`@~wZ^E$klM!Y>J>MaH1aJV4JthZTAz z-+DL`v2Ux&1-eCgeV>!w*xj7=g$jDT{GfE7NY}P6Sa9>kM6MR`%_K{7`A}M>VEf_! zTIM8GmLNIe#5~0kGVOEuE^eUo!7Dzq@7>qAt*&L8=-GNG$8U9QAaw5RCw{u^3zlCO za`t#F{)~dMYu@1YtODF!o{8@M$Jiz_$Lw487`Ci_%)h0^_x|S9+3#=Oy6p>=#Qn{0 zrvB{)jF6uts-QME0EUueiI9fUq9hVM^sGy(*Mn1zfZu&^~RGbG8YfbGZznDVJ;rJ z+FX3(T66Ky1?J)p%gx0f-DoZzoIX8vB#;~XuxLh1)Y>U`vQ}4(&RcY zVXwVc4=6?bC%NYebMfHS=Hj7i&BaF+n2V2=n~OiZ(OmpdmAQCmQ*P|&mKm{+Y`6Bd zhp)Sr#*q@xJ%^xJ`0&P5(t}2E!+?VoDoS=8zmW z?+rPR6ZMTZF7VN{DYDM+3p=@e#LWYuZ#8;2r;7sCJO$gEo?GS|eqHzpgg=gJQx1My z>$4`;FG*=WD|NrQ_{2Qb8fZ2b4}Q~JJha+eeB=>x@zFKr;tyNR#p)%94XuZz&s1U` z&QY9?iWDac=3;Ly1P#6A(vUVq(on5W;!u1J4Y_!RFQuNPb-+u+cZjElc5z$SzSgo$ zH2+_IEp4B^b>Un`UzfFKXb!kGMc{!be&&RH%sHkhai~Ry5oAsf(&lx+I*43Wby(f7 zZnLVQJ5tCT(i56=(%pp~d7R{;-8tsQAk57ZaHlV2P6#;Aa4DQK(kCNuDp9~3)ldDT zKB%G(ikqV=Fz5jh7wqM+BgmqmTVQ$e9rbV5u8DQLChO+@AWPsnmatxz^8c@Pal2DR zi`h4^?!)Ms9+@kA9ZPuiD?%Oe{C-1r@}70nk8&gi`e8M{F6bca;WFL- zdKw)RT}TI~cc$0tdGkdNlRrfI<}My6Vgi59D7s6;Vi+I1!2@4^odMwYH z>6Gg)ptJTLcgmb1&;RWCo>#sq{bWH6J#CG!f-w7P-Fqg<2DiZSr-~l+>b5Gv*F33i ztLpFY>b82m<{!RFb1?2>{@WW8H`$9fnwVSmMod+@>O9(R6*|vI8PQ}q%~k`)h|h(N zYdz< zWJ|j7d?5|rW3k9Ik*C@bnI+cifad0?dwc7P3Jmx=H%E$*IHe&xhBcn%84~r|*Y`?4_|bRq1FbhKRR|gqg!ob(m=Evy0lm zlsN6@$vi>&LJ^;wU;iH$U_|XPOdkRsF+_3XFAX{(;?Ueg}>HK`{;- zzfFO0D8cP~u*3;1U&N@Tum4yMEf+PLJO0XffcVZfRo41blCUP9Ie+5ZZkQ$4P~heP z$J=0TRJONmZkUF|g!(lw`&wtgIqUMai}9f&oZFGQ>Z^);68rI=cXHdrNZAVsZu>#& z;=jFN8gq7wxD1vs6fA5KxjzVJ?vlK#{SA@R8cv@#lD!6BYM}vzUV< zEK^0t_`c1*$iB@_+qd#NFDAGx+9SWioFy@$KTgBNAYPpRn%JK&e=Q+vxTQ4Qjg7w`RGU_ReQj42OI$HWjmk&=vYR3n%Zbbld1U(xZ?saEY!L_48)MKNIy9^5fUgTC2+gLTuGLwxUL1>L){Ylgp}z(}v@OFZR-h^4{tYtC?^N5z4|Dms40 zd7v#@>Nn}nT;gz|YsVD4HowEngwv+VS{LjbHvr`T(QJP2)0@lA^6o0k8vebS-|-uV z8&xP6R?l!jzbDk02ll4%Jaw+zS0r2Pfvn#y^YfU~oZxorrEo4TV_e8Ho3dGqK|4VF zc%CA4FijOUwvGlB&VZ)HC-CKBfv4BqMtRT0=Hagw=(sZ8qQuW)&~fJ#1=TSvNPUoaQo0|p z=b<0SDo|pX3XbiIR9cySIEqh;?Sd-yf{b@iJ9HgR6V#4*0PUAp2-*RX8PvJbXGMLk z(mfgA)eC$v>9vlFboPsn0V4@?S8Y(PPmzvUP<;cPsikYZz3z{HUj2FD7rVu*8_~4z zX-$ux(lX-fOJ!}&D|gCTv`|LM{`v~HXM!b8X)|x9_jNzUHl@x0-!uPG9aCV|-SZl^qpJ{uf@6qOT5JDBi6H_j(x=A0-I#UNBZu`^l~yQf z!PRK94@kVl{CILy#Ak++7%8K_yLXB@1L6PkDz`rn^@#H0`#BFhteAPEmvm_(<&*Yk zSkUdUWsV=rF$ZD&YKN$gCuG63uW~!0m>Vb5kJE9dl7dxK04M)CBxrq=yOfxsK;VPJ zXD$vU={%4%zoD2Lh3$2Nay<&FZ&>BV@_RatC#xPJUXPKoEw9LPkj_8vER@gge(~ei zCa-t89HqoR)3o?_3{!@izpjhgXe3|lQDFRV%&#(A;Gwmt`3F*3LHrl5ar=y0le$eo zj|ud2X5tr$CUHssyVx}w=$5{xK)mWzZg&a%%R+%+s$tw07a=*^-8-w*!j3<39tch` zH-2&f9jl(tEId9QZG1edGh+27JN`)~jCvivNC_O*Sz+3vf8W9F{IzUTP{qO{+N?00 z!5J|7=E1CMgjq-O+qwj|XX;&jo$4*eY0OV=e0p<{j$b5I7-u!a=fdo}2Jja>h?e~d z3}va=r{LL7gC)t$OhMTRE&sseGjj62p?A|a=-mqxY>(`#b!bjaboCYP;C5u6=6q*g zty7qZ?p z@1;h#n`<{GzV%gZ(;0b>hK{402Np~*HM6SF{JcbAb9MV$kYkd`jnIi2YQDL3{GJ)LX;QM#=|m$|KhC5ANZ_DmsD z<%j=Qg4?NbMlx=l`HzTsXX{}7g)-vV9a7&ver5V_(A_Z~w)slD9Htr0m--kLzCPxU3Uo!^hYrlH;_5u)j2ue8IGlvio0_`VZ-I zS0=b!s$pS1%(}mE9@qht`#CSC-$DtA``Qh3A6ESxN!QK@&Rsvk%&=Eq^v^rE%|>~7 zk&c$2kd0=BAJWXc+yu8(z)!kXO4v*SaaHCug{>XjJ~*ikorm*5^I>M9+ryp-W}=(s z(gbv zNMZF29&U{%dmO29?a@ET7P8+@r^EP6)b`Xw47{3a_I)+M?Y)l`Egx)BEq4yXP4^Zo z|3#1RJ(s@UGfsQ|4EU2vZs|YuQ%vS}rf8E*pWlb1ojnorvN^pD2Dm9jB zVu`2cBk|)wjby^oo@xHPU126->b&m}jhsqw+oAnFZKQml$#1Equ)#Sm>=5;V1fRS^ z)Ek-|{`L-T|Nc^Z%cQgMr!0XSe_l~86S+|@=ZusUUCCM+a$pSI&zx4B9p66{#;GR1 z7@wOL876rs= z`(NhvJsPHV?!967FQeR``8#n&)+bu`ZAH}PczK7+x0E&fX2zG0%%sf@U$=wXMXgGU zK8Jk=r@3)LE4Y1(cm3eDi8fOojJIFm_H%CjDD9^s0bi_5ml%In?U4MH&h0^MS?uUC z(ycS%Ki$FYBel#Sy#|_DXBxpRbH0n1k^|>m&I7l*{A7aLU6+g64P_o~ezq9zOwtKAHYL2e%=z)H3VQB* zh1rvo-!e}((>uCX{gHOm>r-;&xvibfVwpxnGkNX zxkZ^MyV{RIY_-L<5G-12PxmCCw6QhZBs;hDdp&FINhSeL&+qm6zCM5OBC{`RugkNZ z^<3YN_BR{bJH=OV&s~P`JzAfR$8HIB{MM*V>o(cK^EG<=XUA%#c)w5RpP#b3UBWZq zC4P>|3@^SQ@PA*%J*Vb>7O#IVqqFM|368(kV=#YWhs(|*5$={l<%c*;3HQmNz7>mg*3Sx z<(khrM}KY0@)PBhB>-nH*m@Jn<#?Vp+L=*1}(L}+0Lfqv8qlaFhE~uz>t>b(%Aqa2`^$~wmAi~`cA5RlMpWyrA zId9n46ZRZ-+cm0Gk>iA=Y%eHpUUbP;RBU-a-S*1p(x*no+08(WxCQ9jv{oS1BFsiv zGCBjuhC|$c5M9gj)7X2fU*G-op(~8Z2jqQ}m+@J93?~m!kKkZ9$hY|2EndNKdEDIv z`&~QV$krn`y<0QE`h~^p3>`SnpB1|%WZ}63y6R+hhUHNS6g!S9Kbi+d1;8;?lnwvW zZqjYpdx+(Oxb+5u^BPrv#59ntY3%wmeRT)&iz2;;o#E5;#|}|V9igSMeA&P@@!fxW ziE7b2R`2K*800yQVCMi_Hb(Wc$N2RBmt#ESCh-YlbiaJ%F@`6M@%Af>vGji!qX<=T zU)BUaWxBtwNVfjd;QaLEL!agEvu(^pvh_@Y`w<#I-2kzM=5${oj&GaIOZ}#Mlb|JMe{}iU2F|nk1%jTksck>V`x^KzJG|X)!m1vb~S(-9B^+< zSRfBQQyD)j@;Zr85%xtzVP7;~{bG%i*;9`B;Z{;z2v(HUmvrk7JtM`pWrOugyS*{K z%W0W?57hksdx*!N`~c5?$*uqF5Y=K&$QzNbU#wU2hwbwP=Pnfo9nDqqgB|0~n%ys7 z*@x{=Wb2e&e>s)=aK(59o0i1fyW`;FI404rahyqi7ED#S53TlT0L2`pN^}Moe`k1C zsXk8d@0md6ALRaolyBb$Sugae-A}0uinQOMC!~=+|TeoWShL zof-Y}qu*lnW*D9Qf>O(Q+83ySn%1bOB*~{eg4W5^&R{aeYe}C2|@?1|GH@1)8i_=lrD)Ll<+hUoXC$gB# zTRM48IMSfXy3@K^5WXME_Ow)nG-#V6ZyiUfIHRPyvF~VHtT_DSP)T49h1G zy;`=azad-I-vUbn;b`=~a^g5ve4g!LO0^FuuMze87pWFz`@KL9_ZJW;PmLrq)X237 zWH7`)*U2dP)fdA8VQ!lFn#q1O5HMJ!d_vh3I1o`_H`T6r zb@^D`phnWi%FeDDfjkxlg8HLZRU^|>yI%NBBGVrqF9fRr)X1ti!0J4~K`u{W|FFOK zY^hXm6#L5iSv1;Dq?t{k>iu+>2Jv}bFM{tM+=F^Rb66!~`=J+3=Ab_RX?68FanSzMl5A*dU0{M=^Z8i$iS zF{UDY?XdsXacq+WOi{Z&e373uG3@IU-q&w-u=!*CgD4R79*8dhIOY)4$S?Z~NVnt& zs9_+Pd1@pB)JTt{M*M;rDS0W?U$@@*lAVWO$4biY&+v4^^JH`UHd)VN1a?J#?3Y$f}lqFUZ7f!hv$zx zjeHA0@vCZnwFt)Oew=_A5*0uZ6I4r1m#yyUYGfA6Uldu5b-$gr*z=?q|LbVn(HmDh zgZ}g)&y`3&r|3G@W&3jCo=n+tddk5{HfGti==grDcgin31)!W@*z{_?1HfG`LM{Fs z%~!pnV|rvfkAYi3`OQJ9nKcPa2FCcs9gni9a~!OjMK-! zFz*M;T$n@5uY>jJ9elQVY@vh8?hkwmz$4)!D3z4-5E!juawhw(5I^T_)UDbbBNCO zP2#^%Kl^BpZ1pde2+G0@g4$)yokTu*7%ciO7`2qyVgdsX=Mcf6cA1h_Km8^c_jfQm zl#cHR_|Ew(@-50RCIZawRnC1Y)<-!c_7c@Tlpw(0pQe9!1dN3pR2xix-!+MRW%T{& z_WRTH!H086)j_JAksvVo?1?OL<~1By#E%Fskf!x*4X+boNe98yL4! zUPC+mdWcf(FHh!@E%nh8aQ)*aw%n_1!24Sy;NOxa>3_Kwtefz;d$CVN`XG+QzBijv zt*BVuU{=bOn8#^kb^VGHtC#$r4fiCdwpuFEPtCl4_G+nE|IqWm?Df|}eovds*5S02 z5%}m~+3Jy`z(;$)8hE%ce)<)#K3pvrXX*vx)H=cF`J^ZwJx5E;U3Z6kA_UEYUka6& zLM@(uC0m4ARRE>Gax(c)D%4Ny$|a^$r2jBijnuf*NEo2q?^C~sa^C$R){Xl2|bQ9{t;N_E3)O6)eTAd$+;2`diVaFD(_B##8&~Dz7Ejt8~h?! zeSabO8bG^wFIe)!g$$eb(z{p1`)edJP$ydzf*Qd-{JEWKf=s> zIiQ3Aj+#$Sj`O<0MSAxmU?uB-ecz4Ws*|l)HYCg^?~Ru)^Oc#4W$X0F*mun*?}?*6 zq~iWrCtKzoZkI#4_~V4<4y8YL0IXk7>X8B3;qgLpj6KV99ZacMuXvGaY@MFGCysN> zzWou;FBCGl&9L|&)dWe6;G7pp{>|oU*@8^4u&*`H z9@0LcuRlsqEhYlL@Ai=06Yl>I@1LWkf~a;z}l{I)IHxR zKYIpsjsvn4odgNI9pUy&_gjl6M5r>|Fdmnub)aJ1z+{<49&U|rY)3J{v1GK|@c@jbT_#LZ(zbOJB1Xz4AxaOS4{~fM5yp8-hpRoVkbN+^N zI$yRfNz?R_(f)H>`WxG+<{O~Q-_t)I?7nln!aBR}lbs}9PT{iGf z;kmyqS&jI8kY6VXch!qo42OZmp5yr~UrqF3?q@comak2Si;N7RE>k(__{4bn^OB%L zT3y?VGX=u)bVSx~CP!S$Yue(P{NY8a%@v^o@1biR#RbV)=4HG=2kw}z> zHq7&5*B-=cb7aFjICd?3y}aQoc>QXId)e{G0X}Al$wU&t_U{>{nt5#oslan*mWRBU zpcUpE9Or~ch z>V(r}i&jn|>G@oCe0c!Uuy#_oXP0a&CX_!1qzv7XG6RGE1lFMB9GB;{O@NM{iah7t zlnR+IukZz~L%g-0`wr`~p*9AfoR?g8y$aw)Jqvm6+BvczBdrw4wb5yyT$cw5^W#kc zWjBCQ;*e`&MWB>q$+giUP>Mi}e03VkUz_*OvrkDyfz&tG?x&hu)IV?Ue%r1FvhnkS z92X3AQCv3}>1ex$)l>ahJJsq$?$g9REXndPp3)-~1;W=ueyZKr0jilo|Ga1RQ|*%7 z?k>CCRGZko|N0`*-|i^JgG34UTOaBp2o)cop#2L zYCCh({D<=8Rmm(+Hj1+G6r~>A_o@U6ez)NqRqhAq&}{ofQYvIVr#tskP0j9~C)@N< z7EQ?$c)y)$ z)s%W-V*fn+eX^Zuo0#9!b=SD3b}p0Oi=z0o*j}WP$#MRhuf*v z%W8$e*&eAt@0JP!$^3?99EStc$iHA)XXrdUgV)U%+i#28dE5rhVTjwZBX`;VM=ACA zC(Ci9lNmX(h3#B>fNHAPKQFnDY95dc`h>uBHOU)@wNvf>zti9)$#a(}dG7l7MdVin zdiwbM$2hJ3;`?8pP(yfp+}f|k`$ki~CVQ^Z-UUH;t8W^jnpN6)2_%k$pz+f#XeZ>0Mj+WpsgNAnU~ z0`%2|uOWEucE3oq5(m^q#g^vrcIBU?#s81>Hx=8&ZG$|IsAVmj-R%J7{1G7K;OhNP z03|BA8_NNDkFfg5E*8u012?PB8n$EkQ~1-yKC0D!Cs>xMizR~^*|eX@eWjz<1U2%L z{Wh*zW=k`CyynE{Jlu3S_UW+$ESIZ`)pP*0>tZT~)|G~XCqQ4xd)%KVf@~~tz%32T zR>OS$25bM+LW_<4!a{2XfDs005>Ov2x`FiUXZ0_at0Pnanb#pq`GTtUQH}X39*5do z36!L>e?I=bJ0(ZoH~TUW z+Vim1``;-4ioAYs64c21lzI*eYUDlSL3VxNRy$7@+v}p#gL>OBd|pr^zopbuZPzDG z<(?)RC&vXl9}Vg7ALY!Z=bFw)%b86caggMbj(F0}nN8jVR??~FCu_h+PFC}i4>KEA zyZ_iiYcB4unF8@S^# z`eRvtXdaKl0{TTs(A}VRtrF!B@}0no%%4?SFBbN$&3|A3_sU{`rn-B)%m&4=t=&5E zkAosu6a7wAM_^IQEUu@mUn6fUmmIy)2vu4{Pw!j9R0-C*H-qG0IRKTzRM`aX#yTgj z&4}M$u$O9%2ZcpvZJ!U5ITi1?oTXp9!2Ajc@X0Ij{Da#de}Yf4iP^0m@{*Yai7p&1N{P-EAV1 zt$JpPBsJzw*A>i0nTH_#tOEmOj+g*J#r_ydBHu?o_nwzb z-^+de?*Igs7A`PG`#EbmxqctjrU}pOf*Z7P(l9^{*B zZC!!2`LdC_mufIXgV^8B5gHt*5ee5%z54k_@@L<-m&MxUvwCilY5)k0=DonM9q(xqWE$KB}qnz#5geeT;x$c_Z6zp8O4Ib%J#O;B0T%CGnv}eHYypt>nCy$c zr|Yph9ps$@4F9-P{l08O1t`4~zJ~NWMeB-ln3ivGa)bs;ppeNp7o;Nn4_6o)1m#g5 zPI^pk3?NY;z_FLY*N{%J%8&&pO^-Y7lRWywd@9)fi;DR(=N15o4PSLtF zA&!RY<6}9J0z1!Hj${DmFSoPwt^wkpRbdT&PE4#2&)%%jcg_MP%SzGEE8Dl()jh3ePlhaX=|Lk$4%;I zfblkaUbcFqLN=bHQ;j^bm&I3h@b(LJf5Jyz;`JP@kN2_fGaj5icR$`wwHNGXeix@& zH1HXHc-Bv9QuF1QL1dlBdwCpCIuZYo*E0A;D*r0TX?6y=YY&SZ)vNb#J7Q8Q)T05W zdv~n^HF89^b<1Ho+D9A*li^}BSS|hE?xPy~Q8wfu8eC`hn;f9p$NM^9G*p1*Gv@$TU<7@hm6_Bz|o zhsMV|rr|$*YTFCP$x$}`&5S%qZ1i$$%@ZOd8VY4=3AlO}H*IV-85W{T&qNybavMH? z>!|7lD?MjD^{t+AUdKBn8>%^=6tgoF+AnQgXqlpHfB->mGZ4r>>pX`iDcW+ve6WfH zXfOI?p{0tlVWM6n%7z;5TxlMKm3{{V!2!YP0<^FGWT9oX31ncM!1nLSLGE9TLI1ps zajG4@isuqd25|o*o{HBk4xk*uWCIb5&&N3}`UQp^$>afsCoi#hrqYXh*cxnj3(xW2 zb*}6jqCs^Aw-0ih$bvvWuIn0kBev5jvixyt?p|K+3-$SuTws{5{}$)@O)Q_!&Mp6T zoX0ogcUdiZ{BA!j?cutA1o?E!3@{Fl(3f{{3{S)UuAaAt(}czRJ!)5rEo1Xo$ceR@ z-nwF(8#ws+rwY&ks@nBMo#U8x0(6AqRBI6U93oG<3BZldM6Oy0_BE1NT1$DzXOgZ*G-D|a(qbRRE@~uHSjz~nq<#A zVCsMBW4s+@YNYGr5LHlDhz-$TYX7elWkYsDe#M%~js8>rzCl`E-T%<6&gQEA%z4{) z^VkgBNA(h`Ih{yh`}_!X58P`2XYm{chZ>1WVEo438!1c;37(3GajJbvspn3C?`P~w zLqFr^P4F?tpo4xIycN{0_bK(96rr(0gvL4%jy^xSmkO`2mrh){W`K{!M;6EVc{pJI z|ITidec0KRSQ+QM9smBuUKY1yT))T0yqL$YzqgP1=d3&Tag5zJ-?J5YmCRZYT z_4(JhSbX={y-ZeT_KXd29)t6#RG`lVwX0K1Sv|5rN`xY&{(YB&MDKKv&G`4dZW6u6O`b(Lz_Y-3EKjncg-%15Txpeq zr#B9unBp{MOHN_HaBPrijZ{q437W=y;@9q`+99Onyh;n#OIQ{vi-~eb6`&Nal`NZA z2B2<;dL=v;t@?b)sxOpSjWmwyp+@#n>Uq}*q*>teR)KV%S7{Y3n^%Tm(t8OM z^oB)Ha807wveo*8usH|UP=Jo-ca70e-anwDAFPGA_f56yQIXdTJo$uovng_{%cpFt z@E?d^^-=1vvSmwrQ|)>@TehD2mUnZJRM^Pz6N>cCT~zZ;u4MKWm@HX`yNifVfR0U0 zINsuf7di*2g8c+2Y=qoO>%qNL!*gYm69~#(Jy*#4#{RJQ@;BA4YEicE{c>>ko&iwq z-b=NMF4-EZGh$;5i3OXnP5egXUaGNL7ulERolZQraGrS_L6%(y4f^2FEb{$b$WM5E ztQi2u%$WjVws~0F^~c>*D;X-Uy&KPxnF8?x9P{_N$PQbMG6hJ?1L&I%(0B6W=gFl{ zKhOBXMvI^SQHfzg=s%28%>m$M-#j*pe0Mirv+~rnXFpHw+r{lR$UD#KRO`dDZGxy3{64j7 z1NOt=sNKi*H1vV{8dAEOYAp*Ogzw&$nu}qEnWl&19HUPVP={D(^;~<$c;Al%%A$Cx zHe7-J%pMlY#rp9@yC2buc0cZP@P4Rj*Y{XIrqq5H&sjF7*AN%><4#A2`9eI`GW~b$ z9;$WPb28hanmIr_G&}wP=_q|4jpb3kG%6ciN~5b(p5!=v;$9e|ui&-h{hd7jh5dfu zT5@uyokJ?{oRHCZxOajN>?%+u+jPdyB$w{r;v$hfREy=}+2hgsdjxWB7u9aKPS45`ZD1-@~3WA?`_&q9uwu#O%WQuwVP_OObC{1 zaQ2O6d7#q?O1F){f;_!T=ef(^gaq>KFymut*Qxnn{dpJa{365IaJ(lEm<~`*&6h1} zrbtpaBx}KS^jG~<`?CnWNeL8lF7h&O?>Y$-hoDBzOWr`$V=D_!(BKN_Zmt4#1vLRm-)JR>`#;*y>A1Vuj>n`8&hspqiJCh}91d1Ww z?|a=_0>XEAe280*7RqI@i?sB|wl4FdE7TC=veK`|$x1@*SRI9G;4u~~rZ_F;I(N^+ zdV`{VUXsT7rNE(fV*o#-FIJ(hb%c{Yn}a#RIIyC;J9>nuMHp}Wy#i+?hD0` z@9Ts`Vlm_|nFY1K!acrTScG#?;^y?@dr(+}&-xs~BL4@#?-fC<@8*`T4bUs&L~{IE zj{D>Rsd1wyhfV<2Vt!F)u!TZ1;S|b05UVkE!Z2p8M^N@niYIPIeBC8_OT!V`KU3+_nGR+RgX} za~syjkFW3_JYTqb{5Z4!!Sh=ujCW+m-l@>j-g(MP4)5T$VSCI? zIOb^jn8)F}zj7Hyfi;uaY7&&`}=uf!g)#cKaL$=(u4Q)&5GUX9Yk<5a8IRCtS>~{R!&1 zd6E?a=$N&O>#xtmIo?7po*QW93@Y(_( zL3XW(T|-?AWuTjOQtbzYPU9^~J;;ZJ$G!PtCoJ+ighgRIzltHh{2{27pZe0OZwsIZ z>tT_P{-g^!e|Bz0G2{cBIk#j8YGKylW&p^Cn_Ik$w}ToPnZO@M z_WVwuacqNO8OKj-%hm^d6MM@b z=Y!wAW6amW^ozG=lV8MHz7ea900Q=NjE0+cbNjd>PPJe2JXQ8wa)c_;tNGszBUGuo z8VHW36x7I3nzrBUJapd<79$e$Psl^};#y`vX*6FBm7IZEl(BeTyWPJPUdE4@4EZY5 z`UhFgC;R*G09ER;c@8{#cD;*qV}EgfI_-K7Ak z=x7Bs@&=1{;oq$D0zp1eALn=u=j_4DM7PAM%nF*vEX{FX2I4=aMs-TpwC;hRaLqu6w;%a=^TjA?d6s@|y2{2ax1U zu(mDpm0h6J^8+W4)*Lm0`pVATRErMNgy4`vg$^Lt&oe_*F<-8K(X6NE;JU-j(V@)w zCq&oLrP*+NNxyU!`Bnp{kve-%srR_a#hGBW?4;VKGr>Z-O^q4lr=-O20=|XvY z67HQsr;(y>oHs|2yeew*!+*uKNzwk_XsHk27_4y-T<3=<_5A({HmmC?_0YEQHmg7H zpxT!y^*rhX(qY?cs!^WHtF%10muAXVLtZ8C!y2&`);Jb_+qT(c1GszJ_*t16556ZX zn_G5XD%A5v?KbnqwR5@c#?@GtX1ihIasV4k*2EZv>FKqqCSZ@`R$3*yZL9%XhM&HB zq6|MKlWgCW!m)!yswVeiyE$)UZAfli+s$nt6M1P$W}`bUm)U;2YpkX>wj0?wzRk6} z$M6uYEIW<$arG{?uNVd-_7B_n$__4P|(kx^I@dq zh4VJ9Sm$bvdn2NjyHhT8s~`!}cWGmg$HWR^j|-#65R7 zND+%wbH)d61?$&s-2Q`l9nSxNjs5vXTk2ay`r$UJb%@@^m3fucCJ`Dpi3N?Qv%k_t zHMkiFUc+^`-)>8mAhEP?fiVl<7@q0tSGdSE0DZqK%I9%FcUFbofc4Fd6|2evz8(tk|b&bw1u8d#&dR6>V z%|FMjak;h@H_b3@NEIo z*~W25CboBWVjL65M#e51^U~%sf7(tx0J3qw{{L5P_|A*t_H+_>esxO!M!CsM)suLH z$K|RbB>Y#Ykx9Fl%`Gtx)W}?s=RrNbjr%c70Xk~8^VsZEn>~+=w_U|1ffC)${Av;G z|9MGZvDE^o5$CqlzV_%Rc2cdy3Ad=j42z%XXwfGio~#i_eKx~!32fNOeQB)#%Hr+Z z_tUza%h2XRyXMAXUUS3zx@<+W!Foo7V9Z;|a6@hoL8;E>xk*PkrgngAXEe|7Xc|N{ z!q#B#^+aH?q-qztcVVIR^){;gl2T7=ekH@=$9F|gBNc6|PcOsW7Jsf9!S6+JomG@C-1@fGG=9F5$5O_Ise)s! z=J-Ku%np0ZhgqJ9DU1t;>!fU&3kiomOV+?!YtPH*NNMUIF*iltB4;8}ma)uy5aLuJ zF^8!#N_#zE(_TT~{0>g5Df&Cu#_(nW!gjt_&G|O{Roe7-7xS@1kOn_R*}=tQfjR$t z`-&KQshXBN-;tk@&$luin#H(2(>99r8JLK*fi(BTwlSVfcTjD`2xWL%Sv$x0eBC`j z9u=S?X4FakX$Ox_7Sh_-JxCQHE3M5zsz9zBDoJpCsyYv8OSY;9Xd-Ib=>(Bjo_!iT3ll0AYK+Du$_&pwv^72iDIi^;8OK#J@(GzAjgd zfJ2%NAm&8B0LDHx=ldt>-^c!6)l4%bfyfTn=Z;Ygb*aMwbo^^<%>Vh@ZG6p>VCNFe zpKullp!|FrugizyUz(CTX3Eyw9sK;k{g3y)O{wursNCVGoi!!A>Tm`qZij3^u52~r1KB7-W4$Q!PRanKAzu!a zKLxd|4p3kU9G~9Ga0D!$0}|^Bfz*pqFY1iz3*}I^1bWL;P+RQ)(jf30EuRRAA9x$6 z*VSYJsd7UZz9$QyJOpy+Jf$AI*2C)P2)!zRG7IF;-LQ@oxUNfPcGXLv(-<1{SNo zvcv%vh-$MEsZ7k8h zvK%f@7%o~N`&Jk7@1M4e@lF`xyz{@W;NL(RZ3SK%uOU~BG$OBeLPzu-H|ayUA_GcG z0or4EH;~;eyhe}@pdErY5bU2X_4~maNUVj&y0YI--9WaqaKAdzQmX{PGbz1;=M;y6 z0PQ9~DYi{osD{@YzU5`Mql_I?ixw_mv4<>Ys0DvJjnw_p7|+*0T1nZRZ;mm0AB)NP z)%MS}L#Fz_qJ?Ve5ba=ldxe*DPdHmprm9R^$MiFWt>F}oM=4Xv>TSpD^^A_t#2>cu zx`YfDGoRNWiHz9zQ~*u>=vCzI?c@2!li>h|&Rj2m z5?xiCU*ZsIqXH=B0fNj=wua-QG97iNP+Lu@GItWATld^7HPX#|Y<#a^yZEgCgB!?` zBh*9JWgZ`1ofRLJL~?%dq;b6d;@7in{PP?ZuX2&qSjdg{OBwoL-Bs~Z9|6NuOMb%b zupc@haY1tGrsQOD=Y=+^9nMoD1GawO*T&4d8ryP za|B!mV_>F(d|Klmyyirq{*4xX9tt8Tx3-SzHT*33WCFgH3`(GtYSTcC+y-joPn3F! z?O0ZGZg^$Mb=>A<*Idw(BUHodC?mhleEqTS|9#t-OsNi0rT97sJ_itF<5zAZAGYv! zO0rnpOoi3Y6hRqUqehZaaUdm26tz+95ncm;)5q=`N#O{O{VjP~s+FCfv}D39)gx5- zX8Ln)+(>d$&ux+zeh2GI4#%8l&zLt7DfLW~REuW=(l+D*F&lx~4r5R|t4Lmzyb2Wm zAPq7*CP4d#k2uNcxejt_xs&uf>|}U0{-GP$dylkIt;7wrtrk_xngyZc!wW*?0L%UO zdpXC!IowZ`)k+@E zsO_|<^83%A?ZC(wovOKfYN=$LCQfK z%_GO_|A}qy;m_1is+f&g1lB(mH#76&=5hx~9^m)Z;`?>{{h1?F8GZLLzu)tc3(xbM2VXXHbmvqUc3rVR;a0v*<~gd2zMHs-KnvA6 zCh^=syfzd0;%y#gZ>lNECpDlp<2;^XcnBWd@3@)G(cIK;*^)7i;MGs|m zh`YA(TG;9*Gyx8^t7R*Q|iGrfD2Sf);Wk-+bq8ydXJo^ zO84dpqq{^fx|ci15`f;NtmdE4+jEX8_#5ZhTsG3z zuhF#U`5JYe=JSaB^?Td+HQ#Bfr1l)%`_O(idWtHed^MAQtNQm;N#;}-12s-|9w1#` z0~})#`Nok9HA3eK##LK6CYm`vyt1&B+il^tJ5HF(!H`)U1u)FlszQ>eM$E5+fxO;) zr7C1D2E%;0DrDXThIz0mWLAP<9;gbLw}N5rsS25M!7z7Kh0K2f!)&VxnKQvKTdG3l zbTG`#RiTf5QWg5Ju_|=>$*Rz)byXqL1%|0rh0Gi<%#BqcQv!D0CF{WOBRx27AwM0W z+7#S#B^Ab!Z5;Cy`+X)xwajA3ciwi#34Hb!S3~|Ax8HH%$T#jg@%j@*i~TW9uRk2J z=@rk;-%_PWfP|mrFBR$jhvu+n)(mm}aQF|Sd!z~X$o#ET`)S7L9%-71>v#DcX_~l4 zmJMCLNBqC$Yn#GXe$}?yFbwdM{N4qrAh5NCYBw-jOn7D67OFXJgM9o(kL1<;#k{{L zx8FO&=|FymDmb>*vsC%jmFcqy>9cZ(YIv?Q+IfvCOb&`V$roCwc4-)8wL9YH7k?>! z@#}ZSFV)-?x0c@>AFTUwoUY5Xaf{l=`#xYS59#7)?Jd-gIBwA;CP!t&yXV{f?0POo zRXO?mo05acxsN_iHOPcgeyvFNzdDC}xs__2B9x}S(OrKz2Ex!*=6i19HS4*r#eZxL z`Rp9rW4kA}va^AI=hPfBx7GGlf5vx`LsYr!8~t-wy!sCX=$LNjgsP*my<5+YabM$Y z08LwR=8{_g+?O1XKz+oNJj`B)awy7<_?1|0zK070OuEl`oBHTw?9cb4+J;G>s0-v!3g`I{&hr8}&}!3;=jEL^~F_uE>iw(cG`sTW~6$}OA^OxOK)&t#qq6|{)eM&v+ z3l|vU?(LpSzC1{^6O?+^-svDR$RXb#4Zd&hbGu$xAhp-aW2{z<{>{x)(kq>; z!TLOj*KGLx7OI6LXk=@>#zo9>u-M-#g2b!@D~e-T2&`XTW`i%*-$Giek*&{5(~o|O z#SeRzF9%Rw18?uIGeJp~qpn`8dr`N~f}py5RT&6S8kM|_(6^)v`xeavCAxeS`x`Q` zpT&AOMzv%m*Yi&fP_5()x8Ece@@vNjczpU{T-#guwL*K(!XO>D-bYaPs*$Y(rJhhG zkXI=6teV4e%bIxZk5@m}!t7X#hrG;X=O!MT<<OMTE~_pp5i*x2FHvPc5_E$-U##cEcz-g$+c+d;=;cyz?<5hF z28q+1&j||Kw;O|`M=I85NX2(C++NA0pS~5W4Fgm=eXDHYoCq19U|XNIFbuW?@=E_z zY9ud4HF*+rT+CtlP@`wcA)Je1C{0q@=Z{{+XtN~7>F0C{^S4})R~>$vD#)WGJI+qD zF>&x7@+{P^Q+(^?E!49m6UeXe9IlbADkbfLT#|a10VudvYj7Wd99r*y zskrtkrAo3!wzjO1H-6p$$7eusW4R=L5=(iK*z;4kpQS0 zVoyN4yGA6hWrLMmEHaEooS#<*_!=iS%S=A|ue3dDq6}@*+qErJyAHsOX9|9ENRzo7 z_bRR@kD2e5iUYn>zZI$0Kf*EgVG1zZUuIte2&U_<-Vu{i)Bl2KnVZ0B#E6l zA4${n4_y*DJyRm5=1QceQX<`TBJtl*O76tHTEuYxa1Nfc_dcEp<_XyV2P`sApj<8+ z(Ehna=DR!(*z7^sdzyad7Va0V=DAc|KifjJ*jk9ca+(HJ+XwyS(^P4-ebBw9sFJ>? z?rhzo$|DJ zd*;j5hmuGCVSc5>F+F)+pJULD6_N_|K0GUisb?0bkqejEibWRtlk#aKB~kw_@)pUZ zpJK5)1*7r3qHTA@ehjZZvK!^bhUf8&=DzHcn?EZi3iPB134bp4OP|?FwYdOIIDd8f zOG#>6bz(y^m!S&uy9aolz-h_N@=ti4Kmm)fmRM}~5muk2`g!WXwy>SE|BJEB8%W8@ z*tUy}4|!q=tK!Sg^O%`BzE3Xqi-4LxNU0|`Z~eHuwDjDK6#wLNAYG12Fn$}2|>!@FHHR74@m1c$!#A+Dkil88Gsu$rb-V<`<0X+kh(iW;s$32ib1Log1KGxL% zin*C;bz)Itx1G0BA*hiP&vV~fF-$ue9ioXAsfg7CX%VOO#wbY3C+wcn4{ z&702a=H;#b%({8$e8_x~$3Um$?iiyne;`{G0tAx)?fy**t^09ZvSsUYTgTh>r){O4 zcb?_>kfXj-yN%Qw{=f949)6blQj-83+0TvnQde*0zSL|0cgkN{xW(oXGiB?e=Q+Kz z7?BaGB*D&In}0cuWpr~2bFa(Z6S5_3nHaAK`qs_1-NpgRMqZb_iDBcoa~Oa8^f{`@ zsd!|RPbE<5@`13JTb21gm1^gh-}{UN%F^sHpZqcjlxW_V5C4n^N~NGi!nUv5pCwKA z0pzG(0ApM|`$9QX@&=DbWii%=czkg5YTg#hb8_&Q-ntn;P(Co%sF6=5)VxpOTbnSJ zi~7v>7T;MjH<&Zs_`F_LwgwOo$d8#D@u4`>+W^q6)XF9cxZ4=f}1yKIp z%xU5hrJmO$UW1S4W4w8V{C`2;`fMuC+@)`Rmf0nk53oUm;72ws`Rr?MfWB&g(uPO9 zBx~znD;1Nnjor9xWXjqf?0 zr-O5cx{SXmhd^h}XdS^{GJS6>ugCqI9p4Gi2LOHkr*0td;0@%0U0Y>*Zqh4Pth=AW z+WJ#7-vcoxDC?ZEwKh+-wgDun9B@3k?4hy`M(ny;%Vw0Rd9oGDfW+?s`Z~nh$V;MZ z{MpI(1@50iC>x?~EI@FTD2KivK+w>5z1pHo#w$^e2_!VCl}oT3_c423gi^Mr&Oogo zG8`D@Cy8Dym%Tc|;NqDobwH9OU>pWDQrS$k&%|_q@fai%^FENbF}m-|Ar1C?ngS@7W^x?;>z=dY zt+RksGhC0u&2Zs~6DYqTKg4sna}u{9?c2i6_ogf5aWrIsGCo$1kA0g%4%Ows@mADR zrU2QI3nctt(c%hO2yE+HQa1C!$cY&s2K-fbpOBW-lnKkK%NmZAlvP~6;6&IhZ&=q^ z!mpY5|I)ICzLK)~Y&d(zFjeZEa8}I#1%Ee)px`%bROOO|&r!|i;C}FQc`WPzX6r%Pb`;608YorF z5gJ_V08)|3Fbws(x3D-j7AM(Y^Qq2Zn!x-2yd{M%?i$6zuXjV){q*wq{HwQ6&r&at zQlk?qC6-w3Gnt6wV@tGM_K$t(C#R%k*a+X&NP0*f8?$B(1mB8aC zOq&-n*)T`8@OgYUF^$wKSj_OF-zw{kS4uwoI|0u{xVy-z17h z{UA2Bh=skIHaydeI#T6iP~ww8nE~#`5)gYI2XI%>_jl-Exx?+ZGt&sX( z#`oUYwyC)~TQ>X>lvd}-R*NVwTL8+%w`(k>B@vAXah5A5$`*e6zAaRX=7WX0n|T!| z)iYQP2b8ssR?h&dJ^-u+C570uI>{MKzM-_&^(i_WGIE%GT1Wf%}a=9?Pq#8D?00!6gp3B{~TdQQ)3m6=d;P?9G&Vs;?fy%Lq1YYMwZ5&{$68W#i6I8@JC1O7(wL#@U#!25TwwzZ?cQ zx^xCu)gm8b7}Tz0r9d3EJ-5UGXOkQ!%t|g4$OxC;&iV(bVpdj!P-Z_oKoxUgMTq&> z2B;F9AsaZKd%2zUg~KCM`3;NBayO>?fw7-EpJCWQMu+HbJSn=50=RRc0Wg;1+|S`y zMPIY)zkb!uyN}KR<6kb(4rN0AeF{&KN>h&yuNLCNm8gSBOb1Ktf%A(+TmN#zt>qc< z!8&JrNOI`i046!0U6;uKTZ2Bc{f$U!Qi}+yzF92xqr@dl9ikUy?56uiili9-$ zJJrbV?Pnek)JT!5#ha|*JiF}~ZX;o}EIch|D3VttrJ_J9&lk{%X8YwQvs&RS zZ{sT4ZdYX6?j8V+h0T1Z_VemhTn^qeLOYVojxasYEfocR{|vt$1L&w13ws;x2W3+Z zbi5#f+gvBJJ|JIcl|UKDgdlzg#KcG#zO z-Jnrz74zY^^f}K_ZHWZSEag%Pz!Ss$EDI>sTtXy)>PzrOiKwmJz>#(wWQ}W5eA*#hV9$IAmFu%8U zh}+x+36%aGiKOZ)g@$>pQB&k`NHGZ%T$5Z%m2T!Q<93Xw&1+jPQRQEMN;T{wi~rSl z`$L;}9!2XHWP|C{zNzGQs80d7e_=m!eiPMjzN_!%>-t(V)f5rj$u+z-$E~17c2eqj z{2n)HXZ}6xqgPMjd`n(kdxm3civWE%&*6urqs)14VAQ(;A9UY(~dn9762FpAmkw>1T+Uc1N z(mlvxOZsY5AE|Z-q~=+H#ERtE13g(}*OdC%zij{9)C>pYn63(=I|qzku8}u(Q`z`@ z=jR*20Xf|g7(zDgN9e2R^fiXhyE|5c^Nl+Tae|J`ee3PIQ=LBw>LUMk}^Tj#^TZd$rnb7C|-V~DfDb+f2p!A`< zO2#L6F1$-pl0VqNW2kxz@WaD6}&M@>Leg9-|jK1F<;`e?%NVSqGXKgeWl)H0)#TckrpuC;Q z>AEu)6q`1ikTy{tL0XAs@>&A_CV(5)9owq0$K<~)kE|G^+IntZXY&IB1Z(bekfjTN zjP~jAT#^`~+KcR5gg$UjA+M&58El!clgW%@@5~;i+73!Ro%qhH99y=*uI225@{^rI zH0Ynh`~s}cgU@n18jqE++j(yaxoeQOgY*#IG?nbZbG}Tf#j^_%jzuN8PmxKXqFyI?t zz!(G8%@;7XV+%qOS`gOQRxL|Hl7mTT<2EEA2~8lDE!o&E-LhRmX-a>`-I`O*uG`Ws z-LiYUE#1;BVV#yeWluS~bW2;4koo*x&oeX9NH*>6>-_QkeqS$!%gpo4GtcF7zdSQ~ zKwrY85BAG&Soe^^IwNND_Zc!^|KM3i$3Y;?bZ+UJ0+#&al6_Nn9%sqkDTnfYNA@M1 zQx1(iB>R&7S%=ONWgG#D7|chRTn?9A!b2+J@L4?P)QN5i^O#MS665c}rRSc&hX39} z;eJ*hP;^pg&Z!06%I}si9q~3U-B9j-@TH_vNx1ipS=U+5;cdZ#vBUD7z_ABZ#N^7? zi898OzL?*#bYu>f)8jAU!J;1iZIcaHgi~WL;el>Z+2-x%aA;`~?3qh&inYl^=Q|%U z-g!xRXZtb^nLZ}Y*GzV+``Rl*?i0m&-#n->B=f6w! zqjPLdzm(_BWE^|`L`dEX5FKX-hjbqj{~bK-IG+p2@!^+}@awjZ$o@A(8JSaYs!N4Q zW74TI#xK92jU&ttEGfIBV>EEha7f5BzmW4AvLAt*NB(g{=79$R{>?~^D{%R-;5=^5 zIkmi-!a|Z9_cKj_{e$Pq9*B(gnO-VKG)MM9x14Vq`4<{Ox*9`Ta6S;Gu#hq3l2B2$ z`HUVLgq>D7&N09I($Wn1o9rLx)NiscIR9dVzf-n>jU&{ipE?{-exJJ>r-TZe+TTlI z#}30OVW;8LK4v@3u{;pwCOtSX-||4nNP58eXsF^r63QO@@?U9)tzG>#)&Xq)#~n%@ zI6Fe&>slJintQ45FV{EF<~EGfH0th^ssM+{9S;uE($YWOQGM{ zjDE+yQg-QsuChx@pliKwk?b4v_{Nz0n+vNM|4xrk_@DK2e|`I7%An6pIb=$LovmRB z7XJE+df3@I4(RcXkCGOi$AZrKGbOk*W+{_>g=E;5OvTrk?XU!yzh3&UWIvFU`6j#9 zX@GtIRD2!$-ojtQ0K17OLs!&U{~L)iXj#&skp-Rgx960-(D^ah={tr)WgnA$tbEE- zOVX1L{p&-rvo%fcqHynrG{kKp{*A2#=b0`0eZ{U~^zso=29qI7W-vLT%8b8a@S2LR zJD4A`UH(n_54M**SO`2A^OijjI`Qtv99b{60d_{eslO!q*q6#KvF8}={UYNF3jx&s zd`{AX8}pNxF8I_LJ?!*0E^Qw%@Nb5wvT!&o!}5UqKIHie5ef(8cSO&>8!}akF1z##qI>gz2j))wDP1ZqeL!?C zQ^13zKH=2QLW-TP#}HcslQ-(zUx-kc(JibpZq9v?>}+mK@BH?c##8F=SL(|;fAqsH z*{*gI!(YbvuSF=F!R-8xDWj!Z-aGS8VG94Fg1^Ry`kVN3&mV|T*z&P_{fP*L`}v+a z6Mt|2w+-fZfA^f_-9I#1-+j<(d-tP2`MZ>){!aQI&)vPmb6|7NtG@@Q<|TE&D9=ld zuRHbei{CxBHyq1Jw)H4FaJ1rq`uk5z7jj);oqOtu9{Ih1k6--uB;QMzIEPPu$nBs} zHiz5Fw-cCe!{$;FmUD;B$e+j^rp4zDAG8|YeIS1y@}BnFgKGRH_C0esZ}_r7j%D_R z<=EzdWDGHR@nO<}^UP;?_)Fa>wm#-tKoEE?aBMvue3s_{=bzW(*pJMZ`@{M!IfuaT zd~GJ9_4(&FFuGihZ;b0v#AulHr#n#bVBUeL55B0!gD;xF_lNzeOa5)4RQ?<6N$1Cs zlFmC)JL?ar{!|jaq0*C2nI}G?Z)Bo#j=IiYY>&?^eqe-M&f{gudAzho=keIweqWAL z<2wweKCDSUHSa*hgWu`#4J3E|$l4{(VPP4Mho3L*;=gZqzCJ|ZGgA=#oz`M>)>o-8 zFE5CV=A8NYz-E_l9c}D_FNpQ%z*tD>&qUP z_9oa}$8qS3fSrGna3O{|TMrgL$zx>t^IspQaA!J-0-17s8j#M~mnFll>sTm%gG$gH zIxq$HFOTz_OcA3E-WQYM$K~&81m?5n9mPw=aj0<${^4^|aO&G1lbyBwGLXJLL%#pn zDLBR21g790?lXRt$o}Jb^1U~J^v|;~jMxy8^TfXyn+rQzqqg4zACsMp``M4={`q&6 zrs5Qk{6iieoDO?H&O!esq{o}ig=HUNp4`t3{(S>^{+8MDnzem*ekk|N^j&oQmAXSq z$K|oubKjjc@wt(4`MJ)IG|#2$4mp0Wd2Z&!=kN#lxseB&=Q4GNzIZ?O+{-g2K3DcT z`8lw0@8gh3GtQ4wW9 z|BCFNO-g^0$wYbni_ahLqVOe2UfW#5#PJ=!BAFj_^1WXZWjv?rtY_yJl^D^BIypvk z8uIU@eG8rSOdoF1b=Kcj_7?wwDC6hM#$)Yto%OefGCqR*JASOce`06IzvH(^C;yHg zd!EhrrIfPYy#68aI1U^0BhBv_s=BM8c6YtSw%=;9+xFY)YAuz>L%!P;2%^d1a*IwO z=oS2;!zuVhpEuwNdi^djP$FapV5_gMtuGN!Q){=C2zhzh26;^`wpYKm7}OL< zv(V;nyBb~I_JF`aogKi_ruv$ynu-zu`K_Yp+aG&K{@>%}Q1=7{mq&2;8(Un@i<7iz zarm8r+vRB$f)0PP7!-1{1FI%|BXbKA-61^Yyjn1-)K(Kv>T@7IK^}|0Mxu*Axz)^8)#eBaqTlcJ3ps9= zM-;N1xq|2k`i}@Jvl~~gg4NbwsjsTDSJl=;Cne9o+m=Q<$ko1tzVruXI^${^7>n2g~k@A%O5Q^w)nl?V6+%$^t*gPLF{k^MJLCDGWl#L zvYqmEK!{Eu#@#;A-{uMgTwV_Ym>82HM}(lGnWL98mf#e9qQ@zE8W{jM$X5zZuNV+K zUOsLhsO7z&-__hK`UBcJd5!^wxfmU_dmIPdT>5Y*DGO3*K7bl;P-ygef-X-xpLjcO z%aA4(w0j)SJ6vwwfmXQX?+%DUUS5;e-zets)p?rZq#qwn?o`aj?&uWU-o{qJ=?FRw zIs#%;u(XOt0&w_6zEXu?*b``THMazLZBx6aG3fGo1fSpQ6aDTZnohZJRy$=g4~m+* zjegM)6k~%{d7gK;T{3|PO>ReXK*(`(1qI1@oOLOO>uuqGR~{-k{hR6rKBh zj$lh5-wFO`L7TVT6AXaOt|_3IbCb*Cl##6=L*7{Md0n1h9O&eFxitf10heOYv9(B@ zv@+j0i5RG@wk{PKylrAkaxq!&FTtS_G?kzO&z7LR1mz{D7n|AxiV&3rsPkY{%*hoD zUQ6S(P(D*HlWC&F8yc2Kyrpswudg%NE4LQ32mA$rgDy`Azv35i@u15CCLKNE;d~V2 z=NF(LzW~q!I>3NO9Qh4Z6*c)_q}SpIw4hD~24n9$nZFs2I9#3pV}8Hb=wPxXzpAFe zZmOJZDSJwg zVk$vOLkUu=J_xwi2yEQq`6!`rTen zb3UvkaFxK<+RRivJ3lY_*~uve8qw}|Bj9>Lgxl39dIBP3u?Gc%`&~`&`MuA(oMHf8 zzpL5hL7T(Hp(Ofou-)Z$IvIm2jr=hS!RHtAlwRQT27}gsvbB=M(9#*%9pLX%<&3m5OW7@N2Q&Uq@ z1)~YwqsSt5_>^!3bK? zQY!=@J5Z7WL0}gMID)P~6Ek{o&@Vb#10~>0_*{126RIjvu7#ZEUH)LZ!@UX~Z%{0O z&n0QFOxLbh?-dakzy^+O!8mC#qzkVCF(yyT6&8cdHuR z=kjoa;yF{@PC=s>bAS*%1-QL4|9Wh%{UU|K3 zSM45~^-ndk);?WRQE#$NXjx->dSdICYw#z!RoLxMw)2azE^9g&ZY3P-%{!eNIesI^&y=bkC>d}6zRoNQM? zwrdr)9@$?m?Q+=vlhp}%+XUsFViINtwxD)r32z%Sfpb~G>GI1L%za^3FSHB0TxQ-> zzGODM<|)KXIfb9pJ0)my1X{V#UxK_mk2lXF1`m7vt!VUmn%u6&V4wt*?Je5{8@E{* zA^90}oGzzqUNMt_v87B!3=V;ypUK@oehQb7GIh!#Qn_~cTK5OM?&n4SenrM8bSnl? zx)qA?l|%So>~i&*`Ud;%Jx}j_=GjL- z7wdaX0q8$}Y-9gHr%y5@Pnl|*#tKA~GCg(1%vq0q>QCMO|IWeIzg-4g$(GWs%KBpf zkyn~Fd(PbSdGj+e7syX7T(tO!Czl9Imo3lAUa>M~)#^35dHDql2mep6haV}~t2wu# z+Ei14-S+alV*H}#ICC%e*VWfn)Y}>w_FF1V^;|mp{4Ng@&dgj9wrv#(vAf1zzq`S1 zvkC!Mv&Ru^_lq!_w56(Afk%aSwHhx_&M|LJG5eUd--XqHHl;a>11WwJ^%1v3y z_@5X3j~pe|q2k8N?W(vlB?jY$@h~yx7Y{q!?p3hXGzf05x3%3TKMCfB1Vwc`zZh)y zdqk(&Ee{FAEhH+>g`lfVbPC?~AcA6>&+B*ik7yrrG&3-}9YN8*3NFR-+g)F+&h?15 z-9OpFQ~Jv8XYJp zC_q6O%1W>r*)OygWWUg!f<>FM*SoT_1uQCF^jzUi>~xt?;WESSGGjRx*Ue&Ze@lCt z!?T~;;LJqyIRb&hvbEUk_qO}MCRl=&V9+Q3A1FZ+ySBKP<=IQWrBn3pben+tB++RC zF42ed8vTymA&EXBJOtjNwfXDv*RDr;S z$cB7!li&9FMNX|ko7d@Tay7=NQPUhK*tmJi*6l*}+QN0~0|E%aMjwMF2doTTFiv15 zPrHu~VY6E*_nWI~touz?D-%di`ABw>vjZjBPEBa~AXnX9=2WgkLDc9M{lR>n*p^V! zDjq>YL$%;`9ptRy^0PUFh@8%VjsF2`Rm!-a14ZWtYUiVw7t86v){T5rj zeSdjXwM|>O)Ao#9x0{=?jc%9d2?}gdyblhqxLd8_k=UJtku^`tz?bJRc`MeDGD9wS z#g3p%Kn!E*+U?a1s`%jnYL~~UB30}Nik?8MF?WDlyn!I^wI(VidH=B)$snnz-M`0H zUse9h{>s`0dyQ$A4SPhttLX^ufjh_v&k2F{gP&pom}v{o%AnBZ2sXCF22_@zN>(ut zbR2ZM0xhCbkOL_k5)=EA;i##11p@7&9PiA}M~%&1Z$TD62?3wj=wcq9;E*xQVZyw7 zZc#ftLY>K8xqp{wFDh$y*^nJ5$oGgre&qLIrKjx1x#2*9}jpN zTg4#iYU}Mnwlg>WFP}*4M*Dy9Z>$#^>*Z*+^JsQ}{XZi`T@GK5!{hZFY4f%R&|o*& zQE4+-QE#)?qrzrKO>J$R0>|pwimDpyZm`u0*?}^?Dy0y+Dr0}08o)nYTW@8+ZIGMQ zJ#FQ{C}4uXx|?-vdD^OirlIOtn|i&=YTu<^#~dhR7Zy3Q3)fBfhX#9XJxq0VHq=x% z*ikR?B&X2k@V9b%&gVXY2GRe#t5FUzAK}?4p-DU}w7ER(K`{VpJVFJBTW-h@z9ouN zIeY5zG^3n}r9jXTY!3+DR>zSo%#>{pMq~Dg1Y+^Fweh@AtK&$t!1E1lKDWs1Jkgme z1loO~zscS1Z4U^JploahTtN{HM*=~yO&Ks(@cM;-T+<@DeaZ^0v5YQnrkx`yS-Und z5O6e$Xb^+y^Ni6FV8ir_M?5UF2Sk7LR-@Z1Ye%mq==Zv{OG^Zu3^I>51~nJYn=~^C zhkEf)yBJ_jhwLfH&ji{V8^u7Nsof15v)|cJbqbH}VmunHwJ~+*6rJ(6cQaw)_BJk4M~udhkSjEL8R(h!!2ned%T>tcom1|V>kjz=kI2)Avciy~K#G3gFyp%B z5hF6onx|sg{lOLv5!u9M@KZq?XJP05F^F3nOff%#&Z2l=9f(d1@v6=irweUvEl136 z&d-%6e6T%mWR+$WjyOlHL~wf>)kKwoSB5yo5>=i+dsCCEk!!&~(CcSTg&gH{c@%m> z!x2x=(IG$2QNS6Y-NO`Lv&Z#<=!|Q^hj92EZDLSlrm$ad_?z1qy96G^MKC*<&N|dC zdK!7SR~h7y4{+oKTO7gINIW1KC8vp~W~<}qbh*U<%;|D?mtFQC zG>W-F(ag-~kh4T)N5Iu6%m0JyvV@Jw9&GXYT`$P9iz)T}rrq{RSZZr(Y!{7@sayxmkB>Ep;eN|K5F7AGb&b$Vfr;+;#Gg6?=l3lWe@g?!A zdRw`z-c}Dsd(ew|u}SpH7O*m3rkrDy>f=nk?l)D~YV2Gh<(ZmAkJ`W6b&zjKC|H+Y zh`D~K#Vrm|sAbZgOOxn&cLzj)^8oD8kWsw?aW1`+<&BOPo z@OnhZ$c#0wV?x^_XSD=5HWBT@<_WrjM+CdqD^xrD&7yiEZ+Cr_rgpbS*=Hm=W%()C znL!ehdYoeTiW=lJAYX=!2QD4jfveO#6b&-L^GpL@epP~QsBi?u!;Y9mxH~40q1=l> zfDyZ}NAzKJwF5=Jd9V|j6_P_~0K7%*$9@b*{ z|9v)Lhr?4Y9^B>dn|%IVjw3tTJv-XnruOCr(O26Ttnof?6&ume?%Cz_*xSXYMW?-` zz1;6=a0H=Sl(gl}4B)a37+NP0W&*d@Nt8Yl$XYK^&P?FgdWouM0>kSia?b>UMG~E1 z?TRG2G84cCiEhjUgbfnioe9)!kO;GY0~;htp9T0fNR%@R=-ePt=`7&n28rrs0p~VI z-vU-Vf<^y}{B`Tc{^w&$|oDWzVB#O)jsv9J_Fds;_OEfkgaPF2U zHv_o1TcWxQz_&-Djtn6E8HuiD09nsSbTb3UeMX{t89?biiHb9U(R~uRGlAkyNOUq2 zxbO*yE@lE9%@Sb&(BYD(Z~qzd%Hwe7Xsr)BuZTbq`oLo@gm^HixM4Q1dMk|bYl^a`&o$|E&@hBCsEE~ z;PT57RW1guzbw%{c0MN2vBkjcV-iIc16N;>Xml}f;}wZ+F9yb6l_>KG0Iy4Ae*(Dt zx4#!g9e`ANY2 zjznWm0y$k0r7r>Q_Di&P3DELIiOwwn?te+5u_eIJpG#CI0G;O~Iwk-o&q)*!fRS?& zT^4|Q=Oh{v0O4JU3`>E1?@E-p6sW!+QT0+_?^h-2TngO$szhg(0$J}#G`tjWzbDbn zr9jcwBr+@mDlbY@vcm*(gMWVec zfTHh7baVx9^7|59WaYn+=;jKb_y-bYtppzaK%(lE!2Q3IsBj zBuZNa6#Yn|tX06tA4ycV3MjlT(TP<+^-m~t^taEE>XuC;N~rfhSvba zzmn+T8X)v*iOO<;;9ZH_xj^WyM4h?7ox2j9VdsCB=w>c3a!;bgdBEsBi3;<8JNG2A z<^lKbNwhZ)aQ;T3&OG4wZzKw_cE6G6TpqCZKP0-A2VDFQiSFhBg};?3Eg$Irtwe?S zz_I%hIrD+h`x1rn0qgH2x{(iD|AR!S1;Ej9iAoEA$hbsx1;F^YM9u=h@Ia!D0^sBW ziOv-OR~|@oxd6aN5{(xCCq9y>un;JHD3QAmuzxI3q!6fz!QT43*NqKj*RkvT+n)&f`O5ItNAQ=di+gd0 z{S_Uk>;!582kDJC%ow@BtGOKs);YW+4O-Lx8>z!k{7GQ3&C+Ic826 z{y%46zFL?MvgSRLg*|dgAi1pNyr_yU9q|Xz+y)>5&0)dEs?3z`nfj9T~bu z+v0}gDldNb;$)UqvLhA-^1oOn91Pt}WPc1*?%es^Ejcyy(0O_@t2&W7`!lP$k)rG9 zMU4>R>*+d;itoZel40{e$6UEG#93B6AZC+Rqr0cKkG8-{Y0Pof3VoG^XMoq zG!wC`D-*7cpJ4%0>ZLY>=$sMf#-r=j!uV|f(%*#e3RY3D^8RhOmLDv^pWR1gbb6_d zs%S*}sXpmTds}{XFHW_0{_NhGie>{UPzL_ygBTEj!}%bdMBpYq8W&XX4?c@a93Ysl z*b5c>&PUT4@y8xP^c%jR8mQk9XvI`qp8GF{_OuRxsSvz=O^jbKa zGRnS)%+Ek}j~{W`2pGce-jHcOgq1EX=e>-zw?sf>6jp}SXZ zvW9ZzLWi*mXGZ`Qp>QvWIcmlxbztgtKvZx4P(rzKO2@{DdeIq;la4rCL?^0;^CThX z-9Y)rnX!B1L>%BiB=z$rODzKF%?DjQIOaaUD0^54HFydGM8#laf}S5#Xm8Hw{=fr{ zQHC7g0l~@;5GLS}J^Z>9@IyCjdmgaF26`d`PP0KkcF|lq@bm=$UxW7vfXL^tovfG| zUpNJGrjr$TfEkl$6C!Cy&e0hTWP1WI_&LmLH2UHK?!}yzZ4*5|@JCeuGbAYEXiweZ z(g`5!i?BEv<5?RHIR#8RLQYNrREtup6ac&0@KZND(?*n!{c-|k*b9AX3}*-reQG+b zn4fNiz?-I^r!~OnH+WQaeC%@sQ4PF}4P=wga_M@A={|U?|5P|hG!?KR7j&YUh)6xr z(+hCJ8-QgeI45Cn0Xa>_PnJGnMQnnMMFjmpz<)-?qB0BSnDKY`2@42WuhAC^2)-}T zTBl)6^MGL=5I6)#targIYJ^HjO(SZInoq$%UXSS6FLjrkF(8%xO6U%wOu1yWI2yp) z2*TjO!XrBgZ>0rJ20->cq_lk`rKY=CL?nTw9x02v?{mkvE+AHKF$5Ukl19ZuqR{wc zS5?7x3ahp@!gu<|903q#Z?qve3}(hEZwR)&Zx?;*s4LCco-2_?(^*P zGN5Di`7*wQ&|vI~1-%SNr^pGUci=#DkMynU^MS=EUe11CJGZ4gKPt8Q;#E!lIG)zC7a2J2R?2f!+Y zLvE5J`y~h}j)T@M;g*{jZ-$eMQ+}fgsoCB3jV(3F0Ecr0*R5{NXj6)-`H#ZZiLRZd z7T`138Iw6Yvkl z$jObDd@4K3kD)e)jY&f9MqWFzpX2)iKz&+3QUCbg;j9s32VAl&V{`SF;PdYL{x_PU z8D4RB&vJlG?z2Jn9qq=n@nwsA-IR#9yXAiA;iUa(?nhEHR!fH%q(TzZ~!*|!z9zFP*f|PH}2zJ4q8ihDn!foPd-1EUqRT0i=88Or`^aEot z3?AT&*9`DK7*gR1du8>T>=X2dAi95R0|*NQ8yOaT^nZ887D2JNB#((7CpQQ!M=1_S z0FdA>Tj(uaDYbuJ30ipzMuCizBPa5TMSV(|z@EDKfz`v00-4VB>nG!b^IabD%bs9F z?{ck1M z!3ax9Mik`6!uU0SY0eyRVoUIHg-s%>Y2l~-_`0Kmy?W)kOBM8Fe%X~*HS!@2`?jHc z7Jss;3|t5IndmW4806Ek(!z(IF_Lm^m$1vQ)cJiin!b_AYD<>RGEkg;<4ZQ;f!CNi zF{tC-C8W`z0SlT^n%&`Kd?Cf=>D7RbT~D#iD_6CN`^ty`%N=ailg?`0IZZQKAc)q4}hl@nCOl|N7+8XrC$+Xz8N#=jIvX{KywPcN0@yu-sclnUO6IT2(B4bLV1?H6~2 zT}7Iee=NG)*uJzH0=;G-KWRso#D_~#$VMv=Wb>?EeiqPchl8i^O;yY6j61eh3HL4M z@05vlRKJ<#Vd!Kjdh3T5{U>1YQ6OiqJcV=L)TZS8;KD`Rn6r;DIB%*l?p65M6#a|E zCq@48rkNA;W_M302S0*CIWN@uw4EaSPAjG^hHw0DeWMoB2GQEX+wP7@fvZBxt6CJVM}OIw9u$>jWZ5J3sMsqJ z**$KoK69bF_pa?bLs?iB*2^Zkz|=iV0OT0k!F!>BIIhY|$|pvq9Y(jr6*Ds<%;V)A z)%CgDF1MatP+)^nNWLOBu#!?0%%U-WN3s)#MdHH>l8pnDDDD4Bpxra%OGS0qG+p|~T^&OcNj3i!3J(vzcN^Px<8YGA>T@=R6Ki?9L9?-}hW@T3K8UxdhdDimcasfg%D7Y5m2$TC(`R`eqHUqwP=b!l zq`<;PNh0^llp|N5nOoNKjQwB%2BA17_#Cidnc<@RK7ajykhh$p19>ou84(aFa2O$A zvRyLFF|@P%X4+W79pm8VqgAa^{KRBc4QjGu6m^-^HM`Rq(a#}0azujvbw&1X6J3t2CSm<`R)n@ z?)qFly=RudZllVkx|Mv^`^cm!s-C{`ipibhv~S+!NF|b%|M;{qpH?PW+>mu`v#JVF zP5bUU%yseQDHVJXo)gw1VkU`XhtPjebuI{`{zGQsaAAZuE>TlM40VR77B@38^{nJ` zPb1ZFYW5f|Ra?q3RDWk(x?mL_>w6Ku{u=Y>W5?vKF;7xD`jbDrhZ7%NG+{C>_A`50 zND+7^V%73TOBe-LOnkG+r&0<<>U^h*T!LJebM@048}ym@$s@J%yaq{1H(|ccZaa88 z1g;)NBaVsiIKztYOA3?$ zJDx{qM#*I;X`QJ)R>>uK-NqL0UC`QxkGufrUki!g)ma#41T->glr7(y0$Djq$9@ zAM1v$`FFS}Tuv_I&di(iy^R3$yK z%r-Bjabw}zEE2>ga`UaZjXj<6M7iC2AZ^`?t?RLVuYZO)PoqfjB9vc*l{2N3EMDFg zaj+=k2tX;$r^R6hU`;FS7sgR^{2I-$0Y)$J~p%+HR=6cYwl9cXpDw270~*cf{Oc(5sjvHER!e5v{GdYylL>vKfw`}*nM z36UU?Fo`U`m40LZyu6CZ)(G+E`r=1tOY-Yb{t!XEjjR2^v7R#^l*|1Muwa&08r&gs zrAo}9j_N5vy%>ltl+3M8{Oeh#60zD%$=f6cH_ab)E`0hQ=Tb{mYdj;%jQTZbMe ziZoOOnCO>(rt9(h%AJ?0D#RG5{$2*v_fxlS?-H(e%Y4354PLH)+;#SeiVHjj#c1Q3 zD#*k~QxMqNsM@8EEM88Z*?cx@4A(dgsgP*YfAr9ZPfO=)eK|QZhhz*K(tD_rH8S?0yc9 zYvI8lh&qd7&&b_7e9jW-y4L~XgDY|e!A^MEP;HGBy!1oRL{Ra-=NcysChR&26Q@%) zETWa}+rXROT`7WnwXb>w)5qri0$?;Nfk0OY_g3a{T(*3fZaZKI>(9fZAc%Yt;FYPQ zgB-iBsU7zaapV`^k>D9L5=I;!p{b6-L!LPDb>Z6A-l}4e40P@;^Olm5k${)&SXsFA zcv_>iv&=F|tZofgvRP%CE|o_Ge&)%goQ5-c0SaV(Kz##Hy74`2jKR6yDS2xTPGoXL zY*xlx{t_&+L12Di>@LmI={Fp#PC4#l4W3u0c&+4%Gw#8VFZIch0vGSR>JN>+kWmKb zfHtLv`*{?0F#~l!@qNU$K_Ee8{44z5W;<`-8f77M&L~5!C|AVBqAFyB1n9}cwKSJT zDQMW$7$`|l^_f0J`k`qQX&!_=2>Ew+KYGZ{I7Qtw2xFBjV{hwYr|4rHY+6P2XJNm9 zUORRK2qPSh5oqpbfS$Bm(1W=lk$lWBuTUm%=b3R*MGng5EN*{;urJl}PqX>8Zu7;* zUf}YUJ`r3N3={4#i(1Xi1j-F3I>4csDKDA81*aY&BEkK8SGWflq=mOj$_Q)v(D|_c zWFk|crC+w-@oGow{y2ee*!Gb9Bgc~1HYtODB7Rg=L*rPZAx~;2zdxuhX&|~IoHKsp zUzy0D2{uoCZVfU2{&euLH~d3tqU-5NMit302N1x<>)Oz8d?Dk%m2Ry4Q%>rj=lVM3 zPEIO7#&nvF=6u5ds|ajzOb2>${a&Z(_e+`HX{Fbg7=HLt*;_tKs>oKpNblf3gMj;B zF{}n;@(9?foD}TYev+5Ae^`Hj-(yM))`oWUrp%$v^@sYyNK7N(mXF}<}kk=x?)OFX=OC2vBXR@-=n}H_fp4tSH=lRVsT>-OmA}OtEY!IZ}M{?u##z__AJ5BPV51S1POG*52@Dg z9Kw(DZGQNn0Y|bGcM`Ap4m$ZyH?tvsc0BfiNPKm>PWJkp+7AIO#3dE#Wc60{Fk=yT zgKlx;gkPXCccjEWpSEu#?qC_K1q%_2xJ2ROI7pf z*et>Jj}+v-oM5ub!^asF);$17@clq7~;mI$~7{=E|8G2f5mnrayYQvzL?GU}K8<%<`q)2#SQFskv8%{h2r z+=_GrbL|bPGC=_JQxsMHt!&k{K}nnMXOueX!4PNZx)Noq)RrK)+|nvc;DC1x5oTKJ zf(;;bzHayhhFYW3m}nmLDPJ^Z`slNo^BZiMAyD?I{51aZ1`Xv} z1|8jeha(I&2Np9a=uZD#W<8&pF96rt0rkNWo$oUT&%*cx3*&Pv7xk9!{V^gFb>*Nx zi}rjLr zU^5}H|7K@DA!tikrzUQAyv<|j+d00|*PGb;ly)o-F0~+ZQz;lt$abF(1RabF zA|mN>hPVgW`|3NZGO;IeA~ryIa!2DQNCchkSO&L-Z9ubvF(Yle0A0zXVy6vZoYJ*_ zf=UB%$HDR{yAxsHfixE13J$w_#0iwF+`%~dIJWM{+0+Z>z(Sr!t}|l`k%HBtl)JB5 zK#kvfipQQ7PlxzqsrYB_H-3Rd{GgfL{STusPskDHaFqUIC49` z{nNms{m!753HyAxb|11}osoHkUBFH9uK6mc&3xoEEN&GvWzOcQSKagbAmH;ysBm+5 zONZ4ApP{!f1!;HvP)pr)lMzbK0ukuw-2P1}@#oKklxk0$U;p!8j3-R$E}My@Mh5^6 z{7e*9d?wSO4REe+aXaieHU?tlM@e>q&)?J7!yqs%@0719`KIvk@7%+7RVjy4UZKRp zLb`WMyAfcbuuFaLJ8#qTS@iTMd0$QJ@LW85IOc%X8>bCdoIXP7fYx1_mVPHb&!*;H zsSL?dhSVWdOuk}tkNb|Fqs*jOCq8L6J@^+#(KF?JQEE77>4Oov4$Lh^o?!XP+55n! zX>n-D-G$NpHFWfHhQb)V3>qNgDmoO8v?wXK2PZdB$Y3`y-xg2iv}=%jZ=7G+>lD`c zX&0xSdVm|X^XZgDTx~s#0PNp-H*{Tuc-B`tgiGj`KLww-rMpu}5X6kh|4I4B)f}$*dXKLF;OL84c8p`mG^C3Q2&-{NKyU! z2pa_I27LKM`)!TT^z$gpv3U32Yl$fBft9Y+U(UbTLjO!O_aSd)WO-2y26@4?;mxmL zkwP%8H8z*9FXwBz5VVWDGeq)4!*l_+j&xGUm;2Pv@pK%6GYMteAe2N8@qHj}#x%F* zPWSK1!;vH8_a#$_Zw9R1^UN(skmsexzCU2d;$szM9glCuPv`T?t=J0MPa(}qaLl39 zjT5oUaLggpEgLIuHOp|LA=DX&;9wdf@|$}2hBpa`B~R7r`4^lNL6GiLwivY5#V+=7 zV)bcx2`(#ClGc`R?mT*XZF}A;^mv9v%9=-Y2DusfA)#$#KlIV@fivR( zp&&GR>(n3%)BBCq_LcAXNawFLmm#(fV^+iOYU4>#3X1N zK}tabBl4D~T?LpXlu08FOpBV%h1LF`^K0}bJeM;LF5)k_%mW>JDto-H?8~EL!G*9X z#5!EUyx;hy`aS|nk_3{rGT~Dqsi@v!*?^?;m?Yn%y|GJW)8Qe%$B)>QozNLXoFLK- zFO~_~A0aF63qhdw?Y%%}QZvun@DyC4HRZU`k!&iXEL_4+!h{X=Oy-pW`;xhK~%nMOdggKcpBHr*KCLg%xhCPj2744`Q0k z`e7{}I{$fIfxwUdQ8QzNbBN15{x{#kCuG)jz#ABEMj#XY=Fm(!Y$JK#STyB8Xrm8;ujkdC=2b446nCIysK&c64t;L0?ON5;oTrqf1^Zu7&*f3I^o0oGi3m!T$@ z>qW{ng$e)3Aj|bWkN5`%an4#Y7^<^3gMhQRTd;Nan9j0J4Ny4><&!4ec#JO1Q3=)Q1yM*9Bn5Ndr}UTLUn?|${bpqzMsKStvnQSbwlUu1m7rGp<4ko!utczI?*EN zJ;)woc$Ji78Bt%G3B*~mOD56Si0WFAeD<2dbO5<%L>Mkbj{nM%^_txC>+a+HeP7+J zgLZ5X>=gyF&XL=hWSHVmPfnkI3EP58F9#2GT5Ee#6i~wc!o`SaA*&;UOCkhk~wJ4U&^ZU2g?% zaZA%q1(M^X`zY^V)9(4pqZf_iRH)UBc$}Ruf(RzdG*^rL!#+QmpAWr-xs(peB_^3* zHp(|Fy__C4S)%rfn~!-S&WpZ|sdDj>)UHS;#CTM~_V0y9uP6uZj@I4f!sTwc`>nhV ziCpR`&Hfp#2y`lnZRNUt;<#J$w_raou&T@Tjfih7)24GrPW!y9MJKeahJTP{@$kaqqO z`}mDGVPN!@dKmQQh6Q)%jPM64soN$ON}VC#J7r~GC54~o6}s{A&MckEV_FKj}rktImUErDbpuh6&}?X|GrVY=VnXB4fA$K$ zH@~wRhhfSAQ1{+BO20cmum>ThC|=7RvPXjd*hpR38TP0vUfDgH2xK z-AB(w64XrSXP^pxf^Wf_&P0fsBAmjl74z>RRNPPn8_*`fviSPT6b8}^2#U6>Jm-HA zk^WUBcnmk}zW3oZxXi!v)ITc_{s>#aIAf0i!VeE;P71TeoR4di8ftVorw{yG z+1=~+U?GXBl3QCCNFAzkBr{fL3s>g%^bJ;*mwZKA-PnIP%8vp$27WyBg=bxqUA@?7E{qstOmUY{*l)p!MI(3j8!n*E zW3U9={IJ7X_|FQZARMobe!bGTxDG^-1HZN2fX_79uujvHHJtPu=4~gh4znJ~l={Zd z&k&(B@=--d-cv8a7OacvlM|CqlFiu$n(@CHh(PBD9l-izS)y=&Mv8ry4lhfr<#kyg zI?sRyUt1T8Q#sVfK$39XIT5zDq_CEl56ckxYqGS;2Z^dke1+M71lhqEo#NmB$G6sP z`Af5^t_N*!rvW!}{9njLn{ zrgd8bUJ0~6j?+90o6zQWcR?NQ`{}$0i5!4gqcmJbzXj1|lX&o7#agdRoC~D9FjEC>Q1SD0$KhN3)HHVK zXtpSXwZj<-Ub_%HIG@j6s5BXcSzv3ny_x+nNOhp`bx-JW^0Cio`&?;PF49Yv>T)`D zVjL1+2%BS2*=b-O*&5{pfh%L=wXC6Yw=Tw}8c~J6zHwg|TH|oXbNs5N=pbia@d;Rt ztSJ-Q0NiS9!rb8HsRWKY$Z7=nT$_kUeTQyUN{BiSqkl8u9Dw~=45OYU*e%3Ab-e{B zM^FnT?dlcZ(u|2{-cAPERD^fLM-&O?_H6My^t!hC6!1iC3K$KJCZsIK_cfBgn(-D& z*q(*1R&7a+t>(S49aiV|Y@t_-oo3m>wLi`Io(R zMv0NpU2~$aYq{91G#;?o5PSuUJ-nGDhON?l#V1!4kvSp4jbf^AG$FW=Y@%nAFG|Ag zOv3Waf1WgCkko&}UgEu`2}V@9nTkKaGw&Td9LXjo@sT@dV_xk$DFX;al!o+{N zOG_jL$w}0{emr?Nc^1(SsU4ly7~9V(Oquafes@y#PtpoeVXX~>3rxRpEnlxpuT8%p zNpF5p@9$LL%1gg7XL(!{FS%s3$Mu?2Q+`HO?owkl*B_TIH)%2F5@y>s z9)H&>@0INuFcvA&n>N>(HrJaD$qJGvN!MUIO!iD|2-jeqq(n92Zgc zuhBBAP1k*CWwEglB1l{q2pUR=v^vrX^1uGq&0`;I{r1H2ox8or{ms{A-EBlaN$e|? z?~J(Pej2sosTbz%ge?00B~v;~owb(Ymn*xC&y4cn=Ntbht?9b7>t-od^Imps5M6oQ zj>a*{;Q0G6`eP_Fp4~>;I6z0V>k(#mDOp_835A-!33?sm^HSLz z0qWq-Mi8O}iFM9KC_fN=rdz6lk6?7f51h6CzVb^xLDNcUVdZPQW+_wVQ7Bmyv$^Ta zzpqb3xEo~s z`esFcX}x_mtuzb%!>SH5J-qatT<}(+JSimi4QQw-32e&LYm2S%(FyM9d2$PEaXWx< zs9T&H&t05)WZH4ZZRtO2CV0Ky-|SE5CqaC5LmDzEP>60ZGiqz!{@Jp=6^|7!uLYOm z&?roi=t7-mB|XaYd+q*j^R`hOx}(_mv`z8KdT+*yt80a{`;+k2K(K;WfB$juW=6-X z>IRpMq}rLvX!7SGsjNuGfUXt(xsF8rjeEv`wust3|378?=elv~njp=Mt$+;f>L96o zb~aeujc$etF8e`|j%(G8PsUnpknBD!o20IP?D+TM3-f&;nd@xAnsvSX3ARVAQ&`Cj zTZ!Lf4I{}dvy4alo@vH1`mmLR(Y{Q{(|b=j+a*z~m2!{nCNp8ub#MkX#_-|5!qwN1 zGEe#p>e~F`8)~*B?PraQ7M*X=!=o+6Hd*5eI$WH@|8$N#iJCeGrtyYNbUBl>L=-tL zF3~b-V}>O@E9~dx?!5TZn>{XbvN2chg8xn8gKpPh)$+SX=lD+@b+Y@U(EgnmHfqgx zr`U0Y#hWBu3B4T{8@0ZF*0|u0o$O`J45#WKrG1NxQ0=bv@!v;ZaqwcToS8CYf9yb? zYE1O&sf#@;L?!NZ3M*fXJI4*#I`sYf$NO}r_1+zd$1xWk{qjKYn_u+^%}sf z)n0$`kNF}N@~UH2(;lk2kGuGwUfrvDzg5e|tv^9s+bd(Umi-l~xIfNzSamL}DWdPv zIGP>$1|!0yxb22%kliN12H4Db4ya+FK7A8Z|AV6aE^LyT=eY6Dk5GR(PHHh8UfSnA zNXp>%Q>33!$Ul*o@6{+5sYSChLshQ+z|(8XmoYHluZJF0LEzEpQ9tAhxE}rSkc}0z z0eFlZ_0!AaPzv1%9*KX4;02>H_tsQZq@q@S5OY5Q5q{TxNmQfl+ya##qJQM&V5MaY zhx8)`JW{0al(}8PE73zszQ%2$)5|l&v$wM-4KxQVx?e?GhWavF{sBoKJyK_CnE>2( z{-lKZRzGf`3i?52Qw@t@&kv6)13@BndkseT%Us|IN2$ItlaRqp1((vYUWN-(;3oNS zjV3H(C2Oc;qV^d^WbS&`ojEk6(k>h-sH11K!1%!Eag09&?%jk5wJUVz4e#5*V3F%LmLQ#y=-(F5gA|?DH(102b@ltdL4G;M)Oq#F4c&rapR8o)u=^((1vRd0))$gaQ9Lm2 zcAqD_XH7=zOR@;Xx4*qYFM|f5MR;t}UFENj@7!N*mCxLc8Fb^kxK3ex?@-vViCawH z7R9sM%gkvoEGyt;XMG-~_6{2p^0WAQ{vRU2D-tf5pr?C%WF%fN$^venPaf7gwb0X+ zGi`~F47q^4l;ZV61+)MMyH>x^OwryT0_7eJ-Q|N3Hdss$M+k zXopohQt??&3ONBmtL$G=5n-c2bhgIpPi5?R{KHXZj8VV3|50W!9fTdyA6if8wlMjO z`p&fkp?K9k#sLzJw0e(wLmjDaNJf;4{;_ATV(`#dgY)@$SIw1dn%%MM2HZ2k)Ld6z z=087-Bt6fLfeI8=id;i?swMHleJSn5>WN1M0d&&JxW1>ifbs%T0&shO1`4N4z9PEc(maFTzQjq%hR3UE^i6^!#5m zgw*(idcp%+QOd_=FvL>1(?6h~fh;=phmwgg#RkF*a?LhkP0iK6_uS^Jgx8DFkZ*^)%Aw4Re zc6rFW_whnTs{RX!BU0XB|Aaw}2Mt+HTO`X+u|2?lt=y?M}C>=oC`e>>6%iY4b>$lIdg<>p+zuFgikNc}*)MB+_ z{;Y&=m~*VK(1X7g7A4)4pAlW%wt59EoirN~v!4Bx?&IC8O(dEwQz607d*4AExjTWIDby;|l*m(Szb z<2e!zBlWb$Ucqawkw$|e+_-3UpBrtD*eE0ItEya_ z_#ULeLNq99Se2@mytzurq=S2%fe@iLo+`YeYmvN*ufjY;oPVd|;6%{4ood5f)U$7G z!5LG6XO_y9Nnc#IoB}!hOi=(>h0|Dzu@Pu#e!p*G#z?e{3hlUD_^1|A5%|*E>b~)O z<%qY+-h|}XO_HxCgCR5om>vg6q-32ON(-=#PzLo?Z-4C#^c;fI(~Cv1JixB=3TQgOm@=txOZX3?~XXUqSiNe@e9Y=RVzQ9+xZMxT_cOgEzvXNViZ^@>bGp zQ!|RyDdM~39iG1##>9J83i9bse6X8BCz-kysRp{}sVYR!ik*Gtj{!0efWLf$JiRj6 z;3kV1Qf#2S^~t5n)vfXbq&F6^${eK~+~adri1vaD6(c?@uy%Vo3JYlTnXML=OE+*jSMSqV?w!wkxCrZ?1f7`0tqmC6 z)ftx4&2g1p2mA{b^bM?edKUFwA{|rd1*fsc){`Nu*508QaDU}?(^%z4fJtZ53-Ifu@ju^-WlxDk0Gy(^2czS@PXVV5wdZLQWBgUV;h0faZZiwL>^e|ITVa+7g>A5d%XtSpg zhsDt(vGdU}&`r@hh}_3@#ONz0vIXe#khkT3v6f@EV?f>CtEkY!f1o7U#E-(zR@cDG zpW+@OC$`CaVf1PI%+13Ii99rx&rhrTK?YqJ8T)vs zokT(6C65o4s6MLd)LNz2vws>|tdJ@rfVv~_jUh6A@rZ1NY$OE>qU#Z=g^2&LJK6cu zql1~aH%%nmdm9@EDY*S2f;0|~@@6U{5b1o?jE}^CouL0e+^9^6gc|jZYtW zU1Y?uIeji1JP{D+#DYF2-bwwWgmEsJ8ZRxi1vc}qQz|iQxY{sMR(6IknJ`E|*wOoED9{(Fj-(AMqFx?;WI@Ul) zOAt8=Oi_qE@|C+GX;m&Jy?E8DEH|4Ol&;jCh;&O0CUT2=j(e}{es%R8Eay$8xcu0(s$E-QCoMJ2JO@6mhQHrH7DyB(nCBcvTr^0_r6cAT-}02% zoyFqwNn&5Dw(9Nov}p>wT%`#1LJh$B&Rh@N_{eKcvDdSw|7s5qEd|(XF_yty}y6LG31{^&rQF zlCvzn_49x8^K@%n(YM`1no7$kj)Qn}aa`tV(K8dbXvB>bcJ=yp#V>Qgi`F+a4v(}% zdjN*6m<%dB;DTsrsqj37S}N~cGqd0t6%|gxl9Qtwcd0dM_h16m3Cs63AR(b({k1dt z>h3B5{nL5QdEGv<0$uL9UyLD*V#|8JT#LNuUbW_r_WZrAGWd@gMxKAfh`S0rUrwSG zUOAZQDlv|Lh{Gqw!5dCB+$Ob_nZjSKY%M10e=j-M5Xhb=qhm6#jZV-_P8th;IRhWM z`zZJ&rynps{m^fqx;TimD*jN&Ac_&0KYpR#aEATuwUMyzbnbv`(q=eVrj695a!Gq| z`&6&&Kr`wO8n;aMx(@o${2ynYtqB7W%rZFN__<#d3d!_x|MC9Ga@BLWrGq6A_i%1s zz-7?|QOid1v2%*j%QhH6zA?GfmFkQ@t~Zl7sm-8^RCEg0e?~+2PU+_7$-8Rv=d>K< zQJ~Y#M!lXE5s-W3Cb0GzeW1`ee2 zPwpUN$K_8HOBX+o^QviI?H0O-4uctbLN)&3norM~k}Zy z+c969Pb$8M$?i3pZQ6p=(uVr4Wx_|7yLfk0c}HQT4Th12m~Vkr35W^7vwAL-NS)YZ zKogqo6eD^pyp8U6WkFo{e6+;o32Ej8L*y0&L~+DsHdaw;Zuu=1?6e>8?Z7S`CN&(f zYB_ld^HH&=a2g@)Ahp8h}Fe3d3f_B}MFa2D}| z3>uMNk5ABo?sdLyIcaMR?#iT$ZBV$bu-Q%ZY~Q4Fd54m8ih$|Sf$8+NW`!k+69;2| z5b%&=8}+XuZLJ$_kLGi;xq7_L+O9MjLq`2qndP1I^&G`wM}8vYPJAsMo#C=1Q!9uk zjv9wA@*A8HF_AtLjaR;_?Jo%s_!_0^D2DTVJ1)%&b?8n{E?y^=H@ul1-AYsaL!Ku5 zr=Ew1SG>30BV35S=M|wxB*59&E#%&?e*fEqYJKws!)oxAIxC|?ej({hWB)Xo&D9dE zcR`7U@lGNR9-YXB%$G>gQsFigfFYka{MP_u$>DwUs?8&-(Y?B}u4f~RZhzzYJN}6u zw4{h8*PGuq(L}@-gH|aEj*Tc5LXuQNoG%KO5Oo{Tb+Wd_3k#b*w~yxcb5U z4>01sPj#mDS5Cn@dcmw_LCbjQ+pgg>hJ?~OG7L`tg}eVH%=p$d+2J}0P|O{=46?Px z$VojboZ1#_u@gv%ta9YNXsgFeCo@aX1M0=j{Z8BD^tsycK;04EOnK9`ja9Fo)7G1l z^)wyWP)Uz=0t+f;-J5>3bX-4)-!J^Wa0KVOSEua4&!7@-BG_#U&G$rP^f%44W9%1! z$BX)pV(no}wU)9B`=LF0b{w6Ve05*-ahetY@Iy=;oF5Wz$PLesIniba;Il>BtTFqS z>!Zd{6T#YnFLgS3LsOaGJ|PRe8!vsH{g;%3Yt)La&G~oIkEw+=H|n=1615GjnY*$W zC$TamN&jW^2}-+V(f&OpLQ1HtN^}|-@&Bnk>%;E(gnHDINZKt8qS$jl3tzZ1W0bZ% zW9wL}B{g0yQUa%gMuPmf?Vw_?iE~bAohlRU>U=G|uCv?_AsVs1=A&RaZK_#e4=RPRn*4_lL7(0U&>U$a!IVr zGVFlTYd@K~66okI8>%0!&{!JZ=dUI|MuZ>usQ5g}+oryHOZg8-i8wg{a>DioB*n#X z4UjlcG7%;go`Sf3;Ts^EHt^q( zs+b68=20=fD1`CAlVi*R!fX)$Xdf7*RN#Tg_MB3m;lCnB6BM_=Z6NvShixJZVJ5Rk zrNX@uveMuw`XbuF(OD895?c8bTN@M_jgUCIJ9p~ew>P|c;nHK z%8~!p>2&bpmi-q9OWM&&=oU05PGdhX$%x~TM_*;4O##qI{C(0m5_Mx{)gvG1hN5Ss zBd6)S@k(mZHsp?IWxk^Y0~GN~2G9`YNbA~pbt1Rv%A$GHBV%?Xn_6%ISFt>Xk*svq z(L5@VB6O1kv?`I$bR2}1O^zLaNE^Dk58L#3Hvj|9-$r;#F;_WgMRC8BBJ1g#2`nqo zdH_$#E>=lsuX3O0ehbs(<8Qa3*~xX%{3gO{h;i4BT%&tq`)!IBLb6?g78-k{8kt3B zFHpQ3ri4h0Z6Ii|9HxR;E(oa%zae*b0+}Ob2!1g|6cqeoj7UpfRT|z+jy5kPj=iu9 zGA6&Wr!hgC68umeu19WP8va1;r-0Z*epDPjO@0InZy-M^2`?m%UY4Tvk*RJ(L2vkr-h;fO`r7k!8Eh+f(p9i_%+GtHt3X^@eW^*?*`5oI3D@3;)v9RI1dT{xp3 zC?_*Yw80H=Lx@%(pb zOj}NaHjCx&DwySMklG(NMpaeF9mH>KAF6(^8KKR|2y*Hy%W!f=+LtsCpE#A25R*HV z#1L;TeOJKTHj18=X(cvtDoG&z+B&O=Y1%p~i+OFNxF8eCi3R@c&RJ$}8BaXoWSL5= z)t21wxX{Py8opZo2?`Bw4c)yS{-hl0_QHl{}F zl?>*0901jkkHu`bCMq$Nfe&O>nv5!aUfQ2ZXCZt5hwZqy8K>s7I1@+4=R-xri>Q5B zgsmvrvUDU4(0f)3)y3y35$CJ-tR`xK&#WoxiyR!iBN~0wTJQe@ znLuX0@QDsS)xqcLWX&d3x9T8Y2Rn7JTL*h|uvZ5MbWo&&LpnI3gQGe)u7eXg_*MsJ zb@06oF6iI~9bDGIbzSkgfjc_5tApQk@bF(IhaTzR4;}oegQq%pri14?5cHtYgI*6t zJ(%=h)`L|Kc0Ks$!B-FE^-xg{{(1=1LuEZw(?cyi)X_tj9vbSQksg}rp_v}u)7j=ndg~!U5B>EpSP#j17_NsDJ&e)ASUpV8gI5o! zdPvv9G(BYKVWuAD=wY57vh}b)4~zA%L=P+UkgJE4ddSnmDm|>z!$v)9*25S7vTh<@ z54-g6wH^xeuvZWJ^>9QF$MkSq4=40+QV*x}a9R&%^l(lO-|OK=JzUYlRXtqO!!14h zqKCWcK7QB3V>SJU9-ivqxgK8XL6AWsgH{Gv2BQoX859|uGWf_)Muze-1jtZXhN?0I z$xvN}nljXqp|(1~7$QTM4E1DaAj4ZSG?l?4Lxc>?Wr&oag$ylaXd^>=8Qzg0PKFLL zbdsTq4BcetF2lPr^pqi9hQ2cNlVN}i@5wM&hM_VHmtlkqV`UgG!}~I%$&jx0YpSZ# zWtc6)Tp1R~uuz6YGAviiKawF=hL2@fE5mvjK9^y$3|nRRLWZ3(6v(hohC?zOk>R*% z|BVc%WcXHwb86m28GcmLS7rD~hMO|nmf?;JzsYc4hKDlzA;S|Hp3B8Ar)vzLH-Kya zlL2f7a2cSi0m>Pmya6g2Aiw}s)R)<-8K9;CLJUyH0Cm;;FatC)KobKrGl0hc5e8^s zfG7jBH9&g<#2BE10lKJm-3`#o0KE;+#{m5d(BA;>8DOXZh8bXl0a6Sw+5lq>Fu?%t z8^CLTX=*z&4KUjP^9+z}fQ1HFVt}OvSZ08a43KMpl?KQ&z-j}mHNdB;{U%kn8sG~9 z>@q;1nzz>g`wehV<--OzVt{W9aLNFu4RFQ)-y7hf0j?R~mI3Y<;8)e=fdPIuz#j&9 zqUJp}zzYKiMv#mk8^K@%i~8XLn-QEwC}o6lMyOx}w-G8Ep{fz88zI;T^^EYA5gHqz zi4mF_!DECLMu;{-Ya_HbLYxsg7@?C9Ivb&f5qcXT$q4<8Fvti)jF4=E;YJu~gfT`K zXM~AH_`nEhMwnuRX-1e~ggHjYHo_7kEH%P%BYb3pRYq8Agmp$(Z-k9T*k*(;jIhH9 zUm9VTdYlES78+r{5e^#Rm=R7I;gnkToe|C%;gS)4Fv1lh{A7fiM)=tXcZ~3>5$+q| zp%MNx!V@F>WrP<-cxfzNEUPhrYyzVROeV0IKrw-j34BdZ&IIL6;5LE32?9+})dbZ{ zP{RblCa7(KP!oiipuPzjn4pmfnwsEk6Mz31ln4_vH$kKcqD;`*1TiLvH9-dxbTmOX z6LdF0ZxbY%Ajt%MO)$^|gH15Z1j!~CX@XHE7;A!w>PIXlnZRp;DJGa|g6SrhX@a>X z$TGoV6D&2sauej3AkPGARNHkX*kFQZD<-&Vg6k%@WrAN!aMuL)P4L(R&rI;#1TRg+9|_T#K{kWY z3}!P}&EPPDj~U9Ep_~~4%uvM))yz=K47JTr*9>81sAq--W@w_Wk8WxPj~OD&5NU>1 zW@uxEchvG&GsKypvl+UZp{E(*&5&q@er6bGhWE@cSgk)))sbcxZH6&sm}Ca88B)zK z*$mUnkYR?IW|(D$*=EQx!+bL=Hp3D#d}xMTGkk1@)n-_0hIMB6)C?QVu-OdT&5&<~ zon|O7L!r9weP%ddh9fE;HN#0Wd~1f&W;kPpvu3zxh9Asu)eP6naNP{I%dvIVYK;3o^*vJ|gR z{>=jSE%3Vq9$DbA1^%?a6AL`Gz+V;+te~-iYz31Q%vMmW;854;yR1;k3T3QN&I%Q* z5MYI>R;Xr$npUW7g}PR#XNCG!XlR8dR%m90a4SSup}E>#q!n6Np`{g~t#R^@m(A^3>tq^a8BrEi_LVqg^w89W8jI=_E6~L%?j78@Usq`LgR5%0 z*KBap2Dfc+*9Q01{D(I9(*{peer|)8Hjot1DIhCgP{5>sQ-RV7lu^J>f$|FYD-fta zkODOn2vHzZT@)CmKz#)oD9~7ew-sovK$HTl6=Z%kgC9B1*R&Hp}wK=jHU;t(*rmYN3hYzhpaO>!IIh461-@0_v;t=pIH$lx z1+FM?U4fel{H(xl3OrQc4+Z{I;E4h+6_D(pvxC77W;v z9ni=D%^cuyK!gJ#9T4S!HV$a#fOj0w(E(i?(9Hq89MIbV@eW9GKtBfzaKJzZ406C= z2Mlw-a0iTZz-R}IalrcyNOeG(1Ex7(mIG!xV6Fq^IUw5siyW}r0V^Dk`JIKknBQcfu2gmO-(;4E&--wBnS zP*vq1Cj>j8juYxTp@9<`JE4gaBAgKEgceR{>4Y{;Xy=6Xs%@MTIy>QAC-heH5}lCb zgaJ-?&j~}FkfN52b^dcq?>k|V6VjZJ?t}~{%yhyWCuIFgy=*5ebiyJhEOEjzC*(Nc zV<)U~!Y58x?}SgC@R<`ncfuAYY;!`s6LvUZmlFz{u*V4pop8tr-#Fov6TWrAStp!# z!X+nMal$nx+;YNgC){(weJ4D0!c!+abHYm}h%V5(z~};t3ltYPT;St^(k>|Hf{HG1 zyTIQCm0S?$g39W9eN|mh%>^}GP|F3i)%*|_)Nw(W3mUn=g3n#B(FI#vu-yeaUGS9) z3SF?z1^Zoa*agR3aMA_ex!{Zo&bi>c3og0fvI~B4!7UfucEKGN{N{oOF8JLAk6iGl z3!b>(nXCB4QjJe>KeVdqeZc4gCLgf+fJ@CUiIxJA86(SZ~K792O@o-r4K~=Ksz6Z^?^7a=v}dz5TpTpBnsBu6C|Fq+n6l;K<&$HV-`c;OqzQZt3p0M6w%XOp2eYV}NdwS-ENF|`+uU|H;CB6(> zJm{^jA1X`gt(ZQ3&eT(yw9mtOY%O*0?f$pME{`>huTq#1&|iA-Yv&D7+j~{`V4k(y z!A(O(Hm-1E;MhjXUli<}dq4L~)CYwQ&#~wo6@IDydl|o#hmvl_Zar zSn>4UN)dVQm)+B?<(X!qvVZ9I@cN~$^4L-p>a@+DI5zT#my!z7> z#qW<((<6J|YFqvC$;Vwbj{3AppY6UItVfKNE}1ii{<3CD#Ku~qyDq8I>Ez6(88hn4 zyI{Xk>j$zv==c3_#I;q1w|KU<-JHl4_Zr_=F=h15;0a5sH+cTjyhr^r+P0oq_E<=6 z^k?0}_tu~D?EI!CRkG|KTyl3gxUXD=EwjT;cCYd1YF7QbZ%?27!_mMNUFUi(E&l7z z43j+PMtqlmcH`-)_rV^ltbM< z-B;M!zvHdY&L6$IRk~@3Zcr;&Y4r5hN7M6s+IRMpW!lj7oxi)ibNDQ`Pi-mIySvs` z`PNml&i``ue23`R^udQ8cN%9xS>4&d}t>kN50;b|`Lj*!%}erhMZ+=SAq3FXOV$ z#R|VXn%~veEdBL$n?XB@A{VWmf2rEbaRJd|&(Ai^-I=4kRj295itmnJI_}+?UpbGZ zb?Y1}aPED_INuK%yjN2n@?`vqmZSV$)N$54y=>~rbhjd^n?nuhxh2`~L{Yl{`r-8Viwd?+DS2-=gmZv5T#L0vNsHoUZY@bPo`k!wfS z+i@c6$l0Siri|^sv)-+Hh& z7w-->_I!AEa)9o+$1~(H%jc%gURuTVYrECY+dp{g{@|jWKTm5PJtngMpL@Q)(KEgF zu2vt6ssdCbs`xoxdI}FCogcrm<@UF8ceEMu zd)A~5lUDsarA)PSrEjUPIz+8)YF<;R^=I#AZVuX7yKbL(X<;LeTMI`msO`8nYT945 z8Xao=U5zcry95S)T&m)T=T#1@jXSqGe#VN;rCa|HvG@JwDO*k?&3mWeOxxYD-}deQ z^NjKL9jksSn=)nFCa2->(TK`xR<_D}*5S+N+wP1TIr(xQ^TT~#cHVDDvs4cJ_Snpc z-Qx@`b?;QGJFJF3D|Y#j_DPRlN3IxpVnXz!FOSXr^YQkEQ?kaaTot~t zPTa#5LTUZ|5$k^PO>AWuHtKenecRiPYV`DM($A%W{%rk1*XFNpYT5Q}8R$AP_}RLL zzfAkkcWL_R{O-@rfTZ+N>J5 zd~uhu54)x13M&TX49aXguJrG9X7$KeJK{UL&T+F@`}nTCdK(*0xZODAp0)DhW*w9q z{l~d=&9zH+x^~Uy$PK^8(_K?G1pJnj?#(*%N8$NVS_&d=nKAkXWp5f*4 zMz?bPTn{(y9kD3Kr_tDqW-nH}-2C3ppLQQ{{G0M`>1zD;`>kDBIlDWidp0yr_^Rmo zhz`P`S%3CB;Q6t}iRByC+@2pd=!Ch}xLwL0!FPJE*>=->zSR7L?Db1K@76z_vv%%> z{tG_u8aMx^-Dj8HGH*TOJsNnZrfJdT>=d^*;J3k+0|N_s z4f$f?x#WSPOcJMrs{=?PitjAd{A#%$2!%fY&~GV=fC@d#_wq| zOoKETre}q%;s+-f`c9qv_W2eQ61|pk9YSYp?mYZnt#1SF4YU86y}AGJJq@>>%Lpi( zSL^MXpTsZMZGE!6-eJ!dLlPIa|53UBQ^tMkrQq+cKI|BFx6)2syDJHu;`TM`@0}64 zYkd31_bv)g2Hrh7X6mz@7oLv4Grw!EDW_L^(q?|WrkA(kg9%SsJBm`wxzeC{-i(^o zp4u<`vlr#~-YUi2V(k_;%RG9OX&tH3tEvKa?B{lh~;rWQyu{^8IXD!P%_+?n#vN^3IrtT{J zXM@sj{aE+QJGH((5?|%+z3Bt?4l13v{MZLcCx;9=SYz*B@7`)QIqr(@)^o9=qOO$> z%2+;o={G~SU3sgfIX3Iid)HPuDkXl}D`9TSu`>@g?fZ0%tlV7o!gtsb-=_s}ODmlo zcVtd$+v%~_c7MI@=8{t#A|A#*=>5UgyC0786xGnbJKM2sMX>4p#gBabNVvJ#;?2e?R5Y z&O142Kb^T(ZT6vB6SwT%S-1L%XO`r}_49x1J-*A^DSHOpJJ+=L_zORL+v=D1k~ifa z`RindAy>{;Snhi$_v06%|GHTEK-)8Uwyz#1{qkph+3w!Tl%p9u-!9ajA+uZ|7*&Czd%jW@^mp)(;BCHM@A>WK`+%NzXe8 z2kd=)M-9HPVz6(GX9ru9>XckJ{B+*eFMbKx61}f_1>?a=KEL~o$sGMvqYy_8eaP5p zUnOdHoNN&i^4{{_&$+5S$XfeF(54=iZOdc7YSrxd&b8*{HD*`UI@i9nB;-jm-Rw2t zmG=KO^w&*U9~Jds@u9bNZ|#uOCwN@&g^sChuJ!*m`F@YsN1q?C`?vSR)^zR6tIjXR zL))%r9PjP@!na4%^POwuyR9#8nXzcUV|8!cwp$B&UjEeX?{oOFCGO|4*REw~n%=lO zF~c@QOr7}CC!-%v*nDy4`;R%Z?B`uOMvQE8VC=4wH>b2a{j}GUXWzNpLbD@sg-aEt zX=&1;YUIUEA0B$?I^Vqc;nWGnH#2P50o&2(U7{mS?Wlh5$!h6L zjaI(%J!e~f9FuYI*ff3Lahbg;*SdChvQMR3vn!R4ST?I5VNmP2dn}i)*L)h(&2!k) zZT+HWoq9z&-pi{Tklz# z*Wl-c^Nydho7TPD*8bwtaZ8TAf8*yn=jLCuwHUL1ZG+nr7YE5->}`4O`&OSExOMu% zM~z1i-+bHq{ijT=|81E+JcIJw@62B{v){PwXD?{p3+p%Hk2}@ctUmPg-1&m~!!DnB z6gVsY=bLAXdY1JZ>6noE{L|UP^EZuLH>=ZIqmCaAFu!FaD(7) zy)mJcKHekDeNc4b@Pgs7BT`N_^PhC@bmgRwAGG0hLLZ$8EuUTS+oM6zQ)dU(xVv@f z%4t%UQ=P8n?y&7CU4L|RX4tKTy@L<+J$xr)Nye!!-9H}NJVacWAM}^5>SH?goa|S+ z@cPE+W~0Ao8Mx+Lx0k=CP5ffkn$s^w&nn#dcK5fpZ+x-J+k2#6l)vfW)ponB4X@Yy zZC9NarKTK;I(KbL*sqmO9}c=bFmJq@#K)1koCOam%JozBReIk|;wMKh#pchish_lS zX~+-xqo+^%wAK6NN16M561Cu_CoE%OyL0=$$R0zFg{^M&SvLH;z&PJKF_zFD>z+0= zY4XS6tqH@5%b-p-ffG&8^WC|K9W7Vy{QiJf+z zty<-AzoZV2bZ&q5+v9e8e)C1gm#r?|&%3@O#{A=!`}v<$itC?OuyO0Gic!Z`S4c3u zm=+)xMaWww=Y76(&HJGWWy$Rm>PaR;qM zD*~c?e73Ldl8)erM^9Sb!SWo3LoU;|PrTrYFPO@&TxbV|0=ZZfbQg*lSiQhTP^9Y+ z$0{ZP4oH$>6wV4`lI9vspq6S!3B|I3-vd;p$3L_2pDOy(4ikFgp*-^D>m!PMATIVi=58rIdZKNs*R6_P>ODbK>d5)J59%`CsdggHtT zzjm5Qu<12p*|+YK>OYMYRM7U|75o!|A}6GXSqNu*7MM3yx0S_R>9X1j|&= zc*Rb8-zgX*@9`W$7I2p-*4{|lG47_b8Plep=X-6GT?#7Wpb+)ZUQQcZOF^kX$7kFgV=WqrcQ>C0@-b0e%$PPy&=2 z&PQ*o19vV-g2e}R+`5;wP9Cfa2*U6jJL{6@(gYfFNtW_?sX426>DH{~T+Iw{SBz0C zAZ&kM@-&QRW^|_p7dyz$4L1anFx56bs$g%Don?0 zU|5&=pN7%Ni+Bc)3B3A?n#v!)@r7z|P!d;K?5kL(^9r=GztP&ap3^KCYlb5Q!K|^ilP@O}*99Em;H6870BZ4_1QvhCeRjCep&vrKN~6 zHt!%se~im?j;vbhca~ND3oDTbllzp@vG3IF6ydCn+hRa;w(^}??d1lc?&nfxR6z6) z>UMEX^0&SLn~x;N^IQ!ME5OzxGYix-u1AVX7$6`l66N7hvhr3eaEIb_2qc&sx@e=J z#!Do3L1w$~K9UaR8~ptDGV7cdyY%qeSS@o`^{pUTssMt=75(Ix99lpM3%s;r1|%hD z2p2MKjbq{r4%MvGV9Z1N{ZY;o3VW0@J(;)YHsGFR6=YbC*onuv$^Ue(sE(RC>&L%{ z*-XR)9kBqt7#ScfYLWXd!M#4F4J?|R6&eGTAt1>6+<(OSffGv+)8d+|3_boGO&2(G zV0!2eZ#Nro=Tj?#5;9kXlDmmv`|oVL{9EI(t%t%+%V(}q zy5+w$7xsFsei=4;Gsat&0+m8jI)74(NpHHn54B>D6U_~$-W2|1hmoLo{vTLz=~<>M z{d+#s&-${t>j`}uoqeob^2}B9Dkr#i%@H!bu~g^*n8;$58q`Iz)+oM7xQ0iJ0lR=8 zDuSs9Sut=Vw^Z_I$}IhX>MN#Ps^e(g1<*;0#W&X6833-7A{n(D%>Hcne8a1$uNSZo z5I1C|k=I=N{ZW?PK3D)lEc^PcCxE50xRm-V%{=1Rkti!Aw=ezIUcq!gRCbndhb z*R?(Z=+tC(*U1|D<&Pazh%S(&GGQO)H+%I+pw@zgP#J*dZdmaYN#m+-kM2SYn*As& zPtaO%g1lY^(z5TXxv)y+I**u?-PGNdu8juFe=5(h>d4kdc*dkaIh>#^K+Qq|on7lb znf>(2|4h-*Wy(uTM4VQ=4Me(k#j;uHHqp{3*GXo|u%tXf$ENnTaEt6LJc|?G5=Qc2znFa` zH;b!bwpNPM4BZ-eu2iMk{5Tyfn9A51QHLueU!Sj&E&Qv zydg4v7LPiKM!q?fw$5U6iikHt#uK#o!3Wh8#wQv8>Y(?>=1wNeV^~p9WxQ0&diqPl z%D>X$ifsv%^!$KKxyXpfRpiR)5&jrn3~6(MgMxB}?CY2;SiEtKLNnMi4w|Im8+E8y zVBO~ef)n=s`X2m1Gh$!8WX(EuBzx<_Lyi_dM`h9x8{`F*5>wQ_TJRRqZ~Pn-HY@aP z197oAH~kRcy~<3R&lweyTin;h1m@b!`l?iGM&3B6>@quOYRD-bB6Sih3g+VWC!n%s zJ{Ks~e>+PToXR$uV*{qV-=DEIisLO1B z@Js*Ng?!3ft141jbqG93EBDIyVKStlfFuT)5zg(Vz5OeC`Pu00M{n6%j` z&m*AL^j=L0ub@-%eCCBKAFL3&vzp6wwc+1v5^F?w&?0^)EVT;QLc^J`9j0AWLD(t- zz}|NI)AHtX#7eYfd7M?h5O|a`a~ZDgdG1IhQIDxbl;c{5%bZ164@B0tt4|!>cZSRC zQabX{)elGvIqqi~C1DupHsCD_MrHpU{S8Z?cdxh=R(jf1bHTynW9c9szMfkFR5yU~ zolq5%o~3%#Z4-hjMsBeuDPu@}kPO+(ijclkJ`4z)E}1X4pZ@Z3Qwu!vRvQW(x@heJ z=9^Lh0SoNO>Tg)`55oT(Ho0oW3mWD)3Qcy7?Gc?*wc=RxHHtkNaEs_@84gQB+0N{G zzjrW77zVp%=fs>a*Z%m6-SwdRVT6gE`E3}~AVp8S0-r!W@_*R7@E41!Jgk@s5{mNr z=8J^#F>J9p3Grk;J025I%_9tqeBHDe@bPi7WzDd+$IusxMvLER?(?7p^n-PO1L~Ps zHW8o!Ko?(J!0ZV1sk#OHg{bVFWLzXLIDLUX0fMNO<@~7q5bWw|LYa@Vgy@LR3w~uX z?0Lomos5f}HHs=gTFsgZ5BvF|Pknkrm^N#?6(b6e1JW+L)k+Y^z1$ey(Sv)K-MFTo z{yi=<1hw0)3bhO|kSxkQ$b$%ZU9|f)5=5L3>nnB77Wwl+Gu4bqIPgGR{|I0nc~wMZ z0{fY?MGRM&^eDPF3%B|F_>cYWNdsmK=LLaR`NPc?HZz&~WsVlNd)K^^^&k|t^5FQH z5)<1cbB2npR(wyA_Bu3n672%i1-v36Q-1@$X3$0qh{<|h195NhhM6szwFTOYqsygP4 z(=o0)emoH=biVSd2c;j+pM5wQb7W^oIF_gADqHa?_A z<;{4#&}W}F+kNy>*hGe4=uAA=2M?h)+kG%LN>g~Q_q6nu5f<@r7a1Vk{&~HX3~bo-P@6KlLt-(5 zYXzx*?JmBNI#y`1-=n=ic0I-#!w68mneIqSP&E~nXPP{q%>}#?v^eiNo$KTtJ*2h) zxVgowKpt?OqlV4~_tF>JTg{vxdAt?E+6Tx^G1MEJ%eK&<%+d-j&qYAPZ26ktcb70$mm| z=rKqqVH{u68i*ZN!1O$1pd*5d1Hv!I7PzKrkmiEh6Ar{zNS63&k4G`yfyYmcK9_V= zw>De~5wBHY#qen4n207esxhq^>i&WDGB>z=PWpVjgwRD!D4--?(;^Q0Wv1~Zj&8cn zYKrutiBxUpNW0})L)@7pqKrHHKWXGVAGQTjRh=2-|AHZ$(=eMLHU z(n`!<%$SiPQjB)abRu5bWy-(wSR?`aGd=LrLIjnH97VzC_dFib;n40BeU*6ZyB{V} z|Ez^-6*hp?gj1vzc)^}GH01L47`x_}Z%*alraIW}SD}%;tZn^R~Yyb{C4!?Z2+rNJve(N={RaAV{o#m597R)ztHh zGcJ(s(@~=m$(xkJw@Av|l@+iZZ|8Pi8m?3pNzQ$g{T#|PPtcnb|9NL|SK0UjFVwxp z=(m4A(mUbS2kW@UhU%9d!{vG@yk{9nK?K$iSpQj7^$~6OjGkzopNK#y$-izz_%3KY zG}fXh5_Yo|Wt5yujZ9smo8gJd8Uu_$@i>oP#F_pAss`xs5F{3OyWD%llQQz})|86c zsu3~2nb|I$!)qorvrT&e6zxiC1n3AVC;4z>ctYS*_&QmatI`0nRvAhWeo<2lNf&qV zlk}jX2K4az<&RtDQ112<4^q?Ro6cB(A|6_((6o9Tbl?L=t1a<}s;ShNoH zEhh0Js8}+zyX+3I49W%e1EU-WfT%GW?YZVvKRSR3Uw{(taMVT^feQrzsIkbMc zt1g&)kwIO!zAQM?@Y~I#y<`ac7+y%?cmZJSDktkZn!Gs57fS@!yvFQ0rbDyoj5aPN3;(-&`hSzF^?!iT$TuJFr(pE2 zF_*S)cS55`3;4(qdLRM`W&ZDFEC)R38CW=ER3761ShW-bf#k6ygM4>GPP!|gem})s zZso25&xJeQnuy|myF3DXXP#vG=SkrWFx&FKapt_*VAjuZ3G12U2jIwZ`L+&oW4o7F zW-zsMlW`b|Q)iu`80V-gx$JpkXr=%Z0m270J>y4|f^oZNJdLi9f{>5mC-}rXER*8U zjHmT`8|DH&_l`b{{|HRwzZW(&=^8U~#6_DcVu&kLN$FsJa&K=GaM8hB%3Tu2D4-rw3p=TO`plAm~t?5EcnQ)a< zeUj8k8<)<75AFr~1oLXh!R#=M*MLqPeUgzAImozabVW6NdI6@)dYd$&+h-oVJ?o^+Fe%O6k0QdI`_Idd32c5c+~UBH%aE09!HQ%$#W5qT2-tvkbd1rbyXkJ-_C22@OiNH+4@{Cah zapH3BqjxGOk@(~_fzjX$zCf1xZ~PC7(IAR7Ns~9lVPb`VS(C1Fe+bkdIX zQ_%3tI1}qV)+;oAaY1pn0uYhP3@#m=_;vpEc_LO_!WYLkn8^#1->=9I zfHRBQr-(7wPVyR4zol^bhi+@1#D?XUwQ4RGO&28T2V2W7p ziDcopsmTAKpbxr5_nOXgq(bogIxdUjkXIa*$JZF;aHRDXLzkRpOeDwa44f1#r%;wk z*uDo7Aktu{oA>*J_IRMQbr1j+l(&KYF$V1O4sE2pJI9CC5-jYVd#e|Sv~fmN{{>FZ zcZQWeZo!cF%e)Z7p0VmjjqxcSs-nQXW@+dop0`_y^w9`on$(6&>#vNe69DNxvfODu zqPK_-2jdE0?9It6YIG>P2FL0tE$JwzchL7cz$W54omv3QX<)XQL`?!;H)=neKudCj zZ6L6h@n6nLfJMq4l5euny%>S-ev)x^=UtqB9db{<#md^%ttX}9_ey}8kubuUer~7E zV=jo=V*`q34vK^!UeRBtIl~CC2nz~C7Xj(*IV|@1kk>NO|K2A7Sh%V(n)OOJe3)2_ ztMTdLwDL@+xpDV~3g6vdjxTc{z9HPX7JsA!6Rfy1yXu5lF+n-?8Uh})e3o7ou@~jS z4*9-*mZg)Xqe3nd-cN5NO>~47^}x?lNP`T2m>|AHPV$k}xk4NEK58hxI$D&U4-6KK znVD`Im7*A;+jDVOtPr1B?!ahNLL12T5GQ z)BKZswCQN|9lr!z{z8@5X?F0!4*4?I+9k}UyRiRni1AGe$8q@kczX8bAra^(1FU~- zx?E7Df>zv&tB(;i=lijV6D?RhPtb~L(VAj~%`lg?GpBA0LI}=192G-7_Hx~?wXPn$ zc?kTzC9f4st}_axdUeSWD|;Bh!I0ZfivTLVrFHcB* z&iox~w)qOD0P%U3=?!oXD|5&%8m`93ha$1kn^4?TUaX2Jc`hS7W-n;9`!H+AEWRQJ zRKak9J5Tvu{0@D{AUGgezJga?I-dm0QJdJTU}E2Q4d-@w0Jw$q9lv)D*Cg^K$7-KY zI$a)C(_y1~5g?KX67b(P+8_u}Z}qGT*#fjUt!Tuf z{vO6{05`g{kfd5`^vH1-a|whQ`mKy}k`%kTg%#u@Z;y-gmDUWFmCbi*>@uK!%i(6z zFhnPLQO3&BQ}4R=EeOp=#^LY~NLbdnJ$!_1XdtZnb;Ujn!tl^ufnAax5Qs0qc%1AC zit)BVN0hP(YZ8S@!yQalik!G?F9fI}>Df*7WIv7f)1KCzwjZvc>@^%?6suITDk4)k z;@oLJ!!VM>7Fn5c?w8JPwG+-Vr6MdXz5R5%6>wfzWfzJ$U_8J?!8==lUv2O|~i| zBPD;hQU?~@rRI-q`}asXm^4U*mfH|{_C6z_e&1FoXZCQ$noS9+8Te=@H8k#{#1BB! z;1);FZ^+VZml^o|KVvFnv<`6*^F@+%Vg7c4Ff*U^8Up_D(!ZmvSFQko=&NX~jyC?Q zPVDWn699hW3nUutKiag3h4;0NSDCXDY&3KdKJr-+p6k8ki`i~SRi`xQHrS@an?VM6 z?H5poQ3J=I(@W^U#ir;Xaz!z>6Lokqom$Yh{DItVuvxNLoMJU#NtNU&p+O91cXd_Y z=X#VxH+@2Ej;br@gDv9ZlD`bsK`UKD>*$yjR4sz{(BSusMLbDNTeARG2unwFOOB}i z+_X>?3aH-or5};OFpO5|=1bKAmbo&02fbLX;UYii-Am{rcAB?nQ!X9D7WcnER2{;7g2O`CnmDqslD&5 zT$#9=86^h8>eR&JM5y-HprJAk_d!`Xo{3D!LFm>+XoB8JFkpJ%<5Gzs1=e44N^GzW zeK2;cK6mX0T{a{&`Si_6N9rQj0LN?~K}?)H`kLND9ZEK2pz|?AXUnRkrJSS=wI}x- zWy;21&x6s#&ELxjINUIDVqT=>n@skxBqZQe{IxN;G2ROGI2J(EI{{pvc+3vE3F1#j zHsvPD{$M$xIFWYm5I`yV^5yKEj5u?a-PF-rY5Stpz;EanDq?P8<#xdf#~zM;m_fVq zK=c?Dj$?RyDsol*b}}An{~^OEOIHZ*XM!NV(MupZ&`+nWR1kma=ZogS=e5y&^CKIWrsSX)wq(%WuA7j)`B;(CiL>Si3{s~ za94)^0lG>^eLl%#+Oo&fx3)^l?$XqX1FqJks^AH+dw6!owHli3mq<_5zvP0UQ#*bw zyUBiP_Q{jCOSy+J^wPTjE{1UK(WF)_DkW9FzXc7$iUt{yus}n#`N6dIJ{JVhKH4D@ z6fagT?Ao~2-c5KK@VVk&7dyrKF0ouv;E}sRw$uBnJr~@mIf`0}86d_p@NF?>2|487pSUA7D5ML&Foih`P3f{H!0C zZ#}4iPMgF8oU^RTB z`-%&lj0v<$@~|dw^8sh6_SiLhuax+gzgt`@WH`YgI<`_AD9)LJL<8c#{N0f89z#Pu zLVJ2(&vzt3i5>Qy76irmoar>+DuvU6ABk2;?YG;G?ENaknKC$1OoHAm*%=;uoi>X` zm}229Y!kZUgUKYdZv7|jsOTa99~WsgE-dby$EA8i&joT9G%8Wn#_ATO7b+6$$H0Ah zvK^>@O$F>Ylx(W!ab8s8s&?>pZ+4$de?4&35b6Wd8Xf{};_sHwpRsenUa)G_4r+*4 zxiekDG}>k)IE&JUYxm55kZvmg9~YR>oe`XN5d*jw<3Z|B9Lqv#gu~bcVtD802lNhq@UdT#@)>R4_FTlP?S3K{KRPaN?uYMMc6f>=T+Fc^SqV%oc%h~ z6r&@GLgB}t)aZ05Zj(4E>Iu1DxD7SiN++G zy?23k`SWh9bv^9c2Yl0w%6OdFb{xX+{@^S&FRhA^;oawotT4LtXv3^Wf>4awvpHCP zu?~r|>W8azN8=(dS@Ys*_Q`)T`LP!heX+!Dx8fcEFNQv@K+swy9<611uMDQ0e30Hk z0Rjd8@~(UaLHQ4|kJI%3N(f^!%o}FxW~CjOnDTsl?{ad>)@NXTF=IDuDNycrO$EAX zTercHiDU@i?f%-ck;jTIPtaCDdKDEfcb~1De2|)xaK<(|S>wwynb2r+K;o+owgmrAXBqY_P1=L|!g5Je*g1la@DSIJ+ga$r%9cHjN{hO-hrF9Ud zBo4JO3?C1Yb}k%u^U*>E60i&3b{b6678egkL;MbJl5CNtZSv55q_0GzU4B^G8Pu}M z$e9mB7!s5a_tFWlebrQL>#stn@07|lfWEQY_Aw50wos4ucF9q0xH$BF^;kY4u1u)2 zz$WKU6pUQ6h01(*8Lwuzh$HH~@ESqM z-e-VP{23~KO+F$qCbY4TZ|2yf7Ej{srH#YmDsoy7`Csc)TeF2H)csO8r?)!>y{tqd z*(SUsFO!^sn#pD+yKN^GlFt~yc>!o^`PYly2iMzJC^9O{9NdCyBzm4-zcqFt7Dz5v z>gZfV_ee9fYneO;i*@aHy-B+kRSpc59m5;OnD9QP%De=@*Z$Od^nSIv@&`HoEJ!Y= z?jHQC|D0PZsW%MG=+I1Drs*{N zsl@h@>@w;0f4Bk0F$84xAD?F)Y@X1Rg{;Uo4i}0x4=b$wGU5CuuYo_ALCt=KB{o;K$z>Uy|CZBIAbB^rac!kl3CZD`@!yJ_i)vYSfJ`TWHx9TuLey~Ve z@!N$MU{Iw8YnEg^*)eYP2(1u9Z2Nk>B1ZQiABTvkX3)D}Xg6C9n^P*pK9a}x)+#fS z6fY)lg5)Of{l1R!4Tk{Q2(btBm*ceA%03qlX0%?+LH1&qfYj;>^TF$yjyK4t9iF|L zdaLLD>ayl0Xf@o%%Q&40dM)5Ej-!m!zSK?G@svX6gsEQvA{n{SIH~+=W}R^j{M-we zDrK;12Nf-I3}{{g0Q8~_OzbsD3g2&e;9>;Pqh-pLFc;HMo9P0tkTCF0e!$uhO5u;? z$E6sMmi6brXbqe+CZWzBYl^PKe5=3^V51uA3r-sToaIsP?@HWwyqc2pKP=PA*B_IX z1EE4n!n3Aq0tU-OId2Zdl~0Q*?JDNJ`+ zN#$}oEEHV@TvOi{w@C?ul8{zXMQNC#G=hNA!VhUdMo5g<2&KDo6Hq`pq+vt42huru z)EI2kVDabw`Mmpi_uYHmxt|;FymRB6?+LgeTHN~<>$%IDCS=BVm&o2=%oK<6dvUCS zUElJH*|8Mq_q>judjT=86THh*26g@v;)7ofKI!E*6rAbPSdI}PgpR&lYe{ zF24lVTa$ijb|9hv>%(BKPoDEyImsmJMY>NZ8SiN2qY7$P<tg{3`v{Sg%@*?8pc2$9|Q;2>C@9Jb%KM%@miMbY+hn<@f2d+6UX-9(| zb&Zs*U8aYuv@=SvwQ;q&Fzvz|-6LoUF3ev#+sZDdFQckgo-Vl>dV}Au<;G8MaV@Yr zQEm@l+Hw>W-L~l&QUK}083$O zsw|pv;X;bg+;=(y`lWB)|87;c{=RAZv1XYyD2wI-G5Mj#@K>+aYo_Ug_^X7%#YuFp zyN#e+xrt!o&II|o|5#lF)ei`9gs4>l2a{YnTgo8E1efY!!3mBF0q&Vp~7iW^f=!Wg=i3X2C^hu_j# z7}l&j9c7+;@8b9#OoH?r=w2^+1m_>mZo2GSvqfd+P3C~B9A_Hazr{XU{${URA2FD> zcxP{ek$IB;%nYM#?H14CT;IEO<3eI1_Pa{oDfiO=V`uYh-#Tsp|B1iYPHSt|fDg}_tJC_oSM$^csU+J5Uhxfc!`Z)O z$rH*{j`WS@Qg_Zgcz*Lm&)aXl*JPgW50NIn-|y+vPdip~VA?#U?rvAeE!SiEVKuX( zb*J3rFt=`6JcI(~-0yU2`%n8rFMalkOG{_gqbmzYwdZDb7dJKxA7M;%y3Uz+mH+7I zAp(Q5`L316$N6Ug?=DfSMlU)91Ox`pUdWhTCmd=77d=m{+XqISj$A!-*SX3lza+4n z^6`eiy&0d>nMubq|H5UjBmGAAYA4gbFo#EhO{KehRK{YtU*dEqy+GP1QC|x@KYMTn z*6_KVP?)06S0wwcMdf4be{U>$FlCKz%+Nt@d857OJ6QW|uUx0%7t^?is+GZW>vzz` zUK_4XD!Uk~$0nacR)>EpLjE+C;OS$jX`XR>v3~XJTTs&5;d+jP&sYwRyX@=x1+hyv zolp554#pJ4#IBecshI`Jh><h-SPr_!Vd(GM zVqq^f0Usd`Y5OUALBz{C#WJk^`$J|hNd7g+XyBlq`pw>w^4#!35*1}&%phYSHeyB} zf9Hyq#9rUr(@P8cu@^Hov58o@Xpe!aoFT7PCTkZnw8;546OAUmn7K;9slN~VR$KL! z?XOM8h%qYN8q}?v4gL8NARj58dho95>YF>Ox!osMM)6-SVph}N+?xJyr2b75ra1yI z45Vh_cv&O6Y0$H}k`ryoF4l8e zJw4wJ)e7?swD@TJtB!I0cilUJYYfwe(e?eJyg6`mp=iVLv%WTA3}2`#09wLgN3})=!1!$R+{%`OUa>U(UOn zB~tb+O$)T|{~h4Y5Q%0hBLJH^4e`!}sVl;N)($KFYSpe)s8Zfg7YEc+8q!mHZhwtr zTbC<$p8dGut+t#tz@>0}f{3J~wa^oT*&j zy}a4cA>Nf_dHH;ZUBZJ!Mg1Sod{6svugj&04T}mf|FR`>n^uA_!WYGm$$eW9IGDrflD48FIkrnC)b{gbe2OE5Y2rty z3;X^>#*;D(ZCDzod%}%}>PM77NsI{2Y}t?Dhk_+n{9V+F86 zZlX>NUgqJf9jkjfY@45dqGOWOM@SeRmgQC& zG}rvMM^!BRhR*YIZ+X!7?KdwuoA)G`?xb!kqQ3tmBw3KW3^nbG+&a{MHZJr=Zf66VP1C=uzrynedy>dF z54vnsI|4Na3k~Jj->4g_oQ4UT=h)?CJM)ne>7{FzbX0jCsP6IoF~0V0eq>~3masQl zD`+(2BkL58m0L}Keryd;w>IeG?Ga6T{_}k!Nh3;JSXq_ca?BBSe?8alm##N`z*mLx zfzm(jv?wiCmCT<3${m3!op(6f8e2@NCdP~2{d=&&PR6u%-_+SYlQ@ilH1&l5uX#Q< zjJ^UVFD|RRGFfI?}9U*o{{SsWXF%e8X% zQLNEw7^#KgNeZK}@~FZfHSlw@92&tRo53d=im&TSbUtJ-Z6x2XjriQe8^?Avrm`mb z)qib!1`9WL^Q7&};$V^C9Q+am|2X@SF8yMvWBjv(eS9`j^(GtEa=9 znq-vi$vP!PYuEj}IzC}u=h|S1`deb&;T`=4^-bmb^G+#Kaej5bZuG8_f8@tGOxV+Z z=1=i%{*lKLtyB}H9e$kj?256}(Vs8xNPks4W)qi}TC1D}e=xvw=H2}}a~~A*S&{bO zd;GLEFQ0Z8?$8fER9;=#cmBrV*!mo-G-fr9V=vFX)7Wz&$!zTQ?C!c~Lg^QAj|bJ9 zq`TJ%;Ey%rif#JUK`_7eH-xPji_Oo5ckoAHxZ>N_Uo(r>CG%}I->MS|OGv)ErRQPw zM3JXLDxS|zyf*#qvpY?_K#h~GS5*%gW>jrk+`kdk6aEeHCiQe{&mccQmyU`bhBc3f z%F@rK3n+Zn%z(meePjOYV70YV(Vu%)CGxKvKihwu<(d0St0byUdfA#!I`nn^bD_02 zY=NysOc<#6xjQr`{6C?qUV|^Wp5&=-{3-r4=NiIZZ86fpuaK+d{L`GSOv&{(th(yF(O^%-_--5>^Q6}67oA+I+F72O2I7yGSe(U%pOVaMUuDke z3d+4CcNo4BEck`e;)pXEy)K!B{-;f|sX3eVOPxP<~cAsiWtla9r@=Cx5>CuC^r4))JwA4v`< zK8nJ;X~5x!7iB`-KZq!TXuq|K%era&{5t6H#(-XkHYAQMg3g>eLwwc9;+4Q@+$_a~x(PB9rAvB^CasF?9?QcIgLXcKDP1Nl~Eljp560Cw6Ej zB;%UF_?-vZ4`Zb;G9a~lkzJFacPBYc3b!Ysskwb_wR+#1LnDpu?~&*26W`qohyEA% zHPXy?>Q*}0jAeC!Xw!~v z-p}O&4XSHc6WcCkj6gpI)U21nzbN^J)memX`G=cfeVv<;fb|ABN#WU6!3-W(9!MqD zwz5s*uU2=5b2YmRdcBv3K59HG0dG}7e&f-Ab~%2isd+-jv~Mr%?3Wp~xYlU+x>D{MqtKEtx09%gm{nNRY z-J%;s?6oo;B}^nWk>`GL*R>P6{$qJ>Kw}bPl}6fXsk*w+>U{58H)-may}9a`(qkME zVlzWh)2r<@_iRxSzq?d3{>u}r@A`*JLU3mFw*DR`(?Cxh_X%Nw=&)`U1 z{<|cOtK$Ktrwe=3xLNyj>1~nMn3|2)@Up#FMSVnozYdJcx?uCqGHqR;S7?s7|4Ai& znd9Z!(JQ5^za};I9*F`lc?zUqb}?I zE+G!SdxdHcx7b|x^__}&X`<<*uJtri1sfGlzM|R($%+rO({=S_rdKmK0&mR=QB}HW zC=002uV%;HoTtD;AKe7zGnLM58?$u#OA6&@=}4!CKfYK}vC2k#0=4&5oIO`B zrx7_Xj}EpAgKiz&B0OeiNWHo4UY;-grh;%<;_s^5^?anB@3Uw%_Im8k{3GMWVwIxO zq>$j4{vg9zWp0y)V*ly+rCiDm@FlpOp`0P2)<^c3qb~ca)jW+^7u(TMA0buY@FvWl z!{7abLz?-GAa{d?r7QDT>aCriWizIGKWp30F&>loI?;1r74?g7;9m+$1Iue0gZjH~ zzP)@?0g$z^eAAEuz$~NU_R??{qlWIJ44wgx+_$Ia>as4 zgP?5im6)Kfp2)hu+jRz=rol~Oxax8ilB1E_n3JEd-R+9gnk;1fVA}hVvk&#b*${;* zK=sYkc}dH+a)pP!LXyXCFX%)Ku8DrvvNjS>)5G!^nyncHUB&otF%QVA^sq&I8rB@r z)4MNHqLTEUZ%Fx(7wJRK19u~V6St9`&U?R2u4vf46o*SM??)3#K`@(FGYa#8_p}T4 z=}>{<8i9|wsmJS+(w-d4(vJzX2}k7ThD|qHJhpnY~s6br>gdhrPU+O^oySq|`lYfFDu zX^lQ`+VnK&p3SQt;d3wGi!LR@UcMSF>pbF~YqX>5`^q6s?7s_2*qwem*(F%LwQiOp zVzl~9CkS->!M=?AjcRM8L1kIM;7!g)Q1fkO-gpkf8@zuT++B{-?&uirJXL1l9fT@Q zMzLFXXfKCf{_j4AtUN;yq;74*>=KMNQHj2Zm_9A;Pn}wG)%FW_hxxT1B+YdVI$1U& z|MC`AIc2c;4Y5Ud*c#7bDG6`i@eUlN6g*rNo{gZ3mLBE(8)W|Wt8wMzu$QBM(Oey5 z1fy0e>;u-x!)&Rutt=MmDK1aKKGsmhF4xPOyD<>6izW3j0yXC`a}DEu5opV=yc!~{BC;+99hn8zTj!y@8b`&eV@n7@ zs#C|`b@e}2EduO+vS{%`nZ)8a%`7cF)z}vo4{jKR0}bHwAM^|ZbXQnC)L9(+4Hvk9 zM@mJUq4o4G{~Tl3Rtu*DRv>q+!DR)Og31rIG2%BJ*)Iw7tslX+r-U+C*dD$HI9?!M zyv**}{N4J|7Wew%3h02L)N>BF{N|Egkp4!s#CfVhmg|cao)N7QZ{*gfM5E8%cQNOf zzNu~G`fIV!MT1m$nWGL>hOoN9af*DPD?B6KLozji=Q={6-N=Hz%9-I&geuk{a@+F? zn3*>A-5z!6#af;l_?2Ypfi0A61vOYkeR5{5_gbd;U*YZ@#;ep`8G5QLY|O*70V@W3 zFHDUh{a{3+|E!XW?uObmAN1B&sOo^aIfht>6$b*DiNPT1p~bGiJ=OgGZdUxbCC$!q zR)4iE@w1rr-E3)}vMuXJHIKLUY{oszmF;tG(&%zsqvA-AVBn(_toMF`*|14Jl=tP< zXjQDKy$0{nT^W9(5gQll5-t*>%G#_nI)-5Lm?^Sva@z-${)LySW9sjC-M-J6Ex&l5 zK;Bz;AmsLA?eYj}31B_9^TUnTQLtWd{%RA5N=`JxTiQXI$DTiyr|k7u>lwE)*C;Qu z>PI{vRMC`cPCs3fp)rsn<^!K&-)`_dE?Sqw5TeP_4|I8J66VtmRN9dyJn+wT@JqSG zX#J21>$p#%(ogmojllV=cSPlGXR7+{i)AX_l^Wro@ufXhmkD%Ryj`HrfAeZ`L;+G2RVyEXr&f)pTQAn_-z56EmSD1b{lV2oU zVDCzqjHyJ0(U9_7irKhkY3ki!mRz|6*$&xk`X^pDRezs`Jb$CP!HY0BS-6xxGWjBG z$-w6}TCasJQEQSKDm-Mqc(CL|&)%!dDB+qm*LurS`%j2dkm{@8?>o10qa=#hSibvkrb1p*~z!urhPA)z{q^i5?`R|))M_6e~dqW*?K3x34>=RzP zm;5`DoPYMYuelet@scd;pGY@sHc$EaFPc5qZt2s%%op5|ZhWMEbt2?8bIcrHd$59U zPkigsa?WSj7sTYAVgr_z7@Z86`YY9CNZE6XEYA$a-PC~it2Yi^S7ila>b3b^^wlITP=19l8BMdY55*wKpUGjb_Z?S#iDl&){X4b3@B)G~#=j zhI046*gA!QUHd*ZbA&t9#lMH&8NXJ!NpvRAg1@jZrq}GJZ%2|e`Coni$X{|h?}w@; zr1jbkXaDKCfWX(k>&IE#arth#(a3{^fAR|I0`5lf`g}DgsM^1(PJLxA^eizrb}&NQ zMlbev0FQ`g^S|?G*7gjgtIcJX?dlkxD#*%>#CQ3eqv3xTSAN;n;H_Bm9B!PVHD&XH z=Kr=?Cbb)SNi{aV#YJb;kI{9i{QZf%Z+g!grsSzVm0X!eS$^2K;NHVG-{GocId%?( ztnpka3$zsFdb$vEhprX)au8uo8{@c_PbHo6j+*kz8I zs_NyXs@gX8PV@2G>UY(}RaI5Rm$$xsJZZ>A-r=MV11X!Ho%X_vjKrfA9ZqUkje73^ z{ruMaxpd1I#LN6wIz?SI7Hb0hrpB)-#~Z`_rfP^+V7-#cP0i?!$bE@J*%_yq-xo+H z@n#?j#|lKvRsP`<#H7X{AZ~cnA)+vjWYe*-KqK>p(`57hyiB)(&BP)yr*?U8Tj4y= z?eC8+lyo4NBz{xI(rs3?WfMUd>i)%;lX_{?9rKtm=B&|ti>qz=xw7=?^a?IeORY^-fEri;16F7{q46N}PkmTHQp@hO<+UA!;IZw&P`VAP!+1f5oWUFZP zPUfy|jM->XW<#~%@iMR?+WZgpQ1@?XAR2nQen^*1#q!mn8P{EhCLf!ke9n>Ovu(iFFEZ>su;J=*deyGOB6hd;*V9$ehQiX&7Ph@Kxd!UmGED+B8H20!e! zut;L0y*-xa_$kp`f#yY3ucKK5aes{Czhles)ReaKK0`fk&~bLwd16BuWc~MVlx6jv z7qWI7k_jdp&&v##fFK7cs(EV{;1dJy5T7xHOT;u3%5CFCrSTBY^v1?@pq0X4?J{xP z(0fFQY16+yEPPF2i3N0=zXFZ5x*53WUFt9v9I3!v3C3R_HzDs@RuW}CK>{b&CV!2W z6!8$7w$9b3dcrU*wVNAs%D!&+npfu8z`+LxXqiBJdRn;8M$Dk}*CFktnzLk@a?~w) zk`Ge6TR(b#?@-OX2h<`&ol0 z7By^nj#Y5x4y?xa`@mr<5MR(xL>MO6SlPb<(r2vD`|Vra+r2R?MuI+%mq{3UGN31els zCZrOZwNfjQ`2_3u-+#;H+7eD&b#}c2GR_Y+Q6938?!uetVr-~kO3lqsSilP(EAyJu z11gU2_r9vi&t2EYWf-?8Ge1pb0#Di<07E?fZbPFTAcd@EWn>A4jc<+#c$BHpZ#wT5O zfLSk0cXqDPN_krag{xOe4Y~JjIB-)o_81&EB?ka_yp5uwVi?qV0oav^X0O^E!nYoc zWWoR~rJ3A}vrnz@#LS#yFK_mO%O*G0`UH8shCS>N{CH3y8_j+xvmjt{2Cc4xg z1|lwbub0&4p2lGPHqlncN_bzC_erV0!deq%@1n~adVahEf`GkBN=Bp3D;? zr^@3a_>0PegDp_lA=SKTc(}qPCz<(7h;dgYO88f9AnHgrTxthnH8&QXJ5NuFH%K9;F^Uv>1uWi70f`tV46S`Mf`XuN z+6p;`tvZhCl?*QGx)Prqxa{KrctyPiJn?|nfg9z9&+MJPe7O=cQwN!o!+K$c3}@on z=v>snmM*=QV3$&m_X=xze+nx7>eh^PzVuqj&%_arKBIFs>phoB=VnjEG25{c4$z{) zT(pdrJpQcRdt`9TdkPcPB^3{w9|12;$9)_GIxLjtdWkx#S9r`<8=B9}vNB>X`^{Iu zA*LT_}18E2C-pJ!PboIK#6qpaaI&ip^tc|k0X=M|0-+{aQ8`MtX@U=$=QW6 zyaDF8_^_v_uupNDDm(+!>_31n@5i-#h@qS%De^P|XDB4D;j^s&*pXHODD&YnB`&)K z&yql7JIt1R=15p_>%m5)9H!k|9F_<8YV{bN9?9%lkXvIe7Ddv_yDqh#E=6`d4siqh zzxX=4XZs3<&`p+yWQ(JI<z(&?i7CB!4Cj3fH55frWUd z#84p<@N9j)k8!97;_i74rC1Rrtv~g4W2Maz1Yfx+D!iR5%esqcl4vvSdF{&esYf9$ z4MfY+fL7Z50zdtVqFg8h9~Qw<+$pk&r5-)#TGz3~b)PkbfwLyS0hGUd!L`Y>r$DX$ zy!Vhe=5K;zNi1fABA%Kr0s0K5c)uUIN)F1^7 zJ)Zex>W%7u#Y;CcC>0N~~ucE)(FBM77v-n?_0 zUGH2QY8-fc@GKMIUDm3Zvp@I|7qDSxM8U=+9EKc*4mFEgg(_w7BTK;tj7bE;P2X&< zt$*fR|s z=YBnly1UAy`V{UbikRoaU9N8+C(F>b1j{-E;-IxR^%-KW*Gm0Ay;`a)RN$H2(ax*c z^!GggjdfD8UEniz#J<=PTG|w*(bJ&b?@LnWgZW8-Tf^{Pvh72V!TD#FEWE&c+!VW9 z|L4@x!xfV8y?$c9%#rj(&9TQ6~_Q)vGg?Fag`?3w(8hfi#TFP#{xz?n4N%?muQJHIL?$5Z5DeWj-n&vumWfS3+d$Hff7>eh zX2%Hkn940=#k9@yCKcjN7HQZk1IiJm$c)Q_v;)a>kB?hpvU;0*ReILgDGxs{Mu1spohXWZ1Uz^d-E(JE(3N7@vAr9OnT(Ry_Hf0#e~GBP+7R zTYdfBXMJal^~NfdYwgKyvgKCtc8zO^gHZQ?@0&2v($8Ogoxqx;rWnXU!VuQWWa<@i z(U(}AFciG0#1rtQ$6O-)RMUYt_UjomGPm50*l>Sq-AOb_=8IKF~!HWasqIk9dBhZ%JRTK1ue?}l> z{qe|Jm!*B6?uOrw(=sl0srTRpQW zsH)u2J8U>^RcA~>8;;aooE>m&!TuAaRQ^a0prjFw1MJGX84v5o>pj_*NKTdFzv;SbGOoA-6tAYOTI*Z>z@%V=Y-4CLtIwn>=m)#k!>|ohvU~Fk$Or! zeSRh28Aa1gn$!FKMShL{(m^}O7kD7`3emN8mvH|2tkgJ?Sezp!U^ytyi`|Y?3>a16 zJWSjxnEM^AWrCJJEd5a7aq?eL{haTP`H1SlCxYeV^=PU--(lz1!-`gjE@HA@cA#Q4 z+l8;irg58@dv#eTf*(EE6~ArcpLt4S*00PhY}o_%U3yFOh~IjuWQAfK#3u@4Ksm5@ zZjE}6nP(q+w3nC^QuENe&PSaE9yQMhi^(~svLh`!4Tpp?!iy=M>=5op+q2^V(`Phi z$lo>bw~70khtD7?L0jg>RD1{NTBn0FZ&wL`He1D2(LVuN>?yVzRcrIECUOGysfE~7kkdL3@M#IR!CFfJ6%iT52#8!wn7C-fJYJ7|m zeki34{ByGJXm#`j2(lz$4of3h;R(VY;+3|9k?50JB+!=;3z#3-LMcdO$Ui;6H3@AGzG@Mqsxj` zqY4;;<`u_KWq3V6Edn**E43yg;Q%o{mBK=PNL?BVdhEA?U^274whlbNohS+<2h9#N z`A&2&;dGj{aEsJu!5%;Q8<&&jWvF!U0=)=C)LHT7v?K)9Kt%vjBR65&a-*&2=q`m} zFI>Q*HGpW`QF&iH0F@mmj#NK=f*)cN#u_g9CxDO;*FHMvk%$ym?6RToJxKhoiS^tY51VC(lq z`lgQ6|9qGzn?rx_iUq!l$^bl>hhB)Ak@5MORZ>xekX|0nTgu&at;neId)tvTZQ9WIzeU$-PxPoe8OSTN(>Fp$m|d zjf56t4URUza-4gxy@20%L1ec-{JHw(?-tvL*EVRBw5g@>(oDAtkPp3Uw{Qk((sT@sE6 zy^`(FDy0SmUg&y1xgO||48S8BWDV>@&QI=&8e6j-kn!a_8|Y5>UXs`7*{S=H+6;H8 z%*k_W6fo&npHLp13KwJ8 zZeRqgt6h+_@0g$;?VR)(SmR5b^^kqj&*ii zPu#EhYV_R87FObj%f$%dcL`=qP*3;hK63^?n>&6jU$Q@Fo=eHqMZsl7 z6_lsM;wx0W+0jcCkCVLmJ_RUw|8$J1<6n%dZS7OvRW=$?N4))WMr6Wu#737b`2B}+ zZkcU85R5+LdG@#3G~8yLu2tSV$9DPFUPP!clD9HN)lzd~eOGkMrgpv6F~>_1{2keA zG}1|ujW;hNiz)Sk+rHoxxR-lgu`;~a9i?eW$h7SxRXIPc6=#sp!FWnul$Y9nhJ>#>K3>QLo49qJ8v(H+a6lv5SqOxx;B>6i|8*^%MU+p*}Oxg z3Iq1ixvGp*)`2J9E+>muMsJPD!TpHOFsv`!ag)cm;_#Moe0iVOCFvvzEHQl zwZVVs_aP2$41JGq1`u=T!(mdXt$Hi6(b`A6mZe}TqE0Guczl%6J#_dqu8oN#)qCEs zJ8c~guMY@fpZWd=U}temNj(7N%bP1B7jv9pdS!~~cxCa{_z}Prg(P3CDO2|~*5yuL zCHeL;r1|bT;U7C6vZ?Pi9T;dH0F?Sb6Uh3LDladE?n) zUXb=2;Gz)bGtZj3i^p4~wtz&K(8yTbGEILRQBRO3h4a4S5`>kQUp1SL4h2!ZoN2$B z$0&A}c{0dqmXalKEcL4PBRhO+#!N*raVehVzT}Mqw(FG*hjYg>harJ{;aM`3%JIH< zzvx}?Emt0DS5(hM&S_SRFi8Yk3HtSZV_S6&s|DsE@K_&~0^5;vwHU1O6~v#O{&>#d z^gDNjQS%)aoc*bX2eKeb%=Wy@Grga!i1W<6_1}g#ah`4Sqb8)HC?(S2E|rp~`!5{n zq!TH|;ey|;?0D@=U43>Cl2{_cNjbSjSX8RT$Xi@vNbrdbgbifQw0!u~`vThAS4P%&fce;mf@&B&l{qKnhWX zmT+@2Ja%h7;XWU%I|c^*)^>(^SW7PI^Spmre}2GnCj69v(v^MICpot2&qeOG)Turr zOv?O#b#D0IM}r>GAS4#g0k1c0ih4|&+Vly@ckRH(*8`VJCxlECT7Y7WThwFzBFK;J zxpzXvv0DeCed6x0x!J3=V}R@BV1*diwrAq8RKp73LKfGQ^$3HKLZHnQ$0s0-r)S<5|c|2Ir+sz zG$c*Zb+Q2@L<>)RM(y{=w$bV22*sk4mbqU2Ve{3F21RjZ?aK8r*6SL!C=RvX&K3%9SUe+ii`**&;JjBWjuhBS;_ za?W^+Dm~v}^3`7~S+chh`FqM?9EHeJ%%sKLBfnThraU9dtr67s&UAhKt}?&`ZY!aV zN+$7ucF_oT-Vrsh7J51?xRc_zcIezr z#itgbJQgt3y}nHxNhQU0>%l8UaaH;!)lf85M{>OEV9#RW`ZS-gsT^nbDT_QYM|fY5 z+ro9jlMb{)WC2m$Ejb9ETmlYUs<>9m$gc17&#;652C}7Ibm=`(EUCGDYOr;LP%ifn zEfWheSaA}5TX*>1or~SIJ?xz$wMFB4s3R9{c6Fw}`eF>|WCXsI1jAJ%5hg9;t*vN* z%pjvc@^wPoT;P|fFa4$S_jjY3-+V%VHNMvKT>fZGzv6@28*ueV7dN^naq+->7 zFc%y603wFta?_<>f9LyH^@Fse=Qs2kpb8Z0LF~yd4a+>{xdB~+J?77HXk}IYJfo4# zXx0zX1WZHI@%>g*m8UYh>4e1iP_1VC>on@qa(1zE*Ji zpeBH^@4WXJ_yJgB7-q!C86pEs6T|OZyra**pFiGyk!Cw;~4 zQ?rq1Xs=#-aA{%Cbv$%DLex-bmSEnmo-WzoVcF+rbX0Sxg`LTPqixmi`RuU70YFU~ zvtT4h6VW}D+Lh=)ZzhBk9jRh%c{eYDm~TH181}^ho-GaFAw`F6gf!M8CT|hfujM}T3@ohT>SBwT=?%wC-SZfp4{JO{_b~b!-q0Ylk5%Q@SzRTbo56G;N9|^GhX9V2IK*oZ<&LYf^u-P z2$p6_S3FqVOnP#Y8EUPxmR(MoQ{`4X{Bl?@Q3*bBC$?>$_+tyZSDgt#CowtRfR$Ds0v@Ox^#Nl(A*E$b0Kj-?*G;A|6 zC5oUv{8B7NfyhCMmF`;%2R$>T>q@CI#}ZygnYCiv$Na?gKW=*uPgW&%yrse}S3Fge z-iH`69&?gG!?{xctfpd8jmDJvMgWb6`I<9kjo#Nzj%Vh~Q2;%N4T|-w)a*pk*PWay zpGCRXiZ3Z}w6L2A`kAkNf42jFedo7={bF-1lsUO<5%in!+#zqMlDy-7=ghkfTRD|{E?1LBW@Ut`~jk6;2q z+Xv@Em_YhbcrSkWj!EE{XU#E+p2c*7+v2#w#$M9$gJAI*hAf}P^j4F_%L(FKU0i&h zFOD>&Ouk$?^D3Y8mkb&F^|mTtPHj(>96Pc56wX7Oa;~e3zrB9BcQ#J|7I2r;bZj=M ztvO8j4iL?HS$qAZF*S{!3UIfl=JAucjSm|JPQILlw;E^$2f~sr)y4YRe5#54)+br$ z(>1DR@Ep>x_lb|V;&Vm^A{$}+2UB9hjdRuYB*0uUaJSxwxl%BuPBD|Jzo>VgiS*lV z?b$)*QLPvJ-|aSA6S^c_TzLqArevOv`9+*CK0EP4s- z^_?$#0D#~kTlVX>U=t7IuKNw17Xu)|gmgA407?U{;B@WyVhF)P5l?FUIk$mc7L*pN z3S{f(H=I^>BFtZ}ctu8pGIkQJI?SW7oQ~_(3X0#hj;By9)XGVy)Zk5$@zSsyhs|_3 z9XRWBi)_!e|ImuZzi2PLN4-)%o~f;;H^7+d%;cPqZ@haJj6aaMb|^E!NYf+vwo7vI z^f5ndX`sn42UEw`epjWejVWn%gUSvg;P`gRs>W+lf)Z2A%uP&v>q zGx5bPzRnwcXSLE77j{n0vsz&c-L-fAn8b+QbqB$-NE~6@+QT*AV;x+O9RHWV)$H|M zQm%Z<;d()7j$g9fdSYmQxEk&{q7y4p5chiRaAhl4K%Ft?CPSKx`ldce;kWF(Q#Mb` z(%&X?7v!R&+t`%+VD=)7uEB+vm(Jc`=`vfUxp?(25o zjh1uI{hE;^FTNzTAt5} zzhGC^xexv?1_xM?F&e3ooxD0yhjjwfLW@SxE74`jfbWQuXv9yl+l0+l=VK2EMOk&d zzcPc8wXGqcW>zP$GwR*Ol3@-TD+guJZX{6Y>1Y{*^~j;Ib6lexq8&W_)8oa7K5^b> zqlJuzjQTI>T3*=U?oHO-$|m@9Ab(?B-6!(8n77j-75{ih6#ku$VRt?Cd4PlY)N!F0 z8Ads+-6LHm?r#R#9X1e-1U1;Kk5{OPZBt*+S*I2Z6(*SFD4S(>Q2C$M@3C9SM&Xok ze-ZHXVom&K?EWn@O_uY8kP;mfEA>jwVwP z`|*6?_kf!+4KOOFM$21pMG0HN{A%1#{ro$gjmrC2epwD z5}Z~cNzw4pYuCfv&M}uS8s9g+3AK+I9lY>XG4Ll+m2OpCHy0GE_W+qC{%oDBXx=e^ zbu@x*{pY}U4M{RDHJCMSg8Z#{cBm0KY&0wVNfmym8Em!4sD2${Iu-vjG7}(M(O+^N zQwsBx_t1;1(y%W(>e9D^@sg9fFb|v)J9AOp+ody~%8z;eZ>R2;sSAZT=Z0FR-R5;m zgZ-@bOYCA<%@f0_Rm(~$KYVegO;W3}!<$|w2EW9;%BvTKvYe1lf=ET5<?q z*-zT`{r?z;ath5=sRZ2KDT=~5mXWu$XMVoZv+m5!_BMRw4qFaF{5!V zQ^zSB_r<}J-mF;Bcyyh&vF;dZ1uFzA+N-9TjTclZ>9;xtM;yT4h1q;v8NmHJ?|6^V zQ2@U5@pBI!pPem-4^aid!iO=?8H6SM=?R;(Pw0uDMGn_De$l5THy`kG<-n7h^;Toz zeIa7|`wo2ov{v+IMN-o!?7MS)IhmJ&ehy2addx_{q%9)cT{iS6V6ZOp?Iz{-wNue635lL~|*?O7xw13F8OV$tWW#@kWPDh^QYNot`f^tV-gAhPb*k=DsA z%{{Qj!k4JCgunlZf8P+dk_xk4_RtJJfm|19pf}Qww%(k$hWvEDT8A0;kXBAXx#of~ zr%*0^XY-`PwXEFB;;>2uZq8~H@NJjpBZfEIV=vS9p7zgHW`J%_D#$r(^jOJBJ+w93 zNQeAC7p4|ZvX3LLmrtnJ9S8Vs4|}uCS#Qd4s=o7~4!}7V>chHz2RPd+&S`0{E8T^& zkm(3JWB7=$buA@dFgM_)Zg;S+b>q!%y$8PAlFYjyJ-C-_yP%PwtP?c(L_>R$xjGr2 zRnzovQA^R#*2Z|HJ5adYNKdzQ__S!vo;HQ!c= zibA9&slC?dFzk%rs#QHjo{+8wO&ExyPMhGxL8ejG(l4Dj1R1fYAypd@SGi*A6L%~Z-l&Fbs84@+0cQ;yu+-DTloQ9U%@vgW4VkANgkIxPdArF9BB+l9vrqf z5g&!Gf*wbaRBisk5}H)VF;G{kAt&E+IaDp&OMH(b^$#XI4YuL!FgpxD{OYGT#MRnm zS4Hnap44%;JvQMP`HM&HO-~A&zo>U-?0*3c(qAsSSo=={#i?p?j$wu+u(~E$eo!65 zmX81}c9WnFfgQMcJM`DfuvJ*U9Q8ual)3v6UvN_xNadawkn0HE(r)4zuR+`5l z%&7tD$w#X$%v_a~sLwRrecc{WfMWg7Jn^l5bjkbOoHeylQoEgc_peG0w%_Ek0ebRm zc5QPLaUQmnXCcejgSE%T)>!f*u;1hd)G(RtqbH?>7o^7I?vqr2bUzQ2Y|LxGHKQ-0 z9cRu?w>Y$ENRnayc#8Ber=(I@ywwTxYK#``&H9L=$oc~O3w%bU8#iWdS~Js_X?LjSe1m@mid_Rd{yBv{Hl zKUk&yd+q@rcglFS5U>mQ2KD$J;i9DU-3#rvVDc-1?_XM_Jm*wYr@*_g1+y0Kw_wcA z-x@965aLs(GI9K^(LM6IEX43d@e{n(9m&6V!p)~&n(D)^GO-v9@?H2bZt5kpdv|=Z z%UYp2h;=*_a&sNd;*ZPBmFdLKC$ey~z^tk@Qo;sQQ3(h5)|aXdjpreN;9pdzQl-Ug zRceYLJZ;o&H3xehTnJY7s{yMh_SJUg3-V{t4;$R zn_RmzDAG#${1U{i84@p}|Dh{RjLszwPP@)L-Ti3h>nUC)s5X!$*Qi22fV|E!XtFKI zqyC)v-6cS30)OlQy=#s@PWDIkl3hdON!8%*;pt755Do@J?qDv$u@2)`6I{%>28^u5 zv4~T9QAPCfTZ&`Pz_)_`Vi*Mz4GYr`+*h;k^R9Dyf~Kd|HdcdZL-2Tjs%vAU*)$M?1`-_&p?TyO_1?kf zt%jZ}Ddkm%)*Z63x+`A{W^V=gI!nRckN5Su$70 zyb`ja5WgUVXY|tdYwM$W_jlkhYM8WN6n?5q4Fm5HX_1e=pj?#|ExTA{feIb_wFaZs zijGKHN%V&4xblaiHL3T7t`!eq>8zDG->t9 z%9X=Ur1&ie*T?TF$g@Kc5opR2%~;FhV*@=1D&rA=vJ!Dzx$aU%5{ zijQ7n-F+yW{+Bk&*}%wCox%<(2l@R`C1E21!`pl$K&&ik>Fq!t=uWcuGp)E?g)$Qn zdWX`d6eh4!qR+0g@MSz)Lw=?neycnE3Gg{sFze?&uty{qIcS|9BDl8%`_c<}Xh3Le zJ)DU@Y6n|y9W`yYsO^8DT^s-{`@3<*zcN*!J~aC@k368ha;LRJ$Dc~p1(yd`Cur;E zU?Kn^v5OqPb{fM!i7S4L2a0+CW$6Jt0NWc|@0~nvo{Gm$?wK2i(;uk8AV1?5y(Kw~^(n{n0~sKb zdP4T41n-o^<=zlN>m)QkAJganVc+v6WyrwwA#D3u2VcT!_-O>Jy1Z<_3Yk3@!b{m zpXxhA@6Jt}d*g6a|A6PT$b5qMAnP~#j>FhBGb-{KV) zJZ{Qc6of5YEDWr>ZSfOQE5(CdXu-DZS0;7}EJ-SC8 zp_k4D&k-DR(7zRQ zy*{6B*V4ao2&$-?lM}Ak7<`L||Lg-beyhZwR^C5RcQ&&K%-N0brZ863b~7)6V{=A* zWWDcWoeH!s1}!}1&w5MotpP;@q#aiD@4+2(g(Pl&u@!--_E z-jnP4zOt;@rRbb^;EU);%2@>imF!w9sG#wVR^3Pb;^~+_8%)IySrh_={%>4bw%O}F zCAg@`Hp)t3))gyG?aH$3XmjB zYr7o~VHM)pUbp45r2`IJ4=4AxQ;2;{JL~KoHv?cfKv=7_8GvnrEF`2wWy);Vc4z!` zZRUucli`X@bXjae#L>(XO7?J{^!uNy9pHC)%=;cSU65V9vA&eE%0AjsD$3Cs^@SaP zr&S)(q9cfF#@ZH)IA$`(vhcg$VjW&jk2AI=cHa0Vytu1jWo^Wk%cWw=2WwGH|IRKuRD2f|Rg5^SK3P0z5#hTa@O(Jk2xWl{1VeJZoAP~gtoG)5NUP#_T@m^eBJ*J^ zlxtp<;9$fur}`d|X|b#F+y;HuAea}>chpiF9?t;XT!IipRcpqA?{vYFl~?a{d}Y7Q zTO&SZ|3;2#_WG9HOG|(z9&p{}45p;aoW0($Y$uX*dSwI5U#nT+n|q)Zf^w?d?DnP}@VUXtughMGVh zF$Y&JAnuMmVthTf>UK2Eiecw*xhI`X7$8g6kj8_no8m9@Ku`29;BMb&Cq=yH-2n4d zB9VuaZx4nJ^ZYdCb{A9U$Pp-I$(h4XkDk`VA$t4^C24#fcTC*!H8}fFB`uE z&Un!hNRn(}yZ4aBaLRVIK^CQIRAg(l)>%j2n<*P!0{|z4^&;wPTZ@wn@WWgczt0Dm zDM=v8IzUop07o^mdT`&wv4Durapj+t(;@;IGPMs|UPSfO#1^+tmfOE@GqkMoQ5SXH zG9p)hs7dX-#s=+$x+9D&q$zz(r{nu%=KrmSwuf=}L^1B{!}P0mVMzk-QT z!#00S8UY}Z7x*Px@ zJ1ER8#ESJcZ&^2nTkdubo)LeH;^PJ15F1Nw>-llC&rU3(X4#k{ohfg#Hysb_)?U39 z6H0lwNm??%$d0bf_io1wjTbdIbHBn0m(%5-Rr|Od&~Hyr9L(PP13~7ZcA-nz<90^X zF3(Fp8eEoD9&eRZbmm$#YfMNzRRV3NH6u6joE767k|@$tM~)EU?}lL~=@DIp=!E3JzrI|rTrVVkCQ(w(tZZAdzi#I?PcsB7uDY!n#E}0MX#e?4orpvy>W(Q%a#FGQjTC_UBj`uYteCXX$7=Z`V)A+ ze$rdM-O^RwwqN@4LJLHwiawHacgg!SN1Fvw@0K9emM~7Yx1%%p&ohpqKC)M-uOOIo zf99^cPN33)#*$HWHniIG&B4A?7&~mjGhh*rH+Far1ou>YEuuF}%es*8DmTl8Sr{}H zVadqg7mVWw=ed*5TLL=Lc{fNa=|b4?KJ7w0nO4` zPGo)TiU6NdMYJuLOZHYdYzj-iHeZMJ#BU#wsuM7L@hq(&h zu}lJb=73I;GJz^~9UT>WH?la4dDpXdz@kEod)(_<>RMr{q745(yQKsAB zC39I1EyJv^Icn|oYEO}7Cn3l;owd{%G6n!VR zV>$xSl9ayHSC@Zu@0BUQE2lLk_025j;DxDdq%&kD*IaiuDQ*q*CP$9ixUpI z`^!YFSB45+4LFOgktf1NXsr#B`NBD!C8oU1b{`0ES3v;KfB(3RxnUdrsb=t_S~2;? zT9dt?fdLJuDye5@kR**ukM_=DdhmX{^FoJ645&z5uO9Nj zQ1ugU&w0eS^z*V>MRL^WnmqZuk$C&>EBHwHh9zf4s1VTVWwLs&{fbt^l^?KQuB8dN zuJg!`GaY@84Rg)?b%~|gpa)qEu{JuoC!;Ht6_)R!W*#mkD>#J}=pNnp7E~Q_wF!8~ z`ede!-zuVmVZDiIZq?4t2ED{D30@G50uB=fvP#V42`|idOXHT+B=twQlfHeBQnL3X z?03E0Rg~OsaXlyI{JEViks0zd6z4qUQ5I^ayYc^;=Xy}R;v(>Dgrb)Dnv+SNIG0if zX|HLQ^2Ut07P2=}*(AFYeO)(C4@GY!%zLNRI9=FDv$&{lvswObq_(4OnIjDX4*}YY z`%jNb|2&F3JuHd(EZ74;m(A{vha@(Ej~PO9C8=A;zomDQ@moD0>?=p`BcKg?`f#t_ zldr;~U!nR=r_9>+cR#*PE$Rib1Ej1M!zYub{L-)HEjVQVXdfMC)fsf-ky21D`K+02 zbQe~U#@tdfv@+Ps0>o4S&Pk{?iQ@%{Wjv(YLduToMszE6V$DXv_kZe6}{sA z%(gL(h$GK%%*uK<$>y;=@i@|=%O ztB*2gFLb;5WD#kKov0hD7w+sKD(gsgPn#xSa^Yb2tKPv`V+1A76!Nt;Z?v~(G@$S)kv$8 zL-$bq5VJ@Rk$|}M^vjT5aRc&|cz%A?%$fWFfmaxr(TJYYvfXe9kE0f2tbCf^R}u6m zn}LuV?XX-DG7$Yqr7ttj^ReWShbpvCZaA9$5E$~f?`V82e|>C0ZJ)RhkZh`9=_jfG z@j}t}#6+nuwZqkom__oT8{#z%n^Qx7R=Mk}1~z%=Bt4y#zV0!)MaO;);pPZQ82CSea(!Pr>Ev{=9j97J@o`}VC%YMN=n7%2-qvYz+?`PVmVAsa2I*VYL!yg@1pBY)Cg-ll86m` zR>Q0`I))2e8(EN);%oVbgNY5K`tJ_$>GTuo7b(0Vx1H6}qvV8l7dqn_loZkGW~OC3mIlzee^y zNJaVMYF4g4eFT-N_y;_~w-98WqMpH)hzDCW4r9M@J2`+UQsrg3z86$n_xo17G~f10 z3;I#*-?`$bWPJO`QAVzO*-BV<$Qjx$_=`=TjY_te?Z;-A-yzRy2J?RCED@a}?mIle zj|c+}NSo8*18J3qxsVGEqp)QIwxMN*z1+#-JuVsVuWL#vl-X`k9Q3Jd@}{q1`Zpl8yKF7c73cVae!TzIj@49?MnrEL!TJ-4r*B6bOe^ar{2;hSR|Sl zM!GyWEraZ)y(JG?^v=0B_b_uT>)D=G^^z;YM)Y%xp6;`l-YmNH0RYI!NACuXzwdFo z@b;8pg$8NN8xvN?$BN>4ls(fy&Co9<76~=?y4=FPbQ2>#%)?W$8uceGtjE2o0p%`;tBCe^?8Bsw>|E z^bq`*UsL>|B-24ai%?ER0A!a{@^KNM_Vp_@)zMl+sJuHQ>FL86Uxq1waeGOC%vc} z;`3}a;YKLnZpYqCC~2e3sr;d-QSAm-^|7F7?&ZjnXK_QI_qm_Q$6G*XBk9`*R#9gT|OO|_`#_#vu*BMNAaTw;8b><3h9zrgki?~fFeMR_&OG$s%AHB?c z&nc1Z8JKXW_;_b5Y#qwEu-8=S=-E|a-3aMLeI4g{Mlafi0aX@^uP0XAn@rv1-cETJAg$0Dvwpf&wizxD8#vXys-u?d+h#<`QBFc@rmHq&1$Jy{Q;Skl+st%houJ@2NI5{HYe=b(FZa*n<{k(HR{Jli`r8~QkHkpN zee8wNEv1U0{{m>aDLr(E8@1y!tLSJzvCMXz+$Fkiz)60Y2(jRS;#xV`LX|MVZQXsU z`rbjoU+%=NVQUm?4@sFPg2`Nx87BLJM^IpSYHSI&-;rM`>V+0Ww?8*6W}=UX26h_J ztN`eJBa_kKPU)=eGDpzR;=JrFiZ*3op0_MV8(v4xgg!6skgP-J{;8%Hegf59IaFyn zmEI>ZO#C29g>kIIOhSA^z&{2W?hE3xPz2yKwCPW@E79W|=1_e-5cP-5CS2++m$u1Pqthj2}nmdtH) zyz~)iYOerqRG2ljjXv}O2H;0SxqFbyd$ooU=N%#qRlSd!tR9Svyz;Iez`O?NUz|{p zv@qa#XcE6^Dl5t+Xqg?`S8lF0%=zGKv%OY1z*R%82tN0FPtHu+K!&3?!_Fr4ci|Cv zzO2zx%;a6Yh(|k-cXQNQBMON6omOgN-h=SNkq{en^@cET&d;Ig=){Bw@m1|Hi>9d! z_&QEOL?o!-GqXcmbVEK9F>wvaMGcU;<(3$C-RuU_7prRIo)lAtpfEr zNr7EVm=P>9BEdF~nT!Lx1eUBWh!C*RzBA>Rl++f~OPlNxBLOnnVzpI^Py8~%uaB=c zy%gQt%!4IIp86xUnB*dB|f$QGjCuF)kp#8Ce81-5|A+7Na* zM7v$O*W8DJ90T03-E&rVJj%uV6lOi@X5ZNXvL^U=3Ta2!wo1yR2e(0RJ3#iYzcHW< zKO7l!P=wnVt9CsOc-{IRf0z@K!XmdIN6W^=u>MA97;IFo&xngTS)Bw~{ocC-;~X=_TU$WeR05&B=4O6bKAdCU zCyXXF0gW*s-BLHFi{ za@BQA5t~84t3Gt{v*^vCx|lP&k-t*(tos4PZIxrq$n=IC96i6~)}RT#s^(+xUg`ce zOXjJ3w>VP&Kt|eDfltdw71K;g{ex~gbq!p;P6TtTV3S{3Wq-sTq!yjQB{n5(I`TWp zFU?$38^@Q1PlI|{34Iyt+QCQUH;9hGz4oZ%n5dgbMO&jawP8WKQ3%UQZzMkP{2xVb zRrU1RukjYYR!FZ}<5$GsW!8{|T2l5}m`$9-YL}YDCg)V8@XC?w!lq)F zKh8IFJy<q37$^^4Mt0RCDXBsQjZXC3^e1uRyjDe};^0SdrvES&>vFO7AuDwA2_} z6?u{iEktAW?pE1yg+4!gCG1jEx7g2-m64epeZaFBP-NxDgy^o3|2+eBNmcaBKmYdi z7NB!2tsDJkD#wwlRv5OjYq9zT4}PinCV=|`WU{i>7yy128=I`{f`+NUn+X{M5dK=| z+fRO+KHG_DQ4xL`{1*luh-;y5!#Cr~>G|5L(WxA1CU7$LGF~DCi!VAn0aRgX&j*`P z8U|>i=k==}oj`8?ZHi~x^7&?*r{7S$qj4IGljGkl!am*+9uFB)``99-)Sm*>=z7Mo zi~dGi^3t?JwiC>W^-{?|qK!0f89?PPTNZz0_DfNGUsU0lQ|CZ8Y8cbh+-#aS4 z@7w7T!G4D7XMY=@5xXL0JuEvBgSVy%#wbDha6M$_NR1?esW)4IDo{GZCLaW2mI5B2 zc!Cmp^37h@6_HNno8H1~tIrlvx=jlj^UOw@@>|a09?I&CyQPUG?E%9}`%n1^Eiv@< zpLt{I@=BwgDGDRbjacmfp>*74KlMCS4Ce1#^{#8GggsbGH)&f)VVTKZosa`D^7{QBJ+?g}{f~lO&)Zjwucs zqyOm;tq>*T71>>QR+J>BU~`n??;$J33JY=n+>*>acZk;c*bFQ&5IAdD2%DE%eLuP= z(I;^OVle&>>~hUzssm%= z_Ev+PdBc)D;BU^wBh}h+hu}zZQd{1Cl&+z!d`6J$qE_U+V}f!9eBlh{(1XOLJ+Fh4 zAa%i+^ebPmkkQjQFivXHC2-qLrDP51GenwRqBEF^<`Ovj{6f?}x3?P=%yX(xu>^ zroaqMfs(hy5jt1MWks1ySiyPNObGhv@(u(SqK9Q+z+Hfy=0Su zRU?%P!xFcS`d#rCS_MawW&;)v#LrK2ffO~VQC&TqlB=21H%TcnOxkf?-(mTQ!^*46 zPchgH%2bt3YK)ma89&m~fSqjtj?JN;MPId@@tqsfZnHMAB~n-53-7;6jM%e!?x&g{hGDyIBBQ?JIQU?S zO)fr(h`0K*>Tjfod>g8F+Y7FV;wC__%302X#gXfJ`sX&v-tXuxm8Hw;6sDwpeuHJB zt;Q=b|FooHojiD`nE1}--F~X6uyLeznLB!{YG7)pYfOQe^o9GxPZl1$lFIqcLuOY% zr%XC>Z*ReV`vH)dzsH_u|7yd&r+HyqCtv-rra#rMimFr3xDzrmJ)`#|JL=`l2}>_$ z&n3SZ1m$FM=xp!99-~u~g_LS1!J#p>$-oCZJCsW$3&Cw$aBa?Vb$oO1r#}}&2Z#~TWmKTY@zwN!Ufa!@P{su7IadY8 zN)rs)RH%iW*u&D2GaybR3vZPWttXK?q}Z_-GiW)6$5nhHUAD62brdI(JZzF1R+3G2%y?v+p1Zt^pJ`{?>5d4 zkT>UB++FajALCi#bMp%ph&;Qo!L5k6E`ydGv1xK2UbCLw8(?mruEz!{6*0u$0y;aE z4sxA2rCBZBV~yz|4*8RF>hZa-UsZo^_9aEze@VB{UdYN_r-pNL9NWfuB`ulC-_bVs zk#KN(4lhJw($8TfjVA>_{{V2+BjQQ(ZAre|GU@mKScNYo%aUV=`N6lD1Y58N_OO(^GwAH9Xd}=?QN}bjd5&M0Fii&1zSc*%EBHMX^X)9WA^cM0$9dv6Wp` z6f<|a`PsA&A1^!n5ON?j9f?zZ#rWW_Q2mw+ZMOXpL&M8Sbei|A1|$*b+8@ZG0~n6vh7aZNNtTuRj)e z80NnP?%7;Eubo|9KXoo>g3{y+{DzzGh_&Vg+-W@f>SiTyseGQJ<$#6FVLmR^J|N$> zYKt^g9@0*JeQi9!_jhknM-nM$zuv5@-vpdQjsFDWd78o7I#aYD-Kwz^?0ND|4EPH2 z?DP>gBeuC{zG}yTjCQb%v!2iBKIJQWm>EmlbR7`D66njEl)aP8XF`8TrLQJ*3P$ZQ zrxT66WE}A*3gnRQ`jap;5VoO*Y}{SSoUSiLa)N-V&^Nsr*%q?A?K43c%csmzNDqpw z1GAp!%g>BM`%ZX~yZ>m4Ey7vX*^i4?&6s>$DOHG`ai6!%jQE1PKH2liOMp{B8)tim z%*E!@i%Hk04k5+H^OBF%t<9>mI`9$V@G_lvzyx@=y;&Io`iCLP)n1 zh*M{Hzq)+K*Fp*&)i!-Mu2ST4H$D=dDh0VK~ku@s}g(>qj?fOh#o-`h1 z@?@%ANd{zw4>N5yqb-hJ?|!Ak)u#X-BR-_$3vUAx7{n#ydYyUl%=CO)8_VmyE~s;_ z*iT3)4KFsg$tv^EqSNfrJws~;lp7SssEW{GXfbS2Lt)mq3Z!me{`BybgxOqD{6>IB z!NqB)pI!~eAr$~=M(55<-wY?@`O!R;P7>hx;BpJGB#I>d*J5DqNacVr`@;tI6PIL7 z9If)C_+#?w3?3kOKyig#Edr!OOsoOFL+d|{TUG(5$?3za7ycErogw-79kJoh&^iPf ze^Oo5*XdJ`D4~2lX=i9D4;Q|T_R2z5@OrDZ(Nd+T>U!|cs^)HsLp#_rGVTbxmHCq$9Ca|E3Q}4{@}(XYkW4DRY-oK|(vJs_-wa@k_pd%(*UAwQ=)wCde7 z@o@qC1SyHR>8bDr`K$TA>}Y-T2IiJ!*z$-2OP!OS+ap~%xuPuQdeR#mL!0F`F``;x{<0V*Y2a@C-;En)971ZKaQqK8`^%$2f;P+{5h!|Al4Q90`$Fj ziG6@T zCu1eJbofqu;Pa%#<;I9zjn#XAZKgkM2LHi=AX!ZwIt31IfL_c5+4iv`%ZJ2fxzC*c zWL_fo3^a8fq85xSaiiC_I7NsLgVyWoU=P#nC3y2^wNZ&$#N;ZOUg`+hnP`Nwu&ske{bZ|tHL``e*Y#R{!IGQAVN@t7X*)Ee=%*lUoVjLO~M z{}@(o4(RP9WO+=|cNbHa@N!!R6xaAoEdg3Ku8nOw3Hi{AUf9Nt zQbLYQoDvxOco3E^AKJedw+>ofCAKX>mxeMuwO4$M9k+>GrT*)}fPUS`GC>_PAzVmw z?TI~(Oli_tlcyf5Jc?G=5u?vlkw<+y$o%qpd$&geC6xt`CN20}*y{<dg$KVKNuIQ>IyCj}JXQ9v&H|5tkc7{=M3?b8(9dm12GkyzDI2 z7wXQ#_>9xReP0qQ(d=vN;{HT^iwjg6a39~#CR0qiY{X1U@-UH7+wJy;trr;wk^i3H zb~%ME;-KqcN;4g*Rg%Rpq`RXXpr*8PA9s%4@v)X<^WE;+wf{ZFP8m6a-B=BueAx1z zYV0?IdqI`R_nQBp#z;a@UVB4cW2&ly&+9YANfW4q0gM@{ItFp6CTY1aLsfIa(YAu0 ztiO)rIyN|W`k{-F+uz=)&LCkwYONV6%MnZUk5x#O(&y)ZpsdWY6nZvdDt4wNrR8q5 z>=kHpTWt_f9xJ4}lUy0oE57o*zVgs2;D2>+1*8o-0AYHO@CL}m_U2)pV{i1R?;Fql z(5Ggypnndnn+{_ak&C+CrsWp=wOt0*g0{y7el`3{p2T(F~6iVxKwv zwi0|roLBT;UfF+>%&?x~Ue2S$lx{NQ%ybC!Gxwn_kB-FP$Qzg1ta&thEBBpYBt0n zGab4?|KHR2R>u-5zzK6A>Q~n({g~LRm4kC@cf9ePcD{{ra$T`~cl(&Zq4~DnKD9$0 z26TI6KwKYS&PtXJx+m8X2mO@NG*)hux5!tx4*vrmViq8nU5(mDJS!@4;ghCc4f#+c zL0MtrI<3_y*zt?x^guEA5hDE=>1gqk{0M*ckhl|XC1$BdzMd>s;@g%GsuA-^sp)52 z#(K>G-9YA7jMLcN39c`zrKJBa^cLVT-!LD# z8-e8kz!P#+1*#I;ww-^XzAXl~kLf)COIY{-;b9RxMA!LomS;ZD$q|i3$uEH`FaVZF$84<72QW6}zlviMV(QO~C z5czG#N63^)(q1rUFZ;+AViAboA$dqU%n6Xs9+)8yC|QSJ+Hua~S2mzf{U-x};Jgx> zpYGh$IXk;lrtQBe`|){Z-~YO)=KtFOJ{9tzDVOR^Lsqp+k|mEO7*V=-dg=2hW9<1t z9JLM||5S=UDNVT~-BA(YI3{7CGk_JBQl< zHe{!@NFayETAb3N%#nhtQx(4)wQxFHC_nwmni8Vxbo~7JW(?8)2rnuHf!W>G+@_$B z019(`_qAW4iH6Tq=!vCB>_C0X#w=LK&nTfs{f^^`N#i9~p-D9KpCkKhMfMVE`K#xV zS}YO!_<$&ctfOR+QliD5&2P)Sc7{0I_ti!tsbD?O;ViTAHWR^JSVjgvDM@| zRUM{B2+~%y=<@VCEXRL(pthjC zdQo>p6zqT$yETt_*4BdDa$GCj`GT`es|!PNqd~j4>tS{903HDV+0sxKJ zx#Iu!%01t@n?6)dk*bmb6yM!pE5UU)dFYT{s)ND|4SG$D6-2c*Q9un ze**DQKQ^NG2`oE|AFHPG#Y63RM)aCS%G6Pv3A^T~IHaE)i2N0MX42A(oaGEneD6GC zT4hdGCv`*@Ekh*ck@pr)M7j+1+J*j2QQ{@+-4r|O3tj1q(|}RK9jt0!%t3-5XT;;Q zDWZKK4wjo}(MOr0#8;>1t$GeS6!%*4cF?0<7m+c!i|Pb)4FZ-tbx~*;q^JDfgI+xn zqIe-`Oo1k%bp(~qZi(JvVhg=z?BonW>Gt4i;KTFpW0xZ1Ap!{VS}k= z8!qDH8x^P8mOIoy6T|&fh}c@T_AUm`98RyYW=aZX2u6gEm%R)9xs-w;>m-8PRAPJ)vZewPKw#^eS!#zWO#q_zjTA(~k zS%-kELrCm7sREIw_+TFCp){sN2+xVF29Q3SD}{CG{5ohq{3mTKUew<_jeF*OaHUi# zI?1(r_hHegEr6SEe5M=vQ7^k0P zL6@Ca$qj_pmG~ZzUH%NjhtGJiCJ8nod*ugt=E*aa`+Hia&3luamYoiTnHSJHm`72k z&ob;x%jDs^BBNOlzJC8#VFSt;B(oEbKG-l6T{f^Cry5qidUpfAa6xAnT44}f6;b;z zx#`f+x{5yslvl}TX?DcNc}QyEMfT2D5plNH(WaSFlzUMZlky5YOc)YJk6H{KPp$Mc zjFtWnJSqfI4Z)w-4$t5U&57L$ngG!@RvOFbJe7;eG0HD&pZ8rI&6{`Cvg{a{?f4Cd zNogT$L6iQr;WfXYe$IUCa*50_Kbnu<>) z>c?n*tW1}xaulk}6Q%8QswJO&W4`qM8FS&>~pS4>BR1hWH zM8vNsgSM=50S%~y0KVXY&}d71v0U`oDz~w^?D5{gPD4-Dvd?mpKp7SyDkFb(z-)%* zKdNl<^_J{+G>r=h{MxdbY*qakp@vfJj zDfax=$p%A$agRs6PbRg~wVG{1mm-Z;bgq0lF1{k89N})^OBxs322VRjL=x{1Ejv!>8_7x1FiwK zdG!Ol4=Q^vePb@#He2Yv1~fc1)8rfivu}PJ?;3b82|GWlv|ij=%$;r)f1+idaUa$_ z&i*2cMQ2@c2M2BW{3YpZwzB0+ zh8@S1ainLm!@e{Kc3(n&8nL^Tl<=DNVT$Eum_l>3KE`>3Y;5fR8C#4*=%bGeucqrC ze7p%hglV}POfEZeOJ4goZ``_buGnlkZRJ-AkSo}sy7=-lSK4SrQo3>GZVcMV5YfI8eW?;_P$JRGrt9Sk z)@KJ?R?~n58r{OEPs6mZp(EtgvhH?VrX#p;dmgmWl=aq@RvxZ62+#T4OnNB4BD^Md zWD}-TP7KN3Z8mllwKHumV$GWs-?5H?O73!SDm`kY64fJ{zy@j3NbBJmdCYtaBXj}$ z_tyxYKPzVY2Ks$lKw)lBTF< z>0-qZav^*)p|ARU7@p8;K3Q;K?6G7M>5uJ|QsY4MH(PF3K+*fKTcSN%!28E0lTn?b zgz#>d`OJRa_4rt(NU_mcBDBckD%8BZzo%B7eZPIDee$iX=gs|22IcsDFzhuu6mHda z`GcR)Des5>emrd(IS{z~P+i9?u&1Ilv!b-dIDgmruh-6Q{n)kLtoA;Bb8u+472{r=eh`#c_>$LIZio!2?fL(|eC-r3=Ej02!7BPy5$tL@*S*Oi%5 zy>f#Z7u{6+eT1sZioJirj@D)z@zpTEy2|)-7pGg>*qg5|Dr@<+e_J%n!Kcp!^v%aj zv?ogge!)I$q>mSl`@r?W$kRh-*K5S##Oj~!FZXe zD?qMZ@ETjI0u+mbJY<7vH#rJzQj@6YO)ckx>bfu6Qcwwk-0ieMQp113y3(2rpL{6% zP>^w$y3Mg1i2jdP--4=4wrqQ}bTu^$<6xPl;A~vaS=6fBDxB$@jw%7X39t;g!-IC+ci(_NO;$*N~Dk+yxDM}Je5j2UGBerZUpURrLbG#2mDiVdFAw`F}cc? zmQF=!)qeR#`noZ&!aKRD#y0`kpW*5Mogn~Rd@_eLxEx*IV|g8Qe@sBu44P{$v#%{< z?J{|xtP@T2f1Rp8YlT+#(KDJ#=gXF4umO8_9w%74c^R(YJ5`x=Q&RY4VVZ}VF2L7- z5sYv%dUFPwF+E? z4^?7(mM_x-k$eRtmJ7)hOPT&%JOv!|6))710v)sx&Tu)tkm0eZo{AXa7!lsbU*w0hj zUQ?6psfXadDBpZ@8mRad`r|@=ztUPK@5(mzQ~b|1cHl>>cf;K+Q>xX*7Fb+jVJLGUCSxya~g_re8=Dt(3*_1^gqvk8*(K$Ui3FWxs}D4M9A#w!I7B zueWu=^!GER3fXSvf+nNUDPEAwIm9gUa~uP79K<_7g0m{0#I(Afg^Vmb@@Uc?>aUsk zY+81od#iH^bPczDI!}Gtwo9Lh`gi`b${)iW=S01Vi2+;3LzEP1(-MWd47UC46SHX1 zzVa-$;MvUY1^L<^BW;G%gGIrc^+saCao>tm)^sb$iPP9y0{c*wvIlp6uEARzW6eqE zRk?pawC7b{LH6E+h^Xsii8sSXZeLmcC;x{)*Xh$Zk;@0sb)1eakvVfg$}#YH4tEz* z@6X4@Fo2TjH2aIq2;oH&%E^xWypB{eCsevZ*8bv$3t3NPZ~tr=SUcrYxB%xCQ3ufp zAmWce)Lh^r2>%FK!c;mPb}*sMDpd<0ocZ)lASGy{Tg%{`_DqA@={@DDkUPxIWZIfI zG}T6hAD2mS=+Rj=Y&21-xJwtxXUvavG-3&$WatZ`)g!_K8x&WZ)AtKnB=E$~PQ{_| zR|IRrQD*Fv-Z{~ca$9TrmMZn-Q55={hVB!LQdb%~lO$9?{jl7TRR>P1X*|21$W6{Se+IgqVJD3U8OvMO8>|9=}<0RG(Lz&Mqz18b%HK zx9fNL)S=VZQRb#Zp~>A9XhSsi$5BWDbso?*QRe=@KcOEQ2BzL$ z_kdaE#5o>uzQ~uVrI^3Rr)gr-wW*62qff%%nRur~H{Kq7#a z8g|`quF*ZB*Em#K@bz0p-!Xo+l#r%Fc14?_8rO|9Axv_l{G}=7c;G$jSpTkOt5gm8FpleCH&i{49(83AJbQPk=`Mt-jc)Y}OuwH?pYw4# z&6;~j*LgNS2-s0)m@Mzxn%>Q(5TYI2)e{j6Er!$TDQMVz=tAQ^zRovSl;(Ua*mt+I zas;w-8jIRwGq9?UiOCmx>2XUok|Bao+#Co(<-!xS;0L)p6%ySEritQdj{7-D_ovXR zQmihqcFFm`uLd7)NQ#;iSN>RP+2JzMOz1qQ_>0Ttrw~iFN;z&PIEvfzU$+id2@kUj zXt$S0(0_2=1TC9fj+P&63i}(mae$e29VLUz#fjx2{uJr*;oCk#fugD?Dd!60QIwo- zUGQpe-mvNbj{_ew2L_wr(HiWsH4~#Mv`Q3hC2b=upu&e3jvbyGHRH#+P^{E^NY}ZZ zaofaXQdQ86(OdjI5IdpmAYmj-n%hOsx_Ua}xxD{UXPa1pToA~!LRfin8;d_IOA@{- zB|ePjU4BkcvM4jL)Uz+EiJGCd7YrYNBRCzjyRl%nbug%M08n$V*l)}j#kHhoI!q^0 zUtZZRc@|IxwkHOvCy0&Qo_Z&z6*|IGju$4(j-ENhk!vmyj z))smDvS7HG+e=XAd}f9`%2{FK{a-mvRDgk=Zg~=P=j3>e2+o!g2`FaCwmqVUU!qIz z-+G5Tgd@JgU+SS}#JiAQd`k^wcYe)E+^GYx3^$-xNAAF#&V`x6Z!=PQzRy)TmF)b? z@Vj^#rx|YW&3-x*N;GUnm2kR4+6Gny4;Q!>+NAzmEgh{(pCAGIbzQz}vW)g61P;~x zz@iwFI&v^?>?x@iq*oNNo@mo)mlV#wj->=xi7W5dp|*{+EA(lN3Va7Pl`+xB#_z<3 ztp|K3P~uIC*@SvV@UN9WrZPT>{K*JM1Ku}-&MM?nIRW{q z7;WclFt`7Hop(u+gAC!p%024V_$#CDQ(Y6BD;$>t306nfK(BJ@;87n!)bK_J`eBFs zL{x}u=`wiV)8Z(lE?~I|dRq}VPk7MP)VI41T^=dT65d*Q&CSJslJ-^};h}%l&46Q(^hMGK(>_&O;6Jhf%HiG&3+WeSzBG zs`#5T^E_ptB#F4)tkJUJtx1+&Z^w?1ley2-gTE(e9Yg=|@5=0A=0&2JcUGNRdt8+x z?V7KvDiu^0ylNzEHe)#G?S`z+Id3Nn zQ)_iak#W&uC$p<$f4mH-mZ#fA(C9+p{#iG=mOEH98O=u|xIoZ}0YBIN`)Y-JgGL0_ zZC(_wh^o;@+NP`X+UI6sH*ps!le8=Se2opO2dHy?dM@;uwU}j&x0CRgV_U+$^90$) zn5vAgqC>p+EXs=&LizesMG51$W^{8~c(niPtm&6n0n}X4Y+FgDa7U~|jnm*dAn4H= zVQ%ql%6V$2lqtJ=H0hnK!tdohs@@*20@Ua~+D5E^8WwKLfmd?9H#;5O-o2o1?%J-@ z&3E)Wg-R@Qb4A<)?%Y~F@fVvW9pJ3-;Mg~xggNTC3%d^7fzkKR?8URpmkH-q)3)5G z3@2nq$TJt(RA6SCm*7~PfnVlup51HR+h|F}H)XnJjSpH1-&rm51?t;OHI*OgCR%=b zyFEujJs|zNSN`Jr-j%JzXLWIN5Z~hzkP?Q$9p{!8hOkjd4UWXG{IdDw*d#IAgZh`( zj;(3vED!#$(zWe`QmtXBh@Ms{(Q$H&gN{Ef^a1U|U#oAM07MHOJYIxWEk2saFbC^c zDka9KQ1tyJg9n^du+$2Q+N2pGUAacG%x%)rdhG?0ip;^Uc%GNW-W2vEq}6`(r%&@Q zj@%agw>yh2_L<)qu(XHv`;`O zr#E?%r9KDo={=ZM-A&jIa#_yHJY6u_C$IZJm5}$di>lMvMWrikJZ!>TsPC|Dj3pr& zJ<{K2aP>&GI(LuGJ?uxV{f38#CyeJM%%GT&sme7-g=?0`cIvoADSPie7=omT(B zbuvt6<>&AJur)KC-P$}ow^w#nIL948P8=Z@w1mbU67F|A$Im4sO1Q@+Ni1C`H^P`Yo z%+9AFTk^00VV_>jw+CyUIMy-27v-$Bn#NmB`7U|jatyPqI~r4)w)GR)WDl{|sFf6o zP`QKNh+TRduo#f`W!*R+N0Itq*j8CBE$ju5VVq|58=es`JwN#t8Ryp!3%XU;L#ely zoJMW#s{&LZ1qV0V%vz-a47T3uC7phPA?1)yX~6m zV0*X6J~`P;ho;xpw@(#Q?aONA4gbqJA`Akcit_Ph*}Y+u#9^y>T&*sB6BZGa zwUDv0{lEz=ytG6T?gKrL*}z!C@5hGGCY6^zdo&mYrzK3Bot}Fu-)8JDA>-UZk5Dntq(no2Wy`-QZR{6 zsn5R#6*29yZz;A+VuqvL9osU-8X8UbA0dZziSF5w1Tssm#tli*0`vJUuJ*_f~d9iT(03z`c;t%f@9T#6U1%{}RFe(0b9z;TXd(1$~`~ zE<933FxeCd6{wLVM=zx^8-5ZVSILBmcG?i7byD z?GTzii8;MGmO0j)2iq6TdU=JH@4O1EyQnJI-b+4TzrKsG3n{z3ToSXfkyQx?MJQkO%TUA;^g3&h|E>{!Hj5YZr)*tA#~Aq@)pLnA zU3-H)t8|`edgv*j>=(Fne%7D^QgL@#LqgO0PNoMU(2)T6tDzn)ME?VJO#)O~L>1U;R z{>gfG7H#;hwrARKGoQ&z$`N50?W1;r4irtKmF+Ktwp$_-84dnMG!=Ct< zPOocH)>Mi-|JoLrTSP7LJ^ zZJ;+0(T$~^2l=06;S1La+71cgc@^R9nwS;9cdHYm(|*O@#?~YbHZ;Yvf4?bF71GW^ zO@9T9F_)+(d>>8hbjcnvl7QdFyGX;b`Dq-n%<^**LX=ziFs5uIbo_WS7W1U0H`I2# z#rrYf8Q*Gv)gq0S5_E38POSl)Q^!FZ7_Xy}NH!ABxZaHCfw^bbEW=Av297P63a&80 z&wJrgp~cFrJ`Hiqf9b|ctVd?Tq3Qd_kj`i`#gNYL!){nr^;50Ul6ptD&V?={?y@!e zyNh&PVx#I5;kRFCOb{+-d#hF{0-gVdjzL^gDtaUCq1=>>VJ#VO=f;>Y)GI;$nzdHh z)_LGYe!B_itE5rCp;gDkmzElbL%62&&_Tt9VHM?@*fo8J`1jz#Y8hgBW~-hj2!guC zmGv-s!Qm+_m(I&`GGvMjQ&LZ@O#@dDr&!&fx52BFi3_eMhHY1d=DX#Gdu9^_q4Lzo_Y+@t{_0nW7Lk`SF z8IgM>d7PW(g=fS00wHnJ+*?G9z6PegTsT=RCb*UcovL%AKBN7n2x?`HJ#MM}| z*u8A-0T+bVqxb=Xf;t7rV}^OQEPcdwAgkU)6-Pd`nfE(l5Xw7CB|d&POcRK!fA$Ai z#8I&=q;-9>@m7r%sXt!BeRZ!uD5TJudzMh=NTf1W* zR&PnqHS{dwCVr0H0v?2O8CO?jnl#my!fHH#eJX^Ni5P;HHaP$y*7@Fb23F>nM>w+O z?1k2Q#q{iqeFu4g?zE_P?uhruS*gv{4aLnVkNl{v0hohgSti<;FzEeoEmH8OO6FA; z(*qLu%Bj~8P;P-%J1@6g|3R02!PbwGB&ww3h^W4j>P$cDelc1lJolAT&C0#4#(qOT zRYt)46`S>`L&_iBZ;bC&J`1kwifabm zNH=yCm_smcV7<=%8I%1}#hLHx{_A^slpqwb*^YnnfZpVL z&J5LC*{+ykJ+mxLpz!O<7P_R^N%oJnj1ztdy%y;^jHNE8h{(w*Nr?H%cY`ZIjjrn3 zO($A$EY+ZYx51}5)d0u9cS$wd2N>OPazPQ`XTk*Kl2P>g4UYUI`=OYw;6yO@mrnt< z=s5m6AN!-MbAXMvKPV)w%yc^l&Jaj7Eq1bHcGRbml8a|nU+UKlLPr;yb7#{1iP|#; z<3fw5xTo5z3F<O-c6@Nw9a)O6 z(ZwTwG}h07Kl@}%LWSbOA;n}r7iGqM%*hpCG#Ffc=Xd7$F}pQD7nL?0t+WJQ=3d4) zW#hvm1~mfC!+K0NxG%yCYx|~5&4lgZT{VxoYIY`JcepAB`C$KxTmuQtJ*E(z+1WT~ikgP_Y)eu*NjYs_9C^)@i-%+<<3X zs-{$3hu)-V4lX^&e;P9b8h<)G&{L3eBQM8i$?CN=Mx$u$DJ3U*A!1*7a_S|b7myc# zO~S1F>$_wjy5QBM>HWchGo?8Pah`n!a%iLQ#!m5?q9X}q=*?Q^JaE@k+q{>su$Lvc z8vLmRHdwwPv!N7#DjjWg)Hh73tDh$hHY{4w6C27? zHna(kfp<2{xb#b#4J~d3*}gh{qx&W2>m047^ZT9H^O@zBgICXmLq#0Bj<_01?cYys zH;9aptgafk{~?|NisHC@W(l_8+#DwO?^{$~+wQ4ok}usXD8Z9^=b;#at81hD{*Rvr zauABRfJ&#|twXKn<6KRWN;No01}{+Hw7wECcASe#LQxx{iAD8~cKDFJn1LX1zkp4l zxNmhDI-~aM(eJeQlR?j$x~$WzdN|*9XFQlZMV#>I)*bPnWQ9dE{#KLi-XPr4P+qqq zc=9(Olq+K)pUCuj@17L)^;JU=`RZ@mmE*5~11oEgu9UQ{lyPswQQqZN6%Jz0h9FPl zHiWw|=I~*UrgZbHe8`pG(JhdSS4Uq68a|v~voktrct^KZX-aUsZHvV-U2Z46Ng?Pg zf3#>tWo>*O46jsL(4v=kCO^-KJP)>lKtg0=n9)3H5K?SAgjIDbWsm?pS3V#?9bf# zE+X+@S$WL<2{Z8W=~kQ{B($+^-}?M@vc>jYTV@&4{gUX-#@!@m5>5%%KE5vDBpVDj zxE0a7W*esSaB-~1%TKPM6Ke-xR>eUDL_+$_&5sX$tUK&#Sj-LTe!^>|D7-Y&H|e#z zu+?XZ0`j5Wn;%o%2XiN*AWujpRo+$5C2QU|{KVHFy+{B(j5p&DAd+&`D2HCON|$Yn zV9rFj;=kZ(Vz+6#d=mYCX0t?DO5$dYftxm|HYqga#>A|sT&YcUzRZ?6X3W)&T@spP z0;yLvOHsal_1K|q$RA`K$jYkO2iNgm6!C~??s3@ROLwkkd^p8_Sd#=nm!FmmQv9_e zRArXcr}-WV`cd7V7(5PfAzVUO?3m(IA&7;y%Q5{WzF@uA6zH8MnmbQ$v?M>9uF9-h z6CW}50>Y#x1q+3)$}y)IG%sBSZ7SZ;3HCO%q-L&jNi?bxZ8O{^4#^by$q4!?Za#v} z9o@{>HaRa{lLXXiDFTK9UI{|sro7qX&MntNVv5XHL`1|ppUKkM|DvlE=*>eiSn z6e6>0=PEB%k%AN#U(Zk_;(0P?isI6x`-GJMigo|jZ|Y?HCTkhNRn=6cU*)maA_2m^ zl<9=)=UD>4eU#nec0MmV>u=cRMoIO9oe<;F(8)T{sE*f7qFJzQ7LMvkI67jjN!#YD zl)p2+SMfXhIFR;ebo%Ke2wn4f7@+W;~GQ0$)LD9ubF zMVbz?SCBi0LSOx+4X1K4Ab#kjX@}mEJ;t9?)t3~1q`r=xNk7oZJ)7z*A zVyMSMQG*1-quD}76i|lKnJlrM+YH!&ffl3Z6qyX0_RBVIoxI00N zfHgPj)HhInywCsF>@qAzqX@28*JMu~5=3RE80Q-Cr)?;iZ8hBidyxBTN42$v+Tf&5 zLZeM6nn=(K@wc)T1@AhmW`e_hs)Bze30A!lx9hJmq-&=iq73?UlS4iM<+r|iesAqP zO$)2UofVLqBm7BxDISwvUNFhNwB4~cZ+fw=60$9|wN;5bX!&&>6ocg*^1mHiUW(a1 zCn}lzBuhLhk>NgrQ-0$ET<8w-;EYM^J5Yc;l>rKp^8&_j>IKrPu~VAp;k&E!wXxYC z=N+^=jHdTUxUrY<`0P1FRb0qFklRB+HtJ4sO~^mrYY69*zmG*r-0kogluw04W+byl zrpxTd_RX;`hAtuT_n8Hp|FjsrV}q^jpxgt~Pg5LrbfsIdS&Y)S@RP5EtZ!+|AO(&? zqlqB>82$L)tfag^WvBj)3v-HAr^RP*1-Wls*0IhZ(-| z5@t|9-u0VXNe*yP(G(6oLIdj536L^eH;v z+tT4Gjlk@FSX)3}gTrqz(~qV>m?@KN+zIhfXg-}^1LoQ*O9PMD+vyWE8z-$dwtq4^h+wd^SiK;CxJg02n;F@wq=>k z$$hcacv(At<7+6l3jkSEDcmI_5}^eZjQ#sKOZ3 z2?m1Y#o(w7YnY>U@h;EJL`nO6%|NhU@cQA>X`Il)7HM6y)rP7Ux?xx2WCHXK*9y#@ zZu8%2ER)od26@PZ6@iIm&Fhsxv6T}5OI#9Jqa|wSQxCgLn|aome~DpVGksCy+4fzp zX*|Pxmn~WLgL%JO*LxUt1d;+v)KSs()@EGiNAQ%5Oi-8=y23bAbNQ?cL9gQBP8C1f zQ;vE^=>8AdI}O@ohn2NtQ1X+2rsYv*H^1a-oW=J3!Z~SMBrvzye!9tTtmcj7bU>|S z`JBTDOXAC|#)Q`TlK?Zs6Xgvs>aiK8oucn_lue$pYOC8uv*_9 zTOc@oQ{&`So*ChdLT}Uc1Zp8=Xx-4bqccsWP^UB6R-tV@<9QbleG9)1a;Ro@LO*xP zv0E>(jfr;2kkv?^LIu%RqQ6G?qm8c|1%2rqS!&m?8%>_PDp!+sL*T_dDwDxI%&lDU zdXxc^-X5$LdxqOQ%X`HKbTKQA!v~^gH3SjLx)=()l`X-|ItC%Ufg;}kE}u3f*H3)U zDv%MDa41s-<=Ub9EJ)WCZU5R1N(uL}*R%=U$orB~I@H^%yv;&o{bFf-vk3>~J;22G z=jQs*uX75+LlJ6J&|3ha;dKBw8nI_0-F))-71U>!R;#PBaQ^^IWd``>^i+(vj5Je$ z++`4>GBij32PWH)@mi}8YxtddQ1(uvrv&H6POdfMRYy0})OlT>@D;T^*q=FL9E>r8 z&(+P;jyosU_61TZdUI@)i};3AqH<;p{RH`^L0ssp5&QbS^^~xU^XNZ2wG@Iv^xSRu zHAYEiOZ+O%WD80q=}9BedqE~ToA((fY3%q?3|%?+d#a&o*|`)y^RRgKIiuW}G08YY zqo{{y6qUT$&=)Dh$Opk`ZunHC)2tpK<<1L&^<4Q%F)xDsCe?4r4gIz@O)+oUv99CM zw|gtsC(yy+u_c=1yQG02AB{w6PYXLFn2^j}Y)AVgTuKRB+~vogHJ&#>r`4{W!;;PI zrHij&q!KZf6BmCpj|>A;<`b1FAvc<2oa~T>oSLY3-h@+I`>J{hW8!Ic;hd;Y+ddLR z8qi=mlmSusQ(c()T_CSFuM3q#6p4j)j~q{7|KZ@SY8BCK@ZyG6wE~QJV%En3@o2#c z1!#CS_%S=fxZ6C@Yi5Nv^Yw%ONUb~91+cw#rL`X~FKl=8H5>QVzbQz0O{Excq7nDb zM^0^-(9_SO6N87bWL<*ZE-ZzR?8#c;Zxea-TgRm_p z%DZfm0w=UZa&6)h?l!URMI_DZo1s}HsfgKWkdNkB&}%#o^1LKb*zE_)H~(xLLAwF^ zuIvb*lzP|J=`0iQSboY#SS*=W0XbNB8@_a6)pFW&STAHFTw{RS(T&#YU@5;rzMObf zDv8epIn{OMoLZQ_!Fx3o3Gh8mWt__?#lKvQPS6`qx~d-vgQoFeLZPhQHESL4%YkT0GEj#S2q09UQLf zsk8aUVa8lsXNi{e(b+d^Ru*@7a_%w=x)pZvEumK&o5u|}655qpr70*mmTg0bwE@6B zFatvh$R!4rl(URox`gD7SGsSga&$BO?OTl9QpwWym<8xF8PzBKuHridwp&S+y3XNF ze!RdDKoja=fOAN`8K|Q@o4D4_fZJBgr6m>K?ul>sZX8Uy#9WxV+t{15s6S>O`ipvN0`Y<2 zI8^Hp_|anuOOVXlwRABbG14Xy9-2IW_EvkFa5Jv%KCsyOlXLr~7sUJLwXbJJd0k|G zRu-cU#W-g^9mbEDOp<0q7zm^e=f}8AoWc3F)7z|WSm3KU3$|rnYIRNMM#!q3@%Wnb zIiG7I4;Y~O+Tz2IO$FasmHR*y;Y`pr&llR*S&2xxIsz!DO=<> z8p@UJQn>tN44r$n+>XDYss8+Mwh)x3+;@S!3=S_>cWh^i^tNUW#ZVq;yF=1_C8@L< zQ^;zEvuP#{_YKE2g8!{utlr&j9b}Z_-`}$CdDeNuhCS;Y4tPk0j0aaJ3PZk|QjGhj!p@Fru)JSzY<4f@-ug zQfBknvg2sbZRlRp;g@3#+h=qWa>~Ps*2>oCO;=R_U7D+qcG=&dWiX1W`Oe+({W;mP z&rGscXWNJr9B@sI_(}NC`Qw7q%977(qJ@SXLHZ*mv1bNQMd-m?^yB+mZrK~0e~kX!fYsrPn+x2^(>RMdgM_t=F6QQyacQA# zE|GW&TJYr#XLE z9#A@@6>SibChy`^7#3;3M($H~*ACv=P&kV`&(;0=C&bxxQYPMD3S%SjGuGg}z4xPc zO{!EIk+RwkyQ*PJb}v7dtD6&cbQ~IRf%e~xVvS~WvT_Gn_e7cXtoVt^e$XsWTCYs>6Wf|1f`E1WM z;_d7Qs(!)lO_~IzI-^*$p&s$>=*M!hQzdX6Qu@471Gg$c?Ln@UWqDf(Z8sLQ(eCnO za>0eLG|YCutz6|)_8Lrs_3Ty|i z5Xf=3!th{pGa3>kgb?8M4vzDk?C~zQV&FI_@Pb~=fMfy6ZkM+!DJB_!ibD^14^xez z^}h5PRME!uB|=nxSuGR?m274Me}L_cvjJ6E+>NlliYg1G+F?qdCdIco;f<#fRE zKcZI~ps7`qW8IUn-jrBBQi@HXL$;^Xw=!-~E}rDP29={XuGP0s`qOD}G$Hu+42X z#w4MgHtF~;6)8J+nVy;&d!RY0msu=WWERL6sZSLJ`0d-VF8Ks7!sMWRswZg@GqQB` zhifl5qgDu{U(~QM^s#XLYZ{jYn6d70P9p_rayF{vI2+2HnCu5?em4P^z4=>V zfPNXui3Qb&(AIT*51>cW!X5I02_|F9h#HU}+P`tSN5(owv(>nySGe>^;MzW)!*o^a4zZ; zllx6vnzVr<3*|!sFEd=02N-axA#T&Paoq$}^)EGM%S*tgv|7kJ(#_wL}^im*)MNlKSn+L6y?DeEt4mPiVLPrg@=Cr_0a%O1=&2`2Z%HH z`E*#Uuj{^{)52}PMQKKF(Wn^Sd9sh|K;Tob7=cq3zOp#Ut+LfhXWrz@;YYSN6 zVFVmmB@%#;t0*|ZdIdTs@%)Ugw|ferJ5tGqbY{djK4UBa^q9z1+TqU}cXYE?mOw8+RwtyajFH!xf`W+YwzQ?i) zF^&DW%gYB7o`jeg{nuB%jm@aF~(pHE_GJ=xE}Sw=43ABK6fD0n0zFRkjiETG}iIS8$$*>@Y8bn`qH_Uh9gBfa-PQ{DC3-c~H!f*GxPs`iE zu7u_XieV_%yaC8u1QJ10_VqhobKB98bZF56oxTE55Z;)$l&Qfw>3iMVk7o&~*Z_zr8hyLtXp;rcazxAn7ueXUQKSH-+Pi1K4>!zL&nNq=)*dyCGiPKr zjqPuW%%MBbqr5o9N=UHxDP@>6tgEVNLuvE(RDsE~mM^sZ=d-DaU139t8L8#oXV7+p z3ritgr*JPjiJF3Wn}ver_ZbEZ*Duh!Ij45?B_YpiW;-44Hac(n46{8sYnD9P{t-pI!0hE)<&^`J8%3Fu3Fre^BIOHWyS$fT|#Ro84bJXgT!~!x(j23R`SJxF|{-O)wJYVptw>c=}Uc zZ>5@xf^x#j72o%FO6GATAC*V{Yz%)#|db&)48mTtJ{ z_Z%q&^j*K4>+?E9UYBlZ_m}|CT;-rUX+ua{TnX}@x{Dh#`cD+sJ9F`^->G&gc5x@! z@w-BYo2&pA7gl5#yQ?2|2S0xaIpt#VtB|C6Qs~rwFdgyk^L(ZwUCUUbJE$S2o-;Kvw!b^pUrw(ku1D4RinP#tKE#8fEvyK)Qh0P> zWz(pfLpbk&sDwTTQ+-TurMfJmoG50%JZ97{So#lEEyG;6#qHv>^F6R0inr3!h2=Jz zeWh5Vww~3?jLOZ|KC3X}-_}$WppTOp2d3(`S1A$zll6Qma~N zLk0Xy*R3%v<+8 zvN8UM_H`?7i=@tbRF*l2eef2oM*M@Rp2JMIu^pPm;04#RBXZF|=rfEpmaoJ> z_42V~g%1RTg)&~>ts8{u&ZgzG`Mp4TtblI;dXfmzLPZ$v-fsmZimh3|5B&EMz}|lS zrNbjuYn_b}+=32SKra1PQ;>M?$6u6)`tc*~Oe`6IO$NAU$6xNw4+M`uA{eyn; zW7di%xAWMczReCGW{GnvjC12fHhvWM7P&g#B7bP!BG>zb`w;#X@09!H_O;zAa~DO% zuCQZ1$QHvezY9cFvwdt$rHqRI;_)5E4;K;lN>sgF;tXCqqkR>4a$U7{P$XkbNUtIr zwsNpLLm*-FES+>$;Cdx3%O z2jre6BxO{Xznp%JyoQku9yrmezM~Yj7<%uwngm&P0^V3@8}I8~e}TdYJ;(WX0eNx7 zx2bJMZme{{dIFO29gZ<7WWP@!IK?X_zf=6oh1?eTF$^`!Zyg9~4fxU%T9!6;$i^yd zD-Rt$rQO{ur~E3%t>zP6A{sO8(q>8^^UTgC!d^S85Uy=l|A2&4;P)lRi)KMggL3-D zdAY^&B0;NR@%0#?#`)6R3Ba}K|H2zTO?*|MS@73vApCbAh%xGsX;m`MoXPnA&BbjW zH6tXc5~}ppaoC`Uat5gmctrv|yY~C^${*T+U;a&MVm`KabHw{H9NQrM@EaYFhi`n` z)vf39IG+??8Y|Rf8b1~Jq0*`Dn7@0$w zqf)GCDiDWFM-}HhulvVy2Uiek2>(vwNc7R{yPBv&YChTTc%$67N<$}%lkRM=oGe{? z=ebb58v;44{OQm462ve4X;#sAh&>H{F#EquJF>GN7I&fpn%4=8+2&?F%PkX=t3eLS z4v~T+86DHR3z7_tNeAl-GEyME!$m-WCYw_nRRCfh@r(FoGD%(=Qy41G zAPCqxx6ZBA;GVYKZFPF1DC-VNz6 ziL>b25S=Bzvv&^xi~P8Z>32{#1?YO7hoj&tejbtw zuHL(P!Qo(o*_(a`y^lLz=bNp0-}+3Pih&iwD+KJY6-1xd{0Eu)a87qW zDU$y>_&|)O=bf~Te&{Km{F8o3+~_P%o#hzptsK(xR-xcZD6P-uH#@bV0&uSJa|g61 zg{C4~Am?xGR#N@6Nbmw-w}r z28BLY0lp4iZWh)$o+mejC`N)1#qxk}<*G*{L{1bH6d>DX;m}xTpz?mT&J%Q}($-_E zkW6S#=mg$Hqfcj(JVJl1#&tz~ny83PNR)Og7eb#v?pEL7&dxY)R;9^wG7L~uB&B6E zZ1NW6!Qv@Q%BUdIIQlIpT@*hx2mDgk^^-xV8bK*lD|+|(@~ZO$hv7@rX6HkY*K+bI z8;12>K-h;@ydIZ}ls|EyMu{!;NBV?$Mbv$HrgH@L#X*SmaDT9L*pv854Dubi@q!bX zzwQR{24d24Su(!i!D6~&HgI z;E|ItAaEpWjCU(2_E{CIEMso2rL9A(>`Q+5 zqivXDjT&nTq$gHgmwBdXl|H)TBynMgT2^HbA zPt1y9?R$_`z0#`x5+s9jRmvFh`%?NGDFW$FJ1!$l|Jd&)_|cZ7dd4cDskEaGvz5ME z;1Lr45`B1b>W}O@oRUbfcWO6B0o7Q7489&BTi!|yD~x3YH=WwJpgq=UKv!7yL#6ti zWOego9Ga&dtS3>4PLvQ2xM@}1JjM1qwKC2e#5_bPu`)9L23Vsl)~C{bN#${&#>zmS z21-rLOl*B@LDRbUYT2EAQp*SE7t;2N?lq0XJ=6ZIIR^YFy=LF&X&)_U`5CBc?zy!J z>S5^#u6~*%gvNhA@pLKbx)l1 zGwJ+3Y2Q1J*+~Fp2A|IAQc`vfdiHRlvl$MQ~KYfF1Tnom(%@O-ZNM*$u(t6 zuYSF^@@U2I!HnFFdLoKL&Fnm?fVqoglvJPfOvS1}^a+ zaPnJ*WWA3Iuv@l$d6@X#Cs;rA#`-x4d~Et_svWIoZG}H)u99)qE8q`Jozl+sYw%qO&Bdhu&)nJ)bo z2cnmy*GpW-b<~?1FwV^^{1jFBl7EJ&+hyM=^9;uz$Li$UG8#m5;-t&rnJN7aZXJ2AhxK|G$Id@Seo;N|e**6@R4&ii7m?emwn%yobt1y&tMMFXJ?zCUSNXY&A9)EJ z$lyy7&vq{Sd9+x5*R9AW*$+tleF6C1oRw;RwcPjy@%7##rF`-Xc`bULlX{Jlc3cZp z`-7~*`&kcV#(J28T%A>>zDvu87l9LNYLWWObo9H?Po#d=fnRm-uab{_@<+aR7kRW8 z&m{b(BQqra_C)+jyI+xUmm%z^bB%l&>!=GeZsg6l2m8ao=ftlu4sU@o>^9$#GDo{t@}_-To!O(q{mlcCoyg72mNN68yn zpK8P|J=d^Hr%-oh>#x*$?&f>H#4poJ9g1xlKS}&QF)@A5rKSVCt`vcW-HhMt^`f`SmAM7#k zPJ2qEAFYUW()p~E6N1F2r_GW1aJC`$wmq(%*LM3+?6J8&Qsb}l!!&{GYc}%kUIFeU z-M~M$P*YS-+zdVXFrU1 zmW-W}Z%+^Ky>G~NKE}^7u~PESWbj4fC93~A@5=r7CC5&de#!OFM-2Kye}R-MZ6pI&D1MNH}ngS&aYb`^~bZpJ?5;IcFRYQ^M^YmPWvh1sshASX}j5**!{f5 zIr0m=9*pMGG@#`fMPpZe~C+G!xjJi25fIAuncckmrp9z0( zJu9DILA*o9C2}4QW4*PllKP8}edPK~+MT{+znA?;?RU)wjs>5;{WNJmUr+r4?@@9b z+}L@N(`8)1VYkC?4gPsQ_;&A0GGE^U{6{_gsvT{&xe+^R_Z>1H{#@)}6F10w>>J6O zT6U8>_g?^iK4#bnPa;2OQ?DH72I|)B{q9K7&Pm`6=2lAl*qQjtCf<|y=e6kFt;AdD z^=xDPO(D?!rF# z2KKt1acQr+1U$_6LGoPlU~ic?i2SkauiNo|^}Q_T{Vd|3+y5;6u*ZW3%QWy6-Q@X6 zI$J%j<)T9L2rqhs_V0W_oLzFgw`n%Prrc zN0b?M&Me}dGB20=Yk=oB8+E2OfII3nJ9wV>* zv)HLR4LjAz8{6~Kj)WfUFmw4U$b9Y(2w-KJ`VqE;=O8J>9}bxc)a=siC3J!uGpR@&zHmTo6mjA z@RL%{V&t^h;=K*M9y!T0o*E$gY zNSk5DI1ze>QMY=_p~yv_%Jpy}>wn9wQZM_MJa0Wlp0{%1<}!@9xm@sFbB*}uS;W`m zynUh=pW}%;n@4_cJ)URZ$+=*R&q>5zH`hu&e+z!weMY{=`^m$wdzaMvzK@*WmZ$i+ zwkI4%euFvb=pE1x*L8KTmHOsCsRP*dHyKxc0`VQA1}nTE<9R1e+PMMCk#K)f6+&}$?LB7#f{`2P8q`gsQDQCDCcN! zjCy{tcXb%~idX-MetsqE_P+iV?WD>6{1myjjC##_Up$E3y4}e4zKwdX*_ASn+@H~F zwxZW)`TQg7egQLI4dc*i)Z4m>yp;V$UdorLca~t-br-=OIt{$sOyaP%8u?NV;=CBs z^}k@0>yWEc&zAE1=g9dPF3E3`vF8sP_JK3-x3(L&rt`pU7SB-q(d(xk98oiM`n3Ff z5qa`k7aRF=u+N8$^XvQQHQBvV-YaAtv%iq?=ON@7D4wSFwZ_B00N%J|NbL)qpW#y0 zN#{4R-ufjx-*c9Fua0{?9{GRX6*3=`3%zxRp||eUxWx6UpPKJ&#opfDB=hFI4L&?z z;O#fz=k43A`mg!bmDGK1`Aof0%k3TDLIVbWejWQv(%+H0*mvI%rrx&R86OG@*Z(e+|+AntWpjza^O~{A+^yh!%=gBIN^863Lv3TjH ze(!W};8~~2@&Dc%eAf#SSKokKk!;8Cp*A+3+RByrJqkvFf>Sci+q`?TW; zsVD9wo?--hyOw`ev%d=n*Ya~B_QO5t z(qDE9_Q}L|6kXd_&(w8JJJmYT_~8bPb6BS4UB^>=hyAd>S>miV5|5nq*fcTDui}r+ z^s4dH_JO_l9r}$t(ucx7=UgGj|4Zx`YtE4MYyJxEx2i*pgVs-TnfI*Eq@Cmw@@@7V zBXQBk6Tg}MwT$0on;n`VRYH;2CK@ z{4M;X{tfty&i_fAT|uYnzqXTKKz*XZ8M6IPk#9S5)Oyo?y&sX!q^V5mU$?T}20oMf z?&d1|LD|ypkl-k?FLSuuL3f=e6m|#g%ksT`pWE)N_PW)*sqZ*ynw*YWkI(7#Tp78H zwcw}?Ivd;$kFVCB;BZVu&9hZFYN~4-ZeLAsV<2o@>%a5MSC`pKBe&--$QDny+*3WF zsaBh{)$u>l4@#)acoG`bh1xofJ$?>u$x=(WQU3Oj4o zIcn-k&u*dHUslTTj5dY)>*${LF ztUmHcjrm2Of)t=b&dEL&SBj{FdY;ZS3 zdmQ(hI(}o)YwF!K>k^zH-+YH_fhW?6%Tev|CoEdA*s;vEOmw)x8C(~=Q5W=YuwLy; zSX5MM{m^<)^~UQA8PCVQB+?as^;&mL*!n@h?OvyzS3_XY`~gSUuNts^6X{!|ThWW! zfc4stqt@efTYpA+8u_;-9Q0a$#NOx$yBl;94tJA5oJ5GeC`zdfOn$1CrQ-6`xkKRu z+sZOWf%-G{oM(Z{y0NSv^3|D+K+wP5<8lY%h>q~afIGofvZScQW?ifH9ByBo#}~a( z>+yL)_4;ROImNZ>b2dZ?weE0DeSBZzI^}8%#NW|ZOKc^!^1R}rOKk=AqGh)I-_Q%l zq^ngl<*mrV35A0mUtK~d9Q3++mH6t&l&kex;_!qVK6jln>{;*T z@=ABmANkYQ7-=IMQa>#!vD=o|%GKO2Dsfc%7F2tD)?Xgqf@j!EY)lPg5Vs|Dzsrs?PzBtu&_`~u_ zb#%qwwYsL;^m$y?-#(9PfxmifY#qjbJ3p)mx}9P5)94~E&9~d^la{`qM%TNbMkl?j zyr{&Ux2V{r*tOaOB}FT3M~p0L|d2E z!5e$lx+@O+=pj(H)VA7M($=)c&Y>coCmcDpVw4pDS7dA=gbGicZ*fG}jbmJq{yA#G zP4Vxwj+X|PL2?Avxi>~1wK@=eIC3kYG{UFL^2+m;IcogAP&n9F6L$D(!m-0($|u}D z*Q6F50cX(J5V9t{^4!b|9C^h{O3US!vp#A)K3C)`JT6D|Mu*c|7fOizA~Knoaf1;V z0rTUOcXLQ$ue9=F>zJywJ!o_}Nbv^R+25E{% zwB+S;Z-^dy@k>1_C>cca;jrHkVS=V;?QpqkosHgz@EBSrZr1%@H_cxrglt_BVPX|C+~~+S3s}u7wLvWY<`Fgg;6Pt+SR^{PlXLw^4DK>X6$Rtf_ZQ>QD7X zM@dn^6t8o-L{pKS9(NgN4AoEZBTLk742UQFfq1TgfEHzr5rULi-WXMQR$BMXlT7`}I-rbm!8#P84BZoQIO90J zYAnk0{zo zx9w=?ATDXWiW=MlQs?{sk;QnF!8rn1alr6r3apAm99yq-|lI7%J9 zMz7bBTUMTg6hWFxU)JU9$J5?lPTR=GXf@HIt~JD6`KiS?!p@tQaLND>EsjrNy?qlIV4ulB`LK&1bOV z7%dg$ooiCi`t^0misItv1^Qw1GX5YeDX=Y``i{p`0QX0aQsP(6WMYh97Z2Fan{Tvi zH%GzLH)H4R;%tMovZ$iS=xc0tSJ(?n%Zu!*9YrOJOC78Tabu}%b&)k4i}EUp@*Vl5 zB^CDayrL4j^<4gji~M-?RQMD!1j^OUqZsKBS*VDld+EptQtRZd)F`EVnJUmRj8P3R{Ie?z*CE(Q3P`LQo3w?0JF^_kze}X-S1G zjrv#%((#ZgL@6x*U-YcI5w>-jBPWLuyN6zU@G z@1+Hc<8Cd@ub98U5!pT!d5hIoKwFfzB>r+)UcN(r7Np28jHe*QQTXe8N1okYZheG7 zT4^gUTD&?&EGSyS0IO?Ti6t%xLSz-$Z6$)Z(pFqrW{XiGYtUBi$SWy`jAl_@aqL#P zEx)MDp$A;iB0W=lJnp)Diif6n6@O$$IOQTD~H$ zSW?WL0(DtlSy@rZk|{_QrM$Fqwc1NoYZiN`;HXqL`H?4_P+pN&rUb{O?v0vYNno*S zM`@m|Oxe0BG^wnjB92m_rYDY2Sz=?$S$}GVU}O62rKQ$ftf;V+s~sGH-1^SE6_qhUQOV-iMR{>_9-;*OcXVJXCX=F+IIEN(>5H-zi!4oy%Lv~P zFNBfsx3$Zo*A+!eqJOWrH)!hAn303H1TMtUj5+@M6LP` zk1rw^#)R28KS<0{A174BsKRGsiS%)QDwl!kL$x#HJ}=9M8tgjtO~%7q*95(_O8Mk{jkUGzIP-0_$1?7_oefdrXGCU9D6=h7?n3Jc zEs94TQ|+pIx>w~9Mq0fw><&e)%qJj(-A(8?o(8|G(d&-s9SJ2CJzlE`g@eJG`k=A} zDc6VfwuoZl_qZIY3Dq9WIbANTMMM;cn5!k^i+WnT>Q5evQ?{awhr-TkuUogT2Bj&i zJn&Ahx7tE>XjgpH9&K65%?r!wVEs^S39qv*q^|vejaIXcpgSDYb7PqeB7erI?$H$* zHN2QKOMPvuo%9^EIP0g&U28e+Bdc_&dt;e$KScFe?U=DHLQx04rdXpXerh>_Ba|u5 zH_klEB4gQsraA-F1Vt8cfi1tZz*erkM~+&5FwWni@74zW4VeGUA4!vi?70OIafaLu zkNWnwbIsjkP}CM~4ErZPG+BL~{H$tCACuNq{JCin3gQX=1s;bjKXxtbqRO!pZx9wL zoOH9*P4#@VC68}^ck8CO8})N)KIWXH|HpLxntEq&fyWo;9gX9Y&MA0j^f|a@^ck+L z$+eaIUn@f24g2HPL;O#oMvvG+7gyHWjZos|PA`}R)>>6}r&!q*Jvw31@>gDwXWbW* zE*~l2k%Ij{V#|-bEy1(EFV;q6@l34}Sq<*z)_#{kIx`Fy+eG%0dB27du ztRF>&>s&{m+HFY%4yU)yAB=3Dspygz_0cJ@F4A<|<>bb7{}zZ2E{OJUf#~9bxIU^M zMim`?8oQ2Hg4EAr*P1LH z=X(P6?qIwZoQISNH0+NVpyPfWwcf_PD#D$4*Q75nD3dyu%opl7TNS=OvK>%^$WNa`3leaI=9alji}?k#u~3FZpDAUd|hl#C%2o%? zLB)Y=#?!1)(YA{W5`pDU;xeGQIYc zG#I0Wrl3Wh^EFKQ=oDnjE$0qS-Sm_*SgYoZDNX&cC2HJ|FNs?4<4_h+l40YIiKJ1I zY%J>Ah#U4O$?$$e8;g--W5RtBYfzG>aI{1lmSovDKKuBY%8#K-v`0T~j`Cxu60?UI zs5_~T(Hm0{C-pOWL%u{fMPjdz#2c)B{{T=DQkiB_yIZdb%h?XJc^ z{H0|Ekg!EZgDaj=(;$8j#Y`+Khyhwc_0IVTi%PVRQ4()%w4lBGan)y#_rLrK<)4&c=}2vDRO0JZC`}r)mH!p=iWkXh~mK*5{KjlAq*Ovw z7XVKU?uG{cdhIjtdVFqd=$1xm!Ge@ps;#~;GjFZKSMBjT!tPL5UpIQa(XcXY&sUam zE^4h?ydpx#D<~+B#(-HDQ5S}FWz9zHGU(jU;9M7Xzt(ckiwB&_BQI!yhyoNP1f1b| z4PCOn%Wt`dJmG{ocQ~RW5;N)!27P{OyIDs2I;Y2S6Ik(XzOcVO?j801koC*>X002M zJ?N>KM2A^7g(b!K9E%p|on>7S)IiW5_Sg8ml4^c?>=cOnFLKxVG|Lxcc?Tl>j&#vN zS=R^S@Oi$-0T+2tA(A39SmzFlCcr9L9wm2mV_nRJ;BHC?gare9^mt z&=_z8-3nM7S^IH2La+hdm>|SIq4z}S|3`BM>n8tL6C2#&dcRAB62@Ie7fc`=j5%~7 zO9@Vz&=~T%-GONAr6b_>x%3!XgbneO$h$3Xj$=_#sX2)$DGoGY-Wjs=6JmPC?sCEZc=xf|{ginRts>jv*#UBhV=Mr!ZDYtv!=!!2y-v)F~xH|A-zg#y#A0o?w0yp+@Dcy66tQJ-rwkTv5X^} z))`}X;hKQM=W=_U8xunEd+4Aq8WpRK%38nvaO*omZm+urXRz8X*5B10pDW6f<3A_9 ztC4$gm!W6?ZsbNpzz8@!!5CMHZIHS~XVB>jv!S9ltyLUUV8z&-h%h|GJzs>98T(WH zWwoCf_jf|jU9-L+RF@EP`&^NKRZru;HPYMo>&V?;G{jvwcOw+*^8#w^sOKV#sV*1? zQE)}CtiK#Szt2(Y3_HECB^UNIxc#**=SHh%k;bjAh5ZTMklW4S6A@yg?^l1;x+b*- zSuBrQYiT9a)_NO5^$E3BleKPtZ9;9>?G>BF8#%CRt?gcG4Pb4oRqMSTuRFnN&FimA z@CV$!$iJbDp~yd~m)2jgyamxk8_{+f+_7P?g0mahfH7G!WNwtnUs&R3bh@lK*v3#} zHL$Q=JnL{BqbruLe3BmT)o-xSY6 zjDK$G_k^aTDprqkL>WQWJAzK1EAqcOciafOn*y>oDneE?=8vBig%OHQkE6lw3)lG@ z+`)}g{YVc`u(oDFR^|nfjx@L(=bx87^^N(N3$o(woOAAi^Yoo_&pB`EI}0+ivZuat zPUiUwroNMvdBJ{KJ8yp0etM8S|AGbN9jI4BQSDpca@R!us&_Y$fxzXi;V)-M|D~Y` z>Q`D<=g*iSD(=3tPDNFDeK+h>BOAGJ`&{}@qVc2g5>~$>lqI&3{6)%H<8@7bgco~4 zv0v!F9ktF-Sm~u!=zHWJmW(Il@Tf9p-#7Wy`g_8D<0ty5kf$Nw{Xe?wXj%|=b3wG*kx^Ff+u(^vy?Uz$L-n58 z@ch`HJght7jotS~??+mYP)hsyeNf9gM;&!r(*$1~dVT28bh=35X9fk&_Sv#6e&lf{!qA03*0Ih=+}W zUjpM~zPKcX^Ho!LbZRs}kH!beaD5bJ- zgf5N%x#2BSb!eBBcg{Th$X`P=Y2faFTp0}*J5+y%v9V(orN;M5CY^k zYy7-F`OvEKN&=0MQPW-Es8U@SF2DE5EpjdeN{G${kW^(lP#S*7)4gqxNZSG!U7sTFc!jM5cJmOBee z`V6O~tG(mQy|TG*itLKENDWCifemIH83REKLVm-{Vt}Kq4<;xl_4X_pFofMW$$TF1 z2ZLomfyASO=?{+hV`-+IONOtr$%_MVAVXzbhudJ#9!(6C<|4Vk-;I)NH%%FpX*DRS zk&~z*i$*!rkiF&-oO^?8)$3(e+)t}!u^11c{ucLRwu_+26cSi)q!=D`Q;J-dx}4(BYAwu#_N}-1Ubi|Im;UIX?kXV+TVGMMDAU#0!aE zBHWt1J~5%KjKPGRJJ3~(Q#h6b#J1`?s#&u8(N%!D90DMP(6+MNY;Ivbs*13AP>oa_E)Ecvwl2tC(aRHcKoO2_^56mJ@=LY?-j zv`&D4-?day`3E z<#kH{qkwOCxPIK7Y{_~T@}$~Xv=ve7<3b-fPnqp8)~=I`Dbs$FCQ+S^6Z*Yb4fg%B zr06PaEgpqFxGFu@*=^Es4Wkd0jGcqH_-CzpiCiNdqV0Gmjd}}fe#Y5|7lt}+R=&ee z33WHa*zTlNV;UdNQ!z{yJ%1o6=Vljs8}1YFBGn_s^n9CtX4|FZEkXcYR_oKCL1I&& zTeQiRg%tP+XsUQz$8h*jz6SjARAE?yQJHv2(4Gb!sVa6uF~O#%Q0W;LEq-*LBvcck zz^?_fX+l_0Q_nk4!+=1rL>LZws)DxYqaLzb1Yb4^<7V3rc@XErmGPihEE4}4!lAqG z3pp$Ic3)h;r3OVdkmaQf(_jY6fR#fXf<*v3W?PfNyf(b!Ix@O?aQ&E52Vu5~boZfU zGI?lp!1Ty`Vk!nO0R%=*Nl$#Wciij8&PLm5oUm>Nbgn~f(xg-h>?7g*E*1s}!VuH^ zZlvc{5+T!hI4Xy2J)=QB911_ADJ4)g0m5Mqp_ha2NQufkQ#dU>nu`ym?S3t|ILRjws~g=hv~$xwa|zM5VU zC&R&`tJYAD+f^Hu6L00#NPGb0)~K|bvRnL;pHDH%5l)QQ4@}rVGQ;N!=8qu!649$4N99msQc|?vWe_Q)S%VLDZ+}RWXbx z^ES1tipNcqkIG@*&tZ9Ikkiq*(k-i^pVqbAJ;C#voKtqyp=yQvp}semSIvBZx5I@E?@hjJj$6i{?kIx}-o18g-TV=>hTxKVbU4hLWvIK_SY zcE`RsO*yIKEEN{yjLmqfNIOMnc|^5X35{6J2k1Ul(Hu<&cDQKR!k{tZSYvq;?l5r= z47IuX{-JkSs)nD$<@V{DsOMm7v{J4EfsE?RUWbv6z;q;g;AR)|%j8}yn?{_!fI8GR z9?t$|V5(A2ek`u`pdi5SrI2h#XOn?2cOrzNWNJJnV@y17$%-%&Fj6%MVPIpXDWv^a5pgkT zhUwT7&sw?Lwlzve%-F3|otzyBb1vgh7Wnq|awG@)7D9>?j_bXa+&H7Zj zN>Y}N(cG}im#iu#Ws4VIJMAaiQNI|({YJH+<`wul?Ipm9wB^qGW(~Oa+BFp z5|>R&To!(K*o8@LIY5^coWyLlE4AeEAhC!TG_c{e;mHNec$`?%zIq`7?{o4)ZsN=Y zt-d*2fJ~DmRii=mU}_s}Erx!Rb>K6FoYNugq{E`bkZ=Ts^like;92;m<-4Phzu7NZf7%S({htrmWw%!0g)!(3&@W2S0Y3Q06bY&4=I=e6;# zhUu8qbOPH)dW@h(wZ1)E7_0_xz;dqMP~c(Pxt=I8@mtj;PUg~Ipo&uYgdo-;FEKeh@P#& z{?VqXLv(Ymp?y`x43_!b?X23n@)Wd+q_+i1aHQPcs%O0^FH9^f2`-|Upw=L*D)Gny zb*FsPw@AYywhX;UL)HtGUt%>;X<6%q_F+WljqDS#J4D($S5{t3Vp=~vu zGKPa>&BZjPRHqP+ty3e_kU_swc1ZKFGi2TBy-mTZCeNl9{63I|w5H+bo@9q!&rs+c zLf#0#6=&N(>b|!u@_8L4X%qLi)5K^wpgR=&3MlB?r}m;Kdjo}y2O6Elv}*D}-jAD9 z+rzG%3@SqVK~tA%?|1N|EG#g9SK<@1L3^x*&KLo%M%fxrS6I$j4MU|&zqz=sVW(rD z#k8`(bVC^@aI(>u#d0>sJj1`?p-EN8JP;`?;2-O=hzx= zHZ9(4TD(~xUYQA|RJy8I3_e3b+m`}??tmbH{kT$}&nN+El+&shG0_5^b@S^w&_A19yZ#%V+9jaiJx^; zkMdF4k4p#OU_yX5@i>Vq--mhCY@gGlDvMf}QZ?6+;nK~R&W*rjb8ZDd^`2-i3l9b7 zx=$$kRxN&Z=BIm$PR-k?Q2j$EjN}j>h}n&=t7alr?i3@pt_4K1y2kbQo#DVx?obOX zdogcw=1jLukE*0quTMV?jxFpq1=o-V#Xb!})-up68Q7AW_+!RI3==W0g%X8<7huLL zb^sd?+8I=%1>dfPG=oHNG=RytUyMpH_@JEDVb(ZLEUVYD9oO3wnPpE$sf{k2-N z-*)=VGXxIpON|_|%>9I60&xyX>R*3u4xkkSv>EP*dGN`oBmo+e8YY)k)>byzs{{ax zY{htxXK;>Jw}n#_aEhr-B`!-p2=>PHV^8v7laJ9xd2KE>gVm;DJTSJ)RjsUV49hIi znk*E3=~_)qsnZ*W8 zy%TEMGnHp^;c41~Jye^89om=XCjgCfsXpLSc3*5bcA-j*LwiSiY%GuwlV)(Z8|PJE zN8a2+l~_o)M`~I)VHN!n?e4$nLn?a!1s^Xx=UK>Z`_|~rucUlo;WvoKI6H`M`_)}qtX)PNncs6XZSWxtRI(Yu$P43yVxaa%t6zwsqQ7g zPja+{0v3qdjYQq9Z{Sf=Za@kb89*9cn(&uf4kd2PFha;`E{)1+Z(T4soUwU{vCH>4 zGSySS1p%9IkA?ad-O-7a-sX(?VQ%UuoG77s`c46KEN+?`$~vbOPS6u(VMz$%EAY5G zl+Y%`Qx{=zRKwn@h-6%wCYZ7a$n*kDOA6?Ttv0cGM>U+L3TxE;si`R(1yt9``ohOjzQM5j z@^0xas4}+%%RZUe3k~Mstq<)&hrM7}b%w1&*U|c2%tqz8j6N3_?oIJ7a>8|us~@#y zFUIbd5!y%B>}$eTwqB;=Uhjm)XvPCYm=7k|%&oG;AX6?>`ysQBg-dp0hB1Z;1`{vX zC5xw)j*$(I%EeAK;MsGPIn|`!zyQJC=Z+r8t^niTu7^VK_}!@Ar=N@-n}-J}M&(3j z2dq`5iFr~nql($@)6Bd~)IbSN@2QZMmZ{5xpbMzB6==f3)nyFH*n!0a5hpR_Yf_-6 z4wcgyay7rrgM&ktNW0{ZeNjX7*+WV)T5ni;q@3s#RCBcp(F;&*f|VCSVu>{%fY~zl znwWM;O0pl4567I4I#%Y9G&qoFKriafYq*X~@^hIT^xL75r` zTvXH5>dDsg46tpLUN~>?{Qc9xf=q=cJIv%0*r9Un3 zX{uhGUi*Rf7F<;fqClM)=1^%;kqMsF6Br$JCzBFtn%)BM5cC#UC4wP27pqfHN**In zLDCAZw-BuHdJ85WX;`MxvoH5t=CaW^GMcBZhBFRZpj;hi9Hf#nh}3dKi#)xo=U7;- zN+X&fY)0lhNKTB7K9K8cN{$1vd~kv5N`?zEx~ij!9+cH3RSt1iVNy*_XqCybQ!s1W zFiS-)`4o?}d76X;8fd>BgH1_T)$zV_Q03h7QF1%i^!t2+E?K(6#}B2zw;}G%)0K(y z0@bRmRzxW1$5vFbKE`?tD!^n2rxTN5ePJ|{4E4dpWEdw&HIoeWdNnK|LNTw=Xt*NA zBCTCYRdBVlxxBsvCm!p12uOd0>+U1gCamFyE(OGYEx{Vmj% zoeghr5O(lRuOFMyx3pq+PyfcrD0Jz@r7D#7#pw9P`pIroR7qOl+a+4mpb+Eae1*l3 zPZ69M?JP#!^_8{Fs4VhvGru(%1cxnfx3B5ChKEYf(2_WCp*o-o1w$*^;i%r2vnZNG z2GC2S}ihMydINK*Z5&V$$73t z_^e^N+k^t==IZerWDCdrNwq_E!I_gKE+^A*-<&LQsbo;ULiSL4{DU6I6Pk<&pd$T1p-^X{2HToVZV& zWNBVEQaQ=%ewB~%ajfIki3SVUE(i@rlOfZHRf1IquDQU=KmRVYK71F0K|W5Seo<6O zK8~9dauvFpxZMeS)-=_%-nVSS$y&p4rNUJ~$I#@rdt)M%UL!qrWNYjy2-ATG<$X|Q z3po}BVz`R-A#gxt5gE+cbci<871oxFFp8`i((O}frbkATAt?$0fqQFB!Co_-or4pm zx(?e#!yEiVf!>0yW^_ixW8C8HJ|x*ScWG~z_=C&NVrXossCzdy96rNmRIne5Z3rQ> zhl0osZhUMG(s+XQDD42y$7ZiP6J+7ov$ojfT$wKo#GbL(ZO!8xcuiLUg_(G2>vzCM z2xDR19SQXdW_2i`Dg_&S*}r2r)aJ3|x|036vMQcU`%S*Xz9HVP$eyoaoRDfN*`jr& zzLw)5br=sVTwijXQG7N4@X^~2@UDGXwxhfocz;`Qo!9ntyM&vq z+^QMkb<@Li^aJ|G;oZpEHfQZ>ssoRG4qJ-#upt}E3V&PI;TmnHyIAF$ou1lyn;P}# z%HFLOJU)-1CWYM!Zvl%I6-XkSE}7Axg9tTj_s0=Py|I_((AsI+`mVJ*W^Tct(;rWD zo>@Jqa~`3rmt7Ia^rNGwxhB z0R)1_j-7s1`jtjsYw5ZR}fGyT$-q^b{I z`kx3KufQks{5A2`&@LWHVUX9xQ@_~_DzFt+S>mXNU~aLxg)H3~VwYYK*lWWL2vsXC z_PQ>&tGI5dC7e8(+SIyEii=6Z3wDcwD4a&i)v?qc zd=O*uF&bf@ax@~E)lA)0m@*VrVS4eq50Z*Zb%@Cecn(yDtzuGLc{;SZGD7y%2XiQ- z;i{{kR_iMaX|=pZSBn^e=Kdrbh$kX72zxzV4PvBI3$0(hkU;(Fg$RSZwR)j1%T_P) z4YqlxttFv0f4pL7m)nZLQwdcJQ^FAygP)CZa|%o%=pm}!ri%`^+p|APYz3+@9RPC) ztfZLVqXewM?56z*1KYy zn9+so9=tZ^%&2snH#RgX&})Q25j<+pkDdr6nj_eeJ+1?p9LjgS+drfoZMenkS}bOV z@N$T{ISUr@!rD@Z!@*+Jfe)rfe;q-QK9O9H=eX}G&GNcYRb8RR22JV=n9jPNWv9!#O89rp;3*rQBL=YRh(mld@uzN1fwNHobW+_=LldME`qHE?VZLeo#CqkJ->WvIriEsoG<(C# z7&)ggiPkw)HWP#*()Agg)578(#~py{5=BOLjSq%_Mcw85bMkVO;^Z@|XlJ`b$fq>R zisu_97ye{Tou~LJMhTV(oe#UC=hq!%GH-=ERrs&3Wh1E~G<3F3@9}Ce)1I4JM zxAG==c8)!i`q>4iw(u0qk+=~(bxb8E;=+5txgiqk;pGiVwbgRyl7%tf^fE?Dj3YO{ zC1Q+5d;LKBkxH6g|3c{^_}T$he){!-MQ#!-rmcA^UwTo>vyz}*SrSrH3YQt(5g)Oh z-1&LiDIGTSn+062458`bhvqconBNNZ#e_d1IX-_@qjc*O_^yE!Cju|#&3py)CQ-$@ z5VQVx?~3;5x|);VIy4aXY-l{tClg_2zk+|oIH2`bYSt&!CrKZ&^h0lh3iWU@wtu6z zI=)JKvuZ~nr>|C%O~&R4ILhfWZPt*~11y=XVR?Q$n(+Hjhp;kkAu9Db0XC$RIAMph zk!O zFkBuvP;@253DIPD9IxQG_L|b~gko2S=S62<#LH7t{Pc@d&xM#N-`eqAQJTr6r499o zC$A2^ieBf}Tt6x3f_QtDVRuJoK5cAvt%!2*%AD8M;LmLzmp%|vaOECkNpXpD5Xz}~ z*qhMFQ(oL+TRVbLm(qoCikgc*E73$qvLc0exfVW5RS_{}im<}2Ur>by0M~AIYAIX? zxAViTy!H}^19@SIJB$Oauq~;tXgt!j8ONe^7;I9)g6F!kG%InkjS>9k*;U6e+df%G z{8&qeYe7?|Vc-)|-e0R!2JrL!p;uRuks4j~TeOzn{Ikb&>cOdN=u`XKyzY=y)l>WZ zBxP(#5TB^G$TeON!%#N6WQZv_l*M+2n)S!mhGAH|i%{G%nYUU|N9G8JU9+798t3ZS zg^^7pfukn=OsWUZp6_?}QB{!4Cq6&NrS}c8;Wyh<5?HkavL^BBEjoqAj~S_k<-T9A zc<>_lT)L~bSlQAhA3vZV)&K##ler0pnj|eRZkr^HWX+RL^Uk{; zOOLozPLWy7WP3+g_G!?*BnLTUeyN4EPIt3;`?O3Dy)v9az0^C`#+C`&{kGLdfA~}^ zA}~vSKJI%tk0sy7vr^1}@NBC(b0e$y%=t-Th8zLLKlMp6p-EQV`S}a@AmM8wyiuqq z>X*d-8Gf)~i*I2+5_AX;*AFniXZ6ZdJ*D^gmKB?)qS z)>slJjt^xn-tDRjl6-HQ{87!w;K6X`lZfbH+-*8E~9VfKEQN=qDDfKOdyxG5ECr5;Sk{@1O^b$!Od@Mx6Js4p4WozE*8)oS>DRfMtn0MxTbi{MtXN=q* zp6+-ep~y=+y?P_}4PWk?Yh2gi|6Jrmj0lgX0q`Bd9c*+~n|+ z1woR;2sJy<#|S(}m?%rxtHbhqAKHaiA_47pyV#`x{!7`k53KjDNzCVxj%`8Z5i z9;Q&Ag<|yxIDH-v!gMlMj^-y>O7&Qk_}L+4<6v7An!#z$sw{yVf7MMR=ymF85 z4fZ)I8yQUu(<~^0-AyeCHiGW^+}T_(f%%z}Qh)KHl zjdY~s3Uz$R5-SePi5vCs_lq(@pjgo+Wh6;HF5mUwtl-aUxL{ntr8pt5FE1n2vuQ1sN5kBLs9GCpc`F77B3E$ z1rm$gXkZ|#m4#dWDzTPxC#{v6i5{<3$rUmWpuNLG?s8up;M$}4=HY4lSTwb?G}>8_ zGL^e#udF)S!GA;>Bv`OvR5iuddrDZbBBi{mDDhF|l>1Gxtc0AidRlW8-@%aSpq>j0 z(`&=bWvKBZrZt00tVTi7WOEoFv3|v-`DeCGpsz8IHvU?Wc+ZNo)Z#8oJ|`PLv?{Jd zxSm_ar{3`3lb#XVY);Fgx@f+@FIXlRdR?3i5+9j>;k)+`LC=eSUp_TjYF|Jkv} zrhR--Mh+z8hT3{Wel{(3V%vBlu}gvWKfRHSptD&|@d_~sS`_WW0}HrQ z6=dJNU?<2t(WYa%2XBnIg=bNwNxE)KRS6$SoYavJPGwCG(MZJ6{*bI0zQT>6rO4}X zW|pk(GZ2u%uH=L$r#)jU?|#@|*$Yi+-Y{^~sqG)m0Fx$rV#+y+9NoTJM!#dQzm;Bj zG~jtCPCfrZSQ}A}&7f5yi7myrQfrGqlS+_xdCQ`6JY|{p2n#RFM@R0m7PEP3ciwSJ z$*DK){q2U;WDg^kwno_)$mgl~%jr_^;OmBJDK;9CKb?zQH5EwG5p7sA&qlDEAmg~2 zCn{eQ0i1zfZ9iGv6`8T6n{}cYbaKO=V?taP=Qv>k6%N8j3O=q1-zc1@TN)7s_^TNnW>*x4YVUN&{g#NVAKY43kplY7^m zn}cC{1WR4(TYFJE0^rH#=7`8}$yHQaV$X)9nq@mgeQxU_y0^hDD zMxrmCpHXi2H;(3EKwnq6!QE-Q4rn>_(;@)aRrlje(-2((eEq};Wt%zmGmLH)W_P5V zRhc%Elm5>c$gyVSk))Ye!6Ys$%*pB~G~;nH`1su|aM&6jCbiM-kevxFjLg3N30D=B zQ0(e2QYd@!NgE`$u9`cKQL9@*z`==r@C!L5OGT2fH)eCw$4>RNIi2QA=8*p&ToLN)dYMI zff4;CRx~ZG36p;dyRMbe$Xr!ccIw>qV#sGJWN-fMo5lXo_;macSH%X->df;XjIY>H z4H@Da;@|8_J7cd&L3x|~3iNcQGrP~EpB7sy8^@zEFOJ>XXB689vk!803s#sva=fJT zFI8VsjxX^`Wtmf(D)EWS`BwNfn<__%&@|ZD+2wdm3RHJ2*vFPd#v zvXbz%8YAz!GO>1ZlNltr^UpI7#;wI&)CxI~(F>6sQLqd0jUTJ2eg28FD+wzS`06T5 z?&~R9FH)CBlXfQg^X9-X*NR1H7D498N9}4>92|!#H#LEjd{C>Ux1=dD@*JIPJ=-LWY3?2)DF4> zk@2O37i!zwnGhs}VAN|n3Hl#BGK;C?yB#xczJDILYT*<7AqLZuMHy}uAqm_ZA)xca zy^Q~@-t1W@566a;2D?R}01MsY-g4TXd!F7aKimHA7Dj8{1)}ZMCx>4ISXED)wO{|{ zenqtz#0%ZT8SK&POqneHdqTGGK-;5@9)F&}!ftG7hV6eI#g<%6@hU+;{<-)EOGt&n z%P>Zu3$s`&xuVahmP0tzg9Qg{oIGIn7+Px{o+qutI<{Z z3s9N!6}KV+Zl4M*1ML^{C@srAl>-xje!G#S(>|5I-mfu(Non3vBgz z1b;Rz!_oGe_sg2j-qzXQpPqJZp7&it+|{&EPB9mu%)l0}Dcd6$0Hymx|{-Ut@q8CLw$8#M&n37JbHJ9IWlDpjxhZ0YPWKOB^&+CP*Y1|42 zH$h)E&s|1$W6QJyg(bE5_~CVx1Z;ALXwU4{y2WgXbUlfct0>Ls#u-(SF@~~BwO|Hx zLTi6^>un*JF2DH*yV9YXi6ER45Nf*6r<;fWT)H$8LmiP$j?m5@;Q%AD}FuY_|W*%G#1Hs1mPlv3V0WsNK-$#Ld;gW^X?_8WbK9Mvz+PM z+*P+=Pk&j?^$(vgW+}aIYJazZY3+!Z_j>^gW5L1hhv7vzgHrW03{7@=MoYt#fXoVf z+NGRvpAe$~?MQ;Q{*b3!4}x=Ns<0GJFRx@#7q0Q^A#9G@`iPP^E&Q08Nsm< zLc^O}H_h1V9#&kEq^_tO4?Y)(Pg1PET5OKKaT6u%q;rc|XqZ+&rGbc{MO_~+?wJ)& zn`H~R1~qoalD>Z7UhUc^vzJmiEJVPXMgUhNp04Gxb4zKb&^bnnC2j9dte^EA+eUaf z5Z&X=%9MV*uy)+c#1!QRXN5DPlYV*jxQw!>LNTKcLymCV9=vP9H@W15oY0%v;FhRc zisos}806WjFsUm!b9D`+)`)F~cEcHcw_p4#w5)?T8gC=}2hv&I&ULlMJ68NEjMwP3 zl8O2^`&8c|rZI=h17zkfNBz}3ksF6xljN0xCL-%Yt32iYOgAcM7lhCP>W>!1PsoNc zj?@T6z0h|?fjxzCq>Vvt8z3*G(!xgojgoTRLT-SFD}jsu{IU zGdUdkY1_20J|y=qZo&iGaKp~%u5H^|!=8p;egV7QmwJw{*js)p`o`RGvMi?i{;N0V z`h)wJXCn#Ih@qWzW7v+znTR9D1%WmX!{^L|W;-(6Kl*>(7W#55W7(!?Ctj-D8$w8!rlfF}5Z2V%QHDc`lLvXMd?n=2=q3ox&HtUQAl>irYp*BTo_ca|A1JP3+<}f3%&;1{jRBCO_U(Ou5zwQdAeNt*QkK>R9A9mNl_udA%W%l zB7>AHGQM4a3z?p)d^a}sV_vJ-ar+qawOTQupMzcj;}=}mZBX7{&{xadF6XlGm;OQD z9=1Z4R?_BSywq>{oosIDYJnEHnV&uYrVzJ^R-+0#!$^#z+2eViug+d`FK`vMlmE zWnC^C$`K`Gr-t|xTw4!)Q3Er@)UYJ%4wBRs78Hmq>>+|zuzacDgn3-aOAVGdKNR@u z*ooCK|Lk95s8YKxk;DkxS#1p|U|tdcH3pZdS{160Po56ak zgYP>)vZF$fE=je;tI{z0G53Og{EO>%;SVRxkmLR{{fIJe{} znJSqgEbA=~3p$U(=2GXnJR1v1*QzGx9cv9V#$|>KQ8Swc=|>4x%#=45Ha%D1l4S z8r?}2^kfI}e~sooS3DPEM~ItH@71 zcSyUd?izpjr#2!ZP1!3^a0Dn& zK!AILNF}$&gI`}B%{f3o)6rc{q;`TN1gWD#7=jKgecHNNZJ0>Z)nXqIKa8|*@ULo0 zr}`ZrfaSB{^0Jf$G}l@;QKfGuHeA)Fa{94GrII(hD($rwBRqq@Rqr>5Lx?IN_ zDmBQNmrn7G_TLg$s|4&Qm2w>mgi^wCMmGKG37Wb<+P>BVUkTnn9G3#k$GhC0RwIhN z^%?C9H4J275gz ztLXit%3W3w7S61lKF(Fnj7WOsZg_LAd`DQEJ{iE|v0JBQK?1k0A9L9=67H&4YimDtnX! zB9?ARkR6=wY>RdJ=ru<~!WBww#-(W{`OV&+x3j}Zd9@GF!21z%1u z)HGu%)h)lBT|k!zAKP5?yNyr2d7}*$n}>bHHPKq*2811f&Sg{=?Y_i_akZS)QW=ll zH-%u=XQhst_QNNJpHGzJ#kD<{JWNh*fLyq<{VdT>HYDxc%lvm3ru8|KFHJ?A#7B5J zRWqK!A3wdBhC7w#oa$LlQ|9=~Z_{vWq^9)->nYyHGNN@(+q)w6l(>_s@!FVJw`xuA za(>Ef1&oHP9c94+$qY46ury&^%JVt@d~vh4qNh@^cx7|}Pu#q(R>UJ6>*Nyk&xh~& zZAWyNDeambbVScK@ z&7`%lIf;oplxE?Fw_HlrPT7X#Y#w2NU+QW;`YAP(Vr{tZ%!0k$ZdZJ8;1tKt=h7^X zxQ;;SQP0XO4G_sY?aQk5MJPdLY9 zjtf=FO>O^}pU8x8w3z$*DX`k{H#$Ze+NeMp%YBCf&}ZYXeiUD4-1ZWoVS4;Nhj+K0 z^aO407rNu5UvOl7oH?sXTttUAx6#7W*=yBYbR-7{<_2_%qka}SOmQOsXQrTI&SXk( zM0r%CuhHqaukwSMbY_S|twVkBGr-3AF^IN@O+4 zV`F?C$4g<)s06tsW(*6@8&U0zdzrC;Bk&s9;w~Q#HiR>?r6Spax?n zQlQ*wv=g$_)jN4D@#<5N-XSYi6$fV!`T=L)l)5IC&W>vOFU0fhp(6%OG%5JzX7`OV zcZ(oFxi83$vS%pVHw!LGE(ScdRm2l*MSiIXzkx>B(IzF5;qn%+!Ehgp)^o)$Y?q%Z zNXiPq96LY`=ieO1f1pc^X|g=_SNX|p{P<$=W{Eghx1%ozdDjb7h@Hz9DTDtMb;WM(ap)o#rR2#;=*!rA!*H83-MBm7AHc&q-)+_eUjI za@0^sN)u@sS;2QA^-*t`qSsaz^kk#G*i33eM>^b=&VC(OKKX9pWWb)jS;m%)c@5ks zNnJy43;#(qznw#X&@jLtf7yNHe9K-fdCBY~rR2wztxKCF7Uh+8f5WM(sz60&;OAIYDm)d=t4*9BG3h0d{yirteQYjbl&z>4ow}{Yas?JAa zL;JS|F(=?};jp$xO1_!#7X4W)3*o&;P8qG9F00n1FZ4#LMO4L6i6V54r0(ZIu!t?s z`~Y!ZqYAxzu(e*r_)!3^E{wLT&p%!nF0e|i=hnGGP%{P<19esz8i(R2AaT^M+n zFOqfcJTW*SW(D)tZOL6Wp8?Bu=!@m23C&OUClw~2%B}RM{VO6+ETDz$Ws&oBpA_nK zfIWV*Y;%?5geR^|`7q(`jcFIpOAQD4krxS4)4=~j--|@bU!h?6X&Sfxbp3j zP{*>#vE{r;W78O`hz4x;WCE*%wJ?dNX+GL=B4=y&;2nvj~6{~UK$(Q_v)x0w+ z`>27KCb?l?_cc4$b|KD{iD(wsU-O5yY#4>3f2f&;x-2g<-!iM6g?q1D+GGS}vA*h( zhgC^Ae9n1h_$lA^?(wI<>}TFjXn7a7p8^(x`yiaeFx$uUn5{3t9AbukhGCePu77!P z4-#3OROkjNJ==z=2i4r9*WJ2F_YHEoK)DKwK&=>;Z%Bf}Xx%NpYy;hznuzXr`E-`z z4b>H!nUT9umfyc4TCvaE|ETceXSj0op+(@G46^jEW$7-a_2wRpPha^1_*McJwe**W zANnY*Uxv>hHuB9DR@^Y-MZf%yih;OIUt_V-Q^m`#N%+0Pke5~Rfy^o4xP;*2!fzh9 zRrx&M@sS5i7Tfs&@r^vqEYIt(Yr5$2vEA_UWP>3g(5Efp8NvWFN7tUo_dHC`-(wx}S^ME<0u;r z3I{NsEKVZZLRxInU=oxt(N=jhoau1^{{P=FKiulB@$Rx~;qY;8I5hS;S7bRIb8*ROg zU30j$_PdJU-OR6gn(61{p5pX8A$?p99fppXEoNu8HP>=Mt8Fu`gBDCouIRn<#ufML zI_s}YT?=k;e!e-X+L!g?FEq6+czbh_gzD{9efsyV7X~q%=1Hc9IEA8lB)H=zafte1 zCUkO^q2dc)KF9o5@*>X^^}Wq8d9vxqNBR zXT$^t@jCyxV<=mYLbr)C4x5mt;#8sXgegX|LW_x^=flS@;Ltdw>s7|kYm*O0U}WHa zi48%ZsZCFU=c2na`pqE0!YwCm$|JpDM;1nvqBU{lmirNT*G&KK>9w#dU)qAvvWihB zvmOzTJ2!sJf-1DfZh_~7YsX5}BlPXBHVAJ!@b<4?2<5qXU2HN=FZaJF3+ zx4uqTkA>Ya=P$NuMZ{r#M$JBe>t9i5^>NpDK2q05 zzv&^zA zRW#v#ITG4MKO!Z~4VLeZyg))TqqV=&`LJ|?8Iqudqci_z5LJFw)H^j1)RG61A{{$R zeh8qoC`+_xs6G<9_m|L z4$T@CjJZxyPWi{mu8f@;Y<@t?&GtS!nDc|Qi5DvnhGrdWZe{Cc>r z&>({&5S@_psa@yoA%)4~5-D2}pUF?bhLa>@cwe4qf7ku1w*wVd{j5Y|#v+oy;}xE8SB4rd0*4mzm+FL=aeayTHqABo`%JQQ$=kadA^$`(NNJerg_sXz;p;tEb<$PJ5>xE>6c6&P6zjb-! zq;@j(CLF|dA?E76h2RBRz)Yxsjz|+pbS1lulUKB1cL#>z5UZU0zb0dd)A{0+?&f(_ zrb8#AKqr>E<%$wfTiKun3$=X5Y>Fm}Y+^RlCoW7I@>Rux^j5kp=`*AWGRh{Fq>{(9 zzC&>rpE5hkXs>DccBJ^Fx2R#DowzOv%bBA@m%?al7z2JbJ}Nc0 z_bjb%=;`UNbITS40|MQ*!*U)M@P|EYS}K2Y6PF1cClYR1O88*S*(R-`6g22vq97k1 z*=`e40-RYEPvxZta6XzCZ4elQ9n$^7!aq6X-C7eAKG-~wXzOhB>Y_~$u5xi`qSeJT zS0>U9!@&DevSg9fXflJ-G1$)Q2~QBau-VYJy0+V2?6yb5{RI)D<4YSakyF-DR=a}t zcTuC{21^SI)I!2&X+VZZsQXAZ*DeuVc>-aH*Ffe66~2^4$zRmY8vtGz9QApBJYI9o zJi2}9Ue=qilc5yj6L>=phL&mMFkOVq+V8F~v$$-MCDGPvvZXa9;f76!U4Y?43M!z<%TzZ+LEp6ULuHqljFGO^juK2mrjv5#Nu z)gpUxTDuHl3Xl#zu`}n!Tw|+H)q4;mmnfV*>j_Up5^Q|pV_FG9`+NN)MRgITo+bt~ zJJqJ(hoc3H6CWXUv>WdQexl>tKA@z!fm`(Lhm)eanaqsdfZ3f*dly9#u<(O#%G2@P zb?Y*a*g@r#LOfgOihussPN-=(OEGu*QNobE$hsll@ehM4Az^RC!XQVwt*S<;53rYFOfQwxu5%(_7Qu6TaxGg~<*FXLNF9E(tV#GP)ycm1k= z>dCANH;X5S<@f<5W_p;K$(TsG&WMtJnaRj@fmX+bFbJLv^(p(F#V%_DKx_7zATlka zdr6rd?ijBR6oI&Lv!E3!V5pQ?`y) zf9ZcXZV!e*v#W<&k>%A24h>#5Y3I2y^e_Cwx~s*ddnn&9+$tRXU4eU;CzBeJdsv|_ zdq?xxIXusYU%ohCD)eE^20{9zMy);28hc5!ptViYY{*cWxk_ZN)cw{b0|_%Chn^td8gp2ue$-} z@>ojk{~GybHs)%Ug({z8sjOhms6~!$IN((_*!PVG4(KxyuBPL26ygvajP*U2RO-BV z@p*+5=MM(vaq<$S4DEFA{%F{sC>7?Pv5+jYaRvpJBuu`n93cCnG3p_LldGopXCm-~ zpnc{uHq7|g(bW9gcx5GE1n(1Vcyxvc(>wn291JVBx70xgi%Hkp6cfd44;6ONB> z4|!rOLspw!suFw9$cxKHApBN|AHQA>lZMu-R>Z$LTj-WsXno5S{~r z^2NOh+2+R4kp_Jh5t4ToMl{l3mF38KDoMAn^D}`t`TS1y$yotVW-HLPI33bMOaGTR2hNx#JjDZknM)?uPcS3;T@u&NdcSn}oJ0i`2F@avF`c76dd( zozi?xYrobn#^Wvo^FwL4w&7==zZ()1t!eK{d_5TZ$opo2rZnFggs*|0jXpt&dF`ec zGPcR;W57sDOOD`Y7w`aEqpVmK@j=o8MmuBdk@=U1{DyEO<6EXu`Fa)szv{5Fi91zC z0JT*6=;X*)a%#Bdclx7SI$B#(i`9x@KLsy4JIO!J4lyL{Rk@^9tt|q@Rm=}6^`2Av zRR?_U)d`n7E-xZ5t|tcll{*ZkkClp{tCO)H@qkEDM&U>?NkpT4*|5j+C+l+?5}}>MvmCAjZyhDHb1eS0 zeDli`Y`@U1spmMjtb?l}xZW?(z{mAtNy<{fO2qD;p zoV78O>xeJKp?afCp`+*+>4%@T7Q9X-%TTGWxVDx!h?Qrmc+go^mP2XaJ#PqYFdFOu z({t^Y%y*3MYwur>ZG034??2)5oO+h3rmgBkK(>hyXRe;h!z1L(f5i7^&K{eW$Ck0V zwNENwMkX`N3qMjqj|&|^93KaTbceV#K!MdG%Pu8Brs6Dupedg<`{Q>zUxE!FUr5s~ zk=9XAyK!oG;?yBVqYyrWCs2~XUistAF_OwX?3hv#RW=7qma>A_ND2)ue=3m`zdr_1 z__TNt3mNXiPJ0KbVsGu^l*yOM51lp)6>ap&8oA_LN4)Ukvx?4m?wRB;1QLE%hEW@0 zq4fcsC0vdLSbQnRIE&nx+(nmU2x>_M=`UH#o-bLsQZ9leb0Y~C!mD}iT!qIwt%@#4dTT01e zA6ay;7}|2hY8UX7ABxxiZpEL4&WN_Z^krCUmR^M;NlqKkE}0n3sp`Sff06k3y@`66 zv1N%kBdUBJh% z1aw)^vq!M$8{tw-NiebYR{TzW>mb(wv5?9Vsh1h-!JnMufo8^)PZ0%OKYqEULA;qI-Pmg2F z1*%2gH_p}_|D4sCbtg@vqqQP5W5heRq|FuyWMiDIj5dUeOO}<&XiT%$$!MGjT0qOk zyi{f77V`AgH~3fAONzz54{Mc%H)%vG$*g^-Tu_m+r*|MV`cjgzUqodZy+HFu#s`;| ziA7qq5TTswib7s-Rq42}8#lM{X|+>9NY*t(KqbFrs~slzBEv^Y^?>)b1Jn3n|JKRB zs7)aSCUho%-IbN0^e)lefB26W=W;*%xBib89Y@e2^3LoSYbq!7GeTF1GRHpGA1B3m z%EOs|S_W9r3_5VV*uLrQoqcRU8F(o;J#0!@{qh)Ss49K?bfm5@?q=J^d+qAdWDW4w z;^P3QNvRqk?l=T4ElqA4i{By91S=mu7ee>QL23n}F&MaVw+g~WXSJ?&8xxW}ySh-y z`>cF@_|=B4+Ab^%U&sNkAago5fC@K=d@)bXO6a@ZAT}Wl*+L{|HQL+2%$-63745TM z9!{qY#nBg69>N_B(c>t+=#63N%O(44XtW>7l^$vTee&sSaj!3k6wc>fzrDiO3^GVM zNG#w6I!|VF@}LsAS1ZvfMwhkdV(c5O3#*5adi~2HDk-14_!8ZU-|NpW^KD8`As!oT<^1F4@|LcJ z(1ivx4=Opz4f@WrnfjJ4pCRnl#0a1TAy`oon`yuk>Eva+}iii zA9e4k&I!R6m_4A0_7_u*pjYOM$9W@mp*bnBlW}L?TN8{<8Sf4;{b_8Q)MEkYr0^H` z{lm5mDd`z@T8Lf@-OMVazo)SOUT%1uZ^`gTBZ{~ENjj@%rYI^Ergj?;WGPI8LrQO= zr=l#z3I0Z~*w2jK-8$8q{%N?3kldQ!vPt43KT%M-)Gmf)7XG{5F+S$XUH#%=r7giP zB|RccRHp0eRnTYQN=jXawWCN@O*1RtYIeNVE`s(zM$BK(1L}W> z_2{tuSo-EyS9rK|k;EbLH-1(onuxZ8ZOpNvg}ipsY1f_TYxE?B#mCHhH0xrT`ka7V zVrZ zaywsavTkJ#bjPD$V92U3aJq$V1F0P5#P&Dt;7)+S^x}GPi8`d9bb1ON5%%u>i?elO zv$}D2Q5So0ZJMjUL9S|Zx#2-f)d`}{odZ%=G?oE z>V**!-pStHtRN<@y7?i!XIu0w3MRM9_gQ5BwVZ^!^=?+Rg7p78NaWf7_Tm3x{QrjD z`(6mXwFw0B_;Q+*020x7`tKkJ0chc%o-B~)|7i+YEm;5A;qxjh`jp1S#Z|z^#dUK7 zxQE@C7Ua4a$Re0J11Z~CT~c!XkqM-n=&`l7K6n6~A#nMJ&BR!n@P7+B3V`1c=FAQ;4Z7Q0mH?@)GrZa%>j)U1&_P9}x9g1orPy zxtR><#eLH5-^vY)R;dR=s86w*vj(C3p`)c4}C1myRovCa@czNd?DN!82h6Y^RH z{s;x_MR+pq??rkF?60RTc=|X4!hSO8---+91$!sWq5{dEKJ^3kKeI#8@vgZ-dJ%mY z9y6$WzdSNtPliAd86TG^ds!dbD0>+m*ORvJp}THEJE=H!iT3_7W&=#QAplYz^ny); zpn#E3!1oZB0cc+cPrMO8B2d8p`qzu{B;8+60qq^;e}J8drUb8nV=k!g9D8jDpnm{p z1L3Do-BV~gF6aeq;|K9T|7#G#^;^h)eSCjNB>&VU@fYuv3JM59y4JXI7-K_yuTL_? zf889bN6j}A_{I9@uMQ~#7lgjHg2}m`*dFOk2d>#3fqPt+`>$?${s=idbeJ4*e#eG%%4-W^5_l}wZ2?4FwIA1!WzUM`n6yKO$Et~Os zTfI~CvONmrFK*Ai@*aYAFOT2*O!^@tcmEOIl??)@sS*SaA=@+VhhXm6z(WxBO2NIs zP^W{UUK_z|zFhyiP|&q}suaBpKA2BV{nUHj2oU1E2Ly=D9+$TO#2ngDi2NQjhP0tE z)cdh_)T+OCFNX)f@)+J`+r#p>1t^+auLEa5x>+$Z;2{|3hu^_BgqJ-1z2tW;$nV}l z9VCCT1HzuY;d@^;v$t?wSyWGM0a&k_6}^YvL;j;47dWp>iR4%TpPtP7my_7gfD?PY z;H`w?Rs2`fZTJXQX_u4|O8DIG$5g>m5UAO9SP=7rYG*Sw3pbnK)dPmDQf38P<$DxD9*qL%i zz+bG_a;Wv4b57CCUgCJgu%(}hjGC+S#f}Fpzfg#?Hxvw z92JN)`J~(rh~zS z`48czKf9q@>)yQlC8(QyKzo-ad=G{itM&TAWD z>Q|~DrgWx$#l>FAM>I8PJObPi*OmKY01M}LoA_`3EYA;yx8%t0x2Cpl-ItiBm;NCB z*SC;aVC#W#KU?id06+C(mdmK0*p=^I2K-jcwh_*2%zrrEYLHg&!(5>5)g z0tn|_gyJ!nhxEM>3_%xhH0O3+r{b0%UmQgbwKeqnunm1^(;l zFaQOU+H3az8m3p4P73kgKd-p-4kvgtG7t-rjpQv*dMD$c{lhkIvw|3 z-h*ybrJ?D!oB6I7vLy-ByxJ0b7rO$voKyq$UPqOB)vuuZ!1xH@c;oBug?ai5z&>ZY zw(4(#W>r_@YXo>SX^Y?$We@2+^F}x4S@UX^>y4=&KnhI&z`gMb8}=(q`nm`?`1P%# z*Ys+=0wi@MQ~@%$+AnW;uLFZ(_xBpXFY1sEu(vuS9*k+-qXozSvju+c8O8j5j{(iT z_u~pExm=(%zuWZ}NWaCfJZB)xszV~ck?N3iuxa>zSKa14?51Ao4Gx5@GHVX?5MZIm z6tySrS@)eLH{T&-v;x#A4XFdq{&>%S*$FIs7wzAQewH=3?MyCyZw2c%bQxp6VyZ)` zz&5j@If;R2oH@*)9BZ9Fs7*K&3cHbI8gQq2g-Ax5VCFLPp1IL}}La|6>_mC?ZJcTE8De29*HF7?cK}Ffvyn zfOu%m*-%0y0A?=(0pbn?1cXCLYnBR%woKK_@@SZ}h4)H){SpE(+~Xq0ze9ntbuYma zupbZ`pmU}A1mJ)mKqUU7K~^YNpF&U%IpDY6DBp}tv0vGMYBx+FAinGB5J1FhHW+e| zeXxuG2!=)p?X_VD`6EjJTQUUW-h~zfIDp8)_eP#~?t#Ldn4gdu0CZ0UW};}obJ6?R z()WU|ztUbMR|=9|2mj}Z*L-lB%U6Nd3NQp?lpuL);F|8K^CyJviEZ1P<;jUzHyOeR z><#e-eH@k5fB?YWj8F9zAhBx*TCeQ*r5WVVB6mx+$MpIE{HSsbiQ38l`-9+K0Lc)# zC5sSK8K5*&b?VW8Xj{8Z{h()Ry>|qN6_mL_Y}Z*xxgad4sse(cB3SUG&P*TT^4k12 z@|)BZgzT;}1cdOPvTk$T2ADBCE>wWjuaKXt`epx9nytVx3`j>T!JP~0`$wp!fd8pA z=mXUK5Zdc3!0szS(k0$2U(zLXH@@q^kW10N0Q`W1*@ggA;0+r)0Krt|jVZ)b;_Va~ zr7T1kCs4=q6% z^u+u}rvT^)yJDWXK>bghYM=rzk{YA|>>~SC2VVYGYl`}Ay$F>P^Tl4eM}fs&S|5Qq zs4ziUO&BWxaB}$qe;9}k(z#l%T)IRB!rrwZ0OFoA;0t8mszWZt-*Q5FQSUC1fqeak z*sq#upi9s}z~?&~gx=oo`)XH)fwj;`tS^3tjx37awfjMcQ2hgbfHru?ScIzd9ZPNR zLvNIiIwT03p$5{ws+WC((sYd5yU`WLiRq_Tx)UfvUKYPQ_1FJ+59}AJ=(Ra;8+j;x zhv_Gme4`El@Q0pKgn-DPq6qwWSC9NowFn&tNiRarilkyD!tiLfxOD?N10wxT{bQbG z;UV&iP?-*`AMn-c2NC|4@Rv+(WZGAk5^vDB_CcI12iurbY(BsP61Jzh5^spmZF<21 zC*=6A_$LMUuczuD-H6_MjYp`WLwHBL#IK-3NXe_0F&C6~)5NV$ult6NfB#D>OnA^K zV8s1hJ{LrEa*6Y5w}%7|RXx3{dg&hKM}RcY;0hESV0h(C4GjjeYsHY++n+$J*QP{M zoYxj8>-0oH38!8bN;OSmm*WBdF*yY9DWAX%Nctq&4O`&+deJN; z)jrP>P{KNCc6@MGcMOr}brr57dKTk)=LKLJx>Pu=`7cAzWiRPwxE28;$a(EIRK@wi z^@W~O<~s8h(-KnxBw?;S1`l8`9G^1I;iI}EeHhprz}M>v2X|b*GDW&;Fn29&Fe7v~ggEaWbr!zPdo zP|Y;6Ak4Ivp{&YgL97dL(%c3I;1&!e`gtZn)X^x%KF7c*_+%-pj|G{S=h(Q-m-5xK z^LkHZbihQ|-5T0I%Qs@9>tD$%VcKWL1_Zem^uS4+foJoaVc6d2*#oh2>=HDLA=B5S zq8jNJ;}MX~3TN-~w<8fv_m9rc^t4|NiD$SbRoqChYu=OB_$kLo2aq{-^Ed8=Dl`0( zRp6L$b1H=J1wp~=QwJd%I3d%ZoA6%{&G+_F@PVm`~!^57-a(hh)%3W&geNuaVGrPI9xOS zR-2$@J}K;Ujw*jKR34p zK>zFZb7+L?Grp*V)7Kj5ZhOTZ+4k1h*%I?wsNlN7`bSRAUB}^2(`R~f(b7?$NW^sZ z)$=9jY^b&7wLk>WA!;qLodh!0cv2%@Gvot>o3jSe zwrQ4Rx{G>>GR4(&D&Nl&0_p|*D{&Xl?%T3^=4Ti6zb^WDw~9$p-&|mCJjICw`LJ1) zhpV^QutmTCXNfYx@msv*R2LeNoN}Pr-CQ z9~cdB&l*}H`Ng3*1Anh^MZh6@0)U~xYU{A2z--AYfB)V2vec zpyRO0mi?dKtH9ZR8g0>zGPdl6D2fBBfYwtSdRbXPKtG}*X3Zv{f)P6ZKwu6U#o zYo-{7&gQx|V;cDv)>1ub;Mm|xDyFM#dH7V<>v%QwDG)8dE!U{lKtHCx5p{Q|iUw>)h5D)i6sGh@9LQbW7vrEr-K1RcW=ysL z_=hl6IgP${0`$ty4%6NeX6bmMpR&RTK&vb_+luuM-x1r|-h6(43lNaDcLrKYpqS$H z>ptMGme8vUby5ees~urqzfGs*rC?|=4kkG2o0Hvd9JsMaX$o16PPv{8Wn}CWWpdy3 zhr#ZTdpI+YAjclnuAzq|qEqHz_wf(=-vtr?{4oX>RgHk*`yV85gZBR$(m%x|T6_+w z(!T+(N^E)V)v+SjR=Fn@&UFzKP4_QQlYoIk1Qx*NYHsEGDL-?4sn?x=3g?Nj?DZsO z=aa3EzVhVKPv84<*R=2Me6VBfD|2`4{Wo=Cba&tv-@HEm;!nqBd>633ZtBOkKT7{( z`n1(krd>Gw)oW{3&0HJwX6;YkY>XF}T$Y>eW*t?hjFpY8ko4WWzREUH^aq`uK+}A9-Iu@(A(C3N#x2E7_Y@t}YQr%S9sZU|-Xl!z0(Uj+OFY_yp`BUBF ztw}6ZN|)4N$j~go&J=u)T`V|=?H(%>3nQy&?X8mM@<2}A;rXhjt!T9PRHlAU65J1x zrfIw@FPMp)I_P=nx2J#COma=w3d!Z7t*lUT5z84ax)p(4Il=T{u9BIZC1&Z^!o)g{ z<20qmgCv9wql)PPR;KRF(s2pbxOzg<)b)+qly!KEXYATCSS$lyY%jjpQhc!;_+n4- z#qQ#ZfxaHQ!)*3AW*njQI3g&09wa4n6jkgFurYN9OPvxfpZ5+s3jW;K{;=|OlREM- zvUe<3)~nR12G2fs>y)2sYZ|D&q$jz%Fj^H$Rr5;E%69YhJ#Ha0o~GiQ&eTVko;b+{ zPr5=iSk?eGmLZw4dqhMhG=+e7)`Zn=C? zzFAVE_oOPkQ5L(Db~;htJ+#n1b3Cav+$B4xyTYa{Ahi!#Cik^*W)@RM1WMBAfak4t zRvN=cCr~rp9`puwh2A+B^g=#~wy$SwD!p~JX6;#3Z$w4SgQtAo0rHWDWPDc^HNLM_&kuTR$k2wD2`Yv9IL5tWW+P zdkxvtY?{tXaV$WZ<^J5R5o~l`61P33E71^nD+_yOS%!RAXNuz$Zq&45sl(6q9e1AS zBPk0HXne3V&mUtiAs0?ieOXU<9a#OaMwPh@B`YRgI#0r$bwwJy_|w_Sx6P*Zgon@F z%A1EhV?X(@>N=Z_YxBlE?aL+#JFqWCovFMv9!g@tAK0m^y>X$kn1O*So+4$4(zAO4 ziF|_UNE^m=HuWjD?aq8xkhRm`IZZW$4DD%l78QST$uqHt@&xrPfMujzSW$0Uxu{ZW zh>OdKP>d$*$gzKQs^Gjk%yg}f#JW|AJ)Tw2uSyB9(Ss%VTQq}Mv)r3RuG2=+F;X_F z|GMR_WM7-$GCfe4POe~mVjGYh?Vw~Z!ezHBF_LkQon(0hY11BZw>O=NG_>C8#&#Lg z?b|IYT^sn7nv{VGT2;VLW8;FFz2^-h{R3H=$#h5KU5fpC&LN#JXDF5T5A}Q|_V*uR zs$N~q>bTJ_mg=v)t+|g~r~8QNs3D~8JnZY?+v>)ZcfFA+d7!AP8?!0zjU08iu{l_b zajAW&Wrpjr?$CK5Ym35%neNcPxHYnTEw)%UOfRNwV|bI?*T;O>TNqxVe&}x=@r<1q z;Ab5%aeGWDj^^Qdl}}fbev{St=^LI8iWJiZPABVA`QGkCtJLsg%yV-bmQ+Pk#b`(P zDqET&h_yghPTI=&cJ|$|5^*H*jb*X@a=w-BrF_#d4SBI}oFAruZ=}Zd8U5`0EmIK^ z-%lZv`=c8@M#*bZfKBjTID4C761t9E zqWN@$=wW9PY%|F&AZVDo_r5#5{BwF`?d2HAQ1U_m+E zhhq)6wgmZW_FmfyFM+ByiKY_P6tas=2}v@QdYFsZDWm)l#YOs0joM_!pJU6BiW5{X zWns&S07cR6ezs?S^Zwt4`LP4dO4E=1$He`)=dS1E*XG#VNzal_qAjLP_A+XrxP*qR znJA2!SX@hCVDVNp>)H!>pwgP%_O@XzKU(q6V4FBtZhuG9hPFbgai#k;H$=f4xg2}H?gmGX#U2R zFM0=R$YOZ&K`gwvHw@PNQ3z|UL==`$Sl}#I21`wLGtXzvvI{L38+LRH|M3|A@hASn zxA2f+?q9V?u;Pq3vjAWGL;OcB{-eCJ)_S!=I;IK7u zrV_*4rcJ(rTKY=4hd&ixYEuW=<2VVzn}sj_0lxV6_~JM5#k~s;iKoHN_V7Gom*}v{ z)@WE|&%vbrqDt7;zu~aT&l{dIS^vx)mry^S0;>#t27CB;oo8%L(nSyd%VN%K&56gT zcnDuA7-PAm{2=#Hxi@DbX~N~rxp3L}5)#Mnd>r)eap%1bae%>xabFXUWe=s=1Nq*J zou5DteNMI`RDON%c1O;9&JkL5q@kPkM?pt~WdS{&+m5EA5rQ8r#YJ*Ps%KzYiKhYa zRa_UmEm9@cQ1z|1)38&PP~<8-K)IEDgmt<`pMNU>qr!Fc(Bkh(fuud>bZW8VLyBf? zepP^8ZJgEYY+W$Lp4x@i&tH69p-?~1(S0PZXjIbf5KQ{h=)|hRAa}E6I&U+(R8yI# z4}l7*g-cY~Z1uEiGq+#03O(D&C0v@QJ-MqA`!{<$X`X$3$`AXoZ!Oc|KfY=W^{cFf zZ(*g?wx=W3E0$UI@4Au=UdBqSznZ1axqSn>X`#FF_*2}i@=y-T?Ad0>>K?%+jGOJ7 zEX!O6Z=y^YrERAf3Ga{;q>OwxG>D0wGd`FpXn*Zm41KOf&8mzv#JC0u`(AVP#5~V` zT`y~thNCG1Wy;xHwXV`>vyFGQe$=n`IWe5w*@0#DR+dSh3*MW_uxhOZBa=LhjLdf{ z5>Hz#o9!Qu$F7NS8#QeRHc6(tYU@>FF_AXQCVTzPB1W*{lx4kLwxj7a*Qn;O3tP|J z!_n_FmU`OxmLm+CpXA1k*^ZikBJVsu$2C1>il#D@6{K- z#4%mg(!46}1)1tT0qggWV0{*>pSk(SpIkl>+7g9q%puKmG#i3yse6WwR@4}(9R&(Z z{*Y#Oaz0ju+s3W?mHH)$2ZCtF52t7y(gnKL>0dn`Z`)rKO6yR5Dsh%;vKp+5E&FDh zncjIN0^O`YrIT00o~bxh@DC=<8Oghb39WJqW~-u+@1X;YYM@ldk+Yh{MpNOXXNc%^ zvH8@mV@ZGT6v;C+wvB@h@?Rc%H};HaB{vB!eHXrgbylOjrcPyZ8pJQTa%}}dS^eRZ z4o;pXQc($!G-_>+G%HGo0#H+t{K?*4Z+eWLcovyXmj8ej2xAbLOBrazT`sDD+9=kU@n?&Fp- zLeJ0x!(+ErW4Sk>y|HKL;RXipEziiue_;PCo{%+eR!`JA&D;ZrJQHD}QKjRV2?}uC+{>wzY+Zpp#wC#RXE_1164}2k0v@K0t+Bp+` zj$xvHzPD%K8WpKL@!=TFLS}4%L~AIN6f4$gw8TQZ ztEJ>b9^x6kE59YfqdyETox_dTX`#&@2v2DSEg zlOqPR^(kWbo=tz&{8;FWIfDN4pz~Izq4I&&wox6~3W>zG`<(p}#X-zut#_uSGxYL=7Hs>f1P^OANi%xU_4Nk#Tf34vqaC@w7Mw`59I9b<-;(UUYWiz~ z`;%Qsn#C4V)X3LME!*MsQj2Nk2w!}Psd+~;cAVaCq`hj1j2huzIHmmk9nH~WuJykb zus<21Eqk!UbXcdW7UsYBmmefJF5jR_pQwrY-{X)Lt-tr*gOxu~v-7+ygNZy+3>W7# zrD=R?b4uzsH-kCgMRgTYsB1TpYP!0a|@Z*>#Jv zZ%DSx5^>zMZZ>-Sl=9bGtk*1+$6Pk(aIQvn?HQ8_4XN?>JV${=ZCfFPhED zceEa-Bg1pMbi0NO4>?y{hh~$^&91f$ZuYLE?hT4hu9}KAxEZ^W%=lSE+ix-7yJ`xZ z%~Zdm2{`U5{k4Gc!4T!O2V*;Dd%pcnJbgB2@q@7`_-2!jyK3Rx4~HmA9^_p)CE0V; zH277cEQ3rwSLcdYe)nOukjvbxjphvttn@w4+b8DYPuq@@dB$+-w&P;yF|s`)zupvI zYuY0-n+wFt9+>vjnxf&ct4O@K;KS&o8^^3)?|x3-3y-Us8yhrv8%W575&qrB{DH^C z<^oZHII-a44J7)iY)9m)B>FdWU*!?#~2S>@go_eVf(Yd(C;SJhfNJ{in4 ztl;nd=~?rQD^^LaD2cc@%@%(ZueTgNstF4O6YXurW#Q?HrtX*ngNei-km zI3;w7)7{JsWJZePx3g@HT4qkF2mpQc5@td{fr1Q+D~%B=%O zI5e(G+O-NR>>pP?wI;*nB(M)zt5v9hXHWYzrYjHjGZ&|6@JHGAUp$~FPRM;pw-d01 zzy?oP{1FyEL|m1x&$(5Um)n0bK;Lv5TAG$XwjwFaw@yGWz5RYmFp zx>B%O<8=ET%S_iA5Qm!v{%N_r3JWkQ_{%j$FMEt-GEz+U_Pj|h1$y0{$=N(Y(!C=t zCY>_rX~>_>e3!TDiPsJkcx18iWtoaolc?u*XJJ?5KAty5oic4?mk;)fWwLy>s2#29 z1g9p*UiYbaj2v&bjJiW?-DB9lJCbM})Z5)y>rlEq0(Ad+_^*bFnjgc^6vra@LYuPG zmqA#*kWcl4{7gbsuXqZntj+o+$vHc}5tg$8L?Eq2a{#JT42rwSzWFf>(MZmw14oELgnK=JZG zr@h54m#x|YpLO*>ndT4O?EPw6h9ZPA*Ou5es%Tmk$V_v*+E;{rGR=K|U6C7(H*;B# zuNcaTlgFUJyM)z_3dkn!?*IJ|Z<1v*e5` zzmL5{UqDj%9Mr9eRrZl+w|%gyavzGI2yC`&qk`2oS_4)MKZabHuW!5^BjLBr<92Wl zi9(p^?5rUx-?EafCr1waF~05ZcZ4wo?DBx2rM#?(%NnPxifPuRIpip7XRb&5&p+;@ z%fCz%9^^bX-$w5#rPz9p__vy7MZ9FPqTUL|v^`n&!3Yvif5 zX5PrSKdmbbJ4SzT9IlQ*j0P6PRQ|W6H+Qop27+CkvkT0mb%s%M&M$^h=jF-+wj|S@ z7u`1w*xFS5=0ZtBU_Pp83C%|{+k!c-tu^d*fNt%@`xOyH2Pku7Ys zkm5O@+gNZ}w@^N=^qDxZP?1fcc0K{_8mwHnhpE8`@)MfamuEoy1IIL;CEt zCs`J_mh$5UzDzVIZ#~3jt^LuBtu?ymvY8xm8SAvrVC$~MOvc<7>k71$b6iSLE2E}= zUO_GZ!6R8-M&A3uG~J$$HR;-}TvMk8&)Nkaj^5Nu@oRtjFK z)^N|irU5>=TzOTz+;!p7ix5U;XJv^JzF`1@|jIr6HQG(Ui(CA*P%~H?C;(8)V;ZrmlHrYqvdIuf5 zix;jC6$E2GRkWGx3TjVUIp>nuM;1MBgmM8|?C&J)e~2y0PI7bP;#9^YO-oUkD4pdi zPGbaXT8qjg7sPWA)v1<&ju42%U~gq9O*+CNvky4~nVCtu?P)RA0aJZ@%J80cb7i7I z)G|@RxzzczLy|hs^xFvSW>K+n7D=sxYE8*Kc^!P{YL-g&NA8FEqg9#?W$s9*XA`@` zvq+{2h^-qTBb)g#?yNQ1M0-J(Q}D|~swQEQZj0k3yC_33iMg6xqBA}Uw(sf6G~{%j#f};ms#js(pQQ-K#*JOhFj7ate!&sl zH^|Relq)`w*)F^Lr0~r!mYQ>D%*VATY5!f!8#!^7q8H8QERzRIOpgNWH@Xr-xvI!! zhnJgTY^`vjw(%U;NK+Llnp}(y!V*)BgB4UmHf+vQH?qlJae*Gd8BKUP8=)GHVr@ga zn>k78_S`P5UV1wQJ5sO%J7?KvUwTl=_vS zySgIvK_F%>6fD3ht7RRXw@0vqp8I9s?)yo=_?D%KxPCHC@3}`p=0)+Vu04E+y}Yh- zbG!29w!A?3qZc89MrhKJsx+#|n-e9vE8?m0MkHGC>#VH<>PKXyH?+tpsNs_bb9pG31DBdEP+thrwOjogP5a_2Q0-IaVS^ z9{oAbRRn7cjw5e(9?(sap+k?t>=bMBYPA|GhwW18blT6Nfmt3L^GCk8`|x#o9k`s4 zt-vKWI=qntIIFetU=dt#<^--PxvNMZqs+F&08NmYrdNnE8Q#h*zmh)oGC2gq-|F{JLu|1f0?j8v`FPA?}K`Og2lV(pEb&pN&g~yzKAs0~s4N3En!k zV?I(w52suNK>5KEuU>+E2JM%{U8XQvNB%ZeG~{Nm>lHYb{+|0sSQ&~S$vkczye`*l z9cXIM3gfO9l~KMCPnKU7zbb$7Vv3*+oT^{CsQR-yQ_~ zDIkGULV_l5PMy@Bxy7;4708beTrc<=yHRa!r=4_WjE(PxWap+c0%^C^*rwsnJNAN) zE4vkeW%X2+pcj#u?#uMD^kT;57L9P^7FebUT&~xoQUXc4LfX$DG=;`VaXz-uGj#qP|2Z}Wr zBD3hLrfNLhJy}UR?T@;W0XTMHO+A%IDD}u6@O?hn)(;G|)fyG+bflhAFZHF!kZ5t9 zGtl!c0L>g@3^vj)P;tM^H{>@@?07h$8_q4olB-CnMsQMf^;CaJEfVWK4TnnFFD}+( zGJH@S9BNLYrakd@)2p}#t2hCCgXLkcm&m=K{`+w*4RY1WgU&!wT_^MRk(4S@6uCqu z69*zUQ(LajBnzR6PX!dmuZ3B|x1TMq*2J*O0HLB4^_J=Cy;xH3eP{wA_pxON(|X8I zINzKlRR-vV(DB!C9N!vJ?H_@BNKTNvO828QibGw8j5jJwhMan7pzAx5N}uZRu*fvGWPPwZjN=D!MuR; zn%tXPFZBnu)neFej~w2kPTcsUU~e;bt;|y=o&*%2v_fd;E|LPH+J;A1ai(A^cB6_F zBQBRo#dMdyF{GkKU)qya%)Em1Vk?o)Ai(^trciTxEsQFZtysrb8dgKwHb|YhJOk+6 zE)1=sdgN(mSNF!Ofh8u2t1)k)!h3KB5#iuDJ* zZh>x@JOoWoax?iw*9H%@Ev5USSxHmiG$n_L)RA@6Am&C#l_8p!m9zpHRydw3Gg;As zd-cE?sf`e!%}HVQg zT_htp$*p30YAs&8jpPyy&~U|ZOR9Phv-MP#nH!KUEYuZY9nw4FC5iGt&zhv&yseHe z3`^}cpx>fQ#U5Ua`{-FzKUi(s_XnW$^wS?v44Da(W%OVu6S=%iL?-_|e7l{pg%N`O z4Lo%%QJH4|`sfTJ)4UMTm1LRkoSLFzTNtiqCp6v~34RaRep%71JmyCz>r~2vEIesu~w+nz0=4U7Xqy?V=NS9X0X0nA)N9MWa7_%z!^_`8KP4(Iv1Q%ze zvZ4gnEK?w*bD=(VcTs_fYcg3gfOecS_}O<4$E$Sd3J^VvRDkD1f`~&d`EU&DvbkY4 zZiOQm5_-H#7%FNv!=x4j3Qy>Op2`YRCa!thU*VdE01aj>fW}4wG@yA@BDs!$;&C0e z+SP33R>u*;EIZm8QLL*)da&g#AL|?gZ2?{vIhVw-pc?t=qu7apF3emdi(;43fIl+y zbKn@b>Ke~#XQ1v4zU~pA1_YSk;9;T;Z3Zh=apV7znR1m#=5HaHt1NTXU?KLVl}hT7 zerz7H3X+*`Tvg%xslD%_c#>-wff*3gVDufwSB4-6>LwLuD`OvT1_afDIS5RK(KJ7I zwFR$%gT435Xp#p+GEcMGe|kRNLIk+8o*JrKz8ORp}D?y=vs?6HCKNXU>mPqCRNamVqoOdv<0O8wiTvB1u zYwDzvB#p>D>@~>X2JD1osX7K*F}z2WxqLf7RV)2%t6iwK)*42*qWfc-(3Lh==}Tq5|&&k^xf?ju02c^O1dE zX{lgrh6W7dVS=Q>yg<_dUtdaQyzB6Gy$V_e&)g+dpk-i`EOmHKhi0q7kEv_(_%l~0 zDL&K6whfRZ{{Z=HDd@mDt3~aS!yt^3lY;EAz^U{5869~5%gU{c01n80L3P2K*pF}D zv(6xYnQ2I@lZMmKOXkCg@?Wf(tN`(ui<+lVqn@)`a|Ua&qVxpQSGSg2%&Zefxn@no zwcr{)0sz|9JNRL!MkUE$c?p`Kb^197aZRH%Sh>bAQ~Pu-$TUBI>C8rHm@;FaTvbu?J;4l?G=L?N4kzM1NN~ylXP~539P0`Kaq|~!klP>)RX&D> zYkF~FAEU$6Aob#c)q)Pan8M&BW!v937CkfwhF?r^iveJ=iRwscaRj& z`*V0>WWJ=_vq>y$>Ua5YvUNTgCEQ00^q0eVV+Pu&>MkNGY$_6G-KNiv=ae%?UxX;W z0~oI$*od;Bv#C_;xwhf~mp7TQE@>w(MHB-K$QM({sVr~B-+NlFcX;No)JYYSsPZz|*6q&@b{T{&=dkhZ|p zA+)SlcVlX>xR@95+DgAHo`IaO>{GX5-wi)Af1&-+;-y{--o@wb%v8q5yja1hf-mv8 z*=TXG3AeUV8C>2JK`Eg9<*v+7nMw+mfvwf%70Ojh8>Jzn1?Gp>fPhc8mg!3g-om^l zUXCOiBPyhNT0PZAm*u!>;M>ujv@*(NB2gaDg(j948El{>9un>Lf}w zeBnw7)(Dt^ZevXov{@FbBM#`cLQ(!p*k)UCAA17VWn&$cB>6$1;QkKz{|$iC*9CnI zhQoFV_$-Dmr? zc8RE}VZdKfs&R@K09BQ=9RCn!vDG*k&rs}Y=F()`%aGk!L|t9gKn;dd1a+177KokH zE@>FRe>#gSCTI&|YtnRkc~>Stf+&@R4~l`-!RuH>;lw=SL`8rhr-2H`OIb|!SH1z5 zpGVLZ*%qKJES$FRRs#{wA&59PofYRkPeix1_kMAHwRz?!#b58 zF=hfqC^T-eF9DqQTtR-tV&zxF-Uy8#;xZuO%yk42AA!Q!Nf2>KBiS>+R=!2>77ri_ zU?cDrq!`SURaF{wH?+PMg2VxbsaR=zKyiNuqwS<>E;vP2A=)5bE5oDf%1Uf%&(BnR!1Gi5d}kpxQ4QnGW%>Pm z-pn`gL~hpB+`Q>0_}&5@)d3yt?_~R5U7ew<_RMXpV8M5mJ?a|=lt5bcR?(u^C9*5x zU{|=Yu|jL`vc7JZPH;k>-a%)pmXk36$W7kHic-8mB<}`DUX-9LyB@f=C>>Xk z;#AfY!GGN48E_Zsd`_Y~NYemCd^;XmAGx3y#Ep{>H>N(956UL^pfA);ux*ynLo}_9 z0L4Z}iD9mN>3(-HjnL@q15jwM<$*|(`zY_-VS2FfM+7n)g+}6d47^@g z)|oF3Bhuw*bRh!JPSuFxq$qF%>+->(+{`I37pE6g%zs=X;LH8+4h4~3>eh;cW7S2~nEZ78>02u$NYJwv}v_FVXi`G3jl zT5qhyv`}1tLUu$Ff(8&j7WteIG?$>nd6{spCyeoCQW$T`|E2GYE@$}2|I&9cLG$*2 z#{>!(JSJv3Zt)S+dkGkZNB5wdP=Y++t+3XFBa3-8Mz-x#wk-#xvs`i7adK^;bA6F(04(vm4@_9sz zoA69y87nKKhJ0Y4g0G1LE`&7j)DYkhz2AKyK?mX-{TX&*ssiX`ddpVf$+4B;>*;|V zM#C>P3n)TT^A;eX^=-?oZzWU!4K>TffTHMmwIp;&L-S9;nV-;sd~C#KgLCWfLL1w(CTT| zZXL+4(k8<62ov_oc!#KST-XmOjp4Qy|FDP&66pcCHP)4qUdt!09~KLCD0K z25E?Hek?95>dD-&`vu{J9FvB+A`Z)=Yt@l?(sAObE7VCeigx z21*Q5OyJlg>Qg~1j?CAArzfiKWcrU>!4*3FI+VKy)M4B;9Rx+vS;dMHmq@^rhBUxU=}0i8 zDfKufcD-ip(Rcn=?|>7t5^%t{sHN6ZC&94KH-??|FlYwQw&0ej;3!z8351!)0-gr+ z0Izp(5ZcIi&eH#SFs>|uN`T3p|D_g9CC~!wC3ir+?sd99`YsT)Gow&IX1ad>9t_tx zKr(2fsmQkkTGRk0QT};E0n1d2zZ`~_6MJNyPPkZ;`dzztz6>qAoalp>QwMMu`i}>P z;0s^F4G`BZxRzNNIGa%1f<g>8q%M22WP4gN|c zOn;|9%K-CM@jfri9bkQ3pE+Omx;zZDR5oZp=dUlI;%x>#v80;xKeLpPOyuu4SZ z6txg&4k$fs^ENQGHYM@x;vGV7`c)upZx|b~eO25Jmg}ZXk#SU$0z(p+aZ>X(8AnQH zA{49d6R@ZoK~+^k8p7VafmCd=^DVEtJ_7eN0-7$;t`IDuC#?i#wW8hU8|Cl{#oes4?=5QR;|_B@CJV!+`kaZk70ib{m}$tQ4Vh+pFhccq}8m}D&N)4wM&NL z?Q2IFA>ii4!7yWx3DP!1X>DuI1o1aiMb#GZST~akSg>d_0Yy zZs;M~Zu;ADa30FN5U2amci0r#k3Cd8XwPh|BZ>o&u# zYMjPV8pJbP-o}R&`G(}iPG-1m72#)4p_`~oC%TDyfMh_gdpFM?&gMa^fgl+nU}u2e zfwQ=Skke)&rzMv_f-Er>4MGDza040u6e6c}*Tu{G@-G8IN%gimst;#9p`<79J}&gi zlVNgF4Kz790Xm51 z0YTpd6Qxp+BN}MoO6IfF$^&`f5LlcubNkQvNUkAZTF6Jh4xthzHJYCn-j`oJDynd5 zRI$zH;Ek6E*4)@g_1CQ>CUf3^aPO+pM2SnebwKMD;A+o-Kudu6UrQhlAUdy_8#7Rz z+%u?oAC*0rxQ9(f>Y%kXi)gy!XR@XWz9N_gw1HHeL_Yv*solI(q8~5|`T>%3oHPqA z6|`WYYTNmT&=1%J-CNREbJ)-CC)QDeInJ5=iD9gE&t>s6B#{`3nrj_0P~$nTLa#g% z()%VMr=eIzfZdO`4m*1XS5Y*XL}%+2sDPpbN-<7Tb8x%qUB?{PD!3L_fQg#<^(E&# zxZTT(kqN4LSyzo=wlUpa2xc|N0WT$I06O&Ia3_u%T@#V-F#ws7zUKqZHM8vB?ER60 z-GTYcPhmc@5DYCF+>y+DR}9k+dEu^UKt;NZyX|K1vvdta52oF6CQpB#h`8(`*;CF& z|LY431Ez5@aHj~E|5QdM-sZAH|3szCz`32`I?!kx(HDTWu0K*eatH<3)@=mXp4a7E zGz>gi0x>sVLH@+%LpuxF+_utqnNDc%%gizRKP}sq0ds>zIBVN5RubI({jw>@vaatLyD^;S>RU;|TIGoJJuG z!BU6z**}2S$?@jaQ0IJ7yR>CRfZ!*~PIWC-*muqcZtwMV&EN;SPoB*KvlwP>z^->+ zf?qU5%T{)CMZmxoML6EQmoGH8*EAP>tv@Vb=%$v*=7~B=EjXjwyPr|aH8QxncrzH9 zJ5-ni#C0I4AMpkXGhKXIYd8w8p~pT0DUthl{=P%48ALJ$NXmOK5~xve*@#M=$&sTO>C=Zf`o7uV2iM6nsVJm1|km zLcIy*;g39+<*!`lSdJVu6`Iv^3?q%yFy;=){ks4h!k)Avk}E{}B@b{qasda14s;p7 zsOJzk-CEa)UeGaHxAKOO+S!u@B@2NMk?3@VpPep**OR z?SxJu3q}rb_=0Q!B+xB^a8KV02A zVZQwk-$zg`_mRwl@#~WT)b~$(Db!OSu$ul@Z_jE7Z2O%ZEW2%gc(Jew)L*qpuWVW2 z3#xxTZ!7yz?)ADAzJdnJQeZOv$U?y6%4#kQ=H?q>>O0Y}>!hv#eHh#T{WZYyPZk)L zZsHu!Eo=dQveE?OtYpRK@=y^3BMI&p_^E&$W>2W*8wxjW8#73A%?m=+kO@obQ3yf%vWkFaIHk zx$nU16ej54UI$zDh;<1J)kt8dMsR{2%48*_^4N|j7YC%>R=gBK#|xZ%LuMnDGhxf6fv4OApfTEdcZAbD0mBQ-ZoC^lH!jCpF|It61eOuF!>=GdFj9VJ z$j@F1U0TltxRJ3+9t=GDu>CSo0ww9J0I;*O?N1M)suA$T1EER=x=+)+(QFv+AQ9so zrg~}^=V`{BSy-PiLMtXWhof+-rBC!meu&0Ir(a~FU!i?Hzlv7^D_14a$TBFy|*Hme_EC!rc< zR@?gVS*Fc^%;+}+GJgihJpIZrBT%J)+K|} zLF&?malusC15A1I*fE3RHk)e!Qq3v zX5v~kohXWs!V!Y=mWB4GKuBspz0_(Y&|XA;0pb!2l`*7B6eT{=WZVRKZ6@+sH?$jC zzP-{X5S#$TDfwO=Ht*e>p;>SdoHyn|Pes|iq#_dL?qSfAUCwz)rlP?ZzP9TjhTc3} z%Ie`8m4A)c=2MO^=RoJOD%r3U?iRQ`>W16E9MfEBFnbpdzj(48bj0`&Cc|6%CgR8$ z3UBZZN}2jmGd2Y>SO^*132%ViugH=M&d?{JzxL}4rUjG=7HslHKfKinO~E3|G~`69 zQk?^HkIGjxYEz4ImHa;en3RtSQQ*<;HW-6ThFx;%FO5XeU$RZljr-J=Zx@+|3m?I7 zk}?;5@l=Um>Jc@;?$47SSSOP!O$M}gY+-v-Ri^$Sd{fMMxYd~r-z;I?f8JBhe`{1I z`ci11cF)FgA?;u0PZihX7%Gh`?8>3JyiM#1R*lv`0zc>LQCFD;#=U5_OPdNN;6i3_ z$ff8jFwxR|AL0$_Y*bz%;|Z^iVM~E{R9I#rX>bSlHK^~~Mkyyc*D&EL1Gw52TvoNmjQzq7sT_lx+3#j;Npk$ zo%NlGcSaKDn}s^KRR^EOV61fny5fO*Jp*FENd>Yy0uAg7Kn+eq$21dCG_y|X>uG&( zGt~1JWavt8GJQt>D2iZg87PT_7KdlOV-d3Vrsq?c?gDg>B8_XYX1ceM16TY7m>2DY zsG@Lx$x*l;Yz`#odUm;vDpN@gjfA4x2P)vktL+`gB2qidg!_Ba$uPf#z6Ihfb7>|% zz$Hmzg@YM_&tgROq*ZvH?7!nvq1DrF@+T?&KeoO-uBoGG*m|Rg5G^28l+;>_NHwk2 zQXnL4spV0tDJrIlkjGk$muhMeNFW!LODbAZtCU(LsiJ})L`6VINPrX(FGNL%$R!E4 zXadP0A>=?V=bN;BpZEE`-}lGn?AhHUyR)-1v$Hd^x%NaF>H`asmTZ{>M<<+ACWirg zHwNf#VwU1T0nbxBnu5fFsc2#ICL|j~uj9B^q-pZ?u*v0t_(cH|`$RCj$3B7eJ@g7F zI4CRDzz)Mz3p>+XtIf<#O{?t#b6ib&vgjD&8rTV41G7wiQSfxK`y9wTY4_6M5w*Q^T*|aNQB_jf5Ckwb{1{ft>1J#@oRC92It?sj`Ks6^n&DW%s z1W%@2W&64435-5Cd_I%OxB_88{~%g;hr4-bXI}?4a`NpZmvV}J-E-oP4kl>J(96nRxJ|=}=ACN*$|K9d7BfjMp(*BNn6c8}qb<%_T@=#fAmk%HBW( z+)J48hQk{F##F8R7n`=EqGgsVzL8(n)D;TU?peeK=-S36Z3&#Vd2I{!=6x|T7cD6h zAl7Y#ldwbEmFI)R4G+w}H^sx|;DErUUDrQF5OeTNt6?Bk5Uh;`b8>a6HB&x3IE#6^ zOh-V2z^f+;O37Ez8DLuMEnEFH7@3!2K7;4pbu1|bwM$`g4btbQ&cGA!b*b$U7bl8D zMdJs!~lOn8Fx;KA`V+p6sF9UmIoy|SjzNQ{4LqBwc zsAAB7iVfg%&VEhSY@O|jE8TR|#4RxLAvi=by1leDleb}HnIKi8ei{*lhWV@c)c$BR zwPFKW#dK|i6Zx z9?66$pn$1aQp`vK`pQglq?NAB%=5=jbQjSU3+fo{Fb8;lJYQ{^c%61J`6)v8 z7abMCeJ|f{2?sD_nges+Z+64eWp>+u`FTKiJnF*LwDpb6u7)pEvK}VuiWUE zjv#=~j%|frrX?~DUIV~qZmI7Cgo1WY5e@L-WczVN*izDK>Tk}$ zw0sJ4)aNI%GK07^?I8`RacoZ#Xw;Rh5v$Myr9KId#%?S0#7?#ERS4qPO?^?Qt)k_K zA(Z=a1X+J4@%DzZW$15BzQ~E&8)k5?^tJ{m8+c{OW{CPoL%?9JqWxN(YKcrg0!Q-g zdmCs}_Jh6!sHtKD&P8jqMUgTIst7Il3xa<)&67y<)>0?uFi@ zAVM9!9Tvu#9D?EjxOp8a-NeT}9q~rzvAkT@+h5gTCFpYERpt5#MAkmHL9m%!v?CpK zR7B&*hmI2S$tG}Do}ne@?}Y85PnTEk{dl|)vT`Z&THjmlv(U~Vb= z7aP!QS=S0Z15`EZ%Us9-Yfa>9>ea$yG1faPkXk=c79~l&D2vh_u^Nr>ryb+1P0ZlA z*;goI1%9|Qo40yo0doWC2*yf&pFdMuxP+8uD5A~xY@y6_9iY z9rGFkH1gEsY~|w!fAm0(xWRM?TzsEJtVg4B81+=igo3^|KS-+W@fc$=!w1{lX!)*<2iEMaeIs0h)D}^Y| z0pRWYf^)I`c%6C+`&r*1^zBk0s+-v}WRD){7dckg*xrH=5{~?JVkYgCP^@iQBAYB) zB(Bf9quY;m0AzXK4<~MmNI=E@>J0VU_&US3;L*ZZ+7-a$yRLoyt=_@^>S&mAOFHSowRXh94@MMjM`Z zUA@6D3fpfPjs^=~z15J35%pLsP?*M2{UY`+?Q7~%H?yDi?L~XG1$(J!BjEyYECM7_ z{!G=zfFT~?emtCMeI#9Is^goNv$G6~*gr{ej0Yaby{~H-lT0C`(Y#oE0Sxym)>KkT zWP%F0O`J{>bNZ0u+sLm8z`yn^aT+az0?I$E0H^9p1yZ9D&5_#>2R(>jN9j;OgikaX!f1UXehtB1o9%_i{1=fh#(O|y?lj`r{P0QIsD3AvyXI% zse7+7b_%NW!|(lRVrOJY3nC=G#)}pnWBfwbXcIQm;Ux1luGOb_C0iT-ZzP6?si0jG zyhJqJ@gY#ED3Ex+>dBxj#)EF2Z=7c(H!ni$K;SQIJ#%bAkz{^{T}GT{!uv9VWM3s_ zT?4BAF*p#e0!2!;6i224+5DAn3Uae>6c0a90P4V9;8eRi?9ojy zYi6NcStB@Cd?xSnkzHu4d8z8O>M!3x%fJD2z`R`gu1Uf81*Z+|*QS5rJjC*I-2$nU zD$L}+TjWB9LDUNmn3miE5*jS?-=s6;+W`=bys1jn0yI8dPnyJt3i^}3<(rl#5fIn_ zIMcdqWDfy(&YuCAy}*mZ+Nbs$Nv+@plD-mhP_(&5-hG1gwV_FKpj4Ep14@Xk8DXJW zo1Vp>VsPExzyNkTrsdEB@YN%Es*^ZMzJ%K}YB#i#7khCS*Pj(18oWzcVL@Zz5Al_17V#Sqn_chPVx zWhrSoAyhflF$pMOmGGHiEqXAAP;a2TOkT|PY7EnE1)0pGzc5qts4S66dS5TTW0;&6 z3;tD?0W+n&>yS!V8QPR|Hlp?+$~c;f9*5MM*fWiZ>ctwnFkpLX2$M^G)QKd4s^Cr@*Brh% zxYBu60{jf4c_(aNJW&jG5$+(F8>3A9ZdyKx7Amf5dgv)*Y|1c2tp|SdbCrhnORA>u zema7`=K+d@i~JAN%b$evu?-_1pi1B3mC|bqU+ZIk2y-TSh zhf?Y(xpd89mJc_#gzT_^c8A28=IY-tkvP@i*%+pI^6B?M+Ys*@Qynfm{7z6hav)jg z0W0C6Tlkk#p zA>IMU_93#VIMDU{D4k3bTT76iVg7ev-cpEF8Hf~1aVA$V@|qMmsEKCo=f9=Ax9_2% zb6QZA@$4{8F{oL&SU%vu0P5CdIACIJG?<(GMx1E z>jR=Q@8ZS1@egBq5+UER&wk-BwNrPw>IEs-*)|qF_j;vrjU(26;hmrg?{asl@}oLz4`C3 zw|?%-66aF2J5y)6+0 z8>H_%IBOJEWozfk9=%;ln1R)|Ot8IWjlr9F=;thO+3U$t{%q66 z4y**5Q}&%meG(8<8-zMoEzE>KCt5jPY&zYL7fQm(sfn57cL@rJJPRZ#8EuJBu4iuV z$>ufW^H5f>N3u~tt6m3&h_QxD(VNzCAXNiEs#HMLtBKyc&xKj?g-S)0@~uHx}B=(X{VQjw|jwk89scqS2 zxTe@fSXDBHI;joIGwjTDYkcRdg9u8hJ-50sH;l*M6Q|_lpCP2-CKv$nta;Db@Zj!N5s^$ z_lkl+E(!pZV0y|k3YyasmLV~PRA?;z>Z90~JsIkE@pYzLej1YtkualJGf6*#Pc0|T z6c0`iE8#3O9OarPJNkf_ECFKT&+;bGdLaHBqdpLVIs7E`NEP{dYdDR3VW8Cp)M$Cq zs1zsWt|L>YF&wL&hk246pIfJKZxg*4c(Le2CgHJdz8U!!P0iqApBYpdYk<``6`hu2 zYS?cWg%ZkCSnHJXZ{y^U#7O`zQEfCGd2i7eA{LLKf*p2p)47oB*NmzbC#f*q=x+UxE|BBJJWkWychF2p%~Efj-Glr0Jt z)QNwI(Ry&=fiS-hHVyX38X(hWg0-U7h!Ex$;nBR7XSOH}LwLm$S&z@n(=>q)dsYf8 zfl*gro+B+LMj~Fy$JS}`SlBmh4NCLW(LlTl5!BOigEfI*@tZQO4KL#pJwyN{@?t{0 z{5^4l z*mJnqy2yh_V#^24VkKZ8yA5~<~Pl1C;8v`6zml*L~{ zS4gk0^+=VU`dCcQ%-(dQiK=I18sxM8j8O?DqH`z>XMjwWn2A#Gy`2p^W?Eka?D`m6 z*a5;Vj#=D{-bLaaPVWd2(qgEW`yy9tueg&1d-I8o&l>YIimJopql7JN-ymquE$g+z zu|%nTrej$nKM`-m?kT>vB_+k8?KXpKsya@1gpwN!ky3`9BA0t1hOQ+w9Hsk-_!7~B z&<6P>^o=g3G;x}1eIr$?yJr9elQ(mH51q5N-WhHtTqsE$l}@MJjtfJ-FG_kH^gZj4 z8sLY;z2}i!k>I3#vecTG01yuUpAm9410$jgIalB|!CS&Z59vdqX zoQcsIKwV3{tF?!Kl6oOUA%92NKmjd08Diw*H9r98{}P9;%5kIbF-_9&yN=zBRoc{M z36eUfPvW7Qa_|sl#me)rVthSL1PcE`*dHn&J~no*99hXL7VXalt6K0#1D;o+S@D~K*#;(i6UuR21=Svy{N#s-qs~*kbwX>kY?d63f@$ zV7w;eY|>2)qOunVx3IlHuZeT*Z^UU2G{%JeG%>j`Sd-w4oFd;0Q@0vht_UC%Sa6~@ zJ@s2N2;B?8(RSO1;BcvLIa+n6W$Y+UV@!W58YMQyeAYaha-by1M^Jmk{*m+#o-S%+ zF?u2D7^egRY29V_Co|cUwx8^GCo>d^of%DSS#+|WLxK~3_t-FstB(`CPAua!X+Sp` zg8o98#+swqL@y#C&r@m=HJnm)rh1X7&QKhUBR!LQAW6xzpT7G@UqV{Ye=aku64$P5 zC}4Pu_iOq_Yp<^8a#C-0=VWDF(-QD0EJk|=Q(P5~ zh8>;fJI8S!Raq!M-Bc+BH&x=3H&u*NH&ue~KF|+;iQM_dz3rwgqA0}ALw}QieMe=x ziJnb}V>kQKvczA34e`VA32C6~kKRb6a^ZHuCMDQtGAgw|X-#NAbS%buG-*z9VAmt5_x zMimsa9U*LFr$dVb=IW6QsK{z4kbNEG-RaB$+RT1#q|WC4p{IFvI*VDo=XXeG!#BFc ziO-FyNwUw!`Bjy6|16cC==lpHb%t#7NJr@~cR-umm{(b8k2^{@qk;x)nPL43D9@_; zG%5~z{!xnj4Iw%Tk6S0H@)@1aolEOg)%LqkphslA@lc?zQ%UT@P>_urm8cKyw}nnu zYm8N$FPv)?e50$nv|GH?apOiJ6{<=Gj+@*MITSwrT0)zRUJ9vUoUE|tW>Wn`bK$!l zwCiXu)a+u$ja1xBkq_x~=3^ez$m@ zEzb35c!*m81F}`Z<=jUIo7l{B2`!cxJ#u__n0rO@z+cqeW26T4Y-V$yVmy4^e zJ+bT+-`GOEMWqwEw^QUZgy;`{8mX(kv6aleX>U6wj&*ha*exbWOVG!sQsi$V6-KV4 zpj-ToRA;P;eBr$B2Ier-+(%>*o^g+@#7p#Yux$ar|E_lYGiT1Ja=SmCZVO!nBcCoy z9M?6$kQ+R5#3#$`aT$#7ZJmcwL1xsl8P+*0ERb5cPly-}sGbOa+BPsHyeZ$;cO`XoAC#&pn^BA_0 z2mlxd8n~cAG^*N+-D^pae-qg`(wq+_zvAN)@bOaxvFG6~NikZKNJZmC(G=_XgDNmjGd`SHaSTB%>=F3eFpB8Oqc&-(jxzyDywGD7WnX`7pm9!2Ip|rCU7o zj)XS8CPlvX49xVq9nNBC(01WlTgggjz<>r?XrPT6;$E=sb#y|0}O&J9f zTrJk)b2^+kf5PI~nIiw?0}1WiZ{6bU4~^6hcH2tk1D>AfaPEWZ3aGAu>I|rUoR}iN zln!4r?Xrc+^SZ@vJ0`cuZ$akwU|BUh#-KqOG?-Th0mD*mb&HosFQb2cD}lQNK1-G7 ze+Q^d0I~xG{^;9(6_j|2@7Q%vpbaSq+Tz@~2`2a|Oc~{-JvSc~fW4gvEENY zvxcO|w?TtsXrPA%t1iGIUeRWxeplQr?%yn-y}AZ#a?>z3PMi8&iBf*`g>xUPR{{mr zLV*780bA%~+R$KU?J#$-Hm;FA2J0Y$aLDE^$kna_5Oo@;R615S?;xwApSY-!- zp@;{PD()7)%YOPb$5jD2VKDa|vD^6(;M^QQwYSb}?1cwyB~xhw#;QYZ z+65TZ2MYmNW#k4{!5pVTugDVGUSY`p$TCIM?D~6{Y?Rqh}YJ3Gh-fLl7!E z1O;>0zxPU@gn2F zItn~t*vz#f*D~D{>}szC-d8iXjpV|+`)ueuydPlR?Iz>gT$vE-^!4a;u4VO>!{a{w zJ6p+NVBIs=m1eQ~#S_kZlAs_6jDXZZfc@-yMY=BM*enUn6WyLFj{>eUN0@3;M!Tt) zs>D?a88;P!hc^!B?>Kzq6AST2ypL8?G@ITXNz`F5( zv;4d+r{!@hFOf%EG=*ny{+k=xpg2EST#w7E(qd0#Q_$V^ml4h%^C_-HDWqJ%^YIV0 zk@L%x8KiG?b4d?dRv!8-pFWoadnw^;lF6*mO&E~4z}#Rqgn;F3@8Rdk7dS3FnU(l^ z023|vF)v2D8m=g5omhiDWaxG0HRG*Qlnq|vbrz&L*r00!CG0uFz5SpgY_98j^3LFz ze7+ysLOm8i)pnTlx=`&Zmaptv8CUkySM6p&{8Z&;-Z^Zm-qiHHh|2aOZ3*Hx4FK;E z9+g+ul2qAPd}4<35D$Bu`#TrYPLi3D>+SD95eO!Jl^C26XjDy5D89;efZNqmrP~@j z;%Oh*P2NH7dBf4;nU-($v>!?)?I4#ebnGmA$)acHQ+7Z~&aT~nml^XuLSBYp^w>E3d4TGo1u_2El2%Hc;HAENP%NTaeZ3tVvCxTX?FM z@Xq2NP2a1}C)cL8doDO=`+$3gBV5Vv)KxR@aC-JZrj&Ds<0=SAS8u-G6DGQ)+Iw}V zsdHV2AnZ^kM3`wfC00DZ9xJOAeF@H>N$9-Bswle;(f$Sb04?AerBfGAe8<2a~ykE z-(Icd{s8IVRnEZ&D~FRhf7?qVbe|iuzA-UW6xQXO^>6hcF^d4+VLxSJ4Ps>@A}%Ne8pddPnf#=Tt2 zc%!FH_G-~Er#$9`eU5h8aQxU%e3tl`ELkaAuaqS)H`vEuVAZlQ@4{hD!QOQBJH!G` zD?Hz0A0K;^KDI1vth8a%iz;JBl_z1px{|IgqpKGZFLD$y9riD@mI{VrNxHf}c1*UF z`7l8)X%RMV0R3*JxZ$=rRJ|^`fc4r z7EX4hh6R69SYuF?Gg`|T0X?lUj#3uQ{4+t`#4JKC|jJqobVBR?hHE zd?GslLq}H(ciM&`M~4EV<|yR=t?SSgY6WBBYo#^aoe$`;8ak@re3@eqa?T4m66At} z3&1*8IOdHBbQ4ZIj6(_I;X(I+q(I$Yy$VTnx(DC-*Wj%~k(t3=RyzyYlAk5WMYipK zCFHli+RrtW(Uh_{m<;z=-T!gZ{WW*59%;r^3G%t{J$y@B_(K50NjIzpuN@S^J}~*O zDS6dVsIM8+M?;$(9 zga#X=0220In>VTQkDB^mP);MZxG?5!nSMI$DyI`PG!i5i6cu@XaaDvD_AlgnOo7;? zT88<=m~1Y3$ukW+wg%-#12ncSZ-!f<{%sM0aZc{G!v3v=LtDWr`xC=6O}XH)sbK7S>k-AlWN`#_D>KG+lPFzGXi$(JJ7yj!S_S&3~ET0$ob`a2l(Eg19zKzQ`2sOTVaTmMxi9W>>eMT^3;#w6W6 ztO4)Se!N~%GMQ4RTB`Juj{R)3AX}Bw!P$fPK13F2^N~(fb_FmWo#83Y@E)AuHJ#z% z5_u7Dyj0|f?r<}{Maa|IVtRWEIk&>1{C3!pv^5f&%&s;Q>cdEXSf-e|#1RU6XdH#& zT0n6{QCw3fu8Vz#$m~z8nYdiuOxfD;V9neCQFu=aIaQj^(=sEmrz0sYh`u+j0@G^s z5yBSNvb*Ynv@|oGX~uCHTgYbrNbF5um6W=?P|Qzy$*~fA3<&JT7WpXDKv zS1jsdVwJU18&SheM@GAgb<| zXqNXi%XQ7XNupv$bg+hd$>MudsTx0C?*W0}C^sz13;))MBI{e^-yh58c?QL~{Lvo< zXc+-#c~gQm{TGFM91jHucG9;bu{$%eBP`5040iR74u)?VVY?J z>SOp~ML*DWQr=99I#?!-(Tm z00A`!JC1bZXEVOeix(S}BpfH}&SC#N=87Fjh<6Qdj^;o&dEG-D#90W&vV-9&KI~L5 z79=fjcpyj3xcraxp}D-N!i}!uzEKwJxNsc%T0+JWVtCtnDGjQaVKNK(-!q@pawO8TbO2 z$MLWdAyk-}<%7-ceomuQ!#}9t%Ri^nruBeJT_I}_YlV*Og+KXF>A;bn0njg;r)mSc z?HCe%|DP}ZjpZH!$v9q^V$r`UkoDAJIFsX3E3tbeCNjblz@HbU55g&E7^a}tu>5dx@?2LX&RYZ-d+VB&zx=;RGv zb405FHU2vxLbI|i*xkPr6U^lUH+rq2xV$N@Wk9shc?0T<7yuv5{nfjc2GeFGBYhD2 zuf$`I!Feb1)CU6b$M0{=X>zQ4AE|iqTG{|CH7O^*z>N z-B$Sad+_aFVTn9|C8Aq`z0sG;%NhY>EX@6fmHac2t|Gdd0(=f=z7kZ_b5z(T4k1pN@I*R6x`r43?`{u$$7 zA7J5jn-kCMg6_GJi*+5)z3-rVmC(IT=-y8E8tJm}G@H7ChAjENNq`D46vElyk&&8l zEd4h_SzMGH5bwW}b_e`%IgmNf=kb_d{zX@b$F&TWqY*tq+SUxN8atvvSxJ;nis{gcS-Tr;KKJxW*(;mqyhd0fpoEb2cjU>UFg z%3%vx>YmE`tBQ3vz<~csWZ>w^dX+?ZO}orJjBJ{_hk-&zyznn%MQVU`*o{g0X$7(d zz!PDd>-aR7zoT>)4gM$q&<(=9(~gOgM4J@n0ae)B*SXi(|H=e-ZP!xlb*YY2m`zAk zV@I3L@&;pImi{Z@A-<;S&MEtac|G5&F>M631p44!B;>J&m^&etKqinFllGx2+>?#v z73&017BbAA{BNNEcEpT&gS)|Ju&R|CT^Ex8M&a-`^8p!70jBHD@}|q4aW;4pLa@ow z5wHJ8B#0lky=iiH5jsFvNEyHvNXF&BZq^C^dT93!z`cow)EGaY+lIZ0bAS79smVEa0OV(AWf`uhlAl4 z!vCn5)ozLDZ*d70^x^s3i*c25tj&s9De-7h8(t;2&S(pqU$cFku12ps+NE49$VFzKkJTFoweEl+1pIBN< z2L_%8i}3FUnOI;ET?C%SErMzYGzu8z79##ebYxdCh`(+kOPAO%!hGv*WEz3A+`Qlq-~~B==DKPd21Z39$@7&MZ3y}R_z!&rVU$rv z55eXTVH)^_%eMe{_;Y}z!{507f)CbMA2oj#0n0Z=1+e~yOaj9jEU@!D+;|H7 z2CH^u73&s5_uhc+9f$7y3Eew$pX`AHnL&2f%}RcC3- z3)*}WpYId>5hUbz2szQ@roJ}WY-XbU?#uY8_N&~3rt{;~wG1C&yKEYBi~UzkV`&Cw zzmO9s&7W`(#1o%(0&mc9_oJY3K=?X4>PNNqkRPzo|H>xt!5h z&hYMeHsOsT2lAtt>jhQ1j#N!Y*x|+PPoR%9`(4eB?y!y2v@&&Q6lgN8bG(qUv1Lyx z82((>t_jHx+i5)AZJhkepz3|kY^066ra7|DN5a9}V1>gfvD$8w-LiPb4YPaW($!zK z^;CUbVH>Wa3sm7p#VRKIF@+qdg6q2@NnBz-LZ&}E8B*I~F zZTA$h!Z&?-PiDZo(|fX2?@sN>!VPfHp*>&($;+!#tb1Q)n#c5$eLAuRMLCnfn0>t` z(Mv$_CgSj4wpSk`z|~cjI9&w9_THOj-kWZIm1cgGZl0TFKJJ=f_;U&vI)o_Sk=_yO z!E8d=P_hjoOD-ie(1!~xo~96GO|bH6u(C2(Sr)961uGYVxNtHtBfP%NGLI4^9(nd( z53S`aeVR*hZ6aM3WUB8rb@*WFB8l81{|J^G?5vGN#|rhyVUAzAN7MVX=`T&(yZcgv zdj$deQe17Y?JL=>Q@b~Y+$cTmPB+5TuD39JT*lQ$!?Xs{r6e!WZ_lcCIbxCz zYFFNFnMHaWq1}I|tc#UR`0c6%LNLO03J=OvF9e~yQsz#2<=brA1&E>WmC0JC`g1h( ziXp|hDD0bq&3dbkbRnhg1i09~!rU)o)4=GpU6)*2mp&JAaXI2T)qO+Q3#+MXkBY}E zNWh*mh9?Sn`&IHut!dG3C3piHW;K{Q4CV!YlP6 z*Jhv|zv#4wShIs7)>tzc!~|=m?HSx#y*?2fG;4c1x6^vu`%z@Q5NE_@`RTS#&?yLA^i7Pc)ZP<=}NC*)cKm!)|O|SKoT)pH&=H158YPuO_m2K zv4^kbQQs%W%uC5XK}k5 zbjRD^sIJZWJ^D_|c#Wt|0#2MarBi83#mlP<9or77%H>_)JXWA1O~Ufi)j_T&JFTg2 zYGdvNLX@@ywAuXlKmqqE(TAKUJPLQA?yu_5?RcHy`ch>QeZgt=uiDesrVEnqC>+QiJ5eKqoWdWg)&)aCDx)U*57GslG*^)i%fo6!=7clAY$+U9`! z&IwqwYtC5H#*||hwr0z9aM7Hlw;p_uyu%Y{yt!5Z?_WHdFZXhLbKOew+w4m&;of1w zn6uhj8Fg8CTmu(_MHEyCCVIA!d6I;x!QnBfO48jECT(aTzlLQP)3<`dhSh&emJcaf zDZ3dt#A!u5`m-X3>};!#($cUXMQu-g?#ywtk#NoO7rKj+l|7fo=a4Ym?+opuEAZjv zr#`An#$MI8CfBO(Ss6aW!@)+yw&2O4Ysudri1+Uvnl+_oj;X{d;v`Ba$wO3xPG&!3 ze2A;lB^H8s-(68mCSKwMZl{ebV-C$}!zUiL^2KNQ+nBP)tRL%i*W@>UA})-bi?kZX090c^f!F4OE_%Kt=+Y zFi>D9`X0pbn3Y#16x6->Z`<0&uSNY^B&weRhd7+avc!$J7pirx zPwi>fhg`%l5g=d?zrK${Gu;!7qUVdgfma9>RFe~wnNN-&2n~q3DvTLp* z(#s_Fa^+_f!oqo#rBP2~I;u75)lBC(je7B2v9~K>aDoEhC4NVytio4{3e#|%%1zps zA>Fm9UA2iV4f6E-7R#bB3v+=>e>k7cOf<~Y20YlwD;F1h$X*jKPJ(C{B}iv{gc4bF zmWS_o9C7*-ooje*ZB8CC6wTxrc%!ah#{yQ>PFm{4wgOkzs)_AyK$NABwBG$C!?G%B zCujckO8c9fXJr(9Y@~?j*v+zlgM$s+7+9!jES%!#Ch0olor0>-REfYU@6<^xsS=Vx z-f2BvdQ-_t`-#)ywSOonF=403(moHqsd}y>nt$W8oDp+wux^2N&CMReu<+<(5 zgzuQM*pkT+;YmBxx}B64w(-$3V;mWBnIjUD_NsO9?jjcyk<4c~A_{4jT9-uWu#KBH zL93CoQRKs-TOxHg@j(Q={YCQfvI@iY`2DKt+V(Qbze^KzFI!XcH&Hs1TgV4g)#lp? zxtb%W^>{)Ddk& zU9~P;8KqyOl>FxNm_EfQ|dc%(V+6~E&c=`GCe$iM&Gw+4rY}AN1MVhWY zX1_}t?V|pFlNrkYKgm8e{%~x#CU+vGThEak%$Frp?NFD+5ABj1e3ds`3 zi#I@l6AD%*-ZcEmZY+x*_qWgg2wvJb@bWTFa&Uw?T(c{&!mx$iRu(@D1;bF_4Fz)& z7^-CzJ!SFSTHrQm5>l--h0`GJu&$BrRt4LCPY^xbpTf~Y!7C`BqfqeNkivN??zDzT z52^~SHJq{uai{89I`&(lE3bBg$`?QH`N-Tm>FR5*rjw4+q6U34HSb_Wsx85s9P#++>26e+>qpY{31?WuTHER;wnjzO5C)A&KQ8iip z@nc;zvU*!#Juyx^sD zlvtn;EL-Lgt-tGM(hAWz(sxYnQ`)NC^$WY4U0c5USnta%RIbq$a<`MiJa{PugCC$J z;JlW=!pp|fe{XU{=_Bu*fiO+s;HbF5p)gN(d=EaGCyAq?SmpgbWK;iKlns7OzAW#= z(^Xm(xX|q~zvRU@31&a(GNl5aN7Z0w!?dP*=}2jp>8Fk#?NWQ~2N0vvmZ`;qvs%*~ z6HcMK7wLA{Gj$|=HW8J+VTqKk^o+Y>pI>SfayV9XxmbM9K4#5jt7WnuOr0v~ILAJ* zPs*Utx^2UT(A&*2S?~EFLuff^jiKliY(6&O8wa}yun&_d)Drgc~*--?a-q7$hXtorZO+g!MR)=i7 zh|=|)8s`c;TKL&fI4^nR>B-z(AXIBJ)~9j#O%)6u(mI2mhVP0|nqV#qCyTLo$W;_a zPXXn@GPv7bm)hP0uC1%gud#pE&z-kYzqm0*b7FhG7LFWd1jRbbF!MJmu zmjuRSXVt!uAg5jGJC1MYR<68TIp1ox+P{7ZmiPBop}#E4fD@~8<~hWQIL!hk>jao; zTw+fGH^1n3twUnR5wC;zwK|7Vmvr7k*mJ*(eza_&3JiZrhbCegQk-XYNZ=^xmjfBZ z{qQT(iL177j^w=pvB5qWAM`|a z@xX8dy|TivwX401ejr{VJb=nnuXOgir_vY~%3{!m`G-ZBgjn|Uo}R7BP1|`*bzX?I zINmey3{?}_zY2WnrU>VYxj$7Hh<_M}g_Yn&WH~uLJTyVAEH|h#mFO`U9pbD6^>CjF z@^l)7Cn$o(K5z4t9ZGHUB~cPHz~T2{>({00=Qr@diHB}1uuP}yQ)lZ&Dv5%sK9)2}*|&fh#MpDe$z0So z)D##4pxSqE+?g9J4Hneiwv?4SPElF!l+(*HMCf9UJS{Jl{E1bdpuXh(c2xOW zk!e*uRxqK`#4CNI-h%rcNbSIrgc#>6)(lq&_(m3+ufgT8Y+n*+U|b&PcdWPfDg8T& z60nWW%6L)xOr6JH*zcy4iwd7gIymnQ?Y7;lIp5vXelP`Zhk}z|0@h#nx9x+ldgD&k zvF@h3Qze3K&lG&Lq|>b-}+oR#Vrq1VJx|#}htQWxs^*!lCR1~f5f%$DBnWhXtE=gyI(kl~VR*Ehq z#z5?XPVhflZc)iN=x5`zWO_;3f}5%$svka!kk>E2C7}xo_%z3M* zUj|vjz{$;pl^FJerNv%I97ua+4D#{&gqalk=|Q+w6i9IOsrY}ng>&zA_vsyIruscGx98!oap?iPLLa;ExflAG2QD! zVq|y+*Zy#`owUWmOfTk;PY#23#o`DY#B7*GNhr2_LS_4qDlb_kQI^W4Dj|U0TyiVx zNU)z8x!!t=5Jy@t$UEIKMG9Vv@d0{kH|a+*O|^)1x%YH^rC{@vr2EyosSK?_M zcsa}_B_9`3wBg{fwVJg+rpZeqWzqfBVDgfs%BA2*rnOO`hIBK+{g^?0IqpZ&t$_EH zC#(|zLMnTn>bM!K8eKokEXcxqSFV? zMLw1Za7V~JWmwm`oOoRxFe_ruv%EVtgU>A$A?RB%xWH>%K0nf(FAqm5pB=W3 zN0GZ*3Rgf1hZNS`5`6AWtLOPq*PHB~flr;~NRzd;p6Cd%MMamjJ`3k7X%~}xXl?D` z{3btjc7U;MTo+Mga41%$zH}rlXyoJWay}W4(YEoEUE02i4NuEA{63N<-O3zP)+j-{ z@;0&aDOf8Ge$j>(%GOxmh= zOja`-NKqAj6HOE7DwEX}-ajEkR}j^4wEx4_pT{+IeE;Kkl`3^3Kt$>SVG$yr#-)k` zNKizoC{fX(RYMg>HR5W!m9Q>!hYG0}1rK{QYms$zndC1{jz z36PupdxE}x@82Jv$0Lx*UFOc5Ip@stEHk$~uH^!y@3eh2v;9%$E+sWdN#(Iu8OOgl z^8D6p7q7wV;&-?95vaFjw;N;AlkSEHo@R`YNb#An03}FdJ}hP*&zvFk`mZ|oRo{!W zbbdR%)xfAAO&+|VxTf@M*E7Eunsu)d{4_O;84Oq~=0r2Uy}JokR_X4J+nM3ru1Hmo ziTrbB-rhdjmV1iY+!xxV?Ntru`fl003|9*FRdp_BC);P=O_W_QrFp?i0?Z!IU)+d) zbR*tb{yPc3dn3N*9OQVh&FAkD`(}xs8@TPB{N)OUhpm66mBz)znzx!M?dnB~C7E}1 z%_a{#05-boU&)*O8U6M(Nox-2Ebao!hY7aj#?N38Z{bo~tJYl5R|O0G3#Sfb{nO4Y ztZbJ=ew`KwE7nbIpW8BE)19gh7j&cUk;0ZsUcsI}uumIoqmtj+ljetKLBBG~F6(&r z5=>diPI&A@lIhEL{^Glpt6I(1`x3gwu$RNW@fCyfVILGp4y+{{X_?0vlMIM&7H5L0 zD72jdYj$VFe`9@P2J}aMZP?ZRXdo@R95P|uz_%m#8@4Ce4{G3PXAmw192wGUP~O!X zZnZk|54Hr|%l)=;q^<{RX>a{+>1fMB*l^?+?3A#w>qQP}PY$0y+17jC6lP)^HjRVz z<)U80^;&z^I|AhvEZdW4lQn;bf>yB@;G6)KSzkA`{SNQ=g%snT1@wuwKR&t96pQ_7Cp}>a}!AQ#L(q&oKr;UVu9Hoic}~OQsDHZYwrTVALpD z$0*@_#YuyPQ)~OI&|U8_ukCM0iQEx~QfM_HLLB-tC0GqRttG%K zxp%ICw%ONm$M8==1T1M_Z_Q|haV~`0?EeLerf~=8?GrL*lA;9Ox{=OVwBViHt`pa) z+mhAc`yu^#zob(xA=r(dTO+(=!KA-Keo6U0ww<#S+X3Kf@QZMJi`&mO9zM-*N6P51 zwftj#0BdwZ!*EED&U)C#ApNT2@m{Jz2PS8!7g_uwRpTuaOLP4!|M~FBcK8m2)mZ7j zB`IZfA@e^_;jL@IcGb$;Wp9)(2Uo%tZyN1PuEHyw_U6^YaLJ$gX?t75yxq^pJ4?Uf z7QjYNnQOV)w4uR&a_x4-R(|J&+Y-U@zZHNv^@=mo21cpEB4Cej*zM36JZ+hE{}ODk z_Qm#&myMxF$II?>UuIXm8E2ou&Na@Ek7H(LwnyTZZjaQ}CIF1TP`BWKSP|N{dW!K; zZC{g9HU!>p@+W$;MtSE@YAAh+A}R)nkp8p$@2z=^d&N7|U$w3&o!@5+`3sg$Zp0sC z?Z>A@T$XnltJCAh_U(tQjuPKZJ9$d{gfm(0b5XCXD|&9srSK#Etr{(b*SA}$_QSIH zH%E^{6SoQKMyd9TgGNC%c$c6Tzb6Rq!+I?@o)|zKn>C+n4R5A)I(1Ke8N{B}_iIG@ zvkMdx=lA$8<=5TWpR20qnJwLE-BG-peTX&fbqh+B=hE zlY9@ieO0#<2fnGk`)YG6L|<+ujnws@f!*Ag<#o?!_>loopK&i5+`9kd&;L+Ag zI*8gy-`WV0*JFl`G?QE+To~Y9gzaI*fXbf8EsvNWse0s1vV=N8H1+TKuSS*SRCaRM zE0g!-cE;e}{n#GBhOL6wv6u&&k$jMRGk$_TVqyCp(d*As>Defx%QrOk}V8mmtiZJx}uEr~D!NYuUhzHw6^>X5sg52DNb2hP%F?oaAwDAISJ`4N z;o9Z;j=^~*fp;;p+)kDgO~zG{y|J^E-^1ip{$)<(^@I4fPH z*&3mJf;!|8k(p)7W?5&ss`YaRj0kfnSH$j}{wxgRkF9vQbiIjIkFCAHh#?%&vM9gB53 zv2BJQIaW+4*b?`PSlUT+vnP`@?Ln9q>KUcT`YS?UMjq>)5QHU4MGa+wo;ay}^DmTo z{p-NpPqqgOmOoLfunb+VX2iE~`O*-RZ)zIp-1(j=59;wVPE#E(}>i0 z_g0;vOHcWkKrSP;^03dyHJ8{qWbpbhrF-FY;M{mwe;cOnaIpj z_OVz^S{Lq)?S#!>BQy=IT6cxE4o@Da={LE$Dr`iyEv~+jb4|wotC0IW+HJm8U-O5( zh4YO59x=gQ+VK=u`ZVmmzLOh_=+(6~zggtfgl;#1ajr#Sj;ImjZy*`J5|)_Hc%h_d zZgDltL1g}D)ERpFsMa!=a9z&Z*qgQoF?bjDTZ+4Al~EQf^EcVoT+Sq(8`cuOb~ll7 zC!}jTnp0INThg|y%mqtyWd_*jkDpcjg671^*c%#n_jC8*f6on)5*bIo=6o&7!-Z_~ zvBFScUEhu6mK{Ae*_&O}zP4*wt66!3xtQsA5Cis!h>+`6aU|@p;{Fj>YI}?EnR*F1 zT9%E^#PaW@A^P@FC@Gt8U%#ES0vdPlRwQ$%ywSqDunG10DHr$tsTkiNlg36Y;YM+1 zU%Py5bK*n3cRqF9wabgS3c^_zQE2&7KeJMWUXO zLf%GfOO)lspBHMS4{6(g*YTP9j16>=c+)}Zblb~$S0o7GGYV0CNPCGJBcGj%e;4^~ zMa{Kftd8|H=LnnQ)Dn$uU0CiS%4)huRAz??TfLW%E^kiE*Q<}*T6^tsw54d%>O>@@ zYAerQp80u3OxrCd?NsbTyAyh6>KeM|czqb5vbE$+)Qe(~K^L2pboTutB+F27O-MI? z)-o4$ZacWwzswleGPk=)>aJ!{hBkKHia=Gh7ecyjjYNB+FN6#^Q+=@!s6VRz_CmCL zc3&XYaW5RH?AUv|VekPmb=R|!J$E9#>tffixJgZuUDZd~+P}BRIh1$DaIAeJTAAZ1 z6nM36lC6FbD)Ln1n|x{J)GKj_e_t?W%lv(|n_x=Bch=b73BjC0$Q_q=olCZprpx=5 zKO2L6upb%B!=LH4-0@SzaC7y!{9=3~<7~W;Q9C$Pr1hH7x-+bSuX)&7lF_Ms9M(VB z?Pc6M4$&-D^gL|c6i91+V31DRPU_^AExQxcx+#D^7i6Y5CkvU{PQzZbPe4<8@9`@; z)qcsG(SzqY)o(Bp^BDnqOh-)77F>7knot*G`Gwj2F#5_m z9oaq9P&W;wY|ht3_nT3BHw{y8XFR5_MyDbKnzMQ;dAHo~Jitan>X66Q(<3l@l&$6S zUt+uA@r1>Svq-T>FcI?zkT0`be7h)gy@()s)g&&&7h)7Y`TT4{szq@aHwtw`gK~wI zoHchaPN;OFbUoEAC=x28WUJa@dAAUapZrpfGa`-QCN;C%nMd(Ssd{_UDYh3j2J^FA z4|LJHAt}OFLda_&V)sS;gWm|%Vs=Ue_l`HV5aq?t{cLn0%aw6Vkc;0C>iW%oa)u>E zNOINr(K74j*cYJs;)ljph*?Ns`k4~~Y>7y#F!30p6b}#CV5b~!)lb5r-PD1!(WWuj zIXAVx>MO1N{7tzpEv~JNMRBM2%9qLryj(oRRp&1CSCNw!bE7~GbMViR&@ci1G=S!X z&BY=HoDq$`YEKXY(TFIq+-&v)Y&$BhpkH()S-ro&G;X?@{=HM(?Ov#VfP59#zh76q zhc_f-DBQJl%NPgjD;-%bT%4?u$Iz>rq`%{a%kC0?j%>mIBalvKfiUlZ89*) zZh!lRdit9F>w%B3)Af6}*|@J}tChUlS27kepVhgFR};K3vYU=^(wr;A_ux-`%3^3< zD19G4u~`>l8$VI7C*cCEnbKAH(DrY_Hu@vP+*i56GO9D7#IF?y6Y_&qQZZm(LHiKY zKNz@z%cxN`uKSkMXriw#)5W0T1(;0au5%@wf;`yGEZe#;`*)Yl2y$?~=6h?3HM%d7 zgF5@se&AiHazb?$_ZIt(n-V{J1QuP+^y&5fr8^R{7BN&!`bosN$6haLT}fZY z9W_w!0Qt#Vf5Vi#tLPW~^*}QZJo{p4QJ%{Pt*2J)Qp* zy6Ne5I}xq)lUE`smuoGX5zVFk!IwyiuY7ZnwsIMFG8&0?*IX6iE=Z_QtYY}sK0`Y$ zwGlSWf9Q;){P55mla22bQl1<$>&IfDZo0-}tqd`KTXERRJ0w#qMe2Oy<(+C@{!H}t z{7&O@GHnv(6hI3tcsBtvp57x{W%>CEq3bm8vxuIJPr+mx8A8Dn zciG5q4EGJY_O9Uma8f4uA*H@`({x)vXTmQ5x=I&J>Z2+RPXiz|rNT{gFRUIH7i(&A-=E&-`$)qd4 zY*up6sb`rN>b09r;~yT7&{2n3R|7R2LB<0JX&--STMoYjFA(ZnGgn$&1y7!d_uP3A zR%K&q?%_qMJFgV8ouy&SihbV_kb+Nl%ok{&Vep%2xPGfj^KbWs!ASW0AEnX+fiS zL*C%KVB_9h=vFtTe1(c~DY4%8?Ai(aMP>lxIu-pRNQQ57aE*=FQfJU)B?ehF5n=ZC z@P|g!(Bkx+ru6Rm!M9Hev`-~uapD|?xAZ{-NA`=p6MN@QcLG)8YH~tT{8YF0o=Q0; zD8oJ7m_EsK%>Ed~U%o_k09YyCRp&uIhml3vFbo-uT2{{s4q`>M2Td;&%E}W|8&1tHRTmxzX9gL)CX{3{G8p z)5_ipR0Y;55&e5mZ*%)Ex(i&e1*p{P)Pq)$-32QrYt(*n^*pF2>jzL{Wtw+EttA`h zG}cAYG2P-Gu1o zYwdmI@|@Lh}j{vP}0={6rUE`K{Ox0=ImNxA}6OAhhRc0Tp75pUQi zC+jZ9S=J+U`CUfZhMBt9mW+OWp(0+T9@h%mBv2KqrNeZ4dF`{H>5R!dHRo$B^B)zUn8wL}SgW(lK>`|r# z-PI~;s{VFdd4>AhV1s5C+8vR700;H5DcGPty}gz@7QOMP&?aH``8-(S0u3F1jyuf$2O_Dra{sk5gpbC(Wz}AD_ zjL1NlvD~lQEcU8Z7GEUuP*$i*<-i}KB<$LbP%36hX56nAN zZ#{Mlx8YnjH>ICsA!hKE*S2n#Gh!^$5knFFK5q;EH=``NZ3#?l9>}YZ&cTKxUqj+^ zkABMpA>$ywlua^*CO*_Mb{^bJpNl;zm$-&1oi~Q$8W(i)J+aySL9U@1FOS3q>-vM$ zMtSaywL?$+E-7VieKb@PXSQUD!J!fC#4m$>uqYlBHbQvB6y^eJMBW zm{sa-ABFDBjv#3fgD-9THo>=uV8H}UW{{DL*vDFvearD;KN_gx`jyTWlk-TN~}ItLcZdkFOp# zJaxw&xw6tCuC*rl8(O6dm@zGXmtxEiM+?jyRE6q_E5w;-PmEn-bM?8U;tSkK25tPNPslN9O*# z(1*r#LVMg)v)ocaj^u-5-BF4ef4w>4L>c?#iV-h9V2h(Yvj4BraCV-Y``% zg~{3|l3pv;Ukt)B0wk+NtRUmfB7EB&S??gg^$VwOoe}&sTkEOaV*?(%_{eyBg^XFO z^>r}qP9e)ZRFT$v^^pz9cp+Jwl&rZrp`R)t^Y7~V!ehZHu&Pj0qI4^o&>&}UUtCM) z^$Ep%yx4^3M-7 zv=HPmZ+^-Rl#p77M@KBQx!V84Qf@>jzDIc-${$`R8&7Tl@SY-~AK~V0+D4CqKQA<8 zTVHqwlz6B(IY+Hui%xB1Wz$!1OW4?}9o%Ak*X=h`u@+UK0c<4JF0bwmS4n^^1u%Lj z=>c~gx(nq15+!9!wb8%kzKIT!1_AuQ7hho^^dn%_kHJ= z8&NS0Yx!%7iv1ZB-~Eg;xbHjqBiqBxkSg5el%a&;2K4{3_>-Xbw^PJfT>#L3>+=YOtNDDglbj%TK zCp_p{7Di)ORwAAv`vYj9;Z7gZG0zXpf@Vc#LMuC5nTcRZC+McV;1GTDt8&#^_y%m1(?Y(rk5Gx8xMA(;&OYJjys zb4%UHZ!xQ0B_4j_isYnm`*6Ns}btZ?U$VZ+jVU{Bb4c zQ1zXlu2J3e<#p%3ju=@bVjNkMh%k+F-{s*YO{qe&Fw@9Woahh6dPiL#q1Lp7ULxyE zY5%_JT#lEU`Y7l1cV3O!KrFI-7J8MOpz@VxEqIs9mW>>&mCssib!F|2E_J1RFCYIe zoOl|qa4@0gX?_S;Ix~0G--pk60k({PNPRw_ z_sWWlJ^uZc$Kr?jszrWE^*_Q0!3Q^vjS2@dHahEXQsLlBIB11~qv7CHxH5FwaSba+ z?P<J8Q@N=F{ zEO{NIRJX-*Y~7+vg>Y~i9DW3cH@yf_GE?Bk>r!|~Z=r^DM1RjR_;Z84Rilk03@+#X z6!flu7tMWW`d8}j?b+8IUqkxOheC7q5EOdeLt(ap(o%4$&P}_VRVgbQ;B5ZAZ2Zp+ z+T{yRv=(fhE+rekPG*cfE-RZT(#<{>@5doYm-W+<^E-KM{@yueq~uiW2<>-X7xaUE zw8KEeJfNLhy*6t8iPr2%ObR<3zT>A$onC*P?2LY`s&hUrbJ=hkF1!(!?EHtLPz8m4 zD4hKr3VDvg5=*K~8Z8@>{5n9_ac?$9^*pm)Kl^2X^7d%+K2B>J6rR9Q2c<()@MBwX zgwAxklgIr%PE~hxQztJXEng<~6t)`P*v4Q(fBXM~`SJZxFSI-JawJ;it0L3(mN{Xz zBRKqT)=v|vM_FfMuOBL;n|1rFi@Cku829R{8d`U%gEdU~`X`FLm(K`3d=q8|9Av$D z3=qIK`S^T15?P2ftJTwOrx*XiSlMRjjb0+FihO({)=`wO=dSE6oYL2gu?2NYzLI)qXd-sO$W zwqPRGXep72Z+Rx#ljMe7H~dPS&~@vVE9#XUuMlQUc$XJ?{`Oi`fbC^yg13GVKcs66 z76>{@k$=nKFMGYr+#G$O>J|9Q+{L=Mj&X>y!x_k0W&^X6c4|*abq*ekz1ZD*Rj~lA z6D;T&f%Ti!<`y*-Yg-c}RbA^LQdaG^eaLfsyz*#R@AD=_bTfQdGfYTFT)BGnz|=fj z>qH)!vbV|pOND(wj9m-Y^>6E$A8KMI4k*fdi1dbM%Fu~cxFs{#gjDW#hA;T2*A0k@ zkJuZJ*g`$5w;feXw(HgoI6mJDh%`s+nIR_ltcsDapW|?GNuDk8rgyRv4>eDUvU|rk zKAYfK=$}pYlNI(^G4|vb3I6ZFCPiX1eAMT9h>}}hn6f5XBlB#$T5j74Xv)q}1GxLV9bQkg%zoA-myaA_SWV4JKcV({z#c ztBiuZUntW>H<+P3{B;Em{a0wRFANAg48 z@Dx{Nx~h-A#WQqqT;pT5I=0ZjTgn;!DolULW}>l?d4?{wUM_CXX>aCoc&vsbbWKQC znY%6oD|aUafrW$-gT$h$vPjca#Te`*A%V6Uy;|3aw{6|SO%_ptu)o}OGq7v!x*!K+ za;NZ}X+*Vt2A99myLf18e>LKWix3Lg+VDNxx2c@AU8ttx)-=?*k=-k*j&w5Y5>g)M zR|7R948E2XB^!}UR$1a2qR|lpC5X0ZhnwN3-geD;Gz6 z#tJsgLdDUFIN9jZQ`JsoGfa`-QIii&f9%<_P3U>|2BQHW)ZBr5m|)64%TMbNfMjeB*}c|r)`eIe{Ell+LOFe>a6W0ppc$F} zgPf?_s@kYNm-@NVUCQDyO*SNLI8G4`kfpR_ZSt1VT|t>5(x_zrWcjQv8dg`%B&$Y? zg}PBJcO@-f9UGWDLiY!~eGKL*W57&Dy{X%mA_|2GxX$*4B5jpr=1;e4d82x>hyv4C zOWA_DTFDfRQ*W9LX7%Hkg#8~2IoX*-B;36XZ9P!!tRkx>7wpk0cF3od_0PndT%xT+ zu;QjCFO{u|h~ge(YZpDEV-K9$>DY*Bz#Gnha_$Jl!YT=M9$0v_Iu&l1!aj{>rt&XF%d%XaJoVpQc5XnV;CwTM<<-_w3Dn5J{p^2C6O)%M!u~??B%6B*YkOmi~xao+bNcADy4Sd6) z8uiaYQVy6VR+m-u)&Wt8e!4UA*nTdJ@zf^NAMHnCl~um{k$mMHuq31#0zeJZ)6&Yw zn7Dm!G%6;YNM_~Z0zbL+=KGW-V9w}LZB0t9WQYQ2v_$_R4~Z2p^6))95R8aY2iV4< zJT%dV*3Q;vtwlV270kI=A8G^@Qb z&axUw6qRTSozQN>QLQ~hqn^$mKd=eO^p~8%1wJ(2USHKam^=^FaE_MXZ<{FYp=$C) zSNlkqd`gZ3Rv(F&lQ{CF;3;CIcMXYly+OCyJQB|a-+6wKVdtnKc9qLJXDoU!pv;Jxe}j zy-2iAqoo|AJRE%LxBH3l#}F`_S)_4-I{wdd=`-W zH*P|T(X8^tGnMK??&@`@BZTE(5WyFk`y1&e4Sz;ps~%SNZG9n`m#PonUPOA-vB`Y> zjG_)EafnAfB>R=o=RB^w+LJla>W!`6`IGlVZ05iXdO7WLV<+FwywM~&qp%Xg1jV?L zpHDNA_efk_l`HS=jo}VtJ`f3r#+yR&m+Dh^j*!9kljgQCa%+sQD;gQw1!L(&)*!Gj zJ60PnM#x>#(t0B?a=DJEE8*`0Bl^$@h_p!E)Ygle?Ysbc_6b36Obty>X&Bt0m|@)Qx7J*r)XU(k}{HqA>jN!=kQovtkocw_)RN7X0OZ~7~nsCsb z(!W>hDsVDgtI!dZQFQ$DX2Jwix0styUumAd-I}ty#V)DW77d>G!>0K4ik%Xqwa4}E zUC&vbEd4J9P8d$ek`F>*{QwmHWS%frJ%RJj{d-B-W^lGd(GB`7yZMGNdm86XFp)mG zW0SAypgh)+BQ$Iz>8lo7&i%$0db*K__6U>+&X|-FTln7S4P+NsP$lZ)K>>T{Z(Wr| za}@5|`EK+{Shl;`hd&Z6S>XsWi`_ynC$w_0+H`Q9LMRx49b^ImUug*uN@qAcowiY$ zUGAZpvag^?5@b%#7w!aWC zMPecI_b-*c!H_JVFwHbwF7DdfL$ptD1j2iZw$S!4eqq4NG8BJ_7^SE9WwSy6+#Olo zBNetXs0*!evPciBN7{SOS!nJVvF)A5d4(Up>ocoIYT8j=cj8TgpM54EOb=6$j8=H6 zWKe={ZORk`=vrx5r7Ou*;!K~aIAMPN+X+T7E+yQ9xP4pIG*`h0;|9fV@{z_)5gDR+ zx=ipBs{7oo*cIP^TbLMlP5~aP@NwXwh>8JEfNdehWC{nF^$z7%t%BGDFXNQ*zHVM; za#2TI;~EwK2s!uy2iMo|_a}Clt|)?AQ}pXOKqlH;j5a{*zTgb|NhSUUf7$rdCdyE! z?bjt1<{ElDBUv4Rb_{)QCG(%Xdb&4XNLkE{Zq~Un#V|!UomG?NL>SI)yMK*(yk6=H zcJyOw-!v-5@|Rntaw4y|+i4KKH8)9#lACiQ?P2Rc)2hQp7!n=cub+N2$!pYWd1a^i z=V9TbdnWxRPUJ;52$XtbpXsIsn~qng18pf!obA+r^+YeUX7xJ{k4YNG)BNQt(cd#p>P_13741svXPH|B=FsSv22zn11h>%Cd15ya}P z1^8>h``-PP!cjv07`P-3~UBAqopnQm4Tv?||ghoc6_?IwyFb3fah zv0V`;9|?>jj;6DdlIhw!zCMFv{V@na6dH1e@n~z2)nusUJ|B0Aq9`6rLx|35g0F2# zb+jzhTM;{ywO!$}n-Nv&s-ECYRFe87Z_P7IM)?(H&m+@9?0xw~d7R~a0G>1*ePZ}M z-rfG8V*}aTP)$_l;*+q*MS{RU8v!A&ptX<=8N6(CUqbH%`8g(LFfi%>IABbwr zo$`w1mRKRnK{}>mw)Q@tYjsl-GB#LK`m`EG7EcR4kl@aMz@}$5dAKblQWph48n|7Oed|FFv7pM-Y`4LpFqN zB-=wb))`B#bc9f|E1rInzSq$ck*cuu{ODA@Wlb*rs!{i?Jg9Yx1V4WNCY>Y;l4hM& zBuEY!{uEK1A(5rZ%TPSA^iajqb?J~ul$Je6=-2lQWO+_T?|)&mN4H!IrcMZuUq({w z%gystRZAjnjmr2MJZ6xKU?UC82Ykr;1@ZKkpNH%RX{;kltECR?2}njL!AD~4K@by? zSVvoY`9u`*rTl3oi;re&ufLmp^Z*1F@Slb1eEgcb1Tqs+Y`bdPBz+91_)tY|#vwep?*O|dhh}8v8tZ=k%^>ZEmXmg&DL(QmNI3G!eq?W; z?JIUM9*nyZ>9(MOdI&F74HeYQWmvW#o`sN$<)^Az);8K8lnj1#t(cuQ?m<3o6x?OI zF>Hr;A3pqX)cW(r%9S$P=>Ej?DS7dhpKG36&0L*ib>g^ZUQHJ`5*%o=($W;A_@uPn zudo}clkZ{?Lzav7*9x^S-<#%{srF^EmbBe7cdM6cE#YgEeUf8j(G~^&fO5O8P=Do4 zf~s-}+B>2z8{g>sn=F>wd}9My9n>mVIKR=q&G67I)G82xcjNpjnN|4}sTeO2+@&se zaHr4ivYgArP{aCPCfBIGZG6m&36LzUuiM)?hs2AQ;5}(3#9*cmcp#b&ukA2LLO}nA zSdl?UGS4%O1>`JP3NbjvJq~I&gBK>OuJ`sfx)~un7<4JLr0GuT>lK@x)CKmg`zijm zJCj$n+5Ttdqd_LQS8+%en;Jo5R)H8i`j8o-9fM`HGsM+3l;Ri6C-mEjGlEn>n8Y3X z!1!JfSawP$(NQ2$!hKIlRs2W5p)C}O-`86G(3+=DwI6yZ%DN5pDZeXZv<=P=jh%#J zt+^x9^wte%$?p5QW|EK6Fa;|n)#_uBT0yNrDWVGp7y3c?4CWCY{=%0}l@rwA5DgXV zd!I5C^+MT}{fFed({}og-C^%!A(cL=MD!e-wfk&`=!}$7!K8kjEHEK- zp|S?j88Z9kNceMG>^WVwy1?CXc!|@7WY%S*wcURB&zvq3CY0EN-d7^@{klI#BOOQ1 zSJ@6B_6V9)A^5fDD`6Jc=@L@AY*9>QwCv`B=OU4=Ru(t0)SKCQa$QQ4CD!c;p|OEF z8TC%zgDBXMWoc{D$0BK9U$fqDqBb=L5i=K7QeCi;vmL=;W9O{8cr@0cY{EQB_p!ey zJ%%&R5`(A{(14zsLi$kJ8UMwWhy?n3vPE>GU-q?7Ie)O08hVyL(Mx-53%~dx34Jo< znbNmk_K@VKN$^RIq6Ng%ebXOA)LmI-o#v;cB-U51h}fKKT9eKVknCfRF&@Z$sQ+qh z{|;BBkK`mMss6XFtSd_#*BX`rZfV<;57%CaE;9L+Mbm1ciw1MqN=WN!+51dc-f#Is zq_dBHmpiydd9rnBt}$Q#v|TdK6B)L`b>uxz_A> z?uE^{q7w|U{)OZED~5;0Z9>D@f-EsNiGwN*#b@K+1-y%GzAm!Y0p39_H>FPWD#ksU zF1m{o9sQNyt&S%|lh>vDq0*?z#j=b@xPAxGepkJkj*M#(sr?OGMe~v)(KmaZi7U1q zIbIhM9pO~k_T@%0eVMm(WGZX2;{kOKJJtuPHswJp+UE8{LQZ%SHqlFPI3jrj_Qd^} z@=Ff$=!1tH&wY~j$Hz7A2Fa2_qweH= z@mG4LH?RkVxvdqBas7!Sn}^JAs`r|$%Q4m#S@WwiCpg+oNF1V|cfiFTQy01Ug+e&o zZ2M2!?S3k3H8d~1`VWB{WpU;Co|{G3J69IhV=%4yA38k4zbxlTRP*(ttD%B>+-FL+ z6?X0cxR|v02oT}Df1x#>?LmbB^)7$UL^?RbEnWhTC@v>Ly4{G1;VTw74W9d0wK9tQ zO}hJb*Ea!hj_Ffrdok1NQz?>jQ6ZT4>jnXCL*tRyqBSoU4%L^O>J6z1XwiK@J z%>w$c$56{EI);yiUW#kE=?o(zxC%w7f*+l5M_E2AS$?SuT%z4q0h2e?1E4L=6v6IU36%$pIEenf9y zYIPOYopW>r=QIToDbaOd-PAZa5f{zA{vJo*H5W6#ZrrGKG}T(*ANm8p60ODvE2Dr03MOYfPx zGE~%Mpc}1}a{kdZL#0~_O}@#w@yna9i`M{|-5dk#&ipSF4L<@$br2QK)Dh-1Z|Jc| zNOvwBt>umyOgsF?Zr~W-k9gaL?N(paeRdHHf5MI{^IZUM3$n?>OV2qcRy^$Op z@%}ey8bSygtzXw11u=G?ao|$MNf5Jd=cJ$aNy5ai%Sol7at`X z3)86K<1~r^*-_~d@HwSBwAl?i2YT{!t8M1HTwD=dXWF-xj^vQa`9i@YDkr8gDuU}W z7|nG_|1k#8W3G0Okd=G%a?d*Bt+HiSS35188$`QiKU}8#B+QhDRm}r z&RbU{j|4YAPwcbKhyhLJ6DGoWV0#x{2aW-dF$)d5F)r*yVffgA8bnXC=J%6&3I6X@5tQR z=21EtYnaue6$;u8->!J-t7r$R^Y1bpp2t7i14)No)Hk_Z{6%ZQQtP0f zvxz*LLjR)8G@OUNoa@OHiF4yETWXlACR)qD3C?!{8G5Yo+<9fK9oZ!K8`8zL^k{^N zk!6Vko%f*NPV(_W8dRp4aVYy@}qeD4}wHc-L}U)+6N8VEdX}$y;bL=Q$wU# zyBuKmi&FL#8ErZY8~f+ad9OEcync^g{q6vp=S=fF1At#vk>FEy@Mzk8neH~oB)iwC zn()(pnZgV**+xP2?PL0B?tpDujD&#(pd`b}>`s3Wk5 z^l!-x8UKEhPDKh5=BOE9GpvDWSsT#!R17u>z2dMZ);Xdv0X=6I`^)+I&2v3qk9;IMJ)EQ5ueOIXcgSO1- zoj%V&jv8@2m4o_zq7y(ATUyWmdJw=L2#1*st^yQClzdjY&(SIe$`3Dp>KK(Byp_Fm zFB{ky{|e6Bc67sm@qw1vfbk0e<3m$VOa-7-SKqPTaeYt_b!ZVsHare6(H||Sy9|*M zHF~7Luw8HlU_Oj`9Ds<9PVB$KR00?=FBxoU%gGJR%L}o0ZqUQ=fW)^skhr7u1w}Ru z{P;xwk3arbec4QLB7~L{_Y=}B1zp(KPa{Cx=q(-Xc+f`^;*IuxP000%0tW4MaOo&fK7+vb8;l~IA45L47uge^)c$M`h+M>*1HYDvOzsuFn)!cR90G=BurfSy7|~AZS?7>l2QpNP0BrvM*j>l<1Un^6 zaUQ~5fc2lAed>@r5UB(BkAVB(p3z7wT~HdYp9t;+7}2)3f5eyJgz|)8t}nedphVQR z-7t}YRs#r%Fb>8Kb7pwbwP*=G9_CIMLoh+zNZIi@pB`i@2OR1cA{gZWi8tK(s68EY zPs-}ZPyGpxZmB0K-;0O!Kv1c#a$E^M`TzREoefqD)T^4j$IFE1_JOVkWfM$w!#vBM zey2W5455*cs`hE8hU*41l(ty!^{M@202us#U(MGSi=Z5KOuu3=8{%{BQba!o+Q5_Zi|B3Ak>dDAP#(w%R`KN)c z_WG~)jBE!f!Qh4BX(-ro z?Q%vvZ*}?=Mv&GqdT~eb9!(%xuqJoZC&?wkkPTOEENn};C0RSnD4=p2l(F991i`5C zR(zC`Z}Z|y*dqnQO~)z=<%!t;RUb0UlqbwLxk*OGBUlaesp*oFhWvTj?-V})f!1#B zx^;=0w8){+xM=P#I^Ol8FBB6?g?LbRR?ZbC0eGe@ClBC%{?O*&<9_>s#;KZL6_kzB zZSP;;rA!nn?lYf4h{$ckIxe9XMC~&iiB(V_A@#h}AC=ro>zWW#SJ{2f*2%e=xlav?cTudX$dEEQbd&ituokRUJF? zj>gJ1tYWsF{^$}a8uzqy7P>I~WnO%4N9jPu-=?Ow;Fo_Q;F_rV(_4C%kj;}fl4IM- z%H*@%nI8>J>E@I2pM{~rp13E1Z%r@Bwu$K@V=Cii3m5QS``EI2zVaxYlqy(Zx)o=M z)ZOE*OLs?MhhOao?dDwNPDxS5JmlQ+x7r9SbW$aCR7~a9vbVoUA0Yyl(!7ceR~GXZ z`87Am0c}6Huh@nY1K_Jq8#WuTZQq-2t+IUHlRmL@HfFp3R_mR*bL*w2iRq)K5lY`{ z4slq~mkP{ht`v~VN{`8ByXltHeFLJQ_dG96LMzXfUCxU?!mf_sdATZFsTnck>8cGU z<-6ULyW*sm!2u-l?5>n%f<7X zAVSlk*`Yq255FMgfkc-M(2?84=j^_=19~!s99xZ$4sB2XZDC!b6+si~kSy6TC zLED7qH``t5`kxwOVW_yje_{#nx$}@JCOTSAA2nh$g=n#bVi5NLmAz zwP;pP@kHxvZ4~{D;UL7wz8G+1X0a!mPT$yOor!fEz00M?y_E`6{(^|GZSt^z$|g`} zYsQpbsz~rxy~wuZ;Zu5^d6XVA9)XaxdQ>U+UIWW+kFk1SDQ6320QPkP)+gwBP4#E4 z4kRLvd?BVD+c`%KLzJ2_6@FAMu3MA78GU{g?q}>fDg||ZXBL#9ztPP*+zAWe(W(Q( z;*?v`#B{TdNgthebnyHZ)xSb`y1Kl;e&Qb{B$P)9Vl1Z&-_wGr9%v~QY6c|e7@|6D zGt*5nwiHl+(6Ae>;*J`YCj2`uxJbKuRqLy=il^kV?08s(PjjZeNGr7Ev3Jjclgw;~ zb4BFYau&KjZrCI@{ug>7*%yDd=b5NDu^f&s_$WnmGypfp`-@Ey|-M4oku#CORumyU(9ks;|&_T`|LzA2j zoK2tVkfBcP%Y(p|+Z=wSg_^WbV7QQS$IuLEW)ILc6ZGNb1!0W00%5B{WXolHQe$E& zmqy$o0%y@bj?H7%S-UU4bImES!wq5006z1a71#P4L}(jHeh4aO_oRE2o?`zK1;Vhc z#{n`Q)yf3U@F+!gyzLRNYTN#!t1M$a3efuxz{9$aqoZL(!#%_=4UXaQ%mmS(jiNg2 zvNpK~wBR#pWK1PPwr8A4qTf-rgq$V+$L=cjcH9%*1c-Pc_QO=T%zp8#eGQ0^-hKqS z@I`4<^F<=%XCQ&#OMA+&2o;fmQsBP_C@g%XcHF-n|B)91-QI*p9*n>`#IOb-JkTp zAE4T}$DA^ULE6C|pnI+@Yx@8Adh>Xww?BTol}g2=NS3h_w``TN4iiG%V(PkCvXx|V zOH9aMj8GX%R4Pekx@}r4AsJbQ+b~3?QW#`3Ba(G2W0>vxnm)hZ@A3Qn^ZVmD^FFWF zSzhOLw%0lDbI!ZP_Zb9!C;tj=&hX3YS1jBRF#27HrppJo#?)I6)fw{e-m(q&()jm2 zg)@v>(WL10J08c02*4q_!c;lRpWmToD)iPg z6^>lX5wC4(C0;FDj#dZ04?VBBz|5a-re!K*shbL|j)>ZPw+g*atQUWFDx>^JmmL)O z{yju;jDw)M)Wn{6zns(i-3NbT3=8|-VI$O}-R8N&gh`#L1>Gm))UN)-sAQ@lId9+S z%mx9no;YN3TWsXJ zL+JhXZ+*S!h)l)?GTn)M%m`c zFF)M3SA5k_=pA($ZR^Q53qOr^1gaCtKST22wm8F&#Uva4E~vvd#ci%P#YXUNgs60- z?K%j0hQiC=3VOZ?dTt?_ld7l6_a5Yzn;qnvk+%w2d0YP%6izq0f_9addBjs?W7wFo zu>v!1ez~q2G@C|Vr!W6=#jbTFoF=-Ii3Bo$@ z%?9uSHMbk$bKvKk>kaW3{AUz26Zud7rzQ84n1)$(cPL)KAwVl2|9Kfji`U>V8wL)? zObd$3)Az(TfQx`8pv3{?>1I#aclCw2dHOF& zHPKHASk;I55f22pxh9aV38V{v^=WYs_AS(@w_^nseta_^s=4JrmI1CgaELeT9TN}y zu(xBw`*>#VaJc!HtRa37FI+gr?|A;6=<%|Q;(v^9rcI79Am|gnNT#ZwV(9i?qU66A z!}`KOUXcc7@EOT5cw&H><%JthZ3G2z@7ryS%8d(a_5)JcxGqsTBtrq z$lC_l1>6IWw+TnuZi)-rZ;EGwTZnRWKY!eQ@SlN|9b3#9zy`k=!=4A6 z1cU%$-hkLXP&s_ye5LcD}$Y-4TMh(0>xs-`uEBI>@JLLz= zc>4HU{PG1$x)0+&EXP#qN^G42-&k8KSEznJi>`03I9QDC@cv!6*<|h^oK#cI9Od`y8jFo&vk^FbCl>2pc$OR{QcVcp={H zzRRDkn$$(2RBYfr8{`@;toYMTb{ezAKv%1zp+?W{>8&OU*t%UQdwIzEIP!;AuN7&I#>hhL>zYP#{&FEBX01$>O|&t#Sa> z_y=4^QXfwYn6k#j9eS@<*Z*NVTzaw|q94>OMlWxg|0gEDWdl>T z0TCabhgT+g6yFg?mfR5+`WXvH0*r;;wBvlUx5xSAF%@IjJp5X8wP!0)AHd&)E?Ov~ zumDaRV?hWrM_kyJBaR$yC3X(A5*KGqqelUcfbYtQ`;LvP8^cBeb_ejwO9UbD(5^8A zrtwrRwL-y88Eu%vgi{T;-^UFmCNDGTj7wdzV}B=B*d-j}gZ)so+)f!;t!bxhnmnJH zQ(vxi&9vBJvW2K(%fj?#iwp5(lwt#+`wX1Z+*ao%auTS;K*|_?`FIQQqAiO_&lbN{ zSv$kP)v{KWQ5FD=0RA!-^ZhawG8#_%yQa>kR({9E!{ck%>QV)$1ylntHT-n~!iSxc zL=a%|(r{{69f(ts)Jtb1dXk3gznu+A_y>BfeH1}nwQQZ5Z3?Sw!iwB?lwuC%p#a|c zl@{L?xA+?hvkfFe<5LUASxDh=7G=$7J#rrYdn(G%QJg4&vY(-_qsD_@5MMNg@#GmC z6^$rk2C^!SjIdSSO9oZnOEvgaDM^p2iiS=YzGJ0uaUB!S5P82 zWqecIVsaDqT8I6IjJq+0IelX+tNH-H;LQO(BVeo0-Jt&x`jhTyn$K2Yhdym8o$PUTYG<19;vK2Wr z{Ekv+DwM7JrqzvQjkikvCO{yboro9DqP#T~Dle3wT?6<9z==%F8Th{xd#70vl+!F3 z1a#AjY)b8nZisQ<_yP>Up`e6c09}qt17&Cfi^2!|-$l}5qB-O($PU;cbO)>Bl<95p zbEDf36ckGGnPSN30A=Ib;t()dLV$meH2fVCz+)WO7iRkb0$?|+uf7o8f&VZU)EwqB zfava{FXWnLi=P8RE|BL>#B1BB)EpAwVH4fLdBNeDDOW+wea<9Qcm~uYiekPl&xl&< z%bL7nDExMTRk?-NaTIMgn(RV%6m&pW&hiJGP8h(JL7xvz$In!lTMMQrhHz#2wBe#!OtIX9fCn0+_z+KuING3a?~Nh zD|x$;Bd|$rC~iN0%@eZcA9f|zhpRC);#Gtp!hp|f2WSLgm#|4>03^_Xcp$3M0tfX)%9gBf97-bW(r?fH^P7bg>d1 zCjMbDd;Vcz5};Fy2fT(3t_t8vuo8`3kW86*8~@I0C&=5?OjLoR6$Q1<{PHqqeutkP zB&#PJnGycST-?H9p1C%L&4#;#-dH8fRE2>9Jjsfw2n-tKNpyxJv}mlL)&l~2Kwz*} zeGEb7+aNO-sa{B;xm7|0C87v=M*#SNu(^H~ZMK5k00W`7uYoWGT1jCcm||Tm#LmtZ z;^Jr!dXye7P{T>4%B$R$Nz3W8wT}d)R1@_L@Wo)0MY^DAo?cGCcy|uSQrW-%R~n_1Fx4pGgaQY zP+u7Y5(n@)dj1gRegm-KU`XE|!VqQC2IhNbkoVCTHuTY00qrQiybf@%=97c83BpY{ zvzS4^l!e_2VF7HI3~VK*Q26?gSA7VZ4Pmn(EKCLhH3h6eLR);5YZ>JmpauNc;b!_M z6)|`7h9zZr&=BZmQ{_~c5%k0Siv{zr^Dusf0+hpSFG;S=?3({!-b#F9(Mr4s(1*Tq z4D##)d8P~JAF{jQC{3TPFeL1TxbWN!ab#sPaS`TP-ovs~jmsz>0ONpffEE=NvyM|x z5p|a_WmXMiDD4=(oC@Z0Kg_3C0KNVyq*xtx3Actq^?C!%uo9Xf;37c(enFM=V9h#o zQ7DuYU;)qw;G45BIrx>tPD^A&!1+9A6oA(-EvN$20;*m4W;$Sa$2VdOZ;9KkLeL}p z^37nQlNdw9qo8|*(`Ye}wB8e){~g1c-4dTmfkK8MEjL^;Bq`t&M1juvpnK6ZXo!r; zPc#JFL>Xygf=fD;f@+B`G&ng3bw)DCHlg zL|Z2sDmkuYVSK>tydZWT;2(>Yx`q1&_vv;S$kk(B^EG4Or@hJY7J42bYw!CO+d4aE6r%a^ag^r2Gh zU^}p5ox09{D@guECMH}j5z+Af$`S1EjDr2Z10={FwaQP6!M_-z zQQi9kH&#w*X7uO??|cKWb%Y*$I>O+|>+vtguE$5Dg1s7=GL}bkR{gbgZof-%?)>r~(j5sz<&cli&pr>_fS_b$L1Y=2-r z_OE^&f4M9;))X;o_pplT#7d#EuXhI;dX4e9}V9=ajajue7#aQ^YGQK zwH2XLPn^@sR-ZX_Uzwv6_w>M_6Z`ZA%t<|mpKL&kzmAR7*FffSN49NnB==FIF{a?0pELvKo7)nr_JS8dnv zI0GAcBjfpU+#$IpRo>QcMULUc2E0!H8dMT>)9ks_^tp5C>2rtajj=CqrQ{K+7qb}P z>syFboiNDYEF-Q`qWY80l|wP_;Cnc5ooKvOB(hurpSxg38i(LE4S zdGt9T*BM1q{}lu5K49Bg#~$xYpL<=TIy&Njl32GXjyA@c7psn{9XIVXOA?>8K81dO z?TsxZr_Kf19-~+9W6pxZ4}1+lxG`B4>l-n0#xpJlCf7b=t>UC%F zrRkwcqpUYTUB;{2hlxt|V$K5FPn{k+WDdH3@NWu2U}1p*&-`OY`9UZ` zeJDa#2%iVF2Ylq#i2(jZ)g-y>!*s!eEhcsD z9O2JG?9c6`CZk#hTvUTeo+XZvz-_?=-uyarC)vaeRsXH7dXM9(ZGFaLhlJyFek7Lm@C_gUrdN#4{EKajbtXf5od(JqaOi{Mxt(FBnHUHr^wmFe<2(wnS()TJ!}Qo5vhwH% z-mS1eUY0I50_q+!buQxsx+kg%*l%nNAOrUy16Gg$dPI1B%_uy{Sp1)$ME}Bq@t9Jw z34Q!Q!7w~rW2VoowS_i3UE{^PGu#LffP+`#h1tYg`!kp552Y{zr2yW3H)3yS#5}rI zH!W0UbcAKpS&l1*DijPw_#x2N#~kW#uTiI2B6Usdi#%BigkU{DsPz7wfj7p@ia$rX zbvrvMoC*uD>0ZnxW5|FHJ=XaRY3>|Lx3hemP~KJ<2rmFnOV{_zF~LU!IBv4}KMcOl zxF~RXCdYjcnB-blMwTXSJWh4JCfZFCZ9=bL_vS>2@R1?`qKgm>SYYLBIJ11`1abLMuXj#mgHts5CpPu&T=SQ~iI;;A&J)M)!7i%dyfEILZIyD$rSk%ia$sRj>bHOC6EkuSZN9_LC%WX~7i`HM#>S?xZ0F#8*LD0yVS((mke z>snY4pXY^9;~D)NV(WLBQC$nM_&hJ>A8)!M`}O-38I`H??^;3wZQV(&*D=As88a^> z$7tHNqzBp-nL@+S)mrv#P_;33F<|4U8UZ@}%`##C=q#UeDkbxPp^u2(XZIW)g8es+ z=Ej2$kbF9>lzfqnPMm8_#jA#^@%n}TDoxfR*ZhAUF!pvhdfa4+L(M$#89P0yRl7e9 zy|LZJM%uVQNs0=O3n>29b;{nix`dHNy%>-MRj5wOhSL*o>qalXo|PduTQBbRuf{;b zv`gRFu8iL(d+?xF2#q*!c*-D^dXeI^Mn-G9$g>QtOlRz(`JpoJY@C*E8dF4cO_aaV zDgK5%>C(5Hs6jeA?`??5m)rsbZk&LA#x;1%HOQb|tV4d{ zDSzd4Bt>1C5qoH&L#>G%(%Ipz)tcxXoNG;`PZ)bR_5*&~c_PZYg?bS?d33)Jbzc5g z7^0Y|EqRsL7zNj$PUCbYmY~U+9PUE|&!z#h3aVrCdfwZPGRKN z1q?FhVO-IopZ?fT<_=~_ffq)e<1xkUfsv)$9R>wA7!>khP=G4?W*kbPdwZvQBkrX1 ze*gAm?qFCRfBDG5rzlWw$Ad<953dI z%$MJ?UL7jLZkhM&fY$Xhw--3F4)y$NVj}s?H|UY8VNku8J~un2GRmU*6k>xap+5sg z@5S`2dHQ)CuXq9m1?QS&vtvClW>kU~MNa60f*;#T$!~ICOz__TV*(6r!$9~K2+lxY zP2Yqr865iHc&BntE%6ufmQ#Kr>Kgr1W`uCo2#z*=L}*}*RZ)2U>udGYHsWKXJD19#SNn>p6XE10wphJbx@y72# zaofjoW613dmC@%Mlsz*N#zarR`uRh@jRHeZTnWft3qA5o8uZ4Vpm~49sG2=W!TNO# zbjRbHO3AC~wgWElPKDS-aQIOJ?zKZ0S<-JSO=+{JyB12AhQ+fkearZ=o|ta-W2e70 zF-Q}wMNhqgqh(T@HPQBM!gr{rvicgoq)?B<_HMxc&A_B*QatF7POyPd%r*Ge%>SS! z`b8$?Ry+Pllqe`Na^mwRgO^-`01iHwBf`zo{cm6ILCOX2X#Bh@}Fg-v6q43h;D!N9M8tZ?5@S> z<*GZ+JNZWaM@XVpY#3Tc&mVAcCd@0{l~$3|I zh&+XUz7Q3DRnLiC%H)1JTbW+wfb!f zDXe35Kb&m^|0(t0|T}#1NSk>y;{V1X1M`fJh)LPDh z+L21@g<(V`GikByL5$*bC6>NmgFr4{XeH6)VipmeVVB=Jp%fNU%s8S)q=aQSF3Cn) z`q)jfo$hXCkGXF!NO3}~f*6?lB!la45)V4^D%FjSkr@6=71TU8NLDL1oI@rHw@lgh)BF1~U?ZBEGD%6BB%%9>5QdS6iR6SSNy!n48dico>C zMlY%__mYRgmE5d665qZwA3@tl)#NQ{WA5g}yqc$Nn+TgS#wEN9OBJfeAL?U!XsAx7 z%BX)8(6;AGf+H96TnN!hLy47*;)*)si4t)rE+IcGU1+FBzCsX%jgHCptIS)7-cV_u zz{@o~t;-VqsKva`BVo=3H1B-L5U9~Eh}OPX5zrSPBtl?eqj*k_7;FAz99-|fb!|d* zzA}nNrQzuA*DB%Q3jr{8g{ssxtnU)EoHXPCTBxxpEm;7ZYB|37bH=4eX0y&w^ zs?%$y9W#(p-6RL|MeZbq4kg1);+-!#sQRK8Ok_U@2*?NgFu}on=sr4>6FHXBaDWG0 zb7mig-ty-g_5t0xYFQ;(jY`Jrfx)BoyERnD$878FRiah@@Hvd7$Gxfck}A=@&pI83 zK)OTd%Yv4bM=D8J!>hNn^sE>5M@@&=i;gwBIQ1=PQrSlgKoUDY>xH1G=@uPgT;h*Y zF^bn(<&$&Clc_VfI)iq`9N7}NV2iWU(iC2Ivop3{c>QazbYE}z6&;OaU|p=)C>vRr+P~(E^>P7WctkOni8`~9pa~LQ?`TijWMzPs>34*0r#<7 zAqSOg9dor`wJTx;Z}HC|+DabAd8bxa3;N$|XgCRw&@DGfh^EjaUlajH5Ry3}WBJAf zAH}qpN*zgKwep`?7wPKg;82Er{(=fF%bcxiw{Ci^o=JtGp{;Y|bSf0Vg(KKHC-^em zPWG?C>`yH)N1WHD7U0Z=8gkT(zW{oRg2j)P6panTr>q`B*0g9F`Ee=q1%YDfOvrxG zu4V%g{-8A14?QeYfNf+aZ_?YmKxf9|^liPgovft)zH%W;18-AHLOdmI>0MILS3q0`E~+j#e^hIKxQ#@o4_S%rh#PYaOE>Ieqxo;PYRD zxu09i;{V3_+wLgFPA6JoTID&YA|z?%wO(;P#!9KHopztZj4Mv7Eq-SU=Ar8~Bx!Vq zAd$M>k!0G_CQ6CIui!05P$!BWIljzXA8Kt)N3h?dH@g0swRqCOe(jcEc6TyZQmr(3 zTy8kkTKrzej&FaFc*8~XN#BEVM^QMP-q4>Wa6B=&kFdMj29cFiD?gKPvM)=p<&~n| zdGwyl+DS*A_AY5(I-@XGgDX6v#V)_gju|VyHIFKiMot4 zqrB3s9SLQ0>a1Yz^zoOFoF4#NG%FFKUR+HPoB9%$pmgbJg2Y8HV?jv%>yn)NR5k zbThz%D|pCrsM#=PMh)0m$GVS)i@A7$?3tOfo zIe@DBltt(ErU^E0W(!;(7UEW|l8x>1O@@z7QJn6>@H{HVb+S{*D%pfH?CwRw!^|n3 z;5{;(VL_tGH(7{E@q|aDu+NdseGfmVlML)u(%LNP$?}P67WZnmG1$;Kv zGCf;~CyZP3VIq0LFT1*tJ36V76{f`7nQ@Bh1CpHQ3Eo_Uh*R-HO+4s-hnF(7$?JBK zokUBfP@JO!gV}Y2?cs(Tgd+DM-E`58>qakFnuEZ&Vf(W1ADMV1-W<#+Q7cht)L*A+ zHVrQA%9>3Jtqv^q?Bj}EkB z8W&qBX>;=lJ37H+`Jwv}rixR4a8w40NLfp@TnN1mAJv9eFBaHs8Z}MG%w*UUK5+pn zo~F^hm`;_pw%$e4$1B*UBuW@h0&RA)1EH~TN@z}svqRFGmhxP~zV7~}RJqU27#hG_ z5eZEQ)E-50{<@m4*n~hYZncsAsqMe();HHrxcKd?c*e=TvJyfzBkJ`M=PInNcnr5 zCh05%{XT#r-f82HA{9u}Kd2MwMgC9W9z6Q{+0`7$KkWH^qTunx4IHAu7c?xXTv^cI z9o<=HOtML!N1knr31;DXt_l*Zj!5yo`eoGBbjJOlx$ONlff_H7n;4sLLK@NEM|8+s#~iw0L{5pZ~~ny$dB`? zU5Q{4+Q%G8d9;-?XwL2IZi!CP!k(r_B!*|Hbx4DRoj6)bO3|U1k4gU$^l#*Z)#GmL z>sv#-Nn$3&_%}*SlP15PuvIXU?&+K%dQjBv)6AuM#I@6HuvL6Yqn*8$Hk^T1%Iwgh z=cjwwJ-+m-V+EyLPqLX_p?hAq*$(SMaJPDivEir){2wmI736$a?nZy4a6+0)6$R{M z>S-;t6_b3zwyfiJKi2WQMi)^{PP6MgA5TNXoe*x%>JQxp()A{O%gKlfsf0jIYgHUf7u|gclr?U;iyS z)}BUq+E;3DTw1-vgSgt-cSBFK3JdtQpWWjZLa39U(*&R0!Gh~$?zSB#$-9&-; z(xldZi<=sWCnV<@V$Yvgtkj)IimF-1a}H%E;a}W|N9rfyw>Ee3wsP#cU7mYU5)U&s za!$2l86jJ6y_*G^7wB=?6chT)P807wQ>rA-k(WPf^Qr!_e1%0 zybY)0ghmm`=7ep1rQ+oZe+uM3co}Hzm1}606l2@_U5zJ0An6>^mRY)V! zE5FsZcWpsnih?D{q{;@#&dbzI{K}K`ib+=|s87PuKR7y;na7npzgz!h$nmVlSLpN$ zX381^YKbK{iok9Aeeqle4T3~!<|SuMA&7?RV60q)|sFvNY%C*GJJ*|ljj>7 zlPF8kMWpBk(Z{QT*Jry$DvX79i+TG9JKA~=7BbIJ`;!DlsUz2$xVJCOxY7+AC4MBv zN%4DKNwfbDIz_gejpAezR|%ErAI=NNUvuk3##ECad%`CQ%knsay=0+Ri7mI-i?DbX zWhKukIs&T!CCjBI^dihF-c1CivH?B;mezFwnJF;9K(!Fln)qmY`jc-*hDnu&FU4DO zOrB9zaT+8>%s)8O?&pxbNrKIH8OITd@1pLS(`{)d7Z`}j`o){|;wv*hwsJyWnf`^q z{6~EZr(-&A?BVPn1Xv_T3C+`cui&#U*1^QHnnk$%ZXvlnrjY5tw{lSASW*4$+aFq& zoLcl!LYAlHPkJGkPfkF6GaC$ZL9LnjcR9})=89BhyRL8@|Lx^7@oEtUP?c>ngb2kD z3Q~uBX~CF;pQ=2krJ$qL)$WL($j=;HG0aUGH70p7uZ&(J2~QHwIHA_f_^5M6<^Pjr zUBXYsQ%RE&Mf19Y^kbHa$8ferScc~soch>s2fi;sv8xx6V_{}n{fgYnB5J2omlt>a zKvce)o6;JiEiHbjDx9{#lu3>&1^nyhX^&dZNMFZG4{U>4JZF0@;m1CLp&(j!g4Nn- zs>&%JSggqqJiK6uc0%pR`YD zs#DG3>f%hn-HpDUE;aJgA&#h33?~iVoz`yZRwd~QJNbjUk~^xfKArO2I&=$8m0)t; zp76Q#l_FG~g+nT%tJ%m8I>f()_c!ux@fQ#rHL9Ci^Sm&;DAcLu$FA3Nnl^HI3W**p6J?^VWB(G@(L~zJj<3}by66T zk%Fi^d>WNBm-`=n+wA77shv&)gDxA{TpKbg<3yCHhL0V}W8<-MS(TqQMGY%DQlh0>|Er zKwHLhIzh1~Z0R0GbWM-i->)A=^gL=pv)9d~;;&@EB2)jbD{OUp(ZlB%HV9_*_qg?7 zINOmd50(=gNCrc@g*!P_R#S0$B!lEBn@x9_!H{tVW-|tQ2}TBdnC;$5ZaRK;uRyeM z=21og!V{S+y!&c>*njb}B#XM0^U){7iNoPE{w}f$VS`}OUNl&pp=|bEx%j1zQWl{d z?7_C2aJzIt?7&5MAF*>{AHfW2=Xvp(iBY(-g^J|uVtj`M8`G6q&V(Ic+L>K~Ww8}n zjKw7w-MS6%{^TOO`iNc*(*Zd!SSObooIaDVtS?QlKxq(jNeK$Du66cOD@nQ;qH=;2 zHtAaYW?sOOEM3W}DGz$rQaJFhhTp*ZR_{(iE+N~CEMZ~dG#o{urz|u05x;O|z=KXx z=*tuwtIsFJCAN|*md)$gA;Iq51_rC?axEuOSG^BHYC3?U+gyUBJIyIrRZ7Gvu@zD2 zf?ci&^te6w!nq&sB+IPz{1y6AsmrMuRAmsRHBlZxS&PaLD8eft%6eE=a;@i*q=r*l zVfB4GJ!~Zi<2K+;pIl0I5fKOIpL3+@V2Fp_laNX}W?gC=JCM8&;F$b8>mo9SgywzM z(+*t~!~rcE^)rjQ4zk6AY_V6Mk_7~aDPcV-OYpA#pcE>h>r~uE5_&2BBHbp@1|jWU zO*4br_g>BGN!Cwka||w}Akd1Pk5+Jgy)%Dmz-jSlI!4b~HtB#8hh-SZ&HkAAdn!xt znw^AfvoPzw;2$tyQ8xN_5h={vtp6%rVak$&Q0A_tBjuzA>57{-dm@-iFgkXjw!R6D zq8tBM()RhjMG!3%c?X&0qxZcFmkXdl%1dMD`MoElsp91Zo8n_^!xcE?mwFLhb&8Yw ze5+~iQt^|+dL(J@s*4&GIui#gBmO@OPAqQIpTKN zI_*0AdY<(_483GUf3je%zGdGYlX_zkTdwaaUJv?jQSiWe`s9j<{RFFURZda;X*yDV z!k(ZUj^>yy3EPiahaw4x11IT<V71Hcj1&(omR_c)^b$E_u<@bm#!c>kSZ_5Z|1F?TE!98V_*qffnx=e z8`?5rPo#*BFbLR1-bb(z9Msj4gSR*4Q`rs#1;N2lL5udp3bY>yJ*OwAHPu90!HT>= zme}(@akN*;$tl~!nNM|*e-I`WaI!j;UQb(xldcl@TXW{>HHXu?_NsCaXJ93#O>;`< z2Q!H+6V>)8RjjWQVI;Q69ePTP7S32PaJ3iKIGTxi~|3w_t-n&+N`n<)F3JaIXlS+fLa~NbEIyd%7@L zs>FGh=%R#Nj!F}(nPR6=6~=lYBOrP~Qv3#9#R-Z7LBG2I`j77D?~S@mniq9I*hVCYMD4KP^upcHcMVE&x5{N5a!soM#A+PE}s%UBvsp;LZ!}$F5_VG zZpGbxPP$TLvW>5ZGxM^T>bOEZh2(nEtKWZ*b0wv;*U!J^Q4{EOl^w|olw4c2G{JhP zzhDKF>P{p|dZ3`QaW=3b&q%~e)-~mmlz-;H)(^c7dsrcWQMFYrc+#aNeP=(3s{9L# zBDv|+I$9}{DDeitzKs{6f4H&|!`xBw- zAgXt#CvrcvLWw|xK>N_XCqETP=T7Sbd?pJrUl104)=I`dO6m^L(Q;8b$Q7VxW zUUsuPNT;pjd(*K9ems10>msy|j*k-!xV(Xy;QaxTwZ0g>wq(uJPEHCZu|ZU6^U2iG$&mJ`j~dOPXwKn7pmlc6nBBSmIr0 z$&kO`YjU6K8R7eb+J?LEOM}w%UF10|$ihntm^|;AgiPiS{KS|Q(Ujrd7$G`ocb<%U zl&hr7h_gIDG=nB)=I|E7YwmMBGG}6YEYE+Z=5xhX69a-JnKo8LEry>)$pE#DXRk3I zE+S+KtoMdbP|Z9Y4Mm)2S!Rlre+zFFBjp0>J@2GO*mpsAX61#xCZ2g_)&TxK zSI>$(Ah@D|x!}v8zUS@8EU@(dz}v$(Ye|-+1hN0X-{C&8By$C4GKa0~u5xWPkgd3B zmX%%RJC)3=Vd`z}`pjNSe+JHmVG!Qezzf6mweZp{CpdyiE0YM3jZCm=jrj_k3nFj9d}_`gLWIVW;y^`Q?NSE73gO6S`pP5ni`%U znP6Na8i#7b<#N-lCcX=)`gl}uCazxjp1WO zRAls8*4^UbGNt#qt20fxptPfzFEwacAeref{vLNe0`-o!Nn?^DSgygmAhORKwv;G9 zf%gB$)5?_I5vkc}JnM;_2OQUgfl=^RYfc!&<&s)roI#bf;qSwnFDS-?%E@ zS6e;|_b9$!Ir>Mj*s$tERK$2d>&j8z;@ZDVymBJOT|!KJg}b&;&Z6D85#tqmh^#8U zGdQC^3VekjGP(=U*`L9+5?oSp({PVXh-f-u+;)#$SN|bkc7+g%#roHn74se7%NBgm zFhG8{he(SUSClb#0Tca%SH;Id7)cUDQE-M(9DfHMnzpZe`RPKjpWTxanvE6mhqrru z^Nss>D=EsPOKbO&6MpR#DX!bSx-N|0a9`7z?^_-FXG84Wvsn*$Ldw~!M-b%-NG~A; zVp5f*9tR23-2|5>xO!c=ik4kO>G2EtB&wc$8iSS4456)jTXJZ5gP z&6Z|5ZcsjaBk7y-@znV6u_Nn73b%c_+7pO7mUg|hY`A5mgZ?D5vpF9-!Se2j-moFm z(%oo1I)ZucvoQ7A)|SMOE6QeT$8&lPjOsm-W7yGJy3cE0`2I2H@d@ou7LPpLMqVrG z<@lY@YuQGteL7{kA@r5c!JB)?$hg@*9fx=8jYQ@fH};*|`bln4E25OTwIgMqQn+}~pznbrFFSZWS)l6}{t+_kZ zd`0_4Pfhc6u4&q zcOq2RUU>ao^vtYUp4Cn_a$Mh~KXLbPhJvEn z!AniYPieEwx(}3@M}(f-m};J(`?y0XzVQ2zP)_ESKrb&tb@{v^ccOX9^(EH~)YVP9 z{t-{*TuAJ!%-j4nq^N1#Rwb0X@3vT)_}s1|>U-Bd9b-0f!X0*)@>SB`VcPC~mMpkV z@Xh8mj5Ix;oZ5Ll<7>}>v!Q*P^9~<~PP@KuyUWa%|1=!Thh49(4=iMvmX&N9{Ccz? zXFTsO9NV#?pg_b}A8W)q@Hu{1aZSXb$-Vr#95V7BhBS5N!1oR6A?u2x0_-ye%l<-U zy;V5sV6Lp*qNJ-zB)+A-c)4n>Kf-mSV(i4tt%KF2!%)VogRga{o%qJonL&q1lzr%U zmrBrb)?ub!2zl0aPjKk_&5tJIhYsU5*;2%grIwSNImoR_(Y3a)zdYT!)-Q-1p}S-3Ic^g10z0c+4bXvOM`%#6)t8JksIgg5Gg z0{v^6oR_&AZp!?2^~}51sF6L&RS{RV?Ty%?lOJq`vdDHTUrF{kP*4T8I9_jWp;M`E z?yu-vtDD>N^ZH#M^QI=o!8Sx?(=QIc`!dzcyu@Kb!@||$(aoCa#3ygmSO<<6pCy-U zXfY2;-hWl;FY}XjH*74fUzkkJMhRDKpRwE7N}KE%%KKXSVdkst&8TL%mfb1wb{;cYZvh{C^Y|Q6e0lix>x8F`DetM0#+BliBIHlXwNc6nrr}`w1I%_N4D-Mcw>+vZMBaCctvuYa5G|3&-fka+ju zyN*Bmjt#{>|6-aP%`lSIoxL~w^6HS)FS!=$#~x*CpKm*@{PS!?+i{89q()E4uBrR{ z)&{b?Y2Yb?1dp|wgBRv+yH1atO}p8BYshL_(LaZdv;MSeg;bOd`X8)#de41b>i(N==X69w z!|Lo(uFb5M#hh>dY;Ir7mq>e;&d8sX`rn^gz{}@ig?VpJBX&Ko4 zqV#b89|n)Jo41;G{%OrP_CEjg^tlS(;-d_Yo9#IBs&XT1ALFdfXQx6RN8H~UedkH= z%OB6TL>2D0W*e)dumg5ERouGK5P@Bo|7P7%&fJ{)lAqQ0;_bGW(|)&WE`$aZFRlsA zmh}7N^aSrYIQ@R<4WF-)8~R^;8qa0!S9ul%PW{j9QGNYMad1_Hl}`Q_Gzh2c9(pXVyeKMp>>>t2ofhYQ31Nx(f4k=|GJ z@x=7K9fNLF4io3f9tWEvI8Q3}k3I|N+cJu*WEkN#=;5&E#xNq`klznh*HPn=nrFxT zs~+DslI+|akZ;;z$k@Ylmxr9hkyzCd|K5zUW&JPP*wZ2cQ5<7|CgEreuw4avi46Hf7t69MC#JWE%=OM9n+8g?BYH% z{>uSQDjyg$uSoqHKjJn1i`g`GU@*8M^;S&lJ=JHUsjS}pQCkiOv3$GZM(dFqQ=fHS zxbW`hQ1IgBxZ3yDLE3YA-dCxHMT&cG*elEJmHu6H#{aS1vD2E*{ig*uqRLLYV3C8#wyPzdw1Wv-u~%B^ouVAY@_JED35O`&c&qsxpgRO z;dtTac$Jw`#tYjQcDf@gUq(uu*zEmsZV%!ME1UBJ%w0nR&ODp?T)KmG{Mq=juYL`I zD_7^9_=jAg;@o;gzs3Br(hCM^uFckT+r6#3gG_eCt`?U+4(>5LV35!LiJRG_VKIx( zbslt!ZS&13;2j>na%G7BmZEMVNPjL};a=;D-RAzQn|FfmX4aa2NbYg)aj2>$yYAI? z7@Z3(|2(|uLdZH_G-=Rte@dg)`g{HOKl~BGDBm=(kLaP7m7ixZf2{h+asQC#cRbhM z8N8jaT`zsug6WAoSLYr7a6u(X(bf*SqpkNGf0cho|C$5coB9Ftq;dJrUG77*Pb1rI z#f&V@rVsi2UG~MCn-7D65SsH*beP-p*rC1h(CgPsZ=Q=P36+~U$-7GAuw7Vtp`LE@ zjQf*0jDfB%Wc~BV{_O{*-64s9v!?p8EN@K7{3#odCty95X!Z~mX& z4|lt_dzP8s%xa97+PnBySmvr{@y#!f5PHS)SSEl(qBSDSo-Z>lSP^nmMGI%x(dl?VYV>?&w5i1 zMMvZF?z_Y4U_YZtOS8;O);uZs4OEn+&16NuP(z6*wkUxZexv@m<8 zfyMxc@hQbviNce1seM&Gu7-j+|IfbM$VsOV@f`6MfFI%{yTKuB=Hyc=XChG4!?PVN&A$HQ8deo}x$Z}Ea%}3V*DD;E*uA*Fi5|0hI}`IaAAYV=#uAb$_X^cBxet16UpOzxV935FpQqTB zV&gpPn2^T}R{_WI?z;WV*!`88&@ttvQLx{luW3E_x1nFViK&H%clbXkJpUqDjfk|7 zP-u`_p&1plu3rV#6*lc(j`-kA46oIrHj!pOcxI&kNySy=|B)X3${lVvawu4=Y%vlO zc2;w+Ho@AAJ)!`&nyEe0J@7qtBhGewzj{1Q_Tnz+hF7|ck1RYG3KP)Ur_&L?@3NRMMm-ESaPrI&QDl&{<+zGc2#ps zn%*<}{asME7R0~Z;)GmwasuQZQ(^jnjwQMTDX%aiDqSJIaAk5YtD3THcXMn}x$$QS z_9{M;#lQp8-5xjoNScp=1W#(Fp5Uq z{M)r`QLnPBKyNY*E3E&}_WRD= zH?GNMTZA%c=KC3@9~-*F<>S`92TL~xTmUZRqs`1~<8ytjmHhJxQ zqDl5Mug;8fYr?9_j{61=wx`pjs(e*AFY8q!Y{WXZ!dKp8%>-Qb_)DROly2$JQfh8+ z74#EiCbC$|&Q-x(V)S4QI~(Jx6M`qqFFBSs81D3_R}YX4hb9G*%<7Ra%lL06oEe|P zsvCgkR0$a6L9+iLg=_YY~1z-KxCZWY2c;;&-8y5?!FVs zUTz8;$00c^aBtzupKJ-rOr$Pz7tV#iN6#CUo}4p3D8 zCp4}Z!%*ub7@7M;+skoD!9r9HuSAf;x+;Lzj)8Da`TgLGHN&K^_xPExcd2Yr7v%1Z z?rY*e_wio^0EbTp6^u;hfv-;3Etu-4GO6=5Sg{TQf);t&LujRs)wtnsGEC#M(Al+n zUbwZaA+R%zlHqa_uK*@XjcDCgJx_D)2`byJWL8scxkcHGSVV}}>|F*Z2g(W34k zN7?f9^Ow?HEdvtVo5cr7xcSU~C`!qCOg?R+BpAs>MF%Bgtn*|hHniXo^O*K9m)ne> zmt81Hx$My``XUw?#88WzDPcJbcrJHclrG_PS~Ws>SdPEV_P|gtbmk z7WsaaeDOc=vy55^I^sY;f%pwHQ=+$4bvLwQX%2tSWH`T<^Q6nJi`<>Yw7 zdb_MLx~87mS8|Iait(SfIu`In*_1aeL%#$;O|SO;9z4i+NLE+QD_bP{-&)kwA20f- zjFG>PQ%+?xK3L3qR6^c$d;!O&40y|U6W+we9fQ=OOCFTot|xWolfAeO8#CG;}#zvkV_f4k;bm<&#V6I>t zl4CuUnCFPw%SL;v!6|LTaxhSsyhA4|`k+p={)5GhZ%b_BS)Gxg&-U50=kEOfOjnfG zW-VyeDoCIuJcEL~H4U4zl zcY*9Ak)SI29iNK;;tZ94uJ8wjFIh6Ws!Rj@H3Sw5AiC1{)SWoy5P7qs!#|!}oNP=< z#+;#q^Z#?q2u6n75~}A8%XcZsGu{Ssb3P9LVzPFy@(gSl+^pnH?pK-CD`C|uwTt&J zhE88YC6I?I(*oAxOBQCTGN8e8L@5kWeK+gn@O!q+TDoeD$SDJ}Wm??*-t6lGww2KB zrU|F2FHwN%s~XVcNWR!OzfvdubcP0=`=rsZ{eOK1>QT+DL1UQ~8|KoD-877KR1x+B zBe&u5jhnpEjX$9`190J+Kj*Kg@c356zkv?{knvIB0i@2fi=jRtE`^Uvbr8JHk zQF>$7#PB$Cw0&mbN?IKck73wQ&0G_3hybNjlM)WSZdoHrJXWy!ib(l)^yuysUc{CCUjlUEWy?bA=obQ>L8%(W&zh~@Tcze8~B z_kx}3#S=gfeZhod7jq)yLT?x+Z*a3Ng+ydxTqIqyBT>tN*Nzh?DoTC? z$~}jV-=#q7W*_)hEZF?*LPA$A^ta3qLw((k9K_hi@n3fy4gWCQ6#^ZlJa}*@da#dI z)!hP$Lh)$XsxMoLdBsBBz+yq~e+o_u<+BCU26?4Wn|h<;#Jr@dq8mC{FF0S|;rF5G zgeLUbUJC_)LkZSj*7SP!ONF}>FKlMFOm2?I5zL?0CGmcdQ44xM`lY!Ee@yurHFYm-L;F)G>@(!`lhy zjKlrf3D!eVNB`CIeniPe{*_RGHtNt{*@~McxhTmvv81V!u-G6p?$&jvM8*O9IIgJs z38~*OrkeuN8u+cd0Qq+P$HmddQx( z%)`j&f3IPb7Oamqs+wqf>dEj8dVX;5e%f+o$pUTJQg~%zN&SlTjP5LXp4>04Jhp}p z#EYfzfZoXX0yvuuDE-r7lWqt4`7rqXmWATp2DN9_EOU)n!N0gXQ`9 z8a?GBsVr2OrK|9cRJXT#D*a(iTql9tuUmrJQdtS4gy&foNSrxx?9*C0YKDO7e+`cGN5ZfdzFterCwpPg17&67|*mF*s?IsT?FOgvr(d&HONj>^W;zC#1I;;Uo8P;r*( zdOX170s-OO%?GF~vBl~h1bD{sm`u&5^-ueJH8ee|rmV38j2>lOMuEp2t9q-zv+!%@m8)z3V{qQu`PqPL18&@TDp*1%V9ZF*W%_Ga{M+tZX#^@k^8a+BrfX&F?71%{WxeGm;s`Wcc$BjE|pOa1??ftbkcY83a zoh-cMp|Ex8ITl3}7Ab;ty_();`aYiGCTYZKZP#W|VA*y%#tAK&a0Md`JOicU|NgL7 zbT=jRdfOG}pbXg1uPw@&5?aLf;`m83mq2Ui@`Gk>+E_AN0&d#W3BWp#$++n7bg9`%6<_~}c zzH-(3EUY=jwlqoiVqUr9*gGXAhA#$R*2mI@E~OFj8{Hzg%LMZ-cq2T>w`bARtj6o> zByRVACd*tWI|)JD`ToWrjt-_JQq;(;nPl7|$l=YdLR}Sa5`0GGMxA&55C-_?{~QjY zpSec&&zPm#2HEFk)Kw#{vz1Rj*z`uti3|^mWEOd zqwyR}75>X|p3>R(NvM}QJ~*((q-@dQC}lbbAw}GEo^AGb*R^IdbMR1%7IMed%NB3y z;j3+!Rc5!)a_ewf#UnWd`guI3t^Szy$Cz%RlEW|P(u^`Vh*Q;kpPV2x*L0To zz&=w=JI;P?6o?UkEa0+GISZ?O))Mzrhja~-)Qc(Tfy>{AOLVMDzrxt5hwmm0a!@^?ng;+N z=8pEm?9!d&m90JrP7Y6EoOm`KO%s=|rIMiF^XjBA$du#n$n9u#dP^rs>u6KC9-a|p z+Oh3?3`_N?Wa$#V`+MwTIlsjxbjQoo$-EcG8!ZdFkJA8Nuh7R9F6AR}h`ocqb2}Uy z4-wu4lW=bk!4Y=+U7rt%M&?a~#cF1_`Sxtkn;ZccLD2AE5B3 zCed+F;z`!ddP6#Mt{NiQsD|~_^qB*qqYs6QKE1u;z{svSHO1sJU531L>;wnDUVLge zGfi`cr%#34z&LI)s99pCR(lf?86@Ioz!0~9ry@|913Vo9p1(aa_pq1}jWH3u@PFIk zH(BZ3@%Sufl)VcRIeQb?4^R9d{B`YqpkqRO=oUJ?hW)6pU~uYp`nSR>zpSDNmQ`)Y zROhz1J}H`5RMByhB|Loe#Y9zcfnoKxV<9iUhFd^j@btgE@HGTZqd)9pN6pA>$$}!B zM9w}~3ifq9P2nW_PKIu8cbv6Pq_2PUPe%B+QOEp@;N`r7^9T2o(~Q|boH}r@T~23# z<6!Ycc-Y~f_`8`7>mB^}f++?=g?|~t>!sX2sU%4+y%T&Rg>~;RgqEL;cTxTBMSwp; zxLZu8D%L&UBp>BQLq_^)Pz>G$Vz~X}4(qypnN7QCSPWHmXj`U+9Zf}*RDe8U#|^dj z0p+0UDS@=NWy+AI*70V^tO6gG9Ig(9Rz3Us&6GnP!ogV0Qo7`$6w+zTem3K(+065f z+<~TybJS-*0q3VIW3V+7-LHr^jdtyA)SX=wjZdb11 z-r3=xqU*{GOkTDBQ5tq*092(f5mWu9Bd^M6W#R|-+$(8T`@+$&>R{s6R^rgEq06gU z7+9+lug!0Jk#hbxG^?Gq98`;^THB6|Pe z5V_+{GPEGWu#WrwfsbgYIb6Qe@`l$wW||>Zz1@1}9#;rkaXZz(KBr!es_1V?9d4pS zs^zo*BU`LS5OeIcZ;7j-ru}m*i?4kQaq`J9k$uYfZys4-sw|7QqL+0vk7A1NL1UeB)(4!pUq)iFI=HVq7Q zu^Y4QOrr|F61Gp-N*Z9EKRRdjR`M!o*yGwA$QpU0G*>bVbV#?T?$i?e78vPfKUSjX z@0n`>Y}NBst|J6YNUa$GBdtusg5nZb??1m?7$U@eZIX zQ62Zx2@TIwuDVBy(7Xo1nwFL3lB~yejYt%+JZ|kwowTbpblqF(C0mu3m}51DD?9gv z-^c10RB+t+R@!wK|Cv?r9DZ}iRie-;gR>wI$UhsSIb1owvRxu%9m`|jsvD~_I%k>E z$fHha$ZK%OG548Hu}M)Yt2_f}Jokx_VF|@Nz1<-Db~mkh7DRQ%6#39X0Y&M^aMj_3N~jQd=twLhr^5L=7_aM0GOh-=-$JiI)`m#Yn|-s2%E+ zYwqd9YXm7AtGRt{O43~VprXa9tKitsGwcB6@ndSsz$L&%|7P;9@YF)KRX6aq+r#%OsApG^->_3RdtzU~YjJOfK zCL?qGVJs0Es}uX~o_zovKMO~Hj7z}~z!E`KH2rD?oAD#uKVCbHg@Z*TVz` z|4ch&F2GT6Ab1Z{f%33Ri6n;D8WWD5x7ym6OI|pn z2Hu&!pBc!cA95Y_l6WVNPHHbwITkLG@HjBJ35ZEJEV!BMIM(Ng6Gu zrELohsieH8W6jbWTxA}c`@*Ic6J|Q|sB`RJjirFVnOEZI#pY|W|Sy|=}K7bEfWmrA!0^fmE zrahL&1xpmift$cMUsZd%sz1F&A4VDYK2P`IMc36z{G{J|Isb-|)G3mZOgP|gzl=qZ zzKxz1W}i%!y$2>u+-atHB9r3;5$>WGl$f%lDV|HxkwGb3|Gm6&Vu##=vYq)xcPmxx=iKy_5L- zk?98<@@`b+mMWa7PV8Oujf*9%o$BWNx%J|f>g z#wX&kA;aCy)s>lF$6=p~C*W(a$Ukd`^P-qdS-@qgf~S1hU)DqOarWHJ0eN_fGB9Lh z(n6OqopIOAielQiD4oqSNh`sxtnoA3LTdJ%Fu8@SDl`}5ZvS6a4y;Ti4UF1` z1;UR%I5!@j+b4e;)X;)5*gG5W4cIRDIyYAevKbDmj-{O`GKDp5^|bEDJPULK{ll~> zyEHTbY|zSbtA3bz^RXn_{%x`MOqqiJ-!`MP*)}5r=d9zYMk8QG_Fh(1e+P9sBd^-y zC$_=495MCBz(*No@xVWox!EUFnL_H1-hSX44Fj@)AYDM#sweXpy^2EaXY-XYwfs+~ zsuLcJWon+)D)~o`hFO{op@Y*`CG|G}3(oACBe0_B-07v8NOnf2ij?HM4`Vy^#rpP^ z#_=VwiORqtMq%4@uM)wMk`;!?VrzNqmO2dus)014AzQO4QKL9ArL{fkBxYWv&nWU| z3$!&xxGM?*Eg6UDb6J6DBWd*-a!RL0r98cO?+0qihV@0g(z2T-yZa)`biHEx zXDMW^$;BZ#ntp<8y3v-{({9DaA8#q{PHQR1Xd$$`TMKu!_l$RgHJnKGCkKeiQ^l-B z3oRt7cWc4Y;7N*lh-)CrRq4rrzqZ&}{^@h4%9GSmXRl68z){+Ls(D|{s7s7#zx0-F z$!iD{Uo;F=G3P#|3KMMdxfAcNd4$agv;nJYf7$2qbQG2dgjO%MdrdJ*XH1RU08175wr+s-QJkE_$Tnjta%ke|1s==-R;P+s=2 z?Qfa8F;H#4WjZf!OEFkzJ#^xY)d?%x=%W7T8{n9!9JJ)Xd+x8~@vX!->5B-58i%%) zXO7si0WOwt<&P{;E~6(#zG<-Fuifs>+}oKcd{2}1ih;HV-`71b@(8u&{C|N}vn6)y zPgnE~F;mMBZw$)tjpNzCy)Ef_L_eKaL{z$aYn?*nLr}XECl;$EuoTI%j-Aai?uSJ+ z-1N0?9j>f#F29&eg$)fOCWIEDQUTyJclmo|&h(Nomu+vy5ZDW&wBJr#sGef+mA?yJ z*7Bq|(mj0lNQl;)j$`;bU(Do#f!R-Y?C_9(6e90~t9vD6s9tSt71F^sSyniq?`z|;wA3F$fMX>KR_{+x~k?*mdC7~0LhzdTzn`?Y2{;;qs zHs_y|{VtaAiigsmth)R^HA1J{w6UI?f3z9gD;DWQdAcm^_XL?(XT&A7nzs3YpP;wjR%?vK ztKm%m4^-vaxx(aTdG(FVP5zV zXI?<3kSx5lW(hD)sHNJ`>e{+Iw06K$h_R~4H; z`)J36&MA3aGnB=_`{kVhsx@YNk^GU>T0+@s8CT8CcUlh&{)R=AT;OTI$^TW##JS8+ zrG_L*Hy}~mvR`+`7W5JUnjX6icEm$qt*5FJ;UV@07!?E3nQwh9eS+B?Id+a+1tVW7`PY(yh zY=xwEny&a1R+V4wJ>KbJ1*w67mr|L)%W2qHtZpZMx27c1NQz&WaAHj%1#-)p%9<~n9u&t_D^=1!s zY0`+-T;?*al3=*jNNn}UB`|R$k;zH$)UC|A?M!tn@eC!Ip<6!8`>0cLW*yVH$Cy`0b6*vgET?3dV;62FcBZ9_y(2l=&XzBViiGhp+pM$MkM zx6h6TDn(77eE;>k9`I#>Oji21(U@YS#Ss`Wl4!!UK-T$Bu%u%T+OxU`l|m^aQ=SE~ zEOy}5)QeFUa>kI1TwIQV0Cfk2XD8@YDBzmA%oyfM zaEQace49kt_o826`i#xA)d58%4pDb#C=Ua>^p)EZsLF?^E!v5A*e$uG`l8xawe7pe z;$E3i>1>a6+v4WCdhR4%$|4h0GsucS^;i(Q(&O(DuUnZA0lxwHq4wJ`QK_3|U z*ezCDa}gAF=ZYkH6fimYkn@~+T){6RY%oHKHSqcmjVk{WjQZPvJa>+XH$?|g_1gcG z)wCOiULF4Q%ivD;f7js}!J-HH>>_J#PkZvkDej&sf$+!t*nXd}Rr>#IB;*$G4g^%4 zI!V0^i}P2U5;1zc$!G279gV9duB9elQsXEl6ESWI_x|%%ojuH1YZ~8#T1&OeMyCJG) z(@$+}C^1u_stL#@%%c+a@6W`6Ro%Zg)w`U#@z?zwbk1OuA9E>;6sLM>Ko%DHKOluK zS|3M|F$*7ERvo<5)SZ0gFtkU;!gy< z=iIt3{Vua|G%z;cJ>R`?x5~8Da}xbEGWY`C`#)|(&bxJY--|ZJBQYV!@19?R!s9>4 z2N)~^L-rHlc$jK1$%hf3tqwErkaCM(q!SfbPh_IP{@@5d<#UP|R za4wlo*-85J8EX)6(%oy@?I;x~v*?6`{`|mJntNB)p)ymoLHh0(<`(5Sd z*1*Bm?Q=DsvkAhS=UzhdpA=(3!DkmKZN?v_qkhZiIer$eYw@pi8+X6tTu#31!sbuQ zeNgYYZ%c`PVhM1OJ{qOzrF)WldL{0AynQ~m2Im)Oy?x*scJgh$A$Q*^MIv0jPl$K= z4Bws3_xpp8XOKa}1*gwt^T)UjST4S%txz-LlSV6MIJ5y|By6(yaBCacoAhy4!gXe% znPXUBG{_?extqkfdoc-HTZiXNgI8c(x!(Qd$QfpdaeP!kg6_i0jR{;r{r;*TZX+wNs7sh&$X* zHhD_C^@P`N5Uz)(i!a@e55I;$E)i4NZr%aRT~^17p)he*7&brB_pvFL?G}PO(uG|5 z^OY?)mv>HFN_16rcb_Sh~S4LoW9X@`HeRthGN{wIIXAg4h->ziQ5pUP1Cto$T zF|EJi^iPC$e#9MEI`{W^uz;ULk-nk}KB4#bS~|kD9~vGcLoIuw4YIhjtfV#R&=H;& z*%4PaEqC1)3l}^K98~PT98`n|=h58=Yn3ryj){%H&k;tk*?%|n?8*6uNX;yD=7|Sx z-=nAJW`9CYr`N|HH5~Yo$Es*V`Zg{VqXZ=6{HHO4nEboG24@K<^X%(N^lc1wO#@n^HkxI9au3sd+P9rW6(;baZ&Z&o zb(21X2tzs-!y^XWN@kng!&wE8CR5;wTB5wuiI~OI04guxNEga^$`y`^BrP&9RUVY7 zXV*BeFavCL)S3LGB9=DmniYddwaQUuC!3y{AY_u99y(DQ39B(U^FyN<2VGO5?8%CL#YiEWvzfqj_MnV_w24%zQX@Y9_cx73&@a#ExVV~4Bs5qdVN|RSZ;?)|8ADby-JJp37wi+)C!5WX-S4yYR*v?xVOkcZ{<2`HJj!zw@3$F6G!|J@*#D8Lg zpi@jEbt{fS<>FH{K;7Ce3S_?Hv+w863A`fFHpNL8)RhL}bPYRhD6#x>9V-vhh(^)Z zqd>dtQ-nxJ@YQRxLQ8@lJ=q0^u4uah2?##3Z~~tc4r7dhj20|insi1dYqli3#|Duf z)59UZVIR>yMWdy-Z1ZBMkfIF>pzXR*s1$2s6=25fLjaQqvL6<<1qztoe(V}K5{^FP z_%Ge^H81eeO890jZ?~3LfKeH*{;s0=3V?*6bAK(IAROBU9q}A&dxbClMiSq}Z)1ylAs+?Ns02kn3XK9Bzte1 zNpx7TO`T*zXOx!Wc<;^jwxK>Qd*^+Mr?m!6!)N+wZROWBTqVP`fb1ARTPy(k({azS zXo@SnaeFi6V4pNLw4elEBy9tFY8U49x~=FZ zew_ebL@a5c7+7pLUG-eEV@BcDSNO&I>HMki+f9l?Ojte3?4W4Ovp;Pe{-7fNTNuqs zb1?}J;=1(KD@_%OxnHlXz4G`eC5X4}9H&^x~d`dcQS88-$zOqj2wmKOfwM$(L1n_VgA_?bR+tFkJJj&0wtI zk$G3VyKKwz>`v$br9v$y41+HD9bWb$(f~S#NVE69y&JjL-~VpjpO_m5`Pz+1vwiG- z->#W!H1FJKT<@h2oyqxX8Q0c353`|m&aTaBEGf;a_T_R#^2kvPIC`Gl!JJaZr{p`> zi+xV%df%%P|1}1f5bb63JgWonMf8QDr`rz-uoY0ckhVlBj zxr@Qf@%|lg1(aSYW3IKpnvR72#8U5PwJLiyVS6yLaVghi$M<<<{G5Yr*p~uQq%05w zM*!%Y9@d~=*#Pq?%~qTrLeUh+j?jLG9qn*gJNYX0KDFd3T{e98+7G!Ox?EOKPP(|y zx+2SD!1YJ_J%6-Qe+n2eG}xaw4R|T8&Q1;KaCGt=8Q@hiz({zPlEAasC%v)WM&ELR z3gX{*g6Liu4+K7WrNGT8=yQw-p5+#*>>iRLNji;ip5c0H6B&|?F10BtDr)RXs^RxV z_CwZP{i#czom77$j_>hAVAl#}lNscq<<#PyqaM11{#4toai=fTM+c1YR^`fzo`HT8 z4CkPZv(F>ht!T3CrYi@h7(WKNegMCa|Blfoj4pc!W7}}4Mzwxo;W~@|j`1!w<=Nd0 z3mNpVoMoEl69LON8UonDa`ndHDp_YAey9H+y)Y2Yz(mtY-dw&;9)VV}S${OG?Q4dh zU6ys7tN`qDVfE(ZA7igEmtV16=7$VLf{SvGG08Sno>kB@-k8VR=;mCo|F{stBiTX0 zu$gT9Yz4dbx9Ate#a1tcSC6=N9dot&`eE#orD}iJ)Mf&A3sKa&8_!?XCvWYfZ&99E z$YNw`SYUV1Z}j>a9cmt$&J$esa#8gd{VzPd_b5Uzqi6j;3zz|-UA<2!)x5H`l-}gI?$SMM1zDtr zSef}FFfgHK#lN+mmjOIt0Gmf73B6Z~;1LET}cc6kBuV;~i&_xNO(jIg;Ekq)e6D4V%f8%DNgdYYn zoYrUo)tAteC+O!I?QPtja?k641?F`cwa`9LKW(mzdzt+Px7m1i)`RMIHwJdb6B9rNDSebLehp|c4Ji4zKwFn9QbThTjo={PKigF z_l`tVjkwJgKk{0HC)j!aPtQ`W7uIia>&xekt(csNX1ziM7GlZ&Y-A4#VAr)v64qf1Ms*JPzz|UHipozV4BxVz0%xtFgojG6;39 z=Af}W!i(_@KxsOiFT&*d2K(ANhQnDiTU#tGJNK9#Gx&H>^e>ixgeX%LbM#|gS zyvMxR?C@GcGD$ZzK)q~_IhkJ*hl(ev{~G;qF@@4rE~MjU#S)?KV&3S~7_M3vK>mKE zXWC@5bX=HcbM^(SCZ!QO5R<9puL75Df3@T;I~F;8fsO%gLJ*omOB2pkrj{!A)rvH1p#C@cq>BgC z>HhB|7hh=g&Wk26G=^v|TH2%VoDr&x(j4DZQ#mA_Dv;p5n)kCU*)HTdq|LAP;6XW) z1a(q4Kj^jth62?X-vy=CZpdX>o>i*Yg;NyvVFZOTytGtoW^9yh{6_rZIjQ~Sm>g8e z7MIa=gD!ax_k9Rb{9TG(w|J-m(Ov5f=FLKq)kXGsHX}8omfggEg}+}Q=Z%sRB1O`p zq#|ja{LA!0Cq9WG3%(`&7sRhX3^mRsAtG0*?+*TR<7}RECqk+?@KZc4<2NG=!GJz! z!1em+6egNHNuVI5zQ%=MJ07i{7O=!P7ZHT*m0GU~zGgvcMwFypj!Z^}y!IagD;A*B9}WI+fRqA;HR{ ze7QA37un$my?wyjd!;bZlIvTZd)R;lQeA4O;r@iRFp&2pBkuiRRU8r2(gv4t;^+F4 z088Vb$h(wwwC6j$lXOx=s*9zz(7QRUPrf)$dvi>MqOxxkP0*2%b2^2hdy<7aycg#* zca7`|h>dljDwA{o$$dH=Jd%BZ?4p^_UpD3Z@mTph4?wBcxE&q#%Ffe87(z*9vwV2o>ysHX#Bls;yqIG&T^v zWDHkd`;;tSxbxw}J8jYgUutL&74@_*HaacGhN`{3vr z+l^MyTKTuZC@BRa2ZF8J`{Rm52R|ls*9h@f&sZ}vIA{tO!LOg{fnw;KzahBKZZm4c zU!1S`yC(KUQ_+Z6tWZDtqU)ZfWtsRhr|AgX_16mv%pZ2IR%{B2H8 zIykAeP8ee zOT>h^MXumi7hE;&L@DOt=2_AXpeVnlste^{trP(XTgufT8w_PS=G025dh;c_Cxyp# zR5%C=QC0CTAWI-|{VSF9#95y%o@p&1O863UJ|q!1WMY3q81@(H18Uo|))Tv>24hNg z|HEe9@zVS*WWasQJ=?I z-e8y+lcEwn)PC7=CE?*E63Z|P#VC#sJVT|j(i=OM$1YufX6Xn2C=k{6$C*3D(L3l0 zda*Fq&aU0W_~YbRL)$4?(hF8mQH^H>v)68_##jnOwFygj1%oQU3zA;ml@-+_R{Ub& zUYR(>Vl;LfV6~^_qg9U}NlD$-6M}D*6Xxg2u4s`JqWLD167M1wi3$`{`@$wWw-^#u z7aH9~kOJ~)>CAXSZSLq@EtiS!O#bwd>rEh?(Is5$c_Ji-@AJ^?ju-;IV@tRnhZGnU zY&6J8YKrZKETCM~Ssvw7tSBHzS@uklJ0$(w|5{>f2MEIHW%uiSr>>hxgG&=-;)6P)Z%VM|J)qB+cYahf#0 zvQ9Y>3kh7bZtmd`2?MLY_T)wGJ&G3wRY>jE?rG2bW|#FY-u&Gh z;N;wK2(sZ-v9m6SL_0S{^LW6;lIgkX#>2|`2L42n!m+rl5w!+nmB+Txe`jH<_-Wt{ zSivSy5NZ9ep@f;G+y$_e-E{x>$+HvP;~^03Jz+xl1S{J0)g@lUT}kSH=nmc(*q4Us zI%Hb)8w%Lh^*@|!hkc7PL2#C7!J3EDbL?EmvO@@>@Y-8_Uzd6Nt%uk)H6lRvlKb1Y zk3mwY;7xO{N9KL>%xjNiL(i+fpyYc9n%-2L5Jd$ham2?jl)umwMScdn#Ihk$!~G{G z`zxRiw_f?L6&n$AtEX#P))wK6_!JKG#+4tmysyM$uLKF+sq6V<^xHJq4zD&`)`JqMk#<-d3? zsp0@aB~g52SsQKF+~3yb$2USNI4Fqazwy^E|@Uuv9T5H7Y z_d>W2|E;lDSs_yOiGF8SEYcWHFMhS<70bXmAQ@*??oP>+Ag#yR$~>0}5YozN?k!EZ zk(1Xx_0)diyyA%_#8@Oy5w)vT|M1}`RMg$7_VX9%8~nb6V7CaPlx>gj za_69HB>wj`*V}0iL5kL*$=v>^)S;5P{p<64kXqR!y!OAop#cGwX)FF|XI*W>*EGI% zLK5fbBoSV?x5md0>x`1ag_ge$jVsK*D{^p#WLS$BW><;Bv9+6MK7dV9&LLp`e2zaw zNABV;N=OTQi>Kxj|1?)?YcJyq4VN9K9WOXV6)wZj`Y5(3ZBm{`x8LqqP? z{)lPgRaHFD41_PCZKVQubLEE0r4{&RZBS{@6Kk-T??1iR;*~9%=|A+yQ`gSM2h+3^ zSAa{o9oF*Iojr=Ve@fMkVZmwg$ML)-HbW@8uvvcI{K@e}t2;5RfZgqrKacq|Z%@Sj ztaab!_%`63s9_qxG%cJ*@P7b(K!U$Pq}R0@JgN{V4iiz{Ur+{2P>z-ycsOd|s&xAl~sW)r+y@k~SVahTUBMWvD{LX|=B za}>r8y?=}s*tTex?2da9l;bqP*G-drT{KaP-@jE=FY={5ORc`~kAw1MSiW*Q+(Y>y z?;74s(D6#@45Kc_Zd4^8rQ8$4)ozXO6@ zGZ@dFdvrMj#`3|j;c}mFtK8rJ=YZUA9lxG8upl47xbU7frrYVl;Mc%%pnvAv$?yH7J<- zgvRp05dB;pq8|lwg-Y6pwsnA7^MuT-Nij7yl4qfKBQbKwpMBCkC(#n(+oYWb&b!wEhU$Va|Co+94m z>1V?y_>P-ow|JT=|1f+KuNRwT_ngyI!PtJ}HfN%SYzFhalbZYoFy$g;d>5z*G38l@ zaYl2C{C#qM+twi62vAWHn z4H7L+k&mDq2FUcIh>88S#>#I0DXN?qkd051O&AV^uL)lWlLyMDON&i>@OZv%J7_bi zYHD;?ps9lJQ-2l<&)QkIA9L1p7OJwgm8@%HK`f8wgE9+E))+pxnuVsz-QYQ{*?N+X zYWkJkGMRp~fq~raN~ZrF5dC@pAh&z-z;(NE9SGz_gNAvUEF11j^Au-+rz=`^=K)nJ zQ}`g>tBsM}#d4YlW!nxYTd-oC7D&h30%g%Ej&dFa> z1ynWf%piTdqw$OOO$;2*V0r(7a;Pc-5Fbelm-pZt<}zYSI1Xvp&1m)d(74zThC$E8 z!m}gQG|vSJPVFr3YJSHilk9%=q&|Ow7&KiaN`Q{^wV4bI`fj>snM!W4=^H9h5|F=d zz#yK2=>1sr>Txg0ckvDgA}@%&$7zDI_CQ`e#=|+QK&c_Hyj80Upz1yb#AX7~s|ehC z*_i8M)HDy;3$e&<&q=Cu8*^dT2J$6m|9nekI9C1TmOSaQ@viibwu7?kF;FlsA}Ud^ z1`Un3I2SyOo~u3!H_|*#mE4jW{aGbOZe(@p_NUL2p+8^_6v~Yjuf|+8Q9BnO$MB4v z6FJe=>mCE;Ya^fQ4vW*55+I1Vb;t&h|3SI`LBvPuQ%6D2tLK@{z$iW#Akh3_pRSkw zu`B{lTlBzKuJqli%coQ_5L<`T1wcU@{jusr`E-raa7M4ST660Ij}6w{3I;^Q(A_0N zcgWX^!(=zccE^o0kK-g&J~#9iMExc3!I1t2eE6I7HgY>ClMTHoeM9v28hCa^4vh8B zeYfh(^&jf(%BsP7^M>gysb6n@X$Yo!$fM6{FaYdgIACRxJ;Ax8;;OpmoL@64g zgKXWOju`Urh4Xevs{_IJgaXRNDm|ZX=u?{zr$f2+O8wmMsu-+mX@c*|Dm~X;!a;l` zK>R|0CIC|J08)RPX814%uVbNOCy-vm8|-KF(nSS(z%1+r8cmmG6;xJR%C6{h9Oq6_ z>cer`%^*_Xr`FtH&hgv$b*(Ij#00rDK+aiAn5%)3hwhxWnS=N`fcR6Cby^sv{v?H_&w&r_q0n@5{Tq$PDWm0aDBIltQyYM- ze@}}U=;Lj#09fh+0KovY_>lh$y{^!5Jp9Z8`N(PG`=?r*l-<{j|Fc0pf;=+D+-ZnL zXdm7|2AXf&Bno5I?F)5ReAe!P2D@iWAJON9M(OiH{yw5afP7>)fEDG`Ly2z&@KY-Q znij&y_zVEQ%EGxK2EOV#b+7FoqmH>wQ1`# zdW_hzw4%Vlf~OcvP8FEmZK^6BXCSwh#l9G!mK5ZFc#|lO<19DYea8=qm4gw$Xls>6l-Sl3q`Q+qm6EhGAC{}{b*pUgn>tRb{_@dLCU4bdK^uParcd~eR0;sDv5>j&kes@fLV;oLo8 zdw?g0(`y1x#i#*#^9_1khM#W$B za|Xd7_84A+P~d~zHV9%nw9A-q-Y$ZtC})7TyqmXT@Y@D|{kflQNSdt^F5Z@H?9ABXo-%6PgQ1N|^YKMW_k-^U#OruzH$hO}?Xklp36a2DHN zx-p=ew*DMi_q*LTI9vJY%wWh)7Xcsa84f|z0b#-4GXp%k$kpF>Q|1uE$VVJ3bZlPg zD5$(KyK}dyHWx$ko!E{rvbz|Vdl6Gsr-8D|24^+74j(ed!hjfaRP}aaEqxn$Uuinm z?K&eJtRcP#%lom8nauM3Vn~i(MUvxd2w5Hg5ElSc0m$)SmFI=8Tj!>OvO`sK0~GGn zeesP(>=)@VAp4Ofu$ccO#~1gh-jJ={T>q!W?ofWFd)Qhft~ps4W-!O$3o&cUF}fBARSD;w*RMK@FtasA?L=QQ8C zWiBCHexdoy{&lHPU6XIj(N2b7xC~FabQ$u|12P242YYCuue*%#9G}5>x;8VOCu8Ak zU;+dKm5fK_K#?N~@-LV1{$o*4wJQ?Dz+^ty5P9_vz`}^G7wsN0MRsG2RN14=QTZSe zny}3iX7KYAn!5D4!l?%U^3qv2hjl5&XJDbDYqP2G^2xg!Givx9$4FvtBY@aINc}Ma z{rg2WVctbZ{Tl?d{UTj7$%nDxC>dEl?(eGi@&tXY5_vhEFT346RC(MCLFA#FfIp;@ zzyv-BG)y=7gLTtDLCpQT>iv6+?0)-tm>mTePvAwnr>j7ApSwE3CoX-x8FTo@V`Vqym=AFJdUK*(cK^&+Z@y(6T&v6UIf!DA-9PP9ZTR_lpYDTb z2Mz+wJHz?QCZ1j62kiWv>$hU|yc>gK3f9mw*4W}}EKr5mTt9@K<68stnywFE^Ove> z+r;owYKHb7*8UZveG#YctH3@H&k@W2t53CQII{k)jUk-FG4(6}k5;=4*K4;TtVbC6 z2*ZNEi?Y7W7t=96?m(>Dtg6kFk=+Y{+?$>H&3MV9-F$@Dq+{BzjX4|aJ7fbIK8E$% z#z0d5aoea90?~XB;&%S?oBBXoe)%KSi`aD~41ZB))i-tBeSn{g?B@FP&&T>yTi<`e z3xOtkDCfzBDxT5in6`ftFRcuSbswo-JMjK=J5_s4Ck4V-E$0HciqJ6e+rvVA->BLe8mQi_hYy*r*btkR}_ZjS8k|YAkc)ElWvD| z?-CHtT?@0DI^wBy4cJY}^}%`2zU#Wp_K$b$;PEyvAkO|s^&(z((`4U8%6Ph{O{?=h zzM*=L8|wf8n&f-ort1A_$Qr-^zW$|=W#l6`*1+%qdiOIn0v1&d4yL3qG#hNJb*`Gas0boji zCOQv&LKPVxZ|5dBhjLnVt!8^CShRZ#)VlqjP=yD`TXk*Y_8nlKva^pl_Y{Ne)^Fbd zaZ`5o(Q}d7{~NZKlU3Vyknc|EQg1ENfz8Tsrq_H2dk*IIRL_4WpUrohcN z;&&40eYZ~)S6zE-`;I;pbMAPI%MGg9e?MDQ#en+!c7;Iw&c5_>jeV+kTJs_Qkhxwu zBu=whoSp)k+~0vsZexwk8QjcxuHON{>y$X3gH7)6_`MGFy+Sbn)*70$yoi8Up2Qc- zi-7wBlObqDz9#d*E}H0*jrq$*`c$#s28Ya_ms1d{J5_HDwJq-g5X;B#Yvx76{b*}Y z$ZtoQy{c-fp~=hJ@O}y3GA{w{M_a>tJ=$FDNM9FC(ekc+BS4YiYW_S5_pUl%um9B8 zD;l`XTARLSR*!4PZ@z&wLGNq^#N+Do+W|;@`i*q${XE1j%q#4gZR_@I2RXh^ld(Q$ zjj{`dbQ`p)rb@og!aw206TU`$R1uRUer5LA^ed0%|SDP1{zz53#np6=myKtO`c$#Tte`?ye1EPpeaL!x3W&iYs<(V2lMq-5{x=Am8*c(Juu}G;kN%AXacht$ zwK2E$wLhq1csEV-6?0i0CPDAB=o-=HoXa>uJ+!Bl;QxoJ+IA8+H;jb%wD#^}K%9><8Fnj; zt^IsjeZ{3&p00S=eKf>ZCF7}#8$F1x;m8wnb;|4@Q5>D~vm-%vJKoIn?Czq<&Uuit(+t5kh;4bT3B=1 zwglOY{3Qce^I((vL88~s`27hYyL*i9M~R+`;rE{t*^M>x19+Xv?tf`>GfB<|Mh(n= zL>Tmuc3Zp=qu{fhg7^gm@eTAD7WKvZ69JxW ze$n9xEC+vJIqzQ=3uhPFWOvcqnOF;qz#78cMU}v}A!uizc`ZOLj(OQAP`a<`{P1sQ zdNiJFvisl2cZhC$h6mQ9mm%%b;n%lkcwlv!b{%cAXE!rQ=V%Mqt`f35&GDHY#D{14 zRPV>A-{ri&=OE*$CE!O}m(8H(cBc!_5&OvaE?tb`Y)hZBk{pj3e8W( z!r?0)WNEoj!$y8bF)O=o1gH|o)Ymct1e$+(l_&vf^Hs2#ogXfqJKFQdtGCw2r9q-3 zg6t0QdCQ&x3gXEQeP0gJ-;~7r1C;SFpv`T&4}$FO83{@)jvybAH$|2x28`>(s6 z1b_Jc&2AQQFHqvE!PubHaK!ii5!KsG!MT?3Q>Pw;`=>`k)jJG`H7r!UMnSwww@FQQ z#XNZ0A~iob4DV%m9=dAOKqGYQo;;+jBdqQGP}||MJJF~sztZ%R==-nCXU~ zSNu-1c^~F$T{K0T1Gw3w&vEZ0qk0|DAil1uwo0nce-|lv8!rs*8#X+TaT;e zcWmnbMeb8`GeLGw395M?n;>t&PB>?;FIpEvKzwHi?_IG2yq~*b$SYoUHzCd(fcp`* z=Fx;-VlBm(WH%*{>!@Kyh5CD>0~ENfYCNrd9h8J*7!d&3y(+dfWhYHo9!)^(rU_1z zc|L&kzm_|GiTQWYD2T6JW-maWou|&~#5!S}sy44O!-xq0*3CE7yvtfl9M!un77jN6 zh(#Y}X=}j8<79VSfGX9SV8px+5erg$86#x3T*L1O9@E#c%WtU7&kPxBfTs8=M#%0z zT)7ns?zyVZpOYjlW*v6Cm*u%~j4BTrbNfu3e589i1b=cElynw;TYfmj#I`5EOcN#`vn2<_+&m< zL!hd>eP_xlGu&SUO#P|@JD=Y~_^Ci4I%DbNf~ypqMXGB1-jMM)tOL5+6w=)=*?l+0 zg2{Yv^Rn`S%JPwSZeE(9t-l>N;#$v-{FG{<%1B$M{PeJN!tFTP1<`4GaB25!&&6Vv6}JRTz}}5g5_WhYWsz-RvzhN zqGb2Ss-7387cx~}Mt}&gKOW;s4T0qj3Zi;BOwKZRYLjJm;Danrjv?bNPJ3@79_{8& zSBNr{KgV@dyk$><7BdfN@>yqw5uq4%JXv=0HT;fykLmM^n4cUQ(myj&c4It?9AdY} z`uCTlICrbsoPaa52j$u_P~IRTd+pa%5%sz$Wx%eBj!~u4*th-~17Ze)^pkwr{p``6 z-evlJ0xho5Bp=4T)k{HHMIibuRkdBBBYmG6Ygh~KklkQ1>gh73adj*lR4zVI=%g67A&?vULdUB1;9m!M4h*8%mq8|$U=4Deq=e`KNQmi03`VsqS-a>55g zJRBIW@3Au-qlz|%ir6t;b~DGQQnL{n%QJXCFv(NOWBK5wZw<&N_!(7dlE7aR3qidN z*76Cyj0yU?E!YnE!nR+1My=s|4&8rrX^7qT@6!p{y-~aIEOc}|S@S#0AKn2F{{YZ* zf$+gq08Qn~0tEr)>Xh$=%Mch(g+0vwFB>(PF~5{}MPE~m*JG>iG9}Ky4925I$K+hV zIJXM?w(qkFPat>icUetOKLh>!v{zKs`#OPOK%4uw)(6NyzA?1c;)j9w-yiC8gcZxm z3#J39s$f8r0h%hz(BW7bDCmN#`OYD{JF;YV2iDXqc#aWRKCVv{n*o|$4~;p4_sanJ z59z+@YY3`MPsH-UAmM|km!D&sBp&OeIP4DCwRj1_v6~T1;`)c38aIz#_dZ2rGXUW2PX6W^kk@FSP+kA>hn0L zgQ=?O4ehVnWrM@Fo%z;o8FHLub(bZ#u>s7 zEly@aumY}5IrgC*yR0A|v4QMP0@+=F*hsARYIqJH{)2(Mqc_ytR-*4a_b*#rz(B2A zF(dAdbiVKr)#f^n#y^)bovuB9g*=yXR#j~>k=>t!?@ciFhidykABCze7Q{t__sc9i zR?C98(98!h)^}0j+X-~}I09lh;sDX}p7)5h20K;O=23aSBc?S4?YV-0|4*vwEjR1) zVBzztqk*5gMOE`gv;5S%@zcUjHK}TzBMv;3aWLY9v7f@Rw7dY~z*A&}f*#|2JbjJ0 zc~A|Cwj5rEhGZF@bCel-5c+ldogun4fw=es)%&EG4_>Zhw7P_V>~3LX_a`Q8?%AIX ziOXXc5MQK_+f~VE@onV8#y-}6>`cMBy?fc?1vOWhs@Vj@nrf(8^qjD+96+qeg(^ya zk#g{FTAnsy0nb!*Y5Pf&G@pqu=zMui6|vuDGkCDJIB1gH7mWA&I)=_mYIb$Vu&Y04 zGQryLy6)G5-hV;4TDig1F`$P-@H&L>!6gQ@!>G z-cP>6D&+)%t!8L`;UZBSmRtL1H~J{D>hbP-mxvOh%|%*$dB*-Pj6n?W{^?ezf}5)N zgL^>v&OM-%n;|GuXhuCI=poaH%&l<9BH4Ma~@2lQj+V3WSza4GW%KOV1$Xk4oD7$Vm zwx5Q^mY~0v_W(ei7*v}BlX*=K)!3fubK<28h-DXvQX46|<&$GP3k^CO4H}pu>{M0T z^C!o65~}$fSSyhz%=Z#}zy8#C-!`8QMtG=_XxuNx`!)Jrsy(0T^^`sr!(VG-Ktvmu za#5e##F{G9XT`-^)kxQlG-3viU&%L5Usz{46xyM5DmeNx0~bF>YH~Bf7;tWSAUIy_AXMmPpyiD{e$1BG5OH< zjz>i5{`6sJZ??&&s!@&V0to(VAyuww`+se|GYhG5;T5XAbNlH9E#_%*D9#2?8`gaP zKi2*|KC0^6AIIN&ubIh^gpkW56B0BT@F*{Ft4@~ky&nNiATr1&`Dd4VDh#NiW^nOS4qa{g)SpWN@E8} zVNA}|yBL3>`Xa+~l$fm^<+=Vz#9+^mf#+KD6$=Hh8ti9@9mIeO&uz?CEGZY3(7z_c zj&BnC&JzUM@rM-axEme6O6yv!hA>FS)1iJ5E=aT9DkFZ?%Mz5e5r^?Zk7_53~Uo~Z;{ z_uDj@n5$TdjCSE4OpL@r**Lur*1z8f#>*YwPw!W;pzo(gWwSA5jl6Hi+a|J7>Y6F) zy75Ms^AwR)6Dpx_S?#{;Si+c!KD|Jx52b$FO}yGVl{FD}rS==W|T7 zR*z!&pv0M8J*kn&PG2y|{ilhs=i4rm$-oQJ`TKm)#y3;ue-_hcJ&M&1T|GWmvEX95 z?PEvG{Fd7bCA24YDDelrLEeo5wP?zu&4@OosN7!dQ2Y%wzr7I)C~xzLqOkeFszO zWA$*}2vi2h(msy)Lfp#Vg11z`K||i4Ry+hcV-UD*v?E?dk4=YWB)Ni7fy}+>>hV*o6uRD`%uRR*%M0=x2?Ch zVy8$(EPNg@J7sh{eniAV4E13t3@MM>4V&3s+dj&;TzAxo4@f`15qf$rDd6@I;~Qf8 zkN&dh{CSD@_`%500eHo6K%YCMn_pLCs$1fAII^mw3eFhV9?VglqQHXDjPE?+sTc zW=b`k_b#Zehpr~Bmugsl6LRg|Fc4yPhwYn_-#x0H`ubV%%O3g z*&+#lOG)avlQZ7?Y`>GVv5qnOnETUQCj4mmlygaUvOwGSd+Xg?=@8vT@*kn2zpQFEP8Lb}!D*kRpkD(X9jI@HxxR znrytEQhqz^@~3I26S~Uwp?wrJfvb@3ma8ipNp58iaR+%lQc69GCL6D%)U&{@r?a1i z!qC;%*!Z%w<(*<+7K};Rx{43(URDldmVw;M_$w?GS1thB+1M&TO_GZ9z=?KU;S)5( zp1r_qy&P;#5LYa)da^O}{5TDZlZg8$ zjUJq-SY9^_`5iwAtQ^ee_W(2bNqt-$@rcW$69?#HKVJaxMLqO`@*g_K>R_8 z(rEcHTE)u$VU(Eh;k|3uS@EYrc99YC*}3~TO61rwml7Y6(T*R_3aMrRxx6w#ii4*M zU|IyR#$7bZWbR46?}$Bw$u$uVBi2syIP{(LATLlo)?m+=epQglGihhHiE+>_dy7W> z(AD))b=CYaldF({d1XrxIS6Rs9IWN*_%4@GytBW$ECbW(vN%RsWn&K3^82G+u`XGA ztphZ)M4DB#-9BsIAuHU5{Fc4%y?B~dE%6}ls9ccsks|*sh%tI@b4bUR=v~k@0PP!ewlmq^p1K zJ9}@RdssGKW;)L*iR*hOro+1KT9`egAlS{%jeUHto@~=BY?q?g$_sS$=m*67JEi_= z=<0k@Ud8kst65jK$x6J26lCrrg|XfhlF>uP2fIme&;z~e%Rw4V9Hmu9Wn`UPQCH)a z5n7UoyroBJ`?hiR7%snPXbj6GRII1eKmE)_mCJxoF*)yw{dSv7M`%Ax+gZE&i7&?5 zWoxV!*bnXVj8 z6hO22RK%Y?nI_wcq5bep8ZATJ;cbId@Z}eijZ>r`xD2{F!}bp-&&6)6p340rG6A3S z9(%^W4@@@L`*%QBOIVrdu!{0ts$zQ$laJ-O=)+G#Mq(zcPES^TVhQ5o*|S>3+BC*v zCZ0sRb3yTZgvZZMv>?v?0UtuVQ~ut%#C%wZC%J#$yu{1ww|mwlZnbGzI@Mr0J9}PB z(DYV6)e`d+t8*;c6E7=q3FBw8Hg=5hm~4F~9#Z0EE=8}V8ndA# ztC-DN%xxGR=YN8RmdM3f{46BPV=|i9_jOqwZu2|e6SHA4S^6{0WhQ=(cyfsnuf=VV zayPVE+#F%H*#*VQBgsr?iAluhCKF*FGqe>s6eL_}prX3@BMxdftb@92GDe3C7_V2Zr z71;=A&a+8G=raR%h;#N$qpjPay{F5@$eFa#R4OIo#h}Kt1H-AQl=j|m#*7O zNNgt1ap8E6uZPG%Ck8h`X&=fjG5QD7{Q;SnD@F804|z`Am1~Nuw<=IQ*OQ z{)ANDH2Y4&ku`D(&P`$mjD#Q7HX>pZ%9bIrh(L4pmioI~hO#qJ&DLhC1Z^V6>GNF? za4A;eX&5f7?xNEXre%pD6~7o0R@Ww`%iVRU@#-5i+9{(VT%^<}5-RLFlTqU&;f7YclSY%P zV1$cc$k5g7H)%9kpjZJYHGx4|@eeBSJH8fr{#qWVw)|4#J8#mcA|o{P+b=FPzWpYR zCZv?#HeYIJZ_=nPA(Z64ECsPZc9}7kl|4->m<@K2+nhgKC+-6Db>g0AHIMZcW4vRO zdp88z{pf2=#WHc?KD>HY=v`tSorJjl1I0SJ3PwT_{GI(xx5?yZSn980&n}zmHqSNR zVF}thZ_p^C*#)d6Ze3k{d6}`2*mIY-)F_+hGW&*NGG7}7e@%+9x!Rb5;dGqH!BmV0 zS_zQ<7eM=o5~Vc z;Q`ul^vmIT>YvRs8jHCtv=-h=jR|&LtPZEX-+v`ye@2fZu(7vu6$_^_DsMyomSrAT zx1xW`Lz%E{0ootTfpwgSxR0;x^E)<1OK)=9xM8Jy@0nPrtJm!%<_DDe_ef|D%WQ82 zzkky`u)>*&rDrnTNU`)BSmAud0+bhy5?@Tuhm{obwC-mz;`&OomD{n`9kTMm1NpEL zl=?UN(N})IVzmP8wfD1ig0+GB%Z&NobaUB*LhObz$w-f#aWI1f&WRj5LAgI_tlP#{ zOUJ6OoOX&^j{}Yk{Pz8=*W}m>Pa^5k0Q?O z@Z$Sj#spU1dKe`(wrX;*5>LoVO)W~Al8-9!ZhuQj1EhP)C1~=qm{&gm`3#98~TE@%mlQuCX)iK(~{V&7*; zy4t-$iT@%Cc?!Ix-cHP0Ay44G^KW{TcFmmbdG_hXX`5d4@$B5ym^Tz;yjmhcqo=| zcyDS*+ndgV7I~dU+1PJ`u69ehdVI98$I6n8l=>Tdh$y+x8j9`DTtxJ7&~DE_-pNcD zTji3bz;UW=_bBo3uI1GYVML@{Xk{-UvTYo+_-R`4(+uRTkc*p?(^T`XP}Z-I{Y{tT zKpP)ND~6o2*0NWXTzN*9EVO z{quE7{cJq90b1E>h|B>r?{4HBjEcCDM3m_c-mEQbJ->>1iS>xTL#e-ey%J|*8t_8< zEULsauh7*g&!3l9KK88={3^4wJOiPhWb3N)e;5eWx|JhLXT<%;D}%Rb*D>23yWeFX zAsGjsM4Z)y4;H)x30ce@Vr@LI_ z9$-uskd=jE&8%h^Zf-p;tXhoSz$K zC^ap2B9dI8#INyhC|SK+Szivh)cfdNFQF6j$|N*p@27k%Ua;)0ms)_PHT#5b^G2YZ z^Sca9-rlT^UoMv>7AtYK7T8*UGz&%pK~wW-s(t%&8k)GmU&`?ep{vaHIQ$VY_0MQU zG26EuRpJdqYLW)2wmL&s$KT~D{qmf5?;^)JCDJ?2y~xq|GT#S|mkO+`1{bE)$JErV8i@t%q!V=6;t^-zpo;Q*3>vT`~?H zvd^Upg--M67hIR=8Uy%J@$fcEDR_9$^Vd-tZFXWe)9~~XfHw9uwvP*}yhR^ze~y2N zmB(bBn z`>z~MWVDnd%M@#+%xu}=c>OzH6+Ww}zc*5Kty()aS`)r%+ z_>j%%+=aEDWpfUV=N&S~DnH5W%t?}QoDgw#(BRNn6#F0H@5|2$hUjQG8|z@~t2BC& z$Tq&RKlUVBBZD;L-~>Bs_4$7ga|G4_zw@>Ch8^-dXC9T?&a7hc&ozXTIV=N-!24e4 zZnLJ_IJLJrXFrmWeTHK?R4^L0OZGaPARE8^j_t=uT5cceLz<6hI0xFtJ7{#NN3r(i zDC-_#w$}ElHN|}m)nSiVhjm_P^c#rW=Z2ve04WGEn{$Z=M)*pmZ~2=J4N~o*4CH;5b@P<{{%=mH-+W$P@3^^BKK0sn;^OCVy@UiOxsfNO z_^iH0sXqe(W2~3yG)+=u5gU_SZ1#?kjlj~WMwtKqpBtF|cZ|S-LX7S##O0k+)+Dop zPdFdPUfKA35zNn+?lcPRY~LQ8c2AJeo*=Lo&8$8~Gpm!)90(JGxRJMK5zH=|#(QiU z4|r2){4u97Y14Rs$h;1D=j1hkj|u0y?TcV;<9ld*+tK+m+m7FHP20(Z*S1;H6^rhW zjZ|#FyB!Rb_ghLF+!@9P{V6`kN&oQL+Cn$>ZFvWBlE6 z`##%mxX1R(NDi(0T|=^{IR(Rp)4vMF(D`7BEc(@;!0>g}DBJJ<`wSl+E-TL^f0%q4 zw?o8nIr3(uAAR*HxMMS+SUux}Uqv^OVm-{(pARE36UK*wG+Hhrlq?W^&6c4h{GzYV zO3=1RqOZ;8z?6Xm?d$E_hT`Y0Y&?$J<8d?vJ4T!(D{*<*dHKwi5g1R3RSO(OuE^su z5*I`YN>JhnzsMmLSax21tqT#R=fEY-O4vNgB9~g%&I*_bzhe1-c#B8qoJ@u%%XBqK znoA@v;;Cok1uj?vwx50j#~!VF#A%z^fd915Ra4`V96tsouWO5it>~KTGP_00DffRr zMyY>S7EFOdRlx6PzO=DFFDO<{wKAO_N_>)?=Z4t;%r-8Ug>B3+*Ia^rc$Ij-%j`~x zpHH)XvoWij>+(6@yRx{Rmfvst@1L-7{R9rKz++1i5_2$Bj}w{u3qR-QIFRkEPftnc z=)T(4>m`9dzhef@iKF_WtXMAs9q-v?^g-I*D#Plwc~_Ek^$AL&hq;fjphJ?-9)J?B zRlx6O82w>xhs&`K{k#udqv2}*>8g>q+Akcm@ttiw_5Rbtd4!TSE=_-0ZU;wab@s4S zY;CR^+1T3O-f=dz_MuU*wGU(tV{12`BbJ5n_mu7bJ8W$|CARJVWnV1%U>I9_sO?d( zwKKP$8(X_u*3}gQG@6R7edh=NJ8bPVxxD+_avA*m^eH+*Hjf?~LZE%JZKQ0z^n=l5 z^U4qYzmd(UJhX6dn1@)MV>6+-(8=?${|fz8NkVx3sXB=JpS!%J`7I#a_GB^%W1vYc zrKa3fl3xZnvds%^VeTV)0zPG303=pBARYd$7n)+9HQ$vzA-_c@Ja(hji^$jvXfBsh z)9fnAuVv*u&?N70eRUpa3$vH*S?zmd&uWmEsMi&%9Vk28#_SHdVO=@EF>=1^;_*Z3 zd#s(@^YU9dNn{&qCmWH!5<%w$u9Ex~$dP6O&E-{Ue&{O6-wK)2gKVY7ZU5gaLkswP z^H=*y<_F*k!l$fT=>7hlg#eFRXMIc17LKd=T^_Hft6OY2^hYuN`R(@jzre9S^!&}@ zJ~;pPl=_*>Y#5LZAC!a-qBH(qG8s4^9sZ1emK~lhZ`@C7`{fpvStOVe~|KdnmRzWx`8=+0*gv{*}6+S^Lc&Y@uEH#YGf~J*!cgI zQh(yi)_g{jcYyM-*~!}AzmY?WPE$T7Pgtx@bx+`X6GWZYWX})Sb)8ke7d3J=YQ9Xt zlXBuGM#>Nok0kDQc)wfX(m(F9gxlX9P}lA;5F*s_8QGD zUH$Wc;W(sfz{l*Q+vm8qWP4$jVwHK7BZ>rV(E-^^rnR-+ZmYRe#OozU zX-wef+qhQ}wA&BJ=0?xRaz8vEkH}@Smr{Sha%KIAA9xMnb6gOUGjz56@8ZrY0d&lA z#);YNZ+nfp48iZhAF4EVY&tAuC_bl<@3&?FF`2D7j5${rbB`mYu*(W!3%$CUu>H_Z z{+*aohGO-Q2{D-n|F0{a5OE*R$2}i+%QYVg}OYaGO_G=Nu6J+v&dX z|2!a@|3j(Ym)4(+V?<2cx&0*G7=b%#O@d{m@t~H2zTwCbtur zf}g??w0G0mtIHMb4elSwQ?0UM{d~5|>|P=n$%T>;xyi-mwBpsY@=~5C|CL=nSuAi{ z9C}wAkj=z&#ahXEtT48tR97GQyYP!k+@Zu+T4~W_PTvT`J)Q$oJb;0x)VHq8TSW#TY?r%D<3EjG;iB~b_~V*1F}f~UzrP$ zIu|t7m)#1|M8xJp35pu__OzwVU*b zcAvJ#N*b@L9o#3Sz{cb+;_JBOZ5QYN`()wg#^ZEWiFotL(}X^Di5FU9I`51Z^{?4K za-F|LssEO=cbf~vyZZi-aVdt~*MV6g_J#H7+Q*2Q04lCc=ba*fN5>?2xy-_c z2)7Y*2^}@*aaZx($#k#tdjoWm^S}38T zEWMo)(asI~hvoTSn9TBsc$;onkN4W+{nQVLnaV5KDRr?rczvb1S~&`@?A$M#H`qBV zu0N-br!b=c$NTMM#}&(f-sQ1#8hpU#VRYZ2Gmo~lIr^+)ue|8T zX08KovCqRUMm+qWVkMbQTfonJ+vi_9?Bl|oJ$Rkl9MX%ooPDNOyp={>z*=U1ukO6e z2q-WTt6&gGS7ljO|6`WR#2{@46zi)YpPcvqrQZ|xUs|eI35fg!Rb^L+n0S5$pui~qAl%RWr4-C_>bmASH@D$VrQymmJ6_nGe13v2I9L=wyKMtj zF7+sJHvSJtJP%s%ypLtJwzy51wC78l@$Pu0>|@!tRfaX1U7CtVd&161t*7CJr1~N? zxG=4e<2)9|{;^f?%`F7&BF2ub1=3T|?IaO^SS*m0ElAIfC? z_Q!s|l}1}+G}UoD3@7)UKeqZ^Vzv&_ihquRS264Z^-P;Qc^GfzXv*I0;8gH&+Uo4l zg|T&iq0#V8BN3~fKsE1MjzFzww5`($%l`LLYngs%R6Uy3i$0Hi=$ zzve59A6@G<^#@^fp60l$>d>0nnr3TC&}ROHMj4GvcUpFhn`3>k|Nnlio96;NJR+Xu z13qSV%V=l&?{A>QJwUvX@u!QgsrUl%-BN(~LiRnI&zW@>gntoVb6)Ouz|Wi*eWy8Y zi{nH1%31T_%NCfpMeiy+Kb{|oW&N2(AG#fF52#YxXz^MK83ohFrC8;%w=$fmSXvHt zo9Y;2Nhv)h0X!tzCYweaC>^@Fp9w+yq zI>zWO)m3Nh^LPtxhakvgI40{|)BY;%NFVIw`^s)M&-HUSu12hGg08mq3f!IaJFsc{ zWYY`yOu6ie;xMML{+W*{>wPX*RT4Um%jg&#Fa0(93{u3)FE~$ENf+xotneV^cr?#b z8dcNi=~TxUb!8&w%{FxmKi{5szOEj7hnV3^SgixJXFUnEBPAVt+274aJhlji;YRW z!}5U5^&fjj;?cYN>*8B)7I9#|aUsvsFU5beTv?w%^sd*D@$+q7GUeCHmGu(QyILXr zoaDNuFnanZ^*d#C3ED;%@}zz#zHzy-UM6~10P@c-EC$b4F>wOo67+QvU@;r}Z#}XZ zm~l3({XKSEb)h(CN!4S9a`~6Ss&!#nfCzbG`^2t&=rLtI3bD4rqpK*F4E+&U`Xh=Z zd6jrA3YwDK?~3Qy<}t6id-!=@1$zhCN_@0+f0RhU&nWe;dPK20Jcuk*V61usR^1t@ z4WGl0@Ouq5+wqhRc6;hwZYL3#>?a6`C3nE6mvr^3KhtP$sbc*K=uo8oEv+)*$ko-W z0ADkdnr0x>xIMI{1=69N60}aa|BsLL*z0M+8XD^fA#bTYp zD{|M)Kl}tr(wCi=i=wO`9oun?(&3r}V0&Xr+s%sA-5^zC_%7we$ zm;JMgP&hkDiunEB9m1zGSmwgCIs&aUbqwx;Q5P5s> z$R?A0M|mFB!kC1@*`LZ%Q}zJW9PFfCuCMrF7T?!$^B2f^)q+gKmuA9x*PJ>W4~(vq@(K37YxsS5MLin_srGL+7Hto42l;)H%*yezuAvyBU1{_u zCk@kotlOr)NLQI%yfEL%yXxonKLJXk;nTF@znFbiAQ{~v4*`ExLV2uND48{Dirc1R z5(Ku)9|mdk2&MjX`U0}9_S?S`HV5|ajSx6p&ih2zW@ zlK+xYf1QJGS$&DI33}I4FVm=QW6py&`OQTl`3LNQ?a!~B=NXdgW~^x4KlZI)Qc>O3g|j zw0`^aHDxF`v`vDxP455Wq||X*4Wscp!}B_)d!(%WwEJJnS|&3eVSQ)%4s>uUEF#Oc#={L||tQK z7Sy|W>><;O99%3WN1oz$hlLzFHLt}jav)LKetQP;O8HtZj4iHrn=1&Ke&-eOiY?b6 zlAI|UflO$3RKaBWvwntFEvpoFuH|Pax0U;dz~W-Ok({kqOJ&51fw<%XrztU8v9?$1 zDqClP){BjTw}{Ed_>yb59eHKF+jMBlZgHChCuw`)cS7zp0$Sqf`nZ0AhLSr(?*2KI zFn!CF^*pYn5@uqCVkK%}Ib~1 z$fk>piRTG>HfuKQcb6rO$-hIGR)Pd}DC+Yc|dTQ(O{ z>VJUEaW48g9-L~l6d}U)luKODS~3w~d(+zzv=$E{ShnuQR>v;w`1KVf@3_<6=T|t z&xdv8+io*lgo(1Y5_NBO>fR>CWizY$Xu_VyBC$6(efo1+nT_8ZF0>u+ zznfOJP8%+}&gol`uKow5{wl0gnT!lv0JDeqgS|Y)sW29v$o+=$HysfEXV1Ez%}=XW z`j*J&=*LRVZ!`yyjRab9lJKv*?(ZCLujAUZa>-kU>G{4*PhF9&-eqHMmb+jju2-z` zn=z#&NB9u&-@U`wPUT*3IsVH*(f>x<51i3_OoFKl(u#}H+r3p+nXIJwi0GL!A8F)w z*tCz)x^TC^mtgy1>2;D>euh@~)92u}VY(HEm;Jh0NvS_O?cL^Y55HUC@L-{?j$u4; z>-B9Nvb5_dxo~#agUb1AZ)W@QDkaWzj_%(n@is~9A^lI+$4?SsfavOY=xT98`Ok|N z;vKfS2 z)4~$8-ajbuUorhn5&Jk?y1HbgUediviF4nqNwRUR1T$HySeqVG*0XsjgLJ6gHSAZt zz$N^u3s9Q>caGcb3l`W|p%|ycYci16EF-IYxw0Nvu;d?q=Oxz9`|UpdmFfKX$`rQ0 zCNq_IcfJyzEWu3VDDhSxl)Rqv1n);JP_x&Ayps!H?4s14>dXBJrGD!r8ttDg{H&O6 zz~s|yA+eWT!sD}*p|h{_m`J)Kb0~grrHw`5+*`~{$z#Usg`V{==tYSC_Zj=%^dcqR zDk1cfPgD4ySL8!?_~6A)Wixq^5_hnJuS@VdS%F32KN|zT`y~;(J2Hm&rIEDRK5M2Q zYt2ut5p>oHIvXW)bk{1@Dw)+w4iUTFw_g&zkV4D6+bd^kBMa(s@KySYq}5AOuDjYZfTC_mpQUl#7~ zV|B@8dmW#-THx?a!WZeVB0*zgJrPPxH&8LrrPOQ!Dgs^@Qc4au#-oFj`v3naJ6b+# zK(ShY!%Y7f{6sdT41RvLnej<|>ofz`Ofx2bI-Fydokc}T zwL1^_TbCo!oB{1Z585-JcYWTVyl{7sQvDh6#114L-t)Q(@BG?TUG-~Z1Z&+moNz(A z7Kr<#(tNMGB!3YQUs$A6uYeqB<`^BY-X#cCavUt|S`F+f2V3_po-4|f$6vAg6Opqk zo$gbg*mjhi&+3U!WmA`nf-jDeH}2QP%DUeoBlaIaJ4NQ9`%Y2qPoKzUVC>oT_B!>B z)74if^|!ci_-~Z@7Zf9Z5~;47=|bM8os$lY9i-YOAhb|cYF0@IHIyUry)#s+U#_et zb`GHxkPk@`v|kUc-;l#SMaR)ic5O5)H2c;F0!sD+9 zELYaA0&04Q6kEl3*ac%Xq%};pTe)abb^UU0!9o|_u_*O3p0B+C%NUO}@%-h=`p*S+c|7V7aa1<|nxCNKmKt)0ru9qrj2sJ8n!>59>OjzjD@z)C@;5YdNt#pB+fnqO3huFj?X{Q zrA(1rh%+7Rf9!af=1jI9JiM+sQ^fb9f7v=fis_j`1|AwEclt3R2jNmIIjF1lnNp1F zEZ0mkDqkli)8`)W*m5H6OlteZy6V)W|*Xtq=h$5ronSZ8? zw=Qu1q)T+Q>z`+j_g$aJ=4f~2g)Wf?M2D_^D(rx>?hcO;Dah>YPLx+M9iH`Ptcuc@6&EG@T5;w(H$arfB@v^QodRwK%*8f87MzbO1c9DnkU(&%t}^PTmmfHX1v zoAJwbAQW&Z7L&J(=l;(YL06+kiR&KWr=Lm_pv1W>0phm*zVm6Nex}B(4c#BvzMCBT z;9^+K1RVvr*uCVzsr($~_ge&R6w@&ZA#%@ra<$tmLm|fi&^<6VRoi;=HPejMuaO}v zA=a5C=&o>pKqBUYS&Jn`Q6HAP!!lsVj}H)65Ja&O_pr6@3G!Sqa|O;BvrYBfmXgHN zh$jk&k+>C>l7qE)=?ad8#=rmK3M0_~t3}4)w*jpbdRK{!Va{}%LcrH^t70W45#!`N ziq*^g>4}kCNQ}g6SWljz(Nj#uV0?a}3Goebb!DA{4>WnY(R(w@)H+!o6H64UZy%cv zU##Xbm~38d=bxpqN7?5+B9D3}rGECE@Vrj`UCBEXi_NpXy?hrxGhCy@dt|a}|6;{D z_B1gTc9yS6yrIMsOAuE`=?@aWMLf}N&4Glj=q}2}k@2x!G9g&M zbh?m#xq8?Aci8!d^PsKw@_k@kk)7v0F%wo|i4q6*sV9-fv7(+HQW~tkGc;63!yPcY z?VQkjE{iLSv39+QCMBL&jCkVxmJ*J&IFrf7{w>`E+((c5DrV~HpXR|#ELP$ei;Bc_ z#rk+IOjfq@I1MF!tHe=&(6M_suKVT_ixn%dTC8biU;O*cqOJRmQ7uucSSJ@N7L{@6 zrYvZzouRq8yuvteJItR^>fcW?V$OJQEVmr2WqqkXINiAT4sfi-p5eH%uH+b9HRkbl z4nHnId*OPRn;DJMVRdE*ET;V`1U4iA&zbPMxiBB2)PI5$aDQF87;(qvA&@EL$a2>2 znXr27@pIaG&~EFA6IAPdT8|I;G-m4RV*A;1$0^SN%EtA-?Yjdu)(035&0uo8x^if~ z)`kpo==aNqfA0(#|Cdt#ibq8b>Y?BJLdJgzpYUM+puoBj{};u!sW78<-0mApzhpcn zGdrMY&3|Vg&$>skYKiYqw+kBMiWkZjh6S)Q1Twd zVmhbJb5Pw_1E2z0jWWBE;I_e7brnKYRME-PUveq#ElFt81$V(^#JxIx7y%2IKES z?zg!Ex_a47;{ETHKuZi#zcd;1YHvnl=K$40_Ib8Bv2#Q7=GG&oEPbAop)uLs>Vj4_ z8Ik7Gl+&A>N%%R*$tGA6iM*!bQkbU+V&Q*7d*e8p#_F-0#>brTD2L|AyVnM(KmEO> z_Io$IFWP7T4u1*oezEtyHy37-kB8J0*h@8MZ9C(C*IbxyG9A{YFR_Xk4t?L>$MM+C zqU}~^{Ps{SxkR*M_0Z^N;to~Fgw_gUnf=~nGU20DH@73OooCpX@}`beM=m&oVR z(*!HLsIj_iIU=r~-uOtT%=Z8D^2;tjWTOm?*?$d?n!XsMTKd?+?!#0Uv}BVQ+m*5s zKlM#}EQ!!Z5|sMO`lU$Q8LCwfR1A%SuhLi`>FQVZ`(H}XKFq=HnsGtH&+k*&UhZ%D z@(k4yO^THy<74uohpJiGlO7lkd|Q-zdyo$8-xo2SPg_HKo%#nUr<2jh)=-$OArv;% z?|!PpSw9VP#Jf+hHi<7bcdFQz9a)fM`z(_KJGkB&O#G8pr0(;#KvzA3XU|9dRB)ZG z(|tCN{@$kV2?9;YP~v4?S45Gaz0df~<~4ysW306)W30@J=Q-JXW8rR_bxdj#;lN1zru6W_+#>-rF?8n4~+Bev7IwOwG*jp z<(f+4IlGRraqipGHDxNy>6H4zjP}Vc9+T_P9=7Rz{2X*Iw(Gj-6E@zZv6`tcy#%pI z9Ak5Qe!W~>xq`_c7qr!#lh){c4b@Cm2iV?%+bUPM5a}e)^h85-SqPCv0&SrS^VnZG z_lpsB)ZHAbc5MEyU3h0T+-p|Y`B;7krDp47M9M|(#LxmDv{grh*%MnsV*g}yd~NF& ztlrfwykp~b@OwL+kMrSSdz|U$8q>3(Smu#xZkN|@AI^oj@?l;5#`ckZvzs0kezVov ziI0^FfMWvk&oIzl2ed!fE@HwH89aya;UvdOv*WzaQRchE8b&$6AD@N=Dl*!XrD^||oQQrWj=h3q@@%plctS*c-l@O+dWyt6{ap~M-= z?ZmH`y(Q`Dhc6KmgEYkI>9&7+_a$O>4$x4`iL&Z1&pIy=@rk$OU~Q`h?c0u28{PNn z>iKU78#Un)HY#gdaid~Bj|(V>vG+DL>8kGyaTXGG55L#yLIrzX|2>ZR)wOfmP`qCI zQ{P0Jz_FcX4Ai(yJyV=p?LAU$W2F?uR^F$pZ*ODsDAv%X`*d~Z(Eq;J_WN}8)osM| z4V}~bMx3Yo{v~4SMX27x?}!j%pKbPUA5iLd@ITIV-gm;z9e0wDSU+*aX6=*BU31{X z9&}v%p=<{7ht7`I*5B_j&{u7I>%+6pd=7j#lzSz`_ut9s;fsAe7iKSy82~>6>*0Am z3VAHekKU(ICx>p%hq9R*rOoOO?YsD~;%sr(hqCF|0*#W0MSS?1;CWd-V|E3jgA~R# z%z??z`S@AWpWEt}jlRx~7r=UoueHM1J=>hMRv25bOjj4O|1$-KAIHhmFEjqD#?8;T zn)!Sd#I`SU&i!^gbL%#N-%DrazvK8Dajdrym|kQkUiPGY=3)^kID|QQy==!p$g!JW zq|ttY;5{{No?owgtT=CMbm9%JuOEraH5S@MFVJXN2Brnv!nY^cg!ngJ6uIM*O-elM zLS9c3c)rJ}ZfH*K@_Oi9FFjAAx(gLOO-h{SW4Ty17A#lRcUQrB{&^a0C8+4G61mwF zFW6qx)hc66?0JFpyVrxf8BBLLANkB);`hk9uHMGx=f{XA?KrRO(^SgAPsH! zKFng9ms?NJc86E$a&`6Vn_zbTSm<+eWM~6TO1#vLU%!*m5YMv#nd4$exop0t^8J?4 zvu+N|!<6euYuVn)^rTa^UjlpnlQ}TIpw!QJe8V{OA-7pQK1nvp2{LbwPBv!Pxj&gq zoB)xpZ;QP*JWj=Z>S#E6bY{Nc#BDUD#efZAyV(AGfgJP&=F}L;6>?j06%1MmtE)=H zfN`9&YPZ?=FY=-O^m!T;XO*v>1HV|DPgUfgPsGU~Rwv@9VjGWC8}edZ-T9i3g^C;P z+@_b68pcycA>=B1uY0ks{^d1WuDa09ep`9Ju0qzk9_S=I?(u{jx0T3Ltk4{^wN<%I zg`lE?uRDP)wke{kkMQ@!9Bhy1>VuucWaG&1K1)SDY&NFd5w=gh`pow`iSIjGh}l_$ z>JKUP7uh~ypWELLp5^ap`w^0qHC@Hm^iZtVP@d9M?ATg+9aGwe&dZI58GnvLJCk?) zJ(A(@!Um3EFY<7)wenkAm%eWtv?T=XiJrO|w#Suj5i!{dpsV%1mXc!!L_8|f`Df^> z*L@6K{Wf&9`A9=`Z3vO?juE)0%@VZQFA!KF8O!BS9=hV z#w=0x$Qe<#-Y)ws_WTQhwZNW#e#XJ}^~c7Ed>*lKFKl1C!r0_0w;6VcxOFxTtnb&b zI$9A~Nq$zcH~(iP3j6;*g;H_FgF`v!P1qQeiw0>lY5Tqea<4X|YB$ecn8n5=SNPntpBXvk zK}w^h2k(>--=RPs)xtx$y6Z>gdy$~MxLMpm?4#7r>VpLB3)pkiPx%~$Z5*H0V^m}M z_zLRyXB3|8pTT4bab(KKJhSOMovtT{y~-UsMLc|8NySm5Gho#N?G1p%Y?6?3uOg$v z|31G%;(L01HH?kZb+tSPeQbYM-nZ`#$BX@a&-)@CYiLZ;uo9K?p?!ZdjlMESqsJ-j zv+ecv2`6zG#d@q#$W!)x6XQpqU3Mu}cS_rOmD~JBTHDEr;kJq0c4LXI?qGXJ zlM?UQA@CdypAoU4PF?p^xlK(*#p`MHZLA!w@9Vv?SywWQS-$dpnfuCeSwB#3-C5-} zf5-Nw8B8AfVvDQXW*Oskey%6hBKwW;!0XPslhM(Z*5OdqLxo<_?FLQEgw z``%So8tnOu=V>%7BlJl6_@~tU^j_Iqm7!P@bI@1+?3KnwyAPrFWz(T=T$S5=+s24x zzhzaq&0bOx>mlQ9tOK@|OJf(=@`35F|DN8T8N+S<$m!2`U2Uh-e~ZL)N-_4iRc^CW z7VGAV8-y;KU+Fe$DfOq0>F1Shp8s)(S9f1&(9JwQKxpW<&yJT``$+m4ZE|IUVX{U1c^b?wzKAG`sklY4t_T3e0v!)?*`hH(=1 z+4}H_9?596_1I%lb(INJaz0->!&t4sOze@2@wr&LK^~i5vudiiU!4x?GQj89mHTdh z$#e=QpJgZGt%nfrcJLMksW#GtMwy2#z*<9E3~I!&XeA5!8ICLn(WL1gS8)&4X~M!G**@4!T(O^I*cfy&Iu^Xg^ZThobNVWb(+Dxi`S?v2L(&D%rdo&uA%e?$Ox%Y`qcY32yHc#4fdYgO&Mo7Mq`fLjg*) zgWO+5;yKktovzro_R?tg*|9+}XOBN_`v9CIB*^ypYm&10#w?hvGCC%|C-8iR`stGl zDQCE!H;>ZK?)T2l$Li?O$85jo&t{8!L%pOp)PckDI2Q6EMMptG=5@Vs!A7w_61C8b*0`|Ww z@pzciIl?w*9EZ)!?hpLbXFN9xCbKc=?c*Zl?A`B-izw{#H`$TqL8@&Whuwi!%K5&_ zc)OSBP~3lFyfYVlfnzY-^I?kLeZ#-sCK*(9eouX0GAtD)yld4~8JVYM!}=(n-xWrX zDegeU`AKo?;z52E7p%xaNVGkEWE)>d#(s6goc9IFWh1FNJ`DD6kITl#>A!s}8}F+_ zJkb~U9x?W)qx7SX7=Kk+--~!&bUUV$pCP|9NTci>k*j%_zQAoRK4x20a7=(8;A7(+ zc;#aL``lSDAE)A8HSp7mxepHK%Yj;>-`1r96JQ*7zF!67i1YnU7{747KLg`u+<#M7 zAEwm*DA0cQIK_HRM#ranWRvSpOg`Q$@!0e79PDQD(fh8gN7#DS&)*%=Aw)dn;`D41Is}4UucZO=o`D|}2gRo}z1kRXzR&oEvEBLp z&^L^&_ILLFqkFD4Y6`w#ynN2Q8GjS!O{?%uYCiFM21n)-&(2)gMHgPOD^(9Z!S-~5 zSYt|D>&a4x{p2Dq-%q}In&*V;xFVHjP047UHO#Yj>=|j3f3+u#XD^yH5<4mb+J8MO z?0}P$?tbr-zzqo7xJ%5IEJ|xHaKmtWwRU^k?Do3$$Y#>EL7toLHj~a8yvAefc#dPf zhvc;Swx!f}@g8B@Ow7S5>_i&|aB? zJ|53;h1c-gak@X8?l#Nd=l9o4wv7dRuXf2M+s9eonGRO}ir2v9UgN7S+rG5(d^GPF zJ!jc4K8>HpxkjeD&EnlkTeDl(qHp|8%wsr{&s~k;M(AM=jB=vzb4crXVkQVGbXoj= z{CQ%w5>$kbG*mC~;2ri`-}8i@)h_XX<61r<`*v;5)Kw(|#+g46v&Z)JGP>+Je8nqr zQYbKznY#LN*V#JdO?zaXTcaie#y=_bn;xDg%+K}S0jfRLC7atu8JB15acL|RagQxB z4z&RqP_l-7-(>rIF965zKJ*Nwnz&yjv2IclJ4VLG{`fnQ>x_*{*`h0}y9tSjJj1@& zeU&bLZ+DC!I5At;HShh2nC593I_W{)|K_4+%z+Qx4}!1BoMV`C!x~kp-*Xt(`uz}nGjp8@zGz37DZ}K z#A;i#<(N~aURr{eYEHGqc19d(C0qn6s3BI=T4g2)N<}RQft-Y7zn^_MnaL#dX`kn> zWMHdK(8E0K7KZo+5n%SFw{gYGJpt%t7 zf_A^f&b$IRQpqtk&lmO4<^%VMyl}D8SdO7}4+3>yF|h{undg;Ql*NI!2WXh&L(PeO za;+`Q(i<0ozA;zYFtcaqRnx4uXZw)hxMs^3cMyCWyrH}oN+<$lu5es8GIf{i<8a9PFn2Ip_V z7x*|YXSB>0{oeVs#EMAi*Z;Jv?MtbbwXHldgZmR#JFK6FbwB|BdAM%@^ z^&O_v`%v1L6Decfu@4yyGFL?4hZdPD@?m{rPm#VfW!y|}zu;o0anC+vG&`oQ%V+n= zy?24lkdKeX~)VZ z@4ggs1wdpe5NjTS=%0^Cf42hBW&4oP^<0*|4N1RRLAHMPzNu@hv`_fDF9h&}T*Qh# zm&Na)AH`a5XAB#n4zHJ=JN5U%@Qg}PXNt$#AW$3jA;a$wXNBF*4U#9!MrVD{eaN^O zAfh3{F~rz@iyagG0FLvjK=h)0$k>?H&edu3vbi;6I|LxwiNKoV!>dTWH~drg3NLIr zZQiGYSp7v@e#Hi`!gJpfYe8=MmQ;@AUUIuzchFm|9EPdX-$uR-D_8}u= z<7`Zm|GC1PF8^~YJ|(@>DaszD2~^&0Jap!^mDu^}1vlwOPa^+glB=QgR$@0KqJ z-ovCCUsK=TdYbpwE}ZWD7banM`o1D^aM;+ZWXu@n3r5^m#P;8li@<0(n^-G?B-Z?O zE!GUmy89M#Un$oW{|kZ2#tYzC914m(`V4>?`a1tEJM?vkeM+hK%_(zRVs@eW{i_hf z+P@C5)A5q=(V7y|gKb||K=|*#9LC7>ECd6x1+E&Kr&||^`1-BiLTx<`fo-+*>xko( zZM_vs^xL)dz~{JR3R@w)zJ^17y0XeP1p06a`K zgi65Dm|Q96`D=Zt@^@lgl*sqWMP1tyJRgu)p)=*XGr>AasrTj!!TJZ2Qx}ToKc>`6 z90LEdDihiO^BTvoDi5^z6;M~qB(esWm&c{vO=%d`kj^TAqpyxq@ocHMN-TC7`)OcHaC&ljUYS3sg@x4ObOF8)S-_2!~El z)gJHqCNN4Q=HZI+WFJkS1<$484wK(8j8HYfeYjq8ZIif9n6(Iu0|?soyN&WVd;e^X z=Ne#p^z%n)7@&A@vzx?14c~Gm#6lv+ zI<`g7!*eV{C0fi6ur7|v%txD&d-XoH7Ru#bEeDQ`5Gs-Tv;<<^GFP#^1Y%5=S#c(# zuax5!*|E<*O=&OJqUwGG*`+&t>!Ju2ht8C3bGigR8Kdo%&uGn`=rr-Mvyyphsj|(k zUl_-V`D(YQXWY+Yc{~&H?HU>H_-IZtzO6bBdX4+DQ}a4a$kF;f-HZ)pi_d!nFX9kfVR=^{M*Fk=Ijf$dvQ#n5^I2pQi;ir1kx1Gv>H11VOa&b$)L1HhF$fHRwvd z7QAAb_TPRTO~kU^nX3iw*^G@rksBOrM-U6SA*Ml3U&x)T?e}h@xCiiq7W`YIIMd!{ z@07qMAfMyDkrpqkZ{anm#5sHo5Nps2mIJiDffmpc>y&Peq370u*DnO4`7|~0neMRk zDH=|m>r>;QCfvRYEMA7JnY} zK3c2={Ws+3uo)X$OL*=f&x>a3BYj<_>SUIb#kPD)9Ve5){4V$+5xat&5LpR?1E8;P$+Hy^YqS&$M*A$Ldymn`S~gE5>|JFK0AAcB@kReW2~Tv_#M=0$ypuJp zny}#A35-m}gZE3p=t9Huxt_|$U(CnfU#JD|VB@aY^qe)y{x?z zUMtN&ICJg#B)0-YAfNDht*^YA z!k-Z6@f&mW=1eVk{ME_#3HJ!z^eq7JByP;n**t8|)PmsB`o8y^h_Q@~)9}&;aj$RJ z8r5Wt*?Sg>dsv?fA`|v-XqN6javqo8&y0)v=>Kwon)F{?p!?x0{`))j?@p#uiCA2I zZ&{=Ti<(5f<$pUsb>tIksNLB;(4^>e9$5TdVwR$llzqf=pUxpx=xXSWUqq}>7FdaS z#Jc5frF&xT=ci%yB2Yj2H4PU_?D*@X%~Re02IB|6Ps`VWN1~YLd<|ibc|!iRYeG-f zQKzdHp-4R&0w-ks)RP#S%>a>kK&(!H=-<90c-@6Xoay>DIyN-n8dBbpamOTTJV{<;{N>@?tF-?&4t-u ztSEr>jSJ`M?;x-|4v0L6h&8lU(d#iBjUwYAwue5zrRG7ICox!{1^FG+3rIiME$Tx= z5JW>9=d;A@ZxMYqJdT)+$JdMRDP){bpk^!b9F7lDwF?pJ!t1cHlTvSE0UT+3;Vhl$ z-K^g-&Kv4|5P_wQ(daQ*d&oCVBTUCyvIHAFW3>8aUL!-uRra^xbhS?bRM)R1F4iRd zcF&}m$e^ahCh0TF8{g6OGlCoxNI-;0dq z9KO#s`SM^>;}`REIG(FNv3F_>nfb3Go@X-`z!SM9%LM6G6cZG{TWSSj@e#jbHRRlWDhdpb3`qWuK`3N2rQeI>9!oR`8Pg6 z!~M9N`^9HpF7uUesktEw4C55#GV6(Jv2hJ+7kdM5w}`qtOqL#R;pbedc8aP$m+PPk zJcr2%k?$G478}2#)VpdAGAj2XqoZ&tpRU-8jEzc?_t9i6@JTU%srpAsTu&e=gAvDy zpS0h{c^-50ATH(gs90MAY;W*~XOcxnxQaIib(=QXa++5-ZgMELJ*;sSH zy6b$WQB?|UT`rN&qp{Bg&=$`SpVzR@IpQv!z27h8S7sI%e2<>L&>E3`g{#kZ8e0%V z|FDPa7JP0RZvb5>=f2fVY@YtMN8bI)^?cJ_WSnkY5eKN*PuLhK%swtR@B2LFz9#lR zqoH=3M%X&lg=ju@QH&GIu4AK9{NMD-|oB&I0RZetrsBlaOZ!JJUmZkkR2t zS?~WZUx&(k{U>{-${Mye*je*kCTlJxmQUsyR<>ZHD&*p|YK5Jv=s)=`HUL94``yic z2X8CKNS;M3j@vEe)7#(Xb?j;`-y`Y`rqgkqoKHrJO~=R{WZ1eyJAw&a;)(BIUSH_3 z?_guUJcEZ;V56#6;W!nH#x5*y8XBCS+HrGiy)FEM!(euLj}xL5_WJsN`L^GF6Qkt| zk`^Wh-kYc?SZs#w1fAZd7;y~I9QiKOb=mtz86C4^4qgGVn%!Vk6-fP2zI!U77=R!; z_KJ8{$rA7OQ|cXl1sU72rt)Rxo}}FVBc)zjKVp5gdAVskasq*+a_qHI{{2=|)SAFxKHAs$5RKjIulV9X8^3*rT#8LeAsj+?_r~ak}_ce$ED(&k*&Q*_!UhCA=Qh^3T-M9&04;caB3XYp6{k|-G;;qslUr;Jcex1n73r_=7+SaDOqrh> z3UqiXU*GbITr2X9=fCz$A3M8r4e4Zi_li$wnCFbSi1m5NTgFGm!{q>NcfCSJV4SK4 zP?Dbq&}4r0pd>%-T-?o%*|D=icEt0O=d1&WHF%Ej!^D~H>jg^#Etr@EvBX-?2j)R6 zJ|AK|9_R&9sP|Lc-QNQGyo9K=ZtGC-j1A@K^*7i$i#$fd)2}Oq$)_0O?|u*T))Q!B zG7Ut%!oEvi;W~|brsQYib)YK+avwgGueYS}_QWepE`djJ5K9>s*yi@#M^9s+9!SWX zkTDuz{qnQSL99XS4GiF7v&r`NI$*Bv6jir17IJ;%M(^qGhW;gf772c)@-Q(6Vh{)2 z=C94u_v18d^V7~-pN^-?{{^1DISo%g_;VUh84V>#p5~?TbR(aGBu|;{@MvS9p5Xf* z2S^s$8gSv_5NR+tG^*?uLn5(jv{Jeo>td%f$DmUhPx1n5hv7iaO{eb z3G9lV&jZgrN{mr;Wfl~EN~!l|1tMDBJLS+@R>5SB&?QQEo@H1&%a-!)UkFRlWjDNh&H;Az}NWFDXP9ksdqsh zY?_}3n@Zm;)K7j;$gx9ibBOx(MW6*=I&E#qT~lhTbAE%UNygf-jaINGCX8Uq@?bLH)VV)&ZbyX!R{v z>4G*W6u&DD*!Mtd^MV7lBHwUBt6%(H0IG&zT}gcTf&<@E+A2Wn>-TOb*II91pdc;S z-wLrGK820`RuT(2q5Ad=(A!Z(YYwIAhCTBZw7a0~lUz{$>VRqule(%NXlr(Ws%41( z6$hw4%m#gB7JPLjLW@@;aQ^{AZN;CFF)t4`tqiz%+y{^0X8Yz=x4!VtGVjhU_Q_l9 zbFPRzW4h1X&*Ew0)|i}uuRM#5gZ0Gvu$9Dm6o`KEvZxhc+j)%M(mzl2N1BZ0 zJT3T!%=hlxUboJ|PP1$0IqP^_(tKtgl^t$SKxKUQyF_fP@XJ)17On_9BlpzZlzM%b z)KzT8hEExu--1Y8T{h?~Ih9KRa3F-B&UbA2f}+jXAb7ZT=gY`w$mjH}_vOKQMkAc- z)<1n&%AZ0R|MzEP#9rp}u%7Xtxo~10_&fdb`E7C@Zuv7Z?kp6wco+>6{g=Rky)sYz zj|gHB7g!Hc>iuv$Fg5QPL(z92wAg!ejco6vNl!TFge3y&T%PoUi%+qPHa+q5|bl#3^22K)8$SvXnmJR zxl<tCOCop8O0sC7xM*2kE>z1NJ?9{ptnnE0wlW-VNm=0M**{tGUej z#*^4+$bfxu1U1KSd0@jULQWAT+fgN#K}!+Tj_gj3V_Wv*am;#ovJ86eWn}bcYdi+{ zOaRY_z+m@QW^`tM`wpdO11@X5&jD&(9;~n1>eiJEXLi4=x4t$<3m$BNSo0=q9Bd&m zzz}_RHvn$rN7t^Ct7MclTtu)ABMh8uPT^Gn9H+yAy4ez=F4!J%%d- z{LU6Z>`fO~FLB*Emg*BUhp`eMlX5xj_&ece8M&SOp69HuRrJ*RlNE?qk17zoeK#_; zWv0l;O+`9fRir<$d$ON>!OO_VW%E4`tmhPn^dNyLXL&c2w{RSo(m))0O{R~oej0Iq za2G(7>4A9wo;naZg20U}G4Fd4F*~&S)I4Gx$CZIP1T`MmX zDWE>zCF)?UYy`dKH%R6m7n`BqAcK9kAp_>dhpGCHr0?vs_3|B`6LDk%STVPIU=!QR zjZmaNL8%uxi1jEyr13IhtpJD|!H8r0+jTVO?B;ef=UZbn=*)g*d}KUS(|GvdZhrsd zwrgkhbNK@%ALp%CSTF8Qo)h?UWFj|r7PB{(Hgq%E*tx)HW3)DEpeG8n;O#b@2qH}( zVm$`p`6C#c?0H6S!)#)0R3P$to$zM@7I-k(a)H3_7~?;YF4{V?u{G2Q@r zA}=|{irtfaV87jsi~z(yJHLNOx%|mA@oUQGh~-xpuZuXZSzl~Cd|X7)w-t!`?MTA*0Z$OjJ_Pa_oT*B64P#{-)HiuJM*@NDzI zCO;JGLq*`RpKpnSK9ZMwhuKKqOnHylZCNSrGCSsAk*M|Gp@7Qx8lNHKShB&I2gEvj zuEPjTbH{4ehv04ZluXItm6+nDUH9$;6*2r1KH)T+^1XTBnFf>GJVb5mjwI$9qv7mA z_Pp3H2Pm^Cw>|YnaY`E!pXY6AV~Hejz@I9TJPDQlpXvV9ze)FS!Bo1R_!sG3UBsS? zrNp;^$#j`CSsk!t^$>OhY<#N`>@+8G@TI(_^EfttIIci6Zx=G+zber;I^>z@@#=NE zrk;g{rI@ObrRrxs*=%$la% zsBAa!s}lXr8RCp<`K^ehjWHVM5v%o(sGn@>tLb;q@k~$`ZJ^<;2-=DfRIeMO>I-*} z&e30$=m}h5#&M;&!leZ-`>pgJD-i9K^u=+7$!Of@67fvMil_~~A48-HN<^LtR8I0) z{h0f#D%Z73pH)AuH0^ue85?L=Ln1Gb$%lV@NW(31PW#u2nBqmpX_(nPzmqihGqoV2 zVKeuCu{Br8{rDKP;19y$F7t*ls&1D4#+8gOxGaFqbr=Kl*m(&iLX3B%=3A9u^n6CE z**=Y&HV%LH#J$V)Q}OBoc5G`34h_#wzqeB4rgx;wZDR;@e~y%MkCf=eO+BJYp_^8SeFPJt#-tAYDMzgG$TEMPjpUnuqReN4*!&-?i4+<$K$yQbO4fAIWk z`}jw0DSt>Am&yMV?L+?q?LRmT?H`_o_P6qrw7)NDziS%W-TNC&D+sU=d$`QiT+lO-KN z9tXQ!D-XGdwe1elx%$sE9CAQ)J%+X$T%gjQqPD?uvif5esIOH>d}0idA?z``GPU5W za~ww3-7tJF=XEjnp*;L9$H3utOTVG^U4>^Ftd(6d7jW`kzw-gH*KMwgfAUi*@cP-izpelyPN}!m3%riKHbx`J&44~*QTU|iwA!J8n)eG7|(Z{hLJ@q4zK8+Y=%h(0zxMmHN{!leZpzXCes!4Y`gtN(nb z)P1Fo_uQ9+JYlq*I~()3R9L!g)ntjkb7L|$;Q{o@Tp&UP3Y z28+iGW`L#Tu{kR-7hK3O@OW(TebEt@wO3D|Z73i@YqDBz|-aNET5c>4b7s}9T_5z>L+sr z=Ge+1Ua_$*VHfCu-n=eZwUm9f2QU6Y4Y>{UO$7I2!<|jWFYwBaUrv5;wcfk(C zYZvgk;R>h&e-P&q0xg&TE%hdOs6GR|KTv`uM@qa#-Tsi;VxfIHqdM@P_{cGn^e*t*t zS~QXOezL{E{Q+d6jy>ugT86pL&}wydkFIoee^4*$+Ak40<$MIu+jk&in@h+l#_PsN zxelKz)1TOZjD{3`vvpV|YY5itOy14YcIf{48q#?TV{=r-A7#im0z2*t*#FmKBcwph z@*T)%&Y0TYk9WvB=1PI<6vtlkM;Gy$k^%PKS9c(T>0IgW-M%9!XWn9SJTCL;iy-m{ zmmQ^nC(aVGBfnJ24mVq$Uh}*QcsxKguUCn^<{M6k%)S5{Oop_hGA=uO7;&9Z$c{2D zJ38<$?8Jvam1olpnAMc%ojrfo)Kg!J2 zpA-A{UJPmp8*9$gv63B=Wyc#kknt-@y(iDd61TL>ER(V$=M+`Tq`ciVCgf~hIdESa zo4egJvGF|s5Bt1xCN`?VwtVoKA76+K?;6s{bYi6(j4SCxzGegzt?vMWqx;?3Lp-K{ z>&+#B$RG{(093z;AR=&qE6kgB3%i1y6^ZR~Z%4}Y#;ZW@D3g2pb7gwgj;VY5ksZjG z0pRh1*2m-n>nDLrcrCBEA;!4(l&IlQO@%LLe;LQ#vMObK8k1v7chfMOqSc{1VkPQ{ zwPd%*>7DO@=u2fHZV^Ulic_hQ-*6R|L68(ok`aAd)oyMj`MZlG2<;rU+@de z>jgEtL|%LAE*{5MlbzOXhcDS~_4Xv5!$<7hEMmoHA^n@XXqb%C>gGJw7SgZUMZ-N~ zwE6?@7rU7}XYzY+F|kgxD&6UF+`1MUA-10ov6ybk-jVV?cKluFKGA~o6Bw+Ke6Uy> zi0A*8nupnY7OiIdJ}7NQM@rid&gK~NfgN0DZRD{l$CfsA4=r2ReX`{X-B#-r-J_Qh zi>}4Gjrqd*oxpv;U@f7OabK!3g|Ey9#DYu_LuQ}13TQDVOZvl@=SA5**%V*ddWiqu zbpj>p-_r?}@DX-KDo~St zw_@A<0K{roLpm#V(Xelv)|{Z!d$X(+d7R1VEZdLbF@HHg!y{=m299HF9!tZW(*PnJ z4pCD<0kDPuBCMUtL7{)L|BD7W7EkPE5a){~YrC?3Q)8SU$FAMCwHrd9vwk1=z0yU;IWeP89i7r{RPnL|4~UwZlbt%+>sAQT5i5T zf4?3K8&iPE@of^P?#3E{ooA0LHCCk=kr>-QxjU9UxssTgD29N0lE%?nE zFjlSr{lh8z7kQFAm&`@1TSRQX+cj}!dd%p<{4B2tAu=UzOsv;p^XZ3a7$~h~eSA8_ z&oAn3#`*mQHsh3rL(1^{P9BF30f9|fWOn{Zj_nr#`w%}p>`?`GSt-CZ=A9?SWpS7dn!+u5F8_WbPxGf)g8NWZQmNn$w z+EDHW@HF31{&0K%eqRr8_{Rv;E*I?Ee*MY?RZw(zM?Unjxl{6>w*?-2$iJ|X+hDEr zq77a<=bzvR9RrApSX7UR3bf!@4Hz&c>dx92IiFT1YYu%vsduFd^nEG0($it6qg;qs z*bz7(?gKeb;ux9Ft`Tjm%7;yVW&C;QT>a`*7w8FG7Pu0JAL6y(3bf$6HR29PQ-I6o zOV)_bfS{Utsqq|~4>z2l_gxMK)5lZKV+Z47lcIle z)XDQ3{yN)XgfgId>r98yFV6=4{?ljZ+vWRAe*fSTC)ayJE{L+g~nNsJo_oY$|202Z>eaHdof(L0B8X) z5F4N20-f#q8!rc=SNiHFWOZ6ReZ51}aR2vew{MY{r9ZuOa=rKZ9%QVXA@EvO0eE;` zk;JoSdc-O0GDmPmpa^q6a9tOMYIf!%>UpkgEU^k=9E-q3Vu_UyYcAJf%~)BNXaXzl zT2LF>ij0QNsdW5A(y=W^3o=`85WCEQHx#{phoUD26rJg)i{mu>4@$kM-?Qh~Zwuoz zoLEI-vp@?rmq0ABlEj+b5KA->s|7(_e?8MJD)xk25Svw?1y{JhYUX$e`1*!Xsy6ia z*VRMi;ZH`WI)5uNn(v=VWAoO@HRg|RMMgViiYR2KI@^pbt8bAkgOM&|?>k=H772Fy??O9N<=Mn7ObE+P!ZvaGQ zVyL?nAcCR7jWN`%0*J)xi4{j+eV_fmio|*l)ZN1VUrAzi{&EKb%a%CDUAB>s^SfrN$fKU%Ra)*|Pd2FDU(oPi6R{|U z7@Y-mAK)UBW&=OZ2DlHk!ps28ZOiK!l!m($sQFbI9sawMbnJc+84dnqF3fw(MqSoe z=fhBaphVa+KTRLUJ<0bs%W-Th6>)L>ONq791%(648|wrPy~orkzfY)+FJb3F<(`!Y z_BHw{K6hL(VT2~K_2~5H70;p9`c9`jXPlRdMS_0PFZ0t*j)g@yZekpCkDR$w? zMcs6V^kXz7{TQ~dA}Kp@x9!_tYjN~a=?}eD-mzz+I!d#;Db4PF6G5~(b*xW;u6!do z*8k7ub3XT7@HO*~7g6%ex;8DQ@={ROg=shhr0#^s7hrZ!z{1YJyOrQRjx)?E543H> zpbp*xu?+<qV|29XOE=*ff{NFUF)WIQ6X(eHs+RRPTPXMp;+GCY6iPm`bBc6D;>XWDxu zUkh#%zI*q>3RE9Td#7Pp@|{BY&bEAU$IZr*+&3jA8_&Ter1!5ydZGyF8PZRWf%em zI)LEl`54q+r_u+C?r%@h_xhibvg#u4e{HNIW3=YM^f85!?`)UvbQEd9Z%^dgl$nRd zXt)cY+HgUe?_5y#XTiP$lzJIo8BZB+58^T|lLqpUKDv}}EODE+_F5Sj<1(`5)-<{s zevqVLV;W!CdY|{Az`KuUH`b9uv^u_wSTnEHf?N;Os`U4tz{X{a|M`t|JqlEBaKYRJ zfcmYpeiA>>f*%N+(!%&sCMzoT>_@QYX*Sli|IrPgtYiGOc)h;zJpd)^3{xH%3zFO4$DjUnF-JI6e#_uKDioYOb zSh*H_g;MX#cG8(xi?|Qql3g^c9ive;zSV_beC3j7wIgTw$z-2g=a zp95km+4#Q)Z5xNETAx8a3k^|qbs8=Hl}TD2le8qtwcvdmZwf57-@6p3W^1hR7QWv% zvHjlvI5yZB%ILKa#NsZnu4He)_sp5_BNt8YM{W{+bt?PUO!kHP2D z{hFft-VO~*o2-x7WT|%}wywJY!BL;g>tcGw390K|Q%Xj-Zm}|>yMH-YqsP81;`nZo zIz}s4Y!980I&RIWZ!1ZT`-&GP-@S7DuNQbJ2Z(y;Kg#h|YIISmhCWG)9ddanYi zBdw1HZ?caIUP#)0hbZ-~E+8Dg=bcJ$pTrsFB^V-CUoTCM606ZVuLt-D|3iA{ewn4wFZOis5J6|rsVElwq?}ylHet^pY z101_9`OM-m8orZKFQb*oj-RHFyD~ZM&2rq^m`zWqmyMI@11Gt@=m@YevokKv^{!&` zU=!B+&%t_P9@cGri>>?jM}@AnGOe%XGm?Eh^2fTShP6HMo8RkEGiWjh^(TJRdl!$Dli z>t(Y!eTGu+f6OA*e<%vYe6Qor9P=YgH8=cm!7%oO(f zumVvH5vvD7RMeHIFzwo__ho@WoKSN{`n$8Wpvhz2iuj!n=Jq%{+w1ptjnSIIwCDYo zC3$d(&4U~*I4h+_?4ANJ;>z&+=B$S9ivZiqPJxcs~ogGHeXdxet55wWBgehXY5L_5?2xnoLXPZ1rLj7iVw5- z)p$%t8NZMDxB!e13})ABRMrmlm@7Ba$+?)A2p0lIo_39lJ?d&$EV+4FhXn26}hEWmE+dWv=rJ9Xu+2XM4U(uzyxj27XYuN`;!bX z>K+6A>I~4?nqYIoY!$H1cBwU}FxkcS2e1Eyl*Q*UUcN`GfAIm0Ot_&BmyJ;roDAvvIO@t0X$08AbfuGwf6IxbSv2xyEKTO8%;|Vc$~(6f{BTUH zU3(o}E!R=#1sVY$7V8%jsI}$Oe-?=OVxKEA!1z6--Ysc;`7cTKH6Z))=L>!2`&*E4 za{Qn8q3rmCCS_k0z)_|Trs|GEv%uPjK>cM**v=FE_B!?Eykx&G#ir_jS8hSZB%O8^ z(_b1T$H{&?Mpc1cRW4rPNi(2n%@ zETpIUFaBWB@Cb%L7lxWesdM=`m%i~!NuK_{*i^ZXwjjeECzCU&K07D{^;h@Pa5+@D zHOQ}b)SH1s?g_`67^muLM63}7BBypR8?4++lsOH%h8p|aSL!t4%fQk& zzGnS?AxA3BTV0|?POMDStq&n$@p$wd!UsOGh*--p9K9EV8gFl`i@TvZFKvv?OOs=q zA4|%+8~_hadsbPJeD?gU$%HmZ#C~f4{APrKCS<+r0D;# zr0in$JsU4w27Jr|Y|Kp@uPZkE52lM1n*wL8#I*G_2WalcPl-F#y$IAd()!x=)ns3% zo}W6OKaC-S^?7VrDxZtY5*HY3{(i`0%sv0v4N$p)^q#+`N{kmWcpf@nA2?-s#$;b*w|S4_?n3I0j><(mBr*``2^Nv>nWjMKb+QI zhnnnfXWICFA=leB1Zp{G?jWUJyHD0nYQL;cyDyusUp^(U%Ql$Q-lcDBNb>u-G=Ap;&$pc0 zlL=~kd1GB%ftrib-fw73zJJy8(x#SY#o_0L&Cd4I2R~yrV7Ym0i8x0O;tF2FEg@@` zurryRjlUWf^=gXK`tdhu!Tl4ypwd0f2=>I6HP$7TfE8CnEud?LX&5lnxYFNUn56Nd z=acf`ElRx|3PeUWr#=6Lg@N5K9mr$Ul%fWT7qg_r=H6T`(gU2Mh?Xjoh$C4aS53Q$R_H55M zjnsRfO~IfRIY{gcfLMD8w8gVPy+Qh7yRh)Z`lK(m#|i3253%k9V#U40st4auB@@(! zOk!=z@YRMyZTlE;fHhC%cW@dD;MooU^)4V*=UwFagB+KT#0G7jtRj4}ex{#ziN)w^ zU^@3>pue_-hPU%t1H@8th*jhvv3jOom6O$7!&GH-Xu~wJ;ttYT14w3g$5BPAS zL)R5Ylf<_VtKxg_h;h6JSt~exEr}@v zzFO~qHph>eE*Z(#P~Pr>xgjT?>$%MiP_G1Wr@7SybE9sp+=C!80#H53eImtyeq0o= zj27Q%@EwQ(Dp^m% zUeJOEq-_d4^VVqytWPBWj!uX9(z>vFbPnU^?kV*lJeedmFO$TWP0)@!t$rZZiaw*f zaSiD_x}Js!K#hiq7N^D`+E`VoF`PEdcAa7or=yrBWd3%tcKQVVZe2qG-;>pM3e1g& zf*>+8lf>>+N^9#pd|zJ2?6n-mtw!ER}gE=C;ZO<50LvBz4L~Wy_koV zl>CABe@4TDxP;HU9Y1h7yr~Nn@US(bVNk#QoIF!P=jaW2@;q^zqyOx=6#t~61!rzX zOfO5ys`|-mK{-WLfn``8I332->E88^P?bH)=x5IlNIXPg|0c&G;+tQ7%15b}(cc50 z)=2s{=4(MVhF*dDJjr(M;kr`&emF)a{6L>&gQ3Cj{N_Aj)%W-g?^SHym3SvE-&vR9 zr#qMpM*Ik!c;~(&RBg^87IJFAq6uGJk+~rUjEOU-e)1W#?K7&faoS_Upt&EQ)NAvG zJ&#hJZ#YWTvpmFN?=T*v@`mxs=1oFk1Rudplko^p)&5}&foqw~xC&y7U(EpO{_mH% zi;)(5#|hDp^aoWqwZ2N&4BqnR|27dCEu;D1j+;6x<`v>K5 zRB`Ulwbx&1paQhMN~hNM`L}48^<%f)j4Nf^6^HM2f?Aa=@H5%_H@-!~WuHv;d)V_p zJ{G>8>E^Y^qBVXge`bOfY|7#FPEBnf>7!!uwk}81-eq($zO%L03c|PP`#a_1ygCE) zJF&8OIY8^WLsazxWG7aM8a#IUw`YJJ$PvD#P(0a(KZn=f4G3SfnA@cQ#&(GZG>CD4 z<3nBq6Z?5GPA}$k30Z|W=DXE084u_$PJwZ&IU&mNn8uU-f>#l!rFpQvG~*mSflGOf zikX>O@XcQe{Nf%2(eFkDPK>?h8y7O2s?==A)Pna%r`nmbpW}A-wDRAFK<)V{lRNCJ z@tO&a!BED>ePSM14~^6C0|=}meBQh=hoa0hB+Vb477t9E3m7_rzo*oTLENv}c=>i7 zG~-t~A4P67nuxhvX2)F0*tOdsRC{6(SSMy7{kDuVzNgIqmF`>#S%a(Gx6jC|U4zebUz%A^%jMAw zP(!%#d-IVNybNzB-;BcLSA!OeHzA$rth9w=r}CJD4^}~Jd$H5_U=@iS0BFsg0cxU! z?K6&n9N4sOC!~m<^UeEd7>a~V zO_u_*Va$heq2^=@(nY>jiTQZ3)7XljHBi9oWd!W+qAn;LT*+vtwD*{s$N6Ee$#nRm zQtrY@sy^r_cRwd%repGZf~Jn2*{MD9cTE9xHLi3oQ+)GJ;j+LP2Gi6WA57`F2~e)8Mg2a-2M_c|MQ1b~E~UZ0#7w?VHl_3syxyQ*e(YY`T(-yEfD)LqqWtRmqmfg_tWqwhQJ0XFPZ+<-^%8#Ov*|zZ^z!G;n7xz zt>gM;iFs+UlgXvF|N4ybT=4nDP6J~tcrq7`47<+JQMDF?HM1UO`~1B}cutn7VTiV+ zj^mKn+s)Nl@ZreRy?sHH*9G91b&Q5Qw&qrm8016EXe){N?3}(U(_-XGK;3>H4aZwF zUPEkqwHAEg5s^n5M-ctWG&CqRT5$C=G~`5)anf~;jOF*5{dHP!%Oltj=YE-qF42O| zJtDEY*CKrw7n>Dq9kcVK1?lm6u&kxB{;$Vrv}0(^#v*_IBahPbh{uiTdPPygdU7OItv{a*WyhRnPNS&b3v;f1%XN)*i~%V$2SD6q0sOD$a&&myA;C z{g3--n6=0HV{IyU!}9>jI;Qh9W(#b$t6M-X%@8>cTNr(~#C*!*G^#MP9v-La6B6g9 z^GzDQhf*)wL!(Y#t-X&J&Fmffd^~TA$M5jmZotF}0n{>{-A1W*{~spr8UOiOaGr?q z57_JfjyHMy$5FNi`1=2Z=|8r8l9XHX-b~6Zn+|ba2wF16Xqc_l=EI^sL(7{qe3kU8 z@%+4%BsL&r*=(%vyta{3V(<0*opRdANXGo`G@7?vs0CdU_3J98(OvgUQ$GpJZ3;wY z7chHDF_8k*vk^q@Dj?RN0ug2_9>IM5va{b;4rgydN8QxV^FIKU~coc$hSru|3&ND zM`@U~gUYmEA{UPM?>$#fJdAlwkC2D^v19LZUTSV%CdA(5IbGZaZwpbX{`VMFSs%;> z=eTa7?xeN#1sZNgV7*SMcUA$hdOQ$0ZH@R@V9f?nx6=XDCou{zJB{hNjS56&F7`JQ+L+9oT6;z0YHjd98^NG%khWFo-8h;71{tR{59Cg^ z2M9ZpP(9B(-IfFD-x>Xx#A=cFeF>gFJ-M&dylx3!uTyO+`OGRxy3;Q?FA?A_?2 zu#dIN*4K42M2(l!JJ)5r-%|4e0HZDgbPs@s&!a`vZUB|dS=SKdbH?l&#sfBA4`hPT zbA;FM?6b%JmrO929Uc05L$~78`l3jY_Cwj>r$?!}A12SO&BO4gv}Q$~z`3^fFQeDS zXOFjlzLe+fZkKhlwcwJ|phB)0f>&QESaUXVdY05vYgO(Xg$fU0UQc;&a432GiB-dlR8Emhv2m z59D3WirGQv#6^MkOp679=`f^$_iS-zoii>IYy-nn9x;qfD z>eoQG&jB$g(E5Ct{CD^AgxYyQG?2jIAHc7NL(pl)yMtL1p#S&*FS`f9tEQGS%EvX?JO4D!1 z{i#by>QFEIUff;$j-M@>oAsvvFxhQs68kltv7!7)Dc@fge}hwNP6MyW`j?Q_$JSsy zcs>dV940Fpzyk%zH3cBz0GWI~#OqE#HLuq*E_^`tTr%F+SfD*)RAuL%uYg#gF&aTR z#F{xKusYZ}v)|)$ok^_tsHp31e}Cl^EWN3Fa|k0dwT|NnjLp=&@IyqbN5SL%HruNe zU>(~5`V&0nK;-tnKt;U|zr@m*Qj^gEs$(4uZ*|=Ina!Ky%(ii~f2JW&FLpb5&6f4g zN*!b2d3xiQ1g-_QB@Ugd$DW-!hl}ML^7{1%tOGo^uEZRW_0L@Z#=Fzjblj3+52L`$ z0vn4~V1#jdSmFy0V+Y3zI}1qNObn5)i0iOskbAGSlb}UQ`Y}iC=H9)!IFTz<|5-X%yjavDG+7js6|lI zm?!nLL+9$x+2c?k`UrnFsax2z#F3$#&;#wiw=U(66Xgw03x{rETyYvYq?4UN&T%H}T<+BSYd z`5Jke>2(uzhF?t98P1n=hOuG}@>*uVb(we*=rkLw0HtBS%qQfS1KGrao(&HTVH1hYe6 z_5Irrsb#kPn~3RoLM}Zs8;lFMu39GQT_Y{{1NQD$pbeC1Fcwnu_WeQlYJ%Sr@;ZMU zmt=_hSc}arN+Ux`vY*b`;$GywF{&CIhogwsHc$#+lYhZ^dT6$&PZ0NRC?BNM>!AXV z=PhQ7=0Y!9hyJ(c@UeY#p=j&lF{+At-t@a8g`FwuQ_d8AcXR?fCS>VtK&;U@GAB{q zA89}=A6`%!lILW3DY0f^k9!;AUq+R?1AVS`1wi$&`CuJ;Owl0&YDz)ti_7y##Dmy5 zf~BU7am!;?K?{B#z^DN5l!Mmy5vAVYJg%cnwAV96t8aBc=*MLNfivte&ldOo{Eq%&0HbGwRtsN8k$DsEqqOyDjvq`cpOQJ> zCu>gFF@=g;M>m|J>TWJ41?`MyjD9vAe@{SfzA%Y3@*<_)b_7S`xzNjbd2T?z>*IjV z-eJ77-(z(89}&F#s(gR%C{>@CE=oJY+`zGY3(<>#M+KX-JJ+(dR!t7!8b$1&&D$$8b`$H znGLm9V5sJESuOTUWLA-mor_!0qXKn zXj8_hdiG4Hj-m>4XeLCzF&mIkNG62txEMg4+LCJuzs1G7y)nt%ZbhXzVy@PZn9Hq5!TpaNB z(eTz1INId^Ra0!cyU6?xIaj$SsH)^kERY4cdXxPAzlNw9%>#Ywjc_!x5Y(+VLfgv) zpt7|Mp$l}l>Xut?0VwD)ed_?K_P^;O)>aoB?NJ0RTix(%Vw9@KahX|{K`iZV@_g|c z(%CV3PA#K{$AhqW{^lILjZ*JM5cIOO^3gsT?ir!cI}wR3cfj0@Y@e18t6$!4gcMMh zGhXD1y$HTJx<7M{?g#B5UN2IPp@^L~tdF+?`Uv0KWxQ77*B*3o99Z9{bb=qwS^SPJ z(0H+|#l+sbd5%6ajE$`b+Ft#bsv9Ma$rof>oR7O`m{3~tt(5OB{T&UDQtEvGiJa2! z7CDS1g${vT3=oavL$C4u3-qB`h_9nKE;eVeGb&39hKd}$(dM-#bsREH~vDy4kjDjLOlBq9^MNna^~Li^&{tl(Kk-LJz2z3 zoLcZ};Ggh|ZFYbmXe^d{8q91uJ>9<E#c`bZ!{4qNh7p$#3=BfD7?9#f_=sbH zgnWbsIgTSa8@tteX}zlf97h&*>{;YfvS^TeV(-$Xv*XB40Lhmo_O8|jTa!&9Bp(~! zGIHb`&d&qLM}m_T*4dJv-cMC^GsA#l`?dby!%R*tzBewe_Mi=T14%yaNCPkuN2H~`}eGx_uB$cG<0JXP+vQ|H6aKgMNyLwo2g7U+MA z1;%0NQ@%7T|M3N3IdGH(R2bS#Z?V9CCBxE1zBDXNUl5izI4p{xX>YN>{mHNx^h?8X z#TSGndXxo1Fto3|#RAtR!xHj*X;{wrg0S3ulm!gM(6ZiQflDPUdju?M+LwkU;|s!a zHOC7vv_HPd0&|mL33|UYEFT^EVzAV3ybwcs`Arr;GAu~{(y+Yv1!0+Ul*_1ww)IUG z_`{n?u*APSEZtuamJ>%Kv1EFbATy9OCOW*V_y$;uZ!FBlG!;{xx?dM#FZzsdvmHVY(|Hc=D{h=vf|K{g}y*L?m zW5$<;efk%K{n{yDFZ`Ua4rjO-t;K3N;AbBaeF))+iR~_ zWa3bz`Ss}JyW$H`>9g(NyFB^6I9rZC!)A$n{8J|C8uXOH&`Q>0o05xIA|HBUUw1PW zQ5E#?bt=m@G`J#&+K4z9W^QE)yv*w51OUTdSx6<;K0%7Z}>v4^rVPp%V1=Z4){Mfs@+HAo5wa z6d2l{woS&(`Y4%DU)aS<2@0IrW%+G8Q)-uWll-LGW%)uU^l2-Lba-KR=E?l4pG?Zf zF6Zao`{R^EuVkWbiohRo)mVt4QYYxC%TTvT-;2-Z*SWV<`lHr)MV685>LPX}(hG82%Yo{Bq7JP` zwfokDj;RWIJBn3%ZyI`gDJuRpd95s%EprVm7x32+)gB<~qLLhsh4pGjONMI4XTfd} zG4n8ksNNSOsQhM1`?{d8FK_2(;Ro9s`?6ElRgveQe>&j*@M#tqW-QQgm#FjFKR8RZ ztAXL`0KKD76*);8M2>8j%^;$NbW<5jciyS7mIk0d(8?lByJepI+jeqqsU|oC)Sbu&B zSj~fz;rdS|Yr(iMJ@6z8gk*gKZE9Q+w{B*1l?Puh6}Dy7E_sGUZX&SxIk|h3MVh@b z-gyS#=lk^trBP1b_`dc#@A?_52#J_Wp_eURxRXT=G8XvPQ5Fe#VRwzO-l^zG2QkOTCpH-<(wR>P_)wttRi*&ABUr4PF zGCY>_*^_k_I1E(OPTBqBj+A~}TQ$c+DO9^9$72N*RJM909jOI+yPf*doL2EZzP3~9 zfn7RY4UBk-)Z=y1CvHlgutUxmD$w)7e{&qEb~C5bKu`Ioq+1;CT|lqlRc%fmg2GM< ze|CkHio@ss3meW08e0w5j-~3iNu;qvLg3_+0ru9m(=odon!Mkt(U% zH5Bv~KS`|8e8IEZIGT__OtSpkL9#BFT6> zP(ZEF7^@WLcq>efJAM+RSj>Dni*+b42k^!#B=)aDd9!32%7~vK1;Q~^D2wP1FF4uO!}s~eu}?l?jC({0^UlUb>Z_q{}z$!s=~2# zwU=%>$IO_Wuv1SZtMI*30O=ohli=Bku+d%L0IS5Oe%hr#_ruWk3jdOV==U37VK!zc zilHHES25tvOy$7`fu0H&T5}<)q_0LnG~*gr2N(pi{sP-n%Vd}_Z3k((^ zFf?1{bBOWz{Q0LW5O@6G;Ko!-f9vsD|DStKOFv^y!71lt4`#wnnNyE5r{@MKd5!;m zsyQ8MPMVW*E_Qs5ISCtWuCNKVr_zzq{Z;0l|BX(fA0p-nZ1d!DMmE}; zKCCjK$heFd|1R%pAn5(u$K_sDJkFkfZ;5FXcJA7C3E8{*xt|k zxmSUH^s$NUx|84!KAy-Kyhr$i;I;T!u;X(TlaJp_Fx(30^?5K$K*sAWZv*uBLdE2t z-969OsE#1^lIsBBKpwxxCivgW6a3GoTsOxj{c!5KeHSrz-RhimJG4|W3)4~YLh{;C ze{@Gwu3cBs+U-h1#g62;|AVZN@6LVTv59N9Hfim?%|t!Uzq)oo5A;lD?MewMRdVdP zM^eVyl{DTcfE?$~b2x;UMedz}XP=Y(E{uTNQ@ zJQG~5;j&qB?Wg}gZG}!IfIYQIe&3fQ@u0z_vW?4wN*o@26Y_H& zPKMPq=(UvdowDc$B}V^#N}^m=;ryl(7}<2PW^aRM<7Rj;(!!V?nvEG)PxG67>ZiLD z=mP}3^I&LzCv*Hvr1+VK2=q%gut=Jd2iyZgYZ+rb)PpM<)~g+J$JpXak+!V%(&M2PZ=f{IjeHU+v&z zu7mq=oH%`Pe!Db@->QIKw1GwVTy|w+4(GZ5x54{hDJ`In3ZzPkFFs+T=5KLUMqf6x>CAI1U=!asIil;dSEQ?&u_t=AKgza{&`%UPLuL< z$Nf^C9={i4B<=-#4BqCI`{kV=L}aYOdrZ{N@6ULYSjL0*zEB-RsraAEG=d)=(=faN9_5u4WoIiC6xKD+1?-V$Hb_%$s!udT15^=3U zhH>uGwOI+dX`BxDRNE@PSlr(`+a}(dTeIXj|52Mf=W%5+EfKz$kb32piS#?)&sfA_ ztT*}0j?;+@LxXoBop8thWt*fG{4PbdI{JeQhdx|)v3btciS!}lHME^uC)0VW+T!ql>n=9CiZ3>6t6=V$VQ4e95>eNx(?%_s+dE(Ef#wWZ^O?81k)-)u7?2C|`#Y#V8ODkL z+Bs}L9Hb&Y%c>pJ>T+z7-A>+$O(e}~t#Im&X5&C<(Z%N1+hpBP1xCNVgIXIo{s$@N zFQUG@u<7K%{LT()1r<~z@6GyYe2rgt((P+b8}+B^_L6n2d$VzXubGJdp9TAMsT1vK z`oYEK5sGM2D@?wgx4_VT?N#mWR&`qt)%&{sg)Vqt3mLE1&{AM%u`P)jnjD{(b9^%v z*tmsQ^*^}SH27K=FkA8s?LW69t;IjpZsYBa&Qfi@7NhH4e3G}nXe$}7L;g4uwYPf| zk1FhJBv%!-!$Ad=!P$tdNm}#T7hw*Z>G1xdi_MNL#Nz$Au${S8$`r}<)<+#(AIGhW zn}q?iHw{vAZJzW6|M+=2uAAlW?U&yxMb5qF>0i+SB+j_oXDAQm2fTgKIUjhQPN<#k zt_ivp7Gxb z9cw{3@B2m~^Np(ny~n#Jw&!h?uNm6BEt6@)b6beWp;Y!Yd2YUUAGKa*EO2v%v@QQ` zj76Rwb8Kb-wDYse&uGi@;vQM~emAlBo}M_KKU#Xeq4^vLUs)9=YxSrR4 z%6iuOWq!G6+=JfawR-hlYQb5jhs8S0iq@vdb;@$qiQ~B|8PAvVdC!Wrq#4?)-IMWr z)fQs46kjalM3Qc3nfFoaUB&_&ubf9U=OLC%{}yokjBUZYN)97Xtz1*w3EQz#aN)zEAv=%5!gBm%|BbzO0<8*f6G9)+rxiT?XDwC z^uLeqf4^$;d4FXcwSok_-|r??>klqA`#8PXq?o0%4eh~hV%4S0Z=RqFs=X!&hEB!; zw|G@MZymMbg|PLMzLYZzt+_iv=l;T2V0jWw#a(8TV)8TDJxAs}xFCS`l|xkIZ$3hrs3F16mXRUsvBH*E;^=fs$3(u^p3zYj5q26c z>@Z^ij+5UzH2sJNJ?m#(EY8vZogFO;8rr@0QcKNr*G0xV&2r`#r?aCRc8;e@r`Qj_ z>6ZAKKp_m z-R-%HS_V+TX*2KRY*FXJ_3xSZ?l$>urL-f;cV>^Vh~e0%xy<0k(4@BAd>6H#pdxpS zMYy~p_zM4@tHw$_m@(0>Xky#8yCmOLWS(@3MeCun3v245pCvyhgtp+k2RLq6ykZL=0T5*U+l?9wg|! zqf5$!bzVm%ya(o!U2@;K{F?8*3%V!zK_%P2KHzeo(BtyExx72>0PN>|;Ol69&x>u( z>B_dQAYuoEu14hG@A1r2V^;$eoOYZPdLPy9gfiU1n6CKL7(W{|KrA$&KDuhJ0_+f^ z?OEJi=czI37rBKh`F#&QH5R-CJ5)&j9Dd)6QyS%RP?|@zzX{mHr`oN6T?QHz_d=)> z`XuvY-Fp&LW351C1JFZ!YOMYe?BLJDZ}a4DbLMgE(>wO|mU>I8-X< z-szFK5j}npry7k@Pt;DrLk-76P>of45UwH66`_-(!`%w>Is$u(U+z)9KkvMU3c3If z-VQl_D#>=28oxa2r7$#Q9%5X!=D6W^{liY41mzxOTWTG8nx)z=06qNv%+IkpMXh>e zzVsmz&*rPK)O#I2C;2e?-8(|bNo?yalfDpLKyRvStjtqm#IM?=3M%pmdRsYP%Ep2E zGYpN-b=f`gJ}|;q;Gp9xS68OS>J(IN8D%}ZeJyX#SVesy=aU6d-u5Dnqe9gl;{3A= zvBOT@+|i^u`^Tiu!+4GTXQ9UUSvo{L(IZaY*TXbT$_;Lg1}As!%M_I-HY#Q@jQ&-$ zaJY{`&nKufh#C`d#J;|j@dm^UFW=jJE92isjPw3$04v@gpBV(P`1hU9Uc?60++Jn8 z+Emr@>cXlfFJ_bi%bGHfr!-zrwK5&%hl~Y|Z&b`#F#6vovxFa-3;(kOvDBQpT@?E8 ztt|4{a1}?@zXDfigW9ow%{l=Sho@ytsA?0GWt(Or&(nBe)w*<;o7M!Yet*jR1TqJ& zkev^u=rF`tQKAEsL`eYcweMYG3!QdA>Q4#O1sslAU*F0>>RAxq2$K?2_&L0DC5#~s z?^m7AUc_9S3(x6p!JBzaQXiY(U3N`UAN==CypJq3_C2J1IXH4p z104R-07ubjfMfP)fFpPs;FxzB;Fy0J;5hpUB34lJecn7m)!uIARd9i>U|G|b+xw}JO@>oq%SS2ytAmX(5Jmcp|v&4UF( zZt<%N%7ThH_Y&SWT{c%e4fN%r(}1t4(}1sv(*VbLrvZ+$PXiqDPXiqDP6Hgl(*Vcp z(*Q@&X@J9j8sNx14fG}JG{E6I4fyal^aZDnzKpJWUdU5Y*M+D}$pqOp;UifPmGZC5 z;doULZ=awvYF(}hAE<$EN%=NTi5XuA`fwx;6^oO%!OHmqPA{Q)YeMKvXWek#0#N6C2Ql11Ow1ZvM^#4 zikPVp1fU*xP{ zEBXdYs`h?bQg!P|_S~W*T)ebF;^HyPZrd5efAf36zEAJi%YWOqrE~LRL6}=m*rrm_ zwlfza>NMz2r9me!w4FZrePuw*a~O9l$DfDH zP7bW9;`hO&;8~9o0a|f32 z|7E}ub-hnK3yROV5PYPi4%e-((^yH9Y4lRZq5INuzG@=FSf&ogF#Pi9LGktw4J-)t`ALdVA zuxowp3WMX$)31o zuctH6B#Xq?IrrI(h{cR}H!Mn1tCwQLpzuN-nWLj%~Jt1wYfMK5k-Tmzq zKo@u6E64=@$kOu^leZCiz_l#WS*CuN385nrsvx^|cB=p+Th17l3bwATKc2-@8D&ppW^mh-;hyl?C-*|C%O#rrP) zCe)RA|IRJx`#G|29NPc?n44^??39A&u9GSXD#w0si3X`YOK8@j_IU z%$IqN8$6g%Dq?Zf*girVEkZK^x;&JJSg25q0W>pIh*&((Sqv!UILRs)!ID&4+4vfL zRkiDh8at39bL4S2vqWC{qUeozuz1_bF;>w@5VrDuSj_2qXaiaBs=&qnOtil?&~2Pn zb!VW*9~5_pY7_`xur4yQts0o%XBouIww(k{{O(KQ0170Nbu54yThdoJudq1qpO4R#ug{^|;ZLw@Lo zoczB>D2;yNg0W1T?wfm}IXz6UCEVAYq&T!!D71-&juwL@nb zF~0tM%*Gs8{`G1HfB*Fvu=qZFAOpIv%fO!*Iuo%_nfSasREF4}7zI~>Bnpk9QnGqYO>nU|76vp&qyI6Ane1A8HICVp- z&r@T5;TMa>r$?DySE$AmD4BJ?s;lCAtOn36FHCqa<0xYRKIYn!te4|H+@ z)dwIJ+W5@&jx7j$b zWCdSWhrTQ@G}_-#r z#qb!~<(rAcark4#0=E)1c9fFx*BJ}&|E~&LwHznTWs~v*{39*Yx|JZdb`0BOJ(R-X z_z|WLCcX1<3$cw84J`C!>tFUb>|q` z+UYX3@A~6RulLH|<~qM!@BDV?-OkO|3O`@P?gxF=eu)s-VZ4^A_*tu53FmC5fU!_YcgsK~?ET#i`t`O;3-T$b=(bM0t-PJZ=j zVC0e__4Y~pZ!YZYZ0MXOb2;GItOWn7$wH4miT@qRf>lQ@S-|&h5Xd}Au$+;?#zrdX z;O-4-N3bv0mdIg2rpRGI#&cM3o>lv=EW+ubMG7;4!c0yRC;7=F8JgezA>ir-}{uwazwC73zZ$Uz6X-%dqB{4jIzpR{>-b!IB(57 z!gM}{%d_848taXdOt%O!9p2kmH^y{MOZXc6&ne>Q<5Y<*Xp(se1}Vy2+Bdpx_miz$ zCM-ldAajMe^6kv&6XjbjOD4&;d#rtAVy;kP^nYqd|C_rXl6L*>bU`Qf)aulH=Ap^- z;gTOE+4YlSj~)M6;^T7do&E0_vQC7E|8e@R@g@3xc#6Ky`4JiSeXaKy8t>x+VgJ9g z-?dRE%faub$id_C$1K=KDUDX2hp?It{fKk#;xdP*qmw0TlXJXr*`O<1$`_)3DCY&~ z=ou3EwWSP^&3Uh-g!?j}a~{m^kX)AO9%K6293!??K`-x%0RHA2#6oE@&q1=E-nMM` z`MVSNSdtH4e4Y9XzvJCcp|2&JpWUf(KK307J(R)u0BMYKc`+M%_K9^YjCO5MJ9eL8 zXf1~0pQNC-;347HBye1Nk<3+7^A$s@o&w)*KO|}W?->i!5m94jxDL=cZ`;RdZ4Q@* z3L3K&=v+3qDF-qB&aZ^bOWHaKhSLCl?RvH2xQJsWf^NEZQ9e&KEPe0>=LkNqr}Q0S zUSm*eErESg24Z}Dg)DS}30Y`wCak`3SxBzI%4}B_DvWZP{$Gp*)Z?t@>KrM@J$*>l zq~z^i$b==~M)+x`CLQnZM5Zgh6-KX`F6FnU4>Dc8>u-F+sc}~e|8hPbrLUsxrW-{} zhLq`Y5c`O+0Po9%i}NME-gk0bWf-F7u*-Yi%uev0jeHL~XY`&daYiTQwir-kjw1e^ zp`hnKGa>Rv@HvUx%b5^o=$z^Nzne2c`fB7mxp&-{?cEuZe9ZSCsM_xN2UI)FNbsG( z3`0{4YE8{^cBk;1pPicLI5lqH$cN7FT{cB@ZNAKHz}HyGM^8Z#-}#43P9yW9b-Nd} zF`^9D=Rl7as`8G>n0^5a?Yn@#g{bz!{0vZxWK-zt=67FC&!pxLNUB;jOkns<8X0W@G79!0?Q4) zXT^T4YJ24d*_XIu<{2-%|smr&i7k#WX>}_hkHFq@E?}&U*^Ey>+pF#?$4cCxpBqZ-2Cz)R7 z$Q|!77T|m9$Ih7dpJe(Qe}%Vd;i-A+WiD?uvM2D?+Ux{xb)Wq(GjW#PXIV+l+?bED zX_EF$h$RVQ87`dBOBlM zBG%Mz6nCBJ(0-a5x-kn*|7F{5t|P9T^wyZ1&;DLjz(D}Z&#xj+MlL@ z%M_=^5upG54J^WC-=pJs&HNK^AZ6R>6V6|K*5vcon=$$Pot^Rd`0KuD6ZvcJG|6B8 zHv824^~;=rA5WWn2IeK5fyJNm38w@4Tt@G_RFO4+zoCR{sLT!L;-Jhg zaq!q3)cOygw^`<9=#P)*F)EDi_8Zz;tu#4j(dOSU7Ptw=p5tfW*PPe+5c`zNl|D80 zwiAO9;(VQuaGj9P4J{<(l|b~$EKzs3hkyPXelMNHW!Qv{G}&I#oH217IlnwaNx3T5 zT<~vq&3`>@;=9TG_4XU4=C3nFn_r~%@7zgg^vo=b*QVk0aUkhDP|-HI#-t+7STgNT z_~pvlXvw)gp73#c=+FV_zug08VwO-5_ayws^8i1Wq53?i;Br@p zLafzLCaldwb^O4KqhGm!MTV9tri@jU^$6oWSaC(hhMfwwniEV(zf*8=+ zKe|3)({pS7?M^qe9qZ|ox(_kua>P2%N35d^HkX&uf~x%?CDH2n2={rQpRGWz_91K# zsegb|$G49__rU1)0sd+bQAeH2#PiO^m7N}h=QF0y6TUQ_C?BiZPlWyLQNJPLYah*( zci>M(nb2o+jj^78n+AV3Y8Si@i~vfevR>`z>#8~a`bnk(-sN3IWWlg#Ys4-YWkPom za^m(=&vU+?-y2%Brm^Z7O+?9T%IPaMh#G798~+N<|9|Sxnq)p=cvX9MHn!JoP&;a` zPBZ6b8QQ%oCm4%_Y*z7*SGAAQ{Bonvh!w)pZ>KweV;F(M{e>Z^vH@2J%uo|L(YBv>U3DQJ9gAM zuWEOa;>J*+5sNr>RC~i0x1(;qj^EV-nbM{l5H{sdo}-7&LyV8{G=XlBfUu(uIJrvy zhOr17I5^+paJYKlzfVuxKc8~+!0%?jx&^4<_so5}BhH<^uzVuTl)7p@?#qk?_}q^q z>0Jh=P13t;7kZa#(xl$SquNibo2c*Ky6*GoT~LSvK;F1a#^oa9Oo-v%ZXJ>1ys<73 z!#|@#-UUnLU2uEtNw0ZP$7EgLn;lcc@B_D<5Ow&){dIfkp)~WBb<|ICL|n4gavckl zLA`C258(kt=1UPiE2_+wlWZR-Qxmy}%CgjLBn#uQL#yT|+LtNN$&Ir8+%e8i`Yr~H zi-UcA7opF%h|`U08Pm&dl>PBL#43-hRma=c^Y%Lw+5RNcN7wD#wmVzm>5S`SJ#9B; zZvpRTha&npJfRNxq#P6FZjK2zwyMDcvw6ER^05ax^}%e-mNm&x$wEwp8Vh-492}=Xb^KiwBO>Q; zF3ghk*v8vj?Zs`)waPKoqize`g>Czt`3%YUx!d}t$i=BZy^YWD2%nb&M}96$3r7D< z6g`~Bml1we{X+j!OXPYAS_n=PVET!?i*UT`BGB`FGQZdH>sW;IkH0uJ)DZEDv;BYK zY|C2D{Cw|dWRZQ29F*!S^A3^uis9rZ>H*EEi#nY9%#mDz??@gT9DyN*Q^s4+n^F87)$4DF={iN$H2 zJJ-RTDZX_X&_j(Za>$f@cF#66-Y4(7)%mMsDE)=wq%XTxPyXP2MQ?txhw}PM-HWPB+V9?Mmyq#K|1olo-*i{7m z4r9K4T}V`(R+** zL=V%M(N2Pq{l)5WP80dPc&8U5Ek04Bc}dBW2$%YVZN+XT79hCNjgS$O%wJs z@m}3DVOJ3PkEKmfa zpWlIh&RBrAb-(WzKj;2v!%`t%wbvd>Gq-P`R-C|AkFwtXmUC!#=TLX4m_s|C!|&QB z(hXS~yhyCa)=LuoJ+gsXeVncxVZEO)7I-A3PbI0(m)f0tqq&CmGr^~xOX5>X^ceM& z4;0E;)^cCbav87e6*=skJSXM+?sbBuNj>^^rT(PZhwxJ#=r4GVEpGN8JTMJ98d>Ds zY_uOal4jaMFHsoXa+%C8b=GZ?rpD9IdqXnJpGdp(uFDMVN9~hk(X&iqH6*{^19Lz( zwD^%U^MRE2vjKnee1wfO=zo{eX4i@YUYZ@e)H(Yl&lI&gI4_fNzTZvZWjWBFzLrJu z<5U&&JKT_;)Z zpT}5))Ad&v3p7uMbwt*h4(~d_bbG7h?K=rZ4i0562o%`TSWCm-U1`pTi}6|NeQ6%tu}_A7AgH(A6}_|7+5q@6ASg)0o$s z)=sRZ=U~2*jdo7M#&bjcqoJMOPOP3a<8nZI?W0l-c%hwGC;mN=M{3tU8roOgedqA? zEWrQizfW9`x|NCbn3b}QT(02rd#asS2WesXX2t?TjcV)#%wN=SYjNH&it+}`Ie(~8 z-o1XG(s#{OiM~DU#44c(Bfq0~-Wn-y{4P;LWeOd_tAa*+NYkQeFtml@+(c9Ln&s|Z zk+Pk)T*f(g$~hgjDV2Ww|0QL-Cn$Q3LbZ=HD5erL`iETIE{8ejGh;cjK7hbMS7&i^ zF~X%F%lmehwUw?{JG!!Oufp9PlI`3yKF(!6vo!}+rt^H`1#0Y@9w+xY zQ5W%dKBTmKKb;w^UF$P%$${08r`iY8(Zlic$+cXTEp+t8`Oycc(76hF)wMzG82Yb? zaz)$={e{&mB4M8yt^JM9tj~cp?BF4J{M|?yf8I1R&RAf)?fuit5yk?ScvPF8Z!w?T z4D)YtAaW@2{)T8#`6cdLugEaJl>=+fcpnb#?#~dl;3qu0C(}Hf`plDM9*};J?dXy< zGdK=btY(oHQsYVlFWWa>Q=wtK+L5p)r$s*~MEhg!T_Sk#M;l>24%PlJ0NV?r|9iVT zH(#@_v-pF2*dI_&bU&rh%NUD{)4ssuIEo*vW|2gmvlqs5;>euJ@;?2+YMB#}|2E|0 z)fl8o`2eNS5(@w5x~pVg?Jn{;lFUiCVgQBfl)Fdx4_0=pguu#@rnK#eq|5ciy zeHBG*bDPzU7SSG!_ooS6vS|O6bj(l{L$hgGxzRYcs`It4R1IZ*Yg=iv+QH%5NAfd6 zsNOfQShb6&(iT6)7O$kpT$hd+yZAjm3nSlFpzk8-nH-LtL}|=Ypbson?T@|-`@GdG z^3iuyd&zXn_{anE4KA}RRBbjJBgA89kER(~DT>-Qp|yB$xok6c_4lhQrE;O65EtPWLi*g4!~2Cl4~jl5Osm2l~K_Y}7{^MD8D?o-BF{XyoXg`w4R z-a$$EpvVb=D1dfspDk+O@29kUs^9*0sy4wh%ui0$CU}N<8DoJ?ApC|8da@2%>Wn-N ze^APgIy!*cr(=&zN%_iK&N2D^{{3`pf5d|;*R>T2olGH&{sI^pzx&4noyG4Hga^`v zE;*x<7B+rDphH1L!*uM~H67c>>+9cBD0D9GX2CkNyP{3lKXY)PG^^Zf{d85;+gTX5 zub#?BsSl_aqQz0^qccm$pf6;>8eDU8Rj<%ni(HrOrR~|~FS1~D<@~m|;GLPXdV$Ki z>DVL2+;oolTo$Z-UYKt=aZ4`UFtUt(V2jA5RdS!qr4`SM@q}z2S&aF=qqT|;`C{%{Q>nx_tUKC5S>;&NHc{z7pJ~x9M$_ufRQ%<{aI8k z+F2}ZtA=B%O})GQk$Obm*N-xN#b~v7AEQjai_3)T)MwrYhVK=&7vsT^)EZL%M79|U zdY^cJST$u*=I8XNcJ)jX{+Z_64>)pF(9pP?G#~IEbn4$Z_gLX$8+m|OyQXNr>j7f9 zK0l??4Ndsbg-AB+{_JAYfuAXVusxZ6Ha%5cpOmlh4y8gchK~nF{KY}p{RA~@l9OgrvZI%u4>mU;`kEWH*44y zIu|h!OIfd&%E``qZr-h!(s!aTYAA;0yHVVuD@MAh6{>~U8xK!0ZcCP-y)?zRfByi# ztI60}-e2pD)EX$9DR{<~977{FQH$S?TFw+X)OuaNzhr-;3BKwyKN>{!K7*k0wj?-& zj%yRlnruVcdOxwcQ{bpffg^MypO0$)she8wF%~e+RPE47)*E+peO%_*%u;JH{&JfV zQp}0zjhim5&`fI+|4QH-5eVixadotYLYN3=9_cxz2zR!Wj(SIsg^1G7jJa=+)a{eP~u)3ci;d`MF z2ToPTVo*7@cxWli+VyHjwSy727Taa$zR}{xjsem7f@8*kTTY;io{qCwI$?-y^eiwDt`|t_=kOF^PcM>uM0NNG=NVZ9y3038k2A?PHo|nrn9z5wq18EkU#>uZ ziLpS#BGo4A)sDe@*w^$0+pbvzyCz9Cis!4gTTg4jQKna>%u`vMnCHK=C2|n|$dQlV z8?P@pInO)a5AI%Y{hX6?MX*_NPZTAO`3_8FNn*^JDfYzPwkh_+Y`G`WQu=C1>g(K; zJ+Z4TWlxk$-V;|{%_4^=DQ{JdE&9uS6ZlnbBHB$*}MsTIM`_O4t*TXT{HlHX0<7vdc*JIXa1 z`Q!xC_ez=Z!PIl<#u#=h=v|VGi`k0VQk}p>{e2V99+w|D|GA$)KP#o3q9)qu_a)9k zK8!q$&kye-)&%`^k~~%oEII7(jyTZkPw9J?YH0j!#bpXZL1k9T?=>}vu`BOOoS^~6 z0{l++_fRs0t%MXV=X)lkxV7>NqGg_uZaX1tNayXffwDJ5)NM#`6H&w{1HO|#D-SD{5!@Xr{dEppjS5}?96{n z7I1CYwepTK63mOv*BLN@8|YhaNkf?*HuOM%|G zWqKHQ7@GBZL!@Cwx!bVf5E+z{AyQ#V}z^U%LUbocd^@eqd@Yo#dRm zg8^{)y2qsxU7SXoE%`}xm5iqi-*x*6xzC{$NjhgvC*lqt z=yGKEU5cR%22`7#ouJXlbU_)DbYXC-^hI*z^cNM$=Q%C-{s|WOkjolL@0^+X9t`cD zPsnw;{3O$V=g8jf-sO0xQ4H-FDesM-t8;U5{`lngx)nova?1B6))Ih5OXFDd>v!Sdiu#S=|LG6+~c38+Cvng-2e>j&M_7VmCLoN zJ5#lld9eBa8lWdQA9nMYXWPM)dPt}6jT?_A7d2KC$yW`aB6KFF@%ho9g5I@2PuC)m zCoSg0OGZ=U$3?F93g_NaA@3y|_PMi>M?9)c6!g?Wjco)ft3lRqnOxF885@mxq9%B6 z!XI4T5%%1ZvGJ)dk%}*Ry z=bq&IszBs$dzrDw9~cX??pDmY-HOTY%^x>Xt8a`|9ERMhaatJt4r3APOw~R@^P_th z3-GmfYv~Lqj&H1cXP>9qSDlnJj*rJb^ZmltKePz32{Ai;iit+*=l|74>KC%edCuJv zM*q0KP{qV&qSkw#g!h}*C2Hz(7*rpuy@lA*bmlkh5K-+{ek}dN#IxI%if1qWcb>D0g#va9NP^4nEhV^(+$TThz9Yptm3yhC_TL@{A{dnY{&fk?IZ{r zS%&rxFtpw+hOj{tDP8|M_-^NBzE0G+zuYv+BBggrpJA8Ib!Qpc4Wq(`N5)J~gZ|!~ zM8xjTT(5R0iuChY>p8aQ4<}fJ_w9L7y*=oKUUE0F25CXL^j*l0E*MMn^ZH4qzkm0{ zc`3Ig=H2wnBKAydDT0V zaF?j>S=1Qf{~uAp-N%`pJXg-AD@G+BeUq`kjJt`*$K{8S$NA>7Dew*?!Ta9biMmgn zj0MQuMA(-i0XFylhs~t`~Rtq&WjyI00THkCF+h>{WcTbL8F1ttGVUywH@)3u>G@fqW{y$PD zcFc(t7WL+73s)?OxSjn$$!>ZNq!%6 zVhgr-C&m`=IdGYa!^dGWZ%C=P@0GEXZ8tde_8ooRxSlTywphQcOKioLsL`RUPpawR z_-DF0KgI8~S-aF$a+BMTM4KY#-J+zrAG4ijvy+~=`p#g|vn2kSR3F6Eizc3(?L0d> z@ywOQljHvY)pm9Ee4P)9*iBElp`f=L==r9I0aWdsfT&@9s(Lla?|nSR^j&G_;h$U5 zpvPC-{0#qGHYRf>Jce8|jf%VYp5D7=o53_UhAb^wyT;H8Z;(E5T?%@mcR73L);VU~ z8Y%bx`mV|Q=lgdP>$f8Jm1^(ivLR9J?&GY-jklm6ZPiJ&pYH|qxgc#Npd#Ml{Z%Z& z2n0`4sH{gdq{z6f7lpp9AUZ(PqC<^_=DUGfeL(L<2e#7d42{G0Tan)dw(#HQ{di#R zn}fVoQHu!n->nW-@%uz8k+pe7*FCq50pX7veMO?an$U0V!MOjS^rJdTNpx_l8nYWc z+m1Ok)`YI>yHeM+CG)(+FJ>HjZa?+B7E3d<`plw5JA()tnb3Et2#2O)&)Vr|$0IXM z>*jMzE6>=x3hO@Y&PF?@C8hgkn266dA6u_>93N85(p+P65Jvw--%Fc)C~iAJ5xurO z?coKhudSLkQd0FX^+b2VH@u(H=*M?=7MEO&@X-Hqz74ZPp=)Z!nBLroaF80>x_qPf zqZ<$#+=^JJS?!1~guSXUSS4!4hgjsJ8`Kz|+eyr7d}KvuaWhSCT(|Y^;%X}G`%Prl z@+P7zZz5=H(mIP<5nR+s^BW)8+EL8!-Gd%1I!N=E&s0#cpUx~F5As(n7-ztmT|cNLmH4W${{%d2Ot z_$`d$Cm9ROgrPmoSb*b|rYBi{}WWz&B+Zm%(*W|#&)fSs9$cD z0g&+sY#!BXyul9 zXPBjOZrb;Hzx_AB1RZSMbwvsxGRbxW55;3kP|>fgDZ#3?(8PMn*nrX2H3^d#NEkW20GRaaM4S65e8p$Fz@0ePu{Qj4UNT%RgzMNmqw zUqY!x@bHW(d}jjfWqfA>Z8fEqvM0+X6n(<#QVsqcrIsJU@3O#;`Ql|r9OA7{s{B`9L&^QCs#}}?pk2eW&Cq}`HB>;H`^I5HLGwR3l zOmFo49`(kdHz0823iSjBL++tBlmNE2PI^o@qx7o^Vj--_Vhg#P|Z{5=YCFITI9v$Cwk0+=6<;P+@% zIjK7I`!{>^yxG4B=^p{Pm%C}+5~1fu^@qDjwY!i$CN{@R&!cWEh~PTb8wXo^^zK*G z@zUREp0wui>+$*WAL`Q#9+rj98f`7R{;jX5W3+Yd^`Cu39oSdK5$f0m;C$O$pZ4Zg zH1BOlz4vVsIDhgLbzFrHsP>1i@N?tsMt+88!~C}ZjU(&pxLMN~7zSbJ` zIa{M>k-R4gRQmuHJ16S+XM+)jAAe1MLlmne&sSK`1iO6IZhYJ`ZDj|Rsa56{DZcpQ+^ zvO{q>x&Z=*HbLOevZG$DnP#6JX3&>~H#*f3UyT zkNJ}Q9X4hUJ9Fua-?6!U@$&-YB5sJ+O@rY&+!xH*#P1vbO6nZ1-U3>yoSF@%U2BmR zuM#ED$?^d~4_(SZwJ*hWAPWZPi?bkXhi%R>9L)Z6J0?`0#=if=@6KUgHK5v!KIZ=$ zxWDcP?t7rxAN#Rz-{U!YMj~xDNSwx-B$f|!&REHbHtCn3+V8<{KjPoc>5v$$5&mI0 zDI4L&0hsZ5L(9;eU6+bz|mOB&V7TjydU)Q?+pZ_KpU}S=sELA%R&blV+r=;9NziqxF78 zx6Uegp%fs&y3tw_DRqvN{%8-3n9+G`XhQJ|tK=z%IY7dw9ip$hf4q%2X7;KyqVn5i&DOQ)0&k^n+ zzlP57HUAL`L(vbT{SeyrKX_X`r0s?9Z$$rlLcaN&$;5SIc0$^iA4`MQUOf8HAmsfL zU)-W3MX?qPC^w)nl4I(7f{!dCR zw-JNZ*D*LMQLbF#cNW+j9+Zb>Se{~tMLw}P%UE6$_jtk0ZJ?k4R;|XFl7D;0*)pyvu{V@et`^}@9m}zgU+pDPu?~*#&_sF2y|?N zz@SUiQ*wglwvCepj%^Cd5p1-ZY*8k#7@e7*AKV0iyCuM4bVAGk<9~feYS2;UVOTn>-uy2 zT-c8G4%z}}E1_OSdkb}Q^Oe4HjcYB+IhXeV*(kFSM795=JB){Z#9U91`s%Hrc1o zzteZAe2R}2$t>p#l{5F?zVgrqpdFYgX{{ef+Lfiid?boV*%A`3wzVf-tzFXEHb|_V zb$h;vt+BPWOw?pJc2wtb&(VDK_(Uzs&(LO@G<3Nsj$3dHV z$Dy(69f!xOcO0+`@*PS~@Uh$pHX|>CNo%W?eQhgbt-T$zwh^GWMW~5wGa=A6NKI^e z2m)`ye&3 z{UHdn7lEdllr1GD*z(tZL$mQAG}|ujOBiQmEM{jAkJ&je6SU=^+Oh8pQ0;UexvAt4 z>M4;r$1QjS$IIe{*IX-Jc-U;}2_`9l(0Ji#vqSGiT~!+lzNsybUTI1W8bJ^0<(4?xR3MLlhDk{^FNe1dv{ zS7DR&4Cw z2{g`7**OLqbD;uSMhx=-tikcWD8`==&&MAp#(%AGH%EYDo`Wih`?G8084izSm^zz}DJXT0GlkM@5oiWp z8ELBhW|g>qKbz+SSTA4|PEXhVs`ekpkOjTxmgi(C+mIKWGbU>zxU98)09so+XtYxH z(JaunpQIjz=l)CVnU4`+xr8IZG5KNY8AYk*K*)Tw;e5!F7K|$L$)MU}_&nqVvlRU& zC&f6k6#a>lA}>;wqCa_(^ZM&md*(dZ{n1tP zWZX+?=#vk+hklO`-}x+wop&-i&JlE!ll?c#y?9rdz)_b1?%+VkWB5$5YO5=W+ua0O zV;rn$Y`b2>!YBLJSyg*uC2@}rncu>VTrQ`m#J#MNxQ%aHt*YH$$@#P@mh~0bHNg{dUYY+`uTZU@C@B}}F97v9X{gHuaN#;>yy`dSZ%Jf@;qcveI4-T5CE4wu5RvFiYHT zvDBv-a{*$Q@E} zi)v4;B<|XWLwN2u=Q&>`aknnxc}A*k;Wk{H!E+*yi?@>J{Yd~Y2S+G@^k&KVssxTN zmxb`l0nj8{uYSF}Oz77Ho`+rd8`t!Auf;2YBWD)%Yzymedq{srM1NI-d7O3M`yB6u zu30_wG-A3!eXjN0gPf~O;5aK2|8f&F;2QGTES`_3l0Zj}2^q;8&Lw)$AwWgafX%8Mv-l|6Yss(t4<`W%D-A+PN;FzE+Kd!Dp%Li+GsX zNo)G^vw{SU6A$&;bXIXkfW=7ki3|Q)zkCytGco(aE8KQzmBGPdyjYIT?AHaK6v*Is zVi|EGZy>+8pUcw9=VtWW(J6>j?Qbk2?!lov^5+c3Bi2gdp0&)-OG*B!NY%bl%*S@I zu3IWatWel}h@Kh(;!Jm32p@<%etqf)To?}l#CN*{j@t}=SeT_1jsmU9uq#S3w8sVf zR>7keml1aazw?=06<_pa0_AHPgz{ZjOgF@XR_jMXOSFxF`{-`Udz58*n|Y6f@7d75Y7)N&1+3gT7!B^PnKLUD3%oK`O*?hge{ zRq-6B)2`llz16}lMOu6?2u`=js=e&vC=F?{Hft_!clQ{HHBbUw)KpB*x=d0olsf~)qaVe`2H zY4@L3)2`L5+Bdt1`<8y@^NwZ2y;#sLBU$XZ1&*bI`MoZdi?+kaJ7@M=d*+kfpUOTG zhDYf&@Q_ke`)e-Zjt#}*O^(NP%ZPiX!B;69k4k~Zx_H&zDD>I;{ob=``nNja;&sAy z6?x^WK($}E9|Elp_0HSa(0NmV<-#=P?a{D#JLL+SxA6US3OHU9^LAjSq~V?&^}$?F z?SFoV#oFgxd`JnwA((6 z({8lDcYA_r|2w4?)L}SR-(8^|rHkgGjyfP)vfIZ>J$edtRO5qv=kjDl|M*Dhs@>uu z?q5H2HBW7H5qGdc%w;;qC)U-gqqZ74YOHjXj`~Fy{Lilezrd>6FIEuu5&?gC9Go`b zuW}K0vw&Y^ZV?HLj5yflFLEfhG_#KCFA z$tQ4f$HD1PoJuoQdrJjzJNm(?%thRF0;hGE9H);2PSRl2KA-Oedt|D$n|j~`%?-{} z0_h@uF7p55LYGMisy*dFu@+P6FmPLb4cuC@RQsk1;=VZ)w^3OPx7%IBy-47eF`VP( z6}Yv=tM>js;8tYFGsZOy$Mw5@Xg)%s{){Ri@PgV5Y z|6HkH`}#z$QO7ncry$x?zj}arP<{qop`PY$%Jz&&4^Yqdef%9f1`VXn@kY#b%mdUD zl&#rUmTun&73njZ!)il?`jO05MOQOfKGa(gW&x=7&mW*3eAnsVHl3OY?CwYCeU#?N zkX)yuc&=09ZqIgryq+9FAvRQ!Rndc#ddf}EP!gl)jHV9`*OtfeIw$iVm)#|z-s$={ z)&2xNrzpDr81`6j#urE;qx!~b7s71e;A)@`Ey~sYJUKqf1~J2 zPT|~h+i!WiYQO(+*}YBFh}@P5`j=sOz1s%%`XdZnSr$Re9c?AX8{QkVqf4)jOKxG0ro6X>eCE%!x2B#7Yj>=dOn_vP~Pa*|Wdk;^B`A~vZaGZ5e zPo){0N(wkCQ@IaCy;0HCWN7q)YR>^M)vm_DX>bhJ7B3aLJ(168bOmuE4;4wOy(F^0Hyl*^Pu7FhCY!Psbx@D0 z(_G}|W(gX{h4-7*+wUCF@Akp`ezz>{UzVhSUIMDUg;L9XFA{f2nxg;tDECX@|NnZF zWQ#?-LrPzDV3Zqtx=$i^R=%efrZpHn(awIlw2e1PjdWBv+bZ(#aw=ThSCev$99xLuI!&tBTQ&qAB3BohMa zBnYUW+JD2wrs#_@mB8ksTtCl^Q365Poc+!fZnKnRDuIu>sb?u`s{|IcAzdX6_qFG; zK>zj<^#r?VF82?a{gZKQ4}xwyKZMV-LHCMzM_X-*kw*rgp;^QwvNcOm?SDQ=JveUU zr}}Xa!11roQd#|%pS2N93FED{EY*IS;H|mwN}yG?_z}+sy7`<~rOt654hFaNAkAfV zm89DJC#eVLQym9^J1Mmwu0J0PZf5VApaH-02_GWTaN|kT>t??<88J>&QOP~SqeD)0WCm(2+)b zpOupRU&59dev*1p!gG&@Opz$Izl~_DWLBk1A*O?TFRoJfymHUGPl6ziG$M@ z9~`b_jziwE`2BNbcV!IdbLWCqTF7%XWr1qPIY7L5z4TO3yWPU`#*bI+Z_brjUcBaP z2>g-Pxi}*caNzgG+BJ7PUuU(sy?Mr$k5}#6p1^e%bnAKAVDy3WJSQ5?tOH(C7+~0# zk{AeV!uPS_{cjZgtrOI<_&1=xjqelSOzAmJuaZazcts!E&r;sU3quo;?j^kD?iuNY zp^4ZpBvhr9#6!R>@(!@Pg#ZmGKP3QxMVV?~h4`%mAkPfy+Db|-l>ldgQT1uqmnm9# zQAL~{WOu*yDoQQs08S;fpbKqSTr0YI-WBq9zf|<|J@1P6yIMs*Eyl7P=RQr*%Z~8# z809!+bsww*9KlO8Z&9QgcntRxqtw77lvG8-cTii3 z!)j6+_j*O#C99Kz>-euvP>&~5(NR|c%PGz4hHn*TV<-z_&QMPjfSL1z+247k_rB@0 zZtA#JK8PO!f5|oAzZ(KSF%16KKN^1jHQ~Sm} z#&Qj`qm3xmoi9)Fd&{fEz2)=AsV7O~=;~9~)XMY5Wr3p05;V-UD*7A%y>cW3=2S?& zd;lHozx)cx$82G7@6NyjZR#q*@5i5@)T5>-I@?dg+^Dt1q6{Yax0a#|^8EpcQ|+5e zudZttYO`0x!RZ~MW>7}-jlFlHqtuptrLr66MN(I_NC~~RVt=&^`}#5Y9V?t?#M@D! z)ZlzyIZi#^Y$Xr`?sx33-k~>B(f1QLvocNT0#J0+=ap&fp0lGYM$uPD(8y%Io7ely zkW~B0N0SUq4! zsINu+cabD_WL%~Wv^zdPoZ>;h^lxZ(R@}4RDrn{25Xk+*3&f54;^lF$TaAO=g?Eq8Ao@nF^#!p<6ge&yEeY{Ohut$&V-&rH(K4xH z9ph(SQ}q|espl-}SOUA!fpjFTSzdclPV%df1wN#on#g0W?*?#W0PJcbQgt#&>|5m1 z#xb7SuSs$>fK;6hDeTUm#OT^vC;Lf2J2|!EGP^g=b1Lqcfp$i!AMrvu0wh$+*<19BtK#hRhvP?xUiBc1dhrX)Kj#w zz-I!vIv-37XDi6N7Io8x0yEEHS|#psBF-m%Fb5f7{sco#cn(w9pPviP&1g>nIR8e# zkzs-vXsgX5;9&Ei-l)N>(mpZA8NEn5+T1EnxRl;l8 ze)qGGxt|4ERbKDhM~S&F9i-Z00nA@Y(AX08eQU_~mwwipV+ncX=PwZV0o*$X`3vGa zrzraRajLy44tAq{o=_sYYnHLQ&MgG-N>udz^eE!{WhUE$usTFRfQH|P;!*)x#(n&J z1z~szG-6+#IM{tL=0#y|kq1aCG3(5C#0 z*fWgmrk*BtM_AF7?`Z?8H~&4&tBO%rE)oD~7w!?&G(~?8aZCgKcft>^3L6w@iMj`A z*_-#|!;Pc(-LNwNr`MLRS8I*4`y1K$c2WoIuBk;EV9QzRSeJ?Xt>_t6MbC^@^g@7L znbDxP0W@T;#x;mkv)l&>^|hI?ps(RM&-I`G0Q|k({lnkg9R~jtb*#@+^nz$!)3hKO z^cRddK1v&KUhbvT;=M%;JV&Wz{Vfo9M$pWAgtGi<5UuF*MH@K6=%_z|x*zS2M1|eE zFA;5;J9rx@TG7`XqKy#EYh4DT>T73nn`#X}vesYzGG04Z_8WJvJ5m2q>REq`pS39x zG;%x2?DrnyIfj07jNfBQV)seamUsa3VM;x}IL7nQsNJ+7g+Sv!2sE}Ec98IsKZ$GU z6`E`0AUDgPpC!E3Vdxsj^EjJXo(*ZRYJcQ7^{7{9-giCge^SqHj^otRe3|Bb#r-KQ z#uQ3wAMMj@ctGC zuSCELwF_}B3M-TvDN(f#o`8v{0aPCE6NMu zxhYyga|MOx;erX=e_kSiqm=8EK)#uuofLp-@4BCQN+u}*OBeU2Ghce2*tgz%6ysAB z-N+GVtfOX76Q3taV1FVwy$RqLMZmE?hWkVI$Ai-w1CITX+umiIhym#tNN_#XME&~y{?-R^vzxW8j{(zvh0#dC);AFEaPSWASD6>X5Si-{Z8 z;_&{5J>S>Ay7hVD{+LqBgOX}5d0FxOWI1TS>Anqv4@Q@DSX-3v)k^q(Byd4=%*PaF`w)f7d4@<6C>)y(7nE{YsPCb%_2 z2FG6)6Zfy;VD~TMV0S9LN!$Coky;z8*OlT&S{+(U-1DXj|EZv%;Xi%;dE)-vV&cZ{ zQTJe*e=hFzpW-^If@*J=1c8lWO-1|gjic1_(IVn*n4|;{&xa2PUuqinr53{VV~Q_Q z&$e+8KwQ0%kXIiIZZ<{z*Nwu#$N_1{Jkuu=_t($&#`3a^IeOGd*Na(z!C9<=ZSm5VxHGrO5=X%$BlUvan%|?a##C@d%EA1a*o8yvG z!QY=I&gQ|~k6UnwI#^!xRPIY`p2U5L&6Cu?--Unn=iS^Nv9_IhDigVX_A~Yy*WYR^ zFrV?Sy7@ke6%~viMg`g1nMQHL!(J%LmcWFdkI9Wh4aJP!Io8@%Ed;GJ6ExIA%i4v`iov}}itrP2UkI6`+7lm>-Rd%>rbhUPTP2RS(SPA2 z-hcFCvfDTxm^(?ekDJT$c$LI}jyB^8!?$ZpzjGP{P(J3SLEs4PaYw0vX_Q*ZA{BiD z@G}_W-2Q{3)KeDI`#w{={|mm4WIEPASG;@p81>9eQv-&5TAHNV-#d!$6gFquCDs1N zW7M+?VUAV;FzVhfZ=uxk_ymTd6K#q%OMP0Q2?iHrsrD21QIGck&D+NI7OU*Y`x&67 zAsteWP)~r>GhSs+Ji_f74|`s2AAE#*7C#3QQ^a%R5$Z`2xr!6{I?|HB>z%g5htz=V zwfjl-I&nY7@YjUKS4dXoQwYp4gVQU4<8PsUUkMyu<33SXd_!;`I7;qg{#W~jZrbp6 zG2a&uv5#Om)(5EeN&m zmu1!7UJii|Qb2370jsUwo(_6j83fSY@J{2gY0L)>o#R?1uG6<1X8AC)KaK%+5ZC8& zCD1HEZu;%u{6q#va6GH?7|0iSctBAmzLx@nn+Z%TDN*gsiSU9qvUzs%7Zv5)Tz#JV)835%x1!U$r1LaS9fRv!@)>1m40qxXYMZ;u{93~pA=Ehj_@;EHv$~F#fLav3y$YL z?O-|2MT&FPzJg3l5@Q6pbDTk|`xyO`vgaX{7GUFBEbgZQTW>YDzj zZ^7F9eF*_w?{D7&YGP$J1S-ey_@Hkn^^|0Sj&h3o8@^ZOeFcr&gc*Hv6C&;`H=)4) zsYhgY&pMEy+JB1AiHh!P?Ty_*97!fWC;87uc+SF-kTVz~9*OxE(T+CKQf8#Qr z!+%ohF~(4t33_O4|K?;k4Qk3Y&za^Pq8@A5ITPysiAPw>LL%Eu(SGeJ@#ypf7v1Kb8)9B`jSJ`qmul+Mo#~0o&SXR z(X+8%!yddK%giR+Pucy>21|mX|3Ly)hX%)M)KFq^`6PcY+C}}@f4IJMU88162)yk7 zq12;F(2x?X=no1wcOOD~oyGn$nw^$Ydh#0M-WA^=?}g?%z9yU`&^IGrO3;uTtLS+G zhV2mNr_*w>KQ#8LPyhYI|6gMqJ#^D3^)w^hK+!z{mN|rOh;#3_EPjJ#A#m;CwEVHK zpEF>adSRbG`2P;}T$%Z_w`R=C)>h1x&BVl?QUBn(zs#1+Rx@k`?_jOJc`)u<-i!PM z+)pU(uK7dH5zh72scU5Z%5K_lj2ba5N&c*ZB9C=9ZKz7&K37&(ir=O4FF!~@|^8`b(ZA6iOUbG5fzVnhX!z#M2h&2&EQmVAF-9!%+22j&JqHSa;%{(SfidFQ2ZrWHHiEBMSKf!fn-4*c;Ku5b%GAX)byfcA* z5Z^^Bdg*2HE*f;SA*2LF-+oEFO91^}_|B~88OA#^=zH;9s-jnQiFc`>@1fM9gq}|u zx_cDMXNJ%cm0i;aO|$#9DY}W=0hOas_6McCFg47wV~krn*@#wE6m8h49zbZzBk`1IaLv#q!4hR4E5M6VRt9hOmMt5m3mfCcDFF_PN-c}T9$6(2_;QlU_CiUc)W9M37Xsf?YH81sG>BL2BwlS{YtLN} zz za4S7e9r*15S<(;>B4Y8My_b5_b9DUKd?hgR935Z217-{aFo%A-Lt=O8?T_C}J=U}Q z+q2)(@#W9KjQ3uIz%PW4u87|S=jTy^x2up((Y}?F8E z?|NeffBh}>ETPo0js2GFH|Uu(m3qnr{>pdE);$xHA-g0|=_+qgYqt?Ii^ot&QuQ{{ zHy*=FlB(-_;xUqX;thA+Lp{?ewRj29(!t!(hTj$v4ZqFmrVcey@p&VoeGgD-@looi zDg-SZqz+xw2sIJazMOF0KpW~toZF*}H`X9;#7w20smSAm^8=f!B;4*Q_RIU37n<9g+NUJ0a+0%vI}b!>Yc0;$Hkd6E<9wvKQaDiM5I)kYmS2grA5 zU!%P2i0YN20RU$Fy;R6qMgspPT&BLchs#v+w{+Zpi}|hNH46MkyQ$^9^$D zm)kjhUVw&nIXQdzGNnd}Q|;Xcsi!}iB7LaD==K@#vj&jBfwT@<>eCqRA4@Y>9mH4a z(=LniWp1;++sB6ShSz2-lYRPp6VEyQGf`_iUbP2jLSRv*qUR+;L#Ir#7f$8=u#4>y zyHjq+)P4eiJMN(#wNTNGcr4y1u0?>P3H z(DBX7(FWo3dL{7UBypZCTl{)deVX}O>Y2DSedYlf{G?K;LEUq(h|w`SD5qs_xrh61 znD75NB@m2+yhhSFj^+80RQv7i)YBLVgSSP3^9TV)Gf@Ihvo#fRS^a8BwNGltc~AoC z^AJE=^1yAN?_hS4v2hu^lW}k33z45RdL;AI^W_?xrh5g4FA}{ zHsQ;{F-G!Qq$4F1Efe*Y(ZGz6px5J(THOYnbc zYya0>*Rr+4_qBxWsaUK#;cEgruZabAraDcW(cu4??G+hvMia81&9{m@&TyXJeeNv~ zhyyUQnE1E&c?&y(@k&mqn>s$Fd>$6v!hJnP-CvYzT*vZ(ID-I=d^2G&^O+*gkO{zS zX1PX~e}vr!!|@t=`ir}TEo#Jki*uTiNowFr;g8=F;v@fD_^v-Q)(v&Yzg;&vTl-%( z79P09y78Ih#Qk7;s^m1*4mEu37%I)k0JTLTAAD~e-dqa+iCtpeI>lOYf%}>ne;)yG z829sz-OcksU0J$)d{-VZPX)T1F}PTViBczCBm0nG6n+4Vho{pq3oAO!XCtFEF@JM zdmUUCw~?fdLaFz>33*_b$Sd+X+IXVY-}Y|m*hXNYN|cE~A?r)-<~W7=bU@@j4X=H5 zwx^C5$@U1EAU#-}=1EGR>n=XuhQ9fvmFpW(uPVEa@|t6Yj`_H?hYzy*#y0k^8;bAl zUpL_X+t3T?VR}LRU+M+afoLWFiFc;-*O1G1D|KN_6tjQnIF`%-SR z$bQ+X=oha8{rwbJv-i8neex+O1HpmgJ8l9;J?e#IaEy|`Q6CLXZ!|dSW5L-R0gif8 zuRh5GFxL+UCz!!eKZ@rU#(mcZQ}`XTbIjZd^zDSj6!zo*+%bjEAL5HTY586Je7ALkqVFIqPM7%s zkWc%o|BmhQrtmmxE=RII^qa`LsbwW)wG|Ut%wloGO~2s2ke0)gT3nQRN(dyXw?JTQ zMC!PpENRO@Z7DZJk7M@n^wFB*5!roFmNdR*CHvRSmfdO;G>-fMnr7Uf+NVE5+%0!; znjT;^@00zEw#}m%ZTCMz+!jIGsvEezD0+st3qZt9N#5tu0nAnLur*_0ruH3+2dZ3~ zo(gBS12CH~=JasPpL(Jnz##i z+&i-?3wPhD!MxF0)-xi$R@{w#{~6+bf>Mhr{6}gw-?yNw?F~}T@5H*`7QP98KYqSe znPgWIm`FrD*zI>x4@l5ZLX?TzzDV*vih817-&9ylL|O8eW-EbpA@?DSHY%kJXu}m& zC^fhq)ZEEynV{_cc?$KY-88p64o;W1+^PkhChqcV&=$qPX*ZiUkz*lIwYNP@+>eWS zn;QqG3m@gOQ2q>YZ+g1-F8TIE)&AAfe7<_(-6ZdGPd>x%3Vg$CPVnOxf+B{lRK(D2 z=l&jhcktLax7t=iWw;jfq|~!R^vUl2fND=+{UrOBhxGHy*8XjrAmDn$?UC72`kp_9`gw`0+DoCg9^+V0 z?MWkh*SF?4*b1k!wAZKbGuLa?CN%DS;(noxbdFa{F!*P2aJuusG1_@i54TlL^`jmp zLsa|oad7%U2S3X!A<%eiK5_488KVW|RDZ@0)t>V7)n}L+pXM=YKUBl-S1gVoncroB z)IL6|SDDW$wYsv$XO-$V&J%{*Nj;TMO_=a?%NQ+nENEyOwX%4=B!B8m&?Zh+|JWuE z@$Z_{1 zsn6MH-@A0|EV7&Cs*#G$bV1=njU@4Vbl=UCS)K*_e`b59_0~%_``dU9v6jx6 zyf&X#-0A3?0`AN~Jbzp%QFN+k15nOy>OpB=2H54#gciH3oE?CwBiU67;^YCLb8h*$0sdvwutH z&7FYzXcfRwU}C=J`Dp(ZnqaUo?_RNwIdO$L>OZwkIKgNk`Oi>l2@+_KMk;}I1ad>| zkR+?3zbCO=Cq6)&P28^q*f%Kpydvr;C5n##%hRoAnD`lBs1EHf_Z-s0@W9s%aj_V3pD3e z8#-A6QoW5xeRT3VLfAdcOX7U@{UYkwP81)?5z5dH-6?FJ+`qoubk)61*&iK3*8!3x zk@rLVJ0tnt=_{h>^T^%f4$6_NUff+KMc-gj^aCJws0sD8lR;sAnNc$L%fv?U*jaB3 zIN~JkYsnbE>H-9A1u!3E^?xE+4tM6`kK%ru<|yvNQRE+puLa^%OyFQ=i62W&ZzMSK zKa<$m^8+$8Jju?*&Hjf4{k;TqGk`finy~yP`DWq-sINs`6O81#{2mGNHp2ArZ83_D z_Jq5L*MbbCwG3cxHYrU zAZeEp&FhhWMyaJ9;7rg`U;7EAmYPWrKzVuqpy3^Y-IB# zK*v3adW*_(w*aVX|JY-1Ua$46UvRw!s&rNCjzXaEt0#$juHfOqkvyL=@-*@@Jau*5 zd{8FYYz&1fTJm$j3B$M70w`-?bbT#bXN28m*!DS-sV97m4T)dc z3Xs8Qa4o;Y|Ea(7@e}{vU&;KG!zE`h8XP^oOIh}>Hi=vxQQ$!R%yNAU5V=00IL}8S zuZ{+1tT^{7p_H8=Tlc(-=H9|%%_Uf6 zzu{Yvw>PT3_G9*LCG&eB4r$*~&!0p5pUr~j|7!5On%R&46U072V*bxR?h|_t2^!jE zbM|`S{~W!adNvG#-DoS9eH_KlKfcioMc49;zTZc`t0B3rdh)r8`mc)z zq8&%F*A(&dxA2(a{R9HjzoVYHMoe)`Z%pw#2c?H;NuC8H`eyy-YX@0GZi`CL*k8(UL)T4%M=*w z74gR2M0lY&vU#>QB;L4UANQG#(s{h`FDUhtbke-{I{U^OvmE##aj&-(^0S_kKPu+< z{i|#}gO-MWH*{Wy7KO$aC;1=R$K%4iks`jB#ZeHgj1){n+McVH`^FfL4~a3pOT-wL zLx9B@w}Te6i5TNDe)ig4L?&J;5cesh-m}3xMsIWWbRKV)YvctOw~u;a0Lwz=GeH1HZ2`Y8h_>flg&h8=o}BOIFdFu6_q<)$zumJz*h+=6 zY6rPDhImmN?5?s;(w0o;dv4tKAl^wRGxkZ^dReuvm@Z!xBm9s{>~*?%?x2$H`c)Uj zeNo&uT7~Z*nzTA@SChg`wY~RUJ3HHO_cvp5~JuV z|0U)pQqjv?9KYp}s=YK0c4thVq&+xYcH@3J_6l{J>&H&~3+?ft^o;i#%I7Q;7Z%t5 zFTM|56a#u^n9uR9OYGc|?H@OaSV!h#{1>~6&=P9XCq;vPIjsFxS9;t3Dy03iA7~HJ zivG#J_}`=A@6vtz?|Jc@@@?;)N--&0+KWJIlVyL23AW(x$%oK>;JSUAN%_7&0>?HL z&b$ubcsB*M-WoF{Fe4H2wnZ!7!{gw6rj6Jx10r@|J8V-15xcMre&1k)JzJ!xrn7Q-?PueF;f*+7lokC#7HFZkBJK!p zCs;Niyu*-Qi+H;;VNW>Tiv`Yz%U3V=#T{`#{1J!n{;&_ki{VewJI`OCjo2Rh>3q z7aW$!p2I^&EI6DHu`7Dm$OVTFytwwJVK*(H0NT`H*$WPXNt-_`XTe4*>{&f*)PgO; zZeDO`bN#gF3^;RSbN#eqo9m|?-&{Yflv2kb*`!%F?w@un3$))%R{nfcj_~9D1#!WD zk4{$p{N_6ew!<>f=5E|S?d2@h_DYu5wkk)pee0Nh|6huREqFD@Yx~P9hl*dzscYZ2`?Qkju!A&WvRB0D)vu%HOp&zEl0Htdw|2Q zX7G;`uNLrM7w}&e@Lv(|H)buj`2>7_&T`wJh=tE?%2{vQoVCIhT@bw>`lVCFTe3FT zq9YbQ``erqws&$i*har}qq`v`4;{VFoU?>0+1h8r;Cr;K1I-|wL67mJTj?2kdI!O+U!>lt0g z4ayy-X&uKdVYt)o?WYYGbOjfc`X%9q?~^wx?msQFtNO#??0YsPvn^9_5y-~v5h zoSR{s|A&0eTRBCw1DM?L`UW81sr!0kgneU#b;Awg?0|FAcEH#sIB^04R$NBe0EhfS zJp#B_dYdhO+5rD|FoDe#H2rBKE1fUe3=zDfQ|X`u<6CFtxddJF*R|Jan{lIS%G<9NWIp)8`J1e=w?5uANmL@me45YlcGUYL2Rbp=vuVQOr9b%b&8V`13gyUIcRD{;Rnf8%gBman?Abt~BFz%NM)cCP4 z@7f>O-$~X#fkwUlg9nlk6{FW`MJ&GY=#OGx1eC3658k}yB6~GBIVao8H909?ld7EWI}5g(WYn!{qu#7>?~**BpB)w31`wTH@JGDHpa;awyd$fv zahD4xR6M$rYXz~{t2Gp=-TEwq`oVJd`CyGL2C$%S=-ZzN`fm%E5P&QvRPwh%cm~|SU=zk!hkYV#uZ=_=lMq>DRZ?a6<%^s22th~nUqDkeQka? z)E98<%%;A2f4#0Nv7rpM)c+fIiqM?$nv%~e)O(U?);eGnA4}_fB)ga^=vjQrLMkm~ z$9g6B?)}(t=bv(|>J!SsLp$%auRP4{>ivtwPrcAd-7%@I1{`iM5@?PQ{6v%Z1TzVc zK0cqvi@lSrM)rE7{u!8qvc_FDaFDI`WfvAsVd0Pgp$Jly&1ESf?g5ioba=Od6cwNI z(-$DP2kuY_-YpiL~>&3*xXHTnNRLiCAXYU#CpHq+j&a$t~^=LW_{d)?F*~_#X#QgwC zXxj(wm(?3`d)a|k>pEUAl(!z#4Jr<*_M$Ubooq)BiKVHu{p@H16^}!6<;$j8+R!GO zIELtcpA~GX9e>LIyVSK5KXLOKkS+=SsIuMXB zxrZ%$#C>l5dinJde*eEqc}4ouO7A&AFu;l4Gk`o0Dh_@}e&2qmJx}S3IM#6J{tnaL zWPcm^E~MbpZhA(5A7FO&l-%EG{j zeYF*>D^roUnR>(t??tZu`|A9_t%)VD{%ST7v!6}OwhdD=Fdg$dP#&iFRU(1Oa>Mk& zMr*QM6bShYVBl&S^O_J@|KY~>GCi&Ak2#s_e@x1JBd9Lwk1K~7fH{*A;BfaH@NS;O zB3J@Qa8&j$6H@l?xF4X}my^Lmzi3^oI~ZBKjyI z^Sub$E4+PyDB8jv>DK$5S#(11b;>!PNr(FTkX`!T(Q>Az)$tTpF{iQi+_SD~`+aPa zzuLOQZ&yoK4t9t@yxzZv?6WDF1qkIgITk+GrYxqZVT+xoN%rR>v))1+DFdA`#wtB8DH!{A)?JzWFWnhxkK6TxYzU`koeOa9;=3 zxwg{a&{KBjre|9ae3o_=pn4WxExwF)d?xn{8$WPBAW)_bswP26pTMMR>GsGj5{64| z6-Jq6{GO!Xlvw_^>Qi)2|K{d$%wV>rnf$S)kQ)m>W5*)a0h)aamFU~%$|S+ z9o>V*_#j{C=4-?x!yTEhMs5Mdwe}I|3Qpo!Jh!wuZY}VV?WHaGgqdiRgsp(#-SZ}w zlGT7GP2{exHuPVzQ!~*<*nTG2s0aRj2Cu>GZYT7^?-+mmA#+&KJ-wggU0_`bXM?583&JTo*I;yk<$-h-i)dz8E0Mh) z$6B}e?rvS^bnzexTxPAZo%=+mF0#RXw6yLs7~}8L6zz{sZ;k4R1RVI6Tqlpn1c38@ z#ZJC9(y}(Q7GA{x^|g*X=?ld`E}tS|i=6T`rTA>q;Zt zx_!mQuM- zmkZI0e8CUv@zIN&+)Y1YJW7{)GE1s^)>3t~6ivATbZ>+#K7wi*zO89I(eKFX#a`o@3h1eN$a{GFAI=ac*wb}}| z2j|7J(;30)HE4ULBY|C+m4C8~kR3FMg5bCHAYX z8KpUsz2D2zvhezsRH9Qf%+pdbH& zPQAPX_TY&K@8Iq}#9t%5ejxWGs~x4Zeqr55Cq7r~r^p^vx=l?v=PulKPkH!@7P-14 zJ)fOO`jq@YeSmy`dl19>d8OZbA7i-fW*W{&2iyAlFA90DABG~^I+J?|rjYalZ76hb zvujjJBNsFX49G-H`OqQHW)f*mEs|)>l7@`yU_n!$-H?uE*3(><`MKV@nrm2-9)9gt zL0Ji8iLA?Ny#$c*L3K*e&v3?O@ARQLqCnbj=t;VM*>IY5mwfdh1lO1=wEFqJy2XnP zx#9Bl8p4p-b2W2cecZb2n}>9uLxGD;w?;kF`+`L*1zj`e(<;?#Q?O#Rq z=Xfwb1Dqt42>->gk#YAbxfa7b)IvfIMh1{OZu=r;?{`!ytR^rhr&WbY{;&N~SJ1uR&)kc`uFyfuuq(e8xx%v(n%>5X&e`#kt^D`^TaQPY?F2R@n2*AT@cJRNugYkCWEG@Z+9$jC7cZ=WiO>oxs2&Tv1 zgaO456nTD?vtX(Gv^0S+r!EvpX$hdGP7|E$ZPt`fi4yH_s&F#r`Gi1_SCn@#MgIx( zFu8RPsyk0DMp`XqTp}S_yc1 zat4c58Eux=jX;Nct;5ik_RD-qJUARG3KQf8kEVlGso=<`$4>b+;)J4^h=*TrB@uY2 zvu|1-oU}ejSwqkhQmw2Z2oZoEI6pSa1+zVrye;w~A6s~o`gR0nf@(N0;8}AU78@9O z_+jR%{oviSlX$oDP}g~He*G2x*g%SN)86v;KK_<&L^bG$Rp*P{v4y~Us!f!>_EE9h zu)(uh&}esf@Ty?Yad#e=@P6HLCgzxQEDLujh-1Ba)kuNpopa7W^T zNupMuSo$b?FMfC@I&)9qsWP2 z5}lYk6~F(o4jn}9euY-u*T)}(55?rtFK$DUa*5kyY_H`q(hH$R^Vd`5OwX22gDaq~ zXKc5j>m5QamS>Fksf^T-vHRXhUx0*J~Cx|wTfp6>+rVMAI80n79-Z#Ixund zdwfe;_9c24@7c_Ly=JdiOxqi#cg)nnd;3*vn*^`;xw-j-Tc1Y;7@bPv#9I1(2K^@2 z>MfN%!Y7pU;EMfEsEQ|6-$4sx-~j7Jt6ymc{X>6N=<+tAkGLvg?2%lShn|ovZp(L> zA4MJZ(nM$KyH^^eKADIx%6rIO#{p4;xk?|2Z6~_r@fVY-N;~C?d!9g)UK=L+w-{~e zX*Ow_6!%TbmmyUSfQF{QCDk;#-*)2My8MP_j5j?~=j@N3fFZST?wJ`hagu9mjU@jq zLl#JB%hCGFCh`F2C@#)QlozdveIB!iwgsF>peV|M3DSs|3Fm z)nWbiW-)SVVX_dGJ54T?4SxjA ziQe^4MuP3%6$sw!*X4E;xOlBYE&Ss7c4#Ag<`gm&Ujq7n zj{d#-O&mtc0h++{#5+Xde~KSY5bROd2ta)(M}6DLw7fJre`ui)Fs!+L#h@bd3Upu$ zl$Z79TbUS7V)mBel8w}8Ew^MiXyudHYp^favxYyQF!7GR5nQc?oNtK7M7=cl_H@?B z;rM6{&?iqdax^MVR>iIN6h`wug?B-D=tGVlEsv$1QgO+owyY<09Expxi+pe{1TRo(n0#2>G zs-L9x3f7lX%2H zC|TSdG1fo?s=2f&Fd0pmdR+IS5l2PR@AZ#iT44a+n0A4`o7ksBzh_6su^hwoB^CGw zAwUN?`!}DWViAcujqJZh*d4oBy?s78sy>oQQwv=AYK2l>)XkoI9xQT^Tj_}_Ul|1g zz4VBDMOLpJyN0hFH?mPNkk%*oBEke*XTyhO{>wW~;i$r{O;SVc3PFg`e38WXxcvUg z{~Mt!<*f&QFTFR-k6p26P*E_zF#If6Jhz-;DQ@KpuUO%3d74WxNN0#z?baK zd-N=Ec>$&L*|yFyS9^WwwkNdAEojdwx5n8m@48udYN9(Age6SM(zRswj5)|?6h zaTX@wfwSt?&Z*TD*(-!G#rNmNlSC2Rt=6pNcU+a_!2^R0Y~OeqTzC>6*jUSY@v(vz z$QczzYv~mhgVb zVz}ct-|xusFdA4`Gp=hRYZR+qx!OOyee|ZTTVXijZ`u5{guksBD_jw4UUhJ#om-}} z=B#-?1jbpf?_6UU5zch>$W!cImH9#bLK0pUH;A&`s(1h23`UMVkz&Muid;GPn-r+s zSrT^#R$Sf4c^po1IhJB`1XyAr@4n3>S-zAX6jxjb8JR+Ok$HIqLnhWz~<@DacO8HZcFF z$XV1mUj(rXgoWZ6o)Hu_&aJok~E_uh|azu0K^8 z7~Tn8nxv;2t{Kwhu4-|6*$FQ87O6K0Ii2(I@0?QciUwe91HpFp&q^bY*yl5T`L7_F z9rjDG+=c5ksF|f@Vu@jcfsAm43yoMme{A3pgSO}14VvCQ4I*q06xKg{N7wg(qSPK) z?N`1z?a^lg`N1AU%kTfdf!*EaY_+wtEV+G4Hj^3ZwfbfgG2Q>_1N)P(F{&X!5!E+V z|DwN6`7U_xK}-aRt81~`D(a8@+`P~uR-h=FrPr7Yhl5YLa_=L$a=@S(Sp@yR5ptX{ z%iWFcrc;N=rR+K0h3xjt?#-fC=z|M|l_Yul?o=Ex523lpVdv;IQMh~z_B|$I16ymx z=jhXU-(k*m(fJ*Ec42aV)XZEjUuG${eDbi`LwGo2PoW1v&#yshIVbC>c|yand3UvJvTT_rl|9n6sK5+t#KyJ;GZde?{ z%S5vsOyl7Y+pgvC9qt-bx3tT0Er%4Cjp6FRHwMvjFL36gjj*hdAIn8CPKx6a);eD^ z-Y8_)J=-F&xm?8z+xL?yX(|4Matbe4LUAQuo?8Ygr@P&TscMq9e~u&fE`aH+@+bYi-)+%y6t{It$0&;GAr0 zrcfhfBOr;Gn6uS?4YOq>6;-jVs^B5bjks^YMWJF@?CE5D=stJD!5>vnyxDL3FOZ5c3rm8Kj<@j^MhX9bX{wcG?{ zuc!jNuG@telolh>XRhhq^)7Rb$lc9CCa{pTtnBuN6|?pg6|qXP{rDBdt{(r$&;Aod z3NJ+vQ?f!g%3tsDB?>1Y3}?m=lX@=Y{R)m8?IlH95xWfd1=Vb4X4tuVe{3>&|F*DTy5Qo~Pp1S03>-z=>!hiXNLvH0P$rS3qUp~Ll@3UMo7<%$%hlI)+tc56{%NxG@kN2-*7(%!qubpG@ z3?_M?Hj_X^Gze!9VfcNMafTi{emGT-FdA|ohg67B7$s~ zKl7#v_D>8EJd0g<1ZZCn>+TP1rV7$DEo+H zq0wNtu8G)T4sMZc@WK89V=-E@-#Ez6%#RajaK2_&S0(Qnm$)rRJgv0R_}f|W?)Q;@ z!ShfX?1jTFQOq6aeis( z#Ezr=zR%>t!##4%7Gl87hl3<6foYU@v=41dv0QENjhN0roM*CtoY6>zg9d}ZZ{K)7 zp9UfHx$y&8?3UTB+DQBecp8l)8t>lYGMCcxS6go0?bw`HalQvcjXE}hT#i;aklwMP zCjoM^NI`rG+c^uEbdmwTxJZr<55#mj3@`Yg_lc%MsMMn&|Ab~@r-pQj??x^J48Rvw zU3_1((1ikSw3ea^Cr&W8nFu+#a_p|Yb_73_`?@b}rR-aOnKbGG)r|@iziuhq>-F8Q zJu~P8r~wv(dgKxUjk9_&H<<_(<#R8Y1>clgOmp^*)x(ZHj;Mabht&N$Ayti@^y9tk zC)n$dkDkOinOi5v&4-)fZH>*g$Y^qOi zdkYVns0Nxc2ES&typatn1v!-gsInyN{>U0zjQ;4FEqE~h_OH93+_EQE$smWH_DEcw zI$efqE-H-tSWH?}c&^V86nFc9dK)hSPi_nDMZ%wbYTn>vpBM4hJ0Z$25hv~&SJ#C= zHT~Na!W#)w#3O#eHN(BJ0qvh;IdwsT~TW*EJg%$GsI@w|z1>Ntf6@mU)<**);0jW9l44+W!gUYqPveodZx43KdIh9xL`8Cv{QZ zGt6x5G4}MT%GJ%zsiO~NF(geN8Qsb<# z>kRLh1x>CAaTBT-@6@pLugtMJDiYXntX1lpP4a?Yg^&aG1a!FCrha|t93nqASCRC{ zX_PwdqlM3UAJ8r^Ssr>$NbQ@gspitLkdrm;wi~_Y;ZTTWLnlv5#(1!yPhhe63TSt> z!Vz#vP4>H^*}>0(n<3q%B3$c;%DHF0Bwz~2%TH$@ibtsGv`aK3FV0_nw zxbz##V#I|CrO9LWD*g02<@_(tx#9oGUa92DW;2P3_rS1#jA@P z(@D@@8)8R1-$J6-v+NQdC|g^_{xL%Gs&y)*5|RV%;5e#G-V5W=OKDdryXaSBBQIDC zJgUjGHhS=UAC}_?({fcQ-3~{>EoLT18&R+)BCylf2t*yU{#%hVW0ZvCW9*hk#>5{2 zj{NpVu~?g_iYz{g9mk(3;Uz~C*)J83_V~KHTs0W;czth|Npn53 z5F~ge3sPgf<91kBPxAZ0Q;ndoM@WTSLmX9e39T1p6(?E#evEsECfI2fHU^aaA@psL zS(e^Z!fV}?UrTmbK$=fvwmPp+N=qL8yqHU|e5R-Ap}aR_RD=k8EPC@26PWx3l*pK0 zBL(Ob%?!n*sp~7XlZk-&{9d4CyS^X%E-2A8`Ig7=L(6 zlTV^I+9VH9iD4(4M6^biYQ%c`tI>Chn;cbp&k@WXx6|4-;6Ehrmg{X&QMo`=;T^`GT*&&lWJLo)27Mj?(c z?4e3^%JiQJUxhkJz0ETz&*z#n^pUE^Y2U}SEW}lLPyDo&s})e*ChlH|DX`eyN~Df! zh;9E1G)J6$`G{*O)@aG=VoVilQ8wq02AW!v3t2B8;q z%69%0)fi1C(*KZMr`hVePkrM3MAM06<2iey%MXq(V(BN>Z~PYf%{4UBOu@GdA#=2M zGEhvK%`l5Z0yq80M`1wqWs#~XZ~AEde6a_^oH|Ot&6OEb|KXG_D3R@W%oQ`8l) zqXw!$@e+v%p59>;Zp)s(9P3?GP7II9dKp}hjJ zql>vXRyuyo|M|LyHuO;wu1v8>mQ2JRlj^~}bX@+yG<#vda!)yzWF%w(XQMWFG?L`r zHw58>F)kIjZ6o|=kbci1T_-Y%gd&h5CS|Kc?rB4P*0%T;c4ehFx>}@;r>+gSGHM6n{4@6 z8ayvNmmwM<3%vL}Zs^vH^~cyC*e=o`TuIqTe_;AK$&bO=w7L^9wE!1CDcQ(4wG8dHmY%P_B+7CT<<-X38o()BhpanQzDq#7TsChYOuUF?gOlSde z{NLjld;%}n8(AID+7W!mzp5(fh+fg5^miHqSzev^udt>L+hR+lBhn}Z=>xuU zlo^gmfG=raCbIs$8Yj{0b#Jp`S>^l5?7c?HXz{$V4qGz^KSoyTd_jhoCtUf+$XcF1 za1NJv5&0f*ld6H~)^aJ^M=tfZ%I-|?&J)cWgG#a*@Gh^9aZglE6D^mzhVi6?{yGDZ z);OKma59*msmZat9QJ=|z)TD3CVPV$z%R+C*AF9G+$_Ei6uMd7>M=+Su8INa07r~=%w^CVcRppe(19Oz|Zn*4*C};*ZlC^?3YKX?i&MQmWRG*33bDz zHh%Qw%PMRqIh#1f<7e8aTj!iUa_bys;~#hNJ+n)um0}}EhN*z+hw}+i@y_0#O=GP| z8V7Y%;=ZQ_g`|+|cDW52iDq}y&&XBfspQgbT_6G`rehl%s3-b-EvDV6hSw7G;=yEVBj&kzP(f`4bpS>!=dS*@#h+72a*2jzMV>&s80oK-lp0OTJ}QJHpKm>~ zH8{}qEgMW^66SemzIEL7*tqUn?(-dpYJfj636>PmUm13s%w;18MOc0J9F^~$pLy0# z>Ubs)j7~WDjq0#zL;nU9wA|ni@^0ibp(GZ2}<0$(x5z- zbI9I1R=sP<$Yt+uO}PSyaYbLeWW)y~EBqcplHE~s)gd?1_}QMtPAC~Y%EriLlb<*9 z`*xj=5|}6_NjYL_F6Rbv)00tZiG7zUI`J7oVh~c26B7&cCz-!3NIPmK{pJHt;q#+2 zMj{q+Wm@7RgijCsZw8b2hBV}H?7Q#SG~>9$FL41wxb(J1krFD2gpsZKw?n~PVCUpp z(D=QQwWjcAm+^|&(Qtth9rGaDpQNH$oEm|AuW|dHwendFCgIYsV$E*;;pRQ*Fe;9=qcqR7S@QysoZMTy!_jy*9V!Ugs zQatlQS=9T=y4`xy%6+$Aaf?`&fqH9AVyEt+F;CQJB70xh5x_$_ zf=s1+IysTKP_yRtHk<0!$!@1OfaLQMy_#f7a@OuBP*T4Cc6(b|9}YM@eHAuiOx=5L zGhLX{J_{i}HZWmKZGa+Sb^JMjPMDFWhZ=_T?xtpO@{>xIBLoQl;k1j_N_bx_E8Pcl z7oz(b{I$o4tqPzs~8#$>8E zBViE!cJ%c5F+ZZWury0!p}Ph0LZCgiFfW!sF4(Nv6i&J{{{Sk&wE5ZTQ2xQD5$om- z-9b#wWZ0&bpNELv1`|S=0CEO}2=xQLg)FAC8Q~GCyLH)qGF3DjP4S+cFR%3y1E;9(~;f6AMevS5;z4&p1&`x zVG`l1I+y6A5!9u~;8Gi^kGV)ePOlr(wdWXZu|BQ;m#|AS&Q@EOZtMd)tSTYmh+t87f( z1xa{=l=+@WZcjjzGl(w+6ib0y)W}M7aGjhNH#5}48N{eq)Ww5u$Y8!+4`HrwViJys z>@}+Poj;5yyvFDuvfcN=<{DvlL54VqTTtlxT0q&C6<=^>ZUlJ4a?(-r4vu^Kg(Hc| zQ`c!@{PFiTclmvOY0;` zidwOIZ$yZ!!&Op(ut_ryB$_DV2o8zOK$+^KYG{Gj3ip;c!TRZNOwtF&%Vu{=?v&^Px9eyAQ?W~elR2aUDJxOZO&uTFRdn(EZGD`uXx+Z1^USIH zB9QvxICexxp16S@x3~^`?KYyf*H%$cE2}@PH(p?V`nbl;9VB5g2CmkiEesQp@TWEZ{tmano~cFc=N zbNJQ6_3zX!WMwAAMNx!`nLRImCsQR&xA0p+4&%$@ux;2e1IMv}=bbrdsv})u+9r9< zHp-Bn0uzf-Skgs;M6_#w``|1&!7zV zBb^_8+UC3u))+guP8YK67!6dWVv!rM@3W;6rQC0EQlE!zH(ZB`t+v>2(OZj_Fz zg6ShGI;Z@m88gMtn1>yqLq2Xn$Y`+*l|WXU@(>aT`sjjM%CsU8vE0tooWr;Hs+ef= zWJfodB#F&?ZgGG60lNNGe$z97mCfLKjggnlWxQUa^C(8PqG5r_^C7x z%iPrGHGb+t2=T}2hIA1@PW!xL$IiagGxsVIKZ=1gmIL+Q)JIt6+B%LD*oQYH6+YI9 zdAD0q$2vMDe9H`txsk_%D!f5KlMxSt&`P2ii+>IzXI5w3t&<^8FtSO$kR};;saJ($ zaATA8>?9~qt<1@zUh>on<1HMe*{O zeLLnaX8RYv*z^0qjdxnkh*VXfw)NK^9Ngsj_XVDG4=2j6*T0Kt4i07q$yY$5QaZBF zeJCBXD@Bp)taDOPI_#v9`V!_RCQJeSao}ss?>gZ>%^vY$ZovYxNDMYcbdmP1#ZSco z&)BC#Zc|~+)GU>~3}o|;tcH%PI4?{OCom6_foOtn^k%;>PUb{L;J8tmr*PTQz2*Jx!%^_^%^01*CMD+<9Ss`fB&;hrNvQiTg91tt2Z{*Gf7HQz-Xcj1 za^L(z&8>(-;vUTy(-M_Ax3p_te|(bEIp`ueVDD(Y#cW>2a&0Wpp?5!1GkATR!mo7F z=$mD3_^;n8g~&PwiV>44n(&Tf_Axo`V;+BD$sG@HB0vrNH2t1xZ+N~3@={ls?BU-O zbm0$TpL@#VvtnU5n$yRFXREZ%&&WUGm4i7xesPn=2nxC0r?DX=1vTgHk1l6lRUP_e zJa@D?j^n>AMgB`=d`#fgB``xmk*-Y)Z15Uo5-j_}dn8jjCeVLMZ_J!HL_*bhVOXgn zQkVALAP#EzvoIv(HXL}_tFrI2TlpW2`m^M`;A20OA8SO1zYUDU((s3>5IP4JxDpNw zTQ&F~c0j?%hLx^;mXT`|ZS8CH%S;J0bsvkkO%Z5VP#R(Xep4gosR$H!&`Z~W`dlT@ zAM&{=V8j-(wjSioAgwG53Ra!=3k;pbm+xI4Q{6r{S+64qcAh$G-Gq&fFDL6uoM_kM zTic&3|K6IC#{5Hy%JqR4-Kg8vf#|DnnLPkHLoNUaVIz%~gv(ii(V@-vp4pT}vq zoqXmJwi{gp%d!OyK;1X~AMMv_^-lpf%NSuGwvL{PL(9CFd$24|$cS_Ju}-~5sPNlo zzgptc{ENgCnm^lS)m~gOxvE0(U9%5fevw8L)^P-m2SJS@a{u4xv;RALN=l|pC8plt#CIM z36FgiX(32SSC)=3i(jkHzj5^B{KlJ8eCjruj+na?4Lv#MW`4NTsdmYj)-S*tLV5~J z8GQ?4Bcf9X^vpE%|245ep3VJf(kR&;iW;M@j538__RDOxxJE#@f@Eu2yMWkN-HK89 zy(22{iSv7pd#0(rs_~WG?0jLH4)howb)6$Hl8E>X3vv=$b^|HGZFdgCY=U#B#=$&z!_=nt`k3iU%dQLTEz$=@ahmmCxI?-Rn zjXv)Uh+g8;(IB2HSz}O4THg97^00=C2XkEGVsP|W;GtT~Q`H#D@2ZAFwwM61)xTA*ao~^2uW$;K3G^v$5!cnXf@O+BJiDU{JvI_x=!x_x*>qK zuA^y@YZZV{R>z9NQ}F#1W(VmEk7c7b--;)QSQl+#*KL4VMPby4;mVfxE!qBDj=7M9 zIAfNZtyD^Nz5G>h3-s_^9p4%qFw_dn32|&!;3SA*| zO5g^BzBODD6V?6x%O5Xv(2gcM=RX>{kT3>m@a{kxZ({c>!V&V51OGA3j;?23l)jBJcIWXdUsILz7 zLP3mMp^GdHkS26oWIle&0VLl*2l4esYu@5Qr1PUAP0rooF*bSNNBVeMOA;FT&S#6o zk%U7?1pBmiHfD>3TOP^gA(ak+Iso23WIe{S=Qna6?XsK%Fh^#oG$lIKNp|vs_d{!+ z#_jR8(zUS@O6xO5a~fPU%xlN7I-kqS7+%(zsuPTT0mG_p(&^UXofi65XjxJCKjOI+ zPh$BUa&Kvz-ABIGvInM~$7)UQ=UWZpwU3ccbWHP%F5{OTDAuy$Sf0ibwokXG+bhYP z#C|%B#np+uXn@2b3h~vlr@7`ftoHItI=^tNkOlp*XtTQKv`Fq@evnS*T|7EsWdKQ403JU(n9NBFoc$v4dN;dwgozFc!fj=TZsJ)~_d^ zoX~fpNgS_~F+Z~&*9HGT0w zr+qWgRus}cn{_KT@?&oy!D;aD-^3P)lHuRx-jhSeCKiRB$DaUs{Q(sk$bo;q z{J@;V@vO--setW4t@eDDj7(A#X_b$ndoll#@Nqs+<-`Yk5p`jSc(eo-q66!VT$ToJ zNyd8FB336%AGwmd+J;$9QT2KiTPA_a8X<;w4+be;kU6{fsIHy(H2a2E*yJB7zGVSY zKEJkNN`lF|Oa(#z)#1b>qKgIq_sQBjCk;p7JWx&0%>Nq6+M@9*feg zFK6WWDBK@HF7B7zo-#MFd#m760<^qlKKE7$1BI@-zIGol)2-btBCycC52f~2Sqa^~ z^Q{>@8}tbM^J=jV-|wP70#LA1gKB$Er=AS3-FhE1>h`Mn=wH4T+;F+)zhxe_P{EZ=uBGSJpzA@DxK3 z#g9$Qc8+a+VZe${H_(9IzvOxte4Zjvuf_VicJuZ|Sf^aL<47U6{^i7~2j)9Zr4Af` zYopJdQ;BCMToU_2Wo2$Y@`AM+KRW)La|x7@KZq1vp86{oJ@?_={AaY#1!XWwVXp-W z9p7dv9q_^6@1Y%iszzBOqYn}@(2-I1Lp;nwS3$q%1ewMFd5PBEowfk^KsN(sG{K2c z_pv8dboq0$ui)_eKX#lON*8QObo9atUju2{d<<_h^09i8$FY8C2x1)@NchKl>6=!x zqXFG{!`D!Ii__bFuIf7Ekwl~+Cb(s*nLWhMZ)<+LUo_RG>FO5r4+7Gyfi^4*53yS{ zB}EQjIUDDSEPJ4Dd)<_x_sNADG#fg?-3DAE&$GEpDNoAUA{Tc!HCEDenahUeEHB=U zi-oCKEh}b#TiqHR0}|#91`qsHN-B3vs<{SPB=5~!xu59PbWh;uI(uqViH!KUb_Lzi0;3CqwI{OU7zs{WS_(@u5d5wB@>u6=O37w97==M-b1!chb9w|p%fs&H zWD8mcqTWfG#GV8;xjk==!Efa$o`DTHdqpFTyjG)XVHElpPB@ zzY2}alh_i*Knk6yP1KFY6#(GzK%^cc9BjS>5^WtT3Td+Tx#6$m;dXQ7nP7RA2*MP2 z!7TM-I0-kGD|BwWK;N-chlHq%a_uQL}g3>O*Nd08x z;p+_8k(WPrtQ@5om3SKcJJGG6a^^k`mrIOZU+_QGeR)jN;ziFEYlf~cmf-bI6_>V! zW$~THXzdbu$qXLRi!bQOUMN`)A^fCvN#eDeppi@7hEK1LAU1?-gnp=}OF>cL|s2`(j}-K&4o6LOt|x1$!0wJDO}>CxT0<_qD$ z4?ID+$>&_|@TN}cp8+{$%w*m14fG+xr}`E@v!43uHh;KFoG@$UVtH-|=VjM#tk3Xz zb%2jjj;W{bdR-JxBp;x)Zj2uP-rt9KN81j#^=6QJt3k8EXJVvN&t+i4E}p8u_#+Pb z>Ee-XEHmLO&L;|;08WcI$SiMKr!^Fq!TB^&-Qig9$`sD&Echm*75biE*{U=VCp5YY z36;v>O~QB?DjzlEqv5EkE~&2!Z?miy6+RxDtO z)rm3#rvPOZ)%)G7bj*JW5nhXotvPCga^)Ox;1d&Nj_+rD`q}xnmh!J=pC;SX@!GkX z#7{zpk8J0sEQ_G|_^7dP5F@u`Ghm0`IQl+Jt@-%!URKxWOUL!`dC`TLV)v8(`NpU;Ws$s9R%Y*Y)LrmhHWD(qRnzw>x`4mF!emwQ=%=fspefhA3hu(P1AIC7^H1AlwU5mvh8o^sh% zx`!M#zNVa9q~10)@)7|?fu?l&<{J6tj6XSkeCKVaXKSnY!4c(5UCEI`YAqQk!D@a!kH=(a$%idRzF<8IYAf zJcADaxjdoCou+H2a*kYMNJ2M`n!soi!w!}7Wq>-^@r^JMjoZj59;}XW^;r$;8%eeM z$g4MgP=uaGNDyXh!t)t^8o>+kl#MB{bKA7y%B}kBk=4cMkg?3mIRni}^o-wRuWzn-_ggGA@H){|(7eheY$^Wc5BlH&m#`OyZMysb z!T;AR;`nH)?Dsyes4$M(;~(FG^vf!LtC)X$i3cbQO-y2e}M({(&FGhQg_MX^t&y9&O zTc8jAmS_qS@T!3x)#t(ZA=&)4U$dIu2@>Uuc+JbKPg8^pq;EatFrJ=tKS-?i2eV=9 znY0%LkL~op=swP>?idsP;e_Q&@317qff-bD6SNKm_n0u zZn6`=_gu&XwB1VyeoCSFe-&{Tk^1XUU>uOq*uPf~_PdL6`U{ZXr4%(@t0G2l&0fRf zS2=rM{GNH0(6b5l1h4;mho!n03+S`N8=;vQ@!qVQ-vQMuY+RSwyK!9xkWJaEM`>OS zfUibH({e@0!D#id7RGpd@c)mpLYGS>wHBs%;`90dXzDtU_ zW{V>EXl`2wzXfC`ARka~ix(iRL)(2pCLUgB`>BHF4^Fd`c9BI|Y}gSVj&nJ}<5AQO zHODIf>XVPV`?L(h!QC%QVZ<}S$JICG+{%tkQ+dZsypny_RQP{kE?0zZ|HGTglE-;W zfI>3_eem@U*>9&L^gp=TegkEcCBrJgs?bcW7WR|9U; zmX)CCei^Ylvih!f>Cx_+%96U>cYR2_p>}v#{;lH87U-eJ;exl+uyyUc?HWe)B}XvjG2kpkSYhCCvyv02MK6Bg=@bhi6Th zq&6Or5OZb0Z%?j(--lPrM*S2y@ce4o_!q_khoJcC6t(daV=Oj*%(J8cYU9bgm5;?G z#Of5KF(e^&_7>4+c$S!p@ZTzxCm0K;(4#}#mPK+?LMl8cm*%{cRf{3{QEz; z?9HxOi_SD7Ey*wtdM)@?&MiF(3Ul7<`sAWB&03m4X(af(bb-ZwWslV|TZ~0I^{5Q% zVa5XRYWzJSa>ZXMw|Y@|VrzRdq{iD}$HWJJr?0AXv$mP?LIwSb9U>o6(}6(0b+4kZd-wgcbMDx-F>;O z*?xyfd*bafkqZRSqas&~9mfc;B)^uHz0#sE%05z-hqUBJdc8V1rib&Md03Gv?feOq zzfkxYV}IK%6L_xCkQ@%!?+`y)mh8Jl$bIK+DdGH<)miyuvT_s?@J5Ke=lRHZ~26cvQ!m$O#U$Cyv@nwb3Q9R0?E+)x5b&suD2bV zy~upxZI&9CEo8aSs|w9;D=0j74AM7eiFd z?~`HZDk8=Fyh6yRxCA5aB3V~FF6(Y9g)xwW$PyQp#C=-2Tjg)T`PnzT+U{zi{k%|e z$>#Wv^a64A&{cpm@o^1^oL7q1+%*%gloW=NH0~Km$Z^;{l7+IcEmS@)zp2SE;+Ggd zv!*$hzwO+Yo;c%o{QV?rkJ@j!$(C6HJ^F_2hZ;j=7tfU&>;GD}Y?dbBKoCcM%b zTwjc5^%5z45SgVziXL5&KvVb?Js2;>vr?&)e%}6Gmq1gE{ap@8=@;zp%?UI$*x!}; z66YH_P{r@BmsIoLWEZs1o~Cc5)oG&hGH=$mP<8q|eap@IHorRkw!OFiLh~-fD;S#3 z&o+j4Xh#%Xdx`YF^3mq@`q7qMVc?}2%q`H=?ZFc(tB=grs$beL+T6ZlbjPj+NH6V0 zX~A&C$|LJTD_>eT+T7m4+bA!c!c_$|a8;fttUj_JulglG&RIX&-2Q^yZad}`4Ckyo zveCQpr3ItS?b2n@?hwifYM@pQd#aC6n=p^HC#|9Rae5vKCChWQ9yu31VXtOMUMIHN zfAk!mr$?dagIVzlUNLruc>IC|ADoC;@W9PB4;l(3YvLk)om8erjhnBuI~Lp`^zLk) z%HLEMBYiO|M!^tcDIMq|{ustpA0fWzyw_St^3$*Nl>4=`2e1};wX~XBv&iE`dSR}X z_T(bHFi%T+@{nHON6*b(f&mKV=OIn9vlXt&25(t`>PNZ;N@clUyl)?prjNVGV=v9p z)8VsQk9}sYVl?}Z=JcHv|Bv%?k|!#fz7NC>@;CZ|&Yc`EWA;86Wh_wP)zT*wn6j66 zhthaZLX7l+Y8ADuB)bw?`??U4l9XAxb8~$rtm5d(&GnfBP)6cRyfuQ}bq}Xo;O!F% z%=snS#XUf*TSfm0JLVXNZ=RN3m#3xcfW~f+zJMk`FMwaaCu8Rrx*B>^g3sVQ@(LsrVH|jZoipxU?O`_8xA2^LvXa`OZ2sV^SVrp zild>;)D9yd#$xZ-IcXk{5IY5ZcSAyJf9mD(w)s%o?n}5jAK!Ri=6e$Q8&o8BFjmFa z!B|Xvxx9_)wuW$Y=jMjYi{N#R?qlLU9Ie@*Z(4(@;wZsXM`)J{eXtDb$SSXv9{OR| zZ{5%bpMrW@EAO9syy*~QoTH+Z??Z*?bp()@{nHT zx9b7BTCr_6ujfblX8ZdpKhn)`kLydfLbF~xyY<*2!lR0$djE#Z!uvO5PC|W&`Zx{s zrG@ujo$=V;)cdc_oMkLCqJ` zt{(tmD-v?k4Nx%w;yI2_hV+*rua+j=<=@<>wJKnR)x0Ie z&<9IITpxZna#$|DZAe~nTbSE=l5b9;tgxh6ujI0J^H(yjxsgopx4CnCg(%D!QkGQ$ z!GcXPa)d2f-1x`KEOt(=^7U^kE8HYk`6j)so${7&G3FJ#!dPl(j8*Y5UVk*RevG9G zO9DCXOcU3%1&ACH{*R{NKv%GS3jd<|q(f!5=@mRULi&vZr>SkG=5YKc#!{pgy+^iH zcDpJ3p76l=CD8PPESyc<_sFyRuzA@@MKMn(vPn99vkQLWnF?SLKUKU)SLAAGB^T)m zwPsOxb6G(ca;5Co(!~F3Q1%h}t*G)MXa3J`zCy-5>&UpPt`jn@TSEW8tmHE8SuW!e zLdFem)}y~$d8Lf|!m2A}TsP2H^Ozp3o{49}Pll3#>qI*y-Uq&w zlEn8$YSm0UYsV_Gwm%t4l6=}XXTnw?S+)Mdil55;5+YPi_4r-%IeOHoQ*)i-r*AD! zhLZHHJg7&{UQ2VEkcAR7%b|&3ps!lo=}9>;HNw!Nzhd@Xap=+iVk{N6^*~9{2fsE) z#3kN4cRVifvwZv~L&;xVtN5qN(IGqjF^!W=kLj#2$zJ;rjZ>_pAz=xRrFYep{r_~D z{wK%6lq#iMvEONo6)0+~lo6B89w_+COgwu)mKup~U7wBrXOSEZ>(PPTq2y;*3ZF#v zED__2@c*ZkPVB?Uv6*N+|6s%Bsww@|my7;Z+x>-S>d`;a9+8A!rY}g~ zez-1K_)7hNMSI@K$(p^FXpCGnX@$e^%v_cteyNi^>C@7>ZC6jV)3agNEeTthXylzSmLl8h!PHu^lC@-#!ZQ`}BCc-q4JeJbONf=LsFl1(S0n6`^R#q0QC2vtge$8d`6Nd- zfM(TfZpfTe`MgA#8t~{=kSGL0CqqZ%ODoNjaGfPg* z(|+;%`(scQr03Ft^L-e|psReMsob zC@{NZG+ien)-5CUEjMZjPtR>r*7o~Q;P~1et~vfdd|7o!GK(Zc`rW97ie#6J#%d;F z_5Fmg)SrlF$eQ(<8@1=4N2~8zl9BBA29wWBB(vI%AtZdxa;3O)4D*7bRF*@tj(-Ri z@um_lw`J>5Rd8oE~8A^A2F_dlMz z%u*;tK5}0Vz9FOWHVH95^aAbuVm-MKTQHZU-cyPzyJu->eDSKaYC>xt0;(PvW0CFK zw01|d!|$G2(iHDA1HE!h`$0#%!2cN@_r!Lk|dk#(ai_Oz^7(%G%M zUEZtK4sWc_gy+B5u>tat{iDt8VYqzZQWRXEwr(7)m$6)edW2{Wqt$JM$NFL{yEJ}A z=C7O@i)tM*OBLwRr?PAfMfmy(x(GkWEUmC(!8qlYu80c*=RAw!Wv`5W$)-!lf-a5c ztJ)4^(dKhDZT@3s?)GZ_0G~77a|98-)IM>hzAGK+- ze6((v7J^wU@fhi~du1u74*qf4EXtzI3vSe&haT1LTAFcUZyaPS&?0A+s+CFvcDp%2!VAM9vBcvt<#^33HiF6Szq7@Sc5GaisYiHM%f|A|yIC(a{e4J6M7MKPuPVl~tv|1^NM7;1@#;!`=HCjv!@MKx)C zkjq}1Dt{--Oo;as+%K(~(y)l3>Abro+2!~m9bM=Z`%Tbfx%RKTPv`yAMMWOx8`*UF zW!o0JpeQEi9S;lMLGsu;CS>t*+qCvKYVdZCg4kU%@nnfoo*Y(6%z<~d9^3BGqYD=a zy?#JO|G#T8kBNWK!_Tgtthv2B`KETIPQSTY_|2<}@g$Fj_VDC*Xx(1K3WF^5ZiAEz zE1E_0UZZH%3gGQ}GzpS5)~O*@4v@bLnxGDp7F6 zskcu-Y^Xs>e#?h+R{_$^GDfOZ;q&+%V}YwTH)Q7L=;_s)@5`uAk32Qny6ff~J>80u zUKd z>sulR13&L3K0e>sV}B>j?Hc;qG`DzKn)}JP9dKTeOrkBPf1)SnTr{I7W|Mel-!~v@ zR^K+QeFN9+@HXKNc{@8uo_HtWcxQ(SeXtAuksUH(9!0a>RHP%a9dn3(R}rg$#BuC= zt8fXNe%bLcP7|}#y}2RtGoPOR_~wn7C*V2qv(YDZz3J1_kHdXr!R5zyy#?vWBFTNE zXY+jSkJEtI@WQT+!?SdfT}i6fFnUYdo3lh4@8w(C$R;?kd3~mP^ZLvSPY6S;_06cgW7`goxhpJ-gm7Y<~616|s2*?yeeQDNV9@ z6Tdg+Hz(ul`Dgz8hR9zqnGUkwa;c^hhxy!i%p`Dp4JoR*`47S-dHWB1tbV_(*Z=$v zlka?F!}dJa!-_`sNQgOS8wiLvL*gz;iG3e9VE)sX@Ta`z=?ebAj#=j9`QPUj`4=YZ z%n&iy>>TLF6~%n3Sj0qf?i&+*I`33qziS|R{l*`squ;4}!pX0$m{0k|J^a76CmtG` zuFt8slFg)_zaNb_xnb5{WT_!!mQIJWr>Di)=F2w$6l)qu! z@lY@EdoKK(tN0R288RAQln`69g4?{DZ`Z_-tiGC`e?AG6Cm&g1zgKbce`vCChOxi_ z+27bVXao(J)7|)4*#$p;TNde;{c8k{3(Z9rS!#fqM7?FaFs0 z-OEDrWzp&0nal(vnISU_(aZ!?W<;ry@DL~`2}qb|g~_y9)G|q^0-Oq)iWB!&KxgM-TU9-m2b-s={e~y=-D6VFSm%% z)(lY%Wk3|=e5L>u>kSZm-6yJ#SRnelRV(XUAO%LEP8IAGwFcaC+bM3waFmrxg!&h8 zJ}%=$^^66g=Xg<#XFzlrKdQE~Z(K8#MR6jx@IZBM1J74Hp_1UX+t{B@|>P(4U-c2v~78)hX-M2LDj-K5Af@@X=~;`330s1(|PJ+F@%}Q0u!W{R}0Tx zb&$w!EPbRWA4b-?0cvAQr}iuaIJP$jBJHMzjUE`OoSodTv4!W>?HFW>^UCQyeP&R8 zF^-K1>a#a3Fh2)vA6zdjVzj!)RQav|!GkL8=k3R8sBUGkuaieoJfPfUy?VFir#@|JaGmVK zjA6Rwbpxv}G|-0l_da>IEA~r6*$@BOZw?NPgUKn!j<7Xj(b4{E#2h*JF>;A7s zB3G|UX{s(8?BD0FmI5%WpRfDr`cpa7*Ijm?kFdQ>s0^Yi^+gPErs{^s;tP!K`!6uMaZL%8C49N7-F?2?r#%9;uujVKUrxgy~pu7&LEO4G}$$;midh zH>NRc!y1qR_6zKcM9)u7yFlcITOg{g;UZ|qU*ALIcqd2ka75%C%F~<19(+Hg?_HMD za+%_-IFui$MCLC+`e?HhI49VZg0#QOd7XB8x`0c1)!2vUQ3#OMzQ$Q1906O;;)QQ(hnTBHAV?IzG@S8tb9? zL-s8BlE@*0mM0HT`F;xX-_rB)RVg&?*{RYvDvHDB31^oa!L^jv+jI5hR-yj?KH6&9 z9(A=(jB-^g>lOmg*sLia1y*N3)C6E>x?q%|ug`xuLu5%Mv?g8P2$A*i@0ioy*AwR; z_+loT+Z;$6?z=$b_q6l)j|p+CF|ztz)r&nn9yh}WbprFjvzQ#GZ}8go-VinuM{Sxo zK#b7==eqz;Ju@B-5(AzqA1Jgq~fNi_uLHS8Qpz%3>$8}P$E58f~^~*SDQF}E%BtSEZzt5z; zVv%FAaFymazEaIWZ0o*&KyyGEv2BXYYg0HvWc^$B2G}{n-+53k4YG^5zIqr9Jw)cS zAf4l+Ktb9z7sYPmAee0yPn~u&xNujpqs z8a|WHetT@nGpn*of*0u7ZOhpUtj5YUDv@z+{2~LQ4__cuFHi0vGG}1^znd-+`TZgB zHFynQ!{9qB2tK{$CI1DH_gW$MAP<$BR;{e-+?`julZRj_&(*q3(2@h9S_YsVG(x3h zp>&g+e~Xks0W8brIZT6oHS7_O9ORp22?^S1U(W&$|Z=P&ApoEYEg&H z22nLYO6^vFlU;&g=OT)=RI~A*5pE8dAUNAF;J!h-Z-JXbMhMO}54dmE?hl8XLn#oP zoi^Zp8oR$Y18xrC{$8W$3ql;&zgYk~7XqAQbTl9xm2QFcweOxmyJvw)k!StxyJyz! z4TnmU4O%Z3fPNS6<2~eu1POjLCHrEMUk#CD8r<|5zUSaT-_@Apyp-3P8UQMjY)Ri4A;qW5d-5Ji z_hZuBT}OkfL4eATvuL@8gWzlq@`lFId+&u+pA$#*bf`SeL-6N(rgaf-x8mNeljfSU zJiQ1Z@*BMUhVD@iY~*d$4uLNQuvyh&Si1y6 zafguN3stYIi%$mCy=z)+CmmxW^&>N!gi%WO3W#<+4$)W7(Og>kyeL3zyWmoAueI7( zXT|sb{Tz|2$3UgiA`b3Jl9LaXajgYm`1To;=M%f zpg3>#;x)!PE6vrKDXO3L68T<$T)P!=L#tNSWq}kh3Q&u*cM79@&+$nANE*+d!s6co zhh~EMI3e;i0QT%OHvcF+BcM{JM?_l9Q0ci$f=Elw2h(cxe9r$Gf|lz5>_|uRFh&Qb z(a|9Q&4I!1<98eEL_S1wP)GYZlEyljwh$q5$K$s(bqjVMKFjzq+85tFvG#|A$UchG zHke0pFOl0BT|T6%L*r3I<59ht(KcP9?KQgZ>fg7=hG^qY8ZH|0l-Ahcp%(k|{sAH< z_u;(*jBccJ`vD?%3N~K{$^^BmM=ChKnP0@_n@;1hor*p-48$ z(nQ(0h05A!Un9>)P&PZYJmI2VBJ;cyD1gz$1z;}@6{3A-x6T5v4@LX#%S2wp+lv|P zqxx{d-@VMR>DwpjbCW&)#t_fHJ;ZaZL+}J`Oq@%hRU(yX?4Lf*uN#5mlc~ffi|U~{ zpqBS0`g>>&!x_+@#dnvl;%p0giCit%D;AmRiXS!B6*qpk)`ica{oH7TJfshK+DUVr zoyzx6PZ?dsaihzMYeeI2cP+~JDjSg*Hi^Th=a~mS(`xTji&4BTSs)j699uVeW&LMt zell!Khc8|zs+*`D;FQA8lIN$RZ+`xL_r%&w+Wc((AI#4?s1K=spFF4=`O(F3ezXytFUjAY2OY_1obu>k*jAyrS$2Y%ZKq0JTy_neR*KPRWTRxuXJ<0YbLnpnQ(lX zs6NWOiWdp4V*G}le{Lc~evRcZ``Esi$q;_$#mhu~g%C%z;Hp@gv0!=rWpc%KzPe20 zEt(uKe-Wpg|CH&Hm#Hp^_UV#bEzaiq+WBV#50%fm#N~R>O#v z``DlIb3_);(LKDng?AQXf7bHO;&yuG>-60(i0ZOlA|pR=U1?k;)_qQh!xPS??UmsB zXA zxy%UjY0RJi!Ocdd6VP721MgX&QsN=F*`i%9fXE!YJ{&4z90WHH*RGdAB>xj4FT;Ht zy*}7BpZW=ryOZql#Cg^0O@{;n)rWmGoIwhl5e&+*v^JLk67`(V;a;>4f10PZ2F@Sr zWg??3;`(4>ZOiV7wFi5l@(BTg&+ML5i_diRVGrAtE~42kTFr6P#gEu331?_h}t&VcYeo@s{JELw9DEYrTlJ)?|=D;er=R;NULkJ z5QM(i{;}cm9z%FcPq_giEXU^6fpy~)cM|qMo~C1_fT*&4jG$b+0o2!R@ZqFP_;BwR ztR6xFW5}jFbB4v5#P1Zf@kpGU*P9+Z<${d)|j0ow~%SpAz)kOKd9mc=#J(RdA~Ql^~|JcnbmnTy~a z^||3NpQH2(N*JU-!HJb^Q-{Ha1+j*WKS?L@R^D0h21tRH=YH$rDCXnH;+EksAD@F= zd9}Yso(X(};j1})39Jw^^&OF7P#^q+VHV+iTx0ZS2tHHHFzm`dA+iG;R)%*opdIa* z1)tEk8Cv)BCj!tK={dsK2q&O@;q>ul&$GJEIKsZ^!}~ghOF2k^+D~ZwX*1!WvNYp2 zG>!=Qavve`YAu%a-_H{H8M`bSnU!5IYCiV3XWfEnz)dn9< z9w3_x&oCj6rx-3ouHHt+U4t<`uTLj3jx&$)M(yrViY}MQb!!S@5V^c!=L^rBBMw*L zwUKiun`1aCn@^r1a{LmLP4P{LtUHw~nn7KD*faV4&|IbkQN1p$om&ngq7>?K1XNbI#%D+QtK-+YA zsOJssOc{TRXmbi~-?!29)BQ}o5;TF2%FWYr)U_j|jh_(W(C_84ybM|knAOGm_ixqv zKi6UaUbDf6eRFGB3d56oDlxahyr{Yc&abBi&#ya2FumVVFnE4Zd`?a87f4*>@`^n# z>^Mst7Yelb)yd}9t0$A@*BUPJx0C&KfAy(>^Q*t^HxD(xp8CI>U({ya)3*l19c&H2 z`SsOlHox>WK%ZZpULtpO@{z5>q4K#5n9r@jHNc?!PMbp)I)wW4%d_#R02DB@?(B&`{xh*xQtt$#5$9epje z>G)ls9<2sd(b~m#j}_B8oYwec7Vq>`iKtq^s<^Ag4QnXY%rNC%0!?~b_>E&4ACBL} z`hacWyG|jE((#`F#k4O3n(n>|)brJ#ez1?ozZIaE`XHu>YP=fx%D(yK98tyhj@~J% z4zSRD{9Ptc=UPEUU8H~eANy#GXR*6Fv_bp^nrK@Z{ubq-_T0H@Q2)M<$RI#5%`p*@ zbr(ORp7`@V8iV1}bwTp8sEc%+B^sdlVA7h6a{RN)i8XuMX(Er))@=VE9X0f~Z`;>j zN1Yp>qdrg4QIoV9d(@Uqs?Vk4vnSgCr!@?TWc~E8MT}DYw6MQ^I(3r9q9^pz!XeiG ztB8!cNw-TA>pnZbC=mGwv(b0Gu=xzrO=nRzZRV+Ndg=s`L9s-ahIl-GLK24a7;3lZ6F2SIYny{HMePc z=?#62yhP+07tB9j&PAMWCf5Dq4hS~5pfaYd`>Q!^-FGF{{rK+O+MeM=#x=CPTBNmx z(YEtQpunY2Tl*SwQ~MY`a#rBzS^gNL-vE_h5ES=X=m}{$q_hC{bWHZxy3Z-E@5MFS zq2Zg@ls7ecTlO+P2>o3^k6Y)R}86O}bt1$Gy}iWu=&Qg>1gzcc3b?AwGxAV?dh)?c)ieina^ROG@)(k>Nw* zoWF<7&vnV|&D5SxYL^gmlWyk_Vrg2XJ&(`gJM@`qOA}WmZa^9+Kati#tu1`-9#DU# ze`kWIQoa;oA2ps#OybGpB%Vx5;>pY_^W@pRL~frcs??8{M3Wo&Fo*RAY2fgE9CIPH z@7?u`u40`gd>{MCRfRU-v%0+(C#iHzkoFRJ4G+cDxZf~9u$>zqGEB)=Sk(&MW>Y#jScT&CfXA<_;E4qH`zt6TS zzvV^s^%H%%?UkXhdr`NY79+)>61*iJ*?@r9FEm*d+Q>R zx8=b6^Mzc*DR6zdEzJnQgE>$MoD|smoaD-(X91bTdvlU?+oalU!-yQef$fv{OLN;= zjF9d&h-$$BP;%Bn&(<8M%qJuWm*!HP!2B_GMamJ?F`N_tx41#dVYz6J|C7i$!{C(y z7)#^o@P0wa9El4K<&A$bp44Q>8}V7B|2G$@pN!$1pCs~&w4S0<*)>2u@pq#QUIFo1 ziY=r64Ke8dTjKiv7Ww|aL5S!vOYH*ml|`k$1ml@(`6x|#sQH2es&jvc^o2H-mk`-AcT zytMzF3^TJiE^xkff%laG!;hf&C}yaXI0)+bR*TG{x|U+YFl?GKgQ%juNzUQIXF3Ey zIUyJnJ!gvX`PD%7KcvB@`|sPIf@r5BwdwV5h%Aj}@pwgFuz0m?UnJ_U{o@NF ztJ)a7{)LWTZBtsmNYrI(!RHIv^MCt7JG&8V%3r=}Jmon*VM%OR!JJUq<@v}N^)lj&WJG4B$OzOXU{sfWT zmq;`I?Ez`er)ji)ST4IiTKPTRr*#TOQ~cOHc>e;)#ozXCC>A2E^RoOK=7)-@B#+f0 z$)abNOHnQb$YtwLmaknHr36!f>h^ zu5Ug_d-kP4edr9yy_AvMZbrRWq ziqL$i^lyk9GwYbrcIDDnL>A4EOV3+tAxd>}tr%?(pn_sQ^AIdRKA#}XgKMeTmFrIv zS^S2zeSyvUJiP{g?g{GWZFz_g$IWQ}em!&>nWrg^bgoX*zOS@#5$sC0raPQGs~3xM zaJPoT-=8NVmBufL9RHGC->2!69#ezMX@d0louWD!q<|A3`aMD%*herx`kPu!7St#4 zVp{Ju&`~W$1wv%$2+57J+NSC8YKX2U#DQ`&ZwRc{GlJktUZ0cViGAm^nn`qhp1{^; z?kkGX!0f577_B#^vGwciuW5bRXrvTX9SISWa2wt`lIe%c>VBcD~ z{e?e%O&qyAmAmGwQ*u zggEfq@3Q|XRvzvxXM(%3{}>zl@}KqG^h9k^RttLiFnFbF4ye0$2+lM><#+=GZ@h)C zr|Y~sH_|>r3P^8GjNE;TmT$zcKxoY8m$&p`fedjT%l2@%PQ`x;QNqK?w=5#X+}xT8 zmCt`#xEweLW@z7PPnQDty>5zK#4wS5_vXY%SqAFAQ3}B7Ju#P1--CSMpv7 zZKP3(PV0nQ24jJs47_}R>G<{A^uIj zHp~dYt*f9iw4yA$Xhm5#=fl|-el0*ySWy-(2d*|`erqGFH#~dJ40$xx-O=E>4dr)* z7>!pz^m8pI6=k&e8+w*Z^Qv+I?4>KpsGN381T|fgQ#T zKG!)B)b^R6;=Zb@1k}fmvwafM+c{BG-2k;6#iH6(BC6RS9P7Bi^3dv-%9 z8%@?kzJgujYnoOc!hM{`G`1L|J!K&6@r+naYc>i72?Fa)4w8#=L9>ejSt$P< zBsX5J&5Lq~#(yeC+sm1)ReFg83#kr&eMszzWZm6^Yx5XTRUt*m|BUWSnhyz}up0VK zO$IZmZqn<;Jkp!UFBLxYx0Xd&~TzUR*cm><>{B~UADXlH(5~2I4GlV#vF-ZZ6C%gEUJ)W_9H+s?_ z1Az0PeZ;-#q4BEtzNEdI-%EmfGhqI~47eHpMjFoNz()taC6DBtH;LT7naFM)nonzW z;PqUL)-7nKG5KvFiE-b*naF2tG#+74Er1IH^6w^Q!iiE}ezcT>Je2LwbB0K%kBb`2 z(jHuEI|YMMfa~Q5h;Y2LXTo2IjL)35iYi`9#M-cU(e{a;dNgbaZLg@slqYZ1BD=4YA2kAk<*7uj z=ArV~a0sFv4eiKZE)9p^&#!^>X~W=^D#zr=c>$D`Rf4Tu$WqEuq(C#p$gwK{r%;dk z(hv_VhbHj#aUo0DltOb>UMW~KIglQ6W3};))?U*$_`Q%rLcrw)I=QSE` zyg-5rO;EY*A_-n+f{)_aw1&~1ERZtLhH9V2VlI$&Tw@N+1oao%yN70q>Ww`l*q;5y z)OdEmRF3PJv>c#0ws`pzcg3w!7MLKim3L80$nB`RpNGoD0Ku6Rw@y*<_w8KekzNv< zUUBP`v$%#BVLtK{+}m8(SDa7Szc&cW$HzXS3|CKJJkL*KW8>Dw2ket0FHA_-uh`bK z@9^~xCu(#IVZXjND37Es)_Dx5?Hsg}Ptfe-MUx{1SrDm7mjd`r{NDNre0}}^nYiXV zeEkEoHaz&m5n}X=z$+35x$_6KJ8UtUlIHyB&4H>EDnEUj2TmhsEDFWY4zavlqyuSCXzBI7(zVPbR%ch~p5ed+MWg0w~r2=hN_s0^537{Qx7aF~d_H zCf|>K%Y7WLzxH0aeG#NU)3>~j_cyWoiuRt4n-sX6@`pn^b`M??=(({JxQz^cUZiK; zgP+Iiw-VyO{U^)O{4=WwOLaNW_(NS6_u=Gk78w4~W<%t{WhZMS&DXcj5!Ka>$&vDLDC?QZG>1Uz>2PLg&u_jt zc^*XK!f0jF7%5PF6O-djnvTktz}I7c-q&irF+BjUc)EnhZ|>%4op^!mLz?4td}Op) z3ZTv3`Dch$gT10qfFR2?v9o;Y<1DVDv+lMgcHK$$DmQ+{Y>_jL2G`#Raol)QVy+== zNMq?(DR7rYA9t0u|G$Z^->=cuF1RQyyjj|FKP1)=z19J~_p=3jy`+-d_F`6t3ioU6 z-{)z4K)vQ3pC;`&@O{2s#A~&4s84AB_xbwR`9xhV{6^dN`Fc0KHnOjM#}D{==^V-J z{IeKc%L~N~z*WWy#?-ET`dL?pVDM$b$YZOu`VU)q?%10ELA-{0zD-*FhXM`565H*x z*}PLtMDDbec+0_HRffQ;ORN{4Fn@;u?i`G>4le_6FW+;7$e}Wb=z0Ek9btACFHqaL z54#|D7`#$HdXGk#k<%J%93)WNHaUb==2+Ls8*nLb+*`e9vsXFv1fH|_7ky2zmCv-_`%b#a!S z)7yP#zofb88g7xJuSPA-`?61Id~DwFLHjjMIo+@JzJcO2CD$La?kDmy6t8rovSvTS z5vkXHSMS%)GDa#@`}G=FBb7(?YiA;9(5%;j9Cw7sjeO4}r0LudwD%pXuIQH(f42{p zWcL1{^Ck4PAD^Ll6-W#9kvM33;akM0b47MZwg45*&5|oL32km?MI0c=FbbS>{l;a-)IP@KW?Xf3}O+4Zj5`(2xO9JvQ#(VIoT$^2o0I*Ae<&UR=YV zE!FT}^gN4L21G{y*wNPT@DTiJyr%!|okHu*Y|`zqv?-Cy8#NuR)d_F9k=dNc%cJ{< z{5)MR6LmxWzKh}>!`~u0-F%J(6lId^9{aU_{$@S@d{V`m2?7K4VR~`ox zOKB@_Kenw8`)j1a8K53|N$we~ems+RR;v=%g(7YLcw`{{*J&c38ZtNDpy+1=8Xl^S z&*1y~C_N+SkEN6}_eN^{r~xT(>Ijk1UgW4v!?1{V_7J&K!=BOo{ueH?bBN;rL7Iys z*yuS_o{{z|ubbsE()aU03j9ZpmZz7L%c%Pf;zEk=9L{0d7n71)cld%}pnKA+D$W)c zOiFh(L_0^Dn;hC$JiRYbbNz{Zx?N&Z*6mB2Pd>gcah|z$U*gQOW}jZa*QTu6N6*EY zalC(Lgl2tSJb9GJv<6-wt5ds(V}3_ACN6C*j8-;x5;<;yW_I1tcb@i#PU?4TPCU1UG^dxDLP$nQ#Ke%~HQOjANEn@e&U~{n{soiM(2XVzleHOgP~gH%r~gF(J)BqV?x}4uYdDkrtL8 z$ztGmkODVcCbD>uj`oDD&8FS4Udp#rD0 z*$-T^99v;}u>1GH`(a?j$!oF&*;d|!b>*yxL<4~CU7wjZ_H{zs_AJ#VtK$`<_JL-c zR}>9T)p`aGO`gm~=GfXxp=@4Jq0(oZ8Z@bNnPf!pB5xyy>HSv4FZBv12`RAR$DBjr zU5Xc7J?)A)Ie$+&%~pmj2zY205VCb*Z(skuUu)CL^!b+e#$g`aoH{yLA(dr(K*{Sw z#rl2AxUgc9itLG>`2BKajI81|Ed3`P%thTgjZY10N^AxI1SPLW?Vx@*`3YA72cA8jf-e%tT^{%z_ zWP99)Qyj9QrS%DX`&$^dSY$2}xmyJBzT)SAM5LbehEluxJC&ZQ)@5DG4$@t9D{ zz~%)FE8?KQGY(GH!s;6Ul#vsEg|mE)PR8SR=74riua5b$nGe;qMukY*fC4e7&Zw+3 z^KSJzRi7j@Gqi1g_dOD9%r*+a>DEHGW%gPG%xPGyxOlF1TUFQ510Jwp)Uc1)G79du zu)1kP(gme~)aXASgji2UXnjX07-_DQ^9v-OGl}u@vA+GlIe|ve(`>Xv6|$>VuSzuS z^GyYk|D*W094E74A-BFPfLO$yLMQ4YnM$J!OD_5Uodn;vFMFsFDF57C#30+qY`k-YQ`nDc6 z{n_DHgHX9Y=>tYd_q3Z3!#K)KUm4>$Jc3Zl$Gg}#ZNHZvlaNRjVKTC-N4*$-Mv(D? ziH4AW6}T`z&CqgF8QjRc8-{3Fz&fBmD0E%?!OfT=IU`%`f?CGwsMtr78p>&qKo7l0 zuN>@y4wIT1keYsdyIk!W5KRsAKYI?X=$>46*tp)zHDY~CaP?hO?&e+4&;@oPn7;Cx zrK6Dkxs&2cg8#vOK?5c!*{SC&sP^DcPt`DUIDdy)Ff$94e3tdBzmU$)+A6Kd8f%VJ zQS*Ir#)QhTzo6RRl{@{%{m0shY8s8HG(L$H2vCCc6 z$A7f!jyLWOR!+42u=WJDC|OZmJe{Ib3L);XeFK6YYW(;3FJAIa%=Ofm_Jz)ljxkOx za}jYFukvENo7-%s7kothJFCa=*m{wV?#EQ@qSNJ;Jap< zg5gFlDgFq%Lm?G-M;Q?Li^+BiD5JqlBJb;+$sAerZKUcgQ+;ff4X3Nm5{Tx^J0YCA zJnq2-E25lsT>hl{*aam?aP-41<)-tfx7iHXLq@mb?WR!7dblzy8J*ffoScr+FJ>I! zs~x!f2${R9^kqS~uyKX-2?(6FnFABK+=?}NU!hASTBQIJA0N%!hi`bzPCo1MkVJ*^Pp>K`Z<^Z98b5l@Q^u+ zg%lz`Zt}%qm5(eWlZ6V%lV!L_J@0P!)*EZl=kGY)ZB21KgNxkRh+9I6Qy6gY9TJD{ zm>(d&k-=20yg_>fKpww{9GJvXzw3{Lvn*$G5aZnZ5$_MCo?sZ_XJeR&fqBUFdxgLU zisppzTLD;yjT+a7I&iH10P*qhL?R;CLqt&TM0MO5A4c@4EujB?Lq%F{c$TQ&rr4qt zzi$zK$vTp{pmF^$jdv0wlz33F6SLzEL=<`+ev03ib*2_kcS^J z!@4%dMNjiNcu3Y%0`Kq0UQ``-=M2s<8baNr#G?xJ(6*&7cUvO*#y=JJ!9_Lzs1 z?B%5|1+=!0bi9*6EnGsfxJTCy#4AduN?cI9BTdVl3OoL!;~PKm^P0!!VFy>kL05dl z55Z&k*?rS>ar4XH+mgo%fcgcyDUges-l)(id!bNgs&e4dEnx3%rK1XXNrr7Pl2VCOs`9L_>bJD{hgEt0)*-0Ks#Ydv~ z^kK15Cm;72#4Q72FkOtqhSZmcg;~}l3I4Im3Sb_~7dII}O*@6arwuhuRa(DiJur8H z|Lk2D+*UwFlG0hG#W3YH1-qkl*yCH?=)T;UUwyjulKdzu4Q@-jHtJe@dfjWH7&qOV zs{T5k)GwuUrg0w>q`spEc$)itXe=M_hlTaC!D^rT$|>TXi1elS=TZktV4`vmoRyH9 z#m7!qtscZkSPlMZLVWQf1y$m-{46}NpkMh<5(7EaA|PzV$ex6M8FpWt_%)M9NZy*W zH=9`%;II-3M+smI8%XnfNv~JC*jpaVkC4 z>#+CFGd1{W^~IE7aMH0AeLC6bC)3-cN{p(fjdnIa;t}?Hi>mV`lLqnN>_XH=;qpt-Z)mM!@UJ>D>!XIjwp9>hj&vJ=5W~=p#t3Oo#r@(d`;s3tw z(G>I0?I4%8wB#dp*p6FFTAXA|E!Y&L5>qsP46t=m=^u+X=fFQhyGd{HpEY?VJ?(7y zhWs~h5$WeuCz7k{N!gOwh=0zQ^6vuxGqzd5#K z;MBc-uQU)wJ}k>q(5(K0h~;l9zEEmm)|{!^o9AgQH2$h<{?t`p(jkqjR#6%ZT{5;b zZtO_l`;*9n>l^QR^VO53i%1XC8B(-c!2QeeicB@2YIUf^Ykrow#MDSGP_`6X{w?1q z8|cIKgq~QV=1#ok8_O2i>8nQW=s`Ga?<%IK_5`J-7{_8+yMFMh*6M3*#W0mA`MShe zAseq@rjC}UK;Xy5h@ldNaZ=yr=z+~it8^=U3tna$w-qK;_r7gmH6j)^_pOa!R9e;- zW;XXj3XrT?`ZpnFc0aNHtr3uF0x+U>gD+lT^_34jlShO=VdC{B9hh-Q!9wyOGkM=J4=375Sk-+S?BhS&SGX% z-q|ZW#q7nxQ&BnT(TInf6hlFK_7!9_XT}e;v+aY1lvDH?Y<0zE>Ie=ciMx+;2&!3t zRQ<7*TS8PnaZ!R|rph=#Jo5gO^8|Bga>-B}tgD2gN5dbL5*iP;b`~*e)QQG&!cF>A z*BS3e9xwlk8iNT{M%i(Sd_Sq}`*(>Ip;9`Bl&oo_>Cc1-9ytrXljw!*6EpdJyt zpLZKPyk);=#yMONISaedB8nEy6T>^2DNar`rV=ffMNJ}Eyu^Q@E2!QsSGyEO5Bp1* zgKIq9G|4aP)?X08?PW-H`+xMd?t42FcV6tA1MuwpDx^0oC;H>&JgjNwhSZiDkg29q zF(ap*-2)jg-?MRF=yCFEp>82KG4?PX1JcXNJ(R)ZmO!}{Fwj~_*({#2);xb zsSssBXJ;MPE+^CQw~aO$0g~b&8s0?nQtGB}jc4?K568MA(=gIykE9a^4rpB)UuRjg zT?ODYG9%g3l6+s#gjsA|EbdP$CRk}zP<>k6wW4VRI;fsONQ#uQgH6my^QDq1?rBi* z$7}~~w=36N?E9~PxnJ^wUu|ek>iN#Ij&I&K2HA6yfnxRcxm4J(DW3FBw~U8;epNw7 zH!BdN?6T}AM$#JuzS*PM#FNElP823kG2y{lVf>HRbYESXy{zT=JWhP z28&-p=J*-EljnHmo%69cHFTh_M|B52*R)6<1a^s~^253iYT-OY(LcXm_t5*|oOdhU z>b`;ZVhhn++GYLovc^RG_CY-1EL!#KYl85K%Al?8;o(|AR=dhXz>5&dV%tFi!{Ypi zzTg6((sxnr@_cU~V7YBDu23#~(N7&g=oG6y*#Qyy3T3C9YDkGZ-lH4s=pujCz4bc$iT1Zw1 zQB$26nLw$ff3S7Qs~lz5Ap`($E8sUgqGr6mDiv>u*%U$l;0KAw=t+=&cMl&K)$Zvb z7y8cbBUAUfBCsoLAoOL}jm^txgsrb#-08&Ko3b)>%Vrz_`&FBEvQvkkpFOs7x{eK5 zRLIq$Hoq3VV~#Y6$%}Wt3?8qf^USyihxixL6EqVf(-q**Qq~w=es#^uX|&YK>eer( z{`UviU#nlCLC^@{yt)q?*s{Fscj%RW9P`K9wS2DAx14Oo4QI4b=wqT~#m#K)dmnJ1uoY>n!QCab`AHe(?)mwr)%ABqu8YQx_KSA|D zj=ysfEfg}u3hA3I@fjbA*OiPtT(04_yQNiZc=EF)hQ=HB(bH7#=^fLSIKo+FM;p;Y zdv@NO-|!YoDEzq{L)qdkG?#+&icImWVnkU5NYO(SZ?AB2a9m zA91phgi`HnhP|J~VGdOMorGFSs(F37sr32S zOv?Mikj3~@$b%Qso@RuSRVIuXA>JDh8c22m>0QmIcOm|yyJ}%#m4y8M3yem5gslGA z@-fb${nRTqL3{exH`b1E+-cU~duc-ahR$)^9O|KVA}7gtgdtlh-zP6hYw(*|pZ{x! z)^>4l>RPGsH7h9}3^#9Gzwjd73asmwKNl;whK1^2@_%e%h+NTkrxf>Rp%=kZ=cK_* zjqr#$H)`}Gg|3i@t>G;0#mo;*g$+kZWp_53esC{>OhEHZ|e*SVeZ&ZVMNybfxo zteuJJ@B`TJaBuF8oagYi)z6L?+;z|?0c@O`F-5oVhHI=Zqi8C17x1c*rK-v^vwGV`-U5xL1x;Gs=gyEK=-Ew^HOXp-Cj;!!uR>(~Q_u|Z?=7sLj&`KSU;WGmlGm_;+;ns_}1GFJ?UOF-1O@)J93+t?;ZR2!|xt%*5MZ?}2I*OOU zh7Il;vb7$z8HYnR=fF~7Qf<9;{jl?sKXO4$R}c{n^5>WUy=aCgzcQBn?wT$USEo70 zEqI}2-`?MYD}ZeO-kHb!{?gInMzQC&)Vrqob}`4$(P4u-8=hH+rRyyKT1%RFUjXPo zQ~_{|7wSG*;~(1tWVMf7_8hW1^}_i5?&}-@N}qjQdJiu|w8KjL<|K^vu|??Ak+r_X zgrm6S=TYNrS!NTu@n#c^_5{132GH739?CY(y7|SsXx2ZT;k|lKL-r1H5V|N zc{$ZqRAsD>H&g&de-E6L2wFwGlw&pOA?N-@Y9g3!if{XnrL)(?KEvl`i|^`~n?~30 zCo>Ejovwdu9_3u50h~$lmTfBKTGQLxZ`$l}@a)!Vys;YI^3N7TOy;6lpi z?cTYtNSll#_w;b3C6LVJeVuldSJWgod;vG>Acu?pAAdjfqcE`!%7Z_fIWFFR_wZ2&0bC>ZC{T~@HW&}1apwx^OmfNWh(RM29tPHxu00v9wL^rtrAnDzq%?^#ald-D?=P1M%JW zN$PbvKvNitgGrz56-K1J1VHD45`{@tad$GjxR4t1%4C7{+T!|F4HKEWyY_i&5@bnW6;d4JB}*je~FE&rO?LoQE2VXcxZ{}m)bytU-Ucx zG^Ojwt9Y8T@O>U^eY=MAt`cwP(>;!B za+~zoRdlNBe2LYm#F%vj06*F^I?|Q(9C%n8}vr;(%sQWi^{H@Zzokwa24i;$m7Yiz8NnO zutS9gqv(oJ{GYW(nPvU6?(cm2gP#w(@$wYei-X>XUZR6N-RS$H73 zfTUv!&3r1MSR(jyO0#^adx~!-MNL?0qx;5`u5ACcs0OdYvOA(pguFoMW6G)j;~}Dg ztL0N>{X4U%+we#K^x7Z@;EDgUe-<9wt|{07m;RT$er!V>M4oo%(N}Te&)N%R62mkc zH{BzGA}b*(@nqFk%Vn&ump6dgTE$9aq2eL)H5$COXXElr<8J6X ztQKG*PxCV6}`D{ps4*_ZL<8iI|dGX)s7PndZWu)D?Xoo(M~Q z?cDq;s)BRQ6+f^FcRp!f36KL^%m_JRLy}x??v|r1>CN6W*AGym$YeVpqf=LZ6?Q%ZAY&`3$wmW1=SlPK>bkNEp7C|7t`%wZDSV|C-CQALsFidx+@da@u9VVtY_Q4v&&E%2KGE#%zJhu_h=fz`1 zh`3{86p;RJ|h;{4r% zASl0HOdgM2)(d5A8X--Z{DX9!D+;gRvvV#)Zh!Qof%(b2RV2elYH-Cq-l1e1`B+s3 zwoe>|1FLnX3BynF=4#A;x^elSaTfTp>S5AMs?utc{1uTZYz z4z`Cklv?v*mJo_In<2!{kntUC8Cp*Iax@D6R3ei`T$<7^6j+Vl3~?^;ABPf8agn>S znGv3#FTS+iIsYb~D$(Tp87Qb781(0-+&tmSP9u>pndTKWMhNb9k=5U6qd)Kx4=~rl zKCA-YVHJYk%1MTu!?8J65H= zmr~p!w*xagU+VC@ern%e%PB0$rfFak=1Cp|PRADzBh}iVcpgXW*gRn8-ywRVFQbBV zY&+(`1@h6$Ng-2)0vzi~w@Pv#O*%AIuNn2Lvn-Xy-y71nl{Phj)+Q2uWE zrr&b6#JY3ZKS9T)X#5j#A9N=}8mq)~Q<}dXwkY5@NHX3@>nuwosOXG z34_4KeuII>Owmcg-0Vi}9Ag}>h)0{Sty9N5cC{+ie+zkB+Kayh^SEwk^u`L!O{5y@ zteIH*_r_H^o?=95Xd$hAI&mqQACBuHUO?^hD8TLdO4L}bu7}imI(qMx35yfAT0d1+ zTx|%EJ>SUFR`2D}%vg0zEXTovQwNS|oiKV7a`D}qhld5j69}%kM8}_4{L44=N3=Db zy|Im?G+p|`X1r!NK-7!NuAjPzTCHpQmbE?)GYdgrRr66hmT;QC(MG2X3#Q^bqZT(E z>1u@t-Un;4eNwF~_tC;PFjC&RJy9bX$8*e^HvN2<`aa86$7pom_55Bgl6T7NoOePN zWtImfDuf|=efnKPpon|mZo~7V1?4Ac_ty0H@5kvy(7pJq`tfmY_PuMG@^XG$BCxBX zVfTh+`LwPM$eAt~b(wWxT~7c@B8yWKBNy78j|P(1V<%p4)1Us_Wo2QxJ-W+DNgR6> zGl2bz<1WXApTS)UR{E#w)q+@gqr^N;#m1b3J=$b#51H1$0Oo*kwSJsWnB3hi+U{)A zZTvWe*3M_CaWFVNR{YZnV!IXSThm9FkCCWv!1k-rUsTgvn3|F313hE1tY?0#X~C7h z=G82c#_nr8bR-bP3*#o;n$wka#d~q=5p;SZrG=xdEvY&CEcd9Qy zGOc2{bXD(Anxt>jWgq$sb!!KCc~2h3@>7ccGjqXB70UrCLyRgp9ow9I1dB!w z@qGN3cU$3=|CrT1Weljwqtb^b)uC6$*Jb7SkLDK4a^qGQO?N-PDq1z#I%VJvzCzEn zlxu8fU+|4F*~Zh@ccE%9rG^+VlWE?C>}GV z3$MKFQny&d5Ab{0GxB{EP_a83rn!8%?MgHbdfn%w%>^h=zb$2$FWCl6=mg$1m2 zi(;3-ZFiJw*)Xee%~9#xLJ0oc0&asv7^(v6Em{5~e~R|ISeHR-q|aO>+z)*DNQ`bg zY+dc8J@+M#YM;CkiT+L%Xsi0RpwAc*bk}sqX*d4?yTq@VUHn||<>dzph7+)d>S4h01YP^-eJ8wkvG zTxjkkjo)Rh(|vliRPl1XAnkEi>L=EL(5DLyHqfS`uE8|A5ThDMDHl%>juQx{HFwH| zX+w#*@hrU|xaPyt#jjtC&O$Tr34~9KPyAL{(erHND1z0U$$7pdEyN)oGCcgEq(9|=;+8_V^=|* zc|yUZgZuFBNi`Cf?Pyb%X^nR|dy5VL!N!MW&z44xN4(Z{jpwl-%h9GXp~b#1=?2WN zLKh0NUAD740V>}!0?cnZ-fnTc^c;UHu+Vvx!*yWq1(ST7gi79UYw};IIE2}WS1{+s zTi?$p79wg~-p<@T1$Y%u28dCU$>Pf#BF8vcndaEwI|Nq6vfjFD@gK%$7+ET+tf{lD z^({%@du0OA7P@RH%nM<;ZiV5=L$rM5I(#wh~X3@)kF&E3r=s;=i%fA}!diG3FL3%%F z-CmscyzDM1h80a~dVVwy#QRwt>c>jH%P}@vJA zC@4vg;BAtUjeh1(*<$F2k-CPG1@tCsJ*AT=-yeR<592OlG@GHs`>QwKu=@6xlToLx z-d!smjQd`ka6aZyli8I=c;{a{J3#`m{S%%av}ep;JC085467dqEe1I(5qxaf_O8~X zBc3(6$b#&hq8p#|gL|*zVr;?$--3SFu6ONX#CLCPgx-3JiNl&cGmnK1Mi$mI>gR(6 zcO{K(KCS^jQ>u{?@Od9@2AJR|V?@U0r31Z9^SKwl?=rUv)(DMJ+nyuV0|=cIVpZHN zSA9W@_{uUyj!qBx=xeEB32|Z=Pg2I7?(y)er}DYTX5p?r6D(F`;+)79_WPrFo-L_C zF9l3Ttu1=H>>N5!Ml;yz`4QV-dK_Okj)iIzEkc0gatTD@qN!2B+3LF@fvo}+=QG=M zN4D@W2MD|4ym!^$X|pIKO7x4w?>1EF!R%?BV_PhR%b(z>w2Y}1jgCRVC9_<~vUY20 zL;DWPQk1DmY}3?feNzIx75%pF-%PF78I=3JpGlZ3Z@99TJ?)OmFTv&NZ>7cjly3#& z*xRWXhuc)+o~;>>MTkaf3V2PwRLA$svtK;iF)gz!6^;KO6ziqqhul~EoUmn&Kze4C zPSpH0dViqq_7okBs)C2~$QeWX;E z-ncKchnC0}ndoqpM#IIKQ8^!WMTE8Oi#K~|U02y<@Fl1Z&S=K&^^^n>D^f1oX^hh3$(H%u% z+3kRI@F_(*Rg=<1K&78@q{Dm=_B8B2PCmBrMi02Zc=XqoSm!?D>}dT zDVQt;p0v*SS~9A&4`F84F6`F@C74lb@RH}SFA^!hEsl!PCGDe%g75^#YQ!Jb$UCSE zQvd{uP~@-qG~)TJXQ*X*(-RBz*dGoz0Es61@uB*uA}j*~e~Gt2^OJ0O{)@%!YN39Pqtlh3BvZ7XI%G2 z_E=8_oA{w=ME6ETfpVIrT-*MAOWjha@D*yhMdO0tWOdIsV`it7b#&X63n@_|L^Z}O zg?18Hg2{u*h9AH@Ee`ajJ^Mc)2;R&+Jt(=%D0w(7)}Oe2tKUzxc465S0hNZAob^eh zlWK0+b&Cppc)G4%UeNA4{eafttjHr%Swh#>%phI&<_0^Z!CBa8D$bO^;wsiwRiXZt zX}jcH({;u-*X^$7Hg>7FfA2{_E|O8Ljip%Oto`ZOuMY^b-7yE~xb}Wv7`^???u)Th zl~|!)T0{BDX{G~&FbI=cI|~+(NfhWCot1#L!gmBC<2m=Y^;SJ56&CCySAv><3M_Ot zeRi77`!tw$yhi>0m{M>aNr@m3ZNnbK%(fO~cwSN?c z+X`8(VdG<$z^xS?@XBtz@u&&LE!%MF^g~$~ zP2xs$5pz945m*H>pQO0F=|m}-vpU~1Y|N?SA)5xE_;J?Om)GIT&h4dl`#Z!W$s`|z zhHITpkb7TgBzZMFHj~FY>4^i3)ZZ{l{qTh#9N&Xh2+T)&5jdW-dYJRi)qM}Qdoawy zI~pypZsu`->CL!NNg+G?gc>yaFV|7d*q?E!pKd5A#w{6H-nqc9+F7?2v#h9{VuDsY zNYMG&Yw^?147(tI{$10W@`d|^P>)-3%x3t$^#miSBw9mjI;(k-U`~^54jaXL&QC5I zWc@-PLg;jaR^^Em8Z6wmI9K-0QxmknCjG{S{?(1Cn6~c1>u^=Uv8=tRk?g&xm_)#l zflsrL&)UXRmU%eCyr!o;NP4o6f4K1yh;X$BxkjiVd2PZ@d8te?6tKyq!ImIqT=UD{CjULF%LD{?+@t zTd6e>A53RbI>|1d7RJirv@R$b(zxWAekI;Zx`LFzYN#cII}+$^-tZXz)s@k&T9td9 zvG&&Zud}afXk+9DfmKNm(enAaRs)OnU=cLN>@VnieY_q<3bSY|lKSq#|2Bp2l-tH= zDD;ZDE@BA!wnNEjCxo>_=`b8$J|KFb=zkDG&Dx>dNKCmoACwuJAKufit>MHhECj-v z?aU~-x>E2gx7Yt=kx4HxR{v)_B~-m;E3}c(>9-!hJ`dDSJyCkfqAjUUToKC~Y;wr? zfd-6Y`ju)w>55b*VgLA4KJ#@Zx^>*9TOCF7Mx?BOQsY*K0W2C21$Y`DZ}g($C-;+F zi(y1Kubp5IO+DS_XQ!g|&rShB-yo3eA4Y%VSjg8cw;Wh1&G5kHtyj%AQg66r;`|eZ zXU8gGa_znFS+YtNNpINk2M6B(>O*VM8FY2W6ZC-Y9NUbj_RCFV3H4?ElK6$j3}Ufp z>DR?p)a8+kQfv%wu;@b17sw0?4lnSxNKHqOCPY-bsy5||$AN5~sU@-Q>-pXBg{IbU z=4WOPfckE;`4=W95=M0&^kDC7d-Ohy9{&0w`&(A2eYCOsLj`YEy9;VfpJIajC>qa^ zrYG=+3Mu+$!iOu?!N$*tQs81`qf3TZ=PnnaEkJC>@~)@@TavJS6t$2&$&RhCIPtiH zO%lq^hUainC<*02Pjl&jZoLbE^AhvgWt9A4$;zXY<@lK>>pO8-+b4jr*05i65uU?` z&Psh7pH-RMFUvR3O1tHt09N2u2#niXm-$3mYaFj~*>u zWzsu&lc{$?&tRtCx~zlcgTcfIS*C6)P(hv;dk)lftXRF*?qWDB#pNZoY#O!dcg~~} z^QT8cxcK3ffcz zy}m+hiX9^Gc4&kUylp>;mV`=2DpXC^=aN#|^J;i}mFf!1Rgs$^Y@@~4CI>XG`()H$ zS?Kqh^w?-2|60SZs>uFp75wEa!2-M8G^XAR-GAHDE4=pajdR=Rmnr?dj3u!(;fho5 z`PEn|W0VkeOOfa&a+{h3GsiPC%dN+zwxUmk>I@vfJI~s>M4tIBBBlr~tyR%whrxFr z%|Hd0)=D7a<>ab!YwK#>`xWguvjCwnGk2jb*$a-HTyLE%=)At~3< zZd~70G=%Ijm67RRu7A?0mL&ZF^wzEolat>)<59`D)}4amC9x6Y#Qjr_W-N8GS%6+k zd27J#jy9Gd|J33K6-wR3+(#XnL7aaodj|O{?My9B*g_#r(Lydxe*LiJq2ELChb^Sy zq%9=khyM;}>ISq2GzL`l%%IKqX`3G;D1PT)$$eQ zhYRsd!%r>Zn>q}sS!4Wz)u3znh76XZl56=v%>5l}8pFeTGd^}&4wmK=OsnplNj$=W zp8zog8??AHF{sY$UAWcha?y`zeS4)$+Sh6lkWXN_I<$n%w-h@t2*X~R4Gh7?EY#Q1 zFapu1zNWzuz4~pX>rGsJ8~8@4)l~qKziXFMl#SPgubom#dfH?2C|~XZv^TekxIZ{$ zC7X?kz-7na&t|GM@P`*M`p`R0`k2(#vtm0w-Ab;sye_e8ovx>&K7*o_Rj?PA4HeM~ z%ch1sBGCHpqm;?bE!sL3hi%*+0#@slA}gxq5KE_+Qe2v7aXBTlCiNDk@@|!@51ot; z{mOq#emO07@7o^mlONV?q4`7a#E2RhToiJ|1;;hG=B-O3Z2RLy1UyhvTbMU9{7da@ z@|SGEr3*A#WrKXoY@7MmVWIpE^Wc64L|?*!@wlh1Y3iu|9(Z4<b#b|D@(L2U*Datq_)!GOMj92rJYiz(^6xPCOW?|9B83(&s9SCIc|961d!AozA z$}r@+S{rWNX8GG{8#V8&K%oJV#*tEyjFD}@S-}Cp#+2y@R?KtMleM>3+zhef@l=mk zoDBXdZy_9q#&h%JbK}sAf%g|XW}{7eb&=4uT8^kY^!2kdQg_lb5_gh+jLxA00mRp# zt}0#L)Z#DcSuXeE8o&Pq&nKDjDN#9x9t=Y>s%|`0j1)JDQ?*D(v@p(VwA%^j>wLuR z-6{6KOkZ!Q;dFr4KDC{1hb0ukG}Hgo18;;->4eALD5(I*?OogcF>$m_Gq3LILC0Ov zAd_!cV%#p;PxY-J;^X!W9X^f_4j)cuf>un87@^@X{2Pv053v_AB%!h3jboXVC0f=8!`Q?oUh(;mAG{&Rl`cg8q*Hh|6PA zNUC*^@YOM3)LNYXEGJD(n7(P`BMSz^v+F&wyE4wj>Fwg>dYrHR`&6!TF7BG=>>0di zKs#;x1@BjMlyTVgn=^8FNhY?R$g%5>Oee=&*qdf~uNZl9O1DVtY+N}FkEoTEa@pI-8dZKUG8>BTy+;dJOh zgVpMO7wOVLqZyCgpv3!@l3uCxKS#X2@{WeprfPGs)aJLLTjX*9QgAl6nV(nGhL&%B zTB@h1SujVYb$f{^751=Csh(;iiJ)ITM)rJV8(|Uo(Xjoi$n~&f*lU>=mPb0j@#iSw ztBOfnR&cV6;y=_lZ`Hl8H z8FhJVfVwpNl_g0Q1CnAyJm$LBc|?$}xHJUbYWj3%wg5+z^-N zD4GYcPI0o>O?9;kQ-{fKaiD$-)=Sz`ZxQ?qYfh}axR|nF%zQWe^7XOko1#B~$=y_Ux^X#`Q!XSzgO}OWLE&w_R#gv_R#cr3sJ4WR^GK>gui*`@>s9*^X|q4sJj`=9aE{N#Yr13HNy*J$J@bgU_4gg(9UK)S)MJV7hX1@go$Ic> z7>a6IJ=3}J1<>!xNKme*&{90+9T=kwf?FAQ4}F$@)WNRCK73<$k-07fLJaRAeVKc* zkK2gLyRHx21EdATiif>D1l>%lyj=w$yML!vTU*j2xg7iaDlMr-#O9~dg77TxFf;xp%^)k5DRJada#gX$2XG+`#oy)z$WW9 zVy^vb-?ePlioMv)nm!Z$Gf%W*!-1I`POd=46Ncm`0SwhO%LSeIcSFbG#~VxB>xa2YfjO{+szvCU)>UxO_h5J*?$pNksxBz z3Cerw@_8(nam1dA*x`#b{r)yuaU+>&^l@^Zu0XP7TJ0%Mo6)pgq3cp0ZEHS&LKEj=; zGM->oxE~UAr1=Hf$@6B|ha_FitAbzkf*KQ=Df{zoCX$IysW8bo2@e0b=zK` z;Mss)9BOpnHIiL?bby`sc)><8Lxr-7fgyC~;e zFP(PKwb=YyM;j+Lk6DxLW`=l?!m)&xFFTX%W@mUwjtoePhgaFYz2_Ejg%OE@9pA@7-QhdQnrm#v}-cjq4I-} zQ)asEu7Fm#Bj0%Gva_jnQ+Jljm48uMyrs)va~FuiGNxVh<$R@}Q)WxUnDv^`ygB-} zbE`q+@>d=q?6l_=gvs#Nb;__Kb#J3amJjWHO>KS!y1;#J_0pS`cSeXVJ-Zvz$D0P{ zwpv!E4o*M*;Qb)?a{U?^Bym6X;2InYtpQK4E%4gW9Fo_QUg9l9K=2)jKC--wo20MK z(fN@)GVO_?|~pLD7z6L^nj zszK_pKyhK~$o@W$hp9haB$e|A7go1-^8aP~iba2jeYN;6d#wK7zt%Tolf$Wh~ zrdlqq-2N8t^CpUQC3R%?5W&xnUTNyrc+*5uZ8x;O&oWnqX>Nu^Of@Bnebv12MsAGi zOhcxcG9l5j*I%d9K36hF#i~j#pYw{J6_VZ3j%`0ay zVTUYAQC7qYmgoOV7Arw*Mzu;t;sZ7+Ytq91K_&FN|C>Mx*yobKZzsnpj$jqv)RVJN zUOOUQ*=AEU-|H@a?u{KnQ9IK781Eh!-#;74&G9j;JiYRR>k5?ct%QRH3dr6TAZ@P+Iz>G<4}PM5sQjKCMYcs< zDw%*MWoaN%&Bi%kQ=u zk&XWci?<3eZ*?-~mCH!maNNDX_tDpGT^de2k;Kea9;(JC4>Q#^L(I&L6&=-qiz{z> zWCt>g{%ZkT_c@x7U-JztFYs@M+RX;d74X{T$n>t=cqSu?aG40b`O7;5`f5@0B(-3P z2wnQ}y)kljhJ!K++`%yatDUh4F{ z{ioF6+NT_gTz&qPjwXwwK(q?RPkI|%M@?DY{#E^1IrOXXv+^$dtucgQv_i*S4m%V@ zh#9{QMfjcF`ki8LVYaIZ=9&*PUKB5HCb~ZR-cdj#j$9a+liZs7^PbzT+mNOd|8=ED zyy1`LF(n6idoP|(#7l;|FB({(>Z}BW*Z9u%Esor{!x>*P76qVf18)(`~7C{t?lC1@ZI)`jShHtS`so8XK%= zkA&$&6AZt9lBKuBiq1h0$CeGyrH{K{j{jr(UbFB)u$^#zlyK{)6tAPNSxMmRC%8A}Zfey>ps(GZ9@{?;eUx)XWu*sy+*wE?&OA&PO4W!Q);r*JTb z2q&Nx&|V8O+-5GfB9Hf)=JAv%TK}ovQSm#J8nDQ^j!`?o91US)*)X5CG2fW#X`MtF z$#K}@@86YF-@lt_SCX(=w9gmc-?SY1KLETyL%%*GCGpBT6{#Vxk-Rs0R=%*~EUgQF zN8dRuNaq;v7@k-5{mx{eV4u1V5P5b~8+wnP0XV6Lp*)+G)1r1IxA|;9o={73l8fe~ z6OYlNEg%=VvO%cL1|buu6Wal-G-&Im0NuBb%L@S3Y|z$c02{>KbL8#rX zT(^n|T~|T&g4B9UcuqDY)MiuUoK8A)&eSW)ImM(MN~qngoKq5Z&gjd^IYmbTPJTV- zbFEkQ+J9e`^@Fa+eVC5Ovfdqb{EaN@?+t{Gzm2+=n6l@-0T|CYhW2zatjEPb%PL6m z>}R0Gwx07{W!JDh#<0)WA+T}H)_j4%IKB`BvcD(rZO<)L?ApU<$vC=gIW5v;FIyei z+jjDifb+Ta;A6?2Zj5I&K+AFpT2QxRVPliX0KN^|e{3l&`UCR#FC%_mwwxB>lCn2( z2a{r?eoTv*0M$z`%49#}lp(OO<=6SbVMga^xn03{gh@dhZ9iB_iv~$9#PbF(r$yaL zZgcYmc>*3knN8s}#^ByvG0T;9n|fs{&Vx=yXT%wAjmlkq^id8rCcOH;$vhdj2QeW^Xnnd`)XlyrTiDi;O$niS039r9fN1jiyda zrGxJ})p>q#IN*F;9e16?_SAje?UazZlH2^;e!~fPC#(KY_U2!bHUQg5C2fSyomx7z z9>;e09!RSX2b`|;oUevXJpqs!k7L_^S+*kn!;GHnLEex}3A<|)yWf97wu*FW{XtpQ zhtAQFeYUo#=iJmQTWjdl5AnP|$+G?%Nw(I~S|a&WHKyIo~##t)v*RmT#woifj--eXhKCv8`yqVp~xb zXiN={8OR=Ozmt|}1PjJqpcoO}@uUZbvvc7D8PJQPvK6wqz z-k0s7CT?S)`dnXDAQsqy!vKt5$NG%MS;f1j}{>%QhM+e|lNABA)pK58H=F zl4U*hJm;IjLV+K^${Hv^c@GUI1;_0ROK4qiuQg5!-N4@@g#QnI=zrWw^*?se{f~L3 z|FMnjf6Qt69~)x&A46<}{D|Y$xCr@!BIFN_kRKl*KOsW?kO=uhBjiUMw+@StpBN!O zDMEg7gnVs;d|ib6lnD6|$E~Rm^7Rq&(<0;#kB~ot9Cwm^M>z@O9*zO)ObW<-BRH4l zB|tTY@zG?cZl%B)zOUN6X;5vTmG4L#pyQ;Hk-P=DJ!@8h&~%y>dvHw0mAIeK0~z=J z*li=a(a$7uk_|v2`@!ls>B>MHMq&ZlGgp?KhZ#`!NYr^E_quxW!Txbh@Orb1{u?~~ z_buJO`(UZEha8@Nw=6qRr)Ot}wV}o@cgg7QmAxi|?}D~GbZxAK*TH(<09eNifVD9U z>nIhgB?{KmC|Gl^gEi$kSPcVUjU52%GhtW*0R?Mr6s*00tFd1G!L_k|8@M*sbF-pj z^#`J3eIN|$rz+OV4_}S-U=*w$UkB@l*TMS109f}9fHfx!YqN^=<0x30qF{ab2UnlB zgPa#SCn-+WQ*q$#_pWSpU*=YTX0jI@LwUXq?z61y)!Y_s&$*z^CuP}rL6-F#*{@E? z5y=0n@;_qA1UQ|O#$D{&cb5X|4RN$soTB7L{sibQ=@}xxtODVIICWp`1m42M@|Mmx zg*RgXbcFALll%b9-bHMmuL;jn(7wN2%#yr`Q}>N-TEvQEZ(*8~{ll-g8UYi1NVm$@cuOeh*4G+nP zRb^1=yhYj5moj#);9kRA<1d$G>t7@BgtOxKb+9fN0PC^=u)ZCJb&-m7NffNMC|HZHgY}W?V4XAo*82y*Du!X5 zreZCQg7wZQSW~T6pLg4p{`^rJb8UTYypBFG1L!kq0DWv>`sh@BhD6b4NECfKORtSJ z?mAfiVUCXV;^pXA$A@7(eObZU8HJPodHHIrZ(Ij!$K`8d-7^5z_5rXC4#WC^iuH{s zSl@|)b;EVA{_#3k*A9Sn&j47zo)yBnOU1e&3RYJXtYz21`m5_;oihN|pALYvISlI> z6>C`(tj|Wldi!;-^4Gz7%K%s(9{}qMVOW2xV!b^I*77J=A#1(QvavO{^#c&Vch2!+IUh6;x={vceMtYd}T$kJGke& z%qVr9+Vz~T3}8IQ+!)tq&V*`PELbz=LN$+{`A}U;fz=knNfhuFjPt4CAo5q_<|SDm zX2wBvRzS8gLttaYpN0y003GGXNS?xivJaC1sXR2`Yx_mH8PENJ+II0Jwe3F-6W*qw`Y;0$41t614}m?9kRf!QoYZyZMU zMGEFH6s6Q})xDywsv$-jTYj}ppOXcmZ9nDX0`deuqx1YQ8$??hVdlncceNa~hly*xGf<0~tmKfVO$ZcTwb@WnJqc^5ciRQ3pU_JX~z&RS=!_KFkd+j-(Pux#| zb+y`dM_AjxRokvj;4L@~vHlE<%*W&PkNa>lc?IBy(VT>SP4P`y&ptesWhX~LVee>~=-I*OJv7g^?aKm@2WZA)oRcSM zT0|e#NbdH-dydBRC&}{wDa`!3BmkqHiI!mI+F&r7H$R`8JT!hQWCBDZNACpp*dJ z=M$hC{gh1uEvUn>-zN(<+@TZRL0xu&fMb=ti??*4je)mx@mk?T42bhnIX45mrEHF} z{((Mg_;8KrzYV0~`AYo=?eD*hlWweF#i9xL8z_lrCuZQG!)|hH>7FA;zWK^$HlkLOdO#R@w<6Cjj~=!ffbL(q-wx5e>tRy=pR@*8638E8pM6JgF0= zmGBmvlN(|{?6^&tJGT*=sQ!QDJ<^{mSTV>qk^2d@(qLWxMZno-E4II_c9x({S`XT) zCI-YVS=Ni;woTOcoxkd35Y|lPEj{W!4}K=iIMBXUWP*tEg&zdgKQm-+8sgh<-Wi60)un;LMf;0=IDQc;a;kU{gcfs>aF|K) zDC?h!uSHuPXiisbS)|xj_rGj&|8u$Xj|eAZ}4@(ov|`WS@$oSf}9VISfK6L-*-|zWN~ph=xl_ zO&I-IEk%oeLmmvXPgnZzKHE$i&s&0equo$w@iStXjuc3pijq6E2Jdz9|<|lkWZpOGFm}eP)Pe!i6a~`@v)*p-*BR`Y~;y+33 zs{Oc&jNMVfRk=>T7?yD(U-VY6ZmCk^mKe%7VhD6!s)=#m{pMZ5rJ-=J^C|F^Kb9*T z-W=;*_=e)s$oyWU%iUJAL@2*3J`wa z8EEc&0AoP#Ol5Ek=sYP`$a+Iz?>zLQde6#45HlA;b*&Dp{uoY5Be6-E=jY{0u5=R( z)`Ju+qF!a$yajb=H75y|D0N<>DDwix7LGAU1kpc_lLEtl#LepfbPBFC&zmVAUPd1n zkeh2`Q4S+$V@Uin{*9oF(IFX~s*Dbux+YPu&X0yaunO za(GL-dToOmgDs?K@o)tvDe+R8r({V6iI;ZqvXi?gPv~IM$lToowD^%M>-l(2va!%2 zk7g#?9?KQJFeeExnG*cdK|&mU2BgmEoYcjnd9eSLI9x~k?and0<$ynf#I|3vAo7oK zJ}w3d`AM9Vrh|{skG=elfD;(_5c9v2ELfkSXc61nmy7+B?%6?w@{rxKtnVyU`UNpR zgP1SL6ZSvHx3Md^%^eSOQc0`fL&SV!I!O6BvJ>rmWI9>XB0B6NFhH&S8m!ws4>-$J z{>6FJ<;@h(#_y>8i*}x7ROV0}3*y5kxMTHvIkdXO~0x5-+Nl5|QP!A4_D4xY}{AmDtepm_^- zS$6gizoPYUh(XIqcMXG3JQ8JZ--VwCoS1)~C2MUuWB3|qFxFM}*P@KkV%>8LZ9I>@ zvx0FeF)`~2k9n62QexhA8k#RK;3)*&(yHbk!&y!;#B$P$Wy&1?3k}v!A)oc*~Xo)|)>MI6IgWqn{b>>C%DNi?$2M%^fjH{I>s+?DSue3*U}` zf-D-Wm>V@;ke%lkFlMq)u$}_zYYL`=K}@yx5=;jX(?3AXrHAmAf1nLxIH@yTiJ4H( zEC#G!4h8XR8l)r4NY7y=)zitO7(18|q@Pv=ls@Az_hz9Wt5>%ES(f!%B4lRW7n1qM zpv)BB@<& zw2y%noJ;z%EVgYy`~ChhOYG%fpas91AK;|Jt0|%ETTa>raJn@GHp0&7l9T`k*C02L zxM9kn3pfU87;n3$*k_A{!gGwynDqe8d%dUAf_Yhr@zdk9xQUE8t>^9-5Dk~*@jsPi zz3p4%i8N23hZSv?3#2&}9$oD~8buoI+=m(OB&D6LP z#v_je>Cz}A zE-_HhT>cYoGmZfqi|DUd;4M!kD}Kd5Lkrp>c+d9DLxJ31oh!*s|42?U4ki9X*(*Hr z>V0!8e-DuQT<1IJmr{sd8gWU{^<-bJl44Y9itnnrz3HBk2-QLT&PV8kxG^^SGzB*H zel<-Z`sFJ6$)iE)AoCWQp|#kT0(>&gJt`KgN0?O4VTKYq$^2LD>wQ^`y)YmA7ajea z{Q>2i8~~kxftJ@~O4NprkGCkH_~Foe{9LB`-P5rYXwjd`NgZT7D7L9(z8E8r~^h8&?7c*|m0)}!3l!|w47%M~{U zb49ZMU#7DEAC4>RH((Up=!>-sv@DdVknc*Qh1$6xTm3x3R@p!gIG(WGKYm8|DH-)e zz0Z+xr6u`C!WG%+0ur0I;n-X~1jK)lc!K1e$~*(UEem+d{Q;#O)fAAeHQ#a)=FR=r zK9sR2ztcZg?g`gF{GAdv0>RobL5Zo6<36FGB{y96#k7!R3+X;f)x9=>x1@qv|C6bZ z{u4_2*9$Vh`jgKBP7e5Fem~{o+eqE5g+IheJOwQY5wiA$$r`W9qEdLvQH9$*;}aGB zb1~3tP}}TWjeZhy7oBG{#anKVFh&(s{m+WTznk3bB9ACBVTU zBSAcy00(hyb3?&;l2U3Bt~jL@!4Cqffq}yJ0~CqD_buWrh|6V863zsuzIuX5ttaq< zm3o3dUa2P(2V`qk0vtRx6!vI_z(ErCy?cX_i+b-8*oC}h5PISY8pr?RYnR&A$YL8zVGYCHSXT;&d#63^~X z{7{ElW4JRNMAvD#8ILipSbT*NUyxy2p;A-)gDmUk26YMR zt2z}!mY%l|uE$&hc*}%j5G4jY90e_A^*ZXY&~;C%*EQ&P%g3^;-(v@L&1t0P-P5ed zQBcSQ$41z7mFjh6dfxI5kvH7q>AQA>=Os$1ix&j1tqff|Hz+fOw_sca@tov8E;o1n zNa-*BxNIG*Ue~cixlUAT6MiPucvYSGMoyC73Dqk0rNG9luzY~T+*%-cN@u1LU!xCp z(a~Qm$B9bZ5WH6s$3k8L zi0E%~6F~e{shyMB26BF|9`z2*Thb-jX$#1O=SFgpD~6Mv+fVtlEGN|fv^@JGmdtnj zK9dFMp9A>g@b$*fx-V@+J8Ypj=~){iu8L7=3m9*tja8mcd+!P*7RM``jdmyzZx(WK3~$#9LYXGi?%psxuSBpuzgup@7rB8ieh@Tk5-6k(|5o9*L|EXgTS~qpWxe^Ncy1 z)bS`wa%9^a#V$Ao6@8R3zymbn9595fhX-U?&(Y8lyyxM@aQr%2pbR1W)(HGvR|x*( z;Iju9uLkcSj_iw+@OGEeLPJ)l-Mb>%{rF0hzBr=vMZf16!`AHK2wAh(nDy>-Y1^Z$ zxcnGMIChk0BZALFDtfyHYGWoR?a0@N%gqB{8*VHAax;Dk!^k$-sXHppmIr@d$7%(%l+G|i)<69zBZ%vL9^2K9@6%4M(7wDYWvHGwwFcg z11KhaAg|8piz$`0K`{Cm1F>bVdhbNn&shm__&cew{GIeT{!S*JzmqNG@6;6Wcg9TS z@ANZcg;>})*`@ATs@$ujbsnU!}okQUR7fd$`soID@_k`{-PhwODy|j`HkJGLFZH=j75jWi2ZK_84er#+ZNY2XtTmbtS-_ zV?$x%(FEAjwfsgkHqi+?RvCqoC9JYesaMu1MOk**VmPUJm67lnoyJ>UIYNuJ4CEP| zCp(R|?84)0<+vn`x9q@UqjFrH##^@G@y(pHDvh_`cfZ186DNIoi$=7WIq7fsY2l>O z8#JQrAx;|7!;0vWh>cd>BmH46E7}%v(ua87W1;Vx@q0Tbt##6(?Qu?e+blb6Pb#%d z3V0vJlsC1}B7Wz^-+sbLkBy;4+d57vLRsrMX(1l}jFa}@@0&R3xA^%YC;bLLf33>e zeYf-rl=X5*_7*($aMD7Q{Te6bV0(Yyq-^~Bqk7(+X;M9&cR)R!IbEv5;}6v1#HrG1 zJZ|G85p_GnNl)Lb5p7?E zmc&~=xJ31PZr(=mmbsS|e}XaBG+B0zAkQHydD{LVyk+7yv}lU~$#7Y2LEZwIZ?ioE zQduWM^rfx5<<%=nZIi!?Z!0Td1y@W{@(eqGJpSczw9LO$&*Ta z99f?yw&~_1M>pGNo7iy7))=99atL#N1m<@x5!i%R3~y_UP&OrmmyN*d{H}N}gzzp# zyca`wZwlhQczwK)@%Wx_tdnDftf?Waf4|s29$#|l8u9qf5Izp^y$n(hDEKr%d@n2b zy48D=zE$x=K5LdmgLQp4uD4=^;=4n*UccDihWA{eM8pJPv05LlKPlr7eKm4c-?KM! zSe^b4=)*xW$Z|_}urK|rz?})*|GPLGM^2oOH9dqwh`^C^DRN$h;xDxI55n8p87CCa z2(|T-2wNuwZ5h*OTuVa4Zut@xhvefVR9#4!9t;WEb#687C2l35mkzvp6q z{G`1ePTF!RG`4fX+uJ%wsJ$=L-u)5n`7eIQvE36IJFlWn=R;%r$y4gsIsfmCZ9fGq zk`#s&1`GR2Ls+vTu(qhW#{uYqIXOi^3vc42Z8vGe%_hap;qv_q<>~x{6?qEAe{~I6 zv8t@H)9l+qTz}>{&18z`C)iliw6r?*0A_riirO&UOgv+_#4Rlqdfd*jdGuM zKyK#OangxwjktN8qR*Kq@?Qy;|Jh)nHcb8}5%L#(2l=*e`4&$45anA2mR}z(-xe=) zgvoD?kU#x9$mhc4zs5dlRFCriFtGgl z!sSm+5Xv43$zL8JKQ@Z|zIpW)C-wYLsnKE{Q%EawiUvNpVK8rb{xXi;3lnaMkeBsv zNZxE!-o6Chas+)$SPXpNhpf2#fTD+A4*49Qp=CsPn{Oou4YNaSPL=xmx*_RJvy^+-r|PK5p5kOsEjpJmyJ@k}iR)?*QE zHiWe~EX+nH&_;hGYZ=7Wo_(xRYrHIzdmHe#Cug(d{ww_b$NN|jZD;=>E86}Dk}V*& ze4+B=Kce`wcNH8P364*O2w6WOI5r}Ve_iOW8!rvu(-v~lW8*a9=7rIHT2s5?)7;mP z)pp@(pZ4g5aGw@hZwsz5wNlU`hPRnNRLGhaYIAP{{#gYZI84|V)>d%@?oTdU-PTFSFh?@_EeCdF7y_1~ObfZRG{_VhZy=e8a* zd37Be`?D>)-7kg-wF^V-Uh3`N?$0g^(4TfrD%wnoo9)s2bA_P1yX$nsJ6z6bLBibk z)o=_&i9+$B5Qfit`}^pn7ox8zsP;9&ZjL;Qr`t@6Pk0nO%jZzOo`~AA7%tP5C}jOO zZ2m{+J?ldM_^}h?-`z?)UkgxJJiFLetoVR7lFxra-d)pNE6d|;=U5%LM0uYD`du6s zcr8aki{TSa;sBZ-KF8_|2bKSaon&=}`JB`$%Pj`=x?s*u;$Ryq%+-hT_405%;*tbv zX-JRy2t6_`M2V|itT00leeZQrY67egHr9!-Fa({#M0u}CKzR()y(ZxpI8 z%FgFTfCTCqTSE#Q#C*oqM)_=CanhcLS@F5AfUKKQz_+m%WhZ}0E({*W%CZx}k1xwk z{$l9(*k#!XVaGS(?^5WPx+ps#?D%~VaKAZ)Pgbpcr(geLOwwoe|bL4 z#ToY<@RYaR9k!^Bt&2^lT@U~~`1nP-U+m#V*2hK;~B~Ia`aJ)B#xA|wCQ2b=5 z&4(h|{N{WF-o)rONDFV1OA#8L3giEXHb04MQ+I6}P~mOAnnM`k4PDynSyf8S@P*cuU}1|F(tm-+jz)U%^`* zI~+FVGn6rp-`|R3J|i^d$(qW+Yp?&l5{_}4Ug&r>WP?v4a4tF@k-HrXuK$K|L1%b- zJM}`@bD{QHBibvCu;~;VRPUp}I*)~d$Kt@cCbF&CP+LuETUn`!u2Yskb(wnYeF51z zZ!AtBHc}o(2F8hi+Vai6R{!<)Sk*_LjHwhIp%8JSW5=TEjy50tvhvpfe z`ll3F%Ol%Z6~_NTolBaJ^Lg-LZc8twe3;wP zJmou!pKB=cu3-AVDBmgk^nwp{o0p)xf0B#9QM-<}e1+$2rFEUG@Fvsu-7UkY#eSy(Lq zV_kjtb!?ijZ$s!hE~5Y2&ne?+Fn|vG;FxzxVXlyLeMbZ#v9g`&E0{lK3`o z?Kp#WyV6aGJV1*<3kQK4EV#NU(J;W8Pv~73;F-0T?R%Dj$6S>LpGZN=H={IUZ4KjK z7tKlc?PbN+=}_Jf?qfO_oyV39!io%y=nBZ=(a%iT%Zj18%U<{XBxQXucn=fMe4BEg zGvz^F*HDrp&|fM($wfoUi#_UEQb`VZCjhZa&J99qk7|b@>ij=PiFhr_+@8!^u#NEh z$U_*x!>G?)&@|ung98kybN%JAZ0)>cM_i7utf&9{Va`S2xpbB1P@W<5j=xAb zH-*dj4G0Z!Avq64$oZxxikuup4vsMjINy{+rFMp6n*wFL0Lw||hLC5UPy6-TMg+%m zI3M-pLk1A;QR{tu-*F%m_y4YCAlpF#$@iLThH{u|v>84M^u4d;=RE-@!4SJ`ga$wt zm@YeQLqT!{rTf0>rPLVvbq{8E82|8x>Mx3 zRb>0FYqamjTsMZ3P{t~n>wEY6CN1dZs50O?$glxe!A1$IPK4Q&3E4IHzLJGjR!V!lM`nOaZD3E3I#9V=oCBw-t~tm^wvuE^Hlx>dL@(~)OV(T^zawLDAK z%=_OP6ZCbXW{~HMJT?lNTgUJg{|^}Q?C|X>Mx49o3+|gCI}zK+aBThjopPV$TQYez zuQ2?covX)K|Fw3+3*(ggbcS15@f-ujZFEZIhXcG9-*z(@4@NEa4?qjrrH9Dkq|Dij znE4r7T_!8GiLBd@F};D4l;>qA^4@s#bGC9;_*DRPghJcTIO%)>Yz(fuKhsIxr|oH_ zpgB0VyBP2sOMs2EyzJaZe6h~6YBX=z_77St z`xz&>IuTE(e^a%fi|p^<*eZk2yLbBUcR-Q-4vIl}cJ>zm*=dM{Lfb-4^0UzFIU0Pw zj?Qx>AUnAjD739po{_SdIEiDSxgqQv39r{cA^v|UAUj)GC@g!Cld{;*J`7DbPFW}< z&w|sGU=GMmo`J&JY~>!^ZI@&xFi=?bOHL|gl=^)}Sni(;ptH4clHrovQuYT<`nxRa zZLe{X|B~E--=m*+<|r%v1HWI$NiJD#!MKXgri8yFgV=gW9v@lX#D2ak%X;}8_Twun zV%%3&Q^MKO*x-E}>hsZYq`!MB2DvZ1!w6F4VE3h(csIFU&I#(fec}Z9DUdQR=esj6 z7r2Sv-ZNI96F7J0uwiaU=&#E0lBb)Ng+NX zqbES-EfPcQh-!15mhssQS*8xwn$NEnciv=I)fsva@UiC*iod6uWIiEe$PM zL!ldS8a4Nv{xS=g!CCpMM;x9CWFG(uHnnAe>r6*3d7fO#8O}X( zxRR4Pv>S+*mkVSk+E;mRN~*`-t=JfS+o1)r(>8*WFdly&=lxJP7;c~N`v=2q^lrRj zqc!JbXAeNj|Btb6509$4`d;UfNeDxLWRgh&k_q625e3V{a8a`pK&;~Jcxo+Pm?XR{ z6gSgl&ik<%Va-6k?e`Sfc#P&>_WS>uJ2EbzvGXAlWDI|spJpWNNVfin{!aDJJA3Slhlj?8d*v$ZEtBC2 zBqi<5)aDTUUmT%#hF1t8sGpw@jM$?|YwNzrIxL=~OD7Y)_1Y1d^1G9R{jJMISVHWh zUVaxilzsEF!-MhXMwekP@R}Zueo5Vf2IHNH7I@emR+-Iw72$g)=~XUGA@iyD3(;7f z2X^Qj4zcy?u{OIj<;DXdi_OSmu^ER__N&u8w}a@exm1=6H{uXt`?K@+F0$_evmbIm zYuSdeITU{NP&TV}g4?Y3P1Y*{pqD!~>*7gz!-;`9?5dMP#WORTwP-Qayb7Qe=Rk9@ z=F@$9gWdEVh0xkGNhjyOMvjrq;!xTPWCI7_ZP+3Y;-}O{!hp*c0qXEIH;K{gZiM{UFu`_TP@(*wYCU^ zuLT#V<$~5ip6gwpuFHm+VhPl`-N?&NYS9?9f({DffS19<57 zzR5aV_u%vg0Y+)h_?`tQ+HH)7Ti0C=HN!Ag$EMJ&9G9Rwm(#5u#qtt@BC>yY4x5cO zJ7Zplu}Q|CwDq71*+0Dt49x|$CPKIyV=wva?-SCDUjCeYl;N0@=g*H|^9+Cf&s=Ph z_k!mb4k2xm=ccVlA9`+)_kMk=Y_xM4L9({!xV<$1Uxkd3a~4d_o$QfBfA7+?hP-BW zK5Q*x=f^x3gn~9UySc4=M#{66w$Z#pE4Y!4MTne@He{w5zH|sZyb;;Nra%DUGcE{| z?;0}GXpSQ}zdiCAvV*@Yk7zC^IUvFb+qOtP_RauySH4b! zn!faPh3|@RV%2c8tWf|p$a6!VOzEF+VWNNk=uG5>68f*)$#cBAiOwqYAG`+)pUmvT zzuf}{&3mUcaq?+C?ZF@zK4L%LTOJ|5Bj-iqKXFq6t)(kzUm>5bk+E5IZ+V2;I+E97 z^;)!+U&{=mfQ*Zrk9x`}wpX6@iAZc1ul2Er%{-oOMr6P8PB3l)@UT55kLuMw+yk_R z6X`QKg9TTVN9rV?auv8-CreDO6S-W;8S%F?wkOxh@01Ov=23m7ro8rVHa?mFA%>A! z;E!$*bn@M$?M3I+lK4~!yruBZoP%)dIG4`y!m*{__E4RjiZy68Ey(E7(MvVlcd;uGd)%w}HH0e2Vf& z@iWjltdj2@xLG!|yflNHVTmlf#O^2s`!L4ds%h4P1$)4o53zzvLbzLyfSTuGfDK35?zzJXeoMkZp_0<%*!WB$+JA2agaf*XL@7IGB-P1Y+;|q+v zZ-{JvrMQvab%kW@|AOI~Sf~ew7UiJ^GC!-IVK^nE%@y~6q1iZ4=VCq|vfuRHBpZ!g zxMUmUGtXMRfa|3=4mZ;MB|>A^7A3{74amt~n${4zA0nCrDp|+9lIW+nUXpC}NNHBL zU+UW^ibuI7EN=lE}Dzh!pO=EFo!c`ULgld-uKz(e{l zRz`MXMR_DBLrLf`_y6=^YU|ui-^sP^IgHJq3vATKYQj}6M{Bm9ikpqSI6(GbWjGj+ z0k;x;HB1JzOM=ic5kjL<_>9d;@HyjK!Kf|fd96a-1BBNPzZHxR$eCJ1_Of0Y7f`Yl zWADliYz8yIM%|eDREq#2MCZPBTsG>ua3Gk;a7?^1*jhRnpB&2|V?%Vw{U}lT*>KWAFnj_89)7Jna=-;wl#6UnsT4HjdweeWWOm-0 z1mGcUK6{MQ-Hq(lZ)C$c8#%QCiC!?uxlaxtyrvwRofvzYokC6W_A>#$q9;SNbmNYPeB9sta_Qdg| zd2~$Bo32gFqgRgeHO}qXncp%!^0z)VcPDnR`JOyhi8IIBgJMkk*XIPVgECu}P_<#eR+`g zrJnaCov+=W_c7Z!7r^u7O){}1?Z$IBWYRcPuhn!r!>#k3WBaNv9of5XUy0yoRgTt6B0Ntq)&Hda-8otR?noIr8SY&D5?}S<=s9e z6QZNCllyp|s0%kI`Z$aCv7GmD$8pw2#QPXcsk`df2_MN|_%JRxl7#(D_Q}C@Rt4*~ zeb@w*>7z*^sK>ua;-^v6W49#u@g5(ze_F=}=bLCQrc>zWKG4bM|2UZNA^YTn4|{-r zoBO=U82sv{fmq>LG(V2{-k-WjHXb_2=TwsKeOr?6z53w!eeZ{p{Mo7cB`EcuMXj@v zMExpiVyr>|?q?=^ES13k5lYr4%WJBn*M2`CuMfWwjF^ zGLH8vDnhs>xevEUdi}ygAJ%@ubq3!fFXMe!H$)#&*92Mb^dBJm`9m!4mf=$8TE-!Y z5o!DS*x58!M)pL6%{p?Cj)F^^VErGMxzJ; z$InA--?$qLp9m!(jJ;d=yS}pn-*xgh$?s3PDQ0WQs|-JE2GKF!JBPz&4-TEBwqsuZ zZ#&#<&HnMf#qI*KHe+ zI6CbbiQdfwhSEzzoyUlcMf%gl&tv71reyFwHHr|vGr2$4$$D)~qCcy6e=2!@ynNh# z)iZ=%Njj5FcIFP>zn!_$c7tqaeKC?8K<$cPG2PnjA$P& z*+c93lJ&;pv;f)1=Tkp=_|gIMPSz_QOz^KBOY&Wh(v*&417ozESnL6`Wn}N+v^~kR zeQA2}BMI79C(*7Sp()Mhp`ALv8pZxPi2gk8`+sA;Y#b0_$zRDjKbq9$t7&@qT`>B<5bK~3m>qwH z`Fw4{EATZil4=i*r1l-$>=Tzc*DL|+dc6%5i( z@;&J%=`Y3qJ|-9kxZPF;%y*TPtDqKVAiG?I@Sl@ux4ZP>Clj=H92Ev&idS;^rP^xK z0NJ0O!=XwMMM$5T1PGLI{Iy@F(63#Up#KJ^9~-49#Fiobo?XOpK~OIa)n=lG>x$B- z|F-=Us|TbB5Pmd;X64ER&3aC=a+Icgim{i_Aao1vV))hP%P*@=rnx9xFaKqN=5t2} z-Z>N<8!Eqy*d<^U1F|!^u?d*fLWfZ-rh~0jkCiVDtj+u1a;C}I)3I%R!0!2GB=dPJ zU2l3S!Dm$ppJ$FTK4kz;?eCCXpHy$Vf3NikIyvh$#*_Gs<9>dR2?>5rrsRN~?#I?; zb-sxn1rb6yfb3}^gqGe@(Xc6o&4ZHHYA5^H7-TblWge~1J#c+&eRbwE?Dc}yLgpB0 zi#&G@x_=TZ2V1mWfDoN~0)&<>sA#B?F*EPelmt{W@t37H8FKIHr?7eW2)*HkBD_w&0ULofbyg5Q6C zos$1^l}vST4b5asZ}?g; zV(FSvcW;UAwDGV*m-|A89cB7;5^3X7me+Lk*Md=*G4Q>`{JqL7mLC_Z7W8PFpl@o& zW)QkdV^feV$Pm8#Yl>&tLf$PNrYX+*cO<<}+CBQUqu2AScWwhCT8ixOy(KzXKdo*} z`CW@>M5i#HjW|M6UT6^wN5-x52Hr6tH>i(oiJLi(qcx-tB4`moX0dv)SzyPu2>Pnq zz`4H&r+qCLgun941bRsXLF``Yn_4O8M7|v_33}TUWD~vO0xc4gz)q8q zt+`Oc+`E|1cG%TyE%=8bttp@mesGt&7hO#!X*0yRVF2h0T8x z8~dlo4hj(d>WE;(MljwQIe%nMq&qy0(iEMn!Hbdo@=cOK`bR!rc8g>*0+f7wgw3gX zvNumI)t8XpE=7@_&zFpK%Xpke9EbK_#n){o4qe%f&01n7q=Vfd_D67 zwlvUMe)-dc&7ap5H?>oY{~cFh^L~!w&h}|uS8lebpFf7{?Sb)VjVMBNEcJg?OAVz# z(5YW+IFtk*Mz(J_glSAyCWL}NMRpze|6XJ_$`B^=J$!ko9{wTdpJ&19-EP=0n}{5NUHbmW|-O)E^Kc zzbCXh>L%-{^xCsojLV0|uvvL8vRegB5hUg}`{zE{fV9DR#shs|IhJ@Fo7>$qre;IO zM~v@3Pamx(x3emT;e;N-*jxESRwLqpeKdDA;LK-2V_O!D&D*fW4b2^^u1v(`EH2S2 z7O}c7?H;2gxx+|6Mb-}#>R-%GZ6F{H%l}J{h8!8E)n$N3leR-&f6#+ z&1;v;Mv>U{67z9&;ZS2XixXW@hRw!ouzmb9vM2Go@$7$=IWb4M*4`6wa|4grEZ@fO zqEF%wnUl4rvDtW%`Lg~erQgCu37(!moY3)`xvl;x$A(W}6THW3R}Hj9lGa|cV~fyQ zI1V0n8C!RFxvK%s0y{?n>U$&S-Vn$1h@Hh|(I}{Clt88N0hthZ1T=-#l9NEa@~~hC zUb;7JAUszzU#-J))AitCVLyf!LSed4!+4 z-{pL0E@TVopccr;&IK)-*cOE6hq573rJx9z^G{}hLH3E}gMv}sF3|fV0ci>%=MWdW zC#~znq2To>(k6MV_A%EsL?wuH%tCgnl(P|I@c0)2G)2FT#{vlu{Hv9z+%t&r$__iyJnO{kQtL>3Z|m)PLwt#Y`AU=I>olQ;eNFB2BsRB*%e? zW0lwuf60PQ+NLohQP*p_rnF(~CFh&3G4?hl`?8&U6dBpBqs(tP-o@fQo7}L0v|s$( zbbb3L4u0dm8#cRA@~ehxElw;Yd58SI=M$b^Mg7UlUtfEa-NS>x@bH7#5E&}o&55<# zjadxc0Q}z$uIHMsrg=cIVO-BWH(ggdQt*E}Qt@ZO7M~LuWJ7Fl{jb#U-|}}yC$}RD zdTe;2otY`^khL)=c2iEl)<~k=b0~@S%OXv5&#;DgCDLDb0}=g`bb zp;@0Imok8wSo*rc3{AT(nRch77iTAEe~?1^uJh4W6SVQl!F%H_vTl?1MsiLd`(u|RSoV^%hTf$v zmJ4w++b7qE5MFjjFub6(tZ2DfZ+w2bUQs9OO*1v+8WE zTut+CitA+ke`a~~R!N|Bd$+k^^{QE{UN5od$zD&^@~cO%=}V{l&^$V_x6C~x7-T=L zy^7T_tKofV%4U6$I|RcI;1T$~bnh{i2UGVvvWpf%&2=tN>$7WH1W(<`;)#3LHl@Lp z#D;Kkh3@}Mq&4J-K3T!}b@c1DmuFHvw}s1+@F8u7?nWp@92eV6w z4F7eU)-wq>e{VaEO(a1{Y=WpqXNx+179#itu-n@NR>$LcX1f&^u|Cuv$7b;a_Was$ zY<>mcK>~!uLxMqgY(kns_#tC_*`b6jvk7Bw^-aXi@X~t^5ny%2h8%sxa9StNU-vMg zI-E6Uk?rtxoJh9-Y0@u^nIv#RitwXG`OYqx`O@=2~W_AOY0Z9KMP* zrNWa&>3(%EVWVULc#>;+{ODSW4HbTwzt@!X-Y5LMrW`g8s}2bU>1RGLo1yP}tj+~_ zKJ`6Tr?5<7XD%|YW4t~{vjQyc5+Iy9KklaVw3bELH1?F&=4SoYplr9zYlG4DZlv`Q zTmHEpo5y)=u#(R$ntxjCgUrt7L#+c@6)vctY{Gm>Q0h* zQ#lOO@?sXFAN>;3xL9I4UD1in;FmZs8^CiNmp9d6o;1CFf~G7zI53{cb%^X=`PMtU zALRV8C=c1)vqgPTI)qD;X%Ia)M^mZ}3Wj6z6Iy2u3I>(Aly5mQ$E|ElMxR9y4Kl8b z-aum-W*~qP@;#ByZ85>91x;zC@#&h9C-E^HPsSqG+H{1;lC+;JGslkVKvz4tLK`OD zs40JLyjl-}rYt^;O`^XYIkLF5TuO;$& z;AD;jzv1`5Hz4~yJ_ksjYB~PU3v*@T3UbaXMD}|C;Un!#ZnbmS+AHSwPQIh84MLx+ z4QVxM5P`K*N7`{Ao1B9PeeD|@-oxp{F42?<#MX>>FcIT4jnExO^-%aD{@e0vS(`G( z-bY=?ezAkKIhOWkto6iP*&uVprvC1H>*a5mjj92tu!YtTzk;muw>Z7}OEsn9QPy@_ zJHM;*Xo?48uPs6e`OS7Wto}Q4*jttkH6IJ04x-;ZtKW7`rvLI}wx=BKAoR!5GtzZ)WvV|k9&=i| zkDWn+*(fqWLiUW|$X*Drg!K1uN7k1m`uj?I;vBR$j=ldg4%y_aR8yI`Z zyN%@i>t^b(c&1M4b&N;0Jwep_W{VUj<;M1b>r|MhDUY@fJf9CI>r^VRh-{p7n#boQ zdG=v8Pn=q_r{^%8-w2?VIP>{Cno_YTO3k2%j*$@&rJd9O=9UR$*n~0NrNZNA&GIe2qYZ_iHo9Q+Bckx^W0LS8 zk=+Lcpb}Zo_fC(b^+11Ig-uk@T`KbTj^u+{kOiF!vS4+WC_ej`Bz`#Kk<0W2Yc9~q zc_<$=Wv&}KH~aS%-UX0dA;FbWI^4Q^5!4(8M!y0^>lJrYKUxhis_IpSf3wvM8&*N4 zUIb9HevY8e&iVaX!Uy5ux+-k?auYm!-~rWXJ1UL!llJn{VRX^`P*dKA)puP`0{}{^ zxvp>_z`dG~)GsuO_G?-dHnr>o%}LqGG(Fbmvw1x|fSMa!Y;NUeLFY?Z(47CsWqS2n z**c+FJ?h1^6{|<-4zCwfVY6{$g6@w;f=XodIXUNv;%;1xIM0;$eL4ogOnn{3Ui$oErvAUqb91Kt zd*?Z0xc)omSskvgah~gj>#LpT_Tl=ko#%;e{Tb&u=+>Wdo;SGlRn9Yv&}*INIV1EZ zoad)U=#TaDFhYOSd3I;%5B2{(OMk$5elSbF-+5l0rQhc~@5<7D-2d)K{fEx;btCm^ z=UE%62c73vN9uPw&+m`a7dX$2!}RYv&to%nmB%7iGk+QN4+kywq3RHHPfLV6pp~WL~$vx;Boz`N_O$ zg5Kmy@LHb2>#h`Dlj9##^2+@jYs!B{60NCU^0;`J;VIQVf!4fwC~o>>2z(|$sHB9& ziPTBVPbz|z{cnl-Ap)x_WQvOwrM1UB)^EyXLlYrDYjFE_75W4yb>>nn9;grcHKdQV4i;6C?{|Dsjk)r4 zP1&|FZaTPB&hH1+jT;8)#JA&AE=_LOK-w<;C`VrbTFX1+eSi`p8}y~3=fmZBQ1iEQ zSgmrw=u;~b^$sf@M{9O`A{y-d9IH5*qgQW=o54OD=>M!cN55wilXd@RqdfW#HpS^( zX}udd>1W40x=P+n{%rba{pL-yR)6B%i5~s>O>tVUwaNM2Ti57wH^ogPCco>^(WbZ= z?ZPGG%>53(bK69939H3P&M9wE+%HXegXZV6nwG>ae~sVGIb-PfAIZ70PSBM5x}h*BfV~bNqB%G!DferT0qPqY z<0cvB`5WUVd5@fZ$h!wbnnxS)#c_yyKSl;UO7`cCac=t-TK8jYY9d779KN!v4~P0( zpvSfd)HhclXiCp4us4%=F$>wzQn1%aIY-y`V)bzm%~*F7YRY@Dy41z$5#PmW)%D=g zU2fQ5%=GBRQsIZKbbb_CE8Uth_7l+n32YieCyx2>CAX#!p7K5sjYbjd=n@o(Nn`zW zBG5YS-i>jyhvyy$W6|`v!$B|8pk^azYv1m#rCn$Zs3AHaKla^*HYv>_DPG27P{_qv7$Q+Xy}So9-OF3u7;R z9_7(bW9(fq0yb29B2IxD7o^n=cC zqB(ji#$NY#RW((AVa|>IE;&vHR;X zZ_nWO!08QmHrVXGF5e<&AevLLMbH=T7ucQ9FbMUQA-i#(VDNji@Gdv3UM|52L(J6; z@egZrT-{eLT?X0A?~~&feOgQBCnCkwuYLlpA^na{5cP`rxw_!fT3%m>&9(`m-aZ@I zrzW`ctuln7_oIj=XIxn|g00Jn&RMzuD_UM%h|S;15JnR7A>R8SHhamLtp|r%XCeEb zlw-9mVfVm`KvSNa*XbxNSAfJeKkG zeS$&k_h2s$S1&*>e9Avxp9LETAHv{P^0Vj77Z4zPdsHxlLVBj6et?R)Tpgx+bS*k? z56p=r;&92Cu~JIJ;im41P7XGdGaQA7Y3?5LcV~Sm8;$31fZ?v?SSJzBEsJCI7|+)j zahUlAVsWgV#MsMnG(%(QT)pCP(1jv?Zl3PZFHezUQ}q0`1XzBsaMUM&+Fv8* zYqnQX{9F;)fBFt4x|iZ(emg`gKN2AvJCMXrALzpP1V5Q6{QNPApJW;I*EbM|?Irr3 z_zuet)qwd=AO8+EPttfsBG(-2j<4e;!Z>hB%C!ie4<_+>WB^vs(D9p}m-+!$R(bV`)l>C}JWj5omCc(803H!E<*bxu z^+fQG$}?BExoED8apr0y+DG&3$yV%?>Hw+7|Ls zU!Bt~>0^5i^V_}O%I@iFtGxPnkETSoiyVKoydl+pgjWjGhw&-Hph{_{z}n`?AJooP z4{PTit=KfHymY@MYq!;-Der9;ji{7I^P@>Wf5rRQI3)diYukg2ew*aA9QqS;8U5e2 zVzZXhugKMue{2_xzYdru8wcd19$+!itDSv`tbd}zXw3<-2Tfsjtij=+65D(Ha0p%f z5H{adnE$PDBcj+eWbVGdNj7}0>7`z0ovfZp@k@)-_&N!Cb##E=WsIivCTYHC%K?GT zH?kj*F}->Po3CjpbcBoqoy$3$%3Qww4+zHV00E#r9j^teF4Hq(G`5MxDc!q_$k=PG zR z43tmZuzK+eQ}tLGvKLBFGo}V~BGc`pzYkufckIg7Tct5p2WV^exS{zoH>^Im@f!W5 zDzCnc-WwO_v8B*J>*Qa+=46|9SVL!wtgk$4>Q32k=J_XI$VLap^KA2ew}H?l?-4rk zI8E8+Db&gP9c5rgW7zB{L-wXBuO5@eT2U$88b3}`&TbQp9uWeBwl|6PTVK%r(LBtm z7p6LQ+mzRBw-oAa#6JERJNvvmj`6uYhRu4qb_%V{<22>KHqnU9X0f2J#%UgJfY9Ri z8XG#ED`a&qc>f)Gi;5V%*JDhd4W&bpebBLatc~Bqu?gpJ33<-m&-f?LqxU=53x(9* z{qhl(Kk5@9K;|JGn~VazV}5~7_#%3i_PJSG>)g4_@o7pjk3`?@#H)x=oMFu(Th2b!G$uii$PPCbL=1T-pRKak3I?6V?4-yTZYhD0m8{LBD{3` zY)t>%59MJ4=ySXbw;ZJ-yIj&D^FJ2p{9``CLhJX3<7S-%B`@;v+ve!LOU5STy@B;b z&S&!ee*gI8)B48uZ)1A(tt{AZ`YqXrra{Sez7J9PG+v;)-sJII9Xxz{20gK%OdFVVL^oYIX^rvI;xc+zT{s($Rq*ewDC&a)IgNyZ1BSPE^YEC)+>7hO8AJ z{Co<%rX+fAa(Y6xrV!he)dLePkWs^XoxHvpKsXmz4d9|y=4%;yLN?kk_Es-Iwv$Kp zbrt7J0MPbo=v8EP4CEuUfv#yYw^{P{N ztsRx%^|`MS^|5IF-+sY3k%Eaq_-(-0tP`Qcp+ok!oLj5~LhbPyNOR|3}Z%1}3_k-ye zn@FG-Y>~P+4mkOOK zy_#b-FrT3^==_>=pK-91>HR}efz?i9fr%~~OZ$5095#It1nv|eKxIMai-+r>9IKkl z7m;D?E!Za;bu`DG$?)X^6rY;n|J*Pt%^B&BQ*u(BxO+A( zqMwXOMH&QP6N)rukbVf(@S_~NFav129qq;X8*b>_{lZjz_jg47tt?pmrW-nGZNVxp zttptm7R<4>PSce4+^~V@R$`;Sb^x2TS;!{icSy?h6FabC(Nt=mJ2*-;7@I)>0@ElK zdXmkTgfBsP**jkU3S;j|POowSvioU1H?g1Q-9*=%!zIDn5v}`1bXlDnItdL}H9_w< zHbJMd1Z^$hpXDtj`Y^GCt>={oC`JLTOS$4R7Pn5?CiE69KsKRC_<*Ss^@`OKbaE!E z7)59@o(MlPd5&f!ulGy#wa`_vv5l`8!qc3&iP-1Y-Ow3wLnj%VM_!n!cdcMDC+p_- zRbHK}n=x-@>m46W)DKBxcszpF+USN2b7y%H{x+Vc8U;Zf|*VK&!HF7<&?F%7XcRR9uqaeKW zg{itx<<*z25b1v3CV8w@dX~(!h%9M7+P;hF`LO*)W>btlfX&yw6b$k^;U;z-+Rxjr z%wzbObq^zoyP7Q10W>eUkkVWb{bk$zHu2o6m6h5V=(B74`bzni6(+3sHFO!dOcH?aBp>3(dk!PqO3bF7H$g&-WQ?ZYa?7;_=JRn#JX{g-G&dx_2MwSIXy zJELTNjZHy@(PdXLf3pv?7VtH#t*uy1WA~Z_Q0u-;FD30#yDo4M<%!I{i8p9UGH+!5 z{cArq0{|W}hQT~DLp>H7u;h^=!SmudZcCesHUndWH9Jq%yR-js># zF*35f9%OI43E6iZ#i2$Qvf(K8p+<^Ev6#;iF4LwNno{AGsBD8@CSr)M=Xoig9KhzS zUkFAN<4$NErPpPGy-}jRJ$~lMwZ_L;T<@k#u)qI>V9W$fxtjSEX`J3A`?2YaOaGkt z*(5q=2oGDYVmuI;koj}perzVw&y17(Kaa=mYRU_7Y(@pvo)@$h(%y_O1jC@VaREIi zj<3*^hqs6Z+jG2DMTMq3uthYyNpo*JKeLdtF42jE-gmzcsEzKN6))Sv;?3R!7CRdg zwa6v^5m|h4CbH|&AoSP^Q)%BG8!74g+^~W4@yWNZ(K{CV>DaTgYpyk?%sKPA8m8^X z<`3xE_Sy!ruT$U9b(i-4b`}5ar2WjE?@EIZ`<>U?7P?d?^tYDr`IIEP3-&Wvi5y34 zUXtuce`m+B`NkJX>&Y$AxarszJl>bvs$^~z2oM6$TI$`BXAGVLhn~~34`vk*0 zjYH%+qU(z%U#5e0nGWRrmT)9eA{R& zs6*KVK45h=9K4^i3`fjQY=ZrVnU9uZe9`q46hXcF3&H5O%kGl&dR0@1oXEN0mtPEw z)i3yRpg%a-uOC#B>RbSXIzEz(dKa<}N?^Ur_t;g_r|1=rPSGdu_*P;=|8Ebb7*ARj zvd_+xjiO7SW&}B_ah{UxCSoskyftN@{eG9kF#m67a(wD5W~;P>pG35R>>g){E8SJa6t- zhq0*%-B-4!(!DD|cLb+fo~w-yS!EgqFh(uXl0} zIVT^*f#fmvek>d4D5m)uw;yEo2M7$0@Oy;bIQH(WR%|w&!zDL!`IH|fzlECj<5(>( ze!9gsv2krMo_-~l7vLaaY=jb5mK;olkB0U<^1PS!b?9O(~E-oiBh|_UO0= z$^}rXvr&U{hMfD|1P0AS08iOir~!=Chm&QtRnjZ(O~`EB=ZSIi0C+sy$93}_*{I55 zIKSlYkI!=aZ4uO}6ne#r6ZD?t^y>LqANR%JyC|pbi_>q&fz=S5peH{=6bAm?C=C3& zP8|5RCJp>MC=dJ_r49Vs=NkAoq^Go>@^@oKO8di7+RsdBe|Sp!?v(aNq_m%v(tgU{ zjU!XqAC=Pn=#=)eQ`*l-Y2TC5er`(pDStQSrL^x&X+J-u{eqPC3sc%3qdW1r#X=(P zjO;y-f$Z`J#Q`<{2IW$+_2CZyvdI~>QUEnRRW!6hu%k35G{^tVJkeN}H@H4HX|obz zRm(&6nN{Q+WIr-pq*&%ooxgfHbuCI3ZEGs^HLH^aP{|(SBmYlkd*GmU0#MV#@WQPi z0)1-^Tc2cKVs$P&)(;AR)e&*AIwGAIdn;Y+yY&TpJ?~jp_;u2~6>uC4vOfq(vCTww zL{FR=4n$X$jS z$78edJU9{vKwbH-xar^?48#Ky{HG+@ALFrnXZn3&;O~+|e^ioaoZery%SKS{EAmkL|Ldox|Z%7<-qypyrf!UEvXoy{`iVPWN4WC25m<*3K}d6j~3|jqJO( z%O3Loqx}B`{QqC_|9`(-ruE$+2s)94wVl-{BJ(~`+cWWf^!@+-z2}4f{{4+Zd{6jz z@&nle`N+OvJNth=|NnCS{{sI1PaJ+58NDaY$1ndrbUuFh_lN(F?~8}xHy_zQ_<-;+ z5U+;Jo3I-?L$8h2$=o>$nqn`J8~((7vi2TU_h}pdyJye3!s;xV`{OsO(4_G+jy&HV zmAw8RU~C3OD7kNsV61;_v@T50l!_?mbWc}D>%ZG07>#KxSFYHjDUAdcXnY>S3C*?EU(T@F9o;3!$fo*BMs~Ru zjMO?)(+Z$JJ~Dx4E&78zm)h~aC*zki#RVshA)LKOFzPdyADhUyLe0@Z&e5;hGZ3?m z$b82h!Egb1c5@8Z%`Rj=Q~(qw#<^eEEQm(%JeVcXG*Bxy#Ld%fptpXSh;JQ+1;aUS zG!h%Q6h*=k1gM<};*y{M>fzmjQJFcIPr|=bBWVvk*9v}t+l|@(ic>%M=eq?%7(V!2 zX-^_w_I9)c7zv=e_(a$FYbr-$HS7j{fvdMZ-t$>GG}b+HqbRAm5sA$Ia+Gpm-x&3(+z- zhtxngHRWwNG={b+ zT~l_y!|rE&E{4zCDvhOWeraIS*Mm#j?&q?y8Rq3R4^h7Tng9Xj!(q7A#~)#zCu$Ys zS}Sj*wbE)%QJqv^O`62=Cl|Ek==KZPj7f!7)i5%b^Q`yY5h*TBQ;lfkh)^ifY$OdotL5>Yhz;?aYN^cY%oBA66ZJh zd|U`Gvo2%)&KYevx>X_?&i(TG98IZvM>LjR2qhDDGaMn(2ZxuNIWP5IP5FwP2g?}t z`O%q@QM5~{sS`lW+s)5Q$fNt(a`cL;K(BXe3gYjU^L~7~o8d(fnU#a4h<$90{<;UN z2k#aQr&g`t%US-lc_5f@g#Mo{Qr%dLZ=LGoo>3rJxgs%myPk z8Uk(8=-n@sNAx8@KRKDj#~d$}j94kM%K(lRr-4dzLhA%kFP`e5wP^7?uy1`tG|)&0 zMCUOY^SJaMB``WqCxul$5N@E&efd8$7u{-{?c;l%l6Nl%>9@Y2cf{fx>Pdi zM6i1%v3dkCo-;$s-iwOKF6n@4GXgqq@WShYBQaBIIG zFwa_(w4T^J%C*QGh+WF+)X@I*VD*MBHt&4BI7H?VIZt@H;wJg+scFcr8>cBVOC3Bw z?qd`gK2_FaY`%xF_mf=--B|G===FZ?ON!>`-MbR?UVa%*i2)pN-}vz$+u$^_4U+Oz zz;bG2B-;gKUKaa7ZAoLb*Xm>lHT_C7>PAAib)}$F%vdRJz&bWYgAtS<&^86x6C?33~ieY(`6w{iYk57tbIzfvW~Y8gJZ^`7_bbS-+brp3c=P5a{(6 zXi9WuuKxC}fqUCcpRv8|5P--2K8loip=RQk@|pDlt660HieaOob2!xV6F!gnSgq3U zEftNZi^UzZ5qoMD^Iujy?aa3vtMX~lz-2)5*ve)@O>8)*ha|8LN*;^M@91o>>qITG zYLuqD+87jF`EVvi78=okNDbvB{`gowT(^XALH3beM*?Yjhn^sPyz z_8{$ZE$?R~@2BT8R+EvekInZp8{m13&GEnfQ!rlR`{Jwr6b!PicAddAR#WJT^W40A zOYUNI?a6$5xezTw-B?}!1X@FAz5kGCG zy0(23#Xq1m_sG6}X1Zk54TF;6|->;jev;F#S0;u+< zOy>2jgv=+V$o$P+tQOu&bf0GS&Xs&09udbXvzjG9J8*ru0M` z!&BP$(=Nf7jj{K%BsOi)Ywh_^5lE+%> zXXnaBk;c+-yD-sJK(t;Ci=nM5=i_EGyXn3%YP)e?QjTSDS^d2mtK{6+M)NE@R&;`>f2Wt>jL`49 zu*%|cbF9giaQSwz7;Umf-XP6vBpQMY zJBfaaKEi4Uz1qj-2HCR~pJBGosiAD2Y0UQdRY|h#L+{D5@9{I7jd>T-SY0ZoZ*0tM zpIqxkF54SzcFya(h}pd4v%hv@)#qjy0l|kgWofonSd|`(-{=%OFU&=JO`gPR(1q;(Il}B9^8BxhvALZ7p7|7W zIR8I6!RA(%BrL{?^t|nu!c~X+?aU83Y&rrQ@ z1&=3ek29y4?Ge2bMTjjsro^#5cs(akQv#qV-%i5j|6uIB?O{z>kFodp1&Om2u{-x( z#CUk_G*%a2?EOnilKwsnv<_&U8=7HyuKr0&!bb57Wus86Y{xzc4Z3T0^hYXY2lX8- zWWFQ9`(rL-*Jne2T`ThZcow30O(8clualVHFuEKf+oFPzcP%!fvuIv>_~918(01hM zg0mO+yn21hU|-X;PXz|Qkzs6}Eq*D*-^Lf~Oa;IQil?I`ouPARo z0HNhsVE;S~!msUQxcaxZ2u40=3gMx6Sb_(wh3-F!b7xCu=YH2E!_6=Y}V)VD;UjrC`sHw6%Bd6b!2Wr2^~Vaui9{ zyZZxdzPLqD$FvAWY#8gS)6Z+2IpSu0{G7{!^qusV$cWg&g#M-s2<@FE8dqN<8cPBa zu`^js^-(B-1SpYO1fwZ)ApOfZ{qlTPABNC5JWHfGErhRo1yIlI6pY&81K;xzT9BwQ z`Z>m4Gz`=;FNwPNI9lWEF=T(*^b)fzZtP+D=<}<^ejfxm*E|jo3T7iangQV#cjQr@ z3ptlmjntH~jm&4z=z{R4I~iUZSuYMB@tuR`;%Y9VdH_#lI@>GB_*_)R+MO?e+PG6N zV(x)`I=Ykl7u}ljXFj&(EYZ-!SFfxZhit-o6+pO<*W9iyM0T;LDLt2Qx)`h0PFBkx zneJztuHe;_-(c)5WaHQJZ;r7?=>BV}*e@d@i=YJIhwl*^9+w~-+QIshN8=0`A7$V@ z+9-i~VhVfjJ_*#v0m8uw6!D1=c$)B$J&=#rcP47{5jl~$bqB)-q_v3&{prABD4lgu zouesNZ4?c{3;AB(AsE%!$ZjX&JCD^2Aak0m@k;{<`7Yim81ux5I@){7?rsL-(8h5&dq#$h%I~hEYSe*)lxFnt;7~3d|ktNkwKkH zWRW+J-p`W8nv6rma{ZgfxyxjY^0 z#uTh`=Uhs3&$-7w8g&0hv6zx#bGycXEx5rRp9Udv?&#W)r=O;|qF$QAwz*JKei{*t zx@@q6B80`Ad_VGe^@`_!t+hf;nat(u+|>{nzq9lFu~tRkp>h!*=h=0laC9@53z1)~ znDcBA2uFLVA2o-@7*4a|=IeQ2Kg{bR9i?^DG^KnR^PTka81scg)pQ;McBKgFr_D*c zX9&7*0pCkM%G3Lr6FBmu55L)&s5P3(dw=}8B+{IMS{Xv0bz$=gAG2HP1PH&y+S=f> z)x_G`K-!8m51fnbME6OWk~NLlKg6af0-(5=ULI%m&M4sZgeguq#c7D~x=dsY9R8l9 zaRkV|w?s0E7DG++99Dmu!b|PA1TXJ2C-4wApXVN`Dht``0Yc+5sQwC7fToNGi2Q!k z;QOgV=Z2^Sl>>HB5KaU|P>VD;LGj5DoTwK;eccTkmi{iEp7ov{#q4+IndREC`gzHD zB5zC)J@mc*jz4?{%@vI96%b=7z0o>LPLZ|YJLo9yB=r^ zN2DwRYUTr|TzJsE21`mjpg zKZCJ1m)AOTFm<+1l?|eI#=GIxg)-DEChdWyko~$Apu~yAL;!(@M2HwJ7~RD3Z>db6 z2dm3Pi0q(qi;csUfMgWi#jp{Jo*PvY^{y*~M~iMtj<-2C1im<#*CGC{PXzVACwyM7 zD$pzL0=+zg&+DlLdPZ~N-k6N(ADRba<&iPzJ5M`nNjuMtqV2qw+|DM@D~Bc8IsVDO zc544?I|FmWocVM{68wz@z8T9!{lks(O>?NX!uxNSie(;&6yATy0MqyNRavB zVs%_JfY3iyv3tG7bC~8G6#;naM{t^Zi}m09NHnx_xTL?G$+`M7Kce^}L$>ol5B3UK z{I|EH>C6AiZ^L;U|2V0RUGn^u??Cn(j6-db$724m94kiVDU|Il%781H1W-YU)U@d+Zkp?&2xQNU6Aswkdt_K zE0QxaFwDkc%+8_FI1Ygu*=Nr~Z#K^SW_5ahoD;1>P%*VYKl!HUNp5c_ zdQ&)mAO3&x2N}rjI!{eNvM*jTlKGy=I1>Jd{&nhNZ<)fdOFjZn&yRzWYrQi?rg0L~ zKFMHlY2=-HUSkpjP>EhR%Hz1|G4qAx>b7SJ!zzK?qts~y8i(^ z$6F%HMI`HpVMw7!zfQ_$n0BQ7T41qdWPS9qIJ*{mi1p~ieULR7&SG-WLK#0n#o|W(nf(4SL5~$B-rqaK z`}ck#7+wHRuAA8h#QqVkVD?W?M7F#)Zbn5->6@CcBeXsoBEKi?{ymG?5YBz0bB28M z95zue4h&VVVqF}Y-_qP2R>$o1|3hv+8bWR_oWbVT7bN6XlicsSM7?-KqTg$W==WqU zw`;iEDwE%D7WLW*iT9rw;{CBh$nEv13Aw$oCvFB;Y05v&Be#X;k(>X&$Zg3Ga+3i? z=7q^B)a#> zdeig--J%q_uk8>FUlNvMYCJkw=X5Vjrg==(V>1#oGj}BRV?y_jI|j#qlkuhX%{|Dz z_Q#?@{`PoStS-^x)w!^`dfyz|ndgfD+3jAincoFPmS;dsqX_D|$$Z?Erq|w_wEjO% zvI|CP%4585mASBbDBQrH0BYVVag&YV|=Opo0DX zRC53Jrs=WU6aCxp@jzd|>>cb5?Wxm=TypaFhlSW&0N|-p+_#c_=~n`%H7Rt3JCfG_ z$BCR0qT8dRSH1url{|Yugrj61sY-db{tlKG8?Mrn#iy~^JeFfl3J|*EG&VmPi%reN z_fLV@-I@rIF43utmv41WmW`kUB{!tdZn`JI*MlDq)+??Zg0U52?`Kt-62sX0+bT^t zfU&pmG&YyHkp1_u*hIsbKB4%jeK_2~aS@5lPCkEpf!NS0jq%gEmt;PC%j%vK$YAre z8;Z>$=Rlws4ofqUy=sbN5FJG1EP|Fzbk7eaVl%l`?@&3hEO$hv*(q31GiWo-@$@7=t^(m_NTTuF$$IzuJs=(vnpwllt?GbG@sBRUQviVGtZbl&k57fK4t z1t$rPjwt~VyOnlLz!jJoj2q)dcLEB63bLhG`u?7K&#kWNPWZmh^ZSE`PIuK^&OP_s zbIv{IbL<{~Xb2R$4ZwcdBd6MhjN)_>n6w=L_5h{9HvzbQRSLV8ZaLd- z9}cr22$A*zn5|5NNGu-~eRL8uFgv=nOtF)bz}}FLI?cv>NMp;e&xZw$`mc{-eZ-bB zUhgpWG|q7mpJQ#V-gJ(pcAQ?J|9hj0QP1Yb_C{j5VzQ(ja^1$qneY z{qHk~Q9h5^3>8*l0x^=46uVF0)b!m>jFw9D{{=zo{o8HCm|qEY=jj#PN7Z+crv5WZ zj5U-7%R%d9`u{f{VXVmw%%-hW>>s&LFldE9Qe+&>lJIYQx>4f!7?InE z@e-xMZhv#vvePT{{tNM*>fcdfu=YPCq>DXwzM$uIlm_XY5U5}|Q`-<*< znAr`@8*3LrP_dg&ZGXH5$WC@ZZg!L3!u#`VBPwCBaWd~Y-3JI+%j*4jHbcADB4CC1ep_oKvWI*jKJ@;GMo(HI?Z(Pz#sBJZ15yDBAJ~31UxWwa0iVG*?sqxnZ#HmGKrk z3wkLHemVy4^MOF@;jA{2b1|m$wGD%L@fV_voC(BO$K-Db#)12U{yXht!tc-joV~`k z<2?Vd!L6UTOU$$HL&Qx%o>q8W*v_%UNF1g0$+=p*uOI8cwi0RKiW3O0(VO_|FUI%D z71mR?GulWa5_2KmU98wWWr{tP@#$PG{vjd!>|?z9pD@PmgeDNOegr?LI|8V0*p9O;_MunB18RfZ=d(%={;w; zeNNhtsjt7ofoIymP|>xiMx8%GCO<40Sm^DxSck}AdC%dzjUE@$ImYAS^17xYd9 z2r$`BMu1ToR7BnXN=q669H+2P_yuO(CgRu+)94LCK8{S$$hzX@0DeG$zpg`fqwE&B z+P#;2AbvkeBZ*0h&Cci8=@ok4R83`VPI^(qrxA#~yFQZ^JU&9v)IIA5@0GhZpp6Q1 ziBVGpJg&H|SyT7P72(c&SQI+7LOjOS_^K_RHy}g{c5pB62yL+)hFYRo*Ojv-t~iJ zVx?H4K1zcR*SRwBqO3OBZp4`XxkIe;FwsW$cw&4=X^`m(f0{y!Ff-FLI3zZFJ&X4cjPV~7DMTA!S*#ry6?+1N&;g|RWjP>$02 zzPm3N-wZIKZ#u*otr&f3y6bi(03yNcb-fAmrshscgX=wGt~f|dItJ{0 z=(CUZ%ThYVrFJUT9!Ff_fYtmHYHp)6_=icv&?XV1R(fx8hsg1lax_&gRBZPAwy`1x zDn%oE<$$%>#WA&99MjDF&}`a&SfJP~g616nF~(mab}`;cWM+?Aj}CM10KYll)_Y*@ zX<2K)YtYLBlV@kIfi|44L8qyyk7upHN$Vw}#oydD-?IiMt|rF(^cn=Lqi1ovyWR}@ z*W;&Vbl*ZC{{0Ys@PsT`4v#VZ=DbxSYCbe+Dy;(hY6bn`tnDjpYIaKy{g^;(>ieGk zRX9QqJ>i~}*NJ(Agucyqi`kw|U;Q;%{vSU?9$A($``1Bw?e~g()BaOxCaM&B&*{XF z*}D7Qo6KW80Ag>9_Zcn4V9zX8?58A%Rc4RrNq0=s-p`b0pD}x<3ULS-?_42x=6(qx zd0FiwJ?)(KzI%`IKBYm;uh_8x#IJnMiAN~$))09uBVW-=bG8m_&R)8+xz7-De*1J{ zboim3eP(C%#gj-n-{V4==N|Wd`5vB2?pZy8+dgfbn(BAfLBs?<_P%6v3jKZAGEF`2 z1!AQ4ZcXOit(75i+Om|%o@csvU8kl_cmZ_{-g+c$BVl)Fb4Xv>LJUQMde)xeh-p`9tS&8gwBsYHLUg>X#q^u6GPvi`p<#Hf`~uC;NTp;G;x7Nj>Er430@Yanz< zj(%4QF|;F;$6qp9_^wcFAEU`)tYLw1UE*Gk*~o`!WZyU?{wd}%6@QHQB^j8M*?GqM z(y=P8{(ML#mM#0jcjUSELX&O8HESUdz4ixc{yQk@(h!LK@;%8|kPo{#U*zTMq0=>0 z<5+nW`uz6>pYKKQOU6OD#JcV4$z1bQ`#IhfG?)^H+;OBQSEP_OyzHptCfiIHH_mHQEydg>W z@(I8Dwa0)xXQFIe7M6|MuONmZLzK<^*FWI-)N-<7-(H~DFXdt_SoSyjj5#&smQy>b zPvEw(bzS>TDvbw}VM~m0^#eA??EBJm43xlj{mBnl&ky5R16KB(SnsGzEMDjRQ-0vF z*p`zU{ovkXgb$?5773ys0z_NLU`&_KDK*8tvU*79v;)V$7GP_d zsM6HM<7I>O%lc^MKKxSaHqk#w5MA@Wl-3W2AHW(JwLV<$?!Rj4-9x;8-4AX(kp1cR zORPit@qL9jSb~T%JO(uN@{PEc_w)Sdfc574Xx|K9KQwN%$O+^)HD12mml0Qpn63w9 zpEV%oSd4FNSqk5e7^IexgZ08`te+2V;n4G_!QuAAkBZ-&g zLHrv^gYUj089l|QS1{eDc{kBvDbe@5Glc#Bu4H^iX)p)0-dBd$D?;btGA5c2i@b6w zc{k{^1ne^?H5GYaa@RYUcehOR*?b%5+TVztEYsB9A^N`hUCBt4D0bW5h+Y@e)RO19 zPBWw~&>}(PNPEicFH!8RGK2}ioTs)*O?~fsYStd19RGF~*7M0YpIZTU=zo1j*b=3v`&GW1*1=KMH)hKE z1c6AbJ!Nhkr^KC{(FKg}sx-Cjdunz_(9oRKpNOU8{msf+n|^^&v^9M`yes7WOUInA zbJxV@d@;_MP5}EAPaMq4qrligu#USzAi`w*<`aCV7yDp#LV`%ScbsQSdNSmWv&o@L z0O|4(@>}o4T)!!?UdsjJv#@N`oGQ=OB#7i>wbfbYwso>-t22Oj&+Pp_`oU-ch?an2 zFP0#-|Lx58MZ5-o|2Xk}aui}1JpY|5&o}Nvxdpip+nUuz>+xoRNM35auje+qNd{wn@X$`E-kt3T-kx4%7a3;(^K-#zc3 z{gIfU*jJ>ed6#DnBTA^5-isG!>E%Tbsc27`rJ(f&1-`Q+Fd=?_0^&SFm8RyMC>wW! zSJszV-+hPvJf?#_nKjm)aqd{(5o1jTu%^kunUdZ&$;ss^wUS49ZRCdgv*~-H+eYkd zcOSh)X>cu3;)#ou_;i3-j6eRIO{?+lyU&PsTLYRJqcqsV?IObSz@BMOvA*kX%zD4m z^Zp~^{iXosR49H;eQTU-tb@$6uS?W;{&iMc$*|kj-J-3|QcZnWV4YnxK{nVJF3hIk z1oypL-gax;+{5^58v5bBIg0))W-p(WJ%@?z`@a+KOQo7RhwYIGirqRK@3=nyCS@w$ z)B1_o^gqdc|8j>0rJ8zmmd%J*TkF$$WQN@+bR@68%sFe;h_UC(5E<$1`|pw-I?e5S zvS;i}M)3HbxADAr@~DTm#|^IGGvjY5ldabkgVw9W`iWSt@88PoyY+Op@1SSBlH6AT zy!Hv}J2?U3jDCq4;5c)MF<^J>!hMJNnV{de7v;ytLN1|x`1YXKBF7KZoC6%+%!##Z z0f^lenb)66FHUhR+CtUNEWJo?uW%ixMF^F<> z*yq#x-Wq&<&v_fqrQL&Y@)0AS;|ElM-6=z~7I=LZ?*ESLa{W?qALd#*pZnwz3-bkn zY24qubx4m6fauHXP|th82gcj$BxA5|@GVF8@7+46jt16usNcnOcV4S3t+zk=c8b|+ z+-_7#VHIpY+ukP2yiNr7DV&|7r+zL6{;y|>r^x|&H|EarXF8f~UTZ?sTgv75FPcha z#L@Hdn!xz(<>$!8(L0;E=-r6p`Tw__$v?|%XDIt+@6Ms^m){&n4Q(%B%>(OzEQh!5 z6t%MDvamO&!)rIK`TqZIr*|hcw;iLMd-7p7YwMn~b9B~T@eipWUFX)0!x~kHTVT-?mBJaBW*D$+H#$1PLpJFfH z$??89?-lu+_?GnNu5aW@>ub4M*#CiWKgR_O3j3tY%KIT@9cnH2Cet&EL$Wi z$0_XC(98~zeGqK{#r{^tJ#_a@#3f?;X1feLFVp$FRW7m6cFw5x$zz@$+U4%0t!r^F zeIuM77)^KQ@H1}Nad;n>dX5<50Rko{U`05l}eM4YDk9wWwQ zqMm4j3^r>EWVGSyK~onzMtDri?mA+y`966QG3J+ntsEn#SObW}m!^2FoP$H0t4@tk zCr+wg#Go=AyVetf_LFsz5%S9V-F_Xk9R1pL;`}N@J@L@G%=oi5fauje#l9yWV|bSV zL|c7|9m>P_IrfYb*FM#k8TVGZPWTRY`}JlG^pIcp4z(Qp=UM%Jf&KP+ zLGwevsZY;z3_mFG69~@T&*%n<{XYQqUqlR~69<`1Gl!N=?BW(5%x)q$f2W-j0PF=K z2Gg1U-A=nAF5Fq8w~tc3M!SR`Yp2K~^vy``lgt?I{cC^ z?f1Gz8rX@@%B(Gw~2 zYQJLl-=!?({yS!WjFI#l(9}PrsHq*rx@sGLME}~d1vxtSn!DsWP5sg$2J5S(7;I*D zv@rTJePYW7QEg~L!$#GzB-cHSyBGhSXCB%Z%iWU3bkk4Rr+qB)Wt4pnhQHZ_L z&xXgNyj zf#0D(Z1Hi5O(y~OV<#oo|H3{qUd1|zi2Kki_!WE*J>`0VPas1i$zwK3tp4j=95?p& zfg7Fp)pGv+>CXEEqCUaz|CE5oC^3Go{tebmz4}VTCVzQ2*gcd6Ywm$HZ0vXBfboIA z3*@@Ujl^K@7W@X|J9$pAjJ20ae2QIrfJUas&rYrtvFJYyi1pdeXi;Xh)PeqZ4j74j zwEmIf5Ywkaa$-L5Gw#=N#8wmIcd&8axRDr-3cHK7$HsYS4j4?nY&=uUFGVA4ZtI82 zVdv+r<1h2#-Ev>qs*tCC`=>;S^O)=j;{IOL|EGS;)406HBhzaMk7;vc`dvMlGQDW6 zWCZapb=6RqwzY*2S^jv+{K&7^j}Mj5F>FW*jf(Obd@I% zl!O^}%T!`G`%(biuiMs0l}C{lGd&KlGHOBNkMJl?Y+H z%|#r4sU+-t$K_|4V)qPJ?DGWQj66gm%L+p`Y{2w{1Uu|EH5gEUR2;jg%aF06)93zsmY)t;k>9i+Z6K?}X9wsWA?g zP>J>1T4Jo(Pa75sUMo0>7&WV~?$Z2eF#AUK|4f+8)_XBq^V|IT%`f@&o7ZZOe?@7K zeRuO`Ir`_$=b!rZ&6EZeu`gc!hMH#60ds?y?s2TS^3VB-J#dUU)E|S6tqvWv zq3M{AAPTjh+mr?`_0De-=%Mr6`Q6d&)`Ma594Y3v^H}$v;ym0hlko0u@D3E~H{!in zwmsigJoG(i@|&Uk2;UB;!CK;}2O(&&Z8tUB@?le`W0>AjpxAxGGT~eL5!9Huz{ew z|CCbm@S7gGD(E9k=4$HL?o6LoZLX%i+>Lh*L*-6#y+`P03e#5=^uO@Wfclvt^w`0A zC+0T)h&4;Cz0~!QvCqyKe&aCUHv22PvEFy#}7aS;Ae>oXktkJ+RxKDV~* zy?cFz;fEsj?5(wk`EWssM!pj@a|7x7^VbHA)2R*1&M_u8+5Fatv0wEK#H2sY#%B<+=uC!K|YAw;^m8_lHNMj-EV(;GgF?N){XmZB$Fps!)&H6 zFu9Tta)sGyOs*u4xN;?z$(6bx_I)14!yaJT+rx;_vl5%jV4b`0eHR_uxGTV$Vrd4}sV=aUZS` zh)wj;C?V->0hdOXzv~F`&2BTlXC)Vf+n5~I*gB-DDDHbIxd?YB|%+a_e;`Zp!x@*|Y*_m0!4$?ONl6SZP(I*%eo=MDR*Df7F;fECOKqa{V7 z`$c@TGuC$-uznSjJp-baRqOZE+%G;K*+TT&}Q6~iu;XUmcpV>zB=2! zn5`dy=zhV!nji0@75|BoS^FVPQ@?M({RJ|_*#1brhX7{&f7kup1pz=#~UkVKxCVlGM#ge(ZJ=; zx1SB|AN)>Ribjt0{GWz+p6SlVdj5-H5E#_{;h~==++X$fvnPGy?)evwQqwtOhRQ)_ z{AV5I^*3YLIpy`DP6*?zfiW`XC!}bUt<&G$O__6?xFL^>c?RoX^Zq#AU(i!~1+?O$ zgYR9!kEN)|Y)nTk?*pj+ppcsLhlopR0f@aZ2t6lvv;q7|!01n8K?zHFl^tfMV zoWKU{2faT)O-9FG)VcRVQj?~d^=@9!EnZrd%X;S&&-wql2PdIWQ%`#%9iy{osM=Oc zrfqyAW%gs;)m~|orha-l=14>)663N7gk#op0z{bXWOUiGL*jl1_RIwni7{6^0~Gy& z4~nsV;PFEYbx(ZX5ybBi*iE(~LG)lhHDAmZacvUB9RG`VAAUUAXJ~AHQX1VSa(mes z-CON5I#RUZ>wZ^fpFbRNLk8*U;vV?-Yz#S>_2e^k)za{1qY<;KiJ;$>$-Y;fM;}_T zcP%<(U7F^u#hDJziFm1hy)GGSpT~r5`{roG5!-MC<7MKMn%#$Kv_{0`)ruGvMvKz4 ztjm<2>qQ-MCl846;)>UNh8t_Pb`ag~8iMXC`l)&O|3UY;$DsQhLHDH|x`)zq_v*fq z^%av_0DO)mVvb%J2BMy1c02)lHz7+_;1i#~%EFk-?bsfVvHv#VJ7#@KW-Ek5jzl_! zG%G)aR)M|kFf~EMEbLzgdVu>a6gx5+?T}fF##M@4$aG|3%cz1sS_w2rKFt4M`(%aS z5%zpY)QO)knvbzJbd0RZOmoeQj_q=F6|4od1>%_J=Tq!%+`EKrImZfl@~QU8MAUZlTTWdv=WfQUOLZM~{2@W>C%e#I z+AIEU-G#Q1LLk~sVD>~ABBePHyQM&}KlVXPb7=Wm0l$B48YXCYb%EaXs)&yi_Uc)$ zVXcQ+C(kOoPFxj4J~dM2Er9Je9Hr6r10#9t=`~sX^mzJtNc7WMhWhB$#e)AUAo_R- z<_NbCh+Ur5MrefF#$B%t=FLJ}o8F=-tO0OYF*P^w^P@Dw7cCu!{`OrGM9#_{r>BqK zy_$)2&H6g{s$`T28@YNckAvW6;-R zk-hhRIgMq)+Wdg$%~bI-NA|>Nd^B2&86Yw$yPuJo`XQyk&7)lWeYS6Mvgudg&h6x^ zee=Gs-~anWHSTl*OwUP_b7SPlV0)Vn0#|_SPb5epN(GZ8+FYjk%7SGwl|>l8KH3B;YcQ|DIt z4EUPzS{0pH^z12h>AC)u!8Y4fuOdJHrjl^~%>{__%I^t8j)!&ZyNuOYc{C*K$Qs8^ z@YW9C^5rI!FZv;@3CP+XyAv_724t|7duW1+Ta=<69x)YieYpX5Yx! zttlEgwTPOne#O4vgOr(QL_DE$vfDZl+qy}#C6!?<%0#1UlkUBn=mbzd7*-=23Aw_$ zJtQFeYK6()XQG+VA~aI>esK}x;|OK;~F@Y!qy66bY4@y z@st;wj_W`3EDWiPRYml2K=A_*+(&qbY$K^)W1#t=iA zrz~Dj0J_p$yAbkv9iA{id>Nq8>Y1p=Hi$OJ zDA0e^UAyq$@SevT=LMgje#AHD_xyrBj82bG8myu6p7SV;JW61SCM#1Ca&1`i!xSx7 zd>#%{v=QQS0Zh?~L2s8~XBWp#FJIU$yV&Uq03vO2c^W%CDOdA+%IXr(`yWo3lvMBh zIj`MSVXd&K*+bH(! zVk8D=y)sI%gTf|cbKYN$bDjj6dR7JU!d->b9Ld&mlw!xPDd5;g&8P7DvJmWzwJ5JTq*0}JaikO3aaml!y(%{#mdc%>Mi7tVE;n{cAT$Y%s*nM)f^>s~N zmkj=eY#zTXA;#A==XEg~lARa*qcs&{P^zrHPGa;k9Tofwx5|~_nX`{O{qdqwsI`8LFYU=7`K=`EHk$DYYeVDP3E; zlkxDfYYKEWul1A$TT4K1C(_Ot1R@%#SU446=TqBhgv~uBJy#B2wY3LuA($JK1Cz7P_eL`z|QZoW1uo{p#CM!z?U=fjYFPXtwFW@ z&UI`4CJQ0*`3@1!R1DF68EaEIG@bV?_s!NPreQ4IpGV6^O*!Uo)m&9DyMsXFnKhEp zn#=8pMOr>AYJRIwhd&nTo7RZ4ryO}`W}M#%71uiX80QYwu~T}=+&4|JZ|IPXHosy& z{O?pc-;~ED5{S+(q^4E?b}d1?k^kwCjlZlxY|o~=!Q)sd#*q~G3Qb}h(*Ocmfnr}; zD01^DjWYZFqC#^k?pu|@(^#-NEwJ&p-&UuR0 zQw(z5dlBQWoiAr%)8Dm5G8PXdUwA&i`$D!@$CNGmMcxmWE6;o6N-jiBmoVSw#T!s> z+$yK*`K4v{HVF(zwp>$<{`nfEfb&e>G-lTX`SVP7?0!;C*B(yGkms{vQ41mR-J+D) zS^$d}Z-zFH)8}1GjBW|)=XvS!DCkW!E?u4$bdicRRRc{uV~u3w0R-ABvGxRF{sqFU zkJ960!{Lvwm`;7C5@#}TZ?L`cGfIOu4~K>jXzGD}Nl(s&_`#X7{sUkx$5yfTyfipC z4eX~RF!-LCJ9y8$P%(JV{7(Tj-(8VmcDcw+pFF92Ej0zS+aNaHn&Jd8F<`R}y= zwk>i826%kEn>R525Dj{BAf_Hdj0`@W6GgoJ@lNa!(rOkJcku!5U3^xYR|(j+9YFo+ z?ik*^GP&`Ch@W~WhWEimL5!VU?$ogu0;g_d&}XpzN+$x3js4NRgUP^QO5@;VVOG&9 zus;y}viA0sVV^gM`?uv(xokStoy)?9 zQYIVcwju9a2FDjl66;H{dSgDLrB1Q$y;Rhewbvs5zImcz@v9k5LUFb>+ zv+^OF_!|ck+m=cA@C2}rq^POoL9{X-@q_|cdrs{rQ|y&xc%L&-ItDKF1UCnPJ)e}z z!q1f9-40Z9-(0L5Fiz$P-d6dn6%sH#E$n=EnEO@GXV=Ry=b*vxLy=>ztfACo^X(uI zdyLdJVtbX=Us-!H%=$Ln9)8Dk%N_|Ds)YZ7weuRKX04Rj?lMZvPyA5y4yD2JTqycf z{J%qBUcJTa8GvX`En;YJtn_LRR(c-hGhK}}7t`1onK4jcIp;Iu!zFciMyK!Ow=|LOx!QCF^&QVv~tX|GG628(u;`EouUmrBgJ=@ zO`N>6yjaHkY4a^2f97Y_pzaOU2 ze!0||!Rs59S)Ez+jZTYsWO|{bx7E2a{nxR~bN9QLWPIh+H7Pg*keocKO9~O=NlA0a9fyquRZ)hFf*>)3%{r=sQxjX8aM?})Q`-*hwJWZ{P z4L+NfGdVs%v3vT8baJDnUil=-uE)0E9okO-0?YhLydQG~IKBWIN8n3bOSY~z9-)y7 z-bJj_3%|sisg|%}cl#ll7zg$(1&V#o7t~BnlXM63Y#~jV$q9-bIzppl9@cW7FxAEQ zJ2(^fSDzf@Ij&2^Zz~Sb2pjLmeMLNGx_OqSp3KI43XjjQX3Wym3ikH|ykn`gX|#{q zlmTm@)BXV3jV)Uwp3BO{(RZa1|NN5_zmp9)c~2K-?%Qqx5#NJ|S9a+Z#LZv5&xwb^ z&s$}%epjd1{TxF%XeGzsJp7>bzASQrAJ|7DJZ~%vc04OT$Hkk#yMg2+utT1l9QRxR zi^*1gPdSt5ybj4UqI>TMd?|59Fp21iMrMOoSYu03u5%e9^sJgfh_iWD@N=}B=fBjJ za?BfR*cX!F+*{7sM@=UG_Y#QxDk>Q>@?kgUv1cW{=f5?zB_DRPy`n`2^I35W`6*4? zo3b!E%OJAift0D$A#U>2toB=f?Y4hiG_y9t;izQf0|XWf7iY*M#a?!R$AZ*rVa2ZH z=W~GP0QIDJj3LH|e1$r3v$!if=L>3f%L9$*e?$D}hA$+eBSq`CE@pe6lJgO>d0YLO zdKr8ED6MC7WP4++xSwD&l>y@w&i?}U$pc4_=MJP02a2`5Ui5zkKwwE&u^VzB+SkbV z82c{!LNY*xdPb95^I`WVeMR~kmk`rVUhDm8~>qAN$ZL3PFPt>x%_6Fo##y9APsj^6mre3_17(Y-N z)VMxTW%Vsq;=?{cS@5uEmz~o^EyQSH&w1vu&@&g(s;Lu}V$QlILF~<}c{H^$J)+Fo z@nYsYG)jYa*D+dGS^ZPN{?}gIgY56EXM+9Dy@=nib=0|CY%UJ|Veb{Z_Fu!(o_=_) z;j@x1&Ct|;zbNjqiiG|jl?=!KR5wFYi^mfDwD-61sD(aV2N9MRmy`1&&w>t z+Nw@XQ}*oq5;wQUX{V)Fv2PdOk6`Z#Ub-(R8#NKEaq84Uy+PDYZ6OfnbwfZ?Z()Cz zDfV@ujaj+kdExV|b)V{bjc?6=3#qN+Usl_+d(e2H-h*%6K;K zfEDvY5wm|+bKCW$Y&*)6(=Mg&alHEPkN-hAk&qxZ&CADsBzoJO?%us&_29jmS}hq9 z#ku{fkr8)$6tYpM~*#&Zi;w||z#t&fe*>Zfy_+mE_h#6^g>@NKL4-3-@xTYrlf z{$GB<<0MuMg*lfffXKXsDUNNtfY(mz>v?=pskOeA7>}N;*awA9{OulUK33<{7b&-P z>|wl9k*+Ut!E}+^evn2th&=uq_c`}KCDu8=6Z!0WX=HI2&q5}1FFr!e+P$=%oxlBZ znYHy-O5Bx`CDt3)yIAJ=Khnr^L(HjZfjg%UU&x%(HLE3Kfw1!y4~1XD?-|x-`p!IY zr;eUG6c*{KJk$wS5Qt=Bg(d@<`ucy+&Q6plHnXwGUo-NyVx5;q%`bTDMTzxUp^xd4^-P9u9-?k4`ZA=jz)%ie#jx>inH2&uS7P!Z{j|ZsN;VW`A=Len{Eo*+nYH3?)_&*jH1$>L;FsWc$$CwFiBdCh z#Qm*3>5{HM?!` zT@F6?D5YsE?DzP3y~t_m_&5h-!uHG}H_p}_4YL~(wIuld;nK8_i3`6|SGzx;e+%PAwlectg(bncE|G4 zs?2lkW(fiY(I$5iCGO}l?3`X9L8MOTC;dE*F=)MSBWCV?xx||CsT=S3&e4>)kKR1)!t>v2fcS?f+ zqBQavFaWV7Ob!-+t=Tjh@SoSnXhqKj`|A|biJ&2IF3&ev6q<96{ZOILSj+UdP~PN( zTw%$(sX4b!!I}qhg++EVJ_?GnIbdD=8)CGuGj|t_wq7TESG#DWC5&tI+nFNPuo@!2 zr8GF_@VS#C)p?D0c2`=Pf23x26*N4}WcIn}n`ub#H41yj_4`7f@x)$QA0-`)b1H6| z%-*dAO^w);$B8By6?<->&uEun)`TL6ta;u;yAx#|qwCNv`Ml7N3N^JIAkZ`tHu1Ho zFVo|riP4b@^=#kPiTL5GqZ0R>bZ?_k_V+ofB_lBx;t9vb;=cGQ>yp)yF_!VC(+{K3 zRIn3swfNfOHT8%|j3bQaQ#6YEtI9fZF4(87mW+cU-j(C`G%9vMZ^~rtEE}t-Qldy_ ze00<#JRhu&$Bk86=YNpm@;y0~(XHAdCur(ElNkMt=xbv7Lb3{Vh8I4i<`G8IM#biR z$yL_zt0m*L{j^~q#W9;Xe~u9`nzO{5Yrn!dUw(`^x2%?o?Wv*X+&4~B-#o^gn^sH4 zD_L{?-~*iV+7sP5cW2FcWY(PP#%t=!S#$3BE6#b2XU?yPIoGe2cr8UpOvbc|I+!6)?9)qSqazO*nEh~1QMUb1W&QqB#2)FEAXbsZ zd#wSN_nM#2v>!fxUNRm{A$ATMzvDMN=TmAby|iA*J(l0F#5(I!JTFInKqFdlaWVX{ zpxBAY*=AEy*+lE3;O@1fd#Ks+A6lQ7sl;n#Xy_^p-Pds10-voic;{~Q$m&;byuK8Ko)esozK=0i#nO#a|( zYF=E2XSFxyf86ndbEETzFX*K+CvG@;CwT6`B#VvRtAhw^(=cKn z!)!Q=V~MpF*AUp6s*YaS@mVPcv7^vc1uapUut&+LuY2^DDS)-f0(vFk96Y~eW( z5Oy%e9%5sJz^o3NMwmW57od^ZKA-UQFXPXYf1Wa1C~df6rDTNi29IUIN)dZogz-g3 z?^Mz@6QjA~6QwgJF7(DDy!t(lTjRO{96nku-Om99L^w!~Gk4-Gof4|a=Ye|mM z)FUf1@iDosO=+-=q0!wf6qO|mmQKQ9TdyZI(Bg0@ZL1$ z2npZI_`MkYQY{1`qr7vN2YSy)cMfL=Iwge;x?v^SrotY{x)a6Pns0wEa=ufD+r?}c z9uJ6d5j;2ijImChtrrW2SYG}U&e5^HD-j#)xKSBxcFNWoL57C-}V+bM+vl z=GUB;%d9!fPB}^&l7ni^$(D=xH08v`kwGF(dcNIbpA@w6zg<%ruu@)6r(S`#Wl~GkjkTv#Bfj zIxu|= zdOMAoS!s>gO-*LQmCD!gwYzk;h*e)lbViHB1z@-2!z#G9Oix@4HYL@wc1aK^9aY}Q zerJE*I6xyzuVb{oZ6x9|ZvKdxwFLu{m*#?gP}HB_iTOGFxj&5b8Hs6NGuhr!P`wZe z+aFJy33g(tVz1jJ^cC^h$=TlaCbr!{Aoe8Abrs5SNpGs->$-}q>pRN_=W|`L0`GKB z@Aetl>pYF^>uKD6?CrZi;XZK2m%Rt5**^*ODP|}2U8&fMy3v>M=dAvdp8lU%F7C$! zUrkwoxnxW}CNIYJrg!^{N4b9ru~090)5o8g^E&SBOqB z@XS55;Ue){d_c&}12po)9$LQ_AliDzyaD!`ZyWx$aW{=vnE%#$h{t?sYX3Tnjc2rY zE`;mY@ePe8u2gKbncE4L@(qoJmrF(!`hZtCyemy|=cg_otV?ZOE*X0ZAeNY<*pk3) zcs<`|NNL=Iax0$iGr-B6%*H_<36Z&fNttMql!h-nDtJzUnBPn5OC&wi;Ev^#A;!|P zTrzGHSQ~5)b??IcUHcuLt;_DH;rAWieVjrY`y*Q4kj$N&Y(!pob~ApjC1}Gp&t>*4 zHM)HlE_d}f*6&lxCBsP3Amim7DH>!lmF=yE^HFA=^cCBeD0A6&Nx9ORXXAP;PtnN6 ztiD21+`jfdCwSPw|5`2?4U`7iIx!uV?V-~s4Ym{5qm@JsaqJncFH~B8Jxa~F+`g)` z>^f@BVYccWa|R4Q@O%Et@_hy+fmt^QESec-X=-aetO`vm(?bR^7E&54Ers2&yMAW# zd%JYbZdG`wy7i7dGB!^u{tM&`XXi27zg~SX$!l-OT<b-Kw=2 zIJ^R5U{GyNTb$|rXM%m{7Y<%wg>}Lg)YJ&X$^_2Hdwo1kAY9{v)7pw4a-)~_+a^Zv1k|_=Uh#lK)#%!Pnfy-d*BMwBc=Hh&y|r11Z{vJe8D{)nnvXH0 zw|s$TN|Ng`rPhu8ybewM{9L^I<+jdt+>cd&{xd1xXUvyj)=mPEvp`dS&3UWbIy{2$ zR^_Z+M`+{|5)5x4Fk2h09BLZ@k)^rN(3mx^wpMpuEn;46g_!4tyjgAS9N{w(jbMMo z7>iTF>HP6_oSP)#E8pEt&G|Cc$&DPMQSUuT zCf{JLcZBDBm0BClCWg~T&6iA8Vf$x%mDzszm(<)xAUaushN@?=rsZ}%7v!TuU!ZUQ zMM{Hg9Ql++ezY=a((_xFCRKtaQh}!aMZCk~(B>;~Wgo3)ZFdt0SA(WjvbC8H@xM_T zyvnBBf5-UwSA#Iyu@(r^k6kQ`biA^4NZ?{T{W;1!T=O#Po)LJ*zFdMxRW3BVg*C4#<; z&g;I!HM~e*_>}WtZOZo#%w=b{+x@MG8h8@ z0uF13ymbiRwxIUnSlnfNG|0Y{t$jn_y^8vn z;bq@aGgTlPHTM_J_LcwY4rc$I=4#eg?2#0RCxh*k(%BI2CZ(1pK{O^g^+D0Dok%fOSsA!^vhaT9_} zKZrWGR_}a^Yu6O zkcsuoP96it_fWmm(%8>27^63(obVw)4Crw0S?z;svj6 z(MBM4wU^$v$+|S!rS}6}nRr9BmcYk72Hr83SybG7sH{$`IO`Mb2=36z?c9(XuUb0^}aKR z?|osfY)A^+rU5=q*<#}>5@XZyAbP`()Kv1IJ|aKbc#98WrQ*!`bQqpl7y2RM9qSL@ zx?@cOh_MFKW38e5o_0{}ZiikiGc@(u5po(!?A34iU3`Pcx9Z)zotk?%-cTTndH8s? zv2{IVfZxZ*_C4!azg@B(YI4_av{=7Zv0qkoNyZMuTjKljnPD!D*{+?a53%!Z9i_pq zvfAyL=C+&Lm1&>s@T@_HILoF3>^Z(%IW#z@3HVu7F_GDU3yPNj42SZ2)fj*db;I{45WP3@g(A1;D-F3S3TWWTvXgzBO<$55!F7F@2e!C@z zJ&-k*wx7FmdFk2AwfT9M#PRcZEs}oJnK};BsDpjo{!>xI`Y^Nif;^rouMcy+**Wnc z$51N`J7eKF%_&dZ$aX&FXc=G}mA{&r|F3##*?#1GvK)4OtSCR-dTBYw9l4|_|uQ**qCUB2!=SX0{J<9&I^ z$9-IHDY4E^U=7TZvifVg#O?2wg8rc*P2DE2I9Xd?i(<2zZ5FDZ19o@X=fI-EB4{lnA7W}n`6yW7U- ztTt9Xn^~`HC~QsVUbF@z?vH(9L5jzTYktLU^&{4Ch@F|jeqFpE6`TsNCn2~0dT6}O z%$!Nqe$G6B@#9x)GLIOL7g+Cox6i5FjCIJOOkeqS9tjNQORzxH!eYG0cx>))#l9sU z7OnAD^ZUl@@_a_X2bTuOz-0FKA9H<13sLNtznc3AmX&Gh=taa}Yn2puUC#QgEo1b4 z>)FypB!D_`(E9H@Q9n43*@xv8DdT$WrTL49(e20Y>dG`VZxK7^(eKt=rm4O~#Mm+@ z-v@bvl)|RwFV41^{!jz3hs|#qD0Y7kxWACe(IyEZ!0W||yux4>ey;?PFSL}&$2DK- z;`j2?K;J))7>F0UE`x9Sojl;Yq4R)|9|*5s$#kZMJjGT3>?D`3rIzhS{8eo@+R4T9 zL~R*>Sh|K-Mm{j!dA#rU8FTVs5nFqMuL0J*cV|`k7Mi7nqLd9dX@b-LKxqY}gtrwqno zU!bK-)P0HNeea=#B*5s=eS}62%94J$1TnrB^K10P#l9{kx7qKD=5bsfPWvy!9sB+f zzOMV`@jRJWYd$Puv#w$@%*0XD3Fa;&1{|WXosdG}0WUV*&5b~quXEs`yby{1>EcHPVduBnorp9;< zX{j}m&4qy7A@C-y^P_x_a;x2^fM4rTTUlv&<5;i2jpH;sfAZln>%eE!}dv^FB0s;7dja4JCFf>rDUxIX~Zz=YC|JG#v z{3V3rE0>M{{i>U*^%yBxh;fFc)`A-}b=8A{w+Y1dJuS}vQ)~3*6M@H8_1vJT$32s! zPf41(>KVKv3V_yo&SGM0Az)Vm1VV=}CPV^dN=SkR2lGodh!GkItJvS6Gs3*yUa`US zywbGJTVOCbUBN&9ati9GPTu~4n>6)j4-%vPAdP0^#bo$MQQjti$sIhKwxkdr*;BKD z%P38PD8GAwJY52?8O=hc*620!q^?j4=#mfYnt7zl!O~#wr6>({c-{*sQpUTX7N2-e z>Kf|ZY#I9r;*4{hx~>FeWay98dj5mB*Ss=qtI%T>kams$on_^P}EwcoFQE|_Kc@}peLO+G);|ST`4}U|6#IR zjO%wqnUa)q!pkW&+aYIG;xKLCxl(={Q`=$6$CTOr31__H1N{fj7?-j+$x#1yzcS^; z;qDk2O_oq<)|Np-`+E|{Qf^-({=ZlJze$>1D{1OIg<2)+$M;_S8LY22C=LEyLf_Qc z64tKrNlwlNwtpAX%Sxc3eG$y=DTc_7N+sUG#=c9M{XWyTav)OE0ke}u5E+-FsoW;= z;ddIPk*EE<_PTmV&auvuagF+F*|_t<*Ya8+(9p&C*Uw|tW>8+2tf6KH))-fEl_@pb zVRlG{$k%eEwdHs?W4m9mZP{;yczb!gy$HpctBFcpx2v9g&)WNi@NHh1i@AXR7^SIC z4+ov;Ils;YUJr0eF6iG;8vI($v23~0+BQkCD?#f$OID^#m0?P54%Abqo>faA^8c~+ z?eS4n*TQS>GnvE?Vn`;L5Rl9S6dCHPB#@{rCjlSDUaN+#lBqE}@>FXwN846W`zRYlH%UgYHmw%T%;5>>h9=Yqf8ri$2= z>j7Ld(n0IybehKPrgshr{d@sH+YJ&_Tr5GwM+Cx~lg1%|_&B?^#%-UU^ZZidLx=d9 z6^16%#)2px-c9p&c>({RVYV#yJwm|$SW=%Ywmx4o`>e|r@vR8=29*UnD1>X1+Ig$v z?Y3=Aab9XvXo`nW*fL3zLlybTxP`-$g06$UBPf?Otc{yOj4{?+@p= zDFIdaO-$&#pYvQ|BENeY&-s!Tssp(K_ghDd+hR)(N)B$9tIq(9@3)C^dAoU+S`QCz zIKpw27U~YD%BwL^^P!_qZWlZ`jnm)@F=5N9cYr2*Asr#R-h4nJ!*Dn`98LiTQI+RJ zpV)R!6QpsOuE_xvR(tI8C}VDXpYI{6Dq4&M)fg)~ZtC_a=SWrMVUd48z)4hPO^n-g zOYQJs|3Y7DP0(}wxc*7;;?{i|^84;NW_;!AX6!f{(~9zT>SR*kYrt z`V6h|3{_F@nyBS&C3@7JOP%mDp=--lqK_9bvR!Pp@W-_?6)2Z~X-PPe~3vB25V4dsXvPWe&c#nENKTMI=d^qEVhl55Grw?s_nKX3NI$ zIcXY^)Gnm89b;g7)x}e^4@yv9Rh4e3AXJ$Jz24_1X|HT1LT9`pZm-xcfnJ*l#l8EH@mhZ?zwi;N3Us6(BJx` zb}f@cEo{qv{~^A25$+ubuT6Tlx>$_y%9i-uMhjzZw{;gg3-!;8ad=)|S<88Kctvs_ z9?=KFpS*@Mwi3Ob+sz~m*Av(BLep=r091vq>9r-^rOf9Tl~Sy^8AjO z4Ihn#@Vl|}3X~&0eIUmDy9Xuk{Urm+Hb`#YhA~j8*2?QQJ7EuxvCaX1lLSlmQ5XX` zKf13Y2mJ4T=qZoP#(qJI%m(8#3QM!{z>j0y?39fRhivSZGD2c+rH3fgDQ^z3U?3Mt zn*b`JQU=H8RK|i1kShix;QL6#YCC){3I7_Od^VId-A0zyodN#Jbl`Gp5o5u>OAz{k z%cr8BPh!Gf2>H@M^H~mK!7qfJs-k!qSsHPJA9)Fbj6;<%<}Xabz4u&!`zmw&>auuT z9FOOY&PmfEm&wNd89Z@f--_$AnCIDQi(V`8U+ftaz7+u?Y9sec6GOWT zaDMsRR@^;XRo-*6V5E=D#J!x2^f_O&rDux0enW%U$Bop%V>>#A7?0n0dR2VCFS<-s zt~TF$mOA(uK&-qjuP5cYx&r*OR>p#rw*<-^4%joh6qZgYoOfU4*EnxSXgOnUq=6SG z_-BEt;91jw=ad8X;F)lvQ`FZ#6QIF+OQ0Ov%p4MTDxWz;4uF>4h5R|bf8G$U`&PEk z30Gr(=bQWJOUB%&Z=RI~(JnQ(Fg|FD0bmp8V_RQUz<2>(AJXT5MzBy*r znd5u#3s_p|;PHO^b5s&>6~$Aaobz+Dj{Fy98*BVYF|i*aGi0M1b$vWD0%vG5?vHUF zDK!hqqBCSemE;QVM9`Wfa;TbszxXIDZ5adpI+Jf?nf*8cTmv(}7+5G9C{y5j5uTfO zA|LO|A(X8rhAPulCHMXqkF}`JlLzojA`ZEtnn2lUNq8VL1RiFXc&I#GRo2It`yii( z=$E;meD4tMQ9s&Sigc(0u@A90Q=9&hF#F|<-zJG`Xd!&h> z?#Ys7(csiU7VOx^N^$JtH_L`9@@ZETzXeNqy_gxYvFWaf+Ju#{VV|7Bm9b!$0=Lz? znF-qJi$wmzqmPK(Mlyx)+7Y;!80x%8RbEMfo4K0_k1y@MNZdmod4%d3?h~YGsVKDZ z392`v9?oUR{80b>G1Q40pm$+8!ioIRI~E%8U17h;4{hdl^@310pJ#sPId0!92pyO5 zxt!L0v8sIh2-O3V&cFWDGa#ah_ zOR`}%AG0l2i;flZ>E`mBn8Wb_(2m$|Rws*N~gFL%RRZeRmI_{IrW1+Dn zOI50FE7cI*4J~31ze}NFc#qvRQG0t($XA2ry?M)^h%sI?N7(4kHTMM&2=5SM?zZ5o zn~H2X)C)Eyjni_8fbCb!@$>6FH-?y*0oyxZe>N|4vy=+n$Nw$SG@SWtC9c;0hFFNW&F^d871*FmlaRu|3B zg5AYHm-@3{x0izdnr5Oe`gXBaU7#ve{pP%y<1w%<5c?*t#mfJj7~6KK*}lcrerYq& zD{cDA*QUQa;?$}EeBod`=Iu{;EckcE+*~h)3|`CL`V2DBEPcOYtl9;U=EFGu8#WPs zf28KZZt!@u*hZ3YM`FKMvF^hEa$k(!x7<@pT}gM-;YyH=*O=r=$gP?OMt(l@+G7u! zH;b6uKQR_;-V6qQCmBM9^1$qUh@)khR*qn^UVlFHdYa?8p_A|HJ1K-a84D7gCwlfi zD@XU&O+=5nRR!rzM%t4v(4hHzZG7`cUh_ZA!pFjX|AO;7#F*RV61k_NTo&UwZr!}r zG2$glHhLuz0$R-P?uMV|Bt9Ry|IJon#;Xn6(YKg6p3gIL#l z@o{MqZ9dhM=xbC*ApD!8_AR#dho3Y3;l_$PU2ONm6UqJ_BxKR0oqupY_${DW^!%I| zSBsx_+i1Dxypi;Kx=FtlFG=Mq8}}=RP~e1EzYYRnJQJ_Wg59$ygr9tl=!>c@&|u5? zyoME-sw!`rbE-6Pauu#a(mkl<1GM@%qSsVipe?$O@II=is>%z`5q-Z@5bBZgLx{J! zv8qxvcs`f8zSBhXf0%cHj(ljWx7Rbifwn#fvTQ82BX#g(#oM(Q=cZ#^(wD-yDh}zY{?>!4b0Xlo1YWgq? zP%uzGuzpkN?0saVyxz0ZvkNjl+E5HdhaM&1KP_plo!^Sj_1h+`cu!ZAU-P@N!i`}k zX!~t-X|1>rTobU>k3VYqJ)Mxu9OJXiJAlbxFbax@e0&qX?!Y~?M?3%$qn=6Ju{4r2Fln_#bZ`PPVh4AvYh9>-xX zHesIt#{Nx2@7W2Oz5m-yxc|9{=#dF2;4U7y#|u{2o?&tQsjMIoNSG~oYfJAY1foOkFB$u;aV%vi8^4dHRiUXymo<)l41 z=g#@BP(3dndaFy)G>-!eUjJtk(NW(W)-67osX^}yjXpb4x6tt!s7g&qnpT|)?RMW7 zujy}SKO0>6uzP(;nr7wxi~E<;P?WJ=Z{v40D;_qWfOg3%D7!;xAXjd0#{W*)nDPqM zW&E5i8?pp#Kg@#dZyuh(Z2_Bossc{6EAXIMua!c0>n5V>C23k!7Hr44RNV+#L@Ek( z`c&n2o6H!05}((?XNit$I1X{c??u5iV@Tq8*qR4f7-2x2>0SzEF89LFqUowK^HHh? zK802sYk4*p9Y_n=!guzpK}nYhlw!XpU#5DhyhzqLhVO(A&(Qi_=Jl$0%xcv+s`6ER zJhpVvIjZtSJ=Lw;m=^AaYwhI2Zd?<@A@bfMFH^k(;x&!ze!GZUnK6!AV65%8FAIM> z#4ExP$d!%LheW*!{QMPw-#sYlwYgwmoA+N9egb$d44f1->jE)0tV31;w4v@=M`fer zQdRMIsgsM;OqwwgZ8;L%H$LtpJHrPki)1}(ILuMXR3gIhF zyTLcb{dV)%wn7fWt!CQ*K=_)W^Jev$xlHl*sYBwfq?tna8k#ff`i(@7ZRBT=pvgwi zh~V4Xaj#9?B!26W@xJ)XD^|;`ky&7nT`e+OHg0%X)Us1^<#yGi^BLF&fzt3Q zdHr~VD_b@m7?kwc5-hpmH1Oj)Rc#EZBbikr})m@a7q+0%>a3@7DBC3?dnQY<+6=L-#<$>aLv*{&Bb?GP&ex>3ye6rt+|HOg zFI!cXn6*lOiR+guc-k)pB-{&pt?u7Wb+#dKuGQt-XVM)g;k^SeA`T|zTBsAn?wJ({0`zL<5@73T`MuxR>TY0ebZ1suX%>(*AWQ+-qh1Q z={(n8MTf|V-&Fvj7Hk24>lo)ByjD-wB?H3FBBzOba=5=Y4G4dQED8KUhi9he>5=yo z*kADngx59w2q28Sp2yPk&d?T3P?gQAMUAT~2Uzf0$e1}(0$z6w`@H`d!s9wbe72yo zLqjZxdl7X`lpQSizAtdD1Y}qW8)3Wh}JScewKJQ#A6$(vsI;S!^j*I_89#W67e0CsPC90@%Z$k z0HpycS2P2Zk|}U?u?kB)g>&!w9tD5Y%-#3NT`}%ITT6la+u{2vj~OW7Iv>K{Oa=e{ zk3r@ym!K^#9kjnQ=B{yq_61|^Hwd()rNf>-0+cp`Twx#UCj|UIhrC_bUkmqD&kKEJ z`rFCNV!<>A?D;R6*3ie8`{xeW(`)j$_f4EdUC^6w*RUq3o@6a;tTt@fwUiv%Lcs5RqFkfts`8gQ zs|HC?}!^3jxyObQ-Y34rK;Zzk| z`<->7j{YzIxpFU$`*W&F*a;fka)19@*e>0S|8pW8O=v(K`dS^;zp~lDl5L16*Psj^ zdDz+dbJL%X>vk8(#?>YdIcNy|WE};66NSE`?xrIBQ!?(%XNWF8QLfdU#`W3lRbP~A zS3N`Y?y=CwW$P(pkpFR6F8U17Q5M?Dgl~C)S$|}=A?XDx<@G;&qFlq@H{tJ+kV#82 zRi$Hx>#gKRCY%>qdH|Y}~aXR%~EXl?_ zt6(FJA2uYNWSBKKE|QInQei{hfQTP&HRt^;3jWV1^dV2I*+<45d|J$#WX0#5`wY>0 zo|Id$|L!c!UM7-Qf&CQ8={Nj1PHN#6XJrlZK=te{ncu19gi1 zsH;eh(A!I6!IkNGSFlGH9(DQ%SUVf&45$;KLh2KAOezX!kw zm~pQG>pXX$j`>z{4C;34u7E_+_+I4s8YQ)Brb9N|Z^_1IH180v(+jGS0pJR(D%{BJ zezyktt7?S*7Op?a;i>pF;^}L%4lsV7^3}?{B!@J>EjRWfd>*roFxNX7>qXtI>Z&r$ z+gq;5S;F_#M)d z#!vd*k&!h1X-VT}CXGKPY5c6D@y8~OpRFbH?Zh0xH1rx1dA}{&bF%!iED{?L+m7wG z@w-$ACFgwmeRteW*Th&5WzPE##zxrso@Q1q%D9d1ssl0iH^KV&DPaBHD6p!dz`Df- z>k1Rrt5U#vX9`%)JP>oo*Y(tRK6VP&i$;O{;3%*!v%&tU3A;B1?0-%H`|n$l@)lHls& zo)aCpAOCXTU)zr_^?Wm)(@ufsZKJ??VkkAN)CTK6hXkxIrGWL|&`4P8PXX(vL*ESR z1EavYdlXpz9ErpFz6oo63RpW*z*`Tpt+T;;uLhmunzt$HLMFqf%O_2tk;;ZN-1Fd zK?+zu>K^&tB}0ikdCpVcJfH8JVm=>?GN1ECnNNvrK4+Qp`9q4cqd3KUwswCrtOcil z_1RHi%@_sN6Q9LlWrG6Nttnvb9~=qmy{CZn>%nh^^{!E1jSi-U^|v-yKQdvxHwCPF zQowp;3OadzFp*B$^>3cfyQi4XcSo7e%cIQaY1@3Zne(|M#e7;)%%>>De1b{yc~FnJ z1G&&E^uBTb-)E+Cl=+QzW(GbRd1j7HF~3x2X195Usaa|ls9U)I`7axV|2dzNe4+N^ zMlvEt&#;{<4~!0gwtNtIc+ziGkgh5- zp0e41ZTI@knX&-{!j5ASztam)QO~(K#@fobFAlhPU1Tb3a`@Ze5lIIEWls&UQtSPR zM?30lhpZo_Uw`0q@DUozoOH*=Ho zn$rZ@K1Nt5l%~oxc1$9n-y>X^qCR*Bh&zPe9+7l4#>#3l!JypFPwnD1{v#64!5lF2 zKU()Q&5X4r`1EH8+iISfQ+dx(Nw1}_WS6k(bdAh;mdA7R{`RPO?*+2)mwu`jf8|(O z4dRabh_H)~`|2BT)(POxGxI9n78CZzJOCHZeJqjCBJ<8V5@T(Fsj8wJ7dfp&UDo{2 z^4DU)fD;UevEjVJH<|T8Q{nG_i-#xvMLaxe!^6{vhu(i5555$5@YwL6PF0nhBs`R+ zz{8Ypzyt1agrlTz&V3df-=p9UuD8)|1hmSWIQ@34CwiwR?#qTWtmyGQXx$GAzC(p? z*GhT)`A>_Qx&fzb6#mGeFSGo^On(v z?1w3Ahhc(y#wq-Ec>ciQ`nWr`4IP$T0vDC{t>x=1;HFQ<`Qz1gc*-fSk7vPiUkbcr z>50CR|6982JMyp5-B(BAbT@E<>cvO@eY#sWG?MOC55?)Od8(@1bu5wYrVO$XboWr~ z|8D=i^e^HeWW&Q7h=;*{9}n|V;6b+GAu?4}&QHRF|KvzK%>4#Dj0Q(F1^;VL+GyrEG*6!8y;D}I;Y0d2`!4&B4V*;mJF zh(bH=m0J(Qf;g9frv!iL7-ZqE|BdtHJOAQ3mfP0xQd~z!`?uE-Wzghx{QY2j9pP+M zdFN>2I==aiLr-4EuA%=sdOmshU&F)k!*M(~5D$)j9}hoEfroWAJb2Dlm6b_&Xl@&M zp6vKP#6$bPh=(>C9(Ek3dU3|Tj|YDWJj}D!L!a<%_yDk4JXbt3wbNV=A?ua?BX7fMJ6VJ$spT*C}wRRY?9GZ7>9EO*ZV3_-4 z;`tbLi99Qo?!o;UP8WU+7EU`TgzvDAvC^SM&x()nbkZ2p#TdC(-#w=%#vMe`!2j!8 zc`UvWnFHD@PsM^NfwF7tV|?Y%I;X_Ps5Qr^c8fYr(J`_SSyTPWYychyb6HZ`$}?^9 zzuA^d6t(>$67hB4FTXMy=%IfMFn@XSxVE;{X4~ilRrw94_Z=hr{f|f_6ksgqp%6aP z-dAawR(E#1uPZg8BYrGgMYWMKoE69Shd$v87cp~{|G8Jv)w5)SF!PYzEaG^=0Bs8a`i@I9q-Iv$hx2>Ck?18^(97pH#i><( zTU9(+(2MiyZA_fs8gqWv0=Sx-a6u#+{3j$S)Gs+ghLjfSA25Bg3ADKY+MArPR3_kW z%7mqICiwq22FflwAo#SLAps|v~uCwqt{ z^6X6r(M+|ga+=5u{13A>H;<)-aa!pTo@Zw1iQJ|Qm-Mq>|IN^PP;!Ur9+z7`mkL7r zrJ_)pS)b&$&&GoCNmhz_MYB^jUK(J*S4|xw>M~=FZcg0$9TNE8|4A(Po+0?V=QwLS zrzaL%=exq3Z*{i7S*Awx4Q9Q_ zkNN(nY&|l+s`c0nb6QU{RI|-D|cED1Q z!0$|I8?B7DJ+CpI8*(4wWek)JJdyZ*-No_uC!6n+(?!j*Ix6yJl^4p!(*(kYlG;{( zC*Ia&w(ZOoKFRqG*=VM+A*VqbamYp#ApA*E`_AtQJ{FM*LmzfJ^kN6_yr+AT-m9D) z9|z&*xX%{(?H)KG_H7##zWwd{(YrbMt)orYylfyKJAcY@ery z&mHEOi)%YO2e`~N?Dq?5S1hT|1lykQ4Gh=Y;l3(ei(Vdw`-LYG=~YgmS4$?b*B?ZB zJtjFqI{?Bn353H0!po@0$&b7onn9~*=Xy-pKg`_ZfkmK|wmbCZ7%Te%^%kdWly##{ zlOOuklY)0fhFCai)}RaQ04?V&$MD(mSH5Ro<#V&*vm&l|e5$oaXJtX}$(pp*lRPdb zenzkr(2hKpT?R%4fi_RNY@jUV9U~hp_}?w+Kpd5%&=v~eS$3Rtq-&91wVJi04N^IDh*DkBjUoFl+lF|9cp~HS2Ma z|L4d6(YvLI!X|wOv?K3dburZk@Vtw$w#R}*oC`zDKVyt+9G9rpZPqGAye@Xi#*I{M z|NJTO-V1}wADJT?M}LvS{kp3ZRr!w6Js4rs&ou|2l2>Wu#RDWV^jz-KfN{m30^ zd-ojK=ybx>UYMD=Z&h(#$ErGCHKiYV9k8c{mV8)4$)m&pdpzKIw3fn``w94WJ)VRQ z$rY-euPVnLkH^O&KGxds@wQpRzO|q5TsN>%USHx@74HhlbLMy?K__`U$7+74sUL9# z!?mLF-s3TsTt9lcpKv{@gMfcq3RpV*s?ue`(voG$|0XOOkw3U)BM;?^0Apzbq< z`?da1RS>Sh{*vgz-?wl$Ki%9uqRS2_t51T*d#$P< zy}bB%JkA*5seFRyCw`H`V-w%LP{cuOz7F+7SLh$hMGljT{we6@>wgeEI!897>s6)O ztQB;@3X$gv+m&3eDiLfmTQ(}p`E~CloF*iPY&iH_^FrDeM2C~CG`d1<@7_uHo~Waw z;pQ)iE)THMsC4Bt05XQ>QClJCbMp>|9+?eB^8jn>UZJ+5Ocm)N+Kx^KuU&C@(tIng z6Z5_6@pz8q_tnIpHVpUJp%sdV?_6kNohd^ z_ld-~h30(l|M8|+@W@@`wavLA*EeLSUBA0q@KeYYvFXQpsD^Zp=OCVkIL>*8sg8VK z;D3B*+w0~TNFeNgOu&Hi$usAJ^N8lD$^(zZYog*Davm3R|2<>w!)+#yWNbLTXG1&D zfw9u=D{w54n{iB-=z$n3RjF*CJW4_3yeTbA^yVQ}I`}HpqP(V{c>nS+(IbPbv@TON zB0H(}kQNj58g7t{y7wEqywH3Y8p)nwAcr22z(3_NlOLII*A=J=uECX$#pxbl$Gx$~ zmeU!3`)NDTRfCmwza+O?wZJ}WBYLEtm5Os)JewRQy4=q=4B&u0ksH83egF9(=2x>t zuJu3m@x9^e*+O|;Y3v_mw%^By9w1OQur3MC@dC~%HXNg_5cwaueQ>9wUHvu1^N{l} zo|n|ADsT4*J@SPi=8yb9HX^5kf$NHN@cBz}`$1_!C^80&0|@tJxb|QiPY2{np&n@> zm&3X4`P=cDXM(6HWTZD0EiiRAq~W!Qqr1j){k407s$6J}os@2=`7(%xH_7=J1|Rppw;gbg6NyhvM=t}56EfSQZ^xm(KPGD`7& zqN}8T){WV)r<>=|rJ*VZ?AdwiqVn3Ku(X5M`^vkbje>z^EYjY+>xf>LmN@>_b#b1K z^7%q=9BMIh09*OM5Eq3LA@_uo7V0qLnh;;5S+HBgEeJhVoSP(MNDd*N&k{WD_vxTB zmez{<{W?L1eC(>ZpsCA?w93;|WpxTXxE>StF4vp3si;)w`)fL&{8V;nQa{z1s)Bvp zxh`%Sz&<3z<$1DEx4cMOeY&c=vP_((4e7vZS@tg`TqeRbdw{WEfb`EiFR5=l)3ERB z*Tr>RUI+6$*`O=s_1IreI_MpPNP{A8COZ#|pYU2Q{WB*d^;emtDqkhFza|58Y$Mvc zc`hw%o0Z<jH01!fYE|BjlH}1 z&mo8K{E0%itHCx;9W-yQssxr7X@d=k_rAEMkFOJYtTje*Ub%o1{L}s`7PM?H(Zxh_ znrr(;(l|IqG*?x+8{)FULB`z1d9txza`QMl3(qyUzd`LXW`MD&-Jy$GMWP1#<~&uI zu#D<10^z2lF%WNfo*gvvs*0RP1zZ+cN`T8WEoP3GYJ>4QV$P{le?M7{ogB}RXVvFz zG4s}_W7RJ32p^$W9v=1)+6@5O4&#;URSX2Lzn4j1%R+3HRp4eS1utzNdgMb7_x<6x9`tHU8%FXF zX&uprX*($wq$dOXO*h7ZPv0cB;u`RNE8!y?^-m|&FkZ4Yc*d9->(3Ha8A-##3jbM zupxdfq&p!4&HB^6>!qVye%pW<)c$|E6y70N$@TH_TpJZjv zoAfnYgL|09g#6n~?rx@=i4ML86m9bzqWA5)B68>W_$if?w z`sw)4qg9`-D*xnmU11mcr5S(Rot}u7vMku$_Mt~Ro&qo5t)Y6vtUr!@te{~0{7YeL zS0xC$K-9L_@+AwleCXkPsN^(N>AQ>S*#NG)ZE)e-s(L}I%n-SEpGz^v^Bacq5Biev z85R0i*Um3RjQ#Tj{Qqg6x1VUyGlWk2@S}0v1p6&&5HOSCZK`@j?Vf<}Pi(t5sckdjzF1X0Gi%+yks@D~2kHBH zul7Gb<@pi9-YnSdz1*wWeKVgj^V*)Y$w~2A?NWlAggmc23wFD9c{JpGhMALUhgVhX zauUkXxW*sc#n&}F)(-pggs+jeL{(;`SR33MNbhq2To!Hb8>a1oPD~}4=zAMIpc!s%mc{q=ZO775($*S@M_KUPmARHOduRBDhi2O}LR>=>s z8DQ*ro#(Fh@tTzq_`B@wB1G%V6nSI@ABo>>S$PomJ~(Bzm**H_{N#ApokUrKs0xRzuQ;h!-YFEn$5`@a39$O9zma2JFS zhAoR@y!MFhgmH&#c_l1+83DQ7;#HLtN&}DJ87R(V+(%XQQ#2@_qCNUZJl8p{-x-ez zzkyUb70L_?bD-}Q0{-t?>rg*Mt4!l}8@sW;<&VVeW++P^p|XLxTQ!v{2#|_ur(8iC zq~bIu@Z4kLXByRUayuSa4-~(51{~H>*!y$541sLP`OC!_4 zn8kUlTv1J-y>l#-HHDxrgMhzpZQ?l9S*jAbaEdkqz-3%G1$A4kTN)pd#;OW&s9o6C zw&j%PuG3$HJsoM#){QcTL+uLWf+4GN1x&nrZ=e8-%6hqibdXSW0T}XHxx&*7A^v=w zTtQUxd81t637F4yxq`^%^QYwskH>tzNv`mK_$+S&4PmIfO1^ipqhrB67t2pJl}tWF zDfr(JbJ=dqh3DabgDfc%^5#Zyha7nKWL8-C|fp3HUfxW3Jv-@p#4nLu=ZK7^-N95A)5{U`PH%DvP{`H z#+V!VNq|CIWHN9%#__AE+>Z1dnJgRLF;GSvphYKhdu2r+TQ;JTWdqj&@n52XRt)q| zmAMwPvS9lOz7`^P(xQo~Qg$cRv45WXX^4eCcsLOkEfdALeE8v!>+uMHpQ@nE26_nP z7I4TfOx^}s&txz>4tOE(j$GkUp(5~O`Cd;wR0IlS0|sx|>sbpGfpg_{&pPYbb$dOH z*5|ACdUWga<$FC(i_e}-P=UHKf7UEMd$vNwqDiu`nLt~0k!;ig;k+rpX%G%AM%_%3 zLfwHFk2%6N)c_5Muc##KI{7A_`Th~+Z@@XlnBN1mp%&l}uU+jF`20K06Yp1F_&b#@w43^Ou0D0dZ}N$gljX;apr*8L(%_mY1ZNHSye+NSg}*4n0D_e~TUe zyFnw~I4x=q$L}1G4yUaBW*rRoffr=MGey3q6Zf;DV?qAK@{Qn)#(+w z?=pb4^>}s@2=6~AWR{LW)^<06aN8i`d3OVYEWDlq_s?jgzSFnD zRn89waBYf`#;H70)PfCDx{J$Nh^HYIJR$f_n-vT8(&v&c8>|dz{Kq(tq&nkAY`ny> zUt2PTJzq4N4o1ys&{j=lqb?1?Uo#dg&4TU44!EF&g8%SCHuxMwtDL4P>V;FZiAgwk z>0u$a4fBYkJkx3>_~!*;K^^6VmGXK#qc%@dl{t3^pWj(1n-U1`OB%0pn$Qg)X&?8P zHTXolm^knI=Mc>=?h80Cu04oyZvK+zDflC-sjG>?q07_2|0)slRWo5vbUKK=2~eSC z!qw5~GV*|mAV3-K8(a+tAM(H7m}BDl%%IR_Oy_r3KF=62KCeS{P}1>ie>BE|h{Fy7 ze&Xm@;FaKBk^$qwP8g@}@HTuT?tFM|q6G&f9nbIw%r>1d=70T|hzF=TH_oe1yMyYr z6pUY_wEz7&Wu9<*Zg)#|;5xw^GpD;LTXH*)Pbgrmu!uHV}uKzpW~W$Jc*K^XzcR7~CuRJ7;S4J0frjeI4=q$xk_bhdmDoy|mK7b)fB4uCuf&9vZ1r z|Lq~7yG@^b+}m+}EXFU$5js5bgJU)u6-`r>S8J$_@~?+N*kO&A79a1t6ytS1M22m0 zi_%o(&Yx1wOOWqO3dDl2-Jy{O)Gk;_HljTL7n^Mg&r-`4m}Cds4j>zdmksR>ZXavyXtE`zliK7iYlIMPs42b1ZDH>Yb>0 znw=WJ>J65Sy*LM!Hskv)SX#pK2*dWO!l|0)`Li@Ue*pEjtVz5UG(T@vo~89!pT9bb z>!4i=2emW@gY`D*+g>AfGvf@_?zQJ*WfBR`9pc4vz=C{-1E&N|nLnA^+qZ{~%( z-#=T+bg!Hx|gog&)T_{+cCdlhlT;i4Uk}5 zh_-0V&JAB z4ZqLdeM8LSmlESKX1^k!2P7z4 z-@P4>ba24c#gMn;1pvRW>xjCRcStN)UwbwR14c%W7T$__Co#0b71y^BkQ%HJQtwQ9#{bFs2_B?kQZEH%rK5bSKOdr;Z`DdYSpDi0T$2b(i|K3UN}{p9 zqJEYO#uq3*xWK@5#=d9YnaSg7X5W&vw32|o8dPO9x1$qor?u0D7gWWt)ehTbANyjW zRgR0(!qGKxzgxt`!}ZCukeus-hM-V3N^-5*XuP&uqxVLiHvKlL->pbuy;8&yr|QSN zqiaN*;~JLaiQKJ)i1$^}{~GT-d8#shsjwAB2!z+!=dO$U6R%5EURxvZE<5A6zucTV zx0_7@<3I|U<8V)rjYat*=YMDk)$i_d{Oj|dGIIWl3dHJS67kt%TCrd2IhTEL zUm#9?Byd3n$4r}@Vb*!RXHqWm;}+z{pej$tnA>a4(b|^~klT~vr+9vp;aEO1hb_vW zQ-}4MAtve{Utn1Ib%?g~B@uH}8DswFWD(Q9 zlbH87L(Gro=rYE2^reXRmTd9PJ_33R6`zsjvduQg&#ZI&59TvmPso6A4ggoPll$|A zRZtbw8*siy-AzS%8FQDda0pv-4`^4IaMc;iA1xN+JYn`1?PvZ^hxKTyu9c8;I;4>~ zg)LbM&mpt6Td1r@((Q5+o?(f$!1og5rgM9ETxVNUa);J17Hp2OSz!v9C>MR5P#YpK zZkmFcYrF6A?Y@WCPxUpE{#j9}z}IcYReX34&fVklt}LF9Fw{|KkL%%P4cpC|(JDUjX>)y1%8Zo}en= zP`m1G6*8M=khMkUAU`V%&3#eCLcMU3`N>Lo{eCGwgyZ(iAX>MS$73*WdXebO1FW=z zihSR7X3YIeP?g<`xp9oDGgRfiTdBU6ihJV-1>?l9k57Rwe$N`Wy_6){I2sWT2{w+b zxQ%1;t-{7}uujODb(XAo@i|)V>XEYM*43x5ahz?lahS2h+z-d0D)-$%^}xAccw#KP z%NoxSAMbeG$nn;$j<4TlhpNoFRoFNJj+C~GMsB<4{+2fVjJRB0pD!4o&g?XRB>WdjoUiXCtPo?R8ELpZuc+#yI|hkil= zpPJo2tGh-#i!N7{T*iXO7s~DZ68K&l3uUqdzQEZ2nZ@aFL1Es8qBlrRgWam-v%52bVis04^&J#=bU(-dqrGzuK)T zCsxVp_pOrGYuIj@B}3P=&_ zWaaypRM2Puw3lNeeVif^3H?Eh}W$zl6EszJr8nhni>l7u{XQ{YF#P z5D$z4|F{LQV1RO&v2=?{^tu%N{!WeiqJN39Vy0{?%9Z(D8p>I9PMOyN`VjjfP^zg! z_hygm=a*_c?(-wY+|>oLp`In~{eD8gzeXi`ONw?csPQ=P4;gcxxy?NL2(+!qy`&Z2 ze~`*X)kj{<32GP4?afSH%da%>ihOVN0=XR=9SczYY!T-TKP#vI57FBhbECXijq}Ks z4KHJD)l_ajKAC9I$)sX6QM(XMHkDLF{u}P)dP`QvU!q$a{ZXkPgs`YXtQ6NvO@p#v zS5>Qfh_$J)tM*1FlM2<@u>jv&gzLQCaSygH+(z`sNmkk|xy*WN`JudRM3+yp(!gEv zz4(3=s9gwiWW5-3%r+5gxCr-{1mWsO=c4W&Iwy;t!#>quWiya2#*M_^f2xVT4!tVT z-^H_*+f?&INB^7XffKAW*fpnh53Wm*h&6U_a3SlQ!V5z7w21D z5sCZd7Yzy7vzmfmcMALLuOq^j>v?|vn>yE(eb2gvYkw18uUYruNQzpkKQ&kob#ZL- zi7E3obJS=v9H7^fz@E>?Tt4k{#@zKZuc5X8`tZzq0l;5d1btB= zbg$C^Txp;xwb{_uA%VX(7y5vLzcv&4R7t#}_AV^f9k2(0_F{;nN8^baCB3@P+#jWD61b~3ySW4OG~cjE8^drxd`+7Ok-qwb-|OIGwpE&>Dl8IVAa z)X42&3iAS!L34w2@!lk>Tb-`DKo=SH6wbCG)z|v!~&hC7dsUe(Z)Tr#-d0xI8jLHh#9FxV&Xm#{9Y`@qf%p~(X;2PE+8 zhacFBzv-KsHq?7STMe!TS)vV1IndXf4*sts@FO0YGQ{_$Ea>y#e+Tph(nSp!fc$w? zP%w|*Ka9zqhPc9cyomU^NHzkumi7;yf3uU$zbx=yeO)X#Xs+1_bIp(kHWfl2NZ@ap z2z>_}L<#I!DuKRfGH8)8S57;S z_aD=mDa_kJ={$9HaXDEj){v~snGY)q=c}(2m&+?N=Br)!U##nKDb2TfM{)Tv$>CGG zi_5E47S3ONxVZc(#@yX2qd=p{~%$1#$(%^A&aN+{b|~tQC5zuk=t<}ACoAL-^0B+Af<(l zO6j4VS*9<^Y@t(w1Z9Iei8cXwrj&mO*LyyJvM8@)H8YhhN0?ez)gxu(@7nR?i4%%0YxlisS+C)&hnxyR) zo=l4o3jPmadb)Kc1+{@gAxz z%7ok-C&9Qt_Qyrtwa~7wl;$6kq|o4P^0eSeX@18JPeWuDKTDVBPPiH}AXlENF7QZj zMdW{=J+hN(kst6}$)zaIjBh+wdzZQoZI*!7>795ROdH=8m8`DJ<|7D7f9}g!8;13?H&Vq(^Y_<^_dR_J%crHm9+;Rh-)nv*GVxi@ z@m#Z>djWhU=I5%38S|}oWI6tvdgyRl0P5?0Rc^nKxEl&3cLM;O*ZsQOo__J=d%ZyC z(TR|YaGjkFekluj7jHjTTYUMl@>>CN<~%aFApphPE^GQm@H)x({jcWtznTB3?K7O> zxwJB8KHXbfp59YjE*&W@kE9n)i`2^PgLk;61)NZdG+jbOzJrUei3NF_4N(=3L$0WD zz|x*ARTcY>R93**JBucRT(Q{mUJ-!g^SGcq8e{&m09>@ExIFzxarxhoR~{)YKggIH z=YN1P_vDp@^9$2qk0e3G3apd2*1=*TwW;A zhT7GzG(f2K*pYH|mS?}OkHT;eYzRI43yc^?g4#{}bD1FhARI z`MQaVlVh%(mLa(tBI(ymivY}Xn7_GjN{~sHk3It`!HC{^U%C2WO?lmiiDwg8av`p>_W#&>^YEySD{uJJy}fAx zHLccy5U5+iOSe5Swgr~3EUsFBaY4MaI$l^?2rvOpYy~fh5pV_aHrQjX=}fE=%9Yh4v>eM;ES`OMAXE&MiULl*CI>cFyAK=_H?2J*51R?wFsp#n6E{Qc{d>iMbfmLe< z=cTq);i`5Zw7nEumeqW2Y+vQ6>Kkodx*~m+=)&4A#>ZrlZFfh;Ig`wom*yQ>1J?__ z-NE^$Sm3s@^Uyp;g3z2&7nO>B+mbUt_q;xJ zbFvd){N8 z)4X>++_DtFS@&%&=R@jQ3-N!u%5NNp2zK?o+(#p-Z`yRtR69525r_- zN7|NE(za~5M@rkWAo*?Ld0(lc!OXK)NvF^D*!(MP@IHG7j?GLiwkq)e*!%$inv5!O z4*+eH^EV@nk6R&R%Z2y$-FlU_Z%%8~7Xh4?K5^;h9;8joM?}m=nRCtW#jh>nSsEqX z*2-R$KbPRd(O_tJ3Axq?2NqS$I7a%2gl|Q#Juoe;E#GNpx%i2S!=$V`b-$A+9e@2%4_aJ>l4WcbK+YZ_#P&8LrxuVKzf#&*^4_CqE zZz|?M$XjLQs;c^xO(XbA3?r0a=bCKH59^al{byvGAHS_`Nc$`524}|eP~WBo z{hiiy-k#PBKd3dG7iHjjDA&Q;UhdK^*-g4(my6bIVYmrT0 zrH?qR6m{V9N|4e^R8O1ytH#49S5c>lc+uee-^_pgC?#g$6D{~?H1c$9em zT8LLnR^t5|Abve4@vEJ6zH8h8Uu|){ufn3lx4UsZ59ob!pmM34N0G(_H8ioXG>}*; zOInk2Q+`cLYxngnYrCJ5C(s40B@Jt3n-*9YOa#E9VS0JX((VQF1p07mNyB{Eu6D7`%+d-lg zwKOq(QXtU;lGg5Q&&T|jcfKssiuEN8O<>cmUK~tZEm<^7zq+NlyPwGP>DH2lqr|S& z%QC&H<=*bAr9Ap{Db_QNYBe-*lo0J|N!HpI1{3XI)mWaE=I*0p9K9FvXhqAi?xRGe zK`D>!f;>92mL}>a1rqHbX}g?{37(C2Gtq6vuB4zjjuVKA`^tgI~N!+PsMrsXZmyPH6wzn5jY z4`lkr44T+m#_8DSd^8_=zfnV3zaSm^76udh1Ra=A$-5Q$sCaXizu)a%M zR&-+@Ausnq9{n!s1Dj}@h4J_j)}B22I>_|V){=&OVArtRF0j!@89%J_kVVQQY(QmTvrRl+UE5Jr8T9&i-AFku{T+*_l8{2#E2AaTj^-l~i zx!DCWlPS(qD`oE%@o{C!T7Q!gUk(=9e>bP+Ua&BFb_#kh-=(bn(dn5DHX(yU=?MsW zP&WG}@^Ovypv-WdV*g0AZxQMUD@(`!*GMuw1TtM-OA|{cAzvl!kn^$p%yP@umo)4G zo3>_gFtJ9mXqPa4Sn0u5Ot))XCf9Tirn7#s(1B7M7o3hm3xkP6VAae%Y8U-8x#jNe znP8z2$wD2(LLaH6iH(8|$GFFb(D8_%BeFP{hzL56&(?J&9Wt$Gxqp!V)*FxxnaUac z<5(0-I0&bMk83OCYBnzd)Lig6v#Osr=KP8Qh z`zIzJX5Z~ykNU%=9atPp9FQ!mPj`SsX9<2_p7NFl2l+Qk$VVVUKIo!gf(m|c{lev> zyk!;p#%W2WtBFhx*3v|u=$F;wHV^5SgQ8zfFAgS7XUNC$b(!+<(4c%Qzk$ogvWaQ= zSiLBiSWQNgkJXH)#j-@7BoejEpb4wcw@;3HGCw`$Ez~0PZSj&|qFCr#;@NmXCH@c`IoMU~K(3@LJ8r~a+#CvGnHB zKw`e^q_@`4#JhxOPDvIvl~u!Xm=F2zE^*SE<+1c#BGGDjEPauTrBi0mM0r^t;gq;M zU_LAp04JTYp`^hnrR4$Bj}j-H(()B%2kcmvwga3JmjitN(hb}WKsro$Fzfw?mVab* zb30(n;P}X!K@(%j_?(O51M}g$`Xb4rc^mkAYmN_0f0yLZt6EyR|BZ~LPpvCyc#+sO zEOV5Mp-)W=B=G&yH_*h3glI=edVHAmUfFUFtNR@?hQ3I0>1k;UT}{T&Kh@I2$CI!; z*B6)%`S&ClOaHVU`JUDnpJOsLmVU0~q3(@DqW7#TX?T*@H7xTk$))!&c^pf>bOTL1 zNr?6?N$ZQudgnndEpJ)fjeIyD<-&$YN zu$rXxC#Jtha_AK;4|Y>BhJL;^%@1tT=WA#J%grst`iS--Ny`V8#eCR5m>2U=BGE1> zoBBvL{f?MVkPdS`xq|7o9QqwWhdG~I!P& z6D*7Qd@WyOc`;uAvS>t-Xcm#^=31I~JcEwQTUIhU93+Qs7Ic{NtI4M;)?vC`bC7K6 zZ@GVve^=Z<6D)0FAVCSyRu7{Cd5v^nUd-npS#*u$pohRgzgSBXe{epQ?<10S_oP4q z^Ig_*clRO4qF-EJ(%>U$djsFy1X;AaWet0O(>i=_XX)6sn{J?qLmBg$k8r!ke9zux z*gg1vUy~BQ3GB4*ZYA!&fhOjH9s5fwN1l$`%;bdY-E8V#SJFUeJ<_wP8{7Cr);|uqa$+FiAeA_#DWhefKKyY(`HO zqemKro@_x6w`Djze}HUyS6Y7%jK>kY`9M((+LTEtm(t`R8b%j25#W?TlZnUj;3f z30kP2#n1Sb&1ktSgO(e?PJb`k={~U2p9;SZ<=6E4%r^dX1D9XZ?=$=Tr>&e9*p|y% z)(^_VPiwfm{G>E3FQ(sT$_?87rtAd3MuU<>zX=kZQ%e)GCSf^F2hP!0W*0cke&XxG%Y749j3e>9hevMp`UfNgno{dURFyJ zk2>4)4}qjjp2Yiw+i`Y!+4_=(Lm9XLzC+&rxE0e)d#Jg4FujJ`Lwf~2aVWzNMn0SQ zc)1nK9$G6~nE$zA22Ct23nb8|YI1I3{c2tjmRq4C4GO_vbD-~aD=^Wp+o|}Bt z4}C4aax&%k(&ck~)2^K7yKc(oeN~k=`>y&MU`tb+b-t_J0pB%gZ0SAkdjWmvY^Yo+ zkEcyA{{K3*>)iTGHs$0I&?UcsTuQBYx zNw<`uO-8h8IgJ%yIWymV;AGg6Q~q$&}?Zw$%JL!) z$ChT+(nMg==-AR|7#I2klUu&reJeOe#g_2>XTg>vX(YDvlE8A%zRkpzkeB6%>Pr^(v}Qt$?4kiU&5Ab>xW`X)>@7&$&)UQEy;`j zJhpUS2DXIs{8zB0OnL%>9_CX{x;VBZEgp(3{a)tS(wkzg91UA~a|6c?%(-%OY-#;p zg)OZS*it6OH5^+S4dWV#Ev@;hu%(E=mNp5DYcyGQ?GV_3>646(Ej{p8VM_-Dw)AE#P3*l0w)Cdx7t==@9b03Uy}51q77O_P++Mw-WIWwV#?$jR(8Ql6j*bPL zU&pZ^lU_`}s^#8Mv7n>G#DenZEdmQVn&InXxil7(H;4rl3oIya22Dr;gE6rnEE9my zF_>zZV=#BY_#s%(QNsHT-+xzNK}d($e^?gtaV#j0mdhLqGUfSbElvD!(&$*w(e<1T zQ=ZdU&_jPSEa-s1g5IsAiMKC;1-&b`>{luIee9fHB2zWYlU%!`8< z%ozIlb;GbAfx*n3n8t!keP?1p=tp8+j=^Lz48|`om?tvmK>rTQ_%4FMa4hKlZXd~| z^M+wT^KPICEH^g;3(BMe^Km+IDdzK$Y`R9uVpzGdDOw&&r9Si#MUxfu-EwG@=YiZ(=i(o;Q3oOX=TSv!& zn*S;+$SJTOdj=L{8HNSf1r}ub@uOow_x=9@3wrOu(6hEDWtqicm7R)@pWTyUOPw=m z;BCGpw$UlkSxPeEyYTocLZqr0JzWwo$0X9jhy(` zHd*+ZSvjb|CFhK2Ml7=60`@;YvySiYIA=t|Hl#z*B}*M!w*%y%MWS^cg?gXEIte8n zLOqTEg#mDR0jS~tDk*hr-46466^WKR71jo}$KEN?#%yk{4L`eRai`mDo@3nToJCK{ zB!=aCWjV&$#rQCDkPnZ120qNP%%r=HiToBTmE6G20!_@|1Gam71|RT!!T(V{yu$dv z_vb=vp$FdY7z60QlCs3k z)cx9h=H)7*K5-D#XJ*K7+`7T~^<5p?p8XM&Zr)Y_-&1oSgz3d6)+LH}ZhN*@E{TQZ z;?2m5udHtAo?ubpSeJgU(^qlIi1uw#;%WtG#ZbJtQ7YcNLy{;vTUQ97w+qDCx*~D5 zu8^Ot^Athoq&&g@sXX4V0JtT);!Eb)b{{AQ4a>K&vvp1%ejEEF>y#1wwBc6YFE^G| zCG%$Q{)ISOw?~|<+au1_?fHILRU4-7$6sf|p1!iG;tJ53Jn()SzW=1GYUg?58r^*mI@X5LazB{mE+q1hopzVOd&0$&E{F)Pv_hdmR*T&D+z2@Nm zzm^Nf75ufpaWyORe4U%J`{Z(*KI9p;<-n)BEy;RC53ibbMqPYsB3S~}Ww{W^MAM+;{Dfyj&gA@ zn&&I7fcHOq4C0S`YD5oiy2aP`m=f=hfc9)GtJ)|@^uyIkoV0SeFwg7ti1T_q;=CTp z%1PPg-^DC&PqiEol*c4jXu@iTip1VUbHGeEVHv42&` z*uSb|>|ZTER#tVRVHAZk-iI^Z|M8;d%YG_!!OOcplBJlb56;UFJ11LX9iyDDJt+E^ z>jj&L!)J-jG|$@JBJNA5=Q==_<=8K8ReWb;OU#}HQ>zNjyj*pmK5+=g1cBrB4fd}e z>e%+|DX?t*pd7xZ=0XV5O`Xsum&8=Lcylj{>o_6y-0GHY3+jb>NgHT_`1yR7Z*$6s z_LPIxw^fOwZWw4%;;0``H{cjYop5C#*AE>+KR^-J4=U3S7XPPmsecxLdpjsT9EbQV z_H7C1c8Snl*~QM^qU;>p%Js)bGeAc<@uzT{1)0t`xRvXSj`fa)o@ema+0e5Cf4O|9 z>$!ZWnBG@b_0bGPSMeRn1L}(l^@+oRH$PeL__|~Jwr3s0vboF)-|H~-1>yR_;RVf3 z3OB2=eRJ73t{0xPLdXVcuq=!JUp5Ag_c$O_W`*M*^u<1KQ`8w|8(F(1xO~Xd(-(MK zl58;+?v0`Vk3Ww_j? zZ6xY`k_%hBTk^E^i=@c59a0?Ahu$YKY8(7J-LR!e(7y~6eV_<*O9uVY$-hjy0ub6Y zClwt^^Y=3D%aCF_+^{7xMj?w&_z;gzSPn|{QVFW-EpXe0Go<+@5l?CGdk>AgukMLC zsi->_wrqMiPxD%o>P8z>Kd^FXRk;Oj>w0if!;&+k`S1lJ^x(?Is?+tdhUE^dC~2^) zY^-|T3R9CZ@k>Mv27t^x!|rfbgUNtr^V4%u(a6hrni(f_y%i!6Nn-aov$P7L^~;6+ zD*z(KCb>F!nW7(TlC=P+`-xKxTCkpbL4RGGC;aA|WmQmI)-VHXtB_9saE-T>G&BNC zZMVQUEYoD+XD8L4g{#7=%Bunv(3Vuf@!ktYXu~w9{@;dC)LvZHFtEy7<+Xq|!vn|n z=tk)0qr{=Pu=eMS|2y1pEO4t$`&V`+$;-R_GCzleeKNU9i4UxX_~e?=*T)C$h4^Ge ziPzkt_@*zb^HnVj_@;&GeU+_~ft>AJ_`<$;*`ZKosJWS1R$V zs&4iTd>!KdFy$8CD^m5rs?ZnP} z`=6F_oWP`!VGG2>18l;_<~RZRwvU5@4z%*Mj?0OIqCdY6EOelTCLF{@KP*K*o3C@2 zcpK)yvirnZoQ>EhK3ilP{joB81dZ+Bpob+Jqw$Fvns~gFV=72vCT8|TE5}s$`Ygv( z_&QA%wGt~mEHDi$!|G&MMtaTAk%0+f9*#{o=<{Hqm$cl?)`#AdEc7vD<_H>hfrEZq zvM?HV*U-ebFGAyPL8H08is{&Q`yh)VA2Mm&C1~6S>3$zhBbN^ceG{zoQr7o2`j}*; z-(-Dl%U%ICM&mxk#$;lpWM$v^sD>sEm!`3)Od3BDG~#zKtsSzcg;?leuxKV8gZWX` zP{tnv2YsV7koXD1WQJlw$U{?Bke35sq3vL!Kb9@@QO3uSG|rJM|798n`}iU>ehYad zXxuf7MiUR?n2v)U1S=aem;D(&I{ps$cxbf}M_wL+i}UjEy-NHeHWoQgkxrx+X*I|9 z{|SDgUA2qRdU2i}e#oTN`d^~;Z_d}XpMkF%{!aM1=`-;4vA+|(ZvG5>efsZ&uUkI@ zU!#8~eEs@o;On-(556*cBmQmPMjFLx5E}YCEGbRRUv75y(Dlg^z$t2j;Vgx8v8LQ@d9=i zWg54d0BW!Y6g@c?^nDg3erUot-!{46NE?CB0)WcLO2B7+Ga*5IIIf{e5V~Ym`i`ii zToUWcv+rJOhjAUc5$(&nardDKxA~Gc@^2(pJy7L+Yt7(Y8~}vE>Zw&-Hqb`Be`5$g zUKzX>N|zyaR+h9(ehj_G#2Pd2#@h(|j;M1oiJk8!8uA1APy`}Iw7~XN8^Z5Aco zXV3G!CKVsqP9XFUKxJ|Uze{8YFNWd5iUgs)nWaqd26&XU)LES$d)ZqMzz0c0K!)?z`f^k69V03}v zJM|dE|5t8L30n)f9(36bw{4K&_}c_R(FJK48qPBq2cfUdOhw0o>N4-=>1Xk*XYWSd z^?#7Z>i*!U5$*rhExz6yIF@`&iT^<^_TL?-+I&fmOWRNi&5zq5w0%y~kUK?sk1eS> zByh7n@m#J*elxw!L;PlX0EquX@w~6p(O~A;qomU>_1Ff>dco%RvUPHxCm?&X7fP}N zFh2WHDSI>0bGZ#dhjQT9p`=SYG^eR*HGuQ(CobEZ6n9LFc8>`D|AF|mWjvF=kbYxp zal<|fy#Hf>>Kj{~8PATvXZ+m@P+cza@@Hqpvt#fXfA;`X{{pf%zqS#Y!!m?klL-Ia z2+i*h2<_Miw-JXL^g_Yh1DEbCxzxL-^^%oCWhT*^tF|W?-2r(XEqUSg9OKOEf7*K64SiL385qPspu(@_nnjx z`r%T=$M4GJcV(Sx%Joe>YD5R@^L$<9piP!7v`!{;!z4KVR5q~K2bOl|ZnHuBqztjI z$QD{66S}4x-ald(MVRj$8A3mtudwo8k;l{DN+pzkqnPOueRZy{^r#Vyl!Ml1pXb}S zv8<|XZ&?-A@fBI3zm*7OcPKu?*JRWkWmTS5M?;{snBA-BX>~Si{C-)L7ys`ot7`kC ztZI*86z%v6ccvEpnLASf)Zl_+ORBzLf%n(S!0s=p6L+R6$CgwD#GR?Pi{}Fp_|0^7 zH<);4cY|f*&%84g#GR=`+?l#j(92?(N}OJ=3?bH53%suYRO4?QK(*RhJea1oIy0Wr zdF=phY#$f~YhO5Ju=XWWMkr)~_h%j}tBM##ktd`4!M|`{)Wdg@<5#AP&~|{%gEEPAv_tn~3&eY6Ys_bb zaWlq1^RoADdiaI&MhI!L7bxtmy5V;WqihnQ2ItnWn6G{__6DX`07Sqr*xloHVDVo4 znfP)(%D!O~_2s~^0OT{gRbJW1?zxdyrg6(ggVP{^y1&0n4U&~h8Q$r2)={scj(RPP z)C=I6Y=PU_z?@}ca zC(!yi5^VxYHrj9XbLy!y2WS8+*#HuSIRU!VqOg4oY)`&LqKc=U!gHd$2dHcbustJo zkSTynXIW$#u*ek7&)nLd1IK2TIvWBDoek|E`61Wg+EH5UYJz+XK=Q8yo7N8CKXeb) zZ`Xh*am4|ZeQsNW>b5lm95?#GG1EWmo*NUhOJ^r`+)u5gu35_Gncce! zvi+#!ey(Ix|<(Yk8(*P_QriWX?-8}&Q4gmkG8gT7Wzz;P}m!t&zyILN}zoZ?y11mS? zm-m!)&miPT?`bYmeNJnG>a;clEI0bWGSmOsD0l6f_w0v7T%VKq+vcN;tQP-!Ky~%X z1+j>vmSFmN!-#&GujuKRFeC2+KbcW4HH>Hnfl78qzrkX=`on|waJgfv2J0Idhb13W z*IC0Tx)xN|8N(>r&uH%)5{DSS)8>X_W-MZMXY3O5j#JRX^{FV%fqgRgEuijSZc~FR zY^v*9*=q3H*{UlkTl`DFvU;8jp;P_9Vluc5BWjM5dc%nBSg&jyV0&5$W4&@dqgndM zh!Q8i8}d*skI7&&jHqhHeqAzbZ-fjXZy*(ITeYle0E({zhw@C*s&G}Kh0t~jXpO5p zRsYFiah5g^XPrMOPxfP;osPQfJr0uXEd^I25P!d=E}K}>|6?8KV;#-Vxfj;HJ>AomRfm?b)?Y(6I~s|bDbC4-BQ-@2Ef!Es~W3N zAM9M^tpW>ZIInFKX`5Dgt5A0~-c#DpCwu%A&U$~qp**w4QJ>vZI;o)v?AcAFINph$ zSnIPZtTOxG3$p)tfT=rIEoFS!zN(z*^-bdcwpHa-2Swccj&jhpNpR!y@qM-T$wpjOc(|5bKwVVtq^=_&%=nhf!vD4EdK+Mik!-$ZnR; z+}riQVN+&`V)L2I6vV!g;&CA#N@d8--6Pi$pQ%elhu(+&&fwjPhh>O;Bug=~yg5G1 ze(#lKX7g2e;r;YojFuR?5BLt=?~!?m@8yMx?>Aw^cgO`(&&zV`tXvQqkR7q)CccMb zn+(VADS}Xq72ZE9_9i@M)F+=-LO%Sh^WvcIl_;`yF$GVH<@$}5MApXL~Ml`uoiT5`t@dFaj+Ic?vYY11`82YL@7++h^1U1CPW&xyP=8QX)xYz`-C=x}D60yucQ$-1tV~L)&_Ggn9TNqfdxYIPw>4R^LLti!Adp*;d{Zt*${dm zV=ox~|5`2_Pl~-@o@{P+@^%){hy-*EwsjNV3x@3qigx`-D%p(f>RdIw8{4+k4)O5f zTNB|4P;JW6(n;WIteum1WD>aAYv&|3Ext9eW_@u(WPNeNav7?Z*`c~A2deMSgX*RE zP~BJr)oaS2diedD%2){XDyb;aahCbmLbk32{fB>Hf0()VtKK7L><^RuW_nYpqroDc zmnoLP^i3XF?EjGcKg!tuArIRhCX4+a7P0?B7Pj@HrHZdz>%W`I7w0<;e|LHs!;Lyp}a-2(cVBd7;LKDMs|`#=J=KMx?E1~!#dosjK* z+UjVaTg$2_+Rtc@|Ddc&Li;;`zs`maHz{$tv#bE3KwZB|d7bYe3-t3nA-&frx^kkd zYG8(<_wSsu`=eVFy%_z(j62+u8F#oRhu!yn9lHZQ<4(kj+zmhN7}7c3e^QqHU%9B? z$?ro1Cyy^kEQ*eHH{^;qgGJj|{6bGUwx7$)56eUhY^S0x8UyZ;F&{|`-=QthL7?-i zE=6DCQuOWRphawo9xey%(F!S|5SThz?4KiJAQE}*WzYxGV?noHtfK^I7 zyb9vs6^f2?PG(4GFdHn;tjG`w8%F1+Iq+WB%hR<&Q1=&uy1$pjJ$A<=ry9)rT`H=|F!cne!FyEd(Io3h3EOV z@Ecw0r)wV?Mp4T-qx1H2f`-6!t(V83kG(nuBE32AUcU_fKDi*~{dhW?`{o`@G5hbS zb4KX23&vrd0lCQECl|-OldoraWKj1X-Ia=l&l;8K_k}UJk&l#gKyh@2D0j6fg=;V7g%(#GQ{`~kqQc=%oqjKpgC63?1bnoNWYhFR;#}|yy z_Y9-R>r`|c!_SE4dQgK;i{}bZgHIa6_rR0bwL-?wR$Rkkb>+u;`92gDhpY#nYc%<4 zlazQLvk41gzXM75gZZ&oE<{d_u(i=%<@fY|Dq>vCo*=QfVPTu1&q7(1pzF#NB+@7P zJ1_;b?TQ*?b6aVR_JtKgW6+@-99luraj!CBoFd%>{x$f6F%a4IWoTw?vTrN#&T}_( zVV?`zWw8tq6@by*nhO!sk(v9`+hvG&4D7%B7>^rN7~2j~L`@ki?tLHHQ?eRld+gSz z!PhflCt|zvojhi1QtTJyu@t32?5S-GM9ztrU>nCk^i$%w zWeh|%$Z&k-1m!IH z%7{}99uWHNF)Qk~%s7Q|Y{q0Be|E;@&>WUn{9IQiu0cSFHv-qU=%0}(ioV@2y3nV1 z$0|h>1L<}%U&$;tAqU*Qvr3ULi@BH|tKfG8@1LIo5wy=`i=uCI!+U`j0y@&Q0i+{1 zUi<9ZO27k}*8|#|a>Puf@r86FA3iZigz1}6 zV&4wOe{jtH#$Yk#D#I>CZ*wU+R4KZ*O3|x4+&{+oZAff$r=pW8MXv+s{FL#R$IYF# zJY!r(K=V#ZkLxANMNH{DHHc&SljTEWO81L)^~zGrQrox|f<^;jXaur?KyJUpJCYE$%mh7k=*5NG-vAoS6)q4ap2 ze2t)Ey29v>eUbaAI97UPqJ8rf=I=8d^}Sb8(bpti&##8n(>spGr^9aoDDi84EU~zR z0~LyXP%iNIGo4-(lO#3x&;MeHB+qbN_s&J*QvGnqnxvX>hUTQO7l!kFqTstnhOX~& z`d(u6d5G3n#Q6Ra^8MG#M)G~tavoFvvNVrh8jZ)Q1443bDvEN8e8%?v<1ij?8TM^& zu^L3%Ky@j4vBcI>_Ct-Lx7Z+lv*5Q%pljo>a&_a=G=FDVI=mqpy*SBBZIX5aOpzCc^lqUe{3xobcs>>Pw?6AbCke)I{_@qYX335&Pc_d5Eh z>i)8S;W0z|uR!|M{e2Zg>rH_6^&h69$?KGOnF7rn5`?Z}bza<-(o|psRPF|+yXnRYb#u>dY1oYkt(6`%o+(zsJ zq{k~k=occEHAv9q%;f(sdBayfG8pi(am8ocWx`_WjtPXE(x{iEN$M!MYheMupy_|}6 z*c2V@6t3$FVh^Rbt{)s9R}CE>3P9-k8w9qJpSBTj9tgB5TiN~Y7DYGb7L%_V0FGdr zdkKWv03v-N#wGeQ=tn5aK+l|WzK|L@=iCAiG1qX;j<88Ne)_{~hgz3y?%gY8PM*>5QWn!og0CcIN_&A>mKX)VQ@bgBI#|2wJ9jlFuvq)m-TYW7X zBIwJVux~3-CD7MAT-Gpry@RcfICwmF4=DOaSrFMKfqu#`ipt#3yq!R3tAsrHS7uv{ z$$d8IwLpf;L+0$&-WeVx`!ph7s*&m@kj=Nfnj5U`s$9s|9+9X8E_&2s=L= zi(HD)Y;K33-E)%BRmjH65srnkc=9N}-^cidq#wTu(Agm=dL#=Xof7Dc*$T_k zl&$FhQV!auIq=e#vmw$rmdEM2yG)9pz0x5;C+fAM6B$qZjV}J)3k>^;do7CIA@Tw! zy8q==ls#J%y|c_<&)YAZq3y_1gX&x#x^|*3Zr8c~hwr zQBp=F^5^qb=HI`R6u!Vs3nVU&n?UPbBt_tYQQ0fT$k{A5&YP3=Z6*C;-ZbOVrPq0e z$2=v2^Wz9R$B=h-TA=fkEU|dANC)~omoMNx&K~B+=QCfaVu2L-K!Rp$%kw45S=6oh zGIaGlR?lQTnFWy^0+pUWWAAt*2>tl_RJ50^U>2%DeB_!*4?q0SrEawuYfqOQ#UH{@J5J#Dm$hj&2QCB+B6RUOjBzW-6KKQ#-)*;*lJnOY1)nXXscYo=K-`E7w(fHW%ofdNDwLuk8K7kgdS<+Hf!Ca z3|#UB(BM|k{;e?`GaT)@x}_vi1mIrE*3Y=@=}PfAujhi%Iib{GYqLoSy6$Zxk?o}; z>-<_{+K<3GuUtyly4jylcZ)dBKet1~HS9a3DI?0|lkeduUy+I?&l{b60@p&_^tJ;~ zH!vM(Sb_B+=KW|>Dy`qI8mZsEJ3SS}dHUbEe&3&=-$mc=8+AP#$1mK;v9K8c@qf^GUJ?Imy7Kxh;`w+j5yw=JpCqzzYpdb%nwsiMko47^%IS#3NSS+DRBU}2K_sA ztfJ4JXhc00sO0GrS$dm|+W>b=GNQ_Pqm$bM>i(yu8_}L~MkSW(MH{6Q>pXK^W?B5! z+oeXd?7Y4CNq`W4H-7Nlo25pS^tA`efUKTJAcXcC^Rve)`m3d^{;BwUw$zA*&lyuu z_IVw}td5h0Q8Xz3LPs!}&l57=0Gd$*@!f_I1v^wGi1+g|^SIhZEw8H|G_`bNq@nx)iHt#KHHPI{}Dmw+>{X_DMQd%cFhkA zqX_GJf{(*3e`y>x8b(xc@^RQfil<#zk|9g?fz~@VElZaU8&@b>yqss+(P8DhdFgV+ z<~R{!_&bB;E}zyrtXyM8xolCcO_ck_V7V#N62r=E&nS0(2`|?u$~`?;&N=PP;qA*P z_a{-#E85pKSPrJWGQ54xbh+e`p*m{KU^&OM-NW0LQEtB|w?~v)K3J}5+SiA-FQeQW zONQ#II|j=s)1DgMzKn7&FBz(@ZVG>PebrZ$sjr6n?otf>O>@6kb2YEYFRKH6GcW45B#5$Fut6n$EW5lzCGX{w~e+t~hV;>U6x zvG&jH_yUFHhZ(D@P`!%LPq273B^tNz3VkVdd&F%FPtz>O{F;E&1&Ic;AqI{NKC5 z16q3RMT*^AB1Kf-_Qv4aNCxJWxt4xH%v0Fse62!?Edhu>G~S4M?9lmOwxZ))_Mljg zeU(6@!va(L*q$n`%f4O0{f!g$Z6y`}H}I*Ou3;QsP?)O#NRa z!ncucBthh*ZPVS(n%wM13i zw{cLG{U6GfSbeLqmEjvj9N&1pRoNPzujmK2g4S3L8j&E>C)@oAFPF=w078u`Sd3Gx zaRumuV`~_W(*Y3r+I6XDIjF&Z_ezoD!|ppNvnb6y1VSGJgv!9v+(GbnN^|l_)Lndk z4S`L}?go74P@0ve)Szw{MevjwJYyI|Jx}tp0-mSTAlliMg^J$pQS@a1oyTNL45YGQ zwj{)$uRX}I4&JY5PtE{Xjk;M{Od@UW47+w^wg#oy+Lepb^90HY>X`q%m_&w*!(sN~ zjPv&9dkBR7xQIl&1taS$TAZG#`iHad5fvSfEpL@coq8S=^Rnd-Jon zynAG>`&9`#!#J)0x)v52(ePN%6$v^G8?bX=Z!aQ|?L{MLIJHR3(_;R6Vlj!J&Y6pK z*gy|oFuMMI5%Z6OdrC)^|8NnBG>Z9(h;_V{#U$bba2wgs+-8Lk+JZz@_rFzQL_01R zmA#U>AIIR2ON^-Jf>DX|e<-_S2j%fGz7G}0NTDC)X7Lq96wad$JD#nJ;kSP0V}4d8 z!%o*LTf1=HJBxV={bjew5mHmu;E~m!Hw@#vj-C>4D@+KlQ1r%C5YNQmk&jyhZ^t@} z=u?JKWE4VkFL0XM?CSo1Eis~S#;9zxtNRmdJQl~=h`Jy3t8&_?Y$WRbcZRL8i}iYc zMX?kKOVDZV@z^N#-C&=w^(7Bz;bM+8-;8-{hpuO2;`Jy`3l@<`Z>G<6WsU|v%GMrP zG!&yKUd-`~V;n2+1E~9djblZI&f#>TUfxg(ag?8>V--ChK_}{VOR*FY>t5{tMu4ts zkj89adcR!Ii_e$g^U|TTXVQ&-VSrAkQR3#lgp|-{?2M;jM9XraIr*z?C28HYdvNXf z49AhTnESj>G~BV9k6){}yU`LmE8Ajx53m$FFUv88iOY7r5BwEw-{-wW7_Qly123^X zB<(p2`}_HCNhF!Y`^oq<;eC_^ou^;tc>Q6%CcED=2DZTCS7}ogN|8@DNm|mTyx1#G zVDJ0n(%8AzWv#;oFD6}z-r)jW&4u^i%vkOEg;E6bCM#qOEbwBlOVNoF^nW4H$;+0Y zyvNjB*a9z1*RB%z!**U*I3M(LO%`@n7t(=cnBCKzqm2=HG3~*fpkC*Cof_But! zxu-|a*W=>y_1)hPrqe(D)i!nx;`px#lgF?AmPEql`M6g`;zbqHQqcmm>kOl)K&%IF z-?_j)axdktSf3iNOYdJ;OLkwVNBNTkeq@h@2hX(1+-_>J>^?Pkme0ET4E8hYUmM%w zeg1W#Wyagbe%|~u63JUFv3*v3?2g9Lm<(#L&ZY(%_wae^A0-H#-2l4}$@#Gl!uTh-8=)Yqa)(j9Dn9BDjoMtjyxBEmxVE3mB>UW=Rnz>tFJ!|*5 zHM4gcuS;xAkElxA3vdllAx@U@Ig>2o`!R>_u|VCfSQIAX?!NZm34zJu{G`hyR#A*L zi+lAu5`^wtNFv0>bitNn4r~dm%+=r*IoigBL;aZouDe}mOYwE~g4nnsuJdlQ^WUG_ zjHn0g%xs1UcV>z2{3C%-?LrdSGs<^Xitp4p`C2CG@N-21Lz5shWg(w48to&?-nDS3 zulDi6KR=J+yx3yn^I?Z>biQNbbkDY%IEy=0Z|CzN(jTtn*mmAR67gn@{C>6gew*OY z+niQc9NV!`i7&M=JvOazDcX_lSh!r$KAB`hPosTVtLSZ@1{W0@(T7q-XLvErT}82F zHbp;(^KveZv+=Q}T8^LKm`cKo13d($9$7#lBxfW&1q+AHq5okRMMa?QN1Lxv;2qxa zMl?*I>$eL?#G5;^4vT0LajL<$*gVDY&(BXaqT!TLc}by(6&1u@E9AECix-R#KND0C zd$lk<7e7&CM4=SMNkk3y%Ed7$cW(*ixk~sH_h#sBn5pRdC!+kM?at(|yYmKQYwVzG zi_OgC_H~8W+h$Avy}u0f`h|*~x&G1QQ1md&;A`(VZuz;>{cWql>`YBx8Qc5O+*`Em zSuaTc)LRBRru9xxbT3GodnbU7{?3!=?@Zw7Yb2P9a`M1>Wow&6HuuQ|vFVkmXx{|1 zoeDM+P=nc1Q^U?|y)neMPtz$4u7wY$_45Qms!h?Wij1hcl%JW8jO{5=rTn?(-lP+< z+drBQQ`o9(<#>NVtYfcdvkU1H{e$%NRi>iH`F`&$(2>pb3wv&i1V>o&z~9Bu?PxT462@^Mih#zkQaZHs;}KKPj;J}yi@7t8)z(J;R@!*9ZG>BIap zoTpJwn!Y8r<+p`gccCqxw}9aVY>WhM1&x$5ykHBCm#PJ6J?R$q{LdDcddNNE`=}d} z1UmPc^%Dr4o&M>+zo5#>bsgkE z=L5Bh-X%kqS|EJhvCw({bVZKM4Vtzr>ijY&U}r0^o{A!lMG&hIybN26%=JXOi}3wfy%j{mv6Pkn=i&^t{N;9 zJp1AN410Ol`fAb+p*yZkMSCw(^tua1C(2~z+|Y^s?PZGooechEoi{@NvR>Kxzy+i8 zItix!KvMMl3r1&|TzF)o1fgHwHI%;X)6(>j`9t^C{z}*b<65g z^jt95T6v%B_G8~nD>kAY>CCi~Ik4pwfXcQ5+(+7bof@1PkRq=R`)==bYEV6pqYd1Z zUeiYT|A7Shj|P2$!dQBL>b?so5mb=2G+xw}XEF zVn9EX={0``CH&s~MB+|MP7q-Ek>0IKVIPgx^if!lE2>5yUSYt`~EajxnB z=p=4sNd5Tz1G7nF=~9WwaSy1$`))vASJBUYNs5HaL3^Y?V*1P|Frug@E)?)Je96uC zMIyhEKJPtaw1ah$`^ED{C=)w2@#BqI{LWT3FXzCPUw&y!8apjf_j4?nFdxMgV7Nlp z9e4441HHn=4RnvuHr_RIU$uKa8Hq_|V8+NBFX}r*(#ZL3k4L`5{CTz~q*i=mPj>nn zUmWEd=k6kdXK(tl)nKeniu4;s(L?h=|J4Pw2SA4@eE&(O%=fX(nN1=pfy(=D=a|CQ z+eifSd1UDF2s!Kd(ijcDiE?EFaF>X5qzTi}7M^t%U-Qnypni21*J0}nBf7^hiXOna zZwH3Gcbqr6u+PnYHR;0sT~)*Pm|@>qux}Tmude9cQ^ufN^n7YeJ##0C)a9u`q|f9_ z#a$$_J%ca57yEzFc704dKO**TVA@7uN28p2#GSoaTt3I4Ud+Tp$eqB?6ow`3;p-(g z{=SO87DZP8I-hg1J-7S}qD9d?1jhik(ZA~E_Bm3}E9?*`uC3oiDC=+*50J?e! z$1U-B6F!%N_NJSkwFsRvqQlQHj&{BUR;mnFA}dGtv2jexRf=8#pfBY(6n;;?*t#A1 zAndGXmBQBU90f-7f$4zu74t1E1xED#TF{X;^cRNEmtoIi8`-Zz{N{?^8u44jeisKD_tRf&55vdwn^Ab!bw7ZPPXe9y3nsi6+pD{&dZw&2|N>l`@dJ~2j1@7pDQ z$Utk!hrNWJjsog^amRK$j#gGBoi<)Yl0rW@(`MGhPTQ1r+rW7vMxs3Ju& z_b&&mT<2?wZNYpdx9ev~ z5v1q6J4j^k+hKkONL`j1JbMTKwrP{&_n*8o(U>&Wtp-NONbTc|@8g z6IX>nQUxuSrGuxdV4>(bXIS=w)lC>ArZbmAJ7y=JzUj+I6DL znw$AL=q*>L7>4bTArvm>{3rxSm$@fT^IwySc1YwB)@{WSQEfjn(oMqB(BY0FPD+fw7yEE#1cUZl*EnPobh z+Ucv)WtXByJgqNF4We$m zdWICiGLyooXr_KH&*u8sH$!p{jZN|DQ0!(N$8BJyq7U9>c?IYyK<63s=cuCZk)Z1v zw+mfXGfoT41dUv)2CP8f8XcgOox>y4J=qPKX>>iAHirzR|(ZQp{>m=w>B$(>Wq*(=R&sFLE zrlP+aMSuV2?cBbA3_mbQpmOgSe(uR*7|dqlXV%=YZyzHO{2meKlkPdi%VXIeoHdHv z7mVm90(<%0NfJq>jH!nO?E!mw{x!$K31K@yj=KMaS}B6|((x~3(ElTTH$?diEUeHLAHkz9xqXxksY8T2~n`Gf%I=%bOBpqgv}O#wC7I1Tjhm$@E0c9C=5 z`wfnN4gUttL6MskJuE44Rf2eUtP)qpLOg6!;;IeesPEKlh=*NDTy?Scx;hqg)NN`x z#8G#t--l`(|M&k;il`-^C(j$5sISyXEFbe38ZTA!|BtzUkB_Q4`-bsrt-WV5IRHs! zawH}*2`U6Um2e2!W@i!v1y94Y^{!SX1T})~EuuBTB-w#@sNs3aPNp53>0JUyYj$p) zQcbF9Z4H8mLKPAZcP-UP0;1C1a%MIpvwxqp*50%COoHw6d!P6DynoH?<63*IYh9;x zUEgctBuz)$JVp9p6%L5Spoo{$9^X}hB3=aw;bUScliMGe@-N9Q*Lh3JL*Gnl_D zOmo_@o%b8-;eRNoe0%%<^=<%w>C>lPI2}UEY~NzCTMwYef&S zgO>yAKj9a@yQBt*9GU1{#jLK)zbsH_h!XUZ|A+lXkEB7utP0 zzTI8W?^a5Tc6Y(_g-Vgp?k;$Ep)&QKw3~66c8ML}L=1;%2%rbqz8;UMB8}zjf>-nq z9Z9zdhz=Ija6-VR+g9;>b9TC*EHmNdyv5=N zX73`#ztAMuWyX}bYca#RX-z*({w2b@v0EWkm}Rvl|b!@Q|pj03`$TJ}DO zo-Brmv&)Qma}&94!o2xvF`L)Uufe=o{B0cgP*rmRz+wOiy}X49z5KqbCLw1|-*=|I z;50aC-p}Yk&^z?>HPVdz3^(e`M_clJm&x~nB=F9@CK}v;#XdTQRzW$(aiuhGv;=6r zT{Ml&9q`aIT!o~e5+q5JAVAvC>1O1uD2*fT1g0m3xor8W8Fi$Z zVhAPT)`*$ZHl{vbCkMT-jOy@|@4CGp)nri{tY~oA<1D|u6G87WPkdXI*+yHFm&Nn@qlA|^K_dO#izv2QpPoxLnD8Ey zW4ve7GhS}|&t)husA1yd=$JV31?34V^!@m|3}cwskbg{guPfJh?`IwZv*d)9d%kW* zG^q2pC67mgTQp3Z?!@oR(=c%+i=L!j95_}&{Xz0)oI}II$tl(G_Om1d52u;vsrgJc zy8APwdvC;nty*6Hw##A}T^>`5!wio^r#&){gx;kyicr@tj& zDXn~g<>wQ7?Zt$5RN9Pp9KI|5dscc_O!A{IFnp+1j^RV)12|}%*zZJxzPSuvsV(8X zL#Frs;V#2hNOW4?3T^Lh1>1lA-V4#7SqHx2?~Di3d=1XhQ0dp>ESY88?Z9;Vhs=FU zLsI26MjuK4D-ru{-CmvM(e!&0FS?wZJb8lk`P}9FZRvvIL(mh${nKRhmy;OwQlfqH zSB_!Licz&!QPrH9OhIvKZ909-XLEL(?}_0n9pwJ^@s%8$fv+@MdpDN}n`=84NKgJe znu9Z8v%7PFbR-mwov#gp^r-2YI}FnM=Ii}PT4lc8kEDa4DBFk6gw4>ofMPHmyfd1U zhy$aqcYO~j5eMdd9(uOXeCI5Aw}u1rt6P|DLe3Ezg4hpRZ^3~T7~~Ba4#{Qp0}i}P zOPQbOq^jnG0ea6M125*cg!ZHA93H?yc*J|RY51%~f^y#^h6S^J5{uh9PWY#W|NrJ~ z3^V5ZzldM53o~A^{r>@ei4VaX@jgLWq}k75fF6ojvQFspturu7f;b+tgwW*8lQhf{ z?OuvmGS`GzvOvQuabu~*jioS%9w@s!X35wjmGX#0%#sU}7?z2FS@LQOv!q7P71!5L zEs{p|AjynFKy9!J6Lv`zlBWD58uZzrY~)5k8QzYhp=AueeXz`c`dOdfdKo;R~cB&uk z>Q9AT?#0;>9LD$p@cueg%kiz0kojmk@Q+ub& zG5(zo+&NxWMDAq#`Y&lLPV%EP1J|Sg1C1wo=_29fIr5%Iqd}iu|GOfg-dr+xe>@`^ z3|%yI(fm76VCw|^sMfxX^o8^zpT;cO<@d4SclZE9AVT=2mizT^nqK!HPiDE%48!1c zOly10QSU&3ty$ySnvpP$uic3Pdt>?4EDqo;41xZLI_JOdKmk|w_;=)L@2GJyEXkvH zuy_HYvnSp=>CSk0sKHipqN=G;>BMti1n^V`F;W9jC!d&77S}yTi zEtmK{K{=sBC(I?Dt_VSk^Jt zBU-I8mcM3^FUm)c2M{u1>mR0B|) zE<)ow4a^<+a(kiVzU`@Ojg}$Ci_d6wjxbpqfKHZg{KF+I-#DBBCqb-`GM0?bH?H7e z%`uKEHS0e5`qp!eUr5L|KGqJB?><4PDc0%|An?ALY05QTq2(H{0Hx+KxyB-Zw{dzj zxIGh7{7G}3vF%PlvCR;aI+_z~i{(Qc=dhfhAC)p+0WY76)s*B)FK|}57(wrrXwe$@ zt9RXP7`#Vm&X}W=(`xf&061`y&_2W^(Y#I$#LT8tiVb~PzfSBO4$^+B(IlEC-I9-+NXK<^ed!IIldX^)0IQTsWr&$(lNof&;)o85v&@L(lJZj4lj4 zYZnO0%UaBHPpXDvMlr?gv3$r^&Z$8%PTGE1oL)udM^M!sy`LYcY7VZ~;u-6;n8kWi zJY&5U&sZNH&p2T`IH9Y8_;~O~Z$yFSd_j4vF{SHkW5MrChy{0!j|IPW!vwM59xWEU zV0b$Qb)m7~QT*VRQAy70h-c_5qCr|3$8} zV(#T*!H3gLvEUkx$VaKL>)bDM>G+U&p>i-!9Qesx77PCVZ7fc^GK1+4?vuHadfRy2 zOuGGFj0JbHSnv$;ZQo;YpnuTXaAg{8d^SNF^|u?b;ONe?I> z2z^kWl}U7aJsy1Tg7|pw<2NIEuakq`U))A*=3U`m=1Qbpq61n196!^~b6GMuPxRj1 zx5dYUlRhoGo%v_|sv7K9)tt9)PKXEh2uiIROO)d4QPOs{=pp^o$LK$9i;oLGa+z3gJyyI)j|+Diap4=AFB2DjFT~=3 zf0}&xIBSHVhwwS_f14@hx=M?=u1jWl4LYB?tgroYG0kQ1G0imQy37=FJ^x>fxh`Wd z*Y6~&!N=!nG1m(OWnZ!yd~5+Iq>r(f>lNc;t|!7b5H$>gN(4Ov3|FI+jKzC4niE@U z!~neUV$e2047(O%zsF{ZvDf0S!`hy(K1T8JZsYwgrx|t}#eevXmFfp&X8q=*Cew$< z$8zs-T$dLg%bmtzx&P;!iDS7paH8i&Zs>b*!T4Bi%!{7NIXJLysTRw9U7l3KV!1cF zTk@onOUJM44Y&RCSZ??DSnkadAI%ZSnlCu(ep-GLM*qS#c~U#Sng?BO!c(?%dyPsaHr5UW3pyUyLi zbzP|CyDrU+ufgu)SuB^&CMah(PWA!x)T9Z@Rt&wLFF^sG@geXYT!I2<*7)|$ zFEMf%k7~KBKTb06PJe*F`^P0HuyulGk1sKDs6SBEoNs9u4L4bt-o3!e@QR2`vz@2= zfTsu@?#&l23d!It;@}jYD_jiQh;Bbs9_Fw#G=iijED#7+2uf`d^&yt&cKem*qg3au zvN8L;lK$q(6*d-IMxJ>+iP}$dC_Y(*pscY{Jj=P^DnYp;iQ*5u>a}HU>d8@-*zC1MW^ZaGWY7jW+sZAkv zRF-B3IH=CNHB}8dF_h`ohAN1Sl}&vJ9jR(iKv3pe$FL?kG0d&`9&6W!vGm=^YVf#L z$Kt*v44c9=cl`K2vm_ojg3wCdQWWS_)tn?k8y-Qq-zq4!bU~?^EGV^e1!X!1J;ymv zKI1I%QI3;`IV2zBvgMJO|I02P=dxr#6(16v-}ts%S>MN*6Nv_eOKKVUCi1PhR>S}C zGa65rB@;Vpn2trR>{O${e`r`K%-52Dmoi&W)GDmS`t^;I-!XryR_F8RY*3D^hCZ^k z6b{K6K2Z<(#@!ftGnQ!la&x}qo)1#*gh%NZngf?rgFxuqxwK$1k6W?QDHr~H!xB;(Yw$}Oqyb9A<21?Gc z{WuYzm)MbY0FJXIsiQ+k1{&s69c()Q`k zB&or03iO0mi+vP-X||xy^<{&eqw|;_ZN&nHlS1BMEl`8LWVUxwXJzY_?!AHNu_UoI zPX1%k&N`t_NP>AQQgmFEZ27leMuWa2C}ZasHo$*=84dPZp=^jNVD*wLY7qQFyU9l; ze_>IBWNjol1m)@^=+UuT7)C{w{D7OhFF%G+A@KS-c4$~l`E(tuy$}uhI4E0}A}A`a z#Sdd<%S=1Rc-4QLW4?|s&*B>$8s^TU=c2(h0LO?n7StaxRSmwTsyPgE!yyx%K={G3 zNor7tsJ-_j%>UNu#{9S3I-VC~Q~w+|YOSpAHPp|OCExER>o#8wUyKId*6Jlzf;d3< zZTO;I6EC0oGaA2)28D}i8LRu7FB>?OcG&{rz?K|x^{O?!5}vV)7vf~IS_R7NZ0K2L6KH*v!7S)mmL@3e2L*^ z$9&D#lqL5@S)N5_ilF?$!g72e?MQwRP05UF2K9WB?k7BQslDU6@ ztf^78hurf&ENT#gn0bt1$m3LAi{;~p9+|HOotG%Kp4?>7*C<<;1#}+s=>I$`lf~qJ zwp9&o*Vg2=1*Fe*DhG}vt3e`Hhi(K#jHqQBFuTU?&87DYCab~D3u@W+6n2gEIh$f! zA52z*{pZy((aJEE^ylUgIecC%YqlEiBYO1kje_!evKn-rQ_Hqdxo+3?XR_tLgBtXm zReQ|OF!_w+my*?>ct$NFbL_Uz{E4#lNw8-38P)sK$wV&$2kFC&7Bwhn@xIYB(IC+y z#>lzL=xUuDct0qP2FYAge;Mk0^nqJUYx*&ew&oaX`X{$gKT0XqV$6zfW&3J`S3iYW zoF)0+o5td(Xq_D`4vV~hwGnS0@B626?QJU8uA8u)C#_+!nbt75d#a?@Ai7wh=lo^K z_7Zdcp5YVRR!?*O*t4BerGJ>7v0mnxH|r7It0T|3PEM7=C3GE?3LJax{9jlu1hHT9 zZ$W{|Jd-Z8sX&733#95>4EzZ)Rv+D>$M?tY?Iijzvz|nb*&t?)kC)(Rep*Ettm&T& z-dPyD6*l(&KLNZIJggCuSRKhE0Ee@_Ftf-3YY4Bam<4MpS-xMKKR|#Do(h1~L?8EQ z|HFvpFw*~9$5ij~QEtr-##HYH41Fh6HAm2NdGg-n^*N6=kE-4cR_ObJ@@-Cj?{_Fr z1ZYhdv$)s;}jwECF z%q`50Jfx~QgwOq1Ywu;fJqvsPZ^-c>w8p0$caviqS`+5k@vrs%Xvf?2{&4Jg3ps8{ zS>w}=L*)3`l-TzK$+0sd_C4+7cv=Si9&-E>ay&hQ+Bh^eh#b$#ptU}KvKR%nrNT-5 zdn+9*)~kIoC_mTgH~0V)qO-On-kWWV&CbP|jg-k~OSlCEHkkHaw0L1Tcd4LZ&+sx- z>+!^h*2{YKb3|ncOkuhl(Kn8A*`*^?w`Mdtr1@1SwxH%)X~f|8`R`Dm=?&)zUsUz# zxo(O67jvB9c@D{yT761AZk+Uy^h@ujxyBCZtM7A$jY;|^VA8)V`KTR9BUF#Kmy*7b zcK;2tT1p2Icq=bc1Cz`}$Q2E)*81H!rqcTDX9*20qWNZup0hSl?ZR<*6xA%&W2$+M zM37LCF-O&ljl4j*{uhtW3naYl*B6bvKt0xT`!EVL-^^l0KK%^EYD`W2+{g`Fq^RR! zg9I(tOCR%}-Y$%bEf&AQ_FS&l^ael-`}O)$DA00Ijnx*U{w7|fn3}?6a>#%O??M-g z4LYT&IXO;{I<ddu*&SSn%f0Myq(fz9|q_v=7m1Y z(_h7vCMcK(MfXjad2~1f4naRRK|Q{>`gf)0!-!)0>hU(jP?f15BSC8jYkkH-cO zJSEE<1UdWCe;1Y`2=$^{<*_puwMYy20jHJ=zZ>{dFGo`DH10ApCKoFb;)Qweeozz* z8hjc_zn({P#^%siPY&t$dTmYfaNy%u{AQN?@mw6}q;^=AEYHUQ;gVXWj}ai~)iB_d zCM&Z!Cy_qiDD?e}yrW1^08lHrekraN;QmfU(>e!*As&Up>QFWW7!Y;prn+1C1|b{*P>$zmlxiGsSG5Z;MtV zDp3Z$a;KntaEW3-o3H>Z z>GW&1NpxM~9LJX$aby-*Dbe(fc}(vZQ7v7=QC17I(*iwxjY9iSEs}`c9Iir=RaJum z4?W?Ttp4Z?8ee-I!|EXpyhF2@jZJeji=shdiw(~tHZ-kYL49jZEfy|3o8{!}$GN{~D$CFwpn?6vLXO2)w{UMr_?Ar@kI+II`7Xrr4Yd#_x%mV@`A%X&XRKGlm`~2<1hu!J4fccpr-vYS<#LJ*b}uyIfWxYq!=7jRGApKvp5N)uUs8LMwCA@@6+Pq~j0a=+ zS&cp}XgO>xMbRJvN9tLCvi>*9TH)mK`J{g}0N$V#?sD;Pm(vCrq%GRdLeT?$q5bY_ zG>lDv-oIC~wrUDlTOX)u&IO9~oGm|3=+7d0$h`Sh&6|J03X%`!w6+ySgD;Q6JT~;u zuog>tFOex0(L?&2%R>gmqqsuzIRf-PpUHgofkMdm9U}Hy)9L5&^ZBo&!l4Va&p9$Q z3GFLfqG#qctnLG`0bgf*K1BLU^eJLjY;}pAFRG3BXEL|`*xWkC)w}r}m5o{Q^9TaN z6hqTCkLE<&T|{wF$oeO?3_Z89NFp>`GYJlndtE)5Qbg19ivUhd%M~u_<4}pg8#MRt zS&(*TQGM?aj224$)hJMD##rM;k7psJ^#SubkJYf`1*KvKM{V0p2)ts#yET6ReRo&2 zk>m8Gs^$c&%%^nS4laOrxQqP1VFwo=dchA9-ZNx+Pq5mE>;5kqqhOcU6h?z^N$vF| zJf}a?oFjUET#W*E6h?zbsh(<=$$dmmb^D7X@}0R0QD9#JHU*i_CFXbT2dOgC=*wdh zjF)xc_`D;1PwwmsY^-)-@De$EY&%D>Z@!VxhRbfWagXVH$@~Ai8U@{yGSdFL)x>7D%Q%DC#SOD?ATCzd#G_~&dA86;#;6F^pQijXU8FIxy9!u- zLO+Jy(^V+YqxB&W>w|;#VfSRwlV6Pj;VanO(HafB=+WoU{aO*FtyqjshUodL79%EF z1?3|QeGS{WKqrPd|MfNPpmfm#CK@Gev}^Ar@1$cg3)5J>Z(b1%?$L5*+lxWjt*SXx zUW=0?JvKs269?eVZ8Qe_9~H3}@LkZKByFyUj{y(cbnIO%CqUoF1u=8r2_xRpsl{8? zWD9-dJBWQSgwy9yTn}u-T?!cH{6`fEY_*9V5l@%sIC-Z_`>RYiP`v25r+Pe&(luku z2YZRtV^xq-P_`n|yAjNJx(WqqlH=d~+bSa_;tMS%B7mn$Rol6MuTW6vIHri6Q!{bE zSImx!Q$)`{$njNza^`L$#%V>0=s7+UQ(uZXXQ~*B9!QC^2M>`pSZ#k$@@BEP&iksg z_2iu{xuvXe&<@_o+HEzh>xO~!%6n_W9m8@%YbdxAE;tYZA&i)~zB z12mu_YW6*B2uFNHh1t2NXA$@+Fuq&8cF% zuah_W^Hvq3r&ye&05lfU^+bFeW<+bpET3E$yeHkJ_BMfpvW)ifs>bu$Zr0v_-X5`4 z-D!fd0YUHI65iEpdY84z$Y~||vj7zzhR4+2Ly7HY8_y_iW3Ob$T+0JP?;Gal_JUNC zYdm+tJ-*)!tlw=Z01m>_j&WG7u)!Jufwv+J*7R$8B`%`(I>f$MZjVFgvjC>Gsh)B` z-$hl;;epj{Ye^TB76iRp68bWfZ}erq+xYHJ=r`Ntuy42w|^kdT2B)Z>=nNN-|R9j5hoE6WXBlLbWz3-KP3Jyy$t~&F1powEF3! zpETd3kk$0CB)qFK-FVlv3FE%ojRL)6>KtOD2N3k0uZ({dWg5>Gxea~elnHa`5$2NeKCAKg* z$H`=^k>?WkggO!QK5y>BYe=doHu|u;GJcIsp}8?guEEet*6?f$z0W2*?=W3Z#N(Z#jBiamfKX`PZK>?Tt{(zd;dM5jjhv|jr#LSW6cr0A3FqP8!*2);otqE zYVVgcA3#uw9fIOk)!xMQr^l0Pd-J93V``9_CMYEo$An=cnb#8;PqL=SINxIKS2~tl zR~g^_Xr&2Hl@~o^ZRqjvWpMvP@L`Q#LRfA4GGVd%0rNq`GHt`Ui zF5&5-N19>yyd7k$@pP)IZ<{W9LNjo@J!#UzhiH8_2lYR_rm|W*D5`o#=r`M`UzN<& z2T``S_N5jV@%IFKh_rq4m>NXW1!cFE=W~)nF@8_RNfk`vv=mFbXBgu&Jz<>wP>BNM zSw`o&59xPZ*NPzBC4yAtfL*mFU*1n zhyzg&+s<&4O1)rhO#yMh2I4?6hy#z~lqGZPS4EcAKOSjq$PR64_%O5@*}8v>k~==< zQsuODk4Mfuxhm4ykQLh0@Ih!b;=7M>sq&JB!q5j#u8KT`EFHI6K-#owwdo$NdxT4s zpFv3-O*m!s@TltTv4E7yi34A94taS7tRZ%L3)oKVfaH&B!PY$kC3QS_L}*K@zb5hw z`K`Mu@d5T+Rgs4qvqEbd zKL~9?w(f7QS{-=^CwH8Aa#iGWE=@MB@!eUgR!8o~mX5(ES4EC;X)@{iY8ML>=To21 zowMPtk|RPJ;mK-!AU5PB+R%GpX_K47CtGhb#;t`>3@k3WfjypkG z8Q$AoJ6b>ZX86taeWUe*DxsS()l0s$1uWgQVC^8^R$I2Qqxgu>RvX^kjvVA$xK_;L zF4BJ&Si1L>Jx#CgBiHG-T3ay>U3yI32#4hRMUW~J@Do1YZo*E`u%4+ObrJKUl5yEq zR})!TR}*mq-&$NZJ>qhLR3XBtN>%kfyjbXJOt0*kJV~IwvDiO3^aDp#*AoA`p-0jMWrjZ^bd~>bXa=%%mo**^?Ss?~ zTcahk+94?R#y3N+HcSeA$B#p`4U)#vd#o67@Hw=WxJB~xviC)qV%za!!pSROKdi^N$a-$`*&ObSH ze(0_C-o`gWYjNI*TK~JD3uEqtn?p|!| z*mtRE(B60;Wc!=YcKnFY_MV>)?ep&q-N8*cQ47|Ot&ORneUR6k%h@}=Le}nD$n7|f zvb*klTMa^jp6rw8Q^qXdh&ByTQ_N zr5}Y{{@tM+Fr|ApLLF~{rP~dt!`k@g5Nezh+5z_N|KaCD+c55E@$U_}VA6>nG?0Gt zAFpgU5ZZ~Rbia%E4i`-7-V2jET#(jX3w+14BSKqEcy~LYLDHw1vW*>8e-qmHG}QIN z5ut5i_|5hi$kOc|tsiukZRl`?-)S$Q*SRit`0e&eK&{6Cx4OXAngl@W!^U{WqVc?A zPp-i`;&b|0Tp!^T$3AU(>9fB!zBH}AHnOO`Hqrt~2b$91)K(xo*xI_C@Rf8>hz;8U zmR7#LBvQ+R)Z~OyHBrVFxKW{;tbfuU6b6Z`*J&r0&vzdY+UOc>DT)*UIziSalyF zGpewpV?jqaT&k1+&0jxXrPYP~iC!0$?Hl}2Wf;h8A0S80kJ5eGftppm$c9zEhzoG* z)>Y03I6*1`M0rj49zhuf(KAv}RSv+lhVKEomxBrf#m&PS{)kWxPB_fImv2Q*P+a7> zC4w@9kwn^i5_1w95!&eUOIS|pr7<-)gt5dhEc4_GRh)EwjP+-?sXwT0UVMMn>;0)_ z{aH`mm-Em2vzo=Vl5wcR*yzt{_B}sRSv)%1ue8aJs;n>QAzx&L)|cIhV{@b47dPw6 zjX-l{{%K!k(mG=_1~=A^ndDiU+&jkRNY|r(OOJE3cwL9Qb4(4s3NXirKhKk29HV=S zY>oV6{2IBKldwkU-r>ND=GbvlKBcU`OWS9Whz{F>v2=mMrEg$PGRKdH>3BKhXU6D0 z^v+=}r&P~D5UsG&XRX{RTG7tiR8t=(SjUIWeVl5n-~ZEVU^Hr40~ksFHunGW8lcz~ z6R&{<6Rd$b|CiQ4BK`j^s>Q?r!$Lzhu^O_d0F*5lC|?sZ1!Y52CsB7{H~=aqTlZ;78J79$a-S!;Z|QUXc!yW^3Q3THd$W_=SSmd|MX})?f>`ac-sGB z^y_K=#;>LQSI5Q8#b}GzlY2lSeWP?#VbIamRM_Q$nbO8&2vGS#*T8JKWnFD#+q&Aw zG~l1x2KYHQ@bZRr246?2>J=`7@kIKXo@2()Gh$MPb?n7^a90)}X)d5R+n3RHwj4-? zfEjz~o@BPyNcU4QC;f6%4R)r&E`XU50Fu^XEYUbyUfAig!cO2TclxYoXM8NtE3x(` z94BV)QXcUHM$*qPO5hKyuICS8eaWG7UzQAkwV0EJwZ4m(lYT_!TgMP_$dAV8fzitk zN12aZ#8{d>_VxVakJ*>wC#LbVgEB`OOZ~gZSWTjR&C>FOk@T%(2>cXdX+!DLo*K;2 zefVPNeDtGHotGFi5w!u0rCWiqM80W=!!bYJtYmPEt?!AaxjhN|Y>$Sext!So=e7C$ zJN{a z`=-6svG1nzWjnyy`rN|>%aRV3wBA|?cm3)n;dCVeZwn6@J4Wvu+)@u~P*nBS@{r*| z+>#2guC`&II?%76|9kt=`@h#cZC`#JN=sP|sjEo8Z3r((b?wWq<>9VwdWI?%mII*H zaER#&xIj>9O*~uIC$Y}6TLtB@nCw8U;Z}xAzHOB+g0!|aB*?4re43k(PZxoM@#z(U zLgc6+7jP@X0?m?dA60`RG>?_m4UXy3!yGTawXP;2v#B?r@l)|tBVIoKUYC`VU)?$ArL*oRIXwwSA7LEFMZ9*BSLwt6ArWf@U6Z$nVJ{t z=P;Kq>+;kx#$*`cu;d(7gX=Jo>NWX_G`Z%AG!3GgKv~Ygi5gY)f?ZH*F_y5(#tZCZ zyf7UvJ~m!F9j_+P0r&X@BqslivM zJT+pavM#AXeO(OyW<0-mFl)TMHMagkZLd!BTus+mPh9-zIS$3v8eMyPfXRsEOh%CY z@5U?^@Z3c;cy7e6u@S?7lusreo7nxk5_3vz~UVuKHjhEEmxhf(D zSPbDhItLCz#w8J6&g#IgCG(LAn|0pq&T993>k^YO7w}Ap-IpcbPoH6JKXAz`Bkgi~ zk}ew@@+=z!KE&`GdoEX=Zi7HSc0Lyyzn_dBzpor$r!V~~UUpS+QXCJhWxDv?SoE-5 zR92h&(ppOw<)QCsakN~vye$pV1J-Pf zs^0B>-u^3m{b3?Ea4z+=d3=7My%sFD)}{$IGxb#YgiE0Jq?I85{x zAHZ`{K^%b5rgkWR%-wbC=dVu!X%PtJE`SslB$ZY=V15(Fog(XVA8^vAkac2cO!W>w zb2E+m8@oj41Fi2?68K+AD>#ej@qM1Tk?OA1R3O+Ejh5p ziNV{8ua_>YLK%OG?WNH=;+_bXSGp*w279y^Dw=Do-Fp*=o*#^b!N;hsmLu!{~w0Q-Ahc4d;A^T>EfT4PM&FNnxw7^ZZ7n)smkoM>b-q(+WGo z*2`eQ3em|Awuy3;JI(RJ@X_4*4;K<;5eLIPgq5 zq0e0UzlHvvO8+<0|2g!3BmG|>yOP9#_30)W{%AZ6zhc+%67wd&xcIAvb(4IUqcJZ) z={ekL?TV9M9Iwd|i*%ObD9=03B}o@JtHf|jv2>BMNrcuf%_DqDP=>EY8t==aHDlIT zA<#)Np=L@5SlxZzA?z$p6Lzl5hMl~la_5H0u+zy`?p&FTc23I?b`DPls>i>O4Lhgh zRPGGZ|7fSLiL(#gC@Ayy`{w(KSl#@^1>nuiDa`bxLMEA)+?oCP6r+R_+A)XUIdYNF z9iidBTx9xd^D4vFg%b7GGlDY8Wy?p^MdiaZe~xbrpNaQ(S>kjQi=m^8FkDSTzvNrP zBS5hio{!NTqpg5OTVc(PJr!Yn8(QUyY}5KyljxsmXSwUg)M~A7mez1PuKL|<)$RKVe1#FSJ$0po5uQjO~<-^ROdYo>i>Btq6WkBSgjp0 z2OsimT_Kn$k?SWc5Fk7vLgU2ql2X38$9qPuE!#e*VI;oPNx1Ooecu*CR&Q~Q-9u%pvN*Ag$*?Nc0Z*pbq6bHVa z84WW2nkD}wq6W`Wos`kd2N8WtS}rsqMsaeD0_mCwp=;qrq|WUm_^##uP2axSQqCYqfEl zro6o~9MbG5UOLNRHpjo#^=Uhu>$sykzVKx;TiyYae zjfKzr4Zj{QKaXc5`qe&|&^8#^Xp!{yn05aO;FzvgYu5ERrt5`4A~v?J>xDT^#!2G9 z|H_C4N67l!xUl@pc96)qA&!&bvBJ#oMoW2k`OW3v%lk%nInnj(^75GOW|x0&g#hix ztJTWLMnrK<&u|>|2axw47&Y{?PL;{TBJ&tbpa=g-8v|YMO>=A*P-|x$_y>(Gf^qqJ zPE&sTxvFBOFH~VEQdP?Ih1wM9BIls`LJrM)BbdvyZdovsG59a8#EG4qC&QVu@?IS&J?&s;-j$7`w)vZBW!8a5=5y`UT8Oy%*J> zigQm5MOBJ9{g)`)BO^S@H5ms+xrKd4P-L#l0f$^KE>d(lbZ10O>tJzwuA3da-^qvu z&xhQ7pW=em?{MH9N?J&B|K@_|$pO*h@*}&;U*EnJqgEf$Q`V+Pzes|+s4r(8DD>SY zs}*V^+8xwJ+>!)0xG45UzKk9f2b4)2GN7~ zVtVi7i)!$ks^;`JHni_)6xtWA_PrWz6xzd8poAM6+HYL#d-YxfWv@fQ>Xr6;*M$MR zIt`OGdibImBxA5IX4}yiFVC@!&^NLOl(#Rc!DAbRKJvT^gLh<+pb)!~*qG#fwI>?} zk0ou%M|HKYRsgKIjRPdHF&`a8SkrV&IpH=gf&dPW3A9v>qqule|`IQ%(aeG zfwBTPss6kg6s^Ke%D1Zo%s;E^)x2 zT8%eTeqDkj8n%KUzbv0W_=(Jy+TxKUPcep=s>DSi|C$;A95 zJ)cp>g^6&y{QP|=(8)8*+F{M!)4zFc4a0`f>QvCU>=$Yn4#3SdIyPZeX(Hx}F*bJj znp*wanBG{NBo6#i`?eu1x1Pp(FGnm0Y`d*qu)d!MUn&QXq&M>tI7&H+kGFT~-= zoEx!7E)%BAG&1L(vN<23escCaY4;DRO7maCBMZyVjDS>}#O|STYs69>e*Nb1vwM)F z?y)lY^*WPZzu^t}m0~geCs_@>h zA?imReWp^$zE7iV9_|S5u}MXK)D^BumH=QUY;L}3wgY<3aVgSKu0X@&Wc$7D$>PBM zD#aTu3v;)YU#i8lCO;WlI<8zwdHB;?%hiz-Hm0AZl!v*g^7nWMP~O57$VWF;Qd?^H zOl3KFr;W&c4V$ZSvN*6R4F~kPxqJ-@#AI1hf=)LDyxXTlgG0wtB%Ri{`%s{t&{`|= z^{L-Sv{tVE?qzA%z=WSH4!lp+!>C$D{$Hdzc@~xL*YXg!P{K?4a|_dO;4Ej6bUeZq z9s&_AS@Q|!$Rcm1jhq;5w8wOVT=~Q(li$ZjnGS9Lnlaf!Wc>xQW^!Ze=pgwPa&8fe zrzYp#`aTMDo;SXC&-YQld7iB`{ToAM{hedqsOz8SIadFOeB0zS9Qfcf!h@&AaAReT z*ai8q<6e&Wh{^pp4F^8OxhGZtc#F6!szZ|FE}~Z+PnJH#@%}=+o>9S+XiR6ilCF=b z@&J8rzI=!S9aApz&m07rS-iBTS(7I^Hp)18!lhB&UEK&VeB{rHpzAnik*@;LW3hyx{={Es(U7lTTkIXR4PP|aVB7OXnFQp4HjO$Pym@^UEO#Tq}K`{b0lPC zYwH!Zwjhbt5Z>iljHTMuzWKPWW_}ak)h_~gx3ir4!$my&me}QSa^sbF`!$>l-oH<# zb&YT6kE-5tdvtp-OMdzylasEf>bn(VUsNMEqT=#RDW9c{h|J^e5h2hNUQ#@Fv$sKuw)aSue0&@Op4LUan4eDCG|0CG()k7d6~C~1NDjYvJnn{ z&SCirDqDD>6UoQ8WLbaqs9jKw+X>BC<)fTUwu0zskFvR-Si?D6^5fryw1DE-qO<&Vh2AvzC6wS!4@{9ef zBDB$*W#C#l8V?Q%s;iBxta~ux0!ufIn+5)a8;U-jc0_37>q;WEPLLLccelGo>)V?E z(L9KK0!RJIoEA46GkkoyA-js4nsx@4;d~1xp`H|{8}C)w-fH#>fGJFV|4LgQ<&|Q$L4C@c-#E- zNxE(RR!lb}`n&#&{tf1Owc#p|fM>pT;L*;_L?1{M6qi<;5~NfEA<*802ye$)vs4KY=y4 zebKrfkE!1N`X5C;Ere4?KM~r>Mm}n9Ne^~Zub&%f0ekm{R*=@u3w5*roLI{hecU?? zcU|Bda=BVRxIWs{{%J9sa$QorzraLS&X-@HGK#*AEq${46~?2 zo4*&L)Q?5^i*MbEh?@tA@Q~$BIMqyeI}e8eT+hYkceH83`Q4S4IKRJ1^vCWp{IS@u z2|14WW1lhnv1d6Xsi$?{HPf5Eb=rvGizHl|XS%imM9;#g*(dLiuRCqTz>w?TOt^ma zX+y>pBhfP_8XrqrblUK9{^fMMZ#?(3A=lhk^jsA+$Eak<>89)3c+pcBjrXH6>_(K9*W{gG3~`(KLdn_WJ2%Jl41(W8#Vzx#{W^(=Y&X>%;3LmocGVj(G> zvcNIS1wc|*i-`@|OcTG8IEXNQWSJ$naU-!rr%UXDl z2wy+$+~2VelH{fWIJIH3`y!{RUTgi8ksUlpuNS~6mnK{F_asq%dw-+_tlc-)-5)t# z_Dn|$SWobES4KXAqK|htL3(Snsr~gZ%MqysYb)VB`veQyKi2w$>Q+Ri0pCsJ{f@Gy zI%=rA=evn~f1&KD4kF{98f|J{9)?p}wLYAnI@<5McGgP+`gl+*1Rn1AJBQ_K26|7M zvA+J%y#Mr2El3ncS+GdS+BocdB7E8ju+s@>C($#1_~b*8B<=fJ9(s`G-=!cyd9#5J z?QPf_+5suuEoChoJHSeREl)v&=)r23<#K*GMNstozoRojxwT<(-V^@PxTeh*I;tDubb5ZsFg8BcMj&a=t{{K`%?kDEb{x4OhM~0a|#%FB( z8!wVEa)&8qU=A6ljjEcX=ckgn*601Rd0RSKfa@l6PUd@0+0z|lzK5c!m+(D(yw_@Z zyf{f5_(GF;qz~Uy)gYsH3&l{hYk9!M57lbvt|x$hXW+jT&R05U=dBf_G6W!}B6`?(F3Lj@D~)MX)nLUCoa#s5{U8-K_qr`ogu_zrFi5ktT3|Sd z#iiL(S-pybD#P(7>)IF-7Q?bp%N5$As=*H^)?8N1PqB6w4qroPfVQ102UWJWtzRe4 zj*P>5J{Z#>?|!$%gw*pUfcqaEr3oCIf`-xrIz2_&gC+F3xm*ya)t8Bek9{`p&T4SIox~qAc$B7 zKr+3@A(W$Zp_~Ju&wcORgMx@;08ZBNC|8-VV3*uksprqj-$@q~LO;`P61v`QObJyv zg|7C-l+d?wE4zN!kP;edNDe6_pd4#>JJjaqLL2;hLT~vehddZ{?{2b(++gWA=zll# zX47DZ*g8M(PYLaSv<`B;*>9uQANIc&ddj~)v=gE32OF&+S3_ZF6S8zX(zq{lWy2@* zxr_$#TzUt&r`exMuRr5I5VAD97rFtX?izn#Xa^*9T-{&|&1={fdc@D3tM^+&={To@ z-1BQl?|91Z2tCp;B^30(AF641FO-fg-Ij*J(3AdsAs6Iyc;`>lp4A;y!_yIsI{yxZ_z$PG!|5BjHs-ktM5J8J#pcv83P;G6B6(BuyC zy@Z}zK-%RxroAJy?bt80ZTj;Y?HeJjb@iWjx4ZWXZLa-78=?Evu9Og={grPEZG`@p z99+_>lnBa-{X*OJgH^5kEa<{%sEgPXIt$aV0&b~j{pWHzRUzIt0|TTSO6 zx#P!vTj*K;e)5iP_rU}0L~glYayRMci~fwz4*%iM>bHr#W9zOxxVxR@)lcdsboZ2> z57AuQ{lu=abd&KV^Hd8d-Ft!WIEK<%$vC$h+|ypWUufgfL1~$l6nc8U&{lo0x^>%r zq3z0p3tO$}(1jg{=BZax3|gAw-^u|f)x4mT@Y*pCO0`W;N^IJ(4V02JL8(sDj?+LP zbKy?ca>ddaUogG%zze+Cb`*tAPw@T&M-Mc;q_?v$){foOl0sPz!;NP*-l|-)8&P~(p*iJ+L!8V~B@sv-MyI*@`P;eT2 z3V`8hUFEEv@h}!WGt-3`CAP{Lr4ILu83k1{kh9Z+ENN3~?r%L^@RQ&U;$uG^T3(xANAck>`hC%?B3-g^IrROEp2nw1L&Q33hAZE#23bE(J)<(0mw z!4}_l2GMl#f63sC`=3f}N#ja)_#hL_g7V7y-Gh8Clvn$f4Wcq~eCuFKZb~Vd59M3^ z>305lD6hWXGl&*Lxht<|+3~s`r`E3g_8@-~luz?5EOp(#Xt36SOVOQB?z;bu!F?;A zN#&+NdCC3X9YkIzAM!06tW8TQwK(BPekqjO9(p>JyBo@fecv8L_mb><>mAqP;&gQdHW%HSE&ytDmA@=(NT7A*#X_YgGt$wegY6g)-w^h4m5Lr}uXVnZM zhn{b;PMyBAdIquU%NwmzXWd;n<5(^9&Gfow{Jz0Dwd7u5#-VjZ%NFs%jNhy)TDH(u zJ!AOap>KoVI`!Ct&^Npm`idK@Q-@bW-*BzacWJfIcc0%nb(pi19$Qzm%tQYFyU=&L z-#WF}Z=L$|x}s&n>!EL(|Ju+B+tr~B$=?X!ly8MrB+m~GCzprZ$qPbn*lrAcwpQr- z|IzmL@ljM)vl$%q_Nf7iHEZp|(wHiPvbt&4cQd?WQNl>U-1rid5Bs;&)y)&ELZ1DO1 z_4{jP?%aFsxo_v5bM86kj%?++nE2^<-Q)QyX<8%K)wclTzNYzjwXqPBx{k(|VuxuS zK5Cwc8FM))>p%uZTQ2`)00;y&X%d^CP0c9_cXQL_y*<}zGlo`LT%&&5UC2;A%N zPGc!9GTwmuj5G1k_*vLtvf-l|T*f?u*73@=`FLICY&<=y6hE0c4^PjWiNDA!$M)^h z@bN4g-m>OqyePX2cdaeO$8%<2``R0DW{%p17uU?h_BFGxyvBzAwpN9E_qrMQZ|kSy zP(9c66u*)+4^PjUiJ#0Y$I~-y_>0Ukd^~FgUX(o-UtG_1y|-f;UTc|y zpRktV8!~RdPduK#@^Ix$JgagRe(q))o_6yz{P5%XD?hi)!0)Bc!rziH+&&-ISIol4 zl1p(*@;p2{X(oPsVL4{Gww{u58{Ww9J-eos;lh*|_{;)M?$yo3yMgtbxrvj1*09@i zR$S*L>AS(;uLjnW*|^KIOI+u5fX=TgXzO{3)p;IX|CGo0;(G7TSfk&_>OAKW>#=KT zr7Y{oWR3ni8uxlqo?quZ-mu5>Yozn|LFf4vrT86dp7or1alQA@8jt5TU_CxyJ+GrA ze{vZrDQtM!GXr!U-Pql&yK<-C7GOQ=#dY46#um>mF!*%|P*S{);KKTM?OW%qe{sDx zzVW9XJFD{_2iC89alMzB%9J?vt@CDOvL%I}^B)4nAE(omT-|rz#JK&yDP1Iv((IaQ zy6&c1xRO2FlX8l>`FKX*G~63kiq~b&!{-X; z;UoH6@P2&-{vxXaHxyLhwcBRlW!sZ-j_26$wDe;9YLN{u(b;h2=KPgsx6j1G8T0WQ z_m$#h+1KO0-dBj%HO<6z+sg6utU0(at_auZ=He$a=i-G;Gx4?8OvQ^bOYtt2e_ zPkJtb+4DbO_WYZP_m`~odYmt<_tviwJl7-Sd4$I5NcC@eex29Ru-CH$rTOmwv&WQ+ zO8zLW^S(BAck7d2@K1edz4s94{CW#p(m30K$vmh-$Wtn=^P&ySo<@}5H|wC}$i8*n z5`_G(y|~_so?qwvX2Y|ddO&^$nEmk;ObKh$l}x_x=YOK^9-=zB@z@1}$26PCVk8WN z?>+cQ#0O~~@XpnmEZ56s`0iI!9oi2x8NQFT_fFRIKfQDtt5DYKbT%UohvVMR!_>mc8= zm9YLS-FLmBNSOw;%w33gMs$Q}zUoi}_SC3+1a^f!g3pan_+&@nV~r`ZIYBLReJG-X zONzq9JR!e|N4Z|Lt0>gUFj4T8(8TtV^j1(~#ifVTu^9@5^_&*pKuD1`Y57$gRv8dvn5eQS*XGc+{c#IQ~nE_fdBM z1ZV@{)3JySli5V>)qj-KMg86T!u7rT>YKE_H`rmS$(@hige`hWhH;q@y_>{B_$6qyz^bh9VI7s7;=tHUs__`oWJt8>GqNr zn@l;jCR5HvO2Z8~*Kf&R`S`X{{OacXl|7sDS1xWc;7UpXzqhF{v8zw*8G z3QFS_X4vs!%e8oIQz?#1FTl_=69X#7-KZ45mu|xxnuFi7RNx@0z+1Onk9n};&(rNV z=b`C%OVdo8wYCJ;KUj?awx$&KCzj%>#2c}^)`lP7HVePFrUGYgn2Ix#D)6zUnV3y1 z!hdg=jf)d!6uobiabkHP zE^L~Kjd8c&XUb+%`u#!qESyp_8}H(-$H#A;j=#OUBXF(G;HgfTgPD;XfeKxw=iKN$ zt%Ns-i;MGoiwu5)a!;$VpslB0$9jGVM$hq_Qk*HR^L{gWck9^~)_YIIfyWI-&xZ(k z4uQd+FnV_@ys+N8CobMo58xLN@)$z*w4T*vc^r`GF9_Y!dJ&8slg{LEGknh-$mnsb z@p|q8MEQvJvAbJmKflgf5~rv8z)XbbzHthr`1hbG{&i#bv^MTr=RK~|(S6|r7(Gi+ zqQ3;0{Xfi0DIq)s;ZIJ0(f^<=wPZt4TFI`P0rP-7NL=S_Yv4V*0QuK2$t55W9s~TF z8(#3NUOlB`^8pYdJ_nh;p%x^BMpZwtUN+NreoWQZh3W9HX6vNpN%MvM8Lo^*(T1zU zjhLkmNssm+O7GRX=+b?JMg+Ar5*=Ua?5KKX6}!ff<`+WG_uACG=@QHMBnP5)0O51; zI@+c*-$|_k-lJ&u-buyAgib6 zns1JV_arsW(;qbWzZnhtE0Mm?`+lv#>Ks)h2>Z-kGKZ$93^8q!s$}<{n;)GZqR^N-GinKYV?V^V7PSW;1B<$73_J9Kk%?>2&(fUHQ z-_cW8kB*PO+82*&^*tQZ7mXV1AN@c2;+Nmq7w@#+nhU9YtkFjL2Cbp5A`U?r+t6EasNi_^ zdWbVCH>-EB7#a#I@*9dOj_Y8`zj9$CAaK$8M%j&bgcO$!z)}x!OLyE1vmc-~={jGp zqFC96!ixJrw~?bUM;TvSLx06ufO2C)am9ZW#hTxs+HdRt9o1K#)6RF#u;6=O=M&>P z-zBK+Vyu7ge~l;-)NtP5T#$Jq2yG*Zl(=SLfVY6~{D>l%?{WnATo7IwQ6$TQiv#=& z5Tp@Big#BB_%aZl8BwGRS7m^|83bWOk&+q~1^8P**gc|1aragQcozt}MieQzhV%0G zg7DOcBBc`e4IpeEQKU2i{}B*&jwq6Wz;6O!$A}^s3H+x(cyvUO^aTE15Vnjc5=-F! z421sqApdYgkrGH9uY%AxqDZ-8~4JfcYHq>i^hSUaLfR#L~iAZ!>>q)bxBhajvQ zQKT$V$3H;0cSMo0NgZcEaE~Zb4yofj2tOE6q?FOBK>vJB-n86=QJx7K4nEOy7TPX4 zmzwab1t$FSZ=dlpMFxEC!Iyhxptg%|hu*nZXE0#MHsUACcYF1rcP_3r8}Z8J20SH6 zkBfh|v!@E$F3wqMz{v{?_}g2I_?sI|*v;y3rNM|DW<8#}+=%0>CY-v|h&L`~@ruQH zIBmHef1Y8$7nkTU$FjJ{%;FmjdR)Nf;ofB|4xnlw%bbU^8(DlARSSI&p73p*XaGW zz0upbiuV*kvVRtv>Yu|@3-D^A7Z~s#hH7C?t(WGT!=(BzFxA4QRW+WJ`x?E6AjN-! zOYl@ewJ_V)=pAOJ_?wS;(dz)@M{Kq5#(gYyu2R#cu*lzxs)a)tMhq@B zZ4W~J|6QiX`|mN~PDdU-KbMo^ra4&2dKjtX+?vNN4fV z>rL3@G~nB&8*!yxkC)xZ;)NM`__}!}e6iAm3-v7iPq_ilyxxGzoJL$SU5~%I&WQg# zjm3j2^!VGjJY30C3u(8r_^^hvlR^GER4rV8V;&YYoEs7H7ouum&mDOf?#&x-Un{B> zh+K69RSSu(RuAdZLt2}TAmo3RsTLY*c@OE!6bAeywa`E~{8 zB{-d0!Fj>;Q%}hX&TFaRyoD~_L)%fqc^g+f;W<>pd0(&fcp6u5-aWO?cwS$@c~`jh zc=oK|yhWkf*4a+ZyX00AUd$Qrtv4I-q6$4e>w4N#HI>DVnmoK@1?M%^?)E$luw}_u zP3v*jQ=WR)lOBhw#Z&0oN$c8B`-JDKnyrB)$ZUJs2=*^)ssc|Zkmu6C*_xGsr&GXg zTCqKF7EHF?7O)#uED9J`EDP+;1p6OrwgimGVEbcDW#Fk?u(#Fz)U&&Qq~8`eUb7;w zdn(x1*E9u4`;LRb_T&t(udAsJJXuPfw+HHLT!ANV0Q;hv9f5k#+gi%NURAR=;HX(1 zXsG~uan0ia2e7uCH-o*X#u3=bk>`>?VU07evl{FNYPJOmfw48;3ikaq3j@u!gB{gu z4g9nQZ7vzBX(eM-f{+c>R0W#dh+!27>DK`EQuor|XTlpW8=WVS|)PVh`_kx|@OukpN@=ajBx(-O)L-U)UJ--RH z=W9BBlmfznCTL&Kgy?-{2%sx}Do|ZK6UX-?up#T%*3L;W+`{{J*d~<9{db1t{&e33 zMUe>a6|6_XH{_l2PK@xC60t)$8qEjXIhhYQ#74(z^N-sCTrE}_+51;sQ6#ee-*ZK+ zkH}vikh=Sj5SFyemMlW~&dOdSkbiXud8loFQ~t`M(E03^~{{5bo z%X3!lkDK(bV@#0_0I8Q*LjF}Y8-(cpzoKySot1U*lgb_<|Kh<}S!tg1@8`76Yn+vZ ziIe_G)K)uzj_)I3y+b_`9#X>k97a$yUz+f}uTPKt-}9iDjrNyO=Yi5<{7bAKC`89X z$pO_~Hd*!22H<=8>J0+nqlQ?3vb@zt+;zHUGCyMr3HS zSL;>V)1i7*R-v&au0+dw8NPeva6CaqAo9^&)K^!vb?m*YNWp^)m4!Z|?+$z2cFqov zwGsd=ac>9vcpKJFo~K)w=z03*@i-@{4gYt~)k_DBLNsq49m`|^q^rK%#qm+T-07+> zHxI%)QGPfDI_~xFH{hNt2U+2AJtN3fI)Ti^Ha)za3%oOU@K*ax&~_0Xxh6Gu&}a|l z-)4tQNCn8A6U>jd2U(+U&9EY!CHP$f!UMyK6nAcG0LnqQZ&;CZgWChJ0tAvrAKVgv z4ItDFE7Jaxi+%8BQ{ah{3w`gNtoH3X!Fly37x~U=_6UbgaNYvod(IjR?VqO^+rMDr z+m#)rc4ddTUD=V)uIxx`SMrnEd#%asXL3^7-_7Tp!5vfDl^v<=3I>^PV$;50b8R$! z$ivVz)UOi;TjGSb-gj5PxyD9k(abXBm$Ew)pgy!|^$+z87d6cebB3uWIi<#>q39a&TeOr`X(-gTH9X z!DpL3#nVonXoaRv@gXq3wuJm2-4p;oFFBe%#T%M(aPP_Et%YEE?d<5LfCCIK)i-^L zjep|2hLi8Lo`v|=V02TU9^j?p+PFDR9%%){cBfygd~5A+q=u4J*=%z&oSQ8-60NY(pIg^_fZ(PEDG=Y635RRvb8?9`tBZ@xaMky6zTKlZfjr1@IAerCGBVK=j68AL2#esJOw8?4|kID z@FzJBnWJFQ<9hObg7dl==!zS42iB&7J#Mri0HcotAc3{Hv%&5@u`uAyBhNbm?jrK6 z4HTZN^0=py_a6k@Hu78>a9evzg8{NHk-cu;7~Nx4KiX?2@3DV@tHef$iH$?{tLVKdO6T}ttj=+m`nKt5 z9M>UM=L@oN)E9&D$=4#4PfmdIg=bjdg%wB)-URZ6Wk?Lp2f6nqPF?_TL6^y0X=cEc zM)s#-gMf^DPyHBDE349oV!bebITC{-N?EXYk)863WREP?+k-DJB745NN4~7L2X`-O ze`qBV`70XSgL;9${fx9rR@1`##^079k<-%T;xIkR^5rf^B7a#aBWvyQK~_i`39r3O z-xA6{tA3Y+?xAF*p=%OB!v<5dwca%}UeWBJI005sx>PArZ8+!D6EjrnOf{ z`9Xq*#dqMarz?3fqPhDQR?ZfQk2rbH?ca&Un` zSVG>Hf*f3G5Ehg7uWeKN@j5H0+4&FIJtPu!a#2$C$q^2 zA4_0xedMY7YEqnID9N27xyP1%qB9p|6!2( zmveHxyE?!o>+rFJINYC*i`hhki^>1RAos82(Uw+a!NIC)cl87+{kV@Ua9l?oTjbHZdC)C+6V(L>;b5io-2Qx%glb!u=%wognwG z5BF6D&fJlOk0m7F{sc3Ie9prrns9MqHttW%!QGI7gOGp$nQ;L!;ULP!9Fv2ql6077 zbhsrc4!1FJ_+U~l4l=p8KMCPBgz(`+26rO{_cdkUqsA=E#3$gQcr)&cH(`e<8}Bsb z-~%Qd?lZ;V1M#`|NIb&KwhY{7%)&+S3Aiubj2$Ku-f7Cl2TVD*&!oc#;^Xk~_*`7H zEdw+0S=e~+iJrdr1bhzKE;>wRywhaD2Ta+xkHC)C;rHU>aNo8JToj*$9i{}l(`3d6 zOeWk%V8-X*cjI-~u{{I##b@DfAAGrIrzru?LTwihn9R73z>3ete~Hh*JGWImKHErWceT*5!i+m>6Y%M6 z8Ti<3+4%hxCVcV-30V5}8Lz+AjNb^obMf`Nv+!xQS~#^W3(GEt=j;MbcHGtI?E}V7 z?eMBN`8KE)$T~Q?oReLy+dL(8jb1f9-ru)at?RPO;c+xHde1KAWK#C*QcfO$YT@ik zPQK#$zGv&EMz5Nd<3D>RCtq@{@|=FW(R(da3#Zu(e;!jUq`L0&bh~zYUV&=ivzA70 z9+T%k`)Z?im+MK-@mCwYhd}S2&QuG9VDRrQ-|el}(q}Vz{~}Z^7((w{d}QYnJ&m<$ z`Vyq~KZ&Y^8q{|2buDcV()*92YT+NFwXNj)6w>>rv(-XL?IO={cca(N>ithrz5OE3 z@rFjP$msogwp!SF=OWMXM;g7EtlqzftrkwNTI4ytxzT$MtM|XcR12Sx|9qpjli)&d z)Npf>@=z@t(!K%o{wJYYXf_z}>{V*oF3|heLAAiM$#{u|XFW+n)q;0v3f`loH6p$L z6;v%eVKv}WTH5Ob|KIKGSp;ntpT9c=ABjuG`{N9_8yRqOoF3Q3S@CCEQgF|0M%;$< z_`P&J?yOD0Z*MW;-`tjrd1S?h(yjP9s229s8u8D!Bx7(r@qVZl9<5Er+qW3-k8acBU1@r}^q~}d&jurYcZwBnMb*NpyOZ&KTlDyzJF!Pt zY{k1=&7Rs?1EzZa+pKu&YmMIbnQCDx%JClpwJlWNU;k>Ow~#^pPKNcbV5^0LwR=2E+8e!zP%Z3fZ}i^IB>3NF zOnxuz?`J$qY6TBz!)zbPljvW;PVpDG)N__k>QeA7NcDgEkP-i7VKQcnDLB(@#5oTp z^U#G`iYg2IhG$Za^d?X#Yr(tg|N zIo00iCHbyrll%aTzi6zsmGon$uhIJqljyHS>HZbfDVU7ovI-+EX>ar{EltK`4DTp2 zU@|7BY6TA&i>d@Y-Uadg#@c5+vz?sRF~f>at%#g;)VtKPjt6Quufx^ixxI$-cCOm# zIpE}In{HdBo{@ylP7b+v57cnpT`u*^q-C_Wbyp4NeWW@CH&ht$!==f1-3&c8YG*Ky zIAF{AG6OcP*cwO))wF(F`;;ezG1*Kjssax@3wG0rr2*rLm4OGmVE=N(_P|-!a~>ly z*&3b)`?(d10^hD!7HD`0?B{B>1dh9Qd%i_R+qs&`K>ZC?+;D)T-xfGqvm(&&3fNE7 zGzHFr(MIUfdLP*TSW_KX|7-HRJ#f6n6~YjM1NFzjUR<+{o|T0AWcB-CFRED> zSbd5-?+6r*)wHhe0XtK(m7bZ9K6~V8us{5Bu#}@rR0`70fb6Eg#bvE}!u=Aspt?nW6ysdTD=!#bN6|k=ffqgFU&M!v8 z@n+Jl9&aWr3$>Jv%R)qUfhgbP*z@$hxghtkg+gzdvHkOefFgZO z$~r;VHK0g_;Fdt}J`kD*6v<4=J^;e@0Y%b(-4qBu2Ex_>MKayBJ%9?@dTvFC+C&Z1 z>xDSYj%f)p`kw;ikq;&btR0{m(W$>zTT5otOH|^v4Oe0`jzP z_^Brd$a4gcr)4UXu$oPFUkmDD#C2Zx2Hq2V4s{iX>%5g4nmvag*?$%o|8W5SQyZS5 zXChBjEGT&%c;~s@sOzi;b$!u_x_TwlRU|7?@K_v;wb-l0&3$2z$Y9yN)oJncE(1pp zgu?@2A9PhWb8sN6$IA9e^k262FWq-&K#>LxCJ15u{;t7@jcN0sdKR-|Fyhnx;=n|^ z+I<76Zs)PVi0}B`fe4I81|xQ)4-L{7hU0dm^P+5RTcXO;N0o8MlnL9~4izU0j}3%% zdTG8@gAv`)%E5{DtrfH$)h>9$fC_s_R2_>4zuV^a2T^!^FRILqgIBk?T`{1H$9kO| zh12!1IO!ueRcmFYMZqtMfgjZR)~@yU<>ELYYfzC!>(#rRGX}$F6sk|_tbwpDI@4D= z-iA!y*0gxRJQ$t>X})O#(Yn?&U*1@%9H5sWJgR40>*DFFeBvraM%9QSfg{$Lb|W93g83pp)v0 z=5ulu`OoI~Hr;{5KZX=*?|fDFqg#$d8t-Z@CzJoA9gi*v$Gfun!fB5z(c)d*q~;^? zLgNxO-qmn@vC!Ab2;uy{UJ{OXW%a#6#4 z%6MGp>n=xPP<$~M9WOlH7dI3+oBP+Gsuw5YUv)Y9tS#L)a!HYfi!I~p{G+J66)}0w zle`Br#`FFuD(`hMc|WIcv&Qqj9hJ8zChy-V+??^e{~MLp8k6^fOObXB7v~ADj>n3! z`VwODz8jVI=iz(@3k2q}N*g~MR-|A*EA)_Oi%y{5`Fsx^QY)xb|nHA8MiOU*vwVOkj#y{FRSq@2dpn=uca|j(|!9$ zJ8$CTw1(k|9Sm%Ih6UHA?I0v~=I

xeB}Hm&RLk5E599II zN!c}nio_&`_4w(&)vJqe)p$Q-`-b)Kmqmk$^bx^fEE2nYRhUj6Gtslow2O*#rphRs zsRB93>S)XnPK!&tDXBXfEWC4oO}T1fo0=xJm0=mrrx(<=GVH{*etbb|t0U4@#3C9)_tXXL+^XJ8@0)w`D(!kp z!~cI`+Vxv4{k02<K*wM` zE1Xg9ulI#xU?3geGeCKb4BtCvDV(&0&W5D(H zl`*ORUsW{bYOub_PWO5Xq}D_B9I897XQ|CY|G!xKzTt@PO5$ZLzO|9>*)WX60>Y0+ z#cGJ$gETSb$Mu)#y^3`0hV|djHbr=3SX-lJP7WGg&W_xN-#+1ftZ3eSpjeCF|3)}o zdYXF1elRZTj6H4qjD1JU8T;Td5H7Kd;MT+Iy)Q4c2a6Zl3o{{=w7U?p=LC!6?9`6n zP(tQIJrZuX5Vk!?_xw4H**H|Ij+Jo)$MwL8~zd{6E$ zJ^xU7`8OupAl!9jEXoGquWIb46i$XRPQF^d2DSU6XuQA_5DO4=^s(SWb5$RrpZs1O zBQ<8z(Qqs&=O|g9DV+S41uR$d!69%jrGfm}$4I=yg3tXV*Z$uY5IF`q-z`8Qx`THf zHN%J9X86$2eX{^J+$4NM(hKOFQ$5Y7?MH3EJNZI&E=KIY)H^c==-omVUw0CSJg9M+ zU$lUDY5cyXG+%o%h@27?^AdPxSrUkCA*C#Q2N7xKEx$)1gp{)IT%`Slpd%b7@nI{F zId&mBP9n)09ZQjvS!)H6{O`{peWIpcRun0J)Ufea2weH2aoUqrpH1N>L!XsIPD?m4 zUI!HL&M|^dChr`fc=1k|Jd=3mFnOAI=OrcLAECxMMTAc5EsT*-HG6OS00nnQ#kqKkkT>4vc6$TE7N^8D~MOfx(X>BU#BrN4r$w%(n03y ztM7-XUsN}v!nbPix<=E~J3n42WW?YsP7avi!%cH;5*$lae)~-$BNCaHysuu$J3EZ( zT@Vhx8ZV~%{Sb`>bMF0+^hFC2K4&eyGpyCuA9d#nY1<76pz&$xKE?{-u(rl3t?IpT zZas96?_*XF`|FX=$Aaz5xGg}o?`SEA{Vezjt|%RSvpBiZ42P-x)(sZnq=gaPvQl=M zw2LKhvVH4w==|9D`ent%=E9UZGwdZiO`&+RP~XI+(R*W>xK<^N5&2;iuMR7SN6hdc zbHnX{!d*AfxT^1x|3gYyK??6Y&8W0lwlHEZn_(ksa#)iSfn9L=5(~E16vawp%g;3W z86CGz?&3m(Z-qb#?}bWX<%}tM^B4$^;ri9>$c8O=j4;Y1xfJ9Ds$c=TkQcq^yO;YR|CIHJHLX zUll`A+lYGRjk7@{YownA8yT;{uWzJ0o$_BHiL9fCt|+cD7CNnQ(Amdk*uwgaZSz3n zWu*s~LLM{L2 zaQQ*SMdS&!yn3(X-1|b3TUN?nQWPs$t6@Gcau1}sW(!j|xe9paDn+r9cNTc(O6|QE zcxO%2`XlQ)Y^(8ZI;b(BQ#tuaI*28hG9OZCyy|&5 zK=<}xZO{Gw|3RBJT!l8(bp7AF2{KLOO~_hzFwpsnJS2{3ApMLkJJ@=R73R zb(_pP$$D_-NAVw&r&9Tk@IC&7CK29#o!0LKV@gMSHi&Lk?T4`}5P^lVFL`y3kFH}K8?19BS!U8K$bAZ=t+zTi_XBoWx%SCkG^ z0F=)(8tFK7kug3=^}1=kuep%4Hn#1CNZrroO{53iQTNOij?b|Ott9;2Krxzdmo~jK zC5i8OX?RT2Ga?}v071zI`M(rJ>Smz4IvR(MK&VTP;P8;v{v%V={)hZ=S!D0k?xO`G zxbW~8<&XX8AR>S{Ocy`P zL*hFQ*tma0aRrMx`9&@y{hf@#T;92fXT;B2t7y#iFW59&KecOD?+e{|Z%Armpxls$ z#E;DIA*oX&JWuz{>b)Qzfq*i3=d3&=?ne{rJd%gRU_Oy8Exx+#Tx)SA?|e(oh-AMf zbKv(A;$okCHP#$fDBlwp30Yv8Z%nS2lOW4d5bctQ(+{(1KXL zJIqUy{f5s2u??UsU#H&tO2%nW!|kFHd#4NdJ|_Jewa=Dm@#lKOb0{1uI!*NrR;~p( zMVm8kToW~3xkzZ6bCa+?o_F?MGkL5w<;BdIn7Gn>9JrF`oUzdRwm&q0czH2L*UEzk zTx9>suY!$rL?*nJlk>Qcw0{oa(X2iufp;e98S$K=SVS;yA^`3kC$PUkr^&eb=h@Y!JF1ctfN46Xt$|&xHg|b^~;fHXlfg$YIw; z)m$@?=J#Kt&Yy8PjO-;APOb##xHUBbGc_9KAQJYMM_}Hh!Q8LGJQV}8 zD20;`P#JULK1=qJ<5Sdi8U*Nsm_4)*xUM~KAWLK)wD_KVgX+2|ul7j_hy!%({b7>N zR#+y##4@(G(&&AHWKLcneHcC?=^y6@j=eg6OtBIkWG9iE#}sSZ6xa(eh3com?+}EE z-`!~9cN;^$`6+Ooe)H_aZ?|sZHy1bYyFfqTd**{7Yx5L1UkFnK!vi7fc)o5VOpW?i z*o_2bL&zE)t8?_eha<1%JQ%XZ>Ogvxh!04ZmpD(${$Y~eiPnF+i0D>w6nQ)|M%7z8-Vp-Z{LJ zl)VnXLhs20zUQq1(hnem4m!{0OoU&Tqr%VD;1j-r>{tJ~Prs4u!IcPH{W(ZHkY^MM zb9pBzL-HqS`Rh`7=bMUR{kxW@a#|!$TsTh(@BD9iCX(TM{F9LMf{Bwa19bj53YYzJ zRXqL*U;&ns3lyaT44fPcDILpBholh}d>jLv-8o1kd+vA}y4AYS4BnXqe9yTYBxaL- zikUlGa*>z;yfYiXa^vZcbVbuasp~R_%3C@uX8jIrp0w$q{1@L*-x008lR1-liu-br zxS7!jLG2utnZ-L3bc{&ei)MxI_f+rBp7%+Jo>i575|W zlCkm5)1j&W8KVzbhUyc72s+n%NBb*nyz`ly$!jz}7m2UXIc`<&GPd!~w^)Yi8AyLe zWb_>0k-vqcZghFx(&#za4MML?oePg@?W_ZJz7zO{TqHhAV>}Z$s*lfq|1Bg1$CUYG z-h|=5KP@D=5tNt3z&VA^o{gQLKCtCzEycvxhi)lK7bVD{qO^-<}=O2avjN&OubJy)vdq z|56kysiS#Ragn;YQKjQgV~P}16zkj_j0j^&#|{R%eyj&Mn%4-QU$`0QLYluXglPPE zxjUqEp1X?d20B&#ALj#Rg4{;=Y)-BN=pg?|o9>8i3y*|eN2D!}X>F-X;+^Th_YfMC zt=`AdL)sRXgTyQ?p1wuHi#&ft<{JXbQ4=Q@A?TW z=4#$a`ik(*RId0WBwZ$BkD#+KCU4=w2);|Qkx1xNcpo6^zT2eQmyq@%;JV23>%Xdd zPXPm+i81hwM8TVvJ(>1}`{8&t5|0r0dQJx57oeC!tBVN z{WX~ncj-4ao54lkSah81VxaR}7827ndQa*ia7aHBSjZWHl@v8T1h@U!>OB8BU7M<` z+?E%TWQ{-SiNR}s6s(b~$l88SQLKX>ha_O2?7f&Wl`A71nm(0*&ibf1 zLFy#@3!Sfb^3FY3lW88Q@0x5R<|vBwuO?0onm8Hh=vwI7!6158?q(Rz0)VfMYG>s? z1#lGrDS7;d1se4FPEpQXCB>5)4Rxjej3nwe)D7J z&i5l@cxzTMD?^q<$LdRNk)$ua#&`!Wi~{H)3Py+38CHfv-LE+z9CLD^Vl z%=)-D0%N*{M`dzkeY}~4M6060_{~Ql2|`MFryiz+zw;rz@jn2rvoUaw+{-(^B=a$Y zlL`KW=OVOt_s1crpUu`{wyF0S?<4e=f%4NaFq-eV{Bum6-XBo> z4-@={G9xsB^uY&;VqI{Iu3^fTzO9x$JWfyCk+KB;Xj)A9|12ba5>n^DT^X9r1VQJo zV&K%(Mc{m#IhnU#pM}J=T6{P{vz)Ze^D)#VdBWs71_fQ1hy)k1<_HEMNUlDjl*jR8yaTUjw|6!#3?U@mp`>qm+2OGJI zjOs_m?~tXskbG4a(#>#k?=cX9IY4M!&%+}Mky$!Pe?2pzNa1pQ`4eTiHU?Z9E{swA z$%~5GPB*AL;srwI8Lo@)dX%LsLwB7I`e`UGin;H6CUTseGx8J+{Z^j}cV!|mJQn$o z_LUpdbNa{3>fN`~M-+*S{X+njW)mm7lQ{W^4myU@K;%uFoTn&~I|*bmr? z_b;sz=X9^4SP4AB(=O2F1)2d}lAe>vTydvD*IyBIZis=|yCnkCYmMlr|Ewt1f{@br zFWTo;U-6A9k4)aPZwyIH6W1E{OV3FG(S2DdBW-yv6{u}Tv)1lr;GL_JL3F2ba$g#V zB+q*COa)5c7RKOHxRrPQQIj(Z80d(*F(i?_oP3Yk!}Uh!?=#6D7BEmgH+GzwcxR`g zSV?_^e@4IJ*fzv6e(D&t{e9}!asoE zo(J;yTD^9%o!$2HV^Z|`QqN}I)7IGUCg^>`aK>Xf=YagN84lCAIxB2fqH7-j=x}R% z5W%$|&N!d+V^9a3!x>1lsQiW6<`hdD;g2doVRnBIf;+=OX>e}0KB|@imFtBkG^L+NCJK7S#^}X|B(gRmioo_dS z&QlqYF(J4S9GjbY=jDva>*i@I5=6yoN*}jg?PbWk4J3isr|}27V&L^Y!8_mA z)o{Gw;s0rhBboxKcqb~K@P{KiNB&q)OHu3d}9o(%H1kYHWzqjORSAa zPGtXg6COK(lbb@y__@P<(Xd>sfPNaG6}vMg&#^4)#51i}TZ{dm(%MTb@)ZD~OVGJ6 zx{eoEq3-EO9Y4&__}c>B8Lk7YDz7ndFH_H=hginqDWuS zvn!VI6@vPY%*h**Kx{)$9*n66?TyqEAG6lJPgRNS{2`Ph?EAwNdA*%C|6OT-Tts=f{z@?y79pX?E==3e|CcS+jMjQ^&ye z4cQ|ZPOf91^RyWbpQdthhOelVcP508$TJ|%2i{4>`{fv1D_aR~li~YQdStE;S>Fo0 zv+c>s_A_jnuZ7`cg3EzZ6Y*~%GPN<0<%!$ot^2E<&VV~ zNWAm1QpPiy?W@Q;FO4DbWd`K86vg_6tdx^~0BIhA^Pe>PtewwOo@qSJ^G9YlEYdbw zd{aY64D-qj(QUg|N9|6IJkLA5>67W#)C^U>7|qiG6Ln5KZj;5y|NKixa_c$y)4znM z{SEViYKwKm42MbCLeL4v#*pP|wBdm6@*9Ji4HcP}Zf*Xz0(AaK<9~S;I@}CB&+k0? zK}d3w{aLSmzfHdNAd~-X0G)#fs7=|&iXtTeSnBkgT&E}<{cJjoEmrv-dPd%1LF&5h z2IwSfQK#MkEf<88j_;x~;XCoey3lBzb1;18$pY1OrI+G?1h<|M-3*iwm`6-p`z2P@ z>EHY{5({*yUFAFHReie7$cRP&3t5}{8R*=1Uezn`TAMo0ha><#wKq+T!PLJX<_=vQ zxbFF8Op4g|A)!>yh}@`BexCAkNYKtCy*fQ3{+-C|{Xp@#KaLSqyUcXoECVBQBT8Ag zj{rfZoAQ$&@6dF}UV`&YTo<8(z4>HLB048WCirlu_YKtnbg=ZEI-vSlBExaoJ>q2k z(5Fs)E&#YtoylF{7;sHKcW3B)3)?X*(B|Fu{t}WNbwYc=Rr~`$v(N8M)9%^TU{V`+ zt2$O3Qtd0kdHSs}el7@Hx^Kp$hs_{%hm?-5l7ZUdQJr}UY7f?futia*ttYg-oc#@5 zmumeStF9S(PpmOXh+aD%unhIRB>hSMPt^HXcD)zLDF=BXE)b3sSg^M*v(LS>IteDc}K%*7v~oTv1_A zSh43MNCzD>wyqh@Q~URXe4&kH2%Re`t_13|Mv_iiZxBUmj=Ne=c5U#Jk`sl*_I@zwxvWaF3?5w z^I*b+etwi?#I|U>MiYcbScaa%jQ9PFM4>UJ?oyh9z5KQWM*O=OKFnmn zSBcfM>I8=H6F!pmW*l^WLjD`B6T&j{&Dwu1N%cMXBuVu#aVJ10ui-@SakxO}&8B?P zUeY)1X%U_89!0U{->cskFvH%DNE;BiHl`tQ^-z*2O;l|su6ovqD%p4#(g zjQ2UK_4!*da0?50=lU?*?bnXOT_5gq4Q^u+h?liKdLT({TRyAG1Y|Gor?G(}^&QgM z(H2u5D(0O_6~#LLGo`#BS{}KIZ2`5{Z)B@j?ex~`EZ*X zC?D_qla^vh0J9MEFF~b|U{jd@3aMQXNpH50WXql+KX; z`^*Sp!KhOH<+#79)t3{m`s554Ue5lt#{azW|L_xv)gu7aZ>up|e{WRVLdNiSMpge5 z_NTu!UG1~5E$OIMH>FjEm$ONqYI+1)v@Aq$BD@OHadI<)&S<%?Ow*%JH&cItuVQ_& zBR;beapoE5d}m738hjIkx}_01c5cdK-P7Z#sy6@RG+%+Nbe#9A_Eg=Mm5#a$PJZQ7NFwu> z*YxJhVNNc(qI5*p-6kvLzteQ1{2b_V&*QrIdC+wtT8~9}?g;&%u?ehdYyxEDx|B4K z7ihdO;fLLfO8>q~_6j0!9r|)iqUWM%Ah(fqmBz`wQAOfH%6zxx2Sw!D-WCvcr7$8t zrj!j6In*4H1ONZTZ`)Py`^R_Sckg%N_tqpE@i1K+_u&M#AIg&v}P|jj%Z{6{R$1)0j|3>d%o%={=DR<^r{`*cMOs zX^Q916h-PrP<|{0i3iMZp04-HAoN!9&NefgC+q#|l!&}R*7}YqNPM64qgMZ&Mi9sQ z;oT%*tp=YVzc`N4l(fzfI`++uq z+Wi!$V5DliTjP0Z_XoK_%4?CQXj^(2{tf_Qz}o%M)r9A+#WQjPDdwcfB>n%O;NXJ!VYe zaRq0}#u*Nlzqcii&Z(|S0Ow$}9Nu0Fjm;v^96VD7k!gY&JqrxnYrisx)*(UYEL+>n zi>$VN6RjM>ZbDq!OQEqwVl=;5E>hdt>`$e@_B45z&^56>7ijJh>c?}kA<#NRsExEH zkN>|gea;!+S?%DcmSN+obFt$6G-aN>krd+@sW!3?g5~=UiV)f z*AxjnXp@+E^J@sv(&ci^i1FN#Gi5^%A@u2lBwkMlYRzqy45f*wd72MTWI0_gOKiNp zO%AmF=fP2JY=2X20>22MS0)I78cFdY57=()Ba>9PaFW_P!MZy@d&HbScTW`3+AOB+ z9hF2~6sgazi-hB}uY=sr+A={1xE*8LdTWB^|3_Q2h{wHDiriL{pmOco@=683H;w)8 z*s=m#b49xImALkKy8Dp^sa@fBW4PzyT4|aFLnN_)+206FY}vI3ZpJ!eo7^kxx4yLx*;!yq2>|2y-U{Nnkk zw2?QH_L&nbKhSGV-tjcJ?_Ce6Tg+f<|!|PJrF5YaSy9FuJt^$xjvNJPYDpZo5s#m@5OU!w2tk?-I7bcdmI~!Z6hRvvUEE@t!{;5 zZKK4uhsToU<2;xHhActoZ~5#zVD_nY1*kQ@XZ^ytihaYi`%ym2C7KLM*OW9lMT;j0 zff62rPBAt>>B`H6fI|Rhq)Yy8lKpmpoCvPa(=~;*EQv34~FtEKJzsr1fts^9e z&*1OH608&XS^T1RS!{a8FbQ6r#bn)`BKS4oT9fv_1?$`&iknp&U0uQNP1{UD9JI{#?# zaSNB1oe$(;Fkc94z_}sH;j-&88*#4nP##Q-)G7KBzMn^iNvOis-{wCwQ{Ntr`Nv%5 zD9^p3CC_8*>`(P)K^k70*IT@P|69iPoqQp1dlLN)lYSi-|9*$*=<-n#MEO}crpzyR zV?G2xgsOq@W7`%~tL-WIWAB-_N^atDI!4Vi}9&4 zX-lG+nLjpv;gNhHFdJ?2e6-Dr^doQ6_#|`RdX~i&^~bAby`C8>KJf_bK{Z?7K8spZzw^|9hL| z0-g6ZyXT!n{}$^r-;Qf<$8q0+N`coVTpuScv>m3G$U}IxL|rFkC|&OLYc^IC!k${x zr4xm9bs&d9233NxmunSJ>y(>gl2R5c1EJ4Nhz~N9F4Vz?775OwMS?TAcHRkg{$1}* z#G-+oyidHE3;ooNTw-E`jcX?)r=5`8_II+W|C!c*N$bBoW!Bm(e2#QyHwwdCdEz9pLZLTX& zn?zW;>`A4x0~D|SKA1xF>>My!1{s!|G9H4l22q{DbA)bwIj+H~`LT{X2(HQkwP^|* zt0BY}UH7B*UdgHVTq{$a;%Kkuf``_p%7y^if91Il?4GcYK1cg79s)`Zc%lu=UdI33 zfPEPUo|X5>8-}GKo$e>Aei`eQ3M)~st$l~#{k)eAzP*{Cu98aEeN_s_qH*GzT?l*j zb{A7#Kh2blXph?zsev{I5r~o=apSGDNDn=g3B6l^m|` zC|`$sWqm!Wl@F1sk8u6XmyMbUa`>w^<68MBsd|SHR|zNu|4d+%l~j)PrN1}E7ji<9 z^yE0-Q&Ye=C5ifuGr0bioca|n$0^1P_WSlMiakVeiRhRoYRVPqw`W@zfs@CDy2Gn_z84gmE>gPf|QYagDyv^b^@N;J_tY7U= zyzY)EsyHYFI?Nnim+gEH;OpBrN@Ijias8F*ANqUB`eiaP>u-S`lO&4kfNOa6n{0i7 zpm;ych4ufta|*)|&s4n2@;geG-6wBo65-gg;+BmRFXse}feQKa1e#Y+pULiKYiCSV z*X5xRgEl$D`LhnnmHJ#o3#vZ;`fI#zzJC_ z-av?eno`dbl!7WbBLEJ#5_N%`0ae@QNgwg}q@a+;@|w(eWPhe?TyL=W=nj_eWC+33 zXBLU9wkwY3k#B^6zfv|n%!T!VU(QtTc8m1gTe4ZKwHN;u%f^Z~O95U zaDw6GnR9(-9`@VkU=it*;uBO}ar z;Liu6+>BcyEcQKJOclySbjn5rVKLg&#~mkC$4TnG_yvzkG51E3uc!dN7jlI_^Z2BA z0ysy7Qf0oD2JhQ=!g8+(Qv09Xkn?dNqJ=dMbFka~R{D*PDvFnQg_2)Ka zf}zZm4gX9qXx_C0Ldtn^c(o{~{_`MQFAAzMTMqkYLs%(barw#*<*=XM0~|dn(3mTf zN3%$4;`K!Ud`hNlC|MA~zkX~(lnuYg{)!W2L(GCuO02pqW)J!QG7AF8Q}cN;t%Zzy zmSy6c1Ecj62{z};#^P)U$ft-$DPTF{O0i7u5O6Mm1oUrnv1~l{W?X}lsrLjsVkBt# z$#DGS7^!-W#dI5gt}7DOBip$I5 zXcraJoXD=J;~7>J>d(cYxMtoxC(kv0=a%AQbMkvZGnO26o|wn-vW1DV;T9qEMov=y z6;NwtTmAngXKXxhb8c#Uc@4^86T5fZW}_8NqV+kand(*`#M}X-w z$de7`mlO2*0$h&}dNjG6U7$vPV70R&XYBm&<$ik%^N(`q8OXENMzigQ7R@cD9LBSJ zZd#i-#Lf}VgxJ{-KR+2_=gqmsW;^?|J)G)e7JsJ!(|` z`gv21<=1=67H2<@w3ppSh!z2;Dg?!we7~O9pYmm6UM7z#;P=MG*{tuM?2c>YB6tdt z`H%&*rq1GHevaj@qxE-0#rs|kv)`9wLZAox{a{V|KB?3~?ad%yld>wTxm+eF3tZ=NgisV)AqBWX?e0fNhm8J56D$#kC< z)aHvVy76&i*Tec8Ydx5{>9k#Oj$!50U)mMd6d^WyyN#~<5{vGEaePcCu=qnd&$49$ z_onA|#kKM{nT>Pl>oj>4<$~1@?9(7$+qj?C7qd0qIxc~c%i7Nq)wUm5?Z26(U)SfP zziZf>!RAbd2*E|g4Brp=-N*4w1`&29&c$ULwZXiSh!tU6xkH6#b)&p5B zr30M*V}!U8v9z<;U*T*XXP(FZ?=)=z+rF5`_Qi4@H-me6rwGBj94vMQ&v>8jqU*iN z%q;iP=slsk!O zW7lLgz_A#wadBaZJk%+I@9){%PlxmGu&CB}`CZ8JnQCwL*!lNMzJ}AsO0l!4f2M2* zd>*#ON${F&aSg|GJ0I%~2he+;cea^vuxw5;{}#*3V!nl9ey>xc$Fdo|ul1XY*Iz2q zS7g&%RgYQQ`QDw(=d#w;x6Z4rzHQ02_G#>wJkDD4$~I;P#9v@@;UfnGb|v9*E#Ap| zE+#g?{e);NF1t|QIBKmMw25Gr9H#4J7SO-o;om(F#&MAWg8!DlX|5ss{=V&dPYyWE zJPWvhy`SpCVgAJuTw^zg?YKsFzhKJKsSgmMoyrD^^>k8#%7*|#`*(2vdNz(liTc>cE=8G0|5lr?TB+MMOMG+XPe^Yp59dj;QaG$=8q}Qgdo1tL+cE&xIhsU z@3Mc#wN@Ut-m^1~dZubafoyD}YpO(_=iqn$4hZg}<7(bBmLzof|KvbGmcXOTmW>V9 zi0wrb8wgb7L75GPhv`K94hO?#Sig&5HT>ZP<_rGIt^`&?rIkm_>_zi#@*3kRO( zW99|fvAomn2{(xCs3Xk0NwgVGN|KJU-X^g#Ej=TQ60R4Db@R@nuMh$qBgA8u7497X za@Y^q)L!|L^xj2LTFZUTe3rS-)pt?zg#9J{xHg=FN@oxN#|vTx53WUHH4&`t52f7 zOcT3mt{Jo~Ok7w$Kq%D7{2FNgEfOJ=oy?!&P=)&}{?5%B>u24WmA>Xpl;eu;*%jAt zEgsKIrQ4iDcS=?&Ud|y~-ZIX=13WfGOo}lweeMD%UCieW)CR*b59UID;FmMiL5^R$ zNKw4s|3*mMAOAC%pMI8S+N>zvSZ131f7ZvYbm!zKzw<;rc>y6>2S6xM!>3vC&iqCQ zpw0Jz2nO1VIA0^&SJ%q1qsrjE;}KU&sk!D+ZaJ|}Bz4t?@I zQ*t)*E6t(z8O2oYPv$D#%o9Sue;&hdyq1qG#V7yVqegQT@9In|HVWH1gXXX*UVk^J z!br>S9-krx{FMxE;S&CS>v|=Jf_7W_$f)00MpiJPfnYslQI>JqyJa zoXu$n6BIAfKpXp9bIu{n@roDe-}?IHt?SE)hZ}GORw=-U(`rldt<(9`&?L z%a2I&|1y~_=`?eP&rFTS^Jju@;a8(tWR?6vH9+703E=zOM!z$Oeg>!Sb~61z@pXDY zRiJt=?s<{>>)MwK5bSvh)NZLzSH$YQ_`kYhK1XMH)OANG?nwAEl#7e`-+u()!+zuU zCJ`u}T)il+D+3_~PfnnCastJZGtZIa%TeuXe!pm8u)N+bx)g6)F7(s-6|+2vJq{)) zT{j+OdJAoc008x4ixZTt!(WbS{v0_B0O$F07$!+dj%v0XZUdP8WC^2GDj9*fb~Mp2g?v@T7kGK1-XWSUoJSia$AzArxfV3msc zwKjv*@dcOC_2CgVKV$(yB^g4XIfLOrm~`qgEZv8;Y>5vHm&4MZwV8_d#p6Q2e?5y& z%gSK7x;c}tg9~P>=Vgr5)w?o;fImkz0uNTHPj|BO>67^PdgkA&9jADIc0>r6`{AN- ziuaBqLf{obT&W!E zEKuA}v=?r5B;r2z;QXugflBe@>lE)F9b@OBJ0msL)3igki_q6jb#dXk?V_chR|ELk z#6qgGhv__Gb;h+XMzsy6gK>oU>$>`AO+zl5sqAkC$i_2Hnd-NGDT9v{JM+wS(EW(< z{1~Xwi|Br|2Og+W>m6gyJOhr@dm~D_Bt30+GVKFE{mv%s1!-u1Zlm2ri0c54d2~-@ zer0Q}u{N@k+wcf#=R&KEbJMi3)7A#++}i2vF0CKuLlW&{QWEX8f*QTdqFtJX_GZVo zV>ShIVGqtToGYIt(>)=m!u3p#W;n*)(`gPC=g7`)#k##t7M=eym`>hpqub2sej{0W z8Fe!1Kk)`u6B#mB9pi0d?%xGuc{jr~`3h~~9NC!O!SsIx{w-ztf5$|{d$bSt752S* zqT)T&XYB_#2I3@kzUb{^{Iq^cpDJd_My&urne(&eX4a=Cd7o+@s8WSYrK{|);Kcq% z|21GJ6>`{L0bymM9QJPnY8&7_gtmd40X`X^3hjgD1+szj zpg9AA5eEe6=LNFy@b0+QF+zgPG}eXv-r-=mw)nqwglHYZELRrK_7O++Y~>6&jB9Uo zsciVqfUq)Crgn}}DTn=)5XSYg!vP^&mlfqKKD@k72sD)fu0f~bm5t4>LBQ_?oQE#_ z{{3v`H~sUjxaMB~1`Lx>2O+M|uDI5;0E|y~eBL&Wm5;x_Oo(d+AzD)=`yJOUK<$h^zUUx^^62JTr+0s*&=Om7`IWHC4{h%U1kot{Lx368$o-@iZAn7@(P``o@jm29!_1EG=GqL=W z&r#`eqS{0V{UEu|kBDmYd)EBCRUCWo6BDWL&}*-MYn}-xkL5D0?{S8WcIQls_7$Rq zhl2ahDSjVyLXz~)U!!--RsIUusC_-Ib&Qg#hXn`~*yy=uS@hvR?CvtDNy0u0N(SpUas6l0|l+t~G5ToW8HsZ0`<9v&gS69V&%OnaT>Ae|6W+pRx0 zY5ntdo1LtN53V7|U~4HVx%8LgL{m-@k3Wai={RFMi|Y#TyRSCvtApKj;`}%re;*`4 ze0~V|&jXMD8re8!Gryl)AR9+^vh{)I{&#oswIe{VK8M9nkM5*rjVgS$n?H+fUA8%{ z{fV!sFGqR(i6IhtfUl#~uhBNBOq#e%WKg{BypB?L9!zQxg{2Pw_>k9z*W%j8_}(?L zkncbP~-ORBnc)ZLO{{OQ!v%Tl4*W%jG2yxYmvf*~f;p!VRY3<@4W1lNz z<7U?Wl{i*Yx3e6FdaS<5e8{5fXYI^#?G_7?dY|{sWh3bs7vW zc8@OTzvbB39o*M3J8rJgLVf2bi_;u~`kJRz!`w^(!V zUSaH>nlIYw-+^qjfY_%9;FE2%YHqb?-7Z*r($PdLmz1!9_e(%)Aev{avgVuMyWZM5revuOVyiQhw< z-yUh4-YsS8Q7KE0NSS)$JFJG_xA8s#N%Th~Rk*{V|D80vzw}@5{wL1+J{#@kB-;7^ z1@BLB-uET(KJI^H)uFcCO=)jM+NWSF-~VUhd%q;;UrVBXfbyL|+gm(L zv~mGF?0c5(AEq%Q{Cl>3Bk$MWSle68wrhTAwfzZL{pwEiD_ifDvbcOQ^nPhvVovoY z^)1^c8#6=*Y030IbeQ*UlzvB=zIknZ+b0S7eo557rhRkJHouqXi-Y#{ySy*=+S(FU zSZzI%)R+B$(`&SnIKcwkP*|+q??8opB zIV&yCnK#PD86t${B-6e$L+xB?(e|g|`8bT_+2r?MoZku? z&6-sf&4o$)9_IX7yk?GxB{eZoX`F*B8zu(sxa2lAWvK2(tBv#0@VyIIPB-vamgIXe z^Dg=%okJ{l_%Ys>ZwREc)0WguNm5_FrnZeEQGfDjLf`j%WqaTK3+w%Cuwqi_9xKX5 zujJB^w;rij&yaENWB0Zu-F_(}QFj1k72>hMDf7|K=3_^4+cPrN`d?dZA0#kFMyt|{ zZSs7)mdix9(Tyh2{eZxKIUipeGsamLu(Q|_5khKm8~0|a?mMkEUP;6IWsv?%g=4!< z67~H_WBVQ6j}^8y+LGF6OX>%nEe9os-Xmq|-BLzkj3ZFJ*FQo$Rvt~E{y2}Ldq4o6 z-$uXrrxyMH-@t1YRm>yu>j|F0`w8RK_N;PofvNd94nFuPqU)_*@lwCy4+l?Cusr8$FG z`E74-pEbkQ?*OPW&$1mt_Us}a!-zB+hlo~Am>u}Dq_&pwwmL_M51%b`K+a~vpjM9oU8K~ES|^H-Ogf` z{OxhA2$X_17!Gz^`j}a-ef&0P0=$-Sj-^J_Xen{;xSNrIGxMe;~MINj>Nk~ zI?K_X%HJ)f@5*tSD^Byaw}jcbD=L-JnqBSTxF#oJ-AeRl!qkUA&zyY*VKs%MV*P-@ z>h1P$Uo?$JCq(lPvu95xJv(5q9H#9YM?6CFhl}(F!|bfqVX$`uUh{zFlo})vlka^c zu64xNdG3l=D6UqOiP`__FuOk(%xWopjp2wC{5_pcyp8F^Rq>>GJu8dWc`)bo)A6xu zXf}cWs1pnLdb!0$x4zk;`(XUP)rqM*kGoSgev|>B%aduZ%~GSQllK2KJdd;S+_B=8 z81nmdjPd$?8@=W=7QKcfUXKvsdd30jcF69FjuKz`b1O=u_85(asVYe3@AE9R^S2g%^ON{X#Q(=3@SoySJH#SA;((C3kK*su~g%VFprP30qcKZ`9}>j1R{iu#)4#P_TSp`UGvYx`-=D66~MZF|rC ze-{6_aR}5Wjn}`p-C#%=H1_cj%j@kzTVS6wSx0-o#9Bw*v+iR4q<;VeasL^hdaOjh zVpCk(PKax91_Xv}cf#ppkM>UQ1gU)y>#HYHCL8;u4CJ5snr_7Zqy3-U7iYHG_CS*T zKME;+O&pIq;y^LiBU5NR8@=Z>W6UocVYQ1=^Fo*nhPLQbF2|ER|7N|dZTEv#+u_kv zIYxLaC-!6CPEdP$K*fEz4B!~uo2SSI>K>G9Pgcvu^l~iLN1uyppAh0I;Bpi}HtOz@ zjXHqPKo&S_m#5wrnb?a0$VSCovQY~VI&B;{-78Y>tgJXmK^^`|aN^(j5rJZ+$pFFA z!tq2boC9QI?VB=9)p&ifh{Vh&{ z=AL!%Ikvwo+GOofPQJg)-NbMiUVJW2<3URJ`mO<`>ylR}Hm9dKhuNw$KlpL#*Ym8& zVf)Z;7O>yUcHkw6YsB8wC-3%PItl zgX3RW|8ltiRSBHIY-p6PR=klyr8N28nPT0Pz%g96C~E_4?yD8=sc*R-=-^lY6f4lh zumaJZYR-jzio+*4zDsMY4+;TAf?#w5sIT-9twV&W=t$Dsy);|xeASw}IeguiIDC(f zf*DJ+J{=|^WP)$*-cc=jCd29bQH*Gv6j#=%yEj*>s|JNYs{q018c=`H$8=XGYk$4j ze)Kg~D=#{Y(eT8G)@I@p-g~Bc$Dk0P@p?RdR>+pa)lMeQzuIWkY^Qx$kA3-gg!Ls_ z#A;m$*)>$RPDfonNder;BiV))GJ zd(+JMoX2qKlpNWh^sdWS=ky7*#sU71&cRQr)bsji8)*2Ij^}jiCn{dt z^I85vkxuE{RiXa=gb;}C6x4TP0?jjg-_GOP7A@qTu7@JU`zpsyrgR>uP*)(G9zlJD z)7fsL)0sr)0H@Y)X5Z8$e@I>aw z#(OW(yb;e6cDcOE&t-FDbq0Vq9 zxg!wBpzqgE9Fd(TiKYyb5U!coEOskg=7h$!Vd9&T%g&P5oFXi5C{BX)l2zMx>q(+X z6WIRUElo+(to?l!%Y*%{jj!epEWW%+{VCveAn3eud{5moAOxb4s20SS4s+S()rS@x znbR@r@_sN30SAtCoovj0iQOII=eJ*EXIT8aHxnk|_cAD6diE&GbEa)~RH)An2(;$E zBC;6rGf`h%0`v}ZaLBe!KC<{Y-5mEKwl_wni8Q_|dP)f3S-P9zelhv9^0PzKMz3uz zyEnvVCZDv z99xa;W`W1dqq^=0J)c*iErQ?AJ!RSqMbu{a*?XV_jgAQkJer{mi3(bT%HseY)p$JG8c@q&d8 zhNrQ1W=0@ltLxj!<9zTLJLb)bnHJ_vtH3aCmKVr|Q-qNJblG@kf=KBt8qfS=ILB$c z)MM4^tKEWgOFR{SCQt!t3+e+=Hd+axd8p!e8f(2C-}zg&5IB^G^$Cx`Mlx-(7@pVh zyvqG{-E+Wr3T;nG(!Vx{CJW#}*+h9A>i1oQ_}bY8FqhbzHICcQ9oU!UjR?sfIw#&`ZGBF zW*&2oCB5^V;~$pm^P=C-d3o)A4fw`#j~vxTf%DO7Js(rU*atX9`}7)0i^+JmE!l zw~wFm@H2mA+>5+k_S2@%)209OY12pQ(%*TS`AG3>|0s@0$yj+J|8{v^Jp_TxxZmc~ zwD(XwTdLpRL1Q+m?oX0a{bWl{&vQAMn2HR;uvD)LQQvGOe%4a~ zGW^v{P~Mtq_H2t4*q;C{yt2Cot1L9Rg{f30ji|i zWMd~lXgJ1YRl)eIq_JC8{<0sc_eSExgYRYRk&TN)2r?gBvEI%7SomBkRPSvSq3Y`x z1Uf6m&f`gZ{<#Yk?-f+GEOz{_g9OLX!^YpDH#bJK!-TjtX2F#gfa3i$BQ|?cj%+;A zByVWWk&PZ{GWGMF6^v_(^4a(1d^QKq2(o--{Jf}u{pQC1(U?6sTn?}RU}}yVU_o;w zgzNeL@cc*n`H5`&Cg(r&a~xD{i9w)krs7?l3;jwi^qc+sIL7tSB*k0A>;lT?u5EEG zvIN4|hlm7~*oUbwbpi6GG%?)C*fv{V=E%mtHr5yXANB?RcXS);3-b40_2)y`_>Ks{ zbbX14P_+`r?Ci09d7AeH_oD7NaWRZMC%-o=(jPg+^8VS_ITLi>Iz=?xJ4cqt;p?;D zN|g}Td{Deiv{upcDSoBal$zC|o{A?e>Cr!Dw(q+EjNS%bqv9Uscfz$c5!YoViy<42 z>oEhW@c(5{+y@f)z7pY>GDRM06TxS;(|ym_8r#pjKdSZ4XK__hn!F!#KSdoky6Rt> zMn;K?($1|J5=8JtZ(#nZG7$SZimbMJcv}s;txmN28e{|8l0c@l^RIC-+xxl!qD8I% zBYY59R*TkfbEChpG3r1w2Y;4Sh{t8*~*0fZs08`iDIiRTj*B{_`-VhN2 z`2Sj2@iKo!k$z1?pm?nK|JDjnSIdg`O8y+4HJ_B(dH%8p!&3DD1Y1NfBGoLHzqeE# zQUH7{JfEbd7<`|cf`Hjy?5o^Ttv1&vUeR1rNx1-l7z9dK&GD{t0G#EyvH=DOmKVxK z&wPeMNB!(q$i`jl>`)0YQZ+w|*%iOp7S}4WYTCc!qWRZX)|Gc|+zwJ-y#PMc^^pD9 zMsR?NV+!k6Z$w$qTAAgY8za|(v5gSd=2Pj%sQ!nF_oGv({&;hoZcQ2|9HYrJ9&WNe zg5zH;8yj+=|5r~`t2-7k9Lw<$JReS`_Cog}#XBw{1e`Sxx~3LF^-ok&{K*}Q6|WQ# z0^c^rg@erYO^=ECFP58|G%rZgxOSWuD+zHm!PLGTS>TJ@AR9eP!GIMFvDw@Bez;UN z$}T87HX{psW%uT>zndNGuTx-uFN0%It!1Oz0cwQSlU2He71Ltn4!BY-@7UOV74`S8 zi(CapWQlB)t(X?WHdkk`HnF|#d}$rFz2|Rn4ck;!PK%ZIlVD_JL#)98YP62w8J3qT z8!0aE%{a%Tz8OQrhjSaUA^5)z2$f|)V`~=perTI#H5VyfoNKq8;xawc9=>C4EON)(7_NiXJLbl!9biPRl8x(Hs%g!?Zm;5<;sABk0IuyR`r@yc z4*&`w6g!#96Yg8?s}yfJ?qdsOqrOS_GqzbFfe#$;KERZ9Zd`ZSpKV0>SBT*I`XmId zZ>d&O>6Gf73l;CgG;89?QxNE0h;zMEzZAf!NI-Q@bjvupnZU9r>i7aFDxAqFfi?Z6c6pXSJ^J0;ezl!C4 zB?Od}^J4p!vU=-JoP+?*OS7%!D-E5 ze)(;(_#egFl13KiqAdPL@%|C#@3pc~B28KM%*uJOd0C)71F&u*A+A-^;Qbh_8$D%R z*=_ShRSX<(rN6vmBg*Q{Q9?1Y z%{+`Nj}v-kE02?41}I%kQbwO!0-s-$4ac3bv1=Cz_Hg?ldKKGu6sX<{yND;UMh;I0 zeqMLLm60_No_epm0spUL#bz&_2p)EJD%3kpuvn>BR!ixsIB~VEyd?%88{1I_OW=z( z$i}{fV7OP@5{n!s+P;Od5$PZv>NqLaMIf{Pjqa^i*-!)VAu~0O6=4>OUMLTJHuq-1-Xflz`H8 zI)F2>az(5~g1%Y_e9FodF}Q7HF3P1t1dsHza(%;8C}?Vum&%#oyHJ9v=sHHTX9I+9 z8YG(hGV%0mki)Aa@V2g85o?%Q^FjB9i`%6Y4Ka52F6swQ5Di`;9tWQBvp_}Nfqi$Q zjkZP(Kb8gWo8$Em&fg?j0@9fy8%@WF76}rM+5Vqm1kY(z&km-U!#6A5J%fCIaWcED z;UomKQR3`x5I!q8^%xd?^@R}VA7%L0tQPc(W3ZSR_P3Dm zZ9URYG@n50jqn(>$!Y8f=KK3|F7)3`_nacVHcRnBw$e5EOO{*NAwcM+BpIO%Q@a_| z<}Af~|KM01IQb;Qu>?WsS}sDng7$wt7!(6!2g3k)EJqCZPX~%Ed~q7u(QL(gR~p*l zNeGxYX5u)-`}`L|;7#tAUe-^j-^MRN=-eclwTD?v`}#W+?+t^gw)oLO2u$X7X$i;G zLR$cJt=__XsBa7rZEq>N8@cZop}vrNj}h%Jgt%M|2nAXgc3Ho|E`4_k%hg!i z&*R7h2=3X+d=IT6c*fcIYr9kN`dg~i^9L=TA@cV|8vc;J)XMT&kk?-BlY4b5v-7Bp z=U_G-wdE#)3R6Li&H)3*xcldd7e?wnpl5@nGOhD971s{xrSi`=mZ0r7AB+-ebCl?p ze8FrEoClwsNafpo7dtm(*v9I8Zi98xc#D#CWoyb}$bV$MY?MjRhq9>=z_*{v2ghs| zqrJzZE&PJvDSy#Vw2qZ?V_c4*S8UI@8=35SPmG-}*yi1XK-^;G49`rSJ?>R4PGz`LFxKE#ou)$Fa(ii_W;q9e&R9x zX7XA&)}1@9{jy_3>u`W4vhLFMizHY#B#C<6{Y~w?9FGp)MIHZVeE%r%;68BuG*Gug zX&Sk3IRGML(jdr(gT$F79FyK8`G9fyf$7bsm8PwcnegtHo4 z9?JqXM2HLL>$QZqmQ{fILO-E7g;bw$8&6!Ncz1p-1kNVJHNf?m@CdszY(rb!?v;A%rtU&gvq7Lk_*c>`XkFLsCvsruRh13cYGiu1c?!1GpZGM_V8ZEvAK@go0r{T?5HRJ=G_-H{%OXJ4xK(iqgql}v}Z^cov}+>-^0 z_leJhz!8ogcQ`4gj@Q%FY1~|%l#&ZT@mAj()xg1GpW62kEh4hdi?5;eXX)qCYiLd0 zs$5*V=OwM(O%4@&l3F#88h`aB>(`ik5d0ja_dix`Yu}}UvzcPB73uCxlKT96qna#2 zRdX(^cW39*`dFLa8`bE00G?(V_fe?3r)R3qzBj5V8Bm3`nZ0KACCPL@m()Mwv%Ehq ztPyCPB)s1#E z&T>!+Ua`eI7GB13Z_XE4{mh4Qp&$31&^3};@eRY1(DoC}U(9mqSLZ3-iqC|EE%{`g z;ywK{A<%L;!!1shc`Eh}t3QP8RePZE-ErWn259_V4#lnSTJ3D6KF2Z;4|V2&51&y= z!B_2oMqwQIB9f%9@e6@65E_-qtWHf6epfOZfq!3x-yg_nR7%+Qd+6^ujljPz!|!Wz z8Wk7&{&W2PyPQVg-g2kexEU^Q7K~IZ^rLuPih4I{RaI0 z`J_h03BH?;^R>9iq1Ijqs(U8a89qt<-EnTKPEx#X0O!^B${Q+Rb%7hi-0E^@d{Y1) zeb(<#;kx=2^#BvgH{qdoPQD!t=ooZ9LSM zTRbc|p1N*^jzb_FmMgVEjuLIT$S^KrJYS9G|J&#{yDj=xaQgL=OkBI7%7=~+?HfW| z+jHPtw*Wr>qKtn3xOR6i3YPS``}ALT&HRFm4?n{!*=Q9YDBAexoNn=R)^P|Re`d_rPC{I?hWklEv2KU9#5FJo zy;tb~p!xY#0#pgG+FN;uXr0{t-G*x+2Mi!26r?ystGz=9i5BKL_V4Z^T2l@fA>Pk= z0H6O>d7jStb7h$W8h>}3`0ll9(l!CikIqCpQKiQDg;_YI2I~s*|>bK*sk$sXbt`I$>JlB%^mffdB z074JjXh(|`??JSGb7W%!KuEb*HU@sn_P2+5K7s!L(IO)xxZ(&&)VqVc&Qd(TwemR{ z;V~VL9w1tqC>v(J60L=S=bAp|f4VbHd>`UjP!ivNst~p|e14%Zx=LsttpoK`gQMMb znQRPPCAJUVAhjDyGunsG2P0evTjzasp|KcbqqmyjN%q_-&uel(V^jcNPql1Jmt>;> z9DNRc@Ai+kN43#aHSGge)wU1bP}hE{;lg%f=|%0s=gS6>MD;O3Tqa(7^mN&nD?;de zP`ow3&QNYiHh|x8w9$N=8lFdyo*v4(78nj>y#&7Doy=zFmZngA1cliX9z0uZ%!U4| zu9Z~rG{qa03iXZuX6p*ii!+nQC&=nWx=&NQ*Bu*cPaHZ%V`XTa-Y9Pi_orJ3%l&8- zz|+d^gbn6Hbn5#HYTNOg+$qY&bD6TSuT(a4f!Be~YAMBYV(qmOwPSXku6W=7w-9(W zY5r0y^vg_~BuU5ldqQ#~*Vob;_yPHS0c_xlAV|hmQQv*!446>^kyP%Xv8Wb2jgOEP^ldUU@^% z0YN{-63Xn`A%d@~KS|yos5KLx4i#A)X^P8z;HuTJdGFfn$R9atG&kc{0B%1hr!$jYRLEDYkC5(lzu6%@+t&C-*5R(6!r~sd#ViXKObZ zzZ>V4y{1gGTJZ|A;8)7!Os5()EEF?W<}+S%#QuKZa@kmRxlHS;ftXZxEr)-!Ez6+QI8UK3xdw*P_n1)vx*u$i}`iS#8Q* zNz!{HK_%0`SU*BE5FzMvfckJQ?D_alnN+U^hMGPwu-Iux(( z6NVSrYStP((^hL#1m6X3jcUCT=nXlr2j6YzokVk;#M|oUx*eciH1)y{YV+hj-E!M4 zbAK}(<}SKz(cIPjWplTSLSHmae9J}Wy3Rjks;e^;Z%cRC+&P~JG#_PbeNJ;7zd~yP zChNDgrSec)N?ltkUWMwmb9g=5v%u)c0H0Ym^U++`a}pr5y^pPhR)A0uivjSK0yqb_ zzpw1=QLS{O<^%VJOnTq;WVYfR`IyB|w8lx0>ZdwEjY_4sUwh|#$#N~q1@QEoB^$jo zH`=Tn;nI7CNg}T-dX{WdP`X9>&T)$O!cT<2hX7SgiTaj>`ozNwpC>U6=ZuY&`Si_E zEnR$!nR`CEYI9-_iqSkf&`p`493xUD)j0!Fmde;-rH^Fvh-%sbzA&X=10C{sSxPMg5ba!l#P?taXlav(wJ&F57xu)&QVt! z6$1WDdCQ3gQ9VH8n5NPkawQYCP#d!V42n+^%U9R(XCsotpDoqF0bA+|WJ8z;MpT-t zm*>GA@SLIk%6#@I_H6QVUFL6f4!*aP*yy;ZEg;<~u)Y1`mQwtF(Nc!td+<&g)4|4~ zWo$jyd)}n=T(EVr2iTpOy z8D=cCIS#~LFUu@gN^659LDoYw!U{I?f^`^P^jMTxupl6Ouar|)){+^9q%>?9Q zihk`;D^~3=A+9Gy=^X(SZ}%K9p8LnB*3Iwwn?-TmL!0ATiv$$kb8-?rq(kT7M8#Wo z6ax0T{vREM0LsoMfq^oul7Ql~-AITFzoQPnh}tDDkFATv?{a(RfU$2GgcSioLq{Nh z}z%p^4<{$)QlfX`_vKcBP?WRW7 zVP)9}G;ZNJN6{t-XZ|Iwm5&flv`G%rdENwJ;V(2sod3_IkLqy^hKVP#ObOF`)j6yl zPxtw>J`RidpzF4j)h~NJu7LzqOOEh)yf#~P7x44KjBHiqvhC#cB5-bX5EfHx(hx!M zZhD=?<6q6`bQUOHq;-_9`@;6P);dh8_9bGGOA`JI)E&S5hUv$PlK8+jO+J2p#L5>z znSDWZP@&FZ-We^VGwle=A32}Xsdrj@^l+QN+`p%8j?+0gBdJZH$ZFGj#LB(s;dkrN zO>xaXNUE%uYA0=b_cyHFB2Ft>#M;HPnD7cm`zS znU3`M=h0-^kAW&=TC{U)v>!i`de@h*OLnE_`)x*hE2Vvy#gQnvuoY}4*21DU__{qBZlq6JIHnPZVBZ<}oieACu z;3JYlCkw&w_wYSjnyla4Luiiq%L0VfB+KSPL2a92$!7E6RQ*04b*_8uIqHeQbT+WTW4iME|#kEggP<5Z70GnN5Vc z@Cw^|&8J!KtvGDy?{^7t{p;B{j)CzW&*jH6_l8WM_##(H5W3(nP(1l$dNrq8^cEi; zYe$|u%woP#7h&H&*vs-Ww>`}C_zRojT4bSYY~2*sUM0j;evWM1_b{&|C_t#pF4r=v zy-U-y_vvAVoAB7PZ2y5cp}C}sz9tke;DhH_{#IF@Yw7O+d@f!??Nok8X{0)VGgA3Q zJIxOZkv`jeD7V_5aoEyRGXR_|6I@H*7QpvdE)<9Y!;!9qsSB~6q?6S^?6c9Uar1i8 zb)tGB+Gdx4akB)+7Eh6f>K)+gt;T)BRoQ(B?juf~XEa&=Xq0HJ0#to$qbF2Y{DC=N zGnnqCv4RU_BQghQP5U0HSQi&E`|9~Es3)Onr@g<^+1{>DTm>!1rq#t>!bW{yy8s z*LR`f-HmfE3mT)xi0>{tzcZ|N9_8-{#VoIz+j9RQH~5uyQ(suVGf6)oIVzL<)RjyR zW-y(14%2x(#L@ogM?{NE1ByBQ$bIsL=rlp?ru(;`l8=a1E<&gfl!C}vvLVi-_d;9U zGqTn22SOk+O*Zy@M6`syviUh$Mew!m8r7(es!mW#_Y$o|gr&`+#1}ma$FhXVxB+$A z2&w9x#^Sc3QZcP(|6769^Q^>qfjsO_b3V8HCE;(i(b10HDMF|qS?*f}wSJZ*_xW7z z%}f^;Q2ejH|71(EvnK8>CpZRDM3VG9QJ&vB!tD5o-7F8ke1rs@{C{#U)7?i8rSc=3 zYw_divvl|8gt*Z5{^3JR|F#Mc`pWihXVSabwsnR&{Qien%p^Q)VGE8vWMK;qJ!Iht zo_dI35#reIwzU&I&uRzxPtJvP@ja}mkNOk}+}s8qx1ae4P;WkOqt|x6Meox?mQ8t> z>z3P}jcXkuc%C}M@_q1KwDIx%W{=`U8s__N^Y@#%ZG2N7^DR8V`#$v{=2IBhPqg22 z`ma38YVa~WR;1tgOk8UnA+wcC*;w#wT$4vg6@K3OY+Q>Bv(Nb4qG#fof0)c(or!a{ zFk$nad4!$0@3Hl>rb_X?z-`vK&&IW$Z`*6m$8|w%;>w<%L%3#BT=9?ad9LDJ&d*arOw|w5`L3Hy;myH zd!(rpyAo;Mc$oQ3rr2eZMDM~wsb>|O8+#8y;M&BQWl91=49_el53(`Lw9D-K%x}WZ z8qBYO@;bVS<%|ys*2-60hWPHDr#WVstEKd6LR`N=+kaMi+rRrD1fned zaVyfTb>ynBDM!sS`^V>f%b`@ezgH4zzwjBf0}p^~WPevSZli5vr?l~w*#}21J-b9R zcpo<9sK*bcw)2}qV8b!b&@(~l$^fP7Ydk06S>x>VXN|ulw{tJ3LYCFeC$@H$+S*x+ zbmyk0`>0(;Q}a~Vm8hvLOOr)LL^A=A61LK>5`_9ix`-W7o2(KT}%w4R@*-r;s+f$!xVqgvra#Vbx^ zb-oHg@pk6HdYs?xU;*{JX57Z;Z5buL6$LP9s84#~(OlR%Z~l0-q)Fa@cKpy6k00MI z7WcUY7OPZ2>ps9%_uB8Ne$G$ip-fQm{b_ly zwPE@9)cPFQ+5nGkbYD1?^3c14(KtLpeDBcMQ^kwAhsvN%m>0Q3P}_ElYKw|t651O0 zPAzXYZ1RCN?Q{qxw;#DFuC#=N}A+deu;et z?w9`m*!#<Y}z7%hHUjBZLRY-)3^t=9RnJ*N- z*LeSUj!{S?|Mzpd*XQ>yENO56JAH6~avCbY&Ib+<{aPL%fB+=QM*tEb`y_1$3*2>r z0cu|NvVYMcGW(m39>sG)`t93&Ljf>Ajn?T)^(OP*Wnb4LMAdKQKR>@D2%NmIHoW0B z{>>K)(r>;7|NKt01`pi$y`I6O-ux3gYw-N?d(B$-y0_*3$GZgo{VqHdzxURx8E+WZ z6R4m*il`vz_I`paIz5GRu0E*}u-8Soi+_vkNQQ|7jQUp8wXnPnv((h5y6|!_Ec7 zdOt%I{1X@Kzw*NJ2;5l|JSTYb0q*pL1n#b~o)f%<-f%Sksz;g&K>Oe7Y5${M-~Uoi z@}KqonH!Hs;7;Zrb?g7s{mZ7P<^tZZF!_Gxh_CSxdW+{F{8#)Be!+8sKHu+L<<-7? z0(a*H&k5sRo?zwT<@f`R_I zCjnOYKm)iVEO<_MeU~&oz+GY1b3&RB;I0M)P~)R2aHkIZ<5PqIRKM!)oBTh1O2BX5 zi6RcbXX5?uF$X|<9ecNb^18k5If&nK0#N&a0ay=q0I{!SJJ8<7(d*a|vU&#uV7>#Q z?*8}rWzO#FoWm*nn)Np4jDgR;eW=&@&k6tQxTbmSn>T-nX2zdAJ{X{yEaUh2*8kvv zztViQORw(*czR)pKY=QEJFmw6vrl}BMIy?5^Unb8URYoIYc~Hm;Z;7bax(ZMqxL^* z%9%g^7yg&{;J@Vm{}^)`@=gA@z&F2$z&~)OrGRgH{_el}1{_c=2=JMx$a+pl2LrJ9 z690`WJ^c0enH!5g@gH1izW>CP#!Glk0D!*P+K-uU*mB-GfApi(JD^Yi0Ju)@XRc$u z1Lp7i@%#OWEPyNAdz5SER`E}p1_UC?+pn$*~2q>V& z=%4MK0e<^m|7tIM2N3&Lyxls2k0QbDf9{vQXZ^N~zwhlm{I(Hqd6d_|KnwkNeq)PQ zdt^Ri{I%Z^|7TmSAi#B^zuU6=!`u2FjA`)Qf9EmyoAw46SYZ~=Z;bQmoxH#4GyDfH zAV3hTzv*lIi~iBhf70Iq11kjM5xDaQyyZ!IZD;f!w6Xq4TN@N;fc-aZp?}ey{x919 zEtlCXv-kbi%# zN&k)W^grJ#(w`I7{!zXp{W+l>0>IM0{We~G5&xlw0O&wKF&glE`wySUZ+r&qy!qIA zqTj}~aP(ig=fCIfB^Y?&>v*4ddBON?^TWmN(na5N|C>MQuRFWwg|In*-!Xanf0b1h zySx7DGq~8@#b2MZh3`)P`g|nx`+gYOA0NxBY+uJcDW<^vzkS2)0D!U{0C0ZwDrYdT zLSsyUdk`>ya>(|dJ_ew_&1>X8eO!zNtlS3tS3XOTows->v_F`9VE+gH-})8gbx&Wo z1$gVzfv7+D*iUb|3lsoAd!_d(lg&Tp>92an;4McY_3QdIllaZ&m@WF26Y}-B4}gE> zuNcLZ{}bTwH zjK6sWE8P6UYvez8z4^l{#vfic{@kB%X@2AL)$aV?`23CY^E$86nSakK0z$Cq|L^br z-5-w(#qhPHT-07axEYM3mQSkN9wW4~8CDu}H35@w$Q;Y$bzRMg5FZc((xYuY0c8?< z06ap;AC2-X5^ET^?SnSc5n*7;okxhjg0Dx0R6y+l8aH0UR2LN!ND@=AV%^NU!aFhmRaphKTKPQVyq`qYEuv63GylU`4MOgcR+G3Y`d&h4*Ux$EVYr+w_5kp?j} z6^&5JE;}AI4x4ABRcA8P-$-@Ds#ICbbX8|jVLqyg<~`Fh7>p+|`b02Xfyy8>hHJwS zc_*;DH$#c-#CXXd%3l*I#wu;INRCaGH3x^MfC7|$=j@MFLd{o=%kzjv7@+Rn6>Fxi z&F?{8<0J^zd2|`C)g;ISkTp9zpO4=K6qn<0ik=T(de(IdHHX3Q6(rF2-g0DZ(JJbY z-t?dsz1J0`otu@Zx_H`h;$ewv2#;YE3hVB-n!^9YI%)kS@WruJ0E)ti_5gf1)7~dR z?>STz>B>6W09;D9dSfoA_K6n|TCioPCwGJ|Kxs*YBu}1@P8P*?VZOw+UB3w8`QYHm zccUW6xyFpJDP`%-XS3v)WW!p{fg0nJvC{^YTIa3uQ*O3m#%$_6-Ry@ghquwmG2^-I_Ve4Q0f%MCk6>YgOatvS0 zfP9b``*37XxxqjyoBp{aGu@9DDyOO(RAV6m>I!Lk+0ebQEEBdGNH&9k-m3h?QDjJB zn?D4O=Smq6s>KAPvPf{ekzQ79@q#L2)7hGoQ1Q!RZlU7(w(jN$g5{^cuH>W1zv+Y*rV+B^6Kw6gHZ7)3*((AxyFn z830h@Hg9u{9YJf_zCx{h5+_+BjpzDWd7tN0O)fMPFMAVRnzJ?bk#QGkZKy3amRZgO z{Gq*@Um@r6pnsagbWI$l(Skz$sC0sQ=Wc6-)n?ew`H}7YdRiYs$AAS%YX;BL&pdh{ z8;K_2s!9)#N!w6jHw+Fjh5m%#c@XfZGMfVHR9G$=twJMOl$ctChytd5E@`IWIKXag zyEExIOy10t6=MIo8bchxWeYW|yqBV+0|gA-3NJlH1tFF3PuDeXXyB!eXj!-l{`{W1X!TmYE!c zEV>!CGpp(G5DuFok^I{=9hIOzccXyl<*z5D1~+|>(1>caxl1;C;tv{=-eeaL2KShh z#nWhjvM>+Mn#>`5L$o1eXABbBezIcrAO61n&-Ant{I}{f=iYMb7=1S-YM(mQT<9Mz zeik_Tirs1kJ68xh^>_E{G z1>@p*HgP(g$R&Pn%EPz+-YPKjj`{Ggonj#?q3=Bd^q*(UEV>;8hr*sn65nZ*5QZX@6^?BjGKJY9 z3ZraNME%NkhI=3`S-^$mi*EP4glWcLK0Ut(@S%qDn~m$6fR?+;TLEf*IVH zN5lss#F2i$)1;?74Dho}upM#h%KPGA3LiUt6-DbnK-!FPGF_fq4{mKSX0VAZkr3Mx z*<7pz2ixNa8FJEDr-zeaiT!fC5Dn}=uz;Ky0=2`4^X%pJvg~&NL$Hi;P}QJ^A(35p zlzq$=LZ?TzND$|#&W1N8>N>P4rjQek1-dRhmC)n~3zaJ@8x4=tq2HrM^r>(;Vvw-$ zk*o_vuh;c0)TteIJs7IDF;YMDE%H7FF;(zw^TzUiWioiinqXoK6J9LJ-e&1%C=CZy z`p#Od%E3PRQVv0cV$xle;va`H3FhXLp!JEF;!*hGrcl53QALCyOEOEJ@do6+Ji?DE z53J6Mf7_J2PGK}++18))F*%2~Rxm`ltMZK0cu4697HDNl`P{LOL2sf$e<7||VSctO zG`;G<=Cr8ATVS1iC?-dvJ;rd7=V)OZ+MK-Yr|P`Le+{95h3_MF?o!Mo>;sEKS$nnT z@!>FE%0i>&*2Qe}!H?UQ+z0}`Ra9Lu}#?$2h+a3)!OTkfzSfn=Tm-#K^cTfG^P0^k$vi=;)$ zv;Cu+zBxcaH5zFdd|nSIEu6{HR31O*qjmoz73ytD89{vHXKZeCrbLIFlENa_8!xc< z6Y+*C^n{;Dj|N_{+2{fD7rEL1Dr()@FrTc${f2VKr{|5Mr?R{F?`iuRW3imf1B0v- zCF-Jy#u$40Kc)JM5GI0;nzS1`7^J7ZBS6K$<{aiCOUbyPIR^`STk0eS;aTc5fEV;p zVt&r}-u(Ug+^&GDb~`aK%FSv4+X(S|4>`-j*lUGa0|$K2JhJhF>Uv(0+*Yat^AB0A zb@guk@0#X-ZN0!DLmyqtC2u-E z$F=$oHM(fg=`F`LA?o;N?uttXd=(UviYE=pCj`$qjjTN!;c@9P(SFHApiw8%e78Yr zj5~vwRLn1gc*w+e{L^4yYj=`gDcgqzxBa`3;y2wT*A3PmmDPAKRr3(1k{G;w~I|2K5CN$(vpM>1#Yee^U-y3Gotppf|X4V^3Usy zd=4Lct!dz*TSB=>f-^l0gW?B0(7t*B(FM+}=l3 z55gP=WZW-#@GO5Qr#t*cd5sT`4bMs;a6xQJ=XVhcmLnAqgO@lx4`cCUvYmmrF<(30 z*w!aR%<138{>!KHV6}lcy=->#bCUKgwir##GWsTTKl^4USr8&mPpLt+q^dl$x>=Sa zCG=^`G^#v|GmBVhzIP4{YMo}hiQz?IwG?&90WAW4g5Q?y^HngKd*jDe1Jwz39FuxD zmm!|#v`x;Q2Wre@{qNJZiqCW4!MI8C+uY3jgFRX)daS4>xkRp5hcB$3eao;&3}y~r za)0RXdxy{yXTzn)6}&W&P-R?&)=53I9m0wQxzZ4F_!W84Ezf=#2j4*dBEB7n0hGdU)}dp$HZ>T=vO?OcYnQReo>V=F8T9c_4M8 z>0Wo0txK%9`=g@PEuZ+r%r9zdsKoA6>B93E_~Tdf4`nQdGD(bfixdfzFxx&c{7hp? z0{BTj4byP?cZyc#rpONzJGiB`B0*mf_$JeRP8k~NXT<`{XfBxCL%vP;tFm^rX_Fq6 z&}B;)h4kK$D&QuM4>9;HROPM9#E*%H;K|N*&91QnIk|4aPZN9;a3sI! zrA@)r_&JJ+;j1&XIVWoPBcWoj7=-UOKJ#Sl_L6RYf*?(>>BF|Mwbrf}qQ5(|E*0ws zCq@zJI)iL5dh}SgbWuik;d!(y7I^<}PLW)=UF&R^@oo<;B~AMXQbgeN%Wg&k`W49~ zD+DH?>X-p>1;t#&Lv;m*@E%-=N&KoL3hElN*J}DZskb-BslI4ttz}r-HOYEg3L;V@ zLd!AO+g_(Gt-&t%p)J%d6$m(+q2B0r-v;zt>0FZGOPqNuH_#*3b@8HeX8Kfg6mN$8 zl9%v&vin*+~m80S|cb$llBMvl1Zv#$)4&Ks>f} z+AT|NYT&dFX%6|6U>5)BC?3XP3zo02p3DURbffS0b#krCp-{OPO)4r@lMJ1?cfac+{rIaztf*J&2d9e~c)pDAckK$^ zPT3v|)9%{k7@t6HD5Lj!pPZ9xA_o(it_a6u+{dyUZ9~oa7+rDfKW2B|-je6bK!0%O zO{cCgq3C2orHk-Cyn-ed3}d>4`TSWYbhv*126|ObvOcs9r(~mxQ)A70%+&q6=8ED5 zfmo-JqgzgJ7wKn7&*ki$+b8Y&aA_pPxJz1RF}JDC{jp&ZZeYH!Y`+e zpeWB`+Aa<^^it~F`tHCF2-VgAAFRUQ=1TYZx@9IY!)qkbIB6@8PY+u(#c=^-u-npf zk~S_+hwDlM^q)bPAgp@^bfO1U$L9p76=dSN)WVhxQ_RP~LgF}RJFEpSx-wIQ56(dW zs-jIntOAIb3RIj;*60@_$|P~-OR$yX^JMGiQ0}^23}$-NKY=k|@P_Y%eYR1KHszw9 zIc)a5V*SZA`1yT%V-sO~UO+@%Tr8xWf%7ODNdS)^NQ@hlz7z222(z9DALL=Qk9)Ji z$RIxqI@?X3NA=Q%vTpmJ1UD}hY(SiQB_u%lMlA^Kdd@1+2ab>NQwSYT+Y+vS zO{c#O> z;^o58)DAY!J9qQ;#72SX8PRVsp6vWw;7I{xkp|%8%FF@n#Y76TN#ATPV1jyB^W)2n zqgfS?5t|otA^CO>)TCy6aGiM(x(FiWP!_p}sLeZL7o>s1`D`JxuKA8%jA9NsxdXzt zd&$pEhdb=0B1g970Y1&E8wN_?zU8PrRxXZN@LH#*2Yp(HZ70gJZssm*^`}LRd^q=kuoz)eFiW{b7R|T&FjyV_X{#kxjIj+pF8@MOY#hv%Kh&p4KbOjLP_ZYoJfqdmll14PaRB_11Q zlGpxhKMqz!N6&m*>ITLCnS=Flbn)4pe4Ybe5$c1z@9-oMz(|}!q@MLcZksv03JSiM z*I{q7O1P(*=}K_b9g?g56GqRGC_{TTmB3bL7Fs}VK%b738heV+PB!6<&MDD`kFxc3 zO>0)%XyPr0XlAq;OjNlwh+dqg>#rveq^F#XQROU}4u)21?8!w<3}Ml4zVLzIs0-CA zzT(==LO-mn{9bYtDkdj*{rsxqD>!rpREE;F#ikUIoRyC_YX!P`3OgA<)6KewjWojz ztp$2kAgM%jXfR=OgvFlqkc_f?`j%+Kr zud++fIb5?X3-tygTwgTO`yK~VL~Qf>>#i6@eWD4xq)sO1quHS9(IocDWmBR_TADe^R@6;5FLuBYa_u#?zGpPr9vy4|wt1IFf>CS}pA<8w#t@ z$yai{YY?`}?L@vWS!fhRwNE&;-IUY2J0e>g8D#d7chDM3JD8rQ+QaF%6=;)RjO2u? zvpQ#iBM7FDI>4)BgOVaH7`wedjZ8?LSDIWh5_s3=_+#E5q?B!lH3_~39rju<$I4#7 z=M25whXk%D@v+EvEzAIjIYDA~%;ZD+Ey*;m%0OrG!nWa_(|MBs(RSb@%f3z?*oZ>de&_UyKam3Slj(#Tei~ zZv+*d&87(77UA@jiL@!_JbiRT;1Ufmk^>8r^1G*68fHRC(Gb4z&O2JO`cV=$cd=bZu5Y<*|A5#Qb zNd3x^Mt@9DXnR);ZI@I>I;L(ls#HxfH5|S7ejNu9)kiNg%!#3r{>fu>DW**6I0lCQN z2#3V>U|(6)8Wt!fU6;VO@VgKU}ArI3jQ=SR>}{ z6VEZMzQ5UQY1;W%pHd@nw&(Ga>{hg0qqBMWfbWq0`e_~_^g~v*QLa4nPipgBb+wF2 z5kc@rgNk}A3N*V9D#n!Q!(#AL$4^k-dw(qHVS!--7Jkvjl}{8tG-F>HmZfm47%)t$ z`bqsdWNBYgNC@!}OQkMFj1iwm)%*pxPkmGe!o+xOifPjluI2mox;9lsnSz zC=#{HKSg#Kd8J4~rwua~T~)aZ`!)22)t#|)#3eg}h`M;WI9dpwx^jz{>ifsFbE=K? zCxYtsJ83GNz^`oLzw1E1WPJ=R@i>W<{rI&6)=fL=g|dq0R<{aYdyV);c59VjB9mP* zDEGY&e3ujEmUC1W&Pm0V)S)f9xPDnA;$bU!Rtt5Fb=Y_YQeniGV(@Mjh@c zG@>n0^$zlaMiSCaoC9~nx~{r+hTUK6z{Wd4wsa*Ja}hC;g_fLVo?+muiA0|TMm!b=2O5q2 zCvV_NUY<7RCA@XS3yZfMsnKkWiF{#3=&-I;1M`m(O+>#RwQhc$6b##PPS#3f{;@c) z5^}Gvp8vsZkOA0Fj+QcG-N`e!mV|0=q)YgeK3I9o-ZLe8MBqrqzR_CYtw>HO2fA%R zaoL?>4paQ%l9G+Lo8iI!nVYBkeU#2NL;)?3KB&Bap2&GtuuRV0Od}{_j`Z!K58#xlkM=B+QNQF|S`$7kJh?KU5mbq7(kTZmF|-P{i!1s` zxRyMTmdtdZ;iq@-`e}e9cU|3(|BR7G6{H8}w>PTl~wRf3MTC$^~M_n5#SRx8)k za?TlUMg8i=Vfy`bphAaYpH4uWGTHKo0Bc6S*NdM@n(=8~#}~Cek$hapLTU&TtEFg9 zdLh9Is=WW=R$ za~E@7M{8z?)67DN$n-Mi#v@)vGj_cIww#ER>i$*!`<(%S=wyjfLljWLVm%ni<@ZhTE8ei`$7SYlM4Y?}v|A=X)x?2$(}$XwlCNn%wU@6ThmJMk_*=gqAk ziwk3|)o>`Qq2#f~zc%jdFgoJ#?rpd~4+w@3YFV^nzCU5TS7qf>`u-46>Lk|_@j@~! zbmglZX6Hs+Zu#+RZtr5QKM3UtN1@HF=EX2ikBKY$UZ}?9bJ)l)M$sjEtQ&`7?eop2 zK!u|iuFKiVIHfP*lT-mmJ+OA@islyUMdq=c3ab=z6%gGh2lxv%7uTWr_Kup{AGP%E z%2l-kZ;T@F+V(vX_Svhnq|_d-)C0&>p!#5+HPy%Fu&zK$Xk}a0p~ShnXGpk=x~?%q z!LpN(?}|UCpd!aEVDvNvAtlQxt5~Yhp}^&(xLAKG2V3pUbdHBFW@ye-Apt2>ke@0V zJ8?RXce8i6ooHV6>%nv9Pq#6h|Hh1dK zGx7l7vKss-!J3^rH&#Oqa>x(kOvc6T!~ww;Bv=0yb$qw`JWPROSx>162c8~FB1NQE zHBjr$ruoToqEjhBCr5bli~k1qTA5zUW%(m`93%$(hS}a_bRUiTaN*BuI39lFJjT>B zd_G6DmY`ksF?N_zu=t9SC_4Kkq}BO{;d*hyn-U0_-tCypxO7Li+yGQFjKU}Z>IfRs zrQ2WD9$o^(5bp__w>yJ2rd!0O&ErtWa0^pw9H7e{M04KJe(QZ~*G2q}>!Y{bujs%k z)BO2RU_dN13TwXLNGe!K6aP5y`v%T%$N4D!{z9K`&tc;tuB5IpZvL zJ{gl56wM$`W#z$4BamRi4HXk0u0XYwd#VScmW5+pz_YI`O9Lqz5RI8^z0VhMNtV==J&MNiKSh)L*?+)82h9w9G2Fo#$nd zGC0I+tlz|PG^%5f=uAm%)w1I*XD>BU+ZXa~E+W1SL<4`I@UwtKhoQpoe#mFM=alqB zV97dnTFji#KDU4Jc1MpnvztkGR5JLK9cIsE3j1>aS4*Z4mJ0~mbZQd;XwL{KXwjs* z^&qI!bYR}CdYanwHD~C!O>n<7DxB6#jH@!CyECJwCEsz0a&`mllcy9I6*0wBRy_Se z-s!Am7bDTQK6|mOw&rS6yNo~>c*pX?#4=5gbfbd$G;9LP*FjY?U{dtfag%^|{{2^u zUmoB^NydockkSStbTX&5GoFmNswUm%dFaL28)5#s#%%O1vGnv=hNCua)|_QG@xhE} z>Y@zrY+TYxYk8#30Z0#CD(Of@k23`7W;Meua_@n8Pli>&s2)Q`)>|CXHrzLx5sCo@ zSSSju$4tB~%Nbo7CSNivn@y}Xz4RqoMr{oe5?dWP#$h@%w!NR*p7e3z0ivohzS5sH zI89O2cMZ87aklTkrlgASREZ^Fa+ZrZTPZlJ_Da^Ez9RoDkPQ=ys5kmxfE_k9`Rw4Q zIa462n&-Q}(14NGk3{<30_C~OB+#WOL5MnM5jBrB8WK^4zw(4RKg9b{I zNF@}xHND400jo?bV+psuo_-~pX|r{M?V!%@8qyT~V`Ioa(_mh%^KZZWLULFLWs4N| zYDsifyVpL-;bnNv+NKB^C4V;9Iv#&`1nSg&rlr+Do5o9OpgkpZM~?VzROokxyO$2g z$-8Z5{egm6CX~8OV{gSc7iG0V&z|c5xf?C~<-74XMuxEURJ8oXFr0(L4>S*n7zo7h zg*wc$;e#zE^}d$KK~}}IBb{_Be*-8-c1h&)M1L+545KmP_?qLUCS1%=30|aO(yHWI z68hAHUB+8BYxj(E&=rpo7o9*4PJ_N#{?EAUh!R&LMNcvx`s$P(j}HZ@eFQGWZqd`F z!&rV<)HA@y?C95#T1u0z`m^`NH?l5J$qp*s2u>zaRQ@;`Mp<%sde_p@qzlhZH6iDz zols)`P4XTC3X1$BkBWZrm%a&IU@L{p4NbN0H5XnfS(tvO6W7z7Otf1l*RO)JcM}bZ zBm$|-U2XbtDYgZELffAd*$&K%NdrZ_sIe`i^2^gx>LqLGD=n{#(v)j#ajxyWZci&? zHbzaVL6e=N?kqD%xevS zFK{;Ud40<`1Wjd@aId8^FkeO?o|Kak<6Oh`c&3! zP1VARWG^?NJ!Kdjge5Q;(?{5o2W0SPG@E*Y>w89?gIEWQ^KL;wmU$5yZuDpcE-A~rQe*N#!X zLsD0Ykj4SK>g~|>4GV&#tzC(3gwFxQHE+o(5Ra@!*(|Pu&}1GY&~u>CNZ5^}DUQpT z&I!NRl#h@hg58*>&z7y8MSr4N8A{RW9{icc4h$^eQSwek1p97QYJ2^zK`>n_(_Fmq za9CDFsznecKU%wYlMp`Y(F;+ISIk5J|4Y(ZRMh@ZA$a{fkbznnL!=!{ntgJSa69sI zkeXcR=!tRjDbkP8INf)0Zmde-ffg_JIIIdGx3MM(N6#$)D&D<#lI+b<-^wTlX^5_2 zcH)He1&PWQC>ru~TT6mm^i3O-Yy}*9V(90aZ`f&uC{ynU#(fU6E3VkN_2+1mO3iP@ zIj#sP*B>m7Y~In+Y8aA)`gJqAFEM`?q>{_9;Sxv1CCDO}0R6JQ)$l!A{y-^S*3aX_ z1d2T9F7+b@yMdQp!-NXY$D1Q&=qy3fs7fcn+DxM7STFn?Fq^AG5)B2i?^xD1o5XX1 zNYiBqz5J1EC($IIz=k%8-l>8Gri@X;rBLZa}rnERss;KN&&kyn)k|92QeBO*BjluIE#4<6xB8=}XLAZE; znMw`SWeLI>;4S>QPcM7SEG;O47!Hmlzy26evV<5r25V%a<5M5YN6d%}ewi5O^{Tdna3PtSyOn&tvgW5|gZ~sLjOstV z&-4<0H03?PBqMv|ta67?r)JeXLp*6?M`HF7jGcm4HKfVoJRfGJvS;U)y$fG?C@)6K zG{T}`9+W977Rt-$aurOLx)wr^Gc#o(P`o&UIBkIqEVM({ie4xZ+tbOsaZh_K=Hk08e{;oClwMRDYP5z( zjtI+B(0Vo(xk>YO&yY_Wn!`H9!KXY&(`$d_4TVX z(HaZOquYT_-c|2@KuY`(BtUHdDbgucCL*_-RbCkp?jJu%&9NG!gKOL`$0OKxYpkA| zJT&66$g#^%3k;r1rLsf$u}V0PmX+QD`~4H_`hMdWPGf(BGx8oo#<#0D3zX?NM(;)D z$2Patt$TSKQm5owUzYxd1s+@Oq)OXZ`1vk~nRsN1#hGCHt*FOI#apAwpXb!gxFo3$ z6w47?!$zYeJNt6=p@d>i4*V2QI^p3qZorLS)1T)6+ej;}bJdfWnxw)&_|`C-U~#Wl zh_RyyJMzBIhoSx;ii_LMj96%>(OR0ZAse!E7{8i7ohVEJ{I@Z4l&vP*2o`ORy`h@Y zxH`kZ?~+tDKVPyvi9pO>t_RUl9WjK}tx#l-tQx}^uCk^rEv*+jB{AQ~%hB>M zn41R-?GLU-fa);VeRrR(R9Q~>Q2I^~#PTL?b76Bh8)HoVPMVQM_C}(~DT)#+EyUf` zM^Ii<8{h9+nw&vA6+Bth&db+mR~Ya+YTk@#vwVbkL69XukQc&sBRH99A6GvJ1w)v- zcP%UJp8OXK4}xZ#<(>4*vU!0Zmg9G>r~4j=WvJNK2`gt!pYD>2PQE%MlUS)Dq%TOn z(DcMCp0qS_DHFA8KNFp|6qjYWDH@`OMb-HAVm}Z!XF>=)SEE>#6gbye;?A*XdrlW1 z0DpCenKuhZ)jbB#r$_QDa<>prTK1!|&xq_tK*z*y)2gv(5P|0xs*+{*mzrVx$i5OX zR+CZ=3>}AoA;W|yhe@4xBARq!yk!;bpAt(AIuwY*BK5G@pGGU}Y9+?(NY`UY?3Cfp zg;B$C>J2$LYiY)wJh1VDjFxLMC~o2lk3BF~C#T17EkVovg4WXEde`*ME253BzsG!5 zQ(EdPne;wa=lpG(uBhB#BbmB`A84rH54r;AYJKW=v>$kN&E^W|aqpKF9v&_$O()fM zU=Fvhj_K;Sewx!&f5HBq+W$Q**>x(^VLBvjVRdZK(nu43?E^^mm|?q~?EIwImYG9% zkUa1x5-#sdnhC2A(6U8XqzzcaY=7x!kID=e1Abj8fT{U9jOQ)o`TiHt*lpo^!h&MH zQ`HkhycrSCf&jq?bMqL-AnwpM0jiI8`HJD+<901Z_#Nq1{KN!v=QSCu2ow1qOragj z)<>RrulVE9tcC)CO;U1%u&zQpq zG$!`6V$@Pv+82PQ-ygL?{1jM?QVp)PTcdufYMNDtuROMh zQkW8=b$_+Hag_p{-)gz}(;~RWu|cBHeWV$~*Ir3c@fDC#MHticxNIb8S7 zbH1|`$+jgg7Fl*pvnfj;NwWkwA%?pp&&j1XcSQ)meY15nyIjbKZ(NE2OO_t1$J5LU z08BQzC;G0hHtIuDZ<|8%-TT6Z$Zm6Ytr8_GXH|7|{H!j7JfUY%84g1l!NZyVp>g(Y zppjMk`>(G*_HP4xAe?Q(IBM5c;j8*=43)ObVLL{(0-Rh`S#!vHOP%TasUqHw%Tcfq z3o<^mj@`jRwrSWv5+W#?8gWq9q9ZAw!HpXUP(KGNDCzjg;s6=kV2)~)kb@do2tscH z8C{$kRiG?=bkIoTPoaQ4c3dhVsckz&D;~>hL&F`e)#2l;4n8R&FSntENwK2?3XeIw zUuQnq;Vk-Bek#ZKiHhSE&|hZmbyn09&W<9?tXH@)D(&EH>4QmOZ@9;c8wk(kztpC~;e-EkmEC(@`ocP=pe6 zx}g-njt?igBXGWy{#Xj`T`QVJ{3T`~B%R|dQ_}ehyr@jUj?)WB)fQ@}(!Mppa_}hf z_4`u@4Fz-wjD;7(s)o`py%n+0FbrwbPb%$#;oFEOo#_y4rV&ZQ1BZAl?buYEBXwkx z{5v5Lk?oC0AAiTG6s36vBPLlP6Vekt?bKKg7ndB6gdS}PT_Q$ z368+a`k^7m#xu3gAty3D&wTouS^!T#u)maSK-&>3=2{W>pT1j*0j;v9^-eco<#h-E zRAtVmA78aK#sZKM+HdbAN7d>{&+-L6r*?1m4Gh&@!PN|}MbilR&S=oTYuUR#&8J!X zW{7{vrFSicP5@>r5cnb=LT?|XjbIQE5gJ7;=8^CmnqW1Jn{cnuN{b{D=#9B~u(zUl z`DxwG%Qwpr;fh!DsAJR?8cEa09!^w;!{?w5Mdv3wdEq3&H%S)4X$56mU8RC!avrL( zRtJ`xuD0;dE{2e@0y;`oPs;!j;*)Sc@D_4KatCJ!R`{bE{XK_doIqDE8(TkEZ!P? z_ig`oP(_Ab#YKv-aAm8?nCIiH zO&05McHTaj-XzR6Sk6&P+msf;Ixepp4B3V_1;kXcn#E8A_YC71~8>HH%PHB{Osv;nyRO zy*|cjUc0>Wrk&$nxi@1{rc?r9y#2J5;wMSuMY0*_rzoY=UnFXQ%Mr6fV&`)hbE5W? zQpK^8I!bboSiOjFY3jZF2eSUUlfxn^S$(8f2RN7=n0iE?9GGMo%^?K7ctD^o%OBi# zl5a4-uplhBP^|6dx<`&I#)xy#DPC&~_K7Xj^@X$RQZZbsIffw*5i&}lYz9nJc8zVu zVrDKy$#lUAL(y6a8n?4Xu_w>E7L6?txTqA_^?y$UP~jHw==sHW_9su7@$>FzO5?gK zWPRB~40T;fH1cs|O7-CSqMRq4E&G@gnvL}{peeNBn~;$|H# z<&WU<3=Dnht;fq5rPkXk$3|&WG!X>mD+?<8+`Ih_?Pi!3RS!SQL}7=0^W&{+vmGzP z0UxYpWOD%;g)5SV~w|Jb<9swe(i`jOn((Ka^Z6Z#&I= z`D)R&C@he^t`LQS(h8x<1ve(C8~7Z zfU|9oqG@+QBj1SQ{d`UCJT6U!(2@MC5e)GfeEkth@?z*D=qOV`a5iIq!4=p=>bl?= z5{XIvca@+E4AZmNz5UuJ-W?OU_E838_f#=kB4kFEyYH~;;!vcq?tdXmDk_Ka@HSd3ZY;ObEtW;=J!lZt| zIuOh(hLfM{ut+Iqu}vT9>;0mG!6lvbeyJGwjI<<4tHA5y$bLx>cr!JG#`xk_Vu96) zmk6F)i_0PXJJwtw-ytNA8&YogSf=@-(Q!sTzQckG0=m4An@^t6sR9>^P*L@^Pp&p& zKc+p)Jx!KuU$D8>>{2p5P52rg)?Er2w#T#da$hnuq=bGkoF;y! zW-(HEBHG^Or>?*7p=G5{aOj*vHI;*d_du89d<>NJMEV0BRtq#pSCrGn<+mnh%h@1j zZ*D5+G_D+xc+D!;g4P?I1xWTpomQJ8b*1r~S-1BU8i_*e&Nwslc}pL2Q&PT@A`+Lz znjFd+ca;}o37#98RI*-wSe!U>#bO1wO}Q%bHIoYqyk{hVJY@eWtWY&UJv&{%-1t<3 zXq^PS+oh;`+1X|3!Or@~ZO0PiwOi!a^KwWM#jk@46g%Y8)6CUeDbTx$it8ognJ#;h zVK!UOQow;KX*fEUS7T_kOzjNy4==A@!E;A?d3 zxH}-}vyL$8`YgZ%C+;>6rigPDJ!3ubctq+=L_bxdFEa06&gT?r0aKJOC(c6?!a%i% z9ci`|a*Vtuns=w?DYO>R%queoDS6kFkhe$*_b3sg<8yng)`#zRELi_!*O2p0aT!1R z9JEi_V~IWOnSC#3w49fWpY-{{D1irciP076Jo2O$aQhUXBomWyI#z)Kivm1UT(&_^ zoLE z+ncMD?#1GDp+hLyVj|t2^0vq8wek0?H#AO7nnnEnRZeRtSCn(F_@#(>X zII87aB@Al1xPIA!15Fn7rA#ETmK)Q~;0s~~EIKozyd7>Jc{0|;rnxNL%NL(#+7E6L zahHg$74WzpHO#2lFT`!SkgW+xsR-9argzk!jwoUSqYvvOhb*rY67D&0WG>It)O67@cd$#q+oq@k;|6RON1y z!Ec7_WPezhEZ8hHI3@RN`EWwFZer(BloBro*jSl`PzKbNp}>E^J|?v9O_#zlRSy zTT(A~_Y0g*#eJw5Lxfc^SePU1`0|;@JW@grcagY$Sz2yzA1O)pMYVa<9wt|isrZJr#%*wv_qDLLcYvZUfPBgqXy?y^Q(w84#%X+|{Z68r`HI61a40&wF3H6<_ z|E|09Xr(@;wCA=`Vt`5gD6L$hOyYD8L0UE9My(vCwbR0|JLr-SYG9L_aX4aB2NOV@ zw&H{B758ntWoOEqJ-+F44^L3kOI*TpoT_^x7%vsl;+TotZT_VYOpPx~Z-IWpDPL-j z5dIe(nhQ~c!{C6Z5`A+u3FhkMXJiu-g)+1BpDpV)VC#B~{A`2AgmL#TJSO=SmOa4q zX*LdAj(t3wPtq8ZR56(p&b%As?9{ZsPK*UYacMdxDaS_XIzL{qYZ^UZegc8r+Yr1# z7t7o4hiLALI_v65l0|SoBMc{!_>OSH62SWKj(J8Djpw|Iz1YcU7aJ>E;zAuyRmE78 z?8P&hg-8dGkzcs>ZFk`v3tkrdr_yVEd$d*PU-o?Bg1i9r2Y7TJx_NuCTtW-SACL{j zW?Z}HSoLtGP%`N?MF*cVRt22{F|}-6HFcoZaONN#@ZS$Dg5Jg(oAh)jPR&)}Pr*Fp zF$ik@RFZkuzlYHtmdA z`LcUS_JeOHVWC`lX>Psz?Z@+r@rlv?vnyrxr3chij!ynHjhZARilC{0h zZx)ah%4@_IjlLF(E%-q9pu5?PPA|Gy(^5YT|wy}j^<{5XY! zAYXhY6qD28+@#v4`TcB~D|LeLpBoHA)Gb>KRDNM3j!-4oRQ)jQOsKZ-HD~waJpIT( z^ex3r!zsduV5`|G=rPO;pO>gEs-?E>JaMW2khDWC7J!WYwR%8U)tG+Dua)iqCXHLV zGwwCDoA?MG6)gd=gQizl(etG7Iso)Q?ln3f!V@0aGQu@i1_?2Hmd?z#yknmPee9u1Wz#0%zxjyjTwVU@V0XRppb?QI%ApMfd*Xc} zF4D)e=QsNrg$1IEaJ?IU%R=0F*2oHa9OV7tgGHQ z2?tkSzv!U2&;zUj4S#+N($7W#2cH)9E0nLUW(mqnUpG^xP=Y!Nd$Uq559DO4Kp`!+ zAe-Ya>?^Y|U{Nl%XsoX8Eht;yr-iGPx>Jn6_!f^s0q+1ZM2udj-V8T z&Rp-lq^=l|*+`qidXM|FKBP>Gl$ca1ZrNCM)ZJ`-gEGlZH7rpk zXdjgzf>a8vUgEm>qf{i5N@D*g1=1p7g48YI>}JL8W6<`Ks5ige;FSv*p`Duelo~ov zo@RB7CA}E1SayFcJq7}^&!ZG>=g7_GzOItiqW%)_-=ChXcX#{zHn)PD@lnE9p!1;C zZe%E|36Fd48HaYcPRbtzwg5^LgRlSDp~erGI?sg|>ZY0=u6(Ml?}=U%T`zNw(eQW8 zMUsE+xqQMr|5jF|rAg!<)}prL{DxD`o-2FH&uZ0Tw=@np;;I}ZFmaT#SJ>#(#ZNOV zbACv=vsHv`5YLbDw%bn6NeK2@Jbv##ToDQWCj0*|%YhQ=9;t5l>Q9m^Bbha&S;`$| za;;l@vr2q+O!mR-XkRQBzLMdg?m#3ZYsCw12EYZ3BP4d}>A9gjSrzAHM_P58$a{vD z^h%@bR1RkE+CjKGriNqTPKlC0^oue_J4>|Y*h?I&1FPOHW0pTBp)wIQBx>mkb74-{ z+>w|8iVb1xIleo&cz5cmq7opIm=-5H(fV2MfjFN+=(MX(CYt991q1rw;XOsHeL&1F z@~|^P6upr?;kOqh!;;IML>?29m>-s8I;vBe7{D|8-+34_FGtE$BYsbAI0l*f%_7@NKZ*q|Tvlbbt5=KND64*VG7rW)^WHq zI*Zk79bF(AU#0==h<}GwIKmABY(Z*6-wE?rX%nH=ISh`EKxgONzz2IKCK2LWxQ4f8&kD?M z=mH{46Ls8Z@O%tLnxahgP(S&+0kNSdkOylQX^DH~3io^Alra3$jnkPok=5T>Do_4w zH%oXdsVHh(*5M1Su3~%%xR5_7H+y;RRRRU?D5A#)E9R?*osUcp!F64TeEO zZ03K3u2p+jG)#d7A)#K^wjgf#U=^gYk7&{(pTGKQ%ZGhIO0FnRp1WxrH?qmnA)za4 zUH{hGk0IF?*5-8bAPxq#4BT{1lglT^OY`qWsPI@Epk)b!$1b{2+0;`Y#~_81EAv8= zdm9)0oOQpb3FrDI`!d8-N zmdeXzTn_Y+D~a?cRVLSa02v==PD3Pt1-HgQ8aX{cK8gdBV;ixDw&7CH=(`R#a^>EJ zz~5WK#tLVrOar#qe;u>qgtuG-72wdWM65ZbqK3$=C!jW=ZmNfRL$07j8mt83Rq~pb zXZrzzV!wM1JuNcb@4UMP+D`G>gvj&6F45L6VlW(U{RC z(LHvEhOq&F$KGHdxC7@uL^-jz8Biy$g6wsGaX3MllqXnyTjx0vPl-0;r#1o_od^Eqb2Pl%_9RQ~Au)p11AO)XO z&jm0>+9z{oyNg-k&)Qe{7whYoIY_@fTYJJ0OV+lE6tnfi z82{d4m`WXMP5@7RFK6^39@}ZvhyCuCR@49to+1(2jysX9@wN)O=f)Hc#D!mdX?=5? zgKBB-5U}PmG7s2Pq@6jh{B2L`G>I;-q0Ql2tKt8Gg==1^o8|){$)F*t$ zO8W<5nKu7!aWB0k|BaUvRwI8Ci4fQ+ACXp4g{RX5$>Is352`4!dHD$R6j#Jl*J-df z@PLrcb%Ez~4}Wo3J9tx@N?yz(1fC4n*lCd8Hkpvq`Zf0xWU#<+4Ah6f%Gk<^!Lp=&&LaSwcoM zSg97ppNNlj0>5M0D7u=@yK`8v6Y^--YyC-3&k5>k{~$TVu5fwk?41etQ6K#Q)t~Gs zHvBoXOdsa7%$FhM8R>dpZ8cT?RrSf&(Z}r)mWmhYA7N7I8K8G6=3^`DsujH$E2?0Tf5#= z-gmp5(gy`$Q)MyKI*NUrFbO3nav9{V9lxjVbRJH|RNI09 z?F;vx4UaDFd~UPn=mhVLUj99nI%U(c5p^7ID$^z(Uo`>?pEz5kI*>jCpHTAG}0Kwy}A_=NbS*-E$101UV4=DdDnT# z_7=2=?iHeF;~mh_V|aYCFsx&GHpNiCSN8r+Lr(d`qAI7PEEu^%d+7EQPX}&gn%xj8 zOr%(b8Le$zF#BJ&pDL`74X*jC!86ly9Y*EI9vxxv+EYGZ@S5be1nFM(5vEo-?fVAM zlDW9GJ2~v7z_EUQ`-z6Aa7U$JjQB?}1XL;WqIs+&+B0k%G{T^kC%ZAf!P&?)yt5OE zwk49>%sYx@^ZC&#&9L;>M4%`94rxXUR$Ev=*~B-SO`%2Dt4#tiPm@;ACYc<^E5d-Z zy>9-Y_m2~FEU06#J#8{dfNFowY*DEpG)@y4k2CxRMg{QC@y;ONK=KOE_RP$}#|JK+ z3LaBgyW;}LAfG(u?DvXoJP)%JW?WIeg2D?BW2w}C5{MIliUx{*$cg8@&QaWx0|#%6 z=FAO6sQd!rKBvfocbJh*AC2v$I8+W!QydIO5m{6fwMVcap*^ba?w%$*Id%UUjJq01 zVj*_uJrGs(T14=(fzUOUm1Fl%v7qoNm&qq{*eUOH(rxtna;Z-e)&0r3@V)(BT>4Yv zmaA98w&)H+cA*kZ}G z_=Ln!R}>NWeI4h4g<+|m$VIs=ipit?TKV7{fY^7ch02qfE)WB8J+UfeF0Ev`T&jw~ zDu5_1`IF&sa<1CgPfYB!;{_03Oy=SA2V-?_#re(r{53D+%1iviAd6f|Jou8zE3nSl zOYlU?PJ{EEu+*!%Dt4-e&7#pipt;+AXDyOU>pZ56Vt^QUE1i#C!=*bAvx++ama?nP zjsHCE>reZumN-lmZhZ4GUyqrHQb>z&8!ty4A)K;2m*~-Q6hUeOVj~8Le zBn!6rB*l6tLNb3V-b66%X=4XJ%6kIpZto`@b~3_&Jp-EO4JZc#3}tgzCdU5EGk-I! z>VXB!VIFvCaLFHTPq-OE0|T8_hYp%DI=ZAqqqZ8pRhd_BR3wvn4N}&-(wx#VnW)nq>1-;!CV>NL^70QJor+mSziqe3?02wm8Zja3B@+J=GiygQ*k%!m z$&*_wRYJ0xV8*(u5)xes)KqyFZ83dM@{|^3VmNj>eN_e77e!*U9WgXO(~kKmO+S;G zE~Is4_F|9ujd@E^e*5d1hL!<&zT`r)$S9uesJ3m>G3_v(YFh$Jy|eQ0olprtasEq@ z$<_ylp4+L-3zZmJRS>G-aOp0>F>6SKFXemPOatwrRS z-mJqFjLPO>>0xO0VAFnIM9&EUV8XHdFF{Pf26D{aCE$!SxZtwu1znzg_Z}q88x%hq z6ToCRLzTLFVW8aL^?(zh#YmFH)zF6wbFSjE=x|DYpcBK!oOe;mh|l02|7_yJGtPfL zebqN33Aeqs?3yXoPwIIjObK+Hmpcd_g3PYOKhMU?uZ)QmdFzO|1FOdPZdBe-ZqJHK zKV;C$X~N?`N|fRR`kPAjE0YWk_-MRtZ06av1VHp)yulu4AI@A&x_GGdmH@e7f@QKD zLb!-#L)re|hVNZX%eBojq=S>&yja6Xa;)8^B2aC zkF}3<`jE{0uTIh_*;jGtQrJ-XO%r@V6(VIO2->Ps&+E~L)qGB79DT_HS@;P)8-QU=uN zpWoD`maMTM-5^FFiC+$#sK<3WRGxe~)v{=J1{)l`vjVl%G}6}M1eKNNC7ol#?qF_rSX6vt#N?hEGL z_A`ZL08~_jg_MV&!<9~S%PoSQMt}8WVE!66?x(hewN5Y*IZNqR7&v)NKaMEo> zjYUvb$Fi^8au1&yDPd@}O4RAs5a-S4BGXh13o>_oKJ9LKOM96gp1$W2e3UjEAd1kd z+LiWCzHdYeqkByN_TO*FP@X;v9{#vFpMy`cAAVC*WCWx4c>!_G7!5~Gu83;qCQe!I zIs?K@3@PxIoxr2Bg89Vwi>_!#IouG}3ABcX`hE=L?m9IZ4wZ<`=bp@^SeQt?oG0eF z_sVAOREN-Qt1%i^GmD9!z!;i`URVO zB3mRT`6?81r|f0?-+eU=L>o)3YmW}2J8M9*agk@jP=-rK@&{s8e)mN%p) zNIv;8Bao2b0p19$#B3#ce=oPU#;@y{hd^}x4l3xY;BSwh# zq!7J*04Xh{YOBoM&mJqAU#XN7nQl8lQehSsM9*6^Tqh|?!@8ObAQvl=+3|K!*riHK zN(m;=6AUAPK}*h)!EaHg1nHdd0}%da!_916~Q!2cvv)0z*0cI6I&wEn`Zwhm{F$Rvh>oyL*fd2ptk?~z=-8EAbC*323sJX1v4Truf)R_ z3A->4Lbt)-OmW5cmbBClL`S0r7rhUB##0A0nwl>^0qWlz1~V0$TH`Y*&Ol4Cnc#qK z453Uk0U;8;XC~&`tBpn75?}%v-G$aOcq8FhDn{_aO>tRUjb*2o^l^xNVBjq+2`?rU zr@t@@nF!Z~{0tc}-d{rg0E=Pn+74-G#)I}p8@DJLT!nv~IMC!ejbIg3^~QcHy$N~%QcJO2RKo*4M7PjhX@OIa0#hXUB~ z=KE$>&jy50#b=bpma-Z*20bD29<=AnHjAUS6PBtRIqfL|B?2q#)xN91SPsF1-}XKtCKAeEE_S8gYlOcMnjK26ZiU;4U{*&8*AH zd=6$)5KwTMqq?Wxv;eHvt4_fJ)qUM8FaLJAhs-^d5Jv+1mZ!(N+XNUD6jFG9hiU$B7h}##qG4+7B|_;o+Jk2{9J&NI)FI z`Ov!T2bAg;&u+Z^aJ0KXuEVbPR`nBA`%8gctMWhBr{>QW?;mj+l4sM>?THkRjf3xh z%4KbN6JKumU7BcAaa^4Pd~3B@WEc z_n>+dtk-S;pYg!l{5#pdX#Hh0W*FrHnl1mT_j6bwy%6FFQ1?%fzTWC=%%a6)C7&$19+83Ks zaVDu5`yNWr6q6k8;UVg?7Dum8<>k{MjAuq&ml@h_*>HWI)+NyU0b&ZCNj)$RKM!7A=e^86N2t5|xTT*?ZPySu1c`}s3x4iij+Iwgc7;X(WHLcxt#3|@5!G+350 zRJPcvNWtyEl3MKRv2|JYHTC^{mYah(F%YEJ`zY|q6%_}_hI>yuPeQH zp4?&JsnMX0I$yDI=brt6?(o)Q>`KZoueL3!EumUCwZ=bRV@T5&>*F@ck%mieS7t{q z&g4WUfuzo zii!)S0yWmvP5%jbF`B}yr)IT0y|>F3FiTeT(ovARM*zU{i`Nh{ZRq6B*1t7%jX+h` zU9dp*mHQf(B)GwmUuJB_+ZMXG2l)7rvWzCVqFJ!sNn^}>Oh~ol`GF`%pP;1p4a|G< z&IpBbN@V<~z^;0~r9VZl=YK(AGze}94V~(czG8ehlBZ+(1Aq|3Q$`C!i0V+bg7^z9 zlVgH_D`7qt(b#OUw7vbU91t+Uc+_7ZNmP0WD)RPyepX)Ov9~%8dAi+oRB?*ZXo=k|O9JsoK)qQia zoJgO9G1DyJlwm$!HzminEyJm=%ns(qnx_WiLAa)5Uap~-)yI4Y!aP^QvooV>Vz8@XiB-BV8s0QR<}vvP&j=(hoY@GTntkopjJAR*Qg_w zsb)@yu1jvq#-`gJF0SV!;vV-p6i8nBkP3vR9I9ZzENSRAv+h+Y_mH8IPbnTrZgV0Z ziww5(JimfRNyC&5&zpvb!qC^JL;HzKyUN{HafwZJl2G)6a4#>Gy+6XRpCd~JxE!dH!{3Q;N z-8`ridX)uR6@49>JdFL^rOoW>dMkc;Ayn#rQnb5I2bDQWuP(G6p2i9XSk$FNbEt$S zXSff?Yo{po1(7}?&DZt(t|CH~J6Dm;M9}@iOpA+W{sV@RH23*av)?w)7940c7au`Z z9omqys{@yaBV~zl<86*NUG9m25hsiAoA07DMa)6ZDu{68c>LkDQE-H0(GYQ6q_l0d zm~PCPViYjW8vjYws?6b;Lb3jLiY?o~4Ny}JlI1JVc!LN^3>{koB4s_E+s^@E_iZbg z@4A3c+S)C@0N-!ymAqR{+Jod>@TVIm@pc4VJuDIxt?x(NBAdd1k@LS6>C-ioOZ}sv z?wGBa>IdNur@agNz}2uxH^yJ*7{Ora9bOLVbMm2eemPMG9?L3QCUw37Ufygsu{<9o zWqqDqp$nKNQ@OjsK8-D2T)*vR=+S+u@5&C)cq@qqcDBQkLOO&Ufx+k+xaRRg%z9Z( zp8)=9-I6? z@X_hMmJYMuKC&#s&b{aU9PKO%sxo$hv}+irXc@OBAxy9$m{`@2fUBYYgT-d{KBB2_ zbIyMZ=HBkG<|@q0uv3iA$lU6Kv<_*FkcO(`JNt;@=qF`12eXk5T5F#Vy@9h-WpSh| zj@m~A&i(*W@!x_ca4NBRFDHMlo?JHUpeplpcmWr5Dj`p}(&YYI1{9^SvH$LQ_ZYb` zq+>@M-#7#<7|Im*FYFCit-JI^5f1tnOkUKc-sBTREV=#7LFf6}yeN+hK~1L(^_JI< z5SIIOb%x1qBa(4xdz4`uKhI_~VrX6Ndo*1tIlF2!>Tcud+vGHEDGMPu=UaI059 z@lGurd1(rwsofh@Vrvb|oUvZWOiyAw#G|z2H0+%W8%AJg)dbfYJbIW6*@r7nms?h4 zum*0P1~(4Up;Gm#E9|`wwz^1TS5e~tQ}uVUq_IQ+KF{eYdi5DzLpI2DeNhD$hw4F1Gj?%pwp@R#hqFm3hWrdO-ur52Y^ML=I zK~2pi2?B+)s7VqK=UkK%OHxxcoV=IkyF8KP4W&aAb?5Ai5>_;@sjiceH2ip@fl)<$pM74(UQrkN0$sBAc}q#s z8*lxd|8;cmCVtmtu=5HG(xN7q117a+#K7%<)FAeL7gX!s!-i4X_vOd_{BeVTzTQjP zgLY#C1Kr@@PPQ`D(9YMY&0l1u*q+6gFs<=|k9-*HFdZ$n+cRbD;w0F*3LkkY9N|s` zrgU^SLX^ar4){Ow|LcF1oJUq@Y7K5?aXV4f5`I}ZL$y=W9ir)>$c^%jp`13|+S6g! z>2_Yr3R1{gB>*AnYL?ytb^>E_C}T!9;dL)UkM1mlfqXwNFgO4ld!w%b1gKo2mgoaFZ(NC&eJA(gusLDa}tT zTHZCsDvqbF0{V_k^LJ<9%Y}U|ZUSsOlQ2GsEXSpOs#sYi_WxFzN^rl3AdOL8 z2ookOU5FDtGJ5tGT-(IWS{7yGH0vR4xiDS8qUuj$4!$yxiEoxb^IxO#6~jC{xGxRD z%}$`D_IN-GkP%YnPb$rTZ@G4V@RfqWO(HJ5O)eguUydGv0 zL=ZgGF3JnoKY`evf%ak}rf4bEq-4_-kkFAA{L${R_l= z2wW)&1Pt1GaEv`wKhK`(bc?+3@j8YgsZeU#+iB|Wsj3FR zXry5qOZW>`k;rd372?dlD>jx4g!?^93FE>`1z!3vb;VSry+s}ra@PIek9$U&5eFv& z;VsMx0ZC!RVR!~#ssUSQ*D17~)33)x@FTA%&6Xo!va}(VU6DRvk{vImx2LDsw&jX z0@H?uwbxy|&<~ef<*de2vpET9F3j^oy6qK^zMbo&`${0s5V=R0u!$zQy-W6`y)UgA zb?E=bYicpR?9#+Jo;w9UB)aiU3=9QeU?L0~3v7VZ=#PQ!fI&)WN5)L+_A8NmpCWX7 zLzPxlx`iXN!|rO#Ni1xJZD3u53_OToSRMQTEQCo-m36=a0$IT6gzC;ei*~;msuLTH zpR((-0*CJYbKArjC$ANa^jMcexkWNxBrOR3?DFw6nR;eKJ=FJt&&qF8p9*w&n?+j( zk~PNk(U2=*?2~&1kaf4V*=#V~n<_G~x~m#&E75jb0Fs0c-24!w zZbkL~Sa?NVP`=~GB_7{@Xm6#s_-Tn+Rb}*+<$9)xX^q`aBw8tw9?EoOf4DMrwR;un z>&)>ZX~$R`I;tlM5qZzaw!NKJM>cDJg0-igd2$xIQ13Tr-{9B`7R*p=C1b+Yd+*ty z?_z|Jk(k5Ct&x#T^%->rTbHm zK!Z9UJ!?n2!{!J6(2hVtWh*DTX<-94ST%lvQ?=qHF~fJkkrSknQtF>WL~BFo5!5|X zx@(rTmMNnu3i7oKU1B%j)}p`7`B;CV{Zwk9kfmXsroy>^dbqD(Xs0K4K?6>~mPR8R z|DiW1Gbh5C_sf48`$5B55%@V!y^vu_XG#ZOu?J=gQmv4}*G@v7%v|g8+^SN~4t=gZ z8Z4f9`za79VWg9tsp)aW_XiW{y)G>b)~{4ZSi+Gv^kF)df!u-u|H=3FpPwkvvEwT} zh3^%DJDL~nf77LWK_|&f>3T4q#Wb(T9EyCV^xUS~Xu+WquvAGUL%`IN)^JlkU)4fx zc(@e@YLV#iFV6>rC9@#8H6^6WjZeTK&vbH!Z%D(4>av^}+_l#Hixa$Ird1pW{Nr&1L%2&EHkT z&Ti=ZmJi~R%HB78$$&~!>HR!Qfw^CZ;vNnOV%^5M-YL4UVo6iBji0|w zccjq^@G&msaV{97r^}`=BoU1kA#rLM-aJ|Wrs6}G=z|b;@5*OkfS5=Ism&9n9$PE# zw>l*E5RJmBoOlhq%PN;wqq(f&y_b_Axr>6K=XSwK*0NH2*1Ite zhrp_la2a-`>hOn0P{IHArfg;Z--BFK@Ua-+6IgV>XAZdBS!@~f?m7o!XdPl;wQCAQ%~z_WIIn1Ix>dkqs%4aK)Bj7_DVyL-`YzpAK~?usvW>gpYk(d^_g z4Bl^57hE10k*qcVCKsm7i{f%`k37b9Zaq$uvx}`H7dgQGx{$@aOXRMs_EmB|@Degw z-HJbFw%_&<0`-KkK$TORpIaqIu_wGZeIo&XaC%`5MqJF-%oP<1 z?M#_wI>W)5dN^tf-VJyU+*uFt@t;V8M6 zmWPm`6VM%7L-D2hfrICJp>RD-}DaG;EouiAL;ElshE&3d6 z($~w{hF!B7v=ZZ}*WrZD4hGPk@UdGjcMxwuFIz}M^Y7aU+X0FEdP=~SGvB^Rg{O#< z1@aXVg#;jdjN%IF{_Ve*+npb;55M;kPianv3Gl8eO-#S42rPIlzPa^0OwDzZ!#u)< zN6NvR9OVs-Hk?F2iTW2;2-G5)Ta>>!&A#{1%{6r2`dt93s)B8s_-Rp`s;bB=qG(q< zUl5{u?#Y*pTtNs8Fx4wxjosWVs8Vj~VRy=P!&Yt=Q4RpM7@*~yNlqYm9$!A}!%9K( z{)uF)OiieBPcg*eVreTt-|y}4Vot+l%**e=C}DA|rHN8|GFieF8e;AdbQ=k?<7oDw)O7iX)AM{W|5uLBv?ywX!c^X z4CB2Y3qox9Zfay?X{BxFIG?g*HEY=*gydg~{aCAC;Y|0}_2;hW!D#*rvEt;)@bMtL z`I+xdW6Fu-d>2VTN6u%Cz0j76S`9DIk557d0ggvC6Q0o|h2$4m=p3^pQ~9)(u``#l zV8^paqWph`lq%Dd{%xjuq2ZQW=;V?6^DKn4FTTm$9G`L$%e^88#Owv=GDjgN_Q5t; zC2YRAKGYjo5hrV-WO115A!Wc!FuhSL!~3x_Rvz$@4@+Y@ocqzNjPO3U3(`_z*f*N* zdECo~9zC6r61sSb5m%N(jw{mRO(*QS?;He;R#p*oz|0>#daZd$S)*~_^@)j(&mLoU zk&*EX9L#qB*C?N8ytbV)L$XS8K368t0F%i~$x~9<;xWa4_O`+hQD?4WHFV6>1+xev zH8+m&yB${lVxkj!0d;M&l2P1l2zDh>znbca50=b%)N;>dc}_s1u4fE_g$4aXgcl@v zsi%J=c2{N*)iW?cTVH$xOGU$JAOe!(Y6g$rF!mRZ#*AJ<^I3X2RXV|z)n`4cGVbsQ zD08q88j?-S42H6yzn{&=9K7y1cXj;cJ7V&$)wXvnhBy-d+i^;V18tco_-Z3A;<%g` z0sx*{@Nb(k+-qU$>*@UNM7&Cf1i%o;Wo)Fbnl`p*)xT}yZ(Xg{`N#$~C1lB4aeu$# zRxv7*M@Bi3fW_V2p(Tac1xZgE>o0EEhC@!=k} z_fX~@@GG4H$>=J$n~5kTL(d}!;-_#iiK|=LE~(_{9b2bwvhJsAq5UAEvIiQS?cg17Tc5zZg9(&Jj0Nv=mNCaQ!YlwPXwk&8J%mJzll^1> zcSabjgPrB&MqxK{pAL3a_sTX`Bo_P;C#poGuvkGxl*c=qqvVO%+k0ebgrCR>Z};$6 z5LTZi@N^7z%bi6%=af{Vgb1~q|J%A^UWW}4U6uyc?DRgJX1&B@?E~PgKTfpo7TxaF z04HK}3gBpROl@KnhidR8pEDhjJENrWf#0a@uceI{AaVnd@HAj>zN+7p^t@iK8*Gbh~gbwxbeh_A$A~8KeLOUq(z?tawAqz{#+$v?7mDHV<03yF>#C(D?+&bB>{QC*E@OI(cJ-G6}5`XhBU%~D+zjt31!bwco`j9VlT5pjrE--FG?qtA{$J|*>g)W0TFvyh1yV( z7e&+`&zSZsX}Uuq+%_@$9_Umg4Ji16y@DC^3+5Nf2>|b}+1nu=Z@P zTlDkiC3TFW^rzUAc*u9bNNi&EEVV&d_S3E#Rqfx=Sz~qsWz*2jwp))Hc!+oh6hFh% z9BJ4UCCYXcBz^5^DzyaCJH2|ct^`qqD;uysZM>kz89=LbQA?;=*R{u}{7TQMoaQby zQ9A`eLwp}D7F{o>>CSBir&{d?IpluB0WFv0!HF!iv9*5+;-7*x?wfYJoj2cJft8yp z#8@C|(#N)f=Au$_O0PFs_G`o|Q%=f67oQyKP4dyOHLAn@cQh(W=!KRqq*I@J-pG-*NZYVApFyw^%y$2hpygiz_~r`D%=y|?(gzkKT0_Q<>YLbd$B@obksZgHTnvyUY?J~2gOh&{l61ZJ@FVG8I1FbP00Ipq~kxbN1RZX zGG(4Zfg#b7(t%2oXrjS($Ux5iPQ|CPcb~}RL9yBu_WB_|5nRS%+5vwLpPrchI8$tY zx{Fl-HZwt9sd&FGU{A~GCkc!JErNYNua6!#c{TgagT?s8RQ*uwG10Y(O*i&`4!$+r zsGeTAJOEKZuD|pv(wA1yD9d0c&nIY#p}(J_MM^|*;mpGdAA|P6xgC;!8lY}4@E`=i(9VoQok1ZmZX8mfY=C>Ib?7dXN z%(t{_5Z$%oJGXbgW@UnE#tkOs=;4;+3q0fU`__?Nwg?qx5c>Gsa)ioADRr1)Fhi;F z-dMG6XH#Mg2B?=c1OhZa*LOJWQ8IjQC6oj(rTp=*Wp@_ru=#DTymf9VL?DJXz9Qh^ z#0-}ZMLq_@?xi1>$KKoV1>?6Q#ihzlj-Et*n6W(Rrsbvx%Lv!@I5(t5(cDvSY(L7O zn|!83)Ce=u_%hN@V08~k@o-XB7F#|v4&;=>sni^vq!7-*Xib`Y(X zg_tkmKd~LaO{5D{ei;@DadbERXCsEPJ03}rk{e%TR(5TdJCVRze(_uBgSlrf;SA5| zQ6@zL24keM2H=jPzx8|>-~Ko#n4u#UX~dr(swf!9rzj4A~ zn7P1iiY$HXF{SDnvE;%w%kcC+9RmT)tk9hb8URj@P-)|s_H+TAc$ zVHNC;jK|vi^$LdAYY%P-xKJwUQG_#kmkd^6EZKv(u~RW}AbEv<+_?Vwn$&7M$INvg zx}3Qh|D3-4hqTw|ULtB6ky2_{y!7787&i{}B9YQh2$5nOx1fGzm)f8_$mrZ*q-2W< zLy!!3*_Mj17Y{NQ5rS!*e5w7L|L~&yh?d^8jaUZzmTwNQN-OOZr~9AsFvQLRO@p{y z5Ma2x1)|jPu0~e5tY~>bknVZfI+1$z+vDnyNOwx3tDKohAIZ(s@E`W7I_A=R*DoSl`(lw-k}Ah)MQ*1CkN6W@v1bDk86@ zu_-F9-Kb^csW|{1$`_fs*76`BzZ$E`e3ByWJPgKT%!dBJkE|F@E2S<*SBk&f(b6ni z;+BERLA4h+N~F>btX=6uV;i`E)@dA>#oOH&!EGpgHd2DB8V~`U@p}nrRT4^6cB_p{Tx6q{pH?6R`NAOc&}x5u68s=iUH_7= zPJfRt&~pYO3Ck~o$2k2`R58Jh^RN$FSA&RgB9 zl_u$MA@3I5Hi_k)uf-?~(`RJ7`xqA$9;df*J^c_|qQSpnc`K*6A9Lmr*t~RXMV0TO z+K|Hl0K3O1HiFb%ToLMg_IYOilXpo4$-#|W_W!y0&9ec6gF`K$kaNj0uG`S_VPkRz z-XVKCE$q`B{=IJ4<2m4=pJ%VDdAwQqr{5@b>NIO5-bot=l^I8dMtf*5aO|7~w#fi! z5KF}6@n=8OJl08=aU=f+ZUF%Z2tA6Sao;5x?_h>)9NCa5mGVrM(--KLG9`>n#ElV)< zPZAluWhHPk;cpn<7wn^eQEt04rKnhyJgbJ$Grm;>j35pC8mXPJ7D84a%%*dog+0F> z-~mz6*DjsdJn94an!gzr1evdk{G5j0Sa|$Y4Xh?7FD|^@O4VDCH%T^QFBpmYtEllE$1zX)m4;flwl-6!V*qK9kpt0X*idLxm zE>ceVA?#ul^^n_)0;m5eBDg?@SlUkgtLvgb&iq(LH$MbUHg-fj{8YGaOJ-_Hc#kuN z2jo1p4~8xwenid~ci_y|f61)3E0nd7%`E!In7yzng?G<_*{*goG{BuYyeGVuCG_z_ zQ>^yh^&h5c)#DK|Nk&^%Xb0N^t->`Hj{(ez(hO^|Vsn|bbn#0rypHX_RaQW*B=UYA zx}C()Y16tPgZ0F}c$Rdb*o-y0pP&!5YO-=t`T}vgd11Y&?jn4}tZPzdtHjccCLAlT z45ZGr5t&UQX=vcaK7>8%t;t)pw7LeH3bIs*@~~e)w2L7zDU?zkr^LdSxpbAIF#7^` z0Z%dmG>=g&5Ml1cFNs1tzU^kFdJx72ezHCC$t_bJFt) z{glF-ONBU%vim9Bkixf*EK;H}UZD?SI9U2dPKQg+#p(R=mtx(L(m{KoDz0u#yzfI8 zZoB0MMN^>w@AXTqy`?O73O58ImFs)KJRk~0-=ZVQ{Dt#dn-4%LvxyMd0v?|fq~fH$_qu327JULQK;YinNH zj?#zslzR~lOQxSm#%RYF~Ux9@X=#tJ8Yyl`I*F2`9FVd42j4=Or^ z_t`-o~h|Ph2sR#}OTgaD~-xt5_dDc13;}&}_j$ zsbmUywcwt-PY?{O{8X*axX}HZ?dntozfY097D`vC+BmsD4P$77ee4|Of1Kanb;XVSZKQPMYZ{6A^pKLM0F_ahEnBSeD7I5nU86BS1d z7^?y~ZnAtS5t>>7EwT{mowqkj@+)>C_pgdy9c!`^o`m(hZmniq8(k8x;YgH&pe9t( z{XC6SS<%C9GKMMOGCu`|qJNXvw*qLh z7OD)>P3)Rx27GiiZ{Ca9+j$BVgv4XILZUn=$YtCHUw7c!p z{jmE=Oe!)hfz9u9JZhQ@l~^UvI<$n3rSGkg*DbDLubn>wsH>!A)N?w74NPjvy$n3u z9XIOcT7MP3oyX3-MwinE8G^4^IXRVGOO6}q@%E{+{N~_jEW7&Io55-GT90SdoDm)Z zARzur$%|qan)*k7qKm;h0(dz8&f!!*KPOzB-BvhA>N&okc0+>ibWq>gOv*<_e#QUJ zX5Z^uZbf$)tN|Y&p{)U5hdw&cgA*51K>j9~Li$vwf_bMz(4JXjckFNu&AG7v06_o0 z!s0oTx6##SpRilmP>UDryn|#lszX0aj8=noqH-|j=%0u+j*Ss9j#6MbBb_>(1(>xe$X?dHBy~f*tD4hR?&4@aXh_i-eX2F63At zm_i!2j9oAlgXkC3xOk&ZJ9pK5?!4`@MJe%RtNP{N2{%Ht!3|J)22ySf3RL5c8rRe7eQ zW_w27tgf-%;U0}*!Pe_JFC9=PQ_1SK(~+Cq!Dx)O;a;EWzL<#XsCV{hWUHC;dI~0Xfj`)prU7g06bO*9b{0CzGz*a? z>Fnja*4*%^{qpI|p`Cv+4GJof|HL@>o-uewzdt8&;d(Pjk?4*ZX3wEv!eTIdX*D5d zo2MLd2G}T+Zf)=)g|uvm=q@_N+~ea6in<(EhVNBsBw1c=N4TxU5dXd{lL`J80~Sq6 zniV*dI2c8z&*T=c*7Vw$OxTg4@k%(kyl~y^8r2zqfBfxTbMvcLc!}; zSpOeOU-2m}es&dB7o6u+2_g!j*uU9CNvR~)PZ9*87#!SGz#=C+>mLHHvoo@ygd=vw zE0j~Nd+xh|WQsrFb!#luV690E_+?}ogU7kq0bAa%cAFdxi7nL$$EmvtR9w_szr0=m zDGM+eb7uWN+teG>z$e~GkY8noJj6rLNp@s8h}RDMCsMJE&?hN`<4L&;ElzWlSEvV| z;agg^yrF;nOPo!83|vf0LU6+h!HE*JMg%-oCB~0QeLL~Z{J5rOvBIOLn3E3M&CcI{ zXkO~_g<+4@BeY*H_;^PZSuM&n5A~6BJ2K(VR2%f2+aO-}aS)?1@wk|cc5u#2?bCs4 z)s1ssjAnd?bNV2@&ALH|M#DJ3*$8a2{qh@5A53bB zgwzKw^agW1990BrrHZ?%ij9v2%wq)L#&2u*Bv!kfspU+poxc5WogbLQ{M$T5=ez1r zwpQRQvUeMRn?t9vnm~`+Em3+l0Ubs1jCz2jn-@@k7#9ys$ zoTTj4efBGxlUB{6#rlFdMk!ZA2;$*BfIE%|<;DI57q8&(w_7wbS^AT|YO`#-nPN07 z@;hSk97qSrU<0M$W{re4$N9!PsqPO*|NpI(A+-`?eGd%@V^L&jw3X8(@H=h9-Hd<@ zJJL(wXUolfF1=w(3^E`6(lPC*s+jbJA-o6_FT1}1x+Gp)^K$J4?DNr^uw#l8(VniG z&P{B#dU&24%^px@CUA5sLu$v@>7vi`37Ua`1h`sHE)X@cu*N`_rD`NvYnR8sBv6fI zAtlba8T>#9&;1<4Fw_QctcpB8{KM#bF_!x{7iM!ZdXw;ix$z{$WDBVzN=K~w@m1Henq*@OE)$*_?jg`{Tnr`WI3w3D zY9LwfaI%iH74C0v&~+J|LZ=t4nW_z=hduFo4*Fu6AY>P02f~CCvRQ#uso-W1=oKUQogp}9!JjodEXXa0dNdQS^<^_KAXg{SaZZU z*76$)EV(L{wTUe=-=tq88+i`4pX^4{CrZI4l$Al%vxIbFN5xIF;^*7L!+SF-ziIYf z-2SA2k@Kh~f`Szbv{P*HZCEce@9$Xj0pg|pH zMgPk|NyHdvet))a+q`ox$C^fr3sF`X)4TaoSY@i#x)+SbvJ6n^3Sl3=AXhVLoAl!PlJAhcd1GzeqK=769lCoikO zQbcAcGA@yp0vtQEZZk<+U~d$YWet}B`}sn2wjuYzUB8hl^|4Ok)+AR!dduCmmW%vC z86kf`GCgUV?%J0{CUFfC@F0Ig4@}b2G?T~W=YwJs3w_4q(ymi3(HMcyf%d?duN|_A z%hTQ+Q*n|GON@MuW%lC2T2G8w4>exoLr|-?-TY?xv72ifuP%k=K1`z2RY$pIW_zQu z)ryXY4*O26^f}VjIq%@^5A&2qr!pj(u!0C@06*rHc7zICw{*c|UVOR>E^j8oATE`` z@QhVTMJDF+Rd~JB+Xub>VNu?H+g5XHoTRXFr_hs49XgVD-gjl_2SJj-yJ>kKL#rV! zZQn!db4d~(Q*{CD&h!NZE5|BjDd^8z@WETysI0r=tSJhRc`sX%6!OO{bQKQ61v*2N|K5o{H_{o>CScFVjqy9ym#aE=9FVPyX8_KB;bfU^}ON+AYyTt)JLoFuuD8SE4<>O{#RFjU zM**X0vY2&SkV^SsN!G;Ms{{;39x-+LqQ&}V3`&!r>Q?zl)W^&$<=m@bjtuiJwVyVj z1*^8aN^O_t8RhMg~Ksd|gPm)?4n$CcTJ-aL&JjzwuF)F-IpsUDz} zbn%P6JO88hBY4@p!bCcgwWf!BWzpExLn^Y!Wrl+W_cMq)z$~*nBco>(NeKeG5eVZq znww{iW5bL8A*Q}NrdPpMDgxUiP)bi=NdwQiRUBmg3|O?ViILU3yoKhLGKn9cNYQSm z1BQz7U&C5gila(lkQlNJ$CSA~K#Ltz&`jql)rF^%2M}1qiWmw>Fo%;4&&QRY(Lb98 zGgST+LRC<$~+2>~Pz0DH4# zMM7g0_)v>aD02fkG35WqFR1s@%cO}gJ8jE&-~ z-97OHKX*%yIeh`QaZ7vQZ`3FnSC&oUg!W_*yAQnJ8SRpuU=?`LFu+qwl*&t5M2o4~ zF9>jyC0CFBi5IQGa#l-VH-?b`XD9E6A13+y76K; z&*Le$s%1lpNVTv@A>2 z91!p+Ym^lPJkv#UDYIaQliR;wPTx(t-m+I`6b%btW7Woig4PV?OhXd_bXFj1At>hJ z3&DEB2w;NXPrn{N@Tsyc48PU`9SznTHnp-8Rw2UR9{=u&aIQZd<*WrpYk@M(P`iR= zGLuI4?spuTFEL=E349dUf$141F=E;9>1hX8O7kUdG60<&OO{sq5Y) zL%-*>7WHCgT?-SM)Ql^S=8-eYpm0b&B7NlZb;(JBP|1)4GOL+x@$d^^fHfsWi0Og` z;k$(qK==;58G7A#`NBrzwI}J|%0Dnss&VQ&c=!!2S<{E(rJgf5VcUx5E=JYf&=tZ*Q~@`cZo$du=x1mCak zCepkIaKT8{ht|I8m1@qSNUTOiv2<{jY$jNBorKrf7n(-t*FE0-e)QOW_>Ua5`{~5W zx>8>k?sa_~P!^vS9srBMFROE9hI6Tu5#hMOj7fTxB(xUb)m72Ynu< zX+oX)>;l}x8Ec%eUZb>aw5BDfQIQ6y>{0tJo{HcOxO&93u&|(*|oLK>f`&5pnrG=@A?EWdhbH<>*W}3zL z?xf2JM0EZ#^+M|KrtEa;6kJ15`Z`D+pe|W1+d3KkAC)EUCo7q>;n3zYk)f|JposuH z6EPTYkU~`o$;AvqrS8^{2d>17+~fzlVQ|q9+af^S0((?lyiAkkRYbrx}cdA#0u-wR>iF(1o-jlWv45n_!SPos5)~l{@h* zR$EhGE#-fJaaN~pW_BN{4Z8ad&md@YE147Fs58m-ywmhX0Rn|5^dOg`y1Yj)NbO+e z%D;AuENVkC{g4Ee!a~c+#53X3Ba)%s2{_IGle6uDj{D9`nhVqA)gj{>Gw1RcVWLypbE;}=`SkBSK%)SFg6-yJ(bnmc*pm9+ z`J8(DE61mEXDjV?u~MqfG=!mTR)z1&yrahRT8ISI*ztS#5pSSGr4M%P*O=qlxEsgj zi3k}V_~SA%r95$;5#CTKuvC6KUhDU(sGv2L$HnSkz&FZaRhF!@&?%Z4Kc4mVJ?+JO zES+cgO@eMJn*3kf0zzT0ex2;U} zR<%U*a?KME>J22psWv+{@^1MGXUzgNUlXOn+bi{-LG8LKv62853_EXju zuWagHeLQl7h9n>gdgo~}W_>ghU}DE;GTt;WHpq^*6K3(wUwS(JV%BoD8-PQKJ`)w> z9D4|G3vRRi2azKoS4hUGqo~IjiHb=QC5X}yrKp|`r*ZzTi0-ExJ0~Z8d6MmSbY;Cp zK_%IXA#E1ay|g}X744O%FSnw$WmcW# zfuIFj&H&W8C|bdqbjH^w-F&|24M+Te1#3@e$IM;TW`i_xHLE#f8E3u!6+|EyDzCg) zl-n3kRS{~$9q!`bb#w8dgY?Tlmh^W;VT&4!4E)l53mzEKm8DEu)}26$z)|Qe*-tdNw6Nbb}n>8ns3lqrimUNee3BaH- z{=?&vF6dOf!XxWT0`*!84Omb`=K<6g0NV}JE}-5x^sye$@S|%X485*|enK`+E=H~+ zk+}w}hJPu_`{~}>kp6GH+dN1;ZU$&cyF-ng#9u|rcPQXB(X=J9MQyZ+QzkQ*gGHV7 zt@)=}wr;2;rSIzJsqS%PL!t~~sx5t8&phQtz`Iw+v&4G4=2+*rpEjx<&*_GalyOQrU!#+lH z^E(N@A}gE^aGDklOQ#x^n73L$27&afrsk{i+J_in%fV;8FK-4RuXC8;KYAB`M9UrB zV6!Y(Ac_QZR+}bKVXy~KQ-d)=S+g_x{=BV!nVW|3s)g~pzzmU%8V`@3{$eXNuFQ-H z<0+QWzJDdw1Mo~!ty@-RXquzM2XWp>g1h&cE0)ht_5k+_C*Ae-#mK!Xq6RENKcM)` z9c0hEw8UfHYtyu0-@S8CG{Yc826LP6`=%@Gk}|0uPaZgUD$;x%iTQB6?+JI)YF43( zOCuYxFYJWnS;ZhDygv#<9H0xv zxZX|J%uG+O2ZwDttCg#vYEYkiHMV8l;|ArkLSIegKKg9m8CcQw#*`e+Fp$&hqkQE* zSD7v%3Y0JYITq&n(6#xrh+(9t!??FnuaLpu8F&OMaRdV|W4=K3f;$^)-fbR+hl0Z~ zmmuBU&S7Mk_P)RDH&ly~DcZ$*O~tRcPD@HFH8AxVo-)`j!5RM1VX&$NSQXh0PRdRY zgXZQ}=#3M!Z-rU%gUC0kqUFeU27)17gji>r%$)oiC@-wYmXRh#LMv!juz4P_o02T+ zX8_bDeac0bRq84raC{&XI6ys5^*SF4Hj!$UAj-5v~X3x@6P_ z`uQDno=TpxujvN1=$UDXbmx9>X-mA$U15|PM?pAWF3&6B&7+uc_X%bGUt&w1 zk%%>-W&$0_lMES9OOR z7JiD6c%fwrTRK2;p(97%ImFj zg}mXBs&}bu0%mGuV{A}jgM;rDPa*v%j#6e@Z;!r>7rE7$_c_tLqC?jTfa*f{I8&7e zZ?}BG7Kq5VS>AS0FOtwe{n;(bo{cE3NWlu=cANqW#nJhLkcOn|Tx4bVm^j7G?{CA1 zwl9i6RZ>R=brwdP|2$}y!}|~sd%6V7t-8<{`5J89Avg4z7kU$Djc1a@=uuLUvSWvW;ECT!#3uY-isjKx!);ybUFN zo*caxh1zGBw}0$D8mEoj1MNSTh-+BT-+cTA6+-{e?Uxt;~K0 zGJ7OiYfEuX%8SGUCUyd74WS9(E~J8p1zN<*F`ZW04FCkZ2g)Dco*8?<6K0fgs4hqlkUV92PXc8@y5Ep#62@XO~ml1ZQ%wMEy-Of z^-9LljF?sEjnFY)#|6>K(sJg|%VK$~U|Ez|NS=`wr=YA#H9o9LjbMP>a^n>VD!t5_L@hO|iSPN}?Gm!-+YDm7U2&F1y^{y(A@hv~7 z{}+

$iaPOO7JplylOeDMx(n3bYy@oxfD_-jSvo!Su!7|#OnXT#0J zSTTyn1~;d}B{eZBm!!gVa{{h+m~h>Yt@xj#)OFm1!{KbU9(_0X^PGQE6ty}Nq4TD+0tkp(L|J|PTq%=5xK{^O%mX5S-D z;rE-Tt1Zpv{{Ejuw(pNn`FIlv|Hy=s1$)F*#L;J)L3`T#+sSH?^%-~l)8^UO z=dz#oAu})Fsn4mL^sVO#wa)w&pV_~wGI1v=Ni5!>-i&v!p@fcDF6O`2p^%;g|ftMfYz$}h|z#Df=rAfl9;p? z5TP}xF83m090O>5a0F;yy$ae9)WuAn0Dgx*11Rmbx_s@Xy*oaRu$&m&2LXDe0Ihe7 z0PXLu^0?qREBN;~4zA_v#ASyagSBEh!_PUVSB-+GYr)4cV|E= z%N^_zR4Z=~Wu`hNqvtIMqyg)t?aG3Er#_gb{+`lchvd>r)`5ny$4@rccw4ui)~rnM zwwE@Tvau<9ly9WL5dhAUlAw0%5!9$jt8e%@$L9_y&zDR)a`j8r^Zw8A`uHZzLOE@7 zA*Wg2qE!Cbe6Fu`+(QgeO4vj;2+1}PE3Vd?NsJDmY)b0;sDHoy2)CW0K8)WurdO@}0jK`^VTl}HaXIgk z&+6HL;xAZe_VE6=xoGhIL%(UM`iCa!@;eqxdg+60}@XcDL7bL0k%mqAJ9iR~y{lt)~O5>68Th-6Lgc8o(L{z?v;Y zQddDa%L~6e9h^b|33~-7WxhucRp#TCK;8W(NgJq+$#HWZ;-Af$q9#qoeLx8@ti7Z? z30mMvVr0LH`yfWv8$7qrTKAkk^E!-YSA%mvTqq#nkN~AMBI{X^^YcGR8q19X7Ee~X zvt0V0sEtJ1R15}?%s6$k2W1|x7Q zF$h5GCzP^08qvk-cliIZjO9Txx}RD%)my;uw+;8MnEy9qD1IRewxiy?b2W<oYJXgWKu6cX1msq|X0lV*bhI{JUI=KT4_V zr;K0ZvipeVL6*gWcuvhX13Sa(DGefhZ@v|b1Ex(?xQiG_I}p|io+~?J#s3FNT^-FS zbBB2hUF@ec2xn;NpHu$6;g^ZEi6I)?E~wzsi+lc%FzwEJzvKW;Vevl0@Ztyu))&D3@NiuYZ?^$Rxp zT#!=N9FZ6`R}!PDObIjFq?E8tRv)MGv8AyfgG(kccAdIq3hL`!=G{bEC zo1Ot}5s`$i4$|OR33Lg-`6%9h2ed5`NedYYZ2@Vt4nv_WKOI^lMI`LbgxdO{AR}J8 z!P&DRo#lQQZ}ib%-K{A1@|>qdmvjHX@A_yE=U;R=7{3||tx;*Te*I5rFftBGC#USG zexl;Pm-Y4_;awsLR{$*NI74L|QyGr38_Rj(J#heJZ}ytCo=K5)%6OQ9v;|B$2IDGJ z@gl`Pdj)8tKxs!Eyfp(_6?6TS8Hx2*^4t~UadZ8M7c1?1F=!i(5xJa%7vB#p#0@2O zzKC~X;{}TU)hCdrfDt$!+Hkz1KTqD9a3PPA8l7?{G(4A-wahi=f8zvg+l6ZvptZh; z7(yDyhp|o;N3^|aQMoFVDPg>~FFpZU-IaXJ0SB}lm-2N5?{gZoDIy6g4k)P;1SW4a zpv($Nd)1e&9?uLS^G)sWB0IhL(1G8g`EE3`$c^;h-*aJxk%)+ z2-p4Wb;Nl070@DL#eu-hU_=4ho=M%qC{AAkmm?n}Qwz*{7S4i_{OgIacnGvLqph9HeaJl94Wkr)Pan#i`TD13 zA15({^NOsGQ~vjfaT1_yO6pi+75`#NUCVAJ#>WEBBOX5lH0N^C^fUAKf=tjH%Slu8 z0b*223BOu?Tfw2pEl-lfP85=Q+S@dSXZ z4P4Ie7wSEMzf7HidocYdemwiCGc?G2xc@)O?(tVIrp)mz#ea#3cL5Qm;`eW4fVOT3 zXeje~A@q=?F`~>HuIbN617~o&s;f9OW*9HuFs@2{h;LVbxV?tdJ*oW zrEbBa{0QYeErlY-fJ7r&64}l zQRn75W_$0W?`-|3m%4DyL;TLMm?eDYcfHg#9`!9sU1_Gi_{&)GT1qk#eKJ|yA71mx zH$TSWF5A9sKf`QE?RY0~hPS+!%o9U^wHMH2x3TCuy5|gqH58A0Qbj*10s}G0Mw2vsD1>7fn1RdwVq)-?|(sz z2LJIw@;Zh6iFM|hIPEP^{J-WgJvX>Zpf*zkIdDy&>@I+8#q8G@xQ;MATtV6HIxwmn zFftv$8Tc+S6fmEE7YwfhMru`{BJU0Oi4mfd|IH5u>g32r!FqNx7{^UM8|X8i-3kWk zfq^@T5$QFb-3bPhE9VfyV?CP#2J(r(-NaC0=CixOV0?Q%F`{S9XY;}MD?YoQ7{q#Z zKNuh5vxkTgI%7V22#j`owwM@TJzES0%5;H8h!HT%XODpK9zI(^jL2#8*$OcB@LaG` zT({>qZJnJ7wH?Q({P2}vJPf=x$|Jwvb-Aud0}YN)Chv`khyZafXM=YDhK}wHwQ+mX1)3`|jXYZpsTcRVCb_j%y;@w&Q9Mdt{q9b5C zK)!nAb2KS$Npipqowv9ztpjnvdjN8=18(qmz&AT4)xyQeb%?wkVp#U+YyE323mtijOq-IyEiT4b;7`;3w9lPZV@r8-d_QzIDohk*htC&;L^ZGC_k3c z(~;>y*&GLvx76J!Xn`Cs0y)I6+az$_rHc_RZzrwS%6B;-rN#U1o|YV}mWd$=`W^?K zoupT0DE^{{SxvY$yr1hAv-+%hNF>IqxE~2xt=in)M|j-$h9M-Zn>7R?B9ycOwBh@I zqg)pDh|s!aU3E*hRLJOMmsFq|W0@`17q7=<`U`p={q5EV?i8H4kiWN!*Gz5iFn!`M zXwAg8`=3p=z2CLK=%-+-IYWk#FdYkqB0(w1t}UZMEvu99YKcz?ReuA>rAS22V)fQ(~0C z3eR(`39IN?+B#Rq=O71^PQH&H6*Vw6&A*$3oqjukl9$>IQ8* zw#}&*mnr`DSAzCkb3WGpZ`=g6vP|)Jn>}aoyYg+IS>Nm~Q~bYL2^!vsp1XLh$*3u3 z<38UI!Qe9XZ?|4ETX0S_$435zW5clV>V|T~{~@D`;EVG5N#P0@yPzIGu3kl2jz|)t zQ>i)eRxQ}%`{1x>fbY31*v|UyE%}zpdYVY-dQ8gD4`!sdu=_Hb-xtKu&--Zb49a&R zF_9M3>oJ7aqU&BLG@aC(6I69#p`KsmnUII!!y~v zp4k}_cP}+QCL82C7R7>8gxXgGkpHzVdHhOmV*G-XGsioEIMSL0ZF!*hyCqQ-GnDqI z6WOD4*B^*y*P1*kjUt<5CtfS1{ch$qZF3}=@ zw&R(wUCS?57X!4N%!KU+^2^oFquGR2fD>_f%~D>A z*>jSzyb@QEqMvl`G+$+kixKG^U@8kES zP+x4$695jw?UcH9icpI%QihN-yG~LWzh5#?eMF`&eHgE!eJC4_9I|pbhJtYzh;eu- z&*eBIrR%1Spj$dZrzH4Tj8rZd(UqVgU$}_#GaczI0cicN+XcpXTVO*f=;Ubo_V-0%A8R?wms0PFjENGjAnlM3{M zl1oQD#MIq=(P}}Z)4&j{bx-5#zTLj=0eb2^u`m`)lF{S5^@Dhx8t&mAy$QbHzEf~| zlK4WhoU(E&Xn*fzHq+J)o8RWjI|OI{9@M|?C#P_JBKdZS&{_;QYRBaX+%H^b>aIoHZu`nQoBzUAhXHjw-a|gmXX$R&_9bl74RZzUsOgLO%FHdr zb^MPhlX=13V-NJd-o|)Ds|dujE9L6m>)opNukP zmjEU2-p2Rckp)M*oAcC#rmY$Iof*Ht&P+0Wny53qLaFO5^E>8;8a6>aYSyd7J={A- zV6qDlq3uOGEbkIj@0AHyzWaPKEPuFeU|&#;NQ}$p3h~;bm(3Nl*9B;MJZ0<-+t{x@ zpRAuAw)sx1+|Pr(iSsyruAp_8=MkmURcz*k*!AVyEZA32>fZwt8NtmD%V-Vmvih&`xnXZrhFay?i35yJjf86CI69}#0ZKc<^wTF*-iHOB-GI+bS~mH%bJH^UAs&0d@A?P*>Zu=- z1fNxN@I>6U1Ntp5gSK=rKZ_vax%qngVqV9`svG&pzdG>6reHisMTb$5H*d79CtJ^rD+)g(ZZXBU@NT7FSalcvg zp;)l)N}>D|r7mG4Z1;plsNT?b%ULXRcJsOj>qR*7kG+pVN}pK=p5;EU)sr&yBp>o1 z-U~rw=ekFNHW&%pb3-Fk2z|F4>De)x;UjeBVLI z$@*({m_Eis=ZjiII6Z~;(aF;r&KEUn{?3c4lKYuSAa~ZH&ME1KP z1Vw4*HP;Ju?S9a{pw#sl>!;xK@m!BW-HO$~xij3N=INtTI=C*G)5&n0#Op}e^+~#N zq{?fIwvJ*L8oL{BuC#8(I{&PkWbuLRwdQ5Wo4n6^4#?K!x zd#3~;T;ec$xlAR-BoVYak=H>Hc)si!@1jX6yf;a$8mjo~mjKct)?cOHJIg1lbB6M` z@ka${{nJhwJUv%bnLZ=1-bKt$_StS4Wc`UUmG+tULjwK}q|_@L2697fEU46xrb7Jo zYA~$clO5AI&%r(1^9~JqdTB{mg3`{b5ubVe?~ixVU?4_Ieknm)X9Y1V9jGWmgQ2su zWIB%d1PQxg^nz<7kQb&yNoSCRd5pT?n+?K(4GxeOio&dq)1jmzi0=vuHl%@Eo&h62 zrPPJ*TjRdHlLjHi{YE^$$H{stwVBT&_}sSc@^@%3aEg}L$Iy4uVB{n%v9I@^J82MQ z-WM`p!>Rh$(l z+no=rp2?|n0I5J$zo_+6%JvZzbA8GQT8iiYn#6J8*}-~1+57=4$H9u*Gi#jL@A9!O zfz`e|z6V(BFuTk5a2ky`)A72X!X#f(yxzTQc%AjsxNf{dFPxykIIi5&pXQ!=(4@IZ zbtiw>QUUPQi~@4T`qo}cE6E;X_FM_2fqY65RHU0$jR8sIJgea&-Xn;`>p4I^F;+19 z2<64!UG`BdIA;ZEY8LZYA2UT18+XQQ|L66z0LURxWc>gvpI}`T)P6|0uK~||>w~di zQx1d^v?--;9f17ygRCb;&MC8>&xzDC85|?`P(1G;&pN8p3FFH zj@z#GfNIT;=X+Sn)lbYd`+U0up39L5M>@ueD*QA{rFFw6)4CCpY2A5~X;hAQ_5$K+#O6EIJN#ZpX?X~QxMU}nx-Za%{GT+-Yz~xt?LUq`hez<3!DAmc7Y$Db zIeIlQlynG3tBIkEfN*pcF_a+??p#2^(K-^I4N%+p0Ma4w0Svtqvg_C3GhVl5`40SD z83IOhAqgu0CCU(D06esVJzHXbHlICH?qv4iR{rch{@$bZ_m=Qyl2iZj2^vH`;*I*$ z??1!*KIV7x_&e4ea8>rZ^JgB21(SGaE-~mHvktU_n01R__4phj;d z#>Cr+@v;c5bq@IIpp@&Io87#wTgubtlFJ&IodGHiFnz3=gdw~6){cq9*lo*!u90l< zzBYU6O#-w|l!<}k;+Qyg>bPH0>KgZh#5?$0frmkWpF$qIdp4Y5Zwn*=0!N-8tgyYWyJ{Zf!S`4kHmL!fyargJVApVN=sQiu59yc zGWj@gG5=q{LTNDi z0P}-?kL3bQvvTZUn{Zzu*G@iSFemrav*t|gsdr4`y_{a+z5pigO%g#q*#&B6ymwfx?%d1y zVY3JeyaLGGW?lEx-g7@XO@joWl*!%JeNL&1uK>vD5AZ%urv~Xw$7PPzmekxz`}yO! z+3m%6ejO`Ky6U_jN#3BBfid@M&UEW=(A*BFwO|#UOTqxnMX9!7yh{h}x62@jy0D_i zdj0jw2|d@kl{uhVYqzgCdKnlb6Sl((!_<@7x!1nT%u!}Ff6euyJ~q(WUmjrXl_~W{ zkJ&Bq&$5z<+fO>?_yjpxcCAUR$ZW0WhwrL7J>Hvr|sS2qpHsR;b-qXxeyRS zGGs!aWD+=3M?@|OAR<`_6sS@!+wDF_WYMn^}qF489sk*R?$UKfxCZr=-w*d@Ii}Na;;S>-&P%ST2w8iGG-VFDd_rbfRo%qWi^8 z=ik1CPV*G${QFI5=!}B)UFc0&4_BfHTMt_u>){57w6VB6Nh^NnA?38AUK0Dp98z4ga^38)Mr@3YXi;*ge-GCwuS3<<1-O^j9qy6@Dv}ao~ zLdYp2>`ajntnp^?(opxMB4VHBA*?DQo@|Gt9ZBH5v-QqmsO|lGuj%CLs8GzsSrP;q zw)1oU!iSh#P)7Hwx)LIk2ATOsGdUn_Y(DMp{B->VtG`K~_dY9+f}U9ylpye;0)gUQ zsPkq*V6_B+;@g1XVHWF9NAH8hZm6qfKDyR<%VoFX`$XQ`$K^Ve{%(@kFMTinDA!Zo zah&z<5S2sL=4~s=|3%#RiV#onw4A!A0)Z*Cz0-5*fYLBU{63vo*BmE-;!tK?Cw+Hb zPMs=4;2la!Sx(){Wvbs>uKL%?YSI5vc@gDYQal3cmc&WmJ%!_KzU)%{@6%sU{T=kT zO!e;}#51#;V|~3`&h6AxR<*_mf&weJ4B>X0zrlYIV)Wn9{`^@-!A2oZZ_udo4bAX?REN_d=!IIp(q)qIS|>0yDP~VSd@~yM5c0lYrYcnBPP{F`6^lm@jJwAx5kbW)y?8%G*!)S}A1s8G+*QP^ZR8 zAXdRK^*-q*#wUb$?EbV=W-M{RX!<+BVMWroT*%V1y?23} z7OQ{jqn55AJy!pyL&QJ|&+FE-1@x#4Wznk;rfcw6HuM~waVCqgm-AHrxp(j!Zfz2T z=sSm%9G3U={w<&%UYxA+L=Q0#!%ZzPYx24M=Da&t9A94hqr_-QGlvHs6}Glfd=Bs4 zN{mN@&2Hru(3|^7S?5&<$0o{Jv`f-zK8qW%8E0y=e(2{u!ISO){W+$4gt~WnNnl@E zz0|u2jMHUIr~PYN&MVm*1BmGmtu@Nl<_5ktw@*fRyJKy}PJ_UMkMgzIDf&}&3uu+! zQ~hjyrk$yU9!*`Ji*4)k`z&uc_qnBGcV(Oy!A!bF$Czi>)@U?N0$<8}jkbw3is%{@ z_N(XVcQUsxtay|dc3K*2v}lfTp0suF+OCu!kg`@cIPzL#Lg06+;zqUYn@<@2Re@>I z({_R|U*~4Jc8`%zYzIGo$ZWvMXK|zL1eqP1jqqW5mfy+qbXe>8UJdjkyOOyl?7F*8 zHA^?;T+dwpG`)uyv25t68L#^39f0L5oQ?1=ZU_Bsx}Ihu{KV~`zarMjm&ZvUH0aK^ zJF!M?qr7t&=iLduILF2pm!U`%w(-R|LazYn`TYsOZ(r?A@>`G~Buzs&W_zzky!Tu$ zxP@IH{n;=l&DpSQ@Yz6)6VLu{IU6j!6_S&5e4yFZQWUi6>ym3}KohZ&`Ft(WwFS1E zRj_1meeL%8=15w@^~w6aaMX8~v%c(9-HjvG&UaXme4qZF*~~+9J-e5}8B(Ez4gUJ` z&Tp7M=^P$grX=juifO$Y%tU8=MhNrg2SP$_gmAqKOpgw23XAQuW3UBZSG0PtFxV7s z`F_^#Xh`e&dA=OTP!8|c9*gbzQP z8dto1HTNUg_cL%e1B9eP6sgFDx=Mh+0YW@%9WOzVjR57+5+1*6_wSXn#k1@*&z6d3 zOVfUbHv)vEY@Qn}4Wu?|BkNmQo_%%OMg!cAf)^#rP1x6MbJRUh{Yk_ ziMC23nEuw3M({Fu1i~?;#8+}B+FA+H16DbVK-inW$NpnV&LHM1qcZ&$izf~iAUys& z(AO1k90~eN2MAevsZ;3q=-=IRoaZ1++hcUh0eV)vRRb$#mC${N#X6jmq^ktv2kh@r zev~8LqkA$*XNaD~EPp1Ym)(u%UZMA+d|)xy3v738`~8US2N_W0+H9y>Sh(=^HW>mf zO^pBSVf^PdNvnLA@t-}E|Gd>ij5h9j!*UG$MB_R5V!0ycq~l%`lp%2Z#<&raxXw0l z7tMy9pq{1u_apq?N%?^NZbr|kh6>QX5II#243RIaD;Jt-PttE@C%Bf|37q{_07dGv zp>Db8cdfnO2PCb%DcSD_9sMr;mVVRw((i7h=Rflo&!g*<_Mi5f_Mi6s?vwQW!3xmP z04ei|xS;epfd5Ltdpk37-E4uP?xu0&mz+(4!ep9^HW=U5gQJb{(G`oCg~8-1TU5G2kE| zd`zKtagQ16l9(?*bQtu2o~0dn5cH_98%ISyV+=ot>!is7z>VkeJ8Mva(5-X$z5Fx@ z67pOBd>(fcQ)H%Bzj+R@9M$K}13kI`;U5CHB`=JQ?SM!HK;4u+66m@B;o3IumcR4+ z$4>fw$&@kL%zDt<GKJ;Hsbt@SEN&1=>+C48s(daWO51{9=7f_@I zPy_)mU-A+ciUeIK0w7($W^i^o|5jVnsghuQ*e=U zp$BKf9-eC%e8&{Yhe)OHJ#txjV0}jv#n*Qx;GhDbb3dD^b&gg2F=d7%4|m-;S2~gu814Qa-k=hHS7#JH;0uBGdfU-k581e zHW|V$fTqe^*tw}KPb=}#drhIKxKw|sOZC5Xh{d>sZl$tVHj1>%5Lr+E9)Th)GDOz# za@-&TzEpxR9kWkFE)e}I7EAA=ZN2)nq(}Qnn97Ot+z!fsk2w6kEgx&LOL@2d4ym<& z0cgi+T`Y(2aV68V`gr(KS@^dpOvc2kGFq{cW%jMj6#iKmzU~T<&v^saskRZ)t#XK`C+k#mz}Lu z1wbnqDfV#pRINum>r&ii)ts}n5^)!8c!U^kQ2kUs8pC9yF=qK!JeG1?g!$k!rMr)! zkq{_Y5jQ#oFO_ms|7}Lx_>>UOF&BikWx{m2U!#i0JpINvvnxg$d36C)v1g%>6{+?7mHCcL4h!RzVHy}bBjSgDtuxOJVcC#9Q~}$P4@GZhk3oT4uMYZ zU6RNHviK3gavamX{*w?7t?y+@!)8ts%7nl##sA-T(DeGNJpP2yMBhII`VWdZU!XM6 zzR-GaaMG2Rq^s#+5oajqnfM4Xo*~3T$Gia44oVZP@8O4tv5(5BN|AYBF~SGvUadeF zD}X;!3eEk>cpvw_AIJRfV~U66FQDVAiMX{4P&*FM`%neK^!?8+K-l?B6e{-eSieev zn^)C(Lr*UYZx@22;%+$2^D&s!=mSr&8Igz4>ef%c1c;s(f2cE|UHPECgJ ziHC^M;Ntw8&Q;ab(=>2R(k<}m2dc7ru*n; zr*qk$a~#5SpY(R|{Mj%5JZ^ma5HTt<2Dk5W?AP{@eBC_uFyEUC&j9@sfd%7w3Sk%1 zLr^}>V>_+*^yU+!yjR@UN@WOH&k$7XZNsGeceMYRgWKhDeJc7)ycuPHfGlm5V|@+F-=dT!h8HH2ielG%Vs1>h@^v65+J2~DX?DMa@6q`m;Qp3}nas!H`uvrds(pnLmC8P}P4%#OF?%(vp9 zI0?jNBU~9Lp%b-|c61mtjmd$Yy^E%6;Xlfno8?BzXF2cpF|5i07JJm4tNLRzxsI&& zT)^r|9v=hTH@1W4mMJu8TjvvEM9&8725?8JiO5TpZ@#*M81{O(zKz#S`?X5csrHjl z=Prrat>|}uSxyY-Crk&&WMVo`u4$SwQuSxt%44KkR?s#PekpBEs&{NTsnm`~+1~qo zt2OQkT)Al+>(1^=5^zC?-i^A3L6e*VJ+%v`YgK=cwOFp|C-q9}j5W#F+|Dl0V!J^5 z;Z3a1WzpdaT4Rc&MJFKzWcR!fg9_9O1d#8!LQYrRU^Fzd-cYqHa-?Z4i0o(qfeES_|{bSg> zJL$Ve9u#;!BUQgG54oA*TjND|-kq|W{$3$|&k?`ZiQn7qlv$iRfW&zG{ddaT_LsG- zC~0p>K7Z}5lRrQFEzhUiJ@|RMh+DICCv2^a68`MN0ZY?3mLrvKBcnmL-tQWf${U&` z2z+r}-1y6Labq7{Qvjjv1(3oY=$d=sxwsJ>j__A(&5O9HX*>?($_l**vZ&EMM9&#pT0FhDq-#eT|ZKLdi4_ zDC789w*f34-JJ}Nw`W?a@6!cH5Lvd|-{6q(T@ZNSy0}5x+OHIuhc7^QpEB0W znu2h>>^?}_Ui+y2M7QGcbt#3+=ZwjglpYDna~~u|!{Who%(d2f5tr+9Isfgwa{d+% zsQyr#FnQvC)5UJGyV!0^_rdi0k_uWX2C$kpwk?SXiDZrm8O%YL#kQ7CXTDC9$JVR^ zJt!l5(-WWv3lP4(#i27E#&yQa)`9!90TQt5$DQ#)NemX*JVN`Lqxx-kSQCoWj+WBt z+NO0}j`7M64wp`6yr1%**K<_={B@x3+QN7Q8>_12pq1ouJimW!Nyc?iem4WaJ-mg| z4Y;kJgi3h+5r*@5TMk6%8I^eh=)oM06-wKAnWVv4vBjH3M+nYp660e+Jeyo_$+jg>w?u-#(@U1mxgH?*jr%5TQK5M6@(BoU0tj!) zM0ojxB&G_zPcJV;_-R7;vr>+!vV1baE~{)Z;93`qrZUcQAH!MWE|gcqI=BQMcE?2Z_%>z5q4Q+=L7x|ExQom<;O+Yg@D^=nIGXdj)^iq z;NR1-%MqSrm0b=vOv|oBc+*i)b|v6n)3R$2?mi;Qt^xcaEvrFzp;cA`_&Hj3J;G1- zin8kgZzsf4!1NOZX3i6!Te8nMy1pE9-criv{Jbs6_{WP0@!To{zJ?HwmtmK_#`dv= zF?+^q=`m)9@_Dj&@Q}WxTO}>X@<&Wf<*zqDB;1%@|Edc9stW!}d5Og*g|Ajxf2aA& z2mAl9b7jupbH%dtz4?G`%-#U4a)gizywkO>9}rk@f@g2s!g;neHYs?%a9R@2*E?R@ zlsigm0oA{#hj^YP#Pjk1@i=XRFoOT8Vjj8_iRn5SE^ao803iIkL)>TCe#R$kp~7|} zU(B)1>6va}n!aiXJQ*c2fRG`81u+nF@reYk*<>?)YOGzAhuY zJ_ljRi!i-cF^t|!jurO?Ax1C{;ht?=ex|&=bcX6btc)?c)`0#wAs&mb+vAi|Fk-TK ztT2n$n@HCMgs-&E*Ca`6IaBqkl(&nysvO7X%CjXszqRAh7^Ty-qY9Yx4qQ5go=YAR zGSrR}Ym(=Lo;WAmX3Z4UA6f(YISv{c1jc3U1F3Q`JzpEP0mJ{H=fq`M9CztSLJU=g z^6%T~p=SoItK=-zf5`)bmpE_Oe(^9CMc>NaobCx(#QQ*s5+=O+f~dy{ov*-s3w%FYQ$K#V_HbzFGzI?`gmFX8uwt^s1aXb24WB?1FJ^V>1t)7H6^*ZH>r zVi;DPOHaMdQ{lg}dWa|C69YD%m~0fetH+)zd@v5z5k>MHRb-zn53|7G$}r!Fvpvk# z4VBBg89t}S>{JSTF=dP|a}r;pZMHS^=QuG2#f{qd(V#UXX!$j5ORRtCbY8F5Rxf?- z^i8GD`h*@LO~07VPxQ-Y<(H=YqIaann4cDu(R+vJo3Bgp_>wvmxA|n8+eYZ$TDpGO zaG{d@8gh)ybYr}h_DhU$<}`#C$$W1*#+zYp*~j^&Zy9I0XOD_Kdo;~>Ulu0@lDNO& z>;1`oUXf;;^Aoz(!T2Z^CS)b8&&BKem8g&QDWeSG42Acpo8?L#V{)vu0<)R&S{cG! zO1_AnEl6NjW`Nq^0@Xj)HV4xjeYW^hzTi*JKHKFvD`ut59-q8J(s~{89M7rdHX#Rg z!i$9|^4vKML&qjRFu?sa5UBp>4G?L!Vufx%k#ut0JJsppM^fkL%RZjhob8FL5v~+` z+rBRj_NAXMEXDy_{?9>#Ej>y)USPu-W%fb7R$bsCCb&^`M=V)U}PeXWle!MoAcq4KFydFCkB?=xIrXAYj;MEsF# zKHbN4gj5z&mLt3aAVhhp9m_CP&$a9MZGCn>hg~VSLh;SSD9L8}gr;aVG*vat)Szsp zHu*m81IXlLai@IsK1v(^?yJpA#$oSQjR&ngo5|Nr^jnYZ+jjA7>wUz-;u?hwwsIan zBPv&<`W}8vQe|;lexf|PjNB!3r?jq^BAYey5U!CRRI?i4PFsC%4ysT7ZuQ-gT3_2K z)|b-PIijz@)V^-}cl$a=(6%C#wk`i|U#y=)=c__Wo?~{7QY-qCZ5?_65 zrglt`%}!bMTRNv0!^fm&75E@m?fCL$hO-%-zL{fqR4RPGR4pmfuHHOYwx)Yy@@9Td zvEHjfpf$fWQ)|dn{THSACbpRvUV#t1@+q!^qW2WHXj5_}+pI|Q{kxlq!R;vdW~oc{ zt2cxGDIuN>BPp-;m`5H1-LB92nJn;sYe1)Wh@jACQJQr^hQK7_{Hkpv!rj@>w8>kh zDHcv}4%cUGlu@KghVtTEsAGOAp!h0oo3KXhCxO_#f@dr#V`D+bL>jI7hi^{RUHx)1 z_Y1Fb!6nyDg1Y-;2y9$ZGv_*h-0k<3Zb4AIx26c;*ChyV%tW}Ri0guK0Ngbb5SFd- z30xOcQ;Kj6h_X_^dKGAUY58P?w-dt4Cv!aD8Xv;4RptZy1udJ3aLs@yn+mvxmd!=@ z^?p${m+QjVyYms2t@8Pz{TT??#6{T*u4kijQ!@+U?R}zr7Jt{$9lV(fd*0mn15D-H zKjp%nXL=W4D&JB$xLQ*En{Fx8{^LvHIhFV3f0@ja&d)f>YQ!_yGua7+}ZB;lI_;to6OTN4!~WVhw$nW&|!d-vAgte(A8Oh)qWCM zw+Jw8OPYolR&Pv!PzAujW(5MqJ;a#jXeTxy+0J$M4!*A+yO-OY&zJ#v^i1ZH&GOmJ z&jGz{2;7qBNC-T1ZQP*qF*b+$aDW8i4fhaZyrcd0V%1OY{dj?-%>mW#X0|=I`CkLX zpzTe{0lj!Quo$!81E`hCkLyKDGAIzbg=5>Aw6C*=i+f=Xk0lyAoZ}dtpyTa=Q1!#8 zwNn{u(((DEROH?|ljT$iN0lOTSPtl~$#4jUSKj`j0)b`1Ux?OSG@QRr>!vhZBWOTz z5-z6mJfG)gVKQ6>ggftX%;#CjaUO2XXP)Z6S@?oP3GqAzJg?C$13Z7zuzQH1jzsw9 zMF_7e01Udwi&4b$V*J(FhEMgcCB)M>fyzf7cE<@?a^#r^zdH={dKv0^v$hp!gm|Q7 zT;8b7njZj-5Xv|^CkhfUst$a_D2KB^|dW0b$vDDfF2zu?i?-%|7;k~OXijMI%ok1 zGu;6F4e_vflZk-pYK{Ur*OApol7R3{jdgo#Qz-`R&=_+m;ck{}vJFcJVmS zL56bLHkGSBEoJ#T%X>Ga)>ASsSU^I2l(zrW1Yk1b{Wcq=WkaL&oGtD}#RAvLo@1?AhQM2!i1B(h^e{T_l(hB= z)z2`B{xVZLylL>Bx#u1p-{ZU&2_061&NCgykfYvel&trYP06`sc>{`gUesPiW;$k; zmrjB34o4kQRkDtEHl^;lYwzKEj;{Uc0)!_`LbzOl&;sDGnZh@fVHox(E|bztWpYKt zQ_+3a5GO3RRI@947M;%}C7?@pqODO0%2fv~4K`X@MSrS=Z{9pUM*iOlUQFkwK?eLX z%Y{kr*3!X^5(HMAq)y$cGhd9+eBKYM56acayJ`=Mf7&H_U+o#F_aP7zRK#lfUbF(nV^ywp6PP5s2U@=?JT z=YO|6pegm1rPh0UKQR_s_0IaPd1h@n39ph{y$XcrS^Ysa^t`U9{+7&H8pvwLZ&q{r zNK}UK(MDo4XU@_pU8^gj+ZwP<2@O|v<^Ct+g+-^dNt3Rnd;vR8LCWKD9BE=W1-v zh8~uy(KSmuXLXufjaSL7K`}0L%~4s3;UbLZ@yK+nUdf!r;*np^QvGzi3dDE?WeA&% zVh=2v#qKrqZY5=_{`VUPkJ!bTGljXN=4N9N~ zWhj53kr?63S(-%yJ<}*1?b)jTU=zy`z;m5utNz|qp#QJf*V6c;E}G6y+X=$% zhRuW+9pvA$ci#QQx7$0d-zb$E0pXHKC-WOhYqL&^bwOsb{M8AaW?vn_VYjEG>U#2jd+NHL?BAyM zA$mU>di0NHX>tbF^<1)w`w(5Nab3@4k2~_&W^i54;#J?xhluXss!WFu(P*`!<>Oh} z+EpUHMTT(r<5>wGBFaC`S_S%VHWH&DoBIv1J$ChM?URjz_tnjfJWn<@xDKaz2tT6U zpQQQ`{pJ+>h<0T|PwlkX%#X#B^9Sb-2n*#)k~^bE~bY2O15~RcyDzP!X*-f8!{2D7CM#; zdf%SFWq4LTf$LNLN#&JNgj)#V<)u95QuSnnC97;Q_XDc-AzVGc%c@*3y4uHeFV#~K zZs`~APUX6n>KO=2R+;b_s-A^#bzGDQpP}lx2)Fl%vblgMFRPx9aEVnmpXaEpu0pus zgea>5{I2kuxxAM!-2rI_FME+8~?0r)~0jwFXfAfBKAg<`Lpq;It1<;r8LT z28eM*(<#`8r=_>;{%(L6i<`umKjT~M!)58~XdNKNtfrI84JWk^3%^ohfEbgSge`a4 z|D%1ljMuqwfEc5!I?Mh|`|uER^Q!~gR$=E=2g0Y$t3C;**Gn^A^}E?x=`_x(Ca>gr z>FG_JSNV)oUbS%==T+lZe!E_p@~4De`ggOrUiy1O=%q)i9g9|Sz4Vp_p_iT@WVI=C zv{xDi^QI*miJ>-dK4ZOCH4U`p-_6zqPqns3hCnAA(Z@$;l!`lq5zsW{o@f2R5V z%#Aj^bg}CH_{LPd^hHhS_0lh1{qO0e-^_-dH(?IbOS^<_I>Vu#?xgdX4Rs|F1Q=F( zcGc~Z3agmkC4kEZp!kY!o3N%iP6A~OLav)Khm8{*ua>h^|1}M%I_pCX#Mo=;tWW2; z?OtC}Gv@|?+)kU$y2_@ren#ZBtC_%Y0xX?12tUjZgzh?_qZWRcHIr>R>d9Q6+$(g~ zRRc-g^$DT7-rk?oU3Uq6bV5fhcq-)$2_5w;z?&=`^<0~ddakH*KEiTeQpa5@{4i^( z5Ux5Q%7q_hTLza2_X*4pcDHt+I*=joiJBbSss}-GcN}%ZcpZCa9Y@sEyY+ny{BBLpnhJnJ!9sKbBnUj?rfaDE`Da+Zxr`Kfi~e@8 zoRwfkGaytCaA;E@I-zDjzzed8ME_{tnrYv%dEcJpbnRhuML{bWpQLNIn%cLTA^P^1 zqmFi49e;H6?Gjtx68$+nO@EU1g{C*}Txi{go1Xb{Vd6gAPVd8eW@xAFXZD3}eQ)x9 zXDqDbYfr>~@;KPzip=tb_nj%?WM&IH!%SeZrZfVv^Pyda@D(bLBTV$YOwuG*vhVe3 zQvXlKAdjvUD@MhU8z@)+fnWVNZk#s-^jl?!1Q+qKoo^poT7O2e{u|V!Zmo^$;Qd%7 z#!mp;2|I!$>A;Isi^{MA{1uIm34y?c#B*bp{@!w-QTwb=~* z;QVH^>Te;$^Jylk^GXo-GzZm1B?$b+@m{rC^&7&r&?Q0GbUbg!Q~iIX&nF|?1rXlu ze4elR+Zk?EVZtuKVuNQQ{DJ~H-51+rs5|XA36#;Zdk9+tkKf?2*mPe?u+jfLRxkZ~ zlfQ`e|0FuI$M>J~UY=G5cPc#L!u><*(jMDCgf4APs?O_!0b*=^NUYVl{|~w}lv?j= z1H`Da>aF_sb!nClk=MoJ|5O>mUO>1URR0|=F28^b;feLcXyJOaJ#?*Cy+2n2{T%H_ z^@HW5PwTnPmEN<)fa+Ieh7rYduTEWcFcYeS4@JID_wWEIFCQRfw0xBd^!iM| z|4Ns~)P-7WUHp!nt8hJ8&A5b~Y!B0u>E~!S-vDlwH&Rhp4uxibfR&d8T#H)AWw1Cf zHjhDD%(AmRhI=rN@?~f$369q`eJZis{;W^-yjN1ccE5 z3H?w9y(dln=zLK9v@Ls{i(`uHyZcj?cgt5Vk6Cq)$$26ttRs(*I-lnTqV3Uhqyh>K zHUI>qTofU4$;#jW39QY8(O(hbDV36a_BwDbl6i^#U^^GNPdcT~Iv081`08iRuSM?dZQ==wvzG4a2NC`%_78n-5qWAmKhjJnOH4R?5e3%Y%q6^PIOe zrTl(E=a$xSh{|HTZ)WK~C0#v1SWcfN8T8VLRxWO5eo+>Smxw91=Wkt?4Wae35H8P# zP;dsq#o#`uDiAoT$i9Y56p>vh!g9&bv7`HcBppjQ7?dGE=kV>VprcGEqxbe;6@S(s zLqK5Huz2zNSsqi4`6vTob6+DtsN99{U$-)Qd)l~EZ#D#eeMQ`$@4vPc^z}0kZoVGj zHkspn)G2)L)BfM0FuPaT>$%WW)w2k9?E)<(+V8DbT8}P(NChEA6rhaO_w-gizOiDS z(?(N3x6UH&Bh1JANo3A`afPCJ8afXK_YaxBCnUHo}$mz0v{gq`Wf&(T_MwepC_Y4d}y z_omI&wps5@9GvH*;Vvt8h@y2WV^W@}nTuMVqC5?dXGW^vo-^{yUn{5(7gkstW(6@(DnHYAqEVP@`F6LE^=#uSU2=hR~%lggX_FZzRvzWj1F(=%|u!sxuhR3MX;_c{rw8OyHn>pPq99 z4}r==JyP-v_*w!zDnZ%yTGuL%KdpeSzcXNB4-7yXR_G8$gzK8633@c!s*p;C*+vD{cr34<<#vHZ7ivQ@H=+aocKIJhBWbJsD$f@MS0Ox8)YsZim@M=!kyq~^kM+p= za;O}2>>l{fv^w`@jtk+dzL5K1+3`Q8N^~Dr>;XEv2#cr z`cD0)^R$f9;~bKg&}bDuE1NEx3Fop!iBaX1>@lfB=0T^0@3y&syelHk#A9g%IP`I|NT_I*;kR z8w&ZjG~bcbd;d3&H@c+wMW{Pnf>1idDPTtXWQ5zWt$Z@a76|$f z22ox@%YA^~pyg8$M#pXCQvv^xmS2dldQ7x=A>art^CKKRD$4wTL$vIt2qUZPr-1*9 zmR*i;^AS;YIbeGBQaJ*wvMT{UL(8r~IM~a}Hqo}P0lbZt*C5<{*j8Qx_&;g+^$175 z;pJ7d{CdD!Y57Woz4r2z+;4CFNWkIG35$LH^h?^CJ%_XpE4E~5pw#0q`WgH^&J?Z&p#)`c@zv?ylY@yl_Sx1OoBw@|I;ed6 z^m2rkvw9ppQY(h8$KL0f)q~b{8b1ihY&*d9P~^;EY?^ld`E~kso=nruWnU-T*(%!kC?>m`N5W1}r!x#o>u+e| zn3hf&?ny(#-5R8&;r28%3}f$d8rBFJHa!BI1~?~en=8_^xl>Qy=1n=L<<(zfYN)8-WRE^l*$X!FOHO1w?v;(6O72vv-Lx^{p7A{WNz=~X(zKKJ zbozF7rD^Bc9m#fnFWMp72e%VS)6Nq+(znx^rkzQ)c3MO`@{YmnJdviICtr}<3=`jh ze_*xuP@48me^GMN_j^e)zPnMh`<|JkFOS4g=9aMkSE#JG8?u({0 z-^@z$O-xCC)3`$td@wu7iy=F~ixdB=S*ib{;i><_D987Cj_(T`-xoQ)pWyhu#PR)q zIKDr_@%>q8dDPMUgXiJRVd>AWgZl^1!_S8$&#$iie7^rXTby5QbF?-aZkh9!pKBJc z=XLyP12JMUv%5C6WkXZdy7?N6pRawrLEK>r1pe1;sd4Vkd2M63>9Df|Mr$|wIUerX zylqc7^QdsY^qooEeJW>cMtFZ#R%?qb-ZqINqL@dN4Ab(DIi|SGzO@;xeM*+ed}Qjm zk4&sf*2txR3CU^o0=(n}>7|No#AqH3Wm^lF-%RM&xANFpZzhCayOkKxOA-FhK4Q@C ziWNBYMh>^%1~Ykln=c#m;|iE+0nhyy{XT?$wt?OG**H~=2d(lym>#o&A7Ofi$4-NgIt)S{P&@Jg+_7`1 z>^;srItlb|#GSowfP`a8WkktU{WUzUtxoc){*v6rqH94~73(K~4Fw2)m2-9{OB-K9;RR7#QVnk;HhSMMvZIrd>0`7x&bPDKnynfV2jBUfA zPCZTd(9A}7{#5R#gA@pzGZl0!d}xAkzSg-9%~-Q4PRATDm35m(a37lP#eh2(AQpd| z;pX4ccDff^zBDd#S|2eg6gZ>~ue^QAa0py2a60MTu@aL|Sb-37L3s78#2D?EpIAchE)Hk zcM0)Kzm*t!9p6YJli!eAlRi;@5`ITV`-p)pzoXd*e|#37x8`q1cpf31v7mN5O^D~m zOc&=de>Mel&#lDxgQJ~l56>g<)p|O9l@Tdd_4gIA`(+(?RX^l56a{67L`NdLp#bow zn?Ps&I|}zHVtP6W!p}PUJeKF_yj0=Xk(8biQ2kc|glO3u8A6ZCfL~$jqR@Pzn;8ET zb{a}YFcZqU7a=?;3&M{$$HuGrBZPQ9mElkcfS=oQq?N(LBtYl>=nh%qcuHeUB}eTT zb%N_f9{Pp^qDq1JhG@sic__2odaA#-nHW#5=Qwc|R#AI1G1OA-v!}|?`t*8Yd?fJT zs{Zh-Jl9M5B3)xTN9QFbb0&8`a0tE`yOUIlz@ zA9J5g7MGm^tbf;@AjUQs>Y^WREBYZJo@EC}c#)&-meS<xSfu90mDte7T;#HXXMWA zJeR*u=P$UO7;RBf)=+?O={$tJYSlS#TXCLOmCsplC&DtojCz1WC|50_Wt2}~AH!kr zy-0|sWHrO72}v$a3(L{s&DGQ*j>CFzhe*2G13U{ex_uY`xKYi&F=m(*Y%0KBSeA7 z{w%AUO<26 zAY3a$_@4E)HM$J6>Y2$k`m6QCC~?>|(5=J}`Yu2B8xb+lA~x451G#u_aAVauK?!El zU%Iw}8|8B>968~qn9xPe_yyP5)Ab?W$@Oe>op=XGd3PF&wW0g#O5filyuUxR_xDB6 zN@gefyCzM4UH?Dz_vlmK*56lBFwdK9_-uAxhL;Pt%`kQmw~wj4*xo zXd;iQN9aLaW~#5mTWl<7fBv&Hkq;^aZpz;Z%w00~`E||X*a@oT)2if~rjknl5R&T62M^aMf zjQJG0P^1hdDgS^Fk0C+WIqucHBtYBax{(4?5`H|-5aMYWiEy>F zWR~-r_HR)I5|V81(7B}VHB&k=lKpCym&~%)W8pE-IcjBfjxjqg zm9$u`q&@r;^B4E6?**<3K2#!gci6FR%8fWj}X3IfzVnB zLOU1^sEg&3>1H^5+=r6ykIWSO1-gIGJciv7%2i z$`^KsBriEKK=-7JeRul+m)l+xHgLwbQZW5~>*Omt?RzBrFR#Op)-=+|CD_5=OrA&30xL0@Gx0XS&Fb) zlzgB0p?H~3#LjeigJ3uW7W^pAu!Eu!gg;nIjP2Rb!_O~CYhSARo3o*Z@`!=8sXRhk z$878V&*|N1W7Rng(%^mXT8J>+3jiA)T_`~~s6e<7RR1slw{ss;Ui~Haoe$3e)ql;C zJdU9acz%;P&BOqO@&dPc^DkN3d2c1wug4b?YnZOzu(h}HB`r2l(ti6SU-yrlAZ6W) zQKW04q*-G|zj<~F=+6`4d0c`rDnoTKpIDEN?Wu)Hnb;cBi+)Lr7wFy+_0zInK56YO zx4HP2d~Z4ZMw0o6{=1dRC{$LV>n9_zXE>g6ufPDiKt#Vg-6uha#W;bhu0eu8Gu<~5 zgr0XJoK4sKB?xE8JWnfKF4YHGzkLMdrn`a1;Q^1K+Q|t3#s@3QAILaM7)0@SI@P{7^H?whW*5F0a}K@1!z_v z@Z{3C!SbQ*kTg3!fE{08#4ST$1fanf0cxBui~xGyrt>S=@Bwhz+^qlIDl5sn&1~Pv zYKMp)ZEBeeTH94g91qu8Vl+<%twrH_u&Sp)JA3V5pO*Hu9LK}*E2Z_wF4h0jt5W?t zoj4xF4TEt!w#ff?I37Qfd3=JL#PMii@d=YaTYS}E91jb>gN{cV$L(kePX>+d*(!nC zak?0vqXN6*_iKbK@-ztSjxlCKmg?WPX7D&|SWAq8M856<(=In!m>d_#%s;IB8C$&; z9!F)i>ffEF-s-hUJdT=d)t`G6==+Dj=c;$4RtsGh)M_spPgot&-=&JM>$_A@ITlaie4k!VMCH z&vVq>ZmauxQFnufpD9NKhV^rV7_(&vhb0J~<@mlOFZuoDYf>?%KBBUV%x!5OvHbsq z2k)04Fy2u|Lw>T3AFN4YC;f$|TB?5|$DV$Ka6bE>1cBpq4tm^4dP*#M#;g9P#oFZZo~$vse+plx z^lUnEn1o^r5N?qHKQ$~&x@QAEycuDZAG@CC$3FH5!t*51 z$)zl|`=TTK-t-buq?b^>dfpWPAtD2Q%mty}XYyPUfnl)oClcuT17~Y-;fuS7&an%^ zp=@ZkbA6z-Uf&rYM)LqE>ugNw zyxtyQaRg;uTM+JSr0bE(+BXnlpng)em7Z;vBD^;nn)cGOZIbGz^*!@rafgbNP}im0 zXGs?0v5YX^`f^JytD2-qUs5k9O+4L-^6=a4d*3mZoCme48I_+en1j zy&)=Tk_{`TQAUw23Cb%*aLfmk!{e=52r+(l3o&B(oM!fIuB`35B^4{D)&-Z;PvKZO z3zpO}tenRCCTGQx^g zX2W%;^&z}qK$HtyhuWzK@8}n0BEMGc41^V{OyD}y&O*30F3JQ}PVHQTclC)fft6D` zAK{5snZU}atwOl*geVhOIkk%r?!uyM5#V?fp$VYKwj z)%Fq6(@jXvGq=puHoYdim~D7Oyf8@m=NQhyH5c}X9x_O&j~Ts z-+gKrIMST-b$mpKvHb3n$0DB;M@L}Zyh(`Rzx%sm-lVNl;L87+5aT?n&N<%=N9Wt- z=pTDIZa+O^B^9++xlp7w7qxB&DC^|>sl$>h*%?f}`}O5>(~wYS5aa-wHI_M5A69Kowq-nyx+yidHZt!^uzDT zt(`kSLo8MVno5GFX*cX^ew0Xw2v^m<*CbtP@zuSKYu(qS;0&ceD{65U=O;#?NEOEDR ziMxelo=`HFZ_xgFi1g)GaymyzB6cpreE1*4h|UE39tc|*g1Tzq@6#+pc;ionF7+R> z7RylmV?gLqSIgQ9KNa_Akz0NK&BRFbZB%7y-wGk{@#45K{`t5;_sPxo#EoNIFB-m4 zw9%5O`e{3#F}-J@dGSX)pAn_$Mi~Ov{*)NiS*oAD+bn3Jblh*zAuzSZ-^_I_V^|zu zfvJ8$?60+*@Np|W7VC@@AJ`2gkc1P4z7tC z(bpgnm6=@#$7TZ_4=D1p;ShQ)6Q(z?nEbJ3WJz4;Q;W=1{~*Q*1$^EY^w*KWKC^dpL* z1+&mg?AdIDH`b%A%_283i({nk&Ka*=a}&>99NnR4^j&tJ&lmUk!?Nb3?>#<4d;5Cv z-U1hUPvjm>zB?0PGz^;HzO%I%R-Ik0L3M7oo;7A@UCJ1%UJeA_UlcdWhryl#Q2pUs z&(aPM;;H_eF#bU6oOO^G$NEX=aHFKXemB}0Q^uGHYzfzR?YY&UAK4*miFn?vatfvd z<5w3en)`a8&sv~pHT85qIdCNuw`uK{M^}q?y9VP*#MUPF3%QQJ*V*XOtXN{?;%%c` zKCae&x!$UCV#c64_gc?(@%>V2?Uw{?h0I4X>kDGgeR9~dt%&~r!_SG)deYe5j}yKy ziS<+ut+x=T--(oXe)v+E>%-YySxMyNYtM!~Y@L)9Xvb<@wp@W3tyszMolr8(#fF%7 z8A7z3eG0H#XLKLzSH}7rxdVL{a-1(_>%Yk0G;zCpRqK(f7PKC#UD%3O(Y+xtI^DoA zXUGC2K`*Bf%;dQ!vvZNtnCau|KSP{{vafF@;J#JDN8$#4X0LdTpG$vjj2pr~A-rof zF=C_GnXsoh8}?KMT^g)Vw12Hmo_k{irW!qW?!JlVp(%fd`%rFpE^eq+9QO^W>%MIS z1PT_#4VG^X5Wf9gE;H`iC25w=56^$6`qzCzjGzSN+g1~!J$EoYe--pJj8gso5O$NJ zT@uf+l%x7(K$!B`+IPAC)oKX>53XisE~}$`G&|Gx(7Ij`byc6namZR%5u=lxI|U{^ zH{W}k>)<%PW`Q}epPyGCLHONO#JE+|TbZx=Y29BC;-Sx7F8cnRvT3PE`o7vi@$iDrJ5Q(qlcM!|Q@vjfqIECr@952S1u01*)wBJ?B zL8~rI&gBAYE`_ao?`mQc(Yr3QzZaOwN8;QCsqS-tK#LgPk`)SzE$A#%{TE*V`tE1x z-f)|;*c(v^!tqtf^+VfjADe9VKUSy8g_OqM(!C`7J@d?I7rI&HF6n?t`%!u=ol6MjnB*TiG5l$c%QCa)JhtM-ls+6WImI!&$>@pm}^l* zF-It%7Z*aESBAj+Rm5meY`jR#(4Z_sTOr1z@-#jseX9~af_ZjZFS7>#=v|a&5)yLw z08(*pRim8irZXujiftsud?-qM%GO#Ty%RSK;Y_}WPD@yN{)S)=*K&m8m!CI zMv8vK#M*0F#ca17mObR4LofIl;qnLq2%XPqFw^P;ZFl;pBAHFs4j3Q-!<=F={7lvV zlMIFzR!-}9?wWx?7+sWi#M9s=-c9Exm|52%aN4Z)y*c1ESBic1PA2oUm4=CZwk}h9 zZ>890qj_Jir*r1e#qM*o7vr|4u!Z$y?<=L{%4-J*h-E=f zi9S!8T?=}f1flAYsI^jpPz@yG)Rx}}?uu+4_ZiEArjluHt(OpwEb`Gh^`6dnt`a~I zNrG}Z?tl0nrhkp7zK$`Imr-7#iVDPr**pm6`OVF2zJlj{r2cYkQ* zoh~p(T}X`j9GLDMASrZdgcxtI^S{WHb2%=}(odN@;cFWpWz8~*G{3|74&4v*y{h}N zG%AyngtD}j13Z52@Q2%qs7%=`L5Q9;(tRjWBSENY8p5Sg5>wlXCxGUp9iO&Y0Z`{{ z=6DZ@Ivx~tlzsO)I<354dnC5M(GnD?gyXX-mjLrUp!+^ZNB{(H03>M_E(JIJeRwIj zy)uMk8|@83=X=4I!Vke?Yum-~8A=e3iLmAU^;`PMZUxMHa-rv$e=Nkze`XZmX93~; z#XQa-V;aKuuz8iuN`O$T7Bm^4DXO^4s^~;5HcD~Tv7?$kn%$wKd zg22A2xIty>T@r*h+-UK#VOq-~!N;a$Yb`gX#sHSBi&bv{uZ!~E4;Wud>TCZm#-q|U9_OEAJiHkYXc6Pl zB|&(mZ9J;hf!1<v2UklXsM)UYXrLo)dZufY5KRAO@-6SSatw5I(WOMngAf(nU!c zDE$ds%L3K^3h!e_V*H+S_*vyZ;F2nCW2yZ>V37Bd5IgU)VJH2zB;?h8QXq1n$`HCH zkKbvh$PoC@K}*TSNm@XRM}vsn-FhRvqZgRDV?d{J>Ho4E@C?6?>6SW`LNl5LdqAJ3 zjamWvF@@`wV$5%aND~QqVO7#so@5aH{r42HQ&^f)X zh8S(a7vqh~h_T91cf%FQy7d)ezVi9rR!1WI+slZtbtLzNJHY+BxIY&_h~=9B2t%%w z6HM)}Fee&B+^Qw(ur=)wG1BzhY6R^s8{>v5K`0+kB$|)#Q( zncw&k9#i4tGSMz!-xYpmw61hnrgkj& z^3L~`uc&@?8^Ee&fIyWCv}>oqp-Msmuf7HD5>U2y1x}Wgk6xLEaH9lax@Mx5ygwZ9 zrGO%TA;hScVHF(%eqOyU?h=YQ`ClC8GoAcL<$qdluOgf60OhoP?hhsT621li;TH)p z9({}ZBn9P)z4UzIF-J)pfGEoW`TFyv|4PcWbWK=tqNG6hDMAc-9@Bf$6bS*!oV{Qo2E?c<}WuKnS4&Y2{`t09?WVxVRQ5b3A|!X%*bBRhct zDu@n8K&3Jv_)^iUQB-(!}c$7>mP}oyyB@FVsQ{zp3nEUUqY#7Mf!#>%_m3 zn5=5uF)HR|11Y+Xqm=gDN~zhUlmzIQ-zAnD=rKKiPZ@Uk)>^-G&z$@>+L(QcHg?Dx7PNN@y}N5Lu4m7aPkm0j$@f4fvmo9GT*s!o|4XV{&O-6m->~dO9M5+4 zR$j|yS0B`ewet(nZURLD%War~x$jzeN}qx(%70nu%vp-~zE zD!5>2vO&`OCQ15nMKR@(S|=f{K`aV-*6tLvW@Au5)hZE&(Flic=lh5(gt+@!V$ibI z-uaHs-boqg@iHL*rg}eBcu+5q8NCJ+KtvzsLyx2J#Q(i@Eb7et%!bbjmsw3u%4J zVzxjF9T1qT-OS%jGU@q6b*p+|ySB^oHrtPxjcru~zBZT(eol;585l13pReKACfOhS0mt01 zGg|3pzQmPFnXVqY^IF?^zLER**2c6@+qFY|IA>lbd@+Z?5T;|Pa4G$i&r7Lo_eJl9 zNcaq%C*x{I8%@tq9o%EyH%uGl*Aa&0|K8mYX{&Uz+>C2p&_b_W0+FPUiNhB`d`+Fi z{C<717JBMJh=d17)qF=g_0MyB2j-94k@d%|e}wtij-%&8;=`=2HpqK~4akxu?7l~& z7+Bm&eJRh?(I!E(p2|v_L4QJHb^;ccOZAfad*pU2_qi44vx&-o#RxYpBSv^6!Z$Bt zx;GAwMfgVg_gKKEl40mty`v^&*yR>_Zu-TztbUh$#@EW*gc$Tp>!5w9M!5bE|9|Y~ z#MpFCe)}dF;<KB|(hJ zpvh}&bFov>YhTLBi6gJg#Q_Ndc(e=&UXvlQJ_Q10%vJ-Q{su|kDnpcEumHru)f~T; zj_nn~?BDSYV0TdQ3Mg4;`M|&^h*8>>*=SoLXsZrls(Tpkxm@EmCkr!vlMILZWEklh zg-&V;sEKI^=Px71oo)#J-Z7@OSF&UJ;F_%LOV{!B*JfqvL7#z1SuF1dQzXdm9Lmg6 zEoJN{#OqCys+oBZEoJh2srlGHSuTpIpF7&E->rpq5aPXkIehz$O28fkqPGK7X)=m4 zypm}MzaT?QlOfs~;yS?(oqc~T+xOpIlZ~%@SJb;cAMmD1j^9>Tv^NFOHTvvP#LoWcps?z&DKuA zwsOj!q9X6e|16c5ewQrRR!+b50n7|nO6O7CBO>uK-(8k5s9fq1|1b4qjHC2D@c+jv z8RILK?_UdjC2YS=yM5DG7N29-?e>p*GltV{e=3{#-hzzLDnYPG;XJuZDK=Zg{XVa+ z*mRGk^?7pYqtEXioiR{`M5Wub&|x0W6QE~f9=ElI=z2Jm$;~xmwQcb@dMo8w2<@V(e% z#fqJkYr_B;RNvf`al8WI+a(^8GrNZ0e;r_QCYQ^sF+GHO*`X}za` z%RLioQbxDpF=^d)I#J!XHN$egFk5&lK+JCcezk%72xx@F=-y;F+EyG%hlnE?^mo>Z zo_shPN75?dNGM&`XNX}xJ8xP<&uN7FegKj1M1&cQ$`;_#SNXk5SAzRRw^^~6)7^T{ zV({!p6E(;0+7?H}?eJh?#YN|Nr_Jv%kd=qTS)$~d{YruGagt5hhJ{9!0(Q9|>H)3u ztu!$bO97)X5WC1e|EpxZZB};vZ(BQ5rpTkR(^7<^gc!6=IuDx)A!4lu`p$`ur4@qu z=>JPGOtsnqjv*$4R`kX_{JcmkL)hnr*rv;PEN2(Q(heNwiFX z;G~V*PVv5@ul46;`N#l0eKRM}eKDXQ2 z>p@?Us%IVLYA?`2Q8El>5%bgH@m`-QE|co#XK@_=P6f2k|6}^QVjfUrh9%LhK;SIF zldSz7WM%lb1-5U$Gt9RIj&IL&V180rev7^DkI8!5yIK0}XvmFGrTe00E%%eiVo+r7 z9KT8lTP`6?zFkwv;yZ(nD-c_g&#{#29!7YLi{tLKDiB@kZ2$di`#%%&Cr#kI*|(M$ z1puCj62vG!YO0fT%8xo0K*T5W`^48X9B<5u@1tvd?WZii5xWbe&-SNzPNAeIhoEL( zzrgfIm_%<{CP%c1fD`>BcF2AQ)gtbX&iUWpA2FZ*LN1f~f(U~IQJ=_T1a1~*8uPgj zM)d#DR;*L@47BufCO;Q*J+NPqSe+*n*~E&%a<{CnMmQ=#%#Jza%!ADQuO2|SZ5%|Q z1>x{Gh*mR#VRU!;7sM4-n(4II8Fx5>HX9K>o8eyLcVu`a5MtKm0l?X!~ zM7tQ?N%0^C(Ak6-h^~pV5VNZ!&jx%3fah=zF+SmOhVj-E3HI)>)>Wx_^Jm0>6rtx_ z(FcTh{V5VVXnTL%XT;D3IDet-CI(2fYaX|YSnZA>#PAJ}X!2~jU%{kuYvSJd?R4!V z`-s}nN21+INx(W=W*j8OA5W3fNuEyEF)%*A1|T+ZI>L`L+!+`16KV!6^e`dbJV5b@ zfZ{KMyeA;f!-;SWfMI`TmsF4vuv`w{X%rG2sbFj3}u zb}eY32YZOoDs&6_zuv?3(k{s6owUx6n+Wl~BJ8Y+=<_C!*VQV#&yVxmp+)xdhK`|5 zf*4)Tav95a9<|qNkGr(^^Y1f6wJ-&(_`E|xSEc9rZn{5;DPPakMSX=l)|v9(LH?~k zbk=l)Ka?R_4T$CQnH@y9>r=j0_Q_DSquzG5?Ui*Yoju$3)pMPLzNfN%-A1==ow3)h z8EOZx^wRzLFoWlTEDbE&Bkmw%j+u7a05QTczq18q?=B5YP7%Y$aEMAwDb4P0n123a zN8fg3vVD8HeyBWLyM`ElC&b%0zEozf#)HS!;-~+DSK8_PhHW-?fSFPG3Wel?+oen4s%%I@A54iEhv@ zC4}kbR4>(J6mP0zYqd(sgIJr4;;oekOELr#A}{u11H|yT7`8$vQGxJ=6uS@IIc(n4 zF`zb_pAs0}9@Cp52G!yHGOxP=q;(wYHI=G`pd9u)Y#4q`9G& z>HlF7$6w5`l__nh+|X9ZaZar|DPN^$GOag8h_|U4;U>K5A zez?Ciqs^6HQrfWk&SBtDiD170R^dCz+9v?aH?KXtIZV@p~w?1=IiQ zxetroUhx!Rcq35>v^eD(^)le${3}_TkwSj|Y;Uti(UaF?+q_(~$uM+43mps(ZBzf> zwD~Y^^E7*#$ff(Q&$c;Rw3!s+d~29C*Po(I*2Z3`u@*pGXUhd~bhVwXF5Q1aw!I0~ z-V(71Plx|~Ki(e}F`MMq`0+{smcOu%;XAKGGN^m)ed%@S{{P7K1+Nw{0s;@}fiSE;1^rkzqed`o`lLVcvanR{=2c15((P>BiP&#Q;kDSi+$$Jj)+^h6CVwjU) z(sv1gZB##-<(|{)X9KPeBK-XW**@CcRq&aCknI z)kPe6Hea(e$oCoErq`K(V8N&jwzD9hQ)b$&4XC(VujYDoSoGcM??>N*$Z-9x{DyuX%Y1#m_s=?Yzct}cwi~$L zEyq!VUjG9l^tTA{cHfPjSq;jeMH1CBIZm5j;`h=k`h;KfhePq%?7ZzeJz3sn@hp%b z>JmEgWQp^*gyJ$OZ#%tbXuUF^_!@xV`etHaLcBFs+j!m=dAk4XEYG|C>a4FT<$D8H zbDsAlAzre1=>8L!SUG#o%A<}ai9L98b`MfHd{F+nd47)k6&?xd=2n- zsuS#cxDC`x01>*bef^dWUuGWPKcf8sLRf4Lt-ED8!^atH_pi2gf3lqC_n$b^t#hBC5_8_T zrch)7M0Qa9WTuyh6la<>a6g`;FOU6_;t>cddE3 z`|jkb;rE^Ty|3GMrREZg_A(#;rORRPZun(!ckBbWf$qWNLXM-DR3NZPhQ`Td=q~#H zRQt9AKs{WYG9-~V9E5*s)|b@cJ1;tY-dZf5H+p_dwCSZtVB-$9>AWw^2laj0=5)k( zSd$B=eECbm4ZVFoAEEaM9g4}OlYrrZZzIG=OhUNA1%L3R*_}Cl$PK;wD&2bXA2>eW zpT29u=bMBu&r9wdj6MFj1EX)vGg@fZcOmit)g2}wyj2GL9=m(uceS;W7MguR0vdapBPN7qs@sv(Ktxg$76-j6QUy4iksVfZQap@|E z9PgF}_p=@U;N?}Pk}XQuo_ay(#2o@>imnxxSSue39sIe=`8w+IIZ`w*9AHKK%Y$zv}DHy_=|xnj&oPH42(o{u=-8`MjnOdcSTQ^;UeuFyk2E7{{h7 zh95`WH;m%~+c;{zaU3tSTYa|nJ?nQ3@Avvb=#6|bA6xxT)*#$0XLAwwWe}K=uMgU( z86F-$R1PBiII}rP<~xVk{ae)eJpxeQsSI~9iuBF zwN5|f4Fe=t%VNliP5-gcdf}`TvwaOdOO4h?%}N=_{%q0BPtvY3dPm*AwlE(>kRPwx2_BhF-bf1c~X`O!-7PA#Id0fde@7jpA zGTt^#*e1^gycHn!fdsLcpoPu?@N9mO7+gLt&B1~&|IB$&Ylc*nfYv!f+__OXXR90b z-aUfL1RV;*{(cp|FAI+>)Z1KIsM!sB>sA)(d8>xnSdCR2=bzS9?1o74Y=oN`O+03u zyHMX;poM-uA0lBZK7X3SU$OwyKvl|EzLuW>OC(V7JW20S%FS-YYj&}Cb>7dNYXmMb zaJh~4v5WH2vk|^+WFhmHc|1=Gd4%6`s|2wpui}1|yYjN*c<-vAhU;#c5XjWdz3P>TgVaC{r@F@=I@UdY%7nS0!PNWUvkDZ?|P2s z!lwOp30sjOVw0`svsq;gWdE$-}?SW`!p{D6qTHL<`j8?gN8SMYVU zT;aCrvtA_z{qF|#v0%zbzD5ifAW`%C zJipvNo&#npKZCud0$S*nbGe`2O#?ixXZ&l#DBXy*o;XQn^(ZA~x40v8*G&!_S-9o(d4qtQ+S*Xh2!+SR}P)0HCGX1kYBCN zFY)~G3tBmFN1WbT?Tdk6~w5`x6yh}kq(QB^buDId$X6@n;*N9 z^RGc#?|0C8G^n#?ri=#xVkIMBXY7u1_0vJ?i~z(uBVcFbj&t=g+J|{Orc^?$oymEC zo7}M1|74MV?}yyR{=x?qR%5aGvk!@JM~Xy`&XaTtpN^i(ts`JBxF+bCl@K|;ncG{s zlrmw9@#N@ftnBOw`q7mZPTVlqa}BZ{c0(^bR-xa%+_KXQQ;y30BcK=d%+S|acI@5oZu)MyJ-r$9gB1uLB+!0vJi-SRz~nT*^$gpmuAS^2itS_N zo43}ZJqB1RM7Y)kQN@jLvKW{@Y1d}ZVLrlVp5S|k?)920h#}?K*556~I*cyXzkfy6 z_P4803#G2$w!cA{z=0)9^=G3pWh9DOj;27DQXH7EpBTdCQgp_`KcOCqDme(+!`zX>f5+Skvm5%<5$o9u?r%#aAjI>y%aHDhZk)Iyt1HMR}^#@IISvF+mh*=hBs_B7U?owPrnugo3W4{c+U zKnv-Fc>Tch*V6y@i2q-)-Tz7RneRpHclLIW#BlkncJ{8!9e2YOxp!(-?%jD}ytRa= zTOIW!i?a2-w#_C3?fkT#SzsD~WL~fM?rCVDaYLilDJo0ySKU zaEAoZAeRkuVq=*6P^g7|@(*H!OL@KqcGiIw8X&}5zLMv-Y|0v|Cjox^KED@qo)zFl95aJ>tnO>Wpp*M@&jiT>E742Rvaf$bfRcY*@y zq8TY8xf%3DmqDa8LxQvpD!2H*DADh~6e7%qv=wwj-=|41T#ayY5{gRz@#I-3F1di= zQP4inF&+@QN%zy2R*jOKp5zgGC#>i~$-Z`V8Uu;?561O-0#p z{$#~aS$q6So?CG~fQR<$Uxawql=7VVT{6Tv+}wA#!VQh#k)T!-LZfdKs7I9&^Sdi( z`^9EXduL?ZyJ-b6W`b5^-`ivbZ4W$2Mbhi50aN;UZ~ ziH7s*+8_Ry7>N|A`cmZAqV?_XB?kSQ);m+wYt5oFnG4N%&d5yn-0-5uU$T_GEJxTe1C%Q$&5sdOra%zoFrL(qusK)ox(EL|56) z$i#Bn{67KuE?>4UBOL4Mu@&t6DYD<=t}f(tF0j@4mc7m|c-||k&ST4S>%7-dr!*Zn z&dhWRCq*)OE`vh-tKzh`#sxF#0aUn!W5Fb$f0ld;imwJ~-Tm}=5MlVJ{sk=V+4_cH zNw9l@y>)~Bo=Sk(nkz&O*71OAT>Op;WQdL>S-WJHQWCIyo-Z6B^l$(*xf__z`%8qM z1MkWZIXWKU!8I{VK7uc&rHtGdeeQ28Nm^)cCb!Sl{htO9JuYz3!gATHMmwF)k@VW{ zWa<3K@?0Ku?h4MMhKs$Wyfi6OUdUow0)2|YfKsmCG!(M>XsjeGVmmvcT4=f`^v*=dlUgBJQx zhU+`K094A;leTmI(vJsok=pY1ywrY;9gAZW;M)pe?`@yV&%rNC$Phc-KGyY;UOOv0 z*1F|9R?8m4`u=j>?_>qSYi#!lk^&+QbC1yLQM^Y1^EVO%^QI$wjRY~K8~s9V&)Pwu z<;)g@>pBYb9duMGh0ozWCm$@(9K20jhrdCG)e-!9hq+nbC#f zZ2;BH=V>7-tN35{>Qm-gIY|H9{>q=Td0FXtiO{+8Asl(r%kVYE&*gEo^zW`eYa#Dk zh-}Iz?Zd@n1H0h&t??bpaSN7P^UT??6;v8nOZh}Gx5N5mh$Xgz z?gD6`dhM3NnYtgQ>58O<>Le{h%Oy60e(Y?BSHHk~G8o1(i(}*Gz@R+QWenvr?|p~k zzVR`=H|U>SSIB9@@Uq;nGxnxeKcPSXd|Icq$C65kIc~1F@0THV`Q==$pmH@^iudX7PF#*OOnT;*a>{IehJPGh7 z7tBa1pstl5TF>sjT&CZ3zW(~O6pN3m7x!WQ{`2(R(^5vO3xe|Hg11aA)9V(2-u9f} zEw6j^voE*#JQZo7KVR>~JDNR&*Hu^^MxVR^|F4(v@A5?8r|12sWw2pvS zkDA-AKdyx+Z+-Fwou{@*z%t01b7F(|; z6eZB7xB_(DGTyNfVa>&5^{@<8SKHg&1A5!`EPd`(Mcjmt*~$fdhKrY?>!?ElwE{|R zp!)A3N4>RAWb17d^-`LD&hh@tlj1yofXZ@me>GhrpVGbRhQ>BR)B{SH*`s&^w9Rg% zG$3TMKrX-8^W+ciwl9~cxqB|D@;&z&)yu`6V0g6PS?BL3 zD$lda?EC>MuY83YX4Ll)b(Eu>UB9(3j)vyElM!6Dx&s=g%Ah9iKJA%ZWZMz{)K?zy z%P=ck&f|>gOF2G~Ullp0OA+2Nf}T}!yZ!8;JTIK#JkQ5|eT}ses6*^J9RzbWnHF+`N7N{pv|^Ed0RAjbP*9x30hJxNqrPNI4i)x|N1T4VYC z{}8X{%H{}^=49~(n`phGId&7Ro6_DCa<`Hp2Cd85XMg&T<2SJ!3sqXEVh%*8o;v<3 zVuUY3_;mVPhj1SvMtC{G3k%bRJ*Kg%ieqe#n`6loFW7PrvvYSRIPPFhD3Zx@q$usy z9VpZBYq*a8vI}PT3qZX?f@nu2iwTH*Afq_TZIut|F@V@i7sT!c@cb9g(`6o&A?9&I z^!8=8bu~fKca>+?@2{8TVjIm+i7|o7YF2DnjYBpV59-_JaM|EHhj_kdXR7a$ftTvg_1*MCN~-P&cj zIIWKp;_XvB42Se9aTXn4%*Wc%Phzy~1VA-?en*;*_vkSaD+8_bHBsIRTIU(!-Jc2Z zeprbxrNi@wNwn)dNvC~F64LAMn68sMAwGxdPj{j?QXojzP-{M@FUzp5Lk9Jqq1?XL zPRaJYXjv}47t8;C0L-ql zv`}IuU?|l(dv1pK<_jRwb2EykM9!bTgou%t$$W!YfBaLm5baZMXsGBUNm)ak^6XKD-7PLRK5bzzq@xGRSL5%eW zNVF**VgCUVrQiFkc;_CXZmXd>>;!Xfh8VuVJk%40$wU3R@YR$}fyY#2`CWXP;d$5d z1ZEermt=^So@Mg@#T5Xm7e$ea>27gLPmz7O82%nW`1!MkV)S>3_UOD>`X=3XuV;w& zfC2&f-g<6fne56q?I>CPCv=FGoSc+(JZAg*HN@zUp=yDBEiRUHX^s|ZebcMo5*mti zEHC46VuQTPVL#Elp#JCCDdV{}y?XN;?w3s0-KXdC{j5n43pm=_HHYUEP#x>7hY+u} zfX6oMKST`rcX$C{3#U!XM>w1hSR0FQcr0LTB*L3U0`71@OuGZc!*@VjW3jlt#@Yf< zwNi$I5Yx&TE<#MBGRR!Olpf(az}iK;tv$4@ix3W91elhALN1H7%23txbJX6o8+5G* z;ly~rv`_!@FOJ`l7>_XdfcwYLv(B}T81z}V2ym1TZ`+$*y>6}+dZ>oy=uVs@u}yP< z*_qDH5W}Q$WGUb~-y}xjB&njhSW_v&$qZrVb-g%O!{vbKd7d~*V)XpJ?M-5ADh2$d zIQLN=s5iQ(oF}ndQdDN!(N9!x!)1QZI(@#5N0OW6N(l}gsQ~G7zXWO!?2+J#+$b|*-b_RD{gMExs=_RIGb@7KBli2O~+FH~2la3hWh2ZfFP zW4ulz^Ez9P@;aOPNYp=lXr0;@yiT-&7_SOCU0eVWZGcogE&iXef*7r7QuSYS-SGP* zR(D4)ueUe`vXd&qxu=XPw2@KpnGR))&G~e|Q1@><^O1iXlph zcpYwMslzYrWd3?gpSSG7Rvlo&0s8U}QUo@ltuPgIs~nPeY!a=rVlo_lo$9iMuoqyO z4jbzGdzoD~_g*qm2rU}7X+>vFg?B&vgB02HijU>R)YzD_IDH@dLGn0lib^4mgJ@u9 zgksk0`1t{1B)u#iqw#Ip7gztRY~1PYC(pQ@ z%hS6QuCH72{+d#RCn`L5hnxpdy8g1c$9J=PU%GD}5H^-Cm7zA4It8j}Jq*8OEy7)C z60_S&S|x7N1d+37c>N=5b7A(`QXaQ1&p~+20EzY5^Z|dGF#BydO``H_geRs6kCiR8 z^5X1%a_&CcU8s#tH#z9!%g?3LhwFJe^?5_-^ok3jb+ZwcU0*{diPPz(;pilDIyK7> zty_igzbw8+1RcombfD{44kElJMPhjX9y@J;kRh}k)P(@Wt+CgDuQ4fs3Lb<}0WiA0 zk_XZE-XO+*UJVgSyNPo|{`vBu`R8juV)-3v=0M|;JWwYhxGb?5Dt(YR0+U~PB&(NzTy`LR`Z7%^;<8ju@1GDNKbSEI&$-Ho7Wp~;1a>xG;LN2S^9jz9Y1 z3S!)D)iE34k7yk()CjPJeUlV4qPir@sSgl+?yuZm?^JpCopfmubb%3q&Uq01*&D=I zVYM5~(q#sK$4-keu2a)O%ZI3ZJ>OTS7eHj5Rp0dpfAMe9g3?n$ECxKfVFfWNtvV3T zmr>(}#>v9A$#P&&+Rb4xXHnk=#F#?M7un{vbeOq46+K0cn>BwWM%OU(w6KSK3aGjH z6{ubdrX;X=lE5*~a~YXf+U_Ih zw?0QcxBqKDPGpF8<|+EI@_*5f!I(3F3mzUOuJnW=oA#Wi2^q!71%M?4m(_GY<9#kr z6L+8XOb6L^1g7qKM03F`mJ?++k2PX6W?u7I3-jF#Gb9(N z-(O0MHE!r-=kv#sF8x{yjb!$9xe-#FKXnWcb+w~h+hba2CTK;>FY$G+e(zG@2Wr{> zE@l3V1)Do5(+R8i4b3>P~+|UC| z_vH5F`=+LheJPHS*5mYH9B;=D$c+cH&(X^=9F}dq=X6c&l0ltlA9JCs*FL0$tnpsF z)OL3|UJHG)bkOf`*f_Xw9;iQhqV_Xn2dPH$9SF$4IPWx}JA9 z%C$Y5rS-l`a%ug2LF-e^DFRSkQ+X_yonG|aK!)LJvzVlQ2X?X@H?mcR*nO99pO(RX zeI)C(PiFhI^OD@XHE$^~hWFLwcRl@zi}_#<-bIOAdJirkM*b$W^?-7^De^!ExNVKc z)?AFUykVCF>LW{tLCf|iWdT}$x3H<(zstrazxw27n0TLF!erORF#|-UIxl2M)dws; zDJ)Ij{Z!5!gtd+=o9H0^#V-VpY*2JUMz;gN4ghJ#QJMQaSv>Qgl*=;{61RsV7sL*T z*kTuGq3x0ulIJpf=AvH{VibvW(JJInDvzFJUl%?_ufHuz|4SX~qWcoZy7+}-ue(6K z=d6@*Op$a8YvZ8eVL3QJ3rvkxfvG`x_%lmRg{i^u9~Y$=jy8*Z+Ar`U zX&aA!!ZCt6gumNILt>;m2lw-5JZ_%d<992rK#!6ixV8{l{$h*Mc^wcwxEinVMTBHVU~X2Sif5@Ax2^~l~uAiKiV8QKdilU zRFMKr5(Ja05&kXnm&oS(IP)yN_oTt|`0XdB5aQh<^;bW;#5SJ~D|+&tY=1spBJQdL z=FrWT5aVOPPm@ZXnNSK?j6m~7wDqgSr{+(KmhgAUd9v;kdFOpLynslG@26J@@hW8q zf2zoV1Bzr$hUU;FfWxm8z|N$1TY24t0$qWo&?Am=^F_Hjwz(6umJ|KE znwIm}+tn<(w6JoKIr?VMLMpo#d$xUzh(WjKLP_2Xaps$Koj8M-KMRTD z-M$t)F1_u(>{_^DN$%eMVu@pKJFox}d7$1qC1vy|Qa~zWKGU&0&^o)Jnemq&XE^>| zkJMjXsJEXkE0{(A|RAG)k{DDajNwEXXj^gZ9@YwfteFtW>hzg_%wGM~ph zGC+*ChruSIG-p`<66;4%Qjr78nSEEH@@A2X;eyHmMb<)>4)c7Htc5PhaLj-MJieas z6UtX8Pgz?CEn95-nW|)E$M;vQO|67ohlYHeaqAk}{}!7Bjl-WpvYAdfT0h zZhI-+zFeF;Uz(UN${${_$9qdW-rJ6y(I)uF9#+nE$R+ql@f6NSTp};5#C#3kezG`2 zyx&zIno#o0?SJI{0(O~;&CPw&^uJzwY93Lu`0Hhu`v-{eE+O8e8+Q8FpQ|4v#4DE} zycU{6bdRj2`_Q|s{CDEH%kjKTJf93&NSUh*K7Z79mwccB^q$ig7E0)oG%>Pz@w4qc zwt1_wVI$DJ)jbRFcLCu8*8$Eu#ooHYK398PdfU&lbJgsas}eC+wN`A7V{dgRpzb^~ zW#pA1{3<|~`5T>SO>;+z3u{9~AX(XB}4<5F{| z)(yS>gEjhdB3D#1f7aq(IfY?m&}VC;=1`KB+cQJ|y?9nk z_#`1GyCqP&?mq3ASID*_byIggB1dhG_k( z+%6(BJ-+TP>s>;E=&f%NZ;h}k+24T#(S~JN8v=V?$nPA+y=%vA%E^Cj9u=`00s}Qr zKPAO|p&4cr9J*ctH9VKaRhd*iq%?Jfv;M2S%=eJn%m(wb7u$0ny=2ofq(E&>PE_8u zJ*Qi8H|Q^%4-rj)XxDgzkJq*BkN#qARrbvO~iX2ENih0e)RIcW6E*xLl6R`XFx`a)S zuKOb?;?*v;?Xl^3y7X3dkF{ScFbc)J_MFAG-10fJ{Zo$qfn0V>=cHcA|pULucRdoxwnASJZ;^7%i!^ecJz_R`HDy61<4BXD2nV?!OdaRCs9yqg@kPYoZI+sL%zxV6uUW2J z2wZa!*OP8ywhk26GNfv_T!#{>J+D@RYU#dt?XJn(r{!map2aN3N}QhEbe-IH!j7TM z{obV@VEGn)_bV+HKJ$wOFPblY7YUwpj(C5L_}|6k_|t;x}LX z7KmTB_#GjBM~dH3;&(Lvyn&P+1^cdyqju!caG!Tblbb2CQF=DvgLb7=@SI{v@K@&9_q{~H|tZ_NJBa`u^rA{P?Xeb>8TZzS_Aed1(}WB*hoM8abcj<1ABxD?@M zR$I9lIFD$a%zd_=s07cL3{ma(mmM~YHOdEWcf($0n`ltlU&wq*@1uINtc7U5g6uxF z%;fR*5P%A;^S>)0f)t1qGrmz~)+$ zyYjWrjA6dneG%ow3=hFvyqb;?uuq2Ai3@p~k}KP$f0*x|y@<-PWsDvZY1vAM>?g!~ z=U8Bv>mRO!h#$02xEXXQwe7wi$iVPyf@e~B3Rq4n`Yr8qgb?F>08htQgl}-e-izwb z&_{q48UJS-Qt4F zwuPb5ErUA$inSYV1Ss6nKKXtPD)y}{M|i#ju`T%suPq1snG43{19;Y+f$$a(&(8o{ z=YnyOI?&%I#JhGP!cP#w-%SLJ>9Z*ayR2tZ0RP1WqW8`sW7xaXvJ zK39BShwyysSsmcN(q{`0egcbU3jn`KpIwBo%X)SZ;070r+e4pUg7Ex)@%$1|X9(dZ z`oyyk;6Ku5%Mo^2&z1vziaxs%;k75kvnv7bq|dHKc+YY1>}tU7JQ!!v=W7slSUh(`cUUv0{Gj47Af~YTVIOEpZFNj*R;fz})`s)T3k5FHY zaMK|Y-9+CXBI+jV`2vJ@eNLkFb^I=kmaC=zhs6K%{Xa<*U_`(zjS2v`0~H(2xYhs9 z!Ti9(<_Ti$ALQ-(Qbg^c`i00%w4e}r|MKKK+^xvwcMGBSH*@A;?xzJUO_CPca%n*S z(No0x@09!XQ&fM9=fvRF+VICL>@mE~)jn{xz@3~WFvn&B)lFiZi?aK)?j_K7RSw=6 z?S<60^plHnW3+#EAu*5@r!vdoi~224zde!XEPMVKF}BJOPc9?|vzd;DXww3Qi5@#` z5iz2?-JMpuO+hBt?xb!0L$q02tc9o?&+LB}a{te^V+^xA{u=;~pU0XqwEXGYJYRCF1hIn)iSaW>9c|UwI-XmU^^c|d`Q&CvKM%A} z3B$-LG0)3z|HziNiBU5O8WRer+D}nC<>gI;$L)dw(T#*-qfpvxe}~&Gnnxm*E8|D+ z&^iDQP+iFdQRYXcl$+WDgfBcGFjZ#qoLC8Eym|ZE#Mm#xVc)3QyMC{LdIfNdbz1k2 z-{Iw(NAh#<2GIwUBC-1y^1fd4HZkaW(B|^HX)?lXqak*ogC6yZw9uV| zcuVP+3GqI}`cYz@OcUb}A>P{;5~Fo2!Y`B~{9q~I8<#_*X(Ym+)a=vBf%!@Yopsh~ zA*zROYGyeU)lIU*@`Td9wB>=i{S1an9Gl|!uC^{aH%k`{jXO>*BF3$Rc(+eMxLbl) zsq_1J+_!1_cX;l)vCjANwa`IF?m8=GcZbNE3Tc5kI}_oew}~;E5N~Rsqn__-p_}QP zlq1}>ocq&nD+heB7;_tdDxJgq&ZMaby8%3u25l0kQV`+fQNpklWB`xkL%2=kG4MzC?rZUiUgJJm!Z)j%+Y&o1zYNO5x}Fj^&;>*Br7fMt zX-ip92zzb3Y_G-3dI;&Yc-g~G5pRzI4DXb-qX~@tCP4B1Pi6HcO}51ogtnY-b6B5M!!#;NtB)x5Ec6}QQb7O%6i@3gDB;-sM*MguiEQ7krQBUoq*?N9t zt0!5cg~}E=;(%;1#o=L-#lkm|%5h>$ z-AbvMHyL4j9yva?yqvMIwcyf1#nxJIX`#Z5Erwr$*uNIo`k+d>|MF}fypH)d7xMWZ z2jI!4`$U6AkU{;2qmEs+I`SQJ|Eq<$ar^mY2v3n9mNy6C-$)R9(@|Ib3N7?8m1jH% z=S`*ORlZ5TrDLUI{LMKC|A>&-5rM-ZxwX)TX)#{67J5H@>b3v0y{(9(H(i7XJTV`1P-Y@6P2oxXD4B<7xWa zb9p|qSz{pf+!%;ejfGgPRrf)czGp5(d}AS2&+u}JP5%VH{_+R9&41Cb6_wtN$4p{r$v*UISOzi*oU z6G5NWkq}GXKcCq@yQd+1M1n|iCSv#vUYX}?tF^EJW;w8iMuB>6Maq!eC|*+tjeZGK zdgdnpqRWAwmzv10{tQ4Qe1ud{8ELhgHWFtc{5|@6Ho{lY-)RV6A*b0|rTS8G5|5GE zUI&rZBczJ*lO)RxS!({e4kErI9Lpuyz%eR+Mavx~Ra91^G#F6>5r*GQ=jwcj-%p=! zmh@lLK_qd6RDB}K5lZ_3QEo28AEf(_j>jV~oZPjHHv1*s|Gnb7!*e0hipe02{h)>N zWQhEN@)f2)Z6gsLkRYNRB~{N2 z@e6q^=l+H6qi0Wp-rF7@H<+u&16n8DN8Ws`^PzjZkJA0val>u>PXt+>hpMn#djD{I zE|L%Ww)5d|eTJx1Zs{Y$`}k?lJFj(|PWR$kH;QiqSVv{ly4G-j>0CDjvtNHlS> zAJRsL1XWcM#P&VT+YMg{j}8~F+*BlTXF%F$&5+=2`JhK$0e#c?a9B$7e$h1~@&?B( zxi!P^%Q+SUAJ7By`dCgpTw}K;@heru3ZUnpCbk% zo5S#>9KTeb3k~LPKc>jG9PTdjX-FHlNi64Jr-xyo6`K!8Y2jz)vH4SSn%s6*#j^DP zRnaR^JPHupCKs>!DS%49JxYl8m{J_rCd0Z12vM&hDHfyZOOxmn!gCdNDIOLReP4On z&{8DWme23MUL@QvbcqaVG@oO@SXkvUXrZyCX#?nz|K+o_<7H2N}kSUl>{ zf2Fwood?lHU!~Zc(XOvVj&)!dwhaH=5bsL9N-=$wj^RluZ2-xR;Vwag2L#3fi{+Og zo|O4s-X*0CEzR>g(eL}dl{O%q{r(1$GBoI)#lNknw8oGScbD&wp>om*<}WCl7H)Ht z=Xt5}436D1sMA?vkIE?iz5-Pp`3P$YUFTZoAO6MX8f8c{|0^Clyy>eHiw#8*M0bxw z?L7>Cwaj$)r9?hjuXzcijRZh2DAwK*@$FmxN*T1@t!yl3RJO_xr#ys~`T0n@#7Okfw^o5|+M^wV`B^;dHmO<*({%GO;59VI>n8i7?9bb7w;13-c zfqm*WJqHBY;JAz^D7c*Xe6D^k^RaAz00Mf=*3%}03$6c^g z0<8!@+5sT%0Dv9Rbcjo{Azlw!NJ80|PY0d=ehAV=I3M8%{T+$$FX``Cgj?uu5yEvY zEmZG@7C)M-Uv&;Y+pV~Pt|3^1U>;MH!8_BW;CFOiQ28$mpxy;(;|>|{2f*`^S3n7S zz8=!X?fHP;r_V>y=N|U_KOk+aAIalU?RU-f+*b%s7WYm8dL=L!Pz(BhlU`5!t~ndNu4^1xDggpSiEgGy=EJW>l$x{WypA}`BucuP4t zsY#$({yxemb~n>fhbHTn%%FT6FiMf=`cgi}bggf?M{ZA3Sz)%gyPYn6=ZIf1w+ce> z)c}oaK?>A^f21F_lw0ql`&{k5!E?Y#4<+ylVLqfmhHY4xi*3m0Txg@S$42MrC>|b+ zCmtGe;RjBe|0i<%3`f(Zku1(t4^kdONU$j%;qXMzrxRjm84{#tc6bfw=Ma{QBdAS5 zI6MWg7C<;008H2D?QUp^)lJsdc(oASn}0YPB3gc3dwnTjO@?TfQey7*YN6xPIgL98 zNK~sv@i09zD^WaL32|*MiihVyTst4d!{t3&Z{9X(S~JS@)DcjiyB5O4Dc@$NC1y-Uo7 zNccFZ`iv0o+ERoE`>^pW_Wq&S5J7#UYCj>~`DtR@lO{&D0%mxCLyQ+olGf}J;YmYMC z-a1*gVh}!TVmWE5ocYb|_fE|t5vJeuC?x^^p2>sx`(JNL87M=7&G|g{d-GU?Wf@{x z5%W)r(Y;pTf*HF;0K?9rI@Dl2{n>h+Yf7;==l%Bg=*+?QPc@~CaGF$o$mzgjN4Zc7 zJ@S0YKqpBypU##u_4}Vo4dx2Nhm>bNbVKiKH}v-X_*}j0f-!n2Xr1^U|9M0!<@vLw zN}%qt^yn?;>Jvc=EfsZ)K1tL+65`!;&*_gQy5X4`fI}l>Q0e$~yP>yX{kghS0KNYC z6Lk6dJ7(|82c6ctUxq`pz6N;sk#{?UJeT6RI5@6Tu~{$LSaOW0ZACE78q+n;r>Hzv z^_XL*cdqfV;Ls{L>YHyI+KOO5pZ&-OKOyTE5^p4M%**WnTJs z{+B6%$L}$fFH=UMhT}8>{d*?=JN-q<&?KJEf&Tyg7byc-_zm|u@EZz2J$F2pB~MSK zjAU_be4-03ON#rct~(+A18>@BO_N|^9>PbT=6M+?9mY_d?3QmWOZ*PviR~y31^u%U z_oKKMv=F%9vc$^}PfSwu#8SZHK?{`&+5F0M%1FG3;;R){_f9^j$vY{XOUw;aE@C=H z36rmrnUs;hB-%BT<=kh_{*a_pBEjSeuE#u6nl?K6NibQ1aF60KyID?xQl=~1M`hYR z66_w}{*$x}{pK&pl;P_m!Ne?tyO@kzYVJy=4DAGMdqMm9RLVg4{nd0#efco10=(T$ZBUe@AC=%3|VS3etEFb*a_k#C)U zw%-NsB0_>a1&i7f%IRj;Qp9|I>E3(kCSrt-kYHk|)vvO^ERr%h4wGn?GCsidvtqNv zn>KuhIi0#h{?~QMl#%=$ir=kBqfjpiUReO+=pLYBWSEKt@VCV$rCwC^34Sq?oT*` z4-Vd8@mx&HK?@0tF|(V}Y7hsx4DnA0@e(C}F!w@VLmta(hz4<`6lNbdewC}8>hZ^wJQJ_W zZ^w!fIH}~D1Gg2lrxZEx*)m}ReOcH*XG(E0ONw{NP!+C2@x-GLUq1!m)e6KTGDOz| z&|uEd8S99VxEL^9Q>_5evZoo=55E`819d#DZw25I&^k}&_Jhtc01tT-;#9{iks!7| zQ*ro7E+hB)gQa?jN9&|*(DUHsX8ACZL4CPdIUJ_Hvg@!Wg9NXMZNU2mKCSbKB6Kq00`*ZujJ6S4sLl<& z$PK-9;VC+Ne5U>?64=G3X`xooLMv;D0fkzKj^Q~%ym3OR_GhLYPE=@}teO8w8M#F@m>N|L&Qjq9NLyC+NvF^g^;9$4iMt?Ur&t03c%r`BueM*ozGLo zfC8rPD2YxyMEUl3^HKVH73Im}&4=mVH}k(Aq<`PW|NbTY`#S#jFX-P5fZ;HSZYZUC z6vX=PL0i`sA^eyG!LZD+HCY^*cUw8b;}4i5q{_f=3l~Nl3#ZCm&^iHKRsp8{C&9#{%nnnOcn{+A z+m1=@S!+)U-ailF#LWmVOr(tPKS{7_^OE)+WxUzF5V3tq&&<|?B)EP$M8oH!c;ZEf zC+OaD!HkY+pwe*#pCU%$E%BV5e+sDEuH(KLtun{2UqR)cHB)rD&l7c^_jS8;Ht*ea z=Oq=lp6GU+$Kso2*8Tuo9as8ViZ>)L<~}3m-AD{n0af(xwi}2+X+r0zf?;coHw!4; z=kc}TqJJ+0+|fm%FOMxd^nCyod|F5&#CrvkvC2&U{xkJ8mujKpYQU9KA%ZF0k|dg3 zjc{Zn#9pF$BjRn)b+M7PQ)a$$nHHKdmFIph5%Jt^#q z@1c0&I)v+7aM{fzX#=K0u4p4JxI1HoHcTW1n(HnoC4lATPl{-0;9wKJ1R==s0+y~t;> zZ|m}`XFa#|T)LZ?uj@equ&w(b>gUDHc+b1HZD;Z^cDA=Ixdp7`LBxsTm9UZQNbUfO zfV3@XfYtp8Ng&TA4w#Yr1QN+r#5yo}80Ds5@9Qu;#fZ{O&dv>)TFi$3&JxOCS|BeZXs6p3St3}8k9?X05z$DC{KCK zdBbT|k1x3b=P=9cUPY|LG%f>NFF`2vAkPDUbeAaHK8Lt)kWw%7)8OwZ^`-$T8=S<# zHZC7bGg}70_tZWd=PF{cy1}5S>n0By9VkEOhK6t*8$Rawgnuu_Tp`B10>}3$4Q|9WN7~_lqH+hcq&}db z)QyDkz*=bi6yKcTA zKcK-2EFnAHN~~9`^eF5EEM_1LD<`DI{}&qi>j=_@67#{ksKIcefLQol)Ut76yZX)u z^)5ykU%(h~;9mv9M)JRDFzw*{3+ZqDzXqSLAl77j z?gWeF54|<>{B!vHR$?jmynyG$*Zzw#+b6-_0%E~`(OA!-xF8YF@8e;u<+ zrH+sUVRC)R%36Sy*`D^Yni1;V2vAu9n)(){-s8p>q9=|x^rOr9ns(pH*R-dJSWAbg z(K$jZFTJ}d`)y{?TRQ>oUC>iRq{vWO_VE< zuk|TTlZ@tlP?#+NWzjRE@@Bq}H614Ej!VMzQ6_JG$mLA{t%xcYUXoPgfTlp@Q}raV z`68w#C+ZZ4wFUSY+Y@(+yr20HM?Cj})>SrIyRq2(-AUx_W#)gtFv~-^>&`5m{^59@ z{)~OJQ;-lM~$@t;_EF0ns-}(^xyrKkafr2xYfUne(B)Gk-ey zv?f8QwM{wQfxoijbf?5+RebM=kTu;xCjBT&COw`dllElEq)AG>JJK{>{{l7K-@0Jc zTI3~^de@FDKN23?_;~pj;WXk^Ya5&n1MlmvlzRUnL#$kJ_cjV1`!3Rv9z|cRKrhlT z3EbOOD^l+PfDqn8T34sIw;`U^3tES5zR6;)t=PKlN zTjKu(`2UUk|NM_^{$Ff5K1v(B?s~B)ePqj-#pcLKE*B)d5PO<}uASKMIO-G?18F0* zgJg936~x-&9yU5kAc%S{@;yz+mm2QFd?8=vbNMnUarqKqzX!ncSAfME0AkF>3tYCe zDE0mtT#L0VneMFcQPC8LJ*Ys{W+$-*m^=p7Gc;`sGXGg_M@ByTHchkImCT+{0l~BV zBKC0w=fm&)EzQoadL~~RJ&LsLW-h<|=pShV%GkN8>XyKR@`L2jx>hT2I^E>ZQN9@L zQS=^fdl~&1$|C!AqO6_VK@za;!c~lKAAtl>+}o0?IV^kLgGA{^Tt4r4k0dmF_D!(5 zf5v48e9q*DpP@`R)BNS6VZ%2Cg7~g787fyRvwKfYMx2=4+lF*?HL=2 zCmDQ5DznX>m!ys3Jr4atC}Zz;GQ5Ib0=s7Do)e>z5~BizzjR# zrZewB0_7c)U6TNz&CTIzzXN9YXG78EW?wbJ!cS@NL{FZ6l-2&o7kYKssC;u`*0ku8 zcTwZStQ(?Q9t8P&PVwIC(f5v*Pm4Z!7d65T2p%uLf#u>$Dfwpid+f}l`5p&^l08?~ zG&tdK_i`b(^yJkf?`)_>c_n$LzdEJ314$*{Ob@0FpA4}ilj~KO+Vz2^W)bStiawFROlP+r-AG8rU}DQ>fGI?61wMc(;h^W;HDd^|{vlT7Y| zmKT7}mDzK9Y3MC6Mq6$l z=F?l%>8NMr3t6X!!|N&l&#}j@i=H^5=*L%}yim$)Qye#o&9)(G_>OV7*u1^pHEd`{ zsh}IBj3<8uAQ#}gPS^X9@d`TKi_H!SgLIBULl56qS0%9FkO3a?+T;@J@ zYi3Rh03s+mWzT89YZzsx;M)AUBWs;71K-~J8@brAf(@!W)^SF{{9#b49 zkE@ph*!EpR{M_1p&hiE1ykpl|860M3daNEa-rtO}{{Zuq%&D#R>nvNG!#u-$5$(Fq zdBVp4SZ!##R&7UL#$L9hpUZqNjQT%Zz|QBVvKn8!X6|SE(}s`I#UekE*~9!Fy{3K6 z`qn@H?=y`pqkR^e7xbr%jx??GiJ0YmEDrItap(CyAfxdwNf}~(2hX{8PSiviP#oq5 z{md2~KzZ-a{b?g_BiVs_?YQDKaSU&4B0G9mO#=6r_+XjELB6raF*I6}NX_*{%JuEx zV^c=$_$W)A%NlE^7~^IcVttAn!12ZUnLh>_-!I0D&to2CV=G~Ko>Ic!65)g6u*bK4 znA>BK@8Wx!sEr5Wx$U1Ywth62J`rEf&MxOj%rEII%aKK_)Xl;!xdIYl8D0#_(u-kP zelaA@=l$oa@ty~vImI|1IdD!<%;f;_b8bnuW$K#;_!%nvtXFT|NCSJty)TrdI6_;4fM^$nu>5km~9j=^H1Y3SVYp)Y0G$= z{r?_I8wZ7KhI|&^ds(y#l!mU%X}7K<)9xD4Zo@QQD`evQ3_1QVE@E|moihKIB>p;y z_4lu{*nDfkdXZV*bxIJ!?=*n;fktct7>q@|)c9}ko|Eg3w#=Fb;CU7A7l7p(p$xaj z_OoYBg55O)101!C>8(u=yu>oT0KD%62!v~ljxmya687C{Pr@$mA6M|oY!RWm~;;{ z%8A_aW}1dRl%e_KJP6^uZJIpq4r(NaXb|u1-$Zuc+Ww@G8bsXdUM1VbqGOw#03o@E#}U^9tn94!ZL9aBjdM+sj&j|8r>5?^J6!Dt`8w&&N+w5@ z6Zv!lr6JU{?J?xv!R!2RU9!ZKinOjng%Dx7N|Dy}$3lp_LaFz|db#C$eKeGOM$z}P zGXh(mlDEAsbA1Z$p+2=smdEH*IIkXe+UUC(68}r7_d5mLKKIHVYRDV;ypgZp(nyWY zAsXB~SyMajUSAC$UDt7Ub#-Yz=;h1B*r#R2{{9-u&bc3$#@l;lOnYAQ8ib`qgSbv3 zYclKf+w<1-exK*1X0#My;2>6IV&jS@z!UAK^7&j^EDd!qM9~UFg1D(Dq`!XX{*W z2=}f3vU$2*k*O({Ei)V);jyKsMz}wvUFZMr?7n+Uz2QZouCVRXc)Rdv%=iE+qc!|- z{}X`FQA&*-#bffEjQq@17jVqr;C0+~RWKiJk*5aC|E1K> zgrDN8l+`%y%H%K^Uq9Ezk5@)m4Zfi5=XBc|%5-Lg;pSoDp!lAVlg?jRUqz~K((argA=&T||PbgmV zm{MZ;-CzNUZK~n5H|=M^Oi}-b0p{Cw} z*Wzq{ccG>>;q?-Jy}wXXSNq52O6e}-xl+F3&!KOERuUQF?^kE7!Ly+6njvJe_49OT zf_2zY!|70a^ttzjDaGq-Q^+VH-B-VIvUS7xMH z%*{J8#8&3Or(tFWKI^KfvCo&O_wy>Z7u8^YwXXq_2iY8|1Nxxwp?k5PhBD*znEvex z^fThwANy#?2W>2t18Gd_bzr?L{PlC`izGv6ZuZy?$+~}bW^7-m7Csj~O|{qV!)nf> zX4~*Jigx@yP5l>(Q<2TDz98l@%;&NW zJ1*`goJ}jGNpK3^^H*P@`@}m9L%bc_&)0~ye>hA-?_|Y)*naGO5r=2{Pi5!XqoS^K zy9}qFEg*wP=l@!jHMeUOyEBEjqu&<%%Jj@IpdQ)lNsL!RTDEq#NeJW6i_r6*r z{2^!Yvu2h%a7LQfUIK`tJ~m&5(3pL7G@yU}S3DNwO{9O>&z=nE^|l}C5Dj&r3^a@D zXRDu28(KdNu3N})ImyrLnJm%(n)>kzd@QLk`7PfV7w0GV>0Z<+k@kK)8*UpF-CwS$ z$WtGy8o#Fg>P-EgTsxJZW9EP&2hJ)=piglGj!F;&API1gn^2#>OM=knbNWk({?=x# z(NToU5@I2LMqb+J)6{r5L|T`C^&UWc{RT)NPewhr=@w#5VRk~U7wz|H>IZX?$AQ&3 zLgQ~E?`3C3TGy9mqz$DrxDD~{{@svh`Z8F5q|}RW9Ln+c=k`Cv&V6YfU_M8v!zkvn z)!a|DQ{>Iy_Wxq@Vo?|VY<_zg^1GKzyPmseOpZSfXzBp#?^n6Hex>NX{>52v98mOz`V7ANCRn?dtN7ZD?x!1b^tDwG`a&U>IXZybIl}nM?MU&z z=Jc1!>d%q0cI^JyOLZ@3>P*norO>7(mx9Ia-xJW2wP3Y=jh&Mx);WpQIVrrD*Wj7e ztWAf|^?48~FNBtkt06Q+fe_09=Yp1#GK7+ftS76$!f|4sJypa){GTuIAL;wY%vS}> zI!RNL%ZYWMFl{szkwix^#KT2eq8y5QFH6(VoubAL5xgXOKh1oB`K-Lsa2>H~0ebfg z(okm>Pk9M>6tt=3AT?hmL#R&t50fF(cnz^u1Dt+w3NW3%p`KW;n0#MfHksd(Bu!m! zrj4Wvg0lcTyTteVhPWMIbS#pl_B}87@Cf%G!7=;-_s9m4=oB^InEY2n5*y95QM{4a zFiv0Z;QlAr*H=yE+YkiMidrf4K3d7^qT1hm?s@)QxeGp<0tgv7&u71oX12^Lmm+rV}B0K)h_Gi|)S-`A_1qM_Ra{X<^Ic$qd||AxtV znI_J&aIPwgo8|xG`%SW}+w1i6=hH^`8nD9R`7Z3Qo>=})-?oN&uo|u*mao%y5Z}2S zpUEg=x2d%N&5{IT*4+=9`V`VxyRU`BA_~Op=XIc|JDyJ)9WwVt!siH^ax-nPb54NM z_h6d~In2RK8`@b~IVBfX*K2BAzy-&MvQvlXb2Ezp;%mG@zz5ghU4cJu0UtBAe=?dj zlE-*_cS8~P@7gCp=v3v{{-jW5ZDuac*kX|`ys(%W&xv~5NTdC3E^9G4ZrPn!;@6HDL$$K`U`+s&@B%)gVDo@@Z;CF+>PJz&7zy2wlmM9Ii|Dm$_x7p(iIrLr2GUNP2JY%}!o0sbQrfX_7$`g{NPA!H=I87_D zJ=Cr6o~sxl8bA>5vGGvK$2CNQY1GveQWMUDO8o5{q``ItYEsK(7Vlp#X{xhO#51hq zK5QKpt<>^K&C~gy69@lJb3o;X6-rCzBnWl>%E5Tr_wyn2;pdz!WSXW{Pu0}Y16mor z`(+pGy~PE4I~-8?!%AxGUl`Q=OEneeNgkZ1zcM<%Vzd6XOZAje8o>3qb}=Z*ORfZtcR*_1@IZvwRaY`wbPb!A z0}l67>b+Bp2giZqX;`YMJH&X7Dzi;Crj3~~%~_1RqfNaP@#JojfLoML-eQ?C=UOI^OEetsIK*}ejZy5=;S&gU4`@RO&l_S)P zxY9$ZH?@@8SidnBB1r`*+4nAJNulhvgjgLit4VBreJ(_NG6YL==DzQi%-riLsnN8A zSVs|tF4((onx@vzyG%zo9Im8B`3UvafTr?2R&4sWUZ(E`t!vF(i14@&kGT^2aX{th zJ0zfAGZ!MA`M}O&m@f46WqRFQ9uL-E)Ls^La(`tBNXcyE~3@4az|8exl89vPbDEz;sk&``q?Vx=UA{aJ#_pNl?5<&_53|90&E{UBc>eD0sFsr8=u%qI(RX0rsL zj+}3IHD!{p$|Uk1YqQ z2}n(YPcm17qxVwEYP!zwgKrzI)zLv}_+F&J4grG~hpE?(&u5dzQO-?5oBHx_);Z{y zc%DCu(^1ZdJV|~LyJp+Kvvt%~8LS1vJpXtK*X(j)^&J4cNBE;6?Ds^u&lb-K&ttJ3 z*~s|l>97n|GQYjd?ju*fBmklBPZhPEMDC$n+iFsRcyTt2pLFQ{Z)afqx!`!a&!J$( z?t`$SX*P$?Hi)`@ZBsP0;mgF@FJ!)diaaRUx<5f0^)+Gcn2m7zDi>_Wd3^!- z{~~HME)42*>ogU|q-~g|&$97oil+XZQtt`z&gQIlifr7TqN(o)St%)Gr3T^4{C6Rf ze86NDh(QPU6+&2M=Q*KUH zqv`ziG76$T+l_p!w@xM-hE_4(hEQTr7Q7vKtX7B(@9st7Ja{UnC-()p{nzfZ`^K^7 zpdDopDx8`&j@NP>?+iaf2=pm=rlsVY#~l!R9pH4blnhD=gd(zHhMW+8eIYf@C?zb8 zuLLx;`*|Lp`NctAn?LD*ScwM`Gyf?^ORFIfb3^<+55(ie5MQl8%RME)e4RGj0@i;o zq{jP{dbi}v%fCJ|uNM}LwU7OtQt$uB5X14jEkPW|vU4FdQc4+*9R;murNE!Jrb6g` zk-vGbnKlkAq{go)_1=-wpY$EByHVav*nga1Nk6jyG3lK*h zaYpf)J+)xXaq!$4_jaa@o?2oFSjXKgCWl!2AJllgj`j2OR4rJ0W^ta{{h+3z{PXNA zi0t@;#%^3l4V1r8Uj2}rGl6wXD#&r*FY%0(Q~&hkM=iR6}6hLjt;H8CQ7&1XIzOfc8^?pM^6>c zC;Xd*SvW}Y^v!J<96YgbJZ=5XqVe{r44?U(IAfH|enmDLDu{K~jt5no0ly5fh9xAC zlAyBjB38RO{{M3N_ixGc|GR}__aw>>?X0e()|JX{FKY@A>y8`1Ix6V=rxrDQLp1oE zi-?uTgP2btHMl>|<+qpJ=7Q}=N1kq)ue$*}?Et5-jZfH`mjrN)mhF%t0}7b$00gCc zloMy0`}|z~!#1RCgu#8qAZ4+}?=qi3uX)K1De|EV%?F2Rs8WW?p0y;=t;`A>eUK!$ z|DoF)7^DX2qrp@a&%KBD)(vLP+F#&%h54H!9&{@+P5(NM-m$!UY}PZ?s!H`hrJpOZ6|&5vkmc*8vX3kx&449iupVV>Uoh^8JW zhlnPFb&OK)J6ACOF_WZe6|DEJDnAP?j?&PEPA7!gZh@lJ*UK#_Z+qG5r==EODcK-9 zG!+W#Hzb`9DnAJ=b6sRZc#wu}zld1R$`D%vEAKgX$)}! zbvyr)m+OC8K#dOZ&Knkgr|rzxcm8Jqufud)$usTxqs-@!*{lyu=x;zIh&epOa!3$^ zDJWx0frc_}ch{iyT_5w!0?W=PwP%3&VT|#&@Bohupa+yuzXBfH!s-ZFEOw!lSjp93 zjpFUCjwtglaMvY7oHdJkNlkV|k9sFXkFNsj#LpqYaQgvaqrC$xD)ZXlNFQIBoHj~3 ztF|Goc@&6$@3UFBb}~;#JoD?C`toPTHv+ zZPQsSwK}t$^VH-pjospc?YBI5g+80b=74p4i=rQGQuLnXik@4% z-P5m)_PZf*y!`XgW6Df3`E!y;PUf+SNd>HAGqFv9L|~ zNlit#{Cp-vW&wD*y(^<>1rjG7Ar_qsiQ`IL0(qlDuMaKA|F?==|lWj%iF^7 zz0dMQDonTi(}>86p7s34Ga<5gkj8MX53q9yuUY@3ram?kBFS&^dYp| zwu3bMhEd;|64QJ(&DIjzL|8ZeL{nR5Lgf3DdOKxOQ~nyySI+6O$J`HEm#ZLcfDD!V zUJ1LW6r`D7P2YmCaFZV8aPtYcNz*j-Wx=CMCZ~;R7C!{NcS{gDk^Sv$PJMGN|8|D> z)?cWp&)~NT9PEFPyj%|6Uhg4eXSS_0smwI*-!M|x+Dn8H1`YY`pUCN zk9b>cPiX2DGa*uqcrV(iFf=tF+Nn2qI~UF5K7ZKOKSrogM{OVa5_3Wy`U47&i(4*@ z(utGLkOZd{irJ$$&2w|O-)@rE(=)r7uYJCWa_}!@V(pM1e!Q6^jw3EEBGz%-Z@~%0zC26~jpyj= zYG*j+W;hlfv2o19@^%(J%W9W(**WHrPRtzPJj%!Fox4pvOr7nee-jg8eTA-j()m;8jD;k#!yWIc<3UqKFZcx04gh8a0+!3gzfER zWH80fk!G@-7%V^V>;?K?UP>GPVshDRCMW&#xwO$;h5U&7{IK_KU!Wg)DQ%4A>V0#8 z{?{5)-(YX%mx4HAU*Za(&^pyx(vMpAk^;!y}xhMkq;Psn{6hYpf~Q;)T>J&GKjb?vG}+E>LLGl zm>OXisG|FQEa&rk8|LX1&tP9(7QglRQiz~lhy5p6O!aK`|KHgEWgJddeU`}?-+hV4 zcz(XX&J{YFwV^z(sash)vrT&r*hXt9M0VM^n6>%(eJ}Cck=bWvm;99Fnq)qWlBB8s z`AnMSSmgPL-OSJHuAd1X2?;_z7o3{of>RK=LT`HQ3LVGSRH*G_vhEu=&QkN%m(s@G zQ9pUqv$v|>dRCmbErgc&!!+c#>(!MmWOm&rU1@{J5Zrb}23HYJ5nrXfni{`C*ky!o z+_ej+F$U)rEYz=jDQ!GXsn;k0owx5b{a?IPuLrG5bFuiQ;M$4W|AnUhr)a-U*hCgA zpazej<9#%tOosg=7wU6fN*n93p9;_$?0(*!&-z*8N*kRD1a~^&FloN88e#hUG>C*b zKMgnlJaH!+#{Y{ct!)2;ulj~7#_!L4FKg=hE2z<37M0NQuxbp9|6uI`~U}= z9L!g8d;KAYE?>a(w^3VUwtpP9pGLVr;(me^d0Yq2&F$$wOZq@3}?9I=2+8H|NHT5oW&nNCRI5hQkaZl^#_l~;KMnZ;duTtv0*#+CrC^OCeKP}P| zlzN}e2VGN04RpdyFdK@>=R(U}l!jVmZ|~Zor*}5Uq^33vEqee$$^5#PK|1s)%-y$> zC{VTHa%$`<91pXW%f-2bfR*D4YAm~)8Vx1m-(6$BJB7b%T}};?Qg2%Entu^CwU{ey z;9T#Qft^)cmY+6=3u37i#Mb0>?( zUdeO)q?A%Kk5Z%aG|x3+#|Z0U}KT=PEEMLyyA;*cNW zI-ee)2Kj^rlld#7-Aal1@d!0K|Hbp&X#gzGQ1W*q;R8s7vt;XJm0dHzZ6-&k;rp1f zJg@%q)HLr@Af)D}jk8RScAI^*VC`c*i6!j+-%#ou#Q#_G+78&hHcVp?*?q9BSW_bf zpx3ediyjl{&y^(*K^ceuSmYxb>tX&-9+T1j!hrsl7t*}m{)BcpUW1u#kq@8b=L3v3 z+2;mlR>{#bii4dKoKy15K9=9j5glMPG*HgWi&~0o4y|=YhZM;iT*dWc+g~cFILs$U zsBtSmtW|-;paRwjrG&+1vbwIzWxYo!W&DPpZMw{talNKMFuj8L=4}tTV7vdaJSLa@ zhbwI)olyCp6XHujQ@3mTL{W9)1xw%YJ+vW>fnb^C%r|b4}5YNArr~gpg(;N^(U6?o^Sjo;Xip@v!xxdL;yS;RtuFc>v2cvEHoce?I zJq2R@!p{)*>~He8-gHEQ7}DELfKd3;)z#%1w1iPl+6%1SSNQJxtEKg2MGXK!yeCO4 zXMb0A9CEfVIkq2mg8p1y+Biw6*9%(L37V;yHBruUb|&J2?QIvLJmS>#=hH@889x(a zICNFM{zJTXA-~7?cr0Ik)_qEM%Pbcw!MFtY2$4LVh74dLYty>-CpqaPWJx#X?kP9 zft}xd%k$K#x0I)Tx)GjQy9u7MW8r`5dV6P6!GWFjc;7eE-hDE$D%OVwkk9M~h&KSl zB2LiP%F;G)fQ~Xqy@ObO2j~N1;uR-eI~$H|ucwWt&jZJ`S#W%H0yydu!tu2+aO_iL zQ*x2foWLxGg`F3$`hRAp43>5gNi-I8?yP?cp3*81e`FRDt6i9N|7#@bdB1U>m*<~G0MT+s{w?br~p0UB&?>Y9owChYu_c5R&xD|*GkW(JxLj25|El*G6Wqye)j5g zpiV$)8UZSOr0x&+UOhNWgzr{x=*!dfN18ysu70EZRMQkF`i$?u&I6#V^v^x8a~DW~ zI*|TwO4vZ{obHWI9usNrlXsod^>a)|D=}@Dz$C5fW)DP?5|5L_XN~!q3WZwNO&-o) zkry!ArAt$%dLWV#@{~MDQzv;Kk{f$AT4SORPC;^o^|}nF<3-xeb{S5ydwZ|3B1PIx zkhCt4J3kFi0}CWg4POKaAX?XbT@VeIfCWCSD_q9ySH7IQ6=!(u9!3M0J4i8}6+a+O-ixjWU^7Pi%VV2;6!9KnFk^uOm*FQGVy*0feE~!Pl{Vil!cR zBk%T_eW;_N4lIw4XZtgyM$iSPBF^bL%ekg_%=!XN-R~Y7bJkeEW6oZ4+c9Uq9vc^z z6^Crs=4LY9#azZ~t%pSTLSi+Pkpz6O{s_4C?QAIFe%rs7x$U`Ik(jONN=gm<7T0*+ zBwkNTp025W$8;SOt?LJFh;+&jOU)rx$wr7uE+z|D*goQ1_(HH|0C?8DyZn*|E+UCt zPMCpnqq4+k5X!tyZYW<>@0hM{-mvkAGFww0bF+N*@o+uQXBVz#c`3RiJ6`nSv2s~B z4?=f4(uS;fRwABBNT06{ZmU1_&=Jj%Ht>4=g^*Zx5hQS3cW-*=$Z@4O5SP7^S^H&7 zKd>4qAaPdl1SF8Rm9MWHP^J`bgF71sw0;`Pa}jGU5No&V?Va@z&r=_Q+zS$f+8j6* zuo{7#8L}E1J|NZ^O1+zXpbs-yfLMzGtV206y`5(T@lh^>Q}rmv=bZB|2V(V<1M|5q zCy?kq0Q&nQyk;!`u|S5HEXH8tuLneK2)Cv#azkWvtsQU}*Q1s|%eA6@>L^Te{JFph zp<)NpPAM>oBV`;%mXFX-qw}gu5N69kn%v}oo0?8Nbfo0Yrh)Q1=L~d9P|4zRzIDMW z#jmNe+^l}VnDq=JUA%}SV577ud?6(2H%hA-FM>q918%}KYLJQ5Sb_H++5zkyBz$)^ zvVFGr&WZt^a~3RaTLzQWJ*70h*um>{=lY?I!dL7$2G{8vt}-EsdX)DNzRN+^nEcG` zGx$3Sqv_*)-riEuhHXO%E8}zGxJyaG-iK?Qa1+v&`!+qa;|L5ao+vgEX+PX~-+%@X z$M@qEaQGb31socCL54v2n1;e2PG z;5)M5J9w`FppuY!#&`S!8y-g*;0K3^yk`#MJ<@gljS}NMR}0=#Kli}S-5>`lK>oug zg7=)V>xIo0^=v`w8o_6!{8}pI_Cp}NURb$Ld1s=(PcHcR4UFClV%X z8vC6mev`>*?00MDpV+S^eq9p(UC`lRzriH`g=*HGqqFHx|E~WOK&*BdoPHB^47}%o zYQF3zx;PgF|hV1r|ifm?&@!$0~=l{e0h97)Ano=O(D}+NV zCx&l^-Xf_{{C%QrXCCK@759N z^qs)J>1TQV*g1OFYh@4#Q(AdErw-fM9NFevPTnV!$pgpI29bDuq4V*!qys`44x_#clFhp&oNC&e;LMAB%JKe+szSKAn$;{4BA`Gpburh$?x2*N#l>ZwGw;1D{IKWQvm!^C0Qq2tgXi)XouhZWJo_st zZPYsCmImH#H2H`WO|1ew*#!DD%JTuGP?zf6vTk6s@w97%PS_ho|Xo!Y(1F`%rIJ_LlcbXiXx7@yrJYMUY)2j^8 zP`!)s?}G#!+d3Q&-CqdN!=kN2Y=0gY&1r}*%bd4maFxOCVgb7?p#Ob@;vTJpY#8Lo z^uz(7`=qpyoWo;_c8$KV|JN}g$m`6nN#j~?p*J^6?dP3_>%eur%%-d#)*FkD;J zJ%`b}c+xBKjxHjJL&tbb1L9c{_a3E{`0cAB)L`{!FD40Xq_*mP#F5FFe28`pl}tTI z3F*-x`)rWWqANHpB0#L=(!j5T-ood2MUIT^fY352ZQvZvD6*M40($Z>C5mJD@ramX z6-ktLLd(8k8am7NS{^$q_%gy^*v4y**&*nVT?6ZBe2z5eQeq{CDAP?-<-}@Wd4%BL zU&qjz-;S#hlj~#Lrf@%+F?P@~=Mub)wMyw^TSUDL)z`7O=wi^6Pp15NW*^tnmH(x?%xDTJHxd+{UjT z$M@U73O~%RAI0m3!3zI?U;hBFe*jkaYy3Jd2oV6 zSm8DNdjAQCw5|awd^f*ditXJER(J!yzC4~bS~q|d{x-jEnyExuzYSLSQGVUC1R|}E zf)#$8U!N{fBCU^u72d?J8|Fi#b<@Ak^S5rgR>u)o)xj|8<+UeFTy4EnxXXeb8TA0g>?iET)lN@9Kj{_+GF& zMXbgS%5&zt=7LC%ILlm#ZM1;}l>2b4!0U&>(u7afa=iWlSRk(7UIdZw*TCYnW8LPI zGY|=X87vUjpX5O#+z6JI=GWgm0g><;us~e@<0M4FcY~!3@$0Tw+6Zp|3&izDrAj3H zZLqXKe!Xc4M8c1P1>zd!LnOQjEY0HAe>(*cpT*B6bJsu;HSBP&E-Hk*>l#ZL9}X>J zHPeGy1?WFU8X$3gym}c#5Y}rOOZD*Qq%rj@v3+fcl&}QuO90#bU-ap@?Q3$LUTL@g zxw?eLa@~5&&n;tqEpgU%1%5L@9yEb3|8E+{fs4g@ebI$DL#!DBN2V`hI2S!1&f!>C zKTGNoI1cRZglOv`{C0_y82jyiN4pnjDqNI-SI`BAB2P?bIZ)5J!MbERM0~<-c}@Xy zg{aMG+uZ6utEs7J%onU{tnc-KQU4d)uLk?b|Kadxy*bI0t|j^L-AN>XHw1l-V1K+IPOU6ybiJ9Cg`a z`8Gd0Ut0nCsdJpZWsiXX#2*lL06S;Y5aoHH0Ene81&@9IT-N=qS@%E5y8pwh`yU|> zL!Cc@auO7c=BWZr9j4S9md58I3{jSgv=_&SvUE01PlSKicc%oE;oVo&gaH;a+97KA zeo5d_eKp^2emj3*WV+rk4LlR#q|njUQ06NwY~LP}{xUt9Bk)7YdAz6J8F2&6b{?RDK%K^X1Ek}W5lms4zGO^ z%_s0MWinc<{W@rINf2WBR$Ooh!ZUQZc3t&4fI{sDzHI>I?@pBeaNU=AzOr?<5DV$b zx~~xnb-Z5b&nJ4*b<2RAq$3e2ouCl0{S?(3H*ANa-U;t4{@`?1&5Fp)SoQW z5ubdaLLCa*#_Veb*Y~IEJf{xNE6RO=ET?>i!#SrOVOA?LKiA5iPL_;|dzS`aZf!cR{ zGPmd2-|SorkrL2UdpzB>Ir(z)A@uObknz5(sf$2UKcLjRW-_sw%8B)`1o6QKAQ8`l z_?qd`I8HCI!sW#BLG8Q!50FIm7+V%Y zgv!uzaFB*jU+bleJ*EP#0=-UBY~n%E9W{;fNl4 ziq{rREd}eB62y^TboYSn@2t}At%L~JF)capCNhKqBSWIrsN1YwBw|>UVwNA&u0g7g zP~&wOdQq21_3)Ubv*lnlQJ$kFa}N6EIGW%FV*Qfm)a%O4L0Xrusk?`VjHHO~oI{7$ z`9#nKdm}H+(CrwxrczDSiy#6cG`?dl&-=Qol=-yot)Eh)|7I>Vq%5DtPSDgZeuf&j z&n0jl{HNf3JqiSvPVOLfrT2}vlFR(6lj zxF0y~upHDQG@iXDr76U!a1l!?i9;*8=j8zl%fdPt%|68Sttt!+DhQ#Ndvf51kv zKQC~G#ivP!$NIm?=2;~V_uXE$?`9!ib(mKHv5r=ODYhD47d={*Wq`2gFU0NYP=6zIQA=IMC=+Z_Pge@dMCR^reVfbC6TmrgGR z>)esNs1teq#q10&{>-$DPa*CRTzARNl~9#q+mImix#1z^`<0~BoBb_*M@DG;pV>ZH zvxr3xNE7C}#XZ&`&Z#!{x%K*dOC5NBKN(tfv|QcBGVpQeJWbp@tye=&{atSMzV@!EWv>Yc&$TD%_v zsNB_v{6JHGc(W4mIABIc0kPH?{q} zEzI(7kM1{Hb{!G*%E!hB%O;G*S;|p4+pe|<5_CBvR*C%j=M=^KSvA+y!Ue>dZ!x(f zj?aEx&2_<1nCIBuk_v>LK$xF;=*VIh>}_*v>b^d={@7%QAg@Xe^BQg42S8^!jju@m z+W^<~Q7$#AA(C2763KF6)q=bEEr1YyFBfYnwt@3QnGM#j9Y}G%DP5Cm-#s(NCdF-T zN+IlR%EG1FaSwa>9`0!Zy_-r=8DM+;_8EFi}%eIZ1UuXGO6Skg(XWw?%$ZGE)FlrPrQD=mDQX$cqLlfhuF8WT!szxQvZ2!fp~mXO$B3b=lK<$p~eB3kAbN#!Lt3f^M>y|DVV+ zw+)U^V^D#>4jF>2GBkI{5Lz$B=AWM#+cOo^Xz*$3QNs^|8FA3&&IQHcGEe)?cP;y+v zdSz&co$U?q7{q`!LaUe`^9T*G+V7IqMe`xjw?)#C7Za9C6}I~qRO{_+D9f`mnLsy- zWrXd1sM3GZ29bd#Nw-!>x(77%sbwseSfE`lZZ?M)Oar@?r46Kk#}qJ+ih4nalSsEI zEx3fPh6G&%)>p1f8>yRF?uTG9Q;IElfB&M6EMB5YPD6MqC-gqDK7TIhn z(^S+&-kr{QOL&CWfkC`IENbW2e#zZsntELUM0&^dE8F&fK&K3`?tjxai}wdo!{+5A z)`BV~mj(IWC}!t?!K`^+Q3a8IQR@AofLUmmGJk6rrol658v7(m4;6B5fcZcQTo?Q( z!0Qt!W9kNUN)WtZD@3{#FeSbY<{v1phmQLjpQRLUpj*J>fT*2wPGPy)0=4Y9d-VCQ z#dG@^s|hW1yja$=?k)UThXk>6ilomGanN;6O}+kME;s&>odaOo{EXyT@%{Pqs{18~ zA+ICnZ?E-Z5@AaT)Qr< z3*_fMWj0PRe%r>Y*}pD01ncJOx&LE3t~?0&U9jE%#d*5_+HiFkpiugrf13}=-(@hE z_ZeN-;=|)fc&i|SL zp6||vq9zCETQ|B^T@8@v&(6&+;*a_i#bmI}@{7s#n?;?FRzc!LI>zr{LRf$ULN{AO zjMh9kL-5ffwr`Ky?2v2U1#vE)l&Y)n-X%p431|7b)PdHuZ3aX-*?GK&@!uzCCO=e4 zoKIGWd}$iKJ4`G8GNJ#^SUtCo>ww$OSNo3HbZ3FJ<*#YOJsW0Z`z@9JIc==nM0PYd z;c&&NhaR8fx?q)bXX8LOTgzh8Kli{+|7Xa9$h&2u)&e z^O(hdPaEeZoXdab=DP}Hui@3=+$~#wvSl3Py|&DBQ4vIvBN^D%X2CXBejDwF$x?FQ zvfMth&hc0r{0xZrC=H$yHvE@44pdf%^Ba`!JTsULv(oOrJgfiSthG&*Yh9DX+8#aM zxU%M-_iyIUY_)}aY}v5rnZfrT{{IM$eI$d2n?dXP2-k2p1FN$mnX#Ur)Z3%T0p!K@ z{=xAvJK1!uV^cRIjxI+%%VBPHz~LqdDz|{v^+!sLQCyfl9v2=S7&5jLLQT^~*DAgy zV`Z40wV-#GLxSt>ll95$Opw3R$YL~dYYWI`GD{|2@K=_{fvwRSe_^#ugIw0l)C#rN zwujA=#R3L|{4Cyq?fASN3iaNRteT=(H~|yH@!4zllM!}aS()n(iDUYHAw&q}YvG^4 z@zq|JU7&SsDdfHm_PRWpwJsk|;DfS>_r==yc43B=j+GBz8*_$thWoIM;|EC7KRX>F z{}(L`D-iMwa9Vh(kki7H$aUtQ&T-AA`wc9fz-`unrVdPl2+6{^o3rM2ESvT@wXV8C zh@8ve2id$`W;S|OAE1{=5Neblrb!TkLXxN}B#BypW&o`S-e@m_!m+Z6of86|52CJ_ z&*aVRe%E~cV<&jB*R=L3X!%Hj&^Iom#x4i56KqF5Tz~z19bEHut0@!OnjFbJ6+pU4WQd z_CCSA@y-CNDHkgS*p6+)7k)+$;#zK4$82qX*(60;Hv|VFPSD$LfYWu9hQczjez8d8 z#P~Pyk~pukip*%~uLsz9H>rx@G^Wtu1|Ahdq z%V7qe{~9xX+dea(IL&?~Kfv=YIZR8*V|ka-ifj%kin(Qg+iHqID>{Gv6K>Dz6FMo* zwOROLkP*sk@|7;wP85hgut{S14>cL$noO*x9%A#g4qw2|N*JEi2SM*Bn9piq4P7wy zEDZ7OM;B59$I~ej>vM}B@)ve4rgb$vBr*9TUNB$ZUBdGhfm7?6TwZoxba?KK1B}{L1II<6#Y&KSYLQZiVztp_hfy`Y>PqA>q<4XYl1P}ejzn%-qcvC zsct7kj)*?gO;V)T0XO0Qq6SRhtDB_ATOzk%K4@xIZEdrg#TfFnd~}?w3y6y*5%s2- zkD&08_6XcOU;Qt8y(&Oc=?FDC#aiKbF5e{a_;Hz7#}-0l%`{^Dc9_O)FCoz+%Oh1B z=vF)|M_4D+GCFl)0^W{#xroCFAb;N1U^5UFtr7O9=dc+Acx&^KM^8~(02nQlT4Ea&lLsFz1Jk5UuUi&t?9^;{h zB#+>~T^W8B&#^%%qx{Tn-?p_{wh#QxoX73xrv^CfbJt?F)>}uYF@SqBkDr$v*#yxS zACj1_yq(tyanlW2*P4Y8@qpI#y6kDb#|fcilccxG(Cc>rt0_|k;6c4|ssln*F4*2* zFrVc(gpCjF*nOe)|D){7iL% zi)_<2CG@T|O%QZ}Z`E(3PX zP!4pPn4l;}xr{CgKSg;=VZ*~~M)tGsriGWerLJoW_`MhIb(9%znDSfjsWM?09J95G z90>g;6R%`uDtCA0S$=};lW5vmju)oKby(|a&wVaAq^=GDm@R_*->NfkNBVt7a55-| zPA7D#N7Z`E`U|vCZGh@Ke~C# z1*!RqIUr=9d<2MMU+>Q6Z#zaKyQ??X*6q)Il!UyGaM|4?xY^ob`87_s<=69Bj4*o( zLVJYYlk(4hO;TNTKwx+&Z_iruQcCssC1A{aWX;Hk==LuaAUbdfi(zKDOt9`BlT^pP z?oCpK&3PlymWVLuJw+AVBLn`_IG%Ap=vhiV-*B5e(=Byzta6TzfcuL1?~GEGWBS-R zb1z#t-~W38zqjub%LmF3Nq9W(*LPF?_fMUnI^;oQ*v9WSjIsBju;k)vzil1EiDu{j zM#9&co&Wj#p0h5H8eh->p#Xrpa-Fmp&;Ac{K?#1kuCHN!s?4B*O33@6l#2|iGUbM6iwDn^}bTKKJeDTZ^tw+{J1 z*&s<$CH_3;WyGM0>XeMNkC0INdgvNIPv1>HPbz>?d^(|@e4c1K&xuR4JBz+3gind0 zY2$+b48uNQIpO>dB$=KY-EY2AVVmYY@muoEVcKL~7N4Jzc@y&Xnl{o8=kt6u_Iu)j z(+Q7x4?Zqe*f=BCuvlO`%h-kpQmoD~m*==FQhQGo!ca)Kj@gP2w2kWQjNe(Pjhss8 zK~q1+-wvNnFn)k_(8lxu?5tZmS5pOOUC}nGmlVOSV9R-0ealxDcLD@@oUmPx)L!4( zD(we(5L(@Go`#Pr2qcp+EJb0TmuBEyDwzE zAd(kiKKy$Y#IpH=;@Yp?aiJD0lZ<7}V|ws1$nZ^nlj}PoXje6lvG%bYuQ$E#o14ed zY0LQiKjvo8o-sF{pPli$IhWS&S60we-{!otwfwNou*$r8GQso17s0N6({I>X!!$p^ zBG|QN$A#J_b0MV80EQVqh<{hJyuXouoKEQ96dHY|dmz zi&4Nf)ftkJI}bwbGr&-*CBuP#R|9+FI+>w^Vl!@!}GMS2oPF5M=~yVKosi)XGliV959Z~g;3KBFoM;RaRmRa#=nVHFpuSs zj!6K48EZ%N(2fhW`;I{9w@qXE4j0wcM@XpeB-IxQ5SsMVs2+Hk>Y;TII$28f^PLbn zyl6~UkoGU~F{bJB0`jUQdmnIe-)^*}w#-rGlc<9U5c(j)FNnqb7r`#OT+D{~5!`X1 zMiePV1PDaPriGVRP`&30RTh};0z-A%=V`EZp7zxWs&{7SFrQX%U9rW>18c^j2kuHEu@hwF2ZK~FOHWxx2 zqcjkgrC4y32KJ2U3*QF_>>ZQQJpFLR$)y9vjCf|uzyK?7^x zdkdb#{!d`}MXBG9xL-&HMdJXKNmvX?ETe)w(e8c zVf&xbzycTdOJ?odSEbEI`ah+CS1*%d`vh3^r%$L7AX2KoVnOr44DCX!e~bn?E|6j! z$B?EwQ)Q|J&8MEH&A>j7(m=-yDW)F9GS{cdT!!tOraFIUVe8yo zsTp%1e(Hju)eq0pxE)&(20`uJMp$0GXx%i^7TG>etGk)s z%l6!<%J)v=c8J}_HaRVIe=zRjj54A7Laq8z$#A=%%X=x0OCGkzfx(qpnmnuavwnUx z2SRaxK+q}0I{5!a_E@FgcD3YkUrW1;Kt6SUwO=c9!BEfV=4#IFV|ZLJ zH2k^wS{cjxCK*pY#B;)K9Wb9fxw=Cve5EIjn9=4%aCsIo-3@8lt#$Is{& z%ls`5vHJ^VJDy6=8f<6b90>ixyjPuu_9KC41gu#9((sPOsyv%OXs;8d{*zLVP#_rr z0yQWvmOwefMy#eZVlW+72-g+x7@lbaBGrXpR21<14Fii*xssrrR1ro!Z;Jq|oM#S% z_EPHc??t)$AOXjotjS>P;T-S+r48Px+ zmfZJUA!iUWJZd`lw zz8k-LQ-DFA?YqA{NLb90{a*gf+29U2Vd^JoF&nA4fc~^Ne2)M3Gt+Adm%&fn|_^P{wU(s5s}nhl}26Qb@V^R+Dn9M=Vi+WR=9?(9E{r*Jx_h3jWC zA8+OxTs@g%x-S6!uJR)@heaGvW~;r@(s|l#IIm0QYr+)nI7tIoXUAo#3=Xw-GC;_ippnu$p{rhykgpk}fZb~|`O(K>=^=cQ-yzH4 zB=sC9grWT+gbx41Y+erxqYGeJH_v#jM{fpD})a(6iO@n_~KQ`He9z zfk2~4w^-yf>c_|6G#Y^WOj!1m;C8ZD3KbxNV`(h9)(`=VX0r~IUu$>)SS$wn?7o&^ zL{Id2h43%TH#L=E%CPqc`S(Notu`&TTS$LPx8evmpA!8z<~xp2o#&}=hcjbJpC5mt ze5322D1_5_xfteeE)Kt!Kosi?hz>vZk;LDyt(@@KBX4h2DfKk4`yPjXKr9RY&5B{Q z`}x}5Xik}OVmXk(9RP|Cgq;9F>q*fazT_CyPq4Q>ho55^=Y&_7^AQ}Qk#+%0oTAcJ z{2S}TquxC&0E#MLdper*=0y&Jtf zZPygkb^+wp&hOiB zOwHb&HXp#tDu5E4B^gyf1`lV}+jF_rFq`Wh-qEFfJ{J^Uvm&@?>5AYY?C&7Jg0%84 z1hkgfs{A)fJve9e;PBV3@Gi2>kTs{)SeF$^MmxaZRsdzGTQW8jh^+6Bj`eK0M3sMX zn(71Rc_58n%vD&Z7K^&t?GDHw}ss)k(vwGTc9I*RM5VMZ6&d=Ad z(be5{KB&E&Y@Fi19A}GPl@Hp+i8R0H?P-(Pnas&&wh%~+cQY(a2N?K&Euh^X89|YM z4@Iz@1pV5~BFR_|;^6bhm)w$3UqD)sPt6oSfuLU_F8rOa-=TnEGV$LDC``XH>0|m8 z(s*EzCS0b<(@#^~el}3XVKj<{F8(oRYP0ZjNR1DAhZPx!wc??$$rDcNqTLcg(za-N0pIrXRvRNse7H zVXv>dQmejQm7g*Dx|q`wNGo&aRa(RCs{A7?Gb2UM!6es-Z=~sTmY<`I9k;9U`m{F6 z!XYQ@?lW@=T*2@)$_DYbVD*pNRzLOQwyJf&WHz=hoTJ_9J5_l_25mn+@o3-YlT?4r zoUiy4ck6oW=bi^fs-R?0Iz!XvA#kT_X)Tj#{W;`?!fU+b2o816+N5GXZu_;LRs+xnw^Gs_R5 z?m1vE9~1}N)GffaZh>s;E>^ETiF&&Wwu1|{^L=}@Ru@p^;!{+wcOoAsvG`=F%#EMZ z8Up+d=gm4e{&~Xk_w25M(vN{;lpXn;CM;Ctqm+6|1+`ag@M|RnV64u6zpbc!meh~aGyJ=&+>{1$V3 zChU*-B)zdjt6R)*#_Wd@$$P^c?GnA#j5V+p-}3d#jI&T;TtdiU;7+j2ndb%0vD)S=2gM_FrwX~Wh#!Pt5% zp{rlaF+Mok)W_^mCnyawBmFK3C^RM)YC`wa)?L&J17Ek|Nl&y1}mnFJpc?(V2MuWrzjmNXFKS zA=EU7+j!Z05t(25;V+nPLaBQnw0k{8u<4{JOB!V=(=YrE4D;iHoJ-KHNi-8K2)i&U4Chv<6v~&j)a0A28C?cZmBr?QVC%FMVT_ z41;C|-BqkYKR8mc9ubj4cM=I_QhKdioq`2?ie{T|VZ0Nf4Z{IE3qFqTCdgq;=1 zfE8;;-V|W4KXs;g-FpSCSeFP{n8u~Di&T+Gjo zB$l^Uk5OG($@@XxvE}9rI=!OC?iZ)<^$Jg9b| z-5?CU1)z8fB%=O!r-ua5wt=d#hd!6rQOc-~*Wh`kx` zIDs+lD`Mfr+;N2J>SZ`@r90Kjc%JYV#(1s_tZTK|c@e);v&%vDFDtD=*m{dREsFl% zQmO|D)L3yeR~)h3Ib>iJKb}GRIveeGX3&077TQtvW1Du`zhlvE(1&AFm-xbj2c^LJeQ5tE)@;8E3 z4K2MvFK9b~zfXV{v`l|b)%1(O`d-5QtICfic-*ld8NVG&=OJSNw{50N*1hM{;0I3arQ%d>`Z!VL#U<&uGv8Rzu;`uX%la-@@r^}JfW_={f%Fvn z?107B5U2qcXmt+ImV;xkIZ2gk00JoAs{j^{$L1A)mNQhf2>Al)v%dG7n(r#muN@hw@@6NQ)Z*Y9xT2*f!3) zfxMAGRAlj3BExPM$8j0O@Mq==;&+zJAN!zrUpOF^u~>YZ&pXai9eK5yc86G!r>i{)tT>SpK z6u`YigjGQYXz}8^9uDS$5_Cw5A9jJJ3Q)6Ys%_teh*n#Y+IO+3{LJ#QTYh9{;

OBJZo5{$62Q&I0?o=NgW*;P(kAD>CZ# z*y?IiQ#|EEv^$EyA1s4K`^Adz?^xU!gx{dl^RxiQZz=Wsmn|m6@^vml`=v02t-#-j zAZ*M8yNFpTUG)<$&W`1yJhjbnPNqeYq-kKk3x&HEHq{@;ReZP5jA16Xzf! zJ{)pDY5O>#yGLvLK77)taU3K!dn0_xFl8Nq=mi=5k!h+N7t6ypPfh0y`ziI@1~`9U z91y4ZS$^WBM6>SN=_O#?%dtKK_a|s1eu-qDY{L2LdD6-J3tB2vd80w~-g9Ds@YtKW zTvh%BrJl9P%sooNxS#EKEVr6(6uuugnIC{qt;*P*7t~(sP4^{(dT`Eh{@I>&mbBh~ zwy7`h1E*H%e!8vS%$e3ut;#nT{C;Odgm8xd(SH`%=Ep1WJdf3??3y}}ceYKXdiglt zDi3FSTRtdG^B)jP!uy#IHP37Ixg^ztJoc1f0oBb^OxPQa#{s*o9C01@tXWhx#IZ5D?^&~`WQd}Uv9cLJVYbITYZmnT%9{qW7=};R~SSMDDJq z<#*|u-}!#7DoX|Lv>kLoCF%CH!uO?%VO?Hj-i~Iu4)Q92uzWw0;&Y#n>mX;67dpPP z9AM=!2Pi%VXmyY~2}L)VXra|3XT(*d^xiCX+o!5=E(;09=cE@Qf6_aUJLyHNU+{;Du2)t0oppJY-v?EGr{E720M1E|7pU@!1@Bb6 z=*XG$BKt1qhMdV#3?OF`z@$muZtu&p2q-*{lq$CXFnhWsK^OQOu)7YNlm2Sr@1LCz zCrZLcKW1xw9AI-A#_0Y+*ks{o9X0&}(y+8PfOcRtXuqIT_vS)iphPmfw|}=+f{qi- zp!U{Dk|v&N?yb9fuJ+=rANDRgwZ3m-L3f+F4xZikHta^72MT&nFWc#@|9)?`&~ajE zf%t4=L3dlnt7>m>9XyM_lYF%o%cupaT(=JEI4T=YZIEl%k!Q~@_B1ee1+$p(v+PoeHsdp8Axppt}urG|N5^CJj_cF{z-t zLd_u;H?w`vQy~`gR5Yrj623<&)yZ(N>6^IeTzGSL9GQqWcht-aaZH4;RTt+lE(+mK zEDRhoKg5BhpzUu24R!E4ZI}b+>Qi!na>bE^e&ANna2?{}6n56J{`FR_gCEs)4S1wj zBf!ph3CBpN1GqtYPkPu-K&extsf~PpO#OcVk>?4-ZZu=|2PpMm`DL$556`9)%ihw+ z_PO(x)0BEz2*l3V#ws{qH{5sLtv*nDmrsY|UT=3BfY1u_+W*FM0yoEqCSHyWX}4QZ z-r?^Z0z?k5Ipe&@%2(D+Y1HeI3_{diwoi+i+YYe!dB@;V-1h~Nfqx$c?n8QaQR>|d zY<;2b)d@U~$!ne!I~{_X=ep@P%hVO{+#A`-TKU5|*n7QcyEr7&%Of+prNwBoKM%0L zSH#{Fb^?%AUSDWUX2FZX@uObfZI3~;+01xOYblL1x1jD!c2+^j;9E%^r-izy3J|?t z;A@9^pUB>($j&8DGFV5c(gY=gjo!^|A{lwDex#{S@T$E_z;WE?ZD}hW9L4<-9pEpE4Uic%wV_};@mRU+aqI#p4Tlr@DFPAq&7_Ox>fyS`4)d)iSjO+I2BxU; zH-@R+RL0|p@%t(>U(4Y%e=9DB(4JpbE}fMGP!1qpedNt?KZ$k+Fq`C3w!d=*Vbf!6 zY7rP}x3sul6vME#s#xuY#c|OQ#y!5>mRrhd7YHa-4(KA?(qf?q42D_M4U2K!Ua*xX z0z~$k{U0#2ni=Z{FgRZkl z?(<}|#dJqoTPn9NoViDRx&BgB-a2LCp1I;*?3oS$l=nYM==Eg` z3(KgV!hB>6+?&~f{4 zn!o3KmMp=&{_~F#`oIRHqa>V9sm}00N_ZSDIAHf?fM~k_$5Agty4@=-UldAS-?!Qc zyA3mz_wYC-!^HP4D~~nuRWtvTzovk{zm`JjV7(I*pI3_Y11va~{#KjgT2M`Cpz#Tb zy)7eOT>|1@J+rxmoy`L2Qg=v;o08Ba5m*=$BttC&gScQj^NC%QrwOxE`H?dmlj|e% z?y5UUBP=!}$F&eZ?Olj_boBbZU=BnFOg$R;;qxe06EyHQM^oo`D>!&EQ zMW|spCi5jDC_tpyDH+WKA`MQ-5I|_HWAE@ns}Epj%?j_LX!80#aKQ0SN|pNwM0QZ> zX%Y%@pPX?@KL{j2##A_XJ!Y_Zh0Umw|C6>mJ8(h}L~}7u zZegkHw4JZa_#cjclKmXrN+4pLkGdqEKRh4YmyX@#_)i>4=%1x0N&w2A4kh%@%G-CY z{x=J${;QKzXLs8r63d}e1@6Hu?Eb8zwcU1q_I&`QStzmHpYc1VP5%a+&;Lt0)7L`( zH`n5Anp%q$6V~E)=@|Ik(&AI17~TP};CY5uoxV?TJk0`W-8M#bFQozNeBjtv{2}Tb z0>`388PSQlm4mZfe? zLF}E>1=~kNF`T#rjKuBvDV;J`?ZrNCTPJNkBj)%AoT|*ROGwyYevp;n2TwB{FZxCS z(q74M`2`njs#`lr`>0@|418#E79Y$kc*WcYyFC1`0LDZ45W7Dgj7b8o z*&X$3l;2T5R={LD8&ln-pw;HHySPoD{E*$sc-^6_1m3-~hQz=}bS)j@rO#l3WDu@lN2JIyq))tmo zmZi+kGRj~(A~DMpf-%qtS}039nPpmSW&S~_=K!Uiqm+7Z-{YDeG1vWWd)-FR;)O7_ zF0K6uaphtA9o7yPL{QiDzsGRF0*OhseX;_y+KSXZnPu*wW}hn8ZOzv#Jf~Fs)L^P3e?*|W$kVI+1riVZ(%Fo+<%g!I-I4Ek|M5?{+Uuw zj)~=%4NuL=H?)KBxqIN(L+vf&on)@3Hk z2_l4N9O9VP*v1tjRBv>Gc2ETWfLJm+ zr)aFrpmC2yqwVez=ly^=?=`r`X{!G-8CWtb9@+()y0hSfjAMkDcrqxbwyh)~aKKcO zqsp+(_w3*DSv+(2#|=_f8I-k_pM11$?}mbDQycnVOvMB zWCV-3@5R1+;8-G}JN(KR)!#vzhv@^;{CBJ*p|c`{iA#zBj(L(~)aOGC^}1z+Qmo+w z>5>X1<8A_h17cEDhRDh0Mg{Y7lhXK@%LRv z__h5B{Q%DUBq>%^1gpp>RisIh(Z0gF=zq;J1XTIp{)CQnEce3kE&#>)e&7Ctj`m#L zSsJN*3pDI|z}ENDQOe5xY=1&WTd<4LaT<(NzNzp;%$1$vviAVPR}yS-f1#rkf@$?>7B`0amZ?arEOcay*{IN1FD(`m+fevpni=^e+Md?QU4 z<9UG@24C2EyB=XNk7D??dr0Vv2>u5h5Zx!ZSAN?8O7P(|BVLDvJysgNH|LzI@X^iJ^%=81W?v_~lB-Q@ndkD)707)9fwvdja zNy^?AhRj^yolb_=Tr+6CpDqD7?kJbevO5t0lyBxy-Su01y!iBx5Onf%YczsWRU#KF&g;PXOg} zd8SO*UZ~YA1FilyrkuU6Q2S;UI*q*SbgBfDOETK(x3#6%X#FG$t?6{8+s;-l4b&5x zr$aIBnJN$mzb}B&D2S~BlZx>1ikstrNF?|1TfZJ#@0o?bSdC&!h;U}<| z>K6&rV4FuowDEx5uQZNPWq{`e_1wLpVNpAfl`M~m1GE!3wxQ*Vd?0+GHo0WMA(w4V zUI5KklA4o3+j;FNROKys+4Z?Cqx}8mTccF@pKN%EF3D&p219Z{rT4Cm=h2dqN+ z2SgG^oveO}WH>;TyC{1v53HFY8K{50>EgcOmd^ic7u5%HVTjTDA!wvZmE*ZEg!Jxr znRbThBl3Vr@0wyTviad<-v4@m+h2IzC4fkTK=e6#f76N9|Fcwo@0$JL9>o1O1;DN5 zqkiF785BVIQAXYR=TdcFccu0l(t1PQL?0mQ>~EeT89Xna5MBxpSq=O?A`TFJAfu1k z4(_uPbwZ>=U~di4CIOBQ=fcp&@?{SXf2UAeTei84<0h1c>pE5W&qK_QHQJcbR%fRw zBX9blNh|7LsQWO#76FWIK{BeKgxP;eX5B5Ru|Dcb*?+%h^(CV@pU1YLz9K+L>k<&s z^p$ETX{`cb{9drNpPz%*DfKJ^v329nzC{~hWFhVg+&7grACdWXTJ9xUPg#nVFPXG- zntSA!E1h3hZFuc%bQ7&7l4|4g8Ef~C32kJ&ox1oPT}v?-kP8u%FD>~}?6fHQmxH)c z5z{5r{~3LMX~I6p&IjWee6XJ2JPWPJ2bT>kUxYjn`615F*OTlWknzJ(lON(d zTKJ<_?kY-k)Q?u%Y5h>p>MK*U{xpNuxvqc38@a#jEK?Ta7&-|k*>XOkT~soV&?QO( zXv5SCl2K1-^t6eYa7rXB$1Lh0EU#k`dw>3AX5JN*<<(K2Lfg@b|AY?E1hr}e>jU93 z81f*dB0tIl112*ZoTp$a#}vRa(!Wv0Y6r-_Zs%NOvgs?u_BALMwVt`DHMlZ&qQ3H{ z-1I#on0u5sKoJTgV|fuA?*>rN{_?U|+n%j0p!QzGVxyT374ri3S^3obPJr#b`O^48Dz7(n@TMjQ1D zRrxPyuYU8MSK?P5K4F#pJb=QmKw#|*0u3{~-r$VxGgLv{xGSTLo`tD-=yjShy-1ax zq15wSCe4d%=iiy)%Ri*lv(Bdb^jAR)1c*LquYa$oH7`!pf6X~@KYZTY4{iWA?gi$1 zT?7X1iB2XbBm>u9C<0>{fk;k)WV{Ii!#8@<3&(+g(!UzC{v_2!0C%&wH^$Ful^Xkc z5wLrNv*tSY6Hq!GBMa?q-<_o6ZO6wbYrA%gDmg`9_|{3An*ofEt+f+C!85{qC|r`E zj?zejxt7iB?xA4@0F3>UQqLDM=A%|h&Bton-2awR&ytL?J+`tdY;*q#rJgPSCV#;7 zv7cGwYqbI>v+R9!i&}kMs;~c-Wu5jpC)%#;?Baad&Q07ryAt8=XDw!2!IzQ~&+jqw zybLs@&ep}0Dq}e*+K?us59#V$rpgyMGtMpYj+|8gUV-=Tv(Bxp?az-=d%f+vmwSUVo*h!Ze#LoUhGYB-Y zvmZZ26_h{WjCPxC?e^uQ_TP6Y^|WV{B{!tXzL%5Qe|YZi$vFF70ir*$*DrTyz8h`& zf6l}`^#!LT3sU=O{QRSyLekIwMj>_nLEz_K75VvZAEo*y=6=BWwby$aQuXSSRB48h zg%+Rar_@uQN%zeux}V5N?YBOh`zmRipA4OYA4p@F{GgHXg9DU$uFdT0)>L2rX)I>+i5F%w{1PPQR?}b$q)XOE|5)z`|SPP=g?|zOZD@GEbI1QcPL5v>M2J$&E&2W&F9(HY>!PQ?>E=0)^-+~ z?Xq`WO7`NJ{Ch?p{a;S?;jo>_-(Vl>4v*Je2B7eqC~Kc1(C{3dM|FfMXnVZF+uSui z*I!|6?!q=db)?q+B}zTN$tc@nD|^6^TK{J$^*muekA-01d3@Pk|80lX`PEeYJ&uX% z`i-2=IFGo#4t}n1E%97Atn+BDH=eIx4k-PNppBX55ny|-7oZjSF!JE701BQT>--(0 z)YF_v=kgStVMl5$KQQ-4Gw#{kk=N|Byf8+`Y3WH&CEg^xvIJmo+bC7OmC?ShfxqRV zOy6hjiB3oQ8TKYpXSiMf1J_5fSzId8a&&Di#;YEA>`*O7U`%?A)EKXeSpyRXUbibI+7v3fl`GVx&d?9+4 z^9AdCX7YoNDD^y=L0|KCQuMtfrue~M&Hd7x*}sh!SpB0u*i1%V!!wV2BK`>P|Kd@q z)MxZZ?&mlRU(Wcx|9(~erzJz|{GvcIs&KCepwJI$2Ri{2#zRaV@kdHM*JrfV`Cw{H zt89Db1xh_vXVSAaRrVXUz3>xCJ(p$9m96ZTZF}KKN?+d9pVfeTr z3IFMLqq<5U@LWc{ep|hFg%q!R-;7E5((h9KM)moUVfh?20UU31x3@JGgHdn#fbOK! z(=dhOu89ID>~2tWhlQR|9VlJUl-c+9QhjeV`|dAPxAbC`BH6OdfPo?G(ukQUtj%U{dx)Q0RqZf8Ew{vQf(e3srmi0iSKP+^PmHiUuD$q zc{Wx5A0)NrzoXP+=`Js2)McRv@B+kM zH{1RgK>1PTcy#klbp7F8fwj@VbRguZK7g?M>~AT-BdqbM>|A59_~%a}@_r z)@HW-4A-x$dFe3crGA(yXvbOoeL)1}TbXsARpqxR^@vxE^w!(%T9;?e%}-Q0hV$^v zdtTXpW%@jv9-oJ`Gk#~`tB0v)KdADR!xQzBEu8-CjQ*Qln(tLM58H7b zcEUto{I8PF)=z4gA2JD-{5`?21B3Zetg0MVb(`@NSf_D>#Vj$u<6ypINB|MH&EF&_ zK-5~Rhwb!jcWIrkrRaMeCazOW#yYV$MwG|XVU+}+EF0nS1^XoSIAQ`u_c`Vfe~X{v zx2i{>tLjnGRW*K|v*UgJCr#>>k4qcJQ}sVWlls#HYOL=!nCo@+j4ci)1E{$q|eHvSv#(SK(4XY(tz`a}8c11`t$|K*=D{22{Km-cmM zU`{#aUX%{8+v^XC~ma9 z^0_Z(t%+%Yy5!#})n|FiTJOk#NV7vSqFX@o7C@`&0OJ{y@1hg~2TTPKVym}+hWby? zDQ)X;!nR_)j!&lCIPf@?kBcQCA!hJcG5>UF>Teh3|47dQ? zI5)Vj&=$aQAFy~@H}f;7GyMz(M0dF4uL*q@rJiP&89(FVb*cbmAn8Iqm$<;hVSKHt z$A(wHWJE4(w|sY4T-tR!F3kt3+k!Dc^_1%U*GVzR zQDyHs@3Rl`y%!#yYvQ;%RM`Wb*5MP6_Qgd{_{zgnk6+07N02~tJ?>qT*1D@e^W~^A zuIpBlZnU#{DfN^Ul(n9@1dKCFBxCq;Fm4wivX^5yGE5chr{E~n;|uwn#|m4!*q+t) zQ)auCZ}<5?$Iods>dPNd9d&^Cm0+A%3I;zrCCrxyWp*8occEkqER_t6QvJWPVBL&8 z@&~r3=?35K9ff9&{zo7!CSbS{jHMtM`{z0gY*zph-a;UHg?&CY0mD3E{O|2@tubRQ z(Kc2c5TzG_(TV?GA{hRR`n6@L`nQ_(>x)#m4Afp6|3RA6$M?b9Woi3BngUAmhY4L; zyI=%5K-=qNITwvafXF^UV0p-wuU#0BjmAo}~4QWeh(Dd4)jK-W4A*od59{+SNi?D}LYb zVM2!-wRbodwhzBkt~Gd6IVixh%s2F-ald;O&&7PQkPn%;eZj%~;E^Xlkz@p0sz%f& zr4cWs(KjgdkhPbO_&Pva?F4N%rJg;>^m*;{aNn_HGPO^irPNc)^3!B*zr$?*1*Q*k z-kSFb=f%yON7i^9(zZ}FXjs=<#C`Om)u17-!FDGTP_mW5e%|G|L0G?Fe$O$;B<725 zkLjixd>Z4s0{27N*a4bqVtuGCDTe%}YLqbFA=Oda)$&fc_SSi-{GCCnH@{P^S^It9 zJg&PrKeGInA#9fm+&4Ei9xFL4LYNA0+}d;2d9ZTA&Z?BovUrb$Jl=!O1w$f zQ~3~4O?eV50OdX8)ebIiK5zN~1pwStZdlbxsj|okH8_WV{V<`IjMnze25`q43EQh9 z0@OVB^HH5)k;BJs8d$Cq!TC~eO}Nu zPmzog2Sk0-LA!i(Xldemg-TW4dx+z`dz}!iu=e@Q6RzU zpW+hq%7_k%?h5 zAeQ*!Vnz7sH%4`~A04oYB&dSl9f*zU9cO6(b?44|f{Xe^pTF}S?;>#USlD_>l|PNg zm6wHAJ7M?#evr^{9`@O=5cg&HVs{HA3~M)GtBdq~yf?vQ-$b0gcgO9$=S99QX}PK# zbzOBum708r>P={`*zQ_8go*L60DPQ107~$2sSDfNAgD67QG1AE;UA<_Z(0vsP3uWl z(|V!H-lnB@XZr6k9W)oV<9S;#mehM3s@zdr$#tR7bZzrkN`B%Q!+m^yGMP2L?xYzD ziG1fTl;c$d1&9R%h-@jY)GWPYLyjs>9i)2D$#SJezc7~6`*YI!y?-nvBL*n-bQV`? zTTovDwfE--seatV?^u%$#y@Qsv}t220i#|3<+3sJe1@iLbzcFkHrJHzMU~o@@!VwC zZ^y=xS$%28Z3s~a>y+w}IX*_mUg$dYFX$+;)A2u`k-QWgi?h(N^WUK3eoFP=|B;SQ zMs0LlPqd!=6dj%{baee2blgg*u4bWw1f|6c%O{w^jb-1httz&EH}=TuY5vh2AjNQR zo)mL9ww^5q`dQK8Ppr=A!t>C~{M00))&-GYxg=wWSTcC|=FM&G0vT)|9K&=80P{!3 zv)mb!7WW9SptFd_$NkDJv6y@w563Z3Pn%~P<>g{f<>T)s^ge;#Da6HT{)zEv?{OQy zfct2E{VAyn`PTsB5$K7parap6f}pdmYX`@Eh%5&(n0G!Xr*mOb zw762+FP4Vu9H2SQSLLr9q&m!kXpg|-l3(hj`g*>8o7nnw5QhKLbG|BHgz{As!?iBh zj&1n@7ibrq=CPYz0V2Tfbysx|P`;hf2A(}UYr6G)uu?<0fij~Ez&*_HVffogkHGUd z_KOw%Bi|=1m)s-yk})bmxLbti?b+I{R%LZGIU#1Vcr2+;<1ro{q^%x6ssBXkswWU# zmZcrvOjZ65>-%`6hB9?J+9nIZXcyo(>OvrZa)vn!3t z=S!n0UXu^tz96Fjnh<_fA0yudI0S`jsey(O_jfnpT+X<(Pk3DaeVtR61tsI z&u@w=HKY&6F;J|^Z3p;10s_&0CerDQiA6*&+Q{_J-%srH& z%9Q}_3g#1E9`5@8I}m^ScF5`kSN}{`T%;B;*xG7Ce#BCMj3tsQ~VcncsW( zKKw7UFQ1Q}Pt<1~$|zfJmi-&09$}rdd53`K!!uaTc%sls1sL4$0abX+59f2Q?MdkW zL8<3klqzvSV7zdcQV+YMES8KNEVjqZcqsva$CbU0ZMef*_ayXgK{D!#C1c47?;`v= zSO&(glGKw&snRU)97S9n(=&&m?0Kg{BbC8Pf)Zr=#`921-A zobh=Yoe9SG_Haz<0g-6U>!r;H#j@}Lv6SWG8J-KqiX^ugJI!3(@ugA>irT-l|E7sJ zLfRgVBb37O`Xl4-2XbN4#*NdpU6gtbxM0`Da#6#%KPWoFvp|(^O7g#P-`tqYj3pEN zTMA*Q&Kx7!4(u+Y3fNr+>P-Tua!Edfydp#`{ZcgVJAazb^JRJoL~1xD6)Vr~vRn{~ z6STET!t3)`F4A6WoD(ntMNsbA!!asKO`MmLm0;XPAiyvX-s1U{`|^2yXNExrsyya` z&|$P4DtUZYoW%z5{(D>y3S!wx$%va};x?T)g_%1MdvR|r&#!FVCt)4IeB0P=wqeIz zw{o%Cb>qD*2&uqx7JM#`=MJ{(zGo+a8w$W(RRHeu3&1@q58M~zfmGmN z_}a`(Uz@lH%89;&e(EjIR_~pm(I&AAZKN%Qs@%SwbhQ_Qamit-$18#5tXX$9srMK1 zyy|60kfi2Sfe!Nx>EUp2hI6AG9gx+FdD{jOppgvf>FPR z;fzKz-w`wOfr3ji9x8-TcajF0E0ESwM(fi~F#4H|m7+N}4_HijkU*q~(d=Qr5m4p7 z=W<$4=C)U;`I51+5JCec)(-NQnT)rfu6Kd9(Hwh_-%H9ShCXZO599l$B>W8*ghtrD zDrMt(Z&Hd+VA+$o5ISS_Vb<^M&f|G^F9+@$HsDZY)P-P@+Uwg`rEM6<#8%;RaBU%9 zgMl1=p0N(Ye%e^2EgWEP$5A_0?q_4)q~rDA`i%9Z@=BBe7|ntd>ldLWI7KqlF&aUc zC*l7Uk^%Vt49VyoWw?tho+WsJWJvhGUov2nMh2$Ln2{$h_lDP62JAP z`))3Tu${I(hIJ6(vGb+j*^?ktFYsK9s5_zE$?`N^z;oRUi9#6H8T-g)n`V0hWIh8N z`^evA_Pef+>L6JCy2FLGesP{x`#G=3n*^bLvD80g$|$R^f7L(Tkhj}<$FTOFrR!L@ z64v|QDN$rOCPplMXD(s-PF!>_+`?I38q>iA5j_8^9T4GnsU=}S;`zg8d_?tn7wqzN z5DmY>vorf6emAtXkIVeCjYONqct=@y>s_eVPFs1Sz%i&(a;Y{=F4gCNGWLknm3hZS zH{`MV@DfmaKW02(8q2Gw-^DNj8P@cd`gqQds?przhY2XlS6;q|(^e5~c1lLhM^xXC zk7uPkJRnwtt=#>uP@aElaV|`K-^B0ykWx=aA?)JsF12azE>R|fK&kFc=t%2;=nf;D z7RHJ7hHBCMWhb~hlT@+F@?6eVSx?wLM%jsSFp`EP*;xp?d|7apn4Ykl>j|!}jp_a7 zzKY&8#@^X*k9X(75QMyZ9hQR8kqg^lW3d*$j@yED=DHj;*JUz*yLlw3cb>1xJ91$N z>(_aG8XTz7ULG-R0rPF{bH=!i!RXt+JVU>&2Ia526Q&I~&41}#47Y^Sc;}ejlcUPG zNBcgO*!$c!b|-WRAX4H$Td;zaYq@JoN4q+h5794=B=sF8J#{yN)>Em}{STl`EPBG%?M~iff8?F!IqeS4u3tVmhe3WuW#}f-2J{i2dF4CwOo& zgo2|q;K`K?o#C~WhVyb5zD^B@lJUS~2%Q~Hr>VKb!qoGG|NBl78Wq8h?Y4`RD<>z> zUc-6!gty&ELXVGe%&e`w2_5nvfb(&NtxXBPe@7d^$#slwf_4f2ex_-cJdn$Oi=&<; zN`^ccLh&Xk79630lc$n;52cjD4ulRc+@K2fS>X8py{{%2{|}hoF}vdB z90+*{1p1c>n)UrQZZFiZ^#xV_AcyNbk`qGZ0Pgq=l7Y4@kd%G$lN?ijxj`}(I3dJx zNau3g)f?_4A;<*-Klk6jvGK7S*6YrJ5X#JJ?jWHcr2!mY#bgNmfKt!!QbD6ld0lip z>7vD8TrNQLi~}NlxiGZ)P?g5#sVrRWQ{~ScqUPg{l{_P zISrLnv$1LWsLt<3-QkuhRsP|=l&=JiVM`UaZNIyZdbZ3^WyX`-)!K%AHvb{FWcb{Y z@z(ByM;uOiOsoq3fGCFN4kwvTgL}h1w=5@bS+#bW;W(CsaqhS6qqNvZVucmQ`y_`=|~k-KroN-42MnURKR`0GyB=#vNZ%<$1O>82FkhUuvUSSgy(!?W6j(GfBOptXivG&Sh#{$1Lr` zGyELc-#+dcPM#Bk=c+qMNEN{FCTMgY56^N; zu0h+}u-rtKa!hi|w-xO$cGr_H8CT!I@x_{ivXz6TpJ29J%W;lL>|gDKsWo?ykl>IE zQp9yww9%si*CWqwySn z`elYc>EBEMZKcIl&dDQRW_GAQehyr2oD+r8KwNbDE!lDKD@;z*Je{Ngo@=wjZ{oO) z-z&`iD#wgt`!qp4O$q9GH$gpkw!i%rxbgq5oBv;I{(o`@|9`Lf|DVnOUo!uHcn7%u zkq2)1bkei>bkeirbkeim#FfFb8u%x-Ywh<{!ClRSW?Ij7&iYYHRBRA}UyAG&Q~U7J^FOW-htn zZD>tfB@sl8b*h8Xs=bl`6)J)dL6`<|zOS{JwVt>TOy37Hd)T^WhXoAAk`HZt?t6 zHl+x4IBipl{$hR`zDhCnVVSK_1NG^}=tGkzP&vnp@dN3e=q(yG{KLpos;nyTv<9bqMi;q%fn-lKlLD1LnIquD5b9!jQ$pR2U3MykWSyAc~^hkkyt-$xYhA;lB@IGGwm{gxI4KmO3T zA9TY9iS+Kaqn8D%a#5E+#72P##;Yg(>ulqSY)|wA(YARbJW(9~&2P?%vXg^aqqv^G zU2hv6T5BHb5_*w@_l@HyhvPSA8v{h!@b_acoo#$Dm!f+_9W%suSFkit`CtDHo*yA{ zm`axhD*rR~cUGu+X`nLn-+CjiuTp8-rBc0>W&Q7N&dI*U`6E10HIder=1mB0vK#X( zc!!^!>}z~N*E27mK;*x5JyVR|TML3?@Qw;7x}d-l-HHAu-M{Xh{`+5J-XF)s-rQ#j zf`@cHQyE6b_ODig`{pab{Jb2Y4Ffc7PnSXy75RS4`|nqDvafLyxFV6(CmDWZ)j#xBn}>o`)tWvTP z(6U3OpZwf)^RK>>D0Rmpqt{i@s6Ex+BH=M3p812WXI5Whe0!m~)YuEBx}2h?@$XE- zORM%$6!AlKB}IFLu2w_GM65+cmvrks{dUjc?k-(?U++b{)4a0DbqZb8kU+&v>7MAB zBx-0a1B#=Uy1Za4Mnji>wc%-{9t#rXTmUcJ%Nr%(K{&)~8XNk$xl`acsPojp5kM-i0 zzUIElN4gL9c+b2CVkB{{onr6eSFs#lV+=kwFUpt{U3WN}-xvS3imKHXwP~wrQ`C-V zQHr9i)*dajM-Y3fR&AyBh}9ZJ)QlCQwjlPFsE{Beb`ay|_t$-&_ul8e=id81=bm%! z{hSYY!vZpzW3V1=N;qAT4B4KF26YvPMFd zY=Zd8HbA|{G1YXfR)MTCXy4fJAdupVysIzzRHrSg^0gi7HDeUp_tSt4?ag4s>GxmO2 zSELWM?lay&r0DI|f(ux`5!8H74t@uNLci1BZx;}*C2AK&Qb#>@1HYcv#6tdzR`4v; zDZg(9?v8#yUlV$IB+N`6>phvyUOsrI@7260)#>YHvy5eCn8b9X z>U+5K59TyF1&E*Z2QP}{fV1g~abWG_xQxneGF4kQY>{*zBU}3O-(~2&-sNRzNcMQx zB|5_`=yIQL!s-NnA079!ZJ71t<+8OI#oR`(aOyljoe8Gj5d0*g*cy-=t?zKqH?kSe z({gf7yb^`&iEYu!?<*x6aXqy*_=+95Fy6^dw?@0|_oprxbk$dA+K)kHvGRcT3fw*( z=F<`Q%xnvP>)j?VC)%e#)X*+@LzFW!esv3uA}-5l$C$anX8lHtBWZ|fi|f){DXp}w$rT7Bj# zL3cqJTH;rDx%QK)4rh3V7j#BJg})hztg87>RflV*fPc&pst@UH{0Z)Tw8)?ed)YF+ zkf!11ojw+<===6o%k|Y%X+5Xwai1@Y|Nm8$@^_D-o2JG3Bp02Wybk5FFB6NC41?>#2bOah?N^`M(lmj@=yEoXJ0C zL3zrz!?EQ)DKa)&H1Ys3f4x)w-jEst#BVSCce?ywhDBqe*Qw^yfZ;_OXX^))sb8Lb z(til26>CAtKK#@Ic-^#7GANPD%L(o&M+#x0Mq3f_!6B~`=da&wx>ra%%Wo(C7uYgp zXaZT^yF>Z>0!!TsQRCf+=d2Yv4R6AQ4XthMrlB}Wxu$=~QPo_r1(txyYtq)7Uc^az z!>EL3j&ktXt3i&(kF8z7kh|)wy6>6Kw1^+j4w5@xNK*xG@gPk$n~dX-$g3j)lz&ZmwjW_acyhT7F(L* zNiWUzXRMfCDMRIYM--$LjZZQ&bX;E0WqEP6WU1!$7(5GIg_z!erd2;+0-WK51oeAld}*)!iGZEPcn(Q2tK3965`0 zXlyE}t{3aRM7y4ZP6Qf4W!oxCv8lS2FT7Yra0)(i)TiSaHmE@~$C7MZgB$tNX&5L$ zT)%Mo_uE@O#NuTTGA3uVp;bNW=2Bv{Z2tJ8f+TOa2kH@qoDfB{Bdn^t91w$N1zLOc{K3u09lCf)lRF9yN>=hd+FSPW%Zmi*X8ns^$E}v+ z)y$#bk30$j1)*`cYSb3BikwHKpP)mq{dFtx7|Vd9%8!k?Lm(sem8Ly&13yS9mF5pli$b6VTJAICD7PI zAn!q6c0mZd)vQj7`;8=$61Y@i@0N^xG|Cfr*AY*)zEHmt0=pCVc0EOx{*B)Kx53`| zdt~02bN=qL6h(#C3M*>x-Sob0zq#7 zl$~eeDTT^}?pY(<8JqK`5-oIy=Xc^7EP%6J)Zp`J1Wj+iFRvIkoqX4Y$gxvbq&a6# zi=Mz>7}aYOfd&2C(bLZw{o%Lg>)2zv6xrGn`{pt=cw+43^<`x=eyvie5!dqN27&TQLzju^O2c?re6fH0rQm45__d!BQYW195vKO|n;CAG?wo z^w4Pu`u1tqu8PxUfqGXJN#M2G{jpI=3$(1K=$rJuDmi5;CEeS*#q6<^RYn{y3sy>c zIRkZ;cv#RAIsJXCmQ_*m8%H;s*hEm_|Cn5xJC8%?6M`keIh>dr7NWjP7zurxdg@3mh#4ULAIYHJ47cC~edzE=Z23*g7= z7GKeV;T$o#m35A(_Im(M-T4$3zkkF-_EU)uL%A;~UNCP1$7k3|i)E*RSp5X9u1NHX zD=O23<^juNGpI-x-*P!Foc4sDg!uwj1756V6FgpXkl2yz!3%>xK5=yud0F*E#JQLH zR!i(T+DF+nPDT>C3>S|(G@}5Q9cGtp|1N#Qdytn5qe@^uB?s7a-KLO0ZhkiVGD1HW z-?|vq#WdV#c?VrXEBNU2SjWfdnT5?6c<$N7?xP<>R?v|wPcv%A$=s)TS7+_ukvaZ4 zbZc@aKg$Fx|GdIcPje|5WnDdD^jV&sx&jK z95SH$8$7Q0iU2j!u0Z>rUPw1Z zIN9tq+}Xd-oM}!EH<*~nq@{MJhhQSq{$4h|o{Hq_+cSI^x>om(*N%;idq;O$XUEOE ziD+U2@{2B=b~0W$wDP{h`LXqiu|UslAiqbngwg zbxUyK=B~O?PeNIc%d%W&m2^;>;yxK8FPB*S(Omqu)IN6MLa1&rtj5Z5BzU1Du<)?j zezr&2FSw}kFOvngk{#!3*#&wW59h0iBKi%(2-n@fS-yYTM|wENZ*|*_<}@UpB#*V6<|BG zLX3Y`6h_*6m@2dQddmlA-YqPsH+cW@xfODz0m8sxY}L=zq<-oDd}iz1NuC=lOf`}# z)qc}ksAW_nTD4GGfRJrn=Y88sEoNRh-tg90fpzXPf9NJJuT#QNZf*P6ToKNyDn_<7 zx0F5$%PQ;SaJ_G7C3^ZWb(`nK;6I|^YPl>z^awu`sM7LjthGEkW%Z4M7bEdoSdEIS zG~jbPKH%~D%w7ET?prBt72dx}la1^u!iQ^3rdt@!P-UaWC67WaOwHmwux{D^s%p_^ zN>$5kh4Gv2yUK1mWU1O$RvCes-V0JO99$_!$wrQ^@$n$hfG}qR+}to5&)FFtcxl^6 zcIp^XYYTc<)n?{G_isfbv)KK-W% zibM`P-NS6cys!6!#gvgq@ag+)6=6U2N_Z5xNV>?m`~@a`Mw%~$CtJKuW3bp=A2TMoMQeHRQi;6AC--la$0)X>89uPp(bj88{gE_R@j z62#EaiH45nj${{_g3A(oCUrm1d6;5wi_u%T7B!coi;q9ytE+V?YM5$Ci2DuXt|&kj|AQ42z@*!-&pO!gk*@%qZ`6i^Ha`#O2YM)FXupN#mcI%RZV9`d^e?MGN%6{|BLO87no1?fB!*i&%vn-O2V0!*c)08>n!Kws z8$i7&Jt0(^hEQu8iEUbkL%&X9J>IxixS5AON(!=eU02m#5FCV>sIMy7f>|Df;7`XA zEm73)5Dk-tms^=EQC^ke85Jt#PnrVjlkk5AL@{E~%wA&#b1Q)i_8Q#ndJn8NGBaC* zBF1%CKUqD0&uU%`^6p%HyNLPsdEm79dclHQNkx~0;Hrp%L3N8)j*XAw6s6H}*4Ycz z80Tgq)>kN!d*`Z?ISl%t=0d%5)y-px@>{Mjw452)->#&YV*z(ECWJ;v*^yb76_UyvjY8E(9DPM#T{ND7nJSwR zAFmRsOS7^lywA00Z=m?%%1690W51Yx=Gl$wJ?Aid^W+0c;Je-%C_>>xTfNPqD%K~O zi~CRHXa>fJsXJ#j;4MW`P>WK=K{(_j>xArO$g#ABcX9YeB!6@85+Dm<);r84j4;3)Jb2NifAu_mmmX^d?+p_V9MBplb zlKBCTncmnwlR08MdDjZN3GA-nIs84?W#N|HAN}%5(c-BG46kQOb8cHH9Mz&|(I1(axXt7wSdjycc?O6d0~i^|q|i z@UYI+NON-XVB@bQ*9&&*su3237}V9#L`cR+%gAZx1fc=_fAj4?$A$wk}E(tu1COMD#Id*{%>l z!bwwg!xO{lKwo^kg|DunZgZRKAHN8a=C)!HNIH*w5!9xJw>18h@Qk0I!MLcV?Ey@% zL1V39iDIVoKU#g_`ir=G3sui_>E79G0nr>RU1}BcA2;KM;^+2!ZFPKlRT}KR+vpB9 zkt5(OMMejin_gweRc1<+M0Yg#6vxl#8P`A2V5dY6gf*vio$R-thTzRH1Vp{e?WVf0ro4AS^!K5(nKNGvIcC0IFD5y|6GpazrI9sx zl9x&z_Mqa7z~%(HrSlF7eagsj$vry8dDO6#X6$cDp7LBs!-7`XgZbmQREj+p4Z_{@ zjj{qS7ypeN;|sRll#)c?AG2c-UojOiY*N%?aU;!&a_ytKf$ETmh|ipGuOQ331V6>| zx=!kiYL98D-jLz;q>xq;#ulYleXntyQ7M3v_g&dzs|Qv;PRyVu*~S>je!1NNy%`an zTiB%WWX;LsnYIA!koUo#CJMxqPY}TMIcDVrii`ExW5i1>EGR&chqxu=v4wxLb-o=k zma6|Q!D6?3@U0SD4ikCVDB#iDr+kD-3(P6wCoF6qyroIf$133!&9bc}+CRnhDd&wR z<9@(f`!^i3^|NHfSuP(tF&ZRarSwVDZ(W=)Y`50jOJ*szI9wIwg?noHEAu<)@td^x zMU~Ja^V&by?_p>+E%t>f&rXzl(vSirvd?uVZ%G4O58Jp0R1W^l7py6{{jGO2jg?Z* zwrZ9350->#38_4}GebA^H^!i=mT(8jVd%z$)E*OuHxI?z50y;rmE4%G(qf^ z>8g7t^P)>SL>Q7}2@GX`YE6mnzw*Vf?+?7^5rz7`|J_xWYxFP6%e5&>7*eYW5SXd> zq0>@m9eI*dw^zbC*#fNo<$SoJ&@_KziXQ^b^V8EfNl?(R;F$bZC>~!Z&NsNd!p=S~ zLmctKupg$p54nt)f+{;f8>|5KU(#$5qmN(h)~)@x+r1CD=bCN;w0i&@9@i^#TruGt zo_q67pEZROIW)Nww_&v1O&mB(u{hx4e_mcfTgTB;uw-59OpV$rc z1BP{`Int_uuRI*~2cX=>CvV0ETZ~!^(Qv+#j={toLM($I4F`n$b!BvOpm_WL^_ucN z_>ons#h4mf*5IeU_G9prGUbw$#aFJ`o1=tE<89%V5Y0VJ@R;4)i_4sr+Vzm;XPjaL z-*BG~gpp5jgFeKBPj#JM+3>z)N^_;qYr0bt#l!>qsi2$y&0bh9;+%Gi;|V#P6ldxs=+UXmb?A-y=GI zk-cVHHTx!E??34Vyl={kppWZC3=F|K38lEGgBi71Tzs{jaB?GqPc9Z9?o)y$^GvXd zrZdSG6K#zf`fGT%fT6>$QmQQrq>???%_rN{?7S)M^7}YwA9IVL5+-8L(>AKX)z<#x zV7?ye`dgP=(NNp^mK&Oiz9%G+P5xPKK2|3Hicf(F4w$ax_zqrTiu0mFnz~7P{t;Qw z`XRsepzR?lqgd-1!>i}TO1dcy!?yRp;-fc45l$0r24qA3-&qAspg`E7tS=l<=`eq4 zh8FV`)-v79kwg4&3+PV${n$A+2$U9TtuvJ)4HP1_`a~egX6v2pg5HLF&zTn>wY>@P z>*<2(yU1?O&&v&_mp5g_16-*=OBQV(2nNuIl%HbluD<@pT9fyLWryuZb#VU)jQC}a z`_-%I$E8B^UoxN1+?Xn!%Yig>Z>;*Pv_62y9&p?Let2wj(lG>LS2uvm-mqEXrSA6N z*U=nFSko>EnD3Z~Lg+6{K76>AJf+^I%Li~h@zGv*`gwlmaw-_MJtFYl*|U_O3-guqg0(Z{ka4SG*|A4f-v8TZn&cJ6@POMEm`W3?^hs+r7vss0b30 zObU^CAP(jR+7SHTp~n{b107gi-#VP(HHKk&FreDZE_NAG3x}E4nRoBt!-{Y5bW_6eB zs07Pu*ltn4rLtZ&uwsW*@V3wvK2MYVTv?y9ZmauuNa$~8+;-*LF=g5=8Tpv7IIDNA;o#iZz9KfaaL?u&h__kpaceJuRrP;j_=Tai8}Xy=|2 zlYjllv(-tF06yzm4$Z>fO2n4)W!LkbN!7pqPA9=AI7IaqSa?6_RtIz-= z&>MXya&2eVFiS7Td=@z3L@Uh(8x94s5NqRavaca-`X64%bS`-DfeQ3!)&E|_2FHx^ zeBmi1^;I20*cDe38ejNq^=AsXGq5Lqur~O^IT0}z>Hs{U_;oTFRIgxa<4mw{1L^VL zJQ#(q6h7F?9H5{3v11nq!ezO{^|Ap zCiN2>zA|cgpFIE6_9d<*PnlaG?ND34Ho3r};-{0QkS;CyxY3#3F_-a8%+X{13f;GL zBfnUIJX)2ZZMcs;#oQ(DTwAk#ek}nKPG#nltn!(+={=#!8b>3r3o`oQun~L_V-)G! zlJaPqUVDn+9&k(B;I8726m{1#lJ*iS+7#Pnu4{^a&7_!^TM=6kx;q8A|H~o0yex}5 z2%eAfZd%#O$)Bx%C*xYF=Ix^wdd`|eaRq6a)8?ytHwEP{WpLf6XKd;%)yg&cO*7Bo zSs9$0tjOAW^s<{UJB@jLw_a|*Ew0I6)57<+V{YubmLo-l8KAynu1z*1ZY$tpV4~T; zr1)DdQ|UPw82L@Qnuqs%>Z9$#-x~x3>yUffL%!{sV*FNnNK$JSEA$6qPiUN zbo-6=-L*Oq$6PJ#WS@b;OoE566&_mhv;Ht;S|M=gcN89y2C?|**wX)N`%#MnvO1;~ z9A`b_lN7uy?&%}mzOoyIms<#YTso(U`IwXQn%%3i;OEHwUydz;uG`|;n?d$-d`UW& zi}RRwkq&ycrBq9wJrmw<7v{9|H~Fy6DM{4Nya5Axi^pzUOCdUKzc(+fv<}2VC||zRm>541wf4##Jr}kmySMcOr3m=m^hgcQ1>Tz zy51wY{@F{xA8L?~EwBDx2F^NwSediBf5O=&>AHSIYRNChdO_sq2ZKa2Ev`Dii)duj zUd8z|?~M^^5q*b2gF=9B@L3;(=C`aL*(FFd1=k_~VLAtm?wvVS3L=pq7oLe`)%1dl zgEiRZ)Bf3SmfO$$Hyty4%A_8A@sv*~$SnlKZd&9Wxx@{%V!raE*o(15J}%8PO-f#j zu8Dj9quv5-hEZ%Q1m116H$!rGIxLUtd49{$&bs$=RqqU+vm52CYOVHZ?#DtP>d|t* ztNzNkQB*-et{Wu=@!Iw8alZ5J6#ilCrHzh$R`TQC2%V|w2XQn$l(;z=(u$_VMBW+f zWiUxcnXM!yg1b*3(zxzx@^A0)FSl2|O5Pf@VO?Y2 zCwnKIR+_!=PiFC5my%HnOiWg4f4wz-4G?M$$H&4TQFKak<3AolduHWj4{p#;Y-zv6 zsSNGWkr&!EA%4MuNH!U*z?9bzTFFSCi_A#JJYlUuK%$|_T@R!BBfx`s**8k1uWrJ% z~LAJ z-q6{utHAIt`R-Bk50_xmWi_1#v#xS8gDyOeE@9Rs(Nzp_xo!Y*Rga$Z$i-ELy6N)E z%f#FRqc)%qhsV+7W1m5P?+;t*_SA{F<5t`NA4Lzl4_gO+iI?`(6PI7DI0Y`|10cuF z=X>K9$IewDZf7!6cSDsy(d}pLth+PQe!E8Nsi1qI1N(eco7VI$9#hKN--EY%82D|L zvl=?vb^OMQBgeg}d1^CAYIo5&-SDBN^YptZabV0e82o`1|FEyBk-)=m{9gMxByW_f z_wd~IWIHT4-H5TMa$n3@;@)?GfaQRgd7;~x4WHAd_LQshULmPC!xdCgI3w1s}uRxo~` z4{uyJ)1!jaChh+$Y?g3;4G;Mvb!MN3n)T+GVc$pp=7@TFWq9%InqBUT?3@`K56>dq zQaPf`V{v(Z_iI&SIHJ_&y{h#sb2*~Unuh!LLkE_>9I*aU@OE}--w1J1_S)r5Yec4O z1MO=r_()J!Jsa`oRfiedPeB(sm^#jEa$?&j>{$ZvtSkZc zBf%xQMdY$AB(HbTwa#Cg-Lp!lzZqcXwT z!(jKNM*7!2lOX9a#S~6&Rpr+{2ne*Oh4D$ zCp?eLIN#v&iabdc2j$Htr{F5J2AR$g3VYfrr_-!j{wPF?zCYr}UaRBM8{+$=lDAOz z_6=`uO@mvk?Hlk)vIud7z;uQEH##8>Kgmn70YsoB+Kqa9zAPeoYS~#wl8lb+wTa&) zJBi8FPfN(<%)L~YX!QP7vkSZQKu*C4sm1w9onBbp=w(ngB= zTZpg!TGWo~k^nrl$%qWv1ZMsv=1F$WegwROa`D)iQ$A`{7X1hJd3hy%&3p+kEk)o| zekO0h{_8|gXjv~g@Tbz|IgH>iXh_OyHM@5yH2rw-o_VO7ksHX35h`-kGGalWAXh*z zK=o-@5-u%BWz25A2bX+=Kfb{vN1{Zteo5=nc`9k2z*OzCd^9(4{(kVwL;K_Pl|Q~G zi?r6RcX|BFtgy;%ylw_=u)*<)9r_sDRy2W0NJ^!BB6yFB;WD56=@yFhlmj+E9{1~T z?Iq@Wj_*7`;MUPaJ?9M52R^O3Ruv{OYFWy6wKdg9kbDaXLwA;M*R92q z6MlsSc8C;d*878mby?3QlE`Kf$3ov1HYp{-K^-rav(~`lf0whnLMJGZ{pQyhlA5S< zClasDYj%h%^X%L@rab%4?OI6~XNP7ZPcX|l^Eq|v7vQY~)ppxg zVX+-rH4OiOo`h5YB-K{#x`)Sci-h)bQA0isg~^3!?oeSOB`F}w7sy5%F3AfvwHmh% zbW1`Tl;TR5uhoBzDf;?zu8aQ*2)A1GxsDEV?x0*Ob_l$hPc}zw3bi7?w}L z3*np{w96Fk(dGh~wTqt8h5J3Yvvu>9f#EE{ic-XmeV4OBT|W;=eDRG zC91@sl&7q)JB`=RIRQ-iMfqs-gI$@^mLaY6D)Uh2jDpQ;$L2hIO)Efb$UF7q3!WbJ zeC~}(;((BCaYCk>Q`WaAl+V0U@!6+I-d2&I3A3<*pQg7Y#Jo?8P>MyA#;Pifpw6Lt z2NB!bgS$wkev-yW6})|9ZcA6`Syuyf3MLQGx^($^WFJMTfb>UrLJse(y6iPGjQ%;G zcp8U96C_8vyn_hqIl3q@hCNpS3>%vDimuVP&_m41_sz&-;*pPHTaOkH7%CbqwX+?nB*Q$oj8$wkH%qmuWGs~wr zgsN8gNPI|6#+vWU{NK4Ht6yv+dG?l&KlUp*IRqw4^X#SIhc6cGF9(>-G0^&NCyH2+ z5Lsx~p+oi-!QmER04WF6y?N<(=?K#Eom4WO^8iBafy}nt@8wYz_?tx|h1^GZ_trWO z8wH^DJT=o1h!vRgAUwhYSfE!rij>j!GIF3(V32 zgm)I8lH5qHI$c^_zP00|N@oZSXzBPBxnC4C@v>w_Sqd3zA8P+D{ZdJ%OclVpona;q zX_E3r4=~p`+7i}6+;74}Aj;KGhgGJw(Cby}d2DKu8lE{dK|=4n=8~^AI>VaP{c`Pe zu3W>0)zO|RwCk{r`q|>HL^qO4+D24;(Ivj5Qu3~~BUZ%uRlIz*%`L1*g1~CV>jYRP zwSwJ;5YZogOg55W>w4z>k2#+hQZPHTd{c6FM-EpIb+H#@G?~Dgp~UBom&I3qzk_RPm}fQyYhnlF_Ofm4`N|9@lb**uwPEZ0y$U z9V`x%*DXSbqkl)+Mki_@U)$_N`;ouAaS)IrZi zu?uWUh^j6K^&sTlo#{W#U7)U(f_?R-tE>SS9nH_GVPw^E;@Ws)3vh9CMVDamGLIBP zlUQb`G1+=iT*jZ;yN7K=QpWkCJEQ!~oNK^qePOY;MIsEIVEHVmF2i&>RF>JhQOg`W znw@e{^>8FO}-JzAgIfGc7u-?<1y=x^+G`4Yar{AYNrds?i)X!-s@=mE*E^?HakS{KXL%Xr!rCwXH#DDo%O@fLk4SIa40dQw-BY{QmT$UA zxc32sLelD)VJyct0G*OjS0m}%{u{z6uMUAll~gt6HlBA-`i0hrN5>l&Ieat;?aA&l z{;=EEp}b53MX2ixaUtcts8h3$o4Qt~?R%I*T%~3Df?JcenJ69irOKDf^ zx<{j86*M$jyQ=HBG!x5zJz4qKJrreehmS9^p|_h$h0jN0QFw%u!^w--t>sd}1a%{) z@l>&S3O*WK!@K)EL2$dAZy{mFnHbe>#4>M!t^)K1?|acDW66=Yf=bChcUmBKB?bG2 z<;qxVU>UsNnd}2dcgWkPd#fHMDy^(=$4l6{;N4&^wIw zLS^F0D)*65u@&G^PnUb33lkpROukBBO+~>c#@z=(*tn9OwG&eX9~+foU44kk7em~MR|snbu3&DCH|m>&gI^QxbBr3YFWcFI&m+oPk500q>n%51b`&LB zUldIveFyuZM#S2G#x^(HB)Ta^(NQ$k9;$0mf3_+;0w0Pu8m#DaQ+NgrZg;tU_6x&H z^xZOqocxU|GbVvKpI=rbd4=XawHHU8fXz&B{kNI=PiHvz`WGLORi^Gzqa8DCG++HU zQZthNoCLl~?gkG055tyT=|Qy;!E`TFbGp?N@YU}DgcKpK*2{Z*i+CJ7V4$%TcKi(T z?S}6&iLJ5Ia~FlSWuNC29j;#k5jOP4j#nn071q_AY4aOfxWX;(<$&`Sh}a&^Me$M5 zX^#wL>N-aGxTZUY_A1wMsDKog+lcdAqa8~Es0W~A&A4N7A0|^Q*AWpV*^zW*^U+*T zpu;ITeLm4aY>*{Mj~ zu}}82qO>2lc#2#@K=|5?c33dXixdeTML#1O#h1nB+NmVM``Gft?9l0b*5%)5cqq`R z-I@0PKViFMjbF?w(U?byLroJEjj9TSo8nU#}jDFIJ-r-#(H%9(a{^eFCWS(c>? z_23N4?g(Cf;GVU3Z`$AgNWA0u@|~S-RRo}IOA94*qP3hbmCW;9!NBc@6s>?>x~EDL zVfkz3J>ocrT3AGfR5L1lOP4wFdM%k z=~ohe@zDBc^1uwoOzsW`QU?6rP>pFYoo}Uboa`S<1P?tpMUpY^!>$3HKBkYX&zRNM z!DWB={{Mn081nXA*-_HO0oRVhHJ=XUIfVPn7oyuB?6RLsYdJWD#$@#Iz1|?zJ{^EtoqGg#N&_d^#6%*7hfuPYcy(M8ocV2!Hn& zzsQ>|XKASn>#|dV3nZr2SlvNtO4P@B`@yW_R0POU=Dc(1|D@aq&6isK=CSGNorevK zLME)Sq(>56HUo0sC3{^z9IAfG6%J(IomTF5mTwGU)2AqQtCH($|28BEPA%K8)#nSX zzFXY$^u9_sdFiaD!F|J;PvDvdC8_JQ=g8RdFSbWR@A_uFb2VR(yNC6xqJ86$^~iimF$JdTrv20|8`oZN&R&iJ%wqPg zv^!UaYsblLDW7BI`;hNoiB+I{msHij6^C$ZnT%2N!i{Rm6`IVhRoNA;j|nt>BL*V^ zKl<{f(t@lqYn$S4%e6|Z^*kv44*wfcG2{?#_g`W^P|VLZF-^de?*{ctd|AHIY8xfb z$|1$*eNV2NmK2x$#OY#!w9R~%XOR}NyTFi`7yH?UNpGkmly{c zIkes~ZF;$5NO&LOZyB>dF$)W5l>&KMPJcMD_;t^UB`88t8)EZa;W>}mDuCL}OhkY_ z4e{~t>8IeoJk;`$3lq(RYiCq?7@r%AyMfox1CmNtd>o=%-hQGNn{RI{FmX20YO z7$2E^na>1-faJwdq|lppf%T=_X8V>8-)}_#)DL`IEV}#w@xOkFCuM)MK!3M8Wi!mP z4t%CSP<+-!wf~fAU%DYM1!KlVk(f9zw`!Y+$;R5p4bQEv9n!Zpd~Eraz?hcT8A2tW za89+uvf|?GMz!LsVD$O?M)yH)lhdrRv%4Z?H4rD<@6R2za0h__YP?#?iwz_Hv(#|= zCMFtqcgubmxMjoU|3IJ>GgMFCSmNy(F%>bekq{%#LqZS|iVtwUY)$MBL-{0iRvp|! zBBzk+q)&Q10Cvln4wQE233v4(vw{i*@xQ~~^SHgxwJT$YZQr<}iQTVPz|>Mylh26$ zRXx`6|2|iBdnbwt47&2Rs-_l7*`{oyDzd{(C86rG|CO{IN0&H|Yy8$wpNF1XziaS>AgD{qqC6 zd5@p9c@tzHp%3sL`dmEcMsN-jGh-6<_xk8o!oPp=3WimR!SS|R==0fbU^5p zdfD?6=!@N*4(&tqd`EDAbU$iw<^AQ`@NGKtgs;gI%<0%Q^!xLBT3{*-G_3|QT`Go4 zRrE&^IeN$EN={Yk_3W2(bNO2#QG82{ig0n-Umpw#g zk%3hPb_{+lnaXE9HQnxhnS6^iqW^NZl1BNT-tYZ05(|;z?H+>llG8AE=MrnK(ml)w zR6>NT+5NY}S|g27$gt}0-5h0(1etri1FmW3Ox+TD0V|nr&m@rB19;nlo;wT1{$-0b zkF)Wv!^)ax-5$dq{P{)?a(+DAhvuLkkm$SBYZ9Z``i*rgryur_rxh%n#b361n{92l zlRueYpJLY1d$3Q3gZUdP3npxX=|a?k?wa}X^%zz!+99%76^wMTFA_kj4eG7Z#v`|o zyU?`3Ue}J@_^kqWAT5mDx+DYlE{i3NjTn9a~*B!*@r;VNHJaSoXP+xo}04INYgjx+Cegw@XlX(`>9cmKJQF_{paFp;De$Lp zI-X+AfSu@R<=jswJG$=uKel;STRbtP@k8p*!<99ift=d;zp2YE?(%+K&HQrT@eURO zg1DUSY5b}s0Vf08^P@*y>5;raNX(+dr}!IC3RW=p9BX@5a-hu;A4Skj@tzDJXNF90 zXWuS>|KG<|OYVJa=Kve)>WS3Oht@?MtfonA_X2Ai*y_^=r2qmb-N=+9jI{ZzvQ|xF zKDgMwO_xBaGPwJnpB^^Luc>QUAD^Y_E(L4yUScGsUJJR=KFD_GMB+!}H~-4KEi=UF z`=c_f79?S)WY@E_Nz70AKI~fK%%(v&{u9vxqQ544?VE>ExXPL@7m}6g(&NORdpSr8 z@tH_?a!3gJ;mn%FqqsQ;yo(#`HY4trzX?6?Y#YMStb)1oKTeyoJ0}bYFoH<6C3VVA z-1FkMdDf0UG)YavCEbIRg!&YW>;jdz)Awx~0dS&eohyRRl`N zUuGPtsvE-(19gTtt8~Z?{bZYG$bQUs zzy)1{MC4GsXATnxso@VeYYu+=2~~%!8*ElRl2|o%D_-qGKr*(Bx?|Tq!EadHuOgo` zpI5I`R;Ql-^s|ifMr+Mc|4>$L;xV^!wv1au)!3!<9mpg%{7`=U|JZ+a^z^`P*9^Sq zt`@8xVhLb;&C??Jm|7HnXe%ZXNMB>$dsv$=;5k>R0JOqU@5#q`8fDt-=3*P;6iv_h z@xYuDM9LE}&J37zXr@@JzlmyNNTxDYDOLQ(5wpp3dr8!+&L@*g%ZFPMCKzs#|IyOw ziOa~sKe+6gFDFth8pcW&sO4$S2d1-@oD=ze?%d5UMe5(x1tiYcnyB#MCL=&@wX0v< zbN!T4w$z>*^dGLCc;PJt_uBGz0TX`U!9`iF^u4y5hRB=MdVtG!1avjm9k2vtcWVyq zr(u!3mqBrCn*RgIKsLYj4#gfS-6ziRndClijh*DUDs1kVD9^Ei_XgWTL4Nl#w{vVI zbGvol1a3FPN^-j(PLk&ixNUhqLAi~=gPa>A_9`iIo-=ojn26g2{U5Oxw-4eWnfEzv zLcC;M1I6{U?vH}lY`VqIvhE`qZ@iYn0*&Zz~76*aLxGkWm z9 zb1w*6*LTT%i*uO3k>EhNuJJs5Yo3$L!?LF&dy`WwzL7jPFMCW@e#A3ntqRVQ_fm+> z?^yKj0y7VDhQ&kV`P4g1zX=?+(A2m~OI?26SH_yR^s7;SjIGleS4&~5*TjC2oU_Dx z%%q!nOWOm=@q(O9UO8`x_m~-MUm5E?*p6dk_l6zE`?Q)~8<*pjrJf4wdMsWeHQ2f=tJlQ-5|0C%w`5(9 zm73eXzwJ5evGyHH8J~Nle?n=RzhWs>ROXKNPt2X@ugsn3kL51qPVg_!y~6*mcugfU zX6Id7_T9WCKU`3I_Z@k6{_vi>lFIL{yn0;T>>H+kFRyg=^h>Y2wCwJAwaf3wtG+*P z%6*IH{jg@9f8qFLi|6@0^X^$Pe*O=aTtmcumExt=FK4$kvscC6LOpb`ZOLbs*_V8N zRl<^^(;Q2Z$9tNGPA+e*S?Z~%Dbd8d(?w^>c7I_@2&Lb@w?g;;c6#sbvsJr)nA1M> zi;`jf5@q3r$CBD_c`Sj_Y80)=b^qRqN6o*>l!Y4>*BR@@@|71i;P+DVHykf8f5YDy z_wTL1Z=;nLH~2H!r-n;X{3YcER}H^^Z$)Xj!E<*z+owKOGQ{sGH#lv?{d+6Q$_-A; zynk;+wRzrqi~sDcGSA7ne{aP+^IjL+zqew(dH!4OKYIh_IobE`t*A54S(4g5wWVaJ zf3XU$_5-oLlvIrIF@2Y&SA`o-^fcktgt>s~X@gNAH3@3G%J zzRx_?W&Un6IljYuhRSn9?svRoa(TCTY_xf9p830C@_T_a=a3&~theStgXdFo3;jID zP&AHwjvP<(@b8s2yKX3H&a5hH-bF(@4^m3!Hg#y{PFlEOxjM9SkDAhXfL`2ihq`b> zgPPKLN*&tykow|=U#kl@WZ6B$cHl5JM+A| zoOxcx5O4{6Z+7N+8Doq+#?@YX)?CKYtM;t9jGy|POZ<#C)a{R5N4@%}vE$KBj5n0! zlTjCqf5e_O7v*`h>kD!JB1hI-#@o8CFH)Q%$BbvpF|OPrr}+QYbtEOZ`?HjT&OGlY z`;Vu*(seXNPt5Ya*>%K=wl5!fjla*HHJ5Q*Gjgh*F^c!Y*!*PF#p4fjeICQ8dt{+s z-+#<|w(Ikh>kc@EeX{>pO3lbAe#RN&-Fee}x3|a2Gse$Y0|pr5y|_OBYm95)jj;}_ za32Cb7~?22Fuu*iEcYGY6qpA_x!*8Oxt}mr%SXCn>kEKeyjQ$q;P*S-hf22s{IS^J3VzXgu%-Yy!WGCEyM35%}Z20PJz!VeC~|@Cr-;n~XQ$x7va^ z#ysPWu?p<1jy?BS3f>Q6mHP$o$9)6O1~wVrC@14|O821@yc@OZUq(?cO}Vw*>gkPODz6Ysl_V<7J-3kbG?8g zr{e`^+C?RrpZOR42L0usoIL;M3i%#Opc}QAo+hEElMc|ZLr>eY<^n6g5OBXIcg*c#cA_UBzkQ`{qq#dVu=3j8%AC;Ip7JD!4Pl#iU`m+xaOM?=>U%YBZd z821?M-{Z*g@7Z_Ei+kbTxDW0J&3D8$Ep!x`(6T;1e3798fBn+q&%E){#%J1T;f5}H zal_`EJTKS(5%G-AQ!1BwDn$QCYQLqS>vONO8(hiHDf9!!;4k12xCH+JYrrsY0WQFM zpOM?;H~KnNB&ARr-YaXXF59qB%~Go1Z z`rlB`v36r!2kizO2Ymuf#ySUj4x9w-1`P*2S7MIQ9?O_!)oILg_^RdM;qmZ_F*37M+%5(RI}lC&b1*i%w;ZfWF%#jc3d^(0I%b%n8gltT~xapy!wq zm^YX!m|ONqnw0s1BrV2#VbyW0pP>_>5A!A6#=HVOHd@kZ(6;f`I6>1^oBFNF%)0}h zK)ZHcLOy%b-il2*`F_XJy%m9+JU_-4ez$m6iA(oZV63@viql&>CClrW;uQBtoRa0m zc*x@*#&^aDuC?L;e`9P$|9vf|K=kFAIdw10zM<}gBV?8XG&H~ zhXIEe(-=qhPH~EH&8oo;nq%I5Q?dl+z)!#%#x%wVFvqw8XMwvgUSJGje4wv0#xRaC z)-ise?=#MzSuid_GwijDec*76lZ-Qrql|0D8MpysW0Pep#Tdz$##q{~wG4d*UCEfm zn94YWZei?!f1Ztvqf=x0iefrxT1<=G^u4+lFur0ewJ+UU!B`U-oPFY(?z?@TWsGO6 z-CR}o0%Hq&$NdKH2Ar3$bZ-TC4_L#yuxdWwjxi6casL4Jgcce(%?~Ux=7Bx#E5IOl z6u4uo1B=`jfW_;&52fT;^cJ3P9czKRnvsQm;Fz%pT;tj3A0=k|fIa|Twqh9g1!jSB z;1>6u^_lKt+yak`7vP!k3oHY#jAO=%701zBi3?^XW$Hd3;1N*16#m3-VHDaTmpY}<^B2?*ms-bTTBy8}+ z(Kn8z0GoIYW0LzAaK+ev&4MqPhk-4|ALE^|)Nav#z#L=U8Y6U-_v1ca(rYAn$H0|M zikpE|;0b+?@dzx9K1a6|`ep6~F984OXVs?8N57eG>NsdP^pmEXJb`E674%!VGE?MN>(Q#-v=r`y%S;IlQ;Qr7rz!Y%Xl#}m=Uc&Q$H9QmefOdjL!n2{@ z@NDb#O*sXAT+f;f8V=XuK71{78?LkJF5J(0A6(xAjg~uRJnk2}ha<}m4F^pJ?S}jD zeOUA1en(9|??@aC*ZI=MXPRGn{Fyvu;ReshEU#6=P0#Q&AEe~9&~4~H=o`2{G#s>D zJ-OHJqNKG(JZE4XW!OwbYk^l_ahixHuJP|8dkDJiASHxm=1{X$<6UQJJYeE~qw7k1 z|B63X(F_d-tp+Uy?Ka%hZO~GWS-dyqvXVi3IQ-6DoYjYe1_Q@He?dzz$62)&a}4wp z^B(J&Qi~tP+?Qj~b*z<`w?IC7i_O~gFGoU%!Z1(|=Cd*m2U z<{#!3<`LG*vaZXMJT_=LnKue7+E3o2qcqMMNO?V$yatlzkyz*R91?UsbR%>=blIR#=owc>Q< z(v1}{pD&Aij618Rhw=ln=nM6hu@d-xwd<(Rk*F(U9ChB_buPyGj}>!QJkW*Z8e^@{_J3FjUG7Eg}*k=4Vi89CMuT>#0=vL1_Z?so z_~U*6yaKyM%yJRpr<8sVaLhULGQg5h4fWBu~H4BovQ zZvpF!vwmz}62ts8-G@>b!@#AS&ww%%NSLgW)}Gs0m%aWD26tsdj%oB}`ljB+_}9QVOBTqgD$p;vJ~;XCd- z=G`p(`HA9Ql}kOsx953hXjbUdBc^u!SNuldF^)9K%vx3U8E52n`OoJyf-|61XDp?P z|BW7<_YL(ZGzDu?XiMl))*>!bn?jeCnRCSK7iCys%fRSo}@qAu+!`tI!*|tly^$Rl$=K#Gm+`|mhn{2nV%){p$@s#u&QSGJlM5n(>J79Ai1g+}IqNIp@dN!}z`0;tk1TA;$LSEc1F8pBaaS2X#@* zqhTzup0v)@a(}9_XhL}m2OkEc{CcaGwBItPT_^cMc8lN0yqd6dZw0h+fn}`bSZVaE zer*x+B$w{30Cp3X8hJ0=kJt<1aT~Y65 z8MDAC_r0cBhF)jRf9^aUDKsbhr0kKhH_H3nu^wfQG~PTndy~Mv;dAEu*%xJ>l(i=? ziswNWLVwEMCVp?qDe$xQ#658x?g9OVdqSH+d&<5h>pt8I*F$GE<&5_8Jy>h9SBiUC zeNyYapfjguc$(#X=%GVddp5uH_%od^Z4^G~E=pQ!c%Sx=XJnSw$i2$*LNju?HdE1B zt9J@*YV}VI?K}AVcRY_2@7vI)|NFUb{8x9&H`k{F=fJ%}r&{O1p;MtQz5pg-NiP#)t;WkUIC1dcQ zx^M%=%w6h>8)W|#=UDSC8Nb#X%l{v9Zyz32dFGGb=Q%Tz5Ml_)B$I?lW)c*Qs0cwO zt!ti45G}fBhf}*tuPu`V+ca@g5mAI_4oOzgv0DzXJzcdWfOMVHcGqfR9s6PcMH}`- zl9q0*-(_ZkXgAgp-jc&4d4AXZoO328L$KYq>-zn{73SqUFZccV+|PaA&;2}O)mK_E z*i1EQJnvcp)ACLhzU}*!h#`vy$N>xAI9ChLIA_`BLtEIcv+Xf<+k6kck419&x7*fq z^p*P3YAZX^>T1zvc){EgMPKAaUX!$-)$V6^rfMp$N%@}^-rsQ)ec9p%`Xi~lXzHxh z)i+q2Kwre0wmxS%i&C|e79P_%g1*X|vEQ$LEB5lZnO{8)A6!d8o?$O+`1#TCA%LH>!?Z2mEhSo}qt%9g=uget zo??={j?-SBZ08m726<%hC1m5u0b9&x@x`9kwfu18O!}S~awL8K!r}pP1i6A7=}h_9 z23NXQP3;ZX`S6admIb+H=K^vAWrMgLx+I1(FwgPpEK2#m*dOBC;vZrgagF%4c!Zcm zOj{gJuhj$_zQwd0hkZ}N;sj#6)`mmmUizA1-=k=><%AcQc{vNasXBryuS@yA={eoK zw!Y-FGi3*DJ~Nno>`%LM!{Wn=_(wVWY;_CvHK*mu1t}g3nQKtO^t;i=PS5?K&z)Xh zivBhF+?M~1ezjGfVENtn-k+NHMc>!T*IM~r#4X}AJ@1?Tyj5R{&*F3TJg`+?%5%Vp zksK>mo1Q<$=deA?2j_d6rvHt8cWP{j)2q=RKTul1+rjqI>k@(w(7QhQFXVi0n;&bn z{A;uef5+{6RV(r_-N#;^^061RE==Wp7f#FjPUU>B{a^915B`b%b-HiOeQF0B%Qt;% z^uK4SQ9ytDf2&RbKeuWXN^E)MbpJVZUMbCQo~d5JvYmDx*s{H)wt9stZGL=u&Un7f z*X~Z+1KXcg*Mw_Pdfn9J_NvnBoznBcmc0|x^1LLiuGE(n^QYG-q@NE;w_E6=r|+3I zrrpQVkmgf&r}^6ZFXL;Y&yTSJ`q1d(TXxX0b(SqVoVtVX+Sa&f)6lQBY+V0RBae)j zkxRY2))3cA*8?Z+vT_W#zVbR}6JvHCV5ymBuDYdYwH0?`oQ^oncwl<$hd!27_qyhu zZ7&`wE$2DEtP+sEa7$(?pJw4Rz2>#t+>^D(jrQ6=D|c+=)a-SF_I+LZ+TJ}w&KPa% zUYpNRXRBN2u+@vA9me(F!X>WfR{rfpGgpV}vxQHK6EE0&0Q3(Mwiwgm!#lP$9sLIM z2`o;apAb*0+d;noeF&6IsmGcz_0+;T`WB}gMPE+&;qlWcyxaZild+F^ zO$6Fr^f4^VA1PgULv0$5(08zKe>-81+VQ+c(kQ+_Pk^siibZR$5@ z9S@wi3$crKe#)<&^0l20oVd&4Cdag`PPZe~{=$@Bf>^isgP65AX3r_(T7vvRK3LpB zKJ2%heYzw5Q4aD4b&xP?Z4uwRKF9PMkSB-u*^X;c{s(dh`GV_|oi9UX8_37>T3f3g z_s&yO^|pVEJJ>Gr=ZKllM!wYB_F(M!Xyj3PeYnLro{x@wlCt+7+BkyvN4y~Z?Rb~d z>^sii;*!O|cWilO3-jqU3y6KhxgGb1ZS_8upKOmO)7K5|Gsiy8v3PkZ&3{hS>6A{@ zl~3h_uW6mhZx&Lu0}EOa>lUW%`#4kQ^R70L8f-c4^gIn> zJ3Uup@eu9YHrqMFeYQMyx6M{qoI#ss;oYkJ-EZ5!IcPh-W$_hxcKFVz9DzNjlb9iw zZPmS6xonFoRxJhk)aXOcHgnik-S4N>QrL6Z#$Jq(&qiN1y;j%qrLkY+Kzc6Qs1=^d zW%IoC`~^2y?VvAe)%>E5YUQ4-eWdifxK;Pd>wD)fxB-1{_qWl%w(5Ybvs~D>-Ov6?%Fn*~ z5mPXF!LQS=KX6~`#*O#i z@bw43dMiN3Ea;io`g-J)=+GuaP?Fby{-uxGcAi}$M9ztVc2*?X`7e>k1rfCKqC*>P z6eDAzs4a(iVZFr>(M6|rQ3P!d@eF$jNC$!H39(3{BGuQ{fdU}(%LH`Vxo+&BgX;XX z3-q|?)?%Vt^NKacPl;}AcL0<>Fy=W<=7sBX=otsd1C)T&*Sy|;sA;_)fUJr&FYtFc zK&b)8a4lm}UsJt5*6j29@I4A6+ZdCu@3`pEVxq@v+oPR;g5i(=QUpNi4uEn3V0a&Z z1dn-t*+)TngTU}OW1c<-jdZ&pa&}E^wNnt*=E; zR#S2jH18ZZ4ezheQEn(BludG@Ga>-h<29fQAP+Q%(1Y^4D2m!S(V>ltPVEFK7^dSZ z27LlZ#UHl~{yGoBV`8C}+%G66h-cX60x3$0!&v}s&&O?pQU19@ONxcs8>D#npa4>t z=pNoCg7j0*4wOBnEFptN zWEVt!%a|u77V>`L;ym702ci1$04TBLR4=Lni~v*h(&STaS^}k1qH{m9%ywJ_`<&NI|e&|gc|^=1LJoLmVr1d14xYyIJN== z?afKni_iKp;qw6pd_Ir~d1bjU=4%tylsP~z%Ow$C=9O!FKq>`*YOx4({Js-t^@k$S z-W25E_c9@`16+5mgN)&893Y*@gbiOKAgv$YJm~O3_4@G#1|19VZ_}XT8vGj?bS#4E z#>~F82R0YyiP;c!y1`!t!f*mW5`lzkKpZB5p;sKodB!|X0Z0`_S`k#k9f0NH4CVDHsvWiyUx0+T%DdaT< zX?54*MQa-FrPbTMoV(_C?eyh6WY+L6M36$|^ilkNs2m=ZCpQls0aztZJ}`KI|7{v< zc${c^Eov@b?7U!y5U~n^IE?aUqdw& z=mR;peic;LuLj;Gw(}FlJPiSFcz+@F zg9GO7cEPb)iqDIyYAIB|g1iMe_#?E1+|Ipf)1AO|=bHnkeebW(4IPT+dO$R^cO^ip z(dL!o8gMu0$b-W71Cficc)379Nz5SsFU^KLU66y-;=DTnu-hXGAI}pazLujqk8wPXph%2N1(|TmjNgKWW=JBo=8; zkkasdXlp8n5?c!T32+Z@bAZ&FL(kM_g4B=!a|Mutfo!@nM2f=|JCkZ0zboczsqtn} zeG7r=`0d8}70LoVltcCSo#yKt&{1x_Iq)vZX6SCJqYN5>45JKS7DyvXQf+9i_qUtt z6$Q}X{mp|%81rl+RR7>PR|NaRzJ_W*$Mw+O*R~GBE@NMD(W%8mCm&mUDXzD;-sSVx z_;+xUsY5krN7s!tQcz;IWBV&3{COxFi`{8!Pc9onT-5XaDYZp!F9bzGjvkGzw$o`A2c{rQLpQo(*{y1v$7@EHZIaqHQ*D zBxKBlBlmFaY{P!Zm$6^lvq0K&D~$YN7DyeFD+UwGQMLsd+Od;jzBa`9R>*xH`IEMt ziRDz^jr?+eM5fuZlJFmPB-Qwkkm4yHe-_oz#>Q*XFj03IOx!*l6MasQezs#~OdMj& z(@P+HoIp4(5{|{!CzxutFXJL;`_pU;uIWCTjX5_YC^*(B`(nfj*v8)GkRSQb(QMe5 zL(N7TJSJew(=*O`e{SOB-%LC6FPFv3FH(51Vj#n>7qs(#0%m5y%Wq-v@{`Mf+hxQJ zk3*KzX;?v=;9OEznQ^Ui4{w`gU}1bnP$Et{9tzX&P@wg}bUaW8NT`Qin=ZaM!Bn)> zc0AZ^QHN=Z&<^cuzSIukm=1C~7V9a-n=p*=4uSk|4UpkO zX1vn@AeBRYxD3c}lH0<3?YG}dsyMH+v(cA4#QVz!c_7LCx&x#IhOmtT60XH8@tWHq&01OArv9uHSFpdY;BIHsdV^YXPBe4ue zBrfI~{sGh+uP3znFGQ&7BeWVoScSfAtWKzo5vcBdT+DwXi=Kftx@$LquulXD+if6I z?d~6ElI)_9kP9N#*b#5jVoU;3?>Cbw_JM6%{d~xn=h{ieW=x; zA85Ukan zWl39n{_f@~|85s3MS`1;-!YF~te<4k0g@Tk#Ukw^k{NyhijRsy@zI(Z7BZA{OE9O_? zn1=FKMn0&xJ<@(FY{1yFx(<%zgB(1{n1{A(9IJ2I$bAOdvUE&tS~|9|92AUG4Y@r! zO>PumRd;i>zd8eyK#R}cncnxj8Ty_#)psK``ffviy=mhZ_RsSnO-sjWTc-NX2RZK` z=lZLW4@6hxRQv>*#TUfsGLVA?*E6)SI->AgS_M%`&{l9iR?x;pq78BWQ$2pSVF%WU zrNce}q!jn=p3c2K5v1dPn^f;*b%STc&r}XAr~1Y$$dj8N_MhVGM3Ghwa`5D5L5FJw zOFn3aD1?gF#41R2Of1%ZJ;~Hi%ftRx$_Gn^>H^jIur!O#hP*~7&ikO9Mo)g0>W$a* zm8{JGWg`(QH@4jD|Lq_3#eS0FDXyUyOB!4iwE`evLk?))T$OqS=(?DpwUdJ3IDj;* z-3qj+Z}B#b{9(R!N-Wks5Q{2LiXLr9EYye~2RFJvL0-Ht$<$96^N?FW!8LUS(CQ(P zXxl)TU3;#~?`z9kQwE}uOBB}~CyV~H@1Y$>TY@&)9v=?^joRj-8G3YT<6?$}y1_Z4 zo(lwl^Yw)idU3AaMNyA8}Ho6 zx#MW6_alEA!Lh2-T-%Rve$CSob6gQ?JQ%Cu|G&qWnwYaPf;_1gsUE`hnOZsEvayi7 zZmd4T%mH_ljlFGK6H$g!@^fG9=%xW1Zf$F;X)9@ zyXVm8?ySDG?KLp6-3iiG5qgjV>~Y}ZJ<0j*(RRCFZaK&U=zGXneQV`85Pb+>SxhX| z9%oE#%z$I}k$K#9$4%RPsJY&Mvbmnibzig3Uk1(=T%Wj|A>tpE>j$e0xw@Jfxm*u` zYt>av75+vCDF4iuCnm@P4Q$1r7y8a%90{;*VC@e1S(%i~M*Fd@&O7`y0BNlVN8KO? zabD;L;+(9U=uGoj#hAJ^zvO6dUP<_PUP(C0$OFgo zI-W&*zfKB|;#xW;iW>SOy6EKn?j|MSPjse^l9DjuJl0(AM}H94s*s7B6GSj`2>ej}+el0V!b7`}*T`ZcnvCW0|hy4|tt!|x^; z_gNT$;j@f+3P2t>_i6LK1x9}71nJ(7+jg$araRAxM6>(`-JI_jpKqb|iq6#6Md%qN zg_oW0I?+DgVm@C$-2~uRH-T^&%F!t~Kb7V;qP+V?z#&ToBzF$wvGZ zUUt5PAP=nJU0Cn zXgC+t|D10m)fg$@`mbO{e#6pz<~Ne+NwGv5;_~zGXRv=9BaXp42VR=V|HN3J;2TL5 z{cel}P+r_8H~DDD&GI3m)AG}HdD(qQySy+Sd&&vYu20%_KAS^#p2xUQ6gV$*(V<}+ zfaB~VHOJSA(6g81hfk&C-f63c{%88+4||_X~=(Kg4aplPe?V8wDlyq%(3bfU#ErmsdA& z+vHWi<>du;_>F0H1AT%5ZOb!Bb!v~uu!*>4kd{V&cXOlvU~{9npIG4+S`7Q!PGJPs zNL9)s3g8iPLa439wvW{N>A-*;l`k0V#lftQZF zze1nM7A3C({cWK7hqr^Cfj-|YF!H%sAR#`{F4qbmofu+KVkwPx_ z{QwfahjHgRF@N}T)9iNv_s=}f81XQ+hc?j4>7YIwEscHwX!XA4M!ydntK!WSe&Pmy zExvEl%fU$|9S?vK3ef8MLOM+^CrrJd-hRrM2jhy@Q#f}|!@04K`-^E@_ZG(S{SFiR?Pi>xFn!^lhLb9B$OBV0(}??>rp@jMpuCLd`v@_f zpJ397lwL{r1cBkh<4iK1E!6%YoSed0&84>GC*h>(vEdzktjl5Ek~hlwsyXn|fizho z?!Slj<#xlqAnvc71rq8<%BE-P1(2+{Tn_uO43NGRHn4xewticB>EkviKiq5T#cB_6 z&X_CmTjCC%9GcRNA%}U>^n>!UbaTRHfAIYV0I6NfAKq^2B`y|n9em+W(2d2VZkul2 zu<7QFX}T%UXgI0_OC z|C>N}b-}Esg(62}q2tJ|E=O(uQOM~30O+no;OIX9v!34Wczf3Y$BO>nL1zEc;OxHv zoc;d-nf;3)tN-6%R)0MR{VT!M@AL|h`@q?M2W0j;N=alrIQnmgjQ*?zVx$?e`acJ= z`g5wBkygm*|8uyaKYNiYazAAE-wCt(b8pFrG(v8_(>p5?fI0n+(yU0AouXD3MbXCX=)m)1F`>5cH2&DzY8+^o3iOnZ2!g0O=E%F75!bghj$%zARaUO zJ3;Jc4)~F8f=PkwzV{ll``$x84##~*2E1DbVmQ-xy>iok zJHrdX5x%PFzOf??sxN3-KlY1ky0a_yw*CXTM|PcZP<_^;UmH6BuKq5V)&C1Y9$4A* zHGf9a*ZkKy;n;`ZTJ^nby7ND?+Xh{aer4=B$O>0BHIE(PV|;7ZeNL($fvo<&0cZco z?6#fQmzGU;Vn11rHjj1XuIxXO`_`@x98~Xutp2ya*^ZyT2DWO+E=Qg3|HXVRQsc_BB{Pq2}>-Y@+ zfA&fppW**sbeoRPG`vi8>>D`~>JSv<&}orq6I&0z2&C+i+=Vp{zE)R&Ue+c?%6cON$Q#>p#oon6-V^=$ZbJ1C0lf<3V0RXchO!_E-tJ&12cnHxe-UYa z+!3ko0KRX7u`0&2A*eZS&xJgcW5k$N3}D18MDqg)7lNP^%YstY=7@-*=P0`sMy_#y z)R9Ba!~~G!Puh0&5(uNOa?gG8v%=aE@4*BbwrtjU9Q5doMi;Km4 z?HLWgF>LQ$9@qTz5mq2{>cfS#D>u52KJQrq;fe}D7C zTt2l;H~Wvf&>t-1@(DdIL;>XBOf@9wwHA;Kd9_e$)LVd1T?R(Z8U35S3AW6VHI4=6 z{VTH`<3n=~>qB!->jN&2A5W8qwQmsLy7lEE_=`wvIq0GJRJYbv0P*`MkK{&Yu zRtNfx0Pck7tc*8@{0)SJ8v_;L0}hybARF=myiSI!@|8l~UK6wR)K&fe81po45u&d# z<{1(TD=&%#+E2)0CGq6S$j~<-iu_$$2g>txpx`<`^i3MA&!T#x1LlS@`_>}gWzpFC zrefKc+_{eLfAiO!Wn=5adBb}rm=y24J%V^eSsf?h+}&jHvGZbyCd%6eP*&r_eH8oN zGkN34J4uH8K7;e5PLOb1NwHK@NkN#;zXo`mIMfNzcn#I9F>bZS*m>y~L$)!7(#9Ag zB}dC{fsv*OzPEF1cMjb-^jWG4<0}Tg`YP4?Trjr~gxOw{S%;v!o(JLQ^C27%#iLyI zsA~~=a7>#5pjfd3n0qPsJecD^40N`H{QJ!PW5hrs5yOE}$P1XYCJoe8y@vqbr(BQ$ zbN?QM*^h1!qIaA8S7=Vf?hw89{C#hu$eP_;bO=pDq7w z{=D<4{3$W{vnhv0Ee`c&^{riJI>9!^e?3%T4Zl7WC@?+{l-N=%^H04E}UE zU@mf`%f=sTeK}$B24l5&=Ssd0^OaYrj(GkF5$E!~$^a;drAGZM;-S|CbCE}*0b@_S zJIlbt8)RNfLl)JMN5=j!>5mbEOAR^Z>yEN9>uZYW5KzPi5?AkgJT&I3o1ExmV=(iSQ#1GXmGp8b0XK_T zNi8{L1~0~J zym)v^ZB!Q>+JBE5Z+|K`3TIeb3NriFo*)J{u60`6D7=IlK67n3m;(>uGoeW)p$xA8 zaGw-~%0zR>zn(bw8o=v*vmvjG(&_*>cx?o+*_!7F9IXM^aG1dC_4DXOVUkHcGR3FS zOZYU8^Qq9rC%zUfHTkq0^nB#g79kpC%wyDe81>UJu~Z{P#=b>-Db;(4I2Ze|xRAi_ z@cNI%$B;|d&pgq6blk-IixW&jA4n#~UbfYy)ki`s;yIdLQZzfg-RDKaKeBwLt)eGv z$+Jp?p2kB|e}v=HW7c+*Xy~&dKD%eI;RzF$C^yT7H_TwekGo**aU#rqc#9C-Wa9Lp z{{c=v%KQHpPG@}zPQ91GX|`o=(O03a>LF36L>XFGZRA)LQ}vhW81?-xU^LIfD7WDv z+VFYWdeep@{t%nkMogTiO<{NnzZSO89w$wFzGK6u;iJ!+=A$EKu}#EbjOP?fHN+ue z(~e=pue}fVe-WQ3rv{r19Wt@n(K6kJ+OfIW#O5P2_!r(eume*23P$|6i3rN5Sv$Qs z;8Gs#5R@(Rsh+$J^sOaEUduW=653K5U3>Pi!L4T>8;pri<-P^x?rts3>mYC^)Oo|_ zpGc~E4#5T?726bPMjTb3i7t7-@CW4J);WFet)0{N9@JHZCc@_Zq(l^1XrsA{$9`pTuz+4;)_Ftbz z^%Dd}Fg8q-+;frFb(Mo&Ur2eJ$X{R0<8v;nYY0f`IY$a0efNo^iabn+9u0Yj>mhOx z`$KLTIj?tKZ0cm5^yd-x_$=z_(ma`!tNhs|XBG&^1LyNGX5u-Ff$fZ`djc?0PXq;s zJkYUIezpb*chG9}V4FCP&OSL9$bgpwzdR7=S)}~n@0iDa-`P!V z^sc2RGw$Aa@1u8D1m?Cr=&JqtO|IC3AhDqY;_ZrgL$j)1#WPMpihonO`3kvO+nNSw}@OG#^9X?d%!^rlu{>5|sG*x8)& z6`8Gqqo~!3uPL-b>}*bOetBzQ>5|rCfx_0C=HJ{}5SZIq@Pj>f$%zX&ZzV3|bR;gU zemiktwU8LexjHeDlS@hKk7$P3_TttTN*A^svGsAJbV2J2W?yfc{e92u^R3bayx$k7 zllOhV?7ypYVXLQfNo%xpLF?&&r}d_~;?{vcVQcRE<*hf(uWk*_zqz$2Ft^on|DL=0 z5~DdEBt~-%B}P|&m>69xB+lfx5~u&q##K_fr1htz3tI1~D`{2gO3iUuzma@%>%73+ z))GFhi#cy4#&ZrOF0Ot%G0w+zb>htb*|@GOUDEnS>4Mgm>aJ`ZsVi&Eo&RU8H_fkU zogbLndgc9am;JtvxhB4Ta&KLV_ zEG@>X0g@%#9lx$~F&pU4>HT6Mo6&(GX% z=yb)R6L;Zv517A&%YQF4)4N)y8Lj_LU9CT+&ercF^qdb%t6TRZ^wmF4e3b{&?Q*h@8)cS0c1woV98i|lJW!_ATu`pYe1wsN&Lo@%&cQxr`*?Az zjUfEUn+;OC3?p^3K=L|4vg>rk{q!yzvn2Ypc0@o~PL zFvgGL{B>eWM27!^zDI$Zrp`XVBC4Mg z1?>$Ya32wJg)onYOh1O-@n1sq8gLK4D1g+J2TC9Vc65PoG~m5a={ooL&Wap4xDAAG zeF^BkkJ|?8b}=p*WLRL2-%Xd%@@fvN8eT}SoMO7rz~ zpu0t=IzbA|y?2kXmkS`_dxp>GnYNdlFwb?boB6NTEDn)aN?1-*hI`Zj4Jx zK)*Kwb{sFik>{lj<;y|Hk_TSd$yBaW0=>6ulPb<5p3nW!9f8d^Di3Ots^FD_F+mQZ zZ@o?Ee$es#N%fK#+g9`Y&{rVxZ~_$cdpCVqh#2!N)HdgVE|Z$$UoAKGpyFbNwv;io z{sz=lhPIgDSg0;gP_DQBFM|RUlxwZmeV~90%2n2D5ESSG#mAT`<2(yN_ktY!OYxwJm4jd1$<$#Rf2}y;Y^vUxXy-*y!+4IL+3zFM z_9&miIHiy9*fwd@(epYy)caMPN%dZUo^NG={sn-ZzsoWB+6U0?@XoIA-{`ZSeY?OqFi{Jtjc!!N{a);URDrD2UyI#d2^saw#?*(+q5!V$9P} zNOjb0zyV6&?F>V79`;y`1AY{rWKyUphFkO*3Aj-0oi;2I=qp{8Yi)MM;M zssj}D$8I#v7XuXb$CiSQ&&g18Jbt6G?(p160QC4$W8LAeR~k0!ktLv~U6b7P{sie`*Dnj*+i$4=ZyG##bS=tKQ^yt&Asvd z^g2tvUd&X_YTy9Ob2Es6%{NosvWsY&(KZ(6*M;qQxAt3L1jirBqk3o-^cH1+GTJC8 z7xxQFnOHphB0ncs#OM7v0JqNp3d*vNv0jwp4=0!!%Y>fBEUJICgD6dTRKG7kl&{=i zoZDZ2vr&J7b{73F5NeKFSgW5;_0j!;f_@0f2IpR1PW8|#&_k^;^Ek|>a9Cns25KPn~cElkQ1ahuRAvGSNVr+NfmJ!YhLCL z1(6qKzd_?{cIaO7^}Pnx9=#d#YykHo<0}SHmx5WFmX5ElPB4`U(2F`0tTUZy^|X)y z(*A8pm1A&~iNVzt24|(_vxk(V{3Z)`j99qy@cPiMoc2h4km^2g^w$SLufG@DbMym< z{fIvwh#ZUc_X3x-b%zkj6FG=>pnetA51IEeSbVHE^?;m2yUGX|KAdFIl$|aau0y-} zMZ8+) zv61ipdzf|GFk7hoYW%;C*^Bc39J4>00kf}<|8dOrxj?!gUmmk3%=w(KVfJ_cl!G?R zo-i?c*wr3M*-4jWCp}t24%$f*o8jBIj1ZeXj8#?}``z(QXQUxW^;+!T#Ct~o6n?M5 zy;E2Bh&byJs#v+iO3+!q4{38e9G$_i52j zHqK1z{9Y}WRtWOIIVen>>pkcIDJizk_l z>%ha$+5tan2cL2#%#fegJZrbN`C)!03_w^#TZ|gBchMi5tG_+jRzG4nXb_?GKEp6I&0y=ye$PQB7?9Y2+%f?_U`A z1z9{X_A!WYFH4!>TO-egmP1qodEoI`OpO6lom@_%Lt=rJ7zD+NZQf^-YKm`V)A>dL zq!QWK4>Ix)Z<;prb=&mQdg)#@ibPVdVE>2!Nim5C=DuQ2x1Fz!z@ z;{Qp?7FaRDE|MRvfqY)y-`V`g7;#X&n;^Hv{@6m$yIls)36A$V<35N_mNKu!ySa_s+iuy|rGAVP{+cm$FQGag&q8xeTnPGJ7u93e8Lzo*zYg?Y8CVSVPMt@p zoZ^L*m-xr@IPKl^{Zn4EMdX3xb!Lv|n}!bcyFovj0X?|(wLcF0zK$=n(OsjWL%S$C zwWR3MK6Ww{W7OKEObr!M{qQoTwm(iHCkTwRmw=8oqt6M_kDa^@R6ExxD7*8RihTJ9 zV`9TUc?m+-C@T*zb*z&pvWx!Es%6ISKnDC!&Z9cygYM0M9Wa)o1P?G3zc*AND)^m{ z!}v}p7xeF&pT!P~3OL}0+w!O`9$yBWPKd>tZ}Vd14jkJ>R+VTZij`A9 zT%JU{>Z}T1pIE}wSSNisG~Za0-<|19Ip3oln8t6!M^y%#-d(=fo`b1`%u91Hhw`R! zFdPThfj;YRjWvBhE~o z;pdmcBB?wKg-i1=bgEX|x^IKuJ46gzBQ`$gWNJ(RF8gmTVX9n0^}VLYa!)h-8o-f;^=&sPYFm1DK$dG930OjRgg+_Q!@x4r`uE5}}D))d4Wr`Hw5 zo?HP-NcavZl7$Iz!FhTO(8>W;~Njl`nF>RknWyq63$eMf9?^ z*OCLzku5jm5W1B{sSB#W0iWL#0Oe$(poDG(URU)7aTsgMenGKv-uNEkKGXrz?yzYf zwGs4jaW13?^5EN{!PqWi?1@gHIw1;tP9ID#wU0p6g$h9#GS_0OCX!4VoWR!&9q8}U zYF>j6;wrBj{BIC4T+h(QT@e8gv~B@zbqT5=0St@o{5EXK}Yp65$H3#*&; zdwhMr-B{n{OnRpF3XssB>wApXqe6A;EWZ8=Za~b=Joo^sc!#%lWsh3wKp`z zq*xu*Lr;{Ajk@4iH_1QRF2e8~7n$^Y28@INWm%~G3uB%d(YQy-TVd3=iK9%y_pq%R zv1GXO0+V7jRQHM~lX+T-D>LM2s~)@jS?Kh;*Di;H3#PAb#eDYMJmNsO0;IFtE{Iwu zKkw|&5-n{nw*wizW;RIwUJlAdes68Sw7L*B2{@k)%izlpDtd znRn@(TIIGowFuRRK;EfW5Ty|ck0J(^gFJv3IV%=v_`D(a;^CnQ#@kEjW#aOBq+-o+ z#1Z0Wi03N|JpK2uG}Y%jx-kZ8Om(`21wbq)AtLgn24gL2K(7Ve)`856awEe02x1a42QkdfUKMcy%K=o5)#+hK`Jlgh=Nv5LhMjykj zPwU(=5#)iUN156UxE2`q0^Ic|Q_+96FqSC0w6^fcwxnu5JDwg-8vZ0-6H_>~?nu`w z%)KMiKZrfj{&I(TNAx?hK|00Hra3rP(Jq~@6O`{|K<|PKcvpUHF~2(+b%EdQ~5iw`_K7F~y92>`& z)CV+rl<$cd{&dq;^bd=*5OIfb9R9YX`hi%aofHeTAwHJ;)V<)tlT7`8=6S>SXWS#0 z?)Mpf%@p=5`*ST&{dYHlJ`3c5J(={(-b|35GVKhmIW>YXOfu015p55Jk#nM;)Vn}J z-y|V|>6eIFH{X9N9FElqijixBVbKW^`m6B@&{5t7XA6h#aNu8n?;o0$qCEIW5QjqW}3*iIjXW4p8Z*5cY0ARzg?=p(p?hXjy( zb703I;y&t=7bz&$=QeX*Rb>LW5qHR)!bzrH5JBrMhht?>I4tus=*AhXM>eN%Dn0K3 zAicabsroYDUEgbq73}-h>Gv~C^F4n&jc2hLbYkt-VEkskdvnh%F!EFp>O$0p_6y26 z^UlOF5QonX3CdHZKRuOeG4|yIjI}^8?ox13{bUZ+!9n?*7syp>ukG6a%l72ZGiWDv z2jEyTR}NnMaAjoAtuS&80cmVDRMiuAxR2ipAPhGwp%()@H(kK*`b3@gIYBzq9P(EH zt!^~WuQTT9BS!s6g6DZk`f*J;9ss4UW8K)s04PH|pI+RL>qgAn(@i|NGO{}W zBWRN;K!1pojd6da&b&jnqil?S-w9Ie5gPT4AKDdam$Q(k;2`}t$A2?9X6dw&^UR&9 zC%JlSQpNVu$A*2(G^Y4+s>jTGJn?({4qx*gPyAjefH*2J@m?_e;#tP^g8GS95FY1< zXVFK$JrZ)&M5g)VY3mG~1yae@q&oHpjmC22Adat^y|=5V?b})WPEbJtwuO;JwEtY(XxP1S0OH#FDX2@6Q=Q5inV?%bp9Dq zXW#X5klUY+7AxO<3S~ldA8?NAJ_ptRV{6hQ0*#gfjkW`6*#;n$cTs*10Fbid#y-c? z=La$Na!|e8L8B`iFn56iqM?5;ADj9913?3zQ6JFg`Fud#vcAOjAOCa+TpnHef*C7{pCAMUE6B%Q2r=ipVzNgF(2xI%kM!@ zzWypxDeyc})P8TRJr6Lo|6B67lhqO5h`I0?0^SW>apdZ$G9x#wcIa&gl)ye!pg4-!tS*IJtYA8UjpmYi5A?TX~If!-@ZQ3t4 z8D~_e06pNK(HKD0uK||zx?qDBb&^H(*h0|HG3MErMfKhL7AbNT)nDsnyk^U~FFF0L zvYBcY&xt~1s&>ot8PE@}V@8h1p8+ow4lh>zp3Kd|^^6o7I^Mk{H}C1~=2;p6dOW{` zNWmO9{o{R$6!&_#HkL*8Z}f6sXqlB;3Y5sfzunH%e2|0b`xf>(#Tb`EzV?fU3>@_l z=s`}01nB7lVfQxEp8h8oT*vpsOsdOI(+GZswp|!r%=4WMrE+k?cBU=`IoP{zk>)$OF#-1xT z2mf=iQeG(s-+Pj&e6Nx~55Hr22oyf9#h+DJ4Mh1Ju@zJwV(fIhMvgXyKBFMFFgE_x z=A;_0p;7$22J%~;5kSIrJFb(1zk1R(r*!=TNI&14RAKYRF|4x#6va)^Fr6H^hJ-2S+z?%%{z{L9y@+&tws$RlCwW}eUA$ke`X znez93M)?(k-Dpo<>S5}MZ#nh$$*JG(O4Xve4ByrMe%U7GLH+L&ZEe+dC;@nOv8pn8{s>g}1Z!7GCF0|2Q`fU0%}Yye`M z4QS7X4F?&Me7Q6#qZ~lE^CDv&ubW0Y+%!r7S`JP!$(K#_KpWj9XH(trXwoC2UnM{f z`d5MgJx}6$=)(Z?V82PzCpGW134UPn57F02$rfm|EE6_#J3z|DHA8@^G6!tv6M>(9 zw#%a|8#dH4Ced6uIt#$P!cC)2Q4ZdoP4#Vyve$Uq=q`bueGpo3uEIlfXNbsA?`F_G zVa#*2Lztats^|B%9?pELr19I%c>(X?5}X$R=|97mhXU0HA7ttX{@+3M2^_xwRhBNE zW=8!2%AMDh{@^zK!Yjrc4V{_4jb(l|@e1>xPv~&U10u@o3iN+Vlm<8YijL>JmW%#kLhp+2PO82IaxnDlO-e%sj{OSd>))MJc|C|%4qASX zuxC=;`0PzeA;<&WTOJ<6^>p7ga`3ndlpj99)DwBeeNnhZe)}Jc-ygdJz%3WjDEe12 z#!({lVjR#dLhl6!RQVWFy$)Db@!d)FVA>c~TVp7fgC}rp&7pd1!r1@rFz5036HGm&aM}+vaCvf$`Y`_!-7IN!Htk_%|`I=@p}1qi7DC z_S9Xk#CZKH^c2-yui)H0AP?-_^2iwS2xe1#IY6|^0s1QsG8N^KxLOW2Kf%;d7bq+b zM)poJNiL_+y@H$vAY{qq5WN?ms*y2O&g1);J7(I~iV=`L_efGr#bCMf73lUViyvfa z3}dMz>plLRNfqU_?J7BF$xQg}rT*%!?@p@so?%rh8B=#$_IDem;z9Hyb_K5IJ~Jg4 z2g(DlZDcCG=JsDMQU22Y`gDo%1^a6{Px-w0dhLTuZO;OIci?&j^?uzeOvO0U9v>oK zc`jk`5*`b^eT?k3xQV{BB_qo=+xL6X1_=)Me9h+k4ciGwLL1#>=O1zp?d4wl-W9OJ z2PFz|%0Y0HKbMkydQQ{{(tkdjRO>+w#w#F-zEj+Talf%o_TeN`fxxndzcZ;?au3`C zO1x4IdbwY4ld|VKlWN>IT@N>Xm!FpyNLYA#={CJvfZo_7QybIT5*AIh^~`q+9$;MZ z3BQ{Ml-PrY4|i;msY@qW53Z;GjJlm|&)XSx@Shl8vwF}LP07{x>_zJ{$JA##H!+XX z+?P!E>n)kZJf*ll%v2E3GbRu1}N`N}!O)}n>Rs;-@|3I17&mJ`AcQ9{X3JYDVKLqE;8`gG`M_{sd2_UwaAI31}Dyyfqv_Q zOa;bLGP*ELHdFU`pJePb$|jy;oOwveCim*g%jO=RA)5+AHea&ICY}wa(`6IOG0)@8 zAe#%D4B3oLOv&bn=lNNu(_A*EL8+CdWb;om$fou(vN=6r$i|l@o6!w_ifmqwBy!+% zAno4i^XC15bwKr@8;##rxR3*ONZ? z=4+eGI?R;4Kl0-DC;45M)d#jRwNHR$E9`P86_kTFPs!o0pEqnzJX;Q;4B$JH>MVXI zUx6lqoF`yh3i7~v`;+RZ2$f|38-5^wgfUI*Myek)a;IDmdy`DMT>c;~LggW&t>Cer zCDr^ky6fx&Tkg+*9YxRGq*%Y9x6dyJw{=a`F%_hb-7g1YVv$z!{PcD37-Jp>$ial@ zsf<+!%3&}sniL}hMu#{<1Rs|Z=BLW zHqNDdIu^hC{3MTQZat7xa{=5jQP8etOzj(IRqv*?SLjwd<$){cT#mt!BTz z38UUT`#@4f9}jIO@)Ui6xBiXn4&_0#Z<1AQ3PQx{uX@5bOWXc9L{2m2VRf^PO>70* zo*`(KEkJ$bo4@mdK6D}1JI3<@kLRtuNkZk|U*(Qt?6%?h43N;Lc%$FvkAobHRn%6$ zy9MK4s5-}g!;w}W-@8rA z3&9^U`+i{y-)HBag~r)3lmXf(d~THc(x$CkSbIr+w0zIz)^mIH< zcUgOCi=JXU-y7bP#P6iWlzxACUmi$bc_^v=rjSP8%b|MBb+a~nd<94t3;00}7JwX_ z*T;6&h_K-qFn-tg@4q;%e$1Gs(5T4`)_SPFIs-P`QVRLVu_&tP0Sw`DC>&DeF5wuVy^xU&4$@h)V3edC11slErAmOupPB|DVgw4-$ z`4pMILzb@%ZD;BpQrPnUvG(opQB>FCXJ$6LAwVF>CYuB#8&E6D!v`Az)s{&>;aj!Z zVUUNY38+x;6?uq?Fadnjpfb(cQN(XH&{{KAo9eC-Yij^&t&gu5E%rg{ZUTsc8VHX} zCYk&D+{f%I%d7qUH9NC2=bn4+z2}~D?s@1LATQ&G*WopbVVAmKQx1DVTE+PVeaw<~MM=F-)|u!tb|_UtVE;4R!|Sjhtwkd#7*6~BpFWL{ zXH_pM>kta`kyv)>y;SX9?L{9U2`NKvnbuYJo+4UYw;C!V+0av-PDul_NleZjkz z4(>&9`tbz=UytXUN^>srmxME-c>Kn38lOk}Yepj`#|Uoy58H@+%a^EA+4ff~=eG`0 z+CT{&#c)>t!ovI`EDnZFfD6@&+7OdZh0)&Z=mH=VQ6Y=`0$`*~%)nffF2gRjw%Q*G3N0FvvQ-5kq zpB39oZ6LxI5%D0lc!AiGu4ea!7eu21#1BVz&$R$$6`5j7RVK9o;&+cD+l~pFO0T~pcBYs&1a>dmI*#NlpZD9-+b;8e8?#;R zE)Ax)U2ZLA{r8SnFIksdKNHJ3wtSx$(_@Tcx+0VBMF;qeg`D~fmhI}tt0x4(ht~|z zpEyO@Fm${+(y2(18=)m46zMnhQhBM>3E@8@Dr?|=O%%X?AMTq|G~l-g^N}+3Sxe(5 z3{Wew6bX+rc*m=6J=q4pQ>)rKj+~1IEfk6hMS7kA0W7O} zEmWR`<*qD|=m8jqZ(gCf9`Jhu*n1*EhwVF##qE_Hm5=@G-g;2q#Uz6(?b zv2Ew;8>%i=1x}Hob*|ABgP{|zfl~OMYMDq2W&D+TWCh_TN35Li_Kf#25=8KaOdiO=*kU`UR#Hp>2WwYImHr_?^ER z5Qq$;u>~7np?kVbN1C5qB=rX{EzPuNB8hPZ;QNAynnd|=TA}y=i%s)k*(CAo7Ol-1 zjqyDu@IEg>T9607=7LSe$nh$k2Rri=N#T?>xt7gg9>NEoNuXEf0F}fy<|$I{v;A#% zzkHU;$uZd^aWBo8~TwAk+!X z(mHyRrR{oNK|Qi9EHLtbr`iC^jH~=OD%j z&%dshk+#-?rnTAB_ul5Q;$YYf%2+k=H$))$zLiV95Awh zt}9M~tCoQ49SqlLX>h$Q4X#CJz;*r^aLqjhu0K8nu6HEhdL_fPC=ISZOoQvU`%F)K zy=0zo{vJOA?j2vG$NkGw;QoUI-2csR|N20G+&@o)``i0YPiN;DaNT|iT)VCGxaKC{ z`kh5_eLD@V2d)0N1`_EU9PnS$`Df=y=Z$8l`x23`L=V|Et{WIYDvoqj2;S{(&cnVyfNWk@8hU@p!;JP#ou0zg%>w+`jnt2Lb zyPV`9SM9v$@;JP!unI-ek#83uSkEs@OT>B z)A5B{5^=8@_+R5LpCj(Cq{02hv&8+9MBK$e|26IxoFndQ)8Ib#EOF;j<~P<)?X!_j z`)JG<^Di=*`jEDQ2gA=nNXeq|{gmSn2m+L?Y_-QLNwyH&OibmeeT%exCte-eV{s0(CbeNFL#d9#)IzVL~ zB60p+MC1GotmEg3B;JtZzpnxnzdI5XsrE6>jiz#+^gYNm^-aZX@Ub=`BzK-bd=pOy z4*ldpN7G3bzjowNE@0FD4+v?k4)CAP+O2XxXax`9RUDMt=P!ywVn zAL9ZM9{kicSkcrqv$E;RWE}Yhcrcyn{_JRJ_?OWlvjLW^B6pCup%8M=P#ns zoMsPrZ07`D^Gx9z=cY*WiRmc=ub^(+@CW${XrU0F@ z#D~xUHH`o={?7|w+yY=2EN@?Tzd6n6T&CD^OyKnjj>22_M=qf7BsPxt4X4iWDGsP9 zn_j1cn;iEt3Q@>x?;cxYJ(5UR?evAD#pmn|AWp87jQ z1dlJZ9w8pnqqJTu$(@-TcgvH!6g;Vm!8c)??E2^3q=vLpZzlH8?(!%(3n*nEbTzWzg)GEY#K|L82^1TB~Mdi6sOL=i}>c~H33rt z7nF?)5dV`-vNnDLYV>=GRONzByf$tK(6v!Lgr1?{^>#2|X){Tk$2`3%U}|C(lnqaT zQ86YC<4OjjA_2zd0ZX&_+ncYOS}WH*abUpG@c)T$c8ra~nZV%G4xupK4Op7p=Tw_p z#0Bz#JE_k=_f(qK380{k=6rJN7jNMLMcOe=kxHuRyy^P9 zp?D7-vl1fz`0lz5$n!faB!A3eE86^g;Am$K`l?7EpEKs^dNt;yK~VpP?QfWWC;N7B`UwGaJm$YZ zNW<4-0{HNIB;PhW+vUKY)xg7&TLqA7h3@i*;P+MW;Hwh4Cq@OgFCr8W+v5o$)6#u! zJ7W31gaW-vV|oC|%a&`)2+uGcA|~XdNv-X~&S6NM_z*k$^KvxL8itLZCFg^n zxKHFDoX&*Z zLLg3qo&C=5@%uL&FbVx2fqwH2&^b-9cJe`KD*&a<4Ong!jfKDG2(Cwe&jm=n1Pg`s0EAj`pLqy>j^$GpA7Hm% zHC~ZE`Y{*4bHRp5*2jK||1I+|%sl-T+%}DI)l=oGmybdKk0^J#w~Jt!m= zDAM9%^bB9=L7}GoCiNBSL7^SIXyCc=-fO1TY9PPjqUimP;x>8>qsnf$F;|)2*27H23G!Clb?6Gmv%}fV;Dc zoLd_rLZP__=-S3}uaVFWT8x>TdSW4`b_hi*|C^iSBpUx37pUT(>><_Cc4YN$``2pR zpAqwh_Ss?!<|kE^pgOjgTC0i38UH@Ptw(vK#fFdd*LVJ4X{|lTANyu2s3)H@HE$2{ zhXF#QHUQ7554~n;ih=ww8RfeEv5c)t?A$nUpIYi4@P0qunpkr}1PEVPM8|ppjaAem z>$$*jHqIUE?Y*NwAHRzW&|EH{+d6;ZzEMm3nhW$c_I=l>Y$Ghjf8t3R(^^{zDyG*P z&zYDnmepBsM-dCxsq-7=(C+p!f?`@L!D-n(P4`g8mq&yn}?{!HT@ z$$uNhsdYnoHJTHG#!4sh$%?_yTtH^eBB+%PI8us`T;+n@ z@YZ0p2O$sUXC)3eqHrLWWWtdh9LPl0_ks$*tH8dGJySRp%NMcxR*v|i+AxnJ@M9mShanVnjO^dcMwP77*AR22Jg=oJx%LE z@D5Nh9OBdM&sP0ID2%}tlJQ=Fd1>tbXR_6;ydwRAwew9cl53rmw-3LE3&h^*r0;EH z@4ajy`Fz6hUA!EJ)6e)W#7r=Yg(>&Gr zKSanwZK)n#))5GFWBfTPw{e1KR3fDDE>i1Ow|zexoFeru;sVM^-s+^wkJ|rT|bo2>d)En zF?*U%7_Wmv)f*W6aeYW`&c?AD$x4>k;&rlkTxSA4b8^)u z?C(z?xi*{jWzi;6t2%-FvG;zNtFCA7y?mU`y9e;xJCv)=do+*u%`3U0v4V_s!P09S zAg?R1=buL}JwHD-|L(%`rVIJkjTDXAos?&JE}^>ZM@NxNd~GijjRgc&{?f78AY*!M zLda8_B^n(Ishm1>Xz(cJbvFe~?L+pT&Ho&KHnl(Fc}?xsKDiSDRRCd9`#0hFk2`_v zN$Y^lcRZGlSj5k<=FV@CyxoaqPNn7lVrOM^{)>zj*M5U!5X2TtSH+Py&UtD%duQBX zBsVhLayFS-@DTFj`3_D9uX4fe!biu&;#aWD77*xncYclJt+@#_-0oKGwRhekE>QIq z@+W@x2>b4EH-$0Fp3_4N+7+B=xR--qNzHiz~+WolrcvQkX%3kh%V9sMr8wyQ7W z0`~K;6LJnE{P*u-2&~0=W~OLFz5_SDc6>*51-w2Scs&Ay9tP340D#1**NUKWK!nTh!zAorS+T{T5JHLZKFc*wg3x&H8 z@^B(vkHz|dZ3Oqw4LtR!{@?_b>5KH&`>4F!+J{0boucs>4=oK&AUv)i3u>^;d8`+e z&FnC>Rwo#(0)#v8Tv-65&fD&7L|+d78zIkj4#F=#X=%}HB0ulO`*dZbP=yVJ>gP`~ zyCOShS@M*nVIAu4ClP^*=@>Myo()7Ee{-9uc?}doPPnv|138#W&ju%b3xTR`Pz(bwYhqLQEfr_cnil8rp7YUI&Cu3LJ~o2a?B; ztV>YZ-g<=#h#dF_MyZY(0h(KI9j{0SpD{@sAD&woQB$+`!q>MG8+O{9LcoFiyG171 zr#|JO<*!aKx|nUTE42ndLM}kOCPxmM-SiGyW2w19?emm&4#MM~Bz9#o=9Tk7jph@( z@@_o-v)TAp45j1$^^?>mcrt*yi`jmN|F|HKGfqsq3;Harst=Le|0DY>ZOl}vPGf`XK&#Gkv$b;ykJHW}Ec1I8nZ!;IKXb|>F>Mc0 zJ0#If?%8f>-=*`j9hJW3CABs1G5bN@Ai@E$>s-}rY9-gxb3S}OquC_7;W}Pv3oWAK*5zp^Cbjq8 zu*m$t>jdvJGkGWrI7P$FVI8_a&rxhUt6T3>m^~kVo1H$MJqRFwd^=sU`Jl9Yd5WA# z_PTpLY2CFnwF{h%>1NX>HCH#GRXL?qg#))MwzP9l)}9TUD)&w^_LYmqR1l2~ARH3x z_`lneV}>a&{qu{hwVWICGB1cNm|noMIN$8_G3h({`p5gmU}OrnW*Ww_#0erh%qF#$ZhONba&*w7`$fA@M8+7md)Lbx z)^|vp)V*(5+A}>^rYa(JHt_gfv54AtKklc4B-)`f*m)=C>lOsvuD5zmkl9Fh2zPC? zw5TItpF3Ej!p0)?yeE=<`Z2Hj?Gt2Ow=DZqFw4xkPG0o`L~UhR-Mtm zE&d5ht4@f$qP#9o-`q%To>jdlvDa!jjQ zP};U_;{qJh6T2I@K$OYQMgz6G?s}fUB{AO{Nu8!V{hZLBjLx*7&k7H@Zx5S zlu}R(6zy*Rl7-2F#p(K9T znh>LLEU~WeEtL29hd^i@PvW|z3a28S5NIvh`A3lUN}Z)K`+pmN()QWw7PW!$SpF-} z=bXoKq;U}5Q)g)pCiJKB8c-WAiudW48`+s_Htj?C6P7jt!2LoUwMV|#V`&Q4J#k42 zjM~w081)QB^meKZ25xcmR1Ou#`*fm4o*F}h6~tvo{1g#6*@QU zdG*HYmS)qZ{g#w?Rwu}>-ezi87u>T(tZ!$rnD^gqYFNI(JpVfqM@ivFn63J`-_SND zrS@Y?ydTvY<91QJht(E~h7G^^cFIeSc^Zm8r?qU!+TMSd`fBjZzW)f@JBZF|AbFV+ za`1b54pTpmYb+%DL6P1=$a6yAvAj$C7W&sy{xFRVl-CpM0^@z=R|+|k2=g0BoMLXQ zZ(BgE&5HNUw=r2}`NKv_OXk&7Kfr6POn}gnT}W%prLw^7BW5>s2>JTROp)ZTJMt@X zE<^fwxDUx4bqO@Z?GB8$JBYR0$mUnWMoVi)$b;eU9GM8eK;N+wR1E)Mg8X3Tis}}) zq&3qulCGs=n5PlFf=~A6z_Njmr(^lyHjBi1g)rTgXUr%MWDG60YXjo-^J{iyN$e?w zARqI1%R`RB^2mjv@yH<{XE;G3vlbHlJ$Ee^Xcb6a!`v4D+-^Q|;?_Enud^*ihYvx; z>%peO`*mz?F*@8t$4mMJfID&_)dw!OXuLO=D0~+j>R%D^U^(}nEFOFRR8FP& z$=zhHz;mt?6iKn-eHb?sWcLuUynBpj7`a$)E7T_*rswb5TZ%c$TpHnMF#^F54;6w-0yg#fCqEvJk0=PdO5RJF_ zyrtDHkjYu6P^jlp_(W&Q!uUF%X7B)zOWFVUSv#qx=h1(Y(BGFbL2h+X{<3c|7ie`3 zE&pL6ZqINkcX1rIMRoDKAh?e`b(R+Dy0{#-arh7fI0yU$|Niz61n_v*7AVq!jby*{ zVVt}fAYYgW|3gq4bK~%@WAHgP*6nqc_Hc}66zP9E1c73pH5a2ovA)lsx!$6@Xo!Mn zoQHL96Zt)$w6)N@2RUIT`@g@K3wVu-Ct@19NG_8iR^u{XU&LraYG92KjUCz0S-Scv zBX|e`miXA#w{@4}Ebk&--zTZRPRo>`Kzt)#PH7{W(8eCtM(I%M|5@k|jV>(T zbD0yV-OHnoT1#b@AP1p5ZpOrA{OVVo0B&&*^^Y3H{#Ps%>f(k@e2w=`#QOOj%pX(Q zZoDks_8X7KdC7aRdItF<-{o>T+wh05)FC|Mr#9S(0Yl|y>wh^ z@EB~Td1l&9pu{|bbgaD~#$**d)?KvryDtJXCtgH=u#zPjRZeQt8VKNC=z`{I7c?(i zK2B{H@_nV}4=1`>;efdPJDuNhEwfqw;Av9>MC`oH#Fn>V9I zxHA|`Oy76=oh|ZY?X(MmZ-)yu;r2=&D^PKJ7|#FM?QpanEs@6_Pu9h48xAm??p)x% zo(BG|pU3h2Z{hzhgMV!T{B@v6({`Lo8=&(bw$$F~(LUxK+R=;T z$A3oiQ0yoox>Gae1(o7?Dr_IFzV@^JdfJtbTiVx{FOgV@-zSY3Zj16&!H4l9HK1M4 zTzKC&74yIjp-?CDcj$R4maWESp5}}(!B&a)uhjF8^ER{fW+D0SF4**D26XOupk(Ic zM+?+>iw3L2M&lHX?62uL+#LY29s5r6Ub}sRzNT_P2gyxR;Iq#;oD8o!&GX$tIrtd7IpN9?{#U!6bI*e?ir zhrrSKvGF{$CL7#mdgoymxY2s}B=*jnX$Jn^jt_Bx(&hw3LM%qY!Sd+gZ{HgLfxZVT zn$UV0SC9Z__gTW(gyA%0{eOV7`aJcQ|3C0qeV+Po3O)%m+zmsoN~GbY(!J-Yo@6?w zeP>KEop*zBmiX*FPrd7O{W=FY*PX6kW2eV(j=ErX>8c@WbZ|<)(!6ur0IEP$znRjn zIai$#AN$)$ryZ}ehf{RAe!VpBao(l{|THGryIBPQ|8*75vnV7 z+|s-=EOp%WR-PTb=ZsKqKHa#T1Dq+RosX6Mc*7@yQs-m;clKwb^y}c+ultKm*ROMc zGvF-d<7Y#Y=UG?ZDdt(=4D(~-RYs5NEaur+!1-t9X~tvIw0^X{Gj%-Dyi=Px9-%YO z5BuA9()8;;f%B`(Gmpo+Dg5E7z9e~QH*C5xc@2FwLLJwy|NY;oNbUcOv*c@^jZin7 zuK(u%=eD!x|0OB&@%GgIUy;(cp(W}!15^5+<{d7z|6`|~9o|Dr)M=;d|2e?9;B5Ht zjFQu@kHRYr@7b)gvw*{$Zk=tvvfmo2Po;C3cYf_iq4VMCXT3hYcAkdL=K$ve*O}+p z;gosyVK3!-vG#Ufd3NKvr9^$}ba3|^U z`vqQ4^xawLf=xTJY5n+xTT0aSZJ?eHqOtFLwDwR`;M9Fs@9O{+A-)NffYF-;fz}N0 zM@mE^G7OA}hxql8cE?niTKg!`i0%SabWq=li$?Yl-Ep}KHYps07d~uh%AOLnqKMUU zxX7zM`EYVBO)sZN-bXAA!w&2zQKN!eUr?k-|92x%<$~SqPUu`Xc7j^DVK_Mxv**b1Vbteu$52JG^D1B+zF-OUBY1eB zMRGew1h-!BQ;X8_v#Sg|r`j>ygnZqeXQ^xTn+)Qo;KTEb+Wsq>jt>(JB-l9<@`&yD z?OUx_{?@+57O4w{@!ls0I>sC0kMYL%p9$}SKc#rjPQd%%;mlG;Qes| z-n(4T-0pzdVUy8d~o=Y^K3C#xM1|GtH+eh*(>cB&|Y=fok$W)|C7j%j)=&XFq zr^2++>Ma|R?WuUJAK5_bpHu?4j|m0(fPYcG(dvTGTo-hDUmLB?b3tchDi~tJXf-k& zjA`pF&FtXSNV#b26Nc#>+jzBoJ+DR=^6K172zXskhH5R1Uj@0`9LOz!>Z4v*S6tG} z)$DM9eC2veBRPXv9?>AaW|7)g;i?g$0mTrqY5l7X2#5msF^;`^O)YYrXv}m$=d!Ct zs|$)ryt%&Y4x~k9(zE7u#fo${zMoC+w-zhX(mRl5)42Wa6ramNkmZ|9t#W-VPEBgx zOJm&{_EF!45A%W4cCRR)aSfP1&v!xRmX6V?f4!wer;5h$>!=^`(>I%%mji!vI=xqK zHd$@;;bfjZf&b4WIpAr16V}hA9T0$C==n(`pDirI*0*#OC$eZ5O zE)3J7voW5<`Xf99pd0xy-6A&v@lT2F;?)~n(E0Qr@OKEjzMt5sIpSAHZPod{O>dZ* zk_q8w*0VYTkNMO_w<1+dAFb|M-+!;1wZYO}K*)ppM9%p4o~O>hdmlg*CsZ}UZmf=-ZQFfZ|`6K*y&aDsnISIHzi zXQm7zJ_x?GmqE+g5n#;vg2oMFSYjs%_0Gg}7_NVFlc|+lM9=W>cZBwr_|%e{O|4ac zGU`)3Tz`*;fbuP+SJenGBDaV})n(9v*CYOJmJ2$=SB+NJ72r9VufM+(Y3MpI=seBW zcNQqppYXGpV9>dmuk#*7YQ@iHgYi9<|NJwAJcJ(CU1dyO2}l;q;qNoL zm*y)Hru|kXGnB>7<=y%+C*&OIfWX+jruHN9zgs`n4uNY^>x(DlJO96QHAIu;jYJ+b ziqi6#f?n;_6Lby-c?jnw%!|s!pw>DR3G*b(k1k)|U-tNDy>*J%$++*GEq|=&rt$}^ zZSP5vLteC!<&aG$Omc2y^ZfS{em`#^589Ozt5*^8McT%xttojgaG$%F4>ab>-Gaks z2pOclZ;#-lzB=VR;m^DPp@_ii*MDbeSf2cNT>>pyL9HGUr$zTVcJ7|7NIn4f)i;@% z$?$*Wu%&UUN@hM-4{Ft}(z+5DdgR4E5?^FQI0)DBqER~l!V{RUCZ{NE|D2P+^U5oe zea$jK_RKf6=SGOegH8x-xlC+n5TItT6XY%q!oNzv6Ym)|p8vNlp34M}SM_@8@6(Qu zN68kAXV!u0{>~yb1u%dAc`B@tinI%_e~#jcwsDjH4M2Psmmjt?dKLyg>ibckp8yEp zHMn7|Sl=NGBj^03g(FCwjvYMp{TbAaWXzLckZ1%w)c^c|P^|A4iu8R#p%2Tfwh#1s zJv3)E{yj1qV!1tDC40CS^9@PO|BrU%sEO-=ouB%4WXEgncL}@?%izcC8i1@0*ESyf zyc0Sr-x;A|J!LA0_g7|$lSgL4nostRve&cWCr|GztERmU0&scPbwByO`4)W&0jbm{&`hS z$iZ~3eSg9v8_$OKy^~UNdn*o*>u;oM7R&0N3PZ~aKxy+h6sb!n@V(6!EPWZzwu0~qKM1Fjazf(*kS35y1 z@k5Q*L^9Uv-sba`ZnTj6SElnMu;aus0&PITVTVEWbMg@m13|FL2?n0i%7ssfT!xd@qlGL04B$pDYxjIUK&~ZV~ zBZ8nWolojWEM3;76famK*1yfW4>bYE3eVTQ%|q-=ejR`u(&856F7&9IG}$uZQ$+&R7yp zOnxh4)zo}nxNWzhNO%lptrqL!dkd!zm~UzU9bAeq^=4NNxtuxui!Oax?!A(_1oebP0y|+_f2XS z3UwR)JvMv**@k`63F_DVYBs);HfAF3XOV8dw{Xluf+DS>yq~{7zFa| z^Gq$mi$>Kz2z4*y)#F4)6^Nf@hu|PSt(Xt(=O8RFU)WZzd*U}rG9Fxc9FKz9cy7Rd zBjgFfls!ig@)&|g?^(#H{zt{`XIx0b`%9GM49WA+J*$Y&5$l#0fFi9sXlc-c{O-TA zI0yrUqCD1@iu4Yln2gC&9Tt`;{rhH%EnPD?)sEGPGGDfn{~)@oKRR1!X(w^AH0Rh3 zo~z^cTC6|R_XfWMz!Co&{LY$)Me5;TS>SIsAPvj-T&B|Y*Bg-b5<;HeD3rdHF4%3; zq5AuT4!bcOK2zfLE%A6Ps-=E6SjKqnGl(+WX~NFk3(Yqi<7ZT)@ULBl#8II%0lu?7wo?O-SKMa8=zKlO53`*rWWMDze2IJ zksYA!_+h+1K_%|XkNY#BmikU&xh3oab&d;m7vDXO$Q4*mnmNzZLOj$3msCwE*$p*~ zG>5?Cl4hu>u#gXH3^ST!xHbL%{Dc zNmE!3zdclD_wo?V^D0t37rfUEO54`8G*@DbPc(C?_|h1ao2f`2thF?(V`7}~nz~uB zwCMoufqN_xw_H5W)bKp%7C!@ zY*RKzNxa2XP5XplKB4uBI*en(Uo8#qE0``j0m^V6_VB|#*dh!Y80KN%D=cRsZsV#h zQ;Xgwwv+(3wADhf@w_+TogXB;gU9pNr>(R09^v_DsyilkM4oasMd~Vz$W$;|6Jl+< z1P7C^oW2vI9ICy)V13-4=Vk}5_Kp(NFQ z-tT`fH=Y+Pc#zr+0zU^;*-7mN7a2%yUw>5-mC>f`vFpQr$btOplzun*Xum&MlWfP^ zfshCDy>Ain;QtqlQ6v&ydmR`N339C4Sq>E*!arX_>5>Q+f73Wdk$%6XzdicewNx&_ za}47d-NmcNZUh748hHs?CJchmvjT)8Pfc$c$>cjbKJf8gYU3k5^gPJRQu>42tr(|B z&##Hc@ZdHtVQp?g$g^*XXkb_hOxg1dk^2e=Ew4R@c^&xhc;09&wh2bO?4ELocVrk+D9~D~In#}$S2mdwL<8-j=Q~}*7kgMtU&4Gd za=B=HDHQ7mgd$(EoiUH;PE_9h%!uQ+0A`}*Z(JeBPf^s94vwcC!E8rJ{bP3_-3 zyt?B@@&0}LQ2+iZYiu1b9G9-UmX7{kC>!RsvX-Kab-5O zCgnKDAodb0f5&9{Wf@KTu1=2iZ2&ML(?yccyad1qI!bca;@^c(Q_X{1_YjLM#PZj2 zMXG#;C$bRcEx4~mptQaEkfrVLCii#R8cXxA*!&*@xO)U%?-c~yFTg}Cua~TmoFnX< zK*-m#kI)=DQv^8TC=`22d64gTh{=5`;_c!#fALU%o^;U~if0Exp4EB1+CjRv`M|44 z6G4&YnykL903qdp^K$Qdcf1-|2rUtdS0m+MM5a>vetU@`jXp~3D}+bg;RN|d43Fwt z6shuWaXgkk6wi5&ad536`LjtrS>CI(U1=iip9p!rpFqRvo8vGreK4E_Y5H^QA&cxs zk9|sE(iqw%g(Pa^rYwPJmAyr6C?gim&Y(iY@}x{k}i7`ujVCJdNW)U9eWHx8rJn z#MMAjT#Xm_x-Xaw57T184W@?aO!Yyx?<<;nlZ^SldgyqI84&)*YC3+=+ZCyDh7cP+ zM;f~0xg{awxe*kp8_$ciVoT&fXi1zOjYmw4%pH3l6F}Z!x3MVJMl){X(CTTB7sff<{uPWA}3MV+JR70eG_J+` zE}qn5CiaJHMfx)y;~Po+O9Stzt$#=UU>n`rt1=*br9IyF#ds4L@4Hv`pHtjJmi9*r zc|Hg5m#?>)9LUkDX?x{Z_Gf!s0f2$|ux?>Jmc~Q>`#ZcQ z@|IThAsNH9dF>tpX^J2kw+Ik>_KAVC1_6xCmaQ9k(&$DscfysRNJZA!%NG-d^lI0B zN9BuG9*oHs%|yOv71SLv;h$t&_B_~MzF55a?B$E0N7Bm|pC;rU8uy(oU!<=KH0TC1 z7Q;2*22 z#^6G%2KQ^EZK^MV-Xm~&Ffk87uuAkw!KwGI=hc0hlj@X< zsLVs?=pU~}rhtJ^W)ngKnn=E!=`@$dYy)YLt7-l{d_NQ4*ZmK9=X(6RTr~Cz`M!O^ zaJ^$8ueML+)#xZ*eZCJ7zb3Tm6n-^8Y!}T~E-iJ8S4B{yOCF#$&PKbY@1o>$zhFMd zPs^ruY&!Lo!E)^WS*E54;EztBF?LbR3!P9_L1K#C#J6JaERwI?|2G$O7Ct&SW*giy zi`rl9`^RXGPnt92BqFi007~0SPn%lRNfd(lBFX=T>Cv@|C$(hn?IHCa{CNMzI!^RD z(Xi{b|I0ucWP=~`IIlo`Dae|}>u(5zT8W)8--qGh{`Gbv;&atX_!rIF_VO%~)ZeA| zZvB=796vfrag1!^)pbvsns^k2xJe@M&!`3nl`pomzar!*TWo1{)Q5%AWJ8In&7%2| zE9}_oEhXyDXOaAPerCgMF5NO(ePR}oMSV%{Hjh>x#owPq{us>F=c(&bVQxH6eF%@w ziG=r>N2{x5k@@dm<$(C}<>S?R={S+^OJRgM7{DEa6&bBA!T24sVdd%go!c<{F68H& z&|Eq#gV?jGW|>;#XhNGXLcI~U`4uX|?~!k(WvDmc@jr;lHpXZ}+qoWp---NxXSwVm z)8q5MzB_q6Jk^b~Wk*q&y(a3qk#-$BcQ~3_b34WtKO$>;Iw(>WLY_sSNSRFkIzW8Z z9eVOPrx07~`vjiwE>erTgy!UmYy*|}o9_Y@t>v4(Mo0q(_#<_dP0{tBM)Ii6C%d4z zil0Jwpu$0T_5+rt=$EOb4#r=5FH_e&(BB8j{UG%huGKG7D;~FsVP|gP0(jp$If~{t>>xbA6FWD% zLBMN@^v~xNx+j)AU}+T|+BeMSDxaC4!n6tM|2z;sGsFGc`+!CK=cetUc*pwoy=0q~ zD1f|Trl}3@M%tIe{%iYvxb^zsG(Qdgec2vUt0s0bkAA`RNLxwr4HoF{9kw((ANr#0 zruJGd3Wa-7D9DS(9r;Lm4fBJzjY3cKD?n3o`qk^Bb#3T5w7rkMKDalQgX)X>i9Lz* zyRr(@YA@S2r%g~ZALzetZhj#7Y}Vd`5`Csq{iSdJ#w7kJb_@ie-K2QzC|S#w_(&a- zGreaB9tDI7v8fiQ~M3gtrji zvEh1;FkF9cCiU4M_T{@t-s4N786Xp%_1TuDWPtw}9>Vt889bMsk#%AHO>pZ!y2*<3 zmnkWB<-s5aBvT7#Lua_>Dx;X?JH+zu*8R**%GTkrn=Gt%m0=$KHA0?Z4#F#XQK+5R zA*mn1g*RIyx5>W{@+=^-8a*Q&j{9gK|1qXt?>%G@J>JVhctGO1dJELXq49Nf+5PO? zHkSi9o9Yk&zrrUPnAme2U*FEv@ zs^m6nbK-60-ygRRcOc~H5r*lwjW0=lsytsiIr}fvnGd;y$8o@Ln#*9e>EqG=4&eXYW}0&e%eUrdruGp+o&tn4>OVyF&}RYs!gKV!KOy9qhLG0B z_RlBIWOo&E*_utQRcZ4#Qm4{)LJ)kXvc0Yv)T>2!2ya~#^Ap%aXmt?OTI#pB3DfHR zRsH$i{QGTtYhFKlD_YNd=_jPMtNPl7d|#C4MR}x_Q6cl&z;meNuG?(;=8{}GO>JG)_%EYMAvgF*0K24sm)vAAVhOU7U;pRsJs*a zAo);6!#L~0bz9o*-yg1#C>_wuSSd5+TT#7etchlS+;tWrFp4du?gdX z_k3A0wV*Q@pWvsg=2agG^>lD*2hkCWW3uMr)x=lC2SWG6hwZlW;%ztImn>sWT}9(H zUiy^En30P`BaFWh^7WC$iZuFGq(vURstL^en)sS%~9KC#&yQQJjl_DX)W60s;R*V6yoNK#*X7Cgmu{c zBp0LDvJcC9>p5~J*P>He{F3It%UzoVH5JE@Y|{(#x{1Hy0w>eSuC||*VEb8xll-iX z3r=4ni<7kV9XlU2p7TA-SG||6*|vSPybb6L@EHytK^>lBCXs|>s^pX}gNEF*AvwIoL6v-^?e9SDB>yZiy9 zwPu0;;+2+$E~hmxZTlXExB9TD^1S%k?9$J zl?y_o{e9C6Jce6lTAJttf5A%PuR_Q3T8q?Jj$AGpRRV;(D=l)?_ckvcZG2!vZt2jc ziyt>E%{u_f@bfvjh~W3{l|*hJa}w(Sjah6j-0oLh_r>dm68Zl=OLGIbF+JR%wEdpx zZ#Lc)ph(jW$8A@M{r=%$dVW;}-Q^`PeCag;$VDruPv1z%(z-7fjY&=jFIY?cR0ZZc zc?pK+=$@Fp($WgaxsFF4b3fAD84x}u6vlXB`|OmQ*A9?#uQ#--ZfVp+@?Te2TCY&#+quHheuI!_rHM$*xFNZS(6E&UV-G@}j+ia0SdXuz zJUw6`GER{m6v8k*XMS$WzM*kf7kq6JJIkqKQ$8Si)Vo+tOo-#?O;fYxOz|p*2lQ&r zujBr=wijVJ8EBnhjrT3k^|LtE6ojP9SqZB=G-&g(PRSpbQBu7erks!om zJSx{g!oEjkJ}l#5*)H*H7EJ(SnFB&qxuS7`#k1J4EIopg_@-A)6b;}YRCO7xpB|<4 z$kdzM)aSozf=FuaRRM&!D$(Es2p1&MZz!iWj*ZiA%1TS~vi)PnU`1-f^Lc`3)aH=d zdQxm|rkpi`0P@o7OijoXjbqy=f8?@=Psygrp=GM;xT*CBV36-;OegsuzZ8n}145w> z^WS|5b(gB4cBj z70aiO3?+3N+jxLYm61W}SPOYv3_@DPrzft0#}5dmcV$EHSkXuj@FptUsD(vBkJ z;jR!3&O#x)PP#_X`Vp~pa!r}~gJULX2QmGM=2|WweoAnKXe7o&d)YeKn`V8W^}PC@ z#0ILFz1m9$vErO`XS;vCcy0N(?%Za@b?563 z#&ze^wehEvwSn>J3tFCbf%nyHvHImKpX7qhU{YM9pvUD;T1&L(%W^e2Z@Hk$IY@)m zm>(4B3ml4cY(A^+BtZDF<#1#U%B$<^9jQuUtXTFS#$v$^0JaRHUx? z#D1Q(W;pO5@4c4BG?Do}6R!)8?kc8!Z7=sBnb!QIbx8c6NUJ`uv>*>HU!I{pN`jrT z88*f97M8l8v$T1%8ZnY=nQ7lSb~MSB*$n%;c9<;PE{SDzD{!V{;o(USP`B%C9o zRXw#|Y2Nu`YQOfKIVX($EqA(podcZq&~Ey)5Pr~0SxTPR9HSqbuDMMO0Oc>^Yz)~WWKVTrOCCi z@!X#=7-?@8Lk;nlbx;|rln43!OccvwF?k5}3tf3T1pc_p(i*e-w|#IK(~rHh_U((= zcI{%fKAL^sctM}m$#jr~w?p8c?DumQ^l5*?`mKfJ18L#{Bed?5ubLN);>&tT?gn?O zziv4XMshvZ#Qh+{&c&-AkLjSCj`=0kL!G)I@V<%9QJX|NvlA0t&R?MZ^?4RI#X&fq z)i{~@zw}&b|MQlX&VStA2kI?abB1U2X5Mcg@`b-$DDv60`!0XZ(nS1>$R|`U!MFr_ zk>B>I$KOBj9JQq%cQq8J=F+ueCILi)`YzD3#LqA7#r%WhcObM9{dHbYB%5C8{1Lts zK*w}HDDb+?%WyjfNDU6rXdgoL^8*9Hm~sWw`~^U61#xmoA)SCT z`Mh7u1^L-)Of3jvOHhEaG0QA%B%4E(GeE7*S0p^A@O+Y&#p|cwdHm%vOZy5TPa}ve zxQ!_esA=RtE>49}5Qi~!S-ckXcP#gM5TK>iAx{41zn`!yUSk8({#`Gq zxc>*Hf*KK=`XGcf;GhNn9)OTm1<+El+zpynDk^~Z0m0(K@-pub&3Vqty71yF{+>FA&}iZE@~E`mTIr$~`0qA_ZGuf`3B zoYFymD{kPqrH67rZXd;~QGqA#uUQ0vj;Zn7IQUuPA_y%1A>>4^7LC9fM_%suUJZsr z4iFfy^n)QFN2ZF#pp@qW@$>1T;Y@jcbvDgY0x8ey27^rUzKl!8@qr}^^IAv)B|zFI zbd3Fr_4=}vx7#_W!jPI|D-VBDs5}i^kk> zc&+g@SiZpXe%82Nl3QV^h2-yZ)Sv5m_UwZ`BtN_Oap`{F3-=BaH%N0ZjG3Y_gTeT) zm;L{v7w+vw$m4fGXJF+dVpnfnBi1jNp-BIpi!?m%6b{1oCgSDg)Y=)e4(FDdWZgnX z$TJD=PdpeiFu%;9x(S&lY3P!9exDYfKY98^j4mU_^=f%|9de39=2CVmIfKXZLGPn; ziOf}AkzVLao-14XkT#D4f8zXlz7G)_893l>0Obde34QlqS#73hU>GN3v2+E#{_)cv z^vfC8mB3rE%#!5yv0o^C zFU&W=0pVg$+MWY&C(g5~HDdkFwTd(i&$H=R?gPEbLgCNvNtkO_FgvB9NL)>SJ+{7v z)-{W-;pFqesvMBV|H#yKjQU^69L1}R1+U*55r*lX^&*V}MQS6lV#D=^GZBe3t>x`{ zQp5BQdXY9ofSRbQq4>RCq!}F9$0XdBcX~13_4sy@>u_@ZR*HGBAR6Kz2_L2CIVId!j?oQ-7w*Qq@RfU#&jBlHEKMVN%rO1& zZ;|#bLY@OtM5A{qukII$Njw*|GY;2zUXecUMOxJn=+PYx^qmB!l@6FY%}*$9tK2V>Z$G)D_=qn20xA9Md6 zA4QS%kK?DiCo>@+mt>L&32PG2MMizxeMkgFmrhV{K?IsX6jUaFs}gS!5pTQcfV!@@ zkF?BgdD~3_u999*)ERYLg#;AA^@73Ms;e^z7gt>u4Yy7wUB6dddb(#ak^TJs`u@R- z%uILHsj5?_&N+3?`*auuqITC*jP{L&Id(lWMnjRle7D7FV*OT)Gt7u0nv3^O@_jd^ zwb#gZL-$w|vtj#t7G0aR?{JL9-~UckDu}Lg>qISf8Adms5Vy#_Cw!^3Vib&U{Md9) zrEypPhUvpLwTVWqhsS`qgjATqL10nZtkV}d*$&-vhk<~Dmx`H_1jbAHy^E?*de(2 z;R-=(sdD%scys@~_3F*+Zg_u1AC;X2pmscVMlX%6euVr#NjCmS{+}Wn5%T|J*?5@z zPk6bc7o7&+@9c8uU)_sQn~5up$+FSN^9!oa=taK@k~Y}>Z|lL)c_qEnW)0K)Owbwb z)JUD#oQ3-DNB8ntN`C#)l3vs~fz>bW;x_4u(S4}%x6@j~$60PKZt%9^NnkuOx{t;N zC(dGbYxcTzPD_``GC-)}m*xOI(%l=~_rM_LE@*;REt}af38BDHR8Uy%;s; zLgk}gs3Lk;r^ND9m;c5ym*|P3$?ra>WM^>!<&mHCV$?H5HWFT_q;c~6`#>*7<}}$T zC*Ln|z8^tk;SAXb(;S_GAUVIu_k(*e>YgPV%^tFc3w5evO2xsPUW|@VTtLE`rMex< z_S6!FN!i8g7biLP3(*hWT>=rp|F)ix95$`hu1!|A1R^TYcZl3`uVbeE=7G?&7qOak zH8;6<|8+qV&Ubjf?xy~{-**$sG5_Lp#^;}(&iMRO^8Ym1_=NmFLpDAl|Id<*56J&> zWuxPCwh#84&h`P>cc0cmRIyEh1$BUd;s+GMa}kn@R5PA&rK zf6ebQX)b%403nZi+-Hbd?Ko%LXWqo^RIU%V-DII50RCfC4nc6gRH*M;E@)kI1+8-l z^Y?a-2jgjz`Ft-H7>;N20GJEvUoenBsB0&Y-HCJs+oHir>m;qvCW{6Y}tl>1*rf z7#sKAWTAH2UV$$DkE&G8$LL)en*w?#m7OE$ShsbWh}eN)0YcAZ^wG}yAoSbw_!T)r z7s+ul=Hz@i&T7{O^urcLZ34uaGuo&=la2MQ8=X4t>>fX$6aA{2(6mU7Cjlxad!W8? zsH!9j8cR0zu)CM{Fb=fyx@i6Qi^{8A{d|h7E}NvU=XJ9Aor5;TReSu1Bn0g`?_FJ> zb#{Z67y~q?e=J}Bw?znD?;cNB)T&Q$`0EdROx2vfPP>U==&7I|I}&c8rNEM@Hku1!pNOBVf#plo}H;o3#OCWy1r5Np7BFB&N{Ev?_+OMc% z`nZs>mk(kbFsFzb!>IIA90wNnT1?}W|EC9&d8{m)Qnltwv5@90w~YqPjXT&p8no*G zLUztF_0fo6;FF>LA_+p#3|h!I8?RTDFK*yIRnFV>e5|*;)m-FFU?EQ3rAIUhGW^mHTX+nZ@o2lCY+ImxaP!sGPU#0VOd;)T%Ce>Xs+2 zeLzV}0OMYR?DfLByQe>Oi)Z*1cQ)rh$gu?+S_r*vJwLdIVX{$LM#G#GEmDEL?oA6N z#Qt;7u0iT<1Rh|Sp&TezG>mDY_ zX>9NN@%GODFWV!wdoloV((a}{j2i8n%`9!6=4zA3yZcQXAY;7G#DV?%9!cf-9;6>H z$i{(TV0ekn1G14A42CE{<>ZT@{;M1awO&tobPMItw?(bxDk`tH5P98keY(83`UaL$ zIuL#3xe$V>CYpQ&)PDsKdN`x)>P4#ZFCsgpfcC_3O#K@zMK7{@7y&}}Wjvo;@aN>PI9mk0qfocr=!zM*`hk?rn9)=2EO5NmVXNn5Znw^yG8hbQVjR zaH~V-5_`V*+8w>#LW2POL`U9NK+a52BXX1QQ1>)2>M^FVs6>v~{F7;$gnbaY|3VWb z=FT2>o)5M>x^ki>u27YT2!n|o^f=9XDb;@+VmdB47e{2!SiOST(37rDKNmkv(_>3? zLeohJhHDlUA%yGLUAnt1(oS-Ps+^WF*1uhEp;apU#d}=G+!D6899SVp3;@Z zkG^j%X!{$)aWqC^3TSuYAK%|UyU^L+Tn={}z&P+@eUY|FU!;A~A8ruGg-_5=QI>v) zZnAnP99qKrA#IbsGS3ClM-HeRUBkq2q|Xa6M#+NyXTzpr1Jgjxh9ejBKO1aXzQ}?T zZ1W}2OMM_42g|_lxqR0*Q{CzKgrhFMbQRA9Mi3pK|0I^@xS*TW`@gG~rKCg+Mr$OjE?b^EZy%hGSN>3fDt$Zr2?LqX0 zKu~)JqfW_B=R&>*j+1%W_Na+KgxFYn+|lzi!NcW9=saysmbSa;VEMnGgg z#(^>sB1C>IUd1rmuOsu?i(~I+v@7H~?e;8la8SO%nRPlrhas}D?mdjkLJWg@tGlf& zptTQj+B&$*IhP21ch*^`doasQvB$qWUpCeW5Zjc|PHmpk&WFn!-IT1|zXUd}gsYZW zBpp;AhRDmL580p274v1{`d%p5Z=4r zO^-*=l0zJNo?F&`?x*neT?XJM^HeRVO6AFvSE^PlbDa~sJ&OCw+xycpCoYAw^)tSX z*NlJ&jW62GVqG4%j{4Gq1!T`mVzFaH7CgV3**9ScqCJvd*RHeB0jW^$l12tQ$$3Kc z^%6Y?)O;e#-u(-W#nx2`VwYr$lb%;aLU;D! z*uH-K76msx$?)gG`LY2X_U{+%gwNUEMIJC9S2n(U)kL=l5UI^4=U}1U*)+9vpEOFJ z;E|0ksWeE&dn(VheLV*vi9B|v`jdO{T7}=CwbaGuWUilC#^TCo zE*JHc@E9#RXRi&jJW{0F@1L0ie)9g=L%?sJ zYrPpUcDx3GUcmR+syv3hQlo-)*&`HJ>w9{~>uV};V(rqgbI5wqxhMeRx9>7}L3F0) z-Q(XSXu?Qm{GVNyE-!9e#`aXU`s!+)Y!nPW?#d6)EER|b)03)4KQ3wJ~0Ba8!Z608Mv zD9Z)qe?tP&Keq|#pPR+>&#ILEIqVsb*X$U-BN$WcFgvFtbG}}9&dgR@K|jc_W>P)~ z`&>FHYSQ{)o2} zjZ9ib!z!hb)ADH+S~8y(UC+P!Up!yqdVc$V@jRiYqLMxT;sDRnd6PhU<^;bV%=-J* zRuR;E_qraKFGP|&hUUn8Awt$xp!xgTH-3M);3sX8F_3re8Vr$g0ipuP@yWLX#r`5^ z3~8TyNB+hqfuHGptWR=2kpEe}yyyMCyTsPM)u1J2fT5;xm!#Gs3q8F4U{0%1=WR8Y z`&th)LA-Z0vu%@N6q5uy}VND_mG?K~gJr@!7}(j41BgOleo;#vz;Geiw` z3EHG<)6d^`uVwi%Ha(pU8NP?X5W23~L}Yx;9*FAKn-uRkEXs!2C2E34Hj>l80FdK} z$01H@Ztk_v@oS*9>v1{WIZZZt2ZM1yg5W`^RNqg1?o?;e36GD-fk?RsRr{~8P}19< z-eK1|H6*D1e=W~JZ!u8^#(^r}eksYX_iPZgw)a`=_?Z&JYI*g23lSP@dK_9x(rCE= zR0VP%(kwyM_G>Ie?1fBPzP-k&6Y)=u$xLzSTTFVtOZ3A1O>*4EGbZxprngwmn2^hG z$ve*HbwNb6tM5Vnw(ER2av)tk0#H9%^t3lwJQ3M5hcONixmmu8>h?y0=AruavNs{3_F-B_ zvHDGjG>Bx~**#`DE~3YkmzEQBFn*+9LK5_`gPGkb3lQV=A3HW!xSzgi+owkWVz<(q zM~0QP3u8p|lJ8UX3koR~bi%?_-_q}jg0`%0vM`b@T-86vLZJCtNl6Uyyo3A)KDCf4 z9G_sz1oD~cLN%ZT<~uUQJ)hJ}%>RA3)7d?x6AX<7lqL6G9}p z7c~2x;k_q>NLOI$xP7U!j^PA8&3sEt-k0^4_YJa%oLmPU+t)9r&J(orCy&svvs`7e zHpen@>h}D@LTvys+omV~pTn@psc+*5KvjbmeqJH4y*8e&Yd-aN76vc2FanIL4$)kT zk@^9a8%XiSdL-)C;(4HIKH>X?{C%1`_ZJh*?Zr_$M{EXWb)lN`Y}lg zlKDK&^Sf0MVl&7dB6~`J=sBP&<3*?>b0~;p4h!`^naqcq5Fz#`K&2|m#;(Gcx^SGS;b^7!UQ?-L^BeYi3TME0@owmmMenqduc9DGo@k39QZh<62Mk7GW@ z0zENB)Sj>~BDUTb3&+T3nr}XV@X$zo=T25*cT*0-)fI9fM$RuPTi&iQp56%&JOhjs zxez12*A7Yly@~&xm?j(S9=(+2>E6L`qx3cjqU1OFeE33R9eI8l7>j)H^R}ZnlpHS` z`=t^pW4$bYFvX+qdLhz$1Xm3uGNgcwdClWOgvi1-Q}tCx>W}T@Htq!3Xt6MA792VC zP%lRA{+AOzchP^-PKc~yI4~n#B|JS|HV#Om^!>EHLs5{NDTy(nmV+^pkKwAXF%Imf z`M;y|&Tr)S0jbo^|7Epcrij{87T>of!yOx4sVYk?jKZcXx2;Z97Figz_25ds0I|*n zIW8W-m3BP)VX{XK|EXlk#ppIqEDMNRv0+;LrJQx%H%eNTVdlztQw>$x6H)o*is9%4`TTpHXWm{w&?wm zonudQ<)h2xxZPIE_OsU;=MqNwU9Y;IM^`-3%z1pI&^@JbDcW{QJ z)m$slI*m2M)yLi-^SfM*e+K_T1MFQI!WtA1hfOmjOhJB#6)dH;x_=sn67|t)vfF zTWK|<^ak7jt!MPZpA+8yO7iHLHTU`X8eBaTwk%0uUE~Dm-QZd5ZgBq?L6dT115bmv zN08$O%AoZ?fuQ+7Rq$9aMqrHEJP_@irpCL7EE+2t$ti-CIGyV69s4$!Hbz+`{cV~W z-*_%2`(W)l0b;-5^FijKW;SSq=PC+RW#iIxTXNFX79#IAZk4o}0#*6?Vodg2R*V1@ zAhh><*6%R~??O-2|Ig6pUZ%J^&fPw{yC*h?w6|t4j%=9o1wLO?VD+P)EWiI#9 zd=*pjrO6;X35;VeGFr+-h}F2q`zmP3BDT-2U)uk!z*?HBVc+r9izcc9@Y8r^X_TJa zA!yytu(}$=W?mvd?DUMb8w0HEc}tzT66Cz;xd~eLNf10B73f#fcrQDTI-rjQRUzlQ zEJ7@>)It#^18AF+XI}-aqF7brrOv$op>^+4hPOrdy{1@IR$YwI`xpoQ2n>^}imYL0v8vqRUc<@#?^+k1Z=!*8a(ZVkiD~QjP=8w~=*F=)Rtm;rJs1&PIkCh- zNs-EdwdG`dn{qU`C`Zf7vJOuy<$m-5?l{TX)>7S2Hg3O`)-|eJNqzqQ;JBTbVZ00l zBb+B2Zxus?{7=r2-Np2-tm?HTeBCzX*!Q$+2`vYg^rz(x&J#EEuzE2~mqLBD0HIs+ zWaG*gO{C_7(bj`w8+n^akE)P%zri@LVTpwrbNY|@oh6QJKZtR_#*^Mm=kqB#pXTXc zn8e0$)yF1t>&BvEdja(Q1qI^{OAA`ZfNXTV$78@glZ`KVtTy)vv2}kh0~aR`Li^4$ z(NW18JSO?{3LmVk_$o*HMUvqPlv_A@~GfI1UF-GLM#1u&z-5{?c&w~dx z*XGNHFr3xCq|Z(qr9ELk+a+oJo?9+zsu$M66BXK^EBJG(J^i0sB5HKaANgMmFXYdS z$?5-`-PevBt&7(XPp2zD&zk&%8!xy}4}EE&CmkIw*gx+7Q+|$!DIKnRu4Kn&2UiV+ zEi69ULu6m@*pi%9>U)vAL8H#wdR+49=lEc)x!l)Eeaf@gn)lo^y|s5C&5elRhagV% z`Wdo8Rh7lAxy^UYZIaLJy2V^h z-R#wBE(49sbGuJfUR&IMerNp`^ZWIr|NrNAQ|9~*@Z26N{W%-^$XzEyb>*Uxb+P5z zF-g*kK~>Umk4EYz?SM#`1a)<^&XlVB5A{hEQ`>Ry4wgUFSfDER<}l2Ando#LmM7d& zpehYH3|pFfU&z1TkOPsjuvjm9A@nUksO&PaJ|RG;>y7&v={U_dAxCXh z^FujoexMge3k8U_cx7X~D97(WLWKEn{Q7f$5F(#o94HbYO3%(Ig7)<-CdFtC3&$rU zPiJ#>Ari( zw_*zK#*HIy*SoF(h%N#!E(M5wDT48_0I|QV#=JO=CJ&nzX}iudl}vZ&3yp1;~fDaZ8=a?;DbZUZ#z>H01w9p#He3HJk=wPZB!5WccPCABx5L5dorOwllsbcDP#0 zY`e_4(reRop1nK=>E&ar_OzS>(Z`3vmb>1oF-myu=D6(;Sw!}u2q8*q_(JN78nPWC zgyv!G{7zsH(45Gr%J~sRP@f@JGmI@g&eB;bgU=)_*zyo(LImn9mBMa63atm{}{Lu4OagHrl#M>|9o_+Z3q7zf~X$S=EDtZ(bZp|OM?^ZL*6oLZ+2H{peS zwHEr6yn7kse~)n>A~L>^MTnj)GM-2X5IZ+)p+=G2i^t~)WL|<(!xjn%P`Q`#OQ9ZZ z<8gzBF>RyV!m;Bv)+nnhrHly)k@9bG<)hqp5sL_sKN1^khd1qvG!=qt>sw7W4u}!6n*nM zfKYOYq?Lj2%?@$~LlMo@N^bCKlcDIFU-Dcn@W`739wK{ux-f*+^xnMuY>ck>DWe;X zQ>^h|7rkF&*aDMJrLrOzK87o8{t-O1t`*IR+H3!Q6jvtKTtw~64^CzIjmLaVCBzmZ z?;VtixIX91g-|RT$-!VO1yv#Q0)FZfXeD#ExDO-Q#8sz|IVtErCzoW*NiuAqwW<5! zK=%9M9V`X~JhEZmTlSB!lIR(_+QVYl#)uH@r1ydzJq)rj=~a`SKh0hi!>Ed2tg}Do z%0@T~w%UG4pgL0-fN>!}bQ^#X0*I2c>jeu(8^}8t2fnkIPkFT~7mCnC{aTZG%)3W6 zc8C!BVv&VJJ|8vbfhH8I3gyFBeVQ-q)NCbl^H?~g)3W@a$?1Ain+HNw=a}el7f}42 zeJ=pD)84W$^%w8R=&RAy*SCwfyf{f!_G26fduhB#N9PWf$Mv7TnJ7^z8@H}9QSvNS zyRgN?A@bddRSXZa^DLRgNK`StNd%foKIA%&lYje4Mhp}6ajmsu@M(-X!}bdvZW-R`h22^==?Ou>j4oeVQ zn#bZsJEbBjr&Ygfl>VH>K%8kX8j@24D%Z){HvG**-BhOy=;Pn9&=c(}CQRb@3+q8u z>R&V|e&qjV&;;9jTE!SuA@ZR~gl}2_LIM=6X%dB0Zs{t3P@`D1hR8LO#W2u&(;Fw6 z=${-H?#Un3jbF^*nVeuc&)D}eV(^%K2g9+Fk4v7Q*8{O{4p?ZP1bUMQ^#U|1T~cwd zQwr#f`Hdy?Y`_?S1XVp(xyH8(v}CEnFJl%t`Ot({UR;#HD;YLsTMmTgOf=Cx$*Xr_ z95}p0(DscNG>(%TwC~P3``G^cETixCQBL0;*ZxfMb?=-aXaZlup=5ua&itR9v*h>{ z*O|1%vx_=t(pbYho(lgx1sJrkaF<(G^4 zDxRZh`vUE{;mJv0P+!GwnXjT*gxEb-S*XS1I)6SGq`}RDv}dkzY$HFgb(I&<`!tp- z{@V=v-x3IYK7rM(AUgAX7DizKs;<9^`8G4#|KnAT{qq%%<-!gAarmzg$BV#Nf0)&u zR)OM@b`ag=P5}S$t;|*lV`9fj8pS@^A=>eEYvFBff6QW71i9Oo4f2f_LMTr*y7Ohj z*kYnYJ{W2NMD2Q7w;jd^3ZU}X7)jeFNm>`hO=tBr$#~{i7(qT%5}mNKOHA?CZLgRp zv54WzbncMjuU~7Tw&6f=Wh#N$c3*CxF`H|dolu~^y%i$#Gqp>K^j&G63-#BxLga(P zxaucYS*XI>f9|GT<=6?2QhTF>#W{t#kv5TGsFB~% zR%YvL;5JkX#vxV{n%Pj_@V*oI3H(4JC2Zt(I_G78Q0Lh^<}4+TcBbVMe%SB6M+kOj%0?G%{WFiJaKnS#FUo64uzCiBCch63 z^&Q8kT!h&CD=nnv=V`>wqB8vEJZ;sL>GxiRS23K0beYZMW+XpPvtyK2<*5pYYKM6t zM#T1#uVi=8Nmtu-SN7M3`mSX6JzqV`_^9w=Xx&f8ouGiGN$2d@O1<^wa_4IZNg0ql`zQH)Ke*)oGpmn=kIavCy$euoq zX-wajFPJp;A@kn-@r-+S8^3%$#sQ+I-gcP%f9v7Qyg(tig7RiT(9Qv<>-P+cr@f~g zBO;qx0H_{mKhMwU^jsv@d$*DIuK)4($aCzoY%FW<-%bz4sO+-;x4!>P^t!M(rz{uh zcV)as`kCF113afOKh>6p)zVM>?U9YN_+sAnM}(fRSl=$NcF8;Ek#XKG)>rWF3Ous$ zkB5YQ`HmN^F$0;ol$q^sCG9UwZ~qk1zM9^?NA2JKng2!mFSzKE3RHzWzrBFv2>jr!Eg$LyAB46(W2W!{2C+R!+iV$5_v0SY_V|pphXeRK zc|7UbUzxmiPJzDp8512}XrbB>{plNhg%is_Xp3FJ zg^Zqxd{rUsd`@j3iftOa{uUDzah(A~h<(bRZ7*QY5}EPgLJL(C^rr{{HOl?<*GDVfXiDmi{i!(qAH9RsQpu(;wcE85a&g7B}P5kMbDiW0Dv=E=fEl z+!O4Pa)Rb^FRjDhynyx*9Je(+Pj}ZV9EZpQ(O$`~7l4}o)B+ZFazujGgHow}Kq{fW zv3*jp-X#Ts%+{s#=7Zxo-cB1p^lv<#l<55w%kd>%cTn={|9Hjv@wk&6EPjZz30pBb z`i+H%UbuRJg_%`Qg>& zW7ahEmVJM}0HJL|p#B{JLQ6lmZSNS5d`Gh3@qF^!nDQ}$8+wOPY?dY9(HG0Iwrx1n zH-f6P>}f3d*>W>r*VRndl|Dm*Zv*av%xw++!2 zOR6&d_OiJ|=UmC_cdwj+5jo?U1&G$>!5q;8+GOz1`gQ>btihdS6Y&pa6E6jb?iC?^ zSb!*z8z%wy@d8%=u2Eupt7gS#%23CtM3*HHY{5_u_hNZX;;O>0~s;0L|>@o7#!}nb-Ioc=(Zj1#%9Emz-aKY z^*ybM)t@$Y2wE{PySt}vTfT{#IvT{{x*-yTB6-fb*9;?bP^_!Jk=L0u>>f@X1hI$Q zV^zsmi}l)JsuIsK))@;eG!oQ~Aynp%)N94!8Hw!^*PMBai4wx`vz>ZJ1r!H<9%lW7 zQ+2L0?qa+U`gFWWvDha=$v3C<;n1pl7%>@2zoE2CFgWt?s*<;fte+qowPNXv#P&&R zM%-eeeUoG(M}1sLcFA{Cc-j^;!KiO`ix9d;mft5j;l4>=H1#tiFfpGk6@_UlUB02f>uW!u9IM9+0Bg%$D zeJl?~91~%1EWfejEsO*0+bh>B7X34tw@+B}yoFICe=fqGi{v+!G>HXuf449l|K9E6 z*MvJ4O$-B6g@0Hy5lmdU?X3wDKk9cT3OYFpmLIaQRGjne@B%aIv)5*M_RNLZpS?26 zv)5df{aGc;vkzUya*5R;Y6tvm{SV}wu6Y)sXV(x|3u>Wu-#iPkT$}c+xp<`gJb*~H zT;=U+Xuk1UXe+UEjp^TZ?tSVr&%IB5=DGK&&ph`&^_l11r#?Hm%L*mQ_N155|ECkd3em+Kds*H&4#j zT2VGsQ8spY=y%_Ty~{`d^R8O5lPT({k~a*XaUH^UJ;_pzo=>bKa3H@O_f03 zPveA&Qg!_=Yhn7j3=nM{3Xy?y)d2U2{u|>!fY*u4##_q=$b)}tgOdlpjOW3x+-L?s zgeYl8AbNRQzLsXM7R$!^p{i0}jnS1^^5dsIWd{0VX4tv>pwGtk9xBw&*=VA238IC) zBBND=XrT}G#J1;a_FQxhQI-3rViYc+xpUNR_ylA0@nu9mDb#CE;`+($BQ^2z42))< zszfdy7-u8fT%9(+T>W}Oe|&(S(D6HCzw5Fe$1x~80geH*WXCb^4M5WZ*ZNr&TR-2% z{&XI*`mfXHfBA7*zq5Xv)(@Mr)0(id(|VSR){i-@pFiE7);(EheeMLbzIg&#^#N#& z4?wHOMe7z$>vLIXZOuaKeJ7x``2@5!3_$C{1JL@9^$xAS0R^T%_gd)`9#cL z^Y<1Lk@*RW5bxqR1Eft+B)ZLxjY+?%OvwX(-=!9+WcS&>=%C3sjIRspE-WC0jEHk*8X z3-sh_(1^`4zR5&(+g*YFn3ofOW>Pzz)@~Y{PE)22!p26}y_sP&ZoQP+S#-=b*McVa zsQ+yX8UMjc`;Y&Q`7Gw)e>hGafNT_nX`TJx&^YruZWE#YOb>)^`>Sck=fwP=c5KM( zE6?fc?JRv=HJ|xbuWx1ft1X*Nl*Bmjt5$aZ9`3`@mfy(hCM`5kc^|F}du5}V#w~7uuo5@0U7kr7z{kkIa#daKUVpM0(v(S-wtUhl_ zK5Q)22pwgYIx#t9?w`NZLd5`n@^1M&3w62bz9vsnl`H?wu=lPPA(WVBAz^U;HuEyZ zM%sPiQZ|N3D)W8U?`CV_qxqPAy-KxEo5oFbx@%{|GwM4C8S5&g?ttg{Wy8j?NY(wBVCS$D>U;BSJQVgf zja%a9OPNITNXTBvPmNQyY?>_K2L9PbGjeUEXVZK!ORs|Af?IMA3& z507`f>k9VH?=2ikjF*iymey`;HzC&moFB>XAbfg5)G8p+yn+Tx=^DGpbUaHysk-o?r zwFFdU^}O`lbJAborHm&Y7BIWdmkRZok*c!&d`x*{3&sJEWMlpGQY|T}@g>EolKTsc z{1OU(m0!MXrfSiQb}zkV#9W^*d&Ut`run8Qbk((D>f{n{iLh?iSsN}n^7a9cZY?{?G~-4(AJA7 zuS|ZMVQpo@Q2WCL4u;y37o=mTHBS}%nK;X-+Rbba1nnFy*$c6IVhnGpIfux6KaD+1 zN=3mhS8~h~TC1DPn{3=2g-E#vDl>CLY@bNX3nR#LYhn!J^7nl>L_Q~_!XWvM?9CNZ zg~+3EOtH=z36D#~`g1FVh`aAL-Zzo|Tpm*FvwLF@v2(7TTq#gYo-Y_Cn9@n-is_3m zL^jkoMi7EIWqznnpma>Sz6{*q6>*jmLGSPL)9>%;S;OitSCZe#F=l$waHy~4cyx!E zudCw+O2d}4bGw%3lG(oLv^$6feg`oFj5ZNsjUmc6YboD+3t9z>vs_E~Mi24$nh{K< zpFfY?k=X5bHKfa-=CdI5$(c+a89IoaF;5JF2&+>YV1G{nL(P{d*6reqzH3i*`d$-q z>I4xzM;$5~r^PX9%7=K_6;KaDAT&gT5Sc?b2|{I;L4BJSLNhbRGsbE2wvcm2d?A3p zEDZHwFNDgLLVdM`LxippP&srix@l!-?lnY7F(NdzpTaP+?6@1ElilEh2%G}Zd%rf();GC~@IW*%LpJ17S$@tB zZ!xU7zmT!J>GH@1_+_Jx(?n?mwc{WBIr@8|rnP8@Y?OFp<0B8max>A4c+FTt(U}S!|(Y zZ<;g@jOg=kWzbW5sx$8Hx&3vEd->S6V;tyO!g75ohO5f|?lx(io=w{<#Omf0>CLZM z$mF&6_HDCJ{)-sN5*Q5<)SuylP=~^5#hun>Irrw{WuxbLi{7PuMt+|q8>Q=(yp0$tXa4%0X+k714Gg&(N6CENp9>Kdx61yedXn#=)(?Tj z4#N*P`o%)l*W1AAkN+RGP~(hJZF|0|oDAUKH+WiW7q1UW=4tEY?D@^)Y?w>dszhHu zTvawq!e~D~zbCkP=`?}rKEeo9sh!(j?;*TJ+P)cEh_preC34g5o5ek{{`XG-cyM7xn`7h;n=~;UR!fvsX68{L4iDv~Zy0UnY8FCy(p<5=T?A zYq+Z1w97;vSvb%=1B_3sEcy|>E8WA-J$5c7XMj76d4T5iM&xgyL0-3EF5#5|{enqMcW&o0ZyWu;P=AftSsj1dZPI+f%rouf z9Egk$sFXmzbqK_kW{&R{&iH=sn$vOsKWWdlWe-b|M%sd} zYFbP8$+UjVVo5emc?qN2=2$2}_m*F8d5-2mQj9Xy9Bne6mO|^ocWmZycgH2azHE*~Yu;qiSfa{l^!2`o(IqbW?%?#5bNY67viwkD zU#*;Dp-~z13FkZXUFf1urFG0e9|da1v^gw~^Q4S-+gjoWt(X+-+4{;IuVH>3@F46brqCabP|7KP0Bf2APvrU&LsrJ^pF3 zQFS-VKcee1O*Zz;0^{XQ=4aS9OQ!Wgs(AnZn3KUP)vo=or28EHpjhZa?sFh*igRqg zLs81_F!@d9ci2aB7(Dv*B7{!6+d^b7ZOt;~+8U?719MnxMdr9yDi%5w<3Q2f7K#GH zNjOUVwtijRWun9qIeu6w(!m2G5=)5wFiKzaJVcU9Snl9ShjEDfO}@YCd6w&Pb*+Ua zyuoW*9KkV^g|?Q-j5b0Op^wm?N!x6Njjhijdsfmg>3e=kVCbq0Am6?=9QH z+c^nBj{(GvKMV2hML_FNlix3V%|gA;l6f6f*GA6Lx*4rRuhgGq@0}q)X#4b1t+7E~ zN5(ql5>@e?i;=sXg_jULZ$_)Y@K6=Io?(|%q91v|LPU;I-D?npKAO(_Ae~Z?zIv9b z96kplya)_-zt3>+cFaSEZH6HJUiI)1i&P7(RJ&?0&W8^?y{xc)};{7GQQex`$VylNrO-SWERc$wzm5dE3- zGseUyu@_GuWBOsHh2~)#I5g8j^Dz#PJ~mN2>q1?}IPk9nCc5TzK95Jzb(ml5WIjK# z4v)Oa?3&42Ec8Pk4s=hE4P&6X%xSvKD`~!;uqy|X=r-;=T{TZO9vRKn3O9IKZ;N3x z?*)wRN?Hgch|;)EFC3bFyOqkNczm{nI=yg+uF=ba);7IVt6r`uZ_MtmZ_b~?@c78S zS-etJyyvhS|4Z&-_Y*S5s(WCojn!4GznEkDfZ5;oo=oe5^1AAUdQxH-m|jpj{_-ie zMS5}Q4?|^Rs(}&BG2%YU%EwKV94i}16Gz3n$-XMkKj81oG;xT~_VM&mjp&~>D^%sk z6hZsvM2zrQvQL;_n9S4U&-mUpaERq^2K4PKRHc0)Mv1XNZKyVy&(Gc&&!0c@IP+iS z-(?}SNHz#9opa^*>RVVIW$lmTHEkN_%4?#2rJY&h!n-9QNc3=D4Ac66%>W@gUexy6 z5IrD_anxTd8eij(%JKY(Kv}+d?+4W?~q_=@7bh9P{7&*~9EG zTMs@qE4`oEE1iDIXFEC@vG*TY$@H6M0b>8kc(39r=e_*d{c98wefXKEqeGXw{5-Oc z>Cy6V2<^?J=W3_j-dT>GGnM;!v$?TlaATC-DKqTGF`{-y4@TuV3?KQ(5{}(P^yrlq3VWcEyh}cJu9M@W z-|-7f6b7go1>j#t=6tAZTpwk2LGxe;E%!pKkn6)mP}5qFD;ot8#HOq_Q~3k`mpLb4 zXHH(4)n9J>ayF|8LGwiKw9uVgmnHT|K`t0YgCI77_esV~`g}ov*iU(%34mCAMxV)A zRq3+Z$z|=3v7E!lBIiIToF^M?Ipq_G?5R*yrC}%Ixi&wMIZCmjo|b(9>XC!_rPu6s3JrX-8ed) z=cyKTh`EXSu=4aO4}ks`4L>i%mY0 zef*c>7?lf9mFJ$zkf>E$rYd)H9H{p(4w!^5rBS+#T~xHvBJEW5UgEq*=AOJu=3ls6 zRZg9ie(!Q4#sR{^tc^l_<8e&!AHKOHz3;}$Rpm-*Hx}wYw=j~w#gz+uFd~L=p!sCk zc=8(yCDuVaN&O-a9KB3crcA)dBz*QYj&3+vHo7LWdm5hyC{8%}d*385ydH?`Cp!PI zX|3+@9O-7*(5%f;ipxED0!FW2lFnlZX{26Jrz*P%E#&-=O6k7rzS*RCOkGo$4qOYW za@Ol65@c05!tYO?+D`BLb+>-;)7MRuq)PzQ7Kd!$d9jCj1$cmw|@rxJOUQ)^48!8*;zQE2*5FvDRMtd!;_Wth@ zC&!)0r;1tBpF?%W`9z1wla0e01d73O>I>B07hESmY<5PQ$yH99cU}b@7#=b8&^B+F1f_P{cguNaN27Y8v82IM~doXVs}iCjWMrT zXcqsjncv6$iuc=raUeNCrn&$6ofc|4jw{WfvSE&ZDB;zQpMi)v0xEmE1g&$Ops~EE zLLE;6hf4 zan)(}sLEe1vCzF32c(&-Hspg_h+G`0C%K+Fmg~nXpRg!+&lZgIFL>=1fY@m>E%Xk* zZzf|RZI8awLNdmc_+kq^ag@h>?I5~sseT`;|5s1+i)}MAc<2F#&aY;s=Pnak?_~3w z{~YOWl58-&w@|-(g@x23nBpuay>Mvz8da&ds8p*s8>7QTGPSQStYI-PVBu(^S2p%b zBlT6H9N$N=Ckpj*ySe{bfY75EbXEV}p=^QfU#PH*j?^^b0w|f4yWHIXQumICtTu+1G9a>V~D(ZgZ6Wr>d%rM9?tgF(u}s- zU2Xqs-!=3}`$EKsb(u~*SrMD^bSgaR3Dwfvf49+7$G7&@su6?*oi z?3p(<-fH#B!DIGC@l?akJ0v>OhRv)->qna)(ma%5MrDh4vhA1`hswtDn<4VmO#+W0 zDxiAK%bOu0TR6I$`X2oHlbe|hbg_kL{>QhBR~4gwZeV}9ie=;1oUSc|u9E+Pt`gaJ za5F@sp_qTP~WzR8P zR^YW)f!~cyZQ^xjxh~7%Mf_>;BEP$s@(t}f>7o3$htTlC#ZG-2vWKTKS>5p;j01$8 zTHaTJ=pMYkGJx+72bvzcwFu(-nVjk9!#Hp=@1w=5Dx{x-1LUQUu}pZ5?cZ{d*<&C< zDD0xK<_yrKa6ROY*m0L(QC*#`_^nT75h=(kqyEl$;1yUf5_d zwhp27M0NCRKE8Jgzq1qB9UtN6XJ)u~Vhd;$6%J2)Jj21hB0RC|V&}|s^Jia81>>6QD+$2O29B=JQj04oxX}0mf z({t>cdejW#?i4=uWCkpt#@GkB#-15h#(h0Xkw-QH!)1fm>czlt z2@n01pBo~C&gH%kkQi@HT5qB=GH9qB<tz_7>p@jU1H==+XenNAB3esID%N*y!RTlT zE4oO3N{0y9Clv1-W7Iqv3_Aw6Nq1^Q#xV{EelW7-FOaj@&OK-Yh>GW{O418^Dh{8l zT|FM7h7vG7ybSxeOgI$u>Dn8@<}R13#Go9>#!dssb*_VZOGhtFTR z&zVCsgRSF1n}0Z7jcqp%lzU;H-w!{F5jl%mJnYOX^vK2oO(tsg0-4v?%WhgeXLpeH zdM2lHdR%z>%V$_w_O9%}GgoZ1eIUxI;-;H+sliLM(8S_MJj?ejT z5+6gd2Zsz--MVjeh>*R@ajWznel0}yxc2%!{yUj-`wB^##z7>fa-LauC70~kxlo*7Q% zzA+F+t;}&CQnHw0&~dC$8=F>SdIY+}MCHSva;2B~I#!=&<0b|4=yD+<4~0q_w>9*(zrSRm%1sVF>w3QSgIY|~lEdnH zRh&_%?Mzxo7NPRiliA#KO%b%tF$^zsE72Fm%0{_|#n@MKERW2)qUJmZRg5uF3(@6C zyBAB^mZXKkeYi^CHN+}r=V*UTT1fS0l5!+kLuh%#|S82C9;?2_u{C zd;mYa%QbQI#%HL$6I4wmpO+*VejD`>7YJJQ7L1yEaAjhe94GB{|CO~vu@QORz^-O? z_w_c%JC`MhdM=Xe?)TzEF3D!g`Xz`2;KEdm)t2Awd%7Rx%1>N zx$i5V+yB#}qn^$nf;-cf`QnIH477*%}g#Q$9Artfx9YyY`J-;JEUBp;VB-9qk~xbGjrXc&$E zk@Ve%xK4_h|B&682J}kI@SbmA_kHxNeYX#zL?5oS$I&^qe|@b7Mw_UA-v1k^y-IAD z^3m&$=-ZD!RiCDn#=_{E(N2N zoHeDgQ7EuIS=`zPTbLayX)Uwq z9B!fd|3%#9=e)Iy&tdfdb)MTK2<416Q5VO&`IV=beA~J1BKJ)w8d>GD^ji=5N?A*hS zY&n0Kx?cg`Gq(L?`xOiQj4yA9S_nK)HNicXs-(5gcjhw8=TgX5m7#oJ73RtmPiS1m zd&x_k_mqp$^|$>OW!D>{Ls@)JyceV9e5M;_`Y>#puzZMYe6fj*iSQ7`UF`;`8Tv-;Ltb>*etU6lYiFMq){?gFfs-}T-rsI9)3EdGTIyte8IE2GJCD}8H|la)&GBF~Y{KmR zLn_c`_A))TX#v!?a2>Z@xL_ZuNR}9^uJqK9raRupX3ipQjx-P9@u%3 z1F90eh1Fy1hlw{{Hf&71Qcyb%a7>&d{qT9+m~%{r+b%+MF33hV$E->Io6Hx(tYP@P z%+Jj4nU(6B9o!nT7iT%Y(s66P<+wFp^SXxFd_LXW4`=7m4c0LdKCuwX%PI^KJt))9 z`MX0*Zk6}TL+>BML)t#tiqWV~ERW3(dPe{vY>zm@ghkrr#`;+sy%uXnll z{*FFoTdD%Y_Ga``JKX7~cPiI2c{~z%cbSQiIvR{BDfjG`#NzxFz0)R;KFQkE9HN-~ zm46s~(S$3XX1TcK62xA~>?7alqibsawOldHLOC=}lhONq4@S+sxT=8O6~Ug0TQ8(? z{FhHdWINjf`L$K5G8tn87*m^}{Z3U;i0x*v&&fMgEq4@p&sy|cvRK30KCpQlgW??A&*HW34zRnmkgL7Nnl3N zoJ@GwKq(B}i(1NaN}jFSmef&5rPLwI(m6X_D)ggqSbsAq90ImJ^8O zary3BqO|vsqPDLepmHN!Ad2`kDgOCY^Qz7k9Sf{m(EB1j;({+A#QBQt_gYETzo@J-` zguT!p4iIXq-Wg>(XbF;5tn-Riz9~f7KA?R5-4H!b)Z#8g-wlNAWlzu4_MY?D-m{B` zw%O5mKgh}6oCw}`#{j25Sii^u%nd0yAi2VA^voN&cW<8x?wwDd)6_L_7+FU!)fiVB--w9#bs*S*ZOM?+A?C`bVtD{nG>;_KpNi5OEY3&{eZ!0 z`!xrxLM#n(qsIT7NWQs)8csD=h(hgwIcPgSJEpEBQg@72w{jGVx3G6Fi-p4G0cN+I zL6}{ic!BYMqe`g%Q_2-GXrGSH;q!no6&$ruYv);Bm@JSwb6AYkPApqn!8LTFt|ORz zR?|4SE?;uZxt=Ho`HZt(0QY?WtpOp+_v-I)AD`t*cmw~A_C3A_8Xl+f+2~X^ciqe# z{Fv0=@M)=19Q4AL44L`_3Zs4Z?qze%y8^iT^|1BiNQOtaKbBt2myhOZgw#MS_}ytR zg0|-v-L{75CYi^{-PcL3sQR7`42l=s6K)7;%MJ(dzrt) z6&<_Z#d%dQu=}E>3a+7F0Gow};wNS^Kc(olICclP6?xP;oB26c#@IB?nG;f8(CnEI z=Fcj)2I)L0@&jv+OJwht-NrTG-wi)x_9^f2;Kup6P4h7gXn9Z`so)wcAyQl&)9;Qb zT;$n9?O+g(adSe-X6@c;!fhO`{kGd;V04dsE#6wi8b`)zZ%hPpWD#r=x2HA8OJ z_SK{2gsA-`t{>k&5L9w?$!oe%Zve@4O5o+Nf7k&(%Si$}vBtBjC_1LJEY_Rn6AteRkok1b1~Xy`OF7ce%^3wl^Y3ZW#6)WHyj8mxEBo6 zihi2QXC|{r`@?D)1FLwT>}nZpo+7y>&DQ2AZ7p~maTT(C^6!FlejH2bn@wZ4@8HL# zHbC->Ss=MG2{A8?hm=5}sP5XsY@)wUi00#*ZNqox>0T$B%J{Q;pn=8wGHH5$mT&e2 zcDD5H0C9g9gJ0$Kj1QzNVheX*FphJM?P}lTcZSK~B}B&q^92OmU`(cNA zR2IpPim;c?X0bRvdY#1s`_t+%UZI#hD^>T8@EfJg^ zFB`fRkD1N(tFd;C;r7mHXBnuI(YRVPuAa`8y^o!T;aWT=roGCNNPDZwhOWh?aL#MN z2#lMCk;nJSnEqD&dQkaa%@*KeKbzwaUdS0k8)pRG zq+#Is%UCR~8LtPGueG`Vg?pI&FZGY)n9XzV{-Bb3oq?X)M(ZR<=Vb?&O;W?5#%x^c z$Gsj@wh&^ztcR@`xIQB7W=k%dD@&#@{Q&poT`{<#tXgMFt^w!Oc>b!4**J6NadO>U z$#u&V<{$Stv)#0X?H;~HJRzf|ncm%me8NUC$)+g&QeVVBC>HJ5H z**)5sNd^(o$qtGJ6>4#C;I#7x)D3y=Zrg!t&69>@%iY5_1libiQCFYEUe$eCA_eg z%YFR_2ue=1gufGquJ3hOx{<}@^#E!l2 ziya#7JI0%!B^Dm`=l{>X{44yQxLw@#i+7iH{qONNx4(afxb3%3FYG$r^w#!70RM|4 zMjA&Zga5q|NybDA_>-oA|C?K4A#f$1G4q6|- zUEEgx?$WLokH5M7i95t?FFn1m>;0y;w(|yPOPC6i6N|XXNy*?}%`rKQ@Ecn6>$sM? zwD*W-SOySx;J_V?S9JT25~5tI-7}N8yT2~r@BYV3;qGrrbaz*9E1!LcTlwq`ZsoJT z=T<)ZS8nCAr-gVQ!u(t?_`VQweb5W?Rzj3}2vHyzPW*xpI`aMko zS)K~XPT=~cP2aj>Jg$$@*vrrkCq`-G4a=;V5-IcV;ANQJv2VnT!~3e9uI?Ju4zlhJ zaodDD#BKWbmUc~gZ)w*iDXxCYiMO}6oOoyZ5h=d@m$33#!yV$b$#;m`9)D(G*9*@q z?D|>Lg8I9gzF%+fj;Q}LtbDfIYpj35JF-5RTlwr_ZsoJvxRuXdH?3pe?EeQX-U6gSSBq3|Y4W25h}Xr*8w(J(3zNMCh~N3iQUT(4Zt|7_ z#M5lsSb(@@*t`XZZ@Nt?K%7msEd@xUG~4C^#C@jCTY&h_ut^2jhhp270_;Z-e)o>3 zFSKncK$_J&`g#)f?KYcKfc^WCZA$_6?T5C_1=v5gZBqf#bBV340BJh;(E~|H*ZZyB z0;FxNb#npI_W|q1f_tr73huK?1?7+WlV(^SEtqM2jP|M6%KB7jm1v)etX|ruCm#KM z687mwR@SH6tdG(@EwOH)efpu*TY$W9TP513mmYm13H$VGE9=vC>n7SK#pF<=_l@0*+>Nvx~{6`NY$&da%=?9PclU{xFjimSE3=7i^J+~_3Q1dGDq1~&} z4>hea9oo0*+c?9*E^pJS552oro%HTq^^y1aRUdepSKXjDEIjAkx9XyI_o@rt=2e%x zdsm(JHm!2$4GU+~HLaRi*SxB*ZqKTsy609E*X>*Nqq=>omelQ9bz5E2DtFzURX?nI zZdJPgZsha*-sb#T?{oPNcz5UD>)n@spSLNW^47aIztG#1Khyhsev!91zu3DwA9?vB z@9z91-hKJEdH3eKy-oQ)^fu=s&wlM~%HQtYldpK2^BcU+a#+K0ECpU){{*PAo?;5Oz%>xTBZ4NC= zYdSd6EWyZu_&JyVuQd?Yr@js{WDWYi)*W0^aIJs${Q7NAjF?-0L?>=zb39vb{!<+Q z{>8sV_x$Xk8w#ftTkgDPt)b3WX_pH8S zRc-Ch^6y!@@)lZCr0X%{4sVBP5kbC0h_YgrAbSph-?9kgbA%|KBjC4qK<>roqu{r! z2Kk@({633Kx^95^*NRE76&{?YdhQ36K5r^hJr9GrVJ)b`*=mOOx47?0|M9|>@V%Zo z4(ML#J^@;@L_y|xsnZGR$1Fm6eIw7GEsFzp3BXx9@bxVK?v6S^-oSHbcWL>|R{*$k z1vtBp5O;$UPT-!Rl{eL&6Eb~{tf11Z#W@=Xk_%x6_>z-PCW+e`zFD`e@fPU&3Yfh} zEpMvtp?C4DEG@@FYr9jBb0O_)od9kQ((AG9vVP*$@>BUNSwSTMz=Sw{#bFr}Ei*1i z+-(|6ESHhR;yi@U@jqP4asr0W^LK@a+X^O{m%Wb=^N0cBuH@6{@6-Q>jY9f^q6(|2 z{dH?45A}HL+Ifl}e`|Yx@UE zpLV|Fbq+joc;D;k!{ip#iK=}BG|+vEp2gAb&_gfEg0;0k zhU-{fQ7ee5GdoD152g{b#A*3o0Jd6Jrwz&fGCG~@mBKQWXCgG;3zh{eFPdanZIX|q zMebk1HbSLQF)VP;N@G_{VzDbqL2|v8H5l8tGhFu6q@i|Dz=Qj6rWS8NF!>x=>~1t{ z!*yXasGpd~;P;tXMA<$-T0MGEJv+pn>8&Ago5S*78kJ8u>^FT`06H!xzB42EKBnQD z#_j`{kL=7CTRsE0mCT^h6%VZ!wXbRZ4T3X2>VcuAD}!X@;avo*|j(L@w)D)pZ` z=1pZe5TaxDRB7|WVBF<@M}D%dmLK25q4E<=i?E#)jTikaG-T*taoD%}J^_kQW*T@= zO*b+7scYkVc;8H<1*KPp?Sp5bfd^6b>T!S1okgAZI3Ws+hpm;_`3$ZF8MaeVw$@>~ zw-47>5Y>J0Z2j1kbag*hYyDg?N^;?Q;H6G{-!k#)wWve$@9N+f9E345lbC6oA%oP} zIF8!96knZ}`CtpyL0D5ViPD6;w}=h^NDZHhQJ*>OJS|+-l1cp?S~-j8umViyEZ`U{ zFAURHov0#g9KSs{R$sQrPq~PKv|Hw4V|msRLhp5NT*B7CJnPjonKCgVllZ=FEW-!C z4a%lo>hw$`gSjP40P4-Otw?U#3>Y~PD z_?&TPcxe4d54~4x)8uX;+gCSHazUKbd2)gli-LpJht_h`kMWUIP&cv|HN`6?v77?f z&%aI}SNY#X?rE4mz=J$czme_`q4ANN*D=4SZp|)k0O9h?zCAF&Xxh$0Tln3EIB39k z77kkR-HJS*x>aa^&K1Q}PtZfd20f@IEg!>anm390N1$vz93slin!WeOTAt2K7h7`! zJhXM&rpYU8k_!Z>^NR`WebWGGJ^Bo;;moggP+x-aGDu_Phf|0mC4egRlU9WLYaaYe zSIzWgxrovpBt;n@xp2++;2CK6jE9=XHM?gz{-1#coUd^X!0~V8!OiJJ75js_aI;qS zEv;_lVBIv|^G`zqi))ombDCLjekR0xQV%JowHQ6SLrms>A0moEBC=Ehux9q#;+6I| zl%+phH6-2SJ9xK*Sw7drw>+_!(WpXeD_lR;mR|&Lr)IGINBFL4ToUwF z{dKk)rs3@%s;AAM>Oku3uIF0XHQz;Sucr!Rt29Agy_hJLun&p(Y9A6cJ*Y%%Uk}8r z`(b-uArYE##mz zY#;Z}xNt0_G~X9-&~RXYw4S5iGJV+~r8?uGAqyl|4oI%iI9EIXe#GM+PeVhA05!)1 zaQ6pEk*5sgc{slW3B6zU7@6-*h924w$3kjzYw{f(V7mFSIB0l-#_~<`z1C0K-X_G{ z#Kx-a)2G>eIIdL>=$LP7E||}Pj>d#b`Qu>OEZd)>%HGCB$_8lcp={eJVYJT?4=Gm! zumuIdcY+XerHWH)SWQ7Pg6AF+k|O zChCCQ<2dm3`tci%`9>S~dp2@xF7)Ke<%i;&v>1DY93k`p%)BP<`?^-Md~lO+Gn}D2V{3PdI3! zv_Hkkmp_Vc*__Pu!Oci><{Nwh+YFDVi~U4-U0c68(}POSGRcK|aD)x*Oeg!_ahl&! zKcR639^|3rK_|!$t>UO{;=`$+R`e4^3^KVmMEA()gL~wIF?;0ZA$#O>-#SxJ2_&#} z_Uln>-dfsEXdF3wKR$)U=F{+(5&ztG7BFot_NQ4(+fQ)`{Cs^5&gbWf3a$jaK>)yCAq?C@NISP-r>*2Wb<02WR70O@S7*aO!R3?sFM@lZ|&x+)LUUEHf zQ%oF*C>t20%PWK^lGeW_J^1%0u$V05aPo;by7z%0x=31-F2VXK(0<;Q1F1cN&URYh zfHc^9V@TP=iz@c}lwh`D zIi!`dwNNhB=rE`UnVmy@8hLOZPYWuy$H3>z5%|A|qH%K+jmO@^a%%iUqos!j*Fimt zLp1OR^8pOgo*Yi5{!c_mIT5C9SYD9EukoT9w#g6Aqd3sx$&HnyA0_+!)`J_(WK};SA%RF9qIF; z8$-(OVfx&CBeU1B5^B@0N<6rT9{l40Ot{vJ1Tcl$ydB%@XR?iWHwB6NvmK-Q-VPCW zZ5C0)ni=+!dXRBkcH;cPiw+19D)a4Eh?_Wu;#Zj+!S6Z^_ftZe4{>Xz@tGu-|Hc@8 z=MLq!g#))cEvWPeSv0rH&3b0ve%{=e9Y_WLJF&de<~1Uu$gy!I&PT10;q#^K8XqqT zf-U-N`P?{ASMZ{vTPL}eZ-F(llS?1Aa#UZEPYZ$#$Hgfj-G}9J2~jL5P&^yJwERU_ zgX0FvG5a4*#xj8rQE)C>-U@3Dw*E;bQD76d_#`3bqnSi$*HazP@c^y`<3QyCu-KXdsU z>At8aFiBK70oT&Ve(cHApn~-2)_hGPK8tVdn;&9uDnWAHmq`@qJh=)67b5OhU)6AY zzcAhZL}UBCewA${>d7DL;W&!{%W@N z6&A|SzH!IxR-#zq*?ASVcm6lfaDN`ixPQkzkSA4ij25I$crZ8BlM0T5ys4%Jzt>(tH_*T*iYEiz+M_z0)drx~Q+P+SSrmtgyw67 zmofoFwNVFskldKv1mLh}-*NvJT~=hzCqw|1MWje_fK$=2UeSin`Gd}Aq#{Cuuv}#!_vVCgtedY=(Q*w zQQcuM-z&;dQIuYaJh~|GzHDH83U1`&ESis5RJ&Jdc_G5%-%Ne@ipMfpewoVhB97+y zZP&xgIA6`P59$an<9yYv&D9^<2j^-QM`C5n{b@Y7Yg2Ilo9Wx|IM??!57<}7Dl<_$ zHHCIu$0WVzcnbG9>$o-Txc3Liwa85GEQ>)99msPp2X3ry;J_WO*N_16jUc(+C&cUk z$@Pu)_X;8A^BXz2@vcJqCma-=nK`sy-3gI?r9}11o5*yZqnhu>seY#S^a$BD#y_)f zf({zmdGO=BeE6FAS>GErM+c3M5alZt_79AXTXb#;s7pAOqdQ!-r{L;6_Slr55+I}( zJUQ}`r&ug)Pl)+5we=GvFa^|)v5z1+vI-03OJ$r)W3QMSvoB5&Rgb{dw00vDHO*vx z(1SEu$H`DwC|j?WT<^>bDW`-CI(KzM>4r<~T0WqB$;D~&qQOF_oip8+2Xf?sr=Wr5 zRm}1^C$sbEZ*n8&^Ds?x;MmxZ0MwU=&gIj=f$P*9!p_@GT1;UNFZwqmfIq-N@x9Uf zT*t|kHWr)fS?xXI>$DfiIM*Vs1@@5g4dtoX*Bmdo9_gq1y&^U)&Gg=W97wKB1I&N@ z$1(7&QyBcs(eQs(Bv+1Pz6vM{8}#7!q=LU&i;7pBV@erBbWI0Tfnh1QyI=iR{w&s$N3jUc}tWVE$teK;j#+9K;i2Ay-H0a8r+ zs0aU7QSmdnwOnF*v^WGv!=7Tv)jge!zw2^`j=vu$(6H{RwH;_Y{?UTu>fbCLV0png z-;EX~TkLF{Z^;13h3kEzkX|#D1NXJh%b9#Ot-opKc^>MYN)Y|IMwTZSbr#&$v;0yS zH7^O^?zzizpnd&KJ4*$q7i&BRmIKt>4d6bhhZNjPdwFo@=|sPzXJ+5u*!ft30&A?Dn87DuL54=LF8Sr&WDpKD-wj`4dl+lQrm zLWmi4il=~{h0!vq27@CsM+>VLB5rJ_NsXWR1tI3TTj;se%hqXy^1EZ1%@OLcyF_;H z8rGR2u}#1yZ59u_wpl!Y^v@I|S1k`yJbGAsNwa^$@nuE5H_^Tmk~i+yJC-Og0$SrO zKy#bMv3wUUJ+9x$xMoA)VP5oe$>8Y5c@gwA3j}a42d>7*gF6nue-P4Y0(x-o)xqMt z!a^DOrW4q`2d9%dk%!H?@jG#j*;ppIP?v8WOU$zu*>^g1kU~Ir_G=HwyLfOnLc-Y| zp6Nk{*V%XO;e~o^3-#?II!Hm;EL~^cx$my30~>j+-g{T&fn1KO`5A!QX{yV{y(_{z zEeO7^2{EHC<@JC}fIEx7w~QBC&Wwkay*fzo8br0*0IF9fs$U8TJ^@4(b@VFy51g$k z2T~8luDj!+?W=~~3DP++4b&$Sp|>rsSZ;p!-plkZ9VFLu9vV=VhKqUBpa;1z8~VH< z;?C2~%)GkbJIM&pK#FN(d_NsXJ^cG zjNy2TZo4Ut-S=AL6kek@u(zdGw+m^&QHue&Vi5 z5Y;l><^2IcIQCJO4Uc-M~ZN_)PIi89l=VdWKudWFR76=ArTx;K1!o3Mx1c-OfQnU=sMHaGdMy zAhSG$uvHKw*QTuwId7AA;Kw70@(;w_7#UZfV|K~S0IfLBuK*~vCX4?6;=mM+8H+N; z=|q2tPRloMU@>&@dkE>2%Rw|Ub7VgQJq>&b<*NL6or(^9D4S@wOtQeovUZc zaAt=5Wl>1!wnqF41Dxb~s91|%G)&xmPlB@r_r_j5EEYl9QT-(IbEbRFa-y80bCW+h z=bOzMlOvhkQwnr18EuP-_@7Q9N;|c+0AH>EYv8Y9%Ozggf&15s1)yI39*t>K{PQBJ z7t($>Zw0xToq=t|KD}C``I%Z-{vPbp?Bc=wB+KzXGsc!-B)C5t8C29N)C+M;W%<+* zRL|-Q-?Q&Y5Fc(bg8TFD5xO`3>-U(g&7Cp0cuf&pex>2Ur;p&lT>8fgW{Pp$=; z@4Stdc3^vdAED`|2ATuL_i<8C`BV>Eac(a?J3|H$WIkDPwdSyL9syc~X&~ptgZvpU zoNWPcdw{S1jEBLqg*pItJI~i|0H9|JI45)q8NQ#73@Y?KofrL8JgA_9lqMcA1 zQI1Xs$4$)e9o^3CS<2`gfanJuEJhqqSHt$6_#T^=8*p9!9#IOvBdz_z%va(4N4qY{ z7A_pe8${LnJ)+#J7gZAntyF(qR6_Osog-L2=sgCaY|w*xZ^G4OwrOQ{VwnU`J*lGl z+IDF0WQgi3+o54Yh@GCm#Ep$otYtnUh1Ud zAq~`D<k$Mxcb*b-zHnbJXfSV!hXxN1ZAu~A?|X%) zx#?$i)LG^B!l6FTl1_5DibBe8xZ-?q(@efW%il-ir=E;wHZu79VLUW6QJXuH@6~u{ z_;&bMaJKNhP0Gt>ArBkQ1|GFr!jhpzln*V6=OH%3)_ud7IbvqqzZAqGdwgjanSa; zkmWlqWYT*H)VFX?!1mQ_{6*~W-rDyXvo+j$GRZDqqOm_RC@wuCCD+{1noS_baz1|{ zWcfZ9GU*vE%8d>r7w*a4YGJtw!|@qbBuTDYN0WaUx2u&0^|B^AyGIR`okvHr_f^S5 z-)|VrY>nF!rA`o;@BSD0%)UZOgyRq>mVcf<)V?Ct_I^ncY*ptG#d9Q1ZQ`Nz-n@MI z!aSl#dQe3UT4&DS8$dhPkW#^4o0l(pGQb~g3ygIny{Kl~N^=dVo+ESAv|EX?;YgfH z_fUkGn?Z8@EfMj3ZaDkKm#tB@RHtqNwPyqPsc!LSrd#w9rdM#uBK3W!1ZYFuyL78T z-lfG)|HJcG_ayKL>5MO%Ex}i?43SJ3SI39k`H>swp5&!V0xvgbi|YB^yd2QOOElk6DyWqlw4P!1gPru8dP{-4 zN~!#+F|+OI~pUQJ&ld@>O-TSk7498%O8yUhBJAGEB9}Ka8q_ z-@DIoa&%n^J9&iMV`I2Gn9@8~y*Mhv@d1fE6YDk$h-_Pa|B~~Xd zeLi%Rk4<#@I6iUAQ5}6n#D|Ug_w-ujdGqK!^sr|Yo($115@s)EoyYPIA^rH=kaC}k zZ^8F@^O((J-|#VS=^XnZ?r8*Q-M`h6+Uv%_chJhVM|gLckqNRXX&puS`s zcS){;H?XxMz(v-N#nXq{C57=ty|H<}L3Y+iu3#2XwrjRY7h~rCb5ZALfvC889df_& zg?4UE?d5;nuY_X_$=muBoEK`M@svRBzFWKVX*I|VH$>vwAik5P(^zLN?QYvPRBvVT zwuz9|2jgI?Ll0XKpUi?Z*->?!Jd@ptx<1vz%SnSd^3#2Z+n7#6ZK#Dz-!=nTMlaa>n-w;y5wz^@N9!BGM6m+OL-^)6V;=s4;RbNQ$o)Y`Up|#iueXx*KjTK z%w=mCu5tf8m#uNnC$L=LLvs!MVc0&<^-&wU%UB_{ zI`+Bg$Q(5^huS+1#^HT4L==2a=CHZw^K0b6+sESexAMuN+CyVxGye_5tykcE$Oqta zPp+M&?dMSr-vpWmjOwzu{!feKcBSk84TJg4Qlt6E+a(tyNS$FEKG4Hf?|uX2VOkcw z7pMC@dS4Drohcbad43MF7nL|@y>BhZoaVRl`5aAdSFm^8bC}%%e*2cz5!FAc?hR32vfcPs z%j>r5X35oU9T))EK6WMR) zEt0D~lPJ-#@at}2G0Pv#jQFL6@qcK5%2}I9%K;rdro!g{cgzSW~aLC)qTO`+Y z14L;`VCTCc53SvMLW*>S6u%S=e>NvqE{lwblUf_zY{}IQlIy3_nEsNzH>4a)02SLi ztl2&w-d0>E5+}-)msxz#c8>Yil&D169@CEwtsj3V2q~3Odq|cK+2os{hGT4-d<80@ zaZs>h<(6f8tIWaJW-qB)&H^6VYGdkD&SULAQxM6EofWl@&DZ++*&e1F zCaFZ}rsFWnSGPcNePSlc9zx7l_8a6w^O%p|VKd{K2lfA0zTGOh0z$UWTM)@XetJkQ zUWU7*QeUOEc?BUwW%me!FtC2}t&(eX49yTB8|AOON@C{x=sy_CweX?z#S45K@}87y{v#jM4i38#qUC zP#nr13e&5>ysltq4)rkKdge>68Z%L54xfv}mJ!m{5eTm%kz5PW>j>%sUxwHj^6lB; z!`E}*zGJ<({j^qA(ENk7Tw1QL_J+*Y$~`n_|ES&3TX|?OG24u5#*M_eDHlxCr%Hg$ zoxG0a#R7}udVtsT$Pj70dph3$JhVQQB&r{4>#-nEA9p(c>I7)Gq&*WJ8sL1{v*8%_ zAe5ZMHU1!PI!o=Jg*4x%JT&|zD(3>7CvZ>o1SfNx3w*R-t|%R{yqn8EFY%1p!uBhz+#Oc&7aU{j^(b( zuVDmr=KvjNbgh1qqkeg3Jsh}ktsBf&8|B-9&%N~SC?W%QhNvFa`oZ3i6222UH%#nM z8pmcdsBZa-G@}qW5w*hjqZ^nR)BP?EAvup zOg!TmjiGusz5g=#{<>@Mj$%men>5Xabhvij4!5(KweziWXgmLOUfs^2f6)%*IU&8y zfK|4(7s+BA^up9M`Ip=JV{?0GXZyS_?2~m#;C#EUP`ky!xFa4OTBk(wavCpl_eFT= zzFu3S6WRI4m)Bq0f2>tY+y1FhxUb`7>jM$oC&b`>;QHZnmQlQTPM#BF`w5Cy z9w(PZ;dM@n;X&hn2q1saPxmLS?mdzD|LT|@L-L>6&TI1dQUAZMKYX&At!2@{r*=4Tq?G1JuD~~m@-D62ol_%v`6(I`AAEFAp~2vDB-iM4LeDGiPY_!^ za8+p)tY}tL!uDBrXqx}{RiYhZiwTHsZ@SVz$TvM}%axV|+eHozsmJoCF z_iZBwU)lrSBfvw-T#&4T3m(bTK&_s&fH*STg$lGq2Zx%1REX-6Yu zo~^Sywd28GaxKe2I4f@5xWkhHs!6~-ZQdR;GlR#hUoY3qKb0jNfa-Y8`c(| z#Kv^KiI}m>?vaw~K@;;04Et2mznR)!E%$i0cJ@&Mpq6CD#N~>z5ew&WKg=;(i)ekB z!Z4JzIEIBT&Aez0bkE&0?Wm` z(R?C0CIF2+80GsM_FJO&_TTdK-o7@8+1-@J!Ex*DHkr@V?&mmY+hSw!326abwMQqq*MsUEcw{F(?dv=fC;~yCdB;15Gm%GSetHO_X2n7g31BZ(JzzY>ue#VBmHW+xnk(wktDgA z2r*+n+ce+!fRJH}wY4W3&02hev=d>u7#c%@&0kbLmNWV2J_YgwA*e|F<(Yx`qJNOS zJh&k&&!`PhDsjX9cyjWws4U-a`%05@=!dvu@OAU{^>#rDO49Jp+W=yK&Pb*DrM}w>B@)vp#x%)FK22bN61P_@(OV0u<9SZ=}e%N!mCC?fheydnl}DC8TH! z%5J6>kA~(bVe@#Iz;Xc5`vSX7zD@hxtcPCf@f3N9!1A+<#QHj|et)EXp%7Gh2r&x= zvE_`w`F;wL>v@n|cg%v+*|Q+E>WxKR&NmiyC2*quPRL6*0&&Jiflt^A2}VOH$oTt9 z9jtk4R_>A`vwqOE7xcDrh)dWE6B3RB}Zm0?5YC2Z7z&U z@PWX}c$Xj8M9b)mZ_XOC|#$xpmx0I0M08U1br!~99rD-ZBDLuwW1=VP5s5I=tt_InnjPOPp*8qeQ5 z3sTz&F;}fy-Q`@jx+|7;1CQ*dVj%R-LtBF(cj+7}qd%Yi~rKQ>+7ZzpA4pM$imM1a1y4RJg7HZ|^e z19Ivc$H6O-5#0Db^W6V*W$td=(Jf^AJVIvuLp2W`7_Afi2uJ+T@bQ-r2r-& zUYr~->RV3cfxMd+j(U0S=&8pHE!b}6IFR!QQ7&}d+VWvtu03F!+w#GoTzhlq)~=3i z_;*oP$1eO^(be&4uHB38JMr(Lu8y8uyVC+Ey!h?AT>GJZvVTTYzu#KV`n?x&>JM7r zm39H#C%^ljF8p?KSL2So7La#AM!iSi>klSFA0&W#fgaqrUK}*A-v<++PZ|O4gF5JI zAHjT7oM1W%kbacL@vJwrAierRM0t?UsKP5fjt{Ddc+eJUbgJ1ed@{&L{I6(8g zsv8Tb-dhYy_KtnaJ?RlIi48E_la6Z6i;Cu(Q9OnPj?&!YJet)a|?$z@D^=ZGqBgCxb zyz||WDNe4kfc(X;m`r4jgA<>Zfcp7PL(5koq6F%1ZTaF?b6Y+y5!EIhj@I$~(e}Dr zJGCe7XL7;yFY1E+imvuobM0dPtzGS%_?OAbc|q?xbST&E#P2=1_Cw$0+HWGnd}_X^ zZsdidxtY-C;lZ7o1AXlrxUJYv0EgIL(S^?z`n)LW`PRYbyxv^<_Xsh2qP}~gzW?)@ zzEVer-qmSwzPkn9$7_C3vq4l(=du`>JcyHfHu5cj-5?+4pym!y4*o!)==bQs zAC{+{+@W$I0k~&yLFLyW=3l|~3hay^7r=2^5NsvDuMv_Zm-YC@>_&h!f+V@_25>im zP_yy)#%#o)1avho>cGvnTkH4e;rL^oRC#Xia(mu7aXZ&;J+>V9HC7$C@5q6aQ-UzR z$^fa|xsvO-bwb*l#7E~_uREN*$&)JYS|@H7-oC>g*8q}0ZNEOT-U>p(#_CGDP@QLY z>fpq39o*2(gPXg|$)^Q4mZuXP6E1J)I)!?}>E-rA7T&h2di;T05YAc&abq9mRNroo zs~&IPqyzaQLd+AYSJ-iV+nXb9`=a^|yPm<8=^m_lh2085dAQ9}RF63@#2=aFF^=+! zd<{fD&cP;-Ixh-5or6*KR6(FIWUlPySuc88Z8THHc_r%Ay9ON_4c5~qV9Y7KGS;BGgi0GH1#zhzQB_>}nj{AEcs1$Ng%yNI` z_%7)o#fvno75#yY3{K!N@LOu`vsWIg9i$-uS1#5R+uQUY2mXamq#i_v&H!?}PITD% z%erjI(7K@Sf4aV(m{9+fptqe71Ydp}q&O`gzduIYX0U=>U%kryIT($<%@MafR(+5C zvFdz#eRYAohKo1WjKOy`_W9Cs`ZS`*Ik0wz7}7%j4k05euYLL1KORnlVe}auba> z?yLs!J4goiQ5~er83U>1W5jJ+s_(LY1qS1!F_1cWjJU17`lt5#YMXsa^<=w&Ga3zJ z#BJXL(Xpkv+HT-Rlve{dN_5cY842#AhW`+bE((qg93=+mvlzjBH1R)#V~B!d07pq8 z^aTvyKAQX=!byyRlL(Fy)GPJiK5F_8;Uq`FNd`xW3Hm%ba39V558;@i;F!Qsk_mkl z9^6NAAmyzbNIjAxZu3^(X+Hy;F@6lBVx6B?SKEJHJ<;y1zRqri5k_l{xXqai_9`978$j3BOo;mn zA?}3E_Fcy>kA7FG z@A;0?fy&+Tw5#;t18cct76U1~r+RCh?3!5kE9!?f>E35tTXrh0cUl@k4 zuBm_fr7I+GzBwk}+PRBfSUc%2FRiUU^~&0x+S=Coe*VH*E_(ZMSmH#7!dte(duij#SR=(j?gv3ooCxkS<5bx@p4fA0i8mn`}} zxXHu%d3DZcS4%63d2yX~155gL0e2GgQ0`J7J zvdPxl5nhrJVZYC%48r}92KW6*qW_x*z+d&_F#J>s{~IC67Tv~&Q$)Yh9d0LywzH~Y zV;Z)Fu$NZUrCAqXTN%cad^&B1;td(bn<~6%@BL-YWJWt3g}(_HJrMRo6&uqSJ(7&? za~Tvir3EAz-~9dD$<}Iwn{E8Nz{v=Ash~4fLAG(J)`wXY-n6RQ5%y@~BSI2|Pw4`q zjej}3{DAYv2s_K@5Jpqjk5Ig`jQ@pgco=Mlz$J`ZcDUTZ>jz;w1i?72;!wF`y1vxG17K{H|8ztD6gt!?K?q8D6QxyuLHf&3ZsoTE&ENH6F6gK z#U~n{vJr;_N5v=QmAu~Q5VDOAS8PmkK$fwz;&8d+2dphCWF?HNI9%RL@yRjHT6U=1 z3WBi==}cvIwDD6RsC*V}W3+KJuQxs-@W#A~Ps$%zzBBC+A=~JL(Fy-m@k#li z!^;oQww57X5dSQrqr#i!yd7~8j7tSRp>$bC`NPY0reQm$?m_v-wmD;I#b3&+W@G;l zFCpQkiocY1(6(}n>naeh(Z*$n7nQZFLA=%>Um?q=)`)(GfPF>W4wpNYU>^~;tOVq9 z&jZ+2w(-V6+>q{GO(sSU;&z3OWk%Dbg5J1PK-@klU%Grp+EPlhY)aQ|4%^Bx{+QAX z`5dO1Fo@fam+heaKFsOq*v_l?v^*?B$it--pO)|9u#M5iN2n}i8*fCM7BE?QMBo!D zmvuyBiSm*&vcBaQtwNp+`PWV9h`7ZYhw?AmI13!M2>-H;uk-QPSL4zjV1Gs%or2Xy zdB??5*&XCrHRIVbxY33}75C|2` zX2CdHG_O9PauQE@M4s_V2OTG=G_k%v$j=gz(7-gD16 z_ndq0ImeqmA6LQDK$80W^eal=3d@e2@I~RS+k(Ql4jOC&9 z`Pk{q$1*k_bs#ldu<*UCMlloHZs0V_=0jogu^NPi_N#VevH3tbU+OhiAk0iQCzta% zfl`!_S&s^tT&AbY%lFy5%$CH4#;ba>*u0cBR8bns96L8q)-Y?~yIBd!qhbS_pUiP{ zbhX6##pb9C*EH{3F_X>HJT_0&AT=yn_+Hiy2BU$^6`vudDfd@&2&+Dy956bOX{yCY!efY~HG&tl`Rq?`Bmq7!70i zXc?b3jwd#6WmL}Y+_`vjGlegBnQTwaU#~F1{DsHP-{{;eXLDCAiC((SEnzZk4u}nF zuiBaA%w0L+Qj+Le$>^obdo@T6ZCCYX;hI&CFmQ}QrngQKyepwP(2O{|l)+{AMqEy! zYsv*MHQ?~?BB`|DDyiH%MEPeDm1zj4N}3&*g|d{=f{0^js0PuSpmKH+u2bH6X;xqn z;$<15gL&tKhA} zzBaQp0qOJtDDx(SNu#)}mM)T+D~uz%$Zb3yX%5GIZC zL!&e`u{N_ri2~@$%K$6~aDc?!ia*Xkv1-ya55IR{1>zL>-tQgQh`;^bnyVfx{5jMxdcK(H z;|zxA?GrK>zrs|CUq^3dvZ} zEcKR3)q#?$9w;2RUN0OFasK>t{vL!3I*xvEW?*2EUdVJkfzDqe2wq9dpfaFJstK@l z75N1FFVcCc2kf8Vt)gS7Vssu(_Hm|E;=NKt7$x3?FqQUk))ffDkNs}&OMdTdB96iD zt-*Ejss{^87T_2J?|@j+Fdz!vPBFuac=AiL=olQCJRk}UI2NX>VL$!e8kiYqzLfQI zK$IE=MA5rL#6J4HHKV#isdpua4RutuFd1AbW_hb5fyyX0*CpOXAT-RSGD@U#x>?Bb zN|NM7JE{3%HlG)uoTKs%dD8D4xIvB$h*{n~QDpGuO$={VD!gkahKKZ2BBj8*bYhq~ zq`(VL43Ej-|HBx?6nM(S@b(KS@UER09@C@#{TLUD|9*V?#eWa)!Bl)M84C+#=qOHC zFr1c1lGovtsZi3;v~WjOvzX;|VAgQkhRt)SSCpiNx`n-2eL|ME3Q8EwT=f8z9n3B) zqjG%a!gm^acP`#sLS?xZzxCcWifbxa z==%9{(M#9PSt-1~2&M+m9>BH-Z@}?*y@Dh#ILdf9HK{Pd<6*ojq`+7*9!80n(*BYO z#<3!89N!-gBbEx|((y1Broy;*JdFLR?JpbOzM0zo_s6%t`QNlZ(2_QWi^s!wFm*1j z9SdU-wbx6$4?qf>WemC-#ECbFt7d=m_qh=8cfG2q`6w|Ob;YmqmJg97h20^6%QhqhV3+NAbyzE^{MKK^`ft22Ju zW}bJikVo76A#F3yd$>i8CHp$rJ6W7e+dX^(>WP!R=Zx92%=hMttnC|VfAhUZR>(2B zKQOunnCm@T%%w1n+=;qLt~b{u#~A-j_Wntj>^*B?TjA3}t~WQ6?a%&AV0zUm33blN z-rT$DPIvZZ|0d*l`*bH3who)Zkvc8$Nnbdd&@V&>GfzME@65RmgU_coSs;V zZRdCefLM5l_;+MOG~Exc?#Az2?!>48pBx)#mb#A89PVNOKsaM9fYMne$EsYA-&qDR z{M}^#j@<16Ma)$9)q}8mqX>sK zh~l~~Z0{yP+b9b3t~C6j@~tKSr2+~M4fDIz*5DBLp(rw{LETp}M09Y$CEKro*fFWl zI4TN%?-AkY9#MFDjSWX837|CD^WWq-DvazQqK7|Od2d97b<0KA{j31d5&$3eVUh@n z0EO!i{?uWjII+t=930X+u90H^CEku}SiF=}L>)dV=rA;iPcexJ};z#(W4HKo~ zCeWU}24WT9J0uE87?PQU@$%phy+?RANwzV_-q+V^f-?nhwbh%X>M5Rza@H--@P+9 zq=)P42E+9kgN|<}e!s;e`kHGXM(=QDs{5`#ZtG!@os);%?3_HDCCAh(h=p_In3@Z* zaDg0C3)s2J_*hZTrQ{I<;{-e3U+3_0CxJoZBY_;lHgAjB#P1yOnrQcHdxd* z@#y}IW$E$u9sa@Z>0R5C{n{k{{TIM;avmkbA931@_-Q<-HaG00-`{bTHgYffevd_z z?kvdn0QgeNk2~c9{zXpv$B8mpM=sG`cG^G2 z>MXw1qOma`6QaE$t2>j|-E)*E*e87V{JoZ*+MjJ3EWPI&60DG*wZjeT+ug7i?kd*m zZ$3*yc=ez@R246wbqjvS+WWx~qO@hv*jkj9*DJh_hm&xAmj>st4VJEcoigrlsTOg@ z@D)+oa_N~TZErPiFXt;3Z+<$cA#C@qdo3EzbpObYRm4msL#{bn5;l!oL2JuLoD_v z^Gkofo#+*EZfhI$btpC#Pl8ClR21lAF_l72?20o9&C5z-RlJk|k^KS$j|t3IWg;Kc zRJy&0kLezp&^Y!e2k_fI?(3c!p9t&cyvSrig3Af;$>#sQYf;%zlZ|rXg)w6b<~ezl z#DJ6AY*3N{YO!oOXVhU4qW8Z`b72M4`LcQE?KCb&Aa%Y^-C)r;C;u+zd?~1*uMzKV z*?iOuo9Zvk&`>5-dSEZSbE;M==e7!NI9#8nK2-JT>2zLie1zfPtP!GYc0o`*NjAeS zh<+qOE6&}{M>m%BNu`12Ovtagwv5(k=5>B!5#>2ItjF)({;*W5no_2<7t7`W-ggPq zeeR!Fx;#XJ?Pct}Hjkq@=HJskzYW>q%k3qH1p8Cmacw9 zf_>7IK!pcdJ48?_ywEC3kd%GH<=Wwg`TT!LlxoSDqq5OCy8miRm%kvv5)b58OorCP zFrhhD-lsZaIsNV<-bT(LqEvfi^J^{}D2z*|X#1V=&xum)mCb`VPxZ3d&-+^iYUlzx z>0f^lA^xeLhR$SnkwXFQ-!5{0`&8dkT&sPPCSHf{fBs*s!{cLF0@p2m;)O^Y;QSe* zu^o#7W8!8O$fn|jND)9m-1gMq|F!}q52}2!xp%)s<8O?dT??Vj*5K$eTEP>Xr01EPEhX8bqWVw(K&pu<$ z^R^xzCNu`{r|jN1&3hsju(-|ww1=G7?v5OG?wyY6*Ez|2=_e%7aOCA^o-=-*v?7n_ zkmcle^che9ksc3=2Tt-K686w|O{2NFaBO-8L^|9w9;7jtPh;61QR`*%xMyP->NBbf zq6d}>T7R>k^*ttNiM4`8*0{U&dms{bK`=gDHjnKTw4eOirgA!7Bb$qUZR>+{-SHWT z07N>NA3Oc;J_90^^nVHcpL+(4O&&~K#qgDP28}m98s8B6_AEj~5}zuYH-FF4$M8m4-dI%x<LEErIfUxvh5=s-bo_99D7dU;iBq?wO(`%2|v86_UQi%cs~n;^W+ZhYuGh*~f=; zM?MG~A0Ka++x3Z580hEt5J3&)Eu#LbGwv(5^@tk|NB(CD&7XlZ+s^y*VtHD;1W-el z^1kGJ&(bMAC7;oFyS!niPYwO2i^X<8eD0qRpW7ygd4#sF7&xEdhvxA|enC4F-%S(~ z;G+<<3L?v!jAf@Tw`lB|jUpTgSA!NQxbGp<5wBftQGaY2E2bT^?<}`yE;f{fXI^j7 z{0$w$B-(qsyg{gBWr-Aj1}^ggeK~Nrp4;Wf``i|!GEhbvrWQ<~{4N+j-fQbLCWS{f zpUZ^^Sqw3hS!6lHK!omD<+kqNw_XOVb199FeHiDyDGlGqhsVl!{uBToi(C5p(5rb6 zIlflVSZv}#UlFy{I=(Gsvpt#%DYa7$RPjy>gi0^j!UJ1jlUrJ%TL+d@46)L@Gpqo`;@ISxx`{K zFC|0|*Mk`zCf&Ox%q8{;_v=?fcT>Nr_RyVNemP@GkEffO|2y#pgP-VUF`|C{y3KSm zH_M5S?_Olp9M{6Lqdy}n0Cd*yj2CRK>!DZMc{+5No zng|TmRDiGL2LQ@3e1GTME|iHUk)#haU8kIN>D2MQ9fL=Q^ol(AZtoCLWZGAVVV`#1 zMPmgA{!WPhRFSO{BF`I9{GXQY#Lv1=gb4E6*qF(VJTS)LA9?P;WH<9Q{}aRiin}@f zj|y5o$Mac;r!`CmYV?BAQ6QTg87Mo7j9>HdfdJ9OblL0_A^OQ2YfNn859TmgS_0rZ zK3z89CN`IzI{cdUlh`NL=(t}}>g=ohUP)w{x} zvieVH`Q6;0bRHejkM0ERM6-mvY<$XWgnb<@I1DpS)mE3XnEJ=2iZm{NY8?H4@Ur+$ zQ3Dq|-B=)-LLQjTo^Q*mj7Gm4B+Ah%Wb@fU5=H%p=`DpuLK3z3V}f>KE|>z2aezco zp9&9=WcgZFZr*6=9VY3H65^LZ4ed_hv5{48kIMD~IdJ$6XD+ENAQ`^|+5FfKW(L}N z8$ctcLhQN>Y8T8HvzDdhCj%EKR~{YG3q^>AMLE_Z44(gaX^QMz51P=Bl%0iTEKWvm z0b4ttEVFf_yZEUr=U2}#QQk|hzaUv(;`JNz)zIOz9A{2mt@O3u*(*#`u(48IpoZ%L zYcjfUZTRi&Y`>&O1m%TN8t0~9v=0YBYn+$tLtiQHLm?Z(EoF96XRJx%%}Jo-A049f zXuBZNKV6{l4EyE^TB2Fd9w9WZ>5Si{j`;v+br&Y#{guP(>pjW?)Xk^wW;B;Wh!Q_XHdoxqW!QAty!lRBUn4?` zDu8lZTAvd0lYQ#sed;Y#L+|spaUIId<9t6%sQgS^BFEg0%(eKtGh}lX|L)5nqD%)C zvtewkzFiaOB4}qyMi`tu>J)-1_iD0l4O5xNt?6GG8RWM3&4l-)Grlr z{n=++Pxt2`fIL(S(7MMa%J_4Ew0sHwO5Y?>S6GzI6Te`6t;=L<{7R&UH(7kkzJ9b- z1+9e1!~ohqsK4d$xdAonvWiS-J2m(07d@DD&>L zb?N4lE}uu^ITi+{1B=%o-lT>GN`wfGbr(S7+tw9X0;TDjA^kkwj*I8|#`e#mbRy84 z@M~V<&jM%#0Tlf9IL#wj7&uCZAM35nR6`%}-~BE%^iOt%5lW1k_m@Zgg&ln^IscMD zb0=1?+=;c>&?;ome1Rs&vRUbZX#WP#`q1uw478VRhD+3+UoN4vv6s@u&4QMgL1|+z z(#BUMX>p)I4XLG+rzi9?MjL+0H$!^dFPoQx8v5T~**e;2^c+M{Lx^YmkMe0cs0Azs zwlh9vzlXD7JyhmVKPa5nDj^wXs1jrovSsth8>}(8g`D%Y3BS*i&4<3_`>`>a1+L4gXA~g1@Xq?yyTBFEv zS0TSn2JoSb{$U==ql)?_DF^d^d@RRBqMYgH!4-UOvRpPx-x}R-*gMhQqza%MK0Kr^ zuLkYoF*+eX+Z0mbB&O^QfA$vLZ#_a|N_sYyrS1bKWed-7&SN|}V@}3;=Houc(YIV( zb|UYi@?oURQ_W_HJMfbN?G=sr3^qKUc8KKz`Y ztuuSE$T-(W}Q0=ou&C+_N`$1qiF9ix@S4@_GUvQ zF2W34kDq_j(&MMfW;Z_1kj-b`v~)@jugs(TVXS~i@_&)>hbc@3+yX&)9M+L@HBh?VPlH#Q@5W4iD*08}IVGH2YKSeR`hw*D*S~lUpQ}ew>&< zsJpYggHj+}cPG=qynY3XzrSn+i^;!~&j^?A!?TfX#fpelB^h zBrrBEt)r8_kQUEf7|jJbz~hEk%QLzLPKHQF4$NTrmrIPZPjU8`amT7OHeba?Ae-pn44B~s@S*L~=>nx+DhW8{RBycTZ0(qr z;p#Zb!t}lWw6o;6R2s0@cn$1d0`+6Dtffu@rE-KsQN|!&lvCN{3miTr+3z|Ll$ZqF z$1L{Un_Pc9$na!Lw@4Ie3*}vX<($!R40?$!50M!T&taYSc%4~;gpa+{sK4u+(K?5) z&H$P5I+uF`g!pHG8hRxyPxVBy9p`yS5@>9gRKDDw3(*sjXjqbD#3hl*-Am_a59Sgb zeJ-E|I)NgT-~`XG%P3wx=|KUSsvHkatQCeS<{m2>EKzs_Ycd-S^-&(?mK%kt86 z14KKrcx*=(DBW4IDNAy!#|1Nh@&I(-DwZ1O=Ry=^z=cSclUUA8S%O$G;@C^`{>D(A zU^{JDpoFtzGd>;6#B_S6!H7%chD&BSSs)9d|9uMGPow8bKV@y=x)VB!oh{Ma@>q8I z$q=b@C*cJ}h$0=|a5CFJRa4+Lxw+)dfc$4*T z+~6JG-*;+xo*D_F|B=$)vrdLcc#zQk7E)R%HV)LXTs?iYw(bV-CDyX_Znux<9Txlc z+hk>j1j_!ehIFUSi#{sr=-n$^C!P13eMDD}lNkuJn-G6YfG8^~HC|;g5d$3-2_~B5 z81}R1WVTOm%(Jmor@(#nn6^2>~Yt>t}@Km8P;yb<5@xnf&Z{5=1|8%io}lzh8uc^CdXH?IhU@_ks50 z2+`F{2)0$rW>^%oM@NVb_o!}Wsp5SHWrvt={fBxv`K(7dt1 zw)12&+%9PMV!4~1UB$u$5L2I&W8o(urv7SvSNK=%E_J0G3$KKjo(Vy9zHIi~Lf1)p zw)Le4lmwTjt+zlVJRi&s38D|WVec$YHO;*)epd}ahPv-hBaDVBCFnltvuO^gs_)V> zvAy+6s3$_Ow*c3zFB~R%qgyr~JHw)RlAIh2ae(Oh zWtJW;fYJQpi-%dBx>TDieGO(djtk}UrWAWabI!kTO-|LpPf)pBWJpsXaydI=MtyG6 zMEaa8fs*)gi006{WSOOd1g2_}Xt+Q&7c8^%xCkcT|18KOZJJm6$3vOcPx3tHk$(4J|r==o>q z&)J?^XIAoTN6rGJLS`{AYkhQIXcN+LeGs%nJ>3`D1g>griEr$_tL3xxF}O-QU+eLJ za{rfXuXinBb_<(FpYf$d^dt1n53{eMlOQ4!5+c7xuUXKTol<0=?z@H%UA0IM_5Gu31udhU@@XJ`j%l92_|aU{}-@)kObqN`CY0Tx>D~;ZyRGzzB0OZcYxpV zb#OIG|Br#zzZ10Tlsh?S&-85oZDokk%9uMj37)SfE<*QPg(-7&4`{;tI`mK+}t9NK7eIE}bPy$~L>1b2`l(3wuINnw_M84toF9rC0=!!`YK|32jHh*~= z(JM-zwFB6Fo~jX|2+$r9**-G8w-cHKk$zr3H3nfiJwv5zrpMe#Ob5zG;b}}B@H|@4 zFv?AQov-h?=)|HD)bl&RX5LcY&k!1CiF9)93sIXF?57_YCs;@rui z=P$jPprHJnaWm7^ajjS;fO1QrtqU3B;cevb5ZrCSmhpYO5sAqk96_gM5iKJ1pw=eDu<-5b&FDwl`o-m(No=9SAs zDu6<`J=Q6Ka!H}B_qxaT>*s~z*Celx<|3zOB8T3vXg;JmcYCS(uUs71Yodg*MIidC?md&0k-| z>k66U>o%m-{Q&FIT%bip-*nl$qmRbRrgzCE^LBbCXlEvGN62IC?8bJcCEK|vrJa!i zK9))2+nL7Osp9R#3T>V8-5;iEQ;_Csz@-0`sakwCm}r;P37|A)&FkvtJ`erxT6*O% z5}d;CNSqI9Xe;8AuJKa>zh4d!x7fbIsM1pMJpoI6Y%yp)@Y%Ad;`2P&l(Qg;W8d}q*s&Wpz5^uKbP~M}OV8;OQVEski?>^Pyq^Rc z11zuVkM_|11b^btU(xvf{K~;Q?@uY>e41=_rNO=DFP098iQ(35xAe+52{xY1;MQ=s zwH$7pe>~hJ1t~claQ!c^^(J?crX#Ofy7~c$HlD|5sG7GKaK=(HzRk;do4vfvPYRN} zM4BO%&P(xTIaVt{OZYuP>o^_~wX7cvi2rvc#shiL(&PI{u+78p zaQt`jkGJ)CN?X0sH$!X}A^s2Y8Lw64FkYL)>m(+tp;J=$I&u?4=(wkYdAc+1=?K5v z$j15qyTd=_d_S(tc_Zz>#{=YFXUv_pqaC7Z8pVR;s00lFv31ozw$gm0@Z(uwz6CW|FhN7 zWeK`}l5gv6c`5v&o~*%XCu?`+k6p)$`MxsJk-vcLS1jCW>1#y)p)jy>^|!WIx>_ci z6;O1jEeDjNQnB$KA^!WyWb;QJ=zj34xm^!Ulg(NQj$B(V4}l2E5ch@qdJF5VmGH(dhfr)2>;ol zx%*a(zAvM8*`hyNdgTbxYa!q7FQK+?!8?{79(LXr8)%~=Pv7*4lkbG#^*)P4BfEK@ z1?YC?+j?)o`2L-nKVC;d{PyPCxLG#8rx(&h+GB1sF z0wM%)-1GOadu!(Fmj17Dswen;$`V}5hY8JdU$ckNZN0?KY0&OD_`0Qk#d9sH+3G%! zJHEj&cW2vZ>vYT6uoqOnwlLcsb8lc|RkZ8l99aKE+I_!NJLNzPm`{RiezF)$H>mqE zvSsthnX)-egs4;Z)5Ws+zaX2Lg6EKj$J74XXG1#6f9f{I+aj;ie5j8HW%IZs22Mzl zafb-e#hK9B<^iQI2iDjBbDsI}V%eMvviSr^ha}WfM%euvU+0tDnxoRV8+RLwk~8-o>;HCVSWAj*&585t^F{M>$AmdeN5z0yEU{& z0AKB}r}YZ~l%hOauk((tTg&STlbJ6A*8e-N9}~d07J%l)T{;yaFie8m-OQd7@@&0# zg1(%=+w1hPoUn1pA2=xsBHKl1S!NRj?Xw@gz<46;gXm)~Fq)l$a+Aho_Zg*IES4`` z@)^Zjm>hyah$eFXQP#Is)Tpn`MPSzav#7lPBH1J&v{b*b^DaR^ z0KtoG)P7*;m2L>$DnPKYS~exRhcU(Ie;8udzh>!`UI_L-EXSH$DAU9i!3)anSDp20 z3YGcK{E6ll3U0`?sZEXj`rB?xZz{tz!^h=csqxBREnUrm?jPjXG#{04oB#6KY-p_# zL4k!(P_ap9?G-?|7u%_k&ADjPNo9dLP(%G|A*R1?>HTZvSce;CxBz_bziR2>VlcyB zlkOi(w)MpH@$|f6^4RqT`D0R^t=* zdZGE=4G>ubYG}oLFu%&AXOTvDm_!p27>hiRk9y-9*CU^lwPX{b{FV^^M{a0s1W?dc zi4fxNrT4=9M*j`0{uGeS|DpHf$^t`@6wnCqFXs2e8>b=e#K7+e@i)3yy}pMb_SOwd z|LuENjt$cN#7j>HoXfQkLwG39nBDE8IL~;S`FO|IvK$Ix9=26t6n<>!;S*>RmKblp zYUy;p?qvA;flI)wD1jq)XVCr9adU9~`>bkXBHuGL}Y)o9oi;bhtFuVTNX|g%#)l|E_*!bcZ zX4l7OJL4;%I@;s^V0Jyy57Ngn5tK7uWjd4mIf*7_Gd=6?uUUGdIJb+{EjETVGAbKg*53K4a-{kOX(Q zIX})u`5_p$|HIPdPe>5y_dTwMowD1~GkD*^ACqX~Nvv-M_AP++q|fM=N@@R)XIi#c zI#|rEW@RO#W!G+D@e3BxahJ4YXE0y%?A@0B#VdULeI$x<2VvlM>k-a0)=!j?*wza# zTY7weM6r!!E>PG#)?#DmHMaIFjIrn2n=Sp@*73TnL>YIdAw}kf zSQ3(CoV&%+JB~76-q#87JKukOJ<|=_dA}M(*}Mj2y}NF7F7JNX(tD1ODAxTOA%1r@ zwl5if4a(+!0Yp(BLj9y)5{-ILLmNj>Z~Jps1;CM{kCSBd=fL{r(L3!fdhgI07U{hhI;B^kd}6epk(CQdfN>t@^SSX4L+T%os(9Clo&qpC@F_w!etQ@H4tXlomjdlYw$D>0Delb}o+bx#$%^c{GQfW6(LMzZA5#o9Q{mdYq5l zIb-MJn)La&F713S0~GUr~pmR}|G8aGJYU^>4%>~+OpHjP#-TTbhHgB`_e~y_0pK;ArTkqj>@DDx*3sdG`?A@qD#_bQ>5`i(y|G@`eiB%3$eLRTX&n;pxXxJQni7x%C`je;s_X>n%? z{<}_$;2Ko{&|2w+8QW(`{|M)@a~7eJ-o+ek7h(R-(1_ktFH&FfNZ0BFtd`AZUuC-GpI>D<=fGUU_K>6mKr)GXZ&8l^EngbFi(jU zg7~gN-BT4cVR++RHHfdJV9FwNCsN=b41|@)QbXPe;QTHJ>4^D|ie5Ez@o}5xtz6*- z^X@!|gmZ!Jd%rHMr?2NPL^VwQk zjvDd+_+CgW!~WG}tDytgw%+R+t4rRR!}g%AB}Cswh`$A4P+3Ct!)~N2hjvo?h;)>B znE7ksH^LOz>^)ABba$N0cp$AGb(7T)_H#$Jt#_v2=tG`s4%ex6{#)f|&G_yYd=CJ5 zf%1q1+8<=f1Jsu>b^p@IT`ss-zH*R7&HuIS$LAGa+x|X!XJl2-u+AI54b=%9H!TLCe_0{Bwf!f$^wLKLizsj<=80^^oCx zVzqGj9WH1U2vO=+U;pM*!q* zpZwB8r?^0y>JlDqc1i14P8;{3y8x8t%9kEWNEt>wNW1UIhRZf)!*?5PqKI(MzWSy= zeN(kse0axY58V6c$o6mQzF)Uaj6JZg9y-3M%G~i#RUYJ5pZlGH3J_c1-1ah<0|j(` zirGFd#9D0iV$4V}PeC5z94xc???Z|x|Hp=Z9di{-&}&Vu8>?o_TN zL`Qh3`)DYy{qozhen8Ej*Ef7?sFhq9^=QL_fi15 z+W?}CXaft--N)mRm7$JbCYx0Pbhi@{y%`|7@)b+JxtQf2U-62i-%rdD!>!WV4NssJ+Y5Zw@5k zzO~EJ&%yGuS)F#9orl!{bWgQO6#IH4tf=L}>G)A?4W?}H9VF1}C9awCR4pd8~l6-`Mr5|WGFt$V12*=1ojL?50n(;R<9 zENb}zK)HWD!%2PyM8a;E@$h^wPXX|~&G(vR7eryzErUH0L@QU_GN?)rl~>&|C`;7W z)_iyu%ftU5KC@&~-(~6eeOLsuYSk@+jczdO@Rok z6dMnX5Pd(tzw(3&BE30qxT<6x#q9$v%uitAoQUj}x{&sB5`=vUxIq*@XI638fvg86XN%=$#jn=g*Hym9jaNe+MVarp(Jm z&)4S3=AA9c(RrE9<7Xy)-gvwfdIsqWEN@|V z6?#?%2P1CKzH!EJTFN-iOc}?y$#JCm2swU1G+qz)pV`Cvqyhvx#9{+&qV)cx>R55! zrysUJALuWV3T+aIlz=Zj;{+ALM70bR8+-&nf&_$)6|l=V|M>byqh~5EmY-0(uh5?j~a&BucfO0^R0{xO0=#zwi0BS*Wi;eP; zuAL6ghYLYTy_=PK)O17LE&ApZ2m?rYM&VEoJ+NRs8?K zr4V8JF@CDUw%A0k%z_~D)B8)Qe`QPD4a(~Ivbiw}TGeb&a86Nv{F=AbkqOaNZaBOU z)KK`)Yl^*XruVY?Yh_c;fbM}wwjQ4?n~omZ*sO-?{|Q=E)_6Vr*(_U6 z$_l^no23x(Q~!oiqjM=ReG_~wy@Q0~s@UilgR5fWk)`aeFDoxK9^idvdua@R4K~p` zPEcDjgz^%{wNipElw-|amK(Oj1NmqD)zZTrCf@@1+sl5R`d5^7<@Bt7@i5UVBwx!@ z$BD9n%Hu-gX$c}>fElajgZVlk{;gx=*%adnoU<&ZH-`%#_HFCTMEC5RwMEWE`*h2A zKS#bcv-3!a`aOLI^)CUs(_{Ol-c6>lct-soI5_9se2*i=M-Rx)1AN8LfAd8v1G|iAzyn zefhJE`e8IBwy|LJ@)#dHUPgf4(Ot~$=*EG@fsKhOiyc}EnXM=1)vrW3@>OPvohl1j z+udp??1sbe>1@qEY3zQMF^TPGIk5T{kKNA-XMl2H-;mzshV@mKW@xWGZ|kZHg4;zn za&#wXYL>jR(G8obZazzEzg^x?1@}GlsZ?n6WWZqn0WOcH;qqaI%e@qrF9}-bZzwMJA}(Lb9E-~RQlPse2 zkBKwJ@a6D)J@Uu*)KIpaq|-kB&O_<+S&G-h4G?q2O4n%zuh%iW_HevXoMuAn$tCkB zPUolM^!uVF+@Hkh4QV(P({Y-%-`XRA^1H;4E_h&l)jOwZmCy4%R>bAAY%i6zedF2M zm%!r!@jcd5Jig)iwmnvc$N$)D>mPAi`(O<2_Keb6)oOXejvSUle^hrV1bR23e=&=Z zk(dsqgO_7zc!5;Bd@5?44fKb-YBwt6 zn;Q=MR*Z@BAArf~KIF%*zqa)r?x!^{8bhMUXp+>>tql-+@0hKl&0Q%%_o&acq=p{- z+SX6?*rdXY50xw{0)^NJI|=jNcJ21b2F~9Ae)g} znJoY1*S4M-iuOviThCQ?c==TMcO(M|8i5$FQ#U zsG%#rw)GF)>>RdzF&6C*0Db?y1D*>u$QoyfOV79(5LS4F+Nv%m=9R`o*a#PhcaH2%^j1}(A2MO z{XV1#)Ynmt^Lx3%_mla%9h+J>jeVEC|33OIlfTPMdB@MqgzS`e+%87`7=6d>d%>6T zj@$Y|NyXGvZruIkY}x#H z2RrX-64`kd$`E?qr3%`fuk7)6nn5<-*}?X;-rm9XwBF)vIOk%Y@cqzs7qfF6+Cct6 zTDY&Bosk~!xf9ME zd!Oa->y{oDXnZ*uhxWEjqxV$<6Zy^lmiM)1gmk0ciFV>`qHO*=S2l@Q+)_8pV!(aL zV}kiW-G^hU7@pjkBY;vdTuYw`vNlBHo9*9N26>QA?Pz|_Jv@4^m+b|v0ioqf0hC=C zwk}9)4$&s5zem&{C~8MCxF1Fi^bAq~kyl&lO7TYQziAJ9! z1yI+0l%DsC>uNz7BP*wZxUK>uDl3nCI7DrUkJI+(aqh6+KNCTDFvHe;pcXW7xb+HX zbs5~Q3W{1U??Wf=zv6ae;#mFQxFj0YAT2m134x=M6hPapezm+o05#znLmd2<#szul~}Y!-)9fbK$23xrH{U%X$?*1T`idp%|6+Pc$b`n?{=1SR(2 z5cNsFYq_n1O=^aB3R>}MdBZ@zpdoLT(Y@WGLoGaC%cq3+WpB?SdLIt$vE@MHir@EL zTZds1OnB!b9u3b~HubM%_o#eEJE;4_vuqlt<$bYm9oAhV6&=bJKoO+Eb@W0VH}A3OUBQhK9EnRV3@?))Q$kOjnY>5l9QGdgU0*}eALEie4F_tW_h~7IwenU9NY#OhDe%rP*JhQ$fJhKYKhPI`ZGrGL5%i!k*#>gt6Yh*6sR|q5|Fo?urhzDpKy}B;4mc=u~`p&lpB`^<4ZUfs( zZOdr`>zAd~A6fM@Onu}4Z%@#-B`$W45oL_fGiM#P7ZG6{ z@{=lx3l>Yz@<$ga@!7Ju@^*PcKk~T`r4k4UZsRr1NZPX>9G3YA&%aK+5Mg!r45 zgef25`+9ISRQq5i>N|aNWwR4`ehK5(PR_3=GtMMLiC-j}pFAdM30;jHpgx)Iq|BWQ z=AX`Caaul^i}T0)^;%HphxsKERy^Ujbd@bA_)Rvv3LOh{w{6+5CZieWdRg6ELu}hxCk!Dx=!>j zz;REdavTD2sWQ+cidk=qkW~-GfiKK2r>vvC&HybJdq9~s0bSIcs)jC=#`00W zWb3j71^0@!uCTqoeJ>E=?^wEWrT`GixUC{o<$}we03jR$#9P`OeS zxC6?v8YLm?VGsfiO`skUUabb|0kXCsy@8a4G8xM=C20YE)3syjIviI*stmx@CFfO5 zfr1Lb)v^pgX}+!E^4AFQpYq?=&U|v|wKEa+Ujee70C(Vtr6C0E1Qi=7#%#Do)=(LPQN)S zr%^^bvKHm>pY5@-RCrvDRkPA%jT+PcK+HTfD-<(Y`*i7rH2>E z=G*wZMmFDi$rJ^8=E15cK2&9S^5`*_{m)9?<1?ku93B9i@CZ^FnyTI zbBV?<9%#;>xk}9zcbB!?)5UW0B=xMgBpE+=n%!yt>(h>Jr_b1l?=E3?MtYuhd{TYJ zwx?-+vnY+9!S8NW2`rAs+-4TXgWh+|gx0&c4*WL&Un%0?Njauw}5+=Z4zCS4Kv7A7OMkn5=~sh?(9GQqNO)abMDHQ8IDirPyb};Y6b+q z*~;R4RA#U{Mp#FGk=eXh2kZ7p<%XO4lm7G?c0SkxwQpAz!wl3HU^|P^VZUhUe<#HM z0q;kTne-iKf6>yh&;7g~;T@v(y_XqY8mGzhOc=krE&aPbQ479o={?lXqRcp$;%ja; zF+Ux4ufNP_^wbY7Nvn_jI{9TwNBjH{59Du@N?Qb*DER$8K2D)TW^4N1i_BVpLmdDL z;{7o~{8RW{tp^F25uPTS{oCl+0^w@ejBm4aTnF%5;V4nUIhi$xcZA)<@$|QymaZNl zLHwWewJI@=@3i!u!z4KR{UUY-yJIJdfr0<~x$cJVKif%tWrD}NV16PM86R`MW8{Un z2Ta-@2`J3w-_Pr6I$Jicy+$@)?Y4CFOA>6ZW`4m=dr$XTde0Z*;k<$H@%?#x{ujxn zQ&zXr(kl;ko)E0!MqoCKST9T>&*{XmbUcYH>IO=Ys#CqfjESOBR+(|pi!(aU*+8AJT{ra{P zUa4kl-YBooIW1NPGd9NLyHr{d{zrrN-O{1+MDd&SZ__LJbNTNtk7 z{UnO;aSYdQOP@352XxLemfrIr!}WXHSPsyuwpqIBf*DD=W$jPH_TM7GBwrL8|AF-N z7770Ra}s=t`^Ktok|@qaIjH-FdHlPCR33P@k=^TQTeWJikGFYwC);~NKHO>(e^WK{ z6~(rvbyB~u8F!_r%la6}ThoaH>u{tcePqK>6XL-xA zL7dMLr{JOpi>mu#bc$+_#O{DugLj29ePG9}>ju7_s<)s=n*0EiB*S#R4d|0M%h>o1Gj+2PETEea2&dO{ena+}0nU z{!u2I=g|KGJx{%sx6xLwhOnKlv5s3dUod#=uOf&}e#+A4Y9R0bb27Fwe{4IKIPK)I{1~{_BTe;4nKg_S{hap8M`_Wa!;T>mTYi*wS0aTkytJbL zV_G{2FUt>uJpFPPldq5m(K5r*hhKD2KdO5TCr(6>@mqtfe+cK4En|7QJ}1f3+Yj1$ zg#<@VaGn+Bi;bOyYDoIj*8fO| zf6ZiQ4QGI|rVv_tBv96PptUW7#>+JhNM(UA^`oYHpMl3Eey%n`{vYbzKE8=6dmKJ< zCr#6&g|S=I_#s=KbBOrh%wWmjUW;|p$E z6(sq}cipvJjk~TX?4nl9O2I1VLQ4^ps!-m_G)?CD+pL26=>BD#ybtJI!_`}9 z>@%|8fFR(xo0G@c6zxnd?p)ZjoRbeB2c|i5gAJFBvq-#HwDM9s) zd!ml;psE)PW4SUz-BVCw<0`*_fXBeehqkLZ|HeXFu`ev;k+s(5f6b@GaI*P*K6O3D z{Qq`X${OLzJU?=Z?)Fi^+?GeU#{Ea5QqMGywRoI(9jcD%=q?Cey#AFrMfcNDN_Uty zHNKpvL?kUo*)M(6w)$#&n4D>#cMaawN4Um0lSTI>$H>_bz1Lrwa5gjsgurJ*QZwdR z0|?D_s1aEZnlaCkIQ|-MWVy_U^6JWAMd+DE*E9Sb>l4ASwq9rZFCp;+&d->c088C? z(G7V0ipF>~6vuyAu9_@pI+pP57v~jnUv+#!d(Lr~C-eLZqcNU*Tjj~1!88N^^(4)l zo(p2v7!bS2cV^NIZI8!;WiqzQO*CFji;2di@tA1*8Hb6+ndwQ^pW#~xpBQXZj}|ds zpH_+wSfCx_E|?0!Ijl#|pn3dB?4Z9>etJfs`mTO|=&N8@3Jxjlf1tX6zjrV7VJK1* zVpDk-Xg?Z>hntx|@tCf{UFi_rYp@RW8!kZeZQJ}NAB`d8V4%G_p??!}}`j4si1Ae6_cK2JV4hhiy&%|*Q(e(=J|Gf;f|2^S%+(%uJ=*HtG<5c4_{WcmQ z`%z2Y4of#HiXGbyhXaYWgSMwd^)-@v8cMslD7H!R{PW)qOE0VW0Z829x3$<{x#~HY z-9P4)u;e+dl*|~>zv$ilt`}+C4s9Q!{w;NFKcxs>>O+y41)^J-26EAlo)Nzv7nfL* zF?#ueWy`OP@H)NohRE4)m}UIKEbBjVF9a?oV|KqveH}f8(3ZD7EbS+2zt!JJc$?m_ z*t}h}eeIk)A)sIT$N1MzjjjE`ujtyZ>GN2|xb^cip5_kdm@2y0MlO^wqoNThhsYSK zf8loO6ZFxmVQJ?-VtU=2QqgTV`ol7&B_D*A?jfleV)G@qKKL zPM5d)+ZdYLuSG|kXrTSWuvocs)V7=hJsCv)4a1t!40Ji!v1j3cW5vh{;1#b4>Ih&pAg|Cg? z+lM2P<}2EfCb~}yM=t6sdWQG|fPY#lECPqQ)3o zp^ckaj-Xf$tMoWK*;{@;cq>zg@7ZPyXQ4VbWf|)E|FEXVSzY=#BpVE{Xqf>rD!@=( z2ej=91Kk(sO=!Q&9BbdKwVy_PwW9yjsf8>iS<)s z^}kT-J5~D%*RKUMe;rDy{yhW2%L#RHIj!zTYTec}(e0-)%~c9Ocq-ASaD9SL;g|b{ zq(uAbG|TwQCcz@jJ}3nPi9NPnKZcXwb*9J0@LwAIs$bzXdKymfNk79HT=mTP>8ldj ztJAe7X)tBec#`F*u!!MA_s_sEzj6XRh;2D+cf9ln*VxNiiT~2nkE#FCjl+tNL+p33 zc@Q_t!9a<2M;(_d1hH#^S~gWtgl-yp!kd!}83k-sb#;{HeOdnq*H~bKnFU}U;Tt7^ zZ+heS#_oT7ALW~!ME+gqzq5_T45+#DeeR);?I1+f{LQxx4Au3Y^AE-F&${k6!sgf> zE{z$0=fJ7QSv}(|vx{!=xY0Xbqg6Fe@xd^`e`eyDxaM2?%v!GT`Qt_}){kVCaSf8# z1Gxl8JME(TzP_j=GSHrs&>xdS&orlmCnPV%f|Wql(19MDtPAUtl*Na}_Y=aszmG0qZ&j z;3{BI^=nZ@_>BQFmQ8|1cGfJtxnOsXDEK2?+iyI4}whV z5MJM{uG8!^)#u3Ss#6rZnKjP;ui%7+Uov7B2S)Sas3P^U4wo|@GU4`|D=U~};;*s$ z!Ggt~DT;l?uYNhxx8j#GO$=i$V!&)-Qe4|tOq_X4_19p*KED?MUj=r)3K&<%3eU_c z0KV#x4d$wR$UIDFew@n*$o$gXo|)yqnw@}Ln!nCY^=_JGKQw<$CGUGJ{gwlk*%O=J8UNIDj%M0CuZF9uUV&8*3BFd5jjHqN125>-KoXw zg)dXQY3e*zs=1b0Fdr0fatGpMQ0=geWDw$g+|~TGNpSKsi~P>VuO|HU#J(Y^CmBjw zjc^jnf9HzX-uit*5+p%!odI4a-(FAguG=>xaY;~&>yvMDr+FX3bq%_2S4{IhfXnH> z-8#*CA1=qz{H*x9^PXwm>U~2}2Z-(-28w-hM5?^`LOA!zF})VUxqK)h6@!@hFGaDF z7zhQNypzC8=@}Rhn7uV>0r#C=AD7zMij=I_YRSq_=)3lhH30={TR#x zBnDX~9$%Sy*VqYS=76Fb+oWr}1^b4iplWl?{Gs;GU)X-xfUcbt*Lc&^c8G4U3%p7m z$l}X1mQ~MpikdSy%m2&(z2DiB$I1QeVQGbaJg;Bl4eyPO$Myr`X+3@6cv|)2IeE4B z8?Bv0`W;XNY-efl0214IY)91Iat+Bd6)50F)pR6*Fw*XQKlSe2J0x)zX_q+>YZueU z@i;vH)cdc!Lz3en^~%1Z^$LN;1RJUI(NDc^>2R^9>*Ba5>%R~ePwVM#^K9?79~g7x zH)`L^dN&iKdBn)thCx#?=JA}Jw|=jxkF0Z;b~kzi&YUi5xcj0 z&q1p5l`j$9nC6{drg*vDsPtVlKIWNq0VmfYX!963Sun!Mrh_To|0T4z3*bp#_dXkwdMMKXi7{Bv*2LsbJ z8?s=Nxh55XP_WiqbC0431qMTnLs5j4i7*w%`hP})$tt=(R1`bP$yiijgPJ314DO4? zXu>uDo}(6Ky}J~kdJ_Y}8J6{z8aQ%>Sy~J=-vS7wCa76}Kq$p_IvEfI5Z=v%n%1bIwq;-aoub$?^!VNcUS?Jd-&d*lX4JLx z!qiF?KlbHOsTo1_jR=I# z6UtZ4j*W{^$5m&eFgBg1e6mAP><_^C8OwE0?#UneFFpS?TPiSiPbwe7&|wAg~&11|M44P$rGhHw|2Y{mLRH>U|Dlx zTUff^2=aPGvA39EQ9&xyJi&nQVnX{JrLp#RYwg=a_a;29ObD#j<}e*<91IA*PpIF^ z#p>UJ?Pryb9LE*m{!EaU(Q}Ug9_zlSB00_}#h&RjKPD)Y#%u11j+~>ex+^NJLr^Uq zSA^AxV=a&M^@2K9XQt?W9*=b_7ifQIY$m2*OlwsMb?fHF>TXi&)>%cj8`~G^m|KCy zbmxvJZ6X4B8irjRs|V5FuG5WmjyhJySBfw%p+DxjSbz6v^KBK~_Yyxckn>f%-eQE4 z7`Gk@iEYIBe&x~cD4OxMp|z{%RVebC6sTKr%S18tt;YMxF8+Ot8^ zZPa{|x-<7xe)ilXDsK?q=@P6XidS-SivilkzCnFQv>dp<|3;De)ffYL zEm3Kgk@_igAex_aXC@a|d{m*iPuVPg(Hmij*hee~;x(MSeqjv$UI2kJl>5rB-~tsU znCfAmy^MkON`{s_OmcqG+|##sqf$uSd+sB;EC>ih_slP79$+!5w12L~NxbtLMcSqA zv0}YrXEKdHfc1}&d+KJf>-IxYDTttr?jzN?=YZ&T00cbOaPqix2q2*M1glmFaX~^C3_O;!}k=AXhE~*?BW~E2o33*9&5~joyj#u{g~#B;LV(yf)GJKNsvt z*DmDbriGmBL3EA4vZ{rFcCu!Sg@6{fhU8(%1{uqK@k$7g^Jjo|JZ3ycU%nBRL?g&t zRB6YuT`c6}pBdp~`@t0NOR1t8+u>gxj7lEkT;E|f%fBmCbQd0pN@5|%Tv#FJ*y03` zzg6$Fx2o|)^!xEy3#iS1cp{Da!_4MnCvbsMtTP)xfVrGp+d%JS0msQbNzm4}m)zm= z_V$6d^h-q&iS1_dKX-)2Tg3Y5gLg)yS_Jd)ckdCBn>&-l!L>K%lJ7IPKmk~*KSm%- zJ*VTLe}cF7?idd(Ij8Dd>iYZLIl4A!u=Gt#h^fzj@c6%nq}~EfZp{R_cN{0TW`o>< zj71JrH;>KNzqVf(FCF}lPve&-=DTvt<>bXiI9Yoz#XGqnD&2wMT1)p@myHtLD-K2_ zaV(v$;j=oJhG`s(x>2Hg!nw!=aWLLeVfrc|m)03oZ=-ty1`>zh9J%vCbH{0Ztd@qT zbmv$uAhY0aPKO$&0fgyC$hn9zIac%4BDnxvcY^5t$q_{oBgzbn2ViL|im$2vq3T0S{D@rV2yAbUoQ=zLuj7I{ z)Tdd4KL%rbu5HIWPA<8LlmERjO3u4mGC7$`g|@fHaslGInF2zudJnNdQHZT%1u;|W z=kS#HvuKY6gh*&edWqzA%yspR_`F+P;Xb;rh3V63fJH51Ir-O*aE&?d*UrTKK3o-* zD$<~-fQ9NFEbsL5J&Ey_<;Q5)cUD~o)Eu<4&yh18_W`W8WODM3s;Go{0k7$+658p| zwIiwR^k&fW&NB?OwT|WFQm~P84H0EGltTPjp#!oTn$@#H>T_!IzY-dfY9HYmPvi9; zME6^YVy{Ssn$~lQFs~{q9bmDIWDeu)!!{d`n0j6J8dV>?A#AU5fxQuB z`gTRJze4mMtBd9=q5HP}J}M6ef52}dmYY02KcY5Y)OJB5^p1HzizBM13-LNmZd}O8 zH>h;+b{c%L7Hxi z7?@#d|Htzs#ShVMY}5ui!e-O_nsey>H>2L4#&hy}0HNnnnyV3#XzXRYZeZJ_a##^G zS@6%OBK3r6PSd`TSfJU2pMR>-{pC?bST>5nedkzu{(aY#T;LZBo&TQCnsfiH>Jhlj zKSdRZlVfdSd8D;FsgKIZo=ZW7u+n}&^%FWw&aTJ!zYY!2+@JR5+_#CG2qemh*JE;m z^-sGg7I!@h+H{@!$0k%Aar1Jq!< z7uRzxi%J*6-8Tkk`in~A&eMvZ!Dhj*ol=UcGRu8f9#xK2{r#`x0&g+U6da)UneI8P zNcyp09_UdNJEmXlo0>b?b>L$6X-TZ^_tg8e%!uFm>BY!*hDGZ7&5pzoI!E#h8C05O z{qm(C=RFa>ezy|;XzI(lKcYxINucu8m^fZtcvwB#Wr5`0KEi@)Imt;5avxdy4X$O+ z%<*B~{beR6zkNcH>JcY1YbzSrwOr$262HsoF9*ZMN?@vtI&rJieHoeNUoByg8eUlH{gz~H^mcUX(t z3;uH~a!vX@iFMY7bu7F#y!N{$7rzn_EX>{Jj$w zUsRPRB&N^k$HG$4FG;Ma_Km0MIZGWYx-pMnz9>JL>V++--ZxH1q~3&lc-NkZTr_qN zwplPeX}%cWuLzU*$|$|Z!knMcY=o(RKxoc{smB=* z=AVv89VXG;G9k@N(A%p>SFzlz-U89xSIY&Qj?Z(Ku*}^Y1Hu)jBT{Qhd|$s%`)W<6y77YmC9{&j z3kFzJX@HDU01}7Bd0LfUC)2#GX4=Mr(=q>#ZgMx6o!>kPruH%*G+AJgbC;vRak64& z!AVrZArR8>Tw3D$zglghBVBa=OHu4~$*`ytY}J=V6~UnPS!og7xGa{>QZg)BpDMch zo`k^BN4Q4Et{DwS*<>GXlkTq@{S{wCrK4AK#D?vAk_%v)dEiupd38B z{R}(^X8q0ri*m@>>Vq?b2ugA=UXx+by8zYqD2njWsfgqp6+foIQ|fw{PUjx;#wFyQ zlV@h38h55rJ@-7Q%I}VdB8U%-%_M##=`gj21wlqR^GjJ4i0Mx|gxDHe?IN!_V5uX6=mQxPL}-JTnjdWMza!&j^K73XmB&vT>XzGeYy zuf}@hU=>nxve6u9&*I<1O7Y?3c_ilK8y^ixfS~xHQxR$XsWdOf8HRJ4ibEz%bpHvj zk0@t;<<6N6fS=L28Z zZv4=mCVpleZUHRl*8Q8Kx%v=m&CJSIYM|?EE z)soH0=XQ|%r;ES@nLYPH0L%6bJ&H7lWz@Y~zynY+XoN-0*)S6@O@Y1If$<**}#G@%>s)KA*czywD_Ugm!8R8`v}*#4$+(h zT6>t6U&<5R^zK!@|Ly}+wgL<7(SZnw@vn`gH&1lq@k}~(;a#e?Pf@)5O;PNQWLSi4 zz)i!7@ZCTHEP0~)V>JiWVK(32Vx+lc-`+*n|L-D-uxSj9@dIa-HgdNF#IEA8QAs?b z6qgy{6X!{d#3Rie$?xKD%LS+` zg%Md=r^-?h!K^(bmcD_+-*zgBonxSF1n23Dw=k9Sp;YiW)42eXu8Uc!#am>cEwbia z-+F{;6gHE+&MT&PU-~d+7iqB+wYpk-M07KFO992{--S1Ww*U~)zkjH2k;E;&a4h7z z;Rn8(e&BoR4}8BEtN?8QYVHw}?wf&r>#5OwGhL)yD*YxR-8VIti9_upvgS>nwid*n zgC?o=qQU=jBYdLmB|HzJo5;XjjF$yY?whCjRh4QnWb*unt49^>m_zo`$vvK>hZKpK zg!O@}>P-j)7>G!{2GQN)9!=NF?W4Vy4ybZ)l<3Z)aZgKWDXYIcNpvsTPxoN4zVOw_h*XzE?;vV@r4Pi*mm^qSyv&e0V`pZ7{K%ZJ zMD3X|TFhnFco5yQ4ypD&140Rw)hq-KlfJElpZkoWd-MLNw3qJP6TcbNPvIhb^}%-S z{(Xyj|0A{r8C=@^#9Lx_U`Fyj$!yXE_InSTlo(pd%zoX zkM?36^^=pTZld}ERZ%?CJ18^a@f9%Y^6Nnt6!cXy3c*C#?Zw2 z|4AZ?NBYC~tVApJ?vF|bh)e@NwdZol zej}cXg9l^s9IfRVdp9sdKAo8caUshJXuHfW5i{K&T{lSrIv_d8TuSG@ zH)f0fr#{}qS*1g@B5*7)!DbeVmTGFo2;qu3C2@xc`=FCj@PnE zBaQnue`%D&wD2G_Ie6b43j=jgWhB>~mcN8ag-@JZu@{eZ9B_dGV96P| zLyhNLZUC>7BmU~dw+`b7+jIr9N7eKu!6%O46fZ#Y^F&T=GS@g#KuBeQ_*e8Kfp8fE zLIE%}Ey*Ah>|<(LjP%Y;3*9p#_ZSN5%{2}a2nCOuYg+JM(OlzH6v2bUE(d_j8R2zk z%kYB0c+cRz$7j^Eq=4`mZaY7tCWza1WYloDZcYaEbx5o`6M3;+Q!pu`M#SYV%cx<7 zFH)|J^?rfZm4xrz7x@O)gZC4>W-$rhH-oqHV&6Xk?>~tzX2N$9elHMPZrm5#Uxh%+UlY8-s(1NnbU8FM?*&EaE?{80o z&8Gjvug7=}Qy5PEW(vqD*mhM6zU`@;Y`UD2A7`Kqn9^=64^MyAoI4`R6V7n(JZyS@ zNII?Vr{TFc!zTF)-e+olW`x(BNgz~ghMFJ)g8c+NcNxKDvBBH2G{f65UUYNnyi}^T z?cNg+5|3Flh+RDsK|Vi`$~Dh_6p5Jv-qN6>|5q#sNIy4fdu0!9UA6Dt z4Rd`jEzR)mnkc&8{wykWk~Cx7cpVzYczfnB-s==a5~E7-=}S48#wE~V^5Atj zhpZR;f7JcI2#xt2L=gD;B4;hJd3ZDKZfZ;1-FM{D?(3gX?Zfk|k?MFV7I&{AW=TL$BgPrpAfo{buUp@^HeK zS}&(#diDF*`it$*`w_Igi`28br@(u`J-??&ykx?wEkzKmL7;zTY9dPwlDo2C?h$_lHO>qiO0Lof{KzIz@EjH6?E? z*I2QRsqt9cLyQT8zawr|vlVK34Is1_xmg7qjT3N&fwmSiwn1$DDGUg8<@lNDpCc;* z7&xD31Ro%=3%9vmQG`|=!^!lYR}}lYa_Yx(S;82~rqZ*ERoK%YOT$e&#e=C5X#a5g1{*c6_ zK(RRypCvRt)BO>pt)jtPBN{>YmIa~WGp5F41OeLu6;`O>j3897OwD>Ey6e7Egj?2f zji=dc|GHh%`wNXAocS&RzG6D&vERqeoEBr++F-76U^!zH-4&0SYl0C)s7N-{AVhtW zE5>Dz-?2_pk(W^uL?9r8=&mTpsPPOdLdBEjn)NL8H?6odqXzKrCed9nC8Nd@R)mU) z88vlZE2Pe6ieksVVVw|<8|(bIA57!8jep~JBi)PmHJkn6Ur~00Pf_f`_e$F#Wb6MG zgVz^p!yyFyec#~q!>ZctHh=PaLsHKSPPPKb%duUmC_)ff$=USTAH7#kZ3A0BzWI^jt}O zbFAbJF4%&K(vH6s01TYAH|Jg`OVwPVtj#~;SsG{K^=D&oMRz<)<9*;~|FdeGEwz0T zCvQ8AhctUTjdyp|cG|{6&xXl)iI$6ZkB^qa&mkWzi=RLAg{8_u8UtawpTv%8!_Q6- zyAJLSOTl5Kn8xVL_P6*+jJY=ajDPRmP43MXKj`A*9j}H*auLqkPGcT?H>3z27mdMI zzCDb2Yx;weIr$}B+1YB@-^+^NnM`9c%-9~5Kvt$dcqJ!Gy0TN%vX`G%1UzPp*UPqt zrItZu`m$Ua-vQ4_A2~D1@_TlKrQkUl6K|R?EP2k+c$B2vWO_!2f4gNzSQ5|Daz(zd z5x(-fT%UHFu<-Oa( zsvn%){|SM`THRqFxrvFr^`=DQA6@Y*waqx)JR6_=;aE9Dr<^obp6RFYVArGU>N^<_ z=-O`ezqXUaJS(Q}cK@MQ)$xDUoQq}8PGp;}l|8dFES*(zeH^(UCJ=I+W?8a-r}=?v zeulj)>%aEzVX43XHNb$7HR5NOb%CEDCcKn>eQ+CL4PgLI1nc!H5LwQ^?xg= z`~c9NrRFseU!~=OQdl~w-cP{vZ1+(d;%A!=(+-sv13nrDmfU>+v1{UP8e5Uxt+$Wl zjk@<05+{(%^EQ><&L%hK_9fiW#`E(x%xeI}-*3}s)arj+#cj`L&AEF2zeJy~(=6+H zZ&O%mftU}KR+dp=d`RWxvh86>i@k!!e*Rz7f4TM%#!B*RJ;f}VtW_ou%SCiw~Rx=Q0lWfQ)~y4%d>RJp_VKi@{_uzMSowfnZwer-}%x>&x0Sgu$qqwm^I+avkE zx6?N9bH(-;ec!&F##hD9w{4Hf^jo%vr8@Im-!V4Vf0WJff5ndRQ$HW-1F%NrIp>ff zh+}DtP(1DyS(#pEp5vqVr*_)t*GSw_607sDO510Wn{#*3I9O!uPRx}ns&@{FO_rzX z_Y_8yw?2kyT!nQwE+wRCxV`b)Ya+0Eu zI)ChsNY05D)_Gs8Q{^?A2XS~=h@}VoLRHxIVWe2c3y8+_c6aLfpOf>+2(M*uu;!&k;PQd(S^3EeW!zX zl%Bu!k>I|SH#r2MUM1PloK%%ZUcI)1Tln2S6sUOK0`*H6i0FY&nxXs|sb9W+8%3iP zB0p^zKTCn3x=-=yFMoZ@J5fdm^*p=YWDBox1n)&a{kEGc-5W{P>-P8nB{~kb@ELHM zuv9$8o2sz8SRhXzBSG3iyxG!7|64tN1mR;emvR8%wg;j7rX9j;g)8M|VWZ_8wj`Od zW7Vif6AyK_k*5MlXJhd-wwgLh9rR9x9Y`37;T~=A9X5S=SSv8~7f+}P+>d_qTAG+7 zN;IV{s**U5^2QMoyB2a>vzfZpVD`4UI#GVxaqq-e=ZaPnQS-e-MZVS zCb~sX4c-W{u4x@W_Jo!&7rKj(qOUm-Ib^CJ?I)50v?r4~%A08cPjkigmG_Dqeamw; z2Q8c#<{J5f8fy4{D^q+5=j0YrOc#8%1o_~$LD8A&SJN&MiFncCWEJ@`-a?<5zrXcK zf926<#dG{j)3KY0yPh>V>@2+DIYmIf^V@N|2O&1mO3D+zA0eIHqNy(z+PgRTnZ(P| zm4;WC;(#w#t7{`}q^G5lhuG@4&omicxG?I2oI*zO!lIQ}Z4SQQw!2Cxaw&Z@czt5q zqPx~CQ?)wiuaSo%!Iu*go-h$drMk)2V|*AEZl4z_HM)$m+?9DrgH|rBhCcgDte%c8 zOm<$=((mb}1@j*iP^#)bGJFyK#&$?!!`4w3)atJM=v#02uSqUh^*Km~_xBA8443&n z-+ZCorY7)4MgQi|pn!A}j>h+8-Sj<>4gXU)r4?Y~xbTVW{=K|u%((c)M4U+hCcv}m z(3?B@Q36j3R2;a@@Nsa+gtDDUNY%ZQ(L_z9oN2mUY~ZPN9N_D3blTmYLh=Q)t>&Ps zL26F)!tY^CyPMc?CvU?f<~;tkk2ahORI>(^%T#sJMfMT<+$sBeMPH2cOWTSkTA(eZFT3bqng#>a7J`HdMRQ6*kwrLD##WXqWbG*XKKIvY|82 zlDpInm+PJ${xm9`)!xq%R%_&4RupO1qZI1j%DeE@-%$IYwjqA+4IPLH_fs)D6intwE%NiLuwiN=aHv^lJROL&iBsmfCHO%L-IV{__I0MQfw8 zk-qC%i{7{8-WlJVOwcWn;1+#L(sxf02M zb5D|i*Y?RLxHdtlKX+fW2y<7A;@3Kcox%0P8{yY!tMB9aHNYnC&85HRaOh-abxrcR z5{73If&99CHLr{&O2j{R+U2)goEN47O|j12-FMJ$FgN~Ur$PI}MAVVxP;a;Zx_3R& z?QLY!cdc@*IL9}q?>N|z3ruf1{;9qmabtF}sITE}HSW0#zgN%Tg`L;uBsn;+0rTph zC`1y^Ee}nn^v2WZs)Pp(xPjfjAm~RFV5MfQu?Lbu+0R}e<<1tJUzEl+;Wj)9=<}RL zXM3+`-etVN&wJRc2{K{nr=|Y12<(01H$Ix^#Y{AmCHp68z`Dzmv+(<1V`#z04IL{z zAA!-T8~z00Cx?r(c^4r{KuQgwq)j( z#uKekdV!gCYnxZx2j--AJ@v*G1t#uGo@DP4l0~9_Qv1}V2?T2b?(PS!y)DkA{e|(X zEqpd)FqR$79N#-_@kFryO4a(a!DB(gz`P0Hu7n zrFD>cr)+eLM(hFSu0EYBI*iMDbd zYJe}D>)ssI#<}rj$X3LSl!q1-cOd$7%=ZOw=yovX;5QSajQ-&VPSM3PmjKP_^G!O7 zv)rtx8ew013;W{wdaOWQ&>Z8$pnsmVXc@@ZXU5jgK*qKBp!CSvcKCuP!K+kfJ zc;r-v{+u6K$!61L$!W}B8}!#eTM;sRafMGyT8o6sLFq{JI@)}tEqqmUk7s);&%P3K zO5b+3jZ7kYA**`1#&6-rSN0a;d5NQ zOZ1$HF8^b4_Sj^%`K^^@6lN1N+rCNoP#kH@wE{U{_LWZtVJyr`cFVQVUH3I)_|NIa z`)3gP`rqpG8~^OX_^w6oy!1CFSb~w59Ja%|`2}WE9F@l=$cY7oH?b;i;UZ>6W@tw4(Am z=;s7azPvb7h$!KG3m?6YQT8C6Br4$1x-t=pw+KQgc$(jc7N2b<40VXMgKRH`^)~Ax zT-tZpP-({z*$*wmmk~}*`r|OEK`-AkW9S0F_>iu=Wr71RK5UqMe+-YK&3y%M_R&7( zq_XH`dt>p{w2iF7=tbFG#aFc6@7@g0(1Pq@?Pc&YcCU2IjLH>bpPWWz29CgR7M0fG zL>zstuIzYy(k5i-nPvMDExV_Mzj!Mklfo%wtv2N(-^VM_;|-iDc)kFgd1l)%EY4;8 zVOP>VWkjW>c*B6zH)Ad*zo(&_j{S^$se0M9I_C~^%!KB{Sp4lgRJieCx#fz-;Pw%? zU0(rZ;O;7nDj7(Q_$}6WTy{My1mH_%CFM8w-J9kzl#1g2>5UqVF>z)t3?;~ z{x(}SKcBqH-2XvW=vf@``z$5)Z?LbgJy*$wvtj~E>KL^pQmS_*gv$%uh%**_V$~1J z!?dzg=clvm<}W6A>=k$4daBt->r19oH(*82-De_Y@aJ~0^03SaxR?Z3$2T{n7GobRGPc>#sWCb;JbVjmj>+^8RvPzPpA3XV%Kg0?Mwb=BFfC zQWkqs-82#zvAOV}cN13>TVCm@=m`cj;4ZgFryIq#mt#;(mcrQl1chKj9aYrvnE9Zm zqQL;v1%5JskVO@{V8^RPpUI%xTzYb3zxW^b$I#gvug+eBr;4JOA`cvmeY~A4#_!1K z>VW4!iz}1df!Xgl!k3_1(>&XCjwq0~A7FEh0ppnI)lheaK;6xGJ8T9GXl$EpCd{Nn zT^V(JF}^nuW%tY3LM9UGO)4gGZ_87Ld{ab%xk}J}ee2Z__A1n5ZO1Mlhb)$n%&FBb zCb(X&>~Y0o(wfd-AO1Wtv)_GtJv>kmyX5m!(00>th~?DWJ9_;xRaNvZs@Zw z=5=M1RKk)^V6(r4aDtL^p!sUwmZ$0W%6V^LNsrCff)1PdLROnZ?2T|{Av+6+5f<+r z@3e4NN%CLuQRYGcn^Zz>o3bCy2G|pq(ncrd=cCUb@baIuXgS)f5GnkKF6{V8y~)JG z-nI&RU$>oPQe8CoP+<6z&6@vq-l)IZ@pi}I!=3BO95KkCW;3|aY`~-AdjZ^Ebh35T zYe`-7IwS|)Vf1PTcS*@!;3Q5QLbfi-y1G19KEC8Y@bbZbFz5`z{5^Fi! zk+GZR-?);vK?!ucT+uc^TQS5xr;8YM#;jff5>cz=>6^qKClR;myG$6&S2TBB5eF@j zEXF#3hTz#GBQlTsa5o+^xo(bQKUrsiLUBJQ*$zTaSuFdgafR)4y-A|Ik3I=m*7%Ua z-%h`XgGZ;m=l68WQ{wNgFM5fW#(Uu%lz+wf0PcvU8znhXDTJj0r4H(TcHi>j1t{K_ zVlQp@fnZ^YJY6cTZa|f_tE5r97ZtD6FIPk-w@}CGoE<2TGO}`W@hnnlerwP9vaxyRQR!*XH`swrXhMEFbC0|Hxxm? zK)a7ugVlOqM6kEY*Cqj)f7B7TMb)1nXIF{t4!7PD!V(vkTNhK*de$MKMK+9WWgAnLdb>J&8BZV&Ymh=NO-X9XJV_Tu4}KUN2a%{> z!;_~7^U~#4yc~#b*N>^?Rn^9G5wdn3zo*3izJv@4q)7omcc-moN2kY5Pw2)X!Qwxqb2|;%2Z3)j^J@&ljEH zt*K~(I=S3d75OT|2)URT%=_Y(c5+|rCN$++VN6V=r5+&%1~v~!zB3o?AACSc*U86% z=1PCF(iGEu3}O0Bs>0-6wSD+=Y-CesYQ)K=nyZsfxcoj|ldSOW)s~h9lkuiKuE{AVER+q=gSi>Lw(lz$mXPnzyomu=g z+gAl{dW!K?(wdV~cb#-h$)N47OFe@(FDrIKnLFL*B%()T&?jSjCin+#;&U#XI3hjP33E+5NYb9ZK<|4;&^t%SuaYZ_Z0*tD1VWn#(U&=SJz1 z%1+$>f~A}xCgdyI`asxMr8Lw4V6ttDe=uNayhj~A;%I!Ne`z#$G=e%Y3gGjC1$b4I zR#jI9j(4p-ewGQW9pfwiT1)oZf0SDUlGM9n zusE)1L>Si{-y2^nd~Su;5zn1>Xbg+e8TE@hfi19!a;kqK2K`& zmqD#auBEEvGYh2ed|jh*+a{XEv&H9uRR*Tvz?Lf%H^o8DC)p7$2&M;H+R9mQD{yw> z$&zV43>tiTcGUhPIUD1WI(EPCAaN~-DQr+~t(jwE!LPaL0v*$vsA9Gl_gLz5^ECgF z_nqX%f+YT{yD;%*3T6^<=d$C|U+zr~|FD65tl0pi=DFXS{RqbhDbe1~w$++keWkpC zc>O8pJEZp${=U@raTT*N!`5y?az#^eBkBBe-|GYB;G);H_Xlq35#Wm0vBUM{hqi5u z;0m*C&NhO3FmQcm-3b9@RhXA(B-Rs*Ai2ny<581WRlr|g5^Znkqd_yFsxS-66Kq*->*6;RNhk~{s;6}0uo**;zL z*AwKHji^6c%+wQP?_fwHLeG(l>WlK{UGK(bL3RQtE!J#m#M?x!GE$#(5E(o;%3xfz zTZi#tozAo_>eWtJ`eRi4vcDIZQ7G+4=SW{QB^_P66zNQYctn+yFd2=l* zTzdn%Q#@0DnbjqUcvMwSMZ2+9p|B(7Z8!ZzCT#rqDOhIaOFud{j2a%sXgbCeJfyNV z=Pggpw?iu3mMYrvNOf)QS`I4`V@1BjxS+1Gvk)wh($||`Qz)19Uey3O_E2_jy&oOh z`;4e9mHIU~R*?FI_1N`Xh5hvFMO9eJ42Z;34YM-zZf$N4K+acyp=nFKThe+Mq?ZSh zZcDtgIQ@L%Bxik(uMoq-r+iW$05Xk2z9ARg4yIX7C3n>)4x)p<#j$E#Ra~$hBd57E zC|`+OA4CV5bDa00h1SE~CaSCrqEG2ZT%}`b$5Q!TlUdg+>^LT24}KiI7JbyQr)Ybh zJe6;tT11c6PSE16t0}eLI&JCG-Jb5Dxxd-n7p1%hGOs~HF9(G~T*p#1Uu#&`h`1$; za2$V?j-(#rQ2!#-O}vwEJ9Huucw{}sN5fG!PcJw?ypzIS&-m|$ULrp^I{m16(bA!h2p@_lkQLW@4oUr zow}#EH4_*tox$NkJRnKN(m8nVD?+Re)Pi}1Ke^qweKhoCn0i}-GDF@jy|HXK$*UqX)O3k+gK4Mm1QoZS1 z!T6js9;WPJ>Mvn{0?gGm6rTMTb9kZ;F2OWj-_({wTU{+1eL8Led2E+1ZeLZJB0&vq z_!I_kNRyPwuKobu!O3KTq@d`uq~Le%Kca=*!;1)=Hk+HkzI`6^UnTf)sY$@`qH5e< z@8MRm_*3sTkcHtU4VT6F^#Rv~A@jmGJ>yQK?~4q!Frllc!I!GoodoM9D!%{I0OPaTDmKtkKFFGBTqIg#?AAy&gkY^2Eg>pvd z6^#LaCzLHh*!MmiHBI^FfF`sLRWlCuD;4KKMYC}ib_y%l_`%w))wJZL1g?Q0qk=+( zYV#W>fj_qd{G=cg(p9UW6Y>{@xu0nWvR}vgZJ2C#`OioG>U@+-z~ty8EPry)nSZm( zgGT{o-h)<7UC(ra+>~cN6F>Pjzs;b{`npRU#{0dCRxRhp0_D4EmLI7MhreIP_5@aQ z`>vRdb6k1Jhi{4BOzEgUc=q*?|1|-ggE)?eROplY_waNdJ9#fxdv-4Gbi&4&ORPAl zafWLCaN|FA8p^#{IDpw##k`VZsEwcR<9OO1jmi-!f521LjT+E?@FcK;iN8ihUmQF* z38jyZ<_f1};4H;Nhh0Bv|#@;+@)^aUhUU4FOpM72nHxySUWjsyf$Qtx0 zBITTEDG&m_uz1{>DEd2|&;|E3eoC=8=U&~TdyI8A_Mw3`i8oT=TP43H(^{5QTEsNG zP17>E4{@x+@XW$kn#>z!b)a)M2)m+8;hgNRNi0P)IL&#;@09{5x+00YDWB3Y@9QTP zIBCt+5v@nLjk<>xeYQY?#6km1sL;G|!3ab$C?O_M8(KDl$}Qxjy?;C*9Jp6GyK%v~ zQ!Vt(%-c=5^nskZQsT`kmb`h7w8s%{j8Y@Z?$%_RbC&!nk6Yhi*XURK@#NLR=1t#9 z@;1Yc<-sQk=dqH5LXJ*jn#(GS6WU81{N)ce_}ypw7u7#K`AOGn zT&{WZ8KUF#?k9AfFmXZvI@>>wtbt$jfih;-Sfyo$0V_AJAK*XGy>h&_u5>H0)0G`p zmnbW$>cj!_js^T-q9`0T544^q2&nyS0Z zoROVW>N>%3JAJUgQv;Kzml2vdZ5g1y%a$g+*7|LfmuGhK?xR%TuLBZ?R3Z^jowhJQ z?~YMN=3x6Lr-!`A_Zow&#+R0rmL@$rM$sk++MMpi@wx@t9k%jrfv4N8;93!xfO9`I z9}k~?N;PeA`cJ^A>b$!u&xoj3p0O%V?HOLb-!)tL+_%BjxhKZoMg!s_96pt8-6{q~GGGRS~C-%&W&z&_M!x(^S{?NP1|Tj|+3qh<5EHaO7t%J`_%9Eq?jyExp_B-vx^N|Q!DP1nfP|cj>;S8QhLqe@k zHj9njzLS0nlio!hqj`Sx?|A7gW89dz#K*?kLM0ZDdHn#Z#C@K{9XG_Q5$9tdCB2N+ zxSx?8G~1{939?(L@%X1p{dklzESL8g4H9WyqmUsF+IBPR;2jP{_)uv+L@^l=(ybQK92 z94We=V(hE%@79F3?fzhJMb4p+3P&_>L(k-9qO@Use$qnCyHuz-cGl4_+NY<;vg%ok za9F*;S1l3DF7`?!NPw{)CXbCZ@*r9+7hk8R?S5c-W2WuiN1BQjV13I7W}9mEP1}`5 zn_|YHD2ofj$9WJ2&a;bWk$DgyhIRs1kt}l-q%OxKW`_Kl02Km3o;@na~eNHRqm}d zXh!j!7dG>--p?qJ2wky9udau)WEvhk5mU9MfDq|b2RGvX4w;&id#gzB%5_+&a z)$7>~*oYsqtbENj952(H0d?>7LqFi-f$exDnlb)%)`MPa0(BOpl8Vl;lR!KJt9a8# zVFbRsuWQNPl;T4cNU2n1NAWu#XS$1QF-H7O?IKrRx?_L@B3W7V>ZTw4VFh|s+b~+phM>WS7@W)(IWD6P0aDcjV znsO7E)*;(~(+_Cch2VbYFh~Cw*|>o+|BPOn0`Vd1Y17G++|**_o3IvDkw(cNm_>ts`6 zYO&v&Fq0H?(CJmJ9o+*E^!>GD(y7-RB3JCLk}vwq3;B&4S^D=o|6K=yxWj+OA4q5s zxd~$+QN8vf4CW5Q_N*#*bih_T2NB4r$&+#&W=8}ndURLWc?Wetx7UjeKtB=7Y#i!1 zg=147ye@rDe8+UTD#Kg)^_a=j?|9uogb$A{b)C&>OnFG);fGrH;9pr!KS$GZ>D<@a zdzbshiGz!fo{d3GY3eNT>6c_2y)iAG0+_*>F0Sc@sO*^KF;>66 z)f$oLaq0%#JO=8?I@0$z>69lx)BolbFJ`!%qxNBO*2`*t)qTj;y+pSauUFLHrxG(7 zW2vhs5TLj;8V#P`Exu7TwBUGd$hh^3p4Pd`#{#X}yG)KJ{O{7!9G^5_IT2)E<*aFa!jpt8fgsTp#BIi=j1j`G~ z(t9(JkS1F#IUwFnsief`-=%g*_sODc{LgZV;^z&IH`Jzr>OUe$+D!gw(K-f zo1M7x0_G0!ygr}1YfLRn5DP7UY=_JY=W)!UAXAdsinjm@dXtABX7+C#7v5z>IBhFN z9VXlP#|*IEwJTfd)q*))RfVkDeYqa>qt>0AhdB6lcEgmDuI39iLCw%#K18=4>iq7~ z8Xc;Ntu+_Ue{)(xy8W<4thut0Cla%c>A6cjuAU;WY`UjUn^bNP?FotIFZJ_#oA4 zR~u%E70z#(KQ=-p3tBpXymOlfw~{Ww7l3`*xSTEQc1#-wiXxDRDio+N)Jd|Qu~((D zyMA4-S|`mjgQIPs()Ek9`x0*{dQ?acLnke9!>|_GvOhij=eqIXbq?#d5v4@Y1X47O z(}=u8P>Y@f%eRTnC-afDLF78DT9%1gz-b@BjOnlMdu9qYukt>{4<>K;1zOt}n*K;O z$;z(2PmWb$Oj{be&>@g$A@5{C zY9uS7(!4c)0^3Mj7p2Pv^=R)u*s)Hq#G~L0{9cg{pyuzouWRFL z0n@~9RNNaF->K$2*!Vf2*7eCoNj1N6iV>_^qCZ7EGV$vEznLUpE9ypcVHJD+LS`rbMWMoXUiD2nskZKjZ zM|N&Mfpvk3@fJA)#n>#coMG#t57Zr*OL0B%(B0~(lZ&&#$AsA6>)YsHcBMu;f^C+R zw$eoD(`=Zuf8n57X_V_z%dqU>mY%@$2n_USpr_5l%fBq5vYP^Cu|m zT2jt~bF$_WW*tqg{Ye~^^hhssESIP=`WrH+Iml{W_+{_y1Ngl`KK2?XLZ)g`4}>Hc zuNh;LYgZ76@RFg)%WO5sOD|_5+)XdCb;D>+wX0t7hA^6Xz%#~n-FfM{Un>ov}!WnR!g5ye{jBIMu6fwBIfF; z*g%Ly3lVn_Pb{{iG|#1`&6X*tUCC8a3ZrZnHi$S4^w$cN%bNnjJRf z*1eQP_Zj+c#tNS;^KfmG+V}r4RA^t*&T$OkmyEWre@SUq@o7-gP|~zXVL)vR(=}7= zSS0MS8v~9`r?VW3Hn8I%RSB-2#}wDUf=kc}a-B%4g6EEPw=ZE8f9X<&QWGuru;h`3 zW}ocv{?8|FzAxTNcQB6ayQIAPBn^w7tvd#c?Jryoic1^GFr?4AA(K;Q;poof*;(Kr zbaLO|&Nimw+=stt7m0bRF)8v3b&iys*f+S?XWG56uUXpmZf|v3@yT}SbNdX`WScT? z_qZ;>EA3ls#Bf*bR%rSSH5*0yXL&hAWkTRHMbf?=fzDL9ELBSC6Hz2W<*il_&~=+& z)!^YKZo5QI8B;sS6HB>R8AH;C0&LG$W=)E%bR$7=vhp~r43somcr%rpIDw}2e5lRKyp$ljPk5IXkK97;vVec( zWcB*sr=Yr}?WMjp37Qu}!w4zNo~GXg*Lje`Uh^$4VxOvvM}dNI!2i{O!F0>#k5l!* zPn0{~PoxBfUOQ8qMyyowJxc`}^1rTlI*Cz@@EX^%Sf&ik*$v#Cm6THtBKB-GC4FNL zhG(k#_$kEPwSGC$$4e_+$y)@MLx44V(SA7Z>&b13zgfYj+EIkcn5@uH zZW{ll+7R$l`S3ML-yrt~-|EFor8RN2^X$AFV(!ZP&4>w}f5k#&h*@k(v;*cCW+fl!?T@B5aNg_xgLoCdGUu-I0r`kE^@$!RGCnXDn_!9Zj%Gnx zHuePaBoO#HgDB_zkXalS&`(^t%GhuPy$xG3kG-^_$)B6M+*4hCtGbiAPZaU|Z*~zL zX%d^e93hXW^MNhVbHOcU4RsFpaB))?y`vk2N#b3wglj9AY0Y8S&{RRgKxb+v+ug0- z7xTGv47-yZ+wf8;QFe}go_^*>LH5iohdB~4c!OtsvTNg2k6HGXgAd*05PJ?UK%>s^ z>U$BA#<0edOxpI?H61+g2K<36*qc`1tc+MQk+0~szGaOP?P^%KqEct))cyKcSK^10 zPwRJpMwlJw<+h_;Ta?X-me5g;LzRqcsXrq_- zw%!l7iok~sk4UyHz<*93x>TC14hS}_geqwyLcf)JIt&oqxzRK=JRPWP$Cn;5HjoHO zVa`sW%Hr+BzpcMJpGEV$9P<$8fjAb(UoY4hUK@Q#Eh~ySQ~TQ#YSMIEJ8Uz$WY#3& zv~FNZ*b6@So&afht0@4HDPFVMdkrc%{pdq?0Wl?(>2G{%UJ2hbb9nUe6d&tGh9L`t8%WdXK4yvHGVYKC}`&Oq}*yRl#?Q$!j7V8ku(Y z81h$CMtxS&sjw2)Ie&IDtovUc!3mvwRe|e^C~Dy3WT8B`<1I&dMWD8TUgTR^i4h1@ zHg{Fv-Qr}h=K0eN_MhYGT0 zZf2f?6k|6nX5c=hJ6vmiCx+DH%SW%56!0?e8Vlr|4|l&US+8!AJ4g5&cJV};BxW0v zI-=?btHrBP%M?fVsE-)8KzDdYH?3xR``8;k9aFd7(D}M+r|UE))GXDt`;_@^ipflD z0KfM=_Ewq*+4MSq5O^Yl(GX>_L<{;DRfm^@`XUrZaup;2lS-WAr@>9wvT!kAGbvO8 z(r?v%E$>8y>WpD*5{O}i(Z&zi;5qROwBT(nbg4$bh6%D4bEL(V*q+VPdy6WkkMOTz z5*PKO`K#Dyis}X2)0IZpffN`?4Y-fp>yz8zo8OKi=X;e;;t1dRccVD2i(^?$@%;a! zQU*8BDc4^!lAg}o^*A?-GIs5(^_l-Hp?BLr{=MB!rRJkxRQ@C29zLm)e*HH3NUT4l zqI;PF9OZbj3qMKcb!Cf%w1bkBm}jrQu9fw-(f)x2PH*^?27N@8G1;J^a775ccvaI! z`Mv&>5RUMJtRHtY*;*Ax@#%=bgN+xb2OyQ*^pC+=UT_?MCxj$U#~i&2%UOrZ#rsg6 z&VB}x-r%lP^k1do2weKMyuua)}qM z>ZYdzn|Rj!tZK(rVRy^*A4NgoR?M9K)HsG?oo@lS{(nNex{Ul5g6lk5Phq%?^4nO( zMn`=+H5eG;#)x&+oskrF{Z{5gtlO)qTj~ke#Ba7Q19p=zG)i%|h$=!Z#_qRqDA@8V z5e7WmF6+PY)|Od>(oBF)dL|7V{l#~7lm70wj!k>^yw|KC$=YsBl9C;QFxdE4iKYN5jY++`ZjU-OQn{{(6cY%6zIT#Dk~-3FB(0Zd0G*_V z@%nSFrBtvde4Z#=XDQ)2v=WNbdB;MRmZKj7IVQGTV2uYl2}Eyn~7e%k*?Aj+iK;+&a^ryTz=5m%K7v18=;LG zqAD()pa)i%W{u^4if$eOGhRHyQaFd$MwdCI`sjH7{?};uT(}S;P8BnnpeyT?4oCD@ zlLTwpDaaZX0;RTLWWf?KywA}m;a{-S(WI~jFvF34v$ZE76Ai>Xanc^!NO~jjkG^?} z<#A37kMc}z;coG_AyCE=MQl_Koe*gD$Uh3Feqb0@NvF69ue8+wc0vcdIK^a$Ud#WZ zZ-_b*0>h|Krx=~P42M4u(jA8t9*0~jJYLmiu`Ck zs3cV*6n?lUpYg`;Yw#|%mdlrNof6$K?CUxpsFHSU$q)(6SqaBPA>EftcqqZ_3??%H zjsIwzkYPbSrbA)yv2<%;(~bQKU%~-n=bioLa!Bl^BftdSc{%1+Cntj{wmeW&IE%2+ zunqxb-rqkqB4I4L;xS2T06WE(@q7GovvrI zP-`jY;u>#P( z1%VNlj;~$k`pp zN(iqLZk%Q0=1*5m_;%h{<~F7W*-0P#I#IMzF)YN9XsX&9z^+C-4CwFn_tJ>Z$*(CG z=jBiLV#nWg(%DVD#ezB2ZJzzL%y?P=?!JSqvm(Xmld7hdHMp=oGZMCtOeJn( zHeY%3dBEHPSf5Ns(5SrgBDd#&lA3~~6q<39_qFI(9??D%i^gyvbtS{!)-?uNz82LO zHu@pJ_%!m3o1}y0&*`JMtsFqf1b^or5s2|`TTLCi+A*R6Q9_hgB_!Fiw(m=aC}&`~ zSHh_8(}GU&OPDe2_zzSya)%qzY(kU%5$ta zC+3ybT{NO)1lnv`gyvE}N`enxf%I-AwmMA`J9RoCN`I^5@0Q*nB@uoW@33l2+)Gdq z5c^jiKp490pBjbwapN)6sr?V#sQ4cm>jmNG@ekdp{-2Zo)J#9my$&D}zkv+rRgbq} ze_@D6h{IS=!GHcD|M_c-z#^`8{`muC{8NLNv^vRZn{@fqJl$8>THr*o|dONn;WK-1$1J5GhnM94OYq`!IB>i%#R?;H^^5ZtyB1*0k zGRtV{S!8;4Qw?$}*W9~OG(5td4u^!^{<3h8>lB^cNM0$?Y-^B6sVBO<%ckl)(lFVm zuWv5rp;I=h&g9^2)rs+TXfy^B2ua(js5=?P7xM8K&F1LVLQM$=B;5)rugYs8f%4iq z^zADu3u@rf8M~flJXnVvXEwUI-rT?J6LR3`d8Letd~<=tI+mZE(j9${A@Ji41GTy}ad&23Hx zW>oCLWR$c!u3NgGvXeP?m0Qr=Igx%XUzhZ?_MscF`0q^hm|2BHHFVMWnkvohbL^^i zeeR;6RQ+7(82aa!c+Kaeg0C}3@5KRsuPdo*pgP0w!VuyGGi+_yp%qAme_6cLbTh5^p^N|dO2WN;EZ=jFMSY+# zQaAXUCwaWrFO{wu!Cwzck37#aZV=^53KoGHoVXJ6SB8hb6Fs-HQSPB=L+0;@Q6pAT%G&w8HBvH9KVLYsGFBamXGmuq zH^Pu)1g49MK^L!H?mR_Ez{3~!pZ8MEN#7h&eZT-dSN43N@ZaZXHMxsOt-4^y=QZ&f z7WM^<3A?sBq~K}Rf8WZC+&wt6!Nc)zmeM0Z*qy@)}7(Od6tbWA*N(Gm!?W6RE8B zH~9P+;~B9P>}2>X$l&uRNYBGG6f5oy#ag7eyHng94)-F(-Mz)#4u|5-p@+M>-@E^NpWcW4WpCytlVq}) z%}QI*DRe^OjE4F|J#n+OV`+qkHaZe&G#*63lV6)YPA zC6^j73|uWKV0%}9-?H0;mx~v@YquyV?-F$TKDb?Ookp}iV+zja=TpbuHNXW5(_zdq zQ|%5L0$k06;o*kZ*M{oE3+>Ao`>mbaS0Y#+yALj#5%H`*L*ca)- z<3*2WfVVW|-fc;h-gG4MEheXTCb8j$&od5bTH;?Jl`%F0KWvszvu!6>hcu!tGwR5=?7+B>lGOb@8lpNYRg57RKn!k}F# zrBQq}-GL1d%5VDIRI!FYyTbb6(x|>AO6>9^QA^lZ=^=9OI4Mv_OzdD9Ziq4gN7)D^#Z^`URTzxVw5!#rqV@cnq`nwDy2n};sOmh*cc=*xt2ETRYO54f=v}Jdv9Qpj2;SRepnrVPe(BCB z%Liq>)XeAGl(&2BwWZgEE+1a9M|iovOxHZ&1YLtEW&m6B9tW6hcbY+y;?MYKcEzkI z>(zuqD4)zW`Fq?ctl)fd+JadhAa*TD&qZs|JvzDp-u=~a2^-Mm znbPW6G1BKYt#Phbxs8)#mY>KNIs8A?Fx}2vjQgFzDjfz`ROMM?4=1FZ^Gt`ByfB`% z)IXKdF>k|;=ly`)vj%_EE{ZhkA`DLE(OgP81+s9;Pa3FdbLv+AEt|JQ9Ni5WpE;_g zEpLLS%h>8x@0JGJo5PZjZkefCWf)tRZmbh>_b^`_r>O)#lxrY(rujIn9%2fzw@X0- zy6Aob$R^~phpyKD$%{OHK_Nm}U=of`l^5~3MA9<+5XS$Ux97N`B^N&bMrSqh6j-$x zVZM4v(sNJ-=Td4_w$`!VR~4Auzg%a?zvKGQ6i~M>YRhkbO2eZ#m-T#m<{h{xzA;_q zXoPBa*1)f~Rt)R!TcM2GxC|uTDCa1H2GYA3drU+nHqHVw2>3j^Xj;TFCRT!|h27(pUF0-N|ObPA#zE=rZ?Km(P}8hq&bTP+gw47}&0z&JO#J zHX6SlAwwu@@qO%jF|htZ*8mL#xht(Lbzy>v6y_B?qfImPjd z2y0f>{(}1M)EDXWnc|B)%&{nW^ZqtWlZ{wK3kzR5v{{#_0r*XOF)8S;Ka$l68;+gK zu=!+j@DRtxrGD6iNeShL^MU}8)L*uF+TnwLbi*tbyvmK@_oOkB4#;xnlUn>tTE-}S zzt{2^ZB5bFo(H2FZJ(5do~%DU>uj|X7_s41W3WXvn zd;{9wbLK^vue|p3y(2?#J{yyGoBud;grZsX?((gtN`IiFD%(Ed`HqNkYLn>r!{j|~ zU73m0aGYSr6#4mF6(hFiMeV!LE*zyL->aqQpN_%HsGsQAl4%3|9l?+ zH3T0h4*GCGmSY$PX}_DaXE7g+R$oHFS6w+%sNS8e6Bo!YBLeYf#iH)kZph?zUQLZ! zdEeLL%EBkALf19Zh1t46&h*H1DX#Yx}m8CrujZB`>#J;?O=pS#|OJQldp<4c9KGk zJwvdyW$AG4j_6sg3kH4Jo@8XBZJJ+pRLKsQ(cNt0yU7Dv2_x3C_~pvUf1U9x->@DW zJL>t|4#E1`4SVP=1>`Qi%{wl&gsff>_n<X;xL%DYy!d-p6~wpRxs=O~9VE;M%VI ze9oH>NJ}6Z>HbZz&F0t|R0UGnpylby>AntLYbfoSuPSwAtVIl1f|?0byUc(N!(Uk*m(x*^$U*E=b~5s@T$k#q;wuZFW~s5i{doV92Y+qug2 zh-L>KZmoWx$yYO@STE8niFRSV*Q{b^og_b9+TrI!C}#mRo5n`q_#(hDDoqj~w?1D` zWu<+PXrHPTjiFg!TDy>nICt{n{=+65eq;<3{nogu#*ypXNxNmI+_x+!-*vUo&~1Qq zTt`9HT_qX6V?W8eQr_7Z33sHG8S%@%hP}D37oW1JQu0rfSd(&O#sXfsEv1LiHvg9B zQExz3m1FXXgB0Lmyz zPDbU2Np=BK%2cmB-8;pGq?S2Y6ou;@81)}~48y%55?yLjd-}z~LG+py@ z`+04sn;|AMpm;K)g{rC07W(^M_P>_~{81WD8ePwF$M;gFJN3R=jfUAF7m1|pxqEgX z$3`nNQpW6tSo_TsI&hhVZGgfXtcI=|2q5>qR z7L*XFYRr0a1J31u8_wZ3Arqe0t&gxxHd&7?)|zVQ%~(4ToWm3QeW$Ml0LK?(7Ap2!2~Iyvm3a5j2n6|A*$I+zexl?+{aIl z`TQOzngmw|Uuq)kr<}gTukr(9!)8I}&joR|J*RS2Ed>LN9X>zBaCa0Yw_S`%m5XTq zyLzMuiP?Om^fpAuEc8)mrvVlxsr2-MMn9k%##M0sQZ-K*x$RmPXjpq;0vYI@+opKv zAZcn@fy-TU81&`00RW-j{c{pwNyU9T&x?iv>Zkf&RAd!lhYhh-!7{i}Ng8rdx?xM} zaZB(236u%0iFzMNgvh4`*Nf6U_&e1ESr`&2veCY#s&W?~Z0 z_d@AE&`oZCh->Pe$)iBH6n*#C_LSxx9RTpssR`i5sNMoQof;xaJl|jnvyhgYplDQG z3Ob=<;1#)n79F_Pf36PkqWN;Rq;&0)W8cdL#c0G$;J>LZznuh#>nHOQ5lq9a!+-iHZZW)`fF#)?vv7EYg<35n-;C%zkTWs*( z_udS-PI3sGm7@oW_l9rrv*5YPH+==mo4#GKJ`l!xY=|v!&u?tDUeRarpg3n^w+P&0 z++f}x{el??i}c5rMRA2pIHVa-J%nOygseXB-5oJIEAV_=)h(n#5 z?81vYaX4OLzJPuUu2&K4v=oMHb>Ew*0lViN((>p}Q1J5T!-z&NGp{HPOqO_1E;xj> z9)7=JG(V8LF+8zSm8CsmTIsccwDJqEUJ?wqymfS(Yr1D`;ID@zbG}&;y7BR&Q-Y?svsx%;B9E~}%Cg|?xWo{Q|=W`D~cI|w%`0WhSO<0Er z+=WEVKyQOPIkt@UIIU`Xe>Jy6TrSKf@9X3#8IKJ`p#H(Y>wbTr+NEmo4 zBkR~DCtCcUBhm!({w7&Ta(`aU~J|{;K-%M*IA+JF1VX0n)dW6n4V( z=u_$Bk7}fZTdlNtLfq#*HoMVl6+ww=D{!tYpAw-<_iEpI*}3<+5D+}2*uO&OgKGPJ z9!OLK3rqQO=Fv9OJzEbKEDtCU_c^+J=?r}lCA>JfRH^E&U){^VYMVHE!9F(hJ**b+ zI_1#jqwGTvjz}JRLl9%bxR9^Z%yG?N?moDWV5gR_gRIrwldCpWE;yv6sTnH`e@J+60P~g z=x7{vr8>D&tI8F0I&i%(!n{2>zy%hu^P4u0rG)}CF=Y2BmxLbFfTq}?7%TucYV867WK-Gj`oM3-h9hz(=x zt%c@F0{jswE^sU_Uz(M`Q4f%9uY)N64;-(xKqV}PRkMGt+;ugGbY0KmdXg{C*Q&sc zN1>~|nLf{gZ~*-rdePHhwF4O_}DH=_R?r9j-{q9@T3%9lyLycHu5Qp&>v2>p(xx60xsM|EtvCl3EkAqlHcr zBxwRT=sRsQs3DxnfBT@PF9PT(v2#PRKly#&=p^RKC-lRo^5J~@+$p50mS61zMC1Db zV<4Mf3tVjnFf4|^pq$=jv2LsJYZY4eRP+7r`iU}gH@x1r;niC!S{1y&^kr=J&GY=1 zBqqv~M5wlQk3#E69;T%X#+5e__z|*w@%TQ^{I(5}fKIN?+I5>opQ=|+D9CvuzO?BM zcI4)5mq$sf(Qb_6gFjlD`hGs&seCyN;rMM4wyCH8@XL$RykqCBs6lDCW93ICZ+017 zI9g-Y7X8Y40#lsE_aKqJ4($R8BTF&j_&*0#_|Ro-PPJK0JD8)i6>IIJ9xFN0Y$kki z=Bu!e?i#N2bpGVx;inkqoQQzZs(#^-;3+nu_m67@VScV94W2&3u{}{9sE(M)f zQ(q{I*t&FL1(Z5E8Mup~lQww$c2#IG0SU&RU0P43qV(iqs@5d%oK~FC_*!=-8VmF^ z)eIn587&S8+1FbFfD{+LOw{G^@HPt^Y5rVwq}=Rlr4`n)u~Z}2Bm?b6Gr&2VkTVD4 zjxD6Pq({p_Y%qwph2*8b=N>zC*dGK5X}7OFnOAP#mR(?SKV(=>94hE^OF8lTvJ@ep z=L{_w5jr$p6pdR$4_j%N%hBSN!D6jO(2%qHmtcBTYTNyt9-Wly-C%aHe^bi$?usHVYQp zeE2gU!W~gcwU{X>2IVvkeG0YEE3gAubVFBb{L7_Rut@cB1Fp~;H1RSvp2%%y-hROp z;9D-NMLIs0ldNdpi7GZf_e0R90~R`5A);@mu_41iudU{<8~sHb@U#~ud3Xq#oSRJL zexbreE~|qjn!cK)8N$qSl>#k(xCglq*DneGR9jzYLK~*703Qu=7D>8k>>mX{L1yMp zW?Uu#PM=dCc(MobvCI2trCQ^?TcfWv_(%JSt|<+?idw9173S4X+q#plP1{rZBGAJ7 z%?sX19wR?Oz`?A;s{W01f2{}fg|^YFkkvlt(d(l^I)sV-UpzZ2Z%dXT$8bbEu}Sv8 z$D!|J{|C6OEaa{aEN7p5Fn8%mxF*PJjQ(`ip(C@#9biZy*2Mc%9kn&5;5V!1eP;-bn9j%8>N_4HR8gKTUXC zlMj?^p?{JuAmJsytB~CSv$J&D?#Cl2u@gK-YiV}xX|>`*TQWouq$Xqzq0aBpUlN>g zWQpjVL;nK@Mgwrf^glzLf6Ea42mZJE|8))#!+Zz-3V~qcKpYPr0Fr47TUdKpeUy_% zZUYp2Ym{wga20XD4y^A2*GscYOWhac#3Hi-_T-I4K&dm;`R;%xzpJ#q z|GHuQa&Uap8GGZva&UY^zhL)*T5SlwHY3fVb#Y{ojSMq*YjLOpV;$}Xq0lm-=b5a! zVPz+a!@3SilFa zi0vLHLP<%Ze-fMP{#`YNgoi6=G|`;qa;N?$^KT);=bM?7FX=$a_@L5XEG7*}q$<2l zvU6o8>dP>n9t!=#=#*?gIz2hPCQt{nZL)n9a`G6NANbp6oD;RDbOaYG##KD6is ztxA+OBv%1>d_`7?RwJQt0{MNF<>0y*KC~7b*W)aR5IztX204r?jkWo3?M?atcgZ~#UO&6h4aY(Q zHGU6QE-MAGsbTml^PpH*s)~*%v~h_2-8{BcTbb^-;W-UMM4pynuv#xF5J;*TjD7od>Zwh4DZv*0M|DD2 z)yPZitbbnBVZ23tu?{Ab0z^wEn73!MpVe5KBWAB}FV zE6z_C@#7Ix0@^%rU#p~-MEhPJfiU(BwqGyy z)NAqE=&=_EF_;o`x_^65Y&#>s&Hj7XsF-Z0xNvNNrC#xU1Z8#$br>IyE9yocIYiq`0Nj~|y{RG< zwnj0TO{|Nt zWt1@@?o4x~I(|VnM`ggmgO|(@W=fx5eI^^p_!om!I30^|Dx&6QclSzAxMQ;!kE%Lu z?K$LJ9KTS@Nfdb=GhgS;$bvG)6^}|&KVI~zA~9sMUlu3Dlg1)u#AXHncs%sQyAOv^!i>>}tMFh5Hmx?)UA)o5>^ zuH?Z-JHja3qLs%*$x{?-OtazsdxjZK5OcGZqJTACAdt)m0uLtEkA}G6g%7W10#P3=~T_m>U_) zetVVTNr(Yqil_edSr}TT#6LcQ*(Wg1P^=@-!~wvBu?%pUCi2Km1z<_0e<#)+f{hKv zlp?|IJ9Jf|7GSaZAsM)mkG1kx9&Vqt5vxv&oPa8q5R7Tz0F@Y(3)jo|Z=~Yy4*d_* zS#nc0;_T0F|L!W=@&GzSO2}M#1;XtZNbG8yZhst1V%(UM<;{$}ZZonc?ED-^RR5R4`008Ln=Z9AbZPS86P!f2yu?#plBJ0%tb=ouesW@ zgF`WSEweK=ftmKzOh*_6_Z&G$()bcR2J4tVeS{=HC*4Bk}NDiygfWr7^}tY6$q_ zb62D~h|26^rOD8NT8oo*{hc*kIO0MuO#Yn;n+}$s>4&e;ozq-d$g^XZ#Edj?S#gKvjo!&1 z>hb+B`$xW?UpwRML$+qZ)JAnQWSHw!sAEy<54U#V8JO#{H9og|qD!EmGgk3F>ZmMi zf-rn3)G0+lVz1dxZjf&Kdw9BCRE}S-zLBhCUPp($;HOWd8*-Nuq9>=a~31*J`lNMnPO9%#&VEeU8_s87dW zQDm+Hvebdd0eY<&^S-xMllyj-dX3pr_9_9XW3PwmGYxw51`!*GuP|aT0vaj8 zRb!Fd@E1+*>SFd2KaGaEYCuySNjDz=qK?7?HOd5x*DaNR)`k0GsWRYn<|Ql`@Xj7(BV#by87u4VHV=$@QcP9`FMcmEKZ^FLG4!Xx3ETNZ`zr>k@bSk6}j<4VC1 zY}+gdSlWajFvJ@{*pI^kw`!C>3MY~^czTS{GFd!~ol@4p^ag5A^YS9DrZxUlz8Ggk zMg&rOeWMpt#ukge!X^R-Ga1A5hOl;rZNi?wy}W}yUgl@1_70h6i@OxYh$rW|;QeD1 zxG@{D^sqNaj8XlOKm?-_bQtPg!t_>W^AY!5lKqN(CS>!0V|;SWZn>#={TZA9OS?VjxHX8dWj@ z)~QyIi09zHW&oq_gFr}y@Q5LAVndRCorp~m8E(wxMJ!hYc-byQ6~-tH`Wlm_03UW2 zu9J*ene75aG$pyeYPWxwcJNkEbt+ItXDa9vN0NRQ2@+A9eMcQG1gB-86VxPnjG&p&M~;CU3YUUo<86 z7j?5OJSqJ%HY~17aMV?#GKh-nFYY?mt=Aqm1M~_2;S9#w1TM5FA^N+VH&w;_~Mc9ySeU8mV z7m4vlYQ{~cWFi{xtS|mJkx`$>GTLJgH%<5t`C}YiDE}v-Eu!t1Ie;4eIn*|0U{W=C z0Rw|(Dr41VYfPvXbs9smlvsX>yPB{!e1s`55Toiwte|3EM-3^m8g9W}H*?6= zu(veJ5ANj$p@x+3WA^v}tfS*JEE=)F)xq!I($->!WRA5JIpZ4kP=-Ak#Mrb9e6Jh& z;BZPRn>?9n}p2?oM*l@{1Ir$wTgCxes28~7KEvOpY4%)70IqEO1g;3#=(DD!sH~cyYTb~eRA`4SXBw>-Bd5Vvb&ucu zMuCoRL=D;Y*4zxmiltQ7j&YkRBIQ~mE8S+`Jv_j*{?mDGFDw^OP|`|%0!Bg4e3 z^du&t(c3S)H2BF}xPy;&Z06tnQaLPWUUt5s^<_ULVv1wYQHlfAdKFA}Wi&JFB;>H8 zlc`|vtNo3d>TWN>!rWkrf{W6<1xT0s^wE5vR{UKGnVQx^SppynZxd78fzL0v5L2L zT_sCHUX~a&UP7!i3)S3#O=pT?Odx!F$Ng0GaJW%bwNIW*(oHQrO|0+}5d%*dcYez@ zK+0sA?O9g0H@o|Q{9aZtRArpK2*@HDyKiA-D!&K1K#s&cWj1f2KynsMsMxmggU$T{Z5vxOmr-U9m%alcYbGNwKKX&DO~!m zPkgp&u_&%L3xmQlOAifTlO1F129EAvmSQ-f2>*fRy7OFjyY<^5?cBqY96j~2_x38M zPb^m5VWP#kkB-TXZfC(evsKA8jj6w-!Q(RxxKKxktPG&|FT*{V-urWqS)|@{gg3`K zLS@Noi3OurzKApZ^!Q)|_QsrDYgz1IdxD}^@Vl^l*>4F-bx(iK0!c#7!(WlC>OS|h z=%#VX*Vf}rxrisr^@zj8!whYWvDY!x6Uzg+;{s7D1fBg3g~92B3|Q(ijNe|Bk-IXk zuKt$Cq9*T`yhe`h=*~P2BCCA7HR+}%!!Sm@n5nNkikLybVe={?EK6=^Lerh0r%Wz) z>b(7`rBT3lHc?I$GRi=?kAogPsb`#O7$h+(Jj&PZ_nr78#}`3FGK`%~d1D+mS!lHA z>-SS-8ID-!WVojys+#OVfIrZb?`f5`^%$GsI;G1Se#+tPCL}qv!6!Yu&tffcF`!lJ zoh){3v=-|xlKBQ=(unc)-Lg}aHHL<$gyhRv|mq4q{xljEhN0F0IWM*~HoL>X= zV;dL&pEF$~BT+xsNunonhVzrTvd@+$?=Xm*Blt*_nAKstFgcLx!M>&6wSC@|f8qp& z7+antqY|+2OKc~Bd>3o+=jtY3r=ORWDi?vk1}B2EVRdn~dByJ;JjnpJ`QW5k=*D>N zXw>Lt7M-cdQIYV=*UoS20@MMArJd=(0di@TWcA|=Q;CORa%qu<9cf7%V@+>L*|(D%W#IO zH1?&bFdfNAweF=3WnkM) zX`svqB#ahRseYc@>k0!Db`jxT_PAJhs4BQEy_(HVG03bSz82!9{xN|h`=b1fXEp=C z8jk-EFJPszs_bRJllEpWakiXCES^2yO*)kOLp(9^lXi-OGNUV;M=f`J32m`XK8Vuw zvd&X`3eoZl-|Z1d4v(K?OW0HmXKgld z?e+9WCr9jMxONung@TY9P+`*~X);_9Z2$y8;^4@+w{dkMA_t8KmjJ<|s zy51sLOf6w9Fjw14`x#}AdZOrSk(P+&kmi(Fuq7O2DT!B6eH}^jmpvG!qSu)wdI;P7 zyGVBwlRsHtUK_1qQgiZWd(>iXMija}mpXjqTFG9$@{gu&UHQcn~nZcNDWkGPk>w&G8Cc9Aszw{H^-X@!~56hDHH` zPblALbH;_I1g74+Co^vTaMYA(FD2?sd0BSe-Op}u+oA?e-u86{dOzk|bPR#tL%k^m zGYLLYXe%})$om{;j6QS_s0f;!#fnsSj6HM=2+@QRa@J0sRKS+1xQcO)_K+y<*-jLd zOH4YJikf+>zgL`?vS;Ye!z}&Ysu~9ywXNQXShz1>5zbtY5PGYa`4+k?j=}CPX7!7B z>~f^d_sVfdYfLjMzL)A?u|g>WqXn>S8puIh8=wFfw*_22YyyjR<2G3JSKg@Xc4jJy}o z_X!4ectu#ET|fU(o0~cT$^@T2j_Eed8t)k{$UiU}4~HObs>N_@yur;u4ObR{->xq5 zXI%M1!5;4Wd;0MhhQ)!@3r|F2a1LbBmD}O#n6`&-^VoY*IGZ%Esg%mHh83X0v zihe?m*s!rV7+b^!$&TH(HN%+sCDdg$L&deu`SQIXh>5$)^F_@Po@e^DLkQ@0R9emB zm=SWp)k=WrKYMdm?wJ~Aie9RcJlUAQDTvWxCcsOAq2BEJ`bs}uMBsO*tKU4D{oNw- zp2L!Gf9Ch+;Fam zPnTWG2~q9PzvSL!mF888%&tX!G_4STMgYenIHvyH><&t>*=g%n?xo2m zsPwH^v<)0TKA9*;?!OJX2W*hs1V8y2XsHo@rpdW*QGp*J>EmF}%>DAxvsXw&vky+$ zqil_v(v{qm6zuA4Aa_x$J^}0c@L6!{RG=S#FCM4MJ4{2o$FkvBnNv*G;M%HHk{6=9 zFV%H=gl*rG_B#$PJOvnwj&$1tAK}TE+iS%be8D`?v&2&&GXkBj{!8P_N}2Epwj^FJ zx~?$S3P#{MEQn=ii(SgHxK56e!iRL(^|(9}gPS-WFT-_j_)tk ze50CKI?+5V#do1%pe5uU;}u<~DDpXfX_uv6uUD5@B91pDSowtTX4v%FwFjBzpq+zk zJA+Jr4fmYt^IN1WI|&7ZJDUn}IbTO3v4En0;9Jc2%BS_c;%zZe01Yp}6DF>)kt z(GF~y5==-cj+bPNBLmijY*W0^b~7x&@5SC|+6tcFI!cJ;Yv?3z8-r_2!1}1M_e`56 zuzslF+2m(M++s$vc=$gdzmg~OWs)0cb`#!{^VgmxlOH{PbS3@HFk7pE*GIF(14VrBxn`y0F?B5O z$~+f?r7LEX+XSGhG-vMLkUPoqD}-z*^hqiGA`?<@0+V#&1IMW-J9^&+XUrW}h?KPm z)q4AIg)-y zGx$av$vO{btFPR=gkOS`c`u&I?E9{J!!g3kk`0`4M@LF$>NTz`_&G<{PddJ!b>`-- zpkr2@)3C(jx+v$$V&3ZVbJYE=h0T`?@62udsi)O`(&lDl3T)`}QJNIG4_W+R;2PL& zCsv068kV*Mer99x1&2K~puCh`KN#3Dh8+Enxme+JZ1VmXW}iA4c3?>|ndPq~qt6w@c@FF3 zEG}R&88IZ1U=PPG02^B>0#gd2(I^V2EAci4OHlAOPS=xPQBUw)f)#c)MR=gTjs5&1SrF~TYU=44)rpk zf3W-PmS3v3cu@e(6go$+5H5c?@*(rQS&x;q)v{a3H{eEDBhmP(;4b&L12*e^%I*(HU;RU@#vuvp#-pGF9*PNLY$XPBU{EeLieKBI_+ zq!OJJr5< zKNQGeZK6$Am*wgq&(o~f;`q$T|v_GVkk%@`8RTk`CjCyypRNLG0*FWLmM`dU7 zc4TE6tQz}wHrXqTRs4MNRT8*wWVS*8Jj&UstzY~&dv!XfINo;MJ=OiS1o;68ea%KE zx*)UcIIoQU?zynGZ_xGH>zie`*82W%@oIAdXbQM}Uj~rHU~qGan91M~8tQp_FTV-} z2v%)vJ^LDZzh^XU83C_WD2se)=z&L%oOIY%6A}md4lfC({}MO zHY2QnX28Qm_sj7mVTRj7MohS_Yng$^zr$6>_V>()RMyOv13t$t!4sUL&njMay=in0 z@9h_l#>83+x#DenY&(^_o&{?AhKc(4VZ+ z^zl|fOR7HUn`DlSFCsD>zzypMK9aL{f}(Z6i1kCB)-V@4cGN!NCzS@l=BuD@ZeOWz zx}?YtPQ_`DKS&kwm77(gNfpY&Ct7z222f*1iT+1PrK>lTsCPl^sP4a$Ck^7XDPkU; zzj^d6S%661l54eB$Q3#39F5!h0wMH}cA^hl;K@by617yVK*+!_x!26z(MHA19b7 z9hIM&RQAyJ5lfq7tn5$GBD&8Otvegk3a;9FQGa1b@4SX9bbzrVrJ!SS$O9cP6Dk}7 zsOVat-1|d0KM|+389{Hym_y&)nDyn;Xc|oPV~MfoZ4RaYuE;S(Mh>-B0Z2Q(5w z#2N^@ZU^gy-F}0)-0C4G+vMlZ1!+&D5r*fE#DaqW>qB+OQ-K!t+nn7fG(UC$L3B+SVzufl7mCh#> zjs8r*#c+wr{IB`euHYY6X}$F@5D=pG%p3LSN%5NdT*81ksfvc&FcFQ`l__nBtRnWe4Met!l`~WTGAH zb|w?FKBGLy@&u(lUX7PXwa!!9w)bJ(-25v-NnjdU)iJMzo&Cs|=9~S|?;q3Pt<%VR zN^+JdCJtdfrI1FDpkl)f{LQA3T{w)%$&Jn{8|WWv~$pXP>jwRr@z!8 zD)mhmX%kguzq?F-%&99rp%uC3E|gs6FJrL`B0sjK^66DL#jc_luD$FHA3BTw-^mvg zc%0l9&d>oM*QQ%S!=Uz&Xz0KWI)7OO1RRsVp9h_USG9J#Ts3t=hkFBW{9y=XowtZG zVkYsG5BiQ;YdHxQo8YLOKX#}73yVs>`ruGLdv7Oe`Ed z4aqkHNysQ9NBW$u7TI}grmMC=KZXY+t?%W`cKT%r4x^a{-=n!oH^g5B=bjAXzT6GO z_p^4mxIed~mm&{ywWOC-sjpi#L_~nxBMiycM)33>$?4CdTDBQuqm0luT#Wmsqgr_$ z&{9c1>x}W#j|lrYV{m$?{em(0H>Phs(#yRY=re|gyP#bTl5YSGuXXK(T*P{cvI*Od z2>;JP12m65j`T+UzTFUJ{8pb3a$M6$0jC(VE{z5~cba7Ks zvxG|#z&ENy5|pp8GeUqYano210Y+q$i>;F#iJo?RGtL}pmml_!XMBa?lcljJx3_1V z?XPbu>EC8*hJQcbmGZVkKtVfi%gfwd)%PqtgZ6-~WM%Jqegj}I$!W)LVejuDB4Ro8 zQ$K5~=De?C|6?FPtf04>?t@T%Z#M_|y$iU}*XwbPih@1^D_LS!ur>XYW zhxCo5G)$s^A*WmNoux-$|7XjI#1{JrN|Nq?II%U5JA?}#*ebYlmpga22>#PrLGM;dGQLG!W_#?wLr@a^P66aBSDU@qF#@vX1b^>u|MPx$(U zd&FmZ>@N9j}16e%=|M`(; zGQyo%U+;O)2HP7NbUf#IXCbBbjgXzfnE>G*$0)uc{!#!D;L5q9 z_St2PzQOiXSc2Saf#D_s7%a@4#+bjM9aaLleXZ-{oh`IVHaZ{_-UrQZS? zdTe?UweJ{#oIwVk&Z%$6uK@Pl!**t`F>cCB9&p}T#Ha5QNF9K(-t&0qZTDSF_jRDf z)^lOZo5ZR$un1*twF*@l?^n4)|^iLcA@2vp=uwX*r(>a$N6CetDim z1A7{53O%Ivcy_t1{b8ndTk|vfhhuo4&$-S!GzC6XKRBVf8EnjPAl*Os=SN?@ME_;W zJ!$?V35C4g=ZHOaB%{DOHgCiW%J_qH$$Nav&?AtU)px;Phw36B|@EOQ=Xf1F$ zyy5X8zm(XP)e87h_q!e7@g5MFXT}9>+%D92Rg3UlxSwS-E;S8zFE!=PcChEtGxS3k zD1`IulQ-`8Q_h}+&>txW@inge9>s*qE*QJe#?m9Ju_Ximp+v*icvMU0*N@H1ce7!fTuYelgmaq~ z7!g(I;r&wKPGp_K#t)QSpntmCv$2XyZ%#P@*-TT_uSFmHSouAB5|7vK~%8 z!eiD_Jbr%@uLUb6SCe~vf@915AkR0LOH+ZNhj)e=h~tXsFWCp3WvY*Ya;Q4QT%J* zA1>o3h~+|9{d=#wap;(i?KF1F3K5xxBVb_$#G-IT1He@wCDeE%bV|Ks?3 ztcZ2*Ey{AgUSx5vDYCgW-`in(-922{n^3oN7xJzEuvD^8_Xdd<4_DRNhLdxOH95Fv z3Y)WdN>+}4iX~^sk88GB-LS4fE@c!r@{@;-8{`>=}8`*~S*24Pp52<{gKZWew zty`oAZy=j>Z^>red$L*g>o%6`wSC=|rG8q}Ph}4-_Az%;;C-zViCG40^GEv~wlV%n z+fV$pwy}P-rd8*NBk%74ENin_cXKxD-k;67-%w${p~8Mch5d#K+bk9d zY@_^pY)=0%+r|FWdfQGJc{i&z-DCl8RxWr~6|wGDi?ZCii!AO}Z8rChvj6`dvTp~l z{E$3j`KYGAd-gmMvw|o)YdgxmKz`L)S`L6klmEY`+@BRh*Zt5l_TY{mtiPr9uIXez zI?u2YWW$NRy=%@flysJ1Nbj1|zBMt1mLl^=KOkp2>ARLMP1C`4M_GX|{a~E*OyYD9 zT0s{c|C0{3Ph-Hlf-X4Tqyz89p-P{%wwe(_rH=R1=R^iS^liV+=RMPega}%X%RYT^A~blNE4xGmW`VS+wp+A! zp^3*4vYwt!2}hWGNqG-h=~bmud$i{KF)s3?$Eeans)6P`Pu!{Wv-w-H7md_kFPaw- zvTD6vMbcyFx6N}w>DzU|x%M;shFg@~tZ#_+Vq83QGH*}L;hXdw!i%L&NrI$@|Y#)%ZWz;IYupog#M@TPk zv(!%dI~Piq+}14u1!c+W`D)MAd}-6dZqWx&j`4ONWIbD>^pWCGDjcO>rQ^14k?Tg~ zn4ZS@-QsD4teA&?CbalXb1}fl;r-DOM_(L;_SSTheyl;2hGw-devGk7J3LBH*gwou`q2Mw zp3>Xvzvgv|e?`dpUX4P3E`dTVHEM4o7D7iDE9r@@^ios!5xZ6CyQ|2pS;Bbs&g&Mx zQqKf9!q`Y}J*5Y3zLbrWo??6gk=|b#OhqmWrHX~!YVS`CSE1UU*enfN&@Dn2D#x%f zzE2RcVmZb#_*zPjEA3o_9W9v05T4&JYP&_S!9a@QJ%7@{hITXWfvlZ_u^z*t+{TIx2|`;w zMYb{RC$%cNUP*fC6-ZZYP%(lHuPluHStc$M&U6kpsncbRLY0yo|3E5MEpE>=r>r6UmtjwcR4E_N>IeS7t>9 z{-{`1Km?<;A(^)?Lue0tyaO?dq0lyPdd>W=w}p8u*pTeWCLZ*ODGPCcmh zj_X%9hk#7=r;|gHz243;v_vBmI!F8vCBL`cU9nSGS1eKoW0l&O0%9u) zZtWI%fN~5I)pmHk+1PeirTw*v4QZ}b`YXR)tJs(=G~!@)(qfV^}x42s`gdv zPfpu_*eXwIpE&Id3(Pwl2VJJhWh8+@GgO+#09x|N-h7L6#cYL7b85TAe~>=rmR?!i zG{0MnB$SxIU!(LTupaV&UK&!tiHMzOu5N9hodt=VwmOvz+{*DL3O ztglvjt@B2XoDs9Ox?AKZCmv5E^ShSTPh%HpGz^ zfNwpAkQIL_apLdN`uz|&&W00s9M91ZGTSE$*ydUpzV-R#)|c>jB6rt!j%y&j{>puH z!MgtNHtIpxG!#x&Cls9LF;4qr;cP#>FEQSoG_;p z^f?6~0HtSjPD2-_McE-e48-?kWI$sv6fCMrAn&(07GWr<0ClWT!Kj{OGDf_LtUF0pMUAMU&a$HoOt#a1i6rirH3-Psc-`rO7`I|^TS0GNpX zn+f5jU5<5aJ#n#}xpq_~fT?{Zgz?xo3cT2#HSH=}R~ae$2=nl%c9qhP&n=3YiaOeyL%Deg>B78*p}Dpxo2aKaKA=09DjlWtUGzV zJQDCvirp^k?M=I?hxFT>*v4FwA`cd+ZMq^42_g^IDDp5J!f$t@&|EMt8qipCWdFYbNtDb24H|Ngq)(z4Wt{BeDEJn#}c;Hyk&g z+do1ea+jeaatAcuitW>qrxGI1K&X?Ugwwsfg9|0Ml2K1A^K>L zmA=LnrxrUNP{+(s(4y#1fmAb!_bhxWA-3%wL1Nv_qj=A}rxGMq>&*)?u1w1dH~??e z@-7k2SJN?#muR{&Z#xSunvYWYHCv?TbkKON*Y297XI6BPJSw8+O%e1km%XI?N}4 zQ1PSCT>L22T>L2AtnE#v)>6%V{WXzqh9>mD<0=`#d$8YrR|hAsEGV*GAi-0beJhYE zhwz@B^$GDgfR_6xXu-0VOX?~L|7(Wuo)Iel0U^u-j{*O_U#Y2V9>RNuKAXVt%}HMY z$gzw~gZuOUskG}IC(HHfps8B1#oze4#rs>K`7A(a6AdSO;gMd^>KS9ed%D#egdV2Q zOv^p+T+i+wLGWO?#(V-D-}>wI3GCa5pTshAl!Zn-r-&-MnJhHoIkgW{`mn#dJ|PzL z<_85*-}(FzKd%QF=d3H1Q_U;#Kn^8PuT9uIocDYoB#5nu#Sy`Ag2B&l@;?}8#P`t` z@t&i^PAB~ol?~e+!RfL_C(KJtrhd;V&;Jd>F)IFPPmizH{8Kos zkFiqc11U8xYGR=g=MfDPyTzBRO8m{MISY=f?#~ z1G3%3$&oye2Pt&}&qtX4B(AnO8`xwV2f$4(9!}LwW5J7asrGW-gX3%adZkuLdf%T% zAzuzBS6<3{@I7;cgvet($$(I`o|Ca1YE2-KH-hZbLkRz0ZRF%n@HIWi5goCol4?&q zf2E<(u7k3Ok&`)q&?7mV{Bi~i+>7&to2j}cguKexfQ8Z}N}qQL5DJ}0sPkkX)bJ$N zEGLjyox{nPUo{1sd_I9hI}K$uk7N5fNV*Yt&tyD?lc+30?Dimn|MxUB@;#{hafGax zKIOoBRv~1?_ctJ9#WY`mkQMV`(7q7@uRgnZD(^YIE+K09UL7^wqaq&GU)b!-E=4Z+K zeu7JFsfnjW780lY^Z=^}Y0Jy)r9 zD6yK=*%sc=~>~c|s-WmxGv<~^gAh7()MN}aW| zfaPyvj}o&JT_Qe6iD`$ZwgA&z(bGa{ZR))Pp!eQfU$@wUZO#A)$xOaPYHwH{Z6itV z;GHxlcdi;G?96}`%_nJc(NnL;#XU-`)DtE3X`K}8Mk2^4WIMt&Ta`0^Wen>(gse%O zDwIxQzFn=vAIB;<`736Kbd<44N0>oU$8=g~A4UtBZcV^>4A$$JoZMZDuMd%y`?^K0 z2TjD+Y!vUg<)ab8zT3M+vkeAfJHGM;-cz6R<>2~&={&uAn zt<>`@Qf1bcgQMMu)S+y^w-#ZZFon|O6xw~#so1Oo2wAb;vD26?gQS&S-h*SbYoAOI zdPYG0)GwaEOcnl%ymo&&dtFCIc0La>!-$QpOwbTdi=oTwK z8X;6K=Qh52lOpTSJed$nRlhHRZ!p^`ACpOs6|d1ye~Gz#fAdj zvsnixuzXdnA1T1_k;3~;ik+R7!+T;B@A>IwrDoGNUaqGp6OVm&9@N!u<_8CHY(hf| zi7Q8pBy!?g{@BKvLf$j!$%GixlU%Rm(WbbFaT5NnA1O2x@}Ae5;v!||Jwz6%;L>)4 ztZx@6X945yp#mn*iP$0YW=y2m|nWnE;kmdQPTU5NenCI#&R7+(Ci&et?hzcuy0poTZ)2 zL6rJNjG-l*mqIR{8|}1HP`-(Ux@`bn9M?2F%59`6zV)$(yGWgk&x3GmBq#fNPzd9% zr;8^v=sEfPFiHsIaPm>c>|9B6VXQw4#e3WjC5VsuBS1@}3xzOD9}OSD+UW}ytUFA@@y!Y3U74fgm>3=h6^9^!%7Zi)K2!n%urM%4L--UzRvZUF z7WPxraSp&cHy6UwvOvaj^wH3w#gAVE6?wq2P&pce>SEqQ?CtQ80@V~3r=`dx)`yKv ziauy@W;Jw9ECJqAl5$>n-+C{`_Xh>f0fJ{42yJ$P=K#iYEO;TFhniCKE~VyhhM}EU z?r?s4nw-xEi300^Y->z)twx~rCZnbsTW_Wk@iy8?dmAr@3$> zfy(#-K8#_nH1HnG|0Qb^O0AIwqPHt)K3sX?v4dFuHWR+l>neabzDw;<@C1N&7|`pA zfjQodkoC%kxI6j%*Jq>k>G2{v|?UtGd@kqa%+0 z-qpc@Gb2U{oup1>ky6$}2tC@3ya&gJ6)Ig~ItaD=3v@}YV=HzusL}`9B0ho2igTf^ z0eBAt8wUFdAdGR>Wb+<)^s$ZiskGv02w~svBj@j17G=kg7yHo{PCa%I7CzL;u@HJ# z&&j}49O4#D?u;+)b+wD#7>tQXYC3bGXa!g28?8tOht zAa5IEabkVn8Al?QKqMb`B1Ccutb15jKU2SdO5#MUbLq81%m=M*sPW@t056VtQgy+i z(P^1Nry!=29)!~vF7_>?zQl#qnqpoe#eN+J@Y1Ar1hwcXtOqP7!xz<^>bfe&hHi;x}4T?aXP0ayCHcL~O$7WGsKd*;vzC2Fm^FY4&=gM!fRkVQd zW7|`m$H`PK$l9JcJf>h5D*sFBS{BizPt@#w* z9V!l;VZiAt;bbyL-wgRD2oXPjIs+PggE_fL2L~LHal)=?yr<{!gy<`wgsxyhj4>8x zYMkrvrNGmZ8dnR>eae9MV1JKoa9{ldHJ8CQ2isOm&yOka78{^0$bh#v3+jCMlZCn% z1>UAzuj_{+xb@PgPzyH z37KI@UFndgLg*RB3T@Vm=C6tkO3h*brPh~}{a)wRfb3qc>_?lH!Fx&{>=HQ!T3oLX znQz58{$Su+F9+UJ0DNoXBM)~@e?_SS{v}hXOUGCU)x8oI@B9fT|AK)~`{g)hAC$8H zPg#49DEyL!0PndRz)}n_`3$MGDSH5CKb63_e;Ka_p%VC3N(Uz#Wlq8LU>B)L#4vZ$ z@l+Qi@$7pgF1Aq$9!kY?>(Arjw=c&Rrd_Z{y6u53@za;% zV!pbMEyff`x9%P%e5r>OLW2Sbtl*R;|@sWped_;uR)tTu<$dS#uF0Z#5%qOKzV zCr>Zr!dL1bbcCUtO&RN`bZqnUr8YAyVA~g417XEKj~7lnmk@Eh>C?luU>+y?@<3MhahWCB%gMY^ z@khPBXi2&+icsKP{Xmz<)11uYaxz0fh-0~JvE3k$ycx&&Mo#uY#i8%jy!JcIhY&j& zRsF}W2yNO2mS*{kt)8oaG9 ztMSpS2|{HR2u;J(_$V??=zdv=k5YB!saKSIy)6q)^ymM5dhnJ$&?WjVBXLmKZxs03 zHTaI<1pammzvE>kS8vKu_W zG&#`Xi1fW?v8?1fAn#nJ^uUvcfh=diiOGj&$b{Bo6p$!9|rOajjNy;g}lR+#{q0 z$jN+;LU(jA$nWW3yN`kvS06aAdz`Ry6z{oDg|Rb-_k50!^~-0J8aIAsYM*DSoxBG> zw?KUc+j|^8lh`;5>g<`|{gwhRj+1#BycGth^XZheBJ8gYKa&t+7jrVTdz`R&9Pil_ zP-1~kZtfP}L&#c@3w2Ei{=6~CCN~rii-IEeW-u8<* zc^V4`m`Aydj;b6IkM7-&AbZm_oLNGG><7laG^ol@P?e!`JR^_N1Z<#cKesroE^9Et6fyyr9nPD}?vqsTbHtjLQqy$1b<=9M#&wJ02;W8DFU zZzVL0j1y)A5+csUEC69M3v%D*F>llQ9|G_BM%@#IbJ|BzXkPg_2-R05b?~*9E{uCF zeOakhq~fvkKy$ZN=LIf|<9-~|Yjxe4R2-8ifx0G%W8F&^+V7&5)9bp^3`(sS&j-so z2P#cWAit~5B|<^VHK}+GP(stSNj!D^%!SeBl9JnMID9EMex8D3Y$}c^w6N2a#Bp;! zIKFx5hjH*JI98|NC`iSzl@{7&CUI2sgX6P*f+LuM#-iNdR=lfII^%OH$#un36}7RqrB9RUd4-;KyRJN|!p7ZO*LfQ-M}DG1H! zQud+Lr~#gI`MKs^f|dOA6NEpyor#A^)oY$ywy%FTmi5s*n_;}ea9XohRHg0zSRD5Li8q3 z%U^rz4avL zH%q%_^B%M&A!1pYohnNQ7{TFD_VGRP;)QaAWvg%9ZCan_8$7(nw`-iR=taffw`K93 zlYPf+_}9igjZyCP0krT~zV90&;5k%!c@LgPRGou8bqteOVW(G_gR7r8eEH&qbI9%U zyyHe?4wv;e2g5(7eXozh_Syh-ZEEc=e2KE3H5Kov7gA}*3e$d?)Z-y9#zj0{V!yL_ z&o9++pU}pU^>2(LD>)9apK%;W9S5fqs&7e-Lw+GSj%fpU&-%XO$o)6Qk((UH{r!yN zm#O2}t`iz=OOE4DDdX6g#e44VI}XdgF%C;|9J60g_J*d8V}0s43iU$M?a6Vpq>Q5> zi}zg9cN~TP#yAR-J2?zeWP+I1~g zA-4Q##g^mTI>JKeDFzx>yq*vnaIQ3qliOGb;n)l3JUDK~F|#Zr$i7J>&dQf?EPF;s zh&YDrWI&B!^QG_AIJ)<~d&Udj2niAYe-7XG@_2IJQ6V9&$bq^T1K#yCcvtA5E`mRe zP#2@g8mb46rwQ8uHLl&I>p{qRn1+*GIPbd+!fmyb03;5sIP`U&cO;bf_ru=3*(HmTab!pb+Z)xoYVV#D zJ>U9PL!vh>Jo~d0o*vPYSifNr?m*_`-3d z)&BK-D<0R=DPw6(9ZOXP8B6tI-qZ853&-*_9!o!KrkpyK2M$4Vr@DTYvUawiW!E_2 z979VbOL$LjeM!%^YVT&XG5OM64ayqYFO~6ZAmjNWgUCk165jJgKjXo=QP{hNRw(uD zm5%3#W$|+cLU>*W^$GFtF8gtg0dHd;JdS&n{g!|DnNm02pjYG;fB!(A5Ra05hCtra zatu)NbMky>yl~A6aZ%gzy7^w-bDmF#e0N(Tc+8T0q{_Ziy(BXk>Yh?s zq8Mn|sDthGo(kb6QHfFi!6@&h_{bhNv(!%3d4@=r(CT}OI%rug#>FAMydTofJIKj; z$TtXC^;ydMpGTQOwdQXjdqyLwUE|{@gmeGj=wQRGyRrTbmgp5q4SN@_)Hb^DnDo#x zSB#5n3QuCpV5#y8gD`Cc@A*kTJc;})F8&cA>qHtFuX#n;r-yksWL&q{ol?ucje9^J4b9Kp zNj39%Aa_3>7lQ;YB~53!<`WD<^8S9-L}gx$;WKVUqAw3*UtYSOYomA%EKOK1d?$yI zg6cat*oK^Cbds{xM3Hk?xcd_#Fv`0CFWpc0g zSe)9L4wfN3zy>Tsd+Zkp*na2$Hf-UB3G}Us?Z9bprXiuQB*bq)Wk>bC!vE!Udt0CBdlYNI2I@qAmM0;)~dKvxQvOP8z(!#JE^JT(QGJtcy?~z=5g4b)r)D=#8DJ;L^jQ z5*zi>^7?dI+Oxs?@V#ARt?CjZIUB=sWECaQ8GLJuVI>k{L@pO@ythj{g2%R*n|zeX zmqJDex8qo0S#e%)Gfc)~e*12!nE~Fjljc2WEXeZGgc!RRWGsUrvL9DDcjx>26nQ<8 zaV3#IEOS`?u-qwUmROuIW{@=FHY9GMp$_Bp8M&?)3*NSiIk}02mWUoEzTn_J@91E| zp{17#gQ(!rgMjU3%Daa3iZA)o^KsEJ`a*h9VqC=I_SYrI-0A^ZPP4F~zF@NOAVAA` z7B-wOm@MGujxkp0E5_nH%9zR70+o}l5ZahQPE6~^vHiZ7lV2x$+RW0s>imLdQCT~l z=X8q93(pDj`tw`Kdkbaw87_fZ!Vcbp$B+Fa{*Gmb{QtlhQqSzWz7>CDzw$ocI8Jtu z{b@UzDWC*g)eG@o2YfD1(UB$_|Hz0L#oZQKPGmLqt=RJ;tQw12zw-&BY z_zX0(;A`al9X;b0AI*iSt6NL;;kE6B(3wL8fBO3Jl6Kqh-6YB-tiQLoj2+=j2+$;q*9_1c{v zf2p2Z(2)fPYPEN^Od!t#PChagWES|=m=)yMt016}Aitr$2NfHsyxUfEGZHnM+P8+q z0eG)j(v?!{+tb^l7ULO_NZRg>Ta>k~r0q`EiK|~rh=Y}Pzd~&(wL|(AWX0c=XLt4c zERI`$`&^Qrm9K%&FoEQ*8?ene@?83!F3i^lp1-h0X&%SP-Tmk*hW~0R{Na?a^O7X| zkNbgtM}P1qDezPGNk-aYg6vkwu|0FO7K(%~#aOK-fI5Ilrv2JT9+WP28ru$ znAVKtFZEpwjeqw_$~)CmHf%46O%UvJ^kglGGeEePN5IJr;N;Jibm4qQcHfmqTTe1) z!}j~yCkVVzsXtQy8vtN~W7g#Y@Rtj>-IXBkrq;Jl5PU}Eoq3EibS;BWp+ND!!pxE}m@K{3h zQPA?Y#< zDc@}=-|Z>iho^imO@7C;s)qEv;TBM2gr~X5@%n@qqo9oB%P&#_zUHH#3_o+OJ|RXJ zDA(@uF;Lz>bCYo{^vdEcF-DWPdUA}0vgaFB-9A7Gl{bUXRG{j%of395#>HBilkxAE z50zUf0rO(kb8*q4%35-d-|pVCdH#y+hf!J2@C{XcU5V=JMyS5d$&vTvALxtUn#8}U zG2PEicrH%%isxs;hEV$ip$(xEd<_VW;AO&@X0kR}#v8dXj!k@h;7%({!hNDKo&T8c z!8@*!_ckX)PDW*w>e&?>jx8`A#!TMlHQkjE0p}z}PQLnXqEmHeteXboXLmFw#NVlV z8L?g3Ky1^m(rS*eEcHD_Gst)jZ?{iS&eT|=*d<>LkU5e06oZU?9a@pmjF6%Eck29n zMlKwqp}aJ8exHL-ZA;E?cH@OPcSmDfIpa(nL;IR^TgB_ZyL@q%i087pIUxoUs0*juhE@t1(XYe5KcPK1L3f%WM_D}B{{|UWc>$B&; zoDCZ^A2DWOLfm8o*>}fPGTNFDSKOh$V81}R-=?H_3G#ks8DztTcCshhEWy01#njC0-g>uC}nz{Ok`>oQw7 z{oy8Zo|R5LCvK3`wp*!tpSc|5X*-pA8;(^7U*Re_NQ2zVn%AS}A4WXV|S~x=TU0R4SHi^MGJI}YG=^&eb zmJm4>%1bxKMGzUG$*I;|Sys4Vqhc?sReSl>MkT&;f8QmZA+@a}UOb=qpLHqcK9Jw6 zWKVCsPJJJSu}I55>k@BZlrzg>IJOZPVdYrfv+9wAxEtqg(`lh?7)|mjv;@M~PEGy3 zOKe}og<~^0`Kz}n;b;dXv@td*19%U^axx2CICeEB&-@7zMx)Qr?%h7eI&tKCha_bJI2Bc=5LrkO)R7iz(+Icrcv5PC%kB6Uys#aH9T!F@kpH zFaG_|1SCd`P~Ned5@;je8e3L=?(bYE^F=8R5{g$@lv(&+pnuY=OtY6I{Xv3lroVgFKGfp89 zm=u{^kS?<@0K7emy2SR2m3^i7*%fz}OnPks5_uNNpX@Uh>e}R3-hMVNwq4B0ybd<3 z#MeeMLIuFd%7u(jnajWE$WhK$!+4IoN(uiT&fYyfs_N<+U+0{e$&dudWs(UYkW8Qm zgVqZPAw|o{M8P764pX7jr%VzQG(Ihns|e%-5LB$@nCPk2=OKu+X4DqjOf_n20zTGf zv@HfjytGV05EL)ro-<))|2}K)eKIGLvA_3y|C%}H?8{nf@4fbIt?xRvRZx3s7|y}3 zt|FQoAthO7ITlF@w1uyvYlvWY8uKycI4fP#s1GBDiD7vPpm_1!%!`EKEC96O`_E4k4Pu1SX9aNNa~j8RevsD}u83*K>lgpS z?9Zt#+c;bAIzuRC=c{K4#aH+f{ml=woh8~KfKr;ye?7g&aDdYF_8Fp`D+axu5GR(s zh5v4ikEdZ+3#2kzWqSGLA^1KxcGlV0dGmSGxWch?VXLU3KBZ%79p78oWWC}NYs33n zn5{clV8L!HH0t@X?rI!G?`w`01Gec)9is43;Nh6oVS`|&1^Vcn=%w$gd-*&1Y=MKW z&!(y^5675H&1olIsXqO1OoJ2%c3Ys4zI*F3^@)dLTG$3b!3qcIyS~Y4BYy{Klw$OC z*dZ9+!)(Z^?BEM8m33K!w%4rCc)KQ1y|v$=c<-x^(R&HSO7S|omS~b1=J*<(9K}0p zLrfdARnJkpGdIMvd^M_BIQEr$XG|;7Nh$8tV)$;4sNSuzchr_`0@fv|^(tL|mUbT# z=^aXyO6?#^&tTs>AgceN#usWA<7Qi?kC{3=;D z{1T8CF-P&vu4jG;9Xe@496Ef_qj^fwV-%U5aQh07}e?;qZ+nZ_cYLVM@ZY|#;DdkjomZ7 zl+EtN@V_r7rk(qiw1sEN`j2t1v| zZQ(_-9v%g4RaWS8g{P=DD{M~`N!gX(vs~8COOkqyVuvssvlagX%`E`Ir$<65t^t1k z7Bu5p8~@`P1oy7pd!YTR^Snr*prBbqRh8Dc~!*JEHB%fVzq^ z#MhgF<$&X@48?nF=iJuMr7`r5mX4WYf*SfyhQ&n7vs_Poq`dzb)fh&LNbMCSu3&fe zmV2TauCLCWBEkC!ac;{{yr<|q#xM_mn9bUYmUZrW9G{K2riF}#r*9|3`2$eAkD{(w z&hCmSzT{ibtehdiMvj4gUUCGU;_dY!waaw|jCI4)QKE&Qa-uTwzdukVtbF)YivLX%tDlIx&qRsV#|o z74R|e)eU;zFB9l|XO3Q%$d@U7S|VTX%+dd7=Bqm zxkFG_nfdZt)Pc_u()cav-HCkd<9%S;4f<<|e9gE)pP9&)DgB2@(r;>v#PNps{R92> z8MlRY^7EBZvVP0Cm{zzL>ih!u?td(*ZLvb1XNFzfozL~>wN`cSWBi;igW-jS8Ri-F z$EyIv`zH_4T1058eJrZE#wuPcL*eCM{wH|;&J4vHwkqDqje~dFOy@ci>;x>}JFp_6 z`Lkp_+ac>n=Om=_TB)uBz;`RBvwN)K#X1fX;>5IuZ71?_<6}{+pckg$bZGi+Q~C)!eMN@i{a3=- zl5s}#<)cxpYLrRt&FLzH?W*IksK#PEu(JaEj(v}}&0Q2@ zzO-9%x^d2&p91ubJ{j(ak1}ikW-nv>fXmS)2oafF*dAo7B`5t5IiK*hiFn=7$-Vxujy|E}J z#33@tkKz400{Pz(YRibaN}#ro6id;2RRhKGEv4mdoXyTVzaiTEM0p(nwIVGpuQdts zvOmUr+=&SKVH;$2@%T934C~WEz>rV7E8ad=C)PJnP}w~gtM4bgz6xI7SC6vxIUo#g zpJN;+5@q=>XJY&Oc_@}|Ht4$r2tHwjzGf@*1#cdqHvfEtYWU&Te#>KpPY+BiZr zpZ)Jb{cZ(1KK{5lYMiYGKl!C;tgjH%3TIrd(xdDQ+yP9#bdOfNo@Yj=DC4F_*;(q> z_eY1}S`7LhzBNK^Sixdf@N>K_j!8xB;xAjn%IGG$yyAwa)-pg!N|=wF)A$|g!zTo) z1qf1lkBm^$zGXP49RNXkW|ZK=7na1p8_ZVD4TQzPqOv(MLfs!D+PPu4;}UK2Eh4o! z?OTsp?FWEkA4dg3}UC zLd!W5E!Bp6e#7LmY?y2ufs6#%EPFDdeOG@GaIe|NG0OP41f}n}R5d%sFrB*j*~$Tv zyuLKq*Bka?zp_G~<5;SCQ4*=Gv=NJN<~IWx_Mhk1b8K$WkXvpb5+(FboA#rO8)!dT z{WTfVmWj6XIh?PCuW?Swq1blVzrG#ZV`m5IzowX_)W25-2o_n`8S%nC?jH^i6pp2; zM+fhP>VIHPQTplpz0^^o*17dVLaJ7XYb1R=@E+ zhkSOAPgB34{VX@|I}0=`11zo$=Dmu`@Wm*hGCZ7M+cU7r+WL$Y4mK}MQO$952$xyL3lHyC8x40wK^ClcSLXvM9)ndmZqq$B#iYYD;!+)XqtMCj-l*;fsrPEGoTgb!RaZ; z8(kM<2c|}o>l{PB{n8rODHmyMFELQb=GcQCB}KhD%HB;d-knTSFX!*J8t>B6)ytxZ zx={=mI_U{39DMe+bk*}UjUyK9us|QYF;#t~fc3v3e)hWiwse(T`Ys)r9oS)y)7sB* z#*_@D3;Gz&Sab)&8Ivi_Sen|hV<^s8VqA|fwLN1PbK4sunqpy?^WQIF^IM0+&QIz3 z;h8b22XNoWu#;Y*F?_NEC3mtoqCFI6!4de7e?RxpuKWgizmXkq738TslHx5`9i!{u zxi=0Z)wRaF=irzg4p6c#P(FjyMtg{l+#XOnxQ`sg?pVa^>8On_@|B@@m-NN79s=Nx-RHkM1OwO5)w@ymuO2_RPowuxR@iru+sIEzWwA0p zw!*Cl=^?Q_QPP6TmlQFO`7Z$n;ij;Il{BnQ_l!(A>@AEKX>S zXkn?pjK+CHd@3lbs;U#*xzePM+E|VnBPs#_lu@zZ4m~ z)A-v<5vmNDwHSQf<#hF}%-v&;^-R_CbC@N|aEQQjhn zXbr`3dxsVJL<<~*S98=^0Ck@C3UMqxJy=i281)e>H?{IhQ)Q#~Q>Vfr_%?GafFcosFFqXAsw_+wDipslUxmr} z>fwi(?NQhow+ULYGmarVcz$D(_2m(wt+uhVB;91|n3N8Y(E$?pI=fjP!1?syhw1)_ z*6+C;RDqov97J0Fn1q%alF=f{`u6UKwpujN!tE`QChHTCe@|O#oVM@rbrjN8W2Ws5 zP`gv(v^|o9w(-emOO^H4nj+fjR1s1|CjA z%P3j5{xhPj9%Z71`xjy#?I~2eF4&SU6fw+nD!(FjZ-?_2eRi<)EhfBTx(1pzCyqVi zkoER2iB_KrdLs5Fe*57s!GXWk{P%kPyORGt!hd)D5*#>RLJQEn_`Y9Ky~%BWxt*~? z)>kdUbZ-pP4Rrj5#}2OV_Spw0R@pO;Mzlf)oIYu#_d^F={v6dMi)!(De?QJSbbLap z`kZ}0TWf`VI8PkD_X_pm_AAuEH9D3p7pT9+GHtTn{3Tm&ekFk~2vBO)Cy(1r`lPu) zebhdn{VG+~kJyIllLvV^Lzir`55#q0f^Xbld6oiogMC0dOk?0ciQ#jX7K>;+CZ`+c zg1Rr+TH2UzfAw@^FxCsiBHBNwj>!xBVS7aL3qaS=Z`zeyyQ z+z+wjQ8q6O%Fr@KtuV`Q#u)WFdtARCj}q$VhyRzvOmok{0(F|5>F%o3p|ZZhKA@rA z#`gVi`xQL)aZcdzXe6FLW1Knx^JlTL$wLvE$M8koVNQGfI5p2cpgoZ*>uXY2U04r( z&$16_o!hTai+SIK&9G~cO|p|p9Cwn>cN-$%)i{%2m-E{PItA0f`&qO5oFGnF4lO|oA(PW>Qd zK-+DT^(y{-zWMtzHPc+1Z0$j5 zEg7#qjk4wOoc?9*fA@@6oA6tztak(BvEn=C`38!sHeTJ4GN2hg{#!=H*U!yX*w?&e z(onnsC&L@SeS2LUje{5b(}Q%L*yp+B3U&7=cE;_*G5=r!Mz&S)-uqBg`!0NJ0~ zG~$5e1U#b^@7%R9&A)`jRW#OZTShD1th$({@w#`9R=ik$HY(EQ|U#hc)`YfOvV6m*DEU^A_D`V6y;;J`z{JIG- zdJor`4hLNuXY0-{2#qI5pIc_@+4!6<>mRBS%|Bk&uQ^FHf3d93`ZS{XC&~JC`0JMS znV&|6#;wa{?R8|O2`7KZ{zeG61YEN+ObV3ylXpO~fhTs$gUpW7XdBNwP^%nt4&MjL zBz66RaeP8-o3w`paR!F$x6Vr7ZV_eu-0RTXCNiu6eFrq3PlDG*@zyM|-Z~+sHQCr% zLZ556?X%e@CE0xz<+$QBxuADkBEc{CS)7t9>vbnsoD8J#+;{O^5chS# zKDg`zjl)(_lu*Y{vG0xty(30~ubOG!Ca6{8;KqY*9XB(3>N65F zLzI-1g5q`XwcXZ>^u8jn>XV3;EQUO`5#3h|Fr2l0RfDni=y_1z^ASynkP_6VI9F2q zP0111|2fg*OQiH~ggDkjky{Yxv&yYVu*PpY7{7HluJh|5h774IQjd!$jj5pS|sQ3f7J zN4hx%wHPqR2M-?u^(}uy>yV)2*Jhe;k<6yjP6B7A2@QETEW*{S8>`p z1;zU!zo+d?PaZ!U1n_;iG@^wIW#%I@LDm(%-#ZG8Kafhx`_cP_)@UWlK^)Y>gL3$()OxYT(yG^5TL)IzTFpLR^_xeu)_XxOxkXWmMWrj{ zSMro?7Ra=w%k4G$#${sv+GZKhKHOilvrL4NW73#FcPeC39+$bPpU6fFiz#|`X+&!g zVdr_~PxAimGfQX8>VP_h5Z|mOAT5B7ED*Bs=2&A~Np zS$_hc&3B&lgN_(!t16cD&NK*CO_Ft2Is~iSvR;)A!4K0R=>M7A-U9aNhF?I11kD|( zz}hWc)+=}#B^}Cgd3=QZ^Pw4KGV45xpIt`h*StXFqlmWJ3wp_?qz&_9U(Ru`bNnO6 zS>Jnc6vb9-?YxiPdAOC)P@3~VR2#$WjrJj5C>JM>$AEQu@~o=swz!PSxr_wfKi_*G zN@JxI!kANj0AE-d6Ik*4sP+Ls>7c%|Fnwo>F*~gvUSc%&?}$i;e z;`jcj6?Ngq=ZIE67j)E*p7TsU`n|F~0{?qKH+23m|Jtj;H}_`|T35XY%|+)(DU0)g zV>l=9UpQXQGXEQjb0X5t`vF^S{C8UK|@|ng7l0^EoD4l(Z>0KZ($e z``YSt(ERZ4pt-{adJFG=n71EkIKymmJ~>D4;=5kiM*CqS?T4>g)QY)O#*HZB@HXBL zxr|pm!1gYfp3WPJTm55{Xd5ZL4ma|!>^RX-2i15OPMUFc=*O}9Eh$|XBToPJxvhbz z%)e0)A^7CB!M0~~>By4x zDjs*%{ZNEqkxgWM8;az1zXYY&Zxky8{SVJ=6|8X3^`5Bi|6P>&^HrtFt;eX}Np4{D zOzux-h2ULgx#d~aiY0M+AKw`MtmO-;*`%s=^7MiUwxab|L9DV=BZx7^eoOr_od1@{)WdW z-j>f}+I~>H$0P{gTpE`01Dnd2oQgy!EluFZ_0u>%KjZv#bAC>58!G!^hP%@qwq{IU zlf`VAJFE;_j>pyZe)eFL>O=n-(uQN>*H&nJV|!HFxOEb}GwqfN0rl-$b;kt&^zFN%bv?chfyFP2}{M`SEX^ zr0%|5@lM?q$8$hluy3s-#EI#!a^$y{%(W(WrHA{2YD#ftnC z1b#BePfozIQ1Slgo|yLctwY-e>*)Ru#oND?k56ucxzp4xe~uAnkCaF6Ngvu9p|J>1 z#`G@v7R5X5o|wks5#pyLrt>p#^%ZTQuwn@2keR|>hY@Q1X5Zsy|tL~r0`|*og zhwG6aZi{NCW5ikImG!-6iKYlpdT&A*RZHV#{F=+WVYK4y8`RUef!WgtwUenytbZxP zsP;enqgK?zB|IM1G=OHDJ5V2@?z^1s$tpPRxTp2}Pb*t5)?DAJ*WS=NuxfTIskEqx zm@ohC&NM87@A0$oyW8uwMm3j2&k`CHila15g=el&mv0@uPt><2zc1ZzmL$C|9lmcC z=^3J7uQT3Fv^6%M``l~KGF#o%sYdLE1J8FP!!-q2|H}?`PyOc||NfpDB=Eg;GJXdu z8f^g6RF5Cjh7r8|p1DSynuOm!C*#*9>pyuU@_&9;ZMqMB`3xDP<>(d@E$@KpN{`cG zPeRMn$!JNH^{38||EK%l$=l=i!EcypnIWj1qvEt2-!hz*b;)QMCF>0zCch6(N=sIp zmdp0WX?e;_OS7O>WyWdQpM(})GFq}^{i(wdZFQE3mW+QxOKzN&CroX$)=bMuK@}Wv zT6QI&S@*_ecuQQt9E^FB;&+mLwX zhJCsagj0SAd}k#g!0zRQz|#*z2CH%*QLP#ir)g0Vn!eaFoF>I4>t{cR&^v{H zH=fRM+s$M&tufIw!c3E0QY#ALG+mQ~rni#Olq&0gN1Bq1t0A@xSDDU#t{Q6FkhE>b z$J_QsQ`>&lV4``Mq*fKhX|^VzSxZ8*f4r>k{ve{Q9&e(#;NSGK;y5jj&Sf@cNK3n! zmNz6-m=LF>r(rlPtCP`EEbH=IXkJ}xqNRxI?}zGaOA&Ftx z;=ZVGE;JkE_gt2+f0V%Y+LDO&M;lwyf3+%ZyZ7#DXbxW@rMRA8>yTV(!)xgw+F=`H z;=1JfbD>!QplOa1;>_iBUg&22OZQOhf$Tu+N6`FXJno6f4x62ere|&GA~l!4YsNZa zxX)4`9%IxpL{56GrS&N*G)@DV*=^3TQ@hQhBIxzN?iJ@9iD(@n=zbB}sztW8#=Xh8 zN*0f{_jpX3u0-j&&$y4j{RQSnW7yJ$GueGy3qbH^3dMw@u{Xy6IA$npzxso3qnd2% zFAIy%{)5qF6h|EQ8vAD`UjJP&twjW#+QCZ@JWKQB2fAmlwUXzJa&>&e@O9(92IlYd z!V9d9`7cDZ4pG)me-xp(y~w9)beZb8R`D*rE2a?<+Hw56DT4kz0LKH*M~yvB@G!4) zcX_-{AxWK04UE4Yj^*okDXN9(IygIUc7mv0{z6nUaEwLR;(hlVv(dd=1mA9v^&u>8 zKhk`G+4kT60<#_NH2hTO+&JtEeaw=GCT^6Q44;boo{wrBmq_VvIF<|ck6~CYHJ9(~ z7>36!4f;Wxmqa&?qjkWr4RF16+nxxuhw2ts?2W~HB6LsN!);^_ETMNIG;UBffTLTK zX}jS#Zu*?sGL&ppqFS{T`cQ@xt5#OLek=4rdYSs75X0Wa5cHX8 zZw3`I}^dWTL64!89&eCxT6dMVTSjF@_sfc zx&$^)eEm2y%?q5Lrq%BOZ*KLVv-M^st zzjgn4mSOeaIJtC8P>;9?FRLKH?!LBoe}0zf+?UpZNjP_o35=+RW-IrhF#3xyh^@uuaMVe|@ahKj za{JJ@skqMOa{$H073Fr+&$ySTIE7`*?}99Vc2aL`CDTCHie-HvTs3_WKyV?$Ii_p^Ynz|3=rpjKR_csoXwsk1r1E`BEWaeY*?0yv)CF1H@5 z6x7xj(Ud4D&BnHxD(n0I0L|emWj*(BgkqI-jw(~Drz+mf%VTl9RyK4k1?k{hzBr0ZaYr#c}p&AHqrGfL9Lp`=qloLHH=iepAh0~lJd&_C=^X^NR{>8X@c4^ zUe*o#xL2a=zB9bzhSsgAvfi^mZm))C7M_V34tR&}}skD5sm3b7nKY8yQLO$erC&W&Nyh z)%1_39h5V0W0YY2(pNVRZI8|=EPoHr-#t?CKEv~`f*EDgK=HO9U6W+JEJ`$mkka2K zlu_koWxQ|DFpAx6a({T!+VZd5mY{X8A5Qnlt;QbEXh)nc%j`16dK;JuY%Tc;>x;PF zn!c6o3B~aYn+WwYA+}cg;)qsngVQGk@G(3fcAw%Q#E1!>Ke*<3B_ZxaI`}?Y6w&H) z;q+t?d_@%3Bu{m&U)A4Xll4hQIo_TCK71C%maa|<^tooZ)hl;%Ulm|+uuc%-TxW&8 zi+?IpPjesqj#ODMqWD%7<>&VZY70PVg@F;bI!CoGj%c@Tj%ur{(1)^JHL6TS`O-VA zJW=huO7Y&ench>MzTOH4x2?`mk4rg$ZP5HQ>h>zGH)y+@EK{xZ#=6iEsJ>e9w%r+{ z*Z|Ygpl?-mp1Q;e2UqO}wSSMGF8S>h>KH-smg0UlRo1ISx%~(CM>LS2gxY#9j%eor zN((PZrz-$_u&L++hC7!R_;yi5yWhtA0iR#Y>>}-o+6uD8kO54b(S9%jp#{;>)2n z(PQcN?nM!8l?T-F6sW7ZM0~F$i7PQM75mIbN&MS{K-_*(2;Bb-#YJpmzWNUC?~@aF zE5_z^l;PNK$angsMYwHDv8Z?kJ$M0J*&g zz%2u}Hv?!7OM<(D<9wqmI9^BmzdimxnJqmyWS!!uO}PzS1|A5G zS)(mzJJ_#N_m5P(Z`>Z!4EyPB0ou+|T_Obb6QXsDWHG#OtROAL$6}g)6zJGDo=9O> zBCircaTxE8``uI9Q8$1?=J`Lc$+{xS`VN#y7U)GW(x%zix-g?9qWP}@9@7-uTQcJE z+IL5c#tfrt>`R2|_tch%R(*}!j(ewFBAj{_z^91f&RGDb_VY3O5dMO=6Tc7eyXCF7 zMYN7l%ogowh1pexb<*}-SSEf^Zin^xSxEmyZa@DFAsVyoYab%t3zFbA?|s74K!17h zfL7#yHl$sUm98%q4`@m@w5_p1-z%Z()NaX1+YszZ*V;Syn9G8;T!8k%jY8}5|77-r z;Z$flvUyVzvyaFNR9hAA-6)q-&>@sEH@QiN-4+pTkGW}Q7X9USQ+SrD<;gqwFiyI2-41u(-G|{ zo2(xzll3A=+F4v%GovRBN}d5IEtcf+rH?>eiv@huiz3=H5~L~hauZnK{o-2xjHQ#I zPOyM)R&CLYuvn0W`V_|*ozZDE&m{AD1wGRXMwtQOD4;ILLpAe_<9_e<0TrLPW&lCi9hptnLM=IVCcf_;~ z+`nXj{!c=jm>1XENYB*I2(`b(w3w%7q~eV(i)n{=f4**U0uIj*-}=9DKMF@++TsC< z5ph0=uPf@*Zb=MOi!Ao1WMN#9s@rY z=d{o0Ue$e698+5>Fx;-@&6}EF#p?dvTVk|5b5@k}V>>!ml=Nf&>NR5MOS$fEKV$o2 zC&e9!e#Kg&kVdKh6}Y6@=u)-!RJa5 z(x_k5M!6}vXh7>2Ak_95)6IhXQ}2r4s}K~g&{sI4$|mbh5Z(=!$$F3EbX)o&ny^uB zBKwO@2@&E8io(vrHX0AW8QxIc-vZFqlakW<wp=R4ta*;fEhaOi()B{H*SO`j(j1Tnz7@;b&Zw z-bbZf~~1txs&;)I@E1r2gquRygRHsCZrP zT&MoEhUwY$RydgZ?se*xiMW2w4RqG9c+DLEZSWb<92U40pB-ZVbo-|aTSR#GIu*x( zp$9#eDPBW|yj&A=!iqKhSa+}(-VZN`X<=^9b^23gSK$|xb|)xZ?Hm04_hCEJzTvF> zPZ4}A8`kv~Le8lg0AC@DIrR|r{mcziPg1;3*Tl4oHc-#uo^ivve*BN$dcLQ4n`)>J z7A@y;LUM~i22JTuw;S~&v#AYuQWWoU{Fcw2t5Xzj zO$}S8;`5di#k;g7rtQ9&*{Pz8_uJ#P|BGv4&fPp7a`gV!T5(N}bWH$RKXxVP67IDZ zf;vkET+_c49u2w-vR(wjOS^HOlnw2YUDgi>(AHfEYFHAfJssW09@w?SDEruzL-(-? zfY0q?ent$Z?CoJOGL3$?-U@xP2*E#Yh-$8piWe4$D&5a~U{U|IVQ73Uuqxh__nTrN zCHNUrOg#(SdQlSG=Ood6L6Y2OB}<^t4s|O8@LexJ@Tm<^ts$YFw>HGjKXBhHED+Ua zG0h02Yj#acQ>eWhwC7kr&&`1L>~zqbGPEB}vfeb$72Rc^9}^+CaRWcA_`pK#LIejt zbDJlsdz0{3c0avu$@*@59=3+KAW4DqG@h;$cus;giZyrGqHeT8-#L0WCI)oL>W)Y@ z_kffVSXB+`GYdpjkmT}i5lV4B=#|C>j!F6MZfT6W8WgX__X=={w9y!K5(K~cglLKl zbdVT!){TVWcg{}WtHPmpLtGbm7E)}-w(B-TIYvrBpwppv@7fSQBSKy;ZHQ`lDJ&)* z*0=5xv9(*u4y+ju`uiXAGjV{r7cUYY>KKY2LWtHr4A+D0!@DKX-6KivW0J+)D_Qxy zkIj8vN^$!Mjg8wz=WZK~yA}*`-q^ifb|90GVX_~bBgV?QKOc0=yY@Eg6r}Tc6OH%8 z;xv*N!;4Z(dsJbv+-|Jzc7uJo0J2_OAnO9fjGA?r&EL@IYAjHjKOtImHPCn(enIhe z{|D0pwU4nllhvsSd(3&FdV6);-?LbX$CX|~@eIYmxYD$JQtSW_v;WqaG8zYMF0fI#`9pX8nGh%0 z3h$qgtnSYxi~G1F1$rgXJ%Q?L=0_uf;w2L3_Yk5*@2_YjTY<+`5r+8M7=7&gPo>uL zOuqy!)>v9EN)~s&WOY{g&#Y#k-fw0!%g!WgCnb zf)%Z1n>>gAC*B?q73w@ zvQD-#Ip|yti84U`k=J6JfA}~&A=v_-OIEiP6mL^3z9(Y3Lkyf9#OGwOlnna zXh5(*8$DB{^KA}|mEGe~y!-BCdmykvP`Hobmk#pTB2YVGS26Q>oRXyPzkXj-TWf{B z!&GLu%zu57;$2Y{(+nGWT-Pice9jJRnWT9A{Q22QikI3bR55>P;QA{O^XZ&urr*Kn zFIK$Doji7f0Kxaye+T^&6mMkxaM~ZaFG?|+4zaQiUgT>LTJ{9Rdlx^m><}RM+Irgl z2aR%F6BRF(-J7J`wf99S9>N8|Ty8EaccS85cqcm>3j+k7ODy+$3{Uiglppw98skP8 z^h&uD$JmG=+0FN9VJVNs0RJ8x8~^isdW?;k6i~c28m~s_vVh{my(iqXs zkmS7WNy6Kd|3}_DQx)%5cQD?5Xy#33{i0#2;$4x1H|$&gx4iA)yv3r7H(ZN7mktNF z8F6&^*fz$su{L`EWc_#<=vdC5(&6CYe_c;w-$)?qk_c@zMQqL6TPExOBg*~^h}-7onh2xjL&=BiZ4++c-+OBRT#c%|Z9wOMZJ z<}v^0`(xB50Oy(RbtaiNvRFEvQ>zV&cK7eD@_ko_lE%rvVRU)MIQagJb z$9aJ>cQBkgHb0LEhKw{iI zZ0G7cnc4$Z1GLo?$od2kf{&YJ7Z%luX>^@_5ZCFiuZ!O+qU>(w{ndQ-Mr}l47R7#S z5g@oZp**1^Ufyrl4Q-E8{2coLAsX@lP%vF~{$w5X)yNv8Yoeq!Tpy>aVO>;1J&E6|Mk-!Ufkj1rv(`to z>i`^zTW)Uwd3u!9=N>Y($l<}ZUUSl%BIR<%x^@UlA8`_O}J1r0_#r8EY2~77+4Wg`< zX2|*z0<^Jnx@`AbiS=9HYB@@LAV3My`8Kb|<&brwE^Jpy%il$Mu7orW$_b!uUO(|Q zogqP*=3kPk^7Kg8sz)XDJjdvyzWpKud)Auz+bxn>bwj*e)7A~&Xa3hZ)`#-|9LFRG z%(6gThXB4=cBpF+!T0xs@^;UOmv?b(+^*?s+%r$6=hUZ*);qH%Lf$nZY|Aeyy75r; zWK*2w$=I(U>k{^7Kd6g-5~IHw{u(idVd!0<=cYJr&1x$gL|y*m&7x}fRYRK6^&d;w z8pAIbK8HDh>YEhr++}osL-(zIQPvx77S*1c6mQnjnASYFPH_apd5U-B(imO$sAis5 zN_3s%nx}YQUpriX&R-YRYyghxVu8+m9fIQh;wLe!CLQ2$;`^ zFz<>bF%5Y{TATU#kmqK_`}xmeTD=Im8RKWm%?uae=+D@mPXTBXEbMHP;{{~Ju+QOp z`**xg|Bm+=-|^n@UFA!yN#7R@PY*?c`tjnJ(+|v6s>2lLh`zHYd6%B#T}G03jwJ7j zlDx}H@~&X$JEZgUV%jfR{Pqm~Yccw%+&(Lv-Fqe0i{D%pxE06K3jCfxzu8{iCH7B0 zx5m`x+9b7NdVHLXthblJRo4iI*1= z%B`9aFZY8r$$43tgcsCpw9WGVf7)#FP(Fu!zdTV6Lvia-9~x`VYEf=?tuM?HCPVvD zJJi`F@D)o?Qtg)8&r6bfDM+>RCGfcbuE8`b&AeW3QH5W`d3|b4RIAClVG8{&Th!fL zmhQDomshTw@6Xr7&sC8|VQrM2%dFifHx+_|+6M@byK|Q)46zSr5Oa4Hffu7EL74K(+I12&FpAhBpH5Wuk_(csQoDq(BMQx4L?o zis{!_;a~;DI=os{@}a%uzelLA-5jCkrY!)$mUP$$x6h_nMfBZ&k5D@$=yN@vuI{@z zqE%rzc2nAx>uFkihcx?bvOXQt-3#h13uyeNt2@AiUu{}@-M%2A;aEhO%v#3c=E>>G z-Qd)IPrz_IYNcsn9V(4Xuu9TSd7Y-#5^;Z7N;c{&WpH zZ#zzivpyf%d$?Ysdxyb0c_FYVMl{HPTMI2vH(6l#^m5#w!&Fn570{xN@XfgS(V0oxB4yQxo;o=z-@B6$Yx^+o%53I7bidjlm zg!&)LdiM?<%ei`*TK`FU`=vdCS^|o9Y{!wgi zx&@$&*#}dUm5sIC#q()SCZGpOOX8YcyNQ(E3nSLtS&$t|dVml+gBG!hG4@8wI}b z1dA#tO4pLPF|B1VUVK6<@zLOWa(+ZpRtjpvN>H(Hqwd(|7u8u{IpyKH1L-uUd5ESF z)IzYFk_ho_sGg>7Nm06ds|2-T70|WaviT8Bu9e#>#^N5JAWN==b~#1XyZcFrIv>X| z#Uk?d%xC@5)lYl|Pv^3CEm?!I5ESq3R9PQ0KcclPVKH_8)=zvb_X_Indl@ZT0DQq} zq&Mf(o(S<_n+YogRa^<`ED$NJ;1|?c0H^lo#J7gi`U)>2EI9+^Sbo0T9zIV>T5Pg@ z7p2ch>3faS*POL0|F?V&{M)>U7CuW#@&6|%zq6zi+owWMyr0Zt_cK2MC_&xG`a>SY z?RkgVEEc(&Hy18!B*giYP1esz7S)Im+W?C9ck?0|oF;T%hvmIJkLt*_Z+N`r9A!&a z%cMiJukkZWH_ipu&yQ%hA39tus`b3D)hF1G53?Pwbg0AcRgE}f>>TRJDABM@TCCus z_c7^E2Lkx8Efi@e7QUfNK1heg=IUv5AMh~8K0yp^E`HM8zjWpk`4#K|3fN!oMVdmQv;s8lZOl_G0F4qry}PR+AKNu7&N^Hq^q1jU!C31Y4HeD6GHNLXagiG~ z7A`dCId++6XbfEd--3A&4abjp?2yV#HJOhyjvH*B5c7|y>!fxQ*@5_7-u~xbH{l4H zaY{Q9F!;>2BufG6=3BvM%xV1oJ)lb#_jsN4L&XAZ%{I98nB)u`mmF@?3ly7ktbr$QZ3Hrhw(GV~oekf9p(5oQcwL%&_X{g9}18F4_mf1aim{WN}O zlg<6_C@$;((eOLPqs&&kA1#Ruvqc=Vqs6iRMw|*$y2`?Aeui)%J7-m znRSd;^#O_p8-KSlPdzz6{X^pK!iDPj0ir1br0fXli35TvP+VnDUEw_Se|N;RmIx_< zRdTyOLP}7V&^fk$K|AK}A0S$bPT%i?{@FB6`je^99?VjnenJHOZ*;DBxphxE?5i=I z^MA8P7{t!ktgx?tk4V=}7d`3fz*Nwefvoqg1Kk2jSB(|+)yV1U$YpZtOuKw0*H_W% znCEF7e`959_%`s(f>EdL0{qQ8bpY5it~VxvpdJy09d{L(`5xP(Jp>g`gil>nZOY zU0HsDc*^ Jg@W%5e+#WLEERL0A-L*_P1Lb{8*%xqISEH48x?=|^QhnDAvr`wC)f9om7Z%8w~>jg{b z#KOvQ`t28$hozfkN@s;kY{NR9?&Q0k z@~g#^(23uB;%P=e=85!#vVL00(ycR|GYS2dRkC#T z!(}!k-BzA%d1bkM+@?dcjVzFP_mSoO%h#{yKY7$sJ{P}Ft1O=@*g~H>hw|_??;~%U z>c8{Io&9fPdkye5&oj080_>wHp%b;kdAx_`e+28><0*d+(nFu`s4PEGu;~!i^R@*t zm#;UKf521z2-0--hJH-5WCE!4d1qxgO>c+HyN=x1f9Lw;{ZsJ$F;Dpv!5TXLSY`R! z1)C1-<>P3@kvsbDSbt}~9luGH<#rsmO_k+)3pO31<0J#=U)H~D{T=b)^c25hPx>!-3aqqZ=-@Y)i71P(&G5TtAuzbioxht&|$K2;ydTZ^G z+WwVCR`ydp^l8N)9r)cMT0(s{aUFG~hn9)oGg8@j$9!z;W`z2-ddimxme8r?o^qrU z>#Vgx=F0Ue`>~E%AtTgxw4!_)q=imR!?Btg`qIhD#I#7)T+EXRnR9bk*_iL{BX{@D zMV+r-^ByzFO>eX`xdKOy#6PX6?v$ep>IIit?L;w9uD37;RY3TuvJ+ zKO@xl+lum9AvN@68SM;{-BNJ%*eMR{cr0oR$+CwL2nP?lu=7dMA zkcoN#%f|7~^4dcu->snI8+9hWw~O{r-#Vnt9y<9`Rt|p8$c0S%n0S6W)+>3+9~A7N zubND>WhT&es-oPEwEYo(Q$i>HQ87ers8=x03Er1cuduwR)45)Mne56K$csdama#W3=IS98+&w;`y1b@sw{DY@x4yZK7>V0&Qn2 z%HKxXUdLZ+==et_+Oi-Mbt2}$wF;Jv>jswB8ah6jty55E;`>uC*jlZkHPkl;>9dB8 zPxX|4u_vV!%foayws389;@9?8qpZD1XN{-)0l^yjYL|)5aYO0c3+W-$i^rQrv@Wd_ zPB*+vd^2s(hU--8ie)plulV_lyxTNEccg&t?HeQ7M38k{uNv#qi56MMwX3l{ooF}KuWWrfG2K|dvi0f2jQIL= zq9eXOotPJ2pH3{0^~F)*yc}eGt}rGvMaT`=g`Ch!LVD-~I6^N8X`zt-`rD8l+6&`D zQ!SV`D}*{Q)dITPF6&c-)X)e!=u^^V-7bs>+0#LvoFVHcz#dA;0R1wDtmC|BbAUc6 zPuBN>Eo99D{d)z}RwraB0R6jtdH?aeVbd?>FwAh=Lp*(BB*BLNwV^&Mirj8s$b=>F zrmER8^$|ZWiPT2W1>y@&r9#%gDr;-L9kQxsgT7w^AArMMXqV4)j0E3#E3}Oj6z@7w zP&Z2XH+70~xw2VWI7`Z}-LhF)*qsi(YEj%7E>yfQ`Qv;SK6!`PsPc$v&9kCfjD5fYYB7M`BSM=&OXmRb zofDz-%~;Cmhiu?`Huj@KhFxLnC8D*&Dh~yV->|1Zq79 zry4F1-w8sTlFWFl2FFdvUkx~JYS=6-42!U{9&%1imcZxPC@l<%(z{1RIQ4-j?rf!Z zLE_G%B0Jl~{Z%!9Zc^4tRPEn+HPZtSsuHFLeA6_8A zPC}fnqEGVQEQZq$S-^M1CYR?;{VYFE65M%(kX0^1NsTD(6sCThUqjnUa=Qv33)`}} z7&5WFcEwWYodH-N^J4)@gT?SZwk_7Nna9FC$8CTN{$^hyT5~aEQGW+QoPKNzY0OP| z6FT$rKq&u~5NETPlctMMf_0S^Ko*w2+x>BVC8vYdE!yk4f!$Xa{p3m(2bSW?V7Y>z zcwI2&rrpJz`2q;#NY_?EoLH_=Min8npM_Z*$*%ES_Vm~=eO-seF*`E}q4Bq9+@lP0OeP`VQkX9e(m2r$_ZDrG7P>Y{3p)UOHKMT7 zGx;srh8~dIo&w0K5`~?`Ae0Lh$eg7>U8@MbS(l*hB=%8@kSW@k{5&Asgu3LxIT6h) zqYnodMt>0qnWANA+D&sJnh4-<5#sa51hr}e(LwP!ZpKX zf%iR^Zag%r2wrX=#0N$2ej!MwI%CAQhSx`ZV?pV9b%1Ceh|pFqI!?7xA8bLb=lQMwcWqd;808@%MVRlKCwgqJQ<#rvTevyDp2jI(| z6Vb4LeI3X5;AfYA=QJ|xw;~=tWhua^@Pu7UpqXJOdNLJngB2QG%1CweZ80a2(vscF zxy}4gA6f3#)2s2g8cPMr-~K{q>;E;hBTbhiDNvXKb=@NP!pAIXcp>OTRyYW&uTXmq zfF7O(dghM?jPuaon*WSyRYfLz+~@v3&fYyfs_N<=Ugw;dNeI^@lS~qV$$<4T5>c6u zpw^rO6)S=;oK_!inSi$vyhIRCs2&2fTJ$MLMvu3eAbtAC5nHM=>a?~dprQgABciol zW)iSgs15g=lg#Y*v-aL6GnoW^-rpa5$eeTb-fQ31UTf{OzH5vI>S(RywuBz%xpf7h z^{$|x2F|@bp%(zS%SHm*&%A!w3G3m_bG5D)!2Aa1^frda++H@c-iK~W`7vUhrMENR zy*2=MeBGs+yXT9V$@3GQ)&L<(0wbo&(O8oBE=mx^er98(wa>J4;bO?8cq6Oi4I_Wjr>g=){I@Yo$aFdzCaQrOZX4`# z^#&mx?E7jbC>wI9A78k9q-F}|KEoBNzJF<(c)7WR+rB6g>}ya6YISfz+9FM(FMDR-aV80 zh*V!vm}wGId~ z+?G;f;#&DNaV@-t=X9L_iaG=6z3Bph@wZ@(94&*wMqiRB%W@!!=j1~GO2Z6x7keD{ zNS17>Szt~DHSqG!6Es)Cm6!GDs-3&LzIG7bi2*3bF0pjn3wXxPVDrlJqR9hy4MXlO zrIFOO&wbWA_a`~dOa9>oa^NvPsj7GRfNi`)8?`6I?&<;JRVUUt*u_1!o))U;Jz&bt8f_kZ>1A@ zEJAurN%WnN1Y^aT(b_c|&eMXTJpH(oZ!B?vR`v}vIf~?aYb8+jiXMs+jz-NAqW5hg(A zTQ=_>1&20Dpp-3u(0q=k&?-XM&a1kZP%NX$_tWcN4_d>h)H*rQn9y;3*#3OKUd-1? z+8wK~fZ@hsz29=#)_y-fBVQ@KcN*u^(&-GkWHYdf(43jK&g`T6;jGmx{_#0?M*O2X zS}Ub{;jf#wjUIf5w#*4VdzwdcpJBIwa|cRN$93>ndLP3~Ho>+3M&sbQ$G*7npCV3_k|>F813u zvrk`~QTN8NY5?V1T-z^mJo|LN26}e}EPjUmtqR(3_`=5}$*}ny<3pm4#k~m>S2rDN zm`nn5SJKkI{?Z!2)x5MZp|2jr@TYKH)SWs`gB4@7I~%!gIO<|T>s|TOzr4s;z%lJ! ziZQIh(Mh5NUCf{AObL|p8d(f@W_{Q3`mik=zyCBcnI$$!HotflLO9ObzqC@kI|I)c zMu76b#dZ$qLSs=2gkqD}-Y;lO=30wCrtI&{+vlb=v z?g75Uux>v)PO&E<-`twe#TAezTn%|;&~UgMnoG*I3Qem4lqCTEibVB{c_$1lfb`yl!dWj$Vxx@vz&pitvoQHjBIhkH~2tq*tBHfD;dTs8|evIa0 zw^2|7zeQfc>we)T8b|BSN+C^!cVE>NnS zu(fD8&D9j>=6Ei)f616G77qXph&*_b@kjaXRRR1*C6DjrTNp;#?*C@FrOv^AWW?Uv zcjgae^sBuv)vuR$zq|sAgGb)iHbyoV-NbN9WBtT`!iDm0zVXt3L#PwiR1P$?qpra5 zJr_R2;+t`8-k#Cc#-dbP`l8gl{xPksD|uVH2=UyIS-v<`{#T1qd#aTXPrU=0WB}zv zlFjvg)Rk>)xHr$`^KRoP1H~PPNluDM{%(TBsLLCQDY{DS7oh)m3AyLLjV?OADa6KDBT zXq@og_iTI}*+f|h$8g_`5RxSpw-a}zp7-7eAys70BQ6#%*Zv;S-w>g3U4ket3s5O! z(9lqpqQS>$5ONtG`|Bd)pU~s&y_m+*>+cc$Z(Ob{05$NQL2 zKTlybAidfm#&^@_%06>O1ld`i-p<#Ac=kyyqg!$s^$s|+5kR?_<6s`iYAN}S5YM$q zqW2Txae>;2GV+^*cx=9NE$#oGhxq*2_M~1(^0D}Ahha%hqwg#*Q74+*0HG5UBcQ~H zQ=i3rBMa0{yA8Yk`8$aYSxi1&#`Bfs>?Z7NkqV5zzE5oVF8td2%wKA?gnQL(ye2?p z{?635vE9S?91YlO@0*Hj_A@t5{9%ls*`E@!Z-2(VmlGts z2O#pdImz>Y40Di-}kZijz=K$4?;ZlK6;V) ziLM8bG~4!O$0&Fmvbpp9q(>Hq!RZ9qED~5A{MDnN!~1%jdDXiNKU4G!$o3snwwLp? zAI-C|Ofbkk8zb=&^68wW~j=nFcmrLLeK0tHwMpikYYRav%rUBeyc!K>J84TXod6=4r3pI#@Q89ctk6pC@#zzyB9W9ox3) z>Z-|*MLnQ&*HRzbM_cZL&E`jfri#MmF60NGcB*+`de2h>OCMmlDvsX3cp1u6vE|ga z{M=d*6z@ni(8YNhmizVww$9?qm8zZ-62PDte*sq@eU9fpV96{ryA(uxq!ajmDJ0g zAK4^0K>J+3M@nz$!j(sxxhVDc-xssQ59HN4Njk(tnP$W>HK)qj?9>Rk3%P z{rguth~8?E%C1`m_Yuc+W0o2iHO$yPdn?O1S_KgLUqU?T>%ijJIVRWH-vtUFj+bFw^u4OSd19`Pif)6Y-Srl)r6~sLLQ{Q3y zXn~Z$kNo+XFn4%7Uy1_*ELTsf1Yw$cLlS)(f#s5_-p%n)L??G7_+unPpr7yPUb$z}Tr#UnW4gHp(b9&~j9GfY94$@?43)cGg?L2 zd_x2p17@aTZS6Qon!mgZ;E=aSzIUVmidZB^>p^II5kP@#+4QbjxdA{}mmZfXr^WTs znBrX6M>b~66emLL@K;U)fCP7r0a$grFza$Gm$!EsSG zH%btm2yztP*FkCC9R9wQ#?a$;tWUulFe%=$qwKt(2vIx>8s8=~9}cdW(+QJ-JJ|UW z1pxXT$`81gg7_^V{uURQdtL1AXXy@>2WpE+l&PQw+IfyBJ71ia-`l0j5z$>q4?9!5 z+N>Q+FK8YG9d))3IN#qh(y9Rto6`$ z_w7pRG9i^G!@uS@+#TM1`Px@=lAcVQ&!B_heA;@_F-f8^8C+NL;XY~r79;wQ2+DFN zbXZ^K)BIFj+03?`eI?^VC?j2QGs_d@9l>QF*{vsUQf4PZV0;dchlzD4vlfJ*Zw_P%yBd*8wNCOANA6~UZ#oP^u**d0?_ z9zGP*Ft>UZiG z7Aqg3d!xYkYG+cHIc5pId+2QzgTE_DWgwdKEuZgIlzk2ku? zK}4YWaga}_oyd32NfJA^BIP^XG$u+myCk=9DyV@$JP1xA4m@N)mQQkR&uOhdpj52=TNzQ9jAQigmNSTL5a{@lnvR_ir;y|67D&KT@3* zrfQ?#Ci+s`FC}vH4G|h=iJ%1YWOFHv(`T}A=nrm9dfUcKXStX6%x1Ab_C2CF&(5p3 z{rTOqlN1{#;)2{zGiX^)LP%}Cp%>+ZLvNwHS>M~0WNVO((W{j1*aa}4>##mJxIQfn z$~o32iAH=X&tEu`-zm%hGj;*)PcUOs>HksGzYo4e^!vpXhfAQP3?)LS z>Z(|kY+l??^sbe16#KCnKyf%^vjyN#DDTM<>|=uq<{bo@uhdtAIz}&1N=#B25>Gkr zZJr~y9#$Ui^0bs(BZ;$u(EDmx+xZ8s*`$_WnFxOK3$+vZAdW@beJeLS=TQR>&Sv*e zUrS(ExId}P$aI%&9yL%qJE^~YBORlyagQ3nae9>y&$1GT%GaxbudBfH?qK#u90%O* zl?fIriSpUkRV+_`x0Fx!c}#Lq`~B=B(OVt3p9_s~2_}C}BSimScIQFI>*sH=dM>Y{ zHW+HpwE773SHQo!tH7+k5kfy3EB1C*A+Kk5s`7Z`A)fQ(@erLTjn6A`K;=XUD$}2r zI@#}1N^>E7cESbos`|;aC&aS6uyb5hwF_wO!*PV^f2-}-%$bAbh~T-PeDh;V*CC?~ z5i0*lh^HZ2Hn#!zR}=DTOCBfHAh^HtE=56d_&lmNv=cvO!lLhmF<76|~ zM_w&!yYRp>o79p|xsS;nVEOOx?~nQadvV;RG8}?(fN1pusC)v{z)~Ljdja-yi(A7z zADar4r`#_=<4y^bh8)=x9cp0dbD)7^;?n}u_cn}&$g&*SoDOOLzpas=v2i>oF-g=~ zL^zY@lIA+_X zsexZzk<`D+VL8OV65&8Yf+)0n9)wqBF<$vH@|(QC3GcON01X0g6kOptKq_sbGQm-|WNtbulmeUEcm)#m!wtUNi2 zG6bH#0?1K8f+|a3wBq*<@HsduNfg?~Q4($!WwV>xaIuZ+v5g}nl1FX-`9?RjbrufX ziylj`oN76QcuGgHzTQdKKuKd;KT%3}Uc5#=X1;!+Fxw7$#_}t%K6O=rS&|@nR~6IQ zu>XgKY4_6v(aQ;`{5Q*aAJ{#Rx7K6)>`kIm96^wy^$z)P5cN`rY}Srrct5p#E!6qd zfa3~^w@S+uZKwHe=iM~Gmx_%USl2i?xshT#)-OLOe%ju)UmR z?^72mKXyCOM-k$w0yThqqLA_fHCpb5btO>Wi)F0sME?rua)N^6{l8aIHjnYcwvE8YnkD*T?cSwh6Y}m~Y4<<;}Lt__PF3 zbtJ_f>wL|Q(Wf?*Qsdq}qLUnG^6n%4)!UcnXah6GY$7-{X3GW*b4>j_#?yGCNz| zoylQh6{yYZU9NjZhu{;ePQxd#^}GTn^q7;tOwXH0F&NG%(4L7~RA;GO1)+Ts7-bGP z^v)H&B!u# zAB*p%ND%6h3JlubgN3x7`+1vZuVS`PlqXk$2P(7z-nZH~%Y%D9 zEmzRESOO)!?h>lY?-wDY+SmXYxgvuuP(HuFqH+w*2ldy-_R0&j$#F}6n)8W`4p{G% zM`)+VEgjDg`pxGailNW$wLM1pcKfcah>k&N+|unk>%%KkWAoG#mTt>+`Fw0XOnZOb z3Tps!dL(~;U?m$n2hZ0k+3O67H8LGS?P>TCgMIZGt}CvYSwnENQu*{=I%es+KDH<} zeZ>N5QwVsaG(4x@6>FdrYd>2s)JOW81&LvE>>Z)&kLT_ktp+q)!(0#goTPH}{pn+i z;-)87zLKE>iiSOJ>3G5v<03t;@|8@tkw@M6Xc^QV3XTJ%9^g=sLk*npw3M8$Mx zaWL(;kWFzbrZzxGwiTcJ%vez}*Gtr!i;G*>mP zo4$W|yf)FH26{i{??-{+c0x~RS%t>hcN<=JDQ$nP-Tp|{{^oiJ2^24b=S`j=QeN@Q z1_;GxG5_+17ID9x5ul{gl*Q?JF`L!(Xgynxat<3G+OEply_vT=JB!7)99WppkB_)| z+A>L|aU#DYTBC@;WMW`g}{jT2KSJpaxXFXK8;A z7HiLmYM_OW@o0hZ82aww60J^915faGi@zhv&l?hYyf|$ybey7rIzijeFnBM_0&wFx z8sH&&O0@AYOTUBj5S$ZHR0DrB6RhszM8WfZyc2qsE>D}^em2gd?D_3yxro(z2&to? za^SlQC(!Ri{@tjfEMK{OzTaC9A=Gid4ltfN;_akfU(fxbfXSHn-J*I3;W%HBB+75F z`~|YPU^(l@fv;HI|2}~-p@;6>-k)1E2R5BQTmx0I`Az^ry%PA^1gM*t)NiM^M^RXX&5a++h_}NXV zGeZA4-#-V~yPw{~@^&{kpkqP4{*+f4L;JPTp1*$)?#Io}rZu7(*k1)9)N=%yk2b}d z{=SFr?{5f|Z6~lkt*86vUgV`h;l9=o~}uv7N5cLH++hG zW!+`;TqXdaSe#UzFbk?BmoK_F38)27Bx??6rYAi{p}Dd?mu6)oHo59YwNb z+vupwSi|!h=YVpI$wuq%al(3UuuL1p$9VQ=Zmk%d&aDx9633^V9@oBgZ#KwE8*>?p-*Oz>aNuXSl1zP=lpmEZ5 z6{^1M#3ESqxa!A(<&Al~ix<&6{z8GdLr|#jI4;0S*HKH1r4sx{bEHE!{ zq;Tb#oFn>>UR)<0Cv>cEK*xy(Dzu^tMr+5Vd|!=}-#D4;l(=7Qnh$)$cu~yLQbO-s z#(Y)+yGq8liQr$*xTG5OrW&cRQF21ZLV8ZQjfL>UQ?(Lw;23x>F4gYfqrWOnp{eX@61g=XiZ zKf?8xiD~`{xR#nxM*Us6rjLU4C%(MclsWAW3(T)Be!6USiL&YC^R!w@i>V%;@>$p@ z@-yPr)S6I4h_s5bdEuK$9VDpC}!vt)KYgGuU0t&U-9f?k8dAT-kK?lQ7G_#PY3D ze@a0Ov_j3^x491p@+It-eSawmEWgSEI^N+-+1jV_SWBB%4cr}^#qSL2nOu!~?%oiD z+D3vO|33dQ2o*S?qnF!$@i)pB)ng$1Kg%k#wKU zAE@7Byqs45mW=vmeq`zK4Fbh|)It#2&wWt$-6BV^{!Pm&G;Gfso=E5Mf4;D&FAwVL z{~cmJPi-QEBmBE=K2KP7De~K+6Sd_|Sg(I!>7nySYbQ>dMDxDH7Ru4CTOe8nV&fIr zgK5HbcD$3uSg^R<`oX$uEDMy1YD<3_pwiYS3$P!z$aFl%gBn=*2D9Hu$R~1;Kb9B| zZBOd9j4|RPOOM^c?mnL-#AElMt1bG%qA^iV(sr2q(AR0VRx^C(Dg6;j?6F_-JyzkMFV;rsH=v)Zlx44eHD<;uzw~1FlM>qy*g$ES3R9?ko#qmDxQPz*o?D`9tZu#YY7B{fjQ%RMrVm3t+l-25e$-a2-u?3}~P?H+?;aZYM1xXnQ4W3hWQ ztM{&9#^S&ESiCT5=vW;7ke43`%28)EovWv>XZA%~PNuwJyP!S$8@8s>?FwCX`4OPt znY)+i=Ic>6u0^*LN^| z@z8bL-sxaEBkGBDqb6(6QKpq#KU7!Ta(!ZOtXi7S3zJnn1Nx%U$@E2(0lWD6{I6t6 zZ@jC+(*I3}$KJairu}_ohQ5osZmj^3T9kFJI89s2$2RuKP#>cs6b~2-{1*G}{oQHW z3jY0K;BhA?doDzt#_kfOZ1vGPXgz#xlKBs^=lRA(=R+vwfXZ5GFLWE;Z%)&0;&ts# z5GB2iH4ausd6MX{es<@4({&K)yM^hiiyh2nxZpYn9lr%aG3cE(Q126`YggLqtdA(& zQl)|QrsqAywy=*2d+(y{xRS(EE5TM;enpv9W0yAv(sBpBs?W&CA}1C(^%yIL9>z5RLb(bKike^~r(E8i&oE5`)~ zi0tL@h-3fC?&=OCi87Y@vQWQ`PKqN;2=xiWz44>#AcXsX$yaOXd*tzgA407OQkfZx zTsRQN_UFw=&s(7ImY{C-OlWTmmjwDpE;pt#|JFV5b4Od147t8 z>Q6lP3~ldoXJ~uH)lcEOp4*xIPrXmxaM}$JLf*fh#->p$X&+s)jx*_=-uszF<2w#s z1)<1QOm=QbLQ`xMC@rGU)H)iJ77LnIi)^i6*=p2rA3jqncEZ-TKeKd{^QSMb&;(Ee z*GjPUd4~SX%;L|Gca``y6XKb)gxx>Ij*+lEC*Ff+Y70NJbb}Dj#3ft@0tk0;zC*`8 z=+mzGjOj|v7pVbSuA@vFb8%9ChMzz5*_N}kxu043Tlg#oIsnRPY?J*r#9;96HevAZ zR&nremBmJ(j@}BO;C#kBEhVtHbUyQIXTI^LJK#gqrR%}bc!dB;odf2b<^Zj3mAv6O zp?6xh zK78xeh1GBLOHFa)k&)Z?<}ld4dUfB7eZ4^1mz3?l$ue{ z)Fy&bQ_BB$K$EwhC^1k2*#PdEerS>@CYHedUjFi2NmjNnOF@ILN&*nacml9Q7y;XyGujs>b59OMJPU>@K z++7NJF$w%wx425)Py-Hzxdr078i0YkM$I&zjkvA_faW!dNe<%@zolba!5r#qf4Efu zh2gNltXP>EcteCHIHSF!K~$q&2YlFkYeV%60G|xyIRI-))LXsPK~avzr2=2G2(#3- z@^#p+Tm05ZvAgX5O@6K*|2(xQ#glQIv5(~f@?p{F;&Cetq8vRcNj^aUKdynGIDEWl zgNyp^`cU`&10i}WN&IQg@@VV=Ny)=KDF3FF!8vOsL@!See=x0_;E+wWCL%-f83Z}* z1D+@Mi*N|flpFIDYmhE|71O0_1(pkh@->v3ugb8Wxc-(Q=3?+!LWx) zj5a?%n+Z|uvs3;Hi)Wb4a0TfZ+c!znYW_m>Zkm(3h?f5yp_uyq*YA@zAU{2imh&|3 zran#{pZ$!LDW-QXIw5*nAMrC9ifC@t7Qdwj`^dBtF3A0k5YI75^z|+jHM3jLtWAQ3 zXRZg-z~4_Qo9-OqSAyeckBM#fMfr3R$YysHi>IJD&_p)>s)NP3;`%$jP|&~$e&laK z7mHhcj^?K=G-8tkZHb@Z^x!^2o>AzKvAzJl!*5Py@W~Ty z9G~AOiLRQ2%9Z(|8W1j&r+X#vdz`R!g#)&pSjO%da6SK*6MDW9^BYG>pe%7g?vne2 z`S(wRCP)zFZU=0QoIhH#u>?=-w)FY^q;eql+HOn#lE*Fl3w6V4c{*gnhYdL}@40?b zSxbojh$Q%83~OonSLZ|1bD}(5dRc$UOD1c3b09a81DaSa(mncCI3FhBS?GKWh z>mjN9qU{?k&v0=I9SPfKGKC$6=iK<;SpzZiI}$`stZaY&owT#mK6Bd=L(kmb{@(I@ zAFZ$a0IiRogx2RzLTk^a6s;|s*53|8>l4G!dKabj^}%QO0EUU=vtv`fAw*vay;Ut^ z3L5_ngL5Zl>eS_g&=|k_MTiCk2;(|<>=ejFo)WoF%154YRIvtP> zYLY}Oe(r^G;I8s)*@T{7JPPoOm&&uj1Q8UJCnERB8zL_Fkl_LEDVccd-PL&Zm)}}h z&Ey34tOYLF^sbUO$l3J1$B?su`g(sPg4vOQ%er)xydfQvHBRjSZo|gB#C?c-Cu=Id zI~xs37thm!@2+O^~RH8Z#ao0pVWBZInsS^a##L7JRsIQLx%O0=R5YMDr_R9Zx8h z9?Js%jV{?-1F{)R8`EGmm{`Y)0w~dK)$1mL8u+?Q4S0{#SHE@YwvsncPIcL`mpBW@ z(+glUWP{lvLeq;V&$-~k_C>+!ntqAq7*icgHo>vE2j|+sXp$U5+op90pnSZ|Put#K zrUrg@xW0PhsoP3w;M7G8((r9l8BR>$du3wYuEueaz$`ybX#CTKgvCD{CB%c{`w}6Z zItS$9IfZA;ZvMM#2p-7b{rg`3_wV1|w+_F5U+*7&|3cdSeYv0Q-xvRP=>FZ(KXm^# z|IhdHnoU1I>&lbR`q)Wm{rI^Qtq*frn<=e-+3a<+U6U?*1~afH=y`oQk3C%j_e_)^ zEQ1`q8)co5!t__~lQ;BAOg_VN;-%M^+&EbTrQ43bl~^oWKFU1(M7P@*f@$UiW!|}# z{!@;v$K+18@!V@X#uS(je+?8gwo|NPT(2G~LykSq(&Yr9SfyWb*$G4z+lKqE*`U6c zW?LVj&)B`Xpxv;*(#!j7Tb$eY`Kv^SK2nM2`-6O6#}Xvck%7ybjwzODLp&x4sMG5) zV0o-E=g-awOlc$}jD3outmu#_AH9V4w>(M0Z@8cdb*MLTpeZJ>_(z&I4j`KE029xC zl#5VD&UeV>%l#yR`Ul0>?3k==eTC>p?BDArYyGIJ3XDg|0)$Zq5!i2<7(c991QwL!Q$^z4y*+@E4S$~Y`8S1^h|4WPafs{#|{d>>sOMby8d z{G=G1J9vC!5sfLB_!_hAb#i|oDw7M$=72K$J_&r?lE>)cdJ4_!s#a+3y_TK@;I5^2 zhwQyqW_Jgp_gZ=@j|o9}vck#Mlb9_}uLq$?c7gJZ2nx+R>;&Z-0hD@dR|2J;w>!{Q zaEfMrZ0SXrZ3QbR)hNxvqFuk!(hsCR3m0ft^R_?Ff!q>M1LGaIp2r)nzRKcRzU{N)S=cj* z*;0jPDUL(wfDdvj#iwAjt0MJfqPpHD9!qZDE&UsLgac?kP)ft6Q#2Z1n=PAlcTSj( zI!ztGEd2iIk1hSX6rQLL%S*ua+duk=UM{k@w$%>k@jh{e_M@FP{xSVFPjawtJNjuX zGyPU@!g}x83aw{`>zJ53=$Uag#AE%fM;$QK(ud|IOK(+pkv{HKI`z&9B^eU2i$Q<@O_b_ zeGW65a-pxN56^@GAIsb9He%aBYf4b81OHL(%Yx6(dWGmJmF?U{eS)324K|iQ*-(G1 ze@}`I2uO@ptN!x`aFQrP2*sl#&vy! z+T$3e+F+cH#LAa9f8W_V$kuZUv-Ru|AbeaBwG-Wfme0@Jk6$4utIaEed`gGy-~GWW z%)fiGgYjAqy#vXoXX@@(*gjpt<0tU>u^KRUyh1p3u589pgMf9Ro@&;?6s2!1tsD0|hCQ*xZi%cGw3bf241LITJ zxJzR9=nuX^bio1hD5lvfL~j#;p2PGk6+t<^P}Gi15;dGh8`J+^7SUUKiGP7@2a*bm zLsOVuaqt9Dx}^L8y`s({x_p96o1O)^zfFt5Liyx&I>v>*ey*P^dIjY@Y^Q|TfS6Ez8VMsQQ7eScCJQW&6gy^jj z`1=UySvkK%WA@TQh7GX!NDoof}akJ zuRr?JgnmSTaJk6nMtQ&uYG(ncd8o(a3lLs#ifnqFYT)h%3eH5?bmX;G7;vUkA8zR-9r!s9YQHh99P?CffiixqX|quSN*X~|ZLBBu5xwnjYMf&L z6q6UfofBd9_$zo$a-{9_F!evEntF(}cXwB6UhR2+B&l3Yh{pqJ;8Uj>z`o!bI)ln2 zFQ@t7({pPe*T21wktY{(*&q3Gf48WmpJS8`KDQ4Gpu`F3@Xjrv{-JC5yapre|7mHy zM!%qE7+Y_pX=4ya-aH2A7>G3P8JgN1ptv0jmuh=I(eZ59)633`Ba|Py4czOO(sta2 z6k+GY8zMBG#W7KnVf&nL8xUb~ihWMB3!oh97PX_B>~n(Y>-8qluo+uh{^g*`8&=fDj9eAK{m#`}MKwxtIhz0>Top;j7vHdLNX_2|k}yT}toZ9MJ| z5&T^PK$tKEExTiN}oFmQs>>P=6*}K7xLAzxr zrqv}C?B4z4XU$8S?e%%Gd=gz%+#j3g_K6YF0dq^Vo5MsW>mXV#LAaO2ZEuAuDzy1d z*oyNKylbikcLI$y!hS8mzOLi`)pY$78I^?SY8Loy8ZvYL1Sf;yuCVmy=Tjeqt$1$K zIRtI>QtE@S70-|l=MOzY7Agt72-MDRd2H9uoUj$!zABu;P>Ww6n^`i1)R91OPHSoI z`U*{yAtaATdv@_TTA~I*ZCUBxoul>Eu>3Ep=O^?9cTLsWzMDd6t6i=Jw#-lHYh1F~ z?1YYnF>0VLoTnjOKUP?to-P3QJ$FsjWKaXsH-UEi1jS_VT?1->=5N_fV__KSFeFg{9-V`YFJ=79ush>jdT4wP0SGN!Pt<;DPxZ z1Kh0!ke*^Cp*KG&Z=T_Vt=O-Hp>s6vYv*VxsDaA@3H@V2JV+r5YFyYUe&VN#*H605{f!bwv61W{qqfWoNX8bj!B}tINKD zCc(n$NbS_>mXXqWnX&&$*%Td+`@8po)r^;x8vE8j^o>P7s_yy?L{G>N!tl?z?Nk{BEh# zNFS%Nexk?5K;;{}&W5$D&WQl-=(dULa4pBAVxvw_1H~20{~>m*Y}QC{ppD+U$kSDT z%9c@{#w!4ni-q24TX{bA#hQab4FMh%TLM>0N8&D9%?Mz(^eD zP1`1}>!y2BG8W@|9A|)$^#F~iTerR!tnQv6n{5F8yKVYbGy2{o#A8m9v^d40E;fG6 z=M2YYkv*o(?Ayl)@pRF1vzX5Hlask0B!E)SzZKT7Z(pXkD8)wRIK}#i9u%N*zP$$c z_pcD*nPb=SOZMzJLOjp?QVj&S&VuEKo+T^?n=CSW53@}&dsW{{C^Im*3qT4L<&-6z=4oUt;$T zZG9x%Cd%f0y+jZ85x)$wxw4nq)BUnTHa!m6Y;(zGA(hEQ;|7c9cOIv@ut8;E$z%NZ z1iL@Sar|T$e<`?v;yj0+c!}uc0{Bq}i~)oj=5QPPNSVg3;aK0?&&CvWEPM{Y@=MWs zCTTEE-BIo%)CLg2almgg{e6!~qVL|9nD1_Z0DgSm#cfeEpCz~NU)Im;r%So7&_O=8 z+<$I8z-e0g-)X*g?03rdj{WAocbQ|+GmP)pfoF%_L47;ScX9gNOGECEf@ydVw$Dbo zY&6xy?o^ITqOTPoLNPA!f0t~^P6+oppr>GYg@*j5TPk37@HhQ57V?}9?mO%NYTHqr z5Weu0q&_j6q%k&w$`n=7GLv|j+eAV(+WR^Hc` z$m|Z^@pD#MUZGLCA7peN`+&!I^b?9XhR@2bOW_T~9o#p1ZH4yj2dQ}Ozh~BWl+_pK z-&9ycX>hUnM)LX|F&X9$)`|7){UGJH{`Ro`8t-#Hw1v*UJ?HGsTrli=ouiWEOV1HW z*Fg)Hkww{zIUsz@0X>mr>GSROd9RyB?<~T0zcR8CCV(>ENBxIWb-d2%*z`dv zuTq@Hk%rFUvDpcG9GMUD6KP|Pa%FIN1;YiXqWL7Z!k%d~x8x}R?ij~5LtX6Ge`0o= z?kd^bCl&kR^VvN(jq|YEw}^tgtyP2w^01f_BC-?KuUKB8!4p*)#rT@V^H!EtYq2ZA zY|D|&+yBID6O)~wV4I8n#B|&rN-nfcq@&GKum8A)Ypht6Ac^CJS;e`4hj# zLAgpQ@pVf@1M#32@%nB%M3mMs)YpN=^2SC&q}3&xZ6bt&j0db|_t?H=5QUD{zG{u;oIv@)0UfZmLW|8reONY6q2pEBxN8I`t;lPRkucV~a5;|`9W|Yf zM=`H+_d%k>x4z)e@~6;H~gCyzb4AYF>FrruI20R>%nvS1^@PnqeMBA z5KnUsyJ2-WI9!zcejkUrCx-WNI43#0kHa%hrF;m z%sYo0$Nx+JS}!#lhU?#`?}EeCo)JyZK3etDey!2W-H_`UZHIm!Ni zGPU=IMM;i(oqmrMLF6kLY3~4O?@;(u9}n3 zy?OKwZatp;bt^8?p!_0j^&FljZ>$=q2XG6(?#V{|k?HPU2|B!6M`*4yEgkwvrQNU0 zJV&uoP&S{=Vz#h+{~y?0cDzb9ZJ(H9XIRwsfVx7P3#hE(bzG$V=L~j+_Ig@Min1UV zWh{o-T1xHo|2%`m6JR;iqwI2VUhbHur6j`hDomKe@V_$qIde`zU+9v}=OpM5#;Sq3 z@^h(8_R~2D-NSNGb{2rzSp;flKAnpKqw_^}_pz}MLNTexxM(^4?=k+-%3{f1X=Slx zg`jrcLx>*b_dp$lcq%!*s5v{KZ_FJ^&!jmCy*9%p6`7Nue&$c*$Y#CdIbeEPO2*Aj z=&MhW&DBnb9FdBB6J{s$vXLyV?0%8Om6b`bNFD)7Z4R3|5!Af77t`22pX}(JhW&ZN z{&plZ#XT)0_lt0-2n64$BjtPBoSVU-cg|+x;w>CX`_b7v?r$u!f2NP! z+BpgRPduOZ!a9~q>?3-&<}uE_7(%UmB#d;+(p8q+M-;P!VK04(-)t8&asik(-wPoX zpb}-v1NX4}WBB)`b9fHA3uJTuJrMd-0RPJtiwSJF)6&bbp=q{7s6Swv0E&mx_0i8@ z^CvlA&f^%_^gSEDLpUaHh_I+NNfb8k9>XU?NLfx}O6h&jWEny|a~ak}nFNO%MY0ta zKxv-M@?X??hK|t-e2i-O7$F@$o|DiQ5#n+Gfyd(t5W(_y&Q9nJMMLX&YW7gO<>WaD z{l5tDoG4&8hma&;JHMXrBGFqD#IFL&-SdPC%=Q7>UEwgcyTLK*Kn*wn+}Ou*08<9$yH4@)9J09(P$vYM%Lo7UX7~rX zfyQT=&D;kN$9)?>)d+v8_5Aak9j#NBhY>I4B+=?r?UP_q12F_c>i_9N|+H2_DFndOQw>Jq|DwZXzii%T=ac8W!Nw%;O0e~~B(j{W4%k|`yh7`i3JmWmpN3=D_nw`1jr-(|U~4BE z!0n|NxCO?x9LV(+)zE$TpZC(@SO;O)ajY~K+m~-oV>$F%6C}J(0$RtU-An% zqkaCKrPIG}tkIft)Ibr(8~u$xsUz?CU<>oLex#o$H20iTb zEP#UR%`V$@KeFh&{Co?|nc|O0qSiM<)cPkee?>ee@jRz~i`{~T@-BXV z{TAkzLUHFspmTZk7Uq|Ne_ykO=)n;wzZ78vC|xr|Ej~%q-c1rcm<|5euP)nc&Pibm zUBu5P++({Bv2S;a*^>7e>PbHB?J)ZarQCXOp1f= zrgw&C&9(GaU^wVrlx2U^NAIq$nZ?hXYEctTQv>Br=z$w+w6(K_p3Q|eDx*VJVKCYf;~@Hh{RSGYqXc!_Yc~(i;B1?_Z9&_|bTJj}=wNGrrv>g0kasmJ8foPjxD2 z@v~EF>OYsK?&onmHP1@u1N%J#I}nONIptKg-*0;%75i`R^I}jtpMQbqu{9#y=dp#% zW*yruGCTPuk=m*0{(m9mzkJZ%|1YHN{}-qq{J{SA3ZQgt7q$2%QF}K*^m4lYFW+p= z<}r{QSA1JCmA8C)8b7%71$IWX;raa==8s12_g-LmRl0tKJfXlKWW;7dayD;G5Q<;h z^{bgQUUEx<=&A$!{a4DSbrsM3B9$0_x7(LM>78#sFET#j&#`ZP*V?>dys?`0N1)99mCMN?{Ui$OV1xXU)UT6hJDeNhJ9k|5_Zg`EI{Nn!gBuMK50vmaM80YjwzUA z@swo%(V)nEsd-+;e-q-#F9(g<)wwSx%`clh*!RNL!;eXlVPmm?G&o*;P~0TQW>91? zi?Jl}H}QOnYLbNSmLP((6gt3EMV4nC?#d0^(xQZQ{S$!{#0VODU zXg)mmKz@GrN%Ql61T6Lf`)m8x97f%11opp###BT$)7R`GqHOL32)B!JbYm7<7wuV~>~+Z|>Ix@ZviS)>I4;W3 zTK>Kv3lw}_j5N3)_j4!1%6)ho52zJH$7?}$J6G{dIC zb{-ethsW4MGSlrL60)#hw`@{1U z{1@?in9LQR?Ky^T?;eS@hu;DBSHm@QCm|lYkE%r?%PbQ9=xY*wo5gh*n|Q2Ct3@jF zzh?BbpJcqiB9*6eedDn{b`KKlCzbQ}k+5CHo*yjt6pO*=EacetxHgLLOg#y|_;DJ) zIR6Lv#jBfT9&?!K8$SfMIW50wFiCWfAWUT@lzq0aylp7Q(%-MK9I7Zs{o#2Qf3ldz zQ*`3~&jP>QZr98VJ-HN=xn4`(H#4D6bV3i6k$ONAYN?#nfpXU9%ZAD*EtfGn^|u4L z>xzuf^Qqj_@haK8*iSL^eB~V1BL4re_U-Xelvn>}W_CAW6GJYWYzWBi1_W7%2;@Qp z%_Jb=rB%miwf3!Sg0{5SzD7{I@X7>G5p2o8>L6Z702QWQQr)dxYfFN*)neN;D*Cpy zZUSB^XoCV_ChR`H&vTi*WdrZ~etv&tvpaL1GtZpoJm;L}obQ<@8V%JDR0ODgGjqHJ z$?=X|#?AtmJ-L2yOl#R9?ww?ZUY{L$Q*)tTUPSZX@w1M{zVZUm*sz^q5rUS)BlDJ4*|GlQ?@g-N~+T$aqy#&+060`%TE^<0(O z%BA{RAN6G?tQNO+?DuZ!{Nvqo+w4%?Z-aK{wdUHTNKcb@$&=V``5Xx1`$%oU0?{}`>?t}|N3s9m zgqrJ9XyQ4-bn!g3U8zWO09@%;T{cn{PhS?(unzSsn?IMUgoE&;44&}(G+&`e-^duVfYd~l>TOrB_|6cLT^aZGUqO3!Tyj~uZ}iv8V%oQ` zt-b(^AqNzdBy98aUgxR3`#PwvX*9E*)7XZ@Yb**3M}paZmad62JLmMMxy`>#$82Lc z&G`T>tYZ$RO_uwkx(pqcMtUg!k!-OcHae`J7=~LCSA) z%%q2G3vgOIym zQA}$aGm@{li*ezIINRNmMA-JLi)WHnQuhe&UN&sS~e7()YdqDW$r7^8Jb>4HG zD%@&QA$$LaUr|9QZ=C=zA;%6{BrY9bFcp-VI7 znep+@OGol?+aih~{Khs@`v*eqU<;_{0Jszf?axoo(aQAiGTHm7X`Q3d?}h}>U2{a^ zF^6b8W}@&Tcx>m$vG-jX(+)XAqs0z`{pTcW_O8L>Bjm<1kLCR1jI&HEhb0VC#qKpV zj~9;pkO$dkVG!ToR4X~9Z|y{r#K=}m0X4vj^&F>2f0!KCx&dmiF4~%rr?tWX>PfaY zm>Kw8C5ba0x{g2fn3^Xaj!mU>C-38B9*k`L z$95FMF@;NcmY`GJ2}8ben=Rn zH+g5N*cL5iIX(Ctesn37<=FtPH4bR?@gQ4$$qK9K8U0oP!UatJQfb#;8q+EXZI|A3 zbc~8^gMT69UgLz;wm6nGS}Tp_fN{$$6tBEHhC==8IQ2J=nHsDXw?=2u-0nX1GYh-Pa2FF0vlK&2vG zUlrF9{zFE;S^O@=iL~GBRtFf-nWCZa5TSTqWn|AZ7E{|RlsvQ1v*B5O`t-2dimA}| z3HnKa^NT6f!;wdhnZlwlMi_e}?*e*xte-#c5Q?_Dub=#bTa zb*gCK=UmA{1l!^P2klM$(PEmnBN{Ys={(KUtT`K)nf|^+0Quc>O)bsl9G}EYPu*KA z-*hbxHUF`Y*tflSu1E|$kNHK0z?Y z@tT;PL9-`6NmE{k*MQsq?lW=iFvUXB@wNDQnrwNh?;J%MSQyi+F~C4_V?K2G3NIy? zzLDJ&7X&|VbS4Dxetlp!O7uEeH-*L+23SA&05p(zuSKr|AdTMByOH+w3EF?3VpLLW z=edZU6)ChPhRC{Qdo5N?Z5KjrVS;G94iKW_l_ti*I#rk<8UhcY<_hXhG?$4+PaK60 zFUXjig5=zs!{(bSQlt$Cx&J%k+P1ODYk4-0YoCd0YX#bq80*jed@392!kBh9Lhd$J zZ{dZ8gLkIb8zh%?5~o^ua>@JH zha!a*#56n}*%Pe$y6Jrj7sj++gxr7MJ?#GN?qRq6>0$R_LC_BgJn66Ti;Vt*Cns?! zc{RM>>JfwG>d;g$K8{&)SEi#Fox7711H63=0lK7)tJe3$yI z`X>A?2Jw3ti4E#ME^vO!PjM7N5I6`~wP)B)=x1kB*iKjzM{Y4y#&S88D^FSf3zF-f z`2P!H8uRD+((_ExZP*id?_f1|r-;8pV{Vu49@Z2`5?d}?o{$y$`1>xT@%iFj>?7E6 zX+FiZNf`;%2sA!UFta(36Ij)t6u-6zg4o``a=7P*5X8FcRbDiLmqE}V{EQ>934HCm zMKsqI;;0UPw`~ywAO9f)hY)gGnDN>VX^;6|?4mhbM@?Ge_7{fLS_X=A3L*CbfY8zo zPJPY#90he`PZ&X8kPlr;|FO^@cyVru7k6kKsHg;t=UF}vewXVjM6(+}?k^FIHg;xv zypiVRMoUDak@dD-xeF!tA@|6AX!Zn>^PFZMVtoPS)Zbs~5{+H>FUf_2(4ZjbzDKfHS-g5OX)>!(dZKp31N1_h!=kek#ogyxKT7NptfkG`$OAZaYAP+W>ooc5bid zG{4s~0az^trHjY7I+gYfyxM$GlJ;FqBXiZAbnYZ;?)Y5M*v~<@lY`Lw3|jpuv~FpN zX+7R#jxP2UxCu0W^ouP1a<=|i_?<1@IZS&4k-P-AUa)gmv-(_Fv5}p$*Og9dD@t_x z&S7E$el584c{_)-w0$O}u74CB{FyvV&EVmS&IAvBi--F&csSgdMlG%zSVR>5!gVcc0&cpHzoem{6h7_ zK2zfaYE#;-Ftug?7v#`$3+y|Q>;9ua4LYF6ZW9d~&=}IE`)IvQw3A|UKvD4^A$EwflGqq9x7pB=Sl>2vfB7zOI4WPPz4xQ6EVN*K|5cXNU zGM9~2F9@4jc@7kP$m*)FOs|{{L40q3gK&_=(H`nV+72F;UvUDFJh&bk?e9G?Y-(#+ zZ36zjB5Z237vlt-pQlLm)8d-d_YKQedOVWE>RC)uNc4XDNhg)Hp9&!Vw+(tPvP0MV zHt4NiRi)nec%eGpGFPhKJ?TIVv;R`}h8y*^jhOdwq2Mg%0l(Xj{XF2SQSwGTo08`N|6+NgZ*LxX9x#w4Z?y9)ynb+& z9M|om@cPG5cs;%`$!ibewR7{CdDwRr9_}86hhL1s!#gQF>|s18S>~%V%Y1$7Ec3PP zEWCbm6ka!u!t0(CUfUS2-^#-4Jz045pM}@fv+z1;6keB(!s~yf@OmTT)lYa0r`0cv z=mWpPzW46w5R5i}adQXKqMINRZ4iwp2jSffF|8+`#7VoncIaw~x>US3{kb8gHQLha zzXD=R8;5lr53c@Aw6}du2g5l1CWO@nVp|a!ZRZfXsteQlb;HQG;y1*YHXgu*`RHFI zMiz81Uow~0vaNK8Mo@t8>V}xsRxpykXBrsB8uNwg#YC<|yUz~ospm+`E{SP)oJLl& zmfwLi`gsBA6_DG3Nd1@3&iaqOS*V^{VQL+hLbbx;RGp0=x3SpTi>E1$CZ0dJA*Nw} zJd?ls8fcAd3;r%ttoAcL$BMKr)y;fou>eBR2gOJauSjSekTY#jP$X}mQW4z@k!YQ0 z4DCQ#|2i?!0I)odr#C}=?<#< z@%7x{LiG^`)%72ZGc~UbY7{5-TNUY*opB8W2v=l`)l-%nYk~DH*qPqJhM2atSloM_ z9l9QHipJCD7par%(1quB>Ea^QcXN^24T{8H64MrO;0o|yMAtD4zjY9K9U*r!!5}Hs zee2IxZ<`LmfCFl*I!A2>&4c`u#=>;34M^Q4{(b9H6iZogDbh8aacpOje6i0jN$0<< zJjs8FHCJ9m!txnH$bJ77Q|oY0o7KxfD9EstmW-o)fGr%c9RXAGny98PgFZJgNq_hf z7Dx2bey*gx4$sGiBDH=x1Wf__%5Z)Ptfc)xnt}B+@9 zYS^B^Ywd*q%`wLIn>Po-OERCgDmnIsly~_CLhe#wG-%dO`Ou_+g(M@C-)U3@5lG~daKkHQ2G|(`%P5S zEhy4#eE$?^K?bi9#npkv_%u)&snHmADT&3>e&`c)vc^6uQuT6z`RZ5l$r-xQ2@t-3?dKhXlrF(# zx*m)dr_q{31t9d;Q%LK-UNizWsQKH)=`zvgPs)VAWTKPFk)!IQ%+*l^}~qxx)S*u8>S3f^9Y=23pTMo({uI)72(bL;0CN9z z^t*3Ag|v3+lMvnXlc$ho)kps1eA=J5n}hJPsn4;EWISAz01yb z@chhslFmt#^uyrv{ED@pIQi_`c1BM7;l$bq82U>%z=r#;h?_r1XQXk>ge zo?%XJn@?*-qNIO9Iq9EZ?G^b?(Y=D!9F5oWoc~i zgLh1%(YW?F-FO0NQ5(&PdFM3JBu1~XM3FGf9+D?T`g=>CbkG`qtV1?Yg0RDgWi6JXdHZi_9=Sn zQd6TnFiP|*eqn0;ycofJPR6`mSgfx17L)qv23Y;ofZ+142W2~!8{)$+Zcv~7wW;+x zMWdO6kcCtB&@j@5#*^B#v~#oAy>IN9^$XLDe>=p^b*+0a&-fajT&&{j)L)zK4kru( zRMVP&_SuR*b&$T+)rt61;(r!@@&Tz~qP?#3>0c|qt|1qU7@2DpYt9voqqjiNn-V)t zkHID5Q`i@{>wE|*4jOmEy0ya&Ar~l;FCPY}J}S{KeG+Mzbs0&FR@(RKh9{9$ZWBqp zN;eOo6Ke&v!yy_SF%+WscIEmv+!VhZUsFlyxWtH9Z<3xW_*(Ha3R&kl4NuZ@octJ) zt3i?efsp&L%_gap@y1a2eT3ZM7Etlt@`@9B%RrHa_-geS%aM6^#F>s2dj#DFVtoU) z-+5}kcN?sRhllVj^J5y9L)K!u*ADGXp@}LySE_EF&+H3!wo!R;OiP!C*Ar)`lg@|W zQG#^{I_;;Z^nEyy_E5KchaO0thwUfhmyt8+)Or8(38a}>*3oTQ;vWw`l-ZXP^b!(- z;rAZ2LDva^)A2gN@BDombls2(MMHO1k(}hiPte%S0Z5PcS?_pjqVJANU)g19w6|8d zpVj2I`! z=ELB@e=am$w?S7U4>e0y5}nZQvz4j8e$~{XGex6^)P5z;(w3B3aU@y~oqR{X-}4GW zZv5LVE34FnxlnXSuWRsZWWAG_l!ib>RCgD&6t zDs^_($gvwwBRN?!mdqjfy$!m4zp^Tk^ZK$AdROq(>WZ}j(Ro8Q=pEW}E;+BR0Y$nc z7m5xu9Eg(wPv&?)5d6MvW$Gcpq5s#bw2n*UAbf&{YQp=`a&=@L%Nu)gyG%FDb1c(e zookXD;zvksCapP#E>p8GT}wfcPQPesD_TIs`rCTe&)J#!nc|K^Ebe&i6RfUF0J+`{ z?H|~ntA0VbTE41^^o+X54((Q~@yaKxvm1JLN@K~T`ke@AYaR3)@{r*6TiET-Bcx#; z6w8(scdTKun>R|_F`3&?ns|4wzi4V7k@e~JH~s<7X*r=k^;J{D{+7kZ41}~#N1Wf2 zJc2YF2+F%a*2858X#pqALqCTD8OtrPO;%Q^SRQ>gH_5Nc$M3M<4AH%M=(H3{l4;Y^4k*3)5J5-2+-?3jSxH$tiQw7Gu+C9Z1I_oKQmsQ z<3J|ZLL7uG+WFaNM=9;z2<*xSz={3tjiuNJ8zU&*-Q5)V`URqtZd1~ zOufmG^>&?2G<<>aYO=R6PiW!w`gp0Sbqi3_$^3s8D1EoE+?pr{1cyAD2cf=;h)qWJ zkR}<_P8$De$NS0fMa*YpJq~_0FQyS)*tL*61kv4(ix=?#%+j#Zv zQd9Ffq2|a^irb~|5VCm6J4OB74whr_=~4*3kik#CGs(~U7p3oSKbl9*pNq5OvV&d; zYsnd0-!$w)l-dYMlw*UlR=ZeSKc?3`Eu@*g^>~FL9ail?^ z7>ROFy*`6amYYWSe4g>?WAi4?qq(QQVAx}w2)Q3bq^FvpoIs(M0YV0<)OXtV(jIiYesnv<%ReQ6AKM~3wo_T{E`$)7*Tdr|R`onmL)Q+4;|LB!gHTS+ zbF$^Ar{bH@o=6q?``hU=K(1(b$3VEzMrCo?5XD;TwnOMoEN8FV1|jf*I-b?;VO_p| zJJQw&^bE3j@n^*K=VH{#EZCws`N+ZirIV(v=ye3qZ{V*vTy94Pu1 zLheRPbDn6NcF=f&?lQ5A)L?r*S|=KHF|nTt?n6mc4toBQ1=1YoKGOE{f^c&(`FB#7GYfBQT7@*d8J{Qi4nW-guf5+UezkR_AfdkkrB$4T!aLt%1WW&`6D5`$9uUaC)7N4r67 zo0MEff3F`IfB*4CG3^iRUi`d+XX$I*cNTns!M5zO{>CWy0#~e0%KEPvzQE9ik>@U< zEcgO%KXB%C`SY{z`nyqheR33DJt@2f8Lw|=;q|9kczdjZ<%2GLB$2%_Dn(TR;97^_8v?&a_skJzAA26K{grI6Em5-_9ZvpVia) zkP=$=P0paH&*#?v{us62==_wEXME%wYUSetieBEqXqtSftIO3=L#`^wtT9-rj!cyHA9H;)$`mF^BR#M`( zH^!+imRR*j6ZAk6sPpkVMacd6+>E)Hm7I%``t+KlXXZ>${mkUnZx(&;Gy-9dq)KiO7TY$#W}>^A8Ll+8Yit){}Lg0&;dn< zGHP$EHGu8@){9N8c{a%l*1a}bQ1z#r*nzGRbw)*#|J^F85F>!-xs zz5tM(&>c?b0+_E_e$vSEN}kwT^QoNq``P~W?`@=xJABXFnAYf2B;F2#V28n`e4h$8 zd)3`@N6K++JC+nR&k0H&SD;n1WgxxlJ7Dn>2 zACHsy_Qp}zmk+(ZjzvVb3~fW&wR2-yf8IzQ@0}YXesq%^276NKq4Miv+6O81P#=+Z z^2@#6j9Ph8>&E>16O%agB&&Bz#figm^~E+ULnTCpe5^hw>Jg1YS7-FW;6PT3EFa#b zAKpgw9_OU8I4IKm533(7p37C05d1W)pYhqT#@3xB4`Zp4T@T+eN?qn})+Y7vt*kEd zM-PtF!?$FKnKayQQW=cSx8iQ(b4px}{?FoaXL_y^XL+uwQJ(A5QJ(9;wP)VX`pz<5 z(J14+G0J$$Q|9s4Y#z(A%ws6aJbtnM%)IJn;q{X>*?E0p6kf#?Ubiw{zj$CIuMcP8 zb$`mfy@B2P&n)-0Wx4m|^+|b2_C@-?%fy~ho_jQz;8ULapN#hxv+(|Y7T(vdH%UB_ z=zxb87(}1EdztYZGNi^h??XD)9HP-5MP3Jg?590+fV#Uo!T#(1l2SqMB3O=)#x#q! zrmKL|J>fkbHk_wo{z(o5vmeXqXq+N-JyT3EUjO$)w7#)}gYcypG<$NAG=Gxu{G|V? z;L`UMrskiN=;(TyTYx|R?ID_DNzRl4Dd$ZANbGY~Pi2xz%j^s)S3HrcuSvc(%^kxw z3Be;i#Hkf_7{q?ccsmTPUNt4H$FlgBDXQhyzx^n~zv4h%$-DHG0O6lMN_`t^yn!EN z)Y9gH{Nu6sxv1^c{V4VGIUB{Gz`pb2E{Y+qkX)Zq|0|CoZGaaIY_rfj>~Z@3OH2*_ zy|a+w%VXWO0)OTqZ>SiGuustBRHUK%#I2-$ZX&~F;UILgLo`SpY#qfxz_#I$5RJX# z`}R8(>AHz=?H&i#yX89RNhFl(@7Bb$z^W-~53~E4+NY|hW~A(@wK0w8G^a=~Nw9pp zM$dqHtuvtSKT6MlM)&Lfl-}2o?E&kv>;b~MGw;)@&az*f{;%x&)elG6ufDA$_p1Qg zuLKg$dWFhcUAnxb#;^<)!y3juQVIqX_7Ub%SxEQ;M;<{M@DRc}1@md625MsgTX!p`sO?$aU1cp@&lK~i+>d3< z{V0vmyv}-y;PrfM3SDCVF9Q|Rzhw#N2 zeD;h@^7;K5mcPaFBa9jnQ||S>P5qH~9zohWWM89wqdT0U5nTYJFXka(0_i0(AdJ^- zph(x1LC_mVp$>+_va3*$8U;8oZW8SYjQ8D&3|_D<>M2yDKO*GDd(89O;v^0m;2}IV zv-+G$T^$sevrvGK6Y6};Hg z#FVrAeu38&54eaO>K$o=;%92)A^dW6Ok?_|7wpj6^eev#f%DZ5t7(0hn3Bi)pEb1B zEHj=!`c<&=t`mab$M4)rV!9Ca=8A?l7sB3rk~0v-vTM~D@3N5?NiR984V|xE`!YRO z;#hxte9bF+s2+{79u;0YgaZY%$04>aK19gfnbN1S5)?__V`^E)IDNi4_hm{ib&RL> zn52Fnlg_r$=sY}4o$@j{mrJAb@E%k9dlotmj7DeSG}VRaIMeCev&SUy)icTB#=&!rM&cHw_E)lSi^}cLJI)Thm`?fo)71Lm zX(T>bVW+u%ZwFaT?pbh)9Mwce5LqSo6LzB8da>NjtRAU@d#b4pK9UlX{AG~FBt;v9 zN^Lan1nY|z3a}jjHPas?IVc3%1>2ebnv*_ek0Uu|ah5T6SJQZC7oIPK+*S_oO$Dho zSgHQhw@l57ZSG6yKmKq5$ziD(gZXeUj2VFNA2Rr8%Tc6%rqExMLH_|tzve51+>LHO ziI3jFXn*wpmc1nHt_<3Zxr+3M6xuU0X#eN8OieT?ZO+bet{3~&?=kv+!}JT1^tWZu z=f)_~iz)Qo8T7Bm^oJ<@hccggOmhBTnv-73+JTUp2a*qMG=dlb5F=iID~X?H6C<4f zwM_+zgn9M_rmIKC$K9lMc9eTk*U@$P(2M0Ja1%ZMCOEv^F4Y!9THq!ibxt=~yoRQ$ zor1;ZbalfVDkqjs#j;XSoz$rbT)3O)dC$MMAcF661*7M)DH5h>;ii4fVtzi>vo_)9 zy$&kD@41@d_Z)YFA#$f`u?=KhJ0h;fgZy~Dso4P9efcoBzP(iSbr-4vr%06!MT*XW zNOTvdpFI-S0xZ}13xwQwJ}|%D7$UgjkuCHL5r6mLR-_$H^nS5oepJWou7ltw8lhE< zbmplkcf%KE+E>TBfTL=dd$whQINPISH%;Db)uKwoF$~FkL#3r$}&)(zkegve(c* zGU#*piiG9dF(+MLd`dCZbp9NrZ(=^#pCSM-`%WIFW#*23kHy|O{GPm}sx?Q}d$@Tk z($?GrMs_UK*G9?;!}lZd;-T`QrJN^We&^RwjG5cMWops!K-TIHzGZ4BUI!KX&#u+t zR*r{|7a9(-Ub>0cuW^rQ`EL}{z?0E~fCD*}XKG7}sr_i(7l4L?c-^P(Yj2FesIV|j zto$Nl5)jKKxiuukvbEFP6}=v%f_Psp>LTe#>21*K!9h8n3EI zgOs>gw)yM6f##E*!fV;C^ugr!w|C@1-GDI8!a?=_;Y*hPB0$)cx<1-L?eQgb<;AmE z-V4h!>77mWWIv5%_$`_*e@XXol0QnZ)cyOmAnnN;@H??&s>J`hElBeYqi`=m?hr2; zL4a^@3%xhWaDT8|Z&4A^Ng*B#>_>DE+<4cK0MJ~N7gd^HfBy{-{0&0xImL=}!|>F) z{#hB%a$fRToU>!(yaYcFruj}j)!p=5OGus}fRKo_*g@%A0`?=#Kr!YE0bI6ax6GZi z?3TGZKv>?vgZ!Y4yY~Aw?%Gc$K=JPS=6VH+ z)=z+9{QEKhd8qp#gd$3;Ii{+{T;Mj5ZjtY@rsw#c0wRBD6 zec%UQV7~)u=vicme)*RK56zzzTLm#vxmw)XWP`sp0JOdhAUD$fWqtVoE}spqH4$=? z_~Ejax%j#@z_m6aL}Hx2)#6s44gLziZKCU6PtU_*It|PIR$h!?xhMUICo#SDBGqea zilNn82y#9L@)`%ULK(F#+T?6KTJ*b=bcKG15>7 zt&_{Ixu>TRax+AygCo{!=p~xi_~)=#i!RCwC>|E z#A^9+C>GesrJQOwM8oqdXl=yn{|B5p;8FUbOSyVX?=K7Dv^Nq5@*Gek?!g(vrrdwM zB5fZR*AjaE#dJL%7zgq?C&dkTGSAeG^GXE!Av<_D@)m&H#=`-hz-_|6HzK5oF;xAv zoz}edvuEbLO5clY{HoK4^r{a!Kpo(fh{D5x>j4hn`|r;)HN?XaE{|K+9ZHjzvfrassPB72A9mmpSjaW#`KLit#{w%5RF&Zdz^|a zy;`nMW;sB|9imZ|BO2m45c-;f@BmMqrS+$FaxPMj-?7gQGAH2gx#dm+$v)t(BypG3 z;?|!1zD*w^S5As;O1~>3-@WWKwZItq zos}oGbBw8VpFlMM2dILeL^>VVRxLZ=0@s11z#qWxvI$%VmVj`i`xKIQvH3p1Y9AYO z6sZiv2$t{n?-REUu>9n0czg%ePp$*~Ja?cW7mnfQDD-gSVS!Sk*InAQVWMtRILmYZ@CCvS5Sywq?v@47O|Lp6SvjqE+*`Fx%Oc@leH zSg(12U;g};6u%I0nsRUB(8a)#jRhvcT~7pe`36!ebr8T?p?)!j2zIaj3GT* zr4EN^9BHRm_*dEKzEc3;qWfyO|6lDiUWsXwK2A`w+{c4_9f#LWnSOg5k-k7)M>-~$ zWw&uQ)*limf0d8MH8GB=%UP}-azZQK@2+QOOZ$212jRI`7e|_iP_+lY%NUaDK#{&; zeSP``w|{>Y-teA1Q_~%2c1xK}C+`JQtj zIE?)p{QrN75$LYlbjP{0?r{z4$r}Zbu^+(Mp=&@Gulu4i$TNNC1(Ve&j@K*4D^fvu zoc!N3p616m%j4vkuV`nv`uv%3W!$_XeZcg?+_4bE_s(mlHu^W>h}dhL3^%2Bm#O_~ zlpOtjfye%3B2Ql+e3$x{+N#utNbHJYo&_8fFQ${!m(%#(tGj4C(ZZU-_b#1LrQVCs zD0%D*FM{RhzI9&~yofCM#80hG#^>%}_r99t-k)T-ck}9G9x#o|fqqKhuus;WdZu!6 zlz!*~%ti<}AvDeoU0D9=ud7mTytgWWIsV~hdUiL1BWEaCdy{*eAg|3$p4Gj#nPTRY zkoem;y^^Enp5t;&O%b3bFh#5v1*jetT>1(>s7jt_e7(-G_eE>3v(q@lp>>=}d#}3n z$)HFV6hct6K`0>5I?nBz5vfNf|J$gozwKwFUtM+B0Y$xuoWc^F=afDphvF&+D#dyQ zp!)GjP*+R=HHwh?(+g-Uv9XxM%)7u2T}?+XP+|QHwQy$oxyr7Y^lTdY)0nmkl)n2B zB65gnyn8`R>vWBz6Te_&Jh6RdO#9-DeGjZ2(veKtxII}n1qmN{9CQ_@Vmx2#qxriFYKb_9A}wOi z=&`}9ZjSo61ow6^1naJVU~~@YgB9`I0Ii+mcNeJ*_r+-s;MbWykLSpUon~tDJsnDW_WVO#3z~#rS=e z+Mz4_zzj9v=UhhLl3f`1)A^->%B)w_J@Tm_-(7IHp5j@W;5 z$oq#dUfVWMBrG@mJjic2poZq^kJFoGE7HSdae^t2?dXK=$T)w69FSM!&;VyZn7=dn zrWqu5+lB2V-})Kq>aw_oZGlP<>lfTrQM}Z~T}%Aho1t}#0P=!vp#M*X)`xhIm#pSm zMIPknFsfeafNMP*cnT(tv!t7N}E`ZKX;gj+TbB*6-{~_m`I*XdN4te z&j#vS2)S3BK-HvPZXKt7y#gXe0~o;=txLf2wziJ;cf6)7u9X}|)xTqM^!lhaA3c*q z>wJHW-3u9KIYL5zr(*Vy^LdA8U_DN;zHRJ0+^sj;pv!0D)H`yCtz1Luj|2$4R29=Y z^HTIs`79O0nd(2PSZ+!Q)o1^CK}>5Y7Wdli(Di+%XyCmLzlW#KFH%#nSstH3V>Jog zFmqv=ZV1c(8FJXU7bsGdO3#0x5W<_QVp?PVNM0gUNt~Du6Xy+X-8Xrn+L&u%{a%CZ z)Bp#e`>J9Zcg{!}dl-$*5?bG5)rZKE?PmgJ*z7PB!tap<7KI&$~v?l>vm_IkRZKjLH$)=eq z2TDXJqJ6}Cz;D8GJRp?mzbM6a7=+q*(ZJVwZD9C7i2!h$JWzUMC)UrvZ`#Lmi9D%? z0OU@d-{b*~?~2FhBv))`c-H z7Aw;IrE!h+NG#L$7gJsp_MHbH;<16jSCQCT7oICTx4sfZs>+z#3jtglyT-R?Ch4Dm z?55T+7HYc7K<%+Xdl{bdH)g3Tx@iuOSAY<qSfNo#!}j+0blp14Z@_im{6hfWr{Q_ zWA0v_fo+ruy}69YXFKNOpEI)b|ENl={q_`DYv=6Ho+@ikOea|8`k`H>W_*OI@mSwn zV`@8iFoxsEU1kGg=Y8T<0437R!zK@uA6d)f$s=$_c71_l{M|zYWXXYurDP* zs2P+k}kDZ6AGI;5BgxLhgUXkvs{{2?$5N zM#vo?@32%~TcJqZuJm`<#GVze8T_pM6^bMxiSUs`YMvFoVU_OB882 z@rT5{nLZX;=VSRIze?0vBy5q_IhA9z_?F*LX65?r;?&{k%ob^&wg_6|*o)?Y@tK>} zu3;Yg9;WB~GkB1X&k>E2^F-r#K7=65v`D8^~O)X!yoJ_|)_a`ko|xAEWPM^g}b!<=v9?%)Kt^ zk7?04qJi!C%WF(6S|=Le`%Dehff1c28k_GkNj=F|0Kw~MtXswFqv~JOr@}hCFM}`6 zm*i`BdJ=2vZwR@E*Kz6`P^1c=XNhabTvjaqF|kuC{ML6j=0MRQpAL5BmS63<0ruj#4e(&#x#bf07p3~t zhmi(WkMo9+nCTzeOf75P7r`2RGcE7SvZcZ{=%Th3k8Lf2*T3sdiXVgJ!1uvS^*r6w zdU(-jwgKrO@^mxBehA-LrFJq5ftPlenuXb)xcAlz)iT}Gx*e2P{Qcx=`aj8&<|y{8 zor91K#0W?0^a%}L_l1N9hn`X=pK>Oh7-R8;YHTm<)ucFK5V~z=twT6@mYkvoR%Fj9 z`fQY(qUasTn8imdr|75mjEq@)kR_+6_W!d`KQNBK9e9g_mS2PP> z=iGJn{&I={A-5gc%dP%$@i}Vw_0?(p=c){gGI z$E#K7n4`YsXZnDh=l;iZs=v4TX%D*0>wn`PX@gun{p`Katk}{en@0AgtFx!~rkha) zL14YTOR^JA!=Y zr#Q>_x*i+Dn{Gc>Z30F5{!rd(w>+JSSYwo~V z*4#a}XJ2!_8D-7AyE3`vLQJ;X?j9-I&u5YCZ?9r&PRvzlPdxfLsXMy%T6;vc+Q^ej zIcnqV;?+}=ICWqutC3ujtdZQkFm0yHX6-)|IS9b zCJF9?0O8;?+Vd(+Uoe`#nU-8vsdcZ|NBf4K_Fns9Ha#ObGTYS1`*@D#uTR=Yb1q50 zr_(6Jfg-tnN_`^yS#gR+;ZLa#{Si;kEc!W+Z<`j=8uLc-vV9a@ru%7cqG#FMcXJS4 zg6ATCB#no%%+Yv%O#3rJ?phg$J}b|GqOUd}%_F#%FF%P!=D?=p+K?PtEV~G~m*(HL zVC0pxW8gw}}Sv1keg+?sCjSSLdAA;IQ9v7O2W)-?ly&5vaP>zj`O zs)=rRxK91zSyM~Jha=zj)~P136&?Pj)#6qgD8&_5le#`K2IquO>K>EO8Fa7lr(!?} zJk$&bWq!;9$FP8~-owxQ=VxhOy+1re`q|bb?3$zH>i3=`d5W&6!0G!QLRvJ2sz0zn zZ^Q;&sQfpi3;Kqx%6K?ME9$sF!DUfn$K5ws15^EW4kTNdI3EDEVkX~`B~#8 z%GaJ}t@8_){`5l>BeR)l>V>ZehREwf$<^885aKfYqg>=2jC7|4B?w&9wAXiGEEL^|jVtX=>PK#cSl= zD^2YrtNYqLT&)HFdpS_Is%9MH$ayJ*y{2ebe9DFKy?voK8 zwy@(~%~)?Xf0WharDCtqdMSa_OC8%l&y;7dbDZqwtd#z@8O~*}7>W)v+)Og>JX^D? z{p!ForuIu4w3{{sq-}(;EY3B@jro5Vm@Ja#O zT;s_YA6;mYSkjIe^vs9E$zZnHRQTw2&c^VqYKJSI?e7-Fa^{gn@F8}U0)0OUhZUdtaBBTW-7 zdnYRJe)=xyTvf8%8T@_aXJTY06xL226eE*(McM(vkGeUK10>gt)1Sop7RqZYkBgB3 zxUkl{63d9v$CY+}1;B0eMj@W=>d>Cu?)4Z z+2XtHyF`Yda7TspK1rXt&%{Uo3Ts;i#mG*+u(p$fYD|;VWDB4!L8Rt^$V3}}+=}8cfw`wG{C)I!Cju~z?S4QT|V~hJuGng#{y4moPL4#M+KYyA>+G) z@!f{`-nM3o@75bf@I4xhx3ke0<=OFk^XyqMjq~umxzL*STq{Kbz_TTF-qY=TPTvVo zjpc`6Y~H(nPYFV9ACV#6-vha|EnkX}B`eEsZ{$HgHn9{xwL1ZmpfHQ&ce=x;DYH?-(nsz>j+L08wJ~V8MsBc6t^hAL+uG042oQC zZJT#I?# z3nYJr@FcQ)`-GmEI#SQPfDEmFJVg4Jg8H}nk*35^9i9tX8}z$9BjXLko+NcJe@CQ; z)+~+(dDfJe)|szJ16c3bV6droo(dc0s^6Uw)2w=>#$rYKa>~ehCDu1RGMt$UXM@2M z%rgIwAn4Qv0soD6d5W%5Wgp>dod{pq}s^RZ+~O#3a~2U}=g=eqk5!9CoPWlnp>Dbl}FYn?8v zOw>Bf$%nx}i)c)H0BLJl(rcZteMA1{i=?+EUXKiegnVzUC2LKPv#PP|tZEtr8#l(a zs2d^*2i3%1=$)tf+Chz82dWLAeH|#$`fG~R0Zx(5+dy*BiLOqp(Xr`kR0NQJ7dNzI zJS{zL1J8-Z?=K>FIn{yBv3*uHJMcL~0xyV(=lb16ad+x7a<|dGp;+(3O3~4_bBX(q{gukL2H54KN#>xN*nQ#96|ZxUZUDo|T+1;J1&)&G1y z%h`-!-+<<@;_oR)sy@PUX^v*pM5WqZYVESK&-{z zf9Ik&$<=%9xfro4TLx@oj}t)YyXH~|DgZTftbFpWjY+gtc>84XTbTYNFHQF0qYqikb4yeS+^n1CPo@^ZLN(?kYAZh)>J%wzgI=ubqmz@mo-0+P73ak?N^cyYhv)vA|3vINAm0tJ92&xtq)1a3PaR_* zgsYDpL!5DMr8nHFsvrLF4@79PF6P z&VftmImPUZIq(9wN-^(00pm3+-wSA6YWEP5t?OPTa!>86PNyRMr2>M{AyjL9*W*;A zKUP3c9746PQQv6GZ&GN%sU)q`F?xoPyymO)`N6i_TNQN9yC>2)2bgHdjuc%$-`k1x zNb6rf`*=K8M&j396o1gAzrP-7Y40&tkwO&^^qvbLnoCbHa`AlEfmn~{b=66T_~2YJ zw+*YzwEG*KinO}|f`R*h;5JzNF}W8?^v*I%7r6Ab zZU_PoHO*^9gWfYfanBp^WE@c|$M=-zt*4QeT#F?mc*5`QcFfby{uj@2og&?W@7Z#e zdrG*3PUz29q#N)(8^H(^lUh}2Xl%O_y$m9OjiT`Yes`DA9&T3_gPbpHKloOMadwxZEYWr-H^AXPpnh6&pyO8o%e}bBNzY>A2YZ zm+BXs55ev-?01&xo;cE!QfuDbiFed734-*ya<&5-*0oR z*uS=9s0Ls6Bd)a#S@S)X$_4pcNa&xyb5H&+pmISzpF`xLXSkvEFO}(gQ}flyIX_j& za$s4G(xyo+}85>*txC$S22n!k*MWPvE$Y_Xihx#XRkX={lo4!lB)>5 zHLY<;y+_CujX^;mz4yHd`zzhXeIiEVe5q%XADbx6rX5+ALvabFms)vaCHj<7OV^j` zIb{%x@>rj{^!4m{vSA(L`&P%0=0&I)?+Zjv;Oj|lrb~CZA&9TZ7;zGo2cR+*)kMr29NH zE`#5v6~D+v>)sKx3Tv^R`M=Ow#%Pha?R{c~52o~;KEu7=N#$cL!G$DsJpUUSi?h+N z{qJbhWuuY%zoRiFV@^8&Y6CwRL1W9AXq1kiaZPRD_R(mJ#91;X5!{*3A%-6g9Mq2R z>r>8-1G%C>aybRw4?Khe`J$oZK)A~n(|omw7*KE1ak~niU9A4i$MWXKQoZxzN*Yi3 z3?cUd7hRtvpcL1WGdb$NaSlbgbsnoF8b)=NUw8LBYP)^!VhDN`k~2yD6zLmP;$Pu_ zYYAr2Jc@PRvKWGo0)()hKF)fSJm`yQE>QZ~=8ohO^Pd@WXsV<&SjC^yb3pGMCefK; zF9iD#azDlcIm>(00pz@}xD9Dh1J(T47b9nR&GjS4c{Iy7=U2uwyiXv(`Bz{y@aZ)h zG;bz>z1_eO-?Nz)BMn|?ebWwd)CPl~*j2cp`L1SwLhl~$CIHXDfP>bcRy+{bJco;0 zn;oQYhI}iwYbHBel{}C=(c;!_JIL5qJu!(RIrYaU*;N6{n^%#}d4Sf<|1=L|yuTb0 zO7*704Wur!?L4Kgp@Y^jo;U<5+pi-HH$ZETlkVU6dWun|5Pw3;gJ5(FR7X9cQHt%N z&x%{4c91?k)nk z)ikuM^yXipw&p=FFpO&cjgUK)ZgUJ}=i#|a)UQ*oy@A%*XT260NWZI8x}D}I*Iv`0 ze#qhu=+ zH~t=vH*g44{2N>as*&yc+kiYL9(M$+pE5 zB1I=aFnSDytnmqMZwS|Dom z$e8bfddLYuC620(Bjj#zh(>f0r;^-nuOeMD&D4_PmgoSS8cxk~FA)tSIMvKr`mY6E zcO}kVIo;|hFvRSQ^V(>S1?(Ga_`5W$}n-1;!BFAx6`Aj~ED zx0dLJa^@ZbK?fAETuygp&Y%yd-uTQ8GPwrNO|M;r#m#ex?$|(ehr)D6-u-b6uhBLK z$ybq6<-M879+ny3N?sKh7GW95S0^!+$dU`8wHrVt*UY89>&H)-+E~2y4;K@kD4%Eg zNTB+tGfwpYxn~=fpo{N4_>`Hzl}_M*A1!X>Vk!4b5EA!TYm|KNO7i$c>i50L?>}X0 zz_(gZ-?Kh{AgF!T=Y=#T7fQ*0jQS~lBl$gGQ%_l+SK0`s7|Xrv^=+`J&#?OrEv5M( z3ko~F!h3tig(m3-ucXNN^XJe#5Bo(V@6pQ7e9oo@pQ3qAO_P&yzc@FpMN-E*Y*RO; z@cG#JruGYVrrtH0O|aaycQ+5=UwfE8aonyp%>cDiB>qGf-p3AmSX~?2*H?MZo?kme zFtRAl=W)TNpA_uGhN$_B^@`#k{8Yx6J&nmR|KLgAI|o<~i+vT)3Z)=FoCEScC$t{r zK;Fkg>#Z)3#R8BY%Am3?MbyfRC^0ZZ+t^UC_F2Z_e+!G+?X*=Pk|y~ zTj%q0AUMeMGwt(MuHR4qLGKW%zRLlIH8;V3(0ojS)1IS9r)%h1p z7poM@ew^-GEp8PgMfy6Q_EQd=Mxi?$wEpy`YvUTGu~t%~Zl2-W<B!A-^D}t zt<E=I24sYp1aQqVG;s zsyTTOJS2eM%R}|%jOXn6X7V|IH8G|g5=!(Y0eU+N6sgHOi{#;6?ult{Amp9|iuAGI z{(r2!dwf*Yxj+2uOC}*VlF1~K3y@4e!~rkB0>!CUotUo39nuY<<+a|q37C0JoW1jkoZgggb0H% zk>cUrS6`z(d0igC!#%)Pc3t(Q99{Hmc9D6kj)FQgGc{IsOv|=W&@{?zl(?Vj9cGTM z6AvJ5obfP>`q9cglp?ea@A9w(fJnaaJfvvqC5sccCQ`5_HT$n0vO2!xtGYt3Y zd?*hKwZ30Hkczo~=zgTN3)Nl42+QzV->>dR+CB@E{|K-97JAMwfbCWDiTur>4|=+7o5-Y16TGb;<2{svQ(J;;a72e4=rl zgXXcgky8gQNsYyOQ?ut&7n@J3)8><%;9K7M0P`)2lHPf&T`esHZvziaN+IF@_Y=M5 z+C0@gu9J95tUDPz*MFHnT7v*h=J|2a11RZV#&a<`3B173@WNSA< zbLPk%RLaKP6Q|=|eLvF9TA)0bA$QF=QIuzoj{A8Jq;reCdq2{oJP0f|kJ;m#I&gVv z%pT1#X4BZ1O}#&d?r)OQ2EW)Bo3i=E@*gnrXJ|h9eufY4NuYpv%p&*GF*7*AzF@JG zB$r>5^!3FF5`PK|M<5_vWjPsVu*k=}`X6_J1?I{oy>2zj;O{ z=bn-2oEl!psg>UZuP1?ABM&ax;lT6TRi)0kBA&!2edJCWGf(?x^Id)gJu^9o=P9vQ zIaR=Qf-*dK4S2)TCH?erPK{iq1P=-}-{?tDaeaB93_GqQajLG7b}4A!Sjgu`H3cY# z?s-?xvjO5OxPrzPthqC)y^)2fn~RH$;$jW)Fz6VZlpI^U4pyGk2}h#Y&o18?wJ#uf z6E>eCbiR7aS)IhQFzi(y#l@}k8TT*8a}vPs;iX_Gp5NjrBxgnh*FVfd;K%em4U+dX z2r5^?*3{m7_4z63zQ}J(HR(Dgzdy{Pyi>++>#@CLlL-Hirx3;fs1LxnPUVROcZ7?w z^TbZFczSI2JSM_m64Pxq^XIj&{EG)UwU?Ll=Nkx)yz9_>tV53dWGBE8k3j6_!DmEJ zcduu>*Ts{F?q&UXREvr*h;;%IJHLODdf)6q5}*KYJpo(b#;u zZ*!sI{-v1E9QkxE;XSeJ{HXR0vrFI2#5YRjTmR*s<`q8vPx1;^tjL{L_{cf(3SVBC z%7g1=d2n4_IdIo<a6cfithV6pwuCpYcMR4|r zFt?XruJFD|XLO=p@8r4eJ2;RZsEcd8w(PpLv$}fA6!#&7?0b1hKgC1f85U#N&(5Ln zI<9MoVx6j~t1hlNs86VBFE8LZuVW=aIBIx_djeWzVZ)GWw-L!pG1# znaSu`h3YlNJ7s-|)S2+})36X<${}lcI%jcvb_3-KtEaLRG3@zW_oec1!*!CLl!f)_ zvJmSSD^KakJlx=YNaG%sb_gVXyOQJ~djLp`_F=|9@VOzkDpG#fOw3gSZ=PVR6CW|> zd+v@TH=7^7^DXsJP2#|HwocMVg(@eN4;4N$ejhIX5`^r-wWhIr9MlEnsj-}>&7NmJ zs-ye)&+mw)@e-JQ$C)wTxNn>CsK32|hd{tw=RqLxwnm*F)uz9{ZdRY!S8K#v9ZWC` zb^O0z^R2%ls%7#o7-#v|rdh+r3G0*IT6&h3Y{x849jHsS99?E9f2)ySXAoQIhlW9A%7%YDRl^sg_3v3dDZ|Ae|LLTzEv}7goy8`(aCwOemlUh_$+G~CMC2`KDZ(a=~-b1r?_{X z(n&sEcs7mK;qt*XyEd*xO0(N_eQi3{<)^ij_Zq*?-6D()iRs+eRW)&qtkV^g2mi&5 zh{(#rYodg&3(rqDy6Nrxt3BhRYoZjBoUNr7rjdQfW$cwZ?qxAbJjenbpR(-sU6^Cs zcGkwV12l(h_z=Nht~>%dlEbKP81ZoA${3PgK{V!P>p8f>QaP6?pZnTE7+brmNL@QZ z@neYXj^)C1PPKvJ9yy=p;CeTv&XCOKN8$5RXYleXs zEYm19bro6DF%i683zUD##?WJhE%<+qU_dLw)gpMuS)X;&yr2D@sJ*ig#vGv{HUIW> z9p#h=gS`NL!pSLcSY9;ksEKQxqT*H_C{f9J-CLsWtzkA(gW@*Ecx7#Fo=p&;-1|TY zISbq+DsI>$ZHsf1$5Y}UpyK%f=Pem!a`~w;e^8T~pL737J&m8! zei`NG{6=Q`Ol7UD$)4wVwNyrKT0`~m<=lqmJhCrNvCaTV?*snGX8`iAL2CN}fJ@-O zb>Ic)9s-cb97IUY1JGvx=rM%szY;-xNQAdeu(A6@;C&-3UoRqXJHpFB9Th}pWFe@B z5Yoa$l3ow|kpUj$k0(pINVqJ-BfSiZz!+%7I~gt^$x93Y0shfVCZ&2Rem!A3LFI4F%MWe`2D$_b1pR7i!v)}QfHF526fB-J%kqrb>R}ZW&CAK8q0~;qP?q)8bQQtt7uVa$p zp2sDK%*DSgo20le;u2Z9wmD7+_j?yY_HW#av@j34CyD~tuER3E3Y6h@*fm}c!z?!! z>ragxFRqo&UY_XE6j`d^sG^G)-Z!+Pdq zyr1U#etAMCdr#QjS8I-$i=X36;0!q{6%E`A;>(Q+K>WBpA{_rAfGh#!V(6a)a*YUM zF_K$u^ELeEEVT|4_k4=oKl}_R)*uirE`4_%1o}a7ujOHNBp>9Se2NeMcs}@L!M3GN zsC~oBSHFS#>k({Q@cuSh3i3gr(m5*B`RLgQw&iPmMF?q73ND?uy@CIKkFVK+>*w=n z>;};<@OTu1YcF57<-Q^aKt63VR|Ik&UvmVCK@OBId|R=A+AhG6&Qg#=tM6;A-wxee zDdh^e0o$5_)P{eHh#)H#c&nEe-dM(iwH~-54FbptD;JM%D+hs2eya68fpfkO(DXgN zthocg4FK*A0B0i)u8Fl@-9h_Auq%juZN#YJzNPljNdQf2`Kj~P@?zm9Sm$7Jwui4-?T8}zzI-UhV-v>z`Jua4NAg-d zzhx~yZQlC`*-vaJ^MT zA3iA5I1MhDGa_uo?Z9#Xw*|L@#7xhY^!<4MVE0X5qquKi?I1DjvndwYvNekP?3lp z(6XaX1RBp?K)F$tig29dAv3wO06_Ng<@3B^K}!X|*0n#es2}i(JIE>SJOCT{?b(aT zZ#5Rh{Zr!Kw)>twu2b%z%OoA^ggncs`9%qh%V;Qsz`cdgB(OawEC|l*Jk-}1mIZ8m z63e@eJhcYs`QAx{#@04oO5*Gy1c#&A7rF;&pBQnl7HB$Pp&0IAQPMwY2XdbO+I^H4 zWkDXupR`MQSWJ(_Q+Rs+s90Rgi7B*B46;{I>mV@DDJONzn`-~02i)z^gak~ zKY+B+`=sF0I%-;?BbQ6hZ+V^JSLP}U>k+t3vsqcVEm91*qC%DP2(eG9xygEBs#_;LX|Tj)R3`x_!5E(?^I5q z7JBYm?fdB^;N3V6ytr++jT!B;imYv+IC5zjXJv*j)0nd#zYXf4-Jl-)L%QE)^l4DB zJ}|NkRL5(j*WrDW|w! zI~^xHO$U-ZmFYeoymqcHlY&M}#?B5Jr+sc8CFeXT@V)^Knj{;|zrpukZ-bzxmgb3g zYH4m0)?;__&@~W8GPcdI?cH8R`Gj`PgYKg-B*SZ+t^G07gyn`5YTD9|kk$}GE{|0T zLK&2Mtn^&0nyxQ*c=d)>dCipT9uX5-IEq^MDPXP62ekui&I5dP7l)ACA%>PL`)kt% zQbqxklUP}T>G1N7WhII`?fqg|CrY}P=(slDKq5|X+wt}062<)s{GD;>JXNB&f0l@A zW}o)15~}ZSOT_KjF_+YrhHd5d-im7VF|M27=49B%cx?ava@797%ZztU0RN+7x^`BC zt(C=~o*`|cnBmK;iu?8iJ#zyA0uz>a_jy&>I`#8axa}0*XqQ!S zuS`(?R2t`o$;Z~oOKl@Ur4R3$geL;)yf9f6#RNGQ?6lBxO`Dj|B1|{$uqp0q6LAf% z?_Lr1IG(Ig#|3&nwgpZhWN!!I2$u))VF7%f37qeU!23QGINzrLfl*1Q>Fme3i9AB={u`h>wzPCxQAVLCXgJzZ|9EbT)`X5xPmQI*A;vcSFi;?`zXtS z1QX6%JqO3}e;05MKY{DQbsF{Id*;TG{mXL4jkA$Xf;Y+e9Ai2;>lihBpc#HUEr#s) zJzyDz_u*|ZWbXxV4e_wm(J))ZvYuQQ%vQ0UZT>H8!URgUEjZs0Pw_4ZXJKtLnM1I? zlG^aedGR=?kxF7yZ-sTG>Mtv^=f)*f)VE(g9L@5DUS(i3AQbp4D`zOZ9gU`T$eHc< z6x0EGsvVnhw4;=@(k$mVp6snpp%ssR0M9s+aC>tqh6E~rVhV@V}D znFhSAgEnL7*n1{D`Uij>>F4Tx_#peV7wL z#x|b|6gT-T1l{2WLG2Yl?zBj44y>zVz1+ifM|hCe7Sg!yZ@wHQJjCG&N$&)3b^f)p zbpa2qfw!XC8CynMrli_Z&-&V1thisL_AS|GahZXaqh#HB0bD!wP#mvQ_P$zN2k!Td z8Y-Xg_y2e+s%_&S@P0;Jj%lg7L}Ofw6*sm!yr;?e4b4TgKyZ7`c!zWje>}H{9A)P? zoyPeP!>=>)eyb4DhC~>{`YN`|NnS#O;=V8*XMXf_?6CO^JFJ4~7Fp+t1r#6R?E>(h zW>|&;JdEKrdCM`K_?8_4!_azjihAQQU2DiE_=+?>P_n4k9n&?%0Mgdowo8OD^4{;_RL2a(9TH&-zxN;5m|v6m6!F^F{1a)10*ZUL2!lf+3>v=kuUF9X z(2sNE0Fa!A0_x|@Lr5chAm=Ejxgs04M`34!6U?rQ6s2=R?-gNe+xk+~oM+Z(vg`1g z=$NIr(QMHF#xc$b0sNIBsN)Mc)j|1}hTD{fe)80brLAX$O5ai!bWbV*xxIk;0G19y zcVsfiJ5SWN-aEnKmuUhErJq7~grn`cZi2zeqc7$14o2vvOmm8Ags5!@Yv-8*hUzB=*$E?&o#z0 zV4*w$SZ*v}Ih$C2Jb{pX`s`g#2zk(g$GB4fc{&?cT>tZ#?Z24Ho{@z#r=u9xe+Ch* zL_AiT=PK?Q=5Zo?J{eqJJjlhL>)NCVq~SV#nc2rn6!-J24%|m9-^u$wgJj(1zvbk@ z`g6`a=5SKK;Cw}2=vu`lY1;_%d19IN$Wa=fq^w@sifvc1TG~i(%re$#1fem=BfJv95fNM+o1|^ne%tuDu6aa?e;(q%uUI7g9TCQQ zc_kPizJN;K(~A`M^&IsJhdFw07!htY-2z|>BQyqMyn1pi(mXuq;W)~Pu@j;GQayY( z&C3o0$VR_+eN}P4I1wi~H7Dr)Np$j$?k2qWO~!p4UsK$J6Z9O+Y~v8F%H5!bi)ikm z2_M^!8EQIhJ7uhB=Ve9!;I)|9LIT@fV@n14Kt4n7bU~J>G(7zmJ&amicVl@JHbO z4;13Drt@q4Bzi`U>v%Me;)FbhkVe`yxJWn7ksn!0&o9&Sy|d4}r<8-&?EApud~Mj^ z>b3bQthA0_8}CVI^{??{yh&~v<6kB3p_+1K)A6tJ%|=KIlN|dB-c0^C(=rG<@ZyvTwU&_MEPvf~KF&LunDINk?KIDB)<4Suh)Q{z{ zz+1hmJ+18k-D|DN6Ndyl!BWMx9F-k5Vmsn`7bW>LUfF)p1hRLCaGb0gTi+9Sy+3eN z*Q7Y|Gn{;DX50n-jbUZ`)8|8WyEn7;zIXJ?+e_m|(%YHG?9v&;ZriH z3m_A29uda4JY~4!>yy><)ToAK!OBvpZI=jxw-ril9dFK2S6C#%FTR|Y+VH(~YE*0d zKE)0uTx;t}RX>VrN%_#8frTi5+;v3P-W6f&JrTyRu2J1SS#7&`vP#aY@)Y;-jq5h_ zO@r=uV)^A@MO&lVJ|3<*yQ^VK-!wSh5Tm|tPXaZ6lyiT|=G)8~ z9~K9Y79T29`WECX?spICT0;r=!#$p7Pfh34QG~`03O3*J(0M8kiW}b(zL>@hpyd#J zZzCL9o(@p^csMdzK!5uofE-@VsXaU#Sy%va z_&*ly@K|8SEC3sRHcbAPg7wAF{V0Gu05s?B4#xdl4`8b=fbL!k$d8H8WXHBD^KFxL zdRW(ZUU7Fo9!D+vACR^s$AGtQ!DFx+=onnUfvoWM zEqDx!IDuvzx$yIj1d{)ZkR9C($FJ0>4{lN{#k=)^i6d}Vl*XK3T>{okyDlxhway&Z znu&eSJCk#wf}M*n%+CcJ1n_!G_VxVi__gN_>)Pp2ATc_(A*Atm>=MW|N^q-b+l=+g zN0F8uzxHafO<8*b)}clj{^9wCK2LL&u2TXyKU^L)bXWfftMkP=5@$|i`~Kxo z8V_N}_Vcr4`}c7l(&A!YO`cQa+Oy0&wPr4{NS@*@JWT9E|9%n1#@Cmsr;>RPmA;Ng z6!&iuaYI-4d-=*Ybixk{zACV7sbA%44GT5C3WhVr zNn%iw*W@}|L(!fj0RL7Vm9m70v-~XoBM0;yQ2Yrh4De2}EK&-X*q;NOIUMU|@Qt@8=cCyn9II z-9HZx4WI#bw>;`aCWd+awii|I74q zTqnZZQ>0$bx7OWPJG-0CjUK+TYjwiFqqO;)-PksyanbA6C$#=J?em$O7(qP2*WGz{ z0^38(4@31SLtos_)+t{9hW_Z`sSn=dt8?PES=g9<4j{h`<1I#;jIxAoS{Bxy&A2sR zR_5`$zP!wr?>u*znd9r>A>b&BYmP$2y-S2WArba;96V2jhtE^5DvN6iOm?`3Q`{ex zW#^e2@59JX#bXUT_#Hs-CahZ+R^f(&gLn}__kU1rA zPC6EXGsRy|^CB+=o7J1|X~uQ9*Cn)r0yy#BNY6d1X>N;y#pUr3xMwo)O^|oju?SRd zI`PZx!SAtua$F;P*o<=(zsGrH+4%@&JcJri3eH_Y`AvWWKi17U^FUsb2ThdA$>z+P z8Pz;_&~#%)-H!89b@xuro!Pzki7@n{sg0qbN+ZP?HiuUMxQ6m zCH%uKU9dS_6VwLVIhW#X{0~C*8siD?rlM@(|$WG25DlK&5#swu9PRml}(&~rHH+X3mGx-ugwK-=2=bV_=VXVPmUqAX`L5!Qyhrb zOHJc7g`UqC<8`7mQjCHLup)V6c{!|!(4)a zfyZDGmf7ccueARuz9T&EuSV&8*k?cY82l~A7+jVy23O@60}sQfv)-9nM+Wwt`Txmx z8azB<-k0jq4)4UW1mg> z#;&0Isf2B@d}4P}&iX4d{0n&?U-yZwIRqHQbJj7ZQXTnK9Lq=7nNd(jcSAA;fiF~s zPYlLMF1nPjxQ{T->5Xd>TK$}&Zrrb)?-qBjs9kU=w&RI@z&+dy<9Gf<;X%i9<0FLZ z^#GYbX1|*(-CP36J*(-x12n!>2lO8;O1|QL2O+yBUva;k=Hq-l%?>rzn6bwv^P(B{ z`O>Dik^2^4{8PhN*3SU2_16;J%Z=|lGKpa>Cy>9t@P-|n2!oDlmwKutPH|ikD2*@c zOj}$F5v+Hc&+%z8uAQup+nVB9IEGvUh14c|s!$1fn&O%iL#_z1bqP-P@H0(ut$zZ! zPG2SkheX)pxO$elxq$kY(P_#7c%+5Kx_`Abeoj3G+f@fY*0p3FG8rejfAbGX!ChQ` zOXEXQa5LB6g6$1Qm{&LR)He)aULE*^#r*E?tA+l)B_@6%;wyt{#xXF1eKycsV&k(O zxFcYpx)I^&$%vQWK(TrWJ|XEh!H3*>7-`C3DH!7VTRexQpu+XHbdHFsG9r?;ZDMT- z0k{AZEBNUdhq11EH%mbW4^5uU_*rQ3d_~eXe?`)l0vtKQQLL`cOC?>oRMNlmiLNnR z18XFXTH0A(vHiuR@IVcl)A})sxj2Y&*jgL}rj^9C-fEMcynU7mSI<(vUXsce!SV?2 z?f)pD`c*N2?KB$?EbDASS&K`kZf0>4?n5@pNrUwo+_uboRD%aRbO+XXD|}B=E?dHF zjeif^K{?0YOd$C%)$7Umb|2q!0^dJU(YFNOH)jpy_xijzu65RB_rYG0%1QYTf`;KgI|kDNJ{R0lTjcd`BYy*ubx58gvOJk8^zIJ7C>{tkrfZxl26zI~S3(F$s( zoyhk=+?G?t*?Q6sO3syQnbM~#(sAyRI`xfEZw(6^iQoOs9Te}PMuf#ZysfJ!7gvZW zSD;>iZii5Dm7{E1Egr{P?=Ud%D89@eu};SLaLgFN;mHKMG@#Oc4w8O)fy87O{lqrE zF=vdvUd`rBl7DA8sDD97i{-G#BLD$xZ;Y^Wz_7qOO?z^HXIQsTOwaiw{7wo9j%t%q zie)p+^T4v?$4%gsxbfyZribF+e%J)wPy#hKf@1xYaQ#X_C4rijHA+FHk?^Z^^#jOw z{{AM00AQ&J2pw%zW=eVozBsZA=VG$Jk#6;f+&P>bP{$L+PZ z#x+kIx%vwwofjpdb3Hsiu7xu8*Ei?KNh~SeU&Bm?Na1v(#%32Aj}RGyXVT`R(M~K+ z1pMv~(06|wN4PJCll?f5f&apTj1KDBBAc`W>rYaFq*vlS#V+m$&jxZ{g4=n;8p_@J zySRaWLw}=w-ztLPjCF~C1?`dO0xF8iLz=XQ$Ps)5BtCi%Aq)CKcW z@^52NTuaKn62)Co%zP3id}tDjvxCen!k-lqKn`)>sxN@KoB(oLM)^bYQ{^u!V)kPx zjj6dP<6h2m?+xtUUS?+KgGU3xe-$BExy2OFZ92-=T}0dvBxX z0lqT;0T!cTJszWc@HQ}bj4FK37J|3F0FFm2AnPn|dPJxp`rDxx!K`v|M`1C32HR(^ ziy&7|Aiqt3;68-x@3(_DO6(l!pZh6m$CIqw1tR6uxRYRm)c8)5IbQ4hpBTZ9ZSoRb zrpmXui_TYaJ|9Q&tL+pkjpip-`gY;AoJFK9xE-HPAi0l+?nr)Lt(WJnsvm=H2ez$d zOL{xlj|}81Zh+oeme1#ge8oM?Y>PcPa9pxtbBcg)Z7vn>I^khhviSXd_fEpA=^S~Q z%A6--NHcR^8d&q@eeOG}i6554G#YUUUt|6KEzt2v$04A8^^Pv2Nrm7I1CX_N0vUL` z6~4>5kT&-#Bu{#Ap9SVFAQ){GzROpmWFGyOVZ4;|rLb0h!GkvhxjC>t7Ak#*u)PC{ zTLfizIom&e$$?k@WvYxvc_Op@3o`C|iUaSKfz*AQaa}RwH_8>+9!J&?DDH3umEH5+QsCW{9f%$UCXBHCr#IToD2hF z=Z;W`G7N+LN6*SCy{}nE$OwwOxpTA+B``PD7_GvN7S7>|fxymn-^ndIldFg81empN| z&hxSq$8y&IklZ?wpRu$6y8Btay+f3Ak0|Mlab!1NqX!G$I>_eH?jjglZsHWU4J7^0 zH#r^ay^#taad07^akULR$U}_Z#R6c9EEm91k_Cj~tH^IlP%q`AGJPFzEe3Gs!(N^fwTd;g^rcHHn9SFp28S5uVuUgB>3< zs~1hmwu?iPC~h;=ajSf0`7mIS^h%Mo56gr|0{I)DeP4e9B{^Q65)}8c<8gvV*kC$S ztvw$*;=hYZ3BlxiZ zzE1_t`I*4`4hw?s6M!aM_J0BRk5o(gC$l7d3qasMOtStH0RN~^=o=xqLj}&TVDXI! z`J}!vp@@9qIz$!^oF~#Y{c4J&-{j&$AAR=64O*6}MWDJ?ExRqGwiD5-c!+ z<39$WW>sHBajZdrz;zkrEvTmc&HHndH+fQA^OQ>Z>(jvNu}FF`E~ik^3s)g+;0Mjr zuA8E`Ul@yPBg{wV;UV}Bav$Y-YssiDQceAM@8L2_={*-^+|yg5xZg*}zKrKdZjAzp z`$tFOS{R^ddd9t6E!7$Cnwro&*U<86GwvCxRos6;$d2_SPY17ZvA%~har4N2W}z{Z zoW!eU-3&-92ft(X<(wBpSWNt&0yOPx6W;k=p`;sj-3zOz-uNhsLk!)H2&VT?5$thn z_^ST1RY)`U>Ek1Ge7o^jTqEh*~>_O%Iig{+obr%=~>L#I?(L}lAeAh!}+R6 zf9<|atEi824(spl5-e{)fIu+c^bR(GIzZ38x57is>PUX}Tw7O=g9{)n#)$g$R;*%Y zVWOnhL*)@Af#iJ_DF1-r!YhT6zOEGX%Wp?oe;hSwneCX7YDXwXJKP1-zyEXsX&(@O zG~IXl*}l`yFlCIrr#+wUJ?}Swt>3gybyChb-H2nsaxVFQLGJ$zE@3R|N7@uO@G1GQ zSA?y`zEn3xeLC2VUuy2(UMe3JT&lQ#n4@oX1=+Z2^+0*F!~de*oXo+-dq6&T`xA&@ ztJ@PuGuHn)3+QA2$1;D|kSdc;AWdRr;<9nM$CwWMPCT3UEy`kc2yY0(G%|b^`);TF zZ|3+SBbL_Wr*Vc@j-io%t#^q#{=iFVF}2q*{eQ^FAwNd5|mm#9lnJq3>={_kTZJFtz7=l-jv^Ww4u()xHf{z`4fMv1IF zo9|l)X`Tt>Qg|sC<|!9%*h2T9eUzV@V6b{`N7^%0*X|eX%a{6ZHi-R#7o$G zPa>3z^Zao<8?QQP$BU_b)O;4C@DTX9#k3x5oH}$xYQ4W=$&L;CR{odAhMj*q%biG2 zF6iIKkp=?AJpPEra1yL*ENfeDr@q5SfxeSp$B}lJ#`F^ZOVjO0JIk=M6^`cUHiF{5 zN~f_U_?e%@iLSiIvFU4Me=5EmY40Lr53rah!zXTV1)1lofxCLrn6Jz)JYS%7DRHEQ zcp!7{bOoo55`R(^@gHz;dj1j;$D6~Z*n;oHk>=vCZe=6)Vi}C@pG))qNSmj}kyc54 zuX}R&kUe=I_aD%S-dr80^Zb@LiS;3EF}LGDjJ898adOUeeVqEmUR_CjW@PWVLJAJ? zwj#XuJj#4DSK)FQ-_!dmX&h=J+m}y{8{=C+xENF8Tj}$!LO%qXcbt4-dyr@se)%;Bg)A#OPQ&cN?AS=NiAT1>|cF=-Rpj@*8UgzlQ~& zxc{CY`yAo99g5K$Axj)-QXIJyB0s8pqZOQr@5S@MV4X6q=<`|T@{wwGe>lR46P8|A0O_kKp&VE3K60K6yJyv6Tp zfUhdTYvaur<($Fq`IRq;@x!utR}t*#$cWWG!{RlKcM|--`1K7Q^D!~rCA7I?Ke+Bg`ofg1(Ccm#1-+N08X+Mpjrc)-q zN@Gud4UseJrjr6V&&xCGah!3UK;-&0dD*&7IFIN$PV;qnCl zvWHd>KO&Z$Z!#HP&-7LN4qlo-8n#c$0c^`C4!dvnOqw(2f%bhK9$cLk`ke>GdR+;4 zLmb^B`gzcex#62YTFA&F$XHL(B#>u)q?32vKY=tYhWARl@8AT*jtMh8W^^0P(Ox-0 zxlstmyai<3zJ6ZPv3}eog4YAkWCO*zlcyY+dnYKL(*WMrL-%6c_x5we;+J&IFSGf%PQ;oVZ`_(K8O~|4W?}remg=FzTUL(!X9u zeSahts94f(uA^}tNxxsQq+eGDHuLBEQ|Kr0JCuQL_y@^%8~bi!->cbo7DL2MVc(~) z?+xsG1N%M$(qfIcS?v2P_I(cfK8Jn3gnhq+eRr|%F7~~ZeQ#yoFK6E`H*6tZedFV} z9e);m61N+%idfd|GWqHJB8+*@w5I#%ik0ELM~R;xa4z3l(&xr<8yf}1{o?UBiH%Vb zC{QF)|6Zq{xStYXtV3>7o5k#P|C*S>9a<(T?t6~Lwb2|g6u6xR&U^2fR<$Efaj!WV z*YLF=*O%qdxRRAe<91Fo`Hh&Ko6DEP6`OuDz5C>EruU!x%`^v+znSJi@;B35Nd9J; z56RzV81Lr)CC^ovZZv4tjZT~J--wL6hswB05dvR7z+&a6f}g8VhLrPmtCp?DAww$K%D}Ly9Vz!%OMzE&Z~s`ikI{o$R1PE^{5DPg$?}Q zV;qKjmEs-{Va&0;O)Wke*M0_IlQ&7*y!qg|fdhX9^9$np2MkP(?QQCaMRD6|lwouv zu8jybpP#pF!SjZcC0?pN`=PG&ov3e3%Eo&#WMehRkq>k&O!DJvoURqrX2A2IV^u;6 z3DC3)%e6wq9d42I%ZsA~%P}knzR}A-|KdYk`xuWY){`%j^g2^L-?S9uzb z;_eZ6l9T^x0hIp=py)-IQnXZ9)cv^t@+GYO3nnXW+=o2~*}uQa(|Q|#D^Gmj?Z#E- zy#NeX7tgt{20?5KED#@fdtg=P3qt^|-c`$5XKk2jt^XZ#_X5aJ0OcJbs3Qp39SSTi zC}TLi8@O)xzEZ0rWUmmwzaXFT9eq4Ge}`j}v~A?0sHRK;{|an-PrhQuL!ryJgsf6< z*Cy#Fk>ygb9=NV>p5pGzQ`}J2TdUZhwFkr_Kjc7GfF~HxPjNKgvyZPOcFDcRP}5Ex z+U`Zj{>-k+w;V;tPI5+p-_i$gRM)aM6Fd zmDgsrJ{X$0Ww{9I!Rfq;=fV$)6gMwQdXK=7IFcTKwzhmIj|sI-+-|%sE+<^254^3c z^1RT`flFG|**Zyq#qIZU-QVFro-}3A+fXe1WO*5=t3ve~CUt$M6}mjF-wD^ZddBKo z9U>6^;Yk~&THAj|aT!X&KCVTosGRI)^AOL!!+g5DT$*WDrQt39{hXW! zDNbC@d1Etpv3>tEAJ=*XQ=JW$sqo6B>fiWm8NF2aa-Sl>B&e12Z!D+&4=nfJ;ApOv zaVB2RgV)1s$IF|+i{If5*GI{I;X&j~eRxiORBK3}rn9E}-C}x{?D9;bSWQor(Q{tz zl1JPQ=)c?3DCv<096x`u47?3->RWIF)hGI6lrwBP4_+yTT#g^c8FvfCiukRvy z^%wuA#E|P9lKX3LDOUK(8)(kwx$-MW%#%&he}1tk2FfPs>)Cf>-^;{FJAr8IE*`hZ z{p5VlMdFzNy78K-FMzrIBFH4?Kp?SNZUMlC_3Hsd?bv&M!SsKVZ!^jFN@J6XRJjq1}`ln<1|zRV+}6}Nj>q3<1}7#8T(wsKJPl79mitq zgJ#UPZPZ^nJY?jZ+tdA}0|LcgG;}oF7TZe;^>qp4@8zZ75J&ktv2OkmRXee zz65vf`o4bRpVxQ3xxN=Tb*Ld#-?cgF8~Kv@R^_ZO6JM5hhD`VgrwzZJ36JRh^TA8x z@otKfu_Jh4laJx~R5pCg^6_iJx6`W7Ljqkd3z`>^|Pi8S(o=<{0)IIG(Bei2;DXt=B~fZWiu; z5r8d3c?3;)6T7z0$&1?E*HN9I0imq8D`NjO5Se=fzgM*}YR`pRq#GxP9=@Tmwgp2MSEp9h_4TcYa%(pqF z`F07JPxKyz=0J54oFOTA9zYP^!--OG0YGp$zAli0odCfV__|mM_5uW<7~3&mW%l+3 zLK$~Kre2zi(@gPkkv%CQ@JURluY8EKgB0(HT_+2eOSTYw0{J1>0fmiB6z4WqOW{5vy#Tf4tMR zUDC~b&3l3H#W)oU*1I7<@-;0G*k-A2rkvz-&xo*j2rLiw9sDj@ONmYQI0sEzy!1Uog zc)xE5Ez}!BR4*o&Ix8eS47gq@w_aF^G-!bGq}=1Eob2buTk5A!n}VF9!8DRD#pfw* z5F3Bad~J)3GJms_a%)AI{*LE>AscW#ya{8kL4?J)>>WTj-^lY4)wiw5HJ*WOi1&%h z-_^B91q34tL0xq#$th{UZKtu9ujGhhrn(WNs`AkscES-(?%>tzL%p6tavrKi1K%c9bh_!kw0<41f4BjoS%x5a>?CsE+n7 zs2!J6ocPXi#f{saX@_6P+Uf$Z5k1TT!N5v$^U zC`Z{V5m_7Fj&|ZtUsk2KcYmDnZ*Q(r+&e#}7@q%*lJQr;@WkZgn%Znt+|PYX zIYv4yQt)02=nequhFSsg7vr}Sk!9%lc%5zAG-f$N?%17zYah9=c%n~Wz2yA`>OSKdCaG_exI!3% zIhPRME&2V)N$TH>>)0gqugP)>)xQ|mR~MqP ztm+fV_FGjgSyzSXO_pDws>ZcqQ-7Sir&8ULyslCoHm;9Wsozh&FT1)q*@kMh$GE<^ zTHTcFW3_s3vTZf$dgHpRR$XgcZ>m-AGOoW~r`};)zgefQPWE?-db@F5FjZY)TzjXg zoyqq#RlU`?o-s|mDLFT$sW&FesaLNzu3xHG-O1k@)NdNsV-4!n$#>yUuQaarIMlBh z*K-=xg~|3es*-Vis!{#71vB{eb)@tm3&9%sdJNkIZwSP`7UOvvy)}c zRA(jU&-vmd(5Izs0z_`|evUvn>7JVch*++Ku%W-0nrU&{(M+zACNV3vs&(B$7-1Bg$XaWVHJo zM0x+tg@bqTEnkjOM0viq?hmaQke9gETU zXra=#qmkk0=@g^tZ#NJ3u$K zryXT|OSl4RuNwCde-T@^AkiGLMv#IIQPS_UM3cFD*=soG8JqKT690?yneo$>H>U8@ zUY&?hf7`XKL{}QHF@M{5i~7Yx_E;*h7&&{hGu(>jGw{kqpn-LT5j8omdDPvlE&;cZfIsQ_J`5|ATTQ2v3&Z}+;tH5%8@O`u14a4pS; zZpZ_9e>A3ruaI;yulKa61OMLZCj8LGd@fVmwV+t>oZdDO)A|kkjGl}$vl5Um-m7bo z-8`|iuDpoyFnD0R<@8OGemxI?m!fR_>}eys(F?BWbsOVxD4H%KMp<0#52J{b`O!>z zwm!m3dUP8EdyAwt-1iPq(kBFPE?Cvs8o398cwAu0{coTAJ+><)ea0%!_$wChk1Qnf z*g5)5Iv#nT44;}A*Q9)Kg%?VCxCL~jNYY1sF9nwZ92v?3xi=sGF6poC)irF(H{?N+ z!YOW;@m{S*gcdwE6mGmZe4iA=b2xkv1ReO@S|vSJ3i__4y>5LZuAQ+0i5~1 zh^N<$@5lEZABk(fLCB8#0vxzTh+hnxxL>$WBlqAr%6Bc~K(2?nu5c8|xW9kKdrb@I z*v7gP6gQS*(H;m!d!%4>K9qllaWUdKIZCgskz|}jZ4O?`JvnpWVFQV~40tkpA^a>U z*bj<(DZuImgk-F1L=woQTqEhiO^i2(=E@TpXJa|zN8(8Ck0Tkccj8ZZ41$MKvAx4t zdt;fT3&o5({uq_>qxAgDz?X5qo=D}RXZmYm8JycE8J2hT2I?n0BXCZ*TGFws*s}y_ zX9aL>;2>~XsB-S)?Oj(1AS1r2>u(~+9;>87v84BxJl=xGqXfXl&8Fkf4zSvjKtvxo zxa(URONc&5_p9IFz86EcC!Wg9%fxNPvNs}BI{iy%Zbhe+V%<4rNWqyC)Gr*KL}CuQ zL-`;FEKvR~LiV8vlx&x0qOTd3!-3*{ij`y0W7_w=LOD7%9Zkhq^z-fe&I;h0tjDzH z1@PChoW1{Cf;22U-T;t^OeJ{`cHiAgkhYub$F(HS?vW)VMwi4%t~p9|G7o@jNj{W+ zfsnn874Ub9!+6BoH|P5&5ittMo`?}IEu6o2TiGWQsFCEg0u!+ zaVyV4@XPdSl4Fsj=kQLR<*m|qAo4DqgLsVz<1Hr%eoG1)#&;~0JC_U7g4z^SzF!|h z+TOU4>p=5PaXn8Qqqb5A#+!S1IF85h80B*tK9j`Tr1$?Pt7|A`tf5NZ)?-L}InLw? zPq9vMIase&CMbT&^8(dvKV#gcusac#jDG( zOsgijIYG~6UfsQo#?gDCL~nB8`=7g!<3t+9;XmIJdNzuN(pZ)xDj`@c@o;SwoW-@rIbgbITHFg2dqmp&spJ>!W^ z&be2z}jo+s7SD7i1dEMAa zVwnfAe(_#7uJz3X{qaUltzvtYLUj5nXAPS_4|YhwgCsA>PH@=%a)`G3(HPC0-pN;y zv$x8akq1%X+nrD5hWl^~Y0?DY%F21>xA`KPFD76eg_Teddi=YJ4L();f#Naqc{di2XLjJny!Hx`4*T4dVI!)$v%8FAvXk zyf*N9%ajjB-eb|*NCSjip2JcQxK+(f9Jma;Omm*-)s-|J;tM8|j^^g9cJ>>*^=$5% zV~Te3;P-%}hwDI()Jgg_f#5;vl5k0j$07ymZ-#D;2btzcQW-uw7cu`fQ54k<=a|Ez1Q&+lXup=DkLmqOkC`(1pkN)> zL%H9vO=Ucj8T-_q2eR!gUGwl#u-*mT0|_MCKp8Fou#w*`hwceH-mBKNdM%(%#xxImC;wcqx{H2+0khhAl9*w6%T}*WDRI@(9B*#QNqNET_7k`UFYtnot-eXIRO2 zzqdifLG!*w zidWWpmSX(vAaRT?XD2t_0xae<1lyY%a_q}hpbQ_UKB#UGpy_E&aU18Scwdc9AT1oH z`Sgvfd=-)W@osoQ+E@}t1SeGCplNr;vqvUU>krHC&*Mm*&e6D1-vp8ua*F#@##!kp zrhlImIKr8L`;KiCESroxH@x;gzky;$tO1Zu3YEU|2#*BCcsOzc)h`~LiS<1rr_x4p zwfaSHaYv*ewnI36R?E+?k#v#=BGmcby#WzBZmCey^&^7iUE{>R@4tb@`M&rW-80+r zq5LdD_BU^!dUu3iJyPr|tjqiaA*}(g_srbOWWE+Xqx>mgJEFpeW#}6$2KDtbRBy)P z_h%!%S*Y<{UqW@4M-xbcH29 zBxmOMsrH|^5jHe?`TBY2 zP6%Gh+M>**x>|TG1Rt9~fzCp@Kj8YUhm-vCItMRUv0b_pxUPQ(khxh9teqtV>HFu^ z?-}`k?Vx*$py>?&8^q+d0iVlA3nhJ_6TFXP z^tJPsslNW<4Aq;=ef=u#D=6-p0BqrVq+o*uTzvv`E4y#pxH^vHo8qYHv{3ED?=N71 z#nZoqv;M^eQKK4_HCR&)C^BzXSHnJo=221KGQAsx`7u(s4UZU5_-y0!_Hj7AJTgroK08 zXdaD!!uS0#L2zyLqo1OrA7$bK@XC{*#a2+(+?EfE+Xd*puoPrmCRzyk*>53jTmUDC zusGZWLC=3f(4Sw>tnkzB4&MVr_nspBf2@6bd=%B$|1&e2O-KUdvdM-($p#QH;0<;Y zz)KDR@kSAb5q)jnvH`2s@KYm7E&7@Xcx$zmk?1J(l?7`xTWwKy)%8XK+FGp|!_9hu z-2_kp)vjMA6zwOT1%x2zPbC@U{d0ZYX1GR*%lRZ}weI=#+bUvrY zV|-3K4v{*xKcJ#%@gcg$E7%#=wydh;$VtP`PzcS{d7#{hiDwDj!;=u+cm}kEn^1_` zl)&$OjQ6{Xj;#rW7{30^DCD(+`&W;lP<<{m54MBSCXSp)X+rhhwiCHbSATgv(eHc= zvAn5i-x5Zr#$1^D5~mY8Pv1A>$PcM(xder1|6nh1(|tnq-UZU|rppQKzteBl=Y2X( z^zd}RrX7aT;lHmWI-NJFPqMZ4HPLAG42+sJU@I=M4bpS5R=kQG6u`%V$8_h7umL>+R=r_v#S9ubl;s~jXt2{!O?n(8;<#w2BJ)`LT>HX`+#QCTl<}Q#NO-&*wwG#IOM5MBs;`uyZq9&H) z|5S(T&0SNu=n{t8kkXgVlT3c9>1Fyn_q}Zrd7fGr6WtXf9)>k#NBG#41|NzNwqB}i z=rEnbj)^D)QBr3T#Jb;pl=q_=RN3Wdy(T4QCu@u)_+b{;%T5djyy;4!m)T%0uhmz^csRXw z`=24y*pEU~-dW3RIpA;VX81MkguMcaiHv_u)kC;;gm!wuun5+R+xoi0+FMH`TZ4J8%1}pq=to zm!Wfa#2A+K+zoa(*A?ab$?Vs!jehN8bqmV(`2v)yWD@*$3*X?d{zK=kL0W| z^V9wtGx^E0-J9yKK9?MOb*+(iM0FFZ%>YCQP`Uh$0%!{hd9^G* zaT91O=NfUA99nak8WObO%8yA%C%IE>>z)s1#Vx+T1%S6<$s8EvnKY7 zQHIaL<@v1k0;}F2So8)+=nWupy+HwR-+mph+xl0ATTt$Q!sw?eg2yd@C!0ObD?C?M zZeT7(1Wxa7`uJL5^(zK5{Fh+Mb)1jV`v!}k1Y*S9XvqEazCRi7yvuwiRb1#g??$08 zYpsrgC9;m86j?0F$R76uusC zc!i{en*fI|NBBL3=#dpX*Y|lFC`-?RK=>-k{}4tM&_=&Uu0XgP0EZXRa{_SqCkRiL zAQX8Tg#@7IYq|gG!O%u|Cw*>W1^-?JfPJQaVf+oXv_GBqp%8p+xCFIpbe!}oyLy?;yw6=uX!q$SfuF5w2 zR=WOKhRu3YE8-_9QW%&L5n_wYc;vqQf9?dsm}SICeJc zqxU`(LU2i4n^-Z?)D=eMshYG z07cJ*V&7~YV}6rD^zeCr8)qVX`$t6g=7LAb9ar0yKXM{{w+~!(k$QxyzeXV;-&G6w zMYUCuqiGgqKAA&Msw}G(L80`w4TiQ8##n^GJa;d$Vpe;P(_lJh&$ZNee4WB z>MQ>J+v7wDpNH^qI;JZCQyDKz*U1VL>XRH)UMdc+fY9xfugyo;dyE8MB*f{ksWOXI zG{$nCF_wxwl(!A{_w6xo-p)g8d>7F10eIT%BPagdc zYcA`tvF@2?)ZZ_HW+Z^Z^t^n8Kc8p#v*JVv-_Nj|io^Fq=tHW{*yyvv{g3Zq@$H_k z44>&?LYyZ>ghv3vEfO5MXE^Fd^z4(kE1n$a3_*(;W zm%is0M&Dm&`1qU_PtPNIcmcz^lGR*R10(drJfipRM4=XdrhUNaL+@W@&}V#{D6i3X zvNog|`iwTuuum*N_>DJ+?m9}`w2ehJj)hif)X!ynM{?BMJI~-d3c?+B2z1B@t9A&` zJ$H6ta?edDH2H_qKV=VLwJ1&5prJsO=VPLG*jT&|zvfltxm0GbfxA;inC`98e6DZsyw5Ar>dlmZvh@S3yQGTR z@N9%f&*SoEc(b7OZ4xx9FFVZVZ=1p58rFzqO^ahhq4ytUa;2k&)B_$ikLct^LpF{V zw9~W3n?I+Pj*D=&V?#KkhVjg+as0xX?tc{ z%;pm(dZdnHF?}c#7P|sA2vEH?vJh}&2?|BJAr$!~3LU?kpXrfp5Sjqs=$V-MUY{M@ zy|oDQ+5!B!7wWe~smz+gYLzsvwE;W-E-8mL`p%j3a~ld#`c=WOrfJMS?esTN`R+K; z>9bT8sRD5HOQLpiy2!9-@HP|*4_ztOOV9*_D7|MPyy6(IB@pQqH1plQ7;)3*X8BziH#66p`ZCyRx%Lm#SL%f zH4Iq$*T_Vl!p>iZf62-itC_RJ4s%=VaBd_{6wgT#FfpL4eY|01%o)4$wf41Xb>fd0 z{(q}&)>xVf!?uGIm<_D*`+DoG5*~4`^-$d{7*5E%p9Kk1_qv^O5CUozb&vne0KIrM$Qf@XHUx7#38O*UoBq zwo0(FXS1MHZyBtGCCPtsRgC)qP7;OLoh2UAKxrQ?8CR>`gm9G&UR*1JqAo?aT2#BM z!FL!y_)XOeI7DR{YrjSpsPaw6hz`eyo9XJ3t4{q6g+MB*ou04CX9GAk6{vD2l_TgJ z39efDzbodfOKB%xm4AAS=-w#tJZjjA612`&*;u` z_b2Z@`Gp$bOq^@@BxP%qIh&WARanEK3$d{sXG7{~OXvigdGRQh|2zTHH} z@i4+Z1Ak{iFVQFELz^mrn_ag-uyr|T>L^hwxTK%T)^2M%n+B=!D7q&15x2S=VXqB> z>fH#V9A3Y#;UM$V9NM45`#a|#(a)Z1?9Cido-R=3X1d-VMp%uK0HbMiO$sfg0#zPF z-*J+78tD2mo}YD+q|9A!zABTWL|6NXXR zq5@U^_9)SzpLoVn-NX*XJ4I-kkP8ayU!JROfdtKG+PHsVg9uH35)2;VLZJnc&{Qpe zB8)+y<%Uo7rbFCcrHVYhO%*^PA~aK3wr4xX0lnozh9T>w_aPw}ix-A*sbi2-`CU4O zoy5Jt4$WuUK{3~PtBv=u3hq37r}OuftiSd-wd$?>e=6fubxhv(fen<$dw3kB6I3~9 zhvIc{;$(AZ=sCVVl43`DI$xEarSCmKJYjn8-3WJ_Ai+)fscY*gO1l%pvpr6n&@uVJ zs*dya-Iz94qa{^tJ4$q4Kksv+lUQXH;3cM zZIQr3?9hz5c$^^qC4|Z*uz6|ztql|^TQQy3Qd{tY1Khv4p&Xihbo||FCFLJMJIob6 zzx_3;_q`xe-rz{s^j74l^7ThqT)xK_=UDsn`m&>3=d|9tC{LAtO8eeT++jP+T_Zx% z_>)ATa_9UwaW4EbV)8ldi%jYDA@MvI=klj{E)D*K+aeduA-cl`bK69Y2fgDtzWxVy z@tCl;{+Iv$?Z-qhd1>{>^|d~;HgA1e9l#P$V()Qmc1p)Nb2vUTm5ti~++G+*<>R@# zC=VVqhuH+j_HbI$@6|orZ$oK1ZVB>L?pj!?@K+6jHo*qP zbYHaQm_F%p|GYuaw!FZo&z28!>9yH|pzVJOppEKlE*o#_oMA@JiwMDM4@C9lHaN&+ zqz43T+SRJ8+Tb9Sk$!t1(+691Fg3Pp5}UVSHJ1(Ix>{KQv{fr{y~@q^B*XSLaW_dikhTKgZT;5nMLd{gcIL8nQbx7mtIs~XS@7rqJCrRLLnE}m+*@Bb( zeESHiZ|FG@3sL^%1yCsOIB3LXAGY8$TV;;Msb-9v;HUBj&(lbiyS*X=zx&QIue$_o zT6J<>od+`Wt=bP*VwWtkHLDFIfnN|I_|LR9J1uRB2e>?4ZOGG)9*F8b!>7t{U}hog z6Cm(jS{uUXWE+RRi|W;uetk!I(?U@j1*-f-gxj6y+S|wT!MQKa@IU^)Bb?WJmm%yG zxLi3pM)U>%uRu`00EZa^Hra zeHK7{WKCRPIMV7yvCn)TmBs10Xst=cb5DyBMLmo8qiRh#`SmE#!!};as_`WhiX0^# zhQIX^g#JLsV%)c$-WMnCogy^<13*C%C@!(1+q*Hp@AjYZ`WNP!oOYDcgUYRx9_mPj z(ZFLM{|uqqjW|e`B@S}JA)hks58#D}I>h2h;L(K;&`C zlzuJ&g5G?D2VY@{6UgU&b9&8d=XFp`Kbb;^bEb72j1#rBRmpX5^LLr+Q#cUSjanO) zJj~Zq{4#4Tb@3U_qoG$Zo$72Orc*(<5g^z&AK^|B0%NTGP(^KREZL7Af5+E!WGG+L z;qRilgZm8lIdFDbK1(Gicm56Q!W_hE>NWxd8fAoA1qkM+y=PiH`JPF}d!`ks@*YB* zeUjwACD*7`PuE&*(ssTq!u2;*0Qa$PQ`;0svdxi3o7F|C{7Iq?Um3HNQ5irLz_UB; z`L&kkhZxUy4(76X;(4zs-)TI*HSPIoXiYpH|CT>56shuybRWwIuayy=c*wB9381{2 z_I#)1`R|P9TZ>eAEg{ZrBIWDltPkT1-#l$2kk&@4kZj{iqm9NQRbI))z-5UFyWQ^Kw1#|EYq@))9ol?@I6mMI3+=n@&=$_)*THiA6FaoIjO$T*@_LsY+Pt~o zUMKTh3Zwp`+*+*42YOkojC+{jm;ADqV+_v{xxU>$UC@r$ja*5o)L%QBW9U32^0*1x zaMa(ikDgN%h8@b`_ZL8$Yaj89WN~l9m@oX}UT%*SSzL?5zqyy!>zI-Y#XUS%lKaeO z^B6N88&}EC#bRjlO5h1g!~Cci+E`6v3H%)ZOt*QO{x56(G_#TdX9-9tOt&j@x1Z- zdE@s_4UFlZ8dzSlP~sB-1Rm+(xH#;Z*ZA*R<8!g`tPK+Q*qInMV$D%WspO`1PPQpD~(sd8l7vb*J^{`yz^}mPsVyCw*q)J8S&?s z5a$s|sG)r0_P??kC81V^En8O8X1tf`D~q4M;jcu$4Z!2Dq0knQ*;Q)# zzU9xg3ZQ(E_FU)iWPfwaJwBAjj&zhDEZSzAF-ib;^-1D!jDgU0<2u#jTKkEo)CD0b z1CSUqjYdTZ&J zieX9c_t{wOWrj6CWlXd0uS(z$tZU^VN$b3X?KPHLQ?oy+_e!OHlQ;B;u)e`{uJ*=$ zzGgWNWp;cDst@elXKA}n($jd_k<#Nv;ksCBh>6kxU7a_^jS%{vm9tZrOe59`m1THfWGs(GgZR%?xZwM|d< z>q5ZlRD{)B2zVO+*NM>PEdh*jAkaDlVI)DDn#=LN2NR0&pIya zc&y{F_S@Rulz!4S+oogIH~Rg#8Mx&vz_fpqXACj>C_->i+S(A#O0JEE_GR+Pk^7_i zhb;e?x4Vh*up$&1C8}~Yh&4hHgd!rWr{k?ItkNzZM0fQW@z!HdND#mSE)?4T4$RpfR88vxd)AD)T?}4%WRlAso(uV57*e<@}5Cd5(BB zVZLd%_r7WE;qg3%>T^Q$BM$=hjzlEm(z0`<}zE< z9$st~>m%UY^X$ed0^5cO7-EsibY+7ALwnhMs5BY*he?{0?UIdrla2WR4|r zO&mt9$=0k`eTmqy=TV6AVeN9F-?k9pHVJ~XU-XRGDGE({0hCTV6hC}9_uaIKJnw7> zfaBN3wMB_M3_b=g)NkuxHlI>|wM~_Oa)8@_vhg6_d~QqdcB7D*a}Klh&)dn{?Z|;( zry)~cb|9H+a)7SarBr{cdZa234!I;APv(Qkb@blW996#X0E@qH)9Xm6sB2uv=VPgn zhi=yH@3gD(qyt2Eog{AGY82`?Ih5HEt8-NO%mX~;wA;|L8*QpQ?f}t!QR4Z~qHB)= zRUUqv=&pX^`I}K^l;txQ@^$ptPL4?q0(eZH;@%-#Z+ZS0Q3Qe4pQUXT9bk3?Pmu1z zJIu554Qt-6e|Z5MY%p|Vs+)3b7O95SIXj)#IU}P1heZf3*lXEqm)NxGwMl;Pz~0QW zqH-U{Eon9Dai5+R2Vn;#xC!gW*%@f_N2DD8gGRnDij%+^5f0Hkzo}%+YC6_Aai(9o z+W>;5&h{$H<1O=>_Mof35l32fBHVk1L*hVm-4=UmyyRS`mM1BbY0Uii8&CUeOW=zZ%Oo@YtV_l!)phvXQV0* z>5j2_HDL+p8r;{;a$rgyq~A9Jue-7wKvBg~R*U7N5j)+(WPHiLYa^@o=dZe9(qx~A zFl}3Osq&!im>w|jy*G>e%t_ZLNM2%4OZm{{XLQYZWye}Uw)D*yDuEf zWy$TI7_z(3r;2wlvjJ|*S7jKIJU7jL&^GAU&6*%T{)X%KLV+qXeo|Dg-SJJPJdwXQ zno&a-Kz*cTEQGw}fU%LMJE}TatBbyazL)lmzT3_)1dk{+3I6KkzsErvfyc{pl#VmoUjtKU+g7L zVH~$b2onsOge_@T5DF=6TV6`q7P81M70kvO@K*9UTYZUfu5C}nF3~O}I+YbW;w0El zGUIWm9`N4^8A`I{f!tO7s=8Q^0Rq)GpwO&s9AAX?aVek2^=uwL1x=XD=5alp$2DJP z&f~d!9=lB(68g>segDJqXBHqhw3fwf2!6pQXrKz(v+?A+eqw#s96@WHntaziUq|&$ z<6VM@|7)xn^IeSwj*1nxAg2h0%r)*RLLs_7>6&^5fZ^U>1g_ea5(wouD(V&uK{yCd z(prh|D^OK(U&)L!o`sPm%f*Y%*lo|N+mi?GtvTTN`6v{+C7*QUL689cL zoY#$l&^F_9j07HfU#rCL>pV#mD#Kh?Vmo7@m~+OWzPleG0L`kM%2aDsFB$^aYv=u2 z1mLH?kN5L@Y>D=-fcu4H0EaC~+`$vXeeGBXeMN|qe!fA7^U)K;P3b`Qjmq|sff1eHD zXl+0t+D5A#+zT5}r~$y!*Z?7_gVMHK$4P*mQ)-L^Tk|hsZA>97U&p;PMm+7buMH^F zVFUN=B6w&Uts@cMD1cjt^L};2NRWP>AmreQTgPh=$?2bS3DH|dayx@6L9jMPJZ*HW z4G=nPd@}!8obY}`2_F+CLDv8|QM4cQx!tr+CrGf%kZC#&@P3q?AnqN^w(0ao2sv22 ze!TX~#q^v83{et%oa$VC#Pd!XE-9r&%U72D_L`uzj!5pe=f2{5+v<~_`gJDmxTA>I zC|xeXM6n1$RfOob4OE}zY0y+7SJ8?CPx6}UQmtyo@epY@wGy7S|FzIec#oDLu07nvQ-)Hcwsv_>w6dW+ud~W;2#3|%M zS2Y^1i9?c@`>{J;X*X$;z^rqq4$f~FUx)umBE`|mwz^%?`zf4csmP z#6;bhcPj_3J2P`1PS~5wI&c}k3)AY+R9NcF_yjFcXT~ce>KefWgyqZQPV-q`8vPTs zc?wf&^ThKkwRwgh{8b;;R}INto5!Rhn_qx{SwE;XFSCA-IVP(2igO@zbv`&;7Hnrq zi=vDFGx*NsfbarV$6N5v^R2liES3B5Ol~7vVu#`u(a}_sz)LRopO|UlJeT>W&5ASo z$KF$5JpcBRfia%9Wx;qJVC~n?cW$1^*VwlJ$`;CZ_&!L~>+72NuVEuoK3A5gEnJr2 zdopWM(02!B^7#4R#)+~dPU;>LIYuR=$?}VM+!@1Oo5|w@=v=D#5NZ*fO%Nl>W>%Y< z$A1ow;8a0&}S|+{@cuLA@XG4_14Obxc3SHJQ;N?Mknn|w4F(5`{Fl=eNpB= z*O;Gb8x)&!W96MDuC%!Zr-`5}+HL5Bs=zQ-*N!!G!ZCvO(C$omW8|JpdBb`(y!IVt zv@5(kPI<#2dLB?7bd)e`_(YAgYh-|$-yapc zwd#GSPr59w?~{LjByf!K zCkT(JF|n+t@!Fu>#Q=_b3V9reN~n%p;eVL0ctm%vht37+#o{pU2d%iV28Pa4dF-cMyu+fl-Y^BV%dZBkZLD(LD_>X zBDWLw7=E6gyoL3a8$FYE8@{$){wZg}9y}_Ee6EfDduPUVSAu@LwpC9WR^SGbkTptD zY)gh+(gzS=@>>zBM~EN$8Yj+!l>b!FULKs3$5a0Ef!1b`)m39Y=v+Kpl==+I=QciP z74tfL>2eR1Wm--A3`0J!VraC8(7YHxnejH~&t5wex7lEQ+gTE;4^4FrxC^Zs`HvWr zcPL+Ysh6ME5gR+-*Ec*MXl-ZeV}4I3_j@9N=clRz)OPmffpYJg+}G0z5PWTW z604l*Uptn?^eV5t*_#8(LlP)ew?H$>0i~)-;GY%HJjt%gOGKWRlwSdD;nN|cMv1#; z6=?JwFI*beA!^i_>=K$)8z}o}TeG0q2cT3H3e91Ox7FEClqF)t#4Ut4tL6-CE)+ni zx@2hc1QC>~=L;DYW)&LJJW1sB4TWgY+QbYqTZw3F$)##sW}rWA0QOH8p<2r93qe9qK-* z8{uB5)W2|{s71`2U4w@{7sV!Dm92a=lV_*aZvD^!Z41XD{FPMhzjh+RdklS!zK_1E zu?IAhe!q)irus zA@KYGvu)b${bkTb>6G4vIp&7%uyb;c!Hax0tzjH!jroS0GsmVi_GJ1!j`W;5J}%1~ z)~qUnwp~e?B~feFdhRw5l9l$V2*IJ&K6*iG9Fpwgm|cTQnBo9Aj<$_=nKH1VSSnbljzWItR23(XdHSx~&+4aL>2c`Dw&5w#Pw>3{8$r z$U^^BS?E6y-8!vphe2yBPPV-_l1aC_{uR2(5bCl)TjR1cx-GS=+jWAraG{_zj^gW< zeD?$BCPV0Tn`PZv+AwL?_APe)#yYkNL5q|m$M$k0lWrIN8|!vl&iAj|ws_{cO|&(f z<4CW&pkJpvoARASLlC3Yn0rtkrI)#;sE(hF?y2@l?jzpdV0nN3h{fjS3S(!sdjnbS z{okJK_qJ!bcl*xl_db>7-suChyUmt)@6iF;{UFP|%>%UCk>%b$4bW~d%e_w4?prDM zntJmz5dxEVjjh0v&l=jVyg$z3g?BMMjG(zYFe<>*@WQ^e^=9%q;z@we;_@|6~8kvh?q7k?geoQE4Wv?-*cSO0wL0EHd!8 z*9v^xn*}=VneAdJ-J|797BI(cwSgVmft}_Uj~Qb;GQb!Qlw|hh;Q_{&^Ij%B>IWEO z|KBq2eRF_zk7T*`jGfp?WxO6LFBibd>USEjS^z6y#7z9V9ogH7WNBwj1Uq|JOb__k z^Iy-z69(wVhgqKAGQhhwX1Ny)(C!;q?tOd5z~eh-fOocMX=ikn@%=HJ*7o}8ylwAv zjCQ2m|IkeQb^84)XC&@-r{5oFz+arAeIZNx%TLk%u`e^*Uz&dZYZvkRcg@5_>Fw{o z7{8W&|MM3o?zg4iUvUwB{uJ$hlHQ;F7i0Mp?Z2CTf5k<3W*9p&?Mjka7sCIWVrcUU z5ZEP^`FkaYpW9^koO1nV({lo-A+RC*O+oCGI)qvK=a?k<*GkY;?JiHV1(o|B{4vXA zaxYwpaKkxwJkrp$_>l!*I}{N>xt-a0RoN#($lGJns=&c)Q>`*+RUqsWMQ)qgD1fqL zVve>(EM>N-&r6`~=apBrn`1EhACb!aCLela2X=~usD1emXon&cQcHMzTc*AKl@uGG zYUIY6vEo*|vg4BIzY-v@K?FP>Ah1(}&`}YB(|0o2XeF1I1ub$ulZ{qV*=X_3OxY;D zGiurpR%XLH^A>^f#B1CKaW*~okAN2G1#Qbkai#;Fp7y@h3zF}fv(w0FD^ca$RNp-h zh17iTgzHg=>eLZCDC#ItyXF13PR8?GtPUgJ{GWe~>qY5p*C*SaVzeC@%zZt(N(HS~ z611Mtf)<%Bur@nl#2p^bVqlnG;GMt5b^3eN>j=kYas7Dt+dM9P<{%zx={rFJ#}^4& z?{q=q{s3-oxsDLsmkaLyJ-46f&?pxIJ@ZhA&hxTwnD4?}W{1GbBH$MYanf~G6)ocS z11N45BsjQHg7q#CwT6F)ngGjJtNB;8k2BsIK0*TXqlDq?cZd+$$!mA77j{Y7aYCFQ z?ntFY^>kH!ix4Lr%N^6=Ivs}@|6gjf*?~!r()^Zbas9EI`85|N!PnE;icIJAyXdpS z2gUUNG4On^J-465MU)SU>Ay^~2_@qoQvK46A_Ui2+xH1t=gj21eXt`__xSIf+2bOQ znRSIE=sIfH1n9mFOJ)AYXT@}{1a5Bw!h)-#8_v1<5$Kxr2;Hk|MNpO+`?-VdXE9?x zTW!sa6D4hpD6sv!@Zrld_UUJYILC<4_Vd-V+qt}9-REVAeg62D>HIF!rm?k%wlmXc zr;N2@>K3MKcHfujG7yhdu(tElTvPVp?@v7sH$AuM2ek30d*b@3+IZ>9G=4wX;P>iG ze9ISU{QlbMxFTIvvD|+_misf#{t3qY*ItCLPQU-^nHbXBx7>ePmizyh-u{!u{b)Ky z>G!Xkj=#>3H#lbb+jC-+*D>FLX-hj~@zGs5g4GVLNr@Q)Rp!16%R4T)7=N7Jr&%+3 zpT^9@!_)h;WhUN~e!qK0;{Ksu3_QNb=b7VMIKcSs`=0Ur=wBG$rKcF*o1f#fT96$7 zyVb;+;J%s^8$3O0NEP6BKEt|C?5m4ZAuQg7R_!u;LUb=y+YpY71{{$D?TKRU4+vKw zd_kyRPn>IMws93e>3s$3rfy)=2Qt?FyIJZBrtTfnU+~Q>{kk;Qh#3+gxadm@?+XiB z=lmq^d+5uk9)Z;O-jO>7_8;~d^}wbLR^`9R{mdU?_!8OJUr6&M?wZrDf15rhTV~>2 z>HFBShOYV?J0Txd0=TsS?IK1^tmA}X`}lcIA(z*zI_2`y`m@?yza~WQN%&}zGW!>& z_b1|_cM_tIQsDlKFXNOx@3FGVl9{@H#@~J%9fKXTi}FYN+h=)B3oM zBnVLY(RZ`+QiOm50CyT^e21|oymo|Fp3ktA+{qXLhkxl2oK>%8SP_KRzkK=Je%-9G z$mksAbT+?3nAer=Vev&g7Y`~J?oMEV1DdM^PRM~Ala@C8Jt*YXd?^vDW9 z6NjSqo}u=3C_vbi2bkV7>U_?l)F`QA@4kT7m02SWZ`ym3C}w-(GI)+ux7R+>bM|?Au$;$h>cA z+P?k#^8w^2V?5`6&v?88jA!%!<9XdOo=Rgp*Jl||X_oPv&&D%wUmyFPzIq1e>jMMy z^>>!OwitaqKTBWl$kNy1EVREVjrMnao}G74p5!z0{O5o+>wKPzME96Wgy1uuNA<{= zs=Uw!2fa2p*lB^G3&6cOK7?Fk_AT2yu!xAly)dSbVQp zOW%xq{x34jldvTED?T!D1RegN zADQ#U_`ToC=MPFwzj;p6_a*ESX|blQ1+X3g1YNGtTD5Dm=5m;MX~}-wW`l!mCApdz zlgH$r3wZtfK8BGZ_#sE_rt}GJiX~!{F8w^JFEr@fa5b-`N_FogpJ&DqN~dLOZM91Q4J+Y%M_T!g^J1w86pZqFn8dn|KbRuozM>eLzU&BxS4Vn=Lj6 z?%?@gjY|RFZi9otl3Z=wG*zawerQunZ&?O75F-IIPC;x?<=5Ve@fgTuJO*-)QQL5# zk&kV@V-ld`Sv4B)3_y6-*?{ReS5*YfE(w%>2prScX9K0G5Srn19-o*vx6V#Ix6m1& zTou52l>?f?^qKRaxiwCd#s_9Ix^5t;`SIQx5f<_gj))NS&P4dChluXI4B`9M65T5! zy#CC7-8&!QKhw`^5N7WkaS^`bJcc*0zU4j$wZ!w<;f@)Y;eT8M*n9Wj_VCcIZtrZs zTS*d+6AaAdPY7{7y^z~A7WRlNwuJ5pXO!mvdhbIafWnF1`yh05y1@RYIv>4fnpc&F ze?t2R*gFUUjjK^;6u`uVt05%jv6}p>hT1ydxD=x(tyV)wC`2J?1gk~SJSzv37J%mc zc2I;0e(kqZzg~?()i8V_yFZWBb`C6DjY6XVg&Lrey@Nh?rT_|+O_q~dJ|G;>bKQm$?!|0#KYDAp7menpb zFo7vO3sm`UT}1cJ1XerPypN8@+Ar%fLV+s3PM?u~_%p4=s{8_dWd ze`5!W33so_FKoW2EVsSP|He9^pK1J0dCwzLh>i$x_eo{`$IF4$w+|b8W^J)5-)Hov1Csq& zdy**XLoI9}X=b^4vQy=_9j{%8rqU6jLD@oTH55953zlkVfShFz7u2gQhIXL?9#1-2QWKE z^ujZ^{%p!fi{oa_a;cx{PJfRPJzZ`}$iOf~vwk=AsZ+^hhrdTA>#EK!lkFNnCaW2f zl*v9fWU}q!GG(nTS!A;3$DUe#eE)m;`pf`*eRF`mlF^y{`g58Lc=A*1Wc2Kqnxt*V zR10lWpFfsmTuUu-D%D9>*bx5m8=S}=q%?v%s^-!5c1$KtYmSRiPfRxTPByMVaFCwo zOEyl`s7$n^$G{Rgo$H=`lE7*$(EaoF6rNKwi|wcKn#KXJR6qn};Y(OIb4r3!h#nrz zVwxM0$J%s*j*wE;iIx6k{ z#u{Fa&?O=K*#&X7)_fuaE7I;0#`AU?vW#oXr+i#=?BO`k!)7kH_d@MYlZpO3A;hY)?fV-#qSud&`CLI_iN$Oh+nPZH%bJHqu6G*g{obPHOw$OfPMM3Nq)*9t{Y zzOeK9WA)N-hDqCDM|gzqk z->6q(tl#wdUP7GHq>d?1=7L6_?S#JCi*iA`GZ%{0BUO|8r5yimLY(wD$Ez`xbG}=u z^n*>6>HoeFh_$)94shYCF@1L(lM6l9N;w6;hsw(j8hsj0`!fPcm^`t_sNJ>*LUc|2 zobKO6TyEL7pVud*>-XU}(P2NSQ%6CF@-@n{;4ZYP;Y?M|>4>plrvpa05U2pP z#0jeGp!-=wxNKyUoO7PGyN>8B`4DpS6Nbz7 zew^qoOgy8gE+Fz+h<$Zj&gVR#qNzgyrMu4XD;PPxw9T$shIQepf|}K!#Jnv$7afL+q1}F z4knwv-o5~49O@keUDiC}MIBQ$b8VaXl(avKIs~mu;%hx}Hb2uq^mRuhL2KwzSBFOn z+OZZ}I~fmn`$#6cGwj8|c2GJ*M0F`vbC5o_Ax8A@bb;k%d=}%iN{^05I5HYxD*seN z*#}K8_3J2)%R}@!FdIPG2OA6=F#*H}H;8=h>3lB)Q0Q8S65=ccZZq2Q7tGdVJzeu6 zH2uk_K{PndbD^nzYF)D<>xjN4A41{L2yYPqg9Lb>eeSY@@~P2&gz^MX<(fLPW~S3W zs*dZ=i-F}-7w_QMgiMEZ)$uu@JabYJgyJ5CwdXefr+b3xq}6qV`R>Bwc`n$miDi#@ zFVyHb57iR=@@y^VmDxb6v%&f!Qknn6BR|r-BAQb5Cil(I z?=D`OPV1*6JkFYHL(q zVuLO^Crg;@lF#I`hC&{rGjv;~&v)&%Xd;iRVY({Mc{|4J;a!9{Yw7z>61R5o}4!1p5Ehm?12HZZ5sbpUn`a4fh!V@^+4-eu}?t^{5I&uL#gHO_o+ zt?ST~R)D${A4m0$90=^+7}bk!PGBVlS8k2!jc%@6&^6xhMWF^`3bog_X4cY~wJm$i zm55YcQ+^ARfjoE7=RBG1{c&qDmW;MJWm}YCFna9>i$w^JVt!!GlM&Q!3k%#f5x#}b zTQ4EbpKp!oYil#x{+-cw>rh?~(bTE78TtGFvfaGMu$vEIcJr>_*g|c&o%6uA--_ui zC8>7v9=j^<-Dud&OOkeTs+0E)f`f|yw0lqQclHc|gAD*$%gFu=y_K$)QbTW@C-VJl zzS}dQU#E0x7)SL+gnxfaO!t;>y>(rIDnId-skfH;Hx{V!qi@CZH3RCcsl14;6{?5Q z_NmNx`nY~R4m%%*4Zu+}fn(%^<0NRs+oAM~65>q7ZcWwW7+&abz{e%Yzi@~u|I!9s zR+|FY)$YjHLhaeNV$3d}N)QZ7{49Hwa4gfWwix{Qi$bko7HHwIg_9RTa5TmmnxeyShzK+O8}15g!%eBrCb-zT5DGw3QGSA zEPvSll~m#1BURSymWI{rlAJXrzABYz=o$`=NXj9HSovt~AkB$d?bcMj$ zE}0TfU@p_KY_;SgK3^nx&tVuC%Yh2vxqqpzpLH+y~sVC91z-yr0r+5~%X*%~Acu zEHVnORq}pDES4!Ro9o7uyL<9fneE@Ih}zz?!Rf1jRk)`)*i zPk3Ntrk>!*V(-nSC*)W6XUGVqeDDE#AMay)RI081iZomOZj#+rPv>vl=nR|MdXpC~ zwZZ!Ix$7KTs9j>r8=|~-6KE!_uZk1>fz6h^5e2P-^4`-_`K8U7_M;hFqIwzC#|OYF zKsli7d>-qqznRAI*(LB-#5wP!visT^fMAm@9mE2pCsx>n=!}lq}Vx3d253RhrE`W=VK~RKRxG;nmGi9PA7<<)LChGzMxGT z$MlKyl!tpaXXXnW-ppe+mH{|aJHlQ&1Qr>#KM)}}I;}n7jAVPWvdjxzGhc3w>ZJe< zMoS063q>w(v6|b1z%wMR&9#;`Y5y5+gi*`m{mmTzcse0Em9a>7>a*1~$!EuHPReG7 z2yv>laO!#A4$*i+G(>R{#1g$OL}=Q+WXd?nH=}t?x@~qnTMCC?vsx&l}oAaS#uNDr*6v! zoZyA&@elw?>GK9JOvoOlPRV(YON8JWYd`K1wARVVe!SP6xxTL1oQkarc?kOm3H~;% zooQ2&?Yz>RJYzaQl@FxV*ZYEFJh5Ek3l_&%jnrRR+v^at&Z)`v)}_&h_RGDQW1U!e zCLe1kUA|mz&Do*y*KsMQ=7c0M8LLmS`THf2@54I259$1o6*=u*u=x={@aH+;{*?{Z zPdU9%i%7%#>n>Df$`5nii0R?8IS==V5WK`X1`wHS5V=s5Z|%<9XSU5zJ;D3x((D^H zP<(%)a#n?(>Xx5HiS7gNu<@Ra@GWto)BQoe3qCZZQ-n!^52l0{30jX->5r@sw3%^k zNA$)?U@b|m*~U20$=QHkj*&ok64xhhixGyYwetVPbSlGsm4?-lJp2E~XnY!|GTny~ zsNH`c#F+!Cyp9m3c`Z}UXExphCJyC&)|m2e0R+rioShN`CdIiA-@q;@@eY8e;>`zT z{-3bkXz;0Z1_mSL$EU}Me%Pq(NBI^a#QkzUU=x>Sh#@y_$On9s5T|es!fT_1@fpfj zD6gTs#pE}1ub+^>|LyhtdecSyMqHZHPj!wf)<;>r2LA4H|8*DjGk?gJL4HQeXV_-k zmaM-R)jQ(E-ODgw%9*{Xafm8Ux|r)y-^Pg2GaBJ5sg5p{)wCINGtI{Ac)?Z?@PfOb zo$8FiyV0to4Yn+c4Ytf;gDvwP@MGrF1Soq@6?x1OmG_@Zm-SNgmN!qipR6)MWD{s~ z?@;-G@{FZ~`K{=j40z6m1yFYTSq!lM>FZ*Nb^7h%m_9E~0^#9&jXL6-4rAYm>!zNS z9Z$#-UtS7Wwegs8+SeU7#u9k}|NRNKcPDwWs6}QcdCt9`Wa^8~?x>y(SBuK5ouJBl znv%LTB82JwX3j=vag6O*M}i-|nU*J+q%G~cm98Bk!j!fqU0sCPEZMk@-w@NQZh>Zc z)_4U_)+~lGGS zi|Mq!L)5C3B&}<*(E80!2BvkZq{yanK`oq@QWMcDg0vPK>XsL?VMly`j#ZWh%{yA7gsJn`91vN_3Zsk*kY6N zd8F6qZW<6qcVlTF|KMd3gCrCKvhu0^!p+W*p0VHF9asS$3tdk; z1zjWetMbubB z#uX)KE&l*opZ^@zD=f6WXaHJY^najrt%cUXkJ4z3Y+C2iB(1;vD3jJVpMuuYT2=W% z3#}hdqjm9rkk)rtXg!ub_! z{iID3?n=^nc@|nbPC@I&R#oo3AxY~C(rEq4FVbn9Zj-h#UmKS}a%yfqtzY*7xVH@8 z_x0KlUU)Z)313+~rjW%Tt$8KJ^kP>Y!XAJS?7!;~fd6^PtwKAi7YPu!7Z8315Y7R> zod5yVhH#FJ`H(}W0kb`Y7SZb*_cl= z>hIl@dM}gH;=~;pj&LhoM^1znoz}0rqJ+gyO+LwEBYZ~uy!#}#$Gg~Xhkr{`OgHPX zZcVHELTNF*5Mc=bHv$Au5yCDDt-^y~J%o9TQk4ywTUq{a(iS!e5WeOt!u_a~+>e^> zH~l`p#aG|sw}A5Oev5w&;J3J@BI&p2GW-^~Kg#r5{5^}`;)_b=b75otPxxFuDf`!a zF5@dQeJ-Dl_+dVm7b-LF`!Fs3rsBf^@-fdrI9k=O-!?I|4sW97_P-NbFxiMLsAaJQ zD}x^uYho#nEqFE<(_5yd#uh9rRprgE8?gmbtvPvCj0wq4*Id>4(A*(`vRL5xc3u&b zsv>CinR$2u&%d*dr3yi_FBg=m8PHr!h~k}!@KgYYcOt@XRrTvFbnJvU>F-cgzfS+} z$u;=WKZ>YgmBbk$*(>wS$-+ zbS34-4NsP6@Q-5cM<1s8vb};T|K&sO3)yVeoLvXn|6*3-iS6^NZ;0tT{}I)vKXxa|LD zya)RLdu1TJ2d^^|?_qG3y^;;@p=TJ|=d9oViG9A^@vrUkbDin_Q421i2!UEa30v=8 zBNz0D1T}wnAN2#(ul@XgRe(0H&{sPjAn=&T##@uUhL764pJ7EqK_5xh58PnTZNu

eFgy$?Ly7v`?SC8zceBcr9^1$%j+wfi+BlY!Zj1JJHOAl%P)2iA=#u8DP-b(L2jr>>##glyWd4<4*k||yMKP;=eUJ7tm-e%U_H#b%=TB)r z(`i5dM*CT<>*pP`pO?{o-iO+Glb7x3g2QHjKI`sG@h9G(v<>Z%#+&gTxk^!R?0na2 zL{?L{}m*^9u!i8KEdG^5{#{uLZ%uf=O(kDR6VX=l{?v&j*C zAW#5uJx6l2Ao@CIZpa(p7?JcR7t`PAQ23tO+m7oX*^@c2k%a?`0Qx_`ej>RZmpw^* z6ri4Gpmi6JT$Pg)MREepZ7gTu`0QYs34-G*w09Q}JwffO{@#cOaK5)$j^TsK$>_S{&IZ%%{0b6?Djy2n}u;H_qPxt$^Bex3NPB?9xGn`PfDQ5KD0o9%fV95t8IMsC=_S={sIHXr`+(e9H;Gnhe0KN;w_g>W#1c%)KeRfxt z=sYm|-tqW>AxYmi+j+$q@BXKg-cxPS^ea82II$lSm+h%25FBe>B{qcL(mdj<0KVHp ziW$qsE>=`!W4nbFC#d=0=JN7~SB7HCQeIwezI0Gpwo@ldd5J8A`A(zpzvh=$W&LOT zvOaq_zqI8IqH(rHa)Ib@5JCAhTK6jYE!jU zjHTyRBe{v#t9jA4ZAf1;5`j$@nHY#@CEwSJyKCM&zxSWZeP(a>W_L4tJM-O{3DuAgtyC13 zJUOQbT0ylHSGtU(Us7{Xo%l}g-K9Vg{R~{Z z6quW~wcttKEja_?C-k2Y=KXl=>y({LgZFSymJs~#OeV|iz@||nE3;FYH0Ul$7NLuWncdp7Cu1V8 z;V%l1+KQIw@DFhh{u_M`B)-bwo3Fo-kz%xOZM2aRqF(TjfS*Voci&%7dJU~36h@YW zZ3NPJ(4kq?8G5wsuaW%HXKxg!n+$r9MSj?{dkX$afl(E4w^e^_dtsp)mRq4?RW~t? zOZ61IL23L3Hj2Q+&gH3W^6yD%RCX)Y>SA*@527ph8MBMz7i}paL&i4_iahgD$Q4=X zS>fK-=sUS>(3#2K1HE;r7n&1BH0uSUSCJ0~TbDVTz<8!TvSJxVWSYvQ4t>FRpS>>IwxOusptp%>9|=0!Sd@XLmuG8B9!mb z&!d%w6$G->VU8w*hhO&cR5ucDtT)xt4JTc~fO&ps4W7b>LaN8nk6n_YcsHUt&%%dK zYy-KacM?NgJ&Aj4gOE`d8Wc`EsdPqv{2TrE)O4@({t`=ij+nM8qMnGE{%w9h|()YoRWjR6&9jrRjq15N{AiW-%nE)ibji zsnnr>TPkdG@{WW#AAYhX5|-Vi#T|L@)K7r-822o=0sDzPDQXmYu$+VDXLVY|sq*pq zA_ehqit@Q8KYiJ8B~DRZ=_BrQ#BTW6l(BHBjH?>y?-1e?Y$n!di+W2IxHRg+^r7VV+0$m5Ee zLqp1Azj6*QDbXI@a)V_32*R05a)Xur@X{N>ROO&|^W4xzgT35u=m{JCE4ns8&jqvA zYFdsI6L#x=$UNJi0trC?yio=qu~i@u24;tT8OwHO(7ki$I+>T3TSOOc@Jfwe+Qe8^ z@U?+(;&A^NkEa(5*Dnpxx#cz|G7Suw_F%FFk$I(!jb%S_rY*#TuE%ce1WP^IQ;yL5 zSl97v(=R?_r|qur6HH8F1MGt%XNTXNkxZw% zOkM0Ywj)N`RSY$*3i+tfU*tv_=EXLwRIpgAoEpHqz_BD&9&Y3_-`1k{)|ZE!etqb=WQN!83RXSnlx!L#7Nz`W@_Rb7Hcoehe(ZnyZd@r56zF7 z6Zyw)kA^l|6lVR{aT1*$^QyeNq03PTk$AQ@KlUg+i#ZHXxZ4Lon4Yd~8URK9C|t2= z9GNRptCUAl_vvismmirn+4gwOm)rkHZDZ9c2i6xD8_)_H%ImQ_7D}6XYdy5Vf zMS?H&BgD$I_mKwnsU?XVB7b;+U6rjfx$FX!f&LZwK+~O21acdSSisaJV>IG0Vs3p{ znig5!PIM*Z1wJk%*WAT887)x2zLq~8t+&p)q0@`-O&rITrx)X!I9FUsYg*t}?f_&V z0#8s#$mTl)S>k9Z%0!Gyq`-Vu8_8D!4#iP~hxqG&dc~M_OT#2Th_`0esUvW4DCooFBL4G>8O$nlLSh3V^?#&744cb3aY!kw;0^9W!!4fzW&Rg%|O~d2|Ek+=lF47f6d* z{N2ZBscf^&9WNk2QG*(x19s>1IZ?zw0JdM~YUnRg*!a)0mk{qnxSKtD=KB6K znxDS&f<1C?7v^}Gz5Wugx^5^{&RC_Ebl`FYBgRg-vaa)Y^4&MMFA5Jr8^LHA#%_eo z8m593$Rvib*p(lk;@dnF9AkF+tQGD^`GF$bY{NF5-!JMOw~S!gUB(WuEKTb5P?jUJ zP=nQbZ#9ftt`)N+CcTXMgE#mOc9-zaGxhKs5UHovzrs9?rni{}WgViert;+qu`av$ zLJjq#j@eh58qAUbp&C4#qFrWU#nCI}yHR4^4{>E45E93TG0(G6%tP2H_9^2aSW z27EERd6@`i5y4{?gT1|y&oPKdK$%cAOnBE=<8cb8>r>f05m&a8RttDMpyJE~RMyU;@1I4`Dcw(fJ% zu%^`DQ>|DhPr~H$S1rhI6zB}y<#HDHQM&=m-%W}l@8}9?+BUWaX^M5-JRnZ{))K~(%K8ACvyzS*`^u3 z>gt-TwjFbxA7&n zMgp@X7Y3^<#X(omd*;?V+X_u74UTDA&IZnyzwC%-_ptS7xFONDO9w@LtHpf zTe)+aFhUmm^}l-w?G5E!SD4|ql-nS7o^3me-oOjOv8L#utx?|(xASnWmc}p!v3$;3 zs&wzavftC8_7B@Rk*`q_vE7}pP#eJY3YQpQ4avp{Trj0$n(g*JFTax-e4-Z9I_cpt zOD)M7yK!~0=#VQ8gsP(TIw15ySfU7lHG~DPz8!%pC0!(@>rHB4H4Nk`tM$J_7n@$s z#|pbGP1W9J24YzTY>fTQ#_stUW;8PE{BT-MkF=c)k3JIGLbEGF#QIiODix|MD>b== zW!@0;hA1(1#{zW~qnv2y)qWNwtsQ^-BV)8=vy(bsqY6Z+&iH0y;^;*QS#!0Pg_#; z5@-T-`S~$crz?^sXcHfTTUgMC7i@YjGO4@2@|~h9*r8c9m6^kGIh=ihzZQH^x5!`! zGsICyP0XzSEtDVghbM2=PV%vK)O6L9ShZVadw4?O)5_x~HGE7p!q$|#wrV7!dlA#> z`>I_q$=VwQQMqn#*tR4ua{2_}hfSdl8Z)2c(O}q$Swgq%@axRI=#pJvTtiBw)vBn9 z=%crqw9OEIR2t1o+&NQU#dxmIN&QQZMn?Lc3!3!W~o)S$J%<>k24ppOMgW260FTs^i=5h6NkceKc|%A=xj zDGNUUPV-mw18fQxi+a7`o~-0x8&x&u9If+(D;Hz*Y^~Z8yiG7EO$O8lakRg{)3+pU z_}ggIyfbl(Z;Fw++O4Uw;`nR-lDV-y6Xs!WN0c@^GR zwZoi+g90d|j`=T@WYlEOa{3tgcyU0mXkV=vr^ zWu3Z~xNxgiX}ku(yw&g<&4={4&u;Rzd6L9P5AJgq@&=dE>2wVkK1|#bu;KI@oUZmr zPEloaI8-AJbRyi*QuF*am984^8N-Ky(K^Q_gBp!N%49!E?7ewqBI7vR}(fP)80#|Cbxs($2vtPcrW z0Pi-kzdk2b$33C@xKQM`xhOa>cy~qJ#d-o4D ziO_F(=E+(atr7jfn`*CaQ*sRaat@0RKW7=xqaZt{Cqq1Wkgm6*AWgTsug*q1Yu8MY zA)IYeWvcT7U7{3GX2vTtY5hCgv|8y2^teDTuVA{mq*zNBP{E^A{!Qsy6ZD`Wf3X(T zg^u6ZcZBu1)P5(DuFU3b9qZ&W7dx*c)uEmri` zi}i^clM?-2fAvBnOz$2?==%zpF>qW znXeQ8Su4znPC9EHo)MhwK%7ofDC%%0SUL%H>jPkKYWPu=X|yTtP*O0I@QUIDsEJbi zgZ^?c;I zGZx{KJIAAFdet>HWkta-WBW24OqJL(?RP(4v zV#wXet4*eewp(qlM;YE5|42+sYSpPaPcrn=%C*wc&!>?CxFoYu0FMO=*ZQMQ+NY?& zKrP#YqK>#AO%%ZRvUoBSxI+2MzsjaNx!Gu%x(*AL`OhT~xh7w(mD;%3)q>8B2MVv6IOY+FOZ3Nic|Jj9>_j@MF&YeA#U=^WrY~~ zlxy!D0f~3hw%2q&xenI#??>&!23`rK=7i!dFu!;5l|4NF+ups>Pbw+F++H?Br!#0c z2O$rv(Tu;?eS2;XbE+Nq6XcSH*zw@=J3xU42x+q3&BGfg?s(Iwqu~wyIk{YM^3na{ zwLr{V>V$(PaMOb~Ido18vk}eJ4m|v6iTd~N9S6ceQBIxnf*Wu+D%rRfa@z6}R^U}$ zSFBU;7QwYRa%!tw$dw@4KHC@PkIpq8Ce&TZpy}nmH#+TP@S7nT!yc^pb(9c6yD7eB z>LNVbaP6>tJ6pQ^v<@xlfArX==--#M@eA5)I-o38*a~`XcDxUTb`o~W7WkARZ(i{I zB*?O@RP9V74Uk@k5d5riC}Eml6_#w@UhaG$mKSB5VQJ{GeRO4V$d@C=n%bUb5-7ThX4#-|r|oaRKf#;@(`Kq<%PT7DKg6R*XlA5-m7-=2m0)H$fx997Q|RJ9RB ztG_+yAWnQ;_z97vb4kfhKWmM;Q#Sd1kF8AObS&}HrUL4jc{}xko{#UhpZwS17RY-b zwjGwj-Q?9QwSD&9gpDW7D3_ASg=-g8-^Js|N_xM`)(Z()zwxZSJSo?wW5`f+PqJUU zWzW%&$FG67U;GPbyV>z@Gw-m@zlGOf;WHc4NIzp{fSbI4Pk;wdr9!JV)@Ra15c=XRg24HkXf>e#zaC{&2k&ia_q8V?_Cf4iRI?c8ytPibldW zp&kA+ulFUmFa-g1M-6*r_7aUP7pVqIz@dwLuSfJ5Ta>Fpi)AK@?MIxpJ*UbbO~K|C zy5>U4xX>mC8!Uj|ZKPIo4OaPUVBM)aX7059*ZYob_E-n+IOOan0^qrLza-mKf5fr# zRfgIO<-u^!?xo_#n$ZaHQL(rAs@KYCL$I4U7dqa7>lZmV?#AR%O}A1ac%j1_%MFUz za%?FVsw2rp|ICRU1zHnf}+Uv%5A)e$wUVcq|r!`SSu%9Pmj#y~(NeA%E_~nU)7F~il z2r6jy#(#qT{=y$6*z}uVdf!f4;^ofjcWLv_j9fu-9Njd2s>}NuN%Hn4xRiJ0J8e@t z9{-%LWB!2K7;)ZvOgSSH9H{cYiPLL@S9C5Z?#OD6{}X^$KqdGl?x?-@=QVX>&Hl2? z*#qg>toziHPTk@3ZI+~?QuLInh9PMIsMI$f+ku}@V$01_eayw$D;C=!WA%H~PISXI zd!oy^|K1409`EO1WDE3HRxa61>oc$9?8I-(UqD#>z>5mO0zZLCU2jjWNH>x(qmoCh z4$)ruZ58T2aYIWDuqCV;MBiKaTWgWkk`s)}j~1y=k8VOrCc#TfB6jdl5|-eR^7LN09-*bHMSEQ;4F&IS58|AraHISKe!g0dKbGUu@Gf!;IX!B0fuT*epvL63QTAY8!d1@Fa% z=04Q_%7iahf=^PcBxrfi$+*=;%8^!-VzbAO3vne@xD{X+GvqQB3f+DCx;1Rtf5RBK zToeL68MG3uiA8Kt2RwBG9YIP69>Lt?r_;is5+Fd&2L5;r_Ng>g?wG6R+$L$STrG?gaC-gmsv< zjID>`w7QM1R0R7p>{AN8{ELnkX-5}S7_$@9ULL_i`Ul?%8ddJR0ZOh>G_uFHe0YOZ za~lsE(LGmTKu3ef-L#$)wGGX~bKfIbsMj~j*4zJh6HyJ{tKdR{R0AEEnKIWKty+`a zJUJt{*T#iKm$!P9RrtDvTNzwERoegSs026mN{#BfbR(*jwecy>*QnU|y>UXwsBtUz zX~c{#-+}1`)s)Q|ZCqKnsp#tX)8kd``pj&B3 zb$c?dwPvqYl@B6_Na@|_zu-RR(DQN$_2WeHfDr6~|vnn^QtFr_Vk_zUwm?_>s&(yayG zXyN+_Obq+;FL+ePW*;2ve zeU%U@E9EXRJq+D=fEVe(izJpmLO#zte9!B`0Cgjbw)C3&*uS71cB>Qe%IqPW7$IK6 zduBAy4$4YkO5&BDYp4wFz53pH_AfL|oJ*15Umhe^9OsOrnp4G=3NMM>dJ@2uHdeh% zwzyN9f)oQfb^cIPx}I9fpZ5KfxezPM2jwY<6B`m>C4=G~xK<@v5flqQw<6waAcXu* zAhOvso5tQUc4^|kE1k(=@P0QDkB*WH25ctS6MbW8CJw`K1%;aG2*RFwak>V zCJa24h&mIwGeXRi4j)+Rz-D5{NP4XKoi3DnLb7KI4anJ^sivZiS<2O)!;+dA&v)5a zU*?&o>N@o~_mG#D?GfN!+*vUP+m~LK^nr#Ih}qRoC*t|c{Sc*tXWeYJNM5fs8oVTO zIZ3CYRVI)6;w6!GOcR{66Jw$2Ab~lJCuZ5il_Rgkw`y#)YDb1Rmz&FWJj1;~oWwtt zbxLLJUg%?UDYE$YhR8u*KPEF@tkTs<$he6zNZ&tG>}$XNh@i$GFlD#reAPZx!upIv z62Pv=>CEm>5?Y8;y1Eir4UtgA`g}I&^Y$_8AvHhUiKg?)49yet9hXuwP@_YxU%svq zJGIu1_L8j6JB7KSp|pxrj3KLDB~>4eliNo&H*m^_bSa#P>a0G!54tOJo9V0x-Wd@2 z?z?LuawhX+G{`|K@gtBTp6vUm&nL&Vwtme=l_)0*d<@wZhlF<>Y3BNDU@fO{dyz9X z-oB(C2+W-8yhhYm-{150B)NyB5{;*+BPvy3sr~!@^BpE&q9(WKq%wmGd?h&qJK7sP zy`XI&11L1#hZPoo`3a)+8s^mgxRAp|eU0_G{KY`M9a`!cn>%eYh(6R8t2RUiw|eB-y?pWrv!kv+b7K5CYuW+wS!4m^#tHh1d)VBH@id; z#IEz?K}oS@>!r`norRhsR|u6@tv~eQhav6_XS(-$0>xB6Icr1-$33C5{d-bgT=Ce@TyPk)+$lq>9 ztuBXrrI0f>CW!36VW3HI5!4%;U@MJzij>vgFL<#17a8NTBFOj-F`cxaYH>*Fh@Sef zro??glb@@5ZN2Z!M2d}hnF%w)GVn*sEU%s|T;=USSesC$&9%Z(=#g@IdjjB9cFgOd zZR>5C4!cX9pc_0`GG?=*Bo~_=jKd!b+)myJtl~iC%m(M9_2?kj+KD>?JwolOV(tzC zGt$VADc@(IzQp6aSJ9&T_;|Hud+~50#o80x;vx}o)@1TDx_P=Ig0)EUq>7jaQ1Qe}y# zHQ_g>MLD~0ZS=Ky8MW%WU{lM1mXe7~ zpSE;`r@o`dORT_#uUg%HOm*D8wP>}mL-i~RjNuz4gw5(&^J0pQ@=+%46s57Is?`h2 z_`mdLT8@Mm*{1nfKR~l9hGnc#Z~_*nbkgE~3wSIjWc6qVKXp$tr6DdyFQxxJ>n@I6 zwxT#GKp74h7&3BiDEP?F9OG~B@~x%%6wf?+>@QX@@)08$Ue3VV*t_*hq4fNKm2smPW6WsVVNB-|0pVfv=eZZ)1_k`Win+^S_oJZRf@P$q#z5Aq6u39*pmfD|d6L zM#MyJ(`W_0dc5R)7di3etY`^FEm0L&o2Fg*Lw~i>6uopd`2r1EZ3nx>X3vkCe}N%M zkI}q;TYSc3@RXBz3zJy#_YtmhkZJ6QTN1-+fH|f-P2OX*?XYDAF5%d0iIabi#E=)2 zX9O3x?NlSyIhQDZ0>VIvbm)Gj7_2JPDB%^sS2>XfM#Q7x@X*uSD|D$<^)@FEMXz^7 zDC6sLZ<|k8etegz_8n&;`2anUZtwOZoIo^)UIV1i&)Wzb<7nNGGiY^KCxa0>PBXux zGjY<$KF;$M0xQ9s(RKCqDMo1d&S$&^5AsbVw`6_H=JPhcb&H4zGX~`o zKDa&9&XBHuai=pj%49rLOxE{2_K~f3RQvfD_!#wQx^ZdQ>i(ffkfP`4{q~OUhZ`h- z3LP2t4kY-syB^x1Br-ouIwdU3GvB>Jv>1TLLAUg8Ddo`5D3u7GDr>uS;_`WybOwX2 zXheG0;IAZG`TXdPx0=BXrL^7FYMzO^LD*wP$Q`e_rR#b*FTGz@JzJjx9;ZR~S3kmf zG0Fs9Y?5D8L}9-+`=d-$(0Vt%5MG({g{Op~o_+APQzQaWQT09UfMGJHy<-7{T>yvP zJ19u|In>)z+VokIJ$b>U9N2T1>aE*(i(R;mVv(e8 z9h5-}u-JkDkQzo|%`OUTkK>zx_nw&)m$^|#a(9MGpw*hL=z!cGpcu%RF0MnPzX@Kq zAKjzqjbY&9AT2P?W>W)>1au=WQ}V4riU_g*{oJJh&2z9j53q*DETKVkgymTvLjho@ggKaZI=wB%o2H99)^r-r_f1xaz(cv$(j2 zJJ5sDkb16%niv$nQGCL{AocIW_MdIGx^G%$c^>k@yT5TUr&Np`yQrL+1vLq@i-Y6l zjCdu!t^KDz3iacKe0yTd=WqOw0_GYyPj5UsS#9WIOZlO-RpJ3>}Zr-?4))mcJB>qJ%bZ!zL zK)_z-1g#v|R%EXIa798cYTWr=B)B46mtl`hK0t9*h>yL?!u);jB0bbQD>!Pp6YpcV zAj^eRk$goK)#4|&1`WfBH7VC5Hn&9^Zbu{LY3V%{8cl}5iP>vz{H zwL`A!Cc-_#VU<-pSWwA-$wd_cvUj0W)PZH|1sBs2R{Y|4Jzu@0r5-(}YJlh7h`J<5 zo)uOr!jY@{|>K7LGAi57Jh`@_)Qobk zqJ=<9Ox87X_L1RhZkGd6dl9_3oWnz#x3#Al#_(9Ty62W+G*u#<@{b1LPpdMnB}@g- z{d4U3ocFo}2P#l0KTGApZYz#v>+2$P1{Aq}S5jp-7kIJ9gM=6L?*nw4#DCQnEWCaY zV)vLeZc}8z&6o;azwLPMfwlg`=dU}XvZw~!{Yl@Jpr1XOhNhjq@#p7P0^};jW`Vj$ zY%AN}FtV?IiAJqDcdpyD9oMP{RnZtUOE$c!WUe051?fZRpSPP1w@s_g^w8UI=KsLa zO@#||!-HX#JZ*ML~kY&%MBvqzEg&HmOI&K@J|5=R43=t(9mHf=3 z4oV=s6Yk_|II-=8mbdl|$rC%^6@3O=O)un6mOFy*myaI#1930xvr-PuKtL?^=jwxw zXID)%=a+OGP~yA=>iB-=2jQOq%b&t)*)QIa6Lc~hZfma$i3iS^7ckrrmh0D%P*^9{H{$ctkzgT7r@%+Oh?_w1^3;$Pc8<>%=^`i;nAX~y%2v*VQy$4#NlFR99vCa`p!|g!>rsv7WQ>tY7X`aNOwh=Qhu9o>cEoY@bK8M@_;pn>4&V7) zrpfz{MP)zqC2T&QRG4wiv|KDyB;LS~`y6zCaxLQ4@P0ZTI{7s}>xWr<4qn;!2$<~} zi}2Sf=;D3jk8G#qcNg($V86Y}^8$_;0ZUkIl)Y?^f<;VklDqT>D?rz)HUHg$xiuvY zz@VW+WL5=~*BC}WL!K(G zIB)9V&8t@a_4oL-YK?s8qe#DCaQ~YD^ZZp*lN(@)suF&Pi0d<(d~T;tV@0iXgR)?|nfP)E@u37r*JaWo66CGOR`J;c>XW{=!? zi%D3}JSpx@fKgSA?)Z65!QX(kkg%Y$GbL!QXiG}p`x0U^^{V?9>R|uzamt&@mMLrG zSHP%@sLSlATsL&*kQ~>^o}aSj-LmPpl{Qyx_5zx@oa&eLq2Zg8?N39sesUk-!9?e_ z7@p(a6MJ_j679V;==`DFsoa?BRtdF=_lg_(vC9|v#|sT2#MzdRUEq|Pxc)wAP;z1l ziCsuyONXV69ZPr3%ci=rwss&1jU$0u%OCLb#={@+k`(UD0nH;CH)T$VzP8kRl8z#4 zaawPJf0479VS!#6oHvm1OVJ0i8TgvN`Ek#7JLd09^mQ#hhd5@;!Y}IH;e4v8%h6FP znSU+v4sg|{>bp?g>hpvi8}da)i1iRP+{9)7A1VYBL`2R` zo-NQaB5UW|kK`Z3pk=zg+Dw1$@d*>FH56MntDH%n~$cFq=nGZc}W zz8$&!{hJ@Z4usi=fU5M8I7`1L$m8Nfpe-DgtINoeS0S!$vRf#gW?RQmKp**qLEAC7 zXllI&Y1c08$M6fKkX(u}qhhK)}yy%_2?P6VAdpRD<=PwiHz#(RtE$L)1^8m$U zN3O-^>`M^^&y0IteCo}mwD?w z`FIsA(n8>G{5eGUd}6rG&?_(>pEyb&%r?9t*`a(;NR{T@-R4oF9hh_~2jAKU#}3Sz zJfK8-$3KAmwSqto?bjxb$;$lq^|dd-{pF9h;^I0Vj|i&LXka;)Z{a#C%n0!iFCI7% zWJxW?b*6(g-6ZfjAD}RoCaz*3O1h{^+5zo8lm6h@E5U({c{^w2Q~%gqerpzUe5gQd z(8Al^d2*vIQ0=C9CR*7|-$^vJ5W*gQVz4S=TLe~leW-;i0bX8O_32oPO`0PReY+7B zR)vuE$1hjs1{ql)`6?6oK+7ujjqI@nP7)A^B%fcWUNbdy_46selUTF9|2greiSY8| zF$YUCC6cW_JKmbw@%z}I-_zh2a}VAb72R$DJ6hdI0MJZsxhyY+fpm>ke(6Dw6S}$S)YCsy{MYR7p(I&~N87`&g*#R42mLb_hyk+CFhyT=$+=%XO zsnIpcESI_?)l>{8|`1A zI4*8mwGJ0rNfe>~4{ZQQ#9`fyqd1-jx1M}$1SJK5YmKh=oS*_sfqDfY;LqWE_P2fh zQw~ExddXJ)ZjP}0{;TEx)uh3aZ=|LzLXK!5|T~ z|Ja>?10xP3L3>7nL0M`4b(3p$Nc9+{cp%%aO&RwScTDJuf(E5Pp5lV;iHDDzrfWV+ZVedDDtXi z+r79VQ}<%QixX6q^ruuQ6566y92MYW(fap39K|%VXM@{K5>C`Dj=B>gu-oJRye9}g zoW^(<$A%y(KJ)5)xq)P#!;LY8Nv-auN^5)dy!mukkMPrIX~WrX6~0|LO+zBRq)&?Bm58lk0#u4(UAJlPGNo!>yO(C%NORz?ry( zJ;bp8F26(SAjoLgL*h6`GFLg!Nt|(MK#y|fO$Ml*YrQ73! zdq36He(y^gd=1H`rNAK&^`Cum4y%U!z~sI8y$_?{iH4b;rZUOgys zZt4e#;b*OPB_o`QQ?1<1!-?wL*T^qz(vXb>#}=kQ#hcX+D*@HfyH_-IB;s10%-Ac; z_&rTWQ1PPvhCBKRqUNC>ABX>NzL#Wd2*hxpt&hM7`bz)bAAGH}|LQUtsMRWny<#1? zJ5P$`5rz#pg;VZjDO)rCgD(a3!uS4rB%K&=dN6@;2sUoroBOoo^-ngN%?#c$-~Z$b zR2@6yvIHk(-wua?MG*DN&%!pky5NGiZt#=Zoez8E1|7QO<_MbKc!0|88-wAiM8Y!{`QW@` zpZ@&saFC7se=7(p9D#((AHimi7XV)l@6O`t$B5wJC4E zXR|W)$3CEG2b;PVN&()?|G_G&{rNcr+Xm9aBiZjQIL2S$&fed(Xg9o`&Cu=zkgP6O z+=7v>W{b8Q$$fd!B42e#8o zUwhhWbyG=?0V$y`d9Q2on}x2`XctxEQlo>C7jc)6rWEv zFH!d$OnVLjtmU1J@-te34(Q8yufI0hjZeF-iE9$Nw9<$*42F}3B$+2H)H-==o|R1 z1jypc2H)F}Ilk@QG-t|LXwbtm~){M)vQx{#}xbGMY1|8g@lEu@6_!P>g4 zn~sIQTqwKg;RY)hHk=g#bXav01~w-S#A`cXj0Qrr{Uk{k7%W7A4 z=XbXH+?7f8hO1jku5BPLF*gb`CDU)M- z4>nVd`_R$4T$L#zQpg-fQ-#Pd1a%ksJ|FlVn7cgaIDnJho+N0DaDrOF3W4uV6E^>X zhVEyw*_5KIX8u_Ga&>}A*-aGKEvaP%$!94O7dsjX8wrD&twRf?(V9ka9C+^|aN=h_ zjPGJBH+_9lnWaG-Cf3fJSxH73+-qZp^fQh4=2;Fd{U+=+8g<@8vl40Zz2-_{< z!@XWlL7M1pP(wkx->LVbyuH)Y?~mNq`-oimy(u`qubnwOYr(18kua z^kV(AnyT|1p)MxGr&^tGuYZ~hsvCXOl9IL*h~DxAD?t;{ zG0*l*>R-P&8e1Gzl{?oVEdq@W^B#6F-+>j3&4% z(W0tpw_gd1#hp{GuLq@Xgryz&xI{-9)jYV!{>2-b^bZYqe!Roc*$r^CM+7Ed1otmD zY}Ouft@Xza3Y4w#O8Hm%tLd(xcAaK)to+Hu&NfwUlG9N?=^-mxaLc|6LgaL!0<23A z4aRtBm^%M7()qgiXj##LF;$Lxmf3TqKdD6I_NdyLvfXhY!S&1~=k| zaKPNnn_)w*z*<6BIT*R=4mGwUMFQ*5028Rr_u^_P_xO-ZQt&_=w{8|lY@=Fz{|AH7 zKbb9Kcapz1NdRH*fTNJZ13M^m-(-u$a2LywB>?*xmWyb4mP%K~Yk5!FU=%a($y@8o zU*)n6+nor%#%S);=l=?qL^}-MRt?7xQ;N%SgH?(RT(fyxQrO`+63pi@Vkn2Uwp<3n z4c{nmDt8F*!QIstgk44#atG=P9M?o4uat)H#4lg8M{6)*P_w7~L=Ml=H(p*q9DI9o zEWHtj;AmJ>u`d4A@%T4)Z#mi4--Ad0*ngD)Q8g2AZ4B;1 zCqT8gA*>+)c!d24Y>-@UE3Bhve_p<7K^wSoyJ=7R#Cay~N3*mef948X1v~HzL(w zWK0`Q@~QCxjdZ5qwWZzfALr8XcwoF{mqe_9OW!;i@V%0W^Jb-Ta(3X%+^-Q`e zKKP}vTauHJrEvSX(==pUaDOK}vBN;CeC7gF_PhrC#Y@O&rckIF8@A-JJ1FW&dj4hH zCYv&CZRlFnvAN_SQEPHH4*O=sU}!^P@0Qe)l%>ga(xPL z%;({=zjN*J3D1dJ9=~+n^LOvb`Sa8+7&JoK8@`WzVq-;($=;c45&Q1VYcQQ``S;lT zCnEt+PPciF*oaAYcob2LZRo}Hs!00RPdCcbqhDeXCPD*J-_1-^$-Hg;OzT>BS(bKj zpQ!I=$opDrhrX89T5EJJv&u@J)DN}@>2OVsg_Z?vTEno49Lt<6kTG7OuWW0Yc7mtP zkGqK3Yb4hEap0n; zRUg9br1lm{O4pX#{VlApTzwntJ8~pj|A{Ou+*Fr-h2CqRiO<077CBY*J<;H3$@zFf zA3s+LXGLd{?sZ;)ac(%D-r>Tfi&t^}m z(z4-40}o2Kjaz#nS%Qq0c-oXqnL zuN!%d*BY4-Ly0)wn2~wC7IRoDhlRG-oGNdcs+G;MrOWFIqxf(9d6BY%bFMw6bp{U< zcC$jwtg!#??oiU+vKkBjh$v==CdxixGp}UmEMl?X(~=M9yBgRr5zB|4vNqq$`?-sL zQxFK>l}5HiUL*o7EGQ{X%Ks!3=3wv%%ER_qx6Fh1Q?0yK=$+K)Ax!!KKg{2V(MZ;w z04JIkU3ARlrGcMXWnad5-uinnjc^&$@HBBWlvpy2teVsA!KWZM<7b+CTH-y+n>l?a zwMVpBp(3Ec({$qL{1XnN5$IbsmaX9#HaQG)7-EJB3l6VaQFr}|{c?s3JX*{~emZu1 zvq3f`N!3esdnWuNTt+@uvN3)Rp>N~zWt6^;p^t6}Qq}g(Bq(g{g=h-+(WdeTRmc^e z#^;#hC6J+R3g$B2nUvcK@4vy=80cB~B$T8|G4No2dCttL%EZNc=U14h#@dMF=Rx5t zTh%>P`V0*1-uTB}Bp-wu)F!W5dd3Zb)IH05f%k<2>t{7@KA+AW6QuJzvgMIfsq%k*6Q9%I)rKOO8-5)eJ1E?ULA!FnC<|%d&m{_!JZid7Ywffj6+{I-LCogEGRIh0}8v&sm2da~T}+267~{>qb3EEKL0A2X*?#i=jUQm$JQ{uV$L zI6_zhQ~w_T;y@k0A#|Gqg5OJNcRP}W&yJp1(O{Fw8qf38Ee}erGfL5!STX+axyTXB zXBJI^{%QuC6M*-zn;9S5$NDB1cptl!@v)~_pVi3wn3owJGr)$=gb@4?&Fc+qHjc2iPy(? z)ICp)PmA~*_AkGZ_?K7Bf&S|l5-U>Wk6l;tnD^O%>BYP+1)L8*B1?>umj|$%&3Pso zc)5y)eue?3IxlK$t5Ycr>z97N^6&{oF+Z5jpJZ6Ue>AgtJ^Jn;$T`r7?J&*wdwxhM zYGTc`^{lz}Tmd60ilMm-%vjzCusOAe&mnmOl_7Zp(Tu`ohvf|t*U{{G#tw&y9+9O+ zHmA0Mh28>1ajI(u?R{6EIlr0aZ|1T+9IM6{BXndLP>S~|idh@efW-57hsqMKHfv++ zsCY$qMmQb(lc9N#V?9G^e9+%T<2PH2-`_>!m%jv@R*GLNi*uX@;nvE46XBVxhrBR; z&!jZ0Z>9KMna-blkcUHv);DC;tUt<*>$T8&#OFFvH*j7lTFU0s-ooY7K3fCgKmjWr zV{`F2N1zh@hcI4IIg&qwePmxkvWAdsZw{m+H=oA=N~!*o!7UU8zb8XRkQTrKAHgJ_<|;d5v23R!9>hknE_P#rfnt`_0N4&x3W z`J*O@&=Dsq&gK=eWG@F1@qG8)u344$Ao+*;sqHQz_cUSA(b&q2fX`of5d2Le zpu^ghCR#F}7U$KbIYI`B4?NDhfpjCnt7nN?-QhQNIQB#ldWY{vrpywZb@<+;2tT7b zvu26Eti!p-3ju`8c7S387f!4^9EN?DYqwU{Q}cZw_-8Tv?RcGam4nQtL5rR4U1UEa za=Lm}J{Neo=OK{MzPWb}^na5C&Qn~HXD@KQk0*h1kYhZZ$>8N$Y^7*jbsKVLvUl;m z{YGQS#$+gFoxHsB#LBh1()qP$t;{tLUv?aGkb@%00Ny4xr?#h(6%}Pfa~T-$S`omE z=}}!PsJw>mO%0HZ*9ys9V(^S!Axm8xV7hSI;gF4EY7uQDQQByPvZF4BoQE)JP>1Ey zhje<537lhA$P(g@!VX(0z@^iL9ZYGUoR_nxY}>CW=0yfr(gfh#o6es^zcs(&abA%{ zMp(iG6(`}LdEq_rfslgrYFAKc4Je9v-)MppUpjvh(ac;!gzqAp990zaP96>&Wykaa zqrT4xzYoYtQ7heFHlY1w6Du}wxnwWzX7QR@jbu$OdQEkoiR>*K*)g?fk2qVviHjho z_k1OX_m@R5ws+HM#fi#LU7iQLUvZ}uCvPD83&LyQvGiu`-qLj~$XZ;tomPs@b+cmE zwY8vPoK*IrwsL4&V|%;5 zjqEG;sr$;N$i9N;2Jsq1H?Hr8(}^vlNDrd#&|dPb;v9%84;{p78qwn-0GZySw1AK< zYX3*#-oDwak5|WV(4yX-+=3`}84g&o-)&fmC zE*5<8$MZyhQX|NdCCUEjORh5ZP; z@5Z(#T%G_fn;Z@I5gptYnG4(1KN|<`EeYV-b#Q;HgDWMl7gg;Tm&buSCjs0V9o#Y< z+$9O%s`l--#DP0L(fsP*T6J)5z6kr+Iq$~z2VK99_$4AbWC{eoz2_=1=dtJ*lxIJR ze|IrK-G>SUzqRKoQGPVKf0qK(V}C8oI=uc66v-?yPyzMFMx=FXEn zJs0J>SqFjHaeX&`yAMpO)iM8G@Y`Evi=RF^eBJHVk6Y){ipTwX!EbGuExxWB_ifmx zH4FP+qVVV>ND&$mpT-f!r4b0axVe}ldQ!T+i1gJ~gl zoVc!c9*+Cf$jmCi&!3dbYJX5U+&eB4?lorS(>@t8Y%36+wP#h>PIgMPo$SXC#@1z!0EzqtRC*)^W@K}-8c7p?~S&GNZ2qK$kLENKrZPIWF%DvEiRqDTl< z8`fu8&tJcz@b0=c3SPJ^(|oxHwWV#pryR#}$L*h|?QfVTe}-*eSkJ0&Xq$8AVV~KL z6vf=gM8yh-qhNxpIB{MMS#iFnDCQ?=Uy-hl>fNdKby{>^+XhKJ_c_J+3GKsg z)jlkqkNb-0B%txd4M4Q7E_!a$J!^e+(KEFN#_}$W2aNP1BLPgy)kSTgx(Mzsaot35{y0rM z*+^cdhmYX6f+R1~bdakyf=|uMv=ir?%BA=FS)P$^LwzF)31j&+G8rXkp1=q>eXd#8%_&ENyFR20s;WR4kA@MmvHAG_hMcZ4j!|qSdaZDkOjd+itc@XD8O7=`Wq98qM zSiD$OZ&dNoMfgVtTrc>oE9Zz)|3YQakmCJ{%kv!P#(2Kuay>nqxllcGK>fV_?N~k- zMAl6|LUKN28=#|g)f_DABKZ)(*uRFf?_#0#<_%b;$M~^NA@M+&WWiCrVYs}T_56P) z?-sNZd3RGvSl%Um!Yk*9%=Lo*{F)$+m3T9aop=+mORNJvL)6=CoYKTcn7<$Dg(N5n z>$q)&VtYN&Yb-JHZFn!^&Zrq zUpY(knptgR-_VvLy=How#!nq0F~-&XrjXWCkUwW?-$ ziEXJKtyufjI!5edq4v%i5bt19#Kmk9w%=}Jq4pP7o|gi@<9)7;;8Xk5H8c9&NMOLZ zZka57#f|YC=kh#Xa$`L`+&B+vgN3dBtFJsS0c`cRvQVq$jYwqQt#It2;3G_PupHrp zje!%6;>195S{`OZ`JVruwr`J*qB{S6W@dBUKmrMDxD*oLrzWC84I)})l7QN1MVGCm z+LjH$3l~MeOBHJ-K)o%tIYK+$Dnam)RcdOJN~)CvtZ1+r7mK}6-AzDLR6+n@NH+6+ zo^$5xp52`dAiRI@VX`xGp6~O0F6TLOX3j~ezh^m+d*w9Jvoy7SnVdp~&}Ut$5t&PBGcy}B>Q)BrF zO5nNj4nv=Ffokkk@~u8(IDJ1H+bUaGxuZjYX5{LpBcoh>Ok;s@b#P``{oxzR>yK1T zt2Y)*ukTrUS-q*S=a=S+M7~6>kSFBln4?f6CZNZ%v?onL+-AcZH?^H10tk&TnWtbnl!)6A@%2T`-s0OU8+!0iuIXG4( z$ZcnN*_4`07(8deofkrm=B|QagYiBU3NqKE0@*uNHLA{P9S)!rdlyW)@VK0mwE%Y7kU-=qP{~88qWH_Wy{~7@bL0^jZqjUv4E8_eJ`MgO^BR9$^WUj14{79BG zH}|9OkL=O=#l4l)wst9&14@sJPwBSSkO7dMO=9M9!&{|}4fn*GY6#DH(!-O7P z8^iV|-Z-I0_sVJXor`DUj2dOWfblI-dQl#r++O z``h}iFY#U+49dk7L{V)y4a7ZH~Acc$sg$xBPfPD(qSk)upK#>DH@$Wt_Er1VspT%N`^;`L% z(03ZKy(-XW{HMIGYj@HOpAgB!U|6oyAzk4|l?=Nr+ zVCJ7+7deOF-pKUk&vDziOShx@(OJSBU#CYQ|%D|vq8 zx5Qj=fvO z+P=5BPuFB<8Uos2lrKqIV8d-;`tB$C+d6tYg8u#tJs#?pWG(R2ZDDGX|=1c`Gf|V!yR$ ziR(Q^zZU}fEbgffl7BDs>HTovhbH<7dr#rKfv~2f&ny9l7Vuhodma?_7kTJ|=zMWJ zN59qL=Zo1r%Y=L4^ZQ!Qjnvy zxYZVbYIJ5N;{D_8h92eQh5FebA3&KwXKFp?gTK=z)~IZ}tQw(hj3@NX(D|yN)@o1E zJ;=v8NP$D$2oBg-;3(Y)4r$||u`;2tI#o3Qa(!=`rmoFD|LD>&K&oZ=Kq>a~=c~p! zpF9uMiu$kX4|R_j zry5t^_DT0k;PefW2KmZLmOojL?x-)kzBaHx%Ja3p(bNs#Yzxh3>uxRlvReYF4GNzK zy#MIlZtd3})xr06buW;H`nqSRMnUP<-4g(O!4;1NT5f)>d!jtprw#f?cNq+7 ztMeZ0E(2)u?p+gj4szPmCmOoTv@NUa+W*=8ocHgmgA0#z&%k?Usz$n$-S*`R*Va#z z!MFFRnf2+F@2o~0C(7x*-k+$(7+G#p&QcBUMm_K)Wcmtj+1y7 z+pCMDR3FOjS$1_j-utubPLS-WUJyJ>=ai315 z5wR_DT4U+AU2#&Lxh=76)Q{T~bw4r_{XNx(oFdnvEm6)@a+Z(TG>ytb4p1KI8zV3L z&T5qPo|5H5dB`p5gxFCY@`<_@$r(Ow!y?On8t|Wq`D)o$TxDl zO0XqzE!q?Hq%ytCkC0Q8ha98M$ScZ2eW*Vw`ZmjwI}M&^B(7w^ZA~f<%^F^)b)o-2GtK`ing?~W1AASM#ieLR)RoHfzPdDy?vyox^K{X6ZC;_ID=&xD!J_!Orv5{p%d zu~>YZd>S8%G&Zy?tKX$qqntXeoGRK7b>saNkHre*#O#Q2MLQPtV@H(tUR*vE?f7t# zd|F}EJ3OcISloV`SR5~B`QrOWjD3`cIwPOFHnp>3W}F@O$tPe(IcmoQ8y+X0qTOjM z%CWInpClGJr-+N%aHeX+)UH-6^7>V*b&y-M9qPgS%@N71$N}#k=P9xNgZH3ZltuG; zn8gX|$8##`{Dl>hhz0pYc_>@#A5ll_vz%6Zpzb^-k#po1xkZkzQds}U?aAX2^((Ua zNaXf?%YTqtyv{)$kPclO zS-u!~YE&NO)UqFyr?y67k;{8n&Y-r9&#lNO@=9$cJE@+?C+0rRC348~D{?wsiPkvC zE$YQ%5&entiTa_>Bc~`AF(a>BChB&!6^mb5wnTX-7v=ESq+<`o=_|ML9Ll8qmC9nD z$0+K@V-e*bx5#IOG}M=6^^3?U>PqvfB-0uPdBxblK8435@{0VRJmi`8kI1iR$4Knm zpcc;K)veiGLJUd$=MlKh16~`X$(m0iA%wRo_I`aMz zxki3PZc#^WS2k{S(6~am+?L$7+@3tIBDcK%9G3ndMfVL7THWD4ohh z9jPoUCV8F1Wm0+8IFrX?h2-*$w`}^3m2125f`^3%0WFb zw_%KNTcU0c$Jr6(aa+=ul(VS6ud@7y+i<_tm!K?^E5;$pohQU8>gE&rD%27E4S7Xd zJz~XZgj*{nd93o>ind4JL0-8{MQ(Y`%593ZA-5@)O>>0RhoZcfgmDM;BP&*UTylGg zzQf}Z^%G;GLK;QK1gI~LlX(4uyq;~lLT(dWG3>ijwJbD2}!%N*dL#RFT@6 z}5A)5H9c>fk zG-|hIO50A9XW8y8+0n-BhBCOlkVnd2@7t>-klH57sZ@uF@(7Ck6J@AxjXcD+ zMoy!ge4?cL#>i}(TO&(teGh{1iNfrKxS2k(@00RRsNI;YMp53rc?FF3rS!I-Jc#N8 zkV^5p{CE#D**6yy#PjzoZ9yFl|$>f-=GaQN@;B!V;v-?uYEQ0i1!6og8`tl zZ4CcowFFw=>#e!P>u2emEO~NzG_t6Qh5}Q z)s=7*|MuQec(jl{ioYwe^-=0_%M_PMrbUX7g#RL0q}W&dH@ffH;Bv&q@gS@%yNjlt1Az+ z-ixv3L;xhh-r1G>5@_zt^9>yep9tiE7SQf~vpe|SuI_@;ue-f67~Z{W0_qbD-F5B% z><%tG((O$J!<(`;panK}tG9j9-SX((Zf_hOUz+)Aimulw5z#e6}Au`&OK-J;UcyOXnMO?iIA}-u}^f$=ffY?Xx+| zUznyIJLk>51wK-x)Vpq14K7#C!FF8R**jDcU3+?{CXv~YyKjyIJRi%@*dn`p7Xte} z;aLFBy5$PmKJrcPJQ^SQ^qbzLvixC4$@3qSbAA7qXXu9_-$<}`*`^q#zIh24)v`?2 zb-jDI+6_5c;K*R@NxW~V?Ajir@0H~G*T}iPgNn;P-Z1sLC92UPgKsqC?UQBjNRaD8 z3`(!*;olMeX`Vr^!}!KLhP>1*0fX;v&%b4UxX<*|$hlOXE;_&381s$8K}GU+WI}D( zu4x8;*S;K7qjNSG3TS~e)6`8;#~17^|L`b zz+>}>U>81L%;${*p9dp(G(hKyCxa0js}OKN!u;^NY<_st(!q2sM>ap4 zIjv~Lphw-I1#0tp@1K|K8GAz!faDBKR*kuno^tQot~Sr@TEE2TytZhnTCgwVQ=4A` zr?YI$^5MZuN6`XFa*kjBgj)hxC|sQA$f_`g!IzWsOZFVDQbs7zg++qv+yB{M*Ae*2S| zMPEXuvr|`_--Qfk_X1B5fa2^dR+}rNq0S;{urpoCt|*t3iuWIVVM!G@Dt4c%Hh*2; zxFmhzL%HK5M@5yoB6lTZRRE+rZ-ar(=OCv-2DxITx-$1s7~tFs11sK!0Tm0RVb13! z{5rR+V0mtZG{m`g!h^X*(s1Y76CTK2Af-6>OR}>!qeJL9^d6gj10 zo0L}Zyp&ooS8`N*^@`g3+{j<&R!D=Kdq+N)`}W8Oa*L!}XxP#koMr za;{R+obO2K6{{q0mPvBOSV^gy@ z`9Yb;Epm!_BiASsxkcTPXVlN9IGu?3hjK=YU8&3o$z`G*sN>m+lk$UdQ66%OI-@+4 z&235Ljr=vWVZEF|G0vAWok5@4jGS_NqMpo-X%Rc3P0yB{PHs!&8FfNg$T4yo)YWE` z!)?iJOKqoQQr%v#bk2Ybr|3T@4`pR3SyX2xGmTXGP!?HJzi0pQ7(-?C6oFH>VtZ*xM$pPTYqkGh}@xE^eg0! z;zplP8E?oL+6nbTj=8;%W8|XPvemm70~3B76X)Ef?+CJxL)2}%<;UFrxU8$>EGu5q zoT7hFc?BzTuT+?==2jGLTC#Mo|WG$>S3-j#sj%?;|cQ2X!izqp>NswU|1xqpGRh^-c~{ELNKWQCRf$gH*#J161$N_D;z-qgoCKvq^xkMSLmnaAIdD+UrXfM_(XOC}ff+%DLR+Y5DFC}&wQpGJKLc}0GaTa+1Zw+cBkVms8^j$736 zY#|qMdE-b9~7 z{dm8FvQRGXw@}ZGG&iNu7(|(9Bc89h4Y^HGKeP>xJCw_1ayz0<+hvwFizwxuKHwfNX<`wp>*eFcrp zZP6G>;C8~Vb6>J-i8-6w6ZONKjoejOF~aT1<1*fssO!U4E*JBGojqyJv+@vfiavt; zqOMn2vB`3JTEwO(6Zz%+Ft;bSFY1hTMNT=t$Sd|?$P4O<{Tk|uHefY!dc=lk2QCYF zMGmgKcTi2liHee9nk$}6`a$`a#)${YD$F5<-gi(!%? zV+me2A(uSY@$tk0%SYc6`a|Sql{J>Av}y>RUupgG3X4g^hnR}3nkPo)gyb^OzNjne ziT*=#vXVjN@i;*_@o`D(gl%dw>WcCaC)yJ^US;WtoFZQ2l-D`PafLL3ru27&(X*=%ARM%A8!l! z!uC*q>MK%8BsU`to^y~hZY$K4+Q#B8UJmd7qT|hB&Q)?&gfr9`ZM2Gxfm0}Fe9Vb` z71~L(5$ZYD8h<0leEfiTkZZIPjqeE$(Ao{-iu(lWRd3bAqCC_IIsnUESHsvr7}cp=m1BBq)3r^7V)4AD&{zxQZv&Zyd43ADie@BKD+|9_$Rn@^$n>++FB2Ud(ODlbr*Rl4q!Qqg&D}bLf0wjw$B^=9se8W(lB~&oO}mX2h>?1{y@>nDRgi0Ki57X(NEVG5Frofr8SF z(K#g<4E45W0xgfe5S>3t1tU1)kw8nKKRQ>G35IvlQvq++`slpSKrjkGo#MTe%?rJH zjLr*fDg>ygoL{nO&0rvFmxJxRPHLraq_CiFi8Kv1NkI2t)5FVJU##wh z`sysUj;!t6jQ6|Gozz!Zb0<>b+{u5cthpKWySGpJX@5&qbZ(}$zqy$Ug}Iq@o4J`5 z=znfzi`38Dj1-xhxv45{ZYEs|{QQ`yZ@vhOYFT1)GegyGNbi4c=9*)sUU$*)=VmIZ z40>J6+{{HMGB>j+VQywiCUhmt%}ix;GgGX&89o;^$@FiF`YUZN|^bv*l^^D&nuosZd6m&xX1 z-tT8VrhSePnXh_IsDEFcPP+R(7t$n6PNmq?^isqK{)n;)m)bIu>+x?Br+NQ|Kb1l?{lj7It#x~w$ zdn-rwZU3k6P3K{g?R&D^`d0dHuP55}H!c0Fmz!pBf)crOadb`Z(W1_&OlNEd+dE@%|7&{Zv_$j5n{)b-=7r@}UO3mrcg)Sl%?s_2 zr3DHfm&vQQ$9?~vr3F@3#^i-|DN75KJuZ`!6Y!nj=6-zV>R8`-^Oip5J4y1wKQ<@i zg$VACZja^Bn*m**4L#|+&?-Y0=7l%36VD4j^7r+d7uIf0o)?P!ef{Qza>2H*{T1@) z-wONt&(`03jfGeE->Gbkg_ro>)|v}1i1+7cf%W43Ia*-tUlV=j_I`Y4d75B@Sqd3z z<2#N@`!yM^@2B0ebgSKgtla_e?GDre-+1lYoz_pg9dYd*S(MoBzml|jZht&vSnZBr z?S|sp9iaubBxyIlpLWM&#0R=6iVHh!Pvp5?+l z@qYhsl6&qHvBmlHeM#=QMYt#4Ul%30=LX@Pcwd~8NP5(01_a`IHSD-nW zuk5V@wR`M6w+Q!KmgF8Gj+|nU;0y@9$$|| z>XpG-;Oj)Q!9Yh3?Vq6J!hVXY-~hSd+1Xo0dE2l@VO;h1%h z(AGoess>$4XDk?V6lioURO#~|_8dj_f1Co1`IuysGfIMH_ZEWxOf+TCaW7|_e_WjTS9!VKW z+aDW7U(5AB{0l>0-=-RCWS8%tGR(h59=e_FSD80rJyR9fm(go_wwb0Y z!!$ihWz;cu-=R1k|JxhM_c&R8POR-(1lzTO=9Wilfw>KRI`?I8Ot1H*4y*qrPR53Q zWNe9(@j|?e0xfXm3CQsEBSStnR>p7QWlYcl-#-BvOZt&f#$+^b8F$9ZP_@7?CZoMS z89(jM9&s{$786UFTh7q}Z~`*a{_GJaqdZ-JXb39MQ1*_4K#qf~SsA+r*O|X&YxE`V zGsM>8l|TzT-$(V1j4MAD*ANqOmWciE>;3rEd9hp_T^Qx62ADk>lW--<*wv4WvN#!^ z#>*(s0#7BC@wd2fH}5Yc+F!o;x=Hs;zDt6}Iq$0m&pj$k-B~$bHELv*_r!h_ZD-i@ zlP|pxp63uEi@ItfZ-fWdVDlR-+K zygWy91IY6=08hb4wRtwceB_b(0%-0Ywuh>_m+tc-6|c*Lu0roP@=e^|g_=b7HH`TU z6tX+vItTeQ;ks1vpM>ku$UhUV%OLFu*JYCJ3D;$jw-c@#Kw1;7%O-CmT$e*$OSo<@ zc{Sm>T(U9Yx*_DngzJWq^$FMIlV=jH8%CZ;xNZbllW^Tg^4o;#Mv+Gnt{Y8$op4wRZXzuIEoJS9q-p9Xsk?CjWOd?V~hli*uP-k zf_XL`pJ~a|6ziU|RAY=1y=N#u9>vsSHvXZeSN|OSQp8Z88j57Ei`Hj0DFAs&o@ywj zNpaR0X30jx$$1&8x!;{1*3k!04x~ZjAw?o8XztIkF5e-M;N8%yDNqZw14+iRu&$-5 z8xL2>1kcm`n^R$2W+evtQt}d7@=~R zw8&5kZ=Fe&@oU#BB>uXO__=Zi5q}R_>xZ|O! z8ZVCS{rZvZn6>~^W76}mCSDLv1l=Kdwp8lxOw(KWj0f@iRI$en0`wH8&XgZUy|ETY>PoD{SvqEruQpn! zDqXX6<7Z*LCRH^G^VR0jAT5x>rU!G1V(B4U^6KQNJF)%IlpC+v{r>c2#-HqdUs!IuWYt(5*_vCdk#L*~ ziWcDc?uPkcT?J^&y9(;XdWq-j{if*>Yl3~^-=L7aG3OnmGv<6MtqsH);J-2FGswp= z=QGKUnDbfWgP8LJXl)?&_uFF5=a8*2=LeI`G3Rs1>oMnt(Aq%k+y5MMKA*f2bAA|k zDdzkL@zq{kFmHdsr?9m~;YzO9R zybj|Gubq0$;Kd==+Tl|H7Vy0#?c@~N$ocKny|$Q!+FU#Tj`(q=@Ic&n6LT|QPRM6_jN*7E@|!wvaZh4Q)?y65-DkS2x$4@&u2gc#ys*nGcSZKO zVf)zt-CMgQ@;$Fy&-UO}=pI2mOH=E2k4UShb;n+r)g9FX>VvXsm`lO>wHxIi_IDNy^U3TIEL!u_mi;S@G-=k@JC}{Uuc%>rNH^><^yjL3b;Q7)aWVPZ-ZXUN<(2AQ zeR2jg?p9p>&J{{b?jE?=(A9J(!TvVb1I@vus&TMfCJNSjW79}!D%Myk?dPWK3F|l( z`&`Lo{jLn{*vJ09I*fJC#>0w(@N=zbt7#Jn_RU_aZ>HCeJC8hKT_0TUAcz<5!9KN; z_sQ7z%GeK`9cepQor{wWfiA2IlzXh}Iuozk!`oPqN@DK6nCS%y<2|Uj{7=1U z=%oi!>HZMU4%Xby-a_B2V&A#%EsL!wQ^4cIPU7tcLpC%hcvh=N0vzov)BRoeBvlBiX*ipt)BK z@6%NY8iVxt{d|HF9W`2Zv>@P}Jizn2TK@3YhZluUJ~-F(bk5ZTlA z1jZ}r(ecU?|M&lIywZ_j<&gYzGX54EuRIrntwmU);af#6W@8n_&({R#QBwW8U8yXG ze9Xo!IG$L$$<)m%`mW&MP}s7fUm_h>g+*4#%FsI5C_=!X<29<9P+O#%<8 z?$xD%nmaf=ozNIh&meD9vly?;*4zb>=ANPT>e&E!8}IMcjoCCdiudf0$?mN(>0B?9 zjz7!9=#&ZOib+|0wEaKd->c(TYgHO}u(k^gPbacVbE6-9b90#HjKK#D{cx3POv;DG zLtBMg`S?dA;pW4W0{D-*45)D;(^4Nejf(+loSHZT{AoWG%mT zY)V4CeUzWuni5lQht6j)i+T;Ab?MZd#}p_Y50HmgLVs490o3NZ219eH3?-x6rNyBm zrYHE4+T8J)+WbUTpN`j$o~tf?SOU+4>R!DvC)NfxST>Mw++~_B?60t%>m8m>f(jI4 zjBd%%+>hKG*6G?F3N($X?$w854pm0_r9oECPR}4$RLAXcDrxTjRI|MOr*13z@OsoGWZ6u~LYohxb2GszFg}%GG32Yq)Gtg=%Q3U*I)IYjAIrV~uPr;q z?#D59r(rf?8+b3a7k_`~sOgzvnlALEi$HT@jfpl~9~qwwFHZcv;J+`5d9p0s%9Hu& z(LAYWftfdlbq%1A)rff{*8%nY&0S)x_4>1kwN~~LR%`Vq>%yDEdYvGvFbE0qwpeTI zaJkb!HFjqM-EXv9f+hfMaI3YJO8h!1=u02|#L#a9)%bg#**Mps8Xe_83hz@_W9?E0 zQ+Gn2SrW`uo7rCbmdtc3-(HhJ+HVR+^q7-o>2Xa)Oy81vvwhzZUiLzL1iu0V$Czwf zmg?twksVf2ti41XbWdqI_T9$DzUFVSPtK?}t266MUNf;zZNfe=5?gU=n6+es=XXCb zbYs0tI#&=pl-3Km{+0uVK3ajrkA_Xp(HZEc`Tl2T8T#n6 z;J_COcn&I97v$6V#lth5^;$Tr7s&KkyE}NLY8+Cac8xoO$itDVJpThXh4tVJw#PB% zgys16O!jx#aLs-HO<_G?ny%1H)ldLxu^*_K@PDL(?%kB@|4%R7x2fdlm8#**fc9K< z0NvyAcV8~sfjHL9UwZV_Sq7btS(6H6Z5jK11o_y7^|(C5cUV!#!E%X6-qLzVSDS;s zh2~HyG{)C``M(P5ht?|uYb&wN+a$4TLrQ-1`f=xxtY5J@?1^WAXx8=GU@#6T!~7v< zMLn(Cth(>uFo(%k-W#WfEa~qJ8fu@1s`U6}=A9Si6u5#?99KA;skv zN5{&fgYK1vK9}z|&GdTH%&0fb%=+nCST9hZ1g{^Kg?3VnU$28ToeKDAetD?e=uq;c&=;+TzPQsG>vYPIv5x5bT3i79Km)%$G~+%#_E6aMRy`CQ z>&TIM=mvi6SVzJbrjei9>WGYCa%qi{_zd!|*bkShhH99NHQ0aWs7A+8HeZMR_gmI; z$OhANA&-qV&m-AhlsjYV=7vo2iyOm<{ZT_^OnoxDw+_~H(Aq!GAMBLKBQKilS?d5Cg9Dv+ z5Xaz4{%GoTnNZSsIr?z)+@TdI!m)Zg#!&v9d`zF{=f`*(opyenN57%7o*Nfu z0OWOC$(|c4pt(y^HFr*keXsQ15fjHgG)G+fqN$^e&6lv+=AwfT zos0Iebva|^p?l-zp(`zncwCdi_DaNK>_fifbBH;bd#`m|2%4MEMVEr+4kbLdl!_&I z#{JvH(Pw#J^DM7=ID3ZIW16n&vVn`kw4J89)TpYP#0xb+!W0}7Pj--mAv z>vb}eusuEV{G%4qdXAo>du~pqxxevA875)>IA?+8hPmvWi6B5@$7KG#N1h+Y9DiRJ z*6VuBN%%LR`*h~|moKvNRc#iL=Z5unP1AMY5A@lAA562cV}aT%$#jqHW^8NI9}N8? z8H_jCGoQeIE3dzvB(L|Jjdt8_`ETrde*7K34hfp(E$h__S7`1n3Usw#4&FV8Ky4OT zy{uO+700w`lr#6Z`+D_30C~I~qI*OuO7T&&xsvMtR!Q@x$k2p&5_8kFjV9GeRiKI1 z!%Ck2t8Wb5z7G4l_5G7l98_eww{%O`oTM)6)mv94Vw}G$c7FI{9OFvRv|FEE|Cy5O z?^N>r9g3@%zgtpZJp=sIG+iBMBfg=2?;Ie5?hotUK6BE)Ow(m|Lqwva)(}EBn5Duae>)C&LBnGoh<$ z*X2eEKoB`1AwmOk?I)T>wRV@QaXBrq=L37udrv8;_x;FG= zTWyrZwlS;!Hul@-weMa*uU$Y|1-%yjIEXq?aAZ9hxr-2qg zEQkZ~{2#}9%_Oq&>Ct3`qPcG{P5o;dTz?mF-64^Xfa{xk6LD#$3)jlgL|Ll2CndqP zR>YMflhO@QT<_T6x;}{?IJh6Iy39b?E7!!@E(Npz;u{OlP&HvPwcmRZUDRj;R>amRu8yoq zIinNw>9WzMNYv*ng@gos+&22`zPEpU&?YPI7;r-RtawawKXDv=usy0zTHS6UtYcMZM-aNa6EQy*|GuQLlS# z^g5xuP;iNDzB;eZJ}*2W;_7vfQUTW%8(f~#h0DrU8A)(06>&YDLe>emp0>etZW2G} zCtp$fC(Boz;Sx=U)^(3`HFJTU%pxwK7o9N z`kY|C3jb2jry-S;3i_O3qtB+}=o6Q(`qc;X)vd?ThvqBP=LGZByG);Us?Swvr1eFr zPdn<<{mVpsR@&&ZJDi64v}3M9Jy2GsX?F2^g8EETpmvXGc47X)9CQXiE#|7X)l70> znB}W@Y|o0=4yBQhfNi@Cwx6FqYz+)sHW`!z+cFW`)9FO2k7Cdl8Kh9a_A47~*{7Q~$Rk^mU^_>|wjqO*3fQi*!S?wt?XYEA*vgKNZB`s_UKe>f z3AR)bo0>@~1#IWpU~4_y*kA;?GYPg&?-sD_$|N-cwsae8PugNTzD?g!pq*mt8W6#z zEMakabrNiwL~ONAvQEGjx;qiu($j~nfnm!gXC}c$L~PTtNUMPDuQu4OI^DcMHi0DA z=8M=q$|4~F+iDwZ|9851gFN!@9(!!%BDT2$h~$rATWEu=@9ysw3lVJUz*yeAF7j#; zY$HW%Sp!L-fNi=BwvSIYHW)#CNw6KhOTgARkW>oTM%iF%u*H^k0qytOS*?dytQx(m z>Kay~r2upxK3a=z7)Y^Uos4lhHwm`)MQpRONsWN*$X$up9zK288W^^0a!C?wFNoNB zv&lLETe}UmIj5U9$R7^*P8*H$Beb;Hm1|!J2B-orHw()~Wp@6N# z2HV@V*iO=>s~9#MH)5RLn*`hLJH>usFew$V4Y0ws_Vi(EVA!(B%p}TyZ;(yKC&Bi65gX)@8Ufp88*JB}Zr&h|q$I(%NW``>kE|20J#K@o_;kcV zP~gq$BA*!c*sc(<6$~M*0=C6A*p$b6uunAR$+r}*PZ>?^qO%o z*ywK)I5sVSbva^Mxn>l>_*^kia}&e<`A*LrVtq7}lnS`U+2H!ispD#3xUwm(1xaxI zQ^b|!B9#KJzB>|e)h5Bk>^3gZmIAJE3Us9cbWvQua7|Bw>lKEpfsGMdq=w;YKwST_ z!8QLBaYgJ1c@)>^B)A?HapmQcbpozeZE#Jq#g)x)<(%0suD29upnR2N5{yU0WgNA~ zRVCtT$S17=u2nX;Mx8EPFoNRRkp$NzBCe~3k;08pTsPU^I(kPxc5E+-$JNfCb;bDC z6{Bf9D(7qNjY)91L|k3NNU4BJwZRoQMO@UsD6VXZ>%kjYfy+u-ur;P5FWTU`=yc(N5fs<{Blfs{D&l%;B$56Y#kJf9SKcYu zF@o!k0jz&~Omn}R1lRc@u7%$tg#xah+2HzS>8atO{zY+RQ(Wtl;2IF)_oGOufa?Mq zT<@GBt_WYiaQ!L?uDweHT#t_;l>)9D8(hzxF21mTd`xryBnhro5!cAkq(;E?<&s2P z_u1k)Nx#2^#UtXHm;~2TBCbuN$vOeoTQ<0^J6*W2e|$`HJCoqLQ^e&dARz(QGd8#; z^k+x)Z1Pz()LYM@=se`g4cTu-FEXqSHj)o?|qKQ}zjU%lBmU4xTz0CwKsM<+WRK+*5le3oX%(;#8!Tf_l^4h(|4o8r zx`<^}F$oD+ZnMDx$$hsy&UYD>{6Vq2cwJ;u5-ejxEG1_X=}%ECSK46t-|eS}1xAqH zCBb4Y60qz#n-mII&a%PsS6eLo*vK2jQf0-_k|bDmiC7*QPf7(WDK=R2?~bLb%8H{I zNw74FSW3(NIMTuDMI8|OCn~YC_<@X|%H_jn70+!7-Sgt))ULcQTB*C&_z% zvQEJAv<;SXPu6!g#PQ;Fk-ek@|)?_zhFW`p>C?9&Hh-jA)V+Eo_Y#;pF^ zuzNrD$ZcYNIFFPHdKK8{_3C%mtBb$)8?V<*C!?43-skc3Y8CY=nLug;y}rE7X8doX zm-v3I0?;77UyE4y_W&sX46E?o@5F;i#{VL&l@rK10oPkLxUT!IxC$<@#pO(b>rN5Z zM-xb^fa@6>ToXopGZOiu3y^V$~;|sS-3VQ!BrGv$BCr0F^bD= zgKPI~{k|t%Tea#k17-8~q00YO>00qUX)zCo_uITDU0Zd< zW%PQ)a5CR@?7daY9}`KXz(bA=56_-F4_)H>;_*EEG&2^}~AeNN*2_e(^5KKec>Y>Mi0lZ`${Z|z?n^fCVa`|<3v z;xWy=@i_Wmdnfa~PKKz@`147rpwIVh^m*&#^y$|=sLwqoqR&aZ&;QSbqQ9L_LV`Yh z3vK5AZS>)F$O`NGqdlfsJ1*|~qg3Hrw@%ZH`Tl6yfoL7F!utLwrj1$sw_#U@tXo{U~6 zXs_@BL9daMNR6P^88&)tve7H9j;f8TqZ)+zj`@~Qci!4%Uq^i`;`-$zvQEGSHn<-9 zuDDozmw@Z?B)I-0;`(S3X%%q&XF(#ag{O-ztL`jJg3Bl3D!G7!1YC_axGpn&iCGLBx(=GAt6RLcWt#EzcfI$T%Z*RI>%H$yH$FJQdn5O} zak;VOyUN=&-T3p#%6oa5@%(Y_iCp`y>Bdt@u8myNb-D4_@vgajy7BPwu6erL(2`u! zN!L!6iX~7D?i*LOfxPy)i$oV+!%kVZM-+#7;%DaB;5PPbVQB~2s?Nb5rLgf-&!};g)!g@>Cq43HVPISG#w{6!y122&Dg<&1B zXT94?*8rMxH(PIModR9qWm{e>tj!|kwQTJ*{B6#i)_PO5S<;l zAA&cv$0hzPr^fGD0mAy74nJEfQ7Zn6&(Jj)ntnJ>=%25eObRcI_RmY^#jUHGrnw#S zS^pf%Ia?!_ezCU2l%-4gTG;dvvb?jTi^_&+XB@4k%f$ z-P&)9?h`)LUo*EyuT$Uxl>6>KsNXl4w}^GwWKwut6!%&4*m}Q(!&xo!x`p|MB}P)N zR?A?tfad1dG2XBBvHe1V5;S#+@^(!o(zQ`}SvEX9Gp|?QW123;zsrBSJIecb89X1v zwbv@Ncl4IT_8zfxxZG#xA6R@NR>b`g-AfXRgNo#zoezsO0MBd{7JC6asN46J7_KQk zBeK7xwI7im{Z7k-cD8o_+Q(t}rtCkgC^R32&SZJa91BL)3yhBz1)A30(yKQr(Eh9f z?Q0&(BB%%YS=kjAl2)hY-e#l2Pc0qH=M6nLmaT^+XR)=%Qmzf_981TUar+p_;Q6N1 z&_jwu*Ok?*weXP3fApB1pyDe2q%ExPp>2ZyGbOKhw=&e44I$LJ>pve9TY%c|g?xk>;)gTlb<3x^dg8BWCRj>yA7js#Q42_4zO60~l zKsqSiJpVY*+-V(d#fpcE3jvPh#iCvSw zKnBnArH1}3od+D^?<`lFD>K<1pQ)g^Q$TY&*t&~@C1)SCVQ4H{L(p?+SpPD*PQIV7 zlW&#}vew3Lrar^>uZ#5;$f4T}<=Km?uoVAZ$+B(NAvSbtBUs{D&2}I3bp3pP1qo>qi<(mXFxmc}VfI zmYrMV=$eA}tTy#b!OrL_XlJxHw>8~&C2UTL@N!<<+Q9&xT9vK0kNxl{%NIV6UpG3& z2Tonjx02|2i=}5!X8ufdouM|D_L=(76VTP$kFEt0cz!JC`iD=#5x+lUwMqB-Os?~r z!k9qvFB;gRt1>k0yh+IMM=vC$mqv5Ec@xX=>qfA3B+-A#&D4L3#l5u<+oKEEI+&US zO|5ZlwhC>2X|*ZkY3_YiPP@O^i0ConVT0~v7ms(kh1V~(J#7kEcX71s9ah^l0^S>w z;H?z!{w}V~!XHH2eA5Q6TfjRu3Er!RF}(MSZP!jA>#mBn{elg@Q@fKKk-D2CpDMYG>w!O@T-vLSRW(asMiEFb)X!9l;yvH_0@otac zjorJK?WHIAxBk3`_IVP(_c5on{=7$LYlr6gb7%C>HEBai9?gM&{dtcbS$8!TV}tEy zyF3%x*&Yl`2Hm5;#r7!h0yN5JsYZtkO-@md2^W!dl~FxPEImrCXOo!k-@b{Bdm{a% zE4IJHoL)KA&|$o41aqM|SPrDaln!EB`)p%%TSoccM zv?WeX>uhWN*c+pGKQm2NoeYNedbN44jcsv^z&S%5=z7F1wjOb41rReAj5?UQlddN% zgXcL>X8T11^$MM*xj(p(^}qaCG3r)%9GkRA;OV{8&_lUco3gzmn*VM2W3Fn{JeEb4 zPte@*)nUC_hQ+~;*AD;Msx_iEcr)Soi~h47y#=6=@3qb2<@p&st~*8i(=H~3v!Zr> z=Ei8up&k=&>ecyv13cdNn$eywqH9TC`$cq(>8rnpu0wt07t!^pulOQ<>>D@kr!|sX zoSWZ6_bWp?4$kk1)SrX$d*~h;yN9dC>Qcc|EyDpvzIsee1H1U#1N(gZy~i|N<_h@mbGi?n;_p;a{T&MU)9BvSY&;fJQs`L5RM;M%)6b*!+9h1`Z{c|7=h3yrcL?{k z3&;QXJn9>5!tplY_^r>Q>yNhzzrQIQzb+ha5{{dMdtVifUlFc(Svam2j-MBf*9-U7 z3CDjBu6a^8)`jCW!Z8u<{f%(!6RvqkIR3S8yj(c07Vf=IIKD@?<}TrQsc?L|aD1z9 z?|k9-X5pH-!f~Z={0rgu2I1aW!tsxVYuv)|4B_}H;rNHby_X5c<-#?paD0hye35WG zS-7`EIG!k6bFOfFws3rwaQuJ5y<>#q(ZV$&h2vqu@lfIVTp?a^gyR81ykrW;X~MBX zIF^K%>f0MV?%5lSsiVU2Vd1!2INrZEis38a_zU6qv%OKdox*WYIR4+>#QgJ?7yDrF zi}~llOla7<&@oxJ(Wb^!_;S`>qG$ea|a>gYm|NNx)SmN`OZ;r)2 zKiRqY#Gju`=!rf*Nqsi<`AO)D@X0(sX*h-FCk@G-pZxC!C-?lM@mS*Xljo0}-1C!v ze-Rx=wyx{{`3e6Q;(qeR#w7Am?eut2b;mb||^UA!Vq4^2gC}$%{K#-5`#)d5y9jplNqx zzg&m^U0UOArurS5)2kN_)!bOCV0}`yVIYAw29R-8iTmdNrHa4T&}!T6pM`dJ&#~&C z4FgG;3M4eds(;=XKnB>fy*94xItfZ7Yp)ZK(kIu@y-uY08i1!IM{`dFi0pTQdA28R zzZ1UK$v39yQZt|n>R4_O_a2Sd{JrVMU((q;dE~b{E;IgQ{g&V(?@c#Wq_ersgmZUX zX543;i=V$kAEJIxkWH?=A*_SM<``3d7M))d=isR|JOby!CY}F#y*_?#7OcU)jqIN%(|wdN4;zZ)|E#B% z`KJ_pp7!5x?{W6%7)JNh)%whmCTqWsl@D0+0(9>Wm*4%AN%If-{hUm-d2Shy6`9ab z^-#I7hwfoapVtT8{+8#AA^tu8H1r^y-@)@k{N6GkMK^|Zo_FaxaF(B5G^bZzH&XEb z3v&p}$|iH?B>L#Lb7FmTZ`AjTJAl65(@^#KbYr)Y;_pz>{CkvC{~xiI2hH6Qw-+4m z+xUJrN3ma19DZ4b$unW}U|CAP;C#^BwHB|M!0WGVc;&H<*BqpNobM0HQ+Im%%#u2p z?Neet$+&C@vpv3c0F;y+j`F7elRewG_;6Uqcv2*2+9T-LsigQ$9@SU>hDc#POJ1&U8b}DIbV(Rsv}q8I^OiGEvSWadN5zyT2i} z^&XHy0rMW4w(dS5+g~1I`|||b^M7JoMaQ@F**@kGf29Nsg^)>jjWaW7(A+RS)!JK0 z7=wzjRC)ifr-GgE>QsPzMGAP<}bZ)D&+3-%Fv}K&;=I`AXRsqLrNv+ssioF z!f7LEAAFG|V?fySEKLPcEf3jO6E;0`Un2#&3Rj*(CR*2EorZn&LBRTl?R`{iom<#z zdOoJU=c2!lvwnZC&-8p~nl59X@~TULu2~Xv9eLm!lD}v)!Me%#-yga=tvojx;J~R$r^R^o$`+b$G?L zkieIer@OO+Nrs#7*#{l{;x2$lI!YFF(Nv(kB2@Qn{wY}=+r5Fu7|KxJ${M5 zi__y)ewBqD!dMXpv9sn1QLA3c>Og-mFSsI{Q{>B9OF>*tZRzF%NYh2Ip~AC3lRrm z8%z|-APdU6wnCd*=Up+}Q=Z^6nFLbB0)jJn)yhLKM}WR}9+-vtg&c|ppDGxnJWA%k zN#=w3k*um?Q6`>1lYISsQ>n5 zDoE|TSXTG}Z1JaoDhxqmj<$l4s3KrwTxL!5+OUmj7mko6qGPNIi>r1RBd$n#ZTjdyt)M=JqtHmot!$P5Ik6)@NSDe{%$~j_ehrPIf$`!dH$f%L-a`w8oGrn)$zpw zx$CzUAJx1CxSx~NFe?1)6#TuZ!QoBASrqegT>SbD$ z@%oJ=+EU~7i_0{(@%n=$+G6ANyGyhM#_PUi+FaxHkCtdx8?T?K(5^6E-?vmNF<$?+ zQY%gwWlNyr)=Ww6uU@8|OLqT_CEAzC?!UN9`!w1850+?M$?m_qM0-Ek{k~<|Ka$=5 z(Gu;gWcQz`&|XV+|GuT#v1IpuTdBQdVz!fS;te0(W}w?!0kvEfr(5%e(Y)c88!pWo zm<~0PH|(1<6g@AJ@rLV-ydg(@bW)r*{2^g1uIcfy^xT%5H>~BMW9vH$>3QjdH~16U z@J)-i(Ro`E-tgF^ctei*Uz6gzVP8VKjv4WGU%V|DZ^%(sPGY=aPr|!gN&MYIw~gct zE?Y9*kgYmDjPr&7KyVue!FfCc2_N`Rw%1#`b?i!>-x9$}Xc(7175gn$b-c)a+Z3Vl zvGiv#K9H^E4aYIlv%fnfD#2Mwx_WLWFIQYB(ts^k#Dm^BuHqC#82dUEd z{f`4`SuA_n-ILG{ZyQNpxq93HzAdao`|4hmV3(T)($n)aMH6_cC!5v{#cUlV3H`Xr zSwE6tjz7iN`X7`wv(JntXQ_c+$hh9SEv%3+()FznwRhZ;5VLDo z)hSD4&+(-ZCA5s`_wFUKM_w9H{!Vl)A#GlnY2w_&0<`8fSrB=@JXQP}GMId{uA?!; z!NKp39!H&9_DsEPq@VW%eH_eA%hNSYzmd@@4B@~42MxKa79jGi^#A$=s7I&mE**=@ z>xPu>DLm>DphVDRS@8`+%Af$MJ%R&77R) z!R}?Eb|3|UHxF6q-2PIc@fB3YxNaU&ase`lK1Z?a%`EmJq+#d1?Gfc|4jLM}EvQET zm3)7fU{T#~TWDVo=zTpgKy={jlBKJM$o^2_JdXLx>6{H%&}RMFfqypHh-|ch-1&E% z{(A`Kr+Xty<-=H!2XX1|bPU!b*i@p|k>7@fuoBX6=|O#-&ZaV*Lhi$XrD=l-8GqW% zbe^cKxBI3cWr)z<1fX-a^yVQ&qp`H?y7J~BCA5&8UHsKeLrRFAV{9v#-Og~XkLF5b zsgAqHqlNnT$Bkoj@oUmwIXf%`8X|PtKC8Yoo|u! zna<8P{_v(DrSMks76&~u-=ccFLkgsWb5dgeza5YAqy3KoiQIR5F&+{9ko^ArFjmAg zaFY9^A4kCiI$t-ExlE1Tx2cZR?EacCR@%*M40r`-uiP|5^%R;Xa?=ovQ)^FwKvNcM zY34v`%7-nX6p)%SU<;Q5(smv?*7uA>X#f_y5VTgND|a}Y6VUq@Tj}o=<0!5$XDFj=CoyLO(rD+0(NmqHO1)-;l35?qc6y z4`YSqN6Zs7!e7dG2+pT=zic&+(n7YXqz)>PVSPORGmhzV^F%E+uX`t;@nObqX^zoC zqI2ZY@zC!HOhC5{G2T0n+GP7IcK&nj$n&469`!d}k9uJQZ#ME}YOC68@@oR85`G*O zcowI+jPc}R6ni&?I)gLh4A&M`QjjF0_o(fG)~(S<3Wc3`BpPoMR*61R|JE@ z_rr=sj|(zl1N8kc-5(7v4l6|d{fz$2RUdzGSn)>B`d*fBZu?~*O`EGx-nIUvVY+rV zy);bqi5p%TR+@M?OYp%fHgQk{kbs9^>#dYeHblo*$8rxEDE_~7bUerA@3ZfE4`Zt= zKxU{0+HN(&yn@uUxi$g%@&)Mo2M2xY`}5F_3L6SOwgB}U<50K2qpltfkvR*j8CKZ& z)6C9I?tSSQrr*2#rD3XfpRR#6+P(>#p>k2XK9|Yz(=}pSi$LUgw(6+NrnDu#&-U7N zgol-R3>%rD4iDV$WQakJb^sc^*3*`ZH;X&#cZzD~GVselFThj*4GQc;-j> zsDga|*U@%z)QgGFJd=+W3}Hn+8*L|7{W9^HSM$;AA*^`&uoDF6gK$1t2eOCEQ)muo z^q#!{h4eG!-+ggdd6|dJRTr?-HAmF`V1`NEf{n&^y>n9MiT}b<7mb&;sK=xI(fyRA z=8*aM5<9!*k-g2{dsTn$x-X*d<*3IJ-b)+8ir9;tsXTiA{?FG8D|U{Zz0Z9`)!|J43&A+N*{&Y|PHMStedM_6h~g)Ky$kY~tm@=8zkQb=sI`q)Y33l%E#y$YGR3ewi}NNlW_@eqnflTA zLBhud6Z}Cv)X!lmIgN4Oo`!2sm%&eS$1Mh4c?OX0o;a`k*)5}eEB0G2?GG~a)3L`s z5B=59&kAEd(>ZkH?sz}}MN?>J0s?Ptwm9w|vKb#K~x% zp&zTUpTivL+8pmkOwv#1ckQQR9D2ymPh`EJp8*cl8Tu(s($C@V+E2qZXoI1j9%DcA zc~obhgRx2a`LBQDdzKjbdCl0*9v=A&-}CkQ(f#cCuKn1jp_zt$erN2bokuPM9lV>Q zpH1JbA4=Dg4E;Q1>?h2lE<-CuuafjL_uuH}Lqk74 zV?PZ7av1t~EJ;5F3H@*&w)p@`0pv~-fTi37TYLnUnM95J4kDm_jIE=doBkc2YyOVU z9ZddQ@|b15B<|N2)VB@Hr<%Ab^ zj?R~2wyzEbjFk`&82~KqJ44j^1YV8oIC>EH!gof-fV^nP zOJY9i>U8LH>#=w=FQJg-CE$F}K7A4^qQJ)AbqtX0Mol><*h{uPT)0-`2IhtGMQztu z*~6Jc?Fi4}_gZ++sGK{PkJh*&6x-harWVKU2{BSKfHZ%OMzMAOCE}gLG0+NL8#4Y6 zkV3CRV<2FZlhOS2m`~Kc0A0ueP4Yw(5Xih+=x>h71!$Fr)f(`cAQ*f8M+?xko`_;k zG2DA*0jebLr$Dfa)BSdbGf=rFqJ&J$env2nZ?f3Nao{BM?BxvpeM61|CqS#?zFDa5 zriju!giHH%8@ppq1{%WH>dh22vYwCsHLOJA=N`BzqQDR?{esZ2{yvf4zR99ieM3ZP zAH<~}lk3Oa{>V)cB{YajiTw5ziJA`}7=7pVo8oavCk?R-V1iYV9lsluQ{YWj)8VJO z4%ovXJQFmG&3*tl1i&2%Wy#m9O@)BOu{rTYYbg9Qp@u>hNPoOqQ;ciGc_NC)LEyr( z9OBdE&aRrG`U^8bGm&{By3n((vSt&M)=q}D*n5==(781c#cPH@D69RNt|wEh5DgNEH<#jD5J zkbQVRxy}Td`$+UhGIy`)Ye&|Itl!Bwnj&IMeRkf-(Dn|st!1lZES)z-6fwf|chc^c z+o7=;pp^7Q+OEw6t=H(w|Iq^U;+hD{>DbMoPuE2hZx}m6b41NMnduyqj-Oe8e!qs% zaXSwIZ;q%HT}ged4UTsU5WW($dtDKwIbGChhj~B2i_PPyEh5mfn?qeSto8+2m$%6n zHS7#sDQeyv&}d&aAbXqn5iMqL}~BGPJ*KeU3sg;vaZx7n;l?|w;IaG zJCwE$XP`&duo@oXS2*A;5;dY%22U2ywW4!$wd^75Rq2W-G8twwW3h=-06xa#(bMyg)C<#%N4PX zV{tiDz?)>L$O{pCQzibw@+J|{R znU7{3g5=t3293;-SAZb>n+}?sDQY6Q&J;C5r*e*{*~xX0sL31zNMG*DWY6TK5rxhX zKu`d%>?Pk8!KE}0NzWT6{3@P9#Q4_3cu;8$(CJu@wkRC9z_~Wy9P?x7U>c8+H(W}pr zeMe+!GsolVaa^O1gPX|4(V>sS7tJA?mXJec0%`MX7GFcK$VI_aG7}FfDLch|k^q61 z!P@&M2U7oyBl~n&;(glnK3(HvPY>Zq>4evDh}^ps4=UCAT69ejwHywd8^eP!TNCMr z%u@8`3%`pN9JUV+)4Ol zjmY+5JJ1-XPGc?|%Z0P3Z|#6aFVFfPz}SifKA~m?80bUrQ-5ZS$xrZBzrd^7<`nWQHvv9wZCMo?HM+s9e-ILDWFUP$Gcz z=~bE%+2Qi{2-)iGG$zHW_SaPUiTt{7OGT`%#U6l6ZSxZU(AK4XEb!=Bvi6fjEr*9- zhzBjPZC3^d99vT5qH|84#Bnr@7rX#%YewdCpB?<#mj$ zL&rFDTCkLK>-I}pCj{iqB8(O90Ct8KirRhw`fh%|03FDcJuFY7K%H8_dzK9Jl{Yo2cDhBx+x4gNk<; zmwv+H*c%{pSrpgO|G{fw*XftUwJg4H(L#!A|7#VS1A=X1zu6a{U#^NMc2f-Rb`Y$z zPk%OKGCcdE1?Y)Y5v4iBaPOG~Xz!|sBBwAMmqD8SS!R$Kn&1O+U*AFS&RVz=B zIr6WLDE2T;x{nDaJ^~CAa~MlL9vU2{&4|bzj$oAgW}!c=V;Hv2fPde3C60feUl*ai zwlfU>HW=~mfwd7ujN;wL-2Q8Bh-2IjzZ=FK&Bwn5*APKPKjaOjwt4xOWsTU?wEJZx;W;o z6Lfs3W8NvNBGhk8=KX{`67wFGUem@wm2UCKbhg-)4IPdN~Z(Y$MNu#wGl-gisNA;?f&cfhyr{Z-;(hW z99*z2qJ%W;BpA87nDKqbt&`Dj7Dtps%uB}n=WoD}qwu3i)EaM_j8dwGC}tGM-%L?^ zSdL>xAzSvmw|FFGbZ0Zn_{ieqnDPIfh-1d1IkKnaw#f+66r1QZ@`StRt?24 zf&m?n4_CeH# zECU4k1x_UxxQm0}+I6~&&Midl<$!$ibZl_zWVCbLNDMsT2I?R7j0Lb<)N_+;D~A+9 zpI5ILQY<^geT|a=H4aytc#wnO+dNP?oS0V`ojVK2orDevt)#6SQtS~NcxE+=FKG|s z0J&c%Sb8n{8uy=EIiy78U9$-!{;HKH%7Nc3>anQPCk-kg0ZPd`XRc*!G!No{{>~N- zc6nNOkY-)Sc)?XGS==STW^C_URTIdaV^^`KNocTc}F^Q{F>GniQ`a9f!IdyC&8Xk%=zCSYM+$T+}#-F zjABf?jxn}crZ%m-4(PxZY(FPfy`@!@%OtN;TV7adQ=@J zHnzu;jO~N9hOv18wWP<#mXc&_%6A;w529l;i<*m!&1@W7a@!KY5f=qPt**z4mk0W8 zGeCfwPVM0V@|_|N!QUCjya!O%g!q`>T{}`9ZI+VThHmFYjZc+3n`AhDQD>1oMDM<=U`Po8l-`s0PBzOqCErHo`d2(?N0acN^mqpPG+_bI!bFctl{-V^uSxEt z`9da9Tig-;Ml9L=7^ZP6Q9AW9 z7*TR!JTgZ$(j1}Rb5}v59b<|?E`KYm9L-{Nr<3uasc$hp^!ioMNZLL+F@X;?I?$a9 zN9!NwVzr8C%!&H5$Jl-%`UH9_tYn)YP-uexlX;K|A**)=57J3bSaFPJJe1I#du0)V zMh7yj9Vw%gwaNDrjYTwzTDOozbG?cD{@=I4ES_l?)0~wPx~+vg8&2Q@aUK9_^<#`a ze<46eky-W}`Go_Kb=jn^3t5x3)!{9r4_E@(!6Zcbe?^-ol8I=&y~A z`#=89){(UJ!wx1R+J|v4dR{{_4}H+M0R2P1Zs(x^PA@{oqj@pp`d}t{GfC~d=jhmI z4d2d{9pR{a58SVhla58OsH;1eoEa(aIkk?52FJln^f{}cpdO(%m__Il{knyRK1bsM z)J^jrp%26b6njPgkNR3;*Pb!UC+R?INXFH>b>oAtMo#H;@cYkkH#L9vEq+UZJ z^Xp6Kc;09(Y?f~KDU8>vzu^IBH25)DJ(a?dHV^xFkRF|>DNLub(7FT#PhiEX>#twy z`B2nm_1jGJY8AtmA_oC3O>8Tl2wNO!AVC_9^=)-HXQOqlhyo@ktxbovn2&E@JZjV5 z4W%)g9-Zg;1?agd=2vSU!~qy9YVsfs5dB^p#MBqK%faxWV_OlrXF)`%%>k|EC?MYf zCO^n`yt6uPGy5~fR>Gg?c;wk=wu{!4U^bj|XnWuIdtf%2;fm1j6+!k4U~E0PM(6hv zry%!yK#s|}{MlB71btmwCa`t=g(s{$Pw4*ypt2Rz7Um4i6Wa>YV2eMDrN1V$#TCk) zFEO?rNx0uq$Z|5gk5u?;>^gqiR)iiV-#Zz!8lFSGZix9g_pgp9p$oWFiQ0Fv;@Hy% zY|Ss}ySRn---EFd;;65wjqsLs4oaUfj_Fr`+P4=W#|GK+mo+25`DPEJWopM4EUJrx zR>$%bytgp$hXY}ttFao{=rOiRaHc3 z7ufg{`Kq^A)Q)T~LPs~qp5C&EQdf8Hy5PLb!Y0Ig;h zhkVuX=a;XJDBdAl`Ub|6IsoJsCCa{wRc)L zHV4nRsSUa`i_u=vx=$e!NC!(a!|EMpH@B(Ksdj8so&i5g3 z@faYE>bN;7&Ij$+7%N@@oS}SCE3}Je(*%&bk1X>)B|t}TdlBlHA$y44`2tzf#h{Vr zh#Vx}ysJd^tSyTu-o?!3Yv&+9e)qbGu9`#V3=B0jojAJoHLYDg5KZSK4be7unr?3J$#eLdl@P8`gs-Fl}HB`&_KW6py>AaXg z?$l|w&+$ec>i&qzCwd0S$8-+_3^mX=)t3$p4n6KFUVq1|vb+mW2Za=xdod)K)Sfv& z=e2tS+aE9eiOIf|dQB>CG|z2ALY`X&NL@2DC2Oa+FDK)~{`T&yr$vCkJ7z$qhJ~}0 zPm6;vjHQQj7(F%9Ix^X6kC3N!3)T|yO&5ANX+H{tO~k^xipp|wyl`Og%#&Sl;gULBz*~N4n1V- z71=_H$Yae zyJ6q{Ldfpj1t4+2*T2kjy~luH*X&+DfYieC^@YIox&b8kiT&*jz@2>+)7X2J@TMQn z(3E~NOd>p}OyKKZ{>B*YH}w7fT!IYYRd13UNLqWznE$vjjzu0!hlc)-Dz(}7v06&M z{VB7_uzD?7YVR=9#|i#eT#s2UtN_9ORfc^ba#3F_-52)NBQe%oht;F%=#h)Ko71xuAJgP|-+p3F1 zt=0rvWD`iWX|Sc;3{qD{s^7Pm)eYSKFSq|8x2RosDXes5Eb|k(->Ttx;VC@&Sm4#u z0;hf|WT~GB1!|9wuXYPImCa#}`aa>a1K8O!kLezt(E1?R>S-ZQWwe&7PQX|pG|b}b z3)H_{7EuC(em9C*51liiSJ3&MFhf(wJbfxyR5Dke2-#|M4Ann#`$@k>-HzF+-#pkh zjIBKzMeQ_C_^7GZq}xi#?_^A*O)@U>4r#aM$z^^fU*0_U>F{WqNTUF)1m8ApFGATS z*T8(D!{z99{t2?@%)E#~umQDYO^`jO$@LZNx_W}_36bkZmQw%K?g_GI#(Z*JL9d^k zAbT#O*US9JCJ?z|Q62MXd=cU&QXjtO!|9rGKhJdQk-GFq-J$;xnkQG9sQ>R1pmpo^ zB5GT3kCie#7J+pt49{`EflwB7B;yANKc22BU7IVZU(F42=W}9&+J$Le3&@?D z#0d3m5ndb3^Loa`cwslCTgD$0mmWJPWT^|u?_uohuBp_TXj~PuH@GJ@?Vkd2=kqQa zYwBbmIjFod3TV@pvahcHeX#8x9 zA75|axd9&e*2j77)7Oub30JIQKDZdZP!h0r21u_>(-dDi^LsUOAeE=V7T++IE}jCv zZvj0kMDsmX;jekJ(tpSPCH{?bMa{v^uqgRl_xz18qA!6G$Bh3KF^`;W(f4$AEvTU z2BJ^os{Px-${Q3rFpRKwyWS4Q($KR4J@=$b$fv)F59s!VVJwmRXSRivo_)*x1JCm4 z<5i+|u7+U2e3j7dC)D?orSCzD`q?m6#EaP3BV?(AWDiy_e)=idD?*O?v5=?dTHDlX zB5W=~&+=%40KF~e3Es$3LxN4cVroQb!PvTAfY$X{Q_%Vsm_O?ay1$}+&XE{)XzMaR zK4yyBYuYnL{15gt-FEXb^{>~@Qy$$tUiQFvxf9K$m@)Xyb<8H^VDXo&?)lRYcl~JoyzlzawqMR9dkDYg za-ogzJMJpbxVxaOKZ)(1$T>(8sV(PzUep@L7o&Gih83^5lEv$0%AW0WBZ}9|WLHh5 z?0JA*v)GK?nX>1{^m>W^*-R$OemGZ`W#gDEE19M#V3IvVo)KB*wXt*3yw%X=-2`nT zYxIw_rHcC4WF7+ISW!DC@T#4MfXs{ZoCybrnsB*3M`Mf8s<{y*>MtgJHBmbyvjIl? zxoc&F+Ar**?9_o|wyqfFWO6EwFQ48r!q%nBqXb%bq zzXc8gZ=MV*J^}h1I|1!|KddxoFrCqRC$no&UG}$`NLZ@dwEzMw=`KGA&;VbU(f=%p zC@_A69jwDKFdp?UVKoQj3Cu=7V|eBlptJgYuYSLa=J^++Uj4qP-*@rQ>ex9AeXQTN zPk>-uv`*F=#pu+Mh(hjh(cFMnW}}l!A_^FvJ6(+aL7tlk!3WYs?S_lY)&}J7onjl& zzkTTy{&Ik`mAT?zhzIHXF+haRo)Ii66ih?6t&Auap5>5i77vko&1N_xXNp>LCTK6L zj40%OsDejef41D!>M~<& zF&clJeok8^lNl}7G5z|77+cAD(&r8qqj`%)+7at9w!W3nE;l>g?!d~p-HgZy-vL10 zT|n!uiG9r0;_C+FJqqYDO!Kr$yJ^k~hrB$8>=-L@A1?in+^go0*Uh1PjFsj-X5aGd z;!wfTh|=DNONk8b+Q%Wh5!$RvBQ#IGYopj!WQR2yys%}jh9$dQezN`4%U{Fvqx(Ti zo#(Sb+fF(z4yBWJzQUzP4e?@8{Vy5LIX=vA4nHY|a~del8C#4@rI*Gz&BNb}bL4bU z``vr&JW?j}veXcfwFKjs-Ts;bfU0)^`f#s~am*F|nr=YVM*+RNSI0Q!N`FlehpKrF zo!F~m9P<)?O*MzA-5mP+ULE7;_(isfZG;cX)nXgrgYqVk@Z7so^qB znX0$dWoT=a-qw*!W|w||gP@JkbOWX7ovaoXdA4$8T%RR$`of)J+doslc}@^emtaCK z+)(L1BV?(}R-TJ4?gs6P@%tU#FFUBKSU5Urv z)3FV$^_Z>4eC4TI-wRWpSkLZgZHPQ7Qzo1YQ(vhCkNKW}gJAR>rUTeiGN0HHQTi~pHWLiTL7)&Uy#yb2t{6E#b<^1VgjeY6qM!Hp z^Oa$xm-!mn>^zhnNq>9)0h>tVZ70}|?k@-Et>HlWQ(}A5S$k(z#OIsfrIu>3t^LQ} zTMKFJ>vzqd^~Sew6N(W`Y_f$mG8uEbQ}+vMIMAFfQazCLAKC|P%{EaBEd;H3vZ#g1 zL2E7&HG)}N(wF%0S3+5{j$NBKiESYT+Cm$}wh)H4piOM+<{(fGS=7el<@tIt_M^Iu zX%~QG2fn_Rhu$GNw^?fUD$xEpRa3fG5m_pG2z?9*IcoFxcAF;H)J4>m4J(9+Fp2zy zo#H-6`;_{w-DCWruLKmj5wy@b0flY>P0nav9}>8>&^%^8{LQ<}u1RB+_la%Y8$^v@ zcbNmJtNvO)*8QQ;2!KScIfE}%_)XXvJ-_UFKjRr+3}Y$r45-nu0W2^2 zDFGUSpHD--ctji^-*6St2`Hw{R%7V_CT84`M?~eYy7c_=^Axu6h}9>AD@mssT!?o zY+G^ZIFn@Z`iO3qC`wO|*Jq}o+&Pz)*Kd8BU7{HfF9Ra7dEk*Gb_s)g?t6sE?7AXA zL?`LlgJ}%*`Aft>k^YIk@v9#~BQ$1@;fmiUe76w86-L{7)MgjM756e+ak7rZ?nGtW{}OD; zgY!Q9ocPc7U>e^|zI$qwE@vK}PHVIJSZr1UoSBBMtI~Z;y6g&7F}q0&Q`|ceQ$R6D zJEmwfKS1UnI4+^>E<@XMtKxR^&&XWa*gKFop3L|=GxT@rvRJGb`If_bu<}s1+fQwq znW7e&1KN(sqE;?gd%ZlXqxrq(!%AT*Y^ei~%4^_kD1F_aJq4tXuQl{_Hz42D@xI1a z#rhbiTTCE@YIsyAK<}f}-;-ZoDCqtk z0eTORdqVyQe^0Hz{5{N`nyX$c(v+bZ9)){&G$`b&p|w29C42c?svq;Yy|1RRd3!6! z=B<4qNKXCCplW|uA^me{a_5VM5#=WsTL*=FdRF9m0ZP5K{L=+#NA_<3?(Fn1mU_su z^j$%nI7Op1iR4sR^WU88N#$e@&AH?U=E`PRL*}eYu$OG8b!~znEN#EbJAZvDOxk{z zeLk4r`1;zkwF4Mi?P(`%u*a6)CD=*^1t=l&b0F>g{l7NBaraJhzGv%P4(2mnYKPyf`gv(P_aqPWF&_?dEe|Z{~CBH-OOVZrHuQiLAN6e0)s; z*E{7bmdHGx=_44TK_=>Mlf^Osu0);;Wg80MY}YW0ja_zX zP?3w^_&bx~_{+Sd*TsVrC}RAQ+BiA6v$T-;nII4JG&}|hyEVNL-J%~{6Cu4Xs|nWMD33ExJKF?4=qWwJHF(f zVi}pUe_r63jMMqN14Qis0s7vt&7k#EYiHB*Gqsm_(B$zf7oN=bQH$&$Iz-;=2;oIq zJ3t^=yv)JnEXKUcB73R@=yM;Qfle$RectCC*D`wt(RGOa-5kLIX1B|V`Jx|Q7MFLQ zTp|`tG@h+*h(in94ULT{tiB7C)kgvC-i;NJW3t*6&BsfKy^zyE>UPk4JiR`=fTp|H z8AV;s0s4^qKTK;q(Ao_lYm?1e#q^*$TEDvh6}XsT^zUtf&<(g0ru3AYHdStVHM7y&O85;x-yhP~r7$8e!L=pS3ll0S-FKXo5;3sk? zSemHLxQhd6c0zxS$?^Wy>;3sAFh8{~2edb0=dZq^)8p?G&i9V5AH#n<#U1Aoefm1? zc(InrK}I7v>P|hLtldoWJ%VG5<7)-vv&P4FwLU(V?xXqh@)*|WNQO0ydjvKuQ$K63fH7J_ypN2GZ8z0XB|*F4bPuM*pA&r=^u z?3{Qan}~i~m)^cVw4;`uU-Kvj(%Z&<2UzXvXupwVab5j&jI9?1YsoDs;FQ1q$%(=j zxwCsYkX}i6zsvCcm-_p@Y}xZif7ew1b;A&>=CQFaa=^% zhq1M39J4uuhH;?%VR7HZ8Xhg6wV^=^Rq!aZ47B?IN}W27DHJT5#fg$Jb5f@gjB-ovme)cmB~$-uVvTt6DZuyn|{5 z*t`;B>6uiZG0fj4pAvIgpdHZHby&GifIjbdQERl#pmwkB4B69sWkm5lBC`D5v9jm0 zD`|Z0DlZR*ygYZvn<-yo)azKD`Ew(61s}q)`dd+aCUC-qu>!8&!osRtfhdQhP z)OE@^pwY3syG#QR+vF-}i}8+)BYB4iAg!^-CRH@?w&_ zk)02-xcsdG^lhbcou#_R$R0?SJ9l5n@wtB0%65x=wGbkCsgLzh8gOt;Zzz1n8r>f9?#FcjcvZ|6|{#`^$iMFCh65mtWhJ zEG9wp*SG;y7XdoEOV|C6GJl6uhn41G?38m@&bnMBwh`I=35(xvh34WY_M-nM!CtLV z>@~i8B=)+#Vl?&=Y~K-kRnMf@%YJ2Y>~+A#u-6~1_-5>N?NWxlj@WeUHTH6J-_p_8 z%e?H{u~*@eMC>&>pN)LW`c2RnFxW|=Yh|>NTvivik@V|&brdTdU#w##ek4|UUBBPV zL(mn)O3ygZpBK}($PxIdeKC#A3HW#pb-Uu@{=ne>dPYBM<&?qyrLePzN>A$kuRF_G ztubaJ368RnT%yLe`iq}LaS5}B1fy~8nWA>T0DWY<-AnX+Irehomh`g$t7oFIOGo08 zrlny;(C0EF2uW@@{Mnbz?db<~w#4!nt7byaiQiqk89isv?Zw|9(khW<2 z$Yf@#Cm1lKK%2LS#gS~dC(O<_NP%FhvA<^kb)~ZYPA(bEU+&hwB?shAqW{}K?#u_d zGgv(nh4eEit0&5yo*HPgToF;2pEh6JHBt6Vj9uH*0~2M>SpE9wL{@h??FxnmR{toh z^wfxL0Ue99KF4gsuE2T>RYO3qUv&^B;4l-{tDbnnJ$ifB@1n zg5~ux!9wShOM832L$*A9WRq{c&#(r|F_uUlp>i@8eD4qR*d~*}*AqVLFv0QNclqYu zvDr7j22wHrgbY{&nettZ`LHu>Er)T?4O#VszfS?#Gc^hS20NhLwG_K`kp16SJ(FU$ zqgk?N_N;h(PfwQY**@!=v0E}sb6UqVmwJxK`{g@hc&1}3?LSL(XEHpqY8JyYjg^$X zJ1BjJSRQO$rtJAs(g5vOL@^5eKbm7`z$gt-jPmiKkr?GN*JzBg zJM%kXl#X{wW>JjNe|d6@Qk2Co3cCE8F^auXuR)MSF-nK~)mdmoJQ1{!d3r*|^VlkX&R5B$MS zZ*d|Gvsze0PKt)}_|Hw@b-TtTd?$KsELZ5E6L#Q^xARb6sQb3NrwEAb^QeAE?h{^e zgy-sOd9JsH@MM#C==>A`4NT!tHW{B84uQ#aC^T4mf}W)?#e|6L@S3?p$86d4Opna& zt>bjxWt!Z1CNH8y$K3tX1mDUekfwf5QwAw7&r-=gx_z7XFyTo>Ahx-|R8>?7hYLkG z>%v%S;@KD(kIL#@K8Phq6%RcPvPULkOLZOU&ANHU7ZvMg$Y$=)mx8P9t7*5)=$U!z zj57(QzeJfBg&^7X3akdZOH z?A59n{P>I?tbDCXfRv2CaAPurJC9YJ=7fw-=KrPYHy~u(e#a|SUvQ?3W#9j6)jg1! z@y7SxsA_<*8RJ&IStau3j4l|L@uQU;RmX(1jCyWjM)Mu*Ra5RbR@E~9NL4x~Wb~H3 zUiJB{f2+C|(lg##^;Xrj+=PrVWv^Ae3XrjP!>d)}AuZ$j>;GPLHP207 z*ZF^~Du&FArMLd2>N?(>G3)v_tNsk*GA^6{=c=xLERl8S&B~kcMTKp~SJU!m^vo=n zac1H7W_&74p7C{l;fyZ@uI=Mgu5H&Q-(kl@K%yYF0q_~(GB{ig99=vtMAEfBplS%VX)C@&%T>X7Nza3^X>ztJlT4+gQ(Q z1Qs1#*NgDT&g}-iPWN4wT9hVxAVcnaZzkjGlPh$-{^~4hOQdJ=q{*J;6{Gq3$%-T~ zu6%PRmkS!l$(>vQXbx&C0*$kS#_LW$MjE{A3oD?KdyfkqRSRW6ml=7f4(vs*%#`uC&vJ}7f0w>U7>tYgER<` zwQ)pi?A=t1vJKD9TO3hBX7+5e83JVeVtt({N9l%VFJDY^dg-%b3Ixa+$HuUF5yA^1 zihTgb^W#k*Wv7W6#dqd7O}lesPg_YusWpSPE(P>++_KdJIkM;DD;XWgCJ4?otR3mY z{VJfY9NFV_kKUhOyTeKffW=qMay34WV1kXQzW<*F9sIO@e^B>1^j{NELc^Hl+?wF* zqr+I@OmMs$;B&_?mI!_Sw;tPdi{aewy-D)V@iAdkEm@|skF4X>RRdc0y`cFY8mY72 z8P84ELOcX7x(u{y;ZPT|_jkbbS*XxGQfL3YJFH~Wm>;6EXD6@Ab&SO|MPnB}N@%|> zFW!EtJFdH*A-a2ssI{9|{hiPX(01Ng;rEVby7`0VNQ_5Y6o!HN1B&h~SR0KyY!aZi2S930XuoA4`^M5* z>(ikf;_rjq51n|Khu+Tsq^A;|?Yc(x(AuQ!_{n`4fXKLO^=BVTc-B$QboseG51rWh zaL&_SKKp+{%RnpQ=$ZGu2RM*^lK75`)vkOn;XWtI9`bFW8d2*h2TimuIqqbc?8kQb7ydsMo<= zA!?rp*(D#ZWx2sqLH0a%B206GuX8cFGxl+$GQM8->+98$!`3U!9ag%QQ908gERj9@ zbhfwol8CYfW9vRXyMBi`r{2rw)Q51Y-`>09L}&wOaBt4j17x3U1kEet)Q2{MHb`@R zaw$&i-oW(Kx>S%tn?-FZtwWsiIz4MIYrKC>1S_Ge>-~GEZ$78KNig-MVJvlRjGxC> z62VHUuJfAc`?nspr+u&=_7pq~cjr9awL#R%!PM(8gVa?XfA4hRcz=EbE2j&u_kU^v z)Fh<#o{2Cl)dXB`T?$B{3Q@}ya_R||4OM_fXg!V4ev-NFiOsb|{j`RDi-)YsC+~}G z>rR9f?|JMj1?KxI0$3of#|q~=On~^EX=~jl3g`1X zC$4q(6wZg8xogF9h4Wt{dj@1r&#5u^O&4>>G?17%HsB98lxvbpTqt= zG+Vzf$M3f~`mRJX_4{5vmKW3KXc&(!E7Q+o(9i!pWsq;b*X_yg8EnjlFpc}CK75~> zL*60|9mFgKk=mzr0~#kr6j{U0P?o5P8V=Nrr?JIny9Njyi)D5bw+0Fzv(N%t{2WND z#IRDAOZR=Nm#jg-RR~sJi5?Plxun-@80%tnVthPT_K%n^{!+P4LTnwrF$Pf2e|qo1 zk$IDkVLflM2+-yoESEmSL2#-_c_1C5`z}CT6DfacCF8wL9GN#65}8l_S^&#KnWFX| z90V;1@B1dj-@itT$N2SOY~5}Xwf!6fQxp3%ymOWQ4jBi*#`hJAS|bO+!SaNDGUM+| z(cfvAD0|+axtFdonS;_V6W-}EypyB9b7Z3Id5y+Hh+3B(I~aP4E8AHjYWP8D+q*H$ z&hH<<0m4sdo>~uwuDqMZA(vY8vlxG|iRmCjkH45r_4uT z3weJCJI_BTwqf4VyNd_uW!)yw%v)*fIrD)>+j^9?Wua{yi(sjV=g#hpkaps6@$ckn3K^3>f~9Dk0y3{BH-{DZ0(Khb zW(E1a^CRbG>Bg`ko{!pqS?-u?V_0cE7o8gxfAaq}h7}<99u(WiICt}WJ?4d8o(HL$ zx4a(Jw_l+1VePFLVEQ)s2A^Ita=b z-V5yAU*>8`&pc5hd%67^{rPWvV{H2U0<;D_SH@z~wTI%d>ATZq&&6r+*z{-9WzW~- z`jJX{eJow}{A(Js7t=U(o;xIGez#clR~|@S%V4Vjty?`;Qu;fP%IpY#oyKYzj5X{* z>ThlZbR<>w%q<_Sr@UG|vX;R&*@WF=Vm4uxOTYR`w0YX4_53&gjhOWnJH9z)y<*4c zT>8a3Se{wbPTcYkjSX|kysOO1b7h2=QQ6;I9>)RA8=$3i3{uQe^ zS1q>L1t^u>fXKSrc?dqYIIJAG!XR(jXCp|PjXqq=>T}bYZmF{8M`X?uzJKq+i1pNO znIDd8Zn8Ociu(rWnR4=z$@4M{wIV6b0Cn*LtTxkq0<<=!&t`s#sj>&g$(>84#cC1; zA6=}|Li=o5=atIssj`QRKam!el!ujQK5}ABLb8T~hT20>f3M3>dnoD)9uRoy2kw~z z+Q;`oo3Y*y2M0R~1+I5jgKO|wj@5|16yJt%AiZMMlx`CoKQE-JT@Q-C-vC_iUBg%! zqIHc->IK29KK|RVlCx9XcZ!ECPeiaZa0iPSzjz1p(MHeE^YS2d3HfTnrZB5Pbc{m_ ziG0XtUr*zRwzBxAzmVTKaE9&`+sNN;it8D+Hr*LknoUdwuor8wn0s?>^V>zuMM-iSoZu^ag?80 z)Mtxj&;DZF|5ij}o9THP0Q{lk^Ng7p*Qb;p2oF-N0yLxJ$~zl9Z-oG|{3(AKSg8(9N+8_UPlYX-JD3R2M(b9I}aDVFn2b%*KteXo8F;t@SZzDU0> z3I?5GegP_owj)5$7tMYD)oheAH=@|}INvw)n)=71;~fC>`0HV%d631Q_>Kbd9su+> z(G|kXw&LSC@zc4=I&^4oIH&7x-KAZVH~nT*6~5Ke$G=5Vj8O+{B< zkuHCVx`4QFfFKE4hRt3V)|QHspFu7$UDaydFW4MZc@NW^tio= zeO(>z>;D$TY2o8&ewWIy$vt5#*+A~hBYIvjt9RZ~B5GYJ5VY(R_dO^;Lx1{ghA9NA z>MoT%#g|2t=3>yAO%U9a&~IHSkz-c1anVTZ@mGR7tHrj51ZePb;B?U(R;x<*)#HC- zvRbytp0Z=J(RPqK%k}~K0As6XQCK1OikbkmIOE^6Gx|-FWDk*z@iS_WtjRL8zIQMSq)>$k zl~Fq%X!eZu^`R`Tjl8$&HI^4IXF}lrv-a-sQB>#u_%kz`Dfrd0laC4HZJUyf65cXAIWdCnC!s(V!06WS60XJk3^(;Zz7#=ww> zNdE!OJ@EQ`);H=s??SBb6z19^;}vSkDZ$($y7 zq_2?7{VIK^R#nzaWjvIxzZBQpWAHz;=6@OgA26Fu8+YVd^*w9y`vG*Pg;-Q+Zsm zd6{_Zg8A8aYG zpab(*EoZJDbrJpOqj|h$UJ-=6B6NlBn9k*4nZ9ox=R%F+;F`^VPOcM>u|hxl48ndc6`|D?-%bbS zUp8DT!WMc?LpieQh_nXI8mvW5GGFFjI5*J5m*N^ZfAi~=$Xb_(oPUh+X}9(cRa1Mp z%hxp*>2(QhZ7CQlIsvt{r}MI3XijK-$FcX*?D&d0qMyB(fzvXM7fClH(Cdm}c!k9d zJt5^$+mPb5Ljp4SZ?6T}*uNYM^Vt@W^*Wx&=}O)E661L5DIt4mrT)c>%#L)IK+wd( z8efVNJ+{7Y9J3!8_Qi5gq(ZfShk3l1GoR~<EyDAyu(KnrxXs~O>M`rRDH0g9fnp5szUa9W>2MM?YfuZG!~wW!&WY@c8eA3Lt@3N zx4szH{)n;593vvTo=)*-h&f`xUmHU{WXA9@96znQ{nvLGAMPhBS>C?+O+QMq*b=Ib zixBd*#Iv$8U*^(1^XH+>g4%zY)6fC}c#ky4HKA&B-&4%KPf?YBkmo)m_x|+t*517Z z5L}ZFD9wjkq3=$%?jrJTkjB1O>P49G9o{ZM*TWm;B6H5RH>t|v+63i{BlgX%X1;IT zFc0}I2Gr5S{K$#sOx=>kT8QPZl6#W-nfLNY!up6bS^uyJjDtz6eb_{0ub1)o68V*< zFPX0@YHdRMC9C~O^Tjq_mzgiNQG^35#w<_oq|fWrhvuuwjkO7l>@h0FF6;ZU`#b2n zzMf3SZ>-4?W8?(6_irz-dMnS6|LevjZv)o5x>jwq! zOCYXa49r(SuW$dKM#-6{N3kdYhH(2IMO9SJ~saF+ns{OqlHdhYK=W}I7Bl0!y zxb%8esmL)`^yblX#RHt9^C1W`tod(QGCWUbd%MIr{fP{>rMT{+zmdaqpIiMQ^#N^Ot&wqMlLJJt!`z)~+ zezmlhb3iLI$bAj$CHw0T#jDHAXH-0u2`w^$y?>$mcZEL4ecbf^~haR(V3Yl1n`91v-3_pFBJks6LK=r?=t8gmEV#zF3@pvp8tFu()6!N>4#i6v# zm5p_?RHeehILB#Qqij4jOH~{m7NbhrT4dw7S*lX%VO-=xvs9&R5j$4oVKEw_gUQT) zO){v=UL%4Lc$jgpX8Pu`aO4sTj$AkzM;04Yh2og=8_*{ASL4V9OOJ4N;ye(^$di8)pP!Og@bl*(!C$^#F^&6=XYhGN*#z1fAzLG6G0 zv)gFx^no9)9x3}>TnmWcrFA*%aM**f|L&%^=96HU%H?YT4UAJ2S%P7*XFS=&bv4ep zdiH!)<2UwTT)UC3=Q4fdL1L%4)(bY-Xj@8b>DJzW4~(|+z|hCo+apl0m7z5Oe&VXM#hpR2yyXZ-Xk?lZ2HX}zJ2xw6qN3TO+FGfCW_PLquln+4R- zC>!my0@7Ep`p#;-Y^>NWppF*VX!i-|cVr#K8BV-nP(U4vWTU-ZK##6s{OhLwS-25X zJ_L2CYy_6lJS8J=9vG^R)xA+4mcvA@5E~sY$={i{Ew4ARL_jB36!wm=xN6S(kx%jE z<5w3@TZLiFMZK|A#SCM9k>MHt_^~zKs6s!%Yj?nJz~5%TwGR0j$cSm!`Dpbnzj zwlttK`S;&e!M^|VO$=)`pJnjH(R^deCmI?|mZ{u>I;uB^U^=af86x)!kpIu1woUNU z#?1Q)E$qGye&4oI#$gH$W(&Qab$$mwzo02?3+*Q7*8wWO5o?jFS-rzIvaa(iVAmOq zX}jztj9r!Al#QPP1gp-Mjavl>ZOgiD6Tj{NzfQ2L%HJ?{O|FxTDf47wuK>Zw&GKJ2 zN^sx@0{EZIzJ4LQey@3brK*rMLcU2)0W`o8*}!Wj_6n1E+*pll46Fb{n9jKynq*_( zdN733ILFHZ*%(*_hH!>#4BQNcuvj(*ZUbXrx%^k6x4tBSA8t5hS!4lFj?j}!Y$$S@ zY(yr55xH45A}%mK{LT5jaS4pbD%prQz=-@rHX;+ih+Holk#S%|zRzMlaUB>ROOy5e zQWdS+W9D^|@BZ5a^B%!C&CxomW_G@$KMRK-=pa)%>v9E?ad6sZFvg5@xICh~sdx&G648~nL!(0AeQ zXy&W_AVFn4eU2T|652iy4tNagH`d99F@l3`Np2>xxnl(T-39D#&j|KMf6nq^n`S07 zGG`+zzyOzQ(3oI&yr0G7!U5j~IeM-L{+ZTs+5w1+QEQ#5EaT&}jmIT^)X3Id2i1kj z_3evPrMo(zRg=BL;(NF|!D4hT`dwU$bFQ2Vli2_FYnYEAd`+C@T4NsbAQysv;A+`e z)*ja)1<>%&T6x1lQ2W(!eOI~b;F$rc7rOLckmLE#F!=NHX&vQPuA#P11G9(OnEmUT zxYm~k4K=A+cipDzV}~tBv91*W8sJnB0rE=g$r z!q_!Zmq+J?8RvKW8XCtx(yX;b{-*mR%r|Yf9UxaD zQy1Jkp2Y(bJ?v5mhC_>*5E+xyekQ5??bQjgZi1cpa<5sx)vQO|!Rt|j0Kux6NwV*G z%~+83QdMzQk6pJlS8djB%t+EbcXLVBp1ZIK3Dt>=ydlR#Ic(zOyYj(%jQcoAKO>T; zpQJXHP2W|Qr1i>9h!E-%Aas+L&u5sAd_91KXhS-t>C;6l2#qTGzFlyoUl-rKBB+B{J0 zLzbF>#5SBVQ4U*Um5ALq&;-UKCEy*Q{97U&gQz6w$0VD+p)N^di-@h)Cqd|G5kd{t z=X?*4$DMx8YqG{**vtI;5ot;etdik?J))CxHeCu3d|Cv<4-kA%1Y;pEzagj3RaIEK(z<#ES@VT2FBM7(WS{+^oS7LCc?01#~Enl z?1a{1sjJ!s;1>$1|2sr%sR96}ED`;v3B~IYS^#73T05)XVdVfKa%5_S9PN?7|7E#3d4VDe3y*L}Y~YK}*L z`kOy%t?68EtsOw@XCmu9yPn0DIC&gSDz439FMBZ#ZY-9MM3UJ529L2+lQ^hORF#b) z{IFF7|Hgdzh==Ew*U#iNdPT}>&p1=2C$vw9{1U-#&SyfR=ZT7{#U#h!bG24xHqZ| z)KQ*ox^_Rp*!8zvQO&HUJRq?;v*!78_C~cx9j%WMB=>3Mb>6#nN3{rU_` zYo?XW(Nqn3;LkRHZJd!xMWY?)rjuXn^* z>|rga%2~tlRE^xd7`rqP?A-uOE>IPsPkhdOR-f!iKgWlAvYvx-+dA|`{5i-o>|=U? z^1&E#<&z(#;_WlWasyv0ZNTQMLH%omO>YX&)Q!nIIrOc2qMA(W_&W5yJ<(Ln)ghhxbG^cM^v_%u#Ef>`4@ZySE7a`!rhXkL^cJSlK3!{iv1VwxM^@^T@jQ zn7QKQJ)$}4+LL>x!=uVwV`v#FmmoV%elXv z#jv>Je2holO&_~|7RA*m?=Z#Q$XF(@e{-p9Z1ORGg#@bd`*)&Rj~xt%;t6v0B>NC9Ih#0Iq5VvS%OfYN)E4iGpYs3 zA)E)`41lTx7D1RE7a`PEE{BB#ZXkPQ&0B2!sBs*ezb8t^oY)FveFW@snC$JX#Y{d3 z@TgL|C#tpGC{s?}X?voKkNA+Gy~XS1J@_u`5283YmG{?{FB<~@p|*Q`wC={g55?(T zLhe%w;H>x}PV_@BnP+V+v~J&-U?cY|(?2~F*V>k{wg9lUk4RfRlf`Skli&M?LoCLo zhrGL84!fY*?vA<|+ZM^;Kq)=X+W@;jM8EEn!{qx7@pyqHZ$^ooOYPp*xGW`O{?B)! zv{q!>d2)Dw%8@etwL@`jKgO>1(^+kfU5DaSUhm*>QUXAi=Z1Q8>le&cTv02B2PLTA z&+m0$S5*6ua$_*8tEZUy6@zWxlEaGuR^CT+Ct@2&PW_R0qZ;|99iS>THdsmSH|W|} z^_N3&8W;BVZZ^;FJ&OHJ$FR4buE{6qoEnhE&x}Z-Ztj6}jy(r-O&)trKs0~iW|lv( z>)&AMk$o4ZC7Vl2&%{PyZ1^f0m&gn_l+7~(Y)#2-y-9Vn{h0PSSoTpOJ9oVk)l5I= z+wVlRlUe>kaG= zoSwdZ^F{3X1D5NzU!*FPzE2Ee>>8?(jTIONI|b;X{7u~psf=<=qj5Xlk9b{X zilYm##W%-^N~Wdv(R~>?U;p~r7*X5z|1*qeY28<2M4NbiL%@O&DRsFqqQ@{!VML_u z;Xz{Cuo#kG9*k2?jW2TGM4!z`XrFxrPE`N>{|qPk+2GhX(GNfPa-7J-AKV#r@r4YG z=$Itd=aKOqjT7aZKadapaG{~yB-YrU5+*j?B!YL9&58+?r!XPsAj5v`cnO4mvM;Jd64*OJ$CF)e#fc=|hmgcUhV_)|*YAtcyu<@3{HI)3Nk10+XTZR; z&eL7{(qr^$PWbpm>elg z<=p8ers80+P$SLg?CDlag}2XXL5rrRF_n~l?r%Z!r>A3~emfA=205mJ4#YX8!uVfJ zOy$>>xZ*UX;?#dJkj6qTn(<|ric|lA<=nGpSTPl+e#R&1V`t4sV=A=9-)kbeW;Sah zV|H~UnnUi0Dg315dn`t+Eam4c%kXn9!#GIx#KRGWN%SRgkYXo=uyPaGFH2>kCSG$m z@^hx=uIbO~?fQ)43RD+|E;2rz9kY;nz@V{B7YszTHl9DZ%|>w*qazPOCWg_M$M(Qy zK8tH@J}ZXd)I+3gnryV@G0dWEksMa@CN^c-{!VK9Z}}{)nOKZl1ivb>oL)6wHe{af z1JwUirvH%3gM$Em3BbASv$!V5Fs-*i#-=F3Fq_q%8I-@My^7iA*OBw0Y)@!gDu+EW zwjS^MEUxV)=hd_Gx<8{F0N#V_+VFm_MkbOK9!_YHMvVZLOKp z5*id(?4)N~&{T45k)>_w0#q}NK4XUcRW*&vxWY{P%Q=nZutkpIplNdqoM1K!v5!Kp zw4hFz*c@g0>tzW|r8Y;IzFAh4coo&{4imeD$h==MoumIB7`tRp`~S{kJfE7D(9{v^ z-NbnV{zAUv2=@M#+id?mEur;|VDGOjHrlo$SvJ}$E!0MjIys`H(Kn$npv>255QkD2UfO;u)}?}ga9@^%%61&ya_0Qv5OohYs_t1 zoH{N5*kveeB>l=TvC%V;{6D|Z<2LWpkh;%tmS@7+Ks0^w?03(ktl#CCzu{EVR^0;b z`mt=)de61FZOuPb#lFZiOjMP%BK*+Q)rj8h5DJ@C3DC5G>S|7X zc3mu`pABPp`Z0x7} zbC8P1d1`)4+s|vVN9M^!yTEhR=QxoBZ0{_nr5wuCj-3bKB>F`;uR}v?^@(M=EJ5%@ z9#Fk_`r9nNh}f|Y@V45w4OXizfrI23SWb(XV_K=dds<9`1a7#@1|gpWUF5j$odw9u zZJ$xg@?j!Bk;5A$s{7w6Q{PdgK5shx&MU{qupg$tq#>G{T0w02VcYGJgW3B|{m$Fv z4WE0MU4N`#V-%Xb^veHgpQyAb`y1#1607`xarOxAs`k!N839Xbvtal`Q#4!+G| z1pD8^*ww&ol}!05)ZbSd)5y5aAkTNPo%#-Hz;QkK--_+#^1G+(ZL0UCFopUHR(yGm z2GM^Tu&dF;Wq(&0BlDnsKyuMF_%_DG9-(%4p8)>161aic;_Up2${6L7>K5jw`dC*L zOW6mM?-AxVZ53f9dFJCu?0uix?C()5S5;o;HB(+2qvqA*6--V$c@DF6ZEvh)wGmc} zvSI3lI%eD~Yekcf-a1aHF{)?zU7$-V#;|oQ*t01=dh*E}a_LiQW7;3yGH5kzw1FBulpIzHFN4F56PYUo@Bip!Ps@F zz{a@O6Jt81RIdNQ6Qg*-R*olhP`k}h@8J6OGVU7=e`sjbPnVzDS1IJNyvr`ypHtsH zJErwXEH;nY>-QF+@7FOo4I-0?YdtZo=q?x(e-Yvj*YUj$$OkyozMcM5Nt1I_O4g} zq4rYQ*iQb>myPy92(_2X#$Y}K2L$d=89`;lxG#@9a0(r%lL zepj8KdHBSB-JTDj_PMg*BhP%gY;+0`T*3X*9b_LpD5CtDgjNRNB;STSyXQ}fY2QS@ zC;OYj(<(Y7U1?5>5shE-)eb$4zKM%#)EwCAa9q)S@ZT5 zqd)U@wZw9M&v^7WZ|@s#X@9;HZ8rO#V7c!V)6gSk{}V0kH`JmBd3(g#{!lIIGVeRd z(r%lL?&0ljyQRIa7Tsw+kG1{w>F5sL9&n^`1L=IZrIy*7eNG6?%$Nmt!wv33()3!n2mO--QrifM^%=&SRIMLF@`0ku8(7X zpgev3c7A=C<$BV##Kr7L_fZ^r*Lr;v`vb-4>j(Mud6w%*+dOi8F&L4tVHRXWTDWOiO6;7udTQW7o$+h8Cy-BXSf6i5)=X4n22}oqHj%+Ye!{hOz5Ca&9#k z>Jff!Ek9Qj=()aW2@MWm@4Xnic9L^z!Ehhu=T772*0OV(rX{q%=h)kUvFinL?lds^ zzToH9^K*Ud+*#8STHitJU4yaf@8sNiFan3zxn^wHz~|T>m}?oEd)e4LO2#I?wYRMW zXbwZ&y{a-)p3nkw!H9f@Lv5BmwjE%8*Gnbn3VpNy`R-*H$bFL%no9a;1e&M40l7u;o>p$wZ8;%+hL{;Q06t0cGghaD!6G{jPV!=5IR01uC;bjoU2Qgpv(8r zLInF4pqiOH->sb2|Ckx4J}e>^zkO;0aThXNLg2RK_9?M1 z#U`@jCSn(`xQR6ZrZZNgaODc!%)hYej9W$cVI+zD4H67@f3$#N1MNRk6_}*uO@!k$#42oBFInoY+Kk(2e;NTkxB>)5oX8C`a5fk?BX<+mbYQ&%t@qOLsASmK?jH zhUhot`pJrz){|iSpxMtQ)iLc5#x7HL4RGD{3(GmrSEqH=Pr3f~YL0JgXYWkE@%HcNr@Gj2G;Z=*k|6{?>jwW$%chc3kmwev>SQ$uS|F0*reG#}% z?3L=6=I>`ZZ9sxxZ$HcDA?*g&XSY=|%!9@~SI4xEo)gf1%3)ik52g5YXiic8rw*q3 zUM)bw{>KFL9JN)QDgNUPF;*9uJpVWV=Nf5#6OEso!gOsJvzh=Aaq;e>)P^h9=gwq$ z)}50Rv{t;imKk2`)O`~ZT4Vvk`Zmj|vS=dXeR!>(`Gd~uH?)u?W`O1;V@$u_2PvN8 zEY7~u$hUv#@zLLn`2mGu*x|8q(NV54v7UT0>NiYZQ{S#ae}AWu z(rf4T8(Nd;za;w8oEB8+X0?0!^0}{4f-Roz0_5QBJ%uSBW|wEA8I3p3=j}u%^}IPA z6`1FbV?KggOQ6ByXSgo7scvERvxV4Jv6=*(Q*tSU$b4e_NtHU|9$~cx$a`Muh|zpe zGMBRbpb%r+U1mG2CCGiFL|zpFIBEQ>J;wc+lPM=i-w4zH$ecMz_XL+d_#IW*GJ(x6 z@>^W4Du0^5=1~iuN6+juv`4s)yR$ak=P`Fei=1F_0p!?iwK44@3F>R&1uG8<;IE12 z@&6_E|Lx}gBK==ie&0fh?Y+ZHCW_%oqYRfyaXidE$( z$3-uwVb3EQxQX=hhC8A49mU=kFm{>W;nA7|%@1r9Vc7GUhz^`eZKDSM9lMBK@c{oW zJx4Ijx7%DD(}Xz}?21TL`rq6M%|`TS@(rh+h4!AB&;p0C_X++CLN&9^i5@XDEj`yG zM6Wp;(7?A6V*F;&BG)P-DdqhIvDS909A0c=_$zS!bZK&o zazM4+!Quzn1n^TIHm{vz{Wj(~eE@#o{(D5^S`;@NrM^ko=l}>Z4k)Mo^rRS#P5O7% znDhw@v!b#OWaDUM=2!&ySgav(k&nf}N;VeR&t#6vkNLRt@OQt#GA`TrvAzU5_FtB9 zS!)>=6~N!adpBB0FQEa%_Nb+A->Pch;?x?u<`GW}y+AkQ5$mh;MM{%^6I=UzkYvW9sA1mA?h zrUn6;vg0oUKDk-O1x;pN7m-1xPwd1P{m#24x8H8o;oN?^+RHP2r&KQ5WTRU@i^_~c zW*u$CId7a0|;fr`B?O4wN&mUGP=VqhtUy^=L!(I@>DKA z0*fdoK*zaUems5_>O6I{EOJhZYae6m>L_P(uP2WE$B!^f+$}=r8(IBrIxpSdk8|_~ z(-p@mK zeH8Z1al~O02PNO{iBl;5aInoThc}7Pu-FDG-4ghZOtp+Gu zM74Z-GmfSsf&H}-Y-#N)MEL+tvwd5fx4&12pinkyoC(bx$5ei8;+$D`o|39Tmx>?R z6ld6+SArcO{VX*24Tha88lR3I5tpjUkL(;b$!GB+?{NRu?k|a@_|CU6$M7Bc2j?(* zR^sbOWcsJF?{F^cBD0?hEd9KeqaPyU{{1!jX|eS4w;cVnf~x%eYxFb2($C{L`e_4I z>CM?sM!c$?#$_aGw?1$V!(}FZoAK+;mtaTdLRAs|`z!>K+FvoAVJ!gwinEma#hIpz zxy;N(`R}t>J*%@+<=-V=or|)U`z_xk`Xi{y+Zel6fU3Neg`bmWjWE4Q$%XYE<8ikq zBvC&qN%cMfc1ULfy7P3|@Xc`|vp&w5RgBwcg8&Wd>Sg1x1P_pWpdI+0tCiC~X#-sP>B;eck` zdC+kA5K zres0mYJkSJdf8}A;$Te)tQ?TQPkwJLhLy+a1Oy`Zx0b?6RpcDq`LNP0fPb|Z)7rV- zA6N=#j}cG#IwKgnEitKYobGdLqMiT6xsz9C?|o4;!r~ zr2G+MmsFtk6T9el zA3qC~l_a#a^ zMCJz36Uh89_3b)phdocR*-(<^l+;TYowM@pIQDm*E*l+70YyDD4v1nSHk+zQ6IEq%4dV^B6{w0dMODQ4suIrO^R(pX z)Zcm)CUUM`m7t;AHnCA{m&2RdX`c4=G>0HxKGGwCe~nbwNc1bW1dXasZjOl1=*WWx z>-nuV@T;fG#%4PI;J`Ks{N!1QE_ZAsy)IXYP@HSOn8*Db+eNTHC_-aTy=-)FJ$-70 z9E}LzpC>{?XS*DJtX&ST1@Zb#0RDBUdrAlT;+W3OkGT$F_G!j45c}zd$%81)j5 zT#0F}1X<(VhZfWI-Dy)5qI(#{Y>y=4)z!rOq{LP>^$%a3sytcD^^F|05s6H=W+`+N zo!osVjF9JW$2ZmLbs2Pz=BeWLa-<|>FVi^k zNC_gx+z}zujwa_p9?JMF=V$)zWBle&48!1V$oLy%A!S1^@#V5LTYI~=0~(Z^dbl*9 z1v&xE{x;6U!Fbq05}78 zwf2VS`YqF!RH({JWF3?;d%LqjRmeUF&W#VhSi)jTWD!F9vic|Qv8_T?iaeursNZ7mj0r;W1)ALP=Jakot7U9Jl#K@Kw|%_ugTB zt}Z|W^SN!*2k4LP(Xy}E@*T2yr?Tb7yU9$s@orjf>@elV_IaxEc42P0k;B&HaR6d{ z?DDa5mu~`wp+*@VX0(;c28a;al*FMGcG>8(GkwdG#Qq1$Wn)FTY+Ncp=&=M2$w?f% zcYrZVc!_r^KTW|GL>1BN>P6xYA^D48BM)(;sGHfo+1x5w;NhcLmca zGyB~B_@~JLU-3#)^!9>$64uh{bUV~+j6Ul zDPNbknXfYi-Q zXWDip_2)5M7h~zttd|%8Pj5>4^h3y4#wI$gx=RNcHNglH~#!G zt{eN9Zv5S4Ido&@OX_k*YOFeN7m(jQPE)Vl0diBu-=MM_tR4}zz{R=i%@e)hwaYmF zM!tNc55PYlIqI!GuSikyYw?+qb!CkY(w#}Vj|DFqLl3cFrHvQ|1Dv0tFNysR**O-Q z#6iC}zsbs1aooYE2hg?IVtcrAso0YU4L5` zgNq_!1AqC*2#v2Y$5rLL2IP6pbtWl?onK&M>y}LZ43?iWyC9j`KR)LAUL*gW;`*H39Q`4bL7J%>E}O;vFj;-rl*nX zd;Nx=;}#%zMHEwxg5#6Y&$rc;&>}JHeU;Bo^I7gQ`;Ot@LnG`upXI%tB-cf;_a7L$ z$h`+B4qmSRcvh0u!n8i;t!7^$gsd@N?FC7#=Q!qZU1h0wuP^e`^X?BsPcyOK*F^Np z6q@Vj-N^6jNirUmi)SUN{YU=3dsb5Gn$7sq&G;sL3iCB0j9vdVF_|;RhUa1FS6<3= zx~Bkw0lOR~x>$`(UMUOU&*lY9?WfxToiQt^K^{A5WWUK#P9cv=7;$7#7K%C0ysZJZTZ;z z5Wx8%D$6bW5Yw{wA?nlo5W<)6L;U%~$S8gYtA6l2BZq@~G=qKK0Tsy}ls6Xo3ShbPo^Z9u`-%ssH9y?mDui@9#@O(bE2>we2XqeCH zvns2^isCVIG^GlCFTdA(&M!pv;)g`A`*|*3yFJM{hRXHj{9YS*E+3Kk6&w?PfcyVn zd^^n(G=Qc86JmSBtT0trF4h+dn* zbzAO-Tz(3(v&s8)nA{wX&qLoVV|5o>O&-MSW+7i$g4k6d&O5WREz0x`S_{uEAj!65 zd$ax0ET2Krt^U_XWyS|l>1TEb*^gxr{7n*U z+1{)w0}qM_#;N@^c}%a200hecjL&x)G$+U{(C0M@-!(LHF8xjmRpm_^v+>3QI0x3j z+%@kST3-@30Ce&!Q~l!^qZiWET5X`7NA%dWME-#5ZAATbj|pPBI0(9-I=_ zrUE$0GoHK$Yl6u$J5q{%=Hwi;rZ08MbaV@8v(Yy8O!KFpRZg1k8Wc-pW4R26e~<_M zaMm*jr=*`@a5A@@OIf{T#>wu~?;&$A&T!~~B3@(OmE{AMz(4-@h-TjF7XtVn&AJzj zf#&ymk>6`zysA9U_-PFCu6_4l?G4NCH}7HJW{~Upqv{1^`j%7QqsGa&cvIZIw*abg z(z>akY`NF5eM$4>6^v^!%Hq!ZmsO-O^5Yo0d;q~W?#bBY-1t>s|a zKtE*oV8dzwg6SId4t*Y`HSaQf&?#N&g(b~>0(dX5j$;p?O{M8^yorxvE1x%oQ{og; zC;hZVK#ehp{kI51Ws4`Jr7CfV<|D3OV~1Q6mLCU?O%0l zL^HDVf>)HW^?};_%=`RXO8X0-PeK##!CW86F~&R|=dTLG1_Rrd(AdEqT7Q(uG!q9L zyvG`szU-@-J_4ru=(oat`^|DgLkI-}qxA+S*QF^3Rqj{}vq^(Ns~S^6#9k|GWIV!jYDL z>s(p#?{+5t9F6=dj2>H&w4aF8TjK{^k3q{424JW0w5$R%Ob+m#QrCuTw;A zqL?B7O1ehNzm1n<$-fFFm;NYz4f$80_Rl*yTK?U0$=8s7{66=I7WoGvy6jh9E&p!3 zgv&qCH>Uh6?D`VhZ~dtaF0s)h-*0HMz=< zc^;obztWGjA*o#7Pw_uz^ z+6c@*Gwf8R1RwM-024ZdSt)k?}_C8|AzBH=o;9KaQvm7QqgmnRh)Ij3po&L(_rgFgzteu*@bK4d7UR z!XcoOx5W9}J3!C{LvT+p5ebtenCtSZrz*2u4@hNtKp$ZI**4cCE z(-o|B=gYR4q-y~DF9ld5#dtX+L3XxsI zEzpgdAiOO58)W6HsQKWp9UkFx*rBUFK%q+*PYHRBBgB5%1;|4=M$2^1a3R$lMYpPu zIUGsihSaecMT|=ZROKd&HAv!yfhIZJ0c@^%ZkIPqem|~RWy6INSdFlh{eEo`I%fi{ zFBI$;1hmSL)+yewtR+t@tsmdP?&WWcU8>9XgWDYvr%Li4S9#(e=(B6U8ugg zi^Yw7zBjJ*#Bf8TNe=gL9X$ITu_WwF+$QuUmH?8b$i~rSBJpebMHn7Cx#99y!JVyHW0lM}Qtl>InW*jF@eT68Xwkn!uY_zwFh>X?u%Vpzx)v~dx z0lE)TdC2-Cd#>5<@At-O9NzvM@{)YVCofFdJzZk4s%%;ACmDC;vZ2X4UUeb!eG$2`iR(l}zblj394)uWhUirLj~yD( z*5tFeG_p6YEeB(3F;KnfxxH~3=S%Lplj}{n;u|}BEI#_X7c<@iwOls(k~pYV$;RLW zruTWyE<|RW^?wPxPFMm5JMQs)?HK8o4~@{em|w?+nov60hAJ-Qc+gkaP^a&Wr+m?^ zcIJ1adF?(xzh(AmaP7J{k0EjB?g^PTl)z(S*R?8|@8@YN3R9OXet(vM4d z)MtJ|%GXayHp-(5HVAc#5Na-qYprKnbj_EF5j;|aR*?3rxb)*?nQ`ga{JI+f4hITh zQfT7Fhqu{aCqUUacb|Jb6u$5<+@Aj%mD@VQ7`yhxrNfUWu%C=k9jJ;l73P00ADYRx zs|0a9k&la^a?Edc)u9m$i*Pt1RqDU1lA{3u{EH>mf%#I|`au!=Sgbg(Bx%+wa8Z7) z3(5DEDs%@pUVSScc80dkTOTUk{cz}x^2uw(vg>;Q{7;FF^T~L(-yv`K>7fy=JBov$ zJLC-yh+yo**!7D9_D96B^@}AqFgkWGg}ZJsao3LVY;WUnKXl&Q&U3+YVz1@0@ysNa z=Mm*|#Cb8+PIji}$3vxwjQBIM-XB~TclC{7Z{4|=$$>jB!Wxmg0lR<(KZ|Q^)v^(| ze;nHP8N>N%9n20BBp9Z4*ds;gv_w3o9d_9T+zu;K6>>iOR_!O}eYdM7crRz3j-($Lu1#ZHdvS2A0y-^pYVt!*TNF;J8{7h9IVfBokppb&)L|(pAOMN#sl7SoerML)Hx4p=b%O}ThrGT( z9Ag(=SF|&68>I5FXb$rdiqmZ|>){>aw%Jk1#^%u(0-Z;c*S$_aTX2RB&c5v#t(iKw z1pZ?ON3@gEW#c0n15{3RtRcyz=YiU9qdZY+e{&L3j(VcI)TqUWuS;P6N2!_)4Bs-( zC(kfDi8bc?lzXk%2VPe+$_740IWs^9IjuiD{w=Jn?}%$1cG$UixZv=)BKVhEzu&!p zJT>X>cejK4I>)oQJ=vKX*P->b1@K>x)z>CVUpMi-wmBJ(w(WL#!w{7lWqR9oKt%RG zWXV(hcnrPP{8m;UuRm=^ZpmfKt3}}NIyj=GILL!VX!kf)Q`uwI;=iQ=?c{AK9-fg> z^xC+D2Kf+5#g|Q)j$Ry>(9}2%N+q(f777pd=7E2__1&KZ)Yh1O_eMwBhgv~-`ULdj z5*FVIJm+O#9U$xg;{#$}V%!jM$i~1j`L9HFzbt_NxIMFf!JF>C+WbzOyYERyoYtKr zGWFjn|FA>91!Jwxz+N(k#6sC<8w5o5*_fqn-CsuG7@;x0LCR-FbvVY2O25nH?7Q5Y zFB>yI39nk#WrzHF@avE0A?7h?8Z_+EB=QJmFAk(~Pb7h31c6j@Iey zIU-V({)jy@XLCEouJ2aM208B|$*Es^|2X7p5YTg6o>V4SE+83mVPg>@x@heTRe3WS z*EUiNsf^cvaOqQ9;uHgGuaXU-pOChimUP|8;W4-%6Suu;!S0HX_3tcyOPA?y*;Ab9 zZ>gG)>2Jwp2b!_qyU%6*=6OW^7ekonR%Gt|xIdwRsP;4eGkZp>%}RCsLI{i0@4U4a zcsF^-z!6PtN^OH2&4TdXL(F&VkXs zdUD;P=UQ^gt@YB$I>=WQau0H^&Cxi`DR%(VtIS-xp-FLVQ?aU$bwk#QZ$}9NX9*f_ z&y@8&_DoL5?B|FO-9dn1A|uxo(>R(?b`F;St-UoW947Wl#3I{IQhstkzuuY9))qtf z$k)Iy0_SGsnp(b{DO=vgSObhH_tDl)c3GF$?jvNsok_+-p!){fOD2v-Q;S)B{#0ATcvMrIpd7?zem&)Tt_AeV zZzNNBtyh&Y-)648x9uJ|>|;9YO3%d3ss$wpntMd-__kll;ZDo3hLW^>b|_1icDk8N zG<9fePW|=YVDant9EM|I(Q#mj0Dhu->=MB+vF6M?i{~GAFHMe#8K>46=jQnBH=8uJXefIe>O(1vpwgqbtV?`b!J!l$+`C%Ut^uw)&3uUmV2E&f6mzJYuEZ4TKW^MA+LNva32-vWB=>?EzrO6#rG z{(qdkdwdkt`9J>5%;v@=K(fh(5KT7WVgrJ}M!=#>f)%B$#bv72TG&mzQ0PU(%SWYT z5^Srb)r_Q_7Tc0QX~}%G<%1jTS}O@ywN-0e5bwI11Qg;W;galRXLEk9=bV|{*-fDR z{Qk;jF6W#%=Q+=LKX+caU_7g%i@d|XfLEp>CX2CpxT*N%{Cs8Q)&H5V>^Av|hl6$; z8(SaoNpQfEzRc<;!NEOg>5mT7z(8x9NMqF&y3ZE>$o3Y8m>?O$W9r6O-aA3F*K&^t zoH8glGzTw-dIX0yZzW;zAR-JjI6w+lFh7!B!A0#jC^x*Y)SxxXIyms){Zh!M@{_-Y z>CWx)6DNXF&og~GIK(zzCeXbcsStIZmqVAVBAT^B2Evxf5bE;DGp2*grIV-;~0`!o>(yZ~Le<~93r6?aFj@~4WpdPZ<*XN5vduj7^2 zZe9uJ^Gf*3pyM75FA{aU?*`dh2%s0T*fVDl$RXqxJ8NJ7u^@i;Zy%F);5_sQ)3n|% zi+cIOU+!?BEHVx}JFkF&Y#yWo{M0_&BQ3m>>Q@f|yM}wIOmJ>Hz(Ze+xtF>Vb<+y8 zw?09fKaJ-5f3kwc40*bLDhBKMX?+g^NIrqzR?h>~2jjIyn!A|aRxd!`?l_Uw0!MWM z%wJ%dcIcC+itn>F^R@0}p#Sj%l_e^>mx(&ADbP6mTqUvrf_W>58rdKQSsYD~b_dR} zP^7J{ptZlcXaI3Qj=w(r$+^nzLROz-sbQ!;CB&6JmgPDdpMA``qvrUcI6gL>cD`g= zGhgz`Z$62tzbC|n^N)Q;60(6)J3Xq-=j*0EkkfixxZijU*SltNu2N(eF641gBC*?{}xBS3q6Xk2o#xzrcZzzY4)RD^+x`j3w#S)myG@IIa9#D=6g_XUuwu@8CzC_fs zI5~vvBTWNG=Uc<)7ZRd&CgpJxfBeJds~AYdL}|2%v_#LJwe0*sn!2Z0)FazDg^u@$ zNl0r?$~^a^oF`vSZinDBlip;L-egK|`I?&$RTQA=E4hZcsa8-D-~To!k=*3>e?Qme zLpD|R!X!iW@nR6NVIxf5c~kgy2%d}nWDcZXe;ie7E3LdcjQ&J`DjXY*x zUyMm-WkZo_|d zWVEll3=jYibrB%&!-{w!cENuAjtb^?h)Lk zr#X9#=%~brdT*lX8&}BA9;7Lxt;h;i z%Ype@JGG})5Y=}|Owd%RgUS9qH>CN~l!C;4998eDy`~K@`HR-u(0P>SwVH)+lEfk=u1!yi9s%N|*eXi%r-j2LUN`u)?r%U$! zkr3C>yh#ebfcYIib=FYBD?qnu&Rmt&M)d-QH}0^tf$JpX8tShIanxDz=GGCSBDSM-Ww(pN-Qz$iO6$wNIJu717M;0Ru4kmH%jQFK zC&=D!e{87XMSz&49q0c{j0A8j6#!2Bu9gh82DfHF0Ke7DTOY#j9Ax=K0wn@;bzdZV z8}cV9YtI_$F)Bl`=W$-K9enThxuSk-8R%hHcJw12`i?CVbvF;v8KF=+wgPmY7wOX3 z_Yh*Y>)G$xAtFU4B)^SfnkP7lX}C*e?+!v-*l$?K&<=h{_O8P9TqNqJNlsh$R$f6| zCp;)dA1tT&An1PTt>YEM(1_(TcsUfj%Cw2IwVCfeLulTZorJi0etLBq%7nL%6ZPYQ zOSAm1Xp8|YJBs+fTPV~zOgr+gM~K?a#=9>;Lrdsd?87mCIKix4ThhoqtKrl99lSNZ7=_@HRDc3IsEnc@Q8#ek;UY;Q8h!JuB zmT^$!Zxn-8{FKAY8D;tcdktz~hXjH8$P6ZI zlV*OT*`OC)$^39}Jd~F?n9k*O!uTBWmrfp}I{Q2p@k(S_avpy^A<18GKbB5pxUbWS zC7hSa8$0qqdiGdUl{u*TdRn`FG1=}tX1nepR$IEt0Ri7i#xHYtkgiC3x4Js{?(Npv zPLjQ{L-r0&FjR}5y@UJi+9cndlm2bCcD`x0Q$11keolyMkb{744cia9IFK$#dzV|D zeD^AAUR<*GSwdV+Do@JZ`;fPsf?$~-1`$&uU-_m0fm>;Q7^mq^>oW72=4-gWfrlzS zt*?fwl6}p#zIQ6yE4X*6<81GIV)l*lY+c?pZO4S7O5~4`OToDTY50M(_o}~6-UzzVU6v^H$d~Xe-34CvD z+I#+0$@d-_pQQVPgt#i*aaLOjU_)6ZNFH3@`yuFiQ4Goe9{)l74sJv9Pj(jj*0a2t zPiD|u|DijMMb+BdMBQJ^a=U-u0g^uh+8OUJ)FMI=^&zw3C!QT4s+a+u0+ZfvEo3>D zl6z`ug4TQ)P-XFi*=gUyeKYwzlKDLmm+XCn?In741MsiZ((&?r>tjTsXEZ>2Ghb9G z8N~AzAuf-Zb8nwPRDU=7PWLd8h6r)xrqBKAWS@(yH7k<68*%Oria~I|6xwJrB`rOb_@AhCMSmkSqx4lH1}v#GH%tW?JktP zzaKKxzo(6-vyhGF<8jF~`+yMF5gzmp(_~w_9yy$zHz+M%e!AQe9wF`i3q`$}hXAfS zp6Ou@s(xc1Pl=#3+?-s~gX2>5KHnVA_`xwkTpyM)nX1en?GL53;r>ptjsG>f|X)uKH_=j#(ER2@GNP;X6%j9$6-y$k2v_Osa40S(IAO zHlv2|%xMDb+nkT|Q=&EcWiQN-LlaILEKf5J?W^qHCkskgDA79oviJURqjN`37|&$N z1P!ItO%=z3^rxPvTHFh5MelQMg-+0O%i?OF81$C=A;@uT|2bHlS{n1#a-peX;AHQ} zuy_qpkiDPUug^8x;bre}`}GCvx}TT5Vf*z7J<@A7dKvZ>vWUHfE`a*O$H z;@b4d%340IcG$1^CM!4bG#`5MTJvP(n|xfA?blwOtgPbWs?UBcI$8NDA6G^D_$KEl zSK;{V&s{V{smAfypIeoqEXDC<+Mau2lClWLm&tfa27uFlN(`%uKJ>+3VDnFCQ-j3Gp@=}R>#r5M$}hl#?_W6sY2f9e^Cs6*}>}QA~yElChFH? z|528U)W2TTz1Y7_s_@*~R4XWcUJTB4#8dN<*?8z!e&l|uzRlzu#lf@u9f@nJaumXy zBY#Jpp!`Kh=I>~z5tNHFQ}cJkA2`q!7C5S_f9PIA1wQ-IOYOA&s-U>e-iH?)MfD?zVzih9i@Vz8D2Pxk}j{?hE6w$kizZG86lwg!LzcQxp4qxvwn zit!w5rxUN=CF-0br>%7JxHir)z76Rz@_@KM#(Z4%K}VtG<3fJ}j2k1Kl0zP_&;4LQ z!f&>4Gm{N|$T2?`{N2exm)m!dvYuo4L&G$8ILj4kx2=CXLR_5-#Nf}7c1FmUIaNCH zXwBTfrFUB~Do$-rR$P_M82|VK!4&&Shb`8g$pM^Z=@aSMw#bY>%oO!sZ4vd?=RmX0 zcw19gaB28$*KxGARC^J{dM>1MTI2AmW`2qmNY*&y93X9?F~2VS?tS>()f~&w47u#N z=f;UTt%t~i)S4^m%d&y`+`1>g8)ZB+H3-}`m{X<{3()lPkfF8+;CUe1P+PB;z2e6O z3NJuYO;e%r$7~aCnD&?@ISIL(#Q-i!%kkp^=}081Mz(Xx5iYLEI`M>W7lVs|)_|aU ztz!WMUn0bX}ss1n9P~A7+d`#1<@ibmzHtgnfHy#ZZLvsH?Z_4N7jHLIT+bJ7H&o^;R6^rkeo3!e{zFCdS`%K&1>Lfn zmft9Q_w}>)%XkQ2dtnX&+qa0i4{1bz_PN=VKhUw&_&{l>q5PonaovoU7(P2>+U`9%I^QTK&FdHDlF^?5mkt7=2mV_%b#ONaA=6L=Px5P2PvcReC-X>US#>|;5T#& z1(l}HkgZnm3wxi^NvaQ>Ew5|3FPx8u0Dj*>vmU_$bImWozvD!GF8<9G_3qmY757f~ zHbzG@?zFc+IrMee%N5F@%g(S`0oFIaV-QysKvO0_)5qbuz0K z2ac5$>t-z8;{c_e&)D!aJR7r7?$5965jd@TJ1BS88mbK7Ve$9*8}Q8RJVy+_2p~Nc zj;c%sWar93GbezhOS0!F>8=B18Ss5QyFq!F#`y^ezYe_K2p~-tL0JoqzB)pr=}xh& zSLNF9Ieh+j55AvCIA$Uxh)WI*`4+s?b*Vy^_@&@XB67)XsC|M*)z&8IG#ULH4q9lF7x(00yos5{Juj zK(c5TY1Fk;)a`!M)CW!Av>O}{DCFhPQQq~+S}5#0B!E=Z#3>-SwplS~4IxfR&q3gZ zLR$`kLaO^L2uD>$`%bOJtUq(Eoa{q2@J2gdxNQ^f+P3ow(A)X^ZLNI%EA>~vz(qVr zhdBr|ULor8W1Ips=7;O!d60O>r?G8^Vno98B>GWQm9G$Wfc$Op6$}&gntY_55bEc@ zsRrIaoc-_!k;);T#=rHGWbQa?&OiXk;S}}EE>;T@*MCLRgF6Taebqcj`2PtGq#AI% zBJgr(tq23K3bCeRTTRo}9W>|0y1K;~>*^Li2pKCK>nax4IgpNozG@S9{$pL;;)~YR zE#3p!EB|5MXK|c=p=%Xh2)c!Fk~Li%T5kofnDzl}$c(`l7I;lJW&42kO1n=^4%1%C`@4EofPToQNoA7^{!|^drIRHujCOK1V3;#5W>Rx8Y ziHgtTx`*p{WhW1PJtKs+(P+NA6PSM!doR1q*v%`xLQyZpeK4NsVrd+L`92#%N#AY* z+X326?PHvRYa84uMizDC!6J64Q^1-?meLzO6cu@EVR^7I^B%)e|Ms+71}lOZ}QkD0b~$1o|x> zMb+*_qTV3z+jjC?Ut3FTlW( z{GB@p4+BT@cJ2^i>NbGFZS@+r1hPAB^4$hOAB{0A(m;eMzCUwIfRjVME0`YS#0a5z zAi9OAn&k`Di({nM3e7m@eC;DV_lAill4Hgpw}4U(a_Aj=Und^l6*Oih!1Hpb2H=%@ z9;5P^X(juQSxLA$EW8FsIZNGJ7J)bAFyz_`Af!oUwNcMveb69RC2Jx#7mTzhGT5 z##5$zwpg>U#o-a6T4O(cPMq|HnNO4X;D0QD_K7KTqx^e9;I)&2pi#dnkVEqgqV@>m zv~D3siwN0TSjf`ewZ)7j@}MPj27gPbJ!ScJ6rgO)jjqSR;)K{ar3-?#JH+CPTf7|2 z%{VCVTK#5d8x|bekdUF(Z|2&fLMEM;(#_Cj%}ood!4x`qJHxNE){Q~b<3h1^Oqiv7LB6{A45t zT>?Sh7SQdnBx;Pf9&s3IHxKQj_Iy$ zPU^09bE)^B$U*P%>->ukLh8LlePL6d)sYSTAhVpT)^G5o#x7g&M}8jm6>b)F_e1ki z@|_$u48)J^qjOXp+I!tFaanaXzQ2sdbp&SLnapugAe>v@lrGQFJg}RS`MSU%>NOX! zdJEl&TBR;+$}*z*9IVdAs%6aQ1q290%yGOrOjMu1>cWV3vRns96X872d1LwEnp=uj zuLZ}(nx=;0+C~VLJ_rMmiE^lBv#>gxDTm;ah8?vlL9a2Y57&A@_uT{f&@>kBpX%TF z!rsS*$vNY#ZW|)5OQNPP^u(l0Ok0lxvP)%T}<+l9JK)-7`>FRq%Cly!Z%%7fvHP}Xg#YnrK)>!a(LIZc|uGYk7- zb0BEH%oX*>GH%IBSFpGpR%^CEdwZU74ta>3hmmE>4um*q`D`-=_a0IIHLcxOMEAty zvkjWhY>6AfE26T;keRkVCs{bMQVPu4<6IKR0uzzeR`(=Q*+ql(WSSr40C#I1jy^t;?GC zqv~)j(*v(cS=(aGKhIEGqQnz6Yw%)wp-Mvqy!Ml7nnQRQIQy>QLBjivxeT`+;0yb{ z#DUbov)GcY2FkQf&C2mn{eD#K!0{16V^Tiip^w%5FVs$7Y^ZRSc*1$2-poT^#~_i8 z^019zbLO8@0dlBrgwXm@qj8vZHvYA(rUdfrHUQ^cjJB<{W3-(?Z2`FUxJHPB5U0h2 zOs!`T=usg{dox$mD?rqHmN7j`_z<^5KJ}x+h!4W~S$|z?2pc;bAiab5=q+xEaR}$O zP%|!1jnAJr&!D`PeG8M#wp1E4w@YLZ(swbvc3-8TmI>gwmxuPn0<<@Rr$1e6s2v=5>UmdRBh5SK+(vky{!+NkL6Af5)BQ0mkw?>C$!gOAt-S=!?&VB2 zqOrP_hAJD({zv6v-bv$SKBep9qV<4q4Z7Zos-1a^ZuY!wP+!Hwo>-O^tI2^Beh=lJ zWc|kbE@rt3I?Q#35h6tnRWI4Z!#1}ArbG^LOa5|B{FAix^7GU1&xfug{+TC-qMsYI zuF*Gn#z(8?%U+6geqN-=Ji|AZ{f+9bh0!@)C}x@{hw$tQKOpY+T?@Leaa@~^+Q(Z$ zzN?si<}@KLawwTE(8?9ac&d<$ORjTJo{IcEO8HJkn=WK%!$PJOTL}8+a}4#(FBz(w z3%Y3Xn?x?aZ!d2fs=KmH-|&^T*g{b!hgc4RVFC2VcY*S;FjYG)6luo<7xhc(p|rwe zS{~%Q%Lq~BIPnkxXv|o{8sNce*76fE>Uo6u)4cU%8=icjND*eqUamk6^?hcj=`lYK4^m9IFB4$j z$4%pv7kyJKOu28*zD3G|U0KY2(!ndg7)-@nG)I+?Y18XwX#C`)&i<*N)I_b=;UOW5 z&I!}|3KSnj4sc5-_IQNlqZ>>2VwZ^<^F;l(yO=H&+q&@)mRCJ;fV1-FhE_j9@u6p} z00Xy76Ng(JAe9O*FnyXhjIt;@pV|6cjqe-8^AQgNy~W}%=U`Ze;ufx9{&nK9{)o1K1d<@uG$W_p@u&d^-smkAB^jY`~?i^>~dCtJI zra$P%LZ)WVuYX2x*z(+DYRAponNb>(1RC>q&d`nt4y~8sabD}Dx$tD~_slax<_k1{ zeB?EOkA(v5xG+`IsjsHf)QvHk?Kb1vkq;q_xam3dkG(gUwvluBJ*USqSh5g~Q|1{) zjLinULx8~Jc_Pg%LeFpW?6%H#mjm;MI<3h3K+k#`C zO2>@jM_TSN$86c27+-&J@BbsjH65s)hOSr5Vo<6l%ib^#UGPGY@^vtMEb`bIh9Rk^ zN!cs2?f&S`rsxXsTk*_F)Gwy|NT6~Oemk|#2tfBIe)qFKxhmQqfMf^-+Izb|IY{Xo zu|_ea|GR&|d_oQ;=)YLI>lcO!0(dM;yGsCxo%8whK7PZ*M`)e{`ivpuYt1~og1GP# zO8-SBjx8Le7px^zkAEH>@uGR&6tFRxdvD+uj7QY-EH}B&lw0g}!4?w-GrOQOA&ca` z6IILV5xcW-rH|=ylB%DD&7y8Sb1B8tpdn3`WkZn0)?_DRYdW%_3p%b)?D=G@7|Pwn zEQXTOgQHma(WeGIhr$A1iSjJXl_WT{q^_5vzOzV!EO$qycI{!7&*u>mqj@e{U5p31BQC8I+@7R=L@V>ZHIYwzk1lLM<6)0R}RP379J=* zD}}5e^w{oZV&s9zgQ5tOTv}zaiU!wF5QCTbD zOW80^435_gs*_9SlbkGj9Xi!(P+5wbEQg8=Bh6PZH4hV)Ee4ql8?gR8 zp5IqY_k8OFbI&`9l~p9B`o@Vt{N~bZ*ci#$S?mU33f=!CrjC^pCM*b*$Xj0znLc40 zwCASxF)`W4A`(l{0polId4>sPy1x0^s>AU_jrr>i$7#O%1H6@=9a8oZvtL3YKf8q~ zm%bgP*s9`iT*b2%=jaVWT#ebXH^M`g+fl5n`8YLy(rF&LI35BYj@ZU8gW}JWy}rz1 zCEKKj))Gb!kFz-m+1F`PX0dX{%+KGQ$>NW&{|6+^0rH&xsR2$Gv-E zj9g6A=gt8e%XpBUvbPxkrFC+0uHPR?T~8ddwWi;**3%XbV2=}^yki0cOG}delQurm z50IhQe?ys&!dDQJK@rOBpqGN951Jm_aV~%Ah~;zqM3GWDWT+xWiDc$+@C_Wz3*5 z5cN$SCkE%}=KgZA{LN$4C+IL^w(U7~3E|tUd{doPjDC7uf*g?k@>W!}f9KgjLxl|6 zH@!Sf=}*75w?ye1WO;jf4uKNc4GOkb95+;10FSRw)DK>0(zr2A*>l`b!!A+x6@ng~ zMsrE&_IZ4J(4h4f?elmTuMLxczZ{gGMw2||HJq0kP#U8Kt(}i^irCUVj;LX%A|W1M zo~YMekQ~R>o^nYTzwV?D28)`?4RGm!ZtQs>%ZzaQ^8QO1I z?pY75F%8ZQ%Q=ub71fLLUj3)mJAJtj#6JCA2-?>k$88YeqWJ`-vwQ+K=d*kQ_G_#1 z<1V}3H-1Y^7Q@8&O^N+DUJm{2xS_TH1R@WJ`}2|JCqR&!0D5}7O|NNJ<|f->Xo26b z)d3RnYmU~e6KL#tHh{C%D+X&k{K}duYgX1c`IWU^2sW;BFQ#@SfIf~8DJ379lg2v- z_%c!d0|$Yfrf-sbj@qL;!K!QF(7retrTL|3&K8hExDNlP_@U`6ekhU`SA8>SO@{Vu z@tEqLVLMxolqg_KQ`+OPgr9onB-wlQ2;)aI*Pxjny(T9qf6)Dgd~LF*H;+uCIUGJe zW~j^$!>QHg$ljCq|4dQu&r7YFuq%hz7Q2s)&XI2AZbW{t41^6886e@_M~qr6K$U+S z;(h*=ojlifwF4x7o~XM`KdVOSXXT`RR+fIW&MOA%Ji^MlE0?dVa|$c#ybu)3^};qd zQzw*iwwrl*a81g=N&T)qHF4q3juY&;6wxdxM_wjFzMpb-A9wCxHQ>1&A(i;9hPNaJm|8I!X*uY@q%VH3K zTUlykZT!R_bdJKa*fTVT1hL}1U)h^(+bqbCLj{`)9;bUd2fBV$o}nP1JRG{3bqCsv+os~@W_ zn?0wsT%Mu8UX}}t2ifZeIV9%F-i_vbG>iu+yj)PKj?x@rl|BwUD3j6i)^mZf=q+{~ zpKTRD!m)1G#Nc=U=ipZ}s1ASE(Wu&)A$!l#TtJ1|i*H70-GKvnu<^+_ky@;HuzA&~ z@nAV1RUD0~h+mbXQ5BzmVuVPXL8Q_W*obsdYE0VrBnQ&qGFAgGEaX>~gB-f`Xq4u? z14s1Io8F450L*7UJVK;tIJV`S!cS&7z43cy9F3~=Ba=2>WAX~$mgU=VE}-{EkKLOI zQ`}{TcXX~Vi?Tjkm3H0SxVKneEfBqQnXRvu5nBJh^3FG->VZty=pG^x&UfQ2Y@Q4D zLJ;S=(46bCK_YE0&!93c4~<^G20@&M3*U;WJ}>B{4)|Xa6L*E#U%PK{Hs(wP$jvVO9p98^EUb(-m)r?iO`vM`(wfuo-e#0NK9549Y?OiM; zD=ZXfySmI6k{oDXiG5^2Rf1N2n3fkh6Qp0i$?PMcH!00joe}c2dL9Oz;6ZxlXmVZL zaa@L%XVcRk47);N(6bN}7y@7J)gB~I7OodaFp>x!$J$}<#{ABvs=1+ji(@$%vC@+b!uXp%W^ErTR*uK8*m zWcex6^RZ!{OvcIA_KdKa3HS42aBUXMM}GM&VEJ8WTy9sK>cv@}`r^um-i*?^b2vv| z&j5)x>nqTh;y2>zQQp-T$p8riF(_t$$NH|tU2&QZusIWyO}jvOmDvosplmYr{e%Cx zD|!K*2|Q4~-Z4U?NFArlVf|6wBXS^x=ZQM4+p$p8ed9n6ZxDmNVhDzpG5qy!TmxPV zK5`_g-pfPqUxc_?03@%CHc*x>%Yy6P0jPRwm{8eU86oPMgt$bIy}AIE9dsY0=j`AV zYp!XoeJg*Km7k;D(YA9O=#Rb`Rm006xL`_L4bK9q>%=qanj=xQjEAa-u)GaqZX41T z5@68m=1@|am!@N zCqxbcyiZ(WU5oIr55k<{hB9R>h^Jt3!w&m9cn|R;>|?lb^K@GODnzknfL(jPg4M*L z*UabsHO6yKOiw;%#WCCEjTT!j6yzKBIOQ6E_S#HQzstmI3jv(IJF9~@f2AU9r2d~- zJB#m~!E88Z8NE`UVWR|^hs^wRdyq%-Fc3wYT`b;zG83fJJnS3fVc(k$2o%O*YAs); zbPQiW>v~sDk-gP1Du?dt5u94hz6+Jk0<-={ET)#e1OsgxNZD!cwN8<}3+?YME>)_{ z8jdf-Vs!oLW-y&`Vy)9`!5ujuedkD29T-k+J2F}Jme|{V`@%%qPsU>Ey)kkr-2=7a z5}yEze7A{9I(YDGx(!Twc)r%R&Y*Po?l5bo2FlpD^XQqs526<+LM*2C(i#;`4WGg9 zuGv?rU_aYqFJ#auHAU)pWv~MDp$c9h^%-rXKC_L~XSET5yN{6Uw(KKJUqjnjwNx3J1^WEc zNT(ddgE)4a$10tDcRmO0N!x`}t0E*}&q28xn zQ8hIm?>o#+Vdn5Xmkz@ZrVeBAEamf4)JL+t+R|%0G*3BkipF*&bra*h+4dclD|@tV z;xPflV%GtT=l2P)|K3YR=_yQ^qY2Aj3^mS@FqpjxYhFYJ=;?e526t)#VF`Ob7 zHO^;p(QmtrG3)fbG@tqMo#kO)_X645I(&fw^W@O$-7J^5O#S+t8b41C`3@sygf`ji ztBi+s{EcUiyr1T=ZO6a9{h-TFi+TtCpGot22C!ZJQrY{&$7Zc5fOY}E`P(Oksr?qm z+hNsC8lwi_*QZmTE^6m}+>LVpx^IL88lD#QyJs3|he4{oI8RRfK^o&DRBoHkYPII` z5NPJ19p|kq1KQu!ZTtTSDE=bb{vVE|)YbUa@Ys4%K@C%t6(m zw6?3KCfoj0k0ojloG@c`Zg^r?g*c%xhkyKk!|Gk*K)?G=E@;{CCfV!*AC0NA62{1B z@2LD5e!BxaJv2v&Ghq{aiZFjo%RYhQxoL#ePek4c|5KXhtA!;hWoumczkv(KvY7i#$|t$lfOW%d=cHR8M1`nbmIl znfY9bul*oB=U5G+{P{!;JHUhc#@aLG6J;;bbg@a(h}k*>kxuT>W25|_vxj4hP+hpCK;d$EIqz}njlwP3Tj{nbmDPesaE zJ8!g(pfMDsc}sAOZrdVmckvMT2#Wiz9w8E9h8Oa_IUI=->Br+ly>~UInDGUb5n(FD zcEkIJDSf_X5b5|0B9*%`1<*(3xuW>nvMWAwUL17Rq~k%VHxu>93KM6pfZ(q#NyZT* zzH3FAKN%0w*FsVC^au$cEw+r1z)%IJG;`37Yu_ulv|}s8V2@C!S#)5p)$95o|C!=jo%ClAG{l5#Z5=6V>Ej_Vc$=Z-Zx*-LUBdVi%5e|otsd^= zK-z=zEEKUg0KrM+-iT?h#&5QKI{vwTnAZKW^1Y7j^D!pg?6S|Z9dD9F5WFIFe!IrP zXfhAdnKx4Bcd!Q(RyVg$+fl~+b#bn7j(Zo0!EP!Gu(`J8c|RfQ$0_-0U$(IOJ_t{x z*u4{fBYwZAdWkzcRVkBs#oZxL++H?WrntQsBz5AGo7vE-dFVo1dSgGU zKhTnq#Op&_IVHTCSB7ST9<4*XZesQN>^4$?cs-}BuGw;bocYLNNjpF;YxY-f|p zm6`p9iueO@|8-}mKeESPS-m7Yi{?3AokCKDl{co{;mxc9Df5B|{ z_OX2a1@nut&+~~dn15zRnhbFBprMwHB?Igi^|CVt#lMLEksc8j`)gTUqM3t9`2gpl z>Q*MxTe3p=yiu|Ot2ga+Q{1!jBSS@c|JcoF{b9FFR@e`E{T5eSR^PDdJ1FXVp3+s{ zi=w{!DLqAgsJ(>A4?q8CZ294txy;Y%EDucw=gZz!uUmlya_GQEru@K}^1}i-w5rQ4 zKe*a_9JI>^nS6l#y>cG>|9sytmG2P$%P-RU?n&9>Sy6Anww@Jr-?O00&$C(rD0{TT zNdU)GTP1sc(aUfg#7TQEA+E)4>cd0xO8w+QoGZ{fVkFS;yr}ysm>+(cWmE01fIVLCEK;?wj%Fiz+%rfVm$_dYl z`j?STpFh8x@VF@_{Kk?K%yW9th4yoL6rS!%;%SazFj|ir@pJ_+zj_N_+VHd%VR+iO zcnlmg27ccEdQ?T+d_Bd@Q~MqoArh5~0Rp8^Ky7S4F21o1vGY&ICGyBt(pYnly|+(@ zjl$2z`7!WwN}kv;@pIRIgP&g<>$}Fl&zoO2@!j)j__?xrG=8q+Qt+c(K6nnga1j!doE4?X7_Ow%st3!{)<@-#3bG1_cd_9WG=x~ ziET2v$*+uOl2&;gcf>+aP-{9GduHhR``ZJguAp%&yDDTaOqWCY2aG-kO(a^K%G|7b843fHZguFY3YyP%^Sud?oUtv1%dqbq$|K4*lCG zJv5^|hnCcJ@LJT&|31|r>c5>s>*ab@bI=ailqc!u^UW?LFz^WnQqLK4|Gr(J)ObMg zJI!;rs6v@=HkQbdj`O(lEIWt$2ysoHE$R<)(0(}W{fO;-GZ4y4#?QT4Eit-@K* z{`2(qCnno(Ka<2bpO`fYDh|ff77nVmq`eohz4xaxsq~HV(auMhjj^Ey5^}<>V}|Ol z6@$yNQ8oo>*#y`q3n1N|)^_XUWZO+=M(>?+bML&>8KW_#9RQwg(?*VR-{mf*$ECLB zj}3KuCZoHj5wjDL^6W|%G@mu)&R-p8KH?3vEdKI9FN>pjz1L9XpMjogqkL&pOb%OP z&_0~aauXlnp}(2(6Q@>_!}!Uu_ZdI&@zDMy`*%m#In|IOdsm+seNG)a6FVo?#xY)5 z#Lmg+|B+WbHJi~O`4>0PY37P?tNDi zmM`xandQ%W_b^G72Md@ynEn3P^58;Te+PKpvLKCNyOV7cDqt8mF)t5!tt1~t(gE$Y`5Dbdy66_ZW|#qR`R9u$dJ>H(0KW( z!T+N6GB=yW*sbOufb#(y1gv@wcG|_Zf6!pK#)_$=a>)cHmmHGqa!GpMd{BkYRW#DxvF?|^#F|}6!8guC9tEp^f(dCRXmQQ6B%8mwWy9asV zL)C3KfAzAFQU^B`2PfreEB8=qB~g7DjETiW8zW&I4r%^$iv{t(Au^xAO|+xc&btFQ@up{Ga2X$^Gh7q z&A!i`AGOcIf>2qzUJR~v!p1TIq_st`QFef|b^`N-S_UxS%NFl%1sLVSd)=v+>Yi-d ze>X2ypk=1=z$v!>I8(=+Ywo`Rlr6@MP+!N^IFYJP#ni|c?{6^QuP$KcfbVJM&kF{T zA^`12VkF?ZjOp>0`Dol|l>=!lPt?EcGjK0gRi28eT;AxmCA00$0@?e{dH7xpKs)a+ zYxwb^etU^&FW{j)-`YDjFIH-<2Bl%HdDgVdRF<0e(*18e+0AL^Cd>Ru} ziF{!K50XBR*3Z0TKjrp*Z1#kwPQ}zL0B4T?l~$e!QGutDuG|Kvb=FRfqyCCPpr_I^!U4AMQWM^%ZT-hCP9zB|Pw_uLObfYJrNJ7EdZ z&A~Bnlcj4z9%s$>FDJ6Rwa8b-l`#G88CL5o#pd!$bFT1vE`2qs?&M)$NC54HV)6dZ zXgp+LrCl#qO^6B^;2|%!ki(mpz8$=-myZQHtiGJ-xcm1H{kZ z(B4XGVH9ZYSHG_JO%L}0RcP7_m zhPh_k6xmzza;0(=fD_xoHr=b1D!WdY=h<#fiBzz;4$lIbU*->A(Aa;^T`>{}*9l5w zIj5k^$b3tk+Hb$0arRXy^6n3-Q*Be_AT9e>ROPe9;94^lZ|!8*=pP|cQMRZr9wC7v z+0fM7Sfw=Aj8{}%4BpFur-9=5BCWXwl&!BsRgsXYq2&;CP~6HXb50tnXb?|$IrG8w zWrFlI9;8wSY!n5MN+-ZZ$N;IG%}tjzH=VzubJK-$^I^X!J2=^%*fx~x=>RtGGHmo`g0wts?5%%Dj{SSqy*YCfTBj^e)Hkg$kiT#Eg##o{ z`giY1zWbg2n2KY;cWzr_AU3bWXL|%^WzBPQlm?U6p6rjQS0TRQql-$xx#3?NNEfEH z8~J0h-4*7&x~Iip?+P(k^YX=XZK)m-v0m9y<7HzIFI}qq{S$LfZsnCo zow+CHF?;xd&ka@XC7v@Jv{Twg?8So=`y%Zdwd7c)n`;|!%3l12a9x%X*=p|Pg={ak zea>P!ClcbKaY-x0pl?3}u@B#R2yz^>M`nq7CqO&)i8!x=gD&tCD%2-^o~XOcXBs$Y zuUo+CT3Y!&e-I~X4uG?JA(JWp5+~FaIWR(8-DbVO44bX((-EdqJ~_f-RqW>`**bod z{yP6=QP1aS{R}jYxf7-YrOOxZ;ZH=o?_R7Ej!$3U0bQ-kI;(9!1nXkb@+x#D)Iy`nC z`{a+Y_>lg1T$M*i6^`?wk+>Q)ec|Vg(0B~`d;SQGORo$IMU@v3Gag4Mteinu%tnBN z_HU$()xS77*8j2YJvf)*l|NIg0PQtt?{G_!?`*K{70pvlTR7Fk1UG%aaO%SxNb}R% zxGdSmP1e05^Gv^;!UX=f#@0qz`aIj(xW>BIF;97e5La!csNcOG687W)gQ)Ts#Dmu@ zozRLnQNy1T4`Kwmw@wp@*2?&R&Rr$)re)tT)Mg&Oiq~)afY!*$vubJ{;9(=)YuP2; z{|gSJ=;yZa`8Zmm&l;cmizJ`Fkr3D2PeV{XN6fa(KA*5_|9mF1Uo*RQLBg&*hcNvr zt}S9oYRA44mLO*9;Gw;~5b+!6KHNuzqP~5qq1G3Io($L*562R|RJCy~A| zb;#$+>tX7WXb!+a*?aN(>}(Ke{nJA2|K&lm&kJpI&HgeZZu?vJ2;< zdDl#3{#1si4;L9K;_o+#SnUs-?}HD>-j9wl{l=aVqWadb>$^nR`_55AtzX0VQGO(@ zcH8uu%QrLqCRZefO5U*9P&}4y-mYsFvXOoc?RAaVZ9D(D&0Ejcrh~P~{~z02b-p%v*5+sN zvD!@Cb8s`Q4I4<;hvELAcz@SSrT4u!^>3tm>W9dMnzM%3@wB5p5w zdDCKfffyW@F`||VutDZPnw{2f^|zA!N}ri>Vu9>MxedSd+ut_SQpn%n<3TD(d$-f} z?pHpGsrdXizHO*I0#x=2`Bc8>bjseEt1qGYk;9*{__u~NqCUujz6=Wb!U9Mi@l*R= zrux)^zK3{_%Ak zTzY`LvoF!!8rgf#d40S7oU$L~l(-O^9_Ud<^Q+C+mTG{0_u^T~@?%U#BfB7Qb}Oeu z>Ud^DpDc&o_`p!ZJXGzlkLf{PiCjp(aUXu;p-)GjRp0!K(QbnkZ}Dgv?UsYo|Bt9j zaUo(oj_D-COpxl+`tnyK``T;Xt6MJyYc5)-;Qp+o@))zPe{Ui*Q+@FykdE-M?XtOP*L8#Iqkj9GTHmnPh%>|fOL#U z<|_?u#-niGx;~4k{e-yg+Rtx@uTN$m*W-0(fb)ihSJNZUOer|W%T+8T70GuuN^TDyK*yVW=^Pm94` z!HIleUjx$ox&?G^zVT^H)ezUxwJOr~V?PG*`0r=`KRXm$@pzk!2(_p4u48ha@Z(^?!5;IhTwGNefXq-B#~W9JDXwPr(?Tdq>v;&__lNc?p3 zVOZz?D{$bsb-ft8(gDf=fDI7`NabDS+o~O+-syn$SNm-9wMtN0A4<;G*}l>AhqUDY zaQfGa!H16-YWNuOcxVi1q1N!TdCHBwEaw%D8?U*`mMW`zShn zn7Obnq`71qT8Qdt1Wi53^4R%9pfsOk`VlAoe~MF@PO^MilWFceHW!@$l7GJ#yyaNZ zPMbrB3+IQ66RB>$7_85R`FLj3J7E65IFRZm!+aV4p8)ewhHuHNZew$?KxtmD({?`l zkVuFNTJk_YigM`)k?=baW74%LSxDD*!%0K!W;(ci?*7?I%=%q2M~RN|;SY`SA!FFb zF(z-MzONQ8n8kQxP6e}%;NI()1OZ%+Wlq@G;s9w`5o|2W0tx5EKM|x`>A7D}>07}3 zTe}5kCCW5=;_-xEbAk`1)u!`J0_o2$MAaHQo%~i%8fuetvY~G@Hi-8neMu0rJsu~j zOo+$7M%0f91vF20x4`0`1&~ASai;(H{s@u66)aCC&E>O(*`sk^-1v`ZBG=gwLR{ba zmZ27H7Ps#_Sk_m@gETd5jMcX$$B5(a6`UIGSA52f0YZH-nlA#!vN29nahQ1O#xaak zy9Up~g34P!_TKSM^2{AMnc7$DZL;?{LR>!jo=dCE6ZN{wME#aEqJHasG5FIV_U;pB zi1bDJySK~UCkb(#NW1P|mmGhd`EB%^eqo{VCv&`CL0SFG7~{n~ZyRqYt?kHnS*$A3 zcDMrc-J@vqALsP7mDA!H(|v7g%agvg4d=*-fcviK1=H8oEBd*fPu_;y@%ZWg!WJ_82?p1aXdr*0Ov zf2o|sjTDtbU?*SP_gw*``|NZ4vY@!HOs?N9^B$wYVy#B@DE>lrE-&ay!y;)oS}XdT4V@LMQvdZ58R8$%aBHpm$i&%yv*%1dD&`CVZ1EaUu2l|H75roS6W}yUzNSb%)J@N1m(ML z$5rGR-{nD?koK(q>g2epPSV_z`gh)roAQH`@(w@l!QWO<-f`$;OjXRiSZmN6@l``7 z(!TYYWSeCtQ?cj{9M>A;cZD6K1!?4*~u5!>T@zYe(@nzQ|zzYh{||mk@g3W zy=CjF7Pn-=6yyhZ{mXANjE3XOA0{df;5>7K7~ILj#t9QZdNpmV)vIOi4!eyg10>&m z=FhpVsbNmw$c;bJIEq9c`FN=*4f?JTqEyTv;9e%kiejZA2 z;RNK}7>aaf5wqW32JdKW9vd^dt%zmvve=j`jK}K2*?$I>W7_S#`hjQD#h)=Yw zh4)r^{hO~Mf#cYpdIO&Y_+BX|aXN5Qye(SIUf>t(rTGOUcb39oZ7tUuRPns=*jkJZlut&OJpCp-I;HEzc;LA0IQW8ZjO6n!*W%2#1O z@Ag=((h zfblylVmYqAf%zpI(U7=bjDb}(3QP^sw~vT*3W2~U+>*vCP_zSnCJ0(YXCXiYq8s%k zsV}Q;TWZl7kSvhCJKUF5yO&z9j%SbA`k!KGCTv5<|P6=11SKi=o{s#n4U{eSpT_Y92#7bwcwPT8F!Z4QLH)9^Rh|@D}lP4tQC# zsh{}f;QP$0^*Eju+c>+h>JufFX1>vfyNGuOMJ1wd^x-hO+zRNd){8Ae>*fLp8?uM@ z=bn{dJl|Yvz6G)uTlQ&@NsDd!Zh$d%zyV{2cEH%d7(9nWn}16_&$U| z{Y(&)i@n4c>v};@o@gWDwCE)~oot0@+ed4NJxue6)~fETdP#{Gr5eRph;Nqb3nF?ZY($_cH>k{4~dV(gFone90x!~V!a%ImfA zW%Q;93UaT5pYaU|_cZM#`N3%tm^X_|I0jmbrBfKw8U<#m8_idH6PzTA!_XP2qC+F* zm(Lpn=H^f__VPFh{GFHT_b<1<&kcGpE*L1tE4YQ_-3BE8;)eleXp8s24M-N=zSaB= ze(7zqEhmGW48-xjSL?OGk{|b%e~a<8XJz;3iRsye*RRTP@EPg=N>0}UO6cveqAWE0lYej3ZE^k7zv)_?JN zDIS1;JZ})c!+C&Ita{b?ru;u)_Od5w{lpx!#uE3^yjMu0mPS0Wb^^YGJL@6J<;Tuj z1MUlgvJbH8hv+;_*!Gl`_I}6w2Z(+mSJX$+8U>8Af_OGq;y}yt! zmA9?>AjWBp6>(b8ncSLFE$wC4DsY4Sz7Np>xv3yCW& z5?^}Yd*T-D5+?*fTh&6}vs|DASTD{Rt1wVT=hRY^4#=R&7V*kG>3k$Nf@F}ANCKk? zp_^g$YCLG(ifbH4uUKRiBx{H}Oxc}8OWMgkLO)rrRR;_hFwXjwVr831eB06h4ejb5pvNPWm_25WjCl~1GtUnEX{H*#;zkxr8QzM036>E zK=Vk?vA)0B@qKs7bgV|q2Z_d}0{glU+??wct%etU2NJ#Ld_kacto9P~4YStJ4WA1( zpnWjDFqQ+^0PfYBlKmx6+za>JG~;|PPY@4L1ddnRcLQVpg|}S{TmW* zYU>7@kJ@b>hNa1Ni55=O!c*P(SkI130v2gDcu^tonmb6IMZpC#xQKPKxa#As5NKk4fMc zdO`lne1ohxT;e@hb*FMEPD_g6LpthCLC}i+BfA~#kj?Oq?D6oL^3kVC_D3%|KTBHs zdIc~(z^cEMVzhXQ($!Nk-C9@JY({Iui{=YGAa6#YS*!5^j3+bxhO{3S#&Vc1#{lNb z#0XaX$&KcFavO9`@um6C_nFZ-Ct`?QSyV1AQqu8c1GqUi%-S^P=Jx(fL{~hWAEba3 zq^}0~L5hX~=1W&7$qO68XOT2d%OFo9<;zM6p!wkaW^J%DM09m%EA4g3Ugt&gMc7}r z6SsVy8Q=K?JG@Ioi~f}8T^!dn*NyvVpIJ*=ga{vpcMZ{^{$!BWI$Gbo51FxFBsvSa z9WrZw!s}fe2g!F*Cp%=;hCdNrg=Nr{aJOMASmedwSqdhKOa=JMG_vj@*)bGtM22+dV>X&y$^V67tR1XRL|}&>1Ly z-DgE+Em>pMCZ@;beE*jj`+hpg{x>J{*w^bom59soCJ79&Oz9n43n>Nym^2luhDqRs z<}wI~*>MCgjn!r?E5&P6r8dVRFZ2ec%OR6iS!33s^;S=j9N9+9pPcOq8}do0RTToa zbR%%oA(J-7c>o6_)WZDkoW2k63j%1~2c0KE=zPr`A>!v6vvwN^wRkMDfFsnbIt$13 z4&W+K-};LAfoNdWGj5o*1F#PT9TT(J0Dgc;)HAZ zLjIQkd6KWZS`z~KPt0N*R23$Hx$5c5(#2*A~sO%di`p!iG|Ll-S z${p2C_xO-WYlx!xJQ6bEhp_5AlE^^wiuR-SXC+&L9P*Ov$EX(R*8aM*A*|X1@k~6O zPbgq4n%iK%xFu_zTXRnb;(Gol$1y$;S+nLxqcKZ+CNP`jz$M1h`B|hQW819x(FrFB z%nPvqDINTVEJ=JSFd)O2=rO877#rIGQcgY*81x)c2xAjEK*}iqCe9>;X9BVLqMC(k#_?uQ{(c1i36}rTx=XUt{ zoidAdjSX`@?8O{+B`xIO0elCsyive%ohBi#t^F8=6I_wEjnDelym&@AQ)7N1zEt53 zyxGC_g4(KYCup-ods4GpTjDtsp9jk>2{=D3-XqpeRjFm_!mvwgFqF+S!9cXCM6vA_mnTgZ3mhh?wsSTvNZozSf^W)Lnvt`~$uD7RS(A=?tzywsAwFT97 zoz)oML98Nd=G*EW@z?kt`|Fh4z^zRc7rs4s>M) z+vqwh{f2F{?y+2=MBlg?(P#B#vQFa;%!30aZL~OlN<+1H?*Hz9Nn1#mB9~R0F|VTa zn5bgaJFCswFtq*woe31W!vM8NKE=;$&ms90Rb$px%7MF1`WYk9ICa_@u$6>5y>e?n zEWoU6lfcXe$SbTeW1rP6Rc5U|gU$zcg;$U#okGZg!Fk)ne2`(s8ib~tc5m7DKa1cD zKDPd+S2ySHZzMl`&;XZGVw0KXgEpDD;JJ`TlMp`8v0h(Wz3*3x@)`9NzcVNn_p_l| zTsxmO2wJqSEewJDpQJdXBDB9v4deDMiX5!kn{`Fv?xhL@1*53wF zoc;IK-1LQHERqvqUV}sYOZQzCfEjVXr0oN&`nhd9!fd)}Nt692-4%An+vRbwVdcq0 zJ6VuuCp!};XoW!Ft#;gp2D8?11hC$2xo*O7C1!(J`v;gJ@!bGG?y^HXE`#2AdjhXD z1d3P*RpR+Yy;TsjY1WuT2fIJ&L%;zOz887k?0js)kanb9v|HJ7N@Mzai1cp>l+H@P zdg&?GF1f8Bx91_g$$x!wm855NrZ~b=(qVTK+@UH5c~7wFG1X$caHk2ph?#YW$8^#F z3W8+ICZM@#5ORMsn6+r{B1us{SUrKqde@F^#0@tJoe#RWf1#o9M5YDNWaGzhtUtaC|;bLlP3}(mb9;^GLnXB^scW3jNoJ>#Xn~ zkIn>ncMQ$@s0w7&Cj>$1)-;EH;v8y#yE9&-Qz6aalJUGYi1L|jXkiZjYW(*(jFjdu z_a$>k0-YZM5QF~4FLN0eB7+!GMlTL=ff&-AjtOzc&-o#q;$QrZ0{^x+#1CS~c63Zg zJBT4&==_ji@h^U-1H_ODdT~f+h#|YtF(KV>nf#ER;$QquI4-|9BpPC%KOGa?A7U^~ zs9ligklE4ZB7Vj+p>{nbIuv%a`APJ)liCfI=;&ZaTW5)0L{on{2GfM-2)CmxTB5f< z#E>KDm=GFb$PV=4kUf#y&#;y*NDj2wA%cAm77Qbssw#+RL-C+GZvph7* z`dL#Ry4(7BQn}QoDcLfnTx!#lY#CNAwP}hEmf8fOuE-*`DXj1)wZ`)sW&>~7J}Sm= z1oEwXWnI_SJYnW}PB}GE!0UrtbE+l+=DDi#1hz*TM$>z*17W=F2TV2rC1~$`N;&Bs zQ*xckFPw`UZP6CCf^hv2irXXQ5B^*U49M9s{XpQqa)sTMeFySDiZQeRumLnZxd33* z3W6>3cVWv6M{tZkA51ASihLp5P#(umLOSR`npbrLP6cF!Ar^Q;EX}LHJHs#qctanW z_XeU^KZWM!$)R)}2^soWnxE%(InxJxGP2w*XXc;`kl0F%EkCvB%%jHac z0`U4HbiPIb;ouBh5O^EY1Av)F`V|MKdVj0$2Yl85mvQp89_)S1g` z4_^EIAw1m+O7%Dw0;{f?1N;a3O&F`FY7WiomCl^Odtl6#nIX}EGsC0xfzBL({suX7 zKIm^hnh*AeJdnX?eX=tbNO@+EYcf4F{%EyH!o2lGvJZiwJM zlj zA46?4WkqsR?dvS@bygq#V}w_<(ssK zU!%c4Bb#8$`~-?a{Os52a;Bd%aKi;b8AN>=VukSd;9+Rbl&r$ZO^KBA@BYxNkbMn9Uy`H<219(`{ZP4g@Oj#;4yX!<>b00ylq00QS|-6q|gqrF7v2mB4B%a5jc z)K*n_9M4K^87R;lm$PbgRt^DdKjGp*K0HJL(XkX569s|E^YG6wP%<4FKcpY`5(K5S z-q!>{iPs6fYmw=;<(stnHsTs-ht@+YXAZ9uXK9^K&RirK-y?KB>kQ#&O`~?Io(Rm- zBNX;o3IzXRt1e!j?8X^L|BP4&Fn$KW&{QDqdnhk3=sVO;REM5~j06gd$tHnGrO3L@ zCV{EKHkSb1U^G9mG>^)LP(-mI3eBHC_T%dZWJVPUOm!5^$5H+nsX!P9J`))9P82Ff z1vH%t>QR0DXucn?W$j!pXKrzZ(ydgWF-MPd3Guz9&cIEk{4>z|ydWq~H3&=)1R4=f znUmc(z1EEr$Ux(J0E|F_vHFp~pyzY|#t;cyDn%FvJ`xxMN%Mx$1aDB&ro?ezLiB`0 zK`H8c4v6#;Kw^52)Qa??-}(ZXkp#d5L4c8xzDMIK!+i;C>I>=v>I>=z>ceMOUfu`& z44UswDT;5k8Jd$w!s)66nper7R6_=zewysg0T64aks+rI2{aFu)J;`UG@nQkr_np^ z?Z9gX5Nk&PRcshX^E=S*<7j?=JMc14M6naR8a6@(oDA5qyHr5fZK`h=n$I9`Hs&}3 zb7$6!X#F^vpF_w_-;x1Gg6uQ^aXKFGIioBdWTz7VjKMM}1!#4;>i4Zz0NUu%3DONf zcKRm1y9^0KbOCe=I}ZL{UGQ&CZpXnj3_$KyK*)?c0T^=j)Mx+~w|H=KqXEL$nGw+| zWx(Ow$&}0(XBHSVW){q+J~{yZ4785*R69JTRYPgXXQG{shSb)7!MS`Go1y)^v*6#=!@7dqB zlJ?duAxOj>chd*k&ka~8|oKO->cJ?q_Qqg?#HJNmv4 z%^Q-Pu^w!azW<gph#Foq+|;Mv&j`U%*!0YKf$?F zL6N|^rLfMxB&>A9^(Dw;7^?@rH)=3HpJ2%?-Rfz__a;Zpm*D~#q=bs zb4x)w8!n?Bgv+?0GM(Gvn2>~S()%6Srlgsr_dJH;_YBx~#Ybl;uxJbA5YZC;8GirT z5d8iVK~Uo7%0YPVueCm(8;F0uXMO%iq~o^r`9tx!#`@e>tWR%!{z|0hs`Yub_tLw@ev_UdD1)VM4xMtQ8a#p>KgxV|;YU9_)IQWI)=3TSePQAn8$H=%i zDQ-b_UG#57^O)d5r=a~N`kGm5XrYdzYho-}Q$0Op96GB%kbDserQGfIe^I|90TjV@ zV{QKz=MVwu{u+-Bp?fR{TEKU6-nzrUmZ7o8c9Ag8v)XYo07WzZiDo{aj@b6Lczj=A z%bo`Uf1UI(8l?Ge3GV`()1PC0Qt0Nz14oUt;QZivlFmo#rBV*uLqSj`5o{TvOBLLn zyYArAWG`n@*SV$Woq#z*0F%1XEd}Jjq^@xj<4}P}VbNdKEu~Q2oF?mfP3_zk<8vWi zNeyl*zTcrOzN^7&qh4IAasWkYx3(#U2I>3B&1J&#L!z&X<9g|MNW=oOzE^+9#=rkq z*WY2WuKU*KDzVKw*5_y9?>CyBhw$O3?WX5={CiVk((*VS z9@uOgcf4dAD-Jdv$DJ*WV^uuQ*pH*{Q2g99j*|!D=caM&J-GQeel!sO-c;WxhjE-R z#BLm4lw%7IS+rRIFZeKHxt2Q!%eCzy=9E{~K~d&e<=T9^{?xss{&)Ya{_vsA>R;nf z|J(mX{X_n({>}rN)j!vv{z3mm{jdF7{r8&JKgpr~ZVvTVDIwPpKSD3zEK7bPVf<`a z4o{If^E{`V_lynNLK4Y6e_ggwjMYbg38~P$|trJ2rp$L2IEPEOo70N+BugGpXrrSU*W!E$UaPB#}Z`1ZIIN)aH2%a9WCgWR@*A3ucJsW(r@r{y7*kt^eoa}VtuX}f}hVw_i1PkOaxXv z=%7WL#S0OeahzBHrXvnm^?-vGZ7?rHtQQ1jkY8I7qp@9E5od9oTMAJpFirE>Q^Yq} zL5cbOe?1_UO|{}Tqj&VcJ-2@@Brxt*)AJYt?{Q7fbAdD3JtIBP>MtqzN~<@ccAg0l z(&-W5Rcgramq4qC8ZH@?5U z+kkU|;CBXzI$5%$lcgLGbF&%nor$+@u-#nVz+>Bl)9d9c2sn1*n%&+b#Q}sN{Ys>r z)LGZ>m!(#$HgDa!QXE$(Lk9{88H%BeXZPIt>dBRbP zk_N~nWWb}o%UGg)OPX7y%JG z|CVIS$yYg*T#_pl9k{Z;%~~tY4$+!bPrLeZY`-*&~~ZW;+*?_98G z3jrd&klH|cDr)DJASj#4Xu`No)-rNp+!(1$x>P3HSuAr!5R{47ufkiWqC>auPi~W2v1wonJII!IBl10l3LPT$=Y>`xUtsp3^`~$R{v*#zETQz@%HqD>e zw#}b|mH0WBw8LAo`joPCJ`fPD89?(%zS6p>=)kQxV$r4!06sMxn)y@XyN)9-=IMAk zh05{iM)S{;WjQdH&gW-4HTiDd@RsNB6s5~*1L0c%>M)LjXIyzaVEy5h>OW4 zA*%L@jlbiU0cQxd@worr(%$PXp09rSTjcQ<@_fu5oFg0&^L!98m&hMoE@U3x?DOq5 zQeM0t$e#^STQd_V%6JEWsc>j7Ekru6fvgVwe#YThz>jMm%iIL^|r=T$8rG5AfA}XkO!TArsd5dOnF;JlCYvlK~mNwL#HHr`1fb<{nV$WHQl?#6oPP9w1_yBb^9qEaG;Yq`M21fp+M4@6%S%>yVh z^ijZLo&ZI$z7Oz7cWG(QRcR=~Khnvdvw4GG~-F5A%# z1ee&$Hm9##X};cfU-=ij+P!fxg>sijnuJJu8Y3y#TtNC6Pf@^Jc5JJUtu4}ye{M*8 zi}v>GQVz0eq#J^dF{?pfPB_$4)Z121?PW>7Z_TR9U*J8(3%r->P?w<(t44bo;<*bX z@aSy%ac`OzNFQS`0n9{zJdN2o@<)eq*%7Szy42o+c#v|o`(QtQ$2PSNW#b}Q^>!Rv z8y7Ua2JTFT>(=Wpx6DI?HU58YckbO%F_(2B+A~;9`Py$+dU_vI1RXSD7PT@>rw?oemk5HX)F&JRbx29;ko zuCG*QuvF*5bTLLx*{og>XK|-g@8=Hns)n*^#A|U@pXeV5u0yGmhjSa9KUV5vszbS= zp&~X&q7{GPWIxW=TCO9_PrM+OOK}{VVc1tvnMO*naxO8POQ}tV&O&t}y>$r9-?(Ve zY6Kxd<4E%xta|-RaB4MDtP%EiRf_(uo82MTejbTZi&jrTu3-~!d1V;qA!4X~8$fYs zBQUS*M!YiDj#musteTQ|CD9t!r*w#2cLnDAJtnQb6P=IF&`1UwoVNx91N71CC1RR* zw{sYGtpvwWV_G(riDTBmftI3?Vs6P7>kGj3Wn0Jc>sPtcCDI%mCb&r^4XX4koA}TeNGDjm@a5ey=k89DDGKLTj)cxxWdk2TwxH9#xwv1$>9VV>d^l7 zvpsDcWL)A{8*LRAZTyzqnpMxZ)H0?D;scEB0_}SvKG38CXZ2ek0PV{}v%Ok{u^sF& zl@z*5yG`1yq&LQ6(2zcOFJI9pF!pi1=Xaa14MZ;p%6LIwSkfmWl?3Cnf6)=+2-eHG z?>wU@or#j^f_eh~oO03yWkEjdj*9^x+~NpU-BBiY1CWQIK6thf@t>a&kc(sMr2HyX zlwT9}`;X%MN4zZOBpR12!ZQ+;2NxI{YrN3bF8PFb*o@lF}EPF z_l&(n%qpNGr|pf4*#Yf(PuokxpwBAH!183v!18#@!15gcy{E=Qe&TvrPSR_@qj#oH z0PNo$VHPmWj8D*o0$)`!CD*Z}C(beluwkkv>R@$nKBox_7%~d zDFZ5Fb!|fQ%G!kJRWc||1t;Sg0+USsrkM_2^6zFbKGK`T>L&WdUg#LayGUjl+PXxVC=%lXOfW0g)P#;I5ORKVwk{I>$7}MDfT%3za-rGxsEM?!`**ISiYVA7<1{Eg(OC(W;PD4W$N zL?AsR6`<~@8(mMxfysWVjQoRuycGa>21=$|AqZNu&&5G-)X^tGUbUMIpTtV@1H>z2 za3mT_nuI9!aZn_peJV+CH@&QJLcUF9P}`bEg2)?l1HC+Pz7d&jrgX2eP7stgJzgy5 z1Zmsq0np&wmyn=b_uplTA9~4S=NuRuAZ`L?she&v8jGu`8hIC0)jUN|%PCQ!_ zy5PGK9OJGbfLVS)TG#!%bA+2D6J~bfe!5`Or`iB0wt3KeIzSZd38g_jp)Q96=EDnS zZJNEj?cbe4Wxtln7D@O?T`L`QF^706S^>=QUrpLuUqvbN12`OAhS38YSP+|bC!pQ>(zAbsp-evKP%~;M}YGy6YmZBNaKXg zmWYl&5Kjiud^W+B=?S(>1!OS*Ssd#Jb?*_tbg~;)r1M$Fb*w}?`Ys>QF1KrYO@Hp( zS&LRLm+-L_fc>5nQe9{~QGHs(8FbxSVc(fC3>*x?*u`4 zJre5Du$&;U%;@3-OkyPZOc+-@6PRq0<`YAJ&sNhWVhotF2)0b)1$@%pL5t#Lg_Gm^ z(;E}oLCSj;fk`CknD}5QMe8*UAPVjOJIw+U4^WKW#kjnIsH|)en1x)8uU%g){kTnM zEn1*#eWeLtE?09VxE;i&&1w! zaToJcARY^*pbz3P#tCv0}+K<-&mng;{Z$R^QqQb@}Xbnxi zV2450EI)yWg@VQ*2oz2Dt6LrLSJPg=UsdSN?y|0h_INEsHtEZL&Gcn!J9?xudmvp| ziS6niI?~_XM!&YgrYqx|dc(#02&D7d>&L95AGc%^N+hH+zGM@6bOz^1z++iOuw`*T z6!$6>Z9^mMX;}%J!OKR=e2Er98cXL3E!&2gcvI1pyLd)AKfBSqU#WNw?(NV9p%86} zP4U26+__U{BpZ$la+BpWkMs!Ao#s_Q6(;~;OecT|cC5$8M(Z1P^L{}PlnW1wHlS|h zq74YiVXF;@lWaNe4)taGu<9a-F4QNLUpH>ML>Ei7Oji{EQ(x{-kFSVJVx^%~3pC7? zXfQgIjZ;dtAL|^R?8l{B$JB%7kCcez{&6U$@)Pf*n#%pqpPO$j=S%Z>Qn~XEDEg&0ry zn`3_iSoKuY#&DWP;~J`~f9qV?|6bzX(9A!@{AZ48*%K`4kuAmn2NS@A|6VI(xw9X=G`{;_ zGae*6(@i+2X=GtpEQH)GgqD43iA6N;%McvtB4Q4P%0$_S*LAsso( zuAkO(E$+hvfbPgGMhZqTZC|X`f6Tsz7f|ysZ%bZ zd27r)D8zGf5IQ%z0`uHe(z(=eF)ZmBd7V@kv)m@ucOikvq99Tefb$-3ngHMn<&a00 znYF5TtSfIo@*;ji4-O8z#?2~|@xW64j88)^?(=cs568bVqs8 zl!KCB%eISW!0<$MT+E+IP@3dR^G8CEo=QL390FY85}Mb5GGjHV%(y`*bjLl}%o<9m z>#PvRDsckEIg@M|5V4i04h;bjiDu_0aa|~M;X5tbixLiswat-&psf}JC29kW?Q`4HU`eJI-bbgRKq-X?zVJV1E3C@vdt`Y!J&Nd26LN}=U44oGiBK?gF zOPoM(6tL>!+eLY@t3i~HXdcn{<8zgoh^dy-JbE|D%{J$>-JDaBFK%I@z(h)Tb+)s( zZ_`;kt6t2@xkC_?H6D@=hTS_X#8y7X{fLWU0iv*eDuX?GlfYDYAsWQ^D;l+L62dih zJXavCiFnJva{KrT6N!!5{iamf(>C2{vwQ@5x~6T*k2!8e^-~LHVb((`tyXTZeTS!4J(lO&?P#W7G>P`YM;@XBt>wKjVz{nlPBEUAbJ*2TM zYR#%YK(tMuIB$u5Q%Uo3L?Ek9u&2Lsf9{J@;yoeKaScWx7w4H*KuVfXU=VF+&4t6{4VbC}2`3{(?`aoc!bSAC+7%fL*gm`WO#Z^}WN0Mxr zAryE6MR2F7)Z#vF0WPgQt7b{4MPqZjq`B=&A0%Q1p)ocP5V_l-ED>ZY zd%46mu4s+EUn;IqENeZm{bRRP28=^IKtZmd8n{o+ievwcL*1%ik?#-<1e$LPfpbWI z;qYE|u#JX&CAM{g{f*r0+FjG1i$HVdY_q!{9dM~beMKrU7nIMWxSSvtF(-@=1bm9a zdx;^ob~B}R(^`w?&+Cy;mxz7mC~RxWL43NF!nP)R`<&IbW5&Er^NH%#re^jhU*MAt z$1S$EKjoMO%=2_Glw#Xcf2eac3kjXj?Pd2HTn$CKqZb0MS@j?;MHt^TVW1aT@q!p#8ioTgtP= z3ykT!1Alj5)iHvg+=lmhAB>Z5rl&^WhLDW+so8MjKT?Wv*b`3gm|3< zrox^c3vk)aHlAxZ-`q~Nq2xc<$tDoo0yp6QS6dmGBi@;#IekV#u10RNgZ<(_pTWgO z--YuwJJ=<(7MHYa2h-FG;i&(-ur{iJfe;{d&In89A;L-Bnl{-4+I5-2E>O1xky%dypc}0d*z+1+26D0d!jltaivjl=!~;#UwJtBDdahH%H{N< zV=~%KDgFV~Kp4JzBN=@5+P#XGt@#dG$AgSztm8eeK3Ed>mbI-ub1xcZX6Jl>tWZms znb+|ySM`*(>xCD)f*iYV*W1ta8;Cb@MMJjA@??Y#k2YGo<#jL^)G%?v+zcJj_h%k1 zkhslHwJ*g)|0FYAp#9bXZ+fQ|DM>f45@EhY zgT2>gLYPkYhMqa#NXZp5+uZ#jZ8;bWe^8Lny8fiYi?;o1t-?%xPVJTa`1$_okhiFI zPR`glpIj>-5i;^M9WVyxicb0Pn{V>sciQi&kQLb%cfJGZn_<`CL3!j9nZ|svi07xQ zd@;+I*{Da^)hL_37(AIVz66+|GV)140>n$jbKz@xj+7{5LFRi&waxz6z%^57<#%sv zo8F7T@3;a;iGxQK$z-B82>S_fTxkdBKXM|4RMY&1Y#EP@F>nzM@;W=KMoR(*&S~2F zg7?Y;9!WENGd_#nsQDdOCiWEEC3Zwj<)mZjIMa?OWy{~xW|1`f>Sl?;ZyJY+ zsCqT2>t}PlOnFYZH|r>TJC5VBE!uvBjw9OVgPi>3opt^S++Da^PH;Q|Gz2Vgjc2hu zs~J|*R`n!^-l(e>b)ir42z#N`_d&h<-14o?GN=si{$CY0FXO|cUGtg$PZA8K$c%GLD*A$|8W0Y50i>D_xK84_PuH7;48To zz$#LM(LQJyHXuJV_F$c}e>F5q3;y{@BQ8Ahi)tJ$g3r)80^2D1v2+m3M91O}(pj=! zaa+Wag|0(EQerQCEi1>YN4jV($<{P)oQiV%r)Lksh-XZ4h(WlsJiz_~`HX5p`h7H* zO=I5`{ex1*2k1W5n``P~%EhB$_CPYi-LJNCeJ7+9D&KYU8LeuD&A)Th>-Aywv_xvD z*x<2P5!cc)bK)E?f#zPFDI>GiVQy06PqWpg+Kv(SQ0LyHGPzRP}rVzTMRwaPnV$#9~%d3df@W2kqiBMGHKbAuGC&+D_3PRD-mTa7JrqT%q zQTldE!rJC;I5(FXWMwEWoku;oR#z|qjv-7N8ipEjYX{N8Ey}v49 zpL?aF#7QwXrsa~>OX!*#81s?I_t_>_YqzUu@Bzo#$zx3SkO^fi?JN1s3~CE^;kez; z5_G4fO}LcCMQGv*$)$kXRjrkhF2KJG{Rk+IeA0)cv2w1-!)3}69fh_P@~kQ+_WQCf zklVVqUcLH{_0lU13N8`pNzlVx(*yI|OES>CyJYKYXEl1$*Gwz)>^8k*9@@%_W#wFS zvF8AE?PLrSdj`=>O_<;lyRT~aUVLhZiCF&FX5pSh+;G0ka_A!Q7Q+2`t&Q2=L|>(0 zU{GN=VC-OFlweShU`Swo!=NDej*yRz4r{Pzn?4`x#!z^5IUUz8#e7CZHk+>6;53`! zK3HM5k)O^c38x&%B<7rAzF2ei2O95I7Df=>*u1~qWTc@JZjpLD-x7j~N|0wu6us|{ zulMgn?(VRoY&#nt7H0BJwHKGtFV5HSc?MhXg{q^{W)9hCV`Dc-v(P(nxe%lQ? z=d$u$-lD>vlkHB&hxVNw-v*x_16#*USWf<H}-m9^Q<>wM~u=nAi^+u5aGyOZ>^*{0yZ zOi9_{X<)Fog$?L_InvCWG z*K~-Ct#>+luSW^ZD=HR2KE;81nW?`dfImq9|s zb{?BZ;mb|ee}=QOj(?PLmUIDjl&wcG01-XA{W05726ZnbrD-sXSj+a+qkTW}pFfDy z)7c7YE$uIoZl11Z_7_{Y65@S%)>_sBX<`9O19VB%3PK)E^94CRBsuS+w8?qZ-CcVr zWok-W9*0?Px^HiuKz`e;Nv5dc%hLv~kGa``Zlz8S=a<{qSh1YIAa;Q5%8cz`I(MZa zHgR3mcmOi(*u#0orheX0$KzUK&c7}1haSdCttXb(mkZsu+vjfDTZpjpPf*v*dV4GV zyU%V^l#N5{%L};xM!EaTx%UN`NXK3O^>qL?@aYdY=Eo0dR|lO5Y<-_q#(%}dLdI7+ z(w)$R3)|)1Xk>GKzR2rM0CrWy%d4Z&Nf5f{m{inS{`9Cj^~2i(>!MQXWyDPaZH#`W z=fkV*d~udux5;RNVE4Pg!t~(aP2c;Q;}VnBPr<`QjS%4Nnx(C)`7%ozWSD|Bdt@?; z_x{n|`sjRpaQyv=)^q&zsaai24E~*%eW$z}8JnhRYQ((r@A(=J>A}?EFg8)mnYo@` zxXtq|XG$>UI{3Sa!_I2`q2A}u=S{RUpA|zxQwNnYA1#0QynAk(EROw>?d_S zfq)?THG`HjYYt-I$Mb2G_gWL?(`o0!*nwVG=FRH!-4wujYvVA+w)_0^T$lGpRF2Qd ze_n@EWxP{aFF%O@dd;PdhwO4y`k<@9Hs?fo!58NH`e~h{N^N8vdb-r5(}T%~;oV&g zNCtoXo{WypGsL#*_}cyflCa)nG2i9(04X8}Ue$bB)~C3=yE{+L^zs_6`%|1m0el5# z6v^dyzaPcTc-)_j1vnn)tUI0&4d0%X5li5FCH_8y4@YO z`#jT1lz{Af!oo-GY9%5CDXi5W4PEbf)7rM@+*sso??0_8TNkTz?H?Ezd~#~7wZ;2w zyD_`k|Hzs5Vgn*Q-)E({_3;UO1ox)_gk(16Yz^xT$9MXIE@b?S9M^B7wY50|!oc@L zAxG1}qsz-Q+lv+U`_U-UqHSmA4mnxb#bUV>pX}vwjX6GwoSNTh6N7I9VXTXJc@o9s z{MVc9K0d;Nz&rJyO$iCw850wq-KVBLSLx}If6?T*T>tm)w3;-^Owi?o>!h>OQ*D~% zx1DQwdASBS9KYHNRJmUG1Pi-ejff=W0tK+#lU8ZUJ2r`Xu;SOpWrcosknOKu?`e-O z7vs~;$N73%x^L6IpM|#+G+XDi1#LEBl;q@Y%<}JmA3iG0U;{1V+MmehtI)096X}5) zIo#zt%Jx@>5?JKv_WU#l1-Showp~09d&~F(^!PYP|*Z=H}a{tu1nD$fn>NHPv>kSb5Y6kNHeGr|iBZG+}O& z{y49+OW}PT_U-L%IRzt2;BJrgqNDyJxf^&t+^UX)EzIZX5N@6L?=Mwxq#rwrHh4E9?i+=n4{EjO~Sb6bZ(gh>%qth}^ z@58lwtFuJ$Xx;Ulj+a;Rg?DS^u~`QKS<36Lc>wu%>Q8R>YlG-n0gv0P-56e}iB7lD z(Gjap`zf71rDgOnS{;unLzUWu9yvm3>}(7t{mmke;IW(>pkhV4o#FI?N>23k*wPR2+lY8C!vVO>xz5UhgdN*(?NHXH@a>w(@C4Y72 z{k`=0nxyOF)o_?|YwL|78K8>X^Toyf2=HOTngRH@PtMJS{fA54^?V5K9VjOzuGFa3 zT{m6aXnn?nM`DVY9+%@6@O~!VtT7~IQAyl5hN2P}A}v@wFwnnF{l)Z~eC8u#PR@tk z=*gmNRq0X2kLr%O=J^MZ>liN)i*$y()J1hSALQA_nDTS2V}dc#=_jj9(Z3RC-_o03r+*~bxCcX zc=aaa+8%E*c!7Futd85qtVlVE*v~9)3ud=v`*%4k)xaaQk0rfbZHeU^5-m#`^>#+c zR#iC2?5CBS`3m%hN_)38D)Y*9f6F1j>*vj)bP!09{?)N}8$gP2PQugqep(z&ZRQ;5 z1#~buqqVP{&WWF%t|0QJ@j6)F790{;wJ+d$l_I}TO;K&6-=CYlVY!nfSstflT9Q84 zVG+D4dj5VCYmq12<@pe*KRxB6FZlH@IBlTz}$5Y@%!hh z{nRyga-oaITKOw~q>9cy{-%zx>^T{!Yp2-$w>8 zef$CU>&HjGrw$CB?RA~q^`~&}t8hn9{9)>H&U>g#Acj|x@_ziafUNQU3U)NwJS4oA z?_~Qcw_2LXd&_^JKjsbWW4-$?Tgb)7;o-I1wIu7^dM%#zH04#`cB+~s+lS@lP-msP z)MYYXBV^kBuCW>5QK{<`;sQ{tcwu+l3ftISs~xr_4B2|8^;`wq*xII1aEan`?UVzh z$mBab*b44WA{(uLRc4ig*j#(+9%0?-rEiLJW)&!!w&&PnA>V~P6@_lh5BKBT+&qm2 zDgr~py08Dc0Wps1SML2H^yVx(O6tned+Jhqe+V9*MM{`mzja;)bwi)DRdVk62iWP# zZwA@Fo64yKZ5)~aZHiNY!{|rLU%}9NBAs^Gxt~C2&>7B0Qx|a+{0syjA?7hy@oY|m}EmHbA-mI+;+7*mXP+&}9_Pm@NrU1Nn9joTu6-XyR8=$TxvnjG@eiwPpVl$=q zFQJb7oTl=>w;E5GKZb@npbZeHrMK z!}6^xPhzt2ujMY}eC_TfGCVvG+5jPe-p-q6pbgNF@W*yYIRLdW`eD#_E8 z=s)eYS>tl}H5`4R6dn2cm4)Y?{^|88eAaAg!b?!d>nwp>P!`$%fpt$#{_zwQz6xE; z6%|4opde@i)Y39;qW@1RlZb$crBhU|ECb()m{+5l}p8=$+9@rhe#0|dc2-p7Ar z9@hhQ{yVXfF0fzl%n~Td-fVw>EFq$I!0GDhKlu!X|F~&)Mh8M0pgKhj?pKq%B{3KCCFcj~Sqns**um_alSXoasuoJ|c$HsO#5J|(tmEUyeyx2kZ@?La zJ|-quIcNIe=J{jDQfONEVZ#ynlKIg3ATmuRGSR@x@%-ibP4LOx-F=~PXUEG%EdgKi z2lVDN{gdeu80`DFT&?ltv&aV6>0)cbLalg$Gd8Yl?)h^28vV;G*!=Hb)u^bb;;Tqv zPwy)IhZ7O!ljWgCOXKs2N!zSEWm!TWlcMXR+2HTLQ3q;8#7hql+fQTMpX$;o1C z>rb}2y3r9~qg;sWwZfBFSZV__@--!8r8-{ZICdtI&>pa}YwP(YjdNKE36a?BVyn_o z=v&d&<=rX7nw=f9%@$-+-{l+uF*9HJiHA#-*x~)cFDucX7sA4VWzEm8#5!Yc_T16g zt@wI>F7m$FF8D-rZ!K+Ap?kPmAJ0jvV8oS}?D9=gn)MI(3YJMhfjWub(W@&{Xtc|H zTl}Q%7(Ho{<)o06jgM*?<3NjdB1K&7AzJ)x3;yPH)M~^``P!;oQ2d*WXJzg}c_q{y~h)kA@iJ zsS{=~cLrRE+QQMru`?<_^e1mPg@$<0R#6K;5kO|PO>R7kW zaFDgj+st9O(_v%1B!PhtEqiM7`)}o0#Sh16GSieD zi2)EUmd;z}4x&c6Y|FSsfYZNo=&qfo{pDeT!=1tn(mdaIcE&sb4~fMJDHIlT_FkuD z)>wa=Z7yn7RYx%+RGh*PIrP2d@>r?YXFV0MbNjw{ve$s+wmTt4&2q(S88 zD7>#7q*LjPM3zkHAUY~3eqx+|d#yrmeg|Lh6L4zj54WDrl2$&B`}#MJ>p5+7bT7g! zsmPrpuS=%lvpGARF67wnCdzHs5+^InCX$nL7#KvJ4w@hxXGT$S{Alwwquy6PQb#6T z|0=xvBxr%G^a$l;Q-d^N_ltXZc$e;3mo@6Q2sDKsY{si&2J`gw^uIPA3AHAOHpTx` zOw#~$bUC%zl^?28!44S=q%D* zzu8`0_0yp1Uxc}2Xh~qmHS3-df31I$-XAP!7x0MW);Q3xe(mxZj2rhnEwv}Xj3l#o zed}xBY?fc1NEDJ3SrB98wALdRzQ{h32Rt{&2T%lJwb_gnmoylk2b3&tv1+6*P`$JY zzgb)Cei@q6nx($@JcwT^ECSS_1wxFRv%G2lH3r0x=rFr(6K$5|jJz*TM|?KvkVSJ$uWY$o8~l@c-sZ}P z9YORJy%KB%G1gXuEGJ^q-vU=UhBvkA)TSZ!ff&c5y?gYU!L{=qZ!W2$9Uu-s$^E>w zYFKXuKdVS~eFV4X`(-Re`?{t5c|#g|Fz>1cUyYVWzrVM9=n^l*_d?SVR<#=^Dm z(zRnAN`=ybtx&5an{B6p^6ZrHVK)CGlnT>sYBHRU&YeN^N(RHKd8A{O_48p>C>1~m z*+X)RG|#^BK+;1kgkHf1N`=+V;}T;df2oS?MNO;vDCT3&MovWqwOx()T)S)%e4pqzy9Zc_M!5~Kt+P977p6p{%*%f-; zODmA++TVwGJr~G^hxC%1A(RTiPX9$mP)<&%Rv~xQHI#})C>1nie_d_6I38ZZ?E8ug zp;TCPK&i-tQo$nsy0)m`JnFF;xcS24Bi{e#4LMv4O2u1c8E|FybXL9^N`?L_-;{SZ zl!_226@Y3j{%w>_qqIUO6_rpbXn!|klY<~u+S^bnUZ7NH$m19aIiQmz3R9NM>0j|R zI*uljoDRj7Mn?Oil|!j$8tvrP@?k7~QqxJ!N>$e>`R;XLjri%~RFd}_l!_0!B0Fdf z-_bA(`xcu<#*H+KTf=kMg;$6**^Wt;=2oYfl{FXrD8sf-y-Gy$K9&y z8oip&AAP0&Q{e`sA_z)_E5B9Ou@RJtUMLmPP%5~dpj41TsSshbNN=WwQo#tNf+E@_ zqb-CeS+9PHbHwE(Mm7yf1q+E~)mhovqc9Lk#VM2uPf{X≦^zIWwEI;>kpz#sg*K zEUUGSHmfb+S#u~AX~+PSq!ybok<_{9S!AVZYbX^?`uC2W!|QWHPD68RlG0nkc+AS4 zWUe~2AFog^&w?I()0ni4YobQ~z|pC1|nT7!eMo;t!OH4mkoX!0w&_MV`ZM`7!oHg~uH_75j}ofbw< z(+vkuzDHl~oLu1d=~OZtvy@;Ct6Dc}d{kfq?P_Gdn?KGfoBq`z*caq;N-{Hz|h zQZH!YU)gBuq_&d##w%bt+-!#qYFJWFIUsEBY7wGlEn|GdfZQV{tZ{Ruh|tu`Lx=v+=EQ~mWg0=wy5ZuaNY|7tkHE%zJTrpNv8wsUTa?qU;l+FP~SsLqi?4$1DnN^6R zsPKQ0BmP)#lIPN5d1!i?uOt$zZK+U1EpJ&zyXvHS=lxbi*!a;R`hcM(+Z(j6bV~7w z;*v);R@t1-QUvtd7`I48T>jWZ^ay@>|ClB{;^$OQs6w3EY5l|YyAmOXOUblLr@ix= ziVk|%3DG{lJNcHZcCM2ZRBEQzXrsoHki)L+as5-}sv~2)jr9+q<;IvwYBJ@+;IPFP z-tG$S^LbHlo3Zo(>Rlqx3~_@EvuRd;y<13i(nDMBZlgV~TZAB?yQ9mkMDj4q1a9?j zn8QB|#eV`mQDbv~dN*|;s%?O2DU-5Ir-iZDkAL1>`vIOi3vC+9`R4QJgoV0B2e+#i z397|TYr0DBNy3))8VB=1mK}hLIkm3iotmdL_<|vj^u<@!^w*=FH%ySyKamJwc3bHm z^H+@S5&9H7ntaYm4cZ=<>`Wsrm1ac~_Y~xWIS{Q?a>M43Nc?a8xRBNiJUvP!#1ycT+DHi8_lr-t+qo!i$;aN zJw*59l;)A;?3+DL8+^{PYu{=e3mtpSER_!Dxu+%XyM5GeDUDrJQ|BcIgO-<=`>iCm zDup`wC^bVTS2s#5_*+5xB84+=hBu#uZATS}+lO&S3u%#!OH7C%&^4FlLHUEXk|+K~ zq~;&rC_oeLhAvYqOBYZ55)rGLdhCt!rh4ohqdux1UbJG%heWtpzSMcb2(v8AJ@F9Z_6`4rF>H1-d>jq<{Mvlu?Oz24A zW*j%@O0lo1JG-OxYOm_K=TG_v{p&1d#vB?J~Xj;Y_;wE zT5MbTrq~MG*EQK-2Km-m?s&LVuL;FM|LN=}#;@r+0f5R~=Tgg9{y;#v?LtnfN$F;% zrZeQ}KaD`S{vmIS6+Z7%fBpxh^H!Xj#&XYmxg|LUmkaIrz~J#+3Ob}?ebDnu;kzOB zWI>vq{_ttnibv+l`>@F_c1CjMJ6VfEUz|Gr_}60sKr_QRZ_dn`hf7CLy|v^EB>z0S ze5ksGrO%Cv%1(JnL9ytgXLn&LoSAz`PCTE31f8KmfQH6;{d&o~RY(4&L|fCv$lg8+ z?^kCt{*KCPgpI6DwdIGsUmtPtr^%pwzzl$nW!pN@plZg>W!B3WlU=spd+FS$?=5on zxVk(Sp#neQmnMy!%ITnx7r^AyN>zr-pzMR5cR{v=>1Ht# zGr+j%ajz_Y)19~3LT8L6+l5iOmsSiS*ERngQc}0nU<~hf>JdHh9~#}qR9&kfNrw*5 z`lCsP`?Q^T(J?{-=-nane*HX}ML^CticmL!x4+<)`O~?NB&i77b8>u2_V~SnIIf81 zqBLptTK(m90UHvg;#^(DoU6b(@uPhp@uVJPRw92q(Utwm=(x1Qa#4c5Ob6U5YJMt? zkl1ZRmKyDj+2XG;zb;64;PnFJJu@{~Y(>Wp4p;9ndwH)6Sf6Ac)!dTgo5h~5Q6zD! zyE^N5{cEiocH4b;{YRa$T%9{~UTM5%&b7gsI0WKQ5TthhJ2`0m>ex1AiN&bH^Q*`Ab9)^>#rLP(69Gp; z4a*BbLp$zAy5X9Q{pC?X(si^Gm*Y_p;k!S_u(;#d#n`6+ z?5Prc0O4xR)xRUZ`Ln_rOG13YwJPmkasu~eRr4S*2a1gPR{ePghrDjDkCovwZ|0Ig1OCE1q_}3jMheC>gU`J zcXDi{R&lpz0z(=n@657Xg*7hbg*Ew?UlY{EOv<|$Qhuas_Wp}vIHXRYa1LF$hnYTk z6Z?T7%=R{W<(rQG`|2~v{FXI%x2QO&u1Tb%i6RPEb<_%zca{0iG0EIDOXG`=^>UEQ{W~YwezQ9gDl3r0Wnx>TWZgThQC9DK zh(PK`?Bj7-irL3?lU;=mQGnoz*PZLF@P}=9<*LVz|7=e(6OwN;y5Hg1?N-~!TJww4 zxVHvAuX?`B98U149oCe&fG#&UQ4fBYnoV((QsZgIb{!(c(y?W-kn%9AqsFj8;)>V|{LvIOz5 z$>wu(B$J{o-`?4IbRzAed+tu3XY)Xz{S-1x<-&c2-6@eUkIb~gCwl<;+}8T(%Sm-zl%QB6ZJ(qDgnO7oMSsU!qQhD}WdmZnIi zQ&Zp$Yf>xEOPJ3UI;e~<&$%(;uw$F;b`O1sEwSlnWht!v`-tcUV($Ej(vo6{#Wd#8 zq{zD`r+IpcSbMLpJr`@-Ei|my*ZPax#qGx3`&YAmGf^0j?wvLB{QkL@y)N zH>{K{6c0s|&znS1PR4hjMCtN}D&AL6cgO;C6-&z`{-NCzeOHK;1 zd%J5tTbBY185CObV1FRpg&bhJncg@t;I?QoEIZG$Iwb||X~ z-~}QGdcS=8rhI*esPE}nLx=~LM=od(l1D}4z}GXoh`1@}3RX0ub;=e*K9rTs{mM(| zP$KU~uaw=BaJszR*39dst?9Se;m&5e^F7rK3`2&35!f>%WzNJByd#$aj!*m~!>kD> zC*tLc%|`}~PoQeehhyO2q`JAcZXu_@zWVZoat929<#^b)!Kx3AC}(VGYxT>>|3Wu5 z;wvwQ-XP?Src|vL1YQ1(-QI;4sn+W)|Hn|O)k*Tpn8={G*noivqfgMaPZ1rx=IF>5 zOX%~Z=Y3B$uPr#Lf@!3wN&K`224f->meaw35}Fcixjw=b5^%%8s?tTbwB7I}9U3wq z!-J#h2KHZ!$b<@c5n*X-2i%pZ*_{lcyQyd(JA=CWA7+$M&LP2&)q2CGE|DY7v>r0R z=OGF~q~Ru;ph`^48Jz#%*~7wOQ?oEv*Vb}%bukymlY2R&rR{zy!vrPJZtuN5v3(3< zKN=dqAYoJVNeGZ1F)-wEcnipbT5x&r!bGk9`WN53m>)X$dEU~Iy}c5Pu#P3Q!@>!F}TUrJ* z{YMK9Y~@d7WDIaHr22G!FMg5CT(iH*>DKfYzapI*-E{v@!pDL>kpN$8HW;&}mwaPW zQtT%eMqeLEZk`xvLnC2tz9cPp0F|1JqYX}@iplSrTy$@(F>!2MEi8}KBbt7KiyA`)RvoxJHu532PRuiNB!RuXlQr)3B1fkezT|=xy=!YoR#sL0cc;_f z)q2IFvkr9E3lIO2!@s{fJt)rBOVHcepl5bewzMJ>-SIFzp!JFN@pcq7GgFoF+aC`3 zY%9cHzr1IbH4xR+S-?9Ss5A<52nv%-BV%a6U;}k!b?d+(DSTxWe(b|(X>pT1hu>YV zbY#LOFj!c)IJmW#P1c?;*q_0$F=nt4i|C!50Prw2nlc@9mWj~v@{qwje#dOy&(v;DgjRtg(_bxyt3Zzm$43mf#DSxL&4fxB&RU5 z(17==DiKjrQ@f_|4wfPZT5bz2D_w7FWFlnPS6A%@%T*m zo;}!c{yX){&R)KJZe)FYjt;rnW$hb`2vYtn0|RFWC!eZ}?CgwgxGj#Tth|CM=(^=6 z=t|JPGl)k?MFpLwW$;>~*T{6WZ+N&pn@uJT3hJnD%%1@FVAaxrh;uat47J(0xd2EB05lGH@ETuv6Zu=w;{ zQaE@x=CHTJofSNY&Y)a2Z?MM25j&~}-Y-Isl~pqsOXRLG#Y~eAZfW5Q4G;HUEZ2~5 zb>$5V34ssj^(E!C@oj42K|w_olaWDT`dtI#^YMWxJw+ zDKs>+XEKA=5VFy#tgem-P3Z={y*%_kUhQs!djr_)cfQ9aCkNl1F84z}yAAyl8}QwW z5BM%**Q$eqj~}Fv!PDCpgl@Q0p$RPztK9ix@WlmoT3Q+y0>LUSF1~!cGNxl>SGxi8rnTTbX&ZhIEY9| z`{#<}dPhf5y}Z4*-``%8H8hZO06=J2DoFr=fZx!IMtwae^dA)y7l*?^L3n(+p+!MQ z?{9NH?U|g!oS2vZkHk^OW@TZHCo=~a4@dXLf0HvfoXV;(oBqt_^~gp zAPbL($SW&@7Js6sswy55GV=E6a`olqwnU5T#b^064nz|Z6L5bBw&+(pDsFCkD=RC5 zp-5u8w`XTQ=aWwry6prLlaqepc|GCyjG~H)SSwaM2uMhM!I-2yi;MVLT3Vu-n#2o> zi-yZpy0Or&SW{CIbfKTN#qH{gdqefNWXacQ-qa$ZSW1}B*-cwUkeN$73 z`1tsG0-=wnl9WV*gM-VhtHV1vJ>8y2JQCN~Fq^+&3%kyW^E0P3=8=aK7Q})EG`2BgTZ=}b&d1s zF9VJ=14BbtNl8f@GBS+&`+GK<4L)cEA%{jpz=wT@gNKK|yt?v}OJNZ+GWw#^?t;0u zzfVO?4X@YX2HV-$X$S6sjg60oV@N`Su2k0;4`Zz~+fo#klmz(u!&z;05DN$j<~21D zbaZrxs;lE?1Athgqoc7&Nr>7_R(@q_C4EVZ8o8aFoPZe~^IH8m{68}ZP{RfNYfU;Lg_o(cf4;F{@i;T=9=ZEKDLi_#c=ZFPv zDwVHzLR2O$KOLGXg4ak~oZ1&(v4k*;C{bK~*mRh^!jU67H|5+fhmv4_QA~csbWsEY z6yMk@T;Dv=?+Ibh4-z{_A&8??D8uCEic&_9;ldK2VIeq}&*2(SLPzcohwjIMCV~)- z(t%4!1(p;GheP9MfPzXKKvBeR)CdhIGb(lBVln<$ei*W)eAUrUR8|93o zK{yN^ER}2p%9)DMcgiR@0zUyX*+e^)I#G&Gmnb7REd>LFJ5Lv>(3@qo2MQf#&t4 z04o~xw>k)rWL2qt{>5JZ6h@J8Qiz4A%aqzq@xRFbx;Lq=fmhgBAvMPWT3?NDlKKy7 zxJG*n>Mg$4u_T!vZ|6%iI9z`9aBCB6S?NvXh>NmUW+Y+`$(Q?v#OY4U=tQm;78FM} zK*Z?E9UE)xK0_ztl8H4{Fvv-9|p)QxWnkzXdLf|^m(CEOe$u~w&mM4Y37*#!` zPa|f!P*9xHXEAiCz%qmmSo_@oSEz}dd^Qd;61_la!-g;$Murq;_8(7(WKl>@sOL}o z?}uvQY*=w}MUDi=F*~ArxC?;6+4+6&&W{@E7WhA*VD9h4jFE!H{N0g((Zn*}aX_qJ zN}YJP2{?!6>2SotKX)BE_Zy4nADbX?nnof>DHBOaEwMS;T{Ss5)YQV5@ajoulougb zDp5w!t2zHD7^8-SIWhg6C`FV{WZ$3Fswty#+DmT0L5dhdjhe|tbCSlVF8+icW}aMkI-M24ZM*Sq7Qedk6de}U*mI|*#$1780&xS5EOkdzTUtX2WDu7ZS6h_S zh}laZ`ujW4yZ(E=JK$Lr9~!)X<~6@cQtDyti8_RR#X9$Wzk*f4LHw~r_&#|B^nwZe zZcsY?p@05FVVKJnO2>dC?e&OAMMd@Qs%)a1+DEC{f@>_1I%zmt_DO+*Puqhp9VV;S zQN$ovt-x;_mB(ntg1t1QjM|3`*`K06Z#s~w9#v$gU+e9me1ORP^dmrM^dnB`1h}B| z4BVT4$9|KICJvb*>dHe+6_MJ?|A?Eu1YAZf#s~%5%JkNHC4R(Vzfe4t8b1b~@w)h6 zN6i9P*lD8<#$PC2gkLE3qRw6GXUyFtyo?W-<&J>!)uxdhc^S3W3`1}0SjN>9Ls7}R zee|3{zdH)N6VAes>oFRC(eq$cvVU>fsvot#`af zV8lZV8EcWji;95N%gOgkzkJ`G0VHe#-4vX8vN7Fwus)^*$g=(aePjfF%%p?jd3BVa z8#dK22T47zr($bfO8OL_z;MF!{JhNi((>h*tXJJ|;!d9nM@K~)2%{$=kLdda#ti{R zAGZq)7P{4D3ra6VRM=P9l~6pbezadKT}W#~HHqJmwV6;de=yaU)b*r&f|qM``aM?U z_l*}ph>fNto*ia;7EWZL$Hoq(Iq)ZBiQHR`w2C2B|GV5ti(5pAMO0g^?$ANX9# z$?@ysl}7kiG)YekRAwKUPiRS>{dZZ*-OvTe5(bQn`6366Y90}IxJ|g?NSRyEzo;N6 z*yj<2`CrkKG5P2?;Di2AGogkLj35#H|cb1rpEJ<-+`3DyRX#q^o02L-WJlfD+;7*M> zN3e?WH`~=1>RI{@>Do*pnxX%C4mi><2#^b4Y?WJZBKySz3Se+!%`xz%<*gzo@;Hv* z7_@unW|Dsx#eG@vmE^=F6h;U^k~%b?BC_OCF|cAv|4|TMM%J5akNeXFAxr}6O|6$I z=#uLz=aCgwgq)NBbYLWiS9P;}fYdP~M>{7Qgy?<)u=&?tC`hkq;QwNYOSwo0#Phcw z+c^p)*aGmyc3#WC(|vYnWU@waBV>_-pJ}2jaKk0BL2A_R<}V?1L=Vbo(Lu3%3nNrL zPZFk%Y-oRp#mV#Nv*Ze*7$Plb*uZviVKhPC`{Rz-jYF--0-_~gZ-(hZh*G_lDOjk# zv5nCYQ&T#Geu}6i;>&)S<)#F!kjyAkqdXW2_ymm2iojc9d>XgY~U; z;>rXZEB;twwSYVHyTUkO-2G~_*ZuYGA_VSp zbvs94k;#on;q2Y)^*CZMxT9o(_pc^>7U2Ia=;j|#Px^d~UbU1h0!g+Bm9yJVsU&;U z(AID@+XBcbQL?8IWr+{ur}ap1?kFSet%j2!yy`?jf~VG;++FsWVI$>?_4*|hVNPWkobN-n!6*LpR4wjn z5wL#E2>Ej%^$|p1O!H6wh4br4r1+y3rR`dLBAXtRL?dI?J4=4? z`3bLg4pIJ6=eLd0<>0Cte|sg{wgy&~TY3^~z+^cPT&>Xz;sh?h zbH3pMPd?6u;9>3V;O6P-4g_CMg1d{Q6SxyBodgQ&=vWNh=?&lM58oMBfVYDU!F7a3 zx?8&04?7*7P1o3B>{JsY_!~MwR?y&Q&7tI>g`fhX@C-;Llh9g7D_VmYPG%cw45P@X z+Oc&=o(Y%$h7-R;`Tp7jj}4X0WU#3mp5;g!4v8EZfzdgpfD5M5u)l?mQca-V2v+=P1qAw{ z_NIX2U3s2wj%N?6j{jeE#9UV)(&B z5S2mXFJr)Jkv=hsMde_;8a{e6xEv;zL*zLhUk2*+?|5eLPNEr93UO$kiS8p96fO-T zqHQiv7(_A;>;7)c<^<9BPga1=h#;}U(E=6YZx_w+?1lUVFv_}!bGQdyVN4gC|Ii1M zL=GQ*+Qq>lc!Uu}E}cgh*$i0*-3XrH@$G?#yt9X)05d;TGer^PQ-X?P} z!FGL2jevi+mNx*NBwivP)0o#!fY{%UjYjGhEO^358vE#PG!tLqNIpT18p(!&0*hp7 zl6m35WHBPC6pX?v{Fw<<`eRjoaoBP$1WylZOE&`Vr0P#e@NPW8hEHemn-jya7{KUc zbQ$px`48uZV?V>vtqJa)L=VC;FM^9TVbp+_21I5MO0;fP1UE}}OJ{I%wD#Z;(NapA z$Xkjdd>BO^`w*HhCQ_Ft$kE1DS0KxZAh-+1VuHDJ^01U}O0e#bpkc{;3N`W{()pWu zO)_}!>_p^A^#C%1&2byr=tB^VK@Rtz#$ssQNutp(8a0-eQU9=nV=+$r4bGTe`5gdC zy+gh6){=a-NZlb?I2J>V48iC_iW?E#+#S4$js!oVgNv;zFvGDJ5-o&x1-!OyGy;58 z7r_aU8sOPDZ86@FF&j_g;#Bc$?PxqLT1{-!h&e>mUXu)7E{-m)J}%&baoA)M6T^A9 zIXak#0S?D^DV!q~gR>mkE}`Us>b&T@0}T#?ceXcT|AH#5Ly>9dAsCLoEil31HPv~| zJcc)5qa=bDj`ta@A;L@wM%E<5LLBeK01EX2UY%gIUXZxxv=wCTsQQ4FgAP8DtXxO6TX;~jsp)x^MLXvc&@ z`HdHw1b25=cM}{NLovW$;g;hmD~67Z#K4QrWHHFR)ja5}Cb*(M)-WIXGXqP&{o})*OgC#!U!I}<8Wo#NADVHGAtru_;7PP}@f#}ebIBhH zZ|^v?>EEz%~u;HD}@Edzt z|0xJKMmBP=G#FX*T%WH z`1wD*L`w)Z#=$We4BALi6p4uwJf<9e{DF9IY_$6Ndj!NN5|#gkBI?D*(!rC6zy)On zR6`7=pv7BMFqIvu%H*)r0FuHMtJF_AmY}&+PR54K9H(p~dc02Oh}wZZ%}HBmE+5*J zR0&Zsbw>AtJulOybn2I=ow?fT7I(X-A%5`;QM;nXhUt4|_s48GIa%kynWE*;9SKiyR5I1YXVtOazQ@;^ z@BOxulQPw}cn8b(-nLbrmdb9FKkm7@$j`shxIz1nOklVA+=2%;x)K6aXU16G`E1mD zv7jYphxkmBz-{6gG>feY1=pfvpUijEsc6#5j}8n7^!keTYTuXZbvo#Pz0ZH5Y0-ET!@jJ+t<9vf`wseJWHhXOLIi$XW11XC`O5ML?~>-p%QHrH}Ii z?yJx?c<9DPC8nqzu-|E#f5|a?cE^?LdzDm!Yeb)tcIPPd2cC(u*IoZ%#fla2pU-g< zI)&%XYe|}oz29K5W$ukL`|H0lA|#BhzHQoQGg(sv7k_+d*DdPGbj1v-&}yZFw9X%- zLsLS!lIn9GW-bd0)$)9*dP-vdF}-EEw8@|8uT5iR+`3Fl52*LAmB+qhMGEB`Tln1x zP7=4?D3|yt`N9zfq3T5Zn#(J%{%CHy~~8C#fwKBLGERTt+XQ!=y8uJL>^Q_~?EVtjUOr2tiE81wOr4z1- z6uahJyB>ICNo7XBO0r6rTt1^ew8(>I@&3HA4C8~lsp7I<5erka(`^VFYD6nm=8M$5 zx;(H{@7Y9EiQqy$q$?R>n~MYjqwuG4V+aCS&w5_3zz)H9|@^B zrr6)xd16PevTpP9>0C3}aMHjn1vjl+_wjjsMdrGJo97PLuh#L{_#7YH+P;wQk56wwG&i!TjaaTfTS7Rva6Aktx-6@ql@s~MaS$W)7MDBhc(^OI-?6E?^@ZNryT>hM`hz;EU)MI>!F?8TidytLV{P39 z#V-q-o0?M&?A~>D)sDP(nGJix>mKZ=Ys25n*II72qhud2M3_ePnK0YdC{WNyX-l%D_lrUUgdtzTv)ORb-oA(V4_fN^c z_daur#p?RmmX96QDxB32$HU6PRk$(;RnBj_=###PqM~p~v`czphR% zk31f@066U%iWsGn6gy}8gn!uIE!#L%T?r!>7yrEUR&%`mAjLc3#tMxBkF1?Xa?K&2#6;T`xFE&s+2Sl*7fqPltlff84n$`Sgdu83(B}cZ&Cm zjB}MIgcr%FIf-(Y$oOSin9O{A@POxH?6B4H$FFyWKVICEHu2EItnb<#pWBTzoUg6G zcO~Llo#wq~##eW4B(JPd5MCS}Dth~Ksl~LJsb*Qsu<&?;b)ktbGu_8~94axK=yrNe z{6vd@v(MIjuvxR?V)t|(!zPo0sZ-p#L=@+A4Hkm%tnX9Kp63*q`NnR-S15_L{FK@K z;D=UD9NSKJpOD>mzyP;>G97Dbk{m&&Se&Gyz=ZkzALADLsdel0(n=L;=Pc=E*D-Zr*yq;z+C(O!_xUO>7ahsRQD-)! z%SjQxcpHd>-#qrjbf%P<=m{0SkL^3V`})76F1%8jK{u0CU=m&>o?~>r6I&^sSg3B{ zKj*DtRNn-1mrE^}nuPq@w8vX4*5hvlyGP%4(hMtFG9KAiqdrp0QkDOr_kUQ*+&mrDb~Pzw_P)D^|TrA(X$`bZhm=2Zrm;sSYL!eQwpQ zI^j>doS@{32_MJ}l{iuR$uvc)Id9Ep^>{7%a@ArbSteD|} zdxhWnAU5LHJ?r`3<}H*$UQ`l|9U=OVH@R6SB2aq z>fB7XGJj0hKXggq1$DEA&J3NNi%M7JCVQr*WfC{9P3uX?USl3~Fv+ktO5;^3aqmZ| z4bq|0)shUvA1k)s%zFN8e_E+;^ojWIK4g~i?7^x{>HBRfXT29IyyvN{>G9gWai^+I zdBo@L_rC82tMy4ARe!V1;yyJ_Te{*^38iD&3Q4Or84FzT%TI)Nxu=iGy3(5KT<`W- zeY3h*R2KGG-qaNvuXN8cBSzurP3MHfFgwTBZb2K&yR(As+s@m*JabdhuVckGuT`nY zuG_=8OP#zm-Y((%9&fm^T=cNLTps6K&@>R=I9GkUmG8UnUQ;Z-<;jzni|6j?V(D3~ z-MjtE2jb&qQ)QZ;;j_3v&ZoPlx)YYrb)#zI*H1i|;npkX_4IRxL24uE^eJji<%B6W ze&vezx7?Y$UNhDvBVM0SH9n+a;C6*k4mibN#LgW!&t$VppwdQRhqUWY17$$IS}$+yd21QkkBh$J@?ESywea`T zGu}%G^Hc0gO-wwzHgDgAE6EA}?U=H^t~?~$%lDvc7FjK)Mz8rrn)g!mlRxn~i|4HU zwlYpfZI^II?*LP4zDR&<+4@%tRma=QUQ1DqsD8az=9+y=qQuQlw|`EQP!zE|9%Hv; z20dxT`(;Gk2UpV@c3vy*rWiPN4}2Od%nJl4_sd^U}&Sb0HOJVW<|@B`Q2eAx{T z?zE-M4S%u6LN92timCFY%b&!Lo=-@dTH2mGh4oCe=cooDTDopvUr9>Pq&1YT?=^23 z#~eKS?AL6bKXAB8VY|gwOR}99XHYXOm(DOT9O(TP*dm?X+xkAs>Ba1{sp0fyNw3w_ zh6_U?OdnzMMLOzQZcbJEa%>Q4_DC2PP5vlB?LV?Q_|Tf>+R68KXC7NA+nA&!Q>K!) zeA$(leXHL;HjOOQG&YR!ld4I5Id8p&j^?*hc~+sO3&N^voVe0+zGy}pT1kh!UACvB zy)0{j8@bt(^Z&$r|={McVCQ(LOjQ(Ltqx!qt2A7b03NbseDXH_y z<=<7WDL(7V4<}yj>FQk_9q1f5F3@(3e18H(!^d1FhXgpE=(uE4FN|`WfuO*-?1QtDAe_QsXaM z(!BSv@z3SA#fXQ+zf2+S-r+~LW%^ve?e=O&c6ug!`^A~bm+HoEEVB>FmdeQCaEs;E zm58?Fv}K8E1nb%AUKdvM??}GfC5q2XTPpdRE-!C>Y1Z@OCnigDCuUKhdVDw>c@QjML_)t31E z>S^CV2wKyk{UoDZiu}%K?!MMa5B=$tmENE3mOU#j-<7rI*ZW9$zgp4P;~7apagOF< zEMt|pJ#j?VtHeu(omm%_Uz_#oVn%(mm*>Z#6Tc?a$C*F9E|KTF^0S*lZ#(H+J6hRb7yPZ z@XrV-2(U6d=DKA5#`??Y zx%NIW^nK+IBacAf_n}hK)lJS}o#}3}Z+1RjPAUC)be`%9 z6O&VkDLIavL0+HhKWp7=>T&O(GDH^piSrRehpKPI|=R+257O3jM){zRP`WnWx&Q$NfIwb#9}+_qZ~% z(ydZa%T#+C#VSLV)#MWQ)G960z3dvb z_EmAVt+`qi)#I7{`gR$LQ%<$LKf|=j??+M z-F3mawi3UL9+R@~)`M~l-G>N`^A{?oUQz$mF1za2ZV9~XzI4*wH+}C971#PvvMV2C zmrAdkc&&I!*!WkN+e1mKh+B2}##7zMs_jP%o@;8QrQ0zkx66NdCE?lR^k(2}9e4YD!Zlvx>9fRz>!uM*tgEn-XDSFTKPhB*fUc-Kvv?pl) zvpR=M8)olvbDHK|y{h77b-UQKSltPAF9-)$cUKK~oW2bb*+DO_;LCnItS}f)m0qPR zEOI{X{@vmQha&G?wUF|tf3;+KU`4J`SDqdI5YDJHvevfeMpk}QU?3Og^80SW)9oEw z3x1xCU3>bcQ$VG?T=Ld_;n!hRLO)-;e@yLtv@7#jz)20f=;9;olPYydE+xxfM%BK0 zzSF0jRb?VLiwL4Jw1R?(LEPYAO){Vh#v+nAEEw~M7el5ISo-qi{U>7)+B@Aaq#F` z7Dl271~POzMgo;VBvB|VO)`*4G#XMO1mn<25g3&o%urPuNkx1Ds+EH)(bC4oedyJB zmf)Evn^(hsl`E9N=CCnVB#%U6Fv7XKAEXXRAx5!COjNfV&s<@G16vk`;WT(B-$+$e zJY^w1maE1i;esjVc*;L2#DMpX!9SV*t`P$!m%~;aDuiGhw(5vVG)by>irNS*a4d|& zWzlhX3U2tg-2{h^bl{!2B|A{Z15f>?}jjE-YcnHZ26bUN>~O=<+j;BwHgQR|=>z<-bB#EL8p( z?oFWtkbPE+d4GQ3U1_0zr1kT6r}&T~ehCSpga%WPDkEWGWG|oP2(JLV2ie!l2T8fM z*d&tT{?qVwd0_p+UiR0g{tER)hKc*%jc!-1#@3RrOt58X$nMLXiZ?R11_wJsyAX0v z$X~0_*Ywzm#V6ugwpLpGs)_hl43Sm?)(mDSE4DMpL|k?tqj1@=tgKfh$T}-6v@@_v1Kt%EKb6=HadD+r0Umw;U z3J6-UO!>=vg}l?vo#OFJ0O%knp$DK3(@X#Ss|SD_h=Wp?UV@(~cA*Tw7KOOFV0y^_ zrkCPS2H@^b4hVAb4-IkKwfZ?(&RB5dy*j`CZ(<>1N!|^R384EED!lyNLVQ+6*)IUH zGLim{C~LER6;Y7pK(cc23i#SvFofHa6X~vcw&Q<+3Emkm=J%wv40TdKk=~OU>A4K6;r#vMil%tO#ahGrNLg26qgXG;7GiV?()Yl ze-Fu(RT<0LKaA}2ANM!?Pmj5iL&$P^t21O3I;2*B)0g7!;ZBZNUJ-~$xTgM>*L~uF z8nA!`>i@xC1{{Y5cmf0P0cKzZM8OP>fj=xj2Hb=^2!tizL*Y>Wle~~W90~zIygMb> zEyyb%1R*Cf5G3<^vm%LpnZU~|H4Snww6!v~T9J@?wG1Q-|BJlTD`EIw>wp0OE9=eX#-=O5G^_ts)|*Y& z64I=uwX*&x^3QbUR_m)~pSlJ52KZvrb7uTZv6n6R{zn2h= zVC51T9J=%GQ9FIS{8l54HkwxJ{}vG%;J&P; zeogEDGt0I0_RXxX&x`E3r+WXv&gA`X1ly&ktmqDVJ`SN`ti4FWW{cWvpo=)FO5HP- z!B^g@Z7iTD!{GbPg;T@2PtDiY=AP+5LPgll9s3?kZZ!IMQCl7V`+f-jNAuSh^=4e! zeshwxa`cO)_x!e`+=8pQV(fb@gon%}J#0P?*~PAv`?uCb>Mf7_u2ItR2}N3Dr=RjJ z%ASAP^sYp?QxPdDb3Ki!z#|N<=5E6Ypf8pqdmV=da^1^%n@9ioEqNA~=xE-?Z;PGLUj7<(TeX(18aYi8O`QYQ?Msz;mML7o zvQW=EUj0m)cWKk6cRnVM;LWFn4XrOc7{$tJj=4%Ek56vgCnSPNRqd2K8H5#7uVZ7G z5x#Zc)aK`s+89Db!^T_A>|2ek*7dVqmaN}LaHUO_y;|DG@9aw8G_1ef=q4^H{VmSn zqoBzd&e#!V*Q1z|gUadVdbcx6E_2@Rw8`UjY6w3hKL3{dfJR~H!}N_Q{Tq2!m)wVi zU+q)wy7ZY>PJ~s^9ik-mZxOIpoAb2d!`SZjJ#*(^G0U@e*LZiQZ?G#YVXbh7T)83uwaGYo6%wTu54{zQ(NJ>?9d-TrP@sT)D znDqKH348_huk^9=GCi<FtMZJbyl~dHfma z^}dUX`37fLsR%^jtEsJ;)1E(M;$L{+STry4t!r|;xbNN8>tAZtyK_`q@=3qO+2ux3 zL_~YoaT!vACu>!Rx;JA*ov#0&iTzBgpbw_~0rmJf$>*;xs@dMxFL~|WG+gUGJha}B z#v|du!e&n*mk^x0b@mMlb4}x5R{P@<)Pnn8+}eAmUw!APyX$GL#c$?QZ95696=99M zufvT8PHXB8@zy;nnKPz37kl~Wa2YA(rnProsos`unfpQCLQdU@o|8x>7im=PVYM#L zVEM*T`{a{w_%Y_QGhd_@)pqTmA&R}dXi z#Fp$$SH81oP0mD&n%Iq3n+6AH9wa_KJy5J)npFHc;>h&b%h$_{c4@?yrq1ylzjpn{ zr`@SzUNwq49Z;_fqCRUMEGrw&tlgVy$ua!Id}xtR`7l2F>+=oS+{5+nw}0Mq_AHi7 z=8J=6fwPUQ^umj^dB3KwHX1!>tV~XMk@7t?{)Ds;%8EQ$L^~)-r)zR)#vIq4$sFUU zIJj7S@yEd*_1}d;6!u*TbQY|gn^QbIIA1*f?5*F$Ye7Gp6K;O6K79LK%7T!?1qJ;L zxbN{w@52j16@TQNyZh?U3Dm95*^JXAt=#K(Mv2sK;_m;LwV-3fBII@1Ms`p_(`TQE z;1~S>dZnUEHX$tQb|+>9REu6acqZk6@MfF1#dUX?xE;5qkzUL!HPjB_?M zKheLw=zi7amC`mNA(FYlggJEP2U;rVOL2xbS|g?h5mbBT8aLCbWd*vYLEpl_b7-Fwk&Yxf6+IBv3Ny;foQw1A{E;qK)x$7dgf3sD}NsIR_$ z!oo@~?8d8bc&)i_YXd=%HzoIajNkeG*`@kghJJP$wc}q|&b>5n>y}rxzs2TNR5TMP zRuFz;apSyMtfnyaIxD^H!r6hJ+ZG&XOIo!B12(Fp94+6tc(=^GCo1isSXj35<{PAo zdQ*>#Ol}jjrR_9jqdl!6ebA;i-4_|DUNP_32ZtZ@#Tic8T&l42zHlgJTSfEHw&><3 zt!Z%#j~R~47Co_&)&YY+-6|Y^WO9p2ewGxyCX@uu?rHM9uNa%g;EE|y-gQ!jDMVZ6;=u&*b$1^{I(#Q&`lC9LLcR#HMAuH97b}k|W4IF;p}pSv(G^9t z;S%+{t>d_$4`UOrlPe(UD%CBO3|WlYenKlt|t|NgD`M`0Ow`bYo&(f|Ka{U1|Ns{BX){fqVAZWqd* z`Ty^o|4RZqZhz+A|Kj}9kbm%J{QobGe+&5&|LXCVxn1&K+5e8*_kCD5T6n}Yo*HW- z5_Z^Zj(EPl-R#A8maoSSVB8cM)?LTx+FJ15-1neWk~68vR%Vu2L-J{i#^-nL)g-lY zF8WpnF2ARrv&g94XVuRts}70N2wALu$oZoK8%&b!X807>o=|1`bpILBhb4iU3-=uSR{)pxUr=P~kYM@(Wi|uq?A1ndj&Wjnu!VWODHfecV9b{fK_7Yc5>V%O#NAkNAw6%u#x(UeUPX z0@@JO73%gaw1I7SGsDUJ29Y7g8V1z!w_7AnCQUosx+~$jDKJ9+QTg=28$`aEBW^IoX%%$q)HX?rqU^`&<4g*uzlzB=P9hu5ol+SdtB1xs^RwW;JD4b?BJObM^%%pQyS}qp`AgqIb8NIRy>Prj2^Gc`N1| z-c}Q7lj+WM7Qgp2OT4etBn}+f^a$|n?mR4+zLH}c|ir5JSml&b*yT_7f!Ux>m zzv^+zY9Ed7V;ecj$fXg>PKgKTb51(_bD>Y7)Ldro4>t?gKHXV(D_OOE8{K-JOthN0BTUt9~dgKg>Y=U zHH2f~J)?Mdm+lBxZ(fvv&gs(bE!$>soO45=47i(_Tox7Wxuji#?#$YS+aen$*LMNxM_6Z`(^BakZFT!FvG-DJ z;$_|`q+bG!H^|?)F5F93Xz5$Hm@-7+->%-PQD<6n;~}$4sZHM9$4*n${P}a5X6}P? zFP5x=f=`Q_IlBH-K+XMQ(LF6!>f*DX>uk>yBe2sJUA^%cd)IbIUT9476tC|2(1Y)T zUCE?pwvTdlpMH=}JAWs)+4l2h=c_y39)F8_xBuM9RK~J3{W|tB?6Kcn_iLJ!+YLgB zSqJ<#$dCdhd96DqNyUVqD~|{osC^v=QwF#MXLj>|<$Z5;mJ5w})cEGMhR{gDLw?nE z&(yw(h{dXl!F4+heR{d6Zu%o~@feL%=fW%W{+9^-+*0yW-Hb>$ygr`^7@Ge0k$ zNZ;GebGsg@-8Ehr{QquJ*66}n#a)V&*my|r&A zl$>;-4_CY(Ty7>zrAj4K={>10$Y&A3Gwm+pd-YRN`_`e9(C@vhjY9U9B1xm~yBj}k zLZ2A7jF>sxV)s?xF2+m2gW+?)1(&*;W*+vJ&vCs%e=681cV(&j{85aHiHCrG&GWQ~ zNw?m*feBgbqcjhB@z1vz(r(P>(Jb8^6{D>&>}@y~%To1$A(U@VShILP4Ax(9@p_OA zk#98ex<)cCNgm58;P99r9IhKZ;=J3_S>5w|*x}aUDPLjV6cah)m+39Zyq~cTr=`@k zcEPE0JZDCO5~bRWk7{FJ^Py^BTc7F+cf<~Lp5fu6TcTuYsvD3NSy#9XWC;mj42tcQp#%XxmqZak1}<%ZZPtzsYp+jlMHyq5PLkTjah?J^ z1cmi{wQNijYW3TDs5b5pFXTU1u5Mv*EB?gpHs>NEw&DmSmX;SbU(&8#uP^mHzVEqk zvTEx`X%+!7-^X#iWt+C^LEl-qplL~!6Jiso;JAp(CBHE+te< z3v`5tNJP5nD=1aJHu@&ocj@NM(_ae(4lB&6CvcrQB9b%oD&^6P9~FO-4t0TKT5A%{ zu9pU-J)~kvO^iLUi^cD*sgm1He)0`Ao6*F9-+5(k$LOh^{mrg{epUNFY!QCgdtyu2 z`%Q{xFMkZ*Vm7cf!_1Fr;UY6%vyA4KPI)+esLMxieX=pV!SUS0k;!$()OMY36Ke3D zmhOVu+FOhLa+I9@7VcESp5}3xkQ)TmT~h6^b?#!c=?9cx8 zg)6i0oyLCFXFDEqzU*6Hx6e2A@#W2iGS@NBEgH9NU8*$2vDO}XtiCU@h%oV?sWzs0 z*zv3&<1r3r2O^saf=72NAZqz&r&o{leheh zO1oriZ15@;;*W>SIAgj6s-Hi(?eoNBlry_+q+9PbZ_>7d*NB-sN-v4WM(uWAyNXgY zRM6}mWU)J2LVIHAdyU3z-7ulh=C|u4T(7@*UM~@__t}lP2KD0ys8pNPCM{F%UOe`u za_L}wPwJ6VpKhcVZM)VgLx#v`G#ZXtWRFg za=zE2=esVW2u^~&s z>2?j<>A*u>Ly3hPIzjv>I*}rLdz{5lw#9b~PTj^z#e*T|tl!hUU-#WF63@5>cV~RsYo4LS%d<6Ox<%$~v+YLzug;AXspm1D&&Lz9(Fa+0Wy8<*lb)!{ zuiJ4v>fZsB)Q}AR-{u_cbCEle?Z1Ivl zx7Xuy4oCu!@8M(|b0)zG{8e8k{cQd>LdE1&p;@%lR_KdZ<;8M$m1r5zWSu zF4i(qg*^5=OlL(U)h_sEfAY=;_f_xh5;^~xwfXn=${hHiKlt|t|Ngc3CuZ>YkN*Fo z|NpJ}f9WwV`j7tm7wf+)CE7pp|KB_RV<=uZf9Bu+;{1E`O#9FH|6d&cs`gv{)#Gp1 zy%7IL~-*9 z2=aF$`@l{w&!0yz`ulkPB(@xhX^t+0XNrEh2V# zd4wze*(ihb^p}@AdPfxPY}SE|zlxB*K^M7lHQ*p#&`-DiHivSO~>8z(0r_6oC&T2YDfR z2mgI(8f8zwN+VPD1RytG|K;C2*oAb%5WXxU*5*o zKgd1!mvydd>*s#GqkdV_xt!_B<_`bmWn{IsqSDON%GhYxvr;3n-`Z9XWS_sv`&-_= z{_ZQ%B2^;0ySsRJ?V-54g!un#aG&LYXVrgx)+2yy*(pS?2 zc&#>BfS2-4zhBl1F8%mT&#n0ve+yspFZ>q%>*)f&>rD9Vc!S@|LjCs4ukE=O_v61P zi)uB$U*)9wZB6dtZ}OsliKhktByRqf_+QT|p#gyT-{ksF?e+Wh;}ka>{=P(=g^j&;;Cjw&JTDJ0Fo?uu ze^F=;FW>Yv^Ip1Bw>OoKWz~yE8`2+M-8^9vK5{?dj`}W@g6^YDJ7OdSw!JhFRrY=v zbWQ$~w#*I=_JZoVgJLW`{G;kb2d2-i)I^sup0)a+fd(+Z2+Y6^Sl|I12!l9Cfea{s z8jwI2jKK`d!5Zwq5y(IRPw)m`2!t4jha^ab49J8W$cI8GfpVyTI;e+6Xo3#tg?<=> zk1z(~Fb^mc2E~kGMRB3{Py#4%lnP1%rG?T(S)goCPAF#-8Rd!cM}?xIP%)?k)Dct~ zDhrj5DnON@%21W4YE(U{8P$qvLv^5fQNySa)C6hsjMFDh@UaH?3Uc&bFIBUI^B8B}>x1ysdU@Fqm$98=uC7Tx(Ho@ zE=O0Po6s%jc61lI7d?m`M^B;W(TivdH9a*eH6OJAwKz4AT8>(u+L+pu+ML>&+Me2( z+Kt+aI)*xyI+;41I)^%+x`?`rx`w)*x{11#x{bP%x{rEk)lzcv7vFGai*crgww>*q|&6*WYA>Mbg=V;V5cm{v?1rUTQB>BEd*MlmxO8ah@wE;FeEdiGh{MkG2}87 zF%&aYFw`*AGqf?hVi;r?W*B7{XP96>GqN*sF$ype7^N8H81)&=7;P9G7@Zj@jQ)&K zj7f|~7}FWE7_%8G8LJo@7+V8MZnZ%hCn3R|dnVgthn8-}N zOu1G*a8Dp7c!LTy2GPClqinB_wDzO@~nz354TC>`*ISD`Tr>t7mIw8)h44n_ydHqhV)c=VB+a%du;*o3fj+JF>g5yRmz* z`?JTg$Fm<{&t}hKFJLcZFJ^CGZ)9(0?_wWjA7h_lpJ!+0z;Ot35ICebWH^*KG&l@7 z%sA{gTsQ(bf;l2MqB&AIGC4{)$~h`HsyOO6>N#3D+BteT7CA6jW-K3;h?T=?V2!b+ zSaYm3)&c8`^~8E%eX&v4SZpFT8JmVp$L3&jv8C8*Yy-9v`wH8O9l?%bC$O{FC9D9a z2&V$43MYxvl+%*ak<**gpEHm%l=BE@7H2MJ9%mV6C1(w13uh;1Kj$zf4HqL9I~Na^ zFqb%&6qgK_2A3|EA(t_iIhP9;h0Bx6n=6_thAW;cl`D-alPjC6f~%UVo~x0om8*+u zh6}?@&&|q><>un%;}+l+=T_m?;@0Ih<+kRw=l0_E<@V&)yy3jjyfM59 zys5m|yg9suyd}Klyj8sQyiL6Ayj{Gn9NlG98_fcM;g6!l-L<$EcW8rqaVYNY?(SCH zNzvf$PH}hl;_eRNruQ8F04K1Sok@0+&HH$Gd%}B4dVoCeJX@b&o|2zbpX8p$pKYG9 zpT0a9J!c277|3{Rp9g0$Kus0ulql z{*&(c(IeOMvq!H-Dd5XCGddGGB|7UbnqQPZ=zh>n(@nEXQ(ws#$Qeik=%F(X(@J3{ zVWSP&;N{B3 zRUk8usP9?X$#%5kWz`{P!Nv=X9;E)8=s?iIq{CA6pGE}ZklJ5DN8J`X9Wpyao@mj} zh9UT&H2^`tUjRD*5zq!W0HgvI0bPJVfHa^KKmhOrPy-eK_kdV{Jb)P>1b7D+12_QD z06If6Lv=$aLuNx~LnK2YL&cpRJ9IlRJDfXmJ4`#oJD+xxcMx~1c2IYOcMNwhc0TV= z8@hG;M;cE1x9G~r1E+&v6VpD}y|;ab-h}i zYtd{0Joa{Gj8b(4!okl7~97eZBbdE8+>e-6fbX8PUjCM?R6n4y{Or(r{VuHGY zDuR-N8XcM)avc(oX)XVj;sJb$d8*)zg(-k3he?A`0>}X5gQ)UY4Jiz1cj&$+TqRzm zMI=U~M5IZj45tpK&?V5NS^Tm{wMaNhh6F2;(i0&I4`U&MP)s(TWG43ra7Xik863IO zk8cFWmX$8bM3ss;7OB?nWkgwfD)l#Z5Vl+u=6lWmt$DeNrr zEebB$ElMg(D&i<|E-WuBFCr?^F7hsXEs`u8DmpBxWfvo$Ccq)kCGaIcBCsa#CSWDd zC-Bdp%b;Y>VAo=QW`|`LXXj$CWbb3AWXEE!XOCvTtE;FJtb@^l)#B1())Li%*OJs? zU2#~^ToGGwS7)xSIWK1jnWu0uDc>3!!MRcTKpY3M+#^>hG&EFfR8-^Rgo1Zr?H>fuXH{ctL z8@8LzH^(;_H+(nGH?TLRHz_ywHz+riHzYTGHr|wh1!LZh8l({h0=#=!6tvH|MFc)MoBcG(4rbL zp9_yl@k{XY@GH}Qrx&N^rB`bfY8GjNmJ65jm#dbGmdkldc#ComWLx8&}O%)ln5x>re|)`=V;3`d95n^+rubwM_Ly?WZcgs)XvG8m`)p zvWhZIHDNU+G^U$ z#Y&JAOjarU&`{P;S^7a+s$HgCzE&zwmbB2h;Jc8tpt2x4FS}4aU%sHdu(t5JAW}9} zQouP)h>rq=;)|k!;*4UAVvbTLQ6dpDh!N`(`z6*W)+|;bRxj2u_H!%&3ZcA&Jcc}u zJeRzvJcm4zynsBsJf3`1aktrTvj(#=vsAM@vm&zsvwE{EGmu%DS-ct0totC5Mg|Ea zK8?AQIIBE8yTCqQH}5oivlulUwHUP|vnVq+Iz75LI>#{2u)wfXwpcc2wQw>+I8Qi3 zIG4Euur_XNZ3u0QTxDOCS;bxDUR7ANgPa$1tzxW3uEMU0ucoY4uI8-zt_H7Cu41i5 zuUcRVNC!{>zWmyg`bnjdNHUVJ2SB6}PcV{}F0@f*DGgASVxUkf0 zp_NZam7*gtBXJ`kB{3wSC*dM7Cb1?FAfY9RifdN*tq`P;s8Fns2RR(iQAko~SBO`r zo@|+nLH(Jgm8PiiO+!;dOhZ9KTtiete@SympGT8Nl?T8h!}Fa-o=1g8vRSiPwHeU- zvstfMt6AP1kR}nY7q1qtiw2UMPMTGjR+-_Lcb;~hD>w>09XO#r**{i0UN~Af<~rg! z;W~9ac0Ij6Mmdc=Wx83( zMJTK8kN^<*kYJ$*k)L3SY#M$m}3~dQ?rx46S7l5 z5sNVxF(tJeVL)YCXkcPvVs2u;XClUp$Q{KU#Ut}ohFykZlyj7=?5h>072CH+6 zc%mu7xva05SLx_-g>q6fFEqt8xHQ}}ZZvT;*jWBa9!aW6f=Qo}jFK>u2$T4e%#v7= z?2@#SJh2E>+*B$`V@eZC^GaJwb4okuS2))>S2+hc7dW>X`WxmORvSiKK)^x|lcO8l z)sOv|5k^+7pkY5odnJsalL^y(+qY^~zV+Y{7C*3`U3Vu3YJN*)*FzH**XG?V*U4ye zSc?0Wzap8O+w~P9g8HngyOORz`_-cZp1aI1jpdW*l$1w;buEVL&l(;QJbGWKH{9-r z_809Cm=&Yk1h>I%>ZU<$f9*q=y6^@Gn zv$_-S#dzs`sOmLdcdGlb{ei4~QDpaHOA!3A%mr?L{fO7y_)vI-XSL;J9M>CuIX{XH z{p}~?c4UU9t^Y^6F>rW2?I;|F)^5_>|Euc4{aZ#j-cA@?(m)K`z5n)QxM;H>D z6it3?J}KXrBbiN=s;>(|tkJozZ%oPfS}l}qx0#x-y)L&eSC`>o$Gi2(m;9Z?A2fKUg;tc znk3$#OvWG@Sc#f0}>KRyi(X5p9GD0NLf5dmOdj zEzeXq^ZYCfy5(tAKg#8;Y6y5v9F}Y)P%W$B`rN)-Ippzhj4~Rwv8hpJzOd?l7v89a zsgMP#zj2Zm{E8{dCz9>7$YeW|_;rEXvouPZ3Q;39z27D=nt$o`|#Plevx>8|I%7HMW`b6|Dg zh7AbYdL(-ej@786afIDiP{Q*-m5EOi$80QMP7Z#}T@Q{<{qPc1kmo{A+$`DBNOpzn?b-EoeyNRu$Ieb`>u4*|y zkc3Yx=kD}hdA`^P-es*hmChuo1uBHyg>@hlL;zPxT)<2Plgbuf_=fLAjZcXC+*3GM zR9H*^fn52tTPPs@4s@Dkqn@nluTQnsAR?WV{-y1jMQedtU?{zE`O2!N!$ zA>HB7DWHg`rzanJq*#mhBMUMr>YtvT|EQ>_0)m5~OG-<7L5jeD$jHxCdYy=2VPW6M z(G6^DkUKg%DTIVbkVEVlWbtl7XS2kkm|N@8~F^126FpI&5CQH{SXA z`JUcj_gu5o14?7XJiEaOJ$#&{3+L{{x1~J+hn`8JrIp&U~CKx z$tXjSk&)FjG=%K!nHZRv{R?adhlj(DPfhhft`OTI2isc=iZ%qF+(El~Z^9u?nSXt2$6BGY+!GC3Be1?S5 z;b>`T(J?WDVq%d0b+T_n3D-9^c2?@mdj<#LAiZ#X(qE8!AO7~{^KV?Ir+*w>T!cZ| z;1GHsEH97ZUy6HrZY~(I3-0djdLprC$=TR2n(VhwudlEFMZ7C3D{Bn<;CS86@JmWc zzBxF2_3-lgb9cunCnxu>9S-Suf78_^>G1y`wXwCO5D*~J>+<=GiHZ5IM?O709RQC; z`d_42(DJe-ujdWb)9Y(6WD*(FYL--1!a@e>S6W(lJeddpGQqHMaRD+ih5X=38z`$CcMAnE1*sHmy) z3JRd}^YeeVwGn1!W%VvE<3mE{fzi=OFR!n8g@rIQw6qk0g2b7bnFb%=cSyN>1+pxE z!D_8QsD^HcRDs&l69CQ2>l361topN14nvOK(Yv+=0RWJG|2DvukgV)oC4}c)cZ4i4 za$-SE#G)dI(V}OFj=Kmg)CrLUCQz4agE8<4{s9j^e-|x$&dHhFK6^vd>s*CfYg!42 zjYWHUq7rqwvE=pjB0V^)?rpS&hz(z$+1d3W3j*3<`y1=sL(@0eXoixqudPbu@VauS*&#wn*H!D+cxxz?DKztlp2oQ1f ziG?M0dU+V)NkA}?M+8zKc4!U`-RT8!D8&0udL7H3w3{@8il{lha(D-X4;g#BX+mTP z-hg0eG!GwwWdP~E!U*$?GOX$ya0+Y6C$3dexjy^AQ8twRaKQWu8ai3CQy*a zD#*Q6H!$6Yv$KOx5IC?(N?2dnT2Ub=J7lFpSc@4bk`3w>7fUEy+<(Y~;?D7$MMRuJ zP+_6m@VLt-S`hN^Fl1AT%&*Q?d|Ukeg(~z#Altezy%7t?`NGxVSBVCB$7j1g^1Q}Z z03xT@2A~kBeiI+S5)`5}F!};#WVG4$`UsIVm?7i!4~6-Jc}$fp`0xKU{?KMbySafV z773r|>HW43-Ld0HbAn1svmmSf3lj@}P{A%eud5YAAn8P1tZYYVwvP^OX@SiDobcPj zLjyZhX#5xmq~Z_pLhu6udx^&<+zvslE&cgQe56 zZGwu6>m44L@+UFU0ptjQGGYr~zQ&fw!_1};ie3_Yxe_|sg3jMzNRr_P8nvEL+tK4R|_H4#0+`6n3s z0pD=*NiiB@OH5(vFzCd7;|4mw+@Nzs^JmiQn@e;UCBnUASS0O#<`CyC^F$>K6d<+lq z672jgjA7B=@PW24$`~GE2JnFlc}?gv1B?O&Ls*GdNG8Rvm~Wf_0rZpLX?~bd^dkv!vOr>(8w`f< z9*j>!2x4D;#eF0Bw^gDB@Oj@Lx4w$+VFFyE%Y;nB?g7Y&^7If$#4Nr5ywRV&|HcS( z4M`8B@PYP_oq!nj11)5bq5&}v3PJpv1u6gyeKoL$22h0V6*a9Ml1Z+Ll?Q{M zCVm79ki<9%{J|IE_XQgxPZ41Qa6}F`MVE>BCIsk1Ck*_774nIq0WFUM!B>Kg67rj< zm>+^6>g0EXc|!;j-%Id6og#1nN?-vf7@1K&Od(sqiIPWzU@A#Yk_U?rL&=Gn$BG~h z*e1!_L8z3V!vPSXw@A_v16dJeGDfJB$!RDiSti zZ2Xmm0tz!Y_^T8RbOw;@>HhvZQ0$Yk4srhm1lwtE&wG7#_V7Ew&VIRq5~iXRWyit! z5gXHk01f?hcr=I!6~4uKX*;u9tb_*JQ`OJXKJQ+dz!X?5 zHOTXo9_qf55;~UvQvE+=t&P9r^gML4=Nm$D;-}I@b&LCJC^9D8nv09=TnIR3XSbc2 z1kLAu`9~K*pp{gFj0Sz8ladLd!ozcbY$!V^>2^kT$jCp%O%mRvLL2@RLX^piLUX#E z1(2AT8Myt0$xhD-ZViRibbzRJ<8s4q*U)}8YjA5-I)RM*{J-lRDQ(0GpeiBm9v0Tu z@8tjOEHbz3pCM2FBkFdCc03?BTvS9rMC9l6<>i2hVE8L?e!~35hHs3*q<^R#q`jG3^P9OpL@jAZyZ-6?IlYJLeF@${k0Jw7Uu zT&|b&^vBZ0DwauID{exslU0gR1p{Z+D-0sI00wR48eci{hl-RI#c64iy+5z!yZo66 zJWn2d6|oIESo2|9H+#sXvFHWGvRU@>8|wD=9g6ycsj6gZ;is>YTQahbyK8Lf*hwEhK6Q~zBPq1YM$DU^Sf8FWWdnaneI8YquHqKJTGKPFi{#o4b=au!=X;R5# zB-^^+$Ul1 zCpN@Oz2BJa=55kqWBWD#a9*6y?sTz>q{BR4{I(P)h8BZ{Xv2F|?Ed7|bBaqDRz6di zpg=}k+zvVl z*#ms$chE^$`jfVzsFsN!WiV()AKR+tB>#|X=3%(-(TZvya>E`!qeYo-Vt=|`(sdko z_H6sx)b~A3bIo|5B20kJDBNBr!joCV0R4War?r6WRhY(Bmv@ovU_S7euh!J}@xGTu z9-Co!XHq-Wpdzt7>AtH0s~N|Id%*Fj-QGh2VS<+c%)(XYr!Lk{f3sKF?v|5S(YwN3HTNi@X?YF<=t{=P5$`R_FFX;OY7q4-pS@yuZP*`h@&0zKE=sW zG+=q#k)2|7c298v|Lk3anP%KVFO4)!T-Q?gR{6o&e?z9~-{<;=Z|5$b7P}XlP>Hta zDDfvdiYgXvzX{e8o@N*C_G>Xy%BiNdvAjd!*6GcJm84Z&%Z-TtsmnY#gZ*nr#<<33 z$=u(sHU76R{cl|M#_C0cId0iQ3;NL2OS{o3@4YT#_u2(Frq+0fVct9S5>K9+?=!YP z_$8rUWd!(yyh-h$FjB&_FydKg?>T)y<}8+3z}LgTwA#xXDmMYxb(=@0c~lS}a~t z=#Q*%W|UZKE=PTr*}Exh((3!+!Yrm|r}oMRa(MkQP?p1#n$hntOhS651HC&l-|V4} zzE%GK9!J6W-76X4Z*B;~#gI#okc(Sp1h|`eq8RO5`nB9s(PZ8KUhI8>l9LVihQRy{ zP?9GaF#S1a`V$NQh5Akpa0%5tb+MVFP)7m0e0^PuuUyO6SXqI5Wvp~Aj5d0Ao#|6} zj1+YXdn)(M7`-kF?vlCtX$d%Hbg5S23W!+V34(4S@&mlVHfN2aRUug7w(zv-&EncW zb^X|^_o8+VAQdy7HGD49x5K)=TQzL2cZ^!Ujr}t04H!m06HY#!#gZ zyZPqokLT*$oFN#W!=ZB>j{$D&vL6#y)mL>BKx?^5uZ|1H(vz8(H1DQx`yIE%ay^h- zA6vV8-_03sR>%XJbNwjXYVm#yak6N8W&Q0^g*A;Kk zYH|HE?#Clb4F2z)t9wGyA_4Hbc+69WXnr5>gP}!yc6Y3@Yg^Ua2V)6qm*`rsM>7&xzukz zEcWB&@TcZ!=9awzL)KR3adq(2#c7L+66w;R^}#gwDmh7C61?JJJe2c(OPjp;##Ffw zL;?Q?c+AKoJnhn9eEXnHdl~xnbpJ4GkA#R^8rXaj*VYBL{3H573NN8|aO+INRAzL} z^=Jy@ndoWlDtGs}?Qb!^z5TP{euz4{VWa8$b{52tqlhhsuPHC`d!_60wfolIfw}do zSEQlY@fIoa=~YdwvDih4cjR|T+J3Vf{$+NCYxS#3zxj&-*$EOB+pebl1DG*5uZ5{3 z``p#7#pe0M6;YR1Ag_Shv!&wxPycRV=hj(`tVJrIOy-EOH{|AJcgpYgluMFSd}6m#Va;usQ?fN34cFl-m2;R4RQZ(yB#juU&W3 z1hTLeY)?b`QITjsr^PT;WKDZdN^66_*TaUYC#`TH?Y{7{?6nu^R<=^{8+gz@n zOE`q~=GNQNVkx5FbNe^SR~$?GEa-_fjH}&i%)xK9?Z{?hQ5fx_T1wu2b<2G+4qoF> z_oeo=AR(*U$6%wuLbQ>4?N!(2#p&dXCTH~g&R{Jc!v1ynIk9oK{-H#__y?vDp)N!)0SSWEX$4kj{y7)PHPD$G&dyW^@5EV;+ zOXlhH-YT@;#EYw8Ys~vPmC9EhpUVSEZKOUib3MXp^du7M`B^oRP%qjPgYn#+@hZ~l z3Vx+!rg)xYFf`8EqBArZ&Cc83(iY& zN{^X`y2#v}C8rl1Gfv$?;7DWlHDG+XOplch-kRpM?Vq)uFKyf_m{a}g${la*FI0i< zuPUX}Z?tIqDcxUW}X2^7!MObe2% z%q4rIp{upfYn|Ob?)}haC!ecpy_wX4YiudtW}# z%8Dy2A8Sjm6+1Wl*`}&=e1wN6QJ?2Tt9f87Ro~Hm*ByL4_sf(bJKZ13vh@9Sb|1AZt^HIv3NMpZxho9R%Yx;q2n9+Hr!W_kNM^VpNtOp1(=<=YLy zjyPGbjJgaEhtEwFU=FCIbQ;+{XH8>ypILMXFL%F8+SWZ;C0$Y{yFp?Ssr$={Wla=^ zNXy`}33gELkG@{(E>rRv?+-RE)*m|)Im#-~l`JM+zH%G5cxXMFRG@!>yjy|cKeLow zIdv~LR(3zU-EM7|b7eyheR}UEtPQUexDXn`phx zNx2@iewN-DS~vO6Q1Mp-*%V8FZakMD zyG}(lY0|mJrwkqM&~#{7g#5`4qO3vrs;0>E>)#*losSCD!nfcJL?IBTPser6#YBib z@|3>Kliy_AliOJJ{dm z_my*gh@_fjhFQz;4AQq}YJsdA_0<5v5(SLv>SEbDc3Pi!nIN^_H)_T@m-_sgdGKD&u-&ye+x5~qsi z=0CbqXp-ur8~kn~Cob%3j`N)jGV?P1ru5dg%W$@O{3MHrXjVi&-%x z^AWPm`AFA$tg7fbepMUn88gT2wok`*q8vkX1DCSiPeg6O2~TCsmZ+81DgKPPsM=D1 zCCy%YcG-DDOpANeV?EE-qJ0I&^3&Qk`)9R1^o~NqhckbMJOuuPziM*>X3+lZ{wSoY zJ=0pdc090dj8tgD3$!0qeIjdX z&k44!oMf7);^y2Vds)xCm5ezEZu>*BlC>#R`Egtcp96|n?fkVoJ!)3jvEzBuSW%_u z*7)|Gbz9Vem?R z#|qI9&lSnXk+@lmRoxtm^NjC=p)|)=UT!enjcaJMK#hG2TM>EeS?>B)OA?v6pL@`? zcTC!m+b?DNC%nH*bzHFKb}bk9*B`D=5AUg1qfz4*tF9=u&s(`Y1>h28Mid}PN_J(MEPlMv@$9$>^gVL%!>8pE z64le^V#T8Px}Vn*zrCzfu!di$Du+U@q0G}D)X-yzVG%; zQgQn>&)`1Ghqe{nG_xG_<*@i0nrxeBq-2Nq*iCej79{x?ca;&WSzb+DeoQd`1U8H6 zyZeNluGC4Cw`;oecE#!o+i&EVo>Q9+`F1gw9#*PoCFX5V8#gP@rDh+i`R#fnPkdVYzMuZG(toI^-${2#%x!(KzOSnseD40j9X!w|gRg(KT*aUU0lw%n7HeeHe;%=brcD^?3bDa67Pj2v6&~ z>H8+bpLxXnGUfEbBOV+S{*x!Uo3A=_AkD|8n*3!*`Et=FTS41;PLb7DuRPaOb6}e? z>ws1~=qT7^JGX8JnC+1^Z?!X7PhMzN)QfYfcB}X_w0Qn_bG?O&;$vS*Xp|?b=KawH zSlL2ZKyh_ZlY!E;+IjUOvG4YJct_L?*6w5au;Ev5?NaqxN2~WoX%i4{QRO^A+eiUmD4_eVWZA$;SU)$KhXTsVQ|v&v3659b)avkGz)V zYA`d~*ZI1+e+kU$SIou2T{fNk#geq@v%6gT^|;x>|9#kU<`MIhc#Si0KJDE`6!cR? z&)2P9a(_Ec$Hw=tg+u?cEtl5UvGwkSy!#jErP>!M?8EEPYr_qyw^BpTgz^55EB^0pI5xjt-EX>CsWf+vUA?&0n5^7que_kDwB zl;y=$7ckQlqs_Q%=HINTyYCm=wjo3Frri}C2iW+-xCopC+C2QaI z3a(c$7Dc@{BALGc*Tya&@+?{(re96B0pHvW7jyq?FV@R&z4zJctoE9|PK~#3-N|$1 zYnbh4%6BcS%)+($d1Sb=e=%}>mp**%V{Z3(9|12z@l4^~wIw*R`UP}ZSh$R~tw$On zA?f>jok!g53;kV(HhP_9NXzwI+#52S9du7;n`gxDx8Z8w)1IWM2=Og7=&@6cmj(qO!l`d>^;Y|%_P99; zEYP?0eC~5}4j9Aqn2bM{%}ualr~eW(c=p_ShNJs5mhTwkySdN~-3r=TLVdlRo?$3p zxfos1GaJyqH9|E_{@6JcGG0CMLtAShIvLm2vYc;5377wHU4Cw?*WmJU zsG+!>TM(Ad4P))vuw1E?7I=+mUod$XDY9G|gGfS`E(>M2Ia7t~o~)~roy)Ao(%_;P zYrN)1Pu0V6>#FMZl+E^so!ro@IQyr=>W*_)drnTZRo`O@q6fF>3AOIG1D{36)C9G1 zpaNOe_Pw$e3#JxOiJsNevJm|IaX2iG&%*dnK;;ECb& zqp!8;BMNp>=4tj|BXih`-Q4U&PH>Zgh76?TV7Uh+p{e8Y*n@d>7#N@va{K zzI&c;_})IK3!Gy&(?7r70)vMj-Mi`)zsJYs4=N2Iuh&ENw6+vd6+0)J(v)}!1q=WE z>zdAom|lTQlT z%jNRr;tcwAOe;{fiCLSEioABb<;dP$p<3v|$F=Vv&l#lp(s_T7|4)})vCqMEf zn1o2@ZuP@~_|+K*<%;FkjbG#L1ERSUjU)M}8tT(HRF2bYzOUl6^*K8{sFUTk+2l7e zB2$@+tgS45uy4O3Zvkeqe;p)#Owr#{zm`MMzGc-zCMmJc@MA5dJ6nF+db#955rxuwV1x2kJsKC6bDMrzNl5*t+qcu zmUU6umWbU!j;9Q#g9~eZkQ1-jX@7B3F0=+Z5 z`Rc}mcZfi)gM-CnMCoM8r*gcBQG!-U_<9$7Eae;_h8AY*m#9@N?eitZ%Tw8}{bz zdrdX#q|}*iReFmZM=(4?K`R_-;j|#W;d{5}jINGA?;z*POec`o^bFdh< z<#>0R9jyy7^r%qww?`Ycu0~58br-`4caeE)Ka%_XKW2-+*PtjdB`4^z(QB&aA|Ey0 zf<82#`cmNN+wpQ%Q@P(?wvIuMvy&CxpMf!>bIdDW?JeJL3m8@x^*8a~OB6mxhwNey z{gY_~cV$77MYb1w&$_6g58FO{#oFDnB*o?L@(T3b!e4@S;A+s;JL!GPJ< zMt+vU`E<7qa=$as>)q+#(1YKH%6&Fpxj+9;OX*nU9n(W?Rup1qy0gCr0`QM1^2{%X zNespOOFv;imDXF+{Ggr668|oQ(h=Vb0F?+yj+!;(1J!eu@(1CxM7WZwbRtFmDN5A? zxf~}`(Z`}&`kC(Jrb_ksluBxZQ#t-_V|X2kh9rFz^&_e_Akp!R?2R!9>F0dP!%Dnv z?>ODBb9_4$~JX*;y3x5 z9YyrGPIgib(&WBdTi+7uZ&m0pc5ExO!$n`gSHPq@}!HQPn9p;Fbt7%!{?{Yuyz?aEnMEBI<#ZU*VS57u`Xm@ZoEPrD{7+tk(wv)`{cca!P_?Y~K_ z2g5NlkW~wPNj}|ueHhuh4JX_@fAn#RkLpYGk|P|ClN0FZR~KpWUzl;%=#Ldy>AoLc zN;~!Ax3jQre}0nhu6vh!S5~pP)>!hjW?7$z(64oSYKkjQODlg}SX{iz;yNX(%-OOx zI%EO93(yS>*{>}xNE_pUr5>Z%nM(v_K~o2Az5J}+5llYFZN3nL__ z&F}mNYf`}Ss>`^E7Qv-a63~NcS%$0iBab*O^t0PauTVV7n&!Fgzv@$qBI~mzDpMluIi6QX)cW4P?5mAef+a(Q zyFYAKCl>;lz5ME3HPb2Wgx{^}X0lxcO`c-Ux8S(fctOhT0^p@?t)*s9C7nIHxpsv) zO7$>O?`tBCx2?OB?rOe!=iw;NxLDdl+O&7WrKI5=w#uZII&(Lj59#zR0s0CvABlx| zE$_Li44!WD_6pKwpT5j)Z`Eb{Re{x2cNxzQm0jg_MT%AAmi4l}iAL60Lang9W?c~; zp4-{(=rUAt0W^Ns8`nN*pql?ob>LOGt;bEB^q{@=7GtB|)|2R~WXh#$u~Kjp&_9J^ zf9kosOK{U-_BzJ&yHCKmtH zW(mTO6dBXL8+yyl+a~*K27av_=^7I__cOHoS*CKj1OM=IWv&x-pETJlSMcT7yc^TX+;nYbqM487|FK7-4TtTEVdLKh&utNmig z9HW)b<3OZ@2&vPtPqg3qW5jXiNA>WnInvGOhKMImaru11VCG8r$$KYr<>2%Z8#sP3 zx!nD23EXVrUY9ulYVIfi;3cv2PvdoLOIub15%a)>n z_52rRA1t^_zOhjIiL!17iRrQB7&49*9FlrrI`2EYQ#=hhATJs1mJl@zD@mt^_PN^R zavLqs?`Gj|P>34^M?Q;t*ZsEUiagM*l1#+sshk5Ev+dzn;~_d%?G(%>TC(}_R=+!? z(oNjjVOROp?x7-(vRx;)A(q3`M?clZ*>HOk+9cLFwwv+g;sB@bri3eN2n-$=*0yOp zTJC!Z>SR4c^W<*7tr!g!$RZ;-gM}m(z2P}J;@?mM7rtxFbpK$CP>6_9*N6M4CTr}# z0&CGFATLR#c>xE7NsX*$(5EW>B?uWCjQ-({X*H- z3AG{ot2WDBzH~%7vXn;A!bRB#&shc#*-=z1UQ`6~x&xH0a2%&lPR?@-VC!OD(ig{| z1x53a4Xl^)(P2qQh;YdCvpGXDF&mAuj7Fzb_YA}m>ewtRf}s=w z)9}mtZ*-D3;HE1_9S`uyKV#D>BiP0DZi~6Z15$gwTFQ07T#+ETaik3d>x^C)0kpn* zI*g*J!y2iPPewT49PQy%#1=V5p}5?os`PSlh;^X5DzuLKmlkc_H~7 z8t3dHgd@E1Mkh7nJ2>9dZrHVD75c09^xyAaGjkwXNWt<{Q6MLMv ze~H(6eC4HKO=%S82!e5P7|~Qu4(Qnfq$5-Wk!TS2Nnu+{{)a{T8P+NjqmZh%Ukd}} z8S{j<_&;9V47bIoi}Xe0_Hj^3B7PAMZy_-OA%;OKlW=9v$nS7uPlQBRJ!LD0KJmrD zk;+hNF_fsC3bGzvSej@Im@oxq2j1W4)~Auih_gAI)NB!kD1+1p$h6|1e(L}h1sA@Y z4ste^L_P`a@b!d|Z7LNZ z2gO8vNEOU{li2~ZRZT-W3g&_XE3g9-0OUs{h5u7z@vU^Q_p|%#b#8dL|BwOZ-M74ywyei3|)f zz&S&-MVqj2Z0kRBh^A9oBt~LnL-k3E>Ijn1w23h>xXaFM^gRb}!Y zZ|ocEk=ru0O?V0MU_Nn74@6+nvuDqzB4cL#lIu#Ul|inoTfsf7XSZPy?K3ZmRSry| z&`PlRZ#Cg0y^%WjkM^239eHc;TH-fMM1vemMYA?d0r{Wx^r@8f9)Wx5g5FRg4xi## zdc#HGjpTCX+Q0brPS+r}b>t?dV{#P0B1f>4r(lRvGged-j;n8)f@U`E($Pkbv7dYv zp(6d0K{Pdz9^VtS^BxeASU+Q{Ya=2>u#Z2AV7a?H7?2M9;s0a`^^Mv9mz_0hM{1Oz zm9D)rpinb>{IgLHgXdf=Wa+S3Oj2Dn;Fn-3W9JE!Gq_k4eS)Q>p*K~@=Fx3lb_cV{pUm~ip3I}zvM`@(_79{WK>vSut$I$ zjERQd*LrfgKif3&*El?j4lH;^sUz1x6L1E=jWUIfk*x&UY||i*eaDokC9fqp)?+ht z6p)XKNjbEb@G;6UR5#a*8e$P(H!$F%(;@Y= z%>hSB8sZ6g z6~+I50D3@$zscSX7RfAt(?nUcfzpjsCK^?(mc?8#G#RW8T?Yl$@V_#8O^5%?UrfyZ z4<)oh-4M7qSv@nfg~^BIU^}4_w#Z^&L2}|=g%tD5V$B3LMv6cHi@YGf4zgtNf<+Yo zgjG{26-g*S1qEiH8_47{)(=2aQY<1PdI6z>hQQv7iIg8|1;H*(WF#`n#o@(=qZ~{_ z70TKf8A7w7mFGCTupsG$LMJjpE+c$oW#IEToRPJ044%)$b?nEp1JFtNY0;{U{PbD1 z8nrqZ10HtjRIzeIvnFIa=qv{-Kefm}`RS8S%llXIDOEo>xQuVL8dWOPlUt6yw8KGb z+?li<&@2eINP-I*;;9lZFrH}f<7iac#mO0p6^-~14jLn}U=*k4VSIa&^pLWTAuW_( zD_-eGGe8f_6T&fh#VfJ%wvsB3upo1p;j9d{7mH^Q8LPlZC1BBX;h4N=C>153+^e;j zD}k;Xo#c`{@z^SK@^;o*P!h(*aL}&xa;_m>U|?glc<}=S93_;-3IO|JC3J*$_d zhOvDRgGhOXF-j73I7B$I;nkrm$Ck*Pz~`4#ldNxxBRKv8Wh~i}9YQxRJ?xiNhu%DJi=+WhFR)JkMfedAw>DD<#7zyNwrEDcga} zC)FlJUjv2~cWm9U95V0(#wmY681}wc8m-~kl$cGrIAo|X7$n{gc@J7RACR6z<1#z1yZ9IFI4?4}aI1HHjGw&evxVX)$`VllpxCWc*Fsm0uL=2h*Erd6(Px1v?oGjB()cyu*hH+r#kIk-Kp_~iw%JW z2Ms1latVy$ajV7^G^wycl`*nAf+)H&p+-8ywB+)dKvbfM@3&DvOrvb&q6WN}7>TSdX0%yf|0 zns9^M-)UD83^C#4oxBEFj1kp>!Dgre_Noc%c9NwT&h0U%SY+^#6lcxm1uvk8EJ%mT zF0oEKqbL&5OZ#Z>SPy(KgGh0t$h!n9BcgBllW3Or__{xtQ`8t|4x7o-1@f#@#TpH@ zThS09_Fr zwDRl(QOHF~QT3G7V3R|%0g0C=J1MaahIdKYJqMQ7aHg4pa_@M7>_M$*}tl*rHyO5Wkne1)SsjlZHY zPvD_fuJXyVv<#Cct2O}_I>9M};0#059taT<=vBQ;}zBMau34nZP-tF^3w)YUpRCPnejN;I}qyk-|k4fHj2Dbv^J7d z%wyKXOTwHvY`)du^w`M72AGo(vUtJa&7MQFg<1h?w=*`%PNIp7#KdC_K^s0~2Qr8T zLMF(|1j!NM(J3G~DLKXz9W8&RfVgz{mki=kQb1fvGKh{&0nyRPAUZBRDlrj6!+$C0 z3GE7lg?fYiScYi4U*bX6GfTJvE7no6 zje;|2txoTp7;3QacN@N~ux09I+iManyTCf*_L?DOHp$Pz6>0|^nPO5C0 zQc{3yfm`GND(b5bglko~N=?Z?+QifMR-kwe;3(mTur5*J9VKVL4lGAoJeYu^B9@#P zTS40FAI&FFxr~4|>`Tsug5(xu_tzqC_Il=3I!);>H7%%*vSFy{U3Az$0Vu}}ytFfv zW_8h0g|4mJ($m1?Xg-!U2T!ZUv#8Cb?rUj*ikIqvYbl%0kj89>>go`bGC#~@v$P%EY$5V26JmauGicL+j}33=l=8f`vgQgoEv251*H zEf~BxJrIZmqQp45U?)#brE^p+#o7VKOHnQi!@w7y0OSG@ zIDrEU05(7a3aoIiIjV?QB;F$8{Q|9NBeHml3O>s$L5|!rSmc}n%SmoRW)C!);NDr# z#v?E#m{PiesCZLK8i-CYr-8(zG?TY1yCl|*x0|pZWM^_2dqYG3_Ck>8=f)|UQ4Qro zO2I*PS3>}5`IapoQ0cSkYO{K@2ybIaO-o8K!KD~mB%;?*58f)F{T0|DD1!K3cuQu1 z#E7c19#m}KEH|ql)C!bMP#k$z0YB-H|F2k7Ei*vmEolQBiFqKq(eyj#2vu(~dL8v~@G`0cs_7m|C7B z<;LJRsME<%f{6AW8AUq+ho}jOk$AcIgi?`_Ii(Nu(NdVy4c6TrbC%1l?c4t@_rF)6 zjG@wY+(g)gq?6@1*k&9Zz;gP5hN!~!akkt$?6@fDDX7SZDoL2IUGcw^rbu^04><;* zp+K3tC_B~-%H%7Kf>RTr^0HYwioB87uXoR6=!`-KO)UUmXK1J+t=WO}0%OVm?Rk7? zVE@N{)Pg^*Ak<)ryum7S7?UWgM>X21B`G&hBppx`(AleqaP36FYcOo4ENK>ZcpLdJ z8eN3*=4c}(N_(-t1C@%L>w{@aGn>;X1EF6E$68(}-9XB2mtnsC)#T0zQPG-W zSuBTlY`r2kC<8Wj-58k$in^;SstEtkLX2LFNVTM9Qv!p`MU+f|o$Qpf&tey-6Ey(E z0)wC^NfOvhm&Ayc3{;;tG?le+80M0);erF#D`ey$Xf%$NsP#wl4yV9~q9zM0XyS4i zJMYv$P0C?p6%xbR(1~spkR-4+mZKzIP|2&Myz4DqL6Vfs2&(a`?I15mG9`+6yg(Pn z#F^sUi>v}Eo=wB2nmb8|V{l)_F$GaJfnh#YE*TwX`)~1em1q@k;UVxl4fo00Vv#nGuKvYzO2WHJKCVG8g$YffUNf^_r@J-1|6CO*55TZqoX zBX3P@vzt9$9j;VG1L4Csf_9!Mi8LP2p_JX8By@p>LK>t%hsxM^R+)ZjX({H;>1n1^ zK!?(>L+Mb_-Me%s<002{D6O3&wEIZEoTiG+H4O8dxOAx1bDGlfp>zd|UptXESQsb? zS`pwq=cS;P9k|X}-DNSmQJT#f$PJW15nx_Rn9oc}Kux#@7pFsWB!Pt=6#igx(5EvG zeeePc8AT(?3oIU~9Ht3*35KGC59$_hDvO?E#i;#v~Z-kqn79E#rKAnIp3RzRtOWs) zrGdHxYeyE#Egl>uS~H=P1gt>g^U$G8z65OqI@$x88v$vcLr8RJZc{bEE4o0-6~c(x ze)e7}B`MSj0B8yT7zhApCVw^u08jvc7V`JAUXs%t3H*6dPRq-&Xi?(Ys1=SoptDgynn4+qBnptCRo;RE5NZWX10Auy4Lj`=W7L-G+$GZ~Fs%^6ObVd zFa;pWlo}Gzv~@`Ll&EB!Xw%f4XxgGBP84G-H`EH?lZ}y7_G#1?Ze~z$T19%np?)d} z$#A(i5@MAEJCGqVd8op*Ez)RWd4JBrx|MYav!eKbmo#&>|t5SZ6jPkQ75fM^GXq%I1l&VW5(P?PMuC zD`H>LBP-HbjP$`=4v~cO2DMZJv$L7X3dy=-WDZu8&-`JO_I#iWK?h}uvR92)c~Tu{ucLJCatcHh z4y5`SQADh|Po=4yBD13$W>Sp}w0&b|IGdEMA|Z%Th2A}w9vQsK*r`m$?mi($F-~_m z5#-QW8kxYXIA}7H<&l6Wkdixr#0PHV3OzG+GLDOQVS{;`#>k{v^hM;aSTI~ zJjck}bq8V~RMP=4?UcQ0^sG5t2$OE{ z<#?qFlzn>?%0xXS0w===Sd8S&Rrh&BuUL1nQ*};>q!}wuGupFtXsaBjv8jWPYRVAz zX$I|qW2_+{QmbY}2kT%+iOE;#p-`qq3e`!kcx-suYjlM&br9Uep-`v9lc*YY5Dtwo z`I7r+93E>WsmQm+0>=o}V_TBc_;epQHK(W|&1C&}#$re8G$o7Sa+sWtoYwo#I*~?@ z&uMxfJaks^YTW}~4CM}EYOBl>D5pGjazdHg-lnA}%CR@kc$#dZg)2rHT6VocZt8mN z5N)Zf4Z8>^ryC^~k>h__yA#T@8sYQeisdm=sA^FX7|P+D1v<*1R>0CBNPI&myDcO- zA+=eIDHXOCA}B_Lwzf9erl~dw?QN7S!J4BqX6Q%p0+UmsnW|=hF7XG9RG3FbBV$wB zZQl7*W6ZN3>};mnH^9fY|0B3{u@3&-Rsl7Op`6*L6E zDQ{MceVFK?8f(xGqZx@pM{K=(N!8mf!8-KLfkVwwzS|nt#+^m^jVDUjLXNSSn z#x3&2TmnVYmtgm+xDN~yq-?>1l*8m$@WjI=zb6ZVNQGK~AW|OQt4b9jR3BBz5Jy|TgiL3H*9g&idjV*LS0s`GZ zP(^Am-<|@Cwp5DIJQjAhAP`=m&bkL|;D;>cq#dY2I$91eOL=riiw>Sk7v9(G1NBAXI(^Ny(-} zw1<_H*u`Q_jE+x_F##)uUt|y^N(v4V8v;AaF(i2S>kiP}oY<@>NOCeB%|u z;Q#&$0EtWMA_4LL$FIzR9{hjOenikHGxoo=-|zpm{c>p?_kethI2M&s(DTx;f$V`EJi5QK`Bic*IUp$}NbHVm6dQU}RQ}IdU zPQ%;y#YP6dg2Qt*H%<;V;df|?=|XJ5*#zF@><}a(vK@j%kcf1cYND_YmOFWmTpQ-^Mabu$rLMynv3|{Hx1&AcIBSK4CU2?T=k+o98t?v zZm~0QIPQajfhsggjSo6`CokrhIj2ii* zo``cu*{rDCZYL9PWs1x|7sE-Oa5@_jkvkP~=T0)(V=9#0W~Ko?9}k@P_=N}`5*R6) zr{Pn)>{Mkah?SAV)ww>mxH6JD*2J zgogtMWzXUT2Sbx=t~|>4eQ?h=c_9X_{5&VJB8tvw!m9`=n+_g{4`ou1FC(D))fvy% zkCkl$2W7<}G&NMFVEDW&FN`(-=Ria4^8MQmZAP*wrKk%j)r20(gZjH!#K zvX|dG6c}4Hbg@5x)11^-a43|K%5pY4qZ|tI%m9_7r&f^ZeXNkkNF^1N#ot?JT5JsG zMF79S>u`EE1+lB@yW*9)Z!j%JPlH2!>2bkh3AHfZm)m%Dr;7H%$~)Hb@kRAnb9~ct z(e^m+Sn}cwJxcormmvAFBl-5yVj|K`3&= zwAthqsJo{ShF?aM(6e@G=gO~2xj2Eb@-~hgr7wmk;L&f7w*fIJ@4Q(P@_Cqg@-n26b!;cDt7A7wpH`W6^x&LVko8G z0k(oIU=!E?)`4LFfTm#~jT<%qAh33gYE>%wqjHUdg8(oXP!voLfL@QD(I?QmVM-po z-T;8!phS)U$|IM>AF!MzFNDcB05DBdM33MGcNoin;Ch5q_)*In^zQNsZ-@c89s{aZ zu2be;;Z3O=V4T6A$7K~h48T}u#6inKBLKh{X#^nBSP0V~62VYt6TuM-MF&wC83wT! zj>Djc4v17Di3nGS%NQ{{QZ9q)R_V$46quYB(L(%SYN!qj!?fkHN-PrbgxaLG$Eena z>i`PhC=UuC>Iecp=yZV4;piX%pMj1500AJ3AanrcAs`M#F?E1InNb!u4U`9w1&AJe zAapuR1JT4k7^alNAY5LlPi6+^L1Z-isr=wJ$T0M%^X4D(D)TMZi^vcLxqFZVDMJb( zjRpk6!)(C8UH zK9s>V$RZ)vsbU~4g(m~%7t=6CD)qYCq?B=swE@UIND?{&33LWP00W787vV@8Z#Tfv zBq0vv(HZ1XL@bd2;efj=E`!Qq7|H`MeK{|tBhxIQK3Tz_dU1U+ZA=5#X^^Ev!#|=4 zB1y6kkR;XsB+QR+g^?uYG!ntc zLZ#7>Zd!$?EXEZ^x^V!NB{58;i(sUNA5bXc0H#mEPn91usw!^^A6nj2ehN{0WL^|L z5Y0$+F96TR&Ok>%SZ8&MLr3V*A1r`pZ)c!G&w2nL4$^>SU|D5f0?n|_2o7nYGHA$U zn7oOBagnG_r4FFtBIUX}YxvRQ8BVDCA2JVmxjvbO%!^K~SBA-a>Et>=At)pP7(o`g zH*d&7-0fr`f-Ai^0>C_l_!AEXDyzT><+3AW9Q+v}mo1db6ryL`K!r9=V<+v*#~fzIy%U?Z5Bd7Xh8#hbUFLjKSCM6Zxa;r{&5U z{R1jgtW>$mXH~0JuTisBZL&^a-FiXzfBgo*4I4FX5)v8~9?`T}^A;^zwQke4UHc9l zJ4Hryj*iiSVcOKCYpnV6xcG#`q~vZXscGpM-Fx)xMP*uPCd-!14#=@PINmu>5G7Y` zUVgzK06_ByXbRN_!9jtwYgVgLQK!@E38G9HgW;1;KK-;@Iis;cg-VqwSFT#MTD2NA zYS$*ox^;ts>ep}Buu-EXO~S$=BAPaB-n><-)~(yM>(HTN$H>U&Xp^Z+7qj{E&*S5h zlDc(ENl8oV-n~bU-o5+w?bnZ@GBat~X3Ngb$#FP1&gm3Imn%27pkUCTFTNNytgvw8 z$kC&}{BrErapT61pEz;Sq{)+~PMtn|#*80+`0>Ztv**p5KmVtn7B611Wcl)yD}VlZ z_3E{2*RS8OVe{rKTefc9v18Y+-MfGLZU6oQ2M!%Na^#OcjvYI3;?$|rr_Y`}ckaT4 zOP4NRzIN@#jhi>`+_`)A{{4p!A3uKbAFJHZS`}Wb_+LvozF88?HxA0 zF9{h82Z%8;92iIv_=0fY3rOHgh67)cG#Eg*!2n2ufebeoNYda7!VSKFH29L?247Ou zcv!vb<<(0M@H(N#%Pr6oBme{n^aLOQ0Z2VTl7Jvdye~}vJ*Wo&s0Z`_XVimwBmnhD zJ+hVvpeO19K-2?zf*=7wkb0sX35a^6Uhe(?KmsEmL4Z6A0e~cpfFuJ50E`3x0R#z* z1PKBNKpF`^1`s4^BuFv<5Wols5CG}{Bd7-g06`i7K?Z<&q!H930|){b2?7KV^?;G6 z2LcF!G!g_EK-43RL_IP90F7NJn{lcM2M8Tx&e2`N?03SU8oeiCj9zd<3^U)(C0Z9`8gh2-gCd(T z8z1P5=m~?5o`BAYua6%1>h*-LkDl;VX8;m;SrVZ{A`v&rR;dvHe*l2L5!spsqY)VV z0WkO*amT?SLbkAxKn(##+!&n^kB-qu0DnLLeWT45(a-j82pU{UZ(t@$ zdIA^&2;i?LfPVmCFzN||F@P}m>j{H@00F!@fbeRNyiSHgeE@(iTsAAi37{hhpbPiz zAnyhPU?c%Bh6CVF0^lD`03%5NV>ki)NdowXso zARHKVBrxj22_qm0BM2vqI+8Hz!co;mqY)VW0WkU-38N7ZMx&81`UAq~Zv;jo35>>Y zVDu+}(LbCp8cD)v3@42KBw_Rqm)noMTiND?cC3K_z<_LHJ@%flw{8H~ATt;UJunb@ zgRDypNMk{f!G@E;mjJ+*fMSFug8>SvFVGugL(kw#=z%YRJaAZnA9mS+ADUtW@G}rV zZyTX&w$-)KS1d9fYAFH2)*7w=>2p6=yd@2`2wK#1;9^70KJX?e!c|I`x3xU z2lRR!(EIrUz1|n-{d9z0uOsw+zJy-yOX&U71p>J!2Ao0%Xbd`_Lo)ym4V)D^0}>RY z4$TyuQ3sn(V$lG>0O*3Dxafe6)BzBz1G-=x8a_C5AQ%{R!EiWrMjfd$f?%Cd7mRIG zq+kpH_!zLg>4UmV2Yd`VB>p~d8W@1l#{j2;&gcVlM!i92^nu+=0^kEptzZCrf}y#l z13sh<=!12@Cs=3HlfdXh0;4_{7=40)QBUfOKBUg557rrdf|X@Z^}pq~2cgFULCEU@ zfux=!2y7(+LQfJvPeN^udVoM#06_!-00IFZ0s#R6p{7U62wW-%K#~LzNCFT@0wRzk zKp;t|-WR|EN67IXLXQQ2fZYm$0Re&u0D=huHd7xA2z@XC^uYu{;H)_iLDoT*pmJAM}$xK#i=%;KbhU72>ZRIz3@w32Kd4~gSVumQ0 zaFD+(iA#%qN+gcX4x_UzumbcxsKDl0>N%2f72JX?S- zr(ikBLTBfq_jN=$mEWd$QwyC9Vq#@5{s?s{4>nIynUpn$;ncTk>1+$+QVyA0#nzs= z5!<0w5EHB1+=Yl*n0yuF#%X}4B{^t_Jpp*vh93iiB zCgoKi+>M%d!Z>+*9*@O9O@*3sYN#jNHFyY-jp0JAP`oo;tX*O`2#|%|;8GmsG zlo2@nVbjq~zfhQvs-m+kLYB2fL_~8ngJ(TXxgu?G_c&;wqASybu8L6g6-9$`l??%P z8Z`-P*0NJ{*P3OK3WJ>{33iJp2|xkRjKJnHYBGl@utCKtC(!{iPc{V(^@glJ@Ev~c zGkdg1!9P`13vEe~1S0zHUNF4Z2edG>CEbIa8l~!Jkt(K`F;J^%3S0H>^j;tEKCkp$L#%YwqKEX^WSk~qtG6oF2S(nz$DKq9Rq z+%oM&g2yKf;UlfSYeCDekl>58-Q7jwa}DSS1sVoLT;U4u2^m-d%t3qCuFMoHq$1@l z)H1}Kl7-rv43^~7D7O&Dq(=RRT*H>grBcmk*Ba3FEGvhu$I2|AXj%wv*p_q`Lw^>O zC)5h;Y-W%cD)K-qaKMfY4iX!p{o5?o&UgTnsn7rwZ9vK|W!l+Hff5ST*@5bIFoKN{ zX%~kMp5g?0l+O&Rho0q&%V?2TUwnu87#g4h&-mNi zL`iU2@fU^2{G&xBleGb>ouN3FQ$5e5d?lPrSG_4!CRD&lRKDg0ZdezRe$RFTT!%n$ zqMh=(H&0;!Q0U~lcaLRL9BpUFJW3>8B0i|47E!3c3h^|cB#K1e_zLGEWYy*L_^wcv z`~R`_-{C;V-~TxLAZ0e}5wbOm2-%y8Ld#4fWM}Uc84+c#kdQ()k&LosmXTy{Aw*Qh zeZ4=Q-|za~_xHZ9`}fD^d;WTybDhWQdcDr;asGRr=lQQar2irOU&Fa(rfg0gwkG%g z`?k*ix7`1(_5ZJr`M-;D$Hvmx<9|E5_P+_}zZ+Zmy5@iHQu`11Plx|sGWd_{VsGSV zX8vFBfBo(Mc>mQ4{{jEC)#(2&(tiR@|9jxSl<*($UyAx~_J1qs|1nW8Z?f+kX03sM&N;o2aBK!zB6U~nzJT8^~_UPUT$P!B| zZwuPu*S!qOVe&gDdlYYT_Jj_$`PH{)bv7{^%oqM;|1`=&1tNBycfo`qeSnHC030r} zrGX!vVH=|V+<;LZSu1`w_eLl%)AT;BMb#gS69XHTq&Lv7R6G#x_ZjofeT>JXDDaRY zZu(r@1jwSj-yKWrK)#Be`{x5|5J_pavCOW6#H(kl{a;?8DmYH%6Q?%P1p1k~<`(gF zkj2G4;~)eZEiXT8;Df}$iJvod`OtqUB(lNw45c~FcZWnD;)_>^xywu%bS^A&(_1Q| zqi4<4s+k+om+Q4U?wX}NAIV{9S^N|-g zVR?$fQjU%pi^qla?!=lvf;@>M(5A8(^YSPiov6J%ngF1dmFeD}4(}4hK+5NY)KcS$-AxWR@3@^7v-&7+x#6F9X zb`r?Lj6RoWeZ_H{6$?$y;?9KNqV(eHg>z7zf4-QZIE_k&BL=pVCAc6zFi>mt0cMm3 zm&=Wt5UVxN^hSjd$Nn7C31*+fkH;x#@2NT3B_zm^M^v;pIH3ot`qbn2%8lYDh3gJSn^}NJ?f@`LHI`tPo$J!r6u5=vI z6s9U(x8jj-hOYRG*F}6>IW8pGl7u%@k0O5k%!K13UzXIr0^sSTVJ)EFLO4ZG+}631 zs0pSSJpI8OKiDpQdz4rJl3O=Pm52tQaJx6~8nZfF_DM1$Q_YcKvUQG7f(T1Cp8~xG zCQ$5tIX?G?EKDnI$M2I_3w_k3_*y0XX`dz(_QMukm0SssxsT;?cUL&okUgv1 zsDZ8bb$dBYs3uf5aCo?kV4|%z7I8wTp1Bgtzi*GYmGc!V z=k;Mc5y8#ud=9El5{qxO&*F~ii|Cp~X2|cM-z)Acny3~EP0lgnbNIdV(2%QWsX5bZ z6c~(*W0%_LM4us$xM$nJCJsiNce|go#DU}E!FRv?c5qE?aJ%$tC+xWAZ71~e!4=#W zS=+aOuj_{LlwI|x7>p@7FQW(TaxNz1($7#gEaG!q^BP6UKO7dk8W&BhgmGQ^VAAKRaCh=Q{cuti zf2R|vQaePjQYv)ihjIdXD9qxQ@(WRL=e*GINBIb|xBEO`I*+I_&M@yQui#f=@hW*D z6bp~%lx!0Z;-szdDwY2_N-q&k435$xrI1sdr0+Hym9^zx7gb@Sc%?)8=^Na3+0!YF z8pbnGTJ;;b8F0SI_+02xA$~GVXi^2c!uMxY%a_Go&^|t@yR(^#r3qh}THZMXd+AJk zxFd~jHsQo}xl}aD1ijCv>;#M7XHp_PdJvu@Ni?Vbj8^fJ$GHjqqWNmdVb4<|APZ2b zkG2`axu-UbE$Y`H?o`y4vh0s*JciCKi#xFFSl_&v8ippOvty23@d&w+Fefa$i3<{Q zo{t?J;7+VV=&JP;CB=bXyB~bQH>b?eTuLp77(ZHa50Zp~?O#zdvUPNa=(B#gb`?VH z7Lm;PXYhdf@-XLA5x5Kb-^TZ^VZ6+nRCjt2?1xj1wvt6dl}g^p@8~uLbjmNee+hS7I3`$0Z0* zO-@qzKF<`2LKg@Fib`>S>l^paQ_b*8IV{vru!_#Fj?NqJsZ}cziSY%yel1m&N%bHa60bx@u1B7X1hWl-AY~4{7mpugx`Bt`H1SJo3`U zT=2feNL@OZiq}qGFSdEILh{}pyRsX9F)LWqU-{D<1qCN1Skzr$egAaJX&xf*6xk*B zz4ZVg!Hw%VJVLl2VW~N39uK2FODZ9nEieaBu;lL_LxPCdd5U>+6d6+xyxCa8*3k|>EUiaPZBgX_I& z6)&?3PE9OKKNBCp_lKRmbuTg?oI*3>R3M0v%m2o7=%R2)=4QuRd_c#&#@ocH%COgH zCO>9kk2&_5t>A7YEc$q;e<#?0nZWOoLauA5Rn-4CwcHEk45loxck6gEVHeB)@i~$- zGyX&tgh8yDF=cRL1v|yOGF>i_;7u+$kZbr7D#aQWfgM9|Uj9h&l{F2a9!b5|hiY+B z;e|`DY!%Gz{=2Kk9D8m#lTgF~sb=flt@$c7nC#%}(`p`>RUQT3ORzEA!#G-Dp~ ze}&mxTZF;>eq7j*WEw#ccIqPcw(#P#&0EV~)u7OsXjVNDhIBFigiZ@;oQ)+;&D3*( z2u(DVndt${IeE8VQ1^zqlf*HO`0MaBoL(I<4adjXpmqH>b$FFg+(g+Di9|n6f^+8G z;JIqHHsu?IuggEr|GK7tT*I?%%PquUws%@LH77$cCgVcpena-c=cTHHh6vUP_Fmhh zLEP*6bo{$582A72^@YSGBz;gMeW%QUZWBU3S5{#}{%&_2)DggWBFzV}e02~s>9k^$ zXn;L0>s&_}3no`y4jV4BAmZ}P;xJ=(7>K#%jr$!!kOb?5Zo(?Q{57rFO{2p=zO7G6 z=sZXRUPbnIisF)=t?q?y?-BYmq~!aEG}PmK8SKB&p))sHU{N~`3EL-X=<*&z&Si`* z;ZZ5-cWtM8BNwsps44d6oF;xP9jsgkJA-WJlaC_mxpDb&Ut(koC!YPzyG*UO1u6B& zdk;_B;7M?Az8a$^?p#nTJh%HqTvmvs5G^S75ofx%yMb0pvmJ~YIv;zr-}l{AVw10>kU8TEae7~8xpy_OFuR94=?5K~--M%yo*^x&*&rzDG5*cDV&_ z&Z;Mfeab`S=Qg&Gx4sA(>+{OHkq#d5t&45x!&r!1Ry`m77bUfY`W1ZCsO0w8`*pto zd!Mg=DewuzhPV0naq}e*5iWd={9%B5m$cIcdK0qyqgOq0r1Y#1Z_YUf?0xL5G{^qz~7 z{tZy@P0eb<448>OZNPLKLBgEdTzg7rSf2>9O)|$HO9h@^XPcm7)lJO*ryfc}v=+Cr z#ZW4f^phpxF`fu*Jz+f}0J0+fs;t1TI3zK}x*9 z&*5796Q%Qx98twgKlg~-wKW{-OWnCEcNa=(w_j*BMij%?>Y#Tvs!FWv#-zpmd8SF zdBofBbGX1x{jwyA22(Y&-2>biunc~8r^(X@-MRlV3vRPOsCG&;UgIEY9Z$0UQaS>K z#B*uP20cjJeNdy7e;=gP1p+}Woj9I!r-*S=6G4}Kj?E`M#T_-P1}<4%sPg?(P$nk^ zX$HZ`qU@g-Q=652OkRgX0hQA6dtq?){JUOE$B2f`-%oNL41%$3MyD$v7@3FJM@T6< za5q?dKX<+zEg2)Cl8LvmaX#|!fnrbW3HNNuKbnS6>Dixu#H^sxqARgFn*z|h{=v){ zjNCcS%B`Mo=x1%#vW9kp@4k0rPOS!>^K_F&e|w6D25y%H&WxgfR+{<1fCKD(=zsDq z3}H83{NudFBfMdnCMYYNg1tg8&reM@Y>$sNSw=sAxksCr z)ve`q0lYLtW8&|s;sV91is6$lasAYJ;)CRp7^+vvqo!1ZXP!yms>%%FZLfHdbe+VH zr1b7N-Yx5eI`G1`zg0LxQoYAtXx) zhxAD&h;}r=P}P_Ds4WYg>54}p++M*#|CnA8;brV+rW#9`(Sesgqu1+LKk}H}lAqX@ z!BXykNyXi2&^jLB;`rqVj_77R17$|c>b|rz*6hYhvDlz%?bks+F*O)lWeSl^;^Y+7 zPq>hpCh?@A8*|MczEyr-MRuw9=DoaixKxGFYu>nt$JY%lUc5~L1H8Q+txaO;+r_Td zZ<3&(XzF*3CIS7uH^l9N^q8@f-*ja9gi;kzYQbp@&+o9 zvK82fh$xP}^EubS9qjToV`mGOi{99tGj2d-hHjKh{U7Zb26Yz$d!H2tQ`RfQT!FE94LM5 z$$w0O27HRM5|oAWICw^|yf?HJLkhb`E$w+^=&JkrUHJDEl$*0|IQVDzO(*- zSJ*wTj&~!-RA~KW?-hp2az5))(Q9yWf3i%?OAbO0qEo)Vb77lMYOj{048FbqHh+zN z*mTT&f3BYm)io#MDmPQaik5Xv{|tbN1>w8*9Ip{@^(|BCnj7@&9-il|{)lrUQ7tQj zMDQPYz!agYjO}R>N7C0t@NGIQdXR@5oRlG-y&X=%W9aBHX_9{!lRMO<{aghKRwHFZ z1KALp%nGm1W5M5?!9<79MyR=~{7cm20)b%$Eo+nt%t+wFy~oavKNQi1{n^{m z4?2W!5ZjVoZ6^4!d~#9N=`TXx|CrF>nup%~l)cTvR){`Kq`Ket99qJEDwe&~pwm!! zGjyyMx;^(vR3+!2w`V&-_U|HOG>$)caex)B5ocrC9A2T-&b7B>_$+SU6z?Uo(S>(Q zRGMaHFKC|5_k_vcg~5HJA|a{)gzauxZsw6fiTNm{XLA7tBVwNB^a{b`)uh7LQ5*cL zAS*PEV1(8jX=Umv1MZp-xHem9;FBe(N$<`ge4<3!A13f&&ep>Nt2aQzkZl1kdS=$49Jn~=?Q>EOs|_j@LSp|A`*6!`f#Er*ygr)QPex(f%;CX@cvnci zQ}M2qe~gC}-oiY;o@3vi=iX5tX7o}O?>}IEjMfp2dj#9tNIm_yub*cD$$QN=h6W69 z;QUk>m-S_I9E_?jzuklG_55}r`T;Z%q#3uY^5YC^IGf|0vk0yz(cGgh1N#d?QZd^A zY|Y)XI~XB{M++_l283q#VdhRbk}L+wzaI4jW3}BOOc(P$fOc4{#$YhLPP_6rM3@Y6Y*H* zuNwibzVADI#D@r>Gri*Pbc^w8%Hz#96)Sj!=1Es2kfK56g@PRUFb?w9-}t>3KRzHqpPP<;|KJugI%MJ^!Z zC2w*3kI$%faM|{WSVng{$<$qEH}F$yNmS*xf-gMla^1)ekm-9o_kP0zQ!R&NndCp{ z80-7<-uN&Mc`8ZfnB7LJ_V6pQenyD)>h}BaGa_f7GtjD&7jqx@6`0aFacjr9wzNzY zT?RkTcs8=(Ot8|EY5H6k35dkoOm5+|#L?@_1SD8nP0`Np%Z0pK$%@mYruuUgeg z2*Q1Fp1Qrf=$8%bv&Ce6jMtD6b*l33TM0DD>mG6dH$ce0qvymQ)i1mHkx4LW%{P_( z{uTq01Q%QK-=WUmg+A+LB-{_k$;M?Efo8xtpLE&?7slN-csW(zWc-gfh#(8Cxy*46 zc3z0;dRck8j0$hnPPx5Y@<+-`DZ=lv*_fXkk$F|v42@#qQt{snFp*a<^%PY@8^3P& zm7!_8jicLYm!QW)#N_GYN>uQE8W7xOEro%k6SXnPVQ5Wi_BQ$Jf!2rbM2fqMkgRYi zz)hVQ@|ul9rD|i4PGhpM(@O`P6X#gH2O~mKq9o&3wa~F)&Ur|x1Jb!PQzCXUxZ=j{ zLdM*W@Vw>~eF)n~B&ym_W~uNDj{ZJYcf4Vdk#q$W>_(%;aA}hStAPIWhsU zYi5L}4alJ%FPyIaLKUl54uov2RH5_fxlyk7Y^Y8uAgAL1R6Q1g=gkWcUd=aN-FFdv z;u@t1?;N2&f8fc|+#>kG{ksKT8(>#gajv?%4LOUi(-I^f;%RNSgHkmGPQF~-YJI1N zvzvmU`!eb{M?AEV8cd0gb!sPa^z|_N@#&*4llC}A|GfSf+b9wgC#haaw7{E%Mu~?# z2bA6wzm*?uWBue3otOGWSUfA#4n6)10}ChgELHc>DjYVho^S)pT>%4fqsO4p9>{M> z{1_b>&^T004ay@Syakl8;H0{K#UOGK0$l~CefET*P(7zK`Dh5?DUn*qb4O9!R9D4A zbQ^!C(>@nxD`qwo{=WrO`(zo!UI<_q{l zVy-%W(?W4_$?wV>6f4D0Q;_j;t6JQ5O+?LP1xqZg!~K4h&^$X z)X$63jtt2)D|4qETCsKCh{dMnC@AafxZFG>am2XUa>$MjOW|#n(~7w;Kh#b9OZPj% zU%WOuaY-F-Z-%9vJ!XZUAy*lWIac6F3V(5eX*b>#PijAQ3qsJ92cGq1w78SaKkH#? z0lG_+PrlAXpg5;`Ak=#b=lUuq+*D*yf8?ss;#V!`{d~=zzM}{>8k!HzJyOtcv+xQ( zu8mCUV}`c{I3YJTSjy*Tjpwrp2{p7ye@+=gaF3oW$G{3CzGH5T zl&W}Jk>1Mn;0m~St4jh&b+Pwr;Os9iHiTz6O0@0zV#O$8PV2THX8f23D8Ku|fQvXp zFV_sU3Wv_Vs7{9D4Q*F<3kuMaeP7=j--o2;r-6Tdz>Zzu89@Ruyf?D8rFyIa);ElU zV#=9V^r5_Wr#1nZ%@S|{LQCxyPI_WrYBt9ad%U{swn1#_}z z^3PSAQGZH2UF_CN@Lb%=y7*ZLk+nas{GzvjK;7*jg#=S1l+xvyoA!Zby7quh!!EYD zRn93%iGaXV?saWEJuI)yE9z5_V)+`?J1VYw7@f2A>LZ{+g6VAcdp8T*`H+>cd!roP z4e$6jt|x$u*L`X#Z~=~q4;l7l^YK)BwJvjI6^2?P?0kbSVX2^~$P;)RGxFv1XCJ&o zXHcm_jdBjW$fzIn7RQXsJc+&qp2w$ADpM#>@!3$8|`VcV_WCbT_ZFO#zQ@7}OOhUq@2M!M8m+ zryz6l>4BW!O*BaBrgN0KVEU;uhkI@Y=-uMBo~<6oH6vl=U)J5|mTl)`t}%nOn1ry@ zehTWh>^v--CLnntVf<+LHN-vdYt5oXre3LBs$(y_xuLevFtS6&x}YgrKlB`{fT5_DrybW*Z8K(ef)Q{3RHa$ zUmg1p08ZSxp6ss(9k*TmPX_FuR%FuOOg)2I9yL{|o$u&Ze&9L&rxAn|(Vln4TQUB( zJwHY|62|Q%ai5OY;g{4ME5*snU?-i{&9~vf>b&c4zxG4io#4xR)-H_hyr{a$bv=ag zIbX&r;~8#gXbQccucNRo^?Zw-ZYeN%TCCghNutv(Z|1Gew}XP&a~!7Y@&j?kD1 zT7}tRbX_Uf%puxmXfVPZ(}tT*9$dpewUWL~ix31otC)MYe;)PAchvP68BikfkYtgH z6~uXSMB863!1&rzqdd}AusvJY*|J{>(wTvek#^2dc^MKq`mG1&N5*Sby7FOdapS4Z z#}w3kTuadO=ft2t`OM^`5{~*RP8Ukjz#u4ZDL3{e2;MK{c2I?*;S5Ps(F#9kTnZ-D z+n?b=PyB5B85&q|A7nmr`VGS0DzB~6NWkL$O87{eCuUpkToK=BK}pS;@sFz-_{y%D zJE#5|^<;uebqV(Xy_V8kdLJ}}=S$DUFu=gv;;r!k8o2$rcd0$B0@M18<|!lu;GPR& zr*hcC`S?Bto_2DCEez@$)XWC`#z2%{XD4C?PdHOQ&cpbnnc~^oj`-`A;QE})0g460 zZ+0!nF?Q`zCuvm>HV)CXPJNEX^Q8Lr-yG?9mBj0pow^CPEe--wn^n9Q7A0FI?}GIj z|BH)SOjrwl^Qnww3P)BcsG_6iA%ddUy(~WP|Gj;J==CJ#;%7VqFI%D1-v7{=qyyA@ z%)3nY8ZlT(D$pNSgh)xIPqpDLsMk6a(RJ$=oRkx@!$QvB`;{ASGsjJ^N7sAgltBsB ze~{N&9rePi@o#UY`W~QTzeTL|m5DkO*C8zwnw5ufLjZl}=y9bD{-Reh)_Q2E3Q~AQc4uHID~u@+1(A4sjOY zvOtgXRNeg`YH*p}n-|QeL5W?os90Gw0wiAhw{}uN_jo6}!6j+fz2J~*n|TY}*s8IB zTxHZR>~}^#Pl1yZNr|L-2Gp64Y<+YfM5W#D`u5i=@V}AYc!7Zll0^nFRAt2|S(i!- zQryB?PkFhxf(h!xWs2(ALg7gJI73UL3Qs%~F2?*e#^jFyb3?%@aFdi`I!IP9ou`F2z#P1ZEXg?@IsCU;~ws{#=W)Ha(#SDXh z>vw=r=s7T!wH+b-6AXQ&Pe#m!L--S{Wxd=>2Zt*&Z=av`fMN6+txm-~SkpJ(c42&h zCm*S-3FY2HwrbDs5rsWe$(!utDj&fv^NRRvf;32(S{JX&C_=QW^Owcpx8SR~QL5*$ zg7#L%P=|#LEbM=-EFMU3lc&+Foct?}g)NKggRjc1|-Mxmix*~ijn z`$9t6?iObIjhGhmWLd5~OxxM~8;>}Tm`@E=u?n(?=4kit{IUn?m(n>( zMYQ0ZOsN}8CqrNr|LB3+QrOaXs>;8mkEGo6#`3j#OdR|owG;du3G|;nkO;OxYMF9^ z!omZ5REJJ}Wo5!I!(MY|0SfGDIo$V?=ff1maqG6ZCj5~L=26W`hGMP1LAX~axG%;p zNfTC})&3FD#H(o#W}bET3N^tQ`3Ie?YwuCJX~9%Etc`12Yk|v4G#Jw&xXP49jm+Kv zGMWd~$YCmE>iBUKdJi~tJ+9?o;PR{UaZA+T=GOLE@ngYEf7G47D^&>lME=&NZ5VN1 zvRd|;E}~k9V(yF6ecZ7c(h!zofU(8SocD+XGGxrSO*IEl*rVg;eLxoL?8cby!2G5Fh(lvbCcX4nIyY z)>Khp)$kjee#TJ~dVLH>MSnDrZ zL!BpdkLZK(%9nwTt`aPW-R3l8S%q@@th%qjFgkZc{oa!Cp#M((yP^B{5%-Gi`7yWC zxFS>UH$0vS@(mY;Ps^R)V6{#uq&SEoE0r7OlDE;vsr-1%$PI?!PT8#XClOz;m-lox z9dy}T6(2J{A^ct>MMvA6xJL8S0gI;jf3MN`^swC??Kq^^`V`bGb)GwX& zoF`nxr1ofqd1?xN5c%KUXv{dI6C{IXv{Vg zuJ#{n+kB3Im=&?g6J=0pKTF>)I*H_$_2uV3Wkbb=dhdRG3VM%hlV=Egg6Ma7^7Ci@ z;oZE3ZEwf`_EQgykY96vp{VfT=Acn*5MI@u`W%AXwz0~nsZPxN9Q$b*F@Y$JxTu4v zYM5Ek3Lg>si!HNPmqOeHuz1IUvf+vyW?dZ{PST`JP zIe_B2b>bTib@X{0mY$W^fc*yL+5QG=%m<#awBtVj^3H?}j)a5gNN8N0Eh9z!Y{y%o zSGq8)Idk@l!x?lLxr&|Mp2UF`uDGGm2$=dfUw?G)3hw86?8!6Qqt3X+A)oCfT*7H7 zD}>{KU*;QwzBj-m|LS^Pxir{>x-5iTTTqg$E<1J67ve3yyqW}$!~b8*qbNBmgnk^= z%-G_=Fv-u3&KE9N8(vC#zw`xubu)*KHeQ7FBhs^qvIBUfU7z$m@gTmd{>{~36a=;F zyx*pHBudnbCiNq~qh{76&YzwPR$}isJ(j*;%H_?tqpu{$?36;)36J5be1-B2>18PX zA`|&=A`qgss+QWOZ8%Dz-%%FrigfNa&#b<5gh#9Rj4iVwd|hQnl}H-I+_JgU#C%}g zSQWLjkHgpIBaG8luJEUB$$RW-hL4?e5A_JEaBWQd4LigkLV0uG5&08jH<@(w-B3hq ziu%P3kHa|9G& zB6_~rr5kBzAZS;hXjaDoa{c6c+$tyySst#@Y)0-0CrTD$dE86AZ*YO*8EB0{3R2&4 zp{RjSZu$NlNbwi`mgojTU%n>Gw{8T{i^KktoOvh`cD-|6k{mYwnD>$#^f0iyIM$J) z2>QkMx7XS(BdhFX{EXNJzOM4q+zF+_rq##2c!>fR?}(@wk@5!=17WucbbapVUm)F#Ln7KbSIZMaqDOJg1yBu@9%x&3XK+5F{KFAO~6W3C~*l~H@g4ji9dz?v+B|ih{$**MYa?PO4v-W9>nn6Y6!85ux z3W#gwGx$cV0Mn%cZSKxeWa#+vFqG9ppvFV=R1!UiuN=`+URDJw+1*k-XBOnfn}@$E zY{qt`Z3(Gy1lo%awTDJNg2~>Xz?qU|_}AvriMIX2;Vwmr3+myh{@#;w=D;{wm$YAJ z+79A$(3JBYn;)EAjrlkjxlkG!wJo`x17?}IhmKTlaFw}0Q1@LpirdrLbF6mo?qfxo z(54KM8NWUj(V@%-W{_F6)j}^C4>KOOQ4PmN(XocCo0d;c1 zMCCoKh-s?+o}PCApDW!7hy%tDbb|X??)w)I=uy9yd9oR!+kc!7d0J!N`<8}+Vh-4a zCz^kKQUF&W@n_AKQ|O)lM{86cf^%VMwlP|lVS9#%ed!Q2J}OZ9P;X?R$bvTd-z+H@ zqS)C8noA+6HDWAca~e0)%_x5sr-C4Uj=XOAE~=urt3?jqL)Tda8^M+DxZyV!DqvB9 zJkbmpb%VoT`D&^q`y>#{v9?FcHTqziPgu?rLxNyYnRbHOQ79ZTay#^q8+Uo53M%^a zabf*ym=K>YMwmvlh-*hssjM67C9RHvHL7l3SuvzOQJTHJV1k80*CMA5P6&T13w)kl z1eO~%DxVu#&=*_L%&KRAZovUYJF}CBpcy+*m~{<`8oeWCyj0L}_)T<*dmWPZ?;6A_ zTtF2cb^K=qQ@qXA{&R@^Hg28c*E?m;h1l)rAL8S35RMdhn_+tdf5$)7QPN0a`n9Rh z1;cVgZ1Cs1sToDSO2kDn+9eE>hJQG_^R3P>-f5p#fHQ=>DChX$8b<>MnpKHw(B@~G7{aRlv6 z5jR_mK*unwZ$xzq-cs>r;?@=M@wRQqKs7TyX1}+m5xEWOji7M_mJkT*Y$O&*&OoR& z;R4mwD|mC^fXkHr6GT!lT^{PPhiT*^CAQ(;=%H}QZo^?v4ZhP`QXqz(S7|O~sx)Za z{4F!QUgAl(o%V;4H%Ml36Af#QhuXROqUVx=VWO9=67%dG)Z6DPZVKV`i93vs5B>qWh}r{!C!9FhWuuZG9u57Iy3Qs$`Lj3f=3I9#`-On~^`z(Rhv%i;lM{@j*q%AsGv}EHi~Xx7mA~IW2wkw$j~{J#Vi}(2 z?WYBWDaitT=?|E53LHwad4^YRD#1KYNTCvbaUr;p7TLqOihP#m!R#?tX)ja><>Orf zarSh0VaqFVI%XG%=YFPeXFh<}F}jU?{~JiGW%n`G>_WHwQyE%D})z8~&}I8Gh|-O!o>^K-8!$Sv8f6By$x{as@S%%-)Q-BS{Dy zNAU#5@6SMVcuws~)lD2MGV?R8;e)w@<)bnZVc0tb>pnld2w}OEMDEmed_Vm)=z4w` zQr51lE}nA*L0*@e41X@d+^Tm7In^NYSKpAsFB<39FKDGks^RR+`_uxi0BjSc1j+wq z2JiGOLzV~^TsGd&aF=$4{WZ1~rdLMzq`b51bv+;U1Bzc#qSWE3UN=M%#ED9d%D_<1xZtL z&tX?2S(-i;RAmH*dQd5ro`9L`w55VpKhRFA_-NP+%qnDd2e@D3gN=2=(*vim5lb?} zX1@+UnHs+SrxB?9741abGl3^e<+>l}SMlCw`3rSJJH9CXn0k<01)fmlpe<4k1+gtpxxu|=eLkBt?t2Z2O7Nef_ zE@x-kW8CZK8IZss zhqr|dgN!H)dM$K{&I{Bz-^O3azX8Jc->(11?Lqm_$O% zq}BbMFWyIO^7x?(=SVR0JttA4eHclj;Vs>#RzCXiYv6xESGX4fnla8)BRYhbSu;CKQQb$6cBf~M48qlo-t$lHl z!c@IGkHC);a9v7$)kM9ICoFCPM2D6!66pEp^llas%nr{;sU;)+nEsBL&?s7pRHn4$ zH1WPtpT)6m3tEp!y{4&^Q2l12zQ1J}tOw0XWn=~LFW##2qkk5b86C(n{S)BRH&YX$om~;e*L26aBC$mIYt*iIJN^?sI%_rG_GYQJ*Xn z8Pxz?KpOMJt3G7Uvk>*iUqDD3^XIbWMzH=RUOAUFkBp}G`s9u`;a}wZY|$wc7Y!?z zmgEf3bmXlM@5}{Q`wW}gkdi@M%$l_Eq%L;!=!Zn5*X+QE+|$dtE(P+8DKCRV#X)sqyGPq98mbYZ z4F^t5Ahl~^etO3coW6n@ue+787_dP4tp7M3m7K3C;NQZL$fxbLZyE6BA?MY^vSowLj?zo; zlQff>+nIx9sd3kj7t+Y86;9?HZ9-keiNVs!yO4O5;r^pQ0ygK6#oy!uomhj3-q90~ zjMUzQz*F$ss>uILVMp6==?S`r+E{c=o=(wF!@hg?yuO7Ur1^=c1smC+)%C@wn&TgC z6y&@KE2D>4Hsc%RTf4Y5eN#iDg94ikWhy>*chP-bnouK39Eo3F4Lo4T$1A0wFJD>j z;EW7qD)*!|=$0OqFkaL{ym_g*M_mh=I}^0#SRE04(vxW6_!h=Av=uX~#}J{x;7P7) ziIt=6Po}h2Vf#44Jm^m<7}qUG*(AFW{M7cF@jGQ4_@+En-!_b!7OIT|u}9JSs;EiF zst?UAo`!ezLoiF`D;1;m6QZ=9#IeD*!SaN8%jIV{C`A?NsJ+R+reti-V)qmS{{)$A z8s%X8%R+##zZa@?UYY-BxuGmYsKH6sj;E?8w3EEu!Fxjc!z-Ov*dvwZ_;WY|H;SiB z;=-!%S@yDX(Hu?HfS&U<9t;)x$dm19AsnbaehOi`?`K*-V6k>}djZXJI#qxH! zV7+l3x-+UzpNe3B-4n~U(IXRRJ*N;elx2xSGPXw=bGcA-$CdsgAw6o&+Do`Ur3R9N ze3hk-AcnJ5q%_+UG5(@&YjZ0hHJ4oNPD}`f(~nwWSA_BHc$qXeZ2$`BMfDPRZ$r&6 z$VlHc5R;L|MSCl*qI#?7;*2dNp6^TAht`DP^X{NXM@bx7$>qu)bUwtg*7c+vlORl8 z6=SSU&IC=dGm+dRBYc&l-h7PxfqWM!3z1=4G@F)_MxT&C?p9r?loSbeR=)r4`Mv^z zz1S^!l5(`Up`z{8B~)uyi`u-hy7xVF)YL(eb%lW`XV zuc#K=Rl3JW>C%P!E;o36YKe<#E%5QFcW&r@4`R=4<{xe@!GL-Em6JKKNX?kzBOIzl zfNSUKb=oFGU!o!p`PYCHn>dLk@(2WlR_m@m-of^vhe>t!#Ncu&L+KVJushEtC1}oy zA6%bAviBLG@-OoHxHSPbl}t)rx$a|1AzR@yTLI4YNv~PeSR%7C#Pq|i3I+wbmFK^f zfSB&_ycXXbIMUfP=Y>5-!j+OwyF$i@QFrE!yL%k;c@jJWq{?8)yKq1zCg=*J zT(EpSf8oqrCO+CnnM`#4gy<&gf)NK1a&~1}(uqP5O642m{9X;-LOQBSlU$I#G4rML z@emk?t@C8d%g{r4zU(VU3Jl%v3{_nm!kaYS`(AXP&^F=za*Bl!0=Gyh<3@&X?`+>? z;fL!Oxq9{bU*~1GHI`qh7xu;1?v$F{GpT46*CUFtyNg6ei!HTLKYYn9)MUt3MT)58 z+FY>*26(GZjOmBqbNlgTcG+`?2$$KS@h3v)-T3Ef7B28^v|aV7jYgREX3zVs1iWr; z93ryUM+;YyS@lv8yiZ>m5k4>knM;&oG&?$|jeGMva+w4w@%B|*UldTr=*dlWV-lag za*Cvn>4J!QYm_bTH6EztZx4?rm?JNbME80Wv(6T9+3Uf=F>FUJZ71B&`%Y)7FzevL0HiVTZ$ zJ8srS3@HC?!q{|x1Txz10)nn_U_d+Z2+_6@j4MyHro9Nl{^ljxJIO{kq+YY+{O1D_ zmdtjWO%34p-fequ_XC*!U&OpwR0w|b_WOKMN>U09Qc+S7r9{fmoFqb&Ur|DY3Q1HV zN`p)xL`5M|k;qVy$PiK*G}53+G>`J#XPtG<-C6H?*Lu&zf8Xr2_g-tSXJ72k<#Rmt zUEWnuBoC%`W<)vQaPj^LdG-4-UUOpNd! zES_EL@)cpTPmPbeE`!>@ke>Eu{h075Pc^kW12Vt9;ks&C@`HU3 zFuH6^_2v97e5_z8#Ol)kohD`Ht*wsm9KFzd)aq|F#v!;oz2MLPt`oVIsDCcm2Z- zn00n8%+i^U!>jiX&p!MFtCFg1ziSp@%C4V>rc0_|MdZ9fGvQ3wm|e~qf5HqeocG^4 zEv}99wdyiXWue$39b2RQIvJ~e=x+MrItl@?>pOm!`#?iL@vEiQ4H&0&EYrR75bss^ z>y80eJas+&G5+;Ih}tU6X?zff-m>-&!o^)U>Ynz=zwrpd2Cpx^oN@vqr}VXji{C}O z(Bt;;1+pk#mGqoX55zIW>IQ+w-6&Fukyf1$N zI*e8G-n{>?`(EU`9MB{)D`6k1+CwwJhHMR&rSu zrN6_HF)Ck0-+V!4@A_A65>eRTIrjao`9_c*eLel(#VJUvjrnGxu@;v!Onw+`)5L;( zPxdYdIs=oJ8eRFDmGH!+@4Nc6SvZ)#X_@kSSNKI4T$-|Z9R6<0Z@Y8gJ1mcOK5r0K z#oWI`gKL|g!u60?j_by+D6nYq&Yyf5MJLwTlq(zIwPK@JM%;gpF)VrH|ML+7=WhR* z^j|GzSw!oO&^U%wI^`X6ZswzMZHdtPJ4-M}Vy*8y`3U5#daof@o`fB3FMFoYVQ6Xm zmHg$l1hf7dKIp6ggkF_P{Qcex!<$dbWsH3cyPMCB-Rhl&sKHOeGW!NF&F!;Iblg=O z@K5b|Ch;HYwB;>Vn}tC%JEY~nhLM<)?eEsmej80IneD%AbD+|pFcfCwhP_FnF5dmH z4k_=3$}+pPvBmWryZhiHmcEeuE*~)w>D|NLe=IKH?8T#F_BGvs=giBm_kAqKh8ou& zS(odeE+dd(t#uL~CrZvHQL*u&g?`n|HAFbD%xCV#qAE?hf?*YAypT_wtk^_HJ z_1C=XJhmKI{V(`!3Dhe)yefJgW4NU1*+AzJ=+_l3obT3+E`6Pz!BGPU)Z5&)G_?>W z4?2I|O9{l+6$L_C;eAllteMhb=>l6NhwqPCMIaKLUU(*>89lnzK@%ey5L?-OK_h7? zu7t+?em#B$vgOy9&DYVxH6zDk*H*oQGk(9=OQYKDK#o z(OkWB5kj;7bl>dC?deFr{`2($lWug1=icVlc1U)5+-Y;u5QmIQ|0edA zVa@y(lFBDGW4WC{dgk(E)R(cw=!O9FBt`q!=N-UgFSq-{roSK*wdAZxodZ-{_OUHS zA@Gav{;;{%7k&$@r4}mef?f+ZPgm~1k_l{6|DnUU_U%u)XXQd%DU%&xGOq!B;}u8s z_n$?T=)ynOb0Sf+_gBuT$8m@=6?IS=ISX%^m&~1^Ym4)#Qp;O{oiQP{?xORVJJ3F` zt}*4|bVvyZE&V2X7?IBsnB6aFEOmP!<;lxnG&WmVaEUui1Lq0ccuvqWk{OsaJP7Om zI(;8TM&QD!>;<#G@5W%krWXg@XQHNVdV=G;B|ORJ;@lJ4)S*u|E|UNG2W{O#IjMkCp7ZgK0Wm292rvi zpbp7Lw}v{y#L=jH&~Zje1%xE`{sQm+5nOnZa|e=Qw9sT>nV%(`2#`3C|s zU-^wP_zl^IbH|pg0v^sU_Ab$rL1XNTOFxCn5c8*K`NN<@tddO*XPWo4g5 zUgf~wd(*dKxnSp{eh1t?-T%4jN;6XTwamZK_Y_kaMm_juy&FYV=i<#mm!ZG-{f0K( z9O$mOcjncd@zCDtW~p&yCgzu$zTO^o1r8ez-=8sA7hX?orSwM`;E(P2f^EMt&_#cQ z?Nbjx@SWcY;l4}g8Q5u@DwzbYpnIZY3PfPK%5!D#*b*4M`!&UR+-ux*$O;|Bg5WWt z?cS^nN*4e6A76>Bna4<>w>uL3vE~%N=+>dIr-J560iS#Q{~%V=>LbcIOoP z)2Io%E}tOu9j!@5jmP}2fqe8UCcnJ|fsU!3G4H0~b$#uUD@7*gTJ7Nb$)X9lR|k#_ zTx-SK$Ll&pqoiS;sI9&$;SGfE&fTb2laHlZM$fIy_hQkFU`+x1g@Uz4T|w#;EVT{X z{b%HREH=MX@VYb^oimJnx9fUiZt(?8hOAkVU z*{eN$9>CAxfav`Rx3KoWN5jy!Wq6(B7+$JjgzzF)CN};Sf>ozq)!eWhPP!9HNG}~8 zdQCBP>vXa9+lJpy-@iqd@547u{Y&v|vh>lahAnu!ExzuMcOtsX1P0SDPJrR4;3dmc z)v@r(D9H=GQ&E37{EDtd5bkLDhx^a2MrN#IypB6?h0O_XX!wIo3t?=ovlI2VN3FD( zvKF>pTbg1NnsM~B@vgHoH=?6GWByT(@hH^u{8;lf8lvNMdQ^%8P%^dsNl0KSPRdEQ zuRdgn8o}k0eMGWRJNmc(=K4m2&zxZtzpw$v{nsm}yEWtaJok08)c#_cMC-^kE48uM zam=sEhu@JiPszS~sT#r}n_UjMc_P&+({A3H4Y)H+QAYceEwppIQe#D<@F7y?@$f-4 zBn29L&JL?b@S#~@oi-aV+kSWRjnr%K3Euu|^M+-RNE>I>e=P%n_8C4Oo0TBBarD{z zOZM>2bbfYc!#=1sR%#^nmqRQiRMltrI<_q@l&GLRD0vw0!Mb2RghJjJy%Ko`mv=%M zCtvKx?bXAw-G&h`Jki~@`JfE`bbWL%k9EgbW5JTE%S~~xAtqy`Nu=ZzZvRE z67$sm>A=j>R4o7D6SOV3>o`gA7y4h8zxs7b0tz>*<%iz9K;yY5JAJ3T!r2i83zv*4 zz!`(+<8zke;H*$*_Tf8);7z6pnzhcD*;QGy#6|{&11}`sIZc7&h=KsQbuu`RwfOk0 zs(Oq&_u=V<*6p}3Z@O5<_h_icxk=lf&V!z&+y}Wo8}Rx1{5y#Uli(3^VcE~Pr^xyq zwOb_SEt>OY{@des7T;X{epK6EiETce>s$WIMoz`7DuvoRFgEF_O+4!hv2W{_ZWN41 zabL-k-su*2cRFln%d*7?oz#>0>3Sb-|7$w^z~DT_nCQGn-R*?Xx0hWK=R0Dgm*Ece zD^1uI65iOa!!fQ?w>q$qJON^ zeXp2FxY%czDlp;{$h<@7X(KJ82{bcf~mr1bk86D0LvSj=60TFz!4Yon$dbLh&%P)z0GoaF_=Dk zt#!#u6hz2LtuM7kbo{IS1mg_2zS;FVGWH+Be@bel1ZYAgH_~tYT|1aPoabS?wg{q2 z6mKNUE`tsQ&lm6hj$B0reOnWT2F<4_`py?nd~@RryCcF_=Q?WU(n3Gfr`WBqF7rZk z-x8hS$W6Ha@Z#RiMJFJ+*2UuQ_1B0kS!lGj`Vm4bi$wRUwR#OBj@csZsKFNvw-<;x_S!jah8=S6>OP-U z1NeCDDOVesjb{hKKB~41qJ6N&E?p-F7Q;%@q{A*iAwF9bfN-pC>G73&)Tq}3-L1K@z z=B31cFz|Z)Y+J}lEKz@VT*15@O;5gh+qWiR;+I{affjr4recL%N^ClgUVR*QUHcT; z?lixzbN9ux($K6*TV*V`f7iO;%oaFL6w2+JUXH+hHRhW76XEfzDqO)xA3hb!R$0n= zLt9z#jm5}IaHx)|Fb)fV?=ar!1qr~?P<2B=_fnJ|TV4Joq7?2E&Q!EiSwd*A_^shk zHk>pKW@nD{My2VzB&Y5yBal~f4Ar$&T+oB0?wLgYR6+};nd(8lW#Q-!gA`j<@sXH+0iDzoW#(h6Kt z_LP=>u@JA%eYE&8=MmoAoY-Jf{TLIL&ddt@RSx5w>Bbv^XTfTYY3QC&o+$D8Tq}{> zk8sP^@;4`^qSSBO;y%4i*l1*7cJGt`^y9LPlKz!pVok_8xAm$J_iGZK86s|@1 z)_C91z^C2eVX=EHp!D^%!xJTrag_~|RxD_OQK+k@o{=S<6`N{%i?m^CSu=5R1N8Jf>Yh6 zY{}mlXz5cl%J{V(3SoTsptvU%g!X$dUOlM=CzwFA)H%?&vJ39O{QxNW4 zJ*~^$4x%D$X1g?|LgR6&kr|J}$j~vCr$mi#zduW_Pb?9q97UGZX3HS>(5t5ndR|x} ztUeOvchEFx^|W0r-Z;CdVUqE}TS)tAYW6(bAHO1Jba{-?K}O16Q^!aTs1A+k*zxxP zzRFKh(m5RisoxGeulB@XOl*uwqwP&R+Shh)ipOERR*%0B{Pqe0*L`{(P{!~(Wy~Li z)|1$*b2G4YW)I#Ef4G=rHXDcL2ibiru)&9s()rtdR-yQ9m$CO)W4x^L)xKU^1=XBm zd$UT!!Ofxr)=t((l4sNWjmlz}KXZhF&0b&Z@_GH=(Ml)iy#Ad%J;?)p2ah{_5zoWR z?D;_*7GqHn`Jdd)BrTYCGxwqG2a&f_^`_`(O#~cEnEuN6B_jVU6Z}#z86{%shtogr z#+TCtaao_ckX!S&u>9#`j2B$ixOw$aIJrvII|Q^NyyVjRFIOAjcQab$W8Nlcm&VCX zT^foh>vfOTRU~6ysp7NB)1{EDdmk;4r;jVy*3t!LBN31(@3rEr3?=*1ejL-+uYU`za$(Z{757+l#|U zXbCpnT4RYBR@vKDSv28?{v{WQO(t;Lm{7f^+X_wM@g<>_UeLBUv+}c|0@U0afBiOV z!lH@06p|!_VP%q5eqc%;#J#taUR}np#=>y9>D+m`ShK^`bc>G80(6_$C7pZaqhx#f zO~l?;yQZGeElpWgY5lrI>4P8ruVcyo<0tz6R{zV)|2OmhzkaCyr|O-eqerbjx2C@Q z!h@XUv$_x2OSgt7)oc@8@U3Cv-U6u<6TjE-%X6;Erh0y9$jDr+sFtBLpm%44&i|>- z|I<5vf9-XUb&;?uz1n}HX0T?$|J}3iOygsI-Xh;>buK@l7^{zrgl1tk4jf!cbL+1X z+}|+Q$!GpQyB_=4Q_$Y8$a0@ZVq@H(_LAXJ^Fhiqh@;DUJ`*zPc)F+s{qHp0j~mCo zz7M7t>C*_?LTVUTzTZ@LFHe`;EcURK5+3mDyMLV)em(%!&L8z>xdjPy(a4HYYsD#I)n;Z@*@e6tdojD>5~62z^60qjr2YIRMvPB|(b_oH zzfc}ZhV!^-+Y4v}_p*53YACu-ARVcjcvfnTmitcVYS(3Y_F-6qwG-}oF#+z zGxS-Otv9R+{6I z$nVx&rfmiwc`$qVRFQxOgvxkg7fg^>GUZH%~+L8AjV zbJP19$!kACeW=4mN{kr<$T+&O$2tVaf{@n36aTC#iyB`Y_=zZ7Ojh;rmnZ zPN0A~)sJwcsV`~Z=WBL!ybu1mM$u>;Pdd54h*ax(soZQjzgH?u7RJHs+{;p$rQ!*b zC(G&chQGM*D*})1E`(Q4I~=Z!z_#SgXbE*<0b2PGh&~Ug^TPD?&{#|hmZi#%AqW;y zqaSN#a$A{x><$3G6QYSf2P&y4xdfjjI2U?0nhpz(W*+Jm@X%@FPD>&X`67USvVKY9 z+1_v`x$8eyiLo7 zqiLhpSh^HfL0A7wr-!Wt^ac;O ze$KfYM_3pIsb!^8Y)qNjV1RdmCD|PI_dT_Lv{}@(|v#{(R)Q+!m3b(H9!w=1w-Pl2o?y<^LF0(u9Zk7WZO|6S$3*_IQ$uy2iGi z8$&$CjGGTOz)pTHOcut`3+e6bsL@e+IoFni9)^+1(0lA#6^CPud*E*ui47)i@y{v- za^#IYLmWoSXQQ!VCVu)nW9Lm~BE;_xd%p7xt)16L+FtyBjAtf$CQ{8aeKH!|$xH<; zuAQ)~lLdLqdS#UBoFjkVGO{&Lpd``JsOYuh!%7C2 zUm8b2TNmJmq9l)8+6vjTH`rcpe+&!{Ve7`%lowIQwbdWv#8_dz`(6e<(HuG( z2Otr3oxdqGqLdynenT?@T8ldPW5-;)Z4hMd1jbXS#&6nneiSyW{7o~Kte|kc0Ary56A^>PnB4mF#y*>~Yi zoUF~No_Vi`W2EO3Msm243=7};LzX} zCNJqsi~k#B13@eBW=SIV8nYTt+V=3`{8zMS%P?0K_&^8#yG%z{PJydy68~N1LEq+? zqP;^3uP#)RN^K3ADV=+-4kEq62Q0if2r>6(^H=+3!><1)lXHE6>Y7x3;nyrgHOTOa z9j-WKTZ9Wov#G>zBi|qVgI4G5$F=Gz#BWu`o4wPq{oXAu@))qO$Ry`XaWWMggSU}q zNl17fGb~M|^5jCS3b=*-pQHHg3_sc+_mQXScaVtM0NbUiO=lkD@{2=<5%!-U^D(HQ z-kf$!Db1oIBV@4Z$_=cj+R0i!S(5H8SMstDM#IKAB>zr^luGSs(fyOOrY@eA2j0UG zmGRgVdWp*XV%bVZ;QZ=qJU8$!seZ7czlVR|n#*EdFuInUOmcDZ*)=*Q*+l9`ICLr( z@oo7Qh!`zG&k{#kd%vCxUV{wW{bu0{*jKt*?Q|TVx#u}+UjksFF^(^DS_~Tl zX}T+@Od|(np;WRPlaA`rM5S74U9^A}mJ8yvpB>r`8=+7ogQoovq?EJUuxZj)ycWC6 zXRmFh{nO5|rXfq39K3}&JkO=Od7ki*Q%9khF{aokU`pZ^b|*OwJC*ihv6DX8j5TE^ z+Ow%@SOW1?3n?@-lh$n84JSb>wAK{S)09ulAf|*wJ4 zm3Ai6i8VMMeu%0{ezE3!!a==A)Q`S`d6OcU1*^sCU`@Wp;2NE^xPxh~?Z|7H124%@ z^u$e=GLEi+^8H3O&D8>xH-gct9s|V-PWJi{^Lr= zRY-E1KUb~~BJYuVXo{#GE;(5;yK|rE_KPZhL&A<8Z;^t+ejV7%c4K2ljE3o|_pGq* z9>!`$upeLT;8hokLz@F(*w)Hw>x8MG&X?Jj>cjJd9ox{8Pg)`>?C7p%u=f;WTW5cy zfR7q{B~_F5G6@P$-%6bmKOnAtGumM$iat#7Pp^NM_^J?&&lIet)z zmZE}rFCpR|&jw?j(x_vanCR$1iw-t1(|5}BRP!l${Fz8I=E{&uSv;*TmZyYB0Xib6 z#CCmmr&m^Ku-uxC?m3!Bk(o)Wlm9W@y)Q|1{(mUjb)Q5QjK+@^D->@2z`JDpF)PQB z=L-yU*y}8!H-Ko{3Pu*RYu6L>f_ptm^C*EPWYEKJ9flnsyF&>5pGwt;o1` z4r|`Nq$l?*Xj$zMtPmWcXNJbu-dBK3#W1Rn?t*cc4gY=gAWbN^$kg77li-9Si1il0 zBk|Kzr6LBYrICD@tSHtu=&_G}M=(?RJ1Sk?V$$*nBsuvot}QNu`; z+Xcxc_%bj3mq^BbKhV3$5_0mhINM!CY4-LQRSxEtf(G<_0a)WW*P^k3eQ_2nT zPSlJ08oZ_-`cHV5{cHG&FXtD;Kf{!3vL>(ZR2XN--mTh<>93yf^Gl{7yu*;n&m5-( zDjNK)PZ4%KxJ7X_qfmAD0Kd62j#gI(=C>Fs9fg5b+(-Mpr+)1ikW~h881DR{0FkZci zUJpvq*$Edg*Ww&DTAgRoe+{AVQVLIs-;;044c4D*fg9^9`Qc!D#EOjNw{}dyvdIl> zk52{}#qVatr$s2XDUs2U4bU66klX8wp?^a03}=gI%u!o5`_W{$hQ#s1nT0e>$pdAT z(o`%`%C`!5qxnq`eZRe%ey>_bX5kwVlk@~!XXE?d@AZ)LDlL{{2>YP6izIBT&-~5Q?TFSskY!1R}V_`M&6pj1y1R@3V zDC6ZbmZX?MFRZFr|J_Q++?&hGg&*Dd@c>W>!KB*Po-vr>_qetxQHgB|D zR;J=|3!0!J&BGQi#-)>^&{*X{Y+^B;f8T^2Utx}p`*>uXPzZzC{ef)Is;n33ah2UJIDah=0; z_~|Ew*}{+TX{io7#^n$dQ;cIvt?^kV31|$*i+}Fiwf{Djs;V;eo1LV;yn*|5XVGhi zGzvVqjw0+Au*f_C${&c~XKqA5+7-M}DCa_aNjZ&SEi5rns^69sh6P zc06AAoDVjHAV1iOyHvMeIWOg_Os`<+r2*a+@`0}HxXdr4PQWB3N%A|`f@ec{{P@ps zgsw`VoBk#^^Wi-I)jog|PrR{p<9Iq`Va81Z&mo{@fSCq(llFRVfM8BQ47;SU{7qv!5+ z`laDVW-iaLKQseB6w06~yalr2o0v)YdI&{LAlWSo>Hf`prsHjf(Tbe+@Lsxo<`wzx zk)rztA0cFIA;JXZ$zD?qQ=`X`Ove>OeA>;-_ARCfsylhumAAC5O=~DM)SKV z@}m>U3QncX+H2V5k}ovki7v@hh(OD@k4s#zAW<0$sIM%A`Y07PIs6P=crFErgyZO4 z`-J=CZKuN(PFS$Nl|-kMa+5h@==PQ4{E|u@jMD7s-RvY1by-72&;QX~4Rsb)=!eo9 z5g6Ne72A|O`N&9P=#=?VOOh^a4qc4?iW$^Y(T4sP0mwbK7B}xZkYw>j8gE$-JJri9 zFOtz`<6hn|vVs;xl#p|V8*-a}@lETlpiuJ@_b%+D4xjI=WJ)aJ10qSZ!V$L8Cfsbo zD#{W#$yPgaa&dV<$JYkY&I&K`JTx0S#w+4g+!8XWnZdsObHIZgpXkE-T&UNIkm`+n z5FTxVn-!Hvp9DVT+%TOhsAcIVoS+czi3cK;6f`!6&$ONk!#xL?ez_pIZ*P51#MYhKjBKa9Qs$SG=eWnY?rCcjp3}G!ejm3HQkQ>@#kx^9hv&N7?Ru zcG z7B=mz8=@3?_`M(NY20rq`e!Rk0W-Yl-u5l{JI;)Xzl71huS2-6brWJ%zBIiejvP*i zvoVMFl9|8{>K}}N$piz|S(HV&<^%E}(F?_>Ya@P!5B_n!$_9KOpB z&=v%qXr^&1(=c@G4Z`xi;NZ7#en3K*rsN!gxVi?Fbo^qC*>@;Use!vETcEVMlNOvm zftUNOd4yvDoi@CHi4vP>)2trm_F@INtq?DDzfa4OC3)QIxAc3%8RXpCL+_$Pc*BNj zglbu`gz7RX%o3m-ZSzT8;V8?YHq0(JK$zWgs$1PgHl|T@DqEb11`8qJkS5tIy^5sn zaQs&4!=ckTy!g;LY*Hh({`d-vDptUF1#8UENaoU~%4w6ZAl0uC#Af|KzF2-Lg!X-9 zH=K{q=qFO#OD>TH!lGz%PY0fP2V(EQFWQm(j>Y+z(?;b4mTGv8{&e2uAM)Oy!90v> z^zEisIxz@(ejjUwuWoSoSNQPib!d9&MvVx8m{3fxHVl?%ZJFafBrRh&S*hM!b zx)o)Gz3WdK4?-t4i* z1-a|IKuR7vj@OfJ<3z6x2?56|oFg`}!zV-Z^&vrUnLhR^sGpanG3nrNijf>~m zz#0qWx7=Z;b}m5wpbFFIT1E0Lu5emy2C4TRu$duG*E6i?RqIqTsXxiTefEOc^34j|nj*>4W-o)|OhrDB^&8uwBkaRi?L_zoXIuLBQG)h#8Nog775^gf3^o%Dkh%Rf z`Q38nMM0;qpevNCc?7~EY9aF|iJ**oounf8nx2mKrP(5V=-qLEiH*2ULZ3BA;)5lv z@!Q9WBd%eMP$3T&Yo>d;$$W1Aag=72;LMX9_|6AFksTzJX@Sw&y2zAC=T+&THE|OV zpVdtZ3t!RtWd?AQ)GHJ2PjKLq1)jG5 zqeWsBcx}9ZS{0Mn?8*jw+0{xDmNe7Nd2d-zg8=D#+6l`)C+XtVO5T1ijs9kR=ZdGk zQiWI;>wLWma>|?eq}I1s^t+1s^rqv~_)~Oku`Fi(*~CYd3sQ+p2b)oqLRUU%a!Jvb z)H6+&pA?Tq$0GqAonwGoM@EtI*#&g5qY^&aXR-RSIy>2R4m%wNSk{=4SQ65OuQQ|} z`QbWCp8Sl8KDKkU!W;CM$I?A79pt*!@K2`tm^Vp{RcOA#s-i9wWftK1_3QlGc!rSL zJs5hj1mER1^A(9Vpg%7alJCb*_>WhJ%(+6vSz|eSmqK%c_OOi)Hz4`(32c0@2Q%%< zC}h};e1q3;fnFn8tu=#HjralQqYtn`-yVymM6>*)Dsr$6$Jwcm=#F#*n}6{k!VOkY z#SCYRh}=mA0~SbboWlgyJSOoSH+X2V4W&N`W;1FMsCvg=*6!(#C8M3OWP3fGUpN*U z41Uns;$f^TOT<9+Tej~YgYrEeDBgHZdONi!Qhg%a@@6tU%k?;%Z$n2<~l15}5< z!pNF395ZRcgLP@#FDe~R{8X4({CEuheZm%U*tHhH##sw_LPd}-eeKymQqYt1tuo=qa^$gGd5q3{FpQr zGRfVD*~j0b$V>awWFBN!qHTnvzB`X zO-9zc_Y{8OB3kF)r$uuOacS2bsUSWS^nH=_&6C*$KzXb6K8q6x>DD(dqpu zw6FLb1U_WocfuI{w0$w!d?fg0Ul&Sz|BBCUEyaryk-IteixO*r4iSVJf2U{t0 ztUf7M`O^7^2E1eJ6d1voDa)(SKITYHu1)kNMxVV*=)i{$dL*5q3Hue%Ox>ysJy9)? z(zHQ)fDW$@oK6E?j?C}4H zsY7+kLN>w05||W+V9|*X)|pS^?N1_gnm*RvJU~C{T4}V!E%Mz*Oro?8L!-@EdDT-C zD_N0>e=4$^i?H|4EKZ6=!m(i%E~`qNeFEZfWf2 z5?M~vU^N%-dNv~Ok`FVPW=dlXv|4Y>WrhfH*zl3GP3_9SY;ZbufAU9Ct@9TQkX z$8R!vJP%249B8L-3w!HxhOD*5(C)iCXu~K4lIz(+mJ3C&xT=p1UU|pQ6s6H&y`yaA z&^X%aA;;#d>!d|y7ir!y0g{)EL80tAg#ETe!lq1|GMK_|cn#3=)Hp;*h@;TMkmm=_ zAiG^!bWGNqswbE6?K>Pvp-q9Gz*jmQ;LeJd{X~oLZJx`%(DCurq+PxN#=qv$_oCBy zI4_X3xaFZdxr#i0N>l0;M{b_qN18@KG%}=-q^kGuUmhj6>$8dftsVi5z!<(`V>xx{ zr1KIJ4ce|Ehn^TKTz}_81@lDdx$$}2)g8cr8)>v=f(X>rU$S$t@s!c*ffYX|lKH&T zm~1r-eIawGa>iqF`0<`eo*GA{k2@*eyBET{-Pqkn{bW7o53Mb_PbE9UF+)WJ785VR zBG43{Rz&ktK@(x_agW!j>(fJ&v8hKo(K;;3o~#styZkchi^#&=f(mAN#gxMOv?y9} z3;Zp2&<5K@r1bLvE%wi$%j+`PGM{1;`u6b?g(?)aa29hgEv0c|?P&P&E&5mBNe0$y zsNT;V=}yBmZ~s)DP_>%W*kn>kxJ3yrcle?+X7uuw1a=M?;f>*3u!j;v+ZoNgtVF9k z65*bj2(=v=R5|VwCA6I6GnqG9jB}B;I+nuLAEM$v8|aLZAD20qfWKw4c#zpn+FHMg zJKUL%GIcHNO}C|~&6C-^5*aMM@5>c~q^b7BVmO*z#v}FZY|@J#^zPkB8f=}83wjaA zUGRl?pcyG9chHoow{YLGkBzGlFY7MHDHsi_YsZmtmyYJS0zJB5Uzclhyq7F%{>HH7bN3B6au64qe&lA`k3jF ze)_ONmkEgo(`BbyC@)Q>;Flv93V^JXo$O@r7R2Oqv&Y+#@au{;P6_yuL83h?ALl@l zr2_2hZH`%jAGnW18;R|CLQlSjL-oM{{@8Z|-M@Js{VQH!a;p!TP)hnUA$PJR(%=^@gaSv@rG!qKqn`Z+e=ZdJf`1$Q<$wJdQ;3 zO|<8}DrIkR)PYx+v69rc8Fc?aU$iTkY8Lms9^C0xzP7Y8@0 zQ`(DMnjNT){cDA&MXQwmIkX#s=Ju@Zt1o&)HTi+_Y!7dcuMqPk`E%t?cqtaadjPVCz1&(#yC6e$&^H*tZ03 zJU*4~i0D&{+9Fz(IgWA#Lupdv6q?{VlKKMc>5%FX)XkCRO3I43^elr+KTJSwP%dh; z`*9~}Bg;S>E&U|HuC5WIHwy>(Uwe0&JI0P{&-{kXU3siGY7dgyUa>a{Z|SFv3RBac zfPdQ?amjHU^>v-&rFS~0W7{qsce@Q&Dl&1gKwt#2iHHdm2KG0HaO@UOxmg@T zx_+v>DfhFv^%msGV9v3%#956|lv`UNsbT;^|3*q3BO4wLwZ+}kFLcs7$E^bsAXj+{ z<7t)1u6ZFoI$fhi!*FqX-yII{8%*Eb{~%EX-DU$Ar+*N$#+PCLod&tDO&D5B;BW3G zxU~&tf33-UsQp|F>^2{1V+y50RXtnGek{)&U4~I>3UF!da=!cZjKO~SxSe%Dq$Etn ztrb!7^Y*Ezt646VtxCg~SG|OIr+_6fr&#diE#;qbnry=TL( z!(*Q8I#6EE@69h=BAJoz$HgCv0D$b7erjgJiQUb&RlHqI93j-TL9 z6HRe8=^+(VZwoh5KknW#U-liLiH2wg{xej8R{A)p-)kPTyK6If*9DBa5`%fYfobVh zuv&bRnon+ufE(SYVtq$`ePctX9!i{@|CJ^ATj&4NSHuX#E;Q=;g_XT(Wl;Kl zw69%){fatBcHJ%BZW)BC4h@tY)zI4fvskXM8fIIsV4-&}EGw(PaJy{g1-zHtpR8o! zixqN8{eS$^+mz8^^O>u$MkpMQXGiZp=xUnB1eYWXQ*A)I-OX~`hl?E4F#)GqyYN`1 zq0~HmfkpXq#D;)y#u)hU`5kkX*0&Pqzk(ybILV0zolx<7hFGUIfpe0s^3Dev^w-ys z77-f|K2u+&{TdGEq`z2}9)^E!Lop_08f>O?X6XYZd{};fPW={89yOKEx4C0y)H$iC zk&8j5y?DiSI>zR`S-=(gxA@~>JgRm@ zbL=w{d8Kgy&zi-H;m-`=*6%TTsO9lgx+WG{C-75ofr#4s0q>6f5JZa7QXMkkJ~fG0{%U$!UY3 zMvhQSN#MxDv(&qI8Ie7P$n*vJSa<9+Phd@X$a$PO-(t?)gFG$ zvEs9F95NzHx#dP9w~tvZVrotC_30YuTXg4`;3?v7dUp=osw5WN%IDvJuj10ZLC`I7 z#lA%sQ1WD!%sem_P48|4DzmN_%;qyBXgmbdT2 zbyL(BI<5}0<#}BA=yxYJYb8hZ`g(?Tg!k4N~VVc0vj4~o9GK>6_PVqxYb)Wj?kF4x{+ z$E<7e>yr?=>9&?>H}vtZql1W;5&(s-~e;m_Ik@XJCu)?B1bZt2v9d?dD($?kdw|1yZb1p=9 zxdtZ3jY7Eh1bJXtEI-|fhemlUx7$|BH)b#B9DN-&eunI;`&g(%P2>Ey0IAZ^8c}6C zMa)x6#?5Oh9$a)|=Tm`PGW#8#k6kMc{AtOBd!Do3FDsV3&XzGYF_<*)6L*ZZL~HA> zypVeyeg@q!y81c--A4(7SBI(g`lWpSY6ew?1d838PvLiYF%FnrV3cc594I-De>#(} zZ;n4=i!Y(Y<|fY8+yE8(y+|AJQ*4NN&$6$DV#C#33?J2q&ULj2>gdMyvNwO838Cj6 zEo20Jm%G~aV{$?w?%iFCUtRl&Mf*%KV4^AfO78GG5|R9)7mC)t!RA$mxXU<4n6K}^ z!=p@vu|W|s9`@vl9jQFI;wD!na9#X&SQ>L%IOaG4R5VtmpTa8w-z0z%X%}z!9 zvv9Un2%$l0FPa}6#^BBI(n;Y86jH`x_RGgOu%JM6NE?gl*&}#2!-~dv=HlQIJ^IJK z#@Aolv8eDYcTRfA5?fU<=-yz)U4OwRfj{{4X)g0F)$?!WG5%+$j)<)DGH=luKAd@) z-P`0Ns=|W{ZYgnApp{VXdkLbAyXEyr*wOa6oHQ~OlV8sjepfF;<}Vf* zO__8$azQ$_@Z@R7>73$j&8cI8W#iDXaR0VRHpVRB5Ti0_w&Vk1PbG2Q_dZzFUw}DR zx#n~SnQk78^`F0C!SvCvoVt$d|MP->%d@EZ{s19;hswBtgOD2OE%cACV!-K-m|m(v zg|0WsRp7n>dXnZRP zH`INp-{CGaU-c9lS4Y6NOAhWF-Hn%FGjO`*G_SsUOn0609MNS5yIz@3{o%>-px!T> z@T|hD+pW-j!ctkH9?WxpE#(8@z(_C2XNf)V@^6JOYugw1RDU4&;c%=tRt9gg`&c>S ziR{-UmyPZw%--3FxjhYNH@_36{&C~$!Nt5@d6y4VQ{leVS?Jc7LMq>(`{mK}&u^Bq zmKme={1tIwf;Y=Dk~wVUIR?&7Mr5KPW0hMnrg{M*!(F9C-5@#*9!bxnPdGSULTT3) zDlNB`4M)N;?yQwO6IjF!mi=x|pkR)n`?%a?gq`GN{{Do>n#Efm@?+FZ~wE0^VR?rV0;O zIMKv3j=RnGQO`4)U-lj5{W-nm^>z>7?&c^Ds>a}T?sM$^IE2SCyU0o1db9l)N7=)q z2xlyRi=4LKkg|9`XWDFIaMfdRIX#%QZCs)6ZO+Pf&G7f!fdQQYAAvOEi zb!r}3{WNCovu~nf!CQX2y#&iv-^SsO*65;mmT{sU#rrL==GO!2zX-#qD{Y0=P(|2` zZAHT)xeQu6lv8)L=YxfrGD>3-DqsDRYdp_!->Bj8*%?j7(OkqveaF90dl*f7hvENK zvG*wh#ywcaGOa3h{GBaYC@p4u!EYWZSxgUENNdZMIGedxxI{K{tWq3WgeP-t%lG*H zSfGG@4Tl4faQj86eFR#{M@xS+s)LMx@J!c4gbVA^Q!$N&-A3m)Z zi&c)BVD6aCwwrRGc1cD43vXma*Wq&d7x4GOiFALp6BiXJ+9Z|X?v^59|L7({9y#Mh zbQLuEXUIaY3h1ucB_E&hgNvb+@ICSwDr0gubaWPvIA7)KyJx7|Y7aBr%lRWO3Oz?0 z;@h>Fve)8LbZR`n(D$tn6#7QY80&^lA${4(%MuejH?hrXb?oarTNWg|=a%#4sJwrM z@Aj8Vg)JB1dnQlxQ0dLnOJ>2qE`~w9joBrB8#`t16t8N#p`Y&wrvA;~l->7a@E*&v^-bozi(1Km| z_2rUB;XGBdR32|kf#a{WGWAstK5t@_`#b7gW1AIz9p z4!zhj)VvWOZR2yWK=rC<7gY%7`h!&dI0QlpIdC=%7AGR^aeZ+K(-uX-JR(|7 zG#`ldhG*FLa51w!w?&%~>(Ht9No=f-56Tw7=7baW4K%{5Rqv%%j~{$<^FR4Ttp=5qNiseD z1)dH~6gNwc({oLtP;tqlpZRoLJbDoK-%pZ*lP>Ynp%L;$Mh+AAoW#dr`Dn9KRX8V& zq3VkiJS$Yi)}BMSXo4@zKhBc_ZBAm+RSV|Li^qFq4Se=Z!t1n`jP+T|;|ISB%|0g( z>PS11()@E^a@D)0eb6g-vz$JO|{jXSRD=U|QE zHc{Jc2P?*J#Ss7X%yt`r=mpC$$)JWxhx~YEVpk;F-^IusAMmA@D^?#ah1;P`=(pmT z^!3T)^mCNoO|$u;U#2uk)aPska`lTVyxjGzRGl}UlX?_Mb+u?V1W2y9?M}seD&qOD zLs$_$K)C7`FnUCxyfjLgD|Bl`acdQx-!@jhc$>jM%lD%CLpJ+eDVIO;nsBxKEDDV)uyRPed5T&X+^?nA25E&P?5PH7Ed-$!pKhOK%!cdi zpMMq3ITkn`wSi0?!5#zE1*>%{Mt;Ip{ zobkz*@u$NUVLl{?W1ly3n!!aFE!fQWvkJI9c$4VTF^_tq5;!TUAF`U1rPl7As2_iZ zYrIC`%hfZ&{$~oW>i=To?2A09GJuhfJ+SBHIz$&AW_js8p?ba&C;QlwTIb>aGC>r- zbmGL;mw0{L92%q_L`1hhnlxm~&f~XZz^=>kUs)>_uL%>nneQ0qk%yS(R2YV7Am-3y zL=~=(`;WBZm%aC}@lZJD9W0b>#;4-%(PY-oG^Xb0k?ddPgwGe+@m|RTbQ;hodrf_h zFwdSMdkx_0w^nRz{g?ZK6U4G{yJ4&IhF{*iWyzypnHac;xd9)b=lLF1ZB4j!`(|Xm zvXZCbFQew=8~Od&1YA_{7q*Ee@CodU#HDknU+*sC!X9H4Q{{jgj}Xz{S~R5v;jn8Q zH4LBefO-UmL??6LrVF?+qmF*T4|pQ1hL8M7 z^@x}>%^7h6HM!)04Ki-NWo*Aes6I6fUF!eCj(5&t`gMKy2HK12*C7b99L*L*8IaoT z<-SYzu%ADug%tEU@JuXxTaJZA=F)OoF>ehrL(rF%Ja_zy*tOmkit6)N7(a}MoJ=vV zR}SnF=HP7P2Bf64VVAO(h|Bqo!vVRN9hW6zRsDErcCC0hDu6vT=0PiH6Hl~?mPzeG zc=$$7B)Dux8?BxqQKuOSL%$Q1mtmUqM%=4w0n@zgGVqEbZ~1QGCG8Tt@A?F@W-ddg z&|vPrGakEbg5>YyVm^upL(Iq&_W$UBE<qs6-Bakg_2QHDHLN?<4yL*7 zMh2(m?vSZIvloHQ+vB2o%46;YA}eYzSZwlXJ^Z>h+EvPV3BZ6bUaCx6M2*|UbLdrKe?nEYgJ~>N`TYvG- zs{zG9rdWC1g@$XspnpIEZ<+K(fnNxwxpd`;UNv&S=zq}G`@?2Yk7MNvh2H(oXy|J% zKil16dB=EJ?!JkYZmM!;WY|vI={r^i^m>=P;ZeeTPS>o`kgcKOo=+8gDYfj zDPUTLYQ_Uj>J{aD{o8bi3Qc z(M|qbXZDaj=SE70IiC?-K0}yH(Z}4P18}^53={6=@W%pObk;tN^=n^XMCt(XUW{h@ z!cZvO@5eB++elqB6T@CkN3OXg&ZY#4t?d$Mk)@0OCPZMIFfH$07w=>p!xOT<)7 ziB7v)$~~5&u_Zf?GvW@@e{K>^ltr>^TP*h<9>v6UweoMpVSH;p7)}OTkbS}%yJp95 zq`#fmrB%;EdgH{WQv+Zevy?{$kL8W}Fge%g4x(L$$tPNBoTxBSEY)7Xf!$8x;_&u3 z{;ZNVtp#74@RW6Bj#zZ7NzT>Q;{DiOqWV@dTU<$%i%b>Je)Av{E}Dh|B_Fvj%M9y& zM{~}|*YJ5@ByX1ZL*>_0F}gVz<2+(SSja3`&mT$Ons|0~*^7#OtuW!+IuYIAOrOD> zv1M`##2R(x6w8&kvE(2IwJYKJ{>tKy(ms?1?MLH}Dh}#1M|f9kL}JriF{x-1Z4|o* zw*f6#GD%NNTNREEX7ABwxHC(7`-q-5&U3`KROz^K4?H6D@Uh)_8hR&Ty1dOSl|)#4 zjH2$CTv-=XiH3Qpa;kn?#FbcK!=pg-f8i%0y+6Un?F?e(--LakH*%vBFvKMpzq32@ z^0Oy$pk;eB?AeWX)%TcrTZ_J@U(?pBzZm>eg`H=+LO(+Z-~HF2Ypn&!zecg;8WZkQ ztCzRcn%UIxC*6JPaj|7K8$XYrPJK92yi;g%xi547?4fbqNtAitLZj|m;c;;u%MEXE zgs&&1?_mse=sHOk6G5zkY`_9GZe}i~Gtgm*TLh%#s_Nj!l4HpBYZT&~qQ3)>kL!q#p#-z+W{r{>+{Pp4lZ({CkHa<5{``E{_Djtu=e zg?)bR<<7*V%y#Q2D@(i)^>Q7Jlp2t->i~jg6;oy9GdesK{QGy9Tp72PYxFmX68neT zf4h?1<}^{|XQ-GyKb_z8YGCG;NuMcO<;=tSJhIUa`locMnq$ZKrCRXFU&(PVVsR@| z$hL{|kSuyK=@bS$No@jo=+!=~+o%$Wmjz{yW zmLFgG%#+t|Dqy*eCT}J9(RIGNcr|J%7vGGMRp##a(A7*BhIPjh1qYe-~(dc$&)mZR`-`$tJJyBP8Z#Z?S;d?gSc%n5qsLsz$~Rx;_uDr zQ1`NBuqc4?W(#4jvXB3&u8IzmvoPoQTsg{p2=z2C%Wii&pwqht^7pv^;6CXhVsGj& zrXhg+M@-|bIU#b$*gr6hYLJn-W}M%{2z~7|nLVPTyfSe%l;g66Tc|&dtXc*C*eNU? zy-Vt~Z_n84Eu_ul!5DfhR}S%RjmXE*qT6W?jPGGDJ{cTh_U1qGUj8+vEDV=M1MBfX zl*qJ`TG-v7C$tS#vcvZRRv%r@)2D9BiKde=@TCdL5=ZfZnr;Hzp_MLEC2+Zdf3_9UCq#~SEM){r3B}IQgL~nCUTtsYCx60q+B!d7BmeeVx3WI?6Hc(+c!=0 zxLzerj(>*4i`v|~B%JZe8VJ&J!$-&0(!~21C$4P}hnhw*cz~MtHtPrMCv*``Z>Mmk z)mRo(zlTMnJx?Cip!eEm@=1SXZn?A#PUU%6G|T}d@)WB&K9(oPd$RhiHT%D)!13w> zviH@FIF_v}lomMgdDc7}fB23!w;LkF`2}}felK^f-b~+&Pg4JRXPR}+;MB$T59ubKp(FAI}y)+>!4)bQnC4Y zGe1?g5zF<9Xl}9s?ml1eyu?XN$rG3#+Yd7<$>g*f|~%?axT(HJ9M4;m02-->7^k3}=_$q3cse=>F3~(!rM4=~oXIp(#He zddM`d&NQe$4WB`^$p2#md2E&3zJ3s0J;&kkK@IM@Uyi|7j^p-V11?{Fg;&Q{vTl?w z-aT&+g$ga9v(8wyj0>frsea z7q!I8DNPLQJXD66=a?;Je@US^5)QSh-p~ZF4?TZ8USGI$hLj{#>E-<)eJ$>%% z6aMF{IC;l8yoz29e_Ich?b3ytVh-;v4rRy1{o!1g!aLuhU|F`0+ZvnEB3%XTe_h0$ zHWJ#!8k~3cB^-hc+2v9%?0x${{QB^lH4}Qv)0e{d<*uRFX{`&j)0MJM!#I3jRfi#3 zimdjr5iKXRWB+B>(8kw*HrA>bJ$@|XwY@mwn*!hHHH$r6?_piwebGaHVXMs>=}`5U zi5;$C?$;>@%e9e1z8y#Tvj_A}JdD!Cen^{a!W*p&F*)-)H>$@o(#4F40SDzSRcHJs zi>2*>MEL9OlO>rmneyr=JUV^m&y8h#V^#s*%0e8R{29-CYezHv^zvn5Vf7WBi;9@yT$CVqrQ>nef zo*_M>_|1MMOI$mNGxyc`t9p}k_n*!3u0=vMI~)6EWXk!6RQU8tDpu5)QLAr*9OCWG zgiY3>Js=`%Xx{#g182XxvUz$4AI=yo z{#Z}s=pVDhvc-+C*gi^paj1ZbnHy8>Wj$)5x*d(4r_oQ%oSmln$g~qP8DHO-(Sy=3Dxe3fvqSklAdFe}-Po}H zDl$^;qI~Ue^z^i1VpWb%@$Z6)0Zo)I-||9o5w=|&jtyli>3?bt74HX#;Tc!>-=t8n z{n-fSIP8}CM<+we?U5|vi7z+*C=Z&}N;)(dgxPla^M zzrqmqljWCVuwAV)J1?Hi@_Q+G_hkxWrYbPa{xJ?;-o}*RDfnu=jb|U)@XqApGCwUD zDoHnGFP32JWCxKlbqR|Hg9WRrX{AwycTW~kv%VXY>MR+kbXIiJ&Z7Ubn?mpSRj8&7 zMv7?>dvxoDjmhuP?74^*?*cf=ZwIEAs-b;9Z#iEz4LW7ZsCDZx2QFVMTi5$w;L4X4$A2AI}vww$#q35vwlls&o;?<%RVvDOM}`eUUc~Mf>s~aVpXRfQmL*R z`dnx&TU`5&r*TGdkoiQWeOiTp+>QLQr<5Z%8sd3ynVeOU#BmxC^65ZNZn~X>JAD<{ z;s~JQa+%llr($JGU{$J;ba)!ZJ60!opx_N|{cFvvB>}j5%?m~aEnzcIPiigM%XXec zRPA2NzmqPB(_TKxu)i>>RTst`KVqoX6@DrYMhllRS^VWD%}ymT zQujRyDh;XdvK@99pOteymZG+_AM_0kn6i34mGqv_@?;OJN^XST8V7E+Ge>H~9oV;T zfO@aD;>_wu2A`;re-8z7-)mh=eBX-emu-}D8~4*oCsy89aKQL|mUye0%#kmeu~>PKdk&#|Iu#wd+Z|ztkUB*6(6-dv7lDazyjw6S%JNl9~#)#cRj6I23hLt~{ZR z--{c0c0)U!l}qHvmSYk0=o~J%L_yD2LvFp+guSQl$n6)58TsK1A{Wo)kifm7@BM?g zzF?4?-64n-nYMVG9s$+%{m|$BBHDFq5`}7?Sb3=i`o~Ulm7gm=dwhho*+My?Nts%i zQ$;7g@u=F6%yU*+oSW4M-Knd%F=8&?esI9|3Qaj-$VWaur-in^+i=OSh5UMV30K!- zh~BxkSkO3;>(%lQI`Jl>6%NpM^iquV2xPf&C((NMJj@Pl;C7>>Nbi0QXY@6($~YDO zSv+QM;VH}qPeiUlA`7AivT;*?dDXu^E&SUGmxN~=eCLHY^F4__k1Ap94WO0dUAcKv zHiAAkGCHx6_Bx&At}oZ2sF)8|@diEnD*@X_^WEeJvVZ78&U{)XJhbiDu2nw2pR(Y! z^r0dDas!{B>4+f=&pGmzq61CzQsmadcQ~rn3x*Hp z^B)q0qWuNz+df1%t^bKRmor4v!Xlup2YNYY;YE$1`1R`}!?TR2)un`!svn73+X5&L zujYv<7g^N&R}S&+hb@b@aB^B6wuS|9hleY_TuftwhaJP7yy4D>&$t|ZK+H1P#kuLJ zESTAq&(+RRt$jXx!^^q*RSfihoI<|)DRy#?6&!2HxCbNo{f7eos6^w)yh_HGhRWvJ z9vB+e%nXx@tRL|Kdvoh#5PsH`&-op1$12iX9N#lXFoPJ@Ij8L)X zBkS#aa-$quyYG@)TK&TY&ra;|cp9cxjg)mcqcJ|?nlxNhMWtmkIP1hm?A4q{z4rmw zAN)#KG}__c&}Xcl-WU4&JIWfJ2^bfuF83UELhty8vSM&AwtV|b{yp8E1JGN3`$3-2 zQw&mreIl z`Pi_FyxvEhzgC%J@znlQcd(N^d$ecK`^WM}Y%yMjf5yYDDsUcik7|~`ShpoWIBLwm z-4a7-b7ecuJ=-Dnc636C?k;)x)HAGd+sl~IiF{}TtQL9O8qK8$LIuEuRJq{Cx5;*%b(jt>^gqh6zjqn`Y< zy93oM67YP@b$r^VDOaVX~?~wjZX6S4To|f4rBdOsT}g*C`?|e=k+r%%jrX zUGTjgC)7;(qx%L=k@0vWo&S~Na9A1}&mNMo`36?PQPq%bmxZF;%E=rR*Nh0Q5)3)!D-Bi@K#Wi3 zDz8KwnLSWWfAj&Pp4?@IOB4rI`-s!k-!QT1g4k}iljiGx$-RocJd+hJr~KNBPq`au z+4UFo#+WeSM{D#mH4)2h&&KAcGPGW*#Hl;R(skA%KFaD#gV3q;iV2ac>@s0@bDI2Z z=FPTG&I-i~&iK;3tvqq}IsSVW2Dj;-`NpA}uzfawudm(|mBj(H$!^PCWAEW?slEL3 zcPKsPdx?KnjxgfU5gz+#Orr}6MVI0NM)qAT?hE4Ma$Tkx)*}Ah3ykR16@OlI7h|LB zX&rb2V{g3V^dV|u&bRTneW8hC%gd?QH&#qCn}t&aX52kl5sQxfKuwtm%(_mKvkD5( zQK48KJGus2_x=*A98Eduv$6=S3gi0Yo+429Dx0s|le2Orv#jxzP%~FVLTP{OUg>}* z9UgM~OfR?{_h6S<0X%v3g4ndTB|OY+AHJP#1UEYyp1flrqYOr}bzREgw@2Ypv<)wZ*5l*(E3$IuWlkM#i=j{7;mW^e7`$u8hr6$d z%|E&_{r!45ci0tfy`Vvzvj;dL{2z*E_J;a01B93ZTaP~N@_0kxHKnzt>S z+nLG{kCt)&b60WGO&f9d+exKzLsXs{Da%jP@=0eq#{UUJy!$38?hQh;_C#TP;}-4L zLVnCRfbPdX;C9$KlsQ8N#yR4G3_TP1KMfwbgz@sdkwgksd-M|p>73(gYmhIi9 z^Yeyptc|?PVwYDa={*Q##qH7MwF^(h-N3K1jj+7p+ z4~r5{-&^6|{T}$y;Ursk@ROY7I-O@R8JOdzbcw zG4g@!WB&a8i<^H>#Oq)7Sg>v)Dt<0R`)zM9?0hS+@c1&e?zK(Up0!|2v?e?1AHmy2 z7IJMvGiOX&C~TfZar$v7cULr`R_CB}9kK|wbPPoK4^w1iTwv2wZ=}TaLe&dbHaJd^ z&5IZDNu?v@jy&$UYDlv?XISiHh&4V(n0(MfY;=D^zxW?wMX@UK7raA2>v@Rl<0yl^ zJ*3L#cqYeo;l)?#{G)l0t7r7auM7=-K2t)&@O>=E@xiMP(NJ2oRNM+~i7$I*!m#x~ zdQ~J#^U{B?d^`azuAsi&ZLAAW=f|DHMUh@V<`{GrTOK%YsPSf;3S7pb-81F5ANBlc zyj0HY|D7!sHp%8Jd+r<^0Zq^D?6;(&=%;=VR`2|z!CrSnq(=+CUI%fuZGdQdv?CTQ zu3>Obe~i~w7PS{fLW3?$7?jV^JFCzky8&F(fwo3r2se!u?q5$(z2>ddKW9q|TU~hl zti;VA3k>~dh~0(H@bG9pMg}aC7di(c-TwsdoZZQ=fjP`Dyd(9Vfh&Hu=Hzgj-pt|L}YUqMHYMIz#!2E7i%inmL1 z@l@YHhRxW?Trm?!*iYAey z?H0UY!t(K=%x4pQ22)P$HkH4!56FOB=7^eD%tr$gm~iJyW=4eJ&e1 z8_1B)1M%SKE>RdWmUf4%@ZZJ-Q2p{r_~k93g61~nO{jrM;X+X{!HKhWyc74@)Szlr zjc};*r{erJqJ^8l{;AtIqVXKxp79o=u6VNG&S%->{(p#4(h_sy-=O#LozkSuG+HiL zi}U8`*pXN+ZBl#V?gDT2^{&S37+-Pb)f8q$RI;YTn(8xZ=`-^KUYTx`iu$|pJt|pv z7>r-b#is`H_p&;q+-U=^!l!sFyUDaS z|ImA{3zU}*!iC^Fa?!7;tk}2}52A+P=7;WL|FH8o>~KUFFFVB+Gxy0QvCi0Bx=9*t z_{0#qNqEul5C>0`qH6g~T(EPJ3yV#-BWI1+;}VH&+uy>q;{l9pw!*F@EpdBk40?6? z%@G$%al2?fMi#!7>CR2G8atksKWs$G%SFPw{s$s73NUIw4t@;Ll&8jL^Ppd>IGq@R zN}m#Wa^p<)t?EVX77lE&w*iVDA44G{Mrc0%$+Tff@>^snCIp|u_=eSpFq$lz^;DqY zm4@--t?4zpoB2Q3uW$pB7h2<+`0h1YK08y zpn+KHLwMv=$lQ@pw3IXDCfh^sS~8lRwh3I8S1xAl7yxrRa&o&%c+lKiTuqJO+aaCg z=5e)n)U-lw-#3?Ahn~ijylR%I??UCnwJ@-`BzOMljb3AlMA+d)ICf7%<|RI)>gCap zW%`(7cMadJf9Ii%`^1ODMAo=I5o5wO;_CjF!VtRbG2n_Av;7NB-N=R8n+k3^`a`@q zWsYNYd&IehQcgHHU-Vww1rc47SyvW1={ms>~55#jE%U-X`*_SJInMZqk^AlT|82yLI;9A34DKQG0iRn`kR+UGFC zMjjKhdWT`-pKS5zsUAA_*e6t@rl9G{R-ty~I$!Q7;^fX9_{Zq8?4aBc-5;)&6)Q}b z6%|RBjl-dlzf$NVI^kw~lhoXt$GiGxrDM`y>iT~a^Dcbm(+7ep@7^4D%;x$-uukJ=?lv`4VE zmo7d|JkK#Ekutrb9p8xdEH*ez!-}6W?Y=9nO&W=QGviPjF-qi4y@E@7qUD$go0xDX zil<|)Vf*_#@_0@-5;iu=x;|DIUuuP3J#^sc<09n3UmTJ#0k{2?dD+iEaQ1divh9Y6 z)h*EHV}Lk6C>E1K-^tt5#-M|(5IcGb`{isvz>5RyR#G7bW!hswd?Z(fbjG9=#cWt| z1>(Pba_Br?w7pl2YhM4ja&u=HI%fpK&v=U`{nWWdwTuDLC*adbL!`{=&DCGmqc-~w z#(SNU4^H^wrDqaLt?StR-5Yt|&4$+F+h9xXBAn=%NVUWjH0`1+78Rf8rm-m^IrM+z z{Remx$MXOTujoCrP!b?VF}49WxnLVGxX55^Y-1TPC5Y4MWFMC9#NElZ2tA>P-fL(H zp@b58FG&bJ^bjBfLJz&yXuoIo?xd3}ljQe*zvug&=T(BWJ2SgGyE{8OyF0r&3i6hJ z3pC3zz|_%gG|Adw&|Fy6d9B=Nuw>!}xX5%Fe0=4iX5ptlz`rJp1=Z^fh7XR1K(dAr zifk3wPv`=AU%L%oIWu6N8|9oi2gZZrsl&mWF2~`7XP;@t=`I0cRyob*%j>}VNz0u- z@0tmgt{Ml!cb0>OhGU)6|J(pJ<)46~KFNZ!=pZ=!@Ktc7(=-q|ZWjEZ!*S>R3kyO2 zhGU(7@45qXKd1rslMs9#w8DAd>O9~dYKNoy3xI6C3Cs+Mhx!pWoG+RW2YnvSb@rx) zg2h~8_~5rE@bhgyz_WW6!oZmqz!xh%2R*ajX;viacZ<1;h?l`nzvjgpb{R! zx%W52--nEJc0NkM_-TcZie3&gUd@2wyzB6O%W6*D*vhcZo5z~o11G^_ub+Z5AGL*{ zo7ZVV>+XR^9J8H4ozKF!UNxQ1m)?Zi`ioHC^ea%MaVePDBo0*Xu?BuecLRr;b#*S% z9fcjP?f|jJ`-1M1L%@yh&q4bsyET4g{ekuEM_}x!#n_r;W96K0lnp@z6T_<6Md4n|r zmiC5@jNNe5Lkmm`c?FhUe+X)Dl|asnRQT)NhhX_v^3(P;c6WqB)IU5|F4%ajt z2ibZ_u#|2S$Tw#J^ZoLmPqX{*_a%Bw>%-;X=)Xq8dT%a+_`csdpT9Z~R|o!!*29DSFF3a)Wy9Xv+c^^_O@LLOeFG`}0Qi|*3is9A z4hB7Zp<$EifKqpZHD}u91EvL|sdjTVC|~w-Fd=U)JX^XP`26}3xWUvwbL+Ei@OZU9 zG=KNI37XHIp)rmf2+kcV4gZ|I0hSv%7A(|#2?s2h3pYMp4L{x`z)8WE;Mq}E;gE(p zu(Rb@&6DJcpx03dZ>^jL>PFXcMh{*9LpNN28Jqux&Cl%71l}D4`ps$pMo-@jj=lDG zM)Vs4&$Jo?6Hk5)-;JmXFAl2>4-78=7P>O{zU)*@TzM1Rbg!?o!AHwLS{)lKGG~Cp zdv9nCuKN`Pc6bJlZ%qfwgW78rH3hIum5K0Z#mVqu-y52NAKSn##tJ)}=nUTuZLKNw z=K;_v?If5ry9+#3H&}CMl@7K#eGBaNy8@s87zbBux(u6~t^o=k{{(L|ovry$7XZKi zb1|5{VIR1-->C^W9u9Byd80|3vl4tb{V`an%Yu%Yw_qQ>G}sz<6I?yi15WL?1a5kA z34FKXcg>%1D`E7I-!%5B*WiX$55a;7^Wfy)_2BNw6QD(nuQhMGjs%0AA99kX>p}gw zZ@}DU72&Ipp`h2rFX7_fnmf--YY!8$r)z#GtpPVj_0$Ya9|*6^)4;4Tox%6>Pr&W< z!{Fu8r!+Ta?uOl#M8Lr82{7feZ0DynW`e?64KzfZUtxo~N8!ZB5%7A%V9+q_7x3%y zH_o-oZi3doFdFNQ=WubWOPWA>7+hYxFZlFaJ}l@2oSE(Zf{wL=!T1$#0qH-@`R2zk z`1J7*=<)^QeCbSG;W$=0D^U_;@wCf-?XFVAB^$qw=e+XV#-cPfB z>q7X1*`RrK;1L*^a75#576O9m39vBE34Xk~-TB#s)!?IUf$&dm3pjgg7AVuEJbW;2 zI!Kt-7=H3%0z5fEgn714K+fXTK>zDaX9zb71T~M)d=YdMj2mWk-m#B@Pj`Rke0=W_ z$QpXj8Suwq$Zoz0KU?z9G1Gw2RU3dX1VOZd|VB#f@d~S-~M^cj7B(Z8BEV?eum~Y2QBQ!2RpN zzz1fy~`TCET28o+4W;PT=dm!XF|Q-;k8O_H4{dg z!HHcnHTDgCz!!DKz@ncUfDeafI5$^}2N#yE057H;fcecQYtq*qgXhY=afakHgv&yX z!j`Se!Outi;uKBiK))|jHT^G520suDG^@Log+FhIfPUFWz)IU1P`ONRpnLYQ#{PL9 z(0KM*_~o2@_;z$lXOD4Z;DNuUIUTdJ;W2uiWvs-}0{vX4r zOeg4nQqbfMBEj!BjqsCO<-qrQi<}?)b_5Pum;r24UV=VvLN!Y_?SpR;invnG;!D6ZgEVz6a4Bqfg^I6moI3;EeXuaJ5Dm@(sj-9>%2hV@(oIZaW zyjE)`927{vPnsNe)`-!AqjmgXi+)B>Xx^$Ry}JQmvo64cNB6=*Qwo6n=v43pVbtv1 z?*RQ5ztY^#83gK{`3M|a)eF7~J+GPIcM}de0-OuKZ3NG~`ViQ5l!vJ!AHvSpp29cN zlEJy6C182Q4Y1C_n&3j0lN!?66+Uac0mekc!1&dt;OmYj;lvdWz`|W~;2LMH)7ZEg zn2>f84j3N+KZrd8zWwzOe0B6!%^yjNV9eYt&X8LU(EppUpzD}%;Omy*;MVwdAjZ(f zSzxRWXSKhl>AU+4T(OPUlzkHmQyEh8>mQ@Q0BWgbSey+|{ilJYKU4yZk8K9$s;z;; zo8N+woBsgD7GJ@aRRh4zQ|mS5J_Hc9o9-MNG#vK)NOTTq&V#qwCr-zxVeshd<<76~ z{t6DSe+ouUhy#yC?AEYrApo_fYWz+)V0r%$VB(u>IN{(gprRoUR(`eyjJiDpEZ2PI ztiEpsynW}P=4`SJz7rQYpIp8Kk9E5S%5RGW1uxrc#4hV$-1CFZ_BH)re&lVZ_V?3Z z$;I-{Qhi&3&2gKZi_#Cm(O<3vceh>#Ya_=wGh@5J*@sGL+W*)Dlx?&XtXel0INBTs z%_)DdIfg0_Kd{=)6945ZwCWC5X3ohku(-Ih~GXV60FYwyk#_jH=lXwE2?+>n3&t zVQdGZaFXLwBTO!V$IplTYzy>S~j%H$mL1YOrlO3E<16@M@dhFu!9gd>qnP zqqW}y7uUCUKI^psG~NFz+?A+>bw>{edAt1JwwV2(Y1}P%>6Hakx%EAml-XPJ`KL6T z>|aU)-+T|s*0|>!PXvRbJDWS73lVV7fE4E*iw@S&J=fGd@;z8dtpxF}IN)cQ13UQX z0LY1R_MAQ$?n%0$dF&qv0*~B>Q-tZuRZ?yA1knOoWbC){b~46I)ne)z*Tpx}8BNIW|OepRI=+_CJM zW>NjJpi24=nwCFZ1)&oIoj=ZN3;+1Jre?~R`QV*>g>%ZE55U8^`M|nqC%kD3bEd4k z4{vR`1~V_!2K)1eYK9)8L2$%Rnp3Nq!JN{)VDzjBpx+J%TcjTZ&g5jxv%%kjqez!cdH8aU{kAGecWUDM`|IHj*-1u#IP|=$pzTd4pKU0b4L9=FvR*W)nz( z5r8dNv?(E*9Lf(zRqmLT(Jj-EON$1YQWY&Xiy@ci>^3bfjWKyaC9b{m$XDg!!m)HA z9yFeX_(ZGIGg^}YcZ3^c(lQ9dGX?S(MhPeW`#e*abzzKrIKvPmL7(~uQiX?Ewm5ddH zLX9+t$!-I35OZdbIKypUj95}ZxLb-MLt_kBBYIF^oGqUcqCM-6*_1|<)V~;DP|La} z$}2gd2&RBum)J3+M|PT?zz~8fpm~BM!oswKkr4^pT7=YEi1dG=(nkLqs;E$(RKA$= zL7JYT&kiY`t5zHFZ%MHE^_M?myX7Y0st^mHa-X-*&z@@C-nLN39fwJhkqAv=gq%}`ij&FbF=9=(B@5&zuov>lUp;Oh)QS%Sm!Yd3I++`k^ zcOWle&9TKTZY~{mGhjFj2^w)=WWdUP-E(3)J^eqXe>7;v&eur|-fUs(O}?J@#b4JN zzpPUENXqc6qFI@#_u`_yX?g5T(=xN@4li_I*ERo$M5_$ zt??JTA2!bawc(Qse~kLZKa~CDwROk%)mLY4ZUkO!(EdaHZQbJf#HX!jUO#>mS%2v2 z>Kz-dKRvv{rx$+TG=QsKeYpNtDC0%H2ui$6WYD5Q~leB z_``qArgjG1|FqY)ezA)y1wTGCe(u3dLu=Gs-tx)M+ivY!-KFr|^uzy!_ELqo+}Ry6 zxAfh9eUrbK9#XgD*#a+MUwg+xyp^6~7cU`TI%5 zm!R3#pMA6l{M38QC&O!ef9Y~cXG5pHy$`3JALmc4IeEBc$hVKO%M~4K^g-W@&lKfc`7XvETJYrqGeaziq2#{cnQ$bgFXv%7Dsx&A`^p<8M+U443a;N*rM4H(@K z)CwzqPyZk3GlzCv_}%hd-+p|)`NeNKPWj-=)M?50zdUvzJ@unqHSE^o4GD2&^EP9K z^|^10>=nLoz=L|1XRiy|wzS-nwa56#mo0|R8@8(E-E;c7%?g~yl3T2TKf?MSPw#KY zK7V3mNc@-zNBvfnWsIlGbzNM0?J0Y&(^2BkX&rkH{N!+(F;6xxsc_VpJiS6rm;K*Q zX>Q-sdtpvsKneVB_@oYNSzX3&`7g1X*X9rXp?aG!+ERDQ(DeVcy*~S4#DR8Sepsa~ zU!l_RvTGOZ-@RmF#`pfCYfYgaZlCh{gK=LE@0=NX=5Cp9fBwD6@qp&a_xPAi*>xTz z4GP&Z_-gq}r@jduQ|;@xyT-GFHpY~iaq-af*e#=GzR66h(XfH(QQj{)xa6DI;am2# z&mYrq>8&A;Gp=16de~WISM}Ssn_r2DI+wii;pp%G?09Bvqj9?%+KJcum-ShHcjAm+ z&Sn|6R1S3B%Q0P@UpC|Ql)!*$$;piirwp%=FrsvP^S1gA|JU{kklX8Y-;PAo&WtTr z+ZOdbrMW`Cp7hH%FP>F>m@#$Ry`pLN0^Xgex&HBnVE=zf*KGN7@=EmGMrZqNIN9-H z5mBpLTKy+OP7TT(w({lBtzUOMzG6uePMtf345pUKQ={T7~v_@WLJ%KM>w}JFMHj=9l_d?sQH~dK$Xv zH+6W&uY>l?_@Yi=pO;sU=O4XP4}MvG^Y~M1wjCML<4CL2P9g7xZ&|zTvj5dqi)x~KQ zHtaAx9@lTog#PQVB^~#J(K8d$hdOH)1RqIxHFezHpZf)FJUgtkc;|WTxb9z`YTv%g zpsJ~j;tw9J+Mxd~!$-*%(>%&M@pksfIy+OXmv=7xdik`k{tMrEU*BxC;<%+j;Ox@h z?9*57nqIHP`E_Ml^gMj(t31-_HX#EC-eP7sb>wRwTL>ld}(s%w38FIOgi4tdi7i5tP5y&)P3C;Ky+HkJ+=EM&J9huJ>DY8N6~}4qHEGeVcg^5BJ3kF>SwFcJ+Q5 zHZA(@+<@_e2Gu7Y&H4C?W{HK3vkqPP&YfS+DQ7YRJ1p$?uHwJpBcj@8e=ZqzSNwA~ zx&4Cp>8#r?e*leg=8l|^5K*&M#>${w_huYCpW8QQ_t~{|{%YSp!#M5B-DtXyOmiuRF$@=g*?*T%a1ikB0j^smi7hoxs6`R4b>bwH15iumwR;H6YgI3e&CCrzi<7Q(lx$I)ZF{4+ehbH z-|@M|F6rZh@LkA1R{#B<@{Zl+A+Im(Slw-ramMk{mCKi!_wHiQ@qpiYJ{jJ-&a1k! zJH=ioY`*kI`qO1^-&Lzo;oHCKZtV2U$n5&_JD!;Iw)&Z^-aKtzbLr;VPK(;?Io0>e z6H)Q;N_`rZ*q5%#+_3)7)hG)V>w1TGc{Jyb(02ignPs_muG{P@J{Uq*+q`92A26iC zSNDf*k4PAC`0cru*XqCAyKYy{KM$u~>}Dmu_UsYOrQ4_OkzX8sv|>QPSLaOsN~kE`wNac52Qb%RR{+wv@;;nyeE|8>POcwR_|b$<7NVCi^_ZKh!Jpu7oTQyd;&6~4s&W5H}{3|XyH}ht}=v`!h+dg(C9oXgL&4_38hWTRW7zODCk@#1``4b?nW*B`sysAHa8@!K~fyvUd#}Pp^LU)$lWCzWa%OqXV61ZpxeZTnI=uF=O+7 z7{9I7k#{3N({BR0h2>2j-1E|*nq``HZ9VX(w_4R0e|GS-|C-Z>?M-^P`?(~YBemJT z{gel7(xO{k8@PDtGR?w*(5Pq6fA2D62blKd>&UQ4m+t59A2CW_H~fc3Z8ILI_}TiV z&L6Ah9tm8iYtpC^N`}PR@{N`Kj@?&@Rb@1OjrT^G2u@456 za}G27kebw9ZuZ@v8DFl}rlo2gFq_q?y11yaH#SK)5#{ja!7Kjmw%xI>y5m{9^Udb8 zZS|n<={ldh%o;y-UQm^QeuKVl)qB)0y$;6oUVFFJ-k>E@f4@KQbJWzRDErc?A5V^6 z{Gq}_HKiT=dn~Tu;zD0%Z{NyiE)Ht3$9S!;d04^j?}+iF|NgYHPsdeS`Jzv?N3FVE zemwlsP4~rjKctQPwPNbhN}Fy^-FVfs;KbBXiQgSdem*9+b;rw3*%|Dts6Q&LJ-_wW zo`V*bB~GNO%f)qnUb)mnSGj>@_@egfJpHMB(B;AFYQ21R}k>WYMT5>DOb_|KQ4%>FzQyBY5mPbS8FY3 zzGe7VLncFM?)K1J-XrBb_;`9r9Z5>G~Xc?E~+;`R2Rjbr*i|blc(m?3&{pAZ*W6@uKkKP)3tGCAQ`o+Jh{Y+RFz0>@*Zn*ZVP2DcD z&-yhT498#Jt}b^N0KY81-7~T9OzpkVjd$h{ly|+Zx7pb5(bg(^_pY-$CQcvL@0IrB z!T*0ir_y>eRZm{0=6eHkTW)Ppq1}@w>%JI#$M*f@57l`a)-P{%X;}QI zPUn9QQ+Q60c|Ngl33VO-w9o2f?cLR8{hsoX!XIPWwTgKB zQ1{81{LJRyCrr|MV+iz<8DqwBD{4VXbFHY@S`0!TG z0B6H}{!8Gum%}@4*f+9&!o1f*hJ@|EvCFKf7ZcdOXl|RmW%`UWY-~07ci`eb&6gPnp{^?Y}EeMz*z$TEg$|FlGRjKxx1C^n$NWnlt~g z9o}>uHTv^CAv5!b9@TVuS@G)=Z8ja+I(B}?H9NR1jiyAKDk}Y@>|-yDoZ5eB{Urk% zg0cN`g=HfK9$PK^Lm61MN}8Mg1^v4XVIj-^jJtJx_QbOJ*IotHuh(!s>l_|mvvlnW zlQL_K?scGh%!F~lCl|CBdGP+}do3QW9DTUS?(t4oBHOTyas2XmvwOab zzcM1bMRd1PPd?q#EzlC1-8Y&qsI(=j?&Z!io44XVT{wHs)Tx&OUp;HMD`0NzL3b{M z)!OuE>)uNJ)*o*;WcY%Ci46x${;QgyB*uTHx(t8TI_Qs_kE(v(Y2EUH_wLp2fApt7 zL1{x}?Y(P2M8`R2e|~pKx9O{;+g45LKYjd9-g&8}>;J!7kE?Y~sBR5+Fd@WrzsHP# z)5D3st~Q=|_C5Uig1<90E?fV`{9(5~Sbk>}-z+r6x%KkBeaYL_*PHNdwRNGBUkutq z+)Z3O20Vk6{vH9V*DPPZ1Vm zAk4$R#6;V8nj%HoBzt{jq@-sXjI0*>!~i2{A_OLvB}F?=10$2m+N}g<7YWWx@Fbf{ z1Bzr>P9zw%faXO&aU5@ASW=_~FEV`gZsKTxK;(kmX5)B~pea+{dvF3-5)v`Ru(`m* z2o%p)8J1*4f)R*;G|vH=BJepq!P13<(Lu1Jl_tz2V?mWre1Zt<)8mmVZ32jjHW5}b zpJ8(e$>E5|ryY`O5+QONVIlck8swU_R@Cz#r4%T*|&H4&cvTy7Nhpdv-aXrT$t z*q^3E0WfRq1jw9&jq!)Lp06f zE^q@_kz_e5Ls|$UcHeVhB+oYwYJsNR+>1Qpk>Mi#08g?e&PuR$tC8lFzC_$f zg8&E?P9)5Biv`$O6K!T#THWJrnAF>LHlO7RS+{s90NnAem_qETy)0jaJjdqBE;=f& zM-OF{PdkDskjSwn2JuN+44H}9Kz2N)IGaNW%UseZg$s}U?hwGku@8@M89Bhts9XxY z(VhrN(tKe^hA(6UUnqgG+AOq+6PY!E7L}3^8EHoCYEX42a64BQXgNysm8%OU({hxk zMKE8qE}S}FquuP)+_L|;+Y=lS69~$gJhEl!LW2Z0ApN6DOzLDn%EvBufk(C$#u!Wi zDv#tzN~C#45E&{+EaYToPfw3dlrvrA_RB&|g-5gp#E18-50Ht@rfkn>X8lfJD&NiMydY&op=w(C4WSg5X_umqdCX+j2GFsdb zc~W-A1p_Ji;0YDwTj*TrIM&^w?uxuG5oJ~JXeIM$nc4*uN`l%|RX`C>iNJ#ePu;-F z84t}fKK!UuY5&OCUUCIYup`5)~S@h&fctTw3WS4-RbdKvu{MG>amp zJVU<8Y_OW7u%fsPR?b8N02+fZkPk#q032X27zV}yeDi{)43x-Q41&me09+9h%`*kG zD~gKn0wLqg6;T*>C!ihbD3VpL>hKJUnlvXSDm*nQ*#l|HGoYSv_bslNTNAmViZU)i zO_>Bz$w`VJrVV(0cV+SqP$pLmE1-GC?C^%lT=+^Lqg3g<`9rC&XeH_64JJ;?1#3$L z@DY<3_0Fb%H>-1z3Y6n=M4cqxVB=A-9Tlxd1i0lnFjfs$-wyD^NLK{{V?n$=Jq+1U zv4o$1owEsil>|jAfn;oSXFF`P6vvk}RPjvC;*jjQSP&me5Cq6XhE^;{z>y4OYs3;D zQI_mj0_bVl6bsaMl?-O2r`$IpJfNxGaGyX#tZpHj!OF2}{n9a60;yD(G)#*T;5iT} z?vhaQ#KN&9CYG;Lm4H<%RPU?@@Fk(-8(E%}WEsJ`k_hzPN@4=voTyNUlj3C!)J8_( z;pmQ{mO}cUn(AM*M@hz! z4|=r?R8n@HmXf+Di&XckX0B|<1T&0zk2aUG`6&Yl!!mowU zHYL4#d|FBpAzvCKQguD!@Lf_rfsn7G1*Oss>3*r3x?4h8N}?w*=3S=MB}GI;yO$p* zrn-x&OVUP0hQ+AxIIg0|Q76ywOr7JIILA9Jsvx%O8Or0PD{f$qYpg|{msm{(Mx?FE z#3@@bCWExgB0;61y-;X^_KA?vpsM&t;Q_{G7~beWOH;&|Y9~UOOb{ZcloxYi9?jDP$ za4b!5W&%~jM4L&wMI<<$Fp>g|s!_n;WMl!!SV*IV4knTq6VAoV@u+b{j<9f~38lBT zN6ff4L{L2tUMf78@DtqsfegJq&5)!^%t+E@84|N|p_O4IG(2|(XEpP*lFJ3n?E`If76Cap?(68w!poWq695jE4ni% zt`*Zc1^piF=A!ujvUbCbuS z7w@IDN<^!)Rxuh`Ybk|!s3C<|z--I#5>(~K_rYc zK?=y!Lc;@}ED2-*9i%#=@Wqc?w-l2vFU{m)E|*~uSGfj?HKS!N1{fF<5ID1FK*I@` z94u*ND1(g@^OOkCXBaZ$vpa#b6n(ZKJ}C*v1J>O^0uZF3)(*`*ENP{203TDe^AqHv z1b|j9aykajcoiMWf9J+aiw^b-MJ9Dd{@N7DXxXW?>#}vC+H>XEhlZ z!9W+$lwCynL!Ag=z2j(%B(Ptq4H#Y1%e`3G{B@+`ER;$Fk0_GQwOeWT;V3B| zhXTqfEtph7N^w?HO+qB|X@S5-vloozTwvC0VJO6>B5#ZdpyCN71@@XiYkX8ZZ30R9 z4A*(BN#Inrh&((Ac@Psc&vU#CC6p0K7DvfdVp!auNEQ@~XHK%ugEAo0hv?oYwLb*Q z2zkm;u|H$-M+SmFl30JmN&%jND3#`NLa<8m?Fo%>mG>QmzDo^erU}sewLQsq?4wj510H3I`dPx^!t`MS17}V^Y-{4S6%e3!)leAwA

_jk95wKCE+dFE??o>f4Wz(Y zu@S276726FuwmFhRWNR-8BOSd=p#32bb96{kJw_gCT#j@RBxTRQFuIiW+RXB;D*Cyb&mmNQY0-v8a@Q+(*AgfD&)C#LlJ@EeMNfvU%4hPY2GTHnV3h4L?I~)4jh#oLwU|F;)Mh+ zknTtlV>UB%P$$}Av68GCZens75j8JcKwCH)?Z#MXE3y}jcC(r0-C$|cnqW*cD z7hDoqb+nT^rq`#rBWNtR>w^b`D~iWb_i#^qm{!%`zFhe@9vhX4%dCqSi6$Y4q}8V4 zUz$){@r*=$raRUx#T`yg$<(`JiCxr@tS-rFlq!c#UE&i}sBCvQUf(lag-T6QWg(4l zceIPD$~wKOd4Y!!oEn$(EIUI?ZDR*|MyG--R0NL~;+z22Zt z>6o69-qDb#%gQ!%*J2nBrz9y+HHjLJ!zp@wH(i!Nuggk_PXkC;4U9t6`5*vp@K?In39Vo zg3HNCOD-X601TF$uRVs9y9hNFuTo1u6=+phMVI-?niNHzG1^79{U`|NpKOk*Tbrc| zWlPqh3*2yIP{?4V^l;i1<-`V ztK5BK2}&#qiZj~H1`Ev+aqZl3&TM`kIcGK#EeVEbO9U{i7$`6UY0ey=pacIY>Hm-n zG1#`V)h^T`1cuNoM^QvjD!OtDbP_7Zs&PpRD{Qgx!m+LOJReV@`dE`<$Xx( zhfElGG~=4NBBHuN8Uc7pi~a?LX`?|_qBbZ>LL*RA1cpR}x*!puAR!sY5|V+@42%}8(2Q1~iShdE zNQ^)sK%oU53I$O{3de9DUZ+RpV7hpn9u-N_0{X(37_AEvqs5pQEyidgqZEubG74eP zSA14VygR$Blz5yU&yYAnj8t+&NR%Z)qC64Om1$N=JkFJ8Nc5c;-$j>}rpj6Yplm79 ziVO%`gqu(<#zh#TbrZ&D-GoY!3IG+S5TdXkSi*y>rbsCu>mJiZ*igyQsw18)9 zwABQ7t0^ohR4to$7gpLzH;6pR3KmjC>%QJ3HceywOs$YPA=0sarcZrC36XaowJuwh zB$1HPF}+(CqJSX@X;%zc;=Yq|ti_>h`VpkX!WGh{5=e`0ZTqHE%vr3*@sri^p}WII z6MiM-uD-NTQc7J;c2<01wjn+}$)L;0j89K;filw5dIAY1g?*P|BTd*Km2J5axpC2v zR+{h=0BILFz>%~Ka5QNHMKR%Fz$Rc@JV;KtawfT4)vr?fF(HxkbN|?vn-@rfEH09Bw~aKpG1gpjn89iS=vyflrw{~#Kw5C& zD2`+c(YeAF(nwpd$OTD3C6(mCt#mJk5`e{6>1=j zno^)Co))DLZNlHA1;_Jg2l|qXX}Sol$AOhBveH(A(IL_TFf&EUtKn3U>kLggS5jhT zrpRtHkbJHHq!-@h!$gz(V!QI(xN<*%77eC6g9$gkL)vV^1oZIEM*vfvfn`jp zU}RWWgc5c6`(u&8+eu0h?)^Luuxk5H4VN!bkXG7lK~iFoboM54QbFqJz?7#P_2o)? z>}qc0_L3p8|CtPRS**(OEG9Gggy);g23hbu(7EqN3$z%j;L%|5PV0d*Gd3YCI?52? z3TZv+sca1vxBsjrByh;`Lj`n+&oOjKGU!u!=|B-@Mod{53N6;8nO6YPY7)t45oZRZ zC6_S;kw$@LMf@aAl^S(ECj452M8w3QF0h(#2bg)9MhgH+EW-6j!u)iznMjdV0g@S( zv|vAfPf$)qG6r=?!j;EIU#i^Yi&ZiN?>Q?QULMIfn?ptCwJ1@ymOv_EA<4UkK&S|5 z14*NWH7Em0dHko*)b)sGfp#Dl%);S6Kq>GeD4u2v$nl7O1`Hqtlmfj#Dexh(=v=$$ zIFd_QrG`)r9d*%rHWSZ~zS^m#rjAEk z588r!Fdv6+fKuSle{UzAAyrJHn7gHvm?z$&;vQ@(mS-^KGD1tD%p<8hQX6WpaTZ5d zcxa@we_p1P^zo0AzNw7FQl&~2G$}?dG5G)Mk4Kfzf(VTOS}>qRl1Jxv{(VU+$L+>t zJreMg)~ANCAmt*jM45s>v`jKs$y|m)D%s=A0A)idL(fBl=hC8pXDOFD#)DBPu5f+a z|0I--yr{kPsBvIt-*@Y%0d4 zVr(kLrebU+T3><8Agwk6WCn#tqrZ{bFd)#BEi6pSyF*$jq>WZ!+Gqt96`CKWgm`yI z#>Qx6tX3Q04#{-d$S4^W9<9J4wPAdi^vfqxEQ0oqcOF?aTj6#5dT6a((h>R-0 z*@|Id;k-Mfl|tcR3M@QKfklPqhbbZ69g?vzE?A5L(}pW4wBZU?8y=&;qQl)G85!`e8`k|_-l zkGSX&kJ0j8aSyySbUfmo_{b>UEAD|0*Ls#8uJtTm8ipQm4}4^pCx4M)h(EO!#y)-} z@2pA>T=?8(q*)3(D+PkkFl~55WK`?unD~UmBwcdHPAQ#J)4HT*WOmKcXLsw~Bd2FC z(ny(Tb8a5fKi^_yIokkU5bXtpMUH{NA>e;W<}S2li2Ewql}8XhF8)r<6?ZTWK7s9} zgt2Yfwv(Tw1e#K%%akowzCy)Hm8(>(_CfU;HEY%Wuuk22^`%rFecYg7qfdy&O`10I zYwjNq*rH{tpx_Y1gI7WSSU!YL;@Z25lgsxm)m@&H#=BIH3P7mt(E^+7jENQq(wwI( z1yz2kq$SrNdsN}D+IP|`H);R3xPTZf|7H8xs4@=z6P+0?3<5zu?Ld<+Q-J=87J(@+ zGexvX3g#*>hAjYsjh5gfseIX_P?*(j5gCJ(ED~6gnJ05SfkwMo7^nh~9;xt3!$Ok< zv?qy;r1E8+WFT4#d&C$oEM9Gq6gEtKk2}fy3W~#vFaut=wQEO&5rYQ34Es z{N-z!f_H1|5u3x-TPWK_ye^mwP> zYz}OAs*ar8Ye^NtYw<|Z0``ZJ-prA`7SQ6NIMhg*+*k7?uR#P-PQFkWrIGogNGcCI zMhYUyih`1fvKlF#z5Iri>&~0}^o#@*yr8%)`1~}NvJzM)$S@a`;xVG~^mIS=qjnAT zsuOBSC9TL?in)klpywk(YBb)6MnF6`Y!-Zj152&aGRjpBe3ga39`|y2CdQ1NB1POf zqQi!_))bif#}JEbw9Gt9LBP*)nK&!SuqC3U=ca6SQTDfG zM25651658qlwA-xtM?mMOo2B9yCAuTi0g?grO(}Nu%xBflUdT{XK^TPQegSC!Ju5R&bxAl&ZEsDive0_FIvh%>uh2ct#T)i9TjnIciBW>%6#j8GhJ5>%dLv=owM z&dcS@N)|CzyOrSS0d^!_c+b?!TTOCx5=35-8aEbeI*MaOx=2)k5u+4ou^34zUvPP{ zDQeFBFqutujgz7_Bdr>U>Z3o&dXkFvfD(AOTlO1MWY(KTu8|ukpYw5Mg6HfkZYnp@ z#+$w3?mqL)9aaod#qgXj_h}(d+VEs0-ExpmQ6+yLY!!M=6h)#Soom`z1`l$#sA7~| z5Hr z5ZVXIN~8Knxrv5c3uh!PYP{O-Sgx7mBP^p4q`d=WDRYTA_U z3aMS7gYdx@Ns}fZ%^5*V0Wx@l@SG0vNFfLf0Br7Bat(}0KA#cETx1D*u`4-973ZM8 zdSMV0#}ow0(qclzsZ2I$+fd{rZ*2J-K*nK^azLb5l3kK;W4di+HPjXN*fdlfKo#3B z^o8rHyb$G8S(_0pzO#E~>hMJYM4q5S_9nj3iHC#&OvE)vL53<_R4gBk2P25&K(nw@-;S@G)Yo@q!;N_JID9XF{Sv62%h z_gl+VsZmE-KVha#=Jy;~<#TU;7R5I}12av55 zxt;<|*?C5ENCV$W76su^BC9LqJl=J^P65bWf-^#$Y!G?n7x|0hr2DJ#Rd;Wsl~gpS z2N%ygvQR7QU;J8a1pEF1cf@27$>f zz)q8rS_0DJW(A5vqx+~+&*ZYjjzqiT7gLIX5iMT!79*9QY7R){ol309g4~)cKG8!Y zl{o%2@dBFxB{aLr=!)Xr`MO%LT$LJi8-zy2Hg4Y1m9)e*u|*mv-X;c9ATuE~DLD+g zfJb6&mQOqIwhbCv7^wwFaYgz_?)$JwvS?IuLO$&XlnW@(7B9n%K!thW)J3AvAdh6V zqpE?km^|sET`_MD*Wz@N4ptv?;WMEueY|U$cSGej-Vj21DuPI*9l%deExMcd2~E^q zU6s6w!vdfzE);{2Xh--7gb}}3jM!0tF80$i(sjUtTD~`L3bNUaLHM4PLW|}&o-Fjd zn^g?ycIaT~LIZ^a1yvJ2N2d@Av=~NAp3+#>kZIM)oQyg7>?2BSk6_&9e|V6n^< z>6VTbIh(^^;tJVZ9^b!oQDKB?jjXOns38vx1y7K&i1z}^OL(vTOe&$5v9aY%+o@RN zC_XtJt?TtZ0Pc0pMzgXsX4q&p#Y=l5LzA?~1bUjZ_#lv%f&0(yLd%4Nk!aPI_2y+{YW!4yEVf_#_AB)ej`TFT?;V~VpH8CJGHB((d) z*o}3yp6C0=Zm{R$$Hn-<4P)a(nnlZ9z=+De22vlAgFeq$@x5)AqR&*n=&UYEemB$w zk zd6q$%Orgj&3qyvyC#&v#SF3@ud2u4AKt1c3!nJ$rVMV)M@W*ex7R!mFMA~(IxEKR@ z*u27Tn|Y=5m7BrNuwqn%XExq+%KNbf^~-<-wh$Meih%*Df|{TnXb75u01yPiK{RLw z5bpuC_kn@xGNHZ&qy3WbNZ)=Hs>(3mJG6crW` zA%&vDVzj`@nQVrz$nYpBgwx^>PK!f0Ee_$dIE2%h@(f|2+6Y5fR459gv<9st6-0h?6$tpvRedMysV;qMBYYR* z8t1_jKv36Xc4_G#H&-?ciX~F0lqU;SDCH4dnW7lpY`0k4SUGz%RpCFuF5@jv6m9sA zd?z}X0@7AVJHLVUR)m!-LIDu3PY(_w)R;t$McOVX%>@IQ8TxF{QJ0O35rFcH4GHlR zln}_LX9M23SC5i-6 zU?{2IP)Ydmp}PRN+lr$kZd(y7#|B9k7HPr8u>$QQ8->5++TjX-9dt&6)^NqCg78%0R6wMSM8$yZ;G>fmo$pen3rKd3PU}IQ{ zV+BUQ`FiE=y135qqW6O^cHV-YX7T_CR32@mfx51$^D2)^^2+r*1*#N{*G39ZX?()M zNk=R|sv50akVT@P3@&w7NiQ5>jYEhW4tSvPdqQ{v&jb`fCy+=<+v^;g>jtY2XK|+! zNQEHXz0TkSkreF$fsc1oOI;vZ1P^{xCpIpI1z=~D!Qt6d z#b!mxg2q+Hs?3m?m66jE2la9oBPD^wVL8Zhav(iJCdAS$4LT%UDq(lQSi2QJJtGkR zANKwPK8~!q7stQ1s$@yF$K%;o&-5%FJnd zUG1upEDh_h3?V=WTOg2xEi4I3R+bO~gnbKZAOr~62nmn?*?^aX-bW)lxNs{k$J9eWH^~lw1Z;|A;A~%c+y;>N$?S}2R zy^`u~!;RgZxmrPIYNo(A^xbv0XI(03iJqE#lDe;;+3sjO4Z*#K)(WLN3wsZ)ZO7im zT0#8^Ymr)8iTiMImFBCGJWypzq1m8S+A0m`A3U#b#|0PN0PMNyI-Gy)C6`^1 zv?6pwC^dTYjB{2fl={M<=yE1Cqj+^I8MPIpHb9@QByZLOf z>$zd-sZVxgxSk#R>u$$UWNNd9KFKB7s}V(fij0~nTY>)4TpSdX%dr)x8r6;gH*ESX zr5($y6hS@f6qa`ysZ9d~-jcNJ7DAUdJGk|NyJ0(VW0PgnZUuEGvH^-6tQ2xzn#&}u zwfJ~Toh^UAxn(2Ck?wkE1gi1sBV#K;*tBDoQ~49$F`wm4!%3~H$uT#2-+~-$QOeIB zRHt44IVS&(O*y-EZ$MBl_sLO2BD|*}ar4W!XZ=t%9g?KnnW6`26WW z>T@KI>iS#7G5+gL>;Bs}_%t)~w?qD!PdlHf^Ivja_n(v?8Im_&bYA-R^mF{n*7?Ho z(!U4J@lWS{RC1X9!2`nwMhfMT!kiNq%0uOYkQ^+p`Hi?h*3gmAFWhCf3gttEq2b#{ z%eRjXli*09wpc;CVaGI#ZYSMnZKGt{p|g5uL{I6H(+js3uD{idom-=*aXp_CRb_V9 zL2}n)W^S@}qDz3D(~{b%8(ojed~JI6$lUFP*;~gY^kfe1JpaZUFT8}$a|&-Sc#cyj zt;|nX3Z-@|mxn^>9{ZM3sTH^zt`o(!bE;69iwdQC)I(4x-6IFb9V%MVuD(LaJ4d;5 zEv&m4lY0HDRi~C_=O(94Of61j*zz`#*hFpm#N>2(8eO3@IXgKuQ9F80O-LZT4T)hY zck>eIO7iR|IqNGC^$ySmAEZ)uHo{_I?*Nx4WZrp4VW@D^O)Bz;LbQ5dC3IbR1fg8Oy0h)u*N($NiA3$t zZP_;$ZYu2Cr(CTqB z5z~##)=r!#Jn2dKoT*5!0`@tpc33DDZ%)NZcea;wiSqoU?p#0JjZzh5UHZ*E8=5Bf zYAgK`Hx-7r{L!M-rPz()Wk06=x<$7Bmh3Ort5g~>cicgFoSGLR`ek@%cPj$EBu$QPDtvzpapG>=n!?OMvWNWc(U(zVJr4XH4Z;~*To9$JZ_3;nU^-N%JHei zr6{(;cqv+2USh$9+ge&miwW)K66sB}jLd4ieA(CM!$k5s6FGf62s5YCC`Ej!y%w!z z$fedApV}{lmL^V2D*nW*JdvSS(ptPSrk#XarqgrXD>3I{+*+VV_RbS1GCe{ngSLb_ z*h|YTc_Z0Oybq2lNncO#l4j-kaxVkhL+tQsB>v58t|W)HqLi0W(TFXWN7VYM8sibpvm6~UIsmr%Vsok;@vz>Bzjy&HZSXs(pJMU$<{Ft(>(2TPcVBB>uYUN3{&Cc>uP#Tt|-JYE2D6Ld_i*D zFgn!^-L|bg))G(3WR|7baW*w6DT>;wp&hvg9L$G7vn@Xo9%Rm_N-#Yz%tRJT`J@f)s;(?4t5&Rx5=570nr+kPm|N>}Hpb35eD804F!e#n%y z5~yw10ZZr8rTb64HY?pb`5!ZP%Droc&Z?41vM1m1NjMKtSMmza(sEZ@(1}Z@quCc~=Mt~R@B_yBm|dzYorA2p`JC)}vQr?pl1YCgH;{l`@Jmy4Y7uQ>mYIscz={tt8h7jpjR zbN*lF{BO@SEpV1q(^wZ&aWypaEVg6Sz=sE(IrCd-t1j~}ltRL8p#N71a0b|=nHOi|9#y zWtRkICd=ck`s7qq9y_T7M)Lxr8G)0dLqkYE0~5L7y6?DAVc*FEqeDYC%W=p@YtO3J zVAoo4xG8DrfbnA$k%u47h4QfHmg7oZ5PEitcUefrTrJ158?}}n%M|Ln+tjrrfg?pK zRc$h5=mW{KJS8;Vs!#PuRD1GsCCKh$q5A4^cXQkeUHPJ}I!;xeq{_#uR*tB+v$Cwh zWk;X1nw+?b>B*^a*`a>jwWWyS9GPIw%Ch26>5@amhfZ0_E>y}gf#SrcIAxXTD=I$6 z@nB^c(Wr(br>zRx;kf2WQo8G~AZw&a*0#D^1tnZp3b@?$#^mG1KGv zl<5ewZX7vw+f9f$ zU&%`P@kn~?F8v_sX}w1>$L?lQl8&VuK{m%+HV6Nh!##dM{(0+>{CSBaR?w&uD;1O+ zdd%fXvFbQq{iqXbyj7Q@X`-Tw9M*+s5gAtL3ZCVLZ$aHmF zeTVe4WOfTL+mY{7q^H{UTXCf2)!w;mf)h4om0ONQDhnqH%*h-bFMlQ9O$y3(XOd>C zje7Csad$J*ahzpbr*?Mi@{0ToCXUEib$LZjsuM@#(@JS8GB&4T^b9uZPMMe5N?FGE ziKOMaG&00TVarlIf8ABfS#=iCTF4*DlJB5LSo3LC^G~n2nf5qgW73b*9OehD`5@ba z)IHhM0w+^*X6HK=f5d*=aOL^hqp~&X7;d^v#iKjrqq&c09^J3v%_TfJy=OIo3bC`( zM0Sb*DG`!r)<@Mb)tPB4KO^yB)x(E|67%No@(>XEgDgz z$rtW%m-YNWJo+VhznR)&oD-}_R+nHc57{u(uo+=Tekm1CB)2+sKvn{v4 zMU|lLPPgiq@trV;f|a;1-KzWRetpeu6ezKvi&nCgpqY`CQ&;HtJ!BV8P$VO}7_LQe z;e;Q>8L{foN=Ae`;;4M7yrMj7&1mXKH6t^n)vCe~zu^|D@*^}f{~oPmX5AhI)!jyH zR~Am_pJ|ff@}ZzRcI4^Fm4y=vawBZ^nNb{hgL;F9A8$^Q#Xg-x3o>3kIqSyLlc>gW zkKois9NH~6E=*5mm(CG+B7T1D94?Pd`0+wzBriBJ)FC%A)G2l_qjR&+!P0Seb20SW z4L7Txt25ra#mi?Ar!{@+)|R`4w`#ExJ>_mr*q+q)#;U7fu%@0L;?a~X!>~btI>A2*yBkqJ44X>3;>5X1bsmnbmiq{m@q#8PMb8BCQ$sp3 zU7dp;1!%gomY0@;`X=!TGcsP7;CQK4mF!wImvZuOY4kRnJbXZ2ou(oSm6^gL)o;N+ z1Km*6^qX#}8PwB=6Q{IoXXu8P5z1tU+NZO*{am>vry1oL)F(Mc;MenvX5^LD4|e2= zqmrEDrGZl#8#`d=&Ew6*UHr+rD^(tyU3IE7wOu-&XxqBwdSqvl^tP1~^33{dO0zK~_xK+3qc{jR zb7|bdWAY8ZY@W!g`W{=R*#vn$0MA|0zUfg~Mt#ebX*+kTorc-+POtgvcEfGOvf)v$ z@)nXWn|8D$+-x6rH|IllCEpe5smsokxnv@E(XGgD8)Z`yZDKJv<+k!Q#u1gR2Gw-E zE6oX-O+Rk->KV@3a>EmP_kHhVve&zkq0 z%X4;0mWk~!2v+7+=0e}|TU#bCbkBCV^hvkjue;fKp+lfbx_`K3@_4%)2J3cXOMy!0 zsuAC;kI0qxl)s@@sME4te$0H?HM}l4P5BF|C#7AN6QS+M;It!$n&aqv8^b02l?q-9 z6w`0^U?!4>5B88$Ou5j7&6R{!jUn=sYtx;r_zk^kb#gOBs6k8QX;wb!a@=Qfb|j>k zlMlqn1kH{0<5EgqIOLSTiIUpr8OSuEJTx?fWj|=Tap*g8J(|!lsp8 z@lw=X0)~(IicTHb8WJQccrM+pOa3hw$0n2-6TD>7q`va&|RNT zy~&EFM|LG>t@vS6w^+sQv3K8M21Exggl!9$iemiLM3{_GuqUoCBoa5T{dSd=WnwfZQ=I7>< zirsErBedt|=I`<27Ay3`^xRlKKsu_%xN5|DaLUaLWX1Hdy`kUy%ktzot@HdICG*-r z`-I;*wIE+u=wNoViH9z=i!8EsY;zX`ty0?!qo8FswC3Ed+tkbM+{%O>#;ckoUnuL~ zdC4+IG4|HYtyKKjzu#>|t7>t|r7gG-{jREZ+p)7_KQqK-inJZ4^?nQHI;(c*`7N)L zFHaiKkuYeuyz0rt>d}?zW-GQgO6$YC3YMHuFNmf2UA8Lrua~ztD2S)$$R>6JEZg z2(6$ZPgvn13o6EXU}Y^1R#sFRPZb5`vGY~x)t$4DXXe+-n6do^+*a&{?a-$_oyyR4 zM|tW|cjlOoX8>1%ruwEF#}T;=`F?Ch2~npfS2>}OI2H?P)pQ!J9m*$BIRi#W-RpMF z*-lBm7fZv9oh}*NMLS%2pf3C{xGjfj)}ImX;Z|W3E1ROUmrS9F8>CWLOf;KTu;8wb zuT%eV@@$ZGu8k*$^V+S*FP%JGI#kB^Y<0SD^6-H}Ww=f~vP)!1D7?Q?otJ=K23)35 zO)ULw&#B4;Y&Vj$>nta9_WPf6M^c$!WjXyWXol}-{^4?3=HYT$=HYT$=HYT$=HYT$ z=HYT$=HYTuW_k2bQYO*5Ormv}MC&q%4l;Qw89tS{8Z_$D?7a4amIR@X1&w+k!&K08 zhvaO~>LDq)on_jMhQj1}lx#N|4A^yMTX5wg(UpbyYfb}gzY)ahnmho~0L`=11g)6r zL8~)ibUh^#!+Kla{KA*GP0lEpbo>&FHBn+lIN!ZWP6t ztd2t(GYmpCc%#T#M2f#u_@~r~adQiL$3nQ`jFrnYXDtUCSh3dws>q!T{njaYJM8^z zuLf}-OHv)#lv8Gy+-%0M(5yx2?$fcmd0(K8D}*fx3LKw) zA^z1;hMY;Lz4Jj7+sQT)tpch0ZwAYLqw9{^)OnrEj^Dm(ACleRRq{T&<;J=flzUDi zbV_%ZuSAk|C(Ec;#~-bR1tP!YHQW>Ky4y%tYs+!yx-)*uZ>}{vx$59-&DFP-F30uh z#RWdu0c5fU$uByuuv<68#^}&ct<$fppyJgC(tj~?teS92tLjLPDCH~%bzd2VtL{dL zPc<(!Q!9zs>hlD47$*sQ>XRR2JP+;2U8@JJO{wEXZmgDZw=hM^Y8bS9r?8mX01+ZL zE;;IOip)tBirXsibxKXY(rNxP=j^xu+!Kc%7ZdNbG$qYx6ma=lke*K=*F*zH`#Bz`i>i1MxKtS!qr*}=RR4d6!V?riZouNo-Y}^ytXF8;RwBcO6d#ms$VVzE8UxwxKr9@VNIo-6|xr zoIuvkRu+ z`m{-IJ5i}Qe~W{1PV)K^QzxNIE9?AtP*R0Fevwn(;2kjhjV(O|SDo!OFY!6%4O0Lfs%n?@75!B;#BJH=J@1GadzmH#CK;iSM72er!#C-^y)(t!-pI zWu$YY$%Jes3>=bsyoa=@6Gm3eqJ?vMj5P1 zoOANun>mpNu7fdO;%KW9w}jz#{;cBB1?7Ry%|z0)Q-%xp^X#Va%=_^Un84%X$9W2b zSg#AnXLqc5_uMF_0{%2nbvg>3J(J%a=y4%MCm;Jr-mS-FF7#a%$NE+HZwFiR#i_p9 zf+$M`%Hbq|Bz8x|&VO9x>wz!k(z!>;haH1y$Bv$!1yS2mea~a{h~0mr1WW;%%QyQ4 zUOz$MH7pk&8C7MxcN#IRYq$~%ESdyV7TBGm{{A_gv&zY#Pd{$bUY&^Pr^Hoctu+;- zIFo9pVWzs56~^IUDR?T8M5^>9Wo+V3S=#sS^IWZ;Vt&O}w_>yAn;8AlvRepUe2-Wu z>9Ao29+9?QgLj&0dP(XWSIknUIn=^V;({ZIr(39_anvG0=1mu57K~dRc43V~KXYh% zJ2WE3Q41_Z&*+7=-v<8lW?+;d(Ub7ebq}WsU0vD|*6L2EQ2NSGewnV8HMQR(M%1{j zf02Ce(^i*l+dEFm99WE@#T6Hz#P#l#2D;=oOv%kpiKnS0Pf^EyqPM&{Uzap17+++L zkig<6OwB8k0?2U!cMMvm)D(=rOpX|`3u8tpdCl>xXpOq)h<6*2;Cj#Ut!T}<=opzB zc}988^3Q3_>;4b1eE>T+Y|pN{+7a>R{BzjeGPV|9waNTf;?&7vO?=-chmL^7!a{Zz zX<$6>^>}zo5;S~Jv-#$`HCO%e=Ik?NVF@GZeinU!G7XJ*w|c2cgXBC#x7S1@y|MmA z;ga60!XC-;((X1h*B5a??Dk#JEB{7(&;~{S4EL}+AFfJ<#IS&tf8}@9Zu~4TcgmZr zH}K_dd6m6dxaTu@NhfsqWf_moq&0Gj@{Qb6MIcqjZR?f9!n|e+ndlSFR!Z(s_ovW+ zOl?pE+I(!){>-Z1SYT`$SJsv7MESxma`Bm8IeWt6Ig7f^@|merqfV-Y;JV34$wg+8 z#Bg=tiviglX&3!#Wb%MT-(e|XOk}@$nc_Z@RRXkib?IpR7;-x zlgK>x+1{@AzYzl<7LAvw@4pUy#8;d79qZ2g2l)(k!N~b-!^yQ2u`uGpXn^@GCqlM| zxyj)|+E@o3`1V;(((CnymyZ^4=eaRg;b#v^Wf;ho=&7G*r)X#=Aa$& z^o@}?cr~+XEgsT(TOOwBopteCWUo9^qfS|*YAr_oL` zY(a0?L%DsD-8bo>`lm2a&`hu4@s34Loa-MCWgQanWU@HY;u{SGNW3Cls$#4!fv}O* zn5V6fSX}+~tHQtToEn!0!ilY(1}(&^eK%XfZCZk3#Pn~BJin|9 zA)95p8<_fzc)X(gI$D&#A-lbm{3d#JLNrM$A_Qdv&jivd$m4P7#8yfaPMMlizM#A% z=zlFE_;t9u6;~MEU8Ou$tN4%mBYUbaiclbkb5W+$Ks+xRbt5>spq}I9BCkkh(6g2< zCg(Dpu;=NvYOC+MGu+b~8doFa@Tr|Y42fpa;6HCMyF`0tEk>!Z<}2USl#a|xr&&!U zL|02-`M7o|*<7LZbG!M%Zij64Cr{loNu!L0_8pnB!$$3so6_X;YKn3xy>*8r+|(#- zC;CRwB~9njE+6xqJ8|skf=!Kn%ay2sT4DWEIRw?Xt(E%gRAQ!NH%R?*L8H-pdG~gG zO82${w?(|Adb**!47UaS-p6ms-(#%|AiaYH4807`XE)w2A%&i*kc<{3ahZ^g2I$rM zHGQCT`sd^>=H!=Dv<&*$AUt~$f%LJjo4@_VD-(m0w^xBmU&TXN!XxSv-?5*h z^+!6a{IHWl4_$(%7F#PWlQIidWZ;n}yzH3QQ7R$TkKs73vs?6fTBfiFGO2u2_Rmhs zDLi|(k+}C_(7d)s<06sp(_>!KhZeE337)(#8ucB-f@CtUh~b)iALh(_HBIiKZ%ti& zyQIqjE-kBErS6RBSz}LL80dGnd)VHLoicVB z7fO6Vd_7g)>LGajJ=B*(Wo)vTOFKvZchq4S{T5{8(HQai{O=sn)C63~}?!0j$(RXb@B5iSbib8yUOm zI29u=x5=jDO$m#Q~lCR%Wj+ zBX3r`-V7~Mod37iTovS z1Ofz;hsw)m((AV^OX+y^cx^?BK9&e3ZF9F36&eH?%HeCl-bjdxwx@_|gj+_dXvf8R z1k}cLw0Z_S$!@d;WdT>MYk+wvkFP^SZl#7vfo62+H%0bQofsy<0xu7FIa{wG!{TU8 zZr(@-D;`OyQtWf$@GgO9=ZW(V+!Wns*Cci+?W9#hg#=HZQKC21$&jjHorA>M-oYd4|sc#@?`$yv$PaeN*yjlT_g@?4k0hlF8HGp(-mp*COkiJzbUdS z()p#;8_3Ba1Y!;2!0|{H(`CN6PuLu-g&vra8SaPHhT4=<{Hk2|y0hu*=vI!@7^a%H@btS`TH$r?`BDt6Zm;-LFHT=3m}z0|AHTz> z2o{#czR+fHtc;q>>3)jJ`xpfo@Y$G2;Aqc~yLr)Hof$tT-FhIqx&NwZoVvld7Q#F9 zTK!_-`n2Tt*^5)<7R+Dc>T}$NQ_<$O_sKI(8F-kNjCCJkcR-KO)6@7h)tH8&%%i?G#P|_c$pxdu&-Uv7 zwt3#`08a?}idQtaKeA0j7urHk6l$gF&09P6^pBO3-roB^ECEBSYy+C&x60C|OTS`+ zySs;YRCwjA_K?MF+H%kNdBk{@T(o|F(5Tsd-yO60)xgETbKQy2ZP>_dxT7d^&cT}9 z&^s*QTRyfVOf-EP&)!LRnBD&P7u!|#PP9b}Jxmm~9c_1J?L zX3P!0+uKOTSU#3E+KqK&wt0LOEGsBs7or>VZ)eNPU`33kPe=4NHLAT zQn5g9Md8Y~=Gpz4&3KvTQe{Q^ti@vq+YypEOJlOJrExDmM|FqcmAd3B<}6{UIrbeb zZNzflNAvY!_b}T;$1U45Ztv*{m0r;`+7U}p5X#|h^Cd$X znmnltl@GD3KP9L`KV$hSy4x<=%T#t_xSDPJ3D^>$h*Bja%2_RC5+&3A@?-onY%I%$ zp?8Y@Yk}Q(TqvGek?-9fq1p&pzq#-bk7!7htTo^Bz$tAvp}Z<%vC@2NXIt_hj4{VX z%AO3-RxVL-{30_MwJ$k?L?{e>NucR7o_^Nu_Fk-nsaN`I>h&uuel7}=!PL1#1_GwJ zb)f%tn+8dxW9VKV`DtbdzWl{rsaibJc!*p*)A>889O3D~|7~Ntf!XV(C#RXXRjry- z5fHGksq)4lY;P+r3J`z*FnG3p3^40;QQUmn{`_uxB25>xVpL{g2A+WJC@P-L` z4$OeA0WXjcE!+v<6xf5ab6UpE%6BWFY7rut~~g1|q>usRzu!*gz>j3Yq~{a1k^B6G)5} zzKn`I2Qp=hY{7+?ZC!vEa0R}O28p4=vC)vk8>#R&FW}!%ksm?NP`Gg5e84d9563hO z)HVrZ(m{)`5Vl~Sw}1*6oEH_T2y%Facmn%*1}6g8K-Z0+yEe?flyE2rhXU^P?;h8* z2$XIO{KP>7pe!hLCV~uY05WoTFS<)O$j}Z*CWmjMyM%%aZ2=u}_$+#LKTydHwa3ji z1?I`&7w9g*pcNay9~S{Z@ks$4@84 zH`@$QLa`x#YYHf!BT-SRaZMKiDwJYMs6D{SM~Y)Q3k0Avj|0k+bvA$sFBAg@G5FVj z60U)Z7$vQ?0{JT;AVk;on0I-Y0rRL5W}tQ6&nIbcCU%4oU@Sl04g@hkwScEmfY{ln z2nrw#TnwZDs;H`f3old#Bm{n$yNd!(Kx+fw-`NrF=ty6b>sruV4JcpY4-Cnfr57D%=?ccYb=E zrm_Gi(W`BND@r&KF5(K6>mwLL$+QpEO38E#bw|l`1{E(A?g-(s0*5Ifyoh|7F~z!2 zkGVdJDj{MaNM@oJf}b&oic{eEn2M=z0wN*1C-hU(CDdb{&zlgJE>sC;unFI1&NR4= z65;@YB!eL3v9BqKuKkIwlQ6|*;}p<>G=NS<=z8G=7;X!6GDDwge{O?)8UPO7&%;WH zZ3vesC^$g}=){EQ-{3$Qp%NemqPLv@Ix3f}eKg?p%(MvTumE-10G()vH>k)gun-O+ z3m4IegIKpwguyWs5y24TE23*Mlxt^{YfzLH(e*dXfEiQ?EAXSdpeguGKDX>Rk+{rX z(KPrn+C)7x2@RFhWeL1Q`dt651&Ff-%1es$C#^OEp+LB7z@mz#KQY;0Z=>e0iHc$H zJSBt^>_7>D4M8$Nkc>pv8bsH;MAs3R0i&o7>2p%pJ}qc>1(@Z2`Rkl8A1mQ`5I(s2G)VWwID7HnCVPVBe0MO@Dt7DGr*D0uLO`` zBM3o;@|$u%vPKZdkOf+X>cSuOuGJZ2NDs9~Q+*Ei1UDN4g3l1rAhE1DYlu+epXw@b_)3a;_CEfhG}}=lgSxDH8ur1^L;kS-dzWRdV!!> zz*x#Y6m7*Bq=WJTwVE29W>Wz|QUVa$dvqiPP=)4#2~_|Yq9fb@9iW*I{v2usSOOTJ zNZ_2*n3Cih#)HM;`|CO<{v95c3>P4Q|!| zVu;~+vRR~X)X_4q4d%<|Zw-JVwC7kabNN32_F&zjizhYk;U90sn;Covk`;n1gCJiM z`7~g*^`ROoxMyJA!7$s_P}iP*0^NPq6e?1r)*lt=2a~Zm;`v;Z3P)jJg$iOJl)%@X zFmpx39t4R)pnBLTbx>bypL(>mUhtY7Xg&>&TW_rUb{0&^o^1v4Hh_zhx=ewO8=(EV zaPz&?I%vNEd|Ve!IE#sR0ks9ZK|**4R46%62kZc1WN;=_q#P(f9{9utRl!E^g0IT~ z2`1<`HUb-bO#}*voiha8l>i-zlQV2u;{h7dlEg+KvcX9E%pP<(6zJ@~p9kbppA;w#NS<4;wL z^x(8$A5Q2M$mb384HyXmXi<@6fH4|k76|%$$PaMR1*RP8Pt}3i$l<{j3MkilwLd|3 zRFmjPD*dN*^&SX%(s7e*atDo=0pmc2Gw^5ujPrlqO@*J^is{3r*%9QV$d?slfCLVL z9+1F7m;(~Zov)xO;A>)WXFviM!3#)WBisQAd<3?IcN+YH)Fl`#U=7@13L;B|N0B0# zNRd+5*R5!GXuY5S0(dfT#{zv~L|(uIgwz5|P>{Po2OfeGxMTbTy{-b?;X<8(YXe{% z73mE;(7>Ap&hwg z=uUJm5O|0`^aUQ#5S^eB=+hb}gM5UcCSW8MP=)Fuz9$Po(hyxsP6e|eM6i7t(eBF8 z#QMQOW8h4C(0Cnm_lZ&BkIX@xrXbGx8Iiy0nPmf+g$)rNxccL^9P}B%bDsKjHWmL& ztyVt?K3<+|t!K?WsMM}zJANxSI>liQ{PH)#`dr9|BIY}WkAv6&lZ|KvugY)hU=Q-B zRk81`s4!>SXwI5w`NnZ?U27xLpWhC%$1d1^Hr_i*7tOXFvO9>{QeRm$meBP1ol4Bb z$}tu0svUG#e2*1B707YGu4NtIpc75-*e&NEHNcwpV%>Bx+;BNG`Vrd8~@ zzjzn0zne5yv5P!^on<1q$4Bu-w9lP+w1}^BZS4H157XNf8goC!8L!I!8Pe96vEvy% z$3I2>80&aBkNl@-e-121=Ihu}{{`h7I!~!}4vEC5P8iO&J<=Fw4dUHYmLRjet^cYG z{q@Lk5vhpRFE0v;a;!N?!;b%$d7R zPJy4CE-BmJkCVgC_nIulp>y|FFnKbcw1U4f`nM+Xmo!y3`6yz^efXol%V~c|ASE>R zo^{%?1R}_k5Y*)uKa7!LC_bN`c>e$=pT2Ef)34iEPhMs9xjbzk_#oe$6zMXj;B1v~ zPCBRJIH!hh0H@bg5r>QHaUGNmm)EU1fxN5N{C;?9Pnlo*Q#ja_z;5mWbJRgu*%7a? z7tBG)2JnJ>1$``0M(X2JzA@kqXC~lgSvAA+S)+hCCyg!iV};f$28F00PxVQdijW<6pDWrTfzm__kQ#7wHV^l4_q5&Hbh<| zNx*`p52#`^%hUm}j*IC3+Jz=D*!-(s$#b0wJl8w-%F8SJW15Cj^lC=qAuI!C?W>ot{+N^`f5u%j=|)zqhq zjqLU9r{axF1EdoIy|;@r6JEd~>XP!cPUCb?Ph(o6r^K+p^F>LE6Px8-cL&H`aoDq?DJFF}p(21sxCHa95p?y1bT*Lg_1Zq*fTa5@H3Zkk4k zJMUj_9)9W;x@9F_zqeFaWEBLO3E&{+Pef%{%^ zgq+m`YB6`7Q7VOM9P*Ih&GHeCT|)X!8hPg~3H#8EM;71;Z5g&<`~=N(z^BKNiDrS~Jp z<_@hjjwLyqGW!k{AH{_T8hFTCy_c!9E!a#8hd`O$-|W9(On5}%B;dE(z7E*oJxp8c zd$C)nDzwX)g2hQ^aF3o-eSHwxwe3udr4m4LLOCHJb0m59{FYWUFg$DEn#cqcs%P6- zaH(LIwL|82&D@!OYVP%qKFg+99Ajyo7ydv)JEUS;+xft9*dIuE>q=|-X?uF1s#nQ;GaNvAUK`sbobN7()S zyhXsye67ko)}=SCY3FstA!TRS{qLow%!?cA`$N6QN4^vCX0FY$&WQW_u!Z@m`=g~@ zli};Vx?7A|iQ7ZtFT!i|)!(n4I|$BXhP_+6%D$pFLLTtjV$5kD zH=||*X}BdGMfwmXj?9J~M7x2w<`-3#Y(DX)h+Fp1b+Xuxzvxx3x317!;tK+%m#Uh7 zb@VHDn#bSAcG`oSo2CK<9!Hw@?%QMv@fwP(QmPsz-`Z@y}(p#1( z)OAd^2C0ROpJA5gW&FPXuqmd~F*IL{_fUuIBv>unVHbkExly9TmRaiq|35a7)b5+*iHM5_-g9fIpJ5^*v`36rK;|^ zOnKYM7P+izjmePdh@N8kbmtT{y*~}Hav^tR7W%rM@U2>qdcc7-`SO&IHm6DS<#{@8 zKgC8nv%S^+PhafYKUv`IeqqWa&#Kh^x*)cMs@=N7%@V5sp#pZ73WEivza#GOYLP&p zcCLzZ|3kB7tZBc$q|I}yk&d{J#Mj!w!LFYF3L*+?A8D{|{U}bJWP5?v=Mmc1MYDAe zel+RpY3wpK;b=Y8ipuc(nE5DLU5|gBS(=5eG3}qc=E$$bTerj@93TH=H)y2$k>8L!tB{@1RP z|Lo^Zc4Ieu1W%3MAI*1A4l&uMU=1JioR$g+-f?^%%wVOtVu}6erni32qH(i?|NdtB z6T=v;_pROWGZJnfHBn?hOAXx+X1 z;M}$Jm*#5`c4*7RQa9q9CR8?E^kL3A|76kQqpS5bbu=4f-eQIGr^@5wZ;!`a*Ve4T zw)pto!;ZPn6%__{CL;=w9x;RC*bU=b{#JrsmvobqqW+|v{g+vhSs4UalA`nNx}8jo zeTxq|<_;R9ssYG_;5T9_Mxj_Z!QB!hFj6M$985_fkrEZAi_`{~R^14!p~C87zWg(+ zq221J7?&aS)-#36!}h)q;!$%S2wUh2A?5CUFeL`6!BA=V9WZhSiem>>D5CE%y@RUF4Fmom@o{k`Td4ON%j%^b(2 z8pO%wFNy8^oqnud*21{#PzntwxeoZtbnD7t4WE!wg5tZqj{yosE9%Sc>;b!1}&}?ty_IlAlz3kY#d&R;31N~N@TS2uPi-k$#2|!LJzC{8`GhYpAf5R^IcZI+&Z$xlL-Up4-1B}9&9Hw>|Zn6}Oj7Y}-P|u9LqVQNJ>> zTJUDaDK?39$}MVSv~ZikwnbXMGB(LR|9=k)SAHd|WX6fAyIIR;Cdd6$Kf6m%{KUBV zC83RrkyC!~yT(~uLK`0=r^4W{##ux{8xLcZ{9u`en~DhA)G;q_FyoN~@BhX4 z3%8vVT9$cM>Kh$x9hZ6X;_Z2Ta=~w+Uz=KGVKtUOvsOSPIHjgPvAl{+naKK7XqttP z<pRaoriBg7U_CX@0IP-d_Y#9p>tNw zChQeqbP49Y!G7AwwD-C-L$6DvQ|etFrz`8a}_7 zKW5Y8SF_`tCXZ-T#sj~lsEoUQ7f>1Z{oWSiYY7Y%+49136UAuB2woXGVr$CSZme7J zN?IOs6V-Jp!qW?48phw7m||6_MJ0z#(9y;2P4@^W{k8x2mM9puP#I30Upw(g-SGMT zmgV5Vu~wv1&W?bghY(`L2F*Cg#QjvuA@ z_WE?MaFkMD)qJku5RTa%OIWiZk)VBUarix~xu9{Erv$%vE@qJNWZL|zu+VjGT630% zHzRd1ChwlCl7mVdVbWrMqj^8m6b&d!qzZGNu_uOix=k z{6VE>^f_^t;rW4dwpp@EOi#nl^(us~_fTr+bG#rkzL<$Cv9iaq434C7X;Mo&!-V^1 zA+0<)mGZ@9M0P6gjp9}3Av0?stt>e-NvgMm`#T}8A)0nB355G^->Ln< z#oC38;A*F1tNJEU_07?k;NF;kf%gwd%_{51Fr6Ods&D6QbY8wvhnEq}aMq3YRo}k1 z(Q!NxJ**q*Ro{l6h^vU^F4hhCs&8d&bd{G83!5aaQ93;h#sp|p-wvKGJQt%jS1?E3EYhd&W#CTE+cf25$}DZ%>1Oxe5EFLNu)Y; zh*6Ad@QrJ-9a{e>#UdfKD`g`suns|SuanJ5sI_M-LUK9|`G7(xoIZ2?L~X(PcYfapbUTgcAp2H{}{ zuZ;c1!}E6Y`9HdY${7ATl*+j0ckeB2b#)ZSy+;d-!~YMDY%-|TP%_zmPd$6s(_>LN z`C!it#fYu-@8q_6tD!X6JF;Mo-RW(&R>OD6tb1-GMvAS6g~MnbEwLQ_du~KVG&@IR zN!j1!$i8y~dMrvO2esl%SpMKx-m4Af5ViNmDn4qdY}{2nB}W!X_c`hvvW3f%G zqCV#B%|;*z@tk*5i%iCTvs1zTqe>o@GJh>)mf8DX5@)$?pBr2kqsX(p81uu8AGau z&-MonIC8)P2nsynbA6JZN#BxpD(0c`Px+LNychaZ?g(ZG4r${^E zo6DeBjV@``jaBLWw4V#*Kgfl7x{kKyTN&xsag^yL&zG~>%_Z_5l)^kcN0&6}Doga{ z=gQxYwpLmhnbbKI>j}=4xAPwq!Y-;|4OLdF`gLFJ=3GW!&zA@D+vi(F&6P`*xV|Zt znfkAu)v==^|E6QV0fjit_NbmMr0#Xw6yoRE&R!nQs%n2Z|8{hXvgxb!?3WqO)2WR! z<}Nb&lKr<~g;<_&hxkoW48w1| zgMqIX`anfa8YKZFRDX&=N(?ONJ@05S-iLii!B62SAI5GdrI{!gr9fXkg|N~ECL#$Zy|bCCp#e@z@9Aoy`B+W%)<1Z=x1RJJdzUK;aG z`%6zmi-Gr$vC>L@c$n>mpVCTpIHhlhVejwRUX02IMWu2qJX|~_yj!7qp_M+fPp6=uy3~i6 zlo?d)jn9b{f;J@o5^`QIDvWz&ZKz&vz+KhcV6-k-vr&+sfR7%QA?P=_u&R zAGQKFic~qCLgx38lV4HFuX1h7B~ZOb%wr#arR^n{(=U4Xl)vh!xia)9h@3IlKX!aQ zlk+x8y`Wk(A_-03Zu!s&ny_jiS1Y^ve;>E$ifgO`_YV&~$HGl*JgF)kJgE%vY@GQ> zzH#y+?M`&X^T^bK0ZyrB7qbjfI3ssYLgRdn^2l`qlCj{SMtkn&dd5uCU zgHHl>q-pQxTqyI0ePVL?*9xiwB?SckUG08Ye`MH-ogDAvpVB}Ey>)7%{K1~Kf3r9v zHeFY8f-*8*Svda7yN-BVs`FvR$Jvy?P$X;#-z1!UbE{T(Ml53ZH>F|3@UCi6N%MO= zPuTS2mHuEAn>+uOjv-Ot^1etQc0J9%$2n<}T^rr+-lPeSeR(m>wZ@c_I)oZhdyGkOvI%N`G#r+@16IYXQgX(GuJyGV+E4oyQP9BD`QWZRu{ z*UGvEe?bQkS1iQd-TovIo<5y)g4;eZAKjFPPQ~|yq6POEI5K(nUud*_z{=HtNsPvh zyoi+#y|tzH&{wih{E-D=SW%(A{EmZprnA_mL%Bs(GAUgg9B~(z7eGKpO!^|%HS%Km zgS2g4KwfS`;|llhUlfno)le6iX2+q3?(TYue$})E<|y&nzfniE)UN%0H`mgG+4dob-Gr65Rx5W4RkPgdeBJ#nOKBN>nb6*`}QMSIn_=csbJW-oKyr)e%B)C>aFOASc0x^MY-%49m-?4`@4M6Uq#=vJ zn5B~7Uk()HwOWbjgYO?E$ra_LN)NS1lJ7Jd*rkjpjl@{}_y0!ryefP3nV(@lj-1GP zYl~0*o<$W#B1M_#x9qFC;aA#S&WuGjdRkwLU132s+bSn$X02n_HW)sP)33k>$w_+cS(^KDp#JkK*IJuIi#b`j ze5y%@(oiDmVEJf1?ZQEUM#iBpZ?Pf$a#N8eA#j!F2EK!KHP3QKC~W;t>HOboN0=8H zjTa6bqes-}Dqgc=#vOj07`btsVnl&v)3T!g>;L`%k~#Nt%nuK8~w z;k!Mx+`XfgK1+Ii+^ax0uC$%>QcJ05?#cZsqU#CGia*teY9yXn!ywOu5S~qe)2VBY z4Xn^yS525Mz(yxNv2r_h-%h?lsfF2`&T%<-#31$EKh5odbJrY)Y0XconO-7&4(91` z)x--YPYDu1A^K|96P0m}u``C3IP#XiB{e+QmxCIT87(_!z0{KV%RJpPf5ejPz07kQ zrBm&k>ZmohR2%=ul9;hm?_yV2jH;YFTRKZ%&DkTbl`2)MZz)oh17nO-N~9)oclg03 zz#%PMpyxZ-MbRu2&95Hr0LwCM{Pra^UUvv_zz6T?b%jK;h0#78@uz3hV=rf}k)D$! zPoV!mPDVrK^s6dcRaxt;!L|#bUfquo^lx7lIe9|j%D3hnH_IVIBPkoGlOq(4VW=`e zuamiBTO;Cn`G_QgY?8j~xc%6iAL8AQDgUc!m38_&uE%2e)rV3@fiI#&1K)YqqCkC; zd~0SzLpEB$T~PJ4UhH>;>5_{$n1z*v!r3VSi!?nWlmP1f)V&6UD$P}eyxw?eff;MyhvXJp-FP#d+k+7Lz=E$f`mWzc=`gzEC4 z;EQ!61EXFA*BE?*ojiBu#D~ z%{AD|Kj%|0hTmDGuQB||h|A!yrm&n%6Oz<6{}ArV;NJEQ!KfUkXIx06+cyv~bXpPF z{nF9wLpUE9YCrS#3KQeATnA^o7mFWY3Xme-_Y%r4QOf^Ke<_c}(fjZ#JM%F?qj}_8 zZEFd8Znj{JRd}?u<=wy5R!bHIH#%Vh(NT3dHyoCgA%z|QT2;@uMLE7@!gq0fl z7tw@6g;x9!jn^zP@^AalGz`EL1p@g`YiqGQnS>e}t4rG-r<(IF$SLR*#ky=RvigT^ zX;f9Gfu=*q*NEq6!D)Uw_PXO*ZaH`SzntC$q-Uo~@2h!8M2zW7NZo|xp3mm3Bs?zJ zfP=eiW?@{PU{ebbDfmh^UwaEpE==FB8&zOd7*^Qa*}Ab5lxN09O_RTfmm7aUDEFmG zU?koF@T|}7#`9!*MNTk2B%-7kGRDcATLFo4cv+;?z$tD?_#!V_0m2=PYm+tkiBb5h zs7i4`Q$Cfqg&@wBzWImi{@MPEwPN}T#s140C6>(xqAgTS{maC0J3#}&_Ep?`ZEb-< z?-0L3j5=EeckMk_(jjJMSJLfkm#3^I+l_KJhp{w?0L``llpMDvHEp9s@FO4w-_$k+Wczci*P78M=|mfyK2S#0nlx|u zB#rx7zxYsexX)R@LatXQrR<)LGO7s6EYSGy>!v5g_oMXOOOZmW$vTm^e%qoSs})cA z8Hp71-OOXd#oaC32iw~|W450YU-dJ5xkst}rg}hv${eb>NE&J30&8HOeckVCEx!Cg zIWB!p(e{T$?65;(;+)Ah$izISHrb2HsHqZy1X%b;&&WbiFzHW?h@K&Bg|DbQDZW;1 zp|1K2nM!J2iljGeYizZ?tQzMpZ_y5p?>hw>^Q||i>)zfpB@%}7e=ASFkj2mFP21dj zaJR^PcQ*DhXnzMgW+KG4;nk4DS?yVR;KGo*apcyEs>2FJ@`MjVa3oI!)pk9@cWsoG zUslh3rg}7&g0{S{N{Fie*%+2OnqjiP_3tJaeN!+waJq$uV=FSfA2&_<*$`u?zl1z~ z&nL;7Pe0@9NaSa$zl6iXA*a#nn;wx&+i+i9(nP5^-9;8Pc8SZc;-oT;>-{WD)LWiT zW^_b188$`K6ZsvCHQ~{*J}QSN5RvubVp*d|2oLkiIbkW=H)acOm{nUI)G;P5fBlG4 zD8l?c84|)8C2D||VdA5k02xVQRo^5d&JoCP(3_G%wQZP$$!0jGbSjsHeJsj=H~I~FB>N(P**g59ch-SGKRzpG_WTtuexuY#q(t`xb@2|1`fIA_OOJ8 z2o_sQyCo~h)f4#6_%0s*Vo7XJ7G_tK_I6{P{WEqpST0vxEzM9P%_F#L5yI;0sKdG6 zdg>tm)tuy~a+1_-rFo=uh96|=e^GSTVNHDv0LM2*w{(M&($dZRDc#*A-QBe*sEBko z(%qdCrMtUJy1U-{{yUy$?77?h-0wL%J6FzXWQc+ct4B6{{?jMk0v_qyZ{pDQ+!Fdm zVcy{$mgxN?hG^b49ya!}RGZQzsT#}ay*TUFefb3}t#7{XI=pAEtec(aW)Xgzw%MLxhlD$w*Np(ys+5NQmV^i7xr(by2tDhl?r6tBwMR(XWHZ@A$6FgbCl;7rU z2?=yeaxm^{K72eS`rgRjR<%@iSX}%4Gh@H)z@C6Xiz8xyyr4ir&LuCb3|{LZ|J!S! zBGP=s7SkeMwmrsIG`i-~DnXvH>q5auX--Ax`zn@*Ps-}7^KOU$jn6!`~ofA;%H^4Y$E>!u3dr?Sa44!;OB` z*t!Sfjc+uRbF@EGTZQQ7xU7@)oPhh+3p4?ndkyKY?xFgc8Oq#k(6}_Ot;nw}OItsQ znRR`0@5zwdH7=@SFX*us-7(Y&7#6P6-&ZXk3{`#leD5KZ!8`9iAR=4zEdwJ_D)E03h_~zRr3E5q$;m!^b}O@>vi;HuUkdr;lNy6f zC3AfE4mBT2Ck$7z{8MqQ&eyiOl^dzv^PgF=|OUlltb)%*6B>tJ<^nRmv-S&8$mL?*u#b@dhWV zt#w>C1t(u+C&Tw2wsRY^%9+7kV&EX+_(Zn#n?@)t$98aEDRERl!v z7?ao@K62jh`vmO8bD=^;J-v5FowM3T1m2MU(qnlGS;Bu}gkd{tGR2m~>CV_->8SSy z(kCWK{floL_%Y1I5SB<&YY2v5;EtjPW3KMI+n(oh4c-)>1ARoCKr_5p=uaTu?=aFnpUrv z0)AS8=171YrU^?BoGbk}!KyAmZ=c6!!TR=%Ok$XWcw|zUt7|%3v(+M8uBPw&%98WodE42u&mtTTL({DKpOm&5s@1Fa1wXeQ#c7 zKJoKm4pE|99(x(f+q55X-0!XsjVJ$w_fZIYwo7Sm#OJ@O+OxN2eZ#}9s`RP<18+VI z)5>!ev%ieYnm~PmQQtS0gIGnX|B>unCZm@4eC0rMGXKWZ>*@lb`MY#QBq2S4>V4%} z@hWXQ=J(md+8_QacooSDx@Jp>n)HPy;9!swZt86hL_3JH$JFfFd@*I*-Dc-q@NO_K ztI^;VS=I|V91|iWKMZL_bPkX608p+>fBn&sc6T@vvk zLwrinrrd|&H*Qwain;8c<%D&L%w@k%Ks5^K-TKL6<9*pmO9i5jUDQ96O*l2+S{-g%bw`ychkN-DQ|x2G45SDi1h+{PHsn}G<;EaZ=x&$jr?V` zt|h4;nEwub|C*x2(WmIE8>#Oh<9RlGiqAr|T}A1ubKbL%;q^$OV7>99oW0=7eR^(S z8g@xq8FeY%JKP)ED|@rOlxmZ&j+k5{HbcNZeE&AXYLq{XF+0X@>H=!G?my%Kx4WkNvDL* zY7*Dd^VHrx;fxgft%I#dZsTaQ-J;;lV@A8H_3S^}OedpYEs!Fu z3G0oDRHfw=Xa9sMuWuoz{s*#*jJnW_%R}yotFW}#BrBDxP->R1OMKVwfnIDGU=yV| zQ2T50mL)&1=Z6QVH}$7Q-8c89`)sYa5()mxUqiq|NR7ONW)Y5${yND}!QEKBVMJYK z+`)K-{Bm!KUU36f=x$SFSoFKh+k@>7)nuD{*-3bo__~X}uk?%}BC&sDxJAE@cMel~ zo_%W|^m`c^YM^Ueit~%UzQbw2ODh&7*S&^AF6__JwTh z(KYLQoX{G#G>NP;CINe`)uJaec}8DB@$3UI#xrWFWcp9$x+W1@#-?8R%PWgPptda# z&$6<^#i7i3%$V@93giz&(73}D@`Ww^_$w(gh(bIetfv{*TUh?F#^?Mmcd0T z`mE%ra(|?n#S)q_^&F1 zNxIXsoCL$4m~}DnF!o7X0rwha;@+^>GDEH!c`VJN|N2rC9mLFYP-2w5{mE|l`ku@T z7D*Ir5ZvJ zlnV_v83W(L`s+mdtg1Z|wJN9;nO=wTt6SyU+Eu>i9nsM2S+rX$!wi}Kuk@yW>Q5}G zL%W;9d!lBx(2<(`voFtlL?B+Amw7#gQ5vYY@@Kd`{`K7GdYWUgW2%M+hII z%8_$^i6_swEHH7}ef7p(l{0MOaFap94Wdsp^~}I$%g3~EBKEEUQ{oBdZT|hJ&*nfw zcl5YxNbJxxh9!+9*UO%?u+v@)Ml9xRN8z-;K_t771+V7D8GBUfs@gc4XRz3y^-ziN z0E^|q@E)s_uo7EDFb_tqpSQGJ_-J&2ZZk;DUq?h)aciB?oM&&$SDBFTS2+62-~GoN zkrMg@L;17G6f$vp`K;H^F9W6qeEEUd6^SF-wiYRPzL)9gzG~^bYr6eaVPmIi%3+xO z#NPs;!U~IMeH!3h(yYU{Dxs|T>5Ts4^aQ%)+n=6KytUXbk| zxJxdg@>OhCi&A00m^mppg(>y5M!}v!Y=80FqOFRZV!kJqMcoX2-}x+vg<>yGK%qyy z-1RE`p$gFi*AK>V-f+i!&Q7<-e_}80SKRl(4vevX4uT!u@XPGjT8!j|V~$(t`w(&b zu#?VL{ZPynFF5_P<-hWR8fyckgi(RCH%f*RoN-cw%}K?|^8&QB?*d6YWraEW#3A(< z%m?MJkq&kcih8pii(YPD)o52=sg;ImseBO^51iUvx!&DNf!OyGkJ&sdRbft0F$lJ6J|irZqxa|}IcLal5|ydgvW z51Edo=00y5cQs)J(<;@-!|lH8G@0K^*E$XEJ2`IJr>7pu>Yr`!Om_1Qn~TzEXpS=C z;(Z&HCCd#{3KP;4*^Da0Qrx$P#d-r$cK_uJy^8uN7mWJw>_Wxczn8hc(3sJ^_~*lH zQMIvnVtQ#UcCKpS121;79Nv(8oU4hum~ZAhX{;JSnZ@y0 z%$Y_kckE2k!WxAGB5pC}Dveq#*T@Ez_FD`o+WK?X3S1-KABK4>6LjA_^LMTUa<4I%0ZL10_1}I;Yp6Q-Cfn;qDJLg2$za1Rn@zGANQ#nozO2F z@7yW0N{oxrer<+^R%rPP4r()c&RMc%|7la;r~g1<9W3y2de+Q!6VWzzpL~-jwJMSM z^gG_rCD?JcyOts`+?cn2aC7h!O$Q^#K~l~hXXS=@lb%VC%s)x#d-c6a5+)80al;2PE|Uwy$*B`b%V)1w zUp@a@<2iX~yKbhIFKnN#Z}Td#T^!Nr@p9rl3rMr%`jGT=ANQd1#l4df+rJO@VQJ&< zZmR*oi5ENZ%-N3Bv(-n8m+y~g$~##m_P3ATs|uY4CeGLQ1kFDZb&b5|_Jv(LcP^8k zt9v8j>je{M$(tT`k6~F-Ziy`FJ}=E(Y)RH8dYXhM9p6v#ou|1_6k7Q$Pioqk?i>2b36yw@m=uxE3iGV>AsG{NgTF^}^!qR*PluAoC~sDH7Qmg=#hf0?7> zNZPF^iXRtf`f~W>#I;W@#-dHPhF&GaPTOG3k!!#=ljvz=fKs+OMmlui5@+b`w>=thyRL6 z%+$j}*)BK@5!5DC1-;e$&1g9Nfo_4LaWd=%k-$AdRb<<$-;D?U<++jR91zpL5pyxR z=)y^Dtq=DWjjnr!I(+-Dy8ptM!Nlou&CM>qY3giRFzSYLYED#1hu-n$^D-IJOd3X; z5Tnc1qX<27t5dRA+y1~h?fuW^)0X-AS>f940pX^B*xz^)1(HR47TSzQ^}qGEA9V$) z4CX7|-L+n4TogIq-ubTA+8?J<=W&p3kuNM>_-!`MURZhei=Mbv`a(!2AmOyFhHVSQ zyVHInK@0BF;R2=4$7c@)*0)_Eze%l7tuGui%Fovg5>EV0I)gna-8~OK-a}#Rd-g$p)` z{NFpf)`zJh&L^3cq3!)%5s_NQe|t^_QTUV7Fp{v0MP3+K8uqBxmt&@F7h^Y#i5II~R$_2u8t52>G%PNnB(b=sd|o0dd5`n-uKU((VA9Aa zi{@eOpYBzF)3gF@yQ<$e7f+cxdhbC}N|9#W8=m52yufpz%lw<~Txlzw^OsAz8}556 zcExJ4`nk`SkIyRVyJGWKOjbHsPSf`R&c2te$LB0YPn)Crl1_fRt_j&8tbi%UVt^?E zfGHdgaSyYVfGK=FeYlh}fGMMZDJvYrGu4|`&pX2e&#ztqri}jIlsmu_e;vS-E5H;M zHNcclu*EwW_3cXIvZCbSy{l8!bbkq7F@s- zL%@`Qp?gA7!JB%P`})D8%D`79tAHs+sUD1UYxQ2M9Vx3<_kbyFHm4_-dw?m6yMQUi zfGH@eJx+^WfGOI5DN8nhDSrV|@&HpZ%S~%^wTTT|E&)^cFJ^M~08=l_@$vHE#`1wI0x%`@|E8z|rjY#Kls>?eY`_$IRGj_{f4~%G4ueQ4 zGf9r266>B3aNN*O=DY2(%77{7+w!i(#egZa zCPmeajTO@Rsn5&F@2Xd@-CgBP*8o#wS^!g;0aN}w0H*u`OsND+NvQ=)`7&7`>BDWI zoi9I&YTtiGJ6G;7pZsXlI^sLkcmj~J&hI^(S5V}n%_SNCK;ZuM5kN}Q-M9Qjb7f4Z_|s<$xx!(LSG}`WaUh7v3_xU{b&&& zMg96~z~h|vSe7I}$`e3J)CoXJaXphx#lY8<_VAB&PRsM*n@)~`WQHX(C7!3UnPQnH zxU@9QZFbX^nHq(ePvd!Vqqfc~hgkRb(~dnm!!zBaoQ4!9yEjH+`nWVy^##%qA-oESio(<722~wiM*t~eOj$=$Z+)jTM4!Gs- zcpU0VH11DF8M7GaH?^4e#84B_FH8DTiA?$bP2xIfaah=LKfAl|FJ*ko zP_9Pr7xeO6?4Bv+OIT~K(`XlXUnh3|^sucavV3NJbs*RdykV;UC9r0QnvgFR4FA0t zOl-$~x;jufM#UL9a8UXB$x0ws zdr)BeJfr*;Ym1-fvYGqN->3a?^ZQ;(LG>9<6JzVO(X3X;52Aj(9GCT{UF{0P%yt_! zB~4jb*X7GS{_B>O2L2>AK_90So@Tc0?%{j-AMPf*gS)dMvyFi<3P~MWc<9L6yCN@9U6zdNswa@}W2lRB+_e|GF@bo8fOEScU@p%knr=l&G3z74z;Tea4L zm$kaA$%&jsT2)rVan3d(&gD|!#`O_lDPDB`*T8DytJZcF9=H8sBP zhqLFvi%DsqRBEln_Y6v=sxUb8L*%eXD~4K4!QKJGsWiQAyEJ@TTm4t!QB>6qDcta< z^kg6N+}4NhmQgfMthG+d7l@rx)141SE<@l^r0|=G1H7wp*%L_-NW*}5<{vRrSo|L>^K&adt z1EI1Hgo+gqDuMqGmDfP1g#BRM6ZHT>3RY*}5ZN9RWf`==HC3 zGHU7s#{(c#{&X=di3S0o@(hGZrO|_a_n`gZaV`)ly%DWkeQr|6GeD^10-;hJ*!rMJ zn)FO>4TOq8BM>SORPGyhAXI|SfKZYCf2bS*p+W(K3LhU|joTy;D*o4}Ng_a~K=CV_ zTLXbmi3LLCX5Z6#uMr59yW5{DE&f2LpkQvXJe~ld!Ulwj7!WGWmO!X{1wzHjy^x7Q z>0^Hn5Gvd$1BHjntpz@|cNqVR++_$6oj>`d^6fzh)(i46#q z6ChN|flyg%8Zk!wQ+`wrgvxLn5GsFwP|++Gal4xWLM4q)_+fJx2$hbYWzsrdAXKn` zPLWKqhl|p$SRH^|~gjWGn z#w-Vocb=~fMo$1#s{ecy7drz``P=H<7~*-T`=is>y*Bvc$FMj66*36`l?ecqtpB5u z1E50D0H9(5pb~fppt1m{I)4FFt^ibwFwm3pmK#s5ya81H0;oKR2DZE(0Z_3A zP?2mi{Vhy~4*)85!T>5G04nj704lWrDnz#cDy0A_C!+4s z*vAw39$SM+i@n6GeAy_2USdxGDiQ!H9RMmRswGq0#Zuu_Z2&4_z#a+S4ge}2092+f z091fXsSe2GhA$@rsH6a>@BpY_8a5vLegRPFZEdbM08ml?1)#zOpdt>SqGo7kmp=@k z;{1P9fJ`|CGR4pNYgh&WnNRfyfQsP%QE>xM$puhxKLSu`22g3R08p8v1yIofQ2DKY z#J_!eqTS$N`dndTPIGl6YHjRuduLQ@JxQPH%5%Kt!bNmHWoVDJ4cYi_KKItnVGv`y!1uspO ziaXsFVy?_<;K!_$L!iDB!tXJgW=?!kC&T8QiBv3rf-_!FRt zxO9Xcx95Y`O$;aJ)5}QmtCuRLWx^XYY}4!AK3AKejqdu{2pS`f(S>@pQ~?LwDmNP& zi~p;VbbYvv=JC(PGmXwL7E&FLV;aKL;-(27D{5dQ2 zJ@a+}Rf70z-GI#m1jWAqstB52STzEjqTBm$XS6@n;8-1rM|-T8DsWVMw$WXl_ytX{ zqFBv*Duq#jK-u#^K+2@m%f%fp3dvg3Gqr7hBxCEBWYFaUx8;xOgUP~H3Tn~o@p3>F zQu!naKhIv=b*H;?875LT0ls=b6&gSlinDEn6V5b&_SW0S=21JjmZX^?wZ6yar#)en z%)A~zl>+@NiRH+kmld~oW$!z^r~BR$v7jZsUw|sHq35cZo+Vo7I5ykEd!jNpdugBa zxZNlIi5tvvbh@5Rt#dhNEpzS1ZZ;Z33|M|%;Ir@ZI>3LIU1*WY>$!AFO{v4t;dVXu zjK@X0%$fYKdb6N4m^4=Bu<_et;_Iax34xU&6~E8mg5?EQx>()A@TC9jh2_iDe7*YK zn+^$_ea{FC=QJiJ3Pg{DD_zRCOgE_C*Ge!FCYBaE{g*+zfUGt%yb)9TZD6NI{b;FQ zY1jumPZh3(A+jQ&$S7+mHw~jeq>PSD_>)<~5k?cR3bdBUPnmnG+fzGFc!e&RgGt*; z?#Dt}`YXp(4O5=BAgKCB!jCit#U9UP$m)l*-&H$@)_hz>vFb#;F;2vRC2i`R%+SS^ z=|)MtL_(Wdtyo)e1ztZnZavGySY2s8hA|{(`N7i#cnqQ57xwQ|Y--w(0l1$N7*dz& z2+Ow|CEw@aU^|;CF-`PqT5Jl-SxL=wgr(D#Sv~Q9cPb^?h=nOuVKI~Gq6R`gQs`>- zJ6Y1S!`h5(t%iN}*W0+>_WXTEu+3U5nh|SzGr}#HziP?Wp@rFH~{cB1PsCl_A=jlzX$2F|H3iJ;kJD^gq7e z@)zv(dE_Yq)p>(hDt_gC80--v;RDqLI+1pZi*y9T47}-K<7v9y3t7Ce#eXqAiLsR~ zSCHotI6Fy|uA=tulXYFF==5uq$k_M4R+x25u%TU;)@`MsHam&Q&YRJu5NI~UOky!8 zrs%yWE7C|Zk@1VtXaK8mA5dj*rVFUZHdS^qP0UD9RM!1};@AZJ$`Xx7ec0gmmUi#Hn;#%lY@hH&nY{(6?!aV~?h{SUB#C^Urmjmhu<= z@W_{jPe{)n9qf`)?;VhqS~*ufVoam%fBujD&6lp6(>t-Nd|3}sbu{+RVZ3>JLiCo2 z8=mRpSLMG=i4*u=eWX`t8BY_A3)7I4E+(93nD`w>g!g8qh*#mv$6AfVV+4y?VT;y1O`{NeOB z`6}u&+>7JC{!rmOIib z>EMntQ`J+BNhp6)+3`7#y;40ijiZj8p(dcGQ9R+^K>1~$kbSJ?<6x|!M2+Rihzw?& zxz}|iiAeAu^sQ}KdwW4T{^@a53z==~L|g5)771EA=`^YDG|@wJo&Yy>t)_Ze+mS-* zHHu;*D0VYKi*1w)yG)9S>uOC`b~bC|-_$r~ikh;P^re zA3evhW`X#kpR@>%1j8cLMT64)-Z#{%9(*mTulBF8@y>64WpoDp`!DpZ=)|{zbje!V zhqY{xWsh*W8aa{Dp%ey#r+MS2lJ6SCNgbaVa^*aC;+NF~MHoxC=H?|R^EFq-sm>5oc>RS&ZI}5lQU#FG}o_TXIE8@NI{u&VDPf3FAj^Q!A0tsMCK}tj@~B zN=01Ta;~OtV%fDn)bC)(lEmT|KWvsqSpM6Bzed`dbfQZT{Y-3D!|_2h2_*APsqn_x zGG?8z=j=Q?lz2G(CmWi~K_;I&S;{ZQQkqRdvaq_KDcmI2&o)*Tv0U;81{z(zioA5| zjlRz7e_%*^S{7skG0r4TR*&8DQA`fu|6S-PxC`#d^WRlBQoc%fznDkmnVG4z`VwdH zp3Yz`m_s;XQ+jm54uX)SEZ+(hd8-twSKChNlHGU8WAD-UKG3;`ooxDi1fy+BS*k`{ zHj3N31oB~JMl<%%)qAmGgO%`jjdgt%=J%!^xRLX>iWecNfn>5BpR!?dj z<-P0wS{d4Um*AM6SVW2|{rJ|Bn#U=hg|_PGQCO#q#nzM3mmhTBxImrMXJ>O?eH>pZ z^C7qNn@+*YTW_7H9wzhqtDh6nZD1xtMhG)=2&Q!Z-sA=K6vfb6M#bnOVmc{KlBp5f2FD79;;aKLLWTzk&wHV& z`xLVI=O8L!7a`+$(B65;@cRb_HO!+w7WDFwX1fG&PP_|N^o1>yEYh*@+Tn=Y`F|fM zw=`Siu|(KK7#PB<-=ta4Qs#Hx6gkwx10{-UMv8iAy&;zPLssy@(2wUFWLH+17rh)p zD}4nbH=am2|`?Rd5a3?s-?# z6ix}U$YR*8+kH&PKco<}^!}UoV3-~r*wWzdYBy_;@A3B?YT}_^&BEu+ROyTaw+_`# z=l$E~x~GPKAAP#)WwL5SS_O(XJP#V;6((q6FilfQRn&jDbY+V5cDbe7`lPD4sQ92V zh#PnsHV*14p%!1*w^^knY;ZL!pZUQWsQw*apJglnhq2 z`{(O48A(m{ZLtQ_)f9}6gblF+p;I;lJ`5kRUGC&afqAphv_XsTG*DNA^>P>-UWF|oxYn>vF`#ovb#=71C-=eWBE+}omuM?sTLd1+%=U8?bS$I&U>&@K zGJ+%m1(ATz37HiCiLT$YYFqJ+VfvswqB4O3!68cDfBuX#OtC(@IYE4)!>c0rj+_Gy zk@7l`DD)qee1JgUPYBvaVmd#z~G+&vm%=;00s8#-ogl0IBIhr=8x15(C>!+^6lW8^Ft z4B&8BIjD<-m}N~Z+y8=xiBJ{Q2G;`(6GQ{*!o1wS`Ze1bV}gc<+JQt54~BBBL10zJ z5fnyFb=&Wwo}b_}2#6`x7C>0xm7!#D%4BdGxCM*` zzXx^UwzN8X3#uG#?4o&q3y`c3)N{CWL*hbnyt=FIc1H^c&1~juw9jA_klF9xmz9Us zqJb|JMsPGJvFWQ*(k3*zL+5X}9n`3a`u^LPRU|AZ*vKNF4p5g!JUh9TTeEY9xIat; z##Kedg7FcI&XyAEMrXM)(>R(1afX*8#OP3jKy>W+a&e1FiESIq%E&%z#8t>PNK2^r zGh6*}N-BQchH0XtO{jlC?J#Bp6Ua;jm|I8|yqB)u=!V-Na7_8Q@z6o|0w+%o)+byE z&l=?vr)VrVhDa-rQBX*`^K6A$E6o$rBp)~VKeS8G0yqK`Qs3&!`?$08mhJHgPK+Qj z<#ZuLN5l83HSd+64sNM1X~NgVYeJHQM?z^qX4ER_eXehA`dxQNz?-l*sM8v9Gz2;q zwop$x8%aYr-ztcY@e`Z_UqE~UnbjK^+BJXFC&HEUX3wwgTT_cL7h0YZxa&$HZxYym}D?pvsSWZ!GFam({ zoJXgEpxKVt)72ef2+M(T(2=SlL3Jx`Z^35?S(!>oz&WY{AApK+gP^*Po4t!P3JYwL z1z;Tz2OT&H?g;9lnJp7;EjXyCI-G}do06_!P9a-C&`b9Y3}$9aH=%M!s7TacE(9qH z7Tu8dRFQh_{&0V%19>!UGGq!O4bBIJMCdm-?A2V)*O_!8>C;h;(deSG14p7vC5tq0 zMCrNNmHw1489NxEL1WU0>w@+fegw76#)4H%z~S>qwP-)5ZD7?3%nUh2{Ln6$z%_xnTUCn#08;;(L)*67*xrib8>=> z!%j2g86sZDB4Az++Zw6^D*jG`^XhmY;RN>aF$^pVVFEqCazS0!+x;4^qrC6_E7u2y z!p>oW(P%}$NjjR!Z$4{LO48)VkB_bisR7%=szF^d9{UzYmo?8jR|oK6Xy6*-7)BKm z`T?Jf>gM|bj_uWU$NT&m2w?^w>w{5Ekzm{(t`B`{NnQK(%E+P#UBEv;^YAuMS52j%u&brUNw!=Zj1E{| zg;|EogoJL867NB8yL|r5`veIOzKsx}!)OB2vG3iUiS=S-P`Y2TaH9&L5g|oFd_f`9 zTn00`*FLnBSfn7XY&;h#7A!JwNCFO~9R-6vlYl*{A~HJ+9T}_y4nbLNTK6{pH{>Zo zU4@&BfsNt>3IcUG1w7s!Z~porDJBl5g-WgApT6<|9Nf&6DWySaY_AUxcEPg2LWV>E z8^m|fcpj%u-I-;Si+X_!;39|**}T!nbY&N(>)T%i({){LoU-Y-U)i8zqYZ%3DJ9&k zwuZWU?He61rcfgx;qVkF1FR~A-%hb|y+M#6IEW5;4yy^w58DHE+4=ZV-%wmkHaXLp zA_pOvgSgg&VBD2g2f-D=;}t3n>|Sopd4NZ=!SI>ZmO4JSp= zfy}rtNu7*^>fh(b6J-;Ofn-rIA;SO)9d1%B=N@|vs5mf3g!l&>K7IdyNQ@r!?QQ-I@`5nUAl}Uf>yl@se zBB<_Eo?L&Nv83%xCG8lt4^kT{6SyDL#iUg((q{KN0r=Vi@{Ewrrc)&*1G=wdT&O2` zx7+m#umyA*=o}<%iVfr5{Dv1LvBY{^sZ6~_tBT!(5&)tBqd(Bek>&+rWo1g>h@p@m zJ%BKpKy-?%+GUQ_XBj1UROp&$BH&H}$GROo*g0KdeaTF+p zr+M9f_%f0KM@68m@p0pPhu{lD+`l}YEH$6+Qkc+OZlZAmxx|M$0^SCPWRx0sdm0T_ zk!1oe*$jqSgjI%$uPrEiCwpF}R7ooaGKQqVY@s|Z$WYyL1l$-BaWE(mh#8ME1CchR zTSK99Seq_=s(3c4{-w=f3aLW6#WF;>2U1GEqpkSyD!%6%E;s^Cv?iiT!ws}er{&-x z2bxG>A5S!r2P!Ve0M-a}beVymhtc>#kpB%*5Y#c7r3#k}lg_~?ipIb%Z>iO=`i%>D z6Ivcf9L53a^85JFBVta^<#{j(5s*z+Mfe@mf`lGEW^-=)BlPFt7?=zr1k??}iN=E_ z?@SizWGN@yZ6D!0A`O5FVJZkV;L0r~cI`jpyBau5ku7>klML|zJ%B@e+x!I&jEwHa z*8d=0Ls9pUPGEYVu9bSbtJdkb4}s1r$oEL!V9ZdqH9=UF_W1bwaYD8-F)wUg3{4Od z(l`_!R`o9wOOR8Mjllna1RskCJOK+uNQ2Cip&!X|V&2kWQ%)`Qx(mU??M4+s;O zU6pnYhpz1T`HBDLn|K^0ar}S;Ag}8+QBD1C~%hp7c?($FiZi|^&Ikb1~-Clq|A^! z8G{TiOGi|ML&xs1@zHf-^Fb*t4qku=Tzkj;3Lh9b)ak3}_8tY@T`->#%;Efmlp!!c zW;098gIm`{n%S=A*&tPnQ;-|P5)`scBV04rw?BDNZiKZ3DS%AFW1#OqX7qwik4I`F9+C>`UdBZ zzS#^_B;S!xA)cTR9FlIfjRwo8C@L@wWDw>ELpKEDGYL4}H|-^eZXC?Q(3ij!ASHM& zs4MkrNK>fCr-CF_6h$<$Y(jjbCLn+IW+INfYUYpo!$BFG*%kiNGr z%O5(&D6vRDf-qGCo)3B%1phkP%!>P}lNK8bf{U~YjItm@Ap9POg-g##G^I)bM;L(W zEyw|>0~lUv<`1l~GA7m8&f(iY*unBhTCm^1uzo0W+39+#w8HlSsRE&8%EL`*gGT4z zl`mhMu+qyP{6J!Z`xkrymxr>#s^o)$q@GHoaV^PAS@1D5Q66DApsvSAYI`sCyPG^5 zN|+qNnT}itl@EgNb$D}P-zhj9NI-)t2HroH31lo^)KQNZIgo z=qr$!@M2?>W9Pe*E}1A;DAd@LevIZj3jRz`&rc^_FWSc!zd~ zcTWEZmTIFoA$^0pAh63o_*R^{Rc60K3bu7gSkU-T2w{s0Aw;1WbLAzLKAGvA3HU8_0cw@?4Mcjnufr{@{>AcDuSUG&({t4xjG8x4Xa*w0} zBz(DXV89hg+F~LHRvn4}gaar9py8*}`2Cj;`|7tkgW(oy6fVd%sBOSN(qX!!xKzvl zc{CjZ8NvZlF(u|EhR&7LTC-(2`kEmgZV;d~Bp?v5G=YEEV59bu^C!1-BpIxUk^^6d zsv&5hy5p{!Zc%L9Z+f%eLvc-k+x(EBZK2`|aIz2amlM`;(IJN5kWk0P zYmddyYjr~^I`9!33n8%f7FOk0X&m8~(D_jOa0AzXdecdsVv?cI9co?doTR-7XZWpw zqA}A^pFzX$8{iXggLJqb*Bc?7dU9$+g7P&Om13LM9LlN@m8oI6tvmqwVZ@c@Hb zFrCABqjP6RJL_rje<*8&svsYf07wu}0}bZA%hXsKp*)r#@OLy4kSMGb)a6CQMWY_j zQqfbS2E~D*DWd&=yasjsm@RGWFwUB%UTj1YL8^sIK*dePVO4%foQ%dTErGyd2Lz|7 zs0(ouG6NEN>*e8mg>{$_X9Nu}&TavPA$UzmVO7>*ogpVK`(Bd;2*)*|G4L9k5!7}2 z=UW=pj---aGeI&^0Fuud_ZTvCZk|BqwIqQ!6DQ0^#}VE zI6EInN$Fm3LnvWJ2rZCVD=t-$7v0)=o7o?jFX96oNC>0}oHx)?$4aB*z`bvH2z5Hq zD*Q2|BXEeV^XjpS|4|WR4mvwn8f*_=grWhZbFo{Q)M-Af4*dKSvk1cj`5bZuTqCl0 znH@$B75Hl{A$CYfuz3U(9X521D$X|I?J44_#S?yj0Mp@fgY7{fDPrPy{>pbbCT(P6 z5EIy27_$o*G`WyHE9Tpg&+{JPDb*Yp8)C5rgy7x5Y_JLK_Je8-!zs8AO$;#Q1r!p9 zgWgBHwjn6OfJ}yS3+4pIj95@z#QrqB&Ti>1y&B{(5I-ycVP^^qE~e?FH7Uje^w&8I zU|k5lY+-JsB4j#;k6{F_7 z=_1n|zAsj%Rw&0SZS;7niiZxFf#ky?L0$59w_-QK?rP81IMMKM1UUlD2bfy=w&~^4 zbr;_34k3kKz(6htT#%VzN5J$&y(inw0TvNt3Dy9W$QFTB1&|C<57zMCR2o5!A@(p! zfNlugP>tuopK`&RSY)s)QVxs~p}qDRR#m<`+M6ZW>Zp=0kDxK7bRiMK`wKxAec2h# z6CA#$Y4sx(LcK&u1;0c!d4uEjO9(<|F&W-``q+)Zx=EGr%s}3_dh1dOkg>}5Y=bPBqEBX9P;mDySO z39;Vn8{+;!zxw3LdGj)U73_az?%lY!ZHDkLI%krfM+B67ifY zZV7%olzfVV1k8Y+$HDtlYw?h!EfDTvF|hurb}!K}u0Ic=D1s0`Yw89I2qXNd5N3-W zYlsZAf?&f|zk0}&2qKEwbODSjgvh{MtD;U$y}#Dnjd<#Ou7_NTA|i0d_COlAr;cbY za|PPvB6a)6;xYgI2EW0r>IENr!L)E)`heG>CF+&u{aCg>_XSS`@ea+#1(qd@z(tc4 zh5c#R+@J1jxxdYN@$;Ah2OWWek3mtQ2raZ*HsCocByQKf(O@gJU-U|P!MsHf@sJRz zwfAVZ(GVdAJkFQX;Evm|cZWtd!<`RDAFr!Bes7utZ5=2`R9{DpzTD8xI^I1s+#I%D zWp#SpnM+dM9;A^5pN##p4)(a2V3WN2cSTPsF>!t8y!`T)@@2L2ghIl5^2p>VZDDrh zd?_Q#){XNunTbJX(D2wtL*DcA)X|ShfeLnQ6+LC+*@Nu^qnckY=IeMI@;o%&@%-2~ zdJ+ZGw=kYCP^ErP3;pGP8Pa6)etK*9vmuX-w6XC<^tdZ~n^>lOi_ ztC^uuSNo1SLpMLG6uPgu6nSldehH<|@UPvXHGXy)N2by}#=5tGiYmgdW$NAbw2f!G zQF2;1zbK-fG+-I-Pg^D@)|9kY9_-9?t4@9r5!`vp|5iy)OVT)wqO%$O#5l7C*eN;I5RlTcOGCLOUiZwVr7|8h>RmX$A`iXP9 zUh7WBw z+F7o7NHzU)w>z)oVZ9O==X-VA<^~}`#rWd1n{zTZn{5%-FK-0T>dRl*=T?n?Z7XvD zG_{TN<|XNj2W1)jv=y}~Par)G?uJz2r3BT0hvq)w!}TzApjIM<<%&|URXroOYeOm} zOIB|GDW~-j5kf#xG51fRa7HfXy*?dduO<0sq}il0tKmr$>u$WRH?QjC>L0x%=l~?1 z0^7yu>u{TVrQGRk_A{1)@J6&6Sf2|S5MzvNO+&fz*1@xcV`;OkNWKrvz^6w}h+BuL ze0tu;gw~n?yE#8JLL<v2(MX;}>2bqywZdWh zrFl*erT4obIn<5C!4b#;q7Lu0X0;qv@6qJ-(pA`lhfoHg#v)_CLL5cKgWYYL>k$0wUSIWPBPgta#6R|4xnbaQ2J=0z zlA>_xX!T8e%p;1SWSw_a6}mQ7Vq$Jmy7Z_!;I~FvZ0lU0r2N5D)vsT=5a!BBU($@s zFe1zQz%4m=CawNX^M{lcnYBHshEQ{O7dlN6-Xu{+Dco4jpiL#Dl&Ii6)of{} zHUqTkR%oEB0gBzvv^@%A9;}NG=4tiX?u0iXyGD=wEOe%KRgXXXOX=ymh<`uRZXv?V zQZc3XN4e16!p2IkX7ol|;tk$zcU{_tS$jlAG|7(mYA^#ouhUHjcp3`7hPr zxT2y82(Dnltd)3){jwD+IknNa!br_en8tayuZ}gD_+_IK-`V@06FI(Kmt~dVY$68#kMJEhxc9!BA)T3=tmj=HULz3a^ls3X=Mw$p&A zru>d&H`1_@x!e={^CL3mV8|>{SV(;mg%4;}on{a}q1l}V4pqpUf3Jo3XvZGRrW}r8 zq{kn>;2MV%-LF%IUkx97aE#T#S~Cs#0s4KGCqbEqP{Sn@iyP&}aLN!^vT2|)5p(Ey zkW`ag*m^=zEq)&=p!v)Rue{J1_7D1F5AbbF#hXZC!NuJz#8WHs?9`S<$wS`lAnOjW z-*n5>%j4?BzK`u081uVm4g=}F?&E|Vi!Z7C?~1}iFogpvIDc?zPScc{x(VscT8k(HH#W`JVS(35#T)lTvtPrOL%GGf4rWX@EvS{bJd_ zKAa{OWDnVKZpXNA@{4Srk?e_(p8{K6iaI zHJkBTSDYn?y1OC2nfKNrOksau#U+YN^)ns1unX6^VK|I3z0Zq$TN&nyiq^^KVm;b@S)b zX3OExb;JCHh%($0s6aIXDy66KsPrLKbM;tdyq4Ztntw*bwW6(La4kG4!PXswqZ++J zubaftw9!!OlGt58m}|?Iu|ogjw^|*`wHeMJ7u}Cf{}53p3kqtCo2&V{p@y8 zUyrabNJE3X#kMfAJ$j#^whbXc(MT4*@BKDEkv)+680<>Pv^$F3pWitsG**W3PyaxzcSBnoOKu-C|sP#&6$DQGH_+5k3j9$gAb?zf%eP}^3) ziFJH(%8`7{DdSVxjXf)&r5_ zw*u2su!FwfvZuF#;QY!8JkWSOg3v6|Wc%y>SJze?O{0!hApf`0l619rm+nwLY1J9R z-bH;%`oD6N0#s$(d+CJOly=mph%qA%#GCL7AJ!zpJZ!s$^0k+s{~$)bTa^>oEGU|u zx;#R9=y3oJU~_D6EkEn8rVUdk+0ikY$Ywa|+e)z8MhdDD>>)j&HHEwyQ}Zy(GcEw)Y`b7T-sar&1Rjl`tpk zg5wjlzcVOGYXDCg;u`3gsoLol4_@`~GQw^R{F9bgZ{LJqyZkn7oN8HdGH?#IN%;j#C zl;uZY>86wFp2lG-JYzRJ^A+`F4u9?*NEg%pn=m8BYJZ{k?vvCm9CWnS2ga%x%)I05 z`h|T-VK6Dc5=LAo)i4T9pTW(t9_|zG=Ne1=BoOhD&I%{hlBz5sADob54(1T{3Kyh9 z4fBzStuv)f48<0eIRhOR5og;{k7j%dAEZ^pBpg;Xc4Q%@GWjt0uT9!dKaYp-tD{T= zMyvUUMv@P?A12X1tb8yK_z?M_lkUGwal{KlxJJDHNX37%=^|Xrx_;ho=ug$F_zH~Wnu>PH&4lo=ZJJnuh z)Q{hLE9DhFEo7VN+x%XAkHUJ?0PA!5@o^vGS2VQff4-R*96JUp1d6Lwl@l>s%LGW$ zOBjt)Z|}9fiqvzTFKUDaWG>3>X)Mn4z6@Xg+|<>VIr-wH7EhC0QigF9R_~Opty`e| zNv~l(k#`-*HCr}J)QvQxV3UFu1-)nH;^PahR8Y&CU^BzjB{N+la?l?D z;brcZ*yJc{;5uXs{(Ae#!(mccIr-;do@DZKaO!?ibqXpLY}Mw9mb~q>sG#2C;)FPEM_(k#4rw#k&3XX$oud!FEAZ03 zouUlsvuhD)wbsymZ5LWqk5n0xV9$*mHUkpl=vUxP@gn|EHu6v62=S~M#HWxSg~prs zlwum`PCe{7XqR>dBW>Vax8eD9`*b8Gr@oP$#Ic1T1~UFWul=L& zGngpY4S#Cw=P&ud3nduMykL0x@NqF9=c0WziZPez-juW1$l_0d^E}uiTl3rFsA&5i z852%ppP*y{OfV~;qU7VgJ@F6<6}ChZTY*ZS=I%)0)UQeo-_>s{oWBtlNxqx0&}r1h zaJtIk|HM&djAa{MM6FGgIi#|Zi6ecwBS@0~u&Le4^D;S88W;Ty&yV)#BIt`giOoVM z-yto9xNS$#+wD3`Dy29qh(Gq@&G36qThVS|6Y({CZcKHdFePY8EZ?b%jA5CMWyn*K zf59iC;fY?YEtTy`b+?Nqnl2GT%hvNUrAA(#aG@pCcq(*it0pdf7!Gg=3l7;CQjbC@uv5qlD}sDmj3P^S)k|4v`+HHyg7{~(ps3e zZc%nL^QmT5QGqv@@n!UyDKj%ZO%!->Ipe}2RZTTaC`a_?;;RnDJ{s(|iHkd!U+kc~ zCwreK>TnEWb7@RHRv8h9Rxzq_ml|(p21EaT3*Uu%PgAk7lfluILAn(C3g1t4o*KiM z7s)H+s|Btey@-?9M22AxPrehDP>fAFwFm0CpOOe%{d_ePCHspKM{2e>sZ5hu!i)Z& zj}H!eg&>HS>Pcs2AitX9E}0&8Y|tB#jvV`Z((NjmF&k?wSX%TF6We@{Nz{x+SuqPy zUXVE)%wwQgO<5DlaUR?b&hT?9Dnv)yyp{W4Pb(=m*=n~NxE6{ScMM;SBlW|?;9z@P zBFo^$)LR$K=|b->94sP_37L!Orc)@uCmftC=4h;qykust?oY1oSLw2i)NO0iexmx- zk|3of6K^z5Cn0O|-s?dt#`!9g;Er?|_?5B=HZ30p)@;Uxu`kACwb9UFG##YvlSv`h zF9(OJa7`LF9zO*kQ_4Ufdd8T;xJhEz5KnXq(FJzzWs({Wy?|H^K7 zWcnu2?$F;Zol4g0j8aAMTqpUj>zFBDt3H6R&OckSg!i{vrbEb{^o^~5w4kR;gzfu}BZ?rTWm=O9><`Mngu4WCpj+gZvwEaO9L8!;>$@09hr`zc!5u!RI5p z>*g#k@v0+ICamKxDdFgjuO}UZbyOw1b}mz$`mtTnHO-{~@+Xe@wNKaZ%9qA*xAooP zj)CSa<^ms;j|p&^S!5U)6BJ#R*Yt_ZIO|SrCHu>_$6#%sA0>~9RGdcZDC65~l}JB4 z*hq1F1#==&S~yeph@ZdQkiCkH_$sne*%T-(Wj5Dq4duJc&GwZ7C7366ua`M2;CSy>HKwuGL9Q1gh_Ai0XfT1_i3r2 zN!POZcK+5UFE(dm*RBuao>^eDK;EnWDfDm`^7_moZ?@~IOTbyp@CaM=ol&KbE#>;R z-))||O_N&KHy%+LUxvlKACklZnHftUAyCnLW6XcR^dPCvoLe?BLxJProy8bH(geTinU!5umCe z*I$-r$f(;k^&vAdmhB^glodoP-SpsD+V=0V>t@!|-E+$J^*SlP!}LmzX?6IA-nicS ztV*oo@OlPMp|~+?T5ykKK27qsrFU{hb*Y@Ze<^#9zf#~`?gv*niuwI93lts`%Y1Ac z%&xB(5Mly)udMoUP^sCs?941mlHNnsgZM+iFo_joSWSDJZum+|gwu_7NNN_YW@22M znrCoLIxd0UteJ3`eaeJ9vnQj1-AnjZx*`P|Z>dUg;wu#{vVgE5YWR>!Y1nSb`gQ?Q z-1qa-GKZSS%@02%IE^9?2^9Hi;72yF_AvZ_+dDhSGK^yGe4v>VeK2a^Hin8CZ!W{ITIX%d9wd zY2a<;f3L&eM`*x!cV$l)~y#sBNy!oK+7@qu=W;(=HY<$2Tb zfl}}b!j|;~iq9vs9`{Yp2U5A7hzpJvMEOp?fHxFB)Pha>t@F+EEz}38%B_8e|6Xx_ zed!1uxp?dJ>wF8a{_a4++I@U!>p|6yow5besMjL4cA6g?U!h!EqrVxqRay2cO&r2& z+T9MJd*7J-_nY{`$>-nL+u!kj!^~Vf*J<$^{l1sGD)%@x0e|NN#7%EI@sV>#xs3R- z6L|Q@*ZOgn4SY&K7~1+Zs9aqzMM~sQ{i1;TI9hmOP0kk*)3TADXkvboxsKo|td=pA zAYhWOX*9>`Ai6Ou%bHRy``Z$>{aO^^;lSO_y}Hok=`A=tzc7D#euiV%mt0M+DSkqz zb?HP{g=(`??5IA*P@|F2A_wQ@BH=o$@fh}jbrt(~g;i$26IUZ$)o`TQ$S!}`Y!4XK z40i)Ip1P}-<|U1?IgCUvvyL9=^9@32;?ZEHFNd{GsQ3Mcg?=UP8evN)G68ygY-N3X zv>TpCQO1ZynHP%wR5leVwUagb)tB2Shnz>T=k7 zxN=r}{kfB;H-WUK*z(rVo#Di=rKc)-Jyw6E^%uETJS%%usollE5<&FmZ<#_>4*Ck( z>W7>m?LQS%?0mxZ%3_djg~fc(v8ZDwYD2}Xxjs7e-TTsf9cJyTW1sG@l=Wz-iD0h( z9Ed=fafBoBqr^k%XTWaE%qeN!Y~$Y9DF0!nKXu$5OEnHfNswIl+CL!6I-adFDlVHj zFYB!0f81x=64U$JLk`{q;=HqsZniy7NDq5^$s8x&O}G6&*gF0|s5gzMHOODs$rGor;`+jk9>8iTTx+62KWYNe*3pY51e=v5KW>G7< z)T@3O=i@dydDBXq0G`hXYzDQ~v&fW@0-W}2v70sF+m;7+kmhaEv-EAX9>oF_!1mWf zzs%Df()coeq`V|QgD$RJ9m;BgAgSok zAJmdXCZ>x7C)IF8m^`a)RxP@1Qd0t&91@Q$(i@_ec*9*$N-M1GGE$=7b%z=}_9VxI z{}Fy|-LME#u9MDL@naz))%=WW zk2-faRhVwwfGC@)=fQ_B;ItA+>QEvVNpniYNPhU%3Z7%)%Z-l58;{`d3-NHV1+5TW zQBCxKsS@LOvh0X~Tkhj{aS8i`C7O1WXK*_A#Gxzh`lGhGZM^PSkS0Vbzvyl?s~1vE zbe(ZEHkK|j8Y&`pF9k*|LdrF{`i-%t^4KQw1=Ab4CY?#$5G zV@I6e=guyPPU}BiqC0S&<#@YF#~vX@xa9-Q@57)bcS1be&L-)O^TO^RXM=RdGhrUk z|Jt8L%t6P56th#sGz|yX>!!+OsIF12EMvE>sHh-o$if2mEcaXzUUdTx>C!amKZgXY zqo0v3tTfbvJ&ZZg{%Tv1lq!QM3|9v^6}j#0p1Qimx`A}#yYvZPZLR0zxKDi9^{Aok z<$UB+IJQit=MnXFdrUPgdH^`;8`Z?0L}5Vf=UiJwgi`8UVfsMjq~R|O4TM@{Sr<=3 zlv49wae<9(iQ4UUmbepn?K$NXe-zA;*tvKb;08azudS{snQ0fQ_(1Jt3v+!g)#y7X zaSRIobd5#2N)m0ywT}&_<}hxR#d(;>dU$hhzcZ$$eSx0(u28Y-mBT#RyR%$fQCrn! zxw%Sp*~mBCe~9p`t=XP(9-l?J)Jh8YEO7`?DdaU+dy6ao)9S$F3*}3j6)yR)7L}{? zo}e+1J^ZBYNmP#BxUr@&+zl#6y|ry7Y3#uY4}w-Lx7TN3fLFvxI>|JZPm?FjLT#3@ zmRB|O{w>UNb9HwrM@4H(Y8|#WgE%4*1wKDTC?NZWiU61W`{j7DBbvbReNV&P{Yn^_-0p__& z6OtojR#X;7gDO(MQPvAz#9p=IDyvAByA|ctiR?C1!eBY&O`?-rrS_%rGY6Ag^(qCH z7bWOD-?^P_) z1qoCw2_b@Qs+Q?KbE>M`&wFaBb0;kts?h~j=Q|CTX>ky2HEFPZnDA8}01gh>f z&T(34>uXaR%#F9EJ8S(OEw~HI;1+ z7M_)J@mCk|SQWSY{K2H(%nKyyYM4Jv8??e#k%pagu1(;7Fb-QWxK-7dTgQoH3Ta22 zx*-M}8X4;Zd~Ytr8JXp6tfpjCR+qqcD3>dfT3lG#<5pb{hY%ed6CU@;B`I8{&;P(` z;8vs5JdWiZtHAnEQ&HH4G~}hP$Q}Rne?r?=(kG+n`}E`{Q?Xd}_<}M>x|2+}_{O#V zva1-&)VPx^BoSQ=SK1!6abF2guaawXGj~k^jbAp?x5bUWZEt48=_*i@1Sxm63{!W7 zsHNpH{Gpv!R~%dZoz6&o`=3zKk9jd~ZTH3!rk^55o}BjO`!!9pdelCwe=(c5^CAn` zrFT@~IdX%IY+u5f5gUrR%ItCOxVdJ_tYh_Nx$%zCtDELvSlY@}l9D#^B*ne+8vV3; z-1)RPRDqm-D5)!eyEMxx%;l7d#$o?(!_sBs3Jc3>Ul^^dSshz)^RR5I+L5@9WouO_ zt#tHr%dn=r5QCs~TR$6r%+m5~89!p920=mj$Z@b{Z9c^Wo`8s!U8}iSXRSCJ;n&CWH%i^K4E+=~74nNHQ_=Oo^A=Ltw(pbq@|+6O zwEwn+&cF{sYa${DeA@MhA7goTI>}YtF?G{RS@Wt@><)-Usri5UigD`4EOe*2Sz(YIGfhei5S;T8PJ{zf>!TjtpfR z+uCep%Q^seGpJE4l1oOCCj~?cNY@Qu`0U@sY{f*xN(CzQ;1ZF2pt~zuD2>gqW6rir zM|s~GJ4UpOM`)m`8~PF9yl8DpQE58Q0?&7Mi?Y%+V){dZ2k6;xB)CPq4)yp*o8~~g z%$K9D4p5dL1a6p{R+i3x!NzzwXW?lt$l0B!c)JMKem`kjUU~LvjL;Rqx3{zV4-RAFYV+f7c;pWU_a8c*+XRhuzjXXT`elgwa;tj5!@FN6dud-3 zpsxb|rnXO%r}VPT_|U+&!IZR}qSDo|_E=wp<7bTfB2fI$Qj7GOsd{l<9N_1U`%=xg zd!5DjAX2O(%maV%67%MTs7DuvlAcSq zj~jE={EQX_g0R%(=kg{XH{CQxbx0GfeX*lZLZNKv9g7HgiEBFxUSXtgd>zW%G&ed6 z&|@=$isN_COZzwu{pD0TmFnu`h~d6k65p~3jEDrn+v_Z7I0xT2dc{+IWTyKOE15vS zoZDB==Mro>Pml)Zpux0*HQ)FFTl`Cw>XFO05$5ryjcXo}73{<2-WLtv-bDQB5VATf zK>$8nC|rZi7+*QhkS z^Hw5^{WN>zZNYp{=-<7yU@R*wg?#Y9_1VN4{qlv!iOA7hHaj7I3pR^KHiObn3H33_#4g z*7D3Wks*`~x*Om1T*e*s?6T>ZzmB{LDFd1{Ys%rK@2_q0O$e?Cn5UULH*g8FMrabT zVUH0o??!^CNm_h+A!U$&wEOe&+|551Rn8NoS&a`}$Nx|YsLEOOep%X;6UY=ny`ZUj z;|EQ$+4J+`F^h7=sLuNsbEf07o>T<|bxkvnAFib3=|Ad*@&O4)g~In0+kvmW+(H}lB0zWY`-p4L;VEY*5Za2}1;3F;?Mb@KKCICC!;(*Et?=-%84jFl zE0gD^tZv>?P17pmVK19vIL?(&#O!V}%kG#JNy|oJO<5qoBR!h5_9N;DJIX5fILeKO zF|K{Q%(kl1K{{{cX}P)QeaA8@B&H^@z4c;r5#0%Y=#!^_Z-)*8SAT~&>oL*y_P`IN zL$qZ=;b;vMn*R86@O{cR`Ye;jo4>O@(TNwU24D>^Ybv<+{IRD(HKF}mwt!}2$b^U) zMwpGQNt5sIBczy>In?hQltYfI-!blQ14MWB@ zf~8J(ZDN`#Q05fAl0r=y75->F(f6DEMwWat87+_+4E01oJb&jnPJ|TmT;`Gl=L-+B zZjP{;FX>T!0Ce*|jP|n5PWHfIr?i^zbk*(?Ry8`NbHu&vzZokqfc8qM+)q|RHM0GA zfT=kE0neP4Ie{1QXX(M*+5U6!mAnVq*_fCntFxM7jZErTU)o^6ZvN15;NAnic|kd| zw>;%OwdK5&0J3G=?E40b&s!MTmZr%Wg9m}3##<2E@cZ_I59#emFD}i5>(J^s$1!vAtM7?UNnWN2;1?dqzS&KLcZh!C3f$u>SvBo0< z$v>-JKh*o|SX6wIu2nxeZ6;!JwOflyGAq|!hN33XmVVUtd{y_)r!Vm#t;-i$Rxx~{ zp4{E#sT5vc)yRRPX)o3JJU_6&os1VHfl%n|DO9j`+n9XQAW02WQ0Z)RuV~hUKEdHZ ztmE8^!pNd0Im2`!QrL(l%GY)DZD^>OvDP-&WP4sjuR!aV#bh z8hTkW!`ZD_gRmJd;7pws-GgjdD~lGehM0rdnH{`hP4#+PZ9A3qIlqAuPAGFKb$WfH zfg8nl3V`{P({H1yHiy_gCldwRxdLkO*z2LhS19H!Xp;c< zd)8-!?(&Mws?N3eY;5ZHSDDC{P^)35Z9eA#6Eo%tLI$A<8^BHCeDQ3|LgY1yUW2F5 z`~Zu4i|Frhv;RUeqy9tN`(*K2%lDI`gQ5E}olwr2Mo`PCm7c}B0W02!B@8QnY>Y)R z_0ox{U)FL@kCP_$zTsM`ZcD2vMjJ9>?#v1Jdnutb7I|P@Ym(8^sz~#98_T%?ebZN6 zhMS``;#?lV_==3GssDW$PJ$tAFm<{j+#vOkX2}+O36&TwTP?0 zSk}T>P|$974!k?!TzWB0;JZ)uQp{q|vzkFn60e7L+ziO01?CtW)iGRF3=JsF4ewDX zek-#fge&`|ESCR@KGtRTM*}{;8cnYBZ$yOoexy2PDT5ca-X@}-sK2nKYjO><#XWv! z{jH>nmh5e0!r?{Qo3wR>W-&E-wUm+7K)Zea_2xw)wy&!HM^RCnCJTF}oAD9M(uC7d zJmG58B%lB9KHQ7jH|NWh#NlZx%6#+h)TZJ|e;V67|24x5%8+c6J)KL6a=CY}l)@~- z8i8T0c8?&IlzS6TOTC|xaLyN|KE5@|=Ci#TW3P;fX5$KbI7q#u>r9VXzRxmb{2+XF(L7aluwZl=AdPU;m^)uhBMC; zW@km-Gs}!)vVDRn&NKT-g=nXbXopEpu}i4is!aJYg<)SN%9qlnt#T8?pfZtv>Dx01 z$IWLrj%;u#&sI-luKlI5*!*_p;Pd9d?pOXLe;-}HIDCV#M$^Jy$$AZt)A?Q4C)~fPjVDJJv0XWkBY**yKxfjhBQH>ICaeD|P7l@g53I8`aw8#qg`V5}agKlKP}1 zE6mOCj{`oKmRYF4DwYQruV(Pbw7xp>@E7_YnH19l?@^Kfqs|%gyk|k(>NS!7wLT@S ziLJ2qparc3>$iySGlOBI-t*Vwp4`whYplmn#EL~ zF(Q3@6^pG-gcssuD#+{LB`ahcCZ0=)&pW_p75FHs{V&G+!AgKoQS0c~dSRh~VOtIB zO}cf`+(b@xEVSk%UsK79VV&H>vgoc2k zktr>~_y-3HDyo5r-JCvbwX6nC1m?1SQayQ}%Vv1wijFOoi1p?NTiNwre+81;uXWG$ z?y^LhEg!u%?q6~JUi?Ka3(d0*;A*e=kBaeb->>&ta&I|a_4o7rQ@NlRqg9yw#K|U% zv-#)VVHM@=ix+6SW&(n5lm~w31i>BZDcs_X-<+pA{-bQOoE|^095`Lak1O< zrJL4`D)PAiO=N}Fdge(! zQM(Bfa_d9EYndqfB$;GEbbqlPQYq)OzSsF|;O=Bbu>1druMMU8D3(WAusb@})4HGC z2rd&HDoRHjCym^s2cTyvn@uKUW}5x6^PM4lSTOmBt z@yT)ioFfmGQP(VP7W6O~v6CsW2}IBMsUQ7Nh99zk%T#2RNJ!`NSDr_<*WLA_dh-^I z=dPOCoCVK>tV9&;DyrRACI)WyVPBcgA34=%kJ^2m#TiWDGfo&=HwW5%%T=i~Beb_& zXuGj{aGK11fAx9{jIE=AsAn+p&i`zf_r@B>{%kLxeTc#!KVW0RDN`0dpO`iNlL>Dh z=!J^oSMsx%wlpA}v2TK$tH4TzzvQs2PpzD_Iu1fy$W>mnI`xbss?c^2z1f@o$)%EF|eBAQ|bFsz23kJhP$o;b8_R z{zYq`1&anEAp#(K1f)(aqCH>&9TdsXWgMEyIiO8Lq*G0S%cu><>s4@z;*!9I{$+K z!V&UUR*j>;^NTJb--}b>6-qLl|7(3X#Uk^8psybUEEh20j1=?SVwi?D6 z@3@-o79M)O>g(9C$S*JP&tnaBL4Bg-S8yvl=Z-FqIO%w7!-dzQjrdmk z!+2xs05@qEaLr87$~~-zWK?Hp8J5rBl|6dBluikJknTstv2`6l~aOIPO~ucC@!B=Ki}a-Y!?iU5{vb^wJ7G zNE#tS&6rEvh6{AZyZ=RPJ5*p1BzT_gb7>cxq`F!$;2XKp7O`+7TD#jJg}ymv<*{Cb zPQ;fm@gEWcX16Y9qZ{`w_!4#Rh(H!kEu6Wp_92~J+Q1~dIx^CXT18gkSHle^CgxHU z*SQ;gaq(kUZ%vw^u>_`f)_)lq7%ed)eR!DgwDF|!H^1_Af_H`Gn|!yoXNoua!p?U; ziSG2ZgkGgyNDk}xnGP#S1vnI822IsQ$UG)d)2IzI@bF5%B$_B7MdZ>Oj>Kk!vF>z;xNCbYgXKFBV)-u{1&egPuD{hM^<5>Hx>K=Jl_CVQXKEL8aKlF5twg~Rt z)W1H%45Y4rDQ`GVq_m9UFVT<1aoPB?nqe+W1zTY* zo8AUl#TvyKRozgTytRE!1?Y~{C{>uts!W>XghyWZ7pmR*7@Q?xrKSG3rp1F_$V`51 z^Aru^yL&0v@_!D-iqo`uQhYsaQST`WtX#kNt=AgFp||%T*k5!V`#R*He}?TYJd&?p zBx{qNJXEkC<28PGN|W`uuoZ56A6#BNl;bW$>N{e{f(QKQVhCEl?Jxfj2_AT%YaNLG zpYAHJlLOtW0ikUqaQ#qJR_K6))CG#rwicM|F}WgWQH9Vp7x>jPb|1mx*YE!?l=m8R z_dgm-#;0CM!JOzBP%0rrDN=r^6mJZzyDaFQ9(Z!y zd3G)WW63+ZRu8|E+(l~}asDR99N}c8|n6)CfglDmqE4cE81yB}A;lf;P zDTT6iMG3j<$1tb@&9H-eB5a#6#1Fh6pphrcyS6cy>OaJmqIj^!j1b~hGOq53e;3tR;;bQQlPXegO77@X|+VUI#E`r$b z*P?C>f&d_U@znMqSi%ZM^oGgIk}V>gUG?D=06gdfNk$__VQ#S8{m{MX1kw78!M|>; zZ1rL5!P|CO;P*wpw=F-{Z-?7900^C&*)JPJhk#*pUUNA8q1*p{sn$iHd;NZ;)={9l z3Kwv?9_`>61bS|uB7Xe?DrlgR^P7YruV5zoF2YRRDT&`gK~(~ndhakKfC;m!w|tTZ z<2Ee1B=2t+&BV80DAfU6SA)K3m@A*Lg0Wozrya;!xBL*ajUb2WaoAsXij3l#!% z5mR(!P7kb$S1hlG_WikV1{UZDmp=o8I)b0%A$l=XF0RWrKw`r`GcZ|4xUv~qd!q}2)0PXYX#(*MJz&~R^C8}V5Qb@B3 zcufefs{$?}h1``Oju-%0mFu7-%PzLo(!Y=arUzAGaRRAZTIL1 zlEPp$w;{wA)yS%`JVz8;XakTCiSoKsfC_*ZXdBiup7QP$AlU>&fh&Nm93?df;zolh zp9%oIO9+5OmNJ9emOn|N(PY_0ILx81_D}|EE8TL2@{?hX=?u~*!!T3jHvh`eY6cVX z(n=e`Zy0J?fP572Tr#Ky6>K&F`}eu~^9Zcxv)EwuVWa<~>5@zT_r-VF_g(s{jg}jF zcRV|U|4ekTZHD%k6g+aj#N~=k#$&_pjo$6A3t%CZ)VTWt%25PE(U%j6B@a9XVS!M@ zWpMx~hO+fF7PK#g$tr9zlcWev^0v`R6vJONo(abh8`-xxlA$PlY6S%{fKjs>hGZz@ zeAi(@3}B}B;g==0cv%Tb;e9oPBoi@DQ3BrJ<#Dm5n@CD?ul7W93|ITGM|Y< z=`J3y;g1v5@STJOX@dO&0cE3DEB{Z($ zK}2%ke6}SVc1*Q)qZvJH!@o=bP#R*6x(&Y>rCf*Aj4JllO$mUd3L`nA(lRi};RXy! z4{|sJgPvKyRBtJu0%q`>Nc|Ti#3Hg475(qLSH_Uf$cRI4CNr-eyK_5g52HSc4d}o7 zG8DrF{iRvK;L7JbP@plQx5BbX6on42<;*KPn8fe>pJfLhcGMq6v4iLQjA!cD!T zm9OQ&Ga^-%4s_i`%7D|gu*#i|MVG|CZzUi+H_D6$ZAfwy6-rjUWe;z6aYxM%p;Tx_ z)!_ke_p!N6vtYEtQzQtP4g>9l2Lg~Mm;1*9F~UZSceF2NV8O&6D0n>=o9B#vP zKV~o0z6gW6{A!DKg~3lX0Gf00RAK9xtY?h7teV3IU&I9)Ncn1r!{a`{_5rRtDSHLy z5w82luX^YSPV5X1K=R%S_NzJ^ro*`VR{~;b!T73MYiWSj9UcM5ccaj0wwT${MJ#w7 zgE6&WtUvHTzOKbMY;D+RIf``e`qdP@{sLRSnJFLq0@HNVT5kRV<95_CxQcWi=`Ytl z{{o}FE8qSh{(bMy#eawi?=brhvEpqS#&l1m^Oz4B5ech2PzTicVCB5315O{PyMy(Y z5}&EN%k`IBHWLt~ewof(D!lht63AR6%;8cU&{co|cxeIUC{Tc3*I@n%6gsc&kUL+b zt)q?=u3H9hP)F4v{={1pXkR4A;9oy1s0H)xr5~2mf*JkV4~t$yr2Az&^9~M6u%R`? z+Z0>=Rw4?QC0IfWrc#P+bFbf92T-b(T;6 z2~X4>?tDTt_p_eaMZidY2?31=NBwz+v25VM13Kiha8%{nTixMi0j5|-&EZJ_X8b!W z7huAEna_kzkQ4vQ1l?wfHogeFzZ&@GWgVuQEo$-lzO)btto(Zq$lQGFXgFk4NB}X> zVRBU$nPM5n+YqKoq*6lq=`i)^AZYTGJHMw6e}FkV50x5av?spk zvDxg)H?d-f;y@3g8V{5No$BPsEYTa^uo^P8(}U>ULO|kyZ|KJZr9!77J~4CIHUt;h z0nJH)ywhU`+dYUgYmwzbkspL2)dT}7OF|R}s1Uuq@lQSA4E@ldtM4mNZ+wt&_r7W* znqYuKUdU9O6b8&2zwH&VJB$=)|E_BenaY>KNWSCHx})#z*8{S|P`cc39C_j7l%z~; zLJDaZISYV;SR8rsWd6f^#fCvOGR)*+xr)US2A{6ybo`GL};`x zVjw0^;Euuq6WHX7s0NaTko=XGe#^pGjMrf2V1*;a#y|bRNYhA*F{e^)!Y~&}0#)&Teu0J9fy=+Z#_T}vJF1LOcK$}P zty_F3^ci!!7r(8Y%urJVD*KEn_AfG7*ne_v!eSR2G42_0?gTFOJO$D=2 z$k`inJvATC{BVp~}51%5VeZLs~{Q$kz7aK(VruEL%Hs%7=(Pf+hC4^|6?OMcX5?3) zpo^!>$fInrMkhMxqB7!``~Rcp$m5y*-<3il=EzJ3b2h}Vd<;uH6mhgN;!`b;}!$Dac-k88VyhlQCu)`OYJ-XE3r4g&*w-pJ=4sWh^ApGH z6DxWwQ??IkqVX7~K0!>@yK={0P}&-JY6sMm0pLyBg!fvlvrT~7;YP&@V zjwLA;Bs~^8rzq2WT>hjEaKRw%{l;m8^J6jO(AU{X`8c%=t?D2_dHpurK)0Z67V}#% zVEqR0&1=L%^@2SIg|{8r2D`dVW|_>DVnC&OLAQg#0J)RHt+-}AK=Q&3G}k_E!cZo@p7j21Hj4d9F#jGRqJgAk+=1JEC3s4Ld@fqT z+v^dtDgb=#l^2?;5%+Zi3feu<^ua-Ea8DzSr2;&)f1)YILCb)n5%+zM{4VO4cjq01 ztf<1JCEs)-^4)uS1;&p7=azhfmbIGZ1c0YZ$xp){G6%j23Y_r@TF`1@3IH{tPIylg z%LE%gxy$J$E9dfTSm6S`PVnVi@1V&maTPo?ekHE%8Tp*i6D?Tl>|BMQii(WJ*7>HF z7ZGir03Aqe{Qmi-$(u5Mqln9!Vg)4u3hGfrW_f_Z$#5cbAVA?i55)6^B(2XW%%&wd z^3qKf=TzKZ72pE*xW$j>Je_bV?wuwye8N!B?zom)&|&YbXXNvz&HHyG3*4?5|M3xzpZ3b2Wml$y(LR?r~O~(CTgX zIH^vk+kMIWeSJh5DsH$FI(H%Q{aP5}nKdA-Q^(-GWMlYiULydDGI#{{1wL$ksUdhY@YoO!xR|J&^DF~OY_p4o87f~|!3Q3P=F@U6TD@}BrX#&!!X z3l+5b)xY)$@&e`mlR{V*0l;)E189<1L_G7QUtAqstNKFHd)@;aYJ`VR!!uB`0)oXJ zK81S+#*$oRlDG%Px=P9G`v(qsTo2+UouWgt_765C_W^Tu4_dHch?|6mUUlDQ*`i|S z8ouGCL;+cZpSb16g0Y0w*G zFOAqqmOr_B6`_(WKfl=^<8G30_wN$0Eb{2s+$a8x z&ot$)ZJ#aR+DZE!6zMB)tllLdoqY89*F)23CzUjfa(q{ z8bQXpMFx@o98jr4=J!C@e$vjx;xguljK58RRph~ajCe* zTxj*0P}4iY4K(58Sko0mYzrW(6FL}m(tA`N@iqjldvOY6X4e_{Y;W=$ zA@2R0Q9*x-m~y8Mhzn?nUnLhs$KCyFRB+vtr~6(rOU}s8Z|fJ>nOgL(1|pUrP4&4t zZtIYyzqva2FsZSAQ>bly;$2QIa3M_D2n zd1_VfLYgKuff^AaW8<2@s@jCR`?)e#=<+P?u>wB2{5)?^T0AW;Y-{p{E#ViNPX5DN zi4lBQk%z{(#h=L&bL#*b~3ZBXU2vQkPiQlJx4sPgYN<(KnKb)C>fXe#wa`VBPt z#ZN8NOB4lrUG^2#+Ukv>f>kpqJbO0zIOo<-XW(e3%oT77Z#1&d&YlzH4yYtclJeYH>1$JZ#UalS%iOjW>Q5Y zVP>XM*H0`r*Lh@ue_}Nd5MPzyMy@%eSBSK7e#a{LSJ%SOLw5p7-}@jaXA=6Bxp%%__NzU%2qZ|t{zo0zK&H0r0V zpN*}yd^?z{{o(=(KYKQI`fHiEgG`|bzG^qUv8m-P@3|Do6PGao=W&qt_<>uFoO`8> z?fmN#F5Rz0!cBatDhIqKbzCwWWYeR2X&k@U)J``MliN?X-}X#)^RMPs*_zyT3@hwm zck`E7yG=RBDkfJZ+VhIM3cDoBiteC=4tg!CmX`R%zAShh+mP3oh~R7dJTJ_KL}ZWYd#Eh5$Ob7I(fZk z<*oVD^D_Qi7;g7N&uj(%isn_NT-bNbPmsutJg_fjC)<4Ms7p?#jBqXvww>KLPjYFU z5uQ_fo0+RKTlyY?1gfJiV^oA`4j=FiKvvF;o@ZJ>gI36Etrr(sA*os~3|iZig@qct zGj?jtJN4c|a`i56CSZ0}`GZF*L180uEB0#KT66n1n3WT;3AUyECt`bTOS3fiPi43y zT@}9H;L}slEVp!{bn`^)w`XO(pMb(Sx2kHJ^Zx#JY1Rblx?Jt4^Ae+foQrJqsvV>) z9f{5Ee#_$|s!=;+<&k-C5@wNX{@1p2PA2wShD(_a|0%VyYG2_ZSGVSy!n+$~yX3~E zjj~K%VFyxRb|~g8e_eiPg4S~G zWN_0OcmKL%X!TdzG-W@>z>k>gU0$=dN;?Y8 zJM>*v3L7W&T}p1OCs(@JfPQ9Q&shD?_#hTD?-Sb_SeE5^-X`0>hZofp<|3gfo1Puu zQ!#|YEGIVJFTng&;}0u+3-N>k-FFJdb)||I?NbQ!+?C1Yzw_e3G{GxfkYHW&kDf=x9%6hx~Nk&-jO42Qz7k(eI zI@k_xGe64w(xR+6@ec);MnE!l8rIJ#X}|Y33cxE;)42r2DO&=TrV~zj?H8(=pQ+zTdYo>@4#Z zeCc+dun@g!F1kIB-RZ(dmr3VbZuZo9Z|w4nE~D;#6UNOt`0kTi$Krc3%{je9l0Mi-5SHr~Lt!ZQx#Aph-+D?RNpK|?otjBaY(&Bbh7>-8_= zpBBb1ezNrqV?p{rjMMKSANXGil+C?u?22`1@AVp&FFok*sN)Os5t)C{LxJIBKG6h) zv-WTIfPiazziE0}m-j#QIC?qm5qmCsJvH>M5(AR=`)KOAvynqILtUHOA8q6KpLJeo z&Nlyj%%!d)FZdh2SEj$rWojhPz^`Xsq|KuuYnlH`z7#lC{3hnK3?m2QeB)Q@M^Lgb zE#ykOH9xH8ZKgtOwY$rfUu?3wi;^GT{70I-?BwD{ysd2d{71ZlZ2z#!*DE9b8Md-( z^Hpv(vW4qzQ}ennM*T6LyYp`5Vg``0V^J;`Ly^Q0p7iu{m%m( zx!A!^W!0fFYqhsw?|*o$+%6@#^M@^6ZlBjy4R2{%(pHUX!TUXLTsCx>su4*Xt-=r8 z{>6ER>AVyBMyYgVm_K;w%D^zc{n8bU#q+p`PDp5qc}s+gRfKT(Xa!{Sy5m+o=IiO$ zn2oaPbs##@3s&CZwZ>Qa(wKks%;ha({*VEh)^*3#e9Y}{c`KHsMP&0Ik6jjCz7@E_ zxglI_QVII`;ceQL%$~?^UM?kX<^&dLrI!I^yCrS8#}dT$Byy8tTl_@ z5y6X!pzB7xrkBlzcSPpce9arOlP3Y+m-K)pV8{Je{5oeu(0fJZ4(565dLqgur*Y%< zu`Ct7jQR{tv6*{-Or?}SR`?Gu>V;psSFdOaq2J?v1)=k{tzzF59I8?WNk+^6Vo=Pj z{qlA{i6kbAu-G3PyZR0#HRN!fn|)aVqFWA0)m?Wya}2$oY#ylY$T8$!C^r*X0tU4l zs;a*(W@zHbHRM0lA^>XbND;!}!bEI0Gfee`)3mB{2!lg}*t7=vLf#>Us)y zuhnb1CI&L1^PP1VAJHin;FGtwA>8J|4|>p<7vht*8Npws#%EuD^H+_wBilH3EF)%m zROiKI8Qhj}>|~qS){^WE7k)_CsF$}-UgCzx30Hnv)aZd?fjPox-tL;&#F8xe_37{R z0Z#)Fd9|X#Ssj9sJO9b?0-2)1*qi*I4))6!r!zouwv;MiAa8fxjPry4iAW6pbCHA& z5#6d=zwUYDz43`%U**f#@01IU&a39iTsqG`x0P!?Kr_3})lvN-_iLOhJgq6r+RSg9 zP2uAZa9)IyxN*zamzid~yBw~8s0jXr=ST3*&A(2?@cTG+gK+16f8uXD$lR+igNnV( z6`1?(do}L@ambUu?ICeb+wrx$Q-d(tk2t5s2a}<2+RS+ObzGCdsq?Nz{*dq=CWdXJ z>mfyrW6Un`^`rs67&uChR!aG*ZUzSDofhvdEOqe!c6rdOT|jKbpD*~d8QD{o$~{1#s5r6@V5?Pru@5rt z2juOZq(s{1rJbZq2gJAq5*Hf;KtJRmo<}QRSPIvRt8SQqKWaE`#lX2A%{T($vA+*h zowO z_9p?50TDQI8aFS8y%mx7Hvpc)h$M};V1)_G%6@SS9{2{q#4sTgrJ;{K_ac_Hir z>%3+uMt`!|moE%fvYFKv_$k&u!X|xOFHc-pWf$5vw}y*ltZ!mZeT9z*9t6I{@q;KWIm= z{03ipblmr2hcu$%h(~yBS00Qt>k*LnYMz%FOIne0>}-q^In*qwocPtOHI`JZ^{cB9 z9tfl^i&6B1(P4tAf_$(u7V3{C&hcR9pL%+7Z zRBhH125&lo|E@3?nfLA%A|`=NWUBrOI_+Ix_RX6Cqw{MwAKu(y7WNoWWyqIt3Q@Tvj1C1tKk7KPc*l*(;Fh(p zemC<-Uy0*eX6srMKNH8rG5Ba?-iNQGu`RQz#}cG1v)hj)!fFnQoJ67*g>>&-Kz&kk zoV!c8?kYDa5nFR8V^X5TJqEu@svV9QWRu2+W476(tl^k%Y|`uD7^f}9=Azk!M>g}v z(UFJCKN~u70PtH5dA$n6Y2%pfWI2QN!yw~Fz(EPsu*2RPhuusbeeXOB*;hrS9Yu3c zl=BkQtpa#}vg499iF7HCnIf+9(oE-!Ql@sy2~%72ya;*?O7RKEqon|HBKTlYWZ;M_ zb?18AsI2Nfl;Y)?_c8_WX6KMbB$@hKnws|zHz-Z5dmg0lSH zu__+E;hjHt>}bSgYK#STa@kQLo-sL=?<+*w-E}+`5BHCzK5`H**vf~PT)e@yghi)O z4Z!Fb71F+fg-CST*ZajWdGIfXKcq$j%W&)sXIKyXD zESgQNSds}@Tar*mAb!l5;p9yncaVVP3S&5a*vV)4gC_RqNC@k{Vp54iylrHb>Shr2 zXEABf;c=TLI4$=$#si)%8BbFKS3j``mI7qt9)&rLP6tD&86lsuYU0cT2Ej@e+BpX4W|C^~rxOBtrA?l@7m6-YGAc)WhvEHCg{fpp1_ zx|s^!VCMU#C?+N!&2YX%J|#h`eer$oKD8Q4S^1Gam`GaDd_1SA%x<$tl9I6Z$xmx$ zz^_o>V8Pse$M{?YM6w8GPan(fcNEE0U^j@<6kbi`^P5Attb7N=1qB#YONI3=zlT4L9HkAUN!{*;NanNnC zkcxgiON@u?7^No0({_x?#g6sthEWzb9rtooz9oyoIAPf7O~;B{6_A4<=9)zzQV`>5 zp_>h)mBxLi3&K1s&^eNA&&BLB^4sdoF1aMoxQEIeWoQ$};H#f3Lj~?&Yx1wzR&JVA*`RNi5+5w{i-KcLg#id4% zVYZbhAwJYhO+dw{Xb)EjOh1nvw}X4$rZ#H=nu{Mp&MJ);KgO#o&2b5qRo939~17A?ePiP~y+F2;I5yvwf zUush-l+gR-j9Yfp{&M(ymm{Y|JnDG@-Zb<3H4u$^nKJ#s@p_AR_dut&V=g@nuq@oVTC{HCC z;S7GRlree6!l&N$5?5Zbjl`p+(j_$9^FeK-rc%q`bcrv0aanEaeQ|E;DswfK8Bs~^ zhx6we5NmIb_w2za0m0N5I^apErF~QqkQ+$drAy@W#nZM8QfuYWoqeS7R~AWxoY|VQ z>3arDrZj|m0Zg!`woMRIUs(p9vPN$_2AL)U>oi#Gd+>Hs3k-uutIBt~4qq5_bca&z z-KOpXnbqf6HsslBvUo6J?VSirLV>?8fei)MpJzFdUtE@jEIk01pGU8(!11@K{VQ|fjH-Vw|&O2rL};rHQ`KuhYB1ZhMhpRGo06v?-R5YxsSd!*nU-yCzK;3MB0qom-C z-yFY6!I|G2CkE=0^2Md#1K%7!KB5i-g;W4#vX)Z0@U=U_m|$_hD3JD75qs-8b^RHU zl$0Ni1Q(r802z^NZVAJ}#Z!lX_&G&z6_ho9k-`4vXr}_Odc|Y$Sn7}@ZCn;UQRFBx zDwm}fkKf}*1>dA@>Jk4MTE3|_S09lP8dY>#5|Y|cX0Do1I|9Vtq{M-Clu_C;_?1`i zk%@d;HBz;TMHO0n&mnHEOwsnWFzm`jT@#r$7x9%6$FNbblQT~QSfNd&Xp2|jyCseb zqhLtxaoCmyW#g}-NzFzOb@v&m>#t+^Gg9_Vi>mBPlg1LX)f*J{OUEb`360K#tP3x3 zg!8PQt&CrR`I!#N+RJ|&)|(}^d#_q zf5Uy1(cV(19V|5wLW#Iat%p$Lr6A5$mx_6fSBW6R(YB7GOr&Y6hK%!2t6;H_8l4IC8QMulJxK+sJW zYHPP3*M<7i4}J@Z9t$N6ed4Ls=RkrX>%UOa-%pm!4R)3FvXE8xrUo9DM8JETs2`R9 z8B6iBz0=SY4{GlcAZh9G-1ceaPBe9Y2_SWb$Lfm&G5mT2yjvh&dsG3GX(`nsw*S>J z2?lSt2YM?n^jG(aW#R0kKe3lD`@XCAb%6`bF5>$KiW4&6SCXA)Y{4%lbZgVz>mw)B zNSBhGu}bCX6E|GN^#u$x-YJd?7-U4|QjNcttn9$|%#pW8RpwkSa0t0Tw=rE#RMWJ9 z1|gSf!YG*%fOpFyjZNjg9lrX)BMHEb$b4x-Em7Pobi1{AWh98?la=2#I1s8wh&shh-1(bvdE zsz?4TnH9#;{wrA*rYuY#7jB9@ITH%H5R2PR@1B=|ug+vA?w^5f9Vy=CS_eHh;Ov`X z>sfwlT)wC{N@wILR3O>;$|>kwvNPrsG>q&VbqX3qcD6eO<;CATm8$>E@BO)d zkCENMaPybl7Vf>ra)de*-P*EkI~51pvLT&{h?L+tqi4%42ArIWKcjg^Q7%ymhy3<0 zQQi*uZC#?Q{zFdP1aMR?ROMKyyIv51vl&u{r8_+Cu+tUi3#LWOV~8lB(Wr4Qdq$!U`% zww*D==!x-OQ@+WE>YLXcG}AqAXb%&!Y)96|EVm=|XT)LB`j~9HAdgAbgLBZksm{N@ z!2dNP3ueSCqz&7%?bJQyE1xcC-h&vV0P*+mMk$x^_vZ9da1AU!b;E|AX9G_I8h##~ zk!byqo!F^DI~Phb&b?eaRI(RIS-6S3J|nSb8fg34K{0w-mtc|_5#P<;f^(#h%}Maz zQpj=yc3G%63qjeoEq;xlEZP<~BCzYW#UuoUGJLkjCaB6#Lr+|XaG&O8#h~BAyIYYx zCsj8dxTAP7y>8hSWa=*7TOl zSy0%WNDXQ63PQ+S!&BV9ds($lzt?q~4U}gF<~W;6ln3QFTS-9K(#5^Xl=bl9F=fi9 zzSi@AV7&`d+!yclE?{i<+eNbLHkf>$TR2h7WkZU@y`@emr3!X zT(PMr@Puh#aU766`k-%>I^0JCwCj`^B&q8(n zu(;0HIhW!|2h!iGInxAN^^v*s-P3W06VHfa{?bIG*tI zy{~?|VCXjK*FckH9q=bvb;_95)SS+@#d$*Y}A6`85 zdlS*|$tUY&ER(v{9Y+UGdc{y*r5qo@y!C4a@i9~(>d#3|vi&Yeo|J^tcGJL0qm zvf#Pcf^2rtIr(b63+)~jYXNuLu2~2N+_g9c<>k+de=+z6J!qlG>)MZE(Xr0%cD)ig z25!V{@8ZT26rX-SO8l&B$OjF^&-c!YZw{X~$Z*f%SQii4k=l}wx1ak)F-vy3-l`Zh zYqp2ycmI6D_=zZvwk3GXGB}=5@+sp#cVs~syvH3`Q3n6*j{H#u-*87-nJSEj>SOlE z--o7HY#qw%o#K&Pz*MMVGXbGHw4l4HLz%jx!qve}-YKqCBM#K$w9)0XLk)Y}%_WB> zSkXsNgp}?-Qt%C9zKsh5YQ)xvY@TaSZV|m6NHJPOZv;{d7Fj$Rw#ecJf=`EL zZR)2c8V=-29J{Ad35ee?$fyK}Y#8)>1Q>4^R8;|DHw-vc0Ot*Zq$+^^hW?vDVt*8J z^9U+1*Lg*g_;DwjMlfF+onf($fx~j0M>UDrJ2~H?%_T>c(sz%bf*ZQKG>PwaauNv_ z$s$1@H2PaKBoaA|2tcpV`KaW-HV(wo<;W|B~52py-1eP zENc`QWHhVWi$ohw-uO*wew@vYwyI3g$LuCvJ{^ePmSS!>6pwfU^ttyzJ5tOY&0-dv z_~>yC`yF`jObDbV@p5E;$rywZI8^cvf(;uw8!g4$3n-q%z&Q%YO&F9zbRM9S2Duk{ zxLG#4EhYc@;Cpf1-|3{uIA?Yre1edZNw6pH^_5U#iNWw6zFpDPsk=KQ)SSvQC7x|m)+&H8nb;lX=9U2&XlC=x9GvM;B|fb`)M z@<$H5`FQc}s079^+cw&PwRD%ZY0UimwPbyRF@L;xaa7_7ymp%Y&Aw6At)AUBVhzZUu|R(LD6=@Ab2koH}p?; z*P0SQ?_N7Yim5}En2K9QIA05x#QM;j`CMX5XwC^PT)5$1dV~mo z&{r}G!j8EYv;B!vp*b|V{Qc+Ipm*~4%xnX?Jpc1-e!6_Z^K1lNKFtp4+$UC|R6M}5 z&Ng!HSCfA3AbW=4!ve^KVaD=@ZW}%3j%hJk54Dyr;UY1-OuJ^k)>wK620ch$?}5Ku z0lC>T$bJ2I%7vC6bY=egwTbWAM~po%ed2Ef!eO3v>8ECU?rET+@?4jy;5#uMEB;3b zPhIESC_7&CG}D_)KzgRB#FX`eX6~h+NS4~_P0E6VhmSFw3H7*b4EKA}cUcs*u0cnO z0t^S#W(;`un$xrX5qp=yIUd$G>i@w)PNDXV=>z|W`AcCMp4O7|H3;_@>SI^wwk9L8 z&UM3+_~uNQ(!Pay?gHknacabC*F6ryroffUfpZ}AO%CHf2z`>nn1s-`{*k6I9zXgd z?4=)Mtc$;~_sFP&yFPOb)bxH;yB&UXbP_gXH_2tF4cMvgv(%RODW%P&>-^Zl=F-3X z*vjV8J$@{uxpamfOKbLD=BF$=(f`U46YT1o^u)eAkB}O&k-WBu30FWxesP^jf)7l2 z1nY_KJ&y<;u?hMZ-W;GAR%n~p;rRfw0g!SH4_*VnT*Eo* zfT{*IXh}htFqJW<&_-vsxm%(=rZANW)GuwNks_(pZKd8KsXRJZ1hwu@--p2`=yl)v z#L61hZQsfp5Egv;#P&{kZ0Si9G_25SU*fjPT)W%hUzcjb1C-MmR_*JLhl#!^^X#1uWFqL z3itrF+omiu>X~cfXobfDW;+!7SD8N8AVGq8L=jY!1J-T#bKdJkv~zQSo3C6~G#LG( zwX{3(zWdV{!ZGGvD81t<@zK@V@lRsSpB~tcSfme+XVk`1KR5gDpP)>ipif;T?jEG~ zA4rX;as6=sr90cBXZCYs3NDP3dhmS`|MIW)TYwU~FHGrz$ z^y+<8*T!GrG2f$QGkIqXe@c;GFI+@e{Htu;cr0TUL2ot3Mi#i6t8Elou}YTWqP9_vCH10 zAXIGXRc+Ct97Hed&4;C>HQKHKGy1vf4^tw;-GgtSw#9$_4BTNzEkFYmLU+BTQT~AL zI^l-hkEYkFk1oM#Gr!AlvM$>RCx!d;ipPsS;B9n^5`EB|KpYaN13e}t3e*iI5EBII zsvi@l1?u<{h^+#3%8!YE1?ti);hmNqm#x*wVVHLcncr&XdI42j_MDqFi~FOLaEiI} z-W7Way8QmRyS1?CeAVYuJMB$pbKtF?UH8H%w}wi6i~+J6bJrYL zM&nYR4r`|4u!`3&A{qYP#!US&Ol=G>f>j#AhuV7K`kNm+38goRz&i^2So~l@mp?CF z_ix64S-O3=_X}$F8U(0}SE;joTro0@(Z5t_AKoJ>(Vh|!d|bjZB|^k!#^Hfd0x7Gw z_WpVCGKVm!JBkUf*|Z@W#auRi&}Q=1`rM$+rCaNu-!?%e3ss*}iKYvf_ay4;by`1M z(sZJyo&=2k=6^#XHN01?inQDru5k;j-5EYLbdhX4gNaswa-zLw zL(H>+fQyb(jczQB zic^hhEWH`0N@(=I8#f!#=zl*B_@Gfu-$JGcW$bww|Cxajj-GAiT>JDcg zp(pZArpwTaYKV(6^!gfNj0}COhL|ryU#THB%g}$iUmSkxkY*9PvNjpOT~}j!9$jcpTapKmi=WOmK$QLSL?nl%AfcYZa-?N9>B33wwzS1 zJFzIwe&(TnkD~e)15~k1^YFPxG5U*oMnoK;8b$)DDx;96_ zOIGJTr(6#5SlJQjRgZEM_SQ(LZ~BX@4g5)^wve#kB=OrdwFwoqzx{pFaU&D)0>qcb z9?ha+JXkJ3oFltV@G-F8N|z2|&rZO051=YL)i?)GA3Ob54pOe?x{k%dXJkEkM8)-Y z>I^dGVX4Oiu@?OYri%#L>r{gxCZlIFWE9ww zm}Lj7nFoxkhzFFc=3a3~mgK6G|7TOdRYZsq)3;PmXF^Sf*$Qp7Z@t=)dETU)p7 zi88}374{Q|`PUVKcOToFl=YK)<(ZVeEn2?YWAlS6k8e|uvKQN%N`3URX!Z0{iE?wOLFB?n1<62}#{Y_WpuYcfwik=)Tl-H$BH;)?IJSmXCJ z#~g^dSql#2^j%G6s8eCBHHmdGHSvs6Rz2YCx+-+J-G-AQP6|NGJxI5S)^S=YfSdai z=3A5U+iaXu#1%49ea|TEegaP!BP4TAmTW>P+)11A7UIe?g&re>qC+xk6Bx4upCgcQ z7nHibUx)9e+ei$A79+C4$T$O78i71(1ncU$4&NwAWh;|vyTMWp;#0*|iT2{0Vk_E9 z#as4;BNr*l0;$R>r0H%24W#&RF|QM|friFT%nA6SOe+4gia`gFwQ>P^*SBz`g|uG* z_BpMR5DhHZJleFc<=q_nZsYi;4ZYU=Gh=xPP{*-90~{8uMkqw2QHD<;Z5D}k>FI@ zTxA3L6ZD2IGs?Yix|qZWP7QypoYrRr;yD>Vn>da8VQG3@UET0ukyP6v(q>XBsEE}1 z3LI=N5g(PBP(7w2%JB{hUSF&t;I>mha!5Cvp^g9xoD~zg9cKV?M zpUASw=@cvT2Xl-qgWi#JcZHcX%3Yf}j6Yd6q?^Q4Sn9kEqd&{$NvD{zKX}T-PO%RT z3D11tDN(|{0_INJ*msHt>sil*WzJUXJMCVf@S;dJNu*Z_8b)@CcaqarPp0w`#scBf z)4VDGe&|`#!joUr!JPU6;Uf#Fh!1<)Hv9UNyBD19JX-#miam~#)5PhiIzZJu2fG?F~~B_0@|+QmLW!K*v{ zJqGW*T-YW}thNRR*O`%x#r+gtNuF!O zHqM$7q%SrVJTKxGo0rc?tZRz37Movejto?$(mdp~&pYj@!QI75bbfdjmb((0wYt{S z825o^IYOxuV2xS}$!Z(@-yfnSO76;{{(>`ZE705vX}1~V6jpiC_f4C+-^7oqUH#`N zdWpJqNk9_#%|}25sxbaGJk-ExK)w7$GTQJJC&%Vg1-vz~aBM!(r0b_Tl*e)%rE$Yj zC9@cCg__e=DWmJ1O%Gjst40AkYg9l)|qoJFzhon1tUx23)S^wC@jZ zt+y%fBhsQ$@g53u>sI*4BwW9A$pVbx=UKSeN9>JC<@Zn++^|Y)KwMgUqPqoxR%kl0 zVNE=m3rgKV6i&@I1i&E=a&X}aPJjQw7x!(F=o0Ze3RQJT-K7*3*MM1V+V%Y(d}rTA zg6EIiQE0D41}&vbda8);C`=U*C--fv&NeNjpkIUAM#$(~Fg5^zzX*WwsJT`3+?I;q1=adt%YE{pk2Em*n3c?#pB?a92+S^Vpb>^wkYR2N@7*T zsuJ{^A_btFJB6&{l!&uV9Vbz1=7nwg6i%#-eISGNICXo57-7%kn-ak zhHoWS^7CQCtlXRrGNbRheUV3n+qg~1mj~IniO4gfac-9K(0iBNbmYfG?S4FlkBs?g z#KRlM{HF9Nv&)rf#jaEy9G+}f3IiAMpc*)>yb_^+J)hZ&hO3{>?Zv_; zb6>bz%(`pZ`(Z%;^0OiLHi|z085n8Tw8A zl*lPA#P9@7PL|6*BWNJrZEqFs8SEyp%J2$yYYoG0R#x5*0hBBiVd|dX=od?GN<$r= zxkO5r^B`85>GaB_@eZZnT-o+8{KL7j^{)X$;Upm*VJ;T(^y69cTix^5jpS z{zllwwZ6T^$cb#<$OFR-FP)>6AI=U0(%KI{C3IwuzdX>^`O=x7{IDo+S~v4(-bS{* zkIq5#`Suc=-2uy)j*@7*0}?asC4qJaGGwRIhs4b`67-X9AN7jS&}oU44QU%Zg+JXC)dsc@A~@O-CVG|J&kMy^O+2&63S)`69h zO2~(UH;TJx9sKXLGF&XrKm4`h$GO30v#VG3_tt?huASOvjfd4KU6A1uW?XB(o?FNA z^j^8ld_3^2!cT-3@V)A$^ZO8PDAlF4_#h*s5VPWUKqR-gXWQ>U*_X-$6A`(0mF!Of zTJ*}cPXc0(P{Zp7s=Zm&#t#8Nr4ysx>4T@u2E+>n77hk!K-+RfAwic=bdL^2N(<^wnb)b!R^gUNJ?@nkz;;Dm`^LNmn6do2$A&dkFHXCn0h^FF678llU}Ny>w$smNrSw=ne%glRo~4KQ8kBDkIRZI z2+2vF2mO{Zv+BqBx*k}0kJ6HUC@PyVbLfSrtkwO4Ki|Uetw)}E__I=v$<_3#rXKV1 zE@PUVJFxp7PEq>5eo^v?`v=#!zo@f64h)u(Aq~QEn+gT9&kqLeey9HXao~fgHfUS> z0QY*qOHDr96W|m<>R}2H6Dei3$JN1aLmt*jkPRAy@^%jwOi~DsnEkE?(Jrz+4MJWY z2C3+Sh0$0v{XkYUp7rJc#Z<@k?8DStnRduS$0XEg;*BJf5^+CQ78XO@jYp{vnVvwA zhqw}$Z7i-7))qtT14*gNSL2f`?1&?71#LI2hwE>27huKWW^K*d~$0|6D9b z1!S)-@9UtOtR#q*=F{tXf&-2^eTF3FjG* zK9XefP7iX;_R>2&nwu?4Pp0aelG`hCc&7MmdqnFS_{bMTw;gFWFzJIG=}}Nn10tPL}A0{QgV9qbX4Sds|TeGqQ(3#eXoqDu(g}X7Rz|*Or zF({)H)!P54Dk-?y|5P)qFJ1FWZ&xrlrwj2w+|bm;Uq+x|vcc*Kly(Hkhv8MhoYkgG zf)yIb-y8Z>E3_YALO=rMBF(Y+BOIk z@)9-NM@;-d&Z zE%xPA(x4ErUjtEh1m35CC^*94(W^(`SDy2Ffb{NM!Eztz)^pTEAL)A;V!=}de+M?V zZ-63{qPTse`m0Ibq&c?{U+5AgzsXIbazc0X@Z0>Tdo`%vdc@5I#NMdfhflIeQL!%; z&kIFA6CCwMuiI0mju#9Dh;N00f+L^ds=IN^uXye}#NPn%>!C7J(&Br@h%pOnUJLc( zQ{Wsl@q~EE>4IJhY-J0z;wkQPCyw$ISKawtT0Ck)Mk?}&;79;^O9RZ+M3jw!ZMj(1 zmIiiBzF;K)FeS=kOe?ez7X3j5xBYI; zn`(^;bE6W4)5MPZ6@2%AFX83YzzeqFpvQc+5v26VUM*s?X1MLi- zOdz{GA-2vWg+Cz{Nt3@N5*f!3^+X_{k?IvdnYJoe9)aWfRX^&X^lq{0^#GBr)PMjm zSE(Ssj@0p-?0bUq0}-|(7OW|ov0$lNdkbB~`_ni;y>kY;=~IvyMQln!4DX03$tG=Y z$hVybi7Z*7@92U?9}{osW(_~44&y4{_g64g2~vPz9Qs2d@wP7QvQ_0RU7CkgV zw_@<#G^c|N^gzw7fMMCBa2Eh63DJsy|Bs?`k7u&~|M>Ure3Bhftb{pFl29R0E+dE4 zZe~Tz-3n_$iJZA9bzN+^m8F(LUAxO{v=qr<+-VMpv{*VgL}V>FpHKT;zdyXM>v8RJ z?b@#G+UM|mysxBi;*UeC11V~@$_ z?BOvF-s2_k&VIJdw61HjlAJo<#({Ri--l32GE#TmhIv>YToRs!3<@5XoVfBz4^@Pyp)2QYk^SG^K^ z)w%UeJg(c&|ZZKx=l-ieGUA0k{1rjbFG?EKuIC_)nTBefvC0?J*Bl>wgUj{ z_c0HGjJZ$z0d4$TF}dNeWT=7o<|^1{&1*jl3}j0shXGkOIi@)9ol)5*i$Jf7d!&|u zTWs#GLw%Il z_+YQNbs3?oCRH7LJ%1Plx2Rib9+_0J9+XWJvzWmpp9Z=f9O8FCc8U7f9YrC~xh*^lMdmsyQ1C!#*TC-W7`9j@e zhpVJa{gJAEOqu$?X8rjxb+sMDO(EtRG>QMdP^au9vO>)T)~v>_%=RdCa;eNH0iiEt z{J}kNtdKmu2VX2Ricpu<$QXTl=mA3V{2qLn%qUV_nr%gx+h=~qN-(z%-HEvA1j7;c z$*pD3baL^E41-za%lhGVFkK>7KN|S0V`{mcNGH zw6Zqb)P8Jlu|e~2vzfX~^YAtM{Y<;$#vXsms8!^Ow~Wbk_-Ah!^XuSCS>)+;aBvp+ zqKfqSTRua@{N-Ez1r_t^w|u5bZ={B-NM}5Z=n(`Sf5#72A#*GgK8}|Ctoe_qB5U45 zD^=#)i(evn()q9n@@72QP$|I z6uB+XixDY+FJnC>{* zzq)8V9Y226Ti+SI`mivS2i88IOpyWddqJ-ee1IW~+d{^aq-r@`OZK*NMn5_%>?Z>! z-xDIXkaw1F52W(f`8-O;6Rvuf^T3Pm1y7S1Dn1-<6sPi}%nP;Jt;mJ|4tEt1w=Eqs z@jKk!f3mj{2)Rf39SIf337?E$#IYw-;?j%3|AXth8-nt5_N6>aAMZ_BCNl^)R zd8c{F2SVk`nh%5%N8O*45CnRQuEJ-o__7ZI!L4=MPFPVe#VdsGTw(Elgp)@nx1C@k zG~;UTiL|*D!rBq6H1q@|K95f*VJ;n#KFgB5pMjz>DDw-zOt*Jk11dpFSaB9yq?L zRErb>P@v^gCj{SV`REG~eD9>c5FFDwskQ_%l*JST8m#zU=#vOc?hNG2qB9P@V~#ol z^9O{Vwa`mwVXYR{s=?PO!96qQFWJ~xcrwtNXKzrE7%-6NzG<;muy}wzyUjb}J2>uH zL~lS#V}!%s!Q~iX?{~1NtuP>6mwD{D&w-m@P5?(s$Ahu`&gOvdZ_>*9E$MdKavdUaXJ-*TCEm&P`NtTTvJq9tamE ze}`VQ6&-277F!ew(hcWvg+55#UTBkUcuU1w+<;xF;(fINdsW4o*MRj8JozZyuy61L zd)Xcz^+dL))K#>W5)LJ;%L}ALu8>CMQrgx7Ki3E)>w(ra!Z9pZb(iv#%V3|Rc$BI~UHCH(Gn+$s)e8RTIq8%@Y+igPmNfbywopLA6Gom2Y$34oj4T{OPRytD>Cxv&!rt3peP!X}WBAnA z!sG~vdpadrv-tg4wF2Gi!!J^0=%Seu5gll?86TAnwAG9cy8~T1zhRnRDP4;Z{gjzwLC4G9mP|*g~8WwR$x~aJ(Oj|Z1`h!4exgxO?XU}FV z3e`x4Hp@&(m`%pKkkTIx2mU9R3a5wvN4PYPPxKwgL0GV}l(;qKODu{^1DMwkR#<@D zfkhSXw14E4;cTz+<6aSB*P!EH37#eyMN0`E9Inwy1fklB{XP-<5IC}E9tWndy>(S2 z$D0UW9ZIU`lyC#`oPg5rPVc1%Ki!kO5AyB`#9Y<&)(u3EL+`dgj7nlzlWkg~@&=`U z7ks&0;7?Y*6)1PnXZ^fy2O^x9@4yn*Nd38B&dPjWfNVO5{=-A~s;>MEVJQed9x6;G z!hd}bJkH>My&#ji^n3WKSYckx6g^`DeU8HSq2S~6LR^9)tJx=FDIkMaNK9}HPoQ%a zRLCKPwKe)oHsy6Flv$=&GBq!$V~&?e8n>D#ed+WxwU6lMzJ(h)&=bCet{v!CMc%y; zK(Dv(O9a3WQo=RK#WF#JCi*i|R(_NJl_{&d35Jy7PC1ucD8-$2mX!H;h!y%WLMlerx2Or0%z6t2a=h~inG-bREqrX0R7mm7G-~vTaDr|XQv5QF5Qh*a zNKhy{k;!lIX#t@6LRnmRhJE4qN9^yD!oDeh`cV*PC%s>qT4=cDnfKH$$m=8FMXq|Q zPpQc8@pJF4U+eQq6@JJ1pLxIj1uX`9V}C)l!QMZofU$kT&KP`2i{RS@_`-dP`~sbE zpYr;%WOSeK$8)HCpK$gwFqrSXG7t;>_FldKM^>u6)0uzatCs7?YVnojII>!Ot#TaQ zn|(`j9Gi!q;%siXj6B8J-Watl40xw=J<>;QA9}V~@C*X`3+W!fq=~TF0BP1z(HFN2{>(+z2Ti-Rb`IiouPng6OntYy(nB^mj^xx#~n-@>%M|R)x;EvpK=Kw`Dq!gBQ49nUGtB6XWRM~NniD2IDiAn@+oL85!}Kwxus3ijW@kD;eo`jqbQx4l$uD zD$mwq`Q|!~&0G&!`e%OfR{HGm{EDsgYdF1oaV=4x4ViBOTrIQ`x0im|k~-Z;!y>O0(i$vDF_ z(iM3$uHk&&pZKUuPpLl;o8tKz>2gHo#O&6sxOs(J%~D^;_2hHZ4}LWM;_7uRr@|K! zJoQX8A#cBe3(?2DCVejgE`K`zg2Pa?H7&uMK9j%r7V3WL`DQ@k@Ts6L46k-YP@S!= zYHM|h)O;<6Yi9WDO#bY^s*g7MyA8)b+Nhi&Sr$g%YO)zVzYqW$?fa|bqP4W@qp@-W z>|f;hMh*Dolb>n=z9=QhsHopTIk+dwU!TM%idCVaDuSuLG%%%7`U zBIGyqV6haEw8tzg&2wY~szQeO6OT>q81(8SN_0sP!2nfKP{5Y64EA(+HsrU+g zS}%Y2$_hir+$V2L!J_BUdpR)v)Y|pta(tVuxD^q;4arvXMx?%0F?4~{dITc2>k>5!BR>LnHwo~;`(iExSfVsH) zJf75__si>|o%xkq&;A&ESheQ_0;kTA#(qK5Y1#E6!;0NuTyd^E^b+A^5~5?-(B-hH z>;R?PfmM1y*6E;Uc8MuYVw}H>t4fk1Rh-1H_;7xC4L;_PXSWvE&mpNLY9~{zt(KG2 ztG*N{Re^-cHi;H^q7rKZ7GKGKwizD7<;!72mh$}S-J1G>va9P(|H@QoyNV*Xa%~?` zgpXX?;7P=Wr3|_FUBPrZG9*eeP1I9_TvROSN-tk+YlIV@dycWwPJQ=E(9Nj)Y#gSW z5t-(>#0J_-Nt*jHEoBGvL-c$?FX3KhFly?~_Y>joTl3#+ho1OmFS3CdQxZb4idzc$ z4Cs^l^11iHl&{(J{pg2ZbH0S)n?fTM)sVch%QymS9$ncsb!K1mX6*+L4h-xz|UhO?LfTe&KODuPA=v;q(LSE9f!jY=n55 zZ^#};?h#s-3Dq1%Omo4aH#}#a-&h3nAPTZF%*u4zh#uEX_QUOoCg#eQZJ&yO;Y<1V ze4)RPtLTll|Cxypp?AXx)ode@4X1~gsh@){L#rLlpZ^Me!ji_Elt=TEzJm7*a~_B4 zViF^oDsvjOE)r_uGj3$#LJa#7FDqW=7{xZ7AH72FGtR&F75bT<{Ug+{BJT>}rvYQ8u{HJ@Yu#eI47$AWL0>B}ecM-j^N zGD#&8)jOEY9nr?OTGx$eY3hlejU%>YBz!*Kw;TUbY8=0f{7h;bxeeVd_j>=l zF_H9eC+yGj^jDRZN(&y}a0v-#4(Sm0+mueCo^Q{wiCOn=HpUJC_Rc@JVdP@XokahBf*&%m!v;;Bq?AZ3$2k8(B_zo7oDG3(2E1bTlkbP6c6(Uz=y~v#NXBbG5g2UsSlEdd>5DS7pSuy)gv)zmgu!pdCYP zQ$}=cx-T&+(&aG?1-}o$gPQqI7QpVv?D=8c`JPKSghGsJI6riVzNl%KsFe}lV603) zSYFT1OTe5#K6e3ny#MivvGbC z4UT&58E=OEGPLEFzF?niDe|iC=fuQ9Ljn2Hy2TRgPVL1K&)${5)B=g3ids2hTeo#- zCMRa6c9Z=@T*BXsx&O}p_=7&VGJmlKRi|Y`Sxy1tN}a=bO?_B zX#CN6Q;SW+GCGWnaW=pB5d7<`VUKfj+)$`oomGF!DnM>0br2?%!BIlLv|8l!u-eRQ4lInpXd)1xXq7t!#=?(^T!_$lD5x;&$etiP{T)wB9z4?o_0$$$TPd_u|hU4~^al;5=aTzyam}-BS z``fTK&)RgCVs-v|9x#yXIlu$Dl092^z}sZc?>t~8+4C(=@;=#fkSFO+_8cc8Mi%)$ zouTg2q?B|tuQJD$SxBQ9*s7jRGmySIj^=PNznmbW*4baEGsb_96RHHZs(DL8Z14mhFtC+We zu0N6dap}u;;r^qNJ25H-Q1v4k_9(u*-6ThEO;*gnEy?JgqGUtx^CQ|rL$In#Ovuy5 zMb4xiI=t!kuxx1+`t5|P-Qmf>=$1o=S%cB02M>FhO(3M8`pF-Z1wE;_Q@C&x*6%Ty z(#!bt`mO!Z%)(K^qKUM))?|?iUwlNJ@Pkr0w6PjY+iKePM14U`Z^|EZ`F5KBO283G zf%sc)HtD(v#Y>^RUJ106RW1I{{A9n{{PrZVn4lzP4*#Z1?1$q*MfEjkPVE0{7x-Vk z3crT}Q{6PE2K_rWRz=B{_k0an43&K9rae#89iJH^M5P*aH<(OrkyfNrmplQwmgtiw zz|;~UL}C?%_9h=3r_c)WK?Q||J%*N2Xg~A8UJ9-5nA!L<>RcOew3zz34fywyaPB;w zHpGeIx@?J6Iq1RK63ag5F-sS{$%ks=#fxpgTs2Ky4>vtU*rDe$GeywU!z{$4tc5b- z#kjT5P&IArF#cs8wMU!$BCkWPO|Hqy($b?ZL=V_ImJAP4#y3fe^Qd(elK&EDQ?01B zh3HZ{$8$3it_L0arzdc6*Vp|Xv6@4e#2V_b2EL+(I`$lxSf;79V%{u?ak=^i(=*J( zI}Q-F=Q(f&>S%lp9ECb2p92xlwp?8w*Qz6}Xia@u#vnM15nUeydoiLPgWxHM+Iks~ z|4-CA2!2^v6_Be7uZ=nb$`Af$VhL>0{6?_@SeoBtmO!)CH<>k%SvZYT#}m9`*{Wz2 zq4>uQuwF)sZpBJvw7OR8X`xtzmDwGeESzS>O}Tdr4q zFhf23hdR6(#v^Pq9=$#~g{G%CLgScWr2kM`(f~I^AL4}HInIpEkZ+ETsB)Q1slu3H zuIh-Awm}*HbTp=2^BYRcFtTYhNxW-h+bFznmw&L)WUsrIWvqg6Izv1_9}b`NU}Qx-AO@R!tCeR$@g=z11-@3r^~4WF7m>RJW#i^jO| z$h`3wA@&~MzDYRc4?n35>i35y7^0LcsD30mWj}_)p?PeFPCcTw65$^UwAX19>Si?= zeB1hs#_*WBsCEn5wq9uIRHFG^jfBo=h>|@9m(Nzg#`H;b(Z?+rhw6nEPOCa%9{mYO zeMHa}@{5lqIe5ayn1Mfms3Phs6X0ACRjvjH7g77w;K(8>!XHlGpg~kHnIP(=g2Mze z>koYYlP|I7aDF zYSl<*hDH&g-+&P+5)TMRi@yXP$>oN|#5(Zr}DnLFtIu$~(0THaqi!x=Qg6+o$%eEOy5Ve0qvUsdY zp(Hggcbbev;zzd8UMCt7g2Z8ohKe9@s`7Auj$AgXich#j?b8C3M`^E>+D)XXT6^e= zr}&6c?^%9~)#7crU`DZQXzo2?HF*r~w-mie#5`=PTBI*qijv9jh^45B41Wt3$&JWS z71Uowp_K zW*+mn<68|lW+5gjowno+aF)0IzoM(E15yx0A37jzPmEO+sb4gaT0`3MWI_?0W8^o; ziOZ4u4q7eSWSknbTCg#H`7Wq80^X~jEU%I7m`bfWyvbS2?bbf>OB~a!9q=)hEk zm-_lXu&_pSb3e4KLR$*OsF;h2oirz!s*k$UzEP&PW{Ce2Doo*u&%yyyeD{!SVrxdo zw5!4i<`-pi>Q5?@VJer-4;OV=Sc9@OKP_PY&%SO0l74YnfuU(hGj1yql#`5 zq<>Q0ZBmYOV!9FCjl8Bih>kVCD5fIXy>Kx#1WUenl{!`f)o!n9QhIoGeWT2T!pmz! zh~z+be^kWcea6C79 zbheC)t=l@4Lt9ch|2sU%owcVwZV<{(pgPA=Q$1nitt+#!_o4Y4Vw?R~izS-leJIsgY_K1znU08<3@Ua`H6^CYquYi3cCeBxN}U0JI*SE8 zx;8r}m}b9LC{1W}7Ql#*R%(Ha zfzyI5fbJggd?5IwCf2kW<)j=HESs4x9uvJ#Vm9)SYpCz)H^ZGZBQIA_=WBr32vKKW z+-s9@dwO`Ya4Hd)H5I*5qNQb3M5S|h^?=oqJ$=+vG^7N7mQ^Kdp+EaO{$3Ivt#RNu6p0&%%iq8Nct;jKhvQ*M@6@+;lvL@`c3t_lY(5`>xN?7 z4>04X=!Z4^!UvN>&hG9pQ_bkM+q5^<^eZ1stej_$iXdxx!Uq#OXGF#ob{V+XB>aZO zCpMW(t|uQDpvU>Aj*LXJHQ+uwk%lACJ;B`%OxlT# zxc%ERk$M6StQU4+#1^!!JL)-OiZb9zeb6UNM!Goc4rAey@DqA0UEHK8ohznF&|O-w zGF$rWShe~)_Ag3tihB1CwXa85@d{aGioAQ+syM~y-pqy&#MwyfT86ngLF+97x;KmJ zi-3jAqIX4raAqMB6*^e})5{Z(VO-4%^ z-WBBWE>^)z&s0~Jn_u! zdj<2U;J$NSGivCdM*dF|_>m6pg$V3@zE`oFdiQ_{uUG^Qoz!TFbMjK!@Z!+ons-J9 z^q~%o(lmZhGe7atvH@>BTDPXfNcC|4M}MzW?EqLqrVX~wv%a7t^3NJ7y5Q%_d%1^E z9)kf}PGKaCz-9Eny*+RwJ{Wo}xPvF$D24h0at?Lq z4%zyuk-a_7W{osHf%tn9eRh!*qao>Et-;<4&TZW5Y5_K;Xbh~q+E{7C`7wrqr>f`0qxH% z!G|AN*YB*!5aW3%j}BXw`g^^IMe%|)WWRR;GLA;+$WF;8j)s1uDmHq~(yw zG}IfRMQZVl_Ks1IF2Lw$f{|gQumQdn>rl!NuM`$xa>23*+kuY->CXE)#koY z`D^OCoxpd^>eLzSTamM=BZo^~EHJ-bm0y^ViPw^2@MR|5ZtxZ3lpM$QD|3QY9b9ExX+J9GbahM^_;9zMt~K!N zZAbX#S8Lh@!xmkS2S3vM z;ulanadrK)&IOU^Gs5K_^7~v4MCOS;oT5K&rJmkh{C-eqn$>uEFvv2i(RVP2ki|ba z`1S{;=vUk&Kl+s%QF1&~J5}vEt>5=6o-*VX{$xh>)XcoJo7zz=Iaebph=;}-;y%Yi z@-=?e3+Rl7c(vco|7y)p%C*c7eiNRthZooTX)d67$7XSz>7f13Af`PW@SfVeEa`k8 z`m_x6iK@BNhI{&jv5END#*S~x!2C${hXt(l{kQ=DO!cVVfS1%7_?4pRM!iBrDX$l& zg2ZzM#uHm+9Ove0dC;EpZ*JAZ3GjMWT+0viZ?ieqK{S*VH?T{8D{Y+eG*f-KOw{yf zRehY*Zv7t(aS>+v1lqJ!RVE|hbBE+l`lP?#6=U<|XJ)%~XH!MV{=h4fYS%kxC(*p% zBr&r}A-tqvJ|z%6LFQe9s_V1RU7|UzA8}L750hWo_>l-dr?qHP(L$;g@J+?fbS-)* zbXH*tHs+36T|$xf_XhQ9!@;%GD~HUjdxe&HM$v85_(SCBJEEjG`n0Lvn>ctp*zac? z{5{xjZY|a^bb(-d_io%*YRfBNJ{UP3cJ8R3-CFGGqkfKSu_;IW&aTBu{}mNnh2Ve9 zV)u}QL(`hoKU59ZM9wz(ko1u1OWHLwN-4>1 zyg#MpO9CS21%9M0zb9qSvgOK7YHJw%+hsq;w-D4C&o(vOu+s16Cau{fV?9hgm8@fa zA+Bx%bpE^0=DV$*sYcJ7qFMgF<2dm~b^YE`@*u%KcW2Yhb{^JKem4nQWj>W6x}^*L zG>fC`IDGLHwFM1)OcvGaf=hQwNtmnsq8$QxoZ}&zXr`_xd)St7CumI zCOSoNYCDd862)E8rT>0*1N}^v!(|h&^Yls`*Db$sM*Cee zf8+RjTqj3xe1a>W&bM*}H25a2nS0(lWHQE9AX*iY*>M|JNez}SH(HUlLZ<1|zI#J^ z{1$YV#qn_?IH1*Gqca+^TR9M)CGRvjUKa^fWjlEE=+B3(n2OH=cW<^FI}KmB^x)nI zhLX0@^xWifl54ub)@fC*M9Wt$5AN`wY?lY`cu++zN2i?+73P?BLX01xy zg1+jug0mIv=(d8g6%FYpG1I_a{UmNGn4zEaB@LA7C&i?K#rjFtQ^7I)Bt-Rq?DIGk zyti_NzoujJPL$DzI(_(W2LwE2uU#XsyUwuRbG*$Q2%$a5Jqtd2lys{BMR8l%veU7| zR3&pMah2)@ujNEw>~IopIbHpL(QzfxgIsj5P&zkj?cficz$ZpOxN{bIF_1K$u3w+E z7H5Cw?#Z2uA17*etCn2cRs8he@hj$JnmV65p&s6W*K zYXTLhB?Wk6EKF9I7V7=*Ue$Ey=3PIu5#kCg#vdQMw2GJ1l&<@Xm(1@~zE}&#ec# zprk%S)Rf^GX5&S})e7q*FmDUP=r&S@R>5QcI(Ql)+OpNp3{mC&NvYMxBuy(2s90{c zv3)$AKAP!pwa1WnY`x`tJpD(z!^R%NRC*F304UH}B{0<=eeF>62pCRZp~Atew%>ft z4SJ%rHZ|L2)6#+ClK{Q1A*qR^hqqtv6^SP=-gam)#Bl7_w_n1OXKp*h8)C-t)^M9I zswG8XGLSbo41+FOx5W+uDXR#!kh*AHdlUve=k!2w6!`Ts>EhmuiMI~Y+fc2=3QC@P zW-gk)d=BnoIhYz^TLM=pZ13H*(S09fAlhJ=_eQwFpMzeaB&EIu8}B6v-h%HeRz}=G zUkzN%HPXG_y1~+u$jVb=JY?NHWO97kSh9FBY5bUuYwPAMwkZs2+v8ovlF83WUr0Jz z-)(M>-;i-ylQFsluC{qEHwOB$9S(BT4;dcs_oDY_J4iht>E#u5Bz<^rjliB`WWWFT zLILo*JZTL{-vAJq#*dBu; z$Iu=;X#>Y6R;XkXOR~2y`YiECSjJo%SUj=9zYc^ZRt(gE{n1IOX93c|9+zTBx5<4^p*I z{)1};Z{%q!BbNS_KT)xqS_zBx{j>CkbX4dNZLjBwTR~a;=Wdn3@dj1sXV8kNrGM04 z?t4G0x;{4e!96WZe8=jhCA4|;=?BlW&?)RBTq4kpBzP>Ki!c5yZBGXoxn!C(`eeWs zGei1Y7UIx-$Ddd2u!hp}cn21`)61uS#R3Cb$A=EV{iu_og{>!T5}_ zm9dyF87d~8RFj-2CKo23IB~xH&y2Z5b5}3als<7n?V4RTUmggw%&--S#O6$#$|B1p zn_-FgM)vCQ`dh*A+w6cuBGAMNOC(KZ)4j$n(?`8{ck-~)Yl%F2!)J*XGN(4u<@rRl z8f`*iNc-4EeB}oQ0v@|PB75s+6j~zWeua=t=SbX3$r1V)@i)ow{y)U~6oTfe8^p65 zz%oSA293QWfBq>Mnj@-c#6KkW`~=4Fyn;4p+K1O@2Hkqg5+E**rvtoZ+~CE%JjD1> zGfQJ?>DFDL1$RN;+%NE&1^DbOd%RWKVE2B4{Z;wP5B#}J^icw@*8=1U*&hN?pKJCJ z`1tpKc~P9s`JHX|aq>D9Wa;JPbvnq>+i4P6r#LmA4mu|UXOX^mAcozc;nb?fO+4$B zS6*XllR9%+q(ZBqL|N8>|(rxMNXUTspM81K6FB@r^Y~@ujSCrwb zsMyjnTm%(MDbrw6uoGn(V>|HqEk$58k+Y!9sEH2BW%* zuiODgAu5&YzWyZ_H%nhO87-WmGdSesa>PcD*LNA3B=E*BL-Y3At@7NOmp}6dPbEj< z*x7EGUH+DrccW|Gf`e#}NDZ}YXUiUcudtocm@IN#w8Y^C`FphFQy1~{AlhO^T_tdl zq$`1H7ufJ6_}3pi?g8`BzsYB_T@L<*FjT~ydlWaZXI0fz>enAUckVkfu*|EPfa-6s zTw4v-RI-_^h6a^vZmVHHCEMnm;pkIx&m1s$h9{W=q_2tJ2eA>V+dof0?{2Wec5Bb? z+(&r%w^5YDDB%xuyoBGo0)EoKUswT0u%-R0C9^o*Il z?^z6+uv-r=CR%O7q=<>^Z5VwqF?bthKuqk~hLMShSGQpz#6%tuw#JkK2*x1^2@J%&Kb+HRKL`Af$%ehk;9a z7zzwr-UF6Okj-aI%|C>C(cGG+x63*(Dd`#!A2G6Y4Sgmw-@q~mg5EW-K9mCE=DcJ- zbmw1Q%O?0|ulU1M;PV>Zv>)1ZJL`Ia)25I;+(k9>idT$Ys-$xbugVRQeLd-2wPSw?A?+x}&FNh4$8nsm`0SjG}hMgT2XqEiIWfF)8QfF3N79U+;;61yUR zvD-vm1kie$_~Pb&p2WE{7Aq) zTno}X4zX;iNH+Sy$c$W#a7KLj2KW+>jKu8(@W@MQz*HOYG!->*Y&-k(Vap}iIx1#m zq6GnI)y&@~*Ks7xJuHPtFLl30#Ob4%h_v$MEiia5uKX7N)49y5Tl_EQEMxW2J?Ap3 zZ~ed6((_n*=w1Tf5D{B)+OawJS%P2Cum^E!3g|K5-HD<9b(W4F5j?zzeY^%fAm*JsK zp?Q=TvX~+R8!XX-igjGidm@B-uSx%tNf@;Zz1MbU&xs5I^30o*R_3Fsye23@0@3<(x z^5s7GeF0l4@9=RJg6cbWH7%IpJN)=M#-tD2tHyg11SL^fA388duAq}hcizv6PuW`^>*v@-&DeT{rnH)G-s`K&HE*HRIx*VJv!y`cBlfE||T zm?;kRn%+)7mqz{`3Kp9ZgKLnv1fpY&4)-yV1?%We(in?@Cmnh6Dap4RL{10RQ41%d z9n(8x$*jm_EHv_!G4PTuuh)IKm^>eY5B$O(Ed!QH$cQ0J@p;~z9?a!7Vor^I*dcR; z(v-XeNk4@`xyM)miEhma^h_DBC7$W^3GhPd7r+v!p8-}Jv;94AF4#)Jz{9@mc`n#g zM1&0BAffae)?6%OJcPcn$kQr7FN?ga0=#CCKdS)rdj5|!bY?w&Y|VmOg61E8jG8k4&=2SZ?M&xYyWo-s^*V`)^A@hyjxHXJv)GZOg8(=p^x8 zZJH^UGOjOlG7MhFhe&#`8}qiSE#?~Cw@6*e<>y!kmhGhb0=<;6box8~(hPt|uNyB` zO96u!_66iGY}o-=!GrBlR!QUmEpY4E_Q|!d1ZjUHJ^jcSR|RS;`m`W!CRwTlxiGdU zb;&z%R?3X0e(LPS4E2+HT$LH>etVkE>lkcfZSYwa7u^2oh~*>pybm~BLWWb+J+`yU zP~UshANhjgN)5F|s4A?yqFIu;T_^?#@qGhcGRolMy!6LKtH_6_m$e&~%Y!@O}U8Y%*= zBvIZ41BL$y6_e*T|ecprSWT=rMJ{Rifu?^@?MGUDWp^PCQ%W#Lmnh%T3U zLRN+@GAZ==0^U^f&Iy*pwKHM1eBlWNu{Ij2^j0gwTJ)3(%5$C~X^B-ijk}*IDs%1< zo^h*l?wUU1*5s&L*9)T5kW>VUj6fe&7gkUti{{=f$nETG(RFXMQ-cq?2rsx<%Jp#y z*9zjiTO2+itg;0Q=|b2RWE4||Hp9h8Jnv@u%TI!-&2;#a;MZn)#V01hum(Jm^=l%W ziT6+2b#bkNe{=ZDxs+hrjQC_q5HasBnT&))%36IUwP&8}Z3X%)g-!NYUHhlZ1&a*d z5Uc4xxYyA8CckyO;@q+OBW>|4S_;EA*_zTnMa%(YHq5Z72w5j4g|E4de$HTIrNHJ`X+FGV4 zzi)(S2jwB~Vw|wJ5_&OF^kdlIi`mmA#A~Pmxqv%iy|kt;i~6COPx?2QE#8;c%~=qSueYQ?}{iudXn%$toxgkk*?XJr@7&;`Ycmsv)_ zVq8TQqo9~uk)>W(e8kY)=Pak^XtV4@oed;Ml3a6uMZEAP3GT%UUywXMnc!oX4*MUq!zmJlVI`?JVqDJ#sfWd-YqleH)%x`Bf3$LY&0HtrSI*jv5XN; z#sh8o-g7fp$gQwx#E`hV7_r7=(de>^_8IX7vTsX(^pW?Q1*qDsXx1U1#+P%*VG{Y^ zFZ_?}6DV8$A6neW9Qp(94-*!w1*hK@eR3)}b%yfMsl@LLMds8@J0n9FZogowPAALL z!B#S-5?ZiTj}wb_mNKqwewj^~x(dwu2tTfc3V#(=?9?M}FM7OF&j45SLrX7AR7P0b zn2{)^{PY8d41_;wQ2zT*Ah0RF@)dL53}|J0uU18$-S1Pk6F-Ec!>XcB)|4rtK}KjX zHyShwE+q^Z5PXVUE1`2j%KuSx=5a}-Zy$btGi6h02xyrVD(+YrD&_7NM{`V3LL@bD zqTH~u+{JCmRIscpOfzty3HwHJFI z9Q&{a{oayq*ydhuOefZ<&mYr;6)C-GieUPL|I1&*Q)d1rXgbIEcv4V$j)aSHzv8+FT$b(`Cc?e zw#0dV6;P+@ycPv4s5*N_iT+h}#zXY!sFP>AQ<%5lQ`>UJ_mVnEd#6B9QxRrn14Bz98d6O|d zS!DZK^Kq2({z*ocxxmIEx#%0eIFonDkJ#f-oL54f)HLpJU0Q+Hf{DZ+ZtW^qi$+#_ zM$IeWOF#363!1mf5-qG3g+Lar@XuE06xT zTY~Hc#>a+yFA&kqc#|kC8|&Z#V%OJWo%4Se{mLTl{2#iwjY|6`t=A_`lm3_sMu;nG zz?@4QWPfjUTQajO_AgD3ypuL?El!iM=q2dY+zU2&f}rhEBC+oY@I%M>x&ur`=$2&h zmq;@&AOkt7nb(wo>>enlh9!2*xT z5Azb&Fyo?gdHc3)o%~Dq>pFOYE0TE<<#IjsyAbF)E%;dD6%r?(Ku@1`E>NM|ct>oP zMc4H4qv*We%NRW%X!cDZ7TCxmZV%8!W6s1F)x;>la*gMD8L@SMe)bAx?F?tz!Z{o? zm2dkI=RzqHHO`nA%~v(W6PqUJYC-##0mkra+?8jMByMgEoEY>$gVPg;>I2XHdUB)T z_>Jq_2lha18GHRS)P5ku_8L;EdfK3bp|Do^q~+$otwc3?*Ksa?7dmsqDOLHa3$A4^ zvf??x;f_{Mi?5bt@zf}&kbqa20Ivxnr;DK~LB1S808p;JJ;ZTwG`tjuZhD7u8z*9qv`T0(D+*T_rWsh-- z>G|Q~!HMSQn8PL*i*t)gQwEzylg&GQ2aPymj$Bp@G$p}^xP5P&3`U25)}TMQZ86Z@ zI;=u#`k*{6Tvg;F&JDTCGj7Vga@XeQH1nuRJ=pGdOoe)nRhX$cagQ~hso9;#O3c(; zzsG9I)QnGL4YtDL8VoTO4$PxN;yF_gjLn@5=L{-vMGJS$>U~GUIi;Q2JG+0=VN-Nv z87a6WUD+2pY*(`KV;#1!hw>|u@lws7ohi6l5GZaiYN`HHE~+*6ral;B!2Q}H`m(}O zJPprR$C-gN+z{JKe?5%5=*8IxTMkuY-}7|O+Y z>Oz;DxF9h6pq*7gM)E1(yMnr-xzAGRKLWU$F>rMYa7&*_UV(F$W8kqCx6)V7K-Y5N z_4Hu}c47lPc^~&Fno{v0H}L-W_Otd*g|_8DZf`1MJJUqI+HQFBL+*qp=jS2Z30*k5 z=H^7?GdjsQsmiXIWZY6?C&!v$ZtQD|tRPIubC!a*6D0b_c6K*e#S0fY5gq4aSnE3| zkHn8Kw@~<~SA;HssPP$2MhLs&ZCnCo53+uWm#AJ2hBB45&Fr5B^Qh#|r|r!GV9f=$ zUkIBkVih(p){EG-4UEwuHmZTapmLwy;%pt|-oAyLyu_UYb>B10EyZNRf!rw!XXH2T zdIx=bKe(Y(y{If>{jzVq6By1i2^Y!cy%THC22)n`xT}+*Fg9UeQgo@R{nw=EY*o8x zQZz-x=?mfNB$E>$T01c4G%tk?5D*rQh&uCe$NXjc%8X=cES*Y?TB7_GdpEmsf7v4^TX8x5 zFyb-X34hq!0q*BBjP3*6?K6z*1KhbYjK}ZT2m93$XKyt{+_UMQbXq!y4i*yn+(gY) zxE6mXhK<|uhkC9U*;iTx_0BS*?`ehqtG#|Yc_E7c=H3lka$l7(Hutc*2Q+BggUqn! zyx9;Cp4E!!)YkcH*lf^=r52C4m8i++J;&~T{LFmR;E~#!dSA7_;Qb#L zb-5ox>1!BV&aCWIFh4S(aXOeE1)>AN)R+XH>0rgkgz<^s^soelpTX&^o7ElK^C!^* zlX6k1S~G!s+L`tSR(ijB`Z}wkU!AtjiXTvawZZc0Z&^fh^H%htz}U4aJ0)<%hhTb> zcoBgHJ4Q{0gn^0?4;9E`1}liniWhu$s)(`29EeExmiW4!J_dxD!2pOa)E!T3?+Fni#Mio(WRyw;rAiO7FCmn+ZzqvX+|-a_t10 zf`Xd*am?AErU5WNItbN|6NMV5_-j%_jqA$bGA3-rQnnqE}`xKC4@_8Iq+d7 zh}vuUGSs+aRyol;RI%4m95uu2wG@rAPMrrLxsP2qA42(Q>R+n~TgTBb!{Aoftw{s3 z^TqMF-I>rA*@P+mI}5myOlX@fd)-16RTHGRbDy{M)puQ=0(Nobv3G_3l}ph?PvnRT zo}_)U)h>VH(|sa`)yk-}(oTuO6;D08FgXTD%(auEaN?;aU&Uju(L)C+MA;$y6@ zJO{g@tgn?0zrHZ%f9JeAmDBW(f(0_?+dn*0y`1fT=y^8Uhh^*9m|y>ghS}%-E8BN2 z$LR_^`vqa*v}hcy-J-}TH_SPEJ}BQV_Zuuqhd?b9eQ9ELpTLJ*vaNlpU~w|X=zMeL zqYKHZt6NOU10Q4UoYSd4{k4NlDB~}gQpeB{7i{4Vv`me14xeMPSzqs{@*Qy6CRPS4 z)`jRq9}}aTLAkcT0NW95%J?vIP@6I}%v8J}5`WY#dG$v`fUUds9ZzkUm-KIh3x(Rq zXjj`h6*SG&HdrOu{6x;^qee!K_%N*9!Y0>3%{YenHOOXo%P^-moHFmNO>Bj4hTASJ zfDV6KvxQwa2W=yVt2=r*c{{RTF0l5x5@k45o4A!QZmgQ~U`KYh_bY>KCC>O1^XraE z_h(%0_ZncG#pG|Fcd8>ytm>kVI{1#)0PS(wCpJ@gg1>Tq?dJ?}nA95O?vuFOh5eM} z$4r=qY+Q+UlJ|_K_Q-Kr$#rewaoMgiuDJM5abL!TmEX{`2wT*{Udj0?4?!1)NzVa6$X`LWpvY(RCv(0=!#D${y^KlLXI@z7 z5N-Nt%S75Q)?|Eb>;N{Cn2(=DB6Gkf%ST~@YBDcO9pPL%Z<{nAEAMuJ zx}mWUW$XLvd2^^{&hQzL=qYowM&)4XOSv_rwpB~poE_D9?gjpi622Uh1LF2pnK=eK z7M#%{W`LD=$}ZPQ^d|E{5&f>cwhCv$LOaK5F*5nWVbkWA3uLetLEglr)pG3rxoXNR^V`V)5JWOjPZNcO}R$J&8;N7_ZLsln{+H;(1+ z!W7I+om{LBCGflJunxC)74D|eatYM_y4q{Ecn{o7hhIx$-rh@CZE}3^F3g8~nCf*1 zlGG44_!{xJApzAX!4mCxov#t2C-+Gz1$!d!;B(Ag>h6=22@>+opS7Q!$j(0PgfKJc zh(~b}UZ2NG+OPvT+37#ChYKBlUvvx!=NZv>Z%yS)A?>LNsCm=oO9<3xxKB0G>E76T zGL)+ILMV+%Z6n1uZImX=3(gXwduqQEvlaE%JF?enrd5P0;^8v0VKN-GVuF~$WDgF^ zIo`a^8=VcKlaKI+Oc0Md;uY5(Bz%}W+v53l^6ZFrIPaRY{HOU-x1xBZ$05t>j$1B> zQ6U7w8c_+rYCRvhJXP=L`7S(dHH!D3&(vHhm9MUAz;?6cz!hNo3)i#w5!z%y~_uEUpqymAal z-qU|H@m&PH_b96HUBc#btX1fWBQ20u*k|T6aFkCCg}9$dpmz7wF1BP>gszfdm#=42i_FA*2l+ZZ*oEuaQiW!V0|%*UJ=iEW-m`0v z7uT~3mw%n=I*9UzKwQcaP<^%7<>_qx@~=nlP)?HwgcO)%-dT&?I+p!v<(F)^j??=L zgzd~eVj(wy|G=>%f_8EI4@m_#Vbv^KYGv`uO%L9hnORW(A(WpkByc4zab_g@*S2Fy zL^$uAh0_ojp)m`QRHY_7-g8!Fb|ib_wqtul_@5-L(JgmC*OgLIaL^RUW zoFx4SMcUbt+3CyKnobmdNdCk4^u8W!Yr5mwMwr%&46)#0!bN{xdX%ZtVm!6C0Za7f zl}4G0BCx@;L)ov-h`*bIFMv&&8OqK*BOV6->4yXXR(cROSI*;+84X9Lm3C0kH?8th-ukhvC`QD+`YES9x7q zro|SAQGPKHwnKbV&p_?slWfZ2Ehk?5mf6e9eVF2!gb(i>KW>@HLBJ0>fc^P5Z*d#Z zy$3sT&Q$KYG!Z)IScrDA7h%Et?j$Hg{s^|j%GAkUT5@d8@f}+Hw+LHX@Av`=X*q(m zw>B-lE{!=f_oW;y_cUz0O92(iNVuJpy)QKkO!FpIh_LM*SjmaGFPj~XE$2;}!I*Q8 zL6z+l$B*g=>NbKJ!bo^slh9=TZ|(2^R$l4*Weq5Q>Hi>Bwb}KMUtdJuy|_WERX-YS#ymnf96j}=TZLJpAe(x*x;k%Dlvh)>fg=et{+G-{DS>C z>NvEA#_K#vUH=m@*OEO7S#+#1a&pc{c-4|UKM%g`14QOnwqGFcVn)JtOE!POR2p2A zId(ZHkoOe)odI8SG&~KQZWgWB&px~#rjXq)vNh&S<-on;r!b7M`R>##I?gdyl*)OuXEVo6HAW}GMG1F?DD;A z>!-BF7_?JBZo=0?*p`z^j%yU&;swZ(ZhVu=X!b~*;Orqv1KbN|KeJaxRX8zEJ8Hy!osQ75eFV3T)@K3H|R6=-T`o0vyW^9)eFSpi| z=@3_#5YA)mtE)A0a)?VjI+N{%a$39z2?j&r53GDSCC{I@2{}f{R)nm4!N~KsZbAwk zo=rMBbNRBd_-y=+n$!CL$eaU~sJr60;>%kfK@^t8Ph6bIj_~9C7(qOC!`kbvoT|cz zHv=FN{p|UDX41`f6Xj{V-h=$=FW3M#-siIr{T^)6L0Z}Xf?D_mON-!@pM~^7_nixC z?1!RO{(vNRITomzF1E(=Ek0nsd1uoe{Q9!y!ULDtMINM{d@?JY67eztOnTqEQ~&WiV0)yyddO8ssFdE#-`7V-1)`aQ>@b2P1sf20(Bzy_%}z266^ z+n;Ug9H!;|2eIG-_L_=Q%Rb1J{n_2lVQCltkW_uZN>a0}Nn!Mu!_wuh~rx=1*lDAOZVpY#ww{h|3pBg)hRIWI@4R#Ip{PCSzmkv+of&!$k|Eu=v`BbLI!zOGo~+dtfG2lYh|Gi zEvOs;em-!qN`;S@co9oM;u$Si4M0|3aW4795Iu0oc?$n{tcdCcM!TdDX9GCF4SDfT z;m1t8Fx9MaaNXtrPDDfA&0THpt~i&UlZ{O$u0chcIOqIxvIG-1kVr0`rKAw-hG)Hq z&UQ|oZWwuZRhP3_9ng<(ezAWI;j9nBH4s7LK29`5P$>^kAp#Hz@q`Ep<$(=^^PIeB z7~z~N4^SKgpW`AO1ljU;x1LHi_i?;+1%;}NysG@i=U@ew1dGYQCv)c~=U@xx^8y|q zQS*6&=b%a9&NAnq$y<3}&q1$mxX2u}Qd=oYH%d%1{g-cOZ7}905z)&d1)~bLf6u2~ z0lwXK#)5sicDCR}V$!rnhdNhx{^)?-obf4zhh+2*NL z94O*@{Iz)0OH%oG+@zU*MI9ZMMr^g^Oh-6_V*BQmyipP?+0)rb9oW_rd;mkToB1#A z@-BH1UCyedx=5I^xt`84>cEDc;3*7Q)r@jKyLhr_;)F{4Qx};O*`ZH)_2=o$dIGz> zw|Vl;&~m(>mk8j+d>?tdVhPIKig_-d?+i`B3x-ihL<#khl^Vx6UqG+t5ywy*RjQ=y zU!@zEl0+NC4NO^Lqst9q&~d2y4I=G0zPy(|aglSQoH&1xQ_;!ax`=eYhPipX4ID#` zw~?-4qK@O=d_Zj&au#g_kB8``s`;=6=!Ys$8JUtG%gv$-zc3#VMs;X0BE4aq0E90n^w z{MYyCEMLhb>tS%jTQk|7mnzEQFb%UcqR#7AU+F~mS^xU;Gz?8KOh zeTL0_wzvG6d0TWgacyPqrK`l1C}emtv1f(x>Rx{Q!S#Fj^)(LC?$=V*%+a(0`6fnl zopbpJQ2dSml11-uC4$q{RgfOQ$^ORAX8G_-s3$bnPZlVmG_7?D6m>NuH(YebdzUV_Ac@nXGOvSzF8cvydD+2@3tSfipu<%i}smk<+l3yygTD> zKcieMi!b?0h?WLrF7_l@^)qfGJO60abn#dB0FoBx5ewyb{{q{se|)MW{Fv;TK58^L zpvDq_mTBiW3$+RVGSr$%ThKe=2!v7ElTVGdS?s?d`GuwYIv{we1ZxkyxU~65>*pKA zEfxGtF7aEgsFUqnKw#XlaKW%_4PNC}fWY!s=PfSmn6Dt2aH#S#>cU@(H;S7CYF?*Z zQ;4wL&+{Iq0N0)n1J#o|uS&pqdd4Nm8K(L?@0vOq6rir01Dv@;@ZMizX8uGpFg)NV z*?F% zZb{D2+y-!yX}&^~p-k9mhu=^Q*}Sk1{DmOOue}10v`yB`8^vjAWV~rIk8L!)OuQ+D z-nmPhlIHySOE95NZ_>=aus`q%e^#2~-AKK0Td5Fr5j*T(it@n9`Ip+hR^gvR*663mXxoeaoVkG_qK~*6U=(dBf7A7;otZgxFB;s2~5)(l%6u+gjUxi5o2mB z&ub8v33N^_0lEU6t^62?W1zVnBrugEN#xOjfi+*?xgG%f5i6^sH} zVoAiVNdHch-!c5DYbiAkct=Z7Zs$Y^`Gb@6SC<9#!N8|C#L0@?18*k4XjvIInS52R z`21HOU{>qAFiHO~mcQ?_8mHB*?z0*-ql|AJ`2Kv}#Amgyt)MXVuOKsjNw5Zby;9Qn zOe9(W{kE_*-HV$+omRTUn?}ar13sY}G7EZMT^UtDXF5E-(cb6lB6YGcVfj zFnu;eD3CE;gbO;$cbS*)%~Kn<#QeESoJE3Qu^fn~rw(4CoV=1k#EPSD5Xo4($Qwiw zwmAB-1dkO*`C?qL;uv2H5!)Q;nG%7(Pv)UMtGZSZ+rxq9WmJoYJ}b_BW6)#$)bFO8 z9#F7+j=4+FxF-7Z4az7}A-#xd81rMtUjo8-Xzvuz&${za@_kLT8k48ds@b&d7q_3D zzT-MV{?lNqgFpToWva$m{*Y{)hns}_r*zbHNx=W`Xn#q}`w#!Qv47+IIwHtZYgixk1cSlM1;Qtj_px%z5iCN@Rk>=5bp8Wy~|R(U6N>YRT$?y!{MQmk|#egV|xH zK$W()MTD_9VC*vv3-ZJ!CY~qN0uCCDTms}y2B50xyi3D!HFO{MVP*wg;o`739Ez@J z^!I_dN_gFZdPyy(z8J0vd6NOK!BD9oUb8MWkV zb}z8@om7vXXEo`n*DtUhr^23Wm;_(4y?X3B$OGeV{nIYa0fzpE1IgaW|KY5H?{1Y6 z+>b#`zT{RtutAKAJ7^X;mNTolB@|rGLo5m4LUfQ;kcu?`s)0 z`VM=G#Fn@P3srvgklefbHjxdvgL<5~cevb7bk14s%qM#HS#H}W`h&BY5r^9d?i6f<2A5Q_{(X;2N`-swF$pH)#9+BO$fzyi4Z-WSMW;4576Rl?Bo>*umf@SDvOF6`-)7E~@#3^othira=5oYU7H@fxQk1OD+=|<2x*=4mGDnA1p$KOF;jl8m^gixSDNcACVL1hu+{gW(!+0Q% zQzyaX&l#x;)m$G0P^%t~TQuda*iweIxNSOnBbZOB9{ZSsX1nvqsQZLEUB>nm7OY0i z`r$49jyk^VYwl1g5Y1@+uFIH*aesQiTGVk}JLkoD0jM1h&h-?+^bYKpfOTR2S^>@- zTz+hfx#q#~DIpXm)AK`6erio5le!}e&<`Z z#gDi-59k`#Fee(c9}P0MBzlJHBf+~QI8_pSw*>c0z(}NWS#o&yX{R)# zF`tbhh;Eh;q7u`1A=LBGmy_u2!2fdYo&Q=wtXvd!qwbKh7QWfR}rlNI+M) zVNdSQ4pCzl&b>yX5ROx=(XfT%^lLQuFq~11iXt3WFd*Bqmzy{sJH3}H@~00Q;Xu0B zwe{A-hD=-dgZ55;`g$O{5F~*!C*?N4?DPymyFX)nKWjbaJfIttzH_22B%4so7_a`4 zn+LjxzG(LY!ydyJ^mb(}#^2sL*h5|F{xZD9~N~&QF$nTN|4dzXd1^s(Fz$OCrzSk;J9VT_JRRVN_ zZ7*Sq-6xn8@o6>U+(|{wydL+bA6@K;>*|2Dq#DUzI$um41<`Dun&#X=S7g*P0yypj zaK$A+%LuNo16Go1B6I0{5UAOvooI8KHK@5cM#9y#?0Ox*zpgbyBF*q2&k36}Wb|`F?Gi9?n)_gq z(R>|O+X4S+!WtE7CK|I6{gtgvSfDyTeKv?%bDQ2fVsP{Kw%}C4s1#@Aq-HUU;LCmN zjEpKHxa)v;AAtbE!DWO9owo8e->ej$o?!!tt=+YNbU$@h6ZZTKwVMwKo7TuN1h@ML zV>5zv;S9`u#W1+frnzs(AV?K`E0eIT#CWxbH5j9&fe4ydRYflz;@-9Z$vvZ%&E!Uq zEU02=MRaOM!;`~1K@l&0olaOeyG?KZ*B)3?#l1KK#XK~$?*k0X2Mt2uw?Ri~H~r~3 zHmaL0@?cN&&%Sd=o^VV@EXuZDQ45k~TXwk$$zJ^*TNGu#+WT=uBH`UMA*kutcwgUNryv4e@E7_Qz58n5B`t%fqC z@F%T?EycQF&k66Zi<-T-{2qFtH(T+B+b?zQ`yTq-Wo~)TK~qqP8bVnO2Onkh9{SIz zYfZj6QO<6RX!BhRL9TP!#nZsYd$_vQ-P^=+(A^vB$V1Dr8W zZn6peSt?sER5no8Bs=zB9bEY_;F}H(#C$*N;Bt-updz+DF8UrJbWdA#oi8U=D^j98 zi{tzxavz&85<6Jb8MSqCASlgMh-}H7#8HMZ+-(!aTnEc~Mvd0MnqrH-q!GTki&oPJ z+wP*qN!&;%^or1gIACR0IpY+1sBJl((BLlGJc6qYg?9NH+xJ=x*ZedHJcKs@IUG&O z`Ux)I0$S&9g4tw@NAzfKX>#U{aer7qTV@UIHyQulC6Ln_Gj1lnVyy4w0_lx*hQTix z<$Jjq2KXY0@A0bdMBFojwzrbKp&&iL4w%*GE;W|#vwvA;oYHR}QtS~1OKi{ruzr-du-H7jWE~M9`~@i&%lCvSQTerGCeG*)3E6tmd0t=&+9mS z&@g=+muwHTp5|8C0|TeI;~JE|pA))X?N$m(^ha8k8cA*->r0JtPD8;d3EJ9fT5?0- z(C`jlA2@#Qb^EFYW!{}zZVxQKB!CiQb~6JR-iV73j*cSJ!~qd z%)JpxUDa=^>dPHz1!hCIiZEm&&+)ByNvk&VO_1!55lDzsw`xc~aKAW&*2CO9D zT2^Fhm5hTy9yfYi90 zpc)*Q<*AL4gUkUdHGN!)yQtF}mwS>j6Ugm9Nm<>`{dkfS272+8+R#HzK}zV&6vDhY zWl@J)zd>&%;f}39mvun@FMUnOlA2XTf`r5hw5tf$z5*>T!Y!9kVERxfLC#o`SJ{!yQIfz?~lLj0N znvFeYG%pn4!v68e2yTk{$A=w^qW$BO8H|eh$EMYoX!d7Ni?ObKmA=L%)G;6BmI zVCsa1-nZPU=Wo8{zI*;ppyIejA*^zP4H(gogE62?5}oN#V+jqKV0IH%&Yc0gWG7m%F6B`45DXK>*V=tqAR2LcTq zFibH63?hf*V(2zeLr(8bg&O84A@xjHQiqm@4VGllNNyg2BS&sSP!5pi5Wks(OO|Dq zOu|c+Ws^+8gO_FPO~RL!WPh?N<0I(F>`FZ|5EvncrKNR#)LFTVEG;5UUFHOO3x{h( zUp|wQAn+lRh!S(Vt0Bu1k!f1)!xAy&CAI0MxBLIZEqX*Ka^$PtK5fBsW=o~ zhftv%3MZPLUDTboH9aeRa-JV^SAje%+57`t-YA%aQfSGf9aT{?QkZ;>K1J^sRt0W| zKAE3&vZ^dZsKcPbO^^+zlR)!u)f_d9>4PSpcnE{n3s&&RqI;=P%(R|59YHGnYWTvl#WSU1V$wc%*m9UGZcdk!Ib~qmZijYN zzhi=r$|BVcF!FN9eKDG&skEdWwt`8c&X^J~7Fub$ZD|+NA=p*|+_Fh47WCownJ{+_4B+cZ5-)1J@QqZw!!Dvh-*KGmI$>fnO(ReaB zcuUlYC;yD*Y+n?91Znba!FP}S(Nppphw#Cbq`n$@#y;Wu7-%_{*0Kq9sz`Kp(3~Ly z;Y0)db9?0kLbbwSfl9kSZq_2$LUVQugfk8F_wAKZ2-SFp1;wcQ3T7>S6KKk&fv~&* z2wC+*VP zon7dvn>%|cUO%?sqTUZ%ntzC@tTUAh2gw8nS)*IRa!q>WThj6qz_M5H{V$LXm5+F= z^&o<1`WI7F1#^IT-V&~BGH$;mjXeQopOIfUz_z?;_GW+Cv45s4`6C0KlBNcL9S2ar zsUa0JC|ULA82*qf_;Zf`z^u;hu31ssIFoGNpcCl+-i|Mma+iGqGynPw2K z!X|Gz<6fm=hRWcfh+tE!+R5dK@OT^Y6z1)}?o*g$X>@o&N3T8*l27WF#b20|KZdNQ zRt;i-VVF=Xn+!@?z3IFfk>5?aPqoPJ8h!k&$d5)(D;Mc_>nE4>3&QmAZ~6t1`uO60 z0ZkuY*)O=Ek1y;O`0C?J`vp<@_=0{xgg(Bc-|ugId{w_6c>4IJ-;b)F>^h4nd*(x) zO#z9v@|!y@6zY%dB4GG}Z~~N0p0Aq7P@g}!M2&u`RU;Nmx^Q+b2n)RTio>lkRQZ#Y zlvZet#e%K*x%=*;lA=c*GnnP0_zSZs`gWZ(Vd7=vT%fT2GIHe*xvCbJI7EI@3;d8L zm$$<6Nnt4#4ndcG5VuU*g5yYi3qav}!B9Bm&3nJ$aLU{FeiPvo{(HZf@ZU%@&ze7n zJ$@2be}lgJDj43)nXnZ$9io5ppkY9t^rn#1x*up0R@Rf1Y0)E?o!^o}Q%H07fN5~n z9Ad-^DknVDDunaYm}I)gG-eg#w@W&j?*W&abiiNT^Wnt%vJ8(1%mdIjFgKy7(j7B| zIepe{vwpuWRJ~>?u^Lc|nIta3+Lqn^Q$yb#paoX~c01qvzN;h4KKjk8bMijw%?4d!69>c8bp|?$RH}s(8^*XcioK;2PR}#I{uX2K{ zBJ~>F_2Sa1>jks&$Q4)N9Eo1&S2gOP0_&iS+=rd$pw(G37E8$TFGRme$iXk}R(%s( zXKMK@PaILVeO?uRj?wKUY}QJqE`K=4dC{d4y1%V`idY<{aAO$-!nXzy#Oo@f=~a*2 z=u(8~v#a8SX}3loCDzQC=xwBS?!&2`fpA zpEBe&5@St<>?wpX1|l$(wsP)ck_8lcZjX>bVl*$2%RxyrXyzrWD*FH8MtkYj~VmwfUSA#^RD+%ANw=aUzN(3E_#(G}pjfb>HlnYx5JtZM99g=(N@ zI1AI!lxm5<^L}G_n~s?^;J-L=OttC8qN1WI>&9k2V?MT%xWAv>Tq_#;> za}qg62=9tnlfafe*-Qv;ITJ2ZjSK1@#w;7R1wQFmoCHQSgse04&C|lp zBfzcaq)i!4MT=lg1}Pa$iH>co=<*wuL9TcSKc1m~cwRMi1ek6imxGq&GZFGte=YV; z5!W=JH4?#+Ju+NC8hZ|OfF4qPu1=7@S=1Xv)?>eDHJ9oEtEITF5V>f9t7K>_^i47be2)X;t<4{W`%} z4-poW(d&DvUJW2eZ>*pqpEs7*3Wl$9Rt^Z)%NT7YmFWW-^|QYw!k(v9)(Xb1Binvp zmQF*v##43<;H%m|5i_#9O|X89bNL0S&jc8-7A}X2FqtltQg3x`J;!`=GQ<^kBwao9cmJW_6xuIHL zQDs~PEr-x#{8gKj7MrfA^1(4W)ra;)u+B{+jm8sUPv}6nN=?`fo_OPmlv|xLfRTWwF3Bd30^Lp&FDj>a&0Kzj#gJxj# zpJ2@l**+$jL!bx1-4%gf4;2=y&?{;pTB^<&Z1w5*o3w3(3c>87VI}g%X`scTs=E}f zzca7ci!(4C#gwzt!kTsF&GDx}t+qKH^IbkBlZW`lkIJ+;5SG)g$#I}9RXW(2{={sX zw{7|h8|ComaiXbJvouZp6}_5U>H3N;Y9~h#fMtF16M|?}pX{O}YmX%tKO%0`Y3Mxpx)L->H+(4y=uEBDFh}n5SpHyu z2U8B-8{ikftOEo5P9bT@plzd&)NX)YDIAD- zz@C5M{6oewQso6Dc#d0Tg*kXh8kQ7k_p&U^KHARi+FaB6-NtB%&N>)e%_og$0(AoN zQl_j#NW;XO4XT`wEbK*Z@;k;gfi*w!Dw7x8BKS_={KN?79T=}WDybIg`|2x=!Rm#_ zisCx6F{V~$K^wmse@G8llo5j5_^($at9YCH5hYi_vWhS$-UqQV(IT5aM8+QG#Ps?Z zW2GNNw0P5#ZwXng^r^B+TXR+0fqC0VYp1G_l=b`LVV?vG`u~}mvs>w)%(>n|b)tW{ zX^quLYY+?uBG(^~1_L=0$As&xjJeQCV{^?xI5{>GejQFGWWrV9WET%vIGnuZA^U8v zu=9|p_b#dK5LmVmiVgv7r-iR{>HORT|aGlv!F!q$QwPh13^qz9hB%=OQMJ zNGI3y3Bu#Gx@RP4tf(|%saZC8rOMiyerKiX)xp)3s!=cc_y)Pl113KkVO68n&8=*z zR-M}k+Dl4khn#_Mq>^!!K`i@ysZ=1WFx&=Biz;g>7%KY!b zaS||$74n7jJCLf!9?*}FD%Tohy7}V7W};2ZxMW2hy`J5%N&>!}BL{jw&6L7NT3|`- zc_}A}NeB5YZArX^a@zMQM(Zm!gbYkmvrCj+~aj=nuk$xBqNzj2*;12=aNWWADErs4>R^w-A@Vz^Q+t`-}caQ8OjJwG>ffabg zy|&v4yrf+vn+c7Vzx*3R-xaI3qvE9?x24;5<<7+R`HOJzvIi$5H7k1uCi8Ar(oU*R zzq;0f2eRtCY_-OE$lj){bcHT;-nbuynws@h$XIi~!>`r|D7y351KyUGRWD@B=Vg5p zG5}}Cu?_(1>^RT?Tyg&Ls{=sk_ze1S%yfK4{Wz*RT6zvIi|)*iGOF{k#!cHY<(*DD zNMGGuH^wN)%jynCK9OgpYa-uCm9)Uu-bn?wzzf`C*T)!5?y=URjF0ZIqoa)8zB}{a z&Fj$psGWHF6vAmmCb`>;w{_&h48q`-3_kUk!IBI*q_8*zm+SkO<)4{V$d;B`-kUgk z^;EHg<1|i6bz@gfh+bN^Chxjt>{`^FiV(dLqE3!o*wTy(kXLY0L`R$@*+1Wwd9P%n3b( zPmpwvtN-}#8L^h;3>-i)6#n*gL{c7A8Su<0k7^8f;n^OFVklb6T~Q22^DZeGD4=bQ z%P8Jc5TB4~0;CmFrEW`|I3F9}>lp6ns4Ww)FLuI5_JlN*V`+8S(M0BPoMoSZmZ_l+ zOG>h5Ps@p$3A^Nv#4cm+4Ay7;_>!e@< z&qfI$*Q!T93S~CwHJ&&y(WIw!^1wu^9`E=8#gBTt69>|p^%QgtH1$ie0<9d^UQ5lX z#wvzj#trp&S4gqLc*~)8iee>sW|u@c*hw}-zcF#QRj7U=V|U85*P}!G6KA~~W%u)Y zTCz|F#ih?JgOBt4&cvo)blkZirCN|R*C(y<@IX^nU)E+?R_BZqv0)c+=7wXT9xpmH zcC{&Mv`=P&Bo#b$<4c7e&pR}BCdD%L-4W@0X~mwtzXLqKEY3(R=){hOo@vzC+w}1? zJ!O}?*Ab_bT`5x}^~ z2ome#>nK4;VRJ0)BNXnZNR`Z9K1Ea%S0&s&ApacNUCK3LTyGX=t3qwq0>+h#gFJTT}XN}y3tI#aZ~|t*w^HG z%`y6d<2EH$^p|DbJsCyZK9t9`FSHAeOO)8xPwq?{JR;4K6Bl>>J@qncxlU?Gb9b=r z=`=%apT7%kn`!$56}<2L%aU+UX4GL{y4$r!5dn_NWT|k?J@QkYk75EGuj$5iezcU2 zIP8>hl-c=7IXu8|i!2qWxhH2ukDdWDc$;e3p>5f|KSJKpDB?&lX;;eB^+#K=S?N_W z=`ph6!m{_9kUO-M(>|-0zpVC4JyViW=}-=*I^tiy7v)+K%cbU;vg$9zCO2h$z7#vJ zv|DCOQF>F$N25b|c_^zgN}3jZ)T#8L zbtzBpUG}O>syoz z$M25u3WlD)cf##^$F8JVzc1w)T1CS5jpyNky@3;W`j@!rYQ$F%j|`dGbisV=|RH<^|{y0dz>q-{H- zGTlR#|yO?2@&*&Q8|{&wB{XY$m=?o#4cPi$a=&GAIZHcqklg!1oyB-IY-581p?2{ zdD$!IU+?&!>ZD3Mqhi*Yu_q+R@+Ri#v7&Anz23GDu}Z4MD=KC*5U@Sx4JfDIn43eR zZHc`kh?yH?fbu=u6-BxV*>{7a3!sT8e$(I=K#@wx<&~H}Rsb~(mq9j%eBcYu0JCX7k+1y6)(GbFScBvWCI=(KZ%WvVR$VCeX86G4}5?+gU5W+j}c~;MYPNJ zUUx=?K0%EJGl)skzmDj^e$hbe@yAS_Vb6BC5`WVKM)trj_p$N2Tz@WZA~stf10A%l zBgWvHudy4uJZbhUX=fGDZ8uB2927u@ly=`h;&d>hN(B=^NYTy}L1D%rc#U0An22rwV#K0Y_q_ zEo%1$M12g*$WK{Qw#1Vg5VkR}3zJOM7f&T31C#1 zZzEbY+)q$32Zw-M9M7NGYiah**V=BBH1=Y*VzK{j#tiaeHeNHV_|QHTm+gJZxFIHs zaA(|*mVNaVlElva$tK40P1j=&)Q$s0P7#vM?~06aLR}zZ{%JyfUw1{3d$6N8hJTZo zP-Z!VCq0i!KYSD>-`@F^GBUYW4d8_^$d7vL^e*?ONzChZH{vYJ^h`bGXFc})F1Pa> z-^hh}%s(59cDoz$xjt%CHm2Jq#<7nf)SK~(ohvce12rQX6Kxao{v9{N9M4F5KYZr8 zd>yfYCP`Y3>j^VKLXOLe`R)k1OdX;4H1!Fy*lV79-t=NgJb&h3rX06l&A`$Uc}C`7 zBdoXAnj}j^o+2Y`i0&iUzejN1+a*ovh}~x~2irhl9B<;>byNRFV22+Vh~s4s0x|M? zU+a)Vcr*chwm^CxBM*svq<$Lx&k&&QW0Z}ex(QoMZ|n7#x%puiZN#? zvai%RjdLhcWNe&ZQxVlgU?ke>s9piE4~0FadlOxXZG z3mCiS=)^Q9vD@3&<^o2@9MeLm6g2fGK}$-$l$FgDLY37Xw# z_nU~wL|}CkTjaz5sRtkOJ0WW&-7mPPTY1xzyRm08*y(gg;4XxtT%IdJu_Uw*aF#83 zUI+|2qk8mWMx2R%^n1TSw%j z9m*#ja1JB7#{+vua2rQdy*k1p9oRg=u8GAAZUZi*4BhoKzsqHNLp4jh(t+7?z_yfO zV~&}}%7u6lN&F)gvwj@omwdZ7k4{W|6zeWlvSAr>^qDep#-bujbIR>16M(vh=bi>F zkNPP5I0pOKiIGl|_Py#T{0KlD`9hWjKpcE-*T`^0P&P0`1H>;e+!TP^7H~^FL6)p4 z#k4cWbSKO8k`V4BrIvPw%4j@?wnHUDvjbkwD z*jeM4@c<%=ud#ov%70UEPPg_0Ack|$q*jV0{PZ%CT}O;UwI z=9!Ya_g7$61OWH&nntpkMz#XGA^>9#uR#Rsh;J)^F9vWuyq`1}34A`t(zDuzhJxrF-xC?<9Yvjv6B#oER4M`0?+r zml%T}U5u!hn3$RAmy(i_gY>iIHXXF?t9-|M{OB+4C>d5E2UADXlLSVw^17^Bx3cbi zF@1u6t;fM3UT<1`U!OyKGK<~D^XD%M)BY`geA(_Q6Lo*8`=+Mzk^1U%#L@0oily;q z8Pi3kmvw4_2j1)@EMvOk;UC`7cZ*=Q9!nw45WOFlF%>D8k!8%Mlo*3Sj*$pH=SLM- z(h@wuADkpWW0fWTES%NZq@wfmL26DD=ExAkN8tEw2>INEA^d<3?}OTZz!Uy~_}>EN zf1rGMkcl)A-81>#Q8i$u7+_j~s%SF$i5VhEPg0?ex<-mAn>-kLj_LQKGd>1et+6|A z)7MOkBBnV%^@t+oIGqbj<|jBm4T-u>b5bgu&QEbV=a~?jqxOOLw#w!_~@ zb5VLawqNOj5B~$lcfo7-!B4sjnE=BSbDz6zlO{G54VEfZc2XvXH#*2e0WCx*Mt{hH}>J`;$X%+nu$i^ z`ExbhIXz%(6$q+eX9&OUOd+O8@E&tI)?*swug0m(n!W!~0V^c92|Z}=5^&|9eSJ)0 zWeG1C7jS+a-C3)tYZ#4nh)PWYQ|*%A5nxRHB@hIoZ9bxzuz;^k3H*5$jdqVpT>@i% zUILEkXuqh`_)-uPB&%L8wHID%0X61!{wW3s$COzLJ(KO7G{ZPTChGK16mD2R)fj3# z(y`INQ6*~#_ot|IY!dLOj5R<;x91e20m%wzN52A!@}#+3Qk7Tfg}I&gPN`_p(pTwa zv7RdS^RYGi;Q)P_)=?zlFuV(t_Jfm_&M{4yla}C=hUcXH;*^%oNqfdm*r5kmmK@l_ zb*)RX8}AV7QCW6~HS3aoQFa3fa|L!f*>{L3dhm`AA^I+`$-34Cv-YRU-MTOVZwCf@x>uSn% zk*2KX7)dYRTBFxrpB)JUDjw)dCkq?!dty4p5WOs~# z-5-PleejM++Wic=1NOpI<7mZ)6MmoJOQtSEg_vlQbioWdF+&rT*Wl#g^e1@C=y3W= zJZ3AvC9oQ;WVjF!190kC~^nkJ1Y>L zEL(by_`iaH3|iw1@lAbDPG7p05Jh>pM8#t@EtKtUA_h%_)9AGSrDYXj#EO5JiJ^*X zDolx~m7bCux5`jQ>2%@ZX-?DwLnoyE~JB|v}FtEnXTTC8Rlw6&7N2nR)4)k5BbM9 z$WDkWNc6md^~9F2Pzn;1T0Swu7-g_7V`MU9s~;nGjEmCgiyjlU{I2Sy-Cw5CiLc3j ze9a=iOp^0^2I2z&3>6}b`T>sdHKmVJP4l;;Id5ekE|)QBtjqVB;9u{pH(IBf=NnKY z)-2zk!#dSAzrV>k)g)h{-FjZa$lOj6fiN1il|)DwDcDOQ#Ej}GxRg6KShQtGy z#QzFQ!ZzKTh)n9V$=_i4L(I!8jlI0*BQ94F@rk}>>0iqTnyt_>m6<_0&g#L7IqD32NozG`2$R%!+T+Wi1 zfhZoO71m3Ga$tV2x;%Y(M?cMq1Jh{i;_wpQZfa$BLlvDJK0|@}>C|J; zGre>{3e-=3I|ha5rTdQ2YwM@~7^CmjOXsFQ{q(_2Fk7MC*dgYJvCHp6DoL|Zd+AIu zv(QRTtieQNTc=UcR+HT|iz2>OyKDAEd~J5AsG^Zg@Dmrpi5?J|C0l5mYE;x;#_s%1 zlwJ&M<)Rl{2yZd4vK8$WHBm67%XT5W(*uC4ngU~#WzkkSJA1lloERAILa5dQ%(DEx z7^7^93>txXQIn!sc!{Km>kPa^+yq9!rA^+=!QBxiq2AZz--+`2T$4{1jZmb0-5yimyqT2v=|%q=^oX(uMY=O?ZGKTnPDJF(g?Rymi-| zteT*5bd|wGojKC9$kSGwOWGu;oWmfE6535C+?PiBN+oIXsEorPU6fyuZr)sY2Jx&h zeO-}mahj0L3*Pf~*-OHJ8fyM&1Mh9Df(zg?<(}*@fII;=caUOMY@_9 z!W&+&viI_zB&uQ?ZVRDjE$KhZFn$fP1$w9jbCpt1x_4oz9%|X#+zk34dEhplu7WJ|EUZyU(7D4^o5DYc_>}r%ira!ocuv!k-V|91C$dZy1AJL0O{}vRQk= zuNJ;%y*xjF`EN6=1op|kvcC*=%Un$S3)oi?(e@j&!<(l58$#E^K? zvo^t>&Ge2#yY8jec(-A_a%v*lI{n}Jq1(_0!jx=q7s4*zAYCI52_uY{#t-RMyr6hR zae75sV{h|!KG)dI#cdR5!+#TY7%`(ympdVV&R0L@7;KBRauYzbC{HY9VK5he>j5G? zbdAMnLf({Y=pXmCBdEAYKpZ}+w7Dr1re5& zeB~_cl@?Evu;Fd8vw|hol?HpXPshaN)G@J#1gaG5^R{2xEGMJlrRtcYLjoiP>(N$& z7hJQg-1>Hw2sO#xr~H-8}KD>8by$M!im?4k6_RH56%&$D({7&n$0*bT{Q0^|SUDV5u=Sb4IV>&a zD~2k?ug)B`W%RThJ6(`ChbZ}nFj1g;s!r%n!a!1L&;{6uf&d@(6E(s{5+*36#-RY) zSKv8;SUW_hD$qgH2(w9;5t}qYUNF8v?5#H^`%IBUt1T-0L(N4{^rk}LY7nsOMd+Ra ze{B$rXrO=ZV-hqg<=*jdBDkf~q%^zH7Kth~7{8@ERnk9xt7N<+z?;?7%d}Yms>Yjc z_5pOrn|}C#!hK4dGu527%egSHsqHc(46JG|&kF-%+RJOgU7gy6-mDDXrrl%EZUr%u z4bT!r&;v33Q|T2d!16YsSp_)XCXA{8IN`#MN64=al+8reN=#g*Z|JsaSp~#lcbHrb z`Kj8p*4wm@fpImLOjmbIk0@W;^_8E;VZYjCg%@MbTJ(-{FeHczE(dckK-f_QPkczH z4yL116xZ2dZ&VZ)*=0BNGVh)dDw!%XXxAs!S!MZVbT(M6x9StCt=60MiM3W%ff;CY zZ4F5(I;!?pSO(g!w&qd_2rsBvl>(j?`2Cdvf(rZ&qyXOn<6TzM+hR+bV8$duT4;2o zQI?hT+EY{52t9-+eJ8Zby`ZMqE;T%_rreG=Q^r@y+1MaD+#$I(Q4|nmliF-+b?gNU z2Nmv4VSa2Aa((EhCH2S+;0Q^=XCL}s!HBmVf`4~Vu2DM3uUhM*WUOOx&5kN2I!A9V z7?jnLras5g7%WQDA?Q9{$ak5Hb;>aA5agOHOe9xeCyN6jEr<&y=1~@?YMb@i^_KLU zIgXKC^P>n0VuQ}-IgS95W!5NMHxy+x4%dCIYc&PuiqM^KC6nU)N&q5>O=t(EbltpY zMzYu2LSb4G;cihsE&1%Lxatn9j%=#z*MRjGg$_n|bFnd~}wd$mvW!EfU z2Uh$E$zh}*rqsTnBKs3CVc?}9 z(V1hqqFfX6IdS(Wy9w9IFhDt^5`K7JXot=DKx}xI&AI(kz>J9Qd3w#V2B4SsD=H6r z>QY$yAocKd&6fwn%h$g=$dP8slebDD&A5*vqW2pJiM#aS)Oth5;B9I`_bz=iO7#2n{Hdl4VG9ljpuvd9dY9ZLsmUi;MgvFtLs^Dy?;F*UI9fzU2M%ZDSJoP(h_ zLfSc46i4Vk2Or`Hug}3wIKACVsxei<>^V4Q7tyoB`Ms?)(FZ2qTH5ak8@YU7H7lVT zZa6V2q5Ir$Vn(7j#88O|;_OZ5-p612g1~;9-dqZ(ojE;6lQkf`Wb6D5`j6J~NeU>3 zj1u-?sY@2mu>t)S5an&4g=iQDd9oNpe&VZJ7Z49jz+O7J)L5jR#{XL9_!FKV@Em+U z4^i5Ri8V~KtHg#FPponT7>f0@VxqCK5v5q;bi55X@XLWG2gBzYm(otRv^E>?lXrfe zrC4{ptj32ZE~m9w;b(X*b00R-ZY~8+wi8DN)q1FW_cQko*vROG5d{Eu6PLYBrIYRO zI|$Iq{utbX6&b7wYr%$8FRTRtr;b`PQYChtTyr;dtsOIGZo1nzT29>LN>udpVQFNN z;j4=ha9kU|;ePSjp_?gMx~s}B4vpxldJ>0SN8u{?smO0)_f)}7Iy^;N>}zjgvsA(B zI^4~{bia}n4tChtuX`x9n!H$IcpD5Qq{#J82>lgsvux5&4QX{4mg@Su7i-%BD(K-o z+GRDk?z1*0Wn2oT7k;GBKQ76o zi6?%wA%?_$^l9h}i*;D_1~$24BU&g2RW7Do*r&WFYvY0l&0(ZhN@w7^k6|hBJx{H< z>i~Wtwk-@4DnfvI%l9=bEbmRmak-3W0 z5D1bz4nqUxCwo{PV$l~-j2{Hp4_3I2)Dde#GJKIJWTul62@BU4LN4Ek78xR*rgmny ztwrh*Gu$jMQ_+Z_s)ZX}y15R0S{U|Xhg~g zb^rQNLjqy%#YKLF4gKms5X7AQj?GG;eQ(YSQ@hD!>1BET3cF^E8`S{~WN;@_np*pb zKc)WKd1wBX`fKZLIWFbiGF{bbi_PFwsHZo69NV@{Wf=dlp1ww(u{KJqSM;{T+2^Dv z#?2@(gp}ge#bzb4y(y;tU;TvzAqSTjwwTV*nyr&(7xVsV;m0rno5 z2PK^mF&{UL06b%?Sqj}3Z)91NX=>AG)wU5pw#G&4fJGH~lBW*DaNn7DSGiq-X@yG} z5>!CoO@>Vs&`x0N06*qSV5}EEra3Tnh946f7)#AhwX1@A!vt)q;C?UxJu0}y9?;Sz zgWPpCB_G)Ubz%3$A60uYz}&-F{uHR#7sfaNHdAxnWKH3cFACp>z`uXT#%nhCW;k>W zd8xUqoi-)CWw43zUJ}4X=S?+sqbMjd?w|*Zza6WbLO*>w7N0Vu^u6kzFJPABFtem! zhujKzOk9`Yd;U1}S%L#)&)+b|Wj_M8%VY65m{=P|aaHg@1J7t6U3deJLNHyCx7^k` zJ9hLLk<{`Nxc~*eY2!vjK%%^iwYk@v=e#XX|HB>y;krdYGYz~!YBz{ej5K-I&~Fz? z+I-%A)VQHL>&!*|1dn*@KzNJUdKjB!Nav@(4bu=sj5}MBKB3*;It;(XEIf=YKiXHp zMT>w3DclhOe+`UHE(SdejD27To!np;&SMSu&Ap-~v{ou75vhkXb+bH8Lw_2q+7a!# zm*cQ+f+#mYFhjjfOZjM^MbGCFO2#-EZ&$qVQV z^t@{9q>wJD!r`AZ2sd|I;^Za#Ygg47C#D&KtGB0(0JLizx@xIbnHe|pI7Z0Cs%@+2!zyK!Ck%H zxKU0JTMJ{0-8IuK8NLVrb@GD3d@!Dw%k{#TNPhA0JcG)j)L~N^Op!&c4)(+bo-b`X zJ+Y$Fbiz@dmM8gFn0elHAap~B#Ql8uD&@jG0n;DHKx4;lpysUPLiUz3Sm&s##*a5?a3=wUZKROIFVc_i)F5&iDYoXtf+d{ycVC;l6^z{^DpFQiJixJ}S|FB1H zv6s@&=@gzvt{B~>{JaLc z0LJ~y0LOR88${es{ilyBvjA~-$V-IZ$9BkIhemKwjwf`EQC9Y1b$aCgq?vII~4eKIS)va$OW_LmLcS-8GsXyWvrwN zujD$j<2Yz_96$Yn{=n3w!y7x(!B*GdqO_;V zyUJC>ObeNn31A)%>8|pbx&#?etBSuGjNlv(S;HriU-*tA=NJk|N#NTkoSDNEWJ;*&~ zs-8~{3j&~mx3Ni4*AgG{oRQ#MdGcEqG4Op8+(%8?8jah0=P}q-6I`7l2zt&yKX=V} zS56{IE0s^)^SM^4J44*;wGx-ilOpW89BxYyoNf|(=tIYWE=mILaE?a;V19bZQL+)SmY9E>f{A_!n<68)?A)tYQ!qbY z!e}Ujy}R#03MT#~>@WqRRLw=Mhr7JNXE%Un5+uyqCI9wVc|Ny6UU#cr@&fi96SREj z1FG*w*t`&eEyaO-^(Bg!ra}fBN2}m2@%V2Jz!_`8G7hsP1XIURt+FO0;i!&T6Ewmu zjT0hpn3a%(B^;(YBq4s6wrEkZs7+8;?YrZVs={ooB`FymnT3xH1|9ZE1hortS-JYI z@dM`;5|7#h5r$Qn|0=K|U5*Pa7!oL9d6zDhxppnW0vVWzKMDpviL=?FoB_id@q58w zZXN6Xv$yDfx(OUntn-M3uTiYd{4Uk&hL~>!67{49sK_*Yg(g%@$7+lG7Q2T?AZbDm z+!LUYz+yGb|AK0_8YX^;`Qap~a0{7+5w+i^=xEhD}L|=RvEt-at9TO!T)KaQt!$StHkc#OL!OtRu{4M zoDt{J{OLGmclA-tc!x!5$p7w>?SRP#Fp(p=8pE2klUnSy2TYDE(J2ZOCrhlU;~n?& zz*$dVEhGtD&EJc?dEmFj)&^WG0okrUm2a-84CH&3&TvxNvyPrWUAmCXTmTQa*{!-HBRd?ev0|&UhQO%8vX|VMh2L=4_nfx^8Jj@W(GxM*pyw~L0LIgFHr+} zpYaRKpd|}yg9{YVKmGn{9EMaX(X7GFVDD1Bq1AO_2HVtR$4=)TYXOc;_#>-$%j2#Mkdnsxlw zh~5ZIxW9yXrUgRNzOQKQc~T5_%fUYin^8%?k=bv}Is0zpVU9jXxL)MJe>(l#kHUne+@B*u&(tZC zYM6@h@FhgrdB`l-V?J3Yd?vHr@~N}DknZ}cop4BIt@EiFKa>W3^TT?`LY+AIPR4SQ!+o0>UM9 z&!X}DDd6Q}o3ay2Vps>hCl(4LLtnI_9Eudhmb@$kUX`#qoFPNn!y4}c@{g!Q)=OgYS77>u`(gc;KD z)LS1I(7kW4_RMBK@M;)W73G@r_H{Q#HqR`Me?t4U;6FczF2FldqKdx55uIpxpx1ncVCK8jjU)L}uvsd{sn=cffhjut57Ka&I!_KIe$5)1oDl&cH? zK1{JTFzcExfYF<#?)fJKin&L8b8Mko%&SrQNTuc_gQs20tq`okeJb8Npqg) zCGG?}!L`ut#TP7z>Q25Rc5_}o9iYZ7l10{3ZVmT~h1PcJExn*Td0)p}p@n)}3;xRxxUJIKlR_NWB(xpv z&sp>9>9?1|^i_|KP^vN@Z6EPDPJ zR*K*fs9P(zLn9evlzKvwaLI1k@kE9x0eM)2mzTJ^Xak$E1g+Y@)Ga|nHn0y>v|c_| zp17O0&}SW)Qx-U*u*dz?dp&XP53V#n+LIH!m@X=$=2F8CZ6PJWcbHy$Ho1^!fc9k+ zZUt>wrM3vwhxp77xG0En-vPfUlh>5L ziqPAa)4+^Ev2cv*?r!brE9^koA$2dMgGU!%2iuj$#phWtUVLTPgI5d7`d-)BoUR;m zFGTcZaBSPvxa|=neP{36xJ-R(-A;Z7R&{i;ALk8O-Ck%QovfhNt{=7E4YQBUOMVpr zmOC$M*iMX(aP^tb33dyP-4USvl(Xq}7euaq93gXu&=koe&5)zWQhVO0Za**++FxIg zWAneZ9+d`>uY6yZdUJHP^bYvj(O&(top~25B8GV~tkeN6rxSl@bAIyHsy-PqYO+Z_ zxb90D{q7a#qgl30c?H1Ek#o3y2QTi8Ud7G3@Kunce88n3;h#&`Esomaov zGRG$_4lU=T^7Kqe5#yVuWhU3x;3Q#H72nXgO4U_ssh`t=tdETK4v0#U)xficsiW> zOJ9i<_&3b*E@@lyH~kAz+=WE;?1yTbBZ>a0#lKSHJS~#K_0N9HcJ`MRAC5I&;quzA z4GWEUb==B5o1?Hl+@4I4Xvm&H_lOgo< z*ZYYC%CLhU_+Lp+IkCF-If`aJ?EBDb+RLfxkKICY#w;oOVhwP00=Vkw6 z&M)(rxZP*X^ka&p!+*U(s2yJ&?Ox>d;jhYzZ#tI;4|~$GXMDq8%U&$I-#m^WTepJ@ zHiE81q?}FgR|}8Xy>0nj?FGypjf=nAVr*3xp|v?$V!~o^Ly`SIWEF4e*kGHc3jKog zb)$aJN54r{KBpvEce;U`UU1vxY-YVURS)aw@0% z?VX`h$V0t*-g{6a>0TZGf6i^LlT5#^9MGZmKIP>Mdu%ubiEN$f?Tnsy>F3zId(Qkh za{(V2XRDB+&YfdeMa%X4*U%?gei11u?Y!*t?QAu3gT4Y6haDyzPj6GIs%2yM-7vyX zQ2%LA#r9NFJ>}`y@>IRV2JGrig;i7B&g%5Wvq_8A2%mY$u<{7+shgdr3FNKEVVA_4 z*j3KR`uk-=dC4*vQqVkJ+5Rd9KHodt!;vb2jv>Z;C{kVClEMOEoy+zb3$AwY#ev&} zLH3IJ!NnJ$Bh3F><&S;u=r!csr%CV^GLndM{>er2M{U#1ur4XYNyYj-=5 zIyU#P_QuWN$9yY&8g59Y-q69Jf0@r~=+bX#)n0h;p)SM6>;DzaH3)}4Dj``hBx-7M zws?gZ*fX5u9oHf;J*|?}t3&@qoKNTDUljBV$@l+o(f0m$(!up=7uvJ9yzf-)-y&F# z9-Z>E@w8=dZk;c_J~HOF?U~u4<*0a%r(l5m*Acy#5!roz{OrULEsufy>k;bwEA8gw z_-ao7TWEmJnyMERb)KL1m3BFmIMa9Yk69InE8O>y-O=@9R_yV8O>x1a$1K&w-q34f zyaP`AtmqBAyY&<++VOgM7!;|JqJW-rxy~%8|ANGM>6tvgut9shioN%J59Lv*4vW0% zY>_0`IP{Vamp$v})%KE3OLcmdkHrgjY){8)A?s}c?)Q8fi%F3GceHK zW|Dik+6BE=^HB`U_xGo_^{rvjN;1N-Y?G^p-PAFa{rCgaMFP#4eOA)d;byuf3nj&F zJNZqgqa41tE0eo!ErR)WRxTN0K?9B%;&Q(Un5ET>UIpestr!2sR<`gJZyv{8!B?It z%MNI{_3sEC^Sx;~tn!LeX}A^2JT#R{{Flz(7j)fGXSer%UIVRj^(poIREcfZkJ^;g zwei~Lv(#}{tU8WsZ+{!rk~tv!ZJsV{k^_kE&PQ(CIp4k9O3cYq-S=vmVr71Eu3`p%eE!Wnb%U_TfhEX*WW8ZOqvjn>+{2@BP;^O&imjbSGd~I*-6)V90Na7o;1S2}PTWE15HK+sg967TG>;{Pi)% z;)CUV_53yJ?JiGtl7&<`d)mWMYGbDy=ru1*@gf~;sg?cF@bQaBuH@vuAG%jms3MEv zmY3?-v?I~GiFdtD*+s6{Ue%1dW~4dcG8|y*VPV{)%BOe_+M8Vc5PIk5?6dY)Wyk-% zeLeiL_I`GySn;a+IPZ>R|HQ@XEH1azg`c3#ma(C|SD{jx{jYPB=U%7!eEWE3?^T|1 z^?u+7pG}1^bMK1n#-^6V2z{pxb^8Y&&jsk%FY!aOG3RD>dU2(zy~L!MD5by7ZmU zs}i<|>Xd_3;Bgl!Ow>Hx7oKXmOpPHG=>EJ@H`1^5+8So+*zOC1#J^Md&*jh6IUKAN z^B4Cfx!YZj6!;;g;Yf>wsk%|z3j*^>sNm6D#oy-M)`=)C)FBYywaZ+Ykkb2sE$-?L z^F?Ap33HAOU*MbPa(mCZVt{VPdygvarE_k>*_bZ=mh>~ec{^CBF)lE8XrnSCR<;Jrh416j`J#@!?y3; zOx=sm6I4Rjl_h^q_@Q&9An)FkX*bIY@>^wc^%8cU7Jc#7Dodx=PeF5a;E!!s+bS)3 zgH5x=@#g-E9IAiY?AL5qu426|>-evZM1`i>#rc;my;mmpe~5RkpN>np!gqdgpxuq0 zny$!Q`M%<`LEBk7G{n@u%UF@U!}xCKYLx1uPXbVbt^Ha@VFf8>8SnjUAOAczkxG7j z#}8CtZcElBk>7aWna@YHr~4Cto+)d)G&kZtdK&LcnLP zZ54t3Q!Bk&n)u(?z3!181uuRMZh;LZMB$v=`m_il}lm3ev-8Ie6KUp4DggJCNYme(j%0KMASuQNL9qj@~8qdNZh zq_n9uM^>L!YVx?hxns(782jV_%h?l6p1%*!Ma6O~E$98}Zb}WGDxu=4|3#%h{>M46 zO}{W#5S?~EdOdW2d&Yx#dBo|(0fjmf2&M4%^_|8XWgGpM59SM)^-skBS?8ZR(`}wY(%# zm69x(pPE5}slPjk7{0-U4faJh8}d)6GOfdd!|sK-@Q|<5Ge|QToV(m|wN~HkFv=8N zvV{9Sc(J#?o7Etw@L$wj_k6YHEDa}e4^@FaRlq?*lf9ArkYJJg+v~60g&*{m=dVb^64i0=x*d;J&-)k4~bRwW};qGsQfW;h?{u z>237j^STXZtk?DO8{F<$Ivx)o?{B)_xX54_(IL8ewn}rC*s*4QcDbt%8F_E_seG%C z+T!WPvy{Hsr4un!W58&`il?xrtk6$yRapr-q)OJJ zDzkg`Z0=Qrpvq8a2b~fdl_!9(cQGjb4^_x>6hFQ8P0G`r+8#W~N@aBUhdX!Uo9gz7 z(y1A*2gtG^M1@JZekk>xuSp=Ilwn zpVf2qvIpeqhc{r1I5e28cG*y2>Qz<8`hPu+v9ge_{QG_ zPWjef(zv?z4_nMpP6FLe<~rQ#t?4GnzAwn*ot{$66s+^4I(nihu$PoV&H8rLy*_s_ zg{I~$HJ`?sr*`mtwQ{0)Ev=mK9o3K=JlRfpf?0i=#2zEDsR$brU z*`DSJv$}VK^-Gk=l_k<@%;9| z{bAMZ+x((;CZW;mDq%b7M(RUd?48f=DjDAE9#1G9g8tSNeX;uAS_oS(6-qhfT{zWz zu1=rQRm6K8|6JtdAou%$yiE{%^S{piY{gJ-RmI6E4x5N8e?F*>1yiN^FFy8WqLhZa zLNH_?R?Fuz_0Hsu`n~qoZ$1uK9UZREXc^9)o2h}?=w>E{zP9;$=(WTv3Dyk$cl?#X>=wfkk}`{K zJa!^zQ=O$(Sq?eVlUVnXKL0#NU4&}J4U%7VG5y$6E3IR4H6@Q$K92*tgw^1DKVv5o z738u1Hk5UKkk-H{dfJ_A$sd$*w}qq%bswUw3TfW)v}+ANPH{ZCKnh3c`zIcgGF!_v zUriicW^O-}kvzu#*=baCT~(K9YT)QtRq2Q@h1-)YAM*E)s82-Ztf z9d9=&N3NY$zKtebbb69!G^AIZv8tM#-^XJHtX(xi#q!1;Lm)B~0;Zamx)V3IB1R^?t(iQ2LKNb31{ey^lt*=7f9=)#Qq=~f(R)WS+x`iLSF>M6mrP8zMiMb%Mp*s&!@qIgn+e9=Wdnu`9GG9Lnh zl^l8VU72nOD0B2S-pY=;x!drxV)sp`SgQXI&)HY6$r*#CDX$-a|7Sk5P=_LKn!+6d zxsI0~?%MPJ)bUc{Kv=3LG_3B}tBm2EYI6LI_`!WyOr>S-r;Q-z(0#Jy$;|2*8u@vn z^u6f!f_~}8QN_8CMyZ^`w@ue=+|$@v{DfU6JrW*KizQHJzaF%5u$@(~DVk7_F+ThWK&uJI+k3)%g(?JJq!C@#3H7=l{YZupDFXF5pT5VMSiVHy(XEL zRQOT#G56lgqe<>Ngx^=0BHvse9h^vu$nDeE-I%x#P}%+R_xX*BU`T4{!xuRF06Vkq zI>8R-n@ZGc9m1U((ic)*aX2YmK}vpqUUIGjufvPCH2s46cjqiT?SIuM`RGg!-hbZm zy#aajEha*Thd_3t;vWO&x5pEd+5XycW|DH9PNOsXS6UVgu=~wda_qa03Dl=YInaa0 z0`qsA1%m5e@;?2h65KoZvgxDt&O;ifu(R_qx#;Y#(OEtfMMKrWt3yEn{;PvlzNr4R zAQ&pZNvYkA{c^^tgd7MXMlSIceO+E)8iuSocL<^q4SlQefKQxJ8otHbJcL_wM-p< zw=3KG?!US3*nlL{$g(d+zdUP8Qxq@ec;laV^gMjrw?(ACr{hClva7+|VV`S`uN$?N zS+sO^U{Q{GL^tPvir01eAqZq;&oWYhcr5UDJVarhtf&^0&6pSgO`%?pYk#HlAuj&^ zIJ)YvsJ^Ga?9z?WwJ0f#bnc3jASDP25`xkp-MfpZNQ2TyHxeSL#PXAFkj^EfyIElO zzI@+*?sJ|qbLY%C_qq3;nKPf6n$U!@mr6e3Ry`C*^qRT#l+H=;y#l}s6_K%i#Ze!} z^bHcdNS~Ua*Xv>_tN-NTYlBw8 z-5p-V!

&>@z76F-rE`GI1Z5Lx5P#;a{i?%;B`Br~$yM><4OztbM~vIP36OxZMG6~WmOL$pL3qi zs|>Q}iGg0RabS>8!#VHzI`;r78Je5!5VSc&NbH1fDcAgCk4P)$up;4eYJD+TYL%_B z+W*Gl@NDavekk~{oHAPjujCvE3ly}3yn5An2E%8))fNBW2Q?|?(mb2@x3E#}3Wwf( zRV~%~Pqb7iZ(*nDF?o4;&k7@n8IqEDmG}yi>R(j9@hrgIN9GptjKam=kCfnPy?4oR9Cn_#$*D{#)Ko9@th z8E#;0=trXu{A^)Gj=u^bco3^H6tIK3YT}No@#7dl_+5Hbj?I$F4jB)fmP3O5^fx`I zM$caFQA^fQr~aDLK)&&){P>>c-m)qej?;_d=Lw+7wZ_?Ac|V#1r!4m8AklCg6 zoeA7~q4m&s$Ao$>-#gnLOTz>nyl|-ZE49MTFC-4FoqlZVQNEjN6A&vZ?L$-6!1D$? zB)Hn@JnKEL(O6L2Iog*O_BOyUo{Z9zIORFB5cya4tqa<_T9d2Xo&;hxn@Lmm zQ%QZukB&~alWjkA1#RMDEHV3ayWedn-Zn|QJ{-1Fe0c507=Osktr2!6W=i?NqfYp@ zX=8KsWwtOEzI!F@U=aKb#)x|}@v?0`j!*S@lz&EKwe+j`MF%U^6N@MeYH^UH26ehm zri|BzwhsmloNI`ReeDBggt@S{6 z<|`UbTzDiqGta`ID6k%Ubjvx< z+*pA-@SgV*?{Lo$r`9BHm2l#Eel#uDT*m33N;hh27F-7<)0+u<{4JZqhb+JaUQ)Aq z^9`ul4gS+tM3b>u-{IX4_smfj0k&e(nNjU#{uw8<6pEHGdNt5nhn($?Hh6RmeWS?|(RddhNOg1;5>=AOM+XZ^W<_xJhj{_Sb2 z%O?C4XN05B=V9W%#2wYzy~NK*I$FM^QSm&fy>a2P%u9L$(Tgxipc-fq{_9i|>KHMZ zMI~^jf}f2!$suf}EnbbSpZLm((Wi0CC1+!e>>koRit#qnpzC~~_03v@0YkYjUbS~9 z``4m^9(Jc<)%fRagWSSa_tDD|uTor0hh|*=?=0fF3xAcaSKG`- z!B3r=)mORyM>U|i%socc(YIq26t|JzQBmof6-VCCXD+2OyRe5(Oq!P zIo$nC(?U`S>LLH1Ha$It-AZ?$>hkcsj&Rfe##H!!YAbuvt=!X%5?js)8s2U}q}_jV zZM-I=+fNb_zaKNk(CAkxtS4Lw^b>vIRVk~zrEdQ}b+q(|F(z*LmCpe8k;GSu08M=lwJ{N+`d{ZFgFJ@J=X zGbOFvCkej{EhOLL{PO$EjjsI|Mqe*m7S2mRT;Bsahz3z z_w9a?JQ^){9`H^`yld1U!`3`>)HLSOxfl8bE4|k>q!T(b)p2dSQrLFt{1=OSAbvIr z9s+b87$scjtrf!OtuI@~ZYSz?AP!su#Et}(`<8R`h5>qf+l7Guw)o3W zue&9umMzw&r(7UKi?pt7Zq&se5jDmd{FdY|QgXe`Ejey%w;fT5<;aF7hk0_H-OWqE;2I%uB_+IPB> z%-faZSvVizd^dg%emwF4mC7Ldi^$%)4phMGknEJ2$NR@W2<;=iZrW%-J292`Hk{NQcF* zhp9nm$@Sq{oM%wj8bA-mqBCg4iK&94oppmLuUrD}iJxCb7^Dr>kT5CMZ#ln5pc`qm z{GC&2Hd0T z6roNLjA$cVr8O{5W~^O1kO}{&){h}eMDwnvCG8TXW75SBW0~=5dO1J^83Rn?t3>SC zHaG`;?F&{$j@ZyG+@EB`wfOPV0_Pth(Z%S4=TK{0@j=|@RjInWo2+!JmFs@sOm3L~ zbH%6Th+|P}&yF5PnTtCOpQ7;x;N!)Fm26*vnSkmJ$Dr zvqZza76+xF17gA3*YXwNxZ09Lla?#@ow!1Ec#>3Xk~+K-?7u4j-p)IedqF4_zMOz? ze&)>09;cA)5j4K>;bub_ex_(M;M~QTbHkwF?dqwK(iFo{pI^6cg8@_;|b23 zjm!vxU(F3qf%HhAnj|%-TTXJY`uN?Y(tcrv&y&GjOb{y1Z_ww_T-qXpzSTM3zKNA1 zC1a0S?!GXv`q28&BBN0yd1L-xV>*SA-38E(+P$EJ-pz=BPl*B{=>8glb|Y*yTJKv3we zM3|U#Z1~x5owqW7e$+WQOJX(HGb+p&wLnCa;Dn=FhC&C^nlxwty6jknWkEHZE>i)1!k<< zx0d-fH{(6)tfvf+OwEqwL#$2C#bB)7J zA7N1E+WhOb9FR|)JV%Q5qkFq}q`ZNY%Dtr;ZwqSrXts?XLyyVC?8C)KuDbbEdG%^w zeQR)+k%Cdh{@peBvK60dgleT-|Ch=9m>28~EPt`T80cR)^Y4&zt=V#m^~lH=$He7P zEjZ6nb70biP#tLf4^A$tMC|HHS>k&}2Mnl-yIve)GM}VoLFKJ;VUz-f(avd2;8cJ| zb7v|CcZ}l<>{uf{gP`Mx5(zg@i`2$>oOa?8~EPJh_ z;?2RQ!;wM!Xu{1*23LJvR@Xi|%gcFrM!*c5h;-`Me&Y4_pTL^BVI_l(eIp_Bb+Bq% zmXTC?XV#DBO71pQc~Pq4A7_5m>V`xgr}#3&E8BN${KWRxM7er5iWHO7AYT!k2Ga$+ z+NlB)x6*dkoe1U}P|z9W4S$jm9({3>q0zr_wYGfhm5KwL;MhMsArG%xjiM=Zn^=2p zvIWAF6jX?59`9AJD5h9YjpOwD{Qmx^bYJ-)uw6y`bKTYRG)=ffN{yfiu%hA#mVaG( zEgmRMdtE3eV5TSvMMr#zRn~8Y~Kdd77i@rg!MMXNJ(#5z}LDiRW&ZtGP3Xh1E zDUgMgnKw6d#(F#3b_%3y6(^p;pr=FQ>p3hZGkd-#dr;MwkSO7|@`(n1rNR z<8bS4-nS)Bbbbc-SyBwNRc*fv#JAU>;x38iV&CvTUj-_O=vStE65bt6v%RIibLIBe z2d*6rOXR@cI6Qxw=|5S0J?sN78-to;{k#EoP!Ef(USNdr%L+NuTXFtkHu$(5lwPsb zDe@JG_dC~zH^nj;4OS& z6k%xk(`JUn&oUW!2NCzLh5bvA5P7BHN@W@qw#V|wFYmZyiP+k|6qd-hWGp4(tnz6> z#Y46W`fC3#c#T6Wq7SwMP{A<|(FR@xC&W4SX|VCiH6nTHLJpPwiFZW@(cikp!<;R2 zozwOG>I&q{+u%^i-hPs<%~|)0i^8CjnlqcY!REoPn@=1mcfi+3yl_RsA}rY9f@vjwS`a> zObrdQ@?zDLrNmT`E=2n-E;mpw`>#t3Lk+B?^OJupnpJv@AukI6SUH3nucOK3SyU(HefcOR~btd3^q#fz}L7ReV&C zbU;$XYc`00CpZjVhZ;sqwm_K`9{qE-M$4Jj9^_w7{8|Y~ZIZ((H$mH+u5m;E0Nu75 zGQ^yJpb47{ zd|azM==g)={LBfq#+J@wD|c`+Klb^;1n>2CzjqnVRY%B+zrjBJ`j^kIHwIA~Z_xV( zUtFV2k21n%VD7|aUvS&FM{G@CHZ>ngCG?Hk5GlVzaiSQ7d_Xd*e@5XSSV`P1v&gjdfaH_@nfVF1 zJnY#^`6Z=6F&jBEiS_5#rt5b=2eW6mZ8UY7lBwzGTzN;L8lP$9(q4jMoV#g02Ou5}ZVH*w~utFfEcHfAy}f|u1BKmiZ%KU6||@eAO@BCQRK z2s}Y;rxg@)bfgkI-)cRcE7&GJxB+XZ#fne2{7mH*QzdzdN4k4b3 z4AdEPZ5uK3$dthlQ)(UfVu(+*YeVNyqNOdPb11jcmeM(t-qr$k4rRCX>ykXjGElS- zT#}I0Uk)lO*fY3zBSL~)*lh$I{J+u(08?Z&nfVWiHe~gT#(bO4X11Y zeqf>*1jlMmdH6raS8tdLYZVC(_IU5|DU#4Fv>!p3xm0Ekug$t709dpgG9stt zG(G_VOyV`_O_1M&*Y7Gz_vhQZbpxvkFl9{?4w&sJkIjLmoTgDjo&~n+eejCd*^YGo zz=@ox^iU_y-TVXN5WTEKtCCuB8+epo=R&#F_K1 z0mDktI9U6ncpfr-a86Nw%3it8{T=y^W<)c9|1ay*D(i__%lq@{$X26&OcHIKFM3*z zu^qd>1&BN7PuyLOuhl`Iw{cb%4XMMsbU4cr@V3}jmlW^8fQfF0Y@;$%Z3})Res9)8 zx-=;+W~lnr%hf8O3dHY7!JHHFQ9V<0qFSrvsiPq^N(7_!yE<|Df!k~>|12KNAislX zG;Pl@f?U^qhkjfe4HLeXsSGVDpbWqr(s~O=LJo|zIn^@%c3f--O(S(p3}NdLB*PG| zHSEv9y&|kiPNt7sb80%ouJg(LcXR*e4&mm-8$8)V%0!)-7f!%C5gASB;)GD| zX7|=N(@PoOLt}AW-^{RceJA!;_qLkyCs4=0q39UU3gN-<^d%-9fS$-k`0YK7DH?u| zB!a~d+;KbZmrxkci0ALzG)0hx&dHQBJYz$^A-=9Gr;%r#L#+c(p{fU(~VwT%@~!bK^4Uv#ky$vkBT$a=IgTXs64V zV%X6=vGSv8_3IHx+>*tTZ_ByhlEAv`@2TdSTu4%-8A9qr3)Ogm89XL3kVL|h>O>|YXP=r zRn8@?>r75Do6=AI$%*v&k*sZSqU#uwnntTLqV95*5ojMolq>2@ffz1Q>+clND3Ka3 zuA16PxUAde%Rq(k8;^2MIBi?1rN8#4B)sj$k|=47kf`1ahn-TM_DisspSq9YCt;+Q zw-vesn7Hp{y$zuOJ6=TW^o+H^*<)}jcrF8PtA7&zdkmim$rDXJq&4u&wrcC#@Ttyl z-M+Ur>RW~jd>Zwmm3+WCBM?B69zJ)*yJuV{9o!QH)aOby|IqITk#1JV_}50Y*MN>j z>g_qfSFLvuPhZ^35eVwnU1!E9r}hF67c=Yf1|b{RbHxhF-b+ z<#vKKn_y1eumin8ge9d6!{1gkQDtUqA)^zU0{@1-rE8+_W=8{#2*T8gI@qmMxk?A3 zVMBNgCAU-7#p32~l}4(7y;W?cHySs*SXbpC9BYcphB?4!&xT?RQkk4mS@23%=@}(s zJ2Hs=-6Ynv8peW;IS(qlX<;ADp2Z0mys(#t5u%0qk-_vO6T=e>87J9;Yj~zDsG1?$9d$C zEL9roH6X|;>+v~m05~EvIQ;}m)Z_^;c+&?l0hY*ej&+d^)PDoqOFve}T%%u@O4M;` zvE4c7e0c`nj`tT69dT%e{WK0riNlnYlRV@xvrvxb9aY#Sh*R6CAUWopHBdI_8QtV? zZ{`%>e7IuTIb9a>s;B#{%{PXLv%6@D#G6T|Hceb+FR)-__UooxVyJ$~g!%HVRjoE@{xw!R5zb)#}U)k-ayvpjN-m zYopf?gNsV5DhszEqgV;-RBv6pGaIVlBHI7mgUW-4wqnm_X68V~E%x8^C(kd^O^oXS zHdOD$O|F>=--NCYlrd(uwj9eGw>;F^pMI%zowyBo1`~htnTPupSt)Ko(y3y71-X`c zQUqL~urxOsy55Yy3WU6S;L_^1j6%q*YtO2iUiNMN9HEt~$BP(gVf+F~$8Ejdh-dSW zZX1qoAFu@%Q*4>J5tgYOhku&zVEZhe7;vd-YTNa{6J@HMV5Y|OA!q#W@4PK%uT1CU z_v};5h=-_G<{wWXxy4s6!nI>pTwHeIu&k0bES%OU#HSd<(*eeNN?iMI1dU2>+zD;? zak)>Zn9@7_H>AF;D$XsW`W}`SNoEXN-&?G#m)lR#?%Xi=LM_ag zu07_X&UaqKp)d^xrL8cd%=24Fq%462@X$MWp}{8dqfV!SZeq$GKI>g8{79k#T3NFK zR=aaJ^zD->CYHUW-m`ylQp6Rzmr+%>^zES9AO{=pI|KDoAD4U7dBgE(-z?7KXw+lc zR;BtwV#yhh4hnXhrsvI^p7?iDzuB(qMqGrZ9|lYA>nh2y;E|F`*uJVMmz9-@&UEh6 zrKWMa5l6OGJ8S095!$$4AGVRSQv zFW^jYYztOpPy1%xewxjgWA0RyL$vvsjMRru#~f9ein8wZnE6&bvIDIJu?(TIkk+dd zJ}*|1Q*p&aJ(lzaQ)O;|Bf&Nk(TCsI8j-f1Je2jpXIG+6j6~y#(Hc5VMC42vA+NCq z74V}K)H~Cp5LaQKg<;c@{YNLA?Uj|#NR3?1Y~Se>w4!Zy1wMT>G=Lu^@8~8be3kk? z6E0~P>uH+ln+7m%HNonB$2yv!ZIpn(l*$$Uca&hlq!5FgMg7e0^mytDxr(JOkyrbT zpCdLFB`ZPjh2ZBvZzJUD3tii$zn}~*8h=uyn%@yWbqq9_s3WM+0q4HfBY9_jtXHl= zW(T-IoRW#(e2Z4Xi%KmJkBd=}`clbW+$LjiAyG&szTf3rbFHs9(jdk4PkgNb@>mD* zha%IAAp3PvI22opu_cH17)8VHWAQxov^tIaU@F$=t6q&4gMH0~_{C=*ZIe$DVYz3b!+W0U(hKQ zMj0(a!;EUV!jAm!>fQoq2eXd2M zbovhfP4iS|__>o5e}l$OD@}A2>5H>_HPrjkzMja#Yj}4bind1XJR}EESa0d6ixfvs zZJ=o=D=ACPXI|0ezZrY@BZ$8S@Bv^W6E+1{@CNs z*B8d)NZ{vXALAey02Iu-uIPIeZy@>mFdRNuhWeJ0w-ucsd_I;A1%HenaGw95DK)++ zpWFf?47>{|TS$nz_GUSAmgewk>ZDce4muA9nUJWa)t{?0NHag1Gjh}i%Z++=vA!@a z$De(L&)}LU7{jzh65!ZN+u(J6BE z41E`V@n9QxY}mYDw#BJAOQyFM;pw~$)kWdG#fEwANvwO6&m~VV+b84*nZMqhwTO3& z&L`uGWVPA!Be>hIS^k%=28!XDilH4}A@7wft&qW$bZiGu0v~=7RmXFzMbnztkIO13 zfpqWfVrf~yVxO&w1Y*Q+bhLg>T+bGmO{2akdeyw3N$K0%hZ1-d6RY+rxy5C~Hq8mQ zYjtNX@43{^NBf#n#kkKd1Z}D4-$;zK@a0TN{#%y|ubSxOdS6Zy#!)q0r{mLi425vm z6RQSz>ROrT3z}A?Osu=aRfjD-TeU(`dKZ1fh*1I;-Ee&~c(=&c)9=sPvoxk^PWa(h zGX%<_-v;Blf3&2X?Q08bk)#7V{HT*}D7uE;T{MhfWteQ!=e9&>zMc2jNt?*}taJIf z`K;ZAKI+dYyhN?e<6Yg)7l#FNB}r>eQ8l#z6?M9N!%e6!Cy+qbYU=LX#P;G}ta@je zU&c~{58s%MJsGs}s^h84+H^8sK)j!5w6&MZ-LN!d8VPyLB_-OCQ2l`+`M1rB#&hj3 z!F&(6Yt?s(o&oaBGhBPz#@o?3+begb_`ryg;!b5E9;^G?y}kMbPwt4UKHxIUTf6Og zC$$bB$UmcbxU7?Y@dhcLAYnvOR(A|+FHUc&ic$AsVadQbz4*I`qAFL0)kj;4thd}a z6RvR%?zn`0X6^>J&6Y6*kATxT7*U@^X#D-1|H^6L=v0TOy|$`eMyH)N#k=1dyU_ zc=GCQuRdf*m*5`LgH=as-~5u{4M!>b(90Vs@fHc%bn2?9mrnPMX4ZmOH>c@;RQRAD zM{;xcvl`qcKB#dG4!-<12ESQ{JH*4P){a}cZZjT*y2urTJlP}OZXi50`|NvU($Mp@ zZ68>GcNP}8ytx3}ZsQszd?7w}Dq7eak{y&6;KgceyTpN_40~YP1$dQO#y;^C4{H{| z6|dPJ$+ot_m2br=`H08G5;slus8}6Hu3UwT=RocWHF9AhaWdG%?eXt}`7ST&tUV|B znlnm2bEj)F%_MF-B z+_Kr#&&|)Abi6o9%qDoC7_IEEp!r2l=fZV#7*)p6B`>z6#Myq}8N(x+iaW7~?+u|C zOds}zI9%GpcPmlxb3z>vTJmxOU1!1uXrY|zE-B@3Hwqe~a&L9b1=e;(7WJvnjhEKm zan)#r`{U9r6O)ZqgPIF9@JH3THPf@1jrL;L!v=HAn{ zHw@djYwr>$nGzCG`bfhbjgQs@q0)uGHtf=0`<|+dvA8EBcrxRk)7<7wb~yODr#`aJ zmZ=QKCVf)YRQ@{4UKG$(@tVKB>lMGVe4#P^3{=WXFoE1m7?$E}95y4G&^E08`A@#U zHUaR;SuaDyHk2%%N)>Uw${4#n0ipC8OJ5%|f5tv_l&%~FT*=43)AbKANs(QEk$kBn z`(VfTiCM%xnAtQoENLV85(woH-vic9m7H~t}#z<7a~ zR@`tQ`9`Axj}b%tVvCWsX}aBMTrfWyYiH`? zyKFuAT}zg{%NK=b;K2sM`;*TFHi^32$v$+>7GWwji4x6)>xmbW_eM{O9TYQL;5QWn zEm`HXR;GO-GQRjTa7_d8X`{{ZOvQYSv0ugkQIY%D5KNDnUx}o^lu-3!6hTLD4D+NB z)I%xX^@$x2LM_nBPn#YkarWW;25R@Zqv_F>7kn}#lveK5V&4X8oMd1_0Om7H@PH;2 zFN2%W+k0s#wiiULweE0=Ti!sa#TJe6XG2z8Hcy5Lmi$rmDR;6+*7v8@<-0ppti2rm zU6usDfziCt!U+U(YNgB;dLNwFz`U`RCra_B@FjpuENu-?rlFsDu^Z0&u=V=%q|I8F zEAfAW5CqZF$#f|}`@0AtIVi;q(4{GgXAn1oUIHKE28Pg91dlOPA0nTlfzPWWY2m}u zf8)2!=Ni|Swsap17T0~74b(RGyzZ5F{BtTBi$oB;LEB!*y~KUDBJepNJY~Lb9`a=w zI3+l_YHHpUm2&->rNVWxfTEo;A15hjaXwme`zLX?>(F#@%RumOa6F>S`fcYFmkQxNbnW9T+HRK8o>qNJLp5jJN z)pwlB4vDPsaVrRsTMk^l08^PI$d1PhN6}WRwlm(^K6YgZ;^Un?q(I#tO=LoOM95r& z#rZ~UtOzxD&HhHUeOA*!(lIAHWHE)_i!eF8FD@|JECz<$skl) zx^|Fsn+XowV&H{4uE***I(dUFq~6-KjVUPVh~%3)Bch`ZEy3x$W{Wx~{X7OV;kZui zamua#z~tnPfzW8W71)W#>_P`Ft(hO>u*93Q9cNaqEy`q{kdH^!tasZUWs8-baMs~H z(7#2wC+2&0O{e@De{-qdMy_qAJU{y$be|QLiG$CRBw$&#N$$W%hldjR zJ;1)r*@hS<+c#4hzmsAF4u8%|H=w zH{uUrClI(cA>xar;oRpA{c|Ds-&>u7h#3jtduVpK>BKF?==c^E2tqhn5j7iLZXp;-qT7al+^$)g#EGB*{foWhmtp}BP<`Y)22{aq&FQjW&f?6E$yZm2-X?a z2B$}qk%TUj-grCQ_S?UsWqt*MjfJ)O(<4@_NQ&+se#QTuy?sLDRwRi;hel@#;!Gd2 zW2Xo<5)N-D|NoX_A8Q1`O-Bm>4|~Lb{uLYClMq3E8|QRnbVMBQ&!Yg_a|dl1Ub6T@ zdLrB6^6KbHRWeU>xmG`KHt7Z%g^01n&D=&&8~O`}+!cs!vyHi(+pmc;zIY^0^L(D) z$m_kdXM00UmXrmvwQv5ozp|Fx!d~zh;0)n|Mtv{+h3!-(fN<3G5h_;xIr8-CF@`%F zt@DcNtmA^P*D?4TdvJ7P`nJ|de#h7`sbffL?ZlUJ2+z91{bgf2LoAGt=Rv4}n7gg3 zS0E*YfsxCJjcI@0WIj8`7c#91K#Fi2c#vc3McGjaGuEMoa#el`|9tRh#j*TeER$4@ z&L^Z4VIq!~)+zko<0FUGyx`FY)$4EP=GOnj(mC95KNIp7!qa<~`Bt3dw1Q)Jibpl6 zWoZ4zF0@Ykp6Dn$hP-c_c2zVjtK+J z;J7bTF>&!>G+&F%{syCJmDJ3jJg(9_>;Au8gmG+_9PuzVgOhLAOA*uj6E|wV4=Rc{ zMXocWYq@rdFILJ&7x0B*M$D!R=Xc(ni?*d=8I^MI=qHn_Ag=S8Lstph#s&P`K6E6$ zXHK{I+csWV9QzX97R7vd8<+eN-tA@mbM2WW9>=M5qjcPm*$)5ThS^PoZiV(I07jXJ ztn6g{y}R}bFK%%CYdMI~|Me9hJ_23$D*|XBl63xs55L02&tk0}4;Pj2UUneiR^Kl~94vRe`64;hBMPL!! zhpu%GTLxN*yn`KAokzFf9^z7E_!AOq9@U^NBetv*80M=(%tF3Lc&hj&?K#kGy?r+e50I)u%E=0uSrZnq(H zdE`%b{*9}(%9~40SFiIeuR(W+k3qS_Pofnsh&$vfg}>XjD_4{nQWQaWD6;fxfX+Hy z;CJ)Skk|#J21+43Z#Xn^ba*1Hf|H<&BXWuDd^)(wnb0BD@O~^?JHSHlEHg6eM6CNn zrY2E+$f$1{(*k+J&hX3C4hSS+RuVj(7QdcSg#W$ITVDR=9CkIRuHA7`h~sE$>RAs` zw;34bT60dw+mJarFL!NLj#>Z~3GOgDyUzBMUiyVbc19Y8CoQ8}D7=MDTrNO00Gc9N z*d*Ft&JGxNSU$H~YXaFM8Aw!PGAMyV3$7D~PHI!VO{SAuK5x;(nHj&(OWx7!x7UDj zj#I>)^QZj?noY73#XbApptgTs4o{xWl?2denX%&8G7kudUL)+!F&C)x!UVL$8RrPJ zh>8(_kq-#RsPGNo<;m&0AH3)MB1@jw@t{7C6xZTHUlM1e`tHRVs2#>k)R*!=AzASn z_i*pRVip}}-jWaR^yGEH6^oJ{>UO&3PGRFV zah|4pmuD++MPQJcv-#pcIri-SXY}_6x!4ze{e6=Ru19B5AWH`HL<(7E|iAy!eC&b=0?u8BG_qF2_`k6!b7 z^}5_O8Sp3UQP8D3&M#2Nzv!)AqXf1|I4FT~u~2UH z;i^|5$K=+fCj5W1hk*ifRjcqBGuy24t7C?|)~6dXw(QJW&p!l}jt*x$T~b%z<6VXK zvP4=VS7ybMcZw(CARhLD3clYW^M|+Slvm-FshF(`jjqsiNrtAz@vt{lby@fMP*_QZ zd*}s!L`|Kq*A=0GPjX)O{q&0@junes2e5#yQTfsHzb!?9U}jy(OX=*d`_dM7;mb3T zmIqU2F4$*6D!?V-lA?L_N@Y{IgwX*0fP{G1TT~z)Ozm#Bk_um?3dkEVmTLb9y5?hQ2atlsFvi|d&|gt< zrS^R!`3NGRal?OMF&|`0hY)*?`cQs|o)UmRO2y1zi$OjwwM)z@!X_R~M)j5i|M9q9 zNj>QE`N53;4yIfa4AlFfqS+NB!x|mon5IWyT^?}09Wkkb7*Vf5ED7y-n5(4%0dA8ViE{{7A| z-AlBMP48Qfo&;5YwUNn>Y23vy+$B_k*u|xxI_P`U#HiS{Evw46XT=q;Q;Ln{ zY(Z$UM%eJo!Y|p#lW_;!6h{Rpfr_m-A_RE zsmUIXc+F$F?cduTk|s*uD0ivGiiVuD z)4lCD%!LYmI{`No2G7cS>Rs-&MsLB81ivGb#C^1NK7N|PZCAm2*YXzlP5UY41Qs6u z#gkKx*<OJ5Yy$8MTCLB>>gH_tf6TYC?K(a5#W9pTFjTb^y?Ek7 zJvJN|J-lvcQts27_AMPRG!l||$0_#pb=wzN{#WnW(Tw66MgVcgVo8a-L$hc|(=D1q z*_*+_5gG8M)uag^8u(fzdAsWkU-wqO$>@NLgq|1 z$2@QFw)>02k(#-3y79w1RXpbJs1WpBJW#-MH^CC$1wQNIZ<|(8FL}=25i9jI z(^t-7Q6J@0RT5`BcAz7L;fJTG?OYMws*KA95wXV{s~nRp9SPP?_YVMf*Dfx%deFt1 zmzfpFJ-@8szm8l+dC&DAj&~~DShbQJIL6@b)pjz8Z3+=Ix{#CWKPSozYZuc>|B8X1WyAQlrcub zp@VDH`}TN(r$G!HegS>@VV%%9+AY|E$@{8 zYG$ElA*(q4rRK+EJ}+ip+d0a*mb`sCFvb3i(`5rjaL}Udkkw81+PXI&hKwX`f`Uu3 zTedSymx_jQb>J&Jlq68n&tc&;BHCWe~4DQ{J3t#|H2hi-+dv+>38|9YN| z6r_p7Q(bb>ttDSz;CtMWp)j3*3cTzH_H*899GNJ^`fLEEmcV<=9{T)4dKd&Co`qUW zUyq&6D5$s5|3QMRGJR#e=Q_|gB&iif-t14l1J^M4tnE3v<}w=q6~;Z7oRyjDluMWe zKrL~Oep(H)aXYoXn~2>jn)tKEyeZq;G^pkc*;=MFnsow@)SKeqNg*c-=?uB-X#nzR zhbp`9Fz6n~4ggtc{r=%0lgGmzTWc0WmVcukM?{i$G@nve|Boog)&z%aJAK3}wVik% zt*H`+|y74g?@9fHG<5^8=waDD!GZmuWh!WE2sI+WwCd{~;Ijqpm#qy{a ze*E>^gFLagOh5FLpQmESekqe=Z*4QmfqEzVVpQqcWXGA4dgHH`Y7o_gDQ%?fg_I-0Hq z2qCTowCIli+N(gekp(4ki#Lr6HtRL~!PIYn7j!>*jbJ2Bi1N*8o}#_{zo&(3NNW0< z4>eRQm(ITwq>xY9CB%q@feo*m701Vjo#`+QYgj*kWiQ!g40$5@z%+Xq8bbXvWBBD! zSX9Mye(L{mbk$)|J%9JBqU@s5NOvkN-LTR~C?(z9-7Lb2bO;L42nv$Y%}Or4AhGl+ zwe->r_ub$7>_79&?7es9KF{2l`JD4P=K(<;iJx-AaO$8K7?GWjy!h( zgr%X%g4-*YUwCU^xI63V*gbmOS>hZnVY&Hrzza{t=XdE`G`U=jQOsAW{0H`VZ(!2e zghIaqzw8&z0{6jkLNiL2!9B#AqVje!lCM)593PmJUjh#$q4u*8JySF_&CdGQ2 z2Tkgp0}C!~dui%gPnNRC)r(tS&NGZR}PhR*#{*vtm_8u%-pCDv zq(+jp*YY&{ULf@Ow!tfl|JdQet9+S&Ziv?J#Fd&S9zt$yJitGwymB>ZSzX_y;O8d+ z*^?7Y>?Y&q#{j;bTs171t}%eS%Kd}L#}AbNa8D@g8FlLiR8z+;89GzT+&UueYTkrgEmhllaaUIC<=dtz(p5j}ascYge4$hrJrIG*w~ zMPb#~Wk$Z_b!A!iv}NRv=lpO3$oE>p^z!SzYRcAiPcYOy>A+AHtL<=z3m_Nqb2m2Z zY#Eo{5Ksjf)mX=2aQ5*@)e)B&6!&_ZA5hB49#9ZV6>J8X+Dm0Cp|7V5<)Jz$hik#%(9PEJI5+`Iaj zv(B#@L*hXE#PDCYX+`r|XNS#4`b;q)G6`s%UA{?=Rt25oR+gDGH{V~(FMf4ZIb3=$ zZH6qp#45uVO*NCmAp$q8iS7ga@Y%@JOeN3|TBjl~QL6ZcA0lua&4DtTnSJmDPz4d7 z^&sZV{mFUHc6U9$CT%t<32MZ8hK_eWC5hZdb2FF3k$j)lc6_%d#atqI`1ghO2>wAGU5gxjNA?QtW)#wc)>l?rNy|A(E6IqhDKpqk`WxlF2fK^b--7%&-dC@+2;XmX>Db?fry z%(-fL{Yp(Px0V+cT9Lir2@CgrTXUxg5=0Ijb+}S#jpQDi>M3{OeTG+yZk92V*I!pj z_L+*pv}EIc7jYHVP`O*U6gb}I3!Bt}nk zG4>*fh3f)mHbc4tZONjm?Mh9;jK9IV)Kzy}j!YgK>Ta2C^-MBn2ua@>iU+O8k=PiR zJsoqoY(Gj@!aL262{`lgf>qoNvqbJXWmCB%6A%CUhm4$8!n2zc-I@AfPtXH5Qq&Qu z+zf)Zz82ZW!5eql3pXE0)hTYCYJx`*8^UZ?1}*P+LjM;Fs5;1d+{&-}jBG8;c|u?M zs>zoi+aIJFI`1t@Up1#utCX35@*JF7M9%ou9V1Cp##7kqmqv=fkLVR-pqgcU zE-Pzo3v{k;!fm4{P5p$s0$=MO1)m98nVtRM{Q)p)3hX{1Xc_!-fvxF5ATw3Otm?OYaSw!0qr>xg#NogIjiZW1qWzoz~)L&)$*6pA`x_9f!OlpCl=x zk)~QH@RwBE-t!l%)PXf7$(u=PU$kC618Q>$&I7&Nx4)42GBQqK*(>td7mcyzS}DI? zlwy2J&rCJt3gATioLr_9Q*OcC*prbgb1j{Q7gR6a^@rzs(Me(s=BlEF(MBza4h+&o z&l`d&+w3%Vw%nfYmGsfY)HuHK4J$^FP3196h5dujzwdbKcCiu|IU=GUcqf?06sD;Y z(^MAAscJ&@#Due5D33|Qxr9HD>D9NVE_(;(RP1?7L7F%H`&eU}#4ORHoPPEY zar$~k_O65Z0{0BEnL#aZU57opf`PM6jKYi^P7(#F9$EEJS|f^;`x zd8dh~!CMxJyy{p;zgGI;!GHQLvQsD$k`(nW%}5&Y?l#{B{Blfqj6u{uqBY@f&wf+< zC3&X}SaR&i_PJ}Du~emEmCtt!oL*x*$Ux_uXh0TZI7up0kUKbu7dcX2u+L2#dKA*| z&-Ty*j7RTuwi7uAkb(ODB>42u^(_71{gW-966!zh95BZ|PZS2mn|^~67t;pg4b7c7 zP-g>pkw5FAW~9FBAr^w@6c!~m%&jjx5F~$d2C%gkC99yfW8mn@wvnU!Bvw^9M4mPW zkieI&F$a&ih14F1MKRC=i;7p3nEjiYIe!%8HdD zyfY8U7-}-{KXY#($O0#$3X6+ojYgJA7JXBLU@N;)mG1>gh=uT1iw?nZJ%C&u(`saa z`-8aXxwj+NG_#jb>8`1V3Pqx1^piEK;C?>P{7k3iMG1oJwK>yRbz4`>=ZqS)a?r|5 zEJp3>#eG#_n9H7k~zE8!C0Ld!vq*o{#yB4uM|;Bf`nMS?fk z`grt|G2W=6IcL#KpO)-u@Xl+t7&FQz>x1W{uT%nDKOv-rQkk~83sUiMu!3WKf@e$b z!aD7jXlSNtN~TlJ&#Mrn_NQgsslT(S>t_^gg0~FHZ~0RTxP`bbCQHb`l0s3zbfqtf zO0T|_a~G9G!N)f`$Brztm<9l40lkq0(#&@a#s3WFKclU#kYK#;l(DV0qhLIJN~fbS zyO4ZJ{uaJ4BF&4rE4lZU2Q0b>t6N;*-8apAd4b^6(lpD4tDF?zSC*yfx9?R3aOO3+ z3J$6i$A{%$9MNaX88=dcmaGE9Z_||=I1HV>9NfxojCGFWixsWUD$xCwSk1AS;wV%O zo@dWGR*bZd{SwIXUi;hkTvZ)tYAKO@zN${Z8v)6?((`S2EUFu*M9> zEhhJ-fk;_TSdZBn5>;1?LrE1v4Sd6$wOCXWyR}hjc+?~p)PLq0@e(oD--QbUBuZ8nIYH@JIb|0S%;w^)u5$xsvL!M7; zBmdyw;`G-#6d&@-Y$NAEH}yD3`V;?yLA+_B6PNszTMCGr8B5q7_b+|HLM1HX@IJ)Q{E$l_tJG^l9|Hqkq zUUUuIzu1!fZ25vfjEX83?3;<>$)uHup0}1~`3-nWlnV=Rqub#Iyjx2A56$wtTJ9wYZj!ZM3N}f5ID1yr z$p?{R)$BTa6T3w%-{?b&Y&A4B*#|BRbOw~B=a+^N3lznq7o82iM9bfTe|)PST(fwg zVBY9RRNs?9qs6{i8#30*Jy(Hv^y}hW?|ud9<~gnKwSd^Zngg+IwZ%J&qcNs~%4AvD zbqC@RzF(tfLZBnli3K|8sDfb%J)ebMOyjVRtj{BbFCkWFZOOEPW%}FeJRz|CvswGg zuXqgFC!*O%w#^fsiqS41@CNSrCukvXoVPG-BO>lSZNM{yu%v(dpp4}5ZNP!#^@gJh zCvscmxnw*OyBO8b+IFZ!z2@i|V1#Ex8);yAviFU*eU&G2>}fQ*E41p}NeyAHQpy*~ zC)4GPKS^qrRX?5m0?`U-%uldc5!mTm<}2$oJg0g=V1b5yGz$ZEg(J^GCw}N_^M1 z+5#PH#(rX)4=86LWB78E?#b8n+Dm}k!2vPmWSvAQftJFWMivhD&3<3;0YBoSv`M<~ zS9kM#u#IH*G^b8qofg~bWOxSn@hQ9v>t`NS;malBJ^OtaF&<XEGWo*Lbhr} z9yw(9Wz2upN(t~2SX(_~NS^H5Xw%Q}FaTI`3+krcwY}YSPG#cSJU+DG%xs;Bp%gwY zIHeI!>VYu$o}s{TLy?8s?$e|0;QQKSQ(Efn4o^beB6}^M0?+iXOLvmhcWYNTkqyD9 zf{kZ_TF+Ud3bvowb~JnMg8|P%)sx6>lc?a4 z8gh-`&(lDLLW*bhz`5@ug+({x{3c@?lNCNDt`1(u(by3|?1%J>gvTIf_s7P9i!v|s zzS#q95lmGq!EJt&#KrnN6=oYiM?^sr#1z3wN$jguKlm6l&#l-Z7jW;rb}*kiJ7^TV(qgAY2Ev%(BHztB0vBMpYwD%8i zXANpfQr|@@MlxPhY)NQ_xvD_0ih$n0&I`RE3{|&@=da0tEPl4k4k0efXG)(2NA3cc z6%4=om;7DFQg9IVk9@!b2RwXb_l3@mh(d?KOjLq_@>G5U7-1XeRLMC9lIyX_<#jv& z)Iv<Dw^;?mN0j_=ZoU;m>!%W=}vE7n`P?998ChVNeo5iZDHCa+4KA4{JjcRIs6t9M^R zHuk~Pa+V)Ns&VONW8ja)@^RFz18h_KID3pR4;79==X1qC^-g{fqvYG(_H*$&9}Z@l zWdE@b^Zz|0Y`7=gF8bd&)Ksf<(I!V%!?Zp~?7M~50dg{WM=pcx>MZk+%M@tI8E~2yosj z0rXz2Q^(l{?2w5E%I;BT45w;BloKu-nrlP+Z_#f~*da=Lip_t;jnGGBS6>kS5v~## zR%!lQxxlwz(UWuR{jMq*j~F*vyf$@hc_n){n*nMd(u6s%N?M5RS@>H18|ueHQ)`xp z<h1oe7y0e1lhvArku_yHt+ZjOIN(XcTc?ht53OaNqF9TmGp_9 zOfoMMgfK$aK$58cVP`i_2;G6JmxVVD(V-lRj{}^fvaX@<*8@9(D=1dU8hfF+$_CwQ z;bS|c|ThxLkJIMYCbI-&&pkv)Q*M#%- zrA8;o(V=B+>*T=T{!DWRXAN|i|KAy$r`s`qbop(?F<~yk*OufDRD#*^r;_#Ih>t|3 z64%A|L8f_ZZ*Nk36TenXObE9; zlJ>K(3;iH)*R9x$WgDI~Ebp0_1WgN;`;d@X{`oyEs2Bc0=cXJ??_e=Jt(#vrl6yrU zo8Kgrr+X?BX2D#1Ge1i?FIg6EUuAX|pW zsUaMjpB{dh#dKGbk}7l1?eJB6-fzpQCOuLfX@jg^cUF_WR7nUWdc16s&)SL;jgU>f$n;Q7brKr6?F7Y)Iy&`c1@`ofpt65-~!Zz@7K4Boo)P_hDA|bjcFH4ES>%XuhGPXG~o&lwWoa0(EcStwBHJ#J9 zY~t%K7(H^h;$K657Hj`8d=d7IsP|T9g(DrxlvMaflj~A`#H`eZj6jaqhfp*s}b|lw}3>hPPXrrD20a9J{jt`_Cvdnl36W=R;pg!%kvj zJ@Xqn%2Gp~{^D%ZZB-ePhAl^IebmF0&cE6O$M`d8>+)#-bkOHu$df$NA}S2`hEzZP zwzET9nJN2=O}nQsocDFhcbYT(%@u5|^OLr$3| zkjA_0di0WU7ySH%|8#uixRar0r1ONahnZpKk!ajSMCOs$aYgZoiRGrQBxwGtQiCTZ zt?VAMCC|f?n;$tzz>ZR)!o#CtwGC2U{kH1SVjkRWqRq)(&0iyaM5sNxL+*{^fY_^S z4l(ya#S2kiNtVNk>||BEK^=_F0r?0c&g@ahZvNK&HmPRs3c)>CS(1 zZ%8HXjQ9!zjYG7c*d|u2{`tHqU)OoSgvYiHQE12X$IQ;ilp7+={+Z<##7Z02JB65B z61NNn4OvhVw33N!?Db}5w0};g+c$UIq^M*X857@?=`<9b+b%9eGny!r-eF)mtL7(U z6tnk_B<_M3tZworZiT3WU|Ucv&}_!CGD>8oIsTh8iBJaf9iBmt!BkXwQAxhL0~~ZnX6-`Fb5I?a$bS@E`1IIGGIjOKc5_aD%A-^5B*N8)lM0PbA!`>uL8fYQ!NZ;YMFOP#pVpPfOLdFTtltQis|tU zTpt#vor@SfwlE+WlA}0&-cb(voKGXj$zjmgHt1K`*J;!l7jXcK2-p)0JXUVIsf*Jg zeTFUF*N3shivEhzVVY1jBsuEdSSlDBoO%%{Ce8f!Ef_PVZKu@?eqIh{{TF+{la@C; zv93c{gn>OOG^dOEA7@I?pJ>>$Ft-yC7aZ|t$Z zH8BmVSiK(^D$|ga5^l;ws$qHcP~F$mmHu)3F!U0Zw|f7dpvi5>s4{$TpKJ)pNzM-f z?dW{c<}xKFUWbQ5^1jm}pkti2{2=j-fx~Ny5aj{r5T~tL{l8F1t77&DXE6^5bo$dl zB&$JGIjQgLOLKHe4HFYescxgO`qxbHsL3m?novWtk`T?di$q^=G)aCPYdl8 zs80;l^_FvF+1z z(V&>yPo4c_47`H<2`>l~_<2#KaXx+h(+tTEO1xb`j+?O#rC*e5m8|uMI80?AeHSI| zFO=>u#e=#j%+3tShIOBWqb{70d(7fovfJwC(r?M`%qe$YdMia|v4$i8u7+3l3N4&7 zbmTWv=f6KAZY}mVdYCF`vOqyjeDk*L&wWV8R8?7o4tGO2Ka-x?-uz<_Ma_!r=5wZW z7d4E@Tq2cs@9yv;(e6 zyMJFR)wb=WXPo#QIv6sqcCSOW^=D7Dz^aiRMdtvs*c+J#Q9EE=ulFFWJfE=>0oq%Je#)ZXB!mSh+q%E*JiO+*6%N+Get-VHOO1()Q|4yo)F? z!OCcZ9tzd;K84cb2()=fL<^cbyeIV|!h`@ey<_3dWi15iBXo#by;-d`>mv#rP;P8bazwFVWD)=^xUM8N)ZUWS zYP&w7h`}b8avxYwEtQZV=JPp8qp^BuV(WX)9eBa!n@d6*>NEENb|!Q`(qpoGD|%5Z z!^4Q~DJodv1 zJ#AC$c#TebPnsCX&0{5_;mLu~=6?G9B}FPzuA|y-ny}6fE2cQn*%Mxc85`Dn%DjAy z3zvv_x z`kfyH^2jq$e3QRE2xOCwyGgSsH?H%PV}5u%F5JtJ51iT_MvAN?u#734g_+R(9eD;Z z@c#Yl{n1S_3nbi|scb270UihHJFfqCS*-*+vQ5MfR%$W+u1`)S(*Pd8K8fN+e{kr4RU*m6skuBcR z(GUJh5N(paTUCc3K1H}|G}-XDH!g(S7?Rq5ag-KB?GMkc5JyS+vRnE89QfE@&Gwp? z0vrF88@#IVK!f-6w(blVMD9e&U;L_QYc-*=s2lZP67i=k4EQP@ptb-q8}9Y` z;lb+5L*{3Q6@@I+ZnnDoJWJ34+-bYuuXD1m++bIB_m(_Lk)w}x%qBY$1-Lp~ENKh1 zza_e}`fAia{}^8IZWliTh-bb1wVm~|4-Z{?i4*oiev?*ri4$P>^~4tJ(T+xBwQR9IK|Zcjfdo4fGAR8uW)) zl{IH@H<2B^P1fRfMQd$pQJ_jxZo|ub0XNQiwY~mEGMZxl$px_ATPYMFq+yEB3%~HK zb4Fv74oAcAvI1A?JjH%Yg3$mlt1yr;ua9N2)!3u)Cw}?epI!>&^tNr89!CCiX`B%9 zZOT0qpV{15tS;*Br};i}rOY-RNx+cg2Y>n)pbzVzjJqm5f6+br;hXHxC0ZZ$@3H2b zg^V_Zu?gpOSuje(REerXfVgVhM(_)*f@zTT6v=gBdVfzoV`m(3h#Kxo@>2+TIOn|% zIqpk(*L27Z>l{{;&3g;k?0B8?afB4oq&Upa>}#C2ev!`(OB%j!<&i*F^l5<#D>V%g zS?OZ0p0{~2KOGRxVcDy4aD`^a!&#v~a?(ts~plF@V$6W=f#q7)qsTxaPtD(~+DEztru zA1?QhN+{xkzKE1M{qUz&XOHhKedN8g7n}1IoUdZG4HL9Pxce>K7A*o{PYbW(@2LO* zg)mm}kf&A~@%KV*MQf_$Z2=1nu3>Vd;zk4P?c+p@oT&!a;1f`T0IT5Xmz$3+VEV7` zRi8u!xm4C}|JUgPe(*J#S7pSlt?S9%8%!x+4EeVnz0ZRS2s)Ls-2sVS#BEuBUSADLvpIhB%+$+5MjL53{HO3b(olY7Dcg^$A zZ#wu)dIYBfmAqS#?Xb_vdZyiIGVU@ZBdw=CFhaVgEDdy|r{vj97A0ny`Hk5GkjB;C z59Y}wf8~=Q7%zQi!^wQheXm0+q4=?CpH+k4=RLM5a}rR`1ZMd3qgn0U?_;?D-2I&^ zs%`d#lA()gTw|iXY}wWC5pw%%Blh^PP+=E%lf)+ZU>nHD{mt^|tkQs|)Q;{V0FVFc z=d$DQxv-HojBnay-RA~r279e7UusmoO5~nCW_`{FsS#u9H6Yq$Sqo7D#!8jB>rT8n z9&!ixQ+8oQHin}c@&oCaSrOwsm)M1Rw3yMMMHOqpx?;v$(9N|UtamY@L-xB~TE-55 zBH{3PN?Z0jqfu32APhy)dL(=uZ#ZIsxwJr$kQ&g0%&$$de_NW-SI#u2_Uv_P>itFW zPVj-yFes>;&erAWkm*>+>J2N}c-z!{?_W!t9ppGm9@@w=&KvYv6DiktYu z!?{{+Oq63RiYiMO05j!H6EYCW$S!%>pazF>42AQne0M%VpW>l{-NOAYvB8k(tB5x} zFciEc@2>^p_>OZ!-R*PyFRip07h^~#b$40hl6MtAr|m)-GTU7fc!NBJy-)0?FCJ8O zMhD(hwXwUm3C3;*v{rH2l0Wjj=_*ABjUUnbF>qFMlDmoSzY%1tRIF&Dfj+Pb^pTGl zJfre6h=W~xub>4zH%Sm8-GU=Z-B#RVxygRn4|^~@ajogd_7LIr|Al=7d7C<6A#vBx z+q!=%MjWd2{-Csx;cM9)^g-d~kUS1mo3pM~S%d$c%&HA|e%+9=){TYJf~Whwb$;WiG&LL8)TsxrOznG6c|ne_**rza)4K z_xyXj-~R-SF%S-GycFWyx&u(bbITg%-y6)jJ25F(VneNgHV)#d8Sgc-{o8WFiV>%g z<4RAlbx};9Nqcy5+jK`ji-U##f}xETiy+O1YhVa0(l&Cbiz=$m(P$Hd9MOy?~ z7PX0>7n-}8mY4L#+s7trXW-FG-Une4(58-@6a)JKNRKPfhtKETR2)dFi<76#{vu-W zOLx|$XC1a&8)5E&e3{&q*!)2SgJ@F6=tnz|9S&N6;yqWesVSyIg8L%GTuYpoH)o9g?MSv5*C z^#&QD6~#^62PEuwRovN1F3mN@Mdbi7l74pr#aIikMg?yGp$R+6egN6s+SP>BW+%24 z%GpCV-t)I+zs!=$n7nw1#+0APRPM*8XM^XO@VcKHn@=1LpJ&iD4=owj2WYsj5~BSB zbiIy6wTBIW&)1?&Zq~>lLG|sM^rhFToudc3Z2TDITGc(nPQZhsc**`k4(D;u32ZzN zYcUDfTl%{2Zoh3}$@kUq>He3OfL~tNcQ;gRHvNp{rhWIng{LiSb3K$@6>?I3LRM$~ zx`ZR2wXw`wXIHhckVn zxICHW$lo|iHUZguey?iwlpeq}Ezn21Emf#_c02@jokmAtcgXtn0jZ&qcK?eVAD(@!&=8#JgNZCbJ}OC4(?VNH=2;(7*3g6b=% zwhjO7XyyC$3Lr#6OPMaP1hBMv8WUIG(*sPK$*1J&hr)% za8Jm6<)kN!fE#R1CM&6`8dvxh^1%8QvjDO?&kANiKsyt4ygZn4`q^%iX(bI*R;1?4 zM4@_nZm>Vs_y4iHL}THJ<3Z5hF^u|7W=$l7X#TTGKoqk4V1ur#K6L@~nFtSWceSU9 zq>Pam1J&BYKFDGyNe2A8Z7aoR(igx&&uEa)w%os0!AzzeqYWoz3-jgKTZ@mLNz&G= zoBwn%2$N!lj~z5*UA?Os8q&`jWB4@>n{sIN;3StO2Vq=7Uw-PD`Lt=V>-PF6ch6n2 z{PMN_fA!0QX-#B9+kI59xdrg&Q~Qeh2)Qyg;VD{w`a!WKgOuBs+~AJW{!7%J6~n6J zJlBi?Upd=IS=g_k74zqsnq-Llv|cZFpqec~)_!pZvIMUDtNvZu(B?DjEIJ}-b>-ys zXVWIpJ3`2G)BWJF`6%x%n;Y0 zs!#x}FmN1y#tzWqRa-3fm<13Y-F|bOhvG9YcpSv55@xgsb_FPFO>UVeL2sw%Vg6A0 zu^N(Hro#Zz=o{rH`fFi9!CF-OldiMEb^C1Odrx5{!YyMBq44tv#M0&&FVbnq{myxq zVs|DAn;n|5n!ltL;~})(qFQBa^UcFcYx3L1hqelDm4#f`S)+XObzr&lw!!+FYUbp! z6|M|rq7hUf1FtZBYpyp+AGCNV`)`!mId zrxb1DTTCL5t8$&nRAGDq9-}L`M*BRWv*u?}%m0hUNIwc|(l^X{i#QCGk4aXcu-d$g zFvVCWPGd6PDrE+lF9v+Y?MabRz0XwzRod^AaKvxzwD{t8CV9XcrGs;)8u8)2D=j*p zE^d6>VU~wg!Yqq78jah>*2umJh|BRg9a%RfVqUP(KNAP4S)Q~rErSmONP;bhZ)=|i zkhGeEKoUTnvOA5St4mM-NwkG$3|y!NA7#X99(W6H11a%8`nEPo(`@WE^EeF+1dv== ze7b=;!`bI&&0zZ(z2bFSZJ=EKSV2*Sn*7u&&H%E0^V&IQyf)TzU`bOo$S9|}yA2%6 zuaeKd4|HayoYqn?>O;ktZ`UJqP|`F%vRm=5_c?6gq~pgjB41Ua+HFt-r>#V2O)4tS zMz6{YXKRjKj^cJ2Vizgz7U@?86^ zh?V-c?}lU?7L?c*9wJtz-zfCS`q_+wM6C3_P3x&#Ief<%ef5x5)@2E>OP&CQze=DPr*!s}CcJswnj2#b##W0gmj3~UVbKxHJTqLuRx^75D6 z!hURmgfaB0K49cyvTQh!l|0RL!dcGeXKf$HIVV1y#T@?_lH3YmITrPACqo_){23!+ zclx*r-Df6mrxb|jtW`K#Lp8`^mFUxGJ_f$5!4-_AY8!afG#kX_4En%Gb!_S8 z;U{(wP%=$yFALgy7wjFzcrP^u1D_&($=N%rz27!(d-cl286-k>eEmww8MH^Hf+3=> zVlKu{8e<$fKMjM86mU6kE~*R=#(67jhrymaPDH`mlT&DN(ELN|`PU$&u88+4#f=Nj zHP=(iDw~AP0hLCNr)I17br0I2uqsy*VT@KBR00C6;&*#tu=K%*4#JX$tY0wDpXjes z`|`(9%JhQO>r%1jWGh5Y=h5cCW_aYe4wH0XPSBYT{b`QN;Lke}IpCb^ksQIS3o@(u zzNzRDTHEt>@E5*%Yc?Ov67wvn_}%F(tnfLjf!ucZ#wp`IC)-`nUEtyxK4=R{2>ZB; zi}~Di-r$3Jpf!Eu>BcsW+zd=>fJiXyJ`floaDj@TN3fI(+L5?iTwhI}-;SpAj4lp) z>y~7PMhILt$Q5ZwSPlbG1RTuBy& zXq`Og49^{RFZ8-WSCi3f-2cbNu~TJE*!btuU%8^wla7+Tcn>LkyM-ABF93rA`{a+2 z;hWmdziz%e_k$>iGp!A`es5m8t0ueZj)toZJ&!4PTVLC;xbBk6m;}A^>t>34vs1+p z79|i@AOPJ$GbJ!_4eTv@C@u?u2hq?p{~t^CBPH{lN3<|!0?8Fusr7pSp-}>g3inLD z8QyX{?5TO(YLfXiy>~s|gILmLbE1fnyTN!hhZ`$Z#oD@>dX!`BT*FO7ioNqL#G-GoobGr5BI->Oi(Bc5`JlU)Czw2eFQs9Q(f-;e4i zs`&n%^#bDuJ0gqpZjXzAj;-SIgR97*tZ!WCtbh| z6a4u)N9bkM=CBP{NQ{oBw@wUqd3cPDueZ)`sw45glD^W4n>EtI2!I$Dym>04NF^@e zI9soOCw@n4b+cyK{MdkJz?^oj7hn^0QEzVni#%3rDaS70VS^N8k1^Q)@g~f;cvH{i!NX9fvEX*%kZm zH26#3)ujG4a~?PsZD;Ay38>2?BgL}X7H2vn4g<0f^`V>F)gyTFcrIzZ4K`>m$W31s zvhZ*v0JlJOY*KgWBB>9u^kX78;Ap1Fj?jWoGpQ!nlt_ebs9oF<83_)XQ*`Udv z3e1G29+Yz~E$xlk=44&aH#)s3!UEgvBwOKWTuasIu&~n+F=3KuKEipIn&XDHnf{FH zY*1PT-oug6RF3WnMX5!_7!9(^b5pW=q`aM91$<(IJiKnW6Gfk5Ol{@x?~~ZQ|7H&f z$a?N_aC2@C@i5jINcIx*b{s-)d7VEUg-J9dwtt+pf90-wF7F}4yi;o#$RoO;mky6DeuW2}OJk zc8@+w3LQ3++u|HyunTFZ23Nuc@4pgVahNOL*%;htAd_Kho20d`>duW6+c_ZbF{EI(TFI zl7{vjI|_PE`XfHF6}@E6+QsP8G>z#$BswFFu1-Jk=Owa=f@P$&C;wfdN$Bkv%Z_^I zSeH$KWleAs+0A)#_}TfKojr%xbFw2`*1)RSvwW*6-Nb0`1rzbRo^Z&Y zssfu1Rvgl$&6R~YpTEVkNJmTDZH0FqR28J4hIUNUo5f#UgJV%&ucHv~J24DIvLr3`b$f=yX zYNrU*p&ur02YHHq0K-w?AWskn_aI%B3Wy6DcR)tIG%e3dMyoXO=t(jVo-TbG(#NS|$=ova;z{}QpnQdcNSdrAZAUXj4r z-!~X}A~~&?a^GKS>OrI1G^4oN{uJI1(^$gyn0!9U8B)p6n5l>9NL|v3Y2z-%@TlG{ zSoa*iL5AB&6>d~nPPLA<-_^}<=(^Uamja7g2cwhG2)PC_Ni4y<&!$-1* zT5{dCAq8udQIM%xII-B7G~ki#TZdzb3HF~7G}Q1Q$&LCb{OHoq%)K+S2*Hv+a?-YI z-rlzuHAtDFM$o5}^M8e^bn)&$*r)Nkf6UBCUO+7p+wvea? z-L{IoKbe!e4yg;!Jhl@p##)<7H&UNIhdj0sO-2Gt{NbA*0}Fd=eCBoRN81Ga9{2LR zuN8!le`ul)4y!Doy!OzU_x#naH=nRaKSnnA8$-K*%bA3Z{Dt$mMr3a&pYnFiRpK@w z#PmW(?>7DzP6)BSNQpr2k=RsA8_a=~&V~Ht7ex3B9!K2CiD?vNOuNC4?wyB=myMYB!KQ$2L{pKz!+A)4WB& zc3Li){UonoQzSTPUDnS1qpa8Mc^fQFTq)^r$#w~UP@CjxCB4+8_c%X~<;gs{Ztg0t zwgd#`L;`tNC7?kS$H`lA<~>_G^E|mDa^`E>J_eimx9M$|JQltDidp2a`kN~CONK(g zR!My4E1LBrrvi3OUt@4`m6L57;Eo3XA+Ql$3aRDqgl`*{lhP(GWgrIaEb{M@?@CL_HyYc@9$~E2l$ebY8$d#z8dapP29dbaE2oXYK$4$ zDtpuxbx}X7(gZRKU}lIx(HOdx(i!yy?wPsso3JPWrrG)ST}D_JVW)vKO8 z`3078cDegBA4_J6;rb_-A#7fKD&XBvB%C$+eft{Lc>LKjv7N(o%Cr1&x1oyN3oTK~ zB;X>fd-JUlW>qWjtSxtc@hg_>$6Ip5MeV@%wj~2O=~H}ItzBHw9t*mqJ88-CjrerU zm%9jo#@Aq!#C|dz_qlgHstmh%bC3Cwwk07Jn!Q1wsSBEYzEmgn!5jOA3F3r~dDy*0FM^~B0kQ_l&K@xEMs@pZ% z`h0LrYIRQ&NJ+T}Iu6%G%}guB0PUnzehJKzPt6<0$?shKDGN6rt2dkWXNY)JwpT8e zv&jyxqxm39loVYS-!Z42H_3bu=O3hJk|3Id)q8TRLec+OW`H-N`opHoT^6r^t-&?fB4Qux%MO+@5KUcdtc>Kls z@!$^pHb&q;UnypC{iSy5aTeiCOiE5AD13H;k%Y9C0zoB~1O-?jZyQ;efhO{~+dtB3q@94GHOhj)Ox%<-?4uoAjFj}4va zl_j$)8_1S-4OU-{1Lyd5#YlFXtg^f>GS0V`Zr z?{zS;Le|9ZaZI&*1|<#gu3)!wzWbBa%EU30Q;2ZHqU3ftE|R}hwpuv1f+rdJlD;-7 zq)$t>fw#<+P-OIWBJRK@N3%D12VuPqYyO_VgUps2lqT1(e(wceBG9aTkN;w1&q9vb z7egaG=5L|CLWBOOB*#o=&b*wF*S}g_XU%R1z;wQ1LX}(Y05XVQI=ba{l@m5E%`VLs z-V?C6m-_q-a`QqPG{;TRCNp4Q+Ciq3z%fpFuf}ro?T>Y9ryxUB@OigB`YnhT(%>|M-kg8z&7|acJ!|GWIg{5px~LbcC?f`x93u}Hxb%efswfw8$)9>cH+r{D zgwH&oJ+i1iImNA*jS_hI<2IXKe^FmXs&axO>uf#G_rKY|tBuv?`omxd(r6M&g#3B7a5f7p1GGnQ$i%3=G1LJY-9u^V-ES)y_&<{#{tJbEJtQmLz4Ds$u?EHQqtd;QB^j;n2D$m;R?sfPsE<9}BKMw#tkw5R zR64|03dF;v=l;x`gOQ8-e?D`}GzcjEy)Z_DRggaQh<_K>`@YUOit{z_j7`njEVd2CNpc$G&EC~ekh&)2aj_r75SYC!Yx23M4yX<}`Oy6SdAbb-t)6`OT(1sabzdr=DS3T) z&uRO`SLDX8Wjjy?Rd(Dm{g9p3SOp#0`I0RUw}SnG$&~OZ|5)Ny>pCfYlTBMVJ0JpO^Y}G3{!_O{OwftCpOUBUXgM;2|ThrhL;a zQc$P##Ndn-vP#3T;J)0!*WK2X&f?(oaVH4dsiF+WH2lE4a467I z2>cLz5~!~L!PRdazcx}pY)R<-;M?LN@}DL`pm|DVJ6vxtoP$n8F?4u7<)1}2v*f;6 zJ8b`x_(5+FW`|m3Z@L7BNHIru@to_6&z?Ze_ry%}<1i@Sq32 z%()9Gr{In=@h-u48*E1(eSE&((RjiNv?_6zg4cf}rIUmjo(yT#2~lX2DK!ls+je28 z*}c}R!-h<43siup%|&Hla&~oGwLqW3^c)S#3%3B>r0h9s&f&c{LCG^`l==FP#B@+{ zOT3lahc;+`CC&PeZex;dV)6|L2~DsdvJWVe+Ga>7X8Zh_ZjUGSuI5`qUhQXEGr#i- z75=%|f2@1R2Pep>ay`;&hte*Ip=7CKo=3F!hWK;4eoTNJULEUp{10)kv~{f8^FPF) zRif|IL-OWB>U9Y4Kg7urZXFT_lXyNldU@s3)vQj?p==u@4sWI zwq_%`acvzLa>hSR{v2(OPmz9Xh@>bzH0}=2FP-Un{H9IU9kD77oxYB0ORJ|auX}L; zpTmw%lbk(r^xPNOkjBuPi(=^!*c-~|)p0LB!(jBXNtQt5`d!bp^Z04d_qvs(k&s+n z_Hj~ct~Jft>S@qy9cw%?BsW2?3?59sE zhSlVT7LK$zQ zIx}>93j?iFmJ|hD?fC9!VRY)H2`@e)tw0TZN{c9&?&~3|`la`+g!Lyjmm9CnAY_c-9eXZL*8 z*SG!ouRiVq?&Q7L$o7IGNfI_ZSxbRO*qNN}yN_hb+IQ1oFy-QRo@x31S6xUFZ&!`m zlzmKf1n_(SX^7-8{>x!Yg{&u+Li!Q+&Gy)af%Pf9X0KWI zf5!07eXiJP&fP`nGd?J>^OHUNH$=$9J^i0Ebb58Ll{V6XfD^a5^60Tr9cQD_e}yqU zcZPbmbT~5}3Hn{fTT@Qt3kThN+rnhq_KF$6Ie$I`Db}y;*3K1#$6RNP;ow^5!!?6l zw5+G{2&I+Xa=U*~;>phl)8vqInK`RtHHjT)3saR}#Mm{{Z`klrd>Dx$Mh`9>7ZfBT zaK;i&qO8LUt#sHVhXCrz{ofOI**vcR2(*u4&I6Aow>ePHeq>wm7YIpCSb%J!+`(XJ zCF>Tf7Su)6ORn@(3+h7*gsx6F5v7Wg@mKC(ULwFe8!j682jD~~6~wlxb0;~5W7vuF zOp_$Yf8t^V!%8f%PH7<71`C`BK%-RiZ24I~MU-tH7{`JF45oL${1 z9xCu$rccVvpU~J?e4qDt`=R2Q*aCo~vH7Z){HOx&nw^MpcsuLIiVI`}P9@=chwt!{ zc8Q7K7IOD6@zx>f5CPnxyj5xlh;g=?L@mT2@R|qq2ILK5%^vy$r zMDnE;Mi_Canic!oE6# z9`Qf*&WJeRpEu+iMIA=*cQ7-R=RF`fkiA9k?t zrOlN03~<^nU_SR~;1=ZCKYNrI`~X+CI`BcK*!TE87Ls6ebXCYY>Jv6Lj(Z%2hf_u{hX!5daoIE`&?n{#E? zmjQ%BZb*s3<+G{HITg_M^@b;JMPQ2Vj8L5O>lEDuq2q>eJ?N*&h7vtuJkZ4gn!R3; z=D12sm{I_w?ForvVmd$*fRBfF_%C(g@-MH`yN@miYW;!g7Dd{1Izl5TZN(j|RW#eZ!jTum#>F6uJBAR1k7tzkP+$RP!^nD9Z8$ zRS880pR{RyRN4(n7v?)_IJE4HnZzvn5~~Z)7)+)w$Vn*rIyN|7_sN;$wj4BZ5_5_r z!RcdK4=Gx~6k`b&Rga zlgiC4+78Jlv9Opii6=b@%8E+yja0!)hLaOTQCn7};xC5UA99AUS>5 z?nAK3cS1cAdyMAwzPuW3;-$p<1Y!1g;EB!Lv3v-?!an?vwu+6$a!McA42CY1C0Sb4 z+^a}j39Me?dez1oH|1O^_ zYc5zN%aEsuwiI;D5ym(7D^&M^43N3@h91=M#)LL!ZrpVVsB zX8jLgP=LD$cZ>W(_k`#Q-u^#?b-{ysBwuLg(}7#?WeCUT!mSvspHn@lbkc;K2DE`YbRuV2~zynB{4TPG0@;{?s3L|on`(%aipD5v%*Xo2s->@M^gU7cgU z`vfer+w4f1xhYfSp--$iLAb7{xX@9IflF0lofcR+%r(d;qHFaCcn1r6(4x=&Pvf=Gtlhd>cZ zCoHUfL`Vz-8m6?XphWD@U<)S!f%pGGJ`;^cm{^C&qHBq^qcrV(Cz#@5me#^t;lo5y^M3>vIT|My+1x-@379gequ1ZT)ev|RU1;@_BJR#mWuMqc9pC0v9Edsc z9Xcn@&h)HgS46iXHgR|4?}zacl~v>&c$t&DSLpFtmEE`tw-&T@J8IVZ>%h9(WqldW zymCP$e`tE^ozr_9i)Wqu&Ky2ss0O(-b^bHjHGPQh*y9Zgr&kR3@^axo#a8X~mr|*h z{eG(BM^o^H<`0^|)uUbTBj1-e^YxzKaFE?0_lMjjLm$3sPJo4TxRq@iU;+PFqFBF# zKLUkwnC*na)wgHMAF*K`@3F9eRoKn8!{J1SmotdX^GlWMaCk`M9|DA!uRjY?Bc_4B zuz&;D=Vrp;2fp31IZm-Z8Vsg?olzimnbsr3hbH8sPW{`n?C-Epgke0+1K$J4^EliU zUwb^smqTv7BShm>VO>?6?-m=A)|v}P{T^}-b2GOqjD-l`xry&Up#*2M;M}l zY{zT(@pmfldpy5;P}(9+R95TMJg>5Opg@bpGsUjO*ZAZ|Ih$^>)4p*HJS8|6_aRe) zm^md@aH*l#6%sgLB~#=XHRh=s`FT3H?1`TT9-!*Lw%hjAK7F@8bM(Iz!pq`|Uq3fx zmYrsV%Nqdz4G;6!q&2KN{62SRA?Ycz@|^ytc&BXzFJ|*$q2E|+`inJBke+Ns%sdr* zM&6K_fgpwuEQUMec&F>{7B`pzKf7;~9jag5hpdhP=gc7h5Gq`$MgUOcDpbn9xGM4Y zmw$%-7*(9NCh?3aSQX8xyDQaRc<1=b2&p7H3IL$A1hr~_5K468`DYA85h2Qa2;+k9 zgw(O?#D13Qr&;8{nKAJa;=AVS5E?Hf5c4={IbSYO;5h}boyvTjyPDro*;1P#Jn#;G=MRG{ol)l)Y%cF}3c*Au#L!CinHG1RQ74b!Z=DShi#Gy&`1q5Z zjK6VyCZ%K)SV`!g81QKF?sPQo<$jVZSJ@r~0g!}l^o@Ht8WsfsFHaodUhmlJw$Tgp>TmlLta`~ey^P{`@z!%}m62$|QQv-Po;``1s zM&OtQ?gH<=a1rnc2)`pH?GrW@oACFZ@E(0rf#sKJARqG0KrLZjz@tvmboHGS(WTS| z4%J&FnLN=|P|PSy*q8MhCjY_XHMwb{6d0dyINaA^Hx%0O9)G9+I^$=5T~2R@(qNQ{ zhh1~s5JCL&JM~^puZcKyC-j`5VBk3mh}<-fe#_iq%2<$!)ha8dGwt_vQC;t$oHvHY zm8%B!tos(0kWB1mjG9R(=d$2)|90-Vmk&RmN%$z`*zmyPcLI8Q&ja7r2QN*ALfuq) z``}T@(B(lB8#&w2Hyd}lj*vt>JeMNL`8sPrC*V3d9`pqSSUqjm}eL5tHJZ_P>G2C!UkjYx^_v5Nm-Bj6~3rw2e@ z>~N~M(A4}^^Y1K~L@7-*Gb-@A>rDUt78hDI`x+y)3W{@UvJAXq- zvMggow-2w_YSVk}HMLze&;Z9mP@NBI*b*#&W)DZqzQ>;ivWD8L8pf_^M3zz>Lb{#AgN5D(`H z@X7me`r5ca(W7Y;#GQ@AQarLQuZmL8TL3O?>AxWK6`9 z(a`qBA7zpXvs->}L3@2fY!P4W&X>cagoNpD3N;dgVjkVXJ~8Mwl!_X2;|hgKi>ckZ zc{J72AJc4I8n44?1L6w=8UXSyyAugkEZWT|O_u;PqsXKM{X`X*gU&5iD@@alY&AXf zc8iIG9c>%`o0)z?se%NN7z> e3~3hH0^|*3*R7cFyUJvVdw~s`TmnJCyEvu1Bx# zNv7^IIhC|q72<-=PQUb|U5XzO8#D760huraH`}*qr{ukHBi#zp`Bvjz;gk@0s)77k zxt95`<=+%tABDm?J>qcamQaiBW!kVKp|I0NSsOQ>49^-UCVnTN$%2d{6Y(#mOKg`Z z`jyirrYFJ6zn>_Yg$&K$cUlb_Y3GC<%{t$n+sQ1ipFM4{Ae*u#4dp7ddr)J}kG+8e z_H5OLNViQ&CYUj9Jt(U7BKd4DMn!9*{y6k%;h(Jp_%)1)0s%|aEB??50ef!bJ>a#muUOVlZ*USI?nWH*%c0VN?Q2o3{H(KvW2G!C+ofn#^4UpJg+zR>dRA0e^0TX$5tOIU$H;*_GylD zP&;)*ZO-hnKVU-Z?t`|^H*DsJ`ED^!2Fl>*Y#PfVSEw5xn+I89m~ejUT%X>n+#b60 z1HK_v*|6cqCG>jhG^_r$8({KlY+Za$GjY>%YBL)=$bTNSa))dwhpnN^@|SR$7!2iq z)ps*2%3{279Q6?)YCM^)N+bMVL${rL>qi8?HJD*L$Tq2F=hyJEI8dj0{^L5Mr=@VT;3SZ>v7Ej5g3a3U=}Z{6f$klz&sM8;D_#>{bU7eD*R4#@vS-eC3{d3FuE zsYuvKV2*d{Bcwh5;(r}YNjqm0zE>AjDYB~3qVqZe{b)d>@QxAYq8~(Nii1GpkAJF^ zf%Avz{&+^pBqAURR2_W2(SCaYmIdBsOg2o(oYr0H8yD_eqOU4NT)<#$(Ro`rV?!=c zvdRaM{|(1fK2TnfS{N5`B}OYsVVQLZwRY42Af4FJB1jb%djaCFv;IJjKF*!3?!Srs z8sdJS6!z^5!FD;+NPvMAmjXsqTsq*t=PMJLSBTgvk<&^^eE+UOem8l`@>ct-4_L7` ztPtSrL&--X>=f1dETi`NMzM$tdg z|8W2$)9FiucNPksv@ttd(sqoG{(g(0kR|KYkqJdfXk4tx5{}-4g;f+RN*+*!%~e2J z(4y#=8#)T19S!2_7o)93!jtaeYrnXwMndDx*xqT|L@d&fKJI;XVfE~3k_Z{3|I2EA zerG}}8~dvNg=6f1P@j%X{}M%1R@un4LXqg&zVLx{pg?}E?Mubp5;8WK;kJ=oRPLbg zPd2L2u^sKIYo~jH9+FmjE&Yqt!;2|%K{mr4Z#<$r0OaMc_(szNI!z}S5T{3`tv#s( zat0H8D%g#;um+hC9tt76ia?!eTBPkN9jRtKKcxqbE6=9%lzT1TFKjONq`_blC6Nbl zGFIy|O5de#F$W(Cztzrd$ny*9YI!;PB0n7xyY%FQtih4e7`x~qt4Qz;LlL25i;nX( zt%NQovg_$kFS6I$SC3~;(X_7dm#_Eh68h-%nj#3UFQO{G&f}Y`yDOBB!0RsgOT9W*p*$ zS;GNEVrz?Uwr+z%@~ke3HPqg2oag_h(|3Cq>R~|@5?I&&cd|_~K)UOc7@wiT@=F|{=+AOR0Gr?HqxUyV~_OhLZG?2+7WpS>?Sn2>#Dn@(vfOOjfpTun8QidG! zzpJ=(kf6(@S6!0wY$||W;R~cv`kNiiT>iXU{1;8N*TplGq>oH@cj!Hg&Dx*dpZ&w5 z@TtQa#vSmW-*u(I@4D}HSnWMBsU@rXuGwucIS^T79pb%%7hb;;d*-Z>+1EiaI#Fhydi6B54;uJPGPa!z9^xz#sdTj9 z7X67yCK*v(M=mxX3N2q1E7j>dn9I zAVMX33}evTG$rGSkHT!pL_?PK^d7RvM|Ye#s`cHk9bzYB>{fKrAb}4OiughaIonvn zO-;FMgtaTB)?JTcA>$y4uJ?A_IgI-UXD41df!7T+bOG4~I2xb1wV@klG9!IHedxTA zgz*3uUs*Klr7f+C*qdi1L}J6Ec;Kb&)*Q=(^Q%Ex+}i?5WW&Hh_16I$ajr$*@YoMb zrj_P@dS{(rD&>ywoPIS!N6sD3D zJg&O(q&;SSj58UKBD0D#@_(pUuT&-z4$&;A%k4_w8E;10^d~sp+7u@8EXF-)C)npE zrN~Oa4>m==snx5_;#KognzgkR05y;{N?bz(qKZXIyIOCzeiFMLqThs_a}nI7gZFS`AdJYtgGi)n-OzPc|SoWGg7FF%HlocENV)9xoP7Z`Y&?zYNCCcm;$I(uK+7IVyv%!C{1= zZzm}De|iYN&3}4`ChdQE2sq3wQlbrx&@5<56D7Lcc7G>h0t>kED7GjKSq+X6&5Y7T zFNl|{{@r{c-FR^9$vAzQ=%i+C+;=h}6V#VSu|kQ#Y*3eNWcxxtjJITQSU*f7k|w)T z_b8>mFG-(vF#i&BVWLi|c!h;ZKa6@``9~wDTs{=C8wg0sOJsBkW7~k(_#R>mwCKMV zG#q$CaS7YwFVy@Ig2yKjd~YbGDU~&SBnCM+!Pos4?LS~!XGmg9bs3`8Uzq4}U*+>} z?eNzjXD&LHzsT{5iiAJAIv3jil>W!%Yfi?@2z;RHT4o9BlpBuZGMckxK28@&QE)wB zpg>yK&~=*cjjTr_r;&`*$w93F(8nSLKcO z!u07#^HcW}O33bjT{%-B)&)IQ-3i!oM|ZX6hz>mQ_!p<}SmceIbN4-yKlA*n2bo2z zvV97z5fFk@HVdY>qvJ?t@=(^{!XfmeLESF*9qg{4ZL$C8&u}wm^{j!1tutwX)-Llm zjo2Yl#fK4X88*i_-Nrd1Bwt_g^t!lpmC=$KFEEPAfNZCSv5c+hSuu?n+38J3{I7lo zyDRwiA29JOe6e<+>3KqZqH+Igs?q~_FA>G*`-t~x@?q<}oqjQ)B9BhIxuS$b_PRmo z!nG(`QWhH9yZ((&9x>KVZd^r^^^_ftbZXKbTaCX_jJM01xFnfqd(391kNCakr;oX0PsL)MA`*ey{G8hT5+`?!+j-PkEKkxuGzGB!9yh#}OPKE;utm}vIN2dAnC}t@Qp;92~1*sN;<6`9h~*=p zbWz3-(-{A;pylj0F&9gkY=Py2RexCK%P}K6vstYv9g@OG#!ZO}{6hyqUI3lqMj1p# z@Jafe;Q%>a7Vg#<#NHH;%{cv@PI1Q>n76zHOat+a8qvqFtG4M_LEg&7YCc|GdR{sX z9vV*Gz|mzJ-&so^d&^hEA0s_=J-zXtx&y*`595d2zM0$VC+e~AzT}k;9Z((D6&dF) zX*={B6CNKcJ_#II&=K>@zjb;^xC%d$_C(8xVTZ-1SMgaFjF5F-V9|1L9VJF0j*@vj zZJ_Vfy!g4bMsE}*{Ut%Zv>)a`uCGdsJ0ycfLCX}rB$SVRb|6opGCQP$D}Cxc2uFyK zfC@D?wW{4E?PA@f=yDE$m(WOIV%2H3IyZePnlBz0VZW{NNa=ai0a>%wDMDn)ELUCa zs?Cm)y50SGo6NRgXj665sRJ>~7ICmDM7hz~E7!9j>htSMxJ8Fgr%PD50aBQ1QT0`>Gb9Vj6UMC!?vse+ zbEUM`e#n*Ie%U#!3AAZjdvV(MS;*g8cL3k*qsDJ$!f%BB@#93mEZVu6(d?(Of$PXm zVjz6qqZvQXWG=CWM2gh)m>*gR z&6bNM&q%OyOH}60F_GU$TZIuBnbvaT12N2=njsu<^)Yp@5uA43xjaG+1yqwbA!S0i z{rOw#TBh&Tkd!35U2*rJMp@rz4|=>P-;YriqH?@%3Xf8c_BC78dX`O|<7KOo640ug zml2aw11e0u_fnQBAKYTZ{}jC%`qQdry)CN-PI3PaDo2SnmufKF99(}a0GoyIQrpoOXK<`*;_a1B zA>+b{elDqj&6Q$Y_)GTq`x|HR?Znhr^#RLn4prn?{EW;}(&ntqcz4d{b|G?oOp+bj zP3`gsRIVzCSd|lkiFXyd)ClIR1<#)DY#HY-#s9%Hb_Way=S;p}-_uRjDMO z;XaLjqffTT9VN0S$6?KWsx^d9ScRFNnpDlZRAiylGIHd}smr2afDri9i7#)wxkaU2 z?N@#-W0B(w2V>*LU5?}&6kE11F#4(g=U?>wpK?KMg=KqSzW6H7tW>RHVE2<+#g6;h z2XI}a$I|*Nyy{kE`OxTVEeV^gU!T`Zmy(_jA^#Gut~#aQN%3j%bq=n-+m(t5j<^i(URV@LX^XJ+F;d70SvHe@M05uFMhr8a>Em(%+eQEcBqi9dwz5S z)DqYopt8mnaw9%x6UfmlzV^e-1pblW2_M5(QRlBzUMu^|=Q{tp*UK(NbRa|gOP)D8 zE=NT%LT9<|v3f6EzUFw>R<*$h#n|p;9Dq52b@E=CM@k>GuITvCh3hkaMLzvmt1rCX z-@GVZmy;tueQHp$b2K=9`zu52#~8v8}XYXljlsf^L38kK&|N}#pNCP)t=Bz zihxxwnMW@o?M@q_$KmDib0;Lp9?f2W1o0^bj&hq6VbpUU#kETaEoUK#65h-R8SV5H zyNyw{r&U#Dt>bajP0D`^8?OT85w>*)kp^g~eBBzecz@&6T%s{lg^VwCp<%wxmQ{sj z9XtIf*KOlnpV?UXoJ zJ$H>(_-NQh#>g)xYAHj4sh`?B~JxA_#cG6pRYLgaMF|~IIQuwnq z0M(mu@3G=oz~#v>Gh&{Q?|9rqBLDWhbmn{|2;QT#7#A#zdhrW)x24Bo@FfdkQ*E&l zxxCIYpL%`B_L8|oC^Fp{X_*`^yjve@Ci5Mm8ezSA?05kDqX7Te@d?@Vx(aL4DmxFh zOGRFPGGxLc2c7*L4gc+y1y#hB%`sc7@4A?rr8X=X*_Zn%*mzVNY=K-*L_H;LUd)5z^S|T()2t2{AYRoaEX zH{pz-Y4lItkUsT6JKQ00>U*|Z@$c7pqjL}6nka6m>>;^+TV1}O>m6fw@E;K zJDPvS=}5`-<5T-&+|D>A-rj`!h1Qcl;V(TwvkjO0_lvP`=m_l(cS0~>VH*^jaUP?! zXBD&I4{Ixnf;R0=F09Y5s+w~jf1f$vV=5!*1Nzw}8H?u6obBa<>T)RM(o{`kwHx+> zs^#?|o1p@06j}OSEqRUIyMk0M1|>LnWXd{z4Tr+PqgIXo)JxTgmzj7*X!{o zpeZhXOd1Rb>f8ezH)IZQz0Cib9io2bZ*LKK2VP29Ayw>(OvI!bJU5Zm3o-V%VRN9g zcwW~pQEtArxl2kCT+;k%v$^TxSaRun`?@2pd;=%+uyT%xg-;r+W6^Hx?75}c0R=j}=+`JN z7uMUhSEHB1GfKr2mqcnkCv?4p*?*x!>aAx5aZGM1@mArA&oLfGX)_oCqmoO*0NEr* zMFY}v{hZKFr)GGrR8wTax3Ra96#7*35|k5EW)p9rVNgxX%YJ=FsceuGX@#E{(QvyUZXN&qVwAo*0Nyq%V+r#pn-ZeGncT2^a?Bu z&b(u```La@6`*uFTYdE1l_Mrk5X~0IXLIc3&#Y`tB!;$BgYlK?=Ag^%W(!oKSf!?z zM@ue=3c%c~)U)%}d8sCK?1WD49oeh-(*3-~y`u_v33@B>nRp*JrjqV`I92+{DyE*| zQuMUHJlNRf?_CZ~%%+qPhw%i=ELP6;L|{RMTS{^1#D1Pc*`fccI)DL!C9~}OL_#7i zH`7jLhMsNb2?Wku*(UQ4^YsD0F$ca^`|K%;YacErC7@TE-t#oh1FSDSg@kjXT~$RM z{euIR4sInz)*<%b#z zD?9Y}w=xi}p{Ye;5t0l-c&P2s%DURha5a=YDL&M zKV*W(dGga0{o?y_didmJ4%li=w!KT7mc)T1@FNeLM&57CE*loI)^d6dCA9yrY9A|(dw_+8YwWTt_>H6h`W zW3dulu$AxwrxR?j^Z^)w4|D&yqTuZRVGkclNaWKz&`uS^?tmd z1DB0pU)$r^CGI8lU;Y6x3pVqkt-mR!yDlB))Vbw#tg8iY2loBahK^JpZmq1-^x#wE zWEzr%KjgXD#q{`{7Zk4!HAW-^v>%*}xcKz-5p@REwH#!iv&M-`%fc7;+4mGS{ceW_ zKesE>_GzvkQ+yB_``+BlTX|0bcuY|$^xj`68(*%xYq)ukKE1!f9ddkX2`{?WX*$c|H8a| zEwpP}b^SFRoODYRX2s9JetS(U*G~ju_*KLz+eZY#_f_?slEov=_Ko?wX3Y1F?|DqW zC%{Ay&CfULrXExBk`h;zIC>co-d=4l>zBogYx3xGb)W}csul3Y=pWNsX8R=5fkf;0 z^=3u2g@msNq)Ba@*eOc<+OKJna3>x9iqRxF$+p9MQZ`ap2}rYsstHVdpZSudNs_62 z85M+=OD7*R8cSORETNA46K&qHwDV0Cm8+fSYpe|OG<{3U19*qvA66RNbFBDxIr2ko zXCcu-94RiT)72~bPz1D$$g!+3w8H$*1ZA4rA>FN0Lc&r*8iC(Cs;3XOj9Q$O56Im677CyJz_Y`8AbhFNkF|e0IrNsOW zqC@ybN-zTZqMcjksRPe`r&DYY|GMBJ_z-A7rZt36I|SO6v4s_VJi}|?{6^N{%}kdt zOH4u^%vxJ*(J9wsH^#yd7wlWDU=#$IcQ#0;4BM;!bNzNTy@R-5 z_1Af0@uHaA(M7PynEaj41lt2WkEh-Ap~wJXt)0pzWY+xiWLd~3WTa2)33%j_Q)|X- zp%{x7v~4ELz#26i5-Q<*#Q;rUzG@WkdbO?Fb4fz|h-ICqQ!Ypmo6SCSUT`!=me9V>uj%VPB7)YwS(eV5 z5C#|boHr}1(~q=1AlYA8zQc`PJAYUN6aC0$PW(R~F76~==k(20Ndys$!8C$X`vJC5 z3aM`OLUirKQ=D4J6yl!Y>h#qt)D6`@(#iX{ZFR^DpwYZ2N7&bSgDdokKbzB2PPHg4GerueQtNUoXXK=2m zrNeq%5RYFRQoLn9ns6@Um9vlW#~gSraml281E z54%drK;NkYzVXz{6^YITXS{l`)uO!t+NOrvgr*t1$Y|8w;Oe0!F2P26FKG20>!{&` zT`FAB=bu0`#~Mo+iw9X3HT-Dzjg`3Gi;VVBN>zPYEo7fK9JgzcEk3`gK25$+X|M;W z=x&H4kEi*GzS{s;D5_PaxUShxlTYxiR~cF>_E%1R&ssm2xtf@1MnY0v4W8_y!gNhb zE>M+_SBA~ibV%5T2Z$f~*o`2ZxfDaRL^zy?svYz*KysWKRk{d7S8|Z?pwq22Y0Z~U zw5Gv7Qk%{!G&A)6y#8y}`5DU4mX`3-{D+pMrrM&wP`T$cc*1u`B+_G=;zO#>z%&J^ zZ;R*h85+r!GItoE7vFLr4b3E$P_^0+nQ3vlL^n!PtW4u)ELr7WIRnks@LklOKqVYo zRg!M&yxgNbOQ%$LfqgG=d)F}OSIRqrRc3gE1f1Gbhihzu50Ot%X#GQ$3ijJ+{y_N@ ztQ^a=CxKyW&kqJ_7vbfLal?>Yj+RDHA8N++AoF{#Y1=$wm;Nf*0cQ%o$moq-xgF`) zeaJ?b}%{^fmRNQ3E|KhQ)KorbMr3>rRTPx(*smhG3i+J|D!nDx>v8#`o? zw#+Y}Qxkz-GwY}ug=|-$S4(eLRT)32GQpQJKqfNW(P>_{y zxehdhWCZ0M+jnlIpQ&Y*D3qLWRZPMwyDIfgCl&{Rns#2)%ZzdlTQ8T~&)G@7O~;LY zHF)0xO?q+5bQhwCBMG@Afn~wkN+%gvB!`HfQXsU?#tTKh-q{{bu!sI;YPQt;J#}P{ z+E>^%AkL(oWdqbXS z7TlA=K`j6zgle$`e%*B$+;bjJ4@I{HeB-WHc+z~mD$)78%@$~k6*dzZl9OtnxJzwz zX( zF~4L6bt_E%oxZagdE-aWuTgDl0mxXfs_4kcLgD_%oNpRZyk%v%i1Ttd~V-^zA!#X61pAHdgep5&{!Y?!m~{5 z%WfVSGOR(r$evDMGH1NuFf{$;hPnIwTWcq%WZ^}sV1i35o(ST8D%JjD+mPX$x#ciJ zHqRK--0sSxQ;GGi+?Sqc;Htut1eluIRRT-uYR++lhcjo74n*fqivu$;H8RSX1Ch_{ z(bS8|j+a9Dc6RR?qlGd2C#s{auN(Bdka_9xTIi!tlls#Z5Ow^HzBa1As{tfiz2?>#V$YxIOZhoI;Ei7qffWt3 zWsl*DSF`{9tJCU~6Y-O@IoFG~oa&HRKS5=a0~uV8#rtUv9vM9_oum+D@wAPy`%~Uz zk?7=qrNd2>#C|bO}P$pocKDwcaa^yk|)ids^xg6IUR1}<@cR+ zb}wF8X$JgzYQ0zGF8t$E+~bjr$=9ly5{x44*88AOgR@jsvGr;*J|$T2nA5(w zvxO-ZJRx0ChxR--Z09aZCvquwyn>>jRtYsU%I6iGe_D>Lpo&GwGFu0RlII@D5sF>C z5?(?Ogl7GEd`%TkZDt@y>SpY zgtQJRN$JJ`N`rJWl>yQrDdi9WQMz*qGP*k_3>Zj^5XM;j_Wft~?mW)j_LRV|_oM465u%06{WxJrosAZWaBSGz}N z^cDI79^Sj^Fc8-_;R|yke-{!vI3G0a6u>*G!u(3&;oi+F6x#neloXXZ`V&`xe8;}2 zD@+=Hyv!*6T54OZm&Com(?2h8rUvp&^FhsqJKvBvnJ4{dOOv`dT*PvsxKgkTuY0N^ z_UBkey1q~VW`9u~W@+JDYM^CQYPUurPn&t=z~cxW@WqL+tABjtfrVvbt2#))IOoM_jzr&K(7qqb)CRRPg7*S2YKEheQ#W zzPrLdb5Q$aDv^sU0=w!o^a-C;^e2(cL2DoDG38se4B^F1UiGYWW0xG@OI;z!?Ak~1 z#(^3~t>5q;PTnWhGEDbWtSk=G9Cg5nFFTBfU1_6JjEPNOk&96J_`bvei$7p1|aF9ez zIvdT}-(I*M+4nkZ=T>-`U3CVVn`+)C`vQhmhyr~$o-3I(*L58@3-{qQBM-JS9bzJ2 z;(Yb;OtjFASIc6u^o%75YZMF<(nuJB$fP~%Y8O_-GQFP|^mjNRLgQR>auhv}gk)8} ztTbz^s&<&F?XO{(UKeLzE=YL5M;h;~=-xa~L05?sAvu#Ap$`7TE-J{2R4#$uqHY|H zG~waZ7nkO#A*;VkePkVKxp(~rkzLPWT@0Q?AOah3c~r#U!nzh$HM84Z=}RG;t#V~`ky6aFg~3oEN)-1LbpH9H z(8HGjr>j3#G)Hrrv_KmZg>vVAq9QeQ*j|OW=<)&aXv5@B=iPb!fB#lFGTbS!BYE?? z5J0(gx}BVWeE6Hq_HAF2hmem`TD^-j%MB-E3XCH0_kXZ3spsSl`hC=adM^ARUj%{1 z8(C{pPLkjBzghZnun+Bb4PsKBVJg^ZbV-v)*<%nH_ZwIMI8TK6dlx?{n zQTjPO_|!6WTzD&cXC>_G>hQ)&V_c1yRG}gXrvaTt4o1t(`_5=UOOcOHf_qg?msA#I zBj;6iGlhw%s?T&Nm6`=8S1K znDtzI^vjoiTFa7jrxilMsmfPv!67kHKPW!hPuYy!{0yM$FK{(FJ`V!Zl){_}Z+W+d z($_-fp6P@~Z#%mnE2agmydTiBPtm2=C{Va#_82SvL8OZ(h4*R*9 zQK^|{mC?VPBmDj@H_D&TF>yG2I5geC`BKgt-)zQE6(mLa=BnuDg+Fyb4aWmel7rFj zI^qF*l8-M<7#+VF;<)#s^3t!I0DyvncARBcHHpiMm)dA%_OfS=@0Oa5EV$K9s0pRMpj zB>!mFRzm)rn&qu?{PE?4FC(j?zf|Y}NwWD>r-?M_jG^~W+k5f}H8^y&J86-m1A$7( z9IXz$UMua&X-c9hu$$t8&gSOkWLNP3%isrB|Fsj(7$`E)Qv%`Ij)3P3o*MS=)sp0< z<<@Y$HZ_Z+@@3Et+jVjGUq<$aY{yHBJ3K&rxY)}3HtYAI`vTnR9yS!bBFjj;)85?D z7!+ptPY2!+^40FS?_q!gxgtLuS9Mg4UoRr8%(bWD_@{x z53RMuAzA4v0{GXSVxQdhJtMQyl>{(cYKX`M$ShVE81;PpdtVx(3>62GBKU2nDE%E( zpcv=7jLh91OJh(XZ529Wz3j!#n*I$?Kb-NGh!}Tc-8_?%oQdfle~I@m9CKaHP(8%|96EcGyeA-|@CU~u4vkY+ zwi2i>>7I_{n;?4tnMs<6{nOUtbei=ho8v}{X8MNpDZYMx+vPu9KfOi+@u`$meloYa z?1JI1(usTHyMml{>#c$_hWcAMP6LL6S2MQMV`TO70SrYQ8;Ho5yU(uvN9Qsy_5)uZ znup(oY|y&@XeewwIUB$h#`P4m@!y)M=T9%rbdUd%ZvZqqO360??H!`GDeL2r^;+c< zzNrHR0hzuI6_4(;9~QlZHQJx_?d~exsyKY+hzFR7j2EFGt&B7psYUaJ6I!-*tW3H| zDufV-C`?TZzk16S@HAF_{`s!C+f4QUc8ZYC*(}{COMLd&oM|m9W4C;7DAYO^LAtq2 z{jKrt&2R1ZPDhpQHJOi#SNrfW_lTYi#>s;+K>Kcd%(rEW$!l7|VGD}t!yFFvTO5DA zp~Kj%5V019DrOreW!ROfHII>}&}@6K7k=CBm`||6 zFqr-ywy2GcDh3q!=HnLT`2jyOu`fHQoiL+Yc@^JPzElJ~g$znNYZgIGzS_6XmFRrm zJ7hWui?aLrT>R=N>=5NYjuZs1Q_e$S>Aa`x_F(@S4TOU2_F>aI2~anP^YFo}aML#l&{t5w z{)4QCO>L@Br`VjXczR+9x>Em z>vBTV)9>mT@~^us%M36;$`Em?Q2kg|r1!W%+1EfOe-@k93NT|BRma#lll#{-%Jf>y z83;oh=f(Fs$1uR@_w$Vps#^<;ODE%gU=y28d_WmboG~T!i2I^7Qa-gf{PVMg#tRB( zeSweY_x=bq^nKkVuS%e- zTp>xuO_j%FUxsVfDE3TIN$HKdzxB`L;L{CXytg4y_t6a}wovP@@FNO^$er<0J;PF{tRJ22 zpnzWZCo)nctC#y{m^1!OO#pAMq<&7M~d_Pq;$tr^G+O4Rn$oc@;ENM>wTepJ>03wv?A@^WwL3@OOZDXU$JD2=xzGg%}d{@3JOw5T09O0I~x&aJo-l&FUEp9Ex($qHvm@stPfE7^gqKt!XBmUVPzt6LMw4f<&N-~y zz-XmT!5Qfqc~}u#$mpi1dg<=y8NT998gHsG!eI+nqcSgOGq1l6BX(lwuRf*>{`MFN zX?l8B>2A~i!gh;MKWs%ayvD@Ir=5W30{K({m+&5N4Pkvbez6S@up+5C3L8Q#_bsm4 zx4*95VaGbMC71#g6)Wd>Emp(Un&CR&ZO4DY@LvT~y@X&7TGEZ<8u@-4UYpSJB((VO zY#PHDXDFkOPcizpO=Xk$UK_W}|Y4L&pnRgEHJ|=M({`%1pdVEt;H#?sXHG}@m`6PxLkVTskP#Ix@?5G40Kge zeK7xd15MTi5x>Q4HA+NhPQIx+8=JlAH}t!e3OVNoZp&&^fj>(A{u!jMtD`#hA)l$g zm@_)lIPg{DOo+NVda2^Gv~MYDQtY6j~CIFOe#mi&)$507Rq*&oKm zM&+J5fFe6KuErFeeG?q%{-cl}eZE780QBv}eNsTJP7p{K0sV4LM#SkeNwC;j9qQ34 zx+a9!aJw6NYQ$+$jaI=IpEsX9`Mki=)s{>lgH}*1U}##AGz&(i1ZEgMu&?I&>((V8 zf@MxcGf!phiZ$oHgV^F&j1dE)n)BjgGNS~4Eg8=YJAS0)BHVE&H1=`eMfL0A2l_5- z!ACGoq2MoF+KfHgyTl(1*2%%7qjYEC2Do;mYG2*qK||r@S>l^j5?&Q#UcS++h_l@T zQAJdsBA_IFzRWjlzM`|SB6Zhom67{6WW;UGvQ0 zI=#?O5uc2iq`bTe+@d2INtQe?g_qB!$HK<)+XcHmk0Jh7P?lxJG|}~#$ZX+|-k%z~V3=+h zZeZ^*(pmDT%p=+MTm5RnFwwNyL=IMWZd^LBcOT=Sr`1|zl7=Z^%WfR+SLW;IoRYp4 zeZEsNLB>PtxyHF>8%6#wo1*i(qg%cZj{%<)Wg1xLgkodukqu5cl!T_EHt4+5srJ1nz#G@D3Hc@eFzq1)Qt)Fs8$Pl#qN&brmL;MR|Gmks z-MhknDb5(H(QEb%jEJ<2lBF_*UUbwUkzb&y4O}{Hj$3>Mpr- zl8Tzje)ks-@XNLKeAzFBX&M(Ra5Pef9n199m~Iz2_B@6gj1v~~3;znu+P~f_ohm;3 z!{TQ5x??HDe&=F>hvB9~5Gk4a}~)T*sr!0pf_zt0r20lsU)v_n|+afFFas2}_iA(`WmBu@H}-u%9W zB4=X<4T<|cOEj>ZDr})}ZP8RV{_oLOw(!~DyWPCA#dQmx57H z|3wR+GtRSRp19RyVGwWA)hP-@TKYH<)vE#47q`B%@#>q0Z(WX+a?d<|l2BP>?DaEQ0aqP zHF_$0zdLUc=)j+c>*r`XqCd-Rge$6bpF*hn6*z*${X!hVoU(o_$y4Owzc^nNXg)cP z@M0!#_mMU7;8V>{>o963>d;tDF7EwdRl<{m9$$DFR_G2RjjznXGT#N8Bumi3=+oYx z260^1Mf<4&@B_TSlh@j{HS2%a4o_`Ra4$>V=HrQ*0F(l!bUwqR|VZv_C$7+UlG;4?R=#(u^NB?+)k#BE@5|ti zjtg=JVyl3&nN#N_3_Ct@51QYn4w;Ku_LmjCf0r~uRu^(v+o^x`L9uHGM^=RWZP}HF z%o*Af1A6~>H`Mm-u*4?Pe#WDrTPrC#ut2q?Z=)#b{KNRu$@T?J&hko#A+az$JRY`* zQEJYMdS5F|x(8ilX&Jksf)VcSM|P;RSZ$ZAlFx60uv~G>dUj{GK@(hYS?CfZh_he0 z3Uv>lrm8_IcmZG=-24llGoEYL}T5=nd%meHo;{^xrt@vE~M`wI7pM5HW5XhSWhq}deALAD!M3d5J9z3y zuV+s%?s&5F^jZz4NYr|U=g@b}yg8<)D5YEh#E{|O=l7lxSapkeB65tQa)Ib{W$)UM zLI6_603J>}QlV7>co>LW=Hw6PY)JoBpc9+3iZBj!TibryB{4D~3I)+7N#L8++& z6Mg-?YU^Y@(5s>V)=Lc4HQ)O<0a(>|9ja46-TDRd6SqG=?$1rGV!SX&fMSIb$Yi!g~<1uHeJTIJ=mPp@-EZ|Eu zKAFEmK`6zD=tmU(t$CCo5&nP~GPa%eqn05lM{t{bGOIohTU+RMagKkB*;6HVG%_FpDljd*hz)(8MyH^hU_rImPy+jCHFj@7_33^-m zJLj+eebZNYna9SEb0}^| zzn2C~#Q6Sq z{-kkK@7lFgUNQ+Tz%MtV<^}&yvJtSa7(kdoGCVJ!l{51FSjG2-5QAj!_>@w)*z2X= z4CgbGR}Q{=)>$XXkj@&~d1e2YgvU_FrVSH54vBP#7S=yZw_O;F8zJh>67EdByFPR1p z!vk>SFc2sru)WiJj%B=i_~@)24QM`$OR(Naa_Vezuv1t*c&sPZlYblmGIY&q{OkKw zFP4z{1IZMwlror?_}v3?H)i%dt@E}1$hEh6yk*d})^NgcGzRFgV^m^+3*SB35?=f2Ta#y&EVYy&OL zQUVePw3K+X9Dv7=8T>CeGfK@99TSxc#B{U;PrHF=Nue$sVN&XknDQPS>d1k^k~MK_ zNydgAXPvOD2i$i)-j*Ns|CK#;Jonduf0PD;I>jVG_b|^|_XBWf&EDCNLRG%ww%|<_ zw}ShPYQzV?jm}gbj5mCZv$6OeBkZ_yo^U`Q=Tci6aY&y4ACriB&;y|qog1BYiV-`b`~w6))u=s0bpXOCl&tznXYo*;JZ$>+WIL5fr03p>`tM7<{>QM5 z2*W#{IYo08I6}VvS@Gl$VpjLYeLd}BtBpcI5fy8VeZ}nDLI;rL4oiYev`j8!(XKcL zyGVEpzI4|Zj$x=rW;zJ!s~tw)l8^tF3wUHCs`!8N_m3F;RgxS9lP`u&KCnnK#a-Ru z%>89Q;ko)a36Tp>L@FE*UiNEkSl-|b(ASV;`WsE(zf-5#f*)yKiTncndU>R@m$hpE7KZMh)^%111Jr>{db? z#AdBN5h>Qr?E63PT^D-6@{E+dn2Bet&HiNM4VXs)GD(PfPLJTA`m{3PM7fo0MDJ0O z;r#_)EuGNx3jq2C;w<207HQf8fLcHWCA?*~W#wxwEdfK)i2f5tM}aaG=ab-xR>||l z5j{r%7s6t?Cw2IKf5Ewtqd*pM@z`k~0Ebd~XwghI?;TD1Qpf`lU20SI>iSsAD00)K z7`0`Z8|n!jfNSO5mon4uWt?&>KH&iF3u)c>! zr`->sciYfTfosV9t9K1|;Nzzwg-qyoX$`Vxg@K;b@l{PoUSaTJoJQ`*0OsCX~s5%0)eP%RT{7by&&ZVjDirK#Y@O^ai{jiK>tT*z2l(DNODF9dc5bw zAwSG*@WUOgZp@;Y%OsEdc#m%HW#fD}OQ>`mLJ$Ce2f8rO?Q9+J1J80()g3+!NC+4T z;AlaFfSfg-c&z=BFMU->pMcW%pGDD0;} zPr!VcI_t!S7lZENcs}s)f=o#@i4TTdFuZ@Q1k()CcRu3*u)Vk>^8fnK(f?yZ@c5*rOb!Wrk z64yI>rqH8%+tOS544)jbuzG%3!7LWa85YW#m8QksiPJR$9zxSM%c;$K8@+1NDC&u= z05gdzY1ayBMM?II&m6Wb_G+HGz6{|5w19mPqBw}$21aq|dX7X(Mkb}7Co-@zkN*w^ z6GbRaZw777I|Q8EmJBV%l?2%?_;^M(G(Lm@QMy)wr!zP zmPKt`?xUPk4mlU{K%AU)PJO^Y3r&a7)C#n8!6n*^BoEt?Q!Fn+L8#!{BvHYDGDD_mlH0QjTe)FIVnl%(QbBm~l%5K1Se-I^ z!P~6`N1i7nT^XqqEj5jV*~M&kn=yGcsoFgpk&oM;sN z<;OkQ3HmBfT*`jCzS>7zPX;?kb8(Hbfb*QnvZ@A2!=wG;jG5#|JMNI!+~Qvl{!=02 zYN79}6~`Z>A&cJi$y1;F-i8R=8PiHgIoHMNJW*Nj^5TLBh>dI2f5nyAExmOrzlQQ< zf(UH&>>uOyD9X2_3-60&))tl zChNovX+t?aQ&sDFYd6;(K5lqazyCqivx9EIKU+n+n0%%H8n`vGQl&)F$|F2cgZ~G- z`8H}F24`SZdxOpIBa3wm8vTPa?5L$5HY7p#Mk9IgfukyH3Ko**{|EGQNFXad(aFmV z^MPqHO}H)n*SmS^sPRC|oJVRv5HW}=>TVu0y;q6;KUna3`d_nl^gHM6)z5zkUPgx8 zyjfAZ2g;m{h}flvr}G%yNq{QPFz#gw+494eE!6Nlz?ny@UUCQ@{yp5$e4iqF-3s!U z1nkjNYY0(NWokwA5&u|l_J7p}4Ya*) zL83C$-8{q25(?B@G}Q=RS&=5K7~}7g9kihB_&76s2a?w;a<_iP(XHgR4_RgulgG}* z^JFZ1iy){*QS%OdkmcqdbhyT9HsHa-)YFt?G1N?x=fyzH@DIYC;d8RSq_Os$5d0qW z6R_T;@_bcrB_ag~I)c+m=JaH0{3JR8duQR!sA#Dxmk&}{-vLtT)@DmU|Kt)0S2K}5 z0FMRCku$=~64ITsSp@HpgyfMg(O+cs^KfbRum71>XGJw#lV7jNCo>D0X>F;%RH!B> zs*~GHf)BVMfyHd1@+_}G5yI17mOEA0^5$_R0%o-|x_SB0BRmZ+5|CrX0{XQyLwHDz z6mW8pZP*p?H$xP@9Y^qNQ;XWVQ~|Mul7zvmY`F+XD? z4x-3v9!+uu0^gqsd1lxv#mU3*X=tN*xE3Aqy*Mx$HL7P*V_ z5ck(3MdVI?Pj;uYa>vSFO29N=DcyQ*^Ptqjw6%p93}Z*LahY1;=%{F4_g|5PdG*_e zFIkJpSZ=V01T#|zB~`Fc}kFMtKfWedRU8G+~fLuJ(OVM7DiK>`woCp!h;^t^L ztghji5`Tag8C-qX_)~^CF94 zSW6}CUGuB&pZNZXHeD(9z69x1)!!@RyCXpHr~Qwi^Y3#3LK>=MjN$KHx+Q|czmTxN z9h@SlmjiczfE)efz^Q!gGO~JX$8EcVhxYerWJ+vZ&TSbDke#v4{dnl69Pn02EJjs* zrX?!%XzbB)-cfgd#8VmeHf$8g-AUNwRsSVVJJ^@=&{Mz>t?+FhEaC<*sf)GY`O>2O ztvg?d8>VXTEKNr)Zb@mZ+o;l(v%#5gg_1uQL*}AA0XK-b@be3vvT*W4GOvC$?NZx3 zjl`I0rkeF7UGMG-pst`qqgyG#ghX_VD*D z=t&Sz*L6yrH@W&Fe4-SDI-fur*ubO~BKvc41 zWlu(=jh^4D&+kxwaN`iCnIMTiFHw8&Phu*r1mc;x8D?d?(|_nl&Kh{tYJeAlp?1@m z_(so>kWc$Iv2M~mPQ-UA+CAti3QP8Ec$Jf+o2O{glcq#Dnz==h`I8?ufj#eMlJG_W zj=GdiV?m7Q&P$`Pi50xE`@6}|K;hRvTGm|0-!Hj7vC7?~3Ru;+b<&YG<>3`rJuQ*j zq{B^yKM_`5pEfUbKF>2&9|y1Ry+2<(#asg)L(|QiJ;UEkhJXgg6Plf2xQZ&q|0`@G zlAS?Q2|(q$0}Z~df-PJb3k~w2F0s_Ry@5 zilL%lts0x^z1k$4|rs8 zGPQIDAV2tR1bxuR%>|pBXULmGl*x8jC-`n&A>q{5Yval;mro%K2#27sTWARR!6=*~ zbJL2Gtf>7ndGkiG65}@2hMms{whK$SJm0tNo zdcBA$0@%mnF77W!QLC0;J2<(l)dUUkXvp7;UAjf)|BvD0)WL?DWU=qu1DKnL%fe>M zn@=_iOP$`M0_bBYDokAj#JiUMP zb$UZ|h;(3miZtdmFJ^BD^-sO_~+XA0IH!QI6#8qh^pq5_gW5Jr7 zp>4#7V74bKsV+vU?>Uw=IM0x1Y4ahiUhi0|c{p}R+%i#`-Uk315$}U43_u!t zc%ZMnu>C0%!~)UxXBYw^ypy|MDNsvO1%))g9?mSrA@H^41kkli^r zHv1T(A^GJnJ~gpz54@P7&ljhA-m|j&Jd7=Nfr6+)jM=;IyxAR=gpZ~QDr_x4v7CG<@YztM-OGSAtwy5Vu z(C_>Dg@~n*ZL7g#KQP`9yJfrn(Cdv4*|8d?)~~qFjeAGqQuv4XT~3xq5>xwYj)NnW zPH*vv^LM#B09gm}%jP&7sxR|!dZE_}#;MJ4uNH`f)-h}Unpf^G9hfokk4eyu>U@xL zidT2gi1c`T?F1Kz$GzpRSrDE$yAnF#&@!S~k-qu7Yax4@OKlht?!TA{Pd(y;ah4TY z)1?i^h@+6S9jjRTvv_D}So9bLSf0G5c zs({-wV9999;w}B5q#W}2m4u?1#(71bbiG0w0a6(kXB2-J>R}n5{>-gL&npqJx!B67 zWY#yj_hS6pNQ@85*bOh0fOwBZa(*3`Bdd7%{DSU!N9}zwN{aSZa$O;I6sBZ#t2tA> z?4J~Ec1h4eHk!;`4m)ZD4;gjn4H~&C>GvJG_62wI2-IF#R6rfN`#x%Zrg` z_%Be6(L-ds`=t6kitIbftN^%doxR2q;=dp$^~LJ%4UXpxrPyC*C3FkM_faA8 z$TB&O#D?C?6s4$?xI!`O;vwrVz(=B93%A~2zZ>(sMXNUkyDH1@Ig0k^JNg}7rg+Mh zL4d)W7b#csZaPG##Z=F&fDkr0^&@2g&;7aQFYjX^HB)u!%3g>_k<)#H_xj^Ke!~nL zI}?DF4ov83TzA2R_rK;_*TiFgU32t|w&nH?>08GsvGBlvXLk7*3oBVa%p5liNVLNl z`YM4m5}!DCwV|nL6VP#dOWaZQKYO6p#|5qm?|liqqNY7TkDx!|B@~7(O}!-f`8{-0 z)$g+?Cohl+PWr+9nDMQGH-81RH?ntIH3X$(XllxCj`%~ zKch9j2NgKzg*~Hvb?iJH#h>!Y-Puy|ET1*vt?-a8(3r{K(2|GpJuF*wrMl*$ovRh{u!R!X1eV1S zNp*=_7W|0X3GQ#;SxJn>k2$G>T)6JE4Xp-^cvN-V)7YFwi#|%Q>hPUXRBHZXZn9$1 zW5I(`&1>K}rud<$xS1pT2FFVLbx*lKe4o6Um6`s-7D3bbOQ(L0H>8j(MY7vtdrA$7 zaATTP8&4Mr`(kHVOrf~yi)^ywqv9P(L@6#^9Q{4*E8>w~R$Ky0vg?U3ZR1F?keqH` zFC%KmKn8E+p~9lev11`sT+UB>^6u-vOi3B=A$^1j%7UjJ(YIZ~PYd`j%&5QiQHiZj za{j(-nZzSRW)O!=4x4kz+<=Mae7&K@G7aKUm!ZbE3@YEc0`?~1R_jIwbqcnUi@C3jo!=v6N*hSPo(Wt$*`)6P)_g>$0~(n}V?yERe< zY#Q7Y_lYIBV#AHrU?jN$>qg6^m+U(G*ZJGYD0ek1j0&aue15WXG_>KP+#NCLVw3;f zrD^UDm@gG-spJRPCI2K@(38#4Nu`4_N|f$nt-f6v#K)lIxIKzUIXpRTNdRH$d0s!8 zzptj%m+ZfDRgKQ!L~TiPu;#F%Hl;Z>Po2`Fx2^s+mb{1`ahk7^1?B@rQtFSaXcNNp z((2Jxv=8-?{T3-Bk{-YR9r)0Q8}PWN zbuihw&U!9VOfD`3i>ZsvRRgG7Qihpn`EcAT`@yy)$cMA~)a7o}%!3^-d=ulmV&$_+ zfnT1?n+}-DmN5@rEhKAx+=QFR@{1A$?$-jJ!oG6X{znBCijEl|bJYU7c@O%NEbAJF zQx}ZwdGV!A8=Ugowct8lF>uyxMdjRt;%65{H`5l!-7ao<3swx8rGqzNh z3@43=fGoGGs+Vmq_w$0^$Ne<`1AKF$&I*}ivwRb4Bu{a+6D+r{I*|1fQ?G5Y8z&GU zH)@}pg&zD3+7y~<@(tP`8gFQ~Hq4;-GYkY9qkNjdHlEQ^>WKHA(Y6=7g6m!-a5Tur zJ0oOSZQx17tfESwJ*fCW)L4Poa+m0<8keNMF(eLp}2k6-lt6AU9z zE)|sT=Y~X9;W`(Mo>#@ah|S5b0_(u2Oynrh`Lr1=p2fzzD(-HqMM)J*7e-|&H!F(5 z7|aI7;-~GW5y$b<{ui6$mr0rEoQTZ0JFyo2nQ>;X z2-!mJIyO#(lzGfFNnKZ?>j~;ISIFIJl`ZFV>sm1BSF=CqKQvj$o!W;c!n51^eCJo= zMS_qg+dA`wlls+cn}r@(*;-?0r%s_3@Bbh9#DzAdpwA&$?bprz6CT5PsgZH3*-#os z<+K8mHzi@jm5*}z%&}jbN)L_wZ=nt6jk^TIHpEZPg@XgInQC8Q(Rz=kf&Dz;n{~TR zzpnk>heSW``#1k)*3OqDFa-sVe6DdNA0|dqTx&#-k1ClqZW8Y*ef+%T$dq#4Aua}9 z#@PrPWhq<1{oFa8x5Nq@c$ctPxaH|YUUwNSOgOnFQz%DeTaxu7}% zt2gPih8)=*YibPC)G>>yQ!d}JFYd0l{;iO&s;Pmgsk6uYhoG}e<+5_)zOHua zCs}Z)w&u}UtCSuTSQb{nHa6?*`v&)o&`;YHo?n<9kyXt#E(GqX8}}%B({IO5naa7? z{Y}k|s(qLwi11?_mYe9f+hJ^t;+k?MO&iUmTeG$VxPR&YfK%RcN<*esTlc$jyw8n2 zY_q=o2qyRKu=2^s)gL8Cyp0Ea_vnFbP+>U?l~~8M(&lm`!HL{;=NKO8%OIyUW7Cqp zw_Ob&JJBA}CjE(tiO+4XbXY`figQ{PdmHFW`GJ50H{%yCq@QYPCMAlCXz3d#h}HeP z>8>Yg^TXv{qIdT>j^2p1d`XPjt&&sb!NOx$49-8Z{jrq2GMzU=0^w+aUm2UzyHq6TTB!!ee z-N_3{3*`(A5|4Ul<9X^de=;8!@MYN_9mg#Vu8a)KQ1@J~Y|YbRgGUzkg}a=~18_!g z-4C5k>)gs=#q743X9l1>76ND4Rsj^Gmw&1%3fCR%a9Te~b8B4iI7KP|Omo!o$Ri2> zXUoTnEBYn1b2LaRXJoGkX+r^UJ^So_YVJ$~bi=U-l&AQ!W8IV*U|D0AI|Q$w_pjMH z{7zdzpD6w+v1>~`);RjB`^2E-jq-qtqZ#i)jS6}WXM$P~4VV{!(W{^@FC~m`!A${+ zh?)Fo5g?e;$aVZ1G|PKx;Guf9G23>CAi4N?B`e~j=y~Nm#GZ2Y2` zm}{2!qTHdU!th7L0e7etxNu{JIvQM4BE_&B!b--8_nMd=Q0j76!R;bf zpRy^bv2gQ$a^G>Ruw9X8i4^36Ec^Zmfn#ydocR=5h9Lf4au{=fha^cwntQGB8VV&- zH}Mx6=Fz+9Di=vH#pLwP0Q@YqE54ovf)I1{?(RxO>0xq4dJ}s$Fmo#6F%?YDOOyKv z>V`tI{g+WEfgsG>6x`A2CRk+{qfZ*+6{87ceNA8H8LBiQL!Gejtm2DAOgh*9Mw8G_AOFlLgn3@v=hmUt2|%nr>LhKmM_DaO!Sj*V36Cx>tvNee2N7eD>k z9H;(K)#8txGPmiUJD`}a2Jd#Bj33RPS-KBpnLAe2Q>eHLTvluSkEq{W|54yC2t2&X z-ftk>qhM!iL*{So{9mQgN2zdPWSNl@e4_1wKZM6|(!UV1IA7M{ta7N0Pdg3f59VGv z&;H4fb>N@u%VE6xO>V1F*gurww(~Jk5Zq>Q47rpCPnuYi9guyQt~}9v?p0kq^tqjA z2TQD~gwejC<;q$OAxALRH&?W_dukg#lD$yhHy2hhGBfvwW_81V;b?8(#n>hf+`z3Z z%ponP0ghc2xWAKtS%IF|UY^ZiDXyyGO3BWHY&0x1jhA4vJg zfWvvzr#xMqo*;*m3cubzXOG^^*&)w&c!m{3hWPKSU%|;*4*xfn5A7{s^Zi<^;g7wv zTN9Ts!gouMRVhQm+xM*1%)ho=iIOnV{`fs0cO*(V-lSr9*fbyd;|ixEpxCXL9iQ<@ za%D%j=5VfzESQCq=E-m9zaH8isuq{K7d_cxnH^Xe%d8uw1>Fr%~bk?JpLQS3hyfl4J^ile%>R8PY-mdtfNP3Mbfo#ws zO!yDDaj(nk#l>~ds^kqkl8$<$w~bbvSBw;?X0kCI>RBVLTPwgGh|XQ}Y^M@2?;+Ds z4|Shq{P&{er7oj28;@yfiO??eH@uel-}~WpopC`k@^lkVXx^8$u${(6fE;`aMV;6P z2!hL^2ex>+i+zk9N?jwfUtJnRVEtr@B@2v6-^r~QsSE=vLbhU0@AcP>fYVwMGVIA; zYiQi9FSRjPF%T-|{r^*S)^Sa}@Be?BFp-uLiP7C5ty2LdRXRnw1*92M7@)Lt;{@qY zQgQ;)-I9|S-8IJIeE0eN_xtah$2s@ov9s;Iulror^?JStry`K0a6Hu5ml1K*5y+;e zH8x)69}s2WdMbRN5~IJ^dpd)tB}YS*J=u(}4r4~T(6!`5(h^SMT!Xkf9}24RXp^tm zkxBscwmC^0bgS&qs=C9}AQtLl)%$T~nbSpdmtZgf5h!LIQ)FCM_Q~*n11GvpUwVBo zA@*|6C9%sLYzpAYl9#^CxRbCm7u=nFU8fJ^s@RP!c-G?uv9ymv15~B9#lzD}J12GWEqF{*tEg&vb$9A)5VG98v3$+ScvGdSwTjR9P5K}q zDF7)HtjHgwPb{S2&TxFNuPoa)3N6S8ZkLNnl$7BRT)AwP(n&=NO3!ZWdfW@!$^f*e zI&e6wCJTSQ^mxv#fwGgPmVVMS0s6oORIC@m;GXD+P(a7JeBC1KFcbTU$JsS?u+p%- z*@)e@@?@&}#3`npQ-m=F7~s99I*LS!{rH2HLDL20=Ntd@l^LpgJ9tQFg7$)N>r0@V7NV4EI z_*HsfFeWiwA9tdh&TVzx@j4y;zuVi>H}|pat(6CK*B<8YlWh3V55>E_uhS3o2BJEK zLLiy?Mj3hn36uPP!S2lLFmkN;j=^G%@^DAwOC`9J8kLBds!QkzmBiXT5eKQCmYk>?#(@~6(LsZ zfA9Vb6G9d<(H*@wyLc7>hchFM8R%ZU#V;FZ_I)}IhJnGG42~R%J%BBKu-oSQn{(amTY(-1>b1tN>u!)4IHF+nC|i7NB#J9xHdkjWTVi!d^iV2cWvct;NqJz~ ze=Q^?d`g?@D7u$JjZ~j$4p+-{ami|!op~IzyD|To9_6|RcN<6;}V+tGv z+qFuL+JH9APp%0Bm!3R;pjl79c+=`Fc0@y6Y$0dI zO8>I=QsE}bT4(-izisU%&3!dB2S_7ozLX6PJHE9d0fuAs@oq20@Hl{)@f+(KT} z>pNy6XSw59<9N)s8A=?^)5+;FxZ; zD&DCB>4O`-)J|8b_OYMq;aAYpFBLaf3r3t{|M{V&zea3ZlCJmudLrjhMDj18-(idm?o%D581_%}ZpX!dC@An)ql4P< zx1D=oHcUP>##aCACe6h7&WH;p!o_Vx*^?vmnENrXxknibhePxXL4$Ru$}=fq<41|M z{B*Ya@-%!R_CtWp4V(9{_kcSiP&7?@W~Kg({`<(@?M{POMG>Mc_hUw<7t5L%v`zzm zH8U2~#NXbkZdk2JapM^}Xk6)WS_?d@TPOn-)H_c?iNojxO_Rk@WD`#2>LzOBEjU%a zT&d|x;>pT@@0|a_QvvK4UjdWZ>_cCAgt9uDy*QHxmjU!4$99ZgugL^l09ETpZ{s%( zj;w&Ee-DzQoluLm)Kf^X%_f)SU}^tP(!J~2Y=fclkl=8|>>QRGU=K+XTyoV+$4bd@0LVy+APjF8|>VekNJ-?6thC#Q#) zo-?Kzxtew{`sU3@0gRm``ZLI9meQ_seT=4z1t`Rb_q z|1Mx}qDUhGRS~dTK`%!6?{`4TMQdA}-MNTK67 ziE5$tU(kyNItSyg#eTvz;M*#pl?f(icRhKB*#1+gH3waC$*FkR!!O0ZO(q)^UC_ql zeUl11>mE3pN})|M{@QD;t{L-qG;u~lB&cYRT#)Qh!uxAr*IPjoVw?fCW3NljX|?ps zeXoIW6xRT4*Wz?R|F*;HkPW6tg2mCXVpNxpffIY%2mP}MX~x21vGWIJZo|8c@2}Zx zQK(vtFK}7f4ezFhfWiA}r(X7JTh* zh#{XCSFBb|sCX^3dENzR`XmAFUtQ=6ppXJk-Vpp_??12~MYYSx6VRk$^ive5+&p<9 z-cxM^=BDv#Q_@m{EdHBVx{990a|OhzzJe5+qcc+7+0!-efRV>H4XDof@KiyHyM6GK za(Z0W$W3Ph(AV8kdolC#^$?*kvUk8zfWJ?p|3S~U_oO}#0R=8LxA9>q|Fh}lyybUV z$nlQG>0n6&CLpu+OS+Zz5r??aJQp*u@*)_qWB#VU!2NPENRdvF8Y7Wl*1vJL`b;uJ z68tWyVwXGD+r(`(w{Q_{1S7ww`UU?-D09Q`+xyM?xJmA^q|;nc|4^-kkpRZ{tRZx6 zSreSbQE(EgGsz48UOf|nSPWH`n>|pzc8kJ6`acLLR2>G_(n$?)w zYxyGMdFsC8k36FdZVwe?CW*@24%TQBPw^EZVT`XR=i+1DytUsjw>@VS=beH+nX#?S z-Kjl)@GB*eU|n;pZhKWt!W;v-7lVKP3X^aYe0^0>!a0;9va5Lgpe2vL!rkWt?QbL=_gvrs?E7-Xv&j;4_6!-D;M)0%}kEhO}ljq!yc*k=Cs_WA7p> zcJpK`Szafze7KqQWra>M7NT&PX-q>mnsWZ2>_VRC(4ta$atAV*&Uh)3?=xK@q5A z(q@^8=`{9T|LrZ^U^kXQz@Ha!q)~Ga<(?lEtin{B3gtzJ^%mxD!>V|u*86DtYeFp! z2s(I(KnXuUJ25csAo(^H!~1Ij1mSVeUHT=EuNbQB{kt4@)$ALnbu1RW4h>> zfiI9R@}*;#q08kJBk5wZSrgOzGk5reZw=cTJohI>lRxMbHmA;P#UIlU2HDLn31zhj zVS`0oHqffi9{cPrs54LCq|VK;GwnT%v^_KZk=BweK)uwy>g47i*P&R$CD$K!{(#xR zX3;)yv2h;dsVT>7OYWG#&?w@)5(1Ht|76+^;{H>|h|)}mHv`x{{6@8@X9u!`>z;?iwml}_$YGFd zG+^X@cI;pMXC(`qKAvx23<$sQ3Y@vpiV@4T25rFj+14BlG%f|oZA=>}-)Es(q-+a# z{1~h6_&Yd6^kD$o7F4|54ah;7uNcBR<2Do}@Jf~1iSn_nS>>V`gg9ebA-RDEx>%PD z|H65Pt12!7&lF$6bzIw68PFQ7-}2JjC%Gpshj=Q~Ii{Z3CH<0M5WpgR>=IV@d;@SvYxJueJjg5!EM-+D^_7w_RH<&j#)sB)Zcdhz!TbW2w%DyXG=UoO44Z5gfFd!M^> zOwv@R6c_rWPVU$I!Mi{+zh5E#&C2_YE%?T!R<`r1k^E+HhPR(G z0TTIin*yzw^+~~@`E!%_MwO4er_|ybV#kTKr51Cm$;|2VttO?Z)3>r?HR+6p^PPLv zvvdyPUnpZ`zmI-#1(l``1hKP87YU3G1(l!eY`=98sCwNqTE#76)E9)$VB}cH+ftiY zNLp9oOX%+PBPH?3^^C(>Vo~lx#9%g?Z7EX>w>(O{{QSAE=71Pf>(g3wTRe@mphk`8 zRl{}K>~gJ|2*+A{)Qbi8nmpK4POZj@><-ucv_qdgvh;4iQbTjm8;;1z8ll!3_L%>Q9#5uKMQ-5u}&3w@<&*D9&qvJK^YlX~#f|xTbMc zH7fUVPTxLZsD+^(9a)WzR+?=CL7|lQNq2+J@$xiMBIhZxTgZ=zp>0De7K|lp9u1Mw z68Lada_H=!ABV*xze{+8aUfMakBkG+Q=U$rn>En%o@!nw_v5lJ`@bgf?N;v4>NJ#Q zU)2`{HR{)l%IV3sScqM5@a_9+Rqs0=p1zkzaUEp2H(?8s-Z3HEh~-yB zhvwV8E`fEVb*dM>!D=^>F0SQj+Z8FiVPAT}LEqzBayr9eow@X#=LjY zVeIwkm?^>sFAgD@b7DrKscWC&%)>sPT<;%0@r`$&^)+lUGWmm(RjaTWx*k{eR!DNp zXsr#U!wg-Ght%0=Hm4d zk9V~{sYRP#y_T2zJ{CX$GiuH9u&@7`oaDiEce(SFvARK{yMEx;=R_<11xW+#t6B5& zX0$x5%dXvs+~)Mm1y>AZ%`smmB)4Lf#4;K2OFle9J#}iI=5xhb+-im4)^*@SbF^j| z&!TNJRrgvfUEdMPlkd_aMnR3OUS1D)HNY;~nknI%?bh2qcFyj28bpmgC~wIe3uyVO z_pn4?C$S|h&iftWRZHI`vMA7iSf2Nt)_!rp-H+o5aj2HZ-|=!&o}TU?k-Ljg@$|i- z%6?hiz&C#5WslNE8oYnsICL?(GEU9}5Rd|nB-#z26yWlXRxO6C`ySu`R-(TQSD~;FpEq+el1*_nmS{C$aBA3al?T-XZG?C$)T1314oZT(*1LwBfo23Pr^N1bE_)*SHz>-r&*l);-L@I;GzBGD?kCTh_Vt*Q2Gz zUD>9mUydXHNAl2^@fvWT8YWp^?S#&wow03$7$xJ!yNTudg2uRHF@U5Kew>ag4#u?E zpX02Ff?%v_m&ZeI&1H6EdCL;o+1UqcW|?P{UtZabR@IBz)ZZE{;Wv;Ud_WATWBybV z1i^clc9&11Q9+OaLQNL6Ua-IH6#X6Zb@D0Pix|@_Glqxo?%2(GzB;z$P*Qa@FaC1m z$r6t38>sHGI_UbmyCOnLc)96>z_bhczF%{nse`Q1Q@GLlX>#bx~AbJ^}e7-@k4CxrfWW_=xJkPQw#gy7&mGMbd_#PuEZ(4 zV%0kM0g7Jxr*p%6h45v{e#MpAl5SsUG;DSnrP~+qB3|3jf)=Z_DB8oJo|i!L@?US~!pkru$ngaKLj{ zSzN>64UEj%wf~l^H$UR!mTB+H%^gV@`WWcz_T;fMvbj9|E^uR14ST;5`9#Tz^}l}_ zy%6=K1^BtZ+~Y0i7wd!p($mM_gQoU5W!eOGO-^#!hb;$i;%EDuL#;d-J=4w72P)f3 z#T$(|t0cIm*+Tz;P_7@^TbWE zJC^WFH6@&~r4yF%nLll`wcPue#g@Nq<9o?iHPkaFX8HDNtX1<^v{pe{RGf zLm(RO83+Gj{0;X~65pcUc`59DhW8|;o!|X-WCaye_r0`b$RMnF)W`d>_xqPat7WJU zm*Axg8!rRpZRC2C@7Jro#Y$sPIvJ|}1@Rs7iS&GpLL*zUKNuSy2;1|6x2LzDKe2~A zh3)sDP!{6(9p4OsUb$_TrUPak-AeG}xA`}{C1)B5)Few34UG@afnrlu4qCKZSl56S z^4Ij`kbc(4(L0`G^+EKvEY!SyG0x>K|BCr> z#-t#{wNpV^@aX`$I0(uUA=)q@4m{`0)-xqDjgSdVmN!wTyGn8N7p74QmX5*vQaFEl zg#W-r!_u2`H32s+ZC#ctj^Ye-d8KNL2(j_=*il-==JlGt)}|$juZw`;&L|wo^6Zeb z{|UhQ(-3267^5phtTJm$S8dqLEFoG z49$yW|BF-mL+gG2Hp)|2Thu>jJ_csEBe(RVFC-tseb5w@c%gbY>b?(KXNO$jl=bqa z=1m4S4#0(X><2M4ui!Os5?}H#ThaT1aA>#-^7~hN?rVHuxzZ-IPx*~aB0<{2Pa#8Y zZqBonRJ8C{;A{A#I`gj$-i~B#7HFH-PINo0Hv}8@RVc%9VgE4vC+yTaP+i*Q5=GUH=q@^FE6gOR{!F`trF|dBzQs36H3of061?pm zPX(eCcE8?hzMT!KkHH7qS7hq9^$q4s4#T6LS%sQ8@ui3=;>Ldvkml~T`~1H02m^t^ zc^v_|foMN^Z+Okg5`5^Hf>hD={S;60+H48Tm+*bfK92kP^Pz67{I?Ghz*z$X)@!z=e-9>f{WJEL$ zbe^B3I;{-^s&!yWOUWEA^)U3;^A%5DT@YtO8?mX9OxCIxFph|!=M!0zB9H>^oF3(Z za<%KIt3MN{+3$j2POgv-LLnm(1ydO6X(mXYml0BLMgg1!20yX5`8F>gfy20MqdUM!l z3X~s{(4o_IdThXyM#hyv{8VYX-A?ZCl*f#4w$02he~K*W>KXtF|6{L%*`VF;VISTx z>>HFfW>s~Hj2A+rO0*5(+P^EN*gM-lpTRcLIi%TBsWrBy{@|P{cjgtjbAI0(G{Mx0 zdiFJy2DpXt`Xavn(}{>x{pVZURmmQ`ZE-F#DQr+;-58-GRxvnz!j_ zT^XOhO)(-hS>DSp7RbK?l5Yb=j&+u2o;I#bRPDg#$?a)Fbwd%c{ji|Sb6wk6)7|k# zv*nd!cR1vxFR>`z^6N6{K$+;C;0Hknm-Kc?<|S2cKbavOUF+Harb&gjsHH6Wf6QX!1q+Y+e zL$8Ep2TOoUA*_)3`XW=T$Mkn1f|5fa4f>uVdVTkHL|uIvX0*0A3(3!4DUpAMv{g_+ zTJ@_-!v8~91(Ml(z6_FOyP0_z6vqZPMOb|em*AaZ-Qv_HKUY^GFMza_QjxOQq#$ya z{Cw>B7X1#dAKi6GTb*v0UP=1WbEkVd4E}UGqUR~6=Ht&xeojqd-dXY^lEPlD-C!o# z6gNi|w5ga7QM!=iAEUkirSORGAZ()afO2^G&Ais>^j{G)O9G98m-h4fl|jT) zvCgD>v3Gx`7)Oixp=-n-YmXm`rPqL~-B!^IXfd}PE*_2tu{R&)mA1;CocBht(C?_C zXxALR#ps`Y|9VhccG4FznOdtd4lCRkVR^VnsN)`a^Y(*&vyju9T}E;RZmAn^v%$l= z7?;Y=kB#X#FO6?;JKs-h3Lb^|!V13fPGinzs_UV$)hgYvSG}Ke`2(7hZuCx?UYI;6 z0;p+7f>8DDHiP#5A4a`F8rn|w4G;gFD_c#x`XCV!Ad$pST$!Bc1GXM*8e`yinDWnW zpf|ZKO5&ZigcPJ`B(gO6k4^yWmg3XDS}nCX;9H=?C=gD)t0N69ezGu`I#+>BGO==`S;XX(v6YKCpK^x==kz zu}5_FJv}3mF;-g&{dkWvK8v^|=oLo7XxQ1v@k!NCwVLeGE|G7njWbiMuAf7uMf;M=d#sysh}wx%@8` z)ehJvoSE+Rm*+flD)5@g@Gs!!M;tbtF|x&#N~0$lO=w_-(yvtZzuptTWtY$3V($$# z_{cpkQK|59AuN4YHlHF5AUeXghu-{wCEge%f<|jo4>M1t z!!WqVmLsyWk1%rzz3~`>Q)$QubyyB1AF4+0UKT-(`wY+NgsJUYOWqMu_B?Zh@9llf zv+lkxy*)BsR&$x3Pb)Pdb@|i)==hUQAL7V@DSch#TV%7q=_dBw{dg3Vsdjh%r&?Pp z;xCl`Fr;#CyC|QY&O7YO&6iPI=ws%=2(M8lq62YMjbD4?Hun=FsN$$$W{^s?mbX8} zW0?Wvq|nC#C-+^2He$z_5J9Qk#p<(qsrazOywOv{fHlpl)9{=_{Uvd7L2QS>FTQN| zzZ3){r@^|?kqenMcf_bJ5GIkz5nE__DjH-Kf6A6UYC{#wOtSFVXE$=v+2*}lExB!U zHN3}rw-Ti8qPfl#XyKuJUa#ubg3TZnr%M?Bsebud+@?sNWJlyZ!C%~_NuZ<`I)CQN z-3Eu(KYo(_dmXTXT+DM~Msjy~*U9Y%+iq6tryXfQ5c+9XT97aLY3EvyW72g8QEvfZ ze}Qr@0oQv2DcGBJH9_TSVYH0jg6MoJc9h{w^iA>)2g0S1JTjFOJ8~hf)n9_$DQH+y4P;9`ObO@L;KD~ztR0+_g_JsMx}1LyQD3R_#O4t zXW0(zLN`7K8j#FZuDTz$U)j}o`u;F2tb$vqX@kTlcaF2Bo2b6t z%B>o1Sbr-5bU%Tw47%0Cu27fljV?!#|59dViKn$K&PrdxD9%ZzDh#VUEvdY#-tqC* zlw5IP6v)*0wjoLf>YiGf0dXL^QTlJVyNtMN1KDZ#8gFUe-rFtVx?eeaB=LBeaf;w@ zCi`$UT5k~}0j?ZaKfMcV*+8Bf>SOYEz0g8rjgK4?jrzzMdoR3SZGN_g?(GzF$& z(qGFAnjPmE+tuw^(-&_1iza>|CFf@0MH`%ssI!J&v*xzW*`YejmWYwx)u2J)sZ6{q z*vEfQQ47guK&rS_czUZL{QZxB^;6Sjy+>M!gUM!-dM2%EeJj_tRr6)%eLK&r32;Q( z*OlI~qvmVh-L>?4$C#iKi`WNuB3^X4soCs#>5NPaq+NlW!yPiEP?s9yap6ECmQf9o z0p;qOdnwEg)>iG{KtFImM$3}*axNj;mtRH=>%wWC? zplKnCuUkVG*6o%3NC6s83EnMzV*mu9Jx1`99XNx;(}lswx!j(b@>?@s$6lSYLMHXc z*gd}rwhZ2~DE#e7uHfmksYSAlkCfm}i6chp15E91JM!?9=e63VK3IA9m;SHpu7lNB zhK(#~AVCA91*7n8vY6oD9U_R9Y^q3OG(LvrTMzEX4~n!r*{`v;`B)*?35X7>zUX^{n;-{=u{{;b_^-c+^urXDVn0ccE+kgL3=V8yj!= z@!q5=E_ciQaar6;p2=~uU^QF|$s3?XK7TrB8shnv2#A6MRhb2Ax0C{7AILhXJvuP% z?)_9lT^_2{cjs1I&TpZ^1I2)Prww0fZ*kg4fN0)10g<2^^Ols-zAJl6Vsg%VXMSx@ z(f)szAjcYym&is=JY)^yds=+6Et6i&2$4AM+x(A%b7q5<{R_^#AYJ@ap26bP4-IzY zly#Ybr(%c9D8}9cS{PXv(J9=~s#Z#8x>kOoK*j|u*ezz(aC>(w=8un6hGm{8Q z)W>F?2EHD6aeLaU;(|RACaL+!CxXjXkTJ0Ix8QC2O53|H0MY_f4xS#B8X#CScM@79 zH2d&DePfb8E>ZmC-PY9G4el%PGCpBK`_g%wQ-zTa^LC+OiSHcxeo+3z9MZ#MrJv-4 z7VLl^^O@lD;qRM(QID$hpA}-o&n@{N5=TCl<<)+xS#}3M`LJW;w~fcyQ=!&1cq>ON z^cVy|H$Djx6S`=@RlD4B00NW7Fl?KsIRd}~J_ytQ!x2oKW`^O+29n_e6i@I33=iV0 zlP2ogW^j^zMT+S``83{VC*&B7sMx+thEK&nzPuP*K#pBq%;rCL&5?Y(n$LAF^|Y=~ z`Porg6j#5I$~UR5=>ZGhyv?dwtK2=D+B3}-o7(b83;~F$~~b@p*jp42WnvAiu@NWoO0c{YTE#Ho?Cu z=Zz*X1O$H?3o!k())Dw}qil>3Q0lz22dl`xYr00!e@|08(7?`+T@qh_qGc4Lo?Elg z8v1(~jiQyRmKcelq@L0{kQ$et2b98)QiThpyYxPo*k3LAKEY;rzPLQE%|@!0#$D6t z6i=xOCCEi;Po}5t*_VA2tsqEJJe+Q_g}rCsM(N zn<@S#k?l_hf=mm-$crjD#b^_=DzC-$+io;kKF_J&CQGdBt^ugP;H|7AnO zSq4wGwmXzwpf%_p27b8@CJ@mFhOYR$nuAFa{LzEj%L|>A8RxF>IJIaQrbpk?5H*EK z>J8I->9%n)7?Q-FrFOMnDwX2D z7V`Xq=QS3In~Q;#T?fA>JupU(GYqZFn;4)i3$!2NNC>KTRETl%7)bPu7dvQcYh>P}ndn=isxOhCjqrcxEKp2u>bu6Kx zN(2=Av^L-%*>SpHrQzMIPb^}aI>P1VvF@kR@P3Y{hr#NH(l@6fFY&-A4V_CM_AQqjG%qYNkGD^a%1af_GD^oNYA-_EH0`X>t=*1kh>QUO z(-I9>qj#!{DhwxU;d}Fmd0j7NDe9XtPTsZYXei)Cz{f@Uh1ye3BnrhgrV3hJXJZb{ z&?2HLT79hwf3S;a)1TB2ydgzu8qBSk)`K~lMZ2zgKCl3x8lwr z@e+R0fX;O@(`NfhvOMmg#Rn76=vb2nx&Y<@f|!n`>*)oAia>UAvexdawNUJHhbty3Kg5zp*!1MUhTcuLLUG2or z&Y$>u@|^G+v*-!3_>4uW=q2txdBFZ+{uKWGD$#>_!@X2Z5~`T$D-xI|;cu=vn^4k3 zTdmLZYP)I z1VVGK}@deBG0#Ssx)5Mu5m=bCpMvt|zCLY%fotiiVO1rUz)$qrjK=vwK-ZRy>yn zvX`lB3%y|en}fg+9pXZj2+b(QHhI#Xs>#&ErSU9!H)fsAQCTO|D*d)InXg3rcVtY;57 zWqTqw)ioT^_GbQQ3a<&iaYp@9jIh@LtCEa5Gv>It@L00*$9HY4gS0I?^!t!#Ya1oZ zQ!mQ=L+@KWpa-9qTN|198PsS(;I09lGP_fF{cN%t1{Rt(7+_qnb#n*f)4EuvY~X2z z6UAq2rkvR!xaMLY0I)7;TXTWG3!W&q1S3%$7Et3@KA@_}u%qW}DJ<%rcSpwJs-R#IvrGS9a>K! zum10M0)<0NM+f1d2)849NVUG)g%p@GMF**U1hS_Pr_X{*Ip>UVrtrqm?}*ro0N96! z9*zmG`X;3hi#_xTG(Ygi`n4!#S>(1@D({0;)4XVTq8LB%2iz2_ zXt~5DrWb=kyZWOW8=B_LEcaE@k=^L+U#RJ(1vIhXgI?8{H2w}^&k>;+mv#Cyjsn9B zUdfwTn~xXWdf0qgQuXKem-qQg0!3}Rg~p&b>d0Ted@hKv)PKQ=C?*z?&n5f%VMz7N zvYFA95aO|u`MD56x5SuaWoaaE+V-M^cHqj2*MNdRiF{FVZ%3!~MG4J-1BuB>VXsw9 zHvlKDT63q6(r;EI_b&U)YT9UcP3J6m1O#SZP3sL0ny#j;;aEpsM$VEilVKZ?*21+j zyR$v@Gpt@;?Ozpin|bOA*IqPM3=f-$+dxFuj*$H1-yv-xl|zai<8UZpfPZh-SlXtz z$*WV>=MiZzYsQc2=`A?4vWRcbmDkmNCMdx2`<$8hu`f<}!m4qU8%H{bwr-rXIBw3} zFsmFgtKRnYMVjoMJJ}m$ky$rZPygM$I8-7i0#H+;My2-ea+%*2_t+CJZzI}A$4p7v zzgH9~RaZo4xIR|D&x69+affUG#d*nbXAUYhn|<*mQl5N`I^x^rq|k=1mk5Ajg-=C2 zu?SVE{`&e2QO}d+K0DR6WY@Rh%Axt%3C~Vz@>C?%oGs4_Y-^Y)3>*t6+KrM5tcEiu z)y=xKc=4NOQF{U5R!SRL6P~Bm6+{9!c@m4ahqa<% z!ORxPWb!k162)^*wPWx?!IQ2g{~ziluP2>Up2Q57i`ZzhJSYybuptlf)q9xJ@v41) zEE_KPG3{6$v<8_Q%7)Y0#CFSr!pS7mPws(Np0~UA+tWWFAY?l^3|~CGc7oKQy^}w+9ylpBh@NH7=Sl(Dj%d?HN7Qr+h8YXQ1ji)urtl)4 zX)+B+Epru`45aw1lWfB-3u{HwyOFL)^EDk)VsGPA{T>sc{Vr@`_aQO0v`@{Gb|>%7 zv)fA-COLBHJKbf5$Y=7iwfKBb+O*K#-G31o&%>+!G=k=k)Xx~7wU^!Rn`hx>bhC}{ zq)&r+4j@VYzy)|WD#`$6T|PXT)Ky1xhn!D>m3rV$miLH_px1gDut`ZQ;2ws5|LIgV z7n&`Bd*8?2%eADVY8p1KiI1AC!g%1azsBMs=5b|q#oLR z@lQrbbrd7dApP$ zXHp>=%=V-|$C$+vDV)t`r^-}=%VT=yWgFQOb&MpjUVU0g)Pgs*lK5oj&Mlu-T~X9( z@yH24@;b_=m|IIaF{f@HpmXHh=aq>&+D)lT*B4Lue#ko&n<3S}#k#)7I~51#sz1)k zvvL~r3%xlP!g-H4_9IhOY03(RjE(^A;CW36LBON zoYrK^0VXnp=6%MI(+o^p&@%R7YxbaU1)IfHD17@k^)PB43a>D}Y|z1xZ&z0=`n}^o zymV4(Ao(=?=gxFNTLf>IXn`N!aLOi%f%gsD-A7vB>&C_&=2$U=k&`(_46*ay{6)JK zGyObOn-+8E^h&O`D#~xe5;EZ0NdUya$MvZTe4{ij*7OHR7RaLkg$6FS7S^W09H=t}v}-Wa?dTvi zwwMMOm$}bc`Hlbpd}$?pz|o@Z@wvd@^7#fp0@sLp=-;8^kZ-JFI)hg8jKZ3^nLi# zQw6vjl?$7rU*?}` zV~LiDCbpG{`vm8-EPZ|4@vg{ymtZK8z7Ns=ag&a*G&;;cF!0UdBp*%MW(MlyqpQwTz=l?FaEdT9# zbJ;T5swa@Ufr^VU%k%~Q4AYTj^}6Z*vcr<)@s6q0t+nt9=Pr*wsM9o)yfRbB+^b0ZA>BzpSeg;FI?O_9O0- z1nFXb@TT=f94N44F-dOPamV)d@rq- zL`VEr58-(L=$Xp{TNbgO-2y8d@Hvbuhh~CGbh@yHJDK~@{@{M_K#Qq zAO1sm_bbrv>YMJ23;*A_KGDC@D$m8IO>;L2izJ4VdZW7d=ksjcxDUs_=FDcoXv&DR z6F!p~gVOgo$%f-<@&o~%Gs5I!j{14_p^CkPRTy2;CM1YT+cI>?ty{Pp%a3pw+1T9L zvK>FwgRCGgm28jl;d`*mL(a%i!>?~`1#zAy`S2tdi)vVR6V*p4bK^|ie|PqW0MB>{ z+wED`4#KN}iA{1XKPNv|LalZyt^kK;xXJZkyLI)Bw3T?r&~(uB}UZz3G58h zPm|L#xi?U=3DSa?9xL0J3Y2H?|9jG2;g`n=6}VJ$CU{+NMAbZws*#MUagM6F6(#k& zA)Qwt<-4nW4)L|o?5LR$7rg_#=0&E2V9Inq{3oGxxXhGKdruzf$-urSOkadyZ8u;< zQm(1|=*}|te8ra%+J}+krx#LHK2l8zgJ)6)&QFBH6||6U#K)cAB#fRXe(2VJ>NmA% z@piIU<|e3%qdT-*7==*N%((hAOaB7{OOzneRtIO_p;K2|B`_M|GD?HZspwYKLD_^`nsww^cfg(#gEX8-Y9T4^o5jIJ#xfaICp&+ON30tpknh@=fJ!*P2VHwSg?w412uY zC>lchyyg?5d6hOCC@A%8{yNx8;m=CZ9UA$CKN;Hg38~^Vx6>$<_8;Y>53a%5gB;6j zWkhLKk>uMM(ybwzzBETN)`R1>I!~AopX8TU$!eQ<=lnxxkqgFl)-?` zQK&*iZ_|gP+!GTybA{DfMUoXzEBFndO0G9QBzqDZ}m{m64-1Q!Ji8-{# zN5LZtI&*-6#%@cy)Fo+Eo-+;xBOi_Ezv_({|D*@7;;*li6y4TlWl20+QS`t<(eV?= z`S^-vWI?`Au!?sFR2w)4BZLHpx`p*ZG)pw^?3!>uVwDF41Cj$ir5vv@f{uG5rkM>z zi{w#b-2rSq9S-7jWeL=~SF9h^jQ<9BPji7q6^4%Iubx4oNpHd%?av^uyiG=(ch?8^ z$3vRLndo%|d@>ELl)*#jl&S5SKh~Bm!_yoXTAOvaM7l5!mZVfGu!;>v&w31YnjQ}LTPGUODPqxWAgyrViQ5Nj+v_#;IJrk!!Ah;*PJwJ*1`Z@g75 z)SC(l?{C;mk~p;#rOL3}nVn~+HjY=LypRp~&ep@!h6_@H)^jH`lj!+*3{UA3 zdKd8cJa!iML+nr;+H1|D?3YRK|C|W*{_6pp*O^tz83MIWw^S6|5=zGcr=Iz>oDI=| z6-3=G8>Dc(bYKlM!5ZWuDLXKyH`tup65%GW{&mM=)btl*ASRPM)2k+^u<=c%=-0s zely#+6zRlE7VrwP>kH3xwMh)l2^)R*DTML=IJ)kzCYG;#RaB53L{OT9sx%SlO(7Ji z7YkKdKtMVoAT^?tgetw03rJCVml}{NE%eYMHS{15T1fWG@7sT7XP(V$=9xL?%8Vw>`38iNy*v)qMSaaj?vxjuvGd|{eEj?w{rGTs<+RL2cI!Jam1foDSM&ao_)X`n^@YaSqrolj1WGy@jmyh}>%66K z+%m$N>2Y{Xodoq=HM0}8un&1JW0Q!BFBAh+f7utz1Q_)l6U1q5ah zOsT5cCM8Bw6C5^1iQbH55`>QOJ%a{A3WUDw-KDYP=z2qTjYDP+A0?@2kiUd&=-YD9 zTJ_6kR<`-eQjhK6=9W4J0*;@l&2FS%?5={GW%{h*HMC2xoWaTosTMLS8iRu|R z^k=xa04ieqPdo{>2zuCXxEg4&fHTLc-KY6t(UlrvXZ-n%SgxmPsbSsQ}ZqPr48+=Fy;4SX(@G@r_1zl?{3@h2OH@oC(&I93i9 z>pPEg(|1wzz#e{Zit2$xPAjU;dGW!bmMMA+fNoZPwuvXaqlRm3~s` zEeJ_XQL)YA)Id3gQu&Wv8B5zUxydSnva%IDZYX;Ib#idujaqZ`cCMIw+;q-RNaimtcs6 z;|ZCR7}mY>D_eD8C5^w^k}WRk@9$k}FK6tu@0Qp0f?d5xToRK+T`4^26YHFG@AoHW z^Ve7SMXfnn7U7yn^^5k|7xa&Nd|ifobs1KBcxnzm-i@5;JL1ldV=J{>=iR<%IzPn) zw)MKM5Xjlfq4eo*5od2w{aUQg9}yC?wAj@P;)o zgCY$TeOS~?#7OS4t~i{w`lHfg?0R(z!v^=~SZ1h1K}ZfqI_ z^pSbwl!8xWmB=fRaXlTAc8lU5R2BvS10QLW>utGKXF%#EPTSeA0n}9T-+&c?Gml%P z^32M2X49I+BdGh!EIllO zb@R8Jo|-pZKvca-{usp>W7rmS&x2k|@cCqX`5l(s7FADEY-blgKepj8sE9G?tG~tW z`5#Xj`9=+-;lMIQ;-@izKf}r>G348xG(94t6G1=2YS@qIoG3a)OFkWJO1m}<{jW<>8`Sx+Lrjz ziIh)R*otMu{^%sWy!H=L_-MBNuw9=NMTM=HAvPR{fC79qu#GAI6AQHo6aF*5y8&u_ zt>7H-go#pb;|nezDlD|9Dz2}uO`rBUC#kSfJKbf4KRQbiq zP71|15SRR~zeMGiG1Oj@n$=1#pFscVz0;Qev_=VH`)=T(i~a;q(6DWn2_gsJ6L|6@ zl5i<1=wPoR6;#KwyX2}gp5pOPKqq~HD{j*KFxe|)Du`XVKvu*^Em4B=xz7+|4;?HE zqIxZSX&XZG!X^Ev+*v!hYIAk)5&?1uuL%h^Kt9M4u8Zf_Nk0fDm_jBD3hv#XF9Zd) z*Y!YXw#sc)(puW_!+7XFUJr=^d%`q6<+h8C^R}puDWn&h$?AnG!W06oRwd)WrB&AHg7Dy*#Odpiub81IBf(6ttorpdbR zl9yct0#CSYf+JwQbz$#drhOgjn|5a?EnV$h>Yb2xC*+ZOeAclY|0}Y@d@>K8?HOz= zVpcUS;p^ywGZ-fy1+z#SjEqmXPxF?gPy5rqGJ!E+>kRF#TkJHtT&;MWpv17AIL~i7 zb;WCc6|mwDo?_(BnjR>%$~{+mf4{6RZb#+jj~sC{w4`Ooz1Z%r>T{6b)#~-~PJWuC z&}(0TME?Fz)-{x!farB-KdkRZaCb5gmr~{V&+#iR5ngxntwU@z2y_a8c{4asbmjD9 zHRy#gyUV#L&6ZIw^bFPaJ-9nFaKsDrg7H)Cz$(8zg_LK)3v|nFbfS_#VM#!&@~=@? zd35`p3tNWfuB{5Zg5*W6!&I&I3T#=4mi5s!yMIrTA*anbZ)Y!71kr2y%67g&3m zt>C$PNViU=slVtXf!l;|!kgO+@*^1U{Lo)mjwAtorP~d-mXn#kZf2LTny~gr=+1m` zlEAU*?Tw@1yA8KC{tb!~E)d=W8GikG_6XfIBs=JT$9zO~SAU>2+TiP>zniZG_0j*tWZB5-0kF?uiCPR# z0a$+64=v+S04bbzlCXI)04k4{>uYUX@;x=&J9pwRO#XW0v|GCf%csH@h@fo`AvAB} zdvm+S5uk@Wu^|mf1}}&uYeDhm3`fDUE`$X8@4rU8f6``E*L*ep83eMxd7ECt$o@gJ*0Ipbk@{?~?Z)3K__|xqoiS;Ce`DC-WTlQa=NhTL zw*4V58CcyVu7XRqPmwvnaVr#hQOY&2U$gVA#OYhIC|%3u$itSwhYtlyznPYNb9(jv z*Rh$+Y>MTB>QM^qsL|NJ)!LHJzYF)V(x!k`XI5 z9|AI{?nNP#c!}LI-aUJlwEpbS~>vI3s=#tH8d-s^y z(`e^elrgA_5gp-NpKf}t^Xt^pG}4J&?jX>qpO*=U3e>mNgxrJY0ku;%&u8M8f|h4T+)-lp`PM_=wvvyU6{ZbT4B zkBGOS4yI{-O2teQU6eVKd3Jt!JAZAqFt~9TJB3u6yeWTjKK1^V1YbtX_S`Ke*URkNkX%eEsr9P2 zkw~4%R`3a}cWD*FX9-BZ_LXq@eia|~7g}BdXcfM3Q z#01n*Ss_h!m5k9AZO?_MZBjWxPO%)1)c?@-4WcCj>~E4RgeflrcIr~ zWJVTKCg-IG9yNl^vOaVT?KJ`3|{SgPoqwlD!8OP!1#aYnG_bZ^A#0 z^tYH?WI)b2nitZ71&#hj$N_Fvg|TKQXeq>!tV6wdKTh$zz*Nq2y0*N&N3!$j6OlDL zdig-?>{I$7Ph@G%k@uNi{+d2<#Kn%q5me4Fv^z1B(cPU@+nL>D&J7X)Oc*3ji}o;8 zyyHbXBfL@AO!|%Qh$`hkZ}>Jlta60ce5qzt?-oH3@fwh(q;_sD{RYcqJ1+I0@Y|yj8d;*v8dKrKiSnWyX7~L}-^&s3!=kS0M;i*im7<-p zb7O~SgWIi86(ZZc_ljzZ{Gu7eUc8OzzknI$vqx>yzjC>m+I{j_|&01IwZM{6niM zM_FX4a+eWL*WJ{2yFXA+vtmM!eud8k{p2BK&il>W!$wS90L93DOZV=1AeDlm zJK3#p{wj#ESu)hM5~iC=t-Jj=Cv`s8wR-^Y6gNU4tL3gqwvVP<)H0u!h!XpnASdLA zJL<+h;>%0e(Gf3QD$;{&@p^_+V0YZ={X) z2ezbZb(Do%ybh#jQMUP;1mF;Uag9z49jO>!qS!$_-9+CPrehg8Sh~n9Ml|FeYx@QF z0Dkk`FkzQ`dqGx$+J{$v(^GYCWY%p|LTb?oj3Q$USy;R-R?nYEvKFYO_;OSSHDsyi zpBb|o?VM~j|NOKob?^>MddgQ4pW;&v4w5N9!cRc7YM3)3F%u4MLgVUuo(kZF10sU7>{kcfWO8F;4Z zH@%s_VgDT>-I!lh-g?C&74>6ISE?gF3*xUE8HPhsC2wz6uVB%9%`anY_9wJwJ2|%c zOhUL5d`j9YoJaT`bEZp^kKlFc>MruzXJSC)5j8eXv&wfW(Kp+xwleZ==+SKIaM3W9 z+kuKOIPLL;oW60YJ0SFfQTDTcL3qUz)3o2~3Ajuj;I~loOZqmloyu6skN8>zsOjH6^%b&txlY}?R>=wqmhQmnr8OzyO+>(;6ac1y<@3$ ze-U10c}L-ctW)%otKWMr$#i$B9ee~~)S^rN#PsPOIlj$7F6If#-RwCNt?8Ac+e|O} z?p`r_n^mDD>^lHlhfMvAD5||Rb@h&arQ$94#wz_H(DJE-ZRX!AM!~Ilv$nmo@VQm` zVFoG7r;}VfZ}%;WDyx&#px`T3?z{X^^-I4)v3JBEVZ-$rM{E7e@I#hmktn z&?D5>ew8s(*Oh@vFAjL4-7w9LOi^H+AI-=@2syMElvu+?V$_!g;o z!y~3GkysnL=nx?H7^yc15(PJgM6&( zT3-B1;lmVGnSz@aQ?QYlr^z|aPSsEDa$H4yN4!Dp87t+epUIvJaKMXR#)iG$%e;)B zhhV-_DS4K}0pEHV+moo>65NtvU~;Tln65p*u=w&SwstyP#1QhJVKk#-bctdIuKLJA{vzvIR(zYgXTnvR0N zVvbu46zLBFtM-i^_pizn^}vvZYa8sDIWEgVV4*(h?S}kb3V#Gj{C?(piY{#E_uDVY zF#q#)?+fnP`gO>mndWHUY(wC__B-WoC3}BPzPQsHsFjj;u7}~vM!AKYnVW8Xeltk+ zyCUh;z&wh%J*(i`7jR7NOrN}7SO=`-5f}0|^X^V-9 zAAQYG(*BGtfcLjW@p!LFdTFpW8X&vgt0k%DZ*-LI&WIUXgb3y4g*= z9IcQG`HMGh1km@ZJAXmHahs=zXSHY?dq6O%fh2mg7Rzw=?SSqvvVcN^6l!*X(!b(5 z(sWwC=Q!M&#kIHY3cfcoh12~jm_HqA_7|B2|KY9fx01IW`2IAc#-?w!+|hsT{T!N3 zptNQm$f90d7!71;AkczcUtY_i_R9^y-CKm%uWtnu|JH{%|(28tNKH=d_YQbNFhD-GLSdneJ*nb zPtCs*hE%1DY5t!Y7sK z{OXPf?|UklH){4YuK8iwY%_W^3E)Srf}0&fHvk(nTMY6%hAcY|^J|!>4?mzTgV81g<_7QI+)fR# zEtQ*?hi8eNJL>+ipd!_Z0cm2Pc;OE%9N7W0G3BA>%Vof8_8;pn?wJ8DE;hqvL|aqr z`_PGf^Ols&mDzQpQK*nbsjQ`mnuqR;+Z zN(j7|-fEqE0e+X0*8_JeI8c$YHaLett z{{9=cQ5(_7{F<9+z>dp)eC|CDcZe_7LUc9m0&FZKZp((>ZRwkT*~d{onGymQRMS2WD2tM;i(m+ieWUY)cF6C+*!@SVFY=9TT4PE;rgLv0O&tqq z%mP;jQ8AR&c>EY_V)HtU**$d1TGO7oZ2d9#wasE0^Yg15KVwX1O6&^Km?Js_CHRVD zwu!$M-gbBQe${`Oy@k`t-pWY3*(-L^JpI;6i`+GcaIOs5Pq8+5Maf$F#vqx-YIQvU zU%z_T5$JOmAR%-}<+1r5Y;n*lAyh-cHe^`Amgz$OnwYCW_nBo<-ba3zg4DS z-I;G49{SljCsM*B;rzBOQkRxO+^W$Ft*8rRonhdf2h&!i6F-iyLaY(YWmj0uBEQ+q zre&Z1EI)@`AFDD$Rbs54P12UF-^zEd6~Fnx`q?WFh8(-)bH8f$Q?9np{fqg75lJRY zOJWy9WXtCRYSFD)$kH8N0G8T+$MnPzp%?0}qWew$(GgclaH{qaR8(!Q=2ye^p(lRt zEFKMFu~2J1`6DN*h^|mMI=8U%?p4*D>|P#%rLxC#N@4>qQXntBGsk329B}9)I#Rlww#GvqOp{>(lDu<| zcd_zl2V*An!UiR$9V1=NkfsdQ?x64GS?{;cWW!fCaunLeZ-E`Nn13|c4Fk7+)#_t9 zr)Y-`f$D0Id`05H&kGUwy|HQS+e1Q+1_4ZO{%_JWxiP0?z6e!2vQLvth3GMog!SQZFkFR?;D<(7y zQ=boK&RqI}VObS;o%X2y#XI9yXcaZa3`}O~?p6Vo8n4`??%X_<-oI$&^ZFzJywMo4 zESq25sQ_bB{zGn3&8|QDr^84+@<-_Xg!plLI3c>M#U)Wzi08i-zYX>S)Z@FZuA~dO` zQcz(qf9C3~dC|xf)f;pY48R`(uk|w#GST^$aCE-b!VlEWnhu!wf-fCuHQ7YBzF!k0 zSU#_ITQxON2fFc?uL$e!CLjsRkOTIx*Clr@EBOT_CeSbzd?kOcxYV5%_TJ%BIrHbq zmhUR}KKGw}&d|wU8R&Lv+CuU*SLiLI?vOYoJ>R~vjxX86z~Y{2tTZevp(zIS3!cbn z^oFvDW*%sb%lu%s4zxuGW83S*FbY5=Z)QW}sV~K!^j^MQ3-f`G1bnjam6iIjyDa$V z+4a3h>zFdJSuc7c@7Krj5(Ib3BB7TINons5#xNCJm8#&4s2o4lv*P$8Pl_6^5V%39 ziJsPXkG|#&hI~WoKeM4vw$dH4X7xHryMYez*2h@teyotWGw5pVDPmmqpI95oRK#Ye z_9#8Bz^`ymWxIh-G2TYutyivcxWuAe<&sY^?_*k^vlkBF@$F?dcae4 z%T^TfHv&i%cPDM#VnM2)~+c7o^z7VTs z3CMTp%)i&6$AcHaqBz>_(X@gy_1pE;10ii2En>h`BQmRcDQoLwi!>U$A;C0jEqzDv z)O*QgcxN}@$jZgalXfW3E!3xak=3hO8ik%=gBN++i~eH1f01+3kF(CU&$c|Wp|Fkz zG+>DpyH~Y_b^aV1VN6u4%}fUx@}>}sIW8j~KEAd^$sf@@s1yu}?S-D-+Nw0ZZRFUX zu+k;2`pmeu?h^R}@tudGv(;6Slu>qpo`PH$s;e+}`g<99T2ax?WChwB5+GfMu|4t` zr3)-NR?f4XSXN(8UBFv8VP0?-hGC%?mN$kJ!}2$PVpzB^EYGj*wB?#Qv0fl|Xw+?1 zF)S~yX0_+0GtK-WbUT%XIO;U=f-LtU%Gws1U0<4p{AfyGf5(OeG@<|6a8Wk)`POZ+Amz`p zANa-|RQ=^Zr21O&NCxwb&A4}$^(4MguZwDU>1*dD9!eU%2e2U!3?z$qSOWXrqtr5_ z-MMO3@ZO_4QoEd170NEB6%Q5?rka~e+@>%-cX^Klq4sIjGZL6mpY+#|GR$}uHQudR zrD|Ic49M7uc=w`zHbBML29hk9Hr73(GPcx>p()EtWxr$UA|_d7ayqLEFG|wqN+u$NUt7Hw{Zsz;&w`b(? zyD{lVf|-6%vr6#U6PSvA{L;BVezAphOR!OuE#;_(l`$5?B241z)wv|c+Uiu43gXgt z@8DoulHye>3Y3$|x({VD=)4VA36-8^Uc9obFzOVx7QbM$AfenU;?jJ zbW^Rk8p#ODvrOt4VB`1ZcfF+%NOhFz8xr1sR=6*_%S?>+_uwGkG6Hnxc|_x|ZJl~?Om>MqlT}8Qw|70t?Wz`i&F|Yw?ruS zEx>x)b?TN1`&=ZrO7DEUv4i;5!V(xE4eTH;TYQ@S`v_+XM9)uMAnz-y(|MG&(q4DWZ~bR83{*0| zJ7qTy0iMQeIqY5DCEr_aldUt*QQA+^_XdCGWUE&~40;H>O?05r=WZk`6&R z>8-K>L+&m9)jpeXt=2*xk(Bd&>6t>cr$=(2qt}`E_?Zv*T!k-r$3DldYrf{!NECF? zFW6cr6CVviwmf*;-aQUbdTEvbt90%In&k~24`r#3!wHikA+D^Xe$tJx8MZ>6rLSU7 zceJKtsjWY|HHLgC`KkI>k^%OG{ikZRwobYyzNEAppBY7i zWeLa1l08_~y>hW6xBM5!fq&*9KH1pwcKu0}5-ckn$HXo&7Si^oa5g;&=gxocx&*d2 zyLDVM-|XOr>(K8~4}SCOl|7WEea-xr2RA599B%y0*FDB5O--8lCI^Y_EFIac$9N_Z zL#}^>!@OztJa#UqXiQ8XF2f7&~IH5cY@GIGntLG z_2Bpey3Nyl5J&WZb<4k}Q)NVMBeC2uSGy6%55e&ztgRs&-iMm)T9dRxr^@+8$LOl+ zk0f0ea6pguqD<<(lLQK}$wU3y-Mj)`x~pOH8>J7~FEH9ymE6AXE5rOHJ__$)H+Sj* zj^LT{DP@t7unLg~LbAi2_=Z#t;aQU6#dENOc8$!X-0D-O2!xg!>aLdiOUE*^+F`E^ z+^uqKjrQXDpHoD3-*Mo~%qh*OU4(I^+cpt0ZFiy|8W+>D%1Dj3YhK7bx%TTQojJqe zy`7xLze|kp!#=h1L{8#FfMd?_=Xv9w6--;**N6ZkJg<+CO(mv!{{~Myuy`ZnX^bj2 zvE@AEsh&#vv7bfNJe;ujI7C}diBhXQhRF!IlaM?h&1{v%%de*JF`P!c>d&Kmc` z!xw}gm)Lk}G|MkwY(t(Tt^kAlM1K9d_N;t*5S+d+u~7q)CG+KP(AZULg_GEocvT}l zadaIC)PDyiS;Ozy_=G)*xxtDgI!#(Q0wQm;t$z) zNwCYLqU&o1RI3=|&{I3@N6)(Zoe)1CF$m7{(qn8&?U=DIm!nIpd(`u|$#x2;p0Dy= znDdcP^RJD1qV?^;;#Pl<`-UN+mDx^G_d^-{W9>fZ$L4sz{J-Ivt87)O1MCT_` z_s=Eq!Lq;j$oc8Z{Iw=_9CESu#nFhX;wk`N!Nu5cFLzi$rxF_vc{4pa2e>yl1GfO? z*@Eg*qCyr+0%|0Ic04Eq12Cr)c2PzNv;KQZTT5-s1S#|r3zCH;_gPA-0}@CdWE|P-?;90GC!}Q z*M7Su%{e3i>66VRI;r%W) zs#$i_wW#^3owG;NXmn$4cjl(=*&9;U*E5nS?(Nn+gN*GNDBNK)JAY|uwKz6* z2sjCC2p!Asz7yII3bNlv8)0Ra= zM1{#J>ZS-#IJ@8ewc`1aE$OoquxxL{u0AmbV|T#zp61AZ;*d6{1xf&YOz27_y7{~=s`s?_=3K8Y}HJd3XK8Am-t86 z=P~W9M8$7-Ucn{v3&piPnmT5eidVb5y-VXbopMsk$Kc%sb-kX=g7d|Q6Q*7ZP5a=? zs~Ofaaj+%zHT}MHAP}*;HRCPfD3Ku5cD(Qyr=2l;F6Z4H1uW@K>T`6?J?w0dm0vw1 zo`SpqxLBmw1-=b3t*UWJv;vcm%^r_EgkF%pHp$b5{c9>vphD{K z&4)EJiD`FOs^I_{KAsVOs(94Yq{?^0;h6L05|WvZVdw`yl!8J9qa^xdjDS-|$iAY{ z3YGX|@H=9N<`Wc4UK(a;`3w!;XXmV~Jfi#(OM_BB$`Syw**$HZxo@Bm?S98inMCh= z9M?RMh2lLhL`2^)f6X=hu z%^-=BkcJ}?XBeG#+x7=6( z6#u{mOW++>AiCEYHaVbMqBlAA;=)d}K z@r}atqzq}CO%q-{tFhyha>(M@TJ5l;oU^4)(xzq9#kcqR z-IdG#+nYQw{ODW0*jDtXLDVG6eO3l%xMkUW08_8WrIz@4>O#1EMF5f|63VRVU@gOp3l}`qF|}>N&{pXvhkX9jkQ`z1P6-@jN%X&GF8@ zTmj*j;5NHgyr(qfgOb51`?0(h2Uad0=T%x&5@reVgI&N>@P^0szTm>K3&A8?Iua5v z^$EZ&cFU0xB*iR#)!*se7fejHt~BBnkafN96Ed@rbu5x^a!xpFv}U$s7)nm4g=y41 zggw$S7*<$hf5kMA_|h}0G^nSPXhi{N%ZS)Ycp|AFri*tc!%+)Y36CI=qWAw>bk4D& zskU)^(MQg;dC^q*W8vtnyvMtxM4@OGc>aMcv7= z1Fa3t*&l-?g>BuVw@}Hd5}tD@+W`m!YlxTu?|qrs=hEVcn3tP-0~7jBdB1oj3XiQlrqZDl_Bmm*3p9x z-k*)8M3sC^n_MFN*5COWB3vi*HCF2tP1&+a zzPU~LiBz^JIv7%ZO$r^=NrX4s!|da}eU@=?R#=bNBEo;$qm;6wm0c+0;rv==SdI@( zyv6bTs=_Ljt?^FJKVfFH^aMM0_V{WT9W&d}96ZJgJ!U|lkCqH4`8!J6 zknB32F#f6ui6EqGkg8F_KOP$)`4U&Gwy#k!#G(fSKM6noWODw`Sjs<@=U0Adf5HI& zB*09Aa`9L41+H-O@C&m1Y2x9pVT>P^Iz1l0iHPVTCCDSET?nn}KE~x25{w}4Na7a) zEoY5>$zF7}WX3f{(E4|Be|9%cYvbV);uF$+qn!JybpV0I=Xk=kF}oVnYPPF#0uZ#GajkE#pEcd zk_%htHZ|-%R`Z!Q_uR^4OTCg_9e2}{J|)xzkD!v)IfdR@(UNOWi8u0)qi|_B2qwkI zV)u^xZw$;cJ18vu)`~4D%HgO#AT0g)(ar7P2p8Dm_GFJg53fS}7%I4j53(cK{Kl9_ zJqE5S(tN=Z}S&5n$ZB_c%?z?gWOFu#hCVd7U}mxBwjYf5iXQ+R*T} zliEEHq8gl;|iSRr*yl(!~pTUpG>59Bi`mpUc=`I~d!UkaT4H&3(C_g!@|OPz>WY9@IKOW>3i7iZ8jaZNatj@rTuAfubX+uMD)Njh!)#3y#1kaETDQ~wo#S`TFv>r@2KU{qdwJ#S}H#@i0?IJ5>7=oS`Z|-y* z!agRNn(kn{BlrK5X98VG-J=gKTFa%852}iU5R#OI^<0m-4F8-0MRys3Caz|EOngKo zbHpzx@#r%1lSSVPm_9#^=ne)F)o~c2PXR|o074~#?sWXrHR&bM1w6l(c2YubFc0mk zM7(KKHMLfnn~QL+D$I?ss~i6z4krILN;LF8){4gQ=BjBAUJA+y}Dgqw=BXGP9PF+6VK znD`X?5>kAPLV$z>Hyc<4sALeAj$cC1?vg8V@ zYS&u3ye*$oenDaXd{<2T;wwGuH=EruY{)`i+?Nz9J}$J=+ux)}elivmq2gCO+<+c^ z8x>xRn3Fng^B^&ZH0j8Z@pto88TyXsB>f^_&xx+$pME$}=iYtmN=e(6ki+usv}O;C zYLKsNM)Hn(gV&Qf9pTBG!67lq>fdg;Zr=s#+Z_338HoC)_cNLHK1z5{m2C^wwdv^! zv#?q3f;4nEM<6&U63x;i-)vCdMX@(KTydOzqnD zdWAbg{h;iuwG7KtNOPbQqW(dsqm)Q5nf6cRj%*li_pCJm%T!Kt5QAlUNpmnBqPrIK zSVaP8gxFne{ecCo(j1tF=-O}e;^;3^OY}du;?4fRoc3%Kpms1YplU7Y5U$OTO6TQ~4nZm0}q4=WEQ+=U0 z>dKB6NZL!|LD&hWQ9wmSYhj&ob;tk82nF5_i|ZiCqVni&N?R3Zg$C>z>uY`wSreFTZ6Cz%?+Owhx zXn#5cmq(JX+EQDc&~|_8P?BJ>TWNeN!9?*g2?jwtKSa7nyif zGT8m|36>3>*eZ8|#j>#a)6BqNhQ|UOB7kzJp^yzgQZ`Ebr}Fd^Vsf?hFP25~YHK)_ zaECH{jZf+aKlsXWmD6I-cvQ4%0}nu7>y{$9|Z;Z|+?HA)9ue9oXh>#@x0 zGzSm+;K@Fe7xclSs6LYH{*R)oj%)Jk;y)2|f*_+oY9QU+prgCHOF+7t35-q^5TvA0 zx*McX8l=0M(G$kDcklkW_qltv&%Nh9&#CV@_sCgdNp4VtM__&jp;sZ=Y(u~G8Qe0y z+mInt=pAlEqr%HMA1VHSSrkRrk3u}}`$|vu4zZy+;A4GyEr4d~V|{r<+IMDAn4hoD z15~F)j{SthIbIw(7>ugQb^U6`U^3Xk7ev||wbNf?slwH}<@E4e&Y22TZkUej3;TK- zhS2=l=aO_MNZNb1*w)m#s9kl`4Pi>GH{MJE!|yncKl=$R(^Og9E7Y9@XBbkPQrOgImsU?7&sKrmz%@2cW4mhzIGGsF&;C@}`u>%@HK!`t zR{DUbhis$sf~D}1C^+mn3<6<(;CV4g%7Gruk6TxLOt7E$=3sFARclMYTN5BP8KSV1 zA6LhZw(+-`NaR}a9$PQM^DAzmZR$Q7xnuMz^`q`a)UFV49jbYrEx~`nYHDIv9cduU zUfi$X<5v)rfOcS;Oy=yLpy50k1LY1a^WHicV%e_<@|dUB;##sUp|zaN4h|;6+PyQ2 z)gpy+=x_9rhQ}u?-Vr0jM(5a{yi44k-)ayp8AhLOZu#mkpZ5?C+@!Y?bT~z1ws|?x z__d3nUf7(gK>h|WaiD@Dcx@W3|8x&w^Fi!i=C2c+$R)-u{dvICwk${yf$_+h%PW-< z{7tL9S(4wkrV?l5K!XJh{@J^1;3QvU{6fNb2IQhH(D!&-#71b#Smp4f$EZxAOw6!P zRG0%V3OuIw#?L_s&7s{cb(af5*U0VNVc%Fnm>!5Xn;z3Q^mwnUYXbH*VKTZGYAocXDQt%&*crRrCfoGZBGj6>|MTsKM1tziJ(1 z;zlXDjE&=Ex5{6$lUGCB38F<-5*=0bv>M94#nF~bL)A%cEnQ}(PqPrQoj*(9PexG< zDHjGu?VVSla^1f^+yTY(!?<{~cBK2vNw3Cd9=1vE+bdx`DHIh%hz)5QGpp{<0lD<* z3cfoaBi4@dz{h{C%gz`qcC`j5i!};KqNtuZP(E@FcNqA_;#&j!;whS21HASWm8}7? zEe!6fbt%{lZoN?_y7v@4S1#lvD6{)q9@oovxvX4x)SgPGCyLhl#C<^iEdn*(o@(H6U8U_xlZ$yd;aQLaXgOl#vpC#;ZnAcnAiPf8rWaQhN4B4Iwk9@ql7GRv{{&hS^aJtk2U*cPLi|%$S2sC9mqxJ# z&m)}$iw?FhQXHcZL@mU<2`_m}`u>X_t?<^W4Z=wF^A=GLcOMAxJ(cPia^ql#9-Vi~ zgf-o|%gx`StfUE4*STMI8EDoLRNU)`$X7gf*@GZo^Lcj35WY5U{Y%@iA{ozkMO22$ z_1O5{b5PksoF#GyqldxdhVc8)2QayLd|*(9%|U4C9SnN#3|*K_Hmv=$Z6qfsYJc?_ zyMn$$`m=r5(|fvc>2*8UhM$yx>V9LWrMg%z+`sUoRH-Mtt%tZu{<;N=@~GObdS$$`(3kl?M9fXj~*CeFRFfloNzgkDT__a-WlBz(1l76 zOvXb(BS*T#>JCg%bnb+6A~CzQ7iJA>GF6Wo?u4Ntia7-b5(^5~uLrbRb1%9N9m`<& z5lyNswiAPwBC&r>O!u2Y=Xkt#Wpf1(rYDxCGVHwQ%76QKes(Q+^L`%?EPm}08cR)n z@NX;i;)XmB^SC94u(BMHxZiZq+f=$L5%+W(Z*;yPO}b93PzzSn&HCt5b(_*9x)DnE z6WpKFfh;B)Z;r!?NAacHiRNTx&LSe+iAZH;_B>J;X&0{`VP6h0p@xY5me@GDC5M0F zUBch>(GOfUr-~>m6Q{-+NO|fvi`1hee`tol)suwEzOj1gML?nunJfbJdehPGrm4^Rh}|_mc#73>*(?}RkU=KfZVP5WzXd1%W1am$;>3ChtLZGzKl({XOFDfYRTkE2m&5A zvGUD7cDG|^awXY6Hm4&BeJz2}^P|^6t5~lgF(X8aHxhECzsS}>{MZ>+JPb%TWUw77 zL8(KcoB9w*uAPHX#VqB_u{tLpKq-tShL%@*^DFzF{L@Xvzs|qL3?c-RpV1C+KP`{0 zT$D*F`Ed=%ah#JQeC2x|aNbY!17EA^z0b>M5{HmlzMtTY&BG2DeD;6ke26}pXw#Qs zz!9qx6q%{?QN)!{*E7HXr7C0n_~A%uG#+wAe5n2yrgg;P6=d78w96t%S2X@aMw`4$ zJwM;^fx?x!NA=~9lK{fpMzB|y3vtkaeXg9damD@V3;l*TdY$R#xpDjCeoKDP*Ybqk z7u6NJ@YtbXAG*Foc6%P8J# zyxuDMxs-Tv5Zfl2Q!U1D(7l+mB~~a*;IMqENv&~(7%+R8Y>y7eA2}jML14sLp%1ww zr=bj0Jbn8u?_Q%3a_W{O`PAn{RK|dbRxW z0TS|dca_dGY!v6KAH^i-X<=_xe`bM-geLGB3EiC)~<6)O2 z{K>DLxJ$&XP}+mL&1o2NY&VsF(Ou|ZOgsU9+oH#9Tx==;=>K-S{XnFr&YkvgL*5Z`sG8)L;|DlfJH9K^>` zyZ&ah*Gf>=Qf@68y(vD1#xMH&o~(mz)x># zD^mctoUo#|GC4-S6~j^Db$?Q@cD!tS>2QW%1K(tDJ6TxfZ?!i=#p_Thu}_?2MkbiMW+M;h1>)IV?WT+6NpPB`YpGjDT+^ zk9`u3&q;{HdTmbsfGyni_6FC*E&LE@Gy{oq3ok)`JtQ)^gT!fs2clGcB#TcB|DaSG zhm3UR@7-HS6K3t<96Zk){`G|WlU3v%p`WcoI5n=&SQ|PyD+kV3lV~jO^)>}5^z1_P z0(H+g2i~cy?epptfm#)EksGostRWv!#~ zI?ulP6Tq}09lZmQn>3vtc?70>|C_UW8p`KjAwSob=n^HQ9MN~+VTy1 z{?uMKgEii<(Hp9~*e;e=+(hb{hp0CBdwy-Gl&eH<$;3mARwe|T-{Yi} z8EkU|cioeT0ndCv4JtU~t$M_-_T`=@>*D%V`JQ>0y&7})3oh_seU!YWRM%pqeE7HV z`|*sIq&@mEfiyf!t^KYQo~Ki5>v}?^X=;Et?#rzZHy}Ixvl?1|67#KTAqd4EwN-Xo zSH`VN5hQ*G|7~8n8H{P!EK7NBeNJJv(k-4@Sb3MuVgV8vY@Cv3mN(+w7i6axgv3YF z)DPjbuhe+USFZ*-TUtD^eV-M9Fh;6DRY3y(IyUbQbXdtcIlqFte_fg3wqbF2vf1HP z&XlAw)rx-w4>dfPcPx=o$X*g5Qre#1wUJ!q-SXT$KQ9U$y`ye}116LI&iCUj6FAE> zS~;i;gQ7YJ)@?0hk6eERvi)|;7h-J@4RQ)mNB6OW(9~Al$CnK zsqenL?P$CqoQ8VBd&j(5OPJ{HNBqza<7!^2nAvtS5ZWK3ew~!(gzw>IP2NW~Jt_1G z86_Rs_IMlhaA2Fl@dXzX1%WVAi#iw0`M_S>MHp!!F$ zO88^^z0Z+aBU z(}^VQgd~suShTbjB`EWRM0Lh3=HwwsA9g$x;D#P(CgI^l%K`}k79nL2vZhX~O&PZe zlGL?6`i11PMclZPl1@1$3{69aciThZGYNZWotS_!F0rR5+jG_c%cSw&VsEWk3Cd3Y zi^{=#b^Dz4W?;*Q=6fp2#AV{*2`-nX=_76p-RZLhuf}6Na)(3R3Uki#f$lNx$uQtUhNS8{A5xF4vMK&DIV6 z-seHBF&vJ2E@I>T?3JElQh%1DmNkeV<~MG-`_R4}6G!6ER=^ihul4xxAIb)YiTzIM z2Ae)E6L0ImzSPM)#@3Pq&!4mHA{m8QuIc~3P1}(qpV5@rx}m9HS89#Xcevf6IjBey zN%!G>HR|H2*D(zqso-NZ7mcA_+*^UVJ=w`#+$Gq+z8*~_@2$pZ(`ra9c&W$6`+>lK zBB`HJ#s~xv7Ir{cMWL1!>m46JxHJkb8YmF%EednF2f{Um4eblk6!Ox>%m&AT`-AJm zY-3nk4{RU_ZL%cHJ03GSBqkdvH6pmOjUBx64lzOX7w$}jWx_TxIHmHz7*NgBhBadO>h;Q%U+v~YH0 z#ODLc`-*=(5a?47FJ2Vj%3@`U>J?~O3B<7bym%SI)(GId<&An4ZckIHbxl`*mR2h; zxlkd{WhFP-v&OXupQ9;F#fXi5l2xn|aW#;+6*7kH4W7#`Z&Xwu%{5IaFC*^`FHZii zfB-8E(YnTd(q{)zD1=AUlipDovjRn{k{AvjK;^MV6m$3-U9}blpzA07i9H`0U}fQa z?@nOIO15~og?a6>CCxypR^Blj7^gCuK1exHL`pwA;%n|tOtoWcv<7~qI*UQZPhRfY zW4$QraG_%M8@x&({Q^@fsUNsiSg+Oe9Z43AeuB?>ZavjXp52kNxJ&C7fUSNjvZetz zcK}f#;d|5tsa&<&j3k&$y)Y;^{?~_Ot&hK`QnYxb3GZK}Xl0TZ!GO57Sg*yw)`w5G z(EiZA@0;p$1ydZgQH&(wI2m5W;D%rPDSG7?59lXMhW9n?4=wK6ct+ArtO_X|kfxQo zB75tgsCbIr2vKJ@Bk2sba7Z!u^DpLPy-bMZDMXQ74ezBQn;M4VtWiJ=#Y=cEx);&O zI)~()pNmM^aSQ_WHaX|+dWuM>aOOkOz*WE6lXc2TCeLJ43cwc%$vUjSOc*O>DU^yB z9+~KbONphbs;dN?^ew~eiAC7AzP_AA^bE;+Y=iXDO=6?aZ++#zOlC-)9YB#h>eg>B zp3RU1VGDmNodVVV7R2nxcnRCz7o10qQ9s2#p-&v6KJ<=Cn-rK?{a_w?LqhUT=Cae=F1(2nc>@cexp35Ue z)XQ*nx}sEup$?Bk@XyT>>Wa7F_Oune@M;W|^f8VY_~OTxHD{1v_Lq2-cSccR;X*VO zQ(UzZwxlLF^Zu3KqF>P|`sJjH19iCRu;ZOvF@pk?i_~f@=GwnLQ8wZBB^XByviHVD6epRnzBt&Bcvy8AeOV3MlaXUN@xzac@v+y zEEQBcy+eYr`~!2au!a3|BCKPPuz)D#@DjQjUgp}<9nxs*eK8Bn8)-kx;X}!Q-nztH zi&*gJ1XuhrNilRJF`B%@ZNhpjX;GkKWjoA~h5;o4a8iElrx=a^k*d<~K!z9m8d@Vn zMiVb^ov=7C1Iku=EUaUb@kkhU)RFNg^aFMjW$%gTyIz*sbz%|)9ATe`zVE+=G_?*% z7jItR=5Dv)v9S8QuuzG{Y!tr$2^Drmc7YZnuX{8&>K8jdiOPVtvjB+-P7RxEFJtY* z%P8vbTYFYJTo+MU&|G-iIFd&;yrF>lHEF@rJBI;+$df z{~mwRV%QTV7WQ4m=7#AbS)28BAZyTu1Iz6&LeGUzO zjA3EZ>n8sx&!5rgra4>RwP9*dyVEgh($i4+y~@)V(egDEITw1D;xz_?e2#G7PMZZ0 zB37FVk^iOWpZonkWTNBFyUN>W|0&Gt@J&=FToyL;Fp;NK{V^A@b_^&JM7+--Y2_&9 zk;)4?2pDs)%cE}1SC`1M-b1t3UqjX?!eaH&k9JXckdu2nL6o|6cRKpUF6#I`)(ir? zZ4cHo$W;9(5>^jJLbk8TGz>OlE(5c&aL4HsE@^liyt3|b?^oh3;wlGf#RiJ!J!3z;G^%()4b`xrcBA93-AnooA-B>=ReBU;i+@$3-i43X=pB+9UHyDZmt!=<9_1Fk zSE+MIVsyzKWe}cTqvJ?sG|nES5H3`$gJF`x>`^A+x0o*3;uL$7N_bL@4lDWM4SSSM zI9H|41umz3Q-q>bRt4!5c1DK@NYQG24%aPQztUiY#OUlplux)&m4One(ZPo(yYSm8 zgYUnh4LLYt+r;WjtTn6zDoEe&K2GXne!iAb?PWQDWc0P>pp9{husD9}VDeq;GceEi zaXrZc&U{V@hJ{yiVrF~mz~+PN@RE4>U}t+F>Vsp4pmf8cuAFZIca8a61eHt z)dDLf3CSl3-1h6|JS!#$A}lGw(2C2ML=x-7q9~Q6He3i7lU;0Hv`MzOOBJOSK3=7* zL~b-=5~UYjQlqbg$z?Uc!5wQbu-;;%;V^x@*pq8?YZ65nE>wx(VMZq=7-<8~%e85I`%@T0uR9B#qCT#g8y7?U{2 z%L<;rSzd#=_e)In3xw?F!1DqR&}i+|2mH6?`m5mQ^m-g_pPmx3leV-z0m#RjUi}9R z8RWA44_v*SA@Lu`)RW`&$J8IKa|D~WWqK(5w@Uh}-=5LG;c#<(N=QW7GVug(8E7*$y#hnzX@8B@LG|&q0kSyETa2fy}FIYXyhjMma~K>pPDQT->h+z~v8F6Hntm z?U<Jo1y&dtH&eF5py(y5QqYbZ}+!o75r@RIH z_k82|Yet!c9T_YTCH2)mMQm_quR7ksG63r6F%l{w<)Uysw_>~d-5Qb4NC-w!SDW4E zOf$%22h0A<=tkfxj5LdxCCx~+`Xp=q{!vnvmg{l=-!v$6jp=NN%!Tk#6wrweh)qW$ zJFk%cWkmuDHN9GOT+ah2n6}>~ME~}B6+Q=v1kNDDcaa;ImZW8<7w{wA^u!8EGFWBH z3$EXuhkbxz3Rd5IfXWSWU44LJ4|1JTNZyy~KamPCUXVXhnuM zxjVI-95al-pPiDEDRPe2SDnH{pl!30gXfIE`c6q1syHp!USJOh5IWfqMk|dC>K(oQ z2LjkzP%-p&*b-*eLpL(mAVW{*na6_GCj58hLalX({22Pb z&m{)L-6#3__wf@*d;djsCqq6?z>JaG=Xvto40RX|{(VD!R z`BDatrEx!o)Bx_0MI7WB< za>sbN!)bv*&-~Qm%V&T`?d)os`iv&X7IN4R(^XdbIOLY}t_?^hz3Zh27Hb%Ty zLT2pz@jaaG0}9|9kf$u&Yp&?zI=IOSE!FB;<j<;xEK%k+hS=DyuuF-v`-8$PgpV%PdI&*fODYdT@_~O5qgWM3} zUGG~VnKFwMLYZG%ROb#e=ZS3g&$}VTtCW_0Qed4{MM?pKWpt1fSfSM-ENfkAU>UN& z*ywkem*MxY_A%8by+7SLDCWVH*1=JJ19PnJR6*Y5wkMC;F+M=?xp;B6_B=j-E8Y}^ z4^V$5!gc!7?X4rlA+HqOvd7o7wScdBv-kksk*%M?BLN-xGW1j+?^ItS=N?M3q*NIt zp5dM1^v_RV;ToR^8QyjaV%b&{sok5r$n3*x*KNDmmz@HJgZ6*9ZNcHrUrR zx5B9_gXttdE|9=5bG!lK9y}GA$C{092NvvncrKIwyLw2qeK=5T*i8-)=hOO-mDklR z*Ureg%M6`RiV>asdT(1i(sFLNWZd8>0usdcj1{X%1O}DZe|@!@7xZU~QKjj7li{@+ zc;xl5hwp{^v~kNyhxB}7pi$rub;_51*Dq2z%mE=Wxe$q$yT3u6_q&j;u1ro3GwJ|Wx*D)qEkxSUx>(l5jO6E;dy$H|9CEVO)3BioywuWeK&xg=QpY_;x}NFDU^oMr+YuIcIk zPA|MV{|+z|zZto=x8wwSMZg~m2NgMx7DdanwG9%?lFLHx{Gi>$G}S>(NlvN@HL-vH zJUU8%=ibCrtZ$T8ls7UnCmjz|KJU}SExuQrQZGFU0+*hA>* zDki@ds7s;eb2qZxpfbUU&naQMbF^1BsCQE#c}wsGPka%zp$*{jHyV~&K}+C*0;rOV zm2S%4ddVurnr z;O)ekF6aYCXr~0tOkhe~G-7J$--aVJT7ssUK2Ic2CZO2BbvRRRWiq?j8@x^U=Un(m zL_Hlw-Y^Wh$v)paSpJk(7cKVjuPAn=M(8O;B*fis*w%s?yz3Lw3ZD@?HNK~dnG#%k zlYE{!dMfJ)(EefGQqc4uX!R1js}@u7rR=~qjPV8>oM!Niay2RsIfp}6lalH@_PM#=wm@9|&KAfLYO)UCN;w~>i*Oq^ zf=;}QIY5qh=E467CCMw9(htk77(vr;ygEv~Il)(0T{Q0VBCnlY%AhH-jwavBq-=Y{ zmjcu&JJ8;kg@R)^R^PvL=JHTl7pE=otm{wzSbDbhsjzGGTSs^ptgCe%9dMb&uHx%>{V1>8Fi1*q@?zYZ5_Mk8rZDG*~cA) zX!Zv{Z>VFOQ`GO9*RIcZ?GnV>Hn5@lq|CNKapzv*Hdx?`Kh-BI#V-Iy938Rf7XUGi zTRzXxhvpzGuu?U(W-tpq_THcS`%P@$9tWINbmW%_WkqKL3u(Pt zf2tjK5TSLNZQjz@o^?_d1SP>man;{0b_{{$2aTFv><|%NEgXAi;Gh^6dmBo=rkfvk z7cX`5H9mfhPvGFW(!A1rhHHcnc~amTIfGJv>u9ig_l8~&W1n2OD!mnLeOLX}2xz~6 zrO`dvF7*V|_{+M@Ko)OuGY$a63Ch=OV`=?suZ~bJV zAeh{^ar8-P@t&L*$WQC5d|KP4fFzRkILUIxkoDlkfbfE%7B7+)1^1i zRIopF!!7I!VFWHs-a$!9`tW7;2oEi6Fbh@#$V?siGhxB7_!7^AOoc=u{~m9AI}XU|%W!8wBQxhc8MIuT_K0^q)6m=PoziM?O8>Vr zawU;-MeDr{F2Gs#Zd*~bDdDp4Z*Rr%7J5NVJOxQoYY(n4lSeKH9QLSU`v_cYiwaGrI(Z5_h`ENUa6EDG4)^s{}Ug<2GBO8 znYk}^3CuRXPUJEuHXY|dH2SyPR=yM!#sL*C2UC8(XB2$_Dq9AfGv0jbIa3B0r$`hd z{gssgPAL**zNN@#lfl$ip9z@6XR`V|)+ z4T&&S+f&*!kQT{Ce{x)qvwG0t+&{~twv#`Iwqy_e6zU$Vv8+uSw$FAgO2~v=X zCr5TXVb3UNjZRC|ZR=Uf!wbgK8|KEYtuI%85?Rn)MmT|~>G+|lmZ4Z8L zH|F+WGT+zWo9gp}{>GJmEttsjXrHn{36{ zsGK|TN|3@(q~Au_E$-I0d7GVD(~ z4d{$5hGXml@Kpn%~g1@KkuGB)MCq zYPwDS1}1e7JYx~lKKb>LqzIv`3J>(Bw>vGV^WW2$V=L@T67#L>IP5a!47Rz#_os(; ze@{80nCD(eK&0nT*&218dU7{2Z}?Mzm*}XgKS1=u8jTQ@%ENj&cFqO^fd~i{_#nXx zrIZ)#F}6800m+G;dML~zSi8(Rr?qAM7M%+Jtelhbc{mrYF6#(Uc8|Qg{p?~EU4wAT zizYN+VTxEG&j1{0n>nr?{z6$6*Z!dG@!>pZC!KkP{Nd``iV^f>U4~m_L`kvwCvQu1knz>4{;}e=k#T#rXv`h_=DbbtGII8=Wda}{m+4v$+wVma4clJ;QU2FCr!nH>pZFh4^)*6 zBU_D1T^aX>uSIFiCHXHQE&V~K!RnS@9p@)o&CeX5t4V~NmKxqbe@2W;=hUC^<93FR z2pHk)Cc>3eypc3@_bm@oz22#4*VoAfd9Vh!M9|EHrB^R6C;2l9o{AVZaMygb?b!$v z0Uw0La4ZEJ_$6LWxK`ENebSqdS5rJhvxq^K${3-nZpyR32$GhYBLEWhCdG75O%d?# zOMkkJFd3wwV{LR9G7BtR_b4;3TCL7cCcKO8$NBllid*#KoHt%f-)*thi;=Y848QH= z3l(|CP+3}2d{ueJK-rDpqQBQaXoH`8)&UX-AD+1w2&WX)XYE1GI`9c<9Gvt@8L+8q z!(y5sx}{;*=5$Qv_hw3?dzq)8HTucr9s$D7 zuL2TXRjlVVyk?LN0&Uqos3kS%OQsNpL#d+dP-gJA?F>O;kp2tUP1dUWP*b*;0Pr)x zh`mvz^_VW+m*XtJ((|!}r4-%y7LgA<@KX3gW-eNS7z9_3IglEAaSn@KjnslO-x8lj zwl3>3ccTBA{X-EYAfL{vmdMU?##j~Ek>FuFGy5D#jjYenT8QNJu+%W`%HKwf z8Ey$Pgj5@!7VrirmY>y?#e5j}9Phcd)GG+Jg=Ow{5j9JzE%7X6MH8aAO9JiJBJL#Z z$RgIZ+wQs!jRDgzozVBEu#Nqted~k#F>ra%0%+pR=b1}amEckrGO%lrgnPp!%ovcK zG#_ZngMJVCEBNQWBWbl5h314FE7+sFh0)P}(fLVQ^W`^a2SyUXphl_0GqAb;c#l)V zJv`;degE1y#}GBLd_fahiG-FQknAGX8B%&&O%{3z)GaV zb89prt@L#N1YZcby-yDf-SogQO>+2J7bW>QtP&~nya1NJC+#~;4NYe5s`>G^iCA)I z;%*W{w1ev5iN*T`Z^C-%8^_6E%HgWW8Q_Pm&Z48&>B&=91?w&Rvm*L)UvJSfz`Ibn zvj~dGHj#O>vZCX|2xtw@RMw4CO%m@vTejXww2ET6*zUzDBhR0mrSqF#$31O;yOh07 zLVj}4gKb+E86P?5%JvH?RT;t)$PJFa%BJ)NewNNyAm5#kS9)BuqYe4&g_<>k+R{mw z3DKT}ygxn(S-jWu2J%aL2IM99G_2;ID%A;7dhu7M`WJ~VXq*T6pM^qry)(qOb^FfCooKI7kz zW#5pu&-w~9yM`6fFQFeZ@&*-ko`KP1u**-m;k=#l$te*pq2*+4FzwuM!lms^IQh4| zJvo1i`MyfFr=W^KyPiDrGslTfclmdw9|`ZWR`Xt&ev+U_X2McW$94tL!ZSv>)-IRu3$_3#ZbRKj`QivFWa5*W&ar8}E`^tciDB6N>A zrswakD8N=eM=*1|YvrxjJEtN!9=Y-dv*aFV6u>@z^q$QZ1fD)1@QjgmR!rhIexBV! zSa9XNENj<39~@3QefroE1z>~BT}SI2e0@ey>hKS#i3dzZ%>|3%aDxvQjgj#VE)c%MMHY(i6w)ucgs6wMHp@SuO&4m=93J%)A6^Q5^{O%oZ9+yfGOYW zA3**W*E!_=@t_L;+VJ7oSb@naA@{!?1pA>!y8yl$nKyw%tHGcTFnLF$!h*aLdC+;U zOE-DJgZm$8p)Z}B+npPs0FdII4`C1;cuG6Q$Iy8<6cDaRQ_a~_dW?Hl|GGzeiWl z#(>}+-8&h3(BIIqQ^-vBWiC8Oezryk&wA3I`HY+lBBFX=kF%aK#Thm`0r4*0dYK%H z04B4eYBy4*?#vflt8Ng$h?L-)tlQ>{J7fd`SeSBRn|F#Jei_Vme6FY@eO@Q5+RoT= z6b7x|G1&X$c{XSis3n((=6>fW!5srxB!Xt_cs(RpL`;R48PBR*Gwb3XDX6}3QYEbK zUbs%xX&KC@?+yGC^bR9km@u;~y9M&)dDcT-fRS*o9BPw@S{TBu5kmJ?^r6c)r}nys z_ATHvwSU!3lraL6wfi;}<`L_C@baEP;}1FIEBZI6soYj&!BhIZy}+}l03n&flhA>s zLBFG28`<2M$N#{+J)N+V7#HX_$Wd@eT9=}3@lEf!%%lR~VR{SqS|m|uz(umc%-*v7X?Ge0Y7>heo)rSX8RbXyG7>d$&0R+!(RgH8id^BY}Q z2154^yrKkjsKf|_)T@Sm(&2*}$-9FgO0c1-Vdz%|yS6l;Z|A;-JA)^ukJ%*v{morl zy1X9b#{fe-cv=Y{Fia!RoIhR458jCyXI2lcM(aSI$&`hldv&0ZVH!>$HQ}of_<`R8 z*}z5lx{caPEoUSxFK$TvQ2qSSx7o8^Y6{-3Orr_kd$%7;-aRG>pWjy;8V3GEm;9+V zXhwxnf|ryv*kp!|Pnc|P1tN{^dtO?jl{LB^rwCTdaV<`Xs-j+*Q2+EZJyt<_E1HawydU#1= zwhMW+WLH$euZ9P^qlSKK$gL*K%Mg&%?4NG=vlym_rGG8E8wqGT5Zgo0(aMbow$|PD zykaQMJNUGp@W|Z0@N{1?R_lH0?4#igJ$OA(V_M;^l4CBCO0hjW7kxqB*L$6FOdHP7 z!*&kylZ+)KIsLmpRF9P5Anc3G{b26VqV&bYoVpIHKz#8xTz=q6vJQG|GY)&fL0CWO z-_CF!_+}OMEoCjT|7s|%!!dBbpkLAGvF7ba>qnom5Unn(f<3Gi2Cq(K#SV*V zM#Hi3(!-A<7t1&;|2W;saNDEb)l7_`TZQJDn%*Rnb;uqL;AbA+_^z;MF|BLwQ+TD^ zqBk4H_Ib37BMhQUzqLV*szAp^cRPJtn7|MA8cvCP^yHv3{(5~hAO^!eR?%JU~0Kx5l0P;hj*`cMQx4e86?#$)a3?@eVRp60x z7|Fo~>j7B`35TUC-tIZktS{!a@(uB|gJ7pyxk>~1L?UOn!tp`I#MP=ZRV`J)y}yQ2 z7mdt`#`+FvHx-C`jBTQHoWi;uIML1beO0Epj|_rAEb>_clygyGUB_ zVQ|T;cU76vLd)yfTN<5qjQ~KwrHYt&nKV=jQj$~MKnpJKm|<%gH_lA)EvxwxLr7Jf zHtV}43ka@xv_JY*g@ynMu2ss8vhu!^tB(w!uLv2Qx6TSDpe3RIo@jKJ4P`1A`yNSK ztyHJ`FeB)f{%O*J{aSUGA>T`dB>qd=12sY=2A6~VR}%IZC7M<~@A|E<2D(=nyl>nE zy)oM(*^xZ=+i?u5_NV;tqB)}JzmgkqV~f2%HYb?Y z6kD$P%8#R>Hp-c{FyX4T9TSi=s)1~4ioUExsyPHbYyxcslpUae^OIe3*N-htfa%Cw z9lCBWF7RKgGST4)AI_9WxoY^OKNGkG_E5=Mqv2Ak8law0D)V zu|3OdLzegl*Q?Cq62djI<()%EV$TW_o1X15QgyF~hILm7|!TWv2T{-dl#UOHI@y`%wv=V!bjpWMI>0?3&^dm@PvO!j7 z*T+kct{^DZqVzCyaVc7;Df|Rj7%jfnk=*!ZRQ&A4OsDcq5VW!2{NKWrUSAM2tw6)@ zd(x1l?b1Kzt;IsVxY{eGNBTfnG|U>>`Fc0x(;Y8(0$-zh!R!W2t5DwkPQxFE*=>&5EtnJoV7~fn8a;e} z79=rpS8n}D0IvfBZ;FTyw$Eds)eYTgsdXu|1s(M+e|@e{>HqrYB$`2(p1Lz``Oi?8 zSD_cG_Zbw`pOfcMs_s|QGP?dTm4A$FzqYtNAcOz8cEb};K&x&}O?g_`)wZx7dgU2( ze@kPs%egQ&)x`^K`ULz3(3XSC^;Su5l>v`%o1~=`3+gz?)%G9A2HNq`8Uev2WKa|x zG+|2V61jfq-E3m=gZ-@|?N-|Pp4HKW8#SB_Zdu-#u=Hs71Z%Zz(BGK$VUooC?OD5g65m< zoSeLakbvw4{be9}WT0OGn2`BvOL+jzB`xyma_IhBDFd|jQe*U5O0dU=1SFT_AC%`X z#*Uz*wT-qO1l;c2@)0$J8Aj;$B#c8y8Gm7SNxAS5(7^Zz#%CaW;1%pLBVz6(!)5-p zbe$39InZT1umY=PHjd{Hf=>P_S<>1uIoT}`KC=(ez! zl-Ak*B+$W(;8{V3uW)C_jq;7yDe>_m+#8Y6{xNsupBqN^EkNrH^9Q3mhxL4pniK*K zMWqf?TA5gGMWvng3HMWk#el7p{+nzlDX!ge#U$uApTGzyna%zx6`|Py~<(Gz? zCf-HM#;zN z3UK?yhcaB~2<4SoM7zJqY*!Ihfn)US+=7p^ej|@da3cOob?!nUkPv3Rr5$lD*$?jB zlBE~*g{o(R1x#ND(k#sUK0zAu>x_0D3>g*=#Lef9B`X*6wfEguTvBZi5Dwto7_7bP z`&d*>t>PuKv|>VFo?yP)8H&?VoR5 zptg@2n<0qKtqTgs4NU4~eu(>xzCSDh|PSR$bG_4>*0=`Exn-{hvYB?9`=o^1%+l zs{gb~Y-tvAaOK|_5xc#^ISWi^IS@U)20tM!`xBrxL!X+?NvQ}7S7I0s6m1SrQy<(H zct6!aGsc=6bbM%1N6_>-yk?Sc%ZrW)dAhs2SxvwUQ2Q|Gi#+lb8}2@J*8A4_x-~c5 z-k_hf)woMzb(_DWT}RxV9BHmKOb(Bz-zQn9ucF~RpB6ywTOrPVd~W~ZGG@B*L!EAa zH|Nw>V&MezLXHaQvYZ*ZuJV=S=YNgxTXl_^zKN7b-DbsoFLKW}ZW68FvC^h6w{_<9 zp-ZK_-CpA>UsIL~CKg0)`}Z^lwOW(5l$=2+R~>qDl9B3XtZ5OJKCmu6BjDT~*H2$O z`(X`R3|}CMy>WXAvotRK{Mpq70!&7vWxyZP(80dqOM9#b)@_{dx(@eA+@o^OzNYv) z>q2R;(;{|jNnL3oFGOt5MsCJfSr4jfzAZJH1;0G|LBL14Tz@S%!TMx8e#W8IU+-~n&9$+o zb$TVdOGg{d5H3A6s7$;fr_8Mz%d(KeBW(u{E7ck&JDbu2tcTQGwQ85=)_utcVCt>A zlM&FdiR(SB5a_KtA90DpHSl zMWY()RysB<-s}GP`9T`8w0QrUU(=e>ro5=HVSM{C!?}Nx@183Iy+o3EaYAC@eXR2x zRdKFwz1gG6UqzR6fP_^g(-wld=K;A*9@gFlr?@d0j_JBC%WRV6wB9YNvlXDP#bx#s?Sg)| zQ|+D`5Z9h+FTad$$Ca$lnt813?7{v_IUz0V&ntN_FfVt3;&!(TQvSHwfAWLA_@DzT zHqC-~=lLklJ`P-W02@*N+p~XKGwYVlotkxN%bloUiuTy^zd@*P&LvBdyxwQssVaLJ zF%a$f)*Tnuhi2UR_#M_&>3$@!Z#upwC*SGKz#8cdwR1r)QJ8zoXE)ULAzwxtEU($z zvvjSDW0=Y@-blMwd~oW&hrzSJbY1(%{sso;5{KZFzC&ixMChJ9_vwTe%qm!ShybQ}Usx>7_w4byG7Bv}XrADYRG!nfg>WAGoCVR*g(|Et<#H7+k$mbT#Ix8&Iao z3R*hb?$l>bP#0>tE?0Q@;jr|H675ufZ^M^O+-SW8yIEj}yk|0HrcCwjCi}qhAc5szx-a41?N?W76(7Bx$e4~0;eG-ibxZzyBlg=D z0Ke|{imuYWla6E!G^qUv_b;Q%8`M%MSBgdgrt5~EXYscaZ|_U~QCm2(c?CN&iSysS z0$85-Rc{Qdn)b5nzfSD7~zRhtZX&wZVb zIs786Eid0xvh>`y$??iFe$j({$)ws!W*=+&`1R!9wM7@PuXn{Uv8?%sy4rs9*o4@$2#5ruS#jx zGpHNk!0onTsgIS$Bf^0rH=^rZJvsj4YYWa4bKv(>g~bg;+ZV1a*@8Y3A4wTmG!m@( zhvyL3$qMT7qzuanetz%$aO@Cd8CKsY`tazOT@V7}bKL#NM9QZ@5PC51?|o$C7B z;UDe_0;mBv6?M8=nL5SGDMu8@f~CWa6%R!`YBf$u9Cs=ZZD2W2LwI!=sC|6il(?Px zBAuho^l-`&HO%?#z+}YPI0G7}y{NT(c)_pGiurB)s|i8JWV`vUEIS-T4al?4A>E7H ziJ~BS{HYW}GQmDI?qAd@{%UGDwISU$eHKU82-XNU!knW*`LFLi;&jk0V`Knb04~#GcKf^b2;Hp`r9PGAYS2Qlpl#fi$SF74)W2{i-d$CR%Vb!Wk z!%P&(qC{2|j&Il_J(wVt9Bt#N65MD^6Y?WcwrDMDkC9xh%EZeQlO1Qs-^bd@LbKFa z^z;y%iYkyD*K`C+h5ZZo#=(!HlZz>b(JT3DeaNa5Z}drhjtb5#y#SY{4pGfA!T9Hz zQL|KGrZ(Gx4kHdW-X}eYgQA@Ig!E%LJu22zkuLINReJy@vlYg1;!}qZ`!26wM`kmp z6V&HNF;V%1^e~HRe z4L5PQWz7jSf~!*wpso28)SUE+6f(7v+MOP&3P0LN5LvKj2jh=0_RCyQ_ur_PCzVgW zy~S|eZ)N;(0qx9jp~h~2K8Mq1rtZS|5zF*018ZlU5xVF`3-9_K>D~m)dU+sx!7?yN z@Dq`MQJ2@8s>kx2tg(T1`>{xN?UZ=)4{cIRku>Rknwm5RdNJMGgdATaP5kXxt4=uH z_-$TlcrLN^c~+b41`5{Z*paaK`}a2Rg#EvjXBm=^!s`zyXS=a^V6IS|@H$WJTvAA{ zHydwPCy(8`V%z5NJv}>Rn1{>7U$9#^#3+E=mbFFXYTcyUe3-45$|JlQV5SQ9kkiP_ zd~PqgZ$9b1aef_}cibAQTRikxB?!rROc&|3M8W6p2{+RAD5#^*f8e5uJKn3{qJlfp z+fe(BTUTJ_Ul?K}H!Pf(l~rxtz6qM*{V#c(4x(AWxN) z+Fen5J0owz1w6f;!LS(4EqLBhK0VmQc-axJvZr?Qn~tJk&pLrt-Se=nqSB6{APeM*MKD^kB9!_ceo{S*KiYA$(^9`R-ZwErZcIoI3vs??&P@F%xi`` z199GNf@|t9MiGQ93M6D)S!V{~uJGcaeBH{9qG)&FIPvtNfO~9(j0|_n-X_3ueXI>+67n+6=&CR}sIxm*J;p|EpIQo)d{;qO7=CgKG-KX@)x$Aw!QRmQA zL_9ChgITcB0o<$l0P880piVO)8|4YjxP~rdaMuR-Qy2T`>xxG1qyCqir|VVBHW@Xr zjl%M?^}J)uf0e&%{u3e?s$Jnd-fF=blp|;r)Gz&>6sppccq=O_Jt`f$ zEyx|crL)RZe}7}Hy<7)MNy6DbD~9iP3d>rD?YStk%ZgKX#y%0*u(YT`4Vtmdwvqjf zMWoxHpjku38uzG4)XLO^NnS6NdN^v#V_OfQp?ptj2rk?tXgez_&YHiTb<0SBgBlVI zdyFvY_5_gu{{c%2iu5V}v|- z+K}czN_PQ7wXOoFFhuFan_2|Axnya;5#w-prFs@9gJ@g^O)015H^9VG2zIG%EB*X3SRof zAHJl`ztZk5?u^&r-(;C^=K1aJRE__Y7EuN19DT@=66Y9gVquyke1Km_7g(~6vp%p( z8`+2?L~d;%!K}vsBPE&B9PBh`CN43IMyKwX9a&1EFHSDAj&)LxRPviiec`?MeO)hv z(p~~LjE~vc#H0^vu_maLuau!><5*s>&b>ayy-xXMi3ZnV9Ahf~SJ+GVI$Z5VY5qY7 z9Vey^?NknH+gXX%%SYt#Hyi5^Ezvyo67+$cFnA!Er$B#WC0^)nl162vAcluWCf;tBJ&mo6 z#ZH2pHD|*c+eLFF7LWhn@ACP?yf8-l(9kH2df6&;us(9YO%Q$cP zN^NHMG%JzWR?uy7%TQR7f;b3?gtZssYv|QRIoy&Vr-Y{(<4ON8+a`X*tNG-gKHHJv znb+^15o%uTUi9gwEBwh!AjMys8S-StSrN%@(0N!Kky+r&~y?+4+E zpLzq1qfWSG$1%gfz~Qw?cp@-mT}vR}jxz!Q(QXz8=ch_n%hw1u!4$`-@dKz&si9P% zdP{WA5RPU{&WbbOUu2zSZD(0fkKs6~a0A(~LeIwRI17{>e;3Oyoug`}7H;Ztw6Rdf zcWGINjZd$@rKxf>n8zEBiSkL$;`ZO%-Zb>@BnAS5wP+#u59s z9+l~!wt-;jASlR$>Xf66k40)MS5_jfO1DdTAxoWC%BeGQ0nrB&6fa?hBgWsQ&V_g! z&A`T#>n%&EsykiUSi*s=12n?7DIUeu9Py^Aq>GNQ zWlAhOPJmNVt1{I0KzN~b`C%a7DoaG<7Fk zEkO>grh9OkamzG)WqFtWyrM}t|0x!>xKgkjx%JoTzxToE@!0*D9^0$ugQ@B~#qsKg zLx~h&j64n>ccg(S7501*1^s6fJN32XyO8+)VMxb`k=&Obh($B=WGv_+4FoN}YK9|A33wm5tY@ODb=|4fdF^2&oC*jquu}AJ>rLz~Z zp%1JVT!?#qyV_jH7Ap7_+L3A630Y|mUQI?WDUUB4*HJ4b1az2OiKxrba>!;9{(Bhm zl$WG08GbdnMC4Y*BZ3ye{^d(UZpd1{ErI9w1&FFWv+*zDAPTfUzibLVNLvDTO#1ZD zYSuMOd=f8v$aNm+w;nh8-c(jyU_HLv12XJbAQkC#KGyFcsvr1T+yrH`FvA^R1oPK-Ryd3ECo( z)g-`E_&Y$x>kL`KsIrIBgZ~B8c}6|P#h#5%<2LcTsndV;vI%!v@nQ7jz9wk9=;cbM zM#Yis%fVMw(|V=KxTKAbWJPq{^|KdeQls3PTDpUq0X5|OlOsE0r1cQ-7GHuizK7^WupEnM2WgKAdQ&|U8 zl_}Qo{i(meGs0%&+uPjI^VN|@_%+90!V<`ZabFXfpsi>Bw09eNz2vB<)3ya2DD;r! zu7iSH8v?3+P#BnD9>*#1SF(a}aMK`@=B&6qC`Z)B_xGE5hO8+4LFxTWxAec91UFB{F6oo0;!7HDSi~1hYHiVpD=B zJ26eJRZtylP)R z{_u-I@TmCOj~5Nc+9ifVYTxBbFQ`>C(&&(Pi$rFavOG1`(C@OLpU@!RSLkN)u<3`Z z&CCJbSUjluk{-m?m1{@t2^@dXqCIUAdSA%@5NtiZ3c3*Fbuc`e9mwNN#PN9dhu_gx z-#q4{IMaj(ZVasm+O!MvcyLXb8ocf_Ot{(Z=0JB+8}fhGiwg51`||}sydC6g1wphO z+5#vz$r-QnXEW!978CCB1BVtPi}{VA2@bTlrM*ps!H5G+S#i9*O+goAioH$xm$y%9 zXshFs6nI=#SpV#rw%{`boc8DypKRp3p{4oYn?ohDH2b(TE}TqE0mZW$EU zT<5#O2|ju^7rR?_uA!WALoqzBT)hsSwRCW{!JLQu^d?{b@oYXxfkszlidY4Ap zZvo36gbC!P0Vk)&Zkv2d>Vw98duVigWSU@h$%qgYM5juP@i+hh>(c7MRzTz`J(wz- zVl5{sy*j-r!9ABED%)w@5=BySl8;G$^2>@q{sk0==qICU3xt=R0k>yJW<87 z=c1EIk*LV;Aoi}n46J|`*ipN2j!3no^_+gB)`TU8*=X4n-$SpbN7+6|Je@mR=#Is% z;RjY_L>5&~(U`Di&S}A-LD%gLW!lAM!w+uvXpcrJ)@M7+-mN~4E3F}vyxX9p%ZBmpPE5t3Rg zVkRblq6G8XWJvsGalZZhNpYe+J6?C3kFP(_=sdK4d$V8Ov7ZLD_oC`8{Dl8GakI}G z247KETHY>G`0`*cUpHI}rfnM$*Sjdbh;B6vfAjxX-H&s3jNQxUA?Z?SCKDaV3%7NV z)w{TSKKm}KDedgX0FEkfC_F7vd#=}=dI{OruAu`>J^hQF5W9LrCFX+=Icf9T#w_yyUCdn3eP z#K?2uC7r4eHapZ77i%{q-_o|U(THr1{rz0%tAnLK7tZPsV)yfccj!m&=lSg zzs&A2B(OTKd%Sqyz{Ju{OG4)Z1L2Mj!iUnJN5@PZkBa4!*od&0$OhaWbeS;vKOk7) zls|F|s7stS%_rweyx*$e?gcVz43>4mVSAzN+ERaQrczvSJoeMT^M*;DgTXrQd$HU3Mo0H~_c`r1L3QXB z{?)c#Cfb~GxEET(8JlZgOv;E`3&Kt%5H5zBVxFA+kt0;29HBupDBg{QA}EL>y+cMD z?}%!tDO9)gYFxW2)4TAuLD%)3Zg6Q1kF&+KiY>j@B~6KKSX=&wi)mUC)haVZDk&FS zm$ZI=&FB-qlvopB) zSDfl}g6W89b3TYwkm+_Bzw}zdc3MiM(3Hdxbu1qLH%~YKNsK7%-%c^?pU}c{S z7(_m4gLf!8l8U2dc?}%OSkrOfImEtDB)2&XQd`{v!?zxT09Um9Hww8{PWJNu1KU=EBqdN zBcv|SGv*)hikSz1fgcO%)y1^U^wKuYsmKh{_$OWbU?RBl?;V>GFj*cjSlB&E3uGiC^dV8l;$}Rd-FVA8Bfsr>?bT)1oC&OZ6+@?&i&p$XV*{-w}_g!7v_ArMIHYX2BLf?I_13&BL1cWqEX!e|tB&XZ6 z!kQ7}rN$yr5DT()AwF#bi$fl4chsR{E3Ro@jQ^Glt~Gr_wTvn*HG-WnIJ4GR?$(BdBGr?+p%Ts zy6i-9fBzo#X>EB}30)78dQ8$dA4D4gzFr*8*}-<4h&Vo-+g(-HB~V6irSG5UXVue^ zetiAnRfkT@I{U6)`tWRK0mk(mH&HwG5gM}^81beig>l4+V3yqmMbzfZJhDZ2r=mhO z-KgIQqz-Cj%wPZW=P8{FRDy<3qrRU#`ps(1su4PLMTji z7Ec7p73JCsj*V1`4;cwrxFM@x!oRsHcs~g0WAw#)@gl;ATRdA>17wf4EO*OOW~Rp; zp>ZjV&`w}%k3S~Xt{FL7kj{>C@fjab9|VP`O+ z;Ad0JIi`mWo+7O|e$er)(0sYIcg z{hL0A#a?OT1ez#}U3TZIOkI`t$NlIBo;7x0nN|wnIY4K;at2{ zR$J2r^TZw!BOfV}W&iJ8<^pA#eDeg>Lt@(nJX#FS1x%)C=D@M<1Rq8IOStv0rfBun zS+*CP0BldA`2I^#v@^!Sb8FXQt>TxYMheF~p754`JH=XaZK^S?B0A(7hhAr!_S9niJ?>0!tM<}qOZ)|DRHWiCM~Df^7eeZAwv;%9f0i^cIsSVKdkT%4STd>>N3WZ022r{qP7f!MS_QA6PTo z0dM0g?L?Yo?!yL~z!rFvT$$O=0`zB(V&URC4cUE!BJU{`dAnr0Uq9gqu&Av#C%#Yv z9SV?N$%R*@E$nSMSGA%=_Wp*GgsJ2-5lT4`^lm`8xm{_jJvXbCS5T}8UZ$`?2a{+Gr+`9eHk{q64)E<3yhotD#6bT@0+1aq$MWI2=?Z7RV_%(A6kU^4 zo#~=zcmf94-u%jI%LAWdZ?9Y0Wg3;VUR|px!9&W~`W-I%X8=HahcANUfSW|ce&rHv z&;Qt{`t2rZLIKu#|uEFSD^aDh*GF{7y;tTGO(h)cS4~_+S^>`n=m~mQOJ)2Obpq%~ z?Cdzr6#nxKh|L*^yE~JWDpS#1d%l;#_a}NQsy_sM3OWfe-Rm<@G>`-0SB}uJF^!*> z9wZ(Zq>KVT34pb&-Dj!9y97G{O)OIgR)cd+Q)2dKwnzd4N99E?Gzc7H*vv(spcjh- zhjx)Hb9tCxDY~1EG$dz=PO~CdbTC|jXQuBZ+s8i(9u#E;h7UO1C*85XFIw?8vIAVb zU>XH^q92lO#~HhyUxRYs$FSCeEA&?BLNzd$<6fLCU-~z+M1$hV1TsW=;7J{nV=`lu z@y_C}VrP~uj%nsX5UmF7qXJx&k;0Z=Lxrkm87OdZTlt2p0B|vroFjsPK`3y;po5I# zjk%&7d^gbN2s$B6h}$raz%@@_DovFKhGUQ(knV`Cvs7>dLl;-sRz96d0UeW=;-Bt~ z`J!B3dmvl174#C6P+{sS1{jZVC04$>NCSJc@F2t0i6FAgE>4G=jU1Huv7A9yLbw|C zfXsoPPlc;u-O-cfg+sV11I0N}z9@iIkPdjEmH3C=nop|dYrss120`8kkH+*k4So)_ zARW1F#8tKzrNzI%YR6GbMvlrf_kJLH8Fh6-UV`gl+;;(rlMVOz503r#)QKA?BThI#Bd@#`&>DN#hH)b@!PCCS6tq zCo#*XyJ#DK{L`^7XF(72`mAMzf*~~&Gt7N(0N1l>qOn84R9>IJ6Z9}uX$CuP98_DP>Zbue&=^2f;k&TOe{{ zP%H{z1yYNsO6jzXrP1zAe=SmSq(Ul4KinsP;BwNz#j7oGF6g{CLuck8^wK6pq7{yU zY!~m~KZ-I(s&gKp)lh5rR#b7jNT}E^+vW`9inLf)L5n*J$E%v;i$5JvSwySw;TB1N z|I6?NWaSYiHQ-=^fsKK_2be!buOq|Mn1^TtwdtZb6aE&~H){H9oopZI#p0>vf0u^i zWc$Gwm@BMEmM|Tk0^oGPA(nldx>(p&fOji;$Fe$?N!e3KDR z**bn1H7jHB5Evo#Rq$rS1oU$0gOiwspWhZ{1UewpK!2SZHA@X^(3~T>1o{UnaM*@B z?X*i&CHnm0GI1R;0r>YKgfFL-Dfv1dcQU^ZjBI61got_028*wR;Od~6ms#;4hS7I3 z`G^}8KP5iNTE&v$DscJf3pkNG*tjDY>Qf9d73jq{z=+84ctS699cR z_@Un6Pd6fu2Li&cuU>|~Vc9HhJWE@0JeV-(KUI-R2j21pt2=~IS;5oX%baX-=jFph z;MT0}^RLWx#*1^?;QbR_26TAt*!zY~DmIdpSHz|9qg)VJjFH4MP# zvXZu}o?Y9u_Qdrl`r)@^B@c?_hic4(3ljn7OP7d1)tC+ELZev~%Bz^B%Wv z$xO2`EuCDU6@WB!i3efFxo_+2M>F~r0rOg z&ETKfwHe}FJxCQz_R~VFLC|sZvcXOQ)#2hp9e}gd%_%4DyTMK*)#1uR9pr=)AFYq^ zr#@Yjtz_LjaIx`m)RMtYMYq@i^keDbIBL+%+u8~oYBgwPE)I7E+b@#R(&#r?-P7@F zLEqVN)^(~fj%Vy;90WC-Y_|`;uPV4+IBP^j8@3)!enK+_G-!q{UX3`>%P$vY&!Rfc z3-}X>hGi-`lZSc6m_Ti#&18*<~|4qOv$BE-tWwqtfPBHP8=X=Yv-jEZhk364HhxpUDbuyGS<8 zA>|bZt6^g+^?}TLrC-@nD2gH9)?c>5=0d%AZTuL&X^IK6dZC!vFvf z3eIlu?P3gE+_`sqXVSS>@8&}X-nPE&+!5=a`T9+#XVg%~x68ZzpFL82_2!JZtJ=Iv*+3+@fsLoe)dS`@I!!e%SwQW;#@>A?NSs%HtO z7J~r?znn)(o?-UnH_$y6uSjD5GfwsW1o<4o)5ZspPJb7760A^C0S2t^_>w@`R{@p@ zw)zF3s)|3&NX~&}a}LB(mNtbd1;Dp(q7YYFlkNalzyh%YF@tp(qt!u*b4aRq%fgiE z^;!NPrLr)skfyu!13rv!QK?^ZiX~Bob=^?8KK34q*aq2nJEVfNR|KAX{o9JDLB4j2 zbfnceY44BTEnD-IwCH&;2SdIG`L&vinw8YprzKk1Y=*CCT2G{~Vq!nBPC2+lq}Rjy zf$yWM#!}6>!_Nj~j;py_ptNqZ%;Z{V&$qJEiB|J|FK*rZJ%pod9N?|IQa2aY4QP8Q z2ppZ7;Up2I^j7F^$8@ZAWpGPg6JDUZ@zYq(!S7jPGf{cw*bNHHI0B;h1tyEf>dgQvKmCCo@1XZxk>0g-O(5;ZWOxjY6RTU27>(Pz^KY_ zOojbk#m!~eyZ{FF2Sj?p_|=^?REk!p3E+1UmBkXe1$1-NHS;s!`k`!gyhjUmO;cZL zz+GVF@4-~*2CQR3&PKa2m$ucDeq)Q$6*bWIdExhwZ(BL%GNcjbJ;5gLej%wm7mCQ{fl#?`No!62PFs=M_ zie}Sl?t#|O&%oLy4X#gXQ5!5O>y_T9#GJSmll0LTQOauO8~1rdv}n?mu?7+-sV@Um z=&KSS3_-?Fv#9axCmuUKUIn=rHu?Vg+a@HTrmg8FDe(!=^oA5ZFDwx@e>=&rkYxzZ zZCR6FLOLX}D;0kEcADWPO6rx4OdnDwr3Rsx&v1+Y`*K zh#4`d0i`6LuLaLqZk3R`HR;;G-ra5Og70cT(4wI((H7&kctMxjm-bG4&WU0Cl?Oi| zUTT46wlyccBUvzzE>=UezqtD!bnB1~hmw*G3^vBEN7y|OnB8co=5wB-B4#!1pvaGo zjJ2)SU$DA!Uz{f)8B$HG-S3>`7;_saWjj4PuB|^X13w!7{u=DJ)C-m0_uyJMsVSoY zPiw(1-x(?+J^f*Pds*_`TWCexi!uLA1G~2YzBTDG~ zZ~IfqxK-E&#pUSR-(rB#1Q(4kgIiWh_$`EZB4CLy8d^Hdu#{byGWcEb(!Q)a?PIlC z(%s-ar%xp^M**DaPL&EG2|4fm-0kM4#I=;K^2aXMTTW9c>Pa)JmiblPr$72C>9r+Y z3ax>9^26N-ubFnI7{;PfT7;}w6Osmdc08%Tf@r5Oh_-JRA8Kv74cAT5=I(8+q*5kU z9y|Q`)=9=W($?s0jHHaAEM#r%s~4mCCm9|j^_#J~*~r+|fiK}W7bQ9p6*~sUz5cw> zhjCt3GNnUO%Scp%uhvtxJAnEnB0Oj7*uAz2Q&AjDC&lvJgF6LYt(9$%qHn0M3R0!06!yj4JPby@wwB?X;fRCn zOOsvHjQt0>c!k8xaJ&!Om(QQs*_t=z@EZQ?U%Rs?It!UaUL^!2@h)gaash`OKYf?E zI_Wf5a4ON8m35$c+{GJJ&1dfCw7jz5UXsCj>7$e8TqPN@mtH;;l3_(}&G7zW{k-W_ zM#H;fZ%V><5SywykS|HENfMB0@a4R#t+(1BfvalW zP+6lwSLR)CE~bk*r%sXxnszI(>h)jS1-rDcnJYHT1?lRgu3Y%{0{MD8{euzMHU)E^Y8H5H%$M%_XP0@X)BZL-2WAfAuqHUHr z*AU&eC!$G9s6(DIi@2vL+(4cxi|EWqT#1afW`O(1e}M!l*?FQ0`0ns~1usZ$qSDzh zZFAyxH^bDh+lhz&{^@pqSy)?CN@xi^h1f=(f`fvd*yZigm&~ zR?H}#d$0TSU$q$@p%jgMuyN<28A&4}Bpp_dbQy}Ij+f56t9%w)gsGCJ4v^mdRX37q zC#(-6KvYWkyyq0-47v|FcFvp&xvu2=PizJ2=q<2`9Sp3dpE7cB9phd`NGdEr)5Z&o zYIM)~vgC&VyUdR8whWtpDM>B9t^0~}=c93gy3J`6d*0pq%ePaAedMX@B=Gl$;9%=A zF19A6!z7N3qpf<66H3Gp1WV$=3&T{!O5v-&->mq~P$j8>?@nu;un1d0o~r8w zin$@Ju+Mqs7rw>P%)|DPuXU;q%8x&NVQL2|KTX7%)^F_)>y3WysBjiOXqBHEiZ_aX ze5az4q%!Z`-8|sO*n;*!l6JIKwnLgUiFGV86=JPKKZ9}vi(7_YlMrYhIO##gP#Wyq z9mz-q361W{hzQj5s|&!Dz+19)B3P7)^D)=jo>uYn|EJ5w#nRP3vzJ_ z>BZk!a88#S+iJqX58ko5^>w_BgA_cy`V!>MmjAjrFVl=4}>RIWWJ0lQK{YE z{FBbE8$$n90C{W$3F6q@Te%Ne4@U7L8)DC)t|X@FBq$>~*`|Ja z$i*|8>6(5j$d5&tAsHblu!I7THYgz%W59d}9`-w^ZBOgQ&yf2MQJyFZQE6-k={3n8 zq+KAjSxM1Iazxj{&AjmOcKVuQ8ko&n{0~_bvd5=MA zH-;ZE2J;p7U8JPcw@6O8y)4ucW(7!JRU)cAzVGzVA{e6)( zy02$fl`jL7V>Tc~lm{86wskam30I^0(k=&;*_Rz#{aY>R;3W2K6DXs=)7E_vn&fMK zPXP<=PITYlD~hsq@KNxG5{?%ltNHHi%Y~;HL!#2*D?XtnK>DP3m}LHX!B?de1KG%GiJYJJ!91#kapRZgJUFoAt!|mSCABsAQBx= zVyzv6r!1$<5=or-;L?91vMjg;1Kzv|f+GvNBn(zA{CS1;J#hEsH zo2ODp5?uVpJbdRrB9vsEj!R?rE>e{v5YS z*uc_Xud*{b^Bd2j=2eqY@B77j$Go1+nT+Beut_3Iu7@nRkN>BNzmXl_zbcC*5X^3$H394Yow-iq=jZcnp{D8bY`-BZpZgp5^@@ zaaU`aQ33>XW)*5!$vkYulKQt%(S2V=wdhixL!{m*#&(%_s{8NFVf3c(%?w1{rW>2E z#?LJ12U_Po11po(a6?=5+JMzXN}xiDdBl8`<&VW`g;lbMpDAm<-5q*IN)=i6i6f9! z+`Y1fKKkggIoDq7{Eu)S<3Q_DGc?)ewj+@=CerA&8|^U_?f21C{$sz8)irjlDR|5$SMKbh6%&JFr7 zU&Qikqn$sh48#+6kNFkC1O^~5 znY6G0fq@posC57YP8)^AtY>3*;+=p>(h&IE9Vr48IPVTm>Gnau(S0=$OslXR*@dND&;QT z7xAmzZNu00Zms+b8D1TG z1VsQ5PKwkM_d&-jExEhNQ!bP=UR~l{BqOUbvdG!>45rU{|b4_a`>cc z|A*y8j5mNKpY#74>#m^9O?Y>LwCpv(xZ@$oGaB7sLSlSc>*&4@?n5FM36i=z7}(O& zj7Ujdfy;TN($E`I1%T8F@m&@V0K4Zgf)zB;7u}AOp*-?BNnXNxDhdYB$K*!xFd@9A z{pIuB-wR%gaQhGyVq=A0`Oy=BwM-b#dr2N}f(+FWr%W4NTy5r#xwhVMjj0Cq5GGR) z_%iF0JdgZFl6P%X6Gk$n1Pnat6;@m!aPOE;sbf#31AvwDO4Ubvm+QU*sHv-HEKdi!26bSq*+opg zTFPIs8epm*ebOz_&@Cd@Nb({_Svq~|Q3qC<`C^{WI+fn$7LiF{_t<(J%imDt2EgqH zU2;X^4&#tblz@2hOG2Cms{D5_nK(4*YTVR&r*fKJf{q8E+2GocI+hzd)gsZw6FF`K z(8U@{CyYqo)HvF$g9XEDB>ESj765=%$YfURSgNlUP&*jnvp-+^#Z{wBYM|A1EWsUa z1pO5F1;LtC=P=N*)XIOnRUS*8>6n)Z=;i@1au98tom!a;y6@@}TaznqdKUp(aSFXP z^n$!ok{3K?VNB9j0TOSB7@Ti~Ok*vA*?vux3&wEPDfA|Q-x0Vj@394wkl!f*wq!ft z^Xk@X@LsSiSg9kL*yD7|S*M}4C3j59tdrqYML{Xl@yMEb$B6_&5y3pRpj|oVY6hn0 zq;{oF-)dC(E7kV!;9=Vqa7j7<{LbJ^7f_^&Y76kjzfvO0_p@%jH~1f?hnhD~frI_H zt~dY=$j>EtX8>qm&?R|dRRMr-;%9*i3LQ3Ho?NCnB2qyT04toA{+d4wE+xSgd&d8%rwg*tEyl-h3{{i5R zYP)GPH7WyaKdX=lXieO#Q?2UGeRd?2r>KesMgVSD$5In@z!y}J4R9K`t;Hpp?u@Ar zPAdUhL$IA`(4B#St^Q~6#v9k+s=78%Ca-lEwgs>bC^_W_0o*eaveY z?*M+_(&L>C@vq4@Brhk|lHDPF8{q5X*N41f#h$dC^gw&-Sgt}v?2`YT!rCWrN@_py9^6EtE+#nFv9!eyw#R=2KE2h>cVmo4nVen48*! zq9k*hkK2iDrx~Ua@rzd{7o(9EN1b213ML0E9i6X!)XUk`s<;$l2^{TbXS-u_XNt%W z3H0TaQ8N!ll|-%UgM}1uXyBz=r5adk{1%&$WbpLY>gRtqRy3y{F&aes2tXc&scavp0*v(9Ta(>yEffw>Oy#D+SaxNh*b-{}!lo_B`5r$TXCt*2!w4)Ao zQ-}_u4NW&8?To27#`z48hp8m*={-jeoxY8zdB~K7C&pgj#1T-8Tru&pPN@8PU5Mpc z)PYp|9v4hZ_@=*Xi1K(Rj59ctv5~?3_~W#OC1e^RBb>->_z6XDo0bzZrZ*kbKYf5dZP<;#M>y7XRV0)cZxNJ zw0%}^ipWH8VX_dRGIs3fA39iYp*8Xa%lD!1k9b|P^O#g{JW1UHSsk`Dne5kEQY+%Z}0PQ_L4N7^~u!{t_Rh-j?~O zrkrZDgTE^Yu3|W{c7*^~AV!btSgNBUv;ebWs$w|6%*F-N{Xa!-$ow7V^UmZVU@xc$ zsER2vgR0=ed)5>?Rq0tk&{#@ze{z=1wF)legd4ha~Q2RU8KDPCZ zffh@A*nJ4yI7@U+C>xs?rQTMAG?p|l(ZZ$q`f|*E9K#^LxtzQ} zzoP5=cbr?6O^~^cXk23YL#{(LjWq@g3m6HGwl$P^F_I+ddE;XiyLfFaNablbxrCsO zYanF5gp5WRleC87R+OA?t>FXSqeZeYUyiJc${abqe%gt|G|Rp~^KG2WZbf>1td?#+|@8&;iy7HV(v#2&~qz z)ZW{1t{Bf*?-!zeUN#}_&jhPYYpPCRgtNLYMPQ&e(@TI2{>C!|{epih`BQwM?03b1 z13F-s*Bm1r)%zTLhOxtVYqEvOI2$8qE={(0Q?FlGzjnzY;4elMA+;&pu{23`7~?qG z{L*z)b5gJxH6Q!sej~yAw)vnAh{7xYisCn{m$+vyC?pBy@%iTsfLv0FUXZhAoxDGJ zo4@v9+&2Q_;c;Er zqana5a9!XHjRcoQ-TI9@Us`>-IiNuNY4KnSLm~jI*1ZfsNA!Ojk_HHR8GO>M*AIEm z$_0=|3kVXB1csx>OhPm$llo}34tU04-i_QssKw##ywo4{+r>ME>qtqfd+@G*^H))I*-K_5siWpb~KZFV2UMsDQQ6R;-&hAd3hv%Z9nqL;TxAc`^w8 z-(3th+Wk)n8ueNs>8vOg@fbhF_65Byrg!Q6!qLT|j>tC#3Q@oT;hk57^_tz9i(ACr zfZt34fs9jlf0Y>o=nlfX&-#c3PFF@-jd@@^N*OiTrD}I0T0s~}G+$iF7$?Y?#yb0D`q@bYw!FS@-u?^XWf|<*a|@8>)uZSR3PB`Y8!q2gP-=JiK;22+z5Gx zb#~T?J+{f%Y#FLtml3JLID>kmcPxuB5ON9p4;aReT{I4{qy)gpAd(8KaxWQ8(+9O_ z0d};LmAdm2aJo*u+nVg4iA`bM7)#ashx?YS2QbFx;e2xKtdsT_Po?e2EnrpzB$~}% z04oC+PyC0QM;?&moj_{=!VcH9744%U3g=Idtw4Cxd{GDKu7W-KtNXk$YO_u$0=qnb zr{3%(Iua|Z&6eD3v)nElG)8VcQGs2K*FUf^gv{E+PSs4&DB8>^0C5MM)~hHKa$m(snF+sjUrmY zAJ0260)%WYvQqZ)AnMc=1=1CxB^Wswv0`Sq2?Oht;`-p61QWXn(yW{eC%(J1I1 zI~glgUT6Gr;81L0rFJG|7n08{{x~)7Ngg0%gV@z_aUrW09N<)c-$v7K(v8;u9Ea3> z)!z9?awZ`V%+J5^uF#y=sgwqMu_t4{Bv1W%Xqk!&RK)#^s)3~Sp#Sgz1dJP=FqHM5nu4HC`L;Bt}tjex9#X2 zM>|76TBJYYb$MFAIZr>vOoDk2{#<0i?~)#fok560c`afGaQ5QwQCG!7Nx7`K+4Pst z{tm-8`_m7>%d?$F)m{!*ApcTyOgbYG*>9J44g6&Mn!b}Dn)B+LC%S4^$R_-TnoT@6 zT73%Dz-Jj2^wTlrJ^UYlHSnK>?WHSpK%{m#%kpsFXOS1uc1iXv5_sHw%ap6;_mhnv zS&8svK3d{pmTx2KZpc5t@aO`|S9%+jJ7H#kcMTtb0`}hw1XL{KQ@Xe=R|{2GB7389 z-}fk3`^vrZE)$MI9fUsBpyoDvE*Vg$%;m$Y!5B>kK!+B^L@>641-ij=coe2+*7DWR zxSYaDW2a8MA1)yXkq;_y>qi3@0mpySScbO0y?0wM>^+9rj28bNTRRT6_#JZ zp;1kEfw-|)ERYzch=qeWTrq{=@ZGtO5CH?67 zS+%^(U~+-L<6B!0S$Ed|Mb;2{qeS@4!~(zzmo8WkIa5;91q%j!eWB~0j{-*MCQ7ZYmE?b7<`CJSn;@$SDRiWd~2@I zo;-+lxb{6B`0>HyIYJv?E|y{QRb-MzV(l@E&&Fo8yuQKB)Qa-56I1?;51o8^B7OM~F5Qhe4qQy$Usgk@g zG}M?^*uK^=6fhq$dnJ{#f(#r1PezHP>Q&We5FQ3gRHD#&5ZxrER((l%B(&lLhP~mU zV)uZ9dONr>4T1hU^n7@4y-4A0MQBO z7ud#%(}3Qs{}u`g2{R`*2GL-d3H*7IkuFwq4D7DS}n6<7~&`UKd^8lmNs)s zPhI>Q3^!H{-l9dqL&r$yyN0zY_i&RMFgL1^zG7KL>j;0ww$x z!=n^0#*L+pfXxg8T6|K%Z!?5i-38v`FS0bGv-ABZlga0P7^h_ zJEe4wYyl)7Rb77ta6?blZ@4_!^PO!?%WTw*Pv*E@QSloqo*@Tgnf50zmn6YmW9_#7 zCT1(BmW#U?cC`FacW38MrhqS5a_@Thv+68{$qGH>+z_7!Tpeh-qmlMeoR` zmMp)m0zg4*pfHKphTKmJ{>;4Tph9W*CMCr6cIr8#gJOsJ?&p7sAF#~8;tk~BBED<{ zkZvfw_?v>lQkDY?8_EAC`*Vzf%(59vb-S&XM{X846<~6;5DYY~>lgY8#L{)}a8Ex^ zogiC_ib!s6R59@LPES*ed0>irde1y`7Y_>-fXsOpk}rnd`pYJD284G(gl?d`>KFzK z5W~?pJxHGhe0j$|L#nuARbKcg<%cX4`c=+uL&p#T!7`IRzua&DINxZfIBAn1i!2yxab3IhLjI&o;-;d`i$Q#{Z`2J2=A$F?k)6!-Eh##s8HY+ndKY2EUfR8e3;yqy)ZHybicrUbfj|Zi_}{by@sc+7qSPKoVE0zr?lfs z!m@Z>(tXy*7u0QvTAv&6+bv(gMr}+&)`|D#!GagqfO-}Os{*Xhel!t~5CP&GDC)ov z&mJ(h&K8Wm&FS`&%@%;CEch86zLfV}0Hc1LD?Ns2r0pVY#rsESAahv9#?l?(HvxwX z0n0T$gYXRCVJ`yGSO&Nlea3MW?=8QF39bYEw#~FM!k)1mz!y|X$S6MW8DK1$U+9f> zgO01To)1^?f@%q?KrrPo%VLy&%(B7s9ODFzxg!UQc7Y%Ojp{NX<{OiCP$oB!532b2 z8c&|CPM?N~4tY+912lx5@C_7VxgHf^DvR_%uZqKB{9z}mg;RW zaje`XaiQpH%TIplH;>7a5wMyKB5~P)Eb;-2$M@32{B>Xj$1_PofK|<==ZPym`0gHj zNcDelX{p|PQwLM`MX)4p{ibGS)+^(H-|#v$cd7g%!f#h5kCV?u7(croawz;;eZZ=; zGWfId>U~pe6lDI7$m|Sv`78UN-c-hDO#Pk#t!zvCM`9xtQy9Hj`I9T(b50Z602Fpzw_`v z37mCW+kKDOB}&?U!@|R9@a1ILQ<$00eeQ07XH!cP#;{~v=t_ac4+f_KMtSv2R#z#x z!NYS2YKU-R6)F1MK{0uZV1x)y*CSb}4oA_{i>m2?h`Nu@;&RZmp*txp3eRw2Gf8sw zpg1NdvSf;fX@DTM;BzETKlCazw@_+oWOh-sj>6jJbui_J1_N1hj4*v>d3uj?shMP{ zbHtAXJrNf*#^cE> zwM2%T2@&rwIFutT{z28gOI#I}?o5&-b4uh1iB_g>NAZvsEDz=r`R*-!#pz2vi!QyE ze$-CyK1ROjos6R7SY)U)B;5AnS3C5#id>oh7qh_nkKLL>satq{WxhX2iFB%FUu@@o zfBy!Kqh9t*MgR3qsK-~21@k7qxB*n$NbbEGKZ1JO1}_=tUU;pU)nBYz|7w&Sw(sj3 zy!CP>;1lL>l!6Hz97WaNa9g=0rmu;_LbT^iifTX`5JgsQ_b5c>#NYsHaYApZN(;BIwhP4W6@TI~@#u^4E76Q?}ll;bZbNiujk zm4BGA^LxBc1WkOqrZkB}_J13fJ4qm}iA0H!f~M1AMJ=nShua1=eU8I2J^{5doKJ=M z8cbO$lQl}H#MmDEeFT_=fT8qoxuE=66U#bWq*?OJdugPsH}XsA_aA2WcPu!`yOJah zP3rin1It`xa=s7qYKyevqWReC{DDl;!q<|LzvcDp{GS)Px?gALRt_&|_r@CUD2ejQ zs`!qmKqM!GE#-w&rVR}%=h&9H(c7m=*jeoY@9W`9W*kW-`9%p5*;%XA?=g#0bZ^Mz zLqAf=dST9WlQ6DgYnDVjk=vK5=**!T6^Za4E`-LAtcmGY?OTN2*`m+k9dh-n_SITo zHDiNtZn+}2S*!M1AM>Z&L{|&iy!H7ga@PJ>GPBN?1yN0ulB#Cx;TIG%T<>h6U zZS_90{Z)xo-TgR&F+z4l7(EUt7%pM-T|+R6GUE(bgp{f<6bJ@fgoz`+L(I42I^k}V zMB3#VjogAKOPpDK*Anh9w>Y%KpI(8f7I@X&leEB|z}KU?2QR{XrViIVu=*D~BDij-H{Ja%~3spB`Q$`)N#2u61o!8^BVHY7YH z8w+MmoeJ3=;*RsTr3)W9#jVCWRL?|JGf$E5Zn|M`#`E)}p7=Y>3qQk)n?!?ck=+FE z$}BDk!tC-TvAybuT%^|JYMy92KJLCunguhf?VO8Sr?wW1X9O}-Pywwax>vKJX6%Vs z?*CRQLOowB)^4Wuk38qVltO7Ue9AUfn3pj8xc!5 zf3XmXSc>u&*L{VQ{+c$Z@)2;J57P~im=JJi4FdPJEN*0y;1UI%Aolry(iPivLl85p z+^TBUq7OrO9Kk3|jT;#!@F!V#Jey#P#n25)yYgDsvxD9&ohcIS_h?tcTHu?nf3h=un z_MHLQqJ0Y+>U^QuqCdotC4At=j@aMfPsH&bzjD%Y0a6SDsU<&BLPLHIlms@2FLia0 z1QPK>hZaxzuhikIzM(W>ZHwJ7AuA$-bIEJzf~8n8MHrVi?{8vaGlX3P_o$4RcaW^q z3}G7~u&KqapO8)aZ`4eyZAKt=^UYVRa|S#7Xzop_-S05n$`VPwm9?_u{0Mgbq5OVE zOcta~cGu_*ya8$^)8kMK$gKUCFva-~b)|nDL4K&sA$oyg3=By{DHD!A;&i-wOhpZ1KjAb;CV#`3Zc($8i5TUd3HW1iyUicZ(=1}!yZr*bvl;F$tAygo=61Qe!D(hc({LGAPbS;( zVVXbO^pQFSJ}<%NcksEs?5bkSV>~DA7oTEK&63K8`(TKrkOZ;lGo;jz=eQIJe$pY( zNj^nU&013Mxaly`gHg%|nN_r&(Wi}IST)4kN6~_{8GV)rTtcF3ahd>ipJfmY{yL3@ z*M1wXqwC7g%|_n%)OtD{kKW3Sthiua@PNx2hS{Sm&#u0}pU9jLge8O+m5z!9t`|xz z^w!kBj=G7v)JC%DU2H%^hdA>Q3pW!>hxWr~advJq=92IZc2KX&2x@lWQE;#N5NcMy z4=wXeO5t&t72xVNP%S}hGHpnd7cha4t z%Q@9C&p9*sKXvQsA>5!Zva;oHwQSK-j_7jy#p>_8#Yg2M6N((s^g?MtM{L1Kow|_> zy`U-IudyF2xK97>j;>#!XJ5+kD10z8P@LucHFm#6EJ+sDTju?xKgc})6cDV)B|FAx zE4M@19iBUOO}$gtYdR6_6_*;LjMT?C=$p-T+bpm2uX_EssyEg6s=OhnM(kA`TE*Jx zJuEgQMgIheg;HU;M?f}F4b~cvoBY)skOxVh=WPdqX?eN0pg-*`-L{1@mNw5O&wIWt1Mt5+2SPkg)GU{|fH-X|&dS zWP-vkSHOP*sSmU`%KEzB^$xCK9}?qVbOZ z`V{Q~?dJ9LM~V|m>jekEleTQXi$e*Iq7N!O9)+gKtZ%|PK@x_|?;8ok9U+Huj^Zi{ zf1p;ZW8PDm2#zS=UB_8(^>aDGbm{imON^ z&!#lFZA>VZJbQlD9TrmN@kJY^pu7FzdoePj{}60p-EGp2YK^`^dup4n^ad%Yo9`m{ z|0)7$Ls6}g>$Di#d_z2xGbha{I#_V6}YS%s@D?RY$LH) z(ysa@FNMH(E{r?T59U(}_u(&mSfci9ZF(NnCi+acf^|u#WZkSC$Bjy8-g4N@=gTfOc-f?7_(u7mg!Q!lmz!D=dRpDRE(U_}W z%N!`yoeT^y7i$I9do)?6IMRpcKdHFf?y8^%DX#>auo2<=vfjFLR5+X;?`utOKAh`# z3@WhG(lSHL+S#%0aMgZPr5|Z^zD$zSlDge9wB?8dCRG zA$pjF?tVMU++P0fwK-xr-iaPrE|ad0NgvJgIx|Yk0It_+wDJxlqX;fLYg`RN= zw2k8H{gLJ^_4&eq&4-`7z@Q(F;a~g<%f8ZXQl&;KV&rv@@&(bR%`q_sYcEpC@DHzt_)w2Im9aQpPbV358` z|5i}*b;KKU?(IJV-Td!>!Rh;pj#rFD z*uUvV*BD&4$RRn`XcTZCUTPfJtPpPSNk^xM-m}fh4W5E3#@`#LgLXV@jNKi1K7E{q zOt;nVZA`2E7F!%~K0PQ!bbjW&L7;x`m88blAd`vMqt^dx#MFBOYtXi~OZH*lXlY~Y zPte30-S|tQq!^ z_l<&9Rc-%P4ruvkq4eDP8tKVBqS-3Y{z6sze+Ny9{$GO+>h~IgyH4EPYuJCu{s{P2 z{Dk|EkFKjZpRRPXUtwhjpC+r9ID4ds0><7O1cUP!m+S|vi=B_|?R!OPl>W$~;q3XK zT@N+6>%gsdferh;!3R*s6FXsj11%PfRJ@E`6KUl;fYH5}Zj~asgFT;40fHKRZ*UiE z&b5nn{o+o?;y)OGgs}IbqVfHz6JLTu)9(!oL6c~g?7!F+JKxyb*Vs2E#r$_(9csj; zQ&DK|^MA?*r*wn14PUa~2R1#I>^~B!4HEvR-t(ZQRG^Y~Kqa8=Oi;2wn~un)^2Ucl?U&$J7`!0~P%X)Ms0qLa*qYIy0yef5n&`R4&x@NiRrx-hrL5 z@=0$n-hk+j9``SU))**MHU$B?G6bf11GM08&;oE%{|Wy=W9*;c{@*sn-U2O9sp3q# z=m`*x$~a%$2fM*hTOe5U`Sdg({|oJ+~^qu)ChERKKE2BKS{K=grf$3$w@ug(6<>UQ@ft1^_LvVld8g{K6rW4xdF^JO-S?p`<>Vw! z3f?6(gR)pyUWK4tQkqmSFC;`hBg*8xTgrSlCbh@r8$A=PXUc7x?)ue-t#~3T-1n^* zG5uSaFMe5j>~gI=T*#hJ;q__f*6f{o>{Myk%r18{OOAy^QA8i52DTkPvIFtZ0^eIO z55uN)RfVJ&pAYPyY2jnm2$R)WO6JzSso75=b9+BJJ38mwj~_Y9XwD}Khh&$#IuQkt ziv?+c9Vc_G;~jLc_!HqJ?5UK;$AqZLh-Eeo`zJ$Z(tBo7O!so1Q6>Cf4$EpfMoP8N zR1Q^Te|*kA{B^HP);lxui%+v3`BAlzXf_{RKE#i)qxWBt+q2_bwBnoX+y&P*Jry^P zgRg^-yQwnrNcUHq`|B)f+-6?TPbq$y*-cf>uqX1SI<53%b@?tWi9@nl7fe;(yVsl= zpUL%uqKjE8Uh(Mr?V?IPJinLgHLZwWd%2o;@hI{(dG!Zh2GP>^wLHn5(2Eb-I>XWV zAis5F5arXfa7F!k!kKkL>APRc=eJcteUHnGor2)S4;Hjj`|*EoooU|iAzpc8kbk~u zA%69Bs?)k5_;-*9I*HJa57{~+)BPZKyvrRP*A1c09hZ57YmaROdp^j& zgKADUEo7))hnL)$G1BQ)d-SJwCMej!O)9M3(LT%@9%)3 zyD6x3Lt@Zu4~)}hrECL3F|w_a2rkVg^ef(gaxXM3l!23r?#!5*zLuARgI3>ynC1;Z zrG7^mxH8SXed(vpv1NzK>iduGr~X)`9s;*-v7JdTD1D~0SYedrSdwL&orhsq=+<>knzx#J$=M)uP@zHd_2;tJS&~6zAQk1cX4^)zjwS$ zhL^0RhDHkQKklBB<(#-Ju~!!m-%d&E17fv>G2J_VB$TB*k++Cj5@r6su7=D1^>0^L z+77JL)Ej=FFQ;EXzt z(C{t7C-+1X7_OuwCMOy1M?vGI($FSXL$p30f*!f^c+U|ObwnKE;83G{i+eW3?K{bz z2%nDIPuyTa>^333hJb6_$9v9=vtKn6#dXmGhw0zoONM z(IzeSlI}h$y@!xqH3cQMc{-?{b1*i6CYW=|4vqI9#l;^|EHTUo*rh-QC6tI_%Kvaokp;fXWNMxNu^ zujf_?!yFtv9oU`@H%*A`Rdw0!iLFLw#@VHFt7gN%+gHFHrW0HJm)7$qv`d;DGt*03 zo15FD5#QM_TMNotjW8du!c_=q(>omQoI^}1xZWevy|~o~)zN&pF30_StI?71@YCaE zzg+nf9v%ENbatHfa{A*7yj zi1&23Z~^G*!Z?t%cIlh|9Jy;k+@0y3gLhac#0u{MwE&5GI#dh6?cQrOavaxw#Y9D0 z6OU)Q*R&d4950)M0BdynPg8IH6Qt=m2LaH8e95|}R(h)t$2#ZGU_z{`2KAgC*Djh{ z)y-E2;(}zV$~#Txpny6-GXpZ+UFCQn@1LA!(p&Fvb3cUb|5}f90824CHy(a+JbYJU zt#sN``ezX??Hw+!KF2++)#&(m_;D&czNJ-IhuJ z`V=($gi0wFUVyByd064EqPZ4evFD@_^I;AjOo*p4-9NVacdY?t1A5PC=^9VzIYF4i zIul|vy2HIn=(1vn1}xr0Zn5Cn|7>S;AG_?6R8NH}9l3CJulS zUNrlw4yKo?x*EHz6_{=h7HC4y1^)Qg;i>y+wbIQV#DtN;xf5rk2Si~GF($-J6XNzv z_d#`F0Kk;op7YmD;poKaVcg|oPozzSxWQlaDxfsiDM`~?+-FaRA|oJ(AO8tmFP_RC z$2~4m4I4mpY!6^6uczP-O^9z674jHhY=`uT2O=rXzc{8qVvc<-8|r34j$(m zeg}44=(|oESOj>b9Tfm(V%DqCBMAixfR> zRJuMFj6m-M1@~K<5eW{L?qP-3U(N~6NP|EwrfuLRk8-8yQ}F91P^dXayD&{9$z$W% zN>IkCbJ7FA4yHIMuhct@lxq8-L}v$;g+t++Zt%r00=ZB00tJ7pf@r|42!{ma~9C_}OSiT^@Y`H{Jeg>%2& z&aHBYz9j7rHa`(;ek9mjMy*o*#(MIAk(=5T0F=+*Tg1bKL^1N zRWS2Tbqz9K4~ji!Qgj89-G~{Y4QXP(Q#;(Tf>W;p%j@Ed3Ee9*rz zFWN~PA z9EE&&^DpH|W#tFDx8fc9EJI%V>G@I{D>uvM%EAz1lOI*1c5u3C)xi#Y_L<@7s)E97 zxrNE6>8cpSGkIl%XBpF=_TwmqdeUbb@h%7 z6AMSU&xTwI{VSPoatH7ieS{LV9|zMDnirRc!u#5W(v7dmvg_*P6pNt*`>zAy#g&MD ztFigG#2kfLr&^Y+j50~Ee;#kXcCu%A=5S?l^fSLQqwpf{EXEPORvIM zQ2Jj-0{F>({WG(7a9W%nY9W&+qsy3T6?EfLl2kRTgpy`y|pkruIUWMwMY&U8->2*(kImOW$KET)vFIZS^d(|!6r!o~b@ET%@*9zlHlcF&$~>F)`%yP7{yR|m%prIIM%*4rg@2z$ z;7?51A3NJ1mN|8lI(@{>!FUSJyj@rz`#I>R+-WZ4Z6{ ze|D9HSifqoaou>W*EIY)wFszy+NVzu-xz5bu!<;iBxN{~Y8^xVapX0)b>{Zyh~s=h zMY0X_Y`H^x;Q*ig=9wJ-b9))Hz;(Y&{`IaO6=gp#Eq?lf-eIBO!L=S|)8d&I z#znj3W1IZtbH9pm>=XXtKj3-|4Om^m!e3XzgYZV4;qgi83c1^u?|l(&B!J|(%3n6* z(7#dl*Mp)Kez(pS>-w}WBPHYkjZ5)-Siu}>$+?5YMBF{$O+_225;c2KVS7CiPZl-;rH z;GSFBEVO|>Cb46>7I1#yt0e! z(=U)0koN0x^m3~cZcr`(l_HC?{dvkkyEBg+xy7>V?FVAz@Hpyz2H{=xB4>e~ zP{=HK7E+0=IeKR-%j7z*K&FJ^|L%ld#07Lhmqzw+wD7PFspH)GaK)ZEpKt|w(h>Z^ z-?dISjz`oZd_p>*>mNT6Cb{y#*LY~QFiFtXF1^Xz7mi>1p(zLYr};sSTGznD(%+4b zQiVy%d|?j|Zgq5yeYkP~bNcbWs1k0l`T?1)OBVE}l#M5~#XMeI`pQgre;~9pe_g;PAfQn~jyHw~ zb(7ufVSnr&iwXulb}IWdXTdBjBez;vf%&+HcgvB-ROGs(d3XB>9rjx`*U{&tpX=!D z(o^vyo*~#J4g_CY!2b6B>m&XXB?tNY<>BqJQ`Gc!&i9*v9h~n6;rsZG84lpf5_fqd zWoHQZW!U>f{4!=>B7QQ_yhHYF{`o}Q&E1ixLDs88rur%AXS)$^>aIb-$a}D)M!)*a zD0`+TP24b@n2yCSFl|Sk2DY>HeVf?Nr)Q&W?UgxcTDqm$pvjrsCip>AeZSH!TvtZ) zCy`~u9?aZjrLf&+Iw99OyS&reYyn1R(D36=%T93X^2wY8<$|<|C z4TLM+i9bH2E%`1e2L-Z%g}&?d1Xi@AH4*%Qjk6wCYee^V?q9Bxo7U9J9JP(E~S7rzPA z%I2T2)Zfd@sI>ZDjm-Dm4bT ztsaL;6 z+7t4lz1M~K%Y7S#;f03_I%KK;cudHhB&&pq%Utla?O%C#f}7};)cS|OXf=hn+OwHX zeZbZgTc$IoGA87MRFMP{RhNSg9rnDLTiQ0FP@E}XhD(0w1ANirCU#u(j(r;YMNtld zzb{j=4$4riJN%R`+a4>h4@CL!9X$!-63J&5<)(CV<`rG=2_qNE;h?kv>?a+7y_<%0X^{ff_j0pnjdKLEb>&*)!w~@ zk1jMf5&ZPsJ@;_W*E}kGMZDk)P4IMvm!&Bn1TSYWnO{`ATl}8Qea>mC&Uz;lgq5ZJ z%6b}!jJtiInbA6ho44dRZ*1Z*oz6reM?-r*IAtdENzXHw98UR2Fb}hUWVxjYt8baYYW7FScf9~{S>uGIS>0a z9rFzy`5apVU9^jSs`!aIHREb_IW7!mcq3bmaeOfVmH+W0+KWD&p1-U^@t4ogbh=vL zQ~6%$jWT#{;kAY4s7QOUvsipineZqSgL1AvXnuF)-gM5(6%&H?;J*#%?@tS(&2E4n zPgYEb+Nn2V?A2AfpJ}wStBqd=G?xw6=UUt2Bf`GMoO-iTYF)yHS3r5p;OkcxQYVl3 zQSSu2=GlI3$FJ-EI<5OuqeHmc_PZTD>h?4FWyiMz=6QN?JY6?VmJdHXYFO*n*gfy- zLVM3=fgU{rB7tSL%?)1nE`KDL*Dt0ZwNsGZDU9D!oP2>4sof5q=e(Wl%$f?lUPpOmpP^P;~<}& z-iiyDYpioiZFj(1Dcy2%Cu1BG?myTCvQ)9d&$ml{ z@L=J;1MXQnpUNYa_LLDxZu|I37p;S`nYovK)Q;HJ=_-#q$DCo&KMmqF0>G?N=sig4)=)aPsLpKjlhjU@!bi@df4d-U;&K zy{&|C;g+YyUb~3}=l?M$5?5{xrp-xL!$Im?kN?Npm&Zf>eGj)uDk+q*CP@gNR{KmT zp9wJ`sVq~eEX7!|&yr{(Muf^TMVb)PVhuCME<0f?GuFWv!wj=8&%5vU_dKuH^Uw3= z^T*t|=iYP9``mNR`^?<)zVCZi2A^}1m}BHDHttn#*WAgbafXwBdGv?r#C~DcGQMBz zIVPACXA9rXMZWsymxYm&_ZzCUa3`x~o2_wo!tep0`4rInl;D%2)O+$b%PPXu=zCu$ zE0=MKRnwY%FGp#|r*~BA--lT>&$DjlD6OXcX5FR%P;1T|pzp|Asx|3jZnn}Hc4Wdp z(Rjz)YSQn2u+ZkN(-=HA*rP3S#3EIddc80 z_PHb&)bfBC6a~_-oL-77=%+mgQvLLNC01zv0^l|HlwUOWAO<9;+g#$Bl#m4*?7l&7 zUnel`{J_GeB_XZIUSRVisq&%lDjBX zyWBaX&CXx#Uvn>AeR_-8$NU+8$y49&?g=JSGR*Vr4s+l{E_=WACL+XC)+8ykgi+NM z>Oq|aaZEW#Ft8|gMk}ax&q^;kM9q`5?hw2ZKB`uR;luxEev`~;>=xiT8^1|X#@N;Q zrne>T5to;+F_4e6!9Cy5@`U&}ocQe|7QT*(3N z#!ytN5ql^!YSycJ+>`g^2WhszvYkT_qM#`>i)cNlPRyu- zpXY5@Iay~E8*V+Rl>E9P~u z&7kcqWUQM_D!7PLSamP-t!@ z5(VxvP0VI+r5Q$&a4P3L`WRPqx=N_9l2{Rp2IY${Cv;$?!BVr(7|90VkrlT(^e(aP zaK&CBi-La7ep)+v5j>+y5roemjzpZ-?_%Vw#_`Kz@zOjDh5S_9PmydDZ{u#=lhyr! zr;OOiU8cY`f;R|hl=FTpF5*1Pc*eXQ9&4FUPuvxGrjtzZj)lpgl(-5Z$ zhc=Se^Gn-Dzp+SQM$l3XJ3hAZ!`7C-A2c&|&V|RZmE2>}#0vU*f}(WL@A@mGAoY1l zq_A~oOJEWKepT$*k|RNVkz!QreHgfX73}0I5QKTqO*$$kwbT$Lg-^T$%6Dh+d7^Gd zfo(My?ppfnr9K@+3aIqzCY~x-e1l9YOka*ROlt0S1S^~RkUOJQe+?eJi&m>eneYkm zd5r1W`GZ}K;6wXP>3tl*1i#zyPFk6*OXYov*x6HuGpDWC!HaUr z&xJlK-`>9}TV#c8ku3p6`1!!=n7OJDzfD+KkkY_o;m(!%S7RkFJ?4#{lT~{Lva@c4 zX)V9!nVZlzD8q`+Y1(f|#CQ4Xad%DD8sac?9y)L13G4H9U^zm!@v~`|{rLAA z-`BstcX@};eji02gG)`DwrEj=41H<7kUUUn{${qV$JO zAF}E+%>7}RI{|D!4l)q`oZGNG{|2HikrK#gY4lTKYKSck1 z-%km$4w6L;|r|ug#!_*t701`|QAa zAKxYI#%2f&nnp;HFF9oP8}1(&-M4NiQg>L0%D5iWe@y}BJ8Qa*Z}mNA>ah9pvSNhX zyu{3BwWd0QFKf)` z#A$SyB^8Z5l8d{HCG%$ z+g%}>g1m3SC|7=%eKh9Z0~ijvp=UTMJGegJ+}2)W2lJ$YDQeBOwu z^cb7EtM`MZ5J4011?_kzMI&&37|{?Xv2DPoWLqJ}qChX*MWQu`mQ zyh;uymlUIi{TDG;=Z)k=!4vAJ$HIqElEKiuj~@(1lIbXS1M9On8{=B6O^Mzy*&KCVL@IiL?%;}^&q@w97Vn!x+yNRjc415q*2_g+0Qf+$jr--u& zLQ`z${h3S?6Va;A!#a}+G27)e1fog=~6i-@Da<{RUyz&KH%^IO>^<&#maBnk^jnY-dSOb z;u55i*w))z9U7W8d%qGI7)|cmsB~~r?_#Cm6O90Qk^3aX8rXNT$JM3*DeGQx2XM&wA}5TO`{0vlRTs|Y)p7#34F=Bn?dTXBSTVbsj*K;?e)AH+ek|5h3rvKo_Ned z1tJQCe2qXl^Hg@A?ajo?scQwoWRVN+_@*J>PtHb7+H&G{`h7P!8+uV8=gQYgaet93 z9yuG9I^=qXEaj`(Hl4UMnnD6BF@zkArZ|Bwm*F2^{lKI$r8SqLdqV`hTGh;FdTWiL zAF4&{;$6sFgGE3@Vh>6ub%kFkkP2KKr&mCvDY^HrDg=HfLN{bM+SfRA@cHX~gc7lr zht6P;twPL?Y>o4;5X+W|K}nB^_8yH_?Od4*2~e^hmmP~lXAnAc`d+|Wd*}z zx%W}X(7-G3Q4o8`<@MDyMbYKS^3C2?zw9__`3JIu)&r|Eyd+UjR1Ys^!u0vX`s+pd z2&86L!6JPWvQ!bAOPl#e250t6WwhlRux9BhT_iVx`38J#kDY0u$uEa>w~)(ihh%kM z@gsw4opQOwz4gbX*IyycV>$}rsR@c~wJk|GO7YHFnQ9gBL2r`~yq}pm3tIZKo?)9! z%oxY;E3VB2ePGi0AT_eZtLg8%m41>F!~5CQ?T3HIMmT&)-!-wB`#ic*Ofus>jeBMp z`f#QA5oRNyWEW@y*M!0dDZ|KZ1#RTkn(=?dK(`Wp_JTlLxu+;Dv>M;kkF){*q@lN| zOWiG}cDZh##}W3)QJi)~<5K%NVgPO`ws$l2ta2ue_YKK4lg3Ct*hukKAnSP)=<)a$lfH zM)Mrf=SD`qxZ)+R_~@6$x{lGpY13rMH*v0#_o9*H`Hu!dQl0i$tVNfM(zYx&mpwXI z*u%|TkcKv@67mr%Baq2!I$0;BJ7uN&;CqC})p5v$OX6@=Z6OktwRBCA&|mK;$nkLc zNo#5PJmkEGI9d*Ul@8q(RLFiKQo>eUp+$aYsQnaYtV9+3T*k*DrFw8AqZ^^W#H^2s zN~S2L*_-BBS6~aeInD2k-GS7i=hNq#J(8!sC=*MZO_sBAJ#E*7*%P9VEs8B{k7u1N zX4hI^wJ4Xq%7JG{Uo){7g%cDUvizs%8?SKib)N^;DLO)LsoI$pGl4udG87Ph4R66n zL25cT3bc8VuC~7(g*dw#`Ey{y&vqJ23Ui~teoL>>6^4$M6-Cr%*C(Gn&?r{Goy8Kn zDiQGbN^;>l*gQz@B97c0`jxDc5loaki1!kCdO{0HUSvf9P2UfbXeN3@ip|-aK15g4 zxKY9AEy(EOIAwY3EvI(dPG5AWh_-ZE=*T>@oKd(oz9DHM&v_k;x#pi$1M>e|*G6+* z?3Qv_;!yW}OIoKwZs&`?T!b!BI2voH)U1oJ%U>!bg(S%G&*#%$2I*L+OAF8cbyrn( zwEU3wR);b<4TTuSsf7XBd}LI|g+?fDVppAGEpt6KMJSe`#beiXPiwvS%422~si?f)3j zLukJ&W4xIMG+JgTRqSD;-O})!fZ+}kF$eK2{+uE+hQZ|&@~9KNzod!#^v27@rdv%ub=622xdbm;01Izh&!P&{4 z44jE;Dx?2%tqbQ@-h1e}@c5*sl%boWkv4?f-)~O*So!FOTARp^s0bb;48734O?1siWTUM44sxu$OV0U4Da1nR2KV$}_d*Bo z=hA_1wCWb8Z<2!M%*X<^=)+h5VS5&0ob6VKtWCv_V)WM9hUhIBB$%Wx)I6fVOQ2Kg z*`t!dG_y{dH!T?UV^gVlS`oFYW-L2N{?z)pCn|&ivCyimmvh@I-RulJnW&943X63d zB|NXUQ15REiuy_viJ`jitTTqP>+^{rwx(C`R#-jchiT|dU0$9oYenrM-{D2p1ETp< z|8K)2lEkdbcN;D$AWWM;ENbYjw5&QH$ipoOLJ=7v+R2fMf;9Yj)czCihMQh#q-kd* zJakjuxHuut@rW1gZm_HvN7W{gyradg5NtcTKZKGy`y_Km7KU!W*MDp~*!j-X*X6Ci zMyXJ^lzY9sxVg_FThKFZcY#QyQRFtDm+ysES8Bxck7lTg)!`d!#nba3>!XXEF-Q$v z(Ac@TtXF(qiy7BK*R$y1ifarx@43>XYN9K|7&Y#M#66#*cH&7bBVFbhXZ8jjSZQJA zbF1|_QcZ|b%+iOBIkLQ~e9xN0k{wL{WL!XBy0=w8`iy4>Z~!Dz2IkWdem3Wa<7@C% zo zOWQKBy5eM=;{J5>HXaXZ9hsQ+96W>C&b!_E3%qAmO%oc2a40NC$g~Z`GxsDLY4eo* zc_#|dWk<0xk@6$hTmzWHD(~8B_+y0BxDM*00XA0V#6Qqcs$+9DB`SBc*as`(t}8eOs8WAGLX`h` z+JB*ESKW^cQ`xs&1-#iCVIt=K?%5oCh}kX8MF7a~C zI1M2bMtGKI?AUhDHzV8#G+~w*6$Gl1#vOEXILcoh zSHLpO5BqU&;>CN%=iyvAAH2qLN!Vz}>(T7cOD|pLPYGtlL!{y_&2C{8=A!|cwWbCU zyVf5`U}|uibL{DJHt?F+N1qNYhj&DDT;L4^9a<)yn7GpI(MV;{{F}Fk?S8NWE)AL9~7+J@({iXJK+Mh@Rh(SyvyUx?vYY^=-MRekSQ%7!}#bicK-; z{8tomc6=UH_!j@3%mGeDj=SP0DJaY0zvNUk3z-j#&pRGW+7G7`(sX7tV9;|oM75!u;WC@otB zG;8zl$`a4;1tB^2n#4P-867bUU}y-9X)h)3s~-w0&Po1Om%|sh=!;C)X>lh|gL{0D zoHU;XPZ_F7HV4A*ZOUgvq(~sJSriom>|5FJc!9VqIe4{H9IDSo0&fU++z-b|x&c8; zo-Pp?an=2jm?l10pFI(`gyuE^;Kl4!24`Oh8Xhlhc`P0hX%wFnw@DV@z%Veq2P89S z_p$K>$69XD6nAYH`>Q^0QT_y0gqW$y?JkFT_n&~)|Gf2>e zZ-~sb3V4cmVKuRvnZG^Kxi!vn@z;3EVt{lD)eNo zx@KCv+xaf)ZNCWxQpwCLP=0f9Iws-O%8y5wz*%EWk4JKw4KFqrZ9#q1$Cko2PHf7; z#lbcTStW?nlQ~DiC|w@%s|9tqY9_|@&c+;B_jhrUOJI+G`3B)0KT#lR2p zD2sg(PF!2;){(Pk`zBfvi>5vOys=ou-?mqo8EvaNgqnM(Tp;p>AFl zj*%7-gJYy@F`!z!ef@&@keIbGhmGm0?-xKn#R^T+j?91~qLj_l5hvqyxL1LEdw=+q zlzQ+s(B2xO2=eAE_%4DucORwy5nKktc{&?(_4h|EpEiX;H%gs#C_1xa=AlbsY!*Q$`_FS0 zCk36zgLzVR)b+c77f@Z(L#x-#W@PKUm*(C<9(TJn%y!3Oa~gR{b&y}=iz|*4NDO8R zSXo$ir3<5p{u7eJW_+KZTF||%YoR$Wd`E>xHep4txwSgL;YFZ>`S-`mh&u)&V?G;| zWr!FPlF`Fx;zb_vd7-M(x3hxq?Yb^ol2G_->*E^EE~`AtK@R8sW^aMo#wNi%*+(J8 zo=^qIv%A(#y`KXp>Oy%-H3)6M8 z=dr@-bL9-zD|?BwkG5+9xo_JAt(XsYu$v&um~`P~k$5&jMn`Z?+-!^bOi((hWKzr6 zt-UFH_h0D8zkN8{1v4>eB3ues3zFn4^6c#`oZ`A5brz_FNg{Q=c7bOavgAmT8{P+I zJ80i0__`grCU_V{wh7pPwE65>j^UqkrrcIEv1L|X>2y`QG!@cTNN$?nKBnqh(?*nI zm$rRd-M7*G%SVh2+q#XfxSDX%hKPmtvAuHI#NqwE6W2;&^LT3-jc++_h61{Djb|Q^p#4uRh4t^JOl7^60L9Ur1)@ z`nE3>dURh?q7IyVx-~*~J=Vus@OdI+xaScjb0>!%7IeMNno$PF<&o7|V+eussTF=c zhy$HdoYXl@*m`Z1ZJjh^O0d(6OR9U8GsBfj218Mfq2nzg`C{0 z+<4A`!jGKn6Magz_O%o*B6auyAHbv+rR}i1cVpL7y$i`dQi3FZ3kX3W`j%DIk zaWZjpfIzgkaagG?eB`dc$D>+#eNK-Q+t=KjR9rnves&p&#R^@Ju35kssyFkQim1!A zre^eWtLFV&@;cZBoGeIa2SEe{dE|{5rTO?NHsMoQ>fFD|E1Y`rs&EiBs=zN|C#tYv9{2l+m6p=MX;U8*ip#dYawb9=aXE0 zfEl6Sedk^i(>4yLFlyBF8r&64N8aE?|3r%D-EOCHx;)Dz_^7I;P;du3v1I!NbI_|n(AQnyuxbr*5F)}2B=jW-m9xE*UZUq zJALe9q2TGuKmpC)mdQ9>)aBo-c$4h3DwvpI@avP1(6Qdomh^h|5cUcqfRejM$<#4x z{g3r2Ft*^xGQNnA7rABq#$Nh4);Yt#$m=A&59rN^Q*_S93#|G_np2@ zKR)o2THm5bL~pCMKMZMs-_%8;vXny*@jxH^ufptLjJf@Fl5tE zE93sjLDhGnzaPTNS>!_&R(2CmF2!yS1n!UvV7?~Uc#T{phZuXtam%G-2CA);Sn}bu+*ni-XZ9jlmh#!tMUOcC zO_cX=KEb-yW;?Q+^_D(W^V3}#rouhk#F={_3Qh5%UYtmQ6$N*ePBWv>>?icrS zR`^4=@;kb<(o;>rD0_UeB|vz~dsAODp8KwZ3tm>04vyK1K0{mU}^InAFJ z^>6VYG$v1U_~&wM<#~74c4GG(fttq?kRLp1`C)CGa~Uh6ZkBipojv2@-fV~ZojheF z-fByWS#Uy@lTRlH!u1y|H@Xj73JIUUo0g(7MXeHlPmt+VH#tij0!RB`(ih?vr3)h5 zVRHv4te=J0Yu_7r+S_FVi{sWWGjp0csya(y;?TLQs4FOZr@R2W$ZLN{`6BPIjJtk) zD%5HnF{>%%Ahsk-*Yz?sw%CbxFI%NYs6+VeHkGtG`wZbxqsg&w-%;0d4ZJ0J25joE zsUy+jw#2FPe0KN?j&>pSLacU{o~71cQB+PW3Y}c?s}yc6rsc=VSmfw3GQMbl7d}S) zG%Lsna45u8r!Fo`evFC&z^VHb^S5hrZcz-YH23lZqMM?=|DQ z=Xp9;G0CUrTNK4-SPoz!6qr?U%7x@)=BK zjP?Ml4|qJ8mi1Xe0DiaD*RH6kj)Q-v1TsxG=2woZh6kpxt7Jzi&NdXt*GhllBi;Kd z{3^VtXK07VHoc5>S2JI8s-xB*db~+dbN!6n^rP7V%2&EObnU7mknNr+woIb`GT2lS zo0P4=2zo%~cHEjWb12h5gkVH$E#zsAE%n)kkITaFAbUvF`(uJxm#}^Yr{A=&eK|?q za0~B1wJi?3VT996ny97^VQYrOyi>din+B0BQIMYpOWSn0M4&F16+HgbB?@1U z6V`Xkii=Omr8!xyx-MlHE8F4JYX?-WFd}!_o-?kT_=n9X$qY{EZgLUShO9>KANN=q zqD8fS;}vsu1%aaELZ2OTlI|ZkLN&~9d&(_8sO@-&oaz?HUnM250VhE6+UdK#?v^`v2 zE_ETw{*kT)Up)YKZrkHBZ5psXSm;`9Qm z_NXN|*N1G)Q>BiatJb)T?xk@`q1qT@Q%7`fbk_@h$I@L@oHFDT$RS{|GEUG)ZPXnh zI6sPPW!F?6GK}7nv1=nK=!3|*HuCudE_FJ%ntZY+nlW^2u*lCiz5_g`Zw=noEVyTb zqjNUbhUHNMh=uhnre&Em>YsQ7bS~F?o@u(@GTi)1L$44b7x0 zf7t4?+5%QGJ$zX@p3_uF4O`0z|G-9ir*J*PFY1&KwR51IZ)c6>B}M3vbLv`cu%!D( zT1C_sOvIXbrno9scsBPM=--s^Oucl@>lxn&c>K(VkPEy`HlF{uF`+3s7nuz0D&k>s za8^h3`J5wz(AC5vylN8j^c{&gX*Hh-V)%6wApVS!R&h+3lclp)CM5oJ_6KIb-#RGr zU6{a;_hx|P3#5Z{JJ&npsl`? zXDx+0x3-Dj=#qlJOUCZ_n~rD{CZ~$7rWI#7snCc6*p8mdxtoBpEMo2go$)XTT&CH}+M=>A{E82}wR&dPyJz3>-)??b2M`3sW<(np)|Rskx+J*41K zuG$BKibU9xu`{S=_hCf;X;;mPMDne_Jua>O)5h*@0OI+w+45EME78dF>}UV_0<69q z2Zl$6Y3c}4ApmO>^hwqdMkT*i{N00i2tcM~SOrw0YTp}Fcn}qXN7reQ{#A7TdJUU@ z(`3eXx^z~; z%=pHZ%>vJv4}7sC8a=kqyyQlZ3$FNw&RgF)bG+NP!)@%5q}#6>-fg8`nB4uy;(l@% zqEC~f`q=iO)L<<8QW)Al65blizu#iKk6C)zpGQp=#OeJZ zC+n>Brw=t{TpvGN<#|ZZGKDh1XOyFLlUwv>sG1c=XA&h-%%z+Dk^=G3Cs~Wex-(bM zi_Rn_=rfqBOBdf~5pm^Xb405E7EBX+NzCa9~J@cjLgPAL`aCe#>8ADxm^mZKJltF>jb z1L)~|arK!?eUj30gz=Kx)z@Gsb3!{)vTMqcwDB`I*B*HPOha(iZrIEGTIkwEl zvCI|bK7gHeTz0XK$Jo5)6za8Kw|4}&q+p9Yzw@)Ys=vRuU1kKk1WM*`y2 zHNws8qnKCi(gsSicsphduu0U1=nIi`evTkFz3!{&OZ-XE`~BD%SpKT+0@U27UB#C9 zWk)We<|B+iIF;J2bV~2Kq;SqKjr?1LmKU;8ESB{Rp$E~2tI+#0G^EhiQv{X4f<@O! zM73TY_n$!C?ipyx%qP_nv?=IA`zvIa<!L&8S2u z%-}vUUp%W4Dl^wp#)#kL8&?PaT_paIyHGVoc(KD8DAS*?sY?Ba91Sa=!e?x%T>mre zOpTe<$&qWSSSI)D4FD5dY!6_9Lo%N;;R@E0W1w930P>?hY&>>^z{aCD{w)eRmtf@1 zPTMo+w$%<~E4c){D%QSFM9-5ie`h|FoUDJoiZdbWR4pQ~GleWm7M)l7I02h?zn$2*I9Q=P(P&%zHRDsq(0MjVeJ(Pe} z4IbnX?wbzdO~{-lKm%MKs8yr^OgWDM5W4}8Mq={!N>Q_uL@Uq+0AGCjFOxe&K+YwA zQK|?K_B$+;0A&L*wxIw4M(}{3g8yGg1b?Ak7vsO78V2a>{|0LTaHf2<$b|SmaeXgU z@E0TlAfUAWhp6yslrF$`$mq#fn8+!MJX!+V4utJ|fD{PhRDn)G&6JQ}BlX&~wdE{e z8fXllG0Dllwu2eJ)M(;~_y1LtohG0pjlbH2eK;fpG+Xgk^BOXMX3@w0YF3mC=&i%0 z0SNn}Rsf&>cJ2AgM-NaWjtSsw{);oNmnQ6=C8Gg@_)_Y*eap(#O@Xv@6E_$ zIe;zk(~b-PJ^CEL495pVxboLlivSh$DL@5h!Gb_Qp;^JhC*yS_fI__gdW7rovn9aT znxH`_cmmccAOY|);@-bxql5Mf5A0yGrRHR?wD0sgyULoFc&g&P7bc(TvNLtFRb+db@7kHLPLe90ePmyJKG?jT z8rbGs8kECoib8r` zcN&x)_(!QM2%_yie9hl|uiTytOIsDr=QumH;>2jjh9*pJvq4&*X=+&z*v7IQL z4;5^4+)&#+&PAo-MuT?Ehd0KD-T%-?m321`mE6od6YwUEdWq4kwE8U^;)$ zs_Ey2hHPibA%OWaQf2tzEQx?rd0M_JB<9Srn~dxGx>>u*_gnnk{h``GAb~bzEY!M}riiFi~)+K?7K^ta^2bx94Cf{tT@Mw5@)n_{W zq6sV5e@x5C{g@4@@`JqL&9`R^9U7#JT-G+rWK>$KRJb(c-}9L!>`E7o=O@}F2c{qM zA3L%DGKzS1Cg5A#j^TntbA4WY*!}4mnhh{>xt#^p{-csskSMsq9QtXm;++<_>Q)wn zv19WdTy=NV&Z4@KD%-vjjLL#u$ajG~dSQp%dye?Km&EN5S*f@>M!~gj=bZ_7ye9N! zQc0DUWiq~=3j)(`eiu!w-bYy4lZjaMUy=M>j`jLe42|g9B6~8p{p}%CxWP>LssNIs z^sRdvh^8)nQXEeS`G6&e?*z>r0?-myb?H{3-Mg@f!3M}fhMrTAa(Qy{J z1zkLgT;gY16g&`>nT^2g4hU2x@1Xm?030h*MY2b|(3`WD;D1!^((n}kZ0Lplm9+%# zq5=Jn09fA(-RZ#Qj5U5=HwLB=|E7H-f*jZtH?2naw7EOz;=4=miH@%Iq2iaK&Y@KFj1Y)z0MSQ*N&U0pM3a$AGfR?NeG0v}FuF1jEwpJxKJ7k`*1I~obZ z+P32SMY^}i2r)uOpfqzwayx4V_K)yg2si^T-MLv7{RmjWsffvg$FFWfIKPCHVE1D} zP`53Z!p4ZhrF*7>iWB$Ck&T-o8hP=n7yYjPq$7LU#E}3$O9wWCbcMU=f@uw@?WrpEvG&kC1zwbHS z>=uYx;E`AFT)n&zN>~0TgEdf664HoLFo)FyWZnzOAz7l+hnJ-oK{=#xhDTQsX16cJ&tclwscvF2Z1-}cL; zq!OhPN=2FyXYkrSA6dt zS!uc8J^D=%ykbSss=F^)gGZp=NSTMd;J7fpf`_h}3}LzEOVE;3kxk7n@g1`f>;M3M z2d1Buzr>fqzk^4@hp|V2`CIfekxbBcaAf$f23kk(%W3%w*wcaC^6;4mux$(CnaH$k ztV+y99^y|6Ud&@SI=SF;_pQ;0s|mE;_os8w>h~Mh;jMnXuztT5VVX!wV*c?t&BZQW zwC-nhK;V`<<&G8^C$P1VM@ZiMOD`e5SS_V5oIh)fr0foaOSyQ?Y=r#&1lt&xRo+8i zFBjhf;2r>OYZK3X0zB-S1KT(k@K9jgWMpRhAMynqfr@jp_(t}U5#ZpdfO^K10Ef>? z6`ckgd=G$q%WH(MvUCUCd3OmU5*Jqc^wz z*HY_|BmBQQjs+}t2S8w52Y4_5ou9aX-f<>DoW>4$SCwfkSzZhIeB6O;1W0>5dkI#U zDolulX(PMNcqi<~JTka#VJk4T#{%Df5l0-@-GEPncTa=-=F_r)8+yom1SUDb4o^xIbq+fNMgXY) z8f6eL3d7J14ZOY$_W`^R2pb_p09F8k#04N60bzg@miC`8VEpO7Vc^S4QJKjIIb|9C znqBn>_rD`X$A80$?I<~9G>e9>0xTN#o!Dj$SoD;R;64x?6|!gGAokt`f&6ufF4*Z6 z+Wr-koRQ4(#k&8!Gy6fNv(D8IO%9dY@o#49g*AnTSl(HeunR%_uRnO@?WyD!$nb*($feN2aKVz{i3I>sijFl>>& zi5@?E&AgWwLVh7$$T5P+ixMgim+Q2(!R{00;Ss>cmN1V;6XuQD`~_1ywn(<}D4&LO zTr-|cna9uOir71U9^%u&udf-e;?1j<69gS?g56SpTfPS3uz?r)JfOej*}nCPk3(%6 z00(w#7V`lmvHB2cA=bd+AuOh?@(@29mxEbAr42dvQN4ok@vFljF2MZ)hJ6zk?#Gy~ zBdq(#HR?QG{K1)yZr2D8rJ=;gp_(WE4Pu~Tm083MX(v#V=|Io5=OO#KDM|W%Lo&uq zK^EgrXnA4mr>Ier8ejDIZdr@6^IIY!vlbJ7na{${%7{*jFg)6P=qq8O!BFJ|@x22o z5}Zg@?*p+w;w4Tm1y^VEkmDqk#E}wh)({^&2e%QhvgG;Zli+2zkBlghhY`?RtkA#2 z)8aX0yE%Ars&KvNcgNix#P%HKkBp{Oyd1%C-J^pzQ%ut{DJbm zqiWgt?99tgSmnr8Jrdnoq*T)G6m$dZt*uO0gUdT{2y~Mb442w2pQV zMc{8@yrI47LpiyYx|SEB_p!gip%>%??6|E7>_+inQmW*&4|Lf%*D?tDg579wm#mJ( zHKN{;oU=0eqDd7M(MG)!3-!07KLPlBjy&B`;}|LW)G(noqR=R)CaTR+nZAZV$+YymBPEvszujm zN3$=oKd$ekw+()y3O5MY-1*_u)t5fdcXyy~?m)|vEc>zF;7}B}H)o|Q*AkRsX_I0Z zkYahjj6K7tfJ2|&f%;hX=5WQima8e21)8~*1!nA>1K+%V-hrM&_U1gkyzofLcU5`Lhh_{1oSw?c~ayYzockhHuY$NZ4 z|MNSHgTA2she;he-OqJP@mdvoU|7i~*XV@A3-z&SGdUGPUS<2G2lPgfk^Wr9}Z|IjGkQ)94i zfLQ$o1)0*A_%m7}W_%#iy?e#&`FDt4{=;|}ONW!ir{~V>x#n$1E zRG>GmL9+JH<&J6#?ux1t7Q!3FkI%5_K>C~pwK&!V4tcoLtuZ|;)cQ+<_Wcdk%&r7! z423-w&4!l1ZaE2+tk8|um^{kAup4NKsX!u;C=n1fZ+J~Tt zoB)TI(v4>x=^$+=3uF3f2>TToh$&1(nDZkGFGcv}+tu$oQkR+q-vp9KcNt4znF`cQ zo8VDK{W%8?&a=f79zC&#eK|VP%7Igq?v;fT3|^)n>!~prsq|=%D)#gN!=`@L=lxJ@ z-ffG`N$JOO(w&lUZZgvgj_s>2hhBK|uOH93?j*6$S?_)=&xSIbl63TMS=i^Rb|1`+ z_;hjgVJhF7dEj_XI?&nel;mCiBBkl%;!NvIG=BdnAx>=`ndP!{TS|t3MDz#?&InO=Nls;cJ7(Jb>L95*4-6) z)2~zizJx6L99JjgHAQe=?wbw@cnuKe1sJKTzq)M^tko1zX&t}1lB78OO58wi@)|c2 zD|KqXVvTJgMp?4Y^kmpjxtWs?wH04e|LqI46dR~V&#~6pR&bA&sQIf~*iqTT1_)dJ_9oH#JN!CzW)*C*c+GS91bTFKL zqyp@9v;`&&^K5YBs|1g7+Ulyyrf2bwIJ@pR*dOpAOK=jX1SraLN*60K2l-)Re@u4CW93T4L0XoVD9+S`)RBs z>ul2fUBvGeCZOQGFwHIC-?a6`)*u-*Ui-m?!$S(v5}mP@>62TclAZ>l?PVjQE1v~g zp8IMZei*&$pS|o)zvoa!aYz{vV|u-OYQ2{bE|#-Uzpk+ok@@qs_RT5&f~t?nqD*<9 z=o>i*tx^xNL%UaoM2;oxn&asfn{=6DM;Rz|^eII=C%iP_bRtWwgcU{op!UT_@`iwr z`XR@CZ-{u3w$vf|{g{0HdH2J{``rf!DW==aQv_bH-G~6t5L6KN!PQiwHdc^|e8DQ| zTp`?)p1@jeGPTdbutZwIB!le{a$rNrzMy|J(FaN6zcM<`<5!ry&Xs6KAIXoS9G$fA z+1ZBO#&(BW7{{4Hsk%tOt1jwdR$qktYv-!&N@LX^>ZD6qP0l+PPs>t7acu4BIVRT- z5`AZXB;q_{Qk2-$o!Yf(!Z^?@=*@CQTQ{NPW0cJt;eU zhgT@DX~oOxJ#otuB#CzW!JU|D}zSbTf&=L zE8}k38K4JZ%7*Xz+IB@9WiMl$N8O)4rUSDO65%6ML6+{cXx|SH;tR1st8(d`1lGjU zxAo@ymZiUFQMWr3U2o8=OWnM9QkdJNymRzD+W!$d>f&SvbM^eQ<%^)YaphNU{QLvj zpLj|)h|-{;mmfF*dc$P1HGWN@=Vfk^NSLzyu5J#WWHtImn?Jq~-Lz`5FB2Vy)Xsyx z?&uri?GJC?COABrB~RLF;-Ft^U8!nmvOdFia_+`;c&^_up_}xi+PY_qq#hpXh(+zbO zXfyvrRFIK9?tI>maSp0@Yb=~*TMDQ>4ZULD3C^3To(sG;HpbFl?oGEI6gyQ<9%N;M z!{Rvtz8P8TL&qI@XZe?MZN)H~(5Jt)sc1N;h+)mqjNSDNL zT|>Vq?1G>3V?>jNRpZBnQVpyAD24&523gzK%?NxYm;d`s(9`csrb-3r~t%-=?3==L&iZFy#?#{oHQW!{oEu5PK4V&*Ac4 zQ*|>wqVT-TMCZ*sovVX}&bGwg|OBKW^ES^ZlTUZ*-B<=?jECpBJ+e=@JnBU;Z_ z7cE-9^O?T=L>2t^dN@oE2O>Un(E3#&nwD?3KlU>|QT{g+)(|R6*Dj2?`wu{lq#)io zVdw;rx8KJ+JW1`mB(o+DV#fUZr~XAIERo_mT?H#9@?UAF+pQ1^46c(e^zsIbI>_h* z5PnGx;|!uaSqdq|oE{9TtXs;$3WY(Y-Zw}}n-nKPbSO&XomB=r*>!(_|JqxrYQW5x zyWjL~At^%SF|i$Ptf4z1oi$%uB`}bGE1e{pwF~1LB;e*{DClPU)BTp)tGC)u0gD9W z)4VtdZV!WFMozx|sS@;qv}r$GzMdgI5u3rR_tr#Mnq4R8x2jB6q?6~TkhVMt0o4-h!xG^u1Od%~m=I0jOp8GV(oM~y!W32#8ge6xJOI;N zc8LLwlI{kuOy9P6Gaje{_|Jvrir+!zl^c^HB{Rdwk^(Sxs*+hZn9qatL8riqu@zgV z|ASNSxjMtaF2bcLKv|U6h9pCC#(cWbVIR)D(HR#16#OS zb|FO~n|(qovx48USpQtY*7=d?@Bt`&UY{TI_zvz?9Gkq^$M>3{D<7N><*oE=c;_B` zFRv1HWE;Cg*udJu_kJjXb8DXaL>vob0t{N@h{fkWh+l&j14_6N!b>4anH|MP4DNKU zYv;GVOe)SW;l=cu*B!+#5 zt#n+jKD}bQ8`A%F0$Y_Y!Q&QuH9zh@pihwVW9KFw5DJrgC6j2nVMDUMx zG{5g1y!AJ-^vIxVx3!(JbH!ENJqpFP7wwRrn9ExK7j*9|;&?}j6YGz#0h0&Zr?zmT z_i7y{b-8@GINuCoiGd7 z_=8q$c+fEgF zws>-=wn+l_6Sj+Q{rh>d!K&-cx6kKcxYu1xug;~(T%URh(R{$O_fThT#h_0M5>{Z9 zy}@BY*?YWeK625x@;2M^0L6XgZ zn!n~ZvWM%)ldEaf+FaUG!@5VJZ$G$CWx3UIk?;&IJnTW;(513mLhZg%*5$o;l+pg0 z^1!>^TA+udk#Iq#-WOGPF1>nag4Z;M?uaH}4;$w|Zi{o$!yS z-WPR@-RcRP*Nt&JP?il4a~2m`Z(6gZOk};Vc!8PcN=Wx}J(;f!??c}|yR0&7c-X+K zP%@s=S*S+)QCKZLW}9o)roYiWf>+6S_w8o?gs3bl99x1-L~xFrGq8>IR9vs)*v#vpi~p06nz?02V>B1t8NyuFRJOCba>j1}|S~e?l~M zdG5T}x=i16XB0|Jhg$2UvZtNXd>gD=*1Va^X*E{;rPI(qAThQqkHB3Nxcnl8+pOGC zuI1tyU{m@JEBS*{$>MMpWbhPPTORQ&c`oLBh_EBv>S>3omRP0I8bVFg&*}WAL+P@o zmR=72*0-wG6M->b7-2u9jFp`JIb4Do9-7~)oX641!QKOIg^6o!4b)tt`Sz6ltsz3+%SBMZb$AdZ z@Z@6>mpZK@i=4-`mXjiwW)%#hic@pQ=V_GvNor3-kK|cAf8tVRdG6v zTwm(zL!vW$f7?Ql$S0Et>M?F+J5rm z@1>cZI+ImXcOhnU3dBGA;Dw{&r920R)oKFR;|I1zX5R?Qq!@K4#io6%KVza}!>aMc zNe+v2X`o=?fp%R(n74R~gp6HfkIC})M|LMDy0W)z9Fmk7!y+OS@IhnWs@|t!+cpVe zO{R#0$^K!*=a$;T<1v}bmMm1aJzAh|qNyu5FPJ@t>YD2%%&RO*%+o0vb!mPc*a3C_ zN;qe9PEP4h2)hTrY$!I*?37yQebTKYS(rZ48p<;K)|iR(Z9Y^5k`_r|?Xd6=Y+?~A z=~F&pfDdK{NY2Tth5zA_G!BTM5jWm{J(>-?`|i~n?Z`fAp#+w2ZHP%>XonNkqTR1P z`KHDXzxpa#7aCPm9Pcn|cc6V=?P_Oi zr*rf=hY{^z-z&aWMfM_gQ8 zMO+~ZDR*y-D0|p{dOI#CS<(2ZigAKps9#EW;@@Ad)bgCnCjkLcgP+^R6a~hgJj(ZX zXl3*KNY5)hFv9wws=t!=fh}qvSK_{<>0z2$jF#fl<_yzkDUXFp;tH~XDWxRW{H8e6UpNRt zV=9>5_hrdc(G*dAuFb}#o0sQYt&BAHwW}UA2_5+GN4IH)$>Jzzyv#z})St$JoXpm> zzsBKR<@d1KK??X!X66=3>>CxG>mmztg_X7*4Vf(`1>A|N=5Ltzn9Zp?rsdj)uuA(~ zKQ$JDwNsSbI31>dv$8Tf7oA|0$!sByTdc$UJHqIm0ma2;r#nm}$!yyx;8}u$^JKJf>W z6InLtgm?iw@1a1k3-(hAHfFY`1Kl+7G{(DtF#K&YTW*?oCAW8n*W*v>Jt_1GYV!7E zAs>#Tfd8P0Z=)tMj5CwjZlEqJSg))k#iUgRp|^?WHdr_2-8+urI#1JN$iaF*F~%rZ zDGPJpQpda(nXTlvOA!af-C-MfyEWtj1$>*CIh$`LQ$HRIn@3Q^5(r^owRAM`!m6t_ zWVSJwz*pkShBV+bh9RxVZ#80KX`kL5+V;NIxM5JJMmoi#h7`I@F(T(c&gKli9Y=#2*RsE|rGi z;2rY~{Rp~%j*fX1eDLivv0eHI8aY-hf`u8k+A&Y(v+h0JF)#j#SQu8j!TQmICO-Gu zDOf_x=e~a_b$o8xrhP1G=UVi-uv+Vm>+fNe!cj#sTd)Qe`~}9pwZpU_dfm`a$Na}l zhEOYUF`t=^c?1Q#nuWRLTENJ#+U##F4l9Q%W;Ls3V+_fuk`ixM`%TC-Z(?IRfDs#u>^MXXCx-o^4_)1Vr6l*`!LLOx_x)KYPzf6 zM5`Zg%Y|m2auMD?|D08Rk(C9l9@1iSdeKWf&M(8!L-6X5c=Gw$^SApSK2&;&Yct^q zUz2Jdaog&#vK*Lcuj)Lv_T{!!ijO~+lDJ6Wp%Z~$b|Ko1=BGNA8Y>b74N>W0)r+;3b+ji}4V5H+Fos5KZSO2`mtBcm8TBi8; zm#i#oA3uDmPpTE~6*IU`e93KV3yFtFN-)waXsN-i#3iIT@wdifu8VyLw}(@iNj$?)U0mFygoINe!tE0$A( zZ?mvu*F-Pi42d^S0HGqUQ_R2Od)46gA@RaMiND%iyeur{)l*R8hsiZPh=JZyWjLZj z>a6JDkh$d{@{bza5E373^WhW6=^PsiZn%Gbr}r~ke0*^j;&$^Lsg?fu^t(&2@24`( z|0Lq$T_*YwP9KCGV3#2AM=4^aYH%MG7F@Flk@HU7TtD(!Ah-DVk8CVUZXXUqlWN2J zK_5OGMkm#>bK4>W@tDs3d2w!A5G#v<>jxpG#s_L}T}DCA#r}Dg6MIN}uB60;Acjf} z9@33~X`OF6PUHAaMOax{cm_x}!3+H+H;C;vo5-Kbnsf2-mUH9&Mx}`>nj%kvMlA$c zELl9gKUP|ZTW(phRQww>*|_5_=~S2L;^edFvtD>G196sQn#o+ zd4&pFy3Fc0QgyR7RU}Yw2BRSLXG-S1(rTluqQ}88z-FxeJ;D#tC|!n|XK4wb32{Tx z<#rjV%Mg`T+`5;Rl(I&|w`B5sG2!lGZKI2S1LdohCY=+jKCK`R*VUnN=BT6?HxWQ% zk?U~*Y{Tqjl~`WY3=y8;y(+io20A*`9F4Dl9DpR;OSIZ(mi7-pSksYkqs19_^Y$LY z9c($S!Pm!|@cCa-j@A$&s48fGvKPRfn<=@m@3XN#WRIwx2d{LlKxzC|k)_6!;$w$^ zT7Agp~J0d+g=MBMYJy;?jy`w@uRDVWV^#fBrcr-MEBZo^-a8Zuiz~ zGHBxW6@muT^!s&> z&Sjnzd!}Xg>Bru+p%Rc6vXa9y5VD9mSrfI72k#`=dZO*;*rwfF`T(Hiw&AmveLyPC zz<1s~IZb0npX!A#*Bk$uueAQuW6}T2-;8TxA~MhTZ-yS*8bT{iW)5T&-tOZZKCk?W zzoXQr<8n_f5dQVCd4jfo#nkr(WjCd37*i8S{Q_WN`w7}GX+MKtX8XMs7MHD-gQ;B_ zIYIz+(XtBX#8gTOrDVockLgsIbg+zDK%ZUm65%flT$fElOJGHB6s|f`xe8%y&T5P~ z%|d#RS7@+afN@8kvM4V+8R8R~z)@1dH{j{kN z-LB6dOkrFU_}&hF>aZBnxEjYfXmV%%x#}4v@gxLsZ%wqPo2G z=D@ezXUR5sh+_fqX{<$W#;?^|rv`I@Bw=)_!nmQHfb+{XG<>8=ZVEZJt=!peDI)58 z`ErcuZ=MJE-BAIMgJQ;fnV^~7#L0vR`Dpm(?oijlfS#cOaDL(Fuxl3AW))x;^GEc+ zr`{zb02#SOk+Ha=sAS*s-1^OetW!vY{GSlN?THXAYm+=l&*NcZkTB^8f@!D-c3*4_ z>`xB?_vtG8dzukCMwcoLauah{FCE6zhM?@1i;1v?_SKT$EfrjQ4QZf_0a()Z@;D74b7k43QHpy!GEQ2%T}82zN% z6`Bm-u25SZ01r-ww&Jz>YlkUagFH66=2=#hy?if`Z-31@Z%Eo7SoxFuMueFb5zMcT z%gY4U(CJd(nz4{{!6WP3V05yN$Vh;9kmpo;pGB4;3vQ6fkq~&jxp($EpD2{5)s-b#(ahc`c8E-WK>BPe=*k*`wd)XVu~ba7gkJPv zi^K`neB_CBy;yM%91D&uFG@y`%S&LBMRL9&$=uUoLozi#J{kvN@l)2#>*Hmmlv-8cTe<10UL@C%?xRUz*r(xIoNhhB> zFI(nhKyar^jJxaAq|uR;!ij6)#8BSK_%>!)Mx<5Zw9TJwE~we-99_`XLW>`9Gx`&@ z@iY)_QRD9Z;fxZ88*|0Yw5R`t{a!=TK(q;Lk!fyb$5YNM419kZTMtJL#MAeMJdmx@ zZqK@^7o1Dl=TMW+qd4DhoGKpc!~?8Q>1X@38V9lVZeuNfnMglO(fw* zp^tCex~1RL{8)$lYyMXrev8;#D*kVA(PXz-p9-dZis}FUZSzIgvytL=4*z*-lsh(M zv*=23) zN`V)W2>?VV_|um51W>~n)(zQ?MT_pVN;M-Z5qUlq1n)k;Ha_6U*3Fj!>2Ev4 z2R=%41sIDHm>j4wIt@j&np`POlzp&Fbf?EIo6&kdQY^r;cK8(Mef2j0R~O5E zJtb*+KFg>fL0T4=&lR*LaLxXbbAnLnt>et8yhXR8=yU!B2nz;x&bv4(dP;vx%=Ee} z&y*aKJ&FZeoiB*yIESo+tW>GD1Mihr2jYJwxfsKwN{v^L^msc~EF zUi*+_pErD#CgA+f5#7QA?iw@)0~j421qeBv>T3YVT~=lyrb7b!NUaHLZpiCY7FoDC zKKc8=%VA5>WF2-oJ-ZtJ@6x`#4XcRoUy@NwA}w*0TAH92%4T7Rz-^i(-e62eUVyIU?Z5mZmLUM6!bOHps(C51$RQ4%te1;=AgHTL7Kt zWuFurRMth|0}iIEA0##koveBXx+0o)DUX-NV5Dyd?@z?dn$j8*xph=SdXA6zr~U`9 zMr0f}(Pv~$c!|@|OzgZ6XBTX*_+FtuEf9v+Jq&?QiBW2O>YbjHajYUeS#h#zO3VWL z$7YeXDV>gUDz^bS#oG;e728o9)!Pl$mD{2mKenM`hG=7{bL{>tAe}>Xg|*Sxuon=F z(g(thHGr4SgCMghE9X`xV!P!C*lvNl^9q3!G1#&83d;h>z8K-NEZU~aE8I5cE5};f zIUN>GVB7hA`lBBLNu@d?fwYF`2)=Uv_sV6{q#IepAC5IzKp$eN+L(-4`zsd$a%*D- zdyt@yPNt}6GM>^Ko0x{Fd9E5T{lpq%`S_a`dZxoi!-368I}Sin3!K(@YDLv5K zE>>uRO?HbEY+k^El-jcXiHfpzUN5H4a_1{S(V>CF!I~IJ>#4H?Eui~00O-^Ht{#qX zy0X2VB6iOBZZk-(`L&uHQnFx$sK7Dj^{{XtVfQ~sE~WG0mI?$cYw6jBbAp%aWTD(M zc&mq;&n{B!TK!&a*l#oO5@;eGCNhF)c|B!4$(kGV6U9g8d>E9$+phGcFv?0t zfwPLm+I6bOO<5<%14(phe_=HC9Jn#cGa{>?Z8Syz235j|l0YI@J2eYY>UddHvI4G% zF`s0$T&am!qMO3(xU-T@sJhMW)Ov^T)*<2{yIz>AuxN>EV6#8N2S z73w%!3$A7XjE%>03upOQ7spK5ISpPXY0SHHhHu>%xtbS&tP)FVpXZjW)J#l!!dP`k zGd*rvz!1B-61!i52Yk)o!^}bHjLScHXniPBGxwMvW8j$h(f0v(aj!kEoRl zDwtT>$a3Fw8j&A1V#VPtji3dr1Rg1Oq6UN*MQe<crZ4U&u_9^RWJ z+fyAQqdSQSQ(+AxzD@?`@rE>NOaaCw=XV4ly2rDaWNYVrv@axAbRq?0T$mgv6@t?o zX`K4WVr`Rk1^p32c|1Okwty%F0*Ou$CCZ*a)Ws1i!PpVsEeioR>P(4{U7J-Ue2nx` zk~XglwmLtu_z-y}$gedFHo-}xkG31nNKi6NaMA>!6Es3>fqUxs7VY&dL+QE0uGHIKgl?54~;Z-Is;di zfGrD~szDC;qc&C$OwD#@E6e|YUxxsgh<8Rh?jtHq>D*@L-`8#jh>lNt{<2eSQ!ygx zWMMYxNBrb9(CnjitV(oqJy0fx!@n;*+iINFhtb|>ZXGa4V=9q$7L&Oo<=$_bg`F;B zRY1;SDrg~`ybkzbJ*gd+Sx*;X&*@Wa2BI%CBbDV z+pN!?ppg_q$^q*|0fPTkO^NOZb zfWs`*ZQ26)fR!YsTDY_#0wifZkfC+JhiYv!)Li=^RY-9A1m?(Gin!?t3AS^%2FC!; z{f&%>Bdi3_4-{JnWVF=jYK0{Wdwx$xVNnX5H6%rtsMwo}a>QQ@W%>QF_H6tA5+F8$ zUNUyVQ4A2;Vk#Hn=`|<)Zt4U-<+ZtnmZpa|3zYM%6ZAHlc%J$J(k}_k(Y!e@MQ#D z7~2t|?kX(3*9$6ov5APg;7Ac4qDRnMO3!TC>M`?dfhm0sqE>uD5h1dJB++EP{3xIL z7Ph0+FL*6WUhB7Q(AQ%%`ozH%JGu3i>%8v4g&0g2=E{xsVvie_Bip|zI4U)?Ktn{m z=S6l#nfF}2N>m~{2kD8BQZ{sy*#YAj6d`-Jlflxe%E&6o@neB0*Y%cI7rv~ZK4lMV zjgE}Jn4HGXvHC)N(%jZXR=h_Vk{jyFwP+diuloiLO0Z1^fMavOEcx+ipbwW z*uTI>eNfv|xrU78gj0@^I2gr-QfA&m*A45 z;DD!VGI>cu2q48yu*K|*e7)PpKg&pp@tVH%a7&dF`hE~g0ET)F*R{aw)=kOWvx8Um z{Sjo5j&WTbcWhjZHU*=cF5?PyRw0Ql_2D&P1i=uOD|2ziVd9NNCcyVh>f@|vVl?rI zPcrD}Ka5~dzE;lVr}?8WvX2VZRHV;T*eIwDR^*wtNRyj=ac*e^#MCm9$tDQHwM){Tx*0d@a?1rP zSpZI~jPiW9bL*P-<}R^APrH5RPE#-)h~~UU-SWpjm^xNLBn5{v#6TY@KT4$pvu)(! z)a{7MCztPcXn&I)^n+X)El3XvNF2#q0cxKulV5>K@weGShG~eb_yNv%Zo$qPHQ2o6 z6X+%5bZP8<9Ru-wzfjW(>A}XSNBmHio-SJ=Q3IRa?dr*yv~;;gHJ+#}iH;+lmJ-B| zpOd<1t>5Jwb<46bp7)&lga|MBGvFsZPWjlxbzOqYIqjL=TO1dK9qq{I3#ybX8ddUx3Yi^MqUUyyh8{9}ecaSgpp6cvZ68ulgyB(k3 zX!hL#x`2Bjb_|E#_!NY0AoLN(uKtOfQppfLbT6W<3|{Z7e62@m8VRmP@lx{``2@3pL^&8&v#MF zFHilm+oB7dF4C)=lTVWQGO@k*{xDSk<=0PR6!pgTZxh_oRo#LaJd{YEsTZl_p^;Qn zg?Q=_XCk#i<5=>MC&y@ZG5YT#+GP#Yeo&7VG*<+D%`V~fJr~sFZytTw1@rEP#UNia z--|+qReyzD-JUz>>Z|7r)eQ-_w_dI0zv|1rPTGK_5a37y(&NI-D-a~$Sk72vhhlo_ zypo+y;U1~}G4T@x_`bWbU80o)>Kl~6xx&iu28S;ty5b?!b4rC@mQk#Fj`_w;Yks1WDx0WN_ zU`|{V(>u$@oAp3e68o`Cs!*k(F-n6FR^of|!G)N{VA`v4jM&xOuN`5^!8x`sO6l?6 z<^Wa7UQ_{%OtLhEV%{%mzT@;MM6aI;I(aAazy(PS?P*Tbi6iV6=P!?4*q3&1pBtz=P z53}0i*8+XQiE9DrfX7Qm-ov6#;e+lI0{r%VamylLmF3d~%ik-jU#p)gdITzkdHA$` zT(sW(c^_qxw_fXz-dlUH#&@*I zhiGBmnjSj%uW+=l@ucVw6h6MgemX{_4;>WU^sX|eA2T*kBvI~y`)@6{j;Rg zQis>hY!TB#JV&2_xmG2W_05@?{@J&8HX6m@xoE+(XmUE`6sM?B@J;Y($GfH=1+VXX zN-$cIT=wjNaya5bsL$VkXs#Y7Ysxuy+<9eHp_SJ_q?dOy=fxEpy&v=Wy`zE2+?q}> zNSVSFeHt?uj|ulOj6u1F;wPzWl)$uy@ef49Lay%h#bQrkVhPCn#$9Jj*j;%y+K~AK zY(M7--vpR4i2!{@*iWA3c4jfv^eZ%kOK zjztY#WzrE^oHxneo>6GobPNOa6>!=Ry(2WOlz1VHa zJX5^kKK-rpcdq?Ai=j6L7BsNhB)rTo;a-1^Cq0 z#OJ^Cm;M!wZh57b7 z17;EJUKCuZ2yLeKS<)in<>GPOEoLd7+!K)=3o?a-P$D5GW*U5?L7OSEQEEr>$7CjCnq#O66 zCWm$tha8B3_tqy*9I&nC6M%4BW*R+;(M^2au%~NAtcW}_3Wq`B6D4cA|?~~l2zRKmFPIXzO3A6 zc`v>=dp(xk#xicbV`m&-nK(qKzOfaRn2d%(LM~a(TmCTnrr9jt;pS{%Jjh%*!*`2k zKrhDS=aWtv0=s_0I3j%p^jlhEL-zAS0zjC2z)%Qg%w%Vex6Lxa-JiUQjh%{w{|~zZ zesA?Rejm(s2bYr+Tu{;#fr{l6K6Pw;wyimti^Elugr)>a4plu#N8~nYWjn+ zhm`H{ejej)o9>?X_CcBZU_N-KbmFpT^SG$Tv?ybT=orxiHfn!?woyxcN^D!RY4B74aQbr({0jH9cstz$DVW9!ZXR5foLW=f!lV za$~5Len`sf4k_q2Go_BmG3-+}VI(ziTwZcLr{DuAcuh~a5U1|;Soc^-b6ciBc|@-t z1=JKRBNg4P>jD;|O#A zjJYkhDtja3cOW=94s#(9&y*|G9I6|)7E#B?;FrV` ze^sR+6TgbBzM)Mgblf_t*%jTy62r?9DcO94JH2&O2z90X8!OJ^-TG!EJnM!T2;yuR zExF;5UEJdw};| zEU$M3i;IVN=fiI8U1JW`%aZEz@G?Dj8kQ+>g?Zoz+F&WL#VuGCFA4n=-tsoqGw+4P zgwBC#2qvoi`KG%QD;~@K=@)k%Wp-G=-(}u|9VH86raUxD?2i3$kDvTWv?9!pX(K6a zy`HjHo`Lh5McC0-a033h13tEkZkjfYFzGg-C+H9axU0afcR*eDkCbj9j3e0^klG&7 z1;zRC1|<*ldd9zTNSE_k?VbQgp5X`lQj*&k-I)eWxsIQ6*m~58u6tp+7dGicBWVL` z4dx^^kq^+c%{7)_bJ|;;@agWWyYDV!e&3-AA4jBf@b^Wvh^-3$K)I6VAu}${AhP`;Ld|Ie{FD902Ke^yrmH2eV-C`=z z^b^KKUftY1H~xnYG$`W%-eC@2)$X6=S^gAH4mj}J@d##%029hOv5Ks=bEFC9?0|yqo)?bb~&{tg#v4Ok^7M47=0n;7+?lpEFU9l zCVoI)zUh~ru7Sy#8+R|1n%vMG?bX=`Vvi;_TI*=lN8#$IOo+cD4b>P`Q3tV_FciqMcr;w>~kw|MP1^lq_X zlHV}kPF5yYZ9b??ER4c%lb>B6rbs-6wojOnf%=|a5jVNDL16RFIeo?uZ+h0 zcZUOYr8C2TqeR94{o(Oe0l|VReF>I0Tp_CYSpm<+ivj(PN>%xk-)5}=r<4F; zB;%(>B|ib2V_B7|L~`nRS^j7hC)YN^zxHs~=ASndY;_@$?Qp}MYDVO>(#5L8*Alt> zRt2$a!E%|pmVZ_Y3&v+axnx87M?8QXfxs`Dxvc8BV|D;PuLx zL(|lf{QX$st>>@aJ5s+UH#a!Cs~+cS+|Qu(z6d1~$?76WHE*s|5fIQBRx&wI(p(R+ zN*8%8o-0KCWRShUWPDLgEtNHVmP#t9=t@cdB`9F?hNH#zr})XpMPbg zf>pojO)fcVWzuWvYE?tX&fOx#@9!B6L*F*s*VCY#+|rZb#drP!iHp|%dL8?5_{E#e zc=(;zt#5If>igRTT2b44cU^z~qxk5{veA z?RavZ`UyAsc?!+A15TfR;7&2(B}n*9*|>68{&`vRGp?D3G(|&tueAj_^|jMizS|@` zfv1*kZ1+;p^E`*R7hb64yi0Pa%%ASh$cKHav(wZWna-5_Gy{}W!*TEF7lI^s9jFpw z91O#4xumsX*PdyXzhsF0K*qc$$v2WGv1Bb7I6KY4bj9tslxk!@%nAB?l3rl_O|p*} zY-y$~MU)b#?ub5>h-BreeaCOh=_dQLq{)~`)wG+s*p*MDK|{!K?b*{$ejJ69b@roK z>xq1-;s?lbNs$c40LUvNyOF;o87fKSFE+yR_w}c``G=(Ty9G)Lf93F7xe-j6Af-a| zZt(cj_&5p4hgqQe!?)u`E{3xVl@_3%VzC>w&G*(ET1R)+rL}ITkw09}q@~dvxCXbf zNB8j9q;YLIYR{KNMle1cu`l=4*7(t*St=~<=^)_sK}+$?TuOWqRp$_1e_HY1Z-KfJ ztIy;VUz`6z@@|#s1pnG26XJ^JMse`SNR|zc+fX_nrKR z(Z1t1*hEdKPOd}JgAcZH{k#9I3QR!;-oAhP>CDGDp=(+CewJwN)B9R6@Yks< zFC#LiGhSC>?5FQr-7>75*yd4A)x9sh>0D{3lO?zD<%^b9gf@-YQ)A}tN@Irf8VTmu z$VtQD*@u!f7DDDgitp(72XoqOpViI}wWxHJQ>rC5F5^lq#Cv51xce(j)f}=C1QYMO zo1z}wxQ9-U{WHv@?W|>q$dD|`;&L30PW@GIYou_5E4<*frG$+TpNV_;o~qGZi@Ol* zG)+pI&Sw%1ybt*};N^o7GR#^Adk^b0zP;jN(d#={pRk!6-m^k;twUmX(moBx*#AuF z+`T|#c7O9RrNBNcHVbbYq<^zuvYW4UPnsXrm@jT*R6IOXRwh3E)X#l}_6e(vK<>L^ z)xY4!?X-_mMBdP2H5@%5&w4ZJSgRRUUt6Rt)DAw#Z?d7&0+CtDH^{73eAZg%FMJldKr8{HI0w$l|E86=#eisZb%8$z&S%NnhC<~lY;ro$g$ z59Ql>Ragr{_bj$LhBWSNFrr^PvNR(|r2UP5nfhhuDGd+TNOt@%UD0!w(#$h1&Aaeg$J<@qgf_c}@CNp|- z@@7S6Z&vKBeeT+5lV?J|*Mls-r5y5-{}nm#Bu)@tNW2CNq%fsuzDymrP9J4{DsJ4l zg{ta!oYaL(X^J-N5;J>T?$Gm0KBcy@f$@j$#^(JpEfMXajlcU@f_BCLg1v)8 zLaeQnynQBIzsCFY9NjktLRX0KvC-dYWK6SadN7el9<4Dsq@4d#)lU?F)S^8+T zFYu>--L(n@K59iwmiw)=`l%)uP`$0AeVUX4%1Fq97_>{-nx>0ph`O}R{CM?LAj{=sRCx?h6|+`TM(QydGAi? zo>yuX#j=`!nT(6R>j;c|xb3*^us7!bmaSGeZkgh`1Ag?z_%0688YWIpdhK?;IZ#(J zJwE_P@m<`7exh**>X2p5yna_;Rg2F` zaqDhV7leGrtgJxaLE=O8r1=Nn;_utfKr=(PW}y)UPa>A|d*xhFjCLw_iO;0WG|lu| zTUbO_mS4?M#(~X=7NIaBUTOPqa>@r1Zuplrj#!F{^Z&}VZ85h~L&fKW3p4&Q`-Vo7 zKacS;5f&_(xbYI|oO^n5Cp!J^k6Y!xCZAFgrr%0Dc{ADifc^Fr*_!GLlTTzU4D7j$ zFrjl%XR*hIYR*QQcT6eV{L)gN7WM4-khco)DEs8|@B5$X9sXY2F(zvI} z&a5Hale2WYqR=22a}X}TDgH9@D*xk62HGB0)lQ_c#)tcqcWYcYU-L$v7O8%HEfu|9 zhLrtLkny#^!~j$jeaICcb8IV<86qQ)h0uS_Z#2w)m#2_w5qSHUR;oNNM5m7vgkXGH#IluP*3jfIU z@%tOc;nJak0>BjacbaD5PEJy@2U^0GA(bBq!}2#|uC#s%Bt`R06+Ge-2zSlv&ZcX) z^*yb-YO30ye{t-tBxF6GukgFU2;1H^84sMgb$U;0*jma}KW~J=vj`vd5C4TpgW;#N zak5qpMB>(u80J`kf!vG~V-a{+Wklik0`1Om@+S;IDz=X}G}UfSAT=cZSY=tIQkMPL z;kj8p{pI(8ke0A^=XdyI!yl#d2!5k2)w4esPT)9{5SY^>Tgu<)wPK?F{9)C|P`5>` z*bsR%qW7hGH(k;H2z&Q;01+Tk2U){#BW!_DJXL^1l^setgQo-zAeKiwC~*lt#h3FosWy{ zY#KjCu|BMR{{B5-oiU~R;@=P7Z`{ zhj$-O+Ra^7d%V#ua8E7YXMZ8&2hu(C*4jzSv(v&5OV2;7X4&=INM~XmU6Q(fo)P^v3Bv@9P_l$ry}yjijA&X z55@5_lKz=S=F>*zX@hl9lD3xxLoWrNi08i8?zHUK*>+qhUnS7Y=!D9Fp9gPSrY~K4 zA$5_}+K+v=E;#)N314g-oAql!nDULwTgTiB_5|ozRc_gT;lw*<%H3+OwMsMhKXO03 z>Uy@u&j0zn$5$6c*s7e}cHqlj_jKE?63&y4tz59JD}Cz8i zmI6#cBu$d_X}ynm`;|QdwGW;%i|ry~KCH)>arF@fo`?1rPh=jnD9mi#vn;l31N!gm zkA*toQ-WLjzKqxJS~U^T4qHU8lF+NHjStuKs^(>FLwDpbNs9-PAE$&eefI=>%md$P{I;OC9cBwpJQAM@a^loR_W*9}i>&0a8Z{MLz(B~Kq` zo!@)c^5Vx8Ir~R$eEx7K$Sp15<@#9@j_W_NT z$Gz(1t9@G zyt(Td)=tqE#`W{&Ejwswv*)B{*vrpE z6l3*=ePfq0*L;Podunu{mrvm#%*~R#RYix}%(vP)c4dw)fGys-r&ia+VxIkZ>$&>8 zxsHMNDJLxqw!gmR$?)mQ&{EiWsWv?L%D&ZWO1wH;UlgAzzfUZ*Fu?s4od5Wq;qCXU zADz6Xv5)dt+ncq6a`g1C7UJ#x@gApZ--TO9QMgZi6Av-Ukrt1RF5J_7QGI`28MnkK z-0kO6Hdnar)I);SzJRVzSDy&?7Hu`DiLqGh5x8Z^hw@@?MlsLN)#c^T)%NDicaJ@= z+`Vw#g4S~v^mVsAbE6p?cI1_9a~mu&PM}`gd#~j3q(18Rh2@I}JpOq`Xd}FBBW!IY zYF1<#Y&r7NU2s4t?6Za5B)TPSXXrb$ab^C+EeFM`%j&GPCMuR|TylSRuE_A5!(Zhm zn=2N$6Z&#i9XfjM#-8-f?hDl4O0(-<+FkM7Ke+cc@dmmq@WNUrcrr0~*oRIXwtjw8EcxY`bW`<#V4c^@ z>bj8&r?OtIvLd&+rM*Sgz<in~bdguu?MYh*b|yS12lazW+0LrP0lS5{A!8MZ!a^E_@HZjG@# zqVesXds2jo=ViaRYYK*+UkLU-Bdqdx<`%yF!2GbMy=J)EYoEBAOqM^dEnIm0#>5d# zzcZFyU&!tc2aV64w4D9MU9k64%l4YBdv59(TV~g6cs#HFUYh~p=9W{h|2|1Rv;4;M zws8laDyLU0b_4|3~ofp`bI4cHj6Nn)z_9mF^C=E)OxUs|NaMtGK<$gDoH!M=m z5sKKK{#hM%2Xlc;z1p{JO&NQo=DwHrz8r0_i4EQv7_|2Dh5eM8bA_#@p7+Tz*{0CD{r;u!_L1fe5Xqv?>%?eY#?PDv2a;*BRM}}g&J9<#6Y*D^5i$h zxz&={GYVI9cTB8LeyzWcz2b6Eg36Q2k;S(zmTmWMtn9sbKVF~W_VVkcA}iOQH>U^c zlAoVisk`TVl#65?dvZr%$Z)O7O3A^$QYKTD{QTavB_ZruhfQku#N78Q+gx@C6n@{} zy0p68Jk(A*`s<+JYSL2e%Z6EQ@6Ydg6A&@b=sSRg^PSe?yaL4Ywmf8)q*fl1bePgbld`)Yv6ZC`#94&`E zSvOVpe+x)>U%B_zyU9@Px9yX>9rL#uzA1~=Cj7H$#C&+TV+r~Y(b+F|89nj$nYCSK z54w6^J!?6^Sp1Uw)^qXjl{F!yCvFYjTl?$c+WR%fJl|Zdxv#oy@u-1a*X&pV?cKig zHS~&Q{#Bg~s-{==9FQ^=Z*O~Owc^GALG#hbxf8b!G`56fX8$TkIotBwBEtsx@fE7S zGyH2$&cvd!I|+MU*UVcgwWz9IiWl@EKNW1}Md*{(6*kiTTC!g}mb&r%J&)ke8G6~; zn*{^&Z&s@46LWPtqaL$ zes)j3O=PfVe^*)GQr6!Or=Gr(?7C-dtgbwlb?fQ7%%8UH?zo(^o%V}wr**H%xU}nR z%i)3ZU%3Ht4fJ5gTQMxp`F^!Ki;sW(xY&o`sV@vay}@chR3>A~cU8Ysbm^N%+4`4u zgf^}|pB?bRCYoWUe`w{cy=w|XY2im`tihUJ?Ix<9gr*n&5+|#iqqldVC9CIGeY7ob zdSY21K5SofCr9CFOjny{1NU{w%(9sR1vk7M-EnuEkMB#h){kxDZ;*>T{`x1}O)W(H zuyFG5go~e@IM$?QZEV;EMZ`a+Bv~(qHWaAVsE60-NmIAkA9WP_(iBWOz8%d{c014& z(Q0sLLB~P(c8z5&!M1xB6&|P9{G@EW{+n_5bd8(5fU#wu^KIL%C-7Gw$k~XCzgPz^ zE+u`9xt`Ou=GZdBxjQlKFq6sJsNK3xZ=c({;N+R6aIQMpr#W%QI1L;y5&3E@(=8wfBnYqB5mw3$niZZ1B9J-@S(yRjw1geb2alEvA(nGjEv{4ZCoBPv$}ky+2p5*P5N5ef`E&d-z$2b z^vv&ivD&>e0^cd9K9aqee(1sxlu7%Edq45_n$Lc`@p|typ-!d!+QRV)g?A?xu)ow? z3OMTYLj858c$cl-%D28|TDm1V=jpq*zT4KOgY(KNblti6(ztWmKc4Kz=eKK~U0wB0 z+4Jm~%j@a;`$ksLTK>XI?v@=-$6k2iY7*PtZQ_2Dd%a^FDKGNqc2{qt(uGrB1z~E0 zlkydNcH8CD{jzg^>h|;oE+X6e=-4!NmQ3LlP6a=G^8qo3+a#K1PRw;QGNqg^jou9s z@9N?Ds7dnM4N|g@Qq2{Ge8Nbp@A0LY%2d%eT-Q7$U(}DTbRhumiK1$gv<2Fe_tuYlR_Bf{yDo zbVb2ejwaW0H_24M>~QQ9c6*2i^xKC|XiJs)T>2(%%{c53Kc=>e7jt_>JIhQPHT&LK zOrV=zFtEzJ4v@KMHIXh}d&<0VUk|ywEl}3C9c1t7`J7bMX49i7(v{}IAonwK)diI#`iR)j}zknP60DcXE6gz0FAs zl!CVwc?ra06=#$YpBk?%MG$O`8;*2&_h}xh-#KWW>X1p1A6rhs)MW@=Ikk*Ah?WMY zih5_@nI<>lYeGHVXS%g7`j=$mX0anbd*Lbay%iYczMVw-x+39G{u+TfJKZSY<0Ssb z?rwUOYp_%k{&DHLNoM3P%7>3wZ<@=GZ*j%(^QD_hZ z)kX;xi&c-K-uzraTJq-S@-Zc*PIdp0OCLP@a>a9uhK)Qq!SPoV^AL@Y;}vaA7Oh@H zm2rnmoa)#L%#z7?ZTw~uQXnzvR1|E4=pkJtN`k2KSQoM8V}CV4$LQgBE;T#O95c7- zv4gLHd(yHFNDTJFQk(X{3$3SS7S(rPEw|--4p;TF09P9P$mytGrLDR|c zTBv6l&{{kmkrffc3gMo5#r7tejw7|`Dl@Cb%%o}JI4*iAJxy53@!}r2IIvtIH=cMI z?<~@h1_{Yr@60LFF}F>sTxQmkDa-0hk+7xxFpfLCRiwjKVR<-CSaPEqL--;0%?T(0 zhA+=e``UW6$`++^%$#ITFck8Qr?1k9lX4ID)VazfjN0NOFR?;27v+*p!$>p2u<*8-i_9 zHV34M9#l>o*BAt0mE*N3$Pia?o?^{0H*wJ`oTvCSsI(qbV$0)AB{uvxZtEbFs*2Qj z-D(w{X$TSo*@GauGS#YFsMY5sUJrtJsr8w?9A;%E3OQyvwopP5nsQXR2SA;irob$z z3aylx_~1^47niw|j238c8W{0u)7q%t>qor%=Bi`Z#V3t}_Nfr}4Em_jh>qS$Yama$y-YM?pGz4KlP7%nNPU$6C zP2@L^GLRB;7`87)UvM1CQw0Pc0qWq?%9ct{;2w$`$WefZO+v)5ay+v}Dg7@pH&!d- zw>EhZ=}5Bhr$uX*+i|tJQlXDtCN>LqMr_SJ1)}hB(>gfy5Kr*|P>G(5)@3WOwu^nh z(=Ls$1muG(k|x1M@U~f$iBrRD7JJ3?&e=+hK+rJQCTa?1&{e9JH_|mE8A4U4f~{%h znM^snnK7u;s6{Ik27^jcU0R87g41vm#m8{*DM&5p{Jtr}VoLtx0SAErglrjDHVm*P zuNGqkrn1Pd1%0d`WYuX@9i9w9dVrwo)1VVYf%P^{k!Lc7KrLm>J0_}X!z)sCaS9 z?u+S+xh!vas*}Y;Wz#4_7ktB$kJskORWFy!hk7pp*GxOeO_^hs(28NXsA5#B;LS;B zFv`5SK5II8T8E6FV4*i;2m?>zpTX;~9_? z_%weVs>WG}fn10yQK7D=PM>y3=mgAXpTCk)a2lw=YGNO4>7xA8NP=D-NisHB$uh<^q08nQ- z75t+E{=qdtTBP=p%qK9AUirEJ=|i*} zAX-=j-qJ=x=8giq5j9&s|6oqyHo|9 zIY!UXo2EkJdOS3*OCu}+F>W9RmztP~oi}D8Q72p$dcwxY5DcR$vfRX;eAxYR<~~?+ z)0!VK@)elcSXCNDco=pwu}!Nky@uUUn(#ZVh3MlhyJrd18E`ZfWn-k3NmSgHj5hGVkBsQ>M z#d90V9R=)Uf5+<`Jc3&(+oLZl;aL_11N(K7d|ke9BkVbf!A(OcR4u4)ZbTI@?`?B^ z9kIvGllTx88^v8-SV36R1OxS49O_e=&@9GW5Z~O- zK!C&P3*k<}b%~)F$%t@PxZ}rz^g1Lhmmo(=BkT~8G1Z+|!AsctqZUBP*98>O5!D2* z!Bx#h40MV^7F~JFjHC{G;%zY~!Al5Ab*pG_F=Q}R3zvQ3OD0``7kDus#?ugjJjTULgc)<*q;x|6TS)RI~f)CB6V zjc3Dd4E8t68+9E$#etA#2XtZ48-ne81|aFJ*bJoH1O!xqU09`QE!2q(fPN*yWx{%} z%ey%cRy1(6D!4kLsXh}g3z?3iyZCafOic1nmZ*6Z$!5YOK})KIUEJqERDon0;3JK> z*w)i(?1=Z=&Wu#x8i^y3xb(XW(W+Pr-fCg|^yKLITMJ7+{^5mJiQY{)6 zxxl?aU8IYWA6p@@`t{QcGZF;xTXJ#0g!ExyK}MFh^QOgI|1@w^3OI_a0gk#SB+U~X z`e^4VK6VxDF5U!pie$G6Y~N53qdpc##pWyX%%=~SD2TbFEsmz-64(w z*4@#Y(qo?CJNtua64TKeyUv(5LAh;H_kg^xZ^U z4xuoUoXOM^AO(+hQ#NpmKqs6W7$*-p9RpZhSq-Al<3m|IoU)X@Wzfo^)tP7t)%=J> z>rSz(`YweOjs~Uj(;_l?u1Nuz)ozjvTom9FJ9p{_g)k2Q+RfR-&G0jkd>wC|IO=`T zN08b!0ZJ8JTVgI)0Kl39Cn4@GO}<;$Y2CyFe;6zje05%nO5fuRX`b*19J1J z@0s*fP>1s^%)Q02{A~Sj(yOhq>IR*It7@K9Dy|$Q$pJp}I1Vf|FzFlGSMc1P-QEY?d-wQysFH^6|QK zKeftH2^r}+SP^JFc#d6Chqb=2o^zMF$E{l5ln5iI?EgG zGaPY6h$-^^L7yfgMs?GvO|WeqGm{`7Y&K0vjMnJ`ur{C^UBrZ8tRv~3asK9fJzsR9{jl+#2+U^cZ>lb%m6Zu2tJB~ zB=K*ygY6rB8EM6s163QV52be=WXaCX=u5&d0Fo29534_GjyYh+rTAO2UY;F}ZKYN%4hX>zRPpYV`YgH{AX0y}J|8wjYXrUzV$TYVA$p>} z`s;FqF*TC5$=1`b4VLta`&;Ac3`k{!lZ7*_a)K1ALDXq(PS;q3rsYXgIT;5p3%6*i`$)6pM`z!dUZv%FmKXqT8C$^I+sa^z4JUOKUJY;g9*PPlzmm~jfi)D_KKA4Fle?Q}co z?eD`4M)oT(Hx{y)D=-gP-xhPD*A}34aVo6m-`U}kciU+LEA7aJy&5$5m&*=uF%oJ! zyY%RgPrEpnF@2_Oygti2=ZfR>vjBXOLBnL!?+w@91%_Nl_pYpEt@OJyc?fs2t0b&2 z0AE=7F(LNE499w~vm_DPzR;eyw`aJ$etQ*~4cw9bcP1AOj+avz(6Bv<<{z>~jrMHm zQ*NkzSXxef;v3meTfJwvDhdYo!{E2$r{VF*C^GmvOw(2IE|BhqS2Sq&zCPhmmEUkx zXl(#K4(1Aj--VT*5@PTB4Y$_@RH3IMYgu>wDklfOj+di(&>%u@<@fP-c?UX>4W`g@ zX@6B$-~{x1fkszjKowOJV>2HAaIU=a{-?->Q`LUMR&Pf&;m$7E>qHRhN0s+=Dk+zx zvMvGssm7t<-NRM?xL2VQ^8@gC#^8m-KZbXfR01&`h`vFXFYjFXYJ0__qq~ROyRUZz zMgzGRc&`9&)YpmSXOS{V4enJ`nH2la$2vXqyAcV)W4mGY?`hMv8LSgdkqwha zes@*FKYeh+pU!0+jry2Sx$k;cNm4FMzCN-Ca^;Q;7G<7|Fk3U}I!Zvb&` zt3cepnI2f#75Fk>k`RfjgrHY}pNCiQRW62W4!d0ky2>(ChiY=vslg zY_36=OAY3Fvm_x(#^C^Sb=CM)Q9EkE=T#u2WKyo|I{<_Qgzr7aI5NQL>QAK0=d#8P z8a{X3nH=0#(G~dJzLs@$7|gBm8E$Xzs-oUK71?lF)*D>WRgyof*zgIUgKhhsW`5ZP zUksh=CnmSxtzbwLa0K?k_%Gdnspju4_)?$_ht{XW$IcvXT@8**_}tMMc&zjf++|ps zygTXl4$N)vuR^<5gUJn%4Vx0dZ0HyqoXwm>W2*O&2gYB{8phU0y1+0i91wR<@?ypH&^-<}*KxKvT!p#NYE20z_LP6WbTAWYE8yGo{kjRg*zbB9WHE0S34JW|pF}Q#<1J$WECkstNg2?|ieOKkAUrk6A+5rrE z5(2YNg6Z9mSpn5uC5a7y^x;nl6ER>*G&CBa_tOcPVG}u%RA_|5_%0fZdjgHxYX9M? zH0CN$C#jrzA1J4Q0%>O5#qQCBLBl5SHHHbp-9Mr?U#HUC@J}=V-A8u~w>LUhp<7iT z&(Pq6Z{X)%X!IFEB5-9+KfV^nKL%`6=PK$K7!$tXHp~i*g|fKxUW0f8{}&kCRRdJ7 zCnXRqS=jF9|G!~-0zH^q*6jKO!_FU8)$dB8uLt1u3_m42!tWh!ui0Hi-7a(Kang_W z+TBoM+@Qp4fcW>`2BbsdIWYuW1Z-{4xPrbr+4T?_eoxZ=Pjf-fSS~2K9|?|wd7eV! z-?O{~j9Y3ws5Z3|9KPYsq~B8ynAA)*DWLr8MD`>VdS+xj^&VAJKJ@6on71)Wj9J5O z_y3JAfJpC+u0Rp=+5>AB2%+AGai<;`16z?z7aORT!s@do(O~)}?EjSZL$$0Wj70Lh zBpqCWEf>MHh9_Cv*kp zKrKQzJt{5joPZ%;U`SWTklrx91mN9wuM56y0yNZS{?q@6@iLaw0OYsPP|%^$$ii+V z3p?LI^t*!ru2!S4mV(0RGruXW%CwItDd@aX`cau{Q8yf*KyGU5zUQ0D7;? z(7?0MQw2RyVWP}QDo8!0rOzCQI|emPCaM1@0wM+j{w?fQP##>ppti#Y5&NUc779wi zTm51DCV(7#?w){3Bm2aH`{6ef8pvNLL0jRYF0<=9%=j9deZ^yt+Mvsh05v&nH~t0Lfr^yJCZ`L{CjL{?^ktI(o2z+Eq_)qVH7 zN@D8+@b^c-ek%0VLN6P7BcZX7b-ybxv_8PUc=VUB>NK!f!I-FU8H@oP4*w7QqoF6b zZ>%$L8U{W*8u6nl9w<*id1LRsyxv}>sT*Qt*!99@?fFCmg6plhwdE`=s=4nD{ zm9h0hMI}IQ7W9V0($XG;g31curvjlC*sGGD*GM*3EL;S`nBhTLvO@Rd*e;0sl=d+G z-*!=6V6ubE?&;0TX{Ak%!H#>q;0?;WUd z!20D6>_JE=j2RA9*iG@&04Kz z6&elYzGV_L{Sz|azyn7uaH#S2K$3YvlEL_YB^mToLC?REEEo_s0z0@^pauhV_>jY9 z{C+M~tS2cJJ~eE|o?uiSg7Oe}Kbbrz{-A}8mAow{a|Z--ud~tNB+a_Cx@b+YonR%@ zo7eCl=>_@dC7dfwVmBZVxSDSYwT=I39@$V~SLRLi-$3H9L zJpEFg@R&=g?1!D8v9b*tkU7-c%krCUouYo4s~LzsMIKpU-5CGwW=$aaxS%0twd_X- zmz$`+N%kYjpkCwf$f4ey1Nx2eyPboGyyrE6(bPBnk@cJ6D@O;vR6Qw4q`KkjKgCUq z`1Q8e2S%gW$7=f{)?w#d!jdop?e(+8XB&@`=4Kt^}gD;xSNZ~37HYhbx(^3-5Lb%TtdCk#7S-rW}S4K z7L#~Ha()?0vfSxSLRaF6f@18BzSx4-x{M_E@}w*#D@^k4P29X|Nm({!$wRxJVyKsCX`=(1 zMLO|YDEqlA`^Pqd!AHlX=Y_^ssc_S~u@7Z#+%oxvb$w$6s}1Me7gq+iXGYX5=8PBS z*ZQ-nnS7;Ohcgc?w;jwSj=>pa+Z-n6GL=F6< za%O^kRy<47NsInHgRjVVw6Quvs3Sz#2>gEgP|m{5SIT%`ruU1w4_-8#fxY_2QNKRy zbX==X3Ve~6Wh0fJtvx%f%@Zvl)4V09sp_SeQBAP(&4I%<+|md6Il}EfKDan0+KSf* z?pJ=z$fA0=Ntch!ntsW7i^`L@5(UXK?hb-wYlR26N077nl<8xSZF;}9{%~jXd;Y~l z9>g4$7cUd=_x{%BcHrRcg}~AuHjJXAqmtdOj*4T;LgdFj!JYq`{5EXldRlJv^vRxF zg2PDXPRAteS!KapQKwC&&Ej;Dv*WzEY2E2LrC~3I5$6fr$05~Us~R4VOeZI1QcE)? zcXS{_JZXxKJNgi1%UH^+9gga(?QneS=BNnILc)m|9~#{UtJCTwt^+UW9C%fxLAU!Y zQL`&OGe1dLl2SL}y{~&Y>1`5$nJFCUebBg-_-;M}&xqhYv)@QZ4HFnSyn1bYrsr=R zo5l(c;+G8m5F@@Xnb)qvo>({-&q$kiFt(M3U)$B%SUB^3Zs##`mV@!|UPcM8Nt{PO z4<=c2U1C@(xkC~-M8`Z-6c`Hn>q1b1A6fg*OIZ`EPrm%lcu=;PHc2mE#ceL(&joTz zufydkiF&X$74cwfJMjx;&6pNWtS|KDj;<<4bCc+d1dQMk?ysZ^LaU6hx#C_m_-|Pu zPnQfB2}~ol;2F9$VUoiR`?%bAWx;ff^;eGA2B`V)SPE;@=kA!ou4VL2uP0~B(BJ_) zH?gDLpv=^|aiXvCYhKbp>qcqNov#PD-1<&c4c>C=M*aS(uX>_4K_hC1x?@nsYjFFj z&c>p?xC2y1#;Ba`cT&|Oa3 z23rqcyH;{Tv7Z-m$y??EvvQIS#lrK?B*sh9!;ZOdj2gTHp)YDXlu4Ik?FbsdmY8DZ ziIz`-$oKY|f6wIC;CxL%f#}P^dN?`@MfF<4sdc=rzUY(R5{n7uPw4bydRQZLvo}uMC#PZ*~we&@}liDa{*3O`joZV};4r1ZdR$mk@%*1a^ii9ES z>@!g+(k_pnk?Qm2jXHgC^FHgsV?)mvo8vVocSAt{97=~$@<`k&INN+FF&cAu&4fc* zeNn<=EqL(0J!oY5yop4a0IDG~C)N~GQm0NpZ`#33vVzQih8IjFCj1a^xOPVHAO=>! zP|Eo=0zcV>^t?59Kb$j$;x1&r2yaCFK4NY?wMw8ZRV7$~6OSMSQD-DsIddKp42q6` zsr}Ig&Pmw%0_5?U>cfV|5!@8eP1;G~hGnHjm22V&GsS3jF5ikm(;r`R&EcfFlcLGv@M>u!AJq@x)9DV$2ky2q!mK z0w4jEgcWQbVLNRO8u8)9bqZ4nb=h@2`Hks9#aC=_o)5*O(U6u8B-V^#F)DwyJ~Joj zmmMP`6eSBS_V;SR{#R_zppk;HjedikO{>5iA6_uJ;k-X5=@Yzhv6}+^qfcfJY%_lLuuzE9x{-#5MNE;wQ ze&j=R8~J0p77}*}qz7HNklX)9LlcS#OP%E&G-AVZ+&yRmZ+YY-4cRfKQ_ z>p?o>C1x_Oz=EYxy~29RL{nF)K}fCZselvoL$dHnx!K#Z5r2`vAJsMa!a_K9eo1OI zg6FtA;CJrOCGQqWQIOsFBg-U~aK7DxqUF}<%CZ*?E6+S4bvt929dg0}Lv> z;G!?eAIe0&#Kc2%8^3iF+$obK1)Zi2$CoAGB_SM1$nzl0e#WX7%@p*wS3_1**z6!K zk?BUS&Vlpeei%y9!(NyPllhL0MF|o{>;gT-yjN`JzDCtqbCLl(q>Zp(Z%A#yeVf*z z8~1s_$(5mCcM0IvW+@p9+bl$;RJU&~tT=!3j4zyt!1Q5# z%TCx~^+TmYTo)hWzG!;HaDolkP_l#9`56SfwSZSZ>f+{?Ep1eQ=gonj7rfrFv5*`1 zquqDpUj zD$#~F?rJF2VHew4;mrezrm-13JWmx?!2v7ONWF+xK_lc}Ce~Bf(WUUC9biC72(rZ@ z;f1E@=z_yv3kPmxts2e$LoCTe9p$oE(l7L-uA883m_(dqzsw?&7A>&aaD# zv6=8%j2FE2MFABY=ard~MA8>udNbU2vqVx#@n^?HTHPxSzId^=8;b44{NoeXD+HF-xWX2E?98uqlH|A3H;$Xk^jEBtJa}9Go^T>~m$w0K5JZ#6 z<81BAS2o;_nGvotj+;5N4#WQL**C4Fm;S?V`y86YdpQ%?BVEkF%aM@;u^J&x%q2e8 z=NsXg=CX1oPUD(*a|$epGHqC`jyl05e$bEkl6ai7>f$gZ*$~%+Q(!64P{Ng_FDWTv z_vE7ZkgM*=QZ(Ne*ECI(=l%2&>~2y+;;t6e4|gpNdaT!a0A2@e1u}P+?X;(gRqSMvuUoW8i6qucEebVB4HDMJI6l8Na)Cs2TvkW*z<{I{CWKS zO+|7P4RHu3HrYlIqhBXaH0Jv@L3*v{8zy5F#U)K8$z(O5XA@lm)G?H)W5yY68d4;~ zKUi&wmqW_46^ZhEc-?_-&0)*46vYcUb4_%$t9cb0^Ikkkk=lWK(wo#$*eZQUaU5qL zMXJVEZPJ&wK{PI^({xmT`Bs8L{)%)xf(9t$kZdC_apFuXNHP5ICZ5tUnZNY-C^?*l z*qXzXL)l7{BrY5qd8sykXA@5zFo06TBSa!hSqnUrkt|BVs)N%h@)S9uGXDfeCB}&0#6R6+n9M}Lm)=%2q2!I_ zCDq^}=_ZI6c0NSR7vPgGk5d*O=TxSk704<=U2qXr74YLN&sGxaH?idaSPn6|!o;R- zIZ((76uRCt&_q_HsR=(cB_;<#zy^}^?2EZlm5qi%drk<4t`IU$yq`njNHsyBp=58l zyb10J4gt3X(I^iwGfZJ3B#!*R6uO+Fg4mVgnG9dP+W?8ws7|npQ6#7fS8}AP5Hz+N zX!I5|qAP$#Qe_C*PS8ja2tmUs1BSW*Lo5X%lJCbk&Z$=9DM%bRPQbxJ(lj%ON3?|^JGBv3Vs}? z0g4G}zEG2s1nOWx9U6+DA0tmg2<7-BPDHW~E}No!RYSZ4+~W)>ZyJM*NfiwZq^xQ( zm-83QD932jY4#}sq}2h^5efilcz`ZnmOCv?!6`tJZE7l#N1bJwBqLjgoT1D#8VKhR zHI>D-oSjV#LYkuRdlOoosSKEQgm_J)&=JHHe4{2c{wDnx6eQUePH>Z8lRuLG4j_~- z?^WR=rX)uw(iQ6T3EG%=#WBPfBIKL^NmCj?2{)c2bNoZaiuC!=C|V;)Auomt0#I?y zLPSWm04a`yM)zN0Md`{GEI(>3uxJ2_l8kyltVqceAc;EAV+(`===Fwi7`*`$VG|JN z1Mve$^==g+NKP$eayHor2CD6#SNlk28GiU@Y@Fj5P#?B|wOk5nc!p5)Eje zWeS*qL_EwX-2fMc(9J#rlVhM!0*wrq$EHb$Fm8b{Mlgmd8)FTSCgx`iByP5$k^FRt2WJ_Y9Cm-U~IvK3Z$p>GMK@`CRy3K(Xn+1AU0t-Ck zK{Of+pz44?)PUYvkaitDWEsa1;9$zkL&L=|jFZZu{|LIJMg!6v+1Lyit z6R?nhzfp!z8NV!ce zSQrozK?9U5FBE{w1GpN1=ndZZgB$QI0o#I&NdcW@&{+%&@U@aDlovwOj^jb>GL0aB zf%*EEYEW3_ntVA!#tHQ^SKS7mW^AB;yl;h(zN#K7rKmD$x zQJdG&(P*E+`8>CXlB$Y!J(ktAh&DZzS7-Cn=apWbKR3muQB5wSyhXID7G)eNDbNmDBkACP2gLy1PX=4YaZ!Th*B-fBI|8<}%0WFN&sR$$f zo?{O0EUJ9QzkBh0@iYFVN5UCv+NW!=r@ltZ1z%I+xpiJY^|fDNc78Cy!MW%G z{la@3Xn7MP1xz8F&d)h}gHj(rY4s_D(LwV1n?s<0A+&QrXNKe&9=g>)-{n(?;C4yC zb~0tonf+37jR$m3po1c_&R|FCoHP0X-TWpQ{D1;~d4s;|q3;OvfgiA~l56OPWVh{f zaBLXR^`@A~vrO;_@Z!NIRG4z%6!VOXMuoA+9@I&MD2>%FxrRMN?xX;V*Az2V*8P8U zg>$9+SKmiI_I68Yrq^N>o*ODTEng~ggyQpFxo1n4(hQyRHRtgbcKR!wq3WJg72*E7 zC!|Y$NWnY}P}L1Q13sgIW75Ix+M=}kholEOrH`;b>OpHKph2Wa5Iigx=MQWuQz*?j zEYM`Y0B3artpcRkLr|B1QLiLLTclvgzZ`*>TM4YCbI$bFl51?3DX@pE^pOmX%bjy3 zL+l-3mSZq&>8_s zFBJ`KnS%(S;o9&s>SQJa|2bp^aJr5lpIw=oxF-2;ZeV7}0`?#AAl-Ib`rlGR?T_?m zh=Jl1qQ6;kEgmMz2g@s9@`Aaf|Kf#HxA=F{cS$4W<5hoLEtbI{^cLSQt)tYErg2T} z5LATD>k;#1cxYPy^}uulJO97>A^)t*5qYq~vThy( zZyH=BOD}l{*itAYptWHSd9^H_a~mPf*-$tjcf7%pQ^2+f!hC*Csw$g24{+}fv91LA zDPT7P_8h1o2c)b1yCZV`bi2SX3sD*dW)y)Gs8YtD->=nQedoXtsxn9H|Ko^De;i@@ z#}TT39HIKh5juYyfm5G^94`VZqrlT!p-O7?Vru6;AvKRja8MxB_%lfhN|F(YI`tR#Ub-E0C|FLFD4P?+ug3LvM z)65};C;$fFIBf(OP-;T^rF2^wdxolXvSZ0tja1{c?y_Rhq0Lh1RE|9pZ}Q_E{8am~ zYH;4as)go%%@XfF_4_|&iT9uS{U5W0uKwS_QBW=`Hj4m1fJpkA|Nr7aQIG)_4@gBp z_%$K1N}ztW!2$w?myTfdWYRIPrsV^+bpbi~P%wcLmanP~y^z`^zobEbP~rav6?!sM z!2Y25-M4b%Z2jWwjD+j~*F&be;~jQyEZ^-dFp726+wGZui?Pk>OEk9IyO)0XaN_IF z&w^9FPUgOhP>e$B)}D;~sJm`3J5sc7Qd}e3kigdEZHRfyiA7nC$jPnt`u=}!FBmYG z?7a8%`O?T`$SSk<>6SNY-M7DGb@7fy`5)1psouc8@P52NJNx89->XY*<-{VRYr2hk zM6*NlgUc_)A{+YKX1;~>Ji074Lj``ese*pePv)LkR?+*4gu~|jB5$?q*FW|-Udj{A zjSgpibi49E5?0?f^K7(AcqiAXbW+3Z@UHFbklavOgU8KFNmq0{@272BV;=n2^Ybre zSNcDTj9j<2z7C`xqg?dUKK(3W<$^r*Ze{7%^7*k};t3u%x^~^5b!_|D+cb2j&RV>6 zxf3d~(Ry!sfX*1E`RlW#d#JdhI0w9O@H*|g#hyw#%qPZ#C(Reh6_LE9;A&u%XdPc;303UO1tdv{2D zE_u{`=TB*{FS+0P6aM7h3qyn&`hk9t;`?#rn=UWQr1^`ZI=27JiJGawZa=dA&Wc~u zA9^XV`+dYi2i117;tnB3Y-y(&)y>yuPeyJ(T5@rr<=%yhn}@9FYi(1vu4tVr9k}Xl z9cbIt;q+TH_{%eQSAu<(@h$1Q__A>&(~^Kr9=zPiPOS zp>ESRy^&+Er~WiObNkm^#rMB_Z<~@E-}gN&99WB8*gYN^SclQxnYZ9a>O|+J=ktyz zzQ4O_={u{N`KQmfT1FLJZ2VYDY_*OxeJ9wTKAU`h4}szqN8@#WTtrEmG>*)R3K%hP zXtaBFWRia0j<(`lT*LD6BWnZvE=E1}aSfVaY-~Y${Pb)g*aq*h2>Moj=w@*Bu7(xa zS!OFo_cjlWD)-=a-wCfCrZXq26E4qv>WQ(e$}HN-n40Wq)b90vl+?Z1p4gaIH+lI( zcC1m?t9yx;uOL)PfLYF@j}8~omkf=r!Sv#(^iEJd7C1nfUnAr1|vSRpkThT^1vQy{yLW_yhOI);B&q zy)bcJ|LytrwkqNK9lfa{x$(}9+O1W?zV^n`RjBrv4xH^BNBfQV?xf%q5$|=+M%mHLgCD~7gd-0g z^tL?z@ZR9@hNqa;BmS#AhVMVbrd1rP_AfjXmJ_lYy{-M(79W$l*5?#-MPWzx(?cvg!p55PU2nw{5_HjNmc49v&;CFJ-~0N5 zF+5Dov0$#Mwcv{vD?>?Vrb(=&@;CnWkRjp|u?^H29Ozgt@O;{T`We#ei%`Sa3epok z;}*7mHgMByz{H@jQ2p^y1uZgQ;nW&l0xamADm#zcpZ+hxEcJq2ayMVTfh|(b7;Mux zbN{}!d8nS;Y|KCwiQ|)c_FMOhfco510fzKUE8lB4trK_Y^-;nlZ&hFd%BUik6c$y4 zl@E&NGH=`wqf42Yv|*DdYVttb7C`$5wrA?&{qYNzxv)iRbuswMoWs7E}!^U}xG4^jN|jNKU%PSG_v;@LDGGV_^KSjjG#-hiud~ zX>BX}vf!9(jyV6OuqRs*((V;T&J5^cQ$eYZFK8O6CLJ$LzjSgsC~TRj$y08NU1dd; z8i0{Of&Bp8c79;sxT9hhi+V!JT6ZzaHsDgDvSR3Ds#=d5c4#Y&kmd*lQY5WLB|_a~ zdHDc^P(qHS;}9*+=1H0MoN!NS=>(e$dp)t#^(L0wV01L}Tr_L)h9zk5rhpAK;fXqI zvD;a=LsX8tM*Lne$ozTZ5RXhm`n3W~?2&PBW4x>bBMU`g(`NTY-z+3>CD|@%-R}W= z+GN+jUeZ|Fej0s&A8zwJU{jb!`y+Mm3_wNuKuay-h5sMNN^<7A?rmWdUB)Z&1v6ZJ z-OA2@`sya2R$Pqdt4C1PS|}il-DVS4VT9?{$5Ud2$}YZHM+^ko`gjx#vF2CKiizY6 zNkU+^i&!egp(~txiEgKM#j<-XO~ZJ39xu46U8Cf#kq-Gjx5(Z?jh)eZ%Ug{b<qll4r0`)G zV`3&Ar7!<{Ljrrk(-!nP0)O~qqJzUg)Fu_7+TDKr`0@*S88o}ijiuwZTwSAu z8zRMyEo8#-a20L3>Q+icF6*taUkv^6+yG3OHBwux)_{q2Q@F|fQZ)7y z8~Ty&U~P(b@Ld7WM`GVtMsq4Hp5SRAqS*Ku-^W;MU8!xL_mq3D|D?W32WXnjU(VVLl| zNy>!YsOyzD{i2P8-q2yl0?v1Ec86_6+@mLXv?S9YmkI@&TXfWl^URw?7M}emXuMv$ zU&GIXD{nJ78=O_NFv9J)YhZb?I2i4 zlH3BawZ+rb*0I@*V`LR)=AFxy=dW&NWcwqi{M^X1i`FS&YyYJ+6q%6t zxU#~ifWc*_i5mvqX%U|A&U7ig);=;g?CN!bZu7=;Ydo^+gyg_FQlj{iwse`YY;MS6 zj{so>r#2OpSp(Z6~fYI?%L=CH=Q+@Z}rN1r<~nj z4Co6nqZf)$JiLW_9GNZ5ea#dxpv9B1Ggf|iCF8$tHeeHJ~La0-dj+9Ivuo3 zE&})ak=M?4wwtg(u#!_99lhVjXPZJfLR=qX)#$&yTN)tfdtHZ+5u#H5`P{8_OEA7? z*7AF4#?y-j%MU!|3+eG`$(f;`?0nCE3#bAiD-5@zXKtPm`>RJ>Ru_^OWwDuuP#g3p z4BYt2X|}mqim?wUzlN z>yG#pNuj-yUF%SBmfJLi&lx@^qaMo)%-TB#R~x4}GIUwDBb;DAxkl%vCAm1TQKLaS z<9KueJJko}$+9?U3Kn<2+3K;M1%F(G9fs($vBL0+;=LA&#|l(Ug^s zD^00XUCCC`lga$K=W65}jnuF^d0ECj^Y-OwI{*G7?>s5;SXw8Gzaw?iLx-j`cJhgF zkk87|@HB#~-`HG)usOXmef9S~f?<~oL()myoRp28?i6+RhurP>%7d#Pi%GWo*3}*x z&?2Sjb7@~d!hClX&T6L0Yqs-^+>;K=V=UioMGMqjMOU<$i|gg(qM$&#hP10XXVR0^ z>%>W~%g+eCBQ(T3_^73NG1~<&!&~32RP(z#69}E@|LMloF17!&QV%@JA|XK^LgmDN z{@~#9Obiwlhk_E48AYW52i`vOqJ8yKWzjsP&F@pDOP<-Xb$IYA)zUqT&`#kt0F1d7 z_HKFwv!3=)(p>Nw4kPVaLS(X{N8XOF%33+%Ttc}@rJ*(+b%h6r8l3%Or3I}QpwDP} zhLl;q^_5I(YzL7N;VVDY`}&J;h-}Xbk>@pXbEO8`Zi+_mm1ZB^;7shma+S358-n_i#Z2(7M8gehoVfwn8`&I8K{A~?(k}|L-s{Rq;-5G@^eAFr+|=F)(-BbE{yjHs z&!29uT_qVQpP#9`ZqzrUzuYpRK8|vGO@g3&)siZUL~n{NV*HvXrRTen%BD7UtY_M( ztKqeVPHv?)Fvk(imPJLG7=EFgC5!@Oe4$3u;;&+opGPnbDI$Dboenr^ly4dtAG^U7 z*cRD$RE%8`qvbiAMnjC2F=S>NSyC9?09No}Td4eY5=!OP-StGPkG_3~S!Mt3$7xqM zRA9|KsSFHf(Ek zFN zK8EGi=?%8d@8n|ngmY~5hV1dWEYtqK>=Y4!rNE;XUWKGOFH_>%wgNTU>o?qV&T{a= zxrd8{X6unS{i?YC>7imxwe!NbZ;h&5ruvjcDs@|-EY1%r7rlQhIvhQ7ZBbw6)mer{ zA2>6`C!5Mo5}&l~pn6M8%-W-1#0)i*PBNd9qP(Fni~v#OoWBiuMA1Lb>Y5JjLzJRu zyI@vhQi-l4=cGy(VEe2JWw0%wK(x{g?@TGxa_lJrP=VcZ*h$0? zmjj=1xt%|AE9VD>12|%?Ea&5OI4Fx6;(qMJxf&Wr#E#}@xS&0chWg!;NJ*_@t$!?B zsB4%w3Pb7Bqb}Mi*;p3LMZY;U>TzE$#gqiDGHY&M_(?Q=tIhZJ0(omI$VT2+7PT&y zpRby-&{!E)ZQ~IXu>>>Ac%+j6mvYp82Z{vE6l<`3bY*Dqis!H^&5lbn&^y=tq%Ivz z29ro}_#usDK4}W92|SZ>+zW4h)35K&+nwQrHNQ0px_MFHyyCOpD5xMKS)g*!UJ9H9 zxG64s#w=BDHmI^n3=q4nZ#wx*r>pT5#QBy4esTD%Xum-}n2Q>oISFT=0hHNgXNdm9 z3zZ(Pd0u}+t*O%#268Or!wJ%iHXZUS6cZ==1RsvWgSqC(KHexXOyXJgi3(_`PF}b~ zs>w(!kj(F2Ak}S%wiz?xMA?F@_h$#+LRD~#`Z|emR zFD3Xc0Fpbqfq-ib{xRzEOd1+pz%cpxx^IEXyZ-vPmwU)hiIis0%^T0$ob12Y(fEr( z-@=qIPD0S?ryr&II4YD}yt_|M`m zdSNK2^r)dlIKR_?ULZdM#D40M(~Ca{F*tNe69UmAE!dVKVU0 zT~Og7q>u4Jyzo~3r|uQl5kD6u;#*)Pxi^e?&n}vj)H4PopJTjjNMi%6Wmz7%S0*NP zkI?IgDs1cHG7X7_0;))jYSu1C9|&WdOq=*>4Cqy>S3=vBMW{uvvhfK+t7pMSSGq+t zObJsLAqm31DIaP(P68TJW!o-DBH~63n5MXxK|1tG6tgEMtR!q|G5{e2u?2fY5~g0C zTl3_iM7^{pOpt4^z!ATINavZg?$9(EQdZqW;g@hvJDfvS0NkPZ!xE5j!K8ONBhb;~ z&ui$B?&sltbWFCdjV+h+11wv>n9UYQ%feqv6-219nb!U0I`0bpmpu+K+7V{h#`gF0 zVy1IAgkvB)M1#kD+ifj9MtPJm9dH=c{h?YH#k)81Lx04);0^RW`}tMzImdoJo{6$% zrM@V`PL@u!t~_SkqoO`LK6%3=i?dazN%g|levmPi=UkNteVYtNYF-g3VYD|yNv!ja zcF5R8ap|)=H_7l7weHS#6*Gw3icr%J@#UkWLhKWz1bJ|?n(YtqC+dhCPX>GBfAhAD zw!mvb^BcE4S0#tGWsEjh&?-3MyxkA$$6w@cQFa_&j(g@|ZPS+`HP0DXWOOv*@by13KX;hcSo`$O3-C$v9(K8XjZe&|tgy@X6s4jOYf|p9QCU%Qd^yMjWW6)$;%7*XpNgZDiD*X31uO*W;VE8M*W>D>e6XK_awA- zz#N{H(Dp$tHn2`e=b$`qXqc_0JWu^!*GrL{9<~nrZHnKmPB=vFcB>`oE*B(>YTX{Q z*)9euH%f38?G=SBcw_2zL@<+XnIZyBXn}@HeV|u<;1?>Tv^`n}#*(n3Ht^g!i~vvD z{C$QZ2>|>{M30wta~V`^Z>rI3Z>Bnil))HkRl;u$Gi1E-x-56(H|OU2X8K_Zgx((h zrz3rrEq`)o=EWSykIA<*#sn48f(o2B%8?UI@;RRBv5}-u;QTen5EXMcjAm8Iem|o-wNgN7530 zyVc=>l>~!PbuRju9gInJY~%9L-Pu2>^+Zo7Bx~%p|L@g2;L<2N-l4 z*bJjtgmsU0EsS61fa5H6mk&_JieQN<^Hh7R`SV(93Fs3Xmd zV^Zr&c75pMt_Jb^bmJhVzcz8X2{}7&gr&u6s>Q2z>P@XVxEH+cU8I8vla<;`RC2MnT7;L!BY#?ZHAT7EJ`c0Z^%D}2W- zH8l7l(m{lt&Cvq`U%h`N3;s!JynB21HJjJH@UYvIoKm4~TDDvZhvT)kG;u{Nc&I|I}Z zvy3gX{xkSmwIF@|uOhJKow0jo$3XANd#Ao>#9@2qBm_iV7Q&y8+io>tm5B^)n^@%5 zYJq(}cUC`W&7^EWQ)>GjQR2k<>UF@ev`^UFlA4G_#pqxpHXupv`cj4FqL%XouFLFi zHkI#$q#I<9WKqv4R{!Fa4TGdgc?95CFqeaq^*`XTKiN>-dL z)7X}@QlhyB=S5=Tn~H6(@qty*to?ROeEr!@Ps5x;D1l3UW2crUOH;<3dbQV1GEl^8 z3>a1_od=ey3ASk$!H5;hhP+`L9C;1)xsgorHlHlM^ToIT@*B+8+5$QwI*|VUPUbt) zt76E5wlmih=YnRSpQzD7aV8H+vhZWK9Rd5bwNOV$K*l_JYQ&A5=0e}9BZ}_M z3?ApmTFJkvXyl$HZaejSkDSH!rT3q0o2l=FKhf?o>@bI7y0*IqxJ^XTYt6JWYIh84 z%+FT6eDBJNE^PFj0k4ya%8zQb2y2DM`Xz|#%}P>-rIkFHPtRzV<8;MGw;pCy zy0Yc8_X)b<7h4aN9O1KPn2OfJ3P(67x1G@4dT8ee2hXGn~EQh8H7pgd2Y} zZ*e~$Z~2-f!?**IZGY()+XvVTVJl@|>5D3G$OUGY-6Eq~e)6m*-Z?*Ni#V__NmFd} zU$?W*47B-=^}p^C&%CxhU1Wg`GjiB2RNKlM2uUu`>w8;}KR$A(k-I$Wn;(Mdh!ja~ z$eQSi#6PW8CaR;hU?~uqwCuT^+|(`%B*#op`jh*kMMWeF52W0TA}M(~Rr^6fw!3}7 z5N|<|Z9*BlBJ8IZB1Z?p7{n@ZLDkm(Gqv->66t|ZRnO7KyIJFlK4E=9f+$kl$b7fd z%p3IpW)eIxyvgddKz-?mZHi8>4*@LfB=33^F|qtY3U{kEeEWx>ETt36!?SmPGEY{4 z;Fi>CT7cqmNtE1RZ6|gc`7zIh=~F*Q?E-uKn0~t#5N!Z!^ggZn8vtSOAK^JX>W=Wa z-I9#JJKnH7ce1n0uO~fC4qN~>6nA7iH9AK88(bn)mo+R2I^X74GAtp7@v29{yX*g= zuG=tU9UXiE+~p*`b(VUs8-QD1B zNwTuk*QWL9vs?!i@*H5kEM~2Q1Uz?Ng1F1*9H4y9QYZp>ea>VSE-reoom8jdYm)-V zy`a7U2sN^d?9}*Z2NP7I3#u?l-!&|;tQHW+QKGGZtvaw8C7ZaPg@Gp}7+985_a$Qc zY!_tBJ3pBR>q((9?Wdq*nzj_36Fu{x<97ntPW zS_f$7ps#1RUi-$f+1cFS)ZZ4?sWpb^IP#LiJ3}Cd?Vw9oenAKL;tu?=(9utH2cQDR zGw$ME`qAr@fScjizs64RgMLIf3X%%VxYXjH6zDGRI=h?A(A%lN;q*?munQ6W?jDju zsr~&~S?Ij5HD}wzhZDe1FYZ_Ca+IEFNUeP)oA>^D8i2&$=QL%JnstY=T#usn!w!KH zwM%)cuH0URoiD-)*w|?y9{8@R%RGF;TkWdtdU*1oVdf(3(~i{XX(H(5tC>@sFneg5^mH$+Ai4~+pkFlG9;0>MPP4+kX^Fj4YYV1sTUN?7zD9*>YFLR9> zq^i&MM~4@v<>5+8VIS$OG+*``xyNl8FxYuo6~I;na|bZh5paTUAShOcb6S)=_}z8V z+$Ekig7hXh#s5#gr>Q-PHXXmi#p66$QQ$dg(>Qc=Efj-HRCg{?Zi29(ULJw(`uU0Q z7Fy`*1MJmI14A@3tB(<-Z@gdK7BrCFayhk)jEb4=JmYI@3Nz2V`*6GZUYDw}c6z6| z50!U-L1U?he+S&bT%{g+w2c0z=eYXEyT^UM^g~7AhX2o;uzf#7!D3Ag1+!ulBSZ(N3TrE_eEK zC1K9o6QCtG5<)gBD>G@1aFs_l&-U*8O53T(q1Q>1RaTK;MHji<{C8?tD7$ulq*i%^ zt1&p_XI|xMawT?fLPl`Xbas;Hg$|rT+VMse`(3nURW=l6YGVBU)#>4d4kS3ZfQ>wq zza~pR0P@+umO+Gdx>B4UBoJ|!?bz5gX&V{nWvbgSWlhlb$ zn^ikN_9I^(jmS1ZEbi%rO`UAq?5=7e85|z((XK!raGyn{hVUST+%wYG7bwdZsdG7p zk&PDhE1?DOO0RC1GE*@fnZX!H zW;H7?=$ji95&|Og@5T%xnbYYy_(EJ_e!A#rZlff|EeE9w=7zO124n@Ed?{l@sqPgn zaSrzCNU=G{Lp{z0_OxI_KEl$&_P4I9EvBvBed0fRq#)i@4xp&!QS+(WmgOk@pXNHZsuO@~fdO*M8sE^Y&+xNbnq)^1f9k5aus1QkA!%ro_{gQG9UrVPe zkF2!iIoxWNNK3PdFq8p(49>qkZFejeH>QSisQ5ecBhPX_XW30)n>`ph-eYA=5W ztxQJ*vbVM-e>PhwD58N9S!)QbJiU5_38ms5#Mq@`r;5*q+`Y#kCnuF`E2jN9$W7ZH zYdbi+*6L9U!WVwaDWCkgL8VV@=_f+bZl!2}!h3<44Jp3&+F@n)me51`^v={BvgPEMx%URabfD!h*bal zy(X241vE>lag4g$AGz7d8jXZxs|r>#;nfv5A74Uzq7!HqCeEd$k-^MAZ?4)<1CWdL`nVeViDoqFy|M1cKJ|LcNxz8fW$-tfRYL7)KH-i5aq#T7 z@5GX1W*fl_(rKLfR#yEL`&-aO`CTU5&^}3buu)RiEj`UDdxd*B0gxbI3{*9$X70lgo9!D>=UF!sKpV&6AK+Wy6#pk7KH3rI3WW(2!tQePrWC zBnv^wGbWlgjBGP=!%?C`a&DSs+BS@3`=iQ*&PGm<-lfI_m)=inb&0L$O-Xe6Ys4Wl zEj%x4={gEp(I(-peRf-=)CK7~oW498Nwa|9OJr7ixoir0uc!K9M{#mNe=VcjKs}}% z-se(;v>>U!E>{BSm zpO=NhEnVyS?BV_BiHr3s?O1XK%yqzS3)3wv4FvG2el+*%2c}}KB*mA`G?anT&)1&l zwz`$Q>|9Nht&d(|pOLQDtM=5^-X{F4Zr#l6sm#kGR|l)~f1VHzw}3s^g4)FOMTWEv|C;qU)VwoUE9})Zjfz`4=B|)%)s4ip+AG1YH3Ka%C{>4gT$VNx#Shg3c(hKJ{CSsHZ~WzUV%m(tpNwgA>_9igOKh5 z@XX9|^0uslX6MN14MP4^{pCB;VIc>QNfobsjOWL&t>o4(x|tmI-FrdtiEwf$R4J9W z!2um$&C)?=|62O%NTMp(y+!EKo5a3w5Mo9;QhD49Wd;DB2ZnsEdnYFSUsU-vTe98Z zyKY%a71xkn!@VO{RuWE34<_1Rc-2A?{A^TQfp5jW>LJ3sF|m2XDKc0mfL99oGIy*? zWzto9%GH|=TDgf zteL;dyF9o<57O8xpk0`q^Daev4@G3diB^BuaUy@~;7m<$)_dDL{z9o&_1&(o`oCBR z!se}5(ih^04t%BSA7z&43T2%5v2}&xN4<&CF2uuB`x4Nq7vMcK<6+8-8NQ(<@{eWD zTV<6d>mS-aGH6w+D>uNq1u2$Bs_kG2&yv^E?$;1@xL9NxxCbq*~M*vq3TdVJ&Sc+Pj z%Mz0~YaT0&ZK3_bsK~~0$e=Jr)Z4a9dm9<6}1n%fZCi&VVtluVzQ*mC8%1Zoh>?#COEO94Wn* z1y)SUI;i*SyxpmYzX7mGnDgWqlHvck;2mxT6^MupQqD*S(q|P=nWrPHFhA1(wF|KX zUUaouN^#YfVrcLMckLywaYijbul?(w)DsZ^t-J->^2w|x0C>dAD1V~CH393n@~%W| zUv+U#vI}x-Pp@vbvVTabY2SPK8>v|_7B`!?dcX=M2(jH__$yg|Cb6yIlJUrtCb(n) zEp9n!1vBoBH#cKrYewlh=Hn_Sv^2s74Uu>SgGY9x7?|}>Yp<|h=IUV6EWJ+{&)bFV z1|4=19W?=~2x{=y&G9>bw@c)^qmLm-{HR|RNdEcY$V`#eGD7I8C7AFrvUM5>f8r22 zi$$U91g5Mn37cw1m>N2n!@FR(hz@QgAME8fnEVa9gY}GHL-6w+c}-^#x=M>P4Q_LM zS1Yh$`e%P%EOu)A@g|6zl6zz-8zeZWdpWF*Q6ay^7&)@N0yp zIjnZo8-F>gHNQcMK;)j`vB@L5Twd4;2is1|Nx`&`bTCNn`JjWpXFSc{{1ZdVgUBs& z^U-6hFq3xf$5nie&LzbKR25g0xeh7Xch%0{9@;`S$a}li;S&Qb52Rt6@K9mq+v+vH zJ2cZcgYhoe;Zm78dD1rnL|>YCxb+W#IQOhu@dbbGCXDO~gHA76b~c{34NVylXSA$0 z;l0H_e-4ey>Vfuq9lA5n?YrJ6^tlR6uTE6C5WbvBBYI7x6HlWO)zUxw`yA?8F=7LP zrG=Q_&jv5^CoR)V?ur!NQR~5Sg2pF3h`8lC#*#c8T|hzsJEQf*3w-|xscj~kW>}<} z5Ua$oWHf4=CL_oXr1~0`^RF}VY0+jQOS19mr_X0_9+oiMR=``H2pEOaNK_qnGi;Ru zBxLvxqNp-FY_aro94=5l+Vd*+ksX)-UqO?1Z$1+n*hYF*g z`a0)I!tA8s8}b;9TDKCOmlO~FYFy**DIMpxpiwm2T|4t4T#Tlazt9e@cg*Jbiy}}F z(T~;k6@W?I3TM6Q#8N}QE*p;BJxuKRaGx$)O_1Ct3|fG7t0|^M=Qsj4^|2R9l-K|) z0i5puk*1i7I|e<6+NVG7Tp_e70@E{n=jT^N;p&Bf8|zGuD$g4-<@-z1V&DpcJ>_U? zG^9Z4zMUoIQx1WJD9K5O*>PdEaeabyDA#_b-F94c^9qsO(v@{+73FyI_7HBWtd5O1 z8hwn2c-QoM()&^7A?%{0=<^cLg3YYo%FLXVpET>xy+~$cRemfGl=t$er(I{VJ&D_~ zfr60S2s2>tBZJkCJ(Z+uU~XIhc=AQeA{>2j&nGRdK6Z^@cXYP{YFuZyt`#!|GAwHn zkh-1C$xfR~G!4v0E}PwAsa&8d>h7-7kLrg!+=JcfwK`s*9MFe|*ERWX+bFerCJ4b# z=3hg`1lt}gFMt|atKVa<^H>*PbZ2O-Z|&atxLuCEgpnXIk~W|-sK@f9SB&X}dfzOl z_w7#m{i9qJ5GCX1#_2ih9x`N~dm+)}q5$7EX#ddn1rRTzmz5o|f?nOE0a2 zTs(<7Z~Oh&pS4x~tsYXQJFp3QDTS!&bON>ROIYll^rG|*{1;dmB_LEzB?Nw7B2@kR z`iE{^RG@l_6HoYogRDtjK`tHp?fg#dBPGO^P=dOQcu>`Rr(gR&zhpRQKNB}K9Xewc z<{J4dXFa5&Djoc&S@{zYHy{0#Vq44(%aj$gWb7PcKv_QzYm2I4~bf@=6l%ONJZI+QSy z3Dy9*V_wK~QedH>Gq~-1vZl*OvLS)#37Xx!$(Z-rk|rK?H}KMUTVHwi$ct*-yoQdc~9GSj6`F9_@|I!bRP}s(uS_>;AP{xYONp2^s=Gc0%(S;p< zvwOcp4PC^j&VT3|7ZMY;Pd9fhtSj9$ax;6fKW`s8HoxOv!@b{O^R5l?2kS?xBnLBa zvv^Hd_~-e6p`?N`7I)CpS?S|+3MZ$upiwz*|Ee!Jf8+N1c>S`sR~6=*7dGd?LjvOO-A@7zV`+4IzHZxzhw7!@p*zbXw^_b zS=B>&_PqV4w$zd&rAwU8cr#-uosH7(n6${RofE4gs-w+Yz9?zVdMHtWf6`U1e;{`^ z3@ES6rv$wObK@woS`c5Eb1PZ049*3@wJi^x-AFz^*Rdmg0)yuoI)U3kBMiT6vcXK) zC>J5RM-jJd&D-JkXEqSbXW`*TmpZm_CvV?g$*1t4PcMo7^9vQEo1_~?*u`1=G+}ec z2k7GNM3PG~X>_bduww_>v*yCPC#Y}Zny-BMj?6x0v47Z-%ux^nXdMdT&~{ibT`&PdHrGu1f@}4Z6h(UeU18h z&Z8ytYk7IDL15BN^HE7wVDN8`1#_aiLav%noa&+FSSUy(YzbYGg~*)2EEbaqymrt! zmMAAv36Jfw%)$Q$8Kj#(SqoB*tSurImxzB3?@2Wb?h|I~@qZiXD=}H_PRV^4v~3&o zF(OUkbPCK=elAv&h6D%R?JeU7KMj#0??Gjx1p?gUgPp(R@m4f;o4JZ$8O>{>tpq{h zzX=upq)f|2Kf#1p>Ai{wS@dIXmQ2`Q2JOy|iYvV@Bwcj9(<6*my<>OfUVoHKY(S?Q zPn#ZIQQ?6dmXvy5PVM$iK+rvhqU&2#JpPKSrX`FSWN+UR_}p4m+=cjy-+kh`wu{ec z(GvdN;xV6iFUmGooLs}~sOs9v{o&8*b<#DzyQ1mf6ztVDO-1(M^SRY+E8Wg4ZNAh` z-_Z;{8b}*=d;4CGsnC0L5Zecl66wi%itDl}LbCgU|kIu-^D_(fa57k zJipYX2Uey2lyY3-=H2gps9HK%Jd_PrmGOCSZ=f?_cngFWkoq-Vcw(M2pF|6%l_{#=PTUwk07(8R^jV=(vL6%<=@%})b1id zz1itNq#F2jrhUY4NS5%Lb{RCh7CaI8&AiWY!sZlbW%Q-74NB7O#s$Jx_LLB6FAEQP zKL$#)3cR|`mrV22mPCN$72<0bKhQP>pP{YD4o#BJ*U;spv~TgUUN>v#5KzVcmcgn) zXp^uZgg`0YFV)Z`TafO;s&%|5{=_FnK(!S~N>yPe6*AQ4$FNG}az2vzuQu)P7cA{3 zS>;|iGKuWZ9L?fv1p`OoeL3jvpKtNUuN;xviuk>z6Gt7bZGotzev(lbu@LZG{a8RS8g3k zmMxrm5a30Sy*an2Zz84ABIAH{&sW0nXxxDDJ&kls7;6Qj4!XC9B)!bx_$3mzZJG!1 z9uCCV;#e$dtrdQ!BcARMS9g+?CH2nCAO3?$dQHt1W7MX==XYQOdU=IikZk+OwcALk zk9^O6%SQJ~4FTmKf>|Np-}IISPq7@?)A~kFRC`#Hx&FOFZMmo#=!n+M;nyL9q}X@h8()|hCBiQ+0TajipUHvthX)b=#=CIU zhMHf)%B}yK%X-d~rXuP99p|Q*|F!a;wN2muV#6qddLOl3!4ic(eto{Ncy8{WR)Y2j zU>Zr}5aIvdc3gh&b&H{WLBty*05oCbA+YVQqhaa&=*x-3J=y&n>HN{<57nt4;~DWI z?PZLPxHwQ|5srma-F4YJ1q)`vAN1ovnD1sb#TEGXAv!nedVHDzgimL zT##2ho4t_pDp*VTbQAaIhv;CP%)zH*Z3zKegQ4>bH2{c{p&;YIt~57b6dgQQ_G6vy z_EfNvMZF~qpiC15WRhnm$&A$!Q#^7e^uFQ1Se$gpMHW#ih4v(#KBv6+DIKXp#JF3^ z!v5ChMen`m`~H7KiNh`Bh;nz=6mL0uSt??bf7ySh6L`pH`CsnALp}iS^q+t%k;mPa z>WpmobS{TijZ2~T>e{mpE2ZvC0jmFt8}}TrXZ3$~C%FGSOQb4;pXB8~Yhh2xpxl*$bGLXKLfZtpK+902_Q?66koV9oU6vN-{TBI%6??5=8e!xP_^OaM==0EVFp=xaz2K z`-h4^1LHHKH`LCfN4pcBr0Avf2tOUygG~Pz0q;OozJw|yb8$H z^uw?(;vA=C+0}L|*nVL<=I9kN?GX}>^B0~-Yx`IMUeV^IBP#G#`g2=#&a?ft;rf|s z`2Va;Zv)M>d4pNA%G>cv%!krnI;dNqt^{o4_0EApoYdcneB`)O*?%-uoA1mqZhW=LqZ=l2@iN@LTatX(Ua?o z9Y$BIC7I*R+?L(*x+!A4aoNI6V3>1AG%B6766ve~V1_o?kVplzQ(q`e^!Z}(I+42iHz}@dZM-ZlFJ1e;P%+kl3WJ<-f>d+Y4+rjbki5DI4)+m6H2c8 ze>5NpAKbxWej6*nP8RD2i`jbOUi77)NOHQ{`f}>yj{u6DcLvC(>vjnL_2#5RD&tE5 zk?{r=j`2<}Zz@i}sO0th6z7^U#+|qq2I8%7uA33Znanjb??!xO97?`s#7he zlx~4Wzxi&TE_RbE`pUQXPJWL)554wjX>Zp8x_o^$^xymbj3Wke%XCEzWOedy2D5b>Te zAKn+10&>Cn;_*ZFTHl|!!|{8sA20CxLk79OqW}9r5qxj97G4&p&~#+=sr=@>0pUWNx{T}I`yX(rzMB?i+A?Lgr*cF+Q$Ht;sb2&5FvuD zRy$4D`g8)CjupMGD?E9|VPAT71+e1h+KCc(U$KgkIn#Bj`+}`>Ve0ClhBt|>CO#pW z757W$44P&g456e!{|H%Sz%Elzl@ZOf>y@rv61Bg@Yb*2?xcxnDg+H2U*PQw57gDBW ze-)V5dF0k*fys)D7C!&;qZ^dcfWIM~3ngOd$RYLzz9o|;3M)vb2o5dnn=SWNJ98%Z zUah(df4usVBBxS&BjEkL`EA!)A+_s3{+pIP30d`*8m>43RIl{7iAT8h(TvTly8UhF z_q8C6?pxaGo8aLKkS%E|S}nmLMQVuOeNU=%svQVs&0?Ydr^7isOl3|i)6_I>^d8nT z|2o4Ed(U*}JU472==EdX` zD-#DTr$~s1FyV;9Ua@JfYnzN0JI~K)Z@a_z#NkTOF!tBNbcJrA+QhH6S6TP9V~a!Z z_uo~g)!Dt^ehyu_(6?mW6q+uINEX-Ti}fwPXiymSvSUwb7W>NCn_Vzyb@bc|K`PPTogexwO!XDEckt)5>w(jYdPI)2ZVmonegeM1U4`T}r@L^p zY+e>w)DpY6S3*=-?7dM-_W~x{-P^}Z`im}MPhZE2$vO0ZmR@&+WUs{uV+JE7NFN1}_YEC~g!UYk*Sa+yaW_wSwp+ezWpnqT%Lh*NF!p_T5*+OK8v!jHbZL)ip&ye&Ryv?S{Pq^xU~Dd%u)6xnkl<9Z6ZCC%jp zmv_~ih!SCo&FyEI<1idu`l6VBMEN^kx?S0R?j2E}b&6#wS-{I%IrPOnO_SoQ7K3|k z2KOs_;I7@Zs!zj@6bEY`5`Gz4pFR^`L8LF-_7ECk?yJyepN`*-3*)V*qX8Z(JLgtv=4M1d;s{*lhEXu3(+K#8MaO8*OQQhfKP~3 z`WHbVrH5bN4(-UssL8y)c;R+v7ZyR`*$lrL;aX%-+761$wy4SP(&TorwN!X4#L8|J zAi^-6B~O6LO=1B*(@~~PXog*&_*fm&$A(-8cMA}0K0pjXV*Zl7%#O{KuS4$?{rLO# zeY1^UpL>AEY51HFFO@?>D+Nq>8KyJHLD&b?{jp(Eadr~DPC^m`j?YZJ8)3@#)T+qZ z1ZlqKKY{Z-0^Lh~jx4_mZmG_PCMtW?e|m#e?SdvsN7eV+x;a}v+9`n2Q7SM$JasX$ zkP9m9IGKf+yisUAZ{u-7ydFZTSXzL}$QY@3gUar-p5N3ly_ve@dVI-ZXm{{6@895F zs5V@s-}kJ0;aLsZVU$$RF{kA_IzFy%5>ommPZp=U(MMkE$^uQEL&ws_k8#H4h$QHa zE~+@}W;m^xc&`lqQz|xZqj^P5K2rvGOWWiaps9Um-uW1yKRIwd259StlVgB7`ltUd z7@(PYDMueQo+d;)mKc}=01+OyTQrCE5o6sLbe)turY3^*lF0EZGv{%<|C?YoND!$5 zWYID^0GbYq5S$``(g9NAJ1mYS!fh+jItSN50&z_>NaJMr*(~0g#ANw(dx@cnnx%>7 z$E0`e7s0j>pnWQzd47y~u(7QwMCgs)o6oQeTK5y9MFboXAfmasT;D2c*3&aJ`R%e*>(q{HYbHklv!VRV$Abwf!%won+lQpSB3EXbnexxPlw6aNNQ;t=SG zKLMs|A#p2M3CjQe6|foz;Y1@?iKhiU@e*M5t0A0N4OT)D^~76%)q6uY@fzTU^&y-j zSzYxFxw`tp5Kg=SSiL)hlm7;o*@CPSEcH7fOsaw1eJ7WTI=K;WViVxRa<|?{h@t)= zgku1a`VAqRdRjrjc23WnV)=C@@EcFGuz86C{StM8qGOa67 z>(Ub^0jnFnu`qE=u+)FpX?j99dAVRET8g?7PrLNQFyICWdYN7-aiyM+vh?rmCx){x z9Lf%jlY3(T$}jd4BV3BCKiG74+QxElXoS?}=$XE7j?dZY3|@%R3gv?ykf8U_z?D4S z+E?s&Ya+r)I&YWr_^5~W*!b2Z5V;>9@{)+~I)Lb>HQc^B?1c!sn{q)@SOn$JK4OIY z8RtiAnhrnC*Xs}1ILT%F{CH>|F_HsUGM&U%4-g|-43V&ia2XUG3l;MixlaIiG&iz@ zl{rP#LsHY6lG=yEc6Xh0*KzRpBU=B0Z+K>>U@2S80a(!wtg95P1Y>+ zZUL)3`8sWjc8UaBzlyNhmZ$F?BL>jlH3+L4^7Nhb`$-biu0~jWR>0Z{WL+!5Mpc$9 zp*dft>#8Q8$+zw!hISpo2{%OOd0+nrwzpXI8w6bD0^GV7VYTNX{qMB=<0Pnk9bxrX zlBKOjyqw!4tLF+$rt1dLvSfr~F1xH3?6O|uWof3JXTwDcYrdk%bRAto^W2HBCfRxZ zVdv@Lc^sPR+E0w%0;eftV;@p^IVJ)QU%+=WA%ODNecUE*2O-{;7X;k$qJZfc*76Sl zxAX`pe8XGp`>Pv5+zx!Ay-Qk#eWT04e4y*m;it<**cb*)u7N`RCwrN`t9SH~?&o~H zZp+uZ*y1)uz5uK&yVZAPj>Y_gr1Abc&OJAa$!N!ZI<}t}_a3k@&NwFgcwg>*=9h`X zV$+7>SwOKCNx3CcnIw z7^yj%fNAa%K&jbBjKnW$x*ArYbuGN_0m^G#16tuxK2PH?$mw|b0pWMJO<~-LT|9q3 z=g%BH*~FN#R8AXWw()|Qig!F4@YsGn-l_!A>Fiz^JY^neYR%$yIHmj9-FxKG{lox5 zB6+rq6dofHZcpqrr|qTVKU77>>f9b;T*B;eJnY+L^jwy>t?|h{#Q2yH?~H7?rPB7n zVSaaXjBKBjXZLb>D<(kXV#-Unps973C?x{dAIbY!Ea!kz_ad|-PQ zTNCWH3P)@{Y9L#ap*B4S4vla9gmTy(zOg1&q;J`GK7Q&4d$>Gp z$LKZ3#w~4?W)Lq=myF(`DOY(FN9a_ zOOGM#LyeF7`Mt1*cz-?2`{mG*6Kh}~FO4Nk*Km~x8_zI0nx4iIuI20at^;fhMPJ;* zbO>xNYl6V=ZtACK@|Ba!>ykZoT;qQc&)D!;k`U$vj|3<&?E4fKb~ z-TF{Np|0jJ-osK$!D1NR010!`NXi4mI$7zBvka^4)2n3Na$ zgb;7%uR>itg}|`fHcTSJ{c?f~SH7DV{To1!ZUCLxyABaW+kvo}2N5lfaI&FLZ!6Sf z7;5QT)=y~|aQGaFwDy0qYs0ygK3Y#(PP(2$BSg7qH!<#y1J?QxPUJvD+t14xDB|UO zgO<||SRJC}+?gsz%ubi{^f{so?;^(i`vGfP5cUZWX?+{vfrdi8wpf!t+s%EG(HRoa z-bPq`8?bgM$86U=L|FY0ur`3OIsjPvl;KoH{S{t%;^@Lz)V+gBbfa%&3Ux4=52@=%A5LQ1S5!R;?P2RbW%E1DT9VOA<5aP`p zBB?Qco$^OJ0RNp3?=Nxs{Z{(EAMmzG?ej!4eXa^7h!BCLb-0+y$}WgZx9=W@`>8BE zy>Y1k3Z+5DbHtY5@9!qYOL<%-p9SFYJ&%~pH@Ar`GQYWpo^fFEdl`@E0;a2#zxOR@ zAL2GRO{xgW-}*D?>>kjmJi+b&)j~bEm#(Xl0K2;uHF;@2*Lh7A1GnD|)2N(K0}y?4 zg3gP_=XP`)g8BA7&M#1&jkl5eZv2g~IO7#gA89|nvOA;BNpt`c?Pq8mls6Wa*5O+L z;dLVS32^#9?^`^!J?%f`!5+x$|0|&TFH86T6x&ydQ~l5HpS&&Q&m)F+O3xt`AbRI6 zx{vX5Nn<>Y$2`3+ZM!#kUaV!&+(DfCts-+(pN%J!!5au!^n7}~OVmK0jE?BIPWQR> zvoirBK=`aAnq^ST{3ekLVNHN&O&IiLFrDE)((~)ARAhz)h_D#A0z~LM?CEEGN(HUo zaP&S%NNHou-xV?>T?Z*LE|WOSXBgKqk+@?beFTANBKfdWhXY^Sg>2 zyLmj(-U;<}XVmu%Do+T!KEbZ3V%UK5*`0WRo~c8WPH(Ei z!Ysu6JN&L6KfY`aF}^X%?CApoHon7e`Z+JG{-g%)*=^&004VisMNGE&B2J8k>ySm; z=BMrZeWAV#pvk|rQ1^qjo~HTjZerB`u!hC;TScE=<+^41?N__`y^yFNJV0gPJGfm3 zg6jU$tgRmNgMGw+m1v#%p$n_~>r(sRyj{d-+3#ZMU)jU#h*_DVdx@da_X0#$+2c|! z!dho6LkrnhuBBsnuK)bGn?~F8!y3j{F5XLwKigxu#9qh6;f~V%6ZRjjYXb8(yE#4& z9YX*u&epRVqTlB8$=h(BpeGll+puqvHVp1MpSN=8C+dc2%>RBbG2Re8jh`}Xo?9mm6y;G8i% z?@=}{EMIpYG4A`+g~!KGo+M8@O67^rJWs&5JoI}ihQiT0w!ivz)nVuTq-8#tF0+G{ zxqd>KPyUO%pQZb-mgfCpd>`P^P`W+Wa@#qd{m%DU9gY#g+xH~m{>5mX9v>!N2)p!N z`d^)=@1XxCI!(JXiJcyV;j^+W0?I z&YX?#<$L)3|1bNAp#Vf~-@|kx8z;T%$p*$>9%4MubQa^X^&(An@3n1VG51{>k_7#C zJNZ4d(_hCn(b12D_A%_oh$2F?A)dA$_}+wZZI#pGdU*HweID*3#wNO#%tjdX6T^3! zM7H#EekgXz(T5b9{~aer7`RT0wkO)hWg0#Q#U^d9GanyP{`MTH_)Ge(DMJs(WiUry za~Da|TnZ;n0<+Wh)nh#AOdEsEzIUTE=2tmwU1QVT&vp`HY24PcND!TyISxKiZ~bO^ z95zfc4ptwJbeduXa06_ z{ZNF~Gq9Usdq(bY#(mfscaQm_K1UB#WZuz7j4x7S?lB+T!_GmbW4fh}7`z>Nvc)7&yCVnJxzn#m$#?hW` z=I%_7{da8I1wfXX2f=GZSlirFq{sS*(fp#QSBS7SO63@vcKpjV`QLXFBPk;5kmNDh zyyX|^2sHWDK4QGsM|qMWvwk_BpR0EhBLrz)!(+z*?2YsBqiNoa6Qfy#HO+aHH!L{5 zjmj&188op`)H~HQO7o1Oy)W7TV3Pl%zOAr*|)F6S~m9lve;8T9p| zn(?vc0hG`Ch;dB{3u}_tt+Np(tBdr>{7C5hIctW>BX{p4MmcEmX(sD%{mrxI93Fw= zq5c2pd@}pP@xCjWn2wITI3xkH`8r4GL=pqT%~@UGf=JQQIy`Gv9ezMW_}`>U3r~p% z?~)+;)xMN14WElelHUEp^jy5U%f2s~&gUW?=WFu-)43L#PxPl^MonVl!S(#tJdf~* zB$%}BBq82MBnU3ze2|HXA;S35JcO6@(REtP$Ae8U z-Cl9vnLf_X&~LZ(alb9f105s8d*2a++X12_5=3B69rkz-#v)Xnq4Jl6aO>ArRkOKbKME@DB!O9@73tl!9Zgl77~kc0N;1b6nZbD21$~bGqLkqhJMw$g?d;x_$?r%6Lws_RH#dHaql;l$g!VfB?Z_ zU$zd15ndE0#!DjL4iTE}Dn;kG-*J&Sy^r4&P#HB-Pf(1qbvTL`o|B|~yNk+50IS#g zGUVBbdI3L^X9RQRTyE#w37QPyj?yv@G(m4`>8(KJcd(d0Y^+H4ua)$ZQxNv;RbO#< z)^l^9{rGw3z8E+qWtkf!*jSUo;*^~#90`xqga`&Nm!0coOiUfThAx3fuvbqJR zc;l-=Qvx(ugYdm-96g-K?kIJ5h>5Y6wQNv+7bix`SD{IDbKHcM%b>~U0;MGYO~7Jz z7B|iT@RUQiuvrwRwB$k4J%q6LOS3>}D@T@?RZ!IyKvs_ns>(F6=^Fq_gDa=1+67Jj zDS@J0hODvz8PQwVPvL3mKgHbE@wcR!ELOGo!TnvTknnQ3Q>uy%Q@NMAlEF?{8^ z!Jqa$de8D#Ish75Z9Hfv)?1AW^ksA4cyf&EY=$T3Bpsfi`GlmW{m%r(4^x_WfW^i4 z2L9UX?8C+8);Pb@`iTh9ar*xZT@lT*IG)b)TAX1eRJ6N6Z!QPD<1#qzALW<}|0Kk_ zOXP8~Q}jG2>1A`^xIZ7(I2e$W9`73bX`kz!yI$!4v9X@5J1IcFEq8J38iBBW7Seup zIzF-Xn$GlxP4c+#g^AUmlQOVK5#X=C$6^deK9Yd>3?!QQy|u$bujsXX9sm@YCsBm( zO+SEkr=CO^vL^ceAOL0WPGU^%_XjE6=#B5C<3EQ*v@jt-Py$$cSSm7?-<-wl=_xM} z%GTsWpM6eI-vM9nJFrSVEI`o$4o8q<|hnMfS2YR{8_0X=#b(!=VulREZfo<(IDP8|3D(m6gY6a7e6OfpBs6_P0EO~TVaK<)dOQ!WW`WYa zlNg7d2K}0qXk8g_zp{ELVm@M_-ERm`#NrM)K8Gzef{k+zCg*7-^OGIKD7)vH zYrpt{(;DUPDX(Dc;%8KNm{g4P5<|4drlt;b|FfD*$BK^ALvdo%PdNA2_HrISeSf}n zQauLUpR=f(DnNwU3W*5&cM;=0k@=Uc^*_($+QU1DLBI9vu=Ts+ZRz9@a=t!bNRmt+ zpj3>#(~fK)iRRH>w*I2$#gUnC_m*ehkqeZ+-$@Mk65kUA8^e~qzkWBTi-R_8KQ=~` z=^_mFH!NUxPyKD6@9iaq#|5`|grQ0<6U{LHPKXh+@7)jgao!*)c>*-gwL6I+&OsJi z`!$QLWdJMu%tkY`5C(tR*Rw)>C9#;lueZ<6*LD)4-3_;VOo%ruBK%$-KV#{5y=Cj2 za&onJ&fK@w({UPnqo#|F&Dd;Y6$$9^PXvVXM1=1Vq4KztXC9Su&8wMSS&O#_(~har zK)GQWM5bI7>RKj3(?tTp_X&@!UnLAx{pEUOy&+uMh_XOACgqq%sT@s+_qdd69+mRU zLeOL?4{89x7iJ*qpa6~CV?=4Czb`>nHB4QB#)#5JfBTWO45qG#jS^)w{XG|1E%f^+ zQ68ng7a*&Hejg#q&*<+fXn9$Up%J1SEI=p10Llyhj;tLpHSgdwbV3^@%Fkhb_EVutv(NE75%4Dhr0!wJ zYGLQ-BVyO+YS2%A%auAOneFUHJN&i?n#{0EK$HE17|m|j+2V$)1RM7!N&B`^lYjjl-_!OH;-&3K+U+Q>)2y0P ztNL13G`!+>!L-&D<*(58d`Ra>l2T(i+??ID2(-s%!aI+@Pd+$7$CBHEyO{mvOl|lC z9oMsxXkH7Nj2qnyEB>71GDlj*PN*VU7|VfRSp=E{30Qoy@7aAR&gf4ri=m;(H2o>M z_dQrz=ywUX_-8?3^ujTdx6B-RB1Vq~tMo z5aOK&njEM5%%$ksy;MfLJhr}*WLFM|P(k^F65!`NqnSU7diT%L=h$1lHg@A|PCEy8 zP@aSGW+j14n!$~WyM~*WbPb47xK;%SHu^zN65@@` zLJWH%#|6P00anC@i4ybicU=+$7YMMzN8ioi?`kCoE(chlog+$YK7V&ugy5r;_s2wu zEkc%90QZ6f${U5~1l>mkm|1vQ5(7w@UljvnAqj%95@fB&g&>`qWD{X~Mm zM;x~+aFk(5K;Rgq{d;C!9TkND5sY@+wBZQuP8M-l!-9 zj?i)Y60(vbBuLMJYRGETMu_q(A>NND?@x$#*?efKmp~Cj7-U#0SI*GO1ug#EyWHkY zy$mgc7~Dc-!cPQHD1VVjAEDo+>7#lAecZl-)6-=D9&}Q$s0{Yvg#5yKO&%n~OXt~{ z|L3S2G(WapCD~QC3U1FdSQjxTE_0NtG0}Yd)AGF82$pBAgV6TC}*+TYA;WhQ$I$Omdhl3 zM=$69Xy0iWer2xy^mbyz+z?f7T5JK7U9H~4>qwem-rAs^j~g@F3? z3F(IB>OPvz#nZJGTp-=jx%$tyQ(n)h^Ac9)+?~YeY*?VH<OI)@t79*?{WTc z)lOm@rgB-s0$t43;&1HqNAqXxlt{xFF`?hk1{%iW}ZkL6e zZ)fap&(F|*PQN|uvJ!6lTb{(f?V6#t&~K|;mgan$YJV#z)gK(;`eZsDg2x`Wo7@)r z9xT;=Ji={*`FPE^I`!?IQvLgre5TEUS~w&En0mdc3Tjk8PdAkqP&;RBkJugDhs>Nc*8K z&;?10LxH3(7-9CZSNSARm<_K03Zz7<6ma@!YDLZh) z4bcvf$HPlxgTnDgxIJJGAqJ(Do&chA)=T@^EogDjK>uQx_q8<(ls81cw*y3o2-Y_N zBGnS$?f}Cy!_^=(b!USDSrDmuml!eEbCs`2P=O@dHzS{87?nXj!zqZ_dZ^ZHP+|e@ z8$$VFI)3%{GTsAUH`m7J7nuJD{tg`@5#e=np`FUxv^_2W&p`l;Kr#Un7V|L&!1Le^ z-1hfHUJ_k^JcBlZmhEsB3KUr zMBqRT{BD~{Y z;|ted#~*EMf^AjNt~&h7&$&Gd(@)tpRsWnMUCZah5Pp9{UuL?G&a>6xcG7EynXOu| zJ`Z6*fXMPfgc}+_udm^_7*78D5eMgGavKOpc=VqR^SdDR35JOtrTI@yhjtYp@=rRx zPl$LIKn0KC=-dzS@@O8FkjU~s)Zm654~w^1zrmwBX+9e!US*5~hbX_zWEY`pw3gN{ z+VL->uCvQsU6|c1LUg(az5VeLW*;o>)?_Hq;>87;yl=a0vnN5+e24J|y^KE?bTj*0 z|87m5zvKM7lj?W44a?{wAzMFK({=h=wOwbI*LC5`5q4yklgvj;3@jTFntnY-nBMlu zBee^j_^@ul;0$O#EP+{8%VTlelLJcG6#kq;*QE%(St9h7NzerObMW{c2!Fb|rb_Y(c%M5+EUXzNK0H2E$C<++)lkUai;Ln%)$iLjQqdHUst z1${Ya>kmnQJ6XKZB9o5kYB$0)gO}=~?-1i9O8-UB1TLPR^>H@O|IA%;^tV`?cd<#8 zK$%bF?A5@YQ)wlEr@dp2{yIzRVmk5k_Zs*^NAGf;cg@wGb)L03`qPAXY58n?i+EeNJYT9m$71CQtbW?o>RL#(g{56>r(HQ$ z|3B$6Hde0|`TL_^(G5bpH0_q9bM@ak&%U|(^a?r zI-d59OZ4xsv^O{T#(h`$_bV^eZzIG@-+dgLsVmO&^QHPN&U4O8{ial!QvF8f`AakP z8=U8(v-Ino=Lcu%HL3KM=+&t-m*|U}=bLBg3!Ue|nJgwhd)8*@*Er9QU7}yJ@>ed^FLvIST%qSX@87vp z&n3hgrf2DwC=Za&VuAd<1U!rndA^M8d+d2@na=R?X<8SzO>@$u-shbEJ_ZmOedG;x zo?Q6}mGisVxt3Wz^ScFzh&Lds9KeD)WI6g~dR9V-{rgJv5W_78XmXXHbM=tMGM{)? zQ3RT7>!JgH=n8 zEzUvKGX;{Kkg`n58!yM4S4;pX;dgv%z=bS2-p*J$|M|VzgtF!%>lqDLS(Nv@*)A)5 zfwD#?D`OV2p1C=jl~FHf@#_DVGJME-W@8R3!!Ky@FaHn900=EC3qsQk0@FYA`qc%x z?;YP7hwfkwvdnFq_6E16=Mv^43rZIEIetj#I}OpKV@qjiND|D@98V#oCI1id3(wf` zKTk_8voi}S>V+`F*Gy)CBFyLViXdEB`LFIfItej;zKs~~Ze=l{BNy)=hG!*Or(VY6 zRmUWL&#;;hW92qt+_;rvkgKC4^4ShzP`*?cB}zh?VZO4J7)30e{0wv2d))rm4_e$K zF>EE~OH1kXB@vi@wTQ}4_8p-IwD=jO%huw-4u=U1yhPbqzOXcO|FfbRD|Y#z**` zjSEetbb%X`Ls<|Rma@!~lFLj;E^~vR#p&Fa(D}c^ujg$eMnyKl_mv?loCQIF;dB+5 z{AM-PP)yP(2pv?D2`TH|;u3Qk*+y(d2Gfe#;y|G?`pfC$r0|v6#8WTYge8?JjivO;szvm#ULlRa9B42+49sFA>(+6?v zw)%@os)R3beSgoYN7nVbVOpywuF+PM4^`)YRlQQ^I_rjM%Or2(JHteIS%hH6RKS#v z4hx`YZJ_tK;TA0q*c~aIgK7{PZ=3>3Y}F&{T18j`AnepcSmV>mhQOuC{j%?={x;Zo zFc0vl15>)rNRoc~kf?h>D?BTK1sAx>Xa!B42bwGjn*7BOvzcW0)imv=_HX+9J<#MM z8NUTPp9DXb6ZU&a2(x_eXQY!#o|KnE_})F4??99LGJgMpW8cU-GTzbl4M^F6Z5i)G zhOMv3n={)XXmV_b7>A_n0DULeZGUaZv70S6@4!rtR?*g@$pWP}$zxu&jTqNaS`H%X z32wh8dqI<*V*cNP?svg738XG6*LD)(rDeaBF^0}P5ZHG?-&OgT{vW$-S$0}ijwU~u z(cYw#9iZvfW%e~klmGXGv3A+z{*vy0w9U5zMzz8;+WvvJG#OU@blt+O+{RTCAey|L z+YOd))#QI}C5D@?i;Z+$ByLBTu8q)EO{RTL8pt{-EeZ@s{y_36WF4aaJCJpl{-^uy zGK76@h$0C#LhLGrGoJlq?Sk(C1eZbf3QD7Q0|Z;Zy#fiKxaS~?{w@>TE9f5Jp3i@G z(C?J*d=!SBalte|g8s%Lp{a9}DAmC6VFeL34uBT-KR;Wy-Xcaqgo@vc5rfBMEjABJ zGZ~)Tb(q_BH?kxfi>>Qb0V?>Mdd-^cn!Ir%0TApI`8`(7J3O91`A)8{ zjOHQyIy<`^Tc=6x(`qG$uipp-rPn3LY)>0We&10U;JIZ=6jRpj3>P zlW@MBh@*3!?n3yK?H6~O#C;CF`4%yZJcP@@d+cjtM0rv~)?R?h0m+-vt>(N%40V)L z3_(s+SVXurkJ5p#CT#OXA2Dpzbb8NQj3*0z$oNWRCC0KVDV>%@pvliMK^G>@kzlhM z^lJcE>>@{xoXJOK*jWd-&lSi2ro3ad3$BVWIRq^%d!FN%(ei>WxTOj-*$v>K^>q@G zdQbPl-8UipyH#ji3FTj9+V7HM4tDzmdCjTFit#(2yfW9N_fmPX!wpx_^O24RT_dac zy+*}`Jj85HX`VxpH}DAI_vN1uPInz5G{dF1LRtB++#Af)7wR6g1h!tCuh2r{&b~mkZRf z@L$xS{L4CC9~bZGj3iKAwb${77#FW(Cg5-(+ovN%yXx?f&BXZ2n>L1s#Ie~OKah*J z+i{6RP`*po@g~skF0a9l(sN9Njg&`Pesr!*_hSFxHTt?OHg<^sksohM<16gk&M-%q zKkojwIUY+)f@slOw%^K3gne&u>qF^3r=`Q9j=zojru#EeU3`2od!KgdZ%g!ObGV zk4g~q*!J6+1QD+bqWvz2-f!RE9Fj^*Cx+|8ThqSYE&z{EfN&BZdZ9bNYj)LP-_kn# z(g=yt{fF+G9^1y8K7YEEV-~3+gzbeahU~aHz2*m7nSWZvko}GBxkKAntQm%JeMl0_ zIgSqxXz@1)@y_AA9izF|*j~-kI2cVY+xc7>`Tm;_uPYD>q*3yJe9)v1W#TbDEW3?dH)pnX7sfLh4soW7^?UNE1( zUuKt?x!?FQuyvR&BtLCadB#5b+F1N((Hsi!^%I+lu=qT}u|mY~>*(B`a=sNJEH15M zz7cg>(K&YSCn75>URkNQYK9UYi!X+M_q!AAqPV@GN|W2iYS*=|f~R&(^{in$ml$Ms zELthTU)_@C-`lD*xpJF*zgh~oxv-;@*1>$p_jHtI>ea5X?X3>mdvrbJF(erDYaYFI zDd29pC*BNL0$5AOXnBEGZ_U!=_*ND}m+8|o^VUc(SfhEE9a^iX#oHdu?V6Z((Ahj8zO_M?1+!vaK34>7+LMw^O7z)4NmV4+_$>{y!=6l)au9UYeLwrBPayfcZIwvNd@d-7B&n zO3!wFrt-Kwty45P@8a~@&8GXA2pgIHW>HZ8(is=I zeG#p5gj7%-N3+*hX1)6^g7yI$hb>|A5Fgum&BF{cfyYXu^XufHWo*Cb{JloYM|kg4 zXg^1Ycko}7(VfrBc=ZBhyk(bhq5L5`zj=ZDe@o?meY{`aOu*d&L~fO!m(u)Mn+BT8 zFV_3rT3o#vJ#<>6@<~bMZYZg0ZUepF4aY-vyvk_+9s~uI|3SQ!25h zBsR??sJsIZtQfnvl3|pNa%_^yP0ZfE;zB+gwBg|GKKFVSSR!oMK0la}?*O~km*&2`6L+C+@c>~rEXW|J*+wF(d^ z56{y@58(3NdAe8!xI8gW7jFPuzO)Ye!*lhTAA>GFn%(8#B$RmomyP6fu~^F^b{Pp5 zFQXufm*LCeWjv3tKauq>%b;h4I!B8G>O4Wm=S(-V8H^$-?}opse;VWalXFg-BE%b} z^8=bJT+6XfnXh`nrwcA*)dN(pZ!TxtIgfpWaG!R+U6zyA`M%}@x(~xzxN@fcP|t+4 zDCfL6r1KY*U}I#!r?g7@ZUB zgQ_+WgT=UZt$MKx9y+luSBn=xk=ZP^t!Ms7ZxSOsLV^OoTCE0jzi*blp@;DeK`jqi zv0)Ni2jQw_;W=hgd4S#7z*M2NHBce4OU`|RM5RNJmAx58n_vBe|V<; zn;sV5lcjOwwr!M-D1EF%>%=U&*N9K~3iw*~c{nyPO_zC>UIs4aQ&kPFCJjLGt;{JZ z8$O^GqSXHuDw{%!@^57o=-NsN*p{oST& zvcI6Mv<&i_&?r$7%QSgTFM2rfR!1q7@5Og+!b0y&*ty?6B!THFK^C}BS3?fM9WG$? zcjQ1*0zjD~K*e1J2upuj9hX2_Gbp)OzWM@$2N}Oumb!ljKv*bAzfb!ua~cy|Je~oI z<0NLpaT4t~P68;Un~34}wWjH#K+@rL(4XAQ`G$~<39+%q@prNBq)*jhRT!+y+eD1+ zN%H@foxeW7?bRLpUZ-s%J+@tYfuz?U&|Cl6%I)G`2mPVVv`rKI|0dM`g>9?wSw@+k z5PmQ0q@nWqVJbIMxp)%3p2=EngqMMEY`z3ay+~zS(R8pJMTU(ij>B>+XLy2QDz@GW zF>Xf=;9E74#MEVtix~ zltd3PXnz_ev?-KGx9Q*}JC4ZJoW{>~6XR26C&c^nF|+I8ch3{`bWYt4O))>_i|x3+ zYOXHM58-9`aD2W9%As1&NfB7pwqLEv=n9x$ZME%J>jRO+Y;^o;6Ov?lW48Y+AS>0^ zi_iCEex`>QlhJ^~cTxEz>4FHuC5+iRRuLi|8^_}M9?DmG8XvR$)K7}Q=7Rf<7Mopk zPu|S2E>r=ctr>V^W^4iuWd^^+eS$sA);IR1gXulp{BAcf{>kP3X$jjNV_*_oP5?(A zD44t-Vu10GHde-gH|_X(66M{zfxq=|eCZ^QdCheG55H;03X(vH+BQzR-{3mD*eHqa z@6Mo)&p;3Ts4Ybww{JS%hW3Zu?9Q$*6Gw1-pNp8!%(vgO#iOBl&;Hv zG=v?y`ouMWg*=FylqB{DHUPx>{QUd{RZfm;c?7j zxH{sCZSt;|jX@+r^qI^)`2;;7%`*Kjw#l<8y|Y+GCF9~Wxy}E(y?XK*glEBwHNVdW z{cBr@0WM9xODbA(NSbAaS1i1Ch6sZT&w}3IMb}c=O-eJ&Lq+bcn>G{UP|@P9gR5q-615&tBn<8y;@J-IQy+??*VLEMthqa+S5A-WG6XO`;3E;S|B=qpt z1iH6tvUEekwTA$L%Uv+72Bay~AU57Zh~k{_4lkjK9FMxkGd`Y*M}%IwXSe@@$6)_T zH;-jA8XJ!dEf#Z~_q=Y-!%u3%NBMIbFS5Ry-C-~rz7(Bh@OF+3-==QvKi=$yX=MfZ zP0?q6YvY+(lbr)=Ap=v)kYMfEFE8OXM^*NDP>L`}5H0SuZCfb)d|S}{XV{+EOV`BX zbT4rHV9PbxUjK#3Duf59Olt2-eita?_k_1>pBiK(Tsc+hiLY5sEN!2NDubJt4l&B* z2|*tqWU$6JM?ZP1s|$PxpS~P0`4(7oozQW;evBCPf4B*Ei@-3B5>*H%**R?67g0X0 z+lk*h-K1@Bbc%FtT)xcMNG_AM&*rV7EYKG0F@2)m$Ca zT>a;pIBzoe5z@o8LD+!0TW_Af8$`5ti+J3Dqv%y*_)*3~MO3iGbRt5bs z5FH6eHsR2$T*59eoEtpqU5rYtwYUj*VwEF=yy19%pZA!|>?YWL|Jt4FeV+Gvp67i| zK;_+5j*z^_>J!-Ticqo0iR;^fUZU7*;sOV*t;03tVh64kUz(LGqcL6B_{|0x9hM+6 zy&CjtKifA1&Q)Dh9~PUP0>^hNiW`GERUpV3ZP}JLhZ};!RR=a;CrJC~Zy~(m@ha{GPH(eLC z;_m-854d*^qgUTK`j?Zl-Y-S=T18vY8^ z4V9~(`_Qb90j-Po&70Bhx6!HS0_)qYQ_-xIF0`VbZ}Eh|ed*9r{9``Ao$|1y-3IJ9zV5Lvi!Hqo+{E9o_#M|6UUyrb~BlW@YV108z6M3NnrV_ zF5XAurJ`4meS5DTeMV$z0b&}3k=JXpy=gc0IPY0-D|Ta#IG5`F_LuAey=E`VvE{Vw z61-3BW_=s~iY?n&@+iFR>y?AT84x49)Z(LcgEa*tt&PYlG+(y_k>i}jRzvPcm-BhE11h-5u^OSAV3VVWEwB3UM`!d zF$Lrtj@WrT7p3GjV>qPoJUKw&Gkm1TNy!zlQ{}Xy$sObR;JXE zFM&WI8SBAN^E&|oOHBpt<-&b_R4UI^nYQ{6d3tYQCxztF05^WQXgth?-qJv3Hne6b|VoG=gqZ)8FsLF-hy%Ls33X~jl-0Ly#z%o%KawmTU% z!MVLcQ=a8HOyeR%X)e>TGP=K&*}XqdMZrj^e2k`sd*dVyij5D9rIb^Ib z_Ut9&IuMZeERKCcV7)BppSS+!v7T`T8{1QGZn}bv^%y?ZB||l30BQ3Y85IwLnjkv*(AKE(ECwQ2^5yKmw|cwoFi{yQeErU`{cn542SziX39O5Z>v@RoY1Rz&OUWZ zx-gu|v73k-3wv!jwkcmz3U~LdXJW%;d2LTgLPQ8p9Z&ekFg05zGQ^zWkXs4vnbiXz z5K4z3c_M6jU=QdcF4UBYx$+XKH=O&YC1-Z?x(fotezlwXsB^r67qa>;|J>78COE!} z(c_OX_NW;$8uK@S+Pg@*(nXr``EI6nA!nCKDed|$V*5BaK_35L2GBUS(JmO$Ai|9$ zF3@k!fLj_xn7LXM7Ci8%yu^RvPw(G8ud%_eH8yymXu*Um>c6|-Wl>ttnk_7-1=kVK zd_4nb9gn<7qbSaNN`Szp50`fDy}NXr-v#<<9w!se&Rg(@z1ZlGiXve#ZvnYCb1yb# zO@Q$wfAi7Y#`PEd>3uB1vBJE@qOmi|yMq}r8aKl`j;se-)AJJS~o)L1G{gv?OgG6r6W_80ZBj0B;y|?8zv2_P~o}^dLbkrrt zp*0qxGj?N-H%sm#6A^e;UE`CI7&(Ti%zgw!2oTv_%l%mo%YWyN9NNkD_m}*gc7f2N z{9e6|B?DQ0?Fo#Hy&@cG?We98dH#|0obUTKY}W#L4`YMShXg>tX#=+Gzt6K=e(X$+ zSq+GwRkOK29W-dU?H({q%+~ZhJD8k$=vJWlNlPx!lu>bPSZyRcve}<*IeWLQTR!|> z!d%H=-qa7wf&T@}W4oOC?4;bkWmauwa=!cD9kj+s?035y`>x!j`_|iZhV0LFu=lhe zgzrDQvwvMmC-os>If{h~G-V6jKkkTimbe$w^-#9{G&{c@?Njr}#_yMy#+1ay#If<4 z9bATRLF`&5uBuCK-DKmsvmadB&Vwsy?+SAEbGvKW&)|Snd*2%8O?&B@ohk5VSMIcG z6y!&WF*XJQxDQG0-oDP+Yd`nUe!9yZ;Qegxr-qbOGkpZ_=b63OxQzGH>w=ie+0R8T zJruS38S1B>&wWonPwqN@KWFcyd#bmeT|2OmM*EiE+c)1{<{M7>_u)C#Co2!nA#Mk> z>~KNI&>!&nP^~B)sa{;y@ZZ+vUS~2|k(ytmPy5~h`U7|V-`lV6r+t_)*|g~KPfYBA z?Ny8}&+(a-zF`cx{{f?e!i)i?A0R4jclFZo?48&ns9EfNb&8p4KQ6hM)uwNMMBYr~ zO;{9auytt3J|-%U^`tsw57#L>ayom3!ZGTTQ&HzU(BTppUGpwB5_!yDWc<4{XM5~{ z>L1gbEn|XEuL)3Lwb|iGjvpoT`U|pVTrz@@%zy5D@3x*}^qBc|*!0+@S z&5mT9B#}Qu0>to+51q8Elc{=c1V|KD%_CvB*Lqb@V`D-a?Vo0LzQsdemnVUs;{ zhm4NW9Aw1@oc1HKW-Weg$xJi{xdcZ~UC!$*kLCQoP)33Tu|GS~uczt0BX*xx?X<_fy+l)Xnr!T?`AwC@yaEKC z-hqun6F~RRm6trs{ZF4dhXaW`**s3y_`W22N)3Mp!nUmiuDp@*mH&i08UJ3~ze&@D z9vk;rDY!5EFL0mcz`w$?4i$1 zYY%xMWL!F=f{1G*^GS93&^z}~YV4}YV;!wLI)uJCYrLsNj9=Wu#$*w*i>K@DBK28Y zM8@Rp9rj!f25_s_$tFnle8?%^Hc9rkyLZ_0LB{gK?bvXGw%EcewdR&K5CSil%-7%) zx1o!?PJGD#O?hb-vyprQ5GYN7>vM&a_c8XUYkj6ygbJDCN7}OF>Y$)0;axoUya)mE zOb|5X=L{j(Gr?!&4Et`-7w-jH=b2R7FE%sg#ZwLd7CHVLRP1(B*8{07U ze6>BLj|1$ny~{B#WNaVZj*SSni<3S)pIWEQQ72@&1pB{_UcKdnyC_{32H9}0-;qqO z)a||WYXAA@)o9bER~_g6Grju9x&G+Y&K3)XwZ@(G;|P74CBgps%O|0B0b&i#K5S3d zeT8-(JSk&$1@A*Xj~#g{4D|^YRFHiRl01g2kGKdivZin`pu{y`l08n=2-)ZD^FTk5 z2MA-ag~hl``M&_%p2_ASF-k_E6#n_ecDDD0OPst?h>&k6uT1G% zsL1YH!sL7IDrQ$mwwDTJPT$#mVEfMg9+>ZJi3ouko$Y^dM)L2e_acv+B}HT zd*O$Cjs`J*Wike2j{42V$=iC@*%oi7_F6Fio3dG6;umt65 zDLJ!2RK3ebV~W+QWiuf{ImKON`E^>w!m)%d6_a%!vYbO+LLXP&V1f&Vs4EAWWSpP* z71Sqy*&{?USNuO2N6#v#?@tat)35J^7^z$&)Wk1k(*v!OHniBc}t6F`;#~_hwH1yRRiS6k9!vY6dwR}p_!z+RTrAo)mi3gj6Kqw^o-NiP5vL9Y^orZsmBMH zoxRtk1Iaj5L-$qyt&RDBPej#X8Y1UhA7s7<@xQcH0vyT2nDVUzKujGt5zWd@LyaOF z5zpeltbu9hbL!*8^+*FWUf_B6&c$cbmfu^U8vJ~>B{`=oUXVTJzT!Ee|?`Y z%a8K4Je{onkO0x+Ta()iIokXKZ!?syDOAt#!-*&)LhO*_jxgK1rd)>Exh;{>PWwE& zonKk)aQW*&hFk7G$QW?H8}fYGHfqbOcqgT;*7;0Fpo)dM0NP?9p3_an64Y#6y zs8Ayhh5(@_-Yf_ZI;UkpAnYQtd^*LWLvlqjst65Bi&%BmDl^3znS7rm)_AiaP}wci z1kd4s>|%TK^$Q@-+zlubz`a@xQJFKWhRoHfU>=qr@>h&KtF{9g30m7L7<*Q~AftU4 zdt6!F+rlr%X!Q$#x-j<4AJn}qJX}VrhXbt$q{uz-_~3y>IBXjuc#CHw&p%j zCvetiqE7bS8d=l{eOq(0sDDF#RZ*w039`?0fvaq_ESUAZ*CQ!i3_0lE<7p5GAC=MS zPC$(SN9ww9VD(X;eT7aL6@z$Wx(fo;7{}_!-dQJ8TIB+I` zNMc#bacpSc;&L)q%{gg0p)>80tE}Y>o7UVz#@3b>} zZ4~PLNaHokWoKSjp1WKFhzjFqj9)n{O3iD&t52+W|IelLKP$Qa3C5FpbHAS7zfdT9k?Y6f=Wz6;7>g(Q zJ*|V!{F4i}Vk2=D)112BQl4UuH;dmFB9aO;9!kiOktlNa zqeI}a4Kp(IlK%-Q34z6H9NC&&Ur&l9>wmqDT&xsc+|6>ahTXcb+>g?xR3Z4F3JvBk z3pmVMoG@R{(1X9UVZNIJ^YiHWVD3ofo#SLP)n}qapmu<^@AH8ey2y{vIUMbh#Ik8F zc0Qbf+1l}*!_kB^G(zx=pT*?~$rG6xqj|w-&74Bel-o1N+8P?Up3YI>%zFR=wa1Ic z<Zj?*BsS7Z4L98Ux#w0pKQbdlQkBi0s~0Me7);mrq1ac{@p_2Zv10^N5Dd z;Q*Djp7T-KPw*;Q0rgbIx_lzi&f*w(E}z9Te`jS*R!!mz4s=@jknd@`=`;=yywuaU z+=Agfjbnf3>r&u;>#s6B>aj##p}%Mbo90T2Y$W z;ex;;=`h5&;el~=H#{(|!9RMzGI7{~0v-dq{f61&iY3oXp8$bYLLa1IktR`C&@md& zAf&k@YE)Ix=gFY40W{x!R%BmweC z^7s-7#(!T-QIC`#k$HTAv~VIC0f6Qay5POhwBp#U+{eNl0uoi`3oG0yAaRD!>)SC6 zpyse;W4%>q8CfXzbaEe$kN^P)_)xn5N2~u7Qc8BQ7=1z~C-A-c%xwZ%a=U)-T z5jp7Oacb8tKOqTaT>>0EKz)<*X#Pap%9dEsh)*4j&QiHXqFuRazTThDWjS4=!{6$NtTq$odyb?%yD*e~+c1B~PX$^>6oo z>R(+*`EIk_zZ_@(=J5X2g_NiJ>ED|3_3yEXtbg-D%Hb`nf5H?2i8r&kl&bvp8dy}- zXAKNkScQHkKy(1e=0LBeR0>%&Bj3B>;Z}e^rb|YdK^bNKh{y|>NpaE{Ae%TRtHuWq zm^zi^!Rw6`StRzxiqwAAf2@db2haPcvR}A^^GTK4)fZ;7-$m>f7EWcqi`cL5_&}PA zK$s(#;s?BqPh@n(7VLp_GTQbp7T+HG7xt9g=R+l4MmsFKo--eTrTZ)2j13uAj*V<_ z@}^9^^&Oixjfy$qaz<%N?P=<~cGQf7ww3+lqlp^>d-I zLJO;?&fI&652*tnT79)_HUpG}w)VJKl@^S4Ig(C?G0z`Ibrnz32-KU_C#;?x|@w^7J z(g8IU$*2+vsGnJ=NJhaT<}c@j*_6xtIzj_wG|S-&aE!?L1?+ort_l?}U4R`QMD@#? z{)2vbQ~l+WP^$w@Xp11aa{UPVe-ttW z{Y&fq%@z7**8lPfnm3*7vG@9u0Y_5ZS@e@AHfn$1Lh7~b`Xh3Ett(0HBQ#cJaU?WH za-VzFK3pgFeb0H%de8Frnalir;67jP`N{d)CzoQ5j8qrIW^Tg9uQ&1fv$WQfI}(Xu zqry4I;|A&_d3C*Wym?Ds-?=wl>T6q&XuWx@ttnemLNO*wUT_u%g4r^fmCJmt4sB$< zw03Tel(EgB`cvwc+a2S6xw$eT?bYT29b2y>=1YhRj9m+T3ec5 zYx^Llu_2bz*wDnE-^ZWdxnqJ^FFw{VXWs-fCjPnMkFQNI$@BRDxrGwso)RH91e$W^ zw=~~$c}$$Uxn6u^^D7cmOrY1bn=M`bFTbVs&~kOp1XC8|G35SRGzUp$UU3%7cTDcR zMr8S{ENUzG1weVdSi9LHLV0|ujQpFh5qxce84@zbsKU50_34jpz7W7Y0+?MYEXtc} z0cv9D^5$5s)=)3Xo4?~UimZdHEgTNmI7IrvVGYLt&N4qqLC}=TzQu+tLPfp!=;pnm ze7q_B(aqWbnm;2_FV5WzIiUs_GRFYS*$nW|X7!+C&gziNerqLuJi&~gokZb3>40Ct z;r*GzZ#shmf2BD|Z(wWS1Lm_RfQ&@1AAws&ySJp&gLBKMe3KoM{O>K;hzo3O+_eQ8 zF3{ShJM#6Cccw(Kach*zq5p-g#qE}n^pXX`9r<7jJ^NEV&i~tjjo*kewfo*x>PHr= z5+1LAGKP(D(eJAx-xt=D4K^&(0qd$1SiLrR4(sC>HZJ@gSR%+s;^TM?kuTjc`k!d> z{n+MIoWw{eh>>RKo2QQ86at97&vWJ?j6GjqmcRWZ)g|T8K75XCpF`@4wTt_h?&9^H`}WkEmj zf685y7pdKVjV0&FQ^bBp=>=pB!6VzOO_A1oj01s`Cr2LL?uAYJ%f__PT;+>nbqnEL-$x=j^|d=pUOSmza&3TsLlF z`4?#X2rzp+g?AbUKwz;z1n%3I)xae0HVF`zmCb5s93g!CEUvI>uYBUI`k4Y z;%Asma3|?Y4%CEu7=7JFuDw9(sgdg~DQ81E{{rkMyu4LpIfuyH zUb2zU2iLL5WbJOG@(qg%TR2eH_JCe;O`Y<{OZIudm#ZmDHYUe}^`4j3$tbi3^tx;6 z6aXK3kH|3_sIN3#%Ty1y!OqKKz4zCR*qFV+$}yTB*>_EyvS%|k;-Y}a`{W(VPxla+ ztMuf2kIuf4el_v^eQbl>x7VC~a}A<>3;ncCsY>bF9p~%Ylq%Y{j-N7|8%W=#Rwegs zYE^IFtoIg?zD=#_?OW-!b;@6?zD=#_)3@Hab^5K}%;eXkdjWP&c!kk#VJ_Ffz0R*S ze*HGTp3krM^Xtd0_;n%DE@;Z*h~+3J|KIB7{|9JF9kTzw+KoNJQQl4``-M)1N2Lpn zHPM(@txf0_di4~QIr6b5Fbvq;n?Tg2z?DOIwY!T z`b%}|-ESOYAaET5S-Y(Q#4dEM(R&8zO_MZ*tkY$ixE-9^GPZ1BYxEb~-|LnOsV@uF zTmQ%d^|epCkh++y#Y@TcVi!`MWoxkGdQCa90UNc~fvGm%Xx6s5%-XLr&Dv*OsJ6j{ zYU>7=wR^G=kzLV-WPE%#Fj?o1o04_+uA7|4z4MJO;u@=+^z|}Y2LOqGg)#@MX4FT>8 zspw9l^=+#8anj z+HKJ^VH~Rm7!;vmiF01+2kF9h8aap3JTy6*`sx}+ZRnq-3G$WZ2wME4sqV2J_hux_Bxj}7ZTZq-|rxF@v0kXEo+|$0hQlB zMAo9C=Fx4P_P4>uWV7;0r~v_Ju1}w!DT%)~76l&z^KTe?G~R|xb2b5b6JyWR6#PP+ zj5nt4%VIuP_10V!_MNK>zGtq!NtvtC)5&=?tT@&n&+$NYh4W?e)G$D_eugAPoO-#v z*-)cqLg0D<0{Ie@?@foAcp3zXoc%dGNDmf-6c2!VZyD6610b;XDyZ?2-vZ_pdo66T)&kdmlKXD*%X0^%`cB7P5cr=B*m&^xWK-kslf4~& zxHwlmKEOOA33>;wk@SO;*a#k$ErI;9;PC+r4<0`l=HKt+c_OX0tU6n?*40Vo z#~vqiGsVYx(o5KQ@G&qyw0)4vQhkv7<6{q=!^R!!X-p3S0b;5sqv%G)D^l(BAMm(o z0(09Y+oza()8+7EI5k~r@x0FY1eME0YWuZoLr9Uv_1L(G$T848ws5Yzq;{Y8NT~#Y zC)PXWd0dt*++No^&*>YPPXeLmWL~PhtTu_2d+>{Apq}bqHZpyAa*PAhEtIV9^?Qij z%V2G?V71;}M{8TPOPfdHTWs#g zn0@^c&$)gU2g*THwu`KO5A3gE`ipVwY+}i7!cndRn^J|~sIT|G&$ks@?CZem)E~9tD`wZ-Xj=8bXpF@bEXHEC2o>s> ziAWV8rd~G@K^nyJL2L8y`mIE!-Liqj@lK|{p2+Eq*w`v|kEOQwOeWWlIzaPaC8VK|tzWY|De5UawlD*R5Lu73OU`68cJ&mF zw$HZf0{w{Vn*5G_uW|JISA-sRpbd9RsJg{e7Ha_dEAEo@p^~Nbf~5rf3bf*RodU%E^MLx zX3>es@tt2L=Ojl}`%2dhx{9FD0US0VKr zj{agD%lmc#q2;svD6o#_&H@OikNRnDbebSKyh&(EI{nVy0VMA50X1b3bZe;S#F*nqIQ3&FmP&hWhOr}=xmHTUD7mjWP5XKDF3T5SPj>hwMBXWjHYxUD<&J-e+m)>c&R z*C(|1EVXW8uPv)29in?hIMykNk*Y$uC!7X>5wZ_;vHZWZ9=R(`YpVq~5)>hDYX(G5 z39zY~>UjzyYS*LhSFf#8ZjVr#O?2OeiIi`qr)g~yWgprL!jV=90#?1xB_g1F0C#DX z4~dzsW&Rx5^aId(p5UVODLliRYh+5co{$P7p|y3&(sg}(dNxJ+=4Z0xvk6r`G$Jc~ z*_}DEStUUEojEdUguElG00QlMK(BtGPWdu|jiY4G70RYGXXN%07wGTvxgx)=braDm z0MW-~ALXM1(zLc>0geQL<@zN2{4Z5LlsnFd& zo~;qboE**8eOv8)J9?cZyC&1(f+bK-+IQyP{9J;_XOcv9uZJZu(k`V(_GxLlj?u)90!?X8V|aeInB^8f zpFAb!K;UEq8`A)4x-uGz4h)1L2OgD|cry<)!2E(`L>{V1f#=)F;C=TZhnK4$pRg+;Jx;Fu9g8T|3390_k-4U%NJC4 zS*~vIA;<(>-5{X)fovaN8o@?v59rBw=0{rh)+uXWWW1B&dJ!9^Cl^CK87G>@Y;T<+ zIL7B0auyX}Q|xjYn;Y3Tj@BA)>u$jYc~0JYHeE)yAxvv+c1Zb@zaJW}DTiKQW2Xub zbM-TBC9QQz9UnKcjyGfMnY}?k+fw9CTjtz;-g88klvZZt4z+UV)3sX3)~b*pqo507 zodRqk{aGVI`KK+|sLPdf->Y?s|CPZs&)=_K?7L?DscSYRe`eSXf$JmKc#F3eale`S?t;8X}+XmovaQ`k1Rpp%*%paDM3x* zuYwLa%Nr7-0kK-q!y|+zZ2p|q7O#K|8Oeh^pOS~sThhel&5+>vhxyi>Ts z!ux;#6*qC1p*I;!Y9k`+e=MNHI&8F$m63K1mwQ1rp$k`hi?PSgzwz;JUd7n+Q>*`u zG20d4b63LRZvP1oeNY0_0}u^JjECL9;r)Ict5HVtiLS#2NzL2CcvbPRNX^}sJj6U-KN&~HJtGsiWgbkHh>2=tG6+o z?uZ_21aFg3N%yS9!P@{)oe?>U-EgC+3Q(bbeZ5J}VLqPwZ%93lm6957cgh=HZZ`tZ za>*PEm$=v%tQ(XRZ|#gvC-|K&M!oq3N{3mTVPTHm^iL{J&^W{5NOFw&*cZ5r=fH>B z16V9(#s8+XRq~15Ru*q7G=ljTzqW|QsMn=@)9UyJx1_|VM{YF9{CLwKkSRhylc2mf z6KWtG0{5k~BOJ8b`FBgQors)4i*ta+1y-ki_o@BeryPFk2u+D&?D=`hyP<#C?|#7F zZ7*du?cHm>{%+F?Qjl|cp`^$q_X4iWciJVv_OrZLi*pLXz z|L1ug8_aeB)TT`2JF*teMl4;e?bjUVez`sU*g|%{$nros?HRk)VNa_6V7yQ6Du`_8 z=iA@B$iD6U?!V~UKmDw4AGff+CDtbQ?aT|TZ?F9y`?faH7r(TY|E_OFKi|IjLf^h= zZu0Fe8mo|`M*=O^iXprCA2fF17D`hFL&e_l(ue9n8FdP<=-EA>FMJ*w>boqy#Gj`r z^Pk5??Yja}+t|J4JWZ)3_u2%c7Rji#IeWauaU=57;(VyD-Y3x*5z;Rr-;wv8*#r7) zF;{<_$jt>Zx}CuJTt?~|Y^Vcev@gQ))Wpeeu8j6Xn6JiP{)P?pSs78@a>pc8xE32~ zgMIBL*H7~6_#~9G78|us15ywA(E13IX(vp8dR6ox#SiuB)l8nP-V##&AHl)TuIsjh zl*#1!I(FT>C8SIw*SE3jeOp3`k6d5G<>4(Ms-t~;H8#{b87;=xP#=@gB8-jr!w+`H z(m}rsV`FbMt4}&x%Gvzy04%7t_ceTd4_r7Zq@-`0>q_M?>_jPQADjf&es3OS1peja;%f7H%B z>pY`xd$e#FjlGG5XiZX>@yBk7z$uu()V?jw6W%6WV}-s?wSleX*f^vc87s1`@j^+b5iePsPq|5#r&h1rAt z)ydXP8JYKNRu6B~T3!e5IvMRJ>+4xRDkJNu!H+H>zbpOd2jq9LAB`lxPgfypf0gD# zJ-No&P_HhoLMH`S6x{>*X>!ed7McxB*|V0dt+l6^-_5_?weA1@=QL$2!T<7!?EU97 zW%F8ABg8}2$!+X@$8(ypj@yB3#f$_wQBE_PkIR8v-y>w706|58>jKTNLu6WMxS zJ_!X#|E}fN!zZDe$@QLz=zg*$#_)C;G-WaQ?mBi|-JmH?lk3OWbzOs|JV~xsa(o*! z(3{mr38nst9tk9r3ANc z?dyxl^~Y7cd$(i_%hN;SsZ;zT$hr0Pb7T&uqC<4fm`=8Ig{J(Hz3;xa5zC%x+${Vd_=|t zO#y9`E}Ut6{4z2gTeGQ6%(6)~-=-<~Yb~2G79#%=>Ak!iYR;+m79EFEdbeMpUDBdyDa)D784>+vCVb2ifU$w+eeTWTfV%p<)*t`yH>7Nct8!C!-*zF_}}C zZQ<)<*wCu|rdmDFRK-hlVZWfyI^aUJKS)EhWof8#F0@q66$Nnb zUG1aimCzU;YTg6-%c`b4P597lX;ha~tE8cM7<;raKBOvXNb~!UM&7@cy+5K_Q%bsP z-w%;*?&9B6r=i*8n`?bYtxiMK<`VFs+NaY{NQ5Z-!iSpnfG*ytDKC@n9^>CVnTBRy z?3sO_3bo$mL;G&`Q6DFNhMlW;dM6Ity9yie+kHrVG7V|JmXZ2&HqxqPq%O`zG}kO> zxxuxA%uu!;1z*cXpO<;lE~M4@kou+zg$DkrrS{ouq&?bowa zJ?TSgn+s`0ex$yejkJsWNNvleIQ+F68;Jz2D8tw@8R6di%dhogUnF#7!BbE#3sBK1 zo4#~S(YgkhYR_a->lt9G$0wWG z@d0$a?*2ECb!lFSwqQE*efZ748K0Z?74tXyobMKV&a zmQC$yFhc-QZ4mRRzP5|-H`xr{>qpvkV5)6Zrq<>%)u*Q-?dfc!E}n`svexePBdLYS z1TYX{L?)02LM-@o71I2p^c@{EH(hz~+bX10kJ7i2>*Kg$2!K17E~8b)XiP~t;rVfZ zSoQJi&0xm}S}*Fk!`N6(_R!QS^pCfhT#)q+HngcO6sL9P-H}~qY0k#B5IOJ7_S0I9 z->qhLdaW)`mpTY<^COMW+XF=2C@2FpTi5OvslDT)W^8D)MWjj)i>=1SJ}drfSB@SU zswr_E|8>>czB;bStFiGZhfC(>r)#hwWy<4S^>T~olE(`m)0_wE^y58UI}*QvQ1*k#jy5 zXnm}k9dHs-VT8a6E(s~`uIW1;pRFS6y^z)LUlLL-U5yPgZnH!{A4(9@$lh%RM0EfP zm;g_rS4Nxv z(O*4CHf|gK!Qyp~uS)J?a2f04eSCgPcs{YmS1~$NaRwV?J(Kgo;MLqG;w%naPk7rw zKx!9`c1Za&o`Uq{_-S$;0cyt(GTFUcMFN5oI2x~Jx$jjd9NY2{p#fx0A8%8|i&}!snL77FQ$$f~ zo7BWj|#6s#U(zvt50e#Uvi1xJ}b=4=`2!{6a@@{Lanw*d$d@*VYg zt`<#z*W1)@1+w1S)Panq2Lz}u!PpbLh}MGXZTniQ?K3z)o{@Xj^AZpjjIsF9X&m@F zuU{u{`*qK`{{3)(=ZPcoLqdRn4!(+6`Dq5#dA0iByx@fQEyyE(*TY%i4b_OV}xGf zO{cc8!nG{7k0oPjrRn-!k=20=R*$4IrceO4qRX-3|%L4)a(IGPWTI-+%ji)TguJgal>f&UOF8A$sU&T`w&q z^qA^xf6UhY8_n2YW0P0r9GmdeDm0qVGnb4Ae<9ay7od~>0Y|j@{5W3Yz;TchM{S5M z9Jg_NJO#(_`EcAI_u{yb;J86{;JD4@B|vGy+h^72KC_60`k<#ezs& zg4m&EYy@4JLU1H_`MdLV=ydDB)qQIP%xR{6Ol^5UeL<6JA=y; zV`bFwvY@w57xdF>neSlPK^_x+8b=8{A85+0S(@^I7%Hkrhv@cnmf!ltgV+cks6zQ5 zBf*m_FUtUd2gD1n5{Ai+>x-_kYDeFD5F6c+NcRFdB5j_-ig*f?~BjL7|xY)$dsldqF8E^fxg^B8+R zqWBj?79PaLhoX$$qj}#7BOTIE?knbr0O6qvCQ&(h!oL`ND<5@nCj1z#)RfsnH06M( z75%Om8%+cH;_<~QY#cTwwGdg$!iVNWSeUP$X~M=|F!mfs2mO_P{T|=w)gMq_4bT*_ zwtk6OoRY+SG6~(gjoX|?09#Y!-Ypn=B$te8U2v?0)*F}6^h|iqp9y+ZV%oU*cNE?_ z62P2zblSMp;3^~k#Vlw^&AYN1ASx4?9axVwLex5mHG>3o3Cd+-W<*$=JCjY_#{&{#@RE`$d{U^FR!fQE?U=W3{sKBm0}^_Z8nZVIy==-|z3?-?xs^ zl#lrL1!-CvOet7K&XPVFtCt^nHjIt+tFb|zThC~`cQehQT4CJ>w~Q7v+3yv*0X6dP z@@c#I%OFQaME)e-cdo=n$1oZB=jJa{MR9>&1HD=l7r1kn?Y3G36mzUIOV0h?dCKE- z%`s18EKmN8$wn_War!%>K=+q}9vsZi30D^AmpI0g%$LmPD<8m3`XJCg2(%9%K`g0X zZW&E!V*R>q^?CZ`w)=J7H2@Hx^DVg}bDOb|ID;!bwZ z0cd^84o7VyQDFQSc#dFa9czTK=f=kVYTvuacrLQ@`%Ap$teBKD?X;9u=B$PPfD593 zoLYrCq{2wMG?dDuBZ2xSDClCS@8a<U zM?4s2=a2%Pr{H)P8y0>YW0PZ5ydDT_Xu`(WjWRk&X-pBN-LE#W^Sp(Zi{thF#ZZ5S ztl>Pw`af*(zc(-DD4r{w$O2p^KZa zA#-`Zw28`5<(Vn4TK{On`g1dv1xB*9xFU>=IL4kLV6k0R-LZ|0*zihFaWb6TR&b8p z*8RLK;bLZIruHdD8_F%+@QOy3r}t1wJHCflOt$sjTPv9lby$GFM=9@?JZ!`KnFVvC zrtHVqLuuMPf%*;R{*Benem&*;R>$`fo9(?w`n^+xio|HX2k#J;2{|%q0*Db>M15Kd zX}yW)mee*MvD>_ow^=e$Q(nZ_Q%>odJ91zZ_v;oQwkqZOrn&a_-sa>pVgnh=(J~sE zMq?iqmBc3@xMS!tg3FJ|c#f9owYv}yp&37<=dHrX))n@%!W`yb`_nLamLD0ria(n> zbXmIy3qS)sA;N+RH_)0MGN%Ozsi5q9IRd|sAVOr-&lz2$`-J*GIBJX~Tyjg|FG5TE zt)M5SgI;=$))FgEXAcb3mUEpEhp#@)_@s06dX7jKC-=~65v=>q1@x3X=R;~ltj}`4FgsqzY=JC**hZ5 z$w~eGXNVB!!uY5MVA09xf_^}$&`(`ethX;nYaw%E`6vzqaO0c6#Fqi89msqx+D8ji zK798q%Q4IOeg8G3(;zS}j13~|l5ZAcY-s0jdFL4%ZNEu2Ytx~IjAO@TGMXl59P9&7@lc&YI%sV!Uc+S29H{r6#ubM#_I!@`if!5N^nrSbP${s{H* zXnK1Y4;PR=h*@En^X z$T;7`#u?Y9w^R%2nCk?HCXLNaDSR*u0zV03qhpnz6S`6I4I7(w>AIFi5y+W>$mqvh zg>uioB?xrCEa;~W2|9W}(0fLRdi%VLmc#@Z;b~yvYb;$%A(fM-Vd@WF&Uk?*GW{&m zW4230^!iFn=dL_4O*TIjVP@-D97s%JbtKurmYRF=$rryrlPvyZ$< z#|+Pd_r8!^bj}V-Qsj^%(p=$Z9}!y4P5}KgiTRSXU~HUy#Mgr7f!@asmj@^)LhRv2 z2aVbVy5O>D)Twaab6R#IHV9s1yq$Kw4jQA#@`+e{n$U*qk#?*q;fcRaf!FGQ_s=ku zRVYvV3}a82=2PIcUOB9?v&phGt65|3MRG=U%4{bku?!Cbw0t=>rmx_8VuzHE;1$R3T`}hE>?0GQlu*4){4{@w#hMVsg(fuZv~Y958-l&%HC=Du?$! zAwq1o6W{v;y*k-8=E8i{IUvDhK#-ioyY#A3J_B$smuc)`?*|0uu?0+wv zS;1tKcbk&qjxBoP+&BMfviHr@6j(vG4ePB&d*2ZHL3o}ZL4fW9(Avn_8zX3n3uKh$ z^&xIr4fv!S@5TkFLPRmVR`H7T+5QGCJ&G^|3++s_1n`9-xc8e$+9K z$ZT5M>=nFT@CvHaReJH!MBO*k#%E4r@|q-b_P;9}dmyF8t1LiZ`buVJIKgd=w>xlu zZUr`uF*{e%Jom?wK3w4#r-Z1t7uk3zjeXbd?^c|jCv`e_l9k(^oL^^@Lj6exU)r7m zvuT(Ov!c=Kx*PgEYnX92@adxV(p)C3znnBYhYRDDHyT=oHvZKeb_RTG`j` z_*dG08NEvN)&&tGOwZFt`_nBX(jZ`P8rX1_;rd7;HsljHHu?m?H9ra0|M?6XA3Dd0 z%9jO^gH0?K>+FB?Owi|*PADT$)bE&aqG7*NFiT7`Gx> zHmeHTYd@9(KRD8cf7QzK%Vy7~eAn*yZsf{j*-RB>6fE_lub0_!nUV5+=wkbOcglL( z*RNdWj*MBskL>nAeV6ZBZNDk?Q@QNr6^sTDIjr0TvG-Hj7Ou40zIlZ$hy9JT zJrHQ__i9n5a@X`yf3G|?p11oo#-2SXZHBI}+q`Cly+?OY8O%-flnX5xTyjV5T853S z{m5V?JXZ0~rT!#2Y(DQJk;8}#R%jKBY#QD zljW~pJLIo%%lenUIw(!n+TJ_M^Z#+1+B;`izN_LC{nrNqZ0fC>GXjtb5I7-8kyRqZ ze(N0D{b_pB9h#zDRiJ;ioUa3~ra1TT>4xOBX50Q)?j>5&iRy&JNTmyEf-VR=lmmMG zRRubmo1qc^uQlbt25fXQ|J~SiDLByFoxj$US2zxYmVC<20EeJUG+)f|54N~VL3Z(zC23C=@P zzG>y(82pA3@ zFdonnOoPDd4cPF2*4B%|xO815>*Ov?nYg?!eZ8Xr8-<`L)ZTuRj2@tCDlbxfzox8c zz((R$Cga!LuPIB(^(1!Pe7~kV)4=lN?z^AW3DX-`KBQqQ9sBd=DKf`U2n<_>jUEFV ztt0|u4%n!s#11{%yzfZ^1-Aj{+d_ZXO+X4js?3fGE7HP9& zhNcku;7e(*r~w;$2wj*U>K_WQY3JPqI;{adLez(Y)>g!9Wo?PEfYcY$^~5!R4iCPr zrDL9`w@(*oT=~BYy8p`J0#tl51Y*B&u7z>wdi(D*h2U{$8TSdilJEbe*l5Do(|Hrq z{nRccdywYtt9e|2z^x6~Xui8ZZ@*hptZ`}MZ3x`2G%%2!Ts2Jb!QF`2v5x^-4{7)q4LTIJVFQfeWqo?`7|IlJTD;qfjoq z2QK*`aK&%0^m>o@&f>tugjRyqRxiSWIad|v^nRel+PXkb9DnY4oeXE z>=D`2M2NX87=K_e2tAm$ELoP?WWgQ`r5wW`W6X_79^y!vcr{t zmS=$8Be^5@cVmO>opz}((s7@r{B0>V@J)c&-YJZf)@aI`?mKQ^kjD4+ODa+O(naEqV)x*K~^?_0d> z=iSNt+tNF1TZ)Z#k?~~0hyCANsKav?>J`iS(vK-i8UN-!aY;P&B=;k@VmZ_OkaKK! zDK>&q-?lGWhK*Lop0siqUB46?9bEn(&#zz3_ct(~pydYBLHn0t^OTV-Mfnje*Ry89%Op)MFiIq4au@&KIh{Dma;R~ zKbJE-OlmGIr|kIka$9!%WeO}I!-n-yLy9hMAk+j!)^{?$n;O{I68VnEi|@N2HYv5e z0d{+@G}!WD8`ll~f6m@LK8osY82_G`%_hVUVzSAG5X~;2V!T5FC`e|Lptf2s!&H5& z)lGty65ARs5+IPX333b490&}ck4dogHTy_^sohxD`bYrlt!gn?YHh2VfR{G5+dnK@_9<$FKhi|yO8meC^m)-yDpR++ja=vbnu&G$0a*Q%8oPRWJhHF-`Va03Uqz3BW`W3 zN5nfeHm<5&7vj;19se1RzW=mbd#)pYkkEg7T>rQ48i`9^S-7-x$4FdS`t(R#dS|=D zrJw9z=3nFXZ1Z4j4HoQRW}iGs-n!ZEgQp*1Y zF1h1yX??=Cd>6;QmGmEQ>90F4#HA&P{bj}aJHGRqacSq#7%uHNIyx?09EVE}Bz$LI zX6!qE+&MZfRmS1c1Ka=KaOuHq5|?h;k$_7sg|uhK#_;ma3vuav^WWoA`;L*gG(8TN zuHF8hap{!INv7L2<1?xflrbyW!TpLBmNsmSKE2KIuSa0;`*wW5*pHcsWv;P{>kFaA zJIoCJKa$*fZ-o6x2C7 zN}3TZX+gB)ZJB#ZnGCe71<`Yix%qnm07LZvt!zfZkC^`#H5*c73_j8>x*%p5zY~jB z_9V-A<;v1DA(LyI|LtO?zZ4Oq;hv{z@&Hl&&uBoKg9ZO{#%#7_x}*<&zg2@x+~cCL#*%Ozh9NV zOBZ5&JOBL)tNlW(Z{fdRm%n!}#QJ7a#`zm@{F|@&k%clB0a}84e)u$VUqhJ@pO=sS zwI`2K??6RC&lI1qpJGwZK`HD*Q0&i>brk--O~RU{NIw$%k`nH6Kyl@CjVegy9*$Ub z*&F~a{}(>Gf$NOJta!9s;k@6UTkw0viWynXWSx${OG@|;FtTsnZ<5t-@(yNN&$_s5 zx`xR*IbSm7=FgeQ%unL%D#zpMAgISm!xN8{h8qEj8URGyw`2fUA3(9P#78|#M7_lR z$RAttpsn=*3wASyt-7sWsu29bs?j;I#YY=J!g47<=v$1LM?D&y%*O?Ye39$u=x#U6>; znHLzeG_rOlbMyaS@02vsj^&Ey+qWE&d388WaXb>Zl7V$tf_rvba+Y0(^q<=$f8xAM z&`g(?{AkC8XCZ60OMiZghXoUIxAyoSMIuM3zw{yz>jjtN9{-P#h{fBGyM&zWLaq%DX4>vfj2(fW5su3f-dA1-t7af!IM@mR0kE`41C+btgJ@{&>wNZV=;X`h63j*p4!mSf36 zyj{yMGkqKfMJ_VAW`*0BiHBGbe#j?s7;N7vYUYUF{)Z67l|BjzbYa~m;`Z>pJ~6Ha zvF>is$0J*r=|9hk@Gc*1Q=sc!6^iS3BU=AFq6Gl1CwFohj%Z|vb$!T~o6l)tKGvu4 z`#PfjA=dRf>waH8*10_HzZcQSpp1{?_Zu$7`W5{CE<|C7b?s%$ji2?=?m-p`?Do;! zt39N#0P8v1I6pu%a)yQQFGT!z7k<^6!|OiEb?I-a=N@=T_Vb(v>ki(}FA((%v#y_6 zW7zG*x|5ILRYco{Sl6?h9_*KG4ot-QS-$tL%kh~U_qpE7m|NsHo#LYt0m9%PL+mpJ zWwvz>Qi;qfUTWo}`ptzr!;(*I|3qOoyCQl96SnI}MgWZW6j^%`i(H>+_Y`D6&3Xk4 zaNr(Xh^T+px5M2k6#HMkljiMYCcox%+iT|~yCNZ{~QtD%MSjn+b0V}{F$qIT?2AEi6QnWq@f!tKm_C!z0s*T?$4 z#p-+aM42ae>9ggO_tOQ?mHn|sm-7Dr&0P&Sg!jF@at!(IcA4*D-gai1g+9J!!p_I> z;GD_Kv$sOHFAEVnCq$c4au_2h{yz!hXrCGz$7FjPmtp-a#@v0k%38gFLLZH&N@0mM zvA+R2WEDkVMS{b+ZV;!t5*B{mtp<+3;Z#E zJE|NiyGg~)1=y#FK9ctHi_o}h_?(ZwIzB^XHs4qmc z!HPxvn*xR}am+Wx#{ByB(d!YkuY#5&5w|P#mMfU3<1cd1-Z{j~_rw`)Dhc#Wisr+x z<0Rtgz8xRI>At#^nRrDx_0K^RD_VH#W(V~v5XSdvwEj^<{cxM8InDRhzp*R~08{-N z)i7^65wKo6WYwtGE{fL7e(BB8Yi3_i^E7lPy=sT_(_gZ=oG!6^1ioex)^}`^d^KJs zby<0w6Jg?{Ra1=97A_~@FMRaW4jI2=>t#tpqwB9YPukJ1-Xd!}ak*lCrgqMg1csfX z;ID)7Eb`PKGqJ9P0o^TX0&LwDlM7xM;<_QYeC)m%@qQf@Nm%!OD*NVo(e_G(*v|rr z+~@J1%Cl0{is`Z2Wqm4gbM|j^@Uh5!F9xhH7-Hr)0GCIB5FbxB$npFnZaghRvD$eL z4$1Lzo&La}Tpw+lv{T#jAKb#s0H51A*3}MoPk%73ufPy97gH8Gt!4%LInTIU+O`$I z`q@Eddd{;Vj`th}roIU+Z!_j*2gZFkv=S11FFNCWkCwbSmvUZkR>bscwD&9${D9BN zoM1#6Q$+pf69c~Pka?@~_44t{G3Gtb_I zD4#dihuTyq;xxB+5+abR(f{2Njgbi5!DRj>PJ1~&w8z|c);B`0ZgYU~yO!9yU$-!` z;?22&H+VIL9Q&=TBkq`~(fI&f9CrV~n0q>4{miWpK9YqplhR zkKQM9p>UnZ`wj76eis-kTA0cE5jYyxhgZe=ckhE1u zeFuQp@@w$~XyJ5clLAKDFq`q^);KzQJtDo|j?vlq+eXiweQO=G@NXFBScre`Dgc*V zGa+S=84Woa-G82i0{dm%aK4{&ne-j`lk}qr2NV%wQtcfJ#=>R(YV&N38Md?4Z$kKCY0o-^zS% zFyBZ0BDWCMACPrY^fyP1!<2q94`Zkqqkv(=k9iFufuF?2{9#L6-TG-*|J#<4zA}BP zQpn|I1s4qPJ*cqqMGY|Kj_1?6ExKj%=t0KZd4!p#8FO>~;my^~{axn2kJc0a=31%} z$I;t9+KV9MIqIX=nKEC>5=)-BXpouycYT8XA386uIV}rs6?T#yE}y!%zCXy!L6Nr< zLhzVxM2!P+?{Qy3-GkUTx-Ht5$jjr$x6c}1GN;Xad=}q1ay~Y`|A`wP*~-kX`Pd#u z^po?<{F_w|UfLWWmM_?1J;)jIVUdnEY57*CFb?L(vH9{5Z(IH$hjez8==RpeIV)#je<98 zx5VMiM~DR0#PCLq!yE5JtWOvXZy@#m32*LbmUx3YOT)bY#b}C;_5yTWuoqTrotsODg@zDklLUl=0!AUeRUQaw*l0=o-3!f#%3~~6ib>jj^tNGfh zb1_mUlC%jgn#*OTLK{XWZo>LWah{wV%-q7v)Ouk-1SSl$sFaJ^~o(!**_Sc2UW-=vu~xVnwk4BKnR~G4SR-J zF@C~FKU1Lp{UK)9c5TO28Mn@9z@MnJEAMzo36}zdG$=W|&C(b9seS$}^Q1hqjhPx_ zMSr@Wrh(i`w5eReWgL8rR^Jts%e>xvje3WZXB=BDa>oh%@9c7D(S})Z#b#+s*f}WI z`k&uW_x1?0YArc5QMa@NpuZQuXyI$OxtzXAnYm=McPQuLk{fNt7$JgX(=lDG9Uq{gz=kdCrgjKn3M}kbjRp%G}rdy)_9l5|3`(dhtPeRVe+l?bK(Dig6#+ndSCI7T|Z^+|Mbp> z&CJaj;lt=Vky|N$ZpT+91MYDG)|nM&$z^D}?X@iznuIl`u-K00#74o_h;6}1cUN^%>6UdV29!(}S zqvT)TyAoQk1&2Scm2mjN#TFc5ziV52(w~v=$aLS!zr_3a5#Hb3=WN1 zF*tl|RtygDtQZ`&%!KwDNwT;K_`b( z-@!`=Eue9lACtQEEO*cE??LwPwcEa6P*>v+5JP0=3?1ad* zHr?!m2d}f~W+&WstxY#O;f-r-x_Jy*z^0p>-~yX&c0y!IjBXw+vFT%}#jj zDw}S0!h;iSy4eXoyIRoAia1?kG@G#ClT(}`|H(E*6SbL#wpckpRWPukg-`xj=9}X0 ziW)S2CwXH_%=Zhg_R;QS=xS*2QPA3YeEAEua2=!FDfw{egW48vr&HKZU$)v^pzp@% zNYU@4C6iCA_xB7l&JHJ&9Kb!e&?oW~zU`3T5p6P3$ouyAhpaYAYOKv1 z*=C9ZjJ=s@HN93_?}8LDzSpg`*POT7mZE6e%K=D_Cpw`=bG79Ck`rjDP;P{rs$aewZ=0=&L(Lz;^t*kJ$4& zBj3eNnXmDyVHR75lrf~qdhh*H%xJjRC&t;p$Nyp;*>1hJPst+pSnoY`GOqpoW5`Oo z{Rw6?=p)+P*f1JZ8hkF=jNpI(pk_cK`okM#J+yTA2)8_*qfku&ZH_ zkM;qCqJ7?W5xK&8|2zL=M#GPNv>^q$qR(HPL+-Ml|08ZJ8ENEO_WZtP#`Z^jG@|AN zZ~G}T`8(1#G$-g?k|xHKZts6TGXfjS!W=($a~w@`lG1!9DFN+-fC0d}ywAus$nO7d zOu$sT1B`}y%S7&Vv4{C%$$+%Ai8InNYi}itr;_8=v#SS~F)RLAB$edZ>-z;W0?*2G zlZMi=a3f%S+GhFe#WT#fCca(UMdUA5pJ`{Aak*vhy6oTNeLc02nZIcgxm~-qJtcio z_bFKCbLVSNdUZO1y0Iklrx(TqUHO!q+jXQ*DW@+-)NFCS=^Kmni%86-V&%RUXSM%m zmNojkD8Vi=iY;uU{RjoUmT%(O2|z1`S*XIPQSUJ0aC7jK3PEpZEP02-YWVZ}5!Ds+ zzCD&4uIgg9B85m1mw%Uw6Z?!2!u{Ht^v-?vl z-)5mpzc`0<#O*!jHGK=0&a`V{FS4FJH6U`b3w{{?e4+jPtbG3EC^}F(eJI+UYX8}c4TxrxF!-~Be zP}SgB)oJBURDz!uIOUlllV^&9$v%2fw>W$4id$6#CV)sKSRXRAB4Y*BS%Vre!rQSyiKH0C0_|Yo(Vy4z@B}X z8buJ7B-(9`T;6ZxlPe$oGov z_f)5-`JMP4e+L2XxypX;IVVYc=kCqcv$AAzq(q}5zB5b4uJ>j6==Kd(Zay_Dc-LlW zx3ppG2usMR>;U7Ro2*(lSCxi2zVY>sASill6EpXp8%Nq2(n;?atbhH~=rHvAC9>3p3iTy*=Cw(suFoPnqe5ff-7jwzY2t(39evJ3IK5niZ7xiF9(d zNu15@IduRLe!urQM6eU~_%k(%GcB0QA4e)S$oKlH6!D(sknd<2K)-lOK8vU-;d@kJ z?~xVHw`HRhYpy_X)+TXgaIkb>94Va)q}L_Rat;DcC(Y6I&K|MeiaN&EuhVR9$;}_-vJGSt3Q4^ZPBShmFr zYj#!K3)H7+VFh3+)D~oxz~d(X8uCiuCnprRbSl(dlF5JjOOwL>%gbqZ5_Db4_w90r z$f5gIQ`~yB0O`FXwqE5=U05%g@B0-?B#n#Wz_NtAiZ_CB%_bRhd)+2xF1@^*`Ww6= zmlFM}JQL|g(Dg#Xw|xb%Z(sIQ%)hahG4~DyGXKe#oAWF1$LbUKD{mk*H$cnsK84in zS4ge!LCFqYyos5W&q}$ecC(K*s6hMf0=l<}nG@=?t^EFZ6T%M+Gc!^T;l8^x+PW5M z)H-eJnmm1lHc)>kkP1exsfF`YXhLszn7V1E ze2pUjUEfU@L&apQZ?@KJ>74RtTdd?xKetit0dIF};vQUvbs-Fpii6bk zslp!MFP$j%wb9yF|1j&Cn$V~Ba;#VLcU5Rwsj5wUJ^A$n{vV(zS5=x`Mu4i^K(9b5p$6ge0?J`lM?aZI;?-6F*on?i0UZhe2vfZzy>Q8sZ67v z-wO2hO;XRSI9yI6syq1ktr~R#?wJG{o$QhMG#Z+uJj9%!hs| zWg)KDeXhC+kEnT8PWkMh!}7x$+8}cV{CQ&ntlfb1X;D3{~aDgLZ5g@G30Gwyf<9%!V|C7*v`!uYpR*oe}lddpn8F+{piSs^bJ$rwU8An9Er|e)7;7ofR`F;dBuQ|(#|0-fqT!lx~ z3BmX^7xDHRn5ms%#q|l}^%Y_LkHgk_Y?kqG{^{jZONK80nQ{urxzmNOTrV>VGPIh2 zQ~FccKF4F9W@aP_id+g5ElbzvuN~0!XyTsE#QN*Q%zdOxqw>5@`rlnV%*?hyR@^?! z+{;omdfzY$`O`IOuf2B+)<2W$cKjL@43`Q;cO~xUO)(n#UX$d9HZKgMVST-rn>*$k zim?8!wHGfAGU3}$zZ$}UVOg&x>L)q|>)qD3f5c_@ty1qQgRF@6*NvcJtg8ILQ6o(XaC=gQg%Y{LeH7MF!Li$ckaA}R?fMFR($&w3g_6bO93?r z|8xXhfgx5D0o-$Bo<=Jd_-B?n;Nr>!o|%2~G+MgAKeGX#7##3nfdhWoJIoBP1McB+ zRzV6J?>Ng0H4Q$jcfj#)on=PZ^;#{s;KM3M_XG21Yg-CDllmLaFr(201i<19`Z}d@C1{Bhut73CG{o)8Boc?{TD&z;(-X1=>6_Fzc5b1jkk)qd_Y0Ge& zr%zlY`MD0@@^A6c-}N#xGDD;OEr@d2WSIY+rBVNOL?b`Y!v3jhnA1NI12RLSf8Su~ z#WOT|x=f=_4l)z!w5_i0q9)hNlaI32j>^i>dkq#=nM zRh_{qC5d?O_Xb!pbR={6{34)IPtFQ@=Z_=15$^fnAT!&}vLcSlZRq|Pf(HVpX=ycA zBk8{fbw0YZ0fj|9Qcmx%tOZctfWnq;AY(id>aB3y_R9^NExWAJv5Bi-kj*)}9&QKPU{pAb(3VBE2RnNj$PuBSt;=Kvp z53Z(IT%j7YV~!WBWoB}A zTNZSmmpq}FG53{cm=RH&q*aCfJ&d{kc7_=Rfcis>xqmpo46m9keDU@&=AM)QBLP3w zp)s9sc}(PfxCZOBoc~5p&D$XCoSoi*am4!?BA(kKGvi~N6%`JaUVSUI?Z;(tc?}eR z<|9==N^vgfZA1dUy*skVPuDUtic{_jacbFm4u5w3fmh>fDIk0Si~U;1$$6;bR|q<7 z8cVAk9qpHvQH9f^>m)sD%PXVoJ`i;t+LOTWsnAuiKTE`5!Y#OG>^f zpg`EQJ4+#-Jhb6L|Hq~4MC`C0rR&#?r0d-tFm7AVOi0E(mHV^EkxQ}et%IlAa>}T; zJB3uNXXa7H+&{atjH=1Fr!7aN$}K`()-kA0kKsDjrDYVR0BO5arN7QAqr9(hP8sK+ zoo83W)812AA`fkm>TX*4q{ycbLMd9fBm-(VUwP4*i_aUI%T*hgxz97wHeb4qnIXzT zd_JD)Wdn=%XNmaZhHJ6jxQ?0FY2_8W7VGu=cdGoo|5~iCT*u5-C(x4W83V1UKwo3b z4JjI3A^OM*?)GB+#~YdHsh%;=hM;TRIt$()pY(b;J<1C@M_J!X)=3^E@g^tez1~G; zC(O~0z*rpDU;9L?^ZA}wKXQ&=TVvwmQ6^#i+Z*|uK-6%pvfBG5VV(Ce;+xGbQt+gZ z-MaqEdJj#O?|s2(Ss5aCt!1W%v7*R4E!@jwEa?lw%)mFn@@PMAxX9Rqv3CO)Fex?H~Z8^+v$N+6T1u}0h6 zmQB7~BXSsrdgmdMzgFhth}_5JFQ|D3z?fjq`wH3D3tV@+PYVnD-IPrLAQSJ08+m^p zS>I2$=Vi5dnt#6m$VclEzW-V_dCO{ptTydaWSh;r%@!bUCARrGo4jhZIki@{sklOF;HmZT`HTnQe+j1F0I_J+YMj>PhQ70HBM@ zx^Hb@<_s=7tzl+?3jJOL2B$6H0MeGH3i}s-@4IW5`Pv3%4p_SDJ!|CoReZc*EHCk! zqtqD@`o}>#*I-edw$;vODRhy$q%Lwe1wuZob(~a{Ag66yF6KI_m}47|((WuW=|QZ| z<+LCfLKUeR<@YNT)X_Q&HSamWI9-LvXG*q+p=(oIO`jm-iv7II>C zu++#QHa$yUD`N(td?lgQieCYvcP%qpoFM##Dum8~d#ci<-}62I!{Y$rcUtw!YQ44p zV9Y(g)?eESO0{Q*8GOG_k6IJ(-EWM$k?`mWdSA&QkE|1OFSdP-ksRMU9j+|(0g2k zDquYuK`7qGpN}Cm#M}zt%rmjNQqgB)L!-qJE8;s=jCnA?@ha^yvfQ$-bqm=U!in>Y z%6o6*kRNXlv?nG5ew0IgxWU@vMOf!_Az(i4O_9UiGRDjX zClH(VEoRK@yIl)U9AZUB?$W|X23b)=fo5n+Cjk}rIMTFmJvgd4ZFab{@WbG!MhJ`w zMWc|REuZKBQmFu~aH1wp1}y)bhz|qeb-;1&Ff$G@=AK(yQ9D0FTfUd~!*wbJ==&T$ z9SOBb*ZohcYA`-V*snlQ)*5M_7qKL9HAZUI#qz+7*n@=lUylQf6;DdtgVO^4 z2fk?iv6GCs`wju=Jpdvfs;&F%ZWMVBiXJ)a6Zx#aD7fXyR!Hja9%Ke@k80=F^6|VT z@)|)1rSbVYs{um@@uATZQB%4unx zw$+h@d&<%rPgiDWbT>e#%EjjbA#a)%{{P}~N5%64-XG^NMUrL~#?ybhUJ$3Rb?d~r zNnr~>QL6&gr`)Z1r>rw3n-8G4{1SVt{1TkM@p*d`2t9h(N3ReuJGiG6oc(x^8E+vd zieHx}n3PQ+pRYwywRT>v1^?EgpWI24LDDGy;X5hR&L7}>57spHj282;=2@}EMPiI; z@=V_YC5MG?OLA*oVjNTDIIOoLXpZj#9-m9S-C1P*8ky(EZd3Q{g?=qv&x+jA;(J1O zh~Zps&dNcq_m``e=t*9uGUu8)R34HzcU^*=Q~~3^*D#ag6{npI0EPnDO(mdM^c{(O+!GLq`eH=vw3Ka=a?3;we@>4$&N{iA2&#zRv}2bWTxHas;(S_}sV#pPP_>^i zqsjq<^JLO!X|knlr!B!$yNsOI>z2J%Tmn$qOETMKh~#rx!ITjc@r z@C$IfeV7?O#)=T6OdYUfoHJ5~YW6}t@mhVB9b0v1{(_2ES^)%&@PgXpNzst`^4G0-Uc~8@qeh9e>MfZKc_rYe@n$sSwJNB(_pR2v#R^I_ zolxXT(WqGaS8@bBpS+Hl-O`5EEac>)Iiz5nv<+Lna?KnU^DJHxakp|DPaVw%a2jC! zQ^wqiM+;Y~12b%%cabW1r%?h~Vyq1SMGu3kx=)NtN!_c!@xJ8NyoVucVdNY$S~Jr` z9)Xgyw3^8uYb$!)t$FPVgn9qJw{pkZGV5P0djFSE_-D~<$b`6>&8JnRFtH9Cms_VZ zA-jcIoZSzcs)FUNTrJGu6lQA6OPI(#UU>8XkUrH_*sEp>-^lO&QrOT&<);|Hc)l@K zmo$;Ljg${z1T8$RqC&27E<0RKqk3nFHQt-FuywYf+im(v63#Zpfw8WUnR`>=1~2DH zca~GZV;mWaFp_856-hgKkiYE&|5)rUCUYoJ%9KfW87)A8+N&zaQEbMP^9f=eH3Ud!2AY#W`jal|W_> z=V`p{b+WCfvEPVDWQIIHNoC9w^@E${cJ$8DsH^sgT28Bko(&-Us=0h#R_m{=2UoS` z0HHq(heFP5Oyl-xqw#(+`#oS z@MvKSP*kb#HBzeY7-UAk0Y!c*r%0g#3=Vsz6s-TZh_B8qN1f4hUv z4l~n#!t#N&@VtGnV7kC>2i)MN%z!CcnCmMQqJKwCJ7psGn)e(t_JjN`|J_TO!RNu( zbFVVKy8B)rda$jL^_Zf(_|zo;RB_a(^uZOLGK+Q7_D_Gb|)bxh%B=^v;+ zRCzDfvjO+44M;!GZWTi3pF?Eu03tVWS#{;oS89ftiDpA)fg^8Gy911}N&9w{45~Hn zs9iAu8kl*~Idt{?8(Fa78z{ukCW8kqUNqttAbdFt)G z2}k#4K!xD1IWLOao0C>ftuyVQ<-Gd&>dm3fjN zbcC^EM<*dt1y{?O27q;6GS&yK0J>w1%$X-_3DY#%yFZJRR$;v_AkOwWN2^iRt$^|4 z24-d{5bC|kI!l?R(XvXcdk5+dy@f6Pa)^b5Jg4RacUNNleJ-ykKqFUav`qmz&8jn= zW##cptoiaywZn>L!yR5CYlrJIhmj6qakMYtt;)YX_+>} z44Z~|24glLPUA6xqKbucsSiP@^2gF{WWU=6lHLh=$e8i5#Rvar!I;fsRAVlEj_Vh9 z&mEDg1nwxO&mm~8;_}=d3Hoq3hg{0l}S5#6o1xf}U2z`81)tI_93m3c&XKX%T_ zhAr|t93OTdIED^niSt<4gnMjS#d+f@EbU-_Zj|{{xZLH))y`>7Fb*kj?39`v3^!a% z7Vl0crH#_R*7nKur)y#1qpL!ZKNE+cO(BsL{(*=BU9FcxxMeqx#k+yDD&zZo!_2sR zjr5N_ovBhzpZJ)R9n#O%9gu!*pW}aDx2PhA%g8yw|7l=mMA$1NZuCtor6&T+)Ifgw zEv|!Ec=5#rv10MMm=c_rriB#*Mcxc8tcIk$Ju!C$ho8lkJ}+QQ0Xk&a`VYJ|2SFdhgn6K8763-Udpj{=XUCMzH7C$qNZaantDiqwa*GGsoD#5!bA8=_bj z6zr9DH!-*P`OLFoSklq5RdcIs4Wy6C7}Hy%VY< zzi!RzXEKh%9uwD5=I3kSHI9tTR;<-T5E!kNj?$`WHC#RuF$`Sqh&V|qfGhsDX6Y!= zIAnhRD|w&mCnBfOOd-PwUCjTHMzP3)0@VMpCUg}4dvW&;YV;p=3@q>KnCuIyxaUj8 z++U~={8B}QoJKg_)96uvP|86~N~a2Ej3|`>i?VB+)`pq!b1r|Pr2Yy^$Fpe)d@S<` zgG&p0;&Vz_`Fo)I-#QrN)h86+*NaDtH(DGRUlXyMNwX<=^?7)f81 zg@2v|MNWrC-}H;Wuv5vMvG!^${Fx)IW`2scg45o{46Hv4>cTJFt$A-k+QoapS>3OK zp&Ts>H(sxW>p`gwA~5m*Tn$CS?kIH8yuf>OO_Nct-BXI$^&dNJ=WDblJ}WjvY3D6 z!UYFWjc14%7QZX@e^Dmhy9R-QbFAls%)pt}x#)Rj6ik5{e4YuP=Rh6~*LKM~-TZxY z$GCe6UQDa;A#(K18=nc8w;*LQS3(EA)L?^SaP`}Q#N zEymnSZ_>hi{NF`T6rICRLF~+Dh>1B=oMpyWR<1K~1~kYF|KH{Kzr(MsxmshYcvf@KXbb-vCzF5Vd{6J&9FFf zDaZM|g}pL1?c#rqB45VNH(wudw!-zB_7pHU-N4CElx6vJ{bLU^L4i4VKoPi`%=KbT*lg@iTqu?$*p-_7hKHoez6ls{pD~xFvJYI-*`J~35FW% zlAAP~w4_ z1?QN7rX740T#H()Rdq2!V{!gU6??eKx8HwL0=mMFSUY^@2K|40k z4Y)_v)^h~UsYxPE@M(ng-$2`0+|O8s#^;KElwc49G@)vH#${L z_rc>ctg{BLYw13O^??`TZTqh#p4&Ia>r29hg0L=QCzZm!GDPBOo1g)Jb+@c1797vz zay7RzCVm?}7}%;cqvz zEdo4_wC=xTpo=lHa`!k=v1J^w{fm!offlSlvH#6-;pc+)e}4eoh86Seqc2-MO-@9zjIRv$_nT*Pe>N|W4%>FFJ0Oj{vDp~b281U$&r|&9~@egC-ZgER0w5*wgps}!F8eW z2eOFB$)_s8yg}cgUUhsB2I{voTpG}CTqWm?73fNhU%&Y&gwMDA(ty6c{=&10)>YD8 zb0M6`x$jl-`Z@gOeL13*z_TRN%mr<0c$ zb64VYQlX`boH!Teb$qo$$qne=B=bDcmrm?8-i6@Uk~`(uY4jZG@SW6mAd8rnYGJ-U z^@r0bmsQR>GcxNxNvB+9!G|@fAqbsCP~7r~MmfIv&y-WY(m8`(rO{>Y`e<#Bk7jYX z{sT?OsU|>iOOJe)^AAp!WGn~PPYqi1;!HW!pmWCAAy#zuDvb`PuHf=_eRN5WkAAMY zf=AWy!6Ry}h%dI<_TXW0Ru+2TKo)^xs}A+5dBKSj0(z(}R{#0QRdF!!42Oxlpl?Dz zS1p*ZbAWQV$g^OgSFz$B6J$Sdg7J@4(w}6sF+DiU%%z9Zg|6)XB%OY?8ah5(jXFM? z2x0#xcgh%kE05@x($?H_%JK{1Yd?|m;M%1FrG72!%GJUXQ7rd0mnBOqSyG%O=R%E! zzzD3?wzjNZy|sJcl2^I`iaAaG*GtlOL-Sz0dtuQl96lremZtuuWA{gR1l+VBI2ci4 z_3D>$*h#FNarjOe*q=pQ7OZd>*}ED#_O3=9d-Q^z->j04(P2}rlLiQ^jsuS>WP{7Av3fcED*75!hdTna=+K z2>BTkehs|&M|aX&RS0?2ff*?u-$_d#rTSe33_iaC zG^T%n0!Hu06$4cOp)1m~@DBjOl>nhhE-hRJ5awf>n6HH!0K$Au6En2sy8&)|6d>fC ztlhYe&#&|Q;gR(3H&L7NeFOD}b|5&&XR{4#wA$6F#uB0{ZhSWnGWj z`2BovjG!46vjX~=RTt8Xv338RkH}g`(r*dCE&LnfV;0&JcQj_ft{EWem9Ajscmze9 z-g5piadtqzsg9XjKgsLhuzr-w_8-V+yJrXVY2w-V4l35+<&GnabynSdGfD8R3EDVv zN>vJvHUbfH`dv~^_a$R}B4C|m0sZ}I>0fb(<6@RZkEpIf+phaOV`dcB?z-?C@Mm>0 zm%`boeOCG^PE3UvBYD3PwDWjuM{v-8u6_%h1oTh)vq;07fG*`H#O0?#&hzK2lysfT z*ndC}I+6+G4FwJsKvw^ADj180eTVLM$~D`!KZ{iQ0{TBzGIQGpa?R2KTqu5TJI6>F zVNO7=Uv;63uzlqydmCrl{CtJ~m4>!-@@TF96;7*eP1C{*l7!FItuB7;6n;>?3~hP) zLQgH1Z~tKVQkAv=DR~@@R}3>_pXGniR~pdwtz_mAYj64eK3_n8P0V3@$L~k@`Halr z98as`&wJSfph9=e)xrfSP~+jc=pr8ta2WPz;fDb&>~??wpPfPuR!(U-8fJ9bPg*uV;x}psb1=+{v?@eJ=?C4t-69+R!AQ_f1R`y-&rsH zZ2Ze*p8O~bC7dxp3K&^+%*1c{Xk?giJ%TP=>6)lXzaLqmE=be%0g3CGqb<}H5Hb= zBV-AHPyoTfJ`r0}L=G*NJeJS-x6*g=AfKzZwuqE+{$6kS>#Nzp`|B*(e3*r}yeIw2 za)J#RSof}GW*1{_d+lBtwI0B4I_d#xK3Cw_&*SXYT(%beaoJ;ckKQhR{xurgs*)7MvD_J=6b?n57xI@HLv-%xqRr&hs=@;sQH##vFS4Q=1K(LSH33wM&=tj_A6zKgzP*COE5~0o zD03!d1^rf@D6X%ZK7xqfsqGQ@d#oHiZJ9uwbyohJMui;V{Kv}OWar_*)>)ln1v9(P zGl9>a3Y}HzJa%5Nb=lDJ@dY{N-xq7?08xV|6j2?)Gpm?eb!fBFo_uZF3h_Cs1RSlj~9l?JW2T=iF;MH?!TRwE{T@A;7n9pg&_+TlMwrnjQ zLN{7`1@a*@?Ft|Ll>%MUCi!UAMbPDaj_aejK}EqmW}T!tZ5dq0E*CK6b-APb>G!Lo z-LY*9r(^lSTUW`m**8Rve7C5nepJw!oS;$$R@}2Im;_k&E7C8vX_y&pW5M8Zz)5#& z9&Z<9R=)x#a)N(Y&dl+3+SVI~*bGk@T#V|pt@wbasdokl{dM<6V00<@zv~q+kS%2C zbf?qJndxkPc`o;+(jdrmWBQh|>;#G2)cyi-*egn#CoI%{61 zn8DZl?{zXpF=`Jx6FVp2{cxDzJUPg59giGtRt>12C zX7BA9<$D=v(!zbGvF?TOzXL$GN17mP_j%=VW|H1q&xVFVJ^eXrA{cN zw_F6FC(_}b&(fjhg;X$-9Hn$`DI8Z7+;ddTDtvBBMu-sF~^dEEQ@n zV14maE;r`~`Lkr}UCw(()M`W*o)HEVFjN57uK?@q!>lVZOQZP!G@@8>zdspii}xsC ze0#a10jIc3yLvADtM$Kakag8(Ld_-sqdryU)A@kQ!+B7HDKq#tz8b~%D0b%Y!6@}F z5$8`~&buE5panZp!zGYbbBzLqtck1ye@|sTJ$#FgBJhQM2#VI^X!LWd=5gbGASmUo zj(C2%by)HZ4X_>`*EF>9)eaSKPp=|l>!Q5a)>*B1>s~c0Sn9+*7g@OVBP;LZbIXN} zdT=y59@kON*T(s(iZi7*FPQVmxcIZvs#17nX`HV~LL62AL8r*^`AQC1Z^_Oc>ukWz zGn#!u=Goxz{Wjw`0!1rNG1E00GW|DcVJZ=DM`GX84? z*Ejvvc{i6|M7~gt+v5B>OUN*AmYG2WZQ~+mA zI4NuB1nw-SN)qnz=ix9ol&8U^Q7)^OXz4xHz+QSK^tP z24LJ@8}*?Ijy#8X^8(*#zBgQUdFIY?u`hPtd~cpE(8BVZ69tzhXJj6kHqw{6)d4p| z6fn-Hj>14Akk%Bq0V!Z$RikIVR9<>{=gt!d(C@s1Wm~7$3*B$eXu<_r7|J0Nw2VcIl|bHiolraru%2thdhYx!Godae z>$I9x$mw%?uFPq>^|#C{NJ*=?CKrqexln{Z@X_v6=)&*%C{Bg0&oZGV;soP82N;|_ z^J~t3AQ_B%lc6XFaOUlz#-b+tx>w!`nS5R=%Q7;H2U$_yG>slnvxV)6<5h5(@Ea}4 za!CDou{AC}CJlkX$D5m+Kb4R34gl9;C41^Ds}@o&1oZbsKG>{6{@y{x+@Iw@jb8=h zvplG2KhKOcE3kg=O02K_y+)sRKxo||>4(H1sh{(QlTIi;spb~)^)~=q^B=+bnfa3b zuSv)H^mMErXUy%GhV`5x`Q0}F>(f)D&OCnw)~BzOw4cN2zS>7>FFp|;tA=V~v1*QL zPA7lvkY@)uoDatFu)vrY54&cJahH6kNyP0 zw=ZMn(Vxig+>yfZN4A*=SZ^I>CZs}9u9`O$-=u{jW1u)!9Y6Jas>qYl8Bz0s-n7fe zwYALbPJ`m;J>xQRC8z7@P#m!Dy^=#F*D|whEbk*{>h`rhdUz~!<*M$f-%W+$kCSej zo~6Q6{%!U~Y(IVDB#fPVL&Dhm>0m?@E$s7P9RQ{J6)0Q^P^_iH^oRoCD6dKI`-XHd z{L7fxr{)yeb9A4O{9)c%R=kNZcfOiG^%X9&PUAA8qmZx9PnOAZCf<&>Nj)Lg3j-9N z1PKR+_`W;f;{RdHoppv4RWRlrQ1c7-Fy@|jh81((_B{@->iDTS*4qC=$eB6ST+ZZc z`~Q>n?(tDo*W&m(=S(I;hyf=oKV076s2SUw)>0-d_fo4{c}xM_$oV69(B_hoz(3 zr>!`4p84?I$Qkk8VR^wu+=G6~nEQksF8#oa=ic+EpYKOaP5eHiKLVhB^Zww1!yxe( zRip_aqQ}EICBX3+`E`%=4gMJ;V&pXUr#XnHSxDO4v=>X;zGI z#~u=K;n$vKs+dP^(afDz40vAj{!`5GoMOe>>~JZr8{*Ld-{W;Y$7zf7#67;{fAwMi zbvyDj>M1Cnt+P_=%wXTBI4_uEwz2;IuKBz&?fGNo^EGMDHS_tNwC4|-&!0_uzTJHO zTH5n(n9uvtp5Jdiw@Jc>me1#rBhQbW{f;uX4K(NKQPdOSsdLg0kV=Es7klyJ2Q2trlQ%`*cBNh8$xAb(O2SShMg9^LJeknssK(_R>G?mb9 zH}}t^5jS+qayjM)U-#3_OP~YwIB6z{m)WLn)iOYZy9ix;f&1eW(GTUHxy3oK(*;^0 z{?t>S6`;<+^$2(W#~GjoPb{UbT{{O6zJDzs@rVMxS9spU8PU>bxgFh6v(--(8;Q^I zaNo?0!~v@C+sol+7M__T9?67~N3v$L1YfC$lT4U@*bX;z0{7D?vh>w=PjNk}c)$+& z`+N`6oNx2Ii{n0J!k29N(}!hglgG?`$NfP_P6&04!c4fKO99oILygVMG3p_4a0z^O zDne(MKyzMt-lVwC z+uzR#*g%5Vc?bBuk=DMZtue3)?c(O~d+t}yiu(f`kIB>e+ayr)GQn4!_OAaB=jFY~ z%kMrUc)9#KE$~%yUubladH_<7Ixo@*pCMhi&(w{;b28%n7cunCyKz)&%;F-$-;C z0Ns8>`0CBRnCzU3_R?=B#Q%)hS@L*1Aotyy0kmWxI8)<(P?uzLfx5Pe9At$yxB>O2 zHFiQZ(|<7oE^~Tp`6ZfVUn`~$t^#UnLgIeMkUHlzll87ww6Qt=OA7A0Gqixq^hFKc z2Vo1w^w=P{4Ak{In9*7QA=s(~!cMI~_~N>Y;{P;jhsw~gR)S&+u1ie+DWqj2hs0}C zEgI@bav3pdGlpL+e}*t z-|b3!xAE6npo=kgYpp%xpNx8#$jP_yA3WblaV)+4;c;BevvB3o0SX68I2KO#;h8U-RSlER>JSAf3c)S{D zfggP){NWx>8?&uT*vJxSfpezZvtak2%zD`EEXXbpi z{LNi8yAFeU6WS8x0KVQUfy>OE3Xuc{2?-X2_cAc|xg!%r;eP$}@fW31CjyG@=>SvxYbIbx17o?5r|E(7IcjW82ghnLj znE#N7OKy|2Kwq=OW0QGZ8;ESZ?jSQ@l=*z11$O*ZqSF|2D<<70#E8yFl|i4c=W6BO zsgYo>_oFZA({}KjFgyqG{H^Ahu?(uRo9u7Rsp$91VCJ0>XI!agTUTu5_riPmUhs0B zF7FVrHLY22TKImD(!!|_f>Fl(k0I?0Y}Qn{#fmHA_a+VgbaXh+;dQg9sT`f;Yu=m7hCig)=c)fjB>i^uyj0V}& zFOB&|i`+)|Kf>pIVUeDLE~C{>Yf2$%Fz-Ytdw&LGk^Kpy@-Ieg^j(kow=) zI#;~5knH<3#a9AMK1lVS<}%sw+5voT-66#m9Z)i& zgNi*`dS|ijlgwN(7v1B;xy?3(lvYoM(@4K<3aQ^_?_9BM5jfGdlCwk{UE2<{4fCUB zJ*}c<9($i#Bz$;9F84>2f|jsc@Wyx0jx^^ba!q$k;NK1)RGiVtMYS`*X~ov#yq*F= zhqq<4_ZgY(JqE;a{H7hu=#U^b#-lT@(%W_l-<^xwJ%8ZyYPG{@EfdsPSCU=jw$2q~ zA=#HK0jg!e@#M`w)rG+0C$Ue?PcyI5TeuB&Yx{HnnykS66DZn=$!}G)7lPF9$N&}F z;+pm@zl!TmXn(fmK4@5->(IO@@p`ytNPgnG4}ya%W+lhl7nA@yN< z=ZZaxz!_dd_Wj7#xk7V-{>z2nEQGxNt7T9{&VS*D&S87?D&4n}8NK^SeB4IQjW%pU zIR~!ybKvwg-|31)I(0Vv`4WOb@N>K zxzT&KF(VhiRb2w1h!fQ63J7(NGPTtPp-+dHI(ssyud{Wos9Q+(1s$Nb%Fyo}Vrs+* zm(H01In2K9#?pCd&w~#lz`zGp;x3jqVCUJplA! z#@yBa2_fPIHCq9-`X>-ddO@xJcL;S2F?B&9_*xwhYCF%=(#fR0tpF~ya8;Vwx#ENE z%qT4bXSY04mnFp2^dd7>iPNH2nO@|*qga0)=l5p_X--f*$<{!%0-L%9nA&%S`R3%3 zQco@^ZM5Osq<;SyrdCdY4qhMRv&@n`BmOsMyFrf^z@^>FbdGnvr@VW$-g_(1zB_^b z=O{CJZzZ(vPD1ksnXie*2HRT7uPV~5cYZo5?v^S~G2cnqq4z2-UMuN2&=PY%OSC!R zQf$|cw(~hwyo)h+-#?gdb}lIm+63Nf{=w9f<&*Sv<~zRxa3P&u{Pf~<>i&eOC*>@C z)(p@e%g_>)pe1mPJmn$_5N`T3#66jy_bvlk2ugq7N}x;nncCel&XeEU&Wyg5Vjue8 zX|xAyQGB;Yu@^nD8Tqt;^U;qVVn*K&ZfmcD>2K_T=`D3OIKCV8K!oojrp}p6>i6LK zSqRQO3(3AlhroB&hfIxpm|24SR5}CnAzq(nnx4EBC|{4io2w`91X}qi>*!VripJK; zGN9|WGo$-fLYovV@ue%tE?l2K;(Ay{(c)2Nbl)k~Os|r`X|NPwTt?^~2OR%|F*o*w zJca))+b+&5_!{0`q;GqO8E7l*`Iz}?B{-z{`Z)Q zc*3!|TOi(e)T4VLOYgoDD2M&YBE5SV(9T}gQJ4*Bb3ymoI#+lX zf^$fbioCtmyYTm%g=Al!dvg0>kGH?#ZxiW%$##K90e?Z!KQ9RQyO$Aa$)Uj=f=7Cl z=}~-lY>j+Uq@TLLj6V16?WKyXB?7iL{>tqNSClFg_i>alVByO!OoKxxK z&K2)$!#PYJm)Td%)qlH#8OKLIpS!UZL@Y_Q4Nh;!0M%I|TRZwZ@+gj5J~CJDxFBq0FynE???7Ko(O0CX z9|%8ZL)*A)H=MpY1Jqy0gy+b^xu6b!eZE~qUT)bY)(67sopX);lO4>!Hj<HTs4NB4;gVphv8^YGSUQFQ}0SX8e76 zuBc$jTncS)`ePfY1oao5|6k}_xiGFXRRVPE2cfrgahoVF8ra4Rq?e$TwWs73&AT9U zs6Kvv?&jyde130TqnGY5=io@0gX8};2k%VO5g^(vL5W{>l(flHOC%+~q(-^Eq)Q>AF6D{EVWDc)YY~=m*&bkZX-)mRfY@xPMrmg`}YSFj} zw1ii?Tu&;tqWFkepNZE^wH0}_FLSxvwO#nKL~Mk%Nm{~+Yb}I-`78oj0-*6gA=tPs zi2FfMf>YQB%)D0jUVkmx+Xs@0J^KE3W{7 z!vFVdCA+)}uhW|YV*hNKM|R;pU1#p4sE_Yi2+lhEZk}=M-p-6~%A_!Jw4S68b7OEkh=HI@z{zuJbl;c4{T=!uXVpb_yFU)2i>g&Xa8nzNBy|H2vjYL zl;YYvU?-)Gpaq_iN$G#ea0*uCFDoDgMOqFiU18Q(U9*)L-A6onlZbTD?9>Yb! zI4(xMtbcVoGurGte+kc*)#(&A##l}%C4YY5OgR1RD?r8Z8%-MBzLgnT5h*<}4~{op zK}y5(KyUh4^#X)v&u7&OBq9}Q2dfv9ugYK6e588891!y*1d5uPs&^@%6nPh1uOmKr zew>BiEZWWtob%b632i-cQ-AL)P(7LOwZc^p`rUSJzr5s)+@gDz2X_Slrb^FyTRc#B zB3VM{V1=xopDpWxU-Lzs-~1bN8}j~}4u1EKdMWXMPuPRv9Ij!M8IeNpl}m8yq>>*+ zek}J~!g+l*XbF^sb4Hk>UI*#*}0`;+f3O70;C6nweSDHq4CKnWPl=kXcuf1(yBQzKt35ZAbebOnubq z^WQ_vz;VzHEC($Sw!`r`Zn6Mn)%S;SKeCxNy@>BIaDTp?*Cstqn;q>aPeh$1Sx0_2 zJH{*1qTVI*bgPyL^2@cO%z!E26ZD-H?c?%kB7IwjnGt!56@LT3mCk>CimZ?E;F5W| z#eZ((zwC+p_df3VlfgICOybqK+1$_Jf8xc)VP<%;z<2g`LR;-{`uCGSweWAzvREPY zbs=UT&bwsTi+Y!rOwv*B;yLS;=~4f%@MlFD;5!GeAPYF%_sr9mY~!^Gj-P9Gv?ELr z8C1;<9jRm79%9Cv$)pr{s=H~9UM_Mc6wOVcMa@{<>l^hOw=u&r1@v$Z97lXu^Q!<6 z6SavkciUD!%`4Rch|lCQM|-kD)`!I%Wl`$b*MxYUW;({JdvDZdY-7d~a^A+|3KM^` zWgY2I{%j7%Uj?rrp#^RjW=3+gsNu!mC5!azZOoWA%G^l5vx=+>y5|YHpS^Ly``%&U zV>Y499N&aC`NPbB3(VI$Th@CNd8`)HwHHK8`Po|ub&aqN%ckHu;}&KNRuC#Hq_o-w zA+H1~hwn+zcP`HF0`uY8PIj`6V~n}09l-rbc)NFeJilsnHiY~NsI6IW`r|>S+H%P* zP9xLi!o4hi3h20paat(0qF)bPgl750`fs-KJ$mmLE>)+Fd^otw(f)6;xbxy;Zz4-=MXdCGv;fRrI05B)UV2* zw#qhsPtYnmLXk}Tl=(SHZE8Qu=X3b42XNuLL;>}VQKq&!A=GJpJ|KbGY6qTsxit$y zjc3#P2+r3lcn%71wU$Gu@eEUYbC(0(*!Z7?18no?5HqxYvSPH$$6)xwe6ELb z8oZg=9!a^o=}z&B{hoP0hVq8fSdsO z_(h3cx^n@)bMTT94#O2&nSpC%dpqkGDI*kl`nDdXYMG?;35ArRu8~LbinPh3^n?sW ze|?nfUpWPB;Tio(H&eAKVqA`|+r_w-ZLxfXL`?Z5Tk&^6w7Wt^J0dY@lZYn>+8{Qz z790!o8@G!6qM^f@~M%}tUcs$zQ>C1?GNx8Sf{+d zTflLcu~ozdBEC^(ShWl-ndBH@#?n#dM%a5w2<=(sXt!W)OUXy^RWm0!$e^B^ASccJ z@ukuUeDgMCM)ED@v;IFMX@SQ^nOl8}b=(c4^j;vPopy0?^!bO=bM>< za?3iG;PHf~O7*r7Gfv81(tCL=bWwZmF-e^NA>Q7n%&eZ1oZxdzi;B<`;S2y@}(Zbp6fxihp0EubdkBY+$9MeQSsrE(gR?*JR`I zalW|rxZsQAF)nkCjmaF(LcZ=fei(D(zCY=8rsi#WXx9mQ=Zbe0f%C*7vac&koQci; zJyY|4pIL%B7~0`D{{eZLjyTvZ!Ljh`b0_G2%Qy2ol5so-Z_;lKG2{Gsu}4|*X6a_J zN8#FOQnUo(!FHvvkM?j|$W}C$rs`rsr}BmHJ)obMuzOw;I6p6w`c(KkvjjiPKFUdY8(X^rw*!?ni`+Xz;_Fw`e0%3+y&}X6frq>n#0&QKZ#>p& zMs(Zll3X}1iokbXyATVI0a5${W4SEwu>`O93wmn^#IZL ziCLf{%x|WTL2l8HY~lLAv6B_D-Zxv;%fEZe*qX z(n8yq9(T;!u}FV}F}L6)^K4{JnT~dM9N%-mY0YZ8s!ZR)m>c`Ry>QvP!WTxflhP+- zQhM%Pq2qtkPD*=~ydtYUFn{;8GJWY5W^5lGi&Np}sQBMNT}8Y1g+==Kz2xi9Z`;D$ zs2_QvOnty6bR_LL#&x8w=b1V%z9$?zskjBrmrvA-1IQoGa@~2n%>xtL+&0Jz&!Mz7 znvcsrOD`gW%!vG$6;HXq+^FYiKVn?}dyfeiKSj7?In?>AcwY0I$Z31wk%JTNr_U== zw9|}XwC=il#-4{yt8@0nt6|DZ5aoWcE5oWVsz4B=jHaM4%{VbdlvpB(bh zVc>aLFMUwN{~_%2HkiJ5XrFH8d5b#=KU7Zdm*AxhHc+3CU@w)y_tGY2)COd|^E-?5 zM!Occ{y~u|WxUq6$d{6+4C_DB;&F08bw9w211bIbGqpg$gX6U! zHCYSH+r*4dOh2c>&CD29fXB;xR}sG2VF~u$_aHOk68OGl_N9GikzV7_0-0X`8HOT+9oS(yzLRt z5@3TD{kbAWwJ@p-2^Y{+jf4%-+R{Q3R32h7s zI(lv<^ds)i?-uiXZL0o9vpr-Acp(?);88n=?Xw5Of2jL(ml4`?hS1b@+=u*ruD^1h zc5MH?452?rpd#(41itAhbm*R}1)h4~;&j`+48r(s^6l1wjf}Y`r@ZIQ)&eaTq2Ixc z!awEWz76m3vwqeL$G-$x;6p`;HcRkQ-CeS7=XW+z`-KY7>(+qYrvP08TH@qnh-ZM7 za583Gc*Nh%nnC|R^|4*_QJK<*l-|ct>A2PY%re>ZPf|pUu$2mr$3h)(pw8Alph!i7 zHxo)XWtce*?a|?F_Vy7`%QvcigBc!qaQ=~vrZ4SXvR#it3KSbSjGQ>|RGox0W{T^ld*!k8UN0~v)ShsgJGGoSW zvLC-s-^`4{nGmY63qN4ZCTeX@m$k$JNlO&krfvmEOOz_wf!;Dgv2Sr6CHj4mF+&?> zzTOJ_uVBJ|Ja_RB>hx~YhdFPob`$c!!41NH>ly{rhICwfSquCM_bRgvcyO4-g8M3I z5TFBpCx=*UYuY&Z);PlWwpjw5SYjAg%waI7$YM`Y6n-Bxtk|L_OU(GQ55=B@^GW_Y?mMpNwoPK+ z>Ac83_09&dPkn#AnOjoHjp82k*@MhDCqr!NMzPkVXi!ciI>`HeD<)SYC8_0Qb6S(O+$1#!1{Gj!Js> z&&3|$+D-Ob`$YQ&W(*vabuRx?_K6Y2rYFt4BAK#R{L6!;e6CX_$mgdd==g~9{|xRY zX6+Yi&GwopcePxgBZqAI%VX_b(QYL_Dtt8->GzuLpFRZogm;t~(QN?%f6Z4w$9;$I z8IYsj@gOsvJOq3WHMNr7!*fm)M4zgVCiG$LF~l4L+obLX>&!iq!&E|Oui}n+%>O;P zBG&)Kb*8U3KHPxmPrNq5S{vFYpN+i~o&o zc}Bz$t##(c6$lX?iln@6(rZ-)+`Eidy|yc|WkfRnG{0>yrnV0lUfmll;s; z_*o`ppaU}q?M^xO$NoiZ&TG%lz_ndrKYrm6x&1;j=ya34eMpg_xc<7vVsaF7Ok4Xv zT}C^P$N8;@$GPPhagL;KWCptjXkIpSpj~?QsH6u^RMK<3vMzbbsecmkjmQJVbBesX zNPp)6W(+hdx@IRYM(psSX66&YcBeP;90@P>9+h?3p(T>$|H#t=vu*m>*%`WZwzcOK zW^~#_O|`z2=G~Qt&_XEa@5%smt+Rl`(tSwQKUhiV2kW8zL&Y8Ko&r>wD(aIX9cs)P z{wP1ZcTLezhWz+J?zbDu*kJk;bD1sajkC1?pU2~i^rnp#-{elJ-a3D^L_QxBDM$DmX+Hu?`seq>!)zy{k$fDdff(Q1o!!= z546C`oy_#D8hZF&EI<5y$NB1$4Z=sh>1r)71;F+4CWOsKVVK2g(%zHikH7bx z`JU|20?3Qpo|rFD9%vv`=pIL_m-gHKw8a-`Jn#l ze&OF6d=%orMU~VeLC352GXuYK+{v@XaF?3{;s0RF{W!wE$VQW+EOtX0{M{uY_9Xb2 z$S>C>fm&03U%W;V_yn~g4iXfjE=6SMkkyKK8OWQuB~VLDTo1?)n~~OU*Dd3CdD6s7 z?F`|AJ2f4LDQ&-Jwe^VDf!KP}rUi(}=`<_T0&QkYLQkE-<)+4WC7d2 zj8?Pl(-Q3ME+_H610n|v%9;N4%&1)^>y3UbfPGu=Y}jyd8FR;75dJ&QHDKj+cSS!# z+FfA2?rnsMvk+Ibcmp#$7npD0kX`S&Q88twE4uyx9_Qvu{+Yxd#{FlLu&@5Iff+lT z9{qz&gj%}#_GPk;y84I8wCG929c`{s^zk_D+~^)jOLPy5I??g<%xHQ~*1Z*4;3p`z zHu3ycdl4S*0uk4i{VQf@{ml2T66_5>EbFn2pa&%_!I~ZIGeAo$1aP4}H>fO_9}dX; zogEUKiX33Z!_GYY`c2Gu#5rBZJ#VLTrXGGz(qma=rVpu>u#i?SP?kpT< zrv3r1_a>coj52lZT4wZaCbZ%`)&WYPGx>9fC+{RQIR)s4w{xFJnp{R`axzeqBgssl zA1JP<62-&J2)@mHb*^67QBhXgPA;E zKbM8XqXqJDPf%b}FcZ`pK?^)P%G|-{WxaPLP{ecNIZ@lApz^=k&N05ikSJKE}A+L4# z`(H7ma4HFT2bmg-E~Uu<7VEiF+&y(~CRE+Y3^Krc+j9tg3n2E>bm@CLIKE%RLW&xAxYiw7 zVrad{*NWc<)-&TR#@r8IQAz8|y?RbIgwd{bH<10U@-)t`nk@1eqa4F$?Pfk>>J`9Z@oiIDfPX{^);F=oe3~<@|A)*QPEYLyZ!sR_ySp^(i`8 zYZ~nxpe|o0@c!ekK{zU? zE9<+yJQ{T#WrZSom6H- z>nd$}j~Op$leEN9D#kmT*;)|ewDp^@nio0qQZn>(I$CF=bZ4=o)6!WPQFb|2lEUR&%wuW4m{anE#dQ#9bTO z5c_3`{+)fkCVsi#qtih<(Da)7U?cRW>&D}A&gBA~WB<60im9Tjz^ zEu4w7HJgdEHS3rg`+Iopcz^iYst0*QhL_T79`@`9{m5FA&m~Z|0dypMZxIPPcrN>O%s_dE_}N%1#{VveSlEI!B2V%Eg}*HL zl8PKnt)*38!{t)!&NU)F0qI!28+0kpw1MBX>wj1)XzHIMXxdjdcK>?OIR_acV4|zraV2B5}Wh`9EcD>wEo+%Hb>xY|KKB{qm@&-rO`62!Eq zpL((&rv21UgZTL~KaJq$FZ?u#pTG7~&t!;czx2}}e*Vx;Ba@*6ZRi-s+q7u;R4wqW zb<7A3W$^rbkvfxiuW{%#Q^nnG;o6D!wK)K;B97k-8X0D>{dLUfnvx>Fu5svaHdDV8 z--C&=@G5+7XfZ|lA?26b{&9gxEA}gQ#j9J#~E`E;BUK~cAjIgKjJ#V-&uC5onx`zGv@v$ z{?4&ea*oCRA7k!*{Oz<;ILBgLjJZF=-vxHsd6va~#hAMnf9Kh$c9zBBjJdTVex4&E z74JP$wZPSg_si|P-dVYccj;0sfcQIz@4fD)!7J<&V&BH(oyl`+(9V?1HDbb6 zw!U-i_*(OPz7{X<=bvT{21{P2-?MP}{beD)Yjd=K^2uU43n1PL5Q8j~We`VtbxIH; zpapCIF8QOyGzeuUfHB{gd`rvs+Gzu|p-#}4jIs`-G2mxG745vhI#4G&dq~JTUVG23 zB>)Kh;hJ&Xn)8=k=!Ui$fqTg=^tKmJZk?#4HKU8E4G7Kfl+#+diXyMn6;#pu_2xdA zWv717Q>pjy`P8;lYx>l~@_itC%F+&>>x!-$J?zP70 zW=qL0qL}p-GNN7yI^>bX^q^hjY;URIbv$E8zhICV4Wk)!z62de6R@K$mKSZZ+Q?P( z9&97qX)(63SJ7YwwwV^Kx7ygN=u&KBw^JXsL0a0lP8Z!`wJE5gi-Tg`J8jT`YkxbB zuY``q^O^drIa*+CEi>?YQgKJi=V*cZ){6C#lqcdjH69doG{wa8pG|)xRwHozmg!GF zTqD-|f0_OP12tm(zQ>pwap2)~;;U$KMDQcp0tjz#gmrkv@_PteOCyWN^6No%)mW{( zoVxKk_TzO|@}f)XggseR_xak~)*O)jwWEu9EqR-#oYrJjQIvImS!d>}y1+V+H+Y?l zoGMzES4C?Is_28YrvJGD9aq#b!!;8w1xX9+lHgSSK&F21N-Yr1=`840@}uELh0n)b zHR22fWQcid$7O$c5P1Ikt}C@bYaKJ>i=2};eMQ`Tyl$SAks)@ph8fe$xgqR0Kb#xRQMyJ8 zl$rD6zWbMnd~dT&+`qy7Ss=<~+|W1-$hXIXg0?tDG-Zql_`6mMTv>PVdl2k@(pMn- zGqV=rNhP0;gYpw)63Qc7FF4;d&MMknJ8nBaR?Cb$lmBk!xSbL0xmF9D$muLN!Few) z`X51N44HQ{C|@ktlFE!IpZj%M0KS0tdT)bp=NR8ji+)gT@m(Ib&5`eFOulPk6YaTN z@?{-yU(;0HPS!Dl$b%)dV*FzqH(MlKx`FHL$54-Xzt+sPcfH6vhx~E$HsQCDYAe*_ z5gMFD=v>t4F0lFdeeY_1M^qflBh+8ZjGC>YK6+FFb#dC5Z7E|OF~^*BxfbYl2>D){ zMQE)I9gUoaT%3paxszG9@V^;zU!T@z&AjnGUo`tf9_nYzjq?vy^O&^QthD#K=ZXHz zTS$;_vn~uV_l+vTI;N$)*d~hTIf&K9(@$?f_okA%g!qL z<)FDI=h(UJ+9hAS-Z$EVxSzm;dS+rxCQRM{sN#41p0_F~JnQGSA%8xyc>H-J<@sRB z^Jh|?&rIp3({I|ChueD}qek(^U^7R{O z|D)~JI7#SqcRc#VeRoaL0iL62lBI80D2hg{XGC` zkbwR^K>sXBoR!Z4EiuTLyB$DLhf4wOYvBQht=)5H;+gl=8+AW1hPX*MB>ZU}koWXP0 z%^qc{oTVi)Rx_hXCbXipIT4hV7QYL0-d+aP7HLkbk!>wyVCz3L!qoD+$jh}GXTR)q zkb21h_38QEzI}nIP31C&?<2R9%Sb0a5j{0VLUBJE76YBz6@F0G*)egFNE9!bcEAVp`Q2$op zHx?`)w5A9s>Yuf<2rU;i)iwM1ID>K?gC-J+(9-9_;wVD~Ns~xo0Jdf*1 z%ct^?1jlesJTW>+>^-ZNP}IY5y!Bhnvuy=p*bdv^ST*KzwDrfH7ZJMBeBPM>v4;x8 z-QSK`gvys_iS0$aCTm~>^|={@K2!j7$1I@Ri-4xrtV4c6JkOe>1<)>OsTQ?!@LBmJ zE%2>s;ct09#EcV+xg#>6hMiD2TS+x=%ui+!+U+Ft>u6(VneSz3f%=qwYO}P!4zr)W z5Hnu?ANr|C>8EzG7FeIsPt#;AP-pg&2r=W=jJc&%OQ@uLz7E(y#*E~l5=?4o0Ew@^iio6_fx=}6u0@m+j=ZKs1~^(8AftbXF}I>Fp%vEy#eOS- zqJ6mpYGz(jLV`@*7p_JBHH1p4gTksM)MkTvgk=L`DvpWopuDTI!KJOBZ0a6msvY48 zB0P59hb+Tb+e5=l<>Ovsj%z+|l0cRCxDtP-ZiuP=>j~{K*J=ibJ%hvkPsZF=(FTBU&x5$Z^T9atD2lQ%CcugYQS8!fd-Ne-Mb&pwR{CsLHu-QO= z6Jkc;ccs(6%K^1ER|}w=_|MTvIykii+83VH;?BUbKQ0ULT9~KN4zlHwp&AAE6?gPV zuFxTmtrl{mEX0hHt4*D!BTFw|4&2U^Tw0(mXz9bQ2|8!htz74Geo@U)?e3+N=b2iu zlm_iUYs*15dT!9G!QCH}CA|qiWob2L8xPLovCfE}q@BE|e7!00l&rK68@!mz>b!+G zP-ai>mu;Zdl*@XVB6y@*nI1)%{p2cUylDs8dUp<$Nn@gQMGlt(>``b>D$}FvQK_9h zDz~2xiZxWseeR$*m_=xe%iC$uCbt&&&T5o{)1n960#A>bcsjR*8Ap*PMwlv9HzgWn ziTgafk9$m}Sff)yJRfmvLZA6sV29ObzUVV#_L$O=F5D6eg3`$`Jphx>p*vi z^A=aM#!l$GQC=61T5GqdKntu~Ep-3aw~XhA?bHVB_pph#1o*cu1-I#_>4 zyzn(8)MW>?u*A;$-<}WQZqu*(4;f+}p0(nAe0IkWQ!U*;z4le)Mo?Q;Gvnz?Ae=nU zid~>NQC_^i0zxprR7dKXdmgy`$?cPoN%}XdFXq3WAHBZ{!vElBHTls6RS=GxV?Jqy zz=cQH(HyQ#!%Xcu%T#kOPC$vBM(iXmJ?)Pdst{_FKyAwapM48ZK!Z0y z9Ogp&m)2Y*P_-NwYlHt;?f%1@OGXuhlQ$9?%zzluM6wYY&w!Zs9E*8D3rGtf{v7Ui zw~~0<$dr=z?}m{7QbCXNiy`b8Wj^G??h8zXD=TT_0*k$L-$eY@+%k^eYpYG)*K94| zm$X2;*>@M6Qc?(co5%&G7TyIRuS4XpM}5Du;O>XJ?PARTS`6WCgjeuS+yf9#@Y+IB zf9d|l1F*;6?geNm12^|KNy^iC9&AhAHE}z2dJ7w?sXd+7C|tji8OcXToJin9eBt`$ zwiajs#8q$b{=B^&~igHGpzS(a!}u%{szinFHCQ# z$pPAVfyLl*EdcAY;|)1LQ7@IwWR~E35Z{G1posGV#@xs+$qZ1X&oWDp?vh*J;O9#q z9La-XT%T>Ta15UJzu*54rbg_97G49VKmL@d5huz#@tzT<#eM29rpF*^rVs>l@t;`C~E_=R&;TkQ7JWdS?|g z4*nub?;M@P`)|8L3*56>$lN}qps4)NluIShoOKesRJSHeFI@~_97Fm+CAG$Z-!7&* zZ-RL2x6JtID03e*`)vEF7QjAv-zKa_E*ED`zaAAbn4u8{t4RpcR=V<3DjrO`tH7O9G}xy zPn6gFqs(2n3PQ+F-%oq5ZPoaDlP!L_TnoH6%G~gZKkkvh2S4}6lf3R_ezbH6gf##k zL7sm_ihpC2x$DzmsTSv06LQF3v{vHJ#_}c(C{j_I8Eb}n{EW!FvAWdf#^U54+P4|v zCvP_EH%LprdUyGad*sqtF2%$qp($&tAo27df1tuAB&G z*MsA5ZnWT>r3KK&^(Z6`yB)bWmPa9_Cvgw3LFf(ubtY&5Z%HN98p!@+8BjR7u;uLS zK!;|_Jl^HpO5paW@Cln9y>2RmgElDsW7_!s(D?XYF~>i6sTTMJj+HOsUkYbJsL$P6 z@XVIWmZ2UqQ_=$6_&-cD>%O{L4$BkkzP8D(l)A5?-od_mMGQ)EB~Zk(_Z|_$RioTh za<>A$3>%@14P?K_r8S+Om(K#Z1?M0ua!UltPDCUqekN@WZQD}Te;TjvK|Z{lQ0ScB zlDr-0U~g9Ys{p?4GD7)tkoa?i=iNui{*%f~epYV-ErH`Be6v7H*g?S5Y4Z3TlBnJM zrz!|{e#(k>roq&>L)5qM+(T$YzH9yyGWa~)HYteW{H(rlUN)QPTZ6I_C_C4r_w|q# z_?#hTCBhNm=)LENq zU#<*^ePEDuHbv=^k}b=8+}$1aYkszaotfWJAv(S zjerky9@h|QPIwe(k+LA%y_v-Ef4>C2?wdtEczo~EQRePJ`@gL@F7sX`$X`&CGc?Q!km7I3) zyel?dTg`SA#BC`)2mdz8+?lC3ze>`j+Hs!Rv+Ck^QR^!pjD4US8MEykUrJ|t2(D^)?b5b!z1FO=h)!VhR!*>R)%sHsc!&j6RtBa=LyjL0P*u?jNjRd+@VKO z>XfI(>;=EGl%F$gH)9!VzO$5ifYf`oKt1Xtp1YvllPb>()9RZ!K=rR=2KFP}HC{ie zW|XPHrB&23%3{*jn-b^W1bv4rwOHdVe~{Om?ZEN4&KCjwh7mKDk?9NiOD1eaj|{OF zR;1v1i=;Pt$8ml27vMU(LfmZ~AG=@6jphuE$6kGcIt^pR4J#(mh7~#d9^LXs`|n%` zCr6nN;X@m%Rz@2uH|kA--aO2VPRizgoD%12ok=1e^(YWU+$)bS<^F@+63owNZBEnx zsn3OsmNj92`rT&gi7J=7b-_nZ^)fZlW!v!E1o}A74s6HX>+ggL-Z&0O|u;V3y;uIFRYOWYZEi zWPvMv4Zu_);!I^iGqNBY%o+dPHwnVQa`CPO@3mRr60x;#I+@wZ?@?q2q2MXdk=JZl zTA~c(ehomKz1#M*a(~^+%>c#tEP179@3jHXQ7vT?DoN1cwZU=Ot|dGmKMe~e_Kmb1 z#XaRNaTZrNb|#lLkIS_{FbCqnCeRy-9JJv&2W^<=pbZiOYLh&JpX0>uWyY?%bLfCP zqvh=!psBo&g#7uaYwwv%9_|`qDt?bR)uH))HKi zLpyUsjib(l)Q+~`*A<|@#XWR0#FslD+_#y;$q*}cgXZjF%&h{%aBO@JWg{ri61+Qy z9^>_eT~U-HomrxG3+i+|5~vmTGNaAI@3oK~d&^(AM2E^t^sW^bm(S1oA>4HS`SHzKp1I)J=hx>q}}8?-?D zZvK88`%Pv-$L=DC*C?)*S&Hj+Ns(IU-OO8zz;1FlZ7Ce5? z0#B`ChDU*7Y=226sBZorxCriXc3d~^mND2Me?HP6wl91DKc63FD&o+h1>zrRW6_15 z4HZHBX){i)6Bh6|IUM)YbIfS?p%m|7%>Bu7W^{k)^SIr(V%(?Z$Q&);w`+l=ehB}C zG57n+nSu0dyyElktx9>Xwm|se5I=;2pWPOJ%Lx=dx^n&m8T4UcNrU40iT^_ppV;Vt za0z2>s!WR>N~`T|)o67`=IQXjQm%7Y>kD*J;Roun%%TC+WC4u_ON6G$tyOy{Yw7}Dk=080m&uGzd3Dp#c1#hb2`K=4V)jvrA zHEb9AM`XFk+l%upzaI3)eOzDIi*vs$W$ryw#M~wSMean#*1Yh=m~HV@4xy0@=%_D( zxWy;lNm^iv$+w>(PvKfzEzS^9V-@YI%y_90#@qBL1so3lBrU*JGNXIrBZJx$LYroj zxEG)W+jM;$;TilxWY*KtH%0=*d?gF7h)t zM1BU)5^O#2+#NNDHrf=dzL^|AVXMk)XMENiC;wojvD| z2PG&*-od_($e>#JE|E^RWkT2^Lov=h6Tro5KQ0va)Yf^$HKR;zv+{KeESabi*MYiw zIWv;4jGv2eT^{!p#@sdEucSSP6usw0put6z)Ng|re&W8v^&59p4j>gJGod*6 zm_HuD&nAD|lL_Li+zu+v^@G`p-rKC`)||ftT3`<1X&cZVntmc*wSk&kPiUbk@p>-* zbx#T(>;~PtS_@1Ca3zOXNAN3^wEG^O|B8Qq?;d8{x03tc6(Rih472&aPkUclG0sO- z_g-AqUriu96STyc8wo`|XjNSOV8%M*n%&j|`s3Bi7&842f{#gjou#g?l9gh8J!l6t zc{8EYK?`7?!MlZTc|)z81{2xw_Z^yOB`XP4*}60h+8(^yEsQ$vaW!oY612Kn*@B@=thg2DQ74(38A2 zaKTva9JJ57oZ=ijJ0Rk5-Ykc3aF7-6PRDtp7MPDXe}%+%9Gs^o71Rx?s87=N9n8Z0 zLV6>4Bcb6evacgY_^YqHPuMOS()wzv)dG>R+U_DYPri>CoukaR5b?99lIy6rj;;FG zwV6-9$8Q5Dg|PLI38>9tzSAm?v!){5{vB};FVPA2=}CM*l?V}{2D#Z~F^ zS~t!MN0(1LS0MndgXZ3fu;P5LFz4h;=czSjKKvYBk2Hb&i}DcPdt((d2xY}*%=;&P zhYVUGzZdk_5zvp~|HI7pOeW}mWXyd8#%q8-2%-kKcaW(ykCFH+8+@(W2BG!=rh2pC zYh^YF-8R6~n!hiJ%#qMQ6-&o56>G>l#~YNXQaX2wSF82P0Pp6 z=d64m>&hU!$UK*O;qOfSVcNMFb+;CjZo6#RQpViVB`t6V$}E}0lg$uMDp15W1MO}m z@xrOupG4WVzNe)abyafE~aw+QtQ=&<;_CIi&> z?}m^!1Jv^^5Kp#{xMmk|nD#OV7hVs%W^nM}?eU-ue0|L%9#jZTRsapoucUiqh-+vY zRp34~Rp-ys)^y)ti2GNFb=`NE#6QUZRn!Zc7M%rJ0{_46K4##5Ng0ZxcTdE1%@!@d zV@G5ykZghY+h)FkA3ZB_&Eq`%!$QtPo@GX%Ej#qbA;#ye4YA@mK`rnmxBG2HIA%F$ z2`8?d5$40+e$W!XM}8V%zET?$<6IC&-4%rAbHO&}R|o#TQs}ej=0e5 zKne0~iNJ~G5b*;D&xtJI!>}W5PF-8a`RB8H#?M!`Fy{6)ko`C&;&0L_E~krMVazS= z)WvgU6*GbtnD74&KlrnS4wFi&x9=5ndSJ5P70=`pUID=?S{A5Xj|v!(eur0yd?^dl z=GeAF3!EQi?({K!ZI1Ch09DK5HF@Zt7;`t7^ZWl;d-w3Ds&jw*v-h4%LI@!wlS~L` zW&*8{T5EMC7eKORl5hzSaM)g|woDQfj`S9(ib~B6;V3n&WlMA_*d~FtnrUsVoml7e zLIPf@*cL_)ZBIRQCgG;37E~Y`lC0me*4mSq46!}W^ZWjl$=-Xd^{#il>%FY?URn!? z@s!Cku1Lk(X3ZBHqjoKq7+L|0K1%JHmDfMf**Y+s&wrNZ11@F#ts{;hISuOV!FuDk zj8N0h>c@45fxL{KE>s;I$XnJERS?<+`4E#Q>wqEePHi`@MOzKy3tyyxfofv-Ww@18 zc<$4Dzh!fLzTW7Q5R$l_D!tbYs2)gAkD(53t39uq%V zOozUa7=7}Z@?Xht4Xhs&1i67bK*={oG0h;^JFqc zU8&>VY>xW|)0J*Y&|0}U)=Md4^*^Zj9vq|g*sbE*+*?Jhc=o%9>A9PT(P{;^A2nI- z=^cRH;g$3U=0Kk_30+i}U6)uF5@vnz1Lb1$;@(@b3d z#|<>#m2i4|%!f4Jobh!n{Fm#BbnZ{kj&vBYYB86em~&a1+V8`fZylv4M%=x<{FEl>gfL;e$;KsC%=Rc z8|z$~Qpv{RH4hXLKF;e2&I(2qOKFKY9*-@!P0Vd}%G{ifXuhMPrtcTiwQbNDPFf|n z&H|yFl<#Bhn(y^dYLBf*+)IG9w`!5bl52Ig&Rq{;&)^1LcS zhWE=wy!L9eoEZMEX7jqY{`<3eotS$DW`~9Sf}sDNY~xQO)E;e8^ownZp3i8b%G5`z zVSK=CZPLSRtjTOu+H_^RICJbtJ#&06+3vdgOZ7(bxfi#yewE0f%IwDdvNE)h;r)&! z#(jIQ(a)PT6NeQ`&@Ut8|7yL_C4=9`yemOHs3zeo1l@C$=Hod-Yo_VsMj^)roC!T> z?sd#2fQ{#M%MtZv9C^fO`BJvQcrMR_ve*olsJrBsM$Brfd9uU7|ngYmC@f1>cTue z)6^lH(0l_`BA+)Oy9ynSi`32MP>ANf3sh|=nrJJwk5E;*K-HM3qxZ^a-!I#SS|xD~ z5`|;JS&JWq<*fZw3p(-@L2GZC2060Mq%HjbKIZLTHgH1!rnzkqeG=s8veQ(4ZCS$UaFo+9Z9u z6-Tyb{Lk*~7U-RrHMD)_p55CrU)sG6MMF(iZsSIFKj7f@b|)~@O{sc<-v`bPCa+l< zG~YRM-M;c6HT|?~yrvAZZ~N1rHhj1|+?s~6mWQM;d*}Q&_}Z@sKQth}9SV%+DYd_T zBMrQ}me~vYC$#AsPA_|fQhPxvuIhwMRDIa8C#K8})>^>pYP0}DrvSAC;QEBqA?D|y zRQ)}r_D=x@vt2u69AfMH!YAf{{j+%|AZlQWGY z$I4+GzZc;X)i5MWf`>k9*0(UyJB$2POSoS_i|O0hV)}MEEl^|kCVV?d2GpZ#ljc7R zy`einD{F6<%#U$auxt@JtbmQ#kH!dw8|sZt1w(x@R9Qmr-9V^M)_h$u!b}gJZSvt` zl-eCOQlZ_ssDjyiW}ip=8?rgS{M1H&#eZ&eRIqhp`dcfds#&`~GGfC2&&BA7%5X_H zY>V8lNbT}%+ai8NZl{d*E`@PV`4VxS_8ElF$>?Qm-d2RI|D9o~viD^&dbg$Ev%g39 z1+(vey$~H3rLG3L(HT}kNHQy}2R+tXGSSc84 z9ieJVxz#vCslDoE@ET%`>BOk@6XQpI5}(h*Adc8MyR?pWi01U z6Jxz(jV6q#{6#n3 z@63ZbGY@Wtt1mA^N7PEf#cR+^(xI~7oDRx~(U*bVsFfHFS@>E;7a*Js*jlDv7CvE) zTMLBP|BWNm#pc+5j;d_@1IQ?&R*bJLp!wENYG-un$z{6Ztl+AovAMmwp`Pup-m@2J zZt|qedU?x@XztDtZOB4&bSZGLJ=nl>^($%&ZH)F_@TK7F`2^1HRTF-#zhpN5 zhI*rKn1?X!qXE|+XFPjU}O6V%8eKL|4vo^N6W+7->)e1 zuU=x1zf-<+8J*n9xsjl&VhxE(S;JB2{k~qxQEiQdj3LsoC>7RsT0-4A1WqW87kn(O9ba zq%_T!!S=*Csvb^h<9sdAX4Tq>KD`%5sog7~JkBHg)1mgIjv3K>Z<_dEG{^AqtJJyw zAu)z44%b}nKbAW%Dr8e^gsKBpVrcw6NIAs#8RKs^?$mYJp#k4FZ3M$K}G`IQ|YZ{2lX6)ZL1ce44+I(ysrniFQYQ z37_WNF`>6)T$k`+_WxQ6KRha)2ig22xMEf@A0A&nO^d9S(9!pEk=&cdz9?nP z*xyAi07j!2qUw4|?E}n~-`H5;v|xsFHgctnB^9lJ+iSs*br$@>NvX>He%37EXO2<3 z=?8RW^(DE|M6NqI*w4?{L|){*V03V4Y+nhd6WR1T%?qBbr-9BtNyyHufzFD@l-z4F1Xzw-p z`4ibX(~Fs|+F<60C&6hupi~I?=7_La<%81)Hai6EI5gKB8Psai1 zM=7-@pCwLF#aZGXE>dnEcRq-o&IhF)O@^^66GrEQa?hDbav$DB`Pr2#elP80`_jDA zP0fWko&)h#x#va+hmW4f*7GZtaGNsEszum-_@$h;=Pc06VDDUDH4^#X1a0~Et_=5D zaij}ywd~CbZ$5w{EjL z?8$zBuwb>E$?zoaVf)IT%*z37)k+^C$c`FgF;hgQ=-i#2WdV@mC^L*ntUoaYcp|F`kPb1{L3S-xG9$SYLA zbZw;+3f!7n9qv=$UjJB)u^tGq|A_+kvDGxtpDp$?g4eIF`(hZ7r_LdB+gpI4*8ueev#{= zF{%`tiCzn1M6m_QcWaDFd*|+GIgDtvtVb8Zi0+g1XcY{yVP$w&nH?;CN#Qjr$*uK9 zaSqPRyBg|&Okz+OXO1r<#xZ+mQB?Tz_`0D*PMj5ad-y#>I#e=sqMw_x*7RqvKwWEr zYw9W*;O9B>q-KWQefQCH48L+2?^m&DSrBn5HGS z)*Ft?H6PiK6<&T*z42pd_=U=pKAe{)`gmbYqP7O3*EAWnclS)`i9Wo%C;D(^53>tm z%BIB;fQ#QReV2r#41@-5B8Jm~Bh@xiG4OC^k7pqXd#1qs>1>3e%9P+M795Gq zk@ZX)sfg~G(sQCo)_G2qF&e-$xJ15VYw&-^Xh6$?>m%j*`MW-Y`E^ZRLraJ8-Zb=* zsdZtJ12;+k*LNAt=}^g#xVz}fhDsC?ZjrIcpAFS7qfV7@xOjHqT})=TW%B%C&^naBe? zRpVZD}wv%m|?=4F0%gp$aCETVg z3Jxk$g7Ld03BtC7RCRQ3N}mmLHQ(EPno=AsFy{X<{GH)B>fg5vlrhnbKiU#~L zTpnJN*%owe&C&Nli`=k^=gChz?-0*duM+Zq{P|CFbk^T;){g}DhI$%kyk-W6kME<; zXucDx&9jF*VK+U*);8Y0PxM>4iUx=T_f0A7TR)@uj+*To^EBUSO6~RLH=Zj6E*dDc zFE^j{o6laP)SkQ_Bx};Sbeh-?{xqoMiW{SbIJv#Uvq0Z zF<`@yDq!ecK+Q^p;cCsdG-ckOR4bnM<=Daf@#kBh8mm&^`FsMNdrWu^pw+i z+;hE<8P7^0w%sqGm&r0V2Jc^j8cXS4a%sL(Oh1~pBXW*XJHzd^bYd_Yis?w+EFAHs zgP*A}K22__H#!$0yiFnDvsUPm4LUNQuggF)vrjZd?$OeTp-qLc?$&H$-PFs%RZ9L) zgB9w2E6yPEQdzgmgq!h426x{)gvhluMidCW%;cu>(y+w2!GPc@N=Z+AA@du;2{SU6DtOJdny3E1J6`s5c85d2XBr z7jqhXj?v(M*PA@VA|P^wo$C%%(o<{wJCkYsuF!2F#9^- z(0ubKwMz>T_LN(V6Qk75^o3$b&96yNT`7I^dlP;9qF&UEO|BWcW{leNwvt`RG}9%c zck>4{bhCu#3e$7+m{J(*`e5su+m>p+H`a)pqFwLP-kB+5@%*4mHD91UQ5!8bO6`pP z&MCIw@Sx1=IrUkI(IN|ekde}dRIB-}AEWla<}zC&?@*r=#(+{7tW?m>Yy`HB$^@T` zBJPvXCBc1mWeWak6LY_-exjb1J0{L3gilCeaPbNnz!-J=)1e>rN_vZ8A0j8HdQm}; z$xXH&yDd=Jc#A90K`d}F{oQlxawD#*%G0#Szz7XQPf*tllEXL!Q61q zhcs|4G~bOsr=go9Jom9u5d81l{Py$K99_#KVP-38+zzq_2O2eBa3u|Nc%d_!Nur{T ze@PR!|DJPNa`e3`X<)-Bwfk4nz^_u~-M=a^Z&&@L`e~sX9odxHuU|<6{NBfk5Zj9y z`+E~Hh?SHxI`{>9pN3FhZhrekr69=kdt*@6xes10;krFr4^c~ac7l&s5`2X5g7ve= zg>D&YAv7Q3cMnuUk1Zqy+rLcrVK5Z#>MSb8tfAIXs@^OMzH_u39opN}-I6jtX|0IK zZBU5OFiJyg9iz(3;2-LEoksUb5mz2zbXQ0;pJ!nW&za}6AXJ<~&b%u@y)&iHZZ(0k zldH^qJ45JNzogX8?8gtr;~I;C&yI+iJU6HGRR9e3=G48KcO_aqlJ}lj3~f$Oon_nUSPRdK40# z%V^D!&?6arv|5QFoAW)8B-_7Y%64X>X;#9=XS&8S64X`+y;ADkh|%x>p#FDCzx`j-eD6_e@63kbl+l~Y^O?^7`;<14KLJZ^9F|XMzDJq9 zzbV`BTZMmLi)P`Np+<^Qlwx!{_o=Ew4USTFrJce`l-(?op5I0 znGW@WqLdCRmf$`GE>~5J5mJN?+%@$=t~kD1!}Cye$~f~<5xEePq57@fo<=J%US2^1 z{#;`C3&dSztc4ic6z(U?{f-)P5@$=3&Bt{`jd9H64JXW8;B!~gz};42oHuidZLg<+ zbqbniZ6&+b&+=Tr6sR}J=>1jZ-*z+msHuSPIKuNsXYILHu^;jS?E{KExObJvL)I(X z+W~vK-wMNDK#cQNTo2^8+fNr)u<mU#tQ7B} z)uJACL$0Vt9j`s~*;O>qcb2-ZNT$J^(51T*H2A}nlbw6b3_g6V@Ljpzpzg*P zcH^yCd!oZM#P) z%N*zpnZ($h)498m(LxFI!4_gXq!6PC)*&mj2m#cuuAqTAf3D&8ri>;wfEa^HVK9|8 zPLvaa(T9=&8*Q^qs8toO^P`Q&{3|{2T2*GfvC??GvE!@F807EDoYpmOZMaQ_3%D#d z8bG+jf?g({#^)V^-ta(T-gPTe^TgP=Z{KIH73YgSzy@5-`#La6L)tYp#%pynpk;#p zex;5EYU^nLnZsqjOc}@7s`(hbYjrioZ|b^>&uru2vLC0ywpH`}l~Vf? zi))Os47NuLg3MlKyl_}SFn$lwZ9&=e)gq?DV-Y#A{k*;i&}A}uLxXkySS1Dit1>96unr!GGz|k z+Y>bK+6q(0zee+EyiTvDr^5=pQ6|P_ucZGcTf1$y4g2NGh7VC{?;>PagBbf*AhYMx zo~b>9omoBaehtRoSJJ@favC@msOvekXGPCo=gOXUzeWuIjAzQUB>z1|pZ763Rp5RH z%Fw%+Q2h>(>v&Ls+Q(=bTEq_+eH$Apcz&(f$nD$ctmsOE+iAg(D)UZpK46QEQkV8f zy%AHaLD@no0aBR;*u=BhK{<<5B7;;8RNE?}OKp{o4Cuv3=lS6Vnru8j@OV8!r1RQ^ zP6u=fX{d=(RRRekgWMMb!qE)e*Mceh8wPWggrVv&s|ZI5PfwH@4^R>5_4%7?v~4j(Z}tk9N)X+8DKGT5x^c zWyswIV#ttre%NOKwVROPZQSn=?JqOj5bto^MrVc70{twd_R3-EW@9=3LPPQKwDUCd zTN5sHwne0_wumO9{V7>$KXx!px8kYYx9371JUC51xx%KuTW!-bphadu^F^1!=yQPk zeji&4<5^1WHCv@UmW}I&*Ka8q_Hv&_`%r^vYk4f1Z=em~!JA<0UqJ(dH}RYq&2K1B zZxwUh8K0~4UClS0Qv2Y+DY}0fcpY*nQ;RUZVc9D0najrzzP!ce7z1r2%*JW3XuhXS z+4yA%YE4St4Ldd8@EEl>>=pjAa;6sfCmU<6SWDJVt3~rY5%1%lRAujFXg;2QsfrlU zDF`u|VSM+>l>VI^nr|KJKik_gu-T#?+w9?R)i0$1@&=QVeMhMK!m^3;@I0ycK5OQ<+r(g;jb>b={2WcYNGI$STud+Hup_^H z9Cr4*0EVCEV#q(_&lK@eOow6P4sP~@-(4nhiLw75T0sLpT1Eq~c9qRONXsk#K;6;R z#JH!0>}pZaY$!!RCVy_qv$q%EiQQD5IfOTa%&0bT*kBQ{VH|JS+@?<8Q|7;q_+=Pd zt;A@|CPtAJp^M7Q;M_UltYu(Vde8P{G|+mq#z_Cfwo)32#2a%$!u zVlX<9&vR<>T${P(bF2A07rge)ENBr6w8#;&uH>XOCEILzye0v&H+C+gfqix2e2Yj> ze+sC@Il^Zpo?jnYCXaK8KHOP!(Y)t0D7DjS<&xT?9}9ghss5yHjAN-5LnxDK~L z*eeGuaNS>5V=z8*uWZrplcjcMOKn<41Mivp?ft1xv6bw~w`!5-LKwZ7eY<-f#Gb!o z!R`NajWJS31FxDvp0k3jvcCZC%o@&L5P za|dil$&Z)?^()J0pywi0opVG!2d2+HwN&_II>snJTZ#Q#s$@E?b7a|@{WAFPek&>& z&+1=3u_olZ%V}VcQoG2FAbepe%x|Vqs@^PNr*v%sPwf5G@%LtqZtjC3X^~R%`KnQ> z#(pkpp_f35%r&2XXGGKv=XGnLMJ`{Ss1Gb+IP-W6XW{Zhec<@_Z2omClWWb2*!u67 z-#%+lHF*x{=JWT5sX7k-_XJFc_dgtOBgVL3>gB7>Q+42%k{*A4r8(|*&WSjmrJb8^bT-QL>p#m~UFs3@g;-#%>aTLrEs z>S~O&N^vgRySFHpcOT4eWCE&g_Ovko>ga-~PI@7a{&6)n9 zgX`IXZ$uRfkNuc4M%Cy8#E7W`vpScvpt{y(LL{*v+!u+RyFToy?xiUzWIo z?U#kW6r02FRp=PU&AOCaYDG}#5*m;*U??|ii?B7^A}j6wYlKa2<9SMm5zQcF>{(X^ zLJUqRgBVq?4V74+Zcc%z`=ta-rc zYvy)sQ0!bMd9+5{UorfAPV5EaxMB+)+b8MqF`0Zx-1CaqZifuFeYuEDxc~FqKiS>e zn092p6+B-Vud%+FgtZT;D_TyB0}*})wbNV3~Y@%atW^`T@2gM zsS8wXSWshhnY9bzcRM{2)Q@T>;?eYn=Xm`3(usFFIXuR-P{{Ig+^^R?n9{!WkBRpF zr4#RTSi735(D4GLcK@RyU$We_suD!=c`dl!GaI>8IcSFCK#_zU5nSE6o8h zt-YEG@1GLm)htciN4&*j?RIckvOinoVPI>-Tv65#Cz>z55!nr7M?gaa#IraV{c{ zF;uSuIDqZm9)fj|Ijy?td)S-Lj6gv$XGrWda@ikozE8I2|y% zmB~rAw|)p>Shh?tUh=0MY0HA4ELvhHYPKQWoNY)u>WwBB^tK!rY#;RtpG($pCXzF64CyX6vnk1Vx64$kMfza`HzVcy&Qxn|R3#h>anQQunR#Z>ETEg6x~SJO&w|y{h@nIaR#d$M*4T zTP`+E%k2Z)E8}gaiT8UbwKMpJ&D@;*X70g*A5j%3;AbfGax}jIsMncoW79?3Z!?^g z;QC{OvMz5WyVfZdZY#7xZeOQJ{0xCT+Y6{3MQ-nel+gPLn%|&t+t3m`UxFi3yga8* z(4*Mf+hFIpZ%a1%D{kN9uka$RuF;JBE_UDy<4OKvQW@7>{l%z64%|$qW%{dsQ$nxx zZ*o>Rro-)_w09$=_M0U!SGEpKxx`>=&;+!zHCb=2#k1K^FC3J0rZWf_?R>rVLW>M7 z=QRM`Ml}t1Y?_bZ#9`7oqwjlbC%dz>1#h_$9ju?e6*RDfQhS3{3$y>3UbLZ3N>wq(w|I&dr&C~4se@0Klnp%*%bNMW6HQ=ROM%|iaoeKQ{?S>-+cF#L8>x)hS}NC zO&ZT<$==@(e?LIgX!@%8jXd^Fnkq3`=yMEp$Efk6qB!xiM;IFvMYHcx14?W{&rULDh3+o*bZn-*snFYCojpyUNRWVHKbi(ZUEW?%W9y0&vS+Y9&9(trh8B#qZs&?22m z;m{llRQCV*%aMCRv6r4y%1hfYD|d$ly5EB970k)hhVOrDJ05txX=`zwcBj9hX*P0W zic&hL%qaz=%+@>CS2&?$0#a%Jowrv2)=VeT`Tt#aeySqIeYG-zKe9mIL21Au;gJ?O zZK!{Qs$uR^JM;B6rSf%Ha3rS83N`_cM3vdWZ&Dg)8fn?pdgtvGuRsazgYt+K)Y~EU!^o~JMhS>W_`JDe_~FNH#yx+0WtoeNWp#!^eRaj z+NVIJZ8-9tf*`?^_8~{@Cu#(vQj&hrYNQmzP|e0$6D z8JCgAzMTd=BMnC~r1VG9M_YF77~Szme2#345Awic>)705$}~RL8C+kR9*ink!E{Ok z8)Z`Y&ot;es81T(>tVwg10}Z<8uW*aNtWzn2+~zboEu zN&LQY>iBO-B}OZjl{ts+dCZA#JTIw2hvDx;Kd$08(#D?^&r7r|ekSpot)oOtn=2mY zrxHVg^hlM3oN>xfYrUqv=E~O_o-p;bw`}^s>ZF{)(?opv)1_wISyJp`!vYd^%5XPC zYQiz5Lo?lIWcix_i2%rT?x+sO6lbXu$SsDnsSi-+nPYYbG#?u`UbptW$>I_#MD9rc zxf%oH!N<_|)yMi2^zK#QE=YpiI}dv6*AnpWN`l{O#>d|~3H<)OD|pQ}-oLc7d;oAG zrC+I8z{X%ab4lEx(2>vP!Fciu=;#A_Nj%OpsTMKgoeW+FrLOq-dMr(g+_8+;mvj$$ zlE(ZxbZJjwF8=Dtb?53*bYucHGv|0Ddl?P%jZ&Amj}iV>4}Sq2e(-$A{M?D>M_eZI zs=bmjrspXU>&NDKIHewD{2uGqH=~2uP0XeuGD5w{ePl?w^n(Q4*CegMfobCGtDyAK z*hR;9eM~VPmwmS_HO6URyT@2aXrSdG>5|yfWEl4nyF!DmN?h> z-Cu-E{y4p}D3((1K&*jWs+nX@df{KT;F+11^8*if~sB%Buvf4s%?+CF$Kie{PKxkveuT zG4}Vpljzw@ua4A&i3M(#1+G?E%!9}oDR9qMs8! zfK0EQ3(Z%szn8&f!1ozmZX_Jn9!cO>lHiVxQP-#9G~07j|%g_J&GAJT{2oC65rz!W8{C=Bk!D~?Hi))1FY>IC8Oo&LN4Vp<=Zs|e(Es@5UO$|Wb{GC zGb{<;d@n5?_sxHQjB?-nt}&|qaYLfUk7UM|e{9M}zXF#QsR=t2xE!XxIL!08XJlqy z$fb=k+;z$8Ws`O1n~6Q}sz=oBjq_@@7k)C2*UXv7|73*XV@R`+Ta|_8jS^IeXg-Id zuc$S<)`-_zW&QovKLtPgD7~|Y(bBc%eNt+^4>k`da1Aio^0Qi_OGXGa9wRU64X>5q zo|O#yMp>8soPhm%$*_M~z`k`7*xA?@Q^r1^!2PkA(<2_M7%% zwT5ItXxm*LgY2lD4_uz>#bvpGTuKzU04>tE(OC*|2VFn*5_mvPBsn6*1g&(AXJbzWiG{Mni> zwiMyI$7rD8XpPYTgqmKdH53KCcOr3qt-oJVqD$ySpwN%@q39K}zlGvpmLn3BBw) zUeAnuHwC>_P=@?dM9yKy6u7?u%{L9OHRgDXekRvSJcdIS-}^^tFIx-$E44hgP;^A( zlghdDs15f@d*#5L-%k4Il4iny)fh@0i8px43^<2kB0~1eNjk0mWJB z1#;mhhTWi~#=WGdbu;O@5aGg|JC+CxQLR|a6)Rz$*sN)aC`rsS2vpRWIJ9?vn>JAq$)E+ua> zpmr^$0V#uo-<#x&EMC8ftw)=m7)^c>Zo*}`vUGFVpapIjB)kq;+@GhF%Wci)0BnPR ztDD-(6_9WXvYI`jmXmJ=U~2;jTiElgtmZ2vsGaORpgPBj%UY#*WdoyCWz3G;J1XYZ zLP+yqdS_AmyVyu^*}*aD>K?hGTs~YAcHsWVI-nVaOWuS{9c%jH+{>`99?9 z`ip;W&zX6>Z^g{q!Ce_W$A69R-SsuX#=BR@6^DiNv;ao*;jEsn#&kWp8pbzJQO15h zk%x}14~bDO;qbYmHhtSN&4-QP`EZb?MPf=paIlIP{;k-<^p&#;f{f>Ca^YRkeF#VG zokb%`{-G8H&BG_<=dq=D?Tb%7`5`QwMbW1b)@b!ES`GtS3ui?iMmVY{yasV}j;OnX zoNxOy8JW@j2w&Jlj0*~SqrWEM=xn&7ONo)s;9fxtN3pn*9jA?ZQ||sQhdOgH4Lo&S z5+7JEe5m@DX}+SWN%Ed$YQE7=2^q=gDb`lklXH;oCV z!6_GMper4&bDN0~eO1(HxuBr*9q$63J3IO{VjPu=4n-G&*C_ys+M{2Cac(mV;~)t~ zA70hN*1#|0F#2q|#B_H>+T=`!Dp}ZGv2nZY?_)IJ&w-2KUsJJ1$|1Z)P2Y5=RZpXt zFq<6thnyqTyPR7K_f)M%^S5R|jV&aGv=KdwZ*TZ?ts&(g94jZr%tC~v92iTP>{-CZ znOQoxP{a$|URrC!?43o&+62$%`Si<0Esbb7j6IavmkOLd7ssimPV+^N+VqzfoBmVg zc@1md^C@)1j@mfi-m7Xp$8|LD45jw%7U+mV@7#zpo?)s+S2J5TJs5jhz(cK%g=B$xE8se3MejCRy(@N7e!lz3CqMLV zmG;CGxpdunG%tIfs&dY^eVwv=XY3zTZSXqVon0F%Tc>1{$M%tME8voT+v#I#5zT-) zHD$j2tHpf3WzM%`mgei9ruklCHv7XQT)ZC5^WLK>_!zje|6Qt9{SwXEyHs^VS-;ri zV9!>dIeLn!tc~C6Xh+w^O8=?p<>r^n{8oJ1cao~_P-_3R1lJQ1LMInZgeSH_ zz;k;N{+S-$#p5dS4|zwbcX_uKCg%Uo#QYt@RK15%`@nt@-u3}?GdRfyR4w6f%A2C^ z3pl&pPv9wbZhF~&P-@5fwAW6l{T>;Ij~=k;eO6v0r}vh0=tl>juiJz(4V0?6l-m2P zBwPjCoeu8vE!J}P7!7odQP%-cmxMnfs5*)<>fUVDu#Qy`LjsJnPrL*9)3|P(l+TUV zm$Rp7kzqv%1|GEUVf=A3?Cp#{HszAAVuh=zfP@dG!99n^$s#QB7|NxFVhLVQ(t>Os z%~PN@$T-a8tdg!pI;_f`Rx1f_8sqhCTv~yrr+b0Ot^OluyMH7h#Na!|a}Lc64k!hs z4Az*E7ZkNc^Lb3?X(cVl^bE+wN0m+Y4xdnpg6p{t+{_?rA2ZvW7m`j>hmM2w|^(Fhpjuw~i&(7lhE%EdFQ=f3A>QAb%eb&r_ z$>>ht)e;={cPSToRlL3w-GK1bUXhpK!-YwEx=+zPcW{06Ii|0E?YfEf+)TjMX`OkO z@N?pQ`KB{Fe3ZIemWr~0U6LMa6E+)bbKM$roKsL5mErnJ$~evqiE(bYj@RKX<#pQ3 zS{;>hg*=G0;~jhCS(*J-!RH4z2-)*66?wDz3cNiHNqg*N386&)w$ivS6|eb! zfx39z7(m?vxS}$t1d6YT%BVbV6?}=xMMK>ql;iGaUU8rCSPEWRzbyDCTlfCSc+Y1N zXOpx#{gOEBYb8AAPm04n`=%!>;&vo67CS9?L9y~!?2B_O`pJh89{6rX&#`!1_Q^P{ z6b3IY7CuJNIcZ!EE0>4M?pR0zjb-_ILs;{9w_5c08Xj9T`F+o;bI@UjmYWYPvIMZ* zAj73SBx-m?0aaT-!bF1mp0a%Xwrc1{KW)*om`=}ZbG14QO5Nn9>Tur}b+K>Qdj+uZ z-#&}}RBpar!*eyw4pvtSAKs{0lQ8{=@IQHXfzTH<3B6?|{LcLo;SVjENbA+6zbmiF zyI7nDes+wi7v>0CFs2mocmGwD@V#Vfc3y!Ior>^DWmfQnVh@TOa0S5uWp*$QTaBbe z7W|0@G=SGXE`S!<$@Kp!VjNTKK~aNAeEafYQO8RBFKS?2X2SCZpvv*}=oj;OgYmL> z4Wo3Z+AG8uY?FDcWdk(dw#77XLP3z%){>xpxInaTJvb2`UteVU|IQa{%GOeygO0aY z{|iX?~*QNU`I1(F_MIB2eBY4{g4fFx-znWuozbwYs$7JlS#2}RN z9Ez~uh}Qyrpe?h9wW}YY0sk0vv2R`h4hjE{bUy!2FG|e)U>x>WM8Dr*x^w$7F1uzY zeHS*rYj{+tfu_Nj$tJs}I! zM;C}1%B*kc^@(dT^%M5k2PNo;Dzk!8h89`8hz6nz_6#kuko{H)f}dX?@-Me7;(Sfi zWvht8yw zqMw<;=PSgw=k1+E(F;_)(ZrkQ(8RgDwJ_;Cw^-pKrEpaIMF>iOF-Gt-I7 za<@Y&eF<>mN^w5-W$>EUGyX!U-35{RLfiosa#^dtAZkJOkNel#68`l`_i85<1eu<6 zLXm=TJn?%XCWGvz46=}(=)+P^Y%TO?6ZCIUkw=zb^}}ShJhWqs zs?q5j|A!Pv?St)7&%h|{9r&)NXCMnbeHK9j;*RIwC3o~6ao=ny*ud+VNJBz5C&tH$ z9Q?oMdA9{0C};bR7=W$aFPnAtVdK85juig_nEnN_g&4AgkizK4f+Oo~q=M0{l5r{B zo-lEGT;TNZWH{|h!RaX~a)Cz2@r9vzGSmT4>-$hO!&jTc$2#@2r|0)`(X-cro`!e~ zgZ;WqZYV6QY7wIBH|=EBY&zAbh)yU23i&Fv%1qEVW)S| zEFHr$_170n&I6xyUh1O}_c6Jje=`aGWFMUP z9BQg~?3FA2KdDNC9+nET>?v3Axf!B1MR z`ATJcu1k{U{&rPj-A&EaDS)72~3C*|vI#KKQ@e5+jUMNqj8T)3mO4Rygzq_l1pEUdZ0|v9XUNLjt z@9=s5x`)A+;9XLX%|E_h84i-~`eFy654;IIvJxFo;5w_I^ef4Dcw5q2Z3#TQSIKmQ zeA8AFdf^`(#UhzOk*yK_bc`OcZ&0=9g_os~AI$P|C=mwE5l+Qg!+=Cpo zLTC0k(|dRv0`iBR;c*DI;A@LTyo5`_PPc@ee^w9*meatt#k2IT3p2&MF4ug_#@Y?d zXY7)6yO}eX>14N{>#iZQcG(Myg))gt8%iM`_EAI@g#V;Z1c-pw)J1G z`K*BLJ1JxKU#9u8DrsPjgq;I(HDA-0i}Wof&E7xh{nPJF+Wk#W>U}@2mof{+lP?O~ zk>qnWeg`S)i})9l@ZFE{T&GM&40Zj$WB6r+x@3V%re}rrdW^TyL=G^%Z!KEno$F}8 zkpcH@sdGFn<|xh8dEL@LpI2P-DOqyKTS*h8;SYG>o#FhYC%ch&N|-!`TPP-<_u ztJZK@lI!-^Cei0?6ZE-sHw`ejY+aJ^JD%^87}_Z9{fQal%D!Q8S9;3BW936k7MvF} zu`i{jP249puD3Bh&Goiop|@$-bzz==!@M(ZwG@^YXJm<3{DaV)5VGlp7ifU31+yu- zCBaATzm5j_6u8fqCE;z0qI<4L?9p#jOfKJUDo)`)#VIkX3e+!_GaJv+-2G0c4>_Lu zzjIOe;eC|Ek8Rh{07eq}OU`vXUfDG;i`gmpK@o#s3pTw-1AV59JANGv_|4w~ti37k z{&xbOe(92P__*J%KP4wda;)xP4to8Kb^M&9HAnb;F}!s{i(JL#&gJc|^QuOZ91deBY0)38M{;%a{-&Cj;W;-md<@Mq(E2n|; z3b@X>z{Tyy(s=H_2UEs(UMYM{rLAPwfO)3GX!2**i8~N+u4E6+bFnqd-z1Gu#v^C2 zu>xi6S;3~2BZ5D+UMK9Y+f&AfT`6+Q4l9ygVEUWK@$$qX8qmh5%kQlAe|!SpM;40Q<&bWK5s@xQo^-!EyA%0)EL zCBywf@?5S=)BDR4bGf#BavoT4c}g9wBsm%9XKybQ`egk7zbuT;B|rGGoA1|Bwm069 z?VDCeB3|v;MO@Eu>nSiv3q;&Q{0_=l#%Z|s;neRcHQy1ow=Kko&y_CZ{w*%HhmV{5 zH*OyekHeG~d^8Eauba62{bcsu$2A5l-z!hHnfhfda(tnnjYc;O$P!L-n4U`0rA3+# z5>7LGzEd_iJ`Y?rxxE*s@C~Qwt&0=z z{pu6o+x>6g`|3QBUFE8_X`F#fV!mIsv$BkL$sojf`WR6M>HPKi_?^(=e(dz7bPA;vz zZ}A4#W?w@+BQoWg+h@@+Gt+1B%bCn)QE9DVNsR58$$U*Oh^0kw;Zhopx#BFQ(~f-JD1i%u=tXwb=4}R`DpBHx~YH7u+P`?HA8(BRm^6-dwB44fV)o>hBB&!={YS5``+v07&PB59{2z{R?Ul&`bEsF>U?VkFHeWcl>ir(c zUoG6Yl-kUlTd)z7poaXmT0@E#P_jpos)=1~J#)bpnzKirDZO#&^3vnD=8mOd6Hfs1 zVF5a=9GWfx)P2(&w99#VXf9HI%ht30TK~CJ99#Pxc6T8k!=33_0=*aY3$XwD(-}rw zN`&|)uC`Lg%Jt|)NV$s0KGDX8viNY;2w1NzrSZja(q8K{Y@{a0X8KsU-g+rgo|}e^ z7clmBpKJR88fRhy2~hh=mcAkvBjp^|e3NrAJwY~|`tU_((KT3O^>xQm!Q6TYQkKp? zZG}FK`AE8FGT+KCr)AD9>8JZjq};^y$rop`JKJEE9BL~z)ajq3dSn~-E9XGxq5kv2 z7mIpPvP6LWr;$A=LG69hu;Bxw^!L9!kNOF^uSSYgn_Ur#r)^?-nn-kv<7|(toQVzXIIgJyR`WvT z_b7PQkoQjB1&(+iq5rJ0#@wHG@S4Ex(7v3LAbXgs$p&JVc|o0XJvP!3#I8#=nb+k) z=k8g8zN<>mdpHhK8#L@pd4SHF?1A{w?M>z*IS|(#Y%=FP#@3GZpvQzF=+qu*GJOK< zUw^Dz-+CQV(vmM$LFP8Mse{<+yRJh@{#0yek9bVE5aO#gc+6_&T&MD=uQGf+Ql75K zTvJ5=J|c^D(j08&BS{^{D(QdbW7sHjwIeLB<-x->94l)$QpkJ-i9DJhn<*2=-^SQ~ zR1)>dAeEI0vDFS$<>;5zVq>@D<2V_`F|UjiiQzaUyTpc_N2pDh*K(Q&syQ{Y?{3ZR zd#P(2f|sqI?+%Cc;{bd+593a)5-F)~VFl@X$W&~kcM1AY$wU3BU);cK(VzhF&s_b4 z7TNs}o9-`kKETu@h=1UEHhiu9>}54>jDIE@YKFu5G`9!usbP0a{qpj)aHhN*0&4v< z8dpSXcjdRTdjh(@C4cPQjo3&XXP=`QQnqho>)2}l<{E6=LiY1m+0-_8OpV8^2m+`} z);5{widhLF3l2??%_RVxFrl~*+n zxp>fiqs@atz9xD`AmuKM{lr#6&xOr)0phY3I`4748~wihuE5{jIvgoCW9;vepi}$t zY%>MDFD!M>(PE?+WQ}bW^dpM|J-yo7!F+F}v2S{re)D~IUpFI#+7@TYX6y4|a{<8K z2(h>8Wi$F**o;r1F=4etepA1)7bQQQ&f2=dJ?0-EWf{jbA~NU4)0ylfpRb$2dq^o4JZEJ8%=xoqK0Bh1!VD?nWrVO6<0w<&c=X30{{x$FN6M+ZR zJEvkpkZDcgw;BrJ0BS%<0P(GM5hdZCjT`8>QUz3=FX3}?;7r$;m$SSjLQfCBpCNKT zG=uq!Qfp>)5Lq<21{;6ny6mS}?oRM5F)OaLt;?}GA^mvL&3tY+4>8W|Sfvc2yp#o? zKE?jAH@j?!AgE_e#Rjx7-GRt|)Q9`^ns$-t_?_1>-Guhh7B-{#Y;IBl#DC-D!>gz1 zp}Xz5pExa3CN%)~$^a$*LF{inrw?DtWML}T)~7-Or~%1OYk8CaQV3mLChjb!>jfo; z(|RQ+sZPZPSqqi7hRqTX7b7y)PlnA+IdB=VBZyup^^jn}f6 zCL}`q7B>DJ*7(B@(DCme;5tG-4XsDa`+nWs^{yIe_mG4bomt` z)R6hMeDPvin6CdFeEpy4Zhs9@S{YUzt;y3$Y@&MRS0VG)CPHWAktU`SZD8&Gfwwiv z)mHi^NV$d6*vjplN36CSb3=X~&)XR6Y9snHq|7JuY-X}bt+Qk#8|OLoEMD%r64Vm< zEWcyPbY{Dd|BI$Gn~q^|`C_x`tb1r*thb(@jgl{RNgX!QXUV1ygts0Qq4xR*o6NC* zlKC_#eiS@rA;-qXM^ zO|M_e`tSfs&OOX(;)M5MmDuv+*)JqW?3pFg`xMItC(p|K*_3}{#j(Cq;bn_@R=@2t za}$~eYMi=uC+QWTeron}prHKJKF<&8n9q}Z{!Kl_BH+Hw zL5V|Lh92bi_gT)c{#>i;DjLnD=Qf%|cXpm;LL{H`K=Ng~%BfY#TfyC3&kqCj1#>$IJ|{iFvG5mjLnC9qkbs8rufZ z`{c+bq|DB;o`(SVLLS+Sh|rmE($Y3a7dG4DsLR5;in8o6J&|NnA_5G<*TmR=$69Jn z?r7f-HU$AXH@f;k#4g{=e1XK~tbCH$oGYecqs@_jj!xqEI@i0@r}ZSmayfa|?`ce* zlQ;b`!P0BFFRYEm_jx+f?}MJI67>Ct8CKJBXZr;OdiYm14-QWm$b*mlj0c6>7Clri zCpL<(_w|!lO^;=9i! zDc?T>8`^xYnU)|%)(&}ox~u)r(=4v`g((BqP8Y`hC0Bdtd6U`&`VS9dqs_#%W8FOL zV6lSsI@z9aN9b8H+jPqD-6C{K%V(RFd2%8IvPrSLMW`L-Y!?;ipfP=q=3mdGd_R_PQPI-8lstq%G2BS`w?jVYyG#HuUKI>g$A~Nh%fVkD)tK+~& z$GDW?-&td(Ir@b%)orcM!BgB1x?^z2I)KjErgdKlInb%q%{IwCcqB)r>zb_Pt({1@ z{S0iZs`HvldweTOPvTCiw$s8mQnpOOhE~Vccu<7+svh5pRnD>AI+$Ts#F27xvR!A| zdETc=8Go7H#{3>z53#j=bC$NkFCgV>-WJ(2`!Mz&mc;5Kk`!wfmnV-(o|txVlNk!m zd7ok&h)4-74_ppfuAb|G^=$&guW+>+ddZ%T_a|qr&5tnluP%~1SRPGjjOpXWG16{{ zhhkgMyM;|z^W!r0rv5tvo(q?OVKEru%XT)Ihp!Kthee1_a?<$nV7>j1HjS~#1J~)= zQrB7Q%2f*v0(Jcv*g!dQ$B{*X-diQ;L`D<2+9pDLwJ4iC0YTq$Q<%mu+>_7p(8$@+ zCN}KslAtEfMN_m3Ddc>)Z*r!5_-p??RatE1A#7*>6mP5T1dbn_*Y7*Bo|%q(NxuL)%&N>Y zREsqwxT0+n35>-P@6}?~H--w~b@g_wbyi&TrY> z$owpAgkM7n*~=@|Hko%Mn-am_gw3TFh_uFZ^rnP%~vHU44FYd6&^oM6K z_OGfNlsLiv-hpv#nn8&i4{DI+IhBlsJpPYKUZe_K4TMKI5D(Gq!+*&(&A@1t+9 zdEHL*(+e6+VT)jg@ZaA$sV~bPsN! z@xNzqTV^6sYKh)8i}{=*eOOI@3p#1*^@A+mmf2uAvE|<~yRwU%cPDW?)l9KRYfene z>_>RV?q>z>N1VuXcd~x3DPik3Y~|IseT!aD7foU@+9iOLJI`VGIv_zj?dmJ-=xaXj zt7jrxn|mC7mBoY?9-3>PSOCIaTJPc=wx|Ej?i+`Z=MGO~Fh#;vfUiDGLCKWQ?956nscz|`Oak^|3{*WiK{TPBRGMO)q)xBqcEjREymL2)(OP7Xi9|k{@my+}N>PB*& zbYAGBr){Vn{luo{jY+l+V#%Xn0KU&9u{u4C`6l`fU?U|$?MzoYp-=60UYs{%q}wNDcnKD#3TB~)HY?y-Hwbh66jcP!s1ii^n_j^}`W2xC8a z=SO{5U4JeVwF0$6nJxuww>|kZ^Aj@MPTv6B&a<9oabw!ju(@RZX)As)0UN89GR(>s zh|HXS{)(fQ$cYBQ`l#g>E{W}$fs~4BY-mq-scwJACa+2C^BGQ_c?$K&UYlnxOtdkSEjh5En8|>2 z)_kB$yvLwNHW%c{E!`5RfdV*?CxSZC+26cEJ-pBEZ^J~ctCiR?=WgC#K7g+ZWD^SE zy@gHkOH}|JZ6|R&vbM>T^SZ7Ms_a~G+QUSL5?uX7|6%uc_e5Ja+)dVh-CTy5oNP)^ z{EzC)chmp0-@RpGCa%wi+)u4d9Yk$@>uk%W2W30g9^IdLuD$Q<`_)1{eZcPf(uo6Q zb4~HTIoD1Db>;+YM3lLSLt`oK&*G;AP!q0xq6h7M>UckmL+m}HJ=kQb0@RW<)R4#S z4v8)hNqQ2mJ&27}4|@7_6rww~yV~zQWVb(R;y~T`&-6ZDPK1_^q*%1w04kZ|kUA?7 zA-aS*i{aB3mFS|(>P-^+NGmF(H6@+)5y%3?OC|P^?2(@hdf-{v6Mi=65uPQo?y(24 zLB^x4Wi)F^PlC|zJBDkBKK%|~{lMyybqxBmmr(_rJNXu zft{9ab8jAd_FjO_)%15S{r$gf2g>9Q51`~{;Mp4iimj8(1@L)6UhxWui^D`mBYH4^ zI!k~!dB^LK6R&`<7-6iwk_Rm^#;S$w^$(2w*8-SFF!l?1a)*?QlBCVh6rlVI1E>_A zZ>97Y#hblx^h?KxPP0uIfTtomu~aC&lc(c|Bvv1#I6K~sUdaI3$*3DMTFaVHS*12)Wb3whQ8XIArTM?l(XP6HC#a?#D`AUA- zZ9$RN$xft%y!sR4vC%z@#))kqYq7Cwq7D~M)bE_&wq1R(`9*ABr7-qG;RDJmBHV<4 zwMFzr|g&e(2oHgz}IzbHPxgS3H)7;i~C7XNPYg8HNJT)uQo)Ek>Xk5+K`a^XZh zhw$(z8&j0(|HJy_B+DmSFmOHXACC<}!%rLHeG;oPazTHd-|5r*pUFIa_IonX`{J}N>=bt2R3S3nAR({rQg?qNc+B;c ztj_HJn?l!l?I$$8E-)1hfyBK-Wb@t=xbq%bx2dFh*Olx(nT)3m8g`y)JyE<6$*QBA zfz=h82C`{kb(H{0q8t{}`#ON?#6Gj+?27QqtqFfhyQ%aXeD~HVzv*a~KBN7X$8`g;>ZV zXXG^tTt1x&kF7kHR@nm*9HJ6BF{ws?>;2}!s0dnHI&*&|0n&K{Ep!$zxUe+aNx;2`B*>R z`ZMx?nubA+N0%KdjQOm3C87EdJGZKjNS@eX$s04JoY*lbH@097v;g%ziq-F7x?gKk zc%!mWgvE1CVl@ZAw+yD&Rj#BlBek+f?Ky*Cpp{i?3v+eCn<0HPE;z2;cTES8wPZiv zF6QZt7f#fxrXVGB^YF(Gj-!|poe^<2%tvG(E->f1s|a?X%5<)|c7_evtgeA_w=DGW=E@sFG@CnPC$ zT=K;BG=O>jSau&t_PAJs6cACeX)Lo9SBY?7PlIfF%H(5V5!BWic85vi*3q%p*i^%O z=JfrsZ2g~FhOyX|>u!UNFEHM}8{_>Ou7{3281Mf=o~qxK59a4maqN%;<~_kP^&Y9L zI?ZvAf4SpKU7CrM8!)SjA=cY;d^i>xmGw-&&BDtV;U&?BfBP?fC;Ov=;($`zoi!q` z+Sp+b-V!`uIQrgH4BH4 zw6#cpPOBZ(uRMdi7Xp<0`zhYr!!dJqGyhaSX3pn}GI4X-oVYnsPHeXWH)oe$PORd% zIbRGVa#o6wXSy*qQul{D+C0#4KgXF0{|nrlLF2OF=KP^!;n{X=04v`yNY0L8>U&xj zKSQ8*hBu65cT7D}No?EMNcr9AOg0hwRTEjAF(#+BWx1OaVuvI#){or@u#U*{owV)J z7_rmI`E>DEY^)N&+$e(iVh+V??ram8j7>{^YJ<-hLu05+5TMf#ZEPd=-6$FBFTC((uiy<9_rGqU3^Ljpq7s%XQM=8%Tkgz_MPz*2eHQBGB0u3IcZif;_7)e>1ap5E6!(Z^zI#<=?~V(0afV+YzqzqaOg zA-hA0asRXL=V7x`fKKw>%+nb@WNLy;^C*Z;OK2u^EE>&gUHdmy{FB#q+?O@pXka{{ zHHXevLct@O4LqLk(CLnG`~~!AiM=*jvaF5oxYveTCV4>p-WV27II=H$JmE*KKEtJU zpX%6w@q`PLO^L|bCbLn1n##6|W&}W__X~e=wbSlrm|wxR!7~V-KN_%?UOwesI<%SZ zqkz4Sp6lb-9%~wDp2K_NsQl@C%GvLwf*!80=^veiXL)X(x$>XeL{Nu}!A4~3WV%1R zeH3@3_NT6X(vE)ev#hf{e4TyX@5{>`d&I}R;j#%L#21sb39z5i@wlLO zk3dQaU_YVb%P|AT`}SZqUJroJ+TZ*f%bNdvp$rxd^U}NaK_|)D?xQzAFiF?q@hsM+XFTYPmjr- zTfJs5tp6g5t^e(wr z#dyDObY|b-O8YM4e_dPmyTlBktMB&F z*~a%`w)^Xh9Q0+$ri5jKJM)*0icq^vgm|QNJd2Y*!OjlD+3!3_kBqg)>~rm>1~N{L zPlT9#PwSJ_15zwHdYWChvW1`?8;yB|}HYpEBG@C=K zu#q}THZ>1)UR#L`?OZR7p)_|1`mxml#Y=0Gpp)SMm&MNJb9#K1Y@X$T_ySiS;fV}W z$hX_5^Vn+sRT z52dAw7ywEhnFi*aV|c9?fOx%|zDW#gJv~h}cZ$Q;G(hQI5I{XYgpG-Aew~4ohk48s z;n~Z?);h{^9M1`1Bj~2-410{fINgp{cnxF!;aRfz;Q`#KHFDlR-fSLfkj+EWzMEVKXeSI_v#=(v8`l2dXj} z8$@@dF@+~+tQXZ+10HsF`c9Q&Odm*ksLtl&+|vi1Ig<;RT%dJJ@1NCicoB=OwBo_@ zPS`P!WDUIFYCl}hbI__}Q|rTV?czrB5Ws$-3-;8ryJ@}3uC2GQwMdUFETXaXQwaUN zxVGKZW^_6`7XqgbJg45z(BEF`$Cz~EONJe|ELOc-C%$Aw4Yk?g8T@u(LqY+lN2;)q zzMbu#Cy%q*A*ls&qD_MOR$BiAsu#$?y;TyZNR-Xg{W%@v*$0m^84NYpSoMzAJSst~ z_aQ-lunHUIW>I@) z$wA6XgV@}@PWN3|EG3o4Za>a&Pnuk9rO#%%aXbfxeI}MHo^%|mEY8dyd#{SenccwR z%+h^WJtCD%D>;xq#6C3eOHcOSCj{2y({(0#!3`(_`f{ufjG7Iz-V z8bA1Ye{5O=eqQg6FZ*xLRL=>9OGnRC0Xla-MD~@3uKTl(Q%n$=i!>C#*IVfr%RL^w zy~!TS9is=Hx8EJque)YFUx}T&po+(k@wyjU_1pwNV5(Nl;se@_V_E}UJAP#y`wga= z1J2p_sb!6;wiq4%m0a#5n-Wn0Y9iHh6Ja5*K4TwT>Cy#CL9MC6M&#;7vs-}9xRV#X z9$h%!=Ec;}1NUqpfbVdXNPTSIInMHFo^-X*?r0-4dSL8=m-F)@tDdf~JOdIB5E zZklas|2NxA)r0w>0P&x?+K$Y%+s?Q4Nd>FZ`W27AO3jtc@L;G34u<#-UGH~aXup4~ zDl^9HW4gD7(-_`4Wc?OEP4DHhc~t>)t{4Qh+WhlZ99bqOGy!S?P`Wrm?9;hamUb?3 z^YKz1b5t*zADjzCES`wPnR$qPG9A_vUF17%`YvTTQawLw?y#O8P4u$lz~utC1pa^RFPYis#4vKMNs_rBAF4ee?gcO0*A(|)(|R@J%n7W718;ahtw8WzYPCr7j`y0_IDWZo-X3DQowl>d^mtHm z(e~M98epBXX2&9JkWS8{BND`35#fNROg<(^EYALwDpnuk`yp&>ag8VPJ$pQpss`$) zZ(;1;?0TpDyGVJ3;=rP0ssT(w*Cv21d!*7>v)W%}F_xdrYIQu%+n;n2tH&B-bHQpj(9LTQ zt>S%+C;dnjF(wDfV}A;;+=Ruf{~i7PUqk!fLGAxaE=R^7<#Yg_m7BiCWcJ29*SpdA zNLfx~-(q%NgsVVJ|Bk(LH-G06*E?YiDT~QFx7cyY=eeHg)@+)#Rc6L1FC?<3mD(a-!5 z!`m*!l7jaNk28#;+qD?k52PH(=ejrMDiGKTQv64?xlfCHyt zOy#j4pkxV9ET>qNiH-C&QUAbXm{w^?qHWGL8UFc^OJwu2RyaWVix27ggxDFKAsS=9 zcXcVTHA~(KXr~<*R|+bP(H(SQhqQ#nR%p<$lhCz0m`PXUdZer%w#{aberT4YTlzPh zkMh>!>ton>cDmkczX2(8x&BlMC`tH!@mPlYKy}J-*m%R;*Y}ZfE`KKiD0y;>jr%~c z12vR9XDl0gScG+<3!6L_sh-!Tl2zn=y#N{(=h;|JrgVYtU}6H*Es_!V#QaYRIvu-X~K z$3Z@~kL7p{x627yd&%l62PFkZU&=UataSAiU5u0ieRf}4tiFiuz}wkB#_sFBu{L%D z#jo|EpL(0)Dtw)n&@N!Q^`bt8 z8AQ&-Y%vme(Zn_XBA$7jW%nMo?p&;xW~n6hUaxJ#$^e}pLfuFwUpl>d`c_*;YzPgs zVeigkXJa1sZE0fWy+~LntK<4@R$K<~fJ)}ux;uHc57WC7tq-e2uRH{>gV?jJEzF+% zTL2rYZt|L|{?BVJY@DD+7EYjd9PhTX_>O&nO!~vOF?*Jr2X5Usd(DJ_G19UKogX>d zt;x~Tx7&PCLj!G)>3IY5e~CST0P3|XWD{W7^V${ce)(vYTKrbO31`13M;Dgb{nllf zkBV&lemy7ACP2-vTy3>G+Nug=#!K(xe))gU7?nZUVi(srageMUeaCOlVY#Ze2rNFa zdTs(=0%pJ?9}M%HuW1v=X(Gyv3)AO#2p5*|()cwsJqk38W5Ylg;01k}zfSS5oHlwuG zv7AW#3=*jZ*^C^;#nMZGs%~v^n+E9pVZ#J31q0os%&w($8fSQ^mo8-Ja4zL4% z56sO+Y5TPkT(oJkCh3tVQaXZ}`@j$23%Z`|zMI|mr5DNOu0^75;q)PB*x7X)*ZSPg zud>IjJH}1+*b^B0uYI%0G#5$wvG2*IBqODV^0AoKYFjyLl1|!X{2dWXNfj}%6)C$$ zVPm71*K(QwYVRo5ytk719TEF8#{Lg-phl}iN_v*0r#1^KNV^9v$HpHa;1Zg@^Yd<*HzI44SiYVLh3refMEwVSoNg zd9339I412SvPs7L*&2>tbP2=n+qs6F4_4nq9+KbMawz7!B0a!!bp(jVT{H>z+r0k~ z*RB41A2trr@#O1~o+^FeolX61_Dp`Bhy4(LFY=9R!$sB2o*U;Kqq@6ZTS3R+1we7Rb1wX<@(8KEY z{q#O;5ScTa==O_bbB|*Ud#DYAlHYw28-W67Ndu^wi>Hw_Ncp-C`-!gqC4hRB>-W%4 zm@OR0gBDL&)18sytnR?RK6=lcEDT`d$PrxIbBSz*Zw;Fg2y+31x#63`W&^<9K}Q%C zT4W^*59W1M1VCCGIgHiR&*Vg?ZRoJZOJ^k@uj^_6aW2u_S0BQv*mI8pAPyp*^A53k zon&5qL3nzbJr`A%VFLvi?kL4j7>SMG$C&b^ne&Cny;XIC67SQx2a@imId#lOx%ddv zb%(ph{4i49=)?Y_)JN%G+}elL)D5y3=&GUkXhYq5>tUq)p%43sJY6JJyp>)fCvs^& zknjRZetrp$>Gd%EXZIr6ysL*{Vx{+BRa@I+E>#94D(+)@L0juFTTX$KMdJxq57PhD z`TfO6=lPwhhaR=}&9wo?`CZB6^_-l6=cvpvuYx@GYXD|CYD#E11M9+_KbqlkZFkbp zm8+*8w`rIa$bKg~Cg;@k#r{!c;c_vo>#vDTd?K?}+z76Fww~K)Mk&@)am;@@#Wkbv z{lC$6jjoqQvl?ANerC!%et7`?m^PQ%!4WU0MCYUTi>`Q>sK<_nndD*dFe%BdRYH9U zoG*y+WeerY*?D^RM#`5hgfAyYWydQ^dH;1yiEpa@L!A4cG?~zL(G2jwWiSGYh)l@y zg6ggj_m?V0>vx>AzLcl8Z?b7kj>lDJ|oZawrCz~X@A{R47%_O zbZYa@Ul9QRVssSu@6)h=lI2zGOnAgS)?Xv#PYxfzo0XZ^j@v64wqx3Xcb>!BTJ35p z`V7+#$^a$fIiPp*b|0#u_mp(rjjZ=luVtyxDa3@IUyvYk)@|V$Z^%zL_um7*z=n(+ zJ`WE{epboyhvqqHQ}ZeAk~OCvkIX)&FMHUWe!=OseKze3+4=?f zoD4DjB6?mU)!AAvXf%nOo>XPa>8C0!eEs6sla&mYoYvpvWBfeZ8T|HaQ+Cxh?G{k- zc!-T_xpQ0>7U+>b*yB1pBKx@hBAt3%ZG2pfj+!8;5IcX+JF{s$B7y6rpM>n%Z8ltPy{XI@jG=Mj%=%H?#XHSpFzNXi3o_*z# zVULDv8Rpgp>HMj(37$E1?pi@>`26KLX(=153)^g3?mfl)-FS-mvuIip`p@(`LKApw zIo2-O^7JB!$y1OrYxi6eV(|x`R5<8fGFXrP$)@|tQ_wv#3*E1~+j*7w9jx_uBFJ>T zDD|B)I?i^iJF@TE_!|3~=hnGnZZdS8;b8i&YBZfO_QIEQ5)B?`>Gpzpr2w57I*%LQ zas;UU;dX7+NDfMt@pbjEb1Vfz^zPSfo)nF+@AasB;5<1jI{k3$jCm!YtV}Aso2FA@zpx&W% z&hhLH^7wyuTW_-(sTQ3N2U%NAIzJ3zL+-;h#NH;~H$TE^oL%f{tNm@HBrx_vmplXV zp*GEZ5Jv#EY&(nJ{|XS7UGH@@PSV@|jFdkPx9@JB;dnaTqgc#6(LJX+-Xrgjccbqh zWy|o)`ZSh*>LC%)lADu}$wHBo6ldp0)EKlmB>LeY#>82fk467-%bK~LL$90g-f$8+akBe)OO^h}V=!vI?riV**% z92@ZgV6g(9qPeIF?-f1xDy9^uben?FnV`v340ZHGTVigJp! zYeiVU@B>?}{yoU_E7Dhc<0O6S2S|CU92=46!}QEq_(IqWoQ;iF24L4%ITJ4oka0l= zJ{9%9U&3pzULl(>=Bhfhv&n>8S#Hgf<&O1+hUndYvG;I@ueqKoCff-8UeTrNT;j6j zsz4o7VcU*TFG>~!S={iCTz!Q;wfo8$p6N&3?U0Et2JHH0#2uh zOmz=wO@20t=~fmU)F%?)wNfnFG?d&EU_Os1-P7#*RDji!M>(=dYfO`~@j}@|{0_Ct z#5L&ZMrxzeoN02#`8RGzlJD0{e<3Z2LrLilrd88Rk0O74v1DM_Ut;qlg6chdPG8f$`q+Els ze_a{JeM^BZg z?`~jsTOadw_MOBk;oa6Dt;uw=Yz6@+b}8Z8&)t06#q{}})odQ7@_AkBdM>(~do*C(-xtRo;d^}=Amv4_+ok)Q^#G@@Oc0Kk1PR|hP z7hv*B8O7!$+IS7sQ(FNg9~@=rY{jv00b6Iw@C{6vOR+$sqOE5W`d0IG11|cyzhNzxufJb7%BoRP9P1gyYLpPZ?B{e7{U7GZ3Cf>q*`Sjm3}P{V+f`m?d0t;OHCbBwBkJP$e*KX{eN9E#fPH*-`s4HGm-u;H=C(h{QncpW~v!X zB+7|EA+$t`K%EXqnF8RG0cuxm_4Y2C35hF2R(Bf-40~MWm^hYg-RdKP?rJJ2EfxoWNmLL->)B>t9PHl z_v$_8>PyR9_wayWHM4no8MsUUnDZz zat}GLiR>4Uaz5(Lz@aNL}Icm4U1IclIY-ke1 zx0f=yB4;9nJeT5QB4e3VmgQUkR5S)-gRhOt*xD$G{k#Mlk9>nWd!({zqXBBda1VWt z@OD1N{yWZNI9&DH8U0UNts`# zDJQ0ju%qm=X0k6@=z9ElvpG|Q9arDqY?euA1O0AGvpGYA9W#bEn^#-kz0_>him)So zL9;o-`tH_dGcKYHs8UWKUhhQ9&rfWugajJG_AJT+mC&RWff_7`Xt!)=it(uv7a6*Q~sW*>E5=?A$29 z-t$FJ=Q!4H<8;u&7usw1Pkyc=7PGjkOF7T?kA?MVD$`r3Uy;yg(I<;#^`xH>WIz6R zPRHZLphs894@n-`+%@R5juXY$&^*w&YtZ=}GDvR`I(A8*M$VJXkca7Z+66533=M$< z9sg!~{6RkcH%Gwwu05E>Dy_=TPed+|%{Hm`1)pm?(M#>|=>E(-SpeY6b3cEP{rtW3 zEY9>*4COqyWE`wdQM+JJM|zt`bD^I*%fsM+wv}32L?L*_>OlIrSM zyZbV`@9X`xe%|Bau?CC>gDT0|XKVSTK6-X1HRw91HF|q*#@N4c2qbR8*dHxo>p+$o zcA_Gn`c4pI^=YC@p2P!agHN%#)lHkqa$2AOE+g-M^)Xg2$Jqap>$%94NO_X%s{&{V zjR1AUADhe-d{340Jw^A=7i>?Z?mw@C?y*ms&EXK;kh;IQV+8rzESnXuf$f`@*m18Hpm$$~l*jp4 zU>K-BEWyTBfc@6*!figoNE@IBwb_k6~8a()oLr-}xy3He>DUhC?k z`+8=7T6`b>4pt9u6ZKsWiF(gwQMY_kWWURQ#x<#@Xj^Bt1E{H7c>ZrR{|*vFCnbA~ z$mm;!Tk*yvv5_OO(d_CobQ4mh@ij-W?w*npWbH{ccC0$Jb+437k>)Kk8f0MDif{9J z3ppdP;T~h~b*xTs^%q`@ltwO#qrl!hIszLzve7WzK?5JdHzTl7>TdG~ND+Dc(=$i# zx`2*7)COgBXsS#xdr5o03Sxu&9xas<4L^Yv^4#dMOYamsppxgKB2r|D?YngqtVYV8 zyD{Z4nQv>Zkz=mOntMP56=mE1uVD2nUnb4zTaW@=zI+m7cn8ASY`j5e*tyHO|Nem0 zv&kOMfy7K&dkqp~zrS!2`w@|yA|!ry68j_9%Za}L?Ees8e*~Z=!1d`jeb^8`I#+MI z?_51S11T4j+HpoA_oJS15*uBP=Y*L^kxQ`=3L=Htt3umtM9;m_hmE&RVt*J~6>p!F zCtX%OFpuh8W^>KSv>}L2PrtvJ*&5=_4AXU%2QFLaX{``%X1}M2{WN86ziu0xE+HE!pfYTS`_!s~G!s&Z33-(&b%2UjOy%zEf#9k9_4V%Pn3kBsw018?z0#Mtb zupaU$md8zQKZD!fl9Gg2G)FcUfUx&<5!9$Co8L-e%&v_jW~q%NI%*>o#}*A^_l;?( zICc%^V`h8_Tc_?AFMjuV>YQsH>s9iTCiBhlu>Oby)nxB2D&{uPkCD=Nqo`Aza3$zz zAFaFIUmJRQM|uwkC@Gioyd%jM z8(x78lnb@Eh}+HvpAQ}@uJt`tM|eQ`TKK%jyhA))*97)1X=_qByA$wxP}06f^u^{^ zV1u0PtWHM>Idc^N*}S8W=dAW&wTJiF{xIuv8^(VBxUgBGou(6-$=Rier|Zj}_s}>z zvX%w#uX#ljGS+gt=wCzDI$O((hTjyj^-O5=lw$)-T;o5E{Z&(E=sZ>y(Pk)TvzA|RJ|Hk4Ue`g)nao(PXjXO8ZP4x0R zDc^cl%V~3wJ>L}f?(Jy*oCkgU4$zO328{i^0CB_heD~W?TKgX1jmZTPw0wj&CXW`O z4cfu;6EaM%JDLyg9bYZzBLF4K>0T;}Jzs>4&qP>!6M)(v`S)%X$zM1Sl|Ugf20*CR z@}Xv<1P49<*uOs3psyDJN$u7>)~Q-?2>%3O{GZjv05b6q%WzM`DMs?D>3Y> zSkG#hI`Tnmw0W4#-y;o=S-FyAA6ogL^IZK2??n}&2fi#qocgZ5o@M*4JY{w56d&Ky zA_$-cz(Z>|w%4)mxO_R+T60F&o1H)b<=QjWC zLX2q}BK_=X2^F?hknc~txN!r~bx0dT9=1=Vdfei-PGYtF4EFzt*EVkW8e{)4fsb>w z(4P}Z@t3rbx;562Ypm@bMiqgq(SzqFK%8E8s`o(_`r9aUuZ^8iWk1iQtSV>gGuK+v zkFoXnCI6l5kF)t2?iO# zvky5QVeZC?NBT~MLGW5XCZPy6ZY?=u4i|&@)_L^)ApXHH$9Q*u9(vN2mzNcDpF)7G zxwIE4wa3_*>#oVW5Rh_+uhA;LMk}H1wk0~tVgJ3mpI_Sj)boBe1vy@&R2&;Nk70(5 zBWEe}*2UcK|BBr|IDNKNFtR8tmemU&CmIS0TJ{N`HpnuS*OA-8W<-F_$}%|-t)Tcb z6vJ@6t6kwKq zH!eodQ5TZfpG5!ZT`lND2RgRds}nuwxFp1uY;R&XZ!faEOw|kV%3;{>14{PuVWOb7 z-3@yCccaS2B8ROyg4wF8O>B%{Ih4uaG?&Lu^YwNVVIzJw(0YlXAWFVX_PSIOW517x z?OG63-uGGGv0QdZiz@H<=v@t^zvsnp=3UKDP?rwFMrDxcDx~ekVr-E4-7Qtn8j4;S zDH5@xFJ(SgBsT0kDnWGs@><4=pnhG54Zl2ae8Tsl$_+(X{Ow+(_y8r(H?grDV}HE} z@sA6!QJRHE(eFi-D;zxP8O|_y$@_#y(@ku=NcUw~Z2wSfB<==%+q@{veI$H2LeJxh z*e`}+;{=rfEVs00UQ}r-#s)b9iEQwc$;Zff@?xRAUQ<$ejL;FfCaTmHVMEMvpIl~Q z!yxevLBEk$gK=-S!zT*t$~^pvq!@9P|VYGyIdev8me^J~cZ^z)d`;Y1EF z`{AcW%+~oTBNyF@|9NGNTw(P}w*y zY<7tduX6ICK-9x`MHRaDhjDp2-mckwuY3HjxpMf+KwVRajmXX>vj${y-C*{AWw4Rw zaQkAP7P8oxHUZ)uSKpD9tnb!gY%RO7Q9JJjed`aSH2)twC>b1zjiZDg62uP-&1{Rt zQQaL?ZW)$|d*gH1bC>n9n47i5*w}P8=vDVd6~RM(_s2Slncn`zFl=n&wP4n9o8e{w z)DK<#39A_Gmk+b!Y(|wA^95KHmwfMnwC2fq%d6I9AQg zg5Gnxg}>vAP33J3KF;!iHVwmuM?lIRsXVqz^3YlgqDs7lmn{UxqrddNIX16ntyatLel8vu2gtIc$4l;(jEnMw7-9F+WL3A;1D z+1>x@D9s(B`BW!_1Fs99_Do|q)#QD$M^BWpm|oIvUNJVvI$QRIJexn4M!t@%G?@p;2Nasrl*qsv{=Gj{Wy_C;l5c z7ajZezR$~#W%Ye#9TNgjdxm7IQNrd=^2ju1&=(YRT5p}NEmSHenqXv6>!7mwg&-#u z6cn^f8U*SBS#C+?gBlpY?n=k88k#LY_EaIXKn|$%zA*<>&GP5vmen zV8vlvaT$vzObbX!4Q6^}NI=Tq!Hni|0AJwe3{N@mIR85ZT0$o=tuL59fz??6zJ?&Q zL{DI~%fo7N(ps4SH4T?SOZRcCY68QdZm5A4p@7}Fpi;K3ocp!mY-kA|!)nTdlwOSe z4TaExazSm-phfe7O5P8fSk+?euBaP8MLa*A(0hhEs<|Ajq&Uz@+R3t?_abH7bN6d zs3BvG9K>o+VEG%@68;rH3+ltFCNdxSPl;^0dp3)KB6`*1VTvnB=C|Ft14?=lvVfGQ zIYvWkK2khEIk6GMn`m9giO>@IC#HPcNS;}G0lh12xC&a(F|3kzw$>npoDTsIZ=&_R zr$9?|A6B~nDGw5PHv=i;H;w-$6M0u--SHO3PCJGTV(&IghnDWWSOozo_mIyXPfO@q zto{XKzpxkA2E9nR+ab>c*M0~(_QNc)9}3FqEg3thfcXqkgFp?`K#QCYYMzJf4YK}k z6!~7r2ld{;j`h$h>5&?`9(IuRK+c0~`p%xiY!94H_P}Up2^NAHn8@z-wEJv%D|kUo zdHG&B8(Op>pb9cv)_|a8&IzoBNSn}>3 z;#I>EsE~scFWETn;d#a8;GXh$=O{^Z|^ahXO+Ae|By{6~5hv_VEHVh*?)2@(Bxp!>+Z^`dp&tY*P zC-_}%9<-!RV0AMGfB;6AVrAmz|R%ST=u zYY)MC&BV30^0?de82hDpazYFW`fdqgt7K@=JfITZt@1z%ctKq?g~p+&a{v9EP`&CU zpm~|AUWS%1#wt1I*&S{3on187*;}2GJk*aT0#ZI42|luiEI)Ce2@=thfjaB%@a)mH zK6mo2?x$gS;Bu3zsja}%%gp@bmfBjI$6up zN!y^lF0yli%st(kd7wU7;8+7euO7a|-h-hb4w*cX`F*^H2kIkaf3=IC3L@+et#39* zkUjS@v~+nv9Y@ZlIqd(yGweK~&mC$uL1Ojp16}MqqTj#XY!dlAi0rc**`(h+(A>|5 z0Q~SEh_D~NY&JuHHUxu62?LlKus!$*kzwSW{mrJ9hZNKL+}3Q8J$Bgo{A4rLQDOrbhq@EBTou2T_uqrH?~PmxrDS$%am7(TI%xIkdp5KS}~@+;EiM!_PJk)4vZU zgV1*HApM_=-P58`oV<-2_ECIRTbGZBwk|(dWV(DfgpzF(i?Zz?X$K&>;WP4H9!ma= z-S;OyC3__gB|oR1A4q=0&c|fWfO?wjZdW)(U39A^&(i{^L!E1?)2p|)*=y=2gEKL8 zO8|UfqNncyz2_*aH(1}xa1{?#$>zpB>A+VasK*9nwi#)++g!%mY@N#DCdr!p-XXS5 zg;UgBCwn?lfQ`ufMp}10C6&Z3>SeabXRf}4O$;AUo8M^q5cAD`ofR)I69fDMLZ2fS z@Bc^HyT?aWo%_SjzGQMCU?7uB1ZrjyFBq*_O@N3sYmy*dsom}#TWet^c)Wl;8t<`a z_5@qCsD~}+w$?TYwmoL5Ew!2I*oz5R>$Sy*c&j>-fCAwb2qcRnd%d5v*50#sc81?M z?_ZhB?ES3!b6d~zeU3;%+>KStbl$7&8et{z^cF!Ub%6h8gxAmctGgd_eR}!@P0{WL zebMx(xWwhd#5haf@y+E$h0P%<|8D2|p;rdA!-sJBY8bjn2DMW}nE4@S-!5N*m(O7J z>}x0w)&!_-_q0pf4EbzE-^aFpt`?~$C#yWN6EhjVFQ#wbqlp&S8yIT8@@J6 zn_0FXC{2!^@038bzk9UE!v81&wFGHO48U*WpRcxRMbN%Q1n52^%RI%pHKog%r~Z(p z{1+jCtB;XPKW0Zz@*3%DvyR+?l6MMFJv-Z6zoaQoSu{3QaoHSsv60pKr8Yon3BTir zil^wWPbWr1fa<(#bY9k!pV)m_ttsmX3EZ6z)f|VcI9`s4k(vS3kqa9!X#l)xIx$)= zlvz&XlzE1j;(M3Zhv>KPRPEnb4lcx$hyKay@TD3Me)4``cQqS7(v&v~h(YN`HZErP zf04Vw3@_}{0#~0kAIpL6{8&@ISLnhDo6YyyHxCno(v95@y7-xJyQsgd|NFc$Z-i)uih9d~N)I$^%Wgp@92aDKCpY zM)y-;^Yju>ufKmWe%%kvgeL<%>ue~lkP`5pj z1J$X!xsEnH2h=FL7ewoWGGMw^9RLY?uTgzXts@3~Cb(L_cg=(Z)ho4GP{VAyd0`xp zAz{b22mr~b58;Xk!u1i9+zgH_M9(d?g(&|mohRTYW#~>Xp=Uf_F9%_;UIJBwQWg)@ zB=Hy$uw#*4zJuYn)pQXO;4xOEEXIn} zHIPc<1$lgoEcb@#7Q!lx+Ss1u(a*Ur|I-aL*)9Qjg8(s_&Qk(ixdGfIq( zAyS>Xh1Xe_o@IY@zNIN^Em{>pO?k?+?rDeXnd|}2JH2o7_V2geX|w8GHkc&f-tX=+ zzV2OOMD~$tw_mUy%I4eqto{Q{xf3+y-F#x4?(z>#xBP=thZpjkIA9p$@mQf*nnLwZ zv55bM=-!$jHCGZ6n16tDvpq8}%=lk)KgsaFP$XZc{H>l{!Fy{-Z)-1P_zyzvgF|zb%@w$eIhWLQ^iz#Q&CLsgv|}R=tGzfn9ouJ5KJ- z#~LT;CFB-J(sT8AE-^Zq1l%J)!f^MiFjw#W+|kAS)280r_-$R@!Cjee!ca?$&TSGn6P6*=@^7wb<5rNfYf04z)SvW7_9Fq#h zNd~w7(IeJf+%1UOS2Z6K5{UT_PAx(VD>XDmR2US%pO^N$KxAoLmT2o#r;IhX(*K}@vF+_~B^I1)E_H1WbQ+{7S z48apa{(2rUHW3myna}$sd)_-!&b)Wp^IoJW8yVl28|QUB=ERr!n2wt8d)^QCJMZfS z#Mme}`8?qqP0^{nu>|4m;@q|LoKQPj^3X{4^ZfKlHC25sd6Z+xqa09eJa%#!;2V!| znRg&>GQHIOpbI-R<%b26^_^Em7#e60^__wC**5>@Iz*dt4AU?a6clVtaI1A=fKk^Yk_J zrKWtH*MDO2jJ6frM-qtJGF!9N1wsJoS@}Gd^?0>ZyfvA?&TTEW>=5g&JW_>{MD^iJ}sZ$XU_ETxE+)OiJ!X1`B1Jd z?05D_uDvdnkD-|I3#%WY3BvrhGXeZ99vY#&4vnMv#E86dN%G=3upuo0i`m^=#CgR> z2Q#){*7~I=AJotDh(YQ193wSphRIP9|Mh%!?~wSur`=vx-#^N?`hF7E|8`Kj=6}%# zLL!f+0-48I*8!}I3803(b9B&Y=Wlj9XLCP8^a?>AZiz>7Yg~LP=5ySSy4Dk^94VJHVz7>6tn; zrc}e%W~HS-{L@@wwB9e^$R~?&Yn#CC+Qrji%4nsaZ==6`l7m}6&%ykRmoQtoLxh^0 zxvu#x%hP+PZhTryS&=_g-YhxD?rO8i+?+3l@^qBH=E-_f` zsmg3N&qK;(Z}WQ9^c^}s{iny2M{~Ih`S@XCbQD5Or>9?`s+dCOq}%|$KtaFNFNSYP zNT3?{-{DGoeE#^GhdIvAe|zbi5zFl3LeJcO1Hj)T7V6RdX-pQ+JIZO?@1fD_qA`}| z#8*(cS8nMSnKY9f+cIGnAv+1up?SE>uFMgfR z2YvU|11uJb#X-~mA9$F@R$uO+6FbYH^JbnCm-5d{EPZi2d=k$Gp!RzTpnH*bKF^6U z3^2x@4~a?lIgh%|`E=`?_W-E&oyBl&`|J$`F!KsR0xIyDHB@G#BtMJ0qO!w|eI;we zDYYIf-EphC-h&%sis?9O1f39H7a_S_Upvg_v%ob5I{x~n@^m@}LQPD0FmLL4TgB(I z@1GvsF)EhLx9dQDc8KRnP#Jk-IZBqJn!(<2qJGB*H4!(z_hM9)gW8nq)ERkng6o86 zf~a==rvrzG5jke#4f*4WSb{{StB>=g05uO}X)}63jOF06 z@tlXS@GAkQ7a&~HAzA+G=9D=TDtu$xm+LW07%$zXB+nu z<6=SrJ0yq?REj!ZyAtLj5hM9JT|cU?rbMV&l%>Dv`k0brXUe%FwR7g5+0S)?a4xTd zTyb$s=>^ynS`B)UkLyCURvyX1Tx;K~MM+_vfXg>c<|n;7%N@DAlb@5|PM$|e?UY%y zJpOKDJ~5CmI-k;STPd{SAp zS|5O{5p_3Kl*>=QX^QSL$I^?>cKPSe6Lj$q&sRG7EtLGi2hBYqsPE^v)(7P?J6*Um zrhMBPcg5)rU#r>g(M3IYQYjy(biLCJTz>gQ?|*(h+LGzVlk=x)_Q3Ue%3=PdRdIcy@qn9+Vb=a-+gJ0 zRga@24%Rt-+(U!KUS1wk{>|eit6n=Uej&dD{W;-!=fsbCpQF4RimW`tTf-PmM#&D? zw4fYrI@EE$^P9H8&O!W32K$TJ8%Mc}V!4%cjotQ5$M#0td#|S0XLI!rSZ;ndvsZF> z+zp)h&k@^kd_A7s`nYYo{R3Dke)@O%q@ffXld619`XTo$wYjku40f5ik*J4NUF zUs>NjI!@I7_qi{c{!zNxb;s0 zj{Yso?&6+pk121_-(KPVo7TSx_}2jb`$S@lN)V3$tP2&MqL=u%UUyiY+@IJAzVD7w zyZySDLgy5GT3?Cm#Myr7d57VeUKdlY^Et9O<-)C9vX2;4M~lo>ThcrxT-ltX^?}@T zP4Hy6hw^>8pCY1D2lL%5ZG`_brd)QMHqP3|^9xS3aEi)-=io3*QPBF16ma|Dr7U!X z>tjldYyS6S;*QJW_Flg)hwCFfA|!s}r9oxN^)cmSAD1b%JhA0f?mlAl-w*nVl`%!| zaXl}Z$784K@`&*uA%RPBoEn{@YXp6O>fX$LDUHiMe&=zHWSx(3qEgx3Z|UhLTVvC* z^ec8lOfhpTzBYr`2~D&529xQZD7o+prPBC`dBm{i@rTwtwoT*w>iTT$+!#}SPie1R z+%;h5jrp{`C%(sO*jCd$bcZVrIKvN?cw*qc3F=!iF;I}7qu>dk-hE9yCM2heo`VlX zNL(ZngPw&<9|{Zf*v*{pZpq1x9s8TT#Av!LrlhQR<*&(%FZB&d#5j%F4_s#c{uI8> zAVA{GEbWAU7-K#JDg*3VNOV8{@l;}Hc~H&kpqIwG^7wfJ5fZcA^Ho^DW!x<><*A(P zaaupx%lF2|R^0q;0x<%s(fSdwjOBdMb+`4>2GII0n8xplAxnRIZ{_oH-*M(8V$BP) z+^u|ynq0Sw)psF(s5U89UnM z1+vxFuV`E6@qF1z(E84rX4(J8p&7b6rWEE(zQ-D*Ho@I7cK=TQ{+f`$HVDqQZQ*(< zLw1mwTTBwTW6s444`w^SIx36s1lylg^gQ3@p5xaFnEn}iB&K}dBmr#U1gE7F<3}bq zkGNa}^*<$Il<@qeN$-UojVS@p`qFatz5UuCw@m{8{%usAJ?iA6tQNUG3=$-+aP^7h z>%Uf@haQWuyfDfivgK;MFi4CNne*4(lozx6X*w5y_`nk}Mb0J0nI>Ojy0(r9l1#PM#AFfdj(LBiBsQ+>M`XWdGda;_vrTr ziSauY8_(}$WLZ-rK~wA;l~W}rM`gf6JN!5wZ&Y@2RQ51it*naDqBhzZ7p-E+$xYen zp(U)3v6wP04+ECG;<+tU9^NcC*uA};cRSbfe$>g6W%56)b7#xW@8oek=ntOvqZ?u@ z$Ct~>$!#yS+Wn!)^Ldu~oIIC{O%m9aGjD!m#zh%EmI6rp%uRpZG(By^lz*BeuvQ|5 zFc)Tmpeg-p1fBBMP+`w(+PBbZwEpk;9G8Lineqin_ZZmz3V*!qsh9#Uhw)7!F(Stn zv+wSFtPyW~DyBqoh|%#1_fybk&}$@dx2GSBH$D|p^a&DBx0Elq#r1m+{i{u5zLw}O zW6ISN*>ZH=%;b8rc;{Qg*w&r>o5DCW7bTAr11{+fV?mfV|63glA3uX_>(1j=B}jy% zvIR@seatJ=g=d-HkL7Dqd64bw|89?sdr}gA_PLnC-d_!Ru4S`RU77011C}4f_FGnh zrkq+y3~h|mP<}@F%YJwK_O&Q!$A*?)4!G`OXzrK>>Wu=Zbqk?6m;-7Z0(PHPcMi|B zL7o`Ty61uU zteCPnj-2^wH$MYZuM3K0^EvM*j?;GjdIiJquW1&DvC+;aSXZb={~A*|to)Mwq9t2S z5Jv|b}(O`N+j zbqgd>0jTK#9-H}#L;QZ?WOv{5rt6)DwM^eTMaP#^DuRDx1;Rv>hw?>GOFi!iN1XT8 zTkqA+a@Oze-CWnYRs{b&bbnkG#xIGG*my)!Isp!bR)fCVk_qKk3K;VF`a~5_yJyXt zZ^xA0a)=m^3pGc<)&A<~dgrL7^brzx5@4&1ztD7nrfdUZq?S8a3tKMGlyYJkaFu{l z<0P>ICXXX@)EP%qoT@9mOGv=(8ye$zIk7xVfgnl(2nFd|*x#y-%Q-I8DTEkklvKav zZs(2}dS}SlBTKAyHlL#@e-Xf+Uctv&eTW!6qog|hEdPIKFQ;X%;hFUJ5mKF6f_NSG z^(gt8X&MnT2X_dNc)>eI$DFZM(S7OCDc-c|1v5I&qU4K|j_AXw3DTXq+WP*FDEU17 z-si(X`u%e2`z8~S~L4@bsHH_KUVCx&*ARA+L}Wpt?HD8Cz_XSTpJnLg-0O1e9I z2$OFCKH7lrb`b`pvp^lGLwNhwM_)<}@U{H@UXB-O^H=Sxyal%WTO1<>oC7t@o;mJ4 z(RKa>i>I8fDUT5nux)c~E~xf=lO=#Z9OAmvGB>Svrt7_?rkqc8DQhj>9pX6j_FB9- z#OoWn=P+uT#u(LqUGsOXX|j6M?zy|#Gz~04yj6ms#yRL10#G#>65j-FXSn+z03Xv_ z&=fi@YNxy;@U`^b13bNpVN5fO4r)J8evp#N;>E-?=$`qE{*_AO|6;c6oOpVI{y#hZ z1^atq{Idzun0uJi%pxSvCvm$5iI50n=~q;6=6b!rutAh;w$q)vh(Y;h4B%kDG$$Uq zu3Eo=?wtuz&A*!+58YGE?}1E{)ez`p-=7!{rMNHq`=)8taS6nC0rycv#z?ny_i`|_ z>y*sh%R>UUt7*S?6LZp!PPv`)zX} z&nX#@%Ho`dmB#yvH07t_WM9>PNjx4bP0zB`cO4v@gjYOmb;?d#3tVlbb2uOD6S=Mt zHaY!6BEuG8dI7`1T!Qe!0`mh@?O1|v+Sxx!3_5P>{W`A~@eDE9TDsegoIJ_Wtg7bo_U49f)=$y-64{}-6;+})KGxS)2 z(+?^S*xvVR$|?ZAeNNRuD;DeL99xv?wl{d_bWU^V?6Bz6pUvm;+a?Jd{Vm7ps{l>e zb|K74Oa7|X`*?h|U2EXh5HaXDhb^3K`JpTwxK4)Q{ri@NF zbFgajD#pB${m=`DgD8t3bLvk2-d-ZsAGI{z@)KVb8&*)K%Aes;`no=uwjP;@!&Y==6kjzK5#X{-2exv{l9*~Wc7`yTx9o>!I-krG>tDr zzNcF~ZHI&0|2siUu8*CdDN!HKqouT4f#I@KyM*Wa-{84Z6+r!x$`T*KJtpbC!8?}~ zuJdoTQBkZZ-}B;mWMV4ceJ)#l`S>`i6H?h<#KkrQ;`J5HOATWz{ydhW{7 zci~p7*h)%T0D^?SGx_rk&XZH1Z=0!_K2g5S%ISbhmR*Eb4f^LrN)15=s2m>45g%}!B- zb;rG@odeh}!nzG-E#Y^yXIpo**P`U|Gokq*0o3I(FkG|xLiqObAT;mtfy%}Z6m|G+ z(>+Z9Md-QUT7dHH%YOyU5kIKUiJ&fj3Yt*~sLP+>dBDGN&qZ00o^Ew)gb*>a`oCps zKK=pVU)~MP=?S9tpN;Su5#f4}1|?QA9#rpr|BUJ2Po0f$Ok{PxGIe;!glW)c(o#vB z$D$R-c`p6y&;53Y1iZ9kCYeI}J45`w$4xstLDb{X{qy0ebbH69(%oAywa>9*$EW+w z$kcua`1sF@<5QoHjU4~^$|G6mA3gr_Gf5Wu!^eMqym0Dxg~P{xek4nOVnfG&{x>Dy z_s+X;aO%9%evf2gO9KpBkyHX+yx)<}NQCa;akhVX-pH?t*u6mK>oMgvbLu(%kDbJ@ zV`ewM5mVkBH;tv4I9pH5m!>Jhf8#N;Sz~H7O}VRw*Bi8H*1r)`ULH4@EJ~k^aGQv5 z$dW9Zh~Z}-$vui{uUQ|qY{B6hXUfaY`#sKVuqxZ>Xki!yYFQdEcGGHj(_VZBsAG9_4f zishd8=oz5;CQKtOfclVoz2?o-dtYF@m*o!Sn4GWIe~t4T#@lxgV;O+o&PAZ#e|;Y@ zdUBwKVd*`~^Cf>r*!@x!5=ZB6p!~RsV|RV z>7PMjsGuo7qkJHM@Eg{9pO2Y_I!0=StoZ)OAu%afHsIl6o(JK#{Ka-`ubLbC>-E-&KwA~zf+ft#}6QB0e3MrZ1w2er)j9-7E5V^-}T29>wKF!VQPa#%L! zI#|5j09!{^NL|M7{Q9UQRM9hR$AH0ft?xuOH;@>lb4K;kTxQ2^tuHFkS5BBya-w2m zrcn%9pPOg#cxXOuCZp*du;Lcl@-zj;%#45GJ*%D0Jg1#2v$S)=m}yWNoAda%e>-Lx z{e%QcLF>EgEWqEDpgM69=o^0LXE=Cbfu?kr4e#GXOhXeP@e*st&+aYkcIIbk=L*)2 zKi}UzPr_}VHhZwe2WH!QECQKu862jl3f6roe&sMsY z{e>Ef6F8gh%X2N;XS$}GVXce3=PIW2J%7rWY1LQknpEe2*EnTyY>eO1Gf-26Fs`)j zZ(g$MJ01G?mbEFB#_e|Z z74UZHzKRuq8k>Res}(TxP7bIiv$|`}8WqZ*w)qgQ&xh`?4DU7Mp~vaC?R^*;Z&+Us z(pu@p=)(FGs%-^vl^}o`lHt8@?&zO3tL#2yYv_5u{=_lUXgwG3hodBsruLmw7XP5o z!UsJ-y6rVApH7U95t6uo1nbNlStcWdt2z)$99uo0a-;*HfV2X*T)(_pwTPjMaKzI{HH5LxtvU(g{iZFB_4CjE(_R|DWqn9?~$c2qKEkJ_G0Q$K{gakdq z+eKmRu?9i^_ zV+5N9n)v;KQ9=US#!aK$G>!5+Xr^t`wi>AHxTpN8&}y`P2O$C4-;e;T|0#g(4<+a> zKL>`oMu-aMzFGGk9#%;*H%A;Fr5o});Eao zcKf+7^pFUu`<)UWc%~Q?^n!&S|~y|cqY_R8Ms559UtIv zAXT&-x(@XKYw37?^-CvyZQ&rtHGAg*%g0FPGe=Vv@%bG3`W}A&|I^Ef(X;yoRyQ`4 zM~ujBQe6g`atqb%&Y*nBKiIpAsC14r5mfpe-CuNn#&SWup{X9u(fr?VHUY}~LZM(7Z|M$Gt6+%m0(0_ZSA?}kwD#kF6jKun#;uxd3}Itx)#?hMRq!`QNVTrs!4rCx@a6?4UwP+5ITJ!pN85|iozRS}ca z_mg90R=o9_(!|)A1 zLxcn>IuH)7t8Z!Y0ghBaONjDN5o%)>Hsa`Pz_Cjkar7j>vH6WSS^+rrSR;;}3OM%D zrMUH{Lf4&DkPOMFCAtw>D8D0f0B<71fYo`$(JGWoeG0Xa3e@sjLX6ZGP|Ng~EucSJ z!1b8OG19G3*{}}beFfYH`(D=gnpe6)a?drBZ5+{A4;K!K=+XmH4T4U2So-(0e-I~E zL6ZCyTF^R#CkmLopSWt&wXe4dy6~j4|F+`n`|pn_rY9un-nIMCfA(a*Nh%-Imq$&u z*JAWp8Q~`ctxu~$Nvb1KIY4@0*gisD+zhDTP|(HcR$vMD>?wz z6_#`bWihGEMmV++wL~tIv33%|kxON)RUjOhFJtXggd>m1EMC0pDPquZP+gghgW9Vh z&=`ish6!TaGhfE{UMS8A+Ox!gKLxh%5Ui>t>>7Hj9tX`alZ z|LnDO^-1UQu!To`niXGF2g!)F$DS%6Mye7Rmdld`Oh;sQD4Fw;1!r){sA({)#(5|S zLDVv8@)$k44%_#vdy7Yb*G1C`h_Q#;=d-fm48pbbI5Zb#JqwV?nOonIQzo|jT85c9 zbHx^4S$&I;l552dz`k{2i&Rw7W#3f|NCLC3+`bv^^O55Fv1ts@^CY6$2taML0M$l( zs5bQPd)^Nsh(~8IeLNnK0Y?f@3$+C!L1>AdglZ$RUC&im&lLiWR-xL+sjlD7Lbcqd zBg7*`khx1C4SDaeetGKIu$ub~qJGb^dUihTHKJ#fV5SGCEY zHl2@>{Q%Xy05x^F97{R63?=JSXa)gPO7loQkJ~*q#_wC7%jdDAw2kQnyrv5hp}Q@Y zx3M^gTI67T%c~%-idi)J>i`c}baq*Es14Fzhwu?;F5^`vQd{v{rjsY^zKX&6mgOL< zqPoP160h;~r8GO14)}WX6+r40GSs z|5$VIoqS^a44|5=ALQxfsiK$fUJ5K9Jn~6>G6;~gb@p;uZjPPG_0?Pfx~X17^&_ee zolJQz!&Bztr)TyxD+l@!tF80%iP5?g@L%co529rGmC)Ro18QoZp_XA63!r{<)Wz$o zMP0bb;q~7cweCC%c`O8-pV}{oF-Yx~ixBQ#!sn$N<_xy6`hnuwR!JD#GD1}P9i5A) zBr-oh(4pzK=ODy=e6LzIKhLY_nG22F_VPt!e=zAD@T?0mzjE&x@W2Q%wHTy;5s`h*DGUNCQ)hs+pRilyKUS35rlu7$M8D3pEgP0PJr%qsbuht z5u&a>A0;o4p$2VZ`#QnuHOstqJ3V_532M@V4YjGS8kkQgeSrThp9{Bj3jDmE<~i?_ z_fdYg*>&dW*}mT-fv=8C-oMe?HDwVYfw`=X8DEzRjuE5d3y#fMB0)E`t*Cuu^Vc0x zNqhzP*V=x+ylRBG->*0h0-uYof57AH%AsVC%8EBV?e^ZSDbz+LO8`IP;c-+4`-e#a zy*`BDyoMIB;i6i)*F)D9UDZV8vkbKn8Co`9gle0LpmuWwYH9LAZEGR4(6wz1LT&V9 zsHJ-(;)fP06OW9T4DUD?tZxAsW(I>|3mqTB89xW~$fbZ^ajng+Jw&|#H094$ZLX|! zxf=3xx82M23L&1B#HxM)w$`7y1UCZ0I|6`Z(E6y|D@dRYST#ta*Vf}o&=hJrR+Nb? zl_|Nlt^;tzI4=U_yVs@%G8N)qG7sA;6c(fK8OKd%el zswwrU*?I@SI(RvtuRl8ZZpOaLz3a1#ZMi9%uH2IY>gpq=F)9iA5ece<)o8t)-@O8~ zzVpUS7S}g2%-c`nyu%FpoSu#Uyte8M@j9cf?oFwG@o4dgL~;Y zjJ8$iO}8~NU*B$*%_s_7KMU;weTa}io6B~@gaqzAWEzp%8gXh4V7hO&iGblDLAQNP zc?=U1;saYCgDrR9B4Tt{d0xjm8z6x?Hf$P^*Qx$m%H&HFG{rZ{eVT<6M7`Tuf4cVd zw+ebV$n+1k2ZoPix3@q1H(__IUd)V4z7~9K7S#hHBB)euQ`-x=wQGC;{yN}wT$Wok zdxKUj2>L&y+LihuZ8p`x={tw5y1nC8J^iDuyH#=clB9bNu)9@2$$9~*DGyFdB~||> z#OQ(1`Pw(8-eC?{ShpOLNK-=@`Vpv zTXxmS0LjG%moNMk$W`>SXw_kwTrd8wUH!sjjFKH|fYp^@v2Fn#>ozP2RbnH;q!_St zIl_x&gvBcn-U#B_K)dAwr+bv&&t#Pc5g({G4x2{%HN5^-x)|Yz8Hf#d?ldQpTm91 z%3+@Ca>o&q$)H^Te!q;umVdOyo!;_=a|O%}seL;L-qrv|(x=FLyfLM^PuEogmz#io%GpyvE6 zZKY4ql$VFitoiRh|J3q9oXz9S@2B?TqiKJU*Ao0DSA zSxk7TE0+8`9!oyssB@<`%}eVvE9Uq-9!q|^_3XP=O)b0t;dC8hxbNwFQ2UuqUK+pY zutW3cANmC>w=wcp9()VsSXl8QV@fMDOL21%Gch4~Y?NMq|Ekc;? znTje+DL7fE6TV&kd?Div z&jF|$SB}|qeYuBBgZ^*Vq-+4K@9JZw0Y0dC`B0WUcb2Bi_v{18ua9jJ^Z`kT?~qQ6 z_cPq)Qbzv^*F65pL$C7;P5Frx=TGNCJX2HtF=WjJK;kLS^U*Uk<*$Te{L}He+xok` zpGJ92sFa0G|NR1D1P4eprN8-Xem++o;^*^`Vbch@`I9jf>-g{?a|+h+#E;(3%73~6 z*136*8wYC=?`idQ%{*ipqz>?ib-sV#9_t07uDue_!{=$rr-z;MeS!-+5+xo?tQhtc> z1U9CAWAdFrM+K9_Rf!PQp2+o+YRvqoUKI{R+rSiGW#Zs!6`>1Jn$ zzyHo{91mc0C`I8%7ankU{I9djW%!$#Qh9hXU%T4s-!Jx?hMR9almqG$Y+sf! z%!;N9HRUe{%?$R`qaOMUyZ%B=Ift$5iE+&Ma9RBAgQgMrB#cv%la~~eKuy(gS@I)` zcU~@nde4w)v;iERv$52j{H-Y%u`yF}H&*tVtwibyYYa9}&7kTLQhWR*NJ2W}R z>0b!S6U zMXUYF? z^`zv(j=$*xH=fTz2hYc@5g8MphMt=h75TdRtVFICSdEIq(-7wMC9V9myoRnLS>`q< z^H^6qf2~(8n;*4ef2e+6o(DsM2n_e4M}~yoJ;s+MJ@x}sQ%xi0;kMRB|)YhSPf_)FTCc-7O`~7(vsxveS@8llA21oFp&vA*T=K7a#G@&zzslC3rDF_-iOtnxhfG#uZG#VH@|s|QOspXtU-2F6UXhJQ6F{Bq z8Ao)rGY*4|qlAs)w;5Wc8Cp9rG2jTPF0tym@|s=#c)|xWpE+O}15!y9m*f1Mk1;W{ z!=#$kgE(LsuZpm0l}Xed?sM;ZGE2US|5lWA*URO1HBwcZ1l1ZnyB8t+?mp9Ky@=OX z|JMZ^Z*<3g*SI1%dinupT+xHsb%n+cv*(z!E`>=oS2|sC{t8RZg8(X((LDe)nOrbi zH;PY7ZV;j7j=weH;b}a_jLHH3Cmj1GgL&_&h4giwg?XO?YNR5JJ93~qa(x(g6hNX1 zz~6cy&zWnz4U(--7bIIZPD}2Ri4i>?F`V~a8LBgS3ApqUtLCI#J3I`UlD~*!7O;AA z=ZN|@gRmhbz&eO5!I9Z~?3o%IP&PlZtR9ya3d!=I*g|Ri5t{}bTer^{+h-qh{E!OJ z6hYP$O|08~Du6#z_epZqeX{D>YE=GM^$4N>^BHE__lRNFx6jnXyH(WvLD)e5XZ`#x z?`H@^o&G*O2pisa)rx-ae8S>6SzRtV@9Vf6?f#e;{$ax6yzV?mYSI!gKm6}LCI$jt zE8Y9f|9ni04JPS+)5`bu_(Z2*dyO;*`sjIr?#7&d60|(HCh3xO-+NE*bG$LI}K`XXsX9_fBs{Fc<#yl z@dtq4lc%6=`EepgUPeD_bZ6^kcnOKHc zP4&osARHN6z91OXlnxP+kx#@VoliOslvhM9Wp`D5k(C_J`8`4c<=^G}?sHGup(mZT zzkk5dYtoeGp26=G0ED%XrGTHX?o4Q#cQ$=Pr(>dRQ@-2&46mI@KX*Js3@8Gfwr}6V z(>`gmPfGzaoTLI&tGVLvVs;#!>m5ep{`{_gO}UHA9`ESge@#mf&eS`w?s+4hPV!W%^KZNHVP$Jz$O;#+J!arFc-QZiIWn!cf5_Y5&Qs9oo(Z_2R2 za){9*IkD`gd1Bc`YRAj07H=kYgT7DKXqHtEhVD&zChT~WEuzHkQtWsPcTCDVu01O9 z+TKd9mD96PgemvX$Oq~t`%EKU$=7v*D7 z?f0UaSv`;%4R{?mN@E8hfhPdES$!L*+iu^%KR+cGTa42^8fN#mT3;-pDeDNcp_vaO zB0|!Qal-OvtUWH0@&$Eyh0X7nguNS$XiAK5Y%OHf(GObl@68{9ZHC_>3f0cv75QN zq57&Iuf^z||09G1>~`*kug!WkuWSLGH{_@Dm#35EkR;~;79P5^t6qS_;bKj($Jbvs z`Tim@4b&g)HH}I@we>Q**9zj`Lncu}GUyc`tqqw(P5-yAOB^rg`a&#Z^_)j<7xbgg z3OZh6*UKx7e=x%GXR43@HK|1iN5)BF!7);;?YTG^5uuvQDr}}>IV`Q8{h3wMvtJ5S z9bQi7rnu_f5t6wV?3YfA)9>hhdd=kDkBIAM@3i8FIo?K~>J&nZ)OiRSA|y2*;C~Pj zSbwsn{GH!pRJBDkB!_r z6gxQ*%&+^#l$_b47GLLkQ?la1gg8B)c$M5WDv9y2GXOLDMg+B&?Q3C`CV|=`q9g)H zrbI|?$#r3uOsQ4;`jm4`L`bRt-R&YIYd}+Gvpq`r6iR{sHFG3L{(OSeqyik%*M9eq zrNeeeoEKmT;>#s2W6Gg~VgBCB&H%rgEgRu?Q0*ea-@F$As85TKTqL0+wOPkRNakf~ z{FcTGtvP?fBsD<^v9Zy){e+N!-Oq9B^D)|&pr&X-$8DP}zl^PWc(I?{*efrI7M9q? zc{-~Lv;}mkbC$0LhE36WQVwoy^S3-{;hv;KsQ$(v(^yc7?V@+xel$f8Y2;JM+IpPtcU}&*Swc4(yrSe&2GCxF(vU8gQh{}t=~Ow za@l;Ln&;vPBB;#2DuF62TLd_`BFi}`1(duF5Z-Ybk0}-ak^_<$4~d#0Ml|K!7kFKlyF_l2 zX7;y7&+jM$HMPeyB9=^GzTBch#>42lKX9+NHce0Och>upLCb$1a?aD=`iQZ^_8S9A zvb#0G;fFyP)Tn6H+V}G|8og~C;IT&^2(UHLc7~p46ZC;%LGPCYJ$;zRQvS^3XC6eT zrZmp;(C9qm^mEgo<73?JqC05y^A5^OBh0syOx2-e1$=E*uUt02U6h-{BB=Ddb>xDY zW@k@Wb$KrDcd4h%=wYYL_4eEZxh$hJ!c;#`wJYr+tSY4Eyn*sxe-+Dj_R;+hs|qaI zWcOs+!Z649qwk(E&fleH^0y{YBZn?YYIzIix6deK^$Xey3Y+(epr)4aXC4(T`|6G* zINFq>i-Oko>|P!RN88%rX)8RUDW_9@)4=`uodT%QLzg7e!ov9#6QsI>+AKNz-48tP zhA_`}5mN08yz6K@U*Itgn%YAJVg!l0|r;qpUW!T58oj-fp={@4i z^+Ic|H=f1sk(SZ+8c>q9N!y7YBP!KrJADX80lMj&L;%!86X@?UeYb9V#K-N0`IFA# z-=CWr*YD`1?l?m?pNfc(=wA@x%J-n-HtpWq?P&?A2!&ExS5xxmtUHM<-_jDtub=DS&CB~;HV_WnLe<@!eVQHWH-kIQAj!90wIG> z;>?k!4p}4z)aQ1a#&D&e4-7cI1TjzRdt?!>$-;0mfnym5L7SD5gxXX&)j0*d4Ya=0 z2?E1QcnJu@;_ffE?;&)3RL1OPNc6K(gv$JcO-dPr- zXJ->VJ2&kyr_{IfTlYDay+;f-uh%YNImh>Y#baX8E*?Khd4%ReT_aZs`slNQo_f&N z#c{#P;(r?EddRz;w!S`t*2IrYX?O(vLDDVnF?_ZPC)c~+| z;6Y#44&$P(2TGxf+8R{;Mt%~;c3-dj$~5l$3HN7a_C=j1#y%g^irpN8EG3;7|LHI> zA`-ATqW-Iy4luY&1oi0IRE~*nGn?xBzOL<}xE4U`J9;+YKkcz_qeV!p_l|RpGtQzt zrm@j==SFRz2R+ZnX2%qkx3~b|awr{4383EZd8XGzb8NSDA6eww5r46j7#lJ;QYCTU zUekaPQggG1PIRtAXZP-@>%T86j?f#E@P6$W7drkQO|${4e)4|~2BPL44-Jaru>`@`w{-UEV8ZCN_cKLglQ`{w{#6WUMaE0@aR zwm-0iUh8N1AWUx&DRe;j9uZqIpv&^r-dG>=lO=DODOzqc)O`_I;I7s!Cd_vSt zv6ST_QyC`gSd7yE-L_9G=)pv$=OY9bKBJ{CM2N{^bk6_EG$LQ-;GhVJ2i@!S??PQT z-PyD9arW$2|KfX=>etb?5dM$dCY3!kcX()Zx@ZmU%1&$Bzlag}axre+Z5pj#=HNY9 zY9hJM;!#h|AGH@F(&V_hu&-?Xq!_O(cd6-IP$N%=lO4HGbCJ8>H&53?|EXpAy=9lB zKNoAtSpfb>{IXkp zFH6=HK{Jv;6^jrKo$SOH+Pc!?t~kAC$DKI6r*`l-y`6*vataaNu?6&|S*3b(Rv@E) zcR=0t;6YxWER>~g7&^e^)8)H}k=oDnK;^EicDW`0b}Y`|sYj{&ch6(bbiMNom;67@ z89e;YshH~U2EvhDCaeE&zlUb{%owlRW#M$%xbbyz`E68&i20gQ2jWVNuEphz7$A&0 z01{A5zlW7{4sD*r^Uz-Hvh##lZl0zo--|oC>BNtES)X>e;L%&Y_+J! zeVL)vXg#Y%3R>T9_L>Hgpr+EE>wll4r)~Y=FQ@CBUu9pr2mYDy8)nCdnhxquzch^+ z(3EI|*Yu0*xi}dWbJ+c+6(hA3E~j>6>}lGcJNKDJ&lstWKGukXo9cOd%=ShMSE8f_ zc?%+ajY$MhQ#Vh*-w~j?>BUAI6;IKZYcO=W0P3Ngd<@Z3V+tL|zX%Cb%nRdCBwrt~ z{PdNe_5FAsyIZaK(t18Nk3YY~@`o@?X~`d#E=R0pO$6$;cbGgDsRDS-&hPH!IplOq zbS(7Ty4ORHo%MJ@;_E?m0YI8k5872fzY5*5n-T=`&MNa#33dE4ax zYMR~e3hcgx+MwfurU4SvwD2`sN7t+VX3)d`V0(2P-K$5x%)VFuKi1v_JgVwi9A9T< z0uc}q13|RS2}lJLBq8BpYdMoicoWi-gJ|pR%*o72GRaVoc(YAB1 zzk6$f_x75!K5B`#V=V@3y={GA6nyJUz<1j#g2+Lb^Z)ka%z4aA=>PkE@sm0Gwf5R; zuf6u#d#}CrYtNZ%wM_Qe;%H;~z*()1DRQSX>oDC3r#45N1K~9@kJBq36FDW=aH{@O zg1k?T*TRJ79E>vh{$Fz`osW?IzKfP`w3TQ6oWOTy5S?Gbvf|gpWWpnMpJiXjWrJ8g zY^V2`JfQX-bgOS3BX5h5x0EXI8)w@-A~v7%%ys_(k^@T&dhUJCu=$(Wn+*zuf}x`g;G#DhxO9pkd-U^z#OLrCq^G%H_{1?=JC-K+=QXWzwu@6A zcfzo1}L@5CAJYkfFfODSbg{|6iF#4-c6o5I%L)k5Vzb5;)N^qlh? z@mth&ESJi7I5h!qS2gOp)&&2vW8@9D-@cbiZAEnJ;M9|IoypFzTuPb1sqN@@5~l{x z?^I508^e2|zS-_9SAeu&82+X-1vMwWvA0}1LunO3iYN@JRV5<%O_|l-!=x@ zeSO~s=fLs=w%^V;D~FaHBlU>@ccFDkb)YWU{T}w`UcdcV4!GPEa4kzBtrIwd? ze-6>^C zCF%dG>3yTi%AMGzGgC%r3GZtAvQ9_x_aBhA1^XEoUTnwXIs@)6-_2Rxb)TVWm5878 zF^I;c{;s8i<Q|qW$ezo=t=@#+e7JlF zjuN}-DsbU7#LITr9s~9_Z0$dtLvyq;nsr{D-xm?lJaA5{1LtMa&pKxgX}hN^K(Y^< zFewv(bjIn#{_7Mcr}`$rzDx&~t}2I~ECWKOi%a_$sH+C@Ui{xa%%%FBQ2($Er|Q*Y zPD1m}DXI&h@9c+UPC~HnJ(e@x@ct^NlJ~nS@cZ4@eV9wJWl;aGHn_|>vj38aaB0*A zv_8AzSPt{|$Rtk9-U8|G9m}QQa=18q3zv2<3J+5b&aS>3F0P((a5f9Dfw`5t2hM7B zW2l{IO|uHr>JM|N>?&*SxYH{4UNRzD7nfALdfPK>a`2>UM8P z@FV*dB!58b()GcYDILX~M7KuqFMLRJ#H`2O8(fM`WC5x03e)j^a0oNnKx1 zI{odeCg5^U8Rbr)v4_UT?dt~-4qjkB9{55N5buof34SRk{Qn)xr3TMwmFWBIxgvHw z`FHDH7;l}K*C|V_Gnpx-b$W?1?iU(<>(+O01C~j?gOjn1p>Mr2eV~L- zByJ)IkByP@CnW1-I=<^|^^4z3@EKFRoeX&s3YBZ5Z8MMkerNeIwBD_zI&q(1mc0Mlr}Hh@Nhqsz z8iNk=Iq)Oo9N0Pdx!*OYc9ji&Ax|K7VYkzB;5Q)6xHz@)4^3*`{(PFr{`?|pe|`}N zzpNl{BY*YXTx!Ox+&w>KPA_}FjPDJOo?(BT#1T`}m(%S$&Ir8?BPu1%1 z8}(=omgj2lHd`%d6`@a9wu;@U*R*`;i^X%)sxMo4t|sPN2orY;GY^Z*3xF5M!)#8miiAQ zx7IhP%p(Mj*ziwjMsTLba&EPafqmHt4f%at#GhB&=qG-f;J;_v@2D;_@w&RJ0C(8c@m&WIxJ0aZ%@Cj=Bj;EW{&;SlY4abo;m=x%d2&IrZ7ji~_2|J2 zx&OKGD7lCE?RG7-Y9jQoXEZ^5U#mxB1zeEy?VqY5KE&S#r>ef6uTNuN5C8(W;2XZ5 zPfBy3@JltV^0FrvB=6nH-IH}*Hk5JB9y<73g8%C~xs>jI=J&QXWSo}`G0!LXubTJ+ z>Ae$=5qk%uOH69VetM6i@#&hyok8n_UlxIreLlf27_;u#==Wi#{8>xYV;d;qI~(71 z-2j;1rcEHWbw9Jg9C!iI>9U~;6Ma9%a&Yz#(!bDH`rHfZ?GrTe{ykd%+hAl5CGhdTw_omxya1)~m{v*t%vxjb7tEH~J(yg9hVEEd(ZuRvta^Kkv@JV$=W&W-CO~=T4 z|H=h0tkd#=Kauk<>~l)eQpfO}+!;e-_dAo>qfUHAGY`$7PHd-)+nRA%&lZdB?|)2u z0Pmvn(Qn?%;eJ_Sr_U=19`XLY6o=p5Lhi`v`aUZAAMfSxJr2b0b6zFB9SI$G!@f{)xA8`8V~CVgFf|4b81` zWBVQaHkSg)5j1|!YIW6BZgnoeA?#c9gIV}o;#P^+Ga($VKblKb-(Q~09ChM%n*I-f zFgDkfTm_Dgp8{;Ji2a#YA1$|>0j_kGC)wK@1~a!`G&r`?Dl3(a44gT-p}DRUIUUB_mlYf@8^hqbqkjs^E;B4DsVBD!8^Ho zs@^5*%assp(t5di)D9KFTQ`{5!=eFrna{L3w02qr%<(%u(*%7DHTB&bzI&eCy?zk&*}zFMZj|>3 z?E^O24`dU3ou*Z;1cg^}6gUMBn-3Tu(jebPVbK^&R-^ z(P8ngKL?*ZI`G*e(z_?Wh2IQS0V?+R9Q58cR6L{Gf!chr;JXY?7pl|waXABm3$5`1 zke>I<_rS5oRm9IHT5mfT*yjWe>tulnZp9SLJq2ELxC-0)|H6mr`;=bq+359wjb0fGy~>BO{~*0Cv(T%2C}E;khSF=K z2)(r37rbbH!vpcFUe{;eaty`+KKcAIAny!c!{9Ydb}o~AM#Jyp)+=wD#^amLq_TfO zGW+cWkLCmWd-7vX=g*<(opbBE6)+Wq58lqDKEH}nHHYhXkO85y2z=3-;NPS08>TD# z2S`8uOC#QUzNr{K-URf{JL6j*fx`|N=7o(}s=YQyQzD(i8sS5uKROjPv^(T1m zt77P2TY}f#%B6JslcQ}3{MO~)-^`_ak29+7i|hG!P}q&zw{t(EPO{a9WN^Zt;O}_H z&_Vx)o_qH0XVg7*pYxY-sZv}h z<$VF{Y$m>7Zf1$SZkADa*IVSh?rKKiYu?Ni*eKz4ozn!xLG0EM4OVf`<6}U8a~h@v zYPZix{5I#)0R--(RyV9^mEfdzjbKX8zzI$8J%;Z+-(58Yj#oQCSVj8hP`-aI#r<;# z_0JP;)A2dWI1}#wqn0|NX_cs+>f@TAI2C@7hQ-sGaF)sqL|=SQ<7)C&F`~!7{~~=z z;r|`w{~Gl8PHMs*PighrG2I)}90PT$rZ7F?-!);xsbIYn#e*LInI@b;Wm}-f{Wnbj zm%{&mh7%`A-MB4>u1Yqn^{v3XdI#ZErgL3dbiy(;7CiL+u!k{t|8D@;2VXyckbqgs z91mQY3&%q88eMjVUjYs3gDwmC9(Z7 ze2`N+HhQPEf@QG(@i{(DRc3N&eBXVhv8VRnOtPoun@Pr!;sgO&;2Tw)(DMO+AOak! zo_2MznvO;0f$BXhR2_NlO;bO<=}I#7MnA59yZ9dEqCXb;I`jQv0~%K~hz?wt!Yeb$ zxWQwC?!99lLQVzW>C^Sj2QLDFbtyc)&v&X(MdOoU`j?@xi1^XxB6gMiF0xk7k6%p_ zM#{)Nc;9Ga+6PdlxX2xayglhztv=%*cQ;wvawv83qK7<`Exn zR*~+E*H<}BIE?b$yFSfnTKy;VuHlG&{}KJtc3q9e@MvQ?b5^T2!w8<$gvT|lGGeBC zyeye*Quw`^R;kS9(p4LYeDXPzQQyI`(+|-$%|33}QbAu;Yrp<(O}RU*zx%l28ZG66 z&Sm`$g})D_@7;jLQN8*86L(r09&spqiqcL2s6%ZUIic162a1ciRfgr#$|P!+_!+U$ zefBf#6TA+b3V#R1X$8`|j%)RtQ{i`GdxiDs{+w3FxfFgUh0mVT>i$#jr<24NLl2UF zcR|meKGz6uep1MrIQNs74V*g;B`R{ zH-+@CnSZ@Mgr1Qy5WK&Ip8iQ7c)tfd*&LD;*ftjLVed8hdAcx1Y>!9K9J9Y!RnBR{ zsPDORTD|Uv#5^yb`>R%ob#A&}Qq>6Q>=#wb(E1qhr#+4NqH0<7`?=J8wU9oHeQ20` z9@9IjN-dp2xp zdY8?`c1O;Ij}`Hi)?e%n-?uqDAHqiXM%7Kwv(`!FTFW&Byn%4J?tiotwpE-+{QgWn zk+Y1S$@t9dlA)zEA2Y#t-!?(t(C|$nd!YmR{apJUze_+k{RWwjPkfp~YY@D4Icc}o zJ7?Iw|L7dy9S-r%M{Cna?p4wE#Rks)7q*3*N^uey5Hd(M0+ERWUyw2=?Ev*>%XxpwRVpD!xtN*EKZaDCXCJay<9(tPCKw8!ul#%Ah3A0mqlf_M zivTK~dEGo8O-NQN#`s?QCgE>9w!cKyl2<=fXd92{fyc=QYw~?u1^@ghuJ?{LDnR1i zYL@sT1G2A+&mnR8k~P?u*6VusuWMA1A^eQPKUt$9-FH+EKf6XvFbdvp#o@j+>HwqQ zyUaK&tWggz3O)nI;eBh=1StGLJ-lKK_7k^X5C36}ns6xijvvKsI+A}GO?!l46dw9( zlE2aOo?N3cPKAFM$=;i|^r|@YWE>!@Wk6UJ0&Iu7DoWldM>?i5Um4|~|5Jeb?#24K zLVU+PfaG%@^l+Rq3a^t|3>TAmeP)3hru$@qy`K)&?D5HPP8nV!S)?5s(F8}bJNF_PvWnOMn=XP@HQ3niv z)yzNT6O-8igMWVe23yc|CExe{Z0_}zMe}lH#MkZ_dwEz8!iX-8o2!Q4eJ@qn{++@cEK2Xtmu4Xx%b%R zB6cX7>HM^JLt2?gbS-Wo(X{~mn$HeRI>aJscaM1I>ZpzZD|aAE(2zFm#j=lTKW zE~PxO`AA~{qW6ktJ?q$&8B2wv4=0 z(LaGxv#r=S*~foIa!c=vG%1J1&t3<47i!mSGX_sPXDw_1X3t&+3?>djlGu^W82U^l zHWdRCI5qPvE`8Jq3s-UM$GgvI0xDk(&SwTDfI9Z$^1%jhqVnp%S#222jf_j-9d{*W zgG(8`F9(B&mcY$<=Dr*=NX}#~9r~AV02l)ZKf_l8J+5$;|ysa;!=jedtpy1s6hnxvf9MrxgC5kv^mI$L~m+`!ucc zG^K6UIcw;1RZI0B*Xnlfg(PZo#yJc3^S^wmr81vbbswc{*0R$_jj|u8;Ey~1~x`Xs1nmAf05WTK71bs*e#eoAEDYemYt_bdF?*9*^{>#45u%d4~$FrCYk zg&bPT4x@2{&uyPn_y=FjrM}2%m5H`8jO(N`4jSzDrb?u54Qzij2)2g&=VilaRFJ;$Wv?m3f^^UykLn!YBH8`PsyVBfqJw>qXl($(LX&N`Xo2&_8dn*{Z~)eT6NJ@WGY1xd#R z2_DVAH@=!nW#)1!-ka9Am2)ph@M~YmrF^R$D$Bs|&h-wp)7*9_PbMx%V87~@161_h z*{EhTZsov3ZguBvuC#BxLp=a6ERHs&cP^Wp7G30i{G|XDdmnYHRp9t|06-XX!Vs$W z!Z)Zr3(eo3)9N?c>Koa=Aeoqw;Q#VkaeIXaNAh!b(f8!hI{P=TVjJrr)J{~d^TGr_ z^_5(z{~^P+C<`#W$X2&_A+gs+v|%1$)aNv<66xms3R0 z=|x0u#QTZAa;wVc+CJ3Q$BX)oc`WZk?lUK|P;Zm@eRp*(Jqy}Qc;U&Z(39N?0-{G& zo4f$?g*IWZ;#W=TT$fvQPJn%L%H3*KX0YB;<$@a4MfT;`G7vs_#ncY2JemEol5a=% zYq?a`%cXT21w`*}jA*IMa!&09cw~70f+UO9n_uPBFTar^^PF?W&>Tqc2N54V)P%zg zkl^>fl1uG;s7#$f{laAEdZM4+*BskydzYyLgr-+>Dc`QLB$BQAd2O3xLehR-yK65> zC+D@Si+d1U@SsBc`PC^Ci2c6;ATXEDn!XCA;Qo8m*6!+Ojdou{`)^kj@l}QNbl=oT zmiyz?&RNUHu>VA&$KLcY@&DfMBzl9-*oPa&??*ZS`{?@C!eN?RvQM zi1y@k?1K}?JCq{b6Buw3A878vyOekxd*ebaH8Qz#IZiXdVJ3iJ#(Ocvn=6Al-_-RO z&n_E|;!6tu3iX@j$lS+QPun#c!CHS-6MkAl-gAP?efS-PqQ1x5YLc`58P5rIf}P(? z?SJuA>wWlu&Gw#CtCsI_aOt16l_htMy3)G;ocpiVQofJ1y6-u-^wFo7zuLh`>&9Pnm?dkkwn(o*bMt^Q>joa$E%INx~H@Xd8#lENR$X_cQ> zDg3OFAMi+SRQmd3vwZ!rl|bzH@@tn*$^J&>xF&qIob0K*#p-90gbz-i#CJG{_nGQP z^&%Yb-LcmczD94yEVBPCezX?*iWeOqh%vW10I+Y)EH2H=!gsu|zu10Tdzd$j_I!!L zYp5i;>mxa>(idY?$z*dLY9MtGqS z3q-O|ya0rRt?mQw8+GSip>t3r(f^Y|g zC+U2M`V?+;t21YDX*8$oI6`=G4+Fw_Tidel8g2U@+P1OT3O_{sAR+!ed?c5GSzP)Z z2XrZ?Gy(DYN19gY>GZAe1Jr>FlE23O^_Y+6oYJtp?ucv2vc%Wj>aJ_u>e%h&gBd3? zw8{m?FK~h2E{7zP!;A0DbtJR9%LlXfpfNmQ=v$v_DR4qv_9zK=eva3Tb(sz>%{j=~ z$Iq|OQgCbeB}iZ3%0OsvD5IGTbo`c)yE`JlBh_y%Nmd^!Pqx3D%lq~AJvx2mE-H_Z z{L*cxm}v_CpZ}_*;162eF+Z1XbCi+&MVB&)#yOgk|Bb#4`YQ(r>R}sye5COG`xhj) zzf!16U63RCck~J^RaHKv=SOEWp~0n$zC?Yoy+LJh+h}82mzxdcP~YZ2V_{0q-zI`^ zU}6!w%ZVVgf450}ZvyN)x|~yiQ+R1tlbX2&(&C+ssyB+GP0HXp!Y)Rj$(o%RIfZ7$DK9Ngh z)_{ugqCAhd{AI_zGKXa(QdmGfFH0}V3 zyVqfP!(``PMrBOzjXYRJ@BKJIP#z=iHuxA2?k-Zl`%{IVMtOVhLWMt(qk7}XhBP>! z?)$}X{zBoMw9KxB3LiI>QF2;6KKCnwdW0`p|DdtryW63%WiZ@B;N6wykFyHjr81FT3y@1)#@Au_W5FNHGZf5W_cC1SIHSDUnggiY zdGDmOuWfyL=e9}s>>QBZcBB#CUw6!RtGgK3CqC^~-3;vWH#Z{Lr7~B$^Rz|s58r8X zfPi3Fd@Y&w88^{=MsR`vQx!h52hs>ngk#1re|bG9{1<1nO5f@xHFHkGzO#JWCZ+$X zX_bF`*+i>D7bLS~2CW(>tr{*@_`B&|!qsQBROYN!e-y#{dy~qZ)Asq!G~sva9yP;S zF)3O7?@AulHAk#AT}T(u*Ymr3v=rw!y&Ru^ozaATJDi^zaK3aTm&)$p(g+TBIgz)k zo@II(K$-m`O{-Ku;fENn7j$^h`QA+mvd>y zN`-&Y;rLF%0m5g_S<>bD0FTh=u6`cC{1Q-sP+p}acmN5s~6Z}Vq>3$;h z+b|oT;?QSWN;#+1`yO|zM+XwTxZkbfvQI2Xe&y9%YUksOiv9lVXVh85|D&2=U|*}L z4n(VlM<$W|<$p`?hYlCoE$(|lOTAC~l%8i}JN)|3$X!o*CQ9y9J#1V5dqMck%h-N5 z4Sh4GW8d2jyp|fwOuS(5vHc5@FhLnbbH%~V1dry3tuK*1W7Y}7^KJCNZ$bwX{4Wk$ z?}Gde@d&+79H6!d_0vL}Xqj_gNGN3|~;B?gPODfBWI$ z_np4;1ex>j9(**xXJ5j5@1rvTDqert&72@50xI^A$ozKM2iV8nC8SJfVRD3)0h$*s0rm7#P7L?| z942X5=cPmDbcD~TBjir{Z;Q3Ho6!E~CF=&qkZy-%a^=vkUopKyyM|M}BV?||_Vg2! zQRy&&b^lA&eyNTm_+OiJdc>o5p3J2N_Af{xn)yzVJDvYb>9*>XT&h*mDmj*nL-s-t zhe#|;RxXoOrGC7%u8M4nw`C->|W6Zq&JMu=~l9zI+ zS(;YayUnc*GcX*t!Ks!FILBYM`eymNrd94@V7S9p=76cpF;khWX$)}Gr|S*2vSQpQ zd-!Fm9(q*MDqlTJ#vWR$t+SP7dX2JA(|R5A6uyGIkvH_&i`eF&F1vwK$LKiddoh>d zE`<7JHdq5DSiiC1q2ERN+3(1C*273vPa}Qhn}TJBis*^v5!MX%(B$NSJ_GK*Qyj&dc(X#RNOP%h=0 zIsw~d|7Q`nZY9Cb#d6wc%L=rH$Tg|GujEn+b9#BoR_=h3!0WIXIzH4Fc@xszr><6C zc!AjNApL9@pJ&b(nv+QI@LRVU8qKAU4uj&5Zr6}V@czTOl=3*)%SL(7`sQX^o%k*B zM1tq(I`8tRma55Vm7h&#mw`(eMe`ok!&ole?^v-6=>^OWv5%x-rjJwI=r_QrXui_t zs`{76J<1UVhQB>(o74NI;5mKZ_5@##+6D75O#Qwhk}asb?zf`ZjBnqRWc3{eub}xx zx9gvmGi-DJ_yXD29|72h+V`)A>3iV-!lc94U(+D&-wlB8Cc96Pd)R2)*4paJ{=lg3 zVZA;oPpbebP*=r50le`go7I#+kj}pJhKYmm6_n#yFJx?BWCG|NBT%783ajFXx z{C3{C!^XYvQ!iTUbpI%U_ifE{mILv@r`V5vT_e%6rXO{>7G|+s!wkGPdc`P#`7Drk zR)0uwntW1A{ajxgZ3Fxc_3-qygts;jyYU;J#q?j80jM7}@V@+#p`*Q_X_Yrqx?Sx6;U0V2e`=J&^Ffhwt`lj( z1E}BM#eT?V47pqi?_?C7`e~c~`xlMzbn}b3RD*tJ;n^uk=4T0>qjwfQAEj%hIYj0k z!+!cm|L!)y8+_5=pLQF(13ydfXic_zIyZO<@u0_%B)aE}A@5;h4!FTqZXjjgad^}^ z&YmXkK3VwjYoC&Pj|lFg=d{X3GrUJ8C7A&O-T?}4PL;yHa<-U1>mv`??+Bu~?vgl{ zz6YS5`C+44eUn>dsE=<36#nc7q%9{V-ZxvmxvCZW?*0R(iVhgAHsdn?!ertB1DBtV z7Jq{}kuH3Lx|+VB=D3MVdt0D~b%NlH0$wBA?dx3TI-j^O$=s{t>r9Lmw|xzyHT>=a zVBe{v&Ua61mHV;X)^F^#MR%EfC7yONLl%FD9mKw9=PpQVt3ZAAd7>|%IpD2BCfshC znq(d{=<&_bLf`S1(zhwkXOEP{cUor+9Xzh3G7Qu|Wv}NUqaIG@?YV}|bVXWAJqS>N z{nvbpQ<(`coH?fr!$fZI^SO@XsiTf$=Jv_-J%X7-&mY&YZ+El?IE(rEavZ$Akq^udoCF4bs>InBv1Pt$r}Ma$t(pmbCgMDmV=sUMPIZQvIq{_qe82 z-fDw&z(gDMMMIxVqp`M>QxRS7KCWT^mfg0p0}mTzKhn!iBYW;&csNymzhTUI*-+zg zV$XwQ<(V~{s=r(QzzexlW))yvd5aBx;t>Nrnh(tUk)-?j2sWzcyU$_Y)x(YUzW=pp z{J&^@J3-NikE?GwFWXZEvp>!N2zB;0{yKs0(b;^H=lSq&bpN)$4Er<1?bSAb+I5`h znyd{T`{aV;fkzYk&vklLlQ(9bbinbW&dZ11t-NoxF5~byBkbb8ayPM0LHtzxrET57U}K#vcgx> zeepjo*HXQAx>Q{UMe?SX`f^$KTrMTP-Kh3|o7$BG7!`bOb%24psz=tS_0JREJ{3O3 z`tG^I>I*;NoV5(C^JIkYDo(v}G?&t0V83|Jr=^a<)K>!riQH))HR{;y6=CRBs|&mAg0pFQ&5g?GNh)zmlH z`X<#6%IGUch;LG)kDfC55Pw}O^jTi`wg_X)gO}Lf6R8-=9))DpCt51wfO^)9zi?5q zI%nYj?}rN4?}`7;+bb1+_qz;)+tJva%iwis*(Z1p8?Wj6&uYWIJDb#cdT09J3UX)q z{pWM3op+Y0C+BkN%MRF=snYLGR}39psqil$Uca*pzkRdw?lSen^H!X*CY+;(iuw4s(WR}^LuWL&Y`mFr#BDVauacP(j z->7my&!5rwx4|567%;ga_uY2)I6FNfOrjSNH*@`R-u%08}0M{zGzeTEpvXgJ)nne5A>8$Qzcnv7MSA1jaBnv>3L9Iu zAs}*G3hN-d<&MRET4Z}H7?-?aH0lkAanakhBQD8$J~e22-l;%Z=Ydo85v9O|6S+ zYF8}scsAv~*U<0U`epdr(9M7Yx@Bl+0FTFmgI<59819g~{$R9I zilL5=OC&*-;=NICm$bv%7K-@0NMwf;mSSRDvd3c%(tFU`Et0xuj1dk5J0v;o^^1O# zEhhORv4EVAev0m_>h^A3C#?0NSa0#z*0pYHtj?64 z1`kebT-&s$v9)y(VdO=6{>HUU-p1C};$`#Em=NYf|LfVytUIZ_`)m@_G zcrCJazEP@l|C>q`)K$7qN>YCfk;WydPt%deD@j8ejG}Ee!Ljw?8qcQl_N1u>TQAYl zX8a0z%2ca-Qbv${UZ6qL))<3$iHS;#)a7QuAfvgWyul;w*fTBvRq*^44sQfaW1D@3sLRF2XM zQ8Nj!JZdCs5wyn9P4Z>zD2<~n6z?frET6BlP`={*rHkJ4bs5T6tQ)KtjHfsh>kMn{ zrTW9D+tPm9)KroNwu!f7OHGqeK}(C)HQp3o&|2GcSfa(Y2{A7(%Pm4k6XI<96>YaXzFsY!BZSrJ77~eEELBpXUDhzsEs8G3fuHB z6TU_Cu<@YVCaWTP*m!l@Xl1LrD7j2^+bCwMyC~60v0sU`LMft`WZ!~uE6$~|7A&b0p~7@&Sh8@*eHtBII|~$`Yi0m5x}^%1)Wyu`mMZ*@Z`yd)x;<;% zwM)D$n>XHAvvf&);e4%US)^wvHea6y4$)J_gJjY_O2V>8%JbBS*lxV~&JU+RGM3D# zOP=EOS>(^SwHefOZ))1Oah6{S2xt5iW+{BEB6pmTUYO~8 zTIl%%)OjK1#cpv*S>uDCe>o%aCb?#>OB2v1h zmey$cfQ?OS+@2f9%aKpYS8a~mu;rW0H#T|JuG?Vx+`P%{F|urOui4}#|KfyojZN-? zWiiGbr4*NNtxZjh1(FR#78hv+*%3PxWG@aK$u3(~lhCqcweGI-lygd+!SIwNY>RfR zaq@&Yi>%tmt-xHq#Jc^w^<$;Abp3|TTB3fv{CUrBiqvn}Eh~;g;Wk(iJnV2vZe-cv z6vby;OvddGqx?Uxl~$yF>t;m>jiW}K}G7%Z!Q$C-@3a{q<(Yx z^X>+fpkRqzqH%S6^XW#3=oNYbd;?Bu3Y^r;|9u~BhabQX;ZC>r?GvcrgEM|L=2n49-Fpu4UYe9=C?!nNPJGxbiWRn2Ydt1v8WR zRGYwtWI z!{jB}CGGHb#3H>>Tf7((yG;oJDHhx&(NDh^m3u?fh{r31jd0`Ut<7urMuz_CmO;dT zidg4F?AAb0$xrghA+IQhYZm*VwRNMnwW+mr-R5SmyS2Fn*RxHE$-zh%WJyN9-e3Tz z!A_U715i7}SO>&|-4alXE{IA}%#`2jkA&k=UmUhcv0(cSZ%mSVLve_QWT`Li?TpCr zu-Gj@RPOQy15!91jPLMv2E%bnjGjFn^mlnf!FCB%MzWbwz#r+3A{6CV)Y~gdF$}pq zBzDLa0Ah#a6$7XxeO^h7g?3=GG7v-2uveBsl0Pm5^a3bPdra);mcqnXt~(MyZNcX=+BG1HqU#CW(Rh^W+6^J%KC5Vv*Rj^JLIr>c)8_5TFc&1F{rfg4iJ# zHsZuUfX3ml-u0-za5~A3YwwMEJ#K8Phr^+W7@(-5`1W8(@=AR;Nel!?m{i-__8rL| zm%Z_bSB@hZ=y_0sN@PKJwDkr<0W%utuLS_20H6TC2#R0;CXgSv%SnFYbo~7b15geC zS2+P#0C>qs%Dqf~SGh<=k#7X*YidCZ?||k=Sc1l;*7^0z7Qj;U zQL}8t0^mJ$^J{AHM=kk4$|w19qfGioEh^`3YF*>ml#fK;dc4OJ@3F?OFej`aDIT#~ z3Wb6qNy>*vDSn;XsD=h`3eq}BG*Qb*ELN$(P`g2&;I7dpI2{{zV_qGHd5e}Vk=c2R zmdoshzU$^KS|PLU-s|Qqs+ZZOu>ZPwi)w3Sc9V#{>f}iGn;d*j9c zoj_v0YpXq*H??eR+SJr6Y+l{iwA#I8qi}7tgw_Y+AAeq3sMIM%1|xs8$D5 zJEQD~R&}kd8@DZmjhnZ^rl!VqTQUAxx(A2mVFA^G?TG6_1DPCEjNTlmo zB4sH~=Tf;h7?)%)1-$+?EPq^7{&4hrfs@FWYn%Yn0HEJNR?7Ig+8Fw?l?jth%(sq;@GLh5ZsVM|er@?Z!0T9Ok94)DejXMND!eA6kRq zj*tXf!m`*dZIn7h{|;*=a|(g(iG;(FKMo$OcGy6M@s$XnQwnbq{kV2>vO5%tY;TS< zu5H@TbOW@+f{|D-9=us1ruwic7zl)-@RCh ze&ZpzM*sC1U$yzKrO<{b9gcXBz6+8+(CL*46;T$fn$o)$(U{Z@Axt`N%t8pNvRNa; zkzx^g?|CC(l8mA$P*M$IFWe&{BCj_b@di32Z*bx@vy)nrh>Oi16yJa1DIoKhFI%M$l#$^srdI$GngV7P+@3dOe!n}Xq%SR@|tM?%mY3?sow0-MA>BSGvl z5;kK3$y6QRgq8>%DHad52mNS;))EVD6XVhbX$Ku2>%#4k)xnSi9;DHF+%00f6a3^m zioR()&O_tdP5E2nkyt)K#sN|_1+|R^Ff2U<1JhG5G(ClY(~}51%Dc2!%n~9!Lj(DY zxMn>G2l7dzf|xa^XCPYK-fjW&w+!LlZp!PjF4H$R zulD-81Gc5N{^zoVr`f{gwlHfBw3K7Wv2U;zV{^@{`+urcW~px|q{Tu;JeBHcGFk+@=4r`P~{6K}Iec-w`F1 z#$=I|$mEQ}vM$$2C>CW!bDbz6YDjSs6_2vrT|pC_aTG#N@?%z`*YjAc|KJRAh($4Z zG>o$NQX%T$*bZn5h67TJ4MZdvaVOob0elZm=a#4#V1qKdJr)UfKwFp%1>3+chEaA4 zTj`MHavVu{A+k-1#exBe?Z$|=_l80w9VJ={ z#6z;kVwq&pA4;aMy|UP0Psfsr_M0t*^mx%UOod>$gN#^fTC}$<6!arbwIz_<(n!n{ z9qtWE2il z2V+uzq~PTlnQ z=j$Of0(64q<4i+2f+S0akre6f7Q+E^IM0%zz7#U0hTDT3wqS3JC}4R0F(qNmDIbor z_(ROg)qIknHdx~k6PYv|JsOXEe|NxIpNzUH?3Z+{iB6{{NdA&Z?P6REoN6wql$G@W8F+?Wcq&FN8V>^Hdr)Ws@>v-!VBFX_iM+-+-^Liw|Y7a-u zCFH!eZ%bfB84;#19_bz^ifDiB5yVvpjm{XZlj>TmxJ?X(&=hZuL~D;=dyoPpf}99W z6eh9}PdVLEyfZ>_nIwR9k7x zbD)UcU>sGbt38I)G$)$i>ruwy$sAjxUX)Iykw1=M=;yrF9sw*G(OSeG?=u3Fv{4Z$ z(Gc;=(Lyyf5;8<0WfQ{llvOS1#ij^b_H9zEJrvnaHEPRR&rmg@Voa8FJwGa1k`P}7 zsQymCvR2uIm;*^_qB+K-_F$h8XUNuQFe-(DVJY9zXhe>iE=P!*HN_WY z3_Y9dm$w;8<@QbqiP=0BI0Ib~>k^bI(S&Z6MWHc!>xu^38%7FXPz(icMrCLpvD-V5 z&KnG4^$>~;YRaQV5)xBrYA{bzI@b~X7cD5+c&B7+AIN~^fhcPwwmJ1M`W5cM_vcdtDiWTriy;F#AO3gIH(siv1LG_g2t9$-H0fb zTBMxRhnNYiO7Jn49g|>Kj7DRTXbjH@?Yeqk%_8@1*Be8BVPIgrg z>voIb9j2wQY(#Dsk@ACRK_h$po#uscFGiV-N60D)FL_LhKU=b~$yPj5C_?tLm$Kb~ zdNvm6jR(V0@eFdOSYytS7lGzI2vf8a4zQ7SE9ypKq@7OINEt%QWWpVSz`3%pdMis*7-Pm z_R@<@5%lvDtE!gY=k5*5kx3qA9wSW8vLUC>V_g{VX}RHYb_TH6pDjo8rmf zBJGtWvPMF)LtZfrfG&v<2X_WLIxP`M6p({}f_|jYwqB&M7;W-x=x=m-ut($lMth{G z3UlK~jO`q%uYSo&d>n&6ESf6zb%t%=4rMu%PbY2w=Pjx2 zBi1fU7O#Y0*dOW*NZ07%S9iME2>`I_HRG?T)xYqX*Is)~>_VXxaK+@wlUIComD|&_ zX5EHOo4+x+bu#|@GP|f|=`!?n<$`ZcF7>w+{9@Q-mO<>ld&2>#Js6e(-uB)wnP;%! zFm~^W_gcN*iL`+~?(L3jle}bkD$Cw3X-6p1;SEwll;P z={rWh5t77Simn>5y*f%Mj71GZqRk)#%7vVl5Wi7V}DeKQ;3X2fSja zgWwVI8i(#ymf98x+W4wX40!2AlsZ(DDByA;bK*DFijLQ8&>S~|ralEhe^ zr z*LaOBF)xzux-~xHg17g-Zjw&`MI&={eQeW>J4<_n-bM&Sy!3EF2N#n?dgTH4h<@Jy1@vn3DVSw-BoPmp7imS}y!p{+ zPrz4N^aQg(RzZ{%hABP|LT7a|GWPn&ZHhdoB1OheEU3(eb76ELyzy{1&R=xKD3U@T zHu2Xt@#~sbZ)R6-=2=tt`dSiW>RDR*GAb3J@=ZS2U%N8b#ph zh@%OMpv=;nJ8X-acW-JEn)p`B%_x0@=~G<5eu>L;Q;NjnyEuAuJ}w%Qw&f$u705`E z1Ovt5O3t(NIucFVw)7fdV=LCyi>$OvIfw;J7_IE_#9=R7G=&r@0+*iLA{yp5{Kz5{ zMVVD)-3EY_d-2M=y*CuvQCNlffY^o^-LV}n%_b;{3dF@}w*Jk8Ls3D&NLW)E!ffTsyOTVP!aG%>juMy6<{(y_DUT{Mrtbz5=0!22r8R8I*8w=^ z51|Zdp}u4tyWv|fZ~j$_YwDI?dmZPbe;)nAxq6-cwJ{&J8Kl|zAFSWh(t17mLN(q5 z7gtoy{t`R)D+{ikO8>6WKc?2!>t8GKabMkmPva5OE@~xW_1a0mvMj4#rC`}>*?BUF zBbPGJ*R|}tCCfrLkZ4+P(YnTK*&_Ms^n8|Rc@oT9QhNhTvO-wokM~{6l33$v66$zSR9L1vwA`+-;y_1(&Lbfvra0kevO@$ofitQ^JU2&2?yi_r3zg; ziB=I8V{ujpq6+4PLIIkeo>Sx2hbX)Sm@wDtlL0=k_eTN$rFe!+<)7yMcB zB8Sm6o5Vi03CpWSF)m)q&g-3&*Pr8k@x^}NTiq;}x(dvcv?#RESTG#-wqw=#8nkl8 zub7}IY*7op8f1x_CoD3ZRN!mYc&l*jCbtL3^cfY&?y6K2cfi-B5Wsi{Ey*L>f&u*0 zNZgAf$oVjRl&0{p6r5mxEColBLj)8X40m|D#kdp;ilO3mk1kM7p>tpZ)wr#N%k)h)v$TXBK?TO6kL?w z$TH%C0aHK>b(li3N zi`AgW+WKXt=%p*_Nc7Sbb*AY0+8PpFUsDTGfK(_2P>r}2Sw;(5Nrz{TL%{5D2$CL$ z{p935g`7N-b?s(PE@6R#a+GF~v$1 z6)h_5&3%h4_cr(5+_TS_^*(3L49pAz@%|@IIOnXj_B#7x?X}n1XYaizcRFVT-@nx9 zM$?nr1YhJl&gXL^@MXS25*P4Q{*`2iii)yDEr^PavSzQ!oq?3_rp?;;^GBPt*sl+7o6t%zi?4Z zOw8#qi({6=M8}*KvoIzqI_k8jg$oueFq_C`TVS)1FbX(EiA37u1^YI=^jD zQ(Ml)iYgBq0-FG4R`E@LOtxFwHW%ktlshYGE?w-iIDCf7Wq};k`Rt4eclBnoj#8!< zhL>7j@h&s79QbciuBoo_t*I~aw}QW3?Dm407Q=48vZ|`0W)5O5s7>*c`9aPh)tv;41>dIOX=z&=yn)I8(Igl>(mFJg}X*syeOlb}V+pC>BTsvxg_omrWWwxZVvea$< zxzYS{eJvGrZr>Mc(=OXyv3TZrb7gr=`r_a{)IkF3?`rln*KPP#-pqWdz3BSFJYPS_ z3rryt)>MRSoA+&5zkV}ot7|=1SL`aPDX*$EEvj5s^(Nm*9T(kFQ|@+GIPKvngJ;NH zTWdWby)I|tx{K4+RMZ4R$+~V`Va|q)c{#ZSdGtBSMR}JmX7NS7pR>YK zzSULhyI;&jvwn-oD%y~9Wx`#+Pvry-zOqix3IHT4?NB$Mhx3%b0ymnLRn}!o|}*x|LOv@=E`To*dtr6RVe7JPImyR=B3sa?lwc ze%NBHNuJWGYEP-ZW-6Qk;0(ZByRCGabu^iEo`J6ynN5e&G~3J@6S8G%U4^sMS?PmL zKlpl_yRu??MNPRYfDHj`G3)8pTgywG+iL@MX(&&#qxdmFfE%l8eS>UO;2bI6gU^b! zm{_*p^g|i}=!%trThpBM-)y;FbLZ(z098ey;b()6=~^q-#~HU++=B~ z_T;qG^o&yzrrDFzQ!_G8O_**^&PZLgGC;VaYGwl}rW;tiYGr!q49wDH5ivfk=KF4$ zwsQHlG<)*Z7p1LSeqjJolQw;qZcok)!mXOdty=EqkiOi{A$_@@Dt-C#nlv+A5MSQ)^X&Xy0iVx@)i`B^4pd8VJ* z=VFy#Rq2%1Y})Fn zDX%dNu;7u=8Ukx0;e9d{!28E|pVuA9ob}ri!CHPtjSElB4pZ-xZZ0p~R&F9{IpAniY%cY!cr3M+ zJl0ZMpwv@Y zQRRyW8<@Tc3kDndc{3>ge&eauZ;AOnd|JwS#$@&#)L1*$NJ{A92_GtA(XI6fCSz+y zQ1C*mD$`x@mESD9IexAQ+EIFgYwM;EKvBU)>(J|&sIGcOU;$XxFUlAluq zsh&HsQl#{=qY=#=>gW{j4+_w7s_@XkTq4E;3Fk8((R?wTPf?_K^D|%7%t^9M6Ib-b3( zA{6uTi$Ld#pc*O4Z6suPBZlK6wqrO^Bn1$OCR~VT#Y~8lo4n7KoyfuYLs1b6JO4Nw zN-}3b=hbClff*tf@-t*(_Gmu`IwFgZ&~)=s%%7E6!RG#7L}V^mog<9pysZ$zYrfdI z^W`f-aNJYG#+^G~k$9a-HHF3ai7X?hR?eYuFXjqVHXYbvR-C2?;aKL;R`c*VWoBm4 z%n>*0Gh`@I5SR#@K0}rwg-@AXwxH!U`Gxub1LDUhv8@C_ZjMK zuD~<%cjEc-_E}otl#!7l@|n*fn48bML5Aj*irI`JNJS)-a*A+7^S0sqDr!D%{|}*q z=86V4Uq3u0m&ieY!Z<~a^bafB|8oT=oYe>Biat2IM}0&Gra6jBJm8RzF}K{c#F@b40J4Pmj#UasE)2 z5mdn3u_{lYrB228|HAh(O459hEa%mMr_AeT;u$%t<6NQCP9>S2iQC*!Aj3G$9Rf2# z-##VBjT;MmgjZZy7-7zIHg=YAIy?H~l{xEj$ggm@s{MzJ`;QgRw>FLVzJyr!zQ5Kw z*Z}Feid+24Rjm)-Z}Ba1b(DL`XBIHz&3rbuSO%@R2tMgOz&Pl=j_Rrq5-SJ( zTn4kbBCvrbi1@l1SMcLT{|>GlZnvvqdqtI}+~v#X)fKz0v$id)tElt%)>Q|-wC9)C z`c9Lty0OB4`n|hiGrn);JsfA4~#f{kg*FS^=sg|%YURhzcl zzX-Ut+~vVtQ|&g3T~W)Lf-CdZ6_w`ataEJ4&$&9Uv}i-l6<1ujrgUT8nhkkH{@sYD z#D_vlQv-bSayArPAD+gKo0Y~Qw&ptXHq8Hqb#ri8hgI6jZO$#Fz7@<)3u0$m#V)q) z#0vZ7{|M&$rd3|$EZw@3=`B_khoCKozRzV=x&U^|)~a$>sg=a{k!`cRvexdYDc`bX z>tS>dknZzY}H!9DZsw6vn?#;sKq(;J38+ugne5`piV0WP&Q?!boQ8n^Ed0^bI9 zYXP(`SX@w5`aYe8eTNLD@V|dHg@0wApM!NyrkMllh!peU|6=O&N81aW+2dROX1~Dc z>s6&2^46^1;3zG~xjt`$Z?~z_x31FKXkY3-Z^eT7_RCvK_MFwF7R)+?Am~0o;DZE0 z09o8BoPK__`1fCxJAEx!?zC^JcJ8w7e7oE>h&1TSQk8XYy*_Ya zozseN;?H0ZftA0R)YH#__xMm&jsvf;R^?md)(HebU_aYwcnBZs{^HH7%`37~xPD`i zo&3BUhn>RfitMaeziwS#V7r0u>MZw^Tl)@XR$rEGuHI4QDXrdSz4pcmPoQCZ&lOdh z{rd!}HnZ~o_$&E8{z4meCL0k-?F%2X{Ng}YHggw5Xl;pbUhEGHY4+^x-Bw|IDZgy39F5b+#>ghvstpnhF=NoP>uM0X=cjLwa-}cC$eK5hb z?5VDuuMtf2>|%zX!|E{-gBo`vaA=iAN*BJ`Bx2@57I;LW2sC6QTF%|j>dmu6H3$_!4ui1aLL7veEr%iLX31ADcDDQkV>izN znc`$x5kc#I0*A(glTM3R5G+Kzg5MNbDuO6Nn>Yv&)V#rU656yu7_;r>P)a*$O{HXo zyD0S)&`cH#D0e#NNL*X9v&I@$0@^*2W(q<@ZqT_jQgFf=cQ|M+37AX61Y`Z$#aiSw z2XYpCF0l#KEkUpd4L?Um4?;$2^YAVmoU2IcHn^6y&jv*jlaMYR44R{R&uD>&T|5ju z_h>Yi76_x5Z`cXzOc95jxzs{9#e74Hr3*sW{zagOFv`qU1L4J+HOg4vS;NVEiX)6_ zuJIvQff&cJr=Fi0vvA?p?pa{7oj!ec?)2Sxky6*}a(k-XHPxk?c0{a$IR}|Y+Q_kzmv)fa%-X1W{+&eb0{%2>Ttyq))vx32&*?wmJ z&VyitXF1g^GxUaxhxRgRlsKi4v4YY<2 zp+Sd<1;=c4ZLRf`da46XQIP)|bV`31t8LavYwntg^6ma3Q-jbmf*T>-jn%Uasab24 z!|mcKXKD48;HIwjA4O=@r$5eQxwF($Q(jfO)we)+Hc48*ADox!GttcCEwDY!>E8hE z^O39*+x$n61S9;~$!dgPM0p^QFIrfr>JLpDUQIr=c`6z|I@l$O^opQkqynmICOGFT zP5~X}bL3~YbWQCnyKh@Xsk1VYG*xVl3^%1EEi(clg3l1)>^mRDY`9ftw^Y~oy=!Za zXYl!j{sU7(sy~v@2P3Bqhagy>RKc*BvId~D@*F_;Pq_*->lWA68!ICUg>MFBwglEx z+#E@I14IGY4Nf?HC{MVX>aMA9m)BH8>aCGp5iFHK$D)VnLbKOgyxBi>RJna-8^g@B zl=)sip8yu|>L;hh`x_)`!J;$%W%ZrTFj1Jb!z*|?D=0o!nynnNY?t|2wdY>anZ*7oU}j;kxe^1_N^ZK zRx3>4bW9Wb)+!<Ge82ozd&tabJ6}{kqx;e{9N~X&0yaf;?@i-dT}i-uVt}o{4EW zoeC?Sx9QwjyEm#!Z}A6c^iRpB1WqiP{b6C6!hht^Y>FELXDj+=EIpfQBl>|eB(s%E z5PT*@@ceWTIOqV>@O~8m96>xzDL+0vQN6?C-r>)-@9@RYO0+;GEB~DM%*mMnkqT@N z_RoW+W9{W%1AGnmp8x9bU(W?nvCc8L2{m-lY*Jb|eQvdY~|258kz1)9Y?@ylx6k?ro@O6K{SQCGyAO1N%-P!)@ z6@K_aKV7u{dYb>bz)$xj|JCNd#`~}5_^(lZKIZRY>+}Kt%xvg^v;GbJVVkS{K1aFF zNvI{L-DiVBh7HfATK~kR?^uHwU&ZRWrqfXBt}G7`wy-ZMH5If+LC@-}YFS)0eUI^VA7YIpg~J1Ts)U*>fGKPPu`FAs8Pk(&u*Wg<_h<2tOT>Iorn|Ub9kANjm2O?em-+B*wrfcRBYMd z3J`^1TxLHAo*oJ4;c$y8*pBdLZa%BtA~}^+?`QN`XxudwmQ@%5H;2VP0}i(NBO2Es z4ww&Pg?pWG<1Gg##B>Txw3rwc`c8ED97}wsy(}e`#ivC@N7c)X2l}0ZNM#PmVx-oNWTHkW z>fHS!q7yXZONDsBGxqg-zU;IhhUO~j3k$wk_BFWrG)Ot1N!{0==8{|Ux%bN zO-H7UFZ8Xwi9?jkt;s3sj3LFHqb z3|<6r9hyvD1fC8}5-x_}4o$KzhN%usiY|uipK8*0F*N^Flb(yA|EHRaUJM0~YocEa zlaFhX{0)fxr6!(lKx3CCo!@}*Co~!R224Jo$<#N%^`s_=sWAMcCXQ6dcuEsjD)c<1 zNlPlkbZgR=3US?<45va?wA=`hx#Nme?XcvcfOe7hsx(P8A^xa z&uOBk!|q;95|=~4OPZ7|hr*XM@hpe>mo#Zv4#h8P(zhJ41~eI84*3I`oLCN-zt!INs1CYb6xDp-JINaK535b0v7*(4=l9G`^up^GaxWLzDKE(D8;QJu9K- z4NV4D!oVAvjID%`H#C`A2@`K<5`77rctewfOCb7~CMlOd{4q_kFM)((niO3EiN`dl zyaepWG^xJ?l8$Mz`w~b#rb)*okaA3u-b*0$m?lG)K*ljm#xH@)W15_}1hS545|atp z$23XI1jjK=QZpg{m?n-)C^)7`aV8WV)5Mht{6UkpOo;n~Cf%7({|8M*GNJhonjFuB z#9>VmRzcFRCMl~RYgm))RnRu9iE9KXX;}s1!_@gHJDj0iTldMaj{X3C(}ir16`O^lzGUn%95VWc-`Z_BTzEvY`KOnq+0c*xxiM%!2X1Y2wU+j7d$J zvLI_xleR188Dx{ znv9xsUQP7Np~vD7g9f`WFi+bKd&Ty4K#dSN!A*O{elwb8mRw* zlHF^d^@~dS)`0y>N=~c+*O!#UJ7DrlN*oU8`LdEq2lRhgNxcJxzpP}p17ebt3_74F zNy(%GvM*4QkOzYoC~@RL+gFu%@*w$ZO1knO?(0g%^Pu7DN@A~o%oHV=S3qTol9DSR z?jj|vS3t`}O1iFqwu_YXn~qBLS>qg`nAxIreyb8 z=t)!3vljZ&lnkzgsWc^%YvE*?67s>Gt|UGmlGBwW=R<0`lB|5lOjlBv583HTocYk1 zp`L)Ka)lP3IXB^d?KxlW0z037R;v=o5nS|y_e z&~mMk$pYxRR!Q77FmbJtjB6lugOajqplgGYmTSOXtYqjKC@5AkehoN_m7KT+>Wh`c ztb_JqCCTfczgS7uIv6ZgQn(I=ictj`a|KgObYiP<(@uruEQvgObkmFn)uQ!S#^v z9VN%tL(+GY=<6Y~L`g;=)RibHE`-JsC9Xn9a4P98ge0eufkN2rR5Dr!Wfe+duLbuO zC5~%hWQ!8dwUBwEl8$R(pi;^3wGg*e2^%1OtCIK)P_|WxV*@z1DkF+=S@mRHbCD^N{(-Up_`QG8({nEMr29HZu2nL69k^?i z=+{AGt&+HJL77L1<6AJ{QR4mXxpJ=;9D@hL&@m3AZe$P$!|f? zP9?G5hT@${lD-X{R0VHVp4n()?{0yG2Rgw;{Gp$?&(KrB2C& zNmr-jw(*p6kiXndL@n5L-g%RIH7{i?ol%K9cZ{m2_?{XkCLPkXunrUK?!u; ztE8+1y6;uuDS_U5l{A$=|Gi4uN+9+=B||09e4mo&??TIcN)o;cZTBfj`7ZP{DJlCd z3^pn8d>6)=lr()8rka$reHWtdSJM4mXu4m?_;;b;0VRpwgQ5qNq<#-7f2hR$Jt%xw zN%!}l_+cdj--EJ;m5iGBhm}lz58Mwcp%m&KRuW$d9SNA@dO>b(=#O0TOj(EN*cD9{*;oIEimwel7TIzAEji}#6PKIatp*fse~IL`AH@5H$vf)N|J9h z{VXL}Cj2QSZWI2LlExdM>nSBYH$v}IN(N1Qx02&GLR+_zm`WIbT1kE-^gpA-Wj;Tn zq`4CMex+o%62^X|WTFy||4PZpN;vT=C9zv!q(@2CR_J+FiEAtLKdYo+D~vy@q-854 z98uD_6;h8V>Dvm$N0f|hg|Z_`rnW-m5hc+#f%}M(gqxu5h?10>py7y;?33RQ8Ky>Mt-B@h%NiVMbm zt0db66TekbAjJcqxPsx-EcK0cX z-VUvON)on1_VY@zw?o78N}SuF>3Jn}+hOVqy~D9Dsk69|4}84H86Bk zNo$Si&nxMwfw7}X`fE(TUdc!e#11MsUIQhAO5$q4IjAJ57F>f$GHan_P)R{8v=1sN ztA)-%C7xR78C23#3w?u1+G=59P)UC+#J#Fyq85f;QxfZenAer0dLZLnA5zlj zfu12HogNq;QZnR$kz-19lkN{nl6HV=SV_qa@C++)?|}MYC5=0vVOUA)4rm@$(zOFx zhn4j2fR14$BRimbSjq7n&^N3^-vNWeO5%3H$gq;6ou)smBy%TB4l60x2`7h@lZhmz6DC&Qc`vc=x-@$Ht{1$dQJR@lA&9mbwtUy`TVw$xH>rbwvyC3sC-9BVI8>N zQR1wFx_6Y+)j`KQO4{n6>m4QCbE$1UC{Tg68A1heosl`E^xo6q;nT|-c!=I3+mrfGQ0~K-%~QN3u50_5_c=4 zyssqbRv7+3N%5_a@R5?XTcPPAC4IL-%STFvZ-usxluX==(^C z{Wci*NJ++RF#M5{{M%skBPAubLCnWW+_ypD$4VM+gOQJwblwJIA1mp*4JJNTGJG4H zm{4-Ur2mVOn0ko+i;~28u>VC#YCSalMM+sb^#4Ukb3N#PQPNuv&c7--UJq@5RT6(Y zjQ&+g_U+*McO|=ThlEKb1GhuTl#&y-L*+k}B;5g?|4~wW2Q>bV64xEjbW%y{9gyq;u`gx$K5`a5AnSF-y~n9`MW+zGLU zlHNO^$E#%GPUsaSu?-N7F7^f(S)hxv0o>8LG&aC+v@Wd;kg-sg!3L;Yq)YVop?#4q zN#BRc7+s3L56;E9G=3lImgv&;eHdDz%aDm*s*C=8$XKR}{Vw1PU5f64=(BX$eHWZO zTbI7OAm$uhChmfgb99Nm8z#@yCF5@BIZv13yP^L)U0ip=@Oip4+zpAJ*QNJvNcp@j zLw7^n`MSh4!tV2RNos_y^L5E;gw}u2rLqxHzobiRBTRism%c`r__8j?8=*c)mxOyD z>jGV}?t#7wbaCAS_OI&Fa1Uhvt1jIpK3SLJ_ds2;F8V!CaG@@V_d?T!x}@F5_OK z417bEg8QH(O_#d+z?r5?^L@~qrc2j-Fq)>z$bC@1T$ku3h+UyeW)oy(>f&sIp-f#G zo1k!&E6bOl6^nKU#d&d{g8O6 zE|vE~)1|t!+z+jn>e6{Xv|p-A-~G^gsV>9!L;t0^OxzDcm+Erzei*-0m)Hlu^-W!} z9stibbt!xRqO){yKL8n7x->ojg;~0^J^;=vUAi8ChAdtBAAq(jT}B>&j>~k3c@R1- z*Cqc!h+eIW=RxqS)}`%1s9&v1_k+;5T9<(bp?S3~qYpyMYF#EDgtpbX&;;by4M)@7m@ z8nbmd*$kc8y2L&NL)p66AAY><4hXP?wG$K*qJY4F3S!MY_cQ5C*Q(#qmQ( z_?|9JKZN))U3z{9$>q8n{~^?E(#5_TGAnec+zllay43H6z6xF1c0=1ux{U6IN|!Ei z4@2g5T{0hruI;)w9|n7sE^QCPRFy7+55uHemy-`e^3A%${s=N^bjkRU>BsAm|0Bq+ z)y4fID6G|`@kh{Ht4rsPpubj^p&tPrU8YR>9l9j$f!-aur0#+Eow_*on0~u1#d~04 zr!KBNP+6x-`yPnfrOV(RXuM4qTEKq0F4--ReTOcd7VzAuOIr){+^I`<3#2sYGHl|% zuS?8cX#Kt}DSN?rmo9~S;pAPqc=kf)-MTdGg{($hdiFv|qb`Gcp}tXOozy_e0`Cy43H7pbnVt9rWI0tq)TQiut%4&R`Bf6#nTG)ExL5KLi}D`Mq8n5pDy+TP|&JN z!2xg|(53DGI1cL4bpYBA>N0cy^nUIeyK}B8w_{plGO&IUAh#uf&FP+cDF&tv$_nlf#ZlSdYkE|=n{7b^dq`tAA*+W zbZIyQ&R$*m4?*P%xkr@Esw&;f9lfrDDY2R#vg^4f9i7LQ7HVUE{Tsp@jrD*eGEqasY}sgF!oPfDj$Q1 zf9g{I7^IxgrQLi!q07KyFm*zg(Z@hPq08iB(D`4w#C1T|f9aCc0mc8VOMVBG{I@P8 z9WZoKm!=LFKB-Gv2gLucF8v*l@V~l@bU>=6i{1elnl5oag;7nH?4N=|*TwTws5f-! z{3)CeU5@`0QlbordmJXB49R#Ljz<}i|2SYXq~vi(uo>ch98ztDG(HabHbYt;hf13v zy^lka&5+T@q0?r_$;V;9W=O)%V8Uid=Fflyh7|t{5*HX!|1)qcFl6`7O#8!-?w>(p zv>_wr^)y51gtCQ(q;^98B14>=kQ`%3Qztl1H>9l-8c#Q*yAxWL7&6%jCzcoz|8tl+ z+mPa)L&4_^Y5O@0e$J4=pPTlBA!9#>mM<6*^9#sKG$iF0P?%^)_Aj6%(Gce^pd-8~=NppvOK3mekkns7=lO;> zehE|O8&dpB$ov;WT)%|oFB{VJOK43pWa^iYm~KdR7xb+#q@fFjvke*Of|J>XjCMgx zjv

5SL>}^b_F9F(mm3@Z=bh^#pY07*h5G)aM$q`w19cW60nW5bH2x@(E~g7?SuT z3^@#OJPC1mh7>;ujyywLPeNOsA#G2>NS-0xPr~sl3>keArmiq#@<~Yewjrrcf&JTt zIG%!-8w_cE3R*TBa{MV6-E2rqH#Fa9h@%^ZZ!)B@+Z;y>8R&-NHybk54XrhX#6JzK zw-{3NH1ynJNafQIcdH?tPea?Sh73LpUAGycKMhm284~vlMAsXV^bEw+84QYA?ob`sZJp&218`A#_^xbaA#52%whaqvlg7`ZP$@~@M z-)Tt6uOPX>kj7uZiMtHx`xT_#ZOHhqz;(AF(LLt4VMuZhjNffYK@Vg!8dBB+++#>n z57ggdNOup!+-t~a4-DLE2+uN@oP5ZTq$3c&#}MZcu(ue}cLbvM8glXo)bBMU<2l&9-w@Ap z(9vc{-*a%h&5+^epy03}F}*N(*pTF2@ch`2!d__qu_4Z0$Z9vFu@_FX8`5Q7e`3gJ zFLXU>2)~Ao#|%mNHJs=$r1;m+{WC*aehq~`H)QbF(Dn;MPW&38pD-l(H_-EhA%(wz zrY8-l`wdJyWk}a=prPB4k>8l(gdzHGpzmozl70)$Ul~$pUV98__$?GXXGqU)A*I)l z@!vvwpCR#mkor4AviqR#B}3}_!1=Nv9et4hdqYP0pzIYxPWD0FQA3iRhvZicDSRFh zUo)icd5C@8kgn&UZOD+x=b`(UA@<)v%$tT3{|>tTXh`GlfVT{3{T*byWk}cWAZ5gm z;oq5lt|7bt(eE0P`~t+iXGp;dF!8=29`kw3kfs+PWz3Ma7od2|knR_tXUvd+7hrtM zkkJ>Q;X^~>`(b3YG~e$y{Cq^}=Ner(9een|erkc1b({fQwdFGA~tA+8r; zWWtc<7vaQT3>khA;{R&M#EX#eS3~p{q42MU#Jyztora{o1S5Ynr0^y1{F@=}mtgqc z3~7A{ijNyI^b+vzhD^Q$?f-5_?8}h<{~40}^|i5q~}|1>0H04D#_km3Ot{4YaV2jKXB8PYWX#s6c-=m6yZuOV^2 zhqC`QBwvl!JXihvO#m4@JiDl9RHkGx(8wC^IjP>ujhLu=2aN^idQmUg@GimIA4Xa3%t_& zDztpnD?P75+gH6Z_$qXK)hlBr-B-Ob^(st!)hp4jf&NvmB)kT(|LT>L*P!rUy^{SJ zBqV#K@->)B_e$4mz;dtjzXmbOy)yC|#4Y#A@z)@ExmWbpz`5Kjaj!#MhF7v)hvW>e z6uu6r8D4R|4w)HVse2uoGQ86EIt*ucrTcZ5%J9m->tJ8um9f_$YlT;)Ou7|bi5r6P z6<$dl0>?_P6b?cCO0T$wAn_8f>>h%GOT5xC1cR4&WoQUeF85088<3UlmCQF_Aloah zH=u8gSGwPT9*0*(-vCd(SK^Mr@qDjj9E0Mkyi#%uhOhEU!!fA4+AHnHAfdo3{l_4A zy;qJOgV+sTiTeW#Z}3X$A0Vs9D@A{R zUKw~3S{l4E^(N#udnMzKrhfKH@gL#%Ltd%>BQ*TLEA4-T<{x>b?k&^4_e$4WkiFL{ zBX2?PUa#nHLHvHNWQ;&|t5?cKpu5#8jUzDih*$bXprqX^Cr7~k6R#xy33`6wmBK$k z*`r=*_!GDu^-9a1;KXBI>Hib(xK~d83Hl%Riv4Xk@witq-iF;j^GfmCQ1p~n+TMo5 zZm;ye4be|~W%6xsKI0YpJK%oCD;e)VY>!vU%;z4jc;11`XT8$?4%9#Em7aH?|A<${ z-hqEhrBZME=(Qs3h#kF?3L8_Ao)$NINpPTH@#B)9!&nxE4$x=vbVg_ z^ByFPcxCK8Xc_U!l==LQSCZd{`cbb`z7Os1d!^-lNcpo@`rn7qKYL}u#E*L=Wehq# z@=D1VWKMXcWegf8yfQEb{M9SE3I8{*WPSkg$GzhG05bpPmE9k}z~8*m^8rLpdS&nf zNSXA?@eiPN(kn3^Lc%}1lJOxp{^6CP4^2JkmBtSN<&}XCO+Dw8sSlyS>y^YmLsyJQ z*`Fcfbdjb%gY$Hewm-w}(?z=f49SZ{hW`xpi$x~>4E>8mPW~B+mxv^cL;q5df^isH zDpEEMvCBl7#vyB&NY^+NE)y9Vhq`4VQ{&Kdrbxm^z*!?6Q3w@{3EDO6p8y78onr!@iA0>MZ|4hFA!<_7#f$0jC^d`ts=3XKxK|d z#wReABU1bcWaNvqeF6jdA_Jemc)rNQCy;cNNZbUZTrH9@0a*niT@%(G5Azpw>jt9h z&X4*+?7#S62|!nsCaHdWoPW>BV3j6Wewf|A_v1vBCS@idXPNy_^x*}$du&A?e(=^Z z{CifMKx(xn879E7Ebfr)aMaolKUfyv+h~HTHL(Z1%XHlft2IdsdRG@vT&;=A1mszK zt~L3rvF^=urV45gN@v0*fX-@7Qi5P7f&OYuvi-1RAT|mnt2G(0%946$;o;MA_e8fW zShLrbxA?;k{`A(!GIEyq@{$<^jc!dGq2+Fgy5_?VOtK`PBnmp*nw+p`vJb@^UbJS< z!j{wW_D0wG*_ruli~{$~niL0>Yh6(NbVNbt%`ftxkS_ieba(i8-x88ypt zvnDY?X(pp!{ANuuO+c=dCNC&WtPM`yJkt(l8SFNQuF=G-n?M$AeDBeOgWHYlmp#1qcnu{V0(f;IbXS1$hWgLnS)w!i9qdFru2 zn@5v^S#`hIVw|(Ym!~ls^m{_fGi8GzPpG`EG1C^zq%~zBVF5(%(8L*@cgJ4a+Avvg zEP$*XnlyydmRKxJn#u*xxz1(3M&)bBLQ(YpYOc4|@*UI+Q1buhjF zns(0Af!PO6EP$4sniPh=Cofda1N2GJ(6ci_eP88&SMHKE){WKfMbR+4)8F5N>93rr zkGg0W->FHnC5tmOB{TKW77h8gXwn{(&oz5(Ys{<`1?AK11B21fcZ(+WXdi9ip~Z(! z&)pN#vM6`&!hNUZ?vHL=u;zem{o)Tlc=w&rfH>K5LZ1Ws&Q62fw`o!rB$EzPCQXst zZ)=Tmnld?)%1o1g8jRFyQZiSXO`&Pbwy8f2^xHLw4bnloPlFS;N06o5y|%(I8R$C= z^6!|Imzg@ec18wFx{1@EF%n&2C|&GA=)Yt7-4XkhNtdw@67JNbD3s2z*r)U@!7b%Ao2H2E~DV4`taXZpsg^2KJxa+a9mc3%v*?$M<0bRT{=I_J<;hp)`rli#v7 zZ|@cR^7cDg*Br<_nDa<>+v)|IY#)61{@A{0Gx*HZz74g|+|b(DFk~CYaGl4pS%9T4d(?8%~F!-7`AC9GhEChl1Uj zOohwD8vmGB5%bl zgHg6pQ#rmDrn6EPL)IQm;)42}V=-ig!HO3{#vVeQ4R?rMU+d9z4ylC$?qDn!Stnou0ctrgf2REI9L4o+iya z?VqV@Uw)TB%Kp&2$1j28Fj%r_dxXKVmViABR=5Nb!(h%OkPrr|TVndCp|Iv95Elk( zUjngVu%0Cl69yYx0?}cxF;f$V!KRjgzAqFO9SbMJU{yr#gB8WX z@i16rEKG#K>SJL%47NKK#=>A7u`n72>y3qxFxXHm42QwSV_|6DO#e1vCt{&53>LE# zy24>UJ9--m}@DNguxn?LO~d;WhrEZ!8(^hN*JtfDI|u$ zhL=KY7;IuG=zBw9Czrxx5X{tdvCCj=@3amN*jxLe@}@1WX+y~;|I4iM1nS$=KZVPn zc%R=#n;8dMqOP0Kd7fp^9+b{}chfSfu6HwA2keVlJL}!O%Pct#wk?L1S@N0Shxx|; zWtJS5h4ak~wRL^|&ly&~53VQs8CKs-^21C$mf@!h_?Q9Of-@{#(h>wKI|I7*YtkD8 z^PB;Nt)aF{(;3jv>bDilx;4kYGhn<`lan#NytgmPIpjH9d-a~0mYesw_f_w&YTbUo zb#U7wH??hDkQz3;nd9Tw8PNI@O$Ka1y3$mRxu&jkn7Y!`oR37eE%?^r4?hS_?la=d z_O!=ALWkeypBek}1LL|0cf>(zhbC^z_8yNqlz8|HxqCj}^0~Ep6ZW0A|J>Gd4#Xck z`;oKS&RlS2ROpM$cQnR9S?4T&;mW`}%)0N419#`Ne9YJm*M-_5)Pl2yXV}N za~yl)_nn=)|E$(Ca}UHFJR|p!Wo=7syF+WwlE;BF!Tr>Xj0R+C>`bVCDs(Pn>P%>S zYDUJ*@C zoCQ-)h59BweX(IiUv!)WsokOP?mY{V!eB#ZK|=RTJ(&E*&w}LcQ2EW>W4k)oc8xw8 zvb+5@Q?M^uH{-7+pAGR(YZ4t5CRevxG$#Lov*EFswu_|O{v&xV%gX6B?!d#C+u=zmTV`@$L9d`2%`6I7oI+Cl| zv!Ua8P5Oe{|7U*oIDR)R-wjcR;trqT*t4u<_PF7+mQ$g%%}h3A^T-bqHVM1uWWTQ{oLpOodXHK zpZ1r0b?q?g+Lk?C4`z8X&ViU$LdTi>b0GGW$m3V=IAhX!&H?u;(_>^MlV~u}a!#!&r!`J@jfa_?ey*qUdIKyDk=R(O*fB*N(UBbE0c2twXDBqlI zs+m1AcfL9a9(Yeq)s7Y$@xMMci8nf}%nhiJIZW|-Cn<*cy=KEjMq>GTY zs0j31vmX1-g{0Rt8H%LCw}rOt@pG-c>a%=d$KL2W{G_Ho9(SI#x4buk{tB9Nx;DVw z>=%yntbO5r9qt<+9On4o*c-ENQSSbQt*7N4h&FZiOusPoMg4hDH>^p9Elj>0({9Wf ztD}?hxyI~|2NoYZJ@=8Awnetq@S($3&m=(K z$gH`Hs{;Mdth=NH7#s2Hkzju}Xr9Tehk^uf|7m)zI7BwSH&b`t37%p!$Bf1VaJ;Qa zOprgic3Q@7neGpPw(LoO#CQDjL18vsfuFZ;{v+Z4XYXymqbjbr@!xJ1h!8MptRMlR zL=6};K!AWzlHJV*5JG?e0RjY!5HM=cs6m59jT$v-G@DNXMokqpY813-i!CZ`X-nI* zO>0_%rY%~usL`TL+1>2_nYm}~y)(O;2=e}4`#$dTz|C)F?%eq}bLPyMGiQLrcSy%* z=Gm)dS->_1Xnu$EA42Y>K3}Yi-MBHpk#|n`BB{-7$vf@4lI_(=uDK~SS6R0oe$Swb z+%Z7sUrzWcLQHZ4BZ*W-9E>ciU50K)`?0y&H3o=2tm|93{$T;>A6R?s9Rp+?COwLI zzA|*!3)xh_CIZ&SM_Bz1pYR=oLi^Vnb8P7Ofb%_>FGQXXB)(_J>8wt1=K~4vo$w`? z`YM(6l~5g|Hdq|Y2IUgwPIpOOxwHK$~EqZ(D`fFClh_OJ_-%j`{Lri)bQ9rK0aWq($ z$t;)gj*PKD@sSh0qiQ?ry1XJum&fW+HWrBaK-Rs9F{9F6>sX-hg8;nAUSnOY>`8Qu z1^PaqJtKqmb-A7Kc+XhC_95xl?56!Gp=VlQ7FSYqVTI8{LL^Z1;R#>4iC!`yfu0Wy znT)l4UL?@@;R#>9RT*2XuQo{HAWvTv350&6&v$bAm2!Gk&;5}=$43M2H5_5(8Xyg) z|8YR?N3uK_ISx4TkulG+yyC_IM+eC(dmPaBk-QgHFb+62$a|IJ0FP3JW-3>VDQxdJ z!1l46?x6BbKL67<&0)Rcw6+joj6Q7RfzFRk_zJ8h8AGRa&V`s9SKM@!#xM)J-k%dQ<3dtI%izQ&SP-Dq(& zSZeAmwRILpgUe#weE2;xUtv6c|9GJLQ+*#y+RMtMA;G?NbUYCL*$H1sh%!ereoQlT zV~AsiwTZ73{no;){bMHp&MyM!5*#&La5d`^awY&JU&ypmH~}dA!f(%RvEYH6{wDx? zzc}G5RogIy_OYzldLy#$?4JPOxJ)0N6M%^0@_zTx2|(;|V{O6u-7^8mIZpd7e*DT= zXI&`oy>k6m6tMreyry(U0SAxE`_nm5z>(vm3n9L?p5`!C){-b7=gYvnEKk{&X<>PN zsjt1X^@*LWPqyoFIZJnlmF=qld!mY*ay$w+{?!RzltrQU6fu$68~DESU*vt4*b9K} z|D5oZStVVF%VKSi)=AkH0P!bI_%gKo^OAYP@;2qGK{gZQ4nO>!nZTI*Re1rB?mpp* zw~;O&d1u6~bL=~YH=W_EKHGJcy(YZ&Oh?_Q`jL)?u*MPACBtQ%56g#rzmt96cfywt zV(M37>Gc*~2J4IRcBHocxe$oAx&=KL?YG=$KSn?C7XrJjZh!ecg$b{cc)vK%SmOHc z3jvqSt?x^-XXS-Jv(2s1vhn>?^IE;_LZD@UG%UQ6mCxo@_p39+II~k?POlSzgEqIX zRIRhIH)`6|)7m$FA`m{r?JFK4`ZvG^%G%*3W~J#+3MT>?!`;%jESm`A4|nT)g6n@L z0tKcpHlB7*1PX_{HQff;Za7SPqz5MgMZ?{a4Ndn%pmexf=Kqw=JV)E2wK8zsW2(BQ zo9Cx{jgJO)EBU5J15Lx-lI}D&8mLs#6-5JON?3U`P^^U2M{8|hoEb2>ZC@i@&Sao_j9b{<1k}B-J}H~b*8MuK z(sUifH#z-J23pT|OZFLiCj(7E-eK{blYxCf;<^1BE8F>Qp<7gKwXQK%Dcbmsz7)tA z>-M=!}SK;d|Kd_^l^EYAcA^V4_RYxuIkycWuj z1v#A-(G(y) z%B|_Gg#0rF*c~O8zkUi^_Yi-ku+}L+w~}uE6rd~0E!p{YPGM^yU5@AVSYa9;$EN`4 z7wELduQ3)%*jIFKY zu=>k@NK+UaTdkJ?VHdc?-lEB7R32NMmuY@5b0Fy&v&?IRzRQ5-3*5fK0Cvr_A=V{g zP_TMNUk>zK=+^ef99n)GOmyMA9LSmI7W#3OpR6$tNk$9Bmjg#8>hp&p``GKO1@a(f z^T6)QnVhW47{*?H8e4OjxAHgnExGvm|8k(?B9cEzF7{jw9KT4Hiw(W#Lc<0(Dh`Oc z*d0*kG0#NweE%~J$iCR^b6S-Bj8tvEPHKov{F41Y(JmzxD zV~+3t#sNn!G1g6tW_sd)W0$z4y$f|s%k_U#fwCA`UWlZym;n5M)BjW^x46arf_5Ik zG|qCT0>^{Iv-U5Y3gk_4t9#Qf%K}4p**ulW3c=H`Iv$t`R84XVJHw7)$vbb`was2# z;<~l?@Oy>~cWf$FDJ7;Eu01< zOm_R*e`Xr#^}o_g`~TCJoFJE{eHu_~3S;By&@`Z6vRmHctF!7uQ5jZR{ig#Nm&)^9 zM1ZiE0AYzr7`K0*u<`)orIr(&Q2;g;%ccX(m%7E76VsZe!D=jPHU!+?-8UVGi8b1Q z(MZR1ATrkNix^_omDLTeKO?nzlxt*7SnUXVLulhL`;MU@vn=wiB6~kP9_Wp8`;J;n zdsfxMU1y{UMQMYrF=Pkd3w<|$UMDLasGlbHRen5Bsf3lp17%8BWjs)f(KyHwC7+=~y18AM@md;2BIc%A- ze{^gH5Ebth`%_Zd93}1OnLu~Eyv7NXmY;u_36#%pOJ{1F)oczm^mYX^Sy_Xp;q{*h zcxEX5KNILx!uHMtjwoRVX98VHSociekP_BQ z`6mkVTc0eD*KeZ}fc-Pwn*N^ZkWF(}rfJQbl)&0W=U>tsx5h-<1qr~xS#lefCIAO! z$vm|xKv)ZfnRQC-3BW!j>`(%*R|)G$09s99tnH2`ur?)G$lN|C{UoW&;tk1Iv&szG5~|Ih)oi$^K{acF$&MWIEe78z>zh&+gg4 z@gR9JUhkO=^v-tsIxUJGKUL`Q*GjqtYleaN{67aMzryW{u_|+yQ|wihNo`O#2PnNV zczG-50LQNkTwXT6x6T22uXIbc2YidNNT=Nlv#y@Ye=N_d+`c%~Zf~U`|6Kui=DMY` zLy=biy>kcON8t8fR{-HjgQw;CuPcDKB)4QYU2z2vo8%T}CB^$!i}!i`uK-$;+`eXO zP+4|^x&GY#?FwMD!!7m`gPwn4WeH0J3Y>0fFEJ_+D0RwmUwk4^*wGf@bP~oa5T*=Y>arD<(SqA6;}cY>27gWjK{B}c)tF-5~xhq*H%I0vh)CQ8Ed1*@4r`eU z=2d99M(hSm-N4LfmkIhGzo}O!XlG^2qi2o2?$l%$jOL9NtcrZ9A6-Z z6(#{k7s#@FSrX8_!0ju5arWKLS%-0^zlF*s^k{4?*`5R>X1K+9TSceI?aD;wI>et` z{!0S#7Ao>zGLXGc=5eEwf%Jv4-hq=1|Hx85T1!s`_AYe$V$`|G(03P@&o-7M1Ff0C zb#V2`Kxd{r-?t_M2M2iPP%_Y)>6Xr#^dtkWMRJ=TPX;O$`RNp-ebmu*pm~ujhs6d6 zO9~K{9U!cL!X)|64m2%N=-&=hDPb*kpnQ?MU(s#{N*1}r+0cOVI=BC~1AUA9_Chnv zb+tKwh%EV=qa8q~5*F(KJWAP;96+xUmhAwJC}9N-pi2oWbpVGlJ`_OLmDyv1(ShsP4L4RDMTXj<%+&UFPk zf0N||dIm|y=YJ;BDL{l0)|Uc=Dq&%%fJdowR4UNBWMEy3GZpAt;vUep zu^?6c9-BK$>3j7SrH(7~e!Nq&W40SY7xCxzR3Ilim`-My#GhHYj-~=wMmkcza|`D5 ztMpSeeEv@ZT9?VZEIvS3I)$0rGdB%rR>F$X0GAS0o(5DXVfAT1sS?(j1{5h_`_q7Y zC9E?I$Wg+MrU4nt-{^BUn;I*_E)1M~dfjhLssYfcw4 z4~SkSkB!86!02TI+pFcx)9MvWPs8e7PI>RMNc_NMu@>l+=k`zYfcE9`yzQvA&NqLr zV;<14T>hTJR3^UvJrC$w?)Ify6xoJvtSs?6qZd6N=v_hbuF0NA^8YX&u;mQ=-NN}m zSdKoo1+ZW@mvS&eyJN0XT_5u^SPpH0Y~3OqOyT2pA#i+k0R6e6hOec~ zI`PkXivspSHVyob=X5GYzp zdIa*Nw#cMI>sScv4-(JipM^m9Iz|4;1Z?YM-ZnZD=vy0n-skE->O35;H+=zlVSSW`N#|H%Xr*SUR(sx0jk zvh*zyTj1k=5#Y=-Y!x~GTLd)a>FX|?hnsD6(iZ{y^A!8nML=7gGXF0ETJmH)WBDSW zKF`mtAyvyiZNy@e?yzkUa6He@N3ePxSOj3b+t*@MXg@_ie`wuhvI}Etp}s{x(baBW zdWd{imXW&uq~y8T&zOG($61ym^Mj%ER6N;(gf-)x@~z8I+5 z=+=Er@%~?|)uUYQpOsSoF9xDFDe~W9VDu(=Too+_!Zx{m;qn=RW#+tGi-EoZnGf!! zFms*uEe3iEWF1+@V&G_jzP6C|?c}{m;(tqksLg(Jd#Wgp!=&SmT>`{zCi%nepH}F& zSvhi+0EwHwemN?Z0L5Rk9DA1lWnZHl8EpN(1gP5V*3QV9&$#Jl@~n4BOdv%oFSwCZrzncA^tYppbw zbNyE~5Vc+A!9A=_+vR!qcs3BWT^?Vd%lyM4Da>rQ7`F^a-0qgoKP>~CrZCn%Im>{I z?QY-h!1iV9MIUnce;IJ_4!zx_v?V4Vo2|=$mOBlbK*q=SF9W*obo)92`bf~cz37U0 z>jwe(xNSL5aF08v|Gnttz>#}M4ksE-SPsOMyM6iQGg;hcL@Jv<>V{hv>asi=(*?_c z{CnNLcrAUig&%FI39mgfrTT2wS8HYH)WqnQV3hn%R4p8{0qMtO{?Phbk<>mnKkI{Jzsoj#Kb}P>TA|DUl zZY?=L*5htp)z@sd&K#hvTBZk{-gMr*F9*nW$@6L0N+81}uPdTf0_iTdFT<+n^-V{; zmMhj-T>f7P-Dc5`*Q8WOxXwwH&ezy1eq)u(e=C8!Mni7q z{(n{i`HgPL9~JAX?v+46qgy&p?@t?A8;7m}Vs?-&&Tr0H<=4gutAMH|x4+N6Lc?}6 zcNGx3Q$HVK{{B++`xUEz<2%3p_uE$ixlaWDKHvXa1@t}P_V=aA>1Kuh{@-dKy_wE` z5bZ^+2I`yL+F4PvjclpE?^{MMS*wAHC*3{|0@>Ql=Rvst%hf>f zQ@Rb7HZDy2>ibp$F;B~9NIF&nSx+na-_?Lq3F})8Bs?vzL&9=_*r)Y9EMvb^b}zvB zPC_ma)8ZCBPZZw)&N{304rzCtuYYra!e``il;r|>&&czxD?r$83N!D~?aKwSpOMF= zbl&^{<0J>Sf6E1mb_b?0b^Shi4bc6Zy#E%v2IzP$@P01icNuGduIB>S!!DH14;8Ng zJkPm>|4oHP7Wm0`Eo*?H7j*vDJ1lwU9lN&Mt4m$CJ8N#M-R7t(vF03p?;W#VqiYRt zsMYO@3kfKHylu8`x2**_Ue?cYNH$#D{$VYU)JE%{l&@j`uoiH&Df@p)7;CRm3M*FI zD@E4%wyXtu+LZn8wLoW^V*j-kIHaWOSqtn}(j8w5w71E$AG!``ZF5ULnS>9REQL1W z*8#`cWSKI39dK0ncJ4Z$yG_<{6s_~GOZhtgy40`J>SDGnZl$nFm7h5S^Rw=CK+G#L z4fn1CB3}vI*L?k(2UNZyuZg4cfZeaiGH*g2(DsVl#~Bo6PM4Plw7(+Tr4txmvmfL#Bz9_ZMk=)cwj2b8e<^+3B4R-}0cXl)T~qUZe^fR;UmZZ3r%_S4n|eE)v~a41MT#QyiyKrgG8 zY*(lI<>3DRt_HGScl%0%q~Y{`HPG5_oL}Mee>HGO2`j!DIMz=76NLW%Y9RE-Zq2Wh zIRAY$5dMbS7jEM;tMG76^M3mp-2cJVz|sAR?Mi@oj@v}!137QfobMQwWT*|;*HZL> zX!jqcyqx^}b3TyxmfyU$K-Jx_?-k_(xo^3BiKKV5CGSkyHP_yd&^Rlt`YP9zj+(^U zE9&Od&vxvX*)+rYhI+`HpMTB=vVZ3GWz&3U**SjKID5_cwPRAMBVA*;4=}Tzv?KXI z$`+RdtUD;3=jWhwn7^NJR>zoYfQsMh>%}TdvU!KWdW-P;#rRwHH9$^>zFypK zNe9WU4VQPkZ5nKiAtA9AX(h?(Te4BRv;2^sK7hMAacKGgYk^tG!^+mS5y*O1 z_Z#4U7X|63x;6rR@9MIJB>OKgjR95`+a@5XJ8)W=uchjg#lDfa2`KH>%Odf^`HBv# zU=t8^Sf?M8zCDHXCAUa^ed;#>$KEq!dw%|L6AJn{oewhyGOPGahmqIx&NaA;8;&^TP%M6MF9}{H@CQZ zL)pu)E;HNm?JEGX|L)d(8u9f{0Z{gLvegyqp90{ZlCG}+IR1B%gGeq3+YA)_!|f{% zxL@R`v)tiN@=jZ=71Ev4e zbw+{Ca~az-t7Me{t5eTrpzEkx_&PGqjdEW-+}eM;*#{w)f3^SzKGJn{CcVu($q#Dc z7NFx}qg@%#$l3yUK6d*`VAyktyPjA(6m0>r|0Vl0aY#N*8m!kU`V>YxySD&w$LLJ2 z)9?{(o}&+K0rHQ@x-jmS;X1=ssdozy_KAM3MU2_?W_!ShYk|^F=!}fu|JMSeKc)Aw z$WC<>4!@Udx`&G1&%PEY`&70WF1Qw`G=;IYD!mq{|CHq5Yvs0L{I!YY^O@V%7jP`- zPRqDY>Axy|(Yme$5ty>#6auAR_~}S;MSHNmjV=VbzR=s%D2GGeTX*Q* z(-s7_`z|O1^8RhiFWmmC5GeY$uJ<wx+%b$+YZtB89t^3-cGH2vRoK*3jruAb#r zcpcFEmD`tK+NX7>HVTa)*1MJZviW28bwE>}+gD~DH$nWu@&3OKIQC!C9WB&oYq>bT z#pqVpe_RjLpK$Ab=UF);t_S)~xFvtAcD=bAy2qUyrRLoJ^LpTbTkjWbUguM~;Y*s$ zOC{F>@gBG4BhBvT%csH0`)8xf3D$_+xWDl7^Yf3_0|{QY?^s}c^i5*E;QAj{uYR{L z+ElL;{hN2{b35akqi+CueexN7{p^UNj&J^&*Qi|oe*;hjk2d!Nu+1pE0XP&Sp0EFI z075Mu$N?rT21-$HGUD$Z1IS7 zHTkV)5~q{No?Ps_Me!*UUj!6dJ<{4Ny$C2(!g7m%N>dn@|BHYotH+n6oliF172sr| zxSh%34qX^e^HYMeGVd({b`SFew8L5IzXhwEe<=cbhk3MliN;<^_3#yD*&}Q#;0*Oh zzDI-ILzA!-2tUIk=H);(7n~KEst-$gyA>!4_xRFnCV7BK0sQ_Pr{TOWWT-{; zInDRKZv-kLJic<9vUeoTK!%)WG5gP9bAJAfK-XwbKpQL5MntCJv77AQZUmCXc=WY1 z8Qn}PoUbuu9P|#=yi6Ea7sL^`z8Pvdc?f#XaBTW;bGkWc`;Cbp+}tO^?PSifHQN>VjyOs zN3*SFynxMr#X#RgkFWF`^ZJgh>a_J8U+Fc3HICRZyy=XPW?LXXk%DKmu>5CveC3+X zpeJN!;;t*~H3_w|Qmf~*QpL4#4JWtaD zasPie1C>GISy;@?K-(OTFP(f|CI>JuG=v~)NuYH$`%V$dCo%AMSY4}b209ZxzGHNc zNXX7PyJp*KX4cMdRwuY-+3Vu#r`sE*HBPnfh-_b3MXVu_`2a=ViO5*c&cxyeOqQ)^(|)W^(PM zx|sS)tT!Bf&r~RW{{I%BJlW&#BWJTF7O=Wk-U3A0J-$-X(}X1R%CmYqSqt#WJ6Ppe z-9ye&H8re^9k&44^Yt>8Sv6e`n_E)YEaMQ$9;J+Y|L;~HG{d9oD_NPMZUw?JJiddZ z%dsZ!ym;3|_PVJ038~f5u8B1l)?VOf7~eR~u_Ll+taZJrJYxNve=AV6(BnHI=fPfg zviEszrc4U_G*G1fycLLDU>mfHZvnqXfuZilsJpMie)cfyBfbcBOfIbS!N`TQ>vdrTu0m8Br`lWk67nt-M`$~XV)4SaM zy#$ELl4S!&wQZI8o5xFl64QHJ|FsP$RPu`42ILv#F!`%7+BRt$P@d)S_hY=pur?pk@j~=wgKU$Fz)|$8xXqKqxq#X?=@d-=^GJRx+in9QmwEhc$#|L5{q|0KZUd^8dHnr+2_N^j$`cyD|Mhm@;Bt?2 zokT2=jv-NiH5f-dgJEpK4}@+3ToI#yPyD=5ZWz2T;Gxx}Iwh><#<~tL)E;je$y*-v*EWd7mY+|M9(d09_kAKF=`o8d9I)^(Ca8uOUD8 zTR?I9_d9^9EgoO4v<_vjI@wzemJwf&vW!CJ`{lv)|91krZ}6zT!*!jc*>1n!PN44w zkABAzd%yHfAfd=3-7{^{T`U)U%k`gk0_9shl7A5MeOcW8;ZDGIqer@Ppyy5?^hUqA zf1z~#xeSQ8(IfjmDg&Z#^hiDqV#|Q^8$FW$@}x2#??!np%`OA7O<}CA1@x|Rf8QF_ zW}DCdWkBnV9{>Aqoi(;%^ZZ{16yGF&yQ2&!P{NLs0l7DMr2C`$%77|U7~|n#cL4`( z^7yh%c9E&Vy`tHz{XGBG3U`5U7tnQ!#}}ra!{F)wJ`re(#U{)3fz~@2O#Z(MXfE;i z%181!wRd9j&Y#$Jy@$>rN)Er!aAy3Gh3jngfBaXWVIO6h%y=TSeHNRltc6CpluYc|V zQ0oc0hsMfMc@HqU)+6sj>bzd|!_V)3zX!;z^{D&qi$tC}{oezW)p{g5_P%?7wpv-Y z5>^g$)CO1s1dy#b|1SsnY7HL2^}ppnWSvLs?-;V^D&_otIS^WJ^cP?Ml>?qSk1r;i z)^0nac1^H1jBY$HrFy(;Tuo%{SbN?1^<(TizSneah&M##$$b2m13k|g`LenDNIB5? ztjBlMYRcEa@^!L&oh)OPFU$5CKN7ayuYQNMcf!3u!SfzprFQpt^YG-IPg!<7X|Y!~ zTU<|AQfqcuYIj=dnk@A@EcS**OJjq@v7_G7RA&iUs;*nP|DSt-mOUQn{(yNTH?a2I zeJ^lukH@z+g!Ht@x*{n>z9`iCzIkEG=m38NZyDqR-N4X}X)Qqnk zR~K17*4}V_;~2+|(bl&Wr5}4g`aZz|JmhYU^v}d9La{pm#sXPpjm;HNmI%-UpPv>G5HRsvo^+oZ8PL+=NiKlk`@$&SLxmgo+)Fi#W9e6~Qh^9A|?GDYzF zAMOY84tg}(ywp)qPQKw{oKYyaA2@W-BW&S?zSevxd10oh$owiFptx>hP0w zC4W1d|33&E=;tYWy9Cq_Nhumg04@@;Y z-oQibd%>$z|HlBrx$6?|)=^Epn*YZ9>k2o8Ga?K=`}mgQJDn8woU}ZcK{{j7w`d>t zI(;wsSIxEFGR2sE8q6`(2O6goL{?$Gk*@~a3950cU`2vut;Oro{~qGkae`t!zqH>D zk7k!z{j5~vHP5wUjFR@4fq9k(vtt(}BJsaySMs|%sF4;24QMg*tYgk3&lTIU)noNs zg!B^oWSk4U@J}REY5yZ$H9B%{#oVsgb*rVYbPAf}&u;b{7n&!5Kg2ZxEV#7J>dfC) zy!Y3^s>nh@Eeg+Bh^oCOaq`B%k#9mD;y$3w2R*zJ!$wZ^!FaBaqv9j#L+@<~q?;R+ zpyZgtOB+L@N1pq*)0zWg$ERdJnUAOMxgL@}AL-ivi4kJ^8Zqu0H#E0-H2CY|;m`Ah zMjI1B=#Y96=k4sg0lVaQ_`Kvvn-=@9fTXSMKY3 z(_>cO^o{#Yt|xxkO@|$KIJUAw`_kZO**6b69-y>xl;w30^EGC3?nEXTp3*O1UylMlU@uu!)3782hFtc4V=ANB7qGn7-(tJra^JMgW?t)(Dx7pV8P>t<-T)Y%MP>}quosbF`Dg0O#_G^b=XvK{}1123;H}AnS z8cp$!(`pyjCTa^F6Lvfama z806CX-BNpVc|q|n4z*A%KEiji0{QmQy>88cN5Eb&2|bNY(w+?GCl)AY&MTbmJPUL0i$ z^w{cNoqL0z-|7a{RJlX?^vc*Zp`RC_1^nS!UZtrra6$_<$(r^U z@)F9ngFfqiMcj!~pU|4F)Lyi|^RB&*HzF7&8=cTn)o<&0!e}kVeq#t9^NxKI-3Tcl zVScUgFp9#>#-Zblyvdk%)Y(>YIEx&kJS&O*OqRaiVCuZ(2yl{`+i5>Q$+?G_{0D{c zaC=_7`9y251ifU_xd=gVcvbIK%9F;P&k|h_fi&-x;a+6^&{W72(QQCrEqTW=a?Uur z_A`u^n-iGi-X&w_)80WdRftR5GkBJ{5iD>9u*GaTrKB}XtkHK1wi{0Sbm*fJG2qxt zR7cvC)vfr50FhLyKi8i5eP?u%D8!VdWAGs zUM=w=ndS)f78;A3!*FR=LiAUlbrPR@C`p(TR7~qlzoyXUR^!wDZ*bS7u_>KD*97d; zqhdwcjMsB6s*|T6lRIwt7^eF9QH5{YZ)3krC{3=w?|tMIR~Ju@&;=*cMjxuM#=HB; z+8&!nTF;Mau>sxGN%On|`H=!wFZtYQ_(1M)WTv063d?lQ$=WesbGJ^keo;fCAHV-b zFyRNLA8u)_51Z5+)inGaoI8Af6!6$UJJ7pD^<&`GE?wMF9U5YC-@VG{>jbP*Pxyly zQvKPBN1IyS1;=HcRyLZ}S}u%gN`2JiccUtL&tP@V(1{0oJr|>ewhi%1H4P%~3&=-F zpZ9j%6t%53`rTw+!yiO-%=*@ZT-Ab zY*B1BLASNOTWdE%l;e4j)#aRNk-sjY>|c)^IosWGvBqmn$||NN(yDMjfd}8a)VOn>(Y?Bj};>!Vn!(R+n&%^k&tUWNik zSLdE?CieT?rpcqx!HpkmFH4wSNUXU4o00D~a< z!bW%1uGEcd_5NV6creK^%=pLgZCAErEt{qm`XD@%ah9#w`t8)`!yVnnY0_7)?e7nj z>XF>6wq(e0P{B`PhfsUdAe&5T;+YnsTZW&7qi-5E-iakJrO(EEbRUzE`&xDDiN??F zksaxO-#1r(SMniP8UHE2>Zftn=5ZhQE4W`XpTBI%v(nfV zAFBacS!yH%NbsB2z33}TB}vXCYp0?Eru_bPhl(C_^#(RqOnjX4&NU0x{aAPxom`Fk zJ9BnC=BL5YFa|kLnRXsMuixH6>R8924tPR_7S5Ie&v$(-BL)7WufxB#KiVohdsW9O zCNMP5qH6z=hA6hED|pY>Z_rqxN|JZ5^T?sL1%ixn@t;+*yVr;0gqlq_4Fa9y-5`<_ zmA%e1^^9XeTktb(e>F$VL(&@rEEas$*HS1vYV13X54us^@%69c&o6f@8FN{!SXK*` zdFA@+%dcJ&%v!_EU|<-UzjnN1H2Mo+T07aM(QEv@u*G8YEzz|x5kSGlA__Cp?#+ntTcHCt zL=zVs&dvMZ7&_)lco8KN5Hq7yxGEd`FJfV%t;|2ZOtu9(aBkY~Ev;b-wSN}8?MO>p z<Q2>OQKj(O40*^mHJ{dov?>nxaOaR|xj0v!Mc`{-|59ExB&yuN?D z!VE}fMjB=Ce9;jdBLx*%InhS_JHBX&MbMHrQuReXf6u12!;5)8o}y*LW8$|9B{`59 zUhENJR+anLc1eTVO|+YY??jeT-yS*O4m0y_SYY+v`#MP>CNfrj#w?fW}OY* zg2`=izE7Z7hqYhJjto|!R{I?B* zKEVN@7OWaj!3NqhKXIw*t!VL1T=ekI9sXBeUvL!W!RtKb0;}z=zifQ{eAl} z2>syAknto|wK(ub7vWlhKm#vu|3p*E2UO2$kAKjXXZ#v&sl{P}J{Dw3`9%YI##3-H z3F}Qfj`)ts)W=VZKO@{5%A2>oBTT*G>5-V(2Q@3KkZOkaA)kGoO_-)W`(7S+Us@!T z!}(=;52riDWn6r>^0{TP8!j={hu0poe4+KT$%-V%=8|ROH)t(f_}itaBMP=XfW6~n zXzYD8t($_!Pt+QvK#t2ws-&K@}2b@~Iul#lNBSX-LcIU&I zLDoPd@we5GtPj|Of-w!Qeu-r;(sScWJ0Ek4r@pMbuk~#W~19_usgKesoWaIayHPOK^U$XFkYGkHLble?%G z#`93<-v*=6XFj8jt7|@A?FkpnsuKIQr*ql|oE8LHID423;PPKC+7}z7YPrJ?`rgtGW+)8;78R_O^7p0RgO#$6{=4ab z^HW{k-b%18GLrf2@8^0SeC!iW470avlG)D9y;O<9&)*9E`U@Z*9Ned6HJAbKF@j$? z0V^##yg5 z!fNR~{1?FWhoUn48p4Y3Wr_i84s9{(!NXq{A6L4f0w5pKr6xp#&f0NE;mBiShFJEJl3%%4SX2GQI+LCt@y| z-Pn493+EUEVWOcfD@uPubQcZZ-FL;!%NlMP-sY9Tf4$aSHGCKBiu>kw(l-60bMQpT zXxyh?oJ^gIj9{zbdHAj8|5yZV@~`-Hk^DHs$x!Pl(|w--9%ep-rs0kpFPH(q#N;1)lvVz|N|s1x?8z`HCCGl9`E`erpf+@$BhUp} zk~I~7MLVF6(BSR~4S0g9034+eI07$FLrN5OY(v z>p8~3_~5>X7jvE}MqP&hBLL#M6~q-M_5lZd7@{TNo3pv|^U1$B3_;eUn|)$9(bpmH z#Y^j2TGC|vv92>yxS?kG>5ARVrsP#X(2FCN#ID8yzkL&AjchwH zg=ZkqU)f{hM}F3uH+B^ zg@M=ZJDu01B80aWXhP<}fBJxIapNKa8PO2w==|RB){IyPOGW(K7jRDT4kK~+`&ObA zxdYxK(_NJttk`hPX@q1mZLw;^vNc=irXk?_u02@E-8I3oVri@m+BCVD5Q!th37r4C zfR}}9Ax34QwkoqDMu^Pn)|e6Ftuy3F6Z1Q;}{8Jp5?OF)IGW2 z{;Vl~n}Syk2;O1t@zU%_pap=_c}0^wU26MmWHT1kCu?x7iySF9FZ=jw-j{QSGYC~M z5@8RuwqRQ}1q_a3e9nJy4pNbkdNIx>rnrb$DvI4cp zKKFD!@`G>4r3|*q<3BnUJ&fwZnS`pre-p}#!j)s=$JB6c3nHUJzt9ZnEv+N`Drzh5 zKptSaQn~pv_+|!!dTr~F$T_9LAb1-n91i+(T*hGIT0p<#e|Nz~r+! zLe-+tX)Cx8?guP-E3gPa7CAQ)nq-c<8^?Aj7u6E#B43M&7#3g@9!#&1<5RAA`)8n! zQaRSlit#|m#T3`EXC*)TF%`*~7hvQVqRjVi@W;o&sHhi$SFJeEgU|h;2f87=U%6y^ z!G*-EK5}(D)oed@XY#+pfvr*gfw3~HB>0W+OYC2+kUXTabx*qJO>CBWYagF*-ifog zEYkbe=|bJ)d6Rz--GjQg7PHy1+O}^T!PR`1Cofv4S@BzD<0_dJw^@ZSc;pd>K6TK5 z|6x~bf7XLm6NI8ME~~s16(L$c_~rWVrS$~)-smmT;Xyb%QWAD{E9=KrZNUXNn7y^V z*svCy4VYJ>Dr`NT05L=j{5lG4;DV`nOKx3|cOF550*w7b1Th0Y-9s6u>x@dSomd7+ z)dBuG>kpdZrlW+tQ7aFlKfj#HtL51`6TLJs!m?_0J=tQ1lx&ERSEBYMpsb1f%@p3a z>b@hVl_6~6zdT=x&K9oh)nfmoha8LhbS2d=dw>Z=I)HS(<_spTdITsn=Hok8h@PqW zn&#Jvb8ksodW#^^@SRtp_YGsKk%v4jFB3^Gw*U5{KJFX^7e6s`>jQtZGEPXBCT_=X zqU3jm2ZIafk8m)9l|ok4Rls_)=gY->W^h>`*2ljj@s*vv?@;9<+>7&)th*|9T=y?L zzpJr{$B3TIur=9UT*fl0Xq4U!%BEgvf6YkTI$2In+&bXtK(x(a*E(VA#F;s;q0fHu=G+EA@pC|hc@FOg6}w&=Pf*$#ZzZGIms8SPH*-ZZc~jO@u%!dn z=x`=tT$us1>|%*N`w291;PxGsZ z+A)X&?dn?ON;lZ)1hngHsV2|anhKn#ZYPMVSw5YGl+uN&;8zV)>M$QI$ffiIUe278 zCRgti?^qJx9o;VpvVN2teE3}A?4%~!3SEH9nl;m4e^x|aIuj<%(@Wsl{{kk>K12l* z{bO}WN_Lxbn&!LVCcI~efmza(s3t1>C%B$OmG^nTq<(TS#;Xy;+1L&V574`wJhH z@Uh>_9i%0T5NtQaB;jvn^F@F*^rLv1E0cpHtFrC!lNua#B)Kxmh=`Ls!b^Y7f8le9 zPDT!ixJ&vtM#Y*Mw*!jBtno-sz`XIv8hC03zz*+@r*HB*M8d zj^c}S5&^n2z6!1Hf;5g`ecy8dZtQ1Bp2OHhKJ#i+9+(vqFFOL?QV#zh3xh8j=TLNz zqZ06J$`ibTFwmy)HI{aeXo|<3hP|NJBMB#uuZ)CZ{&gbzO46FHzj^APG1sRC9p_#v3KGs}NsB5}|c;+7jmyl6T2CCv*={ z6bV#kpIM+O;Emi`QmME^N~JW|KC12wPZ*%emLYyYLWLpaG@vTXvR#Z8)R;Bfr|xYN zb%2;F3{Zo~Vo)G@*nkr9H-C(Dl!`pOh+-(sJ3x%UBa{nl=)U+vB4W#<6sc=P-m{~+ zNrv3n4JL1SnSK|qpvlt`<`vDli^Jn750U;?nTaCc3v^99+Kma8#9H+qB0AvJ zg?Y(?V(}wB50RY`@QYm_Bu%_mjqQ(L6~Wm>DG-&!;Yf;@2+%odPmaGBQ7M@!Rb;h^ zP&WssfblF1j<;v!w9}@O2=77{0EuvnG9#8}bM@uXE_nVZ+$ak8RB1kbk^GwtISI?A zs9p8pFCV}yy52S_%(bD*Tvfu~vf(OwJCnio^oL0}6lD)y7w@LYIfO*mZ9*h_i|IHC z?u9N{6?r~>M36j{rFe=)48fW%dl#z)1M(%O@hOFa3>Gnx64);4T)V8KkJ=&#@4;^ikfACP!)&mp%!@*0 ziIGV5g(#DDs0do^xW$FG6WNvt6ccIObINyQvM?WVDSS9gBl&D^5P?+C(}f`_$Io4B z8%?5$>#CWfC|A27hlt^ydErId=lkY8rp#ktO8L$}Lc6-S*>LR#Nf4Ko`UhBY|q{4He|JGw6ZC=z(uJYn$Jh*qvdkrlsvtuWXnYCkasZzRPPT;QE0KICJfz-b4f-g3E4 zmZ*p1IniNwk~m_=71|-G=(M>dVlUOJ4m(PO@>|m7@FINW(yPoC!{;n8;sHmLb7R7+ zkyMc?U4q!BfqhAleM*qx@->T;q9b|IE{J}eZ%gQRlR(O_f?1sl2=GDprA-Mw_qm%# z+aV=%o^bT@P}DK8|ES%Mk930rPqD?@BgJ(ksiH(F8^zOWr(qo$v+5;qBuk`Ia#zCT zWDAnor^c2|!oB>QFsq~tOZW#tRwEHE#ut{1g!@$aV&Nr{ZtT|9*H1ewSyM)j!beIz zkyNyaG9*q4Lrxt(vy?!QvzbwWmG-+!D7w(qk@n&n%E#^aTvruAINs!(P=S_;EA&4Y zu4C@VJY=o0#s7&US6qrnjIMpyv2ZpKaBgHtv!9sQ8vgi_g)qa-gDYmMWuDBjwj6HKt7+jSTpuR?8tJ5&jy4dX43c(ulSk@`q)4jcMV9 z=AfnqaR0i{wtjZ<>9cf;#dM^l_oYr+~qFpp~!@Z0Ey&2p|il~4~ zEoTx5xEpR3Nr782cLhv8zg@ZdX$<19e0k^C*}^JC!3zCh+pA6q0y#4dSrg zn%UooU&XCvDie)MhxI1xoN3FIU;wVqk`=>qP8$g)$DBB+jb-TGx%#0LxgW^L{QNohOYgfdJL8nk zpY!GHZ_*EA`Kj_Zb~nAfGwp7UY2TNy%%@Z%`%bYBO`sWyMEN9OIz=C;p2Ue_*|0 zkOXDE76XWYH75L<%ze0yH>WrhBfPAHr6XV0qa?6MiaXL*7%Fn;>DTtvN1D9Uq|t>d z)hA{jn_SbX{O6DKom<${cWVJfMYpKnerWeeSg$-%kSNndNmwIf)PLW}l8$!j0;?D( zn}b%!qZ_sdt5QkXi3r#IiUZ=ZJRr2StXRwT!>V`xc#dlO@(RzuF!Utq+*8)Q_Mg15D! zu|@h$Md;k#%w@nAE&}BBEOk~!TMfBXmXKGU!P9x0)sJ%3g>qT?^*;pSaqet46cYmLh?P(iR#H}3IWvgxcMlT_1>$&i->!)f-XdQ36oF4{ym&_ zdCE(}R!?4}5Z-^RBLgo*ogr2VgJD(;%>yg8jR~RW`O~(EULru-DA{tv>(J3X)4DcL zo>9}SeY~SQyN2X{xLkPYq#=c%hp$Ge^KP^OBz5W4A(ePU4ibEN%CRw(qJl?@bK@u< z`DT%<0wa^8`gi4yNU&35CvVR+!Q0+OJ{)?1*-5Nk<6^oMvKM}YYWwV^1k9I;tA`B~_t zSs3}z`j`062?x(6QXBZbfiaS=o*yFfg~e1_P?RfpC$S)gm?{i8Ybzpl=_KPt=>Bpg z7rFpZ0tqPJzQez@>1qX_C}|=~1a*mSf+r#^vUwi-kYLkaiXXk0AS>CfPD<8vc|1w7 zMwM-WFU`DUDM^-6)LF4#?iAnP``bkR!%1yozOcPyh_ZPaCjfq4oqWl;Hi9YFlIZBuBrd>kPBwS8U z*^ar4EvoVRRl~dB^N?=)VkKRU5>yN9=%V;#B+n&Ektm@lUj&#)r0m6iN9qgbO8GeO zU86iC&noKGF)*_BXOzjOdeU9I9x_)LZWE>iBd-jcQLe0u?9@|FzdK5!ehg1C&D50xz+!Ex3 zbN+)vLZr6s=}+)t;<`t-t@$xUq%c8cUlKze>(*~XJjeIh$&x##U`BiiBB;_;h>xs+ zNb)K3Cwr=mgv~??vSe~<)cj)yJX17D96lcodd*QeAJ9t^POuW zarlit{>aE=Mj|ErDV%RVqLu&w7?p|S(2rdxN^%KD1gEyBj|UuLszvuX?%mz`ThuHT z*qAn7ND}6yQnrw?Qv66RuTC-G=q3`Z)>24u;)~}4l>{%d!rBJO8EdvCk}v%akqG-J zVLq^FS$pXcC7|Ly$SD{=M*x0t2ZN&M5pf9L5=*`(q(HNLXFY%w$nW$~J34Jb^ zCfVm-$IP)P=dbtK&lojdmutQX9RZ^)yq4v5U%ZCXu@zeF9uDGlPK(Ue+ z?$(Z34|`$q25zVajD5IcHvPXdx7Zi|u6lI>K~f0Dw-Iv0W-cU{<0AXNG6&`W52k}^ zz@7W$gYw>6%q=k=+ow`|NgjMEckZEe&QF*1ygG+N=$lm*S?7e&{YCn}xOQU-;Nsi!gV1ehpgM7hzv0cLpF&|F zoaBYJd4W@fbf1z(zzU|+lb+|`Kdrz!>G_rpaJ)-YRp!Q?Q-z<=w?39ZQ&v>oJC6Mb zIh^TISMu2%bHmvl^yRYTlX9c|m((Y83X4uzW3|>gYnK>TGT0Xaj#wx>EtA4{*z}S3 zN6slWg=g%*_=&x!Xd!ms7ig?nc3_KaJtzWwV(o`Ia7le_DuJ`?Zr!cEMo1_O=z7(< zjJ(zIxzj?`!SoA4bLN9I zUo1~cXF9aJpf`U3Hbky?RHT&%DkI-l8lsATL90XK6GI*@kGcXF7SFq71oi$FdAJ8} z-Vd)M>BWfoF3^%Hg9%#i$n7Czbgg>Q606SthcN>a`hj4{^f`c$)yth}MitFfP5s?S z0et;nG(g*ZSn|YaqzJP;^JSAt!`iRAUMAOvjLf#3n5eC_fmYc6A{RQZmvED6GKNlE zoiR(t^7rca*m5zsuaaDE@y_BmKslx|VrYz(DIh!GbaV$5b%5o3Y6hE5{ne-%%6z~4 zi0;7jITDKwXcJ%l9{GpYIn&&F@o^!vtq&_O7l+J0Y<*HN$~W`a#eO~K`|)b>fvJbh z^qj-H54UOTgLq$V&G>BXJLuw)cFfH+%dP+K`N0lbuglZR7Y#b(KU>`J%Eyu?hxRxd zs5t+PnoQat)7CKOp?%Vq-;tvc1R6#T(YP4B>&e^sLx zog2u&?w-)8s}v$ds!z`mE-jef)N3h7)PKsT)hpD*VbZT+r2Dt(IM>p%sxYYX-51N3 z6DuxMSCBw}l4Wk{NN3$YcCYv73ZyJOe3kOZ?6cx&1q0r`dLFAjl<9PBWBD%`_Tg8w zY=x@8HHGc8xDDCV;MVX}2Ai@9dAZP_)Y z#G4yM3LD}7zWj@Jcwe=2nzkXl8KQZlLj9_z5^dp%X@q=Px;}w*#i=S?J)P^g>b^rz ze{v&8mH1MHx`cC|aza%i&2dq-9)h>Wupx$tsJ}L`=8s?RU3R8|-?uQMJWyiGD?ZFi z6zmxr1ig}H={A~a=@Y}yIsJmbCEYebZwC__GuQ`?I>Xgd5ru;f9Lzc4sg|Q*Ay;B_ zoY7Z2(UrB?MNE{ujvF(0?jLW7q+QJewEbUyJlgZ!^!okJ+>D-s?T@oZiKD*{C=K7Z z{gqI$`ZCiF!mjx?c+y;f4X-A;d$tJKj1oax*f|JFeD0QZKh}QibWXKlEQtQV@L%xm8+dh`LAh}Jh+>fhkjA)y_T~lkRlyJ2p&U!F0$BK6LOjm8pR~r^M>fRs$OLt z1`xLMv)y@|WuXqTtFvYvAjL>+?=-I@u^afE`UwSb3o3x>pEk#|)Jxj~?K6t)znqKc zOO{VBUEN6ewvpZvHut>K>oOvpT@t2yM_keDu+N$^rO5OXugLQd`5f_;1SL~rCUgh- zVs?qtaetun)_DFu6Ufut%Y6;sg9>abXH&0ZUv9IFIa5s!k~-6`TE1LC_ZtgA91ydl zE+cQKR;4lXdz4ES*A5>(v#;;s4(&r&?@R`_<0JvC*()(ufK}n7UbHMKf^0?372uSi zX~pC+ir5#+zM{&3t@!QmJ!FwDBqAlm51@3VpsK^BI5ZuL`F9lN-Y4)&d8R6#m1w^K2K_?jueuhFb{VAa-Z)H&@{3 z6dQ-k9dB2LDn5+n_g1_e&harEPqwr?R?}h*Y=P~MDA*L7E3gvmvpnZ>bBsb|RKbK& z!w)2`_-a!*X|siTy_yD;4rQ>k1?mE@AvBS1Ml<`Or5G}91?T3DUl4@sV-y&@BAXa;_FA$&u{-=kjgR>bDEb?*B`*MjYP(Fio!W zB#=fioE|jUQ(>eYMGb{Bi3(>}~*ZchhUZJYRNFg0mwx!BBK9M5MQV8Vgxk6d8Nn6OUnui&jaeI@QhoyYF z8is7v?$=Q{IkVmdy*;8|a|gPOUZs(D!XqF?tX#c6vIP;Ab9%iChLn!8VETDJ)|N59 zug!ev8g&YDQ6O>UqkJ;}=|uoEVJKAS7>9gwWL2@8#PB;tvpl?$>-&RsrrqQ2l){f! z;yfey7Ja^4j`E`2qC3C(_*atJfxc5xXZge1(K5OP86=C2Js2e1{0|tIhf}uv3K@pW z)#DtWr_~kAW63bhYX~Oh03eUjaT2`O0t5!qc#qv;Q_3;lHGHbW(&OTdp6`CknO!@- zp>nn(i|<1pYiEo#cDA-EJcH@gwJBB90T@9~hAe0vVhNo9p zsd5YS1%Y|zE&u9}-!g&QST)1zPfmtjkjE$0+d-f?~Fn5z|0K68qx$}Iycpfcmh6sYl2 zHX&e#rjWE%6qatE!BeQ_9^l_bawlI^JgQ?hXU)#b(O&E$rrtmhN{pG9y(ZJGFI70? zfbE9VS@u+8FZ7 zY@Hm+8yRZe><=EnzpNSU``fr!aD#) zZCh6hDpR1Bj9H`>P!U|J<%BfJdCn)Rn3`sw_;u=M5$|%CrQya!xijRO6v?G%BGcl` zas@RFX~a1l1-e>ra?bnF5VPj~*k=5~=~Y{h>v7K1)@b^hMSI^?X#VWB9O-@j2-+^4 z<{RVF1n*_0r@t9Bvro^p4NFQ1pG=&Xyh&Mfz&a9%Ae?PN)`k3$L+ASt|#xQ2om z_hN$A&TB@jsy;jBXU~Yb?^3KA6LSN19*0m6oY{W{b$cr7{@B(rN>PciS1R;d3Jv1h znr}_+W7da(a*Khxi&1UE_Q3W5@_NkVC!F3t=W^;Y4SvF46>>N#{c6GKIYm8Ngl}td zDNSgFCK+;gfDphTNFJaP5-)|2tpNQnmy)FsoByoGwq(IIs+xOtosEr0YuukaAsPfP0tej}EG&z8v z*d}eIg#j|+JCEQL%{Zs$hPL>%>Pul;%=u&U&H1z1`Wq+C{ilIVF$g;x$?xO;a3G52 zxAUc7mebW})Y_ocZNF zjjZ1`d;MyGbB9G!L3B;K*t5v(<&Cm=iA=OX6u6vE z>6%0Z_gseo;cgX2)2OZ)XaALC!6(Rw-n_^iJqJTX=(kkzn|M+Hbt2nIh%K$HJ57{~f_YU4SJNS;{s#iLrv`LnRG=)J*MfxmH&Ny%v;7M+N zQ>=iupmZNB#H~Q-7|rf2#STDd=J#b!Ee_#ZGHYxYU-wvK|9(p8cn9R;z?Kov56>C+ zJ!%tXnhMo%=9?WdfPX$|@S&m@pK)HxoJ^)gUJ+mDf9E~ zXnz0GgVujSHRC+Q>{wc0p`=NfVUS9`;h{R0Eew+x-v9qn5Z8jvRH&_U6xiGH;?=(j zyBC;dtq0^+aECsX-q8_N;w&W>Zk_6na>Ctazp~`5kw0*W`W=Mp)t@w~t2|6f{d!Wy z^}Au^t2YGVd{>Ud$r&yf)(_VgxxV>wcc)2iq3G?SH&<`qnkwKqG9x#FL5j5Nqt`xp zoVbvky+3RCZ0SV9;IrkWhI*~wJ9h0WNuF=6u73QOAopAAhI?zuisAhtPq9CgoLp`6 z?k8$acJ6hB?AIkf-EOT{jq(@i)H}Mj@4Zi{Bgx}BF+omi=ZM#6{)HALxJ-c#_ ze$?X8-djjcW|n*!sI~?oE{jcX-`3|uFOk*MuN>xlhg;?;V(rEDEiR#oe1KwW=etLT zR!N1+#c*sM_l^w}Wz%XVzYx@B}=@uL=7?-4`be=XdQ$41e>AU<+;a>tE9>0 zJ4+@}FyUL0nU>qMk@cz{o3@*Zhc4lwk1I%LqPC2jap%=Aa7C0NyojB?x~1B8!-eXN5Vh@637G;7@EH zzGH!bTM}mgZ{S8bU=YE1C~{~!WOI?q%N!{z^5Ml|IlelJmp>fSRm1q8g>0##eP-Uw zmol~byNgtuLgtLI$JMs)=V<%}>I=)u=s)#?SDeVt^ZDDvoVDyJu-u;dd4(nNdYb;z zxPDtb@g1~ffA#zGmP1gTYI^GlGW=7(=$l2#Z17Z3@0dJ@>((C+egEE`UvgM( zt$%NCFP_;~l%o&z8~OCf;{)bTk>D;*)sc;B;VO_h6S3O9QAS7L67#FuP~*GDMt+9d z7>hgX&6lV7smCh8--sN14Em66aRgl6hyH4mdJKDU(^j6MW3wBD-y`X==Ad)%Q*zSSoW$*^p0Cv^*q zE&ls@Djy3f^Vgd*zn8f@BgZZ)9y@I+SXb}3<=-vL%nxb`KRxs_vR{A778v;kOSse~ zw+(xAwnxjGPQl#TX1ONqn8J>Rdwh6Y9{31}N^ z?wCE;5Q=NxhN=j_L?^>$XP%?}ab9R}})^!Efwo4PwSRJD3;LUK3SK z=2jhulb5=cyio{8z~0b7Z#Fio#G=0`3WT1S77zdpFb=}y_uOW$=aBgb;W7$@{UHFg0$P`iHdX=ZvxY}sMzW(j7q)@8;56cNcjL7r+{s047f!FwO#ENMSlH|S;| ztj)^E*Ac+osav2EPTmh7Z>7r?ju?2asEMG40kM1Yju4RwM#guB)B*pDA%XG&e%<_NtA#x$#kWW7C1W% zWf1GTXk^4$1+S>03AE*PG?rCc0r~TwpkcGGdcA6>+)&J?_kHl0_Y>=whLz$i9wYZD z1+^QtAZEVvEB)^1S~PU?`O*v2%ntdwKZL=`mcr592;U>&e{1I(fGZy7LVhS;fH!S- z`8$=snaxT&+KjfA3z^KnIr(|dnZ(w;X#c~VAbR3>t5Nh^ukscNq)JIoX$ASEnkD@~ zdF2u3`b0MinUzHfmT%6lvBYP??p77Nk19{3aGOTdE>+=%to_1!c#g>mkR$KHT^_QC@w5; zv)TM;|Bs~!k8`<(un`hZRsG3ROvN!`Q%6`Y_qfa{SyT*wOW7oQyj(mYb5=ZQ%Y1ea z;DRHh7eJMpMnlOzgEU=qQ9}`p9Yu~K@C?e3xqqq@00d_68hccs>RPM z(0+15W6h+<`Z1krE@C-D&cDmkA%qe}4d+5B!iI6OJ%#^(aG8(jUwr)AnRbBEvcbw+OpE(^clH%gVt zS67A&xSsN0G%c{MC3x9t#R4;<+3OKgJS8X3JG&tCEjYqx0pU!7^e?4mBXX#q^}hie zOYAv}#ew%TnmlD4h}m$Pk|si`U81UJC%Wyg#KdoP1Nfg{=|pDgc?^f^Q~H?2sP`e? zzvl8Gaa{FZ?jRj`q`!VUV^94SRHIiY8@E|t zx4OeRmV--{e=)Pc)WkaMRIu6*#hbs+AINQRr8&jQR}&hHlc^V1K--KzVINSx{t{N! z%j2jG8-oF!9E$r}2TFZGhLWm-gi%8xDTz-t2u#N zqUm8T?esfOvhJAvVSb$P(fGXK|3KRR^!|QU59+EVFV7BD!j_8R=#DNunb3vnKgGo6 zc862aZWr*1NeU%>J{VMqlpM#h8ydmsKN6lnEv+j0b;i>tX5e3x=ZtPp19NJ?CQLE_ z_l|~>eQ*9Gh=(g-J9Nv!-w!k)CPAC)sGx11Zo-A%3XK+xE$Bg*n5*F5N%BvLZ9BVv zqy4Zx*XCjJ=%-681|*n&P}lelrpH{$ zLr*l6lvIqk>%d}vbQ^w*eOeh&4uYO%XGuZ|EAK_O2l4Iuj)T1Lc0xq^%0lqFvU|og zl@H3%F;8y%is4L(cQ*T74{Q$tYgni&+@J?JwG7W>dKy9@_3qB-=h^3G4-EXc_Uj;F zrTt>GLmy!uTY^{h-fs@uy9n!ix24*7{b{0GrPGGRi1jw|u#;8dj{Y_B~Otx(rsV#{_B=nzGin za-~Y+7lc^8yvA3naUAYuDAHS{`3p zU9q}$IXqsontog5TeWJ<<7!Nev10x5mFsHC)pFLZ)tbx7ic;^4RqJY2-s$mFd&}o! zYp?W-mwS(V?f(3dSu?U`%rt$Sk!2>F24Ui7&6sT_vJGOk`N{0yCpiX@W6nLt3_aKU zWS;SL79BPLGpc`9^?wVDQ@@9U6(S)D7#I&cFc1x_`aBvqhz2X%0t~R~Hn>P&AVQ64 z{x=>N%Ci8Y#>0Pz6b4}s4iUhrPqcsde4L6IO>+rT)3abzITlsATfm~GiB{8U5{y^T zST%k$jHBs;%ink5Pva8k_&(P3&Hzi){r)tI{%oS@83!z6^}ZjGK*x1Bx3Gl7;eiFG zDb8#fXR0Yq7_e}F<}sO$1uQf!486-?VfOC~oI)ChnBt(mvQ2Rwrf~{QaV&`Qdn1mI z#(CHjXB^^~;#AW(K2sbku#jVl(@5h~o8m+Q3$u zaSj-9en{hd&lCsi`(2X`e@^54&=ltu)bpcHv-%yAzoBt{ZhFC{zdz#W#OLTV8iw%K zQhp$WpG{v*oDJpcFE_3Y&yN{_Zx7)I=4s)~5%^>T{?ZZn?h*KFN8s0m@ZGbumL!Jo zyJyh-UZFTybpKUo{8<{mJ2d`Wy6-E5?{sSXKnQ;k<(~=RpP5JZe}(WLrtz)KS%j7A^djAPYU68Qoem~1UZ#pzFvNP9i1E6aHG+OX?%t^_MGA8sEKdh zr8y7iEn=2PE7oG6MvD3Z+>6D)WlCP@gFwvziHyTP5dWK{Bje&(8OPB;!iN~ z>rDJa6JIp(&F_exGw~Zu{LLo*eJ1|PCcb&!K)Z==_A{@W_~t!{ohJTj6MwIXf2)aq z{mFg1u5-|G{mK2WcXK5tbpF{V_w8ECKxb^?LOEuKv&GJ)o=CNGf71WdXUPlYm;>4~ zm7cUvj_Ehi=?mo;cAh~`T`0$-n`p;EIVRsk&sZqOl$z+Qg>p=@iJpV9nCQDPe-k|) z^Ec7?nE%}deIMp;q8DTSCVC0xZ=zk8zlnYb^Ec6tVE!ihTbRFzF2(%6V$jPme-r%} z=5L}`WBw+(8uK^Nk7NEOdOhZEqMye6O>{Hne~&?L!u(D2cQAhw{Q~B1qPJlFCi=UW zzlq+4`J3qPWBw+32j>4(gZ?4rZ=yRee-phM^Ec5y!~9M3o0z|eehc$A(Z9j`P4ofG zf4)Ho#u&F1o-G#}wpMi2>8q70|Knte*xuUe9ANif4 z*p4WQ&FnAud&rg#Ii@3`A*Q&5hjZdBAT*^w*GC-NQF0HQdp8mUEW<5tHXr+BPxCRv zoesD7OCWk6GX{j8NG~7z`<~`4AMf0L{g9?pu

fvO=kyn}_tTzB$?+!lS@8*d=fAE3hF!;dndymu}=Z@4K-wAB5 z7oaykCd>~poPQ&*y{7?sOPJ_^!$M-C%K@z4K7lwl0{Bk@ z?=NA-4Kyi=&@R1vjJ?rzEU?z&nnHz0e0!-k16EObC;>K-(hVEDT0D2id z&!0B(2#lfDxOv*&)Ku0_#r& zZh(m5HaksI@>MvuD-r~hc~Ktx!E(LeI1>gfX|aqygCX-W^PuJS*b=8&$7vAtE?`Hz%u^u-x9C)R_;lL|R!1V@z?e*|^e!>&AKF~fg zj?^A!kJKLb0@Irh(3=*+`5}h&Zv;lQ53~o=w;jY|7^1%6&E_rT4EX;_+i^d~I$pV9 zwCVovE5A7T=&Q%DU7tMGd48w#@-Z&@==t||Za;q#&Yqu=(tZAYCUAaQLrn34h6S%Q z+0%Xu4Kc;xH`7XJd^dQSt_+uXptQqb_uD+_?{ z-M}xvxW~(m)E?gm7?1Z)zR`9pAGlt$nS6-w6X4O-gsD9IAw#t<&X2bCH{b@Qikr4& z47MFZyUl?1^ZCFG*%{h4qtfhvT@<%hm+A)pf4`j3+L{S!?wumy7*0YSFVMeZ%+YX4M689CZ>f0NI+iqtsvMFh%=vua{ycq zq>wFQoqI25U(mxSijWB6mcMhH;{wNYe8weqlmT>Zg!Gmu5M5RfU6CNVqCs>`OCq~2 za^oFSqVjf~=OP{U7$TqJtd6r>l;Z{$?byRc^u(~x<6^^lX0cq)e{tbGKbl0g+&77A z$(Tg8z$CKeom8^rU+Y%vO>2i1f8FxE->LKNeZJ1U_k}v&-YFouu$=8{Z!3PSq3*?< zJjCvr+P$p;GX00Ab#GfZwR>ARO!rTn+P!TBO!LFk?rqCqs^1NE|AxAXz0cK^?|rsz z#ojjC&K(^@dye!w_ z1-=L6FQf4f)|KtuU|*odpK2kpw}EVVpNVPV8PNq0-h*|4@wpVTWg`z&uhn_?y6r^6 zk0LUd;xAyh9yh?q@nf|3pVIgnhKYZ&-iVL>gliyME`BqA7uH2d3Y;5f1);zWe^>*s zdE?oqRIH75XqgPW+K=0@AGbq`V>9|wt|zm-#EG^vy|ctQt-HjDeQluLy>|-svGxT$ ziy7!yd>h%4akj+yQT=0kNgCXpvQ6>*>a}7d@rPtp3?w5 zr&Gw5)AcL%2JEEg5J1nN6td-m`sI7O?WAWXK+nz;vgQ4H-`;jR>G1;ecvHw0ESuL( zdUAmu*nd?K@-1XbDFauSfeg)eH4BmS@o`*kx1^oF@(0d%9>k=2=f$e6tqS#JxOvgz@u|-H44h}k90HQ167r(9!2S~_oV2axSstO=tvA2OKZjNbAE&z!0 z@lfJZ!Fnzk_&h6(CG>X(Y2!9w-@mcV;?}355_It z*uWIO7PBGQ2N3rh4@C;_D&8UB7N;^1D&C(J#fEafrzp0_>qhzPJakn6Y|dn2T2S^( zTE22BdpAzA2lHOEgh6b(qU;H9;SQ9GizQq7xNrwc<(gdYRpm-+V2T?7sxlyAF_zgA z)0CV65O*&RMQy-RxtPWKfLG=EP*H3EoyT;4dU#N=p&W>bI@I+CRDV3xpBN)1^HhH& zRDXv67ViUA#qFm0W9}g`yOBuTQX-)Y?{iZ+(hJi4_wr$C`ziRiq^=3L!badL)9!(| zw9ReFc>wh#5H^seC<5aoav2Xrr?|--X$2Yn$-LI?(myV#BWgOf67GRG*xZ(E2dGC| z$8>smEHjB5^XfyH>`ycq!VZ2T^AnDBg#U_2W-<16OaePZE8(SImFp(miM4pwtIr-ntmN=uCXn)7ME1VIicZjlj z>OFP23{%-}0pSo2RqYlKPH~LmWCMATWqAL+hgUfFfwdC#vj8~1_iTx?5pJnWyP*ht zMVa$8hRkaNu5$ZzMJV9Oyw}1sI_)~PU1)i29JKg&G7q2a1HO_82f=3{^9n2)y*~^D zUlf^F5T(&gNXL+Q1u+_(hjap&SCC+$lgPY+BpROw!Iwhj6{MKx=ZUl6dE!L6n^|zx zGN=e%h%WS6_*ezF%Eea{f$0RP5n?MBb0DA|cI?macf9L$p5{0Q>g0j5B~H|f_p%}= z5K|f0yg3=`$IC+twtcS!S_UwTf)=z#Zw$1Y#xMz5-p4QjTF{4hQ=p|!QEZ6&3H2G+ z_p9^CVrJI`4m!X>q*P!l<2N@aALk(ZB+gwSzOacU^2K&7|7s22yk3SKR2P{``47#lN@x2lZXs6iImDi6=6Y0wLn!j3j*SaRwAdt1V6w8 z|HXJBH?bX)bVum)Qul{Vd=>aAy&@ADBWfBt$Zh=+6f(G8LGC(kKu( zItSVi1;WGEl-ANEM0Rg_Ff$(#d%ZK3NdO6jX^>D@x&&nRrU{v;z*Xi02<{m+=`x!T z8Q|hOZro5>Q69!Zr0wC5jWYCeHb>c;MDk=28RtegR(xJjT0L(PsdUCNDFT?t6>owR z05%f!e!r{;?%hNx&muAlY+)V`u@xOfncV%QPH!_v%>5px*WQzy2HfH_7-#h~gOmu6 zkY|C|vSuPJPh7YQ<7~9|BzqqrQX23>@fHAQO>1a8{)2K)-NCwyx*g?db@@ER_5oYS z0b7^`5b2#^lX5LkHSVG!lmJxbT~`Fu^}81o0d?#CexZyyOJ_l--A$y@H;J^B#ra~w zzyTJ797yQRvx~=2*ZWvzV9%DOZ4BVJC&7<4x0RjXfApHtTKoM-8SMwhA(tl-`TCOw zRXfVOpa>as{(0at&6b+2d<%}5n{Oz>Ru+2G0eZbzMBZxUTiRH50P(kOY2M}r@T0vH zTvJ+6PQ=E1-83(AKIS&1+FJ^d(ar)~LI+8QtzsgP*QFC_9}AUxwus4p;vm}{P2@}5 z1V>XGQFZVd2g0`jgmg$$$MhRG5c;{qj>A`#R*btLj>rIseorEi-O(T;rWX?ZrRi8N ziT(|7fX{pLVM1YPI!K;Gj03V8U=OxCF%E`wq_;B`68*Wr4jdTNbffu)U#ex1EBRfw zb`eQ06PD)^$2cAY(RJC&?WzMf`vkz*ByMiYWj41Z*Tz?UXa%8m2a&2jdN7k%A+|J& z$ev~*dAAUWEOI+bUm%h%ZsD#p``gJlUI1XNrH>GaYiK;4&$8C0a&Mix8KmuX>2+Jm zGwRkomXKNd7D#CfWV;WbpGv5F7u$)8Nck*N2uXYq+Es-Ogf=Twq5j-Ew0N0T5ZoO^ za)&`S%Hax!B2ROn?2cY0RLP4|20GoFXovS^#sxXA7d<&`e7 zJMFLM)dLT)_SczuPxLa$9k)!%1*q)iLGZ9d#`aeKCXv$YM8bIUBB02<8>IR-LF&7t z-r)<1@aA|k! zyNTpk0`k`srS*5%e>4}$giS6ijb0|y%j?h&I_f9a1_l>ZqGV&ePs4ct z7vIr(U1@di04X&AsurD51WylB*H>rDo?61Pb&gJo7w@= z97VCI?Sh9K>{F262vF(XEGA?B^S3ytaz}uGwvBeU{UarNIN48foC9Sk1-2LEe>z0| zUsCziH77ff(B4x4s?g>G5pBt4yT>+zZ4`JYLc8#&ZPe|w^APJ++hW?7+o)Q;4v?^{ zq2=tmGJL(5%a#G6Yhg&)HjYp>EEkp!ED&ohpSgdi1vrcTbSpcz1%2u|fV1dV_prGw z*#DIz@Ku@7AXHPGpdbBbeCU3F>`;IC?I;ki?V+zk{b3u#@xq5uAb5U8B#43{)Fq@q zTpr65Vmrq+p3Xzjh90-m*IX!LTQ7@VCV8!#KmQ(x+r&fc@@Sj1ebHoR8Lh)9w9Si) z(wy$j`_(#ecaEzsp=~?AA)+`R_}KQIQfFwp_UzEc1KtBf$_J)UwGs4(z*S;fB`@c% zU$LVoGXo%URrE4xW!y69IV%W_I{|{foR#Y@^+a+|D%nVXChPE9z$-6IHqW z!tnJU>K}h=53YaS+&0fEIjS9i=rZ@MnEqSXPTwR_DvmGDDZ+^xN_MvevaxPeeSfA1 z&(b!%V^C?;>I8!7IZ>CvKUP&ue`Y>bDV?%Dw?bcuP@itEVp9mBvHSnn$$0%(DX|v_+IB%mT5P2KD+8 z1J*Kt!gm(=oEv#4+78U(G>EWHX=prtdxcN+lfCthI(x+w)lZh8?*gu}?>df8LHc*> zYew)zgfo0m9`@y5z!!Zpq`qFhK5~22>+6g7fqO%6o39&opyOfN4;^P+fAX!M@ga_% zE^~~7SxO`TB44Ws+f^5>jTt9eh?Hc5Kj8Q)m172yUToUd$4zwn52fvxthBjG=PZ*r zJCX8VhuHiEE?%9FB!W=31jmDH;kw;K+R5^Tdsx13CrR_~V428$kUSu4{$6q$%T;dO zvLU&RO{(k%5ZYL%I%O?bf67YM+Y>-2frQGwcn}gnbSZIA)dV1HXPL-cNT|GIYfC=K zC93*hK|F@Knw1J$y;dSOO@cUIB9TvVX^!TnEyV#Y+u?;UKQvg1J>98JkCn*YM4bC^ z{`8|7U8>Toe{vw0wx3OPqE2t8y4}M;Hr7WQJE0Qm=+!MRB}0@J_oXc_CF9t6$9ND} zbr9xO`KL?Jm&Cew71Ez9U0ti^wCv9!Xxd2se3t4|EnXKG~9x;NYT&j5@~ositF|>NsIY$Ga58_ThO&NQVjP zT&MZGHvd3fPXN)i|AHc5*|a$?=g@VNe_0VqzaJ^*TvoEzf#^cnLdVi(`D*82{d0wF zY*=MJueA}J*MGpVjy4D%_%WTwZ-nsPQeX?Q?imR8m+nUY#0>Pu8gqH>nj-knrX0)E zwT*Hdn__?Fut`{Ul+`n1nS}UQZ`e=W4oTi#2GYFoJ@$c28&J!6^l zKF2sxfvH3}Q6|p}n`*~u8wK=xiM@@$3@osK&*2H4Et;r`j zrUP{Vz(#s@gM@7YF;G_Y;=ZUt}eA0eZ&P0 z9Q|BE2l^)f+by z!On`u(h`^=u(Y2S;lO#Aynh>L+g)9Vm0NCA`z-p7Smj~f-5hj*oyZ~wUG~XDCLDC7 zrx2M9k;%h?Fq}N?45;!PG08I?zkiNAx(sHy%xihtyG4C1f_3~!QChJMHd@J5G9CnV zU1AcEC(I_&J}Xp_C=m9ALlsy-fL{=)I}&o3Vj`u^#g!OopV9OvGLYj|*IpCQKR606DXpj@cNWN~+rP0)<$+6z(8nb@-c%GD zV%kBB`$$o27@jfNyFNF%7!NWDgRb{ErsEU`9gLmG`+4YMCKI`dhc2!D*$$_ov|i-E z(H#akO({f9{|S-oT|}C_6w3>djVxDLvt>i_K7ey&$z**u1H$B)L=JG^;7Gc^pNn^R zfbDGp#-9se10S*=v{Qe|sq5Kc9RnAY)~yV5y~u(zYG*+pVWLa4g2bXt()Wsgy{NQeonf7b zOVFMYI<}_3*5S%xj~G7vSw*qw`cUoWbM!Q{pN*EW;iA%te!CqYJHRE-_W;@+rkY9W znA}ymiAe7GTHC}i6t+(<{>=dy+v)$jsI)dVgXBIWN~Hjuc?_IQbKl-VNWpb%1MqRf zaqkY0(gFO9OF(XX2;{VKcijS>)DsJ-&yOPYr7zerJ&R!;M2arB5KeK-gghAH@j&bODd#L@Tg+Ukk zT=cJ3IM%TY=f7c))0#r$wtT2M%!3e!BXVDJp$rynPh-d1<)cr9j zHFSRnax*|zz)mEb*TN!bIhjD@w*k8PIeUi}SU>R4Qd;hI z9#E8=lPN?#X?lkG2zp*XB-R2gIEEuJ;;SvW9F`CFPP9k!*1-hE7M9Q;3j@wG4eQ{9LAJLYa zT5hc>u#olpBS6@YPNWSYWS1op*|&s9>z06Y$_ab6M`)O@)uk41U!PiBHW`Z2655jY z#X!}D?hVN$09Brty!9PVgMfIRa1b!Bw5K7b^i3ii$b)S6AtD9BAzNLSMgRL%5OSlS z%Kl9d@)$UZzA62v-QUMeQ0LS6Jdp|Ho?t9cl*>cayI~;M8OTN(=nK=vFx~4xK)ISq zv5!jV@XAW7m`)@SAV<|Rh;i;EdViJZ(E4v}JS(z9?!K(-Aq*UaD+^_aA+neZ@*LVe zupIU}5Y#?CR-F^6VLst9?-q6^1CXtVZf zihz1=x~8ajbI=a}RE@u;2sqdGT8Ui1LrYT@kukn!B?x7SAbZNwouyVHdlHE(W)V4q zhZb)l$S}C*I4MsX;n~ugJbPGu=CKmlok-+nE0H<+EWO&pEQk@}Sv;?Q>BYYD|TH$wfs zaTf?Uhhkx3*7lfY7q*o=%l2v#BPOFRnTGAJsB0*L?&CN=L*1f2?L3Ku2ELdnpIB@M zD1-)xWg0BSW<8r_ckd>W{Z7a+_w&a;)84J?wt(e(`-;+vZKvR4We>Ko)KgI9xeWw! zx<7rUw4&ZIty^6m5?vdj#W$Ty7t#8=lIXVd9zV$~}q5?eWmXMiIF{ z&4)-_0nW9dib)~z=?I(`!Z|j9$T)vc=ZX>Py2iOa`V9Smw=T7Kxs}NIYi}#|B@#I= zhKY1rAQI=W+j(g5pxr=3WOw-#XXzv&>#|@w4V4FV2>kH&^N-J$e$Mk?JHqysI$87a z`a2%}y}b3Oe%qG3v363iE*FbFmg+J{-UK3<<@HV?vO9{%z(SWEr_>%CN0&*J$4;c7 zcGO@gMwwKM0wT2+K~B3xvxmlXkUddE_M}5sX*!YBc~~NmxleJX;tNjCNdNd3CpI=wPPN>`rJei zJn1-|Pv}Sko8OZTvi*wEiupP3f<5liZE_a5z@h?u1oE>rj6NAA9*0U%=TD0?f0j2= zefRygEjg`rQnAlU}mPX!@$B~t|pK}da73!7*>&rv03@eRd>c^$f}^*QZFlx)NyHx%23 zaLD#%5xH>(NTs`pq`zY?Eie7w@{S$-k@rm^m73mHcp<5=c)v>D2Vh_I zP;&6v{fn24wfpXOlx)o7ZCS~|xMweE?`?>z%g_VDjSL*E0oT#fI%^mZI1mJfP_m`(oxdiZJVjV)Go*Y~brh6(KhPs_vK!0zh)s z(>JuePs8<1T!W=}fvGPv`xD*fnhub9-R?5f`2T2+dF6IzBh4otCKh_sc9Z0HpV#_= zR7J5}yIpHb*ru=@VH-M`qVHqT+R)o6TANNhue4%W(GJmnTxNOy6SQ3i;vT+wCL08O zEe`#OeVpc7+zCW(=b;PB($6s+;{g)f>Dt)Amq6rjl-Ek+<>?@|m%E+Vf4Ixjopu(o z)o}*;t7sylEO|E+0rSQ@(_`|la^c!oD(14%igEk*D0{rxob#BvpN{%E5wvk)8!!W} zCxL+Sxg)83DMW4$A3?s9k>v|;pD*7@Mw9Q%B`RNMhjvCKB1cOWA|| z=&v`lwIm$ts%y5l6B)<63$AN*wN71YQuiixJ^|3F?@hvf2*>90Ky;N@_^NlKK;0LI z?e-)G4)k3CtYaSjU&JtSRx-I(Xd+?Tv zN~^jL!opXbIj;y4t}5B-w?H=P4C_g+vl0tb-T#>)Y*7?jn7*I)yds3ry}X|Dim=?m zw?GuMOoed2UZ2cF5cK$I_+8)on+!r2-S@j4zbBaZNhUts>&xJGeV;FotCs7E01#dX z7Cu(pn*(fRMHuRkb(HP^N!=3_1x0F|r$AgEOXijG5L+5;lh|Ij^Ly&PD8`TRO0BFP zz|LeJ-+1xc7Y`uL@ zu@MG3aen+=5aS?4nC4*k+Qw_=aLD-K4!g(AOyS_Xm5y(hPmYT{+ILINzn(w@N?Tg{XhTttR>y81{ zcOWL}4{=XjQ*3%3k%O8qHa`y^RBXUQ%X~$#VY|BrLkqOrjbRM5I5A9smN^)vKub1; zNzjrt!g}Ndj&bPkdbG7i=y+IGTHWIyCq9+PmpO2>g~O~s1PEM({4Es{E4#x%a4%8!;LJ+nL1<%{O5i})&Onaau}pH) zwHJ3d2qV?){Ig1Hqr)bNPdB`{r}Xxg?JW3f4}rAfF?U@CPwMR!QlAz@>OC*mGE19p z&3wE^Uz@QFy?4~tDFa+m$9521J3m!gQ6@JF0z?uiz(S6?cO2{IO(JRU@tGf|u^`~s z@R<5r6w&oZ5M2k*#~#i0yLoLa!N`ixqbRnyAjb7m-&*mRCi8Jcv9*F2_rKJ=^1fTEBff2&vPcs(ie*Z({m*5cZ`*RY7Fl`u$Prx}uD< z=pb?$Bf8i#&8|IhP049!Ly&s{b=*E4y561&vF-<7a*+r3R3DrKv76F~>}_a&1=Ha; zWlF}uWbdHo_>XufO3V0D@^l`GUYrDSewgU0WkD{rf|L)UYkd|-Cz2r+b?JG?npyq` zNWLvGnJZq1&FqHU6DW^63uMH__#PLL+&cem6MvJ&@8_TcpQUA-NXBQS^Fj7lZBjFc zuEy_2${45Ax=ihd7c@M5+#SvAI?1sP2FJj66M26abb02hW5jcO61hskK;VG$10%ZJ z>CC)*o{h|pf+F;V*bdNl)csddrnfm#E{(IPZA5Du@4WtvPZisqd?j)FL&MVt!q^Eyptw20{-w>dz5hOYl(K4?>Be6+K6x^|z( zKxf*Og|hD7)b)iVA~z+2{N$%fD`L3mxbss*v9;5+{|`8}<21)Pct&)Ef#~Yzc*jXb zbWQryc)xdwV>-9o+5=*todwy;DC|h(&)4{9J09yY zm5=S;jblJ7$Pf)(rFRqgzHO8|NdApU!rO8Cy z|5Iv;lfi-D`$TDNw-VXs;##)H5xFdVT1%-qCV<}M)@73Syrbn}JdyK&@uOePhj70q z4rJf%FuCllFxh)3OfGHKem|nW4;2qEEo}e;>^b`Tl+P3a&NLruXTjgd!T?KuxAN^P z#(t8wZzw|k2<6YXq6ihHxZdlEFn0tUa90%Jep6g-P!aAJMh_=1D?+9z-hs=SOxQ-c zK2ch+%-A-1==**1`Q@IOt*h&1WUh}ifTL+-M$1W#>F}h3jQKP=K*ss&{y}Ar`dpmR z;+YC^KlKA=(Z|HA`(on$Zt@MfUV`^K{CwBF40P^1wNTb|@oW}F9IA_U^f!O}=n9STdzAEq?kl2^M zwLWty2>tVkL;%i0`;-=UGRXFio^=JRpsq^_AjXwIV&!2D1k5{hFPEDIdASuNbxeP1 zq1?X$$HVHH$N-LuJr(NwmcB3ko%W6&k}LNkUNn(N3}j>eK=aH7(S`Z#8r1eFdbu@G$!$DU$x-g*(lxDP6cv^7pl{)?j6n2$7F5=JXi+DFg2vO$bPUbn0W zzgH9+@{!kTe0O0xN{@uNc{R7iy*ll{w%kUjdX821lePrD0y4^>*2hkE~aV#YsiP%d(bnWLE|GH?{`aunm?8_ksKGZP&7S307KX>o?%yA&}&qaGBa^HL+ zVSNSiiG+1l8V&N}=^za{K$ag-_hMF-0tj;;vG7tpsB@S(oHlnsd-p^W8SQz{L1eW1 z$J2=ZDH7rWFAxds=43OG(1utZV*6hJNqpE{ z7YGMGGn1(=0j_expdyqkf~vy|2!XEw!sR?zwgYt#ZE*vP6*BR* z9S9&wBNFOP+B0zy!ofOa4sFepJ(m+Z32A6(0UL6rXXX^i&JEl$+{sRCuix|Cdn=KX z&~~2R`##V6N1n)guf5jyep#3A5|Z`T2?@$0n>kmgP39?Rqb;SW48^#$(6cRKDzgz< zrll}7dJFWiu$VeNDx^+GFzBECzN0^roYCJRs)o-!z7~4>Ow%5)YSXqdBUWEH&Bi=2 z#l88m^pJ2tZphYV^W-KcGt_6Fj2f~h!n<3e#P4Hv$}xoCau4c=pQDSRub47zE9ti# zYLs;RJ5wf~8py8?R;S=uIavXJitJVP344F$MojuBKLFk!7z2Y^H= z!G$U6Hy@AN^2WM#it=>HB|~*@@ele`smggystTg&pbv1m@^x&1%$8g&v&3#lu6kS% zCpkCtI%4YeJ*3wWroXoV+E|ioVV-{fA5*{I+rYH3B-6e~en@s=(mYeY{|p$~Cb%+w z7qrK(I=Hh^k|N6%ys|R^TVyc9Ykp|X^|&+lKpT`0D#sP^$3-({IPae>lI_e}Je0Ly z%iP1X3K^-Z^zAh=?Tp}UzT!Htpo` zrPJ+X7m)m3TdeLHnJw|lEHNq-2J5B5X}0omb~5ui4^dy#Z@!(p7|x6BauT+5k1IcoS2b(mml*w*E%lF@if6e5qvNQEIpM(;A?(o>6>UJiM@r7c!B z+UBn#drCI+80X&1Vy0)MvY^B&kN%$Gk|(~ti2OhkgsTT_Cf`VoiFf3q^ZkAa;JKWv zs=xiu`*h|&Qj*ycSiXGqBv;6f9}%G(CtqUO-!VxJZjn)Z{3&Q-t16QOZ|piD5rF90 z1tC6mmMauv1+4hi-_MoIS5_waJg71F<*!Qp;}rLnGqm^3hEl!)?SyB`JQPzb)nwU< zg@o6gFz_04c^Bny%ihWKG1uBfvEd7GmMkN6{BrTEB*qU;a)oRZ;o!dlZn9Ol2F1%J zZyHI=L!(5#{fVzHQUTWjh^}(j;tnU2)@5*?SXGrIT=yD&PmXtSt{f*@@D#K|oO@de zQB3gmi%!M$XU*IV}Wa<&!e z3*%<*VVY>!tV_nu+13_AuH7)~jNb`}#<}?)Up2Hd(*kXtF@I+6{iVEe z`EsjPMs7cNZVp|T$Mla~(2c$O0tUn?ri%gwP;Kt-?3{1RBSiD-ujb~tb9;#=AO4sA ztDr`yzZvt)vj8qX(;OgMX4L8!p6mAF#7Tp8%x^a=af4S1Hut+O`MljmlN%;3NYqLD#-s7B6R>*a<~ww9kb9_k!h+skSVXL_@Jrozz5}Z z)c(j6S3(Yis6Dl%XM-*n`~45gNZn8V^3>Mo9-+E6Faz3mIQRZJ^1GdLZy0znJh(6= z&Vf$8ioS0$WBL~Z?5dPtJvZtY&VY6s=iVXd07-6l8`1` z2>*{Idz$bk+=&JknHwnkQwKiT5n|9L7=92Dbp&UMmsB@8)rOjgw_d9e1;6AWfjwQheJnO zAx7vKSVi)oZ99A|+jbb|yt@l7%*XGwLFqcpdv}Os@t6$?jWa5Fg1bdyjnr5pC`aiy zu4_2ET88q_X=4sti$xua@@w$qY{aM}8Q<0e#nO+Mu z8mp!;%YuZ{P{oi>Mg6hZLg;;G_)8h7EO?4@?|u>E6)HPBYMuXztzufsqc<%Y6yYj| z7)Q}AUu>1RkMZVnT%mZgISlQ8bMBp?Uzl^>W1U6K!PTvse`h76{i1nZGb5PiHTwkf zyk?6q{k-N7pfCs1non+Z1A?o3leuP|fA(_n;r;!`Eq=bsd2dXz&M_4+t=m^0c`InOlF%$z11+xIV(U@~MR2$5Kh;1it|5rzOx26qx58Keg6O8uHdmVqhBu zJCu(}x2$!My)p)3L1wI33|+J?VyrvL7@w%qzihHMG_ZLOymb4(R5)>BBn>HC+Ux=&iaAB5^2 z&lv`-{Q@UtM(Pf7*BkMCgG!zZ`8!OlMR#a3R;W~FdjOGgV( z#Gdyjf%0Py6eHAE#_D$1(Fp&@&J7hPJ|-gBS&Q~XoGU|axCa;7)*Pt);&q%2OVKF) z@UD%=rv7r|-Di!lUPRx56y`$D!XC-x3f~pr={vPGS_XBv1gi1uftg=0{$_Lh15>L< zhJM#EGPrrpn((}ir;p8dtO?A!|LFkAl7N^7gk;7I9XCLyJ_oJ-sqah~)A08Q~&a~4Tn3n4+>xAa_qOn{?`^^q>t!S_up_miy4d1=e zJ@oEYWB&Nq!oi(cH`AI+QG@rkM$f?>S!&@{19&n^nHB?TGJ+b-ES-L?HU|sAP4Gyk zc(3&1r`!ZXcDa}eLyeAA3W>>+CY-xZns5?+1S^eCZAo83(ihP2Mw5<%^Wpx?2Q4d= z1NU{mtw9kUjKfVJR z9H`;2$NKg>BptH!HiMYP)HK(!jO}ai*hD8DSDxM1WzPW z2E87eKUz1JZR~PD$%+k&Mo(>xj@@yg22X4bT=fv+%noJr^wuc-4xio{tttv{%zAhE zc8GI>yF|3ZFSu|gw5qu)Htx2W^-h{3v=e?RR5#&xM~Uk53;4iTL;S1hYlwk;=AQM8 zw$R<2hrGmsm_N6RZR`!P|G%tiPS(1=-V4AJc@{OwYI}SCo%d z*il1cx1Qv^Ir$yn+`Ho={zr9-criviEhAhdgZ87a#{nrx^!H=FTb{!<4t)m->qdyi z%}8bGuz;F_Q>#Y~{H|l9bzaBQrf%N<^r88VHGq`P-H|ZrHuidq$5cz!)R~5?os#T9 zk~P87lluSve2RNJooGJ|D9Zhp z*RdfH?m?%pCOgYK6WMpSS)b4U9Vlc!GWS6_Hnn_Y!z?uVE!=W;gzN|LW3`n>eRBMd z^K5A9>m!3VvZn*f*l@kSc3i#3vbX+A?QI$08M}vRm2*&|TJ*c;VT49om`3d=7Jan^ zN*H$6SeR)H1(8l59{w7XvG?xOq^}`l+VZQ6zH|MalZ4+ z%o-#6(OfOFnQ1aq_vlilZ}AWM2E{7paj7bpTYp&I7OV5iY)L?7i4zin6laMdlu!PB zI{t*aiZUnB;fua4M@fA3lsS*rxeV>EDo{q>zf%(-x<=oht8EYwAv%xUX{_VC2zJ#a zv^r|(RaO#%d%p7Z#Tg$n_E(e_nsYf7hW~}uXG17+7bE?QZ+Tkv9hVKg(Dz6fSXs#Q zyCn?VQng~yasiQgL5jaCLa7ko>Vo77!x^a;gm@pTOm_RbeU!HxxEG25F}Yt9#>eh8 z_h}t(g?2Iy?bHTnryqvaaDw+{eM~#v%CwVlrk&crw9^kWtr@FpGj68!wG=HTn0APA zWce}5NU3fPSx@x`a5?33~RbU`c zb@NCC`LM?vi@wOOHlEcK?6H+awV5zWl%s4MD|50u^Ai5Fa_%Ku z{3vtpvVQ;C`hVE^{}|`qPk!|UV~SF|l3$ny&Axx9Mls!>=yz@qrAQcX9b0&Cryr7Q zv;`XJ{teWxn`sS0Je2V<4FYNkrnvX5U;c3&749vn%>>C$m5ukUw{Xf_iqo~6dvoyu z(TjN4eAJd>E7v=0rg=qGj5sGS!dKy-&m#;&gRSJpD?vsE zzwVY%Ouj5*M^e5{NEr7FEP*m6*@D#9tCL*$m~-!mricdU6@%YeAcD<0GF{>xdb*n{296BT3cPor_tHG}u>sH&~uR1R??>eE~GR3_c zL|f$8!dG^_dl$45@6XlxET8sV1488EC=TiJqRv>;c0&92N$$<%Glu_u?oZ3bXLms} zWX%t)#ga3uELu$bWhis!_}Mzey$?LgL&n}+tAF}FETgy*YzY%EAkSmEEMUOKm`1u^ z4qLn%P;5kxyP)-~_Sba+?Ex7n)g9jGm@;6{m?eV{Eg6(b)1$4>#^TUUZh&^`VQ8m& zp#5%)_l~wQZ7j~TlN*?J>S3mx?qTQijvb;Hc`00xtlVY#nhj*fEZKZ)3pjhc7S#Q4(*P;tKmcH}+WdUkl}88H_Ect~GqtDa$v!KUcebf_t;8m^KD6 zGP=;%haYcsK?xXfhL9xtPO)6`Hq}>e#PsTLVB4d{diG(M>)EXkB4gHiHpNuskjH!C z=2~_a$?9E9`>|w8`k&&e^ZA4bYDF7WAL~ zJ~a0j?>*joQ~%folfPukc8F30kRsG4*|o!vBB#I4vQ(c0!FVfX%fZGvd`D zC}baR`6}EC0GCm}Xq7(+8O1?keb{EK50hQ_{S^1+^zvUOx%c>uW_`o}WLJ*ndpY+q z%lA;uwh^j3m$$8-;NDii<%H@UmxSOgfrGvwG3b0x3I_dEgFe9Jx?Fra1G1}AoDpxy z$yd*%^2G#8zN!xW(SGWM5_2v1{W~>N#t!Z5hUluDpl!&J7<8&b9n^%$54xIqq%9#XonM`CsN5C^@=oliV9DG-V)cWzm&-?PALYFl=OScJ-!6t|4)1ihIvV1;Nlc?geay-ro`+Ut;P!#XLLi{$slQiVv9Kx_Do1mCO>&u(>D> zB3(Xy7sWiU?99GDSG!xZMScz`LU~N=H@xP}NpsI$z?!Sf+yf1Lyrz`+V8!AGDjaJ> z;CwEbaTP5dJUM-i_WC^jPUjWnY}ZY2?>}Xy+l`N=xOedM zR^vQX#^T9_$qRP&Cuh00RDym7)M);EBiYl>f-ueke0+y#Ym3iuZ+0ouj!mr?q1*s| z6lV)ilUWLl{OSycWoHIWdD-AbBgsonPmiACUec{f!PG6%qp^+9NXIgH`(FJ}qbFwD z`?LQA`pJi(o$7%`er`a-juW$2^;4{w{Vz;E`7qN?^)QY68Y{@@TIIBO^Y3%^!(W}+ zb@uW!&e3;M_EH`A0p(?|M}B;cdvo_Xp4(vSZ_M&u!uhc?l!GC@{0vtD=Gp(K-#_T% zqO|C8dHb5IIe&Oe{OgZ!1N8jy8p2$mxGpCXOU|0PYmQeN&vNf^$!o*_nOn@W0`FaP zR)EF{$j&5<)h152N3j?W`GF5GXwqnr#T%m2x^tJFU;XDZycZ&Bn&+GKfQ|J~U?Bh8 zDZR@-gL-k@$xvQBKlA+Fh4t-^CBdpeC#HAPSa#I>U>-BhEzx)f!c1E+hiwc9P#y#Z z2E$D26JgYxzc7xuRyMeh=|ii``wavZNYO3 zg`}V2(U=IshLL^RAWFu!2La`uGrV_{b8k#EYnoO}nKtfbeqk-ShjZm;8RM>KV_)WP zFH?`z#8nJ_a^dcu^xbE8FOyO8%zUQrb~CNd$+WD1nxRwXe0N5GG8DeSsIi)nJZb%N z-U|seBxAeFrmu+-{<-gV3)Aa{{UXDAvr?IHuh&3^_wII^HAnoD#yuwP_pP`8=k#3K&>ttp_$iHr4}M986nhtcl64rpv4cwiGd~ zo6oLoo@37U)vq?!_b$-upZWs=UJT@&=gQS6t^m_VuYxW@9WFb=d;K2N80WGi1Rt2s z^o6rg({%^a>gS>T@e(NAPNv1)+Zv_3JW~v%JIM4(2i$@CuXL+UXkq`sodG`@$0Q+j zToQsANlI_=qfzvrEjfx#SGUyB zxRlTDbs&`AhQ_0Ir>D5`sU!yXp)_gSLGTo`yG7_RC(~XMrR0N7;+GhSIib}Tpf9^clRTr%V z*>m;sbM^ep^Tk~jPmMdGM3bk~5Aoe^@wV#@;_cv0;t|Qh=?}P4Vd_IPZS2QEaeX1$ zN4M_s{UGn}v8}s&Kjqxp^%T=`@B29S677lR^t=@6@XMTgZ-wf9lXGt^RQKzgdw&4c z{cFy>^q$)OPpfv$k#|V<{;WME?%bY|<<_2(W(daqi;HzAV8vIR5aJD-E9^FFtMCg4jrKx&| z<2?eDo=rW&2Mv2IjXMM=2bUT(w2lf8lDli6H|KsYg+6qP`3?}0eYZgG6)-^dpYR%7 z%1CB>_3)0*kf3BNdw_D<+dj+pYorTrHl9STp~+Q zqvQh`PS4fMeOv#}+WS}$(}sXh9}p5S|0_hl<|1oPN5_@MUfn+jrwrfq^u;(;LYlVc zgxb*m?Ds#?T1iL#`Tmi5NO3>O$-87Tr1;PjSC;=*rZs$Urxt(|Az3i?sr*-Co*|j5 z+5e~D0n|(2xtPY(#(-xv)5EdS6iD_a!rQ0&yMg|3NlGsi@Zw?1=Y23HoR5uu38tTF zf?fc1nDc`EQxbyZn}z<9lAQLhs7M}{gtRCi)K$eg0%tl$qybE*skYS3=2-3#l(bjoJXu3pNx797ydK3ghNJ zGnR;P9?E>q5)DwJ0U*Aj07~X#A$7V{Owl(I;nPvRCIBhE&JLwqfRUd!*ij>!wY8$T zee@KI^Tk5KxK~@0lMv+O76($TGD{Fo0?XhQ97ycCA0G;wD`S!vq`0VCK&W|RtRoAA z0-HLwi|d;^R>&xp*9SVn%Q{E;+A54W0*diSZt8_X4~C?)b|q z;dW8(VncB`Jn=C=sTVx)F&7lS;ECW&=g8IZSl!L>Scl*Lrti3fV9@_7-`N|W&t5R> zBl>TFGjdXpU57u}JaQKHW|b{ar4U#hU@;v?K>#<=opOqW#ore=_Rs@%>bAN8Xc)gMVP@}FwHTo>)-jj=&J}!yrQArLS2SVXZn@0qP8qGjVX4@+2X31Dm zE+g^jEj7vfv-=MUrmvdGxtE^Z!MXPjQen_<{4Mw24s2T@eI>P25>p|+8eL+Zn~L6d znX@W8{x9#%*)IC`7n|7jnFET}GvrEzJIdG0>S%qr2{Yrb$xsgd&F1Z{!E2Lo8%r%} zYwa-fx?|zXPi|t{sm)I$DE1>{!^Ggh!H9PErp?>GxruFG&~|snenE_XO@MOvP((Yj zY4i49ZDQN2+uAzH1zS8ULLogpAvuC$l0Eq7kSo>QQNE^Lu*D?-N_K)Pw!zBeH$RLn z*(bBqz7L{HIBdolx~?HtYF0QH?!^C zb`)nFNG*aI4GEq|mnbB|o7i>-zMMJ*DOn15PD-=W1giu!Di2mB#Q~4DMP?}}QStJt zKw=Ey(On<7mq<^#^tXY5eWEQXZHws7$}G_e`KYwbrH5r0u^PeGWJmjblU#|~Q9LHO zgDW?0-hNWBCEqpk=4kc?rhmm@u9J*Po?up*oo?g2cZc2dQ@#O3TOyT2yhUG5-BEzX zJ385R-+)J>c5@CzG>YTKHg0_Rjsm6bKX1mWknMXMKpWo=Isx-&=~)0^T@m- z|0Q`^uqT6?HgA^(1Ic#(Via(PrCF^fq}iEl$5tc^k&1~&U6{?wz>2jcBBZ#Z=K`H zBQioqH?i$6$Y}ib5^w5-M7i53yOR4HXq+X_O1^-Zk=JB2hQGQtaX>`Pm^3S$l?sC` z$D2ARHxI~Y+{1ZDI21_AhpLic8I2Xpo9JR|69ET`yO=l8(6E;9Y;0)oCiY`yJXQdO z`lB(rCwb_&WDioG|G~NU_?VEg=0}Y6(y_MYj&2A^ic?~Mi|jii`gGvK0Ov|nI%C7CbnHnG`~zdPFm|);Z2*jpAf|4UgNB)J)Qv+=aUh=HBfnUbbU)lYqj_z(&y)7 zB(}(CuaNO3>26jM)49Iho8$^Tr)TFl_r`5_^Q2T5yzf&UdeVl*cPNMM?H)GmnUKuc zvg{Q1?$|7p*g5x#|8Dw`Dw!oJk5nXWP~A^JjqU>4<4~h_7b5X{sL`(#tI<`(N#7&I z-}80b&MdyF8mY=TNS!)TL3T3gfa)#=Ji8#qRRKyp?D2ca-yW$*QeUSfF_`udV}2)Wa4}PI99!rwGM%q$2rT$2SrI*j>9jN)v}f zglN3oHYn5w`SE+8Mqjb!7^u&#Np9o-qKHtrAR2phsh{1{kBnmKM>u2t7S5C=woLLG zf|b6fzE&2i(SPOKTVIX#zYw4ZxYcZnvcw8wuE)UreA{1h?iCzX8%J3}CS9@GJPI{> z0&4US=Uy5k_cy(#7-Nyl5|0thp+=8Gjn)fjUtX+69mS9MwiNaFx@VnPTv?6ORdbNK z??^?`3Dqr994e~OacM?yxs2j>LGmQW{XdOt9IS*Qht_IB?AwVGk{s-WBc7ZGC0>Y7 zli-SHBq-96tCMXV-$<<6^o@iRc*XZC$dLe~AjRrUf-N2lKyf;lPO-Yp!*n5bZDI>U z;~p6)(F46<{en81gXyC2?%Ro5WTc!P829MzZmX!Xh1P0Autgq$&1DODHOHbMpYT<< z9cR9gkSD&85YLY(2D@Q%<;HzNH0s$J<5Ax@XpAXFx*@u9??h zraH9Gyu$3ebs5~Uhv_Z;13ns`#_qQ8qH%Y(Rn^IP2(A@2q+}2D=Jmlkp#hD=ABTtOa_rj) zmklYG2l|#xjx{URSJx5$j~MioT?FI4>Lb2=%iyjLq5XTMP#g}XhaG4nIyCr)eET2- zB~gu1n=TnC!2{hEyEb84UuDo-wrKH~jFjU%&8rMrv=S{sCN09%2Yn*ZqQJa!!wEG? zbXZYr%DU5WYr;`@Yhq>KknboQkpOH#n;;wf?-b-|{HHM;4QNctCT=udJ}kNCIaqQs zXA^9$TNVxZ8omlQ$=?1dw13NG;aqLvywd-QkH#jPY3xTV9@DtOpNn(VbetbQ!$Uco zAG371n{)4bk}D|Y(cy16_d1STZQLhhOMD|C{LMEK&e*pTd;EudUt(ws!x{V)gh-fp z0l~Ek&iJ<|Mj)9a_&iJxTC(5W7MLch`8ts=tGflkwXgbsZ_hHgsgG6}?F2jd_Ut*X zG;;1Gy;$Kuu^jShIo%+7++yL7!-;VD3(md!AiE6v5b_#(Cr2eIxQcUc%Qa}+I}gPK zzeMygXl?d2<8ywATr8o!{D*uCU<(R@C9jsOzV;qhNPjB|QB3fWJ~vzPO7i*mCztlO zVA}f6{{Hu@dX>e6rcIPWYqdrXLRSMH#D&GFZwqqjTS8Ile!-o(PjIBZBiK`9w`YiI zv=Z=anYVdlr64D7TEDJ?V(SzBgT94=Y{)Lj&O4Ce&aw+~D_M5y9vLaSA-9!=JQ3fd z*tZi4t>>+q9BcNr1?mVMf-N9Okse4cqFJ_j$d}XmdeISobruv^jpzk76x(K?_|esE zb&i=R-n#mmbz4^7UH40W!PSFjx$@mt*VV1G%f@!$!RM?wnR-z&^v#|J_dbTkb{VN+5A>n7$~wt{+aCLN;(F`(;Z2S;_p}A->>+~L z9(fLS*U;4_yp&hiLtgEbMC;41NC=H3T3@Dddmu%Kf9w2*eL0&}FWTd`6kix$w#HAL zAHS;3o~MVo=Oo+4yS(x3h8-UAH7|qvl#E6`A+?{L0p*dKzgf3;-sX{yBwKI=q~u*~ ztsRfZEOD^%utAS1NWs0ZySglRp0M;RpB_0rcC}R+x^_7}_E>x*9`1#7o*vI8zWcJ# z7wMV}HNLFj& zl7Ggz_b_Y*j~}NvE3{Ut_oMwwA`~%?A62sHAD0s^@@(P?>v_PsC#pPlZKB-5y&h=) z9_L@!PkvjY4&B$Kl>H|*JuBJM_P#HrYyv*mm-$kP+C8r#CHb#P$sYt$;&r8|R|?Vp z-yx)qY!mtmUbE@cPyGsXP(D7yxssKnw1`DUU8(8M<+SL(=91?EdWHoENy>@E=Vv79 zC$8@=FZ62V)feEKeE5I$8}(nN)#w$|6dO^TV4S-xL~+c2zz4`dP~1f^fe2-tlj*UR zYZJ|7OczBpy3o4MLTwAwt+Vc5iM5z=e~)#C61{7#U8^xG257Aw^u?CJP5oq~l5}&e zSKGmPZ$=6Q?{PA{dp_K)#@$&J!LAz}Yp`tf2+8a>%b*`h}5cU!Xb|F7KU;33^v0X1ri zeLK-oh~h3oFHOJHY4J5bo~C$b)p@;~9#5~Drk7?s-3&1j4xw>N^^mX2(#PfVP)vTf zsS52gMJPF#bMO+Ze+mzRyR{09r0bm)Jv;wDK+nmC|Ea$o_|Q1BZtROe8i$xhdi0qj zS#|q`^yiXjoOeE3u*-LQ5mMzq``6r1K9)+;>sEd3jCvb0?+u&$o zDy~ZHK4AX+tFyd!PfNt8W0sXl(pOIK-aQ*5T2}I;eG|NQcg3}-p|iZV3V7oYEKco% zC&ff_|K#4bSlwQylx*GfjYMS$Y9QmyatA(aFxFQPY=#>33+nK`ry}~Erz1LGOWI;c zp$@5VHBx;~x%7P#%SYJ6@{#?(c+YGoO%mEsbo<%S*-&=ZuGJ1WQQX(^?F7YPe<+0V zoRjGk)9o!Ya|TchCaO`gAWwOpGRY^$u>>ty=wGN$)g_To9qUc}l0b$e^q zYJC(BgwPnS9`vzgaMO2PSe)8h>(we$k3pY+T9(>2$$N=5d%jY789V7o_lf!T6UOtt zkAkV)6{h_x&wCE^7vDrT~>WS}; z+EQbk|LY^_w-u-r!4hHsH7G)=b)vzjK~41EvzZySnwys4qhh@$;yZBAE$G(|JNNL43LIW3CWSDhpAZ z;|cNOCsw@yqT|IlT{p$Odw#{VrXq8_EXViO54dr+RaTml9+S#~^zD69ytj{hu8d-m zEB~g>?HCLs@3r9UE4uw`%M@4k)UMSIyG_{0pM0ql%JWX9A6^FczA~mCF#L@eEU@Hd zkBrnFOJ1;kLESzl)Av~NvRX#!c}rgU+A8Yy)vnbHJ%KH0iIFj^uftHD z#xd}&U8@ZeUe};8HwNLi|2njP$qD72LNpT1a(#CRJk%%kPyKF@k;?T; zeg3KO{DK)5P+z&&fckm|@_0so($n_My1l=uH0;>jhWwg%k!=6P1XluuD5f!u@oT*r zeb+oix?f_{iM#$B?;Vw91<4j%Yy9>YwzPYK_kJ|Ry$g%bxVs3&M7w;t9iW(U8Qd!i zQB3sC$tTGfy(hUM86&y6?+;utWXgkLl7$m_{g6ETt>m)fPAvIRS@t&;LJ_N-3nnK;{Vr{Gx_iRo5Z;{9lMafXCxs#a%_6N`3p5ig!Jdjg_P0f z@tgGgy^5bmQaU4f)1?yA^-Ac{EH$c2V%k^({HD1ESS~@Y06xe{axgsTPw~zf{d^7d zn~s_LLWy^ub+Vu7S3~D_Li>0zbiTn{AL|2Z_KRiXeNX>jXJ!MmmqZ-h4b?TKuz{ere!uT?GK!LGxbb|1fAM$KgN4I?P$+P z+kH9Q#=bdy-$xb~tw&TcJy-YLb?m|#u?*F{Jdb|D#9xkxA*2G=v19;Z(!Y)+r^i1( zGw5sXZxGV?v{fXt4%UM(??gQ#N$GP}L$3tW$G!tyf;v1ViD}Oa44jjYZjzvX-Xo*} zzz2j^V9=iuXQ|P#8=&(zG~Vg#=XXLMdz<&_5`r-sYGBd)Ts?H&1FbKgradN2GjXO( zqkr6_KaD{=`|lQwjd~){3qs{`|(^&$;DNDg<>{ zc3Bb0&8qca%1eS39j4@)qR{~q=#wc@cfT1&J8%;;oM8_K7O0`{yXR1 z@4d}?bNk1~W77=~FhKfGvXMD~FALAEm?Yl!h-^t9Q<>`YL7M|L+8KuC zrT=e)-du*s*tMA43)BzU8$dL)F_4Wdz<2X}cD+HdAuY5fTrJ3~UdgL9>F zb!%M=D3TtlOvX@tEaqnVt8Y`DS(5(c+vfc?MEeq>4thyCf1e=r@2~xSH0FagHo=Yi z#$!IF`KNe@=wj^Q29#KsY3d}e@k5Qq!e+hUC*S719vP{Oyyb<5zH6$DqNp#`!Qc8oLYHZgVfX@%!&`zkSetl=~fq z_CwCSF{{lpoO@O4_tQpwEP~tnm0RUAiwRbO{VmSDbx@;EnD=)@A2aUnDhr0KJ@Wtd z7Vjl~PJt4fecQZ?=7RiM^*>9PK3%R4p4abD%2!1UU=GucKi*@=RXOCi zT(o>+g8+q9oAn*)Wg&h9Q0g6MUk)`I@b~x{t}*w8BF_$x&R={cg=qbN&#Vp7EJKMs zWbS{K=d4^x_OE%NxnG-jx9%<8OT6++Fz8LREr%!0DBsVM@Yi{@<)|HfZ}>E;4`GTMbtCB=jcfENo%uzJXw;dBW+gE=CJE_!c*eg6C@bKJ zj2SVnC)i>){91B{C>>oVLTiAKZ0<(?|K;4fOT_=MNl@OJBxJf+^!;kM~3?3>lZ=a#46A#YGkOGtKW{ zdJ7N=gv`0X{QbatM=r!eG0BwgK<)RV)9wwN!?aHfo8XDdMGYG%PbU1Va}2|OZ{g<` zV9=-@9%H{_^ApBC=A-$tO5;xC;nABnzOmO?z(D03rjdUz&lQMGejS@2XTe@Sz{-PIHeq-axD} zW%X~w>4O$MvKCzpnpicUi6&$tiOyt8jQf6wE;pKI(sDcB;gjAXylgiT8c{jt} z1`3fPy{Q7;AUnRLuQC-LtW4QPxR>O7zlaYBjxD|wONY)~sB4zfwOu2;ci8ly?$|@n z&Rpic&`v-zX&|LPk;Gu`%o@dAf^h}{x);wIdyz@!0)VSogdvCB0@*4d(l?)JP4LEt z!hvLXTd!{s$t=+R!zIcm_jwvVlqMm6WQs<3ygS? za)BlFo6w$dnDHYV2*u_zJ!XgA95!(@?x3^QCC=Z0CqU^M=Dh^FU&id12yK@WTC4(- zIsW8eJ6|(*iW_H$@HhUq=>LbVHR{#{|9aS{dzyaG2Yqm3`I-&GM(m@L?mz2eX9w+2 z9twicMq=#=}C%{A`x-CWpDxpG!gqn-CcKR(QRiC2Ut$p_(j~@ePrDcTx`*va%&oUaDvy2bMDQ3-#VY^t$zuf`f1q%ZIji$>zr8| zF?*Rig(-gQ5-~vXL-7#xLov~qBnGpRl&%mF>dcGJx;C??$0$DQX8jbG?GT0WFr*~K zB`w|P&rX^?f^a>LXOwBpK#1ar0Oz5<&%rgpmHgOZ^5K8%mjt}gnpcZ=9hiRn%g|-0 z!=lryw@bc5xZhmIB0oxabQPjz4%Fe#JK4|lxZH2VLn71mi{A0wPxtQ3t_9hmkS+p=6A+&Ytww-sHWXNxn3-jTt`5 zlWew=9ljz$_Ko7bIg%&&lIR&X)?l5`g^3IPQjf3b4*;H6)QY*EU|OaCA>w09M5sB) zw9&O>e}y>NQ$wy~C=VHTlb584pAL&|F#$?KH1iLFTVD(9nCMBqW68;_Ry*O$^zn&4 z$eoe>^7Of$2IFp`Icf9$-NOby%(Lzu;~eEd$)w9abM75mBc!rYS(?Twu;g`cf-9e_ zWdRdinj()>*IwKE43U@A&ze+vfe`x0?CTZ~29q2*ks}H+gUVdUY|H2aFm@?d#^OTuO0di*RN!`Kk4s_mWN;@s{Pk1p!LFK2`uPlKlzy zEli~*O`CBhF9%yLU&tTVogZ6BQ+&A#LR_GH@qr8d6FeJ43^Z&i`B9Z)Walo3;}mNS z2^cWyWE=6Blnzr2;uzU^F)YSA|5b)f{FVvNu$2=U@vSJ}MWb%D1=DgceQdTlcgbW7 zNOPD*V^AzkarkZt3dPh-K>Lb0E0+f7Z!nE?TvA!Tu@4^5AS1O-Myg6he++DikUOt8 zdwQJFEI>IQ4=+cm0_yN=&U<6PKxR2x@{vWm4>Ew%)i0suE$PhSbt2Qq=8>J-BANTAVTWSq=6tgr0r_#ij5oK)C?-2a zb~N-sd0n%U=>ZvUW+YFrney>lr|06$wPqemvi*`J+szZE{rt@GR#KElpsTtxeS?9Z+3e z|1q&7-c5eT$IdQCNu-B-GfI;{X|k&u{apf-v(nu3*f}%KD7Sdx7fpC8&+(dbk}plR zM7dgs#)^MW#$t+~ITX2$@@E72hXgdPm$<#2hiUq&hoKJdC3`^RJqP_9Ms{X*cy=Ca75T|wxw zKsb8RhX?(sQArLK%%V6(jqaiE1k}(N&DS!mIS7q%1&W^t2Xz+ot_sseWGx+k_jMDm zQ?H+ozhBJ7-%d+6|F@yHp7if7(?+n`{N^(Guoc4ug=(hdXfxzQh;;U^!%Xwa2<7t0 zu#6DpTBUeC>Hs`lBGV~92@Lv^VIa~aLhp7$6D1=z)0$8k4{v+MxAJw~+c(8)dtNv5 zUg7opytgF%+jG2^Wc_@cZRGT3t{iJI$My>dQ4Xg9HCEf`rxwn)zs`F*TcD{GOe@9n z!>WkT4}j1+ZnPhFHf*Fk;*5k~*4TUDNx%IY!%hUt9k^aK?ha>KIp)M0rno}i2u2+P zH5zMyMsh^9yn7beNx`Va-~l|X*0bh8zhQIhA&z$oP{I(7TDXsg-*{%H-NJo{b8k~F z{`izDuW;`DVFlAV&Y67g2r`X$|3i!SZ|99meJ`Kn%IjuLfuQM+OVVLhoqEEe-A|2p z+T^J@hau+fQ8!}JEb+;PnolG%ZheSiJgF>5F>4b%2Kn={5jpe&uqlBzt6>gpiw#-`x4_3 z@9QKm_bXTZ%=g~y&-G--E|7wuow3n(BO?L3rg(UngK4Q8OgqX^doM5&>+s7o5^~WU~mG^9aIz}T{pCZlre49N; z7xFu zM~}oh5WvA@o`z9+pOFWxvLLa7635@SD2({MK1-w<$Iu>s`x6q`@m`@naZc@k;Itni zJ8AX3laKpzKj{AuZ|jUaD2lgpIPLNF77j-Izr@*d{~zM)&>#Pdvpesv{E4~$+>b1N zM~r&=J7Q`j+xN6t-PaNAX;UkNlI^hZ z%{pSwFI?)3VB|roE#jDjl~cefqx1j{M$~du&wPB;zIXe4vr$U3=-N95a^i$P-caq& z(r5ie9as6xn>G@;nS=ND(DnIE?L4x1YGRwjw)wMu3(yT_^94UhBwMHHPdswR5|~{lS|h8T$+FNHUCZa5XUlCQaDK`o(LVmbS_+0XqG!&lh@Q1gNnm!o zh3#ltE=Jf%8GUE{#}*DH{agy^#@U8@?WFL%C#V&=67A0eVeRu@vDv+LyQO9H-NqQ- zs|Zn#`z^-v4>FgH1ONVcqveOKjyW^QY>Fzq}rdi$M#bo_ECo7IH@C_<@JF$mb~{je{=EldtQLj zJNW=5hC-0;%XS>rb_m4xRMgM>a^?CslUJePE@M?I#gx8}2 zCe+Exov!23XX@4EPrvG^aJn~T^!>$<_Vsc@e|&#oA`$%JAoui(7YKf@C#7p6VRRlm zobUCBL{b!jM7SB!1vg;VVFm3mY95K~*rWIp?~83jXM14FY1b_s4n`bRYJbl>YZr0= z!w%fN6VGP=SWKvh;&SibB+_P;(cjjq|9nU3UoobQ_#I^(*Pd8RcB~V0Br$i@Dx>tT zJdChe%*GI$fvg^iu5J4mr3Y{^g4In{M?3VrR>~+n8!!~zKa2n?OEHf|-1g^Mu`*|Q zZOS8&B00{N*8Mwf#qp)+ncq+>wF?aou%1v{$A{pMj}Az zjriGVuew~r3HT4T_&KkAuGzH+C4mvDVxPSQ0ah9vcmd}6uQEz!#~%j~zS;ROWOevO z9*OL{p5lLRUq@BvwXdTJ^V+d}R1!nk@-R-gR!LsRy$^q1M|H^BOWbe#Pa^8Ks{I*} z!MW`;zu(CtkJ3F#kk~tMy1jB%yTc? z%ZB+|Kb!nSwxnv&go3l@49feBMa}Gh*`@c?Z1b~HTQ2ML&b>7MQ24bc@+YoejlIel zKnL=crGM`PdDjN7A&QnR3(t19&6%L@bR|ewwMuejC6y_78Z}U%_|xtk$t!!N zUXeUepLKM2(bYG{?(^3eeuw;lL?%KbO73}vtlMV&2_AH$yF)N#ZU3re_KFpDw(i^-xTO2~6I8dH7JBP~T=_3|%99*ty-ibkclE~J4T0&uo^`Lbo2p--+PtA~ zpQB~b&xN)r(;v@H9qWh8ggS$aBH@W=7Ny~36FhPYj{j^aDRg`5YVxbx({M_l^ZER% zHWj}55~eS^bB8atlsa>NgKYKqmAqMJgq;2g3eq=r3S{p0O?6ptX@{49DRN3bT5tPU z?t9I$sQcx*y`u7yE+>}WRiAKa(H7augU4B4Pdo2^EnBed>W3?rvJT7CUEv;nn(Q~m ztoYr<)lZM8_N$cGrdH*vByIm<`#6WNiEbXUiHqIVNk5URKSG$${udyX9LwKm8YDkQB&KU*H3o=huOQuemHZsM$LQl5LvYXV! zuNK^qHtQsWw?5fCoA=B)@zVj%p=)orPT6Sq_3xhEWWHK;daUT6e+zq^hti|-q`X%-7nNENxJC}-LJ{MAtu4i zUnYJKP{&X|fsgO(e8t@X+fY{TSlqkX43}m_)Q1o0{T1DUNf71aBdqTufJoP z){v0~w_+Brcg<-VI*`+FH21@P_vyPzRA;QKSw2dx{Mx5wGX|?1J3AxW=Xhdl#9`xs z2K!a=PfF*GA5@pi+8?tJ(~D1fweAQ^${hI2WJ`Wj!R^fowrl4tXrAzcZ1G)pRe4mg zLBd|Ldgzl`f}2feoM&C(eX5ljlISxdppE;wB|SJ{$xxl1D_31wQln$!)W_**ue~4b zV&hLYR>)CX!wyVQ$k%xs=Ptc_*ns0TIjYMJ&6)jK@x_PA`72NRU8k~!{RsVe#HY7e z+K6PXhMn=my1x1Ark}UDpkOuJae8>;OqUz3?Dr(@U}a0YkE}0Y-W_z^VIID zzMoS}I1BGc1ZlhO6U3Q3OsQ{(5tge}79L5TW3Lmc^4W2G<~F^|pNd|}zVU@)42MTX z*k_+{?_>4x*10;Xx9`2xrmW*`a-0x6_Cc!7&f2C+H)ozOBB^yxGql|7_y+ooCP#N{ zmF;;`VQP{^+?T_$!;(iV&e`{*`<#0=;V=9wo~|@_xgCdsZ-rD(oYu=$MJB0l#u5_^ zp>~1w$1vO4+`{JLE7os$_kO(c1=Gt3N}kO_=jR;1xnkUlSwq5B)P~*|e)P5!{mqJBw|Z&6ZQ z#T+|tJ;UH_v*xWLX4&kZlO@jw?F;sG>D?mv>%pb4tB&LPNX*=D#i&+q@e}^J9jN|8hgG+%O=j1od#P!tN7`!J${cr zapb;4*W1ZfgBN`Hee(6x(&zrNYtkf+%QQyRCamday?fGSjeag>eXE8P+xnhztX@?6 z?a){A9i^+})kDj7of^`dJz|A*jfw2F&fs&~c zcg&u`-KGHUMJy-`*5qf(+*`F4NAuW;QH9(#w=w^zgDG$#`!(TTFb==b3c$8tO=^$3Vm8dWR>U zHm5n&fBn8DfAqtG%H$mb?+%>5EiXZ1&@vC_9rNmSH%;CAqty88<@>8f@3h&Nd@tH| zV7Fmz3G+@dS2oFUCK-I`ar}j~s{VOnofk*n4|FR~82Oo#K4FdJ*w2-7Lw{IlxxBi6 zKj(wdu4m;3Qdd3Y|J?sLWG5{>AkkZuP*I$_1lTB`+YfKc(85I zy5I+O=A&~~NZzV$EOskd8%?WeCVh$1-|V%HjG28YBB`hO9=*KhTaInD zn@$~mI3=*iV6ig)(CougcR9{oKiIQ+M6u75R~yzoNqnnSvCT+v&Z7+3dp(pSg|lRa z9ke?!Msm=yzDLNn!79n0H|0)Q=s%rKa4o5nvRfXmGC%m#^`#nbrwF%={bV8Kw@$a` z^1@ybiUTIf-rO=``@W-;#f_0tw;CU*E$r>ky};vjfsg-;il5_B@7TQ2e)RSv=X?LK zvrQK&W_=vNe1Dl~=Dzc^`|bULUK4{eK1UuNmbLrBul<4({q2{FX<-@vb z{Y+O5cUe67_u}Rmek!!pr@QfsoOTzI3mx&!&Jk<83bYle?dF(P&tLVQ6&X^=i3?iC<4;>s+<2y0+p= z>F~bqU;I`#e&e?&z2(y$1>%$&I{bFk*wL0DIekinE<={duj&>w;hBP_Zy%Yhar^nw zA2l3$+)nn2+-u=0v+%{59csTVr}dd@cGKO_^JKPKLzIVJU= z+}P1?lUnQ-SuyX6 zMljq%r7e3^qH9%>)^?AX(4)Jb_pjPtzw^5ve?P2tkkh={T)njJmM3Mk{P~|=|K1b$ zTJ^4*))9*-uWwr)*P32%OY208&TD>L%cNb=akIf(1G#{Gh2$#QMYYcJI7tvSPi(W102Gwtd_=P;TxP<%?G~ zME5G#;OjMf%g?%=8xmT6Z_!(Oc*`xrH5;a-8@d#AFA28}N)EqVJ;!DItj*yLQ;xVa zJpADzu~Q>_pY*Yi)H6n26Z-e}Dt5aavh?*^FWzVAko_CnLmY=5@cNLsDB3A8!|7w+ zDkn*oiO~mMDmj%jH%2ep6d8SGxWCiH8&7QcJ@sP_hFHWnKTEXzWVJme&D6o?L!>@sd*A2}>q9JUf~8wt2}X zqIlBTXVuArlfstpQ&{}>RBsH}JRrEjW|HmVtod_1iE2kUvu5G z&sA=07B+LD%l)oCD&BCaqVKOYm(=e$AAfDmkKU=Iv2RsKx_RBYlgpKU+_CYE zD_^}$AlV~XMUxSRtsND((n%NCt(7*PJ? zQEOy=1+AX+(sla9rbCasqtAZ#+P7q_{H3wI6^=hhNVZuv?ZWB{4lyOGgP^PRh;e3BHNZ~dAhGu}>D zSufXJD2Nw$!)0Fxs5q@^Niz;6waH~-R&(-`L{LpSIr6DC{<$nyEtpk{RfE& zQ_n=+R89>T7OG-;a=rAN`9D{rtMjJ)a8ZO+0`va_0%7>t)#2uKA+Y&ta(M=?NEt<^sW2-f10SxxWAfNH0GPD z)57zsRwn8z%vxhFZx;B%Yt7qqZ!gU;7bW#%lN2lW=MTPC`ecm70?*$ySu5WSo}^ej z(^2kb*2{vk`wJdtZk&B#o3?avSi|1)GNx2Yx650e_9?D>G`#N;rN!!AveRFG^6=T2 z>f^X-L}7egb>0=FrRR40@-M}1+vWZ(`I2v~aJcd_fve2D{I}1J1hi!D@%D>LRUDjk z?D++ohlPhXSM}EF`NG%;Eh*XY2K@%y=wFgpqmkB>BX8!@!^wXNwQ|QD+ZpvSn--~P z+vQ|NY%H-<>;6{XlG9e5R~`AO^=3fNHOI0x^}3#T;Fz|%mIZhHy9f5BdxJL2S+9^V zc50tY{q*BiN@Z=gcmp<_=+kO&Z8)7&A>;b)cDF-rT0Uo&@f?@bI4&N$eckj25|z7` zHRQ%#a6caZWMsybNmm@6$!=YL?>DF0x0rTM5=yD{sQ_&Nb;FJo zHSKsk+)Bh{}Fw1fmfBGnaR}JQ6*{7r768;p6Wl% zU44DcRp*a_Tf6q8s(%7uEn{_DcNl~aD9mcc#AhyykhQ{hiJ}4d+ahd>Oem>`O+2(T>4N;~Xt^eNuh)G4I5- z^%})$JM2gJD5On(T`&E_dF8XLrh~_qM`(Eu;rh-wy8P9yPY*PH$zRw%VDq>K*Syr1 zd-mKKuS#AS<{b20S~qFPy^%Aojhue5CgIStX;)nj?9{*Brd)WZ$Lc9co^?Zp*4()E z@`9de?2MTO785HX$_9Vs$}F@0z4`{N`20GF z)agBfZ71w)HQrz95%JqN^h5W4l4CqBsT~+FciZBHIU9AZo_O=+p23!qHSQ`L`un@J zZ;os}A4QLz6xiqd`_|++K^nz(OkIpFI+tmWy_C2+_n!HO+1jJmSTwk%J{zqm&@uUL zdO31;LG|S^`^{~pYFz1ddPDCgF9-oO2Mcls>(rbUK_`{~9v^A7!XDtPM>b%v3V z-L&@5C(Fv|>!QwQ*qQd-8CwE{Xb;?tX0nFwtc793dNk?>nF_Bl}E@b@`#%lDQ{<#s59^*e3ph*e%%=n*m88)QMXxU@#&QZuk=?jtn^g>mDgDIvZ?nR{g>BcLUohpEtxpv zurYoq?oqd^8M;od`nyM}Qtce4Ljz1(=U3;+<*QZ(^^|#O5|-Oky=3#zu!U)XQjr&~ zlxsW1n-!LMOw&?WS6s}PN-oQp6BWE}VnIlX?#!iU)niKR!O`?kkE%ZbNxjU8#c_VR z)4ZOTa@_fIViJ0I%p6d%uHd!HmFmH9@g~pHj|RD|43s+u3!pboH zesk>3el-2%@NM0YPm?^71>4cu+fv=BVV-WP^O1>qiM^Zp+rEF9exa$-t?$^pmUmm? zufLsorFXwsfsN;*j(XbtJnFuFcwp1zfmd`U)x~EuF3S7b99-!#KJaBmno(2VHEk1h zlSk^NZ5pEP@Z~jrjJ5W-G$w4F{@4AcZ5t=gu}Mj)j4)i2NB^{Ks`Nhna&neZpiE}P z(GcHT@xoT=E6+xyt}ATY=rMh$!<^V_=S<74Nuv9nqp;pm6v zLY2Pt(<}4cGnQ(s?;Ao*{;GN3%B93-l1}lp0a;oJYVN@+sHSDbkJ=);SJ*6+sJ~R0 z*Q~F-I@Y0Q*6ttqC)0G7c*doL$;PGbzn!LMT(!IPzDlf<o42b(JFgjXK@ zIzUs6X4z_&Y zHPf|OZ&ZAJYOB`nUq7G5+8I8KOU~k^4e_=~(|1jbyL2)+)<%Er?zXy{^=Z$gnso;& zKl*W^vckd5QOzacJoVN6@}$16Hw?%aaCdT(p1hTNy_$QLSIv5zIKAf5elO~$zWq^g z*lyS(iSxVTre6@I71}P`jdww@v3&v~xcfN9V!^;re zhi)D{55Ji@+10a;@8||3XkO_XZf;0D$w+bk{?5RB{nD(o=`s^S)k#L1&V?}*RuRP& z4tE!{O*AYBr5)#_?Ri>dp1EzA`z!ARzqp*1DSvs(hy6j7J*0nsn7O;$t5ve!qSM&CYkuG6lLnXWi3 zOVD3yg2ajQDL+Gh89ci$e))cO=)tx=_MQlw{@e}K?gX1f{r+X}{ zcD3ZRF7F;t#rr6kJUnZAcrq>RwrkPu8P#Xxd%yp=pC5J0mVY7SMei0{#~C*bUb`9X zatU8m@-BH$U-v34zmKhp9_D=YI&AWEgzN1r?r5{hQE;4nAw*cH+5N^#^P`8eGBm&KeivQXv-SLS-P1!3 z`7S=)GFe(L|8C~-A)i0=lRn!c&gsa^UdA6+KQ=DwXX&)H_<{80?dC&94!@fZyU8t! zgKr&j&lX~~B{WG7Ge~T(UuW9q*SF~xme0SZ0%Z|#*zEx-%cQvHMcA84Y z0$p8kcu1*=wrw!D2N zlS5kO`-}2IZprZQXNpYa^44Ou%-W-zl%Bp%x^NR-+@EzTd!hKjS3?1`n zZm+?YPo-3C-DE^@_UAVnM%mVTt@y0AXvNmSsZmN*+x90sEZa1E%*RtX^`3KQt1T4P zQrr~p<`I3V*DfW&s>^N(I6Q--#^G;`^)G2XeYQj1{$9v$WR=gy&x%Ckea>0P%`F5l~a>~a3iVdGyd&wlQ7ZkF<_^yd=N7AwC_ zXr*|xbnv%{Jp{FmACi>j7#cq*y!&**%cu4OZ|F3a1?mLUIy_ZSvbr13V+@CWoAlw< zz^oo~%63cFJ$c&dGojv#tD7DZT6u7Hue_plDHH1wj9%Ey%2%8_*;Z2i%IB6bSGMLA zPga`vVpf9g)r8@d2iE0C%I%)rGCHRAg}s-z;=F3q*$fU+m_JU3FMBWf%Q!`o0U33L z75l&0Jt~oCnp7*Xg)j3>@ypn{xH?-!1BC_mZayjg~Rr^-#E9QJy(=Vjw zjN!d$)$B_@dTR>%C%h{t4ktD@AImfvw90IwRfzJBUhj^5SgSd#=gjQvn@@(%GWg!_ zdH-X@D~rRNsebWc!9|f<1h?{hl7{{`YuvDI;nNVwgK)h-ufQ(?KWAT`^LK_RBOt^Ub5Xsrx3m8M!n7|<>w#a+ups?@_9sK%T`%! zz7iRzl<;Qd^Wj=%qjT=weK>o>=bGAHXY{@EW3ExTIa7m2ezO+noV%D*czBhuoYsz~ zzXk=_zh7{vdXA>i)H=Ct*L;5I(;Rt?pCP{o zf9(CvzxyQ(lU(8LTcZj_ed%Q*xKPmeG^$|RJHKAa8pflJ$!q2g`#q$4w&3E&Sx*oB ze17{Ty>e6wi+>IPfrF!yyRDz2VCdjsgNF_mn0R@w^>KA}@e>RkGiHSTFoR*k1Qw3A zp8D=y{@wyJTUU4YwE|mD2f=h(pA`b3gS(@TfTiW?xyshv)j{Cy>gVWV>psNY(bL(_ z#aH0#=!eeb4z9j_wx0Hm9VH$4_FfK-0)2gfhpVrztEaQT(bGZS%SqqP-OGMO=k}ru zf!|thNBoVhub-EXV@I*LbGF>i%S+&4>$z5(C-Cz5!-Bwft%seLyYJuVi1_Hr{Qo#U zQT6{gzK)WA0VY()e6GcH%Z4id?|po0cZih#EI@I0UZF)MgUU_1->LeF9c`}fC+*!e;h!s0qD^HlMh9{ zB0#$U^Zc#omjLLw0IdR5`URBvdI0SQ(1rkW4~l$QfOY`rJ^+&l z&}{wf0Bs5|Z=k?u=~)A`Ho!zdg+B+NHvsf_fGL9#Umc*`0eTR?Tm@(ufZhktmH^WV z1wI#`tpHjHs&oRB`Mm+!2cU-mOfD4p(g1A-(7gcWI6!j%dMiL1157;>_P5|8xV9o(FJKsA2dJ4caK!MKy^fG|%0WdL8;oAfBCV-v@FjY|EcLQio zfF2AmnE)*Z&<6l|2EhCh%YQaND?*jtCYJw7fF24kH^uU|1!x_BIR?-aKyLwPA;8p$ z<-Z7^H323>EdR9tJqBQ&iskPL(7FJV0?;hKy8(JCz%+^FKM$Z)p+Iw}cKQ1Q^ay}? zAeO%)K=%chGXTxb*A9T53^4D+@?Q$j-2vvXSpFLUdIG>yh~@7A(E0##4WL|7w691u&1r@^=R4{s40UpxOR*0kj#w zd=$%nIY9RWm{_s=Hv{w}fT4N|GF8F`m1^>Za z@L$jc|H)nO|M_3=f4>X6Z;QvGy{J-pi|L`vO zFYbc>)Gqk{@-O&*)CK?NyWsyr7yKXTg8%9+_`lu-|G)nQ|F^o}KcNf$Uv$BLXczn! zcESIpF8FW$7yLi$g8#E!@c+IG{-e9#zp@MdGrHja=fB|pZWsKY>Vp5*UGN{-1^=a8 z@SoNN|KI)v|4+K$|6&*Xf9it&qh0X-tPB3Ly5OHcfk#1|M^VZ=MRem)3W_`)G+JjzIc$At!u;;8U+pv|KMN<0QyJc?H1ZGjOFP~dT(&f7vM^EBD^8j3tV+g?(Y zXUn#?QQ%3i?YSzvp=^5tC7vwXUPg_V)7~D6P!ip&$_E2UNP!1wNI(W$$bthoP>=`U z@43R$Yqh7q#nINm(MRCqZtMKFII5%E-pj+=$I;i<)yq@h;ppe$<ejG`Bq-}vmm@!5alv;W3t|BcW78=w7uH$I~P5JCtA4!Dp2PgGwPiqM1(hC&Ei zY(WkvY70eiC@v*INm4W=Ln%-ilz=jzj3^s6j#3bR6h-|iK^e+WfeKWi3N@%f9qQ14 z1~j1wEoh+|xA%XfWX!BU-vz`Y;j@&r_&#AQXH-XPm)j5 z3?n5aEiEG>BO@y-D=Q}_Cnqm2FRvg@isGasPRin>(j}>ONork^dY7c}FG=%XlGeYZ zZvT7I#=j)0%a_yT%kA=&=q!FOxBpQcqyWeOkQ3<(paMVxfVTJ# z?*;%c05Dqo$9S^#U*fPx~c%^kYiRZss-AODZ~*G>EXn7aQT)BmLJUG=-GK1+7e(GESO z#ryn>SZCRC{{>qBK|C|0xifPG+^<6`(=LTZ^wh`-fwzzS?|33u8NkLHwG@p@_ z;z>)$aAi4ilzbQNcu)WjGW0MfW}bJNCu6Spz&Gc(`oDmjj5noMLbZ3@%X&e8Iq%V$ci*%@hM^Fp#Dg>;;3p6oYACFpXmH5DXqt z4D`T2k795Z49-#vR)E0@iots@cuz6t1_s?I2GL*;O)*#k21_Ugm0(awF&GC1<0u9h zV30vESPus4DF#2m;3vh1qB=gsU>6wdq8ONgff>c%E*RXU81x5&{uF~#U~r0J;0y-N z6oc1b@S0+v4hHHJgGexlq!=s!g9Q|WQZOi`7>ojgQ51tTFi4{qtOkSC6oYSI@Qq?1 z4+ioSgM(mjkYX?s3}#Xco`Asce}rr@Iw_;3IpD&S)-_%H+?e&B-(8rwj_ z1T=1eMsLta01bQ4cp);P|F_g(miglI_AnLjbaZqOIJnyTxq5lp`mBYopO2%hhrrQO zynpKC>h36T^zrfXX+Q5M@5mADhIT4<_4M_3a&onIb@cQTcsP1^`K%S?+xa^=Ir{un z)78`7%fs8&&(+S|QLxI<$Jf=%lg;nje)$~ZogBvYb(jb*e?Nhj(_fUvwujE>>&t!s zPV@hmmUsGX-MpxC(fsD-X16)bv;JgEXaAFS5l@Z)=-5wYXQ%TJ{XHGmcsttrIXbX& z#InZD5IY_}M;}jH_x6fo|11Z@^JVYl zZR9e0{<)3(k^rnfw-E&%VARw``tX23&23~n4;bIvMrQEZKpz&K9 z$>jmRzO|7u93R#vN6yZA3*9u>Rgg21o+qf3}hFl7Qe>8}X9_g4){1 zWwxBOk$OoWNrDg~K9EEc637RtAP4-KM#xn;K*o}gJUJlAl8{>V+=-Cm@_@S&A$jtE zwKE~VSXpO8j2e;px)O01#~Vy*;OZz0552{70}NPrS>ZU-S@N`U1~ zLK4~YU4-N-0pkM+saFE_?IxsE31~P-h^aD=7et7)GEfynh_^D(5Jbp!Wk4pFkSJw9 zJD8Aj%D|vtLUNS>>kvZN1)O^bAu1}sz7RqNsQ{K?gm|<0VT6RK05M^NoKpefA_L}hpcq27s{#9B2#HbyWR4J$%N}D1kx&ORV+k3p4#XWL#6}(1 z5Kl;=I#6|tkXklBfe;A|VEl1H3^f4jlZ51I097XmY19DRPZ6T631}x0GF}r9BoZ=9 z6RjU;2fccv?GX5_!Em}tSy=fz&rG!vUa6}@OYaGg%TT@*q zx+j%go3pMg=}j9kWHU_V6pnCWDYKetQMoCA?Ev!Mw2@5KL0Yuaun40hAg~n_} z7db&FCyZhXOo|FQqQ-Oo$`ck9vi#+-{57-@x)aarTHmyxjns?tQ~SSToE;+t)PHCr_gLPHiDeEvIs?3&Hta~mn@lov(;eVW>cM5nw&3eaw9Bl|k# zWl}&?mwNdW5ZKg4EIZ}ZQ$Ti88`;n)ua#=I@m1peH&!+>9H6yDJTJobv5E#THJr1c zcydj3VUZl0-##X`6kv71lmi_9(nh>FqIO0{=vcmSsAL##a=1hU*Cdj|StV6dU0Pfs zYA?O$&u_6#ZRY?*-`dE%uKk*@Gv_Q-Q{B-NSP0-U2k>rfBXfD8`m>Hm#WKc+IEN|Y zP&$ln94;BbGl`Ul;&SFn)l`>Pl$Lcg=UnfSvAXlANEa2jfXnYTB3eIp=Eaodh2!6e z8P1AMC-XagiuHXVm(?9Y`bdiC*c_3Gl{OBQ3S*2TC8Ky#qB${CI32+^IV5qI%Q+=g zQ(alrnK9>oT+SEIuJYo%Hw(7s%riQbu)=kqIlKDN$4; zhcmmZ)a1{I4XOR?JNhobDKAMV;tQ}${>l@Ul^R!+3o9qHO((NWH%o~s38hV=IYJQ) z`;O`yJNA5O$LRu5#hD$a=4_#3$C;Ig@Z^qDp_J&{SXyku@+Ec+^~dgy+`#IA0Uy}T*5io$LA&i?&5p?8m`Cu!C5;bLhd3N( zsgh!0MfnuAulDvyJQ#TNg;Nc$9v_re?aKww`&XzDLtCbDhjtbI5C4^1tLjl(&@ zVq=!E>Kfy}A-PzzpKe40ru_)HCokeBpE{xyt7#sp5vFb&r5veZ8lf7lW^!2ZkdkqX ze6#|`M1%!a4XP?FJ37p#*!tmW5vq|YQObvu4l710#K^ORxC=PNB_ds^GG@zIt?F8j z^RAuj4c2FUN!hV^ai z`bTCwA?LdK*~#o^7O+hI8DB}UNf&)+k7`(YhEjm{ctSL&zu9Z!4*UO4vp>0$6}OZs zDm0cB78RPZ<-(#u(HH}zfbkOuQRw8yVx)l469_pj&dX-?UkbQ4fe>p=QQvXY5tUeF z(@41}S>r=8ho#M8m}n`J2>Eb@DPfACN}MA_g~F0zVO6DZs8X0>xI%<{v{Ve^D~j5T zMJmWTR5=l)jv6d6mKIx+r9Qi`$hf3f*imdI)j?Az&2{5SiDfMjD8kPskf|(Gz1<8ngbUCv1Io z-MVlAA=&>ij+*-qz4|2$yjdXjZ({qRAOn~#B&3M*S8Qd<+PBH9t>V~4aU&&WmX%s| zBIeHKvGgoufU3oWc#G+YuD{6uqnG@LxI^S0%_BLSDW&X;{Rf}OR-IW~Qfl0OYRc9V z@qJka$hIcLrjxGRlL2Iw65`h>uSy1RU;0-Z#O5{10B@EOBHmsDt6LJXfYCA{+7E$H zE}J@{5vx8WR4q)^{f|JbBb38cgi(r-O2Qb~XgMd5rxsRKnun`IC`T$qDMri1$WDM~cI`bP*UqAMW>7`YI#o%(B@G~|FJSMvX3?`^=Ns;<59 zb?Z0%{fGRIRn0nM@{RB$){_6C{dqK&rIZHb>B7 z)m{VkgG_DTv<3)yy-|m_S z@YqU1?n#a7?R-?(g{Zu^H_yk7mS1Ix0Kz676mO5AJLfM0xa%Q8`ZPIF?g!KVWm?Vmv!BjduxaY% zDK$^zJ(*jhn8#1TSsECHrn8&lK`?GCgf#^`x?}?yJKoy zt9ese>?}{@XCaMp7)M@zwY?`303Icz z8{&F3KNjmQQ20C9;|SgV&jMKeD7pCTBN*S4(T6I@0+_pjkUg9!pDP~UrK3Bg`-orN z`{v!)>YMhyNq6lfd*7rww<-(Z^=}d4GS@Tz34U38vX{hvYU`~#3*h9p33&|?e23UL z;=Jz30@%D!x3{c+@zq!xml%qSI&Z^8`WPX3d^|3!#Q>}3$#GAl&EI^k8)W%LX{`9et0F>+o01dWH7sa5li=@9KInU(4%ceC7$00rq`2 zagEp~1MK=PA=h)J_3Vj_rPo*^*oLK(0rq^4kQXrjLOsT&Cq1#lpIfl2HP7&E=@=ka zv%zRJ4Vf9_;!%Bu$0`?5BcM4A7?>qwqZzckbc_y61{m%j#F03ji_GIm{l6T5JeiPf z=5?_63I4V>7mN`j*1l=1@tbo1HpqH>$(F5og8wq3$k>imIojF(9@a0U$AxsEqV2zj z+xRL}c1A@GqDk#12yI;6W1q@)*a0zJ?6v;)9mXgi|>0DBpUAkFfY1sW8 zzSsL#yw}BHC!Tqpd+uk>Idf*_%%KYzS}Rtexk>_||Fz?NUTjD5HW#6`uoxCUNG9p| zHJ9`Jb>7$utfqEN*m36b^F&&e*-i(-yRUc$@ZLhxlTR5u&p#jbd>UC3E#Uoo89IJ( zxXR_U<5oM#_!gwtNWchszn zwqlZhE7+52w{7>*uZZgWpp7&B_i|09gDNnci=|_En?`U{q1YdnAsut0&^&#aB@#xUNJ5n>8*^_btUwe>&2+PR4ljXNyxHET`F%c;n~8N&oC zcKpVOWa^6+EEgVuLdv3OTYm_>5h=K?_JbWdC{wo6)l9%?v>ate+FxLm>m*e}ctbux zxAJB!r1rv}J%91)mByQ|UsHeme;33M6=P0K=C7}mTbFi`EA5 z3tMLsNxdzO0=u0D*>F)MP5$XCFh{Ld>?l%lXwr+0X034CK;~cuq9Z0F=N1ta)cNzE$*HM9@J>YX~x+~rCt3kcwSKO+_1m~L_ErO^(k?I63AB4;`xPUB#q#=wB+&YoD)w5F1n;zSW+(mms5-~d@i|CT z6;rmeJT$vzA5&rp8dbn(meDvKXc7v4vIOeYbUatY}(+bJ;2{>k9_ zHRd&^C0bLXeY=qSeKiNd^%l;a4_J7m@-BV)Hf^-zci5bb4WMDebJJin{Og=e%~mS- zPMEeE)3+5G6>LA&GOu?c>6Tb0wU-Nu!XXo`@yHQ}V z$Rj({RhnR=?qn=|Yr1X&|`P&5Fs_vu4Ntn)s$1z3FrF=Y4Lu$OkBl z+U4ZxV1*sjf9P06u!Od;Xz4p>Xoze*|EFBiFKI8qF>+B*TFMpZZ)j*p`Ojp_`3SEq z$L%wfD@jBfx(c?mxad-OVdYFB{*3qVBczYoj!2|oVX0P2D_mDRRkn+XxHd8vZF64L z(mqEobU}Hua_-k!ZfPsPzNLBoRq#(_YfgQx7^|t10T)`qc}I9Zk-bvpi5*cuYc;z_ zz|u;6?#$t7V8#MnD{CO<*lHdB1;OFzf^ogbO`C#mTjd<}d9YJUoksTCk~HV*9_MCG zTcCmm7L{!-<3Tt35}sTX-#BKs6?7qswC9l_3<@`23%I%WHNoxQTy$E3S4yj9m{0I- zS#N$P8|l9@oO5bffQLc1Qd39JpGst+eCi@wN2?kNrkBRT2n{4vYxoBh>#(&Ra4F>$ z)RAz^FMY;jo10jX`O9F3Dyge|4+Mv}*0fC@T=-9j6#fvJ&3`k0RTITf@vz>;OwpWZ5&N3~*2V3PBXkWdNp@Pzh{{9H4^TCzGRGK=fZ4PwAD zkMNt@9v=dS;5hz$(@oN~+5qDK@ZrZm$FYWqnSJw3Er{hsl=R_8-&txJ>r#59p7Kul z*}aE>^jVy5Q{pJT9C1!9KMwsW+tuDdomcL9+V@Ok?2O8;TXcTUl-~ARNN1uHF{$e{ zaiF)SCqmYsC$!>oTTjAJnS>i;DO;AUeY;9Inbah=K!nEbII^|YD{f&jg8ql#?e8bH z!H)Sg3Xbl$2b~!Ey_?V+lU5Shiz3?FyNgw*gpJKB46=sB87)K7DL+(Hh=(D;K!3MB zlfXdm>`&pd40g`W80IG!!_+j6EzG^(g5nuumFWonBa{yFdMG&@&SCpkHZ~g^KQIzD zls51A+wkd);ZzQlWWTR#>C&=7F(QXifnDuX$Rd$mNDz8R!xpAJim_Fgzir^dytEm+ zTO35EeKRmHO0`2`xHWfrlD^J8|K>UP6^W4}GO0P*RFS5J;=Sl_-Oldsa~b#3>uc%j zfzm&+@ zzqo7R)Ngk9x(u_A+3;&yJfgirm%pgnI}mx3AF3($pV%1s&Ya-&&RKo;R3ky~0>Mhu zRMHM4Jw6cX-7H;(ZYzfFy?kRWU1@(l4Vqj$>iJ%;drG}@m|Ikm_gnl4XHL0XpZ~5U zGF5Z-?H4NKIFkM%WNWrtsU=DKR?V3b@p!x4k|#(ga4l7ifg=|dm&y1;S;d_t<|nB#mZBC3x^ zs4kh}t|4_D#wMr>Io=bvJ?lkq+*R;W9vb;>c!rF3bAyBGin)PiE0A{{|fuSMmZas%bD9 zap;_e9?N7Z>Gb>Z9U?*e-)XR{}f~3JiTh`eK~1R)8Qcq&vnaKUUnVT!SP!JyvlBi zpLg^5WS$J{EyDFJf|hE{KfR}Q(Y`ta>M%a4P1Gc2E_8m$|EC}GTjfrL>Huy%j^5)v z!A#+RtOWVx>c&!*sIJ|Ht(HA`*0pQj7HRVCUd5_}BCGl<-_~MQP}N%-Al~`4+G4n) z9!5M4U2h7!nAsoN)Fa;T4gsng;~x0ij>ofkM-_JssxRL9NMu%J2lJ0}Z<(>m0s(@Z zR*Ty2PMi zr$WIhGI2bp6&a#iF{(38sx|3RD~4xr0qwTqXz1H1{g30L5>#gfrrXmW;;!xzdT!fo z^f1J6*HC9Ym={q~rO7&`U(qElaxsXgZQe-`y+n009};&At9h#isx?ug0$y3kkPAt) z%vu=!c>uv$uz1zoxr6%cAw?e?;#-3Z;g9&+sVn~9=<`H=Df(6gq!5U6pG2}<8Y+Rf zkX$?)c^Oyq;&Tjqa)R)%%J&;TaYDJXCD|vGWn4qgU%7{wc*i4DBltgzm)>&$j+K)Vg8>!lhiCh&`~g z%YP+4_K*1Izg!rzOGL73I(#YKe<6tEvUYB7=34TjPFh_=Ft3H}qbzM#fo(GJOkAex zaGcu4%uL+c7Eb3CM$PP>>=#ar-aCIyU7&X#IqtyBIqw4<#pRhp{KGxl*Z8)CTpPRR zCOQ-o6e`m;?v`&jTRIws=?VG&+PeoB(@K2z?;3riJ^9zvA#L%`*c{N!5#L(~8nJ}H zch2}vui97(FO5y;7gyeH&K5UiW@hKeYdY45?b~?pcd7;&EA&?;8D&C3S`j3X9Tdn) zsr7=%!(#+kw~=*>DoQl81_oVZjH;*dwUgL%?D+}KomtA2bC+EDnJh;0@5#?`_$p~& z2Fuv)SxXnf#r%*s;;%wwOV7^3+N-W*mL9s@Y?Ag|PnAruS<-~%sv`T44&+6E+vCj^ z87&K^mm@Lyd#DKG@oKTb0D-s~!AGcO87*zl?1CbsmJg&#Ko>eAMzEV*?mRLwitoy; z^7k+|#UXcckBnfUZXS1pyG?nGH=!;j3_uI8`%cU;C!M4Obf zdO3A-d1v>Xya|++X`(Zh_MK27fqe{{S0mUmo=P$Y8G7DI!A^ck;qPY`5U3W@RW|v^ z?w@Ztvb2^BNt}7-!^A{e(jp&oeBmQ%L(fKB-~Oy>X_{NetxHjC9_4X7g(DrkR|OpX z-3wmU)ivJD2aMbD{Nu|XQQ%L^p^hHfb3MA2IjH6-ZWfH&eKTaD(Ci`j-!@F-8$xqH*!P8 z`)N_VlGD06Eg1sa87EdFWi*tDW!_~iKRdTTA2Z06?yNnlCg@Qj_0|$vUgBe`s0IIJVEOvoEgb{%TQIG87dJ9Dt%|&z_cJXT?(a{&<)5aP4bVRvq6; zcehCH&t=`##(>&pnW3ej)}Ilt2y0jS*-;C7uK!6OPa`v5X8T^_UjI4u16zXfVHBoX z?z}}Ah*SQ_sI2dvmnN-t53)zAjU$$`9!wfQk^XK!)G1M#b0BEPxhss$6Y`sb&Zi z+ud5efDg@%H)u^oRcG7{dwHt`UuXPmdP@*Lo-d;rVYfgMIl0M0vxm?4&Y41l+Y)!d z@S~zz5Kxe1wxT>Hj_UV6-{xmK!U?YbEpDk*e&C7Bg$r}Md_M>D{{O3u3P$7GITJ-6 z$>p$%dGpbi;I0rgb*=cI*fLC)EK$^d4-rBr1P;*o_UwQXx0bc$d@CROlSSnwnHhY> z#BulR-`wi?6}JCwEM+uKk7sflC=fimU*_Au*9R}?sTqpZv>RQGgTJJ+Sjt-cYPHrQ zaglzTgy9&gJ`MVM%@=}(O#WR3e;v@UTNL&qcdr;lYRLXr}ZLMvL5%dUUBB->#TnvzT+D|xa> z1S4nrV|~+E7$06n!IeGKt(zn{JbwoA@h{oVmGEmn*c;vv;gyY>+9{X6#=(Y~w&_Rk zy(`V(GpRbSiidJ}Thv;Y4wc{eL{}!^;}Zq!w>|83yDqZZV)l-4CaBmCoE>TSPmMO9>?9w*s%whm<<9#C$keO3}hrpZ}APo1DzfYfmp@32+1SSDv z5f`_r{A#aH^B~dQnMW(ccgUw1Ze11(FIP}KjCWG~F@CqQ2e^uu9k-61iy3zBmiI0dx>VYx(K7STI9ApElnOAo{*%_9gMoxcnsvKbOgOmQ&$A+y70S;aKmKP0(TaALd%j;9>Rak$T{g@K0g#Yr)=RRm#ajw zd1{H%PQ4iy^|_1FYOE%!%Q*Ui+`H3!)lIf@Gphf>dIp{@RG;G{ywV#|KNP`#_vO2) zmfus*)Eh|0V=q zs8B4Q67f==1t-@ChH}#_3?TO5|I7yw`zq$tU}^zB3UJK@g(+>;U6H7f;3YM!nbpx8 zaeH{@5KSw%bFS>Kj-Ve2*jMOM5g*=*09hVU(=Lu6f{91b8(rqaXe{uB@TCcUlF%i_ z>WCa4LkWgWVEA6TYTmZ=JSTRsK58N!T?SLrN-Hqa1Tld5ZH_c)Zu#(SG1A}TI{SnH z>pJg`jPRkUoyLOVH?HaGfMTs<65`Qzk z)^7huKL}hBOpwYm;s3`GbF?ood`x^ivffVfWP6N6m4s4XM^Bn z9r5xAVn*;XjyOaHd?9$5MiWF02F!-wQ_})KjfMSEJGX={74ShFh%Nwa3LYD=#Sp?x zHj)1$;w3)lFM^ghgblnUc&T*{G?Nwp7@7_My`{p33?UkX0HB(*L4shwDVnsciJeHR zqXpW<9t0`AtJRSdP3yN#qFWA zFm2@?kGwznc+V#leuHo$q|;W=FAP8lnBNk*Bm^oe-H(W)mF@;W0xc}`(CSDO-&gQb z;~wSBz1W;s7q=0J`VWEhPt+!`%PZT z1%I#69hoha$-kY7bm-NNf?EB|5bQpRB$_5h6S<=YBOO#(yQp~$gdJ$w{eEWX!Hx=M zsiG?7uZTl=2W>Cub!CBXmfq%xL;u?lzD?kSthfR@Re_>UXwjspup{66padiVO%93# zh@5d^O2y%yfh-Fk76Kd!z`?C2+XYVo5?O)Bo-TUY9Ze2|;Hp=|7;_+ylphoo`WR3? z2`ILarQN5(vFgrjKMA8o)APmS|}qWBd7F5*vU z+n;O*2jKxK9q%g}1|;Bbr1f5@+|#8DFi8YtNdl;R0fltJEC`4JHD=7h$-!vHDJd(16BfcZY_8IV;3Si;=vE$4)0{ZEDs$PP^e z_YAdqXYt2K*=^h?tgAz0wS!bpn>0^Kmlf;UYL7l zy91GXD-aa`BKC%`G^p(3k!SiD@bg3{D4;w;uj`1yar&OB--g2f1cS88GpfI>6#Xlu zm7+z*nuu6`ULn#8p{zjzN~i&U@BlV?w*QQ zfQ$~%Mwx?ii{c3Ev4RIF8a&N8@HppFNmH(|qAX3z19lyQX6(b`vX1{V{~67+IAw(E zT0G=zzNPrW{01xPbh*S(;?cAMM=^ssF4jbcC-r9!)i8B~{#a$T7#y798@$i!N~1r^ zQI}39y%+xCwG^RpcJNbPEH!31|24WWrLF%47$38%;YVhv8$5anv+}23q+M6 z5u$&kj`Fv#VB1J)d~lhri3m}RKvitd$m1pNih@`O3C4IIzA+C^Wp!m!et~75o075{ zqWt+!CiQgZlM>Q}dh1lqr}8@AN!A_0NV^F``iJ)9>1HJ~Qb%KS4+kI2J@44m$5H-u zToo*&j;n7c_mlqGkM<_|?z^}>f*PoXFza9pk#aTI;G%#?d50qR^@Ebbc_L-^hq_VD zzgy+|e!cG2y;QMSCJ|t`t}-(JB!nGM#fw*YdP4nB?^&1-HUBw|nZ@qvPwLQxrdkc) z>y?9V7?u66%JniT&4$vHPRFlqEX$jHvJ5UnJC2qr5z-3$&c13})n4`RzL?MrI`$ez^Av6RF5Y0$R_$$1=Q3JgmQ7d}F!3VUYL?@d0 zCJxVNlR{PvHXG!0&#NlXjQ-%T!qrg|Vd)o_GfRJIQ?L z?nVAJGcT!5T^;sa#R^HvG)QO^m$}bE66BV{S&Bu@wf4Sz-oJd7zWhPz@th(fdDN6)GrVJ&uERwsN51$1w_q8Zr2hPAExwtC(t{0}zo%^wSQSk1 zt9d~uc~C@}$CpH1pHk6dMixQ$?q)QLyeix*>=e7|X==0mE`7v$6w_ldOGar95@N!4 zUm%GNd$jv3Gt8lGzOt|7Y7+?v2yT0~9vqIL6;^4U6sm=|=WxP6FG{tsr$&?}*I8M` zgg8H_RVDEKXrT6fIP)~IbChTnv#$>G&$~@eUex4!)MpY7|3S9+vnygfr?IVhZ)(P& zdDL&yw`7RgE1QUSpDq~TO?Rs5E^Wp_;NM>e1>Sdff17yXQFFZDk`mnOY8<;rGX&uZ zw7TjWsCbLkT(9gqDH`(aJ4s4I#&1Aaq^zzu1{-=#KdfGlea(52anfS03n<=_F6AxniOhEF`V?0zQN6fNHI0$OGcR_aY3dj3M@uGw4-5%l7zFq zPC3`l#5c5g*BhtGb84RzA=xuIF(@6DAcc0*hIGCVlj)e_Jjv@0ZONIJuD0b|9%I7S zz&#(Fv9zO>j(2V^^nEEfku#rcfA*YO(F4TsY(@gx2=x&0qa(b_9!!}n>Lxz<(usq> zCU~u2_!w($l=v-qkMvyCU#7^ns((+UP+O)K zsPX?5(vVYbv8I@2wJ62)+fMVLFW!`HX53Sg`Z(h}+hUjYV9TQD0r$k8&Twm;1LJ5d z(Q_mP4zGlY7lQz{P98sPy#3XDBoT*dvKpI(NY zpPO!de%vM>Foyr3DBR?7_7nLyK9?()Z{}MrDShxle#1C^gJp|cD-FcUsHX1D&M{P2 zmz zwefiD=2FG~k7k2KgcjEwHfz)Kd}aR!TcQM0XA$cfYriCoxlk3;d)-^xY#k0R^Y0j2 z2JP0!9H;xL_LX%P;;&LR2N;W^*9u-w<&P7f>xRbK^xx%D70O?|0B${xF7t50LZ*5? zjrt4yE6bS)V(A_~r$!B@=m6oLG(K)QK`3cGN&i?9eIDF(G8l!*`cH<72H?uLu~*QC zed&tp_GQ#SSH~vC!JwaO!t2(sbj_^or5oW{lPaBfc!@ckxT^Z$;qe>xis=Un&*i_= zZ|S7)1KYq2>+H(tq@qus`Raz{6?dp@p3NFHVlkXvJ9F0`&0h--V$K-!wEugw(clA~sSEKU8P&Q@KWmIbfBH3~cTOjYcSTm|!; zo3ryNIjZl9*dFWdSQvKtXC;oz;`_WeLUJtVc+p@tZt_pG<1}Z}FQSXn)Klg3luxos zM(e+#)0+B9)i$vi7KSx-AOUEHtNqjGC!Yl*Jg)sS}!yVE9^jW_evxcLfVEb0$<;hjK#rDK%2&m?y}A-&=i;Ve`EQN=TN*VA~PYCI}K|F`H&P^9z`&H4NClOgo` ziN}glNkvlfBJ-(kyw_e9Kq_C)HI4?@C6|qoD|Vdvbi+gd9VAHjGG-aZ}-n z=ef2RyO&MYT&5@QkSlv1EF6AG7u8FUZ7$aQsaE6X_?n3x~js%N4pS2Qi4;b{q zlK(v7FXgaXu-N5#Kof$_@qUT!sf#?DcFN?e+2bSlC28jBi{k}p!aQ!?tU{Vrj9V>l z-z3RuOP?o9+$53SlH@`ie9I-DhPB$razGx*AGQ*DldkJI7p+$yy%Kn^zB}^amawVt1vQ&rDzA&sSwr`wI zSvM%K|43CnHhlDcjgEkk>`{-8!ExU5%a`@%NnQ#FcR)^Uybzk%S$QRCItB-tYZ zNscMzwa#P7u>2gb5Nh&Tpkm^J61Aet#IT+J)0G{oSTxKDl}QYF=*74u)P0WA*qS;N z=Ccd^z(!VJCRz)Lk%^x866Y*Czn9Zsu&=*Jl^;Y$B!rg7{@ezBUny{_@OticGa$6+ z4ZMV*4>ew+{Dm*sBYtN)2qgDy^n%>*)L$;|;M(2zmN+WTZj0|a4<0N208!F<8Q?<$*5iQu)<~iKVd?pl=JZu?y6oW*r<0vPewS z+>0e_jjx9DO=X(s9jxVYNJ5*-_f60cE7;t%dik_sZt#By`m;ZTEK1xW8fVjF4rT_RK;zX0;i|U~jBNEYKI-2a;d1Xj zap^A#p)Xdx5(9cEo8$kqW0WIzzW8rz>O#4s6gR;Et2layM=wIf)%ImDRV>y_P774Y zyDm(ugH#p<7euYn&t3yNkh*{8v@J=JkU5$9PcLUPci&k0+}&Y(h^^T3kpjG$E;qA& zBWIv?2_vYON)J4LWh6NdBqGe}SN&#lIZR^STC6*K<5a<#dwY>cRIKJt?h~9R+dETK zyot-;xY-e2|BSBG1qK@>^GST%XJlcph3mzGwSCm;)6|My8rpEjn)?jb?mwTc!Al$3 zLpGTuCS;CiFI*3i=Y3eo$_=tKc}BUhObanKV_qOq==JZq`+KxO0SjF&toKRI;XPF` z#U3P5_+5(4$@`!-#*v2v5q(@E(ynC^>r5YdD#&)9DUm zO!58sXhuD1)AgTTfX0sGfps;&&c#$BkWnReZZHaR-H>(;{ z^U_qh?e%>5^m2t3Rj!N4eA5xWF#;n}C>1^#*1+yVM>qX&a?(lQ)+Ehg)j;W0&*14s zg>;SzD|a^IpZSXzza>K8`AYlY-_N1}S> z1Y^R`%ECe1tAf*;OD?zYTVq8J;Ns49_I#`*I@zqA1QT^)b)8ba1ADockI{nXg9;@( zZ9bRQ!w9_~=Jo{X^B-8FcO&(m$9BgV=3!Af$0>^#C*$jiEyXFvmm5}X$bvmzJ5v)R z)}>oj_G@}``a+W#71Hs-_9WsGnd|cl1GA*BI~*74vss%=nM#-x-r4DpRoiCQmRCLp zK5Z5n*{@Anzs3~iPH~;kSV$;J-H*&s2>hL0-RO}^y{8E8KGM`Cl&<*JU&nRE8+bk` zYVUb0#5(w@nZ1UsLNS@hAdh&m?o? zY`D+s9}Ew(#?Nb5ErrhX_@$ImIez%Rlj?2V-|Af9dlE<@_iguh;-S#@lAaThJdL4$ zW@bi@It2e^A%3*!sJn1LX8$o{78~W>J@I%-WaT{a(^lKO`oC|5b)7lb^wlKDQ@4IxM2E+X8|bfeu!td^nF-$c&fmBWhwvUyx^gjIufuz%$$*c{clH59%XHX#i#X~E9~|S zHjC*ENr4%ifn{)UADxfNjs)*N*FHFd{Ed2i^u+1q4PSLIuRQGxhY@9CVX8;43FGD| zPwhi2E2&-C3bsYDF|zO55+b!N6FsG}{l$pwmW+WfpU`Gao?G8ew2DgZI>dbfVGycf zXhqYTWwZZW)gxK9fbks%QickH=8r?}#Cm-VZ$d3;Q(+^jV|Hf|>w!1}fX6oRSKCzW6<8#{0w%+q6JAblztGjE^wKD*aH+ji-z z#XfTEG|S8lwzVzQHd*v}wE`&B?EZ=$ODu#yUMv{)F7q;nA{cDzhW1nz8B~CoSe#ZP zWhl~)RY)0_rE7ADF3O`lw`WOiw?y)qD|Gi|5afYy36&@DEn>*2b1Bg%(Q_d)`i?%h z`x6Y`+4GVkb}Xsr-Wr+!yAjYK_2D74{NYqY_SUk#SG( z51ZMfv~Hib-yk~y59h7h<9CKto1ZZFXSkGXdk%y5mH2A+L|8D4eMflJzC^4xi!b#e zrS*8TSbV~@_OCA{l?Py9lu~?;2nK1Nc*MEAw#&MBT)P(H^9HdF%3{|DesPFB=T)h2 zQ%&og1Qt3)2kpF5yx98m&Ug^DUq`VH&3ZZr`EMX$nd|(M#$fzebU*+B!G>25nS(8} zX=5$n?=5~?R6sXuh(@1H6#H)Q4IBPItaNBBr_6OtnR5&*2iOT_kg{lXkG0dc|K^kQ z!ILF;vn9l*;Tf0P7hp8$Z-D!{pvYI9TN+zKMG*=NyX-`(=@8kSFEg&(N_0TkZ8@eUsOm<}4f8J66+i zt+TQ!VH4V6gzGnrwXsggyNQU~klxxHNs(EMGZ2KWdn>2@AL#K4s z)aQFD*|>~K%4AV_L0bMEOo$?~wRQA6N*qb)h#fTH6R6%y!@ihL%H?d##*I&NrxU$`~)=iO`S?qz(^!ETY&!j`_yUr|ogL@rDh@y^0t(?u~{ zz%>(x{`EI2%lZ7sGBQqD;%B>NAxD|RXj&G&l98`A?-Q&<^HJid!B`cwyR zMzjuZvAFh_m=RH&XzV%XHXn>7dat&pyW&nuP#X=?6}6Eac?Id6^He}g$&v*_yW$i0 z`r$+Q@!BoJ3-Se9zv>OEJ>N`mUkB~*_$y0M92A^O;|8p?euUM*CwHV=4lZgZCadB8 z1sqmTPt9m+XeFo2J1%EgeE{j~gesPli^OXmcI<7xb!<(jta(Gc@dPJe; zJAW>YrFEn zHvGmfCTKJ2vA@>tqBV(rPfa$C_#sqjzZ8dN6sy0`ogyLM zv~+uXq}F9`gp|G6d%gVgn$b(IJecJP4yA-w?{=ePlgGtgbO(2{m+rL`6xoM{zI}>0 znwqse>C<@&833mE5;ptX@95>#rcHaV#CaDiTN|2;##W7LXNqxwS&9tMRqUp*WM5}2 z(hVUnf5|kyk24B_$X3*5Gd@4LEBY)%%Mz&k=&2XR-}kF@$9i9Ly&Gco%ZpNih*ov@ z+tZtXn8k>juPo=Q;>@x-47GPHj?-y`3bJjG6t$eKb^A{*1(x_oq+xNTeS!zHNsJ$g zSjK#_R54K&g4zB=2pSoMR94GUmzL9~Tkuy00q4I&6P2#7-V_E-!ZNm`c7cy)6neq>>i^BB5WS zb2Q7)*pSP4Hkc!+$4jscNAJCf*V<^8)PhtcEIx2q^OW}8HlzuZCYIQ4XtFxD^;oB# z#i(_EG1h*(AwW;PeXxK#R_*Uv&UGhzApMpL6P8%?{enN9$NCl`{wnpfFXqjNrZi%Y!$w>WIa-cQI8euKmf}U^4~I?#~)tcgZVR{{r= zDv%>QwEmpq)nOSHV~$LnSGILF)1$zvvbtjsMWrjvVLDIft4d^8huY)auY>D^Wz8DB z6=nUU6*4v_@hKn8!Nsq@ds@_!ztbm@NgWEkv2wc0reZmvl*-qf(mp14CR=^V zM&|iP64$_6mP7w8qiAQQ%MRwuA}6gkdr9c}XY2IwSs_0j16;DAC()Dt(Q`?@g1Gh; z@T%(v&I6%5sBZE%IP;5(;4c6D#12;!OAWfrKvnG`(au#pO>Qx9(aKI61FAG4?$ ze=w8qSZ#}KRUKR1TU+tT{zb(88E&`d86+X_t#~CHj;Qpw^U&9)3MbC1{Gvw)nkIvS?g7jh%U=|;=}!|=w{{bH{XwZslZ!==3l)Dir)lI%YiY!A6eS-vgPNb))Ox4$ z4_~TlS{5V9mpU+>Dsw#t-2TF#%ahl4@zOqMEqAOn;xsQS(0&=r_SW1a2LB&^iKNg>|>G^ay42s({$jSIq$W^ z!!7^f1^~7H)W7E*RWh0_f&T>mU6~e>rJpPhX7g`~2xfb<3akT;EU6ylaaIhm=8&9fbPf<6}&M5SKAD5Ss}L zN={znD2m-(xokO5zg_y}-iun8rTGAKo#+?d(=p(EPXafLEPj{10uPo04{nDw=LXy46S|?1 zpM%@PR|mrqaMZnXp~5+GqzsL4=Gt&;#t#OKAr&{8qRx=z^bF%2jcoYzkCH1t$mB)n zqUpy^vn{xHthLz2u?{cs>Nzg`Ik?yDflD)SavPgrpQu5Dnh{wxa|9jbXy%`X30ZS})<76z3YF9T82mU)epQ={hNMt9pZdU^T3T6F@| zL~^a}B=Y8cqnw!8pZOM+2Yk3AvZ^F-Qjt2lI~G-Z(xOqn#vqJV727XMPGVq-EfeS@ z+li{xxROg6_pNu}ND^gewlpe`_Tpipwt8K9!@hJBP;i@gJbYvtduB_(y&(g*LUt%n zE#^ec$+ggj;D}4{iG3>SeUN1$uiacA*9M%KZ7^is<-nYEUg5koa#?H?=d3;d`o=B9 zNM%9!psgg(YE>NiSBb|$07}t)=dIhHIQ2M>VFoU?M)#u<8Y=3fBUAT99(p6(F09aE z+t726quCIc-Rk3-91K%{&>|(qqEI&dSs|{;6lcDSc^~(-X}@zCIpdX7U|r_bNP@7g z3Q(ggybwN5QC*!~*sjEycG+gx{8``w8Z{IaaXyr8a$%4En`z<>nmv9ex z3X2dggu|f1ub;T5rq1kbdH&{A2^QQ{YKyVx$ISW=XR{^3&0dr?MWCby;v5pu=w)E4 zUx`8`K=u#bMG4Wb+b|ch(F`jS)Qg?V%wF0VB%_*p(h$G5t;2D0DsG$jIZhy-PnChJ zKzwy!J=5dWe_svevU$(7YH9r7}VNE(zx2bk=smGhV?}Dt1cmXME502p@DSI6Dfx0KU~-y49Cq}J725PtTCOt zc-<-M)}X50Htc+hpM@Qubm}gO1}Y3tcPi6(Rg4fz280InbkKrQpSg(D^hb14k&0|N zj&qbx8e8=BC8|wXt?>3xFRyVY1bZRj{0CB76BwLGe2nL8{9OJby|3&;tz|`w7vB^e zegEx)kTq`UP`fSv)$IbLQ<3uWnR>{#3FUVoQEWP!jinK6V`e|5v;LNsOUhCz5 z@j<_m%qdw1Z?4;H9jy6cBhhYpJTdJt<1VH8!s5FrNC-hG)IL-LGBKDA=sXaO6Ia3I`vw2`} zml}IZ?m{+iYdgPJYX7Mlh}g(@JScne0}3Rwy-?|qG$ze&!EH>ucNS0H5{s4CAUEM9 z$hH2&-j~>?XY{2m$WZ`_)?z+S*=@t}(7K>JF;#nf*VRahe#wfjLnEeyLEVhMT)vJe z1P2j1g^B>f-;wRj0urC9mj|T!yzgen4-Ru2Kc&VTEPZO<*sI%37La%hto1SW9Zin5 z=%HbfB)l%_=a!v7W)P;Z^)Qof__+Lf%JqSA2~8f1nT3Lq?Dv0wp!u}u&$LC5AGed5 z9pegnQ-^kUi2w8~9?%@((WpZCkyrK}Z=rE(Oly4FBb@HiU`GzkzzfkIgrvq5#Xg0K zI@D<5#wZ!UUPBg}tja%AS60zJhg5BTy=jCSElWE4;t(XiZ11OtO z=h^d<*J0?h@mC&qGFCT9Aq0PHse79z*%omR$>Sscfl;XBWcvRDfk1x0p?Y!PTDkjZ z{Jnym2gg}qa^#H1CZj&0E^oaTw>qWWH#Pk3j=WbP z_T5#<5&Hdq-KKO=rStaNS~XM%^15_U6+u)*eZJQ4K+k)u+y6(}7MJdqa9n4D zNm~HQ*QV<0v*|kd&ZG1mMWSE%)OGT0N45AKvPHEMpr=64%e;J@eB)7~To2Iy?EXn| z4(gtMKV}19oIb56R0HyE{X7R=5PM$}&K3RCadIndHhkLj6R@^J9!xBH%ET}QT>q( zCLPni7iMGY&M{(Z!^Z?6?qhDz{|*8By|8VJdo{;Q_h;hw)23_hTlKp%DsxZmw8gh7 zS0Ax{FE(Mqx`cD9xQ`;3_G-S!u$4TGt4Y4!zs5 z=m=3d`H_lMhjDF+z4;DUQNW{a>Ul(|?n_6AG65jFGe=Zi=Sh!rqu9IU=TxWCQSPpD z#6h0{Y@cU?6-$seZ0|LT6Ktm#D{r9gR9$c`x3{!5^IGQIPe9mxaec>FL?#PLwh&6y+X-*wgf<*>HjN#mgW zE90QdI12=NS3b3ikhCsxE2uM$XlE>a+WX^UgO`9~Q>mz~;U^#Jy969=UVA^p3(`QI zp4aN$NB#Kty^nR{wR<1f7y7qZI&Y8<9?|~R3AWLDm?-~FNN();i#N#8BQ$m>Ph6Y1 zbZwqs^Y-5$zj=fxed$_Vb%(X@i?cwg>omSAa+=<;=78gehv_#iz4@YeT=So^BR@Gz z6gvmyUjeD^1?@hL_WU%V&!5BRr%71|q`LpYHLi~_>U~%rWAUVRKPQ?lR@qOFtNdFb z$RiK)^4a~IJO`wKX@WFB#}~2=r3v5|!vFliYe(J1b!C)BK2#+#QFAf^D!r5E@yX3Uc%UQKFBI)89KxrT0i3IKJ~S zR)p=l|2k)5tnQOH(7NkWMYZxUQGUfsnLj5a_gBo^yHjCO=pk`a!D?~SlZQ1u2=UXN zfpKD&>k;UJ@uKRQh_-He8V>qwG;OyN6s_GemZ{~IL;6jkXk2@+r&ybK4`MWSB@&SFXo*l7)R5u@_x+RB+g7IGAL@CpjQFA}=+WY@dDonc8 zCaOE8it2T(V%MJ!QU9>x1L_~54T0f;s5Tb|gz1s}!nC3f4-tj>V7G`W0JjnSv+ecT z{m-^kQ9Z>$%-&&}-5fYNZ`97d26Y|y56#B*M6VOoEk-@pff}j@x%*?kt9d>4O(xpK zkGqc@W$t6s7)+clr;TyGa*~i-?Y{BlG7q5gerZ7ac9W0TZJ@@^Se8ztXEeAr1skZx zNc>%`v43UtaoT%tfbPBD;AGY|?}9|1$~beX&k@zF06iXFdzbDm6nif@Lf@xP3hmVH zXPMtgp}z;Q?~1udCr7`jtr7vs*QA14&x>k3kK?Vqw=m8fjI%D_^Y@|+?z=#?ce3A- z*^LMfoA|Zh!2smm~+^D30K?THWt5656*oxW~TU)K#R&louwzGc0I*3)z z?>YD0K*09*7u=7}*{^-YhF;fgg>K4;e7%AQcRXE|XFl~~8*Smyj!N60GRLO^&V8L|o>D2@k0_b^anofUd_)akFs)cFNzwE!Y_ zO!ELDm)@kY=Ml2%RRrkIVSV)oSrx(qpEr!|isjKtdLGg;WO^4F!UvJ_V`TVXIe(WI zAM^=H3CG9sEEi+Fazq&U3Fa9u_j2^umh4Z-D%bLe92>nCpEP;`S><7&t2y!r8Nh;C zPp-MNTY1&_^K&Skl_yHbG0Zx@n7~670-3P-G1@_(l}NC zt>GLHna&%AY_e?R6J&6Bf(#R$bhe*}cKe+64Zi9P#%};Fy)uj889~rANzGkmty5=5 z?@2eUSJd*l`*igSF5!~K>x^$MKFB3zHxvw4}?URFL41}c!G{S=RBa#%;C&o^!hoFWo*CiN9pxE zTgG=hht}y|nd$W69%Pou#`NI3J7FDtEK{ekJs>T-IwE8b2Sj@~f}n6u(kSLYrH6nl z+lR*<^Cf?>sv01mtG{m*vJb@iR-BNDj}$@`mJKxz=@@#llnl}FA<$G0Qb4xHF949n zS}q)mOC>{aeFzQ&VH*I`VL0ewBV2g;Cy$UJPECeTvFK_D$+skpS2^_FSBpocy-&11 z^RtJ@5Z8;TN3Zwyrs4VUqLYvD+p;Dehmx<Jg_5r)!Xap5leo z9{SqJkX6gGD8Kc{Y~H!O?~@w&2-|@sKDnn0@8`7hN>iL^o7sMQiZ{NZc_XHGw9=*w zt+XwRdV~zs90;KNnjE0{{u!F51IIhagFXhl#p4WpPF~AHWath$r+xq~aX!?3N_sz$ z4^)Y%^>?Vu{?t?75NV;u`eB@{&WZOJ8Ax7R5EVa-b@sE&zHy#QdG#YokMbe8ZGjpt zX{>li=^7QLJ;PwOU-f;{K zGT;=zrJ@@XDF1@n0MNty?)qK;EqH!od4Tm7@_#%%b>;wlK7}6a>GilDg&=zI3XK$7 zlEytfp>j=tE*9&pxUIPl>HOXK?Pm2~YpwBV?d` zA{P3>fZW*HWH8qL$kVs+I8`+dXjy`7v$&7QEG$2h5WPR0j&X3KV;p#{<=;F)1}w*L zxo%vj>?p%RA8aZk$3kEG1yJeQ)^MsOQGMf9UKeShuRRHrj&bZEGQ5i9QTyUe@$+~* zaQSpU(raL*cPk#!X8@Y)Dm-7RxgGJmxPC9O{pHve7>egF&(()I6VOCcr!1&(o%awK zHenvmC5<%g@Y-od`v@6yoVGw6uVW3Uo=e+@R32bK?Q6&F!ScI+@#Vzvp;GKb8f({6 za`y3K9*F*FKRdH``LhS~*_pkm^8>M*>Rs-kwbn0xM8`ljtl{eGBe{Bj-WTe4z01|O zZJf5CI-7}Qm~Qd?YphFfpt84sG%gze`f!`h`oc;cy%$sLLstD0X`x@^N><@=aDOd* zfDE|3v<=jo(tj~MkQQx$xPA3w!H8wSlLvGxU)`GVW%Xl8qXX6Fz01FQK<`V4Ghby0}=Efja*x@tk!B$8S#iZb8BSn1kzZyj5Knmkj6#K`98A%DqZ^ky*Crf zfNE|Cc#_8I7pRgWAgOkqq2{A5mg5gq2M}^w776;Fv7I-8H2!CLfcEs2X6Zw$!0|G5 z4wo)=-2-F@#Pv6$t%`TZkjgwO>1r96f!;W{+~r4@fH*S+{u{)vpU5()K6TLtO-}npV0$_OPUBrJmQbe6Jko$_@t3f#WwURANK$m zxXa1BMSQaL93Mmtyk6y|`fPeg#YK&zbfM~qkT|X&sI<$TEyf5tN^* z{vmQhKRREQ5V{&ud7lDYGL0d&FDSp|UZ7(jGq|)}VW8t|Yn_3LGdqs?s55C?^xUa+ zBD2q@j*36i#V){e+?nP-dzig`wN|@(HDp9|+H;9z`<#3_0 ze|1F24;(=dPe2;?0#x>op<)~>R|5C3kOLyF3uzoM1@{qeGuH)-M0G?6<;$(+hP)rQ z$SKFRP&jjbuxUSa@*7(&Jc3k7N9OWY94>nodaTMxE`r zQ}3-qykz#@zv6Mqf8aso3;}8E4zzznC#2UhxenaT5tM&~`&hyOQ32QFA8;){Wwt)t zRnNvezX0G^I+rwRB0&FyvKhLUM?Ij|gR#ADq|Rn`Y2O=Gh3J?7tRv!n+6z!2VRSYb zkj5rAFj|1FhI(Ex!B}t4DdW|ys%dZrHY7fI!b{wHjV}Athz;gAZ>#+ zh&%yuvoG1`vzdKWQ5!rr>%jebB|t^~vkAr*JPze=!(-{86Y8nC`v4hg-N6W4+E-A` zfsxow-*g`t;)Gx%sOOYEOYavR+j+k*Sb}KVeR{umT?6PNIJ#J?`^Zq|P8wGM99t;_ zV<}hX)I#|#$&ghDjeLZV+a6|bruo`KGcCL6^MJTeRo{N^PT3>$Z~E*~E~k{z59U0e zVlS(1w7>5=ycHogF_*0B&!uBy#9W}_hCJG`KH>1ec#+wob-@(x>uet9+ci#r(yJ>v z&R(H?5E)#uisB1QoInsq5ZI|rnSGpan@n@c9jMp=N?*qH#&s@b{LLI8h)S6`=5bD_ zUqs6QAFzOtRC-1q$9j6{f9%!8JjC}tJwMF%f1Z6u`Dy;`tczUwtP7!D)oez)UGf#b zMI!TcaPxhoT01ai@FA%4nJd?xMz=Npmht1rG!e}iexTqaQG z1mLmc2!e2*nd)4J5Pb%v!x+75Gcqg@l2tVbxl#47hCp-wz8}uJ7Z@{s0DTXhu4emi z`n-x&!#n#`?_qtOPsI;*KEKAHTYFm?O!ef#$oO6)HIEvYcN{LZrRaUxvir15Y#K}& zEqS_{eFW%Baak^wR9U+L9%D3xQemx%a z&CSU0D?)Con0V*xIM8d~(eb;ujs}tf)ZJuD*I^s_Z&aCwkelt8_t)F#xExOT zrvMcZX0{}@MX>G?iEY_e0?L+6!?L_PRIYL&sdEfOn5nB_ifn>#;t; zA+WyIv)sQK8QkCS(!5YPZUE1%vknxt@J;t9Z{WH4L^gNsgUQ%-wIr(=v8}O} zqp#!jq}DR#;`aQ5M%GOrjk;;H-1eZ?;OM#Wsq+JPv>GyzY}vF?-avyhS2B2Do4P(`#qBe0-g6qvuilRadj5iC!D2olRENzCl4){>^Nn z{T*>{P-VO&S=GSnS&rZHb-GwQzi?l~Ig!Ryj4vMB?B62f7KC;3*<@86WBc7}>ack? z0JSINSOMsq@)2^QZ2MUeHGJb+wD1z+#ogbZy|Trl_`OGwjkKveBY z8edEBxb!OL0&Po@F!p*KrGL8l%x=ayznhP5Gcw?BIf4#*6OWsFb?{^IHKNWaF^%or zCS=I`2L-ASa_cV8Ii=uhH=R?mX?=6df3I)W@wnynJYM;L>WGjA5CochivH-o;(QL5 zm3BEJ1nWRE2$Nr%(-DiI=|=gn-9Q)nkH(_xBtS*`ev564FPn;^onWjT0Y>Wg?Fq)( zATW0ILk{3T2d!@F54G{B z*R{N`85!z=NaNlg2I%oUroRRr_|#1%jqyCPDwMzAlSSAr=YuGoOB%xfa;rIQf%T)n zSi2Ic!kXyw?i#U8vy!Y@)tjCNHI2xyh}ZKm$pO(TOK=nbxZwM64z0)F@3N!mZ_hT; zeg>>3LK8ClfOUx+N#58#pvE=$zr{N76FQ z?O$xV8fq**1$zAm%+`;me%>0HQm&{gti**4HXL zw2qWd?p6ab^cVotxjZwdvs|6aOB?9;Bw`Kd>nDQ|%ejrz-(ccWG7r<^N^UReyp=dE zck?11JdR-eFqGd4AtnZ^S9yI97=v+sL8LJ*Ii4EdY5)<5%bE4}rnKN$BX zwlQ(q?;DwZ<@GF2L&%WN1)uBfXM@vYi^uf8_P&|#jWX>Ca|39px967u4=VrWarDo5 zQ2uftWm`~dPp9da&z6WrNBxWjI?mU0e&7JyhI&V;e>^}}Gr6HXR=K>xFGBB^dRgzN zH=3O%O2r}c0jE989yRlI_2)dx@>e`wdApBt0=;ML7(ni^@(ISzxNz*cH3VRpqq8Q0 z_AvW9O?x}13PA({|G?^{y`0<~IBD5E$k)1VAX+7e8iaY%8gH@+6i#}NA>f4d4HS!vL+ADLgB%cHef?8vO`yY{ zwz#3QEllqr`{ls7M&yQhZ~X+)xR*=$%^qW0X4N|+!gfp7H2s0B!s+TLSqqmSCQ!e> zk@8=3YI_P7LgX@FSK~jJor(M;E+)8apV?!iIzh?vJBP?|_J*4EIUIMbJ^d=e7 zV<baJo<4QF9zFn0`m{!5aCwa?b?WdCoX3vE;|8tj&(RkSC#!H? z)0nh4ADq4;EwsQTC%w248LF{eDf~CPvV*_1@3-j9#B2$7Ve^-Vmt@@&xU++!EX1csy)$u|dd;2M&yW&%bi5p7zn=_L=ViGR<=? zNoLgp1exrE@BY(1=-7j^h=8y##j!w(gm8WDTqJt0YdFE z`)BVV_oJSo4PiU0ct1%%g|&U$t!Z|Ch7UFf*FdSs|+&!^w;UzxvS@+-xg z4*%QUoLuv@?9A1`#QSi3+T|f*A1$||#3*bQ}6N{T(`{`c0irY#)XR5T5JRHdig{)AOoi72A*qqBjuOrQ*Js7p|Fnj zU+4fTfh4oA&R9x97M|-3)HmJRX>^aRE_UlXWQeoFyutNCoE>Ek=Kia_HyA{N>XD)L zB(tx^flL$IQ+}>00Uw;)E$CPccWX!^twH3?gOPO<-=gbvq8=Fp)nv#U%=dbbMnSj8 zDxZoIW!;x{DUgDHXs8|`#?ih;WC$7!7*?8Z?4q1!^h9o z3v{tMTV3pZ(DlOYY3B7VZw#X12dME8<9@Wz#nxMb9`}Owo@WQfJ}*#Z9d))j?K_xVhYWkE^@NVLs_W_YK{XlTE+C(U(>}y1+{RS{$SQ6h za9T5u%)&b2ssT{7k`HNQ8xlplbPv=ylScQpxMyMjk!~`D_o? zlLnGibw?@LlI+2uzuVtU7hCrY{p>z(eXpjb23>~%YkD!Kddj}ajt%XMD7Aei?aq12w~(sTSzN) z0?`m>5Z&WL+Aoihs1N939RXZSv`a)nR;N6ifX>4bM1(b+ht3g1DV89*=KyJ|1Rx3% z=wf-)-%4^Vmt=O=(_^Nq8CH)Br4P`^Do3hbA*EdJz;=4}CaL)P#sPditsC*Nj_1SU z>S`K;z<9lm)*CTRx%)$FogJ-jdK7in*Yfz~e)Y&u-Gl;)Y#<;&po_)y*F^pONP6DY z@mzfPOf2%3Z|ODn;(BE8K*$ZZ0qevHE{J~S!-u#pp5r`s>J$Ra{-{B7n3AhgH2AN0CM@!S$i{5%w;R z0M2mS-XZn0p0Bfkk++Pfvj3lCNW1_>nwL{201>|D*t$54^(N`R0rV#sQfCDLd$?qX zN1J;fE|>XRlat(skk7)cu|7jq)gL9R76Bxm7J!HlkX4n|9W?lymrv0ku6x{{NOTs{ zomsgTyWEq1(EXr$9u&Bmi{%*C=X{rMJZ>RTvZ+7*heSzT-`_-{Z}59Qq?NryqHo_J zH}@gXdb$~*o}2)R|->S8tc zYORY+`+xU!)iCQyv`%2s1;nYzzFL(^p&^F*4GZw|A3{h}DXDUWOiCoE)Pz{9mLvrR z_yO|+lq#hR)Us5SMy^$<K`?j}0YYyqM}Xt%^{k%IH*5u~r-}*2qF}(;)%2fezNf2QUr- zVG@uq42Hlc0GJL|kOd!u2(&OC^e`91kPNP14K~1sO|TmJfCr>Ps#vX&nHmT)ROxDo z42~qIRVe_Gs+1JD79=~CRriVXnf;UDlI5gz7i^h zZ<0!ttikshiCUhj)qrY=Osx=S`Qm(iHCm}$39TB9JSANr*2(}TC{*!c1&9?2Rfcc6 zQmana;DU}|3V|aMu_Q_6E0wEFKU2h+zT!j~v?e5|aCNEwedFayu{sOqu1eRMo~c#I zGNo^ZO0AGGk5c3sja-@N+lk`nS4x$#<8c=AP^FOiic^zKcS~gI47FTqDpV~?P|Gw) z(3*sY4qD~rgMK7gmZhO8j=Kg|o%)d^lO+2}WNNKEK`z1VSE_u?lPOicN|`o8rB22_ zQ`M?OwM?UdRJB~G^`*L`{n-)IFW&?yq^7HJr=+E&%VkWY9WmiA=4LtCVmgLoC+jL=N{+dUtJMb%prCiU$*+G_N!@2ms+m*an<$*g&T$} zo>T__UBJO{j_r97bpMx^TN;@Ep2LJ>*K%bFAVrTc=Wf1rV%mLcaBfHe(Xu5JX_%- zzIJ`N;l=d*5$DRC-u=&M%-2)uqY}@2bF%4va<4@@|C*KY>FsltcR4dZdqf^PQ+1U* z{&m8r=}TW%WEB6g>Cn}w`+MEW7go)AZ1BHl^;T_XyR>BOm!GP3A3XSp*OC)|7JlbE zZ^pwH3xlSg>UZ(VHw8~ze*L>(>_^vn?H?t1MXa0jt;0X!@ogttAGb}IcJ6<%H`Fr+ z-<`PcM%3K%>L35!JnvR%>ZrDbyJD}e8rx5^^!2udbK?(hIa?99Wb%I9vY(H9{JZBV1li|rkEV^huI%u=tC zeGk{=@i}vA_x@x*wd})Q({%Iy_%-9L)ynFT^JY9&PYgTO}bJ`j-zE9si*M?jiRpS;qsrmK!^2qzPKHazai=~G`e_ww*@Z{%# zU-gnJeHI3AAKHIYGpitY^u@0Vwk#a{$*8~Fx1L_>(qAqHX5MKAbqtDqd$bb)Tl#;xk_4 z%G*g3o-XEvigv#EXpqD05%R`KH%{>E{HBeqoNMMd?`2k<+;-w)_r@f zm-g`L8I|WxJMOl*cKmM5Z`FB?FM0F+EPu)kT)lsL%G#}Il{+5qYN~(Ks?7TP{Kp%% zzWaUIvz=gja#q38L*k6^1^V?-<1Y1W*fHz)fXJ(L+SBvS7ifiZysWl=b$+4h%;LF& zZ&im?v<%)`9+&X_qM=XS79Dn5bok@F541TIfBlsg8hZY(UFzX4<}AKD!@Z^E!BX!Y z^>sT6MjU&zj?_%+_lpX~mp)9spLDSMmOloKde-k?{F;rc{5?dUe|qMeag8v?^Ni=g z;cf~4e6aXwX<3CNSZi~o^p7>;MaLK2da|O2AkV|_!Ih~w!U29OzemqoUp}k55^inP zYqH0gZj)Xt9kOceF9Y^ZKDzl`xZ|)7gUjd6*p|ruE$h(krK3)HdU$=;da>+{_dWL< zOSgK*{f~X0oN^u|**$l9J#ZFQWK?XG9G38=!r?=lWP57)0Al|RuFx} z+6#%-y>*p^S7LJuJ_KY-}U?E9p9eTxvrjce|SPk?-;fFMeC)Hru;PY z%)M8olH^-A91Pm^Nm~ZCo_D(*;x_8o;#G}dTb2pK&$$cN7M!sxY_#nw*k^m7Dak6$ z=Gt%HT75|LF7u9Vbp9}GjNkS}&C~LtdknJM>bGgsgdE4){SDJ~CA&cF_+#z5H-|6Z z`swt>?`<6XnnHd!;V$|y+7KPOCVQXi^uZ6TmfWZq-~V8GnALYyX#Qi%tpkhgEI+cc zIvJRrvgGdWHL_o7b`P-qT-I`1_KkITzx(SKj0m0n>PhQs`=>W&gy;&hTklrw=u=y9 z_P9gP#`tMl2P*h)MA=1q4=P&joqhWd zd>Qqj{_==v%P+1Pa>!Y?|I+l4?^t8$sXZBwZ z2QJ)lXZWQ7W2|~Kia6e`>m*K(UUwhRrnf2OcUzlnJ^q6M%Twn#Kvp`Ny3bQ*i(2577s`eWfw$ret5s=w` zF9F0urKD)*j+p+Re12j^aGlGo)ek~`n(p<#ym$KAVRwH&F>`tZatQcyU-#AeaCJ=2 zGpnjj9y~VtahTP^EZd5*PCJ%$K7qcIsW36iQjD+=^X6*v)gBFvM-mDn;dI5 z4mjao|9jn!i|n?Z+~Mr_?aQno7m~cE9JC))w)~T}fG-=WD%7Gus?drtF)e@e{4$pR zBqZCK5xVPvXQIjFFF&xVoZrCnitnkrq)uBIH2AXBM;Y5b8??pN>$8nw zVbQVN4KFr*_fRqY(lFn7i6hg79-ksEc<$ObH&Gz5lzm$OQijN1h69#J>3~#p3TZ zDU(hPoj;rN$qujYhj%+(ztDQ^L+fnM5B5g%p0L#6Bi%oJq7(0Pm#y1!E>!lz&ctgj zqa=?XRmaco#qB#mw0iN@Hk)fxET1srYrMYb9NuqeCRlmW4&t6 z&jI5;f1{Fmt-7-8wjxCk&71c{sp6Eb>quR zc}dRt@p0ZE+mT*jz5drNcXf2{8J%CH#EHE@rVD@m-EDbqBObB(KE-ExV))xn>VA3ymY|sLWVEMff6nq#RSVAaXxP1WgvH0bFU3a$&;Mm>|I0~@*9K2JS+}Ej^+cbA z>VfIs^_$dd_vMKL_kLJAT^9pA4;a3B+Slh!?>=y=~(7Ow}}ZuQsC@tOP6^9%MZk8|hk6`vkI_t2d)`#ehW zSDbzN%eIXRH}0FK$jM4Lu|Dxm{DS+_eSe1K{i4s@63(=3mi+$2{pj>-Tb{!8Lzlli zkr=gat$pA1=(|wA@5Y6G`Q!3yk(N$F`Z0>D#fpWr5R^qmK?QkWQ+5v~7~?UELF@ z{;pf_vr$eFyS8w(zot755r4O3=*83b{$4RO@Kfot@IkY`C~C7Tkqd^c)Ge%CaJ#X; z^PuF)fJMa{RvKPRd)l|h#$jV-wK`?}wx>?-`Z>k>ecJGF|5}dc z|GW*CzJ44&XOZ76Yvbo@TY`s7Ib!{RX6mvqx3l6?P`Ga1*I8Q~{JCEg&kCD+<(vIy zmA7mhmL4x{ZeBg*_2AmWD$T>cE5Z&}%$?!ebkS-;px-(>-}pIavx1^w_pomsZvL%D z|GI?2A*f9)m9+~?+KxxTVTaDbcV8)?5*O}^cdu!$>Iw92pEYyAD_q~I-MPLcDQ&wQcp z*(ZN?|2{vDyWfLX*zeBp7mI5f7y7C4cQ#G==E3V#V z^(ayLTgzinJ1=cb9k(H1#*~;p`=1oQoT~7i61?r>F9e@^@#2r1J@-|D)Aeq*h=Gd^ zq@LU|ZNYHml|>-~#yYJXF3Mls`^cJ$RzA@may?4?uN7I>efR6kby^GliM6%U3`36% zsTwLCGylg;4=N+FQey{A{*~i<^194WzC5#8(zklpj2R7QZccqWw&es$ba;HgNfSgI zTQ&cSQ_W{*ojG`NkInD%W^Qq-y1H$(>&+csAE>Lnd}B{x^GvVqKZS%`-5d5p=xwe# zW&C&dzTxLwQSE;i+HLggr^hl++5Zv#eRK5wV}Ary2um*pZCPIW`L;08ixcYZxNnO| zzWbJkU-xl5bE7G7)6R_-?;ZYZ-^|v`7Xc3-Tb0o!E4pG^TvIaU7Wq=(c1s*2v7Ivx;08R{dCYJ?6=_+qG`kC_uLdW=uYd5D?|5;e7Mf%C#&Cl??!Jt z`_qwaM^6#9dinQL4>VnRURiZ$=k*lj!@0Jq?0vbLeuM6BnlHSlzwzaMB6~u=E#HqV zv;1q#(>-au{WqT7B3 z{naluclR##H=Gin>09N$h@Y^U+ZTt0UjP^S)d4%ZRfjl;m#Y##m(36R{-H-z%aYJ14x4t4cCY%n zW{hTY#q+A7KZgI2U10xY*Q|br&Zlp<{Pf{Fr}62{-5Wz&&RHx?t)G6r-vLqEyu#qP zeV}TcoZPT%T$atoc_%_1^xoQJLuO9UU-}yUw{HG`fjO!fC)PY%IxXnbRBLBq?f;zS zG#wd{sPfG#vwE#i+C84D?T0FokG)D;;yQKO&l7^abpPi}=0)e7{Ak97}|BXHq?DNNsdhWc=Q@r%R zfX6)@GC%rj=fkgeTBW?Z;ga`7=qYW>)=ob6KQ0`~v8lQcCv+cvT&o%bNo4;>MIJkG=z}K~5w|-e# z`RdcW`7T3$|FP+(<6pE^tl6*s@XyO5KD5t%`f{SK;c4L@;l$qOW7n_0;%(eiV4vgs zy7l2_N5E&7CJfwmZ`6oMr&jdp*>~8z-kD!zt{-={F;; zxUcUwsxD4Ga3JEXJ^g0fTva-uRm*92tXL`~#6)L*A(1MUB#RSe_&x2n9zw*YYYDlQ z$WWy#q(r=oP^dIoLZu{>vP>LriN%s68RHlp zM5xq6x(46=o4=BfClFbxbRt=)${;e5#9Hc3tdQk(UOXiZN~O;n4eGC0zz zWr_lrrXn=yk|a}^lvjN=?k9rwg-Yo$)F#P@1eHRe%D~lSKGsm3i)*KrrKpz3q=Ymb zkA5f+gqJ21q%s9St6EK0SOXBlbQsmJ4)`-cYHtd{bp=%3G~cYH&U> zW?jUrDXp2AVy#vU;N|C|A?D%#y)<5$1>hwm(v{*RVz~m-))2x=O5n7zQQ)P)H&VGq zD_2UiW^FNj40Ow(eI3VaJX2+A+~oxBWw}^EXk>~6U#2oc2#HFml`GS67iGw`Nkl@r zLP0QZ{Xmo?*AR@)U#?P`Mpi9T$SL|4Ylx1eBPJF8sJ&u-Fq3+U^OvaQTDb(*fSPH9 zLLRRctL3;IN@+(vp%B?oCp?Ize6?z^QX`g76`|^?lx3JF^YvA#e9c=2G2zoDMtTq( zeW8~5$}(k=bgis&Vh@<6(!SRhrh;h_A(&MN!fg6##fcg}Vy4;rHebD<7J-(?)M`2I zOK25$jF&u7sZz^2k$k6`r>fJHGBAJSt5Pbm008_w?LB&cuTyuQ-u(vJ2ynKTzNX;X z%amFTw8omq5)&xBoFi8$O-ppX@&ss=b*$GZg`>*%?VHUsZ-u127c4G`Mc zVnwFsUYhnVyzsmB(vmP`rE68bOsRxAU4eUrsUTB3LZxg^FHT61Nwl3)(L}3Cph~4b zGu4=>2y@$BAxyk#Sz5YWEt3-QSAN%=qe93ffs1VUud#Y6mn%Up%tqWWmfQg5BuL2DfxvsI;1%M;~FXq~Q7rzVM&_^pWoF+rtw6bZ}} zpnijom&OM)GD>Qhh`$q^Ka*w3GQ|=tCL&)`Dec9X@pdmwsF#K?4IKRw{}V!rSSe4y z^D;#`5;RHTVVDJ{suXewCJBP-H|mF}@$@4)G5uY~ig>7yXlL1>gqKuE5K_6?^fN)O zXn!1^rKNr^O&1a!l#1WAcPGvai+fX&P8o}}suT_NMS2SL05n>$7Ec$2j1t;j8qj1Z zCG_$zv-l`gWhfOYu@ta=&>^TPu{x7hbFg+KQ^?Fjj~@}6PA_gJ$TR&+^hBkhS0b@w z_ifKjj+x4P?9W%CQYI+m5^V<`G!v6%Yt4+L)GQD}7))&MSMc%;7_JHL=o(x6uB0&GhBs^;Dl)^!bFf%7z7qZ=1mF}!fd%h zLCr;KftjG!vk59|+-nk*QlnDHx`+t#MeoisV!T|zs2Xw&Rt6*znMNbWJr*7_dE&IF zadRMQ+>FTBi7}#y)2G2is+>fbQl_R^T>>TPs9_MPv|!FdPFUw`jcKcH&K_LI5in!($$F!C1Ylr z{vQNNc&pTeT&w9cURWvi^-A&ek`i9gppV5%}eeTwBV3?DqwYiQ_bI1-;OS7?3330j#NQ?y)}46U(hnIv7Up+XDV z8{1CVtr{luAziJ&GL+KxX(=Kld~qYEPloZ~6Q_)ef|=7qu`_3g#zkS0mM3I^RGz37 zrzR2o#i_|u2lpqI2?;_iRwhg3>d{kTM`2E&lFEpAnj~?mY;?RTbHOMei2h!h{=__u zHcKHJEfs5$u*NJ=DOBpwYWy=nrPP|;(rHx^tvFGoTrf&VXFzpAf5LYRlUsX&fB%BM znFk&Df>^CqWhBYO($R9|k|7Flyi73~=QRYRDlLFatyZbc=ixcR1>(h$S( z=z$|ZR1!kA&Hyn<2(>r^%uhn-d3S)MB!s580%-AjHvnA{LPL52TuMSn#0LO5LP>l8 zQjXAaK0v7)p;A7;RXIY{e1M9@2wmj^R4zv70sbxpp&k|hZ&DD7vH&2I2*p_dcq$Rn zS^(rK5h}C*$WBAZ-x6S78bVQ)0B_O|O0@*Y)F4!03DBZJ=!_)*p+)F{CBOzPLM~PS zm01X-S^?b5LMYn`;K?$Cj#~i~F6_O9S6j^&E}Y=5#oeL2xI4wAKq*C9v}kd62`yG! zN|7SL3N21?C>UBXD=Ot#3cwDb7fXZ-m^SAOcm~)gQUCG^VAoAlDh*UUd>o6c1Ew`-@y{``yOFBN z{RZGKU}TYQbdr^7xkqC&Q4rB$J@V9elSIMpL9Hgw0qA5XHBpQHJ4s+oh4sQqYrm6% z-HlkSUmD=w#x6OG$L>n3<|_@zx1{*F1n^jVH-pC%jcrLO?}RN1Vp0>529URLY}*q* z%T9jQD5R<{tY+c?9JnGF{)6Q)!&T9WdxpX(jcfzxh7zo{;rfhe>&%dD^aaH}?*={< zW6xeCWnYe->Gc9I5m9z6kw!y^Iq(&t3#|zzo3Qy;<1z-w*h>gFida-NDb?=(0+7j+ z@(B$*1cZNqHy_z0hgkczt{g@6lkj_oa+ zvt0@`V?#hL8CUiJ&c+#!8ng&d8Id?+z!yCtLdjVOd=63L?_((05sckcz}{xoc&lVxB!JuLHRITy+#e_Vd~$YazZYN)!trYtF9SqaTEPmC%cXpL415;K zPhRfw!6^WvB#1$lw6{J`===O%njvfg9P6 zN@bDkD{1_@xo4ag9cA6Y^^2R@kpNX9famjAtg{$?g#>#qLYIM6g`moaW?-LL{ETPw zHzMFhH3^6EB}r~11z>8FVtf-zmD}3v1*;5L!Z_r1>SIk1h1cL@YmA`z=?bnlpbzny zH7KdR0Mz7^sOiY60yghUrCaOqPc>9)H|+y{(NP<1_E-4Q72*d-;|u(S+pds@?ZZyU zfg2@S`fyKg(p?4Uiy%`a-c7Z7Je|b4IeZkt;~omT_!f$A4>88A30*cnCy}?|*wQ)) zfvzHQx{pZP_t}JR&x*Q1YrWUd)PjY2nBJDx;PD2o#v!Il8<$SIr5)h= zEsAe(WE*$*XMllUBy|8ly}u;6T@oV)U0AKZ+^``}8f7RM;>H*^Xt`UH-lKEkWUX^n znYJI$ScosGkv#LHYtpf)WazQ@wD>w_Su~`G&S_(cwvCUlJ<$uDI-xX$&Ht0L<-0#< z$G@_58n@b}RWX`YNX2Fu6~-E>srg^3|f=h5c7TXnd%eG#k4-cBzbW3tj)r zTF_L46{ksmXeId3WZ@R}qBAG=@e2OjQ^}Z#njLIri$!CRmEOIG=#8hbWpd6AG;z?! zSm~w}{cSVx3Y#Y^)KVJ}--Q5=h!xsJeqgc75|=Vd$fq>{zKq(xxw1Wsoq%>tT>cj; z-pO*whc%tguNcaCCb_j6{K#ms6T72!hrp?zs^2yZZgvasXyriK$Ib-i`EAv4`=feV&Q4;dBiXsL1owKFLdKnlkOA;!v*A59jn<9f7_2 z88{bI&1i~W#M9@;qGs$IndeRD^Xzv0J7D@0mIHtW672kRIt&>`@u+hJg`6_eyPgR! zODa!`thd{Z-t=d7EAw9rY<(dXsaWzR?6XbHNPY>HwV0h|{!twI3aFav(r*UvHVaf7 z3@oz8ooOTD7>KCf^eX2Kta#g9a_Kne8ej%Ut)Z-r6?Ww$v3mSRyJ&6$^|b{nqyF{& zRK$r$MU^sYx00rBSn3$@-2d_8bnu%jqZjvefL#|ZZgFo2poE{PRABd*4qzn}9`EEU z`a67~ZBAF4W#|~m_YU=B`kcE~r9tz(<4Cf}-)Hu0#&+GS&Q`_NQSAgVjWhCo3DHcx zw^KrMqOXf>9|J~h7N)oqLIyjq+@9xeQ`IkP0s$Z;HH1}?_s94Ix;3D>0#~Xdvw}nHbqS0FMD&q2n zEmEr2TCwk3i**lVKQOT1-6{Z|6_DlDocgYSA5a z1W(Lg(u_TQ|8>{@wN_Q)+ldZ-9QHPjietSG%?Du{zHcb8D!kPB3r-5sx`OsI#8QZK zQ?XxT`#3YHnfw?L`fj;?c2k->l;VZYHj!-UoJ4lgj94@)n9Gk6HE<|6e&N;qU7~>4 zI7HYnFP6Eo<~dU|vr@S~W)Fk{%w>M@WR44SOywAlSCi3L$@_QYZQ+_bp?l;h;vuwT zi?g6AsBqb6QFoaHQ$j&h=q8=iuXltVrK@fy6{i52!g|K#hGvDiV^hm$J_G^Hr=9CQTK3irh!atcO4}+R zhmJj<(92wi(xz}wBdl>WaQ@o9_M;QS)1#BTVzMCY_r=%BD)NJiTTDOT zmy=$A{O+ae3}N|sZi%9#9Ca*@hEuhDw}sPkqA#w{vlPuAB1ty`e*yMM6r8S0f;*48 zvt_j($$GS>kNb}YGrKej{%so!sxsIX<}hD)d1VsN##|+W2$mlVeEbdjS+*$b%@%%& zMTNz{_S84Z+hHCB06M?upmdgOgjoT#8e8|1H&!XYx0a{rc%!R zM!B!2yTPM!)Q~>Uq$d0~%d3XXFI1+SmSPXs=ULgSAC)pM3A=96qzf>xWYXoRxJ5kK zzoAg~dHrlVt*?kH823@?#^hbF{FfH|Jg&p1_<2zxOW1Ez)b{}f5c%}8Evu+8>8RM( z)DRyomB-$KDj;H&Z|n(>NC^-W4>ffiaq}oD5jhd@#*fwqw@=*D9{CRQ z6lU2QI@(aWY!-EAKYt5J_XWIPTQ8m7Yg|gH|bcEci{cQ-JJ#Sn5<>FnxtXaL%O;zM`2lG>eu3;JeI1Q zno$Ruw_G4K$d_*?*ttrd z|GpGwf7}4-)pi6nttt)7G&G)eutWyktj*Va;WI}z$T!7MN9%j+Az%kMGtXyVYLf?H zvG+O#K*^%ySFMVtgR$Ntz7?qiEdG~mO`%C_=s`F1-MjhOC0mtB(la-6CEl_RCv;Br zP%A&I_xFv>Jq!Cd8KK#;FW1UzeDO}QZv+3bP61@nQN*A;ZKLp7?|31|BThy5lsc-n*fwKgy*HJulPdw@F9BNMjhfX`Hb)eL@Gn0xyF}MO z=~rWC5oL{239U-lp!!fDF_7F2$;N|}T9TnMzQ@4xk^h{aT7M}{T5Nu5>i(^j)cW(| z@FMC}Zn#zg+ZNVFD08WFn4&P{=5PU=hY706fiK%Mbo$*Z&TenD#%5#{U=i|40}{C;U9PYV~^@S?63&mw#li zyEJNLnRmpr`#4X_);dqH-zq_L!ETpv*vcXAC}Q{1kX7psQ>c}0rOndZj|Y;wu1}qi z@$aA?E9N6J3z;$p?z`xwTj31@=DjtzLU&fgFug}(C$|kXHS@cMMS21pMEo(1heLAg z%40{}HX6q<9r1+?n+nTLTS%_z6a%{EZVT8cl$#0y~<&4=T+HT&Z}3uiAfuFAEV$iMEs8E^D_%w?+A@Mb?Q50SJlb%5Ua(z&Z%! zDq$D2tu^c6ubpp`72tw^(5{62OKMQ!_ky#DuE0)_l8L}=_@Ksb3IzA;9^cJPXh6PC zVfN{qlZ?P=B%q!M35MmWplIca6)W@y=>id^&kZAAPpYm$wsO*l@bzW3F+QJuL>&QQ=_*@bv9&Ker!W@+FrEJ zbvWW4Q8~aBtxL;eipkM`=nZpGm0^i{vS`MDC)3NX_wT6W#>%%XD%L3dP*b~q8|&uI zua}EvAHv1rdn0UY?coy2xvb4v3%9mnS3Z~v&g}Hl+{((h)Rml`UXU!VL`?)GQ5|fr}(Ya?Hv3#scCJSF;5!Mc(0F< zFn+Miq|T;dBdpA54G!aczW$c}PI`QEdN^bSq>28%GgcKOg8pgr@z=Cf$OVt>_4ssy z&Fr~I+N4a-gSPon68O}rsKftwwt@7)>AsBGBuuHH?W6<#b_LqyjyH27KseX+KDbNYRC*7TyswhIe< zKfK_wdf&rFw|ZrEcr4QswO+MW!&a-EE*Y_j91dhzR{(!q={Yrg@z+f)#omQBxQMCR5pkg zmr7=K2xTKzpDk`42>fk9D3s1L&BNB0K2Jm&seBtdxa|I3{QliMew=dEa=c)c(dr4{ z_db#8>%LANK-{r#Ix$hCO@feJjG9YT>#EC<-zx={ULRfW*R6<%wz@FlJBIdwB;rV$ zNfyi839>krwdg1UqGe>%Bu~w6h4zW&P4PeX%b99FndPT-GW~eX!P9uXq$*X_HcKgM zRVJO$XOh;5R`>4j$y=0q(yPQHlY~h%@I8%A%lD{?+p6xdUi^%Vwm{KkgnKL%ubG=1 zXl0`OH{X8VE>?P^!t?xR+1th4`*qc{xUDJ;y{_~=X!;H0V@m_4Q@7^QRE*8{BD4(gd@ZO6=JZMlV;;i{Id3{iyDAvzN^vg z=9lf`^J9o6vg-KY&d8}OAQVlWwK98irJSVKl}6ujBiW#``*$u<@o_?G?k$?9UP)yz zJx}-)Ef`yVoSs)f&?$?!IJQmx#@lqnCM^My?FE|V%7Z14S8ut zMN3Cn8CFu@+4Fm==VmrGHkhliG1)K=u|BO3*5?)ig@xZ34ezds8&6%sv8CA_(V@%3 z;8PDWZ*$Pnw|Kb@TOKJ~XeSyTPV_lo46@MMzqum$L>h%c=6-yUos5KHze2H0od}-} z2?1bv=;ZMU4HOJ0gg*8}dCBxXDW*?xK;_aVUxKVk_SQEq(Ee?7W%kUMkna{h&>gDN zkO|nETcf;G-#YXbl8tU3al6dtbC=GCCZ@|t!W7Pp27+tc2mWE8;TgtYh|WQixv*2f zI?q(FVRGo)L?jgV6-vSLqz`9_e&J4}9=(O7gf2MtIvujcN`avoLP|T($;2(l?xkZJ zqi(^G8hy0rNGqD}H@YKwdwp~DZ@wrKtP@>Bv4HjkjzQ*N!OPNed?O>WyXXN;dlVFx z8?8i*0E8$mfShRl0VoEgAGvj-=n(1TI;b9?`Tg(2e{MbZREUQ!|5qlcRS8WqjfP<> zp{eig7D6s;tvGK$TUc43g2BxKjI{iJ&&rm8M9=lwQjl(;(1*BV5a_{S-j@Xs2AbvL zU67UP#p&e@4)2>=mk30I1^)#b`3&;5gYUlwSQtuV4V{FMjjhC*E-_+0iGH23hk`sU zM8mLz&`c|9X*EapY+Dc0vQH);%VPc0pyXu1@d<}rkg+b|6v$UoGgMa-6VTOkmE-p% z+(MrrZF6f3#6d3K*1aw*ScJhUXgsHIKPqAQ)nmQ>5i=*l;?Oid@VCynouJ3cRgUhwbebkz9AnzWc~M1D6lnW$N!?u;iBtkmu^*sPfozqR2^2AU1%wZMwKb{ z2q-(ZBZ|fg6(ioHZC!Bl@z8Wydum>u3Lc){b1H`&OSc=Yl&l1p_&xuLWXkT&erM=p z$SN(WEpYa@Q}3!&3t@v-&tM!vZfjK&qK4f zw(mbQm=v}}t5wBp9g}r@X9ay*J12ALTV^>E^jAzR`0eRt`>N+xdjMH|xwf6_x5}yY z12=O1Py|BH#-#akX_J<~GrepkFP&cfv2H_weFFaBuHe!T_e}#7S^#~Ayj@~u>hhp& zC6=wfRT;Wtqsu@BZ@g48mL3U2ixi`WF!d$M#cs<6NWbs^SwtriUm=b5VGv(ybZ*i; zq(gNAv@jHT%QSM2YR^OazAZ+Rk~M&~dI7S<*AOd=O+;@)R&6`Ju1Y@-WhT9}e%$*eRGr{gq>9S}jt|WR@*?U<-3CKKs38reo)Z14m zr8eOz!4dM;Xll{=TL{K3|K)3MAC!7+3t(Ef#-RIW7{T4rq1a~N1qCq~0BjV^d45lR z{RdIwtZeKO?Hh?!uf-tE0f8rX8n1D__ZAb%;r}y8C;NwV%;PC6^ST`;ocE%I zPB2wa32nWFm{zIYg9M`ZE{;!qQK%2280+6zKP6f0VTA<0TLZE|5s-+?e|PuRJ&AEV zZfXv1LBl9-%x_S0UHFz4dI&Xbn&N|Ms9pzEQ{1D^F_wurO|`I*wC{WcotylCA#xgR z22m01@(@|TZF;=IiiGsal zg`Bz-qK9dc|22$-poouBnbISfXiX#It>axe=JmRg`;?|e{vZa3+t59H^k5X>?@I%wJS8f6I}r{?WyrjV47E*AspdE4~DEcA(OU)eyl7p48VOs%d=a&;QzXOqM{?2h?5} zmGA$eZ-WeeU8vMwqB(uhbpK+HyOJ=XUk`Ks|M8(pK+EOWMfzzJ82*qBXD>w8t-d{( z#DG?WpgE(^e98nnkiEmZ2bq5eqIcJQKPsW=Zb9cyFoy;gEFZTTjq+~D7Ncn~{3VfN z@K_r_&@GK>n1(XO2Ng+ueYf6G|IeQO5z>SD$(ru2Ht^pX`g<7VIB0t45B>Bt7{deR zoVvXp!~6Lwl+o9J7Ndr^eYyex$k*S4#4s#9L$wDiD^gz(`@j&lY{Qojc=Q-rLkY#U za1YvAM<@PMoaaq+@H?%(j$H_*&QnZ5FxZxPx501er%%yIdys#C>l5Yg)4kC~NR&ea z#W-Zy9sI>RIvvxH|FbcS$gYNZ1g70j`xlnu`)eD`XpS1bMQ>r`ha;zI4j#NQV6Z=- z$&SH*f;{cMrPI#gyN8CKamkObkaXrRvU6W#ZyM0*R-(Y@w{_4lF8=4d@qhP^RXK6^T+}KwQY39ERk|-Y zc{~%*_O{e2yipM;oZJgI9&q>QG!1*A>i+xvE>G@D(Xhc=#%c$^F0 z>3s5p=Tuk^G}x?nBtTEbR@HBd)dq|4r=6Z6!pxD+~EB)O(eVCiWF9;tVT0{(fAO=@( zfOoQMJq*z!>*@{)t95(w_8VX8H2ubK23=4*;> zo!Grl?Vj7ayz7I^H*{87FT&*Gat(cJ<~Oh86s%Cub1t5@f4U0Ia;sK}f8$NK2`bsW zv_8HGE2On7SpLdJD3heU>J3#J_48s6T-d2h=mqk7L zm(hGc#y^4z69OARRiNHHLAO3g>j30s)X($j^T+_CKeB2cz6ZbEhpVuSfvaF(7#n-k zC%Gt@%>`ei48i*3xy%eErT)J}mIR>pu$Wl3ZFo$q%H+8Uk7A0?bs`vp@$qJ|9LjTG z!5^6rYdd}Ja)3$w!f&=Q8RkL}#RjFLKoLMi{;`Q6`*j*5_bl;=Fa(1!ihPsKA9+i# z{^MMQD}oOS=8h17;uAs=VAOtrq0z7^Y7|WxSRc-jhRIC;U7%2YXvqBj@eIKX$vksT zTi1gJGNUOryX8>&v7kH{L=WD>j5Zj+kk3XDl>xKmK)R-ZKAicyogl_29YsAr=l?x% zrRA4DGGd@%4=x_YHh%6-fN{RSM~#8$LWzO7t_ycyZlH+DgL$(@Yz^x~act701ye+c zK}Gl?B%l!81yGu;?%}Opgv2I>OO}5+5BjHb>woHYXbvDO&s3yP&V+T3;pxajWvG=4 zU|^nw>4X<2Veu>LB)$>10oKL4Az|z4r_<_DSr^LB*%&x)9mqr@I0xBYhXgfm(8Pm( zoW+oUr_P}C#XVpqXZU~dY_H)j|5K^F%zCn(O!S2G5-;A+F(e4YTeL|{uUxSCN0y%i zJamR2!Q>n!0S}xdGbn%DoFq|6+&p3^P6bH}Hs9_X(JRMnE=VYLf1VpVo1^b7*sPL3 z(#B6a!)@Zh{b%G7$fxn^!)G2*x1vaoc(zs40Lqx*POBZ#ar)jvN&fpo+`}Ls#-wc? zch0u!t5K$3+AjZvnU02J0Rwxf^(MU2ARD`u?Pm%!Wt8m`h zNH*J7;!2g#Y_HkR%G=1-<33d~9{U5v1)G zH&7Z-k5$!<0gFC%F0jABJfB?OPWih{mRH^PQUv8*hBfdT70@8 zucCwmAEk7$PKa|Q%}hKUr3KP+CgG?kqZu!L`vBY4cpi0K{ff0_GK}y))8INbIgaT* zUwYBOr1GQJ6=fu0mZ*yAmy03=j%2Jregy#|rkS=$T9Lo*&*xE>)t{uejhGt0xS{!~ zKYhM0l*+gt8&Jj#v-C2Vj}pr9{*5cq$2@d*+Fw{GHuDxn+IardeFs$<>*8G8Q{#pX z4ZlWh#D97yUj|i9*0`74rn;BjrgAXc83IUlZ*s18B0|==2-q(xNU*i`BVmvFHl~aY z-+fe=O|yC_eW7aMh18L$>13HZEtdZ?JxP42d*{nd zj%abAs$rf;2%E`0FwAnlD+ueBn5{ZfL^PAq3U${+C zg&+^?Tfty!-E}r-0GhOV2`$`rrprLOIJrA$i_fpX5mUcxymVVGCZ&J>{d3Fd89mIs zOzwSPWQEq9RM!LaFOseA677M9)1{v&O(Tu z+=fMeqdBs35Wyl=J$=FSPCWcuuVG=f1il}{qB?aGoci@)ap5{k4h|k7S9G3s#=JBT zk*ES56^&jf&4vDoI!wUn@xC&YV$+(rA2A>K71azREB^3$BU7xE?H+`)ftZN^nY7;v z+0(U$KY2F@U)+QKLS1Jm2eJ0K$75S`bx-if*3h8r#)3 z{B&eaQD)MZxt8m+{gG3{rOAd1wvdRJkAR(jLIw>JiG9zR5v2!^ryR8mb z1(v+vn=87BsFVLgv_LGqe=b{yneCec`akH?>DjW!YV{l*u}c zmmb{A7l89gQ0RJQ<=0YU{jXQ1o^{n8b*=UFR?ufsq&0GttzCXJwl(uVf6iDyv*rzI z%wBpocz&sAZ}}E++_g*V?%-Jy$73!fsrAO=YwPb?Pv`t)H_KN{pBVeAKh}LDHTZ2x zT9*^gTSqncZ8%51&BA)Uu{xf|OiFTXJjdL;zS+!NI=;@Xth6b#jz^=mNm^<_T1)bk zgQr(w%d$mhmvouc!q1kr&X1o%gk;Gncj9+nxz8_sY*|@a@^OisGSk=h+;PikS{eHz z)M{o~!^r5a#?bWp*Bb5PU*>HVLajnI0!`n(4iA{kj0?FlsSCIbxHf#X)=m7q{O8cU zz`ZnVzRpbly6#u0<)`Y}d4trPoJv!U20`zdx+dvgEzjTSy9Y+j9jE@zd8JrbEz~Mi zN+A7G2vbsx`lK7t14 z9u}rd7Y>2Pho%Ov7j$Qrp8v5hpU5x}3brV){PbVzJnhKQd~03Z$H3O#yW_uq$B%ST zto~YbbanIi(q`7&b^gZHwQ=ROXI*_m-OKJI*V$LyUEex;zw-PwcaL<^_av2CeG#bd z*~$}ix6pzyCvu2&6t``hm4FO44-oDa+bz@3b5hVztL#OUp=7RhAw|M^6y{`d0* zd(WnLyddkk&xoL$M(Kt1S+{v{lHcRYi_abW^-Tgj-Q7*}1zGI{x$-MVOjAop&#Li= zB_&_g)-W-?HZ^f5(t5)tI#)g4UpdP6W4?WVej%Q$eqM5eJWL;{+hEp7=H>17b+!eo zkDnn4! z->Y}Iq8;{312KJ~Ttjs*S9F5*i$Fds3rw39bLVOIh8*bW4jjyJpRN7HoH}@0Y*cJ& zdN*JwA4(g!Ut2BARj9V+A{S_8y5LYIZV)7 z#P3xs=+dAk{?*l@U1n64p(VC2wqV^?uwkS8Vreraw?!dy72Z{UWKnz6rSqrX(;hfJ z=Y`d*FwCI~yh>?>W6<@`BmR2J{4!`MD^M}q#*`(~cQN%hD+qsK5aVc6^#)oU#^@UO z39J_-|MhToXq8YZJ)c$P_Z8F4Xsc~zv1-;4Tmf?b;GKRzi}Qca2US%P9xptXXyubC zOljT_dnPWhoLIXVqVsFmQ|u5k*r^&zU||-a{4;${lsP@zc+Zt)o)}RCvp%@13btQV z8a$U|{n=W$8esi&Gla@8Z}5D`fWJq&3p_6tqEDj4!fXUtmfe6!X0ePrU^t2&Y3E6@Hxaa?;siQ;u?7m|;c$+e*wJrA#KdDAr8y4m^SrybDKY zM5V*Lxi6g3Y*j0=smJIj<>Fw;iQjWzbuBE=T#C+jF#SZ2Ex0%*W>})esl@Efb@2$( zMR20W&;MxfS`!;*PM!y_dhY!F85&Gy4x+vO0CS=K13eF5j!c4)YV<%GZ+kPaFr zn{Y=?2=pAo4FlAO?}8gT7brV=E}+4?eV8>Omv}glT5GGlZI#x*`z-~gqV7lv1;yzI zLRFq@Yo*z0ZJVW4g<^(iDw^B59Z?3H7d2K7%ZW%{=mHf28#8Fx7G#FxjLOKNq&bcJ zA_OzRKHuYX=9sN7_8Jh(M$-#U%tlS|4Go7bqhq2vW`)T}&@efosxz>d$D=l5z zDCj<6+~`UE5F00$ht4a21*M!B@W9ARjL!m@7)^X{bIKEyVsTyStM*G>UQW3{Au8zU zwHxXKq1wWM{l(k*>FaG->vX;MRdoWkAEm6rznUYJN*p{jz4(rncM3kc&_quD+ zRX82tQz{pgf@aW@`TGQ&Id%aM<5r3*TB$;OeEsb~3G7sFpO=qaURfkg8SAjRCigMo zKj2XVsSW>GM znH=JyQgVF)_|OgfY%mC}%n~lBrc~{673+ld-HKHj;)wDPGQAneZ4BuQ&-yZG$X7xO zTQI&1OeB0G^cXM0e1l7_MEfSvgJeC*D#6HzV1p9p%;E2gQ~$4FACuuDUU4`+23+S` z`cF4(huVV^5n+AQIWUdQ?!re(i-~z19J*K;xz4bfm`6%a1j3x1A#c-vl{2iuD^Oh( zEFC5a^*jRoY1c}z4g2Td6c;DJVA79-^SuYE=>FPB!`TnubA3fCR-NJI?Gce%SW# z<9yuGxf&f++WCpQV637z5}+VUY_OK7zBdSj)8Raebytc5a381dnqajB3K=d2e|>_@ z9YqR!wBQiaYyZ=} zR2DczS0v#u=Po;%$z;2`>#_cPbauoSc2T1h?HZD`S1M_RO@4ZRMp$hEbKZoBzy$pw z%q5JlI#^v}u9yK4DLt*hgNgw{to#fef&}cx{^F{=Hl6}l7O|c7g#Lf>+%*9P1Tx35 zOc{ihfm{F&QBnmEw%*9f9;K=X)~Ngk9G@hcuO1`%Wa7PcfDGynz^L~CvdynjpK#82 zvFL}6=)L?tNtd$i%UvJqVz)>Yr&YPS>;9Y$8ln8Tv3~YfbyD}@XuIX@v*cLsrWCwy zYf1&x^D{bw98@a>j?uxSOTZR_QYqbwh5ds+XGC9PJ`~#hVp72&sLKp;TT&sm>(Dt| z$t1~8Ka3#jYs~G4!=LsW0GYYp%SCI(Z0{dazCz>ni5AEvYnN)PBLT!1roJ6d<33kCiZwS^u-)^avi&J88CG^ z)_au(YmzCNX0&i*{%FH@jJ|ggU+(3^R^z#l0D4k?e?4tgs93=r@tA z0dVWrxAD}#tn;VvX6drZt;{PIPwvT~L0nRI80)uY?&vw#LEy0NNTqzjV=0nq*DE-THJ%<;iUuj-?>iF_8?0>%f8&K_MOcPd zjoE5X60{x;lqI)XM2n?MMzYLqVhK*U^WD3jedCxm0P3{8!uUMv0BVc>al4LbDG4h@ z{UQDNj@Qb!a()T#`D-e~U+k|s_avdRkA986d#0TRW3bLAIjaC}P!?XBjseiF0C+yo zPTcE-mJHuMzC09orlNJDB!Kqq6xnZIeEpW<<^;Z`pIz91h5`*8; zPpbfv@vN0>Cy8fx(O*gUKmN?%aC#_tOw3*itoUo>g3WFC#D7lw`F7z;IrrwulB@rs zx$W^96f|BZty!4o4P;$9Ka&q+bQ|qs<26vXsL(Vkcvs1r*WB)E%E$D?utF~pWckS6Bo9NA5n!%-DK9B^XEx}i9VUu_wrA}y<(}Benl6Y%y=+ervobY4S8d+azc74 z`M$DV;f>WA0R%QJs&-=vr4?}PsM35HNvkq_qb{VraF^q4Ue(yZ!Uu`agUw4_$NA(FKl@lOHlwN^s!i zfq{OEX_u*Z0seY=dg}2}Bu6$GZ?{{rvqg>jDz(S)_#I*I63bi(@E@5A3p)(FP5;;! z^Ya5OYtHA)a#KD!H%Cq$^(T)7aiZQ}XD3L~2WFAZax!xwOV#u(f5|70!Ckbcv$mh% zS8f~~j~W-NY0nu5yz!*%6E7OYeXDf@F%I3ToA5XQ<3e8|D$7K!a3yU zRgAIu`|uWANlKzteUktVPpV!o1)~k{yoeaS3~INiWN^>+OdNDlVZ}0Zg$q=%7j>_f z90fyvdShl+@uM3uE%$AoTYinQ(!ckAO zj9J`av;1JK4z!lzC;O)&;(AHGS-L@jS^{%##5u~1#VYfN3?@>tbf;9c9LGg@^S0}q zc%AYo^S4upJPY#NHQL=l{%5vh0nL;jw_+@a$Hf@^Q$IWq;ukz@r1>(9=S1X{$KI?cf+L>dLf3=Qc2X8DS z6?qEQ(h`sul>HN%lI3bzNyv~f%MVFYcYZu@L&IEp6o5VQpMe?7!c$OEXJm{Q(P>n! zhAqxJ?(OCo(0b4Li`JwSt=(WRnZK=&;hUsrG%S+LSU7H46_2v&JmWi%2oZN?y;vTqQ>8EdnWl_C~{@B3rp~hk0ps2tku38ZZaIooU7hY zZ%GnB#^+a4~9`$%+tV>*IaiZfB-ke_@ zW-lB4hdq8Rj9$1;*WRY&UnG>I#%l+O4sO13AeuUOtcX*&0nG5oLgS3S8D;lct&J0& zjm>do^Euh2VKhGZrX~amMimhk-i)f{x|TZ;Iz8Bnt;Tz-e8i@ z+T${vyjD0}5D=K^{_&7UAC9l9_at}H<GwVa&n>_-tPO zLczfzk4=c=ThO17cW6|!Lucd|)#s9))xCf_Z0YpDor7mYOGTD{4Iz+{<-L|}q%h{F zsh}Ub{`?r{#@^{>btMzD`!9%=l-967eS6>Vi9Eb=CmRIMLWsi@3#?hSpY;9S4Y~^) z-(5d!3cmZ!>Ya|xf*mWdhWG7UKY|y18YZEV`vjdydKbzXlqb9{+ccoV&V@6}MH zesB)AW?`*T_YK9eyT5bm+K?>pj}>cA=?%WjH-x-2(AfU8 z1<|*3a?#OuLj35DPYT^fnm>_1^HR1X`5x=3vNqP-<;~UIE1ExDJ-yKof}{Tq56`=k zk;>u5y02Yd=jXJIn|*F+tfl|H3e1H9SCw=5?1r8D-G=qBgwtEQ`8E<-F>|YRIpbQy zU*|lD1D1MOu!613=5!}L3g#lHw)G6G5*PdfaBv6 zRuG>B)2CWNCd?ddpb2c;OrO}I&Ja8eYwhX@VltGnsIvjr3?>P|v6bz`e@zBeP48Vl zv2$;yE>vEp-S@%6JWJnv-BL)IAzp;A5k9;KSo`Pr*C&fa|EM=mE{6Xt|0{T?H-GuM z&0d3tvaWLHnWCuoMvCnOvTX>tDOPO5tTggE=r61v#e;a2la z48&zSP!_v`7*zg*AM;j)TuE@^6+t=zL zu1FS7xIuWezHPv;khSjp<+DY?Fvftj7(wAVJkZ+-e~Apc&ao^et^L>4z>8oQrYAL6O6DUP+reXs3jp2+T|28%gPsSCx2B6yD(4ka2#N0+(G z4qTT3f4=<5U{MWHx8qZrj29{6qx{BHtP#_3McDQJnSX6%@+{-v)_umH&$?mktE)<~ z9@pfx7ESL9k1t~%2my_vuX3h0>L%|dojqUTylV<309S0ekQkNiHQp}DSViEnWMjnX zFy>@n1E>zvE517-NaW^}%H8E@{MfPU#2oiZq&lMZ`;8qRC{$k7RB8wCnu-!jF*zR( z5iTYMaYT}6d~MOH*)I9`JNEH0si~gkB%Z&LoAj@BMsXawGICLpjJQvvFTUU(jZ`4zRp*7@g2|CqWRmPQE_&xqK>}cR=J&AL<+{$7631A{B%{1Qlz(ZdWkcLRe3nt&napjrpf+@*Waa&DdM_)AP3@Oox`1_J z^t|P?gWFg1QdGvx9KPbO$`=TxV;o8~oJyS4@mTeP74lRYp$qil%#?=*3W0cesS4TY zpGXlhWl|yhac!~Jcnm-EiYR*Rd*VNDqi~U!F58J90z5Z`0fn>V$2@YXtaDED5DfG;*LZ)=#BUSxX85K4|!vKm@)>;5Cf)(Nk>tYkt_^th&+fB{;ZtTemu>W2|4;!ehEx7>ZvW( zhgMD5%CCvnm$-1p7c&}8{}8-7dMS(>xk*)MZ`iumj zd_(fpUOxSK)ivV!N%%(*BBT56TqbW7-t$ca9f3+7%jC)DqdumJD0vxH!w(&^*Feqv z&VZgfjT(Oe72?eA{&#yE)*$&=Tjo;q&%kdMH6Q__%i^KyBfWF9y$$zz>=pb{acIUr z-3-n3(KcbZb?ft9TwMjqM(SH{@w)!BNkRT8YZDxxxd%xZSbuHr>q4SL%&mAQQCgh5 z46{hj_8kk|bQk;kf4DpAw>F-r(IbTxZ-L^jr4)Ck#a)BDyHnhY6)Wyek>Kv`u0e~t zYmfwa^L_6R_j&H0aPvILoS8X$&dly)XE*yf6Mr;#aXwJ*gXzLs96<+TSS}0Yy3$7O z_Z@nXoXyDmx1^!)CF3^C4)Q`_GK*&qVb+AdN4`0@La#hS5w0b_&JDc%%l;HVT{+68 zFGCgwuZEc=;xc){UWM2m4RP9^eX=r5?oQ{~?tCS8`ws<(-dF}o-?XAVh09ht-F*Fp z!bG4ZM^Z6a%kq*a>Gp#ug*Wm*R>bUwJ!%9qdYeK zXrEr(Z{YWCYikN_J~t>4Qr1G(U=*{>gnqKG80cReA}aq}!3BG=SmjWPT;5paY`^>l z$-t{wth50F^~~*cTI(7YO&ZlTDuIo2mD1&)y0(ljv)rkb8c;mqpR)%)?WuiA%otZ} z>~Eo?LoJ^lCNF8P(au+GrYVm6t3YGF6fUD-j53mKhlha)03-Wxre{ecKe##hQ zd~&2eKfaWl@x%Fg=nCbJNF;8#ma8r-b2IFH)qusac`BPu- z9)WTAp3HC75Mi-4Q*#A$Mk=>UkbgSJ{)%k*(%*a zNT-C?m57L_AtnQHW0$VyPlkCBpn%`xpO^(jj+?)O?++Lo0^+s4b`|ApbY<;6T|bn6 zvHk6!X&KI!lZ(|IHQPmSZ0D-u2F1M`wAvKVwyfqd=z2*fIM1D0Sn1TXsvbIdn;7xK zLKS{3`{Mm9AOp=EnLSra|6KS2UOM4IHK}-0pAwsWah#l831YnKrjmrt3TD6X>2(SH zZktEF8q;Iu@4mgn_`h`R`9E``lk0?>?oxU570N@-*YKE@ zQ-iN7?$l${r62E;#AR0#45&edGb<3ZFF!7*WDVIQn-Znl5sTL0RddI*UTpnYwt8NC zV(l7kZ*awBz5NYu4SGK9tLVtj+-jrM;+F@6N5Frz7L58=)kM`?m{&f0$xLy1j0@=u z<@9ZNYpz>L`(Ly+`Ts?0^Z3T7ORT0_yFQs3I{To%uCYC)nx5V64Qx5a)RIGo37|1N z12s?+^w(RqNAjVo!+Qd#bvE1GKkN{X!5NW{A(xS}hQ1;M_M4Ad=GxfsAxw!r0 zYUnTRrdRkTM=Vh)-LxA1rdLZtSGNyrCjmmpZwApXGPIH}vjkw%^EJ!iqf33Z$M+^z zJi{}&v{Db2y3vsLrUU1rTF_~>J3-t+e{=M=>7lLMi2S!u7~0FW_+BX*LT|E68r2&h zf-J&?{C3H9_R25$GRk&RNC4i9>vfFoO&y-;rjhJw8rVwKI<<_3XtO@v*Ekvn^6MJoR9^lMAtN6@jdg5cP%8V?<)%J%S%eiC(B5WuLb;G6-(A)&`7&5 zQxWyZEPGB+Jll=yCl6N&$a{3M$-b`}oOrR@L zkd*@XBb$n}N1HOc7z$qX_k6!wBl2&dT7rS(-hj#G;E~cLpgw08Kk@WdG1l-qj0mo#ea4H0VW%v^)pXDOBmn~d z0lpmDait_mi>Z{cBBC4Je6VNM>-kG-b(D2kBiD}ckYkd|uJ5TUBmq3vYTJ*NqsZ#Q z!)r1xCb5^aB6}TayKB;Z9K)AXkW;=5i4z{zXTPFX{@90jSiUQ9;d1Zs+)dD_BfTT8 zE_Byp?z-o?`cKpe40uK>dS#9!r|gz%3*RND20yqwyYA66#_i_Pfw8W3gF0M1B6hpK z4^s}mA9-Gt8X{&FzhEOX^1P?J{@7n%J<{2Cb@nnu0TZ7|Odp@nMJBGy(M9^MnpvOw z%{KL6+Qa82p7$$*WMP&M)c5RyKIGkT+c?XQtiIU9GH<39T(ggKphB9D-18TbSrrUuEifPhSUPVtxEpMz7A4a6C8!1q_>5 z1))Gwmi}q;$8f?|@Bg6KTLOQq{`zTxd-i7xbXZdz%^nfay92ke*nHt(*zV(xuz=9* zC<6aK+baqyrs#%!S7PXfV^<}F{*?V#Fn<*`zqaw&1WS#(g7a|*{n`3q=q>ht=Vd$=}Q2(XLBXZbg|J9k7nHv-hDrJ5|y#Bh=MO_Czy1K`|$3jF` z^s+W*)z?`lk>-6{3r0hkl|L;HA5oi>H(M%6U?szOmIPKnoe@;hm~Z*N?vhc zxwV>?%)b4fFe{r;=N#r(up&QL-Nr9iEA9VN;)Iou58S7Qj^_@-Haz?fEvAL3iv+_o zhX2dGgK6ac*S)2hm;LP<9$1-RAguB&6!vimYugj_KSPu-wSfONN`<-X-_QMzYSx5R z_>-Sj@dB7Lc;G6dfEe1n9>5F48VmA#>mN14=I6Jz%m8*?Y4E&wG;~A^-ASkI_YZUso2^rO!Kfvz#R3o)4XlSqKFGo@DfE zTuQw5^aH;`mGzxI7<~*o4W2HyS^U_;T9N7u-Tnu5*+dP*iiOkS^dnzHvWI&gZq6Ba zz5`CI&PBUA<-_-QE@lS@vFsUC_})nbhS0+!!~RzeX|172wUo)gPzuK1#%ZFyn}$QL zb}TnQz)rFi?$pOWL*gx6fpfj`FtvGO1Dr3#X3xc0J9Ds{$PLv7Z=`_jZxT2d4z`Z& zQ|~{$A#a=L&qQxg7(kVdsCsoWxnU zsbP-M8fPH{ImWxL>*%CfV=jd8pMdkX)3nt9jj*834>^vZ8+g>B2d`|6Z;7yX1W-5^ zzLQA?X3&*~#&Tk~b>OLAxT|GS#H8?7iValfks0uA&Bt0k>a-W1*7a(Utua6x zP;ZyOrzKK+|0V*M?DLy@dHO`03D49ud=hNQK@s6j&H7$xPxRyWOXAK1FBFm>ElQ9>kS-mo+LM6$J{FjQQ$NwG$I3EF3K)No{WxF>2aSRTa3jWr_wvnjD(R&qfL>Gdekn>W^&e%L{Q@!R=>lrDb3 z@X8aqh;;QS-DIOAdOXGV%_Zp}L*}gDBtd()L%7pF@ISXbS92MU`gdg!mP6rw0Szpf+G7)bPab}mxJCjG(jF5=8rMdA*y5x9zA__rQ0Wm{_ELjhyyJc|1RD*_ zDAm@}_C#vk-MxR`qGU<EkI4gpMWhu_=*2cWnG8-_nmM>u7hv~@>(Y*W_7NOu&?SA z3GemCyH2|^`zNG(j4iJ$SHW(VQ#7an`+e6o2>?o(;PvL?au8VY_UD+{$HSPMOr(XG zOw6%%x9LkAiv^tAYw2n=6nZOnAP_4+#^_f0N=wKgHt`fa)atCR>nMkd@-2C0jXiOI zkjC>B3Hy+Ix7D4EY^nmrSt2OYOHda$yaQ?1qN6R7h zQ@1tjAgHllinymg`W>KN3;c|aGxSst7?0NVuG(6v4`%_su+a2N`U(p?R0;bV_AH@b zYmqGVlRbns9QT@0tYRI+-rZY&0&p-=t|z>|q@{zw9g(u1?Nx zHYYPkl&RWiHzRwF9@zJpXh}H8eaEXTad6A0O~&h(`tY8I;9fI?@6qA?J9GAGSK69i zzLzbWuevZNhvy*ZwcygZh0V_pVpy!JLxBBeA}}KvqlWQ=69u$9)KBgV$qx{=k=H#v#K*_{%4 zH4|AM+MVs@N5LjBoTS{=SrS3VRLC>jw1{JHmk7`%MQFv>Q%czG>|M>bm+t#`flq<~ zs#9bH3H8VZocCR9`vt35$Y}|#AGo>Uw6^^BC%X;k!IeDeSi7ffop32xzRMrjwVvlE zd*Aw&jI0lg9Qg0Dlj@PLe0%TvO+^?v?;YDq@7GFpgnMs2&(=Kf9V>u7;luuK?>m`VHpEE6O(DnKw|ee> z8#`S&JDT2Zet6omkj^hH`ShDBV1 z^rhEzJ-R0$ba+p!^s@Trg2#qtk^XQ8g?ZRej>@LuCX!gF-v%0N5B(I}n9@fZH+p(S zYJ3}M>WOes>Ar`5H%&fYC1rt$KDvUq*_n4A^3I%>B|rmIf%B-Nm%~XbTbXx$6j{yU-2mP?pze?38oFV3f zwECbzF52_%cb#LFx<1+4NnSimf>{RNz*cX^xi6!vOCn2Hu4uA&PoK>lS_`eJ$Z-1z)f1+ae)6DvOpt*;vx_8cpB zkV*KYigIY>H!6iS`s;?fma#8Y^V-4dW=>wJU#xEZ1LET0Z6u=0P}Yq%0jyoW8pNqx zH?f57713yw``|dV_*VsxHR$NrFlve^=*#WfSe12<>ey(A*`8+{jGgG(GAXO+ucMO+ zJ1X%k^LM@m=0+%(-}O^bT-rb8uN^!%{tUeL4qiXK57|6k+p80J*}81t>&X1>v)hYh zmEt@9@o6e+n+51S0(UjvU3&5X&i4i%pdbNf-VX#)1g`f3bwc0_2sHrj5o&ykfbE}p z%Hq_)B_Fm%;{af>cTPv903?*H6%JsVXy0#jQ1HGsV4VSeFBPKmts1 z!$s>UgOHE|sqq2s+3-eA>HrV6>3=g#c&v7C0rMwQ_pFlE??R@Ye!hdm04P zB3#w=wV>_(>>l@Gx&}x#cbb_i>&u^iqB8GbI%yhqzkAsc%2<+kS$syU0f1yN<#v#J z8EFAT7S=A3bH;oiZ9u8Rv#Clyc`w0XsTgB{@{ghqQb2E>&A5!=BHhSrq&@vwOA%GT zxp~W2!$C{$zNOK4~) z0p}yE0qXto;;Z*lO|!9$`h(F5A;6E;X5B~3{qxNl(l9L40>1MCQlgrxSmw>?<)M0b z?cwy-_ol0A7YDH3|Ii6xJDxI|dm6)4Fcd`~coqjdut9*e!j@X(IfyCsz>LY^Qsm*I zdCIqwYu;qI30M$>a#$dP(GNkP7UOrzubPGv_ z4`=HU4s+=vKOTDlCe2K;@k4bdoR<#)zuHyhuLXNtf4)Qji%*5gMU@l+ymdgPYUH`9 z4^{^k(XV$xiQNhJ14We;;k<7!Ja6zj;Dw<{rE;xwi2I~A#@`xi?r?;SFz>(*(8+R= z)h6VU@ZtZH*E0sIVc~fGO8oNeXIT1g7A0n@83Z=*>O}~+CiR=2Kh7&%@nww{AkPQ(MuL-LdtC0Z7nh%8p{{bEksH9A(vX4m2co znu!E>Ws^QPLW)r%H!p-h>=?#RbTP?Vc>|S^EoL>Z0cV|Pz9fUmEYH;!RXHU^@ls7R zx=oTz(J}Fo3GunhT8}~YtddRpTkjICtt@CTQY^yK;|&SUXlZy+rWz3pyOQ;F~bBhd;7hgf%B+Zd?)>6)Z-gqV$ot zAG6=-PX_8>0cOy)P~n22aiwJ2mo@xFPP2D^)}B}3C~K-Ha-dJYhJB4fNJESeB{c5Q zFIvdIUO^s*VWft~2o?@0Iz{%e0a?Z8EWp5~4r4Y#iw4o;ZHQcSSeo;X_YFKHdSd93 za+CbUh^RO-s2=^`1uqveqd53U2oROT2!p%;`}g=MJikG{RZCE7H}e7*PH-IPNJV?l zA+F7L0BQTs((?c}V^}%!0U$Zf<3Bx9t$}2*CsT;Uo$yRJ{Uz`|UNS%X6CMEdtqF7D zQ3_+`wV*akC01Y;*#f;R@FMqys2)Zyb z%oeTNYh9yY%@j>{#kzDABSNwm!ahSIE8Tw^49xe$Q&hySB99)#4eu@fq*VvY6wAI8N4ia?hFUrZSC>biQb+X|~x*&cd)8rG&g|HqqmB1&N2 z5cnK^?dg4@t@N*_>AT2+^S_P)7Z2bC!NpP1{o4O9?2KYI7Xsz1r>@S`12Hx-xE46# zoO+1=nBcd;J67UCO^KdMS~O5=Ge7qb<3=LecVc>;ic=M-R9`E8j(l2`HOZvI&R%_C z?$KqzmTUa0t|S)NriMjCPT%=Dg=A;J0pYDVX=kQT4;SE_xzXkk-6hlM>WgOd7`KT; z(z#fGvk41J0sm{U>HAhqylfGH9r7==1=Ls`tz9*iwxLJQm3Qq}I(ap-9bA=T zA&R9BKx%k65}j5UsG8m4X)N;&!c@=ALurNxt{17ZlrYqL2k{C^iTwocqmtHt&C_^8 zYD{Ar`?mD=D@j+o9;YM(Y85S%5BK`@62W>R z;c)Qd*~0k*foAsD4m(MVy3IgIJz4b9xrS`hYWx^~ssgA)RHkfhaDq_vzu=NO2^Ap1 z15YfAfBU=HZ}(KEL;OguN*!8(I=9vsr6=f4sY!5tO_+~Whe;nkL1?jG^>t{E@LS*v zWz8y`WYqVR!e4cHl+Qnl^=XV1BI@mZ?CeESUy3l%9-|_oHoQC(br&@w&Hu(O!$F?b==j52#CAIA%!BGf`X}C9gek3O=96y_d(^FT<~oDo zZzq6KpQwMcR5KKXwI`iz{?vmzA@ATDkEmyG5(_3Ls~jCsGw}z# z^0#|Vx_j2sVj*w-f}H6M<}Yf zC3)h?wAKomvRyJ%<^Wset=ysB#@RC@fnTB^>YxaD?B^`+T92UUT4BL)_dbHO-m)oo z=G7p=r!VA-ff;RIe>8c?uW@VJ{G&)icFQXk7ESd1on{qEf%)O}_t0Kx)ux<7+}DQimqcD~KoOCon;)GQw~%=wex3-! zFAK((Tr0(~h>8dA$<VIlJes8udDzUcmNaE!hY^UhC-)wV^WJQyp8Q$z%2svk6#K2Zr;Np>a=9udn1}Mq`4Mm7|6`q3%0VBPBJB ziT{x5eEhfG|8pzfQR^7EHcmh7(lMI1(tBkN?1rzolC9mqR83EXe@-d>qggbv`4k9! zc57ZdRk6%eB3!}S4+(^XnRx?4i_yHs#UO?oHgsCm-Xf>wc2V9UYX~h?cv{_4NHt4o zxtyj!Uyb^G0TlHkO)*7SP-+}h{rGo2*t8{P?gDsszM{Lrg7@Y7(hC}&ijO_d8&zXa79Ll9%EPSp-ptrgP z)RsI?*h)$88;(f+07LrY@Jb-0Na(OZ{y7kvW%8T%#9LS;x@qUw`;o0DekWA|JK<$s z8$#b9&c`C-D-QHW-TAG=uwE|Iyg9+d@h!%RFe8v|q@KgZsIG2ON393J3(tL2}Qu{;ZO-bFyZA6;$Qj8j~_%mkIOIBk`(j{EwX z3b$B1RG>@O$JR;iJO(2?|D~GbA3I3Uc58oZU}X%7t7TYl9{#-bfI5>Ay^Bew5iq7@ zu}!|-lRY7}UZIV20x*6Y#^`6!3?c)uKJSKYx2sbC5uTCCw5HzsR!DN9oFaIPA1ZOy zWR3AMmq6Zcc5TkTjN zpu|M43ID69!&L322+ur1!`ibtx++HGB#M}!*!(>DDx!QRvd(0{@a!ne<2MF8-pRXr zOCEA^u0|%AFM6xy42z=Y4AfxAnIO{}w6XU4&U0{B^v1LH641E)_EpE}0!}WLU>vmE>p)PIJpLu@s;5)U{RUAgMU_9XyFG^e4LHp3sUEyr604Ehuu*Fv3B}{!TfGXL?l7F;#zAquY2P zv0~?l)5#CgJOSP=HQ)^v*;WBRM=1yqyV#teTc2)7um==uiKhDj%#2f2Xw*ng_6J3$ z6-aL$yf}O^&t9wR`4EMhc~*M&C^JsXqKL#SO*=Edf9w*DX$J~ge4T}#FuB-N{9C#* zBhef%DKBWOHssCxx@56cqKe1CGQs2Rnr3;Z-b0KI4|Ow&!}Qdr-0J6dO2e+^LCggO zL9NV}ND#Uz5F2{#a#QPk$xN9$K}TZbjQ5m-q{xp9qf*UiKE*`-C+|e4joZc_li(Rm zh17q)voEacsA^pP9v}!N6*v~sFll#T%=_7lM@>)_rT)aZJy~}1+Cr*k{aT4XYuQCp zR{t!-t{`dH`N=P!9I?cW&<`wm*I9}V_7R#cA>RIoE|c>^zl>LC2|m5w>Nh|}>k?aZu?O1ieOxjYD5n+rjQ0}E~?Xf5kV z3(u<cKdp>$*Jc;ahUXEH#ZILs#+O)1>#2`;s}b?RCAUPAcH$q=Prjqq^h3;}nhB zT>&@EqfdW>MQ&FD9W-pIet+e~bCv2~q=U^8@jf!(5V>m~xylX=zT`lre((eec+E!c zX{UVm%);Zef#Iq73yx(y(>u^%C!n7r(lAN`n8?pX5x2X(n z@rFwpyEu#EAB6#;v5X9k&Hb3V)M_wXxlmoI;{(CE>fOyJteSCZpC@>%np~hmrs3+i zV`fKcd9|MMnQi7tQP0%+>ng=>+V`3?iy6@IBLLG(?a8ZiFj;;(QbT8n$nilV|8+%b_6gbR| z{OnhC_^JX1sKqXA>lyA|R}r)B;O4`yJ?+Nqn%UHZr6$FLuHAW%(%HE=nIat{_=e7r zI9XVk+KD$ms!a&8u+F1hNtwOyv5z&#?~D^U)o8*+_-k85k6ZXEMPvQmtFejhnyidDy!@7c$`hV6m! zndW_$rzB=OmJYQ-7fOrMmmrp~qmUrKHW|)0Y zOS}Y+eSD3;fBd5vcJ*Sg#bH3$XLyZ3-x=8L>R|mrGozH~01wf@ATeGgD+*%9JSl;w z5HO^-Kz~s1{I8&Wo4*3#)?q$KU~zTh5`QVaki-1T2IY_Ic7rYFYV<(?@h@F_Nd6M> zTxo;DG4$!eJ%@-tMtOyet0+roo#n-Mu*qlkIjFAFA_g8F0}a|ty(Ki17)OTE2S3y7 zasSFyX?Zjc=2Sa9i$qTMOkdV9-#Jav@-d#Za8HyM+@`|ctcI7G0DD}!U&UD<;A2`i z7sXUzLZjEVikHUlPZaFAyU81&FWk1~$B+(WJ4IEuSOTo?+*1g6@tRTtzReLGd{o7) zE4ieg4dF8*`|>`5 zM)MyHf#)6#5#?P#5Gab_flj1m7)xF*Cf2AjVjcS2Bjit!G-8zP*^n1)zHnP__X+%4 zUQj9f9}9+0pY7@1m{wSAr5)cEReDr6ZI0tKjnW^9dg^%IBo-$6W0*jal&D{{eI`wV zw7)02QywP{$@d-fMr_G_s4tQm%#|`L}7eDOhQFg=qMh$P8o}k#Xt4g z*TOkKsVBob#|FNmI}^pXAIlen<@v^o!+ZMP|LncRjdst34nOCtF&QayasQaMC`+U- zxp-Ot5J^i`A~m7L;YX^9vHRIxF9S`WCOnczO@&Mz7FpJhz5`A8dSD;}jhozOC-Y?7 zDjPI(Qjr4$&qR4M{hlGb{@L)*LJ{;UhjgD9G=ij7a(43Mt44N@P&D2zuA5ko9^byi z(3xJ~l@s|(@}GRizXId&&5GFEJApCQ9)oEupL^gL&SV%LU!A$PUSh~c0PxgiyXF2{ zIDj4%St~%#5-^ZO6aHC6n|}`hZ<-r`i#Sysg($@2**h(}u{nWUmCXd$ZIWs>yJbu` z-e2k2SQ#WnjDHGCFGGB@Z)$`qP2_UMzY1Ns2a|b~LkkLibAyp9R2+NxFdp-f?Vdt0 zXEuYQk-!wL`Uq&w&>#Q11982joPM{WyN?p2VdAKJ_~RD6>cO_=H*6)Z$$3G zn_uFnKN~Lj`{ZCXq}aEb0|;stq}wcw53i8%Or;LV9L}by(^pK z$Y@?#suLC3iU-ZiX`$W`hGGN>3-DIY{(4bc8KTfvS1@-2GMks1tLX`0K#^=Q!cVwE zWn&PCmle+N7Cl*|D>b4-U+%pdy(Pi_PAKp>!qk@=d=VW?2Fd~XrCX{Q;xaSe^CN{@ zivWZKzh#%Ik9puzH$_fNl;@tSMaOL0oSa;t!SOF;_4{i`S#AC2a8 z8<~~~&aU9q+M>AL_17?V6?`gX3?0EUvPnyaG(Vy=_;_Vlhj(s395PRX!f5+4WAG#9 z-B1e%=j||&GVIRT6V=~Ypv2-$I(?k6b9IeUJW&Pb&z%ql;@Nz)DY}p};$~4Xi?x$< z;5N0jX5@r(wI9+*MqWVjO`yxPyn)g=Pd(2W%);r7&^s?7+(3R0sdKR{>Hmnzjrvv0 z)K=z|x$d0;WFFFnnhCMk%>yTXV}8!>ZJ7eIyG)+QI+1h2I$Btu{* znCOnwTqmUoEsZ5*I$M7xqHI_jZdyW&lI_FR(%aDf!DQ1sV=I&9p3LjWfbU!*FK&le z;y|THOFVDdO zzL)oeQyXUP3GGK93jS{8@YIRw>-oU;fLtzYVU+5H@nl#*v$>mE?InV^RlRS&76=V7jz(?3vLHq8If9ggE6ZbPME$=xewXqTghK;>qwzF8h2<|cF<0& z-~P~>2hDzbIEfCwvmncJjkwj;n*|w_hH?lIpt@F-x3WGQMYs3sE$OxxS`LMBCo5?_ zuxC3Lm&gAp6&y)77<>Zho$e`kw|`tUL#^cgRkgJms>N#m-cRF`bjPp&0b2+p2vcsmuexN{)Q2u5jh4`sjH7QTvl-v}Rd z!!!@kj7U4eEZ35>li>oc&RiR=bk)nHcrm{otVxcFo_ z_Usfx$-Z)Cm3no8W!Hzn?B zbmS0sQc0s0{BaE}QTr|Yi_STxqK&?CiB+d;+t5HFx1mnss^jtqM)gJMC*|7s$8Xd* z7U>FxmYhNo^B1}!D~v5ZKO^d&@@uMue>x#)218J9ZVnyD@@%)SbL&Yp(C{0(v~1QD zb=Dege*@d;)a>K*8!f~dEz}xUT|j;Rgfi;~i&plHGZEgtgL$}8?|(O!ztx5qyCe&z z))PwJf<~qFt>0Z@R-G_q^jQL%$<6fAbu^_ub%;^pfj6z9LBp{p`X*MDIDTra8TEve zRTJ5~!qPbWX6SAm*)r|tbd#L&8P*w`gTmftn2A}+(prDZ1M(aOz#)TlV zWHckFfyylei$(jN&5}=yzi<1is&kEnRd31LV>nlP>o2#VMlzy&h1eI;85q~bvil`O{ zMgI0lSby@@mz{&C+PT8|&y=$Lg=y703ojLdr&jylZp$hmK_O>v>&C`hlj4lg+y6c= z#_@AataB{9xTvBYonS0LSH%|YL5!h9^4WA$lzveJ>)_7|zrPn+;!1fx2v!~2n{1%D zYL=##Ly-E8JK}#ORMsev$a>-MT&KEl*nOpCKh9yKU$XwU z26NI{0_r&0l8tE3l<*hWm2J)v&~yQ;E3M~g420Yj0jqKC`+S&pa`=4z`hOx6ky7c2 z1{bwjE4_S(AuyRJ-+tD)IN1SAJ|oPEGkVr%#pt^^uo&w&C zv<{j!TQzG-?){e7^Ld?+IH7(Q1v}S0-PYzcN^=E>YB*A;Hz|L?C1~iZf1X^FOSs9^ zlt?HuBRl1B#H!S8s(23nnSUQ|#m(Kooro#r^m77I`jPdpddS{_;D$rx-#BzHs=jnD-DHF8wWyw@5 z88P9j@9U0LdKZPUC$U0T->V+q>j`H@@2?g1k6KNA{3F{OSA0*Sc75;L5WpMHk!R&# z_?0_Jp=7SG73B%BuuMxhU9s^Hdq-YNFe7etzLR()j49ZiP3F>f{zdZZY8GJWxS1UikH%s|~!?3Y$YXAh}wnMz@nMYR?LKXHuenSixG2EQvL1FZHHN^RC_cgbPo@zRC%UYbo7!3 z8Z|^~ajK9NY2oZ%BkqLXu{3{Ha0ulG=J@t*uEn|Kj%UqCTIJ1nQ{yl&=0G`C+@X4$ zKP;$IW6ysN?P{ab-J}bZ9Yv^!F{ez?P>u4Ud<@1Zd$eMXpTwXI3y+uEbB#Q^5dRt{ z&zUJ#Bq=5B#Qr&EKYmQYC0<44P?}xBC48<`@cMw=XJ^DLvFy1=I!A|tD@`oP#kIYC zGHOuWgjK+5!F~ZhlBRA&ou54`R-!Ea&j=Q6-KRN$gxGx?FOx}e*H$6tulnk4oatkR z9jpmb?B-5~@f>HP`@6@pf?=ikswt7hfE95EH(p2E=~;DVzBJi^$*^;A_T&*M)yU@@ zx1ac*NheTos28H8CB&2HT=phMMBQlkI^sCT%_A7nvGqP3ms>4fwSFOtoY}YfT~SmA z#aZFh##ge4$Kj?(R6wVBpi2FhOW{+X>Q57AHMbQJV-YFSV9lMa^l%Bgfw-d=r%sG~ zfufTy>(i=#kqnN=aI@27&K>;Ia|>lhL6-=_DeHay`0JmRH?P!Lq`L4%T=e!(Z$%|T z^y)A3_LvkYnjhbD>FJ{nOvPp^X18#?`$(y0JLg()m#O;Z5fS-l?&)p`CW@svetayt zbd~&?I#TkBs(>&wv+O!m^5*a7gD-|IzfbN#yt z*jY(PakE(nrD*DOf$~BXhQE6MptF5yR%gvsq)b-ABK$-}BHkrCgkAi-FPqS2Ufsme z07$9pP)cC9;K^4wiLJ`OKpFoVEk;6b4AThk!^Lz~ou76OCBRa;M4HC(*Y_n8REw{U zu3LduMh;(ylrDQ0JtVjd*FBy#E|9s(#Ic6P4N4 zTG86Xipw{#9b4XKnhB~l7^YBtNu3@FGdqm$Xw7%yX5nW*a(p`qoE<46Ntjg+w)tf0 zO~c*5$o^3QQ!O_k2UkUU>_WzJS3*RuL%E5lQG-8qI52uwy;d_V#EK@p&x)Bpjg@Y; ziuNr$v6L-jRZ`%_-o%kET_G(y3O81KZe`DiCUqKfm>v4%wIF`mOp*6XE*WXqEV=mt z5n}#Gb952qpN{(LlaYO5p2|X%FR8Jg_lr#1M`lRe9Z;RO7owHv>*;giceTbo_? z&f0b4uFjlsxY_?^Lm%rUQXl+6QCUPWp%r72VG%=G@DvSkh|pbONGFfN#CpI9iI{ZH zY&Jy7IKS5k3H?yMePmR%T&iMbmZd9JhF%C;9GyF5OvQnQ?FU%T?=Q)>iER&F<4JGi z+aD)n2R$bH1n23o=R~mOcO)53%-9k-{MO7*msUdLCSu%}=mOYsXKMJ8luBF*c%se3 ztMOs%ZU*(|DHJQ+Z<&{?Ijsc*Ve7y(nLLusV11CSZEjPai|YPH+5o&}~9*^~6| z?~{XHMt!SrN6#4%RU-vs*l4%j#i~+dOo|&!P_ckSUjcPDoY8)0lR6#xo&yy;XE0zIh!I?aW~P9sFFo!d0M2Q{6_dTlZ^~U%Q@$053m{&I6%@Fz&_j#!7P(`*S*#@+RvD+J=0R zQ;>@n;wZUMq-%xw`ku%f6v0Q(S5o7kUmN!F7 ze$9zAO54zLE>6dbF==Xd^|!*eV*3-*P8~zZV?l!xsoNznq8}BSXq8;JhV3C>8v)Fk zmY-X!9C`g`rR!-Zq0I!L%@KXNrA|NaHmK0>GesR6QEe(T*J@&HqG}A7geSZQUy8f> zcRtjl;n|q8S>cr1Q$trZYSNlam`*{9Wabix?zgF5_X-Ruk7aE5)V z81G)PtX6@LSaYFLccBt8>X7{;megFYn90%VuA?%+7?9$A;HYMX$i4FUz1wXG9lP$` zl&<+@2Ph&}#xrvTuaa*XTjy0{g%GK_l4E0ozqL{*Q+^Ori-eQJep&sl*Xi^f`B}u; za6vX+KV6;oy!*Feef*NDuBAmloK6+4KKT31M95i@9Y1n2nD`@zlo_dGF=tsdYcM}0 zHL)?hJ0q`Ff}jI{wwNp~6W>4GWc5n1X5pkoSwQY7MfiS0WoXtT$@wnZ46f~|5DCNN zgP_s7fuQ$VZjuXPW#OgfwJ)O48t2AA>9nM3^Kj!9HhOM~n|MC{+H%pJ@+ zS7X$DPo2+u>K9gW%vso}U#J8sQxx!MRohm$D}5p`ti*Wgn8K3mhZ_+sts;a?rB~?w zqK|0Jk>^-?MNu&*4_7Uv2=}Eu@(v5J-^$QgI;`8bPD%Z|Fw#Z;Zc?$>&SdOwzU@5O z9ZcJxK$tSa?gd6XYiWA;6iWLgXJS*l!5cKavOCeYLNS=0+^{1rVh^CC3*qN-RZeQ~ zKQaodLrMy*3nd05r6e+Q1$?9!?&wFAvkFgcmpyEuN+h_A{ratnlq*d(LnpwzN`HSx z`j1GDccZQ~EXcAi5s!M3-76#dECfQWaj$3t%;tQuZmyd**%FxammSTm!?$x?BD78W zIQ|D3u`7IUrYfpO@_qn6bu4#;9q z)cqDPChxqO@qSR9byHOjkUv~$U6cs6$#&Vk!Y=Pw7-+Im;Pgq8AA|>v;9BZ7KBDaf z4v%ZcvNb6PSnN4)EWY+V@_dW^{H>}|Yp}^m$fUKamx%JNuwIsE&v@>@_}|Q3x+BAyJJ@xlf`}<5??kCs$n# z9Hjw%L`K3(lZWRn;%cZZT3j3st1zd)5XOr-f?}L`GtqFKn6gz~^0Qf>3_0q2hG^@Z zwkD#Nw6L@t^aK~k?l2pb{~S%!=+5H@*W<}yp&Y9@PLeD^eiEIIs)i|WPJzqFdA|@~ ze^|XZ(i_xd<2bJYoBz z)n$G5e!2Cy4_byNUj{o9{R7lOu{slX`~?L^9|8gD+g4CB&qlD{rfSC!q{@+jtS46H zdi8(Udkd$wy6{~TXn__=so_?^-HJn~;1rkQ6sJIOmq1&JLxBRNNQzr=*Wf`4!6_Ob zNU`FcWS`CVyJzOk+_`_inK{GEV(oX?vz}K1d%xLB2`*Y}5qT20s3jHNPpc}&FsvGx z0>w^u7wERL0S!eG%Uo@&i*NB^rueYjO7p9+{+j`ZaWTc~8NXt_|K)}AeM2+)Iy(HI zM`?VyLg@{6p9}9t98d-ji%W9$&1kUNUP}Ja#Ys(op?qFx-GlH?0;~szdqVTpv%06_mq?`+ z%#E97V1II2DEq-7>}!z8${IW{NNZ&cA^^03!$@$*{7ma}B(o{bzr#$i1>-FT7g$Td za`r|i9=aaty58wD5&3}86xO^CG3kW3(vNq`e|g%L^BGPO;$q*LyJvOac$gAbFZ3A` z(O|Ei{|kszf1>))TN%@q-;dRhDJzS|tf5k%^&wEo=eFc^u~wyf_#rBf!ZMHq+MhUu@VV zA~xhdfV!9Kh$V5O1n*SqwENfgV_R|vpt%GxI{5GxOFbv0G)RBWeWv1Is7_iy%cTz? zPF=U1sW2G!DCoNwE}--yw9Vkfus7EdsyrB06bw`m;Pxo?r@5B=LJx#A@ST4JBg=!$ zjPcDh@lnS3C{uiR9YI?)K~NxJ06DA$(mDTdv}yX!+*gssrh<37reEiNtq!v}jOPSe zzPae_t=ctSZ!4*KV^v4y)WhTH1{iPN6?Gtua*EP-P5DvlU*!nNn}1{duc2R#_~Eh@ zFCCe8_VW*OKW&^2ZhI#jG-Cd?%Zhzbv|9Mmw`RoG{NBXsr0IlCRN-kjTUA7d6)&t$ z{_t7+9~TLh)6MSj_>N@{sE61CWI=VKqK5~c#b*3(m#47sux8ecd(D>5Mjb_(_!1P? zs;~IJ#>6r|Js6FT4^%uegN3hkWrV+WtoV~>ti}5DxpBR(6Z6NuS#RgIo#GgWdlA1- zEv<#Xms+Fy2Jp?T$rPtZ#xO6H1qpWp8S2~68 ze8}Ybz*FPJJR_P;7As$UuyQ)p?`50pC{QKBDE~B2zf@o-s{2&F-+6R-75Cb;S)F+d zHrPMZci&+{pZNhY@7b$Sod7Y-x|2c={j|X9rO$8NdVBZBhN4)m4wTQ1XGCxOXkOcC z#*dPG;Z$i=Q}O4I)oy-_<4!ZDh1;=7?H7wuzFA26*C|#l*Te8euDRKJ*8e_p&5%0o z?s3gDauu@|YidO}Nfr(@yUp2bu1_U^-y16WJ|AzrTTol~mM*QcG^W_P*)1kxu9uhJ z0a+1<)@OcF_d%QI)Wp44q@p9C)TW0g=i!;gUhS;T&PT3)jkTxf}LVX=?K~ z`Mj-ZjpSll*YzH!?1;s_W_1Yo?0zMGI2!bs<4cckUyE}7VT2>ma>s<75Bm?gmtt*v zNpqqW=|={it0R`#Sypvz#MJW=d_NyWwEBJyMR(2AxR{FxFgq|t+D38Yd=}`WX8G;F zDfbaqz z>ldNkg-|mC-=m8xU#}Dj_Bhm8RDn~^IX|r2$tTb)$b04j9#Ig|bGUv4UxZX*3UYBa zzS|eY-0+;2zKM+AoNSXtVTg=xYwAi04%TZ!URXB+?D|#V?=<<#!o$-`z|-KuLWSCG zxaAWL_3gXCVoSN?vq8SVu*0~)9}{|f0Qrij`rg&snidt@PD^?XRyKy6a1I@)ww>-G`p z-7D5qh!jg;fnuvb4(2}Y^kiC(9jJct$vuz|5I=^gkRRy(}g zNMKPJvDdgTF!uK3Gps4BF7fYAko&u{)#jr~^^!Ey2Ak6uh}~=j#Eau^9FB5J3|^hU z-mLXv&0gAEktaDHVaRhKa4g?H(}q5K03fNFh1|!gM+E~hr)F*kJ!)5gzD6bXtXDxn z5a95{I7b6f63rQ>K>6bm?093qA;kXXIVu&PlGp{VXJoV7ocIUiN=P(INTzTb3j1F1 zwKO=4T8!c{RFb*349Dbl`P8z22W&W?1xsEw=h4_1>21W>#`>={GYN_IV_x*tj4vQo zS(Ya^y!QaF%wW`nYo}ReQ2OQq{{>E*-a;#t)nmJ{^+Z%yJwbG zwJDz(h@y%YBz{_o&7cJ6otbEc$m$1~*23I3D;itX;?1_|Fy7(ccHg-*^Ds&uUTs0K z9ec$nH3bUZV;{Dz0#zT*${UG$gFdv0@G!uS5SL1EZp5_&L#$rGy>!1q%?QP*^xB=v zgB=_X18=^e*jFSJALsnr*g}9SA#sy=i*IK90wzm{iH{u;5|GK zy`2Z&R~-Z|d<35#=x&=og$=)LzNOU_zijtjqve*W?cwOo&x_${AEZnLTiS0n{;zp+ zl1JFagMmNa4|)Wie&d`Y<9Ds^P_(dOZj}`1_n*b@y7#f`p+bW4-a2YM2{YHCRK8!V zAM0N1f$pnB?-@FkGWr7hhRieL?lLMh*Hv~A3e-6iDm`x8FcF!TiCeJk z+C`Qz)hwSXOvKH)T;-s(K`}eTx@&ijNNvu=ACR={+IBqmrTYL-3_FO-;~c(Ip%RV? z^)A(RTFB~=-sLkcDP#&+;d5AY-SR01t9jRMIVG)Q1Gd2Y3EhXYjR3k2P`MfVu3a=j zi;l5oSsI*!tB~x!(vDvx}|RFvy`NC*nuytGlKU#`9nC zY-3l`am1MwdCuUq&th_$HP%PgKvNa!g7q=4jupU8mrk2;@w|1%Y=uEa zmx(%X9;|&aDjCN;39tH&qn~tEf&B!#@M&S|j`gp*lox@;_H{qV_2uniKr8+fdYNoX zQdtLw9?9Q=1IvbMS&+iF`+J;{u9RYN1=DfxmKbTBuvf?yT5YCcVzoAjC0aUEp7f*c zEL&6LK^V1PFLL)FR*2qj-M1FkE$%rRQN1-m2-Rn&cbFRK5xcz0d5$d|_s5;ne34-d zD)X>&81y~+lNj1rsSsSAX%SWzl%*kd8X5V}yYKiFC{58#7b_rAPuJa63uw_0^E$PN z7Iipxi;9)$RMZDxnx{-Oq z%?NqYP|FWL%PyFk@kuUC2`+y)+lr<$@Et!#S(`thpEZ<|Qm>|a`59&-`kFLUMiW`R zjo2O$!tK7yGVPNpjp+%+yfT8kX;RL7?AHr7WuKt)yQyAN(}V~D>u{2E=!yO|0?8>I z_uO);42c)`a#-{1PZ1NJ-)@P-dt~v}pPA>>R8^UVkRY$t77*+C9r{`2T{kcAzdQUb z!@Khyh@$PBa*n?Sl)g7brT)pmvQN01d!ppBe@AU2=thKiw;Beey|ylsrxzQ{80g>- zkcuGdogL0-s$Y*O#R5|)9ACp z^S&7efgl)p9A+iveTzUy+WoBa#(J}UNBvff_e}AE^!)V z#%_r$*F+5G2?TwJm8kn1z_3ZfwkR=y-OkXK*;g7PFTC;}+uIRw#l~09-I-Ivj|*Tp zf1gr>ygTm_p0hXqTpC?6a$ZjL{;y6K;fO}CJm%S zB=dXBE95yzsAX7iIZ3AeyyYIpqb(S`&K47qLK>GoHzmaQV(E--k^MMBH%(3ILT~wx zN$5+gLG5xkABvNH+c&2oe1(|yJ(AOBCw=Vb52xzF$pxyPI?xY$e&k<9T_Dp$yJJ=q zcZwGXy#fcPiJnS%=w(zctvRJgzecw+m6>2iN-Cd|$Ltwijchl1l2ceXF=Yw(u-=sx zids?a`6Ip*prU^E_DF?TrZ>20LpObCg17y`$jkr|G*c>FjwKLdkgU#JITju+X98f( z6k9_FhJPO=xV@w{BE)QS{M@5=XA8|_J=Uu>x{<+~Om-cMouKUC(7r@Fh z9%o}O1iJkh@4GFQfV6< z+;Y2Hv$#5s*iz>-Xn7mKgaLgV@W|3IlR-G`HMa!X8-=TxMCq3cm5cP3L{Ta4tc30o z7*&@p1poc`)nUr9!OklqQ=I0N;rovR>Y%C+j zetG?-5`9MXbk6y3W-#18`l~BxyG>z=$DpmSB!VuP~N9^UQUoCPQyS)cUP4Y$i0*Z*fw7kD~;h^$Rym`Xx}6k|D*O0jQnW#sa6}`>a=q zJN)Q<^}Iwu+21}Hit?|2nN{2P+TpCbQmr`eZy8dXQvZv*!+Jz2NyWQkTvyR7JvZr_ z)%}W9ac!3Sw!Bq(xj^o4xyBqx2f!#q&kep=L-52ypWS)FJ5hJBO5MNt(#!V^j?DU` zw)Iuup2Y-PYM-8ykb69-$_5;u1fz)YK=tvl1ycN?cDxLTB4gC35xh5O83a*YZ;4wQngb& z8YXj-V#zacZ?{*5L)EzA|8K9 zdvI!69;IsV7uU$yt{=e-@LFu&pPm%u z2sSl&^}vL=I2ofOtxag$#(9_muss?IE53aOQJID=vjs#d5KgS&Q~d0-3Vuly*d2#EUakuD zSS`QrhB4D)R)P)A)tR&tqJd|4m>ao9%73Ry6=UQoN!x)~e82Wre#TD8UwhOzf;SAa z6hBr4ao@p~68NOtI=+|1tV?;`NYFqY>G!X?>R(k`318p%MR2o3X+;PR7xE=9 zfVRW$C61vz>hp1q8k=|&wd|9X*dBpN6KLON~NyD=* zoQrU;MWR@<$KUL>>Erhml1i44+3tMB`l;S1KJ9k#JR#7W?3%uL#x7gF zNB(l~X!@p^mF%AItMY;}SHucwW!{fpEh_jjS$OZuzbR=7{v7>2SJJ{1?Q~GM@tda7 zrrfH@?9PDE#4~k)-nwE1HKE?RA_Ye4=#wIaVg8@X;MWB7%J63l@#q$y6L{FG4@*x7 z&-X}1&Ku}P;9Ep(d3exQeXl;4OH>jEtrFoh1y-`x2|0?8h2K5Frwrn%id{CMF7jKU zGI*nxbmBizD@3Lmc#*1s^>iaTmPrL>dqg%x?Hctq)PS^2EWOLfHqlp&S1y)L2>TMUo3No(*ec@FaBJ_F>eX6T)s&H3=^pXKjk1Jd$~z!9zc1@=;&Xjk4+1&{gz^ zRR3$ER(U&^*Xq6TWzv2(VZ$r6*#}#`sbYv={3ota3S>q>?+ZDKv6?wAgI4AKHZ5&e zof|qtQU-Rg#IQF>KC8A@zKD%~)3M|Kc7<=`X>n}6EUk^rNQa^)#M-LPc-%PNCdWj=~gUCA8Xjns94G2@yquj%uV9+wmUG;RtfDo%}8g!tXjwC!e=u*?%4yf<0< zcI(^6vDzl~_sf{GKTljImddYn9WMP_r?)|O)bVU2+4dLz!@%!kWIL ziwA#YkQu*0bvrFkmTt2;TR`_s2)~kIoBr`z(awoh8voWNl4t=Nsek6t&$)z&x$j4T zM;*y$O)@^L{7oYj={uOGCscOx(~Ezj4vk}-Cu_#3fpWK^O~CgVxSKYmlEAKlAXqrlWqKGo6+0v7Ofsl=h6uWvXoP-|61m4jcqnEY*bmGqRh8@@o#Ed zIMjcF?jWc`&%OT6Pqt&N)1eDrOJw=3a6jf@8?tg`_Z4K=Q^z#`0lId z-&%c_GWCa@4Q&bUnY*@LPi6;pWnX-|2eU};Gd%pH(!}$dFE>#&RJg|_uFRBbox~(! zs{A4G@Q~uDq({|sNy$~}NYxgJAg=QsOhF{9p*hi^`j|_9OI4elpqw;5vGZNb!B2@# z-<+0bIkW1yx=W%J$8~btJpKFhyen!x$n8DKE)3Gu-w=FP!nj`TQOnnTLmth!)k%@Q z*^#rnPa=nJxpyHH7Qy?m2cNMg;3;Lzm)l3FZ(CnKW@>sw5=!u?&N~@C)AW!X>i9@0 zKfxD#3?p4*GgEa){N?}D%t>ms0-{$rMaFLYN#S7$MN&^21BBD!y6>sSoszTN8@k(j zFX9f{m8GBqm`_PV*b_n`SN*B^Noe<%Y=hTC2}R5nGXVfr{lAJq6~c=~NM9yODQZCw7JZ zmuhBZt}c?Q{x~I$t;*nz)%de75?UKlM1nI`oRHvSyEdo?UPNoZ)Kj|hSmQR=af#PY zBOFDNV(%1KYQE>mc|`PJ#!(__!o^DL2d!#8(O6&fy1QP+%xmG;j@L37{g&juQV9yY z@oXGjFH@{Y;uWFvG_SsLizZOhDDA0f=*50!JBql!q87J4NXPa6P6PWAWv!CCjI{TA zhl9OkkdSwuiM8Ssk)l=ixC2tM+TNyB0ZBzBJ?<3U+`m`2mq+wp&ez77^@GO!ugh2a z_k4RlgL^lYVPyO`bJv5Th1;q-ED=lr3m3UV{^HWvdc zzRF(Z0q<-EOSFalp$!+L>U7gY&8U!-ah9cqS}^!UP{_tv=C#8>X!De;D1JLh7zUoG(;j$Xgof2+cZydA;GxcSwb_fHs+EvDK@LQ!~7~_}CXFn-XQxg^*o~=9&T%WD|GXU-Gw8=~{ojdKvoaJwYeI ziXCqS&jsL#$DPp1XVj7uI;Q0}&D^7&XWi0kihWg^r>nl)V32YlrSU24+xVNj~I^+j8i*(eszZZQ*wp)6{vpEU*6C4sjY=%KPs<0mHW05qJ#=7DXcve__m_WZ_rhE zt5cf8R8&(5ZD2_lV0fLBVA@97*-gi_G|sgo#JL1M@ko8h&kDZ3oOG>0fe}`kN)Ivn zpJWg*Fd4*^0!#*>~O{%&8)m7^saaWGkOu*Z^nqs=qz~XTD_?8^O4!J zr|wVN)K*$U`nNKuk&?{7s37j!NCEZ6uh+xfxLUJ))o#eMH5gwaK*#}kyyl(U2m4bF z81Acgli?mqS$nl60^Z+hr`^YZH8IYdAS7 zbTcs!d_L4oH*@vHaU@>t zUXox^NzNIwklp9-#*dkM<&QUpNzNB2_L2Jgkl)QmQ?0!wUb78^Z@OCIKEyms7>v7n z=d)$_>nW#jnSTt)pUFKa3h-hgsv3=d-R;Ae@DC2A)`v;n zkN9JL5MGw6`ucstha>RawypIcaoG}704#NeIgRS&t&o_IrsfW+Kb#+}LUo1N@X6Y? z1xt-<-@Lp<)H%ocB0?h-&*>n)Glv=E8B<+jiI;{PE4)NEffxetRoa2v`egx!TLb z4-F+G4{)l$RNGu;RV=j;A07SU3fM1ewn1@F4ftN1Eg0C9+1@Ghyi+zORoT*D!T5-B z;0$R#Q+;y3u0g9Rn|fQL#jayKZ=EF3db6m)<%2bg5h2%W3LRb^ZZ1vk|Nm-i|;=ubk*lQxh3md=-T-CfBML{mG_ zo=>F5U--VN%0TLO8_RK8(a>>uznV%==HmQq&0$$uQsH6hsw=QWVP@PeI91)1Es9KMBl4_O-DX-MJHEMwj^f8~{RTF4`8Z5l ze%@r2sjMMkrS<(?`s;H9iwYGVugS+>9{NTRqRQ=~Kv?O9L!Qq6`kj5IHEQw?j( zm5MGPiB8PN19viom|JVCMn4V|hs<*&OTEhl^kW6M<>@L6S4Px>Slhw#mhszZlv94B zq#mgqjURKZw>byR`aGKx`e5ojtUiQP^~#D_dk5C-TB6gY(~jOARjW3*TsYhMUSF9U zjnC^3r=Y%>wU;49*XF{4WCQ;%siYnGAGte5p9(<+8*vW3$aULcRJ_@ciSuyI zZzOr+(FLw~>bvKi zes3WmDXu?Jis}z|x#1zrK^lpjgoDnEa4ScbfYj!*nC${=#x`AQu9BG;vSD%1wGF_W zN{Qf;ciMeM2S9^Fdrx@1V28v?8!66=#FoZDl+`C0Hk0$qX98vLz=jube|Q4|6{5Eh zw$$ICA3jb)VzPj+KPQa>1I|ILw>RK8abgDmE`+Q8e3Sy5r4l(^N?smyHv~NwlHxQz z_gik^3dFNF6BzcWJoOf2>X-w%pIF-NfA?s0#eO*GJXGjzXbb%4x?T!J0D&{HYe^KM zLnalg`GiNj8PQ6K&Y8lVTRPvZ=rIL2V3odnTGHNac%sPkyRfhF@KAm5woR**dy2ju z(xhoci{gX0{BQmUCUW4oL;oM}3?X~PSM-b1wB~O@-}%NI1R-fZmUIfIzm{_qy$y)4 zGJbufKHT3phD$+L)BwQPowF!}+#jGwyF3~gbo;(*)@DAM%@>bF9+(~gDQo<5P)%3s z$-D$tO*G0s56g!T7{ML!F5EO9TUAQT_iL@311S0GfZQVO*2Ds}-cy*AwesBt-lzuv zbPJvbbY6RldveaMxfmcG+;&?`sESzeW&m*E)U^8Jw|B&{fQwRgIKWyQBsL;)jBgwR4B*NK-S5;uFFvXqAEV^z015zV5F2u8 zW*kuT1?brY8U%5C*XVo8*G&@8*(-3aBREJ)4b)ocAVGy0ZLtG<<2pcrbI!qwvyUIV z!2|ctw+D_;A8NMZZ2P_eVKcM;AKTP4lyV;Z$g-C5vbSdkXu24m z3U8AzsVo%+Tad1#o$phLb!YW2P;K%(97?Q&tG4y{ubsho5tWz2SN|S_c9?M_FNt0{ zQ^Etn;#s5PsEDA{sqMlQH}Hw0r=X+@HsW!BFqC`&Q$ybO4jw<;3Is#RKVH~l8McmE zB%GIA@@~J98R8m3{boW91lcz0(jTU-Tb&4-akrN}obk*>C?+zx_Sycrls;CPl=_A8 z7(M?8d^3<9Qa`foV#4LVU-UJ_r#|9`GA$ridx}vVCGYwQiZZ@K&U@NY&b?XL-@eT@ zi=8LOTi&ZLkcWt+UY-qbz99H@mJt_+=`4S*-+qA_9H&FKsxcG6dF5pw5eKFPpQ$fe zD4xM~1RoaY5bIuw>t2edUNfNE4ty^#jG}o4HH$vl=vh** zbm5SP%-nnRuUX(cpBm$Mrx6?sY*FtTF`+RA0==6n)EfYYysu2SD{hN=14X&r8Yyt> zs~;Vp*3-AqK`kXMk9!%7>7l;(*1J?Ba99*I>g*&i;4UJML)}CNM&$#~(PZ`JEz`~@ z;Le(cfo^4?$8GKs_9DZZEK$jN$-_n(_(vOjhNcE0`&)rt({G_EM%KDLEo*~+wuk>* zjqd|1#c#{s8yPn>RMn7BQh|A6H8(j+l9RYgh)&yta16HVq^B36gQibr~IFQD5>_QI0Gz$0hXi=(1RUS64D1e57B+IRq=1 z?mBOe<|^Ub#|*HnU#%VMXYiOBx7^`WhVid*7jyIQh?*iq;8n#9#SJ7Bl^&_M0a2`p zRgxI;N4biTUg?H`-n(?tq{$@Ryr_2<2?JFtky^M(A9hPQ``bFY*MFTDlN_b+lyeH0 zwG`;vRGNNG$h$1a8tWNMF~89Gy<*J|&z^8hTOl#Ip{p_&6DP+H?Z_TuQ8`H0!eXo^ z`OTa?RX6i6E2Qg@CCR+O7hl|BiY*G-t675t(lHw-gm+fTR*z5pf_V#9W$b*qLx9?f z&wcc`SR3Sh!0^iXi{1?v%sn)h7*4x)+8r|;?Ywf%+nXlV7Jm>(4~;*_k%D{(@N$>x zZfJF4ceap9MDOv-WTKe_WMa@^)Ucj|yWj-I7HfQHpC3i)v1U$NiD=Q(%hhv+Xy=Xd zPx+bRrdC_2=%i?-)rL+VQ3Oo*B*2ax+B+eHfIEQ=DAAMO2Qm3F;)|}IHxtnt)Mg#7 z%i8(sv1|fu5$I>s;HinKAe?_z0ZfQ;OUz>gn_$p4bUpv#(19dPJ=6MZ%7JPuK#E3- zoA#ay$MRVRP$FPf0e2DlLZ-b3dxC8r(a6-x4WE$-2x40m>yBZ|$BE;Li=eUacUv%Y z^BYiPq7Bdk;(LOxrYBAii z>%}0~AhfS*N&g#(bK2#`dGobA3lss9;PT|)^5+}ZV1_4vf^-w<-ecs!>t2MrRK|fl zJyX{?cdV_DOcJ-{} zP9F;#-y3H`K>N>0V#8?6kO%cNsO|%ZP+JBX=X#s5BhPCL%(O)l7>F* z+7TM)X^pmZ3%CQC2dFrEdVmvD!9Q!zJoe06qS0skpm~rBwPm8?1VL*%x<9>CV3Y-W-7hS&OLj&4|X+LNicEo_Bi(&M_!Y5stq2InVKoSh&cC&oqHqg9`L!yHWu0g`hL04l{kVe4V#XZsfM^? zob-lw=>Z{-D}WEg1O_A!4gm-h`oZK&`n_ftYZ**N#Yf9VHUMC~+qAzio;Hj9{kMMo2D*FJGY4eLJ8x>mbf z?`;I?9f+@)1{#j;cWn8+d`=ck<%;128OOcp1#O(8SKlSz2ATu`9RO7+3KJ@)8z8^- z>fPvRcd3Y&aZsy7Xz(qI>0nRtU#-APzJ5ZvBA${&M3?Qno3xi@Z z4(T2GF7xvR`7ZOrhcoR5N?<&ZiaD@}z2V>XjtMao=yE?c&h{dGr6CGr0BUU>)+(&S zt1{;sWMSv~#uPcm8w+sx+gM5=%*+EGAk3`NE8Iv#f^Skw*%+L=kV5-96%5YlNs%@C zf~4?)&S|6bTFSQm&hqMgKT`N&XT8z+O;Xgm<=&K(dL zN@d^^8=7L!Fx{DAaLz;7*4bHL*kG|d&K=MiYQz*VYrb4>c+N@+AL`uZ31|v+uHTpB z4hRcAZ)fLZ5(sVK z9w->R`GX9hDHoux2y{e+6DKeuEC0 zUow1iRs!yWvc0STl_o;4!UR?>;Tml$SW&R8J_}RyY4aI4QYIFh2dUY{vT!}2(6uBC ztOS9bq6iIth&k~ynElMNHX2hRG&F2u$uRtxH&mNDPFhp*Jo)%90gqD}ONQ>xyxq#& za^8_^td8II=v2+XIqb;?>T}t$!DVg0$xt7`S&hJT0*OKKktVM6(`GXWC-Ax#lk7!u z4HJmc?0Q2vAP5{QDBj4%%n^+rfrDD_fsHC)cav+BY@h@y40eFM0K3zEg9P$p|JyMa zD1!!rJvOd;JOh_?mcNj1a$a-xYH4$g_e1lprY=ImMTs$!r|n-7L`j9E_Y^};wUrt2Te%;Y6TdzV z@M?JWbDiLI8ore@>Jy=%fGnCr=~l>J%q{Dqjb{8)+p{v^pq4~39f&^@XR+4B$_z0~_RGdxg_FF`8&RQB2BJ#IGBPl5}N3w?H#l|TK}$Gt8> znRDJxwYIV{f!7bT+%;E=5M|*b$t7cNNPds{jF5I4#8dKxB1yc@9AZG z??~R>01tBbq`|AfxqUMHS+@F?TO?kU5E%hUkd5q5Q#=E>7g|Rb;>>;XJ$q6F9`R!f z?JNTwmf$-=f#F(+cJIf9t*^$iXWtY(QxDeumruY$7p|`O#PEr1`|i_8UZbO&Fy@XM z%6KB%vyQa$?BAsI-1DVQ-0zYJriFF3w$~!ak__xzxq=0<{_S!dE-KS5odsy zE@9#5(fGF8Q~lkXiFb8Erg2U@(JV3!tzH_m-2rMU_uOFLi)~1i2g$GOzvB6DmEU;& zH0F-M+@u7rEvd`Ts-b)@<$J}C9!``Yy1$g)*g3a57WRC^j(ZSqmw+b;Wq+wQZFxaf zswIC5L4N-cBsR+gJ0Tz%@!7k#D_qZBI2JxKA4EH!bT_0FPjEeCdg&qtEBrQ<{QWmA z;`NY=RPd2_wTMeEqr9&HC5SNuS>A^?)FPq zrHt%NF~T>5KW=pwOgw~*6XCzO*@&ZkKq{7tzZwwCz)~V;y8#h?!!!G= z&^KXhY+m8hIlOjvi!I(oGB0+Uoh&nZA`2FU-PqUh)Mg^{+QRnyjk-ckQ&BYgk>%ah zllgSNerq+=E#}8b=#krmrkQztk-b^Nsn_#V+ad45gJ^Mlg7~;?OquZEaS2{kSwXl7 zVMQxyTAjfU1r7Ld*%S1{&xX{6B(Se=^J|-KaBn#C=R>@^4f=t)Z#D~F+-oL@Zd$*auZ@nt`VS5~q=VBZ*}oR#HF zG(bt$#F$7s9DBnlP2htj( zd_Mv?!*%oU=GP>j9QAsFKII1o;%v7=Xfcqa^Yql0KNaz45Zjl$~D={BkMNzhi>d7DP6O2hXmCd2Bzm03BP4%jd?ykvE(f(QzCFq<3Ok7&Ki)1 zC=Ng#qh%dwYEp>w5uZ+1MOLoFZWBC*jdu9ye%)$e?z+1vnDX_#?M;ICT%g&n_QY`O zM7W4D!K3+ah)$noCiA4)J%admk0G}s0fFE<70)4@s%#7=wne|Tr_>01O?33iSeG9L z%C|fwurfEipH-)LbLckBXe(aT*C!K{*7wQ8dyU9UblONC0hILPb?XW}o4Gfdij0rm zXp!wZL3w3;$<{O8bVA?xS^}>46O=ul7NN}eRvc;v8|4Y0RU08uWEw`dULKQk15_NI zOP=4=B@ljao$s{L7zNra+X~5!l<7>gp#{k4Lr&2M4H@bZ~=&KQ=e!xzeizh<@O|mOQ>?_kf)T zV&&J_aDPLjlrQAH<*(j-noOz-2`RyvyMK*jcC$L_(!%u=e+Ifjl8o}=8KZN0LskHp zychbAg$o)kchmrOt`xj0CeZ{-Q|ly=Rnz1gb=rvYx2yQ8_n^1x9^S>KX;)p@R?oq6 zYX7pod3U2vGGrwlD;=O)6qR)`EcVLDB?cO#?>rHD%_}KEysG{jatF=hQ#KTxLJWK? zoIxE#ZKYkRr=_tpN|9z2pZNGDtx6H=v%Q*t@SYEwSIjqV@wke?>AurQdDn#+*#Xcy+JI_#B4%{I<8YfW9a*%xx?qta*2Cu9fZpoxwtM_W zfz|34n%9VQ#_V1m8K!<3NF?nHWHLl9%c5AL=(n$woNd!B;sl#&w ziO_`!sbq#18KBhr`3Oxmqk2YHn~8dWEi=B8a=SFasyIRVKtPV{v#tnMy+c5CJkq#3h(!|JZ{Jjh`Hs4bID$oin^!2 z`$}4v`hNRdxaYm5yK0ASEt`(%(y^2(?v0Lij zMP;+zr~|XE%dhV9*!Q%oPu+;m2wccA(iB=+#uo92)h~y~(p_bJly!sHXf9gU&pvMY+M`qt#NHAB1xX69vZ}WYu`n#mGrF)>$do8iPUgb0#El^LDhB1 z{4LIT(HAezPFFjnQ6a6|)-W0rf6rH$51wlHU;=Oe7Gdl_qg3Cao7G2u zf3x}+z>Y?dXq^IE)0sC#9e)n%>-_s2L z-M8}1fw?E@6yumrH5ya|XsmY|b3T^3SH1n08tq??bJ8XVL=r(hDuPTT$Z>9f z07(I3&1_$RHUr>PNfqep3-eu|x+hIl6M$$%*+h#ZgJzEH&PSjD$5@=b_8Tpy{^ZDxkGoSQ(jRtia+MMshIZVv_Gp6bJn|YqE zyw-ewW#p^tuWc#O$4)*7QPf>g0?0o!zdvtXa?Y!#witS{%6&nj!FSP@-b%u)C4yS3 z88Kd@o63=?M047n>`=Ndphw#+y6i|f38O5y0n#I5Abh?yyHGg-8V!c@F_7PIdiIQl zu5m=8YbD)JrX;Otp(Qu$?^_8&*6dD8!eF0c<3;at*W2|zHxkE+0H?l=<7JPie)Nt{ zJv&ZN=ZQp{DZowu#h)j@0X=rTe%6rKm53lu(`fLec%tnEXl&ERi6bPynwB%&GH{%>jeoG7O<8&tFQf(^!ktnEWb4-rzJPk>hZ+hq45NcBUyk`${ta* z#ueuzA%wAou#EWHazQ&(0NU;ekn?qbQ@fu8RV1LgSAbf`)*@h;aW5dBtwq%A5!L1= zL3I;Q#TEFS7=0GM+isk9sGrJP_K0fH3{WHYf`;b`k-YBWWYC}}zo`h@ldV(iz6IoJ zk!To;qmTX1tDsSDgC^b2wu}O$B@>hudK+kw2SICn5YI#3NPIAdROdOs+j<+(a$Tr$ayKCV*U4iPUXY*5-l?U&_`F-l#N>f zcH$#;@L^w8B=C6wGV&}sE0#bG+J@>2b)~Nl*Waq1jfacU*^+J=?9C+_>Sqlo{w7Kt zr~~XH#SSCCo_-p1iQw%mz%i@%MM3fZf>MX|x~ZVFG_ZJTcOMOYg7a7@E;L_&oYipc zLKn_sZzGy-EvR4vHF6thGNq2y;9f{NsjT5RmPq*D*}Bb-^}Hm{FZzs_>gRn%jJB0h z$AmLf7E+8c_$toVZzCGUXV@3pj#3%(sb~4jrPT3MJkg#S3yqHnaA4&d1zKjD;>W(+ zI)i9)CE~-F-#w31XG`Fn_IT44jC)Js27ToaU6b1{O3xYHG&mg~!_8vJ?CFp$OefFJ zdAw;$q03dit(VG>K*AM$H0X3ez=dfC2`^#wpPPmAdRMfhhsrRLgv(g{k^nM<1QO15 zK|nc2Wjs%Eknm~{qxN%DMxEjL`5^7bepsSW8RC?d7x#$zeG}K?um#&fkB`c3Q_&t2 zOT-t6Ctw_*QvLtQ;yKiflP7eI18f%lzQ z*B&a*O*PsS=Mm6NgGJ}4H+&&Gv;DSX|QIbaa~S74K~MtSJzn*3A^LKyJnB5 zM)dv<9)PRU^P7n;A0S7uK~BCzeEBvQkuQO-2H+Mv7w5z?2&V0NdYoPH&zK251+Up7 zs$#O@7iWPlcPs?{APn|PtOwS|y=uBSw?A)rm!GAMR{Tq~UE#WO&?M)xBScG(oaD+PS6v7qOLen$k+@C~y; zdkyEAv-NwC(QOvraOk&GMxTJbArGMX|1H08^vn>y(DM3u{KE3SFZhL)9Yg&>3;Knh zF~4wI?*;tAp+Ud!NuS{t6w@#4Eo{1>*RTckX#aa@kk>KV{Bga8?RbS!$FZ(KAMrEJ zM{IkY%9y8vq*`WgH|X{@ z7c?B>Xm@Lv-EB=U>~6%)?5?qvq1)ZRG}4_vWVUu|I?*!vXt4Q1>c#%Cb#M%Cu#VxK z4}iK$6r=W^#T>&M%rShZVQ>taV;9G*>n&pp7rjrtSY9BYKHG2Hzd)ZhZaR71)Xi#_ zt9-&chHie>WB9ZBx2fzJNwhb6^ga-pr{B-BMUTE^=n2QeYm_?vy~pqedEExzVXUcy z(Ek67t<#`C7&lzM&o$r={%{8UfmCbygIQ;oKgc!w!KyPfSl>mxZw%U%9TvN?A%;KL z!Htz2ma($K94lWrLxb2~gf!#YU-r_V5(i$^o@l3Yp6Q`MwC%i4Apd(lVF&XG8#teE z-ZG!+LZ2{3_X*{?FBlUl)#p%e46H%T5#Ych0_-^Zw*pNY2im^~u*3IjWB&JbfDK&| zggz4Q(C3I5Xgfus2{xkTLPqpi31pN5E2_F906PcfWF<2iv~fi1Tlu!WMq>X8Y#jOf zB=wMf&tb%S+~ZI1;Jojw6z}Q&^~^BN|2FRy)vG{h!8u@$ z6z6GuE}=o6=RP8uYim2;A)h{XBR63mzDgfMrp&fS@`tQ1 zC^vxoEv$n`e9ny!*zEw>4vK#`DE>rH{5DYh0x13wp!nlK@h5=dmq76+f#OeQbC`5c z{5YRZ1;xJ%Afq&%_;z7l$skuIf%>)pp0@$Kg(3uqojeUAu`P`AONAuQD*#?;BzVzA zAD1LgRFXWOK)ilUt_T5_ojhHX4zel#+mNV#M+FE#B6&J88f3Gqt0f4$CxHJGM_tw~ zNL^T*0P^Yt2k(8DL2Z^N=M$pk&}$Y2j802)GB%6BfD!kew0))*(wkW?M+oK#qJ|=XXj_zCI0PUjnGBDRu116aqyF zApe>O4?lA?q<>rof$cVsSN|9SWj2sc+)K0v2PN`!uDE^a_I^3Z6 zKcm!f4JiI7`bV}NauXl@6etD5(O~ea#&gv=c`c|Gg|2~Tw|IE@IlBlnre=dohCn$B8{dFNLU%MoDj!1&%Q%UeF!dT+x5Xcij z#iJs$9q9-aPdfKE!PluG~iAaf_&!t3< zIrgwG-_LY~WjQ9()W;@m2iXtMz}R9=0DDge>_H)P(S<^lvN)0NGU0-|MIgFb1DXVV!PJfq)l zaCkPKp~18I|D!xFo-yv1N2E;8kI&HHp~8HvQv&T%2|`DtQ6bFp6Uh-eER7DeNm(JZ zsqp3@$sB0wAvh}&|-t9Qf+^##+d&WY>X;zOPcG93|!+vV) zDVQ-9Hex>L!>;S3K|HUypYF8oZ{zQYqJJ6-L>t(@#?~*#j)KP1>|Q6fO+A3@v_l{- z1LQHFJU<#BqbikXS)jChO@JLcUoX&*e_enbA002ybbsGbpv@6rN9O(l!{_%DXj|D{ zDR&Zh3&**lCGmsniD*-+M52uarDb_4(e%7tXL%iGd7Wl??Jv+C6=27sJq6lsk@)H> zNVPi!ymjMT(HVB#cl;`n%JQ~Bz&#A)JOOsNn+mid(O7@9XN;+Z5hPrb3|?gznUx7IHLWg+t@#a|Lg6D@q9m(-Fhr9M31#oxkDeT zgJY4c-yhJ|@7Z$);<`Mapyc`7AbN7gLPaDIWFg0h$^WR)U{NA?v5fTs?A*9VRFyr% zSMv_>0SF%FSg0trvwh}eC}Zf@Gy7vi9PIb4eN^AinMG-EUOLh46kx|IO$Ayc9(Ep* zY@t_x_(}-8zmCBBCHh`>TQt9y%0)o5SK`4N>7k9zIneH=R2~VCfq5lR8Z1sH+6)19 zlr$A+^&;$SlY~$S5MRCv-p9V3?=t3Yf9RpIB!QQJ5-zgjg>^%FUN3@Ad58Gw**#Tg zyixrlrH*+(d^k4(8wsxi@M1gW1Jq)y;P0lvUKUU9!k7U__i3~HbW0F&Z#VX| zD~xp_+h?$qXAK{R9MkTjpgwulm>&+w zpdEB{8*@{I8f&d1yN&zvdLJaN=-z%~O>!8ke>^}2ekVFexDbTsKDK7*25~>yo49dx zn@3q>*T;WRwvEZ|K07G8el!Vpp8cZi`g9Wh{OnNK+eQz{#_vtpFK5?n?vw^)E9a4& z!DRoZMYb}Ug#U6L*-API|Cy7$#v)s>$ljP;xA~Aoc9HFivLz<_b&Kqx3=)3rJhF?@ zNO%V)dv3;{Z2aDoUE-?SybGYcEuk)}4xk-l^*RySTNCQC3IPJPO!732+0_8;*JP5X z6;bymdO1;-*zQ zwg_6M2wEaQ2Fk-SWP-48cOS)hjrOq!8v4ncvD|#Pd}c#W<(&wW=oCg0t>o;`HI{wYkB1ZO8)s<{^%-Ybr#jkae76qb_SXSKZGWc^quc~0 zx4_zm(f*yK!6OocN_Dw$y4?CyqUAEVKS?JVe)loN>2mSAS0H}>E`aDyv+Fj0c!BJfnWupJ|S@pfG3$Qh%}F{VCr#wZuc z-3uW9UIgs{OJ6Mlqi=srzyAj9D66%9u#cjTgeYwU8$5_HV*MUb6`BS8c_i$=E6{fU zyy^mY6+n0uZLtf4SLgH%_`wb62bIZ&A2fYn0}vn13*$iXV;m3J~}1>}VQ zIVdly475`A|5Y+*sH3+s$vJX_%HxmF#$lDDIvJFfU&J*(`rhs2`Ddp?jzfeDjQ@)O z8Y3dnB8TZt-QORkji%4eJ4|KtfkmlA!@5PLf`&4n$fi1bZ*Oq+-qGMxoZZe<(BNDp zG&s{h(|rxATfP7r@^M^9u(MUNg=PWqp-*1tg7>ZKHCRWt3)DIgqT}O1p3mws_68xm zg8e@xLkRBz2+YH_{+P;7d`xp9Q;CLpNt#2d?~QAIwETAReA#fw*#nR<1BkDf`R%pL zZ@U3%F=m{1#_-#P8PJ~BOJ$dhg!c)?{(p?!3dcjcB7j_Y1GMM$Q290+2~PvX{~tJy zw~?@H^dAq-?;k!xgBWj3w~_F5p!na@=lUePUI4GSio8&-(VW6eXm19PXZ2CJFwKy8 zy^VzTQtG(YM#2~~=bmBv-MZQNy;R=UW1PSHoKePG&d}he5_on}>QLgzgmp7D7r?N(T8pNZDT}q()y#0=aNHv@b{k`91>g zxS`v1B3&uRV2GpYo;B6iS;ay-W-;;{t+g3hzB*;gk zlu)OX7%CLvqx;TMS=QG!(>CfDFB2tQ{LrM%C@1nsI5_mqM)RDR}(DVxda>jt- z|5$*4GU9=!6Gf2ggfZok2=c0QqBVc(nGYZhR1l%IPJ(C|fIK-KRJ=Y{NG)HP03#;2 ze~^{hT-bDyQU_iu8qZd4U~5G?&`;s~!3KKFw?Y5zRDtHU3o80Awq~>ejuvR>%K(U0 znvHYQyaB%^pQ4U8x@gd>`wRhOD#Vp1nBay9Dw(Hc&UN0X1K@Pqy+s;-G#$ zhUDnBRw^q=B>dAZ8ayn42V;?!nO@Lud?uxY>bq$0bN$&D68?jbklZSzhOjSfHs(h9 z8WhUAyN}AnASAoMcJJ0bqUtWPsVd7C`{y-j5dMCbVfRT7m0cMm{A`yI3ltJp^rdq+ z2e5h8v3%13GO%7pMWbFb+Nr!6hL_LPz9{D!8wtD8AYA8yKv6f9-5Df|alO5p%K0GZ z_v>FeOJ&nOMMTiTlsYio075d>2bv`{#YV!3n2+07PeQqex~N<)*pi(fl|S1><)huy z8)0?EF*uJ>2e!jY{pNXb<#+c}d3+zuY1kvG^_c%|Nd>Uodq2~qD~^OGj)3spOdmL& zU86|&PNsX*$GBe9N2-Ugerp5BNXa1KIzf!i>Y;4RCPojPWA$p5)MgR156&~UnA~N| zEtd6Dhcg4(cfUvF`8J|G`yS0fKR2Pv@N@e2<3Zma@4NxpYyL##Y8%n61;xLhpE`1>5JU*gj#pi)w6RUDZ0It%6WpYKNoD#8Ld<%Raeh0 z6d-yiqK|W3_Sy*5ZJ5MtSeXQJ(;iVhBuSpky@Fa12P!y;RLsJ zXj?MK7;CIa134Suk_q1Q(otk1_na&*Bq-R@|$okpyM zvFG|uz3+#Vc%pr~lLiH_*B-{Sh;d}x{%1N3yRb$dd-2g{`>5OuwpxI={nec`h_(RF zcQ=cwZf{aR3v{wL6YWhJ(Ux`^b6h7RMUNWxCbY1V1`S)25Jg*q$YZi==x3?L_0H3ryeTL(CZ}W`+|%*3A&y6P=5~C zHn5J``Uq%l_Dq#=e^3nZ&zWQc(b~QXnrJ+KwE^|%UYF-p zI^`O5ns|-|%Pe(LX5c)<9y%f#>vi@#ct45FO|V|JfjNp@-}8$;<1T=lXHV0hk`Fs^ z9``b<6V6j+Vx4CG@6{>pa~fPqspF7%{`mj@VEljDi2t3lpq+>yuSZ{a4YU`DAnyZ^ zonxWB8JP>(-$|?49K>^HLVJE%&E}2x|9#L7`29oBZXZ#z`8i4*M}Ob>5*w&)1yqgAE4-)Ko)2ow2_|Fy{nYESldyU24X2HH0*>#Jek$8BPn*8a(|f(; zyw#8xeW{nq5J$oW|1;okf-W6#Ll($F@;7#7-2G&q-1hlq6<3xQ_4A#-;k$izm%y&Z=CYh}+Cy8vn<)ZX9{ z6@TQ{5N=&Ns{ud=xsKDuZ8j2awvq5#iGyoWkpkoXircvO$Pp2`k=ecKa}GCj*WXs}xXkAB`GgZF3A z2CV!}UIWf~#);rvIm1<(3uB_$aUe%3$v``p^EK36tj#5^=*lT|n`d>)UZ{uwJCQ@DO%0r&!7P9b%v)G(pZ#y6Nf`5nRa>{X^?Zd| zCtRiHdxBEOZK=>WS0drIVUUA)4cNUj5?-5PtZCqw$Ooy`1#rL(VlAx5RUbJ)gFVtH z56W$o#)M!+oa#S8gTip~yk3^(IQ4-OG-&3h>o6I-XhSnW@n@%9ReKdEErlRNcPC+A z$9@*4=AEFyt5Tuy8i|D8Vr7D1&}c1Jb}|X?O)_jUmd!@4sda;`cC{o%?@nfU+2YlS zs2}V@C7`uR5YqXZ@#^>!`ZGs*zY*Y0U(M$5_*LPN%2W};er!q^kC{{#)b({A(=9BX^qjj^^_x9e~U zrpKu@lsbOfZupCzu(hTcf>DRn66i6)VJXvtbCApzlq}y1HJjZ8)H+HXzig+$Gn6`B z9gt!3gxYDah`4I8%~0k~n9QFTG7n%s_^Bzs)26mWY4Bw;y&_)!EvSEMr@>$1m|IHp zx<{l@p%iSFwM6TWVp&Ip>@2$(NP5lQf@#{bc_W|8nJrh`boe&2S;Jol+~W1bu7`^WtED`{&t|979^zt^R$-Ta?@ zL;d$XBi3&Iun+yU6l&?Cj>D1^I?zWQpGs2bJ)Dm{Ml_7s&}S!t(vrN4R3DN?hZe;( zKl;7f$@AAqkb`sd36dV`gzq=&D1bi4y|-QeEuNi4cB0K{H|Dz-e-|+yk8#k1I8aL> zpngV;`L{yp&N4gEOukx3jIQseGKnMFPYgfZ4oSMtY)3z>*x0?`v4-CPuzl$L+kS3kyl^)gcJz81Vr>~BBTeYGB!H;*P7+6~iJ zLp;ct=&RcdUwt8+CH|AX`qwPK1E**(dOknB3&L++q@R8`N`r6oQb%(<3B$RBTY65< zYM>7e^~G%u5{o|;qc~@6-DUXW8VTg(Pml)V-p8oWPfwY9pRNkMd`kCAA&h%=iJ;&A zXq}CEGkyoi38SL>gfIGN9B+{aiS}X%s4Hi%z32~u_BTo$KYW5T@O~KEspR>*2K_#h z2wwBISpHc*oEkOy+mojZ8-RJ}e)wvl-Aao-SaymAg;iNwuy2Wy(xRjj?a|@lmRx}7 zqf_cOmz|)RU3#1bao(u^#!M>F4ksFVL!X<4;{^Sx4c^CkIBoDNccSh$51SxjWW5Cp%L5Rnq;CuieXP%?cj|g*VdLmTy3i)h3a5bbd8yhEna;UMhADH^mvRxReq{I1Hz(Sak z4EWwpkJBJ|i%zxrnTq3vUzvB@@H0zTdVG`yi}W~944poy`!xMG1wKD%_`X+6|292N z{Q;$p<0onGSIoA~1jspZk_NGF3k)bT$j&EG1B^Bg=$ zgD&E#)%}iS3w?CbuwTD6*H|h0v~(G^npDNK)uc{2y&tJPH5iq~Q~3zp)PwKxsMuJ}sMS?0-x6!ZWB0g1ywF5X6b z3Ml^N*+hFhYCMl$lu9%qgZSz}@jntZY&*t9s0-}x@KCbabc_b8_KK?Vn!f*VCnPB? z%Il!LIs!H-uYvaDUQum+jc9+_LwrsE-wy%2J^@a-N{A1x0WX#h?TxPA`rFjVO3;wu zxIum4{~4gPKz*D_>F^1ZrcI!9!~`0IFkL-r0{R%VU+^Z;gtDq>#o6G+bn7ok7@CQ1 z>uA9XqlBE+;7niSg_*v#=Vt2ro?2^X>iebI>R5UUO9%Biji>cFeXoV5?Pn~#nx((X z(l4-dElaO8(gS;{MhJ52b2ELB+L^w#Ad~Sz44JE09zmAp3oQM!!93d%9-3hO-&#w; zE&yGQkS54xUugSu=$aQ~2y*=~8Wc`bxj35`I({=*z4sUmzCfvC+={X3nKn>Ye-8rJ zq&@m{o&#i3wqlwyA_VLhQ>6%jG6`hoMhHY~APXzTrssYS0*Vb}w*Uv+`wFyi%=gXT zE~wY*V;#aS%d=K){dWvgRkqG^z~UDNp1G<$MuWovGK4hY;oJid7~e=+H= zdHVVG6m`Kd9CsO^Pmj@HwvopUcTSF4a*PIZOThOH_FEbsv+LZh6jc9eXNvk)#v83XW0-zl0QoPhbA-@ z`8TAh|HgQQmCsC7UtoNZwO)^>s^6#7(Jeu!l2V7>hwBTpsW>h`X*t{BQ(w0!{v06M zB1#?EE5@d;jR&>xdk{D@8?>&3x~$xd5NJ!N%i1Z53nKt>n{;18dm3!)oNcT*W!OOd z?|$ky^dQl2th71mvT}b8fw^yi5C5O*5`1lVUfJAfb#2Btt4lS;S>2C}XO5Mp$EG{K z2Z3fI-q)XRG{+g%1;?7ZX@tI(+R2T#3yrg19W|bRRnmoroot-7tt1+mQ>2eIvfWh+ z;QR<}ZmX2x5u4*ww7cOn*ogfE>w|ShTY~4{_Y$+sOVeN@#)y$$Lil&=Tz$XLUQtD# zl3^p-haxm$n~XeW>~BA#`xAX1f9S_YX|P!zx1&PI$7t~XVej4JqpHsR;b-qXxe^c| zBnW7B&{W_+07)$~o^=ULBM zd+)W5i!gK-fZ8XfZD!}XybkUA0MsrqZL{~Q+B}L))IT14yu6cowDNqc<$sx|p6N<( zFpkR(`x$nAa4+p6tYaw7U+|l%H_!6#4BQf=(l7!P8BOO&j!jg88C61m#!F&nMopY? zcRKXeKhMuS&J;nNF2F(aYsEps-i_9#H_b+x=BDnKT}klcL&f;ssij8g6bBUJFAM`K z|F~Fr@|TH_`v}AhH2{Cd>j&C?F&Ng+wWPMUdy$az0|2?x6Cp>QO#PFF_9cKiO!Xi- zSH8vGhw5DokSkAyej0w~--w^u7XYNz$3sr>HNxUP^*642{GICeeLvVPK^&pcqdtR-UvcKyEF>57mzW)ywKBtqDk=nhoIF6aaQU^&=2J^!z2l zo}aY*jp}xWHTy0R^}sO66~869v<}7J61I%i*a#4+ z$H^e~qkY#E55AH5?!h-j-#6wsU%+fJ$`a&Koerico$n3taXz@8y`!E(`!aKy(wQkh z4%Xio_%q~a>HO&$KNpOyk#0Ui{B)g|F%8Zi_=c$be5Xl0b50XK)A#ldZSIPgCIPKM3VXTZ1M3*x8xJ|PqL)QL*4E)jZHCPL^L-=M_LA8!4c_y>}p z&oe;@c1?$OwXw{elSy&DKrMviCGJ-+Ig0xgOb!PggkT+y?*kd$-6g`%3A)z4m%s0j z35wB_3b~WlD_grKL9WI-`>+h>f1J;Kn)th(kMqg%A@_tdsYg5WoXW7^ zIOw|T8qSrk6$d@z@GKmI(!T+p#dV3W`DH@VH+;dL#mU7*Ms1JcsndK-_aZ;bBG_$! zzF|=b4u3;>>)tf8w%J2rWH^6$yHlNHDaIon<<$XX$C;-;e;l z6S!w{;t>dXJ|q6c3GnWTN0i`nN!(m}E+g;h1n_-Hd0>r#_dndw^TB6qpFH>DtE4YO zx?#wBk*G_)&d8%>lrIv_r+(;PK}hVnoZ(|^5Wk;p|AOx^ z(0%~yhq@usE5f9=>DU|?B00272KMY;3I3Ns2@)_2(K&Yjlwe#(<8apBNFN)opOfBc zePS%K3d@jzM>54`;; z@vlQ3_&`kGoF-{Jkk(W3884s40}#Ul+Zhi`n)S!i8V~TZ7WcB}IccmPmS8`~j0e&f z4|xAc9$@uE9=M0^d$Vt(PqOc6(|gz&`t|F4v<;sAl$L?rSJPv=&TIYESm>g22%l5Z znY(=~bZKEW#CfgHBaWPN?u!Vs`#P^RaD}8V6QIw#Uoi%{NG{EDn@f)s^^t$Ov@SYUt60UMR zV^_Y=-kl68loS~iUr68BOZAQP&v~CPU1JOBUA`s!K9PX)eD!(aha~7*J3$F{yeazf z1=zdt_r*bYGtSpH9p1eGyoczV4=?aJpU&rfs8hUw^SMb}nbu8?$iM+tU+L;7;Bgyrel z2%W+PklQE1=Kmxlz2$SRS6@NhkF7P%t=zLq5{K#l)b5V@;W`2Oc1br32^aZVQ+P`; zW_Chu+B^K2Mc`5Br+Vu&2~q`6j7v80@3N@=%D?SS>pArv^q=sL-827F;y?8sT?;^a zAbr=A6aMl&bp1isnZ^Y0Q5iXi=M8*CNV?^7K5y22O>&kP;QZiuq6Q`?{YyUQ^Hz7f z(!Ut%5C@P-!|XdpRO)_lg3|wi2xF*Bq4TPEj=!^&rYzh{+uuvqDF3AxWf5{|KXe1+ zh;PRE=y;)g^L`3+!J|dSZj=)TzvO$|3Olo%^5)%p==gs;1=r<|K>z9y=CHLmhoyc_ z{IuPj-_zD!;B7tlH=_QWko1w;b8@IXKRNY}+w)9BdwzYE_~kE1FMC(`bD{>uDZww# z@_Da2UI`AJn$~fp$|OsD)tI z>@_ICU!5iXn*dV3lV*+5IVeP@Nz;3L4N)7*tV!2rIabPO8!88$RuLjuox<|?Azyx#DvrK#byH&Xas z59S@DJV)dH4&z>+?H{iMy^W-o${i+~zZmcP?HS?^G>~4~^NMka0or8&)Fp|~ZfXek z1Ek=0*+G)?awI>D=W93HCB7zqOY7rPMMlL&a@eNZG;sNQjd^)b6_i% zWuFU>O4F+LUJCd>jA}R zT1Il|cSsL`n0*gR!!Ks ztOEwfnN&@3*crq($N3&ON&JKNn))*hX%jL5W@TD=-U|WtelTH-kCx%*k?D)!^#62* z_~9z)&8UO(fgn*cI^g`iYy3Ni{b#riN&Nu*2EXNgH15EKjD`CNuiJ-&q_4fg&oE>8 z{($HE6K(9BDKgfTN9!KLr}5dGs06)bq}Njx9+R1IpyuM)7F0Iurnn~?(N zg}eE8`?GP(4&YdQLHzDm-7oU~E)XFn2k*0i#mbXZCx2m-_i?G8_Y5Dm+PHZf--R}; zSGEqsg~#UZBBIhXwDQWdoU+pSJbOoo=T!^P4&ygGL(86N;bp)2B_GRmIEH^Aes>J- zFW_el#3w@T?1(Wu^9tWrTz-as=hS_fBR2FYQu-zcYmAIXXY&39x1I?~8*E zjpO$zbWc$FcmF`?pKgF$@&W``7RZ}VNWv^34suh$Ywh~c`u74a7<{Ufy7`I}=VSX` z&l;F+S}UavWg5cgOqhh|^g&XLFOE}!FWjUAyOVhOZzl6+$QS%dkn+1}0-eWGdtL`f z{p2+9)BFRHFze`P;-}$HP`P!Poo9tt!Ub`ZzK>me;`VmSs#rD^$`$;o*&QdV%sdR^UK7y z=^T0A3E~f22fdaBim~{1#c0Y`Puxq_z0f~c%buyu z3M4>~t{YEE)7biM(-*XE;G=r-3w-Uz%F=zBkK2#fTsg2Zb1_VK_B221Bp^vW&tN-H zol3b#*gIU?Xgf);xqE^VeDXB$O8}|VzEU!5Zdk88N&6`cyw=pjH=m(>7ujdK#I!YV zfvBv_>Uf)-NCdS&Qu<%OHlsS`iE&EsX#+n;n)1%gAa3pxC3e46eFFR5duVzBsQmrL zNj=j+WV*%p6U1K^551O&im^CdF)Cw}AZ@RL>y%Edy`BchX)p||Y*-8v>SXhKiOu0VxJD4po&-AuLJk#5vt*c%iB>sS32`;1KYM7+6{rAt5VE5GUykIhDX9#!? zjRQ!%9TX$u?|*~#%+w9fGRR0rsG9!QEu#Ln8T$K&NqR{38$ex$?{&~JjhMCoeeAi% zTReTbuHJo>uSL^N;o5F9^gn)upT|b+LxiNq)@}AbQMUlfKq@~5uP3>Ko0a~3SGe9# zcRk5vI+%HkZ#V84+<%hzFAa11|C}KH3uvEvlK9ULlk|oud@cULzsC8dvol-Lddz`1 zpCEb?)S|XVAam3Q70SybWIKw*7IwuIJ-?+TO>#Nzi4Rt^_sA&SOY|E^X|| z0+)Tzs|4c*+523fyMfaNiT|NXBt7smr9W_u z#)EKPFcS4rtrGNp%khRhj$PlSiaxx(E0X8S^HydeKQRuePb*%zkD+t{# zGkB*2q)D^N2DuKAVSxDp)k*i8jj{we`GfpD^Nc2b4?(5?TQd23>08{N7YB1d2{N|> z#lc)qf)51vH@=@rlcU~Ar*b1x`>yKs3BK0@#Q#1a>5+9x`j)6SVSY6MZC`M550g`Q z6Mc6Fi2uLXJ*%`XX|pym-2&QArtg|U*T4_%7kx`k;XZF1^aVz0tFDPYV}ST+8wr78 z<30&;04yv$Kc;sgfu}bk9=h26s|dX|+8*q@!?am(K-ay{UcmMZ(tD)wk4~uvuhl%> z%kIK!32!|_ameV-F(gHy++i|Q|!(;E9;LJi-RYf(Ra>y6F|Ky zK>RFDBD8-^NP64}{#^)rFL#jmmq@^#;a`g9dqx9S2+M0MKf92Ht35^hBpKQR-w>6b z>6$icIzI>X(5wJ^m+-fP{Qc!E5HVI#wK)L4VR#|H`}&jP-~EOmYP`HZ(Kipr_cHbS={XP#pM@*YVdHTKpe`dz+rvXqm9p`(!G8-$CXLSUK|6^?*9Ltz=nW$#$gZ0P5 z&!Sj)x>9}4(U^vPQ2mm%T!0>??i8bm$KhWy$#@3FTgd{iF}4jotfz9D?PHYvt# zfZW05N|5SfRIeSpK=bEm<`Vur!PSS^o!_&*t}fU^`RAK^3*=n|TU$+(4p52}cXudm z#oY?U-K`W4?hZvm@!}4}y|_bx6nA$C*5ZNUlFhe2V>iz;b5G998M$}-%)E1F;_&kn zt&U~QW7V`oK9&ph z@TBsBZ9hnK=Kt{cyPv~+9|thz?Ap5}slF)WofGjD{n_=r@-&!n|1`*+w`IvX{ewb*$OoB1S3ydE~0?zeHJnLT1!PO+5y%w=-w0;N9Y{{MjPj2jt~e zIeV`A#MN}&#bj-BBCwAv}1p2 zZ=*Sv?iB;^A7Zei%pk^ESJ27)Y7+tIKKKn?FZHTVTu_K-!cy!M!t|^cx~24948knR zCR#5?0e%QE?O$zVp}R|$Z{ZJ!jvW`Ov-->|{qM%^$|Hj>{JuZ^l=H*JvRRtEK`yBj zKT2ru81m@fX_@0*NbIzg;92%bzunyabgslYh}WZc&^!Zkl_RyIVp|pUaGiR#3**wx zn#jj^JtxV)9>|cZ73cWZ=HS+8-?6(vfG}12tm?+yKyyUuu{mnE{$fab#R zhW7AMR^4XcQD2QGU^pe~a)vE@V(Y<*$+OozZgp8a3yre==S%c1O2I?~in;K_={YlB z|I3(p*5-{BldqXD_|!?=ChR1wk2~NgC2Qt&Otf8Xs-$y9d2|SW*>zKl<}m{48_zso z83X0lJ+uYn8pW`8w$l;}awd(p2$Y=b6J7PaBr`t=1cuhZmIfBTLZ_2=&C~>fNwZ*E zR(r3CFyfSWn11Z~o1yJ%pW@aLBpZ5?9e+Qm54~ih!8Eh?N(}kTq#=|sgy9X$c(UK2 z#K}TDqxXS2;@{&$i^o!|0-5moQmrc4|9h!!O$|u=K&5Z7D{cS#cg!TqAJdBjS68TF%+&>2 z z?8ji)&m-?#SMgZXjU{Mbfto?dR-QwbOikF_!h||?Mcc$Y?p@HgRR#Zm2lo=BW;bY1 z?1Xf+vD6FIBjsAhhU=kzmhCJ-HN5Y=$;TNwKFJn#2u|C^{lhoOmEy#bOu-pN9b!5nlvI{O@rYOugYjTs?ZMmlDi%w&bM2G3;DM2+ZGFa%CI7FR{<;rVBFhf3-(ES z2{8UaMxARfPnVhrXtMlg>7SOlRLKZGnweiWD{sCQi(}Ge{tpul?~a9y$W1gXaEfuMk5`2FDC^ zx2bj(@|A{w;ocomsO&3?HeiqHoQc(=;_}A~5{puQBOkt;z5DjdP;nT~9&;Fv>^DIh z0x&t>d4ix#ZXDdepYLX2XhU(za5IiJ^zOUGL=s;7)mL4=B=ioI3q%a#l(}F$GutEG z{P66YKtk$0qo9;gJEVnifO`t&%#8)bz6#OK#{S-O@Ne>8z&u1V_zcgeTnVnBkw%*f z-WOR{J*7ag2{~nIowB&iaIy4BctbSX`pNbJSJO=O#Mjk#H}KCB2~9?VewlK2NXmuZ zC6)g?z*M2KuHP%k<1{CE*!k*(8p)F~##OSvm$75?P87+rK|G7=Tl|<)cdu*R${$my z6C{*Mi7eUSo4`Nh$?8)Z|9T$N_P#)1x2&HEUKu~%VV@zAIM6Z#A*loz6Lm++eexC6 z#uHfHLOhx@?w&qH{H#bIb)(foU{SHF{~T8pmlz{C`D+>)kc*@H){Rd!c50BA@sE8; zAUn%YTt<;;3=)4a@ybT-EHeCJ^H`O0T;5c%`%ZyrjHIR#jFmvM6jTYK3&z*8L91J; z%~ZqiQ_6)(@#be5>8WKd#a?N92kg39?3ev73*_``dwlkE>&ECkeb-Q(ZM(C%fHb%= z;q9uCp98k(UQEoEEPRpE5Oby_GwGiorfZPQa5LIInw?-ASK#{-DcLP&qzadvHY=AB z)H4)0jqN{>?G{g;OBa)42Gr3DNv46DS$D6syW8c(L=Y^*l=1K8-oqU`N*$gqOXavR zCbz^TN$_~1`9JHg%Va)G{r6c6laIv+b<>{%%>M+__TM`(^nSPKCW)b)z1L-+f=}k9 zS0uOY{TQ5)_H2_^*htjnEE%_a+3_;K1@_5-}iV0F@mq^3|kB&Fcrne z(0y@&iYSZHH>Q_wXKu1_w{+qV_Pg*Czx7U#3O?>Igm9f}#$0~~$PY<}=4xbilLz7K ze5RTkct@-d&4LzfzdVo|gQks-HD40hfrDShLQ$rN;laqHq98QUsF9`oV^E9;OS>-8 zUK>skVrf@ILbHDib`xMVDPk0Zo2P-h+->%sl`ID+P@}UdBhkPS!W3Baz|U&GBZTp> zQm7n`GPwtLx%Zm6b1aY3e6`=Jm{f=xocDh%4DZ|sv36pj1Gm&`wWc17#!D!HP+ohW-zdaPsd3?>1Ksw&OC ztp79B{`1UjFtLd-Bc9m{94qy`Tr{KqyYM_|&5Hf7X(C4uCGd*f-_=1y@mA(>tuFcB zh~EWy=PPazFms!E&@+8d!41Zha0a`nfr0K9g#`L2BEnU$Zft**@V62KFE4OVYxbZ& zIzGu4Jj*xmT${N4$&Z{6VmiSZcnYKxeXjV^wLtSIau+Kh^ZoX+Yn!?0f_H)%`eJS@ zCRwm+E@{b|`@7U@g>gWGaz0WkfRmc>6$+^Q>U-J2i7$!U@0-+PF28(UDV~+X8@Nry z82o_#d3tEoKg7GvgHZvl$`ApP>Wq_2(`u0{;wM|+(&!Aou5waoK#^x zCQPrGaFxazrdm>25Ubstz4^DT3~WF}yh4nmZfLk^^tW*5D(am)P5J`SkY~oTx}20} zvm8Tx#!LIZO}1KzVHZRiVdZmQd)QQ$6)_M;B_8-2LNt`l?AzZ4P?4haKgL^#Nn3Af z2KRoWne(IYZ=Xt8OL^%1(?or+*Q~a2qf&wOmuH#?uz;+vYBpP>Y~XyxnJ^L{#kuo> z*D-Gq1~5B$Ep8vC+a=ixU_#j}xDLXrEtr!+drZ6%Pw`2NxKox$(+Xffz!ETF!Mf`D z&eYIoYlagfNPY0cC@DTxkQg#K<)8f_cIl+;&9;K&(+IxpnYhw(b6%yn=V}PGm*B?) zKmaYo>?RUEI$WSRd$@ey=`AlSzyGraysHhwzS8Q3G%>REi)jAc=8(DYgzJbYcAt}3 zuCB@3sI6^9Z(W4pp-BR|@sH*Hl%G|!++ei98!>Vz@xX}T;=neZ{s6novH+~9^*TKM zpPD>26M$BI-pgl_0)y74BHT?!>+%WOV%hQDX1l69?xtt_B(V31S96wM%=%|M((Sv)HU$t2 z6E{l0Waq-!Yk06rIoti37ceD=RFTLa>nfU`#n)5GS?~RJSv%vysGmis4_9LoA3?#6 zZk%#{sJAw6#Q@Xq_I(aJ!FXgss=e(8tg;=x!c~@D3%SWY))tg^uewa|Dq}v-7mX;&Lz3uqu6%i+zDW4Zy$hMbLOarGG+8p$V@bk4r z?y~=*qCtKT{7qA{1(<%jz*YcJFR>Y;faP8}pVJApf8j!?6{)tTFO^w(mlJXN-e1}V zBkj!u(fn>pipmKUN`eH)D+5g|aV+N6y+#8~O_dZMzb_YU$~^?9SVkbUqm=bW#2FX9 zFyiV=3o)*+MI3nAsk|fkNQuuc#KiRV4rk*#WZggFzUy{8=LzjoLBw5NAMLKG^n2}= z0FHWzjW&fn!LtrzQ3Y>dNd@mqOosFn@R40ExceL3FFkh!iyeRDm|ujp{hv z(T`a8A*SjER0SqflYN_jCg6F%_7Qc_6IvjD)zaA{=%>O;TuzD`g6=(e#$b zNFPk^WJwqGAMP%ivf)|FXx~BT+}gh~u7<^)I?HGGB3$?vK7e*wY{Hh6)_ox#GPx}- zjV{Dho{dP3)&0P1eznTj_%M39W{j-@WBc_mpSH9zu5h2RqRfE0-YnGqZ7QbMP|z1a zO9|!p%;`TH-dEi9>+#XW1tGvMk8hU!rmVexKdr(0n$!1Z!7GGndIf)Pouba;DK_o;_JA25?7rctMmi~#IF1(>GNGcoM>Jd8=gJ5`*!`+D0yb*$vW?}OQBFS%# zxU~Cq5NwV#qhRgaHZt|$ytENC<`37TX~JgCH}c#wOSD5K#jhl``a%@vT!<`O_Bg%- zwHgnRp)eu^EIVW%#J%u{$)BjKN49>AwzG9tx7yZ3C}}(bKe;*kQ~U``>wLfsEgC-+ z+g+dvzAIX2dXbfQ9SFMgPjwcYEqv4RGfBUi>eu%=0ETI|0;8Cg@rxFVasbCC7Um5~wWkKP`+2PNPP=ELhg_a&E- zE1HVcQw6ykW9IrU)f8bN7sJKT$MGiwgoQ)wn1W4@nC*HO(6v!eT*%zzW`gIE&$;jA zraTDNq_|nI2un182^y^O`*k%#&cBTv5VjnDW5uxhr8U;Dim03(T3S=lxMsy!i|qGN zPih;~*6=U(n^)J^e2OqnJw{{u?ZN{&v zY}Os_C=Dn1ldX$F_-qcx4}dx139UAw)2QPI>3kUsvXMqz6PC4{wKauHtiTortqeWw z0L`>TEfXirjsRURdwEU9wq*m3-wS2gRTp)7waOU2nY<}RI`$mp-t%+W)(h-rW=5I@ z9l52pRjs^Dthw@5Kalm5Xt!Ft;Ja^{hjThX`h9xJc2%b zs*Bt*J_h^%^h#sgH<~md-sh;%9k1dC+FPeZE*CMme0IW|EcjhvW|6CJtYu`PWo+{M zq~By=&OMetjuiuAteUP!?_Cte0w_~gPg&Dm6*WDpYSE}^(Xvx?U#I7XQA_GFQRdj# zz$cI$CTa?+*Ipim7S_yQGI3^rewK(*g`Skgk3LCpAzAU8b5g0iX8ky=D z+p+L+aA;@sG|RLYu&G$TOHCyrGGfha88fOhLf28I)u}#QYaBx)0-G3{=-GcfaW@h^ z)N5$=wwM1auFRoPTh&6Crh=sbEPdcq{yJ78505spbWN+U(V;>}twNryqNc8q7kVxsw(mFssZt1gC- z%wGczG3fF4My)2IVt;wzrgXj3IjZJtJ#GUXBTX`d>YDUS!0)B8QeE8N)wP_J?`w9= znzwZqjU3FXjH+bSirlp{^c*aC-v*W7Msf7Oi>@-yQzSP z)7H>A4oiP8{4jF((AG6pJ!8XJ`@W{O!lceRAxMv8v0O7)to$d}VRy3(n}udpWqY;} zJ0WsfWGNy0^&eW?lV9_Nlj`HTMs9*GF2@=ghMGEhMukz~I~F@wMYF$7OsrY=&kxeZ z*;fb_$P#LA(v9>??J7A7lj&%0?X9MG9vV&9*uE*n`km-yr4wDLVHo;KH+K()hp8e* z2C5lr*2PDKjg@v6>M0wJOp!HsOGK50aadLFw3ym7%q5e4mdA$IoViA=6vBXpIP_nv z6jQnmPKKqGN!esD{YsM^-3BQg936WV^U@`~G=jzz9YkHI_s`S?BE!EGawfIe=;uqJ zi&{3dR=BGCLU`;4@Pb1~}PAPpjI2gQL&`GxpaN%V@RfFZ{z+Jm=bv z#Ow~0mFXE#y46u@=&a-Du}XeM7}rYZhfQ;-8BKB3=v4-?L^>SSHbq_%Y%vav4i6c| zhg|#4*M3wE_P@V%RYbC4h_zJ>IHap-PRhIkE*MoC^@yil4&qHy$+Zj5~1i zEn$tTbYm@PrLUNlS*Io%>XqtY;A5s=t)+?GU0rDrby`(cS|YQhw=`$BwAyE-`HUj! zg%3Pjr}KCq2xc4{Obxn$2h#K>3ZmmxYuns_gw>wbX{9pcbWA|$+8DyFk1aYnO+==8 zMs}48Yib-^^&E8&Rg<0_0Rb#s3Fj)ds>AKc>TiED^q_zPqddc87q($o)a`rmf@I*YKjzVMV?7 zQT?d7X>$GA+A`rm{g}_8@zwY>hO)lSVLdyyAV;`TzH+bF(H8sN%P0*WqG5i@BDZmr zut($JguC{jDn=UrIA+s6yALk|v9PIo?7X!t@RNRQJQJU>_xf35`6y=>xnu3^p)TLy zbgHpqtyAlwcT&nnBP_jj@}*9Se6`N}T9?+g5o{4L)yDBH$7`XbRr`F$ygzo<9k2M% zzhH&pmunt_1jBRD0aCYeBHLn9?{#rU{!@@NyFZR3)n2xw`RuC%vzhzDJa|?-6L}hq^QZ#6-G0vrJ15qDo|IIgW%5;N zZCEF8MEMGpfB%u!inE@Sk(eWUSZ~`ggVMR9|F3(k)Ah`|Lz@m-VHV3HM2};~N*{r7 z=YXc3{yoppHXHs8rSRzy_vzFo_Z;AUjqtU{CjHACRq5*jdXvI?JZtB*>Ns&R)mFXL z)v>6?_1@0kTgRVuGpzlv4w@Z(Y-5M@uveWEW3%G(YCS&PlIEB4~IX0b)un^R1P-{OE6vBV#kj7NzRayE`Hb*@QhNzF^5b~JmbR$uoojns(e zIq`h@jA`KJS3c8PB*87qChFre9YM-*OH^L%;aoiV#h4d=KfttQO1FB$dz$iEq%j+K zj1G5lRj;$WTy{z+XagzDbxtIhQKD_u8$Zx3 z>C?Cho4yo$Ag7EWl~0ef*Z$TR$aY4ybb%c$$oi%Gdr?L61YLMdT}9*1n9?yF*-3|+ z^A0`b)eY7bmAAEVzZmI$KIpvdCCK>7WnfiUtxsB|tZ!tsqijuDrJp(u9|T}AYH=W) z*N;f0(UN8&(u7C8=o!`=@EWk9E2|P-p>il30Dx_J<)?1G*=Oz%ndm&NOpA>hD<2*F zbU#-Tj;q^h314H8>W?-GG)*NRRFq^pVFEYY?WSp)Nyh^C*JqC#y4F78`fXe1;G)P_ zdD#t*U`~B}!aJ?tPiPfb)2y9Z67FvLL7FlpSgVGe=i2<02sd^JRdn9fq#mt&?zDA% zIncJ|uxWOfZbg*BSzVj|=W;lygu5rcZ)$$XoK{@1Y%Vo?uvzf&KjjTk+fAjdmW`@WB5l+g zOVWKWt5^BXkj-kOaXjfDnRc8}REAXK6hyGJ9P&`=odOw0!$n|YI{?Vv4*W9UEC$!*Bh;Gu(z#>sb0mkIEyYj z9JL=#+2^6@mCxg|%Gj2K@KLIJtl3`DbW(ZKVLPCeSiB0=@YIFhP+d`{Hni4O z=kB?|y1Y(iz4Y}wGwC)Q z^Y}n52Q*!`^bsc8_m5UMVO0he4=$}a_yDm~=4ZqzJ9)w{*vHapC-eAV(r>5UCe|7{ zH+5ywc(+Em_ZK?q$qKR}FLj<(F9}S0i5gWf$%t~0+DYi7IT@cMyVSPvZ+(*`oACC_ z+tj`ATt6U9jX$Q3l-?I9?UzXL(p@2D7%Qtp}bxb*1|x?S4^&-O+^T5ZM9nn-jA}POPKIdYiEA)GXT(q z?iBwbjGRI9cGzj39eJbWCvxh^yf36Sag<=v+1-ohtAnYo+gP2VpA@g9eXrOtl^ z6CPM{=>X*;ELYr5;_`7b07>a5ch|x*f>pp>#OXg5j*ZF7+FyIdI|Ob6ctY~&zX%Rn z0q4=eB+U4LtI`y>Cg^+0e%+hLfbaWC-#nwiXRYljU)R;XUqw{CnN)*)!@ni3$l{!^ zg(_n*k8bZ(swSUDoa{0@e060!{}|`;HuP+u`u^_wWfcwjCz);w{HtBYLTB&8YmUs% zC>!G@T9LoQ=(<@|BK0FH!(@d}>d|-mtYzR^aB-a@F_Msl2dW49WWRA6W-@>1_bt-M z`-fe)-NqpnaC^Gy=9-?I8gzR~ z@b`4p@WTu?!{1ZSzhzCf(`CC%q}0YO&Knt3PIirgHEx5s!X8%7*rC!u_~r#Cpo6D; zSB-nKK*A0MS!#B5k6&8T>(@V0@CutGTRdoeEp=!)hUSydNLKjG?zEGyW_Y#2X5Y*#r`5;zv^HL+x$wh`P2wL#dX!SW2oDa2Z>=^Rvxg1xL(|jlvhvo_ z)`q2oB4^H*?MrL@*3p%BoCZJbww{R`vJ%t%u8AgdmU+V(&u-hvmRl!DbV*$r_ytAD zZ6>T@F>cc*6pQ{C`7c;tZd1PlL{!fGV8tyY0Bjk_jVO--dScP+@etHFn5=qGUB@XS z9B~l@Hl-EoQ7_jhBf7Z|-)%^bkmBydilTl>1u$)Y8u@@`F`pMPkpj5g`lML&=JGW! z;)4=^MH%&P65!leX2b*UR|g|p5}}zTqJ#vHuZ^0F35ZpVARq%At3-St1Bfxnh`a+N zW}*6pMe*UzIRRFHbS2Ax%k-Eeq_?5)(+Ls+0ETQdVOzi-ZhT%2tesLznJNeXkuk#Y z8TD)&rgy<{57r`F`@is!~Mp#Rd2Mib6OyxhQ* z*>3>UQ_?cnvj1u>j#!98_JzEsO^int@=ZeaQZ=Gh%4sHQFbzr+scYV8=p&w#l!PUCmxDcbR+Y6m->t1R%abvrllv z07$L=a23kFMK&svkJ!LV_WmrlR*5JzPbYIlcPuOm@U_IH)y2JGUt!gAxGC{s!v~ld z%PA6L^SLNIPYGS?$!1usGC32Ut4Z9BnoIg#ytrAAX_p!rcB>*v9b3wDH$W#on7PS` z0pC+`9GxKk3W^={Dn1Z<5AY?zpQALLN*k>yEaRzpMf}zAds{mMcW1y-MvH#UZ3xvl zR>8HJtiRUnO}nKGjJcdKf@KtpcpI~S5dw=G0^RUF@{m3jfb~Jh9jbz#|NJUUUBp?Y7g}XO5iS$c@xvHp^ zkJ<;9ycw^c*;eR!{dHo1!|6QBbR3Ul&a=t)W*L&AhtRQi{8&31=rV78H>w7* zFx5Xrs>dR)L)wN3omEej3VZw*SUD+~jUfOrHnhrbN7jnG7k}`)oe9~E3kW&`!~E8X zK0i%IAi`jH`Hz(vm;dkw_;Mn{Y+&)VE&cutP* zN{5iTwG~hg;z2xe(Q%PjB_nPO=|OFTb|H&kB(Wu_5oH;b-pF zaS6-Qh$vNBN_phKQ!(Zk7bfZ_1`)|h_4@?!>fvE1z#53=cjj+~J=-k1mGybmUwb(| z-D$p6{YKsIII5gkGUe5A%_D^&hqjYyMBN?n*RMX@D=3GFgkl+`pQwwVi|I<5aW{wU z6C%t>eKN#hK2EY~i`dY>Y)ttN) z7TpgCS-o7Sf2V#&lE3=J_m*+cqwfOk8Tdqyw0xq)f0B;@# z+N+n}lBe5i)BQSeiL^q%FqRu!@^Blwm&BENK%%Wr6jBiRaj0EYPWg;PYg@t%%Np9U z`(a{R^gNuY`TW$N?whR5>np7F9nc+u4n@y6i8R)}7#=G6e8`B9`+!fI_JjD|w*ISPaq1lqrH}7i2JHG=&UR4xTJ*iB?(%MkwL%svd zUOfyx&IfLPLj3c}M|&p^W?N&`vkR(@>`H=ng9XJm@rY~b>)?Qvx}t;3^mp7(PBPg) z#v4?W6aR*c0^r->c-hS zrNfzuL9sWxz~SZiA+FAdR1*@NG_-PSGPa&Fr4XaD9L!u|`}1K$<)|1@gqHAL9%z73 z=#(k=c4tg9f?%l3Fna=@KYsV|iX?OtMoHG@C936}z~iENuGHwLypeBlJ1qFofmq~k zNs8M4Yik}>@Zo1fj+b4pIKf#6Nkiy8gQZ*QzhF{)nB*5o9~2wn^BWw($rQ{ke&_e$ zJf^=sh>8-HSfFqOL$E}Hj*>hRLVUq^>C6aFUvLb_MJ6}GmlI+I_MxK+Z^v^(hlqgD zEd?#fEx9Za>E}B$A7SsyUL_MMVd`Iw*CSWBl^)H5h~oQR*hPYNJv|>s%ZumxUg1Ov z?lA3?R87kTHV*JCC*A&}h&RjYO0XIg}La zfg2LdI0bSh3HQoiLQtQ)NsNKe_#`X%6X-%(455J#ssmmGmDB6t zPRn!?K%GDtwExB1KB6a(g7cKXUZ4y4Zggl6$P{#;&`kyHqk9#Er>l*wPPQAr zfk{0irkx5}k1I&?N(uQ0MgpCIuxZR9@3}zw^sj6XCh#z>C{BU=GXUa(Q!lN8BS@d1 z@URi)O99aX3(`0%h~YyoaE@q#DWP~^7>b)PL=cBd;W?aRqek|b|53F0!73Ha-*h4n zTAcX+*~S50M`AY!n2W_4|P$ihBB9pIA3;1h_o1%8>gj{L=Qf^5c<$A9WDpJ({iE&k9ZAakYjF)3;!1m z7x$uvc!Jew^5gDV;Q4z+hOmGFaMk6Xi6Hi%ZG}L3$R4}|2fl5HyO(*F@RXX91!AUu zJ!Ey$@?e6*f{1B*Bii3Vxglg=X>dIJi=D~^!dH;fxA_x7Y7U~?mB+E67)HS$m^PdU z=8yzm*geon#NDGqq`~^Q*tES-_jHzF22!sg3PM!jLLgsWc%j=4yXS>;fa+-k=z71k zqeA(?cQi~O;NUKGk&VX+4435VH+8u^RxnxLcA~-F9TS}B!UaC}QZ)=+NPet=c45Pb zX&N|E{t<{j7={gZhhf24PjFAqoR;wgNO1Nmdc)APJ`V6%jObuea3!A?o|_|@-iUiF z@F3_yrsl>4)3P=s2M74F9%FE_Jq#zF2;iJAf2;fL0tp+ILSlGce1cS9n4{yN2fa?w}u=Nc}#>+1jW_-&m{^i=K5{@wI}6S_Pr z;RYuzT$Z(c)Uq{DAhBhgCX^m_MLIZ&0CM>G34{#hwN&kUBIXbi_#?w127w#PY9cD~ZcU8D zmC{IsZiI%2mFSgFUuK9981_|&3JQR{f!9|xIf|LFa7wX~G!&?Otr%#p1u8fenuE`` zWoduCn7p|@6BtMkqPh*+T}+7_fb%9Mz(6c?jppa1dr?P6dr!? zfPV46g4RCwKUX8KYp=tX@Bady_^sfwFvjz>|5$QYEy>r*xB6psaTMn3(yxL+20Mve$Ik_~9E9vQ6()MYE@i9uz)A&r*a3@{&)|eSi^8qReiD9dgZ5 zNL_PhAI+)^xdlmP17`zCC$VS6!Vi%@3`2aokR}6WJbyfpWCz*35>6`HZG}E3h1&>c zS6kl8kz+pyB?6z26L*Jd%K9ko-^|O4eMwT7Sz6DgDybblDuOkWz~2$;m*DJPeo{ha z)$J;o5Y>WX*_v9P=Af^iW*5;;y7c|ts8ZJqM)1FUn%`@Fi6X`Lv58$Km(lfB@HWNr zs(>P;ueBGKyQ+07$nwMQT^Rkbz;T&#f-`G|LI5wh>b#|15~H9;&1f{31m;&zI*ZZ4Y$&Aa(0d9vvX<-LsCliaC`|6i|IsaQywE zlt)NE;$u9ClUfWKHQPB8WGk6SH3gO}EZQk3>#ko+-teyIria9dN~+)K*N5i&?7%4* zAC6vuZ9AKS`B%L8rev(anYmq1nXxkK{Fg+pevyB*8DoS!O1FQ{Ld zg(b?m8^%|D^FY5GNSmreto-}-1rklw?C{)m^0b#R3|_uB<%4NHRDT)T-c|phy3Vmp z4cp4Rk98}SJY`P3rTxX1iw6V$!>8V(+za8OfT<2!ULQQ@#6eHlRaaxggr~nv z@bxohQ^5<#^`MX>2N}-LWWg7uwx$9?(u4SG-BokL*Wjh#;%8pH;4IDH*Q|9IO>Ca# zR(r^b!oRB^$9}7<${iT!P%0_pFBsZ$%T%##P&^#+pck1l_n;z}Q<%{aas9GQ9^ zUcn}wGqTz>d&j_$ZgbG{xU-sPb@nljJVVOe8OX=_5I2J@vCk4?V{Btp)zw8R8N!QZ z8TxvBKy5Hm9L7{u*EhSaoheLQHAk?=4s&R>l)UYu|LS3=flp>vH2m;avH7J5ycoi`kUm-;P)<{w(%7=Q1S zh-;Plok~Gu^XQsVaf((J~j$f)HE~fDd~=z$~eA4|EW4g^GclvyX9Z5Cye}8ZjJYB@N~-F-#cO%*e8K<&@jk5 zf*?8(j(Em5$(}l$OI83RvsW9#eyW-OM-lPhhf4pu07*?)HpCsBSG%|by6VRk&|B}N zGoskF8XX(0jr|j&@^HpIuf~LV+@++Wrst!>KbO7rWG16|&fCyDVgCGe0j7%83G97?srvpVk*K;-~KT*dSH?R-cF<{mxBV^^>`=IoHC4d$TTZuSbFZ ztyEEb3-C8_!^QU9>t=y1RlvRWd5h&G&O^CO8KP}r}QjrK$O>0rSa!7E{s)|w$r$QLa;Z3YW4+1Tek zf+1>{F$d(eQBU1JkL*dSZ^%|^DOUxHGoyU|%;ENNQ{qC8)Z`>juswS}X#;|(u%86S zaqbN@_wFPQ;%ztC1+C8?UNyINWN(^LN6@RfzfbKq7TG9ba#cVyb1m{;X$mq6@c@|A zxv_XT?&@JhJ|kps?YO}^b;%kxA(Q^3W$Geg#G;?o!WBG;>fX_wZ*OjvyJQ->J_YQe z-M=(4|LDOQPj=S_($pAN=jOb3;~$+o$1(@E$Yc5CbeTx|l2$bSlq*KrUR+b+o)#&fVLXuKk}SoI*dIEL^3?)N>43mN-`;%0dZ1B(Z^Bv7HY;0<|E+y((@auB zbb&DL%^z_~H2%TQ=Ep7N|NgCmWVIZ>@(pC$9RalDDSi9x3?ZSO; z(iY4y1EuM2Ua6u=00sWso$^a(W~cK8vvym^ZDGI+xNDX8A9j+8b4_e9Q*UgLwA%=H z{!W@_o~!Au@mWUi(9f0{azwKgE%b_YiUHcQeS=M#a2G!anwA&)dS42{rhjDtcMY#R zu&`Zs)b{-6;f^-pDFEOW$ayRq$a>BNxhHLw1?@qFWBlhD`PaQNJ-19U_$f$jEeibW1V264$ygxvjj2ffBMj}i(7&nDa>f|qG~aiH-a z^U!-HFqd360(??tj5~Z+PXmz$`Oqay+oMD7XMYFa3@3umWuEcC)N&Nlu>IB}|L=Hm zDeL*$>&zWyeD^bOMid~*#;HQvgIr(E$#NGMDe%{4Nb)SZSZ#8%(tQ5Z_;_JsIQgYR zg#V7FvCp9V5R0y>L2Z(-UTJ;O%fXqa(WP431DJeP?j-FEdQ`Y2I;LJVt_*>1=YF9N zV7>|QTIOzzX1YTsc{4ZK|9?t zfTP>k$VqS9-1V-=Nz4VR$VsGPu;H6;^e8kTPvZkNckkWS7`h(CXdCeHQlBMd(BEiK zVE!;QrTLZbFk08Err6J`K@p9{;);u>tmpyZrES<-kmQDqAIjlJ5WG`-V4REqGr$2` z!sg6VONH>X%r>gi#$zu4zjv1(^>E5tQI%j)tq@myyeFwJ-_JzPhO>Q2T^ItBF})>= zl}8-(40@T!Iply`v`RR#g$z0tKnGLNLpiQf4;OEJAn?K9RVQeAD&{pa2@bVD@;E~; zhaD@En#3X=Qy{a9hW(GpER5601@nEv5#W{~|KvmoRpS9g6NIIBGz=`t8TzGJl&IT{ zvok%<;5x;`@YdpjVq8@2Vb^8UEOGiG3a&358KNTV}(gz>rsR?(dx7G2Es8Lyb%?g8$z}w{X4R3zYinyRu zpRMKAAn%god3-~iYT#LuTtR;DDCUSD*x&xVEly1^T$oDD_1H#uw=U&|8UgP7d{2sC zLEIAi@kp)-H6}~Daa(CrF|+bxckYjlU(K=Ry51c_+e>xpg&9Bz z7Fqa@nE`|apkP%>RlwNp*vmnbdM$hdWhwmEhwS>NPI9S|-)A*C5kPVEZn@HEU45Z4 zgn}N~H)Lt)hiWyjV&v^?8esSlkZZK*vRLUH`Xc)s2c_YX|9CsM4|S&$GJ96PG_m3q zGHW+^euQv~jYv@?Zd5MdVEtRi@R+OP%yuo^X%HOPX{zch+MdyJf%Dv|)`Ib~V5{kEbEgII zjiFWadyW%QdLDo3CrnyoE_|(|Stc}y5#_}~Wi#f}kYd~rP-85X*l8kBt3WUzITN*b z+w+Eya-Ag%zt`&N>}crU17;qE?Y!_-Eeur}4!8in@?!RZ{$Ln|p%CaQke4_&p4hi?WkHT;(m=?~AIx@6rQD-S%b|48`R zC2#h*i@~w$X6&ca*)i9ObC3HAv7`Q@(+&BOdic^MI_%p`dC&OZ#SUHX&yC8yWRHi< zvn%@xrg@j=X2Bf50OH@OllTJqd^)Qvz)T)Pgqdh6LkS#OM2yzF*fyU><`&_XWE`%$ zqUbo@6&Aom9o29o_?K<&Lu4)1$Z@xZ0e7*+m+R&W0es7D#&K)O_0>!U@I7U+!0mOK z==TV_KH{G?WoNrJ3MFfsKdvVQ%@z|nFjg;~MUxoho;K5~Z4V{bCFmA<9-_SS9y>4q zW&(BPCo|7pNWY9f$l~r(OKrbB^>Jg zEF++_*0M9mM=jiT`_+D1q}=%~PJI50Ft(cM&Dm*m8K}?yI$pB-^=Ys#Al`om@_+vK zxUS!u?|JmM^4H~)OqsY%V|k3fNcd{b)S`B})Dnfbc)@CIvHvLY#MI}%f$48oZz9W1 zn1>ZZ%LEQx(D!Z~#jVjCt(MDq0(hFr`2whvk1{*C8vao&NzZzI#l%*zw*NZ2ZJ#A} zlsn<=Vuj@OKjfWvR20p-=Rrh3BtN688jM}kBF$(cb#$x#r=Nk9b2LE@k! zm7Fu9gXB1bVPMiW@9&;_@9y2*v-|HZ=k%fIuC9Lisb*^GTc79Yl%F`ocQ~rj3*)C+ zLmx0Vs^ji0yUkNJz25Kmwg3EsE#Wu@QV^7Kdp*VAedw#mn4p5n%E2o=gH&LR>apeB4^VHo9#Q*rksvnAV$G|(PhL5~2!it;uC|{a&rwqPe z)K_|m2wLR04AFQ{ThXLsFv2?bNFJIAWqsTs8l|e+E9kPXp&drJKB%1GBm~Cyd~Le6 zP?;1EM>paa$heUl38NlNJ{jzB{g^l)*@n|^jb&U+itN)Zs6gbsC9x3^0iOD`LSN$g8cn}<>tQgS@opnEnuJ8M!gobORL zEL{EhGcXOUuC6Yw>1zD!NU|W*{9ZaJrjwbVfM)8x7asQ^WoFLS>d^akf1Cj@vC~1t zTq2QhP-DPPGj`n1G%8%&vZRCZ7(e#e#`R<~0Nvdae{wz1wEuO1(=!#qHUcxWdW?-a_F%3etgnP%&P3u1z@0Y&cNm1)6}3rin0r7Nx@e&-pKZ z$6U%)Ux2gzHJ8<(*;)rCtyTl$;CH0~=vDRywA*nHd++{UAA)>-RfH4JsT>0D2pq0I zhk@({fT^zj5EvGP_rhWejK%s~PhMl8>xFTvxSBDX!6gRl2i(+0&+ifWqnE(>|2Bj6 zF8E;6yV!-R`wQGdIu$OZ!oqms^k)&~_dX2bd>4lfHp@(afDZ3;U<_>k)dk&|50k z=5*%?{2E$}z?u)v<317(K$=SL-s7T(E*QNMU%z&TJXX05;^hcj4Fe`o0p`vo=(g5Q zfx#hQGMxd&%HI7BFZz^YBp7Hd9>y0P2q#0L&NDxh4bsd3g}cJi3AQwdYj~Nrx$>O9-$R-osElkd^S%Zw}InYJIG-y zq#S8^a*F%-BMwJ@)DJj!3x`Dgt%e|_&woyNC}Fb(@IELRu{pR$U_THZQ4ei_ zZsIM=bxoEQ`Viwa4gL`jS!$nsrNW;y4t_d0#v-z0PKGzIeq3jR{L=JEr=BskO?0WL zuN0G^g#p$7KC(V06Qfd0J8adNDk{(QXk2d;w<>h^8kx&{iFMjO5UQQqOTa*O>b znthOGkZh=BE%bG@9{EqvwHKP?4}6|%kRqQ|c1{ZH%@0CgCjlLHqxO*HtyTTe0J42! z$xzHF{)_g(GIkKBNMEjvOozo6=vVLLzF9FHYrCjR#Pkz?U1cSwCn;aMY;2Vmq15hd z7amRHtJLg}d?*Xkg}Qm~2K<)I#>7`kCFR9~BjOa$v+#+n6HR%$r6Xgj^%q~Q|HciA z2W#8<3DOd`N30E|Da@4HP08=P*cRIuOnIMKzCoBR%<3DyWLr2VV`&hpFmsb_$;s-2 zY-hJJv5tDWD$768$<5JgJ;eQ1Fz@d-FM6l>b(#|t&^^(eKcAs}DQ3`*#|)bbo~@td z+BsUdCY=Qt_J@@vf5B*;QWe0sP0eA0e~N zKkc-Y93H55(h_TPuFxUAMk@Q``z-LGluBx!_V4*TIDpX;4`VA3FGy!*z(IXN-9Bt3 zY5S>Py-B6G!#bB)N=lr!C8hTYs%}Zk=D05iPOjV>We4{U-M_iY=3rI*fVVTRS4(4$ z;%fwcssfA*Y3x%p%yE1Z{fGFuZ>aS%<2)G|F$^11&7w(LR3Gyfl0R_@uyeQgJJqa3 ztJ__so|>I2haQK=;cf?iW5ydim_XT3?+hvmT>dOt~on?Ri(G{G? z@_T2RA3YodQVK+V_pm7HLhQT@&W`J_hoE)!CvxdPyh2b zn37)_{N4&GtKuVM;brkEHl>wh{8;LBH5#1pARUd$7*dQTdjVDIO(X6YQ50Y2&^6xg z=;OXT92Ey-oG3>4DWx%I%2B5d)ezXm zpBSD<#i6~Daw@QhTBsR;SV|{_41#_!8~CG@6^MM%SSbcyMej~UMdB54<6jRpMkrF0ZvK@jYYnR<52CQge&*ML*az|iIgfaa#7H5MtCA% zY7_}fhYCUq=jvB^gS-bzq$JAN%;o~*A`(C@0;M1o`|DI!-XgOAxd>Pazuyl}{gus? z0!F%CFU|+XS#tJJ!TEsY+%9VPt$z6UFkl*FRx~a|8deY|u3@Vd@c?$g*>eMK7YBNS zd>sc$4v~e;a{`umQUR9f_fv4DTrB?&3KGi_!gidpx5SF0=CMCVUCL7b_xamiQ%6bQ zr51C~*_GE<(xdD))qrMXQ)BKw@XTGI(`Zyw8__H;-A2DCxi_<-?L1y<4!nFY+`Awb zCD*t$U)4^O9_dh!s}Q&ExC;(l>dCy)2_iX9-8TbdAUZ%C$~MFOuvY^_AZuVp%M31| zx%)jJFjWGYlTR@={Q%e^NrC#~rnnziZlIvOi~HQX`Vcrn1~?-M*si4~8$e6)DF^Bb z096WRaI@|xZ(#Su^;z=3E+61BSbCrk3sh852hR50#pO0*c!6DVz{UYcS6D8f;0hea z#Q+wJ0|kzc*gC^yNGTv&U0>P~*mYqJXk5v_@jbwJ=tpdzf?DcZGOJ1a=#tX6HQV~p zPLX(H_|Y0#8iAi#p5oGY`_)7ul52zgvE0$w2|8^MYe}aej8>U+XA#kY3h|3i2+e|} zPg!*4&vv5HRuGb2I5}munRPr3vgGRQ*Tj!W!ahb;8a>8Ccq;eS+Nh{wJkx%wDQoOv$h1v|ff*Q#WD$27RrPL%rh zj`rl5a9je9gtjBuV(}|tV_E0r*%Arr$a`PdZXt&2MI<2p>vD!xqF|$(JU>A=^&2;%E7IjPhb6d;+JcN_W-bVV`!q z@IH0Kw=Qy>O<@(^m&s{j#!n8bN3B`k+_yPfl?dyu2v*HC=LWLHFEGXzj5JjPlHyPJ zRWAFljOC~v%RI@8g;D~inIjsdCDsSlmCV>G5dQvdFL>(F4v|Su&J#Qjn9#PNuDaAc zZO7FckLH?%Qu^By)}cEKFJTjNKPKhRe}I=}9qX&vDN{|0em#1jY_xphAGi5(s)(ZA z#~30i&$%%~GhM!&I;dL%sBvVco^4p|8(Y6aJ;hlBAF=w_Jv;J3qPwnibjn8+$PYeH z1o_HG-z%_R#$PQ_r(CK{>#b@5e>F-yaIlf0*!NKXm52*V>UYZ}OjzeOVO3D`bql>p zC?x_Eo5(zvo1CRDEBD9W5ci^1u?MQln(G{6Z?~aH8O^FMYf_2vbDYPrEaHWy>JCFXzx@z5$ZhhP7y`hVH8$Wsq-aSx_fEO zfuCQi*2fZF|tU`c;^in`hjW^yVYK<<#))CuX24G!;zS z*6lgYp$9{oJo=RFlavhStJ9d9@XqrOhsL^>zT<%WmCfnx6tv11{|$H|gqpu?hN~7W zw@TX!|!B|&{s+vO6}6D!4@ zZ{AmR57CSMY8MQfG#gO6c!c^O6O6JyeZ%{jMD3lJmS}@$xD0Xi;=NqRr-!LdKUFYf|}<2-IN}G zx*^DYh|b3ca7X4o#{qaiM!#zFw$2!z={R+F&$?c>@-BFYdcdL5(=DlgyHIb-)rm(l zF?#dymCdwMQ|fGc;^C}yfjEd7<5yz8l~-f51Rc6f7kgj}+-2mCS1c@=T(|Lz@rjN3 zT9?5K_sAYC3n%nhtg(4emSm5CEeAVLEv@vl@oT437qyicS6!`%^-$5J@ML+58_i1m z+fFD>mSvyGfZBqwvQck5*S_cBK2my)hdE1Odv(QuIdkmw;jcvlQ<3%_qEXxFVQ=}k z3R`-kJfg?!TG@@)gb)#&@xCph)vmmXH1djMqj%ib<;d_e}M5oj7a9dbwHXToO?eVH&r^wl3B36EjZ z+6KMjOtRm1mjgDKZJ=Y-Z&(K;j;YVcX@xP~+o<7QOz~my)=R=)(q-%>L=~jn1cfz% zROd2eZ+AT5A6#SP?v{Bm*D#ccQKodiNRXo;jj`u5@Z}Yw4x<^+hp=5?GvX%w-@tT5 zsKRLKT(s<{Sv#|9FT3t8dFt^Qp&o^g|31v$zHP$FF;g_{G%j?6zp%lWHkK-2PuOwD zDs{-Qc6+y~Nd2h9)T>ANorJLp*garYXux5_K_29e2H#8*=Z|l4q0`)v>(SCx53>hcxM_|yosQTMakj}Sa$^0KL;Q~5(52=b1#!!|z<`=_XF6RHGCY^pwaAw5-FwZHSZ{!Z9x(?R$5*$GrctKH~0;Vij6SSfij^G`WbWaO6l zvi&INVG96px)*H#BX~HWxrRs|oT#hNVKd4x)kn7{`^XJpl9`YPs^;rf>?4fT;1%`xIfeGIzkqkqP;&M?HL_;*(3}p;noQi&A0Qp`f{~T2tyy z;8UW6whdq+|&yf@>(v@bs@Z;X+q=T z+dVGA3u@R%_Q_GDr_+a7UjZ*r#-qvk@#Hkd)v~1SAD;}aC}1B)h7mR55TpFp(60?! zkfd(x+)^QhQgzr&>#P#bA8DnZUXW?TpP?WAP44ZtwhxImCS%XK84K$8B#bUh)+5et z9;CWi?u2*Wj5cpyUTgBNu~B7;n^*pMaS7L12tTHD>u61EM?cwOEVdq{K- z#hZlQ_?_l!;ln;VzDqG<6dyDliC3(zkT>0wVHk(?&{Po*a@DA_cP+Ho8qOp&Isahe zD=0}jbhi~TbWTNWv+t&uZnFfo4ymg=D(WTyy=R~I zx$eqKsXMNgX?mgx9perk5Klfh+iz`I?=|WO!Yia#OjsvVzg-9nlKzr^#)|t>0Vc4$dd(Z$5un zyx+D{6uWG(F!rHka?eNJX)X+7os39tF+JuHA{(YE8&kcf-YMmc@6${7o`+2>4>5^E zhAy}+w7PVkY^wgKNWFRB{KLyGv_o3dubwiP$n<*c_xH%%>Ni1Df^w&#K%W-oJNM>iT*!Ddkq=p{_sYjQ2GA1Nc=p z6;F|6qJhpt{o+T@+dmu>W4)FF+IpA|Pr{!R2DPtlA}(*Rm+8~{W8k-FX85i7Phy;d zHD$g9Jdu1*VD9CYtu`;mD&`fiK*Nj2DUw#ZM0mC3433CR>&CmcZl_*I7`+GO`%8%z zfwNOL!c&FWshf$kmWv5kFVc5CIZbY9(svlD0*+&(n9g*Ta1M~l_$2%@i zp}8-Fx38r3gPW>1C?jo8D_To{#GMkq!YpGU9>@B!sI(foJ| z7vx+^TRi`J@8ITu!1?N#-|a1AX$s5UBTHVrvV#v#`^>~WYs z(C)!2^}SIBe4_~6IQXTA7m9n3`}>a5oHFoD@)nqTbm0G)AL&K2v3YYA1H!>J*Jn#0 z*Pz-e^qu$oC+BCjE~!!a##SxI-{b73Z@6sL2Phj*H0+TY&Ksws;~54wynXm`j!)xM%42nsn1WiT1iC_1?u`fM{ftt_L)PLQ zD{Za~A)ENZn4cmHM!X#n;QPzN`|Bg`b42ZGE4@a<9D^jA=I{k|{b(k6*A za%sCCF5Beegt!ok_1*9eLRstgy`182Zzv=DU3CJry;GEWv}BTSJU#n{Jd}L zye%0DO%?9o00YZk3&F{etGWyl-nQcsSw(%j_i9;CJ?XVhvNz)~lD}9^Pi_FqUsZQR zqz_r%j#U4pZq;D{7R45Ik7Qb)`M~lQ6j=U(>L#CaOF%cV^LVQCpU1yaFje_-+)pi< z#O*z~w02>+Xn7>hXBUN#+wgHYxPRC=2%IsBdg(6bP*&9y3fg^l|1@u}bM{dbv}@$- z>U7L@%}dB9-#qE8Yzg}P7t6YWlc~#n;raj@%%_#7UH)71f-p>?gb@!5Tz^IW%7*dgAleixv^h zwNE#2f%#~fl9U&24dcsSpCH;oFn-8ie2Gej#cfgmogA5&m7Vq2^08V@?MQQJO=(BX z9bhr+vrzW?>@0D+8_zZjJ`W3hvp|rvelueO6w8~>a897jF^u@+zp;q>8NY{^{70V< zMaC^TFgd?wJK-`eGaoa-H7({;NxVz$R`@m-{^|>uM|uwY`h%5`^TyjJ?OgAnx)%*D z%vBBEvOR3>rJl!>o;44;neUrBb+4TTeY}ghgOMCwfU;gghRFOTxp z>U0=!M1ufg;Msk8%kmv-hE3O>I99*4`d;$I z$*#p(*T&TkS7g(U5P}ggG8jgoD2Jjzs;u+xRuHzvX0P1*mQTY`yz`z_i09$8uEbB> z=Jo#P!wx zPOA{$X=wHRC(+8#Gxjc+s@GtkY#H<=r(qpiI+?pVPO#5$lku~X>A&$ROFe&Ei`+5t zfM%tLA0$n?{Euc8%@y+RnickK+Jb|+<5CM(5E*dIEiDl5Kbn=vo#9mDw(6f=L@mBk zCn567sbW;4Akt_1k!~M4~9hQ12jM0>@n3$&snUQ98m(8bV42>);V@+w2bRUe<8kF3NF=)`o$LO;0A zgfl3`(x@Njz}4m`PTLa_|3CcM+o#Pht!&r!0799{ha1m;(d(iCy(OuTPTL%S-{k*9 zzNlR1Kk$ssv*F&)Z@Pi^l}n=VI+c?bFX{v24YnE{Il9YElGb}XWivRnk_SdF5w?u` zp*fk0W6JLf|6}kf`t_WI-;$+i&^Y!9D>iJ0XWN&kyZn!;`@5Be$s2g*EKzVeL9({D zJSB0RRQfh(w(>8BFN8B?0x$dQ4#Jp8)ZBFu?N#6G2_vZl&w($Wg2_J$s06(bSKTH; zZ5_E9he3<8OSJknVMf^sw0^-m50d8%?V^G^=LyP1UlM1^wDWiidfka_dHc0l`>G4u zio2AXx;)3{!gpe4I-SvFc$Q=q*29?l&p2|rpc~7Wy`WOoB~d5#bVbmohLop!=xI07M_-8kYqf8U)?Xk{mo2n**QrtQiJ$ z{^3DGJ+DWEKS>9&XJms@2Q=4I1cGYgBB_br_cDS;b_i7eHCV)Xqli%eCs6fY27^fa z;CHNk?L1U0ppKirepL$z3-tnH0urkm7{deb5t!7- z9EA&r=JLEP#DaFJN&gjx>xhJc0Y&@`$6-#E{d*L*o4c+Dg;F2aiorWFh!p~k-Lu|U zb?uHgwwtekTv_ph_DUni^=UcG!$swTVXMfXkMXtLfuLzGf9tz06@&8KI|sVv2&OC7 z_YHLqKB!b)=tM${z(;^`Vq@vWb2yFih{4!V+?X5giT0nn*HEZ4zpq81_qaw|&4dYRz*JYZ(K- ztP{O@>}iTS65Z5$IUwIL_ZdTfo@q04nyD25G^H^63cTzX<=wh{I{FVtawmKOMn>>lMPE2mmDpW-JXZi)V`LX<@j?(xp;jsNYMih*f&u_$Np*o1|q9(ai&K(G!r9L?IcyFZhS! z%8AH{tj)e;u+{w?6#FHvb*Rbfn@+pjwTdu_@H7g z3NZJ_4vB~nfXpXPyp(w^fi-@DTy>LBHcbpMY+%IkCr0jsCPsoKZ5!i?N4+0d{$9L)1!PQ#f z?`_WZ6caCxNfU#VpGp`ri^5KN2*G`h=wT5c2)GnNk{GoLTpir{37nt>u@)V4NFY>k zo-E80nG5e6kVAhfEfjy!@7e2^4{Bj-tFu0nb(dBV9rUUjkP{GH0yk(yO*%$6(qBRx zCA>imjImIgW}Inan2UANIMizOLKMj$x_c>}=xgsZi4_)sVVkue_Kl2fVTtIXMmJZ; z0CL646emoNnr#!=?6XchU3T>1$h&2^@@08&JiMBzO|s_)vLW&R=6lJO$G_qU;M>fx zeH+<6^HcS#lPbyvR@ZCq->z5pW$fEFo5HmFh=I6)?6Mwy!(5HVJ1JMp7%i8<*>mao zrLT`Vzs+vf9sf+W2T!bi+~{&>@yzl!|J6rUZ8z%IKb=rl?orN=JYU@{>L=H@c9i_} zuaTxVIq-2RH*77hEM>%kzg1|`PZtooa^Uce$Z0`} z=W9Ekmr3xymc%D#53kjPPj=w4Jw%!;H;baQZuOjxZQEeFMDJVD>^2fsX%>r4=1y+E z4=Lk=(gEZ$or>N?b(06~ebOJD8V8R^0tw9tz}Ha@yL)xPp%IPC9PfSUX-TxrO769c zuGo)OuvH}2uBPQGRCTqmG+QlQM@+Od%%3u0YF2-HP)GqUi~=&WGNw8#Fly*@L|M-t zyfk^oF5zGNy+ZZD3(T5|cm^mn$E{mWghBl=*? z9;3r4Z4ZsrD>Bb!_r-m(H$0ULfuT3pu*74G&))$9`GMa@=_K*XjWJyhVb9>$B`F?8 z;tpRZFq1`K#ex{o%b)G}}St<4P^<@Z3_wW=k#0+{(Qu zN$CZ#w%Cn0nS(sLWVX>!KV8Y@tY)mXWj)Wz=k8-ob!GXBZOwb=I{Tv+Ke7DX0lM$) zyo-#*>4+}LzYySFZ^Q3e6 znNkFchxe0pkHA=)mhhP?7CQ&<^O z?Cy+ksk6|P^gEDZFX@1%W}3@c&h4Wc{;}q+VzIABL&++F#dD3v8wWPrvy{9hbY-nE zl3`t_$)5-3ZY0(Z18%f*<|?4s<>&jVDm=!m-CxcupHcZqkCB&)vW%$btZk4 zH$Xk5B0EHr{q5>S&gbW_aQz~~RSvsdFwAZOJFT_1 zc#j9O(yIjkE%>}~_gto*Qw22=1txD1@vdLCJ`P)Qg+=ba>|uC_jxL5!DLKPB8C9Oc zH17KyBU$?|xRn`zoDU3~ zQFy-S)fnaeaUC>a{}%90WH@0Qhjs)PjHF*&6)gy3;8ud52rQ@b95FS|CLw}0z58`CG3KPF30lZNjRU6mZD4zi$X2FBWhAD@R6y9@1aRB{zqyzLLNCU`f0geTt z<{;OP81&jmI4}`hBTgj=>Cn%i2E+iC0j2@9x%xRYA{gOAQ~;obRPcEaha&(8EgTQ* zloCu0JYvx6t_%lU)?^u)~vAmDqGU;PyMO`87hI z#d4rUO8^?{0cf=#(R0wtxod-r0e7saVtAIXi8gw`f}%3O0xh7BJcFZd#$HEKY6FLj zf$&I8Afob`Z2JPVbo3FM-u>>XPIC|N+OTpCc21eyR}caAGi zpfJN3{A2I`l37bv(#2SoodZUoAb>>>9iSi%oT+l%{Ru#OjOVG(ucJb7~3WyNpX>>Wm;P7YdhFhr1DN6kG=%{+4Pa{nnp*>!Lm2_r zP^iLHPa{@=-AC6x4g_`qI9@tN6ev&t*k9B&#J4_!lXgex0lR#G?fU*O8bD$En)bV< z5Q~6{%DNa(UMu)Ii1oUo>VRX1*A_AZ$LFuzqleiGdeuW_S)omY7esg0yi6EBd9x9fXiyVlxJ7`K6gTe77Jf2kX=!x) zETRMvXu~{IxZo%v-}Q~QBU9LW4^V!QcpAq>1)uTu=Od!+R?~SK`eOQEXY+#_`;|u$ZVK*9yG@_MJu=^q8e}j=Lg6gx zx9#~qs^09B=TuwiS&AxVR4qR@v1no@j~g-aMlp1+o~w`lR5bD8-Uo&1E<~77>x&h( z1$n+E94W zIwaE2*l&5fMVU356I(4o9qz6CT$xLawecw~I+H=1`dhmM0FQ7#n!FFz&3FRPXrN5q z1_-a-enUeqbq(Dq*e6)3mMXb zzoYI~In!0@%b>)W{1P$+f`^Ut7JVO68?ftTFrG^Yj;2nx(obGmSg?+=@kq$?uij8p zBBCYo+HxIqQ#o1Jv##i=5CB4oAB1{(jmH)~R`OWhE&SUG@;F#f(nd_nO~Z>f*o!wZ zKKhx+L!4D}87iLxSX0oi!{#IQv`vrwKHm7i)Qn&F?kO(QCjjP1cjLM8gY(HtoH0ut z_$Ol?O@@j3*1ZB@0X|dVX^lN9wHA_k5Q}j51}1=`wU?GP~+A?~hPehSJ| zFUiv%Z(~f zve`(rde+0HA1BD!7zAvo+oO za6oOVK~&EXr=|PN>FH6qvW3gH&7qqwyzk9R$l495G|0!C(hi|wXeT7LZ*3n8H;Rjo zOfE-$sY0u&b)d^?6bp_5_QB6y3m)K#EYzg9o(;KDQWM~Z?dCN-ekBE71i|+-y>_#vs&AaSf@@$IjKtt@T+Opd689x`{?en{;v&HQxZ+7G@8st|1 zYI9h`{S#I6{!bHxf!| zpe;u9xH$aM)lGjs8NCW18J|kyA5+ z*)GwiO>L`NPkIi2PTY8wx<2b)LcJgSpw(bPMsQS|NiZZJO8u8`dv@A_t-^@>0|G>F zVo-}X2V%SobxdtS^nPL1+Jsf0M?}-hin3e;KY`#WHc%#d<4nFA5UnSw?B1QM3;RF4 zjBYOe3zMK`NgETtJ2%xuz04T@vQg*M*vaA@#aN*!HOk}_5~D|L-tvLAzf(td|Ht^7 z?cY>f^2afhN@K`(dekgWs-QN(uV7!}=WM(zckGQ9$((o*CiIWW*Ucy)m(5>k`**G= zK%`B#EEZ>v3#>w4n-yAMnXN%=UyR$b%~6BRc3KBl&2~lydsB$4nI56l!r?*P=kJIg z2RtnC*}(@p(Cow>tv!w7c-gcmPgd>sKqv=Zde4snI`d}^vTZ*JlDuGk`#KYC+I zy)33~v&`sQOIe&T23i9Dve&2HYO^`=56DtvvVIB~Zit^V^|3Tg+79ee{8bCS`Z)nm zVOe;ch&%LJL?6*1&;rD2@*b_u1FutR6FU6DDC)Lhe$C*TGS~PBuWo?GYIVK6S|Z0q zIJ}L~yBWyFMR*y8gDojCx!SrUr9BD5{v80Z&kk)2P*D$;?U|UcF4^WT$`)OfopKe< zY-Pw;Y7LZ(+DTcm8)qzR-Tc&ly5}IjX0R{htcIuBe#?)O>7#2)Sf~D8ad>4EeQusF zJ#%}0p@hBTR->!rn8;vPi7P$H{%*Q@t`H`^NF!4O?;IGynn?Q$PLElINAjIysPg|% zQ7g1Zx6=3CX{A-Sr~?K-KjTHB2YS^#bkA zx9wUn9=DW3QX!a9|7nEC0T1Vw9CBeNu5RMV@@FLJ!sdCz4)Mcrok^Gry^!;FiEm6UgD0%3|H*mnfGS^-< zZn?x}|C3ipgEHP$vsa@8<{SmM?}G7FuYx%ICwkD1nTMT(d_*k)T-}uq61Lez79XST zgoLHs^dL};0uo6Clia1$9DqAnZ0?v+E0l~vFVCWODYeRrfJ8i>qqL)T31E*rxIAVI zhTgVrv4)Lf2A2xc1^V421j*(36NpjJ&#j*GbWbjqY^XCQIWPV6+K@<`WopJkcnmGtz1)t?j!zrWhxb>}SS46e6UT`7I zch*|)sXKPzX^S0O+HIK5LiiMqP&`>wOKqjYhs~df?+zA~{tB7AtJJMI(lE<;^4t=o zX_EYvZ0_0N&mg?55p!PcEj&@tmr<{4OcjG3Vw0EoMm)1oE23=lWu5hRJmOCE8qOC6a zFLZ<%o3}(4>$bWcNV~@m%|&}r_*8q{u`ku?@W*#-_tL$=q}zxslJ+!gL^$3;fm4rA zmjzHCc9pLu5w2ghtoAw!1M_m6pHim~L@2rEH8*PL=SmVCEw6K72A=%rMb#Tc*2zf! z#q~JxtqF|v&#!Y9)C`!PF}C|s5{hsAu$H5rQt;P?_p8x%We9tUB{8JH-W}T_qiaH) zIN6*+FoQ_Bt~nJE&p>j;x0P?tlqxc%h>mQoEMcKHhBoiWBWTpY6DB6_IlD=>X6L*1 z0$GnJ>}Pe+EU1{2J-5c|0^CHv)f%rqzn!=pdd zWevE7pum0ciS-ccPtT+KFKGyP#|&QN3VT-jUPaf?{W){667Jp6w>l+H^F1!WzfXSr zH9QE9P-SqhncbMA3?49xh2i-J(Wn#QTbn0+2s1R%*`gyJ?LYnHc)yOg_~D?xpN_Ir zu&%j!Dp~Q<#yfj9H;cWMYg53qO_6=&3B@nu&926ag%WSFW>>uJz`R;& zF*8vhC5!|^!x`KlUFvgHbT>j?ptO;o5x5Gu;)RDG^0T0t)K1p z+I8(gLeX3DwJFP6f`{+NXakkL6#ag*azM=28VpmS+`cH32M%zMrCm-7t4|-RHYaB) z9HTR6Py8Yi_Y#+{I`L^0KP~4`Q=8LWR1ydx8M-)Tj!OQtpN4gRffIz(5qfst2ubl* zCO6|~zmuvILN=P6=bNX{!zJ6ceL+s65!olWz^yt>l%HHvm)0s)EJJQ&vcj>q_rj6* zs4mR6;ACTyJo;>a{0Sto6n6NbG4cvK?A(JCR*xrA^QFig$W{ii_3Rcp*73f*;=LO{ zTrACU1Ue6VXySj&9z?&`hcNh_ziy`fiDkUft~dzsin)jBNTcG7%Ont0FR~a6!)(ZExdrGsgF?Hpp1}m9-kW>pF|eS(@=q#^ack!65KRPy z4wZiY>E(kM>Z2Wf(>_TDvsft}Ab&aRP%LKiHy`c3SY{qPH+DRCT@H2E^Ji4Vs_NMj z<#-cV7OSZemm$TUCj+QoM(#r0vPwLeVOCobksd~aV~|91>L9?8>+g%Q_v08PY4Dg~G7`Yq!CTF zpjaRJ*`y7e*}31()YU(4iZQAx?;hH9o@2pPesUa8TLyx{$);X6yBCp*k=SNj(_OdeY{(u;#AvTz4vmSBU^XwTzWlE0x9SwJ}r9trbmsMAXObz$oPbUAO8pD z4n)rH;PWHAX8I{tGQ38Mn~igkY;GSoNHTxg#ZRp8#g~j_6(2Hbe@oG94=tips)Ux8 z{Qj}>L&@I+Pq94vIB*~`y*>E($e+O`{z!62%E+Gu2K|`LAZIUzqd-f0^>5%oc4hw{ zes#%K)EL78n%QakhwDQAPsP}s;y^{Y0IzU=tX?>Be=VJObm4HX-{p1IXjPJ-BJ|+v zD?k>NaqC0ud^r^qH;lX)VWc6PhGb40X}xN)o>>_eOIvN3$o~eVOhu79u)T| zsvi36=OH{#ShexS^K7vx=*f0wr= zSi(G_6#n_4ixv>s#-Ad7s`|b7!5MXP6x_qe8aPw&kE7or}TDc zSp!~B|2vTR;aO6EyNVU^<^vYeucvsivQ6(f9}lVgCH9~z&3XqpA=3{{y3s;$c?;H~ zQ-aJX;m12V2iIkKsBAQQc-@Z7~HM=$L4-K_bivZ-H@qSKWRqfAg`aQUllO32w^LJ{# z_h`*#jWCN+juaux_@%kKb3oe_PECgFgd}aA)njL{D){_1ltfc}z9s|#k|bJ8YlzyH*DUihY7iT|yV-nvh9d}#&7 z=JX|*V>P|!v21$1O4*Tr3~!`BBWE2fcqqN4P`X4mc0d7&FH+>-A^ z+aK7N@Awx7hqI;Q#!X2q`&+gh^NL28PxS&sW`d`6sW(2VxrrOn?r#a77wuj-Y@R{> zD%BG>5B9!&Aa>~qgcAM)o&viw)OGCfs%$7vg5AMFJDN%xENCD0ynA;d-l+R*A@zF) zhcPkN2pE>j*>AzCt)sm)tBSvu1kdwZQE%~}Tr)l=@}r%z?b%^UlJO3HrQO|F+DRkH z{3WpoodBuSIlYDA7mI&De)RT>AGVUi7=4RLwBaX-6*0Y?fSFYEU#cI4)m*=Kh-s5T z9rL+gHW+4AdMsWi40Y4|KwfJPJ-1i_d7bLGZyZM$RuWD%RH8z4lKP+2 z!*tq|+76$43gVK4x2hr^%n#?RM7~3$S|4S!o_T>7M%0J`-~KFaSKT=|nen^S$WE=C zs(3b45Sz)c1f4O=zIQhHC3%F~VsVgXdRnmXgEyQI_s9>!(l9I5*~xM#!cI`J9Xzt` zI~4rO=y#6~#YjrRc?pUIkDiM1&rjJtXm?Yk_Gl{OBX47&+@Y*?UhX|P8@8B^#!1SA z;rjF1T%-fm0z#gB4=x3jE zG^+IU!Q&G1C~7aEkPVhxllE2cw&E$}rO2~l;#}K!Pb;jb&0JX9qd0|e2XYlfOjT63 ztD*a*HXOaMGJAKQi&&`K>!gaeDja)fAQ(UzbY>S^j@eB1NpVv2P>D>Q8 zY-S@DlgeG1qs6v-(OtY}vFm?zvb&!5`ke{*xBUGNxSQRV3IWaSzUpc9GaimB$0dXw zheGRlgj?nJ-bs(D$+ff>i3CF<_yV6F%&%7)Z4q`YSd+**CosM0z2u$Osphi-Rg+$9 zD}&YOyH$PY#4&t%v_Sq>!{Kw3N~3FVvs5%p^GRX-5p;z|Oi8%63o9Met7ZXKQ>0ma zJ&e0uBKZtIR*Q;0{j)jrcpJy0S{#Xw;zIlFk?PC83_HDQ*q|c*OG^HIG1bx$YmncM zw0U#YkUq7l`dHn0i12{r1vxXfmWYgW;>lvQCiA>v;*VX}uFf4O{m$oK#&lX;nn5S# z4y)cO+T%`9xH!#}dY3bC1)M^6z>@X};fPA>E?+7xh&p;$oC2 z|7XwQown53qVXcB@m2F-CDH)mv;6a)-J_*gZb>JeKU->HMh+6!T=xowpT4j^UL!Q* zhQnD|ms^NmXho=w62_FTy6(wup@)uV-zkcGU>n&*6682tUY7g5DV+@&_g-%fMDTx= z;hGf9tzNG3`TOWNf35C$OGv`z(wpwTvUl8wQO)*Qu56mCY&7qdXUp{7s21;?^oC^E zx}$^klGsSvp|j-C*GM=eKNy-8ugY^xy8M+f$c|XW?M(^Rzt{fca)bPN@gTpGmw>qO zy%i(Yj^xvT?){A1db@T91yTMm`{no+EJxAsQke(Wx%hihh@#EtX1}6(v6pA!xuqdo zuY>i)^Nzco0h5b`Gez|K!+u=AaP1?vTbuS>EqR zYB`{{1~*P)tWflkK)?wzIe*d+)Q$VzuD9|;)psqIr|tJK!2!C6XoCa zOr0nkcKBsGJ~!7#^(`bW3&M-=a<4jferw2ejHu%*L8#4KcDjx zCj{1F6;wAxL60EKnqE0sVn6?0c3}gBS7o(7Wjd4XUnB;!r<7c-jDCI^&>z6FCT=62E z2a12FeV0WAcSd6CQMBWTdSja z&ue+VfQxSwx$LHWrpg0%57xdpC+VNh|6G+uQG<*=-<^7F>Aa9mTKSpO9qsMsLW&@V zw7ho{J@~QN$4#$oW40^ZQ0Mp~GsM){aQ2J3g{wB28fw_9+72cBc#n^}q9R3`N6ltz z45PFrHG*I9SYXT>`;uk_QvXxRQm1~$O^JTj!RY)7ck=k;=)|T;!e3+{H0PH^+LgS$ zsoC%64!K2C`hQx{g1h_N-VA3wjPIBOi|TiU68wLRwZ-#?#rTv0+w_mk#5*XZ9pr|+ zcFU$7YIZsB(I??ctbMDL-dWn3#R|n7JZ)qbb+&^eb-9A1ec*|dyS1ib1h+B%V`2aC zgSyg_tE(5JoR8liAFK6>IuCUNFR-5IQ|CRvIQY37GE}T(-^SAQW?zlMl`>Usb~p@$ z+A}Nt5^&!|G(D%FUZf~R!`>(1wEcOeI9AkKR_j$$b;<_3)0 zrs_&w^JVqBJz~!4hN^bgC*z9yRoy1YU)uYIW#KyA26v1wZ1S1qH(M(C;+q|D?8DYFC$t1tG`Fr=&f9L8_ zvrSp2lb`t8W1Y#H5BY4Y=;;%^M>w@RlHVW~-}G@N^?4|z$YJ+dJow*cCo%g`<~Am1 z`t(+W^g2lNan2%?wapJe`?8vH8VQeb#@3^-0g1u=qs-n~$xK!}27#;#p-OpflMv1(`z(-XA7&3hwB{x7^v z@L}ks3jgcrcQ@N_473M21dV?NB^Yz%p_pkO61sCA6n@6n4$Q zSYzyMuSVrrhsts5R34RYn*rRP!oB8#J?+|EF#Ap9K749|BX2)cWQMjLRve+q7`0Tj z{=)<7-#O%=zsy2NPGVkWml8ifqr*s&%zjSJz`S zt>RRhdXi6F_%zW&DVeiqF-@}YZ9>m8Vx^WF(PfCk)(6-Ls6CoGoE1@zksX;>d?bLJ zdAYzhCosjJ5xZ&CuWa=++2KkYaJ4FPIyX0i6(cBLUb+S#iCmRH0Py45Pr1{yLLroh z=pJ7IJp0>v+qV&;dz}uWDwR_*^wn1pA%2fDSdae-Iq|sVW+ymP@kn`=XkNxpTGnZ5 zrqn_r-#4#LMQpxfWQ7$Ve<$Zs|LNXr`8gt^f?8I&xEdBBvD%MTvR10zZ}h7kwrF$A z|FL`-=K3|z_WeQIY+j&wN{wWHp11ddcfD#!mP%x-p1c0vckg!R)<=&dDuV?>^!`Ky z*zl?PvXUn|bY1ZMCCLevr1bR`x)okIlK(s#w9R8Qn6W@O+=t{K4kSHG!poF)&NV5B zir+Nx=ly#8p{jRj4Bw}II zfYRh}>>+oWsdivx>yGznqn$QyJQ=6btHEK@)jKekvptJr!_;ef2g1Y)8k*K1;}!WJ zisq;9@f;<5!|8>#ejcA2Uo`&MXU(JT<@%W5hE{pA$O|%qWRC1sIebHA3Htj$bvsV? zdp=}|C~pl1J+ZjLPB{xQ4F_E$UFYnW+}*2jPPx1158t+`lW-pS zzUa2V#>IdhJ!50oMon+|=dL=K7=JRE7me)G)P*TcVKjmlU6H~YAr48J8_C)%lSSta z#{xPbF+n0unMKJS0sR)tSqC7mCK0LQ?mInCf_91`-|V6r;y-sC9cEXFJQM63;dH}} z&|?>NOkG5rKPH^7wp4h=2890bAHPAPD44P}{5doH3gpUprkJP`de5NmE6QxE37KC1 zh|NUz@Acq^Lv{l?Yu`SR|4x%on*KzsW)~okkPdtHY>_|6L8cvRmGt=oD>jjm8)GdY zrSBN5$GS+mYk*Cl+?BIhO2k|Bp*ncEwYL2a({E5up}2H&(iruBtsl+@|9M$$){p@I zgzS8j94f`r=?^xUa^(@u>UJ{L{+RWkD6%JJYkJpj$buQq|JQ)v$WFd4ClXK^Xcrb! zhswUwVa24+-S?>jSJ`j#`0>``yt^zqI&FF^x=KKtz&wx9m?ElSGGu5(?V~bSPRtnE z;mRTR;;nCgRp@JWuRhp^J{n)NV7b>FkX~+%B7t-YufKWC%_}w?+3HJ8&PR5?eN{@D z2}%AS?~%Z^lZil}FKp}T==T!j`MpDS!cVDy;WTES^;_;>Gvf7&a+TYfe^yWPMOlRk zs~1Xk(Cz*G*p>}8ioT58U#skfG{d*-bz#Lk8Vqw)kcYqM#Oc6NP6&cgx5U!r$;3(a zv4b1UZ{-CSaC8Xdfa)s-dsDsW5Sq$hiE*@`1=Cq#EG%ddzZ|qnrZzWRf~JnHTKL!K zy4}qhkMItu-Ql)~KeD|KZrT$%x|m@(Zbj#%u_#H(9f@;@sf{qgU3xpQjSogKsr^gK zy||{XdL)A3QR}^PHc%{^;e-qY7Dd~zIEH?Bbs3J#zH^5=5eo!~>yljK%Kf(2r>vwGNW&gaa_oHfLDmniwLwl>e|c(chE-qDz~^~CW!%4+L7cp}<`y6ZVy7 z(Q*ZFXVuUUK46)idDG2tX{~`;YPt_=-2;b)JfLrA6=ahqsXKi!dgZ}XQe6lyoJZ`= zV8g=&e+DopgD>ybu!Hg8B9lHHNZ!%h*dFc~uw~_zyCK|lu^-TPy*`A~P3>{{4Wnl% z3LUqU_?lzJTaxc|sY8l`ry`73V7;3dnECtwq&r|smZn@!geh%MHCi3(=SQJ%K`5wC zrH;Z44~ooun(mP+VM3HDAJCR=mWVE>d}m`;%0UHGb($?F#SQnH{6)h{q-nM>s-tx}945)UQ95YPK< zGyE6tN=84t=r%L^7Vc+u5Yga~_alGQ{ORLmhM{n6I|~cP3(hp~675jyZmi98o z^w(T3w(nvodp}FMtv8@>exDsgzY)k(#N=#r*1FQl_2G-C@8aK%FJfI<8uX{lo<7-z z8$`EaPbu?H3mFmaY)ykL5_iN#Du^3o{?yV+sA z7V7;aeV`_s;ET4|g@zkj+H$&M-Jv@?70sWiX&eez&i-nHZ>)@znFChNCvm)(}6d-5ce75C!qx9Gqzq?skJ zNcs15WOF1?^xHESI!Spc_L82M^f#l_*zWv7IDtp`%R#T5~RpG|`}KN=8m8k`x{-kw>I`PP!!zNoN*gjLWVZVyvimfDKAC<{|Y~lr`|)4Q9qiTitmny6l?A#m9|a=C{d8=Lk#&0mS4N30<;j% zq{>MAEQz zrWi*iq7rVruN;&iM-?DV|J?ox|1>1%j7r;}hb&Bxs*ICiw2c4c7!pKsHID+z#J8IH zp!1EAvf{$cA$Ir=`v;&=425=&lD@RJFsQmUIN`{Ko-M(}i4G_d_Jed3+{0 z=CM~Lh;@KDgO2|O4e5rRpc2K?x8?;8Slr_S6vuwz=s-W--V+HvGBc3*8dw#KzuZ`l zrBb=_*L*H#rbR}jiCbaZ`DoWZKHzLQkwHj%O8GIu+qz9CO!n)pnczHZPcDmLH58Pv z5N52@pIqm#w;(gywBoc<>C@ZFn0(!HQeQS^8SSfwicz41M>_%$R3v^l@}M+^8?T^|tG1VFRvP~aoG2ol`@1nYM&u{4bEwMHF1C5lAodus%b%qivlOA-{8%{ zfiBi(Hg*CTqCpGb z8z;)52rB<9f5hN|1|i(d!28jU^n~l&R%#pFkRz2T1mW@q^-?+!2$L2Z9bBkP@ryD( zKv&kj{2&FyNiVqOYFu8KUvH^jKOkhi&RAI~YQYpI&dp|ZD=6QGX>Q=xR^4`e`?THX zzWHx3@U2K|qF0PmBPkaBDIHFx zVPdPlc1^^zX-qfViXK|hwI84B4KA@;UL(8F7H{0t|IGi+Z6)pdQg$3J=m*-5x%3%cD1H-h?xK(=Na z-a9O-`o1JN*1T5|c7EFaHv90)Urt)%OMYz^>Y*>Ux>y*j?T1(^?OFf0#E{>|%oIq( z$IbQbvMz8j2gDc)RiOUL1)}N;n|h{VW_gI()`rrxia>b!y{a+aD+n$K(Rkc&y2V5@ ztzy^0k6SC3hd+SOC$u~Jm{ZUXw+gDQ6@22@qfp41_Lr0L5a-RQG<%)Pde%R1YX(QA zcUJDetze{fTT@MUC;Y=fJXs0;N}j|0g|Ql!{*p&o2nG73zebF=SEpMj^%^=VL9Iz_xGU)HH8HSbOAPGmOofMx}#~cI6zb zc2;o*h#87dwMNi~HE#Q<3OON>VJ+W(Ld|Q8(ak?`#htWZrVu1`jav8~8%(_UM35i1 zsdh!?WVWK@*5mm73473SBVw*}J??j?niKZ{*XFaJ%|^XVc6HdIEUVVGZl8><6dP03 z+0d-N|5^F0LY2GE;#p@|ht)fmK(`G8QLs--miX(B_*yL#I;jG5oIa*Gy$XL>)m@6) zH1WRc5G_$V^YZ`g-yqScJN54P=l4mxjQ2FkiX5-p_xn=xfH}?4Qrk3m&i`W|zH78? zH~`+yxXQ&J$(GJ%6-)cG!Q(_ z`c8p{ZtIKhVw1f2jUE1BJ6Ou=Ag!<1vO_zuWpeL##s7X-;uP6gln+e+e>0WlM3rxj}4%NYxgDQo*XPz z#}x$Mc3~-O~6XMYvm>)ufFy+zM!{6@RjRo?Vrn_n6h=Eh*{)L^JO!U0=;1(7M#OUF2 zDX0hXFr5Pd&5#OVe3y0O8ifF?$GQE6zmWh{g&&w){X0|4`Rz#K=_l;QA9#4Lh&^&f ziR)X1%f^M=91(aqHeNvx=PIahwqK8DPCkww_v6^SvYPd>0Pow=vF&T^8`xU5rb*fJ z$3I34p2m|cB+=yU%V)lzY|gRG_8WFp!sW2ZP0tgX!<-F|htrhfk2mutJdfrGZM~`H zft=X~d|dws4kXV7Je=i55-BCqH{&Ameb3~7iv%Yzy#hJL}890XzM~^?Z_0!eGhWI+7S?9?C^27vdkl6m<_x74s zq2Q&`kZPj69dwl-mH5HHT>N_Yn90o!m;9cThZ9|Nx9 zR}=~fT5hSE9a)u8$1md%xj(*G%e5uh)sLmMHCE4?KW*eF{mQy!QBV!_B469g%p)&c z*SUE0GE5jvYY;^{9d`o1cTrYwy0`4Q*_X@s)%C86o+r0*{&bUcXqC-O*U}y&T3VT_ zn2e6McZpI&(ml|MJ?qr}ONWKpU8{w1z9cQ4Id@lBbP93oen4%r4IjzJhgf-Y4_<7> z&b4H)zV`z@PU4AEue*YSa6{2-|sBBPxPcuLTR7e3EE+1D~TpCtN}q( zK?0&=4H*o%G6K~6jLG2f-Hvr55)68%oggOV>{3xsY$HQL%{e1YtswIxLT5`M=v_kcB$%Js zGkE1}BuuAe_0@;BgZ$aT8mQ;xLbRhFRhT`kjAH|e`f^t)T?CnbHMd3@uQXBJA{BAA z_U7~RcbBCqZZ@8#7!Z?s5rd+95#fn!@jQ6TQ?xjxw`R2^E3k+~+@<=x+`_C)g*uND z2#X0wm4Q)b{#}}ZBum>vE8~{YX3xI_re$q3T{nk*3G~T`^JunhR)GFi%F)<6AB=W| z(hH`<1>YK59G+^^V*st1ocIu(9M!J1vs%5c=>GqI|K~pVEOqy`{rw&J#|KzQ#v9f9 zs=+%F^2F083=Gsjj=`NH`E0`pUcXC<13#kl_jX5x2D(Y{J+=p&2B%~v*k|8Sx!cMa zLSs+z9eD)EOE{hxPF%_8`FF}>66G{X&flHYo{-4`3o5M92<*!oJ3dKUYI}Ojz2O*k z)&-Ud>(I9|vCvtbdjivWXX4fop}?Mb(iiP==X={Pz7iS?%?+xzMh!xr<$=vUli#SRZk7jq3tovOxo=}*X-o61`_@HiDRegqZ4mWcS0PDm z(cEnP&pmfeFx!XQ=Vf9NVUr3hB=;qb$)O3BOXs^R{nJhsPc2)|2A8k*&gz8Sj)BOo z{J!s?SE0bE6!EZ7F=kg+oy#$7<=Uk~iqguiZWIvl^yo!_nlcP3wMYY^FKT95)SY{2 z0_!4LTWV(R^gv|B*B@T&J{*wB_mb_Yl7X{}f>FxK8rfnnGpNUfuYYvIu~*#Imn4`E77mh5OplDYP*s1G1I{rJ zd)vmj9(&Qe2^Vh*cL!|R$fJ^2)VfHkcc(xgN6*k`e;$EG;C)HrM=|g~f$K1q>sY;8 zcUO2kB?XBOIaUy|Pm(|)1ffJ)R;Q2ApJBr{iD~>?cr%YdecHpe&hL*>gK3&c=TC2O z6elUV1kQDa)AGks!FRw&17u&{{mish*B2B8!&b_$4yfy}(WC6l3@qHb?{%(?wzq zgl=ITO)fkxa(wj)99!}5BRNOX4HG1n$5mWhWLU}MOarGw*${Z*@)X`(Qmv4^=4=Nt zS-)pluJ?8G`lA?qz3&f9?cq5->c(N`^9rH`-0%ehIbdG`hOI$zMb0?)SG$#w_20my zXFNswa*u<*d6Rd=+w#m&v%|2k%fNFs;2Z|&vw9sNZ0$8r|A6$%`8E&wUN+M9hu76dLWq9R*pp|~yEe3K89JAB7Bj?Oodi`{b!0xwh80i6di2e5 z28Qe;{9(O-IW7AXg=Z(T;_>61Bk!Xz4P*H>R^mGxF3Ud2I^d_z)?mndz9#X*Oz|DG z2QALWa>-r-g2~Y#yo>hsdUi6%LW_?fCxq$1vTNGq#P`%cbRdOUp&M3*OEqs%^3m9N zmySR7tQY5&GsFs=rVWc>F4i;Ra}zkM>JV2SzW9U||06sbC$WR}ipBzI=ZW;RY5}a5 zB^JZNtfz>|L;uN6m-bGSoy6Yz+Mnoeb{fz+D2w zHp`_u(b!(g)3oqx28k8l5OU-x>&0U25~amVKad1Ymlm4dt(x?;&PRMQm9eF#KH>jz zb5PYWe*Bvy0qzokHJDB@OF{U)w7EqXv*T_De>hBIVKdhbYy~fgS!dckt5k#yQ`ng? z{Sc*RP6JaDw9Il}-sO<2XsrG*^pBsFWfxo~W^4YeftoDUj3s;*N~pm&*uBWD&Q~8; zduQj!q2BDi9))if_n8X4c+C>tswESRi6*&YJqCM10kIl_l zCOQE+aUuE3pEZpJMl3Uxbr~Uv#fyZM=T0R60c~E%Qaw($0vnl+v;mRB63n zPDrj9zyA6mC7nlOC+B1^&2?In1hw6~TNkNjg+?1}?`fEE=xC+Rq(U*TQs7bIMQZE! z@pd7emmjz+rdVAD7L9G6J+`i|t-r7LmFH!_DBY)VrOMdG?X>+}=FXcT;I>sK>Z|W(u zed-v$(24Qz8NrtrV!f9S~-rp0O3Q@FHOTrMS@;Bl__6~52Q9c9Fmx38Ia zZyw-|KWo;%S_qL(a(Hq}Mb9gP$Tf)aK=k=zmRW8ROZ1Q9cjUq5g4t2ff$#?(*b2JF z5u5Aa`d{p?eth>KnMzA37d@kNC3oG66`0%<$u%G7LoX#IibzvrIlI{$sjB}K4-h$T zjr_c_jhM81`IbEM*dUrt2TmUIUf0I`V9=^{G9a}zPqytlaA`w^2~vN-KbN6RF>3>U>eJT{UTGHbR_bbpKE`~1Z7%`a)EjN9^3XSV;tQs zR^;29@qOXm(x%t)p=Q0Y8zPcY0t;2{Ckvg!j1jiITlQ1Zlv= z#{8?P=EK{9$>$=v@7~Fd=_%ZScj*>M9Z(BBHJt`Vc0l)L>1}a~gt%qjL)V4z$e;a9 zk0&1M9q>nCVV!-%elS0cJ)(jgH}U)9bNAoki(sF1%i1A#T5N-Lkgwa<^I>bBCp{~y zu+Y|$*Yi@zTUS*I6AEM_{m~B^v$|~LVZ4!x+c$mY72Pp$SFj5tk&Ak0zKuhd$MdJo z@~w#nY2(WHBZX=LcPo6wm)lnR=o&prOwjRGq{CzDioUkcE|+I|OR zaQm{t`b~|Y<mS`)h*Oq%1mHXq}qBNy);QAIB592KFJ-u%t5Mc3-3_Fz>-J$_}REu+_A!)|zW0tckAoj(Hp-eXFAp|!-{>Y8~9 zoKi)Y_w=w?cBwMf)xzH|o2xVGlwK|?Z3lR?-Qp%-J#Ln*9rhU}-DbV;am7$FBWn8W zdY65{{EneI1TyZ{mExNk_*QZTROY$=V=H;vN7GG7iXLjeKWuo@yJC_j4e^O@n=f^e zR8^W4?muRW^tTn*eorsu7hK@Ttx4FtIlOl0{LbNm3GHphE8}9m&xBTfukw;NQbTX3 zHylldc1yenzG!X2$hy0`=@*|G>`=lRfqzh@Nleszw3BB#A40*U_e z1c!{p3!mt~&BIHZ>P402v<;)GpUM5pl&YUvv$~`v@V>0xPu(!f^qgRB$%pwz_AeX+ zBT-vlkGhuaOS0e5s?~7Y{xMjM?3yU~?=a7i8pSLhzJFKzyVFn&iS`BL4)VMOSiLEf zn=iRz;nGSd6Sa|_I(S#iGF2=ey;Q#UxcJ^HcT7(pz}gx<*I)IsDyqvsavV@o9D}L& zS(VsjZj%pGh~xsQFaF%+Kk|>Jp^JYuqtd=i=I|EKh4{xgF|vF#X~+;soc+j0t47A1 z@wGR974mCh4J> zZL#+ zq1sAyn&Vhy6@1xX%BHi2=7choyexkH!-#`zoeF#bz=$;sUp#3XzWA|vXqHkJ0br~E z=>5LprrbZaUm-@y&LhR>dKI`Ny;1S$12q7G&SxQ;S2v)3@tJ4~UjTSV-Qwyfl?bVrutiHYh9S|P67*cyNQhXk! z0;h>225PKd041;HfY42VT$?4mS#=5^mI2_OCz9s_Lyx!B9Y>0H3sm5a!owFSMj7aI zpYbfDKE2(YizkK|Xp7-LN)S!Q5r?h^Ktl{O;?Jj&H&!*E01s6ppJJfT_uecchjX6N@q*qZ_diA;hc7$> z0T=9g0P>njn{x48Y47vZJuofI2>d)W>ozoSZea&G>|3&W=>4uOxJxN8?RaQ9d8Le7 z(p3F@hf!FU9K1lCD9G8CyaKFVSp>uM=q?-Gc|sT9Q`i^u_GP3BJQW%^ka^7Dp;@W| z#lIOqgNH8OFYP)W4&f9a1c1H_FmhBZT{lceZ>s}6J}2s-xo)}v-N=^RoEY3JZZ^vS zhRU*Q`msg8Ko(N9HHQMp9T?q#2KcOu($O56fY86L{Q$J28gORuKWAp5(|Z9~U!Y*o zzf3Yv>^=u{?SEu77nUvnJ_&&Dy#_EWFaW?rtC{UEbm5sTvnjU^Tw@BrW$g5hM}Q`* z?;C51A-|x%9iGZVHV!oh?*8TQ(BuM0v+g}v$SJuEXaqo}b^x52qp&&QH3f`_Dquta zh@sWPuPH_-3t(hk_;ISEy+s&)1Lz-WPC%yuSgVl?^sFBsKouEzZk&VES=C_n$&mw; zi~veJ043ZxT8o?gt8P2fgUblh=AQ z6uSeI9e^@*v|k9JjdUr5)&c@@Pyqdr9PZkYWwc2i?YkP%-R#!!a$)H(b~12*9GLQK zLl-}qp9At8fIKZQMh}(OtJXtQ;AH@X4(&~sBY_FC1!h_cuwwWPUp!oOm8y|C2WH8% z(@1gMbQW>|pr!)Ht};HI&m_km=+AA1&8pNom&19$!@!u>0(?2^Fj5@dmBxkkfUCgW zfx|ZdnC&>A_C2}Hs*J8xQMea?Q9MaU&vpVc?m!M$Egb$U4m7-f*|7&d?=s?G*#?LM zhwtS-abTfQRyQgHCJW)+fLx@oNpo=5A9yj|4Ie_bU#|#W>N!?YN8r0fh zA`Z^2=}tuF>i{x+mqzq_4aELsJyGz04$z%az;yQ+%R)v(1B->VJg`{g12Y2vbRk)D zkp>%3RViS4G`?a&rUCQ(UwQqI>atWNm7BoY%|gGZfAnwJTJcI7@^xB5n+94+rlY3@ zmg|ghFKBrMxN{uw+Gkqw1b2!Z|;L! z2u~!O*8nAqKAkr(rEl}#TaWBwm^KNle%qY*pIN>l39L{@^25zJvXR1Lcw2gg(enfr zdY{M58C{f)O*_hXHfEQlL(ZtWXOmT_T`j=Yc4bNm>+fMpAJ5jm82^3kNMKHq-p2$= z8L1{}JG`v5KkbGAl^Kym)|ui#k!n$nYRb)#8{nbM;y^1E^@r#>4~STI7dJsU0NfVo z!uG)>tV?h*?#QP>_t;b;zDG{exwyR~j04Y4ftb`ia*@T{-Z6KLA;da~-=fou=unb{ z2!u|{D&u?#&*U&Xbeio;>vZ&?SJ-&QV2R>69XxaguUyYi!?$FV|46ch_R3)1Q#cSK zJUBz+UmrfC;OkwI4UKm=T&L3v?m)9c1ws)o4|mz;2bcC1d8J+ek_Bdf@^cMESqw9U zIlFprhmSPo2?gTKp(CB`;L`i7Nf~8a9pYRLb4s_+zBIvs2ZbV^AF@)k1$QvWVPfeP z29}g$AZnq)a*!__vu)Ai|8AtmNMnZonOY~UOc%RSC+n&ny4bU1NCEF&dO)X{*)3f9w3lR#1g?GHBFnSFbIzr%?RR`Ljym6ZX-n(Q=0Y@&~0YE zhp|9W!y>$cO&UW_Vb{0x8-OJ+mK1ismb~Z!l|oSthyLu%!5y5wZ~4P+06g zQ(scJymn3R_`{(d-O)vtGrXihm(#VxL}AytL`K(|((wYqY}eC%M3*xN7-}~H7#heI z+Qg0zq<{}EF-Su=LlMsbkHQiFLmj3U*Xan-p__nnB%;me2vni|9P`6~ovle7VjS~b zOI#dy6TqMNUAorLj<$~fnCUoXN#StLGC<+c-cQ%Rk^H zF{YIRprh=GF$Cr_xaM~vBLMRK15NkfW3ULIDq28GTNqHV1u%Bq1UcPPSOT@t zM*?Q~{A;tflv>uR% z9Po!-i>%$77#t+6*0wL7YIpii@m1J;7QkG?JcV= zk&hGmx%IT$NSv0N|28rtx4!KW>;TmLVeK4vO_&RdJbGvTB4&>NR@lAb@u_L@cgIWS zyQknW+q9AhB1`qpo8hvNCO_|n7z3Y8C;j`-?CbMld4tAo@)*CT=%@x-o+e7|V zEpYU()f3sezWxUEg1)?to09fqciH+w(_J@WNE3aCM_%BiXL-b*W7(D*Qt95v!BwaI z22N+BbCr`uL&lBU2k;CVr~cnpEZo3O-XCt5UuW(v`(ooX{5uTN-O|5jX;&`P?(LI0 zTSJDKlRKz+GaVR@*mq@1w^7R|rIzfz{NVTKO5s(zUi^wW5AY2f@+9y+)v{AP-@Ko7 z-!Lx;=R3o-ceZ`jKdTvjveZxB?R^^hPdFCyX?08--ntfimj>t>zO87r14LlF$mwy>1IfC zU)ALGE|IOyRTm-g9Uft)9`(G<01Y;zL@Wdqv-@fAIb2k>r2hQ~BhAX?i9gk?R^VIg zCYYwrYMVyEAL>PPo+e5hUbf2!#;N(KW)>|U-qQ#uT9@+sJ}Pf}!_hMPuF*u-&G3hR zbG{ZHN>Q-AA*zBn*%oOx8OR`>;v}-B+^&Qh+Pp2+%~1Xr1QY)9PC20;*{&5uyI{wC zu@D|WN2ViURO1-VO-1DL97Q$br zlpN}kl0!!M#Q^8MB6u(+-Ez-|AcAMH3(o%;z#{=@IJUBJT)E(UXc%E^QQ_e7BiRm6 z!2v4fq6{IAVJ|F+A-0a!@^|x>=nuzMhXiwQtm4?h>)7!j8mkSt8i3p^L;Qkree5Z2 zQs%cL_E!q^eUcEu>(xaGLQ@6Bjpv%MG%eJKP_S2m&?_RGssr%A`lsCgHi&{vv9P{l z7u96lhtnxp~|SdaVS%vJ4y z(7(@w8es_UJEnvTU%#0N32dzNN>Zp#0vazus9zF8^)sQyD}v?~pb0=}iwx@Pp4Nj< zaGMC4UiXnTgv3dQG%bYpIx$0J?;;PQMqK6<-IlE37{ost{Rb{dtrJ1R{NTFBfYRoO zSK1_}(k8m_TCBML+e}D^p;)&R6T)~FDDGD%?hr=v<9*DFCb$n2_b#r@{Zl~emmqZb zI(_X<_W(p{{$-55FDr;q+>r8A+l)cdhq4GwO9ts)FGg`^14Oa|W7TH|Q4sGR@ZMm% zP*>%OQ{2-BQE&<BrdQY++W$h7^4a) zPqkedWXkAc9746%K@Hw3W1pk`NIV^iRopm!a9dJ-F-HA6ZBN}WY6Pd!worhYlTt$H zgan}&7b$-WC~gUqHZfjl6P!w0_%^8d2fEtt=4<#BsVxD-l4)tt zhBm9V1gunp^#{9v+E&Pgn?}e5A`G|ro^#G@cC*=__VWF{@BjQC9-i#XocFx%dEa;5 z+c|Si6yBi-YKc`2P`ng>8zJnyqclvT@wZ(L>=*>^_b!3g9ffy86kZ($j<=eQ*D41v z;^TdF5WG_^fww9O?=w+&568fJUliWueR$vOhnK#a{Jq3#8pwgu<)r>JL25b>MVlwo zXUL#vPl#`vy8^V~uqiMbr|oLRX*Eqat!5Ss>!`rso&C7jla0Xp%tTRJuzdEa>MBs$ zNxIsK9W_nZQM0kSEcnr7d+XzzW7+ML*2OvuFIUb{hYL^!lzQx8!$2Igyk>zf5Tv{Gz z2QlfeV(`*;^9(`iX@b>ZK$HbAbXO|KfejNy4UyEE7MxnsMuw@icxX*|by@JrbJQ-S zc3@ri4j4xs9mBf@ZvO!OhT`fFpF=$U3FbULyBaB!_vaRv>VHGc;D{>2#kn|*wz{H3-&gpcyW0h^e9EdfUd;hLy1VDOsH>Au${idq|S zsN7#T)mrS>b(joOL%OxIx-3|2$n!LI)a=KOngy$B*Bl*Wj3NDGex+`#68RfSq5pML z)O9vu*Rgz$IVZO7ft=XB=WKRt-*YNEw(oHb>GM6iYkwcld`}hiJuW%0=xo^cY&^?- z&vx#6cDpNW%CWNpeb2(PU*UUPav=9?Y~S`PY2U%Kw1xSvi>Rc|iMmzGv9kf6Di4f$VWg^m7t_|PAuIt7t zoKJs>$jd;bdHfWbGYK%BzUR~r8E?cWSzi)kBkH5A`jF&gedx^BvZ8 zC-sxmU$zrL#hClb8?w0Xqu10|wiA;|edUC#uur7-=yU2TuZeM=`bt+8q|&@xi{Yc* z$>Kih9cz@2`n8SusNZT7=8yf}G3smYNPyZp4CDU`VE5MF*c9puseht2bNv}^FKM2? z>x}Mm8$58|3Q7w}Q*$h`Cs7;dYwOMo?rWERThwx`ocAIW?LW=N^40*k@^=BNUlPLJ z`!hsPPZN_$ZIMRI`8f$tDsO22pZbxd(8CMp&q0< zf?)!s0|v1_*~mU|cD|^UR)JE6aZMJW4mW@op3dIeN*wC&GrDg)f~^#`l{i%j9~xVz zpPXDsEgdatS&-JzguuHvl4q5mpaeFzvYYDAwljtfC2}1qIm7C>&eCtwcQ8%my2<%h z3Pt}k+-=V*{UZ!q4yJ)o{-@GYP74b;;_Q1{uO77+K7k##IOjtdL_ z%yUyygunc?P07#<`Crr1$k6NtI&`WcIv3_l)v7pI74zFwU2(COH5%C%?y{}ZR&c>3$bDV8(eJWjc=@b_$dTz>Q&!cpT}7ocOK zD z%bwu?sc&7J8f+yK@^h?^k_U3&2pc2Ghj|MN4mmCLbWAX2dq(RdQG?Q9B`tZlu!Ur* zKRT`Zn&vJnSQif|hnzRp=U%Zr14C|n%T#yaRx>C7!%`@m8z6tj+#3pJk+hC==XEdT zSvqmlP#%T&L;X)5@9*f(dlA5U;LAaB5vC)}{dDBtl_ydCFMnL@5fONo8}IEiRiGS- z(0|GsjAW1J^jGIfv=9Cc@LY+&CYtMcXdmv=y01moo!OKJb%mk$ll_i}SNU~Q)O9#s z<=1l5b&F9;vC09GZq!ULubKQV6H=r7#(aRRs`M$CW@N8 zeD4ecDaS-tOur(<^>eYQ^*rZhDf>H#yLw19*9>80cYf@$b>R4~Ycn<=2ivT*# z>$-EPS=7qbgI0zuY_8vpXnTu7W5Nv=b*~&RYNc&_ZYDCnn5pYtc{X1k@MTDkT5bsI zfjGI}Z>TdVA(`YN=yEsQtVPzrrh=%oUjrHeInWvh4WZchY!JSAQ5|!*PdF#L0_!i2OzxNvPxP$ZL;a=Uhqz$wess5x7`(T^@t`st$l^M%Y$VUsxEvfz?iYG> zUp9e;b#0>d;VCxPI-xXjoOPhA8xkJpx+uCQM9V&_zwGO5;4SUtbEFh6m3@mLM>!rE zhFV4K%i*AX8=&FKcR-QjMSoT*pKqQLMMsWZ_8ic4=d@m<4u@dtglJmrVOk&W?Vnrj z)pciG8_loK{1yV~ z>*+WVOrXE#_3FMMQM7GOmOY>7x)UYIfgW9V7F*;%7rjoE11EId8Ok>^sZ7wBiS+k> z_v*g$r~3C(=3r~eoUlk-EvEp>@$Ts5G4wC`tv}*zFEGm#=+?X>k_0?mx@HvA-1r^GHTYCG$9JfT(u_Jso&SiP|7CM%khD2q2Z~r>> zQwVA;!0Yyd%@<6_g4&RcJQhXohnK+Zj>4T5h5Ne^a|WUL0!mBdoWamb;Qs9;a92g) z{_<1=Zj&4+{3_fgIdFO;)Y7)GaId@s?j2FMKZ?X{l>-?uaJLfD5C6v$w>38I`Io?* zo7W$AeN3!ce3mh z&xu3xCICdCV?gqE8wnKquQ~ajpF3$g`OnXtWFzSM->gYoaVlJs2+z zQ~!KTB82bXS(E4+LyVe4`pK_XlQ_}yPtKhfc|z!Szqu27-4t~lId6}6EI|D?0@;&3 z3{v~<+r#%$h7Io5UmX$KFMpf~sb9yhuNnmYy#eq8{rctRzI6aAYg6pZudg?8zy4HD zcpboo9^<W?$`WPjWK zz*ph4%Yi%tC(B{8E#Z7N+oFJsm1sGJa@K6)TNL)rIr%&1MSPAf2f=QZdpP^&9@%#A z7Wc5cb0y0=D-x9YZYpPJXk7+Mevj@eMKEDh4~ywmx+_u?PN%71`X?+oQ8FgG}!yo(ASqeMVZvC`?91<;gDH*8(u%nW+A0u6-<0c4CT>O7+y3kN%AE=ka2#y-WAW zx<28DQSik{vghN_dSAmv=NdM;-Z{99z9BQVjUAzXz1+(+2z=sT@PcMAr@wvrop6bm+icjUd*wjR8M|_}yT5%J6A|}bHi&&XH=Nri5a5mr3;z(d zLwQJHwI{<4@pu8Lr-y?^<0EF5ZsvBW6vO6Hj5f~#)cw2}yuMtELVbFh9ctUiP?guE zoN6&!Ywl$H+GK~?FWKCcLrt^F9y%5TV&PUZ%+CQVp;RbXs_T7y{SSk6uzqNccC{U9 zixXu}6J{{U07z;Y3I*FRnqQ{t-r7}Go~zoSmbT}xscN>J^B-B|!1XjHHOAL=b5#8v zgZD(2?%ReP9nZ7xrf|(R3?1(PcV#6@Q|Bd=AH-ME%L5#ad|I?`NSHtcdeH%L1>jL*SL)C@%aFj#rw@)=BLwrlLF^ zuC8YMcdD(%9ARq`)J_CQMN>g30@9Hqgkhh=={0LsSryUfgTgOk@acWC-?srxwX!_*5&{l|HzGc?X&tpA$6aSl^^`sj10A4kf+UoQ3DfcWhs zo4dd&&7E2a?nC}s}%hFRmGdno~L^fxQHTf|DVrMS>7G~MN%EUwxP)=9G_ z!~6#^c-sV!sg1`iNJEmwj`*H%o_(=o7Zmd-;VX&l%PcBn%`u-%zu%uzh1_X z!D?xjTrX3H>=R4fq93gAtt>0dAA`Vqsr56rbbj^vnQsjXub-(y;QdXf?kl!M#3`dv z6`0{rx;p#EXVsm$Z{H=>&Xk_lC;T;PozW?R4W1G8OUf&rALpN;JfrzB0aYVr)k4@e zIWgDG@H~z4qm3B8Yo;8?nc+}w=`wN?wss~%<#So->LKFHZzn_55S@2qgkt!CYqO5w zzO`8^w@MDSHfsmXeP+sm8#==^&HFly7-Cea;vU1-W+Aied98C`{!`fbP1k1i_xG-$ z+}~`lMEUy}4h7AW18H4+ZPIs)wMzfh_g*B%$PJJh%JXhbhg#Xh<~CNcxsAsrD?2+` zOx?GRkI$QMS{p`-n!_q;k6~!2yO+v6mDzOyvgeUbV?7@NFYT+TQ}?Z%0^RRl(7mO( zpuA15?}hG}^x6$dW2f$;d3Z`BAHNR@N-<)^84jhSv;UgEqbGQ*__r85dWy;oU_8Zr zyfgd_TBPk@F^jQ&>bDuuaUG}+;!AwHgt@NCHaU=UDphGb5ss5s-P&StmFjKNsZ=XnjF}5Jc^HLa==|NREhf< ze0=Rve7xA7kM|gSWOer#d|Vxij|SZbPW0y^An1bZ6eaREG!Z4V7OsULmBO>{=Cf~9 z)|}9NGC%``M;L z`%>TVyW`xRb?LfOju*AM3wlF4^HDs{pzZEG9@d>B5k4zq!z1I7y5-`TZU>FGLFG9m zkDvR=F~Xj+Tp6G%r_rfgdz{9Apf(}c+IRm0r;=~nuS2jkhkaw5s^+vfl~KoaU!74) zqQ10jJt#B|c~#eaa8aLdh~8@hrE~`cc`;&4e`jObI$(WFcEmSu zEN3hyET;+OF)WAq4$ooE0sA(%FOU9%&T1y(OH)Lx3B%SWkL$jW9NgapCC5qS2wjlw zRNg$!eN3^P%jWjux-S)EPY8e8clzgakO*GdUulM@$q2U2j_P}RMBf{XzRT>q20{HG z%_E+C$j#OWKX&ib`loV5?Z)Hbn(FP5{ndfeY6%IV+6HjNl z(|%m{W$XI*HZol0d4@xM{J8FuFVcHXHN>y^R9`RX<4%`x)9{REHbR)IYjf=)Q&16k6qiB+opEBkHIVBp)B8>jYBbMI$y^N za^UUbx=%dYpN>1IPHB3d9BDf<_4%4UzR&_nyRJJAV${9q0<}G_b+r`so7mmv+4+8ZTzF*7uaR6Nl7=DN9PLMqi zCkK9foYmB}zV}6hUYz1v#UTc(cDYd$1lwVg}x^hL!h>f`sQ3wE6wF|nk*;l+p~h#KZsp)QJX;Nnq!|P zZTtXIsLdz`lk|+;BvHHZsyJ1uo(w7H7MSWcf*{=|3eqy`bgBFhq*McuHdu-DaP~B* z^XHIK4oT9>*-6q_(^ToMlaSJhGNh-33@NWb^pDG&;p+V1%Z~BcGhKH*vBoiBl;oN? z<`&naD{plbTzi|VaQyAAYYXmhwU>iGZ?fobe*pY>*NXo3dEn0*FZ$ab27lfd(ciuR z{CQW3{`M!ppO-EA+ZTdAZ6Qv z*^PIT;nGu!GD_|u7UgGTxO9ExQ;lxOke-?>(SD@aneLz)ka8CxO8NIZ!E!Juv<-#L zt1M@2XA>;Bfk_)22wlsUzLNYQV}y`!f!TYgFZZjpZOn(-vox zRD)UZ-0KN?u%OWUZV;qVm5(;g1}tq@MCr6J`j|d2J_ypQlciueAf+0JvhjPK;6^Yp zSlW*EI~9nOTREq(9I$kN5NRh6>CZ({a7PxWW2b$&gYqtf@6Ss(9S3H4f(HnvqZ3g& z7B}7jNz#r*86|G8C=`bBc1NZ=NT2_Cvc%*<>Dc)_PjII}2W`j4aereQqH+FdJhN7>_Sw<4Ka<0U|A5lu@!1 zEDD9&2xe(H2 zJwNg^r{}WD`y1(a58o&S>A2cQxS8H;1j2NR^VB4Fg&TyVm`CzH-9%>^@>^{9-fQfVz zh%{%46r4Sh@)avb?aw+Q;pQyPDA@>RWx>6k-~uctmoa{rq{EBoeT%|%azSI?eI_SC zI+RJ@3r@$;?|Fhp!K8#_RBgy-ROJJW(?F1Fu^?HIAU!ih3RW3(Sd*XYN5?Y;9kus* zg0%)6l+UK8Lv#=+ukx`z{+n*3bP$O|$j5q*Cul{S4*p)7Bo0^6I30+z6`Ld%GD#bz zNWt}nopU8W?+DvOB5g42+}3+N!L5d!t7d)tkiVZ#)A!z@gzV8MgN{6d4*FiZ?(qa& zsK0&TbUfHN4T!WK3zCEcX~z^P_|8ZwPpnAEE0}(SWVd56wI60>|Gl2zek?GVt_Lhl zH~2x@qDzbfkVf(Wf7CZshuL--xh&%)7@EoQGoR$2`WOmCj%ey5u8_sOt6F*|~# z^@d!^fhe2r@dP&`Za27Gh{WN3zF!`l^`hgAou;1$m+712K z$ohDM>HWKgd_r=3*U*n05&H4rJ)Yo)$kb;?aw;F{(~&YjQcl8B2aN-B7oie&!k;B~ z7o$@DpvW{X&wYA=?` zKY$eW9@vS56TmfaO%k66vEw9Z2TGDMr%1seBi+GQ2v*$oD#z884>i)*=tGn#WiHMr zd4+_>Pw!t_`AFkkBvbku%8+hflu_~_vM3bBj)zFMXS#!T5xaEfWGVO|LW&&|Bc?Jb z6ppr|eE1OArQ696=|hC2LNY|!jD|?p7D>U}EO*e3xjxW#6vhp9>Dnb3C3YOv2YSB~ z*`;eMpJZ{s`lrKjfE{x^pwGA5$m0M?M@Sz+{a#i11J*Z>0}}h*kE9|gn3%GPLwl!BWP zQaVxi{Rs7YW##u--+x7k(q@z(oyLjMJd`M%m?8zg7)jx|y`b$V|6V{tq!WuN-^2Fe zYNk^|q^m2RXskk5`u@`yB`+Y0LSa5c3DWnOJ`Rx{x={+gfROSb3fqgwes6^YDYtT7 zBjv+>oFKVTg0yRj6l@;p4$ebdKk_T*HeOLVuTeraY1iV6l6fd>Kk5C=$R=G;`FNv* z5~bS~h513pblYSpNa1eDr2QdfGYabmg{AGNd}v$RPC{7PisL00ikE(6_!CM;$e&!n zY@1E`l|e_ypIpJlKV5B=p+g)DyK;uz}lO9~0 zQQ|`3c!NHh32{QeaV4?C-aw$)fYnYyJyBja%Kb=t`A+s?yL7~s$QM@#U^&c#(0lx5|ve4l&s=zl!9%5C5u6e z%b>tt{H<%?4#?otmr5RJC;PjCcj?+PXG=`|q%V{X+LpGXdDd7=^Bj|O`4lO*++OWC z3RoF6lFNn1aTe+F#Tg|>BkBV58RhL?7Sa2mcxZlO-~Guv9@=5lCyqws!IaOTb{y`0 z77r~X0?R+|FOq_@v)n?jU zzWYYLIVU3D4An^}pJ}_C%JRN^vlx){_66M;s#WC`h<>)t_HNAAsm~MY&n+<3533Me zQ!;0`#%0fR6+ZD($M{hauP=?c#WnHDTV0c`z0FlH{&v?j|AyMqwf17y*i^Ucx^Qi2 zWlq=4+U%QP{A@BzDu-eJ>$N4jQClKYq+rG%wIyQYT%lNw-luU;9wE|C7iE+b5?)&> ztbDT3j)zGwWaz0w%U>h^V-t1DN@iqGInh#R*j411fwb+ZM+lgF>6co`PZo}VLY(5w8g09 z(D*j8wnTZk6YSEKMLfn0)hg(Ho`>82BekXe^pLMj4~?1sQ?;d)5w#_I%F1t4TQV>1 zUt2Ow;k6|)a`4&`x%bkwrAH!aOO&2(Qd^3o$8FHVa>|i|*Ou_T{cB4H2(K-@Yxv4o zwWW8L@Y+GhSH`X_E&i8kOACzJQe=%Qy0#Rn#x=0EwBTQ=E!7&erDaBqD^_i3nPKNb zF?hJP^w__xwzSo#Ev=s-1vd;*TUu|_4njFe?Ap=~|E1c}extVZ?i4AwW02a?yM|ms zIa=)6(&PV9ZRs@Tx$~hZQt1K}pgbMlGl_BG;#I z;aX5qUo9xzs0AezNkMGXU_!MZ3gd>@HJC!eYcT%}!}`^NIuVx}eg0dc7DVX?$&bR) zcDxppB;^ub3kvCT=M*V;d}QoeQ0HP!M@XN;wV)^dZMC5NMlI;WDN^u*L25xC8nvL% z`yH+YJ^pX21#QI%l7tfa)nKT-`>Gnu=Dr$CqIBESQMDkW26M}Za4jfg??Sa8nn%*M zyap4`YB2dm4d(d>I%s}JVO)dMV0bO)u|^k4kZz5t1>Jh16r^ysMAU*J>7ea69SIU` z=R)z)0vyL`F>|L#L0j^34hdnUVx&7r+tD1)isGfYi+PP9utL8uJ2EK)x~H||9@*i|F;(O&(wlEnAd`48hKi*TF^|R zmKn;^V%LHm{g-M%V~twSm?={5vO#J=V~ko*C~u8j3!48g)q?CsEyxm43lgGgK^CJH z6w2dc*Mc7TKcW`2`$F`(Tf)8tBzDoo*K=ZZwtbr9{(#SkRoSsLU7RXyoD3-pmuQk+ zwYsJ1Ly$sa&}mjds>+@&xnF@47Sm;8X{slRx}wy&ap?IqjS)4%B@+uz74SW52)=wExu_O`5o^gK|?vtiFt`n)Hr zV8eO+_Y)(=|L$Tw{*91Xvn?B5mkD_H_dFe>&-SlhyJllHDC=QpO)0@O+w9QY6bIe} zGk7UKwpsc0wgl)F>0bf5!Y)Jo@0JR{$G zXRsv$3c>hRvuY%yES)kVxN#(;ygFq@aKpWK25T3mmuy{}UUC>i;UO~=w#P$Z?+_?# zOM$}Hp-^~gBosz}Ynq)1-jX)m*KX**8AAt}bltfv9lC*lcUvZOBLZIBHLCyw*yEmT zFG0rd;%t=PcOOuG=zdP7wS*YI^F-2jzbqT&1N{vsf4iYv;A4ozYG&8E1jRomX!(JO$fX>bj$#S;-d5t`a7Hb zwnzN7_WjQ7$||^7*PW#i&r2hoACL7NC(Bvi@7o9UGlJESJvdK5Jx5F`M4TrYvImC^ z8FRZ}Holz`)M?qUXTTn)<3Q60QTN>`y3Py6P&pga#9A3?BM%`j-Nz*F&*Iv@Jp8n*Rgq`pXv+Mo9$Kf z{kP`lF0z*FSd~?fOW)5$+;=eB5#YAt=mOEdV|`XZ6SEVReCkW6JvqGk=6b3ZpWQ5K z*HK&H`}f$2Y5$b1;QRgVNPvduJ?M)c8Br4YehciPpW23#1gmEV&IdqOECcYa8!Gy9 z1V~;t6#Vq}?2GpVa{$}w%-FT=F45m=frckAs`>qFP};CVZNjK#)_LfDUH~t)$^kc^ zU28FPtj4&ep7u8zDQj_fKiAm+-Yjsi@8D@nbwvx62meMR7v#Vs0ct^jJGR{g{!_%E zp2TQR6Nb%A7;Rp15xV0LcxPX{DH!^8=?VdAOOHIYsun}d0t~x;hoB)HAeGV(hrx@$ zQA6?Po!7l>#&;`2T6ACCU7{Z#-Bx!O_@noE3hnP$by4>&#SZq(G}S+ff6RH^TQ?h& z-`xfNEJ*FZD2#(>VH~{&b>HW@?tESk_i;vN-<`2<6X;malkgc!dEXWNG|rt+8vcHw zB}q=Ho10fqDu6=mdR7Z`KgjUO9?omnRfnObxrKk5(Q5GU2x0pau)RsJCETv5Mfa7) zi&|+uXc6&k;BN$Km)r$@_IAUp9lkG+y+}@!&5VBKqYa;E(m~ zFO?e-LCFTRIU8VecGI%SIi=Nsb;o|)lQVx`&pPcw4+7A(ul-q|*!jDj?JqU=6r0<6 zkifqOq!|NPWoz8xBF?S49VTS9!zXT+R;j1cu|6C}H{LHTfmxQg1= znu>=C4uj41+e~rQvlR~)JX>*fK~2Rq1@n-_Hg5#IH?QCpc~$|<@vn%3WO~oCG^>E# zKMa>KxR)v(E_kWpih^e=t|>SQLu^Mg#Z|YgoK^5_#RD8J(STFF23%bPT(SYT?rXqp ziGWKp;9mb~I0|!1lQF(w2Hf_qfp2#Nz7Yo8p09?xItP+(X_-~<{s>6?cT z6;N5sL6_NnnF%QyGsRUeSIjARnaSg_f_W&3$>SL+kFHq-8^I=-y0Z#qL1IT)x9*ip zuxDpBB$q=%jWmBm$xUdqZD%H=u6nLwZoy|@wOu{}Qd}d% zRW%h47SvSa7d%(tDzGA(%{oF{H50_b=PD`+tSC;Z04OXHpu02?yv^2c*pCp=j{t>5 zR_M;Qfwwu~8}?(3=*J3$MG4T|Vg+xr{Tud^5YbNp6c*W`yUq;W=G1T4k3FIvI}{eB zLU*YE-sbdg*iULiKdDeyln&k57`!_(A^F`*NZFYwu3B1gf59<8Hp>V|p)k)^R1`d4 zF}h%B#h8K|h_mHnimTk|V&T$?vI3e5m!(6Y382s-Kq0jYhlx4=JhPv$5+31uz#k@{ z5|9JiMnUCmbg$EO?-3doTLs0!_aX93d#{{6Pks-?!X<#_mD|^5?6iYY z4OUwOfDXU;p#pMMzhuZI+RZs+kwLc10+aVYgZo50GZObLvwnVk< ziq#fUs#*K{3f}Lc?MD@4fw?2+EI&Ux=J(jfH@-yxS`NU} zb9QOmM(<@E)P1qepaDVDzDwILhI;CgK0ToOmc&QziT|g8`xgl!+bfO2v>1Qocs?#R zKC`IFX6{b}fYfIX>b|;*`h@8H!~W|4|K6CkpLj5|ui)DQ_HTjEH^vU*d*ZDAd*mSm zTVn0cEt|kwc|iB|60Ekq1IlbSuzjLl*4dt8j2;@x(t8M?E2p7Q`S?@5f46u+Zvd<4 z&$7e(?H6?~r7`iK?rS`t`CzBTs%KNmR*pu5GgHsgQ#?SKAfV-FosV}GsuZ!GzJ??707Kll&H z@0J6x<#+hgu>7t+5R%`({S7Ide6K5h#?3VcbYFP?tW%s1?r3b(4 zJBx*%VP)>)OaJ|Q5ZmuonJ%Jc)eZ{d1S>dfNiQZsC>OA)ow6sp_9)hvM25Izy{T)a=V ze~FT<4ZMp#)qM-BqLylbhK#d%L&r*{? z!|F5oR?6>*XZ5X|{*34k`}GgH$Jr;F zqW9hkoof}^6XG->>KP&!dv2N3^#mHeBv|bm&nc(!*Jje_rROyuBb#A!bgWUD!tEGsSGRcKY8gWf+jmib%?s9pa)QxXv>$YR z!ubLFb73`P>$3?oqycno4HUB6xsBS(D`n4A&U=mO?V^9syg5xpSIHg>(B<}CuWb9r zz&%(z{|N6t8o7sy1LVLg;Jzw|L8Cq>E1T>a?ElG=b zA&${0pycK_6lc4l;wIOX-@n;a4RI@~A-TC^R8_$7=;ofCV6*K6hwaZGFn*3k*5*-2 zux!KqG+!kw4ZJw9zQ=`z+gvEo=0awJpJP{0Is zzeM%6UsnhI`p%zvsv*@@4T-jDFx#rXPw5-8g3|XQ>n~AFtoU&t(c0KE7F%p%aU!Sh zUP_;91*PvQ9LL&SCDjD}y6e>*D;gH2ZziR0)Cx*pA`&>>-k${iI`NM^E|e6eZ|p$& zHruKK$KQRkry7P{lD;3Ts0zF|qpoKxwqKgQ-LC|$N`0%xiiTg3zQiZj27Yk%?H(5z za!LCB`u0x)S51Dkry9~PN#9@3%7NqeQ~o7flD^|xmIgMj`BRS-rCpM~%|EXS-1e(Y zJuYOrH2<=H9{9oJtv%I{acTK3sSODJ>Dv4@wJizs{b=q-&t=a$R?PT0qo>)| zz}|zH^z{Ce(bK%JzGo~R5|f_9??2Dz`N2njV*H6kPvT2HM$hq&{?Ow>_L%fEfBZ6| zXRc!-lUpo$B)yvR$NR^gu{bFvJ)7;z89m2;{wC9>SoCbJTgK=~RO)(M$P$yDe9Ia} z&x-5cVtO8n9(D3+M$g>8zuhwy+hX%)?aPdw+fHp@?_W%MK3Ku%dGSY$JuXE0(L-rj zKBGD?`k6oVP?yWG+JSam>obZgIYFx#jtZ3dTWMaeb=;+yGT>-6UwV=c9T`Kz||ya!aTN2x9} z)b>|MY<3~)UlMI&uT~rn7SseD{MD~}l2J1A2Up?ID)k8hqU{8m>%r$8(^ma7P~G}^ z5A{>|XpFiO(ro!SzM1-h<-qBA_2pj#4qe#RGn(=O*=@}*R<$C*HVRRC1V+!OH){gb zTedKI;*m?e2B+HgKzws25^RSk{wu2;o$tRKNb23(lgwbLZyc?@3`sTt#WjCs(3A9! zR{}4;yRBywjKLFqOH%*|bh z*sM6&X1(e;hk3H-GL0&By@RZ_7a`8}0W#S>2eWM+B-s+iBUk*D;K~7{xCNNM{dL{j zdv|gD>2i0yHg9VExdqeePnPgF9b?&p0CoeB135prUiszUbmw~G9=-m{C%RLlxw`-? z-)6rd;eq<_pDIj@G;neYxZ zr|Sk~+~3&V=nYFTq-^Y%pM+H(=ITILzN7 zVXmC43=6@;9W(X;H-hg@7fXRvDFinv#_f1yxPYjq8 zp=6N(GdnaM1Lk*;Fck?(j{(zqacc0Lk2%bL88A!ZIm~O3FtwAF!v@Uui&KNYH(+Lj zXtQycpGLw|Cnz6(5jjlV_U7Q;H<;VQIgF*v#y8*j`=KF^JfM`}C^$A2<|7%F< ze=R5Xzs`2@^GNW(edRzF{eWP6=@e0$J=Ay)uDn4peWLr8OaX0475F1-iuAw!4%%~J zA*#PHmFhEQ`rLarsZYC7)J~TR_3()3*XEh{d8q`ehaKj6jS#gi3C6Dl=sraRRkjzO zT?gRZ2Bf0`z+3i4ap5`)lTLrcz4b#>&-Vws3(_s!0s<;h(j6*DgLHRyH@m(85h;~! z3F+=$kWy-qW{IV{8q9~6CX}W7^ZmpZgxAVDhnl)2|vZ5-@^D*eq zQT)saja!9xKTM<=+eg50nAV z^Y*g9$gmcLP?Rh4{|UK#4zQ?L(N<;IwC$*!u^B9yQvvGkEhK6KWfq%!hhwu zEEW}lq5#bo@56sz{@Y~W2sO}ooR2kO{`C3n=(nk!Px-DU2GJ=W#aF%9%MA^h~Jg;Zrv!IbuM9EPV@#}BSl8*pyQHCWl29y zgGW~AZccM*X3<02=KQ3_Y1N!9bi{upn4xqwOl4|@bNqR6RW<D23RDs%tJ!c&BgTnf;oA14DGvCO(a${4FZqh^z(Uiq0w$_5Q@GE= zDX`vA7V&SkVHejtux8Mi*&VR@Shj0#IFcvkzhWFW9T2@YDpeYKn>XM3k>P;64)T`Z z4A$uDJ|vRTqf&_b&1Cuwfp7`sw~k88DFC~_PXv;tx z2g%GsJ+(<+Q6Gsnq2W{tQqO+5xfzut%blQmPEk%?`AXL%f8BCl*ksVDY`(*4Uh)bV zMm*`_{ns`W?Y;eO4{H6^(;i%nm(cxV$$#bV4IJ__R4)F&5#hfc@gqKB120n;e!h^cW9Ybkz^}b~w9miP&28v@}Vsv0!$LkPd3mJ*q!`h+X z%&lq5k8A>pgD7xJrFCxHe%5(X(SF6}8t>7ZaZm_RmccqbC~HyU{+kD{7ZT2iALf0o zAroKFa#bk%>7mnIyg3pkxG1h{A5(wwR5WH@}uNh%VX*pM2NfBo~DtTM4EEcQ0nZ0a$2nwcd?Z-d}V22@d zf8Zo0YV7*)n~Fs%EP>x^^q9}20sNZsXS=rnouZRH9#2Ki<5%TRcj<3$Z9iUazNEr! zYQ-HpwedgReLY8~b>I9%8A{Z{EW+>fW>tS+XHW6;z?r>_KVkwt|9ZnJ^a=O-i@vX^ zHh~#rflB8Olc+wpVP-ciY0-qt%;dir*@)Yd)1*=nEa(7!1gqejpAL$dUOS02H(1kF zAi{u}d3TfbyshK4<&4KFbn`%q{aogA>hbjNyEhnfQd6`8$c_1+|5EioAE@#Xam(j7 z2SQs@YsswVzV$8d*I#B&3|o!Kc>KL*S7=9atPIcL+c;(9YK8yzHuvoNNl_Sq`Sk5c z53)-u^|qaJ#_?RE!BNXDpY{2RXr=r`rTipAVD{$7!92euUQp*hPj@|tgxF|aYmoXV zR0<@e@E7q%9O2r%N1GtXm-OFKMB~vS6M^CPpT*H@N^!97;Y>9cH>Yl&kBpbd;C6!- zI^v&eru`l16HGmyHg6*QEz4`Pf}UmVWH#*nQrIam1%rkuf^RI`u|{uOqPFOk9djyM z8B(s0k4)!F9Nqw(wAJ5!_C&L(>9;ZdzeE&nw&**i2!|v#bR6$vz1Qp?d(5sJfn%kj zZLJs ze~`3zM%WNzpH(jxX2G6%?0I8uQlbIC*mK9dow3`@L9Wu-?zIlz)5$ufZ(btAjdN+TudzLyudc>9ag$AR+r_Ut{2n*HXHN`Y^- z33<@q2ZNGDY7Rk zC(=f-)`3`F;}2CS%MTZEY8pqvajU6*7To2W@N|m>s8eL!mimkV{~0B-msNh+p)A|E z@_J?1HA>=SNdE=)G+v6Ps>0-La2HE&T%V5alQu2de7v)r|B62M(3;UQA8d4A<^DoS zxHv7pxP*7w5u4mgLTHV=0I48J;y~9S{N7LcDQYuni=K`fNkrUQq?0_61|&SRKnco*zx-?=FJxhN_}{rA$3Wp!5b^~D^1b5k$B)FTwt!W3 z@||hvZv3Y^tyVp0UlQ$+ea(67y_W}ou59uk-zoz5tEW~y`t#kwEM9D`8l*;nY=C25 zESR;8{?Z4GOUBgC&zgCkfOKvH1mw6~lvTP^m%>TcPYKzfYO(S4#%2am#snwZj*TBf zuU)?7k4p*;B)#XdXBG{*&-kf#a?BdTb;K-8y4}NvP};8UR&q}+F6Vy|oal7 zuq~FBu`YrPiu%E2GEPe1tT}R5&%9@PI*nzW+&Z%;pzStc6`rg+P1X}%p zzuK>`a{FBHl;N|yl-3tjcbF)!g90lnN#s$C-r({%cn8PHC@y&UBDzKjVkbf=bg7I% z7$H%JsL?DW>2f9TGj#moc(`#N?54k{6n+w~5-eMWu=_nvGe3AP6mLh2(q*jsp%Nv- z``mw?XP}_>-&}Ug*B)wS z61!R`5oRlZWvcDkOi1erF#r%+haI(#k3VMBb|+pg5WHIf*hSNi@eBmV5mxLs0|*DN zzec0p-}|ug70MPL_DBGDP`~GOgDvQ;7^|O!YHi5R^gR2p!Uz5sr9F&`Wf4w)RB-b? zsx6B&0GG4Y*R<1ty6Ky^2ws(l0p$zMjuWYg39p6<-htxPg6Tj(o#w(LYWIPXj&J_+ z>Q7)gSSCCw+DSj$nxh9QTMs%;fB)VH38$CK#weYt_qsB(rJF;+=_xJ8zb{1eAX?(@ z5~k7}f&9M`{%0zm)h9LdB(#f~8mHAjkIINVzLouwuY$)QrOp-i092wu`g~?mFn-G4 zQniKYg`%R^uR}@u*({tFHCzN+y;wp=nbFCTU(1ot(<_zHI`^ObquLH|C|?**9@Vpt z5{^c5R_1q}Eq|S)dznZ{YE=(l4&_m?v(<3$&wJh+{k)9E{8rxz162NG#CPGf?@+CUDn56kDs+K)W3q+;=#4+LQlfyT8F=k=zUZ&?oXtXSG-kbZA^z#yd~- z9Cdco;({DIH$CKs3nd=Pme+|9mRF@pjIMmhLbH3nid_e(L3SYIRrqA7NGsCi^FKK; zs;VC2J^mBe_S;$x@cX^~B)K4Xj&~n+u>|mBWe5V%E!TmE7hs z-WwQKbs|}CZ(Y_k4G%B)K!^`~;O7dOEYy>AYv}t5L61jEG1o$|$w#%q=c;ZhITVia zB82kmuAgniw4+Z?Psyg=(o|qFDgk=y(@dR?uTTGUE{k-tbE+2F!G^!s-q8gT^52f- z{^~Z13DBY_lG_vPPJ^Z-cB+MLo35~&sw3=754&FcoLm9O&A5q}`m{w*v=GrTC{!G665BsHxxZ>W!)W?^x%J{ig zr|+vLq;0T0j3@c`9^Ax5x56lfAE-Eb)CD)N^&1YXAOoHTob~J2!H@6L;i_GG+$8d_ zqVk?s`wA5*E!QiP8z0d`L$W$MMk`haVo#VkmUn=+FaEuG?h-@haF#5VS!UYHw(p}H zR$w)G%X^H~@^i4sFUC%uRSh4L(NB? zM(UPVAK5WmIV9t=giph@S;o@t0}?3-iG+z+$=-}J@CIOj5lf!@tCN2V>2h`cOpSrv zs9$+wic`ah^h~g!tI3LSX~Y_5cpLlrl6@ZQGd1as@%b~}0MfZKTz!g%=k0IzzgPMc z7QY&e{SD)Fn(V+~DDy!*8z!cD8#%{JrPTT31NAHDKfL#-wK}rc3`nMyN18Z-J$z$@ zR6TNt_PI)!%nv*w>aVg!*2QgK>^~LKm1+CM9;-Ifn!3GRyQ^6KSVU*U>(jVf2^;D% zZ`3HHV$G`6yQ{F9@@WcEctOTs&u@tDdh&JsqUsr87GWf7N*m3dh=5odgQ@l01iU6( z)-(1mL6%9&z*f^!R!;n9+V&LU-`zjhh_tZzQ~|JawQYRx@RpHmwRNd(LakXNbtE-| ziQ0FjWrGfa@AQLQm9 zyycfMAj3Qd$0*1A$3fjfDKBu0bT1tC`h&2FQi)16_Jd7+Yb_qlcACP{l)OWLyk(00 zLpc9o^8IJw%+}gUPpG^pBnjyL(=;uW_fwBXczzl()BMD95|8-!Q6wy?H3JBs%a(`$lFDLjGR8lOuC)cl+-wtgkEP_rO5`~9P_0J3p$SYg!0bva;}=?)pH>&0gC&Xc@N^wQ1ZLBY>0yGz zCr#3vTe9h<&&}Uvm*Cxy`i=3CBFxX7Uo^g{E>&RZyDyL356;N={4yhtHQoc_&LaOH z#{1sa!sYN%U42yNC|j5eDQfhc`OlR-UXv^t@zrP-woJo>=@mD3Mg$}hWw(OO94TA6 zZQL+|>e2jGM8YH6C*OLMJu}SSJ7tsqN@R>IZx=|j`%7PhKebL=4)WykGLl$;|NM3- zjb;}wjqk?!QtfRit)U<9wLPA@S{#r2WO^>^WZE_6LFLgW&UO;qhuvR3i+K@x>F$iM zdRU8nXxannPYdz!-l17a!0-Q#@VE&4a=qy~2>%UU2p&6{hIhh+ah zE$Xjtd8X|;xwd4j3DS0e5dx4W{l`u|5zYcfmule;UQ{5!Q|Q!BrYA-GQpLP~8|1z% zJ%5x>Gyh?q_5j7ki|N3-?t5NEieK3H(^V@9|ItVh3F`%Y zHoxriy#J$IPlfHLOMd^=FQfE*0f?$vc$6IvM>VKkL7#pfoW*W3rSkVvPvXV?h<|L!E&e?venU9Cm}L&X(qSr^VedbHmZc|a=iA6 zKcdg^PWfgc>**&d*Y_a`-u5+FjxWA5I6E1*Qcb5D^;3jt^Fhl<^OHT?nJzKDlNKt% z(&+@4?G~73U&mE)@Z#HRME<(REut9x-N!KadJ;gX<$m81%&>+c0CT_<_AZ2b5tv}o z0Bmj$r8o_c0T!a+_O`K$*?zNXv zbfE6d!Dh=RT+6~P$Re~Fik%ds?tRIvcv=CNkfL~y$MO0bJIVbDoRo{-CkpUl6K*A0 zD==6`#1wZiiOXkx_KdyGWQw{%fS4})??M3nPzoCdKuH*W zZUzt_r^q@6FuUduZe?Dhlv50C#SYt1c0vb$GXaVP$AC^Oe8DB)89*`j7|;VyRBpi* z07hxL)Rh8E;8DO@u>nMER7*fFuBgd%X27L&l;$a*?Wxip zj1*jsuc%9g_4+;e8##P0@vqvu3Sex(s0kT-?JsOstC4_QIz>a4CqWXQC$I5H$?v`dr=jUlL#WWgi9#PpQZOD2i@Qe3_rJUN<#9cCuK zceDv0j+y*546O0NUkPGblcy*!mjVW)kxSN5TGeC5GZ#Rsir?KxxfVuWa3}@T)FX%8 zKIz>jRE*OC;kR4C*rT33Exun z(gO>+wSZx-pQVHlTGf7;9Mu9ckyA(_s4zNx3x?xWAE~WT5lA7~ zPV{W%{oXPkSd+G3v=gA|Ptj3NwB|-zkXZ_>xhDTALsEC;i_aX+V6|%<#V1X&CKW$9 zTMD#^q3Adl?)}t{uOWx6EgnBv;|RC`k+H#r0L`atdZD;h`=OXIBJRb5zuh|$0_2C0 z6~sXSQ4uT!hfqM*)g}HhjKmAIOJTB1a<&TPpjsjkKoj9Juabb#Sc=Ml*g1DNQG6%3 zL1;D#q*pYxvmw{8+3`5E$5k#5uU~-jp=p zCOoQU99sac?6hMHc*Mg$2GLkO&{DjTCVGZ?s_2-9({`nX-;I9VTMCJq^p8a)k;Cqp zdKW=alc-%l9V`2QG#(gDUNGScK!CnXe%}SiMqm~sC~)~MpFAs+Wo^0ZiN~@Q30J~j!uGmurC`4WN_YGNL6gEWnj{dR}qRn)b_GkTDTx(R1q+lIe&IzI#`gUAXN=7BdTsi;Iu?iB>X zj(Ok?S}aNyA=!w@(TU_OGiV2~Ez@hGcUPYYP%#;3LbWZV-d##jOt?kS@ZdjNI2 z-1xZ>KmdY3aTk+`ri@wz0ei10qiT8pUUzR4rEam9+T$mCx&hq$98GPsYe)7`HlaX1 zGo`XR+BM`TW)z78Ze#FsVMKMeNfaFowDOOXQ9C_AuN^|gEinL}r9#;m2{=&p-QJ8C zU=<-p-f=|&wnbAEXhDGA9<=a}AGpA$avWO^T)q3Q_{{fQy^F5+xtLTtCO~lYuFAdN z8xaG_-swg;%mBDi#B64mxdbKmDF-GZX`={T0GGq~%m&!SD5io&7r+jbBE%3gjd$_G zf8w@XSW>{+$$p*@DDH$mvs?mlg-~Q1NDH0MjGf53a|60umGC3CZzbx;05w?@FtSnF z?lh1mfCRG%-Fw4Il!~RLVw@?i$UH< z0D=eri4lwix!BCe0F{&HfUZakr&L?DI0;NzRc_1xU|1^!jB}}x7FRB8Ka89x*!{-eE$;YktCF%HN%pZHeTJ7FNE{@G4W4#gOC7R0eFBK&pn^^9cK2*o=Z7Gq zws;Up;o0J-YD3;+Ig1?&`dVyC05>FIa#gT4z9E}<)ltl@u1M`ksLIZ z4A@3Cc=AXmS}*@<_py5VvxT+5c5_qh!zQCPNz7P>yVdA-74RrxJNVgBpv%*>NI@8e z3Xg5mEf=t+rcfooJo8B#=AEL-2kv52k`^j{=DyDJZ~i_npyu?Cuiqf+?qt5q4=q!` zN4P?n(1@?w@0ST<@|gp)OIThGBw;bFfUpkSp6MU%a{i98&Kf-soV5WhHb3j$z`g3s z*49M}9cBzpYktHvaHAQawXEDFdp$(6G5)vspok2;m4v>Pd$6JdI+Kj61ILg}Ou9>Z zlBsjOJukuLatV{`pHP#g6|JqXL^%2&e2Zs#m?g;lU?6RtJDD~7Zuo8W4~>`-0Om}1 zukn-maW%82XKVKxU$<;z+reyg%Y2EJw0u_tn(>yxQ!{t@BXX}_uD!t~)%Yu#s`rsy z(a;d_yxsOxitFAkIqX%$)%w?;(%d!bz^+blNqDUm(9DR*+)(!xn8R9h+(ovwOy>>{ z2b{i6oalU?=_$g?b!e)=vn;k3c>O3H#@ahL*gOsux&o~@^Iz}RZvdt?ik5PC4n%HY7bPx|9 z%P}V=MugnS%SHRReO$K0MEXoA|*7oR*k$8Z_swwWlodawD|9AXcmZStv zPSM6lEfc`aKZ#CP1}m5N&l=e3N&o&hgEIw9To|n85+`R~nHZngy3ATM3X^!{b|Jgc zY{E^_qy&4C7L;fSUml~U0T?+B!DTQGeEAq9Oo8wGl)P4JNUyTwlfP+D6U-8A3REPG zDlx1@R|B?QW!YVB7yufv3plWsXy9292;dUWEo&z~0u<8}s{p-FbSWq3f9jz%CG89tu^8)#ihjS5T8dxMqu| zh%h*(sGPu^GC3{-)JV5|xI z)#4Ao&vXYE<{UzCdfWlrW`X%c#XXj3aOdxl!J#f2)$OgU_1!I-0|5vgGS<*P{$V$> zc$WFWwoBO+$)?=2%80Zr_!4g2p2FS=6k1*Gy^A;m;jWoOo%moP*j{}?S+;fb;7eO! zA6(4D;1$6>n|PJw$Hxl=|`XDIU*tl~)+++9w|#AIMNw9YnNCj1de;nND$od1rs4AAs0w-QC}X!~hcqhA-g#0RF-M3)H-$J|^4lcKrp(`ZYoWPuBYa zziJH)bIOF2bYBR7GZ+&3u4C}vZ{`>x@09@-791cDQVz?D-G4VU>khv+bLM#1t*u5= z7R!qxT06K91ecIJpX>LOvkSGqS%|#Zl(Jay2z7UObN4R>Bc`Kc^U#eU9KGm)fz+OnDI*o}Y;=?r-I1nQ}3*E&;a1^9avBgrKvr#e=g0 zR8FHMz|*!NzodG%CBT$;#3aJeI4*Zpr@Q;aeLT~4q&IV==M8N5*B7i(phlM!UOHqizUL2bpRKg zqmDl*Ov5TE`_GVYTL3HEEh)5FW@i{6i#*wTxR$~7+Uy)X)%Cn*k>8+Y#a{6B+Rn8H zq0^nm+7gg~(KX)#qmf8-eV>?o*lgar8#u|*FB}OU*7h5^-h#-$8^;H4Fsx4p6d*&Y zEqiy5`j&*9!*t2bIX!m(#b^X(CPi|)EO>WozK{27=Y3+6v#78O@!n>UJE2xetCPtx zxlntU2~y?wi5K%j80cXaoeL;Jo z)K+X!^7={d^;_G+%{x1|47%c)ZQJmO08B}xxUCQo?zmAsyc#icGqPN-d^F4&am|Ks zZRBPN3m;}&g6CvDmfG$&vv$HL0jE>=%ydZ#e&krOy9<sS457#FcQ%?M6(XFczu&MqGyVuD5IdC%hNtapjT_eVBvNW&jkQo@8CUnWn?%&b z=5~3iT^UF|htx2npQ!_uTm(P79s_7*})Ym5a*ngJMlpF0c^CH;I1*6^EIpQB@oA^Vyi%rAP zd0HQCA5qP4u9X{Zw1Zh}@#eBFU`tMUZ)VM`?qVX=C}MX;PQ41Y9MH>ZhQdfz%B*2` z-lZkGhW=R2o9GHg(tv{e-+b#cF$yRBX%S(YbJ)b7W1{S2G5$EN3%kChQ9Erf?&R#_4oiL!P@EQ)1A@SNwkXo7xX0SRK zms;XV_=|Zf%#(eKku^Dj?~)JXe*{5;7=AwPTu8H=7j=##G5(lHE{af>!>()l%C+5L z4#f!d6q15}{FPg~eubL4hPuNEnvv8;8AAbK>$9|f=OOn)Vs4%%xze&($Hig3YxH0a zPY%DJN2WPBxy7wZUEixUPG~eGMomMzwu;9*EpnuJ35Otvduw!yZu3%4+xD}2gjR!a z*S0(pBb0MjWqu|sqXRG++xWlWxMN&#NhOXz>@H~~wPRc(hN9F!Y`-BVwN9XmZIf*$ zkg(EeN?Nj!ac$C*JxVKaFu;DibQmsl3r8Q}ihBjj)G~GgKiW3!2ZI;r+~=j`o#H=_ zW8WG4E56s9z;2sh-(py?4eP(>8;|}iEr0)7(KoWou#pcEwFif(?El6b>XVhrK05hx zrH9GMkjeK%emlMC;T{T4-x*8|2G4l1MQJVju}1i_i@f1|h!~S5@>;Wu@6j^rHdJk~ zf?^4vZSI*btKC#qN78;b0;YG#VGg1n|z4Ut}G%**H&2B{Jf=GOO&8O`7(HzPH;R&_jY4!5W-o0p4FyrF3H&{86tO{ zgtAycaqdI2+*t3Wd)tZd$CHM?wgnfeNGOM~VD5=5Kjz*2xdd=WIBws*{zxi&E!|s= z*~bH8oN|U89(sZjg4|I99=klDi87$acEkK|WTseNOLzO>mTodcI>hALm038;+Hc5r zh?YdaSn`jzv1D>EHi+#vT({HrQ4ZV&LnCYn`a!`}pSe|i7++}rl>dZNw>+y)l!CRhMq5ixE0(h&Hbk#%XLUj}=u&nWT1)cDJv8zuJvH*(6Q}aS z>;xK;Z6h>Bx4pvh%{kyit?Stgo6}X_PnX`n!@XRI@2_09LPKt0cOKJWloROXpUeE| zjdEhDkPya)=za_}^lJ4!cLZwgiU%T~N`|!3WZqQ|8fstM}8Bma|wMN?S`1sKpoIMZ3rU+MCZ;rWQ@DijG~!-QB`ugTl2f zLflhWLT$C*)RK;5is5ZHiz(fs3bqpxR#{PqB1(<`xF-C{)^!u%nN&0012N)&mnL}} zg?JsW8in`!!oQ;_l&<*l=u=ETKWsmEJ zobzyGg6Y!jY5wAZbkCgsRkKLqr6Y9t;ZfQHK5)`}?rzEfkHoOTCLyd&>GAETAw%#Z z%NL#{DYHVO~6fQAP{tx@ zCfhxCZd%FeDl;5CUv}Dyi|Cv~+Eyci*A|<%&;Kyo&m9b7laUE;Z{NP#(Ng9Occ_xN zo-aC1tG~IGWxlPO<{~y=PKcyo z81!-X-wlM$RSuo6w1jr3LUyCYVY26w8R23|ORb5``FC;u0^F*QV`wRu2P38!I=*Fi z2qt$2QC=d8Z-xYhH|5g1o<43nA)pD(v?!M*B%bYYIoh)cX^1I?@+>;`OlSr@fD&5J zb4G|OqyJSJ81V)c;a?Sg3SxFgkJblVq9tIcK-=RQIY{TVw^JDEaed`4+2z0><`5*$ z_l62@TY!vt6L(v?^B(nS>nx%!2)&1Nd4Q0OSj(=U10#LzWILYCw~k!*H=x$T!6`yB zXQ;ZsQF(N{8RUvK(x=lbA6co;{+v-ty_mw&z{>SlLxi;6weBF$L=&fl~SKB|8xRe2*Cj zzW5vzbCYaNR}aFtAX~bZV1kg@-LD7v!yK735j&upFl<2%#}gr;U@Wz(Zl2Xc$n|~woWMR_QQp{ zZVlP+?gkm&b_mqaF(Swj>(Iz$)Y`xy4PB_m0Y2W1e)#Kecr%e^uP>*Gingge512HrVt zs0Mj+0PpT0vyi}iOQs8UpjuYe>)YSwI%rZ%#1nnazXNA6Mz!pg+ZLg^5S2wJOXRE$ znh$x9i|o8{ExI8SYy$1iD;@KWUatp@{k^t+ERArV$oMS`U_;PndOgbw)UPJ+O3DBBw~z({XE&qieo;1{M(nm^i+R67H$t;oO1GwfbfI| zuC|Zl$V5eGIoBINPP4p)F|akn_V=BtnjvN2Hc$vmT$_PX2dW8*Kuwx_jiWL0u zp7uMcsDA94Ttn<=Qzw3omgXnTvSQ=G4^Jk&34i4~JJog>Na75?=ZU(r&SE*S?Dt7h zXKm3+`YZS9kgkR7w$-}5*d%r&ZFbkDJcB-W@rX9zezJ@0KWlaW^ioU+pf*YekZ78@=L= zQu2QxC#J-jFGtzhrlx?75c~!SBZ|OjRn~QK8j;pW6}hb;BkmVW?gK0UHto^Iag4;c z>T%iXxV=p#)dZ2j{oO*&I2sDY3}9 zt@h)!5+^GAQ|cWNPDS5pGQHRB`TV}RBqk5|67{=V4H;f#i?j`?eu^IN^?7{xIaudK z-S)-M?I&mdjK6jrad(UYk)%8RNFkM$mwt_5j+^5Q^08>2$4inP<4(NrDsI&OX#F>P z?n&sjX>sL!dp?{XUNZm^!Zb)Jp>lOcZuJ_cKJjjoEAs!XqLIX;3olfziXRn{YY~ff zu#!Oe6(|uXX18OgIik}i(5jE8G6sW?zRL}neOu;3_)q;gbcq!wilirmp9URr3GqR} zsa_A~TaQ})LgcTO{jV}f)c@iXx*HIBqeM9#nuVb__lg0JAl5@8v}B|YY6e3A?r^2K#rT4NpMX|83tH zmcQy3=CMq@gkZYR_u+AgM05FW6W%caGO%fZv`)`4&f1t(iDmN_GO^;;m3C=Jrp2uXGFALIttsE>T*QVdy2Qs;`isBnx!yAp)ZE7yZBS;=c^eswHGx z9hRKKG#Poj^OF@FdXt`yUA1|N_RF}qg=hbldZ*hwWw>_=Aqn~4B>H!kzED$lo@~Vo zLa(5aF;CHqq%z`k7u;L92K>*(-q&YB$LX^%JrJY;_5_(NS;PQ}t(@ztz!|DqmdH>Ef7 ze4r4j=e}dotoPE{mnPb*h%+SvtZ#d^D`_y7RvmMp$4rDcZcl`ph`6x7$}ga@a?RoT z*IN{#R*^dWz1!~PPGjh}NQVh=%DcGFg+9@CE8jn4y$YeV_U}x<(dcF(jq291*mmo< z3R*a#V$zfuy56{v|E<_ORiZd!D5ifIT%cc(hTRgs_hp)zo7LkBb9d2{29d|_s@O93 z3XdfXlYWEj3RbF6aMw#s%NM9aQ#3AfjiYbS&1y9$*}xc`{fWc`vpsJ3T#CiFe2j?G zvu(#((nX(hM@yW^oBMC_yB6abnl}+-rz9zb;~1EdP39<^U7r1K3*{ZojLA(Bl?h+# zRUNy(`@D1C>U{O)3#W!~qL{hG?{&W!cbp$j>BKMyhiv|d0j0v*H4v*SL_?pZOvUsd zOvm!m2P#{0ve6E83u=3j<^xWD@mJz!8A917(JBpTV&w@bsiapIN`WH1pUXU!TwdGR zW^kt->-{aZ(mfQGwVWyNt#~#2U+Izab9Y#AqtU_sRUcT&_zmNaAS$&*VYh5MU*eNP zmk@KYah?C1MC=b{|0^#cdt+`(r%Rxd3!mQ95Ru_`ivHS27wAOd&}Z~7s38_h6F1(u zb<#QAzmJ{%$e7)zPHk6O=SKtQ@`O5nZDGIV_%(D-eKE8Rm7rvg^u!f)LW+(3*Ww{s z>Y|}FrEFIvJ7lVtioFwHG5p!BBO}^pTCen<#*#?h$M!V-t?{JQ^(`HRXGzx$z@lGIDQCaITXs)vF}cQOb#$A6?>X< zJWbkoCX-}8tkYwVm-sLap|SqVb}}Y>Hqm6(xs98i3{gn=#S!jXI}_ zbq2)9FLg0&W?!V#|C6@J?^43<5MjGmWAWTLwR^qT+MNe67w5E|z(dOz#*}La{ld>{ zIN$B#uZEYd_=_1ikX^ekbR~tk_Oep~emVE=-di2ucJ4V#sFL!~3Ya>_<$L*w@KzQ* z6>(LkAE8%2f08*?LfMnSPd76=m{M{0HD$IWhg)Y7C;l2&MN*NPOUr8qU~hQHcw+Qs z+fDelNx@E^n^JlwEeH0E&44NAxu#eWt$wij;n{Sa(Xx{vw;zisgBbZLI9f%tiDjy` zydj4xrN6;EyY#5m`PDzCnmQbbL(!1_5ulx|>r3uOxS}8ko$)7*2 zx(}Yq({NQA7mr)_PPFsZU8Eb^U7Brx<*+wLi2hKojI!%-qG1xJEGm-tt<~HW1f}*C z|84B3ksJ^t{I^BWV z$&quA9{V{zV+}9gQ}M#eO9sg=&c^vk6d0x3 z@fQ<~^xE%uT-$PL>m_1OKZ$b(4#t55cI)jBUiL!vDz4h;_0x~>5`Tl#>TOD`G!Y+I zS)ad?)m72|ZBUaNSC^J0M(yqV@g=vVkn*(1Kf_b5r`FA?c9#lMQ;GPJf<_b5J)|d- z!blmz-kB|;uJ8PdicINo#WMvtt2ujR_ZAgk`goiA-*&1`Qnhs~|03b)j*V@9gUC+N zT>sw(d-+eh+1Wp2@QakopT*04?XP;7t~!pRuGMX(Av_K@i%*&89cT9gKJh4MXW3BcsqQ`r!-m! z+}~vR1w}q2wpX`^_<1Nd*pJVcQ~VqA)qHED-nthLH99iTbM_s3u|?ltrdK+9{CwM& zfCjHxwApREW?pek!Cm0@-CLFFg1j$j-mKMXqRs2?q<#liQdedfeE&~PS1|RD{J^%@ z;Mcz{jb$~WZVI)tvug9%X4AckSL>?E3ENAvO2Xf#Gpk5Uptl>TU%3x?DnkCZ+HFWw z$F|2HAQvc*Zk^64+KpMO*T!?dx;h2jn>i zFiDOa*(bX#*b}C^x;qy9bqubS^b|n|R8E_(R}BSyI3@B)Xc$S5@OMePaJXxMd(3?? zFIgFiV}3hYK6@zrPCykACs@HmF_qaA!zbC`Cd#xk+8h$)1M`|FSDhm=7o-p1%C?v& zX+H2fwi(Qw*nb~aUv)h{llaw=HYrN7Sk!WAVY$U+WT0iXBdozd4W~P;P}TKvCP;m= z@Z)Ey{C~no|G*g+>dTt=W(&jJ>yw}_o&h$^in7d!1MK@ITFOtB9>Cc1+*9jH?^2Pf zHJ~}Cg7W4FAM<%sZ4O56WAsOBEz0aT6dn`cs1%U%Z2O6(SM0pmdP>k>K=hG@vL+x# zM)7l%IDPofI6>he&6eqN#a;@ngT^_g>iN3hk^JXnCLGG`6)v(Bzv;Oc{k9rkHpX}f zCX{d;wVG_w*=s2wSKKBxn;7D0OgtxWHb^z9GvAbSW$_ts`Tr}EWuDW1wQBpqfyC`6 zMSxNhUpjomN>lAeuZ-JJ#%oTSU%1R}jKrkGMH_6T-G68p-A0B)3F~Vj3mUq<#_l+| zj~%OZOcxW(->XtL@_7(_j;&Hd{N zkGTY~rX~?ZZuQSrafdV?gw|gejp~i>{+gQoQgpJHQjJ^vNrYxBCzHp?Bm^{*H_~U09h!@Xel$bAphn)pptlUHzF- zOgZ@Q^@OTyidIlRmU~T<4V$3p)m^r1J~*(esbi3$+2`vJmT=m-IrZ;op%g*o=X&hA zzR__6b9;4HU)8%a`#1)p1Z}Pc+Q7f;|ERXK7X_>JQ{89PXX#52?}lP5ieA ztrYH}o*odWmA@mHcIt+xQL|*5&nr7Ry z%@q4ZrH*bAD9_ls(0irM&bzxv!-_Sah7!8n8g?JT;}Vo%T!y7Ibu_%uUnE`dom_yT z$(|1Vyjl%v(OK3FHiUyus!cd0bIc^aH4-wVYtVD>R%!T#Ksrj*7AXxxZB(utnF&7-G+Ku}W z6Ft~kq|eS@M>7=sEKMgz(kPC$_vu~NCj5)fnss2mT0_QX?c(?=Ot|KLc&2qRsI^v&Z?t>S^_vtf z+(Z@Le;u?Kk2aI7%+N|@w_mLmYLCy-o*u?C(W#VM_IO%cL7te>scHGgAt_jmFU`?M zR`!I4=7Z+p>~?ov2IQGTr8mq)ME|&1@vkL5r&^22YM-!~%UjGZU(&oekJs8SHz2!9 zsnOhR%g5VSC!Us9R{6DN27PFh&(ag!XRLE~K6Yti5=3cT|4#rV8`|Wto+xSynX;;6 zp(uAKR?&0>&fL;B)mWXXo4h@@jkX8|izmoi&9QPVNTr!XJ{m5#Ts|8`6@pDGmv^ZX zZWSkF2}`R|7h(m6F3gZ(Sk#+JY_rZYl+JDxe5O#mT~xn|10Oe zO~D4`|FXT?DY^1_FOed2$(+I8>)@(t#^=bi;<{{}w(8kVE)WW8^4fH>>dl4IYEK@| zHH@Ms9*<@8sZ6|4sQ3cOR;?9nlTocDQz2CDRIrJu6Be8b9+B%Uej7O2YMMI&t&bX5|_4MZLLs>x6K}dsi&$Fg5TC*a z_>F$i=!&{Ml!Lak!r6w`X7R=hT0_@l)E5l|q4UNCt}OJtoW5dHxzem5#IsqZ7&VdF zU_mWL>Nz$a*SX!5UbLOmb8V|Bv;s zHjvU1shB|J>aK_*VM$feX*V16=kpcDf(iPLJ8N$itwxtO5Ypt^y`YgGJ?g5#PcqhRx&YrOFkZBN*&dvu+(1 z^=WMehpG`Yl(O-TgU!U5sDj@O!nuqt2H`dw^D=tT&g~F=E^1u*xZq7xM9!hN1(L}a z8@Gqs-c~to?p8YasKwH)Vro1X>IPyepWYs4qv}A|Ba%@}+pJPeOf>nb#dxZ!PPwaW zvf4Fg-RWSMXeJ^?L6fh!oy~%cir3qeC)ie*iX~4b?a;Z4re-LMXAPQ&zLnBBa-B}y z?y3udBbqlm9PvOb)6>@j837|AiEhqnG3oM_WXYo{gmP8AwiZrvWjySRa9P6dX5%_j z+G;PR_Bt?s@JTh3)Y(2<`1bYyl9|HUbTuBDvf$ktF8O(QNdco z%z7v5U~&n4EoFDN<6V)mVOFobAX><5J)Yz28lKH)eAZOH8}*9`LM3Dg+#apu6Kq=7 ziQ3#AhU~_vn#mEtEly{njU{nQAl|a%Bl)oCbW(vtI2^R_PM$-$F_ut^7@K9BfvABjQZ=SZH0tJxC4<$vULmY%cC0=f zW$LBOWdo-rG6ijyjynY<|9^q}pQUyBdw2dfDu4g6DcGR=kNI;1*(e0b2;uHTEF@dg z3Mw{5zClq&FSRds5+|y6yAWlG;iyLi)@OK9UNu z1};*mYVD4ws-4l2e7x0dnlv6m1LH(5M`vpKu-8r+(>zyBv5Z>Vsz&i>39Ix1xKL^O zBNjHOt@w$0pk`57ys=z_bj7k%$?a-Wf}J2zM9qLTQw*Opa(PWBZgo)ATE*fMy~ZLf z2FPrREQBlhmX-3QGAduoQRk_&M?l(TAlMPrWg zVFg3jZK;F{T|*{oiN&a>rD!wORKB*Ui7}pXqv&9nlGz*cFb;yIoM~6cSPF!y!H&OM zrfnKSlJ1GAOd?Dgk~M;(odH{iaQZ8%q!Ewi8wryiGv&iMpGL0>`vj&QisvxST;LO= zxt$B^?X_&U*D^XvTB2&fvYC2@%H_?eq%*B*GfbhBDw)`PqoLE2#g^Wb(D9{WkE!!r zpDk_c_WF(Pn*gFJE7qpd>A(M#P zwAqF+=~veThtK2SZH}_BLRPr6h_(D_8^d_rQK8lLl~ry}xYQ%tVyYL@(a|Db)W-~A zwxs0$FOdIfeRgAh|9h+aufvt!|7;32DF3%8ijVrJtlC{}a-Fs}VF)rREYD?i>1LxC zqC}@VTQvk*I?@++q&YTQ)bSp7Amxd+jRdEn@!sy8n&78dQx1Ojk-#jW?kzxv||L8vbkMJS}f2#X8@~M+BQ3v zjH zjc|SkqcZqhVhVG0%!YiyDJ02+7{zEzO?fE19P~R|9>N-Ik-2&+NVZIQZ<$ENYx!oy zS@SWm3Y9Udw2^jQs99OPyKbWyZ>%06@rtez&Fl2lL`UbaruB5u(aMCy9M8v0b*)>B zBn*+f%jhVCqh*syZA`oU9<42BwpzHbppCVH)PR^ zgk9`*tA1Z1BsL;#vg+zMyp*c$?FssZpG<|KsYq3y$;241OOF{X)>_G43^O&l9WSWu z6^}N-Y78_Z_F~48H%Sz|Hb*9;5mXkfzZ_|#bhcQ8aZzzY*i(uZ*tkfQ+MTAW!B7RA z!-AJ16`>j~*Fp_lT3|g*qu{oy$!Z7ptB72INo2!5UE6?1jJTm%uJVPZ^8Wve zMcoFy#}#Y4!c@h}_>-bN#fr&9He~2UBf%<{_Bv9GrqduTDHT@aoG!MjFWbd#ITdk- zI;=rZw^KY(3HWGFqS}hlq}c9gs;n;Hb9HJaW4TM~3|3KXjO6V`m6a^|5>1{o`Ej>{ zELjD{91oj&evE9lEzxe-UDCAk34Nx-YIeIWzqC8DuHJ3+H{d*0y66~eYi%;GnC z-L%6O6;u^Rv12I(?Dh(+wVMlNgFB*E>myyW)1b-5-0nuRr^SnTHf?DdiUprJ(e1W) zTwBbG7QyF=XjK}IHrDaxO8JtIW?QBZpE7DPJ&(2|B)yrmA>iQ2R4kB==X;KLEXdob zU|w&thP@P%)rYg$x+>*vbSfbmlW$ZlVYewjgpldJ0?EyL! zbQ#^+K$dRW!lt|>WYU-HxGE8hFg$JcGaduWdu_F#IoUS5>`MOs0{MUK|H-BGy#G=D z{%>=zLHWPSG!s2eTS->b$DHoxzYtRpb2XtVNsG8Ee&A%A*VGO2KX|nh*Me zAuCRYab2k7vf1l}W={}uMT=qi zzJf;^jhHT3a+K+ewx{z%bCyuCf)hHmi*KcCT%p}&{F)#WGN&p+wV@(=2^*eng}J2K z?Xnf4qAStta+xHp_6T`<$kXG5KpIPSX-z564T$xGx0W(8k%HexRehDNT9q^CX(H;z z4Bk-KN;`{2k@2ZXBi8hiB~k4VND8yXtb8`3*9HYgf@822krIV$tsE#MwQh&X)fSv7 zTP#86Qh6MY__{u`ucXm2;ST8vxO&#OQ1+yHp$_G;`6{AXts{bz&hFN7$#P5VRZFU1 z$&w72qd}{?sO~Uzo^#OzUNq@!!9*g@xnpimz}3jsY8j$#tcN1%Ts~DvQEGvtodrEs zF{&)dTDGAxmwf)Hi?auaWQ-9UTu~he#~4EtH@QrySS0AGQsp$+bZ8^BsG6*WIVNTh z<6MP`sXQ67p;kMJ-bS^`6|>!d!<@C4<4XQtfBt8(dTe9<{_EE7|CQf=ZVEQ)`)@5? z>n6!$u^cbyg-SWe{{QSLPhecEx5JRqRG_E|(!6cj=6F+1Zak_xFN zFH;GK)BWA|R3*Gbdr1apcTaAg_K*IOnB<+5D!%eCUAb$(WA zpFTGD!}_z~jCyME_*5(1*LU0YN&95GcSP=veMp+v?bLX_T19ZT+-(-m8=_kt`Lf?v%)BX=uT=5y{5qob#V21Zw&mxmGt3t* z4a?S_Y$HGHbmfbK;^Q$_Z??R%-HUGTxn<`rn!Y)@eKelSICnP~slxqbzhuDfy+b4< z$lXh)wC!}7*f(#m-8ecuyyzl@Y<=za>L>Q7C)O)|zfwl+uifVH z@$sE*oz+dDeAc#4b*bju`;W?5rC+FUrAk9+3x$)XPO(IG)g#NRKGy8y{{QRt-!*k@ zl~KTB#D8YzKPT~@*H3TazrrYRG2%b-yu5t;=Sacm78#J>9~1v&-vW#g|G6M8kAJk6 z5f>Sd;J<+Xp!jp`zf_dP#QtxB-o*c>+JCv2j}ZSqvH$Vu@8G}eQ@|MOzgUnW+5hDq zMlLcS!G9iq6FX#;$G^n#{|m|aUmKyf@n2mSm^l7_e);o1q6MQ_WI%%dJpPWO$a!Oh z2Li^>f00l2{~Mtn;J>mska5<3fsb(hQH=_{YM3`52Hf@E679@sAdaa*+WE{tNg&{N(4qk}N0t zzm3q__^)o|jiLYf;_~~yWc~je^tbR|@)+1y@Bc=5|0~L2w2KT#@Q;iClE(nVdH**b z>HV(=hY>6?Ai*v`nsJ>3JJlr13gd*p`;&xK_1&QSXFBSY;Ox z+ZcrTzk{p>GBfRfKfuS2U}r9kko}^6 zInMR1hX4%nX$$exx>K@2y!k9M-G?a$`?pYYR zkf41w{*V`w(Xkwf=O+VT2_j9Bf>)ABHfl42Fgf{cZ)6obh&;k}3AQyBIAjtA)OTqAhK0%gp z!9@TQV7@+q))6rBbRw4=RX)L4E^pU}Kfg7J!A2%4#?+9zYKP>}07#B0>-W zUE~cBvVb?Vfo?lwClsV~Cg>{-_CZ=K6n19*r)LBx5DCU+D(4{6dnpzHRtx1k8w@af zr9AjImr4av5`b&@CdKxz+R;O!dey2`_Oh8zGqSYxeHQFc!+!_aXOPYWrXw9FYnV1` zV!|93dA@6LGb(?6@o-$es@|0ELcOOf!HgTzp}wdc*ny#r4a(%{d{tzC&<|j9elcJ1 zOHM_DoaGxv*w@~;tpIf@qdbMWbySh^d67wDO=IX%3k?WzsU!vCAfRh|I)I=;RoXy= zfHs>kXt5~++wrh%(Keu^0vIH_Ve)U&RuuzNxoljwuK?~@wu@NaT=B8EWUWQUPGsam zXw?ID5Gsr&^!9*?h$rOeS^#=O0qpGTuq11oMC%f&30W}LHkS&S9QG?r@uim{>pL*k zp`k~_+h^r^!+lzSW`$zj8>Yc8`ykEluz$1TPNgR117v6$Oj?;de*73%j;VYKTU)dW zmGxAL=vecBI9VG)^A(JyH{1_bm)?-cS|Ft3Ay4}Zhm_-g*e_rm&#pni>Q2|8S*wSc zQcwofjvkuTYU|`AfN@uHKZblua@XlF)nfV0k2b)khgFnX$$z(=Tb2YJ!sjiD) zp9`!JlY)>-tV;UN7ZNz5ZW9*2rF&CBoNaJk9A`!}+u)?d>9CknNKjzIF;&&jeg4Mq z{l>HK=l4KAWxZ>$G^)b!~SKcseHIZ6VQZ-%zRhr$B>t zuer7vZWPC@peO8saQuisx=X?y;JN?%I7L^1sd;c|DP`=_-}$j{MWbm$HSk!|DWK$ewyG<{4N=hwTM9s z`!7ie{u`kH|K7XX|4E7ew-KWFn-H&a`HzEtv6!s?8zG9n?Rf7_{|gEJ8zG9n>sxE> zBl7ouf{-JlG{G z?IXJVm&Ib9+JEFJ>lxCN68uB_=`LVBeMHA!DzNxpx$*8~J>z1O;GgqMXWjn45DkA` bPR{>ID4~QBS}*-400960ghH3m08DuRT5r$B literal 0 HcmV?d00001 diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4ExtendedAttributes.swift b/Tests/ContainerizationEXT4Tests/TestEXT4ExtendedAttributes.swift new file mode 100644 index 0000000..d62c5eb --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4ExtendedAttributes.swift @@ -0,0 +1,114 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint:disable force_try + +import Foundation +import Testing + +@testable import ContainerizationEXT4 + +struct TestEXT4ExtendedAttribute { + @Test func compressName() { + struct TestCase { + let input: String + let expectedId: UInt8 + let expectedStr: String + init(_ input: String, _ expectedId: UInt8, _ expectedStr: String) { + self.input = input + self.expectedId = expectedId + self.expectedStr = expectedStr + } + } + let tests: [TestCase] = [ + .init("my.test.xattr", 0, "my.test.xattr"), + .init("user.fubar", 1, "fubar"), + .init("system.posix_acl_access.denied_su", 2, ".denied_su"), + .init("system.posix_acl_default_failed", 3, "_failed"), + .init("trusted.user", 4, "user"), + .init("trusted_user", 0, "trusted_user"), + .init("security.auth", 6, "auth"), + .init("system.admin", 7, "admin"), + .init("system.richacl.denied", 8, ".denied"), + ] + for test in tests { + let ret = EXT4.ExtendedAttribute.compressName(test.input) + #expect(ret.0 == test.expectedId) + #expect(ret.1 == test.expectedStr) + } + } + + @Test func lastXattrNotDroppedAtBufferBoundary() throws { + let buffer: [UInt8] = [ + 0, // nameLength + 8, // nameIndex + 0, 0, // valueOffset + 0, 0, 0, 0, // valueInum + 0, 0, 0, 0, // valueSize + 0, 0, 0, 0, // hash + ] + let attrs = try EXT4.FileXattrsState.read(buffer: buffer, start: 0, offset: 0) + try #require(attrs.count == 1) + #expect(attrs[0].fullName == "system.richacl") + } + + @Test func xattrOutOfBoundsValueDoesNotCrash() throws { + let buffer: [UInt8] = [ + 1, // nameLength + 1, // nameIndex + 17, 0, // valueOffset + 0, 0, 0, 0, // valueInum + 4, 0, 0, 0, // valueSize + 0, 0, 0, 0, // hash + UInt8(ascii: "a"), 0, 0, 0, // name + ] + let attrs = try EXT4.FileXattrsState.read(buffer: buffer, start: 0, offset: 0) + #expect(attrs.isEmpty) + } + + @Test func encodeDecodeAttributes() { + let xattrs: [String: Data] = [ + "foo.bar": Data([1, 2, 3]), + "bar": Data([0, 0, 0]), + "system.richacl.bar": Data([99, 1, 9, 1]), + "foobar.user": Data([71, 2, 45]), + "test.xattr.cap": Data([1, 32, 3]), + "testing123": Data([12, 24, 45]), + "sys.admin": Data([16, 23, 13]), + "test.123": Data([15, 26, 54]), + "extendedattribute.test": Data([15, 26, 54, 1, 2, 4, 6, 7, 7]), + ] + let blockSize = 4096 + var state = EXT4.FileXattrsState( + inode: 1, inodeXattrCapacity: EXT4.InodeExtraSize, blockCapacity: UInt32(blockSize)) + for (s, d) in xattrs { + let attribute = EXT4.ExtendedAttribute(name: s, value: [UInt8](d)) + try! state.add(attribute) + } + var inlineAttrBuffer: [UInt8] = .init(repeating: 0, count: Int(EXT4.InodeExtraSize)) + var blockAttrBuffer: [UInt8] = .init(repeating: 0, count: blockSize) + try! state.writeInlineAttributes(buffer: &inlineAttrBuffer) + try! state.writeBlockAttributes(buffer: &blockAttrBuffer) + let gotInlineXattrs = try! EXT4.EXT4Reader.readInlineExtendedAttributes(from: inlineAttrBuffer) + let gotBlockXattrs = try! EXT4.EXT4Reader.readBlockExtendedAttributes(from: blockAttrBuffer) + + var gotXattrs: [String: Data] = [:] + for attr in gotBlockXattrs + gotInlineXattrs { + gotXattrs[attr.fullName] = Data(attr.value) + } + #expect(gotXattrs == xattrs) + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Format+Create.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Create.swift new file mode 100644 index 0000000..ef81b63 --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Create.swift @@ -0,0 +1,80 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationEXT4 + +struct Ext4FormatCreateTests { + @Test func fileReplace() throws { + let fsPath = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: fsPath.url) } + + let formatter = try EXT4.Formatter(fsPath, minDiskSize: 32.kib()) + defer { try? formatter.close() } + try formatter.create(path: FilePath("/file"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) // create a regular file + #expect(throws: Never.self) { + try formatter.create(path: FilePath("/file"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) + } // overwrite it with a regular file + #expect(throws: Error.self) { try formatter.create(path: FilePath("/file"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) } // overwrite it with a directory + } + + @Test func dirReplace() throws { + let fsPath = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: fsPath.url) } + + let formatter = try EXT4.Formatter(fsPath, minDiskSize: 32.kib()) + defer { try? formatter.close() } + try formatter.create(path: FilePath("/dir"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) // create a directory + #expect(throws: Never.self) { + try formatter.create(path: FilePath("/dir"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) + } // overwrite it with a directory + #expect(throws: Error.self) { try formatter.create(path: FilePath("/dir"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755)) } // overwrite it with a file + } + + @Test func fileParentFails() throws { + let fsPath = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: fsPath.url) } + + let formatter = try EXT4.Formatter(fsPath, minDiskSize: 32.kib()) + defer { try? formatter.close() } + try formatter.create(path: FilePath("/file"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) // create a regular file + #expect(throws: Error.self) { try formatter.create(path: FilePath("/file/dir"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) } // create a subdir in a file? + } + + @Test func createParentAutomatically() throws { + let fsPath = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: fsPath.url) } + + let formatter = try EXT4.Formatter(fsPath, minDiskSize: 32.kib()) + defer { try? formatter.close() } + #expect(throws: Never.self) { + try formatter.create(path: FilePath("/parent/file"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) + } // should create /parent automatically + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Format+Link.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Link.swift new file mode 100644 index 0000000..37c6b3a --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Link.swift @@ -0,0 +1,79 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationEXT4 + +struct Ext4FormatLinkTests { + @Test func hardlinkLinksCount() throws { + func makeFile(unlink: Bool) throws -> FilePath { + let path = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + let fmt = try EXT4.Formatter(path, minDiskSize: 32.kib()) + try fmt.create(path: "/original", mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) + try fmt.link(link: "/hardlink", target: "/original") + if unlink { + try fmt.unlink(path: "/hardlink") + } + try fmt.close() + return path + } + + let afterLink = try makeFile(unlink: false) + #expect(try EXT4.EXT4Reader(blockDevice: afterLink).stat("/original").inode.linksCount == 2) + + let afterUnlink = try makeFile(unlink: true) + #expect(try EXT4.EXT4Reader(blockDevice: afterUnlink).stat("/original").inode.linksCount == 1) + } + + @Test func hardlinkCreatesMissingParents() throws { + let path = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: path.url) } + let fmt = try EXT4.Formatter(path, minDiskSize: 32.kib()) + try fmt.create(path: "/original", mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) + // Parent dirs /a and /a/b do not exist yet; link must create them implicitly. + try fmt.link(link: "/a/b/hardlink", target: "/original") + try fmt.close() + + let reader = try EXT4.EXT4Reader(blockDevice: path) + #expect(try reader.stat("/a").inode.mode.isDir()) + #expect(try reader.stat("/a/b").inode.mode.isDir()) + let target = try reader.stat("/original") + #expect(try reader.stat("/a/b/hardlink").inodeNumber == target.inodeNumber) + #expect(target.inode.linksCount == 2) + } + + @Test func unlinkFirstInodeFreesInode() throws { + let emptyPath = FilePath(FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: emptyPath.url) } + try EXT4.Formatter(emptyPath, minDiskSize: 32.kib()).close() + + let path = FilePath(FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: false)) + defer { try? FileManager.default.removeItem(at: path.url) } + let fmt = try EXT4.Formatter(path, minDiskSize: 32.kib()) + try fmt.create(path: FilePath("/file"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), buf: nil) + try fmt.unlink(path: FilePath("/file")) + try fmt.close() + + #expect(try EXT4.EXT4Reader(blockDevice: path).superBlock.freeInodesCount == EXT4.EXT4Reader(blockDevice: emptyPath).superBlock.freeInodesCount) + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Format+Unlink.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Unlink.swift new file mode 100644 index 0000000..8c220a6 --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Format+Unlink.swift @@ -0,0 +1,232 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationArchive +import ContainerizationEXT4 +import Foundation +import SystemPackage +import Testing + +struct EXT4WhiteoutTests { + + private func makeTempFileURL(prefix: String) throws -> URL { + let base = FileManager.default.temporaryDirectory + let url = base.appendingPathComponent("\(prefix)-\(UUID().uuidString)") + return url + } + + private func writeLayerWithOpaqueWhiteout(to url: URL) throws { + let writer = try ArchiveWriter( + format: .pax, + filter: .gzip, + file: url + ) + + let ts = Date() + + let entry = WriteEntry() + entry.modificationDate = ts + entry.creationDate = ts + entry.owner = 0 + entry.group = 0 + + entry.fileType = .directory + entry.permissions = 0o755 + + entry.path = "usr" + try writer.writeEntry(entry: entry, data: nil) + + entry.path = "usr/local" + try writer.writeEntry(entry: entry, data: nil) + + entry.path = "usr/local/bin" + try writer.writeEntry(entry: entry, data: nil) + + entry.fileType = .regular + entry.permissions = 0o644 + + let fooData = Data("hello\n".utf8) + entry.path = "usr/local/bin/foo" + entry.size = Int64(fooData.count) + try writer.writeEntry(entry: entry, data: fooData) + + entry.fileType = .regular + entry.permissions = 0o000 + entry.size = 0 + entry.path = "usr//.wh..wh..opq" + try writer.writeEntry(entry: entry, data: nil) + + try writer.finishEncoding() + } + + private func withFormatter( + prefix: String = "ext4-whiteout", + blockSize: UInt32 = 4096, + minDiskSize: UInt64 = 16.mib(), + _ body: (EXT4.Formatter, FilePath) async throws -> T + ) async throws -> T { + let imageURL = try makeTempFileURL(prefix: prefix) + let imagePath = FilePath(imageURL.path) + + defer { + try? FileManager.default.removeItem(at: imageURL) + } + + let formatter = try EXT4.Formatter( + imagePath, + blockSize: blockSize, + minDiskSize: minDiskSize + ) + + let result = try await body(formatter, imagePath) + return result + } + + @Test + func unpack_with_opaque_whiteout_path_does_not_stack_overflow_and_cleans_directory() async throws { + let layerURL = try makeTempFileURL(prefix: "ext4-wh-layer") + defer { + try? FileManager.default.removeItem(at: layerURL) + } + + try writeLayerWithOpaqueWhiteout(to: layerURL) + + try await withFormatter { formatter, imagePath in + try await formatter.unpack( + source: FilePath(layerURL.path).url, + format: .pax, + compression: .gzip, + progress: nil + ) + + try formatter.close() + + let reader = try EXT4.EXT4Reader(blockDevice: FilePath(imagePath.description)) + + #expect(reader.exists(FilePath("/usr/local/bin")) == false) + + #expect(reader.exists(FilePath("/usr/local/bin/foo")) == false) + } + } + + @Test + func directoryWhiteout_from_wh_opq_path_with_repeated_slashes_terminates() async throws { + try await withFormatter { formatter, _ in + try formatter.create( + path: FilePath("/usr"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/usr/local"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/usr/local/bin"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/usr/local/bin/foo"), + mode: EXT4.Inode.Mode(.S_IFREG, 0o644) + ) + try formatter.create( + path: FilePath("/usr/local/bin/bar"), + mode: EXT4.Inode.Mode(.S_IFREG, 0o644) + ) + + let whiteoutEntry = FilePath("//usr//.wh..wh..opq") + let directoryToWhiteout = whiteoutEntry.dir + let normalized = directoryToWhiteout.lexicallyNormalized() + #expect(normalized == FilePath("/usr")) + try formatter.unlink(path: directoryToWhiteout, directoryWhiteout: true) + } + } + + /// Test the exact recursion attack sequence: + /// create /_d + /// create symlink / -> /_ + /// create /_ + /// create symlink / -> /_ + /// + /// This creates a recursive symlink structure that can cause infinite recursion + /// during directory traversal operations. + @Test + func recursion_attack_sequence_does_not_cause_infinite_recursion() async throws { + await #expect(throws: EXT4.Formatter.Error.unsupportedFiletype) { + try await withFormatter { formatter, _ in + // Step 1: create /_d + try formatter.create( + path: FilePath("/_d"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + + // Step 2: create symlink / -> /_ + try formatter.create( + path: FilePath("/"), + link: FilePath("/_"), + mode: EXT4.Inode.Mode(.S_IFLNK, 0o777) + ) + + try formatter.create( + path: FilePath("/_"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + + try formatter.create( + path: FilePath("/"), + link: FilePath("/_"), + mode: EXT4.Inode.Mode(.S_IFLNK, 0o777) + ) + } + } + } + + @Test + func file_whiteouts_and_directory_whiteouts_interact_correctly() async throws { + try await withFormatter { formatter, imagePath in + // Lower‑layer content + try formatter.create( + path: FilePath("/opt"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/opt/app"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/opt/app/cache"), + mode: EXT4.Inode.Mode(.S_IFDIR, 0o755) + ) + try formatter.create( + path: FilePath("/opt/app/cache/file"), + mode: EXT4.Inode.Mode(.S_IFREG, 0o644) + ) + try formatter.unlink(path: FilePath("/opt/app/cache/file")) + try formatter.unlink( + path: FilePath("/opt/app/cache"), + directoryWhiteout: true + ) + try formatter.close() + + let reader = try EXT4.EXT4Reader(blockDevice: FilePath(imagePath.description)) + #expect(reader.exists(FilePath("/opt"))) + #expect(reader.exists(FilePath("/opt/app"))) + #expect(reader.exists(FilePath("/opt/app/cache"))) + #expect(reader.exists(FilePath("/opt/app/cache/file")) == false) + } + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Format.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Format.swift new file mode 100644 index 0000000..f0505ce --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Format.swift @@ -0,0 +1,262 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint: disable force_try shorthand_operator static_over_final_class + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationEXT4 + +struct Ext4FormatTests: ~Copyable { + let fsPath = FilePath( + FileManager.default.uniqueTemporaryDirectory() + .appendingPathComponent("ext4.img.delme.format", isDirectory: false)) + + // This test creates a file named "ext4.img.delme" + // Since there are no tools yet in osx/swift to test the created filesystem, + // the tests below perform the same checks as the following manual commands + // + // From project root + // $> backpack run -it -v SwiftExt4/Tests/SwiftExt4Tests/:/test -w test ubuntu:latest + // $> ls -lrth ext4.img.delme # should be only 44K + // $> e2fsck ext4.img.delme # should return 0 + // $> dumpe2fs ext4.img.delme # should print info and return 0 + // $> debugfs ext4.img.delme # should open the fs + // debugfs 1.46.5 (30-Dec-2021) + // debugfs: ls + // 2 (12) . 2 (12) .. 15 (12) x 11 (20) lost+found 12 (12) ase + // 16 (12) y 0 (4016) + // + // # check directory + // + // debugfs: stat /test + // Inode: 12 Type: directory Mode: 01274 Flags: 0xc0000 + // Generation: 0 Version: 0x00000000:00000000 + // User: 0 Group: 0 Size: 4096 + // File ACL: 0 + // Links: 3 Blockcount: 1 + // Fragment: Address: 0 Number: 0 Size: 0 + // ctime: 0x6614b59f:8cdf6a34 -- Tue Apr 9 03:27:27 2024 + // atime: 0x6614b59f:8cdf6a34 -- Tue Apr 9 03:27:27 2024 + // mtime: 0x6614b59f:8cdf6a34 -- Tue Apr 9 03:27:27 2024 + // crtime: 0x6614b59f:8cdf6a34 -- Tue Apr 9 03:27:27 2024 + // Size of extra inode fields: 24 + // EXTENTS: + // (0):5 + // + // # check regular file + // + // debugfs: stat /test/foo/bar/x + // Inode: 15 Type: regular Mode: 01363 Flags: 0xc0000 + // Generation: 0 Version: 0x00000000:00000000 + // User: 0 Group: 0 Size: 4 + // File ACL: 0 + // Links: 2 Blockcount: 1 + // Fragment: Address: 0 Number: 0 Size: 0 + // ctime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // atime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // mtime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // crtime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // Size of extra inode fields: 24 + // EXTENTS: + // (0):2 + // + // # check symlink + // + // debugfs: stat /y + // Inode: 16 Type: symlink Mode: 01675 Flags: 0x0 + // Generation: 0 Version: 0x00000000:00000000 + // User: 0 Group: 0 Size: 19 + // File ACL: 0 + // Links: 1 Blockcount: 0 + // Fragment: Address: 0 Number: 0 Size: 0 + // ctime: 0x6614b59f:8cf052fc -- Tue Apr 9 03:27:27 2024 + // atime: 0x6614b59f:8cf052fc -- Tue Apr 9 03:27:27 2024 + // mtime: 0x6614b59f:8cf052fc -- Tue Apr 9 03:27:27 2024 + // crtime: 0x6614b59f:8cf052fc -- Tue Apr 9 03:27:27 2024 + // Size of extra inode fields: 24 + // Fast link dest: "test/foo" + // + // # check hard link + // + // debugfs: stat x + // Inode: 15 Type: regular Mode: 01363 Flags: 0xc0000 + // Generation: 0 Version: 0x00000000:00000000 + // User: 0 Group: 0 Size: 4 + // File ACL: 0 + // Links: 2 Blockcount: 1 + // Fragment: Address: 0 Number: 0 Size: 0 + // ctime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // atime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // mtime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // crtime: 0x6614b59f:8ce91ef8 -- Tue Apr 9 03:27:27 2024 + // Size of extra inode fields: 24 + // EXTENTS: + // (0):2 + // + // Mount and check + // + // $> mkdir -p mntpnt + // $> mount -t ext4 ext4.img.delme mntpnt + // $> # explore file tree + init() throws { + let formatter = try EXT4.Formatter(fsPath, minDiskSize: 32.kib()) + try formatter.create(path: FilePath("/test"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) + try formatter.create(path: FilePath("/test/foo"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) + try formatter.create(path: FilePath("/test/foo/bar"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o700)) + let inputStream = InputStream(data: "test".data(using: .utf8)!) + inputStream.open() + try formatter.create( + path: FilePath("/test/foo/bar/x"), mode: EXT4.Inode.Mode(.S_IFREG, 0o755), + buf: inputStream) // create a regular file + inputStream.close() + try formatter.link(link: FilePath("/x"), target: FilePath("/test/foo/bar/x")) + try formatter.create( + path: FilePath("/y"), link: FilePath("test/foo"), mode: EXT4.Inode.Mode(.S_IFLNK, 0o700)) // create a symlink + + try formatter.close() + } + + deinit { + try? FileManager.default.removeItem(at: fsPath.url) + } + + /// This test checks that the size of the FS at fsPath is the minimum possible + /// for its data + metadata. It should be 44 kib or 11 blocks, expanded to accommodate + /// data requiring > 32KiB of space + @Test func fileSize() throws { + let f = try FileHandle(forReadingFrom: fsPath.url) + let size = try f.seekToEnd() + #expect(size == 128.mib()) + } + + /// This test checks that the superblock was created correctly + @Test func superblock() throws { + let f = try EXT4.EXT4Reader(blockDevice: fsPath) + #expect(f.superBlock.blocksCountLow == 32768) + #expect(f.superBlock.freeBlocksCountLow == 32246) // total - 512 inode blocks + } + + /// This test checks that the group descriptor has been set correctly + @Test func groupDescriptors() throws { + let f = try EXT4.EXT4Reader(blockDevice: fsPath) + let gd = try f.getGroupDescriptor(0) + #expect(gd.blockBitmapLow == 551) // move over by 512 blocks (for inodes) + #expect(gd.inodeBitmapLow == 552) // move over by 512 blocks (for inodes) + #expect(gd.inodeTableLow == 39) + #expect(gd.freeBlocksCountLow == 32246) // 512 block used by larger inode table per block group + #expect(gd.freeInodesCountLow == 8176) // 512 times the inodes + #expect(gd.usedDirsCountLow == 5) + } + + /// This test checks that the block bitmap has been set correctly + @Test func blockBitmap() throws { + let ext4 = try EXT4.EXT4Reader(blockDevice: fsPath) + let gd = try ext4.getGroupDescriptor(1) + let blockBitmapOffset = gd.blockBitmapLow + let f = try #require(FileHandle(forReadingFrom: fsPath)) + try f.seek(toOffset: ext4.blockSize * blockBitmapOffset) + let bitmapSize = ext4.superBlock.blocksPerGroup / 8 + #expect(bitmapSize == 4096) + let _ = try f.read( + upToCount: Int(ext4.superBlock.blocksCountLow - ext4.superBlock.freeBlocksCountLow - 1) / 8 + 1) + } + + /// This test checks that the inode bitmap has been set correctly + @Test func inodeBitmap() throws { + let ext4 = try EXT4.EXT4Reader(blockDevice: fsPath) + let gd = try ext4.getGroupDescriptor(1) + let inodeBitmapOffset = gd.inodeBitmapLow + let f = try #require(FileHandle(forReadingFrom: fsPath)) + try f.seek(toOffset: ext4.blockSize * inodeBitmapOffset) + let bitmapSize = ext4.superBlock.inodesPerGroup / 8 + #expect(bitmapSize == 1024) + } + + /// This test checks that the inode table has been set correctly + @Test func inodeTable() throws { + let ext4 = try EXT4.EXT4Reader(blockDevice: fsPath) + let gd = try ext4.getGroupDescriptor(0) + let inodeTableOffset = gd.inodeTableLow + let f = try #require(FileHandle(forReadingFrom: fsPath)) + try f.seek(toOffset: ext4.blockSize * inodeTableOffset) + let inodeTableSize = ext4.superBlock.inodesPerGroup * UInt32(ext4.superBlock.inodeSize) + #expect(inodeTableSize == 2_097_152) + let inodeTableData = try #require(try f.read(upToCount: Int(inodeTableSize))) + let inodeAt: (Int) -> EXT4.Inode = { inodeNum in + var inodeBytes: [UInt8] = .init(repeating: 0, count: Int(ext4.superBlock.inodeSize)) + let inodeStart = Int(ext4.superBlock.inodeSize) * (inodeNum - 1) + var j: Int = 0 + for i in inodeStart.. minDiskSize` +/// (the journal grows the image rather than carving into the usable capacity) +/// - **Feature flag**: `featureCompat` has `hasJournal` set +/// - **Journal inode**: `journalInum == EXT4.JournalInode` (inode 8) +/// - **Mount options**: `defaultMountOpts` matches the requested mode +@Suite(.serialized) +struct JournalFormatTests { + let minDiskSize: UInt64 = 128.mib() + + // MARK: - Per-mode tests + + @Test func writeback() throws { + let path = tmpPath("ext4-journal-writeback") + defer { cleanup(path) } + let formatter = try EXT4.Formatter(path, minDiskSize: minDiskSize, journal: .init(defaultMode: .writeback)) + try writeHello(formatter, content: "writeback") + try formatter.close() + // Writeback mode: only journal metadata is committed to disk before the data. + // defaultMountOpts encodes this as 0x0060 (data=writeback | barrier). + try verifyStructure(at: path, expectedMountOpts: EXT4.DefaultMountOpts.journalWriteback) + } + + @Test func ordered() throws { + let path = tmpPath("ext4-journal-ordered") + defer { cleanup(path) } + let formatter = try EXT4.Formatter(path, minDiskSize: minDiskSize, journal: .init(defaultMode: .ordered)) + try writeHello(formatter, content: "ordered") + try formatter.close() + // Ordered mode (the Linux default): data blocks are written before the journal commit. + // defaultMountOpts encodes this as 0x0040 (data=ordered | barrier). + try verifyStructure(at: path, expectedMountOpts: EXT4.DefaultMountOpts.journalOrdered) + } + + @Test func journalData() throws { + let path = tmpPath("ext4-journal-data") + defer { cleanup(path) } + let formatter = try EXT4.Formatter(path, minDiskSize: minDiskSize, journal: .init(defaultMode: .journal)) + try writeHello(formatter, content: "journal") + try formatter.close() + // Data journaling mode: data and metadata are both journaled. + // defaultMountOpts encodes this as 0x0020 (data=journal | barrier). + try verifyStructure(at: path, expectedMountOpts: EXT4.DefaultMountOpts.journalData) + } + + // MARK: - Shared structural helper + + private func verifyStructure(at path: FilePath, expectedMountOpts: UInt32) throws { + let fileSize = try fileByteCount(at: path) + let reader = try EXT4.EXT4Reader(blockDevice: path) + let sb = reader.superBlock + + let blocksCount = UInt64(sb.blocksCountLow) | (UInt64(sb.blocksCountHigh) << 32) + let blockSize = UInt64(sb.blockSize) + + // The Linux kernel rejects mounts where the superblock's block count implies + // a larger device than the actual file backing the filesystem. + #expect(fileSize == blocksCount * blockSize, "geometry mismatch: fileSize=\(fileSize), blocksCount=\(blocksCount), blockSize=\(blockSize)") + + // The journal is additive overhead; the image must be larger than minDiskSize. + #expect(fileSize > minDiskSize, "journal did not grow the image: fileSize=\(fileSize), minDiskSize=\(minDiskSize)") + + // The COMPAT_HAS_JOURNAL flag must be set for the kernel to look for inode 8. + #expect(sb.featureCompat & EXT4.CompatFeature.hasJournal.rawValue != 0, "COMPAT_HAS_JOURNAL not set in featureCompat (0x\(String(sb.featureCompat, radix: 16)))") + + // The journal inode number recorded in the superblock must point at inode 8. + #expect(sb.journalInum == EXT4.JournalInode, "journalInum=\(sb.journalInum), expected \(EXT4.JournalInode)") + + // The default mount options must reflect the requested journaling mode. + #expect(sb.defaultMountOpts == expectedMountOpts, "defaultMountOpts=0x\(String(sb.defaultMountOpts, radix: 16)), expected 0x\(String(expectedMountOpts, radix: 16))") + } + + // MARK: - Filesystem population helpers + + private func writeHello(_ formatter: EXT4.Formatter, content: String) throws { + try formatter.create(path: FilePath("/data"), mode: EXT4.Inode.Mode(.S_IFDIR, 0o755)) + let stream = InputStream(data: Data(content.utf8)) + stream.open() + defer { stream.close() } + try formatter.create( + path: FilePath("/data/hello.txt"), + mode: EXT4.Inode.Mode(.S_IFREG, 0o644), + buf: stream) + } + + // MARK: - File helpers + + private func tmpPath(_ name: String) -> FilePath { + FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent("\(name)-\(UUID().uuidString).img", isDirectory: false) + .path + ) + } + + private func cleanup(_ path: FilePath) { + try? FileManager.default.removeItem(atPath: path.string) + } + + private func fileByteCount(at path: FilePath) throws -> UInt64 { + let attrs = try FileManager.default.attributesOfItem(atPath: path.string) + guard let size = attrs[.size] as? UInt64 else { + throw CocoaError(.fileReadUnknown) + } + return size + } +} + +/// Tests that the UInt32 block-count overflow guards fire at the right points. +struct JournalOverflowTests { + // (UInt32.max + 1) blocks at the minimum block size triggers the guard in init() + // before any file is created, so no cleanup is needed. + @Test func initRejectsBlockCountOverflowingUInt32() { + let path = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false).path) + #expect(throws: EXT4.Formatter.Error.self) { + try EXT4.Formatter(path, blockSize: 1024, minDiskSize: (UInt64(UInt32.max) + 1) * 1024) + } + } + + // minDiskSize is exactly at the UInt32 block count limit; adding any journal pushes + // newSize / blockSize above UInt32.max. The guard in close() fires before the bitmap + // loop, so this test completes quickly despite the large sparse file. + @Test func closeRejectsJournalExpansionOverflowingUInt32() throws { + let path = FilePath( + FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString, isDirectory: false).path) + defer { try? FileManager.default.removeItem(atPath: path.string) } + let formatter = try EXT4.Formatter( + path, blockSize: 1024, minDiskSize: UInt64(UInt32.max) * 1024, + journal: .init(defaultMode: .writeback)) + #expect(throws: EXT4.Formatter.Error.self) { + try formatter.close() + } + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Reader+IO.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Reader+IO.swift new file mode 100644 index 0000000..40d241d --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Reader+IO.swift @@ -0,0 +1,652 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationEXT4 + +@Suite +struct EXT4PathIOTests { + + // MARK: - Helpers + + private func makeTempImageURL(name: String = UUID().uuidString) -> URL { + FileManager.default.temporaryDirectory.appendingPathComponent("ext4-\(name).img") + } + + /// Build a fresh ext4 image, populate content, close, and return its URL. + /// Usage: + /// let url = try buildFS { fmt in + /// try createFile(fmt, "/etc/hostname", "myhost\n") + /// try createSymlink(fmt, "/bin/sh", "/usr/bin/busybox") // fast link + /// } + private func buildFS( + minDiskSize: UInt64 = 4 * 1024 * 1024, // 4 MiB is enough for these tests + populate: (EXT4.Formatter) throws -> Void + ) throws -> URL { + let url = makeTempImageURL() + let path = FilePath(url.path) + + // 1) Format image + let formatter = try EXT4.Formatter(path, minDiskSize: minDiskSize) + + // 2) Populate contents + try populate(formatter) + + // 3) Finalize filesystem + try formatter.close() + return url + } + + /// Convenience to create a directory (recursively). + private func createDir(_ fmt: EXT4.Formatter, _ path: String, mode: UInt16 = EXT4.Inode.Mode(.S_IFDIR, 0o755)) throws { + try fmt.create(path: FilePath(path), mode: mode) + } + + /// Convenience to create a regular file with UTF-8 content. + private func createFile(_ fmt: EXT4.Formatter, _ path: String, _ contents: String, mode: UInt16 = EXT4.Inode.Mode(.S_IFREG, 0o644)) throws { + let data = Data(contents.utf8) + let stream = InputStream(data: data) + stream.open() + defer { stream.close() } + try fmt.create(path: FilePath(path), mode: mode, buf: stream) + } + + /// Convenience to create a (fast or long) symlink. Pass absolute target. + private func createSymlink(_ fmt: EXT4.Formatter, _ linkPath: String, _ target: String, mode: UInt16 = EXT4.Inode.Mode(.S_IFLNK, 0o777)) throws { + try fmt.create(path: FilePath(linkPath), link: FilePath(target), mode: mode) + } + + /// Open reader for a given image URL. + private func openReader(_ url: URL) throws -> EXT4.EXT4Reader { + try EXT4.EXT4Reader(blockDevice: FilePath(url.path)) + } + + // MARK: - Tests + + @Test + func existsAndStatRootAndLostFound() throws { + let url = try buildFS { _ in /* nothing extra */ } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + #expect(r.exists(FilePath("/"))) + let (inoNum, ino) = try r.stat(FilePath("/")) + #expect(inoNum == 2) + #expect(ino.mode.isDir()) + + // lost+found is created by the formatter + let names = try r.listDirectory(FilePath("/")) + #expect(names.contains("lost+found")) + } + + @Test + func createAndReadRegularFilesWithOffsetsAndEOF() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/etc") + try self.createFile(fmt, "/etc/hostname", "myhost\n") + try self.createDir(fmt, "/usr/bin") + try self.createFile(fmt, "/usr/bin/hello", "Hello EXT4!\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // exists/stat + #expect(r.exists(FilePath("/etc/hostname"))) + let (_, ino) = try r.stat(FilePath("/usr/bin/hello")) + #expect(ino.mode.isReg()) + + // listDirectory excludes "." and ".." and is sorted + let usrChildren = try r.listDirectory(FilePath("/usr")) + #expect(usrChildren == ["bin"]) + + // full read to EOF + let hello = try r.readFile(at: FilePath("/usr/bin/hello")) + #expect(String(decoding: hello, as: UTF8.self) == "Hello EXT4!\n") + + // offset + count semantics + let data = try r.readFile(at: FilePath("/usr/bin/hello"), offset: 6, count: 5) + #expect(String(decoding: data, as: UTF8.self) == "EXT4!") + + // offset == size => empty; offset > size => empty + let hostname = try r.readFile(at: FilePath("/etc/hostname")) + let size = hostname.count + #expect(try r.readFile(at: FilePath("/etc/hostname"), offset: UInt64(size)).count == 0) + #expect(try r.readFile(at: FilePath("/etc/hostname"), offset: UInt64(size + 100)).count == 0) + } + + @Test + func readFileIntoBufferMatchesData() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/etc") + try self.createFile(fmt, "/etc/hostname", "myhost\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let reader = try openReader(url) + let path = FilePath("/etc/hostname") + + let data = try reader.readFile(at: path, offset: 0, count: 4096) + var buffer = [UInt8](repeating: 0, count: data.count) + + let wrote = try buffer.withUnsafeMutableBytes { ptr in + try reader.readFile(at: path, into: ptr, offset: 0) + } + + #expect(wrote == data.count) + if wrote < buffer.count { + buffer.removeSubrange(wrote.. /usr/bin/busybox + let url = try buildFS { fmt in + try self.createDir(fmt, "/usr/bin") + try self.createFile(fmt, "/usr/bin/busybox", "BB\n") + try self.createDir(fmt, "/bin") + try self.createSymlink(fmt, "/bin/sh", "/usr/bin/busybox") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Reading through the link should hit the target bytes. + let sh = try r.readFile(at: FilePath("/bin/sh")) + #expect(String(decoding: sh, as: UTF8.self) == "BB\n") + + // stat(followSymlinks: false) should show symlink inode + let (_, lnkIno) = try r.stat(FilePath("/bin/sh"), followSymlinks: false) + #expect(lnkIno.mode.isLink()) + + // stat(default) follows + let (_, tgtIno) = try r.stat(FilePath("/bin/sh")) + #expect(tgtIno.mode.isReg()) + } + + @Test + func longSymlinkResolutionAndRead() throws { + // Long symlink: target > 60 bytes triggers extent-backed storage (Formatter behavior). + // Build a very long absolute path to exceed 60 chars. + let deepDir = "/a/very/long/path/that/exceeds/sixty/bytes/for/symlink/target" + #expect(deepDir.utf8.count > 60) + + let url = try buildFS { fmt in + // Create deep directory structure and file + try self.createDir(fmt, deepDir) + try self.createFile(fmt, "\(deepDir)/payload.txt", "LONGLINK\n") + // Link at a short path -> long absolute target + try self.createSymlink(fmt, "/ll", "\(deepDir)/payload.txt") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + let bytes = try r.readFile(at: FilePath("/ll")) + #expect(String(decoding: bytes, as: UTF8.self) == "LONGLINK\n") + } + + @Test + func symlinkLoopDetection() throws { + let url = try buildFS { fmt in + // /a -> /b and /b -> /a + try self.createSymlink(fmt, "/a", "/b") + try self.createSymlink(fmt, "/b", "/a") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + do { + _ = try r.stat(FilePath("/a")) + Issue.record("Expected symlinkLoop error") + } catch let error as EXT4.PathIOError { + guard case .symlinkLoop = error else { + Issue.record("Expected symlinkLoop, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + } + + @Test + func complexSymlinkLoopDetection() throws { + let url = try buildFS { fmt in + // Create a longer chain that eventually loops: /a -> /b -> /c -> /d -> /b + try self.createSymlink(fmt, "/a", "/b") + try self.createSymlink(fmt, "/b", "/c") + try self.createSymlink(fmt, "/c", "/d") + try self.createSymlink(fmt, "/d", "/b") // Loop back to /b + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + do { + _ = try r.stat(FilePath("/a")) + Issue.record("Expected symlinkLoop error") + } catch let error as EXT4.PathIOError { + guard case .symlinkLoop = error else { + Issue.record("Expected symlinkLoop for complex loop, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + } + + @Test + func selfReferencingSymlink() throws { + let url = try buildFS { fmt in + // Self-referencing symlink: /self -> /self + try self.createSymlink(fmt, "/self", "/self") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + do { + _ = try r.stat(FilePath("/self")) + Issue.record("Expected symlinkLoop error") + } catch let error as EXT4.PathIOError { + guard case .symlinkLoop = error else { + Issue.record("Expected symlinkLoop for self-reference, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + } + + @Test + func longSymlinkChainWithoutLoop() throws { + let url = try buildFS { fmt in + // Create a long chain without loops (should succeed) + try self.createDir(fmt, "/target") + try self.createFile(fmt, "/target/file.txt", "SUCCESS\n") + + // Create chain: /link1 -> /link2 -> /link3 -> /link4 -> /target/file.txt + try self.createSymlink(fmt, "/link4", "/target/file.txt") + try self.createSymlink(fmt, "/link3", "/link4") + try self.createSymlink(fmt, "/link2", "/link3") + try self.createSymlink(fmt, "/link1", "/link2") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + // Should successfully resolve without hitting loop detection + let data = try r.readFile(at: FilePath("/link1")) + #expect(String(decoding: data, as: UTF8.self) == "SUCCESS\n") + } + + @Test + func symlinkLoopThroughDirectory() throws { + let url = try buildFS { fmt in + // Create directory structure with symlink loop through paths + try self.createDir(fmt, "/dir1") + try self.createDir(fmt, "/dir2") + try self.createSymlink(fmt, "/dir1/link", "/dir2/link") + try self.createSymlink(fmt, "/dir2/link", "/dir1/link") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + do { + _ = try r.stat(FilePath("/dir1/link")) + Issue.record("Expected symlinkLoop error") + } catch let error as EXT4.PathIOError { + guard case .symlinkLoop = error else { + Issue.record("Expected symlinkLoop for directory loop, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + } + + @Test + func pathWalkWithDotAndDotDot() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/a/b") + try self.createFile(fmt, "/a/b/c.txt", "OK\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // /a/./b/../b/c.txt should resolve to /a/b/c.txt + let p = FilePath("/a/./b/../b/c.txt") + let data = try r.readFile(at: p) + #expect(String(decoding: data, as: UTF8.self) == "OK\n") + } + + @Test + func parentDirectoryTraversal() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/a/b/c/d") + try self.createFile(fmt, "/a/file1.txt", "A\n") + try self.createFile(fmt, "/a/b/file2.txt", "B\n") + try self.createFile(fmt, "/a/b/c/file3.txt", "C\n") + try self.createFile(fmt, "/a/b/c/d/file4.txt", "D\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Test multiple levels of parent traversal + // /a/b/c/d/../../../../a/file1.txt should resolve to /a/file1.txt + let p1 = FilePath("/a/b/c/d/../../../../a/file1.txt") + let data1 = try r.readFile(at: p1) + #expect(String(decoding: data1, as: UTF8.self) == "A\n") + + // /a/b/c/../file2.txt should resolve to /a/b/file2.txt + let p2 = FilePath("/a/b/c/../file2.txt") + let data2 = try r.readFile(at: p2) + #expect(String(decoding: data2, as: UTF8.self) == "B\n") + + // /a/b/c/d/../file3.txt should resolve to /a/b/c/file3.txt + let p3 = FilePath("/a/b/c/d/../file3.txt") + let data3 = try r.readFile(at: p3) + #expect(String(decoding: data3, as: UTF8.self) == "C\n") + } + + @Test + func parentDirectoryAtRoot() throws { + let url = try buildFS { fmt in + try self.createFile(fmt, "/root.txt", "ROOT\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Test that ".." at root stays at root + // /../root.txt should resolve to /root.txt + let p1 = FilePath("/../root.txt") + let data1 = try r.readFile(at: p1) + #expect(String(decoding: data1, as: UTF8.self) == "ROOT\n") + + // /../../root.txt should also resolve to /root.txt + let p2 = FilePath("/../../root.txt") + let data2 = try r.readFile(at: p2) + #expect(String(decoding: data2, as: UTF8.self) == "ROOT\n") + } + + @Test + func complexParentWithSymlinks() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/real/path") + try self.createFile(fmt, "/real/path/target.txt", "TARGET\n") + try self.createFile(fmt, "/real/other.txt", "OTHER\n") + try self.createDir(fmt, "/links") + // Create symlink: /links/link -> /real/path + try self.createSymlink(fmt, "/links/link", "/real/path") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Test parent directory traversal through symlinks + // When we follow /links/link (which points to /real/path), we're now at /real/path + // Then ".." takes us to /real, and "other.txt" gives us /real/other.txt + let p = FilePath("/links/link/../other.txt") + let data = try r.readFile(at: p) + #expect(String(decoding: data, as: UTF8.self) == "OTHER\n") + + // Also test direct access through the symlink + let p2 = FilePath("/links/link/target.txt") + let data2 = try r.readFile(at: p2) + #expect(String(decoding: data2, as: UTF8.self) == "TARGET\n") + } + + @Test + func relativeSymlinkWithParentTraversal() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/a/b") + try self.createFile(fmt, "/a/target.txt", "REL_TARGET\n") + // Create relative symlink: /a/b/link -> ../target.txt + try self.createSymlink(fmt, "/a/b/link", "../target.txt") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // The relative symlink should properly resolve through parent + let data = try r.readFile(at: FilePath("/a/b/link")) + #expect(String(decoding: data, as: UTF8.self) == "REL_TARGET\n") + } + + @Test + func readOnSymlinkWithFollowFalseThrows() throws { + let url = try buildFS { fmt in + try self.createFile(fmt, "/tgt", "X\n") + try self.createSymlink(fmt, "/lnk", "/tgt") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + do { + _ = try r.readFile(at: FilePath("/lnk"), followSymlinks: false) + Issue.record("Expected notAFile error") + } catch let error as EXT4.PathIOError { + guard case .notAFile = error else { + Issue.record("Expected notAFile for symlink read without following, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + } + + @Test + func nonExistentPathExistsAndReadErrors() throws { + let url = try buildFS { _ in } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + #expect(!r.exists(FilePath("/nope"))) + do { + _ = try r.stat(FilePath("/nope")) + Issue.record("Expected notFound error") + } catch let error as EXT4.PathIOError { + guard case .notFound = error else { + Issue.record("Expected notFound, got \(error)") + return + } + } catch { + Issue.record("Expected EXT4.PathIOError, got \(error)") + } + #expect(throws: (any Error).self) { + try r.readFile(at: FilePath("/nope")) + } + } + + @Test + func sameAbsoluteSymlinkFollowedTwice() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/target") + try self.createFile(fmt, "/target/file.txt", "OK") + try self.createSymlink(fmt, "/symlink", "/target") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + let data = try r.readFile(at: FilePath("/symlink/../symlink/file.txt")) + #expect(String(decoding: data, as: UTF8.self) == "OK") + } + + @Test + func sameRelativeSymlinkFollowedTwice() throws { + let url = try buildFS { fmt in + try self.createDir(fmt, "/target") + try self.createFile(fmt, "/target/file.txt", "OK") + try self.createSymlink(fmt, "/symlink", "../target") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + let data = try r.readFile(at: FilePath("/symlink/../symlink/file.txt")) + #expect(String(decoding: data, as: UTF8.self) == "OK") + } + + @Test + func boundsCheckingForInvalidExtents() throws { + // This test verifies that the reader properly validates extent addresses + // Note: We can't easily create an image with invalid extents using the Formatter, + // so this test documents the expected behavior rather than testing it directly. + // The bounds checking is tested implicitly by all other tests that read files. + + let url = try buildFS { fmt in + try self.createFile(fmt, "/test.txt", "Valid file\n") + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Reading a valid file should work without bounds errors + let data = try r.readFile(at: FilePath("/test.txt")) + #expect(String(decoding: data, as: UTF8.self) == "Valid file\n") + + // The bounds checking happens internally when reading extents + // If an extent pointed outside device bounds, it would throw an error + } + + @Test + func partialReadRecovery() throws { + // Test that partial reads return successfully read data + // even if later parts fail + + let url = try buildFS(minDiskSize: 8 * 1024 * 1024) { fmt in + // Create a moderately sized file + let content = String(repeating: "A", count: 100_000) + try self.createFile(fmt, "/partial.txt", content) + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Read the full file to ensure it works + let fullData = try r.readFile(at: FilePath("/partial.txt")) + #expect(fullData.count == 100_000) + + // Read with offset and count + let partialData = try r.readFile(at: FilePath("/partial.txt"), offset: 1000, count: 5000) + #expect(partialData.count == 5000) + + // Verify content is correct + let expectedContent = String(repeating: "A", count: 5000) + #expect(String(decoding: partialData, as: UTF8.self) == expectedContent) + } + + @Test + func largeFileReadAcrossBlocks() throws { + // Keep this modest to avoid slow CI while still crossing multiple blocks. + let bigSize = 2 * 1024 * 1024 + 123 // ~2 MiB + tail + let url = try buildFS(minDiskSize: 16 * 1024 * 1024) { fmt in + try self.createDir(fmt, "/big") + // Generate deterministic content without holding huge Data in memory at once + // by assembling in chunks. + let chunk = Data("0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ\n".utf8) + var buf = Data(capacity: bigSize) + while buf.count + chunk.count <= bigSize { + buf.append(chunk) + } + if buf.count < bigSize { + buf.append(contentsOf: [UInt8](repeating: 0x5A, count: bigSize - buf.count)) // 'Z' + } + let stream = InputStream(data: buf) + stream.open() + defer { stream.close() } + try fmt.create(path: FilePath("/big/file.bin"), mode: EXT4.Inode.Mode(.S_IFREG, 0o644), buf: stream) + } + defer { try? FileManager.default.removeItem(at: url) } + + let r = try openReader(url) + + // Sample reads near the end and across likely block boundaries. + let tail = try r.readFile(at: FilePath("/big/file.bin"), offset: UInt64(bigSize - 64), count: 64) + #expect(tail.count == 64) + + let middle = try r.readFile(at: FilePath("/big/file.bin"), offset: 64, count: 128) + #expect(middle.count == 128) + + // Read to EOF without count + let all = try r.readFile(at: FilePath("/big/file.bin")) + #expect(all.count == bigSize) + } + + @Test + func fileTreeNodePathWithAbsoluteRoot() { + let tree = EXT4.FileTree(EXT4.RootInode, "/") + + let dirPtr = EXT4.Ptr(EXT4.FileTree.FileTreeNode(inode: 3, name: "dir", parent: tree.root)) + tree.root.pointee.children.append(dirPtr) + + let filePtr = EXT4.Ptr(EXT4.FileTree.FileTreeNode(inode: 4, name: "file", parent: dirPtr)) + dirPtr.pointee.children.append(filePtr) + + #expect(dirPtr.pointee.path == FilePath("/dir")) + #expect(filePtr.pointee.path == FilePath("/dir/file")) + } + + @Test + func fileTreeNodePathWithRelativeRoot() { + let tree = EXT4.FileTree(EXT4.RootInode, ".") + + let dirPtr = EXT4.Ptr(EXT4.FileTree.FileTreeNode(inode: 3, name: "dir", parent: tree.root)) + tree.root.pointee.children.append(dirPtr) + + let filePtr = EXT4.Ptr(EXT4.FileTree.FileTreeNode(inode: 4, name: "file", parent: dirPtr)) + dirPtr.pointee.children.append(filePtr) + + #expect(dirPtr.pointee.path == FilePath("dir")) + #expect(filePtr.pointee.path == FilePath("dir/file")) + } + + @Test + func fileTreeNodePathWithNamedRoot() { + let tree = EXT4.FileTree(EXT4.RootInode, "dir") + + let filePtr = EXT4.Ptr(EXT4.FileTree.FileTreeNode(inode: 3, name: "file", parent: tree.root)) + tree.root.pointee.children.append(filePtr) + + #expect(filePtr.pointee.path == FilePath("dir/file")) + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestEXT4Unpacker.swift b/Tests/ContainerizationEXT4Tests/TestEXT4Unpacker.swift new file mode 100644 index 0000000..1c22f54 --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestEXT4Unpacker.swift @@ -0,0 +1,105 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationEXT4 + +struct Ext4UnpackerTests { + // alpine image + let indexSHA: String = "ad59e9f71edceca7b1ac7c642410858489b743c97233b0a26a5e2098b1443762" + let fsPath = FilePath( + FileManager.default.uniqueTemporaryDirectory() + .appendingPathComponent("ext4.unpacked.oci.img.delme", isDirectory: false)) + + final class MockEXT4Unpacker { + static func Unpack(index: String, fsPath: FilePath) async throws { + let fs = try EXT4.Formatter(fsPath) + let bundle = Bundle.module + guard let indexPath = bundle.url(forResource: index, withExtension: nil) else { + throw NSError(domain: "indexPath not found", code: 1) + } + let indexData = try Data(contentsOf: indexPath) + guard let indexDict = try JSONSerialization.jsonObject(with: indexData, options: []) as? [String: Any] + else { + throw NSError(domain: "indexDict could not be loaded as json", code: 1) + } + guard let manifests = indexDict["manifests"] as? [[String: Any]] else { + throw NSError(domain: "manifests field in index not found", code: 1) + } + guard let digest = manifests[0]["digest"] as? String else { + throw NSError(domain: "digest field not found in index", code: 1) + } + guard + let manifestPath = bundle.url( + forResource: String(digest.dropFirst("sha256:".count)), withExtension: nil) + else { + throw NSError(domain: "manifestPath not found", code: 1) + } + let manifestData = try Data(contentsOf: manifestPath) + guard let manifestDict = try JSONSerialization.jsonObject(with: manifestData, options: []) as? [String: Any] + else { + throw NSError(domain: "manifestDict could not be loaded as json", code: 1) + } + guard let layers = manifestDict["layers"] as? [[String: Any]] else { + throw NSError(domain: "layers field in manifests not found", code: 1) + } + for layer in layers { + guard let layerDigestWithSHA = layer["digest"] as? String else { + throw NSError(domain: "digest field not found in layer", code: 1) + } + let layerDigest = String(layerDigestWithSHA.dropFirst("sha256:".count)) + guard let layerPath = bundle.url(forResource: layerDigest, withExtension: nil) else { + throw NSError(domain: "layer \(layerDigest) not found", code: 1) + } + try await fs.unpack(source: layerPath) + } + try fs.close() + } + } + + @Test func eXT4Unpacker() async throws { + try await MockEXT4Unpacker.Unpack(index: self.indexSHA, fsPath: self.fsPath) + let ext4 = try EXT4.EXT4Reader(blockDevice: self.fsPath) + let children = try ext4.children(of: EXT4.RootInode) + #expect( + Set(children.map { $0.0 }) + == Set([ + ".", + "..", + "media", + "var", + "opt", + "lost+found", + "tmp", + "mnt", + "sys", + "usr", + "srv", + "root", + "etc", + "dev", + "proc", + "run", + "home", + "bin", + "lib", + "sbin", + ])) + } +} diff --git a/Tests/ContainerizationEXT4Tests/TestFormatterUnpack.swift b/Tests/ContainerizationEXT4Tests/TestFormatterUnpack.swift new file mode 100644 index 0000000..3b8590f --- /dev/null +++ b/Tests/ContainerizationEXT4Tests/TestFormatterUnpack.swift @@ -0,0 +1,514 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint:disable force_try static_over_final_class + +#if os(macOS) +import ContainerizationArchive +import ContainerizationExtras +import Foundation +import Testing +import SystemPackage + +@testable import ContainerizationEXT4 + +struct Tar2EXT4Test: ~Copyable { + let fsPath = FilePath( + FileManager.default.uniqueTemporaryDirectory() + .appendingPathComponent("ext4.tar.img.delme", isDirectory: false)) + + let xattrs: [String: Data] = [ + "foo.bar": Data([1, 2, 3]), + "bar": Data([0, 0, 0]), + "system.richacl.bar": Data([99, 1, 9, 1]), + "foobar.user": Data([71, 2, 45]), + "test.xattr.cap": Data([1, 32, 3]), + "testing123": Data([12, 24, 45]), + "sys.admin": Data([16, 23, 13]), + "test.123": Data([15, 26, 54]), + "extendedattribute.test": Data([15, 26, 54, 1, 2, 4, 6, 7, 7]), + ] + + let layerDir: URL + let layer1Path: URL + let layer2Path: URL + + init() throws { + // Compute paths before any throwing code to satisfy ~Copyable initialization rules. + let layerDir = FileManager.default.uniqueTemporaryDirectory() + let layer1Path = layerDir.appendingPathComponent("layer1.tar.gz", isDirectory: false) + let layer2Path = layerDir.appendingPathComponent("layer2.tar.gz", isDirectory: false) + self.layerDir = layerDir + self.layer1Path = layer1Path + self.layer2Path = layer2Path + + // create layer1 + let layer1Archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try layer1Archiver.open(file: layer1Path) + // create 2 directories and fill them with files + try layer1Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir1", permissions: 0o755), data: nil) + try layer1Archiver.writeEntry(entry: WriteEntry.file(path: "/dir1/file1", permissions: 0o644), data: nil) + try layer1Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir2", permissions: 0o755), data: nil) + try layer1Archiver.writeEntry(entry: WriteEntry.file(path: "/dir2/file1", permissions: 0o644), data: nil) + try layer1Archiver.finishEncoding() + + // create layer2 + let layer2Archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try layer2Archiver.open(file: layer2Path) + // create 3 directories and fill them with files and whiteouts + try layer2Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir1", permissions: 0o755), data: nil) + try layer2Archiver.writeEntry( + entry: WriteEntry.file(path: "/dir1/.wh.file1", permissions: 0o644), data: nil) + try layer2Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir2", permissions: 0o755), data: nil) + try layer2Archiver.writeEntry( + entry: WriteEntry.file(path: "/dir2/.wh..wh..opq", permissions: 0o644), data: nil) + try layer2Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir3", permissions: 0o755), data: nil) + try layer2Archiver.writeEntry( + entry: WriteEntry.file(path: "/dir3/file1", permissions: 0o644, xattrs: xattrs), data: nil) + try layer2Archiver.writeEntry(entry: WriteEntry.dir(path: "/dir4", permissions: 0o755), data: nil) + try layer2Archiver.writeEntry( + entry: WriteEntry.file(path: "/dir4/special_ĩ", permissions: 0o644), data: nil) + try layer2Archiver.writeEntry( + entry: WriteEntry.link(path: "/dir4/specialcharacters", permissions: 0o644, target: "special_ĩ"), + data: nil) + + // a new layer overwriting over an existing layer + try layer2Archiver.writeEntry(entry: WriteEntry.file(path: "/dir2/file1", permissions: 0o644), data: nil) + try layer2Archiver.finishEncoding() + } + + private func unpackLayers() async throws { + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: layer1Path) + try await formatter.unpack(source: layer2Path) + try formatter.close() + } + + deinit { + try? FileManager.default.removeItem(at: fsPath.url) + try? FileManager.default.removeItem(at: layerDir) + } + + @Test func testUnpackBasic() async throws { + try await unpackLayers() + let ext4 = try EXT4.EXT4Reader(blockDevice: fsPath) + // just a directory + let dir1Inode = try ext4.getInode(number: 12) + #expect(dir1Inode.mode.isDir()) + // white out file /dir1/file1 + let dir1File1Inode = try ext4.getInode(number: 13) + #expect(dir1File1Inode.dtime != 0) + #expect(dir1File1Inode.linksCount == 0) // deleted + // white out dir /dir2 + let dir2Inode = try ext4.getInode(number: 14) + #expect(dir2Inode.dtime == 0) + #expect(dir2Inode.linksCount == 2) // children deleted + // new dir /dir3 + let dir3Inode = try ext4.getInode(number: 16) + #expect(dir3Inode.mode.isDir()) + #expect(dir3Inode.linksCount == 2) + // new file /dir3/file1 + let dir3File1Inode = try ext4.getInode(number: 17) + #expect(dir3File1Inode.mode.isReg()) + #expect(dir3File1Inode.linksCount == 1) + #expect(try ext4.getXattrsForInode(inode: dir3File1Inode) == xattrs) + // overwritten dir /dir2 + let dir2OverwriteInode = try ext4.getInode(number: 18) + #expect(dir2OverwriteInode.mode.isDir()) + #expect(dir2OverwriteInode.linksCount == 2) + // /dir4/special_ĩ + let dir2File1OverwriteInode = try ext4.getInode(number: 19) + #expect(dir2File1OverwriteInode.mode.isReg()) + #expect(dir2File1OverwriteInode.linksCount == 1) + + let specialFileInode = try ext4.getInode(number: 20) + let bytes = Data(Mirror(reflecting: specialFileInode.block).children.compactMap { $0.value as? UInt8 }) + let targetString = try #require(String(data: bytes, encoding: .utf8), "Could not parse special file path") + let specialFileTarget = FilePath(targetString) + #expect(specialFileTarget.description.hasPrefix("special_ĩ")) + } +} + +/// Collects progress events in a thread-safe manner. +private actor ProgressCollector { + var events: [ProgressEvent] = [] + + func append(_ newEvents: [ProgressEvent]) { + events.append(contentsOf: newEvents) + } + + func allEvents() -> [ProgressEvent] { + events + } +} + +struct UnpackProgressTest { + @Test func progressReportsAccurateSizes() async throws { + // Create an archive with files of known sizes + let tempDir = FileManager.default.uniqueTemporaryDirectory() + let archivePath = tempDir.appendingPathComponent("test.tar.gz", isDirectory: false) + let fsPath = FilePath(tempDir.appendingPathComponent("test.ext4.img", isDirectory: false)) + + defer { + try? FileManager.default.removeItem(at: tempDir) + } + + // Create test data with specific sizes + let file1Data = Data(repeating: 0xAA, count: 1024) // 1 KiB + let file2Data = Data(repeating: 0xBB, count: 4096) // 4 KiB + let file3Data = Data(repeating: 0xCC, count: 512) // 512 bytes + let expectedTotalSize: Int64 = 1024 + 4096 + 512 // 5632 bytes + + // Build the archive + let archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try archiver.open(file: archivePath) + + try archiver.writeEntry(entry: WriteEntry.dir(path: "/data", permissions: 0o755), data: nil) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/data/file1.bin", permissions: 0o644, size: Int64(file1Data.count)), + data: file1Data) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/data/file2.bin", permissions: 0o644, size: Int64(file2Data.count)), + data: file2Data) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/data/file3.bin", permissions: 0o644, size: Int64(file3Data.count)), + data: file3Data) + // Include an empty file to verify it doesn't break size calculations + try archiver.writeEntry( + entry: WriteEntry.file(path: "/data/empty.bin", permissions: 0o644, size: 0), + data: Data()) + try archiver.finishEncoding() + + // Set up progress collection + let collector = ProgressCollector() + let shouldPrintProgress = ProcessInfo.processInfo.environment["PRINT_UNPACK_PROGRESS"] == "1" + let progressHandler: ProgressHandler = { events in + if shouldPrintProgress { + for event in events { + print("unpack-progress \(event.event): \(event.value)") + } + } + await collector.append(events) + } + + // Unpack with progress tracking + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: archivePath, progress: progressHandler) + try formatter.close() + + // Analyze collected events + let allEvents = await collector.allEvents() + + var reportedTotalSize: Int64 = 0 + var reportedTotalItems: Int = 0 + var cumulativeSize: Int64 = 0 + var itemCount: Int = 0 + + for event in allEvents { + switch event { + case .addTotalSize(let value): + reportedTotalSize += value + case .addTotalItems(let value): + reportedTotalItems += value + case .addSize(let value): + cumulativeSize += value + case .addItems(let value): + itemCount += value + } + } + + // Verify the progress contract + let expectedTotalItems: Int = 5 // 1 dir + 4 files + #expect( + reportedTotalSize == expectedTotalSize, + "Total size should be \(expectedTotalSize) bytes, got \(reportedTotalSize)") + #expect( + reportedTotalItems == expectedTotalItems, + "Total items should be \(expectedTotalItems), got \(reportedTotalItems)") + #expect( + cumulativeSize == expectedTotalSize, + "Cumulative size should equal total size (\(expectedTotalSize)), got \(cumulativeSize)") + #expect( + itemCount == expectedTotalItems, + "Should have processed \(expectedTotalItems) entries (1 dir + 4 files), got \(itemCount)") + + // Verify incremental progress: we should get separate add-size events for each file + let addSizeEvents = allEvents.compactMap { event -> Int64? in + guard case .addSize(let value) = event else { return nil } + return value + } + #expect( + addSizeEvents.count == 4, + "Should have 4 add-size events (one per file, including empty), got \(addSizeEvents.count)") + + // Verify individual file sizes were reported correctly + let reportedSizes = addSizeEvents.sorted() + #expect( + reportedSizes == [0, 512, 1024, 4096], + "Individual file sizes should be [0, 512, 1024, 4096], got \(reportedSizes)") + + // Verify event-by-event behavior expected by clients: + // total remains stable and written bytes are monotonic as progress updates arrive. + var runningTotal: Int64? + var runningWritten: Int64 = 0 + var previousSnapshot: (written: Int64, total: Int64?)? + var progressSnapshotCount = 0 + + for event in allEvents { + switch event { + case .addTotalSize(let value): + runningTotal = (runningTotal ?? 0) + value + case .addSize(let value): + runningWritten += value + let currentSnapshot = (written: runningWritten, total: runningTotal) + if let previousSnapshot { + #expect( + currentSnapshot.written >= previousSnapshot.written, + "Written bytes should be monotonic: \(currentSnapshot.written) < \(previousSnapshot.written)") + #expect( + currentSnapshot.total == previousSnapshot.total, + "Total bytes should remain stable across progress updates") + } + previousSnapshot = currentSnapshot + progressSnapshotCount += 1 + default: + break + } + } + + #expect( + progressSnapshotCount == addSizeEvents.count, + "Should produce one monotonic snapshot per add-size update") + + // Verify totals come before incremental events (first pass before second pass) + let totalSizeIndex = try #require( + allEvents.firstIndex(where: { + guard case .addTotalSize = $0 else { return false } + return true + }), + "add-total-size event should be present") + let firstAddSizeIndex = try #require( + allEvents.firstIndex(where: { + guard case .addSize = $0 else { return false } + return true + }), + "add-size event should be present") + #expect( + totalSizeIndex < firstAddSizeIndex, + "add-total-size should be reported before add-size events") + + let totalItemsIndex = try #require( + allEvents.firstIndex(where: { + guard case .addTotalItems = $0 else { return false } + return true + }), + "add-total-items event should be present") + let firstAddItemsIndex = try #require( + allEvents.firstIndex(where: { + guard case .addItems = $0 else { return false } + return true + }), + "add-items event should be present") + #expect( + totalItemsIndex < firstAddItemsIndex, + "add-total-items should be reported before add-items events") + } + + @Test func progressHandlerIsOptional() async throws { + // Verify that unpacking works without a progress handler (existing behavior) + let tempDir = FileManager.default.uniqueTemporaryDirectory() + let archivePath = tempDir.appendingPathComponent("test.tar.gz", isDirectory: false) + let fsPath = FilePath(tempDir.appendingPathComponent("test.ext4.img", isDirectory: false)) + + defer { + try? FileManager.default.removeItem(at: tempDir) + } + + let archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try archiver.open(file: archivePath) + try archiver.writeEntry(entry: WriteEntry.dir(path: "/test", permissions: 0o755), data: nil) + let data = Data(repeating: 0x42, count: 100) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/test/file.bin", permissions: 0o644, size: Int64(data.count)), + data: data) + try archiver.finishEncoding() + + // Unpack without progress handler - should not throw + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: archivePath) + try formatter.close() + + // Verify the file was unpacked correctly + let reader = try EXT4.EXT4Reader(blockDevice: fsPath) + let children = try reader.children(of: EXT4.RootInode) + let childNames = Set(children.map { $0.0 }) + #expect(childNames.contains("test"), "Directory 'test' should exist in unpacked filesystem") + } + + @Test func unpackCreatesImplicitParentsForHardlink() async throws { + // A hardlink whose parent dir has no explicit archive entry must unpack: the + // missing parents are created implicitly instead of failing with "... not found". + // This is the exact repro shape (e.g. Bazel rules_img runfiles trees). + let tempDir = FileManager.default.uniqueTemporaryDirectory() + let archivePath = tempDir.appendingPathComponent("hardlink.tar.gz", isDirectory: false) + let fsPath = FilePath(tempDir.appendingPathComponent("hardlink.ext4.img", isDirectory: false)) + defer { try? FileManager.default.removeItem(at: tempDir) } + + let archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try archiver.open(file: archivePath) + // The hardlink target. /bin itself has no explicit dir entry either. + let payload = Data("hello".utf8) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/bin/app", permissions: 0o755, size: Int64(payload.count)), + data: payload) + // The parent dir /bin/app.runfiles/_main/app_ has no explicit archive entry. + try archiver.writeEntry( + entry: WriteEntry.hardlink(path: "/bin/app.runfiles/_main/app_/app", target: "/bin/app"), + data: nil) + try archiver.finishEncoding() + + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: archivePath) // must not throw notFound + try formatter.close() + + let reader = try EXT4.EXT4Reader(blockDevice: fsPath) + // Implicitly-created parent directories exist and are directories. + #expect(try reader.stat("/bin/app.runfiles").inode.mode.isDir()) + #expect(try reader.stat("/bin/app.runfiles/_main").inode.mode.isDir()) + #expect(try reader.stat("/bin/app.runfiles/_main/app_").inode.mode.isDir()) + // Hardlink resolves to the target inode and bumps the link count to 2. + let target = try reader.stat("/bin/app") + let hardlink = try reader.stat("/bin/app.runfiles/_main/app_/app") + #expect(hardlink.inodeNumber == target.inodeNumber) + #expect(target.inode.linksCount == 2) + } + + @Test func unpackCreatesImplicitParentsForSymlink() async throws { + // A symlink whose parent dir has no explicit archive entry must unpack. + let tempDir = FileManager.default.uniqueTemporaryDirectory() + let archivePath = tempDir.appendingPathComponent("symlink.tar.gz", isDirectory: false) + let fsPath = FilePath(tempDir.appendingPathComponent("symlink.ext4.img", isDirectory: false)) + defer { try? FileManager.default.removeItem(at: tempDir) } + + let archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try archiver.open(file: archivePath) + // The parent dir /etc/links has no explicit archive entry. + try archiver.writeEntry( + entry: WriteEntry.link(path: "/etc/links/cur", permissions: 0o777, target: "/bin/app"), + data: nil) + try archiver.finishEncoding() + + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: archivePath) // must not throw notFound + try formatter.close() + + let reader = try EXT4.EXT4Reader(blockDevice: fsPath) + #expect(try reader.stat("/etc/links").inode.mode.isDir()) + #expect(try reader.stat("/etc/links/cur", followSymlinks: false).inode.mode.isLink()) + } + + @Test func unpackCreatesImplicitParentsForRegularFile() async throws { + // A regular file whose parent dir has no explicit archive entry must unpack. + let tempDir = FileManager.default.uniqueTemporaryDirectory() + let archivePath = tempDir.appendingPathComponent("file.tar.gz", isDirectory: false) + let fsPath = FilePath(tempDir.appendingPathComponent("file.ext4.img", isDirectory: false)) + defer { try? FileManager.default.removeItem(at: tempDir) } + + let archiver = try ArchiveWriter( + configuration: ArchiveWriterConfiguration(format: .paxRestricted, filter: .gzip)) + try archiver.open(file: archivePath) + // The parent dir /var/lib/data has no explicit archive entry. + let payload = Data("world".utf8) + try archiver.writeEntry( + entry: WriteEntry.file(path: "/var/lib/data/file.txt", permissions: 0o644, size: Int64(payload.count)), + data: payload) + try archiver.finishEncoding() + + let formatter = try EXT4.Formatter(fsPath) + try await formatter.unpack(source: archivePath) // must not throw notFound + try formatter.close() + + let reader = try EXT4.EXT4Reader(blockDevice: fsPath) + #expect(try reader.stat("/var/lib/data").inode.mode.isDir()) + #expect(try reader.stat("/var/lib/data/file.txt").inode.mode.isReg()) + #expect(try reader.readFile(at: "/var/lib/data/file.txt") == payload) + } +} + +extension ContainerizationArchive.WriteEntry { + static func dir(path: String, permissions: UInt16) -> WriteEntry { + let entry = WriteEntry() + entry.path = path + entry.fileType = .directory + entry.permissions = permissions + return entry + } + + static func file(path: String, permissions: UInt16, size: Int64? = nil, xattrs: [String: Data]? = nil) -> WriteEntry { + let entry = WriteEntry() + entry.path = path + entry.fileType = .regular + entry.permissions = permissions + entry.size = size + if let xattrs { + entry.xattrs = xattrs + } + return entry + } + + static func link(path: String, permissions: UInt16, target: String) -> WriteEntry { + let entry = WriteEntry() + entry.path = path + entry.fileType = .symbolicLink + entry.symlinkTarget = target + return entry + } + + static func hardlink(path: String, target: String) -> WriteEntry { + let entry = WriteEntry() + entry.path = path + entry.fileType = .regular + entry.hardlink = target + return entry + } +} + +extension EXT4.EXT4Reader { + fileprivate func getXattrsForInode(inode: EXT4.Inode) throws -> [String: Data] { + var attributes: [EXT4.ExtendedAttribute] = [] + let buffer: [UInt8] = EXT4.tupleToArray(inode.inlineXattrs) + try attributes.append(contentsOf: Self.readInlineExtendedAttributes(from: buffer)) + let block = inode.xattrBlockLow + try self.seek(block: block) + let buf = try self.handle.read(upToCount: Int(self.blockSize))! + try attributes.append(contentsOf: Self.readBlockExtendedAttributes(from: [UInt8](buf))) + var xattrs: [String: Data] = [:] + for attribute in attributes { + guard attribute.fullName != "system.data" else { + continue + } + xattrs[attribute.fullName] = Data(attribute.value) + } + return xattrs + } +} +#endif diff --git a/Tests/ContainerizationExtrasTests/AsyncLockTests.swift b/Tests/ContainerizationExtrasTests/AsyncLockTests.swift new file mode 100644 index 0000000..1db0fc3 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/AsyncLockTests.swift @@ -0,0 +1,112 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +private final class Unprotected: @unchecked Sendable { + var value: Int + init(_ value: Int) { self.value = value } +} + +final class AsyncLockTests { + @Test + func testBasicModification() async throws { + let lock = AsyncLock() + let counter = Unprotected(0) + + let result = await lock.withLock { _ in + counter.value += 1 + return counter.value + } + + #expect(result == 1) + } + + @Test + func testSequentialReturnValues() async throws { + let lock = AsyncLock() + + let first = await lock.withLock { _ in 1 } + let second = await lock.withLock { _ in first + 1 } + let third = await lock.withLock { _ in second + 1 } + + #expect(third == 3) + } + + @Test + func testMultipleModifications() async throws { + let lock = AsyncLock() + let counter = Unprotected(0) + + await lock.withLock { _ in + counter.value += 5 + } + + let result = await lock.withLock { value in + counter.value += 10 + return counter.value + } + + #expect(result == 15) + } + + @Test + func testMutualExclusion() async throws { + let lock = AsyncLock() + let counter = Unprotected(0) + let iterations = 100 + + await withTaskGroup(of: Void.self) { group in + for _ in 0.. /26 + let lower1 = try IPAddress("192.168.1.64") + let upper1 = try IPAddress("192.168.1.127") + let cidr1 = try CIDR(lower: lower1, upper: upper1) + #expect(cidr1.prefix.length == 26) + #expect(cidr1.contains(lower1)) + #expect(cidr1.contains(upper1)) + } + + @Test func testRangeConstructorValidatesIPv6Containment() throws { + // Test IPv6 range containment validation + let lower = try IPAddress("2001:db8::1000") + let upper = try IPAddress("2001:db8::1fff") + let cidr = try CIDR(lower: lower, upper: upper) + #expect(cidr.contains(lower)) + #expect(cidr.contains(upper)) + } + + // MARK: - Version-Specific Range Constructors + + @Test func testV4RangeConstructor() throws { + let lower = try IPAddress("192.168.1.0") + let upper = try IPAddress("192.168.1.255") + let cidr = try CIDR(lower: lower, upper: upper) + #expect(cidr.prefix.length == 24) + #expect(cidr.address.description == "192.168.1.0") + } + + @Test func testV4RangeSingleAddress() throws { + let addr = try IPAddress("192.168.1.100") + let cidr = try CIDR(lower: addr, upper: addr) + #expect(cidr.prefix.length == 32) + #expect(cidr.address.description == "192.168.1.100") + } + + @Test func testV6RangeConstructor() throws { + let lower = try IPAddress("2001:db8::") + let upper = try IPAddress("2001:db8::ffff:ffff:ffff:ffff") + let cidr = try CIDR(lower: lower, upper: upper) + #expect(cidr.prefix.length == 64) + #expect(cidr.address.description == "2001:db8::") + } + + @Test func testV6RangeSingleAddress() throws { + let addr = try IPAddress("2001:db8::1") + let cidr = try CIDR(lower: addr, upper: addr) + #expect(cidr.prefix.length == 128) + #expect(cidr.address.description == "2001:db8::1") + } + + @Test func testV4RangeRejectsInvalidOrder() throws { + let lower = try IPAddress("192.168.1.255") + let upper = try IPAddress("192.168.1.0") + #expect(throws: CIDR.Error.self) { + _ = try CIDR(lower: lower, upper: upper) + } + } + + @Test func testV6RangeRejectsInvalidOrder() throws { + let lower = try IPAddress("2001:db8::ffff") + let upper = try IPAddress("2001:db8::1") + #expect(throws: CIDR.Error.self) { + _ = try CIDR(lower: lower, upper: upper) + } + } + + @Test func testV6RangeRejectsDifferentZones() throws { + let lower = try IPAddress("fe80::1%eth0") + let upper = try IPAddress("fe80::2%eth1") + #expect(throws: CIDR.Error.self) { + _ = try CIDR(lower: lower, upper: upper) + } + } + + // MARK: - Description Tests + + @Test func testDescriptionFormat() throws { + let cidr = try CIDR("10.0.0.0/8") + #expect(cidr.description == "10.0.0.0/8") + } + + @Test func testPreservesAddress() throws { + let cidr = try CIDR("192.168.1.100/24") + #expect(cidr.description == "192.168.1.100/24") + } + + @Test( + "CIDRv4 Codable encodes to string representation", + arguments: [ + "192.168.1.0/24", + "10.0.0.0/8", + "172.16.0.0/12", + ] + ) + func testCIDRv4CodableEncode(cidr: String) throws { + let original = try CIDRv4(cidr) + let encoded = try JSONEncoder().encode(original) + let jsonString = String(data: encoded, encoding: .utf8)! + #expect(jsonString.contains(original.address.description)) + #expect(jsonString.contains("\(original.prefix.length)")) + } + + @Test( + "CIDRv4 Codable decodes from string representation", + arguments: [ + "192.168.1.0/24", + "10.0.0.0/8", + "172.16.0.0/12", + ] + ) + func testCIDRv4CodableDecode(cidr: String) throws { + let json = Data("\"\(cidr)\"".utf8) + let decoded = try JSONDecoder().decode(CIDRv4.self, from: json) + let expected = try CIDRv4(cidr) + #expect(decoded == expected) + } + + @Test( + "CIDRv6 Codable encodes to string representation", + arguments: [ + ("2001:db8::/32", "2001:db8::", 32), + ("fe80::/10", "fe80::", 10), + ("::1/128", "::1", 128), + ] + ) + func testCIDRv6CodableEncode(cidr: String, expectedAddr: String, expectedPrefix: UInt8) throws { + let original = try CIDRv6(cidr) + let encoded = try JSONEncoder().encode(original) + let jsonString = String(data: encoded, encoding: .utf8)! + #expect(jsonString.contains(expectedAddr)) + #expect(jsonString.contains("\(expectedPrefix)")) + } + + @Test( + "CIDRv6 Codable decodes from string representation", + arguments: [ + "2001:db8::/32", + "fe80::/10", + "::1/128", + ] + ) + func testCIDRv6CodableDecode(cidr: String) throws { + let json = Data("\"\(cidr)\"".utf8) + let decoded = try JSONDecoder().decode(CIDRv6.self, from: json) + let expected = try CIDRv6(cidr) + #expect(decoded == expected) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestIPAddress.swift b/Tests/ContainerizationExtrasTests/TestIPAddress.swift new file mode 100644 index 0000000..8bf93a1 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestIPAddress.swift @@ -0,0 +1,237 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("Unified IPAddress Tests") +struct IPAddressTests { + + @Test( + "Parse IPv4 addresses", + arguments: [ + "192.168.1.1", + "127.0.0.1", + "0.0.0.0", + "255.255.255.255", + ] + ) + func testParseIPv4(input: String) throws { + let ip = try IPAddress(input) + #expect(ip.isV4, "Should be IPv4: \(input)") + #expect(!ip.isV6, "Should not be IPv6: \(input)") + #expect(ip.ipv4 != nil, "Should have IPv4 value: \(input)") + #expect(ip.ipv6 == nil, "Should not have IPv6 value: \(input)") + } + + @Test( + "Parse IPv6 addresses", + arguments: [ + "2001:db8::1", + "::1", + "::", + "fe80::1", + "2001:db8:0:0:0:0:0:1", + ] + ) + func testParseIPv6(input: String) throws { + let ip = try IPAddress(input) + #expect(ip.isV6, "Should be IPv6: \(input)") + #expect(!ip.isV4, "Should not be IPv4: \(input)") + #expect(ip.ipv6 != nil, "Should have IPv6 value: \(input)") + #expect(ip.ipv4 == nil, "Should not have IPv4 value: \(input)") + } + + @Test( + "Loopback detection", + arguments: [ + // Loopback addresses + ("127.0.0.1", true, "IPv4 loopback"), + ("127.0.0.255", true, "IPv4 loopback variant"), + ("127.255.255.255", true, "Any 127.x.x.x"), + ("::1", true, "IPv6 loopback"), + // Non-loopback addresses + ("192.168.1.1", false, "Private IPv4"), + ("2001:db8::1", false, "IPv6 documentation"), + ("0.0.0.0", false, "IPv4 unspecified"), + ("::", false, "IPv6 unspecified"), + ] + ) + func testLoopback(input: String, expected: Bool, description: String) throws { + let ip = try IPAddress(input) + #expect(ip.isLoopback == expected, "\(description): \(input) should\(expected ? "" : " not") be loopback") + } + + @Test( + "Multicast detection", + arguments: [ + // Multicast addresses + ("224.0.0.1", true, "IPv4 multicast start"), + ("239.255.255.255", true, "IPv4 multicast end (224.0.0.0/4)"), + ("ff02::1", true, "IPv6 link-local multicast"), + ("ff00::1", true, "IPv6 multicast"), + // Non-multicast addresses + ("192.168.1.1", false, "Private IPv4"), + ("2001:db8::1", false, "IPv6 documentation"), + ("223.255.255.255", false, "Just before multicast range"), + ] + ) + func testMulticast(input: String, expected: Bool, description: String) throws { + let ip = try IPAddress(input) + #expect(ip.isMulticast == expected, "\(description): \(input) should\(expected ? "" : " not") be multicast") + } + + @Test( + "Unspecified detection", + arguments: [ + // Unspecified addresses + ("0.0.0.0", true, "IPv4 unspecified"), + ("::", true, "IPv6 unspecified"), + // Specified addresses + ("0.0.0.1", false, "Not unspecified IPv4"), + ("192.168.1.1", false, "Private IPv4"), + ("::1", false, "IPv6 loopback"), + ("2001:db8::1", false, "IPv6 documentation"), + ] + ) + func testUnspecified(input: String, expected: Bool, description: String) throws { + let ip = try IPAddress(input) + #expect(ip.isUnspecified == expected, "\(description): \(input) should\(expected ? "" : " not") be unspecified") + } + + @Test("Comparable - IPv4 ordering") + func testIPv4Ordering() throws { + let ip1 = try IPv4Address("192.168.1.1") + let ip2 = try IPv4Address("192.168.1.2") + let ip3 = try IPv4Address("192.168.2.1") + + #expect(ip1 < ip2) + #expect(ip2 < ip3) + #expect(ip1 < ip3) + #expect(!(ip2 < ip1)) + } + + @Test("Comparable - IPv6 ordering") + func testIPv6Ordering() throws { + let ip1 = try IPv6Address("2001:db8::1") + let ip2 = try IPv6Address("2001:db8::2") + let ip3 = try IPv6Address("2001:db9::1") + + #expect(ip1 < ip2) + #expect(ip2 < ip3) + #expect(ip1 < ip3) + #expect(!(ip2 < ip1)) + } + + @Test( + "Equality", + arguments: [ + ("192.168.1.1", "192.168.1.1", true, "Same IPv4"), + ("192.168.1.1", "192.168.1.2", false, "Different IPv4"), + ("2001:db8::1", "2001:0db8:0000:0000:0000:0000:0000:0001", true, "Same IPv6, different format"), + ("2001:db8::1", "2001:db8::2", false, "Different IPv6"), + ] + ) + func testEquality(addr1: String, addr2: String, shouldBeEqual: Bool, description: String) throws { + let ip1 = try IPAddress(addr1) + let ip2 = try IPAddress(addr2) + + if shouldBeEqual { + #expect(ip1 == ip2, "\(description): \(addr1) should equal \(addr2)") + } else { + #expect(ip1 != ip2, "\(description): \(addr1) should not equal \(addr2)") + } + } + + @Test("Hashable") + func testHashable() throws { + var dict: [IPAddress: String] = [:] + + let ip1 = try IPAddress("192.168.1.1") + let ip2 = try IPAddress("2001:db8::1") + + dict[ip1] = "IPv4" + dict[ip2] = "IPv6" + + #expect(dict[ip1] == "IPv4") + #expect(dict[ip2] == "IPv6") + #expect(dict.count == 2) + } + + @Test( + "Codable encodes to string representation", + arguments: [ + "127.0.0.1", + "192.168.1.1", + "0.0.0.0", + "255.255.255.255", + ] + ) + func testCodableEncodeIPv4(address: String) throws { + let original = try IPAddress(address) + let encoded = try JSONEncoder().encode(original) + #expect(String(data: encoded, encoding: .utf8) == "\"\(address)\"") + } + + @Test( + "Codable decodes from string representation", + arguments: [ + "127.0.0.1", + "192.168.1.1", + "0.0.0.0", + "255.255.255.255", + ] + ) + func testCodableDecodeIPv4(address: String) throws { + let json = Data("\"\(address)\"".utf8) + let decoded = try JSONDecoder().decode(IPAddress.self, from: json) + let expected = try IPAddress(address) + #expect(decoded == expected) + } + + @Test( + "Codable encodes to string representation", + arguments: [ + ("::1", "::1"), + ("2001:db8::1", "2001:db8::1"), + ("::", "::"), + ("fe80::1", "fe80::1"), + ] + ) + func testCodableEncodeIPv6(input: String, expected: String) throws { + let original = try IPAddress(input) + let encoded = try JSONEncoder().encode(original) + #expect(String(data: encoded, encoding: .utf8) == "\"\(expected)\"") + } + + @Test( + "Codable decodes from string representation", + arguments: [ + "::1", + "2001:db8::1", + "::", + "fe80::1", + ] + ) + func testCodableDecodeIPv6(address: String) throws { + let json = Data("\"\(address)\"".utf8) + let decoded = try JSONDecoder().decode(IPAddress.self, from: json) + let expected = try IPAddress(address) + #expect(decoded == expected) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestIPv4Address.swift b/Tests/ContainerizationExtrasTests/TestIPv4Address.swift new file mode 100644 index 0000000..416f263 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestIPv4Address.swift @@ -0,0 +1,494 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("IPv4Address Tests") +struct IPv4AddressTests { + + // MARK: - Initializer Tests + + @Suite("Initializers") + struct InitializerTests { + + @Test( + "UInt32 initializer", + arguments: [ + (0x7F00_0001, "127.0.0.1"), // localhost + (0x0000_0000, "0.0.0.0"), // zero address + (0xFFFF_FFFF, "255.255.255.255"), // max address + (0xC0A8_0101, "192.168.1.1"), // private network + (0x0808_0808, "8.8.8.8"), // Google DNS + ] + ) + func testUInt32Initializer(inputValue: UInt32, description: String) { + let address = IPv4Address(inputValue) + #expect(address.value == inputValue) + } + + @Test( + "String initializer - valid addresses", + arguments: [ + ("127.0.0.1", 0x7F00_0001), // localhost + ("0.0.0.0", 0x0000_0000), // zero address + ("255.255.255.255", 0xFFFF_FFFF), // broadcast + ("10.0.0.1", 0x0A00_0001), // private network 10.x + ("192.168.1.1", 0xC0A8_0101), // private network 192.168.x + ("172.16.0.1", 0xAC10_0001), // private network 172.16.x + ("1.2.3.4", 0x0102_0304), // single digits + ("192.168.100.254", 0xC0A8_64FE), // mixed digits + ] + ) + func testStringInitializerValid(addressString: String, expectedValue: UInt32) throws { + let address = try IPv4Address(addressString) + #expect(address.value == expectedValue) + } + + @Test( + "String initializer - invalid addresses", + arguments: [ + "", // empty string + "1.2.3", // too short + "1.2.3.4.5", // too many octets + "192.168.1.256", // octet out of range + "192.168.001.1", // leading zeros + "01.2.3.4", // leading zero first octet + " 192.168.1.1", // leading whitespace + "192.168.1.1 ", // trailing whitespace + "192. 168.1.1", // internal whitespace + "192.168.1.a", // invalid character + "192.168.1.-1", // negative number + "192..1.1", // missing octet + ".168.1.1", // missing first octet + "192.168.1.", // missing last octet + "192.168.1.1.extra", // too long + ] + ) + func testStringInitializerInvalid(invalidAddress: String) { + #expect(throws: AddressError.self) { + try IPv4Address(invalidAddress) + } + } + + @Test( + "byte array initializer - valid addresses", + arguments: [ + ([UInt8(127), 0, 0, 1], UInt32(0x7F00_0001)), // localhost + ([UInt8(0), 0, 0, 0], UInt32(0x0000_0000)), // zero address + ([UInt8(255), 255, 255, 255], UInt32(0xFFFF_FFFF)), // broadcast + ([UInt8(192), 168, 1, 1], UInt32(0xC0A8_0101)), // private network + ([UInt8(0x12), 0x34, 0x56, 0x78], UInt32(0x1234_5678)), // byte order test + ] + ) + func testByteArrayInitializerValid(bytes: [UInt8], expectedValue: UInt32) throws { + let address = try IPv4Address(bytes) + #expect(address.value == expectedValue) + // The byte array initializer must round-trip with the bytes property. + #expect(address.bytes == bytes) + } + + @Test( + "byte array initializer - invalid lengths", + arguments: [ + [], // empty + [UInt8(1)], // too short + [UInt8(1), 2, 3], // too short + [UInt8(1), 2, 3, 4, 5], // too long + ] + ) + func testByteArrayInitializerInvalid(bytes: [UInt8]) { + #expect(throws: AddressError.self) { + try IPv4Address(bytes) + } + } + } + + // MARK: - Property Tests + + @Suite("Properties") + struct PropertyTests { + + @Test( + "bytes property", + arguments: [ + (UInt32(0x7F00_0001), [UInt8(127), UInt8(0), UInt8(0), UInt8(1)]), // localhost + (UInt32(0x0000_0000), [UInt8(0), UInt8(0), UInt8(0), UInt8(0)]), // zero + (UInt32(0xFFFF_FFFF), [UInt8(255), UInt8(255), UInt8(255), UInt8(255)]), // broadcast + (UInt32(0xC0A8_0101), [UInt8(192), UInt8(168), UInt8(1), UInt8(1)]), // private network + (UInt32(0x1234_5678), [UInt8(0x12), UInt8(0x34), UInt8(0x56), UInt8(0x78)]), // byte order test + ] + ) + func testBytesProperty(inputValue: UInt32, expectedBytes: [UInt8]) { + let address = IPv4Address(inputValue) + #expect(address.bytes == expectedBytes) + } + + @Test( + "description property", + arguments: [ + (0x7F00_0001, "127.0.0.1"), // localhost + (0x0000_0000, "0.0.0.0"), // zero + (0xFFFF_FFFF, "255.255.255.255"), // broadcast + (0xC0A8_0101, "192.168.1.1"), // private network + (0x0102_0304, "1.2.3.4"), // single digits + ] + ) + func testDescriptionProperty(inputValue: UInt32, expectedDescription: String) { + let address = IPv4Address(inputValue) + #expect(address.description == expectedDescription) + } + + @Test( + "round-trip string conversion", + arguments: [ + "0.0.0.0", + "127.0.0.1", + "192.168.1.1", + "10.0.0.1", + "172.16.0.1", + "255.255.255.255", + "1.2.3.4", + "8.8.8.8", + "1.1.1.1", + ] + ) + func testRoundTripStringConversion(addressString: String) throws { + let address = try IPv4Address(addressString) + #expect(address.description == addressString) + } + } + + // MARK: - Protocol Conformance Tests + + @Suite("Protocol Conformances") + struct ProtocolConformanceTests { + + @Test("Equatable conformance") + func testEquatableConformance() { + let addr1 = IPv4Address(0x7F00_0001) + let addr2 = IPv4Address(0x7F00_0001) + let addr3 = IPv4Address(0xC0A8_0101) + + #expect(addr1 == addr2) + #expect(addr1 != addr3) + #expect(addr2 != addr3) + } + + @Test("Hashable conformance") + func testHashableConformance() { + let addr1 = IPv4Address(0x7F00_0001) + let addr2 = IPv4Address(0x7F00_0001) + let addr3 = IPv4Address(0xC0A8_0101) + + // Equal objects should have equal hash values + #expect(addr1.hashValue == addr2.hashValue) + + // Different objects should ideally have different hash values + // (though this is not guaranteed, it's very likely for these values) + #expect(addr1.hashValue != addr3.hashValue) + + // Test that addresses can be used in Sets and Dictionaries + let addressSet: Set = [addr1, addr2, addr3] + #expect(addressSet.count == 2) // addr1 and addr2 are equal + + let addressDict = [addr1: "localhost", addr3: "private"] + #expect(addressDict[addr2] == "localhost") // addr2 equals addr1 + } + + @Test("CustomStringConvertible conformance") + func testCustomStringConvertibleConformance() { + let address = IPv4Address(0x7F00_0001) + let stringRepresentation = String(describing: address) + #expect(stringRepresentation == "127.0.0.1") + } + + @Test("Sendable conformance") + func testSendableConformance() { + // This test verifies that IPv4Address can be safely passed across concurrency boundaries + let address = IPv4Address(0x7F00_0001) + + Task { + let taskAddress = address + #expect(taskAddress.value == 0x7F00_0001) + } + } + + @Test( + "Codable encodes to string representation", + arguments: [ + "127.0.0.1", + "192.168.1.1", + "0.0.0.0", + "255.255.255.255", + ] + ) + func testCodableEncode(address: String) throws { + let original = try IPv4Address(address) + let encoded = try JSONEncoder().encode(original) + #expect(String(data: encoded, encoding: .utf8) == "\"\(address)\"") + } + + @Test( + "Codable decodes from string representation", + arguments: [ + "127.0.0.1", + "192.168.1.1", + "0.0.0.0", + "255.255.255.255", + ] + ) + func testCodableDecode(address: String) throws { + let json = Data("\"\(address)\"".utf8) + let decoded = try JSONDecoder().decode(IPv4Address.self, from: json) + let expected = try IPv4Address(address) + #expect(decoded == expected) + } + } + + // MARK: - Edge Cases and Error Conditions + + @Suite("Edge Cases") + struct EdgeCaseTests { + + @Test( + "boundary values", + arguments: [ + ("0.0.0.0", 0x0000_0000), // minimum + ("255.255.255.255", 0xFFFF_FFFF), // maximum + ("255.0.0.0", 0xFF00_0000), // max first octet + ("0.255.0.0", 0x00FF_0000), // max second octet + ("0.0.255.0", 0x0000_FF00), // max third octet + ("0.0.0.255", 0x0000_00FF), // max fourth octet + ] + ) + func testBoundaryValues(addressString: String, expectedValue: UInt32) throws { + let address = try IPv4Address(addressString) + #expect(address.value == expectedValue) + } + + @Test( + "special addresses", + arguments: [ + "127.0.0.1", // loopback + "255.255.255.255", // broadcast + "0.0.0.0", // network address + "8.8.8.8", // Google DNS + "1.1.1.1", // Cloudflare DNS + ] + ) + func testSpecialAddresses(addressString: String) throws { + let address = try IPv4Address(addressString) + #expect(address.description == addressString) + } + + @Test( + "leading zero validation - invalid", + arguments: [ + "01.0.0.0", + "0.01.0.0", + "0.0.01.0", + "0.0.0.01", + "192.168.001.1", + "010.0.0.1", + "00.0.0.1", + ] + ) + func testLeadingZeroValidationInvalid(invalidAddress: String) { + #expect(throws: AddressError.self) { + try IPv4Address(invalidAddress) + } + } + + @Test("leading zero validation - valid single zeros") + func testLeadingZeroValidationValid() { + // Single "0" should be valid + #expect(throws: Never.self) { + try IPv4Address("0.0.0.0") + } + } + + @Test( + "string length validation - too short", + arguments: [ + "", "1", "1.2", "1.2.3", "1.2.3.", + ] + ) + func testStringLengthValidationTooShort(shortString: String) { + #expect(throws: AddressError.self) { + try IPv4Address(shortString) + } + } + + @Test( + "string length validation - too long", + arguments: [ + "255.255.255.255.1", + "1234.168.1.1", + "192.1234.1.1", + "192.168.1234.1", + "192.168.1.1234", + ] + ) + func testStringLengthValidationTooLong(longString: String) { + #expect(throws: AddressError.self) { + try IPv4Address(longString) + } + } + } + + // MARK: - Performance Tests + + @Suite("Performance") + struct PerformanceTests { + + @Test("parsing performance") + func testParsingPerformance() throws { + let testAddresses = [ + "192.168.1.1", + "10.0.0.1", + "172.16.0.1", + "127.0.0.1", + "8.8.8.8", + "1.1.1.1", + "255.255.255.255", + "0.0.0.0", + ] + + // Warm up + for _ in 0..<100 { + for address in testAddresses { + _ = try IPv4Address(address) + } + } + + // Measure performance + let iterations = 10000 + let startTime = Date() + + for _ in 0.. String + let addressFromUInt32 = IPv4Address(expectedValue) + #expect(addressFromUInt32.description == expectedString) + + // Test String -> UInt32 + let addressFromString = try IPv4Address(expectedString) + #expect(addressFromString.value == expectedValue) + + // Test equality + #expect(addressFromUInt32 == addressFromString) + } + + @Test( + "error message consistency", + arguments: [ + "", + "256.1.1.1", + "1.2.3", + "1.2.3.4.5", + "192.168.001.1", + " 192.168.1.1", + "192.168.1.1 ", + "192.168.1.a", + ] + ) + func testErrorMessageConsistency(invalidInput: String) { + do { + _ = try IPv4Address(invalidInput) + #expect(Bool(false), "Should have thrown for input: \(invalidInput)") + } catch let error as AddressError { + #expect(error == AddressError.unableToParse) + } catch { + #expect(Bool(false), "Should have thrown AddressError, got: \(error)") + } + } + } +} diff --git a/Tests/ContainerizationExtrasTests/TestIPv6Address+Parse.swift b/Tests/ContainerizationExtrasTests/TestIPv6Address+Parse.swift new file mode 100644 index 0000000..3eabb46 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestIPv6Address+Parse.swift @@ -0,0 +1,734 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("IPv6Address Parsing Tests") +struct IPv6AddressParseTests { + + // MARK: - Valid Hexadecimal Group Tests + + @Test( + "Parsing valid hexadecimal groups", + arguments: [ + ("0", 0x0), + ("1", 0x1), + ("F", 0xF), + ("FF", 0xFF), + ("FFF", 0xFFF), + ("FFFF", 0xFFFF), + ("1234", 0x1234), + ("abcd", 0xABCD), + ("ABCD", 0xABCD), + ("0000", 0x0000), + ] + ) + func testParseValidHexadecimalGroups(input: String, expectedValue: UInt16) throws { + let utf8 = input.utf8 + let (parsedValue, nextIndex) = try IPv6Address.parseHexadecimal( + from: utf8, + startingAt: utf8.startIndex + ) + + #expect( + parsedValue == expectedValue, + "For input '\(input)': expected \(expectedValue) but got \(parsedValue)" + ) + #expect(nextIndex == input.endIndex, "Parser should consume entire input") + } + + @Test( + "Parsing hexadecimal groups with trailing characters", + arguments: [ + ("FF:1234", 0xFF, ":1234"), + ("1234G", 0x1234, "G"), + ("AB::CD", 0xAB, "::CD"), + ("0Z", 0x0, "Z"), + ] + ) + func testParseHexadecimalGroupWithTrailingCharacters( + input: String, + expectedValue: UInt16, + expectedRemainder: String + ) throws { + let utf8 = input.utf8 + let (parsedValue, nextIndex) = try IPv6Address.parseHexadecimal( + from: utf8, + startingAt: utf8.startIndex + ) + + let remainder = String(input[String.Index(nextIndex, within: input)!...]) + + #expect( + parsedValue == expectedValue, + "For input '\(input)': expected \(expectedValue) but got \(parsedValue)" + ) + #expect( + remainder == expectedRemainder, + "For input '\(input)': expected remainder '\(expectedRemainder)' but got '\(remainder)'" + ) + } + + // MARK: - Error Handling Tests + + @Test( + "Parsing invalid hexadecimal groups should throw", + arguments: [ + "", // Empty string - no hex digits found + "G", // Invalid hex character - no hex digits found + "GGGG", // All invalid hex characters - no hex digits found + ] + ) + func testParseInvalidHexadecimalGroup(invalidInput: String) { + #expect(throws: AddressError.self) { + let utf8 = invalidInput.utf8 + _ = try IPv6Address.parseHexadecimal( + from: utf8, + startingAt: utf8.startIndex + ) + } + } + + @Test( + "Parsing hexadecimal groups with overflow behavior", + arguments: [ + ("12345", 0x1234, "5"), // 5 digits -> takes first 4 + ("10000", 0x1000, "0"), // 5 digits -> takes first 4 + ("FFFFF", 0xFFFF, "F"), // 5 digits -> takes first 4 + ("123456789", 0x1234, "56789"), // Many digits -> takes first 4 + ] + ) + func testParseHexadecimalGroupOverflow( + input: String, + expectedValue: UInt16, + expectedRemainder: String + ) throws { + let utf8 = input.utf8 + let (parsedValue, nextIndex) = try IPv6Address.parseHexadecimal( + from: utf8, + startingAt: utf8.startIndex + ) + + let remainder = String(input[String.Index(nextIndex, within: input)!...]) + + #expect( + parsedValue == expectedValue, + "For input '\(input)': expected \(expectedValue) but got \(parsedValue)" + ) + #expect( + remainder == expectedRemainder, + "For input '\(input)': expected remainder '\(expectedRemainder)' but got '\(remainder)'" + ) + } + + @Test("Parsing from middle of string") + func testParseHexadecimalGroupFromMiddle() throws { + let input = "prefix1234suffix" + let utf8 = input.utf8 + let startIndex = utf8.index(utf8.startIndex, offsetBy: 6) // Start at "1234" + + let (parsedValue, nextIndex) = try IPv6Address.parseHexadecimal( + from: utf8, + startingAt: startIndex + ) + + #expect(parsedValue == 0x1234) + + let remainder = String(input[String.Index(nextIndex, within: input)!...]) + #expect(remainder == "suffix") + } + + // MARK: - Performance Tests + + @Test("Performance with maximum length hex groups") + func testParsePerformance() throws { + let testInput = "FFFF" + + // Measure performance of parsing operation + let startTime = Date().timeIntervalSinceReferenceDate + let count = 10000 + for _ in 0.. CD3"), + ("2001:0DB8::", "2001:DB8::", "Can drop leading zeros 0DB8 -> DB8"), + ("0001:0002:0003::", "1:2:3::", "Can drop leading zeros in multiple groups"), + ] + ) + func testRFC4291Section23LeadingZeroRules(form1: String, form2: String, description: String) throws { + let bytes1 = try IPv6Address.parse(form1).bytes + let bytes2 = try IPv6Address.parse(form2).bytes + #expect(bytes1 == bytes2, "\(description)") + } + + @Test( + "RFC 4291 Section 2.3 - cannot drop trailing zeros", + arguments: [ + ("2001:DB8:0:CD30::", "2001:DB8:0:CD3::", "Cannot drop trailing zeros in CD30 -> CD3"), + ("2001:DB80::", "2001:DB8::", "Cannot drop trailing zero DB80 -> DB8"), + ("ABCD:EF00::", "ABCD:EF::", "Cannot drop trailing zeros EF00 -> EF"), + ] + ) + func testRFC4291Section23CannotDropTrailingZeros(full: String, truncated: String, description: String) throws { + let fullBytes = try IPv6Address.parse(full).bytes + let truncatedBytes = try IPv6Address.parse(truncated).bytes + #expect(fullBytes != truncatedBytes, "\(description)") + } + + @Test("RFC 4291 Section 2.3 - Node address and subnet prefix combination") + func testRFC4291Section23NodeAddressSubnetCombination() throws { + // RFC example: node address 2001:0DB8:0:CD30:123:4567:89AB:CDEF + // and its subnet number 2001:0DB8:0:CD30::/60 + // can be abbreviated as 2001:0DB8:0:CD30:123:4567:89AB:CDEF/60 + + let nodeAddress = "2001:0DB8:0:CD30:123:4567:89AB:CDEF" + let subnetPrefix = "2001:0DB8:0:CD30::" + + // Both should parse successfully + #expect(throws: Never.self, "Node address should parse successfully") { + _ = try IPv6Address.parse(nodeAddress) + } + + #expect(throws: Never.self, "Subnet prefix should parse successfully") { + _ = try IPv6Address.parse(subnetPrefix) + } + + // Verify that the subnet prefix is indeed a prefix of the node address + let nodeBytes = try IPv6Address.parse(nodeAddress).bytes + let subnetBytes = try IPv6Address.parse(subnetPrefix).bytes + + // Validate that node address has the subnet as a prefix (60-bit prefix = 7.5 bytes) + let prefixLength = 60 + let hasValidPrefix = nodeBytes.hasPrefix(subnetBytes, upToBits: prefixLength) + + #expect( + hasValidPrefix, + "Node address should have subnet as a \(prefixLength)-bit prefix" + ) + } + + // MARK: - RFC 4291 Section 2.2 Comprehensive Text Representation Tests + + @Test( + "RFC 4291 Section 2.2 - Preferred form with all groups", + arguments: [ + "2001:0db8:0000:0042:0000:8a2e:0370:7334", + "ABCD:EF01:2345:6789:ABCD:EF01:2345:6789", + "0000:0000:0000:0000:0000:0000:0000:0000", + "FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF", + ] + ) + func testRFC4291Section22PreferredForm(testCase: String) throws { + #expect(throws: Never.self, "Should parse preferred form: \(testCase)") { + _ = try IPv6Address.parse(testCase) + } + } + + @Test( + "RFC 4291 Section 2.2 - Leading zero omission in all positions", + arguments: [ + ("2001:0db8:0000:0042:0000:8a2e:0370:7334", "2001:db8:0:42:0:8a2e:370:7334"), + ("0001:0002:0003:0004:0005:0006:0007:0008", "1:2:3:4:5:6:7:8"), + ("0000:0001:0002:0003:0004:0005:0006:0007", "0:1:2:3:4:5:6:7"), + ("1000:0100:0010:0001:1000:0100:0010:0001", "1000:100:10:1:1000:100:10:1"), + ] + ) + func testRFC4291Section22LeadingZeroOmission(full: String, compressed: String) throws { + let fullBytes = try IPv6Address.parse(full).bytes + let compressedBytes = try IPv6Address.parse(compressed).bytes + #expect(fullBytes == compressedBytes, "'\(full)' should equal '\(compressed)'") + } + + @Test( + "RFC 4291 Section 2.2 - Zero compression at beginning", + arguments: [ + ("::", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]), + ("::1", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]), + ("::8a2e:370:7334", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x8a, 0x2e, 0x03, 0x70, 0x73, 0x34]), + ] + ) + func testRFC4291Section22ZeroCompressionAtBeginning(compressed: String, expected: [UInt8]) throws { + let parsed = try IPv6Address.parse(compressed) + #expect(parsed.bytes == expected, "'\(compressed)' should parse correctly") + } + + @Test( + "RFC 4291 Section 2.2 - Zero compression in middle", + arguments: [ + ("2001:db8::8a2e:370:7334", "2001:db8:0:0:0:8a2e:370:7334"), + ("2001:db8::1", "2001:db8:0:0:0:0:0:1"), + ("fe80::1", "fe80:0:0:0:0:0:0:1"), + ("2001:0db8:0:0::1", "2001:db8:0:0:0:0:0:1"), + ] + ) + func testRFC4291Section22ZeroCompressionInMiddle(compressed: String, full: String) throws { + let compressedBytes = try IPv6Address.parse(compressed).bytes + let fullBytes = try IPv6Address.parse(full).bytes + #expect(compressedBytes == fullBytes, "'\(compressed)' should equal '\(full)'") + } + + @Test( + "RFC 4291 Section 2.2 - Zero compression at end", + arguments: [ + ("2001:db8::", "2001:db8:0:0:0:0:0:0"), + ("2001:db8:0:0:1::", "2001:db8:0:0:1:0:0:0"), + ("fe80::", "fe80:0:0:0:0:0:0:0"), + ("1::", "1:0:0:0:0:0:0:0"), + ] + ) + func testRFC4291Section22ZeroCompressionAtEnd(compressed: String, full: String) throws { + let compressedBytes = try IPv6Address.parse(compressed).bytes + let fullBytes = try IPv6Address.parse(full).bytes + #expect(compressedBytes == fullBytes, "'\(compressed)' should equal '\(full)'") + } + + @Test( + "RFC 4291 Section 2.2 - Multiple :: should fail", + arguments: [ + "2001::db8::1", + "::1::2", + "fe80::1::2::3", + "::1::", + ] + ) + func testRFC4291Section22MultipleDoubleColonsShouldFail(invalid: String) { + #expect(throws: AddressError.self, "Multiple '::' should fail: \(invalid)") { + _ = try IPv6Address.parse(invalid) + } + } + + @Test( + "RFC 4291 Section 2.2 - Case insensitivity", + arguments: [ + ("2001:db8::1", "2001:DB8::1", "2001:Db8::1"), + ("dead:beef::cafe", "DEAD:BEEF::CAFE", "DeAd:BeEf::CaFe"), + ("fe80::1", "FE80::1", "Fe80::1"), + ("abcd:ef01:2345:6789::1", "ABCD:EF01:2345:6789::1", "AbCd:Ef01:2345:6789::1"), + ] + ) + func testRFC4291Section22CaseInsensitivity(lower: String, upper: String, mixed: String) throws { + let lowerBytes = try IPv6Address.parse(lower).bytes + let upperBytes = try IPv6Address.parse(upper).bytes + let mixedBytes = try IPv6Address.parse(mixed).bytes + + #expect(lowerBytes == upperBytes, "Case should not matter: '\(lower)' vs '\(upper)'") + #expect(lowerBytes == mixedBytes, "Case should not matter: '\(lower)' vs '\(mixed)'") + } + + @Test("RFC 4291 Section 2.2 - Special addresses") + func testRFC4291Section22SpecialAddresses() throws { + // Unspecified address + let unspecified = try IPv6Address.parse("::") + #expect(unspecified.bytes.allSatisfy { $0 == 0 }, ":: should be all zeros") + + // Loopback address + let loopback = try IPv6Address.parse("::1") + let expectedLoopback: [UInt8] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1] + #expect(loopback.bytes == expectedLoopback, "::1 should be loopback address") + + // IPv4-compatible (deprecated but valid syntax) + let ipv4Compat = try IPv6Address.parse("::c000:0201") + let expectedCompat: [UInt8] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xc0, 0x00, 0x02, 0x01] + #expect(ipv4Compat.bytes == expectedCompat, "::c000:0201 should parse correctly") + } + + @Test( + "RFC 4291 Section 2.2 - Invalid formats should fail", + arguments: [ + "2001:db8", // Too few groups without :: + "2001:db8:1:2:3:4:5:6:7", // Too many groups + "2001:db8:1:2:3:4:5:6:7:8:9", // Too many groups + "2001:db8:::1", // Triple colon + "2001:db8::1::2", // Multiple :: + "gggg::1", // Invalid hex character + "2001:db8:xyz::1", // Invalid hex character + "::ffff:", // Trailing colon + ":2001:db8::1", // Leading single colon + "2001:db8::1:", // Trailing single colon + ] + ) + func testRFC4291Section22InvalidFormatsShouldFail(invalid: String) { + #expect(throws: AddressError.self, "Invalid format should fail: \(invalid)") { + _ = try IPv6Address.parse(invalid) + } + } + + @Test("RFC 4291 Section 2.2 - Maximum values") + func testRFC4291Section22MaximumValues() throws { + // All FFs - maximum value + let maxAddress = try IPv6Address.parse("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff") + #expect(maxAddress.bytes.allSatisfy { $0 == 0xFF }, "All groups should be 0xFFFF") + + // Mix of max and min values + let mixedMax = try IPv6Address.parse("ffff:0:ffff:0:ffff:0:ffff:0") + let expectedMixed: [UInt8] = [0xff, 0xff, 0, 0, 0xff, 0xff, 0, 0, 0xff, 0xff, 0, 0, 0xff, 0xff, 0, 0] + #expect(mixedMax.bytes == expectedMixed, "Should alternate between max and zero") + } + + @Test( + "RFC 4291 Section 2.2 - Single zero groups", + arguments: [ + ("2001:db8:0:1:2:3:4:5", "2001:db8:0:1:2:3:4:5"), // Single 0, no compression needed + ("2001:db8:0:0:1:2:3:4", "2001:db8::1:2:3:4"), // Two zeros can be compressed + ("0:0:0:0:0:0:0:1", "::1"), // All zeros except last + ] + ) + func testRFC4291Section22SingleZeroGroups(withZero: String, withCompression: String) throws { + let zeroBytes = try IPv6Address.parse(withZero).bytes + let compressedBytes = try IPv6Address.parse(withCompression).bytes + #expect(zeroBytes == compressedBytes, "'\(withZero)' should equal '\(withCompression)'") + } + + @Test("RFC 4291 Section 2.2 - Boundary conditions") + func testRFC4291Section22BoundaryConditions() throws { + // Single non-zero value in each position + for position in 0..<8 { + var groups = [String](repeating: "0", count: 8) + groups[position] = "1" + let address = groups.joined(separator: ":") + + #expect(throws: Never.self, "Single non-zero at position \(position) should parse") { + _ = try IPv6Address.parse(address) + } + } + + // Verify the bytes are correct + let firstPosition = try IPv6Address.parse("1:0:0:0:0:0:0:0") + #expect(firstPosition.bytes[0] == 0 && firstPosition.bytes[1] == 1, "First group should be 0x0001") + + let lastPosition = try IPv6Address.parse("0:0:0:0:0:0:0:1") + #expect(lastPosition.bytes[14] == 0 && lastPosition.bytes[15] == 1, "Last group should be 0x0001") + } + + @Test( + "RFC 4291 Section 2.2 - Hex digit limits", + arguments: [ + ("1:2:3:4:5:6:7:8", "1-digit groups"), + ("12:34:56:78:9a:bc:de:f0", "2-digit groups"), + ("123:456:789:abc:def:123:456:789", "3-digit groups"), + ("1234:5678:9abc:def0:1234:5678:9abc:def0", "4-digit groups"), + ("1:12:123:1234:1:12:123:1234", "Mixed digit counts"), + ] + ) + func testRFC4291Section22HexDigitLimits(address: String, description: String) throws { + #expect(throws: Never.self, "Should parse \(description): \(address)") { + _ = try IPv6Address.parse(address) + } + } + + @Test("RFC 4291 Section 2.2 - Equivalence of different representations") + func testRFC4291Section22EquivalenceOfRepresentations() throws { + let equivalentGroups: [[String]] = [ + // Same address, different representations + [ + "2001:0db8:0000:0000:0000:0000:0000:0001", + "2001:db8:0:0:0:0:0:1", + "2001:db8::1", + "2001:0DB8::1", + "2001:0DB8:0000:0000:0000:0000:0000:0001", + ], + [ + "fe80:0000:0000:0000:0000:0000:0000:0001", + "fe80::1", + "FE80::1", + "fe80:0:0:0:0:0:0:1", + ], + [ + "0000:0000:0000:0000:0000:0000:0000:0000", + "::", + "0:0:0:0:0:0:0:0", + ], + ] + + for group in equivalentGroups { + let bytesArray = try group.map { try IPv6Address.parse($0).bytes } + let firstBytes = bytesArray[0] + + for (index, bytes) in bytesArray.enumerated() { + #expect(bytes == firstBytes, "All forms should be equivalent: \(group[index])") + } + } + } + + @Test( + "RFC 4291 Section 2.2 - Zero compression selection (longest run)", + arguments: [ + ("2001:db8:0:0:1:0:0:1", "Two runs of 2 zeros each"), + ("2001:0:0:0:db8:0:0:1", "Run of 3 and run of 2"), + ("2001:db8:0:0:0:0:1:1", "Run of 4 zeros in middle"), + ] + ) + func testRFC4291Section22ZeroCompressionLongestRun(address: String, description: String) throws { + #expect(throws: Never.self, "Should parse \(description): \(address)") { + _ = try IPv6Address.parse(address) + } + } + + @Test( + "RFC 4291 Section 2.2 - Edge case with :: at different positions", + arguments: [ + ("::1", "0:0:0:0:0:0:0:1"), + ("1::", "1:0:0:0:0:0:0:0"), + ("1::1", "1:0:0:0:0:0:0:1"), + ("1:2::1", "1:2:0:0:0:0:0:1"), + ("1::2:3", "1:0:0:0:0:0:2:3"), + ("1:2:3::4:5:6", "1:2:3:0:0:4:5:6"), + ] + ) + func testRFC4291Section22DoubleColonAtDifferentPositions(compressed: String, expanded: String) throws { + let compressedBytes = try IPv6Address.parse(compressed).bytes + let expandedBytes = try IPv6Address.parse(expanded).bytes + #expect(compressedBytes == expandedBytes, "'\(compressed)' should equal '\(expanded)'") + } + + // MARK: - RFC 4291 Section 2.2 IPv4 Mixed Notation Tests + + @Test( + "RFC 4291 Section 2.2 - IPv4 mixed notation basic formats", + arguments: [ + // RFC 4291 examples + ("0:0:0:0:0:0:13.1.68.3", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 13, 1, 68, 3]), + ("::13.1.68.3", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 13, 1, 68, 3]), + + // IPv4-mapped IPv6 address (::ffff:x.x.x.x) + ("::ffff:129.144.52.38", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 129, 144, 52, 38]), + ("0:0:0:0:0:ffff:129.144.52.38", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0xff, 0xff, 129, 144, 52, 38]), + + // IPv4-compatible IPv6 address (deprecated but valid syntax) + ("::192.168.1.1", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 168, 1, 1]), + ("::0.0.0.1", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1]), + + // Various valid positions + ("2001:db8::192.0.2.1", [0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 2, 1]), + ("fe80::192.168.1.1", [0xfe, 0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 168, 1, 1]), + ] + ) + func testRFC4291Section22IPv4MixedNotation(address: String, expected: [UInt8]) throws { + let parsed = try IPv6Address.parse(address) + #expect(parsed.bytes == expected, "IPv4 mixed notation '\(address)' should parse correctly") + } + + @Test( + "RFC 4291 Section 2.2 - IPv4 mixed notation with full IPv6 prefix", + arguments: [ + ("0:0:0:0:0:0:192.168.1.1", [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 168, 1, 1]), + ("2001:db8:0:0:0:0:192.0.2.1", [0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 2, 1]), + ("64:ff9b::192.0.2.33", [0, 0x64, 0xff, 0x9b, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 2, 33]), + ] + ) + func testRFC4291Section22IPv4MixedNotationFullPrefix(address: String, expected: [UInt8]) throws { + let parsed = try IPv6Address.parse(address) + #expect(parsed.bytes == expected, "Full prefix with IPv4 '\(address)' should parse correctly") + } + + @Test("RFC 4291 Section 2.2 - IPv4 mixed notation edge cases") + func testRFC4291Section22IPv4MixedNotationEdgeCases() throws { + // Maximum values + let maxIPv4 = try IPv6Address.parse("::255.255.255.255") + let expectedMax: [UInt8] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255] + #expect(maxIPv4.bytes == expectedMax, "Maximum IPv4 values should work") + + // Minimum values + let minIPv4 = try IPv6Address.parse("::0.0.0.0") + let expectedMin: [UInt8] = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0] + #expect(minIPv4.bytes == expectedMin, "Minimum IPv4 values should work") + + // With non-zero prefix + let withPrefix = try IPv6Address.parse("2001:db8:85a3::8a2e:255.255.255.255") + let expectedPrefix: [UInt8] = [0x20, 0x01, 0x0d, 0xb8, 0x85, 0xa3, 0, 0, 0, 0, 0x8a, 0x2e, 255, 255, 255, 255] + #expect(withPrefix.bytes == expectedPrefix, "IPv4 with hex prefix should work") + } + + @Test( + "RFC 4291 Section 2.2 - IPv4 mixed notation invalid formats", + arguments: [ + "::192.168.1", // Incomplete IPv4 + "::192.168.1.1.1", // Too many IPv4 octets + "::256.1.1.1", // IPv4 octet out of range + "::192.168.001.1", // Leading zeros in IPv4 + "::192.168.-1.1", // Negative in IPv4 + "::192.168.1.a", // Non-numeric in IPv4 + "2001:db8:1:2:3:4:5:192.168.1.1", // Too many hex groups before IPv4 + "::192.168.1.1:1234", // Extra hex after IPv4 + ] + ) + func testRFC4291Section22IPv4MixedNotationInvalid(invalid: String) { + #expect(throws: AddressError.self, "Invalid IPv4 mixed notation should fail: \(invalid)") { + _ = try IPv6Address.parse(invalid) + } + } + + @Test("RFC 4291 Section 2.2 - IPv4 mixed notation equivalence") + func testRFC4291Section22IPv4MixedNotationEquivalence() throws { + // These should all represent the same address + let equivalentForms = [ + "0:0:0:0:0:0:192.0.2.1", + "::192.0.2.1", + "::c000:201", // Same as 192.0.2.1 in hex + ] + + let bytesArray = try equivalentForms.map { try IPv6Address.parse($0).bytes } + let firstBytes = bytesArray[0] + + for (index, bytes) in bytesArray.enumerated() { + #expect(bytes == firstBytes, "All forms should be equivalent: \(equivalentForms[index])") + } + } + + @Test( + "RFC 4291 Section 2.2 - IPv4-mapped IPv6 addresses", + arguments: [ + ("127.0.0.1", "::ffff:127.0.0.1"), + ("192.168.1.1", "::ffff:192.168.1.1"), + ("8.8.8.8", "::ffff:8.8.8.8"), + ("0.0.0.0", "::ffff:0.0.0.0"), + ("255.255.255.255", "::ffff:255.255.255.255"), + ] + ) + func testRFC4291Section22IPv4MappedAddresses(ipv4: String, ipv6: String) throws { + let parsed = try IPv6Address.parse(ipv6) + + // First 10 bytes should be 0 + #expect(parsed.bytes[0..<10].allSatisfy { $0 == 0 }, "First 10 bytes should be zero") + + // Next 2 bytes should be 0xff + #expect(parsed.bytes[10] == 0xff && parsed.bytes[11] == 0xff, "Bytes 10-11 should be 0xffff") + + // Last 4 bytes should match IPv4 address + let ipv4Parsed = try IPv4Address.parse(ipv4) + let ipv4Bytes = [ + UInt8((ipv4Parsed >> 24) & 0xFF), + UInt8((ipv4Parsed >> 16) & 0xFF), + UInt8((ipv4Parsed >> 8) & 0xFF), + UInt8(ipv4Parsed & 0xFF), + ] + #expect(Array(parsed.bytes[12..<16]) == ipv4Bytes, "Last 4 bytes should match IPv4") + } + + @Test( + "RFC 4291 Section 2.2 - IPv4 mixed notation with zone identifier", + arguments: [ + "::ffff:192.168.1.1%eth0", + "fe80::192.168.1.1%lo0", + ] + ) + func testRFC4291Section22IPv4MixedNotationWithZone(testCase: String) throws { + #expect(throws: Never.self, "IPv4 mixed notation with zone should parse: \(testCase)") { + let parsed = try IPv6Address.parse(testCase) + #expect(parsed.zone != nil, "Zone should be preserved") + } + } +} + +// MARK: - Array Extension for Prefix Validation + +extension Array where Element == UInt8 { + /// Checks if this byte array has another array as a prefix up to the specified number of bits + /// - Parameters: + /// - prefix: The potential prefix array + /// - bits: Number of bits to compare (0-128 for IPv6) + /// - Returns: true if the prefix matches for the specified number of bits + func hasPrefix(_ prefix: [UInt8], upToBits bits: Int) -> Bool { + guard self.count >= 16 && prefix.count >= 16 else { return false } + guard bits >= 0 && bits <= 128 else { return false } + + let fullBytes = bits / 8 + let remainingBits = bits % 8 + + // Compare full bytes + for i in 0.. 0 && fullBytes < 16 { + let shiftAmount = 8 - remainingBits + let mask: UInt8 = shiftAmount >= 8 ? 0 : (0xFF << shiftAmount) + return (self[fullBytes] & mask) == (prefix[fullBytes] & mask) + } + + return true + } +} diff --git a/Tests/ContainerizationExtrasTests/TestIPv6Address.swift b/Tests/ContainerizationExtrasTests/TestIPv6Address.swift new file mode 100644 index 0000000..3535812 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestIPv6Address.swift @@ -0,0 +1,274 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("IPv6 Address Tests") +struct IPv6AddressTests { + + // MARK: - String Representation Tests (RFC 5952) + + @Test( + "IPv6 address string representation - RFC 5952", + arguments: [ + // Zero compression algorithm tests + ("0:0:0:0:0:0:0:0", "::", "all zeros - unspecified address"), + ("0:0:0:0:0:0:0:1", "::1", "leading zeros - loopback"), + ("2001:0db8:0:0:0:0:0:0", "2001:db8::", "trailing zeros"), + ("2001:0:0:0:0:0:0db8:1", "2001::db8:1", "middle zeros - longest run"), + ("2001:0:0:0:0:0db8:0:1", "2001::db8:0:1", "multiple runs - prefer longest"), + ("2001:0:0db8:0:1:0:0:2", "2001:0:db8:0:1::2", "tie-breaking - first occurrence wins"), + ("2001:0:0db8:1:2:3:4:5", "2001:0:db8:1:2:3:4:5", "single zero - no compression (min 2 required)"), + ("2001:0db8:0:0:1:2:3:4", "2001:db8::1:2:3:4", "exactly 2 zeros - minimum for compression"), + ("0:0:0:0:1234:0:0:0", "::1234:0:0:0", "tie-breaking - first run wins (4 vs 3 zeros)"), + + // RFC 5952 formatting rules + ( + "ABCD:EF01:2345:6789:9ABC:DEF0:1122:3344", "abcd:ef01:2345:6789:9abc:def0:1122:3344", + "lowercase hex (Section 4.3)" + ), + ("0001:0002:0003:0004:0005:0006:0007:0008", "1:2:3:4:5:6:7:8", "no leading zeros (Section 4.1)"), + + // Edge cases + ("2001:a:a:a:0:0db8:0:1", "2001:a:a:a:0:db8:0:1", "only single zeros scattered - no compression"), + ] + ) + func testIPv6StringRepresentation(input: String, expected: String, description: String) throws { + let addr = try IPv6Address.parse(input) + #expect( + addr.description == expected, + "Expected '\(expected)' but got '\(addr.description)' for input: '\(input)' (\(description))" + ) + } + + // MARK: - isUnspecified Tests + + @Test( + "isUnspecified - RFC 4291 Section 2.5.2", + arguments: [ + ("::", true, "unspecified address (short form)"), + ("0:0:0:0:0:0:0:0", true, "unspecified address (full form)"), + (IPv6Address.unspecified.description, true, "unspecified"), + ("::1", false, "loopback"), + ("0:0:0:0:0:0:0:1", false, "loopback (full form)"), + ("fe80::1", false, "link-local"), + ("2001:db8::1", false, "global unicast"), + ] + ) + func testIsUnspecified(address: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(address) + #expect( + addr.isUnspecified == expected, + "Address \(address) (\(description)) should\(expected ? "" : " not") be unspecified" + ) + } + + // MARK: - isLoopback Tests + + @Test( + "isLoopback - RFC 4291 Section 2.5.3", + arguments: [ + ("::1", true, "loopback (short form)"), + ("0:0:0:0:0:0:0:1", true, "loopback (full form)"), + (IPv6Address.loopback.description, true, "loopback var"), + ("::", false, "unspecified"), + ("::2", false, "not loopback"), + ("0:0:0:0:0:0:0:2", false, "not loopback (full form)"), + ("fe80::1", false, "link-local"), + ("2001:db8::1", false, "global unicast"), + ] + ) + func testIsLoopback(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isLoopback == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be loopback" + ) + } + + // MARK: - isMulticast Tests + + @Test( + "isMulticast - RFC 4291 Section 2.7", + arguments: [ + // Positive cases - all multicast addresses start with ff + ("ff00::1", true, "Reserved multicast"), + ("ff01::1", true, "Interface-local multicast"), + ("ff02::1", true, "Link-local multicast (all nodes)"), + ("ff02::2", true, "Link-local multicast (all routers)"), + ("ff05::1", true, "Site-local multicast"), + ("ff0e::1", true, "Global multicast"), + ("ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", true, "Max multicast"), + // Negative cases + ("::", false, "unspecified"), + ("::1", false, "loopback"), + ("fe80::1", false, "link-local unicast"), + ("2001:db8::1", false, "global unicast"), + ("fd00::1", false, "unique local"), + ] + ) + func testIsMulticast(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isMulticast == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be multicast" + ) + } + + // MARK: - isLinkLocal Tests + + @Test( + "isLinkLocal - RFC 4291 Section 2.5.6", + arguments: [ + // Positive cases - fe80::/10 + ("fe80::1", true, "basic link-local"), + ("fe80::dead:beef", true, "link-local with hex"), + ("fe80:0:0:0:0:0:0:1", true, "link-local (full form)"), + ("fe80::1234:5678:90ab:cdef", true, "link-local with interface ID"), + ("febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff", true, "Last address in fe80::/10"), + // Negative cases + ("::", false, "unspecified"), + ("::1", false, "loopback"), + ("fec0::1", false, "site-local (deprecated)"), + ("ff02::1", false, "multicast"), + ("2001:db8::1", false, "global unicast"), + ("fd00::1", false, "unique local"), + ] + ) + func testIsLinkLocal(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isLinkLocal == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be link-local" + ) + } + + // MARK: - isUniqueLocal Tests + + @Test( + "isUniqueLocal - RFC 4193", + arguments: [ + // Positive cases - fc00::/7 (fc00::/8 and fd00::/8) + ("fc00::1", true, "fc00 unique local"), + ("fc00:dead:beef::1", true, "fc00 with hex"), + ("fd00::1", true, "fd00 unique local"), + ("fd12:3456:789a::1", true, "fd00 with prefix"), + ("fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", true, "max unique local"), + // Negative cases + ("::", false, "unspecified"), + ("::1", false, "loopback"), + ("fe80::1", false, "link-local"), + ("ff02::1", false, "multicast"), + ("2001:db8::1", false, "global unicast"), + ] + ) + func testIsUniqueLocal(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isUniqueLocal == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be unique local" + ) + } + + // MARK: - isGlobalUnicast Tests + + @Test( + "isGlobalUnicast - RFC 4291 Section 2.5.4", + arguments: [ + // Positive cases - routable on the global internet + ("2001:db8::1", true, "Documentation (but still global unicast format)"), + ("2001:4860:4860::8888", true, "Google DNS"), + ("2606:4700:4700::1111", true, "Cloudflare DNS"), + ("2001:500::1", true, "Root DNS server"), + ("2a00:1450:4001::1", true, "Google"), + // Negative cases - special addresses + ("::", false, "unspecified"), + ("::1", false, "loopback"), + ("fe80::1", false, "link-local"), + ("ff02::1", false, "multicast"), + ("fc00::1", false, "unique local"), + ("fd00::1", false, "unique local"), + ] + ) + func testIsGlobalUnicast(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isGlobalUnicast == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be global unicast" + ) + } + + // MARK: - isDocumentation Tests + + @Test( + "isDocumentation - RFC 3849", + arguments: [ + // Positive cases - 2001:db8::/32 + ("2001:db8::1", true, "basic documentation address"), + ("2001:db8::", true, "documentation prefix"), + ("2001:db8:0:0:0:0:0:1", true, "documentation (full form)"), + ("2001:db8:1234:5678:90ab:cdef:1234:5678", true, "documentation with all fields"), + ("2001:db8:ffff:ffff:ffff:ffff:ffff:ffff", true, "max documentation address"), + // Negative cases + ("2001:db7::1", false, "Just before documentation range"), + ("2001:db9::1", false, "Just after documentation range"), + ("2001:4860:4860::8888", false, "Google DNS"), + ("::", false, "unspecified"), + ("::1", false, "loopback"), + ] + ) + func testIsDocumentation(addressString: String, expected: Bool, description: String) throws { + let addr = try IPv6Address.parse(addressString) + #expect( + addr.isDocumentation == expected, + "Address \(addressString) (\(description)) should\(expected ? "" : " not") be documentation" + ) + } + + @Test( + "Codable encodes to string representation", + arguments: [ + ("::1", "::1"), + ("2001:db8::1", "2001:db8::1"), + ("::", "::"), + ("fe80::1", "fe80::1"), + ] + ) + func testCodableEncode(input: String, expected: String) throws { + let original = try IPv6Address(input) + let encoded = try JSONEncoder().encode(original) + #expect(String(data: encoded, encoding: .utf8) == "\"\(expected)\"") + } + + @Test( + "Codable decodes from string representation", + arguments: [ + "::1", + "2001:db8::1", + "::", + "fe80::1", + ] + ) + func testCodableDecode(address: String) throws { + let json = Data("\"\(address)\"".utf8) + let decoded = try JSONDecoder().decode(IPv6Address.self, from: json) + let expected = try IPv6Address(address) + #expect(decoded == expected) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestIPv6IPv4Parsing.swift b/Tests/ContainerizationExtrasTests/TestIPv6IPv4Parsing.swift new file mode 100644 index 0000000..15031a2 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestIPv6IPv4Parsing.swift @@ -0,0 +1,131 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("IPv6 Mixed IPv4 Notation Tests") +struct IPv6IPv4ParsingTests { + + @Test( + "Extract IPv4 suffix from various IPv6 formats", + arguments: [ + ("::192.168.1.1", "::", [UInt8(192), UInt8(168), UInt8(1), UInt8(1)]), + ("::ffff:192.0.2.1", "::ffff", [UInt8(192), UInt8(0), UInt8(2), UInt8(1)]), + ("fe80::192.168.1.1", "fe80::", [UInt8(192), UInt8(168), UInt8(1), UInt8(1)]), + ("2001:db8::192.0.2.1", "2001:db8::", [UInt8(192), UInt8(0), UInt8(2), UInt8(1)]), + ("0:0:0:0:0:0:192.168.1.1", "0:0:0:0:0:0", [UInt8(192), UInt8(168), UInt8(1), UInt8(1)]), + ] + ) + func testIPv4SuffixExtraction(input: String, expectedIPv6: String, expectedIPv4: [UInt8]) throws { + let result = try #require(try IPv6Address.extractIPv4Suffix(from: input)) + #expect(result.0 == expectedIPv6) + #expect(result.1 == expectedIPv4) + } + + @Test( + "No IPv4 suffix for pure IPv6 addresses", + arguments: [ + "2001:db8::1", + "fe80::1", + "::", + "::1", + ] + ) + func testPureIPv6ReturnsNil(address: String) throws { + #expect(try IPv6Address.extractIPv4Suffix(from: address) == nil) + } + + @Test( + "Invalid IPv4 suffix throws error", + arguments: [ + "::256.1.1.1", + "::192.168.1", + "::192.168.001.1", + ] + ) + func testInvalidIPv4Throws(invalid: String) { + #expect(throws: AddressError.self) { + _ = try IPv6Address.extractIPv4Suffix(from: invalid) + } + } + + @Test( + "IPv4 bytes always at positions 12-15", + arguments: [ + "::192.168.1.1", + "::ffff:127.0.0.1", + "fe80::10.0.0.1", + ] + ) + func testIPv4BytePlacement(address: String) throws { + let parsed = try IPv6Address.parse(address) + let ipv4String = String(address.split(separator: ":").last!) + let ipv4 = try IPv4Address.parse(ipv4String) + + #expect(parsed.bytes[12] == UInt8((ipv4 >> 24) & 0xFF)) + #expect(parsed.bytes[13] == UInt8((ipv4 >> 16) & 0xFF)) + #expect(parsed.bytes[14] == UInt8((ipv4 >> 8) & 0xFF)) + #expect(parsed.bytes[15] == UInt8(ipv4 & 0xFF)) + } + + @Test( + "Unspecified address with IPv4 suffix", + arguments: [ + ("::192.168.1.1", [UInt8(192), UInt8(168), UInt8(1), UInt8(1)]), + ("::0.0.0.1", [UInt8(0), UInt8(0), UInt8(0), UInt8(1)]), + ("::255.255.255.255", [UInt8(255), UInt8(255), UInt8(255), UInt8(255)]), + ] + ) + func testUnspecifiedWithIPv4(address: String, ipv4: [UInt8]) throws { + let parsed = try IPv6Address.parse(address) + #expect(parsed.bytes[0..<12].allSatisfy { $0 == 0 }) + #expect(Array(parsed.bytes[12..<16]) == ipv4) + } + + @Test("IPv4 with zone identifier") + func testIPv4WithZone() throws { + let parsed = try IPv6Address.parse("::192.168.1.1%lo0") + + #expect(parsed.zone == "lo0") + #expect(Array(parsed.bytes[12..<16]) == [192, 168, 1, 1]) + } + + @Test( + "IPv4-mapped addresses (::ffff:x.x.x.x)", + arguments: [ + "::ffff:127.0.0.1", + "::ffff:192.168.1.1", + ] + ) + func testIPv4MappedAddresses(address: String) throws { + let parsed = try IPv6Address.parse(address) + + #expect(parsed.bytes[0..<10].allSatisfy { $0 == 0 }) + #expect(parsed.bytes[10] == 0xff && parsed.bytes[11] == 0xff) + } + + @Test("Complex ellipsis with IPv4") + func testComplexEllipsisWithIPv4() throws { + let address = "2001:db8:85a3::8a2e:192.168.1.1" + let parsed = try IPv6Address.parse(address) + + #expect(parsed.bytes[10] == 0x8a && parsed.bytes[11] == 0x2e) + #expect(Array(parsed.bytes[12..<16]) == [192, 168, 1, 1]) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestMACAddress.swift b/Tests/ContainerizationExtrasTests/TestMACAddress.swift new file mode 100644 index 0000000..e8e99d7 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestMACAddress.swift @@ -0,0 +1,405 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +@Suite("MACAddress Tests") +struct MACAddressTests { + + // MARK: - Initializer Tests + + @Suite("Initializers") + struct InitializerTests { + + @Test( + "UInt64 initializer - valid addresses", + arguments: [ + //(0x0123_4567_89ab, "01:23:45:67:89:ab"), // a valid address + //(0x0000_0000_0000, "00:00:00:00:00:00"), // zero address + //(0xFFFF_FFFF_FFFF, "ff:ff:ff:ff:ff:ff"), // max address + (0xffff_0123_4567_89ab, "01:23:45:67:89:ab") // drops the most significant 16 bits + ] + ) + func testUInt64InitializerValid(inputValue: UInt64, description: String) { + let address = MACAddress(inputValue) + #expect(address.value == inputValue & 0x0000_ffff_ffff_ffff) + } + + @Test( + "String initializer - valid addresses", + arguments: [ + ("01:23:45:67:89:ab", 0x0123_4567_89ab), // colon separators + ("01-23-45-67-89-ab", 0x0123_4567_89ab), // dash separators + ("ab:cd:ef:AB:CD:EF", 0xabcd_efab_cdef), // mixed case + ("00:00:00:00:00:00", 0x0000_0000_0000), // zero address + ("ff:ff:ff:ff:ff:ff", 0xffff_ffff_ffff), // max address + ] + ) + func testStringInitializerValid(addressString: String, expectedValue: UInt64) throws { + let address = try MACAddress(addressString) + #expect(address.value == expectedValue) + } + + @Test( + "String initializer - invalid addresses", + arguments: [ + "", // empty string + "01:23:45:67:89", // too few octets + "01:23:45:67:89:ab:cd", // too many octets + "01:23:45:67:89:", // empty octet + ":23:45:67:89:ab", // empty octet + "01::45:67:89:ab", // empty octet + "01:23:45:67:89:a", // short octet + "1:23:45:67:89:ab", // short octet + "01:2:45:67:89:ab", // short octet + "01:23:45:67:89:abc", // long octet + "012:23:45:67:89:ab", // long octet + "01:234:45:67:89:ab", // long octet + "01:23:45:67:89:@G", // invalid content 0x40, 0x47 + "`g:23:45:67:89:ab", // invalid content 0x60, 0x67 + "01:hi:45:67:89:ab", // invalid content + " 01:23:45:67:89:ab", // leading whitespace + "01:23:45:67:89:ab ", // trailing whitespace + "01: 23:45:67:89:ab", // internal whitespace + ] + ) + func testStringInitializerInvalid(invalidAddress: String) { + #expect(throws: AddressError.self) { + try MACAddress(invalidAddress) + } + } + } + + // MARK: - Property Tests + + @Suite("Properties") + struct PropertyTests { + + @Test( + "bytes property", + arguments: [ + ( + UInt64(0x0123_4567_89ab), + [UInt8(0x01), UInt8(0x23), UInt8(0x45), UInt8(0x67), UInt8(0x89), UInt8(0xab)] + ), + ( + UInt64(0x0000_0000_0000), + [UInt8(0x00), UInt8(0x00), UInt8(0x00), UInt8(0x00), UInt8(0x00), UInt8(0x00)] + ), + ( + UInt64(0xffff_ffff_ffff), + [UInt8(0xff), UInt8(0xff), UInt8(0xff), UInt8(0xff), UInt8(0xff), UInt8(0xff)] + ), + ( + UInt64(0xffff_0123_4567_89ab), + [UInt8(0x01), UInt8(0x23), UInt8(0x45), UInt8(0x67), UInt8(0x89), UInt8(0xab)] + ), + ] + ) + func testBytesProperty(inputValue: UInt64, expectedBytes: [UInt8]) { + let address = MACAddress(inputValue) + #expect(address.bytes == expectedBytes) + } + + @Test( + "description property", + arguments: [ + (0x0123_4567_89ab, "01:23:45:67:89:ab"), + (0x0000_0000_0000, "00:00:00:00:00:00"), + (0xffff_ffff_ffff, "ff:ff:ff:ff:ff:ff"), + (0xffff_0123_4567_89ab, "01:23:45:67:89:ab"), + ] + ) + func testDescriptionProperty(inputValue: UInt64, expectedDescription: String) { + let address = MACAddress(inputValue) + #expect(address.description == expectedDescription) + } + + @Test( + "isLocallyAdministered property", + arguments: [ + (0x0000_1234_5678, false), + (0x0200_1234_5678, true), + ] + ) + func testIsLocallyAdministeredProperty(inputValue: UInt64, expectedValue: Bool) { + let address = MACAddress(inputValue) + #expect(address.isLocallyAdministered == expectedValue) + } + + @Test( + "isMulticast property", + arguments: [ + (0x0000_1234_5678, false), + (0x0100_1234_5678, true), + ] + ) + func testIsMulticastProperty(inputValue: UInt64, expectedValue: Bool) { + let address = MACAddress(inputValue) + #expect(address.isMulticast == expectedValue) + } + + @Test( + "round-trip string conversion", + arguments: [ + "01:23:45:67:89:ab", + "00:00:00:00:00:00", + "ff:ff:ff:ff:ff:ff", + "01-23-45-67-89-AB", + ] + ) + func testRoundTripStringConversion(addressString: String) throws { + let address = try MACAddress(addressString) + #expect(address.description == addressString.lowercased().replacingOccurrences(of: "-", with: ":")) + } + } + + // MARK: - Link Local Address Tests + + @Suite("Link Local Addresses") + struct LinkLocalAddressTests { + + @Test( + "Link local address", + arguments: [ + (0x39a7_9407_cbd0, 0xfd97_7b15_d62e_75ac_3ba7_94ff_fe07_cbd0), + (0x5e3b_68d7_e510, 0xfd97_7b15_d62e_75ac_5c3b_68ff_fed7_e510), + ] + ) + func testLinkLocalAddress(mac: UInt64, ipv6: UInt128) throws { + let mac = MACAddress(mac) + let ipv6Prefix = IPv6Address(ipv6 & 0xffff_ffff_ffff_ffff_0000_0000_0000_0000) + let ipv6Address = try mac.ipv6Address(network: ipv6Prefix) + #expect(ipv6Address == IPv6Address(ipv6)) + } + } + + // MARK: - Protocol Conformance Tests + + @Suite("Protocol Conformances") + struct ProtocolConformanceTests { + + @Test("Equatable conformance") + func testEquatableConformance() { + let addr1 = MACAddress(0x0123_4567_89ab) + let addr2 = MACAddress(0x0123_4567_89ab) + let addr3 = MACAddress(0x0123_4567_89ac) + + #expect(addr1 == addr2) + #expect(addr1 != addr3) + #expect(addr2 != addr3) + } + + @Test("Hashable conformance") + func testHashableConformance() { + let addr1 = MACAddress(0x0123_4567_89ab) + let addr2 = MACAddress(0x0123_4567_89ab) + let addr3 = MACAddress(0x0123_4567_89ac) + + // Equal objects should have equal hash values + #expect(addr1.hashValue == addr2.hashValue) + + // Different objects should ideally have different hash values + // (though this is not guaranteed, it's very likely for these values) + #expect(addr1.hashValue != addr3.hashValue) + + // Test that addresses can be used in Sets and Dictionaries + let addressSet: Set = [addr1, addr2, addr3] + #expect(addressSet.count == 2) // addr1 and addr2 are equal + + let addressDict = [addr1: "localhost", addr3: "private"] + #expect(addressDict[addr2] == "localhost") // addr2 equals addr1 + } + + @Test("CustomStringConvertible conformance") + func testCustomStringConvertibleConformance() { + let address = MACAddress(0x0123_4567_89ab) + let stringRepresentation = String(describing: address) + #expect(stringRepresentation == "01:23:45:67:89:ab") + } + + @Test("Sendable conformance") + func testSendableConformance() { + // This test verifies that MACAddress can be safely passed across concurrency boundaries + let address = MACAddress(0x0123_4567_89ab) + + Task { + let taskAddress = address + #expect(taskAddress.value == 0x0123_4567_89ab) + } + } + } + + // MARK: - Performance Tests + + @Suite("Performance") + struct PerformanceTests { + + @Test("parsing performance") + func testParsingPerformance() throws { + let testAddresses = [ + "01:23:45:67:89:ab", + "01-23-45-67-89-ab", + "01-23-45-67-89-a", + "01-23-45-67-89-abc", + ] + + // Warm up + for _ in 0..<100 { + for address in testAddresses { + _ = try? MACAddress(address) + } + } + + // Measure performance + let iterations = 10000 + let startTime = Date() + + for _ in 0.. String + let addressFromUInt32 = MACAddress(expectedValue) + #expect(addressFromUInt32.description == expectedString) + + // Test String -> UInt32 + let addressFromString = try MACAddress(expectedString) + #expect(addressFromString.value == expectedValue) + + // Test equality + #expect(addressFromUInt32 == addressFromString) + } + + @Test( + "error message consistency", + arguments: [ + "", + "hi:00:00:00:00:00", + "01:23:45:67:89", + "01:23:45:67:89:ab:cd", + "001:23:45:67:89:ab:cd", + " 01:23:45:67:89:ab:cd", + "01:23:45:67:89:ab:cd ", + ] + ) + func testErrorMessageConsistency(invalidInput: String) { + do { + _ = try MACAddress(invalidInput) + #expect(Bool(false), "Should have thrown for input: \(invalidInput)") + } catch let error as AddressError { + #expect(error == AddressError.unableToParse) + } catch { + #expect(Bool(false), "Should have thrown AddressError, got: \(error)") + } + } + + @Test( + "Codable encodes to string representation", + arguments: [ + "01:23:45:67:89:ab", + "00:00:00:00:00:00", + "ff:ff:ff:ff:ff:ff", + ] + ) + func testCodableEncode(address: String) throws { + let original = try MACAddress(address) + let encoded = try JSONEncoder().encode(original) + #expect(String(data: encoded, encoding: .utf8) == "\"\(address)\"") + } + + @Test( + "Codable decodes from string representation", + arguments: [ + "01:23:45:67:89:ab", + "00:00:00:00:00:00", + "ff:ff:ff:ff:ff:ff", + ] + ) + func testCodableDecode(address: String) throws { + let json = Data("\"\(address)\"".utf8) + let decoded = try JSONDecoder().decode(MACAddress.self, from: json) + let expected = try MACAddress(address) + #expect(decoded == expected) + } + } +} diff --git a/Tests/ContainerizationExtrasTests/TestNetworkAddress+Allocator.swift b/Tests/ContainerizationExtrasTests/TestNetworkAddress+Allocator.swift new file mode 100644 index 0000000..193ca10 --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestNetworkAddress+Allocator.swift @@ -0,0 +1,248 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationExtras +import Testing + +@testable import ContainerizationExtras + +final class TestAddressAllocators { + @Test + func testIPv4AddressAllocatorZeroSize() throws { + _ = try IPv4Address.allocator(lower: 0xffff_ffff, size: 1) + do { + _ = try IPv4Address.allocator(lower: 0xffff_ffff, size: 0) + #expect(Bool(false), "Expected AllocatorError.rangeExceeded to be thrown") + } catch { + #expect(error as? AllocatorError == .rangeExceeded, "Unexpected error thrown: \(error)") + } + } + + @Test + func testIPv4AddressAllocatorOverflow() throws { + _ = try IPv4Address.allocator(lower: 0xffff_ff00, size: 256) + do { + _ = try IPv4Address.allocator(lower: 0xffff_ff00, size: 257) + #expect(Bool(false), "Expected AllocatorError.rangeExceeded to be thrown") + } catch { + #expect(error as? AllocatorError == .rangeExceeded, "Unexpected error thrown: \(error)") + } + } + + @Test + func testUInt16AllocatorOverflow() throws { + _ = try UInt16.allocator(lower: 0xfff0, size: 16) + do { + _ = try UInt16.allocator(lower: 0xfff0, size: 17) + #expect(Bool(false), "Expected AllocatorError.rangeExceeded to be thrown") + } catch { + #expect(error as? AllocatorError == .rangeExceeded, "Unexpected error thrown: \(error)") + } + } + + @Test + func testUInt32AllocatorOverflow() throws { + _ = try UInt32.allocator(lower: 0xffff_fff0, size: 16) + do { + _ = try UInt32.allocator(lower: 0xffff_fff0, size: 17) + #expect(Bool(false), "Expected AllocatorError.rangeExceeded to be thrown") + } catch { + #expect(error as? AllocatorError == .rangeExceeded, "Unexpected error thrown: \(error)") + } + } + + @Test + func testFreeUnallocated() throws { + let allocator = try IPv4Address.allocator( + lower: 0xc0a8_4000, size: 256) + do { + _ = try allocator.release(IPv4Address("192.168.64.2")) + #expect(Bool(false), "Expected AllocatorError.notAllocated to be thrown") + } catch { + #expect(error as? AllocatorError == .notAllocated("192.168.64.2"), "Unexpected error thrown: \(error)") + } + } + + @Test + func testChoose() throws { + let allocator = try IPv4Address.allocator( + lower: 0xc0a8_4000, size: 2) + try allocator.reserve(IPv4Address("192.168.64.1")) + do { + _ = try allocator.reserve(IPv4Address("192.168.64.1")) + #expect(Bool(false), "Expected AllocatorError.alreadyAllocated to be thrown") + } catch { + #expect(error as? AllocatorError == .alreadyAllocated("192.168.64.1"), "Unexpected error thrown: \(error)") + } + } + + @Test + func testipv4AddressAllocator() throws { + var allocations = Set() + let lower = try IPv4Address("192.168.64.1").value & Prefix(length: 24)!.prefixMask32 + let allocator = try IPv4Address.allocator( + lower: lower, size: 3) + allocations.insert(try allocator.allocate().value) + allocations.insert(try allocator.allocate().value) + allocations.insert(try allocator.allocate().value) + do { + _ = try allocator.allocate() + #expect(Bool(false), "Expected AllocatorError.allocatorFull to be thrown") + } catch { + #expect(error as? AllocatorError == .allocatorFull, "Unexpected error thrown: \(error)") + } + + let address = try IPv4Address("192.168.64.2") + try allocator.release(address) + + let value = try allocator.allocate() + #expect(value == address) + } + + @Test + func testHighestIPv4AddressAllocator() throws { + var allocations = Set() + let lower = try IPv4Address("255.255.255.255").value & Prefix(length: 32)!.prefixMask32 + let allocator = try IPv4Address.allocator( + lower: lower, size: 1) + allocations.insert(try allocator.allocate().value) + do { + _ = try allocator.allocate() + #expect(Bool(false), "Expected AllocatorError.allocatorFull to be thrown") + } catch { + #expect(error as? AllocatorError == .allocatorFull, "Unexpected error thrown: \(error)") + } + + let address = try IPv4Address("255.255.255.255") + try allocator.release(address) + let value = try allocator.allocate() + #expect(value == address) + } + + @Test + func testLargestIPv4AddressAllocator() throws { + // NOTE: This allocator should consume about 16MB + _ = try IPv4Address.allocator(lower: 0, size: 1 << 32) + } + + @Test + func testUInt16PortAllocator() throws { + var allocations = Set() + let lower = UInt16(1024) + let allocator = try UInt16.allocator(lower: lower, size: 3) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + do { + _ = try allocator.allocate() + #expect(Bool(false), "Expected AllocatorError.allocatorFull to be thrown") + } catch { + #expect(error as? AllocatorError == .allocatorFull, "Unexpected error thrown: \(error)") + } + + let address = UInt16(1025) + try allocator.release(address) + let value = try allocator.allocate() + #expect(value == address) + } + + @Test + func testUInt32PortAllocator() throws { + var allocations = Set() + let lower = UInt32(5000) + let allocator = try UInt32.allocator(lower: lower, size: 3) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + do { + _ = try allocator.allocate() + #expect(Bool(false), "Expected AllocatorError.allocatorFull to be thrown") + } catch { + #expect(error as? AllocatorError == .allocatorFull, "Unexpected error thrown: \(error)") + } + + let address = UInt32(5001) + try allocator.release(address) + let value = try allocator.allocate() + #expect(value == address) + } + + @Test + func testRotatingUInt32PortAllocator() throws { + var allocations = Set() + let lower = UInt32(5000) + let allocator = try UInt32.rotatingAllocator(lower: lower, size: 3) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + allocations.insert(try allocator.allocate()) + do { + _ = try allocator.allocate() + #expect(Bool(false), "Expected AllocatorError.allocatorFull to be thrown") + } catch { + #expect(error as? AllocatorError == .allocatorFull, "Unexpected error thrown: \(error)") + } + + let address = UInt32(5001) + try allocator.release(address) + let value = try allocator.allocate() + #expect(value == address) + } + + @Test + func testRotatingFIFOUInt32PortAllocator() throws { + let lower = UInt32(5000) + let allocator = try UInt32.rotatingAllocator(lower: lower, size: 3) + let first = try allocator.allocate() + #expect(first == 5000) + let second = try allocator.allocate() + #expect(second == 5001) + + try allocator.release(first) + let third = try allocator.allocate() + // even after a release, it should continue to allocate in the range + // before reusing a previous allocation on the stack. + #expect(third == 5002) + + // now the next allocation should be our first port + let reused = try allocator.allocate() + #expect(reused == first) + + try allocator.release(third) + let thirdReused = try allocator.allocate() + #expect(thirdReused == third) + } + + @Test + func testRotatingReservedUInt32PortAllocator() throws { + let lower = UInt32(5000) + let allocator = try UInt32.rotatingAllocator(lower: lower, size: 3) + + try allocator.reserve(5001) + let first = try allocator.allocate() + #expect(first == 5000) + // this should skip the reserved 5001 + let second = try allocator.allocate() + #expect(second == 5002) + + // no release our reserved + try allocator.release(5001) + + let third = try allocator.allocate() + #expect(third == 5001) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestPrefix.swift b/Tests/ContainerizationExtrasTests/TestPrefix.swift new file mode 100644 index 0000000..9b74aca --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestPrefix.swift @@ -0,0 +1,155 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Testing + +@testable import ContainerizationExtras + +struct TestPrefix { + + // MARK: - IPv4 Mask Tests + + struct IPv4Mask { + let length: UInt8 + let expectedPrefix: UInt32 + let expectedSuffix: UInt32 + } + + @Test(arguments: [ + IPv4Mask( + length: 0, + expectedPrefix: 0x0000_0000, + expectedSuffix: 0xFFFF_FFFF + ), + IPv4Mask( + length: 8, + expectedPrefix: 0xFF00_0000, + expectedSuffix: 0x00FF_FFFF + ), + IPv4Mask( + length: 16, + expectedPrefix: 0xFFFF_0000, + expectedSuffix: 0x0000_FFFF + ), + IPv4Mask( + length: 24, + expectedPrefix: 0xFFFF_FF00, + expectedSuffix: 0x0000_00FF + ), + IPv4Mask( + length: 32, + expectedPrefix: 0xFFFF_FFFF, + expectedSuffix: 0x0000_0000 + ), + ]) + func testIPv4Masks(testCase: IPv4Mask) { + let prefix = Prefix(length: testCase.length)! + #expect(prefix.prefixMask32 == testCase.expectedPrefix) + #expect(prefix.suffixMask32 == testCase.expectedSuffix) + } + + @Test func testMasksAreInverses32() { + for length in 0...32 { + let prefix = Prefix(length: UInt8(length))! + #expect(~prefix.prefixMask32 == prefix.suffixMask32) + } + } + + // MARK: - IPv6 Mask Tests + + struct IPv6Mask { + let length: UInt8 + let expectedPrefix: UInt128 + let expectedSuffix: UInt128 + } + + @Test func testIPv6Masks() { + let cases = [ + IPv6Mask( + length: 0, + expectedPrefix: UInt128(0), + expectedSuffix: UInt128.max + ), + IPv6Mask( + length: 64, + expectedPrefix: 0xFFFF_FFFF_FFFF_FFFF_0000_0000_0000_0000, + expectedSuffix: 0x0000_0000_0000_0000_FFFF_FFFF_FFFF_FFFF + ), + IPv6Mask( + length: 128, + expectedPrefix: UInt128.max, + expectedSuffix: UInt128(0) + ), + ] + for testCase in cases { + let prefix = Prefix(length: testCase.length)! + #expect(prefix.prefixMask128 == testCase.expectedPrefix) + #expect(prefix.suffixMask128 == testCase.expectedSuffix) + } + } + + @Test func testMasksAreInverses128() { + for length in stride(from: 0, through: 128, by: 8) { + let prefix = Prefix(length: UInt8(length))! + #expect(~prefix.prefixMask128 == prefix.suffixMask128) + } + } + + // MARK: - Description Tests + + @Test func testDescription() { + #expect(Prefix(length: 24)!.description == "24") + #expect(Prefix(length: 0)!.description == "0") + #expect(Prefix(length: 128)!.description == "128") + } + + // MARK: - Validation Tests + + @Test func testValidationRejectsInvalidLengths() { + // Valid ranges + #expect(Prefix(length: 0) != nil) + #expect(Prefix(length: 32) != nil) + #expect(Prefix(length: 128) != nil) + + // Invalid ranges + #expect(Prefix(length: 129) == nil) + #expect(Prefix(length: 200) == nil) + #expect(Prefix(length: 255) == nil) + } + + @Test func testIPv4SpecificValidation() { + // Valid IPv4 prefixes + #expect(Prefix.ipv4(0) != nil) + #expect(Prefix.ipv4(16) != nil) + #expect(Prefix.ipv4(32) != nil) + + // Invalid IPv4 prefixes + #expect(Prefix.ipv4(33) == nil) + #expect(Prefix.ipv4(64) == nil) + #expect(Prefix.ipv4(128) == nil) + } + + @Test func testIPv6SpecificValidation() { + // Valid IPv6 prefixes + #expect(Prefix.ipv6(0) != nil) + #expect(Prefix.ipv6(64) != nil) + #expect(Prefix.ipv6(128) != nil) + + // Invalid IPv6 prefixes + #expect(Prefix.ipv6(129) == nil) + #expect(Prefix.ipv6(255) == nil) + } +} diff --git a/Tests/ContainerizationExtrasTests/TestTimeout.swift b/Tests/ContainerizationExtrasTests/TestTimeout.swift new file mode 100644 index 0000000..99ef24e --- /dev/null +++ b/Tests/ContainerizationExtrasTests/TestTimeout.swift @@ -0,0 +1,57 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationExtras + +final class TestTimeoutType { + @Test + func testNoCancellation() async throws { + await #expect(throws: Never.self) { + try await Timeout.run( + for: .seconds(5), + operation: { + return + }) + } + } + + @Test + func testCancellationError() async throws { + await #expect(throws: CancellationError.self) { + try await Timeout.run( + for: .milliseconds(50), + operation: { + try await Task.sleep(for: .seconds(2)) + }) + } + } + + @Test + func testClosureError() async throws { + // Check that we get the closures error if we don't timeout, but + // the closure does throw before. + await #expect(throws: POSIXError.self) { + try await Timeout.run( + for: .seconds(10), + operation: { + throw POSIXError(.E2BIG) + }) + } + } +} diff --git a/Tests/ContainerizationExtrasTests/UInt8+DataBindingTest.swift b/Tests/ContainerizationExtrasTests/UInt8+DataBindingTest.swift new file mode 100644 index 0000000..fabc7bf --- /dev/null +++ b/Tests/ContainerizationExtrasTests/UInt8+DataBindingTest.swift @@ -0,0 +1,456 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Testing + +@testable import ContainerizationExtras + +struct BufferTest { + // MARK: - hexEncodedString Tests + + @Test func testArrayHexEncodedStringEmpty() { + let buffer: [UInt8] = [] + #expect(buffer.hexEncodedString() == "") + } + + @Test func testArrayHexEncodedStringSingleByte() { + let buffer: [UInt8] = [0xFF] + #expect(buffer.hexEncodedString() == "ff") + } + + @Test func testArrayHexEncodedStringMultipleBytes() { + let buffer: [UInt8] = [0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF] + #expect(buffer.hexEncodedString() == "0123456789abcdef") + } + + @Test func testArrayHexEncodedStringZeroes() { + let buffer: [UInt8] = [0x00, 0x00, 0x00] + #expect(buffer.hexEncodedString() == "000000") + } + + @Test func testArraySliceHexEncodedStringEmpty() { + let buffer: [UInt8] = [0x01, 0x02, 0x03] + let slice = buffer[0..<0] + #expect(slice.hexEncodedString() == "") + } + + @Test func testArraySliceHexEncodedStringSingleByte() { + let buffer: [UInt8] = [0x01, 0x02, 0x03] + let slice = buffer[1..<2] + #expect(slice.hexEncodedString() == "02") + } + + @Test func testArraySliceHexEncodedStringMultipleBytes() { + let buffer: [UInt8] = [0x00, 0xAA, 0xBB, 0xCC, 0x00] + let slice = buffer[1..<4] + #expect(slice.hexEncodedString() == "aabbcc") + } + + // MARK: - bind Tests + + @Test func testBufferBind() throws { + let expectedValue: UInt64 = 0x0102_0304_0506_0708 + let expectedBuffer: [UInt8] = [ + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, + ] + var buffer = [UInt8](repeating: 0, count: 3 * MemoryLayout.size) + guard let ptr = buffer.bind(as: UInt64.self, offset: 2 * MemoryLayout.size) else { + #expect(Bool(false), "could not bind value to buffer") + return + } + + ptr.pointee = expectedValue + #expect(buffer == expectedBuffer) + } + + @Test func testBufferBindZeroOffset() { + let expectedValue: UInt32 = 0x1234_5678 + var buffer = [UInt8](repeating: 0, count: 8) + guard let ptr = buffer.bind(as: UInt32.self, offset: 0) else { + #expect(Bool(false), "could not bind value to buffer at offset 0") + return + } + + ptr.pointee = expectedValue + #expect(buffer[0] == 0x78) + #expect(buffer[1] == 0x56) + #expect(buffer[2] == 0x34) + #expect(buffer[3] == 0x12) + } + + @Test func testBufferBindRangeError() throws { + var buffer = [UInt8](repeating: 0, count: 3 * MemoryLayout.size) + #expect(buffer.bind(as: UInt64.self, offset: 2 * MemoryLayout.size + 1) == nil) + } + + @Test func testBufferBindRangeErrorExactBoundary() { + var buffer = [UInt8](repeating: 0, count: 8) + // Trying to bind UInt64 at offset 1 requires 9 bytes total + #expect(buffer.bind(as: UInt64.self, offset: 1) == nil) + } + + @Test func testBufferBindWithCustomSize() { + var buffer = [UInt8](repeating: 0, count: 16) + // Request a size larger than the type + guard let ptr = buffer.bind(as: UInt32.self, offset: 4, size: 8) else { + #expect(Bool(false), "could not bind with custom size") + return + } + + ptr.pointee = 0xAABB_CCDD + #expect(buffer[4] == 0xDD) + #expect(buffer[5] == 0xCC) + #expect(buffer[6] == 0xBB) + #expect(buffer[7] == 0xAA) + } + + @Test func testBufferBindWithCustomSizeRangeError() { + var buffer = [UInt8](repeating: 0, count: 10) + // Request size 8 at offset 4 would require 12 bytes total + #expect(buffer.bind(as: UInt32.self, offset: 4, size: 8) == nil) + } + + // MARK: - copyIn Tests + + @Test func testCopyInUInt8() { + var buffer = [UInt8](repeating: 0, count: 4) + let value: UInt8 = 0x42 + + guard let offset = buffer.copyIn(as: UInt8.self, value: value, offset: 2) else { + #expect(Bool(false), "could not copy UInt8 to buffer") + return + } + + #expect(offset == 3) + #expect(buffer[2] == 0x42) + } + + @Test func testCopyInUInt16() { + var buffer = [UInt8](repeating: 0, count: 8) + let value: UInt16 = 0x1234 + + guard let offset = buffer.copyIn(as: UInt16.self, value: value, offset: 3) else { + #expect(Bool(false), "could not copy UInt16 to buffer") + return + } + + #expect(offset == 5) + #expect(buffer[3] == 0x34) + #expect(buffer[4] == 0x12) + } + + @Test func testCopyInUInt32() { + var buffer = [UInt8](repeating: 0, count: 8) + let value: UInt32 = 0x1234_5678 + + guard let offset = buffer.copyIn(as: UInt32.self, value: value, offset: 0) else { + #expect(Bool(false), "could not copy UInt32 to buffer") + return + } + + #expect(offset == 4) + #expect(buffer[0] == 0x78) + #expect(buffer[1] == 0x56) + #expect(buffer[2] == 0x34) + #expect(buffer[3] == 0x12) + } + + @Test func testCopyInUInt64() { + var buffer = [UInt8](repeating: 0, count: 16) + let value: UInt64 = 0x0102_0304_0506_0708 + + guard let offset = buffer.copyIn(as: UInt64.self, value: value, offset: 4) else { + #expect(Bool(false), "could not copy UInt64 to buffer") + return + } + + #expect(offset == 12) + #expect(buffer[4] == 0x08) + #expect(buffer[5] == 0x07) + #expect(buffer[6] == 0x06) + #expect(buffer[7] == 0x05) + #expect(buffer[8] == 0x04) + #expect(buffer[9] == 0x03) + #expect(buffer[10] == 0x02) + #expect(buffer[11] == 0x01) + } + + @Test func testCopyInRangeError() { + var buffer = [UInt8](repeating: 0, count: 8) + let value: UInt64 = 0x1234_5678_90AB_CDEF + + // Offset 4 + size 8 = 12, but buffer only has 8 bytes + #expect(buffer.copyIn(as: UInt64.self, value: value, offset: 4) == nil) + } + + @Test func testCopyInExactBoundary() { + var buffer = [UInt8](repeating: 0, count: 8) + let value: UInt64 = 0xFEDC_BA98_7654_3210 + + guard let offset = buffer.copyIn(as: UInt64.self, value: value, offset: 0) else { + #expect(Bool(false), "could not copy UInt64 at exact boundary") + return + } + + #expect(offset == 8) + } + + @Test func testCopyInWithCustomSize() { + var buffer = [UInt8](repeating: 0, count: 16) + let value: UInt32 = 0xAABB_CCDD + + // Copy with custom size of 8 (larger than UInt32's 4 bytes) + guard let offset = buffer.copyIn(as: UInt32.self, value: value, offset: 2, size: 8) else { + #expect(Bool(false), "could not copy with custom size") + return + } + + #expect(offset == 6) // offset + MemoryLayout.size + #expect(buffer[2] == 0xDD) + #expect(buffer[3] == 0xCC) + #expect(buffer[4] == 0xBB) + #expect(buffer[5] == 0xAA) + } + + @Test func testCopyInWithCustomSizeRangeError() { + var buffer = [UInt8](repeating: 0, count: 8) + let value: UInt32 = 0x1234_5678 + + // Request size 8 at offset 2 would require 10 bytes total + #expect(buffer.copyIn(as: UInt32.self, value: value, offset: 2, size: 8) == nil) + } + + // MARK: - copyOut Tests + + @Test func testCopyOutUInt8() { + let buffer: [UInt8] = [0x00, 0x11, 0x22, 0x33] + + guard let (offset, value) = buffer.copyOut(as: UInt8.self, offset: 2) else { + #expect(Bool(false), "could not copy out UInt8") + return + } + + #expect(offset == 3) + #expect(value == 0x22) + } + + @Test func testCopyOutUInt16() { + let buffer: [UInt8] = [0x00, 0x11, 0x22, 0x33, 0x44, 0x55] + + guard let (offset, value) = buffer.copyOut(as: UInt16.self, offset: 2) else { + #expect(Bool(false), "could not copy out UInt16") + return + } + + #expect(offset == 4) + #expect(value == 0x3322) + } + + @Test func testCopyOutUInt32() { + let buffer: [UInt8] = [0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC, 0xDE, 0xF0] + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: 0) else { + #expect(Bool(false), "could not copy out UInt32") + return + } + + #expect(offset == 4) + #expect(value == 0x7856_3412) + } + + @Test func testCopyOutUInt64() { + let buffer: [UInt8] = [ + 0x00, 0x00, 0x00, 0x00, + 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, + 0xFF, 0xFF, + ] + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: 4) else { + #expect(Bool(false), "could not copy out UInt64") + return + } + + #expect(offset == 12) + #expect(value == 0x8877_6655_4433_2211) + } + + @Test func testCopyOutRangeError() { + let buffer: [UInt8] = [0x00, 0x11, 0x22, 0x33] + + // Trying to read UInt64 from offset 0 with only 4 bytes + #expect(buffer.copyOut(as: UInt64.self, offset: 0) == nil) + } + + @Test func testCopyOutExactBoundary() { + let buffer: [UInt8] = [0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08] + + guard let (offset, value) = buffer.copyOut(as: UInt64.self, offset: 0) else { + #expect(Bool(false), "could not copy out at exact boundary") + return + } + + #expect(offset == 8) + #expect(value == 0x0807_0605_0403_0201) + } + + @Test func testCopyOutWithCustomSize() { + let buffer: [UInt8] = [0x00, 0x00, 0x11, 0x22, 0x33, 0x44, 0xFF, 0xFF, 0xFF, 0xFF] + + guard let (offset, value) = buffer.copyOut(as: UInt32.self, offset: 2, size: 8) else { + #expect(Bool(false), "could not copy out with custom size") + return + } + + #expect(offset == 6) // offset + MemoryLayout.size + #expect(value == 0x4433_2211) + } + + @Test func testCopyOutWithCustomSizeRangeError() { + let buffer: [UInt8] = [0x00, 0x11, 0x22, 0x33, 0x44, 0x55] + + // Request size 8 at offset 2 would require 10 bytes total, but buffer only has 6 + #expect(buffer.copyOut(as: UInt32.self, offset: 2, size: 8) == nil) + } + + // MARK: - copyIn(buffer:) and copyOut(buffer:) Tests + + @Test func testBufferCopy() throws { + let inputBuffer: [UInt8] = [0x01, 0x02, 0x03] + var buffer = [UInt8](repeating: 0, count: 9) + + guard let offset = buffer.copyIn(buffer: inputBuffer, offset: 4) else { + #expect(Bool(false), "could not copy to buffer") + return + } + #expect(offset == 7) + + guard let offset = buffer.copyIn(buffer: inputBuffer, offset: 6) else { + #expect(Bool(false), "could not copy to buffer") + return + } + #expect(offset == 9) + + let expectedBuffer: [UInt8] = [ + 0x00, 0x00, 0x00, 0x00, 0x01, 0x02, 0x01, 0x02, 0x03, + ] + #expect(expectedBuffer == buffer) + + var outputBuffer = [UInt8](repeating: 0, count: 3) + guard let offset = buffer.copyOut(buffer: &outputBuffer, offset: 6) else { + #expect(Bool(false), "could not copy to buffer") + return + } + #expect(offset == 9) + + let expectedOutputBuffer: [UInt8] = [ + 0x01, 0x02, 0x03, + ] + #expect(expectedOutputBuffer == outputBuffer) + } + + @Test func testBufferCopyZeroOffset() { + let inputBuffer: [UInt8] = [0xAA, 0xBB, 0xCC] + var buffer = [UInt8](repeating: 0, count: 5) + + guard let offset = buffer.copyIn(buffer: inputBuffer, offset: 0) else { + #expect(Bool(false), "could not copy to buffer at offset 0") + return + } + + #expect(offset == 3) + #expect(buffer[0] == 0xAA) + #expect(buffer[1] == 0xBB) + #expect(buffer[2] == 0xCC) + } + + @Test func testBufferCopyEmptyBuffer() { + let inputBuffer: [UInt8] = [] + var buffer = [UInt8](repeating: 0, count: 5) + + guard let offset = buffer.copyIn(buffer: inputBuffer, offset: 2) else { + #expect(Bool(false), "could not copy empty buffer") + return + } + + #expect(offset == 2) + } + + @Test func testBufferCopyExactFit() { + let inputBuffer: [UInt8] = [0x01, 0x02, 0x03] + var buffer = [UInt8](repeating: 0, count: 6) + + guard let offset = buffer.copyIn(buffer: inputBuffer, offset: 3) else { + #expect(Bool(false), "could not copy to exact fit") + return + } + + #expect(offset == 6) + } + + @Test func testBufferCopyRangeError() throws { + let inputBuffer: [UInt8] = [0x01, 0x02, 0x03] + var buffer = [UInt8](repeating: 0, count: 9) + + #expect(buffer.copyIn(buffer: inputBuffer, offset: 7) == nil) + + var outputBuffer = [UInt8](repeating: 0, count: 3) + #expect(buffer.copyOut(buffer: &outputBuffer, offset: 7) == nil) + } + + @Test func testBufferCopyOutZeroOffset() { + let buffer: [UInt8] = [0x11, 0x22, 0x33, 0x44, 0x55] + var outputBuffer = [UInt8](repeating: 0, count: 3) + + guard let offset = buffer.copyOut(buffer: &outputBuffer, offset: 0) else { + #expect(Bool(false), "could not copy out at offset 0") + return + } + + #expect(offset == 3) + #expect(outputBuffer[0] == 0x11) + #expect(outputBuffer[1] == 0x22) + #expect(outputBuffer[2] == 0x33) + } + + @Test func testBufferCopyOutEmptyBuffer() { + let buffer: [UInt8] = [0x11, 0x22, 0x33] + var outputBuffer: [UInt8] = [] + + guard let offset = buffer.copyOut(buffer: &outputBuffer, offset: 1) else { + #expect(Bool(false), "could not copy out to empty buffer") + return + } + + #expect(offset == 1) + } + + @Test func testBufferCopyOutExactFit() { + let buffer: [UInt8] = [0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF] + var outputBuffer = [UInt8](repeating: 0, count: 3) + + guard let offset = buffer.copyOut(buffer: &outputBuffer, offset: 3) else { + #expect(Bool(false), "could not copy out exact fit") + return + } + + #expect(offset == 6) + #expect(outputBuffer[0] == 0xDD) + #expect(outputBuffer[1] == 0xEE) + #expect(outputBuffer[2] == 0xFF) + } +} diff --git a/Tests/ContainerizationNetlinkTests/MockNetlinkSocket.swift b/Tests/ContainerizationNetlinkTests/MockNetlinkSocket.swift new file mode 100644 index 0000000..eb0d3ca --- /dev/null +++ b/Tests/ContainerizationNetlinkTests/MockNetlinkSocket.swift @@ -0,0 +1,57 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +@testable import ContainerizationNetlink + +class MockNetlinkSocket: NetlinkSocket { + static let ENOMEM: Int32 = 12 + static let EOVERFLOW: Int32 = 75 + + var pid: UInt32 = 0 + + var requests: [[UInt8]] = [] + var responses: [[UInt8]] = [] + + var responseIndex = 0 + + public init() throws {} + + public func send(buf: UnsafeRawPointer!, len: Int, flags: Int32) throws -> Int { + let ptr = buf.bindMemory(to: UInt8.self, capacity: len) + requests.append(Array(UnsafeBufferPointer(start: ptr, count: len))) + return len + } + + public func recv(buf: UnsafeMutableRawPointer!, len: Int, flags: Int32) throws -> Int { + guard responseIndex < responses.count else { + throw NetlinkSocketError.recvFailure(rc: Self.ENOMEM) + } + + let response = responses[responseIndex] + guard len >= response.count else { + throw NetlinkSocketError.recvFailure(rc: 75) + } + + response.withUnsafeBytes { bytes in + buf.copyMemory(from: bytes.baseAddress!, byteCount: response.count) + } + + responseIndex += 1 + return response.count + } +} diff --git a/Tests/ContainerizationNetlinkTests/NetlinkSessionTest.swift b/Tests/ContainerizationNetlinkTests/NetlinkSessionTest.swift new file mode 100644 index 0000000..6c31a0c --- /dev/null +++ b/Tests/ContainerizationNetlinkTests/NetlinkSessionTest.swift @@ -0,0 +1,665 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import ContainerizationOS +import Testing + +@testable import ContainerizationNetlink + +struct NetlinkSessionTest { + @Test func testNetworkLinkDown() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME (“eth0”) + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no RT attrs + ) + ) + + // Link‑down request – 32‑byte payload, no attributes. + let expectedDownRequest = + "2000000010000500000000000cc00cc0" // Netlink header (16 B) + + "110000000200000000000000ffffffff" // struct ifinfomsg (16 B) – no RT attrs + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000200000001000050000000000" // nlmsg_err payload (16 B) + + "0c000000" // first 4 B of echoed header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.linkSet(interface: "eth0", up: false) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedDownRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkLinkUp() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0x0cc0_0cc0 + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "340000001200010000000000c00cc00c" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME (“eth0”) + mockSocket.responses.append( + [UInt8]( + hex: + "200000001000000000000000c00cc00c" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Network up for interface. + let expectedUpRequest = + "280000001000050000000000c00cc00c" // Netlink header (16 B) + + "110000000200000001000000ffffffff" // struct ifinfomsg (16 B) + + "0800040000050000" // RT attr: IFLA_MTU = 1280 (8 B) + mockSocket.responses.append( + [UInt8]( + hex: + "240000000200000100000000c00cc00c" // Netlink header (16 B) + + "00000000200000001000050000000000" // nlmsg_err payload (16 B) + + "11000000" // 1st 4 B of echoed offending header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.linkSet(interface: "eth0", up: true, mtu: 1280) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedUpRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkLinkUpLoopback() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup loopback interface + let expectedLookupRequest = + "3000000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d0009000000080003006c6f0000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME (“lo”) + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100010000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Link up request for loopback, 32‑byte payload and no attributes + let expectedUpRequest = + "2000000010000500000000000cc00cc0" // Netlink header (16 B) + + "110000000100000001000000ffffffff" // struct ifinfomsg (16 B) – no RT attrs + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000200000001000050000000000" // nlmsg_err payload (16 B) + + "0c000000" // first 4 B of echoed offending header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.linkSet(interface: "lo", up: true) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedUpRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkLinkGetEth0() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0x1234_5678 + + // Lookup interface by name, truncated response with three attributes. + let expectedLookupRequest = + "34000000120001000000000078563412" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME (“eth0”) + mockSocket.responses.append( + [UInt8]( + hex: + "48000000100000000000000078563412" // Netlink header (16 B) + + "00000100020000004300010000000000" // struct ifinfomsg (16 B) + + "090003006574683000000000" // IFLA_IFNAME (“eth0”) attr (12 B) + + "08000d00e8030000" // IFLA_MTU = 1000 attr (8 B) + + "0500100006000000" // attr type 0x0010 (8 B) + + "0a000100825524c244030000" // IFLA_ADDRESS = 82:55:24:c2:44:03 (12 B) + ) + ) + + let session = NetlinkSession(socket: mockSocket) + let links = try session.linkGet(interface: "eth0") + + #expect(mockSocket.requests.count == 1) + #expect(mockSocket.responseIndex == 1) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + try #require(links.count == 1) + + #expect(links[0].interfaceIndex == 2) + #expect(links[0].interfaceFlags == 0x0001_0043) + #expect(links[0].interfaceType == 1) + #expect(links[0].isEthernet) + #expect(!links[0].isLoopback) + #expect(links[0].address == [0x82, 0x55, 0x24, 0xc2, 0x44, 0x03]) + try #require(links[0].attrDatas.count == 4) + #expect(links[0].attrDatas[0].attribute.type == 0x0003) + #expect(links[0].attrDatas[0].attribute.len == 0x0009) + #expect(links[0].attrDatas[0].data == [0x65, 0x74, 0x68, 0x30, 0x00]) + #expect(links[0].attrDatas[1].attribute.type == 0x000d) + #expect(links[0].attrDatas[1].attribute.len == 0x0008) + #expect(links[0].attrDatas[1].data == [0xe8, 0x03, 0x00, 0x00]) + #expect(links[0].attrDatas[2].attribute.type == 0x0010) + #expect(links[0].attrDatas[2].attribute.len == 0x0005) + #expect(links[0].attrDatas[2].data == [0x06]) + } + + @Test func testNetworkLinkGet() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0x8765_4321 + + // Lookup all interfaces, responses with only the interface name attribute. + let expectedLookupRequest = + "28000000120001030000000021436587" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d0009000000" // RT attr: IFLA_EXT_MASK (8 B) + mockSocket.responses.append( + [UInt8]( + hex: + "28000000100002000000000021436587" // Netlink header (16 B) + + "00000403010000004900010000000000" // struct ifinfomsg (16 B) + + "070003006c6f0000" // IFLA_IFNAME “lo” (8 B, padded) + ) + ) + mockSocket.responses.append( + [UInt8]( + hex: + "2c000000100002000000000021436587" // Netlink header (16 B) + + "00000003040000008000000000000000" // struct ifinfomsg (16 B) + + "0a00030074756e6c30000000" // IFLA_IFNAME “tunl0” attr (12 B, padded) + ) + ) + mockSocket.responses.append( + [UInt8]( + hex: + "14000000030002000000000021436587" // Netlink header (16 B) – NLMSG_DONE + + "00000000" // 4-byte payload + ) + ) + + let session = NetlinkSession(socket: mockSocket) + let links = try session.linkGet() + + #expect(mockSocket.requests.count == 1) + #expect(mockSocket.responseIndex == 3) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + try #require(links.count == 2) + + #expect(links[0].interfaceIndex == 1) + try #require(links[0].attrDatas.count == 1) + #expect(links[0].attrDatas[0].attribute.type == 0x0003) + #expect(links[0].attrDatas[0].attribute.len == 0x0007) + #expect(links[0].attrDatas[0].data == [0x6c, 0x6f, 0x00]) + + #expect(links[1].interfaceIndex == 4) + try #require(links[1].attrDatas.count == 1) + #expect(links[1].attrDatas[0].attribute.type == 0x0003) + #expect(links[1].attrDatas[0].attribute.len == 0x000a) + #expect(links[1].attrDatas[0].data == [0x74, 0x75, 0x6e, 0x6c, 0x30, 0x00]) + } + + @Test func testNetworkAddressAdd() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME (“eth0”) + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Network down for interface. + let expectedAddRequest = + "2800000014000506000000000cc00cc0" // Netlink header (16 B) + + "0218000002000000" // ifaddrmsg (8 B): AF_INET, /24, ifindex 2 + + "08000200c0a840fa" // RT attr: IFA_LOCAL 192.168.64.250 + + "08000100c0a840fa" // RT attr: IFA_ADDRESS 192.168.64.250 + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" // first 4 B of echoed offending header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.addressAdd(interface: "eth0", ipv4Address: try CIDRv4("192.168.64.250/24")) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkAddressAddIPv6() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add IPv6 address to interface. + let expectedAddRequest = + "2c00000014000506000000000cc00cc0" // Netlink header (16 B): len=44 + + "0a40820002000000" // ifaddrmsg (8 B): AF_INET6, /64, flags=PERMANENT|NODAD, ifindex 2 + + "14000100fd000000000000000000000000000001" // RT attr: IFA_ADDRESS fd00::1 + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "0000000040000000140005060000000000000000" // nlmsg_err payload (20 B) + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.addressAdd(interface: "eth0", ipv6Address: try CIDRv6("fd00::1/64")) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkRouteAddIpLink() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add link route. + let expectedAddRequest = + "3400000018000506000000000cc00cc0" // Netlink header (16 B) + + "02180000fe02fd0100000000" // struct rtmsg (12 B): AF_INET, dst/24, + // table=RT_TABLE_MAIN (0xfe), proto=RTPROT_KERNEL (0x02), + // scope=RT_SCOPE_LINK (0xfd), type=RTN_UNICAST (0x01) + + "08000100c0a84000" // RTA_DST 192.168.64.0 + + "08000700c0a84003" // RTA_PREFSRC 192.168.64.3 + + "0800040002000000" // RTA_OIF ifindex 2 (eth0) + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" // first 4 B of echoed offending header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.routeAdd( + interface: "eth0", + dstIpv4Addr: try CIDRv4("192.168.64.0/24"), + srcIpv4Addr: try IPv4Address("192.168.64.3") + ) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkRouteAddIpLinkWithoutSrc() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name, truncated response with no attributes (not needed at present). + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add link route without RTA_PREFSRC. + let expectedAddRequest = + "2c00000018000506000000000cc00cc0" // Netlink header (16 B) + + "02180000fe02fd0100000000" // struct rtmsg (12 B): AF_INET, dst/24, + // table=RT_TABLE_MAIN (0xfe), proto=RTPROT_KERNEL (0x02), + // scope=RT_SCOPE_LINK (0xfd), type=RTN_UNICAST (0x01) + + "08000100c0a84000" // RTA_DST 192.168.64.0 + + "0800040002000000" // RTA_OIF ifindex 2 (eth0) + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" // first 4 B of echoed offending header + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.routeAdd( + interface: "eth0", + dstIpv4Addr: try CIDRv4("192.168.64.0/24"), + srcIpv4Addr: nil + ) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkRouteAddIpv6Link() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name. + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add IPv6 link route with source. + let expectedAddRequest = + "4c00000018000506000000000cc00cc0" // Netlink header (16 B): len=76 + + "0a400000fe04fd0100000000" // struct rtmsg (12 B): AF_INET6, dst/64, + // table=MAIN(0xfe), proto=STATIC(0x04), scope=LINK(0xfd), type=UNICAST(0x01) + + "14000100fd000000000000000000000000000000" // RTA_DST fd00:: + + "14000700fd000000000000000000000000000001" // RTA_PREFSRC fd00::1 + + "0800040002000000" // RTA_OIF ifindex 2 (eth0) + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.routeAdd( + interface: "eth0", + dstIpv6Addr: try CIDRv6("fd00::/64"), + srcIpv6Addr: try IPv6Address("fd00::1") + ) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkRouteAddIpv6LinkWithoutSrc() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name. + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add IPv6 link route without source. + let expectedAddRequest = + "3800000018000506000000000cc00cc0" // Netlink header (16 B): len=56 + + "0a400000fe04fd0100000000" // struct rtmsg (12 B): AF_INET6, dst/64 + + "14000100fd000000000000000000000000000000" // RTA_DST fd00:: + + "0800040002000000" // RTA_OIF ifindex 2 (eth0) + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.routeAdd( + interface: "eth0", + dstIpv6Addr: try CIDRv6("fd00::/64"), + srcIpv6Addr: nil + ) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkRouteAddDefaultIpv6() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0xc00c_c00c + + // Lookup interface by name. + let expectedLookupRequest = + "3400000012000100000000000cc00cc0" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d00090000000c0003006574683000000000" // RT attrs: IFLA_EXT_MASK + IFLA_IFNAME ("eth0") + mockSocket.responses.append( + [UInt8]( + hex: + "2000000010000000000000000cc00cc0" // Netlink header (16 B) + + "00000100020000004310010000000000" // struct ifinfomsg (16 B) – no attributes + ) + ) + + // Add default IPv6 route via gateway. + let expectedAddRequest = + "3800000018000506000000000cc00cc0" // Netlink header (16 B): len=56 + + "0a000000fe03000100000000" // struct rtmsg (12 B): AF_INET6, dst/0, + // table=MAIN(0xfe), proto=BOOT(0x03), scope=UNIVERSE(0x00), type=UNICAST(0x01) + + "14000500fd000000000000000000000000000001" // RTA_GATEWAY fd00::1 + + "0800040002000000" // RTA_OIF ifindex 2 (eth0) + mockSocket.responses.append( + [UInt8]( + hex: + "2400000002000001000000000cc00cc0" // Netlink header (16 B) + + "00000000280000001400050600000000" // nlmsg_err payload (16 B) + + "1f000000" + ) + ) + + let session = NetlinkSession(socket: mockSocket) + try session.routeAddDefault( + interface: "eth0", + ipv6Gateway: try IPv6Address("fd00::1") + ) + + #expect(mockSocket.requests.count == 2) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + mockSocket.requests[1][8..<12] = [0, 0, 0, 0] + #expect(expectedAddRequest == mockSocket.requests[1].hexEncodedString()) + } + + @Test func testNetworkLinkGetMultipleMessagesInSingleBuffer() throws { + let mockSocket = try MockNetlinkSocket() + mockSocket.pid = 0x8765_4321 + + // Lookup all interfaces, with multiple messages packed into a single buffer. + // This tests the fix for parsing multiple netlink messages that arrive in one recv() call. + let expectedLookupRequest = + "28000000120001030000000021436587" // Netlink header (16 B) + + "110000000000000001000000ffffffff" // struct ifinfomsg (16 B) + + "08001d0009000000" // RT attr: IFLA_EXT_MASK (8 B) + + // Pack three messages into a single response buffer: + // + // Message 1: loopback interface with one attribute + let msg1 = + "28000000100002000000000021436587" // Netlink header (16 B), len=40 + + "00000403010000004900010000000000" // struct ifinfomsg (16 B) + + "070003006c6f0000" // IFLA_IFNAME "lo" (8 B, padded) + + // Message 2: tunl0 interface with one attribute + let msg2 = + "2c000000100002000000000021436587" // Netlink header (16 B), len=44 + + "00000003040000008000000000000000" // struct ifinfomsg (16 B) + + "0a00030074756e6c30000000" // IFLA_IFNAME "tunl0" attr (12 B, padded) + + // Message 3: eth0 interface with two attributes + let msg3 = + "34000000100002000000000021436587" // Netlink header (16 B), len=52 + + "00000100020000004300010000000000" // struct ifinfomsg (16 B) + + "090003006574683000000000" // IFLA_IFNAME "eth0" attr (12 B) + + "08000d00e8030000" // IFLA_MTU = 1000 attr (8 B) + + // Combine all three messages into a single buffer + mockSocket.responses.append([UInt8](hex: msg1 + msg2 + msg3)) + + // Final NLMSG_DONE message in separate buffer + mockSocket.responses.append( + [UInt8]( + hex: + "14000000030002000000000021436587" // Netlink header (16 B) – NLMSG_DONE + + "00000000" // 4-byte payload + ) + ) + + let session = NetlinkSession(socket: mockSocket) + let links = try session.linkGet() + + #expect(mockSocket.requests.count == 1) + #expect(mockSocket.responseIndex == 2) + mockSocket.requests[0][8..<12] = [0, 0, 0, 0] + #expect(expectedLookupRequest == mockSocket.requests[0].hexEncodedString()) + + // Verify we got all three interfaces + try #require(links.count == 3) + + // Verify loopback interface + #expect(links[0].interfaceIndex == 1) + try #require(links[0].attrDatas.count == 1) + #expect(links[0].attrDatas[0].attribute.type == 0x0003) + #expect(links[0].attrDatas[0].attribute.len == 0x0007) + #expect(links[0].attrDatas[0].data == [0x6c, 0x6f, 0x00]) + + // Verify tunl0 interface + #expect(links[1].interfaceIndex == 4) + try #require(links[1].attrDatas.count == 1) + #expect(links[1].attrDatas[0].attribute.type == 0x0003) + #expect(links[1].attrDatas[0].attribute.len == 0x000a) + #expect(links[1].attrDatas[0].data == [0x74, 0x75, 0x6e, 0x6c, 0x30, 0x00]) + + // Verify eth0 interface + #expect(links[2].interfaceIndex == 2) + try #require(links[2].attrDatas.count == 2) + #expect(links[2].attrDatas[0].attribute.type == 0x0003) + #expect(links[2].attrDatas[0].attribute.len == 0x0009) + #expect(links[2].attrDatas[0].data == [0x65, 0x74, 0x68, 0x30, 0x00]) + #expect(links[2].attrDatas[1].attribute.type == 0x000d) + #expect(links[2].attrDatas[1].attribute.len == 0x0008) + #expect(links[2].attrDatas[1].data == [0xe8, 0x03, 0x00, 0x00]) + } +} + +extension Array where Element == UInt8 { + /// Initializes `[UInt8]` from an even-length hex string + init(hex: String) { + self = stride(from: 0, to: hex.count, by: 2).compactMap { + UInt8( + hex[hex.index(hex.startIndex, offsetBy: $0)...] + .prefix(2), radix: 16) + } + } +} diff --git a/Tests/ContainerizationNetlinkTests/TypesTest.swift b/Tests/ContainerizationNetlinkTests/TypesTest.swift new file mode 100644 index 0000000..1ca9ef9 --- /dev/null +++ b/Tests/ContainerizationNetlinkTests/TypesTest.swift @@ -0,0 +1,221 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Testing + +@testable import ContainerizationNetlink + +struct TypesTest { + @Test func testNetlinkMessageHeader() throws { + let expectedValue = NetlinkMessageHeader( + len: 0x1234_5678, type: 0x9abc, flags: 0xdef0, seq: 0x1122_3344, pid: 0x5566_7788) + let expectedBuffer: [UInt8] = [ + 0x78, 0x56, 0x34, 0x12, + 0xbc, 0x9a, 0xf0, 0xde, + 0x44, 0x33, 0x22, 0x11, + 0x88, 0x77, 0x66, 0x55, + ] + var buffer = [UInt8](repeating: 0, count: NetlinkMessageHeader.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(NetlinkMessageHeader.size == offset) + #expect(expectedBuffer == buffer) + guard let (offset, value) = buffer.copyOut(as: NetlinkMessageHeader.self) else { + #expect(Bool(false), "could not bind value to buffer") + return + + } + + #expect(offset == NetlinkMessageHeader.size) + #expect(expectedValue == value) + } + + @Test func testInterfaceInfo() throws { + let expectedValue = InterfaceInfo( + family: UInt8(AddressFamily.AF_NETLINK), type: 0x1234, index: 0x1234_5678, flags: 0x9abc_def0, + change: 0x0fed_cba9 + ) + let expectedBuffer: [UInt8] = [ + 0x10, 0x00, 0x34, 0x12, + 0x78, 0x56, 0x34, 0x12, + 0xf0, 0xde, 0xbc, 0x9a, + 0xa9, 0xcb, 0xed, 0x0f, + ] + var buffer = [UInt8](repeating: 0, count: InterfaceInfo.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(InterfaceInfo.size == offset) + #expect(expectedBuffer == buffer) + guard let (offset, value) = buffer.copyOut(as: InterfaceInfo.self) else { + #expect(Bool(false), "could not bind value to buffer") + return + + } + + #expect(offset == InterfaceInfo.size) + #expect(expectedValue == value) + } + + @Test func testAddressInfo() throws { + let expectedValue = AddressInfo( + family: UInt8(AddressFamily.AF_INET), prefixLength: 24, flags: 0x5a, scope: 0xa5, index: 0xdead_beef) + let expectedBuffer: [UInt8] = [ + 0x02, 0x18, 0x5a, 0xa5, + 0xef, 0xbe, 0xad, 0xde, + ] + var buffer = [UInt8](repeating: 0, count: AddressInfo.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(AddressInfo.size == offset) + #expect(expectedBuffer == buffer) + guard let (offset, value) = buffer.copyOut(as: AddressInfo.self) else { + #expect(Bool(false), "could not bind value to buffer") + return + + } + + #expect(offset == AddressInfo.size) + #expect(expectedValue == value) + } + + @Test func testRTAttribute() throws { + let expectedValue = RTAttribute(len: 0x1234, type: 0x5678) + let expectedBuffer: [UInt8] = [ + 0x34, 0x12, 0x78, 0x56, + ] + var buffer = [UInt8](repeating: 0, count: RTAttribute.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(RTAttribute.size == offset) + #expect(expectedBuffer == buffer) + guard let (offset, value) = buffer.copyOut(as: RTAttribute.self) else { + #expect(Bool(false), "could not bind value to buffer") + return + + } + + #expect(offset == RTAttribute.size) + #expect(expectedValue == value) + } + + @Test func testSockaddrNetlink() throws { + let expectedValue = SockaddrNetlink(family: 16, pid: 0x1234_5678, groups: 0x9abc_def0) + let expectedBuffer: [UInt8] = [ + 0x10, 0x00, 0x00, 0x00, + 0x78, 0x56, 0x34, 0x12, + 0xf0, 0xde, 0xbc, 0x9a, + ] + var buffer = [UInt8](repeating: 0, count: SockaddrNetlink.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(SockaddrNetlink.size == offset) + #expect(expectedBuffer == buffer) + + var unmarshaledValue = SockaddrNetlink() + let bindOffset = try unmarshaledValue.bindBuffer(&buffer, offset: 0) + #expect(bindOffset == SockaddrNetlink.size) + #expect(expectedValue == unmarshaledValue) + } + + @Test func testRouteInfo() throws { + let expectedValue = RouteInfo( + family: UInt8(AddressFamily.AF_INET), + dstLen: 24, + srcLen: 0, + tos: 0, + table: RouteTable.MAIN, + proto: RouteProtocol.KERNEL, + scope: RouteScope.LINK, + type: RouteType.UNICAST, + flags: 0xdead_beef + ) + let expectedBuffer: [UInt8] = [ + 0x02, 0x18, 0x00, 0x00, + 0xfe, 0x02, 0xfd, 0x01, + 0xef, 0xbe, 0xad, 0xde, + ] + var buffer = [UInt8](repeating: 0, count: RouteInfo.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(RouteInfo.size == offset) + #expect(expectedBuffer == buffer) + + var unmarshaledValue = RouteInfo( + dstLen: 0, srcLen: 0, tos: 0, table: 0, proto: 0, scope: 0, type: 0, flags: 0) + let bindOffset = try unmarshaledValue.bindBuffer(&buffer, offset: 0) + #expect(bindOffset == RouteInfo.size) + #expect(expectedValue == unmarshaledValue) + } + + @Test func testLinkStatistics64() throws { + var expectedValue = LinkStatistics64() + expectedValue.rxPackets = 0x0102_0304_0506_0708 + expectedValue.txPackets = 0x090a_0b0c_0d0e_0f10 + expectedValue.rxBytes = 0x1112_1314_1516_1718 + expectedValue.txBytes = 0x191a_1b1c_1d1e_1f20 + expectedValue.rxErrors = 0x2122_2324_2526_2728 + expectedValue.txErrors = 0x292a_2b2c_2d2e_2f30 + expectedValue.rxDropped = 0x3132_3334_3536_3738 + expectedValue.txDropped = 0x393a_3b3c_3d3e_3f40 + expectedValue.multicast = 0x4142_4344_4546_4748 + expectedValue.collisions = 0x494a_4b4c_4d4e_4f50 + expectedValue.rxLengthErrors = 0x5152_5354_5556_5758 + expectedValue.rxOverErrors = 0x595a_5b5c_5d5e_5f60 + expectedValue.rxCrcErrors = 0x6162_6364_6566_6768 + expectedValue.rxFrameErrors = 0x696a_6b6c_6d6e_6f70 + expectedValue.rxFifoErrors = 0x7172_7374_7576_7778 + expectedValue.rxMissedErrors = 0x797a_7b7c_7d7e_7f80 + expectedValue.txAbortedErrors = 0x8182_8384_8586_8788 + expectedValue.txCarrierErrors = 0x898a_8b8c_8d8e_8f90 + expectedValue.txFifoErrors = 0x9192_9394_9596_9798 + expectedValue.txHeartbeatErrors = 0x999a_9b9c_9d9e_9fa0 + expectedValue.txWindowErrors = 0xa1a2_a3a4_a5a6_a7a8 + expectedValue.rxCompressed = 0xa9aa_abac_adae_afb0 + expectedValue.txCompressed = 0xb1b2_b3b4_b5b6_b7b8 + + let expectedBuffer: [UInt8] = [ + 0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, + 0x10, 0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, + 0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, + 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19, + 0x28, 0x27, 0x26, 0x25, 0x24, 0x23, 0x22, 0x21, + 0x30, 0x2f, 0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, + 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, + 0x40, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a, 0x39, + 0x48, 0x47, 0x46, 0x45, 0x44, 0x43, 0x42, 0x41, + 0x50, 0x4f, 0x4e, 0x4d, 0x4c, 0x4b, 0x4a, 0x49, + 0x58, 0x57, 0x56, 0x55, 0x54, 0x53, 0x52, 0x51, + 0x60, 0x5f, 0x5e, 0x5d, 0x5c, 0x5b, 0x5a, 0x59, + 0x68, 0x67, 0x66, 0x65, 0x64, 0x63, 0x62, 0x61, + 0x70, 0x6f, 0x6e, 0x6d, 0x6c, 0x6b, 0x6a, 0x69, + 0x78, 0x77, 0x76, 0x75, 0x74, 0x73, 0x72, 0x71, + 0x80, 0x7f, 0x7e, 0x7d, 0x7c, 0x7b, 0x7a, 0x79, + 0x88, 0x87, 0x86, 0x85, 0x84, 0x83, 0x82, 0x81, + 0x90, 0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, + 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, + 0xa0, 0x9f, 0x9e, 0x9d, 0x9c, 0x9b, 0x9a, 0x99, + 0xa8, 0xa7, 0xa6, 0xa5, 0xa4, 0xa3, 0xa2, 0xa1, + 0xb0, 0xaf, 0xae, 0xad, 0xac, 0xab, 0xaa, 0xa9, + 0xb8, 0xb7, 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1, + ] + + var buffer = [UInt8](repeating: 0, count: LinkStatistics64.size) + let offset = try expectedValue.appendBuffer(&buffer, offset: 0) + #expect(LinkStatistics64.size == offset) + #expect(expectedBuffer == buffer) + + var unmarshaledValue = LinkStatistics64() + let bindOffset = try unmarshaledValue.bindBuffer(&buffer, offset: 0) + #expect(bindOffset == LinkStatistics64.size) + #expect(expectedValue == unmarshaledValue) + } +} diff --git a/Tests/ContainerizationOCITests/AuthChallengeTests.swift b/Tests/ContainerizationOCITests/AuthChallengeTests.swift new file mode 100644 index 0000000..f862101 --- /dev/null +++ b/Tests/ContainerizationOCITests/AuthChallengeTests.swift @@ -0,0 +1,58 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationOCI + +struct AuthChallengeTests { + internal struct TestCase: Sendable { + let input: String + let expected: AuthenticateChallenge + } + + private static let testCases: [TestCase] = [ + .init( + input: """ + Bearer realm="https://domain.io/token",service="domain.io",scope="repository:user/image:pull" + """, + expected: .init(type: "Bearer", realm: "https://domain.io/token", service: "domain.io", scope: "repository:user/image:pull", error: nil)), + .init( + input: """ + Bearer realm="https://foo-bar-registry.com/auth",service="Awesome Registry" + """, + expected: .init(type: "Bearer", realm: "https://foo-bar-registry.com/auth", service: "Awesome Registry", scope: nil, error: nil)), + .init( + input: """ + Bearer realm="users.example.com", scope="create delete" + """, + expected: .init(type: "Bearer", realm: "users.example.com", service: nil, scope: "create delete", error: nil)), + .init( + input: """ + Bearer realm="https://auth.server.io/token",service="registry.server.io" + """, + expected: .init(type: "Bearer", realm: "https://auth.server.io/token", service: "registry.server.io", scope: nil, error: nil)), + + ] + + @Test(arguments: testCases) + func parseAuthHeader(testCase: TestCase) throws { + let challenges = RegistryClient.parseWWWAuthenticateHeaders(headers: [testCase.input]) + #expect(challenges.count == 1) + #expect(challenges[0] == testCase.expected) + } +} diff --git a/Tests/ContainerizationOCITests/ContentWriterTests.swift b/Tests/ContainerizationOCITests/ContentWriterTests.swift new file mode 100644 index 0000000..a13e28a --- /dev/null +++ b/Tests/ContainerizationOCITests/ContentWriterTests.swift @@ -0,0 +1,119 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationError +import Crypto +import Foundation +import Testing + +@testable import ContainerizationOCI + +@Suite("ContentWriter Tests") +struct ContentWriterTests { + private func withTempDirectory(_ body: (URL) throws -> Void) throws { + let dir = FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString) + try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true) + defer { try? FileManager.default.removeItem(at: dir) } + try body(dir) + } + + private func makeTempFile(in dir: URL, data: Data) throws -> URL { + let url = dir.appendingPathComponent(UUID().uuidString) + try data.write(to: url) + return url + } + + @Test func testWriteReturnsCorrectSizeAndDigest() throws { + try withTempDirectory { dir in + let writer = try ContentWriter(for: dir) + let data = Data("test content".utf8) + let (size, digest) = try writer.write(data) + let expected = SHA256.hash(data: data) + let destination = dir.appendingPathComponent(digest.encoded) + #expect(size == Int64(data.count)) + #expect(digest == expected) + #expect(FileManager.default.fileExists(atPath: destination.path)) + } + } + + @Test func testWriteDuplicateData() throws { + try withTempDirectory { dir in + let writer = try ContentWriter(for: dir) + let data = Data("duplicate".utf8) + #expect(throws: Never.self) { + try writer.write(data) + try writer.write(data) + } + } + } + + @Test func testCreateFromFileSmallFile() throws { + try withTempDirectory { base in + try withTempDirectory { src in + let data = Data("small file contents".utf8) + let sourceURL = try makeTempFile(in: src, data: data) + let writer = try ContentWriter(for: base) + let (size, digest) = try writer.create(from: sourceURL) + let destination = base.appendingPathComponent(digest.encoded) + let written = try Data(contentsOf: destination) + #expect(size == Int64(data.count)) + #expect(digest == SHA256.hash(data: data)) + #expect(FileManager.default.fileExists(atPath: destination.path)) + #expect(written == data) + } + } + } + + @Test func testCreateFromFileLargeFileDuplicates() throws { + try withTempDirectory { base in + try withTempDirectory { src in + let count = 3 * 1024 * 1024 + 100 + var bytes = [UInt8](repeating: 0, count: count) + arc4random_buf(&bytes, count) + let data = Data(bytes) + let sourceURL = try makeTempFile(in: src, data: data) + let writer = try ContentWriter(for: base) + let (size, digest) = try writer.create(from: sourceURL) + let destination = base.appendingPathComponent(digest.encoded) + #expect(size == Int64(data.count)) + #expect(digest == SHA256.hash(data: data)) + #expect(throws: Never.self) { + try writer.create(from: sourceURL) + } + #expect(FileManager.default.fileExists(atPath: destination.path)) + } + } + } + + private struct SamplePayload: Codable, Equatable { + let name: String + let value: Int + } + + @Test func testCreateFromEncodableReturnsCorrectDigest() throws { + try withTempDirectory { base in + let writer = try ContentWriter(for: base) + let payload = SamplePayload(name: "digest-check", value: 99) + let (size, digest) = try writer.create(from: payload) + let encoder = JSONEncoder() + encoder.outputFormatting = [.sortedKeys] + let expected = try encoder.encode(payload) + #expect(size == Int64(expected.count)) + #expect(digest == SHA256.hash(data: expected)) + } + } +} diff --git a/Tests/ContainerizationOCITests/LocalContentStoreTests.swift b/Tests/ContainerizationOCITests/LocalContentStoreTests.swift new file mode 100644 index 0000000..11f57de --- /dev/null +++ b/Tests/ContainerizationOCITests/LocalContentStoreTests.swift @@ -0,0 +1,66 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationOCI + +@Suite +struct LocalContentStoreTests { + private static let digestA = String(repeating: "a", count: 64) + private static let digestB = String(repeating: "b", count: 64) + + @Test func totalAllocatedSizeReportsZeroForEmptyStore() async throws { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + defer { try? FileManager.default.removeItem(at: dir) } + + let store = try LocalContentStore(path: dir) + let size = try await store.totalAllocatedSize() + #expect(size == 0) + } + + @Test func totalAllocatedSizeReflectsCommittedBlobs() async throws { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + defer { try? FileManager.default.removeItem(at: dir) } + + let store = try LocalContentStore(path: dir) + let payload = Data(repeating: 0xAB, count: 64 * 1024) + + try await store.ingest { tempDir in + try payload.write(to: tempDir.appendingPathComponent(Self.digestA)) + } + + let size = try await store.totalAllocatedSize() + #expect(size >= UInt64(payload.count)) + } + + @Test func totalAllocatedSizeIncludesInFlightIngest() async throws { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + defer { try? FileManager.default.removeItem(at: dir) } + + let store = try LocalContentStore(path: dir) + let payload = Data(repeating: 0xCD, count: 32 * 1024) + + let session = try await store.newIngestSession() + try payload.write(to: session.ingestDir.appendingPathComponent(Self.digestB)) + + let size = try await store.totalAllocatedSize() + #expect(size >= UInt64(payload.count)) + + try await store.cancelIngestSession(session.id) + } +} diff --git a/Tests/ContainerizationOCITests/OCIImageTests.swift b/Tests/ContainerizationOCITests/OCIImageTests.swift new file mode 100644 index 0000000..e8d7fb6 --- /dev/null +++ b/Tests/ContainerizationOCITests/OCIImageTests.swift @@ -0,0 +1,164 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Foundation +import Testing + +@testable import ContainerizationOCI + +struct OCITests { + @Test func config() { + let config = ContainerizationOCI.ImageConfig() + let rootfs = ContainerizationOCI.Rootfs(type: "foo", diffIDs: ["diff1", "diff2"]) + let history = ContainerizationOCI.History() + + let image = ContainerizationOCI.Image(architecture: "arm64", os: "linux", config: config, rootfs: rootfs, history: [history]) + #expect(image.rootfs.type == "foo") + } + + @Test func descriptor() { + let platform = ContainerizationOCI.Platform(arch: "arm64", os: "linux") + let descriptor = ContainerizationOCI.Descriptor(mediaType: MediaTypes.descriptor, digest: "123", size: 0, platform: platform) + + #expect(descriptor.platform?.architecture == "arm64") + #expect(descriptor.platform?.os == "linux") + #expect(descriptor.artifactType == nil) + } + + @Test func descriptorWithArtifactType() throws { + let testArtifactType = "application/vnd.example.test.v1+json" + let descriptor = ContainerizationOCI.Descriptor( + mediaType: MediaTypes.imageManifest, + digest: "sha256:abc123", + size: 1234, + artifactType: testArtifactType + ) + #expect(descriptor.artifactType == testArtifactType) + + let data = try JSONEncoder().encode(descriptor) + let decoded = try JSONDecoder().decode(ContainerizationOCI.Descriptor.self, from: data) + #expect(decoded.artifactType == testArtifactType) + } + + @Test func descriptorWithoutArtifactTypeDecodesAsNil() throws { + let json = """ + {"mediaType":"application/vnd.oci.descriptor.v1+json","digest":"sha256:abc","size":0} + """ + let decoded = try JSONDecoder().decode(ContainerizationOCI.Descriptor.self, from: json.data(using: .utf8)!) + #expect(decoded.artifactType == nil) + } + + @Test func index() { + var descriptors: [ContainerizationOCI.Descriptor] = [] + for i in 0..<5 { + let descriptor = ContainerizationOCI.Descriptor(mediaType: MediaTypes.descriptor, digest: "\(i)", size: Int64(i)) + descriptors.append(descriptor) + } + + let index = ContainerizationOCI.Index(schemaVersion: 1, manifests: descriptors) + #expect(index.manifests.count == 5) + #expect(index.subject == nil) + #expect(index.artifactType == nil) + } + + @Test func indexWithSubjectAndArtifactType() throws { + let testArtifactType = "application/vnd.example.test.v1+json" + let subject = ContainerizationOCI.Descriptor(mediaType: MediaTypes.imageManifest, digest: "sha256:subject", size: 512) + let index = ContainerizationOCI.Index( + schemaVersion: 2, + manifests: [], + subject: subject, + artifactType: testArtifactType + ) + #expect(index.subject?.digest == "sha256:subject") + #expect(index.artifactType == testArtifactType) + + let data = try JSONEncoder().encode(index) + let decoded = try JSONDecoder().decode(ContainerizationOCI.Index.self, from: data) + #expect(decoded.subject?.digest == "sha256:subject") + #expect(decoded.artifactType == testArtifactType) + } + + @Test func indexDecodesWithoutNewFields() throws { + let json = """ + {"schemaVersion":2,"manifests":[{"mediaType":"application/vnd.oci.descriptor.v1+json","digest":"sha256:abc","size":10}]} + """ + let decoded = try JSONDecoder().decode(ContainerizationOCI.Index.self, from: json.data(using: .utf8)!) + #expect(decoded.schemaVersion == 2) + #expect(decoded.manifests.count == 1) + #expect(decoded.subject == nil) + #expect(decoded.artifactType == nil) + } + + @Test func manifests() { + var descriptors: [ContainerizationOCI.Descriptor] = [] + for i in 0..<5 { + let descriptor = ContainerizationOCI.Descriptor(mediaType: MediaTypes.descriptor, digest: "\(i)", size: Int64(i)) + descriptors.append(descriptor) + } + + let config = ContainerizationOCI.Descriptor(mediaType: MediaTypes.descriptor, digest: "123", size: 0) + + let manifest = ContainerizationOCI.Manifest(schemaVersion: 1, config: config, layers: descriptors) + #expect(manifest.config.digest == "123") + #expect(manifest.layers.count == 5) + #expect(manifest.subject == nil) + #expect(manifest.artifactType == nil) + } + + @Test func manifestWithSubjectAndArtifactType() throws { + let testArtifactType = "application/vnd.example.test.v1+json" + let config = ContainerizationOCI.Descriptor(mediaType: MediaTypes.emptyJSON, digest: "sha256:empty", size: 2) + let subject = ContainerizationOCI.Descriptor(mediaType: MediaTypes.imageManifest, digest: "sha256:target", size: 1234) + let layer = ContainerizationOCI.Descriptor( + mediaType: testArtifactType, + digest: "sha256:meta", + size: 89, + annotations: ["org.opencontainers.image.title": "metadata.json"] + ) + + let manifest = ContainerizationOCI.Manifest( + config: config, + layers: [layer], + subject: subject, + artifactType: testArtifactType + ) + #expect(manifest.subject?.digest == "sha256:target") + #expect(manifest.artifactType == testArtifactType) + #expect(manifest.layers[0].annotations?["org.opencontainers.image.title"] == "metadata.json") + + let data = try JSONEncoder().encode(manifest) + let decoded = try JSONDecoder().decode(ContainerizationOCI.Manifest.self, from: data) + #expect(decoded.subject?.digest == "sha256:target") + #expect(decoded.artifactType == testArtifactType) + } + + @Test func manifestDecodesWithoutNewFields() throws { + let json = """ + { + "schemaVersion": 2, + "config": {"mediaType":"application/vnd.oci.empty.v1+json","digest":"sha256:abc","size":2}, + "layers": [] + } + """ + let decoded = try JSONDecoder().decode(ContainerizationOCI.Manifest.self, from: json.data(using: .utf8)!) + #expect(decoded.schemaVersion == 2) + #expect(decoded.subject == nil) + #expect(decoded.artifactType == nil) + } +} diff --git a/Tests/ContainerizationOCITests/OCIPlatformTests.swift b/Tests/ContainerizationOCITests/OCIPlatformTests.swift new file mode 100644 index 0000000..7ffebed --- /dev/null +++ b/Tests/ContainerizationOCITests/OCIPlatformTests.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Testing + +@testable import ContainerizationOCI + +struct OCIPlatformTests { + @Test func identicalPlatforms() { + let amd64lhs = Platform(arch: "amd64", os: "linux") + let amd64rhs = Platform(arch: "amd64", os: "linux") + #expect(amd64lhs == amd64rhs, "amd64 platforms should be equal") + + let arm64lhs = Platform(arch: "arm64", os: "linux") + let arm64rhs = Platform(arch: "arm64", os: "linux") + #expect(arm64lhs == arm64rhs, "arm64 platforms should be equal") + } + + @Test func differentOS() { + let lhs = Platform(arch: "arm64", os: "linux") + let rhs = Platform(arch: "arm64", os: "darwin") + #expect(lhs != rhs, "Different OS should not be equal") + } + + @Test func differentArch() { + let lhs = Platform(arch: "amd64", os: "linux") + let rhs = Platform(arch: "arm64", os: "linux") + #expect(lhs != rhs, "Different arch should not be equal") + } + + @Test func arm64_sameVariant() { + let lhs = Platform(arch: "arm64", os: "linux", variant: "v8") + let rhs = Platform(arch: "arm64", os: "linux", variant: "v8") + #expect(lhs == rhs, "Both OS arm64, same arch, same variant => equal") + } + + @Test func arm64_nilAndV8() { + let lhs = Platform(arch: "arm64", os: "linux", variant: nil) + let rhs = Platform(arch: "arm64", os: "linux", variant: "v8") + #expect(lhs == rhs, "One variant nil and other v8 => equal under special arm64 rule") + } + + @Test func arm64_nilAndV7() { + let lhs = Platform(arch: "arm64", os: "linux", variant: nil) + let rhs = Platform(arch: "arm64", os: "linux", variant: "v7") + #expect(lhs != rhs, "nil vs v7 is not covered by the special rule => not equal") + } + + @Test func arm64_bothNil() { + let lhs = Platform(arch: "arm64", os: "linux", variant: nil) + let rhs = Platform(arch: "arm64", os: "linux", variant: nil) + #expect(lhs == rhs, "Both nil variants => variantEqual is true => overall equal") + } + + @Test func arm64_nilAndV8_sameHashValue() { + let withoutVariant = Platform(arch: "arm64", os: "linux", variant: nil) + let withV8 = Platform(arch: "arm64", os: "linux", variant: "v8") + // Equal platforms must produce the same hash — violating this breaks Set/Dictionary lookups + #expect(withoutVariant.hashValue == withV8.hashValue, "arm64 nil variant and v8 must hash identically") + } + + @Test func arm64_nilAndV8_setLookup() { + let withoutVariant = Platform(arch: "arm64", os: "linux", variant: nil) + let withV8 = Platform(arch: "arm64", os: "linux", variant: "v8") + var set = Set() + set.insert(withoutVariant) + #expect(set.contains(withV8), "arm64/v8 must be found in a Set that contains arm64 with nil variant") + } +} diff --git a/Tests/ContainerizationOCITests/OCISpecTests.swift b/Tests/ContainerizationOCITests/OCISpecTests.swift new file mode 100644 index 0000000..f4539d4 --- /dev/null +++ b/Tests/ContainerizationOCITests/OCISpecTests.swift @@ -0,0 +1,168 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationOCI + +struct OCISpecTests { + @Test func minimalSpecDecode() throws { + let version = "1.2.3" + let minSpec = + """ + { + "ociVersion": "\(version)" + } + """ + + guard let data = minSpec.data(using: .utf8) else { + Issue.record("test spec is not valid: \(minSpec)") + return + } + + let decodedSpec = try JSONDecoder().decode(ContainerizationOCI.Spec.self, from: data) + #expect(decodedSpec.version == version) + #expect(decodedSpec.hooks == nil) + #expect(decodedSpec.process == nil) + #expect(decodedSpec.hostname == "") + #expect(decodedSpec.domainname == "") + #expect(decodedSpec.mounts.isEmpty) + #expect(decodedSpec.annotations == nil) + #expect(decodedSpec.root == nil) + #expect(decodedSpec.linux == nil) + } + + @Test func minimalProcessSpecDecode() throws { + let cwd = "/test" + let minProcessSpec = + """ + { + "cwd": "\(cwd)", + "user": { + "uid": 10, + "gid": 11 + } + } + """ + + guard let data = minProcessSpec.data(using: .utf8) else { + Issue.record("test process spec is not valid: \(minProcessSpec)") + return + } + + let decodedSpec = try JSONDecoder().decode(ContainerizationOCI.Process.self, from: data) + #expect(decodedSpec.cwd == cwd) + #expect(decodedSpec.env.isEmpty) + #expect(decodedSpec.consoleSize == nil) + #expect(decodedSpec.selinuxLabel == "") + #expect(decodedSpec.noNewPrivileges == false) + #expect(decodedSpec.commandLine == "") + #expect(decodedSpec.oomScoreAdj == nil) + #expect(decodedSpec.capabilities == nil) + #expect(decodedSpec.apparmorProfile == "") + #expect(decodedSpec.user.uid == 10) + #expect(decodedSpec.user.gid == 11) + #expect(decodedSpec.rlimits.isEmpty) + #expect(decodedSpec.terminal == false) + } + + @Test func minimalUserSpecDecode() throws { + let minUserSpec = + """ + { + "uid": 10, + "gid": 11 + } + """ + + guard let data = minUserSpec.data(using: .utf8) else { + Issue.record("test user spec is not valid: \(minUserSpec)") + return + } + + let decodedSpec = try JSONDecoder().decode(ContainerizationOCI.User.self, from: data) + #expect(decodedSpec.uid == 10) + #expect(decodedSpec.gid == 11) + #expect(decodedSpec.umask == nil) + #expect(decodedSpec.additionalGids.isEmpty) + #expect(decodedSpec.username == "") + } + + @Test func minimalRootSpecDecode() throws { + let path = "/testpath" + let minRootSpec = + """ + { + "path": "\(path)" + } + """ + + guard let data = minRootSpec.data(using: .utf8) else { + Issue.record("test root spec is not valid: \(minRootSpec)") + return + } + + let decodedSpec = try JSONDecoder().decode(ContainerizationOCI.Root.self, from: data) + #expect(decodedSpec.path == path) + #expect(decodedSpec.readonly == false) + } + + @Test func minimalMountSpecDecode() throws { + let destination = "/testdest" + let minMountSpec = + """ + { + "destination": "\(destination)" + } + """ + + guard let data = minMountSpec.data(using: .utf8) else { + Issue.record("test mount spec is not valid: \(minMountSpec)") + return + } + + let decodedSpec = try JSONDecoder().decode(ContainerizationOCI.Mount.self, from: data) + #expect(decodedSpec.type == "") + #expect(decodedSpec.source == "") + #expect(decodedSpec.destination == destination) + #expect(decodedSpec.options.isEmpty) + #expect(decodedSpec.uidMappings == nil) + #expect(decodedSpec.gidMappings == nil) + } + + @Test func minimalCapabilitiesDecode() throws { + let minCapabilitiesSpec = + """ + { + "ociVersion": "1.1.0", + "capabilities": { + "permitted": [ + "CAP_SYS_ADMIN" + ] + }, + "linux": {} + } + """ + + guard let data = minCapabilitiesSpec.data(using: .utf8) else { + Issue.record("test capabilities spec is not valid: \(minCapabilitiesSpec)") + return + } + + let _ = try JSONDecoder().decode(ContainerizationOCI.Spec.self, from: data) + } +} diff --git a/Tests/ContainerizationOCITests/ReferenceTests.swift b/Tests/ContainerizationOCITests/ReferenceTests.swift new file mode 100644 index 0000000..6a744bb --- /dev/null +++ b/Tests/ContainerizationOCITests/ReferenceTests.swift @@ -0,0 +1,118 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// swiftlint:disable force_cast large_tuple + +import ContainerizationError +import Foundation +import Testing + +@testable import ContainerizationOCI + +@Suite("Reference Parse Tests") +struct ReferenceParseTests { + internal struct ReferenceParseTestCase: Sendable { + let input: String + let domain: String? + let path: String + let tag: String? + let digest: String? + init(input: String, domain: String? = nil, path: String, tag: String? = nil, digest: String? = nil) { + self.input = input + self.domain = domain + self.path = path + self.tag = tag + self.digest = digest + } + } + + @Test(arguments: [ + ReferenceParseTestCase(input: "tensorflow/tensorflow", path: "tensorflow/tensorflow"), + ReferenceParseTestCase(input: "debian", path: "debian"), + ReferenceParseTestCase(input: "repo_with_underscore", path: "repo_with_underscore"), + ReferenceParseTestCase(input: "swift5.10:alpine", path: "swift5.10", tag: "alpine"), + ReferenceParseTestCase(input: "registry.com.with.port:5000/no_tag", domain: "registry.com.with.port:5000", path: "no_tag"), + ReferenceParseTestCase(input: "registry.com.with.port:5000/name/foo/bar:tag23", domain: "registry.com.with.port:5000", path: "name/foo/bar", tag: "tag23"), + ReferenceParseTestCase(input: "some-repo-with-dashes/name", path: "some-repo-with-dashes/name"), + ReferenceParseTestCase(input: "domain.with-dashes/cool-image:foo", domain: "domain.with-dashes", path: "cool-image", tag: "foo"), + ReferenceParseTestCase(input: "localhost:8080/123:latest", domain: "localhost:8080", path: "123", tag: "latest"), + ReferenceParseTestCase( + input: "localhost/123@sha256:\(String(repeating: "a", count: 64))", domain: "localhost", path: "123", digest: "sha256:\(String(repeating: "a", count: 64))"), + ReferenceParseTestCase( + input: "registry.com.with.port:1254/foo/bar/baz@sha256:\(String(repeating: "abcd", count: 16))", domain: "registry.com.with.port:1254", path: "foo/bar/baz", + digest: "sha256:\(String(repeating: "abcd", count: 16))"), + ReferenceParseTestCase(input: "192.168.1.1:5544/local/swift:6.0", domain: "192.168.1.1:5544", path: "local/swift", tag: "6.0"), + ReferenceParseTestCase(input: "[abc12::4]:5683/swift", domain: "[abc12::4]:5683", path: "swift"), + // Verify names longer than 127 characters are accepted (OCI spec allows up to 255). + ReferenceParseTestCase( + input: "reg.io/\(String(repeating: "a", count: 121))", + domain: "reg.io", + path: String(repeating: "a", count: 121)), + // Verify a name of exactly 255 characters (the OCI spec maximum) is accepted. + ReferenceParseTestCase( + input: "registry.example.com/\(String(repeating: "a", count: 234))", + domain: "registry.example.com", + path: String(repeating: "a", count: 234)), + ]) + func validReferenceParse(testCase: ReferenceParseTestCase) async throws { + #expect(throws: Never.self) { + let parsed = try Reference.parse(testCase.input) + #expect(parsed.path == testCase.path) + #expect(parsed.domain == testCase.domain) + #expect(parsed.digest == testCase.digest) + #expect(parsed.tag == testCase.tag) + } + } + + @Test(arguments: [ + "localhost:8080", + "localhost/123@sha256:\(String(repeating: "a", count: 200))", + "https://github.com/apple/containerization", + "", + "-testString", + "-testString/image", + "-testString.com/image/release", + "foo///bar", + "mostly.valid/image/but/Caps", + "[abc12::4]", + "[abc12::4]:abc12::4", + "[2001:db8:3:4::192.0.2.33]:5000/debian", + "1a3f5e7d9c1b3a5f7e9d1c3b5a7f9e1d3c5b7a9f1e3d5d7c9b1a3f5e7d9c1b3a", + // A name of 256 characters exceeds the OCI spec limit of 255 and must be rejected. + "registry.example.com/\(String(repeating: "a", count: 235))", + ]) + func invalidReferenceParse(input: String) async throws { + #expect(throws: ContainerizationError.self) { + try Reference.parse(input) + } + } + + @Test(arguments: [ + ReferenceParseTestCase(input: "only_name", path: "only_name", tag: "latest"), + ReferenceParseTestCase(input: "docker.io/alpine", domain: "docker.io", path: "library/alpine", tag: "latest"), + ReferenceParseTestCase(input: "ghcr.io/myrepo/alpine", domain: "ghcr.io", path: "myrepo/alpine", tag: "latest"), + ReferenceParseTestCase(input: "name@sha256:" + String(repeating: "1", count: 64), path: "name", digest: "sha256:" + String(repeating: "1", count: 64)), + ReferenceParseTestCase(input: "registry-1.docker.io/testrepo/myname:v2", domain: "registry-1.docker.io", path: "testrepo/myname", tag: "v2"), + ]) + func testNormalize(testCase: ReferenceParseTestCase) throws { + let parsed = try Reference.parse(testCase.input) + parsed.normalize() + #expect(parsed.path == testCase.path) + #expect(parsed.domain == testCase.domain) + #expect(parsed.digest == testCase.digest) + #expect(parsed.tag == testCase.tag) + } +} diff --git a/Tests/ContainerizationOCITests/RegistryClientTests.swift b/Tests/ContainerizationOCITests/RegistryClientTests.swift new file mode 100644 index 0000000..f25fcb1 --- /dev/null +++ b/Tests/ContainerizationOCITests/RegistryClientTests.swift @@ -0,0 +1,366 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationError +import ContainerizationIO +import Crypto +import Foundation +import NIO +import Synchronization +import Testing + +@testable import ContainerizationOCI + +struct OCIClientTests: ~Copyable { + private var contentPath: URL + private let fileManager = FileManager.default + private var encoder = JSONEncoder() + + init() async throws { + let testDir = fileManager.uniqueTemporaryDirectory() + let contentPath = testDir.appendingPathComponent("content") + try fileManager.createDirectory(at: contentPath, withIntermediateDirectories: true) + self.contentPath = contentPath + + encoder.outputFormatting = .prettyPrinted + } + + deinit { + try? fileManager.removeItem(at: contentPath) + } + + private static var arch: String? { + var uts = utsname() + let result = uname(&uts) + guard result == EXIT_SUCCESS else { + return nil + } + + let machine = Data(bytes: &uts.machine, count: 256) + guard let arch = String(bytes: machine, encoding: .utf8) else { + return nil + } + + switch arch.lowercased().trimmingCharacters(in: .controlCharacters) { + case "arm64": + return "arm64" + default: + return "amd64" + } + } + + @Test(.enabled(if: hasRegistryCredentials)) + func fetchToken() async throws { + let client = RegistryClient(host: "ghcr.io", authentication: Self.authentication) + let request = TokenRequest(realm: "https://ghcr.io/token", service: "ghcr.io", clientId: "tests", scope: nil) + let response = try await client.fetchToken(request: request) + #expect(response.getToken() != nil) + } + + @Test(arguments: [ + "registry-1.docker.io", + "public.ecr.aws", + "registry.k8s.io", + "mcr.microsoft.com", + ]) + func ping(host: String) async throws { + let client = RegistryClient(host: host) + try await client.ping() + } + + @Test func pingWithInvalidCredentials() async throws { + let authentication = BasicAuthentication(username: "foo", password: "bar") + let client = RegistryClient(host: "ghcr.io", authentication: authentication) + let error = await #expect(throws: RegistryClient.Error.self) { try await client.ping() } + guard case .invalidStatus(_, let status, let reason) = error else { + throw error! + } + #expect(status == .unauthorized) + #expect(reason == "access denied or wrong credentials") + } + + @Test(.enabled(if: hasRegistryCredentials)) + func pingWithCredentials() async throws { + let client = RegistryClient(host: "ghcr.io", authentication: Self.authentication) + try await client.ping() + } + + @Test func resolve() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + #expect(descriptor.mediaType == MediaTypes.dockerManifest) + #expect(descriptor.size != 0) + #expect(!descriptor.digest.isEmpty) + } + + @Test func resolveSha() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve( + name: "apple/containerization/dockermanifestimage", tag: "sha256:c8d344d228b7d9a702a95227438ec0d71f953a9a483e28ffabc5704f70d2b61e") + let namedDescriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + #expect(descriptor == namedDescriptor) + #expect(descriptor.mediaType == MediaTypes.dockerManifest) + #expect(descriptor.size != 0) + #expect(!descriptor.digest.isEmpty) + } + + @Test func fetchManifest() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + let manifest: Manifest = try await client.fetch(name: "apple/containerization/dockermanifestimage", descriptor: descriptor) + #expect(manifest.schemaVersion == 2) + #expect(manifest.layers.count == 1) + } + + @Test func fetchManifestAsData() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + let manifestData = try await client.fetchData(name: "apple/containerization/dockermanifestimage", descriptor: descriptor) + let checksum = SHA256.hash(data: manifestData) + #expect(descriptor.digest == checksum.digest) + } + + @Test func fetchConfig() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + let manifest: Manifest = try await client.fetch(name: "apple/containerization/dockermanifestimage", descriptor: descriptor) + let image: Image = try await client.fetch(name: "apple/containerization/dockermanifestimage", descriptor: manifest.config) + // This is an empty image -- check that the image label is present in the image config + #expect(image.config?.labels?["org.opencontainers.image.source"] == "https://github.com/apple/containerization") + #expect(image.rootfs.diffIDs.count == 1) + } + + @Test func fetchBlob() async throws { + let client = RegistryClient(host: "ghcr.io") + let descriptor = try await client.resolve(name: "apple/containerization/dockermanifestimage", tag: "0.0.2") + let manifest: Manifest = try await client.fetch(name: "apple/containerization/dockermanifestimage", descriptor: descriptor) + var called = false + var done = false + try await client.fetchBlob(name: "apple/containerization/dockermanifestimage", descriptor: manifest.layers.first!) { (expected, body) in + called = true + #expect(expected != 0) + var received = 0 + for try await buffer in body { + received += buffer.readableBytes + if received == expected { + done = true + } + } + } + #expect(called) + #expect(done) + } + + @Test(.disabled("External users cannot push images, disable while we find a better solution")) + func pushIndex() async throws { + let client = RegistryClient(host: "ghcr.io", authentication: Self.authentication) + let indexDescriptor = try await client.resolve(name: "apple/containerization/emptyimage", tag: "0.0.1") + let index: Index = try await client.fetch(name: "apple/containerization/emptyimage", descriptor: indexDescriptor) + + let platform = Platform(arch: "amd64", os: "linux") + + var manifestDescriptor: Descriptor? + for m in index.manifests where m.platform == platform { + manifestDescriptor = m + break + } + + #expect(manifestDescriptor != nil) + + let manifest: Manifest = try await client.fetch(name: "apple/containerization/emptyimage", descriptor: manifestDescriptor!) + let imgConfig: Image = try await client.fetch(name: "apple/containerization/emptyimage", descriptor: manifest.config) + + let layer = try #require(manifest.layers.first) + let blobPath = contentPath.appendingPathComponent(layer.digest) + let outputStream = OutputStream(toFileAtPath: blobPath.path, append: false) + #expect(outputStream != nil) + + try await outputStream!.withThrowingOpeningStream { + try await client.fetchBlob(name: "apple/containerization/emptyimage", descriptor: layer) { (expected, body) in + var received: Int64 = 0 + for try await buffer in body { + received += Int64(buffer.readableBytes) + + buffer.withUnsafeReadableBytes { pointer in + let unsafeBufferPointer = pointer.bindMemory(to: UInt8.self) + if let addr = unsafeBufferPointer.baseAddress { + _ = outputStream!.write(addr, maxLength: buffer.readableBytes) + } + } + } + + #expect(received == expected) + } + } + + let name = "apple/test-images/image-push" + let ref = "latest" + + // Push the layer first. + do { + let content = try LocalContent(path: blobPath) + let generator = { + let stream = try ReadStream(url: content.path) + try stream.reset() + return stream.stream + } + try await client.push(name: name, ref: ref, descriptor: layer, streamGenerator: generator, progress: nil) + } catch let err as ContainerizationError { + guard err.code == .exists else { + throw err + } + } + + // Push the image configuration. + var imgConfigDesc: Descriptor? + do { + imgConfigDesc = try await self.pushDescriptor( + client: client, + name: name, + ref: ref, + content: imgConfig, + baseDescriptor: manifest.config + ) + } catch let err as ContainerizationError { + guard err.code != .exists else { + return + } + throw err + } + + // Push the image manifest. + let newManifest = Manifest( + schemaVersion: manifest.schemaVersion, + mediaType: manifest.mediaType!, + config: imgConfigDesc!, + layers: manifest.layers, + annotations: manifest.annotations + ) + let manifestDesc = try await self.pushDescriptor( + client: client, + name: name, + ref: ref, + content: newManifest, + baseDescriptor: manifestDescriptor! + ) + + // Push the index. + let newIndex = Index( + schemaVersion: index.schemaVersion, + mediaType: index.mediaType, + manifests: [manifestDesc], + annotations: index.annotations + ) + try await self.pushDescriptor( + client: client, + name: name, + ref: ref, + content: newIndex, + baseDescriptor: indexDescriptor + ) + } + + @Test func resolveWithRetry() async throws { + let counter = Mutex(0) + let client = RegistryClient( + host: "ghcr.io", + retryOptions: RetryOptions( + maxRetries: 3, + retryInterval: 500_000_000, + shouldRetry: ({ response in + if response.status == .notFound { + counter.withLock { $0 += 1 } + return true + } + return false + }) + ) + ) + do { + _ = try await client.resolve(name: "containerization/not-exists", tag: "foo") + } catch { + #expect(counter.withLock { $0 } <= 3) + } + } + + // MARK: private functions + + static var hasRegistryCredentials: Bool { + authentication != nil + } + + static var authentication: Authentication? { + let env = ProcessInfo.processInfo.environment + guard let password = env["REGISTRY_TOKEN"], + let username = env["REGISTRY_USERNAME"] + else { + return nil + } + return BasicAuthentication(username: username, password: password) + } + + @discardableResult + private func pushDescriptor( + client: RegistryClient, + name: String, + ref: String, + content: T, + baseDescriptor: Descriptor + ) async throws -> Descriptor { + let encoded = try self.encoder.encode(content) + let digest = SHA256.hash(data: encoded) + let descriptor = Descriptor( + mediaType: baseDescriptor.mediaType, + digest: digest.digest, + size: Int64(encoded.count), + urls: baseDescriptor.urls, + annotations: baseDescriptor.annotations, + platform: baseDescriptor.platform + ) + let generator = { + let stream = ReadStream(data: encoded) + try stream.reset() + return stream.stream + } + + try await client.push( + name: name, + ref: ref, + descriptor: descriptor, + streamGenerator: generator, + progress: nil + ) + return descriptor + } +} + +extension OutputStream { + fileprivate func withThrowingOpeningStream(_ closure: () async throws -> Void) async throws { + self.open() + defer { self.close() } + + try await closure() + } +} + +extension SHA256.Digest { + fileprivate var digest: String { + let parts = self.description.split(separator: ": ") + return "sha256:\(parts[1])" + } +} diff --git a/Tests/ContainerizationOSTests/BidirectionalRelayTests.swift b/Tests/ContainerizationOSTests/BidirectionalRelayTests.swift new file mode 100644 index 0000000..5189402 --- /dev/null +++ b/Tests/ContainerizationOSTests/BidirectionalRelayTests.swift @@ -0,0 +1,345 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import ContainerizationOS + +#if canImport(Darwin) +import Darwin +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Musl) +import Musl +#endif + +@Suite("BidirectionalRelay tests") +final class BidirectionalRelayTests { + + /// Creates a Unix domain socket pair and returns (fd0, fd1). + private func makeSocketPair() throws -> (Int32, Int32) { + var fds: [Int32] = [0, 0] + #if os(macOS) + let result = socketpair(AF_UNIX, SOCK_STREAM, 0, &fds) + #else + let result = socketpair(AF_UNIX, Int32(SOCK_STREAM.rawValue), 0, &fds) + #endif + try #require(result == 0, "socketpair should succeed, errno: \(errno)") + return (fds[0], fds[1]) + } + + /// Writes all bytes to a file descriptor, retrying on partial writes. + private func writeAll(fd: Int32, data: [UInt8]) throws { + var offset = 0 + while offset < data.count { + let n = data.withUnsafeBufferPointer { buf in + write(fd, buf.baseAddress!.advanced(by: offset), data.count - offset) + } + try #require(n > 0, "write failed, errno: \(errno)") + offset += n + } + } + + /// Reads exactly `count` bytes from a file descriptor with a timeout. + /// Returns the data read, or nil if the timeout expires. + private func readWithTimeout(fd: Int32, count: Int, timeoutSeconds: Double) -> [UInt8]? { + // Set fd to non-blocking for poll-based reading. + let flags = fcntl(fd, F_GETFL) + _ = fcntl(fd, F_SETFL, flags | O_NONBLOCK) + defer { _ = fcntl(fd, F_SETFL, flags) } + + var result = [UInt8](repeating: 0, count: count) + var totalRead = 0 + let deadline = Date().addingTimeInterval(timeoutSeconds) + + while totalRead < count && Date() < deadline { + let n = result.withUnsafeMutableBufferPointer { buf in + read(fd, buf.baseAddress!.advanced(by: totalRead), count - totalRead) + } + if n > 0 { + totalRead += n + } else if n == -1 && (errno == EAGAIN || errno == EWOULDBLOCK) { + // Not ready yet, brief sleep before retry. + usleep(1000) // 1ms + } else { + break + } + } + return totalRead == count ? result : nil + } + + /// Sets a small send buffer on a socket to make it fill quickly. + private func setSendBufferSize(fd: Int32, size: Int32) { + var bufSize = size + setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &bufSize, socklen_t(MemoryLayout.size)) + } + + // MARK: - Test 1: Basic relay + + @Test + func testBasicRelay() throws { + // Create two socketpairs: + // pair1: (a0) --- relay ---> (b0) + // pair2: (a1) <-- relay --- (b1) + // The relay connects a1 <-> b0. + // Write to a0, read from b1 (data flows: a0 → a1 → relay → b0 → b1). + let (a0, a1) = try makeSocketPair() + let (b0, b1) = try makeSocketPair() + defer { + close(a0) + close(b1) + } + + let relay = BidirectionalRelay(fd1: a1, fd2: b0) + try relay.start() + + let testData: [UInt8] = Array("Hello, BidirectionalRelay!".utf8) + try writeAll(fd: a0, data: testData) + + let received = readWithTimeout(fd: b1, count: testData.count, timeoutSeconds: 2.0) + #expect(received == testData, "Data should pass through the relay") + + // Test the reverse direction: write to b1, read from a0. + let reverseData: [UInt8] = Array("Reverse direction".utf8) + try writeAll(fd: b1, data: reverseData) + + let reverseReceived = readWithTimeout(fd: a0, count: reverseData.count, timeoutSeconds: 2.0) + #expect(reverseReceived == reverseData, "Data should flow in reverse through the relay") + + relay.stop() + } + + // MARK: - Test 2: Cross-connection head-of-line blocking + + @Test + func testNoCrossConnectionBlocking() throws { + // Two relays sharing a single serial queue (simulating the old architecture). + // One relay's destination is saturated (not drained). + // The other relay should still work — proving per-connection isolation. + let sharedQueue = DispatchQueue(label: "test.shared-queue") + + // Relay 1: a0 → a1 --relay1--> b0 → b1 (b1 won't be read, causing backpressure) + let (a0, a1) = try makeSocketPair() + let (b0, b1) = try makeSocketPair() + + // Relay 2: c0 → c1 --relay2--> d0 → d1 (d1 will be read normally) + let (c0, c1) = try makeSocketPair() + let (d0, d1) = try makeSocketPair() + + defer { + close(a0) + close(b1) + close(c0) + close(d1) + } + + // Shrink send buffers to make them fill quickly. + setSendBufferSize(fd: b0, size: 4096) + + let relay1 = BidirectionalRelay(fd1: a1, fd2: b0, queue: sharedQueue) + let relay2 = BidirectionalRelay(fd1: c1, fd2: d0, queue: sharedQueue) + + try relay1.start() + try relay2.start() + + // Saturate relay1: write data into a0 but never read from b1. + // This fills b0's send buffer, triggering backpressure on relay1. + let largeData = [UInt8](repeating: 0x41, count: 65536) + // Use non-blocking write to a0 so we don't block this test thread. + let a0flags = fcntl(a0, F_GETFL) + _ = fcntl(a0, F_SETFL, a0flags | O_NONBLOCK) + _ = largeData.withUnsafeBufferPointer { buf in + write(a0, buf.baseAddress!, buf.count) + } + _ = fcntl(a0, F_SETFL, a0flags) // restore + + // Give relay1 time to process and get blocked. + usleep(100_000) // 100ms + + // Now test relay2: it should still work despite relay1 being backpressured. + let testData: [UInt8] = Array("relay2 works!".utf8) + try writeAll(fd: c0, data: testData) + + let received = readWithTimeout(fd: d1, count: testData.count, timeoutSeconds: 2.0) + #expect(received != nil, "Relay2 should not be blocked by Relay1's backpressure") + if let received { + #expect(received == testData, "Relay2 data should be correct") + } + + relay1.stop() + relay2.stop() + } + + // MARK: - Test 3: Backpressure recovery + + @Test + func testBackpressureRecovery() throws { + let (a0, a1) = try makeSocketPair() + let (b0, b1) = try makeSocketPair() + defer { + close(a0) + close(b1) + } + + // Shrink b0's send buffer so backpressure kicks in quickly. + setSendBufferSize(fd: b0, size: 4096) + + let relay = BidirectionalRelay(fd1: a1, fd2: b0) + try relay.start() + + // Write enough data to trigger backpressure (more than the send buffer). + let totalBytes = 32768 + let sendData = [UInt8]((0.. 0 { + offset += n + } else if n == -1 && (errno == EAGAIN || errno == EWOULDBLOCK) { + usleep(1000) + } else { + break + } + } + } + writeThread.start() + + // Read from b1 (drain) — this should relieve backpressure. + var received = [UInt8]() + let readBuf = UnsafeMutableBufferPointer.allocate(capacity: 4096) + defer { readBuf.deallocate() } + + let deadline = Date().addingTimeInterval(5.0) + let b1flags = fcntl(b1, F_GETFL) + _ = fcntl(b1, F_SETFL, b1flags | O_NONBLOCK) + + while received.count < totalBytes && Date() < deadline { + let n = read(b1, readBuf.baseAddress!, readBuf.count) + if n > 0 { + received.append(contentsOf: UnsafeBufferPointer(start: readBuf.baseAddress!, count: n)) + } else if n == -1 && (errno == EAGAIN || errno == EWOULDBLOCK) { + usleep(1000) + } else { + break + } + } + + #expect(received.count == totalBytes, "All bytes should be received after backpressure recovery (got \(received.count)/\(totalBytes))") + #expect(received == sendData, "Received data should match sent data") + + relay.stop() + } + + // MARK: - Test 4: EOF handling + + @Test + func testEOFHandling() async throws { + let (a0, a1) = try makeSocketPair() + let (b0, b1) = try makeSocketPair() + + let relay = BidirectionalRelay(fd1: a1, fd2: b0) + try relay.start() + + // Write some data, then close one end. + let testData: [UInt8] = Array("goodbye".utf8) + try writeAll(fd: a0, data: testData) + close(a0) + + // Read the data from the other end. + let received = readWithTimeout(fd: b1, count: testData.count, timeoutSeconds: 2.0) + #expect(received == testData, "Data should arrive before EOF") + + // Close b1 as well so both directions see EOF. + // (a0 closed → a1 reads EOF → source1 done; + // b1 closed → b0 reads EOF → source2 done → relay complete) + close(b1) + + // The relay should detect EOF on both directions and complete. + let completed = await withTaskGroup(of: Bool.self) { group in + group.addTask { + await relay.waitForCompletion() + return true + } + group.addTask { + try? await Task.sleep(nanoseconds: 3_000_000_000) // 3 seconds + return false + } + let result = await group.next()! + group.cancelAll() + return result + } + + #expect(completed, "Relay should complete after both sides reach EOF") + } + + // MARK: - Test 5: Stop while under backpressure + + @Test + func testStopWhileBackpressured() async throws { + // Verify that stop() works correctly when a read source is suspended + // due to backpressure. Previously, cancelling a suspended dispatch source + // would never deliver the cancel handler, leaking file descriptors. + let (a0, a1) = try makeSocketPair() + let (b0, b1) = try makeSocketPair() + + // Shrink b0's send buffer so backpressure kicks in quickly. + setSendBufferSize(fd: b0, size: 4096) + + let relay = BidirectionalRelay(fd1: a1, fd2: b0) + try relay.start() + + // Write enough to trigger backpressure but don't read from b1. + let largeData = [UInt8](repeating: 0x42, count: 65536) + let a0flags = fcntl(a0, F_GETFL) + _ = fcntl(a0, F_SETFL, a0flags | O_NONBLOCK) + _ = largeData.withUnsafeBufferPointer { buf in + write(a0, buf.baseAddress!, buf.count) + } + + // Give relay time to enter backpressure state (readSource suspended). + usleep(100_000) // 100ms + + // Stop the relay while it's backpressured. This should not hang or leak. + relay.stop() + + // Close the external ends — the relay's fds should already be closed by stop(). + close(a0) + close(b1) + + // The relay should complete (cancel handlers should have fired). + let completed = await withTaskGroup(of: Bool.self) { group in + group.addTask { + await relay.waitForCompletion() + return true + } + group.addTask { + try? await Task.sleep(nanoseconds: 3_000_000_000) // 3 seconds + return false + } + let result = await group.next()! + group.cancelAll() + return result + } + + #expect(completed, "Relay should complete after stop() even when backpressured") + } +} diff --git a/Tests/ContainerizationOSTests/EpollTests.swift b/Tests/ContainerizationOSTests/EpollTests.swift new file mode 100644 index 0000000..636d739 --- /dev/null +++ b/Tests/ContainerizationOSTests/EpollTests.swift @@ -0,0 +1,300 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Foundation +import Testing + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +@testable import ContainerizationOS + +@Suite("Epoll tests") +final class EpollTests { + + @Suite("Mask option set") + struct MaskTests { + @Test + func inputAndOutputAreDistinct() { + let input = Epoll.Mask.input + let output = Epoll.Mask.output + #expect(input != output) + #expect(input.isDisjoint(with: output)) + } + + @Test + func readyToReadMatchesInput() { + let mask = Epoll.Mask.input + #expect(mask.readyToRead) + #expect(!mask.readyToWrite) + } + + @Test + func readyToWriteMatchesOutput() { + let mask = Epoll.Mask.output + #expect(mask.readyToWrite) + #expect(!mask.readyToRead) + } + + @Test + func combinedMask() { + let mask: Epoll.Mask = [.input, .output] + #expect(mask.readyToRead) + #expect(mask.readyToWrite) + } + + @Test + func emptyMaskHasNoFlags() { + let mask = Epoll.Mask(rawValue: 0) + #expect(!mask.readyToRead) + #expect(!mask.readyToWrite) + #expect(!mask.isHangup) + #expect(!mask.isRemoteHangup) + } + } + + private static func makePipe() throws -> (Int32, Int32) { + var fds: [Int32] = [0, 0] + guard pipe(&fds) == 0 else { + throw POSIXError.fromErrno() + } + return (fds[0], fds[1]) + } + + @Test + func addAndDeletePipeFD() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + try epoll.delete(readFD) + } + + @Test + func addInvalidFDThrows() throws { + let epoll = try Epoll() + #expect(throws: POSIXError.self) { + try epoll.add(-1, mask: .input) + } + } + + @Test + func deletingAlreadyClosedFDThrows() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + try epoll.add(readFD, mask: .input) + close(readFD) + close(writeFD) + #expect(throws: POSIXError.self) { + try epoll.delete(readFD) + } + } + + @Test + func doubleDeleteThrows() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + try epoll.delete(readFD) + #expect(throws: POSIXError.self) { + try epoll.delete(readFD) + } + } + + @Test + func waitTimesOutWithNoEvents() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + // Timeout of 0 means return immediately. + let events = epoll.wait(timeout: 0) + try #require(events != nil, "wait should not return nil without shutdown") + #expect(events!.isEmpty, "No data written, so no events expected") + } + + @Test + func waitReturnsReadableEvent() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + + // Write some data to make the read end readable. + var byte: UInt8 = 42 + let n = write(writeFD, &byte, 1) + try #require(n == 1, "write to pipe should succeed") + + let events = epoll.wait(maxEvents: 4, timeout: 1000) + try #require(events != nil, "wait should not return nil without shutdown") + try #require(!events!.isEmpty, "Should have at least one event") + + let event = events!.first { $0.fd == readFD } + try #require(event != nil, "Should have an event for the read fd") + #expect(event!.mask.readyToRead) + } + + @Test + func waitReportsMultipleFDs() throws { + let epoll = try Epoll() + + let (readFD1, writeFD1) = try Self.makePipe() + defer { + close(readFD1) + close(writeFD1) + } + let (readFD2, writeFD2) = try Self.makePipe() + defer { + close(readFD2) + close(writeFD2) + } + + try epoll.add(readFD1, mask: .input) + try epoll.add(readFD2, mask: .input) + + // Write to both pipes. + var byte: UInt8 = 1 + _ = write(writeFD1, &byte, 1) + _ = write(writeFD2, &byte, 1) + + let events = epoll.wait(maxEvents: 4, timeout: 1000) + try #require(events != nil) + #expect(events!.count == 2, "Should report events for both fds") + + let fds = Set(events!.map { $0.fd }) + #expect(fds.contains(readFD1)) + #expect(fds.contains(readFD2)) + } + + @Test + func shutdownCausesWaitToReturnNil() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + + epoll.shutdown() + + let events = epoll.wait(timeout: 0) + #expect(events == nil, "wait should return nil after shutdown") + } + + @Test + func closingWriteEndSignalsHangup() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { close(readFD) } + + try epoll.add(readFD, mask: .input) + + // Close the write end to trigger a hangup on the read end. + close(writeFD) + + let events = epoll.wait(maxEvents: 4, timeout: 1000) + try #require(events != nil) + try #require(!events!.isEmpty, "Should have a hangup event") + + let event = events!.first { $0.fd == readFD } + try #require(event != nil) + #expect(event!.mask.isHangup) + } + + @Test + func deletedFDIsNotReported() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + try epoll.delete(readFD) + + // Write data, should not produce events since we deleted the fd. + var byte: UInt8 = 1 + _ = write(writeFD, &byte, 1) + + let events = epoll.wait(maxEvents: 4, timeout: 100) + try #require(events != nil) + #expect(events!.isEmpty, "Deleted fd should produce no events") + } + + @Test + func edgeTriggeredRequiresDrainBeforeRenotify() throws { + let epoll = try Epoll() + let (readFD, writeFD) = try Self.makePipe() + defer { + close(readFD) + close(writeFD) + } + + try epoll.add(readFD, mask: .input) + + // Write data to make it readable. + var byte: UInt8 = 99 + _ = write(writeFD, &byte, 1) + + // First wait should return the event. + let events1 = epoll.wait(maxEvents: 4, timeout: 1000) + try #require(events1 != nil) + try #require(!events1!.isEmpty) + + // Without reading the data, a second immediate wait should NOT + // re-trigger because of edge triggered semantics. + let events2 = epoll.wait(maxEvents: 4, timeout: 0) + try #require(events2 != nil) + #expect(events2!.isEmpty, "Edge triggered should not re-fire without new activity") + + // Drain the pipe. + var buf = [UInt8](repeating: 0, count: 16) + _ = read(readFD, &buf, buf.count) + + // Write new data. This is a new edge, so it should trigger again. + _ = write(writeFD, &byte, 1) + let events3 = epoll.wait(maxEvents: 4, timeout: 1000) + try #require(events3 != nil) + #expect(!events3!.isEmpty, "New write after drain should trigger event") + } +} + +#endif // os(Linux) diff --git a/Tests/ContainerizationOSTests/FileDescriptorOpsTests.swift b/Tests/ContainerizationOSTests/FileDescriptorOpsTests.swift new file mode 100644 index 0000000..6ac4741 --- /dev/null +++ b/Tests/ContainerizationOSTests/FileDescriptorOpsTests.swift @@ -0,0 +1,898 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationOS + +#if canImport(Darwin) +import Darwin +let os_close = Darwin.close +#elseif canImport(Musl) +import Musl +let os_close = Musl.close +#elseif canImport(Glibc) +import Glibc +let os_close = Glibc.close +#endif + +struct FileDescriptorPathSecureTests { + @Test( + "Test creation of stub file under directory successfully created by secure mkdir", + arguments: [ + // Case 1: Single component, no intermediates needed, default permissions + ([Entry](), FilePath("foo"), nil as FilePermissions?, false), + + // Case 2: Single component with explicit permissions + ([Entry](), FilePath("foo"), FilePermissions(rawValue: 0o755), false), + + // Case 3: Two components, parent exists, no intermediates + ([Entry.directory(path: "foo")], FilePath("foo/bar"), nil as FilePermissions?, false), + + // Case 4: Two components, parent missing, makeIntermediates true + ([Entry](), FilePath("foo/bar"), nil as FilePermissions?, true), + + // Case 5: Three components, makeIntermediates true, custom permissions + ([Entry](), FilePath("foo/bar/baz"), FilePermissions(rawValue: 0o700), true), + + // Case 6: Replace existing file with directory (single component) + ([Entry.regular(path: "foo")], FilePath("foo"), nil as FilePermissions?, false), + + // Case 7: Replace existing file with directory path (makeIntermediates true) + ([Entry.regular(path: "foo")], FilePath("foo/bar"), nil as FilePermissions?, true), + + // Case 8: Replace existing directory with new directory (should be idempotent) + ([Entry.directory(path: "foo")], FilePath("foo"), nil as FilePermissions?, false), + + // Case 9: Replace nested directory structure + ( + [ + Entry.directory(path: "foo/bar"), + Entry.regular(path: "foo/bar/file.txt"), + ], FilePath("foo/bar"), nil as FilePermissions?, false + ), + + // Case 10: Replace symlink with directory + ([Entry.symlink(target: "target", source: "foo")], FilePath("foo"), nil as FilePermissions?, false), + + // Case 11: Multi-level with some intermediates existing + ([Entry.directory(path: "foo")], FilePath("foo/bar/baz"), nil as FilePermissions?, true), + + // Case 12: Deep nesting with makeIntermediates + ([Entry](), FilePath("a/b/c/d/e"), nil as FilePermissions?, true), + ] + ) + func testMkdirSecureValid(entries: [Entry], relativePath: FilePath, permissions: FilePermissions?, makeIntermediates: Bool) async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + try createEntries(rootPath: rootPath, entries: entries, permissions: permissions) + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + let stubFileName = "stub.txt" + let stubContent = Data("stub file content".utf8) + + try FileDescriptorOps.mkdir(rootFd, relativePath, permissions: permissions, makeIntermediates: makeIntermediates) { dirFd in + // Create a stub file in the directory using openat + let fd = openat( + dirFd.rawValue, + stubFileName, + O_WRONLY | O_CREAT | O_TRUNC, + 0o644 + ) + guard fd >= 0 else { + throw Errno(rawValue: errno) + } + defer { close(fd) } + + try stubContent.withUnsafeBytes { buffer in + guard let baseAddress = buffer.baseAddress else { return } + let written = write(fd, baseAddress, buffer.count) + guard written == buffer.count else { + throw Errno(rawValue: errno) + } + } + } + + // Check stub file existence at expected location + let expectedStubPath = rootPath.appending(relativePath.string).appending(stubFileName) + #expect(FileManager.default.fileExists(atPath: expectedStubPath.string)) + + // Verify stub file content + let readContent = try Data(contentsOf: URL(fileURLWithPath: expectedStubPath.string)) + #expect(readContent == stubContent) + + // Check directory permissions if specified + if let permissions = permissions { + // Check each component of the path + let components = relativePath.components + var currentPath = "" + for (index, component) in components.enumerated() { + if index > 0 { + currentPath += "/" + } + currentPath += component.string + + let dirPath = rootPath.appending(currentPath) + let attrs = try FileManager.default.attributesOfItem(atPath: dirPath.string) + let posixPerms = attrs[.posixPermissions] as? NSNumber + // Mask to permission bits only (not file type bits) + let permMask: CModeT = 0o777 + let actualPerms = CModeT(posixPerms?.uint16Value ?? 0) & permMask + let expectedPerms = permissions.rawValue & permMask + #expect( + actualPerms == expectedPerms, + "Directory '\(currentPath)' has permissions 0o\(String(actualPerms, radix: 8)) but expected 0o\(String(expectedPerms, radix: 8))") + } + } + } + + @Test( + "Test mkdir error cases", + arguments: [ + // Case 1: Path starting with ".." should be rejected + (FilePath("../escape"), false, FileDescriptorOps.Error.invalidRelativePath), + + // Case 2: Path with ".." in middle that would escape + (FilePath("foo/../../escape"), false, FileDescriptorOps.Error.invalidRelativePath), + + // Case 3: Missing intermediate without makeIntermediates should fail + (FilePath("missing/intermediate/path"), false, FileDescriptorOps.Error.invalidPathComponent), + + // Case 4: Multiple .. that escape + (FilePath("a/b/../../../escape"), false, FileDescriptorOps.Error.invalidRelativePath), + ] + ) + func testMkdirSecureInvalid(relativePath: FilePath, makeIntermediates: Bool, expectedError: FileDescriptorOps.Error) async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Attempt the operation and expect it to throw + #expect { + try FileDescriptorOps.mkdir(rootFd, relativePath, makeIntermediates: makeIntermediates) { _ in } + } throws: { error in + guard let securePathError = error as? FileDescriptorOps.Error else { + return false + } + // Compare error cases + switch (securePathError, expectedError) { + case (.invalidRelativePath, .invalidRelativePath), + (.invalidPathComponent, .invalidPathComponent), + (.cannotFollowSymlink, .cannotFollowSymlink): + return true + case (.systemError(let op1, let err1), .systemError(let op2, let err2)): + return op1 == op2 && err1 == err2 + default: + return false + } + } + } + + @Test( + "Test paths with .. that normalize to valid paths", + arguments: [ + // Paths with .. that should normalize and succeed + ("./safe", "safe"), // Leading ./ normalizes to safe + ("./a/./b", "a/b"), // Multiple ./ normalize away + ] + ) + func testPathsWithDotNormalization(path: String, expectedNormalized: String) async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + let stubFileName = "stub.txt" + let stubContent = Data("stub file content".utf8) + + try FileDescriptorOps.mkdir(rootFd, FilePath(path), makeIntermediates: true) { dirFd in + // Create a stub file to verify we're in the right place + let fd = openat( + dirFd.rawValue, + stubFileName, + O_WRONLY | O_CREAT | O_TRUNC, + 0o644 + ) + guard fd >= 0 else { + throw Errno(rawValue: errno) + } + defer { close(fd) } + + try stubContent.withUnsafeBytes { buffer in + guard let baseAddress = buffer.baseAddress else { return } + let written = write(fd, baseAddress, buffer.count) + guard written == buffer.count else { + throw Errno(rawValue: errno) + } + } + } + + // Verify stub file exists at the normalized location + let expectedPath = + expectedNormalized.isEmpty + ? rootPath.appending(stubFileName) + : rootPath.appending(expectedNormalized).appending(stubFileName) + #expect( + FileManager.default.fileExists(atPath: expectedPath.string), + "Expected file at normalized path: \(expectedPath.string)") + } + + @Test( + "Test paths with .. that normalize to valid paths", + arguments: [ + // Paths with .. that should fail + ("safe/.."), // Normalizes to empty (current dir) + ("a/../b"), // Normalizes to b + ("a/b/../c"), // Normalizes to a/c + ] + ) + func testPathsWithDotDotNormalization(path: String) async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + #expect(throws: FileDescriptorOps.Error.invalidRelativePath.self) { + try FileDescriptorOps.mkdir(rootFd, FilePath(path), makeIntermediates: true) + } + } + + @Test( + "Test paths with empty components (double slashes)", + arguments: [ + "a//b", // Double slash in middle + "a///b", // Triple slash + "a//b//c", // Multiple double slashes + ] + ) + func testPathsWithEmptyComponents(path: String) async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + let stubFileName = "stub.txt" + let stubContent = Data("stub file content".utf8) + + // Should normalize and succeed (// becomes /) + try FileDescriptorOps.mkdir(rootFd, FilePath(path), makeIntermediates: true) { dirFd in + let fd = openat( + dirFd.rawValue, + stubFileName, + O_WRONLY | O_CREAT | O_TRUNC, + 0o644 + ) + guard fd >= 0 else { + throw Errno(rawValue: errno) + } + defer { close(fd) } + + try stubContent.withUnsafeBytes { buffer in + guard let baseAddress = buffer.baseAddress else { return } + let written = write(fd, baseAddress, buffer.count) + guard written == buffer.count else { + throw Errno(rawValue: errno) + } + } + } + + // Verify the file exists somewhere under root (normalization should handle it) + // The exact location depends on how FilePath normalizes empty components + let normalizedPath = FilePath(path).lexicallyNormalized() + let expectedPath = rootPath.appending(normalizedPath.string).appending(stubFileName) + #expect( + FileManager.default.fileExists(atPath: expectedPath.string), + "Expected file at normalized path: \(expectedPath.string)") + } + + @Test("Test very deep nesting") + func testDeepNesting() async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create a 100-level deep path + var deepPath = "" + for i in 0..<100 { + if i > 0 { deepPath += "/" } + deepPath += "level\(i)" + } + + let stubFileName = "deep.txt" + let stubContent = Data("deep file".utf8) + + try FileDescriptorOps.mkdir(rootFd, FilePath(deepPath), makeIntermediates: true) { dirFd in + let fd = openat( + dirFd.rawValue, + stubFileName, + O_WRONLY | O_CREAT | O_TRUNC, + 0o644 + ) + guard fd >= 0 else { + throw Errno(rawValue: errno) + } + defer { close(fd) } + + try stubContent.withUnsafeBytes { buffer in + guard let baseAddress = buffer.baseAddress else { return } + let written = write(fd, baseAddress, buffer.count) + guard written == buffer.count else { + throw Errno(rawValue: errno) + } + } + } + + // Verify the deep file exists + let expectedPath = rootPath.appending(deepPath).appending(stubFileName) + #expect(FileManager.default.fileExists(atPath: expectedPath.string)) + } + + @Test("Test path with null byte") + func testNullByteInPath() async throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Path with null byte - FilePath may handle this differently + // This tests that we don't crash or have unexpected behavior + let pathWithNull = "file\u{0000}.txt" + + // Try to create it - behavior depends on FilePath's null byte handling + // We mainly want to ensure it doesn't bypass security checks + do { + try FileDescriptorOps.mkdir(rootFd, FilePath(pathWithNull), makeIntermediates: true) { _ in } + + // If it succeeds, verify it stayed within root + let entries = try FileManager.default.contentsOfDirectory(atPath: rootPath.string) + for entry in entries { + let fullPath = rootPath.appending(entry) + let canonicalRoot = try FileDescriptorOps.getCanonicalPath(rootFd) + let canonicalEntry = try FileDescriptor.open(fullPath, .readOnly) + let canonicalEntryPath = try FileDescriptorOps.getCanonicalPath(canonicalEntry) + try? canonicalEntry.close() + + // Verify entry is under root + #expect( + canonicalEntryPath.string.hasPrefix(canonicalRoot.string + "/") || canonicalEntryPath.string == canonicalRoot.string, + "Entry escaped root: \(canonicalEntryPath.string)") + } + } catch { + // If it fails, that's also acceptable - just don't crash + } + } + + @Test("Remove a regular file") + func testRemoveRegularFile() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create a regular file + let filePath = tempPath.appending("testfile.txt") + _ = FileManager.default.createFile(atPath: filePath.string, contents: Data("test".utf8)) + + // Verify file exists + #expect(FileManager.default.fileExists(atPath: filePath.string)) + + // Remove it + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("testfile.txt")) + + // Verify file is gone + #expect(!FileManager.default.fileExists(atPath: filePath.string)) + } + + @Test("Remove an empty directory") + func testRemoveEmptyDirectory() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create an empty directory + let dirPath = tempPath.appending("emptydir") + try FileManager.default.createDirectory(atPath: dirPath.string, withIntermediateDirectories: false) + + // Verify directory exists + var isDir: ObjCBool = false + #expect(FileManager.default.fileExists(atPath: dirPath.string, isDirectory: &isDir)) + #expect(isDir.boolValue) + + // Remove it + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("emptydir")) + + // Verify directory is gone + #expect(!FileManager.default.fileExists(atPath: dirPath.string)) + } + + @Test("Remove a directory with nested files and subdirectories") + func testRemoveNestedDirectory() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create nested structure: + // nested/ + // file1.txt + // subdir/ + // file2.txt + // deepdir/ + // file3.txt + let nestedPath = tempPath.appending("nested") + let subdirPath = nestedPath.appending("subdir") + let deepdirPath = subdirPath.appending("deepdir") + + try FileManager.default.createDirectory(atPath: deepdirPath.string, withIntermediateDirectories: true) + _ = FileManager.default.createFile(atPath: nestedPath.appending("file1.txt").string, contents: Data("1".utf8)) + _ = FileManager.default.createFile(atPath: subdirPath.appending("file2.txt").string, contents: Data("2".utf8)) + _ = FileManager.default.createFile(atPath: deepdirPath.appending("file3.txt").string, contents: Data("3".utf8)) + + // Verify structure exists + #expect(FileManager.default.fileExists(atPath: nestedPath.string)) + #expect(FileManager.default.fileExists(atPath: subdirPath.string)) + #expect(FileManager.default.fileExists(atPath: deepdirPath.string)) + + // Remove entire tree + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("nested")) + + // Verify everything is gone + #expect(!FileManager.default.fileExists(atPath: nestedPath.string)) + } + + @Test("Remove non-existent file returns without error") + func testRemoveNonExistent() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Remove non-existent file should not throw + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("nonexistent.txt")) + } + + @Test("Remove symlink without following it") + func testRemoveSymlink() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create target file and symlink + let targetPath = tempPath.appending("target.txt") + let linkPath = tempPath.appending("link") + _ = FileManager.default.createFile(atPath: targetPath.string, contents: Data("target".utf8)) + try FileManager.default.createSymbolicLink(atPath: linkPath.string, withDestinationPath: "target.txt") + + // Verify both exist + #expect(FileManager.default.fileExists(atPath: targetPath.string)) + #expect(FileManager.default.fileExists(atPath: linkPath.string)) + + // Remove symlink + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("link")) + + // Verify symlink is gone but target remains + #expect(!FileManager.default.fileExists(atPath: linkPath.string)) + #expect(FileManager.default.fileExists(atPath: targetPath.string)) + } + + @Test("Remove directory with mixed content (files, dirs, symlinks)") + func testRemoveMixedDirectory() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Create mixed structure: + // mixed/ + // file.txt + // subdir/ + // link -> file.txt + let mixedPath = tempPath.appending("mixed") + let subdirPath = mixedPath.appending("subdir") + + try FileManager.default.createDirectory(atPath: subdirPath.string, withIntermediateDirectories: true) + _ = FileManager.default.createFile(atPath: mixedPath.appending("file.txt").string, contents: Data("test".utf8)) + try FileManager.default.createSymbolicLink( + atPath: mixedPath.appending("link").string, + withDestinationPath: "file.txt" + ) + + // Verify structure exists + #expect(FileManager.default.fileExists(atPath: mixedPath.string)) + + // Remove entire tree + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("mixed")) + + // Verify everything is gone + #expect(!FileManager.default.fileExists(atPath: mixedPath.string)) + } + + @Test("Guards against removing '.' component") + func testGuardDotComponent() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Should return without error and without removing anything + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component(".")) + + // Verify directory still exists + #expect(FileManager.default.fileExists(atPath: tempPath.string)) + } + + @Test("Guards against removing '..' component") + func testGuardDotDotComponent() throws { + let tempPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: tempPath.string) } + + let rootFd = try FileDescriptor.open(tempPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + // Should return without error and without removing anything + try FileDescriptorOps.unlinkRecursive(rootFd, filename: FilePath.Component("..")) + + // Verify directory still exists + #expect(FileManager.default.fileExists(atPath: tempPath.string)) + } + + @Test("Test mkdir with empty path calls completion with parent") + func testMkdirEmptyPath() throws { + let rootPath = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: rootPath.string) } + + let rootFd = try FileDescriptor.open(rootPath, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + let stubFileName = "root-level-file.txt" + let stubContent = Data("root level content".utf8) + var completionCalled = false + + // Call mkdir with empty path + try FileDescriptorOps.mkdir(rootFd, FilePath(""), makeIntermediates: false) { dirFd in + completionCalled = true + + // Verify dirFd is the same as rootFd + #expect(dirFd.rawValue == rootFd.rawValue, "Completion should receive the parent directory FD") + + // Create a file in the directory to verify we got the right FD + let fd = openat( + dirFd.rawValue, + stubFileName, + O_WRONLY | O_CREAT | O_TRUNC, + 0o644 + ) + guard fd >= 0 else { + throw Errno(rawValue: errno) + } + defer { close(fd) } + + try stubContent.withUnsafeBytes { buffer in + guard let baseAddress = buffer.baseAddress else { return } + let written = write(fd, baseAddress, buffer.count) + guard written == buffer.count else { + throw Errno(rawValue: errno) + } + } + } + + // Verify completion was called + #expect(completionCalled, "Completion handler should be called for empty path") + + // Verify file was created at root level + let expectedPath = rootPath.appending(stubFileName) + #expect(FileManager.default.fileExists(atPath: expectedPath.string)) + + // Verify content + let readContent = try Data(contentsOf: URL(fileURLWithPath: expectedPath.string)) + #expect(readContent == stubContent) + } + + private func createTempDirectory() throws -> FilePath { + let tempURL = FileManager.default.temporaryDirectory + .appendingPathComponent(UUID().uuidString) + try FileManager.default.createDirectory(at: tempURL, withIntermediateDirectories: true) + return FilePath(tempURL.path) + + } + + private func createEntries(rootPath: FilePath, entries: [Entry], permissions: FilePermissions? = nil) throws { + for entry in entries { + switch entry { + case .regular(let path): + let fullPath = rootPath.appending(path) + // Create parent directories if needed + let parentPath = FilePath(fullPath.string).removingLastComponent() + if !FileManager.default.fileExists(atPath: parentPath.string) { + try FileManager.default.createDirectory( + atPath: parentPath.string, + withIntermediateDirectories: true, + attributes: permissions.map { [.posixPermissions: $0.rawValue] } + ) + } + _ = FileManager.default.createFile( + atPath: fullPath.string, + contents: Data("test".utf8) + ) + case .directory(let path): + let fullPath = rootPath.appending(path) + try FileManager.default.createDirectory( + atPath: fullPath.string, + withIntermediateDirectories: true, + attributes: permissions.map { [.posixPermissions: $0.rawValue] } + ) + case .symlink(let target, let source): + let sourcePath = rootPath.appending(source) + // Create parent directories for source if needed + let parentPath = FilePath(sourcePath.string).removingLastComponent() + if !FileManager.default.fileExists(atPath: parentPath.string) { + try FileManager.default.createDirectory( + atPath: parentPath.string, + withIntermediateDirectories: true, + attributes: permissions.map { [.posixPermissions: $0.rawValue] } + ) + } + try FileManager.default.createSymbolicLink( + atPath: sourcePath.string, + withDestinationPath: target + ) + } + } + } +} + +enum Entry { + case regular(path: String) + case directory(path: String) + case symlink(target: String, source: String) +} + +// MARK: - enumerate tests + +extension FileDescriptorPathSecureTests { + + // Collect all entries reported by enumerate, keyed by path string. + private func collect(root: FilePath) throws -> [String: FileDescriptorOps.EntryType] { + let rootFd = try FileDescriptor.open(root, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + var found: [String: FileDescriptorOps.EntryType] = [:] + try FileDescriptorOps.enumerate(rootFd) { path, type, _ in + found[path.string] = type + } + return found + } + + @Test func testEnumerateSecureEmptyDirectory() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + + let found = try collect(root: root) + #expect(found.isEmpty) + } + + @Test func testEnumerateSecureFlatRegularFiles() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + try createEntries( + rootPath: root, + entries: [ + .regular(path: "a.txt"), + .regular(path: "b.txt"), + .regular(path: "c.txt"), + ]) + + let found = try collect(root: root) + #expect(found.count == 3) + #expect(found["a.txt"] == .regular) + #expect(found["b.txt"] == .regular) + #expect(found["c.txt"] == .regular) + } + + @Test func testEnumerateSecureRecursesIntoRealDirectories() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + try createEntries( + rootPath: root, + entries: [ + .directory(path: "subdir"), + .regular(path: "subdir/file.txt"), + ]) + + let found = try collect(root: root) + #expect(found.count == 2) + #expect(found["subdir"] == .directory) + #expect(found["subdir/file.txt"] == .regular) + } + + @Test func testEnumerateSecureReportsFileSymlink() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + try createEntries( + rootPath: root, + entries: [ + .regular(path: "target.txt"), + .symlink(target: "target.txt", source: "link.txt"), + ]) + + let found = try collect(root: root) + #expect(found["link.txt"] == .symlink) + #expect(found["target.txt"] == .regular) + } + + @Test func testEnumerateSecureDoesNotFollowDirectorySymlink() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + + // Create a real directory with content alongside a symlink to it. + try createEntries( + rootPath: root, + entries: [ + .directory(path: "real"), + .regular(path: "real/inside.txt"), + .symlink(target: "real", source: "link"), + ]) + + let found = try collect(root: root) + // "link" is reported as a symlink, not followed — "link/inside.txt" absent. + #expect(found["link"] == .symlink) + #expect(found["link/inside.txt"] == nil) + // The real directory and its content are still traversed normally. + #expect(found["real"] == .directory) + #expect(found["real/inside.txt"] == .regular) + } + + @Test func testEnumerateSecureDoesNotFollowAbsoluteDirectorySymlinkOutside() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + + // Create a directory entirely outside the root. + let outside = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: outside.string) } + #expect(FileManager.default.createFile(atPath: outside.appending("secret.txt").string, contents: Data("secret".utf8))) + + // Symlink inside root → absolute path outside root. + try createEntries( + rootPath: root, + entries: [ + .symlink(target: outside.string, source: "escape") + ]) + + let found = try collect(root: root) + // The symlink itself is reported… + #expect(found["escape"] == .symlink) + // …but nothing inside the outside directory is reachable. + #expect(found["escape/secret.txt"] == nil) + #expect(found.count == 1) + } + + @Test func testEnumerateSecureDoesNotFollowRelativeDirectorySymlinkOutside() throws { + // Layout: base/root/ and base/outside/, symlink root/escape → ../outside + let base = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString).path + let rootStr = (base as NSString).appendingPathComponent("root") + let outsideStr = (base as NSString).appendingPathComponent("outside") + try FileManager.default.createDirectory(atPath: rootStr, withIntermediateDirectories: true) + try FileManager.default.createDirectory(atPath: outsideStr, withIntermediateDirectories: true) + defer { try? FileManager.default.removeItem(atPath: base) } + + #expect(FileManager.default.createFile(atPath: (outsideStr as NSString).appendingPathComponent("secret.txt"), contents: Data("secret".utf8))) + try FileManager.default.createSymbolicLink( + atPath: (rootStr as NSString).appendingPathComponent("escape"), + withDestinationPath: "../outside" + ) + + let rootFd = try FileDescriptor.open(FilePath(rootStr), .readOnly, options: [.directory]) + defer { try? rootFd.close() } + var found: [String: FileDescriptorOps.EntryType] = [:] + try FileDescriptorOps.enumerate(rootFd) { path, type, _ in found[path.string] = type } + + #expect(found["escape"] == .symlink) + #expect(found["escape/secret.txt"] == nil) + #expect(found.count == 1) + } + + @Test func testEnumerateSecureMixedContent() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + try createEntries( + rootPath: root, + entries: [ + .regular(path: "readme.txt"), + .directory(path: "src"), + .regular(path: "src/main.swift"), + .directory(path: "src/util"), + .regular(path: "src/util/helper.swift"), + .symlink(target: "readme.txt", source: "link.txt"), + .symlink(target: "src", source: "src-link"), + ]) + + let found = try collect(root: root) + #expect(found["readme.txt"] == .regular) + #expect(found["src"] == .directory) + #expect(found["src/main.swift"] == .regular) + #expect(found["src/util"] == .directory) + #expect(found["src/util/helper.swift"] == .regular) + #expect(found["link.txt"] == .symlink) + // Directory symlink: reported but not followed. + #expect(found["src-link"] == .symlink) + #expect(found["src-link/main.swift"] == nil) + #expect(found.count == 7) + } + + @Test func testEnumerateSecurePreOrderDirectoryBeforeContents() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + try createEntries( + rootPath: root, + entries: [ + .directory(path: "dir"), + .regular(path: "dir/child.txt"), + ]) + + let rootFd = try FileDescriptor.open(root, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + var order: [String] = [] + try FileDescriptorOps.enumerate(rootFd) { path, _, _ in order.append(path.string) } + + let dirIdx = try #require(order.firstIndex(of: "dir")) + let childIdx = try #require(order.firstIndex(of: "dir/child.txt")) + #expect(dirIdx < childIdx, "directory must be reported before its contents") + } + + @Test func testEnumerateSecureParentFdCanOpenEntryWithoutFollowingSymlinks() throws { + let root = try createTempDirectory() + defer { try? FileManager.default.removeItem(atPath: root.string) } + let content = Data("hello".utf8) + try createEntries(rootPath: root, entries: [.regular(path: "file.txt")]) + #expect(FileManager.default.createFile(atPath: root.appending("file.txt").string, contents: content)) + + let rootFd = try FileDescriptor.open(root, .readOnly, options: [.directory]) + defer { try? rootFd.close() } + + var readContent: Data? + try FileDescriptorOps.enumerate(rootFd) { path, type, parentFd in + guard type == .regular, let name = path.lastComponent?.string else { return } + // Open through the fd chain — no absolute path involved. + let fd = openat(parentFd.rawValue, name, O_RDONLY | O_NOFOLLOW) + guard fd >= 0 else { return } + defer { _ = os_close(fd) } + var buf = [UInt8](repeating: 0, count: 256) + let n = read(fd, &buf, buf.count) + if n > 0 { readContent = Data(buf.prefix(n)) } + } + + #expect(readContent == content) + } +} diff --git a/Tests/ContainerizationOSTests/FilePathOpsTests.swift b/Tests/ContainerizationOSTests/FilePathOpsTests.swift new file mode 100644 index 0000000..f5d5c05 --- /dev/null +++ b/Tests/ContainerizationOSTests/FilePathOpsTests.swift @@ -0,0 +1,43 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import SystemPackage +import Testing + +@testable import ContainerizationOS + +struct FilePathOpsTests { + @Test("absolutePath returns absolute inputs unchanged") + func absolutePathPreservesAbsolutePath() { + let absolute = FilePath("/tmp/containerization/file.tar") + let resolved = FilePathOps.absolutePath(absolute) + + #expect(resolved == absolute) + } + + @Test("absolutePath resolves relative paths against cwd and normalizes lexically") + func absolutePathResolvesRelativePath() { + let relative = FilePath("./images/../image.tar") + let expected = FilePath(FileManager.default.currentDirectoryPath) + .appending(relative.components) + .lexicallyNormalized() + let resolved = FilePathOps.absolutePath(relative) + + #expect(resolved == expected) + #expect(resolved.isAbsolute) + } +} diff --git a/Tests/ContainerizationOSTests/KeychainQueryTests.swift b/Tests/ContainerizationOSTests/KeychainQueryTests.swift new file mode 100644 index 0000000..301cc4f --- /dev/null +++ b/Tests/ContainerizationOSTests/KeychainQueryTests.swift @@ -0,0 +1,83 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) + +import Foundation +import Testing + +@testable import ContainerizationOS + +struct KeychainQueryTests { + let securityDomain = "com.example.container-testing-keychain" + let hostname = "testing-keychain.example.com" + let username = "containerization-test" + + let kq = KeychainQuery() + + @Test(.enabled(if: !isCI)) + func keychainQuery() throws { + defer { try? kq.delete(securityDomain: securityDomain, hostname: hostname) } + + do { + try kq.save(securityDomain: securityDomain, hostname: hostname, username: username, password: "foobar") + #expect(try kq.exists(securityDomain: securityDomain, hostname: hostname)) + + let fetched = try kq.get(securityDomain: securityDomain, hostname: hostname) + let result = try #require(fetched) + #expect(result.username == username) + #expect(result.password == "foobar") + } catch KeychainQuery.Error.unhandledError(status: -25308) { + // ignore errSecInteractionNotAllowed + } + } + + @Test(.enabled(if: !isCI)) + func list() throws { + let hostname1 = "testing-1-keychain.example.com" + let hostname2 = "testing-2-keychain.example.com" + + defer { + try? kq.delete(securityDomain: securityDomain, hostname: hostname1) + try? kq.delete(securityDomain: securityDomain, hostname: hostname2) + } + + do { + try kq.save(securityDomain: securityDomain, hostname: hostname1, username: username, password: "foobar") + try kq.save(securityDomain: securityDomain, hostname: hostname2, username: username, password: "foobar") + + let entries = try kq.list(securityDomain: securityDomain) + + // Verify that both hostnames exist + let hostnames = entries.map { $0.hostname } + #expect(hostnames.contains(hostname1)) + #expect(hostnames.contains(hostname2)) + + // Verify that the accounts exist + for entry in entries { + #expect(entry.username == username) + } + } catch KeychainQuery.Error.unhandledError(status: -25308) { + // ignore errSecInteractionNotAllowed + } + } + + private static var isCI: Bool { + ProcessInfo.processInfo.environment["CI"] != nil + } +} + +#endif diff --git a/Tests/ContainerizationOSTests/SocketTests.swift b/Tests/ContainerizationOSTests/SocketTests.swift new file mode 100644 index 0000000..e941cd4 --- /dev/null +++ b/Tests/ContainerizationOSTests/SocketTests.swift @@ -0,0 +1,126 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CShim +import Foundation +import Testing + +@testable import ContainerizationOS + +#if canImport(Darwin) +import Darwin +#elseif canImport(Glibc) +import Glibc +#elseif canImport(Musl) +import Musl +#endif + +@Suite("Socket SCM_RIGHTS tests") +final class SocketTests { + + /// Helper function to send a file descriptor via SCM_RIGHTS + private func sendFileDescriptor(socket: Socket, fd: Int32) throws { + var msg = msghdr() + var iov = iovec() + var buf: UInt8 = 0 + + iov.iov_base = withUnsafeMutablePointer(to: &buf) { UnsafeMutableRawPointer($0) } + iov.iov_len = 1 + + msg.msg_iov = withUnsafeMutablePointer(to: &iov) { $0 } + msg.msg_iovlen = 1 + + // Control message buffer for file descriptor + var cmsgBuf = [UInt8](repeating: 0, count: Int(CZ_CMSG_SPACE(Int(MemoryLayout.size)))) + + msg.msg_control = withUnsafeMutablePointer(to: &cmsgBuf[0]) { UnsafeMutableRawPointer($0) } + msg.msg_controllen = .init(cmsgBuf.count) + + // Set up control message + let cmsgPtr = withUnsafeMutablePointer(to: &msg) { CZ_CMSG_FIRSTHDR($0) } + guard let cmsg = cmsgPtr else { + throw SocketError.invalidFileDescriptor + } + + cmsg.pointee.cmsg_level = SOL_SOCKET + cmsg.pointee.cmsg_type = .init(SCM_RIGHTS) + cmsg.pointee.cmsg_len = .init(CZ_CMSG_LEN(Int(MemoryLayout.size))) + + guard let dataPtr = CZ_CMSG_DATA(cmsg) else { + throw SocketError.invalidFileDescriptor + } + + dataPtr.assumingMemoryBound(to: Int32.self).pointee = fd + + let sendResult = withUnsafeMutablePointer(to: &msg) { msgPtr in + sendmsg(socket.fileDescriptor, msgPtr, 0) + } + + guard sendResult >= 0 else { + throw SocketError.withErrno("sendmsg failed", errno: errno) + } + } + + @Test + func testSCMRightsFileDescriptorPassing() throws { + // Create a socketpair for testing + var fds: [Int32] = [0, 0] + #if os(macOS) + let result = socketpair(AF_UNIX, SOCK_STREAM, 0, &fds) + #else + let result = socketpair(AF_UNIX, Int32(SOCK_STREAM.rawValue), 0, &fds) + #endif + try #require(result == 0, "socketpair should succeed") + + defer { + close(fds[0]) + close(fds[1]) + } + + // Use a dummy UnixType since we won't be using it for bind/connect/listen + let socketType = try UnixType(path: "/tmp/dummy") + let sendSocket = Socket(fd: fds[0], type: socketType, closeOnDeinit: false, connected: true) + let recvSocket = Socket(fd: fds[1], type: socketType, closeOnDeinit: false, connected: true) + + // Create a temporary file to send its descriptor + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { try? fileManager.removeItem(at: tempDir) } + + let testFilePath = tempDir.appending(path: "test.txt") + let testContent = "Hello, SCM_RIGHTS!" + try testContent.write(to: testFilePath, atomically: true, encoding: .utf8) + + let testFileHandle = try FileHandle(forReadingFrom: testFilePath) + defer { try? testFileHandle.close() } + + let originalFD = testFileHandle.fileDescriptor + + try sendFileDescriptor(socket: sendSocket, fd: originalFD) + let receivedFd = try recvSocket.receiveFileDescriptor() + let receivedFileHandle = FileHandle(fileDescriptor: receivedFd) + defer { try? receivedFileHandle.close() } + + try #require(receivedFileHandle.fileDescriptor != originalFD, "Received FD should be different") + try #require(receivedFileHandle.fileDescriptor >= 0, "Received FD should be valid") + + let data = try receivedFileHandle.readToEnd() + try #require(data != nil, "Should be able to read from received FD") + + let receivedContent = String(data: data!, encoding: .utf8) + #expect(receivedContent == testContent, "Content should match original file") + } +} diff --git a/Tests/ContainerizationOSTests/UserTests.swift b/Tests/ContainerizationOSTests/UserTests.swift new file mode 100644 index 0000000..cea3e83 --- /dev/null +++ b/Tests/ContainerizationOSTests/UserTests.swift @@ -0,0 +1,153 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import Foundation +import Testing + +@testable import ContainerizationOS + +@Suite("User/Group parse tests") +final class UsersTests { + struct TestCase: Sendable { + let userString: String + let expect: User.ExecUser + let shouldThrow: Bool + + init(_ userString: String, _ expect: User.ExecUser, _ shouldThrow: Bool) { + self.userString = userString + self.expect = expect + self.shouldThrow = shouldThrow + } + } + + static func createFile(path: URL, content: Data) throws { + let parent = path.deletingLastPathComponent() + let fileManager = FileManager.default + try fileManager.createDirectory(at: parent, withIntermediateDirectories: true) + try content.write(to: path) + } + + @Test + func testExecUserOnlyPasswd() throws { + let passwordContent = """ + root:x:0:0:root:/root:/bin/bash + daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin + bin:x:2:2:bin:/bin:/usr/sbin/nologin + sys:x:3:3:sys:/dev:/usr/sbin/nologin + nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin + platform:x:1000:1000:Platform:/home/platform:/bin/sh + """ + + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { try? fileManager.removeItem(at: tempDir) } + let passwdPath = tempDir.appending(path: "etc/passwd") + try Self.createFile(path: passwdPath, content: passwordContent.data(using: .ascii)!) + + let testCases: [TestCase] = [ + .init("root", .init(uid: 0, gid: 0, sgids: [], home: "/root", shell: "/bin/bash"), false), + .init("0:0", .init(uid: 0, gid: 0, sgids: [], home: "/root", shell: "/bin/bash"), false), + .init("platform", .init(uid: 1000, gid: 1000, sgids: [], home: "/home/platform", shell: "/bin/sh"), false), + .init("65534", .init(uid: 65534, gid: 65534, sgids: [], home: "/nonexistent", shell: "/usr/sbin/nologin"), false), + .init("should_fail", .init(uid: 456, gid: 123, sgids: [], home: "/undefined", shell: ""), true), + .init(":nouser", .init(uid: 456, gid: 123, sgids: [], home: "/undefined", shell: ""), true), + ] + + let groupPath = tempDir.appending(path: "etc/group") + for testCase in testCases { + if testCase.shouldThrow { + #expect(throws: User.Error.self) { + try User.getExecUser(userString: testCase.userString, passwdPath: passwdPath, groupPath: groupPath) + } + continue + } + let user = try User.getExecUser(userString: testCase.userString, passwdPath: passwdPath, groupPath: groupPath) + #expect(testCase.expect.uid == user.uid) + #expect(testCase.expect.gid == user.gid) + #expect(testCase.expect.home == user.home) + #expect(testCase.expect.sgids == user.sgids) + #expect(testCase.expect.shell == user.shell) + } + } + + @Test + func testExecUserNoPasswdFile() throws { + #expect(throws: User.Error.self) { + try User.getExecUser( + userString: "root:root", + passwdPath: URL(filePath: "/foobar-passwd"), + groupPath: URL(filePath: "/foobar-group") + ) + } + } + + @Test + func testExecUserPasswdGroup() throws { + let passwordContent = """ + root:x:0:0:root:/root:/bin/bash + daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin + bin:x:2:2:bin:/bin:/usr/sbin/nologin + sys:x:3:3:sys:/dev:/usr/sbin/nologin + backup:x:34:34:backup:/var/backups:/usr/sbin/nologin + nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin + platform:x:1000:1000:platform:/home/platform:/bin/bash + """ + + let groupContent = """ + root:x:0: + daemon:x:1: + bin:x:2: + adm:x:4:platform + tape:x:26: + sudo:x:27:platform + audio:x:29:platform + video:x:44:platform + nogroup:x:65534: + platform:x:1000: + """ + + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { try? fileManager.removeItem(at: tempDir) } + let passwdPath = tempDir.appending(path: "etc/passwd") + let groupPath = tempDir.appending(path: "etc/group") + try Self.createFile(path: passwdPath, content: passwordContent.data(using: .ascii)!) + try Self.createFile(path: groupPath, content: groupContent.data(using: .ascii)!) + + let testCases: [TestCase] = [ + .init("root:bin", .init(uid: 0, gid: 2, sgids: [2], home: "/root", shell: "/bin/bash"), false), + .init("daemon:platform", .init(uid: 1, gid: 1000, sgids: [1000], home: "/usr/sbin", shell: "/usr/sbin/nologin"), false), + .init("platform", .init(uid: 1000, gid: 1000, sgids: [4, 27, 29, 44], home: "/home/platform", shell: "/bin/bash"), false), + .init("nobody", .init(uid: 65534, gid: 65534, sgids: [], home: "/nonexistent", shell: "/usr/sbin/nologin"), false), + .init("2:1000", .init(uid: 2, gid: 1000, sgids: [1000], home: "/bin", shell: "/usr/sbin/nologin"), false), + ] + + for testCase in testCases { + if testCase.shouldThrow { + #expect(throws: User.Error.self) { + try User.getExecUser(userString: testCase.userString, passwdPath: passwdPath, groupPath: groupPath) + } + } + let user = try User.getExecUser(userString: testCase.userString, passwdPath: passwdPath, groupPath: groupPath) + #expect(testCase.expect.uid == user.uid) + #expect(testCase.expect.gid == user.gid) + #expect(testCase.expect.home == user.home) + #expect(Set(testCase.expect.sgids) == Set(user.sgids)) + #expect(testCase.expect.shell == user.shell) + } + } +} diff --git a/Tests/ContainerizationTests/AllocatorTests.swift b/Tests/ContainerizationTests/AllocatorTests.swift new file mode 100644 index 0000000..8bb80d2 --- /dev/null +++ b/Tests/ContainerizationTests/AllocatorTests.swift @@ -0,0 +1,170 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) + +import ContainerizationError +import ContainerizationExtras +import Testing + +@testable import Containerization + +struct AllocatorTests { + + @Test func allocateDualStackReturnsDistinctPairs() throws { + guard #available(macOS 26, *) else { return } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: try CIDRv6("fd00::/64")) + + let (a4, a6) = try alloc.allocate("a") + let (b4, b6) = try alloc.allocate("b") + + #expect(a4 != b4) + #expect(a6 != nil && b6 != nil) + #expect(a6 != b6) + + // The v4 allocator starts at lower + 2 (skipping network base + gateway), + // so the first two allocations are .2 and .3. + #expect(a4 == (try CIDRv4("192.168.64.2/24"))) + #expect(b4 == (try CIDRv4("192.168.64.3/24"))) + } + + @Test func allocateWithNoV6PrefixReturnsNilV6() throws { + guard #available(macOS 26, *) else { return } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: nil) + + let (_, a6) = try alloc.allocate("a") + #expect(a6 == nil) + } + + @Test func duplicateIdThrows() throws { + guard #available(macOS 26, *) else { return } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: try CIDRv6("fd00::/64")) + _ = try alloc.allocate("a") + #expect(throws: ContainerizationError.self) { + _ = try alloc.allocate("a") + } + } + + @Test func releaseAllowsIdReuse() throws { + guard #available(macOS 26, *) else { return } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: try CIDRv6("fd00::/64")) + + _ = try alloc.allocate("a") + // Re-allocating 'a' would throw .exists if release didn't clear it. + try alloc.release("a") + _ = try alloc.allocate("a") + } + + @Test func releaseUnknownIdIsNoOp() throws { + guard #available(macOS 26, *) else { return } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: try CIDRv6("fd00::/64")) + try alloc.release("never-allocated") + } + + @Test func v6HostPortionUsesOrdinalIndex() throws { + guard #available(macOS 26, *) else { + return + } + var alloc = try VmnetNetwork.Allocator( + cidrV4: try CIDRv4("192.168.64.0/24"), + cidrV6: try CIDRv6("fd00::/64")) + + let (_, a6) = try alloc.allocate("a") + let (_, b6) = try alloc.allocate("b") + + let aHost = a6!.address.value & a6!.prefix.suffixMask128 + let bHost = b6!.address.value & b6!.prefix.suffixMask128 + #expect(aHost == 2) + #expect(bHost == 3) + } + + @Test func cidrV6Gateway() throws { + // The network gateway is the lowest address + 1. + #expect((try CIDRv6("fd00::/64")).gateway == (try IPv6Address("fd00::1"))) + #expect((try CIDRv6("fd00:abcd:1234::/48")).gateway == (try IPv6Address("fd00:abcd:1234::1"))) + } + + @available(macOS 26, *) + private actor SerialAllocator { + private var inner: VmnetNetwork.Allocator + init(cidrV4: CIDRv4, cidrV6: CIDRv6?) throws { + self.inner = try VmnetNetwork.Allocator(cidrV4: cidrV4, cidrV6: cidrV6) + } + func allocate(_ id: String) throws -> (CIDRv4, CIDRv6?) { + try inner.allocate(id) + } + func release(_ id: String) throws { + try inner.release(id) + } + } + + @Test func returnsUniqueAddressesUnderConcurrentLoad() async throws { + guard #available(macOS 26, *) else { return } + // /16 host space is much larger than `count`, so we won't hit the + // pool ceiling — we're testing for collisions/state corruption. + let alloc = try SerialAllocator( + cidrV4: try CIDRv4("10.0.0.0/16"), + cidrV6: try CIDRv6("fd00::/64")) + + let count = 1000 + let pairs = try await withThrowingTaskGroup(of: (CIDRv4, CIDRv6?).self) { group in + for i in 0.. Interface? { + NilGatewayInterface() + } + + mutating func releaseInterface(_ id: String) throws {} +} + +@Suite +struct ContainerManagerTests { + @Test func testCreateThrowsWhenGatewayMissing() async throws { + let fm = FileManager.default + let root = fm.uniqueTemporaryDirectory(create: true) + defer { try? fm.removeItem(at: root) } + + let kernelPath = root.appendingPathComponent("vmlinux") + fm.createFile(atPath: kernelPath.path, contents: Data(), attributes: nil) + let initfsPath = root.appendingPathComponent("initfs.ext4") + fm.createFile(atPath: initfsPath.path, contents: Data(), attributes: nil) + + let kernel = Kernel(path: kernelPath, platform: .linuxArm) + let initfs = Mount.block(format: "ext4", source: initfsPath.path, destination: "/") + + var manager = try ContainerManager( + kernel: kernel, + initfs: initfs, + root: root, + network: NilGatewayNetwork() + ) + + let tempDir = fm.uniqueTemporaryDirectory() + defer { try? fm.removeItem(at: tempDir) } + + let tarPath = Foundation.Bundle.module.url(forResource: "scratch", withExtension: "tar")! + let reader = try ArchiveReader(format: .pax, filter: .none, file: tarPath) + let rejectedPaths = try reader.extractContents(to: tempDir) + #expect(rejectedPaths.isEmpty) + + let images = try await manager.imageStore.load(from: tempDir) + let image = images.first! + + let rootfsPath = root.appendingPathComponent("rootfs.ext4") + fm.createFile(atPath: rootfsPath.path, contents: Data(), attributes: nil) + let rootfs = Mount.block(format: "ext4", source: rootfsPath.path, destination: "/") + + do { + _ = try await manager.create("test-nil-gateway", image: image, rootfs: rootfs) { _ in } + #expect(Bool(false), "expected invalidState error for missing ipv4 gateway") + } catch let error as ContainerizationError { + #expect(error.code == .invalidState) + #expect(error.message.contains("missing ipv4 gateway")) + } catch { + #expect(Bool(false), "unexpected error: \(error)") + } + } + + @Test func testNetworkingFalseSkipsInterfaceCreation() async throws { + let fm = FileManager.default + let root = fm.uniqueTemporaryDirectory(create: true) + defer { try? fm.removeItem(at: root) } + + let kernelPath = root.appendingPathComponent("vmlinux") + fm.createFile(atPath: kernelPath.path, contents: Data(), attributes: nil) + let initfsPath = root.appendingPathComponent("initfs.ext4") + fm.createFile(atPath: initfsPath.path, contents: Data(), attributes: nil) + + let kernel = Kernel(path: kernelPath, platform: .linuxArm) + let initfs = Mount.block(format: "ext4", source: initfsPath.path, destination: "/") + + // Use NilGatewayNetwork — with networking: true this would throw invalidState, + // but with networking: false the network's createInterface() is never called. + var manager = try ContainerManager( + kernel: kernel, + initfs: initfs, + root: root, + network: NilGatewayNetwork() + ) + + let tempDir = fm.uniqueTemporaryDirectory() + defer { try? fm.removeItem(at: tempDir) } + + let tarPath = Foundation.Bundle.module.url(forResource: "scratch", withExtension: "tar")! + let reader = try ArchiveReader(format: .pax, filter: .none, file: tarPath) + let rejectedPaths = try reader.extractContents(to: tempDir) + #expect(rejectedPaths.isEmpty) + + let images = try await manager.imageStore.load(from: tempDir) + let image = images.first! + + let rootfsPath = root.appendingPathComponent("rootfs.ext4") + fm.createFile(atPath: rootfsPath.path, contents: Data(), attributes: nil) + let rootfs = Mount.block(format: "ext4", source: rootfsPath.path, destination: "/") + + // With networking: false, NilGatewayNetwork.createInterface() is never called, + // so we should not get the "missing ipv4 gateway" error. + // The container creation will fail for other reasons (dummy VMM), but the + // configuration closure should see empty interfaces. + var closureWasCalled = false + do { + _ = try await manager.create( + "test-no-networking", + image: image, + rootfs: rootfs, + networking: false + ) { config in + closureWasCalled = true + #expect(config.interfaces.isEmpty) + #expect(config.dns == nil) + } + } catch { + // Container creation may fail due to dummy kernel/VMM — that's expected. + // The key assertion is in the configuration closure above. + let description = String(describing: error) + #expect(!description.contains("missing ipv4 gateway")) + } + #expect(closureWasCalled, "configuration closure must be invoked to validate interfaces") + } +} + +#endif diff --git a/Tests/ContainerizationTests/DNSTests.swift b/Tests/ContainerizationTests/DNSTests.swift new file mode 100644 index 0000000..fe866b9 --- /dev/null +++ b/Tests/ContainerizationTests/DNSTests.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import Containerization + +struct DNSTests { + + @Test func dnsResolvConfWithAllFields() { + let dns = DNS( + nameservers: ["8.8.8.8", "1.1.1.1"], + domain: "example.com", + searchDomains: ["internal.com", "test.com"], + options: ["ndots:2", "timeout:1"] + ) + + let expected = "nameserver 8.8.8.8\nnameserver 1.1.1.1\ndomain example.com\nsearch internal.com test.com\noptions ndots:2 timeout:1\n" + #expect(dns.resolvConf == expected) + } + + @Test func dnsResolvConfWithEmptyFields() { + let dns = DNS( + nameservers: [], + domain: nil, + searchDomains: [], + options: [] + ) + + // Should return empty string when all fields are empty + #expect(dns.resolvConf == "") + } + + @Test func dnsResolvConfWithOnlyNameservers() { + let dns = DNS(nameservers: ["8.8.8.8"]) + + let expected = "nameserver 8.8.8.8\n" + #expect(dns.resolvConf == expected) + } + + @Test func dnsValidateAcceptsValidIPv4Nameservers() throws { + let dns = DNS(nameservers: ["8.8.8.8", "1.1.1.1"]) + #expect(throws: Never.self) { try dns.validate() } + } + + @Test func dnsValidateAcceptsValidIPv6Nameservers() throws { + let dns = DNS(nameservers: ["2001:4860:4860::8888", "::1"]) + #expect(throws: Never.self) { try dns.validate() } + } + + @Test func dnsValidateAcceptsMixedIPv4AndIPv6Nameservers() throws { + let dns = DNS(nameservers: ["8.8.8.8", "2001:4860:4860::8844"]) + #expect(throws: Never.self) { try dns.validate() } + } + + @Test func dnsValidateAcceptsEmptyNameservers() throws { + let dns = DNS(nameservers: []) + #expect(throws: Never.self) { try dns.validate() } + } + + @Test func dnsValidateRejectsHostname() { + let dns = DNS(nameservers: ["dns.example.com"]) + #expect(throws: (any Error).self) { try dns.validate() } + } + + @Test func dnsValidateRejectsInvalidAddress() { + let dns = DNS(nameservers: ["not-an-ip"]) + #expect(throws: (any Error).self) { try dns.validate() } + } +} diff --git a/Tests/ContainerizationTests/HashTests.swift b/Tests/ContainerizationTests/HashTests.swift new file mode 100644 index 0000000..e0d33ef --- /dev/null +++ b/Tests/ContainerizationTests/HashTests.swift @@ -0,0 +1,38 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import Containerization + +struct HashTests { + + @Test func hashMountSourceWithValidString() throws { + let result = try hashFilePath(path: "/valid/path") + + // Should produce a non-empty hash + #expect(!result.isEmpty) + + // Same input should produce same hash (deterministic) + let result2 = try hashFilePath(path: "/valid/path") + #expect(result == result2) + + // Different inputs should produce different hashes + let result3 = try hashFilePath(path: "/different/path") + #expect(result != result3) + } +} diff --git a/Tests/ContainerizationTests/HostDefaultRouteTests.swift b/Tests/ContainerizationTests/HostDefaultRouteTests.swift new file mode 100644 index 0000000..d21bb62 --- /dev/null +++ b/Tests/ContainerizationTests/HostDefaultRouteTests.swift @@ -0,0 +1,66 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Testing + +@testable import Containerization + +@Suite("Host default route parsing") +struct HostDefaultRouteTests { + // Header + one default-route row (Destination=00000000, Flags=0003 has RTF_GATEWAY=0x2). + static let singleDefault = """ + Iface\tDestination\tGateway\tFlags\tRefCnt\tUse\tMetric\tMask\tMTU\tWindow\tIRTT + eth0\t00000000\t0102A8C0\t0003\t0\t0\t0\t00000000\t0\t0\t0 + eth0\t0002A8C0\t00000000\t0001\t0\t0\t0\tFFFFFF00\t0\t0\t0 + """ + + static let noDefault = """ + Iface\tDestination\tGateway\tFlags\tRefCnt\tUse\tMetric\tMask\tMTU\tWindow\tIRTT + eth0\t0002A8C0\t00000000\t0001\t0\t0\t0\tFFFFFF00\t0\t0\t0 + """ + + static let multiDefault = """ + Iface\tDestination\tGateway\tFlags\tRefCnt\tUse\tMetric\tMask\tMTU\tWindow\tIRTT + wlan0\t00000000\t0102A8C0\t0003\t0\t0\t600\t00000000\t0\t0\t0 + eth0\t00000000\t0102A8C0\t0003\t0\t0\t100\t00000000\t0\t0\t0 + """ + + @Test("returns iface for a single default route") + func singleDefaultRoute() { + #expect(HostDefaultRoute.parseEgress(procNetRoute: Self.singleDefault) == "eth0") + } + + @Test("returns nil when no default route") + func noDefaultRoute() { + #expect(HostDefaultRoute.parseEgress(procNetRoute: Self.noDefault) == nil) + } + + @Test("returns lowest-metric default when multiple") + func multipleDefaultRoutes() { + // eth0 has metric 100; wlan0 has metric 600. + #expect(HostDefaultRoute.parseEgress(procNetRoute: Self.multiDefault) == "eth0") + } + + @Test("ignores rows missing RTF_GATEWAY flag") + func noGatewayFlag() { + // Same as singleDefault but flags=0001 (no RTF_GATEWAY=0x2). + let input = """ + Iface\tDestination\tGateway\tFlags\tRefCnt\tUse\tMetric\tMask\tMTU\tWindow\tIRTT + eth0\t00000000\t0102A8C0\t0001\t0\t0\t0\t00000000\t0\t0\t0 + """ + #expect(HostDefaultRoute.parseEgress(procNetRoute: input) == nil) + } +} diff --git a/Tests/ContainerizationTests/HostsTests.swift b/Tests/ContainerizationTests/HostsTests.swift new file mode 100644 index 0000000..8304968 --- /dev/null +++ b/Tests/ContainerizationTests/HostsTests.swift @@ -0,0 +1,68 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation +import Testing + +@testable import Containerization + +struct HostsTests { + + @Test func hostsEntryRenderedWithAllFields() { + let entry = Hosts.Entry( + ipAddress: "192.168.1.100", + hostnames: ["myserver", "server.local"], + comment: "My local server" + ) + + let expected = "192.168.1.100 myserver server.local # My local server " + #expect(entry.rendered == expected) + } + + @Test func hostsEntryRenderedWithoutComment() { + let entry = Hosts.Entry( + ipAddress: "10.0.0.1", + hostnames: ["gateway"] + ) + + let expected = "10.0.0.1 gateway" + #expect(entry.rendered == expected) + } + + @Test func hostsEntryRenderedWithEmptyHostnames() { + let entry = Hosts.Entry( + ipAddress: "172.16.0.1", + hostnames: [], + comment: "Empty hostnames" + ) + + let expected = "172.16.0.1 # Empty hostnames " + #expect(entry.rendered == expected) + } + + @Test func hostsFileWithCommentAndEntries() { + let hosts = Hosts( + entries: [ + Hosts.Entry(ipAddress: "127.0.0.1", hostnames: ["localhost"]), + Hosts.Entry(ipAddress: "192.168.1.10", hostnames: ["server"], comment: "Main server"), + ], + comment: "Generated hosts file" + ) + + let expected = "# Generated hosts file\n127.0.0.1 localhost\n192.168.1.10 server # Main server \n" + #expect(hosts.hostsFile == expected) + } +} diff --git a/Tests/ContainerizationTests/ImageTests.swift b/Tests/ContainerizationTests/ImageTests.swift new file mode 100644 index 0000000..ad09f56 --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests.swift @@ -0,0 +1,37 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI +import Foundation +import Testing + +@testable import Containerization + +struct ImageTests { + + @Test func imageDescriptionComputedProperties() { + let descriptor = Descriptor( + mediaType: "application/vnd.oci.image.manifest.v1+json", + digest: "sha256:abc123def456", + size: 1024 + ) + let description = Image.Description(reference: "myapp:latest", descriptor: descriptor) + + #expect(description.digest == "sha256:abc123def456") + #expect(description.mediaType == "application/vnd.oci.image.manifest.v1+json") + #expect(description.reference == "myapp:latest") + } +} diff --git a/Tests/ContainerizationTests/ImageTests/ContainsAuth.swift b/Tests/ContainerizationTests/ImageTests/ContainsAuth.swift new file mode 100644 index 0000000..897af36 --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests/ContainsAuth.swift @@ -0,0 +1,38 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI +import Foundation + +internal protocol ContainsAuth { + +} + +extension ContainsAuth { + static var hasRegistryCredentials: Bool { + authentication != nil + } + + static var authentication: Authentication? { + let env = ProcessInfo.processInfo.environment + guard let password = env["REGISTRY_TOKEN"], + let username = env["REGISTRY_USERNAME"] + else { + return nil + } + return BasicAuthentication(username: username, password: password) + } +} diff --git a/Tests/ContainerizationTests/ImageTests/ExportOperationTests.swift b/Tests/ContainerizationTests/ImageTests/ExportOperationTests.swift new file mode 100644 index 0000000..9120e57 --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests/ExportOperationTests.swift @@ -0,0 +1,120 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import ContainerizationOCI +import Crypto +import Foundation +import NIO +import Testing + +@testable import Containerization + +@Suite +final class ExportOperationTests { + @Test(arguments: [MediaTypes.dockerManifestList, MediaTypes.index]) + func testIndexPushMediaTypeMatchesBody(_ sourceMediaType: String) async throws { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + defer { try? FileManager.default.removeItem(at: dir) } + + let cs = try LocalContentStore(path: dir) + + // Opaque child mediaType so ExportOperation's recursion stops here + // and we don't have to seed config/layer blobs. + let opaqueType = "application/vnd.test.opaque.v1+json" + let childData = Data("child-amd64".utf8) + let childDigest = SHA256.hash(data: childData).digestString + let childDesc = Descriptor( + mediaType: opaqueType, + digest: childDigest, + size: Int64(childData.count), + platform: Platform(arch: "amd64", os: "linux")) + + let index = Index(mediaType: sourceMediaType, manifests: [childDesc]) + let indexData = try JSONEncoder().encode(index) + let indexDigest = SHA256.hash(data: indexData).digestString + + try await cs.ingest { ingestDir in + for (digest, data) in [(childDigest, childData), (indexDigest, indexData)] { + let path = ingestDir.appendingPathComponent(digest.trimmingDigestPrefix) + try data.write(to: path) + } + } + + let indexDesc = Descriptor( + mediaType: sourceMediaType, + digest: indexDigest, + size: Int64(indexData.count)) + + let capture = CapturingContentClient() + let op = ImageStore.ExportOperation( + name: "test/repo", tag: "v1", contentStore: cs, client: capture) + let pushed = try await op.export(index: indexDesc, platforms: { _ in true }) + + #expect(pushed.mediaType == sourceMediaType) + + let indexPush = try #require( + capture.pushes.first(where: { $0.descriptor.digest == pushed.digest })) + #expect(indexPush.descriptor.mediaType == sourceMediaType) + let pushedIndex = try JSONDecoder().decode(Index.self, from: indexPush.body) + #expect(pushedIndex.mediaType == sourceMediaType) + } +} + +private final class CapturingContentClient: ContentClient, @unchecked Sendable { + struct Push: Sendable { + let descriptor: Descriptor + let body: Data + } + + private let lock = NSLock() + private var _pushes: [Push] = [] + + var pushes: [Push] { + lock.withLock { _pushes } + } + + private struct NotImplemented: Error {} + + func fetch(name: String, descriptor: Descriptor) async throws -> T { + throw NotImplemented() + } + + func fetchBlob(name: String, descriptor: Descriptor, into file: URL, progress: ProgressHandler?) async throws -> (Int64, SHA256Digest) { + throw NotImplemented() + } + + func fetchData(name: String, descriptor: Descriptor) async throws -> Data { + throw NotImplemented() + } + + func push( + name: String, + ref: String, + descriptor: Descriptor, + streamGenerator: () throws -> T, + progress: ProgressHandler? + ) async throws where T.Element == ByteBuffer { + let stream = try streamGenerator() + var data = Data() + for try await buf in stream { + data.append(contentsOf: buf.readableBytesView) + } + lock.withLock { + _pushes.append(Push(descriptor: descriptor, body: data)) + } + } +} diff --git a/Tests/ContainerizationTests/ImageTests/HeaderScanTimingTests.swift b/Tests/ContainerizationTests/ImageTests/HeaderScanTimingTests.swift new file mode 100644 index 0000000..1fa9d75 --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests/HeaderScanTimingTests.swift @@ -0,0 +1,176 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(macOS) +import ContainerizationArchive +import ContainerizationEXT4 +import ContainerizationExtras +import ContainerizationOCI +import Foundation +import SystemPackage +import Testing + +@testable import Containerization + +/// Measures header scan overhead vs. full unpack time using real container images +/// pulled from a registry. +/// +/// Run with: +/// ENABLE_TIMING_TESTS=1 swift test --filter ImageHeaderScanTimingTest +@Suite +struct ImageHeaderScanTimingTest { + private static let isEnabled = ProcessInfo.processInfo.environment["ENABLE_TIMING_TESTS"] != nil + + let store: ImageStore + let dir: URL + let contentStore: ContentStore + + init() throws { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + let cs = try LocalContentStore(path: dir) + let store = try ImageStore(path: dir, contentStore: cs) + self.dir = dir + self.store = store + self.contentStore = cs + } + + @Test(.enabled(if: ImageHeaderScanTimingTest.isEnabled)) + func measureAlpineAndUbuntu() async throws { + defer { try? FileManager.default.removeItem(at: dir) } + + let images: [(reference: String, label: String)] = [ + ("ghcr.io/linuxcontainers/alpine:3.20", "Alpine 3.20"), + ("docker.io/library/ubuntu:24.04", "Ubuntu 24.04"), + ] + + for image in images { + print("\n==============================") + print("Image: \(image.label)") + print("==============================") + + let img = try await store.pull(reference: image.reference, platform: .current) + let manifest = try await img.manifest(for: .current) + + for (i, layer) in manifest.layers.enumerated() { + let content = try await img.getContent(digest: layer.digest) + let compression = compressionFilter(for: layer.mediaType) + let compressedSize = try FileManager.default.attributesOfItem(atPath: content.path.path)[.size] as? Int64 ?? 0 + let label = "\(image.label) layer \(i + 1)/\(manifest.layers.count) (\(layer.mediaType), \(formatBytes(compressedSize)) compressed)" + try await measureOverhead(url: content.path, compression: compression, label: label) + } + } + } + + // MARK: - Helpers + + private func compressionFilter(for mediaType: String) -> ContainerizationArchive.Filter { + switch mediaType { + case MediaTypes.imageLayerZstd, MediaTypes.dockerImageLayerZstd: + return .zstd + case MediaTypes.imageLayer, MediaTypes.dockerImageLayer: + return .none + default: + return .gzip + } + } + + private func measureOverhead(url: URL, compression: ContainerizationArchive.Filter, label: String) async throws { + let clock = ContinuousClock() + + print("\n--- \(label) ---\n") + + // For zstd, pre-decompress once (matching the production code path in EXT4Unpacker). + let scanFile: URL + let scanFilter: ContainerizationArchive.Filter + var decompressedFile: URL? + if compression == .zstd { + var decompressed: URL = url + let decompressDuration = try clock.measure { + decompressed = try ArchiveReader.decompressZstd(url) + } + scanFile = decompressed + scanFilter = .none + decompressedFile = decompressed + print(" Zstd decompress: \(decompressDuration)") + } else { + scanFile = url + scanFilter = compression + } + defer { + if let decompressedFile { + ArchiveReader.cleanUpDecompressedZstd(decompressedFile) + } + } + + // 1. Header scan only + var scannedTotals: (size: Int64, items: Int) = (0, 0) + let scanDuration = try clock.measure { + scannedTotals = try EXT4.Formatter.scanArchiveHeaders( + format: .paxRestricted, filter: scanFilter, file: scanFile) + } + print(" Scanned total size: \(formatBytes(scannedTotals.size)) (\(scannedTotals.items) items)") + print(" Header scan: \(scanDuration)") + + // 2. Full unpack without progress + let tempDir1 = FileManager.default.uniqueTemporaryDirectory() + let fsPath1 = FilePath(tempDir1.appendingPathComponent("no-progress.ext4.img", isDirectory: false)) + defer { try? FileManager.default.removeItem(at: tempDir1) } + + let unpackOnlyDuration = try await clock.measure { + let formatter = try EXT4.Formatter(fsPath1) + try await formatter.unpack(source: url, compression: compression) + try formatter.close() + } + print(" Unpack (no progress): \(unpackOnlyDuration)") + + // 3. Full unpack with progress (includes header scan pass) + let tempDir2 = FileManager.default.uniqueTemporaryDirectory() + let fsPath2 = FilePath(tempDir2.appendingPathComponent("with-progress.ext4.img", isDirectory: false)) + defer { try? FileManager.default.removeItem(at: tempDir2) } + + let noopProgress: ProgressHandler = { _ in } + let withProgressDuration = try await clock.measure { + let formatter = try EXT4.Formatter(fsPath2) + try await formatter.unpack(source: url, compression: compression, progress: noopProgress) + try formatter.close() + } + print(" Unpack (w/ progress): \(withProgressDuration)") + + // Summary + let scanMs = toMs(scanDuration) + let unpackMs = toMs(unpackOnlyDuration) + let withProgressMs = toMs(withProgressDuration) + let overheadMs = withProgressMs - unpackMs + let overheadPct = unpackMs > 0 ? (overheadMs / unpackMs) * 100 : 0 + + print("\n Summary:") + print(" Header scan alone: \(String(format: "%.1f", scanMs)) ms") + print(" Unpack only: \(String(format: "%.1f", unpackMs)) ms") + print(" Unpack + progress: \(String(format: "%.1f", withProgressMs)) ms") + print(" Overhead: \(String(format: "%.1f", overheadMs)) ms (\(String(format: "%.1f", overheadPct))%)") + } + + private func toMs(_ d: Duration) -> Double { + let c = d.components + return Double(c.seconds) * 1000.0 + Double(c.attoseconds) / 1e15 + } + + private func formatBytes(_ bytes: Int64) -> String { + let mb = Double(bytes) / 1_048_576.0 + return "\(String(format: "%.1f", mb)) MB" + } +} +#endif diff --git a/Tests/ContainerizationTests/ImageTests/ImageStoreImagePullTests.swift b/Tests/ContainerizationTests/ImageTests/ImageStoreImagePullTests.swift new file mode 100644 index 0000000..4a21d75 --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests/ImageStoreImagePullTests.swift @@ -0,0 +1,175 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationOCI +import Crypto +import Foundation +import NIO +import Testing + +@testable import Containerization + +@Suite +final class ImageStoreImagePullTests { + let store: ImageStore + let dir: URL + let contentStore: ContentStore + + public init() { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + let cs = try! LocalContentStore(path: dir) + let store = try! ImageStore(path: dir, contentStore: cs) + self.dir = dir + self.store = store + self.contentStore = cs + } + + deinit { + try! FileManager.default.removeItem(at: self.dir) + } + + @Test func testPullImageWithoutIndex() async throws { + let img = try await self.store.pull(reference: "ghcr.io/apple/containerization/dockermanifestimage:0.0.2") + + let rootDescriptor = img.descriptor + let index: ContainerizationOCI.Index = try await contentStore.get(digest: rootDescriptor.digest)! + + #expect(index.manifests.count == 1) + let desc = index.manifests.first! + #expect(desc.platform!.architecture == "amd64") + + await #expect(throws: Never.self) { + let manifest: ContainerizationOCI.Manifest = try await self.contentStore.get(digest: desc.digest)! + let _: ContainerizationOCI.Image = try await self.contentStore.get(digest: manifest.config.digest)! + for layer in manifest.layers { + _ = try await self.contentStore.get(digest: layer.digest)! + } + } + } + + @Test( + arguments: [ + (Platform(arch: "arm64", os: "linux", variant: "v8"), imagePullArm64Layers), + (Platform(arch: "amd64", os: "linux"), imagePullAmd64Layers), + (nil, imagePullTestAllLayers), + ]) + func testPullSinglePlatform(platform: Platform?, expectLayers: [String]) async throws { + let img = try await self.store.pull( + reference: "ghcr.io/linuxcontainers/alpine:3.20@sha256:0a6a86d44d7f93c4f2b8dea7f0eee64e72cb98635398779f3610949632508d57", platform: platform) + let rootDescriptor = img.descriptor + let index: ContainerizationOCI.Index = try await contentStore.get(digest: rootDescriptor.digest)! + var foundMatch = false + for desc in index.manifests { + if let platform { + if desc.platform != platform { + continue + } + } + foundMatch = true + await #expect(throws: Never.self) { + let manifest: ContainerizationOCI.Manifest = try await self.contentStore.get(digest: desc.digest)! + let _: ContainerizationOCI.Image = try await self.contentStore.get(digest: manifest.config.digest)! + for layer in manifest.layers { + _ = try await self.contentStore.get(digest: layer.digest)! + } + } + } + #expect(foundMatch) + let contentPath = dir.appendingPathComponent("blobs/sha256") + let filesOnDisk = try FileManager.default.contentsOfDirectory(at: contentPath, includingPropertiesForKeys: nil).map { + $0.lastPathComponent + }.sorted() + #expect(filesOnDisk == expectLayers) + } + + @Test func testPullWithSha() async throws { + let sha = "sha256:0a6a86d44d7f93c4f2b8dea7f0eee64e72cb98635398779f3610949632508d57" + let r = "ghcr.io/linuxcontainers/alpine:3.20@\(sha)" + let img = try await self.store.pull(reference: r, platform: .current) + #expect(img.descriptor.digest == sha) + } +} + +let imagePullTestAllLayers = [ + "013c522f9494ecda30dc8fbee7805b59c773573fd080c74e6835def22547bd07", + "037316e2a3a13e6d7e15057d3ede6ad063f15c92216778576ee88a74e6f7c6fc", + "0566dbe8e93e20dbfebc6b023399a6eb337719faf1d11dab57f975286c198a00", + "0928a8adc0d420ddda0d25c76e95282534a5b69b13ffcbb6ddbc41c50fc77550", + "0a6a86d44d7f93c4f2b8dea7f0eee64e72cb98635398779f3610949632508d57", + "0a9a5dfd008f05ebc27e4790db0709a29e527690c21bcbcd01481eaeb6bb49dc", + "0c11ea92e0d923e7812d258defbe6788642547fa347969a3dbd7bb7cbc0a9666", + "156724324a3250a38177b0328390d7efb4ba85d7e095ad7af9ca19a3cd46f855", + "1c2a87b1633d21ffcd8192bc84f9bed0c479bbcfbcd8b76b9ca1b8bf8bc61516", + "2803bd9fd5a5e53bc39c576b3e7eaf4839ec77dcc1274c6ad9f7d534ccc566c7", + "2d2e65d21b1f1a7cf14b99e54809bb4eee749fa9145d1e263279e18e246e5e1b", + "34bac5d0022b2997fdfd5c678521d6afe58a4ea6c65d5d31e3ece0be141158ea", + "3e6ec69548a14d7bf37b242f02f26dd41c69e9c510225078ca1f241ef249b3df", + "423949aec9a2fe60140a59926634f90979ac19878957becf9902dcc547592a44", + "4817c12fc96d333e818e9f56f22a7c8683bd3ca8b0c04ce45e188dc6aaf8e5c3", + "4e32c214e82a5d6ccb62b58fb42405fc961c69da5fe02c670f1e4c62c8eb6fbb", + "4ea6a163031004a9a61288b7a5ffbf73d84115d398abe5180caeb15442d1a5fe", + "4f0bb7ea5efffa5762fc231a403f232ca3ea43ef6db18d4bf52aeca8c15d7dec", + "55a8c211d2e969b7b7e9e4825853cf24a75cbbcaf7728db15840c1514838a23d", + "5c979effb79226e255a01eaeb2a525bd12019c02eba2b76f6e0726dd2701508e", + "63e2abc26a64dea41796995524777edc558e143bea4929f06954c52706363f33", + "6d8b5334139bdee0462dd4d6cc85fdec98ad4d97155075973432ec4ff67906c9", + "6f3c7dfa949497fb255d0a28c244e7add0d52ae6318b45947a8a2940d846b2e2", + "718fbe9a22ec3da853bdbd5d8112f2dc8ba41f30d46899b3792242f16a0f8b41", + "744d40c360fd0988b20b15ab845d3db943817b027f38ea6850361bab4ac916be", + "76a0ff976fd7cf0f21858535989ef59ac2ee64a3f1bf1b68d98d15138cd46afa", + "772078ddbdee5be52d429e08f953aaad6715a90d7e4d6496eb1cd4004efa8a95", + "7c6bf3be7c8016421fb3033e19b6a313f264093e1ac9e77c9f931ade0d61b3f7", + "7f608f0a59b5b3717cdd3cc61ef59c329d3c2c16c5fc6963b3b13360d43841c0", + "81fc5885a3ad37110bf576934de28326e1194bd943e020bc3924502335fdf181", + "84df3263e35ed35440625ae0ebb5b1c3d00f57ffcec61188015d5217988a8b35", + "85b46e4c8e4841ce7964ce897a07a4d9df7d589322593fb600dd428e47d635ae", + "872bd582507dfe35ccd496fcd128f61963620053a722b517353f3d9df46412e9", + "8a9fb51ac81600da44afb1c4a5df4745d23eca0cc5d924f989c074f3da7a9440", + "90bb43c8fe064682d965fe27b1ca0cf2b42cf0273914cc20a4e636e174ccdaf5", + "9368b67dac9dc00ca8dbbd25b6f148fd6229b01dac5ff3d89281bd296cf196c6", + "94e9d8af22013aabf0edcaf42950c88b0a1350c3a9ce076d61b98a535a673dd9", + "9cbaf16e9229ef1466c71cf97a75ddd7d2041522012dd1bcace0d56a9ad77688", + "9cfe406db828239417e29e2c00bdf196c32b39ffcead4c2e28cdf60ff8a8dd58", + "adc8e49a814d3e4f73ccdd1d26d4cbd3f1a338b4e136a55c092bdcca57863225", + "b1ca1bb0a5f203b48e1ca60861ae852f49b910ce8488c19c392a3bc7ee31b072", + "b3d7db73e90671cb6b7925cc878d43a2781451bed256cf0626110f5386cdd4dc", + "bfc9829f240e42bab6b756c64179b8e73317baf0e9a8940ea1571cb2f29efcc3", + "c70d93f05189a8a6a10ba5657b8e89e849f2c7491d76587178f75d9fca228bf1", + "c9813c0f5a2f289ea6175876fd973d6d8adcd495da4a23e9273600c8f0a761c5", + "c9aedc9d4e47fa9429e5c329420d8a93e16c433e361d0f9281565ed4da3c057e", + "d27e7628ef6e28a3e91cdc1ef1f998a703d356067ecedddfe9e9281e36d8c9f9", + "ef99f4640fe11015a03439935b827bff242d0db64db27db005a31ab4497db4a2", + "f2c7f3c3fecbf01204eccd798e2f77b0003a8567927a5d6242fd3ed81727fee9", + "f882dda529d0cd4b586a10a7f60048c7f8faaff26d6672008d0478b8b004bc63", +] + +let imagePullArm64Layers = [ + "0a6a86d44d7f93c4f2b8dea7f0eee64e72cb98635398779f3610949632508d57", + "3e6ec69548a14d7bf37b242f02f26dd41c69e9c510225078ca1f241ef249b3df", + "423949aec9a2fe60140a59926634f90979ac19878957becf9902dcc547592a44", + "76a0ff976fd7cf0f21858535989ef59ac2ee64a3f1bf1b68d98d15138cd46afa", + "94e9d8af22013aabf0edcaf42950c88b0a1350c3a9ce076d61b98a535a673dd9", +] + +let imagePullAmd64Layers = [ + "0a6a86d44d7f93c4f2b8dea7f0eee64e72cb98635398779f3610949632508d57", + "0a9a5dfd008f05ebc27e4790db0709a29e527690c21bcbcd01481eaeb6bb49dc", + "156724324a3250a38177b0328390d7efb4ba85d7e095ad7af9ca19a3cd46f855", + "1c2a87b1633d21ffcd8192bc84f9bed0c479bbcfbcd8b76b9ca1b8bf8bc61516", + "4ea6a163031004a9a61288b7a5ffbf73d84115d398abe5180caeb15442d1a5fe", +] diff --git a/Tests/ContainerizationTests/ImageTests/ImageStoreTests.swift b/Tests/ContainerizationTests/ImageTests/ImageStoreTests.swift new file mode 100644 index 0000000..37eda3e --- /dev/null +++ b/Tests/ContainerizationTests/ImageTests/ImageStoreTests.swift @@ -0,0 +1,130 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import ContainerizationArchive +import ContainerizationExtras +import ContainerizationOCI +import Foundation +import Testing + +@testable import Containerization + +@Suite +public class ImageStoreTests: ContainsAuth { + let store: ImageStore + let dir: URL + + public init() { + let dir = FileManager.default.uniqueTemporaryDirectory(create: true) + let cs = try! LocalContentStore(path: dir) + let store = try! ImageStore(path: dir, contentStore: cs) + self.dir = dir + self.store = store + } + + deinit { + try! FileManager.default.removeItem(at: self.dir) + } + + @Test func testImageStoreOperation() async throws { + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { + try? fileManager.removeItem(at: tempDir) + } + + let tarPath = Foundation.Bundle.module.url(forResource: "scratch", withExtension: "tar")! + let reader = try ArchiveReader(format: .pax, filter: .none, file: tarPath) + let rejectedPaths = try reader.extractContents(to: tempDir) + #expect(rejectedPaths.count == 0, "unexpected rejected paths [\(rejectedPaths)]") + + let _ = try await self.store.load(from: tempDir) + let loaded = try await self.store.load(from: tempDir) + let expectedLoadedImage = "registry.local/integration-tests/scratch:latest" + #expect(loaded.first!.reference == "registry.local/integration-tests/scratch:latest") + + guard let authentication = Self.authentication else { + return + } + let imageReference = "ghcr.io/apple/containerization/dockermanifestimage:0.0.2" + let busyboxImage = try await self.store.pull(reference: imageReference, auth: authentication) + + let got = try await self.store.get(reference: imageReference) + #expect(got.descriptor == busyboxImage.descriptor) + + let newTag = "registry.local/integration-tests/dockermanifestimage:latest" + let _ = try await self.store.tag(existing: imageReference, new: newTag) + + let tempFile = self.dir.appending(path: "export.tar") + try await self.store.save(references: [imageReference, expectedLoadedImage], out: tempFile) + } + + @Test(.disabled("External users cannot push images, disable while we find a better solution")) + func testImageStorePush() async throws { + guard let authentication = Self.authentication else { + return + } + let imageReference = "ghcr.io/apple/containerization/dockermanifestimage:0.0.2" + + let remoteImageName = "ghcr.io/apple/test-images/image-push" + let epoch = Int(Date().timeIntervalSince1970.description) + let tag = epoch != nil ? String(epoch!) : "latest" + let upstreamTag = "\(remoteImageName):\(tag)" + let _ = try await self.store.tag(existing: imageReference, new: upstreamTag) + try await self.store.push(reference: upstreamTag, auth: authentication) + } + + @Test(.disabled("External users cannot push images, disable while we find a better solution")) + func testImageStorePushMultipleReferences() async throws { + guard let authentication = Self.authentication else { + return + } + let imageReference = "ghcr.io/apple/containerization/dockermanifestimage:0.0.2" + + let remoteImageName = "ghcr.io/apple/test-images/image-push" + let epoch = Int(Date().timeIntervalSince1970) + let tags = ["\(remoteImageName):\(epoch)-a", "\(remoteImageName):\(epoch)-b", "\(remoteImageName):\(epoch)-c"] + for tag in tags { + let _ = try await self.store.tag(existing: imageReference, new: tag) + } + try await self.store.push(references: tags, auth: authentication, maxConcurrentUploads: 2) + } + + @Test func testLoadImageWithoutAnnotations() async throws { + let fileManager = FileManager.default + let tempDir = fileManager.uniqueTemporaryDirectory() + defer { + try? fileManager.removeItem(at: tempDir) + } + + let tarPath = Foundation.Bundle.module.url(forResource: "scratch_no_annotations", withExtension: "tar")! + let reader = try ArchiveReader(format: .pax, filter: .none, file: tarPath) + let rejectedPaths = try reader.extractContents(to: tempDir) + #expect(rejectedPaths.count == 0, "unexpected rejected paths [\(rejectedPaths)]") + + let loaded = try await self.store.load(from: tempDir) + + #expect(loaded.count == 1) + + let reference = loaded.first!.reference + #expect(reference.hasPrefix("untagged@sha256:")) + + let retrieved = try await self.store.get(reference: reference) + #expect(retrieved.reference == reference) + } +} diff --git a/Tests/ContainerizationTests/ImageTests/Resources/scratch.tar b/Tests/ContainerizationTests/ImageTests/Resources/scratch.tar new file mode 100644 index 0000000000000000000000000000000000000000..077d14a6633237883e2fea9aa9cbcb429fce834f GIT binary patch literal 19968 zcmeHO&5PW~6`#e#1Rp|<$tjJNKw!t+^`)xPz>;-v%sK?JVNC*Yj49Q}j6B`aAgOyj z9tJkBr_C*goO8{8u?8Ok*@HIsJXIt^OM$iul$bywF+AiBF4CPmz#c)G_e5Jm3Cfiu?V4DJNiM|4FQ47n)dLP6@`5;ZYQ`2uHC-N*NSd zf?~%*98v4v63PfE1PPgToI2MsW5555u?1`RXZSSFIAjaiP`498Fxwh*=E;`%tTcbc z`Tr=mTOJ5 zOmz|i{&nm2f=`~Z$8Vni=omgL0_W9wSdsq}WIi^L(b_3s5{Ip@5pYJV6|;nJO9gNS zvn-69ikyuoV_LdU$5?8DAB1Z2Ic1=}D{2M1#>`Qe4pEH%SSC&Of-cI|MY(!_!69nSDO_X?0{Rp(l&1v>*j zz_SypyRDFd&W&(~nO27C4j3pJ$%tSQJ41xkGE`Da&9#)yG8I!sO{kR+p##y+h;u|} zW#Hr@6-p41^{k5I0WkIea{&*cMu-MK63I{?OSyAk&NC4yYFNy? zeG*$4g`q{D9Hc%a{~3uuuyv6COKn)G571vjuyEhmeUKb1W%imn2q{twRGD{2h!VhP zVaTOYjDx?zolu-22Z~N1%czY|NE~+Xa%3c7Si2?ZMvo!>ykdHV|GUE4ax~B5f4+HYr}I5*mS6sTP9B_(*O)7(4fYGNvfx-sC6f*+9AK}m7&UWzgEZ>NBJQxk$9yE@5?KIY|Z|$Ojw?15Y$lk5?(SQtW ztJ)og9(k6Pu5vJIYbu!Ajy@XU+}*^$Z?_wh)o2dVhZ2UU=A3EprXV1pV;eC=q|z?J z%xhMw6=FDy1*{ukEEOo^NX9t0b0L1@D*qF$H7CvzBRLj^D{GX(oLD0?!VXJHBNeNN zNJnVIw2d*3BLa3U7Si&TlX(vRpB4WDdEWDX3!EEme(mFbb8*!u*AwwS+R>Wr<9}7C zwGnuI{Le=P-{|;XSA(=gGMyv;5e~^I{}1=^zZNVv-Ta+jf4wI8*f7KmO}CF8%6H|NPCP;PRzU zzx=^}zWC-_-~N3R{r8ubzWns3=*o?U-}~0r{(bplp#0>?KW_a!-I@=w>Dl-6x+1V* z|8)(kwoK+c{wGYF;(xdRM!o&l0_R4X*ZjX}x}RnrK@`9Cb(W6{htOY)J&)(pIqH2e zp3g>Md~J!X@PF4E^A;4&dMEn!Bn>b8AW+pzUDdnkJs~mu%JEvZRM} z+(#fMV#y&pQ6WR%;)Fon4~;MiV@oL^5u9Y<@3*RZ(nkNkto)y_Rq#({`@= z_Gd$2#sBNdRxLxGBmdEQ{09q23GMU$Tkzau^P2s)4ER)c-OI;?LHNA!pUzURkN<3P z$5&~s@;@X`Nn#u&!f64S7dX~VQzs!afr3Uwjv}Nbmx!`BjN8(tM2os281sd7jX`b)G<7Q@%hrI%hpB z);>=vd;vJ>oQzikj*cZQYo{aR;R2!7lzU$xQ74ZLbL(twp&)K}aVHl}+?gXbN&c$z z#dCF8UBjC}b1oOFdA75@FbGa>Z}US#xB9MfY6lD6=~Pp4Hv4ytSzP1>Z;TgT;SGju z?khq%+93bO?zQ&zbz2uV3Ge?wl6!Nd#u2zEjtw`)rAPcbFZ3qHib`bBa&PRHr_zy|pKp4#W9;=EFcm`i6_|pmOCZq^)Pu z^2DLo@So?!e-P!3Oz^L6LE1Z1cJ}_?hPUBNa=-*J~V)%>2P>Uk>M3wK<<5JHmk!A|)uX76xW-NQRVgwX-!7%@f};%I;{m6+}fkn4(- z`5#ZFx`3(``rvppJ+OJM3q3hrEBeg?Ye#FTbwbsWWupf52T%Cb`#=7Ho%ikRd|8{p zS6&-@b1;9EX*(Z+KLUT>fxq(pm+O}`NYrR@57D9o~hG6X2yr1J~|rN z@TeG{*j(qv?mY9pofm)n>!1A^egA8XNBwP|5_m=5dCBU;7DIDf6gHnGSs_|8N-YjZJoSr0+6l1LSS3gG$wCc0p&WrV{D^-it8UHFI3SNMO4e^~wj{CoSa`=L?t zzbsGeo$!sxICoPX^sjhi`){@W&!zD8UpJl6%+>S1rbM2q`&ItuY98ps|0@5h@Gm*` z_TP<+!zTZmt^W&H|5wV}e>c(vTP-9Ux z2lh}eO~2$yaA=cE-@JQd!4O<-%*%|Pf?0TYk|!ao7KD|>IGl}}6Z~9B90Pbt=UHke z(@C)V`ssg|N0RMB4p8jmKoc%@Ete=FNlJ-KjYK5Eu}KY0BiJWOwMHnV2$@Jkh_X0V zCXs2JDyp{dXh7qS6219>rMUL?y!u~(+|K)xtwevs9sFGND{^z~}wp>C3|2?9rRwjb;c$^srev)N=eFHV`tN8HWd0NVq?%S`ChHunQV0{(AM5S@pXbkmXmWQe$dI}u97Okoupq;-P0B`8h>$BNqWTT&-70%e>tlM0%q^J>=>kA#}F1d?=~kEfNP zzO4PC-tfV^a$zt;>E}xI;j0IP1pzAMTk{kw_U>L@_b7UM64Gj(+2)){jbM)pcDV=`X6E7 z|L^rb_oL_m`d<`LzyI64^tWF^1OGjuzHVCw{@e6FiU9v@T%yjkr>mzt{!ghVTs-~H zGT^5WtcU?cHHJ`brNIgr8>3Xlkwi7Y1D*J9(f|DV-)4qRyZ*a|HUW=7&Ef=Wfs7E~8AJruu}zqO{bCk#MqrO(OI5q^zsCPL z^YNcrBg;VJS;u|adEebFZCFY&A+-A!;`_a>(>Y2FwI7GFdTep z5FclwceMF4$@r4gB|r`np*i_y@z`8vh5kQqTWu3A(#F4ff_+cov@EEAHa2fj_w|Npa~4 zj)Czm{m19gVHeLl(0d%>uO7#5z~-WgwCDP;++uWedw+LEt%rr(2U1_$4QDzm@2IykHc|%7aZx!hKJ)~f4I;nK6g?|G0RUtgDOMnmKn|VRlPPo zE({3gGyriIcV8KUD4>ArOAVwf>PQzL!D$tr;50~!F^DTK>v6xLawVvwS?<9)4dyb3 zQl|FK6mnT6)enJc1G(G$B!etxO3-Pr5H)09341ux4A0=3PzUg^nd+rTZY*1L<2rml zBm87CJ|Po1x-Ac)H{N1nd<=^NZ$jfMQNX||KH)>+aajIbipBX}Z(|1Gq$u+WLgvB}~Q zbWN2CTIf7t!bAG_Q!4^GgO@w_o;&Bp{15Tp&WW0q8gxd-@DBlH zo9jQ4`QQIqfDW%NrvE?35T4jVST_XW-MC0Fg%DH*>-|ACQDn}TIUl)Rg^W6Sh*-`DYzfe(^QS3NH8Ukp+ z*?4f?g@!O&h;tEX%|yhJNTn7Or4Z;&Bg-HZ7vdzvDSTNa5t!%9dN??Ur17|6+8X$W z^`CQAs%5Np;eUPoN5Bct-u}}f%Kno)|L7bwRD{%ii<<2=xb|0e$@aQr9i|MvXf z{XlvE|BtweBI(zE+;_m1OK9M~N7UC1>%u=6`x^Y8`}ohb_?%vS@<$(><^SH7e)szu z_7@mB3n7Z1`QxQam;T9K`sv&E-uc__@4fS$Y{^zis~)7vBC~3((=!h2Q@*cUM^$ z*H`v`MUo_vA&F82_VkE?yM-W}z=`6e!97j6COE=8Np+kEIN{Jnu}%dXw}J$maA^Jh zuh~{RzyIs0+W&RlrL~s1s$>3d+5aUZ^6@`fBwgY}dU3LB@V{FB>v10F#Q(bf z$EZL5eItYD0s0@DPsf$;>pvUmgKZYlz<-aZuUplH{}%s$Uhe<&{{OWMU0tpF|IZz2 zmf?QA|Nm3v|9@Vsxn-bs;lE}52fR-`{#!)Zf0F0_{mb+M<=FWBulawE^FSy5*ZDv8 z{{Nd9MD6?^+;1c-0D1nunNHYZDGmJhi2AxwUHEVD{~*Z!{?`I@cy%%TKh7Jb&ij8X zhExOpaQ+`S&_pCjDUqp>5Pc2DCN(sTAUYX^Q#Daa5i*g85M^J$O(BY-${|<%wcfJWSZWMX+=#Y~<*1Yan_1P^9mvx0f* zS@mA|m=BhDIS|KrBRKRSj@c5@lOYa_6;4zF@d7mL`-4MEq*bulFE*N40zsH5SRW9x zjH^_u)GErDiBevM3@`-8YvSO7FGq*Y^D%_TgFtR&f3FOXaxl-rtA&M4ZDDg`Lw6$= zMqF!&v&eohKBr~yyjfVi1+tdoa@m?k8|%ySL7UyX_+Z219Rg>Q2+p6;%ES;Pfd~bG z6jY*wh~hL#wdNMW`YFsMMBk1f+(H?Hn-F9rN;DP7We4|$#V5Ffp}TKgev%{Hx%%bw P`FaU>33v%yYzh27%$&f- literal 0 HcmV?d00001 diff --git a/Tests/ContainerizationTests/InterfaceTests.swift b/Tests/ContainerizationTests/InterfaceTests.swift new file mode 100644 index 0000000..c00ecca --- /dev/null +++ b/Tests/ContainerizationTests/InterfaceTests.swift @@ -0,0 +1,59 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationExtras +import Testing + +@testable import Containerization + +struct InterfaceTests { + + /// A minimal `Interface` conformer that only sets the IPv4 surface, relying on the + /// protocol's default extensions to fill in `ipv6Address`, `ipv6Gateway`, and `mtu`. + private struct V4OnlyInterface: Interface { + let ipv4Address: CIDRv4 + let ipv4Gateway: IPv4Address? + let macAddress: MACAddress? + } + + @Test func interfaceProtocolV6Defaults() throws { + let i = V4OnlyInterface( + ipv4Address: try CIDRv4("10.0.0.2/24"), + ipv4Gateway: try IPv4Address("10.0.0.1"), + macAddress: nil) + #expect(i.ipv6Address == nil) + #expect(i.ipv6Gateway == nil) + #expect(i.mtu == 1500) + } + + @Test func natInterfaceRoundTripsV6Fields() throws { + let nat = NATInterface( + ipv4Address: try CIDRv4("10.0.0.2/24"), + ipv4Gateway: try IPv4Address("10.0.0.1"), + ipv6Address: try CIDRv6("fd00::2/64"), + ipv6Gateway: try IPv6Address("fd00::1")) + #expect(nat.ipv6Address == (try CIDRv6("fd00::2/64"))) + #expect(nat.ipv6Gateway == (try IPv6Address("fd00::1"))) + } + + @Test func natInterfaceV6FieldsDefaultToNil() throws { + let nat = NATInterface( + ipv4Address: try CIDRv4("10.0.0.2/24"), + ipv4Gateway: try IPv4Address("10.0.0.1")) + #expect(nat.ipv6Address == nil) + #expect(nat.ipv6Gateway == nil) + } +} diff --git a/Tests/ContainerizationTests/KernelTests.swift b/Tests/ContainerizationTests/KernelTests.swift new file mode 100644 index 0000000..dcc087a --- /dev/null +++ b/Tests/ContainerizationTests/KernelTests.swift @@ -0,0 +1,93 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// + +import Foundation +import Logging +import Testing + +@testable import Containerization + +final class KernelTests { + @Test func kernelArgs() { + let commandLine = Kernel.CommandLine(debug: false, panic: 0) + let kernel = Kernel(path: .init(fileURLWithPath: ""), platform: .linuxArm, commandline: commandLine) + + let expected = "console=hvc0 tsc=reliable panic=0" + let cmdline = kernel.commandLine.kernelArgs.joined(separator: " ") + #expect(cmdline == expected) + } + + @Test func kernelDebugArgs() { + let cmdLine = Kernel.CommandLine(debug: true, panic: 0) + let kernel = Kernel(path: .init(fileURLWithPath: ""), platform: .linuxArm, commandline: cmdLine) + + let expected = "console=hvc0 tsc=reliable debug panic=0" + let cmdline = kernel.commandLine.kernelArgs.joined(separator: " ") + #expect(cmdline == expected) + } + + @Test func kernelCommandLineInitWithDebugTrue() { + let commandLine = Kernel.CommandLine(debug: true, panic: 5, initArgs: ["--verbose"]) + + #expect(commandLine.kernelArgs == ["console=hvc0", "tsc=reliable", "debug", "panic=5"]) + #expect(commandLine.initArgs == ["--verbose"]) + } + + @Test func kernelCommandLineMutatingMethods() { + var commandLine = Kernel.CommandLine(kernelArgs: ["console=hvc0"], initArgs: []) + + commandLine.addDebug() + commandLine.addPanic(level: 10) + + #expect(commandLine.kernelArgs == ["console=hvc0", "debug", "panic=10"]) + } + + @Test func setAgentLogLevelAppendsFlagAndValue() { + var commandLine = Kernel.CommandLine(initArgs: []) + commandLine.setAgentLogLevel(level: .debug) + #expect(commandLine.initArgs == ["--log-level", "debug"]) + } + + @Test(arguments: [ + (Logger.Level.trace, "trace"), + (.debug, "debug"), + (.info, "info"), + (.notice, "notice"), + (.warning, "warning"), + (.error, "error"), + (.critical, "critical"), + ]) + func setAgentLogLevelForEachLevel(level: Logger.Level, expected: String) { + var commandLine = Kernel.CommandLine(initArgs: []) + commandLine.setAgentLogLevel(level: level) + #expect(commandLine.initArgs == ["--log-level", expected]) + } + + @Test func setAgentLogLevelPreservesExistingInitArgs() { + var commandLine = Kernel.CommandLine(initArgs: ["--verbose"]) + commandLine.setAgentLogLevel(level: .info) + #expect(commandLine.initArgs == ["--verbose", "--log-level", "info"]) + } + + @Test func setAgentLogLevelDoesNotAffectKernelArgs() { + var commandLine = Kernel.CommandLine(debug: true, panic: 0, initArgs: []) + let kernelArgsBefore = commandLine.kernelArgs + commandLine.setAgentLogLevel(level: .warning) + #expect(commandLine.kernelArgs == kernelArgsBefore) + } +} diff --git a/Tests/ContainerizationTests/LinuxContainerTests.swift b/Tests/ContainerizationTests/LinuxContainerTests.swift new file mode 100644 index 0000000..713e398 --- /dev/null +++ b/Tests/ContainerizationTests/LinuxContainerTests.swift @@ -0,0 +1,122 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Testing + +@testable import Containerization + +struct LinuxContainerTests { + + @Test func processInitFromImageConfigWithAllFields() { + let imageConfig = ImageConfig( + user: "appuser", + env: ["NODE_ENV=production", "PORT=3000"], + entrypoint: ["/usr/bin/node"], + cmd: ["app.js", "--verbose"], + workingDir: "/app" + ) + + let process = LinuxProcessConfiguration(from: imageConfig) + + #expect(process.workingDirectory == "/app") + #expect(process.environmentVariables == ["NODE_ENV=production", "PORT=3000"]) + #expect(process.arguments == ["/usr/bin/node", "app.js", "--verbose"]) + #expect(process.user.username == "appuser") + } + + @Test func processInitFromImageConfigWithNilValues() { + let imageConfig = ImageConfig( + user: nil, + env: nil, + entrypoint: nil, + cmd: nil, + workingDir: nil + ) + + let process = LinuxProcessConfiguration(from: imageConfig) + + #expect(process.workingDirectory == "/") + #expect(process.environmentVariables == []) + #expect(process.arguments == []) + #expect(process.user.username == "") // Default User() has empty string username + } + + @Test func processInitFromImageConfigEntrypointAndCmdConcatenation() { + let imageConfig = ImageConfig( + entrypoint: ["/bin/sh", "-c"], + cmd: ["echo 'hello'", "&&", "sleep 10"] + ) + + let process = LinuxProcessConfiguration(from: imageConfig) + + #expect(process.arguments == ["/bin/sh", "-c", "echo 'hello'", "&&", "sleep 10"]) + } + + @Test func defaultCapabilitiesAreRestrictedOCISet() { + // Regression guard against shipping `.allCapabilities` as the default. + // A default container must not receive CAP_SYS_ADMIN, which would let it + // write /proc/sys/kernel/core_pattern and escape to guest-root. Cover both + // construction paths: the no-argument init (property default) and the full + // memberwise init (parameter default). + let viaProperty = LinuxProcessConfiguration() + let viaInit = LinuxProcessConfiguration(arguments: ["/bin/sh"]) + + for caps in [viaProperty.capabilities, viaInit.capabilities] { + for set in [caps.bounding, caps.effective, caps.permitted, caps.inheritable, caps.ambient] { + #expect(!set.contains(.sysAdmin), "default capabilities must not include CAP_SYS_ADMIN") + } + } + + // The default must be exactly the documented OCI baseline. + let expected = LinuxCapabilities.defaultOCICapabilities + #expect(viaProperty.capabilities.bounding == expected.bounding) + #expect(viaProperty.capabilities.effective == expected.effective) + #expect(viaProperty.capabilities.permitted == expected.permitted) + #expect(viaProperty.capabilities.inheritable == expected.inheritable) + #expect(viaProperty.capabilities.ambient == expected.ambient) + #expect(viaInit.capabilities.bounding == expected.bounding) + } + + @Test func defaultMaskedAndReadonlyPathsAreOCISet() { + // Regression guard: masked/readonly paths must default to the OCI + // standard set now that capabilities default to the restricted baseline. + // Without CAP_SYS_ADMIN a workload can't unmount these, so the defaults + // are meaningful defense-in-depth — shipping empty defaults would leave + // /proc/kcore and friends exposed. Cover both construction paths and + // both configuration types. + let expectedMasked = LinuxContainer.defaultMaskedPaths() + let expectedReadonly = LinuxContainer.defaultReadonlyPaths() + + // Sensitive kernel paths must actually be in the defaults. + #expect(expectedMasked.contains("/proc/kcore")) + #expect(expectedMasked.contains("/sys/firmware")) + #expect(expectedReadonly.contains("/proc/sys")) + + let containerViaProperty = LinuxContainer.Configuration() + let containerViaInit = LinuxContainer.Configuration(process: LinuxProcessConfiguration(arguments: ["/bin/sh"])) + let pod = LinuxPod.ContainerConfiguration() + + for config in [containerViaProperty, containerViaInit] { + #expect(config.maskedPaths == expectedMasked) + #expect(config.readonlyPaths == expectedReadonly) + } + #expect(pod.maskedPaths == expectedMasked) + #expect(pod.readonlyPaths == expectedReadonly) + } +} diff --git a/Tests/ContainerizationTests/MountCHTests.swift b/Tests/ContainerizationTests/MountCHTests.swift new file mode 100644 index 0000000..4b809ea --- /dev/null +++ b/Tests/ContainerizationTests/MountCHTests.swift @@ -0,0 +1,72 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import CloudHypervisor +import Testing + +@testable import Containerization + +@Suite("Mount+CH") +struct MountCHTests { + @Test("block mount without options produces DiskConfig with readonly=false") + func blockNoOptions() { + let mount = Mount.block(format: "ext4", source: "/foo.img", destination: "/data") + let cfg = mount.chDiskConfig(id: "blk-0") + #expect(cfg?.path == "/foo.img") + #expect(cfg?.readonly == false) + #expect(cfg?.id == "blk-0") + #expect(cfg?.direct == nil) + #expect(cfg?.iommu == nil) + #expect(cfg?.pciSegment == nil) + } + + @Test("block mount with 'ro' option produces DiskConfig with readonly=true") + func blockReadOnly() { + let mount = Mount.block(format: "ext4", source: "/foo.img", destination: "/data", options: ["ro"]) + let cfg = mount.chDiskConfig(id: "blk-1") + #expect(cfg?.readonly == true) + } + + @Test("non-block mount returns nil from chDiskConfig") + func chDiskConfigNilForNonBlock() { + let share = Mount.share(source: "/host", destination: "/guest") + #expect(share.chDiskConfig(id: "x") == nil) + + let any = Mount.any(type: "tmpfs", source: "tmpfs", destination: "/tmp") + #expect(any.chDiskConfig(id: "x") == nil) + } + + @Test("share mount produces FsConfig with tag and socket") + func shareMount() { + let mount = Mount.share(source: "/host/dir", destination: "/guest/dir") + let cfg = mount.chFsConfig(tag: "share0", socketPath: "/tmp/vfs.sock", id: "fs-0") + #expect(cfg?.tag == "share0") + #expect(cfg?.socket == "/tmp/vfs.sock") + #expect(cfg?.id == "fs-0") + #expect(cfg?.numQueues == nil) + #expect(cfg?.queueSize == nil) + #expect(cfg?.pciSegment == nil) + } + + @Test("non-share mount returns nil from chFsConfig") + func chFsConfigNilForNonShare() { + let block = Mount.block(format: "ext4", source: "/foo.img", destination: "/data") + #expect(block.chFsConfig(tag: "t", socketPath: "/s", id: "x") == nil) + + let any = Mount.any(type: "tmpfs", source: "tmpfs", destination: "/tmp") + #expect(any.chFsConfig(tag: "t", socketPath: "/s", id: "x") == nil) + } +} diff --git a/Tests/ContainerizationTests/MountTests.swift b/Tests/ContainerizationTests/MountTests.swift new file mode 100644 index 0000000..231dcc6 --- /dev/null +++ b/Tests/ContainerizationTests/MountTests.swift @@ -0,0 +1,357 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOCI +import Foundation +import Testing + +@testable import Containerization + +struct MountTests { + + @Test func mountShareCreatesVirtiofsMount() { + let mount = Mount.share( + source: "/host/shared", + destination: "/guest/shared", + options: ["rw", "noatime"], + runtimeOptions: ["tag=shared"] + ) + + #expect(mount.type == "virtiofs") + #expect(mount.source == "/host/shared") + #expect(mount.destination == "/guest/shared") + #expect(mount.options == ["rw", "noatime"]) + + if case .virtiofs(let opts) = mount.runtimeOptions { + #expect(opts == ["tag=shared"]) + } else { + #expect(Bool(false), "Expected virtiofs runtime options") + } + } + + @Test func sortMountsByDestinationDepthPreventsParentShadowing() { + let mounts: [ContainerizationOCI.Mount] = [ + .init(destination: "/tmp/foo/bar"), + .init(destination: "/tmp"), + .init(destination: "/var/log/app"), + .init(destination: "/var"), + ] + + let sorted = sortMountsByDestinationDepth(mounts) + + #expect( + sorted.map(\.destination) == [ + "/tmp", + "/var", + "/tmp/foo/bar", + "/var/log/app", + ]) + } + + @Test func sortMountsByDestinationDepthPreservesOrderForEqualDepth() { + let mounts: [ContainerizationOCI.Mount] = [ + .init(destination: "/b"), + .init(destination: "/a"), + .init(destination: "/c"), + ] + + let sorted = sortMountsByDestinationDepth(mounts) + + // All same depth, order should be preserved (stable sort). + #expect(sorted.map(\.destination) == ["/b", "/a", "/c"]) + } + + @Test func sortMountsByDestinationDepthHandlesTrailingAndDoubleSlashes() { + let mounts: [ContainerizationOCI.Mount] = [ + .init(destination: "/a//b/c"), + .init(destination: "/a/"), + ] + + let sorted = cleanAndSortMounts(mounts) + + // Paths are cleaned: "/a/" -> "/a", "/a//b/c" -> "/a/b/c" + #expect(sorted.map(\.destination) == ["/a", "/a/b/c"]) + } + + @Test func sortMountsByDestinationDepthCleansDotAndDotDot() { + let mounts: [ContainerizationOCI.Mount] = [ + .init(destination: "/tmp/../foo"), + .init(destination: "/tmp/./bar/baz"), + .init(destination: "/"), + ] + + let sorted = cleanAndSortMounts(mounts) + + // "/tmp/../foo" -> "/foo", "/tmp/./bar/baz" -> "/tmp/bar/baz" + #expect(sorted.map(\.destination) == ["/", "/foo", "/tmp/bar/baz"]) + } +} + +@Suite("AttachedFilesystem runtimeOptions dispatch") +struct AttachedFilesystemTests { + + @Test func virtioblkMountAllocatesBlockDevice() throws { + let mount = Mount.block( + format: "ext4", + source: "/path/to/disk.img", + destination: "/data" + ) + let allocator = Character.blockDeviceTagAllocator() + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + + #expect(attached.source == "/dev/vda") + #expect(attached.type == "ext4") + #expect(attached.destination == "/data") + } + + @Test func nbdMountAllocatesBlockDevice() throws { + let mount = Mount.block( + format: "ext4", + source: "nbd://localhost:10809", + destination: "/data" + ) + let allocator = Character.blockDeviceTagAllocator() + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + + #expect(attached.source == "/dev/vda") + #expect(attached.type == "ext4") + #expect(attached.destination == "/data") + } + + @Test func nbdMountWithNonExt4FormatAllocatesBlockDevice() throws { + let mount = Mount.block( + format: "xfs", + source: "nbd://localhost:10809", + destination: "/data" + ) + let allocator = Character.blockDeviceTagAllocator() + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + + #expect(attached.source == "/dev/vda") + #expect(attached.type == "xfs") + } + + @Test func multipleBlockDevicesAllocateSequentially() throws { + let allocator = Character.blockDeviceTagAllocator() + + let m1 = Mount.block(format: "ext4", source: "/disk1.img", destination: "/a") + let m2 = Mount.block(format: "ext4", source: "nbd://host:10809", destination: "/b") + let m3 = Mount.block(format: "ext4", source: "/disk2.img", destination: "/c") + + let a1 = try AttachedFilesystem(mount: m1, allocator: allocator) + let a2 = try AttachedFilesystem(mount: m2, allocator: allocator) + let a3 = try AttachedFilesystem(mount: m3, allocator: allocator) + + #expect(a1.source == "/dev/vda") + #expect(a2.source == "/dev/vdb") + #expect(a3.source == "/dev/vdc") + } + + @Test func anyMountUsesSourceDirectly() throws { + let mount = Mount.any( + type: "tmpfs", + source: "tmpfs", + destination: "/tmp" + ) + let allocator = Character.blockDeviceTagAllocator() + let attached = try AttachedFilesystem(mount: mount, allocator: allocator) + + #expect(attached.source == "tmpfs") + } +} + +@Suite("PodVolume and shared mount types") +struct PodVolumeTests { + + @Test func podVolumeNBDSourceCreation() { + let volume = LinuxPod.PodVolume( + name: "shared-data", + source: .nbd(url: URL(string: "nbd://localhost:10809")!), + format: "ext4" + ) + + #expect(volume.name == "shared-data") + #expect(volume.format == "ext4") + if case .nbd(let url, let timeout, let readOnly) = volume.source { + #expect(url.absoluteString == "nbd://localhost:10809") + #expect(timeout == nil) + #expect(readOnly == false) + } else { + Issue.record("Expected .nbd source") + } + } + + @Test func podVolumeNBDSourceWithOptions() { + let volume = LinuxPod.PodVolume( + name: "data", + source: .nbd(url: URL(string: "nbd://host:10809")!, timeout: 30, readOnly: true), + format: "xfs" + ) + + if case .nbd(_, let timeout, let readOnly) = volume.source { + #expect(timeout == 30) + #expect(readOnly == true) + } else { + Issue.record("Expected .nbd source") + } + } + + @Test func podVolumeToMountConvertsCorrectly() { + let volume = LinuxPod.PodVolume( + name: "my-vol", + source: .nbd(url: URL(string: "nbd://host:10809/export")!), + format: "ext4" + ) + + let mount = volume.toMount() + + #expect(mount.source == "nbd://host:10809/export") + #expect(mount.destination == "/run/volumes/my-vol") + #expect(mount.type == "ext4") + #expect(mount.isBlock) + } + + @Test func podVolumeToMountWithReadOnlySetsOptions() { + let volume = LinuxPod.PodVolume( + name: "ro-vol", + source: .nbd(url: URL(string: "nbd://host:10809")!, readOnly: true), + format: "ext4" + ) + + let mount = volume.toMount() + + #expect(mount.options.contains("ro")) + #expect(mount.isBlock) + } + + @Test func podVolumeToMountWithTimeoutSetsRuntimeOption() { + let volume = LinuxPod.PodVolume( + name: "data", + source: .nbd(url: URL(string: "nbd://host:10809")!, timeout: 60), + format: "ext4" + ) + + let mount = volume.toMount() + + if case .virtioblk(let opts) = mount.runtimeOptions { + #expect(opts.contains("vzTimeout=60.0")) + } else { + Issue.record("Expected virtioblk runtime options") + } + } + + @Test func podVolumeToMountUsesMountType() { + let volume = LinuxPod.PodVolume( + name: "data", + source: .nbd(url: URL(string: "nbd://host:10809")!), + format: "xfs" + ) + + let mount = volume.toMount() + + #expect(mount.type == "xfs") + } + + @Test func podVolumeDiskImageSourceCreation() { + let volume = LinuxPod.PodVolume( + name: "disk-data", + source: .diskImage(path: URL(fileURLWithPath: "/tmp/disk.ext4")), + format: "ext4" + ) + + #expect(volume.name == "disk-data") + #expect(volume.format == "ext4") + if case .diskImage(let path, let readOnly) = volume.source { + #expect(path.path == "/tmp/disk.ext4") + #expect(readOnly == false) + } else { + Issue.record("Expected .diskImage source") + } + } + + @Test func podVolumeDiskImageToMountConvertsCorrectly() { + let volume = LinuxPod.PodVolume( + name: "my-disk", + source: .diskImage(path: URL(fileURLWithPath: "/tmp/my-disk.ext4")), + format: "ext4" + ) + + let mount = volume.toMount() + + // The mount source must be the raw filesystem path, not a file:// URL. + #expect(mount.source == "/tmp/my-disk.ext4") + #expect(mount.destination == "/run/volumes/my-disk") + #expect(mount.type == "ext4") + #expect(mount.isBlock) + } + + @Test func podVolumeDiskImageReadOnlySetsOptions() { + let volume = LinuxPod.PodVolume( + name: "ro-disk", + source: .diskImage(path: URL(fileURLWithPath: "/tmp/ro-disk.ext4"), readOnly: true), + format: "ext4" + ) + + let mount = volume.toMount() + + #expect(mount.options.contains("ro")) + #expect(mount.isBlock) + } + + @Test func sharedMountCreation() { + let mount = Mount.sharedMount( + name: "shared-data", + destination: "/data", + options: ["ro"] + ) + + #expect(mount.source == "shared-data") + #expect(mount.destination == "/data") + #expect(mount.options == ["ro"]) + #expect(mount.type == "none") + if case .shared = mount.runtimeOptions { + // correct + } else { + Issue.record("Expected .shared runtime options") + } + } + + @Test func sharedMountDefaultOptions() { + let mount = Mount.sharedMount(name: "data", destination: "/mnt") + + #expect(mount.options.isEmpty) + } + + @Test func sharedMountIsNotBlock() { + let mount = Mount.sharedMount(name: "data", destination: "/mnt") + + #expect(!mount.isBlock) + } + + @Test func sharedMountDoesNotAllocateBlockDevice() throws { + let allocator = Character.blockDeviceTagAllocator() + + // Shared mount should not consume a device letter. + let shared = Mount.sharedMount(name: "vol", destination: "/data") + let attached = try AttachedFilesystem(mount: shared, allocator: allocator) + #expect(attached.source == "vol") + + // Next block device should still get vda. + let block = Mount.block(format: "ext4", source: "/disk.img", destination: "/mnt") + let blockAttached = try AttachedFilesystem(mount: block, allocator: allocator) + #expect(blockAttached.source == "/dev/vda") + } +} diff --git a/Tests/ContainerizationTests/TAPNameDerivationTests.swift b/Tests/ContainerizationTests/TAPNameDerivationTests.swift new file mode 100644 index 0000000..7f52500 --- /dev/null +++ b/Tests/ContainerizationTests/TAPNameDerivationTests.swift @@ -0,0 +1,59 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) +import Testing + +@testable import Containerization + +@Suite("TAP name derivation") +struct TAPNameDerivationTests { + @Test("name is deterministic for a given id") + func deterministic() { + let a = LinuxBridgedNetwork.derivedTAPName(forID: "container-abc") + let b = LinuxBridgedNetwork.derivedTAPName(forID: "container-abc") + #expect(a == b) + } + + @Test("different ids produce different names") + func differentIds() { + let a = LinuxBridgedNetwork.derivedTAPName(forID: "alpha") + let b = LinuxBridgedNetwork.derivedTAPName(forID: "beta") + #expect(a != b) + } + + @Test("name fits within IFNAMSIZ - 1 (15 chars)") + func ifnamsizFit() { + for id in ["a", "short", "a-much-longer-container-id-that-exceeds-typical-bounds"] { + let n = LinuxBridgedNetwork.derivedTAPName(forID: id) + #expect(n.count <= 15, "name '\(n)' exceeds IFNAMSIZ-1") + } + } + + @Test("name uses czt- prefix") + func prefix() { + let n = LinuxBridgedNetwork.derivedTAPName(forID: "anything") + #expect(n.hasPrefix("czt-")) + } + + @Test("hex suffix is 10 chars") + func suffixLength() { + let n = LinuxBridgedNetwork.derivedTAPName(forID: "anything") + // "czt-" is 4 chars; total 14. + #expect(n.count == 14) + } +} +#endif diff --git a/Tests/TestImages/dockermanifestimage/Dockerfile b/Tests/TestImages/dockermanifestimage/Dockerfile new file mode 100644 index 0000000..115aa66 --- /dev/null +++ b/Tests/TestImages/dockermanifestimage/Dockerfile @@ -0,0 +1,5 @@ +# This image is built as a single platform image with media type application/vnd.docker.distribution.manifest.v2+json +FROM scratch +LABEL org.opencontainers.image.source=https://github.com/apple/containerization +# empty add so that the build doesn't error due to no build directives +ADD . . diff --git a/Tests/TestImages/emptyimage/Dockerfile b/Tests/TestImages/emptyimage/Dockerfile new file mode 100644 index 0000000..d1a94c5 --- /dev/null +++ b/Tests/TestImages/emptyimage/Dockerfile @@ -0,0 +1,4 @@ +FROM scratch +LABEL org.opencontainers.image.source=https://github.com/apple/containerization +ADD . . + diff --git a/assets/Containerization-Logo.png b/assets/Containerization-Logo.png new file mode 100644 index 0000000000000000000000000000000000000000..ff5ff26c61c7c7a127624ce2d5a0588d0b691c61 GIT binary patch literal 49266 zcmZ^}1yCJ9vnYIU3l`ipNN{%!1cC&Y;1YtnJDdXqmq2iLcXxMpcXxL^JidGHld8Y| zt=iq5p6;3L?&+EB=?PJkmqbM-L#Oxtrv(v~f_GS#& z-&s}RN>q|TNY-A|^vd>F>hzCf8eN)pmBFfZ_I4QJ2$*ZB{Pc}xZtDrE%arQ_dvCm{ zj!in9M2Z9q_t11l@&9CdbL(cCcRl|ErK=R1R2OD5B17IZe`gG z7M~Dcb1ciHDtVlBzwglbg2b8#9e6=kW3b;%;pz$gbm+PDYWV4r1llF;rh;nxj4&X> zm*EWokKUqH1zvRI!w#^9(qf9APytXjFgq6?WnNHo7$`s{%>RY|Qz=f#>-a&OX0EE?q#-BEZ)j`HY+z*j+nCwS+U`FD06{nY z5764!$$;F=+RDa}-%W_}zbN=W;QydmD9Qhe#K}^KQbSIWT+G(Nn4FuLm6?@N7@3@$ zT+qSDgkM=);(ypbNr2J1u|L6Me?=*HZ|Gz!iIR1}V z9|E%cr-p@%nU&@LwEe*<_#Z64qPd%~m4>*vwXu!kM<2pmZ0v&nMgRY)`M*8>Kb)HX zznuS1&Hr!;viwJY|3{$z*4BSvKh!0REXeYIR4r|_8ljLdPpYH^7Wa~V z^!Jm(hQc-a_U#QS*y_sgIDl-LAqAmy1|9_yBIF{ad` z`T2>mvC&k`#5BI^)>pT2ZT(Hh%j0q@@#hU%xQq{!I!QrSty%5(@%eUgq-op2y$s^$C zXz1;2?CrQeHM)O%mbBDF#Bp-cknkPY!CF(_&Us_zY`@nvlw^oLk-DVub~^)XysoPl zE6q6$;Xb*CBK6`!LKJ9yY3aBX=iCkAUo}FzOP+my4sfu)ZxRr1+p=X-h#tK0+`K)8+GSo!{!~z8G6x_2 zgPT|tNxqwdi3~O#Hz<|~e#?&|wU@Fo3ppjqW{-mM<`1uN5OqRP*7w#Ye|c1C7|O;> zX^^8`V&R0UG>YqM0`E=!u|YJK*xR#y5kVT!8xefiZkcTK}0rm z4juwkhQuj>qY6&Vt8@xE%fax7I_#Y%lLc6T&~Q6cOJoN2%zwuZKam%s2W0z33?o0M zXZAf*Yw=n0bE3KvYG$egcPe$08c8XTx*htAB~lD0vST1nL#Pm#x+*Ekr*RrSZIYI;-%@0p>uR%0+Lvrqck+S(aOY2K^?GrHOvi>>ubV_vL00xxTI zb9WobCnjJ|1B0Cy{pY-l7Sy*J((1tU76+YXrwc#$3;ooTw5O!GxH^`hGO$j>bN2F> zbUEV5$;sOAu|-3Db3f7?9jNVuL`U69pdmRQ|M6!*fzb4$j}ikMnY0;-9%^W}XSLyi0#At+)`ha$C$C;8Aecxl}#k${cieKh#aghJK9FOxVPmstv}c*O`<(-Bf&k(2LS{!09W&et9-Bds-2x0WUTk3dMmI@Vsq zE_@14I*{Xs6aiAC2Gy{Q4X8dPCC&Aqvbni#EbjZIQrPU-W@Zp9>Ie;zy*1!AfqFU$< zyF8oOS*rS2(E0?cs3D30xqt~xdn#_me;g-@9wk$mf*SIVF3ET6u=Y9-BO!zN+uCb) z>lXW6=<*_PimB(lmbc+D68x0#KKO+JB!RBfY&y!Dc9}H76A$U^9_?RHSDT0Ur$U$l zFVV>uog+z^TuUrJoh{%bY_+8U1E0e+?dV zI>b#S5lvlK@5(~*Nc9$6+u@8j9M7CN{MD|lp;7BrS9&oqF%I#LPQ){dn{D5#pWk-S&w+=e!aCP+>092fYE=0!fd04+ zC-^hEPAoU$L|aqlxeM;^LpM&fb-#9Tzbv73z@1PW6BPQMjc*_d3w+vc&&d=^gcz;^ zT4~Z+zB|L8q@190vD`(PnwUbKSD){|w{;cX)_VknNGX%tZv`eXsgCEvcb@t`fzM>e z#}G%t?uoS)PX%?)wS^PNddJT^dzb6vRZ9Wr)Q!lUVI0zddv`CI9}ly|&JUrIslOil z(pAPuV!_G?tR+JS$O}~dr--+onzVHUyAK_7-?}R-iw40$K*t^JW5o1lLjQtu$^_fh zr=+B@r*|u7Wa(lSLorpHA2+*g*HqiBBy;}9kt|Nvyh?v{^!-xRiL8hI}4-?c!%=7 zYaV}BkCZYW(19cnlp+B2TSB;2zKc*U7!W!cjLRNrk!9VBbCEFlcS!AMmQMW_juaxC0T$G z4njD1&GtL%9aYWkPYGNo?}iN*t7oKwZf2&YgA>$bBjxIU7egxi)Bk;EIW21*Lr zn(4I0S`iTPod>OYb7vRC4NX+Vci6g#M0_JAQQi&#fDNisiO4}Gv9Ba75z)q++=>2c zT!r@&_|rbE>*{dC{aR>?>qWZ0R{GOOv;KPx;r_(Nls6=r7&7&FynU64>1Zll0E+ag z%q+3vYe53R3fHlB!>!_`0qUt3YOKph@Gn-vU(}PYiDZf(IqSEMG|h~+Fz~a&`|6$d zWIGk6LMcq6!`?aBblWpH=lfE}!~B@`8qC;f!OYI1%rR_yyiXra2ilFRYPeW-524$= zCAom#{1a6f+BZw2za&Easq?@Yzxek}bNRf+sS;| zc@{~#s|V?gkSao_w{VzaqKdmow@XfB+jd5hA1UE=t_8UbR3p=5@wZ6WL%?mk@3bTr zPv*Z)rZxIk+U75hL&9nax17| zoEXUWzThPK{#=&Q(Bg?s>LlafrGMt!2hRNIt+(0pQyI-icHm-csPQPxAdKM z{&OSKuQU;UAQiL(d~2hJY6Gkm+)G3J#l-8&#$$h1tG63DNoSoUy53sq((481(nH({ zkByqCLP1A`CO9?2xCLea{Cf^mcvuOao<@j2ih78dHILXRmTAcAa>|>t18%HpeZF`- zu7Fs+K=iuWT>%+j&Equ` z1BP$&H}skw*3( z*E|^D0C|Cr==a?hGl^S#4hjZIPf(<87dL zUTmAJo6zh4&JMD4UAvhm0ZqvFKJ#R=v+=sT0NUDlD* zUC&kfR1nvt>^z`hz!?~}I`WNUPeulv%OU;gXl`t& z$rDV@&!|%3EQuNJN)bC2S{zbUZ$W z_Nh9qI`{i>L;GDBl_#6k0*Oy5c>nm$6D-}5<|P#LX1@nMqyS=pTYEXKBHDW3n-d)C zg)a02^3KL5?s18gPbE>!@>5r!Tq=KO>HLLvql#aFvi|XWxAK7d9xcD%V(L}Q)nd}> zb$6cej{^L5pXOQPIx?5;`R3_LaKG`ePoh#sN{MEC0^h18q5!||mmn?MCwClCbMYmT7Y^;JpRV8QI&Y&DXsuNr3BxO?t=s zr~qp-{rzt_1d**@V5Wv@^{zB9ar1dlwjGzqzV(&EUa$pd7z5F+i=(LvMeGvw{k%`O^ z8UU_bd*$MJ;m)gp#Zuh7wgUAow?Zd&$toVJ|IunY9$f3W!tfid=d?)7v~Ovb4D9B7 zd67m1bQNq5FL3bX{SjCsXH=EOx`s9r{Xv6vD1Q~>7L&m%#z3TTO#&-yTrfVGgQBsY zK`rcTAXd^L_lK&slAC04peLb5Yj%b-8$ODNetWrIKl%uX8{@cFyvXe6zs zRZj;A>5~;tKPj|5LuX*l&6<)mZ*gQUWW>gK$JF(Cd(x}Kwd8jDc{yVvHR-84t;N;* zF7n~Ya4M4QL5cZzkm3jN6Lcvr;yseB?#!Ob%uj2%#3EvkOcn2X3JYIr!sxbLNq3?+ zd12I7>NKWOxq`Nj#|2JDMm6aKuBFZF!;ox|t}**}0UJTx#~;ce59kxQnI^Dnm{SB} zhYSZJ3?pkHI|Ch+?Uhdl#^Yd4R_h=6Rc6QmoeLEkPt(K4{lIyuj+oPRPjwlurHPBb z)1xq)Hr%>{GyQhlbk;%)JMeH{kvzRB<$jMIThdZ{wx1p<@@qOzY&hH<4Gf^)h2KQ( zc&_9t(JJ(Ne}~TvD%e9>BJ=ujwv+WrnqHK)8B;GL!#`jW@h?Xk+WlKPWEA1Hi0s5D zQxfJ`oPdlPW!&~#;N&2WEq_G#4xO(X{GW~77&Y+&uZLyZNp+8$c>Zkd|LX;M;uT?Orm8Fm~+3G1(21)(UGYpYDGQGyD!3CMX{EGll7Wl zBher9R034bQXuQ}QF+2fCKr-@7V~01Cu;vm8p?P7{NP^@d)2ePzCWvI_m%3P17e(> z{XqH4<7*b^LHPzyWnm|m!?l?vg>v`|)S}g-MV6`ktvm z$Ks^e@F9Cqu(=QwZ@1{CH~cp@x#dLGA&(WYs=N$zDI>xU>u3D3nsA~ZFye^0qI2&~ zS>(=b_OD^knyO z-18XGqlI2sWuP|CQ?1NMxmVk26?QlLuml~==25B!kq;U!%9ZD>S%^}nIX?Rv?Z9g*D*IWlC^X`r(~B#Xh0u?asN{ZJrM`bFjH_ZmxUSrqH;&!T}JXF~s&#r%13My1hi_D->Fw~U+_68-jKB*x;Ca1a%hBBe0#k(GqqzDI5km8Jp z5sE+N*kMX5uXB(Il>~r;gJ|9DVDMjGhIg&U{z!HzKXRf?vGC&4)85K^iQ4O16@z;D z@i4e!hWeMQ_KHW%(7@!Lry&~S_aVtL9L6psHX$D_q;z^5xVG#-aV^HGLpKBaEKpiN znkG^gS%mP6L^w%jx5~DxT65cuxr8-@2N8~cV?Uz2(<@_J+ys-LMtqzOrH+DQ*GK zn0M#&wXcuTd>0iIb8f+QR$Jp8!e?T+Dw2Q%mW?;>=7vZ2^qU*e@kdp>jMLwE8-=I* zx8^8?PQPmWR5yh-Z@wOWEvr@$Q>EcV+KSms;kP|4_BignI^QjdS+hSY_t-uBXVb-z z>j2_=%jWl`dX_sGjM5z8QHHI}7oJ{}5SAB+GDXPXmaAd8GH@oYv5K+NtT%7`(;2y3 z^PklBR0rUGiRJxKoO2Yb|#-8Jk{p5FYdbCt7Ki*df2vj^kvCr$iUA|gzCVEk!)0yCj`{+ zsN`6g6W4(QB1F?xmS5&V9=XmBA8okJMgN>pJyWmb{SqR{?JLb0;Y7k>p8c}*M{;d! zh0!hy)yn<2&-zl%dn)uV1?|c*N^hn;c`ZJ&HJR243?ar;c=nHWKg(<>qCOd)xK8P_Q!}CejiqZbZ9qRG;$RB z*Uje4fB7D|!6dv#Cn1ix;K~Ti(DO5c0@75&GW?_;n?sh+lX0pCdg?o04Wsq0ll<%$ zUySu$8$Er4f6kkqgb*W!HdrHwM2pr#c%x<1CD!NDfI5UZto^FEy|eWvxfq$=3{B%O z!{4@OrhD_e2rKY@uMO~Cw(Jco3;*L(@t7_D zn{g;TgA4!RQC8Ky5B!vu&>TZ6?^Mz1P~Y>dGd6Z@K~OXBenyKkihx_`RB@0%1T zuc)}g&HtOtPFY(Ym)aaNsD_j5UuVDVE4L%}Y>FDGtGxuCd{pCUMk@!s7BR2an6jaI zUNej_Q9p5*jz13&CXOUj9KU!=w&3ZxWwm(i{cu&eG5FL}ClF~_T!(RRU^zdVB>;^h z$zX07CvotLGazgdnboKkEt+-5Ua$cwmevNrWNuykX@4_?Ly`w9s`D=9U?NzqZ2Ri{ z{8aX?`S+TZS-)A0>}9Rld4&a{+N1KVio!IgAgy4aYv(}8xyZkfrLIp4(qWW?AZLD|AC+muqitPqO*>=5s)MGc}}@TaBqL z6nPl7uxj{osj<7>)yH2$`Kkh8$ImyzcbiN1^Ua6Kbe@yFTVpO=S$r18*jGRM=WgeR zr-KAe9y@iC&b9NI3E>3Y5_KzC!Kk#lLm>4>w~XHYp15I5{si&xiMt4d*ywL4PI=qWW+yP~l|T{uF(2X8#(5 z&g0})%e5qgy7Gfh`8P?h%KO)m&ef@5+hI0TF4XkWpvTgXp)2_lQ$pQt4$`@3JK%Jw zskR~%G%oS#kLn|u@lzxbxz{a0kcZQ5@Oj>o-i9A=;ci^u!b!bCZ$`>s{W1~=nQcJe zC3V<#0gT-T^JbSm$~&Ruv8fl^ty}!oj;jAxf0Rq$TP1Aj5|3Fe0YivcT3)Ug54=5( zd|z+qy*8-EjC2O1$kc$vUB&Q7uj=%i0q3wzD4lkE-NE(HYorK$YOPq8Q7@l{mBxmp zmnU=Ai_Rl>m|a*>g_pdyTyJ*QzG&M689F)IgUV(M!~ z{m{@S^ig+1P{EA%DEO$wEa-alcIzX5GC4G2&>4@^+>}TFVU~>#2Rms86B+7)6)S!t zYuzojt{d-;maah!};-C z3&tEDg5TO%ZnYeUs*9CDJNeA9DWhrG4I8S$zB+@_M0Nr77Fv1a>^1Pm8m) zl-zhIw`^fC5wTrw-ANqcK-aC*oHb!woh`GMT0&{RT*kMgr|(Ld-K<&{xM(f&gs99t z-OWnaeknJT%Fi2aX6XUY80-9690@6_G9b>3-IRv9%rv3FB8Ij*|0#DXGOpPx;Qkz_e{cl2!;22Ewc3ssia6zZ!aWdrIDWo@zN zMw0kXXvpTIS8_o6@WD6h5MKNRoPtLUPjdByHEf+KVXa)WNu<;n2rPl zGSB?XkoPIMU^SwcKEyn+pl}T(`{8Pgf~~wG-gbXn;sBXhiv(?bXqA>Q=i8@Gyv39<#jse$CJvvZaS=if=rj6cULn&J!NhV|c>MLyqAh=maPWYk?Z@#{H0erscm_9@z_~h3RZq>YL1BZuV%A3bG8dgcvv=WFEYMF@p4G{5O)*V=9W->C6~No%87A ztbRHA{E4#PeKzctkrj8xM#u%I`rg)>PNdIur{nRH-mq;IIOZ9=SEs%wo4ocsjj5-R ziY`I<_eQN1%)~<@?IERN(^A;a3muID(I0E=qu*ki`eJNuVlF!o%UVZiZTCa4;Jx!3 zx@k%5Jy9*T%7~5P0Eux~I_?VTy!qTtKXUqG2&->26egZEnGQ-EG%;wjT%nt*S0{Jc zv>R@%QG}pQ@Lr^{J$z3Q={PK<++z!=e6$;E z(waQMZ()M>Jx}&t@3SpgBXBJ6_0Ur4J+6Nw>jT22ozaI4@o}G01s=XV#FO3?*>J5i zuj{r2-rR)b;upFP+KN>MrE~e4oU-Fn!{QiwRdCeg6p9Lmu*=_%M)pq-f@afAg*tMc z{R?Yf1>gCbI3YV)&u_~m2W{N`FV5c5lIq^X`o#RZO?ho*UYX+tdfFBwbKMy+YtsxP zTBkWb!CG*GpoA&RO!~V3d48xi3M!D(^{8%+%G$S%`(p->aXQLz>VEFzzKpUPsH%w< zNChRT^H)loR6vE~kVZF#i|y|K(kc>07#euK@F48Da5Kr)YbU{ms@etcaADhCM0%6G z;pc$R8RN6)j{Pk*hXIXRqPzS`YD@)_-CH;|cY)vaJk>-y()FV4r8vmW^}^PLr&cft zjv)OsMs)IpdKv!OAY8eg$1oQK+MYVlqAMI{;~shoD`QXvb*j4q~WFc-4+0gm?@s zYy2PW_@ADuu23Vz^PE!OgI)N%uSS#3=hVlYP4xxm`oiDE$_Co$^C!*q|B78%;t)`j zF9wT=u?RZ*S4UG-4>Drue4!T89__`n4N^!pe?^Gc7#H3m*pfqC+0@<8zP!M>cuu1R zj(q8no;GQuYkiw9vEVRu)*mNzk0AkDXa;0bY3PJc*o|3m+U-hi91Fi*a_G9<22V^p zP2s}#@&4|2G(OyK2kT+YhiUx*pRX>RH@9bWmGy>8kl79P;>#VZ`FJ3Ziu&!wcPh(B zPOg}Z3u`-tfXO6bf$WuPJ_T^5cMgOyL2u%j?sgm7%^bm`QY=HWZPzJC5v`@}8ucR+HRmj1ekK+bF2X55>N-Vz~`VkC0wk}=4r zFbaq)5fy*7C|O+`&7msNSGrM6?cs$SFB~tTu=!{3$SRp#B-4sJ#Zcf@H_qm@4 z@0p<^)fEVRmfi&Qb#u*C?~dW>BeD6F%6BsAj4g2S>UD$ce0F+^!^1w9_Ggt~gNCXc z%7E*L6K&>a9LbZBd3A43wBuAA?ZH@veX9{R%wRI{7utE1e`GS;8;MpnAXB9lNc%u3 zkRuVBnjgjlgKAR>Vyt&X-htwU89@C$EfvT}tB^j~onc4{QR%8`e=irH`-REYO{~CBp_WG%a42Zk32`y|NtRUTvS?)k*~= zxKCplJqic(ecy-0okMChIWYbC^^9{l>#L+M72c$m)%bSG&OoGlAGtzJvd)zP*;oM2MTQsDR6E>9u4k|NxqsiC6ss}F z4yu}#fz}~1P}Xojmc$1 zv0q&{XNVIl2@V&+Ko8t3nB|L@l-pTWPLYL z#jgWTteR7KW|m$_4QQBHk3nvl%3t~SB6o6_10SO~JPE^cbSIZFT)g>%8Nf>W!GBHk zfHe3O`YmNBDy{IuF6OnR_0mBiw4K^+HOtza)|xM>Zc~^CIpJ$ThS(PB%Kjx6NOULs z3NV46kbb5H8=P^%O2u3423aqk-?VanY9T-5a!qh}zDcGK>>>g${b7sknzB+Cmv8V( zLu>jzgzq8)>ctA4HrH(ZSMlrG2FMv%`wwA-y(xMWQ=vDmk6@B23^o>z0xx-`nmlj(;IdBTW^DlNpl>!)oh?>x+6V+m1coCRbYn!JUUs> z`zJ(GyjOsJ)nS*8e3<|~AP#8&T90C1&4+ufrwRzJjO)gSS0CKc04D*25aHNRZQbhM z4gp33ArTQtH^EnkzqSrX`^Ms$_%Rl)iv`!BOPPETI{O8B-12HtnCi?oOT))Br^E^D9 z2#SGkq;Qi2!5AQt;2#Lai8mr=|5|#en$V*SbfK=oOC$iYnSxsT)=X_ty|eTZs?EuW zibFJ`wut@&PDm0Y zq%^Z4^H;F3q6#o9X=h6}O|yJ|U8>VWXOOD}c;&)SzOam8PTH(k8HyB_O@{i?S}mDe zRcH}LQ+o5(l63EpG* z+SCbAXatY#azbO+Vt!}Pyb`1#<>;Lbibmp7T?|Zru_Ob#Koo;rtLA2C6(S_9j=rEN zOA7(9#ri{H+xE=2_em8%$~|E}u_{aoGIdhfgT z4UM)}wX9$h3vQh|j#%p+FB^`6hKHxF43WH2;LpgHBhI9V*&5rZSLka%o~QRSu~0*0T?pcomvR_F{iY8lZ6B4MjoU2WumWB?sodvz< z^*a({i3m(}gW+N5Q~;Mj&;ICDTv7m5&9na{+nw3-cQ}*CI9crywBjR9?X4hQWD;kN zoeIn=z3ys$C=<6N(LK+Dc3@Jj6LLNOg=qcy*!RlAb;zpbm(W z2e2aHCi0?PxXPZ}9ojj38; zog{yCN7lW2gsKH|%dCgubcZC?139<+OCTN@Qd5>-ZrBKO{&+A=6ehmVlt@s0vBoH?E9?ishO zJ~CF5{GP(bcs18dAmB{<^NGt&a%zUH0y{JTth&u#KqBmJiX)IrDB(E4exg#bKitH6oq;h@%-ffQV&Teq6|m)&O=G8{%fn&AqYFu3>0tR^VtxH2KWMai zkfEOtQ?N-oL-B7bjiD;1>+`mk zHLA50-42(Y2EbF^yt4oB0!^|b<|dm@XD3aUwrJ3iX*oQ6!Dy1de~tJ3)6a{AhSIGk z(N*NjF~EMV@bjgztG@dC7AcsGy>H08h4J0ks2gqN)7!@QnbPRazFrrQKrK^J?{-8&zYFt_UKA}hYSwS=Z^f9$7P2gqoH6?e{t*SA-k z<|R=qX9W6aNv?b{WYGt)K>?0zNRMp~z_|di7{5rhhdQjzC$ga@;LB-p{nLKUX446V z4Qc#j{?0L33&xE`nkTp%B4aV)gdFiCM{j<+bV-$Dd=i3;3Ng|0s`afqDte3xq`kTL zYmp<+(^Hp&pAOx_Cnj3VVR;!aVJNXLRvwW25zZ@g($eini&5?BFWhf-kuGd1LoTqt^9f6ixK9=OC z@TkU71gD3`*qQz>BuXjL*=Cc1+>o-3=fRW#VV&QeFKugRn<$a9Nt0P#&qsCVo*OT- zd(|r=riWg19W0R+9O1~@12R^l(uX;9gk96=)6-T7Nf&HN_M9I_hNKb=Nlq^)&Acn8 zWxJ^6gwga`&rA1B{*E6r<@ecns4?|bf5-ZpG?iQ%X-?!X&0U4Of3?xp@*wEd>~dD@ zsUqBcxc1YHvNJj0hupWH$M3-~bLuy{ULpvR8WKxder0x(LY9w8o)R}PAES_Fi=d&^ zdI=p`-$+9BFHXKc#9o+Y71G!7*r|W3IbGvH%u8k;ncVU-{mDP*`S}#a`74>%rRD<* z_`pyg3hxrT&Ar-Q+-c&-fiMSC=ziwxq)gjY5c+cD$9_?GK%8J%V~`_=y?{fNt58D2I}ct0iSj`(BF5|Hh-QCuAdzAV%voEJrn|0xQ}o8<_1ejEtvcF9Oz6ESnIfeGyzx;}+|F%vPvm`frd5Ug z-a;l+p9 z2QJ}ETSWO|t8K0HeyMN9q$}Y$q|%+1da={HeC>xY%G7`U;!^GFw+_%Tz8$EBCSHDG&mSwF_9*rcI+)0ItxT=3rkq1P0*rKNdw#I&-*@i#Y#CN@+UZ z86JG&YRrEWmt}THc&5T|B+YCZ_{| zAvmWspu<6~JFIWIrnF5_mba(?P(=`&_Z4d#8!g-~K0P&#XL9KA_mV1vv?E3p7kdD* zt5W{1`!PGPJgsL`RP=9?|NMj4q`QeDI}GJrmX}Rud^e|#5j5qf3S;5yPH9{h!v~#- zy$XTKwdZ!qg#M(*)EU9k97Zh*^yP-uHbY{-B~CFA8lOOCX_^S{P=^H5di(*B&U~T3H3uh^Wz3dA`_z>R^PR&SE*c5lov>%RT7+86Z4FW!_*W)eeqYI zF>mT_F_eSKsK`t-P5Qt=ow%2JG#sU8R<0p9b@u1Zv@L8hU%TQwx- z6rH}$nxQR2-4B`Yl9*3Wj|p@a0D@@)-Z~XxB7}D@h=j{Wz1gTWu7#j0%ePmXwIp)@ zODYT4tTp+qtdo*lsi%_LQwA50yug^rhYR3kU`A}F9G#-oQ- z;0b;b%8JP7VLB(W8>|Yf!$=~1|BU?2qykKKRjjk3?ew(bETT%DFyxkoU`of(3`17` zZ^gEiI>>=`wJ1lna#Dex;ma|+!!Ra=UEUbV>@I>AoK1du3ggI*qXT+S!P>{BqwHEV z%}e}k|FPu8yGBeH&)WI)QJaQT|FeSEV!R|CbnvWknikzLDjIPmq=!6zu_p^rGC$9s zYq1ltlbnpIsP%Jsn-eTsyc($!B6%IzWAUtuED$@5S(LH0(fuS|q5q_!W1ln$%TbmL z$5^kkg8vXX(>C)chsh#4rRGPDj5+F2_0(s9T9aF*f!oap8#6R+{ZfltRO?j*FS?^J zo!GBm6BTtkl^iuGGLh#*cS?$fjBTw0obYGmYdHGgek|LF%=g;I(U?l&O)9`9zBLqF zbB5~r#B(mx9=oavKi#U7;d*h}K~7;AXRE`Y`Jtnq`HV_GefdG+OFVDxL4fzoQ?%>^ z`{!Z7W|kk%#80vk7@xXIF#|(DZKV&9v~pIe|2G_rKhj?Xg@qsUNqU|P1uP-9G1{rf==7NozhwA_9tHvq2Rv!!2J!C$9PTlG)W#Ijcv{8^#jz3F|*HlVPSJ?xLY=w38&#BRvwOo0q+27g>>3BRKRb z5;noC+nfz2vA`5*`#!}#({wiYdC>)SlS-U84ImDugC*7iEhEDs8bXsWX?-PR;PM5I z@@=nQ(+~464THH=$tpssh^v}ZRTrTzSL1O`e#Ck*g)r^z{MpLdlcQomy#DsviO{6Dn-$03Gca8{y_m zJ0;EN9sM~O^M&$_OS2l`or0-i-GClREcpYnuoBA8=6Sw`OVDc#h}M6`dmua70M<+- zIl%a&Xs3BN;ahw1jRePAW`SuNW zIhyL9%9}m0l9{C5ILKKu^-s%^?y=UYSh@4N1&imKUAo6b6Fb8a3#uho<~|E99$-bT zDdj7dOo$6x#8YL}+15g|TSI6`EjW1U2NiR&*W9KxU{5zDsP-3Q95g-AgeO}7Ja5YA zy#EV_KzP3{Aa;J79yw}5{!_*m7#b-!|C}TnAy7^i?t+NYm!nyBs_A|ZxhBM4xIv>Oz!hiM6aU=Pq708z$T<2 z4QP;j*6{;lGm|xv`O)|Z;&)YllTTP$-C}WeZ-&DQK)T{H+~+?3zTQD$xDSkW**ZS8 zfe+ZpX?K|pV8NLRN)m&k0nLFHh)n~#ltF%Jlt^3532q+%HLypd8um@N5186(@ERH+Vmv+sJ!Pr zPkGyr4XD7l$IqukT;cuXNHDhzISmWYIL}f2T-jlaI2=$p0S7;mxP?}}UPe*eM587q z3fm%NtX!MiF+L@Z$Gi^Q3oXf%+v`e)7z#LO{7~D-nJdUR3D_sR43F~@eJbm>c>AnuTzt|gzBokL114bjo`5AI)zuo>rqk#a)~0uZPaa}q)u?2YcirYK@>c)=KmbWZK~(hz zYTmG{Q+OgxhoF1Bk}utYPn7!ww4={-d}EKz zZ1PRAmLOrZIw~d-;Il50wk3Hc@iNM`PAXI>M6~0`*dG&KoYO5#u#9PhkOUe;X@lnT zp{MtFTCT1mH7SgaR&oLUEcPG`iBHvcQ7LK|A9?V)zQQRyUSgo60YKoOllIX#67njo z@&Zd7*~Dj>cniGA_Y2?ZF8TqX-ztLF80A-Zt* zkd<_<_SAz3i74>^FPQtFhGrC>CnMy6un~Of%$9v1`J%tIwHX1ZVj+k_*fGUO7bYznWCAz|jVRB3c0-4QaA8Mb&v_UOFV40IufO{ z(JU+yd@UbE71a7mS)DD+f@f_Z!Th_xN8L4bY5h@Xsw zM~_h^A0@vJp(0Bk@HCqow4DAl#gzyQWC^abdbO!QGnb|_&}j+;NciL8;|v!agGf&S zV&V_u^p_T5e9;)7VO2*-0`sKsm=n5&siNrpxpO?cglYVf@nR?*w>x}mUrMkU_0U3{?hlp5b<)BcrY2eGBjE~ia@;Y+ zRng;E*XwTawT%tUQ3p_TS}>geibG4)RUt69&=i&&2Zy(&R9$Kp+erqvAd@C-R^B@v z=}kaTW>w?Kt(s}E9_m*2l)_-j8Y#^}dC6|)vU z&P>$Lpi;#xBG-ZrwWUdPshOxpGJ|sw;Qk15tFU|gfRnOG4L{ui2vsUzs_FrE;cSVY zG`{MKs&-KdEFw-woKW@?JhFJi+le1Na>VZi@R3ok2-H&G*hsW3Or(*MC$FkA3YUuW z2t}U`J}^COKk;eNH2HzALt&ef`jZ!nqcm|$eA+%9_hlK!0oiZ-sJzIx_GjIPJ-fxH z9#;P4k1gfmdw!4nb!zgwBQRJpF30y7kV(9+kK?-@3>S>NL0QiQ4^ecgb^9cK_n*%gS7u0=O4gjC3h7GqU&L}%D5won5a7^C~ zc;SW9dMW6X_Xs$muL><_1Eixz^8uO^i1%8c;eyw4S~VnW&;FSwjx(7<>=-UUw0K z@S>nR1)wJjBvCSC3?>T}RO82k!S@#QsiE$4UV3p(=4m-RuLGYt86OcjefqfG3Ou9N zg!N&F6UViGAVt=dUuOv3vPX!8T1TshN^0{(b%K17l_B4ru*bz0u{9dyuZWV^5ncw_ zrX+5J7_=Q;^lh0M_F5$efv@IbU(NK|D`>BHL?TRb_$CG)2cZouFR$xmpa=e}7dufu z(C6u2dGwNY{k`XJR1$MbImce(+F!!K!+$&=Y9vMmfpUi%-~iOxE3A$RK`mT1yJBGB zY*~YJr}*B#Q&g&rNkDS;Bnix(z!agz$(qO5QFv0MK?i^z5$z5KOJpziZaDnQ+9>pe z(_HmWbg#T}R-cA?NgcuopBRniw13-%hIZ@T*(Ha4p7XG|VRP%$F4f@VHAT;A*l#>a z+p>drjQD)xCJ;h3>XqEaR1PHUnkugj-1jh6EjDaJZ1P_14SU2xML#Y3Q^^yFTr#k3=%0V|d55PPub1Lq1MEvO|6; zW)@Ds7$(QjST0NDzOPUh?!vTJye&xsQUlf{tW9r+Puezy2U!VA83jxhR2&qi-X>{0 zG$SENr{aswF?@levwBS{dmr&_c~BwIeD0ecdquGGFB{3Qe+0Wpv7yYx*I(~me(7b6 z0IvDA@zm*4-u|0!|1n39oj_k#bSKfSP(aQ>Q9D^^7)8ra$g;EvcH97)WKYrnn`Dny zs&yX_*rgqT5&;{TpyUObGB;cqu`k;`WX0b7$ET%MhNeC^rvu+#KXLqoHU)h{SNW4V zNiTIj`lD}Zn158CX6m#bz>4nSmb!=9(1A}iJ<>PY*~<;Sx;LQoxJ>1U7EkKr*waHh zLtQPl!d4O_63hE?nErD92)tLg-^a{keo4_T|2415KtnzLh?ix$T+^WuQ4;h zRZs#HXWaoB;Cnmkxc>>@U8Z76%=)X%>&?-5%@wh)By&Ve7&CW7d_mu#IIVf5%i8}R z{AqOrYzq27UnJ&28qkWEmXhh!IQS|NF#2?crm6s zSq5?xoYuj60*b^$L73)-mdxdq&}Fd*mj+IY+kZStklh4l8S-yvICjQ60-rj0s{5&* zeAi!s)jW+B(+uM6{uFD@MJ2=o-`$kFHw=oDVph=5(FXJ;>UUs!yv<5OU4KoegV zLR$X%8i|fTaDlAPhwvU3PzSfWWKmqPPD2&^rr#+(qS_G@-Bx8oCKyxUnHVuP!8P6vUkPg>zoy|vzBT*S*s+?dDl)MHen`rR z$jr{dfa#I#+qksZ``=5GEcH3@z*Y-a8XG{vGano{ zXO0%v^u?)rtNQ+*MgT|k{Ry@TJE|?_UeU*C_#_zLr=WfDS#ahNN*`inyl>)V^@=?Q z;ITeB=wy0b)wTfb?=ck>sdP$|Hns)F2nb5-qz)9`_UTZ2Dg&yN{lgcLy`8CuN{f5` zGcTO+gv^U_{-6HoFX~=R&VOy$d$eD>dc})3{1sQ-$3+OmRWEc6)S3`h6g?nmCmf# zBLLjM1TwZIq`(>4bi!KVJ>y$pRY6ob_x#88!4G;_od0Kv^WV6!++Ejp;8(9+^(?=? z4D7E*eI6spKSv9@(Tx8 zfa9pF9L=k~d37+I+f~rx_z%_}cqD+_Ma>Z~L3s7b)$X0Q-|W8oFMr3kpgdWKfCRMA z4G~8$q>-C6U~5|~w2s73xoe^!n1-K3D>kh1N`&^L#cUS0v4GA{)Tkt_!MMCk}xVCeBz2WvdQMe&heHu#*bV9Q%sdz^ksC=_+mz1 zwp6@T9Q6|>j~MRrjN>zU)Mw-6*sKCQsl{L?P9F8--aKyP@_nm7HQFl zDg+)bDwa%d0E~K28(7nACc6jI0dQ-&sFkK?G%?L%!MEOgv-@pz0-;x(K(WOofjFeYlx6n@J~qBEwDpt)=8@g2 zubj8@|HK#H_KLo%*Y#;8eHP5lujl(L;K00C2CR}OZHFhe-2uxgh|U0|O&G}*HW3I> zPa5IOd8c2@w2C~Q$0gS~a251VM8q~1j69=RCT}iE+9pGhK)a@jG>E}Mi7LBPSaw+hQ>$khhS8wS_(tVv$bsp*jJSvdxI6HAefwS|J2@_~jbOJn;T9>?+ zU%KG$S9bGsB(kZRCn5Zcp0P!I{||l&CU`_nH%yT%I7CIV3f&e@IVT0L1E>g$DuhXo zqMBAB+ewA(7d{0RZDcut$B!TLJ=SZlo$uaw^JUHUuWP3Nu7~|R+s`Y%w{~`=ij($? z9RCkv$|^`bI+=$+M6OMb;=zqoj9_i$jpC7!c+vwr0ELQ|g2WSNcpQB4q#W|%k7A7! z&NK}ybsD5YiwE{3@QpcR`Y8(?Zv5A(0t_%a{|gt+Xi?ZJ-5ELlycYJ*8O-ZbUbGn; zI-L!As+JC5?UcS&Drx$Y&J@k*~a z#SlaPIFYV^IOr(3{?E9WJFtGJe}I}qo~CA;G?^cbTYRf3=~{fIiT8qU^`y*J-X#1a zoujZ;#w5A>g+~rH5?YxP(tr}oup4K8@7>qCix)5Gs;mV)S{1se-?WgO0W`XZd+5Hf zJlDOs__Cfho$h|;cX-5iv)kmBfZGNs!++!Bp}HMlMX5%jAZUwRv{-Ta%F8czAAIm( zH{-8R$L$074Cw9ibOb#vXoM%BL&aob1eV}RIKWq|#Zs;Lo99IcY=Q)1(qT+lrDbj? zD4_k(ynS{oH635%7CW$pp+77AxUYIsz4)oqCw1Sy(%sh3pAUUxu+8vcdlMrgD;GF< zA0u))4hhJZs>yUAYqOco7?MfpNwAi78osEkGF!UDO_Q@5d@C#Yr|Eps_^s?noZ?L4 z{5bqi{P;V%aJ;B{epd7GO~^F7kF%|$^Y<7zww(N!MgohA%pG*yPyWQay0R~HA8RxK zA9Dj-iZ>J|KNEw#APLVhV%7@qX}Zgrqk5<>49(5q%vd@!2L1#`JB`jI?8%a~*6ktP zibJpd>)U|72`aLuJL(>kZ^4=c50c)I&*?*-T>am9>s1ZII(@F`p*nz@`hMG*PZDRt ze<~OdxQQ}_yXg-Y!c4Cm;5t5IHB8$3V#UPW37tWv8O2LoRU+DAn>P)z8 zh~h^@`6z%d{zk-YK+uG&ux5|PP&X!|Oaex|Q$U{pBBd#e`AEac!2mJ}d&IY*QgGP7 zgi5Tne)**{8d5Rq|455`^m?Xx)4mG(&LW&Y@)*xw`B%2p6!0iOYRy~|w=4~~CZBbD zHFW#L=xL?iT3DM-Y2_B&*~i9jCx1J7m)zzBL1X_N_)tL}} z+^w(2o1|t(@UTHp@g=P&!J81wcm}kC(w-*F-VH{`Shxd;Y7d zNTA)oiNp3)fRG~Ea5XD;0_*Esg!FbG!+g;kKfdVM{V#msO+7Arpmis!vG(7+NG}Cj zW;gU*%30lx=r-V}-XS=xSJYXrQs=BN2R_QFJq0wqsD#>R@#?fEtSs{YsK|ODsq|Rb z5-<5<3@ii^m`=bB0|8W)p5(nbJ%8eW>5j0{^E`O{+uYLQ&0)8ypSa<1pP6R&JPZw@E^GRNP%ir38yO{s-t$Gk!G7&`Uocb zxX>&wuc;H@v0+^0k7*sjnr;c+eB-+m)v9JENrM2C%vh7kwItR zKsopaSa1Q?v5cXNGBApndCHaPf_60|><1B_+2GdFr@3fV39}URjNILhRIT5MYrmiE13F$MSJRB}j9?sV!qgoq#$PWH7Q|9RZIB zKmAOTdk?e#P4fh9b}-6`b9bTHIZYr6$LH!#==1dR<+JshY``kII^aT|0@lQSf@zjWen08AD(5G}qqY$~ z+D?&Wc}i<35RJ&PqXM|<^T<#02kHcLQ8&+#Ba7N^@`#=?ob|1T+m+=NUZr^&!5S7A zu#Z=X`2i1l#V!MO#1A{5*MArr*#IZRIPfBksHPjX3QH1nWQde|4}o+Gz{xg2Ro;+# zcoKQ{SR{K{Mr3w(_~drkEgV~@WJUo;j~>%Zs`hEqQeQd&LRMH7%4I7BtkOz8>CM<2 zk~cd}(>3@^Zii30Y5dOcj zv;A{iwiR$Tw_8W#%GDO6jSzyXH$?mk7MyefF~{K5rs@#pw2+9a`i1jnv>C|faS_r* z9flara}f$hUspSXZ%(%XT+r^_yYG>N#0(rAGaMKhR0Cv47+2yb0%(UYwWdiJH3?sl zLC(?T(?QQBiloBrO6cj73W*&1R7=o9`_y*$UYaR`(UpR8vVAwpDv!AXSW^$Ys@c`G zR;Z1MtA3o&>=+PYaXO@<8wR}mQczKw1&g=>dvGcE7(V4}i%&viH}Vrahz}CKo&FKs z_}L&lRlJnz{P|p}67yWXaQcL={_`4cXJBDYRq*rpIe9Wkyf6oHPmi5LJ-j7 z!k4^2T+spJI13B2ddzs#?bKI$c!jervqQ^|PAFC$9@Pp#)7XNrU!=oe8CY&Bt2`i+ zf3Q!(0VlL^^Z1kwOTXq_0Ff42t0!GA>#d;CGspcOH^u&;V&>Jb%?=t6s|gButA~_ zS9D(5VS_XH#*+A*}!C^Q{T#KrZ2p$V|yP+!1*_+^G~Y0BDrLvU>X5v zXf0|C_Fv^pQB4h0N!4;ec8eD)I#ZPOW(mTUc*C#syt0lS%XY%&A0jec>?Mz#7L_ov zB@ON{JbyKy^Ge9G$a$yf(IA!PAI7tHOaI638HK7ik9nQX)!w^3+dRGc;vGe6+lSadYB z;pkxj_AvUeLXu!QNU=jEdC?CpZI5&yTn+=!&fMH@+HgT@_zuAb>jZOxCC!Ln+@6|)E!k!HKjIM$c- zgv>Lbds!cxsrE==bczVUk_fc};NGDiY;Wmd;3|#Sod{IctAsW7=ps;X6BKDB9mJtx z62391Xb5q$p2U#xHcC`9RQ}S~Ad91+rs?y$!H@AY08SiV@QGeiv#2T!k5Y(rGcd3X zdmL&a><5ONC`XV`q~LCd3+ga>K5BqAn&;FbWaaPPeW15PnJ0>;M6?rT<9VN?2A}c? z=iMGgyBH0E_+Q%OxZLOaE7EwD{?~QoU(w>Ad-~`M`s_OrVcTeU1ZWj(vp}q4!K6e( z73o4x9tJ`oa^7iE2d5;gV-tnQ@IJz?_UU%hhe=2897(Ooc|aZ8!} zUzSFHW5-_b7L&H6Eg1_wz&jJLN>X6tvu*$p96w=vI+^uLH)kIoyLJ1XZWsC9W4}&> z6@k=UoOhet+nn|Xc>L(X6>yP3j!wmo`2<7P1HBcv#CBlCnbJOYJAwhGbKv%bZR%TE zOHVx+8yJTc)TZl+XlTpXC=jTJ9BqCS1Ji8p96}d-Pz=d;|{5$pz6Xn|$EHPdoHBwwE#mTD4Sur2v_fUl}s`EEH; zw7uYKnW~Ycx{CY(9z_IfF1D2HAm8FsY)gMo_{JognNEj;-O;{%i~^Q*Mb5w~QfBEH zMNSG-!FcGQsgD>LED82)s4kal%ulIpUb%8Z9RYI>$;U`QSq}6}{1o74{|dGZi(n!p ziQ^clk{(p3NqV9}NavS-K~WLTCXP4&N~My3=ot3tWyJC)f=E>gGr<=H8^*x=+XFr| zwZ?H$x&LR#bW2}k#Z2C<=3}1>`>?VN*xZALxPT8~Gi^7%vdL_CPG5=IxGnRzH2plU# z(rtxL9C2fW!H=0AtCJD_t?)K=gub`UfsK?CXp8PS`_y*$lz`RI7s=MX_XZt*A#$3yY49{; zCwORru2MIRnwil%ckim_T+;CFuHOq_a|PZHppqNXqO?jGm6}F59?>|!jc0n9<2WFP z_{sH>&;zKS2_m`Da)tfi{m-;<4D&`g)MhoQHV5I>Q5Ov!8QMY9JjZqgrNWWH^H|)@ zFDRb}=f}b{h7-(5u^GtwAADA>=Hd%h;iFxK^T(W(KSQtkf4&st_L8*LJ$mR1SM3Dk z#@^#B$E+=^m6h;}Tih^BClGT0qP5bN$7v3uKZK0J+WZdiBBxv~8{`T|$iPXZ1E9jM zYX@NF0hj||6u>ZwZfZ1)K@2ERMXjz;-oyO!Q3GByHo;U@0)G106^{g#mR5B87>|#2 zA&xgob@3qJ*o+8bWh?r?0@8+WsRQsW#8@N6s&Qa16MTlY5ho9E^Q(<~5$m|h&g~esyMa=d!#S0uyawW;@LS*g(C_MZ-C4C!y;Z6me7JZo$eDS-&u8NO_Me=c=Hu2-+7Wm7 z%<}W;}zYHa9l7zMK6#O)wEhB*F4N)5Wt;SwD&}o98dVIV&s!Yo+ zs_8MWY8#~`IXvI~ThQB7yn)4+Sv?A{t%X>+YdvDf4{PYFV{#2_ho8*#OhC6Yolzqb zf&c8E|8{p-6Lfd=sd#=gu32sA6;G0Qi;q167rHt9c;6(h^Z_$mFw<(($@~-hP%?o> z=kmSxKZ*PML5DLILT=5+jA`>QcwX&B!khDj9suvKZCJPtxqz>IajQtAx9hL3e3vD z|L6bxZug_wyz{NMUh|{6Bbqy61UWY|@0WSvg`wcFG{pHizY_ZA-Twy~y0fh}L;rvA zoe%VxFMal#SAq2l{U!E=NRFhAgOLOC1?)!v@AVruyjX}1rM5G?ZY=aCD!P-tQ_1|0 zrKbKh-{{jM z-!ilOYFEtMFUx^H`|MixJMVw2S^OoB3ZkvWl{3!`-V$%GYQ2gVta0IbD1FP_XP;m4 zISg9(qQNEaqW6@K9vvYvbt{4qJL>m&A5xl8&2yo_j7eIgXV*CInf#OU8 zj_M_)FoFa0xcDN5C_;K~BZ$QpROaV$er^G7-MpzU1fBLtV$1OR>-WoxAaPPs6mf`Y zgtf>CY03)qG>-kkPf%@8$|pm5G#oTO^`&m=VN!Tn_|)6mG(1x{RlFG(6LC28rOVfK z6~3)+OP=dqeeHri^L5H20pF*K!OMFkkSjj3|8yKYQDBkJr*i&VH}9%J#G^puqcNNp zWmqD|R42mKKb{!OY1qHw_W9|jpSkU_87Q3a4#PO4$0K}*w|f9eKPkkuUXo=Ce5I|5 zm;@{fC5#kvbOYn0RcD^R*&N31|Ej)V1ZKmVr;+0mFE2S%m`~G>q zBk+ly5PYT~{PE*QG^u>TKlTu0VvhFDo2L)u_^c{q!tW6;`6$Fb1H6Z#a_f*I0C1>a z-hnv<^J`ooaTNxId2!vXy2yMRs!^3z5>=-{_&FT_& znFA0SCmc|bX()%P_9utJQr=!*7!j{VVnVE^{_w-^dt=4RS1xN?=2xA@@mUzeI&0Qj z6R2R;5w!Og0ySl$OoM`&Z>NXtYGpfoYA2o)o;H4xP0ti8E2tWkoq(H4bO!1a`fDy< z=~0_dTjMLg_vGN6uI{znl}68n4<2p{nEeM&yCFe5a9n703t{IkYXul_EG_BV6?$Uz z{s$jO-?}>mi?EcGfyDAtV@Vxo%HTGX&KLxV+Cz*~egp~>y1gwpAoNiQjw1s!erZhR zN8?@NiwZ@fAx#BNPx^4_LHFT@AF7gn88qPQpgh#xI6{p zl%>Suhz2rQLr<_BzNeg=8rnKebI|y4jn4*TaMngDA+k8DQg)i?0?5aYM|||XIj zj}?v_eEMuG2zusOJrTIwee}`C9%fy+a;0_xbObyh-~__L(oarG7+i!@S;!j=J(5(P z8>O3k-dd{d_@UiOekL6bY4`gwy;$8(-^eTsr zbieeu^!LbbgRc@1Hq`E0fRG-&TT45dwt=HoHbi^HX9v@WtVt@A9{jQ#pHjU2)?3}R z>(}&z;EYEC;qdXQCNsI*5@640Rab#dOu{BC3!3>MXPh2j&nh0<+8Sun;0Tjofr;ZZ ze8Mwsc}OQb40Qm3O=aDj!89! zD1hzokYS=%0!A+)h`8tm_=Yx^>0%9MpXM*+S~(3PJNgP-@SGvGNtx1&7n z``-H>bpL;QZvv}Xa^3fR-`je5y?4*PaArh_OB_nFhN5IkvYHzZ#)%O)mI4G>6*veG z2Qh*qmVpSZjgplF4k!mQDLDyj2(XzLLIPPpDB3cVP!_4kHb99p98$yCIGpM3>1}%N ze(&Y~`=2^>>we4I-|OyS*L&Zss&h`Ab80zt>(;GXbxv=n;`JhiMd!mWj4b1=a)_Yo zXnz7*q6Pt+s$fa8 zRs1TVw}e`+UP+gJ3eEVazuWkfH_cD|N(=6yN)UD3Rq>?u774i0!f9oGJWw0+cL4bM zG4y8y$_?e})hk|ya_Q3BgRg&G&-_}j7K?zCR&5VciC+m6-Ug-=3*!=6A~#)XWK)BY zGr&Y9e92Qsn;g)58s3i(Fb~Edrm*noz%~jY!B-l`YfO{sr7#PlCT50P#fMhYueBIT zfiQt{MHTVKUwLlusNM=Z`pCnol$&}S(5XT!8)oGfA9&~;uh(>!d4U)aFh@XMeVH!w zKIR@Nfv%lWuYFfqY6A!2_EcaPEzZVU<_3HdDaOy60p`iL;c(~Y$0DECUw_>jgv@yE z2@{4-_|Xw`VT|8WLX_pL=aP@MX_=9~E;FN{weTr3G_9`z!x$`Vyab)56O=6a{#Nll zZY?u3&3FlyqI3_Di`h!#6tu(7Z~=vfZW9qbsx3uo_NyE}0;piI01OcOSK#lu={4d+Df`Zb4=FIk7z}$`2 zrAjS;6zVRh>Kb&AymRoSluN$T>+-jGJY|Z5SB4E3fo%?-8YX++Gm?GJuat(;ZkQ{= z#o{t;H?GG?mZ4v`a6$7;=e@`WzHUR!U7t3|ZOI*gnwDCXvlbnKf+9#7_!~}O#JT?gsMoW94E@^ADGs*=YSY2OWJS5-}A9Vu?>M@r^D+IxGy*V{7i7Y;x668=u zrr@Iu3z>99kVgP%{MiSj60IK$T1cPQR`Gq#O-wmOuXGf69H>})3KasEtzZgMS@=`} zKCfzcj&nZ6$j^96;7WquXsM*UTFUUZ0Lu!q7NhnSvr)X+iEouP!oT7Rym-oll0@Tj z;_R3kybEJedduP>Wa6`64akykDI=<8I}!vQZ0G?VMun&R2yGGXJi$qB690|hgG;>@ zt|hl*LpnFV%u5)sUOV$vDRV_urB8Ui`f;*@6}(W<90>3at%LS^mq7JEL{iT&L;-9S z4;yr>9e@h~v1@UjrqQ;-Q9|0$0!#5#wJ5NH#wQciAd3z(!z^^z%+g>?M`e>f8ftt7 z8th8a!aTf`sibyhBVg-W7h$1k;bqFAG9SaU5vzg0yTx1AE#ke=>nQ)CXDC}#qYP2O zEw+@8;{uUa!ng*XY|{_CuP)z&r#}r392&bqjJ#et;z?BWSuegx){1a=^n$^2`q6w`h}eCAzI%BddxLjD^hlPs2bY zrHp|TBXUArvIL0JGVH`^2k;hAv_y}da}=cXlTK1qKKfJOP8m8WOeX+5&U|;0V5Q{d zV2dR?MTUU&%QB~j9LhrP0DJ?GK2azlJ`G4RTUo^#$>N)YW8sDf^N1LCdwn2it&k;RvPl%nNbCVc3ly z3K?!0CV~gV;oCFYF65{#ZQG8vO8Lcj!_|~*GSW2f1O?XyAwX%(RchSaQ)>9mn`pfs zK%_vOMkR4+Vu}P?1g5?8L~SD;6;XOU&iaUu43UI*L=;yfiZhYM23y!WN}>WUK~SCR z(gd%VL=1dO2_5l!1wTo5^3dhC%VXv(@uW?<45#1H!Xe@5XS&4Uw`o?xLp!N_*P9-? z^33G4#25I5Hu5f^DUQT-@+z@)7ER5(J?vZ%$+wA6S#hR%EiO~*#!@SlNm#(1n3}eP$(iOB6$c`a&F^koTIaOZ8C;4h_<( zEbH(75V01k)zsJlTo#>)Y68J&MIZzR+xek_Yk0?qL+(NfoSOQpyvXKdINjJ zi8faU^AbcEYy3!2m^APV-p%+%H>n$ClzQV&!WWpyHiKV_|71Lp*3vK4?Kt%H8^@1Q z7W&q6H~@?Ux~RgAWUCBbLD}&oR9o28Hq@uz-WWpr4jp^v0@x@pjFy(Ly+{4i4x&8-mCFKHP`Zs66Nsj)42VQrN1|c; zg4c$Oy$~-yd8Kg^>bq?0>G!c+y0!2V1k|?xiA#NY&mt1YaM@0NW`;Z_c&G5lOd080 zkM=SR(JGkqEllCwV*oU+YQREY{n#m-v;~sj8cos)P#|@kloq<}#*gSg`-`mg z5r_rS;VZ-HpcW>9 zX6}o1YA=(ZEvyY^x)#=kH-pbK)BPf0lAzH<%4j8P!=rS>AuRP7om@>>kPsCz7a&zT z?wm^aI<6>ulQQs4quMIoj5{V)tq5zNf`q>DNW`O2lb33Qv<)F>{ zLR-c6xg|eO0=iIK^He0VT4AFJ?@&Bd%1Ti@K~Vldbz?V} zLOp?DE*28q42%z|?Z5}m z>HIf~r_oZ5lhcoua5TI~5%~{|;@Xu+q)WQwvN}F^Q^c7r{7yq~xKVi2z-am|-TLv) z2NyBpJAZccWh*&v@ukf@uiv=tJ^rugi2Ac{o%3O}Z2QeJ@+d(iRa!4Vqg@nUHh%2M ztc#}VFf5NO)j)*XDAb*8L7Xj)a4C&8!3OZXWWml?Jp$zB7@=DbP9yK@-|(ry=_!L` ztN1ENfhepfeD(!klg5W1Ix#qL;>2LTb_Y6e@W9}K2aXMnA3Nr+0_W!9cyXT@U%mi~ zeF7S-Tnn8PFr^xMbw^2LLx6fDnILQ7+vsk16ipE;v_0dDy- z^Gq8JM5Snca8g)GRkIg7%Q$Fj%3h#Rr)t#_Y!%<~ig3FQ0Bfqhand^qsX4Dj8tMqn zGaQBe(1Q;R9)9@2!GXoa!SNHv22Vcmn2i6pdhB@(>vZsg&W*ouBers)0^_9Ec=pSN zP`OumcQn`ch3`rUsPXWxA4hz#?H3;aEvg+I(kWE8AGxhg;DU}Bduy}LNrRad;etqWq4!H+&Q&tf_zXjD0s+Nwl%GalV=Yi2UYw*7kdl?{`@-Xw-S|MV$2kBy{(x~7~?flE=^61ec+KK8_&lB(odK4+;%H3afqzNbt%oZhZyb%cd z%39d=;$4Fwaz|yyIsg*-?!N|y-9kq>hBP#Gd-X*T4UDBLL$wn!^mo1M30Kg2-}Cg~ zsi&XRq|IP(=FBCX0CRb8Rfjdaefe!2+Hl#EJ8bKen}dc3DntU3wIybx3JyKK4X;r~ z?~IJMwK|$3nm)~dyETT&Za?!JMbF+5I&_9TCfRj*uYT`(>S^r&eAb->9m9*?cuAuJ z#g(QjFE|xrrx(CA3Yad5(+{ehyQX|gC^{*uuK{&c3E1n2pQ2eZ>Ui{0wHfUrN^Fhv zREEo}heaMeHai2@D2>eB{x z0^jm%!zs6gwc*6453aZ-n4pTGt;Nk{S);_*_S>TX89s;6vXKm%%WwgoK48HX1(V8b z3i_Sz{tkur>M+r7#$7%O&wdnk6Li}^pj#ZHgb^)vELsK8$zfvw;COKI%xyJf*Al8J z`Z`SkSE8-pB|AIJC>fOL7@{aY4h4DW!3PJAJ^t|Ed%oxW8V$_pFh-rle(B=iEzQ`n zM?0@`S{KZJ$O>i9*F8w!;xg%+CAj1XfrHcuS%d zM$2U9#ZQnx=3OFq3RtPo44bXSuT4K6ee|Kh_kG{Ls@FHm9)g{F>#f0QRR(*sLx+px z;uHb<6%&C%7ZqQ~x=OI|0d0s$;Yt#$f@{G1wuEmRfZ0ys9b($@DUeQg0P9L$2`dZh zU&=6mqdF+w1N9=(;SS@woH*2K7oCC%IrEoouCctR0;N*G_h|VX9nNDV$A8la+*YT+ zzLO_T9M=tKdGP4N4}0y&OE16dH3M~RvdhAZqRdJ>ZgglyM`KZOsgaRPY$Y05G5@&x zE2x0}ZZQX*ZUx8y06e2fL_t(=S-g)0f27|b*Jj*mPz|9Eb;UFPBij3)JO87PJT!Rr z`#vzZa(PM5`)Bn#W8=@ezEdd?9YNM}?GzH=Y({fHOuf;P*bE@30aMc;?C9kux$VIB zt5_Wg6uC7H(Kb5- z>qjm_3v@EzGHYVb=y$Bkb&zbc3Y%b83PvgEVUHd;>LJ%d51$x(P|y5t%lOaA_&Fq$ zJ3keIOQUy@y8}?jtb$+Ke}Fm}k$>Ba}_56Ds-^k{O^JhN=md@(JF3Ue z<-xn2d_tqrYl90q$aZF^CuEi?bcB_C9Psg^3ijC1!+z$!c74U~W#2p<#?S0Nid%ir6AmvM zL+8UZvN$=fquEcjDx5&6w8X))x_1!1=BW)d`D?*7d?)b8w5tKdBJ3@{HF3O8v-!u4 z9@Fc)gL=Pzz_a{wbFq2s?c3T#`r3`b`HOFB{z%)(U%c!gf1D$sT9%bEa(BJc$P`}^ z&nwzJIQerr^}&N$H=sv_XP$a$@Z~FCQCJhuT31kd0Babd3Ro0f-8+DyjTSkk+{R07 zuQlLTpOW@EZvkE-V?~|FWOhs2sKZ*UYWa4W*r2&Q{@9~>)wekKz<0k-?`HRDh;_!# z{iokN?RWa{w(;u{BY?<_!|?Ne`Vcz>m!1Pm5gA=DZP&uZdC_#mw=);;_J)~az-S2)zL$ho8UDUJxnbPx8VBKAx zup4c{f>CWFRG6Kg4k)&`)}M)biO${3QKaSQ}2AT38$2 zO?=9-j}odSjQ`NV#liP}_j?8pJ#<{J?pVpU&ySHk`jH52jYmy>&|lLd!Gd1x9X`A` zc;RcW44!}f8|Lkgf!sFZ>p&WXM-H0&{%y~6FX zUG?vD2Ne061d9Zd^54SRaEfSQZ8-2W{|?%PGWA;cTCKioa>CD1eFgdhANqinh96Yh z*{@f2dy|>{+qz@(ZOCm6`(y4XR{n8^XZ7Da=SS-CfOLEJE)33JxIB3O`<~Vu!ouL6 z|I4rXvBD<-smoRuPE@hHK)fD3)HVp&42x1AHEE5n_^ZCf1N#S$J*J-Y z;#Gg6O$Wfn4LElI)%X=B?DSkp)2hBxbj?j9u0Q;#4rCHeBHAh*o)hlvG>)p*R`8_7 zxwSVj@JQN@%Ql2sS(DgJ!zaA!AeJrI=68C zHsq4N4bjA%A05k00xSl>_W&&B;W>UUpN=c-{QQg_KM(0Hes%Da<`HOLfA}w+Qj5Jlo4wLm z+3uZRT`-iv%=NkD<(Ugh%bG>e5an?9(q zn{>h0F>?Lc@G~BnBY)r`qlAHHu1WxOf{IVhM`0~wSMXyBbO6imqDAWtuo@m5&UGKb za_!Rhz>chj8>ilJNKc*Uz-R|d=>2I8`;Y2zu{C}@5ol8Hvf9qu{*1Sm9AyPyEBR&p z@m~LihVpC#!eSp*{?UmX&`pT>sHdKKba3I)<-rRtyexStO|?5Z0^io@5OiZ=RKeQ= z+AMPooK{U+zNU}SW<_J$qQTpVhbu$AjQ}46_!2HblW*k$JNE!|1kzRc8LrG;m|I%8 zeNIYnOZ7~J<@>S~Y3oRvWgyZf=!8`05e@%YY4zx153AR{?n>cIb`-~XD<{#p6TmNj zFbfz|?g9W10Tqq_c{JRCf`FzUFNAjqzPsa9g?jp~jvvn(T-y8+#$`!OiYE@bHtlZ2 zkrB>XlnW!m_r3QSKl2~bC?N0rOS&t+dHRAs2FrF*)0Z~kc#|cJgb@Odnd}C%U!Miv zzP+H%U{QyM-Wt6By-({=^qe~s418E01=NYCLs(J=u%rn{bYg#s1x-BCman{i)idut zrONV3*2EX+o-q7QI4B-0<9o6)&>8lMbe6^$7-rLj%{n<6V2 zYwH0%m@JjR-Jfs!4=f%~1@c+%WpB!08YLo~E0w!HfAk9p!{?8zKpURJ5eHY`h0Zi) z5$W#Ec$b&S`W4-U+&n(ZrIcZ>d|F)MOR;9z*-!bS`mQ7WsP3iiYJR{w0?VB85?h4aVQ5@sXl&DNKSj#WPl3EspR;(odol ztOs@kgI*py{q*C51DdoucyM2pdj9;|x{F^{GYI1*b<}@w>DmHujhy7U-Rt5oj|H+6 z_L0C~SS`rp-t6q$;E_j9cv0G0=a}5n8UZ~8*r_AoQG!l@Rf2<+Id=jaP0t^Vq# z_UToU$B4`_N$dbX1u8JuZux4X$MBICzUDlZW@hGY&JAzfUS1x~O52c1aS$Zt@Rp@d zU;yKiN%HGVyEtNK&ubKhPOPzJVuebe7miPXsjR3}d}<5N7s7}e^8w-tJ|b~-f)=1~ z(aq31iJv4JrBc6dSA3~Q>Yujq@FOSm-M-$x>lGgE+V$HSqVxJK?)tP3*SyQCw3lcp zrUy%*#x+2s@fv>ld;sJ^*RwM>CzhQ*@%Tgf2IZU$9NLn~(*hm^sKcOhnp1}{ua0An zmJ8pwbW`-mmn_vG663KfQri?1%<3&nx9q_W<9AQy&cL&mOG`6L%X7ow!nNUWNx#9t zPLh)-T65N+5;RTA_25YhUHU~%CS@j;f@33wn_8H0^X3hIg6V>$Qu$M)_cKdz;NM>1 zHWH4E6kJ5cuB4xqJ&3m#Ukjn?(dWO@_$pR`(j+GqPv`-v&SAAlOJ(j1KJ=>Mte@_- zy3-!lw;=}>_j&ja9@NE)+WJi^`rJO;AgD7iw3(m^pKv-JJ)z?c2@(0lX>w2o&tjgr z*;|^}+he1D=%Hioa2S;e;5GkcIBUaa1V9IX;qeNPrN|dAMw>N%i%1z(O2QRSkR%hZ{oTCa{K)#=*Qm(B`#-sSCRu$4fvfAEAm{Z^C47 zC-KO@Szt)5c@InvXVNU2UBlPXu%a2$h+8xMhrQ}A@BX)Lt<+D#^9Df%+)j$sM`w`A zukABOz+#`JxiD%vgME7BSX9Sz{`@5yl<(x?&k#H28RGF|P7{I5y6@E^ZFSPyWehzQ zi6c`E)_~$o*hHJX#IU~@zWOW0R|Z%0;_}Me-lh4gw+F+kMSAtR7PwiV)6-4Q7K#p3 zq4QP}I%Z_)f$2@7A~E8qP}eGoM(tW(_2}cYo2OvE%z^mLZ2`)4SWJD(Qzyr8+bjgj z>K()Kvw8Wr2XMQ}FAd&phuT-54UcM%p+J*<;+ag;OnJP<6CZy|FWPy@g&z+APG0%TZr-$-!8LJ!&3}%S|wh>q3H>FyI z^5*P`0pZqFTGMp2hKsOAUKGLedwmot1VOL#$z1TXBRUb&L0<6q8O|gV{bVu`xfU=+ z8gy#$;|9z52g5f{o;-QGES4T#vJ7h@LU<}cW^64Ho5y$A&k)7O_teb%=Po}e?mm$U za*>IeLU*F@9SneI6NhGPg+#o&_Cv(NMaA`bCJukA_~_xM^Y6=QW8>lA(ucROHk?$G zV2Q)OOYudm)Q-{NZ4LRE@lVGcuIFeoZZ|+9>`*dsUc*SB%e#Lxe{4a7ZhxdwJ5-om zfRLSXX^L^uaBDNsW^<8Iu3>?T%h#iTVr#X$Nwdw)>T5(Ty}8LV5}=HRbF+L=SKeL> z24{Pfz5{ynvQ-LyOiTe#XuNx6I7gvdVb_SFq%G;AAmJ=P{L60)UOX| zq>ERY8YmPEA47HsKdR5J#jBta7|q|E!b=ZSagAChUIVgP?}i=~1;==W=k;;iFo1PG zw+p8Wn6BoQ*?|_<_q+B3&zwjDN(XRNZ>XZl7P`?ZCq~UGi)BCk}r%@T2n96JJf=)VuYQ z=V-c&uZiyyG6X-T*Kmv!`NWqt%NKpD!G|*1OPfZJHfkD#7HZ>?CVW5Bi?44&x^v<) zLZywebr?oolEKIhJ<`zVn4sXW(awpWxX_VE2P+(tq=%`%4Fr7G=gu$1u%q&m&6f^9 z8zP?LeDrWKeg|5G3JMSK6qKp9f_F*A@=I0#vigq+K|iyU*F2Una)}}iU{*#g*aEPZ z=`ukQCw$cJB^pI4z7>4xFoCT>yNyqInWv0rCNtjRtD>bWk_LFvWgu}0Pv1ONOWzV? zIM~ym&z?Q+q4;&J)yJ{r7pM7TGYo?dW9~#o>nOIF8ajQSUMa+gyC+{8(iU;tm@diq zuUydx0Bg6aElx3PC`Js}6?gw@*XRJoX~WtQo)lf&kTx2^)_+ynGGTed^ z))8ju_Na=e7S@JSlNQ#7*Naa&{7LDz2Opf*;@`?@!&yEptPO7!-}0IsuG-gtOhbmr z2!J1lzhb;>^qH@alUo{f7O`10e1KOPCCV@z42Hm-fO!+b_!*tP^6DFYJ)Lbh9za4O zql9>DOu^NVG+*I~=-r*dJdcDigZtzXk($0D7~jUCoDA zY6oD}+aY>&9osrcN(wy>^1N{2f_qYbR>?YV3MdJwrKqU_1XHm|B}fBnf)Ie~{>X3e z=wL0)+IZ5nDf+Q|gz32VLy@wdzNOeaK2zdP<39=4!rE}=vxT+coxw}>5l4-%LiD9q zUe}QPmhZ^(^FtrswYYz=7$H=lodaW$3a!n_5Vb?>pUpE_n3gvpw)(oNJO8V%y`dp> zj0m8Q7k0tRy9ujvB0ZCT>;=FUW6*~-x<()ptaYW@HtDeG+94?~ew?12y)vAg?dAXu zEDX+Q7V|8|M*2Zc@XxBoL<`&vch{u&2KO)E88A0DH77n1w-YEln$zXn>(l z%|SyPW;L#Fn8!FgA#35GYs6%-o4THIO z>4JLo8=7dj7(1mRIHC>N>5@kzpujAXiOb<^ko1muzR>M;X zJBuIJn>NbpxIg}*uWP@E>w~w>U6QeCV@}NjENVZA=maoG7Q)b`$2H8Fwc*Q1(oi@I zl+}Lz&OqsympXIy!r-gg5s2l-b}c*6#G`_YP4flZ$arKpuaRt5Fj&^=F7>I6daVSj zu*=teo=jI6_$E4BIrGLFU%yB)Tl}e0Kc>yhhJWHh643H=*@E0vR4S;-JhIzmI(n>& z+ME5VCIR0%_m+EkDuKfn7?Sm!Qj$3NrQb5_CFt%SJ@EaAOJHiTmGZe`cmz)o&NKR} z-+WVBc)#Si0QU7~6u?QobO8G`8kpnz5*cL=tV zdf&?T)ce@qUH)Zl4pMas^2*1FxfF&S-^7eV5_8|bi%X!XXIkfIH;zGn`H#M)q5q!2 zGuj}8O+xo-2cPBTJ!--lnW!yuM~=HPOUujha%DO1{1`g3{d5)>N`7I;1Rk&bzWAjt zYdf&>dex}mz4XC6sv#>p8^-0dO#U%hcvh!X(-HX2OYu4%PS_Q8iN=6m98J@qHyfgi zD3`Y5V;eJdn9nEA+5xQGUU|;10!z;rxtpL#_QDfTX1ZQ{b^@sh{5%CpWoZr z{O!6zDX=JJPnS4cLk(SjY~%H%Fa43fA$jJR$ICI^`}{b-oiK;w7$$9N^5UizlL0>tQT__PwI<*^~Y5G;3CrMd2r0>_8@^_%n$ z!%hP)T$J7}kWdu>Uhr=K8ww)9cYk$k`8u5&`psL*+S)i=(*Z2KpbwfZYiM%-lzTeHi1_E23&)Qua*g*MqEgqh*5!F)1GW+&z@BUF6gt*!ye92u!}eLd(%d~ z2k%l=3CebB+=YKnOyGMU3fnF?a@}1#!p9{}%AeI7qfTh&uf=UOd_VtC;-+b{ReW$? z_tlDb+Pl8BVu!mOACP_N55DZ*eo@2!D;Jy8g z8`^`rJ{}?~7viWq_4O@wNb`Foq zumoMkMhKwt&i8@|BFQ=(dc_@|M;k^q=rOpg4-;QV7PSMowSVrFx$DcXsSw^vLNv|4 z(cxAm-jZK3geVLi*M&ip{{@CN?QDDE%aO3&PlvE@sA{nfzn*b6n znm75Hj3@b|PNK3k-a0BY*(`!{$3J9t9KfWM4%&q#;X7`m#I;>rz*3u0e9G_Rvn)bx zq=_)sq)kYRpHz06#kc8F)@pg{Xxa*-y)vssd-}?AFAm;#^R2<3djEImT!{zuCW$4& z7M$nai}7LUdRM%zKA-UdI7zhe~w5zSju)&#uz+Bf|sfC)iPTVaQwMfI}0 zV&P2z1!@(|44u_D1sLlPYF-GCwKSio($FDr@N4lwAJ?upy7Y+;vmk~W#|JF1T!UBY zLp;JsvD0|;!L?E&?|tYvzJqijvvQusOEhp?gMU9&#v;F|PeL;-@j{`XhyTPg?0Szh z80>ky5%_<<@Go@0jL!Lc^3gaTRP#u&OOM)@j1_*%+CH2|0@e~R`OG38-t%96`%1ZU zvi*1b*^1TP{A?|s(ZwE3P;-~(b@fecB~FL(^2@J!($F1;q|ioDG<*de23~%E1Z!Qi zY6x2B`onZ~$miz{Kogo0_}q{F=t;i;fK%-Nh-kR*&oqSkx7q)8qbJ%vs?Aa!o!7^PPDsRZjN2DSpHL_%E{ ziQzifIKIO{+sF5Da|<=)THy1t8Jz%O zVQDk?rA`?BGTC=p!}m9}mp_KeAs-wM&g?$RhIu5orSAy1Yjb!AcYcQN+{wA4n-^@= zD6Nb9Fn(s#wd`1YyiPzqa||~%;m4t%XLNog&)sQD#hk1eoQT6ae(9J{GwF5EhTjB3Bwz098h$~1l#IM4cLb^ zaqZ$EDdXRG>1DqG;PuN1O$_c+C&05>es0Mj4vZM+5L&LOFZrpRKmrS86CDe#mHn;a z#{}L7Of7*d>u4z*S+)_|OLhV|{8M|G(>r_Wo_+n!ozvm6dakF@xjkfa5jzYU1I%Z3 z%TwHZX{ice6JG4YkXlCX--6yWs3W<_sX{tO;Kdie;U)+j?T&Q*gHidxJAV-(KR|F! z6^79f1!|pF@)39cnET-QUz4A=Z>_9+v1QSFslG6??~jFinY*r)M)C4%6Kz{~Qs!I+ zQ2@xc9_o#`%YXe(Ui2fu=`*LjDvOO7_vy9Z;-dCl*Bb(!>7s(9AxY!nFgllFjd;pV zzs=Mn*tZit3aia=KTP?o=5`oQJw{zhP^qh493cO0yYew?{W0WcRNzBEb$72m!*}kK z%nx9+r5)AuPRoqC<`5W#YN*etReNOk3;HqXz%&01wb2*8_I1BG@Z$wK$iiwnPJOI% z=x9A%meLS-I@2gJ+S?_54c{XePfW%m03#LY^z!V=L2SIbUI*~k|N4LMmLz_OA%n`G z6krTvYKrX+D1)|hN}_ehSKNi70G$%cgTJOufV(}91$;2Xl26tK?B~=L`OvunRavgU zn(+RR=$K9U}F5Z6V&{OHEyngAUAAO%}ymP${Ai%@_8{h9Pr6qUND8!P8 z9%;2+X*2i{eo+8fFfKN?MV_fx97He6%y=l#AF!{^8*MgwfW>|KS?ogTYXFa@5j z;|MT+iM{XN^(D~MW!O(whtxCm>nm-Szv4$*E;j~XHgv_+Mru2u&49yKd*g>e^EE0) z#DX;Zy}G07lUk2RdG3Gyg%|WyqFxnp12XTBt4N7krMLjIj?%K^CH=9oFZeO|G=OXg z`LQp8I)Ks%U^_Yl#J1fg?acvzxV19#yYqwPGs^S>%x1cW)H%p{x{hb2wG`S6o;2mVLTdMU3IoBeR<@qXa$txTod_r~2Gy z-fho=?ECJXD}hpNcx`Qt~8r4~e-I@9M zy}vukZ>$5DTl(h9D{~M3p5AT#1yP)9)r#*8kV0AZijA^|K7_43eK0TXhC zPN^IIG?#Su@smqnm&?Z;Jerg?wOTw#c=4(V_P;`E=kcu1`uTW$7Q<+T)$V9VEKp!VlMzX0M@3w^vbJxy?DmWHYW}{!-riv zkARVfj5K`5(NOSePK42~0wCC!Ll<6k9zJwvaOm&>9bR%kH^`$poOJHr|Hwx^`1eM+ zjg0^xSecvuZB1#uqRGG~y>40t!!r_lqc=r4%4>7+%xuXx<%E6Pfh(_dc;8!}3q%A7 z6~qFL)2Gk)i>pT-e%Rj*?AfEe1l0lL&~08XHKEJAw4F!@LQaUP@%w>$uLMdPa^slP zQr)h`Td2_3@8==&wv-FmVJBgv)yTg5WgrzwKjG;oJpF{HKMlUy_-T41JpI%w{b}%0 znHalk&5cMw_4GdZM4W`J|V&!yPu-4qPNmM&~$O)&Bek z%+0LeY}J+ux#brS5j%q?MiRKTk8W&;%3cV3%FMfeDRfP98e>EMi}D|HH4m zaPA-L^~ax&3AA_&SkW7SCH0a!;z}t*CG{oL0#eCQhdziwKnlFIljxb_)6jG0&gpBe zxAf*f??F{C`|>r8!qEAZ4I>2ct31rSkzEl%(^edMR=o<3dljGAwEh{HPz=?juL--LsW9iqz7twU>mfNY))wN*U+?d~Dh|h)}EaqM3U7g3t;Db>c zTnt|k0cxjE!lZ*P(m+zu6?mgg1e364bc|wE0Q|jyiDv)zlwFJt=*Fj~lz;r;4?p{d z(-KeZ0JLMs($9YKZ~uyJ`v01qiPVY2#Mz4c<KZtSnIk}+4>Xi%9X2rRb#rO38uXU;fQ5bA_Y?E7S?q< zgkmnarQ2@&Xlak~AH{cCXLg#>aYj;Gip_^r_MlB(%^#>_)#>4h;3&>0Z*I)1?;%4F5s$CF-INiOz}cLqmQ6n%?jh2H0etuqe#2& z-l-*^x~HPmU`E^8XpY^c3@q&{+gb5xo3uc@2!|i(M$>dODaUC>8r@ntW!lz<50AM1 zY43~$Jp%adKRfeJFPz=~`IdGxyr#UL{p7EHLc^s0OFN^?=Bq&7tuHfd(sR>}Iag9} zj}CxvS6Ts6-2dq-Duk&ZDB&DMWSaEN(ZnGqt{pGp6c8lo6L6sg86t8n$3<2S7>jUuhgD z@isk-J02F3h3?1(FG|a^{y|UrY2r`A{zHcrc@4OX<=LzN)PiJqP5rP@dNj zG4lf))l7xZqNzN(1y@c<uq5M}MY@qi-B)1SVg{*T0USC%Ro2hu~(qYY? zXBu=xncc*@+|UJ`Gap3{gG$tB){o0!)A-ECH2wu&^H-E8ZDYRp_G^D3XLNDxKoYSCE(0o`oK2qRy?uIGI)mnEKgx0H?9?x{cL!9tkMCBd*p&;jVas0ur(47}~I~bN~=l zpR`@-91#F2DTC#NYw$5MUAo2)Dd||!5!z{dD&S?53ja- z$Xn1wn$6&oUzFK6|E=TUJXycgx8LL)>l6ths~2! zjKZ`o;BRW?{J*?@{i|N(QNM)J{6rNAN(i|Sn4+kPkz!(Nt@_tytj(4MLI=(#Up5xrsS=n zCg82#DBQsQ#U!2e3Ryb$k``2f6g@`pC|78kKqnqtFEf4lYsS=|neb!C&-?xZ{IrAi z11FBNPT_z0*hjwqudc~M1ZzG5B$J!N!7nW=FMncwe$RKUtlY41@hHGM)S+Gt*1KvZ z*k-?$RTe6Mbfv8Q&47o|f#~jWO(JMDJZ+OlT?tluiDW#%FS3kDwk_Fi;#;{HZsjMe z^;g4B%FjsJHaZsGhV-klSWS17SqFYh=K|=-b)*LgTW;XdH}s9(D)c&yzO6{((M!oMo|u zf2^_BD1gU;-EwKCC_m}W9r(t?OE76OeW!1qmYC~N0f#$6hZ<_fM+Nw zpZt{MBH$R6h zs82&I!AUntaW~;dbsN<`@so5;*k~HcX4EAu{&wM8UX%Fm6uwsQgho&e*#)2xKq}TN zkOE(=AbRxcj98yRENUxfA9DBS_1}>rhgg01YhU=?fAkycaWJ&)c^456NBpm zJ}meiz83V|-(TCsoB)pmJL*ay^kkHR4zEOd1ZtE9PsTx-=q!-wl$E+j$P^`NuT6a~ z;aAhU#gWO;eC;-VREJUd8^w1We`akohruzRe#rq~#2K4+7$T|GBxWON*AwNHpYQm3 z-p5~D+~;lcb$IE&JT`meW6z#^k5Bzw4=-porPisx@vA>DyuI>|^r`K!+uEMX>!*1P zD8F?*ORrbMbTMbdMvU+3TazMHE}P&w|Ru}TCJ7b>-e$i&CGTgOUSC_ zP>^FIf{x9Yq>TdR+0~e#KZdU#XC59td}wfRao;(8?DnspJo$aUzfqnwZyQbcQ=k0X zKQXgB{EXI1&%~F4@n*oU2-Oknb|+Bvr@)JgU;{|RBtI*vkUL80B)kdc973WiI{^$U zJnlKXGJ?*y%y!920CjEil;QLtniQS}gTBXKgz-4n*8@7cZNiUb66T{BM(K6A8185C z%4c0^*GVMiZ1QnHo8QJ=f4?`vC9HS;%k%RyfBB;)Klpdn$*o7W?rio_MP#T~gTJU( zgZ~Z3b*16^!=YyLjS1;?2Bbpj4a-W6)X{;Y0?Mm{zEA|h6t9Ed58W?;);vmsDut4m zT<>IT1&S!c(D#!T4vn`OUN{aTWzx^augyNV^V1m|J9?B?e!ujQlh6J&O$@?i!>)WB zzu|NwSUGm+#!qRe{p)+YPXNk`sy6%AN|GGB+8QQUR?BfOv5e zdSwju3R9EDmN+mwrzqjR7nt?plV8W9pMHDr!6mPqgp`^X;$WTkUS0ze@bPe)9_;k= zf$igyYj6pQ)S-*@sS@8x9t|hWc*;(GKTQ|Qv*r(MeTWU^oWdqcIMY_K5^uyHf#LrQLV4dgxIOS`M(~S zxpwOxsCYhpO~)w5VI9l|l*K~49?UWGg!H=tYCDe!g`H>*KO20nPZhk5CJ0M$lh(jp zhL>LM{EB{fInY7znit?TP9n&hGY`i>_wn5tidsIs^sC_uFEbTeD5G3B} z6xz^l>-fqW(UM=|MVC?pA&4vT!L_c@sReIKSiBkbhw-ZeIIz!~ee9RsJP>X#oK&hPoGdZIteS?XOUP&xv20_?xHEyC8)a8gCJ zX-4siy8#rMY8a{P1bUMuzU56AdfYvXZ_6Vx(_BZ(qd_@%FX2b)D&u5iTK$dYcPHY~ z!^W>+KC}GM3GDL@R~(e9M}jY`+`92&AOH9dy}niP+m_8!zxe4VhfBl%U7f)9M<*bo z_gsKR0_p&mBUouaA)Y2VD`7SKG#sTt`iE6qDbjNM9d?M95?>btSqw(F& zaj746^VyH_>sg-;fM!P>q5?4zwhps!2J@KTmro3=aj2z_%eQuz&ox9KW*{-#hJac|IW!D z{N9%)r`|YpE0cg@(th$M|Ff57maqS~9x%VKckg~5;!!6BH95!@Tx`W4Cy{dZ;wVDPK8+B=QkXsJtI4i(v_eJUC1 zv#T}3eII;V?)=)1?{k_D{11QRN1pxGM%k}LuVa9>-~E$+@|&0c+z)^FHwUu|Pw1+2Py&@sIxKpWVNV! z%Xj~r3t(=*qXFgy>h${*_LB;63h90Dgc7)4eiI7i&VZ;2?bYv(c=Cw*-eXcL2cj+|P$S8X5d^Jskg)k9_3&e{VO6ZPz*gGIQ$Gr%%kx&-|?J z_y37b8JfGLFA3W-`{)3CN(&=`d@LYg+bG*GxKVc>KYfynvcauZ>uZ%?aJYY6PYI|j z*(wmj=gfs1@i7#)FD5VRu!KN^(zfo+j|pUM3a*x?c=9jJ%;Hhhlg!tk|U zzd8Z@h-eT=I@XW&8f2*m`pU@rt z;EkKtySV{P2P>rd(LnBrqacptE%C9u|rE&@y7({V{mY3t;??$7sME0dYSYOv%}O@H?{v?gE2v?>=et4D-|Q7i91@`f^Ao z;XJI96MM8EZb`JixiXyj#gA=b6OZkz*gM_{pEljl(0&#JE=I4gR`1R0uFs*I-2HO| zV4u-|I)J@8jhZ$6>Nu_n{`uLt;b+di@#1gG@NeENMRix2f$CxS(?9nsADo$)`*$@5 z@E24Q@4}jWDv`Gvqa(onqf;P4-DT$h&K&@Qg}@LfVWTF8Np>$g@=c98|0O&rKkLD- z)-qDgB;LTb0}r2RI;^EXY2{oL7%~y-gi#X_t_1MH&~@l7wEFQJ@1NdVhcAN{jPF|J zN+;lOHU6#>;BL>N9)ANfGkjTh{Qq+}v-0a7{^4i;K)h4)P~tAQmg2YzG?}6T-xcVb zzmICYz+W5=XMaEj{SZ|fs|uMb$Weh9Fham97mS}y0U#i***Q2`<3<@ono$>NfR5r| z+!i7DSmIpkI`J*psDKT`Y0fd}RCHM<|5kkFVk*qW(eQ5xtFDu{RAetea;Pht9{*B= zg}~PvNA;mT7p>T3N8(K`~W1E53TPej$&)qo5`$+YGIt9nm}(~jJMR3g$hkt{vZ zD(oou0#CF7U8FKFs5IURYyy+;0ZXD_8rOu$FMyyO!wN0f7}(HY(%_n4Nz;P_8-uuH z;WWIeS_NNeM^xx1FR9=Y1=IAoVgF87TYR_aPeZmW@mLKqjq~@=`lRKK zA7RqcX8f0Td+zwnv;FMM94!c4FV7BVUQ?2<%*@SwQOD!`zP@;U?h~K*ku!ZQ?~NGc z^p0@eoAAcXCzh9I-lIpi_vw-0y|VCUG^~3-9l!(1h&N|n@KU&+73Qz+ImD){SFHBg-plEN7PWQ=jnS-0b}GOSf)6H?w!{ zt8>evSGh2e?8&D&arJpZ^J=#DKf-F}yb zg2z?Uhg9JYsx|0brQ!U{%3z=R_ya1Gy=n*gRC+~^7lS!93$=x4Bvnx*^dBu|#C44^ z5j406S6pfM2GcM>mrEbk;Z{$ZGJ-y7LyS1`UzEVN3`7F+e}#mu2@AB9E6GKkz?9kX zb~dUU$GFt|Bg|-uE$K`Umy}UrkXP5!UxZB10rNy%F>Lcxo$y$w$HXNW{B6-_dkXyq zgX@xhSxK(xk?odLxTH?uv}i63S61HAjQ-2|K=s_x^6l65%+8+G=>F{S^)MwFB4K!3o3svQ+_;Do zP?SMU)9^#4;MUn8E}ZQ=xFy)zdNx0+TlTkRXNRvY&kVmgH<&r64*RAig08E-zA&>g z`_|IT(gi*G-I`z6b6ei^mFx3YhQsBnM~*Dt`oSOk!JBjpNcnbk|3B`UsAGC)W@rEa N002ovPDHLkV1h;s8@~Vm literal 0 HcmV?d00001 diff --git a/docs/single-file-mounts.md b/docs/single-file-mounts.md new file mode 100644 index 0000000..9f963d9 --- /dev/null +++ b/docs/single-file-mounts.md @@ -0,0 +1,55 @@ +# Single File Mounts + +In Containerization, what is analogous to bind mounts goes over virtiofs. virtiofs can only +share directories, not individual files. To support mounting a single file from the host into +a container, Containerization shares the file's parent directory via virtiofs and then bind +mounts the specific file to its final destination inside the container. + +## How it works + +1. **Detection**: During mount preparation, each virtiofs mount source is stat'd. If it's a + regular file (not a directory), it enters the single-file mount path. Symlinks are + resolved to the real file first. + +2. **Parent directory share**: The file's parent directory is shared via virtiofs into the + guest VM. If multiple single-file mounts reference files in the same parent directory, + only one virtiofs share is created. + +3. **Guest holding mount**: After the VM starts, the parent directory share is mounted to a + holding location in the guest. + +4. **Bind mount**: When the container starts, a bind mount is created from + the holding location to the requested destination path inside the container. + +### Example + +Mounting `/Users/dev/config/app.toml` to `/etc/app.toml` in the container: + +``` +Host: /Users/dev/config/ (shared via virtiofs) +Guest VM: /temporary/holding/spot/ (virtiofs mount of parent dir) +Container: /etc/app.toml (bind mount of /temporary/holding/spot/app.toml) +``` + +## Trade-offs + +Sharing the parent directory means that sibling files in that directory are visible to the +guest VM at the holding mount point under `/run`. The bind mount into the container only +exposes the specific file requested, but the full parent directory contents are accessible +from inside the VM itself. This is a deliberate trade-off for reliability. Prior attempts +at supporting single file mounts using temporary directories with hardlinks were fragile +across filesystem boundaries and with certain host filesystem configurations. + +## Alternatives to single file mounts + +If exposing the parent directory to the guest VM is not acceptable for your use case, you +can avoid single-file mounts entirely: + +- **Mount the whole directory**: Instead of mounting a single file, mount the directory that + contains it. This is functionally equivalent (the directory is shared either way) but makes + the behavior explicit and gives the container access to the full directory at the + destination path. + +- **Stage files into a dedicated directory**: Copy the files you need into a dedicated + directory on the host and mount that directory instead. This gives you full control + over what is visible to the guest. diff --git a/docs/x86_64-build.md b/docs/x86_64-build.md new file mode 100644 index 0000000..5d4e2c4 --- /dev/null +++ b/docs/x86_64-build.md @@ -0,0 +1,228 @@ +# x86_64 Deployment Build + +`make dist-x86_64` produces a self-contained x86_64 Linux deployment tarball +at `bin/containerization-x86_64-.tar.gz`. The build runs entirely inside +the aarch64 Linux dev container — there is no host tooling requirement beyond +`make`, `container`, and the prerequisites the dev image installs. + +The tarball ships everything needed to run a Containerization VM on an x86_64 +Linux host: the `cctl` host binary, the `cloud-hypervisor` VMM, the +`virtiofsd` filesystem daemon, an x86_64 Linux kernel, and an `initfs.ext4` +guest rootfs containing `vminitd` + `vmexec`. + +`cctl`, `cloud-hypervisor`, and `vminitd`/`vmexec` are statically linked +against musl, so they run on any x86_64 Linux. **`virtiofsd` is dynamically +linked against glibc 2.35+**; the deployment host must provide glibc +≥ 2.35 (Ubuntu 22.04 / Debian 12 / RHEL 9 era) plus `libseccomp.so.2` and +`libcap-ng.so.0`. Both are present by default on essentially every server +distro shipped in the last few years. + +## Prerequisites + +Before the first `make dist-x86_64`: + +1. **Source checkouts under `.local/`** — pinned by you, not fetched by the + build. There is no fetch target; clone the revision you want shipped: + + ```sh + git clone -b v52.0 https://github.com/cloud-hypervisor/cloud-hypervisor \ + .local/cloud-hypervisor + git clone https://gitlab.com/virtio-fs/virtiofsd .local/virtiofsd + ``` + +2. **An x86_64 kernel** at `kernel/vmlinuz-x86_64` (preferred) or + `kernel/vmlinux-x86_64`. Build via `make -C kernel TARGET_ARCH=x86_64`. + The build fails hard if neither exists — a tarball without a kernel is + not usable. + +3. **The Linux dev image.** `dist-x86_64` depends on the `linux-image` + make target, so the `container build` cache handles this automatically; + the first run takes a few minutes, subsequent runs are seconds. + +The dev image (`images/linux-dev/Dockerfile`) bundles Swiftly, the Static +Linux SDK, the Rust toolchain (with `cargo-zigbuild`), a prebuilt +`/opt/cross-x86_64-musl/` prefix containing zlib, xz, bzip2, libarchive, +libcap-ng, and libseccomp built static-musl for x86_64, and a sibling +`/opt/cross-x86_64-gnu/` prefix containing libcap-ng and libseccomp built +as glibc-dynamic shared libraries for virtiofsd's link step. +`scripts/build-musl-x86_64-deps.sh` and `scripts/build-glibc-x86_64-deps.sh` +produce these prefixes at image build time. + +## Running the build + +```sh +make dist-x86_64 +``` + +Drives `scripts/build-dist-x86_64.sh` inside the dev container via the +`linux_run` macro. The container bind-mounts the repo at `/workspace`, so +all build outputs land back on the host under `bin/dist-x86_64/`. + +## Pipeline + +The script runs five build stages plus a packaging stage. Each build stage +is gated by a freshness check (see [Rebuild gating](#rebuild-gating)) so +unchanged components are skipped on subsequent runs. + +1. **`cctl` cross-compile to x86_64-linux-musl.** + `swift build --swift-sdk x86_64-swift-linux-musl --product cctl`. Always + runs — this is the artifact under iteration, and Swift's incremental + build is a near-no-op when nothing changed. + +2. **`vminitd` + `vmexec` cross-compile to x86_64-linux-musl.** + `make -C vminitd LIBC=musl MUSL_ARCH=x86_64`. The guest agent and + process launcher; both run inside the VM as PID 1's children. + +3. **`cloud-hypervisor` cross-compile to x86_64-unknown-linux-musl.** + `cargo zigbuild --target x86_64-unknown-linux-musl --bin cloud-hypervisor` + from `.local/cloud-hypervisor`. + +4. **`virtiofsd` cross-compile to x86_64-unknown-linux-gnu.2.35.** + `cargo zigbuild --target x86_64-unknown-linux-gnu.2.35` from + `.local/virtiofsd`, with `scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch` + applied first. The patch is idempotent — applied if missing, skipped if + already present, fails hard if it can't be applied cleanly. Unlike the + other three host binaries, virtiofsd is **glibc-dynamic**: it expects + the deployment host to provide glibc ≥ 2.35, `libseccomp.so.2`, and + `libcap-ng.so.0`. Link-time `.so` files come from + `/opt/cross-x86_64-gnu/`. + +5. **`initfs.ext4` packaging.** + A native aarch64 `cctl` is built (Swift release) and used as the packer: + `cctl rootfs create --vminitd … --vmexec …` writes a ready-to-mount + ext4 image with the x86_64 guest binaries inside. The native build + only runs when this stage runs. + +6. **Stage and tar.** Always runs. Lays out the staging tree at + `bin/dist-x86_64//`: + + ``` + / + ├── bin/ + │ ├── cctl + │ ├── cloud-hypervisor + │ └── virtiofsd + ├── kernel/ + │ └── vmlinuz-x86_64 # or vmlinux-x86_64, whichever was found + └── initfs.ext4 + ``` + + Then `tar -czf bin/.tar.gz`. + +## Rebuild gating + +By default, every stage skips when its output is up-to-date. Each freshness +check has a corresponding `REBUILD_*=1` environment variable that forces +the stage to rerun. + +| Stage | Skip condition | Force rebuild | +| --- | --- | --- | +| `cctl` x86 cross | (never skipped — always runs) | n/a | +| `vminitd` + `vmexec` | both binaries exist under `bin/dist-x86_64/` AND nothing under `vminitd/Sources/`, `vminitd/Package.swift`, or `Sources/Containerization/SandboxContext/` is newer than them | `REBUILD_VMINITD=1` | +| `cloud-hypervisor` | `bin/dist-x86_64/cloud-hypervisor` exists | `REBUILD_CH=1` | +| `virtiofsd` | `bin/dist-x86_64/virtiofsd` exists | `REBUILD_VIRTIOFSD=1` | +| `initfs.ext4` | exists AND is newer than both staged `vminitd` and `vmexec` (also implicitly skipped when `vminitd` was skipped) | `REBUILD_INITFS=1` | +| native aarch64 `cctl` | only built when `initfs.ext4` is being rebuilt | `REBUILD_INITFS=1` | +| stage tree + tar | (always runs) | n/a | + +The freshness checks intentionally use binary presence and source mtimes +rather than content hashing — fast to evaluate, easy to bypass with `touch` +or `rm`. There is no global "rebuild everything" switch by design; force +the specific component you want, or `rm -rf bin/dist-x86_64/` for a full +clean rebuild. + +`cloud-hypervisor` and `virtiofsd` only check binary presence (not source +mtime against `.local/`). The pinned-source convention assumes you opt +into rebuilds explicitly — the `REBUILD_CH=1` / `REBUILD_VIRTIOFSD=1` +escape hatches exist for exactly that case. Walking the full Rust source +tree on every run was the alternative; not worth the cost. + +### Common rebuild scenarios + +- **Iterating on host-side `cctl` or `Containerization` Swift code:** just + `make dist-x86_64`. Only the x86 cctl rebuild runs (and tar). +- **Touched `vminitd` source or the proto:** `REBUILD_VMINITD=1` is + picked up automatically by mtime; `make dist-x86_64`. `vminitd` and + `initfs.ext4` rebuild. +- **Pulled new `.local/cloud-hypervisor`:** `REBUILD_CH=1 make dist-x86_64`. +- **Pulled new `.local/virtiofsd`:** `REBUILD_VIRTIOFSD=1 make dist-x86_64`. +- **Suspect a stale artifact:** `rm -rf bin/dist-x86_64 && make dist-x86_64` + for a full clean rebuild. + +## Cross-compilation toolchain + +Two cross toolchains live side-by-side in the dev image. `cctl`, +`vminitd`/`vmexec`, and `cloud-hypervisor` target `x86_64-linux-musl` and +ship statically linked so the artifacts are host-libc independent. +`virtiofsd` targets `x86_64-linux-gnu.2.35` and ships dynamically linked; +the deployment host provides glibc, libseccomp, and libcap-ng. + +- **Swift** uses Apple's Static Linux SDK (`x86_64-swift-linux-musl`), + installed by `make cross-prep` at dev-image build time. The same SDK + is used for both `cctl` and `vminitd` cross-builds. +- **Rust C cross-compiler is Zig.** For musl stages, `zig cc -target + x86_64-linux-musl` is wrapped as `x86_64-linux-musl-{gcc,g++,ar,ranlib,strip}`. + For virtiofsd, parallel `x86_64-linux-gnu-*` wrappers dispatch to + `zig cc -target x86_64-linux-gnu.2.35`, plus an `x86_64-linux-gnu-ld` + wrapper backed by LLVM's `ld.lld` (apt-installed). The `ld` wrapper + is needed because libtool's shared-library detection probes the + linker with `-m elf_x86_64`; the host's aarch64 `/usr/bin/ld` + rejects that and would silently disable `.so` emission. The gnu + `gcc`/`g++` wrappers intercept `-print-prog-name=ld` so libtool + discovers the cross-ld wrapper instead of the host linker. The + pinned `.2.35` glibc baseline determines the minimum host glibc; + bumping it requires editing the wrapper scripts under + `images/linux-dev/wrappers/`. Zig was chosen over musl.cc / gcc + cross prebuilts because aarch64-hosted versions of those aren't + published. +- **Rust linker** is **not** set explicitly. `cargo-zigbuild` installs + its own linker wrapper that strips Rust's self-contained musl crt + files (which would otherwise collide with Zig's musl crt). Setting + `CARGO_TARGET_*_LINKER` ourselves overrides that and produces + duplicate-symbol link errors. +- **`pkg-config`** points at `/opt/cross-x86_64-musl/lib/pkgconfig` for + the musl stages; the virtiofsd block overrides it in a subshell to + point at `/opt/cross-x86_64-gnu/lib/pkgconfig` so `libseccomp-sys` + and `libcap-ng`'s `capng-sys` resolve against the glibc-dynamic + `.so` files, not the static-musl `.a` archives. The musl prefix uses + GNU ld linker scripts at `lib{seccomp,cap-ng}.so` to redirect + dynamic-link requests into the static archives; the gnu prefix ships + real shared libraries. + +The cross C dep prefixes are built by `scripts/build-musl-x86_64-deps.sh` +and `scripts/build-glibc-x86_64-deps.sh` during `make linux-image`. +Modifying either script invalidates that layer of the dev image and +triggers a rebuild on the next `make dist-x86_64`. + +## Troubleshooting + +- **`ERROR: missing .local/cloud-hypervisor source checkout`** — see + Prerequisites. There is no fetch target; clone the revision you want + pinned. +- **`ERROR: no x86_64 kernel found`** — run + `make -C kernel TARGET_ARCH=x86_64`. The build refuses to ship a + tarball without a kernel. +- **`ERROR: virtiofsd cap-drop patch does not apply cleanly`** — the + patch only applies to known-good upstream revisions of virtiofsd. If + you bumped `.local/virtiofsd` past that, refresh + `scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch` + against the new revision. +- **Stale binary on the deployment host** — confirm the tarball SHA in + `bin/containerization-x86_64-.tar.gz` matches `git rev-parse + --short HEAD`. The script tags the tarball with `HEAD` at build time; + uncommitted changes ship under the same SHA as their parent commit. +- **Linker errors mentioning duplicate `crt*.o` symbols** — something is + setting `CARGO_TARGET_*_LINKER`. Unset it and let `cargo-zigbuild` + manage the linker. +- **`virtiofsd: error while loading shared libraries: libseccomp.so.2`** + (or `libcap-ng.so.0`) on the deployment host — install the system + packages (`apt install libseccomp2 libcap-ng0` on Debian/Ubuntu, + `dnf install libseccomp libcap-ng` on Fedora/RHEL). `virtiofsd` is + glibc-dynamic by design; the libs are not bundled in the tarball. +- **`virtiofsd: /lib/x86_64-linux-gnu/libc.so.6: version 'GLIBC_2.35' + not found`** — the deployment host's glibc is older than the build's + baseline. Either upgrade the host or rebuild with a lower baseline + by editing the `-target x86_64-linux-gnu.` arg in + `images/linux-dev/wrappers/x86_64-linux-gnu-{gcc,g++}` and the + `cargo zigbuild --target x86_64-unknown-linux-gnu.` line in + `scripts/build-dist-x86_64.sh`. diff --git a/examples/README.md b/examples/README.md new file mode 100644 index 0000000..bc18a2a --- /dev/null +++ b/examples/README.md @@ -0,0 +1,14 @@ +# Examples + +This directory contains example projects demonstrating how to use Containerization. + +## Available Examples + +### [ctr-example](ctr-example/) + +A basic example of launching a Linux container using Containerization. This example demonstrates: +- Fetching and configuring a Linux kernel +- Creating and starting containers +- Basic container management operations + +See the [ctr-example README](ctr-example/README.md) for detailed build and run instructions. diff --git a/examples/ctr-example/Makefile b/examples/ctr-example/Makefile new file mode 100644 index 0000000..06bda05 --- /dev/null +++ b/examples/ctr-example/Makefile @@ -0,0 +1,47 @@ +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# ctr-example Makefile + +SWIFT = /usr/bin/swift + +UNAME_M := $(shell uname -m) +KERNEL_ARCH := $(if $(filter $(UNAME_M),aarch64 arm64),arm64,$(UNAME_M)) + +.PHONY: all build clean run + +all: run + +build: + $(SWIFT) build --configuration release + codesign --force --sign - --entitlements ctr-example.entitlements ./.build/release/ctr-example + cp ./.build/release/ctr-example ./ctr-example + +clean: + $(SWIFT) package clean + rm -f ./ctr-example + +run: build + ./ctr-example + +# Development targets +debug: + $(SWIFT) build + codesign --force --sign - --entitlements ctr-example.entitlements ./.build/debug/ctr-example + +fmt: + $(SWIFT) format --in-place --recursive Sources/ +fetch-default-kernel: + $(MAKE) -C ../.. fetch-default-kernel + cp -L ../../.local/vmlinux-$(KERNEL_ARCH) ./vmlinux-$(KERNEL_ARCH) diff --git a/examples/ctr-example/Package.resolved b/examples/ctr-example/Package.resolved new file mode 100644 index 0000000..848cc07 --- /dev/null +++ b/examples/ctr-example/Package.resolved @@ -0,0 +1,267 @@ +{ + "originHash" : "f9b523ded39c0fa3565fd16d3b4097384449d541048751be7efee4a43af79fd4", + "pins" : [ + { + "identity" : "async-http-client", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/async-http-client.git", + "state" : { + "revision" : "7744c2a035c68ec14726c709f031835e3e30bde1", + "version" : "1.34.0" + } + }, + { + "identity" : "containerization", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/containerization.git", + "state" : { + "revision" : "9275f365dd555c8f072e7d250d809f5eb7bdd746", + "version" : "0.33.4" + } + }, + { + "identity" : "grpc-swift-2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-2.git", + "state" : { + "revision" : "21fe69ab7ce0e87ac089534733c52f037e74a3eb", + "version" : "2.4.1" + } + }, + { + "identity" : "grpc-swift-nio-transport", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-nio-transport.git", + "state" : { + "revision" : "e7d463749f9037b047dcd6da4e633718ddc432b8", + "version" : "2.8.0" + } + }, + { + "identity" : "grpc-swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-protobuf.git", + "state" : { + "revision" : "b05885fa9bdd88f1eab2e7162f1ee81340b0da33", + "version" : "2.4.0" + } + }, + { + "identity" : "swift-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-algorithms.git", + "state" : { + "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023", + "version" : "1.2.1" + } + }, + { + "identity" : "swift-argument-parser", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-argument-parser.git", + "state" : { + "revision" : "6a52f3251125d74daf04fcbd5e6f08a75d074382", + "version" : "1.8.2" + } + }, + { + "identity" : "swift-asn1", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-asn1.git", + "state" : { + "revision" : "a9a5efd40eaf558a2bcd48d64b1d1646be686008", + "version" : "1.7.1" + } + }, + { + "identity" : "swift-async-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-async-algorithms.git", + "state" : { + "revision" : "d0b4a06d0f173a2f3be27d3ea21b3c3aa18db440", + "version" : "1.1.4" + } + }, + { + "identity" : "swift-atomics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-atomics.git", + "state" : { + "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-certificates", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-certificates.git", + "state" : { + "revision" : "bde8ca32a096825dfce37467137c903418c1893d", + "version" : "1.19.1" + } + }, + { + "identity" : "swift-collections", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-collections.git", + "state" : { + "revision" : "a0cb0954ecb21e4e31b0070e6ed5674e8556685a", + "version" : "1.6.0" + } + }, + { + "identity" : "swift-configuration", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-configuration.git", + "state" : { + "revision" : "be76c4ad929eb6c4bcaf3351799f2adf9e6848a9", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-crypto", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-crypto.git", + "state" : { + "revision" : "95ba0316a9b733e92bb6b071255ff46263bbe7dc", + "version" : "3.15.1" + } + }, + { + "identity" : "swift-distributed-tracing", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-distributed-tracing.git", + "state" : { + "revision" : "dc4030184203ffafbb2ec614352487235d747fe0", + "version" : "1.4.1" + } + }, + { + "identity" : "swift-http-structured-headers", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-structured-headers.git", + "state" : { + "revision" : "933538faa42c432d385f02e07df0ace7c5ecfc47", + "version" : "1.7.0" + } + }, + { + "identity" : "swift-http-types", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-types.git", + "state" : { + "revision" : "db774a277f60063a32d854f2980299caf06da041", + "version" : "1.6.0" + } + }, + { + "identity" : "swift-log", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-log.git", + "state" : { + "revision" : "92448c359f00ebe36ae97d3bd9086f13c7692b5a", + "version" : "1.13.2" + } + }, + { + "identity" : "swift-nio", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio.git", + "state" : { + "revision" : "77b84ac2cd2ac9e4ac67d19f045fd5b434f56967", + "version" : "2.101.0" + } + }, + { + "identity" : "swift-nio-extras", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-extras.git", + "state" : { + "revision" : "d2eeec0339074034f11a040a74aa2a341a2c4506", + "version" : "1.34.1" + } + }, + { + "identity" : "swift-nio-http2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-http2.git", + "state" : { + "revision" : "61d1b44f6e4e118792be1cff88ee2bc0267c6f9a", + "version" : "1.44.0" + } + }, + { + "identity" : "swift-nio-ssl", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-ssl.git", + "state" : { + "revision" : "407d82d5b6cc00e1c3fb83a81b1539b70c788c5e", + "version" : "2.37.1" + } + }, + { + "identity" : "swift-nio-transport-services", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-transport-services.git", + "state" : { + "revision" : "67787bb645a5e67d2edcdfbe48a216cc549222d5", + "version" : "1.28.0" + } + }, + { + "identity" : "swift-numerics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-numerics.git", + "state" : { + "revision" : "0c0290ff6b24942dadb83a929ffaaa1481df04a2", + "version" : "1.1.1" + } + }, + { + "identity" : "swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-protobuf.git", + "state" : { + "revision" : "f6506eaa86ed2e01cb0ae14a75035b7fdbf0918f", + "version" : "1.38.0" + } + }, + { + "identity" : "swift-service-context", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-service-context.git", + "state" : { + "revision" : "d0997351b0c7779017f88e7a93bc30a1878d7f29", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-service-lifecycle", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/swift-service-lifecycle.git", + "state" : { + "revision" : "9829955b385e5bb88128b73f1b8389e9b9c3191a", + "version" : "2.11.0" + } + }, + { + "identity" : "swift-system", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-system.git", + "state" : { + "revision" : "7502b711c92a17741fa625d722b0ccbd595d8ed1", + "version" : "1.7.2" + } + }, + { + "identity" : "zstd", + "kind" : "remoteSourceControl", + "location" : "https://github.com/facebook/zstd.git", + "state" : { + "revision" : "f8745da6ff1ad1e7bab384bd1f9d742439278e99", + "version" : "1.5.7" + } + } + ], + "version" : 3 +} diff --git a/examples/ctr-example/Package.swift b/examples/ctr-example/Package.swift new file mode 100644 index 0000000..15b649c --- /dev/null +++ b/examples/ctr-example/Package.swift @@ -0,0 +1,45 @@ +// swift-tools-version: 6.2 +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import PackageDescription + +let scVersion = "0.33.4" + +let package = Package( + name: "ctr-example", + platforms: [ + .macOS("26.0") + ], + products: [ + .executable( + name: "ctr-example", + targets: ["ctr-example"] + ) + ], + dependencies: [ + .package(url: "https://github.com/apple/containerization.git", exact: Version(stringLiteral: scVersion)) + ], + targets: [ + .executableTarget( + name: "ctr-example", + dependencies: [ + .product(name: "Containerization", package: "containerization"), + .product(name: "ContainerizationOS", package: "containerization"), + ] + ) + ] +) diff --git a/examples/ctr-example/README.md b/examples/ctr-example/README.md new file mode 100644 index 0000000..1563eb0 --- /dev/null +++ b/examples/ctr-example/README.md @@ -0,0 +1,48 @@ +# Container Example + +Very basic example of launching a Linux container using Containerization. + +## Build and Run + +### 1. Fetch Kernel + +In your terminal, change directories to examples/ctr-example and run: + +**Option A: Using Makefile (recommended)** +```bash +make fetch-default-kernel +``` + +**Option B: Copy from installed container tool** +```bash +cp "$(ls -t ~/Library/Application\ Support/com.apple.container/kernels/vmlinux-* | head -1)" ./vmlinux +``` + +You should now see the `vmlinux` image in examples/ctr-example + +### 2. Build/Run ctr-example + +From examples/ctr-example run: +```bash +make all +``` + +> [!WARNING] +> If you get the following error, try building from the default macOS terminal: +> `error: compiled module was created by a newer version of the compiler` + +After the build completes, the example will run. In your terminal you should see something like: + +``` +Starting container example... +Fetching container initial filesystem... +Creating container from docker.io/library/alpine:3.16... +Starting container... +/ # +``` + +> [!WARNING] +> If you get the following error, try moving the `ctr-example` binary to `/var/tmp` and run it from there. +> `Swift/ErrorType.swift:254: Fatal error: Error raised at top level: unsupported: "failed to create vmnet network with status vmnet_return_t(rawValue: 1001)"` + +**Congratulations, you've started the example container!** diff --git a/examples/ctr-example/Sources/ctr-example/main.swift b/examples/ctr-example/Sources/ctr-example/main.swift new file mode 100644 index 0000000..101b40c --- /dev/null +++ b/examples/ctr-example/Sources/ctr-example/main.swift @@ -0,0 +1,84 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Containerization +import ContainerizationOS +import Foundation + +@main +struct CtrExample { + static func main() async throws { + print("Starting container example...") + + // Set up terminal in raw mode (like cctl) + let current = try Terminal.current + try current.setraw() + defer { current.tryReset() } + + let initfsReference = "ghcr.io/apple/containerization/vminit:0.26.5" + #if arch(arm64) + let kernelCandidates = ["./vmlinux-arm64"] + #elseif arch(x86_64) + let kernelCandidates = ["./vmlinuz-x86_64", "./vmlinux-x86_64"] + #else + let kernelCandidates = ["./vmlinux"] + #endif + let kernelPath = kernelCandidates.first(where: { FileManager.default.fileExists(atPath: $0) }) ?? kernelCandidates[0] + print("Fetching base container filesystem...") + // Create container manager with file-based initfs + var manager = try await ContainerManager( + kernel: Kernel(path: URL(fileURLWithPath: kernelPath), platform: .linuxArm), + initfsReference: initfsReference, + network: try VmnetNetwork() + ) + + let containerId = "ctr-example" + let imageReference = "docker.io/library/alpine:3.16" + + print("Creating container from \(imageReference)...") + + // Create container with simple configuration + let container = try await manager.create( + containerId, + reference: imageReference, + rootfsSizeInBytes: 1.gib() + ) { @Sendable config in + config.cpus = 2 + config.memoryInBytes = 512.mib() + config.process.setTerminalIO(terminal: current) + config.process.arguments = ["/bin/sh"] + config.process.workingDirectory = "/" + } + + // Clean up on exit + defer { + try? manager.delete(containerId) + } + + print("Starting container...") + try await container.create() + try await container.start() + + // Resize terminal to match current window + try? await container.resize(to: try current.size) + + // Wait for container to finish + let exitCode = try await container.wait() + + print("Container exited with code \(exitCode)") + try await container.stop() + } +} diff --git a/examples/ctr-example/ctr-example.entitlements b/examples/ctr-example/ctr-example.entitlements new file mode 100644 index 0000000..f7f5d7c --- /dev/null +++ b/examples/ctr-example/ctr-example.entitlements @@ -0,0 +1,8 @@ + + + + + com.apple.security.virtualization + + + \ No newline at end of file diff --git a/examples/ctr-example/lab.md b/examples/ctr-example/lab.md new file mode 100644 index 0000000..d51630c --- /dev/null +++ b/examples/ctr-example/lab.md @@ -0,0 +1,58 @@ +# + +## Install and test the container tool: + +See https://github.com/apple/container/releases + +Once installed, start the service and follow prompts. + +```bash +container system start +``` + +This'll install your kernel. + +After this start your first container. On first launch, this'll install another artifact for our guest init process: + +```bash +container run alpine uname +``` + +Container starts after this will be fast! + +## Get the Containerization sources: + +```bash +$ git clone https://github.com/apple/containerization.git +``` + +> [!IMPORTANT] +> There is a bug in the `vmnet` framework on macOS 26 that causes network creation to fail if the creating applications are located under your `Documents` or `Desktop` directories. To workaround this, clone the project elsewhere, such as `~/projects/containerization`, until this issue is resolved. + +## Take a look at ctr-example + +Read through the sources: + +- ContainerManager: +- manager.create() +- container.create(), start(), wait(), stop() + +## Fetch the kernel + +Run + +```bash +cp "$(ls -t ~/Library/Application\ Support/com.apple.container/kernels/vmlinux-* | head -1)" ./vmlinux +``` + +## Build and run the example + +```bash +$ cd examples/ctr-example +$ make +``` + +## Modify the project + +- Change the command run by the container +- Change the image diff --git a/examples/sandboxy/Makefile b/examples/sandboxy/Makefile new file mode 100644 index 0000000..2be0b9c --- /dev/null +++ b/examples/sandboxy/Makefile @@ -0,0 +1,38 @@ +# Copyright © 2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +BUILD_CONFIGURATION ?= debug +SWIFT = /usr/bin/swift +SWIFT_STRIP := $(if $(filter release,$(BUILD_CONFIGURATION)),-Xlinker -s) +BUILD_BIN_DIR = $(shell $(SWIFT) build -c $(BUILD_CONFIGURATION) --show-bin-path) + +.PHONY: all build clean run fmt + +all: build + +build: + $(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_STRIP) + @mkdir -p bin + @install "$(BUILD_BIN_DIR)/sandboxy" ./bin/ + codesign --force --sign - --entitlements sandboxy.entitlements ./bin/sandboxy + +clean: + $(SWIFT) package clean + rm -rf bin + +run: build + ./bin/sandboxy + +fmt: + $(SWIFT) format --in-place --recursive Sources/ diff --git a/examples/sandboxy/Package.resolved b/examples/sandboxy/Package.resolved new file mode 100644 index 0000000..dad2139 --- /dev/null +++ b/examples/sandboxy/Package.resolved @@ -0,0 +1,249 @@ +{ + "originHash" : "7b278fed488f6dec94de45fcf45179f7556a1b32ebb5b19499b932a307ddcad0", + "pins" : [ + { + "identity" : "async-http-client", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/async-http-client.git", + "state" : { + "revision" : "2fc4652fb4689eb24af10e55cabaa61d8ba774fd", + "version" : "1.32.0" + } + }, + { + "identity" : "containerization", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/containerization.git", + "state" : { + "revision" : "72432f148c9cb35d6a7e7c0ad61d6f9d226cbef7", + "version" : "0.30.0" + } + }, + { + "identity" : "grpc-swift", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift.git", + "state" : { + "revision" : "ac715c584bb1e2e5cdfb7684ccb46fab8dafc641", + "version" : "1.27.4" + } + }, + { + "identity" : "swift-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-algorithms.git", + "state" : { + "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023", + "version" : "1.2.1" + } + }, + { + "identity" : "swift-argument-parser", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-argument-parser.git", + "state" : { + "revision" : "c5d11a805e765f52ba34ec7284bd4fcd6ba68615", + "version" : "1.7.0" + } + }, + { + "identity" : "swift-asn1", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-asn1.git", + "state" : { + "revision" : "810496cf121e525d660cd0ea89a758740476b85f", + "version" : "1.5.1" + } + }, + { + "identity" : "swift-async-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-async-algorithms.git", + "state" : { + "revision" : "9d349bcc328ac3c31ce40e746b5882742a0d1272", + "version" : "1.1.3" + } + }, + { + "identity" : "swift-atomics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-atomics.git", + "state" : { + "revision" : "b601256eab081c0f92f059e12818ac1d4f178ff7", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-certificates", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-certificates.git", + "state" : { + "revision" : "24ccdeeeed4dfaae7955fcac9dbf5489ed4f1a25", + "version" : "1.18.0" + } + }, + { + "identity" : "swift-collections", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-collections.git", + "state" : { + "revision" : "8d9834a6189db730f6264db7556a7ffb751e99ee", + "version" : "1.4.0" + } + }, + { + "identity" : "swift-configuration", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-configuration.git", + "state" : { + "revision" : "be76c4ad929eb6c4bcaf3351799f2adf9e6848a9", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-crypto", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-crypto.git", + "state" : { + "revision" : "95ba0316a9b733e92bb6b071255ff46263bbe7dc", + "version" : "3.15.1" + } + }, + { + "identity" : "swift-distributed-tracing", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-distributed-tracing.git", + "state" : { + "revision" : "e109d8b5308d0e05201d9a1dd1c475446a946a11", + "version" : "1.4.0" + } + }, + { + "identity" : "swift-http-structured-headers", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-structured-headers.git", + "state" : { + "revision" : "76d7627bd88b47bf5a0f8497dd244885960dde0b", + "version" : "1.6.0" + } + }, + { + "identity" : "swift-http-types", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-types.git", + "state" : { + "revision" : "45eb0224913ea070ec4fba17291b9e7ecf4749ca", + "version" : "1.5.1" + } + }, + { + "identity" : "swift-log", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-log.git", + "state" : { + "revision" : "bbd81b6725ae874c69e9b8c8804d462356b55523", + "version" : "1.10.1" + } + }, + { + "identity" : "swift-nio", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio.git", + "state" : { + "revision" : "e932d3c4d8f77433c8f7093b5ebcbf91463948a0", + "version" : "2.95.0" + } + }, + { + "identity" : "swift-nio-extras", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-extras.git", + "state" : { + "revision" : "3df009d563dc9f21a5c85b33d8c2e34d2e4f8c3b", + "version" : "1.32.1" + } + }, + { + "identity" : "swift-nio-http2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-http2.git", + "state" : { + "revision" : "b6571f3db40799df5a7fc0e92c399aa71c883edd", + "version" : "1.40.0" + } + }, + { + "identity" : "swift-nio-ssl", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-ssl.git", + "state" : { + "revision" : "173cc69a058623525a58ae6710e2f5727c663793", + "version" : "2.36.0" + } + }, + { + "identity" : "swift-nio-transport-services", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-transport-services.git", + "state" : { + "revision" : "60c3e187154421171721c1a38e800b390680fb5d", + "version" : "1.26.0" + } + }, + { + "identity" : "swift-numerics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-numerics.git", + "state" : { + "revision" : "0c0290ff6b24942dadb83a929ffaaa1481df04a2", + "version" : "1.1.1" + } + }, + { + "identity" : "swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-protobuf.git", + "state" : { + "revision" : "a008af1a102ff3dd6cc3764bb69bf63226d0f5f6", + "version" : "1.36.1" + } + }, + { + "identity" : "swift-service-context", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-service-context.git", + "state" : { + "revision" : "d0997351b0c7779017f88e7a93bc30a1878d7f29", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-service-lifecycle", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/swift-service-lifecycle.git", + "state" : { + "revision" : "89888196dd79c61c50bca9a103d8114f32e1e598", + "version" : "2.10.1" + } + }, + { + "identity" : "swift-system", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-system.git", + "state" : { + "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df", + "version" : "1.6.4" + } + }, + { + "identity" : "zstd", + "kind" : "remoteSourceControl", + "location" : "https://github.com/facebook/zstd.git", + "state" : { + "revision" : "f8745da6ff1ad1e7bab384bd1f9d742439278e99", + "version" : "1.5.7" + } + } + ], + "version" : 3 +} diff --git a/examples/sandboxy/Package.swift b/examples/sandboxy/Package.swift new file mode 100644 index 0000000..15b0c52 --- /dev/null +++ b/examples/sandboxy/Package.swift @@ -0,0 +1,57 @@ +// swift-tools-version: 6.2 +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import PackageDescription + +let containerizationVersion = "0.26.5" + +let package = Package( + name: "sandboxy", + platforms: [ + .macOS("26.0") + ], + products: [ + .executable( + name: "sandboxy", + targets: ["sandboxy"] + ) + ], + dependencies: [ + .package(url: "https://github.com/apple/containerization.git", from: "0.30.0"), + .package(url: "https://github.com/apple/swift-argument-parser.git", from: "1.3.0"), + .package(url: "https://github.com/apple/swift-log.git", from: "1.0.0"), + .package(url: "https://github.com/apple/swift-nio.git", from: "2.65.0"), + .package(url: "https://github.com/swift-server/async-http-client.git", from: "1.20.1"), + ], + targets: [ + .executableTarget( + name: "sandboxy", + dependencies: [ + .product(name: "Containerization", package: "containerization"), + .product(name: "ContainerizationExtras", package: "containerization"), + .product(name: "ContainerizationOS", package: "containerization"), + .product(name: "ContainerizationArchive", package: "containerization"), + .product(name: "AsyncHTTPClient", package: "async-http-client"), + .product(name: "NIOCore", package: "swift-nio"), + .product(name: "NIOPosix", package: "swift-nio"), + .product(name: "NIOHTTP1", package: "swift-nio"), + .product(name: "ArgumentParser", package: "swift-argument-parser"), + .product(name: "Logging", package: "swift-log"), + ], + ) + ] +) diff --git a/examples/sandboxy/README.md b/examples/sandboxy/README.md new file mode 100644 index 0000000..3246c2e --- /dev/null +++ b/examples/sandboxy/README.md @@ -0,0 +1,374 @@ +# sandboxy + +``` +$ sandboxy run claude + ┌──────────────┐ + │ ░░░░░░░░░░░░ │ Sandboxy + │ ░░░░░░░░░░░░ │ Agent: Claude Code + │ ░░░░░░░░░░░░ │ Instance: claude-20260328-150531 + │ ░░░░░░░░░░░░ │ Environment: 15 hours ago + │ ░░░░░░░░░░░░ │ Workspace: /Volumes/code/vessel/containerization + │ ░░░░░░░░░░░░ │ CPUs: 4 Memory: 4 GB + └──────────────┘ + Command: claude --dangerously-skip-permissions + Allowed hosts: *.anthropic.com, npm.org, *.npmjs.org, *.github.com, *.githubusercontent.com, *.pypi.org + Mounts: + /your/code -> /your/code + /Users/you/.claude -> /root/.claude + +Welcome to Claude Code v2.1.76 +………………………………………………………………………………………………………………………………………………………… + + * █████▓▓░ + * ███▓░ ░░ + ░░░░░░ ███▓░ + ░░░ ░░░░░░░░░░ ███▓░ + ░░░░░░░░░░░░░░░░░░░ * ██▓░░ ▓ + ░▓▓███▓▓░ + * ░░░░ + ░░░░░░░░ + ░░░░░░░░░░░░░░░░ + █████████ * + ██▄█████▄██ * + █████████ * +…………………█ █ █ █……………………………………………………………………………………………………………… + + Let's get started. +``` + +`sandboxy` runs AI coding agents in sandboxed Linux environments on macOS with Apple silicon. + +One command to get an isolated agent session. Your current working directory is mounted in, your config carries over, and the environment is cached for fast subsequent runs. + +> **Note:** This is an experimental tool. Behavior/flags/commands may change across releases. Its main goal was to be a good showcase of using the `Containerization` libraries API surface to build novel tools. + +> **Note:** The tool does HTTPS/HTTP filtering today for network traffic originating from the container, but can currently reach services listening on `0.0.0.0` on the host. This should be tightened up in a future release whenever `Containerization` gains nftables support. + +## Why? + +AI coding agents work best when they can install packages, run builds, and execute code freely, but giving them unrestricted access to your host machine is risky. `sandboxy` aims to alleviate some worry by running agents inside lightweight Linux VMs on macOS. Your project directory is mounted in so the agent can read and write files, but everything else like network access, host filesystem view, and installed packages is isolated. No daemon, just a single command that gets out of your way. + +## How? + +`sandboxy` boots a Micro VM for every agent session using the [`Containerization`](https://github.com/apple/containerization) Swift package. Each agent session runs in its own VM. + +### Caching + +The first time you run an agent, `sandboxy` does a fair amount of setup: downloading a Linux kernel (unless you provide one), pulling the base OCI image, unpacking it into a root filesystem, and running the agent's install commands. All of this is cached so that subsequent runs skip straight to booting the VM. In practice, a warm start takes under a second. + +The cache has a few layers: + +- **Kernel** -- downloaded once and reused across all agents. +- **Init image** -- the minimal init process (`vminit`) that bootstraps the VM, pulled from an OCI registry and cached locally. +- **Agent rootfs** -- the fully-installed root filesystem for a given agent (e.g., `claude`). This is an ext4 disk image that includes the base image layers plus everything the agent's install commands produce. +- **Instance rootfs** -- every session saves its rootfs so it can be resumed later with `--name`. See [Instance Persistence](#instance-persistence). + +On each run, the cached rootfs is cloned (via copy-on-write when the filesystem supports it) so the original cache stays clean. You can blow away any layer independently: `sandboxy cache rm ` to rebuild a single agent, or `sandboxy cache clean --all` to start completely from scratch. + +### Agent definitions + +An agent is just a JSON file that describes how to set up and launch a particular tool. The built-in Claude Code definition specifies a base container image, a list of shell commands to install the toolchain, a launch command, and the environment variables needed at runtime. You can list available agents with `sandboxy config list --agents` and view any agent's definition with `sandboxy config list --agent `. + +You can override any built-in agent or define entirely new agents by dropping a JSON file in `~/.config/sandboxy/agents/`. Use `sandboxy config create --agent ` to scaffold a definition file (pre-filled with built-in defaults for known agents). Use `sandboxy config list --paths` to see all configuration file paths. + +If the built-in install steps don't cover what you need, `sandboxy edit ` drops you into an interactive shell inside the cached rootfs. Install extra packages, configure MCP servers, add language runtimes etc. Whatever you do is saved back to the cache and included in every future run. + +### Workspace and mounts + +Your host workspace directory is shared into the VM using virtio-fs, so reads and writes are reflected immediately on both sides. Additional host directories can be mounted with `--mount`, including read-only mounts for things like config or reference data that the agent shouldn't modify. + +Agent definitions can include default mounts (e.g., `~/.claude` for Claude Code). To skip these on a specific run, pass `--no-agent-mounts`. CLI `--mount` flags are always applied regardless. + +### Network isolation + +By default, `sandboxy` enforces network isolation by placing the workload container on a host-only network with no internet route. A HTTP CONNECT proxy runs on the host and listens on the host-only network's gateway address. The workload's `HTTP_PROXY`/`HTTPS_PROXY` environment variables point at this proxy, which checks each request's target hostname against an allowlist and either tunnels it to the internet or returns a 403. + +Additional hosts can be added at runtime with `--allow-hosts`. To disable filtering entirely, pass `--no-network-filter`. + +## Quick Start + +```bash +# Build +BUILD_CONFIGURATION=release make build + +# Run Claude Code on the current directory +.build/release/sandboxy run claude +``` + +On first run, `sandboxy` downloads a kernel, pulls a base image, and installs the agent toolchain. This is cached automatically so subsequent runs generally start in less than a second. + +## Supported Agents + +- **Claude Code** - built-in + +Additional agents can be added via JSON config files. See [Adding a New Agent](#adding-a-new-agent). + +## Commands + +### `sandboxy run ` + +Run an agent in a sandboxed container. + +```bash +# Run on the current directory +sandboxy run claude + +# Specify a workspace +sandboxy run --workspace ~/projects/myapp claude + +# Allocate more resources +sandboxy run --cpus 8 --memory 8g claude + +# Restrict network to specific hosts (in addition to agent defaults) +sandboxy run --allow-hosts api.example.com --allow-hosts internal.corp.com claude + +# Disable network filtering entirely +sandboxy run --no-network-filter claude + +# Mount additional directories (read-only or read-write) +sandboxy run --mount /tmp:/tmp:ro --mount ~/data:/data claude + +# Skip mounts defined in the agent configuration +sandboxy run --no-agent-mounts claude + +# Forward environment variables into the container +sandboxy run -e MY_TOKEN -e DEBUG=1 claude + +# Forward the host SSH agent for git-over-SSH +sandboxy run --ssh-agent claude + +# Give the instance a friendly name +sandboxy run --name my-feature claude + +# Resume a named session +sandboxy run --name my-feature claude + +# Ephemeral run (remove instance after session ends) +sandboxy run --rm claude + +# Pass flags through to the agent +sandboxy run claude -- --model foobar +``` + +**Options:** + +| Flag | Description | Default | +|------|-------------|---------| +| `-w`, `--workspace` | Host directory to mount | Current directory | +| `-m`, `--mount` | Additional mount (hostpath:containerpath[:ro\|rw], repeatable) | None | +| `-e`, `--env` | Set environment variable (KEY=VALUE or KEY to forward from host, repeatable) | None | +| `-k`, `--kernel` | Path to a Linux kernel | Auto-download | +| `--cpus` | Number of CPUs | 4 | +| `--memory` | Memory to allocate (e.g. `4g`, `512m`, `4096` for MB) | `4g` | +| `--allow-hosts` | Additional hostnames to allow (merged with agent defaults) | Agent defaults | +| `--no-network-filter` | Disable network filtering (allow unrestricted access) | Off | +| `--no-agent-mounts` | Skip mounts defined in the agent configuration | Off | +| `--name` | Persistent session name | Auto-generated | +| `--rm` | Remove instance after session ends | Off | +| `--reinstall` | Rebuild the cached environment from scratch | Off | +| `--ssh-agent` | Forward the host SSH agent socket into the container | Off | + +### `sandboxy edit ` + +Open an interactive shell in the agent's cached environment. Install packages, configure MCP tools, add language runtimes etc. +Changes are saved back to the cache when you exit. + +If no cache exists yet, the agent's install commands are run first. If any install step fails, you're dropped into the shell anyway so you can diagnose or finish the setup manually. + +```bash +sandboxy edit claude + +# Inside the container: +apt-get install -y python3-pip +pip3 install some-mcp-tool +exit # changes are saved +``` + +Every future `sandboxy run claude` will include your changes. + +### `sandboxy list` (alias: `ls`) + +Show sandbox instances and their status. + +```bash +sandboxy ls +``` + +### `sandboxy rm [...]` + +Remove one or more instances and their preserved state. + +```bash +# Remove a single instance +sandboxy rm my-feature + +# Remove multiple instances +sandboxy rm instance-1 instance-2 + +# Remove all instances +sandboxy rm --all +sandboxy rm -a +``` + +### `sandboxy cache list` + +Show cached environments and their disk usage. + +### `sandboxy cache rm ` + +Remove a specific agent's cached environment. The next run will rebuild it. + +### `sandboxy cache clean [--all] [--yes]` + +Remove all cached environments and named instance state. If named instances exist, you'll be prompted for confirmation. With `--yes`, skip the prompt. With `--all`, also removes the kernel, init image, and content store, forcing a full re-download on the next run. + +### `sandboxy config list` + +Print current configuration or agent definitions. + +```bash +# Print global defaults +sandboxy config list + +# Print a specific agent's definition +sandboxy config list --agent claude + +# List all available agents (built-in and custom) +sandboxy config list --agents + +# Print configuration file paths +sandboxy config list --paths +``` + +### `sandboxy config create` + +Create a default configuration or agent definition file. If the file already exists, you'll be prompted to confirm overwriting (use `--force` to skip). + +For built-in agents (e.g. `claude`), the file is pre-filled with the built-in definition so you have a working starting point to customize. + +```bash +# Create a global config.json with defaults +sandboxy config create + +# Create an override for the built-in claude agent +sandboxy config create --agent claude + +# Scaffold a new agent definition +sandboxy config create --agent myagent + +# Overwrite an existing definition without prompting +sandboxy config create --agent claude --force +``` + +## Instance Persistence + +Every session automatically saves its rootfs when it exits. The instance appears in `sandboxy ls` and can be resumed by passing its name to `--name`: + +```bash +# First run -- auto-named instance +sandboxy run claude +# => Instance claude-20260328-091522 saved. Resume with: sandboxy run claude --name claude-20260328-091522 + +# Resume it +sandboxy run --name claude-20260328-091522 claude + +# Or give it a memorable name upfront +sandboxy run --name my-feature claude + +# List all instances +sandboxy ls + +# Clean up +sandboxy rm my-feature + +# Ephemeral run (nothing saved) +sandboxy run --rm claude +``` + +Use `--rm` for throwaway sessions that shouldn't persist. + +## API Keys + +Agent definitions can include environment variable names without values (e.g. `"ANTHROPIC_API_KEY"`), which are automatically forwarded from the host if set. The built-in Claude Code agent forwards `ANTHROPIC_API_KEY` this way. For custom agents, add the relevant key name to the `environmentVariables` array, or pass it at runtime with `-e`. + +## Network Filtering + +Network filtering is enabled by default. Each agent definition includes an `allowedHosts` list. Additional hosts can be added at runtime with `--allow-hosts`. An empty `allowedHosts` list means all traffic is denied. To disable filtering entirely, pass `--no-network-filter`. + +The workload container runs on a **host-only network** with no internet route. A lightweight HTTP CONNECT proxy runs on the macOS host, bound to the host-only network's gateway address. The workload's proxy environment variables point at this address, so tools that respect `HTTP_PROXY`/`HTTPS_PROXY` route their traffic through the proxy automatically. + +Note that the proxy relies on applications honoring `HTTP_PROXY`/`HTTPS_PROXY` environment variables. Tools that ignore these variables won't be able to reach the internet since the container has no direct internet route. + +Agent toolchain installation (apt-get, npm install, etc.) runs with full network access on a shared network before the proxy is set up, so package repos don't need to be allowlisted. + +## Adding a New Agent + +Create a JSON file in the `agents/` directory, or use `sandboxy config create --agent ` to scaffold one: + +`~/.config/sandboxy/agents/.json` + +Example (`foo.json`): + +```json +{ + "displayName": "Foo", + "baseImage": "docker.io/library/python:3.12-slim", + "installCommands": [ + "pip install foo" + ], + "launchCommand": ["foo"], + "environmentVariables": [], + "mounts": [], + "allowedHosts": ["api.example.com", "*.cdn.example.com"] +} +``` + +Then run it with `sandboxy run foo`. + +To override a built-in agent, create a file with the same name (e.g., `claude.json`). Only the fields you include are overridden. Omitted fields keep their defaults. Use `sandboxy config list --agent claude` to see the full default definition. + +## Configuration + +Global defaults can be overridden with a config file: + +`~/.config/sandboxy/config.json` + +```json +{ + "dataDir": "/Volumes/fast/sandboxy", + "kernel": "/path/to/vmlinux", + "initfsReference": "ghcr.io/apple/containerization/vminit:0.26.5", + "defaultCPUs": 8, + "defaultMemory": "8g" +} +``` + +All fields are optional. Use `sandboxy config list` to see the defaults. + +## Kernel + +By default, `sandboxy` downloads a Linux kernel from the [Kata Containers](https://github.com/kata-containers/kata-containers) project (arm64 static release). The kernel is cached at `~/Library/Application Support/com.apple.containerization.sandboxy/kernel/vmlinux` and reused across all agent sessions. + +To use your own kernel, pass it directly: + +```bash +sandboxy run -k /path/to/vmlinux claude +``` + +Or set it permanently in `config.json`: + +```json +{ + "kernel": "/path/to/vmlinux" +} +``` + +The kernel must be an uncompressed Linux kernel binary (`vmlinux`, not `bzImage` or `zImage`) built for arm64 with virtio drivers enabled (virtio-net, virtio-blk, virtio-fs, virtio-console at minimum). + +## Building + +```bash +make build +``` + +The built binary is at `.build/release/sandboxy`. It requires macOS 26 on Apple silicon. diff --git a/examples/sandboxy/Sources/sandboxy/AgentDefinition.swift b/examples/sandboxy/Sources/sandboxy/AgentDefinition.swift new file mode 100644 index 0000000..38b8f4c --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/AgentDefinition.swift @@ -0,0 +1,243 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Defines an AI coding agent that can be run inside a sandbox container. +/// +/// Agent definitions can be built-in or loaded from JSON files in the +/// `agents/` subdirectory of the sandboxy config directory. +/// +/// Location: `~/.config/sandboxy/agents/.json` +/// +/// Example (`foo.json`): +/// ```json +/// { +/// "displayName": "Foo", +/// "baseImage": "docker.io/library/python:3.12-slim", +/// "installCommands": [ +/// "pip install foo" +/// ], +/// "launchCommand": ["foo"], +/// "environmentVariables": [], +/// "mounts": [ +/// {"hostPath": "~/.foo", "containerPath": "/root/.foo", "readOnly": true} +/// ], +/// "allowedHosts": ["api.example.com", "*.cdn.example.com"] +/// } +/// ``` +struct AgentDefinition: Codable, Sendable { + /// Human-readable name used in output messages. + let displayName: String + + /// The base container image reference (e.g., "docker.io/library/node:22"). + let baseImage: String + + /// Shell commands run sequentially inside the container to install the agent + /// and its dependencies. Each string is passed as an argument to `sh -c`. + let installCommands: [String] + + /// The command and arguments to launch the agent interactively. + let launchCommand: [String] + + /// Environment variables required by the agent (key=value format). + let environmentVariables: [String] + + /// Host paths to mount into the container. Each entry specifies a host path + /// and a container path. Paths starting with `~` are expanded to the user's + /// home directory. Only mounted if the host path exists. + let mounts: [AgentMount] + + /// Default hostnames to allow through the network filtering proxy. + /// Supports exact matches and `*.suffix` wildcard patterns. + /// Merged with CLI `--allow-hosts` values. + /// An empty list means all traffic is denied. Use `--no-network-filter` to disable filtering. + let allowedHosts: [String] +} + +/// A host-to-container mount for an agent definition. +struct AgentMount: Codable, Sendable { + /// Path on the host. Supports `~` for the user's home directory. + let hostPath: String + + /// Path inside the container where the host path is mounted. + let containerPath: String + + /// Whether the mount is read-only. Defaults to `false`. + let readOnly: Bool + + init(hostPath: String, containerPath: String, readOnly: Bool = false) { + self.hostPath = hostPath + self.containerPath = containerPath + self.readOnly = readOnly + } + + init(from decoder: Decoder) throws { + let container = try decoder.container(keyedBy: CodingKeys.self) + hostPath = try container.decode(String.self, forKey: .hostPath) + containerPath = try container.decode(String.self, forKey: .containerPath) + readOnly = try container.decodeIfPresent(Bool.self, forKey: .readOnly) ?? false + } + + /// Returns the resolved absolute host path, expanding `~`. + var resolvedHostPath: String { + if hostPath.hasPrefix("~/") { + let home = FileManager.default.homeDirectoryForCurrentUser.path(percentEncoded: false) + return home + String(hostPath.dropFirst(1)) + } + if hostPath == "~" { + return FileManager.default.homeDirectoryForCurrentUser.path(percentEncoded: false) + } + return hostPath + } +} + +extension AgentDefinition { + /// Built-in agent definitions, keyed by their CLI name. + static let builtIn: [String: AgentDefinition] = [ + "claude": .claude + ] + + /// Returns all available agents: built-in definitions merged with any + /// user-defined agents from `/agents/`. If a user file matches + /// a built-in agent name, non-nil fields from the user file override the + /// built-in values, allowing partial overrides. + static func allAgents(configRoot: URL) -> [String: AgentDefinition] { + var agents = builtIn + + let agentsDir = configRoot.appendingPathComponent("agents") + let agentsDirPath = agentsDir.path(percentEncoded: false) + guard FileManager.default.fileExists(atPath: agentsDirPath) else { + return agents + } + + do { + let files = try FileManager.default.contentsOfDirectory( + at: agentsDir, + includingPropertiesForKeys: nil + ).filter { $0.pathExtension == "json" } + + let decoder = JSONDecoder() + for file in files { + let name = file.deletingPathExtension().lastPathComponent + do { + let data = try Data(contentsOf: file) + let override = try decoder.decode(AgentOverride.self, from: data) + if let base = agents[name] { + agents[name] = override.merged(onto: base) + } else { + agents[name] = try override.asFullDefinition() + } + } catch { + ProgressUI.printWarning( + "Failed to load agent definition from \(file.lastPathComponent): \(error)") + } + } + } catch { + ProgressUI.printWarning("Failed to read agents directory: \(error)") + } + + return agents + } + + /// Returns the sorted list of available agent names for display in help text. + static func knownAgentNames(configRoot: URL) -> [String] { + allAgents(configRoot: configRoot).keys.sorted() + } + + static let claude = AgentDefinition( + displayName: "Claude Code", + baseImage: "docker.io/library/node:22", + installCommands: [ + "apt-get update && apt-get install -y --no-install-recommends less git procps sudo fzf zsh man-db unzip gnupg2 gh ipset iproute2 dnsutils aggregate jq nano vim ripgrep ca-certificates && apt-get clean && rm -rf /var/lib/apt/lists/*", + "npm install -g @anthropic-ai/claude-code", + "npm install -g global-agent", + ], + launchCommand: ["claude", "--dangerously-skip-permissions"], + environmentVariables: [ + "ANTHROPIC_API_KEY", + "NODE_OPTIONS=--max-old-space-size=4096", + "IS_SANDBOX=1", + ], + mounts: [ + AgentMount(hostPath: "~/.claude", containerPath: "/root/.claude") + ], + allowedHosts: [ + "*.anthropic.com", + "*.claude.com", + "npm.org", + "*.npmjs.org", + "*.github.com", + "*.githubusercontent.com", + "*.pypi.org", + "*.pythonhosted.org", + ] + ) +} + +/// All-optional mirror of `AgentDefinition` used when loading user override files. +/// For agents that match a built-in name, only the non-nil fields override the defaults. +/// For entirely new agents, all required fields must be provided. +struct AgentOverride: Codable, Sendable { + var displayName: String? + var baseImage: String? + var installCommands: [String]? + var launchCommand: [String]? + var environmentVariables: [String]? + var mounts: [AgentMount]? + var allowedHosts: [String]? + + /// Merges this override onto a base definition, replacing only the fields + /// that are non-nil in the override. + func merged(onto base: AgentDefinition) -> AgentDefinition { + AgentDefinition( + displayName: displayName ?? base.displayName, + baseImage: baseImage ?? base.baseImage, + installCommands: installCommands ?? base.installCommands, + launchCommand: launchCommand ?? base.launchCommand, + environmentVariables: environmentVariables ?? base.environmentVariables, + mounts: mounts ?? base.mounts, + allowedHosts: allowedHosts ?? base.allowedHosts + ) + } + + /// Converts this override into a full definition, throwing if any required + /// fields are missing. Used for entirely new (non-built-in) agents. + func asFullDefinition() throws -> AgentDefinition { + guard let displayName, let baseImage, let installCommands, + let launchCommand + else { + throw SandboxyError.incompleteAgentDefinition( + missing: [ + displayName == nil ? "displayName" : nil, + baseImage == nil ? "baseImage" : nil, + installCommands == nil ? "installCommands" : nil, + launchCommand == nil ? "launchCommand" : nil, + ].compactMap { $0 } + ) + } + + return AgentDefinition( + displayName: displayName, + baseImage: baseImage, + installCommands: installCommands, + launchCommand: launchCommand, + environmentVariables: environmentVariables ?? [], + mounts: mounts ?? [], + allowedHosts: allowedHosts ?? [] + ) + } +} diff --git a/examples/sandboxy/Sources/sandboxy/CacheCommand.swift b/examples/sandboxy/Sources/sandboxy/CacheCommand.swift new file mode 100644 index 0000000..a9b94b2 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/CacheCommand.swift @@ -0,0 +1,263 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Foundation + +extension Sandboxy { + struct Cache: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "cache", + abstract: "Manage cached rootfs images", + subcommands: [ + CacheList.self, + CacheRemove.self, + CacheClean.self, + ] + ) + } + + struct CacheList: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "list", + abstract: "List cached rootfs images and named instance state" + ) + + func run() async throws { + _ = try Sandboxy.loadConfig() + + let cacheDir = Sandboxy.appRoot.appendingPathComponent("cache") + let namedDir = InstanceState.namedRootfsDir(appRoot: Sandboxy.appRoot) + + let agentCaches = listRootfsFiles(in: cacheDir, suffix: "-rootfs.ext4") + let namedCaches = listRootfsFiles(in: namedDir, suffix: "-rootfs.ext4") + + if agentCaches.isEmpty && namedCaches.isEmpty { + print("No cached images found.") + return + } + + if !agentCaches.isEmpty { + print("Agent caches:") + print(pad(" NAME", to: 20) + pad("SIZE", to: 12) + "MODIFIED") + for entry in agentCaches { + print( + pad(" \(entry.name)", to: 20) + + pad(formatBytes(entry.diskSize), to: 12) + + entry.modified + ) + } + } + + if !namedCaches.isEmpty { + if !agentCaches.isEmpty { print() } + print("Named instances:") + print(pad(" NAME", to: 20) + pad("SIZE", to: 12) + "MODIFIED") + for entry in namedCaches { + print( + pad(" \(entry.name)", to: 20) + + pad(formatBytes(entry.diskSize), to: 12) + + entry.modified + ) + } + } + } + + private struct CacheEntry { + let name: String + let diskSize: UInt64 + let modified: String + } + + private func listRootfsFiles(in dir: URL, suffix: String) -> [CacheEntry] { + let dirPath = dir.path(percentEncoded: false) + guard FileManager.default.fileExists(atPath: dirPath) else { + return [] + } + + do { + let files = try FileManager.default.contentsOfDirectory( + at: dir, + includingPropertiesForKeys: [ + .totalFileAllocatedSizeKey, + .contentModificationDateKey, + ] + ).filter { $0.lastPathComponent.hasSuffix(suffix) } + + return files.compactMap { file -> CacheEntry? in + let cleanName = file.lastPathComponent + .replacingOccurrences(of: suffix, with: "") + + do { + let values = try file.resourceValues(forKeys: [ + .totalFileAllocatedSizeKey, + .contentModificationDateKey, + ]) + let diskSize = UInt64(values.totalFileAllocatedSize ?? 0) + let date = values.contentModificationDate ?? Date() + let formatter = DateFormatter() + formatter.dateStyle = .short + formatter.timeStyle = .short + return CacheEntry( + name: cleanName, + diskSize: diskSize, + modified: formatter.string(from: date) + ) + } catch { + return nil + } + }.sorted { $0.name < $1.name } + } catch { + return [] + } + } + + private func pad(_ s: String, to width: Int) -> String { + if s.count >= width { return s } + return s + String(repeating: " ", count: width - s.count) + } + + private func formatBytes(_ bytes: UInt64) -> String { + if bytes < 1024 { return "\(bytes) B" } + let kb = Double(bytes) / 1024 + if kb < 1024 { return String(format: "%.1f KB", kb) } + let mb = kb / 1024 + if mb < 1024 { return String(format: "%.1f MB", mb) } + let gb = mb / 1024 + return String(format: "%.1f GB", gb) + } + } + + struct CacheRemove: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "rm", + abstract: "Remove a specific agent cache" + ) + + @Argument(help: "Name of the agent cache to remove") + var name: String + + func run() async throws { + _ = try Sandboxy.loadConfig() + + let cacheDir = Sandboxy.appRoot.appendingPathComponent("cache") + let cachePath = cacheDir.appendingPathComponent("\(name)-rootfs.ext4") + + guard FileManager.default.fileExists(atPath: cachePath.path(percentEncoded: false)) else { + print("No cache found for agent '\(name)'.") + throw ExitCode.failure + } + + try FileManager.default.removeItem(at: cachePath) + print("Removed cache for '\(name)'.") + } + } + + struct CacheClean: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "clean", + abstract: "Remove all cached rootfs images (use --all to also remove kernel, init image, and content store)" + ) + + @Flag(name: .long, help: "Also remove kernel, init image, and content store, forcing a full re-download on next run") + var all = false + + @Flag(name: .long, help: "Skip confirmation prompts") + var yes = false + + func run() async throws { + _ = try Sandboxy.loadConfig() + + let fm = FileManager.default + + // Check for named instances and warn the user before deleting them. + let namedDir = InstanceState.namedRootfsDir(appRoot: Sandboxy.appRoot) + let namedInstances = listNamedInstances(in: namedDir) + if !namedInstances.isEmpty && !yes { + print("This will also delete the following named instances:") + for name in namedInstances { + print(" - \(name)") + } + print() + print("Are you sure? [y/N] ", terminator: "") + guard let response = readLine()?.lowercased(), response == "y" || response == "yes" else { + print("Aborted.") + return + } + } + + let cacheDir = Sandboxy.appRoot.appendingPathComponent("cache") + if fm.fileExists(atPath: cacheDir.path(percentEncoded: false)) { + try fm.removeItem(at: cacheDir) + try fm.createDirectory(at: cacheDir, withIntermediateDirectories: true) + } + + if fm.fileExists(atPath: namedDir.path(percentEncoded: false)) { + try fm.removeItem(at: namedDir) + try fm.createDirectory(at: namedDir, withIntermediateDirectories: true) + } + + if all { + let kernelDir = Sandboxy.appRoot.appendingPathComponent("kernel") + if fm.fileExists(atPath: kernelDir.path(percentEncoded: false)) { + try fm.removeItem(at: kernelDir) + print("Removed kernel.") + } + + let initfs = Sandboxy.appRoot.appendingPathComponent("initfs.ext4") + if fm.fileExists(atPath: initfs.path(percentEncoded: false)) { + try fm.removeItem(at: initfs) + print("Removed init image.") + } + + let contentDir = Sandboxy.appRoot.appendingPathComponent("content") + if fm.fileExists(atPath: contentDir.path(percentEncoded: false)) { + try fm.removeItem(at: contentDir) + print("Removed content store.") + } + + // Remove the image store reference database so stale references + // don't point to missing content. + let stateFile = Sandboxy.appRoot.appendingPathComponent("state.json") + if fm.fileExists(atPath: stateFile.path(percentEncoded: false)) { + try fm.removeItem(at: stateFile) + } + + print("All caches and downloaded artifacts removed.") + } else { + print("All caches removed. Use --all to also remove kernel, init image, and content store.") + } + } + + private func listNamedInstances(in dir: URL) -> [String] { + let path = dir.path(percentEncoded: false) + guard FileManager.default.fileExists(atPath: path) else { + return [] + } + do { + return try FileManager.default.contentsOfDirectory( + at: dir, + includingPropertiesForKeys: nil + ) + .filter { $0.lastPathComponent.hasSuffix("-rootfs.ext4") } + .map { $0.lastPathComponent.replacingOccurrences(of: "-rootfs.ext4", with: "") } + .sorted() + } catch { + return [] + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/ConfigCommand.swift b/examples/sandboxy/Sources/sandboxy/ConfigCommand.swift new file mode 100644 index 0000000..68e81c5 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/ConfigCommand.swift @@ -0,0 +1,170 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Foundation + +extension Sandboxy { + struct Config: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "config", + abstract: "View and create configuration files", + subcommands: [ + ConfigList.self, + ConfigCreate.self, + ] + ) + } + + struct ConfigList: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "list", + abstract: "Print current configuration and agent definitions" + ) + + @Option(name: .long, help: "Print the definition for a specific agent") + var agent: String? + + @Flag(name: .long, help: "Print built-in defaults instead of the resolved configuration") + var defaults = false + + @Flag(name: .long, help: "Print configuration file paths") + var paths = false + + @Flag(name: .long, help: "List available agents") + var agents = false + + func run() async throws { + if paths { + let configPath = Sandboxy.configRoot.appendingPathComponent("config.json") + let agentsDir = Sandboxy.configRoot.appendingPathComponent("agents") + print("Config: \(configPath.path(percentEncoded: false))") + print("Agents: \(agentsDir.path(percentEncoded: false))") + print("Data: \(Sandboxy.appRoot.path(percentEncoded: false))") + return + } + + if agents { + let allAgents = AgentDefinition.allAgents(configRoot: Sandboxy.configRoot) + let builtInNames = Set(AgentDefinition.builtIn.keys) + for name in allAgents.keys.sorted() { + let definition = allAgents[name]! + let source = builtInNames.contains(name) ? "built-in" : "custom" + print(" \(name) - \(definition.displayName) (\(source))") + } + return + } + + let encoder = JSONEncoder() + encoder.outputFormatting = [.prettyPrinted, .sortedKeys] + + if let agentName = agent { + let allAgents = AgentDefinition.allAgents(configRoot: Sandboxy.configRoot) + guard let definition = allAgents[agentName] else { + let available = allAgents.keys.sorted().joined(separator: ", ") + throw ValidationError( + "Unknown agent '\(agentName)'. Available agents: \(available)" + ) + } + let data = try encoder.encode(definition) + print(String(data: data, encoding: .utf8)!) + } else { + let config = defaults ? SandboxyConfig.defaults : try Sandboxy.loadConfig() + let data = try encoder.encode(config) + print(String(data: data, encoding: .utf8)!) + } + } + } + + struct ConfigCreate: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "create", + abstract: "Create a default configuration or agent definition file" + ) + + @Option(name: .long, help: "Create a definition file for a new agent with this name") + var agent: String? + + @Flag(name: .long, help: "Overwrite existing files without prompting") + var force = false + + func run() async throws { + let fm = FileManager.default + let encoder = JSONEncoder() + encoder.outputFormatting = [.prettyPrinted, .sortedKeys] + + if let agentName = agent { + let agentsDir = Sandboxy.configRoot.appendingPathComponent("agents") + try fm.createDirectory(at: agentsDir, withIntermediateDirectories: true) + + let filePath = agentsDir.appendingPathComponent("\(agentName).json") + if fm.fileExists(atPath: filePath.path(percentEncoded: false)) && !force { + guard isatty(STDIN_FILENO) != 0 else { + print("Agent definition already exists at \(filePath.path(percentEncoded: false)). Use --force to overwrite.") + throw ExitCode.failure + } + print("Agent definition already exists at \(filePath.path(percentEncoded: false))") + print("Overwrite? [y/N] ", terminator: "") + guard let response = readLine()?.lowercased(), response == "y" || response == "yes" else { + print("Aborted.") + return + } + } + + let definition: AgentDefinition + if let builtIn = AgentDefinition.builtIn[agentName] { + definition = builtIn + } else { + definition = AgentDefinition( + displayName: agentName.capitalized, + baseImage: "docker.io/library/node:22", + installCommands: [], + launchCommand: [agentName], + environmentVariables: [], + mounts: [], + allowedHosts: [] + ) + } + + let data = try encoder.encode(definition) + try data.write(to: filePath, options: .atomic) + print("Created agent definition at \(filePath.path(percentEncoded: false))") + print() + print(String(data: data, encoding: .utf8)!) + } else { + let configPath = Sandboxy.configRoot.appendingPathComponent("config.json") + if fm.fileExists(atPath: configPath.path(percentEncoded: false)) && !force { + guard isatty(STDIN_FILENO) != 0 else { + print("Configuration file already exists at \(configPath.path(percentEncoded: false)). Use --force to overwrite.") + throw ExitCode.failure + } + print("Configuration file already exists at \(configPath.path(percentEncoded: false))") + print("Overwrite? [y/N] ", terminator: "") + guard let response = readLine()?.lowercased(), response == "y" || response == "yes" else { + print("Aborted.") + return + } + } + + try fm.createDirectory(at: Sandboxy.configRoot, withIntermediateDirectories: true) + + let data = try encoder.encode(SandboxyConfig.defaults) + try data.write(to: configPath, options: .atomic) + print("Created configuration file at \(configPath.path(percentEncoded: false))") + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/EditCommand.swift b/examples/sandboxy/Sources/sandboxy/EditCommand.swift new file mode 100644 index 0000000..d55a81d --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/EditCommand.swift @@ -0,0 +1,245 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationExtras +import ContainerizationOS +import Foundation + +extension Sandboxy { + struct Edit: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "edit", + abstract: "Open an interactive shell in an agent's cached environment", + discussion: """ + Boots the cached rootfs for the given agent and drops you into a shell. + Any changes you make (installing packages, editing configs, etc.) are + saved back to the cache when you exit. If no cache exists, the agent + is installed from scratch first. + """ + ) + + @Argument(help: "Agent whose environment to edit (e.g. claude)") + var agent: String + + @Option( + name: [.customLong("kernel"), .customShort("k")], + help: "Path to Linux kernel binary (auto-downloads if omitted)", + completion: .file(), + transform: { str in + URL(fileURLWithPath: str, relativeTo: .currentDirectory()) + .absoluteURL.path(percentEncoded: false) + }) + var kernel: String? + + func run() async throws { + let config = try Sandboxy.loadConfig() + + let agents = AgentDefinition.allAgents(configRoot: Sandboxy.configRoot) + guard let definition = agents[agent] else { + let available = agents.keys.sorted().joined(separator: ", ") + throw ValidationError( + "Unknown agent '\(agent)'. Available agents: \(available)" + ) + } + + ProgressUI.printStatus("Opening \(definition.displayName) environment for editing...") + + let kernelPath = try await KernelManager.ensureKernel( + explicitPath: kernel, + appRoot: Sandboxy.appRoot, + config: config + ) + let vmKernel = Kernel(path: kernelPath, platform: .linuxArm) + + let enableNetworking: Bool + var sharedNetwork: VmnetNetwork? + if #available(macOS 26, *) { + sharedNetwork = try VmnetNetwork() + enableNetworking = true + } else { + sharedNetwork = nil + enableNetworking = false + } + + let vmnetMTU: UInt32 = 1400 + + let initfsReference = config.initfsReference ?? SandboxyConfig.defaults.initfsReference! + var manager = try await ContainerManager( + kernel: vmKernel, + initfsReference: initfsReference, + root: Sandboxy.appRoot + ) + + let containerId = "\(agent)-edit-\(ProcessInfo.processInfo.processIdentifier)" + + let cacheDir = Sandboxy.appRoot.appendingPathComponent("cache") + try FileManager.default.createDirectory(at: cacheDir, withIntermediateDirectories: true) + let agentCachePath = cacheDir.appendingPathComponent("\(agent)-rootfs.ext4") + let containerRootfsPath = Sandboxy.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(containerId) + .appendingPathComponent("rootfs.ext4") + + let hasCachedRootfs = FileManager.default.fileExists( + atPath: agentCachePath.path(percentEncoded: false)) + + let container: LinuxContainer + + if hasCachedRootfs { + ProgressUI.printDetail("Using cached environment...") + let containerDir = Sandboxy.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(containerId) + try FileManager.default.createDirectory( + at: containerDir, withIntermediateDirectories: true) + + let result = Darwin.clonefile( + agentCachePath.path(percentEncoded: false), + containerRootfsPath.path(percentEncoded: false), + 0 + ) + if result != 0 { + try FileManager.default.copyItem(at: agentCachePath, to: containerRootfsPath) + } + + let rootfsMount = Mount.block( + format: "ext4", + source: containerRootfsPath.path(percentEncoded: false), + destination: "/" + ) + + let image = try await Sandboxy.imageStore.get( + reference: definition.baseImage, pull: true) + + container = try await manager.create( + containerId, + image: image, + rootfs: rootfsMount, + networking: false + ) { config in + if enableNetworking, let iface = try sharedNetwork?.createInterface(containerId, mtu: vmnetMTU) { + config.interfaces = [iface] + config.dns = .init(nameservers: [sharedNetwork!.ipv4Gateway.description]) + } + config.cpus = 4 + config.memoryInBytes = 4096 * 1024 * 1024 + config.process.arguments = ["/bin/sleep", "infinity"] + config.process.workingDirectory = "/" + config.process.capabilities = .allCapabilities + config.useInit = true + } + } else { + ProgressUI.printDetail("No cached environment, setting up from scratch...") + container = try await manager.create( + containerId, + reference: definition.baseImage, + rootfsSizeInBytes: 512.gib(), + networking: false + ) { config in + if enableNetworking, let iface = try sharedNetwork?.createInterface(containerId, mtu: vmnetMTU) { + config.interfaces = [iface] + config.dns = .init(nameservers: [sharedNetwork!.ipv4Gateway.description]) + } + config.cpus = 4 + config.memoryInBytes = 4096 * 1024 * 1024 + config.process.arguments = ["/bin/sleep", "infinity"] + config.process.workingDirectory = "/" + config.process.capabilities = .allCapabilities + config.useInit = true + } + } + + do { + try await container.create() + try await container.start() + + // If no cache existed, run the agent's install commands first. + if !hasCachedRootfs { + ProgressUI.printStatus("Installing \(definition.displayName) toolchain...") + do { + try await installAgent(in: container, definition: definition) + ProgressUI.printStatus("Installation complete.") + } catch { + ProgressUI.printError("Installation failed: \(error)") + ProgressUI.printStatus("Dropping into shell...") + } + } + + // Drop into an interactive shell. + ProgressUI.printStatus("Launching shell (exit to save changes)...\n") + + let sigwinchStream = AsyncSignalHandler.create(notify: [SIGWINCH]) + let current = try Terminal.current + try current.setraw() + defer { current.tryReset() } + + let shellProcess = try await container.exec("edit-shell") { config in + config.arguments = ["/bin/bash"] + config.environmentVariables = [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm", + "HOME=/root", + ] + config.workingDirectory = "/root" + config.setTerminalIO(terminal: current) + config.capabilities = .allCapabilities + } + + try await shellProcess.start() + try? await shellProcess.resize(to: try current.size) + + try await withThrowingTaskGroup(of: Void.self) { group in + group.addTask { + for await _ in sigwinchStream.signals { + try await shellProcess.resize(to: try current.size) + } + } + + _ = try await shellProcess.wait() + group.cancelAll() + try await shellProcess.delete() + } + + // Stop container so rootfs is cleanly unmounted before caching. + try await container.stop() + + // Save the modified rootfs back to the cache. + ProgressUI.printStatus("Saving changes to cache...") + removeIfExists(at: agentCachePath) + try FileManager.default.copyItem(at: containerRootfsPath, to: agentCachePath) + ProgressUI.printStatus("Done.") + + try manager.delete(containerId) + try? sharedNetwork?.releaseInterface(containerId) + } catch { + do { + try await container.stop() + } catch { + log.warning("Failed to stop container \(containerId): \(error)") + } + do { + try manager.delete(containerId) + } catch { + log.warning("Failed to delete container \(containerId): \(error)") + } + try? sharedNetwork?.releaseInterface(containerId) + throw error + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/HostProxy.swift b/examples/sandboxy/Sources/sandboxy/HostProxy.swift new file mode 100644 index 0000000..af08eda --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/HostProxy.swift @@ -0,0 +1,460 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// Adapted from https://github.com/apple/swift-nio-examples/tree/main/connect-proxy + +import Foundation +import NIOCore +import NIOHTTP1 +import NIOPosix + +/// A lightweight HTTP proxy that runs on the host and filters by hostname. +/// +/// Binds to the host's gateway IP on a vmnet host-only network. Workload containers +/// that have no direct internet route use this proxy (via HTTP_PROXY/HTTPS_PROXY env vars) +/// to reach the outside world. Only hostnames matching the allowlist are permitted. +/// +/// Handles both HTTPS (via CONNECT tunneling) and plain HTTP (via request forwarding). +/// For HTTPS, the client sends a CONNECT request with the target hostname in plaintext +/// before TLS begins, so we can filter without any certificate interception. +final class HostProxy: @unchecked Sendable { + private let group: MultiThreadedEventLoopGroup + private let channel: any Channel + + /// The port the proxy is listening on. + let port: Int + + /// The host address the proxy is bound to. + let host: String + + /// Start a proxy bound to the given address. + /// - Parameters: + /// - host: IP address to bind to (e.g. the vmnet gateway IP). + /// - port: Port to bind to. Use 0 for an OS-assigned port. + /// - allowedHosts: Hostname patterns to allow. Supports `*.example.com` wildcards. + init(host: String, port: Int = 0, allowedHosts: [String]) async throws { + self.host = host + let group = MultiThreadedEventLoopGroup(numberOfThreads: System.coreCount) + self.group = group + + let bootstrap = ServerBootstrap(group: group) + .serverChannelOption(ChannelOptions.socket(.init(SOL_SOCKET), .init(SO_REUSEADDR)), value: 1) + .childChannelOption(ChannelOptions.socket(.init(SOL_SOCKET), .init(SO_REUSEADDR)), value: 1) + .childChannelInitializer { channel in + channel.eventLoop.makeCompletedFuture { + try channel.pipeline.syncOperations.addHandler( + ByteToMessageHandler(HTTPRequestDecoder(leftOverBytesStrategy: .forwardBytes)) + ) + try channel.pipeline.syncOperations.addHandler(HTTPResponseEncoder()) + try channel.pipeline.syncOperations.addHandler( + ConnectHandler(allowedHosts: allowedHosts) + ) + } + } + + let channel = try await bootstrap.bind( + to: SocketAddress(ipAddress: host, port: port) + ).get() + + guard let localAddress = channel.localAddress, let assignedPort = localAddress.port else { + throw SandboxyError.proxyFailed(reason: "could not determine proxy listen port") + } + + self.port = assignedPort + self.channel = channel + } + + /// Stop the proxy and release resources. + func stop() async throws { + try await channel.close() + try await group.shutdownGracefully() + } + + /// Check if a hostname matches any pattern in the allowlist. + static func isAllowed(host: String, allowedHosts: [String]) -> Bool { + let host = host.lowercased() + for pattern in allowedHosts { + let pattern = pattern.lowercased() + if pattern.hasPrefix("*.") { + let suffix = String(pattern.dropFirst(1)) // e.g. ".example.com" + if host == String(pattern.dropFirst(2)) || host.hasSuffix(suffix) { + return true + } + } else if host == pattern { + return true + } + } + return false + } +} + +/// Channel handler that processes HTTP CONNECT and plain HTTP proxy requests. +/// Checks the target hostname against an allowlist before connecting. +private final class ConnectHandler { + private var upgradeState: State + private let allowedHosts: [String] + + /// Buffered request for plain HTTP forwarding (nil for CONNECT). + private var pendingHTTPHead: HTTPRequestHead? + private var pendingHTTPBody: [ByteBuffer] = [] + + init(allowedHosts: [String]) { + self.upgradeState = .idle + self.allowedHosts = allowedHosts + } +} + +extension ConnectHandler { + fileprivate enum State { + case idle + case beganConnecting + case awaitingEnd(connectResult: Channel) + case awaitingConnection(pendingBytes: [NIOAny]) + case upgradeComplete(pendingBytes: [NIOAny]) + case upgradeFailed + } +} + +extension ConnectHandler: ChannelInboundHandler { + typealias InboundIn = HTTPServerRequestPart + typealias OutboundOut = HTTPServerResponsePart + + func channelRead(context: ChannelHandlerContext, data: NIOAny) { + switch self.upgradeState { + case .idle: + self.handleInitialMessage(context: context, data: self.unwrapInboundIn(data)) + + case .beganConnecting: + switch self.unwrapInboundIn(data) { + case .body(let body): + self.pendingHTTPBody.append(body) + case .end: + self.upgradeState = .awaitingConnection(pendingBytes: []) + self.removeDecoder(context: context) + default: + break + } + + case .awaitingEnd(let peerChannel): + switch self.unwrapInboundIn(data) { + case .body(let body): + self.pendingHTTPBody.append(body) + case .end: + self.upgradeState = .upgradeComplete(pendingBytes: []) + self.removeDecoder(context: context) + self.glue(peerChannel, context: context) + default: + break + } + + case .awaitingConnection(var pendingBytes): + self.upgradeState = .awaitingConnection(pendingBytes: []) + pendingBytes.append(data) + self.upgradeState = .awaitingConnection(pendingBytes: pendingBytes) + + case .upgradeComplete(var pendingBytes): + self.upgradeState = .upgradeComplete(pendingBytes: []) + pendingBytes.append(data) + self.upgradeState = .upgradeComplete(pendingBytes: pendingBytes) + + case .upgradeFailed: + break + } + } +} + +extension ConnectHandler: RemovableChannelHandler { + func removeHandler(context: ChannelHandlerContext, removalToken: ChannelHandlerContext.RemovalToken) { + var didRead = false + + while case .upgradeComplete(var pendingBytes) = self.upgradeState, pendingBytes.count > 0 { + self.upgradeState = .upgradeComplete(pendingBytes: []) + let nextRead = pendingBytes.removeFirst() + self.upgradeState = .upgradeComplete(pendingBytes: pendingBytes) + + context.fireChannelRead(nextRead) + didRead = true + } + + if didRead { + context.fireChannelReadComplete() + } + + context.leavePipeline(removalToken: removalToken) + } +} + +extension ConnectHandler { + private func handleInitialMessage(context: ChannelHandlerContext, data: InboundIn) { + guard case .head(let head) = data else { + self.httpErrorAndClose(context: context, status: .badRequest) + return + } + + if head.method == .CONNECT { + // HTTPS: CONNECT host:port + let components = head.uri.split(separator: ":", maxSplits: 1, omittingEmptySubsequences: false) + let host = String(components.first!) + let port = components.last.flatMap { Int($0, radix: 10) } ?? 443 + + guard HostProxy.isAllowed(host: host, allowedHosts: self.allowedHosts) else { + self.httpErrorAndClose(context: context, status: .forbidden) + return + } + + self.upgradeState = .beganConnecting + self.connectTo(host: host, port: port, context: context) + } else { + // Plain HTTP: GET http://host/path, POST http://host/path, etc. + guard let url = URLComponents(string: head.uri), + let hostname = url.host, !hostname.isEmpty + else { + self.httpErrorAndClose(context: context, status: .badRequest) + return + } + + guard HostProxy.isAllowed(host: hostname, allowedHosts: self.allowedHosts) else { + self.httpErrorAndClose(context: context, status: .forbidden) + return + } + + let port = url.port ?? 80 + + // Rewrite URI from absolute (http://host/path) to relative (/path). + var relativePath = url.path + if relativePath.isEmpty { relativePath = "/" } + if let query = url.query { + relativePath += "?\(query)" + } + + var rewritten = head + rewritten.uri = relativePath + self.pendingHTTPHead = rewritten + + self.upgradeState = .beganConnecting + self.connectTo(host: hostname, port: port, context: context) + } + } + + private func connectTo(host: String, port: Int, context: ChannelHandlerContext) { + ClientBootstrap(group: context.eventLoop) + .connect(host: host, port: port).assumeIsolatedUnsafeUnchecked().whenComplete { result in + switch result { + case .success(let channel): + self.connectSucceeded(channel: channel, context: context) + case .failure(let error): + self.connectFailed(error: error, context: context) + } + } + } + + private func connectSucceeded(channel: Channel, context: ChannelHandlerContext) { + switch self.upgradeState { + case .beganConnecting: + self.upgradeState = .awaitingEnd(connectResult: channel) + + case .awaitingConnection(let pendingBytes): + self.upgradeState = .upgradeComplete(pendingBytes: pendingBytes) + self.glue(channel, context: context) + + case .awaitingEnd(let peerChannel): + peerChannel.close(mode: .all, promise: nil) + context.close(promise: nil) + + case .idle, .upgradeFailed, .upgradeComplete: + context.close(promise: nil) + } + } + + private func connectFailed(error: Error, context: ChannelHandlerContext) { + switch self.upgradeState { + case .beganConnecting, .awaitingConnection: + self.httpErrorAndClose(context: context, status: .badGateway) + + case .awaitingEnd(let peerChannel): + peerChannel.close(mode: .all, promise: nil) + context.close(promise: nil) + + case .idle, .upgradeFailed, .upgradeComplete: + context.close(promise: nil) + } + + context.fireErrorCaught(error) + } + + private func glue(_ peerChannel: Channel, context: ChannelHandlerContext) { + if let httpHead = self.pendingHTTPHead { + // Plain HTTP: forward the buffered request to the peer, then glue. + var buffer = context.channel.allocator.buffer(capacity: 256) + buffer.writeString("\(httpHead.method) \(httpHead.uri) HTTP/\(httpHead.version.major).\(httpHead.version.minor)\r\n") + for (name, value) in httpHead.headers { + buffer.writeString("\(name): \(value)\r\n") + } + buffer.writeString("\r\n") + for var body in self.pendingHTTPBody { + buffer.writeBuffer(&body) + } + peerChannel.writeAndFlush(buffer, promise: nil) + self.pendingHTTPHead = nil + self.pendingHTTPBody = [] + } else { + // CONNECT: send 200 OK to the client. + // Content-Length: 0 prevents the encoder from adding chunked transfer encoding, + // which would inject a chunked terminator into the raw tunnel and break TLS. + let headers = HTTPHeaders([("Content-Length", "0")]) + let head = HTTPResponseHead(version: .init(major: 1, minor: 1), status: .ok, headers: headers) + context.write(self.wrapOutboundOut(.head(head)), promise: nil) + context.writeAndFlush(self.wrapOutboundOut(.end(nil)), promise: nil) + } + + self.removeEncoder(context: context) + + let (localGlue, peerGlue) = GlueHandler.matchedPair() + do { + try context.channel.pipeline.syncOperations.addHandler(localGlue) + try peerChannel.pipeline.syncOperations.addHandler(peerGlue) + context.pipeline.syncOperations.removeHandler(self, promise: nil) + } catch { + peerChannel.close(mode: .all, promise: nil) + context.close(promise: nil) + } + } + + private func httpErrorAndClose(context: ChannelHandlerContext, status: HTTPResponseStatus) { + self.upgradeState = .upgradeFailed + + let headers = HTTPHeaders([("Content-Length", "0"), ("Connection", "close")]) + let head = HTTPResponseHead(version: .init(major: 1, minor: 1), status: status, headers: headers) + context.write(self.wrapOutboundOut(.head(head)), promise: nil) + context.writeAndFlush(self.wrapOutboundOut(.end(nil))).assumeIsolatedUnsafeUnchecked().whenComplete { + (_: Result) in + context.close(mode: .output, promise: nil) + } + } + + private func removeDecoder(context: ChannelHandlerContext) { + if let ctx = try? context.pipeline.syncOperations.context( + handlerType: ByteToMessageHandler.self + ) { + context.pipeline.syncOperations.removeHandler(context: ctx, promise: nil) + } + } + + private func removeEncoder(context: ChannelHandlerContext) { + if let ctx = try? context.pipeline.syncOperations.context( + handlerType: HTTPResponseEncoder.self + ) { + context.pipeline.syncOperations.removeHandler(context: ctx, promise: nil) + } + } +} + +/// Bidirectional relay handler that glues two channels together. +private final class GlueHandler { + private var partner: GlueHandler? + private var context: ChannelHandlerContext? + private var pendingRead: Bool = false + + private init() {} + + static func matchedPair() -> (GlueHandler, GlueHandler) { + let first = GlueHandler() + let second = GlueHandler() + first.partner = second + second.partner = first + return (first, second) + } +} + +extension GlueHandler { + fileprivate func partnerWrite(_ data: NIOAny) { + self.context?.write(data, promise: nil) + } + + fileprivate func partnerFlush() { + self.context?.flush() + } + + fileprivate func partnerWriteEOF() { + self.context?.close(mode: .output, promise: nil) + } + + fileprivate func partnerCloseFull() { + self.context?.close(promise: nil) + } + + fileprivate func partnerBecameWritable() { + if self.pendingRead { + self.pendingRead = false + self.context?.read() + } + } + + fileprivate var partnerWritable: Bool { + self.context?.channel.isWritable ?? false + } +} + +extension GlueHandler: ChannelDuplexHandler { + typealias InboundIn = NIOAny + typealias OutboundIn = NIOAny + typealias OutboundOut = NIOAny + + func handlerAdded(context: ChannelHandlerContext) { + self.context = context + } + + func handlerRemoved(context: ChannelHandlerContext) { + self.context = nil + self.partner = nil + } + + func channelRead(context: ChannelHandlerContext, data: NIOAny) { + self.partner?.partnerWrite(data) + } + + func channelReadComplete(context: ChannelHandlerContext) { + self.partner?.partnerFlush() + } + + func channelInactive(context: ChannelHandlerContext) { + self.partner?.partnerCloseFull() + } + + func userInboundEventTriggered(context: ChannelHandlerContext, event: Any) { + if let event = event as? ChannelEvent, case .inputClosed = event { + self.partner?.partnerWriteEOF() + } + } + + func errorCaught(context: ChannelHandlerContext, error: Error) { + self.partner?.partnerCloseFull() + } + + func channelWritabilityChanged(context: ChannelHandlerContext) { + if context.channel.isWritable { + self.partner?.partnerBecameWritable() + } + } + + func read(context: ChannelHandlerContext) { + if let partner = self.partner, partner.partnerWritable { + context.read() + } else { + self.pendingRead = true + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/InstanceState.swift b/examples/sandboxy/Sources/sandboxy/InstanceState.swift new file mode 100644 index 0000000..333be1e --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/InstanceState.swift @@ -0,0 +1,120 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Persistent metadata about a sandbox instance. +struct InstanceState: Codable, Sendable { + let id: String + /// User-provided name for persistent instances. Nil for ephemeral runs. + let name: String? + let agent: String + let workspace: String + let status: Status + let createdAt: Date + var stoppedAt: Date? + let cpus: Int + let memoryMB: UInt64 + + enum Status: String, Codable, Sendable { + case running + case stopped + } + + /// Whether this is a named (persistent) instance. + var isNamed: Bool { name != nil } + + /// Directory where instance state files are stored. + static func instancesDir(appRoot: URL) -> URL { + appRoot.appendingPathComponent("instances") + } + + /// Directory where named instance rootfs files are preserved. + static func namedRootfsDir(appRoot: URL) -> URL { + appRoot.appendingPathComponent("named") + } + + /// Path to the preserved rootfs for a named instance. + static func namedRootfsPath(appRoot: URL, name: String) -> URL { + namedRootfsDir(appRoot: appRoot).appendingPathComponent("\(name)-rootfs.ext4") + } + + /// Path to this instance's state file. + func statePath(appRoot: URL) -> URL { + Self.instancesDir(appRoot: appRoot).appendingPathComponent("\(id).json") + } + + /// Saves this instance state to disk. + func save(appRoot: URL) throws { + let dir = Self.instancesDir(appRoot: appRoot) + try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true) + + let encoder = JSONEncoder() + encoder.dateEncodingStrategy = .iso8601 + encoder.outputFormatting = .prettyPrinted + let data = try encoder.encode(self) + try data.write(to: statePath(appRoot: appRoot)) + } + + /// Loads all instance states from disk. + static func loadAll(appRoot: URL) throws -> [InstanceState] { + let dir = instancesDir(appRoot: appRoot) + let path = dir.path(percentEncoded: false) + guard FileManager.default.fileExists(atPath: path) else { + return [] + } + + let decoder = JSONDecoder() + decoder.dateDecodingStrategy = .iso8601 + + let files = try FileManager.default.contentsOfDirectory( + at: dir, + includingPropertiesForKeys: nil + ).filter { $0.pathExtension == "json" } + + return files.compactMap { file -> InstanceState? in + do { + let data = try Data(contentsOf: file) + return try decoder.decode(InstanceState.self, from: data) + } catch { + log.warning("Failed to load instance state from \(file.lastPathComponent): \(error)") + return nil + } + } + } + + /// Finds a named instance by name. + static func find(name: String, appRoot: URL) throws -> InstanceState? { + try loadAll(appRoot: appRoot).first { $0.name == name } + } + + /// Removes this instance's state file from disk. + func remove(appRoot: URL) throws { + try FileManager.default.removeItem(at: statePath(appRoot: appRoot)) + } + + /// Removes this instance's state file and preserved rootfs (for named instances). + func removeAll(appRoot: URL) throws { + try remove(appRoot: appRoot) + if let name { + let rootfs = Self.namedRootfsPath(appRoot: appRoot, name: name) + let path = rootfs.path(percentEncoded: false) + if FileManager.default.fileExists(atPath: path) { + try FileManager.default.removeItem(at: rootfs) + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/KernelManager.swift b/examples/sandboxy/Sources/sandboxy/KernelManager.swift new file mode 100644 index 0000000..fd4bcaf --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/KernelManager.swift @@ -0,0 +1,153 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import AsyncHTTPClient +import ContainerizationArchive +import ContainerizationExtras +import Foundation + +enum KernelManager { + // Hardcoded default kernel source (Kata Containers arm64 static release). + private static let defaultKernelURL = + "https://github.com/kata-containers/kata-containers/releases/download/3.26.0/kata-static-3.26.0-arm64.tar.zst" + private static let defaultKernelPathInTarball = "opt/kata/share/kata-containers/vmlinux.container" + + /// Ensures a kernel binary is available, returning its path. + /// + /// Resolution order: + /// 1. CLI flag (`-k` / `--kernel`) + /// 2. Config file (`"kernel"` field) + /// 3. Cached kernel at `appRoot/kernel/vmlinux` + /// 4. Auto-download from Kata Containers + static func ensureKernel(explicitPath: String?, appRoot: URL, config: SandboxyConfig) async throws -> URL { + // 1. CLI flag takes priority. + if let explicitPath { + let url = URL(fileURLWithPath: explicitPath) + guard FileManager.default.fileExists(atPath: url.path(percentEncoded: false)) else { + throw SandboxyError.kernelNotFound(path: explicitPath) + } + return url + } + + // 2. Config file path. + if let configKernel = config.kernel { + let url = URL(fileURLWithPath: configKernel) + guard FileManager.default.fileExists(atPath: url.path(percentEncoded: false)) else { + throw SandboxyError.kernelNotFound(path: configKernel) + } + return url + } + + // 3. Cached kernel. + let kernelDir = appRoot.appendingPathComponent("kernel") + let kernelPath = kernelDir.appendingPathComponent("vmlinux") + + if FileManager.default.fileExists(atPath: kernelPath.path(percentEncoded: false)) { + return kernelPath + } + + // 4. Auto-download. + try FileManager.default.createDirectory(at: kernelDir, withIntermediateDirectories: true) + + let progressConfig = try ProgressConfig( + description: "Downloading kernel", + showTasks: true, + totalTasks: 2 + ) + let progress = ProgressBar(config: progressConfig) + defer { progress.finish() } + progress.start() + + let tarballPath = kernelDir.appendingPathComponent("kata.tar.zst") + try await downloadFile(from: defaultKernelURL, to: tarballPath, progress: progress) + + progress.set(description: "Extracting kernel") + try extractKernel(from: tarballPath, kernelPathInTarball: defaultKernelPathInTarball, to: kernelPath) + + try FileManager.default.removeItem(at: tarballPath) + + return kernelPath + } + + private static func downloadFile(from urlString: String, to destination: URL, progress: ProgressBar) async throws { + guard let url = URL(string: urlString) else { + throw SandboxyError.kernelDownloadFailed(reason: "invalid URL: \(urlString)") + } + + let delegate = try FileDownloadDelegate( + path: destination.path(percentEncoded: false), + reportHead: { head in + if let contentLength = head.headers["Content-Length"].first, let totalBytes = Int64(contentLength) { + progress.add(totalSize: totalBytes) + } + }, + reportProgress: { progressUpdate in + progress.set(size: Int64(progressUpdate.receivedBytes)) + } + ) + + let request = try HTTPClient.Request(url: url) + let client = createClient(url: url) + do { + _ = try await client.execute(request: request, delegate: delegate).get() + } catch { + try? await client.shutdown() + throw error + } + try await client.shutdown() + } + + private static func createClient(url: URL) -> HTTPClient { + var httpConfiguration = HTTPClient.Configuration() + httpConfiguration.timeout = HTTPClient.Configuration.Timeout( + connect: .seconds(30), + read: .none + ) + if let host = url.host { + let proxyURL = ProxyUtils.proxyFromEnvironment(scheme: url.scheme, host: host) + if let proxyURL, let proxyHost = proxyURL.host { + httpConfiguration.proxy = HTTPClient.Configuration.Proxy.server(host: proxyHost, port: proxyURL.port ?? 8080) + } + } + + return HTTPClient(eventLoopGroupProvider: .singleton, configuration: httpConfiguration) + } + + private static func extractKernel(from tarball: URL, kernelPathInTarball: String, to destination: URL) throws { + var target = kernelPathInTarball + var reader = try ArchiveReader(file: tarball) + var (entry, data) = try reader.extractFile(path: target) + + // If the target file is a symlink, get the data for the actual file. + if entry.fileType == .symbolicLink, let symlinkRelative = entry.symlinkTarget { + reader = try ArchiveReader(file: tarball) + let symlinkTarget = URL(filePath: target).deletingLastPathComponent().appending(path: symlinkRelative) + + // Standardize so that we remove any and all ../ and ./ in the path since symlink targets + // are relative paths to the target file from the symlink's parent dir itself. + target = symlinkTarget.standardized.relativePath + let (_, targetData) = try reader.extractFile(path: target) + data = targetData + } + + try data.write(to: destination, options: .atomic) + + try FileManager.default.setAttributes( + [.posixPermissions: 0o755], + ofItemAtPath: destination.path(percentEncoded: false) + ) + } +} diff --git a/examples/sandboxy/Sources/sandboxy/ListCommand.swift b/examples/sandboxy/Sources/sandboxy/ListCommand.swift new file mode 100644 index 0000000..1a15ff4 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/ListCommand.swift @@ -0,0 +1,94 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Foundation + +extension Sandboxy { + struct List: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "list", + abstract: "List sandbox instances", + aliases: ["ls"] + ) + + func run() async throws { + _ = try Sandboxy.loadConfig() + + let instances = try InstanceState.loadAll(appRoot: Sandboxy.appRoot) + + if instances.isEmpty { + print("No sandbox instances found.") + return + } + + // Deduplicate named instances, keeping only the most recent entry per name. + var seen = Set() + var deduplicated: [InstanceState] = [] + let sorted = instances.sorted { $0.createdAt > $1.createdAt } + for instance in sorted { + if let name = instance.name { + if seen.contains(name) { continue } + seen.insert(name) + } + deduplicated.append(instance) + } + + print( + pad("NAME", to: 30) + + pad("AGENT", to: 12) + + pad("STATUS", to: 12) + + pad("CREATED", to: 12) + + "WORKSPACE" + ) + + for instance in deduplicated { + let age = relativeTime(from: instance.createdAt) + let displayName = instance.name ?? "-" + print( + pad(truncate(displayName, to: 28), to: 30) + + pad(instance.agent, to: 12) + + pad(instance.status.rawValue, to: 12) + + pad(age, to: 12) + + instance.workspace + ) + } + } + + private func pad(_ s: String, to width: Int) -> String { + if s.count >= width { + return s + } + return s + String(repeating: " ", count: width - s.count) + } + + private func truncate(_ s: String, to maxLen: Int) -> String { + if s.count <= maxLen { return s } + return "..." + String(s.suffix(maxLen - 3)) + } + + private func relativeTime(from date: Date) -> String { + let seconds = Int(Date().timeIntervalSince(date)) + if seconds < 60 { return "\(seconds)s ago" } + let minutes = seconds / 60 + if minutes < 60 { return "\(minutes)m ago" } + let hours = minutes / 60 + if hours < 24 { return "\(hours)h ago" } + let days = hours / 24 + return "\(days)d ago" + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/OutputCapture.swift b/examples/sandboxy/Sources/sandboxy/OutputCapture.swift new file mode 100644 index 0000000..4f99917 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/OutputCapture.swift @@ -0,0 +1,47 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Containerization +import Foundation +import Synchronization + +/// A Writer that captures output into a Data buffer and optionally streams it. +final class OutputCapture: Writer, Sendable { + private let storage = Mutex(Data()) + private let streamTo: FileHandle? + + var data: Data { + storage.withLock { $0 } + } + + init(streamToStdout: Bool = false, streamToStderr: Bool = false) { + if streamToStdout { + self.streamTo = .standardOutput + } else if streamToStderr { + self.streamTo = .standardError + } else { + self.streamTo = nil + } + } + + func write(_ data: Data) throws { + guard data.count > 0 else { return } + storage.withLock { $0.append(data) } + streamTo?.write(data) + } + + func close() throws {} +} diff --git a/examples/sandboxy/Sources/sandboxy/ProgressUI.swift b/examples/sandboxy/Sources/sandboxy/ProgressUI.swift new file mode 100644 index 0000000..10d5f40 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/ProgressUI.swift @@ -0,0 +1,70 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Status output helpers that write to stderr to keep stdout clean for the agent's terminal IO. +enum ProgressUI { + private static let boxLines = [ + "┌──────────────┐", + "│ ░░░░░░░░░░░░ │", + "│ ░░░░░░░░░░░░ │", + "│ ░░░░░░░░░░░░ │", + "│ ░░░░░░░░░░░░ │", + "│ ░░░░░░░░░░░░ │", + "│ ░░░░░░░░░░░░ │", + "└──────────────┘", + ] + + /// Prints the logo with info lines displayed to the right of the box. + static func printLogo(info: [String] = []) { + let yellow = "\u{1b}[33m" + let reset = "\u{1b}[0m" + let gap = " " + + for (i, boxLine) in boxLines.enumerated() { + let coloredBox = "\(yellow)\(boxLine)\(reset)" + if i < info.count { + FileHandle.standardError.write(Data(" \(coloredBox)\(gap)\(info[i])\n".utf8)) + } else { + FileHandle.standardError.write(Data(" \(coloredBox)\n".utf8)) + } + } + // Print any remaining info lines that don't fit beside the box. + if info.count > boxLines.count { + for j in boxLines.count.. \(message)\u{1b}[0m\n".utf8)) + } + + static func printDetail(_ message: String) { + FileHandle.standardError.write(Data("\u{1b}[32m \(message)\u{1b}[0m\n".utf8)) + } + + static func printWarning(_ message: String) { + FileHandle.standardError.write(Data("warning: \(message)\n".utf8)) + } + + static func printError(_ message: String) { + FileHandle.standardError.write(Data("\u{1b}[31merror: \(message)\u{1b}[0m\n".utf8)) + } +} diff --git a/examples/sandboxy/Sources/sandboxy/RemoveCommand.swift b/examples/sandboxy/Sources/sandboxy/RemoveCommand.swift new file mode 100644 index 0000000..3768f99 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/RemoveCommand.swift @@ -0,0 +1,69 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Foundation + +extension Sandboxy { + struct Remove: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "rm", + abstract: "Remove sandbox instances and their preserved state" + ) + + @Argument(help: "Name of the instance to remove") + var names: [String] = [] + + @Flag(name: [.customShort("a"), .long], help: "Remove all instances") + var all: Bool = false + + func run() async throws { + _ = try Sandboxy.loadConfig() + + if all { + let instances = try InstanceState.loadAll(appRoot: Sandboxy.appRoot) + if instances.isEmpty { + print("No instances to remove.") + return + } + for instance in instances { + let displayName = instance.name ?? instance.id + do { + try instance.removeAll(appRoot: Sandboxy.appRoot) + print("Removed instance '\(displayName)'.") + } catch { + print("Failed to remove instance '\(displayName)': \(error)") + } + } + return + } + + guard !names.isEmpty else { + print("Specify instance name(s) to remove, or use --all (-a).") + throw ExitCode.failure + } + + for name in names { + guard let instance = try InstanceState.find(name: name, appRoot: Sandboxy.appRoot) else { + print("No instance named '\(name)' found.") + continue + } + try instance.removeAll(appRoot: Sandboxy.appRoot) + print("Removed instance '\(name)'.") + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/RunAgentCommand.swift b/examples/sandboxy/Sources/sandboxy/RunAgentCommand.swift new file mode 100644 index 0000000..cdad0d3 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/RunAgentCommand.swift @@ -0,0 +1,1000 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Containerization +import ContainerizationError +import ContainerizationExtras +import ContainerizationOCI +import ContainerizationOS +import Foundation +import vmnet + +extension Sandboxy { + struct Run: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "run", + abstract: "Run an AI coding agent in a sandboxed Linux container", + discussion: """ + Available agents are determined by built-in definitions and any custom + agent JSON files in the agents/ subdirectory of the sandboxy application + support directory. + """ + ) + + @OptionGroup var options: AgentOptions + + @Argument(help: "Agent to run (e.g. claude)") + var agent: String + + @Argument(parsing: .captureForPassthrough) + var passthroughArgs: [String] = [] + + func run() async throws { + let config = try Sandboxy.loadConfig() + + let agents = AgentDefinition.allAgents(configRoot: Sandboxy.configRoot) + guard let definition = agents[agent] else { + let available = agents.keys.sorted().joined(separator: ", ") + throw ValidationError( + "Unknown agent '\(agent)'. Available agents: \(available)" + ) + } + + try await runAgent( + config: config, + agentName: agent, + definition: definition, + options: options, + passthroughArgs: passthroughArgs + ) + } + } +} + +struct AgentOptions: ParsableArguments { + @Option( + name: [.customLong("workspace"), .customShort("w")], + help: "Workspace directory on the host (defaults to current directory)", + completion: .directory, + transform: { str in + URL(fileURLWithPath: str, relativeTo: .currentDirectory()) + .absoluteURL.path(percentEncoded: false) + }) + var workspace: String? + + @Option(name: .long, help: "Number of CPUs to allocate") + var cpus: Int = 4 + + @Option(name: .long, help: "Memory to allocate (e.g. 4g, 512m, 4096 for MB)") + var memory: String = "4g" + + /// Parses the memory string into bytes. Supports suffixes: b, k/kb, m/mb, g/gb, t/tb. + /// A bare number is treated as megabytes for backward compatibility. + var memoryBytes: UInt64 { + get throws { + let str = memory.lowercased().trimmingCharacters(in: .whitespaces) + guard !str.isEmpty else { + throw ValidationError("Memory value cannot be empty") + } + + let suffixes: [(String, UInt64)] = [ + ("tb", 1024 * 1024 * 1024 * 1024), + ("gb", 1024 * 1024 * 1024), + ("mb", 1024 * 1024), + ("kb", 1024), + ("t", 1024 * 1024 * 1024 * 1024), + ("g", 1024 * 1024 * 1024), + ("m", 1024 * 1024), + ("k", 1024), + ("b", 1), + ] + + for (suffix, multiplier) in suffixes { + if str.hasSuffix(suffix) { + let numStr = String(str.dropLast(suffix.count)) + guard let value = Double(numStr), value > 0 else { + throw ValidationError("Invalid memory value: \(memory)") + } + return UInt64(value * Double(multiplier)) + } + } + + // Bare number: treat as megabytes. + guard let value = Double(str), value > 0 else { + throw ValidationError("Invalid memory value: \(memory)") + } + return UInt64(value * 1024 * 1024) + } + } + + /// Returns a human-readable memory string (e.g. "4 GB", "512 MB"). + var memoryDisplay: String { + get throws { + let bytes = try memoryBytes + if bytes >= 1024 * 1024 * 1024 && bytes % (1024 * 1024 * 1024) == 0 { + return "\(bytes / (1024 * 1024 * 1024)) GB" + } else if bytes >= 1024 * 1024 { + return "\(bytes / (1024 * 1024)) MB" + } else if bytes >= 1024 { + return "\(bytes / 1024) KB" + } + return "\(bytes) B" + } + } + + @Option( + name: .long, parsing: .upToNextOption, + help: "Hostnames to allow through the HTTP proxy") + var allowHosts: [String] = [] + + @Flag(name: .long, help: "Disable network filtering (allow unrestricted network access)") + var noNetworkFilter: Bool = false + + @Flag(name: .long, help: "Force reinstall of agent (ignore cached rootfs)") + var reinstall: Bool = false + + @Flag(name: .long, help: "Forward the host SSH agent socket into the container") + var sshAgent: Bool = false + + @Flag(name: .long, help: "Skip mounts defined in the agent configuration") + var noAgentMounts: Bool = false + + @Flag(name: .customLong("rm"), help: "Automatically remove the instance after the session ends") + var removeAfterRun: Bool = false + + @Option( + name: [.customLong("mount"), .customShort("m")], + parsing: .singleValue, + help: "Additional mount in hostpath:containerpath[:ro|rw] format (repeatable)") + var mount: [String] = [] + + @Option( + name: [.customLong("env"), .customShort("e")], + parsing: .singleValue, + help: "Set environment variable (KEY=VALUE or KEY to forward from host, repeatable)") + var env: [String] = [] + + @Option( + name: .long, + help: "Name for a persistent instance (preserves rootfs and resumes conversation)") + var name: String? + + @Option( + name: [.customLong("kernel"), .customShort("k")], + help: "Path to Linux kernel binary (auto-downloads if omitted)", + completion: .file(), + transform: { str in + URL(fileURLWithPath: str, relativeTo: .currentDirectory()) + .absoluteURL.path(percentEncoded: false) + }) + var kernel: String? +} + +func runAgent( + config: SandboxyConfig, + agentName: String, + definition: AgentDefinition, + options: AgentOptions, + passthroughArgs: [String] +) async throws { + signal(SIGINT) { _ in + var termios = termios() + tcgetattr(STDIN_FILENO, &termios) + termios.c_lflag |= UInt(ECHO | ICANON) + tcsetattr(STDIN_FILENO, TCSANOW, &termios) + write(STDERR_FILENO, "\u{001B}[?25h", 6) + _exit(130) + } + + let hostWorkspacePath = options.workspace ?? FileManager.default.currentDirectoryPath + let guestWorkspacePath = hostWorkspacePath + let extraMounts = try options.mount.map { try MountSpec.parse($0) } + let extraEnvVars = try options.env.map { try EnvSpec.resolve($0) } + + // Determine instance name: use --name if provided, otherwise auto-generate. + let instanceName: String + if let name = options.name { + instanceName = name + } else { + let formatter = DateFormatter() + formatter.dateFormat = "yyyyMMdd-HHmmss" + instanceName = "\(agentName)-\(formatter.string(from: Date()))" + } + + if let old = try InstanceState.find(name: instanceName, appRoot: Sandboxy.appRoot) { + try? old.remove(appRoot: Sandboxy.appRoot) + } + + // Check cache age for display. + let cacheDir = Sandboxy.appRoot.appendingPathComponent("cache") + let agentCachePath = cacheDir.appendingPathComponent("\(agentName)-rootfs.ext4") + let cacheAgeLine: String + if let attrs = try? FileManager.default.attributesOfItem(atPath: agentCachePath.path(percentEncoded: false)), + let created = attrs[.creationDate] as? Date + { + let formatter = RelativeDateTimeFormatter() + formatter.unitsStyle = .full + let age = formatter.localizedString(for: created, relativeTo: Date()) + let capitalizedAge = age.prefix(1).uppercased() + age.dropFirst() + cacheAgeLine = "\u{1b}[1mEnvironment:\u{1b}[0m \(capitalizedAge)" + } else { + cacheAgeLine = "\u{1b}[1mEnvironment:\u{1b}[0m Not yet installed" + } + + ProgressUI.printLogo(info: [ + "", + "\u{1b}[1mSandboxy\u{1b}[0m", + "\u{1b}[1mAgent:\u{1b}[0m \(definition.displayName)", + "\u{1b}[1mInstance:\u{1b}[0m \(instanceName)", + cacheAgeLine, + "\u{1b}[1mWorkspace:\u{1b}[0m \(hostWorkspacePath)", + "\u{1b}[1mCPUs:\u{1b}[0m \(options.cpus) \u{1b}[1mMemory:\u{1b}[0m \(try options.memoryDisplay)", + ]) + + let kernelPath = try await KernelManager.ensureKernel( + explicitPath: options.kernel, + appRoot: Sandboxy.appRoot, + config: config + ) + guard FileManager.default.fileExists(atPath: kernelPath.path(percentEncoded: false)) else { + throw SandboxyError.kernelNotFound(path: kernelPath.path(percentEncoded: false)) + } + let kernel = Kernel(path: kernelPath, platform: .linuxArm) + + // Merge allowed hosts from agent definition and CLI flags. + var allowedHosts = definition.allowedHosts + allowedHosts.append(contentsOf: options.allowHosts) + let filteringEnabled = !options.noNetworkFilter + + let filteredPassthroughArgs = passthroughArgs.filter { $0 != "--" } + + var fullCommand = definition.launchCommand + fullCommand.append(contentsOf: filteredPassthroughArgs) + ProgressUI.printDetail("\u{1b}[1mCommand:\u{1b}[0m \(fullCommand.joined(separator: " "))") + + if filteringEnabled { + if allowedHosts.isEmpty { + ProgressUI.printDetail("\u{1b}[1mAllowed hosts:\u{1b}[0m\u{1b}[33m none (all traffic denied)") + } else { + let hostList = allowedHosts.joined(separator: ", ") + ProgressUI.printDetail("\u{1b}[1mAllowed hosts:\u{1b}[0m\u{1b}[32m \(hostList)") + } + } else { + ProgressUI.printDetail("\u{1b}[1mAllowed hosts:\u{1b}[0m\u{1b}[32m unrestricted") + } + + // Log mounts. + ProgressUI.printDetail("\u{1b}[1mMounts:\u{1b}[0m") + ProgressUI.printDetail(" \(hostWorkspacePath) -> \(guestWorkspacePath)") + if options.noAgentMounts { + for agentMount in definition.mounts { + let ro = agentMount.readOnly ? " (ro)" : "" + ProgressUI.printDetail(" \(agentMount.resolvedHostPath) -> \(agentMount.containerPath)\(ro) \u{1b}[33m(skipped, --no-agent-mounts)\u{1b}[0m") + } + } else { + for agentMount in definition.mounts { + let hostPath = agentMount.resolvedHostPath + let ro = agentMount.readOnly ? " (ro)" : "" + if FileManager.default.fileExists(atPath: hostPath) { + ProgressUI.printDetail(" \(hostPath) -> \(agentMount.containerPath)\(ro)") + } else { + ProgressUI.printDetail(" \(hostPath) -> \(agentMount.containerPath)\(ro) \u{1b}[33m(skipped, host path not found)\u{1b}[0m") + } + } + } + for mountSpec in extraMounts { + let ro = mountSpec.readOnly ? " (ro)" : "" + ProgressUI.printDetail(" \(mountSpec.hostPath) -> \(mountSpec.containerPath)\(ro)") + } + + // Setup networking. + let enableNetworking: Bool + var sharedNetwork: VmnetNetwork? + if #available(macOS 26, *) { + sharedNetwork = try VmnetNetwork() + enableNetworking = true + } else { + sharedNetwork = nil + enableNetworking = false + } + + // Pull the init image with progress if it hasn't been cached yet. + let initfsReference = config.initfsReference ?? SandboxyConfig.defaults.initfsReference! + _ = try await pullImageWithProgress(reference: initfsReference) + + var manager = try await ContainerManager( + kernel: kernel, + initfsReference: initfsReference, + root: Sandboxy.appRoot + ) + + /// MTU for vmnet interfaces. Lowered from the default 1500 to avoid + /// PMTU black-hole issues on networks that block ICMP fragmentation-needed. + let vmnetMTU: UInt32 = 1400 + + let containerId = "\(agentName)-\(ProcessInfo.processInfo.processIdentifier)" + + // + // Workload container setup + // + + // Determine rootfs source: named instance > agent cache > fresh install. + try FileManager.default.createDirectory(at: cacheDir, withIntermediateDirectories: true) + let containerRootfsPath = Sandboxy.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(containerId) + .appendingPathComponent("rootfs.ext4") + + let sourceRootfs: URL? + var needsInstall = false + + if options.reinstall { + removeIfExists(at: agentCachePath) + removeIfExists( + at: InstanceState.namedRootfsPath(appRoot: Sandboxy.appRoot, name: instanceName)) + sourceRootfs = nil + needsInstall = true + } else { + let namedPath = InstanceState.namedRootfsPath(appRoot: Sandboxy.appRoot, name: instanceName) + if FileManager.default.fileExists(atPath: namedPath.path(percentEncoded: false)) { + sourceRootfs = namedPath + } else if FileManager.default.fileExists(atPath: agentCachePath.path(percentEncoded: false)) { + sourceRootfs = agentCachePath + } else { + sourceRootfs = nil + needsInstall = true + } + } + + // Create workload container with full network for installation. + // After install, we recreate with the filtered network if needed. + var container: LinuxContainer + + if let sourceRootfs { + let containerDir = Sandboxy.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(containerId) + try FileManager.default.createDirectory(at: containerDir, withIntermediateDirectories: true) + + let result = Darwin.clonefile( + sourceRootfs.path(percentEncoded: false), + containerRootfsPath.path(percentEncoded: false), + 0 + ) + if result != 0 { + try FileManager.default.copyItem(at: sourceRootfs, to: containerRootfsPath) + } + + let rootfsMount = Mount.block( + format: "ext4", + source: containerRootfsPath.path(percentEncoded: false), + destination: "/", + runtimeOptions: ["vzDiskImageSynchronizationMode=fsync"] + ) + + let image = try await pullImageWithProgress(reference: definition.baseImage) + + container = try await manager.create( + containerId, + image: image, + rootfs: rootfsMount, + networking: false + ) { config in + if enableNetworking, let iface = try sharedNetwork?.createInterface(containerId, mtu: vmnetMTU) { + config.interfaces = [iface] + config.dns = .init(nameservers: [sharedNetwork!.ipv4Gateway.description]) + } + try configureContainer( + config: &config, + definition: definition, + options: options, + containerId: containerId, + hostWorkspacePath: hostWorkspacePath, + guestWorkspacePath: guestWorkspacePath, + extraMounts: extraMounts + ) + } + } else { + let progressConfig = try ProgressConfig( + showTasks: true, + showItems: true, + ignoreSmallSize: true, + totalTasks: 2 + ) + let progress = ProgressBar(config: progressConfig) + defer { progress.finish() } + progress.start() + + progress.set(description: "Pulling image (\(definition.baseImage))") + progress.set(itemsName: "blobs") + let image = try await Sandboxy.imageStore.pull( + reference: definition.baseImage, + progress: progressEventAdapter(for: progress) + ) + + progress.set(description: "Unpacking image") + container = try await manager.create( + containerId, + image: image, + rootfsSizeInBytes: 512.gib(), + networking: false + ) { config in + if enableNetworking, let iface = try sharedNetwork?.createInterface(containerId, mtu: vmnetMTU) { + config.interfaces = [iface] + config.dns = .init(nameservers: [sharedNetwork!.ipv4Gateway.description]) + } + try configureContainer( + config: &config, + definition: definition, + options: options, + containerId: containerId, + hostWorkspacePath: hostWorkspacePath, + guestWorkspacePath: guestWorkspacePath, + extraMounts: extraMounts + ) + } + } + + // Boot and install toolchain if needed (with full network). + if needsInstall { + try await container.create() + try await container.start() + + ProgressUI.printStatus("Installing \(definition.displayName) toolchain...") + try await installAgent(in: container, definition: definition) + ProgressUI.printStatus("Installation complete.") + + try await container.stop() + ProgressUI.printDetail("Caching environment for future runs...") + try FileManager.default.copyItem(at: containerRootfsPath, to: agentCachePath) + + // Delete so we can recreate (possibly on a different network). + try manager.delete(containerId) + try? sharedNetwork?.releaseInterface(containerId) + + // Recreate from the freshly-cached rootfs (unless filtering will recreate again). + if !filteringEnabled { + let cachedRootfsMount = Mount.block( + format: "ext4", + source: containerRootfsPath.path(percentEncoded: false), + destination: "/", + runtimeOptions: ["vzDiskImageSynchronizationMode=fsync"] + ) + let cachedImage = try await pullImageWithProgress(reference: definition.baseImage) + container = try await manager.create( + containerId, + image: cachedImage, + rootfs: cachedRootfsMount, + networking: false + ) { config in + if enableNetworking, let iface = try sharedNetwork?.createInterface(containerId, mtu: vmnetMTU) { + config.interfaces = [iface] + config.dns = .init(nameservers: [sharedNetwork!.ipv4Gateway.description]) + } + try configureContainer( + config: &config, + definition: definition, + options: options, + containerId: containerId, + hostWorkspacePath: hostWorkspacePath, + guestWorkspacePath: guestWorkspacePath, + extraMounts: extraMounts + ) + } + } + } + + // Host-only network setup (only when filtering is active) + var proxyIP: String? + var hostOnlyNetwork: VmnetNetwork? + + if filteringEnabled, enableNetworking, #available(macOS 26, *) { + hostOnlyNetwork = try VmnetNetwork(mode: .VMNET_HOST_MODE) + + let gatewayIP = hostOnlyNetwork!.ipv4Gateway.description + let workloadHostOnlyInterface = try hostOnlyNetwork!.createInterface(containerId, mtu: vmnetMTU) + proxyIP = gatewayIP + + // Recreate the workload container on the host-only network. + if !needsInstall { + try manager.delete(containerId) + try? sharedNetwork?.releaseInterface(containerId) + } + + let filteredContainerDir = Sandboxy.appRoot + .appendingPathComponent("containers") + .appendingPathComponent(containerId) + try FileManager.default.createDirectory(at: filteredContainerDir, withIntermediateDirectories: true) + + let filteredRootfsSource = needsInstall ? agentCachePath : (sourceRootfs ?? agentCachePath) + let cloneResult2 = Darwin.clonefile( + filteredRootfsSource.path(percentEncoded: false), + containerRootfsPath.path(percentEncoded: false), + 0 + ) + if cloneResult2 != 0 { + try FileManager.default.copyItem(at: filteredRootfsSource, to: containerRootfsPath) + } + + let filteredRootfsMount = Mount.block( + format: "ext4", + source: containerRootfsPath.path(percentEncoded: false), + destination: "/", + runtimeOptions: ["vzDiskImageSynchronizationMode=fsync"] + ) + + let image = try await pullImageWithProgress(reference: definition.baseImage) + + container = try await manager.create( + containerId, + image: image, + rootfs: filteredRootfsMount, + networking: false + ) { config in + if let iface = workloadHostOnlyInterface { + config.interfaces = [iface] + config.dns = .init(nameservers: [gatewayIP]) + } + try configureContainer( + config: &config, + definition: definition, + options: options, + containerId: containerId, + hostWorkspacePath: hostWorkspacePath, + guestWorkspacePath: guestWorkspacePath, + extraMounts: extraMounts + ) + } + } + + // Run the container session, cleaning up on both success and failure. + do { + try await runContainerSession( + container: container, + containerId: containerId, + instanceName: instanceName, + agentName: agentName, + definition: definition, + options: options, + containerRootfsPath: containerRootfsPath, + agentCachePath: agentCachePath, + hostWorkspacePath: hostWorkspacePath, + guestWorkspacePath: guestWorkspacePath, + extraEnvVars: extraEnvVars, + proxyIP: proxyIP, + allowedHosts: allowedHosts, + passthroughArgs: filteredPassthroughArgs + ) + + // Cleanup + try manager.delete(containerId) + try? sharedNetwork?.releaseInterface(containerId) + if hostOnlyNetwork != nil { + try? hostOnlyNetwork?.releaseInterface(containerId) + } + } catch { + do { + try await container.stop() + } catch { + log.warning("Failed to stop container \(containerId): \(error)") + } + do { + try manager.delete(containerId) + } catch { + log.warning("Failed to delete container \(containerId): \(error)") + } + try? sharedNetwork?.releaseInterface(containerId) + if hostOnlyNetwork != nil { + try? hostOnlyNetwork?.releaseInterface(containerId) + } + throw error + } +} + +private func runContainerSession( + container: LinuxContainer, + containerId: String, + instanceName: String, + agentName: String, + definition: AgentDefinition, + options: AgentOptions, + containerRootfsPath: URL, + agentCachePath: URL, + hostWorkspacePath: String, + guestWorkspacePath: String, + extraEnvVars: [String], + proxyIP: String?, + allowedHosts: [String], + passthroughArgs: [String] +) async throws { + // create() boots the VM and brings up the vmnet bridge on the host. + try await container.create() + + // Start the proxy now that the bridge interface is up. + var hostProxy: HostProxy? + if let proxyIP { + let proxy = try await HostProxy( + host: proxyIP, + port: 0, + allowedHosts: allowedHosts + ) + hostProxy = proxy + } + + // start() launches the container process. + try await container.start() + + // Write instance state. + let instanceState = InstanceState( + id: containerId, + name: instanceName, + agent: agentName, + workspace: hostWorkspacePath, + status: .running, + createdAt: Date(), + cpus: options.cpus, + memoryMB: try options.memoryBytes / (1024 * 1024) + ) + try instanceState.save(appRoot: Sandboxy.appRoot) + + let sigwinchStream = AsyncSignalHandler.create(notify: [SIGWINCH]) + let current = try Terminal.current + try current.setraw() + defer { current.tryReset() } + + // Build environment for the agent process. + var envVarsBuilder = [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "TERM=xterm-256color", + "HOME=/root", + ] + for envVar in definition.environmentVariables { + if envVar.contains("=") { + envVarsBuilder.append(envVar) + } else if let value = ProcessInfo.processInfo.environment[envVar] { + envVarsBuilder.append("\(envVar)=\(value)") + } + } + + envVarsBuilder.append(contentsOf: extraEnvVars) + + if options.sshAgent, ProcessInfo.processInfo.environment["SSH_AUTH_SOCK"] != nil { + envVarsBuilder.append("SSH_AUTH_SOCK=/tmp/ssh-agent.sock") + } + + if let proxyIP, let proxyPort = hostProxy?.port { + let proxyURL = "http://\(proxyIP):\(proxyPort)" + envVarsBuilder.append("HTTP_PROXY=\(proxyURL)") + envVarsBuilder.append("HTTPS_PROXY=\(proxyURL)") + envVarsBuilder.append("http_proxy=\(proxyURL)") + envVarsBuilder.append("https_proxy=\(proxyURL)") + envVarsBuilder.append("NO_PROXY=localhost,127.0.0.1") + envVarsBuilder.append("no_proxy=localhost,127.0.0.1") + envVarsBuilder.append("GLOBAL_AGENT_HTTP_PROXY=\(proxyURL)") + envVarsBuilder.append("GLOBAL_AGENT_HTTPS_PROXY=\(proxyURL)") + envVarsBuilder.append("GLOBAL_AGENT_NO_PROXY=localhost,127.0.0.1") + + // Prepend global-agent bootstrap to NODE_OPTIONS so Node.js http/https + // modules respect the proxy environment variables. + if let idx = envVarsBuilder.firstIndex(where: { $0.hasPrefix("NODE_OPTIONS=") }) { + let existing = String(envVarsBuilder[idx].dropFirst("NODE_OPTIONS=".count)) + envVarsBuilder[idx] = "NODE_OPTIONS=-r /usr/local/lib/node_modules/global-agent/dist/routines/bootstrap.js \(existing)" + } else { + envVarsBuilder.append("NODE_OPTIONS=-r /usr/local/lib/node_modules/global-agent/dist/routines/bootstrap.js") + } + } + + var launchArgsBuilder = definition.launchCommand + launchArgsBuilder.append(contentsOf: passthroughArgs) + + let envVars = envVarsBuilder + let launchArgs = launchArgsBuilder + + let agentProcess = try await container.exec("agent-session") { config in + config.arguments = launchArgs + config.environmentVariables = envVars + config.workingDirectory = guestWorkspacePath + config.terminal = true + config.stdin = current + config.stdout = current + } + + try await agentProcess.start() + try? await agentProcess.resize(to: try current.size) + + try await withThrowingTaskGroup(of: Void.self) { group in + group.addTask { + for await _ in sigwinchStream.signals { + try await agentProcess.resize(to: try current.size) + } + } + + let status = try await agentProcess.wait() + group.cancelAll() + + try await agentProcess.delete() + + // Stop container so rootfs is cleanly unmounted before caching. + try await container.stop() + + if options.removeAfterRun { + ProgressUI.printStatus("Instance \u{1b}[1m\(instanceName)\u{1b}[0m removed (--rm).") + } else { + // Preserve the rootfs for all instances. + let namedDir = InstanceState.namedRootfsDir(appRoot: Sandboxy.appRoot) + try FileManager.default.createDirectory(at: namedDir, withIntermediateDirectories: true) + let namedPath = InstanceState.namedRootfsPath(appRoot: Sandboxy.appRoot, name: instanceName) + removeIfExists(at: namedPath) + try FileManager.default.copyItem(at: containerRootfsPath, to: namedPath) + + let stopped = InstanceState( + id: instanceState.id, + name: instanceState.name, + agent: instanceState.agent, + workspace: instanceState.workspace, + status: .stopped, + createdAt: instanceState.createdAt, + stoppedAt: Date(), + cpus: instanceState.cpus, + memoryMB: instanceState.memoryMB + ) + try stopped.save(appRoot: Sandboxy.appRoot) + + ProgressUI.printStatus("Instance \u{1b}[1m\(instanceName)\u{1b}[0m saved. Resume with: sandboxy run \(agentName) --name \(instanceName)") + } + + if status.exitCode != 0 { + throw ExitCode(status.exitCode) + } + } + + if let proxy = hostProxy { + try await proxy.stop() + } +} + +private func configureContainer( + config: inout LinuxContainer.Configuration, + definition: AgentDefinition, + options: AgentOptions, + containerId: String, + hostWorkspacePath: String, + guestWorkspacePath: String, + extraMounts: [MountSpec] +) throws { + config.cpus = options.cpus + config.memoryInBytes = try options.memoryBytes + + config.process.arguments = ["/bin/sleep", "infinity"] + config.process.workingDirectory = "/" + config.process.capabilities = .allCapabilities + config.useInit = true + + // SSH agent forwarding. + if options.sshAgent, + let authSock = ProcessInfo.processInfo.environment["SSH_AUTH_SOCK"] + { + let guestSocketPath = "/tmp/ssh-agent.sock" + config.sockets.append( + UnixSocketConfiguration( + source: URL(fileURLWithPath: authSock), + destination: URL(fileURLWithPath: guestSocketPath), + direction: .into + ) + ) + } + + config.mounts.append( + Mount.share( + source: hostWorkspacePath, + destination: guestWorkspacePath + ) + ) + + if !options.noAgentMounts { + for agentMount in definition.mounts { + let hostPath = agentMount.resolvedHostPath + if FileManager.default.fileExists(atPath: hostPath) { + config.mounts.append( + Mount.share( + source: hostPath, + destination: agentMount.containerPath, + options: agentMount.readOnly ? ["ro"] : [] + ) + ) + } + } + } + + for mountSpec in extraMounts { + config.mounts.append(mountSpec.toMount()) + } + + var hosts = Hosts.default + if #available(macOS 26, *), !config.interfaces.isEmpty { + let interface = config.interfaces[0] + hosts.entries.append( + Hosts.Entry( + ipAddress: interface.ipv4Address.address.description, + hostnames: [containerId] + ) + ) + } + config.hosts = hosts +} + +func installAgent( + in container: LinuxContainer, + definition: AgentDefinition +) async throws { + for (index, command) in definition.installCommands.enumerated() { + let truncated = command.count > 80 ? String(command.prefix(77)) + "..." : command + ProgressUI.printDetail("[\(index + 1)/\(definition.installCommands.count)] \(truncated)") + + let buffer = OutputCapture(streamToStdout: true) + let execId = "install-\(index)" + let process = try await container.exec(execId) { config in + config.arguments = ["/bin/sh", "-c", command] + config.workingDirectory = "/" + config.stdout = buffer + config.stderr = buffer + config.capabilities = .allCapabilities + config.environmentVariables = [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DEBIAN_FRONTEND=noninteractive", + "HOME=/root", + ] + } + + try await process.start() + let status = try await process.wait() + try await process.delete() + + guard status.exitCode == 0 else { + throw SandboxyError.installFailed( + step: index + 1, + command: command, + exitCode: status.exitCode + ) + } + } +} + +func removeIfExists(at url: URL) { + let path = url.path(percentEncoded: false) + if FileManager.default.fileExists(atPath: path) { + do { + try FileManager.default.removeItem(at: url) + } catch { + log.warning("Failed to remove \(path): \(error)") + } + } +} + +/// A parsed `hostpath:containerpath[:ro|rw]` mount specification from the CLI. +struct MountSpec { + let hostPath: String + let containerPath: String + let readOnly: Bool + + static func parse(_ spec: String) throws -> MountSpec { + let parts = spec.split(separator: ":", maxSplits: 2).map(String.init) + guard parts.count >= 2 else { + throw SandboxyError.invalidMountSpec(spec: spec) + } + + let readOnly: Bool + if parts.count == 3 { + switch parts[2] { + case "ro": + readOnly = true + case "rw": + readOnly = false + default: + throw SandboxyError.invalidMountSpec(spec: spec) + } + } else { + readOnly = false + } + + // Resolve host path to absolute. + let hostPath = URL(fileURLWithPath: parts[0], relativeTo: .currentDirectory()) + .absoluteURL.path(percentEncoded: false) + + return MountSpec(hostPath: hostPath, containerPath: parts[1], readOnly: readOnly) + } + + func toMount() -> Containerization.Mount { + Containerization.Mount.share( + source: hostPath, + destination: containerPath, + options: readOnly ? ["ro"] : [] + ) + } +} + +func progressEventAdapter(for progress: ProgressBar) -> ProgressHandler { + { events in + for event in events { + switch event.event { + case "add-size": + if let value = event.value as? Int64 { + progress.add(size: value) + } + case "add-total-size": + if let value = event.value as? Int64 { + progress.add(totalSize: value) + } + case "add-items": + if let value = event.value as? Int { + progress.add(items: value) + } + case "add-total-items": + if let value = event.value as? Int { + progress.add(totalItems: value) + } + default: + break + } + } + } +} + +/// Pulls an image, showing a progress bar only if the image isn't already cached locally. +func pullImageWithProgress(reference: String) async throws -> Containerization.Image { + do { + return try await Sandboxy.imageStore.get(reference: reference) + } catch { + let progressConfig = try ProgressConfig( + description: "Pulling image (\(reference))", + showItems: true, + ignoreSmallSize: true + ) + let progress = ProgressBar(config: progressConfig) + defer { progress.finish() } + progress.start() + progress.set(itemsName: "blobs") + return try await Sandboxy.imageStore.pull( + reference: reference, + progress: progressEventAdapter(for: progress) + ) + } +} + +/// Resolves a `KEY=VALUE` or `KEY` environment variable specification. +/// +/// - `KEY=VALUE`: passed through as-is. +/// - `KEY`: looks up the variable in the host environment and produces `KEY=`. +/// Throws if the variable is not set. +enum EnvSpec { + static func resolve(_ spec: String) throws -> String { + if let eqIndex = spec.firstIndex(of: "=") { + // KEY=VALUE: Use as-is, but validate key is non-empty. + let key = spec[spec.startIndex.. SandboxyConfig { + let fm = FileManager.default + let agentsDir = configRoot.appendingPathComponent("agents") + try fm.createDirectory(at: agentsDir, withIntermediateDirectories: true) + + let config = try SandboxyConfig.load(configRoot: configRoot) + if let dataDir = config.dataDir { + appRoot = URL(fileURLWithPath: dataDir) + } + + try fm.createDirectory(at: appRoot, withIntermediateDirectories: true) + return config + } + + /// User configuration directory (`~/.config/sandboxy/`). + /// Holds `config.json` and `agents/` definition files. + static let configRoot: URL = { + FileManager.default.homeDirectoryForCurrentUser + .appendingPathComponent(".config") + .appendingPathComponent("sandboxy") + }() + + private static let _contentStore: ContentStore = { + try! LocalContentStore(path: appRoot.appendingPathComponent("content")) + }() + + private static let _imageStore: ImageStore = { + try! ImageStore( + path: appRoot, + contentStore: contentStore + ) + }() + + static var imageStore: ImageStore { + _imageStore + } + + static var contentStore: ContentStore { + _contentStore + } +} diff --git a/examples/sandboxy/Sources/sandboxy/SandboxyConfig.swift b/examples/sandboxy/Sources/sandboxy/SandboxyConfig.swift new file mode 100644 index 0000000..d946970 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/SandboxyConfig.swift @@ -0,0 +1,81 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// Optional configuration file for overriding sandboxy defaults. +/// +/// If `config.json` exists in the sandboxy config directory, it is +/// loaded at startup and its values override the built-in defaults. Any field +/// can be omitted to keep the default. +/// +/// Location: `~/.config/sandboxy/config.json` +/// +/// Example: +/// ```json +/// { +/// "dataDir": "/Volumes/fast/sandboxy", +/// "kernel": "/path/to/vmlinux", +/// "initfsReference": "ghcr.io/apple/containerization/vminit:latest", +/// "defaultCPUs": 4, +/// "defaultMemory": "4g" +/// } +/// ``` +struct SandboxyConfig: Codable, Sendable { + /// Directory for runtime data (caches, content store, containers). + /// Defaults to `~/Library/Application Support/com.apple.containerization.sandboxy`. + var dataDir: String? + /// Path to a Linux kernel binary on disk. When set, the auto-download is skipped. + var kernel: String? + /// OCI reference for the VM init image. + var initfsReference: String? + /// Default number of CPUs for new containers. + var defaultCPUs: Int? + /// Default memory for new containers (e.g. "4g", "512m", "4096" for MB). + var defaultMemory: String? + + /// Built-in defaults used when no config file is present. + static let defaults = SandboxyConfig( + initfsReference: "ghcr.io/apple/containerization/vminit:0.30.0", + defaultCPUs: 4, + defaultMemory: "4g" + ) + + /// Loads the config from `/config.json`, falling back to defaults + /// for any missing fields. + static func load(configRoot: URL) throws -> SandboxyConfig { + let configPath = configRoot.appendingPathComponent("config.json") + + guard FileManager.default.fileExists(atPath: configPath.path(percentEncoded: false)) else { + return .defaults + } + + do { + let data = try Data(contentsOf: configPath) + let userConfig = try JSONDecoder().decode(SandboxyConfig.self, from: data) + + return SandboxyConfig( + dataDir: userConfig.dataDir, + kernel: userConfig.kernel, + initfsReference: userConfig.initfsReference ?? defaults.initfsReference, + defaultCPUs: userConfig.defaultCPUs ?? defaults.defaultCPUs, + defaultMemory: userConfig.defaultMemory ?? defaults.defaultMemory + ) + } catch { + throw SandboxyError.configFailedToLoad(error: error) + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/SandboxyError.swift b/examples/sandboxy/Sources/sandboxy/SandboxyError.swift new file mode 100644 index 0000000..d112c97 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/SandboxyError.swift @@ -0,0 +1,52 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +enum SandboxyError: Error, CustomStringConvertible { + case configFailedToLoad(error: Swift.Error) + case installFailed(step: Int, command: String, exitCode: Int32) + case kernelDownloadFailed(reason: String) + case proxyFailed(reason: String) + case kernelNotFound(path: String) + case incompleteAgentDefinition(missing: [String]) + case invalidMountSpec(spec: String) + case envVarNotSet(name: String) + + var description: String { + switch self { + case .configFailedToLoad(let error): + return "Failed to load sandbox config: \(error)" + case .installFailed(let step, let command, let exitCode): + return """ + Installation step \(step) failed (exit code \(exitCode)). + Command: \(command) + """ + case .kernelDownloadFailed(let reason): + return "Failed to download kernel: \(reason)" + case .proxyFailed(let reason): + return "Proxy failed: \(reason)" + case .kernelNotFound(let path): + return "Kernel not found at \(path). Provide a valid path with -k or omit to auto-download." + case .incompleteAgentDefinition(let missing): + return "Agent definition is missing required fields: \(missing.joined(separator: ", ")). Use 'sandboxy config --agent claude' to see a complete example." + case .invalidMountSpec(let spec): + return "Invalid mount specification: '\(spec)'. Expected format: hostpath:containerpath[:ro|rw]" + case .envVarNotSet(let name): + return "Environment variable '\(name)' is not set on the host." + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int+Formatted.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int+Formatted.swift new file mode 100644 index 0000000..28f7ee2 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int+Formatted.swift @@ -0,0 +1,52 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension Int { + func formattedTime() -> String { + let secondsInMinute = 60 + let secondsInHour = secondsInMinute * 60 + let secondsInDay = secondsInHour * 24 + + let days = self / secondsInDay + let hours = (self % secondsInDay) / secondsInHour + let minutes = (self % secondsInHour) / secondsInMinute + let seconds = self % secondsInMinute + + var components = [String]() + if days > 0 { + components.append("\(days)d") + } + if hours > 0 || days > 0 { + components.append("\(hours)h") + } + if minutes > 0 || hours > 0 || days > 0 { + components.append("\(minutes)m") + } + components.append("\(seconds)s") + return components.joined(separator: " ") + } + + func formattedNumber() -> String { + let formatter = NumberFormatter() + formatter.numberStyle = .decimal + guard let formattedNumber = formatter.string(from: NSNumber(value: self)) else { + return "" + } + return formattedNumber + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int64+Formatted.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int64+Formatted.swift new file mode 100644 index 0000000..34b73ff --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/Int64+Formatted.swift @@ -0,0 +1,36 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension Int64 { + func formattedSize() -> String { + let formattedSize = ByteCountFormatter.string(fromByteCount: self, countStyle: .binary) + return formattedSize + } + + func formattedSizeSpeed(from startTime: DispatchTime) -> String { + let elapsedTimeNanoseconds = DispatchTime.now().uptimeNanoseconds - startTime.uptimeNanoseconds + let elapsedTimeSeconds = Double(elapsedTimeNanoseconds) / 1_000_000_000 + guard elapsedTimeSeconds > 0 else { + return "0 B/s" + } + + let speed = Double(self) / elapsedTimeSeconds + let formattedSpeed = ByteCountFormatter.string(fromByteCount: Int64(speed), countStyle: .binary) + return "\(formattedSpeed)/s" + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Add.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Add.swift new file mode 100644 index 0000000..3710895 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Add.swift @@ -0,0 +1,236 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension ProgressBar { + /// A handler function to update the progress bar. + /// - Parameter events: The events to handle. + public func handler(_ events: [ProgressUpdateEvent]) { + for event in events { + switch event { + case .setDescription(let description): + set(description: description) + case .setSubDescription(let subDescription): + set(subDescription: subDescription) + case .setItemsName(let itemsName): + set(itemsName: itemsName) + case .addTasks(let tasks): + add(tasks: tasks) + case .setTasks(let tasks): + set(tasks: tasks) + case .addTotalTasks(let totalTasks): + add(totalTasks: totalTasks) + case .setTotalTasks(let totalTasks): + set(totalTasks: totalTasks) + case .addSize(let size): + add(size: size) + case .setSize(let size): + set(size: size) + case .addTotalSize(let totalSize): + add(totalSize: totalSize) + case .setTotalSize(let totalSize): + set(totalSize: totalSize) + case .addItems(let items): + add(items: items) + case .setItems(let items): + set(items: items) + case .addTotalItems(let totalItems): + add(totalItems: totalItems) + case .setTotalItems(let totalItems): + set(totalItems: totalItems) + case .custom: + // Custom events are handled by the client. + break + } + } + } + + /// Performs a check to see if the progress bar should be finished. + public func checkIfFinished() { + let state = self.state.withLock { $0 } + + var finished = true + var defined = false + if let totalTasks = state.totalTasks, totalTasks > 0 { + // For tasks, we're showing the current task rather than the number of completed tasks. + finished = finished && state.tasks == totalTasks + defined = true + } + if let totalItems = state.totalItems, totalItems > 0 { + finished = finished && state.items == totalItems + defined = true + } + if let totalSize = state.totalSize, totalSize > 0 { + finished = finished && state.size == totalSize + defined = true + } + if defined && finished { + finish() + } + } + + /// Sets the current tasks. + /// - Parameter newTasks: The current tasks to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(tasks newTasks: Int, render: Bool = true) { + state.withLock { $0.tasks = newTasks } + if render { + self.render() + } + checkIfFinished() + } + + /// Performs an addition to the current tasks. + /// - Parameter delta: The tasks to add to the current tasks. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(tasks delta: Int, render: Bool = true) { + state.withLock { + let newTasks = $0.tasks + delta + $0.tasks = newTasks + } + if render { + self.render() + } + } + + /// Sets the total tasks. + /// - Parameter newTotalTasks: The total tasks to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(totalTasks newTotalTasks: Int, render: Bool = true) { + state.withLock { $0.totalTasks = newTotalTasks } + if render { + self.render() + } + } + + /// Performs an addition to the total tasks. + /// - Parameter delta: The tasks to add to the total tasks. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(totalTasks delta: Int, render: Bool = true) { + state.withLock { + let totalTasks = $0.totalTasks ?? 0 + let newTotalTasks = totalTasks + delta + $0.totalTasks = newTotalTasks + } + if render { + self.render() + } + } + + /// Sets the items name. + /// - Parameter newItemsName: The current items to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(itemsName newItemsName: String, render: Bool = true) { + state.withLock { $0.itemsName = newItemsName } + if render { + self.render() + } + } + + /// Sets the current items. + /// - Parameter newItems: The current items to set. + public func set(items newItems: Int, render: Bool = true) { + state.withLock { $0.items = newItems } + if render { + self.render() + } + } + + /// Performs an addition to the current items. + /// - Parameter delta: The items to add to the current items. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(items delta: Int, render: Bool = true) { + state.withLock { + let newItems = $0.items + delta + $0.items = newItems + } + if render { + self.render() + } + } + + /// Sets the total items. + /// - Parameter newTotalItems: The total items to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(totalItems newTotalItems: Int, render: Bool = true) { + state.withLock { $0.totalItems = newTotalItems } + if render { + self.render() + } + } + + /// Performs an addition to the total items. + /// - Parameter delta: The items to add to the total items. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(totalItems delta: Int, render: Bool = true) { + state.withLock { + let totalItems = $0.totalItems ?? 0 + let newTotalItems = totalItems + delta + $0.totalItems = newTotalItems + } + if render { + self.render() + } + } + + /// Sets the current size. + /// - Parameter newSize: The current size to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(size newSize: Int64, render: Bool = true) { + state.withLock { $0.size = newSize } + if render { + self.render() + } + } + + /// Performs an addition to the current size. + /// - Parameter delta: The size to add to the current size. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(size delta: Int64, render: Bool = true) { + state.withLock { + let newSize = $0.size + delta + $0.size = newSize + } + if render { + self.render() + } + } + + /// Sets the total size. + /// - Parameter newTotalSize: The total size to set. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func set(totalSize newTotalSize: Int64, render: Bool = true) { + state.withLock { $0.totalSize = newTotalSize } + if render { + self.render() + } + } + + /// Performs an addition to the total size. + /// - Parameter delta: The size to add to the total size. + /// - Parameter render: The flag indicating whether the progress bar has to render after the update. + public func add(totalSize delta: Int64, render: Bool = true) { + state.withLock { + let totalSize = $0.totalSize ?? 0 + let newTotalSize = totalSize + delta + $0.totalSize = newTotalSize + } + if render { + self.render() + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+State.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+State.swift new file mode 100644 index 0000000..0771e79 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+State.swift @@ -0,0 +1,100 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +extension ProgressBar { + /// State for the progress bar. + struct State { + /// A flag indicating whether the progress bar is finished. + var finished = false + var iteration = 0 + private let speedInterval: DispatchTimeInterval = .seconds(1) + + var description: String + var subDescription: String + var itemsName: String + + var tasks: Int + var totalTasks: Int? + + var items: Int + var totalItems: Int? + + private var sizeUpdateTime: DispatchTime? + private var sizeUpdateValue: Int64 = 0 + var size: Int64 { + didSet { + calculateSizeSpeed() + } + } + + var totalSize: Int64? + private var sizeUpdateSpeed: String? + var sizeSpeed: String? { + guard sizeUpdateTime == nil || sizeUpdateTime! > .now() - speedInterval - speedInterval else { + return Int64(0).formattedSizeSpeed(from: startTime) + } + return sizeUpdateSpeed + } + var averageSizeSpeed: String { + size.formattedSizeSpeed(from: startTime) + } + + var percent: String { + var value = 0 + if let totalSize, totalSize > 0 { + value = Int(size * 100 / totalSize) + } else if let totalItems, totalItems > 0 { + value = Int(items * 100 / totalItems) + } + value = min(value, 100) + return "\(value)%" + } + + var startTime: DispatchTime + var output = "" + var renderTask: Task? + + init( + description: String = "", subDescription: String = "", itemsName: String = "", tasks: Int = 0, totalTasks: Int? = nil, items: Int = 0, totalItems: Int? = nil, + size: Int64 = 0, totalSize: Int64? = nil, startTime: DispatchTime = .now() + ) { + self.description = description + self.subDescription = subDescription + self.itemsName = itemsName + self.tasks = tasks + self.totalTasks = totalTasks + self.items = items + self.totalItems = totalItems + self.size = size + self.totalSize = totalSize + self.startTime = startTime + } + + private mutating func calculateSizeSpeed() { + if sizeUpdateTime == nil || sizeUpdateTime! < .now() - speedInterval { + let partSize = size - sizeUpdateValue + let partStartTime = sizeUpdateTime ?? startTime + let partSizeSpeed = partSize.formattedSizeSpeed(from: partStartTime) + self.sizeUpdateSpeed = partSizeSpeed + + sizeUpdateTime = .now() + sizeUpdateValue = size + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Terminal.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Terminal.swift new file mode 100644 index 0000000..ce84cc5 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressBar+Terminal.swift @@ -0,0 +1,95 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ContainerizationOS +import Foundation + +enum EscapeSequence { + static let hideCursor = "\u{001B}[?25l" + static let showCursor = "\u{001B}[?25h" + static let moveUp = "\u{001B}[1A" + static let clearToEndOfLine = "\u{001B}[K" +} + +extension ProgressBar { + var termWidth: Int { + guard + let terminalHandle = term, + let terminal = try? Terminal(descriptor: terminalHandle.fileDescriptor) + else { + return 0 + } + + return (try? Int(terminal.size.width)) ?? 0 + } + + /// Clears the progress bar and resets the cursor. + public func clearAndResetCursor() { + state.withLock { s in + clear(state: &s) + resetCursor() + } + } + + /// Clears the progress bar. + public func clear() { + state.withLock { s in + clear(state: &s) + } + } + + /// Clears the progress bar (caller must hold state lock). + func clear(state: inout State) { + displayText("", state: &state) + } + + /// Resets the cursor. + public func resetCursor() { + display(EscapeSequence.showCursor) + } + + func display(_ text: String) { + guard let term else { + return + } + termQueue.sync { + try? term.write(contentsOf: Data(text.utf8)) + try? term.synchronize() + } + } + + func displayText(_ text: String, terminating: String = "\r") { + state.withLock { s in + displayText(text, state: &s, terminating: terminating) + } + } + + func displayText(_ text: String, state: inout State, terminating: String = "\r") { + state.output = text + + // Clears previously printed lines. + var lines = "" + if terminating.hasSuffix("\r") && termWidth > 0 { + let lineCount = (text.count - 1) / termWidth + for _ in 0.. + let term: FileHandle? + let termQueue = DispatchQueue(label: "com.apple.container.ProgressBar") + + /// Returns `true` if the progress bar has finished. + public var isFinished: Bool { + state.withLock { $0.finished } + } + + /// Creates a new progress bar. + /// - Parameter config: The configuration for the progress bar. + public init(config: ProgressConfig) { + self.config = config + term = isatty(config.terminal.fileDescriptor) == 1 ? config.terminal : nil + let state = State( + description: config.initialDescription, itemsName: config.initialItemsName, totalTasks: config.initialTotalTasks, + totalItems: config.initialTotalItems, + totalSize: config.initialTotalSize) + self.state = Mutex(state) + display(EscapeSequence.hideCursor) + } + + /// Allows resetting the progress state. + public func reset() { + state.withLock { + $0 = State(description: config.initialDescription) + } + } + + /// Allows resetting the progress state of the current task. + public func resetCurrentTask() { + state.withLock { + $0 = State(description: $0.description, itemsName: $0.itemsName, tasks: $0.tasks, totalTasks: $0.totalTasks, startTime: $0.startTime) + } + } + + /// Updates the description of the progress bar and increments the tasks by one. + /// - Parameter description: The description of the action being performed. + public func set(description: String) { + resetCurrentTask() + + state.withLock { + $0.description = description + $0.subDescription = "" + $0.tasks += 1 + } + } + + /// Updates the additional description of the progress bar. + /// - Parameter subDescription: The additional description of the action being performed. + public func set(subDescription: String) { + resetCurrentTask() + + state.withLock { $0.subDescription = subDescription } + } + + private func start(intervalSeconds: TimeInterval) async { + while true { + let done = state.withLock { s -> Bool in + guard !s.finished else { + return true + } + render(state: &s) + s.iteration += 1 + return false + } + + if done { + return + } + + let intervalNanoseconds = UInt64(intervalSeconds * 1_000_000_000) + guard (try? await Task.sleep(nanoseconds: intervalNanoseconds)) != nil else { + return + } + } + } + + /// Starts an animation of the progress bar. + /// - Parameter intervalSeconds: The time interval between updates in seconds. + public func start(intervalSeconds: TimeInterval = 0.04) { + state.withLock { + if $0.renderTask != nil { + return + } + $0.renderTask = Task(priority: .utility) { + await start(intervalSeconds: intervalSeconds) + } + } + } + + /// Finishes the progress bar. + /// - Parameter clearScreen: If true, clears the progress bar from the screen. + public func finish(clearScreen: Bool = false) { + state.withLock { s in + guard !s.finished else { return } + + s.finished = true + s.renderTask?.cancel() + + let shouldClear = clearScreen || config.clearOnFinish + if !config.disableProgressUpdates && !shouldClear { + let output = draw(state: s) + displayText(output, state: &s, terminating: "\n") + } + + if shouldClear { + clear(state: &s) + } + resetCursor() + } + } +} + +extension ProgressBar { + private func secondsSinceStart(from startTime: DispatchTime) -> Int { + let timeDifferenceNanoseconds = DispatchTime.now().uptimeNanoseconds - startTime.uptimeNanoseconds + let timeDifferenceSeconds = Int(floor(Double(timeDifferenceNanoseconds) / 1_000_000_000)) + return timeDifferenceSeconds + } + + func render(force: Bool = false) { + guard term != nil && !config.disableProgressUpdates else { + return + } + state.withLock { s in + render(state: &s, force: force) + } + } + + func render(state: inout State, force: Bool = false) { + guard term != nil && !config.disableProgressUpdates else { + return + } + guard force || !state.finished else { + return + } + let output = draw(state: state) + displayText(output, state: &state) + } + + /// Detail levels for progressive truncation. + enum DetailLevel: Int, CaseIterable { + case full = 0 // Everything shown + case noSpeed // Drop speed from parens + case noSize // Drop size from parens + case noParens // Drop parens entirely (items, size, speed) + case noTime // Drop time + case noDescription // Drop description/subdescription + case minimal // Just spinner, tasks, percent + } + + func draw(state: State) -> String { + let width = termWidth + // If no terminal or width unknown, use full detail + guard width > 0 else { + return draw(state: state, detail: .full) + } + + // Add a small buffer to prevent wrapping issues during resize + let bufferChars = 4 + let targetWidth = max(1, width - bufferChars) + + for detail in DetailLevel.allCases { + let output = draw(state: state, detail: detail) + if output.count <= targetWidth { + return output + } + } + + return draw(state: state, detail: .minimal) + } + + func draw(state: State, detail: DetailLevel) -> String { + var components = [String]() + + // Spinner - always shown if configured (unless using progress bar) + if config.showSpinner && !config.showProgressBar { + if !state.finished { + let spinnerIcon = config.theme.getSpinnerIcon(state.iteration) + components.append("\(spinnerIcon)") + } else { + components.append("\(config.theme.done)") + } + } + + // Tasks [x/y] - always shown if configured + if config.showTasks, let totalTasks = state.totalTasks { + let tasks = min(state.tasks, totalTasks) + components.append("[\(tasks)/\(totalTasks)]") + } + + // Description - dropped at noDescription level + if detail.rawValue < DetailLevel.noDescription.rawValue { + if config.showDescription && !state.description.isEmpty { + components.append("\(state.description)") + if !state.subDescription.isEmpty { + components.append("\(state.subDescription)") + } + } + } + + let allowProgress = !config.ignoreSmallSize || state.totalSize == nil || state.totalSize! > Int64(1024 * 1024) + let value = state.totalSize != nil ? state.size : Int64(state.items) + let total = state.totalSize ?? Int64(state.totalItems ?? 0) + + // Percent - always shown if configured + if config.showPercent && total > 0 && allowProgress { + components.append("\(state.finished ? "100%" : state.percent)") + } + + // Progress bar - always shown if configured + if config.showProgressBar, total > 0, allowProgress { + let usedWidth = components.joined(separator: " ").count + 45 + let remainingWidth = max(config.width - usedWidth, 1) + let barLength = state.finished ? remainingWidth : Int(Int64(remainingWidth) * value / total) + let barPaddingLength = remainingWidth - barLength + let bar = "\(String(repeating: config.theme.bar, count: barLength))\(String(repeating: " ", count: barPaddingLength))" + components.append("|\(bar)|") + } + + // Additional components in parens - progressively dropped + if detail.rawValue < DetailLevel.noParens.rawValue { + var additionalComponents = [String]() + + // Items - dropped at noParens level + if config.showItems, state.items > 0 { + var itemsName = "" + if !state.itemsName.isEmpty { + itemsName = " \(state.itemsName)" + } + if state.finished { + if let totalItems = state.totalItems { + additionalComponents.append("\(totalItems.formattedNumber())\(itemsName)") + } + } else { + if let totalItems = state.totalItems { + additionalComponents.append("\(state.items.formattedNumber()) of \(totalItems.formattedNumber())\(itemsName)") + } else { + additionalComponents.append("\(state.items.formattedNumber())\(itemsName)") + } + } + } + + // Size and speed - progressively dropped + if state.size > 0 && allowProgress { + if state.finished { + // Size - dropped at noSize level + if detail.rawValue < DetailLevel.noSize.rawValue { + if config.showSize { + if let totalSize = state.totalSize { + var formattedTotalSize = totalSize.formattedSize() + formattedTotalSize = adjustFormattedSize(formattedTotalSize) + additionalComponents.append(formattedTotalSize) + } + } + } + } else { + // Size - dropped at noSize level + var formattedCombinedSize = "" + if detail.rawValue < DetailLevel.noSize.rawValue && config.showSize { + var formattedSize = state.size.formattedSize() + formattedSize = adjustFormattedSize(formattedSize) + if let totalSize = state.totalSize { + var formattedTotalSize = totalSize.formattedSize() + formattedTotalSize = adjustFormattedSize(formattedTotalSize) + formattedCombinedSize = combineSize(size: formattedSize, totalSize: formattedTotalSize) + } else { + formattedCombinedSize = formattedSize + } + } + + // Speed - dropped at noSpeed level + var formattedSpeed = "" + if detail.rawValue < DetailLevel.noSpeed.rawValue && config.showSpeed { + formattedSpeed = "\(state.sizeSpeed ?? state.averageSizeSpeed)" + formattedSpeed = adjustFormattedSize(formattedSpeed) + } + + if !formattedCombinedSize.isEmpty && !formattedSpeed.isEmpty { + additionalComponents.append(formattedCombinedSize) + additionalComponents.append(formattedSpeed) + } else if !formattedCombinedSize.isEmpty { + additionalComponents.append(formattedCombinedSize) + } else if !formattedSpeed.isEmpty { + additionalComponents.append(formattedSpeed) + } + } + } + + if additionalComponents.count > 0 { + let joinedAdditionalComponents = additionalComponents.joined(separator: ", ") + components.append("(\(joinedAdditionalComponents))") + } + } + + // Time - dropped at noTime level + if detail.rawValue < DetailLevel.noTime.rawValue && config.showTime { + let timeDifferenceSeconds = secondsSinceStart(from: state.startTime) + let formattedTime = timeDifferenceSeconds.formattedTime() + components.append("[\(formattedTime)]") + } + + return components.joined(separator: " ") + } + + private func adjustFormattedSize(_ size: String) -> String { + // Ensure we always have one digit after the decimal point to prevent flickering. + let zero = Int64(0).formattedSize() + let decimalSep = Locale.current.decimalSeparator ?? "." + guard !size.contains(decimalSep), let first = size.first, first.isNumber || !size.contains(zero) else { + return size + } + var size = size + for unit in ["MB", "GB", "TB"] { + size = size.replacingOccurrences(of: " \(unit)", with: "\(decimalSep)0 \(unit)") + } + return size + } + + private func combineSize(size: String, totalSize: String) -> String { + let sizeComponents = size.split(separator: " ", maxSplits: 1) + let totalSizeComponents = totalSize.split(separator: " ", maxSplits: 1) + guard sizeComponents.count == 2, totalSizeComponents.count == 2 else { + return "\(size)/\(totalSize)" + } + let sizeNumber = sizeComponents[0] + let sizeUnit = sizeComponents[1] + let totalSizeNumber = totalSizeComponents[0] + let totalSizeUnit = totalSizeComponents[1] + guard sizeUnit == totalSizeUnit else { + return "\(size)/\(totalSize)" + } + return "\(sizeNumber)/\(totalSizeNumber) \(totalSizeUnit)" + } + + func draw() -> String { + state.withLock { draw(state: $0) } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressConfig.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressConfig.swift new file mode 100644 index 0000000..5579ef1 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressConfig.swift @@ -0,0 +1,170 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// A configuration for displaying a progress bar. +public struct ProgressConfig: Sendable { + /// The file handle for progress updates. + let terminal: FileHandle + /// The initial description of the progress bar. + let initialDescription: String + /// The initial additional description of the progress bar. + let initialSubDescription: String + /// The initial items name (e.g., "files"). + let initialItemsName: String + /// A flag indicating whether to show a spinner (e.g., "⠋"). + /// The spinner is hidden when a progress bar is shown. + public let showSpinner: Bool + /// A flag indicating whether to show tasks and total tasks (e.g., "[1]" or "[1/3]"). + public let showTasks: Bool + /// A flag indicating whether to show the description (e.g., "Downloading..."). + public let showDescription: Bool + /// A flag indicating whether to show a percentage (e.g., "100%"). + /// The percentage is hidden when no total size and total items are set. + public let showPercent: Bool + /// A flag indicating whether to show a progress bar (e.g., "|███ |"). + /// The progress bar is hidden when no total size and total items are set. + public let showProgressBar: Bool + /// A flag indicating whether to show items and total items (e.g., "(22 it)" or "(22/22 it)"). + public let showItems: Bool + /// A flag indicating whether to show a size and a total size (e.g., "(22 MB)" or "(22/22 MB)"). + public let showSize: Bool + /// A flag indicating whether to show a speed (e.g., "(4.834 MB/s)"). + /// The speed is combined with the size and total size (e.g., "(22/22 MB, 4.834 MB/s)"). + /// The speed is hidden when no total size is set. + public let showSpeed: Bool + /// A flag indicating whether to show the elapsed time (e.g., "[4s]"). + public let showTime: Bool + /// The flag indicating whether to ignore small size values (less than 1 MB). For example, this may help to avoid reaching 100% after downloading metadata before downloading content. + public let ignoreSmallSize: Bool + /// The initial total tasks of the progress bar. + let initialTotalTasks: Int? + /// The initial total size of the progress bar. + let initialTotalSize: Int64? + /// The initial total items of the progress bar. + let initialTotalItems: Int? + /// The width of the progress bar in characters. + public let width: Int + /// The theme of the progress bar. + public let theme: ProgressTheme + /// The flag indicating whether to clear the progress bar before resetting the cursor. + public let clearOnFinish: Bool + /// The flag indicating whether to update the progress bar. + public let disableProgressUpdates: Bool + /// Creates a new instance of `ProgressConfig`. + /// - Parameters: + /// - terminal: The file handle for progress updates. The default value is `FileHandle.standardError`. + /// - description: The initial description of the progress bar. The default value is `""`. + /// - subDescription: The initial additional description of the progress bar. The default value is `""`. + /// - itemsName: The initial items name. The default value is `"it"`. + /// - showSpinner: A flag indicating whether to show a spinner. The default value is `true`. + /// - showTasks: A flag indicating whether to show tasks and total tasks. The default value is `false`. + /// - showDescription: A flag indicating whether to show the description. The default value is `true`. + /// - showPercent: A flag indicating whether to show a percentage. The default value is `true`. + /// - showProgressBar: A flag indicating whether to show a progress bar. The default value is `false`. + /// - showItems: A flag indicating whether to show items and a total items. The default value is `false`. + /// - showSize: A flag indicating whether to show a size and a total size. The default value is `true`. + /// - showSpeed: A flag indicating whether to show a speed. The default value is `true`. + /// - showTime: A flag indicating whether to show the elapsed time. The default value is `true`. + /// - ignoreSmallSize: A flag indicating whether to ignore small size values. The default value is `false`. + /// - totalTasks: The initial total tasks of the progress bar. The default value is `nil`. + /// - totalItems: The initial total items of the progress bar. The default value is `nil`. + /// - totalSize: The initial total size of the progress bar. The default value is `nil`. + /// - width: The width of the progress bar in characters. The default value is `120`. + /// - theme: The theme of the progress bar. The default value is `nil`. + /// - clearOnFinish: The flag indicating whether to clear the progress bar before resetting the cursor. The default is `true`. + /// - disableProgressUpdates: The flag indicating whether to update the progress bar. The default is `false`. + public init( + terminal: FileHandle = .standardError, + description: String = "", + subDescription: String = "", + itemsName: String = "it", + showSpinner: Bool = true, + showTasks: Bool = false, + showDescription: Bool = true, + showPercent: Bool = true, + showProgressBar: Bool = false, + showItems: Bool = false, + showSize: Bool = true, + showSpeed: Bool = true, + showTime: Bool = true, + ignoreSmallSize: Bool = false, + totalTasks: Int? = nil, + totalItems: Int? = nil, + totalSize: Int64? = nil, + width: Int = 120, + theme: ProgressTheme? = nil, + clearOnFinish: Bool = true, + disableProgressUpdates: Bool = false + ) throws { + if let totalTasks { + guard totalTasks > 0 else { + throw Error.invalid("totalTasks must be greater than zero") + } + } + if let totalItems { + guard totalItems > 0 else { + throw Error.invalid("totalItems must be greater than zero") + } + } + if let totalSize { + guard totalSize > 0 else { + throw Error.invalid("totalSize must be greater than zero") + } + } + + self.terminal = terminal + self.initialDescription = description + self.initialSubDescription = subDescription + self.initialItemsName = itemsName + + self.showSpinner = showSpinner + self.showTasks = showTasks + self.showDescription = showDescription + self.showPercent = showPercent + self.showProgressBar = showProgressBar + self.showItems = showItems + self.showSize = showSize + self.showSpeed = showSpeed + self.showTime = showTime + + self.ignoreSmallSize = ignoreSmallSize + self.initialTotalTasks = totalTasks + self.initialTotalItems = totalItems + self.initialTotalSize = totalSize + + self.width = width + self.theme = theme ?? DefaultProgressTheme() + self.clearOnFinish = clearOnFinish + self.disableProgressUpdates = disableProgressUpdates + } +} + +extension ProgressConfig { + /// An enumeration of errors that can occur when creating a `ProgressConfig`. + public enum Error: Swift.Error, CustomStringConvertible { + case invalid(String) + + /// The description of the error. + public var description: String { + switch self { + case .invalid(let reason): + return "failed to validate config (\(reason))" + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTaskCoordinator.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTaskCoordinator.swift new file mode 100644 index 0000000..ae09ca7 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTaskCoordinator.swift @@ -0,0 +1,72 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +/// A type that represents a task whose progress is being monitored. +public struct ProgressTask: Sendable, Equatable { + private var id = UUID() + private var coordinator: ProgressTaskCoordinator + + init(manager: ProgressTaskCoordinator) { + self.coordinator = manager + } + + static public func == (lhs: ProgressTask, rhs: ProgressTask) -> Bool { + lhs.id == rhs.id + } + + /// Returns `true` if this task is the currently active task, `false` otherwise. + public func isCurrent() async -> Bool { + guard let currentTask = await coordinator.currentTask else { + return false + } + return currentTask == self + } +} + +/// A type that coordinates progress tasks to ignore updates from completed tasks. +public actor ProgressTaskCoordinator { + var currentTask: ProgressTask? + + /// Creates an instance of `ProgressTaskCoordinator`. + public init() {} + + /// Returns a new task that should be monitored for progress updates. + public func startTask() -> ProgressTask { + let newTask = ProgressTask(manager: self) + currentTask = newTask + return newTask + } + + /// Performs cleanup when the monitored tasks complete. + public func finish() { + currentTask = nil + } + + /// Returns a handler that updates the progress of a given task. + /// - Parameters: + /// - task: The task whose progress is being updated. + /// - progressUpdate: The handler to invoke when progress updates are received. + public static func handler(for task: ProgressTask, from progressUpdate: @escaping ProgressUpdateHandler) -> ProgressUpdateHandler { + { events in + // Ignore updates from completed tasks. + if await task.isCurrent() { + await progressUpdate(events) + } + } + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTheme.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTheme.swift new file mode 100644 index 0000000..44b5bc3 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressTheme.swift @@ -0,0 +1,37 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// A theme for progress bar. +public protocol ProgressTheme: Sendable { + /// The icons used to represent a spinner. + var spinner: [String] { get } + /// The icon used to represent a progress bar. + var bar: String { get } + /// The icon used to indicate that a progress bar finished. + var done: String { get } +} + +public struct DefaultProgressTheme: ProgressTheme { + public let spinner = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"] + public let bar = "█" + public let done = "✔" +} + +extension ProgressTheme { + func getSpinnerIcon(_ iteration: Int) -> String { + spinner[iteration % spinner.count] + } +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressUpdate.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressUpdate.swift new file mode 100644 index 0000000..cf92db4 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/ProgressUpdate.swift @@ -0,0 +1,41 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +public enum ProgressUpdateEvent: Sendable { + case setDescription(String) + case setSubDescription(String) + case setItemsName(String) + case addTasks(Int) + case setTasks(Int) + case addTotalTasks(Int) + case setTotalTasks(Int) + case addItems(Int) + case setItems(Int) + case addTotalItems(Int) + case setTotalItems(Int) + case addSize(Int64) + case setSize(Int64) + case addTotalSize(Int64) + case setTotalSize(Int64) + case custom(String) +} + +public typealias ProgressUpdateHandler = @Sendable (_ events: [ProgressUpdateEvent]) async -> Void + +public protocol ProgressAdapter { + associatedtype T + static func handler(from progressUpdate: ProgressUpdateHandler?) -> (@Sendable ([T]) async -> Void)? +} diff --git a/examples/sandboxy/Sources/sandboxy/TerminalProgress/StandardError.swift b/examples/sandboxy/Sources/sandboxy/TerminalProgress/StandardError.swift new file mode 100644 index 0000000..9295f86 --- /dev/null +++ b/examples/sandboxy/Sources/sandboxy/TerminalProgress/StandardError.swift @@ -0,0 +1,25 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import Foundation + +struct StandardError { + func write(_ string: String) { + if let data = string.data(using: .utf8) { + FileHandle.standardError.write(data) + } + } +} diff --git a/examples/sandboxy/sandboxy.entitlements b/examples/sandboxy/sandboxy.entitlements new file mode 100644 index 0000000..d7d0d6e --- /dev/null +++ b/examples/sandboxy/sandboxy.entitlements @@ -0,0 +1,8 @@ + + + + + com.apple.security.virtualization + + + diff --git a/images/linux-dev/Dockerfile b/images/linux-dev/Dockerfile new file mode 100644 index 0000000..8d3a8f3 --- /dev/null +++ b/images/linux-dev/Dockerfile @@ -0,0 +1,132 @@ +# Copyright © 2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +ARG SWIFT_VERSION=6.3 +FROM swift:${SWIFT_VERSION}-noble + +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + make \ + libarchive-dev \ + libbz2-dev \ + liblzma-dev \ + libssl-dev \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +ARG SWIFT_SDK_URL +ARG SWIFT_SDK_CHECKSUM +RUN if [ -n "$SWIFT_SDK_URL" ]; then \ + swift sdk install "$SWIFT_SDK_URL" --checksum "$SWIFT_SDK_CHECKSUM"; \ + fi + +# x86_64 cross-build tooling +# --- +# Used by `make dist-x86_64` to produce a Linux x86_64 deployment +# tarball from this aarch64 dev container. Adds: Zig (used as a +# clang-based cross C/C++ compiler — its bundled musl + LLVM lets us +# target x86_64-linux-musl from any host arch), wrapper scripts that +# look like a standard `x86_64-linux-musl-*` toolchain so autotools' +# `--host=x86_64-linux-musl` works, parallel `x86_64-linux-gnu-*` +# wrappers pinned at glibc 2.35 for virtiofsd's dynamic build, +# Rust stable + both x86_64-unknown-linux-{musl,gnu} targets, +# autotools/gperf, static-musl builds of zlib, xz, bzip2, libarchive, +# libcap-ng, and libseccomp at /opt/cross-x86_64-musl, and +# glibc-dynamic builds of libcap-ng and libseccomp at +# /opt/cross-x86_64-gnu. + +# Build deps for static-musl C libraries. +RUN apt-get update \ + && apt-get install -y --no-install-recommends \ + autoconf \ + automake \ + libtool \ + gperf \ + curl \ + ca-certificates \ + xz-utils \ + build-essential \ + pkg-config \ + lld \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +# Zig (cross compiler). Pin to a specific release; bump as needed. +# Zig provides clang-based `zig cc -target ...` plus `zig ar`, `zig +# ranlib`, etc., bundled with musl libc — no need for a separate +# arch-specific gcc cross toolchain. +# +# The SHA256 is captured from the upstream release index +# (https://ziglang.org/download/) and verified before extraction so a +# tampered tarball can't poison the dev image. +ARG ZIG_VERSION=0.13.0 +ARG ZIG_AARCH64_SHA256=041ac42323837eb5624068acd8b00cd5777dac4cf91179e8dad7a7e90dd0c556 +RUN set -eux; \ + curl -fsSL -o /tmp/zig.tar.xz \ + "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-aarch64-${ZIG_VERSION}.tar.xz"; \ + echo "${ZIG_AARCH64_SHA256} /tmp/zig.tar.xz" | sha256sum -c -; \ + tar -xJf /tmp/zig.tar.xz -C /opt; \ + rm /tmp/zig.tar.xz; \ + ln -s "/opt/zig-linux-aarch64-${ZIG_VERSION}" /opt/zig +ENV PATH="/opt/zig:${PATH}" + +# Wrapper scripts that look like conventional cross toolchains — +# `x86_64-linux-musl-{gcc,g++,cc,c++,ar,ranlib,strip}` for the musl +# side (used by cctl, vminitd, cloud-hypervisor) and parallel +# `x86_64-linux-gnu-*` wrappers for virtiofsd's glibc-dynamic build. +# All dispatch to zig under the hood. Lets autotools' +# `--host=x86_64-linux-{musl,gnu}` and cargo's +# CARGO_TARGET_X86_64_UNKNOWN_LINUX_{MUSL,GNU}_LINKER point at these +# names without knowing about Zig. +# +# The C/C++ wrappers filter out `--target=` args that cc-rs +# (used by Rust build scripts like zstd-sys, libseccomp-sys) adds — +# cc-rs emits the Rust-form triple (e.g. x86_64-unknown-linux-musl) +# which Zig refuses to parse, and we always set our own -target. +COPY images/linux-dev/wrappers/ /usr/local/bin/ +RUN chmod +x /usr/local/bin/x86_64-linux-musl-* \ + && ln -s x86_64-linux-musl-gcc /usr/local/bin/x86_64-linux-musl-cc \ + && ln -s x86_64-linux-musl-g++ /usr/local/bin/x86_64-linux-musl-c++ \ + && chmod +x /usr/local/bin/x86_64-linux-gnu-* \ + && ln -s x86_64-linux-gnu-gcc /usr/local/bin/x86_64-linux-gnu-cc \ + && ln -s x86_64-linux-gnu-g++ /usr/local/bin/x86_64-linux-gnu-c++ + +# Rust toolchain at the same path the existing build-cloud-hypervisor / +# build-virtiofsd targets expect, with the x86_64-musl cross target +# pre-installed so dist-x86_64 doesn't redo it on every run. Also +# installs cargo-zigbuild — a cargo subcommand that uses Zig as the +# linker and handles the Rust+musl+Zig integration (specifically: it +# strips Rust's self-contained musl crt files so they don't collide +# with Zig's, and wires up libunwind correctly). +RUN curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \ + | sh -s -- -y --default-toolchain stable --profile minimal \ + && /root/.cargo/bin/rustup target add x86_64-unknown-linux-musl \ + && /root/.cargo/bin/rustup target add x86_64-unknown-linux-gnu \ + && /root/.cargo/bin/cargo install --locked cargo-zigbuild +ENV PATH="/root/.cargo/bin:${PATH}" + +# Static-musl C libraries (libarchive + deps for cctl, libcap-ng + +# libseccomp for virtiofsd). Installs to /opt/cross-x86_64-musl; +# build-dist-x86_64.sh adds -L/-I flags pointing at that prefix when +# linking the host-side binaries. +COPY scripts/build-musl-x86_64-deps.sh /tmp/build-musl-x86_64-deps.sh +RUN /tmp/build-musl-x86_64-deps.sh && rm /tmp/build-musl-x86_64-deps.sh + +# Glibc-dynamic C libraries for virtiofsd. virtiofsd ships +# glibc-dynamic in the x86_64 tarball so deployment hosts use their +# system libseccomp.so.2 + libcap-ng.so.0; this prefix only provides +# the link-time .so + headers + pkg-config files. cloud-hypervisor +# and cctl stay musl-static and link against /opt/cross-x86_64-musl/. +COPY scripts/build-glibc-x86_64-deps.sh /tmp/build-glibc-x86_64-deps.sh +RUN /tmp/build-glibc-x86_64-deps.sh && rm /tmp/build-glibc-x86_64-deps.sh diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-ar b/images/linux-dev/wrappers/x86_64-linux-gnu-ar new file mode 100755 index 0000000..6c3646a --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-ar @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig ar "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-g++ b/images/linux-dev/wrappers/x86_64-linux-gnu-g++ new file mode 100755 index 0000000..ea64733 --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-g++ @@ -0,0 +1,24 @@ +#!/bin/bash +# Wrapper that dispatches to `zig c++ -target x86_64-linux-gnu.2.35`. +# Mirrors x86_64-linux-musl-g++ but pins a glibc 2.35 baseline. +# +# See x86_64-linux-gnu-gcc for the rationale behind intercepting +# `-print-prog-name=ld`. +case " $* " in + *" -print-prog-name=ld "*) + echo /usr/local/bin/x86_64-linux-gnu-ld + exit 0 + ;; +esac + +# Filters out `--target=` args that cc-rs adds — cc-rs +# emits the Rust-form triple (x86_64-unknown-linux-gnu) which Zig +# can't parse. We always pass our own -target below. +args=() +for arg in "$@"; do + case "$arg" in + --target=*) ;; + *) args+=("$arg") ;; + esac +done +exec /opt/zig/zig c++ -target x86_64-linux-gnu.2.35 "${args[@]}" diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-gcc b/images/linux-dev/wrappers/x86_64-linux-gnu-gcc new file mode 100755 index 0000000..59f921e --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-gcc @@ -0,0 +1,31 @@ +#!/bin/bash +# Wrapper that dispatches to `zig cc -target x86_64-linux-gnu.2.35`. +# Mirrors x86_64-linux-musl-gcc but pins a glibc 2.35 baseline; the +# resulting binaries run on any host with glibc >= 2.35. +# +# Intercepts `-print-prog-name=ld` and returns our cross-ld wrapper — +# libtool uses that query to discover the linker before probing it +# with `-m elf_x86_64` to decide whether shared library builds are +# supported. zig cc passes the query through to the host `/usr/bin/ld`, +# which is aarch64-only and rejects the x86_64 emulation mode, causing +# libtool to silently disable shared-lib emission. Pointing libtool at +# our ld.lld-backed wrapper makes the probe succeed. +case " $* " in + *" -print-prog-name=ld "*) + echo /usr/local/bin/x86_64-linux-gnu-ld + exit 0 + ;; +esac + +# Filters out `--target=` args that cc-rs (Rust build +# scripts like libseccomp-sys, capng-sys) adds — cc-rs emits the +# Rust-form triple (x86_64-unknown-linux-gnu) which Zig can't parse. +# We always pass our own -target below, so cc-rs's is redundant. +args=() +for arg in "$@"; do + case "$arg" in + --target=*) ;; + *) args+=("$arg") ;; + esac +done +exec /opt/zig/zig cc -target x86_64-linux-gnu.2.35 "${args[@]}" diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-ld b/images/linux-dev/wrappers/x86_64-linux-gnu-ld new file mode 100755 index 0000000..15daeca --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-ld @@ -0,0 +1,9 @@ +#!/bin/sh +# Wrapper that points the autotools / libtool linker probe at +# LLVM's lld, which can produce x86_64 ELF output on an aarch64 +# host. The system `/usr/bin/ld` on the dev image is aarch64-only +# and rejects `-m elf_x86_64`, causing libtool to silently disable +# shared-library builds. libtool searches PATH for `-ld` +# before falling back to plain `ld`; this wrapper satisfies the +# search and unblocks shared-lib emission. +exec ld.lld "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-ranlib b/images/linux-dev/wrappers/x86_64-linux-gnu-ranlib new file mode 100755 index 0000000..5118caa --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-ranlib @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig ranlib "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-gnu-strip b/images/linux-dev/wrappers/x86_64-linux-gnu-strip new file mode 100755 index 0000000..052a9b9 --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-gnu-strip @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig strip "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-musl-ar b/images/linux-dev/wrappers/x86_64-linux-musl-ar new file mode 100755 index 0000000..6c3646a --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-musl-ar @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig ar "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-musl-g++ b/images/linux-dev/wrappers/x86_64-linux-musl-g++ new file mode 100755 index 0000000..57b7ee3 --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-musl-g++ @@ -0,0 +1,14 @@ +#!/bin/bash +# Wrapper that dispatches to `zig c++ -target x86_64-linux-musl`. +# Filters out `--target=` args that cc-rs (Rust build +# scripts) adds — cc-rs emits the Rust-form triple +# (x86_64-unknown-linux-musl) which Zig can't parse. We always pass +# our own -target below, so cc-rs's is redundant. +args=() +for arg in "$@"; do + case "$arg" in + --target=*) ;; + *) args+=("$arg") ;; + esac +done +exec /opt/zig/zig c++ -target x86_64-linux-musl "${args[@]}" diff --git a/images/linux-dev/wrappers/x86_64-linux-musl-gcc b/images/linux-dev/wrappers/x86_64-linux-musl-gcc new file mode 100755 index 0000000..fd43c98 --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-musl-gcc @@ -0,0 +1,14 @@ +#!/bin/bash +# Wrapper that dispatches to `zig cc -target x86_64-linux-musl`. +# Filters out `--target=` args that cc-rs (Rust build +# scripts like zstd-sys) adds — cc-rs emits the Rust-form triple +# (x86_64-unknown-linux-musl) which Zig can't parse. We always pass +# our own -target below, so cc-rs's is redundant. +args=() +for arg in "$@"; do + case "$arg" in + --target=*) ;; + *) args+=("$arg") ;; + esac +done +exec /opt/zig/zig cc -target x86_64-linux-musl "${args[@]}" diff --git a/images/linux-dev/wrappers/x86_64-linux-musl-ranlib b/images/linux-dev/wrappers/x86_64-linux-musl-ranlib new file mode 100755 index 0000000..5118caa --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-musl-ranlib @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig ranlib "$@" diff --git a/images/linux-dev/wrappers/x86_64-linux-musl-strip b/images/linux-dev/wrappers/x86_64-linux-musl-strip new file mode 100755 index 0000000..052a9b9 --- /dev/null +++ b/images/linux-dev/wrappers/x86_64-linux-musl-strip @@ -0,0 +1,2 @@ +#!/bin/sh +exec /opt/zig/zig strip "$@" diff --git a/kernel/Makefile b/kernel/Makefile new file mode 100644 index 0000000..bc955b1 --- /dev/null +++ b/kernel/Makefile @@ -0,0 +1,74 @@ +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +KSOURCE ?= https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.5.tar.xz +KIMAGE ?= kernel-build:0.1 +MAKEFILE_DIR := $(patsubst %/,%,$(dir $(abspath $(lastword $(MAKEFILE_LIST))))) +GIT_VERSION := $(shell git -C $(MAKEFILE_DIR) rev-parse --short=12 HEAD 2>/dev/null || echo unknown) +TARGET_ARCH ?= + +# Resolve the effective target arch (TARGET_ARCH override, else host). +EFFECTIVE_ARCH := $(if $(TARGET_ARCH),$(TARGET_ARCH),$(shell uname -m)) +ifneq (,$(filter $(EFFECTIVE_ARCH),aarch64)) +EFFECTIVE_ARCH := arm64 +endif +ifneq (,$(filter $(EFFECTIVE_ARCH),amd64)) +EFFECTIVE_ARCH := x86_64 +endif + +# Compressed (vmlinuz) for x86_64 bzImage; uncompressed (vmlinux) for arm64 Image. +ifeq ($(EFFECTIVE_ARCH),x86_64) +KERNEL_OUTPUT := vmlinuz-x86_64 +else +KERNEL_OUTPUT := vmlinux-arm64 +endif + +BIN_DIR := $(abspath $(MAKEFILE_DIR)/../bin) + +.DEFAULT_GOAL := all + +.PHONY: all +all: kernel-build-image +all: kernel-build +all: kernel-install + +.PHONY: kernel-build-image +kernel-build-image: + container build $(MAKEFILE_DIR)/image -f $(MAKEFILE_DIR)/image/Dockerfile -t ${KIMAGE} + +.PHONY: kernel-build +kernel-build: +ifeq (,$(wildcard $(MAKEFILE_DIR)/source.tar.xz)) + curl -SsL -o $(MAKEFILE_DIR)/source.tar.xz ${KSOURCE} +endif + container run \ + --cpus 8 \ + --rm \ + --memory 16g \ + -v $(MAKEFILE_DIR):/kernel \ + --env LOCALVERSION=-cz-${GIT_VERSION} \ + $(if $(TARGET_ARCH),--env TARGET_ARCH=$(TARGET_ARCH),) \ + --cwd /kernel \ + ${KIMAGE} \ + /bin/bash -c "./build.sh" + +.PHONY: kernel-install +kernel-install: + @mkdir -p $(BIN_DIR) + @cp -L $(MAKEFILE_DIR)/$(KERNEL_OUTPUT) $(BIN_DIR)/$(KERNEL_OUTPUT) + @echo "Installed $(KERNEL_OUTPUT) -> $(BIN_DIR)/$(KERNEL_OUTPUT)" + +.PHONY: x86_64 +x86_64: + $(MAKE) all TARGET_ARCH=x86_64 diff --git a/kernel/README.md b/kernel/README.md new file mode 100644 index 0000000..797aa4f --- /dev/null +++ b/kernel/README.md @@ -0,0 +1,24 @@ +# Containerization Kernel Configuration + +This directory includes an optimized kernel configuration to produce a fast and lightweight kernel for container use. + +- `config-arm64` and `config-x86_64` include the per-arch kernel `CONFIG_` options. +- `Makefile` includes the kernel version and source package URL. +- `build.sh` scripts the kernel build process. +- `image/` includes the configuration for an image with build tooling. + +## Building + +1. The build process relies on having the `container` tool installed (https://github.com/apple/container/releases). +2. Run `make`. This should create the image used for building the resulting Linux kernel, and then run a container with that image to perform the kernel build. + +### Target architecture + +The build target is selected by the `TARGET_ARCH` make variable, which accepts either `arm64` or `x86_64`. When unset, it falls back to the build host's architecture (as reported by `uname -m`, with `aarch64`/`amd64` normalized to `arm64`/`x86_64`). + +- `make` (default) → builds for the host arch +- `make TARGET_ARCH=arm64` → `vmlinux-arm64` (uncompressed `Image`) +- `make TARGET_ARCH=x86_64` → `vmlinuz-x86_64` (compressed `bzImage`, cross-compiled inside the arm64 container) +- `make x86_64` → convenience alias for `make TARGET_ARCH=x86_64` + +The `z` suffix on the x86 name follows Linux convention for a compressed kernel image. The resulting kernel is copied into the repo's `bin/` directory. diff --git a/kernel/build.sh b/kernel/build.sh new file mode 100755 index 0000000..a338de3 --- /dev/null +++ b/kernel/build.sh @@ -0,0 +1,50 @@ +#!/bin/bash +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -e + +TARGET_ARCH="${TARGET_ARCH:-$(uname -m)}" + +case "${TARGET_ARCH}" in + aarch64|arm64) + CONFIG=config-arm64 + KARCH=arm64 + CROSS_COMPILE=aarch64-linux-gnu- + IMAGE_PATH=arch/arm64/boot/Image + OUTPUT_NAME=vmlinux-arm64 + ;; + x86_64|amd64) + CONFIG=config-x86_64 + KARCH=x86_64 + CROSS_COMPILE=x86_64-linux-gnu- + IMAGE_PATH=arch/x86/boot/bzImage + OUTPUT_NAME=vmlinuz-x86_64 + ;; + *) + echo "Unsupported target architecture: ${TARGET_ARCH}" >&2 + exit 1 + ;; +esac + +mkdir -p /kbuild +tar -xf /kernel/source.tar.xz -C /kbuild --strip-components=1 +cp "/kernel/${CONFIG}" /kbuild/.config + +( + cd /kbuild + make ARCH="${KARCH}" CROSS_COMPILE="${CROSS_COMPILE}" olddefconfig && \ + make ARCH="${KARCH}" CROSS_COMPILE="${CROSS_COMPILE}" -j$((`nproc`-1)) LOCALVERSION="${LOCALVERSION}" && \ + cp "${IMAGE_PATH}" "/kernel/${OUTPUT_NAME}" +) diff --git a/kernel/config-arm64 b/kernel/config-arm64 new file mode 100644 index 0000000..429535b --- /dev/null +++ b/kernel/config-arm64 @@ -0,0 +1,4201 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/arm64 6.1.68 Kernel Configuration +# +CONFIG_CC_VERSION_TEXT="gcc (containerization) 9.4.0" +CONFIG_CC_IS_GCC=y +CONFIG_GCC_VERSION=90400 +CONFIG_CLANG_VERSION=0 +CONFIG_AS_IS_GNU=y +CONFIG_AS_VERSION=23400 +CONFIG_LD_IS_BFD=y +CONFIG_LD_VERSION=23400 +CONFIG_LLD_VERSION=0 +CONFIG_CC_CAN_LINK=y +CONFIG_CC_CAN_LINK_STATIC=y +CONFIG_CC_HAS_ASM_INLINE=y +CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y +CONFIG_PAHOLE_VERSION=0 +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_TABLE_SORT=y +CONFIG_THREAD_INFO_IN_TASK=y + +# +# General setup +# +CONFIG_INIT_ENV_ARG_LIMIT=32 +# CONFIG_COMPILE_TEST is not set +# CONFIG_WERROR is not set +CONFIG_LOCALVERSION="" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_BUILD_SALT="" +CONFIG_DEFAULT_INIT="" +CONFIG_DEFAULT_HOSTNAME="sandbox-vm" +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +# CONFIG_WATCH_QUEUE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +# CONFIG_USELIB is not set +CONFIG_AUDIT=y +CONFIG_HAVE_ARCH_AUDITSYSCALL=y +CONFIG_AUDITSYSCALL=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_GENERIC_IRQ_SHOW_LEVEL=y +CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y +CONFIG_GENERIC_IRQ_MIGRATION=y +CONFIG_HARDIRQS_SW_RESEND=y +CONFIG_IRQ_DOMAIN=y +CONFIG_IRQ_DOMAIN_HIERARCHY=y +CONFIG_GENERIC_IRQ_IPI=y +CONFIG_GENERIC_MSI_IRQ=y +CONFIG_GENERIC_MSI_IRQ_DOMAIN=y +CONFIG_IRQ_MSI_IOMMU=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +# CONFIG_GENERIC_IRQ_DEBUGFS is not set +# end of IRQ subsystem + +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_ARCH_HAS_TICK_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y +CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y +CONFIG_CONTEXT_TRACKING=y +CONFIG_CONTEXT_TRACKING_IDLE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ_COMMON=y +# CONFIG_HZ_PERIODIC is not set +CONFIG_NO_HZ_IDLE=y +# CONFIG_NO_HZ_FULL is not set +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y +# end of Timers subsystem + +CONFIG_BPF=y +CONFIG_HAVE_EBPF_JIT=y +CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y + +# +# BPF subsystem +# +CONFIG_BPF_SYSCALL=y +# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set +CONFIG_USERMODE_DRIVER=y +CONFIG_BPF_PRELOAD=y +CONFIG_BPF_PRELOAD_UMD=y +# end of BPF subsystem + +CONFIG_PREEMPT_NONE_BUILD=y +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +# CONFIG_PREEMPT_DYNAMIC is not set +# CONFIG_SCHED_CORE is not set + +# +# CPU/Task time and stats accounting +# +CONFIG_TICK_CPU_ACCOUNTING=y +# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_HAVE_SCHED_AVG_IRQ=y +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TASK_XACCT=y +CONFIG_TASK_IO_ACCOUNTING=y +# CONFIG_PSI is not set +# end of CPU/Task time and stats accounting + +CONFIG_CPU_ISOLATION=y + +# +# RCU Subsystem +# +CONFIG_TREE_RCU=y +# CONFIG_RCU_EXPERT is not set +CONFIG_SRCU=y +CONFIG_TREE_SRCU=y +CONFIG_TASKS_RCU_GENERIC=y +CONFIG_TASKS_TRACE_RCU=y +CONFIG_RCU_STALL_COMMON=y +CONFIG_RCU_NEED_SEGCBLIST=y +# end of RCU Subsystem + +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +# CONFIG_IKHEADERS is not set +CONFIG_LOG_BUF_SHIFT=21 +CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 +CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 +# CONFIG_PRINTK_INDEX is not set +CONFIG_GENERIC_SCHED_CLOCK=y + +# +# Scheduler features +# +# end of Scheduler features + +CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y +CONFIG_CC_HAS_INT128=y +CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" +CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_ARCH_SUPPORTS_INT128=y +CONFIG_NUMA_BALANCING=y +# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set +CONFIG_CGROUPS=y +CONFIG_PAGE_COUNTER=y +# CONFIG_CGROUP_FAVOR_DYNMODS is not set +CONFIG_MEMCG=y +CONFIG_MEMCG_V1=y +CONFIG_MEMCG_KMEM=y +CONFIG_BLK_CGROUP=y +CONFIG_CGROUP_WRITEBACK=y +CONFIG_CGROUP_SCHED=y +CONFIG_FAIR_GROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_CGROUP_PIDS=y +# CONFIG_CGROUP_RDMA is not set +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_CPUSETS_V1=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_BPF=y +# CONFIG_CGROUP_MISC is not set +# CONFIG_CGROUP_DEBUG is not set +CONFIG_SOCK_CGROUP_DATA=y +CONFIG_NAMESPACES=y +CONFIG_UTS_NS=y +CONFIG_TIME_NS=y +CONFIG_IPC_NS=y +CONFIG_USER_NS=y +CONFIG_PID_NS=y +CONFIG_NET_NS=y +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_SCHED_AUTOGROUP=y +# CONFIG_SYSFS_DEPRECATED is not set +CONFIG_RELAY=y +CONFIG_BLK_DEV_INITRD=y +CONFIG_INITRAMFS_SOURCE="" +CONFIG_RD_GZIP=y +CONFIG_RD_BZIP2=y +CONFIG_RD_LZMA=y +CONFIG_RD_XZ=y +CONFIG_RD_LZO=y +CONFIG_RD_LZ4=y +# CONFIG_RD_ZSTD is not set +# CONFIG_BOOT_CONFIG is not set +CONFIG_INITRAMFS_PRESERVE_MTIME=y +CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y +# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set +CONFIG_LD_ORPHAN_WARN=y +CONFIG_SYSCTL=y +CONFIG_SYSCTL_EXCEPTION_TRACE=y +CONFIG_EXPERT=y +CONFIG_MULTIUSER=y +CONFIG_SGETMASK_SYSCALL=y +CONFIG_SYSFS_SYSCALL=y +CONFIG_FHANDLE=y +CONFIG_POSIX_TIMERS=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_FUTEX_PI=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +CONFIG_IO_URING=y +CONFIG_ADVISE_SYSCALLS=y +CONFIG_MEMBARRIER=y +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_KALLSYMS_BASE_RELATIVE=y +CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y +CONFIG_RSEQ=y +# CONFIG_DEBUG_RSEQ is not set +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y +CONFIG_GUEST_PERF_EVENTS=y +# CONFIG_PC104 is not set + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +# end of Kernel Performance Events And Counters + +# CONFIG_PROFILING is not set +# end of General setup + +CONFIG_ARM64=y +CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_64BIT=y +CONFIG_MMU=y +CONFIG_ARM64_PAGE_SHIFT=12 +CONFIG_ARM64_CONT_PTE_SHIFT=4 +CONFIG_ARM64_CONT_PMD_SHIFT=4 +CONFIG_ARCH_MMAP_RND_BITS_MIN=18 +CONFIG_ARCH_MMAP_RND_BITS_MAX=33 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_HWEIGHT=y +CONFIG_GENERIC_CSUM=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y +CONFIG_SMP=y +CONFIG_KERNEL_MODE_NEON=y +CONFIG_FIX_EARLYCON_MEM=y +CONFIG_PGTABLE_LEVELS=4 +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_ARCH_PROC_KCORE_TEXT=y + +# +# Platform selection +# +# CONFIG_ARCH_ACTIONS is not set +# CONFIG_ARCH_SUNXI is not set +# CONFIG_ARCH_ALPINE is not set +# CONFIG_ARCH_APPLE is not set +# CONFIG_ARCH_BCM is not set +# CONFIG_ARCH_BERLIN is not set +# CONFIG_ARCH_BITMAIN is not set +# CONFIG_ARCH_EXYNOS is not set +# CONFIG_ARCH_SPARX5 is not set +# CONFIG_ARCH_K3 is not set +# CONFIG_ARCH_LG1K is not set +# CONFIG_ARCH_HISI is not set +# CONFIG_ARCH_KEEMBAY is not set +# CONFIG_ARCH_MEDIATEK is not set +# CONFIG_ARCH_MESON is not set +# CONFIG_ARCH_MVEBU is not set +# CONFIG_ARCH_NXP is not set +# CONFIG_ARCH_NPCM is not set +# CONFIG_ARCH_QCOM is not set +# CONFIG_ARCH_REALTEK is not set +# CONFIG_ARCH_RENESAS is not set +# CONFIG_ARCH_ROCKCHIP is not set +# CONFIG_ARCH_SEATTLE is not set +# CONFIG_ARCH_INTEL_SOCFPGA is not set +# CONFIG_ARCH_SYNQUACER is not set +# CONFIG_ARCH_TEGRA is not set +# CONFIG_ARCH_SPRD is not set +# CONFIG_ARCH_THUNDER is not set +# CONFIG_ARCH_THUNDER2 is not set +# CONFIG_ARCH_UNIPHIER is not set +# CONFIG_ARCH_VEXPRESS is not set +# CONFIG_ARCH_VISCONTI is not set +# CONFIG_ARCH_XGENE is not set +# CONFIG_ARCH_ZYNQMP is not set +# end of Platform selection + +# +# Kernel Features +# + +# +# ARM errata workarounds via the alternatives framework +# +CONFIG_AMPERE_ERRATUM_AC03_CPU_38=y +CONFIG_ARM64_WORKAROUND_CLEAN_CACHE=y +CONFIG_ARM64_ERRATUM_826319=y +CONFIG_ARM64_ERRATUM_827319=y +CONFIG_ARM64_ERRATUM_824069=y +CONFIG_ARM64_ERRATUM_819472=y +CONFIG_ARM64_ERRATUM_832075=y +CONFIG_ARM64_ERRATUM_834220=y +CONFIG_ARM64_ERRATUM_843419=y +CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y +CONFIG_ARM64_ERRATUM_1024718=y +CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y +CONFIG_ARM64_ERRATUM_1165522=y +CONFIG_ARM64_ERRATUM_1319367=y +CONFIG_ARM64_ERRATUM_1530923=y +CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y +CONFIG_ARM64_ERRATUM_2441007=y +CONFIG_ARM64_ERRATUM_1286807=y +CONFIG_ARM64_ERRATUM_1463225=y +CONFIG_ARM64_ERRATUM_1542419=y +CONFIG_ARM64_ERRATUM_1508412=y +CONFIG_ARM64_ERRATUM_2051678=y +CONFIG_ARM64_ERRATUM_2077057=y +CONFIG_ARM64_ERRATUM_2658417=y +CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE=y +CONFIG_ARM64_ERRATUM_2054223=y +CONFIG_ARM64_ERRATUM_2067961=y +CONFIG_ARM64_ERRATUM_2441009=y +CONFIG_ARM64_ERRATUM_2457168=y +CONFIG_ARM64_ERRATUM_2966298=y +CONFIG_CAVIUM_ERRATUM_22375=y +CONFIG_CAVIUM_ERRATUM_23144=y +CONFIG_CAVIUM_ERRATUM_23154=y +CONFIG_CAVIUM_ERRATUM_27456=y +CONFIG_CAVIUM_ERRATUM_30115=y +CONFIG_CAVIUM_TX2_ERRATUM_219=y +CONFIG_FUJITSU_ERRATUM_010001=y +CONFIG_HISILICON_ERRATUM_161600802=y +CONFIG_QCOM_FALKOR_ERRATUM_1003=y +CONFIG_QCOM_FALKOR_ERRATUM_1009=y +CONFIG_QCOM_QDF2400_ERRATUM_0065=y +CONFIG_QCOM_FALKOR_ERRATUM_E1041=y +# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set +CONFIG_SOCIONEXT_SYNQUACER_PREITS=y +# end of ARM errata workarounds via the alternatives framework + +CONFIG_ARM64_4K_PAGES=y +# CONFIG_ARM64_16K_PAGES is not set +# CONFIG_ARM64_64K_PAGES is not set +# CONFIG_ARM64_VA_BITS_39 is not set +CONFIG_ARM64_VA_BITS_48=y +CONFIG_ARM64_VA_BITS=48 +CONFIG_ARM64_PA_BITS_48=y +CONFIG_ARM64_PA_BITS=48 +# CONFIG_CPU_BIG_ENDIAN is not set +CONFIG_CPU_LITTLE_ENDIAN=y +CONFIG_SCHED_MC=y +# CONFIG_SCHED_CLUSTER is not set +CONFIG_SCHED_SMT=y +CONFIG_NR_CPUS=128 +CONFIG_HOTPLUG_CPU=y +CONFIG_NUMA=y +CONFIG_NODES_SHIFT=10 +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_HW_PERF_EVENTS=y +CONFIG_PARAVIRT=y +CONFIG_PARAVIRT_TIME_ACCOUNTING=y +# CONFIG_KEXEC is not set +CONFIG_KEXEC_FILE=y +# CONFIG_KEXEC_SIG is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_TRANS_TABLE=y +# CONFIG_XEN is not set +CONFIG_ARCH_FORCE_MAX_ORDER=11 +CONFIG_UNMAP_KERNEL_AT_EL0=y +CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY=y +CONFIG_RODATA_FULL_DEFAULT_ENABLED=y +# CONFIG_ARM64_SW_TTBR0_PAN is not set +CONFIG_ARM64_TAGGED_ADDR_ABI=y +# CONFIG_COMPAT is not set + +# +# ARMv8.1 architectural features +# +CONFIG_ARM64_HW_AFDBM=y +CONFIG_ARM64_PAN=y +CONFIG_AS_HAS_LDAPR=y +CONFIG_AS_HAS_LSE_ATOMICS=y +CONFIG_ARM64_LSE_ATOMICS=y +CONFIG_ARM64_USE_LSE_ATOMICS=y +# end of ARMv8.1 architectural features + +# +# ARMv8.2 architectural features +# +CONFIG_AS_HAS_ARMV8_2=y +CONFIG_AS_HAS_SHA3=y +# CONFIG_ARM64_PMEM is not set +CONFIG_ARM64_RAS_EXTN=y +CONFIG_ARM64_CNP=y +# end of ARMv8.2 architectural features + +# +# ARMv8.3 architectural features +# +CONFIG_ARM64_PTR_AUTH=y +CONFIG_ARM64_PTR_AUTH_KERNEL=y +CONFIG_CC_HAS_BRANCH_PROT_PAC_RET=y +CONFIG_CC_HAS_SIGN_RETURN_ADDRESS=y +CONFIG_AS_HAS_PAC=y +CONFIG_AS_HAS_CFI_NEGATE_RA_STATE=y +# end of ARMv8.3 architectural features + +# +# ARMv8.4 architectural features +# +CONFIG_ARM64_AMU_EXTN=y +CONFIG_AS_HAS_ARMV8_4=y +CONFIG_ARM64_TLB_RANGE=y +# end of ARMv8.4 architectural features + +# +# ARMv8.5 architectural features +# +CONFIG_AS_HAS_ARMV8_5=y +CONFIG_ARM64_BTI=y +CONFIG_CC_HAS_BRANCH_PROT_PAC_RET_BTI=y +CONFIG_ARM64_E0PD=y +CONFIG_ARM64_AS_HAS_MTE=y +CONFIG_ARM64_MTE=y +# end of ARMv8.5 architectural features + +# +# ARMv8.7 architectural features +# +CONFIG_ARM64_EPAN=y +# end of ARMv8.7 architectural features + +# CONFIG_ARM64_SVE is not set +# CONFIG_ARM64_PSEUDO_NMI is not set +CONFIG_RELOCATABLE=y +CONFIG_RANDOMIZE_BASE=y +CONFIG_RANDOMIZE_MODULE_REGION_FULL=y +CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y +CONFIG_STACKPROTECTOR_PER_TASK=y +CONFIG_ARCH_NR_GPIO=0 +# end of Kernel Features + +# +# Boot options +# +# CONFIG_ARM64_ACPI_PARKING_PROTOCOL is not set +CONFIG_CMDLINE="" +CONFIG_EFI_STUB=y +CONFIG_EFI=y +CONFIG_DMI=y +# end of Boot options + +# +# Power management options +# +# CONFIG_SUSPEND is not set +CONFIG_HIBERNATE_CALLBACKS=y +CONFIG_HIBERNATION=y +CONFIG_HIBERNATION_SNAPSHOT_DEV=y +CONFIG_PM_STD_PARTITION="" +CONFIG_PM_SLEEP=y +CONFIG_PM_SLEEP_SMP=y +# CONFIG_PM_AUTOSLEEP is not set +# CONFIG_PM_USERSPACE_AUTOSLEEP is not set +# CONFIG_PM_WAKELOCKS is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_PM_CLK=y +# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set +CONFIG_CPU_PM=y +# CONFIG_ENERGY_MODEL is not set +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_HIBERNATION_HEADER=y +CONFIG_ARCH_SUSPEND_POSSIBLE=y +# end of Power management options + +# +# CPU Power Management +# + +# +# CPU Idle +# +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_CPU_IDLE_GOV_TEO is not set + +# +# ARM CPU Idle Drivers +# +# CONFIG_ARM_PSCI_CPUIDLE is not set +# end of ARM CPU Idle Drivers +# end of CPU Idle + +# +# CPU Frequency scaling +# +CONFIG_CPU_FREQ=y +# CONFIG_CPU_FREQ_STAT is not set +CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y +# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set +CONFIG_CPU_FREQ_GOV_PERFORMANCE=y +# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set +# CONFIG_CPU_FREQ_GOV_USERSPACE is not set +# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set +# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set +# CONFIG_CPU_FREQ_GOV_SCHEDUTIL is not set + +# +# CPU frequency scaling drivers +# +# CONFIG_CPUFREQ_DT is not set +# CONFIG_ACPI_CPPC_CPUFREQ is not set +# end of CPU Frequency scaling +# end of CPU Power Management + +CONFIG_ARCH_SUPPORTS_ACPI=y +CONFIG_ACPI=y +CONFIG_ACPI_GENERIC_GSI=y +CONFIG_ACPI_CCA_REQUIRED=y +# CONFIG_ACPI_DEBUGGER is not set +CONFIG_ACPI_SPCR_TABLE=y +# CONFIG_ACPI_EC_DEBUGFS is not set +# CONFIG_ACPI_AC is not set +# CONFIG_ACPI_BATTERY is not set +CONFIG_ACPI_BUTTON=y +# CONFIG_ACPI_VIDEO is not set +# CONFIG_ACPI_FAN is not set +# CONFIG_ACPI_TAD is not set +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR_IDLE=y +CONFIG_ACPI_MCFG=y +CONFIG_ACPI_PROCESSOR=y +CONFIG_ACPI_HOTPLUG_CPU=y +CONFIG_ACPI_THERMAL=y +CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y +CONFIG_ACPI_TABLE_UPGRADE=y +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_ACPI_CONTAINER=y +CONFIG_ACPI_HOTPLUG_MEMORY=y +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_CUSTOM_METHOD is not set +# CONFIG_ACPI_BGRT is not set +CONFIG_ACPI_REDUCED_HARDWARE_ONLY=y +CONFIG_ACPI_NUMA=y +# CONFIG_ACPI_HMAT is not set +CONFIG_HAVE_ACPI_APEI=y +# CONFIG_ACPI_APEI is not set +# CONFIG_ACPI_CONFIGFS is not set +# CONFIG_ACPI_PFRUT is not set +CONFIG_ACPI_IORT=y +CONFIG_ACPI_GTDT=y +CONFIG_ACPI_PPTT=y +CONFIG_ACPI_PCC=y +# CONFIG_PMIC_OPREGION is not set +CONFIG_ACPI_VIOT=y +CONFIG_ACPI_PRMT=y +CONFIG_IRQ_BYPASS_MANAGER=y +CONFIG_HAVE_KVM=y +CONFIG_HAVE_KVM_IRQCHIP=y +CONFIG_HAVE_KVM_IRQFD=y +CONFIG_HAVE_KVM_IRQ_ROUTING=y +CONFIG_HAVE_KVM_EVENTFD=y +CONFIG_KVM_MMIO=y +CONFIG_HAVE_KVM_MSI=y +CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y +CONFIG_KVM_VFIO=y +CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL=y +CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y +CONFIG_HAVE_KVM_IRQ_BYPASS=y +CONFIG_HAVE_KVM_VCPU_RUN_PID_CHANGE=y +CONFIG_KVM_XFER_TO_GUEST_WORK=y +CONFIG_VIRTUALIZATION=y +CONFIG_KVM=y +# CONFIG_NVHE_EL2_DEBUG is not set + +# +# General architecture-dependent options +# +CONFIG_CRASH_CORE=y +CONFIG_KEXEC_CORE=y +CONFIG_ARCH_HAS_SUBPAGE_FAULTS=y +CONFIG_JUMP_LABEL=y +# CONFIG_STATIC_KEYS_SELFTEST is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y +CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y +CONFIG_HAVE_NMI=y +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_CONTIGUOUS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_GENERIC_IDLE_POLL_SETUP=y +CONFIG_ARCH_HAS_FORTIFY_SOURCE=y +CONFIG_ARCH_HAS_KEEPINITRD=y +CONFIG_ARCH_HAS_SET_MEMORY=y +CONFIG_ARCH_HAS_SET_DIRECT_MAP=y +CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y +CONFIG_ARCH_WANTS_NO_INSTR=y +CONFIG_HAVE_ASM_MODVERSIONS=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_RSEQ=y +CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_PERF_REGS=y +CONFIG_HAVE_PERF_USER_STACK_DUMP=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y +CONFIG_MMU_GATHER_TABLE_FREE=y +CONFIG_MMU_GATHER_RCU_TABLE_FREE=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y +# CONFIG_SECCOMP_CACHE_DEBUG is not set +CONFIG_HAVE_ARCH_STACKLEAK=y +CONFIG_HAVE_STACKPROTECTOR=y +CONFIG_STACKPROTECTOR=y +CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y +CONFIG_LTO_NONE=y +CONFIG_ARCH_SUPPORTS_CFI_CLANG=y +CONFIG_HAVE_CONTEXT_TRACKING_USER=y +CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y +CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y +CONFIG_HAVE_MOVE_PUD=y +CONFIG_HAVE_MOVE_PMD=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y +CONFIG_HAVE_ARCH_HUGE_VMAP=y +CONFIG_HAVE_ARCH_HUGE_VMALLOC=y +CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y +CONFIG_MODULES_USE_ELF_RELA=y +CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y +CONFIG_SOFTIRQ_ON_OWN_STACK=y +CONFIG_ARCH_HAS_ELF_RANDOMIZE=y +CONFIG_HAVE_ARCH_MMAP_RND_BITS=y +CONFIG_ARCH_MMAP_RND_BITS=18 +CONFIG_PAGE_SIZE_LESS_THAN_64KB=y +CONFIG_PAGE_SIZE_LESS_THAN_256KB=y +CONFIG_ARCH_WANT_DEFAULT_TOPDOWN_MMAP_LAYOUT=y +CONFIG_CLONE_BACKWARDS=y +# CONFIG_COMPAT_32BIT_TIME is not set +CONFIG_HAVE_ARCH_VMAP_STACK=y +CONFIG_VMAP_STACK=y +CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y +CONFIG_RANDOMIZE_KSTACK_OFFSET=y +# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set +CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y +CONFIG_STRICT_KERNEL_RWX=y +CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y +CONFIG_HAVE_ARCH_COMPILER_H=y +CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y +CONFIG_ARCH_USE_MEMREMAP_PROT=y +# CONFIG_LOCK_EVENT_COUNTS is not set +CONFIG_ARCH_HAS_RELR=y +CONFIG_HAVE_PREEMPT_DYNAMIC=y +CONFIG_HAVE_PREEMPT_DYNAMIC_KEY=y +CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y +CONFIG_ARCH_HAVE_TRACE_MMIO_ACCESS=y + +# +# GCOV-based kernel profiling +# +# CONFIG_GCOV_KERNEL is not set +CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y +# end of GCOV-based kernel profiling + +CONFIG_HAVE_GCC_PLUGINS=y +# end of General architecture-dependent options + +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +CONFIG_BLOCK_LEGACY_AUTOLOAD=y +CONFIG_BLK_CGROUP_RWSTAT=y +CONFIG_BLK_DEV_BSG_COMMON=y +CONFIG_BLK_DEV_BSGLIB=y +CONFIG_BLK_DEV_INTEGRITY=y +# CONFIG_BLK_DEV_ZONED is not set +CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_DEV_THROTTLING_LOW is not set +CONFIG_BLK_WBT=y +CONFIG_BLK_WBT_MQ=y +# CONFIG_BLK_CGROUP_IOLATENCY is not set +# CONFIG_BLK_CGROUP_IOCOST is not set +# CONFIG_BLK_CGROUP_IOPRIO is not set +CONFIG_BLK_DEBUG_FS=y +# CONFIG_BLK_SED_OPAL is not set +# CONFIG_BLK_INLINE_ENCRYPTION is not set + +# +# Partition Types +# +CONFIG_PARTITION_ADVANCED=y +# CONFIG_ACORN_PARTITION is not set +# CONFIG_AIX_PARTITION is not set +# CONFIG_OSF_PARTITION is not set +# CONFIG_AMIGA_PARTITION is not set +# CONFIG_ATARI_PARTITION is not set +# CONFIG_MAC_PARTITION is not set +# CONFIG_MSDOS_PARTITION is not set +# CONFIG_LDM_PARTITION is not set +# CONFIG_SGI_PARTITION is not set +# CONFIG_ULTRIX_PARTITION is not set +# CONFIG_SUN_PARTITION is not set +# CONFIG_KARMA_PARTITION is not set +CONFIG_EFI_PARTITION=y +# CONFIG_SYSV68_PARTITION is not set +# CONFIG_CMDLINE_PARTITION is not set +# end of Partition Types + +CONFIG_BLK_MQ_PCI=y +CONFIG_BLK_MQ_VIRTIO=y +CONFIG_BLK_PM=y + +# +# IO Schedulers +# +# CONFIG_MQ_IOSCHED_DEADLINE is not set +# CONFIG_MQ_IOSCHED_KYBER is not set +# CONFIG_IOSCHED_BFQ is not set +# end of IO Schedulers + +CONFIG_PREEMPT_NOTIFIERS=y +CONFIG_ASN1=y +CONFIG_ARCH_INLINE_SPIN_TRYLOCK=y +CONFIG_ARCH_INLINE_SPIN_TRYLOCK_BH=y +CONFIG_ARCH_INLINE_SPIN_LOCK=y +CONFIG_ARCH_INLINE_SPIN_LOCK_BH=y +CONFIG_ARCH_INLINE_SPIN_LOCK_IRQ=y +CONFIG_ARCH_INLINE_SPIN_LOCK_IRQSAVE=y +CONFIG_ARCH_INLINE_SPIN_UNLOCK=y +CONFIG_ARCH_INLINE_SPIN_UNLOCK_BH=y +CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQ=y +CONFIG_ARCH_INLINE_SPIN_UNLOCK_IRQRESTORE=y +CONFIG_ARCH_INLINE_READ_LOCK=y +CONFIG_ARCH_INLINE_READ_LOCK_BH=y +CONFIG_ARCH_INLINE_READ_LOCK_IRQ=y +CONFIG_ARCH_INLINE_READ_LOCK_IRQSAVE=y +CONFIG_ARCH_INLINE_READ_UNLOCK=y +CONFIG_ARCH_INLINE_READ_UNLOCK_BH=y +CONFIG_ARCH_INLINE_READ_UNLOCK_IRQ=y +CONFIG_ARCH_INLINE_READ_UNLOCK_IRQRESTORE=y +CONFIG_ARCH_INLINE_WRITE_LOCK=y +CONFIG_ARCH_INLINE_WRITE_LOCK_BH=y +CONFIG_ARCH_INLINE_WRITE_LOCK_IRQ=y +CONFIG_ARCH_INLINE_WRITE_LOCK_IRQSAVE=y +CONFIG_ARCH_INLINE_WRITE_UNLOCK=y +CONFIG_ARCH_INLINE_WRITE_UNLOCK_BH=y +CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQ=y +CONFIG_ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE=y +CONFIG_INLINE_SPIN_TRYLOCK=y +CONFIG_INLINE_SPIN_TRYLOCK_BH=y +CONFIG_INLINE_SPIN_LOCK=y +CONFIG_INLINE_SPIN_LOCK_BH=y +CONFIG_INLINE_SPIN_LOCK_IRQ=y +CONFIG_INLINE_SPIN_LOCK_IRQSAVE=y +CONFIG_INLINE_SPIN_UNLOCK_BH=y +CONFIG_INLINE_SPIN_UNLOCK_IRQ=y +CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE=y +CONFIG_INLINE_READ_LOCK=y +CONFIG_INLINE_READ_LOCK_BH=y +CONFIG_INLINE_READ_LOCK_IRQ=y +CONFIG_INLINE_READ_LOCK_IRQSAVE=y +CONFIG_INLINE_READ_UNLOCK=y +CONFIG_INLINE_READ_UNLOCK_BH=y +CONFIG_INLINE_READ_UNLOCK_IRQ=y +CONFIG_INLINE_READ_UNLOCK_IRQRESTORE=y +CONFIG_INLINE_WRITE_LOCK=y +CONFIG_INLINE_WRITE_LOCK_BH=y +CONFIG_INLINE_WRITE_LOCK_IRQ=y +CONFIG_INLINE_WRITE_LOCK_IRQSAVE=y +CONFIG_INLINE_WRITE_UNLOCK=y +CONFIG_INLINE_WRITE_UNLOCK_BH=y +CONFIG_INLINE_WRITE_UNLOCK_IRQ=y +CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE=y +CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y +CONFIG_MUTEX_SPIN_ON_OWNER=y +CONFIG_RWSEM_SPIN_ON_OWNER=y +CONFIG_LOCK_SPIN_ON_OWNER=y +CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y +CONFIG_QUEUED_SPINLOCKS=y +CONFIG_ARCH_USE_QUEUED_RWLOCKS=y +CONFIG_QUEUED_RWLOCKS=y +CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y +CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y +CONFIG_FREEZER=y + +# +# Executable file formats +# +CONFIG_BINFMT_ELF=y +CONFIG_ARCH_BINFMT_ELF_STATE=y +CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y +CONFIG_ARCH_HAVE_ELF_PROT=y +CONFIG_ARCH_USE_GNU_PROPERTY=y +CONFIG_ELFCORE=y +CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y +CONFIG_BINFMT_SCRIPT=y +CONFIG_BINFMT_MISC=y +CONFIG_COREDUMP=y +# end of Executable file formats + +# +# Memory Management options +# +CONFIG_ZPOOL=y +CONFIG_SWAP=y +CONFIG_ZSWAP=y +# CONFIG_ZSWAP_DEFAULT_ON is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE is not set +CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO=y +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842 is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD is not set +CONFIG_ZSWAP_COMPRESSOR_DEFAULT="lzo" +CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=y +# CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD is not set +# CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC is not set +CONFIG_ZSWAP_ZPOOL_DEFAULT="zbud" +CONFIG_ZBUD=y +# CONFIG_Z3FOLD is not set +CONFIG_ZSMALLOC=y +CONFIG_ZSMALLOC_STAT=y + +# +# SLAB allocator options +# +# CONFIG_SLAB is not set +CONFIG_SLUB=y +# CONFIG_SLOB is not set +CONFIG_SLAB_MERGE_DEFAULT=y +# CONFIG_SLAB_FREELIST_RANDOM is not set +CONFIG_SLAB_FREELIST_HARDENED=y +# CONFIG_SLUB_STATS is not set +CONFIG_SLUB_CPU_PARTIAL=y +# end of SLAB allocator options + +# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_SPARSEMEM=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_FAST_GUP=y +CONFIG_ARCH_KEEP_MEMBLOCK=y +CONFIG_NUMA_KEEP_MEMINFO=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_EXCLUSIVE_SYSTEM_RAM=y +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y +CONFIG_MEMORY_HOTPLUG=y +# CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE is not set +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_MHP_MEMMAP_ON_MEMORY=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y +CONFIG_MEMORY_BALLOON=y +CONFIG_BALLOON_COMPACTION=y +CONFIG_COMPACTION=y +CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 +CONFIG_PAGE_REPORTING=y +CONFIG_MIGRATION=y +CONFIG_DEVICE_MIGRATION=y +CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y +CONFIG_ARCH_ENABLE_THP_MIGRATION=y +CONFIG_CONTIG_ALLOC=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_MMU_NOTIFIER=y +CONFIG_KSM=y +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y +# CONFIG_MEMORY_FAILURE is not set +CONFIG_ARCH_WANTS_THP_SWAP=y +CONFIG_TRANSPARENT_HUGEPAGE=y +# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set +CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y +CONFIG_THP_SWAP=y +# CONFIG_READ_ONLY_THP_FOR_FS is not set +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_USE_PERCPU_NUMA_NODE_ID=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_FRONTSWAP=y +# CONFIG_CMA is not set +CONFIG_GENERIC_EARLY_IOREMAP=y +# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set +# CONFIG_IDLE_PAGE_TRACKING is not set +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y +CONFIG_ARCH_HAS_PTE_DEVMAP=y +CONFIG_ARCH_HAS_ZONE_DMA_SET=y +CONFIG_ZONE_DMA=y +CONFIG_ZONE_DMA32=y +CONFIG_ZONE_DEVICE=y +# CONFIG_DEVICE_PRIVATE is not set +CONFIG_ARCH_USES_HIGH_VMA_FLAGS=y +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PERCPU_STATS=y +# CONFIG_GUP_TEST is not set +CONFIG_ARCH_HAS_PTE_SPECIAL=y +CONFIG_SECRETMEM=y +# CONFIG_ANON_VMA_NAME is not set +CONFIG_USERFAULTFD=y +CONFIG_HAVE_ARCH_USERFAULTFD_MINOR=y +# CONFIG_LRU_GEN is not set +CONFIG_LOCK_MM_AND_FIND_VMA=y + +# +# Data Access Monitoring +# +# CONFIG_DAMON is not set +# end of Data Access Monitoring +# end of Memory Management options + +CONFIG_NET=y +CONFIG_NET_INGRESS=y +CONFIG_NET_EGRESS=y +CONFIG_SKB_EXTENSIONS=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_UNIX=y +CONFIG_UNIX_SCM=y +CONFIG_AF_UNIX_OOB=y +CONFIG_UNIX_DIAG=y +CONFIG_TLS=y +# CONFIG_TLS_DEVICE is not set +# CONFIG_TLS_TOE is not set +CONFIG_XFRM=y +CONFIG_XFRM_OFFLOAD=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_AH=y +CONFIG_XFRM_ESP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_XFRM_ESPINTCP=y +CONFIG_XDP_SOCKETS=y +# CONFIG_XDP_SOCKETS_DIAG is not set +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +CONFIG_IP_PNP=y +CONFIG_IP_PNP_DHCP=y +CONFIG_IP_PNP_BOOTP=y +CONFIG_IP_PNP_RARP=y +CONFIG_NET_IPIP=y +# CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_NET_IP_TUNNEL=y +CONFIG_SYN_COOKIES=y +# CONFIG_NET_IPVTI is not set +CONFIG_NET_UDP_TUNNEL=y +CONFIG_NET_FOU=y +CONFIG_NET_FOU_IP_TUNNELS=y +# CONFIG_INET_AH is not set +# CONFIG_INET_ESP is not set +# CONFIG_INET_IPCOMP is not set +CONFIG_INET_TABLE_PERTURB_ORDER=16 +CONFIG_INET_TUNNEL=y +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +CONFIG_INET_UDP_DIAG=y +CONFIG_INET_RAW_DIAG=y +# CONFIG_INET_DIAG_DESTROY is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +CONFIG_IPV6_ROUTER_PREF=y +CONFIG_IPV6_ROUTE_INFO=y +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_ESP_OFFLOAD=y +CONFIG_INET6_ESPINTCP=y +# CONFIG_INET6_IPCOMP is not set +# CONFIG_IPV6_MIP6 is not set +# CONFIG_IPV6_ILA is not set +CONFIG_INET6_TUNNEL=y +# CONFIG_IPV6_VTI is not set +CONFIG_IPV6_SIT=y +# CONFIG_IPV6_SIT_6RD is not set +CONFIG_IPV6_NDISC_NODETYPE=y +CONFIG_IPV6_TUNNEL=y +CONFIG_IPV6_FOU=y +CONFIG_IPV6_FOU_TUNNEL=y +CONFIG_IPV6_MULTIPLE_TABLES=y +# CONFIG_IPV6_SUBTREES is not set +# CONFIG_IPV6_MROUTE is not set +# CONFIG_IPV6_SEG6_LWTUNNEL is not set +# CONFIG_IPV6_SEG6_HMAC is not set +# CONFIG_IPV6_RPL_LWTUNNEL is not set +# CONFIG_IPV6_IOAM6_LWTUNNEL is not set +# CONFIG_MPTCP is not set +CONFIG_NETWORK_SECMARK=y +CONFIG_NET_PTP_CLASSIFY=y +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y +CONFIG_BRIDGE_NETFILTER=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_INGRESS=y +CONFIG_NETFILTER_EGRESS=y +CONFIG_NETFILTER_SKIP_EGRESS=y +CONFIG_NETFILTER_NETLINK=y +CONFIG_NETFILTER_FAMILY_BRIDGE=y +CONFIG_NETFILTER_FAMILY_ARP=y +# CONFIG_NETFILTER_NETLINK_HOOK is not set +CONFIG_NETFILTER_NETLINK_ACCT=y +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NETFILTER_NETLINK_OSF=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_LOG_SYSLOG=y +CONFIG_NETFILTER_CONNCOUNT=y +CONFIG_NF_CONNTRACK_MARK=y +# CONFIG_NF_CONNTRACK_SECMARK is not set +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_CT_PROTO_DCCP=y +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +# CONFIG_NF_CONNTRACK_SANE is not set +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set +CONFIG_NF_NAT=y +CONFIG_NF_NAT_REDIRECT=y +CONFIG_NF_NAT_MASQUERADE=y +CONFIG_NETFILTER_SYNPROXY=y +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NFT_NUMGEN=y +CONFIG_NFT_CT=y +CONFIG_NFT_CONNLIMIT=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +CONFIG_NFT_TUNNEL=y +CONFIG_NFT_OBJREF=y +CONFIG_NFT_QUEUE=y +CONFIG_NFT_QUOTA=y +CONFIG_NFT_REJECT=y +CONFIG_NFT_REJECT_INET=y +CONFIG_NFT_COMPAT=y +CONFIG_NFT_HASH=y +CONFIG_NFT_FIB=y +CONFIG_NFT_FIB_INET=y +CONFIG_NFT_XFRM=y +CONFIG_NFT_SOCKET=y +CONFIG_NFT_OSF=y +CONFIG_NFT_TPROXY=y +CONFIG_NFT_SYNPROXY=y +CONFIG_NF_DUP_NETDEV=y +CONFIG_NFT_DUP_NETDEV=y +CONFIG_NFT_FWD_NETDEV=y +CONFIG_NFT_FIB_NETDEV=y +CONFIG_NFT_REJECT_NETDEV=y +# CONFIG_NF_FLOW_TABLE is not set +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +CONFIG_NETFILTER_XT_TARGET_AUDIT=y +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_CT=y +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +CONFIG_NETFILTER_XT_TARGET_HMARK=y +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_NAT=y +CONFIG_NETFILTER_XT_TARGET_NETMAP=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +CONFIG_NETFILTER_XT_TARGET_RATEEST=y +CONFIG_NETFILTER_XT_TARGET_REDIRECT=y +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y +CONFIG_NETFILTER_XT_TARGET_TEE=y +CONFIG_NETFILTER_XT_TARGET_TPROXY=y +CONFIG_NETFILTER_XT_TARGET_TRACE=y +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_BPF=y +CONFIG_NETFILTER_XT_MATCH_CGROUP=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +CONFIG_NETFILTER_XT_MATCH_CPU=y +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +CONFIG_NETFILTER_XT_MATCH_IPCOMP=y +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y +# CONFIG_NETFILTER_XT_MATCH_IPVS is not set +CONFIG_NETFILTER_XT_MATCH_L2TP=y +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +CONFIG_NETFILTER_XT_MATCH_NFACCT=y +CONFIG_NETFILTER_XT_MATCH_OSF=y +CONFIG_NETFILTER_XT_MATCH_OWNER=y +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +CONFIG_NETFILTER_XT_MATCH_RATEEST=y +CONFIG_NETFILTER_XT_MATCH_REALM=y +CONFIG_NETFILTER_XT_MATCH_RECENT=y +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_SOCKET=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_TIME=y +CONFIG_NETFILTER_XT_MATCH_U32=y +# end of Core Netfilter Configuration + +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +# CONFIG_IP_SET_BITMAP_IP is not set +# CONFIG_IP_SET_BITMAP_IPMAC is not set +# CONFIG_IP_SET_BITMAP_PORT is not set +CONFIG_IP_SET_HASH_IP=y +# CONFIG_IP_SET_HASH_IPMARK is not set +# CONFIG_IP_SET_HASH_IPPORT is not set +# CONFIG_IP_SET_HASH_IPPORTIP is not set +# CONFIG_IP_SET_HASH_IPPORTNET is not set +# CONFIG_IP_SET_HASH_IPMAC is not set +# CONFIG_IP_SET_HASH_MAC is not set +# CONFIG_IP_SET_HASH_NETPORTNET is not set +# CONFIG_IP_SET_HASH_NET is not set +# CONFIG_IP_SET_HASH_NETNET is not set +# CONFIG_IP_SET_HASH_NETPORT is not set +# CONFIG_IP_SET_HASH_NETIFACE is not set +# CONFIG_IP_SET_LIST_SET is not set +CONFIG_IP_VS=y +# CONFIG_IP_VS_IPV6 is not set +# CONFIG_IP_VS_DEBUG is not set +CONFIG_IP_VS_TAB_BITS=12 + +# +# IPVS transport protocol load balancing support +# +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_PROTO_AH_ESP=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_SCTP=y + +# +# IPVS scheduler +# +# CONFIG_IP_VS_RR is not set +# CONFIG_IP_VS_WRR is not set +# CONFIG_IP_VS_LC is not set +# CONFIG_IP_VS_WLC is not set +# CONFIG_IP_VS_FO is not set +# CONFIG_IP_VS_OVF is not set +# CONFIG_IP_VS_LBLC is not set +# CONFIG_IP_VS_LBLCR is not set +CONFIG_IP_VS_DH=y +# CONFIG_IP_VS_SH is not set +# CONFIG_IP_VS_MH is not set +# CONFIG_IP_VS_SED is not set +# CONFIG_IP_VS_NQ is not set +# CONFIG_IP_VS_TWOS is not set + +# +# IPVS SH scheduler +# +CONFIG_IP_VS_SH_TAB_BITS=8 + +# +# IPVS MH scheduler +# +CONFIG_IP_VS_MH_TAB_INDEX=12 + +# +# IPVS application helper +# +# CONFIG_IP_VS_NFCT is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_SOCKET_IPV4=y +CONFIG_NF_TPROXY_IPV4=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_DUP_IPV4=y +CONFIG_NFT_FIB_IPV4=y +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_DUP_IPV4=y +CONFIG_NF_LOG_ARP=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_REJECT_IPV4=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +CONFIG_IP_NF_MATCH_RPFILTER=y +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_SYNPROXY=y +CONFIG_IP_NF_NAT=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y +# end of IP: Netfilter Configuration + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_SOCKET_IPV6=y +CONFIG_NF_TPROXY_IPV6=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_DUP_IPV6=y +CONFIG_NFT_FIB_IPV6=y +CONFIG_NF_DUP_IPV6=y +CONFIG_NF_REJECT_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_RPFILTER=y +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_MATCH_SRH=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_TARGET_SYNPROXY=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +CONFIG_IP6_NF_NAT=y +CONFIG_IP6_NF_TARGET_MASQUERADE=y +CONFIG_IP6_NF_TARGET_NPT=y +# end of IPv6: Netfilter Configuration + +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_TABLES_BRIDGE=y +# CONFIG_NFT_BRIDGE_META is not set +# CONFIG_NFT_BRIDGE_REJECT is not set +CONFIG_NF_CONNTRACK_BRIDGE=y +CONFIG_BRIDGE_NF_EBTABLES=y +CONFIG_BRIDGE_EBT_BROUTE=y +CONFIG_BRIDGE_EBT_T_FILTER=y +CONFIG_BRIDGE_EBT_T_NAT=y +CONFIG_BRIDGE_EBT_802_3=y +CONFIG_BRIDGE_EBT_AMONG=y +CONFIG_BRIDGE_EBT_ARP=y +CONFIG_BRIDGE_EBT_IP=y +CONFIG_BRIDGE_EBT_IP6=y +CONFIG_BRIDGE_EBT_LIMIT=y +CONFIG_BRIDGE_EBT_MARK=y +CONFIG_BRIDGE_EBT_PKTTYPE=y +CONFIG_BRIDGE_EBT_STP=y +CONFIG_BRIDGE_EBT_VLAN=y +CONFIG_BRIDGE_EBT_ARPREPLY=y +CONFIG_BRIDGE_EBT_DNAT=y +CONFIG_BRIDGE_EBT_MARK_T=y +CONFIG_BRIDGE_EBT_REDIRECT=y +CONFIG_BRIDGE_EBT_SNAT=y +CONFIG_BRIDGE_EBT_LOG=y +CONFIG_BRIDGE_EBT_NFLOG=y +CONFIG_BPFILTER=y +CONFIG_BPFILTER_UMH=y +# CONFIG_IP_DCCP is not set +CONFIG_IP_SCTP=y +# CONFIG_SCTP_DBG_OBJCNT is not set +CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y +# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set +# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set +CONFIG_SCTP_COOKIE_HMAC_MD5=y +# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set +CONFIG_INET_SCTP_DIAG=y +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +# CONFIG_L2TP is not set +CONFIG_STP=y +CONFIG_BRIDGE=y +CONFIG_BRIDGE_IGMP_SNOOPING=y +# CONFIG_BRIDGE_VLAN_FILTERING is not set +# CONFIG_BRIDGE_MRP is not set +# CONFIG_BRIDGE_CFM is not set +# CONFIG_NET_DSA is not set +CONFIG_VLAN_8021Q=y +# CONFIG_VLAN_8021Q_GVRP is not set +# CONFIG_VLAN_8021Q_MVRP is not set +CONFIG_LLC=y +# CONFIG_LLC2 is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_PHONET is not set +# CONFIG_6LOWPAN is not set +# CONFIG_IEEE802154 is not set +CONFIG_NET_SCHED=y + +# +# Queueing/Scheduling +# +CONFIG_NET_SCH_CBQ=y +CONFIG_NET_SCH_HTB=y +CONFIG_NET_SCH_HFSC=y +CONFIG_NET_SCH_PRIO=y +CONFIG_NET_SCH_MULTIQ=y +CONFIG_NET_SCH_RED=y +CONFIG_NET_SCH_SFB=y +CONFIG_NET_SCH_SFQ=y +CONFIG_NET_SCH_TEQL=y +CONFIG_NET_SCH_TBF=y +CONFIG_NET_SCH_CBS=y +CONFIG_NET_SCH_ETF=y +CONFIG_NET_SCH_TAPRIO=y +CONFIG_NET_SCH_GRED=y +CONFIG_NET_SCH_DSMARK=y +CONFIG_NET_SCH_NETEM=y +CONFIG_NET_SCH_DRR=y +CONFIG_NET_SCH_MQPRIO=y +CONFIG_NET_SCH_SKBPRIO=y +CONFIG_NET_SCH_CHOKE=y +CONFIG_NET_SCH_QFQ=y +CONFIG_NET_SCH_CODEL=y +CONFIG_NET_SCH_FQ_CODEL=y +CONFIG_NET_SCH_CAKE=y +CONFIG_NET_SCH_FQ=y +CONFIG_NET_SCH_HHF=y +CONFIG_NET_SCH_PIE=y +CONFIG_NET_SCH_FQ_PIE=y +CONFIG_NET_SCH_INGRESS=y +CONFIG_NET_SCH_PLUG=y +CONFIG_NET_SCH_ETS=y +# CONFIG_NET_SCH_DEFAULT is not set + +# +# Classification +# +CONFIG_NET_CLS=y +CONFIG_NET_CLS_BASIC=y +CONFIG_NET_CLS_ROUTE4=y +CONFIG_NET_CLS_FW=y +CONFIG_NET_CLS_U32=y +CONFIG_CLS_U32_PERF=y +CONFIG_CLS_U32_MARK=y +CONFIG_NET_CLS_FLOW=y +CONFIG_NET_CLS_CGROUP=y +CONFIG_NET_CLS_BPF=y +CONFIG_NET_CLS_FLOWER=y +CONFIG_NET_CLS_MATCHALL=y +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_STACK=32 +CONFIG_NET_EMATCH_CMP=y +CONFIG_NET_EMATCH_NBYTE=y +CONFIG_NET_EMATCH_U32=y +CONFIG_NET_EMATCH_META=y +CONFIG_NET_EMATCH_TEXT=y +# CONFIG_NET_EMATCH_IPSET is not set +CONFIG_NET_EMATCH_IPT=y +CONFIG_NET_CLS_ACT=y +CONFIG_NET_ACT_POLICE=y +CONFIG_NET_ACT_GACT=y +CONFIG_GACT_PROB=y +CONFIG_NET_ACT_MIRRED=y +CONFIG_NET_ACT_SAMPLE=y +CONFIG_NET_ACT_IPT=y +CONFIG_NET_ACT_NAT=y +CONFIG_NET_ACT_PEDIT=y +CONFIG_NET_ACT_SIMP=y +CONFIG_NET_ACT_SKBEDIT=y +CONFIG_NET_ACT_CSUM=y +CONFIG_NET_ACT_MPLS=y +CONFIG_NET_ACT_VLAN=y +CONFIG_NET_ACT_BPF=y +CONFIG_NET_ACT_CONNMARK=y +CONFIG_NET_ACT_CTINFO=y +CONFIG_NET_ACT_SKBMOD=y +CONFIG_NET_ACT_IFE=y +CONFIG_NET_ACT_TUNNEL_KEY=y +CONFIG_NET_ACT_GATE=y +CONFIG_NET_IFE_SKBMARK=y +CONFIG_NET_IFE_SKBPRIO=y +CONFIG_NET_IFE_SKBTCINDEX=y +CONFIG_NET_TC_SKB_EXT=y +CONFIG_NET_SCH_FIFO=y +# CONFIG_DCB is not set +CONFIG_DNS_RESOLVER=y +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_VSOCKETS=y +CONFIG_VSOCKETS_DIAG=y +# CONFIG_VSOCKETS_LOOPBACK is not set +CONFIG_VIRTIO_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS_COMMON=y +CONFIG_NETLINK_DIAG=y +# CONFIG_MPLS is not set +# CONFIG_NET_NSH is not set +# CONFIG_HSR is not set +# CONFIG_NET_SWITCHDEV is not set +CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_QRTR is not set +# CONFIG_NET_NCSI is not set +CONFIG_PCPU_DEV_REFCNT=y +CONFIG_RPS=y +CONFIG_RFS_ACCEL=y +CONFIG_SOCK_RX_QUEUE_MAPPING=y +CONFIG_XPS=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_NET_CLASSID=y +CONFIG_NET_RX_BUSY_POLL=y +CONFIG_BQL=y +# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_NET_FLOW_LIMIT=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# end of Network testing +# end of Networking options + +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +# CONFIG_AF_KCM is not set +CONFIG_STREAM_PARSER=y +# CONFIG_MCTP is not set +CONFIG_FIB_RULES=y +# CONFIG_WIRELESS is not set +# CONFIG_RFKILL is not set +# CONFIG_NET_9P is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_PSAMPLE=y +CONFIG_NET_IFE=y +# CONFIG_LWTUNNEL is not set +CONFIG_DST_CACHE=y +CONFIG_GRO_CELLS=y +CONFIG_NET_SOCK_MSG=y +CONFIG_PAGE_POOL=y +# CONFIG_PAGE_POOL_STATS is not set +CONFIG_FAILOVER=y +# CONFIG_ETHTOOL_NETLINK is not set + +# +# Device Drivers +# +CONFIG_ARM_AMBA=y +CONFIG_HAVE_PCI=y +CONFIG_PCI=y +CONFIG_PCI_DOMAINS=y +CONFIG_PCI_DOMAINS_GENERIC=y +CONFIG_PCI_SYSCALL=y +CONFIG_PCIEPORTBUS=y +# CONFIG_HOTPLUG_PCI_PCIE is not set +CONFIG_PCIEAER=y +# CONFIG_PCIEAER_INJECT is not set +# CONFIG_PCIE_ECRC is not set +CONFIG_PCIEASPM=y +CONFIG_PCIEASPM_DEFAULT=y +# CONFIG_PCIEASPM_POWERSAVE is not set +# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set +# CONFIG_PCIEASPM_PERFORMANCE is not set +CONFIG_PCIE_PME=y +# CONFIG_PCIE_DPC is not set +# CONFIG_PCIE_PTM is not set +CONFIG_PCI_MSI=y +CONFIG_PCI_MSI_IRQ_DOMAIN=y +CONFIG_PCI_QUIRKS=y +CONFIG_PCI_DEBUG=y +CONFIG_PCI_STUB=y +CONFIG_PCI_ECAM=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_P2PDMA is not set +CONFIG_PCI_LABEL=y +# CONFIG_PCIE_BUS_TUNE_OFF is not set +CONFIG_PCIE_BUS_DEFAULT=y +# CONFIG_PCIE_BUS_SAFE is not set +# CONFIG_PCIE_BUS_PERFORMANCE is not set +# CONFIG_PCIE_BUS_PEER2PEER is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +CONFIG_HOTPLUG_PCI=y +CONFIG_HOTPLUG_PCI_ACPI=y +# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set + +# +# PCI controller drivers +# +# CONFIG_PCI_FTPCI100 is not set +CONFIG_PCI_HOST_COMMON=y +CONFIG_PCI_HOST_GENERIC=y +# CONFIG_PCIE_XILINX is not set +# CONFIG_PCI_XGENE is not set +# CONFIG_PCIE_ALTERA is not set +# CONFIG_PCI_HOST_THUNDER_PEM is not set +# CONFIG_PCI_HOST_THUNDER_ECAM is not set +# CONFIG_PCIE_MICROCHIP_HOST is not set + +# +# DesignWare PCI Core Support +# +# CONFIG_PCIE_DW_PLAT_HOST is not set +# CONFIG_PCI_HISI is not set +# CONFIG_PCIE_KIRIN is not set +# CONFIG_PCI_MESON is not set +# CONFIG_PCIE_AL is not set +# end of DesignWare PCI Core Support + +# +# Mobiveil PCIe Core Support +# +# end of Mobiveil PCIe Core Support + +# +# Cadence PCIe controllers support +# +# CONFIG_PCIE_CADENCE_PLAT_HOST is not set +# CONFIG_PCI_J721E_HOST is not set +# end of Cadence PCIe controllers support +# end of PCI controller drivers + +# +# PCI Endpoint +# +# CONFIG_PCI_ENDPOINT is not set +# end of PCI Endpoint + +# +# PCI switch controller drivers +# +# CONFIG_PCI_SW_SWITCHTEC is not set +# end of PCI switch controller drivers + +# CONFIG_CXL_BUS is not set +# CONFIG_PCCARD is not set +# CONFIG_RAPIDIO is not set + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER=y +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_DEVTMPFS_SAFE is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y + +# +# Firmware loader +# +CONFIG_FW_LOADER=y +CONFIG_FW_LOADER_PAGED_BUF=y +CONFIG_FW_LOADER_SYSFS=y +CONFIG_EXTRA_FIRMWARE="" +CONFIG_FW_LOADER_USER_HELPER=y +# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set +# CONFIG_FW_LOADER_COMPRESS is not set +# CONFIG_FW_CACHE is not set +# CONFIG_FW_UPLOAD is not set +# end of Firmware loader + +CONFIG_ALLOW_DEV_COREDUMP=y +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y +CONFIG_DMA_SHARED_BUFFER=y +# CONFIG_DMA_FENCE_TRACE is not set +CONFIG_GENERIC_ARCH_TOPOLOGY=y +CONFIG_GENERIC_ARCH_NUMA=y +# end of Generic Driver Options + +# +# Bus devices +# +# CONFIG_BRCMSTB_GISB_ARB is not set +# CONFIG_VEXPRESS_CONFIG is not set +# CONFIG_MHI_BUS is not set +# CONFIG_MHI_BUS_EP is not set +# end of Bus devices + +CONFIG_CONNECTOR=y +CONFIG_PROC_EVENTS=y + +# +# Firmware Drivers +# + +# +# ARM System Control and Management Interface Protocol +# +# CONFIG_ARM_SCMI_PROTOCOL is not set +# end of ARM System Control and Management Interface Protocol + +# CONFIG_ARM_SCPI_PROTOCOL is not set +CONFIG_FIRMWARE_MEMMAP=y +CONFIG_DMIID=y +CONFIG_DMI_SYSFS=y +# CONFIG_FW_CFG_SYSFS is not set +# CONFIG_SYSFB_SIMPLEFB is not set +# CONFIG_ARM_FFA_TRANSPORT is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# EFI (Extensible Firmware Interface) Support +# +CONFIG_EFI_ESRT=y +CONFIG_EFI_PARAMS_FROM_FDT=y +CONFIG_EFI_RUNTIME_WRAPPERS=y +CONFIG_EFI_GENERIC_STUB=y +# CONFIG_EFI_ZBOOT is not set +CONFIG_EFI_ARMSTUB_DTB_LOADER=y +CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y +# CONFIG_EFI_BOOTLOADER_CONTROL is not set +# CONFIG_EFI_CAPSULE_LOADER is not set +# CONFIG_EFI_TEST is not set +# CONFIG_RESET_ATTACK_MITIGATION is not set +# CONFIG_EFI_DISABLE_PCI_DMA is not set +CONFIG_EFI_EARLYCON=y +# CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set +# CONFIG_EFI_DISABLE_RUNTIME is not set +# CONFIG_EFI_COCO_SECRET is not set +# end of EFI (Extensible Firmware Interface) Support + +CONFIG_ARM_PSCI_FW=y +# CONFIG_ARM_PSCI_CHECKER is not set +CONFIG_HAVE_ARM_SMCCC=y +CONFIG_HAVE_ARM_SMCCC_DISCOVERY=y +# CONFIG_ARM_SMCCC_SOC_ID is not set + +# +# Tegra firmware driver +# +# end of Tegra firmware driver +# end of Firmware Drivers + +# CONFIG_GNSS is not set +# CONFIG_MTD is not set +CONFIG_DTC=y +CONFIG_OF=y +# CONFIG_OF_UNITTEST is not set +CONFIG_OF_FLATTREE=y +CONFIG_OF_EARLY_FLATTREE=y +CONFIG_OF_KOBJ=y +CONFIG_OF_ADDRESS=y +CONFIG_OF_IRQ=y +CONFIG_OF_RESERVED_MEM=y +# CONFIG_OF_OVERLAY is not set +CONFIG_OF_NUMA=y +# CONFIG_PARPORT is not set +CONFIG_PNP=y +# CONFIG_PNP_DEBUG_MESSAGES is not set + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +CONFIG_BLK_DEV_NULL_BLK=y +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +CONFIG_ZRAM=y +CONFIG_ZRAM_DEF_COMP_LZORLE=y +# CONFIG_ZRAM_DEF_COMP_LZO is not set +CONFIG_ZRAM_DEF_COMP="lzo-rle" +# CONFIG_ZRAM_WRITEBACK is not set +# CONFIG_ZRAM_MEMORY_TRACKING is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_DRBD is not set +# CONFIG_BLK_DEV_NBD is not set +CONFIG_BLK_DEV_RAM=y +CONFIG_BLK_DEV_RAM_COUNT=16 +CONFIG_BLK_DEV_RAM_SIZE=16384 +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_RBD is not set +# CONFIG_BLK_DEV_UBLK is not set + +# +# NVME Support +# +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_NVME_FC is not set +# CONFIG_NVME_TCP is not set +# CONFIG_NVME_TARGET is not set +# end of NVME Support + +# +# Misc devices +# +# CONFIG_AD525X_DPOT is not set +# CONFIG_DUMMY_IRQ is not set +# CONFIG_PHANTOM is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ICS932S401 is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_APDS9802ALS is not set +# CONFIG_ISL29003 is not set +# CONFIG_ISL29020 is not set +# CONFIG_SENSORS_TSL2550 is not set +# CONFIG_SENSORS_BH1770 is not set +# CONFIG_SENSORS_APDS990X is not set +# CONFIG_HMC6352 is not set +# CONFIG_DS1682 is not set +# CONFIG_SRAM is not set +# CONFIG_DW_XDATA_PCIE is not set +# CONFIG_PCI_ENDPOINT_TEST is not set +# CONFIG_XILINX_SDFEC is not set +# CONFIG_OPEN_DICE is not set +# CONFIG_VCPU_STALL_DETECTOR is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_AT24 is not set +# CONFIG_EEPROM_LEGACY is not set +# CONFIG_EEPROM_MAX6875 is not set +# CONFIG_EEPROM_93CX6 is not set +# CONFIG_EEPROM_IDT_89HPESX is not set +# CONFIG_EEPROM_EE1004 is not set +# end of EEPROM support + +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# +# CONFIG_TI_ST is not set +# end of Texas Instruments shared transport line discipline + +# CONFIG_SENSORS_LIS3_I2C is not set +# CONFIG_ALTERA_STAPL is not set +# CONFIG_VMWARE_VMCI is not set +# CONFIG_GENWQE is not set +# CONFIG_ECHO is not set +# CONFIG_BCM_VK is not set +# CONFIG_MISC_ALCOR_PCI is not set +# CONFIG_MISC_RTSX_PCI is not set +# CONFIG_HABANA_AI is not set +# CONFIG_UACCE is not set +# CONFIG_PVPANIC is not set +# CONFIG_GP_PCI1XXXX is not set +# end of Misc devices + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# end of SCSI device support + +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_TARGET_CORE is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# end of IEEE 1394 (FireWire) support + +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +# CONFIG_DUMMY is not set +CONFIG_WIREGUARD=y +# CONFIG_WIREGUARD_DEBUG is not set +# CONFIG_EQUALIZER is not set +# CONFIG_IFB is not set +# CONFIG_NET_TEAM is not set +CONFIG_MACVLAN=y +# CONFIG_MACVTAP is not set +CONFIG_IPVLAN_L3S=y +CONFIG_IPVLAN=y +# CONFIG_IPVTAP is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y +# CONFIG_BAREUDP is not set +# CONFIG_GTP is not set +# CONFIG_MACSEC is not set +# CONFIG_NETCONSOLE is not set +CONFIG_TUN=y +# CONFIG_TUN_VNET_CROSS_LE is not set +CONFIG_VETH=y +CONFIG_VIRTIO_NET=y +# CONFIG_NLMON is not set +# CONFIG_NET_VRF is not set +# CONFIG_ARCNET is not set +# CONFIG_ETHERNET is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PSE_CONTROLLER is not set +# CONFIG_MDIO_DEVICE is not set + +# +# PCS device drivers +# +# end of PCS device drivers + +# CONFIG_PPP is not set +# CONFIG_SLIP is not set + +# +# Host-side USB support is needed for USB Network Adapter support +# +# CONFIG_WLAN is not set +# CONFIG_WAN is not set + +# +# Wireless WAN +# +# CONFIG_WWAN is not set +# end of Wireless WAN + +# CONFIG_VMXNET3 is not set +# CONFIG_FUJITSU_ES is not set +# CONFIG_NETDEVSIM is not set +CONFIG_NET_FAILOVER=y +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +CONFIG_INPUT_FF_MEMLESS=y +CONFIG_INPUT_SPARSEKMAP=y +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +CONFIG_INPUT_EVDEV=y +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +# CONFIG_KEYBOARD_ADP5588 is not set +# CONFIG_KEYBOARD_ADP5589 is not set +# CONFIG_KEYBOARD_ATKBD is not set +# CONFIG_KEYBOARD_QT1050 is not set +# CONFIG_KEYBOARD_QT1070 is not set +# CONFIG_KEYBOARD_QT2160 is not set +# CONFIG_KEYBOARD_DLINK_DIR685 is not set +# CONFIG_KEYBOARD_LKKBD is not set +CONFIG_KEYBOARD_GPIO=y +CONFIG_KEYBOARD_GPIO_POLLED=y +# CONFIG_KEYBOARD_TCA6416 is not set +# CONFIG_KEYBOARD_TCA8418 is not set +# CONFIG_KEYBOARD_MATRIX is not set +# CONFIG_KEYBOARD_LM8333 is not set +# CONFIG_KEYBOARD_MAX7359 is not set +# CONFIG_KEYBOARD_MCS is not set +# CONFIG_KEYBOARD_MPR121 is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_SAMSUNG is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_XTKBD is not set +# CONFIG_KEYBOARD_CAP11XX is not set +# CONFIG_KEYBOARD_BCM is not set +# CONFIG_KEYBOARD_CYPRESS_SF is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +CONFIG_INPUT_MISC=y +# CONFIG_INPUT_AD714X is not set +# CONFIG_INPUT_ATMEL_CAPTOUCH is not set +# CONFIG_INPUT_BMA150 is not set +# CONFIG_INPUT_E3X0_BUTTON is not set +# CONFIG_INPUT_MMA8450 is not set +# CONFIG_INPUT_GPIO_BEEPER is not set +# CONFIG_INPUT_GPIO_DECODER is not set +# CONFIG_INPUT_GPIO_VIBRA is not set +# CONFIG_INPUT_KXTJ9 is not set +CONFIG_INPUT_UINPUT=y +# CONFIG_INPUT_PCF8574 is not set +# CONFIG_INPUT_GPIO_ROTARY_ENCODER is not set +# CONFIG_INPUT_DA7280_HAPTICS is not set +# CONFIG_INPUT_ADXL34X is not set +# CONFIG_INPUT_IQS269A is not set +# CONFIG_INPUT_IQS626A is not set +# CONFIG_INPUT_IQS7222 is not set +# CONFIG_INPUT_CMA3000 is not set +# CONFIG_INPUT_SOC_BUTTON_ARRAY is not set +# CONFIG_INPUT_DRV260X_HAPTICS is not set +# CONFIG_INPUT_DRV2665_HAPTICS is not set +# CONFIG_INPUT_DRV2667_HAPTICS is not set +# CONFIG_RMI4_CORE is not set + +# +# Hardware I/O ports +# +# CONFIG_SERIO is not set +# CONFIG_GAMEPORT is not set +# end of Hardware I/O ports +# end of Input device support + +# +# Character devices +# +CONFIG_TTY=y +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_VT_CONSOLE_SLEEP=y +CONFIG_HW_CONSOLE=y +CONFIG_VT_HW_CONSOLE_BINDING=y +CONFIG_UNIX98_PTYS=y +# CONFIG_LEGACY_PTYS is not set +# CONFIG_LDISC_AUTOLOAD is not set + +# +# Serial drivers +# +CONFIG_SERIAL_EARLYCON=y +CONFIG_SERIAL_8250=y +# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set +CONFIG_SERIAL_8250_PNP=y +# CONFIG_SERIAL_8250_16550A_VARIANTS is not set +# CONFIG_SERIAL_8250_FINTEK is not set +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_DMA=y +CONFIG_SERIAL_8250_PCI=y +CONFIG_SERIAL_8250_EXAR=y +CONFIG_SERIAL_8250_NR_UARTS=1 +CONFIG_SERIAL_8250_RUNTIME_UARTS=1 +# CONFIG_SERIAL_8250_EXTENDED is not set +CONFIG_SERIAL_8250_FSL=y +# CONFIG_SERIAL_8250_DW is not set +# CONFIG_SERIAL_8250_RT288X is not set +CONFIG_SERIAL_8250_PERICOM=y +CONFIG_SERIAL_OF_PLATFORM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_AMBA_PL010 is not set +CONFIG_SERIAL_AMBA_PL011=y +CONFIG_SERIAL_AMBA_PL011_CONSOLE=y +# CONFIG_SERIAL_EARLYCON_ARM_SEMIHOST is not set +# CONFIG_SERIAL_UARTLITE is not set +CONFIG_SERIAL_CORE=y +CONFIG_SERIAL_CORE_CONSOLE=y +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_SIFIVE is not set +# CONFIG_SERIAL_SCCNXP is not set +# CONFIG_SERIAL_SC16IS7XX is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +# CONFIG_SERIAL_XILINX_PS_UART is not set +CONFIG_SERIAL_ARC=y +# CONFIG_SERIAL_ARC_CONSOLE is not set +CONFIG_SERIAL_ARC_NR_PORTS=1 +# CONFIG_SERIAL_RP2 is not set +# CONFIG_SERIAL_FSL_LPUART is not set +# CONFIG_SERIAL_FSL_LINFLEXUART is not set +# CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set +# CONFIG_SERIAL_SPRD is not set +# end of Serial drivers + +CONFIG_SERIAL_MCTRL_GPIO=y +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_N_GSM is not set +# CONFIG_NOZOMI is not set +# CONFIG_NULL_TTY is not set +CONFIG_HVC_DRIVER=y +# CONFIG_HVC_DCC is not set +CONFIG_SERIAL_DEV_BUS=y +CONFIG_SERIAL_DEV_CTRL_TTYPORT=y +# CONFIG_TTY_PRINTK is not set +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +CONFIG_HW_RANDOM=y +# CONFIG_HW_RANDOM_TIMERIOMEM is not set +# CONFIG_HW_RANDOM_BA431 is not set +CONFIG_HW_RANDOM_VIRTIO=y +# CONFIG_HW_RANDOM_CCTRNG is not set +# CONFIG_HW_RANDOM_XIPHERA is not set +CONFIG_HW_RANDOM_ARM_SMCCC_TRNG=y +CONFIG_HW_RANDOM_CN10K=y +# CONFIG_APPLICOM is not set +CONFIG_DEVMEM=y +CONFIG_DEVPORT=y +# CONFIG_TCG_TPM is not set +# CONFIG_XILLYBUS is not set +# CONFIG_RANDOM_TRUST_CPU is not set +# CONFIG_RANDOM_TRUST_BOOTLOADER is not set +# end of Character devices + +# +# I2C support +# +CONFIG_I2C=y +CONFIG_ACPI_I2C_OPREGION=y +CONFIG_I2C_BOARDINFO=y +CONFIG_I2C_COMPAT=y +# CONFIG_I2C_CHARDEV is not set +# CONFIG_I2C_MUX is not set +CONFIG_I2C_HELPER_AUTO=y +CONFIG_I2C_ALGOBIT=y + +# +# I2C Hardware Bus support +# + +# +# PC SMBus host controller drivers +# +# CONFIG_I2C_ALI1535 is not set +# CONFIG_I2C_ALI1563 is not set +# CONFIG_I2C_ALI15X3 is not set +# CONFIG_I2C_AMD756 is not set +# CONFIG_I2C_AMD8111 is not set +# CONFIG_I2C_AMD_MP2 is not set +# CONFIG_I2C_I801 is not set +# CONFIG_I2C_ISCH is not set +# CONFIG_I2C_PIIX4 is not set +# CONFIG_I2C_NFORCE2 is not set +# CONFIG_I2C_NVIDIA_GPU is not set +# CONFIG_I2C_SIS5595 is not set +# CONFIG_I2C_SIS630 is not set +# CONFIG_I2C_SIS96X is not set +# CONFIG_I2C_VIA is not set +# CONFIG_I2C_VIAPRO is not set + +# +# ACPI drivers +# +# CONFIG_I2C_SCMI is not set + +# +# I2C system bus drivers (mostly embedded / system-on-chip) +# +# CONFIG_I2C_CADENCE is not set +# CONFIG_I2C_CBUS_GPIO is not set +# CONFIG_I2C_DESIGNWARE_PLATFORM is not set +# CONFIG_I2C_DESIGNWARE_PCI is not set +# CONFIG_I2C_EMEV2 is not set +# CONFIG_I2C_GPIO is not set +# CONFIG_I2C_HISI is not set +# CONFIG_I2C_NOMADIK is not set +# CONFIG_I2C_OCORES is not set +# CONFIG_I2C_PCA_PLATFORM is not set +# CONFIG_I2C_RK3X is not set +# CONFIG_I2C_SIMTEC is not set +# CONFIG_I2C_THUNDERX is not set +# CONFIG_I2C_XILINX is not set + +# +# External I2C/SMBus adapter drivers +# +# CONFIG_I2C_PCI1XXXX is not set +# CONFIG_I2C_TAOS_EVM is not set + +# +# Other I2C/SMBus bus drivers +# +# CONFIG_I2C_VIRTIO is not set +# end of I2C Hardware Bus support + +# CONFIG_I2C_SLAVE is not set +# CONFIG_I2C_DEBUG_CORE is not set +# CONFIG_I2C_DEBUG_ALGO is not set +# CONFIG_I2C_DEBUG_BUS is not set +# end of I2C support + +# CONFIG_I3C is not set +# CONFIG_SPI is not set +# CONFIG_SPMI is not set +# CONFIG_HSI is not set +CONFIG_PPS=y +CONFIG_PPS_DEBUG=y + +# +# PPS clients support +# +CONFIG_PPS_CLIENT_KTIMER=y +CONFIG_PPS_CLIENT_LDISC=y +CONFIG_PPS_CLIENT_GPIO=y + +# +# PPS generators support +# + +# +# PTP clock support +# +CONFIG_PTP_1588_CLOCK=y +CONFIG_PTP_1588_CLOCK_OPTIONAL=y + +# +# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. +# +CONFIG_PTP_1588_CLOCK_KVM=y +# CONFIG_PTP_1588_CLOCK_IDT82P33 is not set +# CONFIG_PTP_1588_CLOCK_IDTCM is not set +# end of PTP clock support + +# CONFIG_PINCTRL is not set +CONFIG_GPIOLIB=y +CONFIG_GPIOLIB_FASTPATH_LIMIT=512 +CONFIG_OF_GPIO=y +CONFIG_GPIO_ACPI=y +CONFIG_GPIOLIB_IRQCHIP=y +# CONFIG_DEBUG_GPIO is not set +# CONFIG_GPIO_SYSFS is not set +# CONFIG_GPIO_CDEV is not set + +# +# Memory mapped GPIO drivers +# +# CONFIG_GPIO_74XX_MMIO is not set +# CONFIG_GPIO_ALTERA is not set +# CONFIG_GPIO_AMDPT is not set +# CONFIG_GPIO_CADENCE is not set +# CONFIG_GPIO_DWAPB is not set +# CONFIG_GPIO_EXAR is not set +# CONFIG_GPIO_FTGPIO010 is not set +# CONFIG_GPIO_GENERIC_PLATFORM is not set +# CONFIG_GPIO_GRGPIO is not set +# CONFIG_GPIO_HISI is not set +# CONFIG_GPIO_HLWD is not set +# CONFIG_GPIO_MB86S7X is not set +CONFIG_GPIO_PL061=y +# CONFIG_GPIO_SIFIVE is not set +# CONFIG_GPIO_XGENE is not set +# CONFIG_GPIO_XILINX is not set +# CONFIG_GPIO_AMD_FCH is not set +# end of Memory mapped GPIO drivers + +# +# I2C GPIO expanders +# +# CONFIG_GPIO_ADNP is not set +# CONFIG_GPIO_GW_PLD is not set +# CONFIG_GPIO_MAX7300 is not set +# CONFIG_GPIO_MAX732X is not set +# CONFIG_GPIO_PCA953X is not set +# CONFIG_GPIO_PCA9570 is not set +# CONFIG_GPIO_PCF857X is not set +# CONFIG_GPIO_TPIC2810 is not set +# end of I2C GPIO expanders + +# +# MFD GPIO expanders +# +# end of MFD GPIO expanders + +# +# PCI GPIO expanders +# +# CONFIG_GPIO_BT8XX is not set +# CONFIG_GPIO_PCI_IDIO_16 is not set +# CONFIG_GPIO_PCIE_IDIO_24 is not set +# CONFIG_GPIO_RDC321X is not set +# end of PCI GPIO expanders + +# +# Virtual GPIO drivers +# +# CONFIG_GPIO_AGGREGATOR is not set +# CONFIG_GPIO_MOCKUP is not set +CONFIG_GPIO_VIRTIO=y +# CONFIG_GPIO_SIM is not set +# end of Virtual GPIO drivers + +# CONFIG_W1 is not set +CONFIG_POWER_RESET=y +# CONFIG_POWER_RESET_GPIO is not set +# CONFIG_POWER_RESET_GPIO_RESTART is not set +# CONFIG_POWER_RESET_LTC2952 is not set +# CONFIG_POWER_RESET_RESTART is not set +# CONFIG_POWER_RESET_XGENE is not set +# CONFIG_POWER_RESET_SYSCON is not set +# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set +# CONFIG_NVMEM_REBOOT_MODE is not set +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_PDA_POWER is not set +# CONFIG_IP5XXX_POWER is not set +# CONFIG_TEST_POWER is not set +# CONFIG_CHARGER_ADP5061 is not set +# CONFIG_BATTERY_CW2015 is not set +# CONFIG_BATTERY_DS2780 is not set +# CONFIG_BATTERY_DS2781 is not set +# CONFIG_BATTERY_DS2782 is not set +# CONFIG_BATTERY_SAMSUNG_SDI is not set +# CONFIG_BATTERY_SBS is not set +# CONFIG_CHARGER_SBS is not set +# CONFIG_BATTERY_BQ27XXX is not set +# CONFIG_BATTERY_MAX17040 is not set +# CONFIG_BATTERY_MAX17042 is not set +# CONFIG_CHARGER_MAX8903 is not set +# CONFIG_CHARGER_LP8727 is not set +# CONFIG_CHARGER_GPIO is not set +# CONFIG_CHARGER_LT3651 is not set +# CONFIG_CHARGER_LTC4162L is not set +# CONFIG_CHARGER_DETECTOR_MAX14656 is not set +# CONFIG_CHARGER_MAX77976 is not set +# CONFIG_CHARGER_BQ2415X is not set +# CONFIG_CHARGER_BQ24257 is not set +# CONFIG_CHARGER_BQ24735 is not set +# CONFIG_CHARGER_BQ2515X is not set +# CONFIG_CHARGER_BQ25890 is not set +# CONFIG_CHARGER_BQ25980 is not set +# CONFIG_CHARGER_BQ256XX is not set +# CONFIG_BATTERY_GAUGE_LTC2941 is not set +# CONFIG_BATTERY_GOLDFISH is not set +# CONFIG_BATTERY_RT5033 is not set +# CONFIG_CHARGER_RT9455 is not set +# CONFIG_CHARGER_BD99954 is not set +# CONFIG_BATTERY_UG3105 is not set +# CONFIG_HWMON is not set +CONFIG_THERMAL=y +# CONFIG_THERMAL_NETLINK is not set +# CONFIG_THERMAL_STATISTICS is not set +CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 +CONFIG_THERMAL_OF=y +CONFIG_THERMAL_WRITABLE_TRIPS=y +CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y +# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set +# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set +CONFIG_THERMAL_GOV_FAIR_SHARE=y +CONFIG_THERMAL_GOV_STEP_WISE=y +# CONFIG_THERMAL_GOV_BANG_BANG is not set +CONFIG_THERMAL_GOV_USER_SPACE=y +# CONFIG_CPU_THERMAL is not set +# CONFIG_THERMAL_EMULATION is not set +# CONFIG_THERMAL_MMIO is not set +CONFIG_WATCHDOG=y +CONFIG_WATCHDOG_CORE=y +# CONFIG_WATCHDOG_NOWAYOUT is not set +CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y +CONFIG_WATCHDOG_OPEN_TIMEOUT=0 +# CONFIG_WATCHDOG_SYSFS is not set +# CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set + +# +# Watchdog Pretimeout Governors +# +# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set + +# +# Watchdog Device Drivers +# +# CONFIG_SOFT_WATCHDOG is not set +# CONFIG_GPIO_WATCHDOG is not set +# CONFIG_WDAT_WDT is not set +# CONFIG_XILINX_WATCHDOG is not set +# CONFIG_ZIIRAVE_WATCHDOG is not set +# CONFIG_ARM_SP805_WATCHDOG is not set +# CONFIG_ARM_SBSA_WATCHDOG is not set +# CONFIG_CADENCE_WATCHDOG is not set +# CONFIG_DW_WATCHDOG is not set +# CONFIG_MAX63XX_WATCHDOG is not set +# CONFIG_ARM_SMC_WATCHDOG is not set +# CONFIG_ALIM7101_WDT is not set +# CONFIG_I6300ESB_WDT is not set +# CONFIG_HP_WATCHDOG is not set +# CONFIG_MEN_A21_WDT is not set + +# +# PCI-based Watchdog Cards +# +# CONFIG_PCIPCWATCHDOG is not set +# CONFIG_WDTPCI is not set +CONFIG_SSB_POSSIBLE=y +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_ACT8945A is not set +# CONFIG_MFD_AS3711 is not set +# CONFIG_MFD_AS3722 is not set +# CONFIG_PMIC_ADP5520 is not set +# CONFIG_MFD_AAT2870_CORE is not set +# CONFIG_MFD_ATMEL_FLEXCOM is not set +# CONFIG_MFD_ATMEL_HLCDC is not set +# CONFIG_MFD_BCM590XX is not set +# CONFIG_MFD_BD9571MWV is not set +# CONFIG_MFD_AXP20X_I2C is not set +# CONFIG_MFD_MADERA is not set +# CONFIG_PMIC_DA903X is not set +# CONFIG_MFD_DA9052_I2C is not set +# CONFIG_MFD_DA9055 is not set +# CONFIG_MFD_DA9062 is not set +# CONFIG_MFD_DA9063 is not set +# CONFIG_MFD_DA9150 is not set +# CONFIG_MFD_GATEWORKS_GSC is not set +# CONFIG_MFD_MC13XXX_I2C is not set +# CONFIG_MFD_MP2629 is not set +# CONFIG_MFD_HI6421_PMIC is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_HTC_I2CPLD is not set +# CONFIG_LPC_ICH is not set +# CONFIG_LPC_SCH is not set +# CONFIG_MFD_IQS62X is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_KEMPLD is not set +# CONFIG_MFD_88PM800 is not set +# CONFIG_MFD_88PM805 is not set +# CONFIG_MFD_88PM860X is not set +# CONFIG_MFD_MAX14577 is not set +# CONFIG_MFD_MAX77620 is not set +# CONFIG_MFD_MAX77650 is not set +# CONFIG_MFD_MAX77686 is not set +# CONFIG_MFD_MAX77693 is not set +# CONFIG_MFD_MAX77714 is not set +# CONFIG_MFD_MAX77843 is not set +# CONFIG_MFD_MAX8907 is not set +# CONFIG_MFD_MAX8925 is not set +# CONFIG_MFD_MAX8997 is not set +# CONFIG_MFD_MAX8998 is not set +# CONFIG_MFD_MT6360 is not set +# CONFIG_MFD_MT6370 is not set +# CONFIG_MFD_MT6397 is not set +# CONFIG_MFD_MENF21BMC is not set +# CONFIG_MFD_NTXEC is not set +# CONFIG_MFD_RETU is not set +# CONFIG_MFD_PCF50633 is not set +# CONFIG_MFD_SY7636A is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_RT4831 is not set +# CONFIG_MFD_RT5033 is not set +# CONFIG_MFD_RT5120 is not set +# CONFIG_MFD_RC5T583 is not set +# CONFIG_MFD_RK808 is not set +# CONFIG_MFD_RN5T618 is not set +# CONFIG_MFD_SEC_CORE is not set +# CONFIG_MFD_SI476X_CORE is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_MFD_SKY81452 is not set +# CONFIG_MFD_STMPE is not set +# CONFIG_MFD_SYSCON is not set +# CONFIG_MFD_TI_AM335X_TSCADC is not set +# CONFIG_MFD_LP3943 is not set +# CONFIG_MFD_LP8788 is not set +# CONFIG_MFD_TI_LMU is not set +# CONFIG_MFD_PALMAS is not set +# CONFIG_TPS6105X is not set +# CONFIG_TPS65010 is not set +# CONFIG_TPS6507X is not set +# CONFIG_MFD_TPS65086 is not set +# CONFIG_MFD_TPS65090 is not set +# CONFIG_MFD_TPS65217 is not set +# CONFIG_MFD_TI_LP873X is not set +# CONFIG_MFD_TI_LP87565 is not set +# CONFIG_MFD_TPS65218 is not set +# CONFIG_MFD_TPS6586X is not set +# CONFIG_MFD_TPS65910 is not set +# CONFIG_MFD_TPS65912_I2C is not set +# CONFIG_TWL4030_CORE is not set +# CONFIG_TWL6040_CORE is not set +# CONFIG_MFD_WL1273_CORE is not set +# CONFIG_MFD_LM3533 is not set +# CONFIG_MFD_TC3589X is not set +# CONFIG_MFD_TQMX86 is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_MFD_LOCHNAGAR is not set +# CONFIG_MFD_ARIZONA_I2C is not set +# CONFIG_MFD_WM8400 is not set +# CONFIG_MFD_WM831X_I2C is not set +# CONFIG_MFD_WM8350_I2C is not set +# CONFIG_MFD_WM8994 is not set +# CONFIG_MFD_ROHM_BD718XX is not set +# CONFIG_MFD_ROHM_BD71828 is not set +# CONFIG_MFD_ROHM_BD957XMUF is not set +# CONFIG_MFD_STPMIC1 is not set +# CONFIG_MFD_STMFX is not set +# CONFIG_MFD_ATC260X_I2C is not set +# CONFIG_MFD_QCOM_PM8008 is not set +# CONFIG_RAVE_SP_CORE is not set +# CONFIG_MFD_RSMU_I2C is not set +# end of Multifunction device drivers + +# CONFIG_REGULATOR is not set +# CONFIG_RC_CORE is not set + +# +# CEC support +# +# CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support + +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +CONFIG_DRM=y +# CONFIG_DRM_DEBUG_MM is not set +CONFIG_DRM_KMS_HELPER=y +# CONFIG_DRM_DEBUG_DP_MST_TOPOLOGY_REFS is not set +# CONFIG_DRM_DEBUG_MODESET_LOCK is not set +CONFIG_DRM_FBDEV_EMULATION=y +CONFIG_DRM_FBDEV_OVERALLOC=100 +# CONFIG_DRM_FBDEV_LEAK_PHYS_SMEM is not set +# CONFIG_DRM_LOAD_EDID_FIRMWARE is not set +CONFIG_DRM_GEM_SHMEM_HELPER=y + +# +# I2C encoder or helper chips +# +# CONFIG_DRM_I2C_CH7006 is not set +# CONFIG_DRM_I2C_SIL164 is not set +# CONFIG_DRM_I2C_NXP_TDA998X is not set +# CONFIG_DRM_I2C_NXP_TDA9950 is not set +# end of I2C encoder or helper chips + +# +# ARM devices +# +# CONFIG_DRM_HDLCD is not set +# CONFIG_DRM_MALI_DISPLAY is not set +# CONFIG_DRM_KOMEDA is not set +# end of ARM devices + +# CONFIG_DRM_RADEON is not set +# CONFIG_DRM_AMDGPU is not set +# CONFIG_DRM_NOUVEAU is not set +# CONFIG_DRM_VGEM is not set +# CONFIG_DRM_VKMS is not set +# CONFIG_DRM_VMWGFX is not set +# CONFIG_DRM_AST is not set +# CONFIG_DRM_MGAG200 is not set +# CONFIG_DRM_RCAR_DW_HDMI is not set +# CONFIG_DRM_RCAR_USE_LVDS is not set +# CONFIG_DRM_RCAR_USE_MIPI_DSI is not set +# CONFIG_DRM_QXL is not set +# CONFIG_DRM_VIRTIO_GPU is not set +CONFIG_DRM_PANEL=y + +# +# Display Panels +# +# CONFIG_DRM_PANEL_LVDS is not set +# CONFIG_DRM_PANEL_SIMPLE is not set +# CONFIG_DRM_PANEL_EDP is not set +# CONFIG_DRM_PANEL_OLIMEX_LCD_OLINUXINO is not set +# CONFIG_DRM_PANEL_SAMSUNG_ATNA33XC20 is not set +# CONFIG_DRM_PANEL_SAMSUNG_S6E63M0 is not set +# CONFIG_DRM_PANEL_SAMSUNG_S6E88A0_AMS452EF01 is not set +# CONFIG_DRM_PANEL_SAMSUNG_S6E8AA0 is not set +# CONFIG_DRM_PANEL_SEIKO_43WVF1G is not set +# end of Display Panels + +CONFIG_DRM_BRIDGE=y +CONFIG_DRM_PANEL_BRIDGE=y + +# +# Display Interface Bridges +# +# CONFIG_DRM_CDNS_DSI is not set +# CONFIG_DRM_CHIPONE_ICN6211 is not set +# CONFIG_DRM_CHRONTEL_CH7033 is not set +# CONFIG_DRM_DISPLAY_CONNECTOR is not set +# CONFIG_DRM_ITE_IT6505 is not set +# CONFIG_DRM_LONTIUM_LT8912B is not set +# CONFIG_DRM_LONTIUM_LT9211 is not set +# CONFIG_DRM_LONTIUM_LT9611 is not set +# CONFIG_DRM_LONTIUM_LT9611UXC is not set +# CONFIG_DRM_ITE_IT66121 is not set +# CONFIG_DRM_LVDS_CODEC is not set +# CONFIG_DRM_MEGACHIPS_STDPXXXX_GE_B850V3_FW is not set +# CONFIG_DRM_NWL_MIPI_DSI is not set +# CONFIG_DRM_NXP_PTN3460 is not set +# CONFIG_DRM_PARADE_PS8622 is not set +# CONFIG_DRM_PARADE_PS8640 is not set +# CONFIG_DRM_SIL_SII8620 is not set +# CONFIG_DRM_SII902X is not set +# CONFIG_DRM_SII9234 is not set +# CONFIG_DRM_SIMPLE_BRIDGE is not set +# CONFIG_DRM_THINE_THC63LVD1024 is not set +# CONFIG_DRM_TOSHIBA_TC358762 is not set +# CONFIG_DRM_TOSHIBA_TC358764 is not set +# CONFIG_DRM_TOSHIBA_TC358767 is not set +# CONFIG_DRM_TOSHIBA_TC358768 is not set +# CONFIG_DRM_TOSHIBA_TC358775 is not set +# CONFIG_DRM_TI_DLPC3433 is not set +# CONFIG_DRM_TI_TFP410 is not set +# CONFIG_DRM_TI_SN65DSI83 is not set +# CONFIG_DRM_TI_SN65DSI86 is not set +# CONFIG_DRM_TI_TPD12S015 is not set +# CONFIG_DRM_ANALOGIX_ANX6345 is not set +# CONFIG_DRM_ANALOGIX_ANX78XX is not set +# CONFIG_DRM_ANALOGIX_ANX7625 is not set +# CONFIG_DRM_I2C_ADV7511 is not set +# CONFIG_DRM_CDNS_MHDP8546 is not set +# end of Display Interface Bridges + +# CONFIG_DRM_ETNAVIV is not set +# CONFIG_DRM_HISI_HIBMC is not set +# CONFIG_DRM_HISI_KIRIN is not set +# CONFIG_DRM_LOGICVC is not set +# CONFIG_DRM_ARCPGU is not set +# CONFIG_DRM_BOCHS is not set +# CONFIG_DRM_CIRRUS_QEMU is not set +# CONFIG_DRM_SIMPLEDRM is not set +# CONFIG_DRM_PL111 is not set +# CONFIG_DRM_LIMA is not set +# CONFIG_DRM_PANFROST is not set +# CONFIG_DRM_TIDSS is not set +# CONFIG_DRM_SSD130X is not set +# CONFIG_DRM_LEGACY is not set +CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y +CONFIG_DRM_NOMODESET=y + +# +# Frame buffer Devices +# +CONFIG_FB_CMDLINE=y +CONFIG_FB_NOTIFY=y +CONFIG_FB=y +# CONFIG_FIRMWARE_EDID is not set +CONFIG_FB_CFB_FILLRECT=y +CONFIG_FB_CFB_COPYAREA=y +CONFIG_FB_CFB_IMAGEBLIT=y +CONFIG_FB_SYS_FILLRECT=y +CONFIG_FB_SYS_COPYAREA=y +CONFIG_FB_SYS_IMAGEBLIT=y +# CONFIG_FB_FOREIGN_ENDIAN is not set +CONFIG_FB_SYS_FOPS=y +CONFIG_FB_DEFERRED_IO=y +# CONFIG_FB_MODE_HELPERS is not set +# CONFIG_FB_TILEBLITTING is not set + +# +# Frame buffer hardware drivers +# +# CONFIG_FB_CIRRUS is not set +# CONFIG_FB_PM2 is not set +# CONFIG_FB_ARMCLCD is not set +# CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ASILIANT is not set +# CONFIG_FB_IMSTT is not set +# CONFIG_FB_UVESA is not set +# CONFIG_FB_EFI is not set +# CONFIG_FB_OPENCORES is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_NVIDIA is not set +# CONFIG_FB_RIVA is not set +# CONFIG_FB_I740 is not set +# CONFIG_FB_MATROX is not set +# CONFIG_FB_RADEON is not set +# CONFIG_FB_ATY128 is not set +# CONFIG_FB_ATY is not set +# CONFIG_FB_S3 is not set +# CONFIG_FB_SAVAGE is not set +# CONFIG_FB_SIS is not set +# CONFIG_FB_NEOMAGIC is not set +# CONFIG_FB_KYRO is not set +# CONFIG_FB_3DFX is not set +# CONFIG_FB_VOODOO1 is not set +# CONFIG_FB_VT8623 is not set +# CONFIG_FB_TRIDENT is not set +# CONFIG_FB_ARK is not set +# CONFIG_FB_PM3 is not set +# CONFIG_FB_CARMINE is not set +# CONFIG_FB_IBM_GXT4500 is not set +# CONFIG_FB_VIRTUAL is not set +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX is not set +# CONFIG_FB_SIMPLE is not set +# CONFIG_FB_SSD1307 is not set +# CONFIG_FB_SM712 is not set +# end of Frame buffer Devices + +# +# Backlight & LCD device support +# +CONFIG_LCD_CLASS_DEVICE=y +# CONFIG_LCD_PLATFORM is not set +CONFIG_BACKLIGHT_CLASS_DEVICE=y +# CONFIG_BACKLIGHT_KTD253 is not set +# CONFIG_BACKLIGHT_QCOM_WLED is not set +# CONFIG_BACKLIGHT_ADP8860 is not set +# CONFIG_BACKLIGHT_ADP8870 is not set +# CONFIG_BACKLIGHT_LM3639 is not set +# CONFIG_BACKLIGHT_GPIO is not set +# CONFIG_BACKLIGHT_LV5207LP is not set +# CONFIG_BACKLIGHT_BD6107 is not set +# CONFIG_BACKLIGHT_ARCXCNN is not set +# end of Backlight & LCD device support + +CONFIG_HDMI=y + +# +# Console display driver support +# +CONFIG_DUMMY_CONSOLE=y +CONFIG_DUMMY_CONSOLE_COLUMNS=80 +CONFIG_DUMMY_CONSOLE_ROWS=25 +CONFIG_FRAMEBUFFER_CONSOLE=y +# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set +CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y +# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set +# end of Console display driver support + +# CONFIG_LOGO is not set +# end of Graphics support + +# CONFIG_SOUND is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +CONFIG_HIDRAW=y +CONFIG_UHID=y +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +# CONFIG_HID_A4TECH is not set +# CONFIG_HID_ACRUX is not set +# CONFIG_HID_AUREAL is not set +# CONFIG_HID_BELKIN is not set +# CONFIG_HID_CHERRY is not set +# CONFIG_HID_COUGAR is not set +# CONFIG_HID_MACALLY is not set +# CONFIG_HID_CMEDIA is not set +# CONFIG_HID_CYPRESS is not set +# CONFIG_HID_DRAGONRISE is not set +# CONFIG_HID_EMS_FF is not set +# CONFIG_HID_ELECOM is not set +# CONFIG_HID_EZKEY is not set +# CONFIG_HID_GEMBIRD is not set +# CONFIG_HID_GFRM is not set +# CONFIG_HID_GLORIOUS is not set +# CONFIG_HID_VIVALDI is not set +# CONFIG_HID_KEYTOUCH is not set +# CONFIG_HID_KYE is not set +# CONFIG_HID_WALTOP is not set +# CONFIG_HID_VIEWSONIC is not set +# CONFIG_HID_VRC2 is not set +# CONFIG_HID_XIAOMI is not set +# CONFIG_HID_GYRATION is not set +# CONFIG_HID_ICADE is not set +# CONFIG_HID_ITE is not set +# CONFIG_HID_JABRA is not set +# CONFIG_HID_TWINHAN is not set +# CONFIG_HID_KENSINGTON is not set +# CONFIG_HID_LCPOWER is not set +# CONFIG_HID_LENOVO is not set +# CONFIG_HID_MAGICMOUSE is not set +# CONFIG_HID_MALTRON is not set +# CONFIG_HID_MAYFLASH is not set +CONFIG_HID_REDRAGON=y +# CONFIG_HID_MICROSOFT is not set +# CONFIG_HID_MONTEREY is not set +# CONFIG_HID_MULTITOUCH is not set +# CONFIG_HID_NTI is not set +# CONFIG_HID_ORTEK is not set +# CONFIG_HID_PANTHERLORD is not set +# CONFIG_HID_PETALYNX is not set +# CONFIG_HID_PICOLCD is not set +# CONFIG_HID_PLANTRONICS is not set +# CONFIG_HID_PXRC is not set +# CONFIG_HID_RAZER is not set +# CONFIG_HID_PRIMAX is not set +# CONFIG_HID_SAITEK is not set +# CONFIG_HID_SEMITEK is not set +# CONFIG_HID_SPEEDLINK is not set +# CONFIG_HID_STEAM is not set +# CONFIG_HID_STEELSERIES is not set +# CONFIG_HID_SUNPLUS is not set +# CONFIG_HID_RMI is not set +# CONFIG_HID_GREENASIA is not set +# CONFIG_HID_SMARTJOYPLUS is not set +# CONFIG_HID_TIVO is not set +# CONFIG_HID_TOPSEED is not set +# CONFIG_HID_TOPRE is not set +# CONFIG_HID_UDRAW_PS3 is not set +# CONFIG_HID_XINMO is not set +# CONFIG_HID_ZEROPLUS is not set +# CONFIG_HID_ZYDACRON is not set +# CONFIG_HID_SENSOR_HUB is not set +# CONFIG_HID_ALPS is not set +# end of Special HID drivers + +# +# I2C HID support +# +# CONFIG_I2C_HID_ACPI is not set +# CONFIG_I2C_HID_OF is not set +# CONFIG_I2C_HID_OF_ELAN is not set +# CONFIG_I2C_HID_OF_GOODIX is not set +# end of I2C HID support +# end of HID support + +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +CONFIG_EDAC_SUPPORT=y +# CONFIG_EDAC is not set +CONFIG_RTC_LIB=y +CONFIG_RTC_CLASS=y +CONFIG_RTC_HCTOSYS=y +CONFIG_RTC_HCTOSYS_DEVICE="rtc0" +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" +# CONFIG_RTC_DEBUG is not set +CONFIG_RTC_NVMEM=y + +# +# RTC interfaces +# +CONFIG_RTC_INTF_SYSFS=y +CONFIG_RTC_INTF_PROC=y +CONFIG_RTC_INTF_DEV=y +# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set +# CONFIG_RTC_DRV_TEST is not set + +# +# I2C RTC drivers +# +# CONFIG_RTC_DRV_ABB5ZES3 is not set +# CONFIG_RTC_DRV_ABEOZ9 is not set +# CONFIG_RTC_DRV_ABX80X is not set +# CONFIG_RTC_DRV_DS1307 is not set +# CONFIG_RTC_DRV_DS1374 is not set +# CONFIG_RTC_DRV_DS1672 is not set +# CONFIG_RTC_DRV_HYM8563 is not set +# CONFIG_RTC_DRV_MAX6900 is not set +# CONFIG_RTC_DRV_NCT3018Y is not set +# CONFIG_RTC_DRV_RS5C372 is not set +# CONFIG_RTC_DRV_ISL1208 is not set +# CONFIG_RTC_DRV_ISL12022 is not set +# CONFIG_RTC_DRV_ISL12026 is not set +# CONFIG_RTC_DRV_X1205 is not set +# CONFIG_RTC_DRV_PCF8523 is not set +# CONFIG_RTC_DRV_PCF85063 is not set +# CONFIG_RTC_DRV_PCF85363 is not set +# CONFIG_RTC_DRV_PCF8563 is not set +# CONFIG_RTC_DRV_PCF8583 is not set +# CONFIG_RTC_DRV_M41T80 is not set +# CONFIG_RTC_DRV_BQ32K is not set +# CONFIG_RTC_DRV_S35390A is not set +# CONFIG_RTC_DRV_FM3130 is not set +# CONFIG_RTC_DRV_RX8010 is not set +# CONFIG_RTC_DRV_RX8581 is not set +# CONFIG_RTC_DRV_RX8025 is not set +# CONFIG_RTC_DRV_EM3027 is not set +# CONFIG_RTC_DRV_RV3028 is not set +# CONFIG_RTC_DRV_RV3032 is not set +# CONFIG_RTC_DRV_RV8803 is not set +# CONFIG_RTC_DRV_SD3078 is not set + +# +# SPI RTC drivers +# +CONFIG_RTC_I2C_AND_SPI=y + +# +# SPI and I2C RTC drivers +# +# CONFIG_RTC_DRV_DS3232 is not set +# CONFIG_RTC_DRV_PCF2127 is not set +# CONFIG_RTC_DRV_RV3029C2 is not set +# CONFIG_RTC_DRV_RX6110 is not set + +# +# Platform RTC drivers +# +# CONFIG_RTC_DRV_DS1286 is not set +# CONFIG_RTC_DRV_DS1511 is not set +# CONFIG_RTC_DRV_DS1553 is not set +# CONFIG_RTC_DRV_DS1685_FAMILY is not set +# CONFIG_RTC_DRV_DS1742 is not set +# CONFIG_RTC_DRV_DS2404 is not set +# CONFIG_RTC_DRV_EFI is not set +# CONFIG_RTC_DRV_STK17TA8 is not set +# CONFIG_RTC_DRV_M48T86 is not set +# CONFIG_RTC_DRV_M48T35 is not set +# CONFIG_RTC_DRV_M48T59 is not set +# CONFIG_RTC_DRV_MSM6242 is not set +# CONFIG_RTC_DRV_BQ4802 is not set +# CONFIG_RTC_DRV_RP5C01 is not set +# CONFIG_RTC_DRV_V3020 is not set +# CONFIG_RTC_DRV_ZYNQMP is not set + +# +# on-CPU RTC drivers +# +CONFIG_RTC_DRV_PL030=y +CONFIG_RTC_DRV_PL031=y +# CONFIG_RTC_DRV_CADENCE is not set +# CONFIG_RTC_DRV_FTRTC010 is not set +# CONFIG_RTC_DRV_R7301 is not set + +# +# HID Sensor RTC drivers +# +# CONFIG_RTC_DRV_GOLDFISH is not set +CONFIG_DMADEVICES=y +# CONFIG_DMADEVICES_DEBUG is not set + +# +# DMA Devices +# +CONFIG_DMA_ENGINE=y +CONFIG_DMA_ACPI=y +CONFIG_DMA_OF=y +# CONFIG_ALTERA_MSGDMA is not set +# CONFIG_AMBA_PL08X is not set +# CONFIG_DW_AXI_DMAC is not set +# CONFIG_FSL_EDMA is not set +# CONFIG_FSL_QDMA is not set +# CONFIG_INTEL_IDMA64 is not set +# CONFIG_MV_XOR_V2 is not set +# CONFIG_PL330_DMA is not set +# CONFIG_PLX_DMA is not set +# CONFIG_XILINX_DMA is not set +# CONFIG_XILINX_ZYNQMP_DMA is not set +# CONFIG_XILINX_ZYNQMP_DPDMA is not set +# CONFIG_QCOM_HIDMA_MGMT is not set +# CONFIG_QCOM_HIDMA is not set +# CONFIG_DW_DMAC is not set +# CONFIG_DW_DMAC_PCI is not set +# CONFIG_DW_EDMA is not set +# CONFIG_DW_EDMA_PCIE is not set +# CONFIG_SF_PDMA is not set + +# +# DMA Clients +# +# CONFIG_ASYNC_TX_DMA is not set +# CONFIG_DMATEST is not set + +# +# DMABUF options +# +CONFIG_SYNC_FILE=y +# CONFIG_SW_SYNC is not set +# CONFIG_UDMABUF is not set +# CONFIG_DMABUF_MOVE_NOTIFY is not set +# CONFIG_DMABUF_DEBUG is not set +# CONFIG_DMABUF_SELFTESTS is not set +# CONFIG_DMABUF_HEAPS is not set +# CONFIG_DMABUF_SYSFS_STATS is not set +# end of DMABUF options + +# CONFIG_AUXDISPLAY is not set +CONFIG_UIO=y +# CONFIG_UIO_CIF is not set +CONFIG_UIO_PDRV_GENIRQ=y +CONFIG_UIO_DMEM_GENIRQ=y +# CONFIG_UIO_AEC is not set +# CONFIG_UIO_SERCOS3 is not set +# CONFIG_UIO_PCI_GENERIC is not set +# CONFIG_UIO_NETX is not set +# CONFIG_UIO_PRUSS is not set +# CONFIG_UIO_MF624 is not set +CONFIG_VFIO=y +CONFIG_VFIO_IOMMU_TYPE1=y +CONFIG_VFIO_VIRQFD=y +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=y +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=y +# CONFIG_VFIO_PLATFORM is not set +# CONFIG_VFIO_MDEV is not set +# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRTIO_ANCHOR=y +CONFIG_VIRTIO=y +CONFIG_VIRTIO_PCI_LIB=y +CONFIG_VIRTIO_PCI_LIB_LEGACY=y +CONFIG_VIRTIO_MENU=y +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_PCI_LEGACY=y +CONFIG_VIRTIO_PMEM=y +CONFIG_VIRTIO_BALLOON=y +# CONFIG_VIRTIO_MEM is not set +CONFIG_VIRTIO_INPUT=y +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +CONFIG_VIRTIO_DMA_SHARED_BUFFER=y +# CONFIG_VDPA is not set +CONFIG_VHOST_MENU=y +# CONFIG_VHOST_NET is not set +# CONFIG_VHOST_VSOCK is not set +# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set + +# +# Microsoft Hyper-V guest support +# +# CONFIG_HYPERV is not set +# end of Microsoft Hyper-V guest support + +# CONFIG_GREYBUS is not set +# CONFIG_COMEDI is not set +# CONFIG_STAGING is not set +# CONFIG_GOLDFISH is not set +# CONFIG_CHROME_PLATFORMS is not set +# CONFIG_MELLANOX_PLATFORM is not set +# CONFIG_SURFACE_PLATFORMS is not set +CONFIG_HAVE_CLK=y +CONFIG_HAVE_CLK_PREPARE=y +CONFIG_COMMON_CLK=y + +# +# Clock driver for ARM Reference designs +# +# CONFIG_CLK_ICST is not set +# CONFIG_CLK_SP810 is not set +# end of Clock driver for ARM Reference designs + +# CONFIG_COMMON_CLK_MAX9485 is not set +# CONFIG_COMMON_CLK_SI5341 is not set +# CONFIG_COMMON_CLK_SI5351 is not set +# CONFIG_COMMON_CLK_SI514 is not set +# CONFIG_COMMON_CLK_SI544 is not set +# CONFIG_COMMON_CLK_SI570 is not set +# CONFIG_COMMON_CLK_CDCE706 is not set +# CONFIG_COMMON_CLK_CDCE925 is not set +# CONFIG_COMMON_CLK_CS2000_CP is not set +# CONFIG_COMMON_CLK_AXI_CLKGEN is not set +# CONFIG_COMMON_CLK_XGENE is not set +# CONFIG_COMMON_CLK_RS9_PCIE is not set +# CONFIG_COMMON_CLK_VC5 is not set +# CONFIG_COMMON_CLK_VC7 is not set +# CONFIG_COMMON_CLK_FIXED_MMIO is not set +# CONFIG_XILINX_VCU is not set +# CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set +# CONFIG_HWSPINLOCK is not set + +# +# Clock Source drivers +# +CONFIG_TIMER_OF=y +CONFIG_TIMER_ACPI=y +CONFIG_TIMER_PROBE=y +CONFIG_ARM_ARCH_TIMER=y +CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y +CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y +CONFIG_FSL_ERRATUM_A008585=y +CONFIG_HISILICON_ERRATUM_161010101=y +CONFIG_ARM64_ERRATUM_858921=y +# CONFIG_MICROCHIP_PIT64B is not set +# end of Clock Source drivers + +CONFIG_MAILBOX=y +# CONFIG_ARM_MHU is not set +# CONFIG_ARM_MHU_V2 is not set +# CONFIG_PLATFORM_MHU is not set +# CONFIG_PL320_MBOX is not set +CONFIG_PCC=y +# CONFIG_ALTERA_MBOX is not set +# CONFIG_MAILBOX_TEST is not set +CONFIG_IOMMU_IOVA=y +CONFIG_IOMMU_API=y +CONFIG_IOMMU_SUPPORT=y + +# +# Generic IOMMU Pagetable Support +# +CONFIG_IOMMU_IO_PGTABLE=y +CONFIG_IOMMU_IO_PGTABLE_LPAE=y +# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set +# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set +# CONFIG_IOMMU_IO_PGTABLE_DART is not set +# end of Generic IOMMU Pagetable Support + +# CONFIG_IOMMU_DEBUGFS is not set +CONFIG_IOMMU_DEFAULT_DMA_STRICT=y +# CONFIG_IOMMU_DEFAULT_DMA_LAZY is not set +# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set +CONFIG_OF_IOMMU=y +CONFIG_IOMMU_DMA=y +# CONFIG_ARM_SMMU is not set +# CONFIG_ARM_SMMU_V3 is not set +CONFIG_VIRTIO_IOMMU=y + +# +# Remoteproc drivers +# +# CONFIG_REMOTEPROC is not set +# end of Remoteproc drivers + +# +# Rpmsg drivers +# +# CONFIG_RPMSG_QCOM_GLINK_RPM is not set +# CONFIG_RPMSG_VIRTIO is not set +# end of Rpmsg drivers + +# CONFIG_SOUNDWIRE is not set + +# +# SOC (System On Chip) specific Drivers +# + +# +# Amlogic SoC drivers +# +# end of Amlogic SoC drivers + +# +# Broadcom SoC drivers +# +# CONFIG_SOC_BRCMSTB is not set +# end of Broadcom SoC drivers + +# +# NXP/Freescale QorIQ SoC drivers +# +# CONFIG_QUICC_ENGINE is not set +# CONFIG_FSL_RCPM is not set +# end of NXP/Freescale QorIQ SoC drivers + +# +# fujitsu SoC drivers +# +# CONFIG_A64FX_DIAG is not set +# end of fujitsu SoC drivers + +# +# i.MX SoC drivers +# +# end of i.MX SoC drivers + +# +# Enable LiteX SoC Builder specific drivers +# +# CONFIG_LITEX_SOC_CONTROLLER is not set +# end of Enable LiteX SoC Builder specific drivers + +# +# Qualcomm SoC drivers +# +# end of Qualcomm SoC drivers + +# CONFIG_SOC_TI is not set + +# +# Xilinx SoC drivers +# +# end of Xilinx SoC drivers +# end of SOC (System On Chip) specific Drivers + +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_NTB is not set +# CONFIG_PWM is not set + +# +# IRQ chip support +# +CONFIG_IRQCHIP=y +CONFIG_ARM_GIC=y +CONFIG_ARM_GIC_MAX_NR=1 +CONFIG_ARM_GIC_V2M=y +CONFIG_ARM_GIC_V3=y +CONFIG_ARM_GIC_V3_ITS=y +CONFIG_ARM_GIC_V3_ITS_PCI=y +# CONFIG_AL_FIC is not set +# CONFIG_XILINX_INTC is not set +CONFIG_PARTITION_PERCPU=y +# end of IRQ chip support + +# CONFIG_IPACK_BUS is not set +# CONFIG_RESET_CONTROLLER is not set + +# +# PHY Subsystem +# +# CONFIG_GENERIC_PHY is not set +# CONFIG_PHY_XGENE is not set +# CONFIG_PHY_CAN_TRANSCEIVER is not set + +# +# PHY drivers for Broadcom platforms +# +# CONFIG_BCM_KONA_USB2_PHY is not set +# end of PHY drivers for Broadcom platforms + +# CONFIG_PHY_CADENCE_TORRENT is not set +# CONFIG_PHY_CADENCE_DPHY is not set +# CONFIG_PHY_CADENCE_DPHY_RX is not set +# CONFIG_PHY_CADENCE_SALVO is not set +# CONFIG_PHY_PXA_28NM_HSIC is not set +# CONFIG_PHY_PXA_28NM_USB2 is not set +# end of PHY Subsystem + +# CONFIG_POWERCAP is not set +# CONFIG_MCB is not set + +# +# Performance monitor support +# +# CONFIG_ARM_CCI_PMU is not set +# CONFIG_ARM_CCN is not set +# CONFIG_ARM_CMN is not set +CONFIG_ARM_PMU=y +CONFIG_ARM_PMU_ACPI=y +# CONFIG_ARM_SMMU_V3_PMU is not set +# CONFIG_ARM_DSU_PMU is not set +# CONFIG_ARM_SPE_PMU is not set +# CONFIG_ARM_DMC620_PMU is not set +# CONFIG_ALIBABA_UNCORE_DRW_PMU is not set +# CONFIG_HISI_PMU is not set +# CONFIG_HISI_PCIE_PMU is not set +# CONFIG_HNS3_PMU is not set +# end of Performance monitor support + +CONFIG_RAS=y +# CONFIG_USB4 is not set + +# +# Android +# +# CONFIG_ANDROID_BINDER_IPC is not set +# end of Android + +CONFIG_LIBNVDIMM=y +CONFIG_BLK_DEV_PMEM=y +CONFIG_ND_CLAIM=y +CONFIG_ND_BTT=y +CONFIG_BTT=y +CONFIG_ND_PFN=y +CONFIG_NVDIMM_PFN=y +CONFIG_NVDIMM_DAX=y +CONFIG_OF_PMEM=y +CONFIG_DAX=y +CONFIG_DEV_DAX=y +CONFIG_DEV_DAX_PMEM=y +CONFIG_DEV_DAX_KMEM=y +CONFIG_NVMEM=y +CONFIG_NVMEM_SYSFS=y +# CONFIG_NVMEM_RMEM is not set + +# +# HW tracing support +# +# CONFIG_STM is not set +# CONFIG_INTEL_TH is not set +# CONFIG_HISI_PTT is not set +# end of HW tracing support + +# CONFIG_FPGA is not set +# CONFIG_FSI is not set +# CONFIG_TEE is not set +# CONFIG_SIOX is not set +# CONFIG_SLIMBUS is not set +# CONFIG_INTERCONNECT is not set +# CONFIG_COUNTER is not set +# CONFIG_MOST is not set +# CONFIG_PECI is not set +# CONFIG_HTE is not set +# end of Device Drivers + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +# CONFIG_VALIDATE_FS_PARSER is not set +CONFIG_FS_IOMAP=y +# CONFIG_EXT2_FS is not set +# CONFIG_EXT3_FS is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT2=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_EXT4_DEBUG=y +CONFIG_JBD2=y +CONFIG_JBD2_DEBUG=y +CONFIG_FS_MBCACHE=y +# CONFIG_REISERFS_FS is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_OCFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +# CONFIG_F2FS_FS is not set +CONFIG_FS_DAX=y +CONFIG_FS_DAX_PMD=y +CONFIG_FS_POSIX_ACL=y +CONFIG_EXPORTFS=y +# CONFIG_EXPORTFS_BLOCK_OPS is not set +CONFIG_FILE_LOCKING=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FS_ENCRYPTION_ALGS=y +# CONFIG_FS_VERITY is not set +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +CONFIG_FANOTIFY=y +# CONFIG_QUOTA is not set +CONFIG_AUTOFS4_FS=y +CONFIG_AUTOFS_FS=y +CONFIG_FUSE_FS=y +CONFIG_CUSE=y +CONFIG_VIRTIO_FS=y +CONFIG_FUSE_DAX=y +CONFIG_OVERLAY_FS=y +# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set +CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y +# CONFIG_OVERLAY_FS_INDEX is not set +# CONFIG_OVERLAY_FS_XINO_AUTO is not set +# CONFIG_OVERLAY_FS_METACOPY is not set + +# +# Caches +# +CONFIG_NETFS_SUPPORT=y +# CONFIG_NETFS_STATS is not set +CONFIG_FSCACHE=y +# CONFIG_FSCACHE_STATS is not set +# CONFIG_FSCACHE_DEBUG is not set +CONFIG_CACHEFILES=y +# CONFIG_CACHEFILES_DEBUG is not set +# CONFIG_CACHEFILES_ERROR_INJECTION is not set +# CONFIG_CACHEFILES_ONDEMAND is not set +# end of Caches + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +CONFIG_ZISOFS=y +CONFIG_UDF_FS=y +# end of CD-ROM/DVD Filesystems + +# +# DOS/FAT/EXFAT/NT Filesystems +# +CONFIG_FAT_FS=y +CONFIG_MSDOS_FS=y +CONFIG_VFAT_FS=y +CONFIG_FAT_DEFAULT_CODEPAGE=437 +CONFIG_FAT_DEFAULT_IOCHARSET="ascii" +# CONFIG_FAT_DEFAULT_UTF8 is not set +# CONFIG_EXFAT_FS is not set +# CONFIG_NTFS_FS is not set +# CONFIG_NTFS3_FS is not set +# end of DOS/FAT/EXFAT/NT Filesystems + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_PROC_CHILDREN=y +CONFIG_KERNFS=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TMPFS_XATTR=y +# CONFIG_TMPFS_INODE64 is not set +CONFIG_ARCH_SUPPORTS_HUGETLBFS=y +CONFIG_HUGETLBFS=y +CONFIG_HUGETLB_PAGE=y +CONFIG_MEMFD_CREATE=y +CONFIG_ARCH_HAS_GIGANTIC_PAGE=y +CONFIG_CONFIGFS_FS=y +CONFIG_EFIVAR_FS=y +# end of Pseudo filesystems + +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ORANGEFS_FS is not set +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_ECRYPT_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_CRAMFS is not set +CONFIG_SQUASHFS=y +CONFIG_SQUASHFS_FILE_CACHE=y +# CONFIG_SQUASHFS_FILE_DIRECT is not set +CONFIG_SQUASHFS_DECOMP_SINGLE=y +# CONFIG_SQUASHFS_DECOMP_MULTI is not set +# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set +# CONFIG_SQUASHFS_XATTR is not set +CONFIG_SQUASHFS_ZLIB=y +# CONFIG_SQUASHFS_LZ4 is not set +# CONFIG_SQUASHFS_LZO is not set +CONFIG_SQUASHFS_XZ=y +# CONFIG_SQUASHFS_ZSTD is not set +# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set +# CONFIG_SQUASHFS_EMBEDDED is not set +CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +# CONFIG_EROFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +CONFIG_NFS_FS=y +CONFIG_NFS_V2=y +CONFIG_NFS_V3=y +# CONFIG_NFS_V3_ACL is not set +CONFIG_NFS_V4=y +# CONFIG_NFS_SWAP is not set +# CONFIG_NFS_V4_1 is not set +# CONFIG_ROOT_NFS is not set +# CONFIG_NFS_FSCACHE is not set +# CONFIG_NFS_USE_LEGACY_DNS is not set +CONFIG_NFS_USE_KERNEL_DNS=y +CONFIG_NFS_DISABLE_UDP_SUPPORT=y +CONFIG_NFSD=y +# CONFIG_NFSD_V3_ACL is not set +CONFIG_NFSD_V4=y +# CONFIG_NFSD_BLOCKLAYOUT is not set +# CONFIG_NFSD_SCSILAYOUT is not set +# CONFIG_NFSD_FLEXFILELAYOUT is not set +CONFIG_GRACE_PERIOD=y +CONFIG_LOCKD=y +CONFIG_LOCKD_V4=y +CONFIG_NFS_COMMON=y +CONFIG_SUNRPC=y +CONFIG_SUNRPC_GSS=y +CONFIG_RPCSEC_GSS_KRB5=y +# CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set +# CONFIG_SUNRPC_DEBUG is not set +# CONFIG_CEPH_FS is not set +CONFIG_CIFS=y +# CONFIG_CIFS_STATS2 is not set +CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y +CONFIG_CIFS_UPCALL=y +CONFIG_CIFS_XATTR=y +CONFIG_CIFS_POSIX=y +# CONFIG_CIFS_DEBUG is not set +CONFIG_CIFS_DFS_UPCALL=y +# CONFIG_CIFS_SMB_DIRECT is not set +# CONFIG_SMB_SERVER is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_CODEPAGE_737=y +CONFIG_NLS_CODEPAGE_775=y +CONFIG_NLS_CODEPAGE_850=y +CONFIG_NLS_CODEPAGE_852=y +CONFIG_NLS_CODEPAGE_855=y +CONFIG_NLS_CODEPAGE_857=y +CONFIG_NLS_CODEPAGE_860=y +CONFIG_NLS_CODEPAGE_861=y +CONFIG_NLS_CODEPAGE_862=y +CONFIG_NLS_CODEPAGE_863=y +CONFIG_NLS_CODEPAGE_864=y +CONFIG_NLS_CODEPAGE_865=y +CONFIG_NLS_CODEPAGE_866=y +CONFIG_NLS_CODEPAGE_869=y +CONFIG_NLS_CODEPAGE_936=y +CONFIG_NLS_CODEPAGE_950=y +CONFIG_NLS_CODEPAGE_932=y +CONFIG_NLS_CODEPAGE_949=y +CONFIG_NLS_CODEPAGE_874=y +CONFIG_NLS_ISO8859_8=y +CONFIG_NLS_CODEPAGE_1250=y +CONFIG_NLS_CODEPAGE_1251=y +CONFIG_NLS_ASCII=y +CONFIG_NLS_ISO8859_1=y +CONFIG_NLS_ISO8859_2=y +CONFIG_NLS_ISO8859_3=y +CONFIG_NLS_ISO8859_4=y +CONFIG_NLS_ISO8859_5=y +CONFIG_NLS_ISO8859_6=y +CONFIG_NLS_ISO8859_7=y +CONFIG_NLS_ISO8859_9=y +CONFIG_NLS_ISO8859_13=y +CONFIG_NLS_ISO8859_14=y +CONFIG_NLS_ISO8859_15=y +CONFIG_NLS_KOI8_R=y +CONFIG_NLS_KOI8_U=y +CONFIG_NLS_MAC_ROMAN=y +CONFIG_NLS_MAC_CELTIC=y +CONFIG_NLS_MAC_CENTEURO=y +CONFIG_NLS_MAC_CROATIAN=y +CONFIG_NLS_MAC_CYRILLIC=y +CONFIG_NLS_MAC_GAELIC=y +CONFIG_NLS_MAC_GREEK=y +CONFIG_NLS_MAC_ICELAND=y +CONFIG_NLS_MAC_INUIT=y +CONFIG_NLS_MAC_ROMANIAN=y +CONFIG_NLS_MAC_TURKISH=y +CONFIG_NLS_UTF8=y +# CONFIG_DLM is not set +# CONFIG_UNICODE is not set +CONFIG_IO_WQ=y +# end of File systems + +# +# Security options +# +CONFIG_KEYS=y +# CONFIG_KEYS_REQUEST_CACHE is not set +CONFIG_PERSISTENT_KEYRINGS=y +# CONFIG_BIG_KEYS is not set +# CONFIG_TRUSTED_KEYS is not set +# CONFIG_ENCRYPTED_KEYS is not set +# CONFIG_KEY_DH_OPERATIONS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +CONFIG_SECURITYFS=y +CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y +# CONFIG_HARDENED_USERCOPY is not set +CONFIG_FORTIFY_SOURCE=y +# CONFIG_STATIC_USERMODEHELPER is not set +# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_LSM="yama,loadpin,safesetid,integrity" + +# +# Kernel hardening options +# + +# +# Memory initialization +# +CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set +# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# end of Memory initialization + +CONFIG_RANDSTRUCT_NONE=y +# end of Kernel hardening options +# end of Security options + +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +# CONFIG_CRYPTO_FIPS is not set +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_SKCIPHER=y +CONFIG_CRYPTO_SKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_RNG_DEFAULT=y +CONFIG_CRYPTO_AKCIPHER2=y +CONFIG_CRYPTO_AKCIPHER=y +CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_ACOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +# CONFIG_CRYPTO_USER is not set +# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set +# CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is not set +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_NULL2=y +# CONFIG_CRYPTO_PCRYPT is not set +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y +# CONFIG_CRYPTO_TEST is not set +# end of Crypto core or helper + +# +# Public-key cryptography +# +# CONFIG_CRYPTO_RSA is not set +# CONFIG_CRYPTO_DH is not set +CONFIG_CRYPTO_ECC=y +# CONFIG_CRYPTO_ECDH is not set +CONFIG_CRYPTO_ECDSA=y +# CONFIG_CRYPTO_ECRDSA is not set +# CONFIG_CRYPTO_SM2 is not set +# CONFIG_CRYPTO_CURVE25519 is not set +# end of Public-key cryptography + +# +# Block ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_TI is not set +# CONFIG_CRYPTO_ARIA is not set +# CONFIG_CRYPTO_BLOWFISH is not set +# CONFIG_CRYPTO_CAMELLIA is not set +# CONFIG_CRYPTO_CAST5 is not set +# CONFIG_CRYPTO_CAST6 is not set +CONFIG_CRYPTO_DES=y +# CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_SERPENT is not set +# CONFIG_CRYPTO_SM4_GENERIC is not set +# CONFIG_CRYPTO_TWOFISH is not set +# end of Block ciphers + +# +# Length-preserving ciphers and modes +# +# CONFIG_CRYPTO_ADIANTUM is not set +# CONFIG_CRYPTO_CHACHA20 is not set +CONFIG_CRYPTO_CBC=y +# CONFIG_CRYPTO_CFB is not set +CONFIG_CRYPTO_CTR=y +CONFIG_CRYPTO_CTS=y +CONFIG_CRYPTO_ECB=y +# CONFIG_CRYPTO_HCTR2 is not set +# CONFIG_CRYPTO_KEYWRAP is not set +CONFIG_CRYPTO_LRW=y +# CONFIG_CRYPTO_OFB is not set +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y +# end of Length-preserving ciphers and modes + +# +# AEAD (authenticated encryption with associated data) ciphers +# +# CONFIG_CRYPTO_AEGIS128 is not set +# CONFIG_CRYPTO_CHACHA20POLY1305 is not set +# CONFIG_CRYPTO_CCM is not set +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y +CONFIG_CRYPTO_ECHAINIV=y +# CONFIG_CRYPTO_ESSIV is not set +# end of AEAD (authenticated encryption with associated data) ciphers + +# +# Hashes, digests, and MACs +# +# CONFIG_CRYPTO_BLAKE2B is not set +CONFIG_CRYPTO_CMAC=y +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_HMAC=y +# CONFIG_CRYPTO_MD4 is not set +CONFIG_CRYPTO_MD5=y +# CONFIG_CRYPTO_MICHAEL_MIC is not set +CONFIG_CRYPTO_POLY1305=y +# CONFIG_CRYPTO_RMD160 is not set +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +# CONFIG_CRYPTO_SHA3 is not set +# CONFIG_CRYPTO_SM3_GENERIC is not set +# CONFIG_CRYPTO_STREEBOG is not set +# CONFIG_CRYPTO_VMAC is not set +# CONFIG_CRYPTO_WP512 is not set +# CONFIG_CRYPTO_XCBC is not set +# CONFIG_CRYPTO_XXHASH is not set +# end of Hashes, digests, and MACs + +# +# CRCs (cyclic redundancy checks) +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32 is not set +CONFIG_CRYPTO_CRCT10DIF=y +# end of CRCs (cyclic redundancy checks) + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_LZO=y +# CONFIG_CRYPTO_842 is not set +# CONFIG_CRYPTO_LZ4 is not set +# CONFIG_CRYPTO_LZ4HC is not set +# CONFIG_CRYPTO_ZSTD is not set +# end of Compression + +# +# Random number generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_DRBG_MENU=y +CONFIG_CRYPTO_DRBG_HMAC=y +CONFIG_CRYPTO_DRBG_HASH=y +CONFIG_CRYPTO_DRBG_CTR=y +CONFIG_CRYPTO_DRBG=y +CONFIG_CRYPTO_JITTERENTROPY=y +# end of Random number generation + +# +# Userspace interface +# +CONFIG_CRYPTO_USER_API=y +# CONFIG_CRYPTO_USER_API_HASH is not set +# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +CONFIG_CRYPTO_USER_API_RNG=y +# CONFIG_CRYPTO_USER_API_RNG_CAVP is not set +# CONFIG_CRYPTO_USER_API_AEAD is not set +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set +# end of Userspace interface + +# CONFIG_CRYPTO_NHPOLY1305_NEON is not set +CONFIG_CRYPTO_CHACHA20_NEON=y + +# +# Accelerated Cryptographic Algorithms for CPU (arm64) +# +# CONFIG_CRYPTO_GHASH_ARM64_CE is not set +CONFIG_CRYPTO_POLY1305_NEON=y +# CONFIG_CRYPTO_SHA1_ARM64_CE is not set +# CONFIG_CRYPTO_SHA256_ARM64 is not set +# CONFIG_CRYPTO_SHA2_ARM64_CE is not set +# CONFIG_CRYPTO_SHA512_ARM64 is not set +# CONFIG_CRYPTO_SHA512_ARM64_CE is not set +# CONFIG_CRYPTO_SHA3_ARM64 is not set +# CONFIG_CRYPTO_SM3_NEON is not set +# CONFIG_CRYPTO_SM3_ARM64_CE is not set +# CONFIG_CRYPTO_POLYVAL_ARM64_CE is not set +# CONFIG_CRYPTO_AES_ARM64 is not set +# CONFIG_CRYPTO_AES_ARM64_CE is not set +# CONFIG_CRYPTO_AES_ARM64_CE_BLK is not set +# CONFIG_CRYPTO_AES_ARM64_NEON_BLK is not set +# CONFIG_CRYPTO_AES_ARM64_BS is not set +# CONFIG_CRYPTO_SM4_ARM64_CE is not set +# CONFIG_CRYPTO_SM4_ARM64_CE_BLK is not set +# CONFIG_CRYPTO_SM4_ARM64_NEON_BLK is not set +# CONFIG_CRYPTO_AES_ARM64_CE_CCM is not set +# CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set +# end of Accelerated Cryptographic Algorithms for CPU (arm64) + +# CONFIG_CRYPTO_HW is not set +# CONFIG_ASYMMETRIC_KEY_TYPE is not set + +# +# Certificates for signature checking +# +CONFIG_SYSTEM_BLACKLIST_KEYRING=y +CONFIG_SYSTEM_BLACKLIST_HASH_LIST="" +# end of Certificates for signature checking + +CONFIG_BINARY_PRINTF=y + +# +# Library routines +# +# CONFIG_PACKING is not set +CONFIG_BITREVERSE=y +CONFIG_HAVE_ARCH_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_NET_UTILS=y +# CONFIG_CORDIC is not set +# CONFIG_PRIME_NUMBERS is not set +CONFIG_RATIONAL=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y +CONFIG_ARCH_HAS_FAST_MULTIPLIER=y +CONFIG_ARCH_USE_SYM_ANNOTATIONS=y +# CONFIG_INDIRECT_PIO is not set + +# +# Crypto library routines +# +CONFIG_CRYPTO_LIB_UTILS=y +CONFIG_CRYPTO_LIB_AES=y +CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y +CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y +CONFIG_CRYPTO_LIB_CHACHA=y +CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y +CONFIG_CRYPTO_LIB_CURVE25519=y +CONFIG_CRYPTO_LIB_DES=y +CONFIG_CRYPTO_LIB_POLY1305_RSIZE=9 +CONFIG_CRYPTO_ARCH_HAVE_LIB_POLY1305=y +CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y +CONFIG_CRYPTO_LIB_POLY1305=y +CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y +CONFIG_CRYPTO_LIB_SHA1=y +CONFIG_CRYPTO_LIB_SHA256=y +# end of Crypto library routines + +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +CONFIG_CRC_T10DIF=y +# CONFIG_CRC64_ROCKSOFT is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +# CONFIG_CRC64 is not set +# CONFIG_CRC4 is not set +# CONFIG_CRC7 is not set +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_XXHASH=y +CONFIG_AUDIT_GENERIC=y +CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y +# CONFIG_RANDOM32_SELFTEST is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +CONFIG_LZO_COMPRESS=y +CONFIG_LZO_DECOMPRESS=y +CONFIG_LZ4_DECOMPRESS=y +CONFIG_XZ_DEC=y +CONFIG_XZ_DEC_X86=y +CONFIG_XZ_DEC_POWERPC=y +CONFIG_XZ_DEC_IA64=y +CONFIG_XZ_DEC_ARM=y +CONFIG_XZ_DEC_ARMTHUMB=y +CONFIG_XZ_DEC_SPARC=y +# CONFIG_XZ_DEC_MICROLZMA is not set +CONFIG_XZ_DEC_BCJ=y +# CONFIG_XZ_DEC_TEST is not set +CONFIG_DECOMPRESS_GZIP=y +CONFIG_DECOMPRESS_BZIP2=y +CONFIG_DECOMPRESS_LZMA=y +CONFIG_DECOMPRESS_XZ=y +CONFIG_DECOMPRESS_LZO=y +CONFIG_DECOMPRESS_LZ4=y +CONFIG_GENERIC_ALLOCATOR=y +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_INTERVAL_TREE=y +CONFIG_XARRAY_MULTI=y +CONFIG_ASSOCIATIVE_ARRAY=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT_MAP=y +CONFIG_HAS_DMA=y +CONFIG_DMA_OPS=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_DMA_DECLARE_COHERENT=y +CONFIG_ARCH_HAS_SETUP_DMA_OPS=y +CONFIG_ARCH_HAS_TEARDOWN_DMA_OPS=y +CONFIG_ARCH_HAS_SYNC_DMA_FOR_DEVICE=y +CONFIG_ARCH_HAS_SYNC_DMA_FOR_CPU=y +CONFIG_ARCH_HAS_DMA_PREP_COHERENT=y +CONFIG_SWIOTLB=y +# CONFIG_DMA_RESTRICTED_POOL is not set +CONFIG_DMA_NONCOHERENT_MMAP=y +CONFIG_DMA_COHERENT_POOL=y +CONFIG_DMA_DIRECT_REMAP=y +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_DMA_MAP_BENCHMARK is not set +CONFIG_SGL_ALLOC=y +# CONFIG_FORCE_NR_CPUS is not set +CONFIG_CPU_RMAP=y +CONFIG_DQL=y +CONFIG_NLATTR=y +CONFIG_IRQ_POLL=y +CONFIG_LIBFDT=y +CONFIG_OID_REGISTRY=y +CONFIG_UCS2_STRING=y +CONFIG_HAVE_GENERIC_VDSO=y +CONFIG_GENERIC_GETTIMEOFDAY=y +CONFIG_GENERIC_VDSO_TIME_NS=y +CONFIG_FONT_SUPPORT=y +# CONFIG_FONTS is not set +CONFIG_FONT_8x8=y +CONFIG_FONT_8x16=y +CONFIG_SG_POOL=y +CONFIG_MEMREGION=y +CONFIG_ARCH_STACKWALK=y +CONFIG_STACKDEPOT=y +CONFIG_SBITMAP=y +# end of Library routines + +CONFIG_GENERIC_IOREMAP=y +CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y + +# +# Kernel hacking +# + +# +# printk and dmesg options +# +CONFIG_PRINTK_TIME=y +# CONFIG_PRINTK_CALLER is not set +# CONFIG_STACKTRACE_BUILD_ID is not set +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 +CONFIG_CONSOLE_LOGLEVEL_QUIET=4 +CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 +# CONFIG_BOOT_PRINTK_DELAY is not set +CONFIG_DYNAMIC_DEBUG=y +CONFIG_DYNAMIC_DEBUG_CORE=y +CONFIG_SYMBOLIC_ERRNAME=y +# CONFIG_DEBUG_BUGVERBOSE is not set +# end of printk and dmesg options + +CONFIG_DEBUG_KERNEL=y +CONFIG_DEBUG_MISC=y + +# +# Compile-time checks and compiler options +# +CONFIG_AS_HAS_NON_CONST_LEB128=y +CONFIG_DEBUG_INFO_NONE=y +# CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT is not set +# CONFIG_DEBUG_INFO_DWARF4 is not set +# CONFIG_DEBUG_INFO_DWARF5 is not set +CONFIG_FRAME_WARN=2048 +CONFIG_STRIP_ASM_SYMS=y +# CONFIG_READABLE_ASM is not set +# CONFIG_HEADERS_INSTALL is not set +CONFIG_DEBUG_SECTION_MISMATCH=y +CONFIG_SECTION_MISMATCH_WARN_ONLY=y +# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set +CONFIG_ARCH_WANT_FRAME_POINTERS=y +CONFIG_FRAME_POINTER=y +CONFIG_VMLINUX_MAP=y +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# end of Compile-time checks and compiler options + +# +# Generic Kernel Debugging Instruments +# +CONFIG_MAGIC_SYSRQ=y +CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 +CONFIG_MAGIC_SYSRQ_SERIAL=y +CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" +CONFIG_DEBUG_FS=y +CONFIG_DEBUG_FS_ALLOW_ALL=y +# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set +# CONFIG_DEBUG_FS_ALLOW_NONE is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +# CONFIG_UBSAN is not set +CONFIG_HAVE_ARCH_KCSAN=y +# end of Generic Kernel Debugging Instruments + +# +# Networking Debugging +# +# CONFIG_NET_DEV_REFCNT_TRACKER is not set +# CONFIG_NET_NS_REFCNT_TRACKER is not set +# CONFIG_DEBUG_NET is not set +# end of Networking Debugging + +# +# Memory Debugging +# +# CONFIG_PAGE_EXTENSION is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_SLUB_DEBUG=y +# CONFIG_SLUB_DEBUG_ON is not set +# CONFIG_PAGE_OWNER is not set +# CONFIG_PAGE_TABLE_CHECK is not set +# CONFIG_PAGE_POISONING is not set +# CONFIG_DEBUG_RODATA_TEST is not set +CONFIG_ARCH_HAS_DEBUG_WX=y +# CONFIG_DEBUG_WX is not set +CONFIG_GENERIC_PTDUMP=y +# CONFIG_PTDUMP_DEBUGFS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_SHRINKER_DEBUG is not set +CONFIG_HAVE_DEBUG_KMEMLEAK=y +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VM_PGTABLE is not set +CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y +# CONFIG_DEBUG_VIRTUAL is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_PER_CPU_MAPS is not set +CONFIG_HAVE_ARCH_KASAN=y +CONFIG_HAVE_ARCH_KASAN_SW_TAGS=y +CONFIG_HAVE_ARCH_KASAN_HW_TAGS=y +CONFIG_HAVE_ARCH_KASAN_VMALLOC=y +CONFIG_CC_HAS_KASAN_GENERIC=y +CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y +# CONFIG_KASAN is not set +CONFIG_HAVE_ARCH_KFENCE=y +# CONFIG_KFENCE is not set +# end of Memory Debugging + +# CONFIG_DEBUG_SHIRQ is not set + +# +# Debug Oops, Lockups and Hangs +# +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_PANIC_TIMEOUT=0 +# CONFIG_SOFTLOCKUP_DETECTOR is not set +# CONFIG_DETECT_HUNG_TASK is not set +# CONFIG_WQ_WATCHDOG is not set +# end of Debug Oops, Lockups and Hangs + +# +# Scheduler Debugging +# +# CONFIG_SCHED_DEBUG is not set +CONFIG_SCHED_INFO=y +# CONFIG_SCHEDSTATS is not set +# end of Scheduler Debugging + +# CONFIG_DEBUG_TIMEKEEPING is not set + +# +# Lock Debugging (spinlocks, mutexes, etc...) +# +CONFIG_LOCK_DEBUGGING_SUPPORT=y +# CONFIG_PROVE_LOCKING is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set +# CONFIG_DEBUG_RWSEMS is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set +# CONFIG_SCF_TORTURE_TEST is not set +# CONFIG_CSD_LOCK_WAIT_DEBUG is not set +# end of Lock Debugging (spinlocks, mutexes, etc...) + +# CONFIG_DEBUG_IRQFLAGS is not set +CONFIG_STACKTRACE=y +# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set +# CONFIG_DEBUG_KOBJECT is not set + +# +# Debug kernel data structures +# +CONFIG_DEBUG_LIST=y +# CONFIG_DEBUG_PLIST is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +CONFIG_BUG_ON_DATA_CORRUPTION=y +# CONFIG_DEBUG_MAPLE_TREE is not set +# end of Debug kernel data structures + +# CONFIG_DEBUG_CREDENTIALS is not set + +# +# RCU Debugging +# +# CONFIG_RCU_SCALE_TEST is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_REF_SCALE_TEST is not set +CONFIG_RCU_CPU_STALL_TIMEOUT=59 +CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0 +# CONFIG_RCU_TRACE is not set +# CONFIG_RCU_EQS_DEBUG is not set +# end of RCU Debugging + +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set +# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set +# CONFIG_LATENCYTOP is not set +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_TRACING_SUPPORT=y +# CONFIG_FTRACE is not set +# CONFIG_SAMPLES is not set +CONFIG_STRICT_DEVMEM=y +# CONFIG_IO_STRICT_DEVMEM is not set + +# +# arm64 Debugging +# +# CONFIG_PID_IN_CONTEXTIDR is not set +# CONFIG_CORESIGHT is not set +# end of arm64 Debugging + +# +# Kernel Testing and Coverage +# +# CONFIG_KUNIT is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +CONFIG_ARCH_HAS_KCOV=y +CONFIG_CC_HAS_SANCOV_TRACE_PC=y +CONFIG_RUNTIME_TESTING_MENU=y +# CONFIG_LKDTM is not set +# CONFIG_TEST_MIN_HEAP is not set +# CONFIG_TEST_DIV64 is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_TEST_REF_TRACKER is not set +# CONFIG_RBTREE_TEST is not set +# CONFIG_REED_SOLOMON_TEST is not set +# CONFIG_INTERVAL_TREE_TEST is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_TEST_HEXDUMP is not set +# CONFIG_STRING_SELFTEST is not set +# CONFIG_TEST_STRING_HELPERS is not set +# CONFIG_TEST_STRSCPY is not set +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_TEST_PRINTF is not set +# CONFIG_TEST_SCANF is not set +# CONFIG_TEST_BITMAP is not set +# CONFIG_TEST_UUID is not set +# CONFIG_TEST_XARRAY is not set +# CONFIG_TEST_MAPLE_TREE is not set +# CONFIG_TEST_RHASHTABLE is not set +# CONFIG_TEST_SIPHASH is not set +# CONFIG_TEST_IDA is not set +# CONFIG_FIND_BIT_BENCHMARK is not set +# CONFIG_TEST_FIRMWARE is not set +# CONFIG_TEST_SYSCTL is not set +# CONFIG_TEST_UDELAY is not set +# CONFIG_TEST_DYNAMIC_DEBUG is not set +# CONFIG_TEST_MEMCAT_P is not set +# CONFIG_TEST_MEMINIT is not set +# CONFIG_TEST_FREE_PAGES is not set +CONFIG_ARCH_USE_MEMTEST=y +# CONFIG_MEMTEST is not set +# end of Kernel Testing and Coverage + +# +# Rust hacking +# +# end of Rust hacking +# end of Kernel hacking diff --git a/kernel/config-x86_64 b/kernel/config-x86_64 new file mode 100644 index 0000000..7ca2317 --- /dev/null +++ b/kernel/config-x86_64 @@ -0,0 +1,3650 @@ +# +# Automatically generated file; DO NOT EDIT. +# Linux/x86_64 6.6.9 Kernel Configuration +# +CONFIG_CC_VERSION_TEXT="x86_64-linux-gnu-gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0" +CONFIG_CC_IS_GCC=y +CONFIG_GCC_VERSION=90400 +CONFIG_CLANG_VERSION=0 +CONFIG_AS_IS_GNU=y +CONFIG_AS_VERSION=23400 +CONFIG_LD_IS_BFD=y +CONFIG_LD_VERSION=23400 +CONFIG_LLD_VERSION=0 +CONFIG_CC_CAN_LINK=y +CONFIG_CC_CAN_LINK_STATIC=y +CONFIG_CC_HAS_ASM_INLINE=y +CONFIG_CC_HAS_NO_PROFILE_FN_ATTR=y +CONFIG_PAHOLE_VERSION=0 +CONFIG_IRQ_WORK=y +CONFIG_BUILDTIME_TABLE_SORT=y +CONFIG_THREAD_INFO_IN_TASK=y + +# +# General setup +# +CONFIG_INIT_ENV_ARG_LIMIT=32 +# CONFIG_COMPILE_TEST is not set +# CONFIG_WERROR is not set +CONFIG_LOCALVERSION="" +# CONFIG_LOCALVERSION_AUTO is not set +CONFIG_BUILD_SALT="" +CONFIG_HAVE_KERNEL_GZIP=y +CONFIG_HAVE_KERNEL_BZIP2=y +CONFIG_HAVE_KERNEL_LZMA=y +CONFIG_HAVE_KERNEL_XZ=y +CONFIG_HAVE_KERNEL_LZO=y +CONFIG_HAVE_KERNEL_LZ4=y +CONFIG_HAVE_KERNEL_ZSTD=y +CONFIG_KERNEL_GZIP=y +# CONFIG_KERNEL_BZIP2 is not set +# CONFIG_KERNEL_LZMA is not set +# CONFIG_KERNEL_XZ is not set +# CONFIG_KERNEL_LZO is not set +# CONFIG_KERNEL_LZ4 is not set +# CONFIG_KERNEL_ZSTD is not set +CONFIG_DEFAULT_INIT="" +CONFIG_DEFAULT_HOSTNAME="sandbox-vm" +CONFIG_SYSVIPC=y +CONFIG_SYSVIPC_SYSCTL=y +CONFIG_POSIX_MQUEUE=y +CONFIG_POSIX_MQUEUE_SYSCTL=y +# CONFIG_WATCH_QUEUE is not set +CONFIG_CROSS_MEMORY_ATTACH=y +# CONFIG_USELIB is not set +CONFIG_AUDIT=y +CONFIG_HAVE_ARCH_AUDITSYSCALL=y +CONFIG_AUDITSYSCALL=y + +# +# IRQ subsystem +# +CONFIG_GENERIC_IRQ_PROBE=y +CONFIG_GENERIC_IRQ_SHOW=y +CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y +CONFIG_GENERIC_PENDING_IRQ=y +CONFIG_GENERIC_IRQ_MIGRATION=y +CONFIG_HARDIRQS_SW_RESEND=y +CONFIG_IRQ_DOMAIN=y +CONFIG_IRQ_DOMAIN_HIERARCHY=y +CONFIG_GENERIC_MSI_IRQ=y +CONFIG_GENERIC_MSI_IRQ_DOMAIN=y +CONFIG_IRQ_MSI_IOMMU=y +CONFIG_GENERIC_IRQ_MATRIX_ALLOCATOR=y +CONFIG_GENERIC_IRQ_RESERVATION_MODE=y +CONFIG_IRQ_FORCED_THREADING=y +CONFIG_SPARSE_IRQ=y +# CONFIG_GENERIC_IRQ_DEBUGFS is not set +# end of IRQ subsystem + +CONFIG_CLOCKSOURCE_WATCHDOG=y +CONFIG_ARCH_CLOCKSOURCE_INIT=y +CONFIG_CLOCKSOURCE_VALIDATE_LAST_CYCLE=y +CONFIG_GENERIC_TIME_VSYSCALL=y +CONFIG_GENERIC_CLOCKEVENTS=y +CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y +CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST=y +CONFIG_GENERIC_CMOS_UPDATE=y +CONFIG_HAVE_POSIX_CPU_TIMERS_TASK_WORK=y +CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y +CONFIG_CONTEXT_TRACKING=y +CONFIG_CONTEXT_TRACKING_IDLE=y + +# +# Timers subsystem +# +CONFIG_TICK_ONESHOT=y +CONFIG_NO_HZ_COMMON=y +# CONFIG_HZ_PERIODIC is not set +CONFIG_NO_HZ_IDLE=y +# CONFIG_NO_HZ_FULL is not set +CONFIG_NO_HZ=y +CONFIG_HIGH_RES_TIMERS=y +CONFIG_CLOCKSOURCE_WATCHDOG_MAX_SKEW_US=100 +# end of Timers subsystem + +CONFIG_BPF=y +CONFIG_HAVE_EBPF_JIT=y +CONFIG_ARCH_WANT_DEFAULT_BPF_JIT=y + +# +# BPF subsystem +# +CONFIG_BPF_SYSCALL=y +# CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set +CONFIG_USERMODE_DRIVER=y +CONFIG_BPF_PRELOAD=y +CONFIG_BPF_PRELOAD_UMD=y +# end of BPF subsystem + +CONFIG_PREEMPT_BUILD=y +CONFIG_PREEMPT_NONE=y +# CONFIG_PREEMPT_VOLUNTARY is not set +# CONFIG_PREEMPT is not set +CONFIG_PREEMPT_COUNT=y +CONFIG_PREEMPTION=y +CONFIG_PREEMPT_DYNAMIC=y +# CONFIG_SCHED_CORE is not set + +# +# CPU/Task time and stats accounting +# +CONFIG_TICK_CPU_ACCOUNTING=y +# CONFIG_VIRT_CPU_ACCOUNTING_GEN is not set +# CONFIG_IRQ_TIME_ACCOUNTING is not set +CONFIG_BSD_PROCESS_ACCT=y +CONFIG_BSD_PROCESS_ACCT_V3=y +CONFIG_TASKSTATS=y +CONFIG_TASK_DELAY_ACCT=y +CONFIG_TASK_XACCT=y +CONFIG_TASK_IO_ACCOUNTING=y +# CONFIG_PSI is not set +# end of CPU/Task time and stats accounting + +CONFIG_CPU_ISOLATION=y + +# +# RCU Subsystem +# +CONFIG_TREE_RCU=y +CONFIG_PREEMPT_RCU=y +# CONFIG_RCU_EXPERT is not set +CONFIG_SRCU=y +CONFIG_TREE_SRCU=y +CONFIG_TASKS_RCU_GENERIC=y +CONFIG_TASKS_RCU=y +CONFIG_TASKS_TRACE_RCU=y +CONFIG_RCU_STALL_COMMON=y +CONFIG_RCU_NEED_SEGCBLIST=y +# end of RCU Subsystem + +CONFIG_IKCONFIG=y +CONFIG_IKCONFIG_PROC=y +# CONFIG_IKHEADERS is not set +CONFIG_LOG_BUF_SHIFT=21 +CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 +CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 +# CONFIG_PRINTK_INDEX is not set +CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y + +# +# Scheduler features +# +# CONFIG_UCLAMP_TASK is not set +# end of Scheduler features + +CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y +CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH=y +CONFIG_CC_HAS_INT128=y +CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5" +CONFIG_GCC11_NO_ARRAY_BOUNDS=y +CONFIG_ARCH_SUPPORTS_INT128=y +CONFIG_NUMA_BALANCING=y +# CONFIG_NUMA_BALANCING_DEFAULT_ENABLED is not set +CONFIG_CGROUPS=y +CONFIG_PAGE_COUNTER=y +# CONFIG_CGROUP_FAVOR_DYNMODS is not set +CONFIG_MEMCG=y +CONFIG_MEMCG_V1=y +CONFIG_MEMCG_KMEM=y +CONFIG_BLK_CGROUP=y +CONFIG_CGROUP_WRITEBACK=y +CONFIG_CGROUP_SCHED=y +CONFIG_FAIR_GROUP_SCHED=y +CONFIG_CFS_BANDWIDTH=y +CONFIG_RT_GROUP_SCHED=y +CONFIG_CGROUP_PIDS=y +# CONFIG_CGROUP_RDMA is not set +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_CPUSETS_V1=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_BPF=y +# CONFIG_CGROUP_MISC is not set +# CONFIG_CGROUP_DEBUG is not set +CONFIG_SOCK_CGROUP_DATA=y +CONFIG_NAMESPACES=y +CONFIG_UTS_NS=y +CONFIG_TIME_NS=y +CONFIG_IPC_NS=y +CONFIG_USER_NS=y +CONFIG_PID_NS=y +CONFIG_NET_NS=y +# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_SCHED_AUTOGROUP=y +# CONFIG_SYSFS_DEPRECATED is not set +CONFIG_RELAY=y +CONFIG_BLK_DEV_INITRD=y +CONFIG_INITRAMFS_SOURCE="" +CONFIG_RD_GZIP=y +CONFIG_RD_BZIP2=y +CONFIG_RD_LZMA=y +CONFIG_RD_XZ=y +CONFIG_RD_LZO=y +CONFIG_RD_LZ4=y +CONFIG_RD_ZSTD=y +# CONFIG_BOOT_CONFIG is not set +CONFIG_INITRAMFS_PRESERVE_MTIME=y +CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y +# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set +CONFIG_LD_ORPHAN_WARN=y +CONFIG_SYSCTL=y +CONFIG_SYSCTL_EXCEPTION_TRACE=y +CONFIG_HAVE_PCSPKR_PLATFORM=y +CONFIG_EXPERT=y +CONFIG_MULTIUSER=y +CONFIG_SGETMASK_SYSCALL=y +CONFIG_SYSFS_SYSCALL=y +CONFIG_FHANDLE=y +CONFIG_POSIX_TIMERS=y +CONFIG_PRINTK=y +CONFIG_BUG=y +CONFIG_ELF_CORE=y +CONFIG_PCSPKR_PLATFORM=y +CONFIG_BASE_FULL=y +CONFIG_FUTEX=y +CONFIG_FUTEX_PI=y +CONFIG_EPOLL=y +CONFIG_SIGNALFD=y +CONFIG_TIMERFD=y +CONFIG_EVENTFD=y +CONFIG_SHMEM=y +CONFIG_AIO=y +CONFIG_IO_URING=y +CONFIG_ADVISE_SYSCALLS=y +CONFIG_MEMBARRIER=y +CONFIG_KALLSYMS=y +# CONFIG_KALLSYMS_ALL is not set +CONFIG_KALLSYMS_ABSOLUTE_PERCPU=y +CONFIG_KALLSYMS_BASE_RELATIVE=y +CONFIG_ARCH_HAS_MEMBARRIER_SYNC_CORE=y +CONFIG_KCMP=y +CONFIG_RSEQ=y +# CONFIG_DEBUG_RSEQ is not set +# CONFIG_EMBEDDED is not set +CONFIG_HAVE_PERF_EVENTS=y +CONFIG_GUEST_PERF_EVENTS=y +# CONFIG_PC104 is not set + +# +# Kernel Performance Events And Counters +# +CONFIG_PERF_EVENTS=y +# CONFIG_DEBUG_PERF_USE_VMALLOC is not set +# end of Kernel Performance Events And Counters + +# CONFIG_PROFILING is not set +# end of General setup + +CONFIG_64BIT=y +CONFIG_X86_64=y +CONFIG_X86=y +CONFIG_INSTRUCTION_DECODER=y +CONFIG_OUTPUT_FORMAT="elf64-x86-64" +CONFIG_LOCKDEP_SUPPORT=y +CONFIG_STACKTRACE_SUPPORT=y +CONFIG_MMU=y +CONFIG_ARCH_MMAP_RND_BITS_MIN=28 +CONFIG_ARCH_MMAP_RND_BITS_MAX=32 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=8 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 +CONFIG_GENERIC_BUG=y +CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y +CONFIG_GENERIC_CALIBRATE_DELAY=y +CONFIG_ARCH_HAS_CPU_RELAX=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_NR_GPIO=1024 +CONFIG_ARCH_SUSPEND_POSSIBLE=y +CONFIG_AUDIT_ARCH=y +CONFIG_X86_64_SMP=y +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_FIX_EARLYCON_MEM=y +CONFIG_PGTABLE_LEVELS=5 +CONFIG_CC_HAS_SANE_STACKPROTECTOR=y + +# +# Processor type and features +# +CONFIG_SMP=y +CONFIG_X86_FEATURE_NAMES=y +CONFIG_X86_MPPARSE=y +# CONFIG_GOLDFISH is not set +# CONFIG_X86_CPU_RESCTRL is not set +# CONFIG_X86_EXTENDED_PLATFORM is not set +CONFIG_X86_INTEL_LPSS=y +# CONFIG_X86_AMD_PLATFORM_DEVICE is not set +CONFIG_IOSF_MBI=y +# CONFIG_IOSF_MBI_DEBUG is not set +CONFIG_SCHED_OMIT_FRAME_POINTER=y +# CONFIG_HYPERVISOR_GUEST is not set +# CONFIG_MK8 is not set +# CONFIG_MPSC is not set +# CONFIG_MCORE2 is not set +# CONFIG_MATOM is not set +CONFIG_GENERIC_CPU=y +CONFIG_X86_INTERNODE_CACHE_SHIFT=6 +CONFIG_X86_L1_CACHE_SHIFT=6 +CONFIG_X86_TSC=y +CONFIG_X86_CMPXCHG64=y +CONFIG_X86_CMOV=y +CONFIG_X86_MINIMUM_CPU_FAMILY=64 +CONFIG_X86_DEBUGCTLMSR=y +CONFIG_IA32_FEAT_CTL=y +CONFIG_X86_VMX_FEATURE_NAMES=y +CONFIG_PROCESSOR_SELECT=y +CONFIG_CPU_SUP_INTEL=y +# CONFIG_CPU_SUP_AMD is not set +# CONFIG_CPU_SUP_HYGON is not set +# CONFIG_CPU_SUP_CENTAUR is not set +# CONFIG_CPU_SUP_ZHAOXIN is not set +CONFIG_HPET_TIMER=y +CONFIG_DMI=y +# CONFIG_MAXSMP is not set +CONFIG_NR_CPUS_RANGE_BEGIN=2 +CONFIG_NR_CPUS_RANGE_END=512 +CONFIG_NR_CPUS_DEFAULT=64 +CONFIG_NR_CPUS=128 +CONFIG_SCHED_CLUSTER=y +CONFIG_SCHED_SMT=y +CONFIG_SCHED_MC=y +CONFIG_SCHED_MC_PRIO=y +CONFIG_X86_LOCAL_APIC=y +CONFIG_X86_IO_APIC=y +CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y +# CONFIG_X86_MCE is not set + +# +# Performance monitoring +# +CONFIG_PERF_EVENTS_INTEL_UNCORE=y +CONFIG_PERF_EVENTS_INTEL_RAPL=y +CONFIG_PERF_EVENTS_INTEL_CSTATE=y +# end of Performance monitoring + +CONFIG_X86_16BIT=y +CONFIG_X86_ESPFIX64=y +CONFIG_X86_VSYSCALL_EMULATION=y +# CONFIG_X86_IOPL_IOPERM is not set +# CONFIG_MICROCODE is not set +CONFIG_X86_MSR=y +CONFIG_X86_CPUID=y +CONFIG_X86_5LEVEL=y +CONFIG_X86_DIRECT_GBPAGES=y +# CONFIG_X86_CPA_STATISTICS is not set +CONFIG_NUMA=y +# CONFIG_AMD_NUMA is not set +CONFIG_X86_64_ACPI_NUMA=y +# CONFIG_NUMA_EMU is not set +CONFIG_NODES_SHIFT=10 +CONFIG_ARCH_SPARSEMEM_ENABLE=y +CONFIG_ARCH_SPARSEMEM_DEFAULT=y +CONFIG_ARCH_MEMORY_PROBE=y +CONFIG_ARCH_PROC_KCORE_TEXT=y +CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 +# CONFIG_X86_PMEM_LEGACY is not set +CONFIG_X86_CHECK_BIOS_CORRUPTION=y +CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y +CONFIG_MTRR=y +CONFIG_MTRR_SANITIZER=y +CONFIG_MTRR_SANITIZER_ENABLE_DEFAULT=0 +CONFIG_MTRR_SANITIZER_SPARE_REG_NR_DEFAULT=1 +CONFIG_X86_PAT=y +CONFIG_ARCH_USES_PG_UNCACHED=y +# CONFIG_X86_UMIP is not set +CONFIG_CC_HAS_IBT=y +# CONFIG_X86_KERNEL_IBT is not set +# CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS is not set +CONFIG_X86_INTEL_TSX_MODE_OFF=y +# CONFIG_X86_INTEL_TSX_MODE_ON is not set +# CONFIG_X86_INTEL_TSX_MODE_AUTO is not set +CONFIG_EFI=y +CONFIG_EFI_STUB=y +# CONFIG_EFI_MIXED is not set +# CONFIG_HZ_100 is not set +CONFIG_HZ_250=y +# CONFIG_HZ_300 is not set +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 +CONFIG_SCHED_HRTICK=y +# CONFIG_KEXEC is not set +CONFIG_KEXEC_FILE=y +CONFIG_ARCH_HAS_KEXEC_PURGATORY=y +# CONFIG_KEXEC_SIG is not set +# CONFIG_CRASH_DUMP is not set +CONFIG_PHYSICAL_START=0x1000000 +CONFIG_RELOCATABLE=y +CONFIG_RANDOMIZE_BASE=y +CONFIG_X86_NEED_RELOCS=y +CONFIG_PHYSICAL_ALIGN=0x1000000 +CONFIG_DYNAMIC_MEMORY_LAYOUT=y +CONFIG_RANDOMIZE_MEMORY=y +CONFIG_RANDOMIZE_MEMORY_PHYSICAL_PADDING=0xa +CONFIG_HOTPLUG_CPU=y +# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set +# CONFIG_DEBUG_HOTPLUG_CPU0 is not set +CONFIG_LEGACY_VSYSCALL_XONLY=y +# CONFIG_LEGACY_VSYSCALL_NONE is not set +# CONFIG_CMDLINE_BOOL is not set +CONFIG_MODIFY_LDT_SYSCALL=y +# CONFIG_STRICT_SIGALTSTACK_SIZE is not set +CONFIG_HAVE_LIVEPATCH=y +# end of Processor type and features + +CONFIG_CC_HAS_RETURN_THUNK=y +CONFIG_SPECULATION_MITIGATIONS=y +CONFIG_PAGE_TABLE_ISOLATION=y +CONFIG_RETPOLINE=y +CONFIG_RETHUNK=y +CONFIG_CPU_IBRS_ENTRY=y +# CONFIG_GDS_FORCE_MITIGATION is not set +CONFIG_ARCH_HAS_ADD_PAGES=y +CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y + +# +# Power management and ACPI options +# +# CONFIG_SUSPEND is not set +# CONFIG_HIBERNATION is not set +CONFIG_PM=y +# CONFIG_PM_DEBUG is not set +CONFIG_PM_CLK=y +# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set +# CONFIG_ENERGY_MODEL is not set +CONFIG_ARCH_SUPPORTS_ACPI=y +CONFIG_ACPI=y +CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y +CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y +CONFIG_ACPI_SYSTEM_POWER_STATES_SUPPORT=y +# CONFIG_ACPI_DEBUGGER is not set +CONFIG_ACPI_SPCR_TABLE=y +# CONFIG_ACPI_FPDT is not set +CONFIG_ACPI_LPIT=y +CONFIG_ACPI_REV_OVERRIDE_POSSIBLE=y +# CONFIG_ACPI_EC_DEBUGFS is not set +# CONFIG_ACPI_AC is not set +# CONFIG_ACPI_BATTERY is not set +CONFIG_ACPI_BUTTON=y +# CONFIG_ACPI_FAN is not set +# CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_CPU_FREQ_PSS=y +CONFIG_ACPI_PROCESSOR_CSTATE=y +CONFIG_ACPI_PROCESSOR_IDLE=y +CONFIG_ACPI_CPPC_LIB=y +CONFIG_ACPI_PROCESSOR=y +CONFIG_ACPI_HOTPLUG_CPU=y +# CONFIG_ACPI_PROCESSOR_AGGREGATOR is not set +CONFIG_ACPI_THERMAL=y +CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y +CONFIG_ACPI_TABLE_UPGRADE=y +# CONFIG_ACPI_DEBUG is not set +# CONFIG_ACPI_PCI_SLOT is not set +CONFIG_ACPI_CONTAINER=y +CONFIG_ACPI_HOTPLUG_MEMORY=y +CONFIG_ACPI_HOTPLUG_IOAPIC=y +# CONFIG_ACPI_SBS is not set +# CONFIG_ACPI_HED is not set +# CONFIG_ACPI_CUSTOM_METHOD is not set +# CONFIG_ACPI_BGRT is not set +# CONFIG_ACPI_REDUCED_HARDWARE_ONLY is not set +# CONFIG_ACPI_NFIT is not set +CONFIG_ACPI_NUMA=y +# CONFIG_ACPI_HMAT is not set +CONFIG_HAVE_ACPI_APEI=y +CONFIG_HAVE_ACPI_APEI_NMI=y +# CONFIG_ACPI_APEI is not set +# CONFIG_ACPI_DPTF is not set +# CONFIG_ACPI_CONFIGFS is not set +# CONFIG_ACPI_PFRUT is not set +CONFIG_ACPI_PCC=y +CONFIG_PMIC_OPREGION=y +CONFIG_ACPI_VIOT=y +CONFIG_ACPI_PRMT=y +CONFIG_X86_PM_TIMER=y + +# +# CPU Frequency scaling +# +CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_GOV_ATTR_SET=y +# CONFIG_CPU_FREQ_STAT is not set +CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y +# CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set +CONFIG_CPU_FREQ_GOV_PERFORMANCE=y +# CONFIG_CPU_FREQ_GOV_POWERSAVE is not set +# CONFIG_CPU_FREQ_GOV_USERSPACE is not set +# CONFIG_CPU_FREQ_GOV_ONDEMAND is not set +# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set +CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y + +# +# CPU frequency scaling drivers +# +CONFIG_X86_INTEL_PSTATE=y +# CONFIG_X86_PCC_CPUFREQ is not set +# CONFIG_X86_AMD_PSTATE is not set +# CONFIG_X86_AMD_PSTATE_UT is not set +# CONFIG_X86_ACPI_CPUFREQ is not set +# CONFIG_X86_SPEEDSTEP_CENTRINO is not set +# CONFIG_X86_P4_CLOCKMOD is not set + +# +# shared options +# +# end of CPU Frequency scaling + +# +# CPU Idle +# +CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_GOV_LADDER=y +CONFIG_CPU_IDLE_GOV_MENU=y +# CONFIG_CPU_IDLE_GOV_TEO is not set +# end of CPU Idle + +CONFIG_INTEL_IDLE=y +# end of Power management and ACPI options + +# +# Bus options (PCI etc.) +# +CONFIG_PCI_DIRECT=y +CONFIG_PCI_MMCONFIG=y +CONFIG_MMCONF_FAM10H=y +# CONFIG_PCI_CNB20LE_QUIRK is not set +# CONFIG_ISA_BUS is not set +# CONFIG_ISA_DMA_API is not set +# end of Bus options (PCI etc.) + +# +# Binary Emulations +# +# CONFIG_IA32_EMULATION is not set +# CONFIG_X86_X32_ABI is not set +# end of Binary Emulations + +CONFIG_HAVE_KVM=y +CONFIG_HAVE_KVM_PFNCACHE=y +CONFIG_HAVE_KVM_IRQCHIP=y +CONFIG_HAVE_KVM_IRQFD=y +CONFIG_HAVE_KVM_IRQ_ROUTING=y +CONFIG_HAVE_KVM_DIRTY_RING=y +CONFIG_HAVE_KVM_DIRTY_RING_TSO=y +CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL=y +CONFIG_HAVE_KVM_EVENTFD=y +CONFIG_KVM_MMIO=y +CONFIG_KVM_ASYNC_PF=y +CONFIG_HAVE_KVM_MSI=y +CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y +CONFIG_KVM_VFIO=y +CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y +CONFIG_HAVE_KVM_IRQ_BYPASS=y +CONFIG_HAVE_KVM_NO_POLL=y +CONFIG_KVM_XFER_TO_GUEST_WORK=y +CONFIG_HAVE_KVM_PM_NOTIFIER=y +CONFIG_VIRTUALIZATION=y +CONFIG_KVM=y +# CONFIG_KVM_WERROR is not set +CONFIG_KVM_INTEL=y +# CONFIG_KVM_AMD is not set +# CONFIG_KVM_XEN is not set +CONFIG_AS_AVX512=y +CONFIG_AS_SHA1_NI=y +CONFIG_AS_SHA256_NI=y +CONFIG_AS_TPAUSE=y + +# +# General architecture-dependent options +# +CONFIG_CRASH_CORE=y +CONFIG_KEXEC_CORE=y +CONFIG_HOTPLUG_SMT=y +CONFIG_GENERIC_ENTRY=y +CONFIG_JUMP_LABEL=y +# CONFIG_STATIC_KEYS_SELFTEST is not set +# CONFIG_STATIC_CALL_SELFTEST is not set +CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_ARCH_USE_BUILTIN_BSWAP=y +CONFIG_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_IOREMAP_PROT=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y +CONFIG_HAVE_OPTPROBES=y +CONFIG_HAVE_KPROBES_ON_FTRACE=y +CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y +CONFIG_HAVE_FUNCTION_ERROR_INJECTION=y +CONFIG_HAVE_NMI=y +CONFIG_TRACE_IRQFLAGS_SUPPORT=y +CONFIG_TRACE_IRQFLAGS_NMI_SUPPORT=y +CONFIG_HAVE_ARCH_TRACEHOOK=y +CONFIG_HAVE_DMA_CONTIGUOUS=y +CONFIG_GENERIC_SMP_IDLE_THREAD=y +CONFIG_ARCH_HAS_FORTIFY_SOURCE=y +CONFIG_ARCH_HAS_SET_MEMORY=y +CONFIG_ARCH_HAS_SET_DIRECT_MAP=y +CONFIG_ARCH_HAS_CPU_FINALIZE_INIT=y +CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST=y +CONFIG_ARCH_WANTS_DYNAMIC_TASK_STRUCT=y +CONFIG_ARCH_WANTS_NO_INSTR=y +CONFIG_HAVE_ASM_MODVERSIONS=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y +CONFIG_HAVE_RSEQ=y +CONFIG_HAVE_RUST=y +CONFIG_HAVE_FUNCTION_ARG_ACCESS_API=y +CONFIG_HAVE_HW_BREAKPOINT=y +CONFIG_HAVE_MIXED_BREAKPOINTS_REGS=y +CONFIG_HAVE_USER_RETURN_NOTIFIER=y +CONFIG_HAVE_PERF_EVENTS_NMI=y +CONFIG_HAVE_HARDLOCKUP_DETECTOR_PERF=y +CONFIG_HAVE_PERF_REGS=y +CONFIG_HAVE_PERF_USER_STACK_DUMP=y +CONFIG_HAVE_ARCH_JUMP_LABEL=y +CONFIG_HAVE_ARCH_JUMP_LABEL_RELATIVE=y +CONFIG_MMU_GATHER_MERGE_VMAS=y +CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG=y +CONFIG_HAVE_ALIGNED_STRUCT_PAGE=y +CONFIG_HAVE_CMPXCHG_LOCAL=y +CONFIG_HAVE_CMPXCHG_DOUBLE=y +CONFIG_HAVE_ARCH_SECCOMP=y +CONFIG_HAVE_ARCH_SECCOMP_FILTER=y +CONFIG_SECCOMP=y +CONFIG_SECCOMP_FILTER=y +# CONFIG_SECCOMP_CACHE_DEBUG is not set +CONFIG_HAVE_ARCH_STACKLEAK=y +CONFIG_HAVE_STACKPROTECTOR=y +CONFIG_STACKPROTECTOR=y +CONFIG_STACKPROTECTOR_STRONG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG=y +CONFIG_ARCH_SUPPORTS_LTO_CLANG_THIN=y +CONFIG_LTO_NONE=y +CONFIG_ARCH_SUPPORTS_CFI_CLANG=y +CONFIG_HAVE_ARCH_WITHIN_STACK_FRAMES=y +CONFIG_HAVE_CONTEXT_TRACKING_USER=y +CONFIG_HAVE_CONTEXT_TRACKING_USER_OFFSTACK=y +CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y +CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y +CONFIG_HAVE_MOVE_PUD=y +CONFIG_HAVE_MOVE_PMD=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y +CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD=y +CONFIG_HAVE_ARCH_HUGE_VMAP=y +CONFIG_HAVE_ARCH_HUGE_VMALLOC=y +CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y +CONFIG_HAVE_ARCH_SOFT_DIRTY=y +CONFIG_HAVE_MOD_ARCH_SPECIFIC=y +CONFIG_MODULES_USE_ELF_RELA=y +CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y +CONFIG_HAVE_SOFTIRQ_ON_OWN_STACK=y +CONFIG_SOFTIRQ_ON_OWN_STACK=y +CONFIG_ARCH_HAS_ELF_RANDOMIZE=y +CONFIG_HAVE_ARCH_MMAP_RND_BITS=y +CONFIG_HAVE_EXIT_THREAD=y +CONFIG_ARCH_MMAP_RND_BITS=28 +CONFIG_PAGE_SIZE_LESS_THAN_64KB=y +CONFIG_PAGE_SIZE_LESS_THAN_256KB=y +CONFIG_HAVE_OBJTOOL=y +CONFIG_HAVE_JUMP_LABEL_HACK=y +CONFIG_HAVE_NOINSTR_HACK=y +CONFIG_HAVE_NOINSTR_VALIDATION=y +CONFIG_HAVE_UACCESS_VALIDATION=y +CONFIG_HAVE_STACK_VALIDATION=y +CONFIG_HAVE_RELIABLE_STACKTRACE=y +# CONFIG_COMPAT_32BIT_TIME is not set +CONFIG_HAVE_ARCH_VMAP_STACK=y +CONFIG_VMAP_STACK=y +CONFIG_HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET=y +CONFIG_RANDOMIZE_KSTACK_OFFSET=y +# CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT is not set +CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y +CONFIG_STRICT_KERNEL_RWX=y +CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y +CONFIG_HAVE_ARCH_PREL32_RELOCATIONS=y +CONFIG_ARCH_USE_MEMREMAP_PROT=y +# CONFIG_LOCK_EVENT_COUNTS is not set +CONFIG_ARCH_HAS_MEM_ENCRYPT=y +CONFIG_HAVE_STATIC_CALL=y +CONFIG_HAVE_STATIC_CALL_INLINE=y +CONFIG_HAVE_PREEMPT_DYNAMIC=y +CONFIG_HAVE_PREEMPT_DYNAMIC_CALL=y +CONFIG_ARCH_WANT_LD_ORPHAN_WARN=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y +CONFIG_ARCH_SUPPORTS_PAGE_TABLE_CHECK=y +CONFIG_ARCH_HAS_ELFCORE_COMPAT=y +CONFIG_ARCH_HAS_PARANOID_L1D_FLUSH=y +CONFIG_DYNAMIC_SIGFRAME=y +CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG=y + +# +# GCOV-based kernel profiling +# +# CONFIG_GCOV_KERNEL is not set +CONFIG_ARCH_HAS_GCOV_PROFILE_ALL=y +# end of GCOV-based kernel profiling + +CONFIG_HAVE_GCC_PLUGINS=y +# end of General architecture-dependent options + +CONFIG_RT_MUTEXES=y +CONFIG_BASE_SMALL=0 +# CONFIG_MODULES is not set +CONFIG_BLOCK=y +CONFIG_BLOCK_LEGACY_AUTOLOAD=y +CONFIG_BLK_CGROUP_RWSTAT=y +CONFIG_BLK_DEV_BSG_COMMON=y +CONFIG_BLK_DEV_BSGLIB=y +CONFIG_BLK_DEV_INTEGRITY=y +# CONFIG_BLK_DEV_ZONED is not set +CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_DEV_THROTTLING_LOW is not set +CONFIG_BLK_WBT=y +CONFIG_BLK_WBT_MQ=y +# CONFIG_BLK_CGROUP_IOLATENCY is not set +# CONFIG_BLK_CGROUP_IOCOST is not set +# CONFIG_BLK_CGROUP_IOPRIO is not set +CONFIG_BLK_DEBUG_FS=y +# CONFIG_BLK_SED_OPAL is not set +# CONFIG_BLK_INLINE_ENCRYPTION is not set + +# +# Partition Types +# +CONFIG_PARTITION_ADVANCED=y +# CONFIG_ACORN_PARTITION is not set +# CONFIG_AIX_PARTITION is not set +# CONFIG_OSF_PARTITION is not set +# CONFIG_AMIGA_PARTITION is not set +# CONFIG_ATARI_PARTITION is not set +# CONFIG_MAC_PARTITION is not set +# CONFIG_MSDOS_PARTITION is not set +# CONFIG_LDM_PARTITION is not set +# CONFIG_SGI_PARTITION is not set +# CONFIG_ULTRIX_PARTITION is not set +# CONFIG_SUN_PARTITION is not set +# CONFIG_KARMA_PARTITION is not set +CONFIG_EFI_PARTITION=y +# CONFIG_SYSV68_PARTITION is not set +# CONFIG_CMDLINE_PARTITION is not set +# end of Partition Types + +CONFIG_BLK_MQ_PCI=y +CONFIG_BLK_MQ_VIRTIO=y +CONFIG_BLK_PM=y + +# +# IO Schedulers +# +# CONFIG_MQ_IOSCHED_DEADLINE is not set +# CONFIG_MQ_IOSCHED_KYBER is not set +# CONFIG_IOSCHED_BFQ is not set +# end of IO Schedulers + +CONFIG_PREEMPT_NOTIFIERS=y +CONFIG_UNINLINE_SPIN_UNLOCK=y +CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y +CONFIG_MUTEX_SPIN_ON_OWNER=y +CONFIG_RWSEM_SPIN_ON_OWNER=y +CONFIG_LOCK_SPIN_ON_OWNER=y +CONFIG_ARCH_USE_QUEUED_SPINLOCKS=y +CONFIG_QUEUED_SPINLOCKS=y +CONFIG_ARCH_USE_QUEUED_RWLOCKS=y +CONFIG_QUEUED_RWLOCKS=y +CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE=y +CONFIG_ARCH_HAS_SYNC_CORE_BEFORE_USERMODE=y +CONFIG_ARCH_HAS_SYSCALL_WRAPPER=y +CONFIG_FREEZER=y + +# +# Executable file formats +# +CONFIG_BINFMT_ELF=y +CONFIG_ELFCORE=y +CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y +CONFIG_BINFMT_SCRIPT=y +CONFIG_BINFMT_MISC=y +CONFIG_COREDUMP=y +# end of Executable file formats + +# +# Memory Management options +# +CONFIG_ZPOOL=y +CONFIG_SWAP=y +CONFIG_ZSWAP=y +# CONFIG_ZSWAP_DEFAULT_ON is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_DEFLATE is not set +CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZO=y +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_842 is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4 is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_LZ4HC is not set +# CONFIG_ZSWAP_COMPRESSOR_DEFAULT_ZSTD is not set +CONFIG_ZSWAP_COMPRESSOR_DEFAULT="lzo" +CONFIG_ZSWAP_ZPOOL_DEFAULT_ZBUD=y +# CONFIG_ZSWAP_ZPOOL_DEFAULT_Z3FOLD is not set +# CONFIG_ZSWAP_ZPOOL_DEFAULT_ZSMALLOC is not set +CONFIG_ZSWAP_ZPOOL_DEFAULT="zbud" +CONFIG_ZBUD=y +# CONFIG_Z3FOLD is not set +CONFIG_ZSMALLOC=y +CONFIG_ZSMALLOC_STAT=y + +# +# SLAB allocator options +# +# CONFIG_SLAB is not set +CONFIG_SLUB=y +# CONFIG_SLOB is not set +CONFIG_SLAB_MERGE_DEFAULT=y +# CONFIG_SLAB_FREELIST_RANDOM is not set +CONFIG_SLAB_FREELIST_HARDENED=y +# CONFIG_SLUB_STATS is not set +CONFIG_SLUB_CPU_PARTIAL=y +# end of SLAB allocator options + +# CONFIG_SHUFFLE_PAGE_ALLOCATOR is not set +# CONFIG_COMPAT_BRK is not set +CONFIG_SPARSEMEM=y +CONFIG_SPARSEMEM_EXTREME=y +CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y +CONFIG_SPARSEMEM_VMEMMAP=y +CONFIG_HAVE_FAST_GUP=y +CONFIG_NUMA_KEEP_MEMINFO=y +CONFIG_MEMORY_ISOLATION=y +CONFIG_EXCLUSIVE_SYSTEM_RAM=y +CONFIG_HAVE_BOOTMEM_INFO_NODE=y +CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y +CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y +CONFIG_MEMORY_HOTPLUG=y +CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y +CONFIG_MEMORY_HOTREMOVE=y +CONFIG_MHP_MEMMAP_ON_MEMORY=y +CONFIG_SPLIT_PTLOCK_CPUS=4 +CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y +CONFIG_MEMORY_BALLOON=y +CONFIG_BALLOON_COMPACTION=y +CONFIG_COMPACTION=y +CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1 +CONFIG_PAGE_REPORTING=y +CONFIG_MIGRATION=y +CONFIG_DEVICE_MIGRATION=y +CONFIG_ARCH_ENABLE_HUGEPAGE_MIGRATION=y +CONFIG_ARCH_ENABLE_THP_MIGRATION=y +CONFIG_CONTIG_ALLOC=y +CONFIG_PHYS_ADDR_T_64BIT=y +CONFIG_MMU_NOTIFIER=y +CONFIG_KSM=y +CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_ARCH_WANT_GENERAL_HUGETLB=y +CONFIG_ARCH_WANTS_THP_SWAP=y +CONFIG_TRANSPARENT_HUGEPAGE=y +# CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS is not set +CONFIG_TRANSPARENT_HUGEPAGE_MADVISE=y +CONFIG_THP_SWAP=y +# CONFIG_READ_ONLY_THP_FOR_FS is not set +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y +CONFIG_USE_PERCPU_NUMA_NODE_ID=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_FRONTSWAP=y +# CONFIG_CMA is not set +CONFIG_GENERIC_EARLY_IOREMAP=y +# CONFIG_DEFERRED_STRUCT_PAGE_INIT is not set +# CONFIG_IDLE_PAGE_TRACKING is not set +CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y +CONFIG_ARCH_HAS_CURRENT_STACK_POINTER=y +CONFIG_ARCH_HAS_PTE_DEVMAP=y +CONFIG_ARCH_HAS_ZONE_DMA_SET=y +CONFIG_ZONE_DMA=y +CONFIG_ZONE_DMA32=y +CONFIG_ZONE_DEVICE=y +# CONFIG_DEVICE_PRIVATE is not set +CONFIG_VM_EVENT_COUNTERS=y +CONFIG_PERCPU_STATS=y +# CONFIG_GUP_TEST is not set +CONFIG_ARCH_HAS_PTE_SPECIAL=y +CONFIG_SECRETMEM=y +# CONFIG_ANON_VMA_NAME is not set +CONFIG_USERFAULTFD=y +CONFIG_HAVE_ARCH_USERFAULTFD_WP=y +CONFIG_HAVE_ARCH_USERFAULTFD_MINOR=y +CONFIG_PTE_MARKER=y +CONFIG_PTE_MARKER_UFFD_WP=y +# CONFIG_LRU_GEN is not set +CONFIG_LOCK_MM_AND_FIND_VMA=y + +# +# Data Access Monitoring +# +# CONFIG_DAMON is not set +# end of Data Access Monitoring +# end of Memory Management options + +CONFIG_NET=y +CONFIG_NET_INGRESS=y +CONFIG_NET_EGRESS=y +CONFIG_SKB_EXTENSIONS=y + +# +# Networking options +# +CONFIG_PACKET=y +CONFIG_PACKET_DIAG=y +CONFIG_UNIX=y +CONFIG_UNIX_SCM=y +CONFIG_AF_UNIX_OOB=y +CONFIG_UNIX_DIAG=y +CONFIG_TLS=y +# CONFIG_TLS_DEVICE is not set +# CONFIG_TLS_TOE is not set +CONFIG_XFRM=y +CONFIG_XFRM_OFFLOAD=y +CONFIG_XFRM_ALGO=y +CONFIG_XFRM_USER=y +# CONFIG_XFRM_INTERFACE is not set +CONFIG_XFRM_SUB_POLICY=y +CONFIG_XFRM_MIGRATE=y +CONFIG_XFRM_STATISTICS=y +CONFIG_XFRM_AH=y +CONFIG_XFRM_ESP=y +CONFIG_XFRM_IPCOMP=y +CONFIG_NET_KEY=y +CONFIG_NET_KEY_MIGRATE=y +CONFIG_XFRM_ESPINTCP=y +CONFIG_XDP_SOCKETS=y +# CONFIG_XDP_SOCKETS_DIAG is not set +CONFIG_INET=y +# CONFIG_IP_MULTICAST is not set +CONFIG_IP_ADVANCED_ROUTER=y +# CONFIG_IP_FIB_TRIE_STATS is not set +CONFIG_IP_MULTIPLE_TABLES=y +# CONFIG_IP_ROUTE_MULTIPATH is not set +# CONFIG_IP_ROUTE_VERBOSE is not set +CONFIG_IP_ROUTE_CLASSID=y +CONFIG_IP_PNP=y +CONFIG_IP_PNP_DHCP=y +CONFIG_IP_PNP_BOOTP=y +CONFIG_IP_PNP_RARP=y +CONFIG_NET_IPIP=y +# CONFIG_NET_IPGRE_DEMUX is not set +CONFIG_NET_IP_TUNNEL=y +CONFIG_IP_MROUTE_COMMON=y +CONFIG_SYN_COOKIES=y +# CONFIG_NET_IPVTI is not set +CONFIG_NET_UDP_TUNNEL=y +CONFIG_NET_FOU=y +CONFIG_NET_FOU_IP_TUNNELS=y +# CONFIG_INET_AH is not set +# CONFIG_INET_ESP is not set +# CONFIG_INET_IPCOMP is not set +CONFIG_INET_TABLE_PERTURB_ORDER=16 +CONFIG_INET_TUNNEL=y +CONFIG_INET_DIAG=y +CONFIG_INET_TCP_DIAG=y +CONFIG_INET_UDP_DIAG=y +CONFIG_INET_RAW_DIAG=y +# CONFIG_INET_DIAG_DESTROY is not set +# CONFIG_TCP_CONG_ADVANCED is not set +CONFIG_TCP_CONG_CUBIC=y +CONFIG_DEFAULT_TCP_CONG="cubic" +# CONFIG_TCP_MD5SIG is not set +CONFIG_IPV6=y +CONFIG_IPV6_ROUTER_PREF=y +CONFIG_IPV6_ROUTE_INFO=y +CONFIG_IPV6_OPTIMISTIC_DAD=y +CONFIG_INET6_AH=y +CONFIG_INET6_ESP=y +CONFIG_INET6_ESP_OFFLOAD=y +CONFIG_INET6_ESPINTCP=y +CONFIG_INET6_IPCOMP=y +# CONFIG_IPV6_MIP6 is not set +CONFIG_IPV6_ILA=y +CONFIG_INET6_XFRM_TUNNEL=y +CONFIG_INET6_TUNNEL=y +CONFIG_IPV6_VTI=y +CONFIG_IPV6_SIT=y +# CONFIG_IPV6_SIT_6RD is not set +CONFIG_IPV6_NDISC_NODETYPE=y +CONFIG_IPV6_TUNNEL=y +CONFIG_IPV6_FOU=y +CONFIG_IPV6_FOU_TUNNEL=y +CONFIG_IPV6_MULTIPLE_TABLES=y +CONFIG_IPV6_SUBTREES=y +CONFIG_IPV6_MROUTE=y +CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y +CONFIG_IPV6_PIMSM_V2=y +CONFIG_IPV6_SEG6_LWTUNNEL=y +CONFIG_IPV6_SEG6_HMAC=y +CONFIG_IPV6_SEG6_BPF=y +CONFIG_IPV6_RPL_LWTUNNEL=y +# CONFIG_IPV6_IOAM6_LWTUNNEL is not set +# CONFIG_MPTCP is not set +CONFIG_NETWORK_SECMARK=y +CONFIG_NET_PTP_CLASSIFY=y +# CONFIG_NETWORK_PHY_TIMESTAMPING is not set +CONFIG_NETFILTER=y +CONFIG_NETFILTER_ADVANCED=y +CONFIG_BRIDGE_NETFILTER=y + +# +# Core Netfilter Configuration +# +CONFIG_NETFILTER_INGRESS=y +CONFIG_NETFILTER_EGRESS=y +CONFIG_NETFILTER_SKIP_EGRESS=y +CONFIG_NETFILTER_NETLINK=y +CONFIG_NETFILTER_FAMILY_BRIDGE=y +CONFIG_NETFILTER_FAMILY_ARP=y +# CONFIG_NETFILTER_NETLINK_HOOK is not set +CONFIG_NETFILTER_NETLINK_ACCT=y +CONFIG_NETFILTER_NETLINK_QUEUE=y +CONFIG_NETFILTER_NETLINK_LOG=y +CONFIG_NETFILTER_NETLINK_OSF=y +CONFIG_NF_CONNTRACK=y +CONFIG_NF_LOG_SYSLOG=y +CONFIG_NETFILTER_CONNCOUNT=y +CONFIG_NF_CONNTRACK_MARK=y +# CONFIG_NF_CONNTRACK_SECMARK is not set +CONFIG_NF_CONNTRACK_ZONES=y +CONFIG_NF_CONNTRACK_PROCFS=y +CONFIG_NF_CONNTRACK_EVENTS=y +CONFIG_NF_CONNTRACK_TIMEOUT=y +CONFIG_NF_CONNTRACK_TIMESTAMP=y +CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_CT_PROTO_DCCP=y +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_CT_PROTO_UDPLITE=y +# CONFIG_NF_CONNTRACK_AMANDA is not set +# CONFIG_NF_CONNTRACK_FTP is not set +# CONFIG_NF_CONNTRACK_H323 is not set +# CONFIG_NF_CONNTRACK_IRC is not set +# CONFIG_NF_CONNTRACK_NETBIOS_NS is not set +# CONFIG_NF_CONNTRACK_SNMP is not set +# CONFIG_NF_CONNTRACK_PPTP is not set +# CONFIG_NF_CONNTRACK_SANE is not set +# CONFIG_NF_CONNTRACK_SIP is not set +# CONFIG_NF_CONNTRACK_TFTP is not set +CONFIG_NF_CT_NETLINK=y +# CONFIG_NF_CT_NETLINK_TIMEOUT is not set +# CONFIG_NETFILTER_NETLINK_GLUE_CT is not set +CONFIG_NF_NAT=y +CONFIG_NF_NAT_REDIRECT=y +CONFIG_NF_NAT_MASQUERADE=y +CONFIG_NETFILTER_SYNPROXY=y +CONFIG_NF_TABLES=y +CONFIG_NF_TABLES_INET=y +CONFIG_NF_TABLES_NETDEV=y +CONFIG_NFT_NUMGEN=y +CONFIG_NFT_CT=y +CONFIG_NFT_CONNLIMIT=y +CONFIG_NFT_LOG=y +CONFIG_NFT_LIMIT=y +CONFIG_NFT_MASQ=y +CONFIG_NFT_REDIR=y +CONFIG_NFT_NAT=y +CONFIG_NFT_TUNNEL=y +CONFIG_NFT_OBJREF=y +CONFIG_NFT_QUEUE=y +CONFIG_NFT_QUOTA=y +CONFIG_NFT_REJECT=y +CONFIG_NFT_REJECT_INET=y +CONFIG_NFT_COMPAT=y +CONFIG_NFT_HASH=y +CONFIG_NFT_FIB=y +CONFIG_NFT_FIB_INET=y +CONFIG_NFT_XFRM=y +CONFIG_NFT_SOCKET=y +CONFIG_NFT_OSF=y +CONFIG_NFT_TPROXY=y +CONFIG_NFT_SYNPROXY=y +CONFIG_NF_DUP_NETDEV=y +CONFIG_NFT_DUP_NETDEV=y +CONFIG_NFT_FWD_NETDEV=y +CONFIG_NFT_FIB_NETDEV=y +CONFIG_NFT_REJECT_NETDEV=y +CONFIG_NETFILTER_XTABLES=y + +# +# Xtables combined modules +# +CONFIG_NETFILTER_XT_MARK=y +CONFIG_NETFILTER_XT_CONNMARK=y +CONFIG_NETFILTER_XT_SET=y + +# +# Xtables targets +# +CONFIG_NETFILTER_XT_TARGET_AUDIT=y +CONFIG_NETFILTER_XT_TARGET_CHECKSUM=y +CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y +CONFIG_NETFILTER_XT_TARGET_CONNMARK=y +CONFIG_NETFILTER_XT_TARGET_CT=y +CONFIG_NETFILTER_XT_TARGET_DSCP=y +CONFIG_NETFILTER_XT_TARGET_HL=y +CONFIG_NETFILTER_XT_TARGET_HMARK=y +CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y +CONFIG_NETFILTER_XT_TARGET_LOG=y +CONFIG_NETFILTER_XT_TARGET_MARK=y +CONFIG_NETFILTER_XT_NAT=y +CONFIG_NETFILTER_XT_TARGET_NETMAP=y +CONFIG_NETFILTER_XT_TARGET_NFLOG=y +CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y +CONFIG_NETFILTER_XT_TARGET_NOTRACK=y +CONFIG_NETFILTER_XT_TARGET_RATEEST=y +CONFIG_NETFILTER_XT_TARGET_REDIRECT=y +CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y +CONFIG_NETFILTER_XT_TARGET_TEE=y +CONFIG_NETFILTER_XT_TARGET_TPROXY=y +CONFIG_NETFILTER_XT_TARGET_TRACE=y +# CONFIG_NETFILTER_XT_TARGET_SECMARK is not set +CONFIG_NETFILTER_XT_TARGET_TCPMSS=y +CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=y + +# +# Xtables matches +# +CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y +CONFIG_NETFILTER_XT_MATCH_BPF=y +CONFIG_NETFILTER_XT_MATCH_CGROUP=y +CONFIG_NETFILTER_XT_MATCH_CLUSTER=y +CONFIG_NETFILTER_XT_MATCH_COMMENT=y +CONFIG_NETFILTER_XT_MATCH_CONNBYTES=y +CONFIG_NETFILTER_XT_MATCH_CONNLABEL=y +CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y +CONFIG_NETFILTER_XT_MATCH_CONNMARK=y +CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y +CONFIG_NETFILTER_XT_MATCH_CPU=y +CONFIG_NETFILTER_XT_MATCH_DCCP=y +CONFIG_NETFILTER_XT_MATCH_DEVGROUP=y +CONFIG_NETFILTER_XT_MATCH_DSCP=y +CONFIG_NETFILTER_XT_MATCH_ECN=y +CONFIG_NETFILTER_XT_MATCH_ESP=y +CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y +CONFIG_NETFILTER_XT_MATCH_HELPER=y +CONFIG_NETFILTER_XT_MATCH_HL=y +CONFIG_NETFILTER_XT_MATCH_IPCOMP=y +CONFIG_NETFILTER_XT_MATCH_IPRANGE=y +# CONFIG_NETFILTER_XT_MATCH_IPVS is not set +CONFIG_NETFILTER_XT_MATCH_L2TP=y +CONFIG_NETFILTER_XT_MATCH_LENGTH=y +CONFIG_NETFILTER_XT_MATCH_LIMIT=y +CONFIG_NETFILTER_XT_MATCH_MAC=y +CONFIG_NETFILTER_XT_MATCH_MARK=y +CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y +CONFIG_NETFILTER_XT_MATCH_NFACCT=y +CONFIG_NETFILTER_XT_MATCH_OSF=y +CONFIG_NETFILTER_XT_MATCH_OWNER=y +CONFIG_NETFILTER_XT_MATCH_POLICY=y +CONFIG_NETFILTER_XT_MATCH_PHYSDEV=y +CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y +CONFIG_NETFILTER_XT_MATCH_QUOTA=y +CONFIG_NETFILTER_XT_MATCH_RATEEST=y +CONFIG_NETFILTER_XT_MATCH_REALM=y +CONFIG_NETFILTER_XT_MATCH_RECENT=y +CONFIG_NETFILTER_XT_MATCH_SCTP=y +CONFIG_NETFILTER_XT_MATCH_SOCKET=y +CONFIG_NETFILTER_XT_MATCH_STATE=y +CONFIG_NETFILTER_XT_MATCH_STATISTIC=y +CONFIG_NETFILTER_XT_MATCH_STRING=y +CONFIG_NETFILTER_XT_MATCH_TCPMSS=y +CONFIG_NETFILTER_XT_MATCH_TIME=y +CONFIG_NETFILTER_XT_MATCH_U32=y +# end of Core Netfilter Configuration + +CONFIG_IP_SET=y +CONFIG_IP_SET_MAX=256 +# CONFIG_IP_SET_BITMAP_IP is not set +# CONFIG_IP_SET_BITMAP_IPMAC is not set +# CONFIG_IP_SET_BITMAP_PORT is not set +CONFIG_IP_SET_HASH_IP=y +# CONFIG_IP_SET_HASH_IPMARK is not set +# CONFIG_IP_SET_HASH_IPPORT is not set +# CONFIG_IP_SET_HASH_IPPORTIP is not set +# CONFIG_IP_SET_HASH_IPPORTNET is not set +# CONFIG_IP_SET_HASH_IPMAC is not set +# CONFIG_IP_SET_HASH_MAC is not set +# CONFIG_IP_SET_HASH_NETPORTNET is not set +# CONFIG_IP_SET_HASH_NET is not set +# CONFIG_IP_SET_HASH_NETNET is not set +# CONFIG_IP_SET_HASH_NETPORT is not set +# CONFIG_IP_SET_HASH_NETIFACE is not set +# CONFIG_IP_SET_LIST_SET is not set +CONFIG_IP_VS=y +# CONFIG_IP_VS_IPV6 is not set +# CONFIG_IP_VS_DEBUG is not set +CONFIG_IP_VS_TAB_BITS=12 + +# +# IPVS transport protocol load balancing support +# +CONFIG_IP_VS_PROTO_TCP=y +CONFIG_IP_VS_PROTO_UDP=y +CONFIG_IP_VS_PROTO_AH_ESP=y +CONFIG_IP_VS_PROTO_ESP=y +CONFIG_IP_VS_PROTO_AH=y +CONFIG_IP_VS_PROTO_SCTP=y + +# +# IPVS scheduler +# +# CONFIG_IP_VS_RR is not set +# CONFIG_IP_VS_WRR is not set +# CONFIG_IP_VS_LC is not set +# CONFIG_IP_VS_WLC is not set +# CONFIG_IP_VS_FO is not set +# CONFIG_IP_VS_OVF is not set +# CONFIG_IP_VS_LBLC is not set +# CONFIG_IP_VS_LBLCR is not set +CONFIG_IP_VS_DH=y +# CONFIG_IP_VS_SH is not set +# CONFIG_IP_VS_MH is not set +# CONFIG_IP_VS_SED is not set +# CONFIG_IP_VS_NQ is not set +# CONFIG_IP_VS_TWOS is not set + +# +# IPVS SH scheduler +# +CONFIG_IP_VS_SH_TAB_BITS=8 + +# +# IPVS MH scheduler +# +CONFIG_IP_VS_MH_TAB_INDEX=12 + +# +# IPVS application helper +# +# CONFIG_IP_VS_NFCT is not set + +# +# IP: Netfilter Configuration +# +CONFIG_NF_DEFRAG_IPV4=y +CONFIG_NF_SOCKET_IPV4=y +CONFIG_NF_TPROXY_IPV4=y +CONFIG_NF_TABLES_IPV4=y +CONFIG_NFT_REJECT_IPV4=y +CONFIG_NFT_DUP_IPV4=y +CONFIG_NFT_FIB_IPV4=y +CONFIG_NF_TABLES_ARP=y +CONFIG_NF_DUP_IPV4=y +CONFIG_NF_LOG_ARP=y +CONFIG_NF_LOG_IPV4=y +CONFIG_NF_REJECT_IPV4=y +CONFIG_IP_NF_IPTABLES=y +CONFIG_IP_NF_MATCH_AH=y +CONFIG_IP_NF_MATCH_ECN=y +CONFIG_IP_NF_MATCH_RPFILTER=y +CONFIG_IP_NF_MATCH_TTL=y +CONFIG_IP_NF_FILTER=y +CONFIG_IP_NF_TARGET_REJECT=y +CONFIG_IP_NF_TARGET_SYNPROXY=y +CONFIG_IP_NF_NAT=y +CONFIG_IP_NF_TARGET_MASQUERADE=y +CONFIG_IP_NF_TARGET_NETMAP=y +CONFIG_IP_NF_TARGET_REDIRECT=y +CONFIG_IP_NF_MANGLE=y +CONFIG_IP_NF_TARGET_CLUSTERIP=y +CONFIG_IP_NF_TARGET_ECN=y +CONFIG_IP_NF_TARGET_TTL=y +CONFIG_IP_NF_RAW=y +CONFIG_IP_NF_ARPTABLES=y +CONFIG_IP_NF_ARPFILTER=y +CONFIG_IP_NF_ARP_MANGLE=y +# end of IP: Netfilter Configuration + +# +# IPv6: Netfilter Configuration +# +CONFIG_NF_SOCKET_IPV6=y +CONFIG_NF_TPROXY_IPV6=y +CONFIG_NF_TABLES_IPV6=y +CONFIG_NFT_REJECT_IPV6=y +CONFIG_NFT_DUP_IPV6=y +CONFIG_NFT_FIB_IPV6=y +CONFIG_NF_DUP_IPV6=y +CONFIG_NF_REJECT_IPV6=y +CONFIG_NF_LOG_IPV6=y +CONFIG_IP6_NF_IPTABLES=y +CONFIG_IP6_NF_MATCH_AH=y +CONFIG_IP6_NF_MATCH_EUI64=y +CONFIG_IP6_NF_MATCH_FRAG=y +CONFIG_IP6_NF_MATCH_OPTS=y +CONFIG_IP6_NF_MATCH_HL=y +CONFIG_IP6_NF_MATCH_IPV6HEADER=y +CONFIG_IP6_NF_MATCH_MH=y +CONFIG_IP6_NF_MATCH_RPFILTER=y +CONFIG_IP6_NF_MATCH_RT=y +CONFIG_IP6_NF_MATCH_SRH=y +CONFIG_IP6_NF_TARGET_HL=y +CONFIG_IP6_NF_FILTER=y +CONFIG_IP6_NF_TARGET_REJECT=y +CONFIG_IP6_NF_TARGET_SYNPROXY=y +CONFIG_IP6_NF_MANGLE=y +CONFIG_IP6_NF_RAW=y +CONFIG_IP6_NF_NAT=y +CONFIG_IP6_NF_TARGET_MASQUERADE=y +CONFIG_IP6_NF_TARGET_NPT=y +# end of IPv6: Netfilter Configuration + +CONFIG_NF_DEFRAG_IPV6=y +CONFIG_NF_TABLES_BRIDGE=y +# CONFIG_NFT_BRIDGE_META is not set +# CONFIG_NFT_BRIDGE_REJECT is not set +CONFIG_NF_CONNTRACK_BRIDGE=y +CONFIG_BRIDGE_NF_EBTABLES=y +CONFIG_BRIDGE_EBT_BROUTE=y +CONFIG_BRIDGE_EBT_T_FILTER=y +CONFIG_BRIDGE_EBT_T_NAT=y +CONFIG_BRIDGE_EBT_802_3=y +CONFIG_BRIDGE_EBT_AMONG=y +CONFIG_BRIDGE_EBT_ARP=y +CONFIG_BRIDGE_EBT_IP=y +CONFIG_BRIDGE_EBT_IP6=y +CONFIG_BRIDGE_EBT_LIMIT=y +CONFIG_BRIDGE_EBT_MARK=y +CONFIG_BRIDGE_EBT_PKTTYPE=y +CONFIG_BRIDGE_EBT_STP=y +CONFIG_BRIDGE_EBT_VLAN=y +CONFIG_BRIDGE_EBT_ARPREPLY=y +CONFIG_BRIDGE_EBT_DNAT=y +CONFIG_BRIDGE_EBT_MARK_T=y +CONFIG_BRIDGE_EBT_REDIRECT=y +CONFIG_BRIDGE_EBT_SNAT=y +CONFIG_BRIDGE_EBT_LOG=y +CONFIG_BRIDGE_EBT_NFLOG=y +CONFIG_BPFILTER=y +CONFIG_BPFILTER_UMH=y +# CONFIG_IP_DCCP is not set +CONFIG_IP_SCTP=y +# CONFIG_SCTP_DBG_OBJCNT is not set +CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y +# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_SHA1 is not set +# CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set +CONFIG_SCTP_COOKIE_HMAC_MD5=y +# CONFIG_SCTP_COOKIE_HMAC_SHA1 is not set +CONFIG_INET_SCTP_DIAG=y +# CONFIG_RDS is not set +# CONFIG_TIPC is not set +# CONFIG_ATM is not set +# CONFIG_L2TP is not set +CONFIG_STP=y +CONFIG_BRIDGE=y +CONFIG_BRIDGE_IGMP_SNOOPING=y +# CONFIG_BRIDGE_VLAN_FILTERING is not set +# CONFIG_BRIDGE_MRP is not set +# CONFIG_BRIDGE_CFM is not set +# CONFIG_NET_DSA is not set +CONFIG_VLAN_8021Q=y +# CONFIG_VLAN_8021Q_GVRP is not set +# CONFIG_VLAN_8021Q_MVRP is not set +CONFIG_LLC=y +# CONFIG_LLC2 is not set +# CONFIG_ATALK is not set +# CONFIG_X25 is not set +# CONFIG_LAPB is not set +# CONFIG_PHONET is not set +# CONFIG_6LOWPAN is not set +# CONFIG_IEEE802154 is not set +CONFIG_NET_SCHED=y + +# +# Queueing/Scheduling +# +CONFIG_NET_SCH_CBQ=y +CONFIG_NET_SCH_HTB=y +CONFIG_NET_SCH_HFSC=y +CONFIG_NET_SCH_PRIO=y +CONFIG_NET_SCH_MULTIQ=y +CONFIG_NET_SCH_RED=y +CONFIG_NET_SCH_SFB=y +CONFIG_NET_SCH_SFQ=y +CONFIG_NET_SCH_TEQL=y +CONFIG_NET_SCH_TBF=y +CONFIG_NET_SCH_CBS=y +CONFIG_NET_SCH_ETF=y +CONFIG_NET_SCH_TAPRIO=y +CONFIG_NET_SCH_GRED=y +CONFIG_NET_SCH_DSMARK=y +CONFIG_NET_SCH_NETEM=y +CONFIG_NET_SCH_DRR=y +CONFIG_NET_SCH_MQPRIO=y +CONFIG_NET_SCH_SKBPRIO=y +CONFIG_NET_SCH_CHOKE=y +CONFIG_NET_SCH_QFQ=y +CONFIG_NET_SCH_CODEL=y +CONFIG_NET_SCH_FQ_CODEL=y +CONFIG_NET_SCH_CAKE=y +CONFIG_NET_SCH_FQ=y +CONFIG_NET_SCH_HHF=y +CONFIG_NET_SCH_PIE=y +CONFIG_NET_SCH_FQ_PIE=y +CONFIG_NET_SCH_INGRESS=y +CONFIG_NET_SCH_PLUG=y +CONFIG_NET_SCH_ETS=y +# CONFIG_NET_SCH_DEFAULT is not set + +# +# Classification +# +CONFIG_NET_CLS=y +CONFIG_NET_CLS_BASIC=y +CONFIG_NET_CLS_ROUTE4=y +CONFIG_NET_CLS_FW=y +CONFIG_NET_CLS_U32=y +CONFIG_CLS_U32_PERF=y +CONFIG_CLS_U32_MARK=y +CONFIG_NET_CLS_FLOW=y +CONFIG_NET_CLS_CGROUP=y +CONFIG_NET_CLS_BPF=y +CONFIG_NET_CLS_FLOWER=y +CONFIG_NET_CLS_MATCHALL=y +CONFIG_NET_EMATCH=y +CONFIG_NET_EMATCH_STACK=32 +CONFIG_NET_EMATCH_CMP=y +CONFIG_NET_EMATCH_NBYTE=y +CONFIG_NET_EMATCH_U32=y +CONFIG_NET_EMATCH_META=y +CONFIG_NET_EMATCH_TEXT=y +CONFIG_NET_EMATCH_IPT=y +CONFIG_NET_CLS_ACT=y +CONFIG_NET_ACT_POLICE=y +CONFIG_NET_ACT_GACT=y +CONFIG_GACT_PROB=y +CONFIG_NET_ACT_MIRRED=y +CONFIG_NET_ACT_SAMPLE=y +CONFIG_NET_ACT_IPT=y +CONFIG_NET_ACT_NAT=y +CONFIG_NET_ACT_PEDIT=y +CONFIG_NET_ACT_SIMP=y +CONFIG_NET_ACT_SKBEDIT=y +CONFIG_NET_ACT_CSUM=y +CONFIG_NET_ACT_MPLS=y +CONFIG_NET_ACT_VLAN=y +CONFIG_NET_ACT_BPF=y +CONFIG_NET_ACT_CONNMARK=y +CONFIG_NET_ACT_CTINFO=y +CONFIG_NET_ACT_SKBMOD=y +CONFIG_NET_ACT_IFE=y +CONFIG_NET_ACT_TUNNEL_KEY=y +CONFIG_NET_ACT_GATE=y +CONFIG_NET_IFE_SKBMARK=y +CONFIG_NET_IFE_SKBPRIO=y +CONFIG_NET_IFE_SKBTCINDEX=y +CONFIG_NET_TC_SKB_EXT=y +CONFIG_NET_SCH_FIFO=y +# CONFIG_DCB is not set +CONFIG_DNS_RESOLVER=y +# CONFIG_BATMAN_ADV is not set +# CONFIG_OPENVSWITCH is not set +CONFIG_VSOCKETS=y +CONFIG_VSOCKETS_DIAG=y +# CONFIG_VSOCKETS_LOOPBACK is not set +CONFIG_VIRTIO_VSOCKETS=y +CONFIG_VIRTIO_VSOCKETS_COMMON=y +CONFIG_NETLINK_DIAG=y +# CONFIG_MPLS is not set +# CONFIG_NET_NSH is not set +# CONFIG_HSR is not set +# CONFIG_NET_SWITCHDEV is not set +CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_QRTR is not set +# CONFIG_NET_NCSI is not set +CONFIG_PCPU_DEV_REFCNT=y +CONFIG_RPS=y +CONFIG_RFS_ACCEL=y +CONFIG_SOCK_RX_QUEUE_MAPPING=y +CONFIG_XPS=y +CONFIG_CGROUP_NET_PRIO=y +CONFIG_CGROUP_NET_CLASSID=y +CONFIG_NET_RX_BUSY_POLL=y +CONFIG_BQL=y +# CONFIG_BPF_STREAM_PARSER is not set +CONFIG_NET_FLOW_LIMIT=y + +# +# Network testing +# +# CONFIG_NET_PKTGEN is not set +# end of Network testing +# end of Networking options + +# CONFIG_HAMRADIO is not set +# CONFIG_CAN is not set +# CONFIG_BT is not set +# CONFIG_AF_RXRPC is not set +# CONFIG_AF_KCM is not set +CONFIG_STREAM_PARSER=y +# CONFIG_MCTP is not set +CONFIG_FIB_RULES=y +# CONFIG_WIRELESS is not set +# CONFIG_RFKILL is not set +# CONFIG_NET_9P is not set +# CONFIG_CAIF is not set +# CONFIG_CEPH_LIB is not set +# CONFIG_NFC is not set +CONFIG_PSAMPLE=y +CONFIG_NET_IFE=y +CONFIG_LWTUNNEL=y +CONFIG_LWTUNNEL_BPF=y +CONFIG_DST_CACHE=y +CONFIG_GRO_CELLS=y +CONFIG_NET_SOCK_MSG=y +CONFIG_PAGE_POOL=y +# CONFIG_PAGE_POOL_STATS is not set +CONFIG_FAILOVER=y +# CONFIG_ETHTOOL_NETLINK is not set + +# +# Device Drivers +# +CONFIG_HAVE_EISA=y +# CONFIG_EISA is not set +CONFIG_HAVE_PCI=y +CONFIG_PCI=y +CONFIG_PCI_DOMAINS=y +CONFIG_PCIEPORTBUS=y +# CONFIG_HOTPLUG_PCI_PCIE is not set +CONFIG_PCIEAER=y +# CONFIG_PCIEAER_INJECT is not set +# CONFIG_PCIE_ECRC is not set +CONFIG_PCIEASPM=y +CONFIG_PCIEASPM_DEFAULT=y +# CONFIG_PCIEASPM_POWERSAVE is not set +# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set +# CONFIG_PCIEASPM_PERFORMANCE is not set +CONFIG_PCIE_PME=y +# CONFIG_PCIE_DPC is not set +# CONFIG_PCIE_PTM is not set +CONFIG_PCI_MSI=y +CONFIG_PCI_MSI_IRQ_DOMAIN=y +CONFIG_PCI_QUIRKS=y +CONFIG_PCI_DEBUG=y +CONFIG_PCI_STUB=y +CONFIG_PCI_LOCKLESS_CONFIG=y +# CONFIG_PCI_IOV is not set +# CONFIG_PCI_PRI is not set +# CONFIG_PCI_PASID is not set +# CONFIG_PCI_P2PDMA is not set +CONFIG_PCI_LABEL=y +# CONFIG_PCIE_BUS_TUNE_OFF is not set +CONFIG_PCIE_BUS_DEFAULT=y +# CONFIG_PCIE_BUS_SAFE is not set +# CONFIG_PCIE_BUS_PERFORMANCE is not set +# CONFIG_PCIE_BUS_PEER2PEER is not set +CONFIG_VGA_ARB=y +CONFIG_VGA_ARB_MAX_GPUS=16 +CONFIG_HOTPLUG_PCI=y +CONFIG_HOTPLUG_PCI_ACPI=y +# CONFIG_HOTPLUG_PCI_ACPI_IBM is not set +# CONFIG_HOTPLUG_PCI_CPCI is not set +# CONFIG_HOTPLUG_PCI_SHPC is not set + +# +# PCI controller drivers +# +# CONFIG_VMD is not set + +# +# DesignWare PCI Core Support +# +# CONFIG_PCIE_DW_PLAT_HOST is not set +# CONFIG_PCI_MESON is not set +# end of DesignWare PCI Core Support + +# +# Mobiveil PCIe Core Support +# +# end of Mobiveil PCIe Core Support + +# +# Cadence PCIe controllers support +# +# end of Cadence PCIe controllers support +# end of PCI controller drivers + +# +# PCI Endpoint +# +# CONFIG_PCI_ENDPOINT is not set +# end of PCI Endpoint + +# +# PCI switch controller drivers +# +# CONFIG_PCI_SW_SWITCHTEC is not set +# end of PCI switch controller drivers + +# CONFIG_CXL_BUS is not set +# CONFIG_PCCARD is not set +# CONFIG_RAPIDIO is not set + +# +# Generic Driver Options +# +CONFIG_UEVENT_HELPER=y +CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug" +CONFIG_DEVTMPFS=y +CONFIG_DEVTMPFS_MOUNT=y +# CONFIG_DEVTMPFS_SAFE is not set +CONFIG_STANDALONE=y +CONFIG_PREVENT_FIRMWARE_BUILD=y + +# +# Firmware loader +# +CONFIG_FW_LOADER=y +CONFIG_FW_LOADER_PAGED_BUF=y +CONFIG_FW_LOADER_SYSFS=y +CONFIG_EXTRA_FIRMWARE="" +CONFIG_FW_LOADER_USER_HELPER=y +# CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set +# CONFIG_FW_LOADER_COMPRESS is not set +# CONFIG_FW_UPLOAD is not set +# end of Firmware loader + +CONFIG_ALLOW_DEV_COREDUMP=y +# CONFIG_DEBUG_DRIVER is not set +# CONFIG_DEBUG_DEVRES is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +CONFIG_GENERIC_CPU_AUTOPROBE=y +CONFIG_GENERIC_CPU_VULNERABILITIES=y +# end of Generic Driver Options + +# +# Bus devices +# +# CONFIG_MHI_BUS is not set +# CONFIG_MHI_BUS_EP is not set +# end of Bus devices + +CONFIG_CONNECTOR=y +CONFIG_PROC_EVENTS=y + +# +# Firmware Drivers +# + +# +# ARM System Control and Management Interface Protocol +# +# end of ARM System Control and Management Interface Protocol + +# CONFIG_EDD is not set +CONFIG_FIRMWARE_MEMMAP=y +CONFIG_DMIID=y +CONFIG_DMI_SYSFS=y +CONFIG_DMI_SCAN_MACHINE_NON_EFI_FALLBACK=y +# CONFIG_FW_CFG_SYSFS is not set +# CONFIG_SYSFB_SIMPLEFB is not set +# CONFIG_GOOGLE_FIRMWARE is not set + +# +# EFI (Extensible Firmware Interface) Support +# +CONFIG_EFI_ESRT=y +CONFIG_EFI_RUNTIME_MAP=y +# CONFIG_EFI_FAKE_MEMMAP is not set +CONFIG_EFI_DXE_MEM_ATTRIBUTES=y +CONFIG_EFI_RUNTIME_WRAPPERS=y +CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y +# CONFIG_EFI_BOOTLOADER_CONTROL is not set +# CONFIG_EFI_CAPSULE_LOADER is not set +# CONFIG_EFI_TEST is not set +# CONFIG_APPLE_PROPERTIES is not set +# CONFIG_RESET_ATTACK_MITIGATION is not set +# CONFIG_EFI_RCI2_TABLE is not set +# CONFIG_EFI_DISABLE_PCI_DMA is not set +CONFIG_EFI_EARLYCON=y +# CONFIG_EFI_CUSTOM_SSDT_OVERLAYS is not set +# CONFIG_EFI_DISABLE_RUNTIME is not set +# CONFIG_EFI_COCO_SECRET is not set +# end of EFI (Extensible Firmware Interface) Support + +# +# Tegra firmware driver +# +# end of Tegra firmware driver +# end of Firmware Drivers + +# CONFIG_GNSS is not set +# CONFIG_MTD is not set +# CONFIG_OF is not set +CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y +# CONFIG_PARPORT is not set +CONFIG_PNP=y +# CONFIG_PNP_DEBUG_MESSAGES is not set + +# +# Protocols +# +CONFIG_PNPACPI=y +CONFIG_BLK_DEV=y +CONFIG_BLK_DEV_NULL_BLK=y +# CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set +CONFIG_ZRAM=y +CONFIG_ZRAM_DEF_COMP_LZORLE=y +# CONFIG_ZRAM_DEF_COMP_LZO is not set +CONFIG_ZRAM_DEF_COMP="lzo-rle" +# CONFIG_ZRAM_WRITEBACK is not set +# CONFIG_ZRAM_MEMORY_TRACKING is not set +CONFIG_BLK_DEV_LOOP=y +CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 +# CONFIG_BLK_DEV_DRBD is not set +# CONFIG_BLK_DEV_NBD is not set +CONFIG_BLK_DEV_RAM=y +CONFIG_BLK_DEV_RAM_COUNT=16 +CONFIG_BLK_DEV_RAM_SIZE=16384 +# CONFIG_ATA_OVER_ETH is not set +CONFIG_VIRTIO_BLK=y +# CONFIG_BLK_DEV_RBD is not set +# CONFIG_BLK_DEV_UBLK is not set + +# +# NVME Support +# +# CONFIG_BLK_DEV_NVME is not set +# CONFIG_NVME_FC is not set +# CONFIG_NVME_TCP is not set +# CONFIG_NVME_TARGET is not set +# end of NVME Support + +# +# Misc devices +# +# CONFIG_DUMMY_IRQ is not set +# CONFIG_IBM_ASM is not set +# CONFIG_PHANTOM is not set +# CONFIG_TIFM_CORE is not set +# CONFIG_ENCLOSURE_SERVICES is not set +# CONFIG_HP_ILO is not set +# CONFIG_SRAM is not set +# CONFIG_DW_XDATA_PCIE is not set +# CONFIG_PCI_ENDPOINT_TEST is not set +# CONFIG_XILINX_SDFEC is not set +# CONFIG_C2PORT is not set + +# +# EEPROM support +# +# CONFIG_EEPROM_93CX6 is not set +# end of EEPROM support + +# CONFIG_CB710_CORE is not set + +# +# Texas Instruments shared transport line discipline +# +# end of Texas Instruments shared transport line discipline + +# +# Altera FPGA firmware download module (requires I2C) +# +# CONFIG_INTEL_MEI is not set +# CONFIG_INTEL_MEI_ME is not set +# CONFIG_INTEL_MEI_TXE is not set +# CONFIG_VMWARE_VMCI is not set +# CONFIG_GENWQE is not set +# CONFIG_ECHO is not set +# CONFIG_BCM_VK is not set +# CONFIG_MISC_ALCOR_PCI is not set +# CONFIG_MISC_RTSX_PCI is not set +# CONFIG_HABANA_AI is not set +# CONFIG_UACCE is not set +# CONFIG_PVPANIC is not set +# end of Misc devices + +# +# SCSI device support +# +CONFIG_SCSI_MOD=y +# CONFIG_RAID_ATTRS is not set +# CONFIG_SCSI is not set +# end of SCSI device support + +# CONFIG_ATA is not set +# CONFIG_MD is not set +# CONFIG_TARGET_CORE is not set +# CONFIG_FUSION is not set + +# +# IEEE 1394 (FireWire) support +# +# CONFIG_FIREWIRE is not set +# CONFIG_FIREWIRE_NOSY is not set +# end of IEEE 1394 (FireWire) support + +# CONFIG_MACINTOSH_DRIVERS is not set +CONFIG_NETDEVICES=y +CONFIG_NET_CORE=y +# CONFIG_BONDING is not set +# CONFIG_DUMMY is not set +CONFIG_WIREGUARD=y +# CONFIG_WIREGUARD_DEBUG is not set +# CONFIG_EQUALIZER is not set +# CONFIG_IFB is not set +# CONFIG_NET_TEAM is not set +CONFIG_MACVLAN=y +# CONFIG_MACVTAP is not set +CONFIG_IPVLAN_L3S=y +CONFIG_IPVLAN=y +# CONFIG_IPVTAP is not set +CONFIG_VXLAN=y +CONFIG_GENEVE=y +# CONFIG_BAREUDP is not set +# CONFIG_GTP is not set +# CONFIG_MACSEC is not set +# CONFIG_NETCONSOLE is not set +CONFIG_TUN=y +# CONFIG_TUN_VNET_CROSS_LE is not set +CONFIG_VETH=y +CONFIG_VIRTIO_NET=y +# CONFIG_NLMON is not set +# CONFIG_NET_VRF is not set +# CONFIG_ARCNET is not set +# CONFIG_ETHERNET is not set +# CONFIG_FDDI is not set +# CONFIG_HIPPI is not set +# CONFIG_NET_SB1000 is not set +# CONFIG_PHYLIB is not set +# CONFIG_PSE_CONTROLLER is not set +# CONFIG_MDIO_DEVICE is not set + +# +# PCS device drivers +# +# end of PCS device drivers + +# CONFIG_PPP is not set +# CONFIG_SLIP is not set + +# +# Host-side USB support is needed for USB Network Adapter support +# +# CONFIG_WLAN is not set +# CONFIG_WAN is not set + +# +# Wireless WAN +# +# CONFIG_WWAN is not set +# end of Wireless WAN + +# CONFIG_VMXNET3 is not set +# CONFIG_FUJITSU_ES is not set +# CONFIG_NETDEVSIM is not set +CONFIG_NET_FAILOVER=y +# CONFIG_ISDN is not set + +# +# Input device support +# +CONFIG_INPUT=y +CONFIG_INPUT_FF_MEMLESS=y +CONFIG_INPUT_SPARSEKMAP=y +# CONFIG_INPUT_MATRIXKMAP is not set + +# +# Userland interfaces +# +CONFIG_INPUT_MOUSEDEV=y +CONFIG_INPUT_MOUSEDEV_PSAUX=y +CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024 +CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768 +# CONFIG_INPUT_JOYDEV is not set +CONFIG_INPUT_EVDEV=y +# CONFIG_INPUT_EVBUG is not set + +# +# Input Device Drivers +# +CONFIG_INPUT_KEYBOARD=y +# CONFIG_KEYBOARD_ATKBD is not set +# CONFIG_KEYBOARD_LKKBD is not set +# CONFIG_KEYBOARD_NEWTON is not set +# CONFIG_KEYBOARD_OPENCORES is not set +# CONFIG_KEYBOARD_SAMSUNG is not set +# CONFIG_KEYBOARD_STOWAWAY is not set +# CONFIG_KEYBOARD_SUNKBD is not set +# CONFIG_KEYBOARD_XTKBD is not set +# CONFIG_INPUT_MOUSE is not set +# CONFIG_INPUT_JOYSTICK is not set +# CONFIG_INPUT_TABLET is not set +# CONFIG_INPUT_TOUCHSCREEN is not set +CONFIG_INPUT_MISC=y +# CONFIG_INPUT_AD714X is not set +# CONFIG_INPUT_E3X0_BUTTON is not set +# CONFIG_INPUT_PCSPKR is not set +# CONFIG_INPUT_ATLAS_BTNS is not set +CONFIG_INPUT_UINPUT=y +# CONFIG_INPUT_ADXL34X is not set +# CONFIG_INPUT_CMA3000 is not set +# CONFIG_RMI4_CORE is not set + +# +# Hardware I/O ports +# +# CONFIG_SERIO is not set +CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y +# CONFIG_GAMEPORT is not set +# end of Hardware I/O ports +# end of Input device support + +# +# Character devices +# +CONFIG_TTY=y +CONFIG_VT=y +CONFIG_CONSOLE_TRANSLATIONS=y +CONFIG_VT_CONSOLE=y +CONFIG_HW_CONSOLE=y +CONFIG_VT_HW_CONSOLE_BINDING=y +CONFIG_UNIX98_PTYS=y +# CONFIG_LEGACY_PTYS is not set +# CONFIG_LDISC_AUTOLOAD is not set + +# +# Serial drivers +# +CONFIG_SERIAL_EARLYCON=y +CONFIG_SERIAL_8250=y +# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set +CONFIG_SERIAL_8250_PNP=y +# CONFIG_SERIAL_8250_16550A_VARIANTS is not set +# CONFIG_SERIAL_8250_FINTEK is not set +CONFIG_SERIAL_8250_CONSOLE=y +CONFIG_SERIAL_8250_DMA=y +CONFIG_SERIAL_8250_PCI=y +CONFIG_SERIAL_8250_EXAR=y +CONFIG_SERIAL_8250_NR_UARTS=1 +CONFIG_SERIAL_8250_RUNTIME_UARTS=1 +# CONFIG_SERIAL_8250_EXTENDED is not set +CONFIG_SERIAL_8250_DWLIB=y +# CONFIG_SERIAL_8250_DW is not set +# CONFIG_SERIAL_8250_RT288X is not set +CONFIG_SERIAL_8250_LPSS=y +CONFIG_SERIAL_8250_MID=y +CONFIG_SERIAL_8250_PERICOM=y + +# +# Non-8250 serial port support +# +# CONFIG_SERIAL_UARTLITE is not set +CONFIG_SERIAL_CORE=y +CONFIG_SERIAL_CORE_CONSOLE=y +# CONFIG_SERIAL_JSM is not set +# CONFIG_SERIAL_LANTIQ is not set +# CONFIG_SERIAL_SCCNXP is not set +# CONFIG_SERIAL_ALTERA_JTAGUART is not set +# CONFIG_SERIAL_ALTERA_UART is not set +CONFIG_SERIAL_ARC=y +# CONFIG_SERIAL_ARC_CONSOLE is not set +CONFIG_SERIAL_ARC_NR_PORTS=1 +# CONFIG_SERIAL_RP2 is not set +# CONFIG_SERIAL_FSL_LPUART is not set +# CONFIG_SERIAL_FSL_LINFLEXUART is not set +# CONFIG_SERIAL_SPRD is not set +# end of Serial drivers + +# CONFIG_SERIAL_NONSTANDARD is not set +# CONFIG_N_GSM is not set +# CONFIG_NOZOMI is not set +# CONFIG_NULL_TTY is not set +CONFIG_HVC_DRIVER=y +CONFIG_SERIAL_DEV_BUS=y +CONFIG_SERIAL_DEV_CTRL_TTYPORT=y +# CONFIG_TTY_PRINTK is not set +CONFIG_VIRTIO_CONSOLE=y +# CONFIG_IPMI_HANDLER is not set +CONFIG_HW_RANDOM=y +# CONFIG_HW_RANDOM_TIMERIOMEM is not set +CONFIG_HW_RANDOM_INTEL=y +CONFIG_HW_RANDOM_AMD=y +# CONFIG_HW_RANDOM_BA431 is not set +CONFIG_HW_RANDOM_VIA=y +CONFIG_HW_RANDOM_VIRTIO=y +# CONFIG_HW_RANDOM_XIPHERA is not set +# CONFIG_APPLICOM is not set +# CONFIG_MWAVE is not set +CONFIG_DEVMEM=y +CONFIG_NVRAM=y +CONFIG_DEVPORT=y +# CONFIG_HPET is not set +CONFIG_HANGCHECK_TIMER=y +# CONFIG_TCG_TPM is not set +# CONFIG_TELCLOCK is not set +# CONFIG_XILLYBUS is not set +# CONFIG_RANDOM_TRUST_CPU is not set +# CONFIG_RANDOM_TRUST_BOOTLOADER is not set +# end of Character devices + +# +# I2C support +# +# CONFIG_I2C is not set +# end of I2C support + +# CONFIG_I3C is not set +# CONFIG_SPI is not set +# CONFIG_SPMI is not set +# CONFIG_HSI is not set +CONFIG_PPS=y +CONFIG_PPS_DEBUG=y + +# +# PPS clients support +# +CONFIG_PPS_CLIENT_KTIMER=y +CONFIG_PPS_CLIENT_LDISC=y +# CONFIG_PPS_CLIENT_GPIO is not set + +# +# PPS generators support +# + +# +# PTP clock support +# +CONFIG_PTP_1588_CLOCK=y +CONFIG_PTP_1588_CLOCK_OPTIONAL=y + +# +# Enable PHYLIB and NETWORK_PHY_TIMESTAMPING to see the additional clocks. +# +CONFIG_PTP_1588_CLOCK_KVM=y +# end of PTP clock support + +CONFIG_PINCTRL=y +# CONFIG_DEBUG_PINCTRL is not set +# CONFIG_PINCTRL_AMD is not set + +# +# Intel pinctrl drivers +# +# CONFIG_PINCTRL_BAYTRAIL is not set +# CONFIG_PINCTRL_CHERRYVIEW is not set +# CONFIG_PINCTRL_LYNXPOINT is not set +# CONFIG_PINCTRL_ALDERLAKE is not set +# CONFIG_PINCTRL_BROXTON is not set +# CONFIG_PINCTRL_CANNONLAKE is not set +# CONFIG_PINCTRL_CEDARFORK is not set +# CONFIG_PINCTRL_DENVERTON is not set +# CONFIG_PINCTRL_ELKHARTLAKE is not set +# CONFIG_PINCTRL_EMMITSBURG is not set +# CONFIG_PINCTRL_GEMINILAKE is not set +# CONFIG_PINCTRL_ICELAKE is not set +# CONFIG_PINCTRL_JASPERLAKE is not set +# CONFIG_PINCTRL_LAKEFIELD is not set +# CONFIG_PINCTRL_LEWISBURG is not set +# CONFIG_PINCTRL_METEORLAKE is not set +# CONFIG_PINCTRL_SUNRISEPOINT is not set +# CONFIG_PINCTRL_TIGERLAKE is not set +# end of Intel pinctrl drivers + +# +# Renesas pinctrl drivers +# +# end of Renesas pinctrl drivers + +# CONFIG_GPIOLIB is not set +# CONFIG_W1 is not set +CONFIG_POWER_RESET=y +CONFIG_POWER_SUPPLY=y +# CONFIG_POWER_SUPPLY_DEBUG is not set +# CONFIG_HWMON is not set +CONFIG_THERMAL=y +# CONFIG_THERMAL_NETLINK is not set +# CONFIG_THERMAL_STATISTICS is not set +CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 +CONFIG_THERMAL_WRITABLE_TRIPS=y +CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y +# CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE is not set +# CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE is not set +CONFIG_THERMAL_GOV_FAIR_SHARE=y +CONFIG_THERMAL_GOV_STEP_WISE=y +# CONFIG_THERMAL_GOV_BANG_BANG is not set +CONFIG_THERMAL_GOV_USER_SPACE=y +# CONFIG_THERMAL_EMULATION is not set + +# +# Intel thermal drivers +# +# CONFIG_INTEL_POWERCLAMP is not set +CONFIG_X86_THERMAL_VECTOR=y +# CONFIG_X86_PKG_TEMP_THERMAL is not set +# CONFIG_INTEL_SOC_DTS_THERMAL is not set + +# +# ACPI INT340X thermal drivers +# +# CONFIG_INT340X_THERMAL is not set +# end of ACPI INT340X thermal drivers + +# CONFIG_INTEL_PCH_THERMAL is not set +# CONFIG_INTEL_TCC_COOLING is not set +# CONFIG_INTEL_MENLOW is not set +# CONFIG_INTEL_HFI_THERMAL is not set +# end of Intel thermal drivers + +CONFIG_WATCHDOG=y +CONFIG_WATCHDOG_CORE=y +# CONFIG_WATCHDOG_NOWAYOUT is not set +CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=y +CONFIG_WATCHDOG_OPEN_TIMEOUT=0 +# CONFIG_WATCHDOG_SYSFS is not set +# CONFIG_WATCHDOG_HRTIMER_PRETIMEOUT is not set + +# +# Watchdog Pretimeout Governors +# +# CONFIG_WATCHDOG_PRETIMEOUT_GOV is not set + +# +# Watchdog Device Drivers +# +# CONFIG_SOFT_WATCHDOG is not set +# CONFIG_WDAT_WDT is not set +# CONFIG_XILINX_WATCHDOG is not set +# CONFIG_CADENCE_WATCHDOG is not set +# CONFIG_DW_WATCHDOG is not set +# CONFIG_MAX63XX_WATCHDOG is not set +# CONFIG_ACQUIRE_WDT is not set +# CONFIG_ADVANTECH_WDT is not set +# CONFIG_ALIM1535_WDT is not set +# CONFIG_ALIM7101_WDT is not set +# CONFIG_EBC_C384_WDT is not set +# CONFIG_EXAR_WDT is not set +# CONFIG_F71808E_WDT is not set +# CONFIG_SP5100_TCO is not set +# CONFIG_SBC_FITPC2_WATCHDOG is not set +# CONFIG_EUROTECH_WDT is not set +# CONFIG_IB700_WDT is not set +# CONFIG_IBMASR is not set +# CONFIG_WAFER_WDT is not set +# CONFIG_I6300ESB_WDT is not set +# CONFIG_IE6XX_WDT is not set +# CONFIG_ITCO_WDT is not set +# CONFIG_IT8712F_WDT is not set +# CONFIG_IT87_WDT is not set +# CONFIG_HP_WATCHDOG is not set +# CONFIG_SC1200_WDT is not set +# CONFIG_PC87413_WDT is not set +# CONFIG_NV_TCO is not set +# CONFIG_60XX_WDT is not set +# CONFIG_CPU5_WDT is not set +# CONFIG_SMSC_SCH311X_WDT is not set +# CONFIG_SMSC37B787_WDT is not set +# CONFIG_TQMX86_WDT is not set +# CONFIG_VIA_WDT is not set +# CONFIG_W83627HF_WDT is not set +# CONFIG_W83877F_WDT is not set +# CONFIG_W83977F_WDT is not set +# CONFIG_MACHZ_WDT is not set +# CONFIG_SBC_EPX_C3_WATCHDOG is not set +# CONFIG_NI903X_WDT is not set +# CONFIG_NIC7018_WDT is not set + +# +# PCI-based Watchdog Cards +# +# CONFIG_PCIPCWATCHDOG is not set +# CONFIG_WDTPCI is not set +CONFIG_SSB_POSSIBLE=y +# CONFIG_SSB is not set +CONFIG_BCMA_POSSIBLE=y +# CONFIG_BCMA is not set + +# +# Multifunction device drivers +# +# CONFIG_MFD_MADERA is not set +# CONFIG_HTC_PASIC3 is not set +# CONFIG_MFD_INTEL_QUARK_I2C_GPIO is not set +# CONFIG_LPC_ICH is not set +# CONFIG_LPC_SCH is not set +# CONFIG_MFD_INTEL_LPSS_ACPI is not set +# CONFIG_MFD_INTEL_LPSS_PCI is not set +# CONFIG_MFD_JANZ_CMODIO is not set +# CONFIG_MFD_KEMPLD is not set +# CONFIG_MFD_MT6397 is not set +# CONFIG_MFD_RDC321X is not set +# CONFIG_MFD_SM501 is not set +# CONFIG_MFD_SYSCON is not set +# CONFIG_MFD_TI_AM335X_TSCADC is not set +# CONFIG_MFD_TQMX86 is not set +# CONFIG_MFD_VX855 is not set +# CONFIG_RAVE_SP_CORE is not set +# end of Multifunction device drivers + +# CONFIG_REGULATOR is not set +# CONFIG_RC_CORE is not set + +# +# CEC support +# +# CONFIG_MEDIA_CEC_SUPPORT is not set +# end of CEC support + +# CONFIG_MEDIA_SUPPORT is not set + +# +# Graphics support +# +CONFIG_APERTURE_HELPERS=y +# CONFIG_AGP is not set +# CONFIG_VGA_SWITCHEROO is not set +# CONFIG_DRM is not set +# CONFIG_DRM_DEBUG_MODESET_LOCK is not set + +# +# ARM devices +# +# end of ARM devices + +# +# Frame buffer Devices +# +CONFIG_FB_CMDLINE=y +CONFIG_FB_NOTIFY=y +CONFIG_FB=y +# CONFIG_FIRMWARE_EDID is not set +# CONFIG_FB_FOREIGN_ENDIAN is not set +# CONFIG_FB_MODE_HELPERS is not set +# CONFIG_FB_TILEBLITTING is not set + +# +# Frame buffer hardware drivers +# +# CONFIG_FB_CIRRUS is not set +# CONFIG_FB_PM2 is not set +# CONFIG_FB_CYBER2000 is not set +# CONFIG_FB_ARC is not set +# CONFIG_FB_ASILIANT is not set +# CONFIG_FB_IMSTT is not set +# CONFIG_FB_VGA16 is not set +# CONFIG_FB_UVESA is not set +# CONFIG_FB_VESA is not set +# CONFIG_FB_EFI is not set +# CONFIG_FB_N411 is not set +# CONFIG_FB_HGA is not set +# CONFIG_FB_OPENCORES is not set +# CONFIG_FB_S1D13XXX is not set +# CONFIG_FB_NVIDIA is not set +# CONFIG_FB_RIVA is not set +# CONFIG_FB_I740 is not set +# CONFIG_FB_LE80578 is not set +# CONFIG_FB_MATROX is not set +# CONFIG_FB_RADEON is not set +# CONFIG_FB_ATY128 is not set +# CONFIG_FB_ATY is not set +# CONFIG_FB_S3 is not set +# CONFIG_FB_SAVAGE is not set +# CONFIG_FB_SIS is not set +# CONFIG_FB_NEOMAGIC is not set +# CONFIG_FB_KYRO is not set +# CONFIG_FB_3DFX is not set +# CONFIG_FB_VOODOO1 is not set +# CONFIG_FB_VT8623 is not set +# CONFIG_FB_TRIDENT is not set +# CONFIG_FB_ARK is not set +# CONFIG_FB_PM3 is not set +# CONFIG_FB_CARMINE is not set +# CONFIG_FB_IBM_GXT4500 is not set +# CONFIG_FB_VIRTUAL is not set +# CONFIG_FB_METRONOME is not set +# CONFIG_FB_MB862XX is not set +# CONFIG_FB_SIMPLE is not set +# CONFIG_FB_SM712 is not set +# end of Frame buffer Devices + +# +# Backlight & LCD device support +# +CONFIG_LCD_CLASS_DEVICE=y +# CONFIG_LCD_PLATFORM is not set +CONFIG_BACKLIGHT_CLASS_DEVICE=y +# CONFIG_BACKLIGHT_APPLE is not set +# CONFIG_BACKLIGHT_QCOM_WLED is not set +# CONFIG_BACKLIGHT_SAHARA is not set +# end of Backlight & LCD device support + +# +# Console display driver support +# +CONFIG_VGA_CONSOLE=y +CONFIG_DUMMY_CONSOLE=y +CONFIG_DUMMY_CONSOLE_COLUMNS=80 +CONFIG_DUMMY_CONSOLE_ROWS=25 +CONFIG_FRAMEBUFFER_CONSOLE=y +# CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION is not set +CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY=y +# CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set +# CONFIG_FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER is not set +# end of Console display driver support + +# CONFIG_LOGO is not set +# end of Graphics support + +# CONFIG_SOUND is not set + +# +# HID support +# +CONFIG_HID=y +# CONFIG_HID_BATTERY_STRENGTH is not set +CONFIG_HIDRAW=y +CONFIG_UHID=y +CONFIG_HID_GENERIC=y + +# +# Special HID drivers +# +# CONFIG_HID_A4TECH is not set +# CONFIG_HID_ACRUX is not set +# CONFIG_HID_AUREAL is not set +# CONFIG_HID_BELKIN is not set +# CONFIG_HID_CHERRY is not set +# CONFIG_HID_COUGAR is not set +# CONFIG_HID_MACALLY is not set +# CONFIG_HID_CMEDIA is not set +# CONFIG_HID_CYPRESS is not set +# CONFIG_HID_DRAGONRISE is not set +# CONFIG_HID_EMS_FF is not set +# CONFIG_HID_ELECOM is not set +# CONFIG_HID_EZKEY is not set +# CONFIG_HID_GEMBIRD is not set +# CONFIG_HID_GFRM is not set +# CONFIG_HID_GLORIOUS is not set +# CONFIG_HID_VIVALDI is not set +# CONFIG_HID_KEYTOUCH is not set +# CONFIG_HID_KYE is not set +# CONFIG_HID_WALTOP is not set +# CONFIG_HID_VIEWSONIC is not set +# CONFIG_HID_VRC2 is not set +# CONFIG_HID_XIAOMI is not set +# CONFIG_HID_GYRATION is not set +# CONFIG_HID_ICADE is not set +# CONFIG_HID_ITE is not set +# CONFIG_HID_JABRA is not set +# CONFIG_HID_TWINHAN is not set +# CONFIG_HID_KENSINGTON is not set +# CONFIG_HID_LCPOWER is not set +# CONFIG_HID_LENOVO is not set +# CONFIG_HID_MAGICMOUSE is not set +# CONFIG_HID_MALTRON is not set +# CONFIG_HID_MAYFLASH is not set +CONFIG_HID_REDRAGON=y +# CONFIG_HID_MICROSOFT is not set +# CONFIG_HID_MONTEREY is not set +# CONFIG_HID_MULTITOUCH is not set +# CONFIG_HID_NTI is not set +# CONFIG_HID_ORTEK is not set +# CONFIG_HID_PANTHERLORD is not set +# CONFIG_HID_PETALYNX is not set +# CONFIG_HID_PICOLCD is not set +# CONFIG_HID_PLANTRONICS is not set +# CONFIG_HID_PXRC is not set +# CONFIG_HID_RAZER is not set +# CONFIG_HID_PRIMAX is not set +# CONFIG_HID_SAITEK is not set +# CONFIG_HID_SEMITEK is not set +# CONFIG_HID_SPEEDLINK is not set +# CONFIG_HID_STEAM is not set +# CONFIG_HID_STEELSERIES is not set +# CONFIG_HID_SUNPLUS is not set +# CONFIG_HID_RMI is not set +# CONFIG_HID_GREENASIA is not set +# CONFIG_HID_SMARTJOYPLUS is not set +# CONFIG_HID_TIVO is not set +# CONFIG_HID_TOPSEED is not set +# CONFIG_HID_TOPRE is not set +# CONFIG_HID_UDRAW_PS3 is not set +# CONFIG_HID_XINMO is not set +# CONFIG_HID_ZEROPLUS is not set +# CONFIG_HID_ZYDACRON is not set +# CONFIG_HID_SENSOR_HUB is not set +# CONFIG_HID_ALPS is not set +# end of Special HID drivers + +# +# Intel ISH HID support +# +# CONFIG_INTEL_ISH_HID is not set +# end of Intel ISH HID support + +# +# AMD SFH HID Support +# +# CONFIG_AMD_SFH_HID is not set +# end of AMD SFH HID Support +# end of HID support + +CONFIG_USB_OHCI_LITTLE_ENDIAN=y +# CONFIG_USB_SUPPORT is not set +# CONFIG_MMC is not set +# CONFIG_MEMSTICK is not set +# CONFIG_NEW_LEDS is not set +# CONFIG_ACCESSIBILITY is not set +# CONFIG_INFINIBAND is not set +CONFIG_EDAC_ATOMIC_SCRUB=y +CONFIG_EDAC_SUPPORT=y +# CONFIG_EDAC is not set +CONFIG_RTC_LIB=y +CONFIG_RTC_MC146818_LIB=y +CONFIG_RTC_CLASS=y +CONFIG_RTC_HCTOSYS=y +CONFIG_RTC_HCTOSYS_DEVICE="rtc0" +CONFIG_RTC_SYSTOHC=y +CONFIG_RTC_SYSTOHC_DEVICE="rtc0" +# CONFIG_RTC_DEBUG is not set +CONFIG_RTC_NVMEM=y + +# +# RTC interfaces +# +CONFIG_RTC_INTF_SYSFS=y +CONFIG_RTC_INTF_PROC=y +CONFIG_RTC_INTF_DEV=y +# CONFIG_RTC_INTF_DEV_UIE_EMUL is not set +# CONFIG_RTC_DRV_TEST is not set +CONFIG_RTC_I2C_AND_SPI=y +CONFIG_DMADEVICES=y +# CONFIG_DMADEVICES_DEBUG is not set + +# +# DMA Devices +# +CONFIG_DMA_ENGINE=y +CONFIG_DMA_VIRTUAL_CHANNELS=y +CONFIG_DMA_ACPI=y +# CONFIG_ALTERA_MSGDMA is not set +# CONFIG_INTEL_IDMA64 is not set +# CONFIG_INTEL_IDXD_COMPAT is not set +# CONFIG_INTEL_IOATDMA is not set +# CONFIG_PLX_DMA is not set +# CONFIG_AMD_PTDMA is not set +# CONFIG_QCOM_HIDMA_MGMT is not set +# CONFIG_QCOM_HIDMA is not set +CONFIG_DW_DMAC_CORE=y +# CONFIG_DW_DMAC is not set +CONFIG_DW_DMAC_PCI=y +# CONFIG_DW_EDMA is not set +# CONFIG_DW_EDMA_PCIE is not set +CONFIG_HSU_DMA=y +# CONFIG_SF_PDMA is not set +# CONFIG_INTEL_LDMA is not set + +# +# DMA Clients +# +# CONFIG_ASYNC_TX_DMA is not set +# CONFIG_DMATEST is not set + +# +# DMABUF options +# +CONFIG_SYNC_FILE=y +# CONFIG_SW_SYNC is not set +# CONFIG_UDMABUF is not set +# CONFIG_DMABUF_MOVE_NOTIFY is not set +# CONFIG_DMABUF_DEBUG is not set +# CONFIG_DMABUF_SELFTESTS is not set +# CONFIG_DMABUF_HEAPS is not set +# CONFIG_DMABUF_SYSFS_STATS is not set +# end of DMABUF options + +# CONFIG_AUXDISPLAY is not set +CONFIG_UIO=y +# CONFIG_UIO_CIF is not set +CONFIG_UIO_PDRV_GENIRQ=y +CONFIG_UIO_DMEM_GENIRQ=y +# CONFIG_UIO_AEC is not set +# CONFIG_UIO_SERCOS3 is not set +# CONFIG_UIO_PCI_GENERIC is not set +# CONFIG_UIO_NETX is not set +# CONFIG_UIO_PRUSS is not set +# CONFIG_UIO_MF624 is not set +CONFIG_VFIO=y +CONFIG_VFIO_IOMMU_TYPE1=y +CONFIG_VFIO_VIRQFD=y +# CONFIG_VFIO_NOIOMMU is not set +CONFIG_VFIO_PCI_CORE=y +CONFIG_VFIO_PCI_MMAP=y +CONFIG_VFIO_PCI_INTX=y +CONFIG_VFIO_PCI=y +# CONFIG_VFIO_PCI_VGA is not set +# CONFIG_VFIO_PCI_IGD is not set +# CONFIG_VFIO_MDEV is not set +CONFIG_IRQ_BYPASS_MANAGER=y +# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRTIO_ANCHOR=y +CONFIG_VIRTIO=y +CONFIG_VIRTIO_PCI_LIB=y +CONFIG_VIRTIO_PCI_LIB_LEGACY=y +CONFIG_VIRTIO_MENU=y +CONFIG_VIRTIO_PCI=y +CONFIG_VIRTIO_PCI_LEGACY=y +CONFIG_VIRTIO_PMEM=y +CONFIG_VIRTIO_BALLOON=y +CONFIG_VIRTIO_MEM=y +CONFIG_VIRTIO_INPUT=y +CONFIG_VIRTIO_MMIO=y +CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y +CONFIG_VIRTIO_DMA_SHARED_BUFFER=y +# CONFIG_VDPA is not set +CONFIG_VHOST_MENU=y +# CONFIG_VHOST_NET is not set +# CONFIG_VHOST_VSOCK is not set +# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set + +# +# Microsoft Hyper-V guest support +# +# end of Microsoft Hyper-V guest support + +# CONFIG_GREYBUS is not set +# CONFIG_COMEDI is not set +# CONFIG_STAGING is not set +# CONFIG_CHROME_PLATFORMS is not set +# CONFIG_MELLANOX_PLATFORM is not set +# CONFIG_SURFACE_PLATFORMS is not set +# CONFIG_X86_PLATFORM_DEVICES is not set +# CONFIG_P2SB is not set +CONFIG_HAVE_CLK=y +CONFIG_HAVE_CLK_PREPARE=y +CONFIG_COMMON_CLK=y +# CONFIG_XILINX_VCU is not set +# CONFIG_HWSPINLOCK is not set + +# +# Clock Source drivers +# +CONFIG_CLKEVT_I8253=y +CONFIG_I8253_LOCK=y +CONFIG_CLKBLD_I8253=y +# end of Clock Source drivers + +CONFIG_MAILBOX=y +CONFIG_PCC=y +# CONFIG_ALTERA_MBOX is not set +CONFIG_IOMMU_IOVA=y +CONFIG_IOMMU_API=y +CONFIG_IOMMU_SUPPORT=y + +# +# Generic IOMMU Pagetable Support +# +# end of Generic IOMMU Pagetable Support + +# CONFIG_IOMMU_DEBUGFS is not set +# CONFIG_IOMMU_DEFAULT_DMA_STRICT is not set +CONFIG_IOMMU_DEFAULT_DMA_LAZY=y +# CONFIG_IOMMU_DEFAULT_PASSTHROUGH is not set +CONFIG_IOMMU_DMA=y +# CONFIG_AMD_IOMMU is not set +# CONFIG_INTEL_IOMMU is not set +# CONFIG_IRQ_REMAP is not set +CONFIG_VIRTIO_IOMMU=y + +# +# Remoteproc drivers +# +# CONFIG_REMOTEPROC is not set +# end of Remoteproc drivers + +# +# Rpmsg drivers +# +# CONFIG_RPMSG_QCOM_GLINK_RPM is not set +# CONFIG_RPMSG_VIRTIO is not set +# end of Rpmsg drivers + +# CONFIG_SOUNDWIRE is not set + +# +# SOC (System On Chip) specific Drivers +# + +# +# Amlogic SoC drivers +# +# end of Amlogic SoC drivers + +# +# Broadcom SoC drivers +# +# end of Broadcom SoC drivers + +# +# NXP/Freescale QorIQ SoC drivers +# +# end of NXP/Freescale QorIQ SoC drivers + +# +# fujitsu SoC drivers +# +# end of fujitsu SoC drivers + +# +# i.MX SoC drivers +# +# end of i.MX SoC drivers + +# +# Enable LiteX SoC Builder specific drivers +# +# end of Enable LiteX SoC Builder specific drivers + +# +# Qualcomm SoC drivers +# +# end of Qualcomm SoC drivers + +# CONFIG_SOC_TI is not set + +# +# Xilinx SoC drivers +# +# end of Xilinx SoC drivers +# end of SOC (System On Chip) specific Drivers + +# CONFIG_PM_DEVFREQ is not set +# CONFIG_EXTCON is not set +# CONFIG_MEMORY is not set +# CONFIG_IIO is not set +# CONFIG_NTB is not set +# CONFIG_PWM is not set + +# +# IRQ chip support +# +# end of IRQ chip support + +# CONFIG_IPACK_BUS is not set +# CONFIG_RESET_CONTROLLER is not set + +# +# PHY Subsystem +# +# CONFIG_GENERIC_PHY is not set +# CONFIG_PHY_CAN_TRANSCEIVER is not set + +# +# PHY drivers for Broadcom platforms +# +# CONFIG_BCM_KONA_USB2_PHY is not set +# end of PHY drivers for Broadcom platforms + +# CONFIG_PHY_PXA_28NM_HSIC is not set +# CONFIG_PHY_PXA_28NM_USB2 is not set +# CONFIG_PHY_INTEL_LGM_EMMC is not set +# end of PHY Subsystem + +# CONFIG_POWERCAP is not set +# CONFIG_MCB is not set + +# +# Performance monitor support +# +# end of Performance monitor support + +CONFIG_RAS=y +# CONFIG_USB4 is not set + +# +# Android +# +# CONFIG_ANDROID_BINDER_IPC is not set +# end of Android + +CONFIG_LIBNVDIMM=y +CONFIG_BLK_DEV_PMEM=y +CONFIG_ND_CLAIM=y +CONFIG_ND_BTT=y +CONFIG_BTT=y +CONFIG_ND_PFN=y +CONFIG_NVDIMM_PFN=y +CONFIG_NVDIMM_DAX=y +CONFIG_DAX=y +CONFIG_DEV_DAX=y +CONFIG_DEV_DAX_PMEM=y +CONFIG_DEV_DAX_KMEM=y +CONFIG_NVMEM=y +CONFIG_NVMEM_SYSFS=y +# CONFIG_NVMEM_RMEM is not set + +# +# HW tracing support +# +# CONFIG_STM is not set +# CONFIG_INTEL_TH is not set +# end of HW tracing support + +# CONFIG_FPGA is not set +# CONFIG_SIOX is not set +# CONFIG_SLIMBUS is not set +# CONFIG_INTERCONNECT is not set +# CONFIG_COUNTER is not set +# CONFIG_MOST is not set +# CONFIG_PECI is not set +# CONFIG_HTE is not set +# end of Device Drivers + +# +# File systems +# +CONFIG_DCACHE_WORD_ACCESS=y +# CONFIG_VALIDATE_FS_PARSER is not set +CONFIG_FS_IOMAP=y +# CONFIG_EXT2_FS is not set +# CONFIG_EXT3_FS is not set +CONFIG_EXT4_FS=y +CONFIG_EXT4_USE_FOR_EXT2=y +CONFIG_EXT4_FS_POSIX_ACL=y +CONFIG_EXT4_FS_SECURITY=y +CONFIG_EXT4_DEBUG=y +CONFIG_JBD2=y +CONFIG_JBD2_DEBUG=y +CONFIG_FS_MBCACHE=y +# CONFIG_REISERFS_FS is not set +# CONFIG_JFS_FS is not set +# CONFIG_XFS_FS is not set +# CONFIG_GFS2_FS is not set +# CONFIG_OCFS2_FS is not set +# CONFIG_BTRFS_FS is not set +# CONFIG_NILFS2_FS is not set +# CONFIG_F2FS_FS is not set +CONFIG_FS_DAX=y +CONFIG_FS_DAX_PMD=y +CONFIG_FS_POSIX_ACL=y +CONFIG_EXPORTFS=y +# CONFIG_EXPORTFS_BLOCK_OPS is not set +CONFIG_FILE_LOCKING=y +CONFIG_FS_ENCRYPTION=y +CONFIG_FS_ENCRYPTION_ALGS=y +# CONFIG_FS_VERITY is not set +CONFIG_FSNOTIFY=y +CONFIG_DNOTIFY=y +CONFIG_INOTIFY_USER=y +CONFIG_FANOTIFY=y +# CONFIG_QUOTA is not set +CONFIG_AUTOFS4_FS=y +CONFIG_AUTOFS_FS=y +CONFIG_FUSE_FS=y +CONFIG_CUSE=y +CONFIG_VIRTIO_FS=y +CONFIG_FUSE_DAX=y +CONFIG_OVERLAY_FS=y +# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set +CONFIG_OVERLAY_FS_REDIRECT_ALWAYS_FOLLOW=y +# CONFIG_OVERLAY_FS_INDEX is not set +# CONFIG_OVERLAY_FS_XINO_AUTO is not set +# CONFIG_OVERLAY_FS_METACOPY is not set + +# +# Caches +# +CONFIG_NETFS_SUPPORT=y +# CONFIG_NETFS_STATS is not set +CONFIG_FSCACHE=y +# CONFIG_FSCACHE_STATS is not set +# CONFIG_FSCACHE_DEBUG is not set +CONFIG_CACHEFILES=y +# CONFIG_CACHEFILES_DEBUG is not set +# CONFIG_CACHEFILES_ERROR_INJECTION is not set +# CONFIG_CACHEFILES_ONDEMAND is not set +# end of Caches + +# +# CD-ROM/DVD Filesystems +# +CONFIG_ISO9660_FS=y +CONFIG_JOLIET=y +CONFIG_ZISOFS=y +CONFIG_UDF_FS=y +# end of CD-ROM/DVD Filesystems + +# +# DOS/FAT/EXFAT/NT Filesystems +# +CONFIG_FAT_FS=y +CONFIG_MSDOS_FS=y +CONFIG_VFAT_FS=y +CONFIG_FAT_DEFAULT_CODEPAGE=437 +CONFIG_FAT_DEFAULT_IOCHARSET="ascii" +# CONFIG_FAT_DEFAULT_UTF8 is not set +# CONFIG_EXFAT_FS is not set +# CONFIG_NTFS_FS is not set +# CONFIG_NTFS3_FS is not set +# end of DOS/FAT/EXFAT/NT Filesystems + +# +# Pseudo filesystems +# +CONFIG_PROC_FS=y +CONFIG_PROC_KCORE=y +CONFIG_PROC_SYSCTL=y +CONFIG_PROC_PAGE_MONITOR=y +CONFIG_PROC_CHILDREN=y +CONFIG_PROC_PID_ARCH_STATUS=y +CONFIG_KERNFS=y +CONFIG_SYSFS=y +CONFIG_TMPFS=y +CONFIG_TMPFS_POSIX_ACL=y +CONFIG_TMPFS_XATTR=y +# CONFIG_TMPFS_INODE64 is not set +CONFIG_HUGETLBFS=y +CONFIG_HUGETLB_PAGE=y +CONFIG_ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y +CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y +# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set +CONFIG_MEMFD_CREATE=y +CONFIG_ARCH_HAS_GIGANTIC_PAGE=y +CONFIG_CONFIGFS_FS=y +CONFIG_EFIVAR_FS=y +# end of Pseudo filesystems + +CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ORANGEFS_FS is not set +# CONFIG_ADFS_FS is not set +# CONFIG_AFFS_FS is not set +# CONFIG_ECRYPT_FS is not set +# CONFIG_HFS_FS is not set +# CONFIG_HFSPLUS_FS is not set +# CONFIG_BEFS_FS is not set +# CONFIG_BFS_FS is not set +# CONFIG_EFS_FS is not set +# CONFIG_CRAMFS is not set +CONFIG_SQUASHFS=y +CONFIG_SQUASHFS_FILE_CACHE=y +# CONFIG_SQUASHFS_FILE_DIRECT is not set +CONFIG_SQUASHFS_DECOMP_SINGLE=y +# CONFIG_SQUASHFS_DECOMP_MULTI is not set +# CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU is not set +# CONFIG_SQUASHFS_XATTR is not set +CONFIG_SQUASHFS_ZLIB=y +# CONFIG_SQUASHFS_LZ4 is not set +# CONFIG_SQUASHFS_LZO is not set +CONFIG_SQUASHFS_XZ=y +# CONFIG_SQUASHFS_ZSTD is not set +# CONFIG_SQUASHFS_4K_DEVBLK_SIZE is not set +# CONFIG_SQUASHFS_EMBEDDED is not set +CONFIG_SQUASHFS_FRAGMENT_CACHE_SIZE=3 +# CONFIG_VXFS_FS is not set +# CONFIG_MINIX_FS is not set +# CONFIG_OMFS_FS is not set +# CONFIG_HPFS_FS is not set +# CONFIG_QNX4FS_FS is not set +# CONFIG_QNX6FS_FS is not set +# CONFIG_ROMFS_FS is not set +# CONFIG_PSTORE is not set +# CONFIG_SYSV_FS is not set +# CONFIG_UFS_FS is not set +# CONFIG_EROFS_FS is not set +CONFIG_NETWORK_FILESYSTEMS=y +CONFIG_NFS_FS=y +CONFIG_NFS_V2=y +CONFIG_NFS_V3=y +# CONFIG_NFS_V3_ACL is not set +CONFIG_NFS_V4=y +# CONFIG_NFS_SWAP is not set +# CONFIG_NFS_V4_1 is not set +# CONFIG_ROOT_NFS is not set +# CONFIG_NFS_FSCACHE is not set +# CONFIG_NFS_USE_LEGACY_DNS is not set +CONFIG_NFS_USE_KERNEL_DNS=y +CONFIG_NFS_DISABLE_UDP_SUPPORT=y +CONFIG_NFSD=y +# CONFIG_NFSD_V3_ACL is not set +CONFIG_NFSD_V4=y +# CONFIG_NFSD_BLOCKLAYOUT is not set +# CONFIG_NFSD_SCSILAYOUT is not set +# CONFIG_NFSD_FLEXFILELAYOUT is not set +CONFIG_GRACE_PERIOD=y +CONFIG_LOCKD=y +CONFIG_LOCKD_V4=y +CONFIG_NFS_COMMON=y +CONFIG_SUNRPC=y +CONFIG_SUNRPC_GSS=y +CONFIG_RPCSEC_GSS_KRB5=y +# CONFIG_SUNRPC_DISABLE_INSECURE_ENCTYPES is not set +# CONFIG_SUNRPC_DEBUG is not set +# CONFIG_CEPH_FS is not set +CONFIG_CIFS=y +# CONFIG_CIFS_STATS2 is not set +CONFIG_CIFS_ALLOW_INSECURE_LEGACY=y +CONFIG_CIFS_UPCALL=y +CONFIG_CIFS_XATTR=y +CONFIG_CIFS_POSIX=y +# CONFIG_CIFS_DEBUG is not set +CONFIG_CIFS_DFS_UPCALL=y +# CONFIG_CIFS_SMB_DIRECT is not set +# CONFIG_SMB_SERVER is not set +# CONFIG_CODA_FS is not set +# CONFIG_AFS_FS is not set +CONFIG_NLS=y +CONFIG_NLS_DEFAULT="utf8" +CONFIG_NLS_CODEPAGE_437=y +CONFIG_NLS_CODEPAGE_737=y +CONFIG_NLS_CODEPAGE_775=y +CONFIG_NLS_CODEPAGE_850=y +CONFIG_NLS_CODEPAGE_852=y +CONFIG_NLS_CODEPAGE_855=y +CONFIG_NLS_CODEPAGE_857=y +CONFIG_NLS_CODEPAGE_860=y +CONFIG_NLS_CODEPAGE_861=y +CONFIG_NLS_CODEPAGE_862=y +CONFIG_NLS_CODEPAGE_863=y +CONFIG_NLS_CODEPAGE_864=y +CONFIG_NLS_CODEPAGE_865=y +CONFIG_NLS_CODEPAGE_866=y +CONFIG_NLS_CODEPAGE_869=y +CONFIG_NLS_CODEPAGE_936=y +CONFIG_NLS_CODEPAGE_950=y +CONFIG_NLS_CODEPAGE_932=y +CONFIG_NLS_CODEPAGE_949=y +CONFIG_NLS_CODEPAGE_874=y +CONFIG_NLS_ISO8859_8=y +CONFIG_NLS_CODEPAGE_1250=y +CONFIG_NLS_CODEPAGE_1251=y +CONFIG_NLS_ASCII=y +CONFIG_NLS_ISO8859_1=y +CONFIG_NLS_ISO8859_2=y +CONFIG_NLS_ISO8859_3=y +CONFIG_NLS_ISO8859_4=y +CONFIG_NLS_ISO8859_5=y +CONFIG_NLS_ISO8859_6=y +CONFIG_NLS_ISO8859_7=y +CONFIG_NLS_ISO8859_9=y +CONFIG_NLS_ISO8859_13=y +CONFIG_NLS_ISO8859_14=y +CONFIG_NLS_ISO8859_15=y +CONFIG_NLS_KOI8_R=y +CONFIG_NLS_KOI8_U=y +CONFIG_NLS_MAC_ROMAN=y +CONFIG_NLS_MAC_CELTIC=y +CONFIG_NLS_MAC_CENTEURO=y +CONFIG_NLS_MAC_CROATIAN=y +CONFIG_NLS_MAC_CYRILLIC=y +CONFIG_NLS_MAC_GAELIC=y +CONFIG_NLS_MAC_GREEK=y +CONFIG_NLS_MAC_ICELAND=y +CONFIG_NLS_MAC_INUIT=y +CONFIG_NLS_MAC_ROMANIAN=y +CONFIG_NLS_MAC_TURKISH=y +CONFIG_NLS_UTF8=y +# CONFIG_DLM is not set +# CONFIG_UNICODE is not set +CONFIG_IO_WQ=y +# end of File systems + +# +# Security options +# +CONFIG_KEYS=y +# CONFIG_KEYS_REQUEST_CACHE is not set +CONFIG_PERSISTENT_KEYRINGS=y +# CONFIG_BIG_KEYS is not set +# CONFIG_TRUSTED_KEYS is not set +# CONFIG_ENCRYPTED_KEYS is not set +# CONFIG_KEY_DH_OPERATIONS is not set +# CONFIG_SECURITY_DMESG_RESTRICT is not set +# CONFIG_SECURITY is not set +CONFIG_SECURITYFS=y +CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y +# CONFIG_HARDENED_USERCOPY is not set +CONFIG_FORTIFY_SOURCE=y +# CONFIG_STATIC_USERMODEHELPER is not set +# CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT is not set +CONFIG_DEFAULT_SECURITY_DAC=y +CONFIG_LSM="yama,loadpin,safesetid,integrity" + +# +# Kernel hardening options +# + +# +# Memory initialization +# +CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set +# CONFIG_INIT_ON_FREE_DEFAULT_ON is not set +# end of Memory initialization + +CONFIG_RANDSTRUCT_NONE=y +# end of Kernel hardening options +# end of Security options + +CONFIG_CRYPTO=y + +# +# Crypto core or helper +# +# CONFIG_CRYPTO_FIPS is not set +CONFIG_CRYPTO_ALGAPI=y +CONFIG_CRYPTO_ALGAPI2=y +CONFIG_CRYPTO_AEAD=y +CONFIG_CRYPTO_AEAD2=y +CONFIG_CRYPTO_SKCIPHER=y +CONFIG_CRYPTO_SKCIPHER2=y +CONFIG_CRYPTO_HASH=y +CONFIG_CRYPTO_HASH2=y +CONFIG_CRYPTO_RNG=y +CONFIG_CRYPTO_RNG2=y +CONFIG_CRYPTO_RNG_DEFAULT=y +CONFIG_CRYPTO_AKCIPHER2=y +CONFIG_CRYPTO_AKCIPHER=y +CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_ACOMP2=y +CONFIG_CRYPTO_MANAGER=y +CONFIG_CRYPTO_MANAGER2=y +# CONFIG_CRYPTO_USER is not set +# CONFIG_CRYPTO_MANAGER_DISABLE_TESTS is not set +# CONFIG_CRYPTO_MANAGER_EXTRA_TESTS is not set +CONFIG_CRYPTO_GF128MUL=y +CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_NULL2=y +# CONFIG_CRYPTO_PCRYPT is not set +CONFIG_CRYPTO_CRYPTD=y +CONFIG_CRYPTO_AUTHENC=y +# CONFIG_CRYPTO_TEST is not set +CONFIG_CRYPTO_SIMD=y +# end of Crypto core or helper + +# +# Public-key cryptography +# +# CONFIG_CRYPTO_RSA is not set +# CONFIG_CRYPTO_DH is not set +CONFIG_CRYPTO_ECC=y +# CONFIG_CRYPTO_ECDH is not set +CONFIG_CRYPTO_ECDSA=y +# CONFIG_CRYPTO_ECRDSA is not set +# CONFIG_CRYPTO_SM2 is not set +# CONFIG_CRYPTO_CURVE25519 is not set +# end of Public-key cryptography + +# +# Block ciphers +# +CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_TI is not set +# CONFIG_CRYPTO_ARIA is not set +# CONFIG_CRYPTO_BLOWFISH is not set +# CONFIG_CRYPTO_CAMELLIA is not set +# CONFIG_CRYPTO_CAST5 is not set +# CONFIG_CRYPTO_CAST6 is not set +CONFIG_CRYPTO_DES=y +# CONFIG_CRYPTO_FCRYPT is not set +# CONFIG_CRYPTO_SERPENT is not set +# CONFIG_CRYPTO_SM4_GENERIC is not set +# CONFIG_CRYPTO_TWOFISH is not set +CONFIG_CRYPTO_TWOFISH_COMMON=y +# end of Block ciphers + +# +# Length-preserving ciphers and modes +# +# CONFIG_CRYPTO_ADIANTUM is not set +# CONFIG_CRYPTO_CHACHA20 is not set +CONFIG_CRYPTO_CBC=y +# CONFIG_CRYPTO_CFB is not set +CONFIG_CRYPTO_CTR=y +CONFIG_CRYPTO_CTS=y +CONFIG_CRYPTO_ECB=y +# CONFIG_CRYPTO_HCTR2 is not set +# CONFIG_CRYPTO_KEYWRAP is not set +CONFIG_CRYPTO_LRW=y +# CONFIG_CRYPTO_OFB is not set +CONFIG_CRYPTO_PCBC=y +CONFIG_CRYPTO_XTS=y +# end of Length-preserving ciphers and modes + +# +# AEAD (authenticated encryption with associated data) ciphers +# +# CONFIG_CRYPTO_AEGIS128 is not set +# CONFIG_CRYPTO_CHACHA20POLY1305 is not set +# CONFIG_CRYPTO_CCM is not set +CONFIG_CRYPTO_GCM=y +CONFIG_CRYPTO_SEQIV=y +CONFIG_CRYPTO_ECHAINIV=y +# CONFIG_CRYPTO_ESSIV is not set +# end of AEAD (authenticated encryption with associated data) ciphers + +# +# Hashes, digests, and MACs +# +# CONFIG_CRYPTO_BLAKE2B is not set +CONFIG_CRYPTO_CMAC=y +CONFIG_CRYPTO_GHASH=y +CONFIG_CRYPTO_HMAC=y +# CONFIG_CRYPTO_MD4 is not set +CONFIG_CRYPTO_MD5=y +# CONFIG_CRYPTO_MICHAEL_MIC is not set +CONFIG_CRYPTO_POLY1305=y +# CONFIG_CRYPTO_RMD160 is not set +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA512=y +# CONFIG_CRYPTO_SHA3 is not set +# CONFIG_CRYPTO_SM3_GENERIC is not set +# CONFIG_CRYPTO_STREEBOG is not set +# CONFIG_CRYPTO_VMAC is not set +# CONFIG_CRYPTO_WP512 is not set +# CONFIG_CRYPTO_XCBC is not set +# CONFIG_CRYPTO_XXHASH is not set +# end of Hashes, digests, and MACs + +# +# CRCs (cyclic redundancy checks) +# +CONFIG_CRYPTO_CRC32C=y +# CONFIG_CRYPTO_CRC32 is not set +CONFIG_CRYPTO_CRCT10DIF=y +# end of CRCs (cyclic redundancy checks) + +# +# Compression +# +CONFIG_CRYPTO_DEFLATE=y +CONFIG_CRYPTO_LZO=y +# CONFIG_CRYPTO_842 is not set +# CONFIG_CRYPTO_LZ4 is not set +# CONFIG_CRYPTO_LZ4HC is not set +# CONFIG_CRYPTO_ZSTD is not set +# end of Compression + +# +# Random number generation +# +# CONFIG_CRYPTO_ANSI_CPRNG is not set +CONFIG_CRYPTO_DRBG_MENU=y +CONFIG_CRYPTO_DRBG_HMAC=y +CONFIG_CRYPTO_DRBG_HASH=y +CONFIG_CRYPTO_DRBG_CTR=y +CONFIG_CRYPTO_DRBG=y +CONFIG_CRYPTO_JITTERENTROPY=y +# end of Random number generation + +# +# Userspace interface +# +CONFIG_CRYPTO_USER_API=y +# CONFIG_CRYPTO_USER_API_HASH is not set +# CONFIG_CRYPTO_USER_API_SKCIPHER is not set +CONFIG_CRYPTO_USER_API_RNG=y +# CONFIG_CRYPTO_USER_API_RNG_CAVP is not set +# CONFIG_CRYPTO_USER_API_AEAD is not set +# CONFIG_CRYPTO_USER_API_ENABLE_OBSOLETE is not set +# end of Userspace interface + +# +# Accelerated Cryptographic Algorithms for CPU (x86) +# +CONFIG_CRYPTO_CURVE25519_X86=y +CONFIG_CRYPTO_AES_NI_INTEL=y +# CONFIG_CRYPTO_BLOWFISH_X86_64 is not set +# CONFIG_CRYPTO_CAMELLIA_X86_64 is not set +# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set +# CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set +# CONFIG_CRYPTO_CAST5_AVX_X86_64 is not set +# CONFIG_CRYPTO_CAST6_AVX_X86_64 is not set +# CONFIG_CRYPTO_DES3_EDE_X86_64 is not set +# CONFIG_CRYPTO_SERPENT_SSE2_X86_64 is not set +# CONFIG_CRYPTO_SERPENT_AVX_X86_64 is not set +# CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set +# CONFIG_CRYPTO_SM4_AESNI_AVX_X86_64 is not set +# CONFIG_CRYPTO_SM4_AESNI_AVX2_X86_64 is not set +CONFIG_CRYPTO_TWOFISH_X86_64=y +CONFIG_CRYPTO_TWOFISH_X86_64_3WAY=y +CONFIG_CRYPTO_TWOFISH_AVX_X86_64=y +# CONFIG_CRYPTO_ARIA_AESNI_AVX_X86_64 is not set +CONFIG_CRYPTO_CHACHA20_X86_64=y +# CONFIG_CRYPTO_AEGIS128_AESNI_SSE2 is not set +# CONFIG_CRYPTO_NHPOLY1305_SSE2 is not set +# CONFIG_CRYPTO_NHPOLY1305_AVX2 is not set +CONFIG_CRYPTO_BLAKE2S_X86=y +# CONFIG_CRYPTO_POLYVAL_CLMUL_NI is not set +CONFIG_CRYPTO_POLY1305_X86_64=y +# CONFIG_CRYPTO_SHA1_SSSE3 is not set +# CONFIG_CRYPTO_SHA256_SSSE3 is not set +# CONFIG_CRYPTO_SHA512_SSSE3 is not set +# CONFIG_CRYPTO_SM3_AVX_X86_64 is not set +# CONFIG_CRYPTO_GHASH_CLMUL_NI_INTEL is not set +CONFIG_CRYPTO_CRC32C_INTEL=y +# CONFIG_CRYPTO_CRC32_PCLMUL is not set +# CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set +# end of Accelerated Cryptographic Algorithms for CPU (x86) + +# CONFIG_CRYPTO_HW is not set +# CONFIG_ASYMMETRIC_KEY_TYPE is not set + +# +# Certificates for signature checking +# +CONFIG_SYSTEM_BLACKLIST_KEYRING=y +CONFIG_SYSTEM_BLACKLIST_HASH_LIST="" +# end of Certificates for signature checking + +CONFIG_BINARY_PRINTF=y + +# +# Library routines +# +# CONFIG_PACKING is not set +CONFIG_BITREVERSE=y +CONFIG_GENERIC_STRNCPY_FROM_USER=y +CONFIG_GENERIC_STRNLEN_USER=y +CONFIG_GENERIC_NET_UTILS=y +# CONFIG_CORDIC is not set +# CONFIG_PRIME_NUMBERS is not set +CONFIG_RATIONAL=y +CONFIG_GENERIC_PCI_IOMAP=y +CONFIG_GENERIC_IOMAP=y +CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y +CONFIG_ARCH_HAS_FAST_MULTIPLIER=y +CONFIG_ARCH_USE_SYM_ANNOTATIONS=y + +# +# Crypto library routines +# +CONFIG_CRYPTO_LIB_UTILS=y +CONFIG_CRYPTO_LIB_AES=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_BLAKE2S=y +CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y +CONFIG_CRYPTO_LIB_CHACHA_GENERIC=y +CONFIG_CRYPTO_LIB_CHACHA=y +CONFIG_CRYPTO_ARCH_HAVE_LIB_CURVE25519=y +CONFIG_CRYPTO_LIB_CURVE25519_GENERIC=y +CONFIG_CRYPTO_LIB_CURVE25519=y +CONFIG_CRYPTO_LIB_DES=y +CONFIG_CRYPTO_LIB_POLY1305_RSIZE=11 +CONFIG_CRYPTO_ARCH_HAVE_LIB_POLY1305=y +CONFIG_CRYPTO_LIB_POLY1305_GENERIC=y +CONFIG_CRYPTO_LIB_POLY1305=y +CONFIG_CRYPTO_LIB_CHACHA20POLY1305=y +CONFIG_CRYPTO_LIB_SHA1=y +CONFIG_CRYPTO_LIB_SHA256=y +# end of Crypto library routines + +CONFIG_CRC_CCITT=y +CONFIG_CRC16=y +CONFIG_CRC_T10DIF=y +# CONFIG_CRC64_ROCKSOFT is not set +CONFIG_CRC_ITU_T=y +CONFIG_CRC32=y +# CONFIG_CRC32_SELFTEST is not set +CONFIG_CRC32_SLICEBY8=y +# CONFIG_CRC32_SLICEBY4 is not set +# CONFIG_CRC32_SARWATE is not set +# CONFIG_CRC32_BIT is not set +# CONFIG_CRC64 is not set +# CONFIG_CRC4 is not set +# CONFIG_CRC7 is not set +CONFIG_LIBCRC32C=y +# CONFIG_CRC8 is not set +CONFIG_XXHASH=y +# CONFIG_RANDOM32_SELFTEST is not set +CONFIG_ZLIB_INFLATE=y +CONFIG_ZLIB_DEFLATE=y +CONFIG_LZO_COMPRESS=y +CONFIG_LZO_DECOMPRESS=y +CONFIG_LZ4_DECOMPRESS=y +CONFIG_ZSTD_COMMON=y +CONFIG_ZSTD_DECOMPRESS=y +CONFIG_XZ_DEC=y +CONFIG_XZ_DEC_X86=y +CONFIG_XZ_DEC_POWERPC=y +CONFIG_XZ_DEC_IA64=y +CONFIG_XZ_DEC_ARM=y +CONFIG_XZ_DEC_ARMTHUMB=y +CONFIG_XZ_DEC_SPARC=y +# CONFIG_XZ_DEC_MICROLZMA is not set +CONFIG_XZ_DEC_BCJ=y +# CONFIG_XZ_DEC_TEST is not set +CONFIG_DECOMPRESS_GZIP=y +CONFIG_DECOMPRESS_BZIP2=y +CONFIG_DECOMPRESS_LZMA=y +CONFIG_DECOMPRESS_XZ=y +CONFIG_DECOMPRESS_LZO=y +CONFIG_DECOMPRESS_LZ4=y +CONFIG_DECOMPRESS_ZSTD=y +CONFIG_TEXTSEARCH=y +CONFIG_TEXTSEARCH_KMP=y +CONFIG_TEXTSEARCH_BM=y +CONFIG_TEXTSEARCH_FSM=y +CONFIG_INTERVAL_TREE=y +CONFIG_XARRAY_MULTI=y +CONFIG_ASSOCIATIVE_ARRAY=y +CONFIG_HAS_IOMEM=y +CONFIG_HAS_IOPORT_MAP=y +CONFIG_HAS_DMA=y +CONFIG_DMA_OPS=y +CONFIG_NEED_SG_DMA_LENGTH=y +CONFIG_NEED_DMA_MAP_STATE=y +CONFIG_ARCH_DMA_ADDR_T_64BIT=y +CONFIG_SWIOTLB=y +# CONFIG_DMA_API_DEBUG is not set +# CONFIG_DMA_MAP_BENCHMARK is not set +CONFIG_SGL_ALLOC=y +# CONFIG_FORCE_NR_CPUS is not set +CONFIG_CPU_RMAP=y +CONFIG_DQL=y +CONFIG_NLATTR=y +CONFIG_IRQ_POLL=y +CONFIG_OID_REGISTRY=y +CONFIG_UCS2_STRING=y +CONFIG_HAVE_GENERIC_VDSO=y +CONFIG_GENERIC_GETTIMEOFDAY=y +CONFIG_GENERIC_VDSO_TIME_NS=y +CONFIG_FONT_SUPPORT=y +# CONFIG_FONTS is not set +CONFIG_FONT_8x8=y +CONFIG_FONT_8x16=y +CONFIG_SG_POOL=y +CONFIG_ARCH_HAS_PMEM_API=y +CONFIG_MEMREGION=y +CONFIG_ARCH_HAS_UACCESS_FLUSHCACHE=y +CONFIG_ARCH_HAS_COPY_MC=y +CONFIG_ARCH_STACKWALK=y +CONFIG_STACKDEPOT=y +CONFIG_SBITMAP=y +# end of Library routines + +# +# Kernel hacking +# + +# +# printk and dmesg options +# +CONFIG_PRINTK_TIME=y +# CONFIG_PRINTK_CALLER is not set +# CONFIG_STACKTRACE_BUILD_ID is not set +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 +CONFIG_CONSOLE_LOGLEVEL_QUIET=4 +CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 +# CONFIG_BOOT_PRINTK_DELAY is not set +CONFIG_DYNAMIC_DEBUG=y +CONFIG_DYNAMIC_DEBUG_CORE=y +CONFIG_SYMBOLIC_ERRNAME=y +# CONFIG_DEBUG_BUGVERBOSE is not set +# end of printk and dmesg options + +CONFIG_DEBUG_KERNEL=y +CONFIG_DEBUG_MISC=y + +# +# Compile-time checks and compiler options +# +CONFIG_AS_HAS_NON_CONST_LEB128=y +CONFIG_DEBUG_INFO_NONE=y +# CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT is not set +# CONFIG_DEBUG_INFO_DWARF4 is not set +# CONFIG_DEBUG_INFO_DWARF5 is not set +CONFIG_FRAME_WARN=2048 +CONFIG_STRIP_ASM_SYMS=y +# CONFIG_READABLE_ASM is not set +# CONFIG_HEADERS_INSTALL is not set +CONFIG_DEBUG_SECTION_MISMATCH=y +CONFIG_SECTION_MISMATCH_WARN_ONLY=y +# CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B is not set +CONFIG_FRAME_POINTER=y +CONFIG_OBJTOOL=y +CONFIG_STACK_VALIDATION=y +CONFIG_VMLINUX_MAP=y +# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set +# end of Compile-time checks and compiler options + +# +# Generic Kernel Debugging Instruments +# +CONFIG_MAGIC_SYSRQ=y +CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 +CONFIG_MAGIC_SYSRQ_SERIAL=y +CONFIG_MAGIC_SYSRQ_SERIAL_SEQUENCE="" +CONFIG_DEBUG_FS=y +CONFIG_DEBUG_FS_ALLOW_ALL=y +# CONFIG_DEBUG_FS_DISALLOW_MOUNT is not set +# CONFIG_DEBUG_FS_ALLOW_NONE is not set +CONFIG_HAVE_ARCH_KGDB=y +# CONFIG_KGDB is not set +CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +# CONFIG_UBSAN is not set +CONFIG_HAVE_ARCH_KCSAN=y +# end of Generic Kernel Debugging Instruments + +# +# Networking Debugging +# +# CONFIG_NET_DEV_REFCNT_TRACKER is not set +# CONFIG_NET_NS_REFCNT_TRACKER is not set +# CONFIG_DEBUG_NET is not set +# end of Networking Debugging + +# +# Memory Debugging +# +# CONFIG_PAGE_EXTENSION is not set +# CONFIG_DEBUG_PAGEALLOC is not set +CONFIG_SLUB_DEBUG=y +# CONFIG_SLUB_DEBUG_ON is not set +# CONFIG_PAGE_OWNER is not set +# CONFIG_PAGE_TABLE_CHECK is not set +# CONFIG_PAGE_POISONING is not set +# CONFIG_DEBUG_RODATA_TEST is not set +CONFIG_ARCH_HAS_DEBUG_WX=y +# CONFIG_DEBUG_WX is not set +CONFIG_GENERIC_PTDUMP=y +# CONFIG_PTDUMP_DEBUGFS is not set +# CONFIG_DEBUG_OBJECTS is not set +# CONFIG_SHRINKER_DEBUG is not set +CONFIG_HAVE_DEBUG_KMEMLEAK=y +# CONFIG_DEBUG_KMEMLEAK is not set +# CONFIG_DEBUG_STACK_USAGE is not set +# CONFIG_SCHED_STACK_END_CHECK is not set +CONFIG_ARCH_HAS_DEBUG_VM_PGTABLE=y +# CONFIG_DEBUG_VM is not set +# CONFIG_DEBUG_VM_PGTABLE is not set +CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y +# CONFIG_DEBUG_VIRTUAL is not set +CONFIG_DEBUG_MEMORY_INIT=y +# CONFIG_DEBUG_PER_CPU_MAPS is not set +CONFIG_ARCH_SUPPORTS_KMAP_LOCAL_FORCE_MAP=y +# CONFIG_DEBUG_KMAP_LOCAL_FORCE_MAP is not set +CONFIG_HAVE_ARCH_KASAN=y +CONFIG_HAVE_ARCH_KASAN_VMALLOC=y +CONFIG_CC_HAS_KASAN_GENERIC=y +CONFIG_CC_HAS_WORKING_NOSANITIZE_ADDRESS=y +# CONFIG_KASAN is not set +CONFIG_HAVE_ARCH_KFENCE=y +# CONFIG_KFENCE is not set +CONFIG_HAVE_ARCH_KMSAN=y +# end of Memory Debugging + +# CONFIG_DEBUG_SHIRQ is not set + +# +# Debug Oops, Lockups and Hangs +# +# CONFIG_PANIC_ON_OOPS is not set +CONFIG_PANIC_ON_OOPS_VALUE=0 +CONFIG_PANIC_TIMEOUT=0 +# CONFIG_SOFTLOCKUP_DETECTOR is not set +CONFIG_HARDLOCKUP_CHECK_TIMESTAMP=y +# CONFIG_HARDLOCKUP_DETECTOR is not set +# CONFIG_DETECT_HUNG_TASK is not set +# CONFIG_WQ_WATCHDOG is not set +# end of Debug Oops, Lockups and Hangs + +# +# Scheduler Debugging +# +# CONFIG_SCHED_DEBUG is not set +CONFIG_SCHED_INFO=y +# CONFIG_SCHEDSTATS is not set +# end of Scheduler Debugging + +# CONFIG_DEBUG_TIMEKEEPING is not set +# CONFIG_DEBUG_PREEMPT is not set + +# +# Lock Debugging (spinlocks, mutexes, etc...) +# +CONFIG_LOCK_DEBUGGING_SUPPORT=y +# CONFIG_PROVE_LOCKING is not set +# CONFIG_LOCK_STAT is not set +# CONFIG_DEBUG_RT_MUTEXES is not set +# CONFIG_DEBUG_SPINLOCK is not set +# CONFIG_DEBUG_MUTEXES is not set +# CONFIG_DEBUG_WW_MUTEX_SLOWPATH is not set +# CONFIG_DEBUG_RWSEMS is not set +# CONFIG_DEBUG_LOCK_ALLOC is not set +# CONFIG_DEBUG_ATOMIC_SLEEP is not set +# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set +# CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set +# CONFIG_SCF_TORTURE_TEST is not set +# CONFIG_CSD_LOCK_WAIT_DEBUG is not set +# end of Lock Debugging (spinlocks, mutexes, etc...) + +# CONFIG_DEBUG_IRQFLAGS is not set +CONFIG_STACKTRACE=y +# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set +# CONFIG_DEBUG_KOBJECT is not set + +# +# Debug kernel data structures +# +CONFIG_DEBUG_LIST=y +# CONFIG_DEBUG_PLIST is not set +# CONFIG_DEBUG_SG is not set +# CONFIG_DEBUG_NOTIFIERS is not set +CONFIG_BUG_ON_DATA_CORRUPTION=y +# CONFIG_DEBUG_MAPLE_TREE is not set +# end of Debug kernel data structures + +# CONFIG_DEBUG_CREDENTIALS is not set + +# +# RCU Debugging +# +# CONFIG_RCU_SCALE_TEST is not set +# CONFIG_RCU_TORTURE_TEST is not set +# CONFIG_RCU_REF_SCALE_TEST is not set +CONFIG_RCU_CPU_STALL_TIMEOUT=59 +CONFIG_RCU_EXP_CPU_STALL_TIMEOUT=0 +# CONFIG_RCU_TRACE is not set +# CONFIG_RCU_EQS_DEBUG is not set +# end of RCU Debugging + +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set +# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set +# CONFIG_LATENCYTOP is not set +CONFIG_USER_STACKTRACE_SUPPORT=y +CONFIG_HAVE_RETHOOK=y +CONFIG_HAVE_FUNCTION_TRACER=y +CONFIG_HAVE_DYNAMIC_FTRACE=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_REGS=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS=y +CONFIG_HAVE_DYNAMIC_FTRACE_WITH_ARGS=y +CONFIG_HAVE_DYNAMIC_FTRACE_NO_PATCHABLE=y +CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y +CONFIG_HAVE_SYSCALL_TRACEPOINTS=y +CONFIG_HAVE_FENTRY=y +CONFIG_HAVE_OBJTOOL_MCOUNT=y +CONFIG_HAVE_C_RECORDMCOUNT=y +CONFIG_HAVE_BUILDTIME_MCOUNT_SORT=y +CONFIG_TRACING_SUPPORT=y +# CONFIG_FTRACE is not set +# CONFIG_PROVIDE_OHCI1394_DMA_INIT is not set +# CONFIG_SAMPLES is not set +CONFIG_HAVE_SAMPLE_FTRACE_DIRECT=y +CONFIG_HAVE_SAMPLE_FTRACE_DIRECT_MULTI=y +CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y +CONFIG_STRICT_DEVMEM=y +# CONFIG_IO_STRICT_DEVMEM is not set + +# +# x86 Debugging +# +CONFIG_X86_VERBOSE_BOOTUP=y +CONFIG_EARLY_PRINTK=y +# CONFIG_EARLY_PRINTK_DBGP is not set +# CONFIG_EARLY_PRINTK_USB_XDBC is not set +# CONFIG_EFI_PGT_DUMP is not set +# CONFIG_DEBUG_TLBFLUSH is not set +CONFIG_HAVE_MMIOTRACE_SUPPORT=y +# CONFIG_X86_DECODER_SELFTEST is not set +CONFIG_IO_DELAY_0X80=y +# CONFIG_IO_DELAY_0XED is not set +# CONFIG_IO_DELAY_UDELAY is not set +# CONFIG_IO_DELAY_NONE is not set +# CONFIG_DEBUG_BOOT_PARAMS is not set +# CONFIG_CPA_DEBUG is not set +# CONFIG_DEBUG_ENTRY is not set +# CONFIG_DEBUG_NMI_SELFTEST is not set +# CONFIG_X86_DEBUG_FPU is not set +# CONFIG_PUNIT_ATOM_DEBUG is not set +# CONFIG_UNWINDER_ORC is not set +CONFIG_UNWINDER_FRAME_POINTER=y +# end of x86 Debugging + +# +# Kernel Testing and Coverage +# +# CONFIG_KUNIT is not set +# CONFIG_NOTIFIER_ERROR_INJECTION is not set +# CONFIG_FAULT_INJECTION is not set +CONFIG_ARCH_HAS_KCOV=y +CONFIG_CC_HAS_SANCOV_TRACE_PC=y +# CONFIG_KCOV is not set +CONFIG_RUNTIME_TESTING_MENU=y +# CONFIG_LKDTM is not set +# CONFIG_TEST_MIN_HEAP is not set +# CONFIG_TEST_DIV64 is not set +# CONFIG_BACKTRACE_SELF_TEST is not set +# CONFIG_TEST_REF_TRACKER is not set +# CONFIG_RBTREE_TEST is not set +# CONFIG_REED_SOLOMON_TEST is not set +# CONFIG_INTERVAL_TREE_TEST is not set +# CONFIG_ATOMIC64_SELFTEST is not set +# CONFIG_TEST_HEXDUMP is not set +# CONFIG_STRING_SELFTEST is not set +# CONFIG_TEST_STRING_HELPERS is not set +# CONFIG_TEST_STRSCPY is not set +# CONFIG_TEST_KSTRTOX is not set +# CONFIG_TEST_PRINTF is not set +# CONFIG_TEST_SCANF is not set +# CONFIG_TEST_BITMAP is not set +# CONFIG_TEST_UUID is not set +# CONFIG_TEST_XARRAY is not set +# CONFIG_TEST_MAPLE_TREE is not set +# CONFIG_TEST_RHASHTABLE is not set +# CONFIG_TEST_SIPHASH is not set +# CONFIG_TEST_IDA is not set +# CONFIG_FIND_BIT_BENCHMARK is not set +# CONFIG_TEST_FIRMWARE is not set +# CONFIG_TEST_SYSCTL is not set +# CONFIG_TEST_UDELAY is not set +# CONFIG_TEST_DYNAMIC_DEBUG is not set +# CONFIG_TEST_MEMCAT_P is not set +# CONFIG_TEST_MEMINIT is not set +# CONFIG_TEST_FREE_PAGES is not set +# CONFIG_TEST_FPU is not set +# CONFIG_TEST_CLOCKSOURCE_WATCHDOG is not set +CONFIG_ARCH_USE_MEMTEST=y +# CONFIG_MEMTEST is not set +# end of Kernel Testing and Coverage + +# +# Rust hacking +# +# end of Rust hacking +# end of Kernel hacking diff --git a/kernel/image/Dockerfile b/kernel/image/Dockerfile new file mode 100644 index 0000000..99a9857 --- /dev/null +++ b/kernel/image/Dockerfile @@ -0,0 +1,30 @@ +FROM ubuntu:focal + +RUN apt-get update && apt-get install -y \ + autoconf \ + bc \ + binutils-multiarch \ + binutils-aarch64-linux-gnu \ + binutils-x86-64-linux-gnu \ + bison \ + flex \ + gcc \ + xz-utils \ + gcc-aarch64-linux-gnu \ + gcc-x86-64-linux-gnu \ + git \ + libncurses-dev \ + make \ + openssl \ + python-is-python3 \ +&& apt-get clean \ +&& rm -rf /var/lib/apt/lists/* + +COPY sources.list /etc/apt/sources.list + +RUN apt-get update \ +&& dpkg --add-architecture arm64 \ +&& dpkg --add-architecture amd64 \ +&& apt-get install -y libelf-dev:arm64 libelf-dev:amd64 \ +&& apt-get clean \ +&& rm -rf /var/lib/apt/lists/* \ No newline at end of file diff --git a/kernel/image/sources.list b/kernel/image/sources.list new file mode 100644 index 0000000..57bc29b --- /dev/null +++ b/kernel/image/sources.list @@ -0,0 +1,15 @@ +deb [arch=arm64] http://ports.ubuntu.com/ focal main restricted +deb [arch=arm64] http://ports.ubuntu.com/ focal-updates main restricted +deb [arch=arm64] http://ports.ubuntu.com/ focal universe +deb [arch=arm64] http://ports.ubuntu.com/ focal-updates universe +deb [arch=arm64] http://ports.ubuntu.com/ focal multiverse +deb [arch=arm64] http://ports.ubuntu.com/ focal-updates multiverse +deb [arch=arm64] http://ports.ubuntu.com/ focal-backports main restricted universe multiverse + +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal main +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates main restricted +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal universe +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates universe +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal multiverse +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-updates multiverse +deb [arch=amd64] http://archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse \ No newline at end of file diff --git a/licenserc.toml b/licenserc.toml new file mode 100644 index 0000000..43b81fc --- /dev/null +++ b/licenserc.toml @@ -0,0 +1,27 @@ +additionalHeaders = ["scripts/cz-header-style.toml"] + +headerPath = "scripts/license-header.txt" + +includes = [ + "Makefile", + "*.Makefile", + "*.swift", + "*.h", + "*.cpp", + "*.c", + "*.sh", +] + +excludes = [ + "Sources/ContainerizationArchive/CArchive/include", +] + +[git] +attrs = 'enable' +ignore = 'enable' + +[properties] +copyrightOwner = "Apple Inc. and the Containerization project authors" + +[mapping.SWIFT_STYLE] +extensions = ["swift"] diff --git a/scripts/build-dist-x86_64.sh b/scripts/build-dist-x86_64.sh new file mode 100755 index 0000000..f0e0cf9 --- /dev/null +++ b/scripts/build-dist-x86_64.sh @@ -0,0 +1,243 @@ +#!/bin/bash +# Copyright © 2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Builds the x86_64 deployment tarball. +# +# Runs INSIDE the aarch64 Linux dev container (invoked by +# `make dist-x86_64` via the linux_run macro). Cross-compiles all four +# host-side binaries — cctl, vminitd, cloud-hypervisor, virtiofsd — +# to x86_64-linux-musl, packs an initfs.ext4 with the x86_64 guest +# binaries inside, and emits bin/containerization-x86_64-.tar.gz. +# +# See docs/x86_64-build.md for full documentation: prerequisites, +# pipeline stages, toolchain rationale, and troubleshooting. +# +# Force-rebuild env vars (default = skip stages whose outputs are +# up-to-date): +# REBUILD_VMINITD=1 vminitd + vmexec +# REBUILD_INITFS=1 initfs.ext4 (and the native aarch64 cctl packer) +# REBUILD_CH=1 cloud-hypervisor +# REBUILD_VIRTIOFSD=1 virtiofsd +# cctl x86 cross always rebuilds (Swift incremental handles no-ops). + +set -euo pipefail + +cd /workspace + +GIT_SHA=$(git rev-parse --short HEAD 2>/dev/null || echo unknown) +DIST_NAME="containerization-x86_64-${GIT_SHA}" +DIST_DIR="bin/dist-x86_64" +STAGE="${DIST_DIR}/${DIST_NAME}" +TGZ="bin/${DIST_NAME}.tar.gz" + +CROSS_PREFIX=/opt/cross-x86_64-musl +GNU_PREFIX=/opt/cross-x86_64-gnu +PATCH=/workspace/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch + +# Cargo cross env for the musl stages (cctl, vminitd, cloud-hypervisor). +# CC/CXX/AR are used by cc-rs (Rust build scripts that compile C, e.g. +# zstd-sys, libseccomp-sys, capng) — points them at the Zig-backed +# wrappers. Linker is intentionally NOT set here: cargo-zigbuild +# installs its own linker wrapper that strips Rust's self-contained +# musl crt files (which would otherwise collide with Zig's musl crt). +# Setting CARGO_TARGET_*_LINKER ourselves would override that and +# cause duplicate-symbol link errors. +# pkg-config (used by libseccomp-sys and libcap-ng's capng-sys) points +# at the static-musl prefix, not the aarch64 host. +# PKG_CONFIG_ALL_STATIC=1 makes pkg-config-rs emit +# `rustc-link-lib=static=...` for resolved libs — required because +# the C libs at $CROSS_PREFIX are static-only (.a, no .so), so the +# default dynamic link would fail to find the .so. +# +# virtiofsd has its own glibc-dynamic env block below; it overrides +# PKG_CONFIG_LIBDIR / SYSROOT_DIR in a subshell so the musl values +# stay correct for cloud-hypervisor. +. /root/.cargo/env +export CC_x86_64_unknown_linux_musl=x86_64-linux-musl-gcc +export CXX_x86_64_unknown_linux_musl=x86_64-linux-musl-g++ +export AR_x86_64_unknown_linux_musl=x86_64-linux-musl-ar +export PKG_CONFIG_LIBDIR="${CROSS_PREFIX}/lib/pkgconfig" +export PKG_CONFIG_SYSROOT_DIR="${CROSS_PREFIX}" +export PKG_CONFIG_ALLOW_CROSS=1 +# Add the static-musl cross prefix to rustc's native library search +# path so the linker finds the libseccomp.so / libcap-ng.so linker +# scripts that build-musl-x86_64-deps.sh installs alongside the .a +# files. The scripts redirect resolution to the static archives. +export CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS="-L native=${CROSS_PREFIX}/lib" + +# Pre-flight checks +[ -f .local/cloud-hypervisor/Cargo.toml ] || { + echo "ERROR: missing .local/cloud-hypervisor source checkout." >&2 + echo " git clone -b v52.0 https://github.com/cloud-hypervisor/cloud-hypervisor .local/cloud-hypervisor" >&2 + exit 1 +} +[ -f .local/virtiofsd/Cargo.toml ] || { + echo "ERROR: missing .local/virtiofsd source checkout." >&2 + echo " git clone https://gitlab.com/virtio-fs/virtiofsd .local/virtiofsd" >&2 + exit 1 +} + +# Kernel candidates (prefer the compressed bzImage produced by +# `make -C kernel TARGET_ARCH=x86_64`, fall back to an uncompressed +# vmlinux). The kernel is required — a tarball without one isn't +# usable, so fail hard rather than silently producing one. +KERNEL_SRC= +for candidate in kernel/vmlinuz-x86_64 kernel/vmlinux-x86_64; do + if [ -f "$candidate" ]; then + if file "$candidate" | grep -qE 'x86 boot|x86-64'; then + KERNEL_SRC=$candidate + break + else + echo "ERROR: $candidate exists but is not x86_64." >&2 + file "$candidate" >&2 + exit 1 + fi + fi +done +if [ -z "${KERNEL_SRC}" ]; then + echo "ERROR: no x86_64 kernel found at kernel/vmlinuz-x86_64 or kernel/vmlinux-x86_64." >&2 + echo " build one with 'make -C kernel TARGET_ARCH=x86_64'." >&2 + exit 1 +fi + +mkdir -p "${DIST_DIR}" + +# Decide which steps need to run before doing any work, so log messages +# match what's actually happening. + +NEED_VMINITD=1 +if [ "${REBUILD_VMINITD:-0}" != "1" ] \ + && [ -x "${DIST_DIR}/vminitd" ] && [ -x "${DIST_DIR}/vmexec" ] \ + && [ -z "$(find vminitd/Sources vminitd/Package.swift Sources/Containerization/SandboxContext \ + -newer "${DIST_DIR}/vminitd" -print -quit 2>/dev/null)" ] \ + && [ -z "$(find vminitd/Sources vminitd/Package.swift Sources/Containerization/SandboxContext \ + -newer "${DIST_DIR}/vmexec" -print -quit 2>/dev/null)" ]; then + NEED_VMINITD=0 +fi + +NEED_INITFS=1 +if [ "${REBUILD_INITFS:-0}" != "1" ] \ + && [ "${NEED_VMINITD}" = "0" ] \ + && [ -f "${DIST_DIR}/initfs.ext4" ] \ + && [ "${DIST_DIR}/initfs.ext4" -nt "${DIST_DIR}/vminitd" ] \ + && [ "${DIST_DIR}/initfs.ext4" -nt "${DIST_DIR}/vmexec" ]; then + NEED_INITFS=0 +fi + +NEED_CH=1 +if [ "${REBUILD_CH:-0}" != "1" ] && [ -x "${DIST_DIR}/cloud-hypervisor" ]; then + NEED_CH=0 +fi + +NEED_VIRTIOFSD=1 +if [ "${REBUILD_VIRTIOFSD:-0}" != "1" ] && [ -x "${DIST_DIR}/virtiofsd" ]; then + NEED_VIRTIOFSD=0 +fi + +echo "==> Cross-compiling cctl to x86_64-linux-musl" +swift build -c release \ + --swift-sdk x86_64-swift-linux-musl \ + --product cctl \ + -Xswiftc -warnings-as-errors \ + -Xlinker -L"${CROSS_PREFIX}/lib" \ + --disable-automatic-resolution +CCTL_X86_64_BIN="$(swift build -c release --swift-sdk x86_64-swift-linux-musl --show-bin-path)/cctl" +install -m 755 "${CCTL_X86_64_BIN}" "${DIST_DIR}/cctl" + +if [ "${NEED_VMINITD}" = "1" ]; then + echo "==> Cross-compiling vminitd + vmexec to x86_64-linux-musl" + make -C vminitd \ + LIBC=musl \ + MUSL_ARCH=x86_64 \ + BUILD_CONFIGURATION=release \ + INSTALL_DIR="$(pwd)/${DIST_DIR}" +else + echo "==> Reusing staged vminitd + vmexec (sources unchanged; set REBUILD_VMINITD=1 to force)" +fi + +if [ "${NEED_CH}" = "1" ]; then + echo "==> Cross-compiling cloud-hypervisor to x86_64-unknown-linux-musl" + ( + cd .local/cloud-hypervisor + cargo zigbuild --release --target x86_64-unknown-linux-musl --bin cloud-hypervisor + ) + install -m 755 \ + ".local/cloud-hypervisor/target/x86_64-unknown-linux-musl/release/cloud-hypervisor" \ + "${DIST_DIR}/cloud-hypervisor" +else + echo "==> Reusing staged cloud-hypervisor (set REBUILD_CH=1 to force)" +fi + +if [ "${NEED_VIRTIOFSD}" = "1" ]; then + echo "==> Cross-compiling virtiofsd to x86_64-unknown-linux-gnu.2.35 (glibc-dynamic, with cap-drop patch)" + # virtiofsd ships glibc-dynamic: the deployment host provides + # libseccomp.so.2 and libcap-ng.so.0 at runtime. Subshell scopes + # the gnu env so it doesn't bleed into other stages. + ( + export CC_x86_64_unknown_linux_gnu=x86_64-linux-gnu-gcc + export CXX_x86_64_unknown_linux_gnu=x86_64-linux-gnu-g++ + export AR_x86_64_unknown_linux_gnu=x86_64-linux-gnu-ar + export PKG_CONFIG_LIBDIR="${GNU_PREFIX}/lib/pkgconfig" + export PKG_CONFIG_SYSROOT_DIR="${GNU_PREFIX}" + export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-L native=${GNU_PREFIX}/lib" + cd .local/virtiofsd + if git apply --check "${PATCH}" 2>/dev/null; then + git apply "${PATCH}" + echo "applied virtiofsd cap-drop patch" + elif git apply --reverse --check "${PATCH}" 2>/dev/null; then + echo "virtiofsd cap-drop patch already applied" + else + echo "ERROR: virtiofsd cap-drop patch does not apply cleanly" >&2 + exit 1 + fi + cargo zigbuild --release --target x86_64-unknown-linux-gnu.2.35 + ) + install -m 755 \ + ".local/virtiofsd/target/x86_64-unknown-linux-gnu/release/virtiofsd" \ + "${DIST_DIR}/virtiofsd" +else + echo "==> Reusing staged virtiofsd (set REBUILD_VIRTIOFSD=1 to force)" +fi + +if [ "${NEED_INITFS}" = "1" ]; then + echo "==> Building aarch64 cctl natively (used to pack initfs.ext4)" + swift build -c release --product cctl -Xswiftc -warnings-as-errors --disable-automatic-resolution + NATIVE_CCTL="$(swift build -c release --show-bin-path)/cctl" + + echo "==> Building initfs.ext4 with x86_64 guest binaries" + rm -f "${DIST_DIR}/init.rootfs.tar.gz" "${DIST_DIR}/initfs.ext4" + "${NATIVE_CCTL}" rootfs create \ + --vminitd "${DIST_DIR}/vminitd" \ + --vmexec "${DIST_DIR}/vmexec" \ + --ext4 "${DIST_DIR}/initfs.ext4" \ + --label org.opencontainers.image.source=https://github.com/apple/containerization \ + --image vminit-x86_64:latest \ + "${DIST_DIR}/init.rootfs.tar.gz" +else + echo "==> Reusing staged initfs.ext4 (vminitd/vmexec unchanged; set REBUILD_INITFS=1 to force)" +fi + +echo "==> Staging tree at ${STAGE} and packaging" +rm -rf "${STAGE}" +mkdir -p "${STAGE}/bin" +install -m 755 "${DIST_DIR}/cctl" "${STAGE}/bin/cctl" +install -m 755 "${DIST_DIR}/cloud-hypervisor" "${STAGE}/bin/cloud-hypervisor" +install -m 755 "${DIST_DIR}/virtiofsd" "${STAGE}/bin/virtiofsd" +mkdir -p "${STAGE}/kernel" +cp "${KERNEL_SRC}" "${STAGE}/kernel/$(basename "${KERNEL_SRC}")" +cp "${DIST_DIR}/initfs.ext4" "${STAGE}/initfs.ext4" +rm -f "${TGZ}" +tar -czf "${TGZ}" -C "${DIST_DIR}" "${DIST_NAME}" +echo "wrote ${TGZ}" diff --git a/scripts/build-glibc-x86_64-deps.sh b/scripts/build-glibc-x86_64-deps.sh new file mode 100755 index 0000000..751815c --- /dev/null +++ b/scripts/build-glibc-x86_64-deps.sh @@ -0,0 +1,138 @@ +#!/bin/bash +# Copyright © 2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Builds x86_64-linux-gnu shared-library versions of libseccomp and +# libcap-ng (the two C libs virtiofsd links against) and installs them +# at /opt/cross-x86_64-gnu. Sibling of build-musl-x86_64-deps.sh; the +# Dockerfile invokes both at image build time. +# +# Why a separate prefix: virtiofsd ships glibc-dynamic in the x86_64 +# tarball (see docs/x86_64-build.md) so deployment hosts can use their +# system libseccomp.so.2 + libcap-ng.so.0; everything else in the tarball +# stays musl-static. Mixing static-musl .a archives and dynamic-gnu .so +# files at one prefix confuses pkg-config and the linker, so they live +# apart. +# +# The glibc baseline is pinned at 2.35 (Ubuntu 22.04 / Debian 12 / RHEL 9 +# era) via the Zig wrapper scripts at /usr/local/bin/x86_64-linux-gnu-*, +# which dispatch to `zig cc -target x86_64-linux-gnu.2.35`. Bump the +# wrapper triple if the baseline moves. +# +# Only two libraries here, both shared: virtiofsd's other build-script +# deps (zstd, etc.) come from cargo crates that vendor C sources, and +# cctl's libarchive lives on the musl side. + +set -euo pipefail + +HOST=x86_64-linux-gnu +PREFIX=/opt/cross-x86_64-gnu + +mkdir -p "${PREFIX}/lib" "${PREFIX}/include" + +export CC="${HOST}-gcc" +export CXX="${HOST}-g++" +export AR="${HOST}-ar" +export RANLIB="${HOST}-ranlib" +export STRIP="${HOST}-strip" +export PKG_CONFIG_PATH="${PREFIX}/lib/pkgconfig" + +WORK=$(mktemp -d) +trap 'rm -rf "${WORK}"' EXIT +cd "${WORK}" + +JOBS="$(nproc)" + +# fetch_extract URL ARCHIVE +# +# Downloads URL to ARCHIVE then extracts. Relies on HTTPS for transport +# integrity; no SHA pinning. The other build-time deps (apt packages, +# Zig, Rust toolchain) trust the same. +fetch_extract() { + local url=$1 archive=$2 + curl -fsSL -o "${archive}" "${url}" + tar -xf "${archive}" +} + +# Sanity check: cross compiler produces clean output for a trivial +# program. autotools / libtool turn unexpected compiler chatter into +# baffling configure errors; surfacing it here gives a real message. +echo "==> cross compiler sanity check" +"${CC}" --version +cat > "${WORK}/sanity.c" <<'EOF' +void foo(void) {} +EOF +out=$("${CC}" -c "${WORK}/sanity.c" -o "${WORK}/sanity.o" 2>&1) || { + echo "ERROR: cross compiler failed on trivial test.c:" >&2 + echo "${out}" >&2 + exit 1 +} +if [ -n "${out}" ]; then + echo "WARNING: cross compiler emitted output on a clean compile:" >&2 + echo "${out}" >&2 +fi + +# libcap-ng — github auto-archive (release artifacts for older tags +# aren't always uploaded). +LIBCAP_NG_VERSION=0.8.5 +fetch_extract "https://github.com/stevegrubb/libcap-ng/archive/refs/tags/v${LIBCAP_NG_VERSION}.tar.gz" libcap-ng.tar.gz +( + cd "libcap-ng-${LIBCAP_NG_VERSION}" + # GNU automake's strict mode requires these standard files to exist; + # the auto-archive tarball doesn't ship NEWS. Cheaper than + # configure.ac surgery. + touch NEWS README AUTHORS ChangeLog + autoreconf -i + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --disable-static --enable-shared \ + --without-python --without-python3 + make -j"${JOBS}" + make install +) + +# libseccomp — needs gperf at build time (installed via the Dockerfile +# alongside the musl deps). Built shared here. +LIBSECCOMP_VERSION=2.5.5 +fetch_extract "https://github.com/seccomp/libseccomp/releases/download/v${LIBSECCOMP_VERSION}/libseccomp-${LIBSECCOMP_VERSION}.tar.gz" libseccomp.tar.gz +( + cd "libseccomp-${LIBSECCOMP_VERSION}" + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --disable-static --enable-shared \ + --disable-python + make -j"${JOBS}" + make install +) + +# Drop libtool .la files — they encode build-host paths and confuse +# downstream consumers; the .so + pkg-config .pc files are sufficient. +rm -f "${PREFIX}/lib"/*.la + +# Force the unversioned dev symlinks (libseccomp.so, libcap-ng.so). +# libtool conservatively omits these when cross-compiling, but rustc's +# link step looks for them by unversioned name; without them the +# link fails with "unable to find dynamic system library 'seccomp'". +# Idempotent — `ln -sf` overwrites any existing symlink, and the loop +# picks up whatever versioned files libtool actually installed. +for stem in libseccomp libcap-ng; do + versioned=$(ls "${PREFIX}/lib/${stem}.so."* 2>/dev/null | sort -V | head -n1) + if [ -n "${versioned}" ]; then + ln -sf "$(basename "${versioned}")" "${PREFIX}/lib/${stem}.so" + else + echo "ERROR: no ${stem}.so.* found in ${PREFIX}/lib after install" >&2 + ls -la "${PREFIX}/lib" >&2 + exit 1 + fi +done + +echo "glibc-dynamic x86_64 C deps installed under ${PREFIX}" diff --git a/scripts/build-musl-x86_64-deps.sh b/scripts/build-musl-x86_64-deps.sh new file mode 100755 index 0000000..a0a44ab --- /dev/null +++ b/scripts/build-musl-x86_64-deps.sh @@ -0,0 +1,188 @@ +#!/bin/bash +# Copyright © 2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Builds static-musl x86_64 versions of the C libraries that cctl and +# virtiofsd link against, and installs them at /opt/cross-x86_64-musl +# (a standalone prefix — the Zig-based cross compiler has no +# traditional sysroot, so the build-dist-x86_64.sh script and the +# cargo cross flow add explicit -L / -I flags pointing here). +# +# Invoked once at dev-image build time; the resulting layer is cached +# until this script changes. Adding/removing a library here is the only +# reason to invalidate it. + +set -euo pipefail + +HOST=x86_64-linux-musl +PREFIX=/opt/cross-x86_64-musl + +mkdir -p "${PREFIX}/lib" "${PREFIX}/include" + +export CC="${HOST}-gcc" +export CXX="${HOST}-g++" +export AR="${HOST}-ar" +export RANLIB="${HOST}-ranlib" +export STRIP="${HOST}-strip" +export PKG_CONFIG_PATH="${PREFIX}/lib/pkgconfig" + +WORK=$(mktemp -d) +trap 'rm -rf "${WORK}"' EXIT +cd "${WORK}" + +JOBS="$(nproc)" + +# fetch_extract URL ARCHIVE +# +# Downloads URL to ARCHIVE then extracts. Relies on HTTPS for transport +# integrity; no SHA pinning. The other build-time deps (apt packages, +# Zig, Rust toolchain) trust the same. +fetch_extract() { + local url=$1 archive=$2 + curl -fsSL -o "${archive}" "${url}" + tar -xf "${archive}" +} + +# Sanity check: cross compiler is on PATH and produces clean output +# for a trivial program. If it doesn't, zlib's configure script (which +# treats any stderr/stdout from a test compile as evidence of -Werror) +# will fail with a misleading "Compiler error reporting is too harsh" +# error. Surfacing this here gives us a real error message instead. +echo "==> cross compiler sanity check" +"${CC}" --version +cat > "${WORK}/sanity.c" <<'EOF' +void foo(void) {} +EOF +out=$("${CC}" -c "${WORK}/sanity.c" -o "${WORK}/sanity.o" 2>&1) || { + echo "ERROR: cross compiler failed on trivial test.c:" >&2 + echo "${out}" >&2 + exit 1 +} +if [ -n "${out}" ]; then + echo "WARNING: cross compiler emitted output on a clean compile:" >&2 + echo "${out}" >&2 + echo "(this will trip up zlib's configure script — see fix below)" >&2 +fi + +# zlib — provides libz.a. Its configure does not take --host, so the +# CC env var is what selects the cross compiler. +ZLIB_VERSION=1.3.1 +fetch_extract "https://zlib.net/fossils/zlib-${ZLIB_VERSION}.tar.gz" zlib.tar.gz +( + cd "zlib-${ZLIB_VERSION}" + if ! ./configure --static --prefix="${PREFIX}"; then + echo "==================== zlib configure.log ====================" >&2 + [ -f configure.log ] && cat configure.log >&2 + echo "============================================================" >&2 + exit 1 + fi + make -j"${JOBS}" + make install +) + +# xz — provides liblzma.a. +XZ_VERSION=5.6.4 +fetch_extract "https://github.com/tukaani-project/xz/releases/download/v${XZ_VERSION}/xz-${XZ_VERSION}.tar.gz" xz.tar.gz +( + cd "xz-${XZ_VERSION}" + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --enable-static --disable-shared \ + --disable-doc --disable-scripts \ + --disable-xz --disable-xzdec --disable-lzmadec --disable-lzmainfo \ + --disable-lzma-links + make -j"${JOBS}" + make install +) + +# bzip2 — no autotools, drives a plain Makefile. Build only the static +# library; the bzip2 CLI tools are not needed. +BZIP2_VERSION=1.0.8 +fetch_extract "https://sourceware.org/pub/bzip2/bzip2-${BZIP2_VERSION}.tar.gz" bzip2.tar.gz +( + cd "bzip2-${BZIP2_VERSION}" + make CC="${CC}" AR="${AR}" RANLIB="${RANLIB}" libbz2.a -j"${JOBS}" + install -m 644 libbz2.a "${PREFIX}/lib/" + install -m 644 bzlib.h "${PREFIX}/include/" +) + +# libarchive — needs zlib + lzma + bz2 (built above). Disable optional +# deps that pull in extra toolchain weight (xml2, iconv, zstd, lz4, +# openssl, libb2). cctl uses libarchive for tar/ext layouts; the +# disabled formats are not used at runtime. +LIBARCHIVE_VERSION=3.7.7 +fetch_extract "https://github.com/libarchive/libarchive/releases/download/v${LIBARCHIVE_VERSION}/libarchive-${LIBARCHIVE_VERSION}.tar.gz" libarchive.tar.gz +( + cd "libarchive-${LIBARCHIVE_VERSION}" + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --enable-static --disable-shared \ + --disable-bsdtar --disable-bsdcat --disable-bsdcpio --disable-bsdunzip \ + --without-xml2 --without-iconv --without-zstd --without-lz4 \ + --without-openssl --without-libb2 \ + CPPFLAGS="-I${PREFIX}/include" \ + LDFLAGS="-L${PREFIX}/lib" + make -j"${JOBS}" + make install +) + +# libcap-ng — github auto-archive (release artifacts for older tags +# aren't always uploaded; the auto-archive URL is always available +# for any tag, but doesn't ship a pre-generated configure script, so +# we autoreconf it ourselves). +LIBCAP_NG_VERSION=0.8.5 +fetch_extract "https://github.com/stevegrubb/libcap-ng/archive/refs/tags/v${LIBCAP_NG_VERSION}.tar.gz" libcap-ng.tar.gz +( + cd "libcap-ng-${LIBCAP_NG_VERSION}" + # GNU automake's default (strict) mode requires these standard + # files to exist; the auto-archive tarball doesn't ship NEWS. + # Cheaper than configure.ac surgery. + touch NEWS README AUTHORS ChangeLog + autoreconf -i + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --enable-static --disable-shared \ + --without-python --without-python3 + make -j"${JOBS}" + make install +) + +# libseccomp — needs gperf at build time (installed via apt above). +LIBSECCOMP_VERSION=2.5.5 +fetch_extract "https://github.com/seccomp/libseccomp/releases/download/v${LIBSECCOMP_VERSION}/libseccomp-${LIBSECCOMP_VERSION}.tar.gz" libseccomp.tar.gz +( + cd "libseccomp-${LIBSECCOMP_VERSION}" + ./configure --host="${HOST}" --prefix="${PREFIX}" \ + --enable-static --disable-shared \ + --disable-python + make -j"${JOBS}" + make install +) + +# Linker-script `.so` shims for libseccomp + libcap-ng. The Rust +# `-sys` crates emit plain `cargo:rustc-link-lib=seccomp` (no +# static= prefix), and they don't declare `links = "..."` in their +# Cargo.toml, so cargo's build-script override can't match them. +# Instead we hand the linker fake `.so` files that are actually GNU +# ld linker scripts pointing at the static archive — when ld resolves +# `-lseccomp` to libseccomp.so it reads the script and pulls in +# libseccomp.a as if statically linked. Works regardless of -Bstatic +# vs -Bdynamic state and avoids needing to patch the -sys crates. +cat > "${PREFIX}/lib/libseccomp.so" < "${PREFIX}/lib/libcap-ng.so" </dev/null) +if [ -z "$GIT_ROOT" ]; then + echo "Error: Not in a git repository" + exit 1 +fi + +BOOT_LOGS_DIR="$GIT_ROOT/bin/integration-bootlogs" + +if [ ! -d "$BOOT_LOGS_DIR" ]; then + echo "Error: Boot logs directory not found: $BOOT_LOGS_DIR" + exit 1 +fi + +echo "Scanning boot logs in: $BOOT_LOGS_DIR" +echo "========================================" +echo "" + +PANIC_FOUND=0 + +for logfile in "$BOOT_LOGS_DIR"/*; do + if [ -f "$logfile" ]; then + if grep -qi "attempted to kill init\|Kernel panic\|end Kernel panic\|Attempted to kill the idle task\|Oops:" "$logfile"; then + echo "🚨 PANIC DETECTED in: $(basename "$logfile")" + echo "---" + grep -i -B 5 -A 10 "attempted to kill init\|Kernel panic\|end Kernel panic\|Attempted to kill the idle task\|Oops:" "$logfile" | head -30 + echo "" + echo "========================================" + echo "" + PANIC_FOUND=1 + fi + fi +done + +if [ $PANIC_FOUND -eq 0 ]; then + echo "✅ No kernel panics detected in boot logs" +else + echo "❌ Found kernel panics - Virtual machine(s) crashed during integration tests" +fi + +exit $PANIC_FOUND diff --git a/scripts/cz-header-style.toml b/scripts/cz-header-style.toml new file mode 100644 index 0000000..ccbb6a7 --- /dev/null +++ b/scripts/cz-header-style.toml @@ -0,0 +1,11 @@ +[SWIFT_STYLE] +firstLine = '//===----------------------------------------------------------------------===//' +endLine = "//===----------------------------------------------------------------------===//\n" +beforeEachLine = '// ' +afterEachLine = '' +allowBlankLines = false +multipleLines = true +padLines = false +firstLineDetectionPattern = '//\s?===' +lastLineDetectionPattern = '//\s?===' +skipLinePattern = '// swift-tools-version' diff --git a/scripts/ensure-hawkeye-exists.sh b/scripts/ensure-hawkeye-exists.sh new file mode 100755 index 0000000..c493d25 --- /dev/null +++ b/scripts/ensure-hawkeye-exists.sh @@ -0,0 +1,24 @@ +#!/usr/bin/env bash +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +echo "Checking existence of hawkeye..." + +if command -v .local/bin/hawkeye >/dev/null 2>&1; then + echo "hawkeye found!" +else + echo "hawkeye not found in PATH" + echo "please install hawkeye. For convenience, you can run scripts/install-hawkeye.sh" + exit 1 +fi diff --git a/scripts/install-hawkeye.sh b/scripts/install-hawkeye.sh new file mode 100755 index 0000000..9104405 --- /dev/null +++ b/scripts/install-hawkeye.sh @@ -0,0 +1,50 @@ +#!/usr/bin/env bash +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +set -euo pipefail + +if command -v .local/bin/hawkeye >/dev/null 2>&1; then + echo "hawkeye already installed" + exit 0 +fi + +# This installer supports Apple silicon (arm64 macOS) only. +if [ "$(uname -s)" != "Darwin" ] || [ "$(uname -m)" != "arm64" ]; then + echo "error: install-hawkeye.sh supports Apple silicon (arm64 macOS) only" >&2 + exit 1 +fi + +VERSION=v6.5.1 +ARTIFACT="hawkeye-aarch64-apple-darwin.tar.xz" +ARTIFACT_URL="https://github.com/korandoru/hawkeye/releases/download/${VERSION}/${ARTIFACT}" +# Pinned SHA-256 of ${ARTIFACT} for ${VERSION}; update when bumping VERSION. +EXPECTED_SHA256="99777f21e4e56c9946ed93621885532c6a0476377f497565c583f5911f2cbb1f" + +echo "Installing hawkeye ${VERSION}" +workdir="$(mktemp -d)" +trap 'rm -rf "${workdir}"' EXIT +tarball="${workdir}/${ARTIFACT}" + +# Download the tarball, verify it against the pinned checksum (aborts on +# mismatch), then extract just the hawkeye binary into .local/bin. +curl --proto '=https' --tlsv1.2 -LsSf "${ARTIFACT_URL}" -o "${tarball}" +echo "${EXPECTED_SHA256} ${tarball}" | shasum -a 256 -c - + +tar -xf "${tarball}" --strip-components 1 -C "${workdir}" +mkdir -p .local/bin +mv "${workdir}/hawkeye" .local/bin/hawkeye +chmod +x .local/bin/hawkeye + +echo "hawkeye ${VERSION} installed to .local/bin/hawkeye" diff --git a/scripts/license-header.txt b/scripts/license-header.txt new file mode 100644 index 0000000..8bf2151 --- /dev/null +++ b/scripts/license-header.txt @@ -0,0 +1,13 @@ +Copyright ©{{ " " }}{%- set created = attrs.git_file_created_year or attrs.disk_file_created_year -%}{%- set modified = attrs.git_file_modified_year or created -%}{%- if created != modified -%} {{created}}-{{modified}}{%- else -%}{{created}}{%- endif -%}{{ " " }}{{ props["copyrightOwner"] }}. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/scripts/make-docs.sh b/scripts/make-docs.sh new file mode 100755 index 0000000..a4a54be --- /dev/null +++ b/scripts/make-docs.sh @@ -0,0 +1,52 @@ +#! /bin/bash -e +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +opts=() +opts+=("--allow-writing-to-directory" "$1") +opts+=("generate-documentation") +opts+=("--target" "Containerization") +opts+=("--target" "ContainerizationArchive") +opts+=("--target" "ContainerizationError") +opts+=("--target" "ContainerizationEXT4") +opts+=("--target" "ContainerizationExtras") +opts+=("--target" "ContainerizationIO") +opts+=("--target" "ContainerizationNetlink") +opts+=("--target" "ContainerizationOCI") +opts+=("--target" "ContainerizationOS") +opts+=("--output-path" "$1") +opts+=("--disable-indexing") +opts+=("--transform-for-static-hosting") +opts+=("--enable-experimental-combined-documentation") +opts+=("--experimental-documentation-coverage") + +if [ ! -z "$2" ] ; then + opts+=("--hosting-base-path" "$2") +fi + +/usr/bin/swift package ${opts[@]} + +echo '{}' > "$1/theme-settings.json" + +cat > "$1/index.html" <<'EOF' + + + + + + +

If you are not redirected automatically, click here.

+ + +EOF diff --git a/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch b/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch new file mode 100644 index 0000000..8ec079b --- /dev/null +++ b/scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch @@ -0,0 +1,41 @@ +# virtiofsd patch — skip capability drop when --sandbox=none. +# +# virtiofsd 1.13.3 unconditionally calls capng::apply (capset(2)) at +# startup when running as root. Inside apple/container's --virtualization +# dev container the default seccomp profile blocks capset(2), so virtiofsd +# fails with "failed to sync capabilities with the kernel" and +# process::exit(1)s before binding its socket. +# +# We already pass --sandbox=none to virtiofsd from VirtiofsdProcess (same +# rationale as why cloud-hypervisor runs with --seccomp false in the same +# environment). This patch extends the existing upstream gate ("We don't +# modify the capabilities if the user call us without any sandbox") so +# that --sandbox=none also skips cap drop at uid==0, matching the user's +# explicit opt-out from the sandbox. +# +# Applied automatically by `make build-virtiofsd` before `cargo build`. +# Targets virtiofsd 1.13.3 (.local/virtiofsd). + +diff --git a/src/main.rs b/src/main.rs +index 176e178..27dce55 100644 +--- a/src/main.rs ++++ b/src/main.rs +@@ -858,8 +858,17 @@ fn main() { + + // We don't modify the capabilities if the user call us without + // any sandbox (i.e. --sandbox=none) as unprivileged user ++ // ++ // CONTAINERIZATION-PATCH: also skip cap drop with --sandbox=none even ++ // when running as root. Inside apple/container's --virtualization dev ++ // container the seccomp profile blocks capset(2), so capng::apply ++ // fails with "failed to sync capabilities with the kernel" and ++ // virtiofsd process::exit(1)s before binding its socket. The ++ // user explicitly opted out of the sandbox; respect that and don't ++ // touch caps either. Same class of issue as why CH runs with ++ // --seccomp false in the same env. + let uid = unsafe { libc::geteuid() }; +- if uid == 0 { ++ if uid == 0 && !matches!(opt.sandbox, SandboxMode::None) { + drop_capabilities(fs_cfg.inode_file_handles, opt.modcaps); + } + diff --git a/scripts/pre-commit.fmt b/scripts/pre-commit.fmt new file mode 100755 index 0000000..58c9626 --- /dev/null +++ b/scripts/pre-commit.fmt @@ -0,0 +1,16 @@ +#! /bin/bash -e + +setup_error() { + echo failed to run: $1 1>&2 + echo run '"make pre-commit"' and try again 1>&2 + exit 1 +} + +if [ ! -z "${PRECOMMIT_NOFMT}" ] ; then + exit 0 +fi + +echo checking formatting and licenses 1>&2 +project_pathname=$(git rev-parse --show-toplevel) +cd "${project_pathname}" +make check diff --git a/signing/vz.entitlements b/signing/vz.entitlements new file mode 100644 index 0000000..d7d0d6e --- /dev/null +++ b/signing/vz.entitlements @@ -0,0 +1,8 @@ + + + + + com.apple.security.virtualization + + + diff --git a/vminitd/.devcontainer/Dockerfile b/vminitd/.devcontainer/Dockerfile new file mode 100644 index 0000000..228b28c --- /dev/null +++ b/vminitd/.devcontainer/Dockerfile @@ -0,0 +1,10 @@ +ARG SWIFT_VERSION=6.3.0 +FROM swift:${SWIFT_VERSION}-noble + +RUN apt-get update \ +&& apt-get install make \ +&& apt-get clean \ +&& rm -rf /var/lib/apt/lists/* +RUN swift sdk install \ + https://download.swift.org/swift-6.3-branch/static-sdk/swift-6.3-DEVELOPMENT-SNAPSHOT-2026-03-05-a/swift-6.3-DEVELOPMENT-SNAPSHOT-2026-03-05-a_static-linux-0.1.0.artifactbundle.tar.gz \ + --checksum f19419ad6a90d0fe5bbf8a28fbc47217ce212633c28257fc6549162558e6f9b6 diff --git a/vminitd/.devcontainer/devcontainer.json b/vminitd/.devcontainer/devcontainer.json new file mode 100644 index 0000000..f46c613 --- /dev/null +++ b/vminitd/.devcontainer/devcontainer.json @@ -0,0 +1,17 @@ +{ + "build": { + "dockerfile": "Dockerfile" + }, + "features": {}, + "customizations": { + "vscode": { + "extensions": [ + "swiftlang.swift-vscode" + ], + "settings": { + } + } + }, + "runArgs": [], + "mounts": [] +} diff --git a/vminitd/Makefile b/vminitd/Makefile new file mode 100644 index 0000000..1c996d9 --- /dev/null +++ b/vminitd/Makefile @@ -0,0 +1,115 @@ +# Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +BUILD_CONFIGURATION ?= debug +WARNINGS_AS_ERRORS ?= true +export GIT_COMMIT := $(shell git rev-parse HEAD) +export GIT_TAG := $(shell git describe --tags --exact-match 2>/dev/null || echo "") +export BUILD_TIME := $(shell date -u +%Y-%m-%dT%H:%M:%SZ) +SWIFT_WARNING_CONFIG := $(if $(filter-out false,$(WARNINGS_AS_ERRORS)),-Xswiftc -warnings-as-errors) +# MUSL_ARCH selects which Static Linux SDK triple to build against +# ($(MUSL_ARCH)-swift-linux-musl). Defaults to the host architecture +# so the in-tree aarch64 flow works unchanged, but callers can override +# (e.g. `make MUSL_ARCH=x86_64` for the dist-x86_64 cross-build path). +ifndef MUSL_ARCH +UNAME_M := $(shell uname -m) +ifeq ($(UNAME_M),arm64) +MUSL_ARCH := aarch64 +else ifeq ($(UNAME_M),aarch64) +MUSL_ARCH := aarch64 +else +MUSL_ARCH := x86_64 +endif +endif + +LIBC ?= musl +ifeq ($(LIBC),musl) +SWIFT_SDK_FLAGS := --swift-sdk $(MUSL_ARCH)-swift-linux-musl +endif + +SWIFT_CONFIGURATION := $(SWIFT_SDK_FLAGS) $(SWIFT_WARNING_CONFIG) -Xlinker -s --disable-automatic-resolution + +SWIFT_VERSION := 6.3.0 +SWIFT_SDK_URL := https://download.swift.org/swift-6.3-release/static-sdk/swift-6.3-RELEASE/swift-6.3-RELEASE_static-linux-0.1.0.artifactbundle.tar.gz +SWIFT_SDK_CHECKSUM := d2078b69bdeb5c31202c10e9d8a11d6f66f82938b51a4b75f032ccb35c4c286c +SWIFT_SDK_PATH := /tmp/$(notdir $(SWIFT_SDK_URL)) + +SYSTEM_TYPE := $(shell uname -s) +ifeq ($(SYSTEM_TYPE),Darwin) +SWIFTLY_URL := https://download.swift.org/swiftly/darwin/swiftly.pkg +SWIFTLY_FILENAME := $(notdir $(SWIFTLY_URL)) +SWIFTLY_BIN_DIR ?= ~/.swiftly/bin +SWIFT := $(SWIFTLY_BIN_DIR)/swift +else +SWIFT ?= swift +endif +BUILD_BIN_DIR := $(shell $(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) --show-bin-path) + +ifeq ($(SYSTEM_TYPE),Darwin) +MACOS_VERSION := $(shell sw_vers -productVersion) +MACOS_MAJOR := $(shell echo $(MACOS_VERSION) | cut -d. -f1) +MACOS_RELEASE_TYPE := $(shell sw_vers | grep ReleaseType) +endif + +.DEFAULT_GOAL := all + +# INSTALL_DIR is where built binaries land. Defaults to ./bin so the +# in-tree aarch64 flow is unchanged. The dist-x86_64 cross-build +# overrides this to keep its artifacts out of vminitd/bin/. +INSTALL_DIR ?= ./bin + +.PHONY: all +all: + @echo Building vminitd and vmexec... + @mkdir -p $(INSTALL_DIR) + @rm -f $(INSTALL_DIR)/vminitd + @rm -f $(INSTALL_DIR)/vmexec + @$(SWIFT) --version + @$(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_CONFIGURATION) + @install "$(BUILD_BIN_DIR)/vminitd" $(INSTALL_DIR)/ + @install "$(BUILD_BIN_DIR)/vmexec" $(INSTALL_DIR)/ + +.PHONY: cross-prep +cross-prep: swift linux-sdk + +.PHONY: swiftly +swiftly: + @if ! command -v ${SWIFTLY_BIN_DIR}/swiftly > /dev/null 2>&1; then \ + echo "Installing Swiftly..."; \ + curl -o /var/tmp/$(SWIFTLY_FILENAME) $(SWIFTLY_URL) && \ + installer -pkg /var/tmp/$(SWIFTLY_FILENAME) -target CurrentUserHomeDirectory && \ + ${SWIFTLY_BIN_DIR}/swiftly init --quiet-shell-followup --skip-install && \ + . ~/.swiftly/env.sh && \ + hash -r && \ + rm /var/tmp/$(SWIFTLY_FILENAME); \ + fi + +.PHONY: swift +swift: swiftly + @echo Installing Swift $(SWIFT_VERSION)... + @${SWIFTLY_BIN_DIR}/swiftly install $(SWIFT_VERSION) + +.PHONY: linux-sdk +linux-sdk: + @echo Installing Static Linux SDK... + @curl -L -o $(SWIFT_SDK_PATH) $(SWIFT_SDK_URL) + -@$(SWIFT) sdk install $(SWIFT_SDK_PATH) --checksum $(SWIFT_SDK_CHECKSUM) + @rm $(SWIFT_SDK_PATH) + +.PHONY: clean +clean: + @echo Cleaning the vminitd build files... + @rm -f ./bin/vminitd + @rm -f ./bin/vmexec + @rm -rf .build diff --git a/vminitd/Package.resolved b/vminitd/Package.resolved new file mode 100644 index 0000000..24f0ab2 --- /dev/null +++ b/vminitd/Package.resolved @@ -0,0 +1,249 @@ +{ + "originHash" : "264b211a5ea74fa24ced86faade5901700722c925484a26379cc4a6b40083c6c", + "pins" : [ + { + "identity" : "async-http-client", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/async-http-client.git", + "state" : { + "revision" : "4b99975677236d13f0754339864e5360142ff5a1", + "version" : "1.30.3" + } + }, + { + "identity" : "grpc-swift-2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-2.git", + "state" : { + "revision" : "f28854bc760a116e053fdfc4a48a9428c34625c0", + "version" : "2.3.0" + } + }, + { + "identity" : "grpc-swift-nio-transport", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-nio-transport.git", + "state" : { + "revision" : "2ca31f06658ed288a2560e23ad649acbb3d6b3a3", + "version" : "2.9.0" + } + }, + { + "identity" : "grpc-swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/grpc/grpc-swift-protobuf.git", + "state" : { + "revision" : "19153231a03c2fda1f4ea60da1b92a2cb9c011d8", + "version" : "2.2.0" + } + }, + { + "identity" : "swift-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-algorithms.git", + "state" : { + "revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023", + "version" : "1.2.1" + } + }, + { + "identity" : "swift-argument-parser", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-argument-parser.git", + "state" : { + "revision" : "c5d11a805e765f52ba34ec7284bd4fcd6ba68615", + "version" : "1.7.0" + } + }, + { + "identity" : "swift-asn1", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-asn1.git", + "state" : { + "revision" : "a54383ada6cecde007d374f58f864e29370ba5c3", + "version" : "1.3.2" + } + }, + { + "identity" : "swift-async-algorithms", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-async-algorithms.git", + "state" : { + "revision" : "042e1c4d9d19748c9c228f8d4ebc97bb1e339b0b", + "version" : "1.0.4" + } + }, + { + "identity" : "swift-atomics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-atomics.git", + "state" : { + "revision" : "cd142fd2f64be2100422d658e7411e39489da985", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-certificates", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-certificates.git", + "state" : { + "revision" : "f4cd9e78a1ec209b27e426a5f5c693675f95e75a", + "version" : "1.15.0" + } + }, + { + "identity" : "swift-collections", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-collections.git", + "state" : { + "revision" : "c1805596154bb3a265fd91b8ac0c4433b4348fb0", + "version" : "1.2.0" + } + }, + { + "identity" : "swift-crypto", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-crypto.git", + "state" : { + "revision" : "e8d6eba1fef23ae5b359c46b03f7d94be2f41fed", + "version" : "3.12.3" + } + }, + { + "identity" : "swift-distributed-tracing", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-distributed-tracing.git", + "state" : { + "revision" : "dc4030184203ffafbb2ec614352487235d747fe0", + "version" : "1.4.1" + } + }, + { + "identity" : "swift-http-structured-headers", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-structured-headers.git", + "state" : { + "revision" : "db6eea3692638a65e2124990155cd220c2915903", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-http-types", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-http-types.git", + "state" : { + "revision" : "a0a57e949a8903563aba4615869310c0ebf14c03", + "version" : "1.4.0" + } + }, + { + "identity" : "swift-log", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-log.git", + "state" : { + "revision" : "bbd81b6725ae874c69e9b8c8804d462356b55523", + "version" : "1.10.1" + } + }, + { + "identity" : "swift-nio", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio.git", + "state" : { + "revision" : "cd3e1152083706d77b223fb29110e590efcc70c0", + "version" : "2.101.2" + } + }, + { + "identity" : "swift-nio-extras", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-extras.git", + "state" : { + "revision" : "145db1962f4f33a4ea07a32e751d5217602eea29", + "version" : "1.28.0" + } + }, + { + "identity" : "swift-nio-http2", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-http2.git", + "state" : { + "revision" : "61d1b44f6e4e118792be1cff88ee2bc0267c6f9a", + "version" : "1.44.0" + } + }, + { + "identity" : "swift-nio-ssl", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-ssl.git", + "state" : { + "revision" : "173cc69a058623525a58ae6710e2f5727c663793", + "version" : "2.36.0" + } + }, + { + "identity" : "swift-nio-transport-services", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-nio-transport-services.git", + "state" : { + "revision" : "cd1e89816d345d2523b11c55654570acd5cd4c56", + "version" : "1.24.0" + } + }, + { + "identity" : "swift-numerics", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-numerics.git", + "state" : { + "revision" : "e0ec0f5f3af6f3e4d5e7a19d2af26b481acb6ba8", + "version" : "1.0.3" + } + }, + { + "identity" : "swift-protobuf", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-protobuf.git", + "state" : { + "revision" : "86970144a0b86068c81ff48ee29b3f97cae0b879", + "version" : "1.36.0" + } + }, + { + "identity" : "swift-service-context", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-service-context.git", + "state" : { + "revision" : "d0997351b0c7779017f88e7a93bc30a1878d7f29", + "version" : "1.3.0" + } + }, + { + "identity" : "swift-service-lifecycle", + "kind" : "remoteSourceControl", + "location" : "https://github.com/swift-server/swift-service-lifecycle.git", + "state" : { + "revision" : "e7187309187695115033536e8fc9b2eb87fd956d", + "version" : "2.8.0" + } + }, + { + "identity" : "swift-system", + "kind" : "remoteSourceControl", + "location" : "https://github.com/apple/swift-system.git", + "state" : { + "revision" : "7c6ad0fc39d0763e0b699210e4124afd5041c5df", + "version" : "1.6.4" + } + }, + { + "identity" : "zstd", + "kind" : "remoteSourceControl", + "location" : "https://github.com/facebook/zstd.git", + "state" : { + "revision" : "f8745da6ff1ad1e7bab384bd1f9d742439278e99", + "version" : "1.5.7" + } + } + ], + "version" : 3 +} diff --git a/vminitd/Package.swift b/vminitd/Package.swift new file mode 100644 index 0000000..673a48c --- /dev/null +++ b/vminitd/Package.swift @@ -0,0 +1,71 @@ +// swift-tools-version: 6.3 +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +// The swift-tools-version declares the minimum version of Swift required to build this package. + +import Foundation +import PackageDescription + +let gitCommit = ProcessInfo.processInfo.environment["GIT_COMMIT"] ?? "unspecified" +let gitTag = ProcessInfo.processInfo.environment["GIT_TAG"] ?? "" +let buildTime = ProcessInfo.processInfo.environment["BUILD_TIME"] ?? "unspecified" + +let package = Package( + name: "swift-vminitd", + platforms: [.macOS("15")], + products: [ + .executable(name: "vminitd", targets: ["vminitd"]), + .executable(name: "vmexec", targets: ["vmexec"]), + ], + dependencies: [ + .package(url: "https://github.com/apple/swift-argument-parser", from: "1.7.0"), + .package(url: "https://github.com/apple/swift-log.git", from: "1.10.1"), + .package(url: "https://github.com/apple/swift-system.git", from: "1.6.4"), + .package(name: "containerization", path: "../"), + ], + targets: [ + .target( + name: "CVersion", + cSettings: [ + .define("GIT_COMMIT", to: "\"\(gitCommit)\""), + .define("GIT_TAG", to: "\"\(gitTag)\""), + .define("BUILD_TIME", to: "\"\(buildTime)\""), + ] + ), + .executableTarget( + name: "vminitd", + dependencies: [ + .product(name: "ArgumentParser", package: "swift-argument-parser"), + .product(name: "ContainerizationOS", package: "containerization"), + .product(name: "Logging", package: "swift-log"), + .product(name: "VminitdCore", package: "containerization"), + "CVersion", + ] + ), + .executableTarget( + name: "vmexec", + dependencies: [ + .product(name: "Logging", package: "swift-log"), + .product(name: "ArgumentParser", package: "swift-argument-parser"), + .product(name: "SystemPackage", package: "swift-system"), + .product(name: "Containerization", package: "containerization"), + .product(name: "ContainerizationOS", package: "containerization"), + .product(name: "VminitdCore", package: "containerization"), + ] + ), + ] +) diff --git a/vminitd/Sources/CVersion/include/version.h b/vminitd/Sources/CVersion/include/version.h new file mode 100644 index 0000000..ab59dfe --- /dev/null +++ b/vminitd/Sources/CVersion/include/version.h @@ -0,0 +1,24 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifndef CZ_VERSION_H +#define CZ_VERSION_H + +const char* CZ_get_git_commit(void); +const char* CZ_get_git_tag(void); +const char* CZ_get_build_time(void); + +#endif diff --git a/vminitd/Sources/CVersion/version.c b/vminitd/Sources/CVersion/version.c new file mode 100644 index 0000000..d390595 --- /dev/null +++ b/vminitd/Sources/CVersion/version.c @@ -0,0 +1,41 @@ +/* + * Copyright © 2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#include "version.h" + +#ifndef GIT_COMMIT +#define GIT_COMMIT "unspecified" +#endif + +#ifndef GIT_TAG +#define GIT_TAG "" +#endif + +#ifndef BUILD_TIME +#define BUILD_TIME "unspecified" +#endif + +const char* CZ_get_git_commit(void) { + return GIT_COMMIT; +} + +const char* CZ_get_git_tag(void) { + return GIT_TAG; +} + +const char* CZ_get_build_time(void) { + return BUILD_TIME; +} diff --git a/vminitd/Sources/Cgroup/Cgroup2Manager.swift b/vminitd/Sources/Cgroup/Cgroup2Manager.swift new file mode 100644 index 0000000..62fa78c --- /dev/null +++ b/vminitd/Sources/Cgroup/Cgroup2Manager.swift @@ -0,0 +1,770 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +// NOTE: Ideally this should live in ContainerizationOS/Linux, or just ContainerizationCgroups +// or something similar, but it's not there yet. It does what we need, but it'd need a lot more +// features and testing before it's ready to be public. + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +import LCShim +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging + +package enum Cgroup2Controller: String { + case pids + case memory + case cpuset + case cpu + case io + case hugetlb +} + +// Extremely simple cgroup manager. Our needs are simple for now, and this is +// reflected in the type. +public struct Cgroup2Manager: Sendable { + public static let defaultMountPoint = URL(filePath: "/sys/fs/cgroup") + + private static let killFile = "cgroup.kill" + private static let procsFile = "cgroup.procs" + private static let subtreeControlFile = "cgroup.subtree_control" + + private static let cg2Magic = 0x6367_7270 + + private let mountPoint: URL + private let path: URL + private let logger: Logger? + + package init( + mountPoint: URL = Self.defaultMountPoint, + group: URL, + logger: Logger? = nil + ) { + self.mountPoint = mountPoint + self.path = mountPoint.appending(path: group.path) + self.logger = logger + } + + public static func load( + mountPoint: URL = Self.defaultMountPoint, + group: URL, + logger: Logger? = nil + ) throws -> Cgroup2Manager { + let path = mountPoint.appending(path: group.path) + var s = statfs() + let res = statfs(path.path, &s) + if res != 0 { + throw Error.errno(errno: errno, message: "failed to statfs \(path.path)") + } + if Int64(s.f_type) != Self.cg2Magic { + throw Error.notCgroup + } + return Cgroup2Manager( + mountPoint: mountPoint, + group: group, + logger: logger + ) + } + + package static func loadFromPid(pid: Int32, logger: Logger? = nil) throws -> Cgroup2Manager { + let procCgPath = URL(filePath: "/proc/\(pid)/cgroup") + let fh = try FileHandle(forReadingFrom: procCgPath) + guard let data = try fh.readToEnd() else { + throw Error.errno(errno: errno, message: "failed to read \(procCgPath)") + } + + // If this fails we have bigger problems. + let str = String(data: data, encoding: .utf8)! + let parts = str.split(separator: ":") + if parts[0] != "0" { + throw Error.cgroup1 + } + + // We should really read /proc/pid/mountinfo, but for now just assume + // it's always at /sys/fs/cgroup. + let path = parts[1].trimmingCharacters(in: .whitespacesAndNewlines) + return Cgroup2Manager(group: URL(filePath: String(path)), logger: logger) + } + + package func create(perms: Int16 = 0o755) throws { + self.logger?.info( + "creating cgroup manager", + metadata: [ + "mountpoint": "\(self.mountPoint.path)", + "path": "\(self.path.path)", + ]) + + try FileManager.default.createDirectory( + at: self.path, + withIntermediateDirectories: true, + attributes: [.posixPermissions: perms] + ) + } + + private static func writeValue(path: URL, value: String, fileName: String) throws { + let file = path.appending(path: fileName) + let fd = open(file.path, O_WRONLY, 0) + if fd == -1 { + throw Error.errno(errno: errno, message: "failed to open \(file.path)") + } + defer { close(fd) } + + let bytes = Array(value.utf8) + let res = Syscall.retrying { + bytes.withUnsafeBytes { write(fd, $0.baseAddress!, bytes.count) } + } + if res == -1 { + throw Error.errno(errno: errno, message: "failed to write to \(file.path)") + } + } + + package func toggleSubtreeControllers(controllers: [Cgroup2Controller], enable: Bool) throws { + let value = controllers.map { (enable ? "+" : "-") + $0.rawValue }.joined(separator: " ") + let mountComponents = self.mountPoint.pathComponents + let pathComponents = self.path.pathComponents + + // First ensure it's set on the root. + var current = self.mountPoint + try Self.writeValue( + path: current, + value: value, + fileName: Self.subtreeControlFile + ) + + // Toggle everything except the leaf, as otherwise we won't be able to write + // to cgroup.procs, and what fun is that :) + if mountComponents.count < pathComponents.count - 1 { + for i in mountComponents.count...pathComponents.count - 2 { + current = current.appending(path: pathComponents[i]) + try Self.writeValue( + path: current, + value: value, + fileName: Self.subtreeControlFile + ) + } + } + } + + package func toggleAllAvailableControllers(enable: Bool) throws { + // Read available controllers from cgroup.controllers + let controllersFile = self.mountPoint.appending(path: "cgroup.controllers") + let controllersContent = try String(contentsOf: controllersFile, encoding: .utf8) + .trimmingCharacters(in: .whitespacesAndNewlines) + + // Parse controller names and convert to our enum + let availableControllers = + controllersContent + .split(separator: " ") + .compactMap { Cgroup2Controller(rawValue: String($0)) } + + if !availableControllers.isEmpty { + try toggleSubtreeControllers(controllers: availableControllers, enable: enable) + } + } + + public func addProcess(pid: Int32) throws { + self.logger?.debug( + "adding new proc to cgroup", + metadata: [ + "mountpoint": "\(self.mountPoint.path)", + "path": "\(self.path.path)", + ]) + + let pidStr = String(pid) + try Self.writeValue( + path: self.path, + value: pidStr, + fileName: Self.procsFile + ) + } + + public func applyResources(resources: ContainerizationOCI.LinuxResources) throws { + self.logger?.debug( + "applying cgroup resources", + metadata: [ + "path": "\(self.path.path)" + ]) + + if let memory = resources.memory, let limit = memory.limit { + // The OCI spec defines -1 as unlimited; cgroup v2 expects "max". + let value = limit < 0 ? "max" : String(limit) + try Self.writeValue( + path: self.path, + value: value, + fileName: "memory.max" + ) + } + + if let cpu = resources.cpu, let quota = cpu.quota, let period = cpu.period { + // cpu.max format is "quota period" + let value = "\(quota) \(period)" + try Self.writeValue( + path: self.path, + value: value, + fileName: "cpu.max" + ) + } + + if let pids = resources.pids { + // The OCI spec defines -1 as unlimited; cgroup v2 expects "max". + let value = pids.limit < 0 ? "max" : String(pids.limit) + try Self.writeValue( + path: self.path, + value: value, + fileName: "pids.max" + ) + } + } + + package func setMemoryHigh(bytes: UInt64) throws { + self.logger?.debug( + "setting memory.high", + metadata: [ + "path": "\(self.path.path)", + "bytes": "\(bytes)", + ]) + + try Self.writeValue( + path: self.path, + value: String(bytes), + fileName: "memory.high" + ) + } + + package func setMemoryLow(bytes: UInt64) throws { + self.logger?.debug( + "setting memory.low", + metadata: [ + "path": "\(self.path.path)", + "bytes": "\(bytes)", + ] + ) + + try Self.writeValue( + path: self.path, + value: String(bytes), + fileName: "memory.low") + } + + package func getMemoryEvents() throws -> MemoryEvents { + let content = try readFileContent(fileName: "memory.events") + let values = parseKeyValuePairs(content) + + return MemoryEvents( + low: values["low"] ?? 0, + high: values["high"] ?? 0, + max: values["max"] ?? 0, + oom: values["oom"] ?? 0, + oomKill: values["oom_kill"] ?? 0 + ) + } + + package func getMemoryEventsPath() -> String { + self.path.appending(path: "memory.events").path + } + + package func kill() throws { + try Self.writeValue( + path: self.path, + value: "1", + fileName: Self.killFile + ) + } + + package func delete(force: Bool = false) throws { + self.logger?.info( + "deleting cgroup manager", + metadata: [ + "mountpoint": "\(self.mountPoint.path)", + "path": "\(self.path.path)", + ]) + + if force { + try self.kill() + } + + // Recursively remove child cgroups first + try removeChildCgroups(at: self.path, force: force) + + let result = rmdir(self.path.path) + if result != 0 { + throw Error.errno(errno: errno, message: "failed to remove cgroup directory \(self.path.path)") + } + } + + private func removeChildCgroups(at path: URL, force: Bool) throws { + let fileManager = FileManager.default + + guard let contents = try? fileManager.contentsOfDirectory(atPath: path.path) else { + return + } + + // Remove child directories (potential nested cgroups) first + for item in contents { + let childPath = path.appending(path: item) + var isDirectory: ObjCBool = false + + if fileManager.fileExists(atPath: childPath.path, isDirectory: &isDirectory) && isDirectory.boolValue { + if force { + try Self.writeValue( + path: childPath, + value: "1", + fileName: Self.killFile + ) + } + + try removeChildCgroups(at: childPath, force: force) + let result = rmdir(childPath.path) + if result != 0 { + throw Error.errno(errno: errno, message: "failed to remove child cgroup \(childPath.path)") + } + } + } + } + + package func stats(_ categories: Cgroup2StatsCategory = .all) throws -> Cgroup2Stats { + Cgroup2Stats( + pids: categories.contains(.pids) ? try self.readPidsStats() : nil, + memory: categories.contains(.memory) ? try self.readMemoryStats() : nil, + cpu: categories.contains(.cpu) ? try self.readCPUStats() : nil, + io: categories.contains(.io) ? try self.readIOStats() : nil + ) + } + + private func readFileContent(fileName: String) throws -> String? { + let filePath = self.path.appending(path: fileName) + guard FileManager.default.fileExists(atPath: filePath.path) else { + return nil + } + return try String(contentsOf: filePath, encoding: .utf8) + .trimmingCharacters(in: .whitespacesAndNewlines) + } + + private func parseSingleValue(_ content: String?) -> UInt64? { + guard let content = content, !content.isEmpty else { return nil } + if content == "max" { + return UInt64.max + } + return UInt64(content) + } + + private func parseKeyValuePairs(_ content: String?) -> [String: UInt64] { + guard let content = content else { return [:] } + var result: [String: UInt64] = [:] + + for line in content.components(separatedBy: .newlines) { + let parts = line.components(separatedBy: .whitespaces) + if parts.count == 2, let value = UInt64(parts[1]) { + result[parts[0]] = value + } + } + return result + } + + private func readPidsStats() throws -> PidsStats? { + guard let currentContent = try readFileContent(fileName: "pids.current"), + let current = parseSingleValue(currentContent) + else { + return nil + } + + let maxContent = try readFileContent(fileName: "pids.max") + let max = parseSingleValue(maxContent) + + return PidsStats(current: current, max: max) + } + + private func readMemoryStats() throws -> MemoryStats? { + guard let usageContent = try readFileContent(fileName: "memory.current"), + let usage = parseSingleValue(usageContent) + else { + return nil + } + + let usageLimit = parseSingleValue(try readFileContent(fileName: "memory.max")) + let swapUsage = parseSingleValue(try readFileContent(fileName: "memory.swap.current")) + let swapLimit = parseSingleValue(try readFileContent(fileName: "memory.swap.max")) + + let statContent = try readFileContent(fileName: "memory.stat") + let statValues = parseKeyValuePairs(statContent) + + return MemoryStats( + usage: usage, + usageLimit: usageLimit, + swapUsage: swapUsage, + swapLimit: swapLimit, + anon: statValues["anon"] ?? 0, + file: statValues["file"] ?? 0, + kernelStack: statValues["kernel_stack"] ?? 0, + slab: statValues["slab"] ?? 0, + sock: statValues["sock"] ?? 0, + shmem: statValues["shmem"] ?? 0, + fileMapped: statValues["file_mapped"] ?? 0, + fileDirty: statValues["file_dirty"] ?? 0, + fileWriteback: statValues["file_writeback"] ?? 0, + pgfault: statValues["pgfault"] ?? 0, + pgmajfault: statValues["pgmajfault"] ?? 0, + workingsetRefaultAnon: statValues["workingset_refault_anon"] ?? 0, + workingsetRefaultFile: statValues["workingset_refault_file"] ?? 0, + workingsetActivate: statValues["workingset_activate"] ?? 0, + workingsetNodereclaim: statValues["workingset_nodereclaim"] ?? 0, + pgstealKswapd: statValues["pgsteal_kswapd"] ?? 0, + pgstealDirect: statValues["pgsteal_direct"] ?? 0, + pgstealKhugepaged: statValues["pgsteal_khugepaged"] ?? 0, + inactiveAnon: statValues["inactive_anon"] ?? 0, + activeAnon: statValues["active_anon"] ?? 0, + inactiveFile: statValues["inactive_file"] ?? 0, + activeFile: statValues["active_file"] ?? 0 + ) + } + + private func readCPUStats() throws -> CPUStats? { + let statContent = try readFileContent(fileName: "cpu.stat") + let statValues = parseKeyValuePairs(statContent) + + guard !statValues.isEmpty else { + return nil + } + + return CPUStats( + usageUsec: statValues["usage_usec"] ?? 0, + userUsec: statValues["user_usec"] ?? 0, + systemUsec: statValues["system_usec"] ?? 0, + nrPeriods: statValues["nr_periods"] ?? 0, + nrThrottled: statValues["nr_throttled"] ?? 0, + throttledUsec: statValues["throttled_usec"] ?? 0 + ) + } + + private func readIOStats() throws -> IOStats? { + guard let statContent = try readFileContent(fileName: "io.stat") else { + return IOStats(entries: []) + } + + var entries: [IOEntry] = [] + + for line in statContent.components(separatedBy: .newlines) { + guard !line.isEmpty else { continue } + + let parts = line.components(separatedBy: .whitespaces) + guard parts.count >= 2 else { continue } + + let deviceParts = parts[0].components(separatedBy: ":") + guard deviceParts.count == 2, + let major = UInt64(deviceParts[0]), + let minor = UInt64(deviceParts[1]) + else { + continue + } + + var rbytes: UInt64 = 0 + var wbytes: UInt64 = 0 + var rios: UInt64 = 0 + var wios: UInt64 = 0 + var dbytes: UInt64 = 0 + var dios: UInt64 = 0 + + for i in 1.. +#ifdef __linux__ +#include +#endif + +// CLONE_* flags +#ifndef CLONE_NEWNS +#define CLONE_NEWNS 0x00020000 +#endif +#ifndef CLONE_NEWCGROUP +#define CLONE_NEWCGROUP 0x02000000 +#endif +#ifndef CLONE_NEWUTS +#define CLONE_NEWUTS 0x04000000 +#endif +#ifndef CLONE_NEWIPC +#define CLONE_NEWIPC 0x08000000 +#endif +#ifndef CLONE_NEWUSER +#define CLONE_NEWUSER 0x10000000 +#endif +#ifndef CLONE_NEWPID +#define CLONE_NEWPID 0x20000000 +#endif + +extern int setns(int fd, int nstype); +extern int unshare(int flags); +extern int dup3(int oldfd, int newfd, int flags); +extern int execvpe(const char *file, char *const argv[], char *const envp[]); +extern int unlockpt(int fd); +extern char *ptsname(int fd); + +// splice(2) and flags. +extern ssize_t splice(int fd_in, off_t *off_in, int fd_out, off_t *off_out, + size_t len, unsigned int flags); +#ifndef SPLICE_F_MOVE +#define SPLICE_F_MOVE 1 +#endif +#ifndef SPLICE_F_NONBLOCK +#define SPLICE_F_NONBLOCK 2 +#endif + +// RLIMIT constants as plain integers. On glibc these are __rlimit_resource +// enum values which can't be used as Int32 in Swift. +#define CZ_RLIMIT_CPU 0 +#define CZ_RLIMIT_FSIZE 1 +#define CZ_RLIMIT_DATA 2 +#define CZ_RLIMIT_STACK 3 +#define CZ_RLIMIT_CORE 4 +#define CZ_RLIMIT_RSS 5 +#define CZ_RLIMIT_NPROC 6 +#define CZ_RLIMIT_NOFILE 7 +#define CZ_RLIMIT_MEMLOCK 8 +#define CZ_RLIMIT_AS 9 +#define CZ_RLIMIT_LOCKS 10 +#define CZ_RLIMIT_SIGPENDING 11 +#define CZ_RLIMIT_MSGQUEUE 12 +#define CZ_RLIMIT_NICE 13 +#define CZ_RLIMIT_RTPRIO 14 +#define CZ_RLIMIT_RTTIME 15 + +// setrlimit wrapper that accepts plain int for the resource parameter, +// avoiding glibc's __rlimit_resource enum type mismatch in Swift. +int CZ_setrlimit(int resource, unsigned long long soft, unsigned long long hard); + +int CZ_pivot_root(const char *new_root, const char *put_old); +int CZ_set_sub_reaper(); + +#ifndef SYS_pidfd_open +#define SYS_pidfd_open 434 +#endif +int CZ_pidfd_open(pid_t pid, unsigned int flags); + +#ifndef SYS_pidfd_getfd +#define SYS_pidfd_getfd 438 +#endif +int CZ_pidfd_getfd(int pidfd, int targetfd, unsigned int flags); + +int CZ_prctl_set_no_new_privs(); + +#endif diff --git a/vminitd/Sources/LCShim/syscall.c b/vminitd/Sources/LCShim/syscall.c new file mode 100644 index 0000000..094f6c6 --- /dev/null +++ b/vminitd/Sources/LCShim/syscall.c @@ -0,0 +1,52 @@ +/* + * Copyright © 2025-2026 Apple Inc. and the Containerization project authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +#ifdef __linux__ +#include +#include +#include +#include + +#include "syscall.h" + +int CZ_pivot_root(const char *new_root, const char *put_old) { + return syscall(SYS_pivot_root, new_root, put_old); +} + +int CZ_set_sub_reaper() { return prctl(PR_SET_CHILD_SUBREAPER, 1); } + +int CZ_pidfd_open(pid_t pid, unsigned int flags) { + // Musl doesn't have pidfd_open. + return syscall(SYS_pidfd_open, pid, flags); +} + +int CZ_pidfd_getfd(int pidfd, int targetfd, unsigned int flags) { + // Musl doesn't have pidfd_getfd. + return syscall(SYS_pidfd_getfd, pidfd, targetfd, flags); +} + +int CZ_prctl_set_no_new_privs() { + return prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); +} + +int CZ_setrlimit(int resource, unsigned long long soft, + unsigned long long hard) { + struct rlimit limit; + limit.rlim_cur = (rlim_t)soft; + limit.rlim_max = (rlim_t)hard; + return setrlimit(resource, &limit); +} +#endif diff --git a/vminitd/Sources/VminitdCore/AgentCommand.swift b/vminitd/Sources/VminitdCore/AgentCommand.swift new file mode 100644 index 0000000..28c8a4e --- /dev/null +++ b/vminitd/Sources/VminitdCore/AgentCommand.swift @@ -0,0 +1,212 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ArgumentParser +import Cgroup +import Containerization +import ContainerizationError +import ContainerizationOS +import Foundation +import GRPCCore +import Logging +import NIOCore +import NIOPosix + +#if os(Linux) +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif +import LCShim +#endif + +public struct AgentCommand: AsyncParsableCommand { + public static let configuration = CommandConfiguration( + commandName: "agent", + abstract: "Run the vminitd agent daemon" + ) + + private static let foregroundEnvVar = "FOREGROUND" + public static let vsockPort = 1024 + + @OptionGroup var options: LogLevelOption + + public init() {} + + /// Bootstrap the vminitd environment and create an Initd server. + /// Handles mounts, cgroups, memory monitoring, and all pre-serve setup. + public static func bootstrap(options: LogLevelOption) async throws -> Initd { + let log = makeLogger(label: "vminitd", level: options.resolvedLogLevel()) + try adjustLimits(log) + + // When running under debug mode, launch vminitd as a sub process of pid1 + // so that we get a chance to collect better logs and errors before pid1 exists + // and the kernel panics. + #if DEBUG + log.info("DEBUG mode active, checking FOREGROUND env var") + let environment = ProcessInfo.processInfo.environment + let foreground = environment[foregroundEnvVar] + log.info("checking for shim var \(foregroundEnvVar)=\(String(describing: foreground))") + + if foreground == nil { + try runInForeground(log, logLevel: options.logLevel) + _exit(0) + } + + log.info("FOREGROUND is set, running as subprocess, setting subreaper") + // Since we are not running as pid1 in this mode we must set ourselves + // as a subreaper so that all child processes are reaped by us and not + // passed onto our parent. + CZ_set_sub_reaper() + #endif + + signal(SIGPIPE, SIG_IGN) + + log.info("vminitd booting", metadata: versionMetadata()) + + // Set of mounts necessary to be mounted prior to taking any RPCs. + // 1. /proc as the sysctl rpc wouldn't make sense if it wasn't there (NOTE: This is done before this method + // due to Swift seemingly requiring /proc to be present for the async runtime to spin up). + // 2. /run as that is where we store container state. + // 3. /sys as we need it for /sys/fs/cgroup + // 4. /sys/fs/cgroup to add the agent to a cgroup, as well as containers later. + let mounts = [ + ContainerizationOS.Mount( + type: "tmpfs", + source: "tmpfs", + target: "/run", + options: [] + ), + ContainerizationOS.Mount( + type: "sysfs", + source: "sysfs", + target: "/sys", + options: [] + ), + ContainerizationOS.Mount( + type: "cgroup2", + source: "none", + target: "/sys/fs/cgroup", + options: [] + ), + ] + + for mnt in mounts { + log.info("mounting \(mnt.target)") + + try mnt.mount(createWithPerms: 0o755) + } + try Binfmt.mount() + + let cgManager = Cgroup2Manager( + group: URL(filePath: "/vminitd"), + logger: log + ) + try cgManager.create() + try cgManager.toggleAllAvailableControllers(enable: true) + + // Set memory.high threshold to 80 MiB + let high: UInt64 = 80 * 1024 * 1024 + // Set memory.low to 50 MiB to avoid reclaiming vminitd's memory + let low: UInt64 = 50 * 1024 * 1024 + + try cgManager.setMemoryHigh(bytes: high) + try cgManager.setMemoryLow(bytes: low) + try cgManager.addProcess(pid: getpid()) + + let memoryMonitor = try MemoryMonitor( + cgroupManager: cgManager, + threshold: high, + logger: log + ) { [log] (currentUsage, highMark) in + log.warning( + "vminitd memory threshold exceeded", + metadata: [ + "threshold_bytes": "\(high)", + "current_bytes": "\(currentUsage)", + "high_events_total": "\(highMark)", + ]) + } + + let t = Thread { [log] in + do { + try memoryMonitor.run() + } catch { + log.error("memory monitor failed: \(error)") + } + } + t.start() + + let eg = MultiThreadedEventLoopGroup(numberOfThreads: 1) + let blockingPool = NIOThreadPool(numberOfThreads: 2) + blockingPool.start() + return Initd(log: log, group: eg, blockingPool: blockingPool) + } + + public mutating func run() async throws { + let server = try await Self.bootstrap(options: options) + + do { + server.log.info("serving vminitd API") + try await server.serve(port: Self.vsockPort) + server.log.info("vminitd API returned, syncing filesystems") + + #if os(Linux) + sync() + #endif + } catch { + server.log.error("vminitd boot error \(error)") + + #if os(Linux) + sync() + #endif + + _exit(1) + } + } + + private static func runInForeground(_ log: Logger, logLevel: String) throws { + log.info("running vminitd under pid1") + + var command = Command("/sbin/vminitd", arguments: ["agent", "--log-level", logLevel]) + command.attrs = .init(setsid: true) + command.stdin = .standardInput + command.stdout = .standardOutput + command.stderr = .standardError + command.environment = ["\(foregroundEnvVar)=1"] + + try command.start() + let exitCode = try command.wait() + log.info("child process exited with code: \(exitCode)") + } + + private static func adjustLimits(_ log: Logger) throws { + let nrOpen = try String(contentsOfFile: "/proc/sys/fs/nr_open", encoding: .utf8) + .trimmingCharacters(in: .whitespacesAndNewlines) + guard let max = UInt64(nrOpen) else { + throw POSIXError(.EINVAL) + } + log.debug("setting RLIMIT_NOFILE to \(max)") + guard CZ_setrlimit(CZ_RLIMIT_NOFILE, max, max) == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/CommandRunner.swift b/vminitd/Sources/VminitdCore/CommandRunner.swift new file mode 100644 index 0000000..6387d7e --- /dev/null +++ b/vminitd/Sources/VminitdCore/CommandRunner.swift @@ -0,0 +1,108 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation +import Synchronization + +struct ProcessSubscription: Sendable { + fileprivate let id: UUID +} + +/// Protocol for running commands and waiting for their exit +protocol CommandRunner: Sendable { + func start(_ cmd: inout Command) throws -> ProcessSubscription + func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32 +} + +struct DirectCommandRunner: CommandRunner { + func start(_ cmd: inout Command) throws -> ProcessSubscription { + try cmd.start() + return ProcessSubscription(id: UUID()) + } + + func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32 { + var rus = rusage() + var ws = Int32() + + let result = wait4(cmd.pid, &ws, 0, &rus) + guard result == cmd.pid else { + throw POSIXError(.init(rawValue: errno)!) + } + return Command.toExitStatus(ws) + } +} + +final class ReaperCommandRunner: CommandRunner, Sendable { + private struct Subscriber { + let continuation: AsyncStream<(pid: pid_t, status: Int32)>.Continuation + let stream: AsyncStream<(pid: pid_t, status: Int32)> + } + + private let subscribers: Mutex<[UUID: Subscriber]> = Mutex([:]) + + func start(_ cmd: inout Command) throws -> ProcessSubscription { + // Subscribe before starting to avoid missing fast exits + let id = UUID() + let (stream, continuation) = AsyncStream<(pid: pid_t, status: Int32)>.makeStream() + + subscribers.withLock { subscribers in + subscribers[id] = Subscriber(continuation: continuation, stream: stream) + } + + try cmd.start() + + return ProcessSubscription(id: id) + } + + func wait(_ cmd: Command, subscription: ProcessSubscription) async throws -> Int32 { + let pid = cmd.pid + let id = subscription.id + + defer { + subscribers.withLock { subscribers in + subscribers[id]?.continuation.finish() + subscribers.removeValue(forKey: id) + } + } + + // Get the stream from the subscriber + guard let stream = subscribers.withLock({ $0[id]?.stream }) else { + throw POSIXError(.ECHILD) + } + + for await (exitPid, status) in stream { + if exitPid == pid { + return status + } + } + + throw POSIXError(.ECHILD) + } + + /// Broadcast exit to all subscribers + func notifyExit(pid: pid_t, status: Int32) { + subscribers.withLock { subscribers in + for subscriber in subscribers.values { + subscriber.continuation.yield((pid, status)) + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/ContainerProcess.swift b/vminitd/Sources/VminitdCore/ContainerProcess.swift new file mode 100644 index 0000000..e9fe82b --- /dev/null +++ b/vminitd/Sources/VminitdCore/ContainerProcess.swift @@ -0,0 +1,70 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation + +/// Exit status information for a container process +struct ContainerExitStatus: Sendable { + var exitCode: Int32 + var exitedAt: Date +} + +/// Protocol for managing container processes +/// +/// This protocol abstracts the underlying container runtime implementation, +/// allowing for different backends like vmexec or runc. +protocol ContainerProcess: Sendable { + /// Unique identifier for the container process + var id: String { get } + + /// Process ID of the running container (nil if not started) + var pid: Int32? { get } + + /// Start the container process + /// - Returns: The process ID of the started container + /// - Throws: If the process fails to start + func start() async throws -> Int32 + + /// Wait for the container process to exit + /// - Returns: Exit status information when the process exits + func wait() async -> ContainerExitStatus + + /// Send a signal to the container process + /// - Parameter signal: The signal number to send + /// - Throws: If the signal cannot be sent + func kill(_ signal: Int32) async throws + + /// Resize the terminal for the container process + /// - Parameter size: The new terminal size + /// - Throws: If the terminal cannot be resized or process doesn't have a terminal + func resize(size: Terminal.Size) throws + + /// Close stdin for the container process + /// - Throws: If stdin cannot be closed + func closeStdin() throws + + /// Delete the container process and clean up resources + /// - Throws: If cleanup fails + func delete() async throws + + /// Set the exit status of the process. + func setExit(_ status: Int32) +} + +#endif diff --git a/vminitd/Sources/VminitdCore/HostStdio.swift b/vminitd/Sources/VminitdCore/HostStdio.swift new file mode 100644 index 0000000..2bb3139 --- /dev/null +++ b/vminitd/Sources/VminitdCore/HostStdio.swift @@ -0,0 +1,26 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +struct HostStdio: Sendable { + let stdin: UInt32? + let stdout: UInt32? + let stderr: UInt32? + let terminal: Bool +} + +#endif diff --git a/vminitd/Sources/VminitdCore/IOCloser+Extensions.swift b/vminitd/Sources/VminitdCore/IOCloser+Extensions.swift new file mode 100644 index 0000000..9a44108 --- /dev/null +++ b/vminitd/Sources/VminitdCore/IOCloser+Extensions.swift @@ -0,0 +1,32 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation + +extension Socket: IOCloser {} + +extension Terminal: IOCloser { + var fileDescriptor: Int32 { + self.handle.fileDescriptor + } +} + +extension FileHandle: IOCloser {} + +#endif diff --git a/vminitd/Sources/VminitdCore/IOCloser.swift b/vminitd/Sources/VminitdCore/IOCloser.swift new file mode 100644 index 0000000..eb27ff2 --- /dev/null +++ b/vminitd/Sources/VminitdCore/IOCloser.swift @@ -0,0 +1,37 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +protocol IOCloser: Sendable { + var fileDescriptor: Int32 { get } + + func close() throws +} + +struct UnownedIOCloser: IOCloser { + private let inner: IOCloser + + var fileDescriptor: Int32 { inner.fileDescriptor } + + init(_ inner: IOCloser) { + self.inner = inner + } + + func close() throws {} +} + +#endif diff --git a/vminitd/Sources/VminitdCore/IOPair.swift b/vminitd/Sources/VminitdCore/IOPair.swift new file mode 100644 index 0000000..7d9df42 --- /dev/null +++ b/vminitd/Sources/VminitdCore/IOPair.swift @@ -0,0 +1,189 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationError +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +final class IOPair: Sendable { + private let io: Mutex + private let logger: Logger? + private let reason: String + + private struct IO { + let from: IOCloser + let to: IOCloser + let buffer: UnsafeMutableBufferPointer + var closed: Bool + var registeredFd: Int32? + + func drain() { + let readFrom = OSFile(fd: from.fileDescriptor) + let writeTo = OSFile(fd: to.fileDescriptor) + + while true { + let r = readFrom.read(buffer) + if r.read > 0 { + let view = UnsafeMutableBufferPointer( + start: buffer.baseAddress, + count: r.read + ) + + let w = writeTo.write(view) + if w.wrote != r.read { + return + } + } + + switch r.action { + case .eof, .again, .error(_): + return + default: + break + } + } + } + + mutating func close(logger: Logger?) { + if self.closed { + return + } + + // Try and drain IO first. + self.drain() + + // Remove the fd from our global epoll instance first. + if let fd = self.registeredFd { + do { + try ProcessSupervisor.default.unregisterFd(fd) + } catch { + logger?.error("failed to delete fd from epoll \(fd): \(error)") + } + self.registeredFd = nil + } + + do { + try self.from.close() + } catch { + logger?.error("failed to close reader fd for IOPair: \(error)") + } + + do { + try self.to.close() + } catch { + logger?.error("failed to close writer fd for IOPair: \(error)") + } + self.buffer.deallocate() + self.closed = true + } + } + + init( + readFrom: IOCloser, + writeTo: IOCloser, + reason: String, + logger: Logger? = nil + ) { + let buffer = UnsafeMutableBufferPointer.allocate(capacity: Int(getpagesize())) + self.io = Mutex( + IO( + from: readFrom, + to: writeTo, + buffer: buffer, + closed: false, + registeredFd: nil + )) + self.reason = reason + self.logger = logger + } + + func relay(ignoreHup: Bool = false) throws { + self.logger?.info("setting up relay for \(reason)") + + let (readFromFd, writeToFd) = self.io.withLock { io in + io.registeredFd = io.from.fileDescriptor + return (io.from.fileDescriptor, io.to.fileDescriptor) + } + + let readFrom = OSFile(fd: readFromFd) + let writeTo = OSFile(fd: writeToFd) + + try ProcessSupervisor.default.registerFd(readFromFd, mask: .input) { mask in + self.io.withLock { io in + if io.closed { + return + } + + if mask.isHangup && !mask.readyToRead { + self.logger?.debug("received EPOLLHUP with no EPOLLIN") + if !ignoreHup { + io.close(logger: self.logger) + } + return + } + + // Loop so we drain fully. + while true { + let r = readFrom.read(io.buffer) + if r.read > 0 { + let view = UnsafeMutableBufferPointer( + start: io.buffer.baseAddress, + count: r.read + ) + + let w = writeTo.write(view) + if w.wrote != r.read { + self.logger?.error("stopping relay: short write for stdio") + io.close(logger: self.logger) + return + } + } + + switch r.action { + case .error(let errno): + self.logger?.error("failed with errno \(errno) while reading for fd \(readFromFd)") + fallthrough + case .eof: + self.logger?.debug("closing relay for \(readFromFd)") + io.close(logger: self.logger) + return + case .again: + if mask.isHangup && !ignoreHup { + self.logger?.error("received EPOLLHUP and EAGAIN exiting") + self.close() + } + return + default: + break + } + } + } + } + } + + func close() { + self.io.withLock { io in + self.logger?.info("closing relay for \(reason)") + io.close(logger: self.logger) + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/InitCommand.swift b/vminitd/Sources/VminitdCore/InitCommand.swift new file mode 100644 index 0000000..1357b8e --- /dev/null +++ b/vminitd/Sources/VminitdCore/InitCommand.swift @@ -0,0 +1,113 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ArgumentParser +import ContainerizationOS +import LCShim + +#if canImport(Musl) +import Musl +private let _exit = Musl.exit +private let _kill = Musl.kill +#elseif canImport(Glibc) +import Glibc +private let _exit = Glibc.exit +private let _kill = Glibc.kill +#endif + +/// A minimal init process that: +/// - Spawns and monitors a child process +/// - Forwards signals to the child +/// - Reaps zombie processes +/// - Exits with the child's exit code +public struct InitCommand: ParsableCommand { + public static let configuration = CommandConfiguration( + commandName: "init", + abstract: "Run as a minimal init process" + ) + + public init() {} + + @Flag(name: .shortAndLong, help: "Send signals to the child's process group instead of just the child") + var processGroup: Bool = false + + @Argument(help: "The command to run") + var command: String + + @Argument(parsing: .captureForPassthrough, help: "Arguments for the command") + var arguments: [String] = [] + + /// Signals that should NOT be forwarded to the child. + private static let ignoredSignals: Set = [ + SIGCHLD, // We handle this for zombie reaping + SIGFPE, SIGILL, SIGSEGV, SIGBUS, SIGABRT, SIGTRAP, SIGSYS, // Synchronous signals + ] + + public mutating func run() throws { + // If we're not PID 1, register as a child subreaper so orphaned + // processes get reparented to us and we can reap them. + if getpid() != 1 { + CZ_set_sub_reaper() + } + + // Block all signals. We'll handle them synchronously via sigtimedwait + var allSignals = sigset_t() + sigfillset(&allSignals) + sigprocmask(SIG_BLOCK, &allSignals, nil) + + let resolvedCommand = Path.lookPath(command)?.path ?? command + + var cmd = Command(resolvedCommand, arguments: arguments) + cmd.stdin = .standardInput + cmd.stdout = .standardOutput + cmd.stderr = .standardError + + cmd.attrs = .init(setPGroup: true, setForegroundPGroup: true, setSignalDefault: true) + + try cmd.start() + let childPid = cmd.pid + let signalTarget = processGroup ? -childPid : childPid + var timeout = timespec(tv_sec: 0, tv_nsec: 100_000_000) + + // Handle signals and reap zombies + var childExitStatus: Int32? + while childExitStatus == nil { + var siginfo = siginfo_t() + let sig = sigtimedwait(&allSignals, &siginfo, &timeout) + + if sig > 0 && !Self.ignoredSignals.contains(sig) { + _ = _kill(signalTarget, sig) + } + + while true { + var status: Int32 = 0 + let pid = waitpid(-1, &status, WNOHANG) + if pid <= 0 { + break + } + if pid == childPid { + childExitStatus = Command.toExitStatus(status) + } + } + } + + _exit(childExitStatus ?? 1) + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/Logging.swift b/vminitd/Sources/VminitdCore/Logging.swift new file mode 100644 index 0000000..845d769 --- /dev/null +++ b/vminitd/Sources/VminitdCore/Logging.swift @@ -0,0 +1,117 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ArgumentParser +import Foundation +import Logging +import Synchronization + +public struct LogLevelOption: ParsableArguments { + @Option(name: .long, help: "Set the log level (trace, debug, info, notice, warning, error, critical)") + public var logLevel: String = "info" + + public init() {} + + public init(logLevel: String) { + self.logLevel = logLevel + } + + public func resolvedLogLevel() -> Logger.Level { + switch logLevel.lowercased() { + case "trace": + return .trace + case "debug": + return .debug + case "info": + return .info + case "notice": + return .notice + case "warning": + return .warning + case "error": + return .error + case "critical": + return .critical + default: + return .info + } + } +} + +private let _loggingBootstrapped = Mutex(false) +private let _versionMetadata = Mutex([:]) + +/// Set the version metadata logged on boot. +public func setVersionMetadata(_ metadata: Logger.Metadata) { + _versionMetadata.withLock { $0 = metadata } +} + +func versionMetadata() -> Logger.Metadata { + _versionMetadata.withLock { $0 } +} + +func makeLogger(label: String, level: Logger.Level) -> Logger { + _loggingBootstrapped.withLock { bootstrapped in + if !bootstrapped { + LoggingSystem.bootstrap { label in StderrLogHandler(label: label) } + bootstrapped = true + } + } + var log = Logger(label: label) + log.logLevel = level + return log +} + +private struct StderrLogHandler: LogHandler { + let label: String + var logLevel: Logger.Level = .info + var metadata: Logger.Metadata = [:] + + subscript(metadataKey key: String) -> Logger.Metadata.Value? { + get { metadata[key] } + set { metadata[key] = newValue } + } + + func log( + level: Logger.Level, message: Logger.Message, metadata: Logger.Metadata?, + source: String, file: String, function: String, line: UInt + ) { + var merged = self.metadata + metadata?.forEach { merged[$0] = $1 } + let metaStr = merged.isEmpty ? "" : " \(merged.map { "\($0): \($1)" }.sorted().joined(separator: ", "))" + let ts = isoTimestamp() + let data = "\(ts) \(level) \(label):\(metaStr) \(message)\n".data(using: .utf8) ?? Data() + FileHandle.standardError.write(data) + } + + func isoTimestamp() -> String { + let date = Date() + var time = time_t(date.timeIntervalSince1970) + var ms = Int(date.timeIntervalSince1970 * 1000) % 1000 + if ms < 0 { ms += 1000 } + var tm = tm() + gmtime_r(&time, &tm) + let buf = withUnsafeTemporaryAllocation(of: CChar.self, capacity: 32) { ptr -> String in + strftime(ptr.baseAddress!, 32, "%Y-%m-%dT%H:%M:%S", &tm) + return String(cString: ptr.baseAddress!) + } + return String(format: "%@.%03dZ", buf, ms) + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/ManagedContainer.swift b/vminitd/Sources/VminitdCore/ManagedContainer.swift new file mode 100644 index 0000000..545046a --- /dev/null +++ b/vminitd/Sources/VminitdCore/ManagedContainer.swift @@ -0,0 +1,286 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Cgroup +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging + +public actor ManagedContainer { + public let id: String + let initProcess: any ContainerProcess + + private let cgroupManager: Cgroup2Manager + private let log: Logger + private let bundle: ContainerizationOCI.Bundle + private let needsCgroupCleanup: Bool + private var execs: [String: any ContainerProcess] = [:] + + public var pid: Int32? { + self.initProcess.pid + } + + init( + id: String, + stdio: HostStdio, + spec: ContainerizationOCI.Spec, + ociRuntimePath: String? = nil, + log: Logger + ) async throws { + var cgroupsPath: String + if let cgPath = spec.linux?.cgroupsPath { + cgroupsPath = cgPath + } else { + cgroupsPath = "/container/\(id)" + } + + let bundle = try ContainerizationOCI.Bundle.create( + path: Self.craftBundlePath(id: id), + spec: spec + ) + log.debug("created bundle with spec \(spec)") + + let cgManager = Cgroup2Manager( + group: URL(filePath: cgroupsPath), + logger: log + ) + try cgManager.create() + + do { + try cgManager.toggleAllAvailableControllers(enable: true) + + let initProcess: any ContainerProcess + + if let runtimePath = ociRuntimePath { + // Use runc runtime + let runc = ProcessSupervisor.default.getRuncWithReaper( + Runc( + command: runtimePath, + root: "/run/runc" + ) + ) + initProcess = try RuncProcess( + id: id, + stdio: stdio, + bundle: bundle, + runc: runc, + log: log + ) + self.needsCgroupCleanup = false + log.info("created runc init process with runtime: \(runtimePath)") + } else { + // Use vmexec runtime + initProcess = try ManagedProcess( + id: id, + stdio: stdio, + bundle: bundle, + owningPid: nil, + log: log + ) + self.needsCgroupCleanup = true + log.info("created vmexec init process") + } + + self.cgroupManager = cgManager + self.initProcess = initProcess + self.id = id + self.bundle = bundle + self.log = log + } catch { + try? cgManager.delete() + throw error + } + } +} + +extension ManagedContainer { + // removeCgroupWithRetry will remove a cgroup path handling EAGAIN and EBUSY errors and + // retrying the remove after an exponential timeout + private func removeCgroupWithRetry() async throws { + var delay = 10 // 10ms + let maxRetries = 5 + + for i in 0.. Int32 { + let proc = try self.getExecOrInit(execID: execID) + return try await ProcessSupervisor.default.start(process: proc) + } + + func wait(execID: String) async throws -> ContainerExitStatus { + let proc = try self.getExecOrInit(execID: execID) + return await proc.wait() + } + + func kill(execID: String, _ signal: Int32) async throws { + let proc = try self.getExecOrInit(execID: execID) + try await proc.kill(signal) + } + + func resize(execID: String, size: Terminal.Size) throws { + let proc = try self.getExecOrInit(execID: execID) + try proc.resize(size: size) + } + + func closeStdin(execID: String) throws { + let proc = try self.getExecOrInit(execID: execID) + try proc.closeStdin() + } + + func deleteExec(id: String) throws { + try ensureExecExists(id) + do { + try self.bundle.deleteExecSpec(id: id) + } catch { + self.log.error("failed to remove exec spec from filesystem: \(error)") + } + self.execs.removeValue(forKey: id) + } + + func delete() async throws { + // Delete the init process if it's a RuncProcess + try await self.initProcess.delete() + + // Delete the bundle and cgroup + try self.bundle.delete() + if self.needsCgroupCleanup { + try await self.removeCgroupWithRetry() + } + } + + func stats(_ categories: Cgroup2StatsCategory = .all) throws -> Cgroup2Stats { + try self.cgroupManager.stats(categories) + } + + func getMemoryEvents() throws -> MemoryEvents { + try self.cgroupManager.getMemoryEvents() + } + + func getExecOrInit(execID: String) throws -> any ContainerProcess { + if execID == self.id { + return self.initProcess + } + guard let proc = self.execs[execID] else { + throw ContainerizationError( + .invalidState, + message: "exec \(execID) does not exist in container \(self.id)" + ) + } + return proc + } +} + +extension ContainerizationOCI.Bundle { + func createExecSpec(id: String, process: ContainerizationOCI.Process) throws { + let specDir = self.path.appending(path: "execs/\(id)") + + let fm = FileManager.default + try fm.createDirectory( + atPath: specDir.path, + withIntermediateDirectories: true + ) + + let specData = try JSONEncoder().encode(process) + let processConfigPath = specDir.appending(path: "process.json") + try specData.write(to: processConfigPath) + } + + func getExecSpecPath(id: String) -> URL { + self.path.appending(path: "execs/\(id)/process.json") + } + + func deleteExecSpec(id: String) throws { + let specDir = self.path.appending(path: "execs/\(id)") + + let fm = FileManager.default + try fm.removeItem(at: specDir) + } +} + +extension ManagedContainer { + static func craftBundlePath(id: String) -> URL { + URL(fileURLWithPath: "/run/container").appending(path: id) + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/ManagedProcess.swift b/vminitd/Sources/VminitdCore/ManagedProcess.swift new file mode 100644 index 0000000..ba4cd2d --- /dev/null +++ b/vminitd/Sources/VminitdCore/ManagedProcess.swift @@ -0,0 +1,348 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Cgroup +import Containerization +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +final class ManagedProcess: ContainerProcess, Sendable { + // swiftlint: disable type_name + protocol IO { + func attach(pid: Int32, fd: Int32) throws + func start(process: inout Command) throws + func resize(size: Terminal.Size) throws + func close() throws + func closeStdin() throws + func closeAfterExec() throws + } + // swiftlint: enable type_name + + private struct State { + init(io: IO) { + self.io = io + } + + let io: IO + var waiters: [CheckedContinuation] = [] + var exitStatus: ContainerExitStatus? = nil + var pid: Int32? + } + + private static let ackPid = "AckPid" + private static let ackConsole = "AckConsole" + + let id: String + + private let log: Logger + private let command: Command + private let state: Mutex + private let owningPid: Int32? + private let ackPipe: Pipe + private let syncPipe: Pipe + private let errorPipe: Pipe + private let terminal: Bool + private let bundle: ContainerizationOCI.Bundle + + var pid: Int32? { + self.state.withLock { + $0.pid + } + } + + init( + id: String, + stdio: HostStdio, + bundle: ContainerizationOCI.Bundle, + owningPid: Int32? = nil, + log: Logger + ) throws { + self.id = id + var log = log + log[metadataKey: "id"] = "\(id)" + self.log = log + self.owningPid = owningPid + + let syncPipe = Pipe() + try syncPipe.setCloexec() + self.syncPipe = syncPipe + + let ackPipe = Pipe() + try ackPipe.setCloexec() + self.ackPipe = ackPipe + + let errorPipe = Pipe() + try errorPipe.setCloexec() + self.errorPipe = errorPipe + + let args: [String] + if let owningPid { + args = [ + "exec", + "--parent-pid", + "\(owningPid)", + "--process-path", + bundle.getExecSpecPath(id: id).path, + ] + } else { + args = ["run", "--bundle-path", bundle.path.path] + } + + var command = Command( + "/sbin/vmexec", + arguments: args, + extraFiles: [ + syncPipe.fileHandleForWriting, + ackPipe.fileHandleForReading, + errorPipe.fileHandleForWriting, + ] + ) + + var io: IO + if stdio.terminal { + log.info("setting up terminal I/O") + let attrs = Command.Attrs(setsid: false, setctty: false) + command.attrs = attrs + io = try TerminalIO( + stdio: stdio, + log: log + ) + } else { + command.attrs = .init(setsid: false) + io = StandardIO( + stdio: stdio, + log: log + ) + } + + log.info("starting I/O") + + // Setup IO early. We expect the host to be listening already. + try io.start(process: &command) + + self.command = command + self.terminal = stdio.terminal + self.bundle = bundle + self.state = Mutex(State(io: io)) + } +} + +extension ManagedProcess { + func start() async throws -> Int32 { + do { + return try self.state.withLock { + log.info( + "starting managed process", + metadata: [ + "id": "\(id)" + ]) + + // Start the underlying process. + try command.start() + + defer { + try? self.ackPipe.fileHandleForWriting.close() + try? self.syncPipe.fileHandleForReading.close() + try? self.ackPipe.fileHandleForReading.close() + try? self.syncPipe.fileHandleForWriting.close() + try? self.errorPipe.fileHandleForWriting.close() + } + + // Close our side of any pipes. + try $0.io.closeAfterExec() + try self.ackPipe.fileHandleForReading.close() + try self.syncPipe.fileHandleForWriting.close() + try self.errorPipe.fileHandleForWriting.close() + + let size = MemoryLayout.size + guard let piddata = try syncPipe.fileHandleForReading.read(upToCount: size) else { + throw ContainerizationError(.internalError, message: "no PID data from sync pipe") + } + + guard piddata.count == size else { + throw ContainerizationError(.internalError, message: "invalid payload") + } + + let pid = piddata.withUnsafeBytes { ptr in + ptr.load(as: Int32.self) + } + + log.info( + "got back pid data", + metadata: [ + "pid": "\(pid)" + ]) + $0.pid = pid + + // This should probably happen in vmexec, but we don't need to set any cgroup + // toggles so the problem is much simpler to just do it here. + if let owningPid { + let cgManager = try Cgroup2Manager.loadFromPid(pid: owningPid) + try cgManager.addProcess(pid: pid) + } + + log.info( + "sending pid acknowledgement", + metadata: [ + "pid": "\(pid)" + ]) + try self.ackPipe.fileHandleForWriting.write(contentsOf: Self.ackPid.data(using: .utf8)!) + + if self.terminal { + log.info( + "wait for PTY FD", + metadata: [ + "id": "\(id)" + ]) + + // Wait for a new write that will contain the pty fd if we asked for one. + guard let ptyFd = try self.syncPipe.fileHandleForReading.read(upToCount: size) else { + throw ContainerizationError( + .internalError, + message: "no PTY data from sync pipe" + ) + } + let fd = ptyFd.withUnsafeBytes { ptr in + ptr.load(as: Int32.self) + } + log.info( + "received PTY FD from container, attaching", + metadata: [ + "id": "\(id)" + ]) + + try $0.io.attach(pid: pid, fd: fd) + try self.ackPipe.fileHandleForWriting.write(contentsOf: Self.ackConsole.data(using: .utf8)!) + } + + // Wait for the errorPipe to close (after exec). + if let errorData = try? self.errorPipe.fileHandleForReading.readToEnd(), + let errorString = String(data: errorData, encoding: .utf8), + !errorString.isEmpty + { + throw ContainerizationError( + .internalError, + message: "vmexec error: \(errorString.trimmingCharacters(in: .whitespacesAndNewlines))" + ) + } + + log.info( + "started managed process", + metadata: [ + "pid": "\(pid)", + "id": "\(id)", + ]) + + return pid + } + } catch { + if let errorData = try? self.errorPipe.fileHandleForReading.readToEnd(), + let errorString = String(data: errorData, encoding: .utf8), + !errorString.isEmpty + { + throw ContainerizationError( + .internalError, + message: "vmexec error: \(errorString.trimmingCharacters(in: .whitespacesAndNewlines))", + cause: error + ) + } + throw error + } + } + + func setExit(_ status: Int32) { + self.state.withLock { state in + self.log.info( + "managed process exit", + metadata: [ + "status": "\(status)" + ]) + + let exitStatus = ContainerExitStatus(exitCode: status, exitedAt: Date.now) + state.exitStatus = exitStatus + + do { + try state.io.close() + } catch { + self.log.error("failed to close I/O for process: \(error)") + } + + for waiter in state.waiters { + waiter.resume(returning: exitStatus) + } + + self.log.debug("\(state.waiters.count) managed process waiters signaled") + state.waiters.removeAll() + } + } + + /// Wait on the process to exit + func wait() async -> ContainerExitStatus { + await withCheckedContinuation { cont in + self.state.withLock { + if let status = $0.exitStatus { + cont.resume(returning: status) + return + } + $0.waiters.append(cont) + } + } + } + + func kill(_ signal: Int32) async throws { + try self.state.withLock { + guard let pid = $0.pid else { + throw ContainerizationError(.invalidState, message: "process PID is required") + } + + guard $0.exitStatus == nil else { + return + } + + self.log.info("sending signal \(signal) to process \(pid)") + guard Foundation.kill(pid, signal) == 0 else { + throw POSIXError.fromErrno() + } + } + } + + func resize(size: Terminal.Size) throws { + try self.state.withLock { + guard $0.exitStatus == nil else { + return + } + try $0.io.resize(size: size) + } + } + + func closeStdin() throws { + let io = self.state.withLock { $0.io } + try io.closeStdin() + } + + func delete() async throws { + // vmexec doesn't require explicit cleanup - the process is cleaned up + // when it exits and IO is closed via setExit() + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/MemoryMonitor.swift b/vminitd/Sources/VminitdCore/MemoryMonitor.swift new file mode 100644 index 0000000..d6dcd1c --- /dev/null +++ b/vminitd/Sources/VminitdCore/MemoryMonitor.swift @@ -0,0 +1,158 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Cgroup +import Foundation +import Logging + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +package final class MemoryMonitor: Sendable { + private static let inotifyEventSize = 0x10 + + private let cgroupManager: Cgroup2Manager + private let threshold: UInt64 + private let logger: Logger + private let inotifyFd: Int32 + private let watchDescriptor: Int32 + private let onThresholdExceeded: @Sendable (UInt64, UInt64) -> Void + + package init( + cgroupManager: Cgroup2Manager, + threshold: UInt64, + logger: Logger, + onThresholdExceeded: @escaping @Sendable (UInt64, UInt64) -> Void + ) throws { + self.cgroupManager = cgroupManager + self.threshold = threshold + self.logger = logger + self.onThresholdExceeded = onThresholdExceeded + + let fd = inotify_init() + guard fd != -1 else { + throw Error.inotifyInit(errno: errno) + } + self.inotifyFd = fd + + let eventsPath = cgroupManager.getMemoryEventsPath() + let wd = inotify_add_watch( + inotifyFd, + eventsPath, + UInt32(IN_MODIFY) + ) + guard wd != -1 else { + close(fd) + throw Error.inotifyAddWatch(errno: errno, path: eventsPath) + } + self.watchDescriptor = wd + } + + /// Run the monitoring loop. Call this from a dedicated thread. + /// This function blocks until an error occurs. + package func run() throws { + let eventsPath = cgroupManager.getMemoryEventsPath() + + logger.info( + "Started memory monitoring", + metadata: [ + "threshold_bytes": "\(threshold)", + "events_path": "\(eventsPath)", + ]) + + // Read initial state + var highCountMax: UInt64 = 0 + do { + let events = try cgroupManager.getMemoryEvents() + highCountMax = events.high + } catch { + throw Error.readMemoryEvents(error: error) + } + + let bufSize = Self.inotifyEventSize * 10 + var buffer = [UInt8](repeating: 0, count: bufSize) + while true { + let bytesRead = buffer.withUnsafeMutableBytes { ptr in + read(inotifyFd, ptr.baseAddress!, bufSize) + } + + if bytesRead < 0 { + if errno == EINTR { + continue + } + throw Error.readFailed(errno: errno) + } + + do { + let events = try cgroupManager.getMemoryEvents() + + if events.high > highCountMax { + highCountMax = events.high + + let stats = try cgroupManager.stats(.memory) + let currentUsage = stats.memory?.usage ?? 0 + + onThresholdExceeded(currentUsage, events.high) + } + + if events.oom > 0 || events.oomKill > 0 { + logger.error( + "OOM events detected", + metadata: [ + "oom_events": "\(events.oom)", + "oom_kill_events": "\(events.oomKill)", + ]) + } + } catch { + throw Error.readMemoryEvents(error: error) + } + } + } + + deinit { + inotify_rm_watch(inotifyFd, watchDescriptor) + close(inotifyFd) + } +} + +extension MemoryMonitor { + package enum Error: Swift.Error, CustomStringConvertible { + case inotifyInit(errno: Int32) + case inotifyAddWatch(errno: Int32, path: String) + case readFailed(errno: Int32) + case readMemoryEvents(error: Swift.Error) + + package var description: String { + switch self { + case .inotifyInit(let errno): + return "failed to initialize inotify: errno \(errno)" + case .inotifyAddWatch(let errno, let path): + return "failed to add inotify watch on \(path): errno \(errno)" + case .readFailed(let errno): + return "failed to read inotify events: errno \(errno)" + case .readMemoryEvents(let error): + return "failed to read memory events: \(error)" + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/OSFile+Splice.swift b/vminitd/Sources/VminitdCore/OSFile+Splice.swift new file mode 100644 index 0000000..7101b43 --- /dev/null +++ b/vminitd/Sources/VminitdCore/OSFile+Splice.swift @@ -0,0 +1,106 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Foundation +import LCShim + +extension OSFile { + struct SpliceFile: Sendable { + fileprivate var file: OSFile + fileprivate var offset: Int + fileprivate let pipe = Pipe() + + var fileDescriptor: Int32 { + file.fileDescriptor + } + + var reader: Int32 { + pipe.fileHandleForReading.fileDescriptor + } + + var writer: Int32 { + pipe.fileHandleForWriting.fileDescriptor + } + + init(fd: Int32) { + self.file = OSFile(fd: fd) + self.offset = 0 + } + + init(handle: FileHandle) { + self.file = OSFile(handle: handle) + self.offset = 0 + } + + init(from: OSFile, withOffset: Int = 0) { + self.file = from + self.offset = withOffset + } + + func close() throws { + try self.file.close() + } + } + + static func splice(from: inout SpliceFile, to: inout SpliceFile, count: Int = 1 << 16) throws -> (read: Int, wrote: Int, action: IOAction) { + let fromOffset = from.offset + let toOffset = to.offset + + while true { + while (from.offset - to.offset) < count { + let toRead = count - (from.offset - to.offset) + let bytesRead = LCShim.splice(from.fileDescriptor, nil, to.writer, nil, toRead, UInt32(bitPattern: LCShim.SPLICE_F_MOVE | LCShim.SPLICE_F_NONBLOCK)) + if bytesRead == -1 { + if errno != EAGAIN && errno != EIO { + throw POSIXError(.init(rawValue: errno)!) + } + break + } + if bytesRead == 0 { + return (0, 0, .eof) + } + from.offset += bytesRead + if bytesRead < toRead { + break + } + } + if from.offset == to.offset { + return (from.offset - fromOffset, to.offset - toOffset, .success) + } + while to.offset < from.offset { + let toWrite = from.offset - to.offset + let bytesWrote = LCShim.splice(to.reader, nil, to.fileDescriptor, nil, toWrite, UInt32(bitPattern: LCShim.SPLICE_F_MOVE | LCShim.SPLICE_F_NONBLOCK)) + if bytesWrote == -1 { + if errno != EAGAIN && errno != EIO { + throw POSIXError(.init(rawValue: errno)!) + } + break + } + to.offset += bytesWrote + if bytesWrote == 0 { + return (from.offset - fromOffset, to.offset - toOffset, .brokenPipe) + } + if bytesWrote < toWrite { + break + } + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/OSFile.swift b/vminitd/Sources/VminitdCore/OSFile.swift new file mode 100644 index 0000000..05f28fb --- /dev/null +++ b/vminitd/Sources/VminitdCore/OSFile.swift @@ -0,0 +1,132 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Foundation + +struct OSFile: Sendable { + enum IOAction: Equatable { + case eof + case again + case success + case brokenPipe + case error(_ errno: Int32) + } + + private let fd: Int32 + + var closed: Bool { + Foundation.fcntl(fd, F_GETFD) == -1 && errno == EBADF + } + + var fileDescriptor: Int32 { fd } + + init(fd: Int32) { + self.fd = fd + } + + init(handle: FileHandle) { + self.fd = handle.fileDescriptor + } + + func close() throws { + guard Foundation.close(self.fd) == 0 else { + throw POSIXError(.init(rawValue: errno)!) + } + } + + func read(_ buffer: UnsafeMutableBufferPointer) -> (read: Int, action: IOAction) { + if buffer.count == 0 { + return (0, .success) + } + + var bytesRead: Int = 0 + while true { + let n = Foundation.read( + self.fd, + buffer.baseAddress!.advanced(by: bytesRead), + buffer.count - bytesRead + ) + if n == -1 { + if errno == EAGAIN || errno == EIO { + return (bytesRead, .again) + } + return (bytesRead, .error(errno)) + } + + if n == 0 { + return (bytesRead, .eof) + } + + bytesRead += n + if bytesRead < buffer.count { + continue + } + return (bytesRead, .success) + } + } + + func write(_ buffer: UnsafeMutableBufferPointer) -> (wrote: Int, action: IOAction) { + if buffer.count == 0 { + return (0, .success) + } + + var bytesWrote: Int = 0 + while true { + let n = Foundation.write( + self.fd, + buffer.baseAddress!.advanced(by: bytesWrote), + buffer.count - bytesWrote + ) + if n == -1 { + if errno == EAGAIN || errno == EIO { + return (bytesWrote, .again) + } + return (bytesWrote, .error(errno)) + } + + if n == 0 { + return (bytesWrote, .brokenPipe) + } + + bytesWrote += n + if bytesWrote < buffer.count { + continue + } + return (bytesWrote, .success) + } + } + + static func pipe() -> (read: Self, write: Self) { + let pipe = Pipe() + return (Self(handle: pipe.fileHandleForReading), Self(handle: pipe.fileHandleForWriting)) + } + + static func open(path: String) throws -> Self { + try open(path: path, mode: O_RDONLY | O_CLOEXEC) + } + + static func open(path: String, mode: Int32) throws -> Self { + let fd = Foundation.open(path, mode) + if fd < 0 { + throw POSIXError(.init(rawValue: errno)!) + } + return Self(fd: fd) + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/PauseCommand.swift b/vminitd/Sources/VminitdCore/PauseCommand.swift new file mode 100644 index 0000000..968f407 --- /dev/null +++ b/vminitd/Sources/VminitdCore/PauseCommand.swift @@ -0,0 +1,82 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ArgumentParser +import Dispatch +import Logging + +#if canImport(Musl) +import Musl +private let _exit = Musl.exit +#elseif canImport(Glibc) +import Glibc +private let _exit = Glibc.exit +#endif + +public struct PauseCommand: ParsableCommand { + public static let configuration = CommandConfiguration( + commandName: "pause", + abstract: "Run the pause container" + ) + + public init() {} + + @OptionGroup var options: LogLevelOption + + public mutating func run() throws { + let log = makeLogger(label: "pause", level: options.resolvedLogLevel()) + + if getpid() != 1 { + log.warning("pause should be the first process") + } + + // NOTE: For whatever reason, using signal() for the below causes a swift compiler issue. + // Can revert whenever that is understood. + let sigintSource = DispatchSource.makeSignalSource(signal: SIGINT) + sigintSource.setEventHandler { + log.info("Shutting down, got SIGINT") + _exit(0) + } + sigintSource.resume() + + let sigtermSource = DispatchSource.makeSignalSource(signal: SIGTERM) + sigtermSource.setEventHandler { + log.info("Shutting down, got SIGTERM") + _exit(0) + } + sigtermSource.resume() + + let sigchldSource = DispatchSource.makeSignalSource(signal: SIGCHLD) + sigchldSource.setEventHandler { + var status: Int32 = 0 + while waitpid(-1, &status, WNOHANG) > 0 {} + } + sigchldSource.resume() + + log.info("pause container running, waiting for signals...") + + while true { + _ = pause() + } + + log.error("Error: infinite loop terminated") + _exit(42) + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/ProcessSupervisor.swift b/vminitd/Sources/VminitdCore/ProcessSupervisor.swift new file mode 100644 index 0000000..82e767b --- /dev/null +++ b/vminitd/Sources/VminitdCore/ProcessSupervisor.swift @@ -0,0 +1,168 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +final class ProcessSupervisor: Sendable { + private let poller: Epoll + private let handlers = Mutex<[Int32: @Sendable (Epoll.Mask) -> Void]>([:]) + + private let queue: DispatchQueue + // `DispatchSourceSignal` is thread-safe. + private nonisolated(unsafe) let source: DispatchSourceSignal + + private struct State { + var processes: [any ContainerProcess] = [] + var log: Logger? + } + + private let state: Mutex + private let reaperCommandRunner = ReaperCommandRunner() + + func setLog(_ log: Logger?) { + self.state.withLock { $0.log = log } + } + + static let `default` = ProcessSupervisor() + + private init() { + let queue = DispatchQueue(label: "process-supervisor") + self.source = DispatchSource.makeSignalSource(signal: SIGCHLD, queue: queue) + self.queue = queue + self.poller = try! Epoll() + self.state = Mutex(State()) + let t = Thread { + while true { + guard let events = self.poller.wait() else { + return + } + if events.isEmpty { + return + } + for event in events { + let handler = self.handlers.withLock { $0[event.fd] } + handler?(event.mask) + } + } + } + t.start() + } + + /// Register a file descriptor for epoll monitoring with a handler. + /// + /// The handler is stored before the fd is added to epoll, ensuring no + /// events are missed. + func registerFd( + _ fd: Int32, + mask: Epoll.Mask = [.input, .output], + handler: @escaping @Sendable (Epoll.Mask) -> Void + ) throws { + self.handlers.withLock { $0[fd] = handler } + do { + try self.poller.add(fd, mask: mask) + } catch { + self.handlers.withLock { _ = $0.removeValue(forKey: fd) } + throw error + } + } + + /// Remove a file descriptor from epoll monitoring and discard its handler. + func unregisterFd(_ fd: Int32) throws { + self.handlers.withLock { _ = $0.removeValue(forKey: fd) } + try self.poller.delete(fd) + } + + func ready() { + self.source.setEventHandler { + self.handleSignal() + } + self.source.resume() + } + + private func handleSignal() { + dispatchPrecondition(condition: .onQueue(queue)) + + let exited = Reaper.reap() + + for (pid, status) in exited { + reaperCommandRunner.notifyExit(pid: pid, status: status) + } + + self.state.withLock { state in + state.log?.debug("received SIGCHLD, reaping processes") + state.log?.debug("finished wait4 of \(exited.count) processes") + state.log?.debug("checking for exit of managed process", metadata: ["exits": "\(exited)", "processes": "\(state.processes.count)"]) + + let exitedProcesses = state.processes.filter { proc in + exited.contains { pid, _ in + proc.pid == pid + } + } + + for proc in exitedProcesses { + guard let pid = proc.pid else { + continue + } + + if let status = exited[pid] { + state.log?.debug( + "managed process exited", + metadata: [ + "pid": "\(pid)", + "status": "\(status)", + "count": "\(state.processes.count - 1)", + ]) + proc.setExit(status) + state.processes.removeAll(where: { $0.pid == pid }) + } + } + } + } + + func start(process: any ContainerProcess) async throws -> Int32 { + self.state.withLock { state in + state.log?.debug("in supervisor lock to start process") + state.processes.append(process) + } + do { + return try await process.start() + } catch { + self.state.withLock { state in + state.processes.removeAll(where: { $0.id == process.id }) + } + throw error + } + } + + /// Get a Runc instance configured with the reaper command runner + func getRuncWithReaper(_ base: Runc = Runc()) -> Runc { + var runc = base + runc.commandRunner = reaperCommandRunner + return runc + } + + deinit { + source.cancel() + poller.shutdown() + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/Runc/ConsoleSocket.swift b/vminitd/Sources/VminitdCore/Runc/ConsoleSocket.swift new file mode 100644 index 0000000..48d4a02 --- /dev/null +++ b/vminitd/Sources/VminitdCore/Runc/ConsoleSocket.swift @@ -0,0 +1,83 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation + +/// A Unix socket for receiving PTY master file descriptors from runc +final class ConsoleSocket: Sendable { + private let socket: Socket + private let socketPath: String + + /// The path to the console socket + var path: String { socketPath } + + /// Create a new console socket at the specified path + init(path: String) throws { + let absPath = path.starts(with: "/") ? path : FileManager.default.currentDirectoryPath + "/" + path + self.socketPath = absPath + + let pathURL = URL(fileURLWithPath: absPath) + let dir = pathURL.deletingLastPathComponent().path + try FileManager.default.createDirectory( + atPath: dir, + withIntermediateDirectories: true, + attributes: nil + ) + + let socketType = try UnixType(path: absPath, unlinkExisting: true) + self.socket = try Socket(type: socketType) + + try socket.listen() + } + + /// Create a temporary console socket in the runtime directory + static func temporary() throws -> ConsoleSocket { + let tmpDir = "/tmp" + let socketDir = tmpDir + "/runc-console-\(UUID().uuidString)" + let socketPath = socketDir + "/console.sock" + + try FileManager.default.createDirectory( + atPath: socketDir, + withIntermediateDirectories: true, + attributes: nil + ) + + let socket = try ConsoleSocket(path: socketPath) + return socket + } + + /// Receive the PTY master file descriptor from runc + func receiveMaster() throws -> Int32 { + let connection = try socket.accept() + defer { try? connection.close() } + return try connection.receiveFileDescriptor() + } + + /// Close the socket and optionally remove the socket file + func close() throws { + try socket.close() + try FileManager.default.removeItem(atPath: socketPath) + } + + deinit { + try? close() + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/Runc/Runc.swift b/vminitd/Sources/VminitdCore/Runc/Runc.swift new file mode 100644 index 0000000..9c5447b --- /dev/null +++ b/vminitd/Sources/VminitdCore/Runc/Runc.swift @@ -0,0 +1,794 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOCI +import ContainerizationOS +import Foundation + +/// Log format for runc output +enum LogFormat: String, Sendable { + case json + case text +} + +/// Configuration and client for interacting with the runc binary +struct Runc: Sendable { + /// IO configuration for runc operations + struct IO: Sendable { + var stdin: FileHandle? + var stdout: FileHandle? + var stderr: FileHandle? + + init( + stdin: FileHandle? = nil, + stdout: FileHandle? = nil, + stderr: FileHandle? = nil + ) { + self.stdin = stdin + self.stdout = stdout + self.stderr = stderr + } + + static let inherit = IO() + } + + /// Path to the runc binary + var command: String + + /// Root directory for container state + var root: String? + + /// Enable debug output + var debug: Bool + + /// Path to log file + var log: String? + + /// Format for log output + var logFormat: LogFormat? + + /// Signal to send when parent process dies + var pdeathSignal: Int32? + + /// Set process group ID + var setpgid: Bool + + /// Path to criu binary for checkpoint/restore + var criu: String? + + /// Use systemd cgroup manager + var systemdCgroup: Bool + + /// Enable rootless mode + var rootless: Bool + + /// Additional arguments to pass to runc + var extraArgs: [String] + + /// Command runner to use instead of direct wait4 (for PID 1 environments with reapers) + var commandRunner: (any CommandRunner)? + + init( + command: String = "runc", + root: String? = nil, + debug: Bool = false, + log: String? = nil, + logFormat: LogFormat? = nil, + pdeathSignal: Int32? = nil, + setpgid: Bool = false, + criu: String? = nil, + systemdCgroup: Bool = false, + rootless: Bool = false, + extraArgs: [String] = [], + commandRunner: (any CommandRunner)? = nil + ) { + self.command = command + self.root = root + self.debug = debug + self.log = log + self.logFormat = logFormat + self.pdeathSignal = pdeathSignal + self.setpgid = setpgid + self.criu = criu + self.systemdCgroup = systemdCgroup + self.rootless = rootless + self.extraArgs = extraArgs + self.commandRunner = commandRunner + } +} + +/// Options for creating a container +struct CreateOpts: Sendable { + /// Path to file to write container PID + var pidFile: String? + + /// Path to console socket for terminal access + var consoleSocket: String? + + /// Detach from the container process + var detach: Bool + + /// Do not use pivot_root to change root + var noPivot: Bool + + /// Do not create a new session + var noNewKeyring: Bool + + /// Additional file descriptors to pass to the container + var extraFiles: [FileHandle] + + /// IO configuration for the runc process + var io: Runc.IO + + init( + pidFile: String? = nil, + consoleSocket: String? = nil, + detach: Bool = false, + noPivot: Bool = false, + noNewKeyring: Bool = false, + extraFiles: [FileHandle] = [], + io: Runc.IO = .inherit + ) { + self.pidFile = pidFile + self.consoleSocket = consoleSocket + self.detach = detach + self.noPivot = noPivot + self.noNewKeyring = noNewKeyring + self.extraFiles = extraFiles + self.io = io + } +} + +/// Options for executing a process in a container +struct ExecOpts: Sendable { + /// Path to file to write process PID + var pidFile: String? + + /// Path to console socket for terminal access + var consoleSocket: String? + + /// Detach from the process + var detach: Bool + + /// Path to process.json file + var processPath: String? + + /// IO configuration for the runc process + var io: Runc.IO + + init( + pidFile: String? = nil, + consoleSocket: String? = nil, + detach: Bool = false, + processPath: String? = nil, + io: Runc.IO = .inherit + ) { + self.pidFile = pidFile + self.consoleSocket = consoleSocket + self.detach = detach + self.processPath = processPath + self.io = io + } +} + +/// Options for deleting a container +struct DeleteOpts: Sendable { + /// Force deletion of a running container + var force: Bool + + init(force: Bool = false) { + self.force = force + } +} + +/// Options for restoring a container from checkpoint +struct RestoreOpts: Sendable { + /// Path to file to write container PID + var pidFile: String? + + /// Path to console socket for terminal access + var consoleSocket: String? + + /// Detach from the container process + var detach: Bool + + /// Do not use pivot_root to change root + var noPivot: Bool + + /// Do not create a new session + var noNewKeyring: Bool + + /// Path to checkpoint image + var imagePath: String? + + /// Path to parent checkpoint + var parentPath: String? + + /// Work directory for CRIU + var workPath: String? + + init( + pidFile: String? = nil, + consoleSocket: String? = nil, + detach: Bool = false, + noPivot: Bool = false, + noNewKeyring: Bool = false, + imagePath: String? = nil, + parentPath: String? = nil, + workPath: String? = nil + ) { + self.pidFile = pidFile + self.consoleSocket = consoleSocket + self.detach = detach + self.noPivot = noPivot + self.noNewKeyring = noNewKeyring + self.imagePath = imagePath + self.parentPath = parentPath + self.workPath = workPath + } +} + +/// Container information returned from list operation +struct Container: Sendable, Codable { + let id: String + let pid: Int + let status: String + let bundle: String + let rootfs: String + let created: Date + let annotations: [String: String]? + + enum CodingKeys: String, CodingKey { + case id + case pid + case status + case bundle + case rootfs + case created + case annotations + } +} + +extension Runc { + enum Error: Swift.Error, CustomStringConvertible { + case invalidJSON(String) + case commandFailed(Int32, String) + case invalidPidFile(String) + + var description: String { + switch self { + case .invalidJSON(let detail): + return "invalid JSON: \(detail)" + case .commandFailed(let status, let output): + return "command failed with status \(status): \(output)" + case .invalidPidFile(let path): + return "invalid or missing PID file: \(path)" + } + } + } +} + +// MARK: - Command Building and Execution + +extension Runc { + /// Build base arguments for runc command + func baseArgs() -> [String] { + var args: [String] = [] + + if let root = root { + args += ["--root", root] + } + + if debug { + args.append("--debug") + } + + if let log = log { + args += ["--log", log] + } + + if let logFormat = logFormat { + args += ["--log-format", logFormat.rawValue] + } + + if systemdCgroup { + args.append("--systemd-cgroup") + } + + if rootless { + args.append("--rootless") + } + + args += extraArgs + + return args + } + + /// Execute a runc command and return the output + func execute( + args: [String], + stdin: FileHandle? = nil, + stdout: FileHandle? = nil, + stderr: FileHandle? = nil, + extraFiles: [FileHandle] = [], + directory: String? = nil + ) async throws -> (status: Int32, output: Data) { + var cmd = Command( + command, + arguments: args, + directory: directory, + extraFiles: extraFiles + ) + + // Setup IO + let outPipe = Pipe() + cmd.stdin = stdin + cmd.stdout = stdout ?? outPipe.fileHandleForWriting + cmd.stderr = stderr ?? outPipe.fileHandleForWriting + + if let pdeathSignal = pdeathSignal { + cmd.attrs.pdeathSignal = pdeathSignal + } + + if setpgid { + cmd.attrs.setPGroup = true + } + + let exitStatus: Int32 + + if let runner = commandRunner { + let subscription = try runner.start(&cmd) + exitStatus = try await runner.wait(cmd, subscription: subscription) + } else { + try cmd.start() + exitStatus = try cmd.wait() + } + + var output = Data() + if stdout == nil { + try? outPipe.fileHandleForWriting.close() + output = try outPipe.fileHandleForReading.readToEnd() ?? Data() + } + + return (exitStatus, output) + } + + /// Execute command and parse JSON output + func executeJSON( + args: [String], + directory: String? = nil + ) async throws -> T { + let (status, output) = try await execute(args: args, directory: directory) + + guard status == 0 else { + let errorOutput = String(data: output, encoding: .utf8) ?? "" + throw Error.commandFailed(status, errorOutput) + } + + do { + return try JSONDecoder().decode(T.self, from: output) + } catch { + let outputStr = String(data: output, encoding: .utf8) ?? "" + throw Error.invalidJSON("failed to decode: \(error), output: \(outputStr)") + } + } + + /// Execute command without capturing output + func executeVoid( + args: [String], + stdin: FileHandle? = nil, + stdout: FileHandle? = nil, + stderr: FileHandle? = nil, + extraFiles: [FileHandle] = [], + directory: String? = nil + ) async throws { + let (status, output) = try await execute( + args: args, + stdin: stdin, + stdout: stdout, + stderr: stderr, + extraFiles: extraFiles, + directory: directory + ) + + guard status == 0 else { + let errorOutput = String(data: output, encoding: .utf8) ?? "" + throw Error.commandFailed(status, errorOutput) + } + } + + /// Read PID from a file + func readPidFile(_ path: String) throws -> Int { + guard let data = try? Data(contentsOf: URL(fileURLWithPath: path)), + let pidString = String(data: data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines), + let pid = Int(pidString) + else { + throw Error.invalidPidFile(path) + } + return pid + } +} + +extension Runc { + /// Create a container + func create( + id: String, + bundle: String, + opts: CreateOpts = CreateOpts() + ) async throws -> Int? { + var args = baseArgs() + ["create"] + + if let pidFile = opts.pidFile { + args += ["--pid-file", pidFile] + } + + if let consoleSocket = opts.consoleSocket { + args += ["--console-socket", consoleSocket] + } + + if opts.detach { + args.append("--detach") + } + + if opts.noPivot { + args.append("--no-pivot") + } + + if opts.noNewKeyring { + args.append("--no-new-keyring") + } + + args += ["--bundle", bundle, id] + + try await executeVoid( + args: args, + stdin: opts.io.stdin, + stdout: opts.io.stdout, + stderr: opts.io.stderr, + extraFiles: opts.extraFiles, + directory: bundle + ) + + // Read PID if pidFile was specified + if let pidFile = opts.pidFile { + return try readPidFile(pidFile) + } + + return nil + } + + /// Start a container + func start(id: String) async throws { + let args = baseArgs() + ["start", id] + try await executeVoid(args: args) + } + + /// Run a container (create + start) + func run( + id: String, + bundle: String, + opts: CreateOpts = CreateOpts() + ) async throws -> Int? { + var args = baseArgs() + ["run"] + + if let pidFile = opts.pidFile { + args += ["--pid-file", pidFile] + } + + if let consoleSocket = opts.consoleSocket { + args += ["--console-socket", consoleSocket] + } + + if opts.detach { + args.append("--detach") + } + + if opts.noPivot { + args.append("--no-pivot") + } + + if opts.noNewKeyring { + args.append("--no-new-keyring") + } + + args += ["--bundle", bundle, id] + + try await executeVoid( + args: args, + stdin: opts.io.stdin, + stdout: opts.io.stdout, + stderr: opts.io.stderr, + extraFiles: opts.extraFiles, + directory: bundle + ) + + // Read PID if pidFile was specified + if let pidFile = opts.pidFile { + return try readPidFile(pidFile) + } + + return nil + } + + /// Delete a container + func delete(id: String, opts: DeleteOpts = DeleteOpts()) async throws { + var args = baseArgs() + ["delete"] + + if opts.force { + args.append("--force") + } + + args.append(id) + + try await executeVoid(args: args) + } + + /// Send a signal to a container + func kill(id: String, signal: Int32, all: Bool = false) async throws { + var args = baseArgs() + ["kill"] + + if all { + args.append("--all") + } + + args += [id, String(signal)] + + try await executeVoid(args: args) + } + + /// Pause a container + func pause(id: String) async throws { + let args = baseArgs() + ["pause", id] + try await executeVoid(args: args) + } + + /// Resume a paused container + func resume(id: String) async throws { + let args = baseArgs() + ["resume", id] + try await executeVoid(args: args) + } + + /// Execute a process in a running container + func exec( + id: String, + processSpec: String, + opts: ExecOpts = ExecOpts() + ) async throws -> Int? { + var args = baseArgs() + ["exec"] + + if let pidFile = opts.pidFile { + args += ["--pid-file", pidFile] + } + + if let consoleSocket = opts.consoleSocket { + args += ["--console-socket", consoleSocket] + } + + if opts.detach { + args.append("--detach") + } + + if let processPath = opts.processPath { + args += ["--process", processPath] + } + + args += [id, processSpec] + + try await executeVoid( + args: args, + stdin: opts.io.stdin, + stdout: opts.io.stdout, + stderr: opts.io.stderr + ) + + // Read PID if pidFile was specified + if let pidFile = opts.pidFile { + return try readPidFile(pidFile) + } + + return nil + } + + /// Update container resources + func update(id: String, resources: String) async throws { + let args = baseArgs() + ["update", "--resources", resources, id] + try await executeVoid(args: args) + } + + /// Checkpoint a container + func checkpoint( + id: String, + imagePath: String, + leaveRunning: Bool = false, + workPath: String? = nil + ) async throws { + var args = baseArgs() + ["checkpoint"] + + if leaveRunning { + args.append("--leave-running") + } + + if let workPath = workPath { + args += ["--work-path", workPath] + } + + args += ["--image-path", imagePath, id] + + try await executeVoid(args: args) + } + + /// Restore a container from checkpoint + func restore( + id: String, + bundle: String, + opts: RestoreOpts = RestoreOpts() + ) async throws -> Int? { + var args = baseArgs() + ["restore"] + + if let pidFile = opts.pidFile { + args += ["--pid-file", pidFile] + } + + if let consoleSocket = opts.consoleSocket { + args += ["--console-socket", consoleSocket] + } + + if opts.detach { + args.append("--detach") + } + + if opts.noPivot { + args.append("--no-pivot") + } + + if opts.noNewKeyring { + args.append("--no-new-keyring") + } + + if let imagePath = opts.imagePath { + args += ["--image-path", imagePath] + } + + if let parentPath = opts.parentPath { + args += ["--parent-path", parentPath] + } + + if let workPath = opts.workPath { + args += ["--work-path", workPath] + } + + args += ["--bundle", bundle, id] + + try await executeVoid(args: args, directory: bundle) + + if let pidFile = opts.pidFile { + return try readPidFile(pidFile) + } + + return nil + } +} + +// MARK: - List and State Operations + +extension Runc { + /// List all containers + func list() async throws -> [Container] { + let args = baseArgs() + ["list", "--format", "json"] + let containers: [Container] = try await executeJSON(args: args) + return containers + } + + /// Get state of a specific container + func state(id: String) async throws -> ContainerizationOCI.State { + let args = baseArgs() + ["state", id] + let state: ContainerizationOCI.State = try await executeJSON(args: args) + return state + } + + /// List process IDs in a container + func ps(id: String) async throws -> [Int] { + let args = baseArgs() + ["ps", "--format", "json", id] + let (status, output) = try await execute(args: args) + + guard status == 0 else { + let errorOutput = String(data: output, encoding: .utf8) ?? "" + throw Error.commandFailed(status, errorOutput) + } + + // ps output is just an array of PIDs + let pids = try JSONDecoder().decode([Int].self, from: output) + return pids + } + + /// Get version information + func version() async throws -> String { + let args = [command, "--version"] + let (status, output) = try await execute(args: args) + + guard status == 0 else { + let errorOutput = String(data: output, encoding: .utf8) ?? "" + throw Error.commandFailed(status, errorOutput) + } + + return String(data: output, encoding: .utf8) ?? "" + } +} + +// MARK: - Events + +extension Runc { + /// Event from container runtime + struct Event: Codable, Sendable { + let type: String + let id: String + let stats: EventStats? + + enum CodingKeys: String, CodingKey { + case type + case id + case stats + } + } + + /// Statistics in an event + struct EventStats: Codable, Sendable { + let cpu: CPUStats? + let memory: MemoryStats? + let pids: PIDStats? + + enum CodingKeys: String, CodingKey { + case cpu + case memory + case pids + } + } + + struct CPUStats: Codable, Sendable { + let usage: CPUUsage? + let throttling: ThrottlingData? + + struct CPUUsage: Codable, Sendable { + let total: UInt64? + let percpu: [UInt64]? + } + + struct ThrottlingData: Codable, Sendable { + let periods: UInt64? + let throttledPeriods: UInt64? + let throttledTime: UInt64? + } + } + + struct MemoryStats: Codable, Sendable { + let usage: MemoryUsage? + let limit: UInt64? + + struct MemoryUsage: Codable, Sendable { + let usage: UInt64? + let max: UInt64? + } + } + + struct PIDStats: Codable, Sendable { + let current: UInt64? + let limit: UInt64? + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/RuncProcess.swift b/vminitd/Sources/VminitdCore/RuncProcess.swift new file mode 100644 index 0000000..eae35f8 --- /dev/null +++ b/vminitd/Sources/VminitdCore/RuncProcess.swift @@ -0,0 +1,564 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Containerization +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +/// A container process implementation that uses runc as the OCI runtime +final class RuncProcess: ContainerProcess, Sendable { + // swiftlint: disable type_name + protocol IO: Sendable { + func attachConsole(fd: Int32) throws + func create() throws + func getIO() -> Runc.IO + func closeAfterExec() throws + func resize(size: Terminal.Size) throws + func close() throws + func closeStdin() throws + } + // swiftlint: enable type_name + + private enum ProcessState { + case initial + case creating + case running(pid: Int32) + case exited(ContainerExitStatus) + } + + private struct State { + var state: ProcessState = .initial + var waiters: [CheckedContinuation] = [] + } + + let id: String + + private let log: Logger + private let runc: Runc + private let io: IO + private let state: Mutex + private let terminal: Bool + private let bundle: ContainerizationOCI.Bundle + private let consoleSocket: ConsoleSocket? + + var pid: Int32? { + self.state.withLock { + switch $0.state { + case .running(let pid): + return pid + default: + return nil + } + } + } + + init( + id: String, + stdio: HostStdio, + bundle: ContainerizationOCI.Bundle, + runc: Runc, + log: Logger + ) throws { + self.id = id + var log = log + log[metadataKey: "id"] = "\(id)" + self.log = log + self.runc = runc + self.bundle = bundle + self.terminal = stdio.terminal + + var io: IO + var consoleSocket: ConsoleSocket? = nil + + if stdio.terminal { + log.info("setting up terminal I/O for runc") + let socket = try ConsoleSocket.temporary() + consoleSocket = socket + io = try RuncTerminalIO( + stdio: stdio, + log: log + ) + } else { + io = RuncStandardIO( + stdio: stdio, + log: log + ) + } + + log.info("starting I/O for runc") + try io.create() + + self.consoleSocket = consoleSocket + self.io = io + self.state = Mutex(State()) + } + + func start() async throws -> Int32 { + try self.state.withLock { + guard case .initial = $0.state else { + throw ContainerizationError( + .invalidState, + message: "container already started" + ) + } + $0.state = .creating + } + + log.info( + "starting runc process", + metadata: [ + "id": "\(id)" + ]) + + let pidFilePath = self.bundle.path.appendingPathComponent("runc-pid").path + let runcIO = self.io.getIO() + + let opts: CreateOpts + if let consoleSocket { + opts = CreateOpts( + pidFile: pidFilePath, + consoleSocket: consoleSocket.path, + io: runcIO + ) + } else { + opts = CreateOpts( + pidFile: pidFilePath, + io: runcIO + ) + } + + guard + let pidInt = try await self.runc.create( + id: self.id, + bundle: self.bundle.path.path, + opts: opts + ) + else { + throw ContainerizationError( + .internalError, + message: "runc create did not return a PID" + ) + } + + let pid = Int32(pidInt) + + self.log.info( + "container created", + metadata: [ + "pid": "\(pid)" + ]) + + // Close the pipe ends we gave to runc now that it has inherited them + // and attach console if in terminal mode + if self.terminal, let consoleSocket = self.consoleSocket { + self.log.info("waiting for console FD from runc") + let ptyFd = try consoleSocket.receiveMaster() + + self.log.info( + "received PTY FD from runc, attaching", + metadata: [ + "id": "\(self.id)" + ]) + + try self.io.closeAfterExec() + try self.io.attachConsole(fd: ptyFd) + } else { + try self.io.closeAfterExec() + } + + try await self.runc.start(id: self.id) + + self.state.withLock { + $0.state = .running(pid: pid) + } + + self.log.info( + "started runc process", + metadata: [ + "pid": "\(pid)", + "id": "\(self.id)", + ]) + + return pid + } + + func setExit(_ status: Int32) { + self.state.withLock { + self.log.info( + "runc process exit", + metadata: [ + "status": "\(status)" + ]) + + let exitStatus = ContainerExitStatus(exitCode: status, exitedAt: Date.now) + $0.state = .exited(exitStatus) + + do { + try self.io.close() + } catch { + self.log.error("failed to close I/O for process: \(error)") + } + + for waiter in $0.waiters { + waiter.resume(returning: exitStatus) + } + + self.log.debug("\($0.waiters.count) runc process waiters signaled") + $0.waiters.removeAll() + } + } + + func wait() async -> ContainerExitStatus { + await withCheckedContinuation { cont in + self.state.withLock { + if case .exited(let exitStatus) = $0.state { + cont.resume(returning: exitStatus) + return + } + $0.waiters.append(cont) + } + } + } + + func kill(_ signal: Int32) async throws { + self.log.info("sending signal \(signal) to runc container \(id)") + try await self.runc.kill(id: self.id, signal: signal) + } + + func resize(size: Terminal.Size) throws { + try self.state.withLock { + if case .exited = $0.state { + return + } + try self.io.resize(size: size) + } + } + + func closeStdin() throws { + try self.io.closeStdin() + } + + func delete() async throws { + let shouldDelete = self.state.withLock { state -> Bool in + switch state.state { + case .initial, .creating: + return false + default: + return true + } + } + + guard shouldDelete else { + log.info("container was never created, skipping delete") + return + } + + log.info("deleting runc container", metadata: ["id": "\(id)"]) + + try await self.runc.delete( + id: self.id, + opts: DeleteOpts(force: true) + ) + + if let consoleSocket = self.consoleSocket { + try consoleSocket.close() + } + } +} + +// MARK: - RuncTerminalIO + +final class RuncTerminalIO: RuncProcess.IO & Sendable { + private struct State { + var stdinSocket: Socket? + var stdoutSocket: Socket? + + var stdin: IOPair? + var stdout: IOPair? + var terminal: Terminal? + } + + private let log: Logger? + private let hostStdio: HostStdio + private let state: Mutex + + init( + stdio: HostStdio, + log: Logger? + ) throws { + self.hostStdio = stdio + self.log = log + self.state = Mutex(State()) + } + + func resize(size: Terminal.Size) throws { + try self.state.withLock { + if let terminal = $0.terminal { + try terminal.resize(size: size) + } + } + } + + func create() throws { + try self.state.withLock { + if let stdinPort = self.hostStdio.stdin { + let type = VsockType( + port: stdinPort, + cid: VsockType.hostCID + ) + let stdinSocket = try Socket(type: type, closeOnDeinit: false) + try stdinSocket.connect() + $0.stdinSocket = stdinSocket + } + + if let stdoutPort = self.hostStdio.stdout { + let type = VsockType( + port: stdoutPort, + cid: VsockType.hostCID + ) + let stdoutSocket = try Socket(type: type, closeOnDeinit: false) + try stdoutSocket.connect() + $0.stdoutSocket = stdoutSocket + } + } + } + + func getIO() -> Runc.IO { + // Terminal mode doesn't pass pipes to runc, it uses the console socket + .inherit + } + + func closeAfterExec() throws { + // No pipes to close in terminal mode + } + + func attachConsole(fd: Int32) throws { + try self.state.withLock { + let term = try Terminal(descriptor: fd, setInitState: false) + $0.terminal = term + + if let stdinSocket = $0.stdinSocket { + let pair = IOPair( + readFrom: stdinSocket, + writeTo: term, + reason: "RuncTerminalIO stdin", + logger: log + ) + try pair.relay(ignoreHup: true) + $0.stdin = pair + } + + if let stdoutSocket = $0.stdoutSocket { + let pair = IOPair( + readFrom: term, + writeTo: stdoutSocket, + reason: "RuncTerminalIO stdout", + logger: log + ) + try pair.relay(ignoreHup: true) + $0.stdout = pair + } + } + } + + func close() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + if let stdout = $0.stdout { + stdout.close() + $0.stdout = nil + } + $0.terminal = nil + } + } + + func closeStdin() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + } + } +} + +// MARK: - RuncStandardIO + +final class RuncStandardIO: RuncProcess.IO & Sendable { + private struct State { + var stdin: IOPair? + var stdout: IOPair? + var stderr: IOPair? + + var stdinPipe: Pipe? + var stdoutPipe: Pipe? + var stderrPipe: Pipe? + } + + private let log: Logger? + private let hostStdio: HostStdio + private let state: Mutex + + init( + stdio: HostStdio, + log: Logger? + ) { + self.hostStdio = stdio + self.log = log + self.state = Mutex(State()) + } + + // NOP for non-terminal + func attachConsole(fd: Int32) throws {} + + func create() throws { + try self.state.withLock { + if let stdinPort = self.hostStdio.stdin { + let inPipe = Pipe() + $0.stdinPipe = inPipe + + let type = VsockType( + port: stdinPort, + cid: VsockType.hostCID + ) + let stdinSocket = try Socket(type: type, closeOnDeinit: false) + try stdinSocket.connect() + + let pair = IOPair( + readFrom: stdinSocket, + writeTo: inPipe.fileHandleForWriting, + reason: "RuncStandardIO stdin", + logger: log + ) + $0.stdin = pair + try pair.relay() + } + + if let stdoutPort = self.hostStdio.stdout { + let outPipe = Pipe() + $0.stdoutPipe = outPipe + + let type = VsockType( + port: stdoutPort, + cid: VsockType.hostCID + ) + let stdoutSocket = try Socket(type: type, closeOnDeinit: false) + try stdoutSocket.connect() + + let pair = IOPair( + readFrom: outPipe.fileHandleForReading, + writeTo: stdoutSocket, + reason: "RuncStandardIO stdout", + logger: log + ) + $0.stdout = pair + try pair.relay() + } + + if let stderrPort = self.hostStdio.stderr { + let errPipe = Pipe() + $0.stderrPipe = errPipe + + let type = VsockType( + port: stderrPort, + cid: VsockType.hostCID + ) + let stderrSocket = try Socket(type: type, closeOnDeinit: false) + try stderrSocket.connect() + + let pair = IOPair( + readFrom: errPipe.fileHandleForReading, + writeTo: stderrSocket, + reason: "RuncStandardIO stderr", + logger: log + ) + $0.stderr = pair + try pair.relay() + } + } + } + + func getIO() -> Runc.IO { + self.state.withLock { + Runc.IO( + stdin: $0.stdinPipe?.fileHandleForReading, + stdout: $0.stdoutPipe?.fileHandleForWriting, + stderr: $0.stderrPipe?.fileHandleForWriting + ) + } + } + + func closeAfterExec() throws { + try self.state.withLock { + // Close the pipe ends we gave to runc (the child inherited them) + if let stdinPipe = $0.stdinPipe { + try stdinPipe.fileHandleForReading.close() + $0.stdinPipe = nil + } + if let stdoutPipe = $0.stdoutPipe { + try stdoutPipe.fileHandleForWriting.close() + $0.stdoutPipe = nil + } + if let stderrPipe = $0.stderrPipe { + try stderrPipe.fileHandleForWriting.close() + $0.stderrPipe = nil + } + } + } + + func resize(size: Terminal.Size) throws { + throw ContainerizationError(.unsupported, message: "resize not supported for standard IO") + } + + func close() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + + if let stdout = $0.stdout { + stdout.close() + $0.stdout = nil + } + + if let stderr = $0.stderr { + stderr.close() + $0.stderr = nil + } + } + } + + func closeStdin() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/Server+GRPC.swift b/vminitd/Sources/VminitdCore/Server+GRPC.swift new file mode 100644 index 0000000..ff6d1c5 --- /dev/null +++ b/vminitd/Sources/VminitdCore/Server+GRPC.swift @@ -0,0 +1,1822 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import Cgroup +import Containerization +import ContainerizationArchive +import ContainerizationError +import ContainerizationExtras +import ContainerizationNetlink +import ContainerizationOCI +import ContainerizationOS +import Foundation +import GRPCCore +import GRPCProtobuf +import Logging +import NIOCore +import NIOPosix +import SwiftProtobuf +import SystemPackage + +private let _setenv = Foundation.setenv + +#if canImport(Musl) +import Musl +private let _mount = Musl.mount +private let _umount = Musl.umount2 +private let _kill = Musl.kill +private let _sync = Musl.sync +typealias _stat_struct = Musl.stat +private let _stat: @Sendable (UnsafePointer, UnsafeMutablePointer<_stat_struct>) -> Int32 = stat +#elseif canImport(Glibc) +import Glibc +private let _mount = Glibc.mount +private let _umount = Glibc.umount2 +private let _kill = Glibc.kill +private let _sync = Glibc.sync +typealias _stat_struct = Glibc.stat +private let _stat: @Sendable (UnsafePointer, UnsafeMutablePointer<_stat_struct>) -> Int32 = stat +#endif + +extension ContainerizationError { + func toRPCError(operation: String) -> RPCError { + let message = "\(operation): \(self)" + let code: RPCError.Code = { + switch self.code { + case .invalidArgument: + return .invalidArgument + case .notFound: + return .notFound + case .exists: + return .alreadyExists + case .cancelled: + return .cancelled + case .unsupported: + return .unimplemented + case .unknown: + return .unknown + case .internalError: + return .internalError + case .interrupted: + return .unavailable + case .invalidState: + return .failedPrecondition + case .timeout: + return .deadlineExceeded + default: + return .internalError + } + }() + return RPCError(code: code, message: message, cause: self) + } +} + +extension Initd: Com_Apple_Containerization_Sandbox_V3_SandboxContext.SimpleServiceProtocol { + public func setTime( + request: Com_Apple_Containerization_Sandbox_V3_SetTimeRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SetTimeResponse { + log.trace( + "setTime", + metadata: [ + "sec": "\(request.sec)", + "usec": "\(request.usec)", + ]) + + var tv = timeval(tv_sec: time_t(request.sec), tv_usec: suseconds_t(request.usec)) + guard settimeofday(&tv, nil) == 0 else { + let error = swiftErrno("settimeofday") + log.error( + "setTime", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "failed to settimeofday", cause: error) + } + + return .init() + } + + public func setupEmulator( + request: Com_Apple_Containerization_Sandbox_V3_SetupEmulatorRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SetupEmulatorResponse { + log.debug( + "setupEmulator", + metadata: [ + "request": "\(request)" + ]) + + if !Binfmt.mounted() { + throw RPCError( + code: .internalError, + message: "\(Binfmt.path) is not mounted" + ) + } + + do { + let bfmt = Binfmt.Entry( + name: request.name, + type: request.type, + offset: request.offset, + magic: request.magic, + mask: request.mask, + flags: request.flags + ) + try bfmt.register(binaryPath: request.binaryPath) + } catch { + log.error( + "setupEmulator", + metadata: [ + "error": "\(error)" + ]) + throw RPCError( + code: .internalError, + message: "setupEmulator: failed to register binfmt_misc entry", + cause: error + ) + } + + return .init() + } + + public func sysctl( + request: Com_Apple_Containerization_Sandbox_V3_SysctlRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SysctlResponse { + log.debug( + "sysctl", + metadata: [ + "settings": "\(request.settings)" + ]) + + do { + let sysctlPath = URL(fileURLWithPath: "/proc/sys/") + for (k, v) in request.settings { + guard let data = v.data(using: .ascii) else { + throw RPCError(code: .internalError, message: "failed to convert \(v) to data buffer for sysctl write") + } + + let setting = + sysctlPath + .appendingPathComponent(k.replacingOccurrences(of: ".", with: "/")) + let fh = try FileHandle(forWritingTo: setting) + defer { try? fh.close() } + + try fh.write(contentsOf: data) + } + } catch { + log.error( + "sysctl", + metadata: [ + "error": "\(error)" + ]) + throw RPCError( + code: .internalError, + message: "sysctl: failed to set sysctl", + cause: error + ) + } + + return .init() + } + + public func proxyVsock( + request: Com_Apple_Containerization_Sandbox_V3_ProxyVsockRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ProxyVsockResponse { + log.debug( + "proxyVsock", + metadata: [ + "id": "\(request.id)", + "port": "\(request.vsockPort)", + "guestPath": "\(request.guestPath)", + "action": "\(request.action)", + ]) + + let proxy = VsockProxy( + id: request.id, + action: request.action == .into ? .dial : .listen, + port: request.vsockPort, + path: URL(fileURLWithPath: request.guestPath), + udsPerms: request.guestSocketPermissions, + log: log + ) + + do { + try await proxy.start() + try await state.add(proxy: proxy) + } catch { + try? await proxy.close() + log.error( + "proxyVsock", + metadata: [ + "error": "\(error)" + ]) + throw RPCError( + code: .internalError, + message: "proxyVsock: failed to setup vsock proxy", + cause: error + ) + } + + log.info( + "proxyVsock started", + metadata: [ + "id": "\(request.id)", + "port": "\(request.vsockPort)", + "guestPath": "\(request.guestPath)", + ]) + + return .init() + } + + public func stopVsockProxy( + request: Com_Apple_Containerization_Sandbox_V3_StopVsockProxyRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StopVsockProxyResponse { + log.debug( + "stopVsockProxy", + metadata: [ + "id": "\(request.id)" + ]) + + do { + let proxy = try await state.remove(proxy: request.id) + try await proxy.close() + } catch { + log.error( + "stopVsockProxy", + metadata: [ + "error": "\(error)" + ]) + throw RPCError( + code: .internalError, + message: "stopVsockProxy: failed to stop vsock proxy", + cause: error + ) + } + + log.info( + "stopVsockProxy completed", + metadata: [ + "id": "\(request.id)" + ]) + + return .init() + } + + public func mkdir(request: Com_Apple_Containerization_Sandbox_V3_MkdirRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_MkdirResponse + { + log.debug( + "mkdir", + metadata: [ + "path": "\(request.path)", + "all": "\(request.all)", + ]) + + do { + try FileManager.default.createDirectory( + atPath: request.path, + withIntermediateDirectories: request.all + ) + } catch { + log.error( + "mkdir", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "mkdir", cause: error) + } + + return .init() + } + + public func writeFile(request: Com_Apple_Containerization_Sandbox_V3_WriteFileRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_WriteFileResponse + { + log.debug( + "writeFile", + metadata: [ + "path": "\(request.path)", + "mode": "\(request.mode)", + "dataSize": "\(request.data.count)", + ]) + + do { + if request.flags.createParentDirs { + let fileURL = URL(fileURLWithPath: request.path) + let parentDir = fileURL.deletingLastPathComponent() + try FileManager.default.createDirectory( + at: parentDir, + withIntermediateDirectories: true + ) + } + + var flags = O_WRONLY + if request.flags.createIfMissing { + flags |= O_CREAT + } + if request.flags.append { + flags |= O_APPEND + } + + let mode = request.mode > 0 ? mode_t(request.mode) : mode_t(0644) + let fd = open(request.path, flags, mode) + guard fd != -1 else { + let error = swiftErrno("open") + throw RPCError( + code: .internalError, + message: "writeFile: failed to open file", + cause: error + ) + } + + let fh = FileHandle(fileDescriptor: fd, closeOnDealloc: true) + try fh.write(contentsOf: request.data) + } catch { + log.error( + "writeFile", + metadata: [ + "error": "\(error)" + ]) + if error is RPCError { + throw error + } + throw RPCError( + code: .internalError, + message: "writeFile", + cause: error + ) + } + + return .init() + } + + public func stat( + request: Com_Apple_Containerization_Sandbox_V3_StatRequest, + context: GRPCCore.ServerContext, + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StatResponse { + log.debug( + "stat", + metadata: [ + "path": "\(request.path)" + ] + ) + + #if os(Linux) + var s = _stat_struct() + let result = _stat(request.path, &s) + if result == -1 { + let error = swiftErrno("stat") + if error.code == .ENOENT { + throw RPCError( + code: .notFound, + message: "stat: path not found '\(request.path)'", + cause: error + ) + } + return .with { $0.error = "\(error)" } + } + return .with { + $0.stat = .with { + $0.dev = UInt64(s.st_dev) + $0.ino = UInt64(s.st_ino) + $0.mode = s.st_mode + $0.nlink = UInt64(s.st_nlink) + $0.uid = s.st_uid + $0.gid = s.st_gid + $0.rdev = UInt64(s.st_rdev) + $0.size = Int64(s.st_size) + $0.blksize = Int64(s.st_blksize) + $0.blocks = Int64(s.st_blocks) + $0.atime = .with { + $0.seconds = Int64(s.st_atim.tv_sec) + $0.nanos = Int32(s.st_atim.tv_nsec) + } + $0.mtime = .with { + $0.seconds = Int64(s.st_mtim.tv_sec) + $0.nanos = Int32(s.st_mtim.tv_nsec) + } + $0.ctime = .with { + $0.seconds = Int64(s.st_ctim.tv_sec) + $0.nanos = Int32(s.st_ctim.tv_nsec) + } + } + } + #else + fatalError("stat not supported on platform") + #endif + } + + // Chunk size for streaming file transfers (1MB). + private static let copyChunkSize = 1024 * 1024 + + public func copy( + request: Com_Apple_Containerization_Sandbox_V3_CopyRequest, + response: GRPCCore.RPCWriter, + context: GRPCCore.ServerContext + ) async throws { + let path = request.path + let vsockPort = request.vsockPort + + log.debug( + "copy", + metadata: [ + "direction": "\(request.direction)", + "path": "\(path)", + "vsockPort": "\(vsockPort)", + "isArchive": "\(request.isArchive)", + "mode": "\(request.mode)", + "createParents": "\(request.createParents)", + ]) + + do { + switch request.direction { + case .copyIn: + try await handleCopyIn(request: request, response: response) + case .copyOut: + try await handleCopyOut(request: request, response: response) + case .UNRECOGNIZED(let value): + throw RPCError(code: .invalidArgument, message: "copy: unrecognized direction \(value)") + } + } catch { + log.error( + "copy failed", + metadata: [ + "direction": "\(request.direction)", + "path": "\(path)", + "error": "\(error)", + ]) + if error is RPCError { + throw error + } + throw RPCError(code: .internalError, message: "copy failed", cause: error) + } + } + + /// Handle a COPY_IN request: connect to host vsock port, read data, write to guest filesystem. + private func handleCopyIn( + request: Com_Apple_Containerization_Sandbox_V3_CopyRequest, + response: GRPCCore.RPCWriter + ) async throws { + let path = request.path + let isArchive = request.isArchive + + if request.createParents { + let parentDir = URL(fileURLWithPath: path).deletingLastPathComponent() + try FileManager.default.createDirectory(at: parentDir, withIntermediateDirectories: true) + } + + // Connect to the host's vsock port for data transfer. + let vsockType = VsockType(port: request.vsockPort, cid: VsockType.hostCID) + let sock = try Socket(type: vsockType, closeOnDeinit: false) + try sock.connect() + let sockFd = sock.fileDescriptor + + // Dispatch blocking I/O onto the thread pool. + let rejected: [String] = try await blockingPool.runIfActive { [self] in + defer { try? sock.close() } + + guard isArchive else { + let mode = request.mode > 0 ? mode_t(request.mode) : mode_t(0o644) + let fd = open(path, O_WRONLY | O_CREAT | O_TRUNC, mode) + guard fd != -1 else { + throw RPCError( + code: .internalError, + message: "copy: failed to open file '\(path)': \(swiftErrno("open"))" + ) + } + defer { close(fd) } + + var buf = [UInt8](repeating: 0, count: Self.copyChunkSize) + while true { + let n = read(sockFd, &buf, buf.count) + if n == 0 { break } + guard n > 0 else { + throw RPCError( + code: .internalError, + message: "copy: vsock read error: \(swiftErrno("read"))" + ) + } + var written = 0 + while written < n { + let w = buf.withUnsafeBytes { ptr in + write(fd, ptr.baseAddress! + written, n - written) + } + guard w > 0 else { + throw RPCError( + code: .internalError, + message: "copy: write error: \(swiftErrno("write"))" + ) + } + written += w + } + } + return [] + } + let destURL = URL(fileURLWithPath: path) + try FileManager.default.createDirectory(at: destURL, withIntermediateDirectories: true) + + let fileHandle = FileHandle(fileDescriptor: sockFd, closeOnDealloc: false) + let reader = try ArchiveReader(format: .pax, filter: .gzip, fileHandle: fileHandle) + return try reader.extractContents(to: destURL) + } + + if !rejected.isEmpty { + log.info("copy: archive extracted", metadata: ["path": "\(path)", "rejectedCount": "\(rejected.count)"]) + for rejectedPath in rejected { + log.error("copy: rejected archive path", metadata: ["path": "\(rejectedPath)"]) + } + } + + log.debug("copy: copyIn complete", metadata: ["path": "\(path)", "isArchive": "\(isArchive)"]) + + // Send completion response. + try await response.write(.with { $0.status = .complete }) + } + + /// Handle a COPY_OUT request: stat path, send metadata, connect to host vsock port, write data. + private func handleCopyOut( + request: Com_Apple_Containerization_Sandbox_V3_CopyRequest, + response: GRPCCore.RPCWriter + ) async throws { + let path = request.path + var isDirectory: ObjCBool = false + guard FileManager.default.fileExists(atPath: path, isDirectory: &isDirectory) else { + throw RPCError(code: .notFound, message: "copy: path not found '\(path)'") + } + let isArchive = isDirectory.boolValue + + // Determine total size for single files. + var totalSize: UInt64 = 0 + if !isArchive { + let attrs = try FileManager.default.attributesOfItem(atPath: path) + if let size = attrs[.size] as? UInt64 { + totalSize = size + } + } + + // Send metadata response BEFORE connecting to vsock, so host knows what to expect. + try await response.write( + .with { + $0.status = .metadata + $0.isArchive = isArchive + $0.totalSize = totalSize + }) + + // Connect to the host's vsock port and dispatch blocking I/O onto the thread pool. + let vsockType = VsockType(port: request.vsockPort, cid: VsockType.hostCID) + let sock = try Socket(type: vsockType, closeOnDeinit: false) + try sock.connect() + + try await blockingPool.runIfActive { [self] in + defer { try? sock.close() } + + if isArchive { + let fileURL = URL(fileURLWithPath: path) + let writer = try ArchiveWriter(configuration: .init(format: .pax, filter: .gzip)) + try writer.open(fileDescriptor: sock.fileDescriptor) + try writer.archiveDirectory(fileURL) + try writer.finishEncoding() + } else { + let srcFd = open(path, O_RDONLY) + guard srcFd != -1 else { + throw RPCError( + code: .internalError, + message: "copy: failed to open '\(path)': \(swiftErrno("open"))" + ) + } + defer { close(srcFd) } + + var buf = [UInt8](repeating: 0, count: Self.copyChunkSize) + while true { + let n = read(srcFd, &buf, buf.count) + if n == 0 { break } + guard n > 0 else { + throw RPCError( + code: .internalError, + message: "copy: read error: \(swiftErrno("read"))" + ) + } + var written = 0 + while written < n { + let w = buf.withUnsafeBytes { ptr in + write(sock.fileDescriptor, ptr.baseAddress! + written, n - written) + } + guard w > 0 else { + throw RPCError( + code: .internalError, + message: "copy: vsock write error: \(swiftErrno("write"))" + ) + } + written += w + } + } + } + } + + log.debug( + "copy: copyOut complete", + metadata: [ + "path": "\(path)", + "isArchive": "\(isArchive)", + ]) + + // Send completion response after vsock data transfer is done. + try await response.write(.with { $0.status = .complete }) + } + + public func mount(request: Com_Apple_Containerization_Sandbox_V3_MountRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_MountResponse + { + log.debug( + "mount", + metadata: [ + "type": "\(request.type)", + "source": "\(request.source)", + "destination": "\(request.destination)", + ]) + + do { + let mnt = ContainerizationOS.Mount( + type: request.type, + source: request.source, + target: request.destination, + options: request.options + ) + + #if os(Linux) + try mnt.mount(createWithPerms: 0o755) + return .init() + #else + fatalError("mount not supported on platform") + #endif + } catch { + log.error( + "mount", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "mount", cause: error) + } + } + + public func filesystemOperation(request: Com_Apple_Containerization_Sandbox_V3_FilesystemOperationRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_FilesystemOperationResponse + { + let path = FilePath(request.path) + + log.debug( + "filesystemOperation", + metadata: [ + "operation": "\(String(describing: request.operation))", + "path": "\(path)", + ]) + + if !path.isAbsolute { + throw RPCError(code: .invalidArgument, message: "path must be absolute") + } + + var finfo = _stat_struct() + let rc = _stat(path.string, &finfo) + if rc != 0 { + let error = swiftErrno("stat") + throw RPCError(code: .notFound, message: "failed to stat path", cause: error) + } + + let fd = open(path.string, O_RDONLY | O_NOFOLLOW) + if fd < 0 { + if errno == ELOOP { + throw RPCError(code: .internalError, message: "path cannot be a symlink") + } + let error = swiftErrno("open") + throw RPCError(code: .internalError, message: "failed to open path", cause: error) + } + + defer { close(fd) } + + do { + switch request.operation { + case .freeze: + try freezeFilesystem(fd: fd) + case .thaw: + try thawFilesystem(fd: fd) + case .trim(let params): + switch params.schedule { + case .oneShot: + try trimFilesystem(fd: fd) + case .none: + throw RPCError(code: .invalidArgument, message: "trim schedule must be specified") + } + case .none: + throw RPCError(code: .invalidArgument, message: "invalid operation") + } + } catch { + log.error( + "filesystemOperation", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "filesystemOperation", cause: error) + } + + return .init() + } + + private func freezeFilesystem(fd: Int32) throws { + let FIFREEZE: UInt = 0xC004_5877 + let rc: CInt = ioctl(fd, FIFREEZE, 0) + if rc != 0 { + let error = swiftErrno("ioctl(FIFREEZE)") + throw RPCError(code: .internalError, message: "freeze failed", cause: error) + } + } + + private func thawFilesystem(fd: Int32) throws { + let FITHAW: UInt = 0xC004_5878 + let rc: CInt = ioctl(fd, FITHAW, 0) + if rc != 0 { + let error = swiftErrno("ioctl(FITHAW)") + throw RPCError(code: .internalError, message: "thaw failed", cause: error) + } + } + + private struct fitrim_range { + var start: UInt64 + var len: UInt64 + var min_len: UInt64 + } + + private func trimFilesystem(fd: Int32) throws { + let FITRIM: UInt = 0xC018_5879 + var trange = fitrim_range(start: 0, len: UInt64.max, min_len: 0) + let rc: CInt = ioctl(fd, FITRIM, &trange) + if rc != 0 { + let error = swiftErrno("ioctl(FITRIM)") + throw RPCError(code: .internalError, message: "trim failed", cause: error) + } + } + + public func umount(request: Com_Apple_Containerization_Sandbox_V3_UmountRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_UmountResponse + { + log.debug( + "umount", + metadata: [ + "path": "\(request.path)", + "flags": "\(request.flags)", + ]) + + #if os(Linux) + // Best effort EBUSY handle. + for _ in 0...50 { + let result = _umount(request.path, request.flags) + if result == -1 { + if errno == EBUSY { + try await Task.sleep(for: .milliseconds(10)) + continue + } + let error = swiftErrno("umount") + + log.error( + "umount", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .invalidArgument, message: "umount", cause: error) + } + break + } + return .init() + #else + fatalError("umount not supported on platform") + #endif + } + + public func setenv(request: Com_Apple_Containerization_Sandbox_V3_SetenvRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_SetenvResponse + { + log.debug( + "setenv", + metadata: [ + "key": "\(request.key)", + "value": "\(request.value)", + ]) + + guard _setenv(request.key, request.value, 1) == 0 else { + let error = swiftErrno("setenv") + + log.error( + "setEnv", + metadata: [ + "error": "\(error)" + ]) + + throw RPCError(code: .invalidArgument, message: "setenv", cause: error) + } + return .init() + } + + public func getenv(request: Com_Apple_Containerization_Sandbox_V3_GetenvRequest, context: GRPCCore.ServerContext) + async throws -> Com_Apple_Containerization_Sandbox_V3_GetenvResponse + { + log.debug( + "getenv", + metadata: [ + "key": "\(request.key)" + ]) + + let env = ProcessInfo.processInfo.environment[request.key] + return .with { + if let env { + $0.value = env + } + } + } + + public func createProcess( + request: Com_Apple_Containerization_Sandbox_V3_CreateProcessRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_CreateProcessResponse { + log.debug( + "createProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "stdin": "Port: \(request.stdin)", + "stdout": "Port: \(request.stdout)", + "stderr": "Port: \(request.stderr)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + var ociSpec = try JSONDecoder().decode( + ContainerizationOCI.Spec.self, + from: request.configuration + ) + + try ociAlterations(id: request.id, ociSpec: &ociSpec) + + guard let process = ociSpec.process else { + throw ContainerizationError( + .invalidArgument, + message: "oci runtime spec missing process configuration" + ) + } + + let stdioPorts = HostStdio( + stdin: request.hasStdin ? request.stdin : nil, + stdout: request.hasStdout ? request.stdout : nil, + stderr: request.hasStderr ? request.stderr : nil, + terminal: process.terminal + ) + + // This is an exec. + if let container = await self.state.containers[request.containerID] { + try await container.createExec( + id: request.id, + stdio: stdioPorts, + process: process + ) + } else { + // We need to make our new fangled container. + // The process ID must match the container ID for this. + guard request.id == request.containerID else { + throw ContainerizationError( + .invalidArgument, + message: "init process id must match container id" + ) + } + + // Write the etc/hostname file in the container rootfs since some init-systems + // depend on it. + let hostname = ociSpec.hostname + if let root = ociSpec.root, !hostname.isEmpty { + let etc = URL(fileURLWithPath: root.path).appendingPathComponent("etc") + try FileManager.default.createDirectory(atPath: etc.path, withIntermediateDirectories: true) + let hostnamePath = etc.appendingPathComponent("hostname") + try hostname.write(toFile: hostnamePath.path, atomically: true, encoding: .utf8) + } + + let ctr = try await ManagedContainer( + id: request.id, + stdio: stdioPorts, + spec: ociSpec, + ociRuntimePath: request.hasOciRuntimePath ? request.ociRuntimePath : nil, + log: self.log + ) + try await self.state.add(container: ctr) + } + + return .init() + } catch let err as ContainerizationError { + log.error( + "createProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "createProcess: failed to create process") + } catch { + log.error( + "createProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + if error is RPCError { + throw error + } + throw RPCError(code: .internalError, message: "createProcess: \(error)", cause: error) + } + } + + public func killProcess( + request: Com_Apple_Containerization_Sandbox_V3_KillProcessRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_KillProcessResponse { + log.debug( + "killProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "signal": "\(request.signal)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + try await ctr.kill(execID: request.id, request.signal) + + return .init() + } catch let err as ContainerizationError { + log.error( + "killProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "killProcess: failed to kill process") + } catch { + log.error( + "killProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError(code: .internalError, message: "killProcess: failed to kill process: \(error)") + } + } + + public func deleteProcess( + request: Com_Apple_Containerization_Sandbox_V3_DeleteProcessRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_DeleteProcessResponse { + log.debug( + "deleteProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + + // Are we trying to delete the container itself? + if request.id == request.containerID { + try await ctr.delete() + try await state.remove(container: request.id) + } else { + // Or just a single exec. + try await ctr.deleteExec(id: request.id) + } + + return .init() + } catch let err as ContainerizationError { + log.error( + "deleteProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "deleteProcess: failed to delete process") + } catch { + log.error( + "deleteProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError( + code: .internalError, + message: "deleteProcess: \(error)" + ) + } + } + + public func startProcess( + request: Com_Apple_Containerization_Sandbox_V3_StartProcessRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_StartProcessResponse { + log.debug( + "startProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + let pid = try await ctr.start(execID: request.id) + + return .with { + $0.pid = pid + } + } catch let err as ContainerizationError { + log.error( + "startProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "startProcess: failed to start process") + } catch { + log.error( + "startProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError( + code: .internalError, + message: "startProcess: failed to start process", + cause: error + ) + } + } + + public func resizeProcess( + request: Com_Apple_Containerization_Sandbox_V3_ResizeProcessRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ResizeProcessResponse { + log.debug( + "resizeProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + let size = Terminal.Size( + width: UInt16(request.columns), + height: UInt16(request.rows) + ) + try await ctr.resize(execID: request.id, size: size) + } catch let err as ContainerizationError { + log.error( + "resizeProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "resizeProcess: failed to resize process") + } catch { + log.error( + "resizeProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError( + code: .internalError, + message: "resizeProcess: failed to resize process", + cause: error + ) + } + + return .init() + } + + public func waitProcess( + request: Com_Apple_Containerization_Sandbox_V3_WaitProcessRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_WaitProcessResponse { + log.debug( + "waitProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + let exitStatus = try await ctr.wait(execID: request.id) + + return .with { + $0.exitCode = exitStatus.exitCode + $0.exitedAt = Google_Protobuf_Timestamp(date: exitStatus.exitedAt) + } + } catch let err as ContainerizationError { + log.error( + "waitProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "waitProcess: failed to wait on process") + } catch { + log.error( + "waitProcess", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError( + code: .internalError, + message: "waitProcess: failed to wait on process", + cause: error + ) + } + } + + public func closeProcessStdin( + request: Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_CloseProcessStdinResponse { + log.debug( + "closeProcessStdin", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + ]) + + do { + if !request.hasContainerID { + throw ContainerizationError( + .invalidArgument, + message: "processes in the root of the vm not implemented" + ) + } + + let ctr = try await self.state.get(container: request.containerID) + + try await ctr.closeStdin(execID: request.id) + + return .init() + } catch let err as ContainerizationError { + log.error( + "closeProcessStdin", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(err)", + ]) + throw err.toRPCError(operation: "closeProcessStdin: failed to close process stdin") + } catch { + log.error( + "closeProcessStdin", + metadata: [ + "id": "\(request.id)", + "containerID": "\(request.containerID)", + "error": "\(error)", + ]) + throw RPCError( + code: .internalError, + message: "closeProcessStdin: failed to close process stdin", + cause: error + ) + } + } + + public func ipLinkSet( + request: Com_Apple_Containerization_Sandbox_V3_IpLinkSetRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpLinkSetResponse { + log.debug( + "ipLinkSet", + metadata: [ + "interface": "\(request.interface)", + "up": "\(request.up)", + ]) + + do { + let socket = try DefaultNetlinkSocket() + let session = NetlinkSession(socket: socket, log: log) + let mtuValue: UInt32? = request.hasMtu ? request.mtu : nil + try session.linkSet(interface: request.interface, up: request.up, mtu: mtuValue) + } catch { + log.error( + "ipLinkSet", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "ipLinkSet", cause: error) + } + + return .init() + } + + public func ipAddrAdd( + request: Com_Apple_Containerization_Sandbox_V3_IpAddrAddRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpAddrAddResponse { + log.debug( + "ipAddrAdd", + metadata: [ + "interface": "\(request.interface)", + "ipv4Address": "\(request.ipv4Address)", + "ipv6Address": "\(request.hasIpv6Address ? request.ipv6Address : "")", + ]) + + do { + let socket = try DefaultNetlinkSocket() + let session = NetlinkSession(socket: socket, log: log) + let ipv4Address = try CIDRv4(request.ipv4Address) + try session.addressAdd(interface: request.interface, ipv4Address: ipv4Address) + if request.hasIpv6Address { + // Suppress SLAAC on this interface before adding the static + // address: the host would provide a static IPv6 config, this + // auto-derived IPv6 config would compete with the static one. + let confPath = URL(fileURLWithPath: "/proc/sys/net/ipv6/conf/\(request.interface)") + for key in ["accept_ra", "autoconf"] { + let setting = confPath.appendingPathComponent(key) + do { + let fh = try FileHandle(forWritingTo: setting) + defer { try? fh.close() } + try fh.write(contentsOf: Data("0".utf8)) + } catch { + log.warning( + "ipAddrAdd: failed to disable IPv6 auto-configuration", + metadata: [ + "path": "\(setting.path)", + "error": "\(error)", + ]) + } + } + + let ipv6Address = try CIDRv6(request.ipv6Address) + try session.addressAdd(interface: request.interface, ipv6Address: ipv6Address) + } + } catch { + log.error( + "ipAddrAdd", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "ipAddrAdd", cause: error) + } + + return .init() + } + + public func ipRouteAddLink( + request: Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkRequest, context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpRouteAddLinkResponse { + log.debug( + "ipRouteAddLink", + metadata: [ + "interface": "\(request.interface)", + "dstIpv4Addr": "\(request.dstIpv4Addr)", + "srcIpv4Addr": "\(request.srcIpv4Addr)", + "dstIpv6Addr": "\(request.hasDstIpv6Addr ? request.dstIpv6Addr : "")", + "srcIpv6Addr": "\(request.hasSrcIpv6Addr ? request.srcIpv6Addr : "")", + ]) + + guard !request.dstIpv4Addr.isEmpty || request.hasDstIpv6Addr else { + throw RPCError( + code: .invalidArgument, + message: "ipRouteAddLink requires at least one of dstIpv4Addr or dstIpv6Addr" + ) + } + + do { + let socket = try DefaultNetlinkSocket() + let session = NetlinkSession(socket: socket, log: log) + if !request.dstIpv4Addr.isEmpty { + let dstIpv4Addr = try CIDRv4(request.dstIpv4Addr) + let srcIpv4Addr = request.srcIpv4Addr.isEmpty ? nil : try IPv4Address(request.srcIpv4Addr) + try session.routeAdd( + interface: request.interface, + dstIpv4Addr: dstIpv4Addr, + srcIpv4Addr: srcIpv4Addr + ) + } + if request.hasDstIpv6Addr { + let dstIpv6Addr = try CIDRv6(request.dstIpv6Addr) + let srcIpv6Addr = request.hasSrcIpv6Addr ? try IPv6Address(request.srcIpv6Addr) : nil + try session.routeAdd( + interface: request.interface, + dstIpv6Addr: dstIpv6Addr, + srcIpv6Addr: srcIpv6Addr + ) + } + } catch { + log.error( + "ipRouteAddLink", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "ipRouteAddLink", cause: error) + } + + return .init() + } + + public func ipRouteAddDefault( + request: Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_IpRouteAddDefaultResponse { + log.debug( + "ipRouteAddDefault", + metadata: [ + "interface": "\(request.interface)", + "ipv4Gateway": "\(request.ipv4Gateway)", + "ipv6Gateway": "\(request.hasIpv6Gateway ? request.ipv6Gateway : "")", + ]) + + do { + let socket = try DefaultNetlinkSocket() + let session = NetlinkSession(socket: socket, log: log) + if !request.ipv4Gateway.isEmpty { + let ipv4Gateway = try IPv4Address(request.ipv4Gateway) + try session.routeAddDefault(interface: request.interface, ipv4Gateway: ipv4Gateway) + } else if !request.hasIpv6Gateway { + // No v4 gateway and no v6 either: install a v4 default route + // with no gateway (preserves pre-IPv6 behavior). + try session.routeAddDefault(interface: request.interface, ipv4Gateway: nil) + } + if request.hasIpv6Gateway { + let ipv6Gateway = try IPv6Address(request.ipv6Gateway) + try session.routeAddDefault(interface: request.interface, ipv6Gateway: ipv6Gateway) + } + } catch { + log.error( + "ipRouteAddDefault", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "ipRouteAddDefault", cause: error) + } + + return .init() + } + + public func configureDns( + request: Com_Apple_Containerization_Sandbox_V3_ConfigureDnsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ConfigureDnsResponse { + let domain = request.hasDomain ? request.domain : nil + log.debug( + "configureDns", + metadata: [ + "location": "\(request.location)", + "nameservers": "\(request.nameservers)", + "domain": "\(domain ?? "")", + "searchDomains": "\(request.searchDomains)", + "options": "\(request.options)", + ]) + + do { + let etc = URL(fileURLWithPath: request.location).appendingPathComponent("etc") + try FileManager.default.createDirectory(atPath: etc.path, withIntermediateDirectories: true) + let resolvConf = etc.appendingPathComponent("resolv.conf") + let config = DNS( + nameservers: request.nameservers, + domain: domain, + searchDomains: request.searchDomains, + options: request.options + ) + let text = config.resolvConf + log.debug("writing to path \(resolvConf.path) \(text)") + try text.write(toFile: resolvConf.path, atomically: true, encoding: .utf8) + log.debug("wrote resolver configuration", metadata: ["path": "\(resolvConf.path)"]) + } catch { + log.error( + "configureDns", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "configureDns", cause: error) + } + + return .init() + } + + public func configureHosts( + request: Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ConfigureHostsResponse { + log.debug( + "configureHosts", + metadata: [ + "location": "\(request.location)" + ]) + + do { + let etc = URL(fileURLWithPath: request.location).appendingPathComponent("etc") + try FileManager.default.createDirectory(atPath: etc.path, withIntermediateDirectories: true) + let hostsPath = etc.appendingPathComponent("hosts") + + let config = request.toCZHosts() + let text = config.hostsFile + try text.write(toFile: hostsPath.path, atomically: true, encoding: .utf8) + + log.debug("wrote /etc/hosts configuration", metadata: ["path": "\(hostsPath.path)"]) + } catch { + log.error( + "configureHosts", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "configureHosts", cause: error) + } + + return .init() + } + + public func containerStatistics( + request: Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_ContainerStatisticsResponse { + log.debug( + "containerStatistics", + metadata: [ + "container_ids": "\(request.containerIds)", + "categories": "\(request.categories)", + ]) + + do { + // Parse requested categories (empty = all) + let categories = Set(request.categories) + let wantAll = categories.isEmpty + let wantProcess = wantAll || categories.contains(.process) + let wantMemory = wantAll || categories.contains(.memory) + let wantCPU = wantAll || categories.contains(.cpu) + let wantBlockIO = wantAll || categories.contains(.blockIo) + let wantNetwork = wantAll || categories.contains(.network) + let wantMemoryEvents = wantAll || categories.contains(.memoryEvents) + + // Get all network interfaces (skip loopback) only if needed + let interfaces = wantNetwork ? try getNetworkInterfaces() : [] + + // Get containers to query + let containerIDs: [String] + if request.containerIds.isEmpty { + containerIDs = await Array(state.containers.keys) + } else { + containerIDs = request.containerIds + } + + var containerStats: [Com_Apple_Containerization_Sandbox_V3_ContainerStats] = [] + + for containerID in containerIDs { + let container = try await state.get(container: containerID) + + // Only read the cgroup stat groups that were requested. + var cgCategories: Cgroup2StatsCategory = [] + if wantProcess { cgCategories.insert(.pids) } + if wantMemory { cgCategories.insert(.memory) } + if wantCPU { cgCategories.insert(.cpu) } + if wantBlockIO { cgCategories.insert(.io) } + + let cgStats: Cgroup2Stats? = cgCategories.isEmpty ? nil : try await container.stats(cgCategories) + + // Get network stats only if requested + var networkStats: [Com_Apple_Containerization_Sandbox_V3_NetworkStats] = [] + if wantNetwork { + let socket = try DefaultNetlinkSocket() + let session = NetlinkSession(socket: socket, log: log) + for interface in interfaces { + let responses = try session.linkGet(interface: interface, includeStats: true) + if responses.count == 1, let stats = try responses[0].getStatistics() { + networkStats.append( + .with { + $0.interface = interface + $0.receivedPackets = stats.rxPackets + $0.transmittedPackets = stats.txPackets + $0.receivedBytes = stats.rxBytes + $0.transmittedBytes = stats.txBytes + $0.receivedErrors = stats.rxErrors + $0.transmittedErrors = stats.txErrors + }) + } + } + } + + // Get memory events only if requested + var memoryEvents: MemoryEvents? + if wantMemoryEvents { + memoryEvents = try await container.getMemoryEvents() + } + + containerStats.append( + mapStatsToProto( + containerID: containerID, + cgStats: cgStats, + networkStats: networkStats, + memoryEvents: memoryEvents, + wantProcess: wantProcess, + wantMemory: wantMemory, + wantCPU: wantCPU, + wantBlockIO: wantBlockIO, + wantNetwork: wantNetwork, + wantMemoryEvents: wantMemoryEvents + ) + ) + } + + return .with { + $0.containers = containerStats + } + } catch { + log.error( + "containerStatistics", + metadata: [ + "error": "\(error)" + ]) + throw RPCError(code: .internalError, message: "containerStatistics", cause: error) + } + } + + private func swiftErrno(_ msg: Logger.Message) -> POSIXError { + let error = POSIXError(.init(rawValue: errno)!) + log.error( + msg, + metadata: [ + "error": "\(error)" + ]) + return error + } + + // NOTE: This is just crummy. It works because today the assumption is + // every NIC in the root net namespace is for the container(s), but if we + // ever supported individual containers having their own NICs/IPs then this + // logic needs to change. We only create ethernet devices today too, so that's + // what this filters for as well. + private func getNetworkInterfaces() throws -> [String] { + let netPath = URL(filePath: "/sys/class/net") + let interfaces = try FileManager.default.contentsOfDirectory( + at: netPath, + includingPropertiesForKeys: nil + ) + return + interfaces + .map { $0.lastPathComponent } + .filter { $0.hasPrefix("eth") } + } + + private func mapStatsToProto( + containerID: String, + cgStats: Cgroup2Stats?, + networkStats: [Com_Apple_Containerization_Sandbox_V3_NetworkStats], + memoryEvents: MemoryEvents?, + wantProcess: Bool, + wantMemory: Bool, + wantCPU: Bool, + wantBlockIO: Bool, + wantNetwork: Bool, + wantMemoryEvents: Bool + ) -> Com_Apple_Containerization_Sandbox_V3_ContainerStats { + .with { + $0.containerID = containerID + + if wantProcess, let pids = cgStats?.pids { + $0.process = .with { + $0.current = pids.current + $0.limit = pids.max ?? 0 + } + } + + if wantMemory, let memory = cgStats?.memory { + $0.memory = .with { + $0.usageBytes = memory.usage + $0.limitBytes = memory.usageLimit ?? 0 + $0.swapUsageBytes = memory.swapUsage ?? 0 + $0.swapLimitBytes = memory.swapLimit ?? 0 + $0.cacheBytes = memory.file + $0.kernelStackBytes = memory.kernelStack + $0.slabBytes = memory.slab + $0.pageFaults = memory.pgfault + $0.majorPageFaults = memory.pgmajfault + $0.inactiveFile = memory.inactiveFile + $0.anon = memory.anon + $0.workingsetRefaultAnon = memory.workingsetRefaultAnon + $0.workingsetRefaultFile = memory.workingsetRefaultFile + $0.pgstealKswapd = memory.pgstealKswapd + $0.pgstealDirect = memory.pgstealDirect + $0.pgstealKhugepaged = memory.pgstealKhugepaged + } + } + + if wantCPU, let cpu = cgStats?.cpu { + $0.cpu = .with { + $0.usageUsec = cpu.usageUsec + $0.userUsec = cpu.userUsec + $0.systemUsec = cpu.systemUsec + $0.throttlingPeriods = cpu.nrPeriods + $0.throttledPeriods = cpu.nrThrottled + $0.throttledTimeUsec = cpu.throttledUsec + } + } + + if wantBlockIO, let io = cgStats?.io { + $0.blockIo = .with { + $0.devices = io.entries.map { entry in + .with { + $0.major = entry.major + $0.minor = entry.minor + $0.readBytes = entry.rbytes + $0.writeBytes = entry.wbytes + $0.readOperations = entry.rios + $0.writeOperations = entry.wios + } + } + } + } + + if wantNetwork { + $0.networks = networkStats + } + + if wantMemoryEvents, let events = memoryEvents { + $0.memoryEvents = .with { + $0.low = events.low + $0.high = events.high + $0.max = events.max + $0.oom = events.oom + $0.oomKill = events.oomKill + } + } + } + } + + public func sync( + request: Com_Apple_Containerization_Sandbox_V3_SyncRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_SyncResponse { + log.debug("sync") + + _sync() + return .init() + } + + public func kill( + request: Com_Apple_Containerization_Sandbox_V3_KillRequest, + context: GRPCCore.ServerContext + ) async throws -> Com_Apple_Containerization_Sandbox_V3_KillResponse { + log.debug( + "kill", + metadata: [ + "pid": "\(request.pid)", + "signal": "\(request.signal)", + ]) + + let r = _kill(request.pid, request.signal) + return .with { + $0.result = r + } + } +} + +extension Com_Apple_Containerization_Sandbox_V3_ConfigureHostsRequest { + func toCZHosts() -> Hosts { + let entries = self.entries.map { + Hosts.Entry( + ipAddress: $0.ipAddress, + hostnames: $0.hostnames, + comment: $0.hasComment ? $0.comment : nil + ) + } + return Hosts( + entries: entries, + comment: self.hasComment ? self.comment : nil + ) + } +} + +extension Initd { + func ociAlterations(id: String, ociSpec: inout ContainerizationOCI.Spec) throws { + guard var process = ociSpec.process else { + throw ContainerizationError( + .invalidArgument, + message: "runtime spec without process field present" + ) + } + guard let root = ociSpec.root else { + throw ContainerizationError( + .invalidArgument, + message: "runtime spec without root field present" + ) + } + + if ociSpec.linux!.cgroupsPath.isEmpty { + ociSpec.linux!.cgroupsPath = "/container/\(id)" + } + + if process.cwd.isEmpty { + process.cwd = "/" + } + + // NOTE: The OCI runtime specs Username field is truthfully Windows exclusive, but we use this as a way + // to pass through the exact string representation of a username (or username:group, uid:group etc.) a client + // may have given us. + let username = process.user.username.isEmpty ? "\(process.user.uid):\(process.user.gid)" : process.user.username + let parsedUser = try User.getExecUser( + userString: username, + passwdPath: URL(filePath: root.path).appending(path: "etc/passwd"), + groupPath: URL(filePath: root.path).appending(path: "etc/group") + ) + process.user.uid = parsedUser.uid + process.user.gid = parsedUser.gid + process.user.additionalGids.append(contentsOf: parsedUser.sgids) + process.user.additionalGids.append(process.user.gid) + + var seenSuppGids = Set() + process.user.additionalGids = process.user.additionalGids.filter { + seenSuppGids.insert($0).inserted + } + + if !process.env.contains(where: { $0.hasPrefix("PATH=") }) { + process.env.append("PATH=\(LinuxProcessConfiguration.defaultPath)") + } + + if !process.env.contains(where: { $0.hasPrefix("HOME=") }) { + process.env.append("HOME=\(parsedUser.home)") + } + + // Defensive programming a tad, but ensure we have TERM set if + // the client requested a pty. + if process.terminal { + let termEnv = "TERM=" + if !process.env.contains(where: { $0.hasPrefix(termEnv) }) { + process.env.append("TERM=xterm") + } + } + + ociSpec.process = process + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/Server.swift b/vminitd/Sources/VminitdCore/Server.swift new file mode 100644 index 0000000..7ee1674 --- /dev/null +++ b/vminitd/Sources/VminitdCore/Server.swift @@ -0,0 +1,145 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationError +import Foundation +import GRPCCore +import GRPCNIOTransportHTTP2 +import GRPCProtobuf +import Logging +import NIOCore +import NIOPosix + +public final class Initd: Sendable { + public actor State { + private(set) var containers: [String: ManagedContainer] = [:] + var proxies: [String: VsockProxy] = [:] + + public typealias ContainerDeletedHandler = @Sendable (String) async -> Void + private var onContainerDeleted: [ContainerDeletedHandler] = [] + + public func onDelete(_ handler: @escaping ContainerDeletedHandler) { + onContainerDeleted.append(handler) + } + + public func get(container id: String) throws -> ManagedContainer { + guard let ctr = self.containers[id] else { + throw ContainerizationError( + .notFound, + message: "container \(id) not found" + ) + } + return ctr + } + + func add(container: ManagedContainer) throws { + guard containers[container.id] == nil else { + throw ContainerizationError( + .exists, + message: "container \(container.id) already exists" + ) + } + containers[container.id] = container + } + + func add(proxy: VsockProxy) throws { + guard proxies[proxy.id] == nil else { + throw ContainerizationError( + .exists, + message: "proxy \(proxy.id) already exists" + ) + } + proxies[proxy.id] = proxy + } + + func remove(proxy id: String) throws -> VsockProxy { + guard let proxy = proxies.removeValue(forKey: id) else { + throw ContainerizationError( + .notFound, + message: "proxy \(id) does not exist" + ) + } + return proxy + } + + func remove(container id: String) throws { + guard let _ = containers.removeValue(forKey: id) else { + throw ContainerizationError( + .notFound, + message: "container \(id) does not exist" + ) + } + let handlers = onContainerDeleted + Task { + for handler in handlers { + await handler(id) + } + } + } + } + + public let log: Logger + public let state: State + let group: MultiThreadedEventLoopGroup + let blockingPool: NIOThreadPool + + public init(log: Logger, group: MultiThreadedEventLoopGroup, blockingPool: NIOThreadPool) { + self.log = log + self.group = group + self.blockingPool = blockingPool + self.state = State() + } + + public func serve(port: Int, additionalServices: [any RegistrableRPCService] = []) async throws { + try await withThrowingTaskGroup(of: Void.self) { group in + log.debug("starting process supervisor") + + ProcessSupervisor.default.setLog(self.log) + ProcessSupervisor.default.ready() + + log.info( + "booting gRPC server on vsock", + metadata: [ + "port": "\(port)" + ]) + + let server = GRPCServer( + transport: .http2NIOPosix( + address: .vsock(contextID: .any, port: .init(port)), + transportSecurity: .plaintext, + eventLoopGroup: self.group + ), + services: [self] + additionalServices + ) + + log.info( + "gRPC API serving on vsock", + metadata: [ + "port": "\(port)" + ]) + + group.addTask { try await server.serve() } + + try await group.next() + log.info("closing gRPC server") + group.cancelAll() + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/StandardIO.swift b/vminitd/Sources/VminitdCore/StandardIO.swift new file mode 100644 index 0000000..49d32c4 --- /dev/null +++ b/vminitd/Sources/VminitdCore/StandardIO.swift @@ -0,0 +1,175 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationError +import ContainerizationOS +import Foundation +import Logging +import Synchronization + +final class StandardIO: ManagedProcess.IO & Sendable { + private struct State { + var stdin: IOPair? + var stdout: IOPair? + var stderr: IOPair? + + var stdinPipe: Pipe? + var stdoutPipe: Pipe? + var stderrPipe: Pipe? + } + + private let log: Logger? + private let hostStdio: HostStdio + private let state: Mutex + + init( + stdio: HostStdio, + log: Logger? + ) { + self.hostStdio = stdio + self.log = log + self.state = Mutex(State()) + } + + // NOP + func attach(pid: Int32, fd: Int32) throws {} + + func start(process: inout Command) throws { + try self.state.withLock { + if let stdinPort = self.hostStdio.stdin { + let inPipe = Pipe() + process.stdin = inPipe.fileHandleForReading + $0.stdinPipe = inPipe + + let type = VsockType( + port: stdinPort, + cid: VsockType.hostCID + ) + let stdinSocket = try Socket(type: type, closeOnDeinit: false) + try stdinSocket.connect() + + let pair = IOPair( + readFrom: stdinSocket, + writeTo: inPipe.fileHandleForWriting, + reason: "StandardIO stdin", + logger: log + ) + $0.stdin = pair + + try pair.relay() + } + + if let stdoutPort = self.hostStdio.stdout { + let outPipe = Pipe() + process.stdout = outPipe.fileHandleForWriting + $0.stdoutPipe = outPipe + + let type = VsockType( + port: stdoutPort, + cid: VsockType.hostCID + ) + let stdoutSocket = try Socket(type: type, closeOnDeinit: false) + try stdoutSocket.connect() + + let pair = IOPair( + readFrom: outPipe.fileHandleForReading, + writeTo: stdoutSocket, + reason: "StandardIO stdout", + logger: log + ) + $0.stdout = pair + + try pair.relay() + } + + if let stderrPort = self.hostStdio.stderr { + let errPipe = Pipe() + process.stderr = errPipe.fileHandleForWriting + $0.stderrPipe = errPipe + + let type = VsockType( + port: stderrPort, + cid: VsockType.hostCID + ) + let stderrSocket = try Socket(type: type, closeOnDeinit: false) + try stderrSocket.connect() + + let pair = IOPair( + readFrom: errPipe.fileHandleForReading, + writeTo: stderrSocket, + reason: "StandardIO stderr", + logger: log + ) + $0.stderr = pair + + try pair.relay() + } + } + } + + func resize(size: Terminal.Size) throws { + throw ContainerizationError(.unsupported, message: "resize not supported") + } + + func close() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + + if let stdout = $0.stdout { + stdout.close() + $0.stdout = nil + } + + if let stderr = $0.stderr { + stderr.close() + $0.stderr = nil + } + } + } + + func closeStdin() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + } + } + + func closeAfterExec() throws { + try self.state.withLock { + if let stdin = $0.stdinPipe { + try stdin.fileHandleForReading.close() + $0.stdinPipe = nil + } + if let stdout = $0.stdoutPipe { + try stdout.fileHandleForWriting.close() + $0.stdoutPipe = nil + } + if let stderr = $0.stderrPipe { + try stderr.fileHandleForWriting.close() + $0.stderrPipe = nil + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/TerminalIO.swift b/vminitd/Sources/VminitdCore/TerminalIO.swift new file mode 100644 index 0000000..976e970 --- /dev/null +++ b/vminitd/Sources/VminitdCore/TerminalIO.swift @@ -0,0 +1,169 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationOS +import Foundation +import LCShim +import Logging +import Synchronization + +final class TerminalIO: ManagedProcess.IO & Sendable { + private struct State { + var stdinSocket: Socket? + var stdoutSocket: Socket? + + var stdin: IOPair? + var stdout: IOPair? + var parent: Terminal? + } + + private let log: Logger? + private let hostStdio: HostStdio + private let state: Mutex + + init( + stdio: HostStdio, + log: Logger? + ) throws { + self.hostStdio = stdio + self.log = log + self.state = Mutex(State()) + } + + func resize(size: Terminal.Size) throws { + try self.state.withLock { + if let parent = $0.parent { + try parent.resize(size: size) + } + } + } + + func start(process: inout Command) throws { + try self.state.withLock { + process.stdin = nil + process.stdout = nil + process.stderr = nil + + if let stdinPort = self.hostStdio.stdin { + let type = VsockType( + port: stdinPort, + cid: VsockType.hostCID + ) + let stdinSocket = try Socket(type: type, closeOnDeinit: false) + try stdinSocket.connect() + $0.stdinSocket = stdinSocket + } + + if let stdoutPort = self.hostStdio.stdout { + let type = VsockType( + port: stdoutPort, + cid: VsockType.hostCID + ) + let stdoutSocket = try Socket(type: type, closeOnDeinit: false) + try stdoutSocket.connect() + $0.stdoutSocket = stdoutSocket + } + } + } + + func attach(pid: Int32, fd: Int32) throws { + try self.state.withLock { + let containerFd = CZ_pidfd_open(pid, 0) + guard containerFd != -1 else { + throw POSIXError.fromErrno() + } + defer { Foundation.close(Int32(containerFd)) } + + let hostFd = CZ_pidfd_getfd(containerFd, fd, 0) + guard hostFd != -1 else { + throw POSIXError.fromErrno() + } + + let term = try Terminal(descriptor: Int32(hostFd), setInitState: false) + $0.parent = term + + if let stdinSocket = $0.stdinSocket { + let pair = IOPair( + readFrom: stdinSocket, + writeTo: UnownedIOCloser(term), + reason: "TerminalIO stdin", + logger: log + ) + try pair.relay(ignoreHup: true) + $0.stdin = pair + } + + if let stdoutSocket = $0.stdoutSocket { + let pair = IOPair( + readFrom: term, + writeTo: stdoutSocket, + reason: "TerminalIO stdout", + logger: log + ) + try pair.relay(ignoreHup: true) + $0.stdout = pair + } + } + } + + func close() throws { + self.state.withLock { + // stdout must close before stdin because both IOPairs share the + // Terminal fd. stdout registered that fd with epoll (as its read + // source) and needs to unregister it while the fd is still valid. + // stdin closes the Terminal as its write destination, which would + // invalidate the fd before stdout can unregister. + if let stdout = $0.stdout { + stdout.close() + $0.stdout = nil + } + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + + // If IOPairs were never created (process exited before attach), + // close the raw sockets directly since they have closeOnDeinit + // disabled. + if let stdinSocket = $0.stdinSocket { + try? stdinSocket.close() + $0.stdinSocket = nil + } + if let stdoutSocket = $0.stdoutSocket { + try? stdoutSocket.close() + $0.stdoutSocket = nil + } + + $0.parent = nil + } + } + + // NOP + func closeAfterExec() throws {} + + func closeStdin() throws { + self.state.withLock { + if let stdin = $0.stdin { + stdin.close() + $0.stdin = nil + } + } + } +} + +#endif diff --git a/vminitd/Sources/VminitdCore/VsockProxy.swift b/vminitd/Sources/VminitdCore/VsockProxy.swift new file mode 100644 index 0000000..393fad1 --- /dev/null +++ b/vminitd/Sources/VminitdCore/VsockProxy.swift @@ -0,0 +1,414 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +#if os(Linux) + +import ContainerizationIO +import ContainerizationOS +import Foundation +import LCShim +import Logging + +actor VsockProxy { + enum Action { + case listen + case dial + } + + private enum SocketType { + case unix + case vsock + } + + let id: String + + private let path: URL + private let action: Action + private let port: UInt32 + private let udsPerms: UInt32? + private let log: Logger? + + private var listener: Socket? + private var task: Task<(), Never>? + private var connectionTasks: [UUID: Task<(), Never>] = [:] + + init( + id: String, + action: Action, + port: UInt32, + path: URL, + udsPerms: UInt32?, + log: Logger? = nil + ) { + self.id = id + self.action = action + self.port = port + self.path = path + self.udsPerms = udsPerms + self.log = log + } +} + +extension VsockProxy { + func start() throws { + guard listener == nil else { + return + } + + log?.debug( + "starting proxy", + metadata: [ + "vport": "\(port)", + "uds": "\(path)", + "action": "\(action)", + ]) + + switch action { + case .dial: + try dialHost() + case .listen: + try dialGuest() + } + } + + func close() throws { + guard let listener else { + return + } + + log?.debug( + "stopping proxy", + metadata: [ + "vport": "\(port)", + "uds": "\(path)", + "action": "\(action)", + ]) + + try listener.close() + + for (_, t) in connectionTasks { t.cancel() } + connectionTasks.removeAll() + + if action == .dial { + let fm = FileManager.default + if fm.fileExists(atPath: path.path) { + try fm.removeItem(at: path) + } + } + + task?.cancel() + self.listener = nil + } + + private func dialHost() throws { + let fm = FileManager.default + + let parentDir = path.deletingLastPathComponent() + try fm.createDirectory( + at: parentDir, + withIntermediateDirectories: true + ) + + let type = try UnixType( + path: path.path, + perms: udsPerms, + unlinkExisting: true + ) + let oldMask = umask(0) + defer { umask(oldMask) } + let uds = try Socket(type: type) + try uds.listen() + listener = uds + + try acceptLoop(socketType: .unix) + } + + private func dialGuest() throws { + let type = VsockType( + port: port, + cid: VsockType.anyCID + ) + let vsock = try Socket(type: type) + try vsock.listen() + listener = vsock + + try acceptLoop(socketType: .vsock) + } + + private func acceptLoop(socketType: SocketType) throws { + guard let listener else { + return + } + + let stream = try listener.acceptStream() + let task = Task { + do { + for try await conn in stream { + let connID = UUID() + let connTask = Task { + defer { self.connectionTasks[connID] = nil } + log?.debug( + "accepting connection", + metadata: [ + "vport": "\(port)", + "uds": "\(path)", + "action": "\(action)", + "socketType": "\(socketType)", + ]) + do { + try await handleConn( + conn: conn, + connType: socketType + ) + } catch { + self.log?.error("failed to handle connection: \(error)") + } + } + // Safe: actor serialization ensures this runs before connTask can execute its defer. + connectionTasks[connID] = connTask + } + } catch { + self.log?.error("failed to accept connection: \(error)") + } + } + self.task = task + } + + private func handleConn( + conn: ContainerizationOS.Socket, + connType: SocketType + ) async throws { + try await withCheckedThrowingContinuation { (c: CheckedContinuation) in + do { + // `relayTo` isn't used concurrently. + nonisolated(unsafe) var relayTo: ContainerizationOS.Socket + + switch connType { + case .unix: + let type = VsockType( + port: port, + cid: VsockType.hostCID + ) + relayTo = try Socket( + type: type, + closeOnDeinit: false + ) + case .vsock: + let type = try UnixType(path: path.path) + relayTo = try Socket( + type: type, + closeOnDeinit: false + ) + } + + try relayTo.connect() + + // `clientFile` isn't used concurrently. + nonisolated(unsafe) var clientFile = OSFile.SpliceFile(fd: conn.fileDescriptor) + nonisolated(unsafe) var eofFromClient = false + // `serverFile` isn't used concurrently. + nonisolated(unsafe) var serverFile = OSFile.SpliceFile(fd: relayTo.fileDescriptor) + nonisolated(unsafe) var eofFromServer = false + + // clean up when any of these conditions apply: + // - the client has completely hung up or errored + // - the server has completely hung up or errored + // - both the client and server have half closed via: + // - read hangup on epoll + // - EOF on splice + let cleanup = { @Sendable [log, port, path, action] in + log?.debug( + "cleaning up", + metadata: [ + "vport": "\(port)", + "uds": "\(path)", + "action": "\(action)", + "eofFromClient": "\(eofFromClient)", + "eofFromServer": "\(eofFromServer)", + "clientFd": "\(clientFile.fileDescriptor)", + "serverFd": "\(serverFile.fileDescriptor)", + ] + ) + + do { + try ProcessSupervisor.default.unregisterFd(clientFile.fileDescriptor) + try ProcessSupervisor.default.unregisterFd(serverFile.fileDescriptor) + try conn.close() + try relayTo.close() + } catch { + self.log?.error("Failed to clean up vsock proxy: \(error)") + } + c.resume() + } + + try! ProcessSupervisor.default.registerFd(clientFile.fileDescriptor, mask: [.input, .output]) { mask in + if mask.readyToRead && !eofFromClient { + let (fromEof, toEof) = Self.transferData( + fromFile: &clientFile, + toFile: &serverFile, + description: "readyToRead:toServer", + log: self.log + ) + eofFromClient = eofFromClient || fromEof + eofFromServer = eofFromServer || toEof + } + + if mask.readyToWrite && !eofFromServer { + let (fromEof, toEof) = Self.transferData( + fromFile: &serverFile, + toFile: &clientFile, + description: "readyToWrite:toClient", + log: self.log + ) + eofFromClient = eofFromClient || toEof + eofFromServer = eofFromServer || fromEof + } + + if mask.isHangup { + eofFromClient = true + eofFromServer = true + } else if mask.isRemoteHangup && !eofFromClient { + // half close, shut down client to server transfer + // we should see no more EPOLLIN events on the client fd + // and no more EPOLLOUT events on the server fd + eofFromClient = true + if shutdown(serverFile.fileDescriptor, Int32(SHUT_WR)) != 0 { + self.log?.warning( + "failed to shut down client reads", + metadata: [ + "vport": "\(self.port)", + "uds": "\(self.path)", + "errno": "\(errno)", + "eofFromClient": "\(eofFromClient)", + "eofFromServer": "\(eofFromServer)", + "clientFd": "\(clientFile.fileDescriptor)", + "serverFd": "\(serverFile.fileDescriptor)", + ] + ) + } + } + + if eofFromClient && eofFromServer { + return cleanup() + } + } + + try! ProcessSupervisor.default.registerFd(serverFile.fileDescriptor, mask: [.input, .output]) { mask in + if mask.readyToRead && !eofFromServer { + let (fromEof, toEof) = Self.transferData( + fromFile: &serverFile, + toFile: &clientFile, + description: "readyToRead:toClient", + log: self.log + ) + eofFromClient = eofFromClient || toEof + eofFromServer = eofFromServer || fromEof + } + + if mask.readyToWrite && !eofFromClient { + let (fromEof, toEof) = Self.transferData( + fromFile: &clientFile, + toFile: &serverFile, + description: "readyToWrite:toServer", + log: self.log + ) + eofFromClient = eofFromClient || fromEof + eofFromServer = eofFromServer || toEof + } + + if mask.isHangup { + eofFromClient = true + eofFromServer = true + } else if mask.isRemoteHangup && !eofFromServer { + // half close, shut down server to client transfer + // we should see no more EPOLLIN events on the server fd + // and no more EPOLLOUT events on the client fd + eofFromServer = true + if shutdown(clientFile.fileDescriptor, Int32(SHUT_WR)) != 0 { + self.log?.warning( + "failed to shut down server reads", + metadata: [ + "vport": "\(self.port)", + "uds": "\(self.path)", + "errno": "\(errno)", + "eofFromClient": "\(eofFromClient)", + "eofFromServer": "\(eofFromServer)", + "clientFd": "\(clientFile.fileDescriptor)", + "serverFd": "\(serverFile.fileDescriptor)", + ] + ) + } + } + + if eofFromClient && eofFromServer { + return cleanup() + } + } + } catch { + c.resume(throwing: error) + } + } + } + + private static func transferData( + fromFile: inout OSFile.SpliceFile, + toFile: inout OSFile.SpliceFile, + description: String, + log: Logger? + ) -> (Bool, Bool) { + do { + let (readBytes, writeBytes, action) = try OSFile.splice(from: &fromFile, to: &toFile) + log?.trace( + "transferred data", + metadata: [ + "description": "\(description)", + "action": "\(action)", + "readBytes": "\(readBytes)", + "writeBytes": "\(writeBytes)", + "fromFd": "\(fromFile.fileDescriptor)", + "toFd": "\(toFile.fileDescriptor)", + ] + ) + if action == .eof { + // half close, shut down client to server transfer + // we should see no more EPOLLIN events on the client fd + // and no more EPOLLOUT events on the server fd + if shutdown(toFile.fileDescriptor, Int32(SHUT_WR)) != 0 { + log?.warning( + "failed to shut down reads", + metadata: [ + "description": "\(description)", + "errno": "\(errno)", + "action": "\(action)", + "readBytes": "\(readBytes)", + "writeBytes": "\(writeBytes)", + "fromFd": "\(fromFile.fileDescriptor)", + "toFd": "\(toFile.fileDescriptor)", + ] + ) + } + return (true, false) + } else if action == .brokenPipe { + return (true, true) + } + return (false, false) + } catch { + return (true, true) + } + } +} + +#endif diff --git a/vminitd/Sources/vmexec/Console.swift b/vminitd/Sources/vmexec/Console.swift new file mode 100644 index 0000000..b868049 --- /dev/null +++ b/vminitd/Sources/vmexec/Console.swift @@ -0,0 +1,70 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import FoundationEssentials +import LCShim + +#if canImport(Musl) +import Musl +private let _close = Musl.close +#elseif canImport(Glibc) +import Glibc +private let _close = Glibc.close +#endif + +class Console { + let master: Int32 + let slavePath: String + + init() throws { + let masterFD = open("/dev/ptmx", O_RDWR | O_NOCTTY | O_CLOEXEC) + guard masterFD != -1 else { + throw App.Errno(stage: "open_ptmx") + } + + guard unlockpt(masterFD) == 0 else { + throw App.Errno(stage: "unlockpt") + } + + guard let slavePath = ptsname(masterFD) else { + throw App.Errno(stage: "ptsname") + } + + self.master = masterFD + self.slavePath = String(cString: slavePath) + } + + func configureStdIO() throws { + let path = self.slavePath + let slaveFD = open(path, O_RDWR) + guard slaveFD != -1 else { + throw App.Errno(stage: "open_pts") + } + defer { _ = _close(slaveFD) } + + for fd: Int32 in 0...2 { + guard dup3(slaveFD, fd, 0) != -1 else { + throw App.Errno(stage: "dup3") + } + } + } + + func close() throws { + guard _close(self.master) == 0 else { + throw App.Errno(stage: "close") + } + } +} diff --git a/vminitd/Sources/vmexec/ExecCommand.swift b/vminitd/Sources/vmexec/ExecCommand.swift new file mode 100644 index 0000000..b5a87f8 --- /dev/null +++ b/vminitd/Sources/vmexec/ExecCommand.swift @@ -0,0 +1,165 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import ContainerizationOCI +import ContainerizationOS +import FoundationEssentials +import LCShim +import Logging +import SystemPackage + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +struct ExecCommand: ParsableCommand { + static let configuration = CommandConfiguration( + commandName: "exec", + abstract: "Exec in a container" + ) + + @Option(name: .long, help: "path to an OCI runtime spec process configuration") + var processPath: String + + @Option(name: .long, help: "pid of the init process for the container") + var parentPid: Int + + func run() throws { + do { + let src = URL(fileURLWithPath: processPath) + let processBytes = try Data(contentsOf: src) + let process = try JSONDecoder().decode( + ContainerizationOCI.Process.self, + from: processBytes + ) + try execInNamespaces(process: process) + } catch { + App.writeError(error) + throw error + } + } + + static func enterNS(pidFd: Int32, nsType: Int32) throws { + guard setns(pidFd, nsType) == 0 else { + throw App.Errno(stage: "setns(fd)") + } + } + + private func execInNamespaces(process: ContainerizationOCI.Process) throws { + let syncPipe = FileDescriptor(rawValue: 3) + let ackPipe = FileDescriptor(rawValue: 4) + + let pidFd = CZ_pidfd_open(Int32(parentPid), 0) + guard pidFd > 0 else { + throw App.Errno(stage: "pidfd_open(\(parentPid))") + } + try Self.enterNS( + pidFd: pidFd, + nsType: CLONE_NEWCGROUP | CLONE_NEWPID | CLONE_NEWUTS | CLONE_NEWNS + ) + + let processID = fork() + + guard processID != -1 else { + try? syncPipe.close() + try? ackPipe.close() + + throw App.Errno(stage: "fork") + } + + if processID == 0 { // child + // Wait for the grandparent to tell us that they acked our pid. + var pidAckBuffer = [UInt8](repeating: 0, count: App.ackPid.count) + let pidAckBytesRead = try pidAckBuffer.withUnsafeMutableBytes { buffer in + try ackPipe.read(into: buffer) + } + guard pidAckBytesRead > 0 else { + throw App.Failure(message: "read ack pipe") + } + let pidAckStr = String(decoding: pidAckBuffer[.. 0 else { + throw App.Failure(message: "read ack pipe") + } + let consoleAckStr = String(decoding: consoleAckBuffer[.. ContainerizationOS.Mount { + ContainerizationOS.Mount( + type: self.type, + source: self.source, + target: self.destination, + options: self.options + ) + } +} diff --git a/vminitd/Sources/vmexec/RunCommand.swift b/vminitd/Sources/vmexec/RunCommand.swift new file mode 100644 index 0000000..e20b86a --- /dev/null +++ b/vminitd/Sources/vmexec/RunCommand.swift @@ -0,0 +1,502 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import Cgroup +import ContainerizationOCI +import ContainerizationOS +import FoundationEssentials +import LCShim +import SystemPackage + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +struct RunCommand: ParsableCommand { + static let configuration = CommandConfiguration( + commandName: "run", + abstract: "Run a container" + ) + + @Option(name: .long, help: "path to an OCI bundle") + var bundlePath: String + + mutating func run() throws { + do { + let spec: ContainerizationOCI.Spec + do { + let bundle = try ContainerizationOCI.Bundle.load(path: URL(filePath: bundlePath)) + spec = try bundle.loadConfig() + } catch { + throw App.Failure(message: "failed to load OCI bundle at \(bundlePath): \(error)") + } + try execInNamespace(spec: spec) + } catch { + App.writeError(error) + throw error + } + } + + private func childRootSetup( + rootfs: ContainerizationOCI.Root, + mounts: [ContainerizationOCI.Mount] + ) throws { + // setup rootfs + try prepareRoot(rootfs: rootfs.path) + try mountRootfs(rootfs: rootfs.path, mounts: mounts) + try setDevSymlinks(rootfs: rootfs.path) + + try pivotRoot(rootfs: rootfs.path) + + // Remount ro if requested. + if rootfs.readonly { + try self.remountRootfsReadOnly() + } + + try reOpenDevNull() + } + + /// Mask paths per OCI `linux.maskedPaths`. Files (and any non-directory) + /// get `/dev/null` bind-mounted on top; directories get an empty read-only + /// tmpfs. Missing paths are skipped silently — matches runc's `maskPath`. + private func applyMaskedPaths(_ paths: [String]) throws { + for path in paths { + var st = stat() + if stat(path, &st) != 0 { + if errno == ENOENT { + continue + } + throw App.Errno(stage: "stat(\(path)) for mask") + } + + if (st.st_mode & S_IFMT) == S_IFDIR { + // Match runc: mask directories with a read-only tmpfs. MS_RDONLY + // is what actually prevents writes into the masked dir; a + // `size=0k` option would be a no-op (the kernel treats tmpfs + // size=0 as "no limit", not an empty filesystem). + guard mount("tmpfs", path, "tmpfs", UInt(MS_RDONLY | MS_NOSUID | MS_NODEV | MS_NOEXEC), nil) == 0 else { + throw App.Errno(stage: "mount(tmpfs mask \(path))") + } + } else { + guard mount("/dev/null", path, "bind", UInt(MS_BIND), nil) == 0 else { + throw App.Errno(stage: "mount(bind /dev/null -> \(path))") + } + } + } + } + + /// Make paths read-only per OCI `linux.readonlyPaths` by bind-mounting + /// each onto itself and remounting with `MS_RDONLY`. Missing paths are + /// skipped silently — matches runc's `readonlyPath`. The statfs fallback + /// mirrors `remountRootfsReadOnly()` for filesystems whose existing flags + /// (e.g. nosuid, nodev) must be preserved on the remount. + private func applyReadonlyPaths(_ paths: [String]) throws { + for path in paths { + var st = stat() + if stat(path, &st) != 0 { + if errno == ENOENT { + continue + } + throw App.Errno(stage: "stat(\(path)) for readonly") + } + + guard mount(path, path, "", UInt(MS_BIND | MS_REC), nil) == 0 else { + throw App.Errno(stage: "mount(bind \(path))") + } + + var flags = UInt(MS_BIND | MS_REMOUNT | MS_RDONLY) + if mount("", path, "", flags, "") == 0 { + continue + } + + var s = statfs() + guard statfs(path, &s) == 0 else { + throw App.Errno(stage: "statfs(\(path))") + } + flags |= UInt(s.f_flags) + + guard mount("", path, "", flags, "") == 0 else { + throw App.Errno(stage: "mount remount-ro \(path)") + } + } + } + + private func remountRootfsReadOnly() throws { + var flags = UInt(MS_BIND | MS_REMOUNT | MS_RDONLY) + + let ret = mount("", "/", "", flags, "") + if ret == 0 { + return + } + + var s = statfs() + guard statfs("/", &s) == 0 else { + throw App.Errno(stage: "statfs(/)") + } + flags |= UInt(s.f_flags) + + guard mount("", "/", "", flags, "") == 0 else { + throw App.Errno(stage: "mount rootfs ro") + } + } + + private func childSetup( + spec: ContainerizationOCI.Spec, + ackPipe: FileDescriptor, + syncPipe: FileDescriptor + ) throws { + guard let process = spec.process else { + throw App.Failure(message: "no process configuration found in runtime spec") + } + guard let root = spec.root else { + throw App.Failure(message: "no root found in runtime spec") + } + + // Wait for the grandparent to tell us that they acked our pid. + var pidAckBuffer = [UInt8](repeating: 0, count: App.ackPid.count) + let pidAckBytesRead = try pidAckBuffer.withUnsafeMutableBytes { buffer in + try ackPipe.read(into: buffer) + } + guard pidAckBytesRead > 0 else { + throw App.Failure(message: "read ack pipe") + } + let pidAckStr = String(decoding: pidAckBuffer[.. 0 else { + throw App.Failure(message: "read ack pipe") + } + let consoleAckStr = String(decoding: consoleAckBuffer[..= 0 else { + throw App.Errno(stage: "sysctl open(\(path))") + } + defer { close(fd) } + let bytes = Array(value.utf8) + let written = write(fd, bytes, bytes.count) + guard written == bytes.count else { + throw App.Errno(stage: "sysctl write(\(key)=\(value))") + } + } + } + + // Apply OCI maskedPaths/readonlyPaths AFTER sysctls (writes to + // /proc/sys/* would otherwise fail once /proc/sys is remounted ro) + // and BEFORE the user/capability change (mount() requires + // CAP_SYS_ADMIN, which we still have here as root). Mask runs first + // so a path appearing in both lists is hidden, not just locked. + try self.applyMaskedPaths(spec.linux?.maskedPaths ?? []) + try self.applyReadonlyPaths(spec.linux?.readonlyPaths ?? []) + + // Apply O_CLOEXEC to all file descriptors except stdio. + // This ensures that all unwanted fds we may have accidentally + // inherited are marked close-on-exec so they stay out of the + // container. + try App.applyCloseExecOnFDs() + + try App.setRLimits(rlimits: process.rlimits) + + // Prepare capabilities (before user change) + let preparedCaps = try App.prepareCapabilities(capabilities: process.capabilities ?? ContainerizationOCI.LinuxCapabilities()) + + // Change stdio to be owned by the requested user. + try App.fixStdioPerms(user: process.user) + + // Set uid, gid, and supplementary groups. + try App.setPermissions(user: process.user) + + // Finish capabilities (after user change) + try App.finishCapabilities(preparedCaps) + + // Set no_new_privs if requested by the OCI spec. + try App.setNoNewPrivileges(process: process) + + // Finally execve the container process. + try App.exec(process: process, currentEnv: process.env) + } + + private func setupNamespaces(namespaces: [ContainerizationOCI.LinuxNamespace]?) throws -> Int32 { + var unshareFlags: Int32 = 0 + + // Map namespace types to their corresponding CLONE flags + let nsTypeToFlag: [ContainerizationOCI.LinuxNamespaceType: Int32] = [ + .pid: CLONE_NEWPID, + .mount: CLONE_NEWNS, + .uts: CLONE_NEWUTS, + .ipc: CLONE_NEWIPC, + .user: CLONE_NEWUSER, + .cgroup: CLONE_NEWCGROUP, + ] + + guard let namespaces = namespaces else { + return CLONE_NEWPID | CLONE_NEWNS | CLONE_NEWUTS + } + + for ns in namespaces { + guard let flag = nsTypeToFlag[ns.type] else { + continue + } + + if ns.path.isEmpty { + unshareFlags |= flag + } else { + let fd = open(ns.path, O_RDONLY | O_CLOEXEC) + guard fd >= 0 else { + throw App.Errno(stage: "open(\(ns.path))") + } + defer { close(fd) } + + guard setns(fd, flag) == 0 else { + throw App.Errno(stage: "setns(\(ns.path))") + } + } + } + + return unshareFlags + } + + private func execInNamespace(spec: ContainerizationOCI.Spec) throws { + let syncPipe = FileDescriptor(rawValue: 3) + let ackPipe = FileDescriptor(rawValue: 4) + + let unshareFlags = try setupNamespaces(namespaces: spec.linux?.namespaces) + + guard unshare(unshareFlags) == 0 else { + throw App.Errno(stage: "unshare(\(unshareFlags))") + } + + let processID = fork() + guard processID != -1 else { + try? syncPipe.close() + try? ackPipe.close() + throw App.Errno(stage: "fork") + } + + if processID == 0 { // child + try childSetup(spec: spec, ackPipe: ackPipe, syncPipe: syncPipe) + } else { // parent process + // Setup cgroup before child enters cgroup namespace + if let linux = spec.linux { + let cgroupPath = linux.cgroupsPath + if !cgroupPath.isEmpty { + let cgroupManager = try Cgroup2Manager.load(group: URL(filePath: cgroupPath)) + + if let resources = linux.resources { + try cgroupManager.applyResources(resources: resources) + } + + try cgroupManager.addProcess(pid: processID) + } + } + + // Send our child's pid before we exit. + var childPid = processID + try withUnsafeBytes(of: &childPid) { bytes in + _ = try syncPipe.write(bytes) + } + } + } + + private func mountRootfs(rootfs: String, mounts: [ContainerizationOCI.Mount]) throws { + let containerMount = ContainerMount(rootfs: rootfs, mounts: mounts) + try containerMount.mountToRootfs() + try containerMount.configureConsole() + } + + private func prepareRoot(rootfs: String) throws { + guard mount("", "/", "", UInt(MS_SLAVE | MS_REC), nil) == 0 else { + throw App.Errno(stage: "mount(slave|rec)") + } + + guard mount(rootfs, rootfs, "bind", UInt(MS_BIND | MS_REC), nil) == 0 else { + throw App.Errno(stage: "mount(bind|rec)") + } + } + + private func setDevSymlinks(rootfs: String) throws { + let links: [(src: String, dst: String)] = [ + ("/proc/self/fd", "/dev/fd"), + ("/proc/self/fd/0", "/dev/stdin"), + ("/proc/self/fd/1", "/dev/stdout"), + ("/proc/self/fd/2", "/dev/stderr"), + ("/dev/rtc0", "/dev/rtc"), + ] + + let rootfsURL = URL(fileURLWithPath: rootfs) + for (src, dst) in links { + let dest = rootfsURL.appendingPathComponent(dst) + guard symlink(src, dest.path) == 0 else { + if errno == EEXIST { + continue + } + throw App.Errno(stage: "symlink(\(src) -> \(dest.path))") + } + } + } + + private func reOpenDevNull() throws { + let file = open("/dev/null", O_RDWR) + guard file != -1 else { + throw App.Errno(stage: "open(/dev/null)") + } + defer { close(file) } + + var devNullStat = stat() + try withUnsafeMutablePointer(to: &devNullStat) { pointer in + guard fstat(file, pointer) == 0 else { + throw App.Errno(stage: "fstat(/dev/null)") + } + } + + for fd: Int32 in 0...2 { + var fdStat = stat() + try withUnsafeMutablePointer(to: &fdStat) { pointer in + guard fstat(fd, pointer) == 0 else { + throw App.Errno(stage: "fstat(fd)") + } + } + + if fdStat.st_rdev == devNullStat.st_rdev { + guard dup3(file, fd, 0) != -1 else { + throw App.Errno(stage: "dup3(null)") + } + } + } + } + + /// Pivots the rootfs of the calling process in the namespace to the provided + /// rootfs in the argument. + /// + /// The pivot_root(".", ".") and unmount old root approach is exactly the same + /// as runc's pivot root implementation in: + /// https://github.com/opencontainers/runc/blob/main/libcontainer/rootfs_linux.go + private func pivotRoot(rootfs: String) throws { + let oldRoot = open("/", O_RDONLY | O_DIRECTORY) + if oldRoot <= 0 { + throw App.Errno(stage: "open(oldroot)") + } + defer { close(oldRoot) } + + let newRoot = open(rootfs, O_RDONLY | O_DIRECTORY) + if newRoot <= 0 { + throw App.Errno(stage: "open(newroot)") + } + defer { close(newRoot) } + + // change cwd to the new root + guard fchdir(newRoot) == 0 else { + throw App.Errno(stage: "fchdir(newroot)") + } + guard CZ_pivot_root(toCString("."), toCString(".")) == 0 else { + throw App.Errno(stage: "pivot_root()") + } + // change cwd to the old root + guard fchdir(oldRoot) == 0 else { + throw App.Errno(stage: "fchdir(oldroot)") + } + // mount old root rslave so that unmount doesn't propagate back to outside + // the namespace + guard mount("", ".", "", UInt(MS_SLAVE | MS_REC), nil) == 0 else { + throw App.Errno(stage: "mount(., slave|rec)") + } + // unmount old root + guard umount2(".", Int32(MNT_DETACH)) == 0 else { + throw App.Errno(stage: "umount(.)") + } + // switch cwd to the new root + guard chdir("/") == 0 else { + throw App.Errno(stage: "chdir(/)") + } + } + + private func toCString(_ str: String) -> UnsafeMutablePointer? { + let cString = str.utf8CString + let cStringCopy = UnsafeMutableBufferPointer.allocate(capacity: cString.count) + _ = cStringCopy.initialize(from: cString) + return UnsafeMutablePointer(cStringCopy.baseAddress) + } + + private func mountConsole(path: String) throws { + let console = "/dev/console" + if access(console, F_OK) != 0 { + let fd = open(console, O_RDWR | O_CREAT, mode_t(UInt16(0o600))) + guard fd != -1 else { + throw App.Errno(stage: "open(/dev/console)") + } + close(fd) + } + + guard mount(path, console, "bind", UInt(MS_BIND), nil) == 0 else { + throw App.Errno(stage: "mount(console)") + } + } +} diff --git a/vminitd/Sources/vmexec/vmexec.swift b/vminitd/Sources/vmexec/vmexec.swift new file mode 100644 index 0000000..956680c --- /dev/null +++ b/vminitd/Sources/vmexec/vmexec.swift @@ -0,0 +1,285 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +/// NOTE: This binary implements a very small subset of the OCI runtime spec, mostly just +/// the process configurations. Mounts, masked paths, and read-only paths are enforced. +/// The `network` namespace is currently ignored and we always spawn a new pid and mount +/// namespace. + +import ArgumentParser +import ContainerizationError +import ContainerizationOCI +import ContainerizationOS +import FoundationEssentials +import LCShim +import Logging +import SystemPackage + +#if canImport(Musl) +import Musl +#elseif canImport(Glibc) +import Glibc +#endif + +@main +struct App: ParsableCommand { + static let ackPid = "AckPid" + static let ackConsole = "AckConsole" + + static let configuration = CommandConfiguration( + commandName: "vmexec", + version: "0.1.0", + subcommands: [ + ExecCommand.self, + RunCommand.self, + ] + ) +} + +extension App { + /// Applies O_CLOEXEC to all file descriptors currently open for + /// the process except the stdio fd values + static func applyCloseExecOnFDs() throws { + let minFD = 2 // stdin, stdout, stderr should be preserved + + let fdList = try FileManager.default.contentsOfDirectory(atPath: "/proc/self/fd") + + for fdStr in fdList { + guard let fd = Int(fdStr) else { + continue + } + if fd <= minFD { + continue + } + + _ = fcntl(Int32(fd), F_SETFD, FD_CLOEXEC) + } + } + + static func exec(process: ContainerizationOCI.Process, currentEnv: [String]? = nil) throws { + guard !process.args.isEmpty else { + throw App.Errno(stage: "exec", info: "process args cannot be empty") + } + + let executableArg = process.args[0] + let resolvedExecutable: URL + + if executableArg.contains("/") { + if executableArg.hasPrefix("/") { + resolvedExecutable = URL(fileURLWithPath: executableArg) + } else { + resolvedExecutable = URL(fileURLWithPath: process.cwd).appendingPathComponent(executableArg).standardized + } + + guard FileManager.default.fileExists(atPath: resolvedExecutable.path) else { + throw App.Failure(message: "failed to find target executable \(executableArg)") + } + } else { + let path = Path.findPath(currentEnv) ?? Path.getCurrentPath() + guard let found = Path.lookPath(executableArg, path: path) else { + throw App.Failure(message: "failed to find target executable \(executableArg)") + } + resolvedExecutable = found + } + + let executable = strdup(resolvedExecutable.path) + var argv = process.args.map { strdup($0) } + argv += [nil] + let env = process.env.map { strdup($0) } + [nil] + let cwd = process.cwd + + // Create the working directory if it doesn't exist, this seems like the expected + // OCI runtime spec behavior. + if !FileManager.default.fileExists(atPath: cwd) { + try FileManager.default.createDirectory( + atPath: cwd, + withIntermediateDirectories: true, + attributes: [.posixPermissions: 0o755] + ) + } + + guard chdir(cwd) == 0 else { + throw App.Errno(stage: "chdir(cwd)", info: "failed to change directory to '\(cwd)'") + } + + guard execvpe(executable, argv, env) != -1 else { + throw App.Errno(stage: "execvpe(\(String(describing: executable)))", info: "failed to exec [\(process.args.joined(separator: " "))]") + } + fatalError("execvpe failed") + } + + static func setPermissions(user: ContainerizationOCI.User) throws { + if user.additionalGids.count > 0 { + guard setgroups(user.additionalGids.count, user.additionalGids) == 0 else { + throw App.Errno(stage: "setgroups()") + } + } + guard setgid(user.gid) == 0 else { + throw App.Errno(stage: "setgid()") + } + // NOTE: setuid has to be done last because once the uid has been + // changed, then the process will lose privilege to set the group + // and supplementary groups + guard setuid(user.uid) == 0 else { + throw App.Errno(stage: "setuid()") + } + } + + static func fixStdioPerms(user: ContainerizationOCI.User) throws { + for i in 0...2 { + var fdStat = stat() + try withUnsafeMutablePointer(to: &fdStat) { pointer in + guard fstat(Int32(i), pointer) == 0 else { + throw App.Errno(stage: "fstat(fd)") + } + } + + let desired = uid_t(user.uid) + if fdStat.st_uid != desired { + guard fchown(Int32(i), desired, fdStat.st_gid) != -1 else { + throw App.Errno(stage: "fchown(\(i))") + } + } + } + } + + static func setRLimits(rlimits: [ContainerizationOCI.POSIXRlimit]) throws { + for rl in rlimits { + let resource: Int32 + switch rl.type { + case "RLIMIT_AS": + resource = CZ_RLIMIT_AS + case "RLIMIT_CORE": + resource = CZ_RLIMIT_CORE + case "RLIMIT_CPU": + resource = CZ_RLIMIT_CPU + case "RLIMIT_DATA": + resource = CZ_RLIMIT_DATA + case "RLIMIT_FSIZE": + resource = CZ_RLIMIT_FSIZE + case "RLIMIT_LOCKS": + resource = CZ_RLIMIT_LOCKS + case "RLIMIT_MEMLOCK": + resource = CZ_RLIMIT_MEMLOCK + case "RLIMIT_MSGQUEUE": + resource = CZ_RLIMIT_MSGQUEUE + case "RLIMIT_NICE": + resource = CZ_RLIMIT_NICE + case "RLIMIT_NOFILE": + resource = CZ_RLIMIT_NOFILE + case "RLIMIT_NPROC": + resource = CZ_RLIMIT_NPROC + case "RLIMIT_RSS": + resource = CZ_RLIMIT_RSS + case "RLIMIT_RTPRIO": + resource = CZ_RLIMIT_RTPRIO + case "RLIMIT_RTTIME": + resource = CZ_RLIMIT_RTTIME + case "RLIMIT_SIGPENDING": + resource = CZ_RLIMIT_SIGPENDING + case "RLIMIT_STACK": + resource = CZ_RLIMIT_STACK + default: + errno = EINVAL + throw App.Errno(stage: "rlimit key unknown") + } + guard CZ_setrlimit(resource, rl.soft, rl.hard) == 0 else { + throw App.Errno(stage: "setrlimit()") + } + } + } + + static func prepareCapabilities(capabilities: ContainerizationOCI.LinuxCapabilities) throws -> ContainerizationOS.LinuxCapabilities? { + // Create capabilities instance from OCI config + var caps = ContainerizationOS.LinuxCapabilities() + + caps.set(which: [.effective], caps: (capabilities.effective ?? []).compactMap { try? CapabilityName(rawValue: $0) }) + caps.set(which: [.permitted], caps: (capabilities.permitted ?? []).compactMap { try? CapabilityName(rawValue: $0) }) + caps.set(which: [.inheritable], caps: (capabilities.inheritable ?? []).compactMap { try? CapabilityName(rawValue: $0) }) + caps.set(which: [.bounding], caps: (capabilities.bounding ?? []).compactMap { try? CapabilityName(rawValue: $0) }) + caps.set(which: [.ambient], caps: (capabilities.ambient ?? []).compactMap { try? CapabilityName(rawValue: $0) }) + + // Apply bounding set BEFORE user change (drop capabilities early) + do { + try caps.apply(kind: .bounds) + } catch { + throw App.Failure(message: "failed to apply bounding set capabilities: \(error)") + } + + // Set keep caps to preserve capabilities across setuid() + do { + try LinuxCapabilities.setKeepCaps() + } catch { + throw App.Failure(message: "failed to set keep caps: \(error)") + } + + return caps + } + + static func finishCapabilities(_ caps: ContainerizationOS.LinuxCapabilities?) throws { + guard let caps = caps else { return } + + do { + try LinuxCapabilities.clearKeepCaps() + } catch { + throw App.Failure(message: "failed to clear keep caps: \(error)") + } + + do { + try caps.apply(kind: [.caps]) + } catch { + throw App.Failure(message: "failed to apply final capabilities: \(error)") + } + + try? caps.apply(kind: [.ambs]) + } + + static func setNoNewPrivileges(process: ContainerizationOCI.Process) throws { + guard process.noNewPrivileges else { return } + guard CZ_prctl_set_no_new_privs() == 0 else { + throw App.Errno(stage: "prctl(PR_SET_NO_NEW_PRIVS)") + } + } + + static func Errno(stage: String, info: String = "") -> ContainerizationError { + let posix = POSIXError(.init(rawValue: errno)!, userInfo: ["stage": stage]) + return ContainerizationError(.internalError, message: "\(info) \(String(describing: posix))") + } + + static func Failure(message: String) -> ContainerizationError { + ContainerizationError( + .internalError, + message: message + ) + } + + static func writeError(_ error: Error) { + let errorPipe = FileDescriptor(rawValue: 5) + + let errorMessage: String + if let czError = error as? ContainerizationError { + errorMessage = czError.description + } else { + errorMessage = String(describing: error) + } + + let bytes = Array(errorMessage.utf8) + _ = try? bytes.withUnsafeBytes { buffer in + try errorPipe.write(buffer) + } + try? errorPipe.close() + } +} diff --git a/vminitd/Sources/vminitd/Application.swift b/vminitd/Sources/vminitd/Application.swift new file mode 100644 index 0000000..866f6b3 --- /dev/null +++ b/vminitd/Sources/vminitd/Application.swift @@ -0,0 +1,118 @@ +//===----------------------------------------------------------------------===// +// Copyright © 2025-2026 Apple Inc. and the Containerization project authors. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// https://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +//===----------------------------------------------------------------------===// + +import ArgumentParser +import CVersion +import ContainerizationOS +import Foundation +import Logging +import VminitdCore + +@main +struct Application: AsyncParsableCommand { + static let configuration = CommandConfiguration( + commandName: "vminitd", + abstract: "Virtual machine init daemon", + version: "0.1.0", + subcommands: [ + AgentCommand.self, + InitCommand.self, + PauseCommand.self, + ], + defaultSubcommand: AgentCommand.self + ) + + static func main() async throws { + setVersionMetadata(Self.versionMetadata()) + + // Busybox-style: if invoked as .cz-init, run init mode directly. + let invoked = CommandLine.arguments.first?.split(separator: "/").last.map(String.init) ?? "" + if invoked == ".cz-init" { + let args = Array(CommandLine.arguments.dropFirst()) + var command = try InitCommand.parse(args) + try command.run() + return + } + + // Swift has issues spawning threads if /proc isn't mounted, + // so we do this synchronously before any async code runs. + try mountProc() + + // When running as PID 1 with a Musl-static build, Swift's runtime + // captures argc/argv as empty. Recover argv from /proc/self/cmdline. + var command = try parseAsRoot(Self.procSelfArgv()) + if let asyncCommand = command as? AsyncParsableCommand { + nonisolated(unsafe) var unsafeCommand = asyncCommand + try await unsafeCommand.run() + } else { + try command.run() + } + } + + private static func versionMetadata() -> Logger.Metadata { + let gitCommit = String(cString: CZ_get_git_commit()) + let gitTag = String(cString: CZ_get_git_tag()) + let buildTime = String(cString: CZ_get_build_time()) + var metadata: Logger.Metadata = ["commit": "\(gitCommit)", "built": "\(buildTime)"] + if !gitTag.isEmpty { + metadata["tag"] = "\(gitTag)" + } + return metadata + } + + private static func mountProc() throws { + if isProcMounted() { + return + } + + let mnt = ContainerizationOS.Mount( + type: "proc", + source: "proc", + target: "/proc", + options: [] + ) + try mnt.mount(createWithPerms: 0o755) + } + + // /proc/self/cmdline holds argv as NUL-separated bytes. Read it after + // mountProc(). Returns argv minus argv[0], suitable for parseAsRoot(_:). + private static func procSelfArgv() -> [String] { + guard let data = try? Data(contentsOf: URL(fileURLWithPath: "/proc/self/cmdline")) else { + return [] + } + let parts = data.split(separator: 0, omittingEmptySubsequences: true) + .map { String(decoding: $0, as: UTF8.self) } + return Array(parts.dropFirst()) + } + + private static func isProcMounted() -> Bool { + guard let data = try? String(contentsOfFile: "/proc/mounts", encoding: .utf8) else { + return false + } + + for line in data.split(separator: "\n") { + let fields = line.split(separator: " ") + if fields.count >= 2 { + let mountPoint = String(fields[1]) + if mountPoint == "/proc" { + return true + } + } + } + + return false + } +}

^cd*uG8WiJjid6a+%|TFi${S42}K15WLPF3JJg7+;VPG|F_ACJ2DY-88fDnNwZ$bQsW$CrlcvJrb#NF35G+Bi+0W)Xe zPQt9_BqX+jNC*sb<(!!0OgtZMcj}CGBfCLf!HT**FK`5pf?ai&~Zub-ztX7)! zs(nt1nbF!ouju^mW{A-3{jMs7z+j>T=t;>yi$i z!6xayC2A+(W1HP#IIYvNbz()ozx3kPm+9;4n5%Q#ir%U_Y5ieuyZk7?|2Hn{F8~OqR}Lb$c=ylDjpF!xoq@bSfbWgYlUIa=iHD7G;X;I4a?Qz#+|rPH(}6h zF74pFRdiz;LKkYBksFqF$mA<7klE!wRvRyqfrcuy-;>Mw0fpHnMn;z^F0+y3&)ET5 zH>S#7?WvSCENNRF_&8xf5ccVAmhR?XcodTo(pTm5SVqdoby>a8mO{`o^J_DAJdrUqULcpgZ5{^{Cp)Z0H<{xyfdrG9c+`woLgS^_# zqUXLC&5Jb!qf2k_QxZZiJPC)l<2EVbqPAcKxn_Xr>_942cwZb}!^cT!hnHWaF{p!P zTGy}e74rdNnuvA}v)}Q?G{dZDV49Hw6Y35&ob^$+45aJuL4{NW?RvtxJGdM{4ZE!t zeq>LGdKa#CRd|!=nW1nW_KLadLAeOHop@KF;Uk~}(-yoIB<;l#77B_Z5hB9=Nu50q zJxlAW%ORbev1EtkO}Xa~1)xsZf+ z0>tqo=qZEAT~=tKs=Bj=BUz0ymP)(n@>8;hO7+|$)Gs!0wH@w9QEW9Ttu=HTn6)!3 zZA|z%2a;^ZWe{Y|Q=`kw-@;6mmCouu2McKxB1;7R83(yk|K5d}xEs$l`t=FOdcGhOT=mRYyOP=lmq zR>wo8_g%6@z?Ps}xb3bfvwgh*-oWR~=~Xf^zuf~HuulI|A4|sU7M)vobi{R0iX5(M z&75~fztK28p1`dZw-syLt?3iINWrgZ&cw`{bNSVLtMKug>c$HhM?%4%0%RA?h)))# z?c4rg)7HQdFc#89vwl+0ly~qBzZSqsDqO5pSFu61qiBo@W)-yc*_x?n^1KGce9;(H znk|$r1WSE9vEu`Jr{m>gNqj#F#l6!H1pS%!<^?ro7X^hon354D;vrHSR0zoMPIV$b z=(aVa0#b0o&RPKC;*yM)ryW94i}8V{&R|Bq@EtVYb1K%FE&1b-1>_$w5iqd-k70E5 z@6Gn4n$ljnC+K)M{B{33Y~D&nM~;^$Va-B9ZUf=q)w zkG3AdsnRgIGuxMKEtgp{!1$$E#YCL(2E_6)KL5B908MNyp~r*jRg(^hcE46CnPOC} zEa>q0a2Ta4B&=D|l8Yv*!x7_o=syAa@`59(zKaLDdb1qvrQX4=-K{+A>Pogj8j zmz}Afb|5ELTl97sOV1N*o?}y&$`IC&ef;ACENpp`8m*ScWyC0pf-oF#%z?rLrQz1 zbLXJLOs`L-k{p_C?&wY7;Kygr&wYOn2Mufn2ExfG{Ef{c0he1%9NRQeZsJxX*S!+N zFSI)Xsz=&k_R2)40>8Xi`=bBzR9RowpnQX-@9S|~H$6%1kF37K+ zWgjF8FkiV$`^%%2UahOF36b@dAK;c0#h@mk@sWTye>mKjmLNt@AkrYtdDVenm$IzaZac2$7^*Qa;~YxbDiPi3XRnjbJsg{~kH= zXS{Ll>qwLt8t%p7ehu-;=q#|R0$3v>&Np7mSU@fsrU?<1#BUI=6(UGybZjqAO0)sx zqj#&Vqy!>ySW0oR=-)#a4wZb2BRcb(AYdSAQ7C>BXIy zgKp7U6{5TMyM$QIb?DNP)wg!?lxHVjGLbs3)G_#y&SSSlC$zYF9!}oN$X?UCQjyhi zt(fcwp;okx1o}un7YFz6l3{7D-TZa~;_2ePT=I&=nNfeF@vIi?7WKH5h=z3^L< zpT-c3$Q4rK8KH^&nXOL{Q3~Ws0(%W}Ev}?!9k$O{XTZ?P5i~KLqr4I*9*$aL_1f|_ zlw&M8J^6s2zm4x770BCSSbf|Ie}}JaF07JIQQuy5UJraxNr(@7Nu_*2PAU)34|wZB z{0EAQPCoKN#UTM^;!yTIC?3Duaeu{b!K)fGN!_BkQofUymwNCbsKo)sc5k*U34mf- zgavCnb}3(Z&DZ98 z4cg(Lp`nK~V+*H(IfJ?w3l=pIQ;oiTsD3~6amhDt8reUN#KF^m-|h};Blo;QlX^C9 z10=MZVxaBq3udS#<{H!!(H0adkbN$s+OqjGRQU=7Cj%7H*W$sdw&>+d^4mdd5Z0q&80@0*Ypu-!0d>1JCsq$t1K?NTa_eRQA^)1Z!5%D==1r3*5PfHC@ucQD zrZC7*9gA*zc9;}S?SyA4U#tszM?kYJdch;yV)%}bchva+OJ@Xf_{l6S4m>>b{HWqd zqyU1La;fa*3W{MP=1UVJOFLi8<~z97+oV(D2KDBqV5RQKLs zQEJXI19e;_C4!s>_bsR!pVKl%B_FZHyC@Vs?Wltw^qh6{=EN-ph%x<0%4~nDw0Dyo zhr>>|t+YKideV3Q!poe;zXAeq$)9(MeW#ib(GIulVeWS%={?O7%I;9GCtc;Nqmswa zBUG{FP{S41W->T5u~{3#S?H}U~9I#HDNl2sO%z?$I z)YasxIp^q?$5FIiKjx>*MHr%Lv#1Mw&Kj3WXW=}2POXs7Dv!9fma3Y=bLMf|5u4fB z{<=!=ccc}y%HgyY21eh-Ne5=L^)Tc6M67^1A=z6ZR64G{z3`chwJP_?^3(eVeAjg_ zD$RhXDr&h$;-Rp1Y7d`ERzBXdi4rAa8lCE72*r4(Q_lFZ<(E3^(URd!;PsO^bFF8| z4r>-l0IIa+rln_$!+&d`P_R344YTZ;7?NcSEf18|50$!0=EDaf4M5ZlmqfZ$ zjQE#QAE&bD8w%Cl{~I%4YA9$nxmrF$gqpEEJ=+_i#SSgCTBSDUzkb7Ztsb>W!quW_ zmqkN9>&@R!tF!1ys+^oy9>^Sd=@uRSRIF7P5ObH@zC~mENI{6S3pyQTKpPNd>%Q&B zY}E`Ig(I;zvrEm##ReEaz3-ncI&m`vFmcN1dMxLIPCZM=$IEn_qQ|?8L=D)p0es(i z?nld!Z^Qi$`}k{{0I&9Gf~8ngB7aNnrvuxzUlQR2Ll^AS-8m@wqX}LVuWSAcWdRd) zJ?CxN+8q>57YJS%bv^lB z)g|^jnYoridN+>^-XepE@OK{~LdUgm%l+`FhmIcsnkJ@}Ko+;qL6$oD&p z;T=M>2P7DTl#0#(z1Oh)j|$Uur0Dz!siRkDc@FP4M%6ov4QIS8T|W2BoSuPV$m}>E z2WI4h6%#v0BiTl;W#K?A6ohiYzrKOQ%LEo)FJL;38q=ZxC2Y6b4Ir7gMO44UQc{wA z&7qnSUMK0#d7Y?i%{L$j3C5ID00i|r>Hr(V0{^@iAGh}==!?W(_r9C6x~{#PKb7~* zD?s!dZ`V@cr`&m@i2wZ0`@81vwlS=*-eYB2d%}qgsgmJOPC!ABb8i*CgqOo>%-L*oHtJMJeQJnnMg=dOM8=4 z*H3@tQQUNeny$V0=IB2g?u+!;Tx>>e9j|96nmJBunasduRKH;MBxL;-zgDsbheoFF zKxcR_cu9dJy`j%|XeEx53QOUVGn^A})ZcV8k0H5H*L0}@Zr!r9ZYq`A9i7-6K_oI{rHNRhVKt|zjFEcF@HSfv^1mr^R zX=d7{0on=uu|SQg-3Sf!@z%x>JH68caCWcko6Kq*>y=6Y3Ik#QGPB^(Hn!{DOJ6m4 z2TBd0jNWU~%5h|K_naM-T->=&04|0-fqMm|o&%#|&mwpW{s}%}lNoMDeUeHGuFE$~ zS~_}Y-m-qz+FV7_4;=%%?bzimCJ=%~THq5h__-L2y|lB8FR)z;^N(8Ei`qH<=4O>Y z{z-|yLpFEEZR(O-ai%FyurKY2pDfmE`o3bHV#nhy)bcExm^V0Hfoz`4{}1~5=-nxIjyb1`D~u#nd#!PD2w6>^5A4@x8yUCq9&eeeZ23=qB%nl_(cLB@QmREn&`>b*nj z8Cs16(Sul$xW;u>ELgZL;XN=*1^4#4K0^hQfy%s~UB6z~1%@C6#OicxZ~IfFz0wYS;YiHo8~cNrF6I zo%C0%7MbmHrm!p{+xSHy^nw<|XfNlCg>F1U-974%>-6vOHb@mI2bNK_c%h?N7)=pf zUT0}2Da-4;j~5bGuiCYS?^)lmYicuQXVF6L>}B%nmlsX}KTWg-j`^s0w()0+{|jG} zaCTI#dkspw_uLU=vue?4MH^TAwf=^(*4~06hHD{si!PS<1dF;At}~G*h~vTM_`{~Q zbL@nbB1KrSP?_F}H$k7cC)U`i4-Ty4&^XU818+Tw*HPB<7k0G|#rUTRk*bZn71l<% z+!#lk*%PI)wM8!jGF*$SLR;AyK^`ahl5)Yv!B8b4dH_KmEhw)+mX4P@Hh>o9QI7`` z*@1bKlB&73Ir2>;Yj-7nM{LJpJ(eM?8t`9TT7DPZN7We$g+A45QWE04LwP72a?GY| z>YM2VG%P_nWa!Hh`qf3P=su!cxPwyL445Q#(g0%rtk)6l&->kF(si&UPIf<{8m{ia zSsM&Oa6$$EWHI2*I+0$TR)edjbHWuVy7?W*OU62$tJnP(jezi>iduSr*dM7|>}Z)f zX3SdOU+L9q@+^M%r{4@&y@l|}kwlz^Bw+jL|2(IsZA%xkB$*VvWY9sX%_h^MQR^ig zvVHOM^YA+0wW%b-cuMb^G?VxYaS&VZ=Lk(-biWvjNR8Jcf$gFxsoRnEVSLIS;HM#- z`~*6OyZNL$yTpm1f82xmUJuXT_CeF5c6LNQ0q)NB!?{UAZte+8hvuX8ppBWcJJ#zb z`7~(A1c0(lw%(Y5;Oxl;-iGe*hqz}B&iKW#(&6J%9lmVcUV{Sl$lA|5%ZMz>Wo4dm zPV$(RvQ)H|+=R6`bemz%Qtz`2V#$)>(xVGVEn*n}mzAXxzQsquGinmv?x`P zPFA(eMt$HWJzvvRhGZY-0_wy8of}_1~rK+TT`k9>qVc(D^u&QRAev zzttovkp9#(Y^cZ_ny;+?TW3T}O{ZBbpJxXp;eSp_s*hdKCJl3&XjokNMlONAV#Eh`0;wyl7Eu=k(DpJTSD(A26@?xE4KBrXyn%DvF_h4^>Lu*W;$OJTSaG{yWr&Jz?nX~Nv=`A_$Z%vHyOVScu zwx; zr=E}6WWd0~lgFJwxJzk(6Nrij`A4nEPd&%F((-zsIKJWfgW7p1e@yxgn^_)-b_HOB z6Jrq+AgL?R!&uC7J}juGrO+<}{Ha~t%|MZmAKD6YSlEOGMFE6Ti<=jisKmpyl+`kZ z=@8|mnT=OIG9~)7TsmK-EqzYYd+tFaUc$+d^daC+4TmsO@eX6?TRrYd$apxSr08-% z@i#EzJ(I>u5DoSq6$*Dj)qTtP+B+Af@#I$2WqUK^?=<_2pNEG0&X8btSHR>qEZ;$u zg^5mgKcL4|Oh2d)(uaQ1m!WLu?5g&Y6D|<#TYBwNv{kCKXLtu+!qV}3nDB!3e6rN2 z!c#dRf1q|Z8fmjh)WgxsF?Q^)b!IVT>qKLq6ZM{FKtXoS)7Fu(ItTwa9w)O0$8cmPRD!0nzfTF|uA^G%4%wkJ{93iCGyuXs-;KC24UjwTF-b)BL+*sqqs}+Hq-I3;jQAFAGlxaxE`+ z%cSJJFvsNC`CTt%`UVtI2t;RfPQ7MICOS#Px&pI~qC)4A18rdtbI@<$ zZfF0nDPnLu>wxVM2G$s0;XNU#>C%z_o)hw2IC0^VdTMD=XvEk>)@aF)m{MSm}s?86t_g0SW`@VkuVs&~4mjA;cHF3Ff zLBg=8YGp{oP%+}V^yzE^CM)~m*XP}Y6kL~~8 zCLhDMUFp(t;#4O_PctQ1ulk2eTH1XTab2{Hm9`06i|gjP$S;qcsH%g($$$!L6Nc%w2d&x50!3L%^qKz0T|?wuLsn zQe9X2eR9!Dh{o;!QfH%!(^w$VVg2-@NA~9`AXlE zugLO-u}&_jv^9biidgdlFL(!!xfXmv`ZlViW@1Fjrd5?E+eqpP9a^qjt(pD+@wt@R z2}n|%{Is%w85a1>Xb|ii7C*Z}v=HOls^mW|jh8qY2UMuYI>=so0s)*KIPF4-QccX@Po_NHO96CQUF&llyMl>aWYRsmY(~%2GBa ztVh}cJa6pc@O?KL-=$?q!uV;fhcV$=ryZ7l*@VX5OSt#VE`v&DSzRwVRbExy8la`)O zn>^8%15t-Giwmk^-qf} zp2Y!@Qeqm39?D3=*80+ve0OfA>(@`{$ii{5o`x_O{Y+L&(4>Sn0s?A{S8Kus(Tdxk z%rW`Tzw#-3CafO=ASQMLZ>6;}`vU0p>0Yrme3n+Rm@S+*o77e)%-aalLI5=+*>s`} zRUrnq`D&nn!7a9Dk&+}f{Vv$R%gBcsK@o7j(&vH@bl+u08EdqO>z>bfHM%8rGGuD| zujTE9m^5`UK)cxE^{1kmp3TJg*cEJK3~Ux)=|J>)6gPWCn+_>@8i)|NEAA7$ir#wZ zFz7jVboDRe5E+RmAv$O{v`rw5ee6H?VZT!{JGg4eSnJd?4(`XfUOg9nHln7Ku~xQ@ zlm$>}Qcp4Eml)oUxBo708*1A9q0yR7Y8yszQg&wfaE*PJu)~eKH74i_fX7%FB5*SX z>(3@4;FpoV)|3U|gyJz~SH~VUFi@{@voWoN%(Zp{;Z~Q2Hub8PnK-5Ow?c+HFN(R2 zY75}Xyi9DtKfXop(pSwX`}?JN^0B*1RVFW7gkEaKsnsLo(dF>GP--f#qI}FYmHAu* zZ3HpC9kNiDkKc;zPEHC7{QMoMYIbTf*9y@DKl3U zMMSyt#OBhuIz$#SjaPWA_1mJ8mt+W=W=o)CtDx2nETJV9TyKK^j*0uq1E%<)_J;yo zkjpcmz>vZp-CR(U@{5O|bJ|~{Ak^nY*Xm1M)`0vi+(l~kuhe>xWEB^`$5>Q+2trSd ztDDdrS8-6Mx$-7yIp#|O23x&6?$-Q?&tMWui?9|SW(oV#zX^0GtO9I(~}{krL^xI zlgy0w6yxkbQb*>z=7nj{6|E#8PbL9i4-dxGy1{t)d2Y7iyV?ZXoC{QgaCi(naagY6C z5`55Svt{owz?s2R{4#DOR(Ec}YY|X6ZPtrR*%!O$*}Gpk zN;7=35}6+SvIUW6-;E1Z`_YXIn}C7tj0NHrFs&bm1a-mX>@xVETOsz?6DH)LGN_Z0 zT{A_4a#C3%g!X&lkRZlDGpUr#xvS(v3kJJPEGk}2SGVA}hIFgyHyog*Av4GIBz+Xf zi=B@#BPpE`LI>z9?0s;JwWP{3FavcLp%CY5hxrTdL+|(`!tr_z6>L<}Jb4 zJMN^~(@;SezpZ8hgM7DLW9i>ClF5h#ouLuTtKkq!Tgh+j&@st;_mm1`c!~9pRMM z2I^qqeQ?jIPv)Dt8F6WpW?HyO4AGjzU#Ik*J)XkY4$^JL$eF`lJGt0Mz&J>iiT{2b zfK#k{*Zgl?B`?nv+ZtrS7LjFynF_(bO%bJ4RW*}uNAY#Iwh^6fJJAs!qM}?gg$cM5 z$=&kQGB@(?NBSii%-{6nEG&N`wy4x<)U*aJu&SXLid@FBOmUJ*+<_objX!aHj3s#o z6sdZP+5r4f+n`V@6*=~;+@2znFGJW|qF(xNjNoeylWd9pB24VCe!&K5_b)!>q(xJ! zob^BjQ)I@c`NY)9pTOvdV*OOv#srmmI2gmuXx<064E(fuxwO2YuA zSG$RyEyFG!qDRD|%`3twuZhkshmP3%?yHKuFYeEj;B;_?074OqY=P8*@+m%?XmP3_ z3Q=8vOv(f!BjRbZ^<|hD?x{`K;08+T?eO}mLERAf|4g<| z72|g?7hGEJvZ+MAm#KAHx8N2RHyd#SxvG16Qbt&7n};W+iVlPWMU@2cezx{`)n;u_ zj9O>l-D%j8brs8{1^#-$))7|_qrN2TVYSp(_8E-pdbS)^X73Q${k2#KYmh+`Ia*=yuEWT zrhvE$I@kCG@CL`F&T496t_G8&UkhDLxTN|n{I*z(Dn_JLADf#K-4`l71W~rWoXYbf zwtIS#w=el=ng9Sm|G)0DptN#Y85r(vD<@8;)RR@62xR_z#|rWXhuXLgr>FR zkdeXNC45v4&RY@WP#ioB$H5E`EsM9_;!l1eQ~U>285BD+_4C+!UO=LOZ9okmHcO#2 zG^|5ewXu+kNY52l7Y@+BD9xmIO|A({XHgicw8=F=3p7o$?>|PDZmxCLYAYg~?~bo> zuoRHJ5s==R0*oN_$1_coh?;B|w7{v92bxO|kLV@MoAvsUiola$901WYnkl0-IOM0F zwuld{h?byp=Md^P=!k581HAs=vP&eG_H%Em03IfT4Tf8$QIB7#kMy8X|KMZ^mHSpx z7-8zgGw5%M2bUUbwfJ+cKuU#hhYLUjaojPK86 zIxb9j29TRrZ$6h(iOHg6divp&EM|r~Imhv~k`I3R0NTWnHA| zk;&wX(A$OMhJ{e!K_5t$Wb8ELR6_It?Qc!vABGgX0i1sV3}uwkkSrUkL5QtbwQ`sks6?_HDupP7z3xMh>vBwb~Fg9P{z{; ze8Eq5%^Jq-HR?`^YB-~#*r}pur`X`gKmO-)#%tIN)sKPaHwcp`bMM5FQl&8eN0kB% zjQz_Cl{!s z0+YEi12hJ9aX^qO=g>b{r~5j4$fbrM4fe)K2Uh9)tYI*vevlBz+Z8KyCwEao&rs-W z3%3^DHg^N;shgVQ{C7sL&YOQ1Vj^H6;R!AxBfgNjLRd{O7)_LJ( z7@u+X4D2;i?>YWgallDSRp>pN#mbMM(YmU2%_Fj!H6cp_{Ls}n+=~U&rTCVN@ey(8VauYpM1p_ zWeLlLeKR&g8JQrWWU}=j(safwDMsF>N`E^AJ`uLTnEUmela+Q6fI&plFZBJA9@nQ| z0!qBMmNUQ&Etj~|XL?L@lc$YncXJc%IWHhLgS`!Tai#jS09kxU7 zSM%^GE?IIe!?x4V-4_{xNd?sW)-GMw47M262)pGwE`?&i9;3LDAqM*KEvsT@V(t@v z2eu?+luv27dfX#k8J5LO%kC{oeI3$r7>`4bcE2##@&26WV>tgBKR~^6X7{Pt7fOnG z1P&nKIZ4?toKpD|kKCP7)ikPD{#|Ixt2;cNCEjh_SPdJQsmvx$z&wi{s!}~oxF^BU zqN;eg?q4QGUqKDwaDB}`O3JdzFE$@&=4OiaMV-@*8QL}*F@zWAkjxjPR9j!P&MVJ|Mn@|MS7nZ&>7H<$o4_gdF)ki;3a z2hnzJWz6rQiA#`%AmdT2`di?0^KQJrb&C3=$5~4cDJH-SlS)3 z+ijgYGH#seMg24DL6MPCD`=zh#*#x5Ns17$FPabGlpz>)hp$lNaa{_!b*dNjH}Zs= zDc?k3(5%lThh}6S4Z5@26t*7#aF~M~p1t`O^jEH^u6w86A2G%$viI*cG3QV-X-OMis;9VXB<%l`O*Y+oO~sAkJQP|tbsyH4ebd~q zBx&bmU@GSTTWFb}o)GX{s5ymM-sDE}-rB&i((%#-)zmC5enebSfQ7qMm$t2KS4r(> zuP3xy&JR3Tq9h`s%luA`!aOp@2gJs}P{ZRJmUd$K>R#N%mguS=CagsJ@)mM(OkD0! z2e5SZ-q&4o^yv*L24BkJyQDtc_jH+4dQxCUs_-|{lWr6Y z*GXSek2FcN=Mw&|(fa(wfH)?c@qqzY6`3iG8!dFo@$~x5uKKARyYW>nX-013k)uep zsSC1$Pd{0SQ#v!uQ&|#%Dy-ExgXdmPMKXULLP$o!`CmSmbi}Ikrpk3R~ zaY2Isxjf)XmP7bt4?@Lt>?UHF6YKe=hUCewJS@piiS)omnYhuOd$&OfUqF~;DcxXe zC%LKfSB`#DVNDE);mKgHaogQ zh4l>>E_g$(q$F+Js|Az^lqVPOyna%ofZ8ba!yuWvUABG>Svy`G8&A=Z{x-kt4Ok z`D(hv<`^hYoe31a?Q_ym|M(Oui`^<3j!3T9-?>}MkHU=Bv-?0Vuxy&@&=ict$H(~f zPvX}>&9*c?ff)&+QM6$D@@(d=Xh*q|d&%bj#HaG_i`e|16 zu=3V;AeSgyevk%$8Dpf1?+WUOsiLkUE`DmCGG09j3mV)NBVX zUdX`(VSPj>=B@CZEj`YVeR(eP2)=r$SOljz1>LlVYQ#9n==Wl=<1$VI7iH63?x35(y`Rn8-q&oEdhrQN6uCDY(A`TelMDI? zKmj)2iAJWo8QD+y;d=wg?*S$0ZIy(7_>KboZ!ql}n9#G`l4V9oVcvH2ODO|ydG5Y? z2X3e-xC69oP#;R7uf5(Fa*(1DsabpWmMz*nkh*+%K5p-nH{$PWDs*d7pu!%ZBw2*( z+|V>&sDZEDSHh+Of6ty|C>VT|n2>sQKX?`_;HTdWOCE~89e?tGM zr3JtAk}#?rmU>CN9I9N6==0MWXMaZtkTrr%%q~#=EV(H;|4EO2iH%AX(bj|8C9J`L zBXB>t&VK_&s5z_uamjl;vtFP6iV8WcYQc_LsByOeB`6iy3a-KVBOJl#h8?(ZZla`T zB25m`s&FPF{1xqI5r=7S#!TT$1cvEWK)Q5f=TYcfCv<>oQc^Dnp@%yDoVmO|#z`?sc%;@(Bg> zYCML<=U^)CwpFg&&iLfl-*Q5cZN%7M@#qF|IHLnT8x%)$leJ+e-Xo8`h+f}^N7P@D zKG1_AMwK*p5)z=j5?Sgnsp+3ND7@*?FSlpJDB4Z zn-(mx1HtudtN?1Z!NN&Ro%IfTUEn(s%q_aJdn(~2C~Er^KqEZtl4#kY6X(4W$otx`=8UD80PQj+^La>HuVBR(n zYKGUp6-c6Uk7(Z3vTfkSA0O4l@6Mr+T;^;QbEnKL=+8{Z7d-l2+fP*UqyJDoLSPN^ z_q)dR=VMSw!IWTVy<)(DfEN8_`z|AAv$pt^`T##25Ej+hX80wv&hjo#q9GK$EMx3M zR|khYFCx!K(;!j&UDcmwoUh}FHpTjU$_Lz5Do&+#<_Vemx4NneoZ=62tDC-WP~-O~ zGV-g2qlr4|*HTh$?HiQvS)IFjh;P5IYKKQOfAotDGZHIjYsnoLBQ8|#2PnOrp|6E{ z59M9=i^|zOk5A0b!)`i22+|brD4W1adOX7I;2;F``R=$il)O_$@*1n@-qM zIyjNMNGv!BpyOua>$w6gfQNxkTpax?51BVQ`VWqbhjwz)&&VE%JC~s5GG;tgEc>ZJ z{rS{T;9CQ?9!dIH>s7HK&{FH>4<%eo4QKX3eJ>wyCkF% zyd<_@Kw{Ex4nJaYFQLg20}nY@cYIti6U&S&g#CMOV7nR%WsJe*OJI!WK9nlVaG%iq z01h^?@nU#t$eX^4RHv=(K8_qCzM^wOz7;Zr-6D0>n){PDRWGD8Of$pRe4j!upY|t^ z6>Ahvyh{f{B$%eeOfMqYfSH$TedsGOH~!I!y}t-bRz3f<5^coKymjg3ZyGQ(TPz)q zg`nvD{o>~nbIoI8kfo$Qk!5$(?F=0Tm6LRZ>@nWSxh{NdEDaU6YYfupsLPOC5mUvT zRP>Pd$QNb6KkD`9{XJ*9#lvvmk3g{gZ~k#2yR+iVv~HggVPE&;AG_*C1^ zB&8Fvehc;I4kw!L0Sh!wk;0SU<`iW3dqFoMIj!`mJNtes*eefyKvh~uVK0?lTqWfO zi5DZb8#pd|MWqo6jnj>`jYq{#kBj01g`rxajmk~$$=-bip+6zHID3)zT%VWY>s{(z z!KE;;f8b2-<>R0&Ben=3=4Um62U!BtXr=K&aI{`j?H-x3Rq<&qe5!0-)cO{uAKON7 zWhR*MwnDQ=nS2MnEAF(x@V7_!&*Y6XrsWr!w=6CLF#Y>N=b_*l~{B)%*CMW+>)J1}^wiac^yHpE_p$-Xr$;n8kQFt9XFvaHr zo{`o$$TjdYtM(81&hI8hNLIW>MB>-{-?Eh;2kS>1-iTfZ?x9wiU5_=zv(tU!C4$V$ zt=R8_b_i9T^Z*}{Bo6kLm^2U&lP5cty>&&Mt-*Px31|wu6zO92UQTWM@+BaPQ>MZ( zajN>F9HFzK*CJYSVO%hE%!07c2aJ^wSES-X^F4=FML5Ja>rm@_hM-7D&qw=c1WW~DS74iNp^!xpv@q~x749F%TL*%!L#+|o4q+n-UsCy<#h6a7cOl51 zZ6%aXks7ou;}zxRCAf~*GvfsTduymUL`zsa7gHBpyw%OrDd!h@X{L3K3IIXAw2gTk ztSS$ids^rh;peG8GAP$Q+LiEt+ovz;jsBaQkep%SgVxypP4NlXir*^ zE8pnmG`4`7u?~mqDHlzcEkMxs%2l0K8P$AFE_Ge!KJ7=`u>|E|59h=darF3#@%+`> z>kEPp{$!%CQ>*m>!jGU$T^m#~NXm*rSxSXybgynRej`-U|XrNe9pRMLABXIL> z-0>}?!hi2ySi+WOXG?tG*OuD%*Lr=lPe{FoYxKR*Mclei(g1(nJXhB{TdDIGc1H}) zNC&9HFkr@*ASt?Ec5P!{hkiD^qvY0VRdb7rVnD@yqca4~;+>yo9Ppud(hFF@F6?*; z$qOC(%yQV|70U^W*)yrOBz{>)zuMbenbDFPw)S;+Q)!7OYdrhXr|ZS{>Wes8jsnMS zmWqWOksFtno~NA3eETJAV#psf_()uR{5~18ALnsF2LsySxaxW(L z>Y>k9)~5G29d6m)8jSS;cEeUcS3OD;1oHg4J7DpM9u^3hkp3sC1XI|43|MN}TI3Pb z%t*ci2)toO-QHgV$B&!{ljExHoa4p@c-jixu*35U<)B|4KC=~n@$@*d?eeCJ9eB0_ z8O;~87#B%l7rnkq1OU!U%tv8%h1@HJNP_g6v|>}o22k=ox^40q4}XNtrcIWYloGbk z)}+DA6jb(l@swhr$0C~z4r$LgT-u+&`jdeq&Y$zbW~~Mx@z8+|$hr=90<_j>NuUuv_JRawz&Th+RYbcMej<+CIxOUO#> zp&iN`K8VWcsY%7gV>g-LCj*vybBs3LiGVOH0F(>+A35OdwlN`) z{-o}u<$IbDK~bxTRN#$Y5F2(UcRjFJhI_X~`_O@?&A`ZC`~HjyJzZf-n=*A~sjMbfGh^;_JdZ{po5EeoBCE$<3={$X&rp`NOy zbI-%pt7&CQJnSd}V`8DUqt%R_5rLQzPwckkI+mdk6L((^89)>$%<(=M9e6RUT+Y`i z`T{#C*g7}Ml(IO-e>z6exBmN7d;y}HQ&$9YP6m+WcnU>l5`)(C~l5A?PvnpfY5PDj|N#diGj-+bRJ@(rMQK|(gZy_lQs+z zRr`C$qa~-4us%tKzjlwrO#aSF_AeDP20ArK=Lr9qto9&ntFi^DJ0ho-A3CI>^BaVTnbbi}+*;T6I-7B;i6se4Ncro*Dbu6)7-MGxNxZ+o}gA`zs8< zp>DcV0c^@4i1Rq+~bTU^k{$U5S$v~RlP19)FYORxSa zekZyYw2~)q6WP0K9GX5Ug_^fyTWx#nvL-r9w->Lqp}b9JOoq`@E?s2kRoT0)!Bs(- zj!o@7p6cWBc13NfyNL_H6aJYju+pjPSXWJmE(A|{cB(q22$Mo|FFG}_Hq3YIR6#C* z_Mh|TBfvkTQiC|+67Aa~pbNiYn2E5YJ*jGQp_$2^Xhk*h8dun`%P8AhB7n9VP{+E>?h0N5=b7z1e2JK$XkXZpSBo{YI zW0u16;2{b-pOmfEq^Y7*4Jxx-`o8NS))OM7m0l%s`4}HiWCUC24j*jcPW6BA6HnT8 zt6G@T2Qro_#~u$9+m>If!S7ow)@>63*#w-; z^#LP{uW>ch;c&aOVU#N~k?O0f5(BP8}eo}A3i>O`CpYxyo3|Je>J<;H9Y$TLzTaW^206f6CGt2f^|J-QO#~bUrAGouQYwA!9~qI zDFCDMyF>s5SEcLyn5M4A#B6PS_CA6g66ej*)&4>Fq_b)S6DSZsC&@!}&##+c7ekNN zw^nlVNDAgQ@;_1eZpfnqi~)vjgD2v;@{f<9Ip-JM1`rH?`XXJ3HO9?gqVWC6?S-s} z{e8f98-P6_9*#}hAmTW!)U_)sF}!;Mq9stk0U&m7mEbTH07ZIPjggWhSA z8Wf?hs(`Q@0zVU)6@Rn>k1z}F*>cNtl}b6YPIwZrcZtBS7yZF#Wzh((R$SocZ?hf{ z&e-4XXRX)>;CVLWR~$tmr$nd{H)I!Ms{vp^sa?GfObrU_f=A(i1p89B^_U!`kC zH{qcdKep+xfhG3QxFT97NP_`3)VRQ(H&Pp&bq+n%V*tOGYFPv3bH< z0boibio0;C^hLo91SUUpz1=ga)?!w%=Pi3?qCm9dy^b}y@h@4Y0c~2RraOY8v{X?u zYx{Ugbclad>IjY*c)WlaFF}_epq{@(t}Z5K<0YVyslJR2mh6+6;^%?Y5Mnx)I8inc z0N}wo#nh!4^nzv#`LhH*SHnZA#!{7!)A8QfS8Xy+$BY|#Q)S46yWGw$&6Awksu!3k3L$K|wt^ z8-IwWk6|$WXLU8vL6F*WfX~VHL;z>a%CBvNIhwM&{H&X@l`qK#I;4A=CC263dd7={ zYPTLDst}gbRZyY=1Zk4jYag3M2XWfmcEz|fqB1iUF0d+)LqL*ubWYr~;(ftauk|rS${XzJO>4bEBRP-$6*sa!rAOQHlL2JQr%ptDQht_NMST$R?a1; zz+&|^SWS*$)UG8^?nT`ceMW&t!#_WP+nQNcPetvV;{2BXT{m#8((BnRDzCW~N_ky& zwU2ZeZ*+Z1?t`U)^VOh3UPijUNvO_pHZskOo1pn!x4FlRvRSl5!H`pu(x^=NH9#`a z@Gr}13*f#q$$}V-`}|OiXVr$(@v*8eoV-%IpBEf-9p5b)ltY_>y-VU;~zU>s;sf^*;!X#v8Y6Hr+2Rm;8JA-=PK?DAcHbA7XV@T^+E%rxB_po z(`8XAj^8MFii!aHB-Yi2s{4kMT@j@7{Wci$Vd^ue4DhsQ?$hH>A|&1)DTIq#a~0NN zqj7!kWj4xaifv(>4O89p60=|Mv4+;-)__U@37KWvuIBt`Tlo-~i=PNm39ea9Z26HZ zSL*Pi+qju2FRPUSeeBqGb9GOML}_-(Jn$`h4ZhTf4ZNUI^eWL}DyiZ@FH+8yePx?; zg5E<-_>OlR81;Uuls@N>E1?zuf1I6$(R64Jc6p1C=ZjRY=z~N zK;WYRS5`wn-Kno3c@T^LOHt&a<<|`2o*p>cWZ|(}crA+Z0HQO_f{0$rnZf1PGY<-W%TULDEef{Mf!gMMXgg(hae z^rakbx-$Afdn;s^Sd7ju^H%U@?{j&?!Uxxd9d$S!6@s1f-8yokBMwR$I+w`t@mO6S zu5HKz;Cm1CZ#6-U)dPjy>pgR^lQqB(`$E+5Yc=AQ#o6*{yKr9c4Cb|gl*uWfG>O@q zNdY%j7BEL|$mryUCdm|XOwC)w4qz4-5wqt&XKv#x& zYjwU?kNyqcOn*6=m!^ls{Ze-}$!25E$22?idJ)i{G)&v z_)B)2-<@pn*ea_G5&|g+{V4laI0Y=lXVI#>nC2pQ22W{fV;U0+rP5)?MOz`Ozk7d- zEV`4QL1)BYQ>>5$hP8knTQyIT^{8L_R^2U|>dOz9JWlbYEH`lDT(6cks4DE>EC9`~ z104k~jOYGM>6dNc`6FNm>iZ|i`QJ(Y*+?~OL&X`8vGMMNdRO|T*4WALisuuA{3uke znf;Nzktdia+}AF_AqhV`{5p>8`HyzPy;#jHs4V$1xl#fk%zASKU_6l`Hw@Mk~Wbi zkm!8O#GDhmVLd27#|a--^G!B)+@LOoDzc}mp!el98~jV1TP8E(&f%1vDxG}AGFTuCx2fS zQlu|0uaWF}A@`v;czDIBlw*hZm7e*6m~EX%fU0^n`Ct1vJ+8dX{AWf7e&6r^jc4cC zV32!B5M?@GhkEUrL`Z?mt>kKA_yTW1ij71l8n{wmOF#VGGp!V{G-Ds!>zY5Af+#j` zj@LOZz&HD?S8ReB#^g)N0BBb<@KwwXn#Bm6!ge5yoLd*+}QSnm-( zNVupKN|LEL;-)wQrqg+gI0mmv)T;^;|1J8fOJts~J-QeH{ljW+A)NIut1Utj$#UL< zLTd2TmUHowqb-}Xlu--7*Hj5S7Ru}o6u=~#F({l*gxX|D7dig%C9m~@CB zgj<7DsqVrLibk==`~C7PuljN{dU;R~#svKe9!jID!*0LG%{7)A5h1Q(WY~qs+S1l( z%r{p_a~cqP*I3;P^A_h~EHaV~aBp{X4gbQ8J3lEXkBGPeTRMwniIOkJFmuBoyrkq_ z>i8kH#Ya{(kM`BwcOBo*C!++p(8MSfrLRX-g_Ah+tP?POcON~~*CM{+PHjsLz8yn( zG?i~Sp|hav_80Uda3&Z&9NyfiXA;xM*KiZ1vnAmQ>Gn=mf*0JpmM>WYoAkqG(vX!M z;F00L>Pj%JHo6G*q7#eU#52hs$bHI<81hXXP;>k)`ljXsD*!u}+rOOhEx zY{_XdB9&X(Sfl_mgDs>NE&xrMeeVRQi}HNA+f>hE6jEDx_K95jiiL=O%I*7Nyd4dY zQ71)opjG@}>hEqq>kDB;MDDgAOyLM(Dc#Va)qg^{4-)VD6Qc2js#X|maC%KrcFw8o z3d~jT0hvVU#B?(%&QtSGj~r(?D-K5DNd{8C#6OdSMhctD9i?WRK0VQr+TsygiF(8{ zx~UocJmc`7n}bl!sbb@W#>C|!yBdxJwN1(xeXyBOc!+63;Qf%Mzue;k@?D{#h{vm` z!rDLod8P;b#IgHFJ#~U6QiVVH$%RHF=?|8Sy8?q?X-SMY(N54~EVdG|j!VCqj$kjZ8ZQVq_t){>})}BWV$IF*=YC2O8D&!Us*b<7+mMW42OjBc9FuLo0QHWB%@X(=9Ek5^so zLiyG9!yYNbNd)Bkzne;X-B(fm#L?O5kCb@4TRu zGCn_7E&N0oWQ*yV!t(YlFbogF!~Vk2yx_mD>p)~E;@LcYB$SWnREs8S;Z8(aeR~o% zEE26Iyr-ipCAr?_WG$HVR->E3uI%Y58u2AKAc zL_qLf;TH8>O`C=0CcUf7Mq(II)jXeW`sbAV!Wx}pEZoD1XOuTs4HLNEK|OGI9$|HN z%)ei#(}~Q}Ku%@7&OGp1kK*AZs_hTa0}b^yn9ZekKqLx+XnBG-Xm2YE&JWEGy4$rP zIMT464+ss|UZ>EhIc7{o&ML!ajFH^&z&cn^AF!lNznNFhuClLcLehVQj6lYklUG#r zw1Zi-8B%McKMr@Anf7d}yJVakn{qylLCitUrQdn{g#N z26JF>!!Xm90!v1{)NaNp%+TQrW@73o$ImsMFCU=%j7o!!JN0^RQm>huhO6Zpg0mPk zcblV>$T=`St*H-_xXA4U@(Y@=(aD}bPjMk*Dg`D}qd!CB_h+taii z5OSVP12DQ?>5L%~<~r6)7^El3^-#UO@P^m`R`3vk?CbnnDTx1bU~Bb^3oryzg<%Z* z|BoTkq09G>Q#3hZ%$Ly_4T?~heHnW|93tLOkTRM*2Q|P* zObX4BtM~H;cYv0ASu^Iplek&XIv>pE9n`g0?&p>Ib=x;|uzgML?;sQ9f(MS>S9LR1 z#DK5{pKEe4&#YgT6YKOewrf@IRVGf`Y%gRfkvwfF(v-a{nYovC?tT5TjTBD_fwO2n zc_>y;KZZ<|Y_0aiLnZ3G;<|Sj#)4&YIFOymSIwe)(Ysw@a|$1L2~Kc5@Y;ZL21xT)OlyfL5mgbC-o>?+GU zIxyl}yv?ZFMu6<929DTlHDyw`!}*tJ1}#33aYSwbQ4m{nxj)zWT$twgm@+1tUYv;g zs&LXS!uA4^GgXqh`wj~T-(B5DD6TTICymq?LuAB%U}D*0(J0AvJ4CdODwFw4Pkw8d z$r^%DnzDd!F8>*38@9X^j^+=J1Q3)&Y%)t>yh;{(B`PPDsi|QQ!A9Nn5ms|@DWJ7pxm647%Ypqwu9-LIkiSQHN3ckRpHFpXDf0$8%k`&;Y z2%`*aXYvKAsZP#2v9^qYT@mu-*V;N|pyQ+o0UWXjkd(DiRwN?*60Lf5&kqkH!=@kj zIlM0zQxxytkZMpXjEkt$j9HJ^freMX(fjA7AZ~oW&g0G~HGGa5X6k)`3EQY-x;zIz zBhv+!Op?N+=xqC-or_J&I+o`I4@ieB-BI&Keqo8exUim_#5YyuPk4T?SwhOXO0rPB z7HFA5w2NRpR6!RJIYM1Q?7~xmd@{+=G)dS`DIx2Zm`v*-&QR7<+3{{B`s8sm*f^{? zPXacR@(76BB;6nN>3@Tuq-(|Rj)M7;yn;W@hNd+57N^^n%2Y$x{4w5h(0LlHVHLeN zWIM*SmFq5OVCW_{vk-PhF_5sI7po7G%o2F+7aZ8fb_!aw zi?L@B-bfURD#vj~lmJ0MzP}YIM4mMR5cg4vs+>xiMAgSPowTh%(Av@(`IGJ_GGz;# z6639(g6ls6=W1AkKfa$Q)7IiezmVb*VGCE+268zpK4r4>_f+pPnM4inT;5DBBF#J{ z0;LUk7O+u2JcL&I0IqsAMLNtKX8-g_&b3@o^gajjgM>{^x6T85BV*rWqE(XlE~O!f zDMCm##jDnWRq#*4Uc9(*y zA^xO4*}a@E8A80XPek*c(C5j1F{->vx^v;fzg?o(x3>HWGP(bNwknJ2fuQRio@w2_ z!HQk`W+9kdZ`icYiW*Daq9Ev6TJ97H%VQiAeVa%4`r5Y+#=Wu=xDeuT1U7hWI*Ucq z1?-9~`h|Smb+aweuKe8sF3dy4?c_i1EY~-IIz;B}jGdkOwcOsad{J1WA*|wgmXP8L zzfop)0{>?Ua32J0uv;xABU*)XW^R15>o#)_&9VpXc+tIH`Z4x`XOyb{@6sduf~w;0 z!*qFU=|7F(8_2Z(74%@}gg>grQ&Ae51e>eH?wXi@iH%$D3TbiD^GU(MhqD+hQ-FLx!f?&2`SH{iu9V_oXRs4en--#?78T03;#G zX?Z6DV&AQ~jMxZ>4Gf_v`MQ#|-MAXNt3 zrGKt-xu(B}lPeC3OQq{##u~?CV_0H0#=HP>tUY`prCITAU`0Nec0husQu9cTN~7UB z>UXDo6X(Rnrf%BkP{=tjtBT~J+2lxv6N8VW>42&T>(_tzkY8kTIn-*Y?3uZbKlN9ouDrUPtqsbwHG z>Tl2GJLQMk07FplFX`8z!qC9S)#G-xRXtq$KortzjF#PAJQ zgfuKWu|d{@06LMFj?h^PEy-mAk;?;@SKbkeOB;m?wrC|h8U%gSD;8-VWQ#{&7piDQ z@(cK)C-_H(L6kp|!vd>-D-Jx+6IlrS6Ejk~Eo&m8i=TXsKsBVtMYs46B9+BR!B9;~ zHsS0Z2lr@W%M$}|W3ij_U;%DpTum%oTv&^{ZqaGo8UFj$+-R4aMh)Ffy;9`a!UIlB z;$~}2zH9T=zAd`l8&6;YbfNIj`Xe(begFwa6{y(TxZxnx;*rqk`k@Vgy?tVx^1K6~ zM4yd4s3C`TTKV|gc7{S)bwfFaf$#~ z^@RV!yc2F;tk!ZHExRZEjm%kjxnt-G^M9nDOf{O^{}Dp-9EQ*$et~%elU(wv-?trv zz25uMbwjurW0(F8k)1eD#d_9J)clR?)#3-vAp-)TVU6+iAG5EY6WD>$_vzwdNy;1* z2RY^e>}-8I@lx9ImsRg?h=LC0^gc88VQuffsG5;4v(i1PdQO1h1ir`k!^zm90bMYz zZ8=h4od?yThVY00>=+R(X@;pJ2^JfOvQ^p;jpi+q0NBV9%tE-1i&YifmT&#EZ%gDpaD^Ilz| zd%9c_u-c&O->n@?RL`vfXwCjyTV-vf%+u{MbZl6II>B+jwW7TcL z4%Km>$Ja*N+P%%(cja-Nq4WX}#wT`8rZwiC+P>JpAr;ij)l1(v#T85XPJ{F(+lsLc zAIUr%HZ@d>RQNF-4jfKIDUhuwg|u=l8;d3{w!#z+fzUT8To2qKVi0=kqi)n&v=c7Y zkJ(oZoBbYUw{EP6xpiP-gL0O}F5Lcz?gyG;8Q$@w`^?))>lR=%M*Q+^?);!Su@M7{ zt|sq>ksx{*HP#aRb6T?#_+~Tf#Ebl~aRJBt)|O-LEd(8aB+!5Z*%+4WYMAYAn&3iOo$T#KJhkxF zh?0poU)H+)GBJVa@m7hWR;B|0VBx4)+rDx+YzR#zSElw8eM&E6xThm5q)M&Np`tRo z(U=0{8bKx_x}q0is;0+uo$AM+2nrfbaoI)p=vR3X&^RyKy;_9fvSNN#vrsCaG9QL< z#HG5ETOybAg1e+FXglY_S^kD!eY^%`f7S7WtG88|DFX zVII$3A#lrEhrvcUS*CP?f1+$kP+z?q8fAb1L>bS`?>$}{ae_~a!JwLV?yLsfYM?Yw zq~O{;p!b@%)mh+w1q9VHj7jwh4w-}XM=N}LWhDZ{h`VY}i7{ZpM~fo-O5U@%?YQ69 z)d`r)U$46Y!(w9YnL-=BTc}(>1BNLn1`AV0DFZtZWbp~gX=(b*g(DOj{bjlJYr86) zZe$waH#yXWK%@Bt?4CPxm!xEhNU~zV9PMXsBd!l*F6EN8wQ(fCV44skYf2*N3aSZW zIp9F<6DJgN>veld;X-9Mu7C(8`BRu!-SzDzH#dc~h>-;?1g6!dn6M5@OjCAwt%AiC zy4WCJOdV;U;OV@$To6hM(^8x+8*KMOgKw$K0PPk`!z6iGX#4s0u(Scf-S_1?U`R>8uG zNI?AX{_w9c+@sVXN-`Z(B|FHEXw8|>5CYoW$%mr zai2>^NI`R43{ri0ypt-bftewto~+GRQBb_emapF$kM1@FATsDtlyVZI7bSlRKFlJ| z1+puuHUZz%PT>MWPOMO5%`d{Ku=4Uu-xj7+_rDrx>!Di5&qgi6I)6$OA{9nPEy0-g z3-c%ZcxMIJ;P$w-3)@X=ew)8s6_-h$ZxL*69Uf&{xnPf@shJm&xMd~8@9L(&SE)>R z?3K%d-iyy(TYgf+%+H6)$-w@6N>B-r}15~!)tQX>Q5p6Xi-tw*Dom7-@G+X zNq*-cg4Yau^oE9F&GjR9!4!(bDuQ$lkdxI~z*mzR;T#hea>J%n#NzzZpw0+~o+_`W zyDhK4IG4z6xO;WQ@_Az1e5w5zqOtDZkQiFqJh}~p)~^-rwxxJDhu=ch(W2?#rt(gt z?WOi+f0?}dOE=0|vnh^%FpG41tYQ1gV*Vt=ZmedPs+yVRsHE6pSbWjz?#KwBRNk@g zS1h(Hcp?zH{!4eITJ5{|mzE%@jCi%VRmrcpp&t`c`Mau^0avDos$B45TR!1m^q7^4 zk4Va=bSrJNMMC0jX4uQ968 zEanD1#9+tGNsZx9RpfGL?L)YQqr>s_(a+0QtOOP!Bc_aDDznYWYh%;Dlr_2YjM7fzC4Y|n}+&)ku`%Z=pz~_I)p;8TvH|DS76TYVT zSve0EX3nvFe;FG1Fgm4jGo%BywwvC1dSX3=n2ueF$^*zOuJHFmKU1>19njRLsYv=p zUPLueRovAu`IP2gN^-(?S!k01+H;UAw1%Nv&7jBg1`R4&L6-GE8wxtNIN`hFLitkVnBo`IunBW@!2lQ! zrwdrYcw7tx*!#u(TxPyhXweo_`^A^n1A<4pN9vx7kO#8T1{8Vgw&4&}sT1mDdeG%& zUFUlcUwkEfPIt2z09?K z*mJ0M+HL?D(77I)Gvrrj^td%d=5*3CWT8Q(TK0}9wWcAC#0(4;fe7ykK?pR*;n=8X zvGbaGs*u2UGH_5_lKeO^uRhq=OOTnw7v83|DZqk7AP5Xkb~aXi2Nyzkp)F!afmg)O z^ocZh5ayV8uxS+r+bg?^rE*Xtu4^+%d!1=?$b8CrF*yx#c)@FzP?zeEtLNV-F86Lp zm8-q#AJmggFl%kFhBz$9cPzEFT-m$neX_S}(HzszW>I5|^AoMl>w*#*ZS{3#qE#?t z9cV^ST9fg@6KIuHQQ%fOmWGb|UppU3oIU08j6c?G7snV`8j5nLvpL$t`o+rMNJ!Dr zx)fa~J5007jT@0hYb_xmnV4Di6;z-;#we+1WY%&LWRBk{;$(2fB$|4&a7<|y&OdIZ3Gb*vm!w0r=$ z;1p-J#c5&-=CwwKZwcRoET}MvTO>#NLnPG)_qwYa{a~$$UtouLNV~ve^e2Wh^hsn) zT$Gx)4@KgVeVT^bw*~0eWJLOOU~-8Qk1m!osS-+JYs1S`)9)7%f=W?$zhj^w{Jacr zn*H9spDs|>~`+TC5#;Vx`DaJiTL>*FoNJo=22%wX~UYjDpDysgXCIG0r z&{+Li2~VL6|7OgHI%%2`wgqnAR9)u-j+KUJgM)7b3!DW7cNBw1m|r5VsQvTjbL{We zSK0698yF-B*%bL;x&;r9Gf1%pK`xa&_0JSgUAB|!)%c%$k0UiXFv#|F2gFRz;oCl+ z3jIi)R^+Fn2L>3sP<1m%xuH&DWz+OP!!1&ptyX{kutp@Icwe@tawxNGVQ!%O%jo_G zD3=`CcE^}603GrdzDPgQ$G(Y);g)qC?)i9UzY-qe6u;E{NvglbxKD)5T|7mzuoQ1C zZ#DX0e`G+&-l!{9b#%$$EaET1KDwhI*rU8@ogB|zHEQs#^pIkrL(-UMr;>u2$_}} zwM09VEf39*7mt9;!Z5z!HryUa<1FRLyuJTFm02}dFPx?vMWdt51^B;X)6sJ z{Qs96X?`#UhykSWGB)j2iT|l%Iv0_}x^6gxv9Bnsin3t78w%J3A|+P7bw^pxj4rdo zUj~6?Ie6{k$y%8KuKV`wRrS3ulks9|R8Qfb3L}HO!n(9?*@(pkdV|&5>q$t~$wi{j z#0J>`>@97V!kL92E%2=GXi@x+a{&nmdBK?z+2MNvQFXmAX8AF_EGB|zk z40wUJT)sT?z!FzcifM!m9t!Ps-kvdvn;3!tTJ8=rJdBmG3k5r}g{!Yeq643g9lF+Ac&z0v+qkMVBnqX!r!khbgrZ;S(J6YRP`8Q z+2S?sH!j~u_<%CY@q>5+Xa?7U#&#+YD%*4BWh9?-A5~Sh5M_XHT8@gyOv-deV?XXm z!-fxLRtWB&^;(Hcw3lvmVZf)7s5qGj0TP0DfFPY>Mv~n*P0zrJJ}{d4DCpSu2Mw!C z)B;S`!xo7ogi?H@8&rS9bWey16a(2BNdGMRzccap4&B6<^1U*d1CCa~gk7fBA@W1} zJN0UHAo~b=W)(*2bCJxA%1>;JlS{eol zh(}ResB&-&Vqfzf0#G2vTu?9{PFgww$;v;Z@n!|{8Re?mby2~%l=>~Ui$dI*qZ8|u zjqqiM$)Q8E{&w`pyBU^*oiCE;BAW2k^u&!BSs}j_{iej;cUZ2Iv;Ra%Za0(!(w6Cf z*yEGfw0~dE<(*NItX-cYIzHc)XqrZw8U{pE#4Z^RQ0{ZuIezTR9Xa=(yx?s~R`{nR zaI4|Nf|&|UWI;Epl6LEADy6G+*W+q(N-I|a$G+7y&fo6w#^!0ac9|lux#1X*nl;%v z8OL|>Ev^JEw>6ig#+OcAzNs}UQyObdsHP%FEP*AgFo}D!I5a{FrC$Q*?h>2M=Med2 zw#9S?@5q(2Krrkdj_Z>#ky@)SMji4y0{STBeB zN>FS~-*04`WRppWwha(J6P=nh@xbTso9H>yGO{CQciX%T8FzZVR90l{wk`w3HQMpV zeGFPM?1tallygqwMfS2|#J7N1OM(kwpw&Ydcr}yWMx&zDqH*j#?s|!T>2Uw8uA^k$ zVd`u)WQV1B3l@G(zz(=~R-C1MEnR(q6D$bTgM>K# zP;aL&9|rEL6T%th&wGXZFBE40^UP^y5ruU!J1ci+Ir;=g_WX=6Tok(92a3MHc-^TvqUf~>qBjZ@bB zD_k>e189;s2kV7@Rf!i^f5)_X{}tun>dve`4+$mufa3>=PQQM_Lh%@Q1>NfCPw%?j&o@7I>w}a8|e72iF*bfd1r_h+njyvtQr5Va+Fozco#Nn!L z+h@J??GR|OLvyN`8iNfQT8qg4>EIj{+OV0B&L903()y1&=o{0PDh;VkZFf`XkH>4Y zJ8cY(HD?KKLpD-A4)#wLKt+G6Ir1a>PU>#YptkI7lN)cJ*3QiykX(IX#I6Feda@;1 ztP0DO{Rdwgh4-WkZ8 zL1lC^wOjW`kx@ZbRH}}pAKOr*mwM`kF8$qPBW^?}`>yE1IF?o}*nT?5#(y9ct)Kc_ zRrTST2ZURJIZJTE{VT<{M>cd?g{noAj=q0vMfCzsUls&@`nah$#M#PUdgGROf}pJL z#45G)eJG42x=z*A(ImzNvKTF9>f=IrGoEld8(NOb1E@pu)n-8u*9q__w9~rC`=P-1Qis}K3?qMKjo7KYhX|ukicB(epvDCxK#jqZJUDga(xW zyT*=AHyb0e_f6L%Xltr2SB=(AqG{NTgtCQ^Fuy^o&s?Ta9`$)zAo@KD#n(Tk%=Vjh z;Ow3YBjj{86mKM*=dwZ9Xg6ov0kI(YiwpIqm3W|ROTa{uN_7um-owH@7obg7ixD-w zNrwfxT_1MT53pNbxA@NzR2iB{YC^4(g$w75Fj<0vE!m0nj5(b3%_Smq&sL%pK&Ght z+=ZU2)|6e=a|i8vb`fXwQmh(jA4;OCO%dS4Om3cz6GjV_KvOkSSbu?E7uQ}>hVvV6 z@s*GE)NfUiqBzq-Y<{94TNn}D15)PYz{O6E+S`%O_jSTEY0=Rsol$v_w@@16Xe zb`vd~7<~n_r=yCI;B#e(w82w+-14hAl*c{z9FIvi?!g&^6+1Sv!r>O;``#Z8r0Q8` zE$T<*EYY>8y*z&5z{UbCl<_KMQHfxN@m6aUe2RiJKOZRKS^Sq`z9VQ>RR6*!Sm5 zz;?DZ-RH8|9M$(ZGDJuMg=qq<=KQ+{o`3Fb2NEIcXH9gFk9kp@ien_JZ;x}+k!TgE zYJ`%))J>@2Pof?)qnZTr{KV(bQp8D7j(w_hstCRa_T<4~|1O*tVYUH880cQ9`vM`m z2wdRP44B1}DjaF^=!-U>ogUg46b65FJwlRNxwpW;u*IpeXC%TXDa&|{^U*hB%E+1< zIHjKs4JKRuFW*nOA&ki2pK-avY}nH;wTNoWrC=cqKpEO4f5z^U=6k%^z%V=Ga(ZqlL0Rg=j}ySkn9VYj)cf|F&(+f zhd*CA>*$_dmYzan^X~v3Dr^{Mz1{g`5gVM>^F6X}i1*Sa2JgrtKSo{fmO!!Ht>o^u z!erD+y61@lvc3MN0_!uHi(58i7oXDP zb+!8;1ElA)Npk)39$(w#Y?4vukyW>X7zM*D@gre2t$-We;ZaUeq4rw214yS5h+{DS zNc@s8n#u?pWT|v2WI}zZq@BxIaZ|ylrnN`;hqXaik`(v75Jfj29a};K?P*M<+$vbQ z03HRLJildj(GlPkBCsk`G7oMDPA9@~6d>-f3t;b5t}NgkFsuzalNAc*6!RKqu|tKu z22-nTUFYM1xH&Zthv$$@oNt4zqCCPp;oT~t!z z9>EYce96)t%Iko|JOuW)3DiDk!}e>`U;xQz7dgDm6f*oXq_A%iYhU6O9GVqR3w=zW zi9oXsgpjkwKBWtRW)xqI;J^2sq)utotPgA{l#e@0?OSf)SY0w1=DqvXw-0g-TNKmt z38?D#m@h&Hj&dhcjSK2@IJ~d8c4e2^rv^7E3BIc4_qMTLaUWe2N8cc$l#_iS<|2ML z8YY9sGT&Iut7op1rD)6JQEPPtwxQP{LKEP1;p)D#Aip8)APkoSINj2%+{H*F5Ag$8o zw!b_Md*3frSPmsqV$*ZDJ`$13Bl5sqbSqKJqOn@i^qa}0gDYB!3+V}2wM5BP%)Pd0 zW||BYu68xP={Inm+?QH{m-ZS(*C+lT!+bhYg%Wd$jtA@?SwFBc2a-O4;Ch`b4n)zf^!h+^5Iessus}LIW4bSJwzM zH}#s3Fhf*ZSWr&HR#*S<1%k>hAh5mA0DWLT+nfk~A!EFWzst-vwKhStoLrrzbfiye z%VSZolAr^dhy&GvF#BmqAh0)3I_k720e=f~Ctr3har#gj zLyZk=hrdw+7+kWGJ7au*@wMRXujFh-ESFRTH*K&i#Py_;EL12BN& zjw5?5V^1*SxK@W(L)>aS6YZ198XM|3XET2hT$UhB_JUDG${_t&?@Y9?vJcx#0D2f$ zu+wF8LgfW^*PV;Z50d3UgUtE_f4Rf?RpJddQ8dFh(!|#E`g0vf%yBcF_I&e?yEcxCVE@CGffgvym zF!uGqZ42u(**c=4#us3PWkc3Iaje3xE1qKV2uE*1s3EOFn4s_9*xC@S_vQH_iA2AK zhARTmo{zT>W3kLYYom?{xZ`&`-Zpx-cu$#Knw}Xgwb`7NAEC@)F&viV%IhXHq+?us z4b1#Zw@Y9S$<>{SRar*T+rEm8HLkf6Q`=@4CA7R$o|4%ZVfNOW{+ONEx z>URY5N0!k`V9qoy5=q_vDSDD$eTC?3g_5(mcWBl&5=6erA8CkrQJBRB=wwD$n> z01L!z)Fq4eZ!>cLlP=B2t~+r*gn#C>SWlHS=ZO&0D_k&})9;w`GY)NEe!5k9 zw)3{ls1Rs{Z|YRTW>H%F5rdv+mD}ue@PcKu7X|G=dwY@z=9L7my z_IUkiNtKqNps9Eo_7CY&lbn`pUT0%17$Pdne=pN=f|#zbE2fq~B}Y7x#SbjhLkSC% zb8{)eilfYp?Lcin7<@7w;Z7!}q}9v%kh-!29bLXMY;g%u+vBj|G<2gY^2?sUu82U8 zwj#)^|3$|7&JP2fz_Kpe9&Dw)wX>?#Ee1^~qrN3yAwrEOs&83{VNG(MWc&xO>jGZ6 zAO0F=5H;zaU!09fvk;k$TbzrE3<8Tp8mi|M1wEc({B}uJMy|{bM_5giGfg8TL{cso z_fu;mXSj$)aLCJGtZ;?h0HIyGlm`m79Ee$`h<+Z)9eki1t>mRPr8Vf!TE>4duTmDS)N#63Lmf(sd$ZaD3tNa+~ zf7QW$M2;b}$a%n3s<$YiI=#Xj_=ov5FeS38k30=z^3kACznhwxoESsu(o|63${Hya zpGiknWg!o+Q$geG;1$czVFhQ_0va)Zq@VShD9uCFa0O@RcDI?B3f3p-`(poQNB6#7 zHK03ISa_S9Tc7o78fyKHE#zVUT`0t39$6)cAVm8OR+_+$Pv zkHyIf26>Z4*9&0=Xs(+^Z=M?=Siy3s1*fWr?(L0#RXe!2_(CR1c;gr7th3vjkbRA1 z069Ry;+)17HB@8?$j1nGke#&D;WpG>W3ak`3{E5M#J%eD1_5X)poYlaTWa2;T zn&q}o6E^ggUG%l9q$n3Sf6Dg^&#w6IL2aC&Q!~qrA*(u!a*gxy1!?u@Yg^y|8W{y{3?72OTl< zjDq)5g;ZpGc6(o{;NUi-6SE7M3I6T7flIR%MJ_u2V4U2`09rxBfIOWQ1^Qk$WQm+D zxc9s@j7k0qLmFAH9#9AmEx27{f0b(Ht%$>{1r$WEaD!izMLp%cxRNL!)u4mY;z4mI zDH|#}2+DQr7D~@K?Y=4|o1-SiiSovcNjm=87F1P!e`RIT7Tw~bhI(m&nOH>@Olkje z^1Qp<;j~uIz=YN;*v|B4*d4cbZI<*XdNTu;ayQvE&mbtm#OnE(iQvpV>@2?qc##`b z8&R9S_e%JmMyu{!PAN9?xu=Dj_o1FDyR!;mwGVmp;?gV?_fN{HMkO5F`VXG^^|(}e z`Ga+{EHDGbVn|HIjyhvbdMth)Pism)y${1WOg)qQ&w zrY!3`K1O`*1J-)zh#VKG20SyT(KcN=yIQ_46J(X}k&)}YFtWmf8ytHJb`uNvno z9*uQFL!UxiETz|)&BCkMA0OU|KKKt-iUHn7LD-8&)Q!<8Dr(Kka$X8$>GC!i}iof~*kRd+Dxa%GChq~^EQW`d_3-af)3T8mNSL<94Q z5U`pFUE}FW3*&}Z_~RNse?q0#uq3y<9YE(VLX4<9Gwz?S(NT^xg2fi^v8JdFuI9rp zvj)^m?Czfbh=NPF#qX5jXh8)DOPDfgnz}Az%8k@&bcFsPX75eh%jFZq<9s zPVEN782b(ljv|UcO=hJGbn~9skoa-rk_A02pzT747@EiAL0#TNE+#PkQK*rlru{wy ze>$lgA(*SGIi2KDb?cC8s}YH*BB;fZ7E$4M2~&TzfJ^oDq7F7Bf9K3+`z&t47DqwC zcl6ImHy39#6q0=p6zEG#!@GF*pjo~K5IE*62o<`Iy||> zwQ(L7U1c?qiBy-Udjcf++qF{n(4ay{0rW?FgnWv$^f2tXAw-9=mZUoklO_qs`Y3M+ zw*!S{AuaK$KMPqE{);Q%fjDDu2{$-m1dcx=W%&2NFt`M?7uO-oi!sxC5$eTJ0h3?j z^BxUBQY!r?0svSI9~Re83F<$ea;|!LOKD;JtXxfMWnHCbcH|^Kpl|kI(r}J0zWIx* zBFLOuCdGB@mZDGJYz3MX@4r4ZZH-8zGs5UQiR28jn#PGzy2mP|`{mvSy~9uFshu{Z z%#h7!Nm6c_h1476KUB!HdUn64^d$xBLkue%SzA$m)e}@VL^m&a93L20V5|4cUDe%b ztAEFxf7fc=c8TAccyRlP2xEeg0#rAiF?&H67(-z+{7vS+uVA{uHvR za`!Z0;9&-{+zDUdS7n2WZAMg&zc>>0qx^f2PcZGltFmtHd|owhfUvHU+)j^dH}AAjEK&4wc;u%z5$@2z1|ej_vu*>!xUSGp(+f`4e`B-|sJ z&2Ix)Pc=ux5x@*97L>Rs@(PhI9Nu+MQUD5)fXX>K-xjyxy_kD&NQG@kpc@LisJ61>{O?q<~Ia5 zUmgqlI0m`m1ridXDE|_!MA!{1T95l3m}!M+nZRSkh^H-9b}}PO_bJvsMf%ra^qQug zO6TYKzaI&LzBZuUkw-hcQu4wCmW8&HteKR){pM4jb*nhtfxvks&2w^FO~AUT7^-$r z74Nws-CrVNY&Q15ax?*Yui}RrUo)K5;(-IcPOQuq#m4v#B;Y1iiXblJ1;`JHBo5TK z2ho{~RsD6r+p5vhrt!7m2`s>2RdR4+BDO)L2sCON{6c}}C792;7_c^w za%FY%S7^|Np{X48*DOvO*mbu&Do#yxE#7EGdcaTm^zv^NnPGY4<%tC-Y3#Ly1S#3jrG!Y<^=Hhl`IO z4Wu5WJMmoQ$RpJ5c|Os+gD?YRfPUH&d{T(Pe5Z1i74jCTmN2}<^R?(|-a$M)0xOb<)N1RR;XwD%cEo{$u*3{p0Ft`t3 z>c2U6Mcl6?y~T|SL?OY!E>tQqZ0b?qeW(ePFHZg^=wthF$^m`JaMIbJv_Ala!PMkB$C3Yz2seSI@_{~v34UjI-OfPGaCEyH((Fd+8G$G3AE z(T8b7>jGXyW^X6}ANW|4KrGQe>#dN zFMXnAH?Fp7SwR_dkz{vHS{j9)#ju6JmPcuvHgGnhE*gCiSyk*zNuh>3JtVk#gvv}m zeu0%aLH@*a<%xdWhSJ-MxT3oiWQq9zeOBy?$OX-IY|F2H(%omXnHFR6ZApFWXC#>M zD5J6z{FU}qptX!9FUAN-S4<$hNUJ38>8opZO*>(PXlHW5&#R8CIqX9NyH7HGeNkyJ z?oZIUr6S!&2Cb}OApd)ekdd?4iPP$V+{!V-Wy(xY3WfKt<7Zb>9Zo_QEfjz$2`flN zL%FRVw=JvsY8yO#cGor_u+zX^#~=m_scN!kt&vImO|lhXVfr&{l#*EQMuMCKQXwb^ zw5ilC*^HCW*iSPZ3w{R@Kx93lkE51F4*Z){Up%5$K2bnv+P|)A_%WCMEPhvRk^MZSMk$cyM4sOF}!zvV^1h$1$i>>=DfYtqNx zTck25$|K=WRdQJ<9QTuv2Ru%JAXu9RI5%i4DY_sLsh}xkSFz)<`{Ho!AIUs#Y z9{%S|GNApmQlU#{x?YgyR_q1?w&uo|p+WSo-r{HPss)$DfHKfS!UB5COx@`o&`+)N zODtZv*o4AE$Ek)*5U#i5T-7SNJJWkz$lzy(zQ1u!B4`p*m2+G$dn^6HJp9BD-CI5z za&e~PA1zVhVLhN=!fQc~l!Gawwx`Dtj~ulbW<lH`OX72tANICpabvR-N?_X5KN2ZW`2O_ji{1Ty^)N_w&RrppV+neYRhk8pwoV#xE*B$f+F`Se-wyjI_S3NJf zBQ`WrV)tanN9#eY2m3w1a9rzI`-kQ24&ImNb++8;um~m&5!6q_l5u=v@4ysf;SYZ1%Uev;7K?j}FDiHM z)8AIWT9k6tHWKJcw%7H;FBgt}G2u;M#Ywxq_TKO3_+z%Lqr;G|$ljN>C; zS^X*x=uEHIHpe9)twB^Ll@&s~vv*FH^gL9|8DnB+ms-$S`_9ebJhsV6#Q)y;iHDru zPK=%9y$uX*ll|(D@_>E-ng#-guFCXAyR}m87_jkS%i(353;X6f>pB`DK?|9rjsaeL zP8zDK(~FsZx@+v`I@VQ2AR7=l2F#GbYNaQ9%B5Hb*RO37rfA0w8B;_eg}ZW`P5bMV zI-q3rCFt&YJ8=%XK%%qBYZMQ|b*vj)@ibA(>t8?*g6Yz2m57Au>Eod3?>jU8GE$Sy zl}ltimv)iZ&b7kYSR*ImJ-+rad2tu)bo$VC` zA!*Mo`1|sKQ3%Hvf#2<gA|gki_)A ziXdXGrRr)+|Ykl($lTf;MaQy=v%z`q&cp;}|}6HRXKPdbzszIoff!Ys2kS*sx( zm|$?-l~EZ7)@TkY)J!lK9OU7N6(#B?&rw#%si!dr7yJAGLqNR0_6%L|d^XFi?`+PJVUmj5$FmlrjNMJou zuI6||ZMZ-Pw|c4kpoaf4)><)6;$^F_gtl}(re}Pj4rG_6cXw01S(@eO9Y!t#Im^@z_`pKVZ`kx9vzoGKujO&Zp8asE%ouc1xKP9oGXvc zmkdLJeTSd>yQ>;|8ZmramKBd-9E zYnC?xOf|qhW-L;?btu=5CBBgmB4@u!O=869+TwZ4cI%mktT}!5S~rC-Gi5*7)))Bj zhVEQ1u(MBtY)X&(fRV3DA)K2;Jnd)uqcMNfb8@-CF_uS;nT}!_{l}dzOxoqH7q&oO zo~ZK7*VRBXh*x8q-hy#x{;w%)!7MKVLf54z1-FJ-1cXo4pii<)L1y+7EiEPIk<+|%SY|I?i&FNHB&ctt&Y?~_ z>BTU9rN`p4aXTfsU*(+mMkB?d!5=?ErmFEaC&sAl4N!6MI48FjLwtXCTP0by2o1=D z+-u8gd_=ZY)4Hl~2x&knY<^vC*@#xn0&U?Cas3ovTBBp_U zamAOOs79yhi+p@c#XOS;xr;nA*2Fi+1?T?4d;;d$2~sS^sBT1lRq!$p%O0n9jmQ4A z_B%=P``|&C(-)>)KTMUd0*$LSx1f?hUKRVPw4(%zYk@>rA`r{PQa^Zb0OF$ec4Be{ zi@R12jAt)WKRetNc~yyQVI$0IL3icEkWs^jA|8qLTS3<}B0Rk*s#NV-kQXGndPZMV zGgf{r16j+vdd|Cz_qI3y7;2$x-$F@En@`q-R3EJu-DVDaFouF0T7d{vQCkL7Qa+1r za+1;oUF7HvVjb+Ue?kS-(_qxxq)5Q26W<%I^!lV65SP2HEU|c_SfY-z+`3oLROeUb=54&GZ&SdFvoxC-mV#P04nv~lRx!D<@m?z8eLlv zFbVZZW^fwS=KSVaJr``X4BsA{NYUOB*2qZ6b8YqFqspyPMFi;|U{V~waI2e8YXjX&bmfokQ#{@NTR zC0nSi2J8(>Xv0N;IItpdq$~5L1+EN8lnp&dQFh;XW)3L8!EeZq_kA}8qKZ0etKe0R z?1|#a!~p|cp@bnsyK6RMS5H)kfxh@t_gC&Pg#!_W|K!%h@I24`IM~b3mILy~`WVO? z=65_{sTA9^TrKX`=)??Z3{~QpOT>xD?nn+6*Q9tQ+S914iDqXFQ6UbI`?aex%Ra{s z10qpz1E4&qHOoM!zURYHL)e-mw|@I3jinlE=a=N&z&@B~Re4sqekDv?T1N`bwoNQ) zbE@zXyPe@+#9I(DZHZK|{x-g{V49J0oHAjpn)g;;T2!yH3|kuJn3U~l3ylVc$spX4 zEnd3274N|Z7(_qxNIrX{o)l}B-Dooy-A4$fJB@i*lG)mVG^d%oL!%0Qg$t_=!jvK{ z1(}^($Fh4EKC<0Mv)9iV$5mcr*n7105pwOl{MhNA&6?}7Yy`Q8_h4wl^8KKUg2ne; z!oEn;FO*YW#(Jr5;@9-46g1ZSp9_wdaYF6+6Hrd5q^ zLd~k zB9qx?;ixs@mDo%yWyvA0`Q1G%4h+m|t+Q>?K4p%Aa6#6pm#a8<2*`jnNB;vQYe7s2W5k^B>oeU))@Dr z>z?q{X_I-{w=UuV-I~LDI~R!M>6=DeUk)CCn-L$R2#^#Av~x0YzC%xNkmrEi{io^^ z*Y;+!k2OnG*xdu1z`@LPSs0PV~@X>gLl>yyw zopDjOfN8$y`;S9%*{Si6yYaQab(2mM#T0j0_~n5SB}h?5Drs4g=chTAt!FT*vR##w zgM*XvQh^*NcpVuvZjTn_JI;VAI*GSY{4^w@VU?cLX`wGk7A+D5{%K+oq$~t`&ObE7 zNE+s3ONzf}-BcCRB}v`wUMvnJzIV@*^y%}==9KxeT_jUuyJn4Z?|EF68f3%$z|(Q` zc^P@7F!(Ge!or;rP?b3B)y624s)J@b<59=u%hApuUOJc^dj$f9-si%o*-j~ z9hj>QS20W4kUHjWUep%`gHMn%9Odfwjg_JveJ2%3XgXBm9$<1pri@!-9euIlev29O zC2V(O6<$pGHE7aQ5n8N;u(Rl>a5kvr1kr-rVq@k%hDLV?Yp4m(RtblkWsXy>rYl(^ z%IU|%wYkb5_RM1awPt39nX+2ztp6hPl$>qJ&hw2Xe+EEti#}XF<`HC(dA??V()KMV zOKgptTOQFBu;2SvuS%=l66v@>J;VR9!G^E~Td$-rV$j%;HYmZu?_ga*1l4O0sceW` zR#{4i+Iq;(dJ>Z4H*=P$=?zdT}Q+Jk#qvT6wi;?Laub$*mE4o#t`KiBwVWkKC=6!vtVo zZJ;;09BIlzChIXYjjko)DUBJQ`gM^@QO$PNkD@?%!@FUx#A)@5inc5zxjc>&qz_VZ z5le|<0R>dm4PTL2gk-GuoTErFN-pa7_zv*dO$J~QN^)iLgb)^dB+0mlRp91>l)m zDbM5ZDh$eB!RO}@NOQo33t7U7`b1G2gx@bstIF!(NSdLBU;qF>|G!6ihA?WnzG|B^ z^imG4f4$)JU;VsS0+nyAcrK?#94(kYxB9gR?zJURsu~nQNZ^m>FZ}&S5LJ)@>wgVE zs7r#}t3x$np&eSVz>{@7XxaENBKgs$j_-}Pz2RZ&}lXD`Xa_u=U09?ZqhLGCH z2}6K|BABpF1xJs^x-LwQSBmMdmpf4s%ZUA6f2PI&&^kJBo>nNJ2zFRkN)P`rLEW4}mNN$Gs7~I&9R6&|tZl?PebPbovwa*WlXCb7 z!Etg-L1;LDE=#7x$Fw9V(9W_w#9&+NEr1j5l|lYVZHd5oVNpN3Bz$CEpZ8#hmFQr_ z_QS)}L(ch5HS+qfE93sSh#B&Uz_kEj$mOcu7_`(OzRY3A$^IhDW%haKO&l;Wdepp_ zEplF5PkvIIl^`jk3-_{p%)^Y7unF{US!0nZ27n0xJadCWpXaSC4F+i-(w~SgcAhdDbQfFDO4Tcdh^7 zov8QVc4kNbQs|npM_vkthOhR0MtEju_h<}nT-OP}*N~XvTnFjVSV&i&NSTM<2EjEC z*s!Vk+%b01tw(_5bl}=ccZ+eWnvU0Nk+Iu&(uVh88{9NkGEwf+|FUdqd61kRYv)5C z1y5#!&{p9gWAxURk;_p$6Nr~4h}wMA4a?ucea$QmC?g?XzFlHiY^O!8AFMS~+bpJW zrZ*gkTwApW!bNKDaj z%@gnFK-mrU9b2R(R*YuL7+PP3LoB2o06z)8j$y4TM3*(P^H5*<0d&7`MmX^mss#S& zKSM85%j#SNj^;z_z}de_!Mynq)ic~dj{aWrjDSZ*0iLNWEz*#G&U{&Ts=Jm_3iB8r z3qirv5)>NYPOSJUR{mx*A>SWr0)^5zz&Tu}Kg=s{Y3HX3Hu0%>GUGDvnA z9!U`9M&E*)txiB7*VFY}yd{*;Xs;>7%^QYGh#_w41{Adw=OzIKPC6N=Pq`LdVf z0JiOC#CDG!O~@|vRM`pF%b<}ST3}PWJ~e5k%Ja@agmLckb<}!sHe%xlu0RFe0W^|d zaj6KiL(S(eLVlbc{+d9USTWg+UD|aNKdwb5g-3ls4wNA75zrpZ09LnI=2)vNrbHBs z|4Do0_mkCl8sHY#BnTdG&KiV=YvuAoU$Zo-g+87xh9Y$08i)HEYzT})w1ssn6T%pj z=nVpQ;^LhEtCizn5~ z*|zBE#(DoZh=+3WaY{s051fI(aET+P{}KUSGFl5FVmSr5o+A+n#M_VXL;IF;@100|au z_xKv`4J+@1iozm2P@`~C=&cb%gMj{sen0|`N?p?^W_4QfIJMkVsI#he+jHR2*HIvh zI2cAHE)82@oi>^j`^ZjOx}lgf{RJ$CSdHUdd0IvPbtRa+w&2)Haj6m0>whFDcX<=bCM@7V3% zJ0u+Bv2)SRDVE-j^Bs+KSJRsK{~AmTM}mWMG(%PT^3*u(-fbjRkOtNRQYgnbN*0w( z^hQ?qV;|(HQN{~}LO_m59>S~Z+L-`pdwsA`|L`9TL>EzgDh zoJKIY6w2Z-5(bC}1uU9NQkbck*UGgXU_{wm8A86L1pRvax!=~~Z35$#_OA1I9guB? z7x%Yo9a1t|z%j20kY0gx7e{Menn0zfgkap;(uvKoa`bfCT{QT{8zw%B$8-4%lk`9W z;O*t0u8{+Us4wDj{ug~Kra2IROjxSeB7HBv3_wWwzCcVemT9G{3m!9@&*n}mL0Tar zp}W)8(fz$u{F0K(OL94j>vG-qcSBMynG|k8&K*}Q3DOws8;PLl{vJWv4|W1L?3ysQ zT2yen==uiGfcq!X*Z_cKog@9NCb--QPy15M!vbsun4xFK6L)D)SaGe zP?n0`*6H3XrtqI<08k2y<-#}2@Kft@@`rcsfatQJ6H;*Ik8l@|V9Ttsa_`x-!)RCE zEz4Rp`7ZnKZg*WFH%m5~KLcgSgs~Et(Q5#4H^*0kM1SFdByg71C%QKGCB__l8{4C5 zKDlXl_fbaTbkqFrSYuNi*U*Y;)3CX_x@{@AaIa4W(UmI-j+au?zM+1hU{huw@Us_ zl8Fc2HNF>)Y%YHnj(l}If!+iL0w@2yVLjyZOSHs$&%Ve=J4H88!*R&g-?}AoL z#ib$I%o%BD%QvzNbFmX)Ys%XE_Z+;@a#px~q3^^pIHTK(Eeg)dhEZVBNAQe5i z%LjXirM~^tNz9UJ%y=HJ?up1z2$&QgB3o!LFC%~CmOEhzz9LKkWoptJEDmYfj@i@~1he;AI+>LeS^5?38GzF=T1*q~u^*7&a# zCWP1Qz`lN=sJbi6AZKpsNO>db6gGtlRyxgFQKa>fNy1fP?TFsc3;{N|E|h?EiXjRI zMQGTaNqeWVg!(+h)miz&|Ig%K>bnoFeU{VdIMJ~J_DhvR9BHPR_1i{b>ScE#)6mLs|4{PH~EXI~o-IY(!UNHWm8pr}5>Fd-OJN&boydgX4u zaP0P%prrKOukzkd8fdv1OE>r_7Eg?&p3-uE_G^8te~K`93hiZm3%G!Rt4Qx zH}X^*;%vaGacA9gLl-`F+hDY2V#jm{kssAesn9et>aZ*dh}!qck@jDna`qVc8J&dq zOyTQADXQ|O{bczI{s|ny-WlBw0v2U(Gt@F?d&IjDU{AwMDIk zRL*3Rjyt5O``JVWySRVf)54<9TB4`BwFu&8-wsa3&kA`SrC=I?v5p%je~l z&}0hv-9G4<6-~=~B~y$OvA?&JZO$zK^_~q_@${sh z6ZvQr*8)Lo8Ea;mbndjX$LwGky}Oqpd`{-Z00X5qQtTnm$l5Fvsn~U^>IIA>C}X`? zHP@BP6o~|xerF8_HQN__axJ`xo3s`oFOcYu>%)zP4U+atfHszE*p+*&=)ZTK^pnk{ z2D~`(S0z;Xjv0<6jyx!;@&Yi_M~ODMw*g-a(T$US@bLdHkF}Sl0_dCaQRY!%r6(rF zdO3QjuO0){CB8cuM#SCLUTPS?L0?me(-!+W5Y7#Z1WeDXxeaVZY$@$`Hy_v#iv9<^ ze%GdJfZjeVsIfTAs}O0ASUnQQoWTm~Jznu;#tF+y2_&ah9UV;92EF2PaISvos+Vo- z%T)_qMLH!tQV&Qk^+5Pr5D#6<|f@%Nx z>Qn#CAuJ|&){J!Lo`o6&_3eok_1E!<@v~b;Ld%jaaP~g@Act`5Fc!>+WD{8N4HuBa z+XwaIG%*mIq-sj$Y=B7zBO%uD%SzF;w_}t{3eJ%7V=+&bY+XL85FpmJzWP6dyr>8` z>^S7<^|OvLG0l7knD!5fkHOfU1-5h%l6HR%U2$HaL5@BA>+TU3Qnnqqzo# zPavy(&V6`U#UFEl_HDGx5XDX7fv>zbLMUHR9;(NIAj63@@pL-q1SIc^aN%^{ht)hX zGJONr+HH#^jS-{5C)}g_-*BWst=i5KMHHcy7T8pYo_K#F644b1f4%UU@mmMgysN7f zuG;Y?5>D1^HNkEtO{j5E9I;6G^6C$Jc|55$u<6NJ}JBeVXp)OLwU7#Cndgx$yTHn#3wyd8%c(;wo+me zUFk<}WqA0NW4v>1rn$`*IaaW%Iu&1jfOTerdbwvt{)vI3n@YtlRM`7jnzm(VL4m(>dXpxjFt=HvcfWn@gLTv9f(Whg%72T<+oFUkK$C-(lhU|>?^>^x6tpQ;9m znV+ou3U7*}4qRBY3A&S&loFdGPm?HZ(02XFhdc3%eO8281PCzq_EHtP)_OUNTEFW8 zZ80#Cyy6ET7M5^k0N@10sN@K32x&Fqv4aCQ%Krv8fYlnsG5ngaic47Y08XU-p5S1| zJuFhSIq;;2IX9&yilgQ+&hw#EbLVL|@1m z!Zm>f2rKzg+H}!&6S^o&v9W?%PI);Z`IeCfPxmS57t?zT5 z7>>c2uXWRrbHh5a{{Jw6#7{RjBbFEOqMKE2*0aQzqcXPthKG0btrkA;BmuOJ9uE+t zF64RUi027dUYD&6as|IHKbh`|gu`M(Qf;ed&!0~64HFefgkEfoE$>qnpkuxTxSJ!& z%DCOUmS{CYV=#`dQ<&m*=!pO+5pdO%y?Fojh)O+~*?!-sGm@gfGD33*)Ky&=lgfTG z<59=ABw}gwt2W~z5S!q=NM$gb{_8(~B4^BpT5+(^8G;T(E-}lvOzYk10S%NBsE_bc zP7P1dB5`}DS>4~o;N4mFEd&9suwhj9H)*3M)5<3skepfk`3K> zRhj!7W`zw|F#x>To4fn`vNk+4k4m<5oHB1|Y(8jy?CV%+^`g53XxohN1iJV4P|#qy zMRN}!I$dQN%cTr!@CWF6{Yw7p&%2UyF*yI(&&k*{NP7xtdWcB zPxadM$Pr|GjYE?1gzNiU8*6BeJZ7@dj%P%_X*;<=c#X(=fnjiN;{4KCf^9tW-prBtgq6hAvE8R$h-dOVD9UO9V_zDM<7C%43*Zj7E@Z}yXQAj6HKHKJoJE8gsIRtO9g}vHM zFVR46E-UhyO^&j~ZXx;I$u5Bydx*J)Hs!M28MJ?0z#uf-V||Q(59WmwyN7H(Ia6Rg z#YPdMmSAt`{#nfJP1~cP@o@{VABjvdS*3mVK3mG9;log@-vF&eS)L zN#EI`F*aYaruJrth>oKytX`or7GwxV$h^Yo+jCb?)Fc5WCInB4zWU@H znCHD`|1$lGeG%cZk+q<9h4TOVfcCf0CPs+Mf{zAyQn$=TjXDK5( zYIT>iDK28;m4dUNp|{_{W=-7<+S`YDxhs7z*5Qgv&;V|Gb9qq2{OowSb!JdUp64w{CLSaXWAsjKEE z*Km|~65Mg$&$``({wS)=%;;a#*hOz3s9r#kJJ(r~xP2>&IKBRRu3YX%n;^IIt#zs4 zmdLU&{tPyv0`xmD{gL`#))*Sg(k8oSz8smQPgg*-?bd|-YXHdS7#g4VJJHM%>z!fn zjbsRuVZ=V$+7+?ZEQBi9(xGNf$=1Jqwj%m9UfjSj0=O4Oo@di)k28hC{x-aC7>e&l z@$zmJY_Up96NJ?p`J!pf$4SmMj^))g1$=+T6)7%crjecHosj1y>~$GfSMnKqBz+mv za%rlfjN?5xx$s-*JF1rNEd2Eorm0tqsXD>%EmsBzLbVmmw(Fk_!0()f$q26R-O+w(+Q|_O^c5)WWJqyXi&&xKsyWsxl5k^ zeqGpCpyh4CH|NpWmZ}y$qMb759uaOq;-KMgGHum33@0b4!UV?WjeUDCzEo?1H#t*O z$*jxKF?rN`g$MNXT{Fj#PURDL2|_7IuY$3N)YDf`IHzVoV>Bu}UXR4V0HGqjUSzOf zn?jw&SzOF1Z)96s53;Ty44P^gxu!Ds+=A-5C(lCD-gy3;r8c%CwhdcnZ1onuXH-w* zgDG`Fn!DBK0Uy198hWx8Xs(Mp9H_nD;7Nc;Bw#_C~r;#P;jHbk`J*V%18 z8}xEM{-sCwKN@aB^=JN&mYY)EtNTTLlj_4j;a|zfai3P?H(~9Z^AUzi5*#+(9Gr6Xyx~Ic@GiNxOIi&&j(Hs#mo>OgeYB3pg}L z(3v1r%|kC}X0YaULFBIemgoUY3tYTUMQ{k7_h_EGLBY!;*}ZLrYchc5{%k4uRkt7h@dZfCCtnHU?|$Yp_}H;S#~9sPo! z@!=kg3-_J91BTcWNQzaZP47ZMyK0P*Mu&n4L-Uj!BR2kTxS#s@ zk|#XOM~Pg2fkJc=6#tlG!259j$7Nc>xpW(GJS<0f2e~}LUr0~AuLA{Fsf07g4b`kd z+e=qQLGa`V4f8`mr4+Z#WFyJ`{}PwRFO8n^9Wy38R~O-Xl0UZe+4$f$<`{jaiXQ0L zR;FX$qnQ?TNCB^vRY1pqOf8AnkTIMHn&bBf)Uvm;GG=%?!Fda%w&oUml-;H7u}!Gf84 z`*c(KL7FVIyV541fM^%0j}%h2UEpb3F~#*V4gaKjC^(y8{LqrPZX=5G$AuBN&>64F zr?kxLUG||IR^NDf<7%V_anA9w)i^x*_jCVpPQBg%giC#>4%+c5>5)Y>4&ZJI|EIK6!SzKueBx;El0CelWwYrSf9Yf_95 z#twF1M$D5`#BRrMTeN{uRs$k4A>=mh0mBU!BNeWByyg=R{CA=T?RHA{Et$w%{jAUt z==xO`R%1TZBXRiYA7YiRd@aqmZm|CI(7JMtsdRTUExEcPn zJ@9t`YfOVSkmgq@ZYOrseVS_V_8S^S_4X~eFf(OQHzvIIxA|5DYt+^N9TOErBn>EO z#!%r%NHl3NJXmqoO4-^CD81=jU5ajTz>9ji7mk9<>6OGoH_%w^>~|g_@bG+{>trx{ zvU`Tx?~-}hoE#eVm?jvagGC6`9fZ^X)qab5oZ1dQ%3fVQL&O}hg z^O56~iAk9<9r9E;3ChvLf1w@DlxOjX1S!j1_xjCg78eD>lSRMNbYtA&gsUfDR$+2o z-?XF;upxq*a|#h6EoGwrDT)~=Pfy)s3P?3@FrPt9411=_V}sFo`d`VLZV3{H%^o?{ zKnM^0dC1Fmk9tx0Hp6#LgAXi)^4n}pSPoAUz_j$Pr?@v&9_*nt+be|R{rNJ`H zSf@atp(cO;wPXs|Qy+5oVD}2D-!YZ{{Itrv_$o6X1Qr_S>mt!5rUS{Ip2~Vge9MYs zO7I)dG{d`z&lWh#;LgDlt;#uYo)g2`>>1md6J|)}$`MrGlltvuAoZ z@Lt&e3HGaNUF<8L^ybW)adOemDG=u4Cmcb@A>UOergOJNp$TR$2qy7R;Ow392=hr+ zP~f_AI+OLQWVTTB`p%7c3$1hVj2`6OBsd!0cbT}7%D}+9Jppf%I&Q@%ZX}%f*~?45 zp4tr%`<)g3DBRfza?_t}cNBz%RuJ5dYNulG3uP>#(SNQo`kO`%5(pxUhZRf2ZH4=3 z{?7ZfK6}rIr%LQ2QY>Pi`0))&I_&wSUyrk3l9Mp-eQ>mc44?|Dj@r z8GGdjdgY$wM9L)I07J*k$Xg)*xmG{A@6E*E*N~^-`GYJSjl&zFtId79(JS~cp0<_X z(dL1Pr`qsT!OJ>@g|!2;jD46EsDmlH93A0)4z&cjzlktBM54vN@o?Mo6ZAx^W5k@3 zsS_LV%ob+fRuG5`cB@0nb@)#NCY4NWRmi>gln=@&E6vUY9_p?F0gGU2Y6BGIr{A8R zl#)R#@EWJW!Tb^P0O9<4m%!nHkU#1kfB3N2OfB4l`X`I>?>jm~+@-12Bww-J9X|th zJCY5wgrr;VpNXCC|IflGJDt)fbw1n_d3+42Z1M%2Cjk{1U`Seh1Sc(ml0FM!*IN5> z``ttO^lui@kB=eTfk=AjIo01(58=LL$w`>8|BX^HYRz7Q7eSNFBX$_+f^ikM*xn6S zi;(8@SHb-~4Qj5@)&f4cg0g~uNTd`gfK?r@KKOn%Uw2G%Y&Ft+Hp(yT9zS&MrRROl zf$`PBv#*dW##@0mg_w9ePbyXF1~7MXmpOIMN}E-*CO(a5(s1b4nOAR?M{TDX z4u#DCr9KhtcG5>CaoSw;vDG8tVsS$-r&x#v$Q#oy&7<}VMCo>#4Mc;KI1#N*{ z{Ob+{CPjgt&JW4ml@SC-K%@sdQj*}2+ub~$)1kNd>(*^#i0SoCn2vkX?7$-6@)YtQ zqNB47bsD?gN8-St?>$_@ zedMnWfd@Br_qnmPi^A+hYp zWq5MNcWKlMM@@N?&nh(W8xC&`(Yxo@wQpAe)Xi4D@Y&*y4!Awr_Ln&eKH{>YlM8g^ zY9RzET0RGy5l;RAZk8U8;Qk~eegrRN^x_{jRzo^$>(?L?aYbtA#`?M@Z+)6#b~JtM zM{&^(TLd}Qz~!ab^>g|3!YWiHXWxUP&HWxmhXxmIc#aHv2nHM3T|EOpyypVM;NVHJ zY;Tu#562YPe88=WySyrXXhzMaCKh)ai8$CQX+y-S4ffGx+Cg=9&G*tcoZEpHCoj4# zrM12V=-pqbt-i7j3u(5E((>MRGA7vu9YQ9I_sUG+S%PfpmT)<^4fAK6UX+=4@(P;X zrPAT5k%h+(k~IX=dK3EchFUn$e-PL(4m0DRimgvQiRzjt2Z!cM$8UZSZ~|1UnKYIm+EBfY#!mn za{BM7m717S-8H0)MB^xHPrDO+kU3JEL1%8V@e_>SfDkSr!umjE7kfho3!fI zSYfgxMMfU1d8GHj6EF2^`fyMygYJC6RVRB-rV4T##{q5qlHH#b<(RwyT=X9K;m9o zrNI{-`Fo?ZD~C?6G$b@~U?#&8Tp<+F(hu0hP$Caca;> zXDS5zRX7MY*&#R1L9cu>-Ob>VCpcqw>V^cFPGO6W{!YObY>BKN3ukpn^xJLIxE-9b z=9q!5Kj7Wk`b>*37>J=Ap%}O*!USr70$Sz-h5A%DMP%VnN;ph~_W%sj7R&lLv>R%b zJ;Nk<4nBeA!`a&f8GN)&?{Okimx{^bX&_sJu|(I=9*3vD~15^5W=M zgV#wz{rPvb`fwTRuJ$qh)`4uy6ey;jbXLXoQM$;zGJs#(C_hS70pU6IoZ7QO?n4*D z$Mw9%M%V`;&h@ z@nvvFWV<$F;|a^#TG4WY{S}d-1AzpXMGt=?NNlk!&@5q68%k0LlHq#sj2|E09R1lw znQ;YJae`b0pt5RE(rz{MZ2M4|v%xC`uL9*5`g94*r7R}>#pf)R52SpE#((*AogC%T zC-AOYOuq`5E~-?z4RzT_cJt}k0luo23I4K5%T>_fSnM$j+27d#`8+5Prca63=7mJh6B18fP;mh{|8AfM|L~?eIawF3 zld^`)eh9HjT# zJa2UfpxWuc0aOWS#(Y~%h;gScvrrgH`&B9ORvk6c#zVx=LMeqO>X$FB<8o=-$e);+)^I8aBJqx{B~w@M`=kg(xZ-{E}onI9tIC zXhoETSb~}SAl+iF?KOM?7MlQyL;`>S%6*jsU8d~e3{W&-RqnMB|HG>CyrZedYZj|k zdsS4Gh!quTESJ}OCS|XU(FIqsW6>h_eRouBhXWrDE3T%bwbqq1&|*&e%kBZe_coNK zRFseoMVyt1mWVQtCrHJX@P2=3ncsW+D|7~ z{+lcKNR*A$`dsf4L*KSrgG2N89dABF<{;R-N}BDUd1j3x$~6^-5m2N+ZuX~``iWX+E)j|_#SBa3VR z6ZdMgXd2AK16$U6TQra~J_-jJftl&jsBU7N^lS+~0Kh8BfKftS`BX-e@r@j@dj@J!_tiuNXGx9-iX;?|o zbI)E*9!3)SFbzww`^M%C&5g=5C|d1>RWa_mzoc)Red|jbbLvjHVqL7`Q{N|tFFDFv z)^g94#ww*hSN+_nN`?>3)$0C*>zjne_qxJ2ycmT^rhnN!`|u1o;~WP5wn?Llaw|EZ zNc|uFr1#8v?_{72>v(aD)>(Y?s)2fm<|4^g=o6gE#Ba5~2r-jZDuMu&+)MqN$BQv? zp#Q$K)&~{}N(z<&gHtL^GjbmwAj4zsP6d#CA<*&K-VI7wxypg#AA=d(2?JlM?z~$1 z#!Wr`{`1?zcQJIdl(h-5wG&4!Pdhk+_5A6~Me19KA-Yq=_S9p=HyxouE}WWBEdJZ} zF*aYF?PEe9-6!QVJP!tok21DL&IijU!MFahX@Pkl*GIdnVP6TE-=E%DGj-9-{*rkg zEm?@~OMnbGqp|O-R-0tZ$Kxv?$CxtE;!8RntmYRh>yZ!Y7qM?#J7D%7P0DOC|F}i3DScvox zxu)PoD!7fuj;(y`(sYvk8_;uk3r@@}T<3r-Asmi9`hh*r3?e(zV3npjS!~xY;(e$bh=j; z*ZPI^9zFQSfbY%l^hW##wZvc21Zt4=cDDI*BBlv1zqON^l?9cm`HXSa#@TXE_E>ib zN0%W&@Gx9F>|kf#UefIkt0fV;_%t59f5uW7^;0NDb(7A*3*Y^v@vx!`m$i1ZiYtOu zBPqhuGL$dy=65XQYJb=6g!{U2xtDJw0T%RG?7}?U$5R zdPt5o$*y0(VnsEfBP5 z%gc;}#nfXRBZV+cZ2ZZjjM74BFBgXJ7tpe*{bI|s{kkdmg++v&uK1jfWYxH~sbu*% zhG;3QGKYk0unE%L^6a5H{Sh}*XDMPOV(4m1Uf!DUmvd%mDj~j=hRXRD=}RMn9*j3f zkpn-UxL_>Zg1suk=P-|vE2JX<1G0;~(j6A}YKExfRBxO|r4PQ8R{9uezLM$qBu!;P zfggoZx5-J~rA&_vUlM3&HO?s_Tva~3&hjeke&Hz!i1S|SC*@M^ayPpFf|sdXcW=4F zr*pc0FM1g=hgPDAvb0FPE-;A-k98#_Tt?^uMau)xqw8>S2pmT7EJNZ%Flu2jMLxSn zGbAMw>-QvP6-@I7FaO*(4{?RaR;MZ=hl{Q?F)5btf%`1KL}_W7cm2RCLKbJ%z0mQw zK#$Uz8!TjaYuYy^u1xMWuY_UblOklV?rmvY<%QVH&-3U7&C&^Gue-!~vZtj9+4Z7> zPu2DFeR`{ugR>R;4H_MH#bXOp-lz@47UPNQqZ`zB6XR8w6{|Zk$kYsxfLHe(B+yoP zDbfSy#L@}M?wep=q5Z0bOK3HuJMSsDNrmpaIl#u5m&S%{C;1u~ZhWqFK@A8V@U+98 z+dzhtosbDX+`0T&LB(5%mq|(*255uWehE?GhS-R{iZ)2IgL_xqj~Hi4eQ2w>1@Po2 zPBTQO69kmSSFbh$=m|Dk=#s4pc>*LuV#lS@`E!4J8zxZmY<7xK5W*yf9izT zBes&moPP}fVL+b0%X^=_!u4-)XI~4^bG3{{2hG^-D9?|MT;3FT$6(d;NtZ@nNlLVj z$| zae|9NuSuRP=-i?EBW>HYl z)4p*yw>7D#NH?Pq4q-NIuWa%^)>X5m;I9~J^?0>>$4De>>K=bmwCHk1(!Cs>=373T zY;0>q3_7=GJdSsFzfiU?Zs8~mDuqP&yYUo>s=_Drj-k^By66MXCmg24V{ky{${q!` zx7@%7ObsCtU;^WYW#=41hTYqLCSU5htj$>bsh4Y79_4-gu|j{D-C(adMmF8T zaD!9P!)eHn4l6XW47qx^Ykb1+LhW#fwuUmjdjzi%`JNUh;0Vdk}|^>h-9bUIqM5t zoc8vUkR%MA3yB=d$d+;!u0~;LZoX{sq@+-(Do59V&$X$(Mg}!_>-H6lm_nYxrPH;#uTB?>F_;a)mvV!yzthzfAHXb9t35pz+M^-Hs zB*PE`J5MWSJs5T$;4 zNb@75h`_|hJ6sI>;Phx@#-G_2%jLRCq~Is`D^6z}kd~hqE*i2;4yh(V=k`Liv5>Ap0ucRN~Dy3=0 zp^;qOxUTxexfn5lGH#bdD%x1ho()&v<6nCO*vM%0qO1%l@P7X?`%@aiSV+ToA;` zueMZx{h)BUtKT%AT>svVpbH_-D8%1qwZI@r41VVKL2Gr{9Xm<4PXW;&Vig{r7O=fA z2?YQTC0aM>rpE8(IV;y|#g@{oMz7Pr{p$ZrszgYd+nGc^O7K5{b@F*JJndG-@bQe> z9c*mO`@%5xBot}HiA~TDcQ*j&$?`JsLyO@F#90^lAS(fOAh-jB_SY`&Ag20@bbm?| zGp(#eW*94L(zqZR|H>t4{kltAoH#X1Frp+qyVUb%B&Cza^|G|31XH%;$K3JdL$`CP zt6b{K@#|XzdjAhzw9_g%P#aVqGS__SKklW-Mo4~jV0uDA(-jA4MjYZHF_bYRo;j;} z`N9h=YgMB*vSsoY2;LQg2R0H^j|(HHezjK|o+;PVo5A*!BlD8Ky2$l-K4(Z2JJjiq zc)?4WSqQ37^qs`REWB1M6EJoA?MSPT>|_|V)wO@Ye}nSduHN;vDFeQMv0azbdZf_c z&IH=3f*HvIw;bVS**=DCwb3B+=oiMO1Wd@qP1SO#{7(1e&N+^OicU#2M!SaU_D=NsWaN&YDoD!hKo@=Z#is>~u=&%Agdf@-k2NpaiWi;xL|O?emS&)87I2nT^*nsUwx@ETsK{>< zUGiHZ(~e_NSeyK+iDgbU#Ha6=`LE42j266bPt9>E^b@l^qmpq&<(fsk#T|lRI+ybg zmLWamZu^~^>lMPLb9VC0?EMe)KSs%%bD<#!+%W*El?U)WQCIqF!;a~sW!(Q)xgSr) zZ36(O8Mq|1J%`JLxAp!}7F);dOaG&07n5LVgp8GRr!XxE_f8Hknc7A)50j9WOr|9j zxNjZR;lVjj{ndF-1TS__KWA300)j9as&3*1YLmCV-h|HBQ|+ylt3@A7J0dnGMH!@j z5+H1y>(c(#eI@zhWOr7H5?6rLK)Wi;tTc{?{aC}jl1SKp#5rnC98i<*u7Q(Km2O6S z^(RDZAqGi_e)ReXrMwEgwtH2qhZ!^atMe7f8-wye@g{HI6=2(@14BMEda1EESL6vA zO4x2F?tOGr1G6b4v+%|sd`AIhHhL5o3D&Bnf?MPY`9V@UR-*W#p)24GA6w)O;gp1L z?Jg1eO1(k!JdA#nM(lZkur~dia}R_XSxy_((GCCoxBGK7ie~Ne?rrym3c0}Xqqj0i z0qD*Cf_wHx*mFmVdu}n34@(vih8+T35_wtNjH(;Kbz`#DzZtNBa5NIq3BGNiF?Z6N zS=`HKwG_=aF)XGRSSuv_DxQxxIC_BEi&P!Sna3ZPdLJ?)9JOv!(_!a$8En-rh2GI; zYn!17hhB+Zi6J)fl)?RMPT6bHu^UJ?ntRDo{o-v08S>gt#ubl9)U0tq+?fk z;D8-#(uxL2PGI=GJ((wfCqiZcGU1-4-g^|JNoa7sq~Sy^&ZFradcE=FB@sv1sxmbA z%02A!U5Zub)O`ET=cW^?7GJ6Y8Qt;tT(TZ$njw?XI5E2>c0~AuJN400z8j8BptMR_ zeu?Eauy%LF!Xk6R84`croVdXC4%MSou3`A`Yk9~nyru8dv4jj2#O<>fDb_KAc`zD} z@H^?z@*V8U=*1kh%Z>rjvW7!5m2iG_siEh~+4R%l;^{^qAUo+u96ys+G3ynar>4ub zx2Gh&W=xWN=#D>}sn@M@Xc-yQwO4}NXFTkz2JD8LW&gXwkVxB7%%t_-EX7*mFzu~3 zK#Zy~Pm~@MSx6nzuYl*zYo~DMm?BF+0t_h$3RCyg>$`QdFdS#<(zQVTS1de4jg10$ z@OF=qtF+0$FZJH12^8_=H0y@?&&-7!oTlM&p26gF#Fkz3OCwLEGXFRsk3;2_AUt>g z06_o0xU|hFVuV?>v{whHd3Pc7f~T=I?iP-&&l6VXY=e>FeF?~ln`rVM8@Tt+K zd@47wBXKmKWBZU>>bNX{Mx6_K!x!&SpRTpas%+Vz^`mbb%Ck4xC+f?$HnI`gp9grVY^`IP zNo)QelY(=}$o6PdP4b9{H8Z5TxPGVrJuhhn42X; zND1b4xd`z$&xXn0sPl*~!7~+=S@)arNOsH6G2|z7EpF1oDeCY4PCeQ_@0654&6Cf# zRw?)(Afsl3y2wxFB9^tXM0Hh|?GeyeP$uz8_JCX$lDfjyXw-U7-xim>t=Ah2p&+ZiR*dq6+#l*C&h=~$5r_fwe;zKM5UtH#3-URk_$~8Oo zXj5Ro?XVT0q=_RmNj1`VOOJewSt6gUaz|U<@(Bo_jbBZ}(SsMfIgX`Ms^c*OlN7X9 z@ZVG&c}*c2k3Vh)LCh_bRZdX-tmE&eP&+)@G9~WW0XL4bBgI}4h;7wD{XhD3xXXeN zfjAowEi7wdp?uMG*o+J>=$HQ(vl623Y{hw>Wb?<|+f<|_$1wYBT2LhUw#nz(c+4AK z^XD?yHb)TUEbHp`B`}j@h{##^TmnN(BaR$G^TMj4CHQ84q$QYse2kih^@hl@;cVMuAR@iVGlx zU0^nTX~M@SZ!4Gkvs;4bnl?n&ADbJ{6y($mHO=mbP&ZtN38fZI;k@X1kEs~AL$ud2 z%_iM=DOs&4w>t3B7qP=|Duv$gmwT474n==s)RfqG1<&fU`+9k`kyE&gq6759?eMEJ zTyD+1bK~jIgDNU$GVy6o(2MAyeOnJ{!ZW|YR4GU8pW8JGJu97yk+$HxQ@Xd!EZOUU zpe__{+~JTm6rHGxYa6Ug35yzs^k(+^Vv-ZjvX=14ixQdf7Oq?;B&hwfOv2_r(#8z( zWlrDm2Dq8TIyJiO7(V&~QH@1t5_`6+W0^plqwcurO$Yg#EIp>z! zG-ECrCxudDjzs%m%6a9HnS(9hCIqcRCh~q(t~F}=?8YbLI-_f2a=MrUpDIkTGa{W+ z_5h+BCt~kC9Z`#8=HiO&dP|VQpOLhWcx9a33VKjB zGcY@}-)Fu3ar{6@ssZ0lz&8gl45I}5(a;Xd+>{1?gXKj> z&~XNoBYXpZMx_u4(cAl-)CB=vW=;7rn_K>RU}JZhF*N0xf-Nhz-~^9`^RgC(P&b`` z=VIS?+VuRlLY=J35&sNtP8JMV1O<p4f4gW9 zWkAm1$Sx7eLQzw4J*j9^wAj~jgpJK@9}Wx;GCF#sWy^dMfXc-@KTS zZ&}1gcP>RmBS&5MP(g%sisw!H>sSEKLdpUK$NCZbZjgObpcx}1kBJvRz7hM`1o(vO zkbHzioKr5B~y<&Ee)^poC9mzd(4BHj}ii^bt@ZL}Fi|GlOz z=19$EB7O7@>vSbtkPar!7wOwDxh0vFMml(-b}gPl28teHMx@Xk;!HfWOu*6i1zY6Q zadR>Jm?~AUc#>I*C6^WQ`B#g4)WkU$NiZuocxx(p0TpGW1#+jp(3CP6XWD z(pTjqOOsLW)Ve=+{0dxsZl{Ljh|#QcMw&Ucm_4qEPU?-^$GHsGrUp$YD^V-kFiMde zK#AnKa@Fk?X1MQx*-`i#|Er5qxbqRSYM^yoA*ovE)7Oe0;G4G|eZGOJ zR$ACCehgr;XeMo{i_8%~CF;qP`#YPbI^Nm-YfJn;zui%rp~^4qGuSO= zmNO6C3faAe+a*&DJTa{Wxg-++-@<%71Dp13liA;M_#BwxcSc6s2j;uMr?$Q!2d>-7 zX)TH?StsCp@bNThmqfa|NT1o*78>snXtu995XOAb632;0M4x_YW)m44>P zsyh?P`(KT-DuZT8u2cd}*l6w{8oTuO-|?J(=OtBOET4*c z5$W=B{)yqQ$_%;n%+Ck!kGt6;k9Wk0B6dSD{RzNPa91r+k>z1OcmEgsrWu`rMiC5m87lP|v^}QOiw8@_ zqaKX)=q=~Wp*UA&b{*a0xe6XEtqBJv|9Zf%QE^0VEIB=<6i#$3R6Y9KE)2woGTN}6 z^ehS+x3qX~8)_i~PT+^29N6Xzmq*^1fjv2sJfGT7W1v18nJGQ(1u z{XPHrlvQ%OP2xh*_p+?4T~L+UI)}CoCvr6B=%2^B%8m26q21S|a68O$4xNQ{0TJQC z%F94HG4fpuW5~Za-U&N0s%!_+D?5}o(AnTjC8Hu_1M-+ zK;PtM6irUEpN4zFnZu8{=fhB>tGJHED9(#f%dOZNBYhIWuNsp~SLs=517(2+K!lQ= zB8ojHIR)MKAg#g!Cx?!~Bdz6G7U$mNL~91M9k1F5O8Rvg3pMC&DbslwfVp2b>_a6y zyw7k9$1J=qazJyK5y^6&*_EG-N>aOtFk7O23?UKPPN96k50x8RF1@abR)UX&L*FE< znW~Dff;0CDzh3?Fk?`SNPNf!Zv^k5JGHb{d!GsXPbX5ETaYX!5`ocVo_lq9PUPERn zDU;{+pQxiX$=8Q8bHY*K<}Yt_qv-`C{b6f<$pYk#k1CyH>mMXrn*Wz!a11!d6t z2jiHjlqYPg{O%hyL)JS%9EQM8^JDb7P2XzT&$XXvKRpb9c>**_n*Fxw3t=*6Eoy7a z&!+BblMw*8ZYPLh_e^`?6X8d%mLxkyjP$+}?PcNeHZ7!WUZ#`#WDdPh+$m3xj^Te^ zM+lo7x6THDQoyx>cS$_pa36$qo*A-(+Ccc%Cmy^xwH+mOV||4$2?yzOjw`sDzSfYD zZrgmFn?oHTh<325duZgRl4Rr`|5F|Jz(iaM9?hq2K^%;IW~cW2sSQ7z`xS>2AVV7k z_3B&)VY3c=Qdb-aGql(}ofqzgCERPxShpCxg*gkkxHUS4yNI=3OA3CR0<}fu$2e9V z#?&nj7E4gjBysgxreK;*e=&+t=!n9-+l*W)7nUp+t8A+&@H8yx^G zk8&a{ER0k}w7*Oxz$wffP@Wpyd^4Q99Vqa$v z5X}D?$DBHU$`NNi%BGx16|ZQwE2pApdqA?|Cm4Q|Ov(;hIxx$_axrV>KBoyj@>AM< zZ&e7=Cc_6(IFJO!JhrtedpHN4w53Qk^k6(CHhLS#eUZ$u{wTt6seEAeq3c z3|T|M%?YM3k@^xNz8EB?zg0}=BL4xs-YjxF3O3b#?P}v=6kwwYZv>EJ!O?hBt{HUV z>g4nbf~V)(7_pmVYD3> zO@Q%mK)#}*ILsj&FLH%)3ZV_7+@kbkggirS`$ZA?K-?vTfI)<(1}=HO45yD5>Y~JN z*v6i#+(mDy+Ue$m@L!6MnKPTu1Ln>d46QG%fw&j{YyZd;rt~*e+`9=pJm)EuBV1UL zE|uszi-9fuSc)It@l>PG0jfPRVdaiur}jH74*&G&2nm1cQYZscmDn~QUd4XhY_It5lS>Rh-u$<{ey9+XzfWk zv<5Or@zPFVM`b35x+^a968zAFfuUL4;}cPy>Q`1fd~s|4>G4b`!bnbglW|r!|}y;P=I{Cln9Y zsuvuOP{^>tWB)j1hiS9bKeY1bi+d#8A7U>G*DVikNFDGzv9u74#$0(Y-XNZP@uhP( z1sfB1u>vnLDhFAl{D=q)|3Y$Vu!_k&+XRr^3%oi``qWq0FMG?`YUlkj7nvYr9(D)0 zqga1=+6>_AFu$aQ3OT^(_rB4mlpm&T=*1fZC-mIHO_~my=%Tyx$#74B0~zo2-}eA@%PxUI#oGI4YVf1e zT41koCqAt=K0W4zOrfyptHslc1Px?=qPcBtDELc5cv19(@jPeP-Pa3e!`YR4{C&hT z1(56tnEPuD>5O!gAo$D5wsHr2@A}X`QN?cfKR4t4xtg4__Lfd%cOlQO=O6~clf^E; zf8`27t%+oAmA{o8BuDtw?0g@XXPjSduXL4VOt#?Dw_C?{=7$;e$FMEni?3}wF>Zv& zhEe}1Dj(|9EgFvmw7_bU!o}y9jK}}KxQ<&XTc(G{0*Fy5X4vy+IMk-SqFfud6W3(z zXd#FzS-O>k+RkA+Q3O81-Rul&zBN%}DL~7mV&o?^6(4+y<_m`qdNlldWrH-6yoFHT1Bo@bYB|%kIA&X?o|B?G zw&(61T-K=BANSD;FNb6F`Ha+j007FL>?VOk z)45~nH<%Sc@u6~u%sXl)n}w)*wk7%0gg#~x&Lr+4QFDH}9+hOpzfMnc!NZujYmgr~ z`~y{Xj92RD!6gZ4!01$w!F*DVf^G5+KdG1mK-wI@yF&1N?Rc`wLd8K$ zfQ>K^snQ3Gs6fWz2tt3Et;J>^{nEvGcbi~+B`s+bl%?Gp042*tBTHmnVjYc6+4b zWiU{hnI@57u(;)oHJ+LiWrDIx@$DbCw7>)A9V@CH0g?;LGKZyGwe6C;F%c_>s8Y{ zU&<*`=WEfe>+Ozcf{}%RXmEI89t;UOg529CW*nn{nInot*SHXufN)88sZ8+f%mvVD zY8s&T-gw4BzP+F%9Y5XslES^#TqSfpE4W~1+i)J}pUt#_ke(`(rJ~f*B&W*1;ft&D z(tM`K=CAMLhOt5&#-cZyCPoYW?uexEsB*8`FjgYd8!>j*1Ml;g7ELx+8`Y4wXHb74 zsN9_KZlq;J@N?LHL9l3201DcfY=qA6b7hlK$V;?x+AN_*wc`L|z)pk~0OlXPx=G8^ zebVbnvemLvmiq*AzzH$)^1#!k;p*X7zL3fLZWC#~7t|J8%k+~9I7aGZt*{NiJN)C+ zAax8raT{OW|JM3%6J6G8`6t}Ydm*Z-|a2|-e8JDfp74ejl3xaked-VLge?};xhl+Xh!QGbP- zdkDz3;({WnS8?*L2>NW;%6LMUBmFo_Y}22{qq4z_N~6u6R_DS7*Turwm{-VJs`RQv z0)r7A_GFFsJBB<2Q(t1pdJY^a{J~dk))?G}VVs=5y{nd3g z57ZTVp!Gt-ZxHErMB}Nq@Akrg;tVaV;JHQ0XK%K}z>OvDQ0q~~hlgQ0b(KL!CjB+` zM)c`I#_uFj-45lC0&Glp?Fa5H*~kAQ4?pS6rO9I^36~^9%Ks=kJhm0a9>U z@Y#M@1&q-}N52*oqRHLoUrUr<=J|NLkNJ6@Ue_NB?~VR-)QS=)rTK0YJW_yH#+I&U zC&3)H)*N(Df_{V}AFmz{c)o-DZe-ip9bRMPlCJ z`!!`W0G=Hs-)Xkv{<{;b(-X2}TJuNoHdS96hw5Ei{fcO5iU6O3zIlBCp7OF?R^aAI z<>7W$dWEc%7UO6I6ty!{WLmzX1dv=D_?H$o&UWYUuZrqrs1;it3X!d1VrR7QlpkbJ zsK9GDfY(#IaJ^Iku%)~J;MOBI=AREQmLbBBRVG!W%|29Xrm!sX)XZu`>KI|g8jfIO z^j{%10bQTOEN2`@loqb26I|{Xh+*VZYoh3X@D;<(yjzhadmYoC6B_|tL+GJ*T8DXy z)oJ(NW}<`)W~>!uzjVOTcxpPFm|_G$m9isQ#<0aA!1}7llyi|=WE*t8%b|g>!6u=U zRRpt~fVTi|HphQ$m+JHNRmJ{c*|BYmp#liALFVRH#{X_dq#`aYAydBNz7^~vormBq z%xuudw>_i>UujM&2Wd~mqh?Z(kEBSsKz7;7ZW=Y7P@mCwvbYVX_-+TKI^R4prVzbz zF9$_t4`I&22pO0&OId-ncuz)%t||ES!YOZ$<&Usa$a+ZHZ+?ntXsf!}AP<&lL8g+F zjt_?4jc~92@gPtE|H?2VXG#R3-Ui$z9v8e)nqqRn*w^6g&r1`4n!j>S^du(D;31iN zTu;ATK?sW%X<}e3bg(TVekGM^gbziJnv$W-rBLuve_+^=;TPd%kJBGPe{b<}qqY)a zMi%NOp4wp(3m5m{?7%qwKrw4LDodq~`dyi9~fT8cp_5L_bF```4N@f~d2fih`Ftz|EQn??a?bk6gO7=hPb?2n?-b4%g%STRN^yJ?{)YavI?!kRs+;bK zW&>GH9G0&ujZJU%a>f(K6wVn83!?!Ne2x&fV?kHB{%$_nAp4RCeP%J8Pumpqwz%r< zR1dGgnedNQL?A@arkJCsi;gA(>@84Fu#M32mdqHbu@8CUp9r&43!I-K+eKH_syk}S z+{xNkb!7^{7qgeC2S6bEaxKO;9z?f(3pmXDpzTPhn}@t{4~yDQ2`3&soC9KksC;{h z6sIC-sJaf!A1kvDea=7ZwVmKPXI2PZ1B-D1L=hW%&&)3TrBa*g9*UucWY01KYd$IG znihWIAunIzhJW}XHV~P}CqtpR^t8C)qaA>pfs*eZC{$7NVw`#;)LPs)Po-DgO`%fr z)19G{UcQ^rDpK*gr9V29e0@P-HWVdatM4-N4{XKtU*(8V7hsFkrs|6!>>8(Opjr9r zQIv2imM(Frj1m>jeOYVr$}GKw`y;E%iHX`MNq+p0Dw;iQBv-oGFyIgbv44us$R}gg zz3T6fZ^Ha|{lr^E3_*%hTfAa2hJP8iivv*Y%8rYmY6}{tw(WEyG_70M z_ZN+&1@iz(t$vZoYZL!=c<|BmnL~5gx>>%pqrG0m(})I~hBCC(Fn4&4)oLB<{cGm< zOX%~uyM~VDV}p_-1z0X&-8ij{8GZVEKFFW0>TMG6qzLU243~#k*t|d9eC`auqAu_y zZSycAr^3hyX93|QCPp~*UR8_MLu$C>-w$1E!?IR5+PuGBg^blIYU2M-Huq92;;v<7 z(frfK_a>&$3&`+jT?dH$6*x1)o(8+dIz|-|+fLs4c->y=IR3uZ+&(ewBablb? zr9EN?p)*Ol28h_9-3~{MasVw+qcv`}AHU^7Xm4Wr^Af2Vz38OzZ3pLYheWqM>fAac zy`Y=8#i-c^-U4WT)h#<;5;1Z$clHo&fqguzm0P}$bn`x&2UM5i9na#$fNNh1mH-b9 zQ#N*PnG7Evzp0nZ9TVuo1(^%44U(4>u~F zg?Vd4!B4r?Y*r3gGs6H=;`A_(PD=?*Z9yP8W^5?ODl0_$l(8nehR4}>>j!5$eQKms~x?7NGd}JMAwIfRJm*kqz|3`Y0 z8Yr`hGAa1!2*dLv*De@snLu|#pP1z3Iy9X|QlEr*jBvb&Ft3McS8m=e{tr8i$d%7& zc>kfXfk_@kz=Ip3TJAoY6@2ib{RARaEp%Zi4o@-LHJLZJeG%S=PlW4i6wJGEN2^<5 zQR|_>U*udos|4|2P~p&6-$LzkUoqc}xVYR-FXMlSo?^-G{a~(GsiljkJJ?^;3IAb? zCEkR8HOX8n=tkrmy?0SDRXwyd^W3FX)8i!hLE`Ye_5Xo~WXb1gDTc3@Gc#hGdltL? z3#XE$dx5-Ai1z3FbJjOQ38lu?O(?ahQ&Nm924rj@Yv*T5rOcr+@Y#5|!`ngb5D|d{ z19M2mK45Kv@8YQF*V@^&G(yN6r=*UEF1(fs{6IE<-(cwj0t`|2eF4%TI7CY{fWKbB zhVnJ*s38?}e3?~b^hnmxM;}eU3?N;GxvNgdh6r&T6ZX>=tYHvcDzr$Uxp`U%I%Q0~ zm%d2GX4uXQ8MQ`nhztZ^798kN>$E7x=az#GOZ8g!bjXlbEcJXodLbd4F#WVl1j2 zwegmmosNvc!X%edL~%oYzi)Fg4RRr zd8Lg`eD{C>=K@|j_lin|>6jjAGxJoIdB_6_pA21QM2I}sp3&X`{a&SNf&ez=660b< zMQQs_M2_W+Ay;Z)j#kTCEMH|oEUogGG`j{3iaaz8qvCFc`l+g zkNrs6&FTL2Z$r(c1)?r^TmQIkF8w}B@6X@{S19x@JGGuXyQbO>YY$0I~=MJAUU&zoP;6BBA5b@<1QqAG0VnZN#!>p4h0*)aDxn|kOK;Y5v zWPzr{hlMMW9M(vMvA%foiK6i3Ijp}~UHDIQM1`0GflGdGT%i%t{V;#c(BjP0fEGrk zWQ(5sDjH>6kb?OmND=n(P(STN@|s%89GcQ`8`exw_K9z0zVkih{~Beddgnx(HxLZF#H@x<>!);4}mNr-kKVmWdAd9KoJGh?L zAk9CJs*5T@?W@64gU7f(p}F+*u;3rC>#2dCF=rlZmY)gg1pYT7hhVvpkEs!(XkIBH zL8Af)g3v2wZ9GQDBMF9oQxQIcQVL4slg7c87nD&KY3g#gh2DM>N(d&dF&PhUNTKpq zq5+PC?qegsmxQAAKkG1_-O@uOqF1+9h9;xtZt~6hdo*-Y2bEE`{qxa-y(QKxX>$UO zb{XohgJ6tPop**FWye=BDcPwyvJKeu`AA9oJU~4g#EX;;P=D1qURQ?Ex(qlF0bfM( z<*@j!7vIve5XC$F*=UfQY$o3lQ2M`%&S-#)1Yo~3fxRiCqU7K$C9?mY(I5xaj2Zer zN9@6k$u{^=OsYWRY9ZC;rq7Jo5JzVHGDtR$6zvIsP$#O@A8EMcmM2zt*3~WWPZTg0 zo?B^*d>ofJWp{N+tV;&kbPp9CSb z$2GL9e!| z9XtLsSIs)T8CfF|@wW2!!Sx*rMvoS1f&RgljcHY2-SA=QA~13qBrw;!9Qp!P{JBdC zn4@PqT(0D#Pr54v7{H(!J^q&%sM9mub$^l&yj3aP;`)cjl7dBRJE+ z-7Z*n#ltByW=Q#UJc??#zxcZFxuJmzp{f@&8oQ&Sx*9?VEs?ftSe&CNByOb6`Y5M=iTlQb z=qhmgoOQVU?7X}6?+T@N3pk)-rEwC;s>AtmFhx!oL@f#Q@u=wDSch<^k%sSG0+3Z> zncmm8Uk3r-vE^0uhiTG!al8&oiw^*L=c<19kr< zA+Ek=aH5$JHA#4TI{uXRH{fYjIrl$tIdpY0ANx9o2dnYz8IlX7R)KE#3NFvdfuGs!ox?lwc<_f~G3E1u`=V zFh{VgXnpS`3C~gV1}GG=v>&fG+;E6Zx%@3*B@-VqNNwvz1!hE{?9S;?sk->yl^Y=8 zA$3b7e>@iV;=b$3D|eC>GU9Y0Qa=c~L9o-(_wy;X5c;JlH7Owt?7CX>V-KCYLIOtV z2TGdg(|D4i0;>eGZO0K-u-%AG~N4>PQpnm%yKw`0M2LNRDvUOZ3g#S1U$Ot%+ z`K{N?!yE&ENjV(bu3(3XTP>z})*Ucq&jbn@s(ltAJd6$ZNAL3jRZ) z5DcCy5^1(lxZO4-A+B=bIp(yi#{!Hea!VB6$hvSWI^0 zAhJlLpD#?CMSp!9M(G|yCP_KALOM)Ym1`)~zNaqG3;>{K22Sp-f5NpAMnAMQ7Ao4m zK{UQFDi3>Lri;z4dW_bWs|Fqvhee}2oW!6V?(oXErj0j}t-R(RWp&fMa%STHycv_O z?$Bdxmv2||cg^EhKLE(#V}lih#t7R3$tOol7ZN~jtaNWYB3CvkyK2W;{$LyrGL;+h zJnaOBOi0ILc_gzEzg0Ujzfw*f!5{Md=D1ck4$^f!L75DC5&!#TVQz8Ja<<24bwpWa;zu8s^3W}N2yJ=;d{gjZs)0Mv}Clk4}V zj)J<0XS+DCwi67NBAjZ5>VvIcdpaoCQ;;pI$-bHUXhJ9U<65ut*6y~V;4(ZN)I2L# z!cRRQIop7VARv3@9nhj0)QHL8x%RT5&GKhpMA*)1;!?x&VWSjS*5yM=jm%H@7v0ib z)mny*#B|&nt;%C{@Iyfs0!eB*}L+T)qFfPP(#Ztw54mDQwA5bgyD3fpA5XMO>cd>2G{WsK& z5$%W`%4iHuIDZeTZ;c#%)P2~gTqIh3^jo&KD94l5spYI<7MxC8B%msG&V5`yw*Qe7#C$VSmQISugbDf z!OUPdl#dg*%#6em>eV^ZMpYLldItdlbf)LXr_grDURO}X8S#~)QV^pa&9Mb!_>k5bey`wt*SuD+Xro#r@UBW*~+tPX$Tw zR7!3g&8-;gY*^NHK4M6#>K}gvMQ(K}UYA?mTA4z@VynjiO{~`3$#EpnGvZ4h2?QSv zLPgJfpzcWhiyx{`NNtWZb_pYjKn-2ND!N~shWj_)B>yLfzxJfV@Y4dQd~L+V6vJdF zs0A~^+7kS}4UY8nNLr4H(olTByx!ZI_MnoD8N6EDzxxx9K?%Cq3z2%;k`S!&wRW|A zfCSd;ms5KGG-y8#*2 z649)d=?>n%et`B^$?UK9EttG3vGFvNIgY#&6G4yjPEKnos_JlD_(J!*{k?Bu8_T&l z+-gUGum4+qfVsc=6@JmfvVfVrxiF2jLu-05uSNIWA&*qC_APyuV@i{lH-AV1OAm46 zaL#6GHr`l-Y1X|Onv2ESm&M^u?3;RJ;HBL;JfHnV7fdg-v9Utvh;^T|!QVvrPn!2V zHN`T%L(mOzP9eWBnR8l%MJ@n~LMs%8QOls1sc4PcSUq!{`7MTaV#|{$NRl}F>mAy| z5FavV?#s7|%gf+5G3c#(N+~Q5p5KP+6AY`QFgEbutQ0|{^!P-T=#MDEH3~#w$6&=f z#2sh-tP3tlV(J$>^-I3GxNM9;GLTN! zkwH4{yqB;_Iospq5_7*@XyC?tZw(Y2s@^HL$EA>B>BV&x=D?lBxYqixaj2fM^G;uNvlRUe?If^xU)p6A9l27|Id6&so`RiO+J>}R`w=cl}!3y1}j`ME%^Fq zitQ*WZk2{vaqoslVC*${shBNpASOB?>{%6M&AE{oZghz|5CE%+MI#`T0|Ixq&zx}> z3|l~AJCDisOpjn@1&0NY)ChLhqqaAwg9Wlk=_JJad7;j%DHBd|->sfo&73(MK3ARc zmJ_6TOm;v6vl!3UMJg=^ z42e$cDM&+RAq%U{Kvzts-B#YLTw?0PR7&8DRLEsS%x@~q4zsPJFwwUea8c8m&*egF zp}`O0+J>}IP-5IsKhpo+e>htIEg>CQx!vA_6R;)qyAel9uYnbyIa@FnE5BL;V79x4 zpHM{=3%Ww|Jq2RTn~cwsTr+IyOVAyWKEI@$d@P5YLZ1Ve0~?rTPmd`Q#kK5#__AI^ zPp~oMDszLZT0i>Fi+rQ;0TiLiV2x^Q1ToCI65vj+0gd%wBYBE|%rY@)gSLaJ**k_x z*bpcQf;R4Iz<@vfvC`f&`Ammf-O#oznQ7B3w+s9hh!8g0FrmoJE>YPfRRP6>V zG;7PiF=1q#t$&!x{ynYtA@)ovAqRjZqUt7v!?AP(f6*KprGA!0{%@u<-;^JI`_KI; z>pHOfw$*@(H*x!L88F0epj)n6by1j!p78Z~uN()qUe7de4-32sra;H|7<(`EkD@SE$5*Np#57(VlzKlOvw9X%s?53UztGY7-0mh;=dJg!@wF)0<<_mCHIHPN1dtv^)q_>HBC~*FrWGv~# z$uG!0`f$!6o2U?K7TqY$PSk9SM}rfK>>PI7O@So{*!kXO9pdxn+&(;Om?c$+=-Pi4 z<$bM+HURKw#pL|y<5cTR(fFx>K{<5v8Ljt;mA6Cn?l`_nJ-~itGKap|XAsPS4mqV4<4Z@1v%rr>!H9@#m zQqBgm&(yAZ%jxYm)^?zG1pBu^B{<>Hwca7%WY~ifdrP><5&}_HQt2E?NQ2Osb6`qL zeT_r;2BfZKs2!yCY;(eVfct3VVr^4$-` z+Owvy2R0X7>6RmwM%1TqWD{~ugWzRAL9e!30HUi2f2GyJ*}!NjMBGC+fw+iFg&VPh zvR0#!52kQGz3JLOoAsVk?O%j&(o7t-ht|70?Bz8ZESvG=_znk{%vd;AblVOH*;eQX zV?C5g+*$lR!K60B=)OzWM`<&-axhsaPVvDdqom^!&oTD+t}zC7l4OUDu%8|DR&&K& zyMPTDKUR$7){2^9CQgbWeR4F1wth+6{U?>WCEfH`D-l1@*ApGE?BZ2ka_Tn8*kQo# z#Gf^ObJOijDpmrclJ4_3 zQzcDZ3OAm+^s*CoyOXJf@)iAY7XXRpd#T(I*~dhsdp|E8ZKwVW4ud{8C#Oz@JcRz0 zNQDV?VjZMpRPBk?C}L6=@9NK=Ie$45yu*lMd!b3fDGhbgSQH43zJ!lw(dlaeVrKB(RjNp;#5CsHqy zBi8p2{vMN;2A%Iu9Na!06PSqFQ-_HyDHx%Eu7ZTBzly z=Xtg)vyg1Xq?sFqDR>JBcLnq#d0dh6;N)+DGftu|qGfrlm^L(Wm)ALoUV@)Y;_6X_ zVhlO<+{S=N&zO^BefeYb^%yF)1h+)QV8G8kh^V%KqnRr38jW@!9n26=SPA*sWnjax z!N5&oQX)k%yb+TXwk3~cpiGF#gW+7e`x>j;H9%&-FWmK#2u#PgNd@5HVJqIpY6JyM zpXpg5R%3Ua;~qBOhf3?ZLOmO$(8WXtzBe~;5G?|m_EPgyZBX0WR{;x~)tQ-Tn-F$L z>L@1$Fk?I41~4}$bX*_`{T;@)2#86IsQ9s%*ndyoc}9eOkjW>?o?A9MrDuIjI4jxxTu z=GblbQElvg#+@Jmzt_CWG<@YBl5#I^qaWx^ex-#w?Z+ik<9CoB+P6r3z92}Sv;|#3 z#YoV}gTDCKYYir5F7Im-SZiMni%wUvYduZP%bJ_oO@Hba27k@37}`DXFfO~o9naqP z?%LKpbDBSjK)tTD7WM@my3H7XO0$QPYZ?4Us6|V4=mx;OhWF1b zImQb=GR+(U>`T>dJ7ut+~ zgDV-htMa(9lC{MJKGGWe{UN5Zy@~FeJdoM((&)n>xeg4Nyk4OViT)2fMe5;h23h}k z^nUb$z-!r4FqrL)Z#@qCLT0N$s7mj1q*R$twq->5**t4mHn8J-N`-)IcW*RKo>ct| zC33@BwmYpW)hSgmt77C8?e7-vL)G0qWQ-HM%}x7HhC6c}#OPGC%t^XWfz9YJl1o?7 zd<5GW7^@7U~xG{ z8WZ61%FNTdYtUq>4#0_{#uQfMM3#U_B{e)M>ZD}gEjeB=C$Yutpn|3f!d&Ocsb)4sM!F~7KU zWSsNGimvEiXwT07KgG5E69^HV8V?2tO?>&(Am4)dhWztqpcI+qNALoB7Rt}L4`>Ko z9cAt#R_hU4%JHYIP_ofCW$AwQ>10AlfIt`HLjc<0dK|Of+4nQ+v$*v@8_jW-F!`KK ztbUH!Hj+8DRu50VSh%{wy?L47HTNRW&& zm5n&;j;CJ3HpbDsnzOpwEaae2bnlo*6v;SEsYnyl2w?rsUh>Vy>#vA1FmD+F?1!#x zW22{g%~PlH@}EP?3O|g}RgI^W&s(l!BigjRGBlNn1LtnxA%9ZDwMdt0V0Ahg)39KggJG>ZOJ%B_cSmnKNU+8> znps{Z#JTMR^T!D@+JR%HUEx$~1Q#p0FTGXUp=kiky81S%M_PRJA5)Z-FZe1;sLXS# z{Ux$a)?$#1j{@Y}B6$Qfn^as>%A1P#1<|mckE07ysBarC@^N@5&Z*l>TZ8_p|CuiX z6tdu7s$~@)(lM2AJd0J1hwZxzk%y|jN!u8E9VVyW0RMAvE)cIq>VL}m2@?XWKcE7p zXSeJabCD&WDC5}r5p6Vi9psOEb7prwLnE;6gtc|aBZq2FSv|G!)&}^dT?{1cl-H;+ zHxOX912ZQ$-P3deqox6rsa6pq4%_`DlBoN6$c_#WAIg>XttjWJEAc?~?|VQfSG!EC z3yZVk>{Id;VJ?y1k^5D)e{B4>OOf37<&oHMl9cK{Vwe=eLo@=1$I4(z`%vVmk`M%Z zRnwY@x{hxG*2iy=wTHP5zT}?)3m{;~7Um-zUrmDaLM7$}<6FDYu&oOPaXNeM4&meo zpW5G9S5F06QJP@=g(1-jI|>zHD3}V59y1lQU-P?(A`GvQ&P1_P(1313n!PSTtJL}IjobN!ga^6oCY>b^1&V3ETFY2pM-vZzy%=D)vx`hp5nmNZ> z(VEexMPI^1^{I{6ywk{a4F<+bB*x`(_tl5WJir_nsX)ei@N6)0w z_8lz07v>6kEvYmk{2vA}M|&|ej64;ato=CVqn@YVrZ-{zg}5$fbAMnGi(;@i(5l3( zJE;U_-MgHzmEoKUa)1)5s0=@lATzXf-6sAXk7_OIO57+%W;R<;V17Q6^XWG+J3~f= zv#GKam6l2QD(9X$J^%nf|G(H0_q;=lH8Dg8eXUNc0L|v1-O(89r{PL_IC66-Mx(PO zBW)(DhTLaT{ML#{~)DaK$&(PS}0h`Wz_y5Gv?m7zvl)m@c0k z82=*aT{qHn@qq}6RlqLhk$GNX)*D)Rp zoOpC*fW~ybhFJ^}-18f+V|30Qtng)^tACaVGP25?`<-TEcKK-tZqr8I-&6(-C4t#m zMeF6j_J$AXCw$yeD7Dai2f?^NbIYis)Vu_b&(GB(|&qw|}Ty301rR4A-v z*nz9TYEhRVX)r!ir%yzjj(&9!jwo%XGBzMW1S3IMH zU|A?%BXk#eLcU->32H-*KqYy#ySs8wtxu|=)Uw8XP)uuZRu^5pGOJGGpx?TGHt1*<3fUxUq2&^v%i&cEsYM$%vEjEP9dW!);I+El_fe%JqiTkyj`L_l(5 zBgUFY^GlIrCj9fDxdse~yTFrkWA>a4;`Z*~QT?t>A-QXP9yFj$MAGlU`^0-EAVkvE`SWMNzpB-o*(}xZLM`k$wZRzeY)63jZ)Ong z9oBgPPAbrYr=1;v&h>95hSJwo6=g_F@%bTl(S#z-O^t)vj8Im{JH@uoJ`GUiooux# zT39Ic3I+2HK#sPw-w_)$fyE99ru;?}0(g|WW1T)FEXW&N?__rj1VG_Mh4=@*6lLlB zy5yXvkya`?jx(-S1f4a!tz-_Fji+wxLyz56h%{YQ4?;~Hlg^fB_%p}KG!ZDW?GFGzgzix$ZhI|v z>lnD2tthr^UfvK)DIIw{E*$X4v+fys5aHtm9%JbM*Zza&RR3j~C!>aPT(UY*9NT5Bi4B-}$}6K!7N)bg%tu=jmM%GXB*ppl zuG};{_ec$OuTgbKzD;w9TKv~h)03#Y!=`Iv!NYq<@mJ)u&R-a=++mrjeo5A~EMmBf zN|eFE6C>PwNW!Yb*}w@AZZ!uKcYf=K00l7Yvc}$SLJKOk%CX#OR~xNTs3IP!Hdk2QO4@S}qf$(5xYRM8KG= ztrE0-p#u#vm;S0bTJ&-iWP93HKTdrzw%;{Kekal0W4Pk?JJ-0-6&#VF8_f zoe}uG;03!A@Bn9!Z-D16{NU<}oh%bqOn4kb;-+E&M)@%oP6#Y)+i&T-(l_<8eXvH7ptta1MT*ny5CZWx5|7c&3pJBR7>Wgk@xE& zWt9`*thOS6amLJBg!paDYa5bm=Ztj@VC4o6myb< z8$K`XBpzbS3Fv%U2-L>e(N$&`ENYp<4jy~A)V&TLB83So&;NO!lfLZjW4D*P>(+2~ zsZY0>U|Ue%g+^(hnug=z6Dy1lJFBS9qp)~#K>N`qa>0=$dnw+}ne&c^Ie`SNI}vKy z0Nv?9!Pw0CS*)9}WN*0ipCI062^-%LrIc2ycDlvdY=-8fb6Kh5Xt}^p8&x5m>W$1@ z?ug+Se9e#l7`+qfmBfzIlKwr~Z>7ATcUm1`|9f}D1|`L(b~aV#!0<+X%ICr8h-Lq$ zww!|a>(D3Q?RBx78B=tufORq1A}-@`+YM}s5@R9_S)Q?nu!QiLyI zi~*iBVLx_69LjktKu(}G5#S>ar+E4KDlC{>sV!!?heOr8WaUyX9o!xCvlwg9JBy=7 zWn#?AUjVy!oi)^XMKi~!DVCU|BP=6-S{(_r&#Y9WMgX?}LJo_jHypK;jrHwDuM7j$`41ReNP{GZgQ7 zd@ZRL8&e+mm>a&x0QJ9l=Z^B*Sq(<3L(t@)>nUoB!I`Gaj^*BG-$@B#jZ2{%I|1UA zWe}y2&`33w&*V|kf0Ie88oCHGR5aHB$)E=V$BJd5gka68qDG8o*}>;n#T~%2#saIO}?#;2mws;)l-dqC6 z&bN+o&i#4M8t=hSNKkNd(OsNPMQgHwziDw~BNM*-v}Bj>enaykY&_ zhJJ7^0m^|<2j$`m0})4r9DQV=1< zB^IGi@0xGU>Fx%oGNi2T*p&-q5WKS$NcooT-d*-MUovpfDX1OX^fWCDlSqs}?KMIE zORFG#m2?8-adv)LHM7@4AJpaohPqEv*~5K*J+|1A2Z@>A`yRO{JV2*rfKn%}V0nr)(!QqoOnh{!-KCcSz$1R>#_$?e*D zOc6;GLZRDk?Hf1039L2RfcACNGE}t~=y@f?mFRTOZLBmO>eMdLcV3W>5>dN6-{$m5 zj1QWQso#05Q-yI>zgO?2k!X=!di&ENiG`z zF=$H3I>nQMs5!b-&B5A9!c6p&0MB8hyNqNrkQ8klt#y~#9s4I|Lj>GT-wq6Z9Etuh zx0?rEnFu29ZcU5UC*~v?D6k@>X%~V<Z7Gol)6&VbOfU(~<;2*6#>PD{_7Amb zVPlBaxY~&+hiPsm^K4{Obr*+K6hb9`=M9M)cP7ND z%#lasRIVBg1exnr*tBiy>@RG^j&|Xor$PqF!vpTAn;!fT^)D+FxSxk%o5wf~SnniY`cSrPW(xEO-3=G313~%TY#bT zHb|Fh{WQxUr~xGe=Mxf#W+#?5x{|%xlo9Wcy}X|JW3#5gyGH1SKP~wYIwPohGeJHs zUEaXbBg#Rbxo~YU^NEL>a@iG4i&5QHp|ogHWq}e#>Lj!@%%IzSmf4PEVGw*O08N5n zRHSe{oTUrW2yv*Cv9vH@S)X!YRxP9SogDm0ojE7VRI<)Iwsz%?rRNCL$1J8O$UY(z z26bo+Yqg_j6c_%u%qCl%3(P*(Y~bu(9v--wzLB-2wSy?aHD%M@-Ek=s!R~k>Gz)h+ zNSG!=!p;Neb@+6-7;gYN5aQ%8vP|5R0n|!pw1r zeD82Nu=bG5Yb?x*Dj|3ypmB_Q!4D^LK;)h^^9sOzf90FolSv4}Yq#p^)LNF8Jm1Fx zIiI7--D2}-$F4WQHFL6EndGh~RbFbYZyJ?Ru{+naO+AQI0lq8}7b#Ek?OGqH@Mpbz zt>su!)Y1MP8`jQz!=kBjn`-6xIU=fmE}~O)@R=?)hJz4e*Q}#brXzqxZ z2r+Ek;V{rO!o4uKh4a!Zkb3abfaUSRSUvYVy#E7D_pL9c{&U`_VAqLC&pq?2V)~s% ztD*_oqcThPPE$-(eZ}3>U6Z(&KGPLtQg~X@A%tBhuS9(q_}yH?ZpZ}%Fwlbd z01rJ}Vt%I8d!MmHw+$kJ;YurcemPBwn*Edv_ahLQ($b5V<(;s<&jtv9GHLyRU$bTr zW9u*-&0AaS49YM!pn`dIhr#+=I7{Q|MoBi3lJLnDrR<&|wx6_Z_U~LTeWbG``x8Ln zpdd;*;y(4@XkihW`yS{U;1`^VwcT6@btWHhRCU7~Hv=JIx%s;u$ z4FpvM0A`P=>@np>Oq;iErRSb-^a3h8q5}jlo4y%OIHhad06*Op|xRkb5GxV#3?Ho3dryB#xNMsgUOKC^0*U8Ux(!F2= zd}iqql0bMP3tOPt_vD(boH6IBty;rH0BqAuli#*z5kD%tnvLrZwW*G!ESZ#zA*n%Y z5iSBD*ulK;Du=E$sd!vNxVK|12{Ep3{5g9V!_MRSQE@t{zbH+uYm(} zzYJweFelYCDJ_GjxgGct2~ph+W|i}ls)IUjihMdLg1dmBH;j4oN~q))a(C{;swLBp zF0Z+=Jf_uhmj@#_uAU+Yg>d@+IOdk0ED;nIn)+IM1u;G#zfFg#x|Ge^>+C65PD2vt z`2kSKQF>t#>FvVSF4OH)a`zhyjI?FyA~7QC%~NLar8Mb*bj!7CMR93ugy_bG$=wX3 zFcJtt5Npk4Z2g?xcRVr)@0lkKN^%2@wP>Jc_rk8Y&OvZa-4n|{1y1z5h?p-zPG3ID zEYmNzlDpWI$ginHi|{Xj)aM2n_ooVTJ}}t;0Z@J#lIZPrE!!gJr_eKW5mag8@FH2-;Qc&hrubUdyU@*l~AJ`j@*BW zAvYc-r)Ma#$Rk=Eltvpqa))yW;yXrBzFVnsx%fqG42ggZdizX2e?2Mx@3QP8!Y0p* zE-1gnXh+#emGNhOI!NL}T*#GMvhyOzbCI=pmK&ONU$SeAW{i%(;ojC{G2wd>(uI#w zXzYL{JK7_^CF&6vxh;1%B5!H#NyOi=W0V{{TV% z8wu*tumni|{IzFPIXxq23w@XKWgw#XGnUcx$GUF-l{WS>(T(2j9{OO8UQBSiQ+dgn z-#k;~HHX9Ijt&~o_*W}4QB8eA7d~$e%7(JW3G*+(Uk;jHeVzCJ2}b2GkztdyFU5Ze z3ssaCB^jHk4rp;08%rCbb&yt;UNdp>25AQb%Zz!Or5D)PcgM<=SQ6~rLCF#pn#AxY zdXDQEc_(`=RhCy7zEzBWmym!!U0U`B*0jaw4piQFBg#3DLbi((A_j4H)%T4BoxlD# zk-B+>Fh?cuqHlDSW`98wibcHB^cRpk;H*M^w)=;S9te*OS1iu zpQsLZv&ZFXl^4VG%YT-^sP1YHA6+0QljZXhMpH+hn8x)fX}N~aBT=NyvbJf2fJQ zLE1GQyZ>++=w+7aP#Awqvf`B{_BRQPje7#He=@ajBG!Wog(U#RRX_TA$*+gO91)gr z7}(pZhF1y}BQikKuNPJ0=K*COhuXD9XBafhD0jmWVr+|w5qetD-?I~IDbDx{|J@bDhI6UM0rvN^YH_JaZ}iZ+i>1q)tVTe%s;@uNrG?*&M5>68G+e> zB5_ELc?cY|$bMi$O5@dQ30whgAfD2%fVZLwTP6rHbG*j=2C6Pqpj)Xtg|YQ zmTNx4UN@U>@401CLL8@r2@FX(l?Ig8$3XS*X+it=SG67t^VzX3STnw{Jz>Vm0p;3Y zkB9e~wUV@qDzDTYoR>L+nMwy#b$#A)2EmWC-V#IdVy@@x{<7s`HMj1n@CmqK@FUD+lst;T16_;XCJa0?$%z%3z9a#AO!HhfO*9F7Y zsoKwl9B9^UD+VxMSUKwYnW_X31+TF8GGLA5(LgfRqw>01d03Kl@H)=2?q)vYzD-k| zyW2(Z3G3B^IUok9L^bPeo7tq=OP$_5CZa9Rjy}A!j5@zod`M8W#lD1IV}f6YcS@)B zW(PuQu+JHkK=$p@H$D^$G1`=eYuStyL8-thVbfCJ zwhDu5bsHYhe|9V~TsRVo|{zR1Gu^`=+>^c~8TtjiAhcmWDUh zfSf&%(C6Z`0J?_h>xSxtc!3}(C<0B`8(vRA{1ZM*e`HlPK@D`pYJ4|>LA_@=*@OCj zjNzXn4dfj_=5CZ-?05HGw4nq0pbonDC{R2&NB8Y53Stl>u%T%JGkL$zwaXVERRVBCTdW{8>IE%mQRiP9%}g^*1R?zfXM$ju zA9?gB;HVhu^@dpHpS39u=r`*L^u`GC-c6QBVm4zCKV$1egvj-D83R!Fe9{IWZkwVv zuxNNOwgvjh%^gg=Gq>}TIDKCLgW}7zxjSW68#TROaeMqFtRUmtJ2hT(=h>FbeU8X)?+Tz~Qe}A`-Q)Fv-LQ-kQ z)~cWR8NOu@nMtoUNgIkif7_xOwbnFI$jAoD_PBPaokOnhQRSLKqJ!-qjp!W86;3xl z*ao2C_yzq!^LmyR2VUN@`KN`M?mG8)|nEsVLcCC$d#jC!_{kUpz<&4X3%J75QStX*tlo_ zHl?dR;X`GCEx8Ye{-ILojeqEm{-7F?2Z&dm*Iu8hObYwMC#rE1ZM7rYo9>UKl0XAmC%0TzTx@WBR7tEuUEeKx<>Ry-J$oW|$ zZp8}%xf&cYT5sW|-*v^Cx89`p_N3glmI&S|4zr#0b$x!8k$KdoFqb;LeBi~0 zB(P<-SOD1$m!_m@=nAZ?pE~0znnOX7ZVtp_!x*;V?>*=Xu%9j&pqQ96_=au8j6o*1 z@*UK2IqP`_uT!ctfK&Jz^ivu77K=IRV}CfrW*yOxf2(ZENnPem%aT#ZYIIuYrF90aq-V;fBNV97w3T) zn)3FBB2Qvj*1|Kr5$6Xw{&Wra+1tGZ^z^Yo$+P%sdzc7p&P*u3jCW|X@pP`>76)rP)-0 zhOM5YO*Y|o^5Y6r8dsfSUJd}rrXKS{<{%Afj*uNqtS_G&w=nEnnRstI=in&0m&I!G z7s3&&8sf@VNo2^!W3Z;nhYPtDMLmhSn5eh6-JI@FdsfDpcwrq z#WHtwtZrR7sYK5HIi~F1Y2NzCKtwbt6&a_#)?57_d%1}56wgA%r>72UZicdaBaZg2 z-aOYPUfwa3!5L*$19Q6EX_cIvj#=1IVV{rmDML$Yb+b#I%tq2~07*~qtbkR(48Iss zb#^o6*@VH?aggMVI((eO^`Ibrq7HR@C3=1yG}xlzc;medB+2_CC$8zy0ZTd2!ol3E&$q_-s*mSfe!$=n2kVlm@( z08RL_n66D4IOCxwQir}QlSR?1R>t+bwdS1R8#h7-=W(^9XZc9f#1JJ@oCExAUSeKt zR=ju-3T+#D++wv@h81!D5i^u4rpIX2XxdxVw>WGZ^anZbA94z_5)&nc)A*mYKv?Hq zpP;11P^^O6 z_neP{4VZW3_pUe_ zvM$2FLZZl}`EUjQdyTnh!}fFl&7E-iVl?Fi=wDNtX#s}09cX}wQBn=)D52eAEAvxy zs+ik;bVTbV=ibCA6cKyI?-b+&(DV_?+}!3rn#tl0XE1nWlv<%A){rk86Grv5`E*u3 z)f)-31ipy?z2LeN1<{zNlL^I^MzvZ6tR7|q@Txt+RHMWz4Ws0e*3d+zH!!8F!pK-E zEEs5wn@^e0RYCNGJZaiIZ9}t#6(8GJ3vn|fyCFjv7VCrF<+o^_x!LwEuHA?%7}vvc zi@vXo{mn0qJ}aak5uE@}>hP*9^PT+>d#o&GbOYtgaG(3PS{B0vVSJ2p%$#a3?yiN& zQIQj*34%>x2_z*oAA*Rx-4((f(rfQWLbY&cxse zcu3X8T{at#I%+&2Q1A-rMkGbSUUsATaJXVk4w8pTYWYTyWd46sB!0&}us0gW)-wxV zr7!~yg*|)0p%}A_{>naa*pfy`U{u+A_rsYlwRy}kKz%(6#%~1K@!e$g#9$NzTsoxM z+^vtoL^qaW0Qa%Le2fycI_$s}*d*z|#QL#?TjOFRp>>ji1X&PJOHoliIl672Wi9+8 z9Gz(*=N0<8cE3|%uni4eRRFwL0qr+axuy+qtL#F*J5v3w>1|~P^Vu?H!Dbp5bA|!0 z9nsLwvFcPK-||g;$Nv6(9V{ERr+S`{IyzTZ(|HE~LRN zeNE~8SQx{mj)#~t%z)Q$2Wm=}?^g4j`R{M2aerY49i34IhDtS_t1M=XVPd`QY<7HS z;NfnNbg`x;4FMnNv@n`}H__^snh&0hQq-0(So!E2PRV@DHER=_umaHm~^sfzGt&as86`RxZQHi&V(RKzSzy z7)pDHKh{swW*#4!6dDSc$JQl-H;P@dh&gC`A5IGG5gK=!%eH-7HmnB+p9Rm5k3UPr z`9hGiLMEXsX2!UffQq}DLF7b?URE>Xy3a9=DA&c&J7`A`uG+)BAm^;&;oy2pgR!e} z^u*^40zg@umNSsFMD?#Ws;E>@2PDti`ac ziVbSnDSEJn46oXCgeAW24gE~@Ek@}Vxt%>rk2>i|wlbL~;!XcAF4bvLRv-$$ViYv{ zzm@3zv7bXQ0t23?;%H>uH~hH|g^V^u+kA_cP{Vbh&-B7Z*rAN8jXK`vp3)vIi{vrm z5sk5^&%KI+#;`_S5|1o;NLqkw3Muzwiy((CR> zFlr>oaYMsU%!O$6%0x6nsxD6g8zWEY2Lht{Bv)`w8h8Vu-BVD41+fpyo-SAfV#us< zF;)-9a57WcQNtB@g0|>xGV3|3x@XM1nOKO#U=0hw`fosm1m9m5Y4N>8m&jrnNgpH2 zJr@M>y;v2dH#$Fem@+_$a_~V5t%$nQuG~ACH;JVQ<-79uU8U{lIeYCZkk)L|`e~=i z34;}l*yDi%PA%A$J4+amtY0GLol6O?@ZT1q@hsUjif)B^yvGpHUy4(lj=YQ&vx=|_ zbU-R!MsXYq?g*|ICLYhfJ)mAX+c|4Wf>Q$Yq7_`W+aNHaeao8nh-tOR=FOg@uO|*+ zLCubFgAvYNY_FtHfwuBC1-mv*N*f8E${P}}0l>e0KY?JM{Z@fgnJa%DvA@)};e2uV z0CHatt6&426Y;u8lN=op1VHxQJMU~qvklKvy+wZ4j5N^8g-agM#r<0v7>Xz37Ca>q z^6{ZSQ)nkFfes)NlB*Q=ZL;a%xSy1XB;FA5})#NxNi1V zWSZBYk^M#>Y=|YVB7TKKC)^`=SDxu^K!N5209z-%YjBj_Lrb}F6!&h7wBni>2MNz`!f z!@oDz_TQ~2^w$}%@~6~sywjrzTpC3%EmNf#FR)#%1SsYfK6RhWcErM<`~Tfcql>Kt zb0+ZbNYy1Gka!{e#v>HG?Gq_>7p9X5Zl^-s5uOF3w@8GA_)hIT+x%$K?CfbPU^vm4 zMEPLTTAt)4of7zJQ{HxXr)aRW+%tQMbD*VPkAV(R1`}&m7LgzIYiQ<+Y1#^$v2>3d zv%gYVsZIvALuq#hri2x25i;IPRd6|5s`Wn6J1?K)jH&)O_@4W znPRkXp!JH{1$FVIp`FKCP^D4EBAKK^QtYE)Emb=w8oL1-k zmB&pop$9a)naa#Uar^9C9{G#jLuG^(QVL#@AlN2LmvP?GA1=|dwkc|DK>#2<1NcLG zSBFmVj&IZSY-}m^nd8$P(&*RYvm^--{@|#_dnLRLPRWwj|JJN8m(veR3n0=G2f3bP+yK;jBxx2W zH>1@#Cp6k4Bv2FB0!S3s$tWATW~j)Td+m~2ct&|z(eichnA4w3a#8K&&V#Js$SZ$$ zYH;0vh+?KFNEfo`N~(Hv80)vTdmd_?Sla?I#&U1uL{^cpB2UgL3uuKuABx)#EG(Tns9( zj%nuKOG=fTOkN2j!_Z7144TfBQ)+uu3Vw5^mFIkCodvumI-x_EdhP_zlma#;vw?IX z?jD}vg4E#3^6b){_&=Y-Tj>0~ld8in&hjzF40Vd~}@OhHYGm zQAM3YNry#s`#@Ezno{vHUfzpRP@lMZsSkzt(or}smN6^vFQ zoo1|Y8Qi(})2}Yqd&A@<4J@w}jOr`fjB)=}DG@ah@35D$m8MV6@0by$rdn;d|^fO zBlX*Xk844%srXU8#9fTqUI$`)#?h{kUInPe#r(GtE`NpZy(?B%GOazATPDxb=SWVQ z6_|IlKJh*rA+VU@Y3|r55R=u(agQjybQbQwe6JhtajChc@*#!Zd``s=qRU_w65H*KR9V^{Ob{7FO%hC4DoNr2(q$v=>Bjfg&=fr4;AVb*{N7tp$&JcI#T!lHAKXQmqA{B?Aqel>dWdD?R zUCwRTDY2Z6&Zs$0{5CvLvhfIJ8t@`zA59n2V-RG~##%mtatugb2b>3>KwztMngHL| zebf<7&RVY$Pv;Ug8WIr}x2;PkgnQU94TZRN-lKSow|u;pGgFoL6kqra!E1S?Wam`z4{@Q^$H=sXE&ecz%CZJ~Bq#IT=z5|M%o*f#v6>;|&J&YPrDad+Lr{4{UbT>LiOV;KhfJo7(- zC~W}w{f%pR28!oz%sCQ(am#VDwxp=OVVxgHq7|XF^%ii&InG0)3FY*QcNkuvccY{i zEIv?kFREQwUfk@j%5GPHqt%o!d=YiTyPX)pT3E*fRZ+!~i^+J`-u8#F1kAg^#z;fR1G3$4 zz~lA6^%K<*L4O+DNcGkm3WU;x%@9ut*ULd+9L!v)y>4prf!L}#|2dG3Gv-(mU+h?P zHQ)v~5757j_a>R@-TU8L%<(;&go|6~#Kt}fRqS*3aIwhx_||ePZH>XBvYO|BZ3(7! z266e7nyD{Ke63^w0g>c~9pOgxN|wf0+2E-!fF9QArtAJ%w$tc#(ox1}G|BCDDSl(I z3Ev|}K`(GdO}jS8gy~oyYXq{S98KV*qFKr9Vj zqUN5%$$Ai1HYc|{VK|9!pvB*K1*L)Fij&%WufJ_V2^&M5`6h?MglxAZF;D>56TrZ1 zA%boBFYiF;_^wT!9ZK4u4R^$T*}h#7SGQ;lmaVfg_nFKN1EP7GW6tjR4E_3=g2_YE)g$_>b-rPR z7`AnCjThbCKW((=M+xDl;7rbwd&8qYz=0ue=+0O|*=K zClXJ6=xM`!S7Qxd(uGb8nhhLH-#?lbFEm5L@bMNF(w{DP*gRvPegckV(y(E$9eR)V zFhvFT6~k#Hn8S1+771557HA_gVodecG~=y$6l9DmNS679IT>>&1g2GH6^!vm%~P*2 zI@$X9ti8A=;Hsr!g`c}lucdNAn5KWBwyYPzEc4dD6ic&)h>3xNeVzB?1;Wk88!15JHo(IldxztX~ zF(#_pYKNE(H~htsC>!{2zc6vWpn)DRGdDNL2MC*w$r z?C%9U#trOf5=1eq$qStI>h0Qy>~3yz+J#bSp%YTi!%dZl>>pEsZ>&>bNFbU`h%8I6 zXJs*b!oJyA40TY%&_{>ZUy{x+SP-Xb|c>HpeiXVmLpMAgA` z&7hbDGASvDl>O1<}D@30MPKIPa;_~ zxI=5VXC;~cbr-P{el#6IqieOD{-JRVkbzkI$A#v-!pzCZBW~8dN@3LXo;PZ-i;-F3 zKCFjSrup@d(tNs0H!~ZEUcGof?L$CM7Fj90Czyx+VpfwO3d+GDnX@vxT6sXL>HzrZ zkPTVAZhv$EP-i-hBpqzX)|1L{mF%o|=^r=^qUAD>qOb222G&xf(v%OqhJk_-n>xe` z--=(xJG2v<>+LNDMx(yF;o*~^t48zC+0M56(ABoy4DFB@Y#v6iHmC6^zM7!V?bffj ziJOC{pp7Q4k4R?xA{xNY_>fnAC12zWXws@#2`_CwfQ{h#C9vRy=@U6UAMMeUo3+Aa z+U$BCFX9S93B7rJ%eYDcD{`+hg>oAh45REh4lp4>_%6qeTuj;`NsOoaiFPhUkZkL4 zcx`U(5^TA-jpy@ChQwG&Ri=ioIRhd3r`=J2d2L&zSP%VIvxDXhCG1t)3U9o9{gf8n zV4o^WY=Q$zM7xCC%a@K==fQcY^HX>q@jl&@ByF+MnY^LCeck`4UDCq3tzc_FU3;0* z>P2RNY)A6zl(^{VphgAZPe3Cy-;rak$>%a4nw1{ST43Ql;PDncZi|*9;Hn)O-tER? zwML70aheo}d0}X4&w$vRs{66P^En45R)D&l_2-qDtdQ#G;mHj^l!I8(!z<1nt}3Sb z$B9JC;+}Lfs&M5fI#F~};`@9@b|T+KrU4i4h(ks{8YT>_^f6WP=gBp1d<QR}MWw+O{&MsIGUQR++fd_SPAMKI5b0hp zD=;US|B@pFjVNd+(+}*s`TIm1s*5<4XCCzc06_o0Ldom}>y+gjiYo6rbVi9!)o-BX zbgm?gfv%lAK0QHHkJ-YQ^n~j$Y6fQ!EwEK^Cf^xff$2GEI@SrKKq4PpztyJdX_*b` zaP9s&x+9CL2>$!&8i;@sMV!hm+Dgb>6;g*bn}>>aT`?p|%k|UK!R+21NSW2kllRIk zq-I{E&&CxX5V7KpxkRVKR1}5?w~12Ka>Zgzf|euCZc;juQ%Itvoute%MOxqDzRoDf zv9}LuI4BfmReGy6R?x@gp^Aj}#i`pWMd>sx^6e|Bo=F=c5bF*BMsIph317pu9xoa` zi888Ms_!F3+_ipRhj-pktG}LNsNnF(O7TvwnffQQ5wUGTVBlIjO(xWoweejm={iWki+F7jlm$d4t;H=h@0v|DzSZ zw%Edq=-Z6kRBFgqZY0AzA2Z!(y?Ud(sha5gm!-a0`*+PE#yyoG%lD1JcgElbvfJ!b z8La{(;1AkNrSeBV$)J%TIq7sNn!#6wJTfOt!Yxp}dIX$B4Soh4KEZDWf7Ef)TxN8q zGj(LBeZV8yux%2)gP7-KI88aj*E9QAWc=ROznPI$ZOgwDXsz$1?l^y?QY;c|IJv~e> z*(na;Tr=$jovQM zb_#1_DpM^v;8X5>#ELn^+Wawoq8kw%ijHRV02kAE8Ueqg>>}@mkqVFyaXYwxHlR+om!y+s}}1IwW) z0D;tQUAzwgja<2a%>E6d?~a98H}_O`}k( zP(oA2;5sJUcQ7$oq5Mrq01e<~vzya6MY{}F#dz+Fmg=GwqY|+O&?<2E&O)viWWN)j z>0(zMRe1Vx8CVtS<==7+#?!PtVD2(1&fKlgH0HF=&RR;JuK}|v?M9%js$z?z_e;() zH7Oo?+I0Bk+EQk(JsST)z|65SHV{NKY8Jv6llU(s?>^Y_z_Yb+0pJG_)$!9*S(A4zcidOkn+oFIDFlI`fp3(CIoBy^KlG~eR_0z391Smejp4{gd)zf-@c_Vk*er}-5K|E>T%xuGqs)4BSM0G~)pca!u=$UOVBd~)`7-=iTT2()K?H9Xdic;sj_c9+rl?YW z2WwkRx!RFHQ6*siiZPl3uh9@P#gL*srddJq)n!;ecAX7v=z{g3z1wOC$t>1~gBx$+MAmYY9lEbHAM!vzGbCfd zChxotJ3M78r^nxxXRDG91dM{7zEWX8-**7T0h;OF;o?QO?UdE@1qqT>Pl2e~E@1K=5`oc}tNCOQ}KeQIj5wOR*5 zE4SSl6yODs#qLQpdm1e?+M-2%4P=lqvzPv_+`wv2*xLtU zVFkOOsKv916T1lkZwbpsVn*;w@V9(9jpch}NivfjlnR*O%Eo6~--rq(gLlKw5oSFl zkzs)RoKXAdfp6IQcX&)IM9`8_q)ey zfDpRUN!rSuYhy1YIQi}%I9%)Xya#&g-o%&BNSlB_`hoQ%r}Os~>AJ3;-k|_AbT*$y z&d)X5Fn)4@#o<{8KF3>o)5hygah&TxH`$&v3&EWC{Z_EnrsN&pL&oza4*>@$SDcUG zG0CQw4-O~&pjqFNdkRcKO9PlH>dV*VL$MBTaK#7Ax4Vc_#7 zKqD{tDzp0H=r+LFiLeDnHXu6#4ADlL$z}Q!x@bxKD!BwlyJX>iTGMbD4-^T&zQda@ z(FKrJ2}iTV2ycm5jPukSuV?@=SmI_?;=@LB{YzuT-AJeu=?9dLQEn}KVwZEJLVc}6 z%Vk#ZBPep)AI~(JVg`-LhCprZSaJfp&NFJ{%SI*IFOA8L{?EJou;}da`Tt#To-QH| znoYPSdPqOIT+I;lZHYZyhtz4fN+8Dg18iU(oW|oho1qqD?Z($s{f(e6&&J+E-(`v695a9&D<8Q-f5J3(ojvu#u+w*^t}oH=kvg&G)ap7gU#fCedGVhin-P_0ntYm zUVIkyeE79fCWMJ|^M9PMF9)9T65qPO70^0ao!)0&94kwNxQY8>km-rp+qWS~pS{2W z0ot=no%=?i&^+}gZ*aA#bljkJw>nc8-GE+0wKe1pCMOE3=uIw(AjALUe*-LECC6}6 zCrrq>v4IeJqGjX@WsW^BmY}73PYLOr5C-=ctu24Jj|itM+Je4Z)*ZIuo1**}jE(n! z^u`{`<#VQV1|ajP%YXq@e!yxUT3fMJUDzts^;hUfZ2O**rw$Vz{Aq+(LK=^E^75VXP^r65lO{M@6Q1JB9EY) znKCa}`IndzN{CR*SRN+=G=1#$h&pt&G;MEEEg%ALA}8N^|1dUY8lX|bb(#j{KWuaj z6{5D~%~eh6WskeE)Rl9j&AG^eU`gpV$+79nQm&_ZWUF8Ezfm@Nol&l@E_`yH9FT0B#h zP6-kATM04Yt+20q?D?o@x06@*7k7s%+W;uWNUZ zv`7QZc+g#mZFaAnXTx=GYAxcoSWyrS@1PoVC_0xJPdti-J>+IRSF~oc3r|;9G%m*s z5#KztpW)RfK?v;17>Gz-h*gPk=B1E)JLU5#*YyiMyGO0pctNP|)HX5EPH0=C-N7|Yf8#B=HaO4Zea9AC7Ac@XT(aSp~(U{p$vCyhY)e!QosuZVknLWtA z`|N5I-IseW7M2e|xHA&TkZ)C$9=#JyeAJ8Fh?eO*a=BkX5*Tp{+3* zz>$_wsb9OfmA~TEelfbl9%Go(;(dpuM&qvG=uUJg4oeWIe>&x04@qjxJz9?ONYH?L zqkjfRD`4^$!{H_#w+}0P$GAFAtp%5elY)*0cSO-;{TN8rh|OHRj>8dhW1)RXnW72`X*lGLepBv96OCI@kOwgkPGK6tJm0y7WrSM&&6OY zG+HhzxwM?833t*zjPv&Q;3s**PGNlsPz3=s8#7dIkeV6IhD9UIZyRF8&Q6a1=Mpl7 zn#2)<&v@5CnPecQY2D*fm}|$FQN{Q^qhAepFQ*0n4Vs;e=f7)x{yI-w zP_pO6r4!!B=vl0=-N1pT3wSakc7+k|-By7Mb(#(e-W95g92q`$73KxepVstotx^VvGb^@y=44zKr>XU46lhL3To8*L037 zMxhE(we0DUR=nIY{1COuTT6182mb*PETmxdYt*QgA@05uk7=3QLw^%J7apS|KC(y}cRWzy%1y@G{m~=L%K;_8VvXgTw-cB3NdXx}MS~arj+BhBz^_JP4q~^A z)z7(tZi=}gyfFD?!hglVps5#7I23%jv9y zTN!d3EDF)Lb0mrn;0M@AO(PquxY0t?-}p_1qBk%`IEYmp>Nix3L$K`uQ+4L|o8}Oa zZh#T_mMKpNcPoC|TNJ%_H|RD8O61t0PB`l8!q!7sAPf>QY$wHg{QOju9bbZT*B?VV zbHwwryHoxmz@&aFgd6W|gPpUBDs1W=`gZ{}(p$vS=N`&)i@6{BXY$mnNPyuy*d`$JnYOgO=emdw4PK)0$A!1^w0)%7ZUS{Qx6^Ijlx{y0YPlC3&#J>vp1qfCo_%&M2dW54!rGjPe54ojQH7-sS6lsTyTC0CVs}h(tib2dRji7R6N z`(macn^RyL@K&z6Yf>jF)$I|IqT;LF1voga>vGF%r7Cm9{IE8I*5=x4IC5T%uMuBc ziC7^v_I*M~+|H_$@WaI{2r4!;C6&Yx3F>;hF2)L5PloHlIB`gfV|hE|x)ek)C{LZV zCZ;>;Kg%#|0u$RzoOa0A0a86LQE(NJ?2mx$h`0KYED+5*l7;8!5&BRS;@|haq%9M5 zrT`_4;kKK*Wcys+m&^cB)~sj4ksekyD?{y!XM6TkZ;?bOlVGgMxsiVBN!a`nY(Sj~ zO|+}#ty_*QK2xEH_d#)|{{=<_G#?U)lEL{V79+M2w6eUC)wPjI{2jplxx z*+dXQY(KZ?Z#k3U-neYKnU%N5vMSAiQ^U0?iq>KtbWPs+|9kBb9z;Hq9Ikv^?NW7K z3iFlDM}`}J7YP!~2+9@_@u4|*iChsS$2nh@biAo5C0*T<4UBXL9@(G4IGn%WLanmr zv4n!OR=zw!u+A)$x8``r1O`|YKHT=2Si|Fm7RZFUkGzzpL6hSq9=2nYc3+&8WdPI^4orvV z&7QI16C1ILgQ}`D&9e4?60mvy9t6mm{6UDjC_?K+M~ll>1I^`{gz5^l47e~e*4}2Q zSNV2N506t;SCQ0J^?2TDKPG$)9k z<(FT>ql3ze_^dWFN5&v81T7Q6JO^&@;yp54P(kvNKP4=HG^LO$mu}Ibru0hSAlbPq zX5|KRm;QioDEYRolP7v*|0BV87?Q~g1%i{jb3d5rplu+H6S44q~4Br!tq^H3_>Yi<3)TDIf_+Os=ZT4=554EF$ ztYoy>2T4)F{mWIOSv23F){tUD8u_k;ToFLBzNG^MPwXsME$Q0NsxQxA!z^rpP4aO; zF&Icy9bPHSC1;9VB4QmLVahGLSt{aucMRev~?$m-cAb2trhPyPB1Q zthlsj<1yRfGK+mzVjW?Dp*DIY0CFTur`EJ;+DN=xe)e&kl`iSc`p53q5DVj(Ax> zh=MaGEdDBNxZ)@^HJf}(N{+PA-RZr-J(fxB>Tj`YHJ05fUpTWo@`k$KCF5!Tm%E7 zZuMsF!kcA?2EX;=BXc;2nek+3-+crIa*_*TT@oHn|6n!a57~^YI9rjyQM;uXefxR( zLOZJX(+|V)vS^X6D1%RRy&zv8y25pZbR+XNGnt%ZOwnDv21dO}@P@$48@=q9Td{z; z5<(&gnqoYtGr!J~)Ccc0GmmE-C1C5*@b=lOo~`L3vQJ7pIzl)n!0CR-4HH&ja!Q&2lH(bd+!c z+&b<6%m@mrK!+r+eP0!a80JX9$r>58r0(uS2d{d<(9!G@5~`_5YY#Iv#XV4hOfyL=9pfw zz22EP{Ef0&q(obEF);^|^@e!Gf+qZxA2Znga6&4lI~AZR7Fo4O2V`bnMmG^ zrd`wAF{CREL~a@oKWw0@%e3|wx)IdWaKx(wOy}uS<=N-!A)+kA#>3}x+0%ru5|lgr z*)qE0H^I40>OMU&PN3&=olYjv-{vOG*B93)EClIQ)o`z?!3Vs=(uv$6Ss4!4i`_(ArOD&ou+Lv;NxYc( z3xeLU`F9q4AAk(}yKRn=lK{e{zTQ;{or9%p3bn*j-n<9O4@2ruCGJr>`+CnYiWwZD zEpmB*#<=F;*gg-yu5&;z6{_QM!#2S}5ye0CX?W_DR5s{-oUOgh8U9KHv{V$BSZ@Z8 zjFqU#=)@}nszP;iqGQ|2(ePlyV}$$HT6@YxjTGGYaX@jqp&HYS`}X(zf^tyF z37-UzW`WUGCyOSTzLN;?`+!@j#FmJYwgIm8X{v8c-Y>@_zv;N^&9VwmT+$2tS38#Y z*}l@X7OZ^aFGiDwNRj%k$_1YOZmy+Rl)zXX#c3$unG%D~HRN)APK#z%v!*I?1_MRW zmC2L0^ooPd7mM(Yk4k7&*!)zDwPF{j<`@H01h~G^(0YX7IWfg_@?;!4)l!>*ijOwP zt3BbUD)NMy$_&rRMN|gp(qdsv>kBweLs^A7z9z zE~qMlJ^I@Vm=<^#L&q0_xa=}Tbqv8wgul*%JG7DX4PArw))1@4CYxwk>_|%;H7Z*p zgCdT7`p(|5*?9Jz2)g^)@&v^ytiQAb1s@CR=qfxvPqxTwms+0NOFWaoARJj>2HPg zB5s}vR-;3CP}xOaT0c`$xBj*qW2=1aFT^XTQ~Rw(@MFq)ZqD?%G|-yJ4bn2sCO^&D zys1WIMgB$W4Xfrcwz)x5eO1Hz5Joq59~JOl%a7{Cz_`Y-ItD`QIP3<|H#^~tt-{Wh z3-GJnoIDBdS)#1QazOvwTv0+tvYyKG8wRmH z1XY$}Bo^B~tC%xzZ~c#ZRN+VC9^Cw5kN5Gg^&^9mF_TC?m(L zAo!{n_{S#&2lo>G;iZ|XRe5s66bKYb`}bynZtZ~*U$zJUH~HM(P0RYm^THPwQaO8| zJ|)RW*rpqc+xT>>YZmOLN*;b(P``oiJbj%ZIH@K)Fnar|*lG%@yKa$^d;|gxqH)LG zeL}D0lEJyxQmQiQIfNHLu!9)?Mz~qoqt1eUWmMp#ZHl~VWwOfltW4d$h|e(V#P9&8YusQZ`RB-%5(s~38-al zq+(?ZnLTuW|5>SyH@OfnCO5>%Y#iDDj&{;_uO=hLdIG;Q6hP8px`MgbL3OBM_*K^W#ox? z`MFfCMl-?pQ?R6l46A1wO%z)5~4K zj``Q+otN*5s!%bb0XnjcW47ls?4f%9SCzXRz6_<2k_ZMIX9F(o_HUrKntbDGj@VGa z)}f8*W||*j6$F!X=mZTXRVxRvy=mmZG>+%{pg%w{N4m>^i1$xM1u?H9-;)Un70H!! zQgZaa4F|T&OF$Cyhw3TVDKR6gDH@4`TQf^*X}-196_+{=JTjuYgkm0ugpYT>e~s$CSJZq zy>dxfPGx>|&;0h#JW77nj*he$MRmW!UPk}PMrDmL0bU#vlU8pi?DKc}Zn+M&jt)5Z zC}g6cLYlPm6pa^v1%iC>>WfQapx*Y^Hn4Dw1NO)&p1`{=%kMS!7R}bykk?&d05hN1 z(b^YhkkR;A%kg%?z8_r;vI4yspIV@itWmY~3S?*UNib|zgW8bs#>eIb6EIT!Do5(B z)9vJBA8fJT${?32$lL%9TUp2!m1vqSM633be2->N2SPukf#<7PyRNZ5nkDhxtV|tx zRJo~Hudu7HYj$QHz8b+{8-Z)+(KxlcL?;s!4y{Igy}yGv7AN!#ccE@CTWAPGd)Tzajhu zM``Tt^dXm&40@lY>sur3ox$N=5X#_$THW@p*dv(gY(sZJ^MqRH+OrW388hkmdXNWb z@#Inr182EHK_sJLXLZT7-4O90lT_Oc#|?RHH!Vvtdj9?qUE$Yz>PqO$HZ1?u*_ZfHqh@3R4P$`MSN4Y9KN~Y=zu} z{mxgu_@yj<`5OoHG7~a++>!ji80H?bXPpSriK4N;H{m~?wHNm9T{s9_Z%=Zmt9Q8f3Kqv-oyL2j* z>0&D4892rbMlfxVrD#ow@bs@z5sF7;z-{i{yzTOo^ZWfT>eV)hiXymmJlc&vaph3B z@BE=OO0ZUBuP6+9C_c!8!n=vYDSyf5PRrbn=%m~Y%%B$9sWf5iWT*5;>F&SAOT__Y zAkB3SP&)P}38#Mqox=u|+45z=eGul!2y zBsh68R3?jl0qo(8sDLT7>?H5#0HO7dXV}5f2C=*LFz-YX#j9Ju#9YKa# z_7qSPh|0*g{9)_nX>dxVr8Y~f$^a;?umkVolC76A1&ouGMb&j?5z}vfUo}Lx*EG+J zN?~YYKax}dJS8n}N-b6YKZb>$!lB-4zkalQ!GLr1JB6+`8s7j?w{WRKdD15MJL{h= z6*I_%En~8YB#!;&-vNM&C*yt>!cHcl;gx|p-755TA!HE*UI01p2xw;ssGGjGVh*Tj z%}%e#Pm(>3HDGYF+AlbOZ(hthZUrV3oi=iP3AneR_g}N&*2Pp#fK3LEguAw7hb$RN zbUZX-GObJoqr3Z0Po0s3V|6slYXG5IV*`yI+oTNUJ<*hR*msOMNO-ZeqCwDYCm>2e zh^2TxQF4rc=Qn|i21Zz`BZWtaIr$X+zXyCrj?C8x{$1|*l%j)yiv16or{r0!<{#}{ zFV2f6r+hl@j^pC=VvlKW!$8BkAbDIln<8mg3L$3DLHU@^GWpyLr_-M>clmrqKdx2 z3!qf5!#{sFAVfLp)nzLuz2V(*PE?9u6m7tD>w)PYg z3hMD~*_byH+h-dSj?wxrm{UC0R#ieTWLed>Zm4X+KoPZ}z+6R#k+B?3srGVLP>#j? zWLZ*zuyw`Ik==@v{OIFfHg?3sAvA69Xyq_V;njxX!@9orx_`E|r^jN#(|c)lov7DTZPZ9x93e)ens`r*f& zR$}pJx^^^=R3J(9qEu4KLhVnR-_QH@?h+|OkNN%diodQ<@{dNMmpd){gqUHjx;7;+ zi`>%)j(+-)tV=0v41o{F$i!SoXs3hoYRC;bn?||eF|0fiqONqfk?mu;K)6>}9~~Mk zm|*DPgcjxS9yM4o!wgAo6D+J0!rotE@kC2aZF8_{> zhxkTP?R|Fh|F2$RhZdZs5;+sYVoTB?qC@&jU3Fn(TO-YOhJn_mCE>xw1YTwSi4JE1 z>$xU~ftMa)PV`O<@2t<)#haZvqH)*Ma;9dG;`g`gICjh_9^7e8_x>wp%jn~?HUkcpjHtDSCl#t|KP_n8E4nf%yv>;o)G8OsuSpq zrC?^5CJ|;2ElunwlNUN~nQ#CrX0u6YJUaupz?&SF+0o%`k44TR&q!f~5F0-$bVy-n zW8@6Jf{W!stEXaY1+;r*_1Fu2Vb)ymzyl0X>;|oQjA9J+j?0%~`93*~JTB3| zUzqB(CK>gUyZF@AHSQnyae)rz>GLdrs1-FH+6O^7iWwhpnZ7+-ANF#EbLzEWyLYPZ z$1Lq0rv1s@se-y01Q++ASzLXM=NyTD;R4gJMr_aC@CyJ#jn?M($b%qvi=PzgE3(o- z{g!+U1-V+FgHYZM#-=G%5{@qlT+ObMc7(}_f#p8%=3C?;`%Jb9dw+hb+!aLl>mwmC z@0jd_X*4OB1Bw!kDBS>Rqvr@0H7Y`i%SwA3(sWO1jD;N51v>rT9Hm*i+vBHMv1dJ` zaZPNQ;HQlGmLH7_r^wEuzfH%fxBUcI&DS8Yx%CEc8{PCA+%lk$4YH9G1)}%2w$kx1 zbvY8*+Z^-CRDF%v>=@XY(WP*T#oVCFw^HNg zhzwdn-safEIpu5%)TNtIqCLgO7Z9U>Sd+%mHFN5!)XR{>|N!=A9H z*Uqxd>N{b(B(0HqqMEZ~R^pv$p4VSrN1v|t39+6cHL6t${BV~2Q;IjQEuzIqTOKk; zox`+7^HkeExoMt@tr4^9Tvqjb7guNE2ll?h_w%( zl93{v0rT`%pV=cDz1P(d$t3nRFfeJA7fAVbaqsWI0Gxe?+}s*6f_f9epHsqpO~1bN zoydV(f$2E5r9h?BZw%`3Qdu`U!m?iw-y-*S=w`5&kzc|XjTb=CZQgG1Y#&aW6@!~_ zAuE_hzomk#W31Ow>@4!+;3~gqo;unBhT@;MI?&s~U9jFUb3^4zYN2ha$~5|^ zuj~aX+k&Co+DLMYsm?5mq~u6)0nB>}O>J4d$t5pPSXZ{Hsk!t;kpulGS@S{b0k zPgv*~;DkiSWeoBE%X6}d z0Ufw}g*@ZQR%p%Hd6!T*{+5$auHMa!pg1wQ$|3(5>O_@Ix~}44(t=_l}O$uDSR0v!}JfY_*0-b7_`Hz;9Wp;+n{vxz15 z%ZKJe#l!Q_^&c4N(FNIsIPhL3HS%(jG%xDidt|H~ctKW!eS?EpzMp}R03QU{*pAuj z5*C($VV3B7HhU(ULmm#oS>KPek#sH|Z6I*xJUQd2VrDX9eTlZMX*et)B)N>rwH^C>961%j@9 zg+Z`~XGAwfK1aL&df^~Tsr?a9Zi4|N+8<3(*Eemz-Lhm8d8g{+tiQd{Pd1To)y zL`??1vRakzDRrB&=eUCyf+J35<=sc2Yco!q6AlWBT)KNNY;t&p()hg_OP=7FMt>v^ z8`_13>Drbh#({T>R<3%SM>OHA^14!$_*N!n@KemhZ$^|5B5ARcdr`Nz-9l$kZJe^b z+ua$WB@_Na$~NoH6+!1U&ZtFJSf57E5$DW6ROE#Xb2fgiIE+@S@Lyd26q`mHHN684 zFP`4mg8rZhw6wigz~TY1%3M9e7+%5dVPF8t9`kY76*urM6QK93b4&YbCu`nmJsCDj zV^yxvD`sg8WT%GxI=JSCsxn`^r)S=J;NAaMEXgI31Cgi>Ipmt(At}ealL0CM*sr`G zSI0MZr>$NUAkRuXA{&ya1(9&Gh)$PS_cIy=GgsWZD!R}jtU$hCqKW2g^Ih*)w0ue^ zxE9jjN%iQjggLGrqBLhhCNYzTdez=}+f07XAMct>xp3lgo6Rug@q|QL|2CpG=Sg^D zzTlAG@1FBjo{CZEqcSb+$eH$%`C@dZjnAbCvqQNUa9K~%e}2v$edwvTDG!E8S$onl%5-Z0#>|V%-8`xzb z1Pki#ty@)0l$sZA5!WooE;J42riGr;sMX>ZP6JO~yJiEk{C(>rm?cbVCNsrLjryn2{y)jRw){ zRxJ6%gaV%OI{vgd&hCY_WNf@2=7s>nskBqyEqun_E_o$fyXC$!=~ziMzOK9m+(@0n z2yf`PNN4IC1+@3$%)zs$VaurY5>jXeHY*iF$(a7-LlF(bH#mCBm=wXUDK<4@bePW% zMC5MwKW-K1>63ew8-(YJgD|1o!?+kP#Wc~Sx$a5?zb0cTx{$SegDW5CT%RLAf1EFN zme$o1+FXI8U|_vov(hZ8NCb2-UA;!wjXz>79v7DgaRwWf8`XfOK?V?RHq`qzZI-x( zA~f25Y+pN-H5)=a@}1-9KSb3`U{$WZPx7;bp?Tki@Q z&${lC>y?gYvGBXFG%r|5Rz86-w!(x z<#^2^kj|eq6WWgy+cpnohhk9PQWX$qid@@vQGarqj*&UYJTwnIk_Wi&DvMdYg27ys zlMOwaQByc;(BoUXFoXflb}?cYT+5WCgy9XuW;Ax#ouU!XiR!Ov(iQ7knHm=z z&cJ_ACWHsqelsU@gcvf0GBhaYMIpB)I}y8@i$;zo_+qt~ZUgR~%e-{HV|s?=b?bi= zrj~YEMycBIP7aV+R!T@Mk-m6a`}gXr9KZ}+y0m-8A+gD$Am*;_4)8lf)~Z*CA9lz? z2a$25%mg?A6Q=4INRJ7PH;ZpIHc`ef%AVq{3?>xgzv>PYh?mUv!H=!)Ex`}1MG|`E zHo{A4-ctR78zS~SZu5z za(|(&yfk*Eo4yYdRZv=sp0o3wi($UB32|ZY)~bvR3}!Ki<8f-Ws=%Ah4SA5k3iTD^?;U zH*izUk5~Gw0L2WRSKd$ujex%*T}r)b%lvQAR*%&*istE{00t7+u}KQMhvmw35ln?( zcfgPw6gW6OPyfICp`qunUDzKp2VVqF$CJj);{nh^;n@JipLwhN=~Yn!4B>Ou3FEnT za(7G{d{-WSUjl=p#@-`^b{fA($O79jFqMU9iuUP9f5|4RXf~f5@Q}PpXq5PWuBkg) zW17w5@T{M2c%Wxk*er316fp;t3^=4yGhibjhigyysJQ%&@j3$w0|GO=YPpU<$T--8 zFlu33&q>|a+AOccXsrjF)UT9e&*7UlP-O!kJTyb;u$#KEnm!PjkCV4Oti7wK`gD-t zIOOw3{H=?$nB-;Y*@_{7PYlk2NZ5qyivGSZ5_wc#e{M^P9?Q+`w&`t(AKbA0T9--0Ac9 zAd^iIqR8HZ=5=HK6Lk-H(LHsyLt|BZWl5Mc9pxteIm#JJzMUj_-+12I!u)}iT|VN?rr zg|(S!pPM@`N$j&23`$cV*MNJ}AR#h|2!T*57LB{+yT^2ZXGie{XaYAe08oqKM1?Ln zRN5wc;jkmu3_Lr5o2I@b{Rwlv!!MwFgkwOta7m(EjtC#X|$BcuGQl`*qTV`{(AV zNH3EUC&%) z#z#D24x{|yt`Jp9v?u6UUPY<9ArO&9A5c5SjG>C|UT!kxLO^+cyR%yb-r)9sJvZjV zJ3z_cLN?G26EZ$X&e)>wu9Iec-nrdi6;txrkUcnzrZhygY;=8{=g{wL*8ZD$PI+EP z?~}5D3oGt}X+0H;CuwiWzjY}$#^%bhaL}*FUTN`bEe+@CzXwv~teDTw*4=z7{EyOK zflC{EErjA}mdm195W3n?5$nTG5WkLFyQ3-T*bZ@^8~^S$i~xgcGX4eYiI43_BH?xl ztgbvHRD{A0c{3|XH5`Om%93m!cokYUt<@c!5W!!3VPLv0=9@GE>1Z7LzXIHOR~!$> zj4Ea-P^y7WAE+(lVdz7I%i5OtO3;tt*Te<&cKSzp2O4*~W3xJiI}I{V6cqwnoV>yk zkPmy5Ctq+Q*j-e_%4%tz(X%Rb8V8&p_I4so2{0r-JLStuS_3WUzU}bik@9S~0xfKM zrooP#;qaE^__g{G&D==!{&uMVjOq?)iJlf08HmqOwVI%TwA zTkD}9irg1##TmnAzpnSWv50@=8^U3ipwnb@YkEdGKgiQld2~)5W0A#5aIgh68Nw!1 zL_4VxK+qu>^Nq(Vh??v{k53~R8uJ|rh!3X%)Od*IL$;m=-)bL0yFTg_|7J{ji|!{! zfq|8xBD9|z2^{sM&rSmH-Fzh6fZ?a5v-Q@axv`;OT7NJ+Fqi0Gr>&T+&m^&tuF! zZDQ-@m)KP8HstMTst|+T7X8fDB)L3KnSsJ17Li?_My1`fis1)|gf3!8_8J#^$oI58 zo`U1!&kNa7kYU*0p2Wv|`p*f{l!iByuYL-h7VfS4qMj`;t<}Q$k<9!DR20d(Fb-FD z4?#dA4@ns?V_3rgA}UQ#%wb>^!wQI5SH&Dq8$m^J)j_ls+!ajgw0Q*;bXNq|fXXVE z;}FDvN)8S5)OV_Th8fVk_xHZvegEfrj%RwRtDbstsv7Dy^tk*-=pdtQfd*T>qL+M) zIFewzYJBOvj^%&toe-4wB(KdeyTM~W7sW>We%_4Oa3kLJ{eczmjM?BT{qJndDj9U+ zeTGNI++(|H6580-?LlFgOjf^j5hq5$F<4dx=`O= zyi9c`PL|&$)QUL2X7s@upM6K?JHL}U4|r{{_mO0LS;(+)9G9yOgG~R*fCsx_Q*LV`;J&FPw3gM|LQT? z$Lrn5sCaUK?Iz2hHxtdntJ;Kly*7#XFfJ=`)eof=o{naw*x7h#;>C4qwwP1|UYz{r z&ubQWn0KDDx9>Q=x0gmyzZeV}v26R&FudIlmS5y%wT4yWM?P}DE4$!TQnvY{@^st5 zF$PQC+60t#vFmzv?V%rf{Cve@?oPX5Q)aa_n)9qM>;8z^tgfdlJ~>5&o{IbFUgFfx z*>^X$Ej#|W|AjfryzlJpJftMjXL5Ai?vdB5mYP=%91tviHW=LWt-Q+VdHigC?&%+w zmd&FA`pmT4(diFgiyfKUhZ;w8EIl>rg}>$IRc|kkn)hfY8Pw_2?HTS9B+UJvjxFmM z6@S2gf#}rEulu^^y!zpx<+R_j=FC4^JESn>=NEr%|8acRuRmXQ3rRh(GNn+qwYIU) z#&P%RV)41>6KnF1p7Z{Qu@C0-C~d#2({6Y7w*NGGrzCgws@VA3?td;mh~9nQ8-^U| zzxU~1t5x?B(`UwBdOm$vuk!OLQ9VvlHDkP<1_8zb^fNk?RJ;ByvZrPuY=Pbn%ttj7ktaSOB!K6hnpZ1CSh_ILN&Z?N)6!QOc1kNRS3<$}jkel|O9 z7_X@LXOexlpRD>HV3RMDetopaczWH(qMH%YAFJLx&XQ%X)8AUwCF;(fXD!0^_Bgup zgJGiO@ZK@|Yxg?4y!)rmFK3t7bTzr(W#flrHxtbC^{+j*`ABaZW@^22ytd>%9bJ?* z@1xIOgAzyEUx@v*+G4cBnp^k#Ep6~NUgq%p^X5mgh4Nm1t&HO?j`(NJL)&#{wgd!l zFuXF>A^35hd2AvfJM*sa$7^mD=VBCJF8&g-@QXcI`>K-ot!#4F(bdt1-3Jfev0{hE z+&#v9hJTV~Ek@(I}i<9KC%nfytJ(URzK zM*=?4~XK4rXb@$)5*)%X^*iGv<#&6sr;-@VgZ@6H_@1GCn z1TG3#Kfd4Z{nm{zq3`YgCA<654x0lUe&1%dnejHC|0yiSAo2Ev&Z?z3(Teilu;Rog z4qKZZ4HQXt7!SMpagg`(Jry}V#xJ{l=;jdPZWH6up+k>zjmPip?K|vgPFCEJfyd6B zmCX+H3<*wqi^&X9H@&*V#y(qBZ}IB~=cmT)ChaEwnCYFHe5Ap`=JU_@Zn^s1d4FlQ z%+2NJVFx<+TRdrZcA8E8+9#cQy0O$E*)< zG7Ann*LMG$%mV{^B~E?p@&4VTiTmc&2X5%JWC9lb%LuIB`f)z-K?kiX2I=+d*0$Z8 zzh*T!9C^^q_HvABexFb2;JjJn;e>HpY+t8Rw!>`;CN5b&&FkIM*x8ec3PhvlPMtZX zZJ(80m>5&#m%tg4{%42!k^z|Y9pkQ%bI1I6V}8iKL;L2Ov2=`)_4lEg&RjgdBioKT z5%O-wgA=L2cZPRAY5uUyP09YzFONn~>oOsidUqq~OvcUwV~@gD2S($`zEsZBPxFKO zzO;EZ<|NU3;H!@Yjg3<$&2e4#>iX=5eFqX-pUr-e(g}3Q?6SIkvZc4w&~50SL&t5K zMZYZR&}LCb*BdqSmv=jNW=G=)w*&fpZvL_3ew@#zN|9~%&JO*2ho;5*ruNU<-PiEG z+fUKcb zkQo=Bp9`+=alaK1$BmMY{mIAw+^oUBc`d>2tzT8%@p(?jiqKFtrKrvz8&!} z-TdqZm$;wOj9)!)FZp$|&q%lOg8RAa9zFrDFBa<$nfuB}=OOJk?wbDc^nvK6=SFYS>>PX6e$f9b^U#KNdzn*hUhVMs$IWf;j0(8Van;Ab z4Hgr7jUD3jvVDZlQ*ma_+uS~}BNIJG(lbx=31kCi zPqTAu{6TNqI92EOU%rT^Y$@&hwYW{J-Uvz1sEtF?I&N0X4qK)SOSt*2duqYrqhrQT z?A>R@gr8m?o;z{Qv(LR;xeyL*@)W8}#;IUHYSc~;}(dsAS%}Nm;|5UFf~;_OS$^OZjUk@C=GA3tv&%uwjJec_?YQ#$4%WO~C`&Ax&uk@ZeAPVc*wcA~jjE3!r zLnj=5Q@O5W*5|3cKK!^dbz{B#?13TrX4ZcU{=#+{ZP@A`gX*zY@M z9ECf(*S9%(WeL6A^TVv$vW~xAGyAaq>Yy8O9j2{F=rqH7YL7%iu$t@UZ!yDlalo&W z&W-iDkF8%cqv*iFGm8qBtnHV2-R?ZGAb#68kF)MyrxSg5_;eLJzb%&1zr6PesH7(N zV8tf(ZJG?S6ATvrz7Y0vK8Ec$96RXtqz`lLMh;u+p0{G>-$!HQmK$I97}WbleD@2X z%Wp>oo1UKkD-$)MOS?y|p0CIBuzcBjY01z7r6unkuY6?p?5V;jcjFDm-xkm9cfQMw zi(?O6d!>96l%y09XYS+fqh3_qNiyogqpu&%6&?i{5{H;Lwj)Flfd4!fAtiQ-{qn zK5O)oeYCOZpegQu{&ey5=+_m$TDH)b-FvR}al#cxxL&H0Dwx}J_>p@&>(#KvWYtCj|Rh|4JY;EL~ZVR@&JAAO` zl#UkW@0Na8w}7mWdw2z`n00E5%j6Z7=a#|A4;}95IaS^sA6?OHfN^%RSJ9R$2RB^* zc<=e;9(q-aZ~c09-K7CON5=1pSBAS?*n5boUvZ_Xhw0gVi(u)RoNJEb79Q09qx8Te zr`nmuQIj&N`*m35@#Ced8B2`YzTWGTCZ1|#_N$dFdX`c3k2&>!9Uqvy=w5WptW?Jh z@0g&+hmQ4Na$yB*<4)?D~3mW&m~p zJD~Tz@5m2%vq5$m=3w7MeHhz#*+BB zwi~S1N)udv|J&_o(_cp{mlQAfA);^D%QgO$t8U$CYrhUk>+gKHlchBI?Mdp|mrk=T zKZ?J$QQyBP^_f*s(ugRF&+Df?)J-ga4m?ms@zA8kOZ`qbK7oGg0>2)0s?4}}>5`}I z<~6Ij_UTew_R#ar;kM(Smi_i@XWnvq?*pBx@43wc^n0qsv92SmmibGZ$YQ|E#<&xnci^hPp-n9KLqZz}j@I^Kzr(N9N?RUQb5f z_AB!8n!ja+_mnDcw)EN&*XZp_c44!`iO0Kmwb6I6`|`B&sJz5JD#uN8ZA7M`T{q+Z zD)!so-pkB-YT4M(=?m_>xg3CR8S1&#zHCmnzsY5;zgzqoJW!hTLV9labLoBCk1Ksv z?|S!P@E@30%)^}NUE1&XR50uaYksQj{zLi0*1*#T`i1YiI?2-}SARqJ>UCShLf$_8FS%yvC$}OlEX0+D3d+gNpWd`_(lvj^TSM8eH z@6Vl2jEf(xxPET=LeuPFYuvp;Op{M{+i@4$8En<2;*nSHSJyoDc6o8}pW7*qJ}<5E zuNm7lsdr?9hfVv9ySJR#=T-2c?naRDgbmSueR&d+_w$wfn}K_04Yter`)vT|IjYy^ zeviAQ^-->|?tPLz@z3An{yr{;uD+b5-xU1r$Ek(&i*7c3UTBq9lo+u+?33rsRS9p` z9f){sdz0ujqBi?Oj}6}4nr^3@v+lbg`m&YObmN=l>#kke`MmFLn~RgIM&6t=IDJ@r zC7a;h)wX2=Yye-l#9vOokP7u6Quz z&&>}&QDTO zD(8-@*B>J3JNwcPGqEYdtTs2k5oH%Y>1>t!*BH-d%A`vRK*_MidnZoMvFI7t^WvdJ zs;l>Uo@gTmJ1eS(DB{ONmkcV;cRU-@bMl549k}&XWqb69b1UbiO*k=Y*Y^4!;|*2U zuJ7F+d_Mo;>Ty4GzWZyxamVk~yThdy_6&YzTynGa%RSd){)-BGEy7bHJ8hhV$Assc+4TL{lgA@uaBN;^80YvoUG@sw*30%Lc6`7{87MJ)lbKw{&eu2k!$O4WO0r0 zrTK%4?)h}RKVsCo9yhu*{PlRlrBf$odKGOw-#_leyA`=%leV1>340x>@9I7N@`k*| ze$fVx{`NjSbF!23n|Gyb-mKZut#3~OXUtwoTGSi&T8uC1trsVi}A@JArtERn3>;r>(Qs*`7t9@o3`fp z)(lw59_!X*^@nolrZ=|(e%rM@ZL`0x#m&rPp;Nj(aJO3L8ofW>@FQ_2JKvqonErUe zJ^#|Em1nvo7}wq^JrlNgoiuGnNZ*Sci{6h4Ey?)B^x+>KO9x+Hku?2oJGS`crqMS% z%6@%gv-x8d@oZ`eY6J6F5@)ce+U ztNQe-C#T*INISbZQ`&X?{2ejd&&&-qO&MAjJzGAn&zCOKYlbh7TreMBx8zr|@%~#? z`=;GIdi2Zmje~dF{nhu#YyT@r6Q=05@BOswVbsOXH@7uf{_R|rXg|EN{=$*Z8#iCS zxg$i;XF%r;zx-p{sccH3Ro~2>vB$i}$DM!iQL02(9I-_dg;gixiP%RvZ5>UltCj^>|A4Nv#|_x?@j z9Nv_blU^0`oA~$B4JB7~aY3Ksu7a=3?T7b<`i&16J0dV>N7@$-8RA{E0sk%~V4 zK8le&eH1&&Vepr77~Ba13EaBt-<^-^%VwxAWWH$ zL_6jaVaAja=8VyQy1ot&0+8^55HTMKJ?0ak&y*4d zOa=IMk8j|AfWf^!!r+GQ%+;M=NMOuY!igy(oS1ULiK!r*n9n6Jc+7hkT&lBnXC#pn z8=0MSHj+qEL}n*Fh$ND7BD0e!B8jBZ$m}FP5y_Teh9_^Y56w5j+hp9~Li79LMj2Iv zabh*$#N=RxrFXG5FTP@iCu1Xtq;`0l3`Hc7)CV`p$cZG9B5>o3(num{5AKwh%g@P9 zD#Os6>?AXOPIgjXeol7MGTbTA&+z;EEyIm7stKpW|MC4y{=ePtKiv!MgZ4o15$xM~ z;QU9-q`?SxYUqKtZPmBjW_X*EwSu3nkzbqXzz>bWh}#uG7@n848#v-V9fKw7Z`lQ2lO8C z0=HaHgwu=LdZ6MXW|CoqJ7x61+a`Jgr_x+3Hn9xbmS~2n z;o>dfYT%h-rlmh%?Ha~oW(^UT`TsS%R%>{A-(qB??mD!lfQU-W<$UsUxpqt$=aXN? znK5Q6pL{cwIn!6=lh4CeVN7ctaO*Of<3-I>TmcFEVedh{iW&kief<3twFJiW%oP0X z&zUe7`P>^e{tAuXz1d-?LP-F5B80S(z~qA)-G8)KtLr7=gK>n2w zF=d1vQ!FMG<%B*{K^QP4PCg0*<17yg$h$*GXIqdg+7IoMwF$_T(U|3Afg#;!?xE#=d^KWqk%?pQUo)Am2 zags&x1npa@#(AomCWLcL3*3BlaPw0joW?^)C*wd~se*K2G$s$_@e$TWAbc%Jwlxlg z(LlaP1?j_^fE>{f2qArq0P+igK8m!dz6x&L&2Qq=zsa{QoKUa}M2f~`dJ0JBKlHcq zR}6C;%F7$cx{kn^Q|DlC+w(9u7U(fKz<{yCj2LeMRItRM7fOPVXR9Esk%?xGEoQ_x z5ul=;pM%RYRFE!mLA)QWC~+F2D8wLgUeTa(9&=>tb<` zqQvP(LDqzxybprIk55#TI89O%@;aa=cSZao^yEe1NIyu$%?>^aWi&1~fsoF{+A(Ih zIr9QDV+sjEt|UbA4hW7P$rjs?ijodKib4XHE2BknTON)`UMwD|C~+Fa%cxPMg^`Py zF^$9krit)maxn)c7jtBCF?(h#2GR-$8%9Z3Gnc~s6zL266<3xGRX{={?*pM&!+*rD zRn0UHQ`8ACk#xtVAFiV~-xYMx>8G7i#3{k1$pdZUacNSFYo~M=Ib?phSe}p`f{}joKmT7s9bUs)89`X7gv`?VcjtZl3-hS?I zXpWxztP0UVDv&LF=t3$!_4ZNZ4j~mtA07&EgV~J|S49 z<~tLAFyEEwGedyl+%Qa$JH%HF$4>{2e=9gcb>R5xz!|DI zGXz(h8%8K{hxn`E3~h#^3q!MBv-Zpok>cDiJ%z5F>B?DSbKJTs-?cAD=snc6DU*FL z_~(77e(+axas0mBj2%QO#{2syhIjH+jO^*B(CDBc)`l608S}bmh#4`@F+&}D#N}_1 z9<}lrML5Y8;)1^n;ROGrYj?<2d{k&0=@>4b$Z2#`umg>bj^{M?r`A2*E^+xt1alM6 z+6_U-d#RA$CFECly%y{q>Eoql{TZt$aT+J+4HzXhM#ubrtDv z7q#7*sr{(nI|MsGx{2&POO2}&+CN-Je~}GD1Gyd2Ujmmy?*E`p3bruZo8EJ*ghs%NSqvy+~!7bl?{T*yID?(M|aF{sWl+=%jW z+tM}=<>iJA%kVZ03AodXw|byr+xllo%zE3Tlk1-)jl|kypju!7=9GwPfv=d+$sE2m z5Nd%wxNSxRZkzF+)&$?;B-8__7W!X@lga-+oc>SnLAW415DvQg-^NTzKVoegjBx9Q z9=Oeandesp`Y39q`YP(e{S=&me|^h*^;>htMR=y(e@PAW{R-~@c5U*R; zX{bgE2L_4%312G++r+!;#YspuWtbovGu*JDFWyEim%B;KdgG+a>+kaGZ3)eK+l)TA zaYhAU%*%W3dbHlSbRO4w{r~&@zqfbG8j%oc#P8_NjlQvo@A_^_)bF=Fv1`A$#H@0d zCb9wweaHV!e}w)GFvR0DIwQ(-x*XFKny)tqq#tVv&DW0v={K7~^9`CV7V9zz*2$EY^UP0EOQPZ={YW``1w znH@^JX?7^_z1g8e4L|>9VBrdVN8-PQ_20u0DfAun6dGPM%M;*nI7a1lj3MiNMWDhQ z#Ioj+Sk|13Wz9olS#v6uHBXLZ%`;XJi?EwNjot3dH&u@tyb5ml#7&^CMVn}^vq_Z)Dco&mt#KZt% zyC??Kr|95_Md}3>iOEsUA~2!QfRgzFFv=MKBVRxmIRo5P0)Pc3@-YqtzygRcV_}U! zV3Cu0jnjX&rV}99A_Bjw2S`NY!OkO}(GH6XUgtP<)Zs8jIPH6GlIT9qGJ$)=F*>ecRxG|E24TIK>XrrQ) zO;B1zSTUa=6xWC2^3*IFc~ucE-?RzHg<95@iR2*7hNBwMk|`i;85cn1byPvRwuq1y zs>hUs9kY~!bVHGdA5-#s*fBrz`81ki!zjZ=@_8Jj1-SM+9CH<9t`B2|LES8Ba?F+3EXc*p^Ifks;3ucO5u5PUXGP zrIoN@s=_gOFI_l>RNiAXoRtL9Q-PjN9Hcklq^IV4f)SA4MPrpA12ki}7>~2(ApJxi zM5L%-5Rx-`=c~kcTr8V$5i`gJMiEG_K!noZko|NB#oRiwMGRyY_$we`Bp3YUQQl6F z{x=Xf!x9AJYXQoAo9zT+G)fXFv6G>BW962toZj5 zR;#=1b)M~Yp2hsWR*Xi52K+lQ|ISQjURxH@Y5E`{3c{d5Ld?{J>&a^|jV@U;Y(1K5 zE$EESI#@60jrimh%&3tk5{L}SX9$nOV zzM%7bPUrb_y{?=rnO}9@9oKn2!q0PPp0`Km-9eq_1NDNwX};GNVe;5|NN>b#OXmR) zv=MhK&E`LCOAiAOg#4Nluq_<{KoD3jc@(Noo)&c1iU9`T^kyEOBO~aZm|0N|=|lk1 z4qzZn0w`HW2*rY4*)Y@VwZ0hnj3KxXTkIed3pCpD{(mNd*`H*E@77GHj*g9Krp1nj z(F@o59YYAkt$j`--zR(Z&ABv+dDgg!M*bPmQi!Q&Co>R%;UFkfpH$2+C0XCq8}k4l z^PD3?^PB--LXAk41QG@SjKM_Up#(^_gQku7y64#dPOGPX zF99X1GA3Egx=>S+y{>-m3}F!3>kFo$qqc6!>zKJO4+kXcY<;9M%Km2M5$1(AkAaaPqF?qfKWBfj!sl`4|1SIT_PnCwsg>DZ z?^Y5PMU?;$IfyQ2fHM*ic<2P2KMie!K?s*zOhx-#-<}s8caYyZB`>|QV1780=RGR6x0|84~fCri!t@ZiDI}gAXCmAXVrUI7F)ye>$tHF&93gv>0f54573g~CxxeOk7vg&+ER@4M(r4h1OOWrO6Fcl5-fmCTqvSFKm9F6&6DmqjTNR<{O z>th6VJ7?PP`~?Ve8KNnF)n?ughm1|$zqUpu@x^0c2F_|QyI`w zE`Rd*ub64;59zBAiW7KR#Y`K2NK2bwD)K)I2qBjqLx3P8pWI50=Q*f_sRe-~i)e5$ zMEKh=+x1m6g#)*Jtz{9VmBqDymbv{w2*p7b;6Xx;A1mbJcFYArMJG2ww;IBZsn6Dz z+W|^er}mTQfr|ES2Ns-c3xY7j$1Kk{7ZIwN>_$NeN3Ylfp zSf7nVphN`B3+9InP|gn>Advu9A7fxK#R-^$PS@>$Bd}PhrUTK?h;)LmW`;DOSRvF3 z{p$ppX7F^_@pPdzy0QEW3+WJJQAAV|40_TIq-yK{J_YHSUnBEVnC*GM7RXavlPeM4 z+blp3^a3ml2dqR_uE~TP8?Tk?h=6Zx{$&72fa3s*Z0s4bF~XXO04myfBVlRV5y(9| z0(0;ztR6%=4Zxa)=VN=&=lFc=2>J}p$1b4H(0nW#ea_9t^3ms#e9*KyA1iVi0IHk@ ztZRLSwblwT-W`|sd;HUK0b9S<}DyO&M3 zk$a#sKA3{LkX)mZvaXQ z)j0*9XLyh-09J7u2~djsHJVq*>!Sl>E8*xh3#9eR0OZ5%OS|JBs33r3Nj01z4)Wg- zJ;EA$##qA9KQ55gH+lfJApo$*uhby?o`UpWAQW#>!5{<=?HNLV(lQ9ePY95vk-2iJ z)|a8!Z3$E~^%P3cxW=CW6OwHURJ;$8)T!U$nDEYwWc7iHRz4QS2dKy1a*zf9SQJbp zSxGmLeiA}4+VdHNVvtGYZ5l_(9&G?gNO#23P|YP~s7;3Qir!d)G90kfXPAn{GHq<) zvc^%eQZ()bSfClNT%TV!j*`7Y){oWW zdl+t0hPAW{XPMS6qKAFk%didr30_dp8?^5#Tt!n&&<%aJT^(8Pfc)Ax^gO7(eh$f^ zXEbjq*+v2^z=6Xk-Ve?pS>FeT5<#X{+@DSy&C7jtWIbkxe7Y60 zs}a(nBH;EzD_m24)Z!XEOk3+cLHHpYIs!R@6Ad{!Y$IX0?tj2$?;+S4{7gtz8A7si z8X+xdgwp15Gm=#UvVl_yS56 z(x9m;9C%+y*Fky)-^;S)=S*rqzSBXlzdA?@eJ)}B_y&z%wPnofG|yrt3sABV4Uncb ziR8_&y#Y(1Io?A2JParqiRR$?^5&f153sAy96ypR1VTLa(AmGfR#RgM`}fh=zoHh> zn=mcj-5WG}Va%sm;n^1xV7fF2d!TnkwVG!!lZ8<-hh}~Va07MdI*d^=OEp}sIt*ff9NFt3 z!ltyK5C$Rp1(BpDh|~{Mp#3M2EQ*0hrx88ZaI4ZnBM_9l36mefLFti4Fo?!+dA$?b z*NTtjxCxb)*@2_=4Zs8^NJJEPk!)rp5hxM?^G5NZ#7;mIHwb{Zjf72Uks$~Yasq2+ zPc5Wv#bAQw`>t9|jb_d4(0Sgb^Sq@N($AWpn*+)%GpRhZSE$$_PBJ%i05Ee3T-_kV z@Fo<$Cy{IzVVi_#S!V#`?-74O1b&h=kVbZ~iI3%CCZ<8i2L=9GGsU%#M)+bJ3_^Yv z*|60#8#(fWi0;BLN_M6f@|(hUdrT;Byo!V1e}h9m=!R zazZ}#-2#vvhWxCW&eJ+{>Z|EQG`?FvrXL1m{D@YxDrzBJ>_@UC>&SFkUH>WxTi0)E z;5RL6V0A4;0g#GOK#t<0%^FbxqEEMu$|OK4T7%|jYG=Nl1(b!+8c_lefeEPo1~_oL z=1Dw8wPTPG*qt!lM!xAcLC*qvVF{r&Bs+Nu$`OPd6XBWl8zn>gjOvA1jZwiM-8x#p z^$#9bp=XXUJ{I7db90XnFuHY`3n1CT#ehXV`kgoAd)*D_(*v-X7)ZP94-#CAKsoQ* z4Mp;(xs*&|1j>CgyKv< z&5kHMOXYo=CFyzH)Re$_*_+sE~I26NUprp z6HBO9^J-LUcs~ogTG5KWQuSHIbW*5!(eqSNs8g@uph9FzHc;x^vyG2%c45!Q85?F0 zqOm{8W_(4oS~30*(#|0^@)^s~dt2scPb>lL8Al2}c^e7ojVM=pzcwDha0Hl~qDeW5 zbINdBj&d=+2kZw}A@{asK9dmTFw#cCkqN~~mY7SjL=#LE`i??hD-?J?32lVZ6jWz= zk?edHBA&V#>F@yYlIKGNC6oGV^AW_;TmB&7E`;I~Q<7Esk?a&!=szPLTS(ZuqPX&; z9@53AR_D(gtef{P-UZSF{U9A$2c^Zk$n+Qyh$uk$u{X)CGa%(CC--T9K}8-UTgywvS^%LK&F|jqzwE!`zjArMK$(MbKn+x%BWUlHB7dOUyJ;YB2Kj|X0%Mv8!nN2C zq=6ukwfHKWcZIeGsjRy9H%l%1H)zjMTEUt9yW|#q|j4I z2HsDUra&6HluQSDK#KO#)ZeBe6%9;*G~5Nr)|S!4S7$;+lWjHQ*3IWaG@+s?6Jfs@ z?j$SPO|l|=kcQ^D0bo^4h!|A!{0X7BB~8}MEkZ>n8woIrThL*{BoHe4DTHDkZa)F; zOdO;ZsbiCd)?`E7^;&#m2o;@a@GZV&xQc!Rp&0Q(;E!!HJj9nO2*s`Up!B|l^BPyt znIa$!^#uu9x@`D-Yp1=6ru0CXn-M7QZv@I6d_V%g>pig5;y`Z`5Rrm`AP@{JoUURK zJ{Sl>FuMAIgu}HCa?F&Hg&ud12l@#%c)cwpGXlVBjW0;(pq`VWo-@+#+ZyMUA4ss| z{f`yn$m^aRllX_dD(0-~WS?ACC|-=L$JGvjMtY zhfw^;7bIX7lnnVc6o-AQ9pvDsgIwhc62f$Rdn$xt#H)0^XPd4FF#{3*c9(qG>h=~f z4!&y(JOC@fLC_UnwePHUko#T+@+fO{%s=WNFZLDi#@bRcl#e30tn@>CbznTcaI_5o zRt@~!S=_aTAecHr#8eY{%sgL6hY~<)O@P#=I7mC(dJh}z9(UDyM41Radb%L@Jhhye zZ{>W8m-96oc=iWW9*V7GN0ObO;%G}pU=A=!_SOhQEHlltmjEhn^#*c}<&FMv%WU>1 zrnLj98*y>zHVg!g8lSo6i`owwfK(J$iwM97_HD=aUq<>uTA~l6FFF8=L&hNDIuLYpt%{>V z0pR1s6enPjfdfyZ|MnOq6RS8HAUaK6*gIxR?mA^lO2cswR7f~7sE$W9Y_dL(-*XUb zCIxqly8=}7fow?}FaUBVU{|WdLD1mV^tY#E`T$sYv>Fd{)bb^?mEIwFRq}Rb#q|He z(Q6?TKUv$s;;jXUaK;5%N;xgQHfntRczkV`WZW(e;p|D+#3eg$bP8@4ht})@D%vw! z66Z}=mL_8$$f6Za&Js%Y5<;;_YZ^LGvd0jLYxo+`iZSJ7V$JOM%+U+gw()Ovf$Sk0 z2WfRaIxu@;^6MS7^h;Xl>IGlHNBz4`5_FX%aK;yqp29tIf=g!G?f6-TdmfHb*5w$ z5Q-03f(Rb~f*c@pOLigI&79U=kgcrRK<-gCY|IBDq$4(^nFI(*ZOx0WlnmwEZ}mZi z5`dsnt=>C#5&AygKVQ6cVmJxKKti&!zqhwOkQYKI4$=c@$rDMoqEu~bH88b7ZBPE6 z1snVGvo_br_$=fjnK(#QpV_)f41hcgawq_jKyAN=O-*q@xq>Y-vx%dV@p_Mqt#NkM z^7e!dZ;^bxe6=xX9ly6d!TBy!JJjQ5aNg0YIh(_TY z-Bm(>xB-x(0SDDM+Av;C9IXWP9ur&P7}bN4p&a6n1BeJy-${z#P#kkufaEZ;HBCJ! z*n=$_43B0AieQ>XT1`Vy{U$ALk**OEysN`{~*H42(XFh z(-g4#HTYQoHq?k@H@bp!9!FCxj%N^DQ<6P}J}pR=`4=4j?JW8?_4Y#S9vOCU@|xJ0>=tR9-Lf~nL}GCg!DNJq3+>e8;ehat&28xl5CVI z$(D2KJuFBz%7SD+bLu@@$@EYp6C*M`)JWK?9IEZV3Gw4fi+cuDgoy76YWf(${Xm?l zBM64=2-wL&z7??p2SGbYkWe7xMGquK;DPUl_HvNWUVfPr?6*K|zoUFWf>pDBw$l3N zj)=d)?<$Zj{no_Mp&XP}0gy&bB-y-A9DnCQqJn(=gW^1Y-a%M09ZQ9J|6r-Q_5mQx ziuVzg%+gXJ=9Yir=pqQk6km_nFu!vgtwcO=Az2jf5G_T7B_sF(!7fKZj?Uzul)_0? zw1Z@+ek2=1fK;U8!d#&*!RPT!P)fO@d_n_5%y^;ojoS5{aFB-Jh5;(C!A?ah8=y3b z_cPXvw2>3;gNP5=Q%ga*6i~7U{5hC46N%)>!8GJQHmUbe@-+d@?;XlPw;R09Ty3Q@ z!oAHJLd4WL02ayZI^riTW|SC6vjJ2d+Q%6HD^M)aNgfQ(J895;N+z|8(Ct0wY zWF;bynuZH~nE9Us-jgbr%J*Y%p{}aNKpJ{3BCHuy!y&$)aZUY$Xs$LmWRGONRV^cg z7t%}Q+X{GJsjZi)3E-Nng3?tSOnV5S*a`z_VeUfT5v}XX`(RLkV3wjhzMpVb(t}g? zi2z8QR1Z^8Erw`B@l9ezvWFWvaWNmiFrKfQBqZw&RN{9!V}%649FdT$2&lxmHGFle z8s1()vW-0ei;0BVy`x%p`Llciq-A^av4OV{-yJ}nBH`oR17t6sy}#{&Z6HB{wOXJ5 z`h@h^ffd=hLV|C6RyV97lAq>0&<%>7TA9NCh| z`6T4X==s(sj+QjRRHVaEnp)Wa#dVCg0iiAxY@mh!u1KdTT+q=??n3P^$Xl3`$wDcT z^{_?`<=Jj15AZ|rLm#*awqvh`X~#T)98K0kX)$4`?llN^Ws$6pK#uSG2>l#8{%okH zwTjNHg;FgX;f&%2is`kGzk?A*P)-}SZXe7JsyaEG+NuKodpK0DL?~s;x3%c`NUD3&hk?b_ScGX8gUy&^< zJphY*E%X4q&EEbf=#kGSj&4%x$dFGQ-JpK<($S*%1E?6@9NKZXTHs&Ko=R+uNB5+1YI5J!VM@Qi#ONoHA({7SIii6bs0HjUAKpNsV z%BQo81ijPT^W*zf5W0OreqXJVS*E%^$g0@~8315qi-ELD98A4#D)^HQO@c3}F*s!Z z976GRBSHSQO&p!6f@zN+6nBc%_0_=r0Lj808gJ2h- zZ9%GXoL~e%o)@6;0KjIp z0jZg;WIE6X(gI%Z?3uNV91Yrl)B>cR-Xy!Sk)tU?kg9Yg(=*!uDX*U%B)g=MqcaVF zpvPV$yRea?N#wKneutx4t`3a1ilZrgAT2ZqP@r*T0LczSa?%4*^!_!=(V@nGKfiy$ zax`g##x0rlA2qp>xH(s{1XSLV!2&;>kiQrQ*vrT!Ed*UE9wo$bG?$M9IFJ?^X>?WF zx0MjQ?MV6GB=dV%F`9Mg9l(IJ&{TL=;4Snh9LX;GAjHVlI-uN2 zrXxK-ey{M~@Z+E~OO2nzs-YWyU&fMTSF#-K)I-R@ z5zq1<6t|R*Ju{W#Xo`he`4AX0k>lvhwm@2dWbR6)hZzGYl0AZnY`vm^qm^|qwQ$dH z1%fZwv6e1SC!DQlXfEXagYZsL3#A3ShAA|*tHC?821+fiO$hT^vs^9#$-$pml%?F5|9T4?WFA3^@yLWluJ8#tQ$3R5vl?LLJ%_$Ajs zxA`a+w;)+c1>KNtqWq^=hqt_ZRnRSzzZ34*jL(eM91WVF+Y|`Ja4Sd;=6&F09Un-j zV?Jn(`N$Wt>YNk##D+nTR<08KR3-+b5=)XTspn{KjsC0x>EG4!RY=co3+K`}$v$-< zS%>m*ihKi*mN}7R*T2`+R2m=k;Jx6_Mtsovvtb{&=JQFv4_eOK#KOj z+L0`Yd=g>BxHoWgCIG339~$^8kggdExkMGB#hYX!-g7kaMbI0tw;&W}E+u)pkcfa3 zw-oN_YH%f0f=+92L;I{j`*W?w?U^!^2Q=yCkyg!TOrgk6G(t7q0-Ui3w?^1Z_igp> z%yfB0Hoz9V@g)?595prk|Q{(~I ziW0&0=D*k0Uvu7TZEq&h=l+77hP~I;ZqwguZFTB` zs5x8UUn|Vf<~d>p<>Kf)-*c%EU?cri_9xjW50YKbB*a7w?7|lKiktDJs-SdJM-2@& z%y4AOl^R@a)%s@3JViBfr52AcOX0mP9>^9n`^~Tv_{`JcL9&FQmL3!nwLB8eHBsFy zDTC5bV}VD}9R)noQ9b@uyRSxmE$IKE^WIXRrN#TtTD+qB3;POuuy5uASt{5u@^c6V z+P?#m&nI2p3w}x$HuX_guIjscDChm4OQZVk9?F@U$L*VWOCkMuue*;euOqtqkR`f$ zV%^-=YoVX-{(E_YVkngu3o%OIu`Lsd_AmMtuQv@GO%>|mWy7@QJyoECSAT&I!k$*m zdxk1?akp*eV+;FxtIqe#{A2)Tbk7Ak`$vR`eP1CRbwk8w$RTv=o9%U_oGd0L35+eS0$f!=} zL<#w=CN~dv5x&ph`+IhbNh5!5Bh~a8h1%Cn%{TSkl_sdZyJF45M7kL6PO>fTt~6+1 z3-JlXiWSICkRLJ_sGWtH3~f}%2c2)%!OoeK*=x@6;0L%;}Nxd@768TqUD@=V-<~JG8&(& zo`Z1PWGeKfZxBL{7U3Gb-AAF}2g*MYo@Aw#mQAMLd0(M@k7`gvFUpa1`6?-g(nGF7 zzWUY`q;KHw!dUY#n&nfbl^@?L+JShWeXneQZi`#>xi!64P0y^3z?pCZq3`;!Sjcaa z4MD0VR@%N3Vyyg~5LZ#|8s(zNU#uC#uT#b<^>4PU8Amn0G`$Z&x5PSko`l{z_&(4%kkDSfWT5&Uij~l>BfNz35kA-EakXWx z7k?YKHNALLKiC2)?~YD?M(e9u;;6CVkLuoc={LN@8R2)Ocyqo|Phia5V)Y%vciOvU zKJWPZH)&=AL4p|Y=RN{`OK`b!s+PV11HbKO=L{6?Cm6re^svRveMt>nD2I`Ff`l;j z{U;mgov+XnjFO7i#$PEncUQ&WQ9i`fSAr`LVUy_V8xg)A#~yj%U-- zS2V)rdv2P)1<@LYl7%{V;ac-tn3Gwr1E<~h;Uw2VDXP^y042*%-x1Tj=g9kf7P?(f z%PRzcikY@#LyLP84*cEPpgNRms{eLg6@fF=1i^r6j($gonPOC9I%sGX^ivd4||i)gmjnpStANl)Q# z0VHFBTnBjyXZ6+ML-zk&-iqe;@r3*x9Vwt>)u_&MCDRcs{@fD-(kLU6%`_s}$<_SX zpIekE$!408?2pyj_*SCs|Jjv~Q!FEdzTbr+wI68{CrKZ zHa}lkEadYNAs4qmW21|OK6g$LMzkl-lcuM|=PI_^^^H*4#Q%2Pk?#$fRr7s7Hy$57 z;1=E7?-DoT#P?@dZNIBEPACTQ_z=KN+t0IY#))5F2c?@#zmHRLEtG2T`CO%y(K!gk zFO5j{ZwSQ)jYu{heK#f9cj&t*$yPxqMmlg@@N*Us-_&E8b5Wp<8Cdff%b@{~4z&Po zNCz&vkgR?AI7OgH(1X4jJuuhmK}?aL2V9Z125TtN)?jr-+Vha=BB9RDIV{Y*9_7bS2X%Bj8qOp&N(P@0&C|0nHhjFrL|{sda61&I_y= zk`QvCHqGyZ^SqYutm}nbsL=FVI#Dj9sn3^GL0S+tqp)%j@Bl7JBH?jZAOu4Ri#o3nuul z|LT4O(ybZ-W2!wM(m7X31>O4V3q8HqLP1A?`kn;Rv6qE{js_KJebR&?!6#)BAXT^n zX{mF^*@iJ30Qvj18oSngw{`%e0S=_e$iL#it=#}VUhL-M#SKF4vzLz-yZQJ(;M@C& zIRgOydmZB<;cmvZLXN%xq1X;kc^aP8x9XF&K4a(a2lfZ7vkOSARmYWVOvw8J)I5+7 z;M;o)E$m9@joPZu$mME285L=JE(S$Hj}u@Z4Sj!8DCA`SKjz*&yshHe8(y=we2tUX zvTWH-h$ZK)I2Rl_!Q8y9giC=IDsRAOdJEEpP?nrQOxBYqBEaP znnpkMQ96>?)Hd$1`DUIM^PDI9DFLk=;AkhMp#e!Tp;9q#K9P-R#BjF;5VtW&^+xSZpXeqhY0I1#0{JZUn*$A_ab`}GR!NaxFE#bSc zT~eY}pF>Dnf7%*?RB zt%QXxZ}t5i(f5+!bfg;RV$;U)UMIw`9m!CGYz$?$@j)Ze@1@l31$F4Yk#yt(O5I_Z zk4MXiG>bdw7CJCKUvQgZ21=BExsvO^%=a=v{hyx;+UB{S{en_=hphDf2*-`m*bjsb zjXLBJaYmih!}z&t*oJS&_$I!aJxfM=Fwq1rqfYQp3B;`VD#!UM2Y(x=!3Si;L|d%r zL^?8nd#rUf?c`(6^-x#FCdxf`wd=B6uTQ*}EyK?ytTHv3G6To*&wi)Y(|eSc!Ffaa z<`z$#H}zfWf6WK+@6QEoi#+>ipGiZwUN1*|YtuK!v9Evlh-0POO5o)^HoGLS`J3a+ z=38yqhJyaLsUP1xBKQ&Mx8`iV=m(?kEnW`a$97hsj*_CW<=D2w%i;4CBk9P%2#sAQ zc%@_{9T}q3eZz@#WMeUCxK8v3%3H)E4odBc6PV0bDO)9$|=6*eaK;Y!AY zEF1bq>4+lEo0CG1Mtvn;&U~$vx;@p3dG|+5?)p>-{FbhC-%1wq}<%llk#O4^9d)p{Q7e;E9YNLX7!RkCbMVGFDJ8S(Jv*lSdJHx+4Jh>lU$Dh zH$*#Ta^J?fxr#Y^EFB5gfPEidYm57ll*()!!*^ZSZ`F}`e`YRi zNcZ}cxwLs^WXn8K&f5=6%cFlf_}6Frl3b5CGMbJk6@R}Eo@v=K0pTNm#Fce%}1Yx8r9`b#-&_P7V8NU~AQ*~J5QD<1W6K9`HM+W5l@t8ejJbESDoUJZAW-8%j z96gG82Z30YUaqS-?#|L1Cj6}MokTjaklEgLosO4*N!mIl_8PV~$h=OZp|4!n(|J4_ zPSXsXeKWFj4%@~-N%1l$Z+o4JDd+5yvzWZ~oTC2Kpa!4zLHyup=<7X2TmK+r-S0n2 zM^5D7hdH*47}vE@lvS18MzPs)xd7~y{tI@$0cp_i8P_{BN`vDFTU)fPi+C8)t^0Im~q5sT+D(FPYb z&Q=jWcpdK11X?-vzurh4DiC*O(~&d#c#1}Ml~2XYdQ!CYJ#1%&y&bplDZZyj~i#NoI5qm%z_)J@JGLK4p@&;=DZYcjl#6_}n-S zuWm{`I4|#u_E?WiAg)TLS6i%SjO-pccUBEMog8`G1__ORFaJIeFTJSOT)7O6q3_vjRx6AX{Y z1z@dPmLG1Rl^;&-UrCrv#d1+~mcf4S3YT`N$OZ5KK&vA2*n>sD^FMW$!EUd9t`=BI z^sN#YO_WAGMG#%LOfe7d1FbVaw6CuudU%rhld}{vybSd(augg83i}juTe%u!<1o;q zUF{|M79W`JpuD{hw8UI64<80CDHDz504Pz1u3kxWNKt>HQ87E0DJI%R-KS_M98lT- zpd}oDHXM7e$h&ZOVQ$`34}s8&)6)^Fepi|@+wR+xMiOb-`deGPl>M%U;pu8HyXJ^* zY!;aAayWi+Zxb6^T>mUSYKA%_pF#8i0dM- z-cJxcyb4S;b5~BaAuVqo*i!BOfT!(~(ywbuUiQ&|HwVH-dche`xl6 z(!y0Ck6S!1{Lns>k0)f=HzqrLC>zJ+BEyu6`C3@c*TT+H=n9uY=raz80;oewH@%W* zIA^Q3rz45aD)B}KoH-yt=%tmmzC8n4M@@D;kFCs&Vf&6B^jhRYD<{YD+?*VV8VJpw zo{peRQ!PR3Jr5EcW#b+RKD@R;*@W$F@l|#u?oxx-I+aZzLukvg%B}$dp`C9**C2rq z+U2tVT$>&wdLvYC@J!Osqj@xvS`ouG3|*=NLO;m+eXv#yqF%9cE6?p|Z*x%4kSy8R z;Jvl+%EKZzT@$Fm0RSDxU6CMmcV3-+?(Deyd}Zz$h*Rpuet0KnXk)h;ME-o2Qny=z zR+O__Z&!Bgk>F@QK!|{}eUC&k{IL}v)F&Yi5XK*9Lp@WGj{KO%h%niO{C#a6J;}N( zJ@>Ahx+WX_pyQhTBY?hxQa3G!E^je}PDtRlkB7&>=U}*G=fi;nXx4eY3~I2aNYZi7 zdNIw%kjM~HC8Z5+IK!z*(5Bw5v_Ty>0UBD=+o28HTR%x7@BwW-E05mJSy_5JExvN` z7+cAq4h@SjOr|MsnqZcKZ&+ZQtA#+8tRp#?K>qndNPv-qc)4Xo|}zF!F}im&%rZf#}Ax144NgYN2|dc zl_le_Of;4oXCcpxgSyA?0nqO2N=G~n@DHz63>sp z8E?ro#yn7iI1j_CA#P66j6Hn+o#{ws4KB>fi$fr^wjv$r{g-qk(a7!L$iJi`!!r29 z`RUMyl)6W&xn0V2=c)Gsxys?VwO^c+Wuv=co-NP5hwlfyr)caDrEbL`@-y|2DfyXpeJPutNwxAb6)Pr=CDOjPl;>wU z+JJRl(2w@e;ZimD$wus_V!n4#Zoa0bGH%BlY9KCLgZcTI2=F@*P|rhpnBFFXrgA!} z8XeG;cy(t(Hg4xv{lnALASs9AIq{>-is`MJryZL^^so<1d(0>}6f=338U#?{jf*O~ z9F-lLdI3U>&6Nx{2nnbXV;G#I)Lp3jfGAJSQiIT@2BEUMf$7wZr+ivs zv93yOFm0yz`nfy7U0jC_{%!b~bd}+IZ!*a)HO8G;=S-Z_fn1^Gv?RP-X`{w@8D>=4mI+%w21} zpa$=3;W~a+@8o?!xx5b4V25jG!`ni?!aa6cnnqL>GvzXtQX2U%lZ(8X>FpQeIEy^e zXafYg)gaoP>$qHv@-$Og11?x*w|4rh2 z;Fbk!J^O~4E(Z*|I3V#@&^IY{hd>RU6qpwLeuTy6N^B0hD-|qw(XxF9o;5D zXdM8vP5ug5U0EVrU$OR2)LSgw)wIP7-cz0%D+q$F|INO6|3;q%3iRm_2}0hrp#8mm zjsA^(U3r>*+1Fww-hG9V(Fei+QSVcr-_TC<&SG{(;CoXBqZrg72VmdTp}C;MQSJk~ zJA}s_+GWqS7liD|lNU(CsXTdbIvU_9&@V4Q!@N8i4y6jyu zWy7M+!SpIl!y}@> zoX~^1pxp*UT~c)_CY$?3iivXl$`wo}-;eS<5C*M#I@8Jbqinxz1=q}twb6z2AZ?;|#e7TbBM!!AsuOwcKfacZ zBnY%78ksJ(Uw>kr)_J?KgJH*Ks=+_j5xpXBY>*H8W~#vi*DKgwljVJG7f6+g>8(`E zYXCl+SEo#%eS26217(J?mgnzW=TJ1xv=DOq$^BJM;B( zod4=_*zXm49`1J?62$(z+}4j?VE(!A6Z15OnBQ)Z6Ed^~NXWu^gRfYc&qWS8^Kw$Blp* zyllCw=f>`famdf#dNcXuaP~M-sCXbDB* zFSF5iH_^KPElXcf9(@mraV-LHRTGFosXByvlc#_l-z_O-dkQ|hn?Pt^UK@R1%C>QA zSvH>;>idpGipl$!&ADprzo8Nu38!f5p((n{)Oq;1=x4o{hh26WjuEZ)^G9x=D>CGMeC$0?ik6yK=pUV6!lg-O>gw4wr z^4cL^$+q)t+q}HRWG(7KVDi4#8bymZZUum!la+uvgneIZPDT=^XseaqD{&W>7kuxL zS8 z{nv>4vHaEo^?$ZN{p}8ZXHolX=;{;aTb56uV16tn?`1=#G2XsXsuMtvGsC4>Oy0(?5pn~I@;8<7`mP=hyC4U5c&o{wAZJY3V|3Yhy90dUaAet zE}s|XGhN5^n27g%b!Wpg0N41!x3Zu&S!R2$@?7>_ z>Zkm@uTIj?fY9Cge0IAaun8Pof3x)7ZBDces*TTIpN{mVsGrqq(R~)L_bpNHHbXXa~9qkJrf{mh>;dx7@6X!rV4H1sR+ z?z@z_Wl)1UrS7?)2JfTPJunk`z|+Fyvh^9jk@vkc?|X%2>0`YW>JSV(@)6Ge8H+(z z0b&C)VK;bcwSh&Dru$>1zANdyA}^6;2ftDTF1t;Pd#UByc(ECD zZw)liw0`5HrAXQGozNM!F!f+d6U5hRPxw3o?k6n=QGVrUhKxY0=I$Y<>zO+ zvEF2XdN=0RYxDcq>)mCqHwBuvK3ne#1?v4me!Y%ty}c6m<>&aqf#;_r9>qkx+rwhy z6mv^4n0FMhy?~vm1m^O+gOtN=98<5_tc|*eD<5ZM$H>>0!|q-QVqNw=^bjpMOAUIq zHEZ8%7CEpyYS5y8>C)5WFt%Y+R&Q(8Mnq1bb+grAQg$0qqz+Zqu=7_VOduA@YqNVc zzoX@L(I(nthgn`Qm+{GB(4RY-+j1U{kB$3&G3aOm4|*9t z?Ixu6#z4hV4f`_D%<=QPD2=>8se2dl+8yVyyBlDP@AYW2Ef^zuxE#zaO%NZDAT~dL zyyoyWFBffYDTWNKtBOI#wzmj{M^3|Q&7dC==d5TqZY_hJfZn7fP70e7Ac`~; zAq_Ktosp#-pbrpem2Gt3d@)))YH(?DZma;dv!@yKUsLM7X&v-yr^}03q2L}FyZ5^i zYYW%pyGv|+9Vgo0yexlLH*?z=>$lo^v^l%~+w*CnU9o99KfgtJKQ46bM&YZl^Jk|7 zq2JrvRV9rq%C(^%H<7j->(+{mgeI7Zi{iy1joRl9s$E z+rM8H=-=hdQ{-Ghd33wI-Wz1C;}h9>e_Wv6w)}eQ3fFs`y&Vp@7iAs%A7i437F03VL99A^&Wjyh!` zEJ5gm$aRK%@h-nZlFcW6J|fpJj4$%guTGCHxY5$$u zB^_>4b|lsSyW51_>9(!3KY0tp(U$5b5K7#2aev~jlKwgo<0H+wWTJnPhFHJuzJRUY ztG7!`cR@LLs-54H(g?GT-VG2+-lD|44yZbc`V*5^vwX8b9on#6(jTJy9wE9B;ydN~ zqw4`en@d1D&Sb%Cj_=zpG23RB1N0A;^B5(5hau00<1AwS0{;nY_fo|~8%~xW)IEn| zCQ-JC*w$!L>>bWYem?7wAjYx9yxjLoKzl>PN+soLAIh2z93$X)i}5>-!N4R9Z7c@u z2-10r67MA7$MI4m2#I%%+b3xxOu&ycfdjO}r5rPOHKi;E^}4Ox_dM(XJv_8$G*@l)A~=YM_#JvPkbHB5gB5*&L5nlk#7{UyVG{yz8)@D zOeljW+KV`smf!Bto#_ZczWX}Fljne$m^Qv@ft}}96luvXWqJN`ALzu9jpM>Kmh^#s zCV&fhs?({&U;PeWKfj;k_Y>`NDkk;;Zk^*q`ehlSdmFMj^uhwC`$-8xSZ*~tA8TZN zr1qsG!b1P5GAEbyxj#| zNq`WkQ{pIxss^x5ex8GSq#M-W5pIv{X78t#X%F)EW0`03mTNnj2z{}xL8s#!zwr|6CBz|Y=Bo(p5V#OpfL`?~z?EtQ%EE@;wh^|gj ze?p#Z{FzdBU>j)o9LIW62E8{;TTM1Lvy8W8(8FokI!dYgp-CD|%Js%?>i8Hk{wk_m zHGGa@B5xDH=kNV69m(hUcYc_TB)_i2+W|Is-=iUI5$ItSb1rMiZEM;NM=tJ%(!hZ) zpM&E#XC=E+Z=2kflK=%W@-bN2`9!lL?7J;7Fwx&%TD_IrDVB`wLa{YnF zd2f@Z_(-jNZuBa-e{8*@-`r5te`+OgAIs(3$8th~ShJnKZYa`{#aaIPm&H@}_O}=F z`xG+k@A5nx+;j+Sm3W-Mt!aL@S9M++-6h#J&K186R;a&rFNJ3m?gY+sQDHpKFA zZT?|8l90z&CGJm0zW05RkL48dK(+DmPLAn&Xc)AS%S-xkOzD==etIdGo@Sya_Yn3^6&?8$Q2z47Ly+DW%Q3|{NR1W($ZfevH8q2l19cO5+a@eh}TdoZ*0KF01M>`!5I{ryv;C(b;g@=gK?%y6;zqa4pa6$j6 zm5NEXNm{<&l*R3^b8ljJf02%y^L;+vxVFEyi07a|`dJ^JFVgyEvOe};ANMVqx?dn~ z;oLUkJaSB=&pL;}wh!~%IxH`B`UgCp49@cf+-C88n0JPOduI|j9`dA23=i-#_)%Fh zwn`AYaS$o=Tu_+d99iYUw{fggRVPQiXDd#I7;6E&KoHJi8 zsKJ$>27mv9bfj0}cI^k>OGn;i@{Aa397_LjSvFA5p5ha!WIhp=n`XzmL}&M8*zT}E zS~`gu{H{b?g=4H_<0RANd7h(j*}-D0Oqm$_9B6OLMn{PnTt?CnaPYeZekNJ-s+jwV zh&~|mSR=ICTZ=ia+#`cO3S8DFgbk@m5XG@NBG(({T%ONhSg!UZWjC`W?3mYLC+z>t z-4~cePT2qG+O_7kcZsVSYF;?ZV`zqwLgv}+2fN=TKR#tdmQaV<$IRyr1)kp`>V(=P)7cEGQ}0_*h=_qeKs%qW;8O#l(G3 z0{06??KvZ0&a0)8)`J zcJopV`N?jZ^-79)mCyvW;j`3GN{dz8@+xwLOrI z96{Q4DQ&~+i54w~_?vQ#0k<|fdv`$_(){EXNxuwguuoEhbUB#oWuhmR0NOGi4wvj~ z2$w;0rvzPVOO;K%B@p8N-#X)8idf8(&r<@eeY=#l#1h3+OCgq&y}qZt?A{EgoAll| zCXq`I06us5@I5By9NcGk@j}o$R!$w08yA9(v>hUZ`S~^i#Hvxo*S2Xl1H@{}q32+2 zoA#DmYrHADd^`uM+lTewI0gpVwDEce-60eXr6dVaHij`nEJY_01kVY%sXoNz3Z zQe{*37!6^4|0myWVr%<%8Jq;^g$$;8$yJUVKm52I3*I~RuHMG03Shy@8UCn8Z)wx^ zmT)Zibu$Um_aeuMj`FpumFVFH#r(>-xmfT(DL>D=dS+oP`2SGqemyT{&R?26KN=OW zmF{xr;rDfdFCk0DC9OoqHIi&;(lt!Lgz;p-32Z3ur>vX8W zL`$3Y{(`LE!P>9Xg`m#_aN!y#I~V%{=0KW88NPoPzgKrtImFR6bV%IS8y0y=eoAQs z?W{t1@GY5xy6er%H(PJ~@qNA@c_wL;(Ran!nkp&r_1|98A12WHND0LHN+1?KTQS2W z5WQdccek|?T}@H{HzZ*Bm)Klg23@5DLdwPAv#tfGRPXj|2WULF9_41SVut5{sRuwq z-D{9i{;UbiQH3l!61JzK!<=?(i>-fjNO2PWzY;bn@MNQ-C7z&wV}S`<^Up0$99 zx@UNmV)mxQvsGXYB#(*FBk?89r#avUuF+-Qj%=TxkCbCiJ`&ZJKAnR6XxM7r>PJz^g$q3*C8!^&hg=e+SX}&d%0f zTA==i3)Bx4idpSY%!$*q@f&*^<3uCpX508+{?sf`*){&WxLXU?)Gw!uJJLHK#vaG%iIqhE zgT%)jZL860o(I^nYZ8QH&Tp(-4t80h*v@RpBD6s`uMz@Lw0%CglIWd2ZkrsJiGlNp zHVuAf@q5|%9pbWypH=Mwh<40V%uawPzK8EvbmX+TBDYP6(#Q&Iv*qKriFIxLlp2KT zS$w6X7a(8mn$Gv%UIMYV=GoTCA0>`U{*)T5oS*A+!!@#NzF2!UK0e)9G}_C5m}j#^ zvHnG})^UXzOq9WKT!&-x3Y`DX&$UJKZK5&ZOC}YH*&#!;-lUP*+mszOpbnw^xksu! zDoxUm%KUvbzOUaYG5zCO(>fQbXP;3iv6_ZWVC$d%)iyn*XmM}ioA+727Wfh`PW9_lg9QK<|MUDYdnL+Bt?_k zc)T`U3Fh3nEGD1jR&J_LgIL~s*7@3N6+}<0R7}+gCMky=?{f>;SwOr}%b}Hujeqj7L zPz2Gh^z*ZKD%BiK7C~q@bJt0=@sarLU)UK7$AEtS{|YPtvpe{+`&hYJL#mdz1L-o{}}XvBJhW6`B}vF zZT#%Mxrpx@_`8S2$3ojY0GCHs+7uaD(T?6sxL=^NTrm$4rfuA@0jdjf7xSsF>(AL?Y#FGGiwV3af>I4mS z&QaoxKsIxGjX= zhwId!w<6aDlIpp>HLGGO&gO);@6%d?-X5jR>ws1q?@hIe`Cytx-dx0Oovo`Bb1$=P z8jMTsko0jGd~Q&KRI1zX9SQAdw-0~2_zp=Y4u#!2iv1pRSm%fJ>|F4qh;^{$r3k>) zS^ zkC(x5b}!^P=WC;~%=L|nxV~Y^4z>mYEou;o)gelY`mHnMkEZecDldDn!|V4hqJ=E?PhVb(_v6!o+7 zZ@I>}=qI2jPIR=vDaz&me`jY}y-w|Z)U{4@w0R~d!=-#-jOQ4|-`N@66%Or-V>IG1 zX$GHn!x&|G_A_OmO6$h=#;Lzr+->?RO5KI>f2KG8cFMj!A{QCioFT2-M`Xc&{2z5tBu){ zH1ZMS<9fD+XPl%Fh2l8WF+by>Q5qSTq<#wnV&$i2IBuTP#-F{%rrLO5j5196UqxId z!%gnyxXC}v;ke1(nXn%`Ztcc7`M61LcYp*jtqF9m)8^Z{yGVm)Kzp_+SKkSjsKHOp z&9yta3AA=Mfj(H^{hu~*f1%|oL|uhI_P$~ZH`6IW$fD5`^a2`|%*r$h>SnK3Sk2hnn)@+otd<5i!|>VJ*J6FpEQKC#=aphMt=C3d1?uQ^Mqiy8T$s0(kghnVYv}O|&W&SCUJ*LX z(=zBFLF+pO>g=djgU+U0tRdFUkmGb+yVNPD~N98^Zv5~*tt5|^e^Yt z-O+$@x6U}_<@Q6$k%QsvVfe|lgyAReX#)LCO5N=J3Q5EDsvWbio3+N%$B3?$bNk}y zymq>0@ph7;9UONnU-3hZDY#AE?jnh`yP*m6{}y=!*!?DDus@(TX*V9T<2GxJ2(~{1 z%-$J_x#Nq_kNs`kD(Ss5fW@5OXQ$~VN%K4l8m`%2c&E%_1-FLeZFkHcNVDE zonP;1aEKS$>n(L?q&Zvf*9+83^6RzX5Ko6Gv}5rUF@_9Ju&?ap^k&HQDcE$CDHx^I zgkzLuC?<%zG}=H7V%<#Fuip82rY|{__{e%mYY_hVV-5(pKy{*x+JNsjDCXWzvpgw1 zD5tiR5q(PonEyo}+BriF9$tg%v4NeJ-1Jwy%k<9g5NH>*2x^c#;GLZOLNq#o4ZK}y~6VxIT%=al1N!YrR*1H+*8 zc1vu18Y?$Tp&(499tSN1U@K%3wdFmT5n0 zB>Kd9SyPLZ$46y{rj)?rXum7fV1AE4^d06CpOt-Q-g0eMBhj&ZZ!s_1>jZQ35r@`U zzNR0`D`m(tOSDsRgYkqYi_fuqY!_(kovn@IC7!AE;P}_e;J>L@F&jiY-7U{>e2gM< z4CG;X7UM6}x!yioF^dzRIau6rol)e3o<~=#VHhKmogKN15xL%X@iXbj&9z{zq}2Vd zPo*QT?%;KX0iw9yyhW)S+Z*9|@>za`^kyZa*XG;IbYGdke8l@DC-elw`2g}R>Kto8 zF%Pc>hN~Jr09v9%>Q?|BS4!3Mu2})`os%?@SPAij1g$4z@YUMq_ZJR^E3)RdUHsNp zp#}pXS;P5#*#kO=80X>DdHL-CLSHpgk;FF8UYq1Ou1~zmb8a$!81s4mcR`!q!mQl% zWIFO6JF=LS_Zzw0lcBMqNK2MxX+-*ywp{f{<4-(%|J<_U?_*Z3xIc?o`DqSjdjPSM3#)-#nO?B zcce46aJ9HM>B1f9$Z=Z?z$Si%F z(QT4qwu5~1;xrAd2l7IPgXQ-(1Hkh_K0+W=CS`NKOapLrOJJ@9HTVWQ>t#4XmZS0- z2e9)JD~C)#r}RpMQMZO)Oa$chf=C;1eeN zzrx*IF`mlcZeBK18QjgADagUyd^QdLTezE^-;^@kP0yoOTxdR;{9nP{^!$^!o1W9* zZf+b;G2G1~DVT!0k#Wof?&c0NH3fH5k%oU5cM~4|-@)Bnmi+j*n{$&N3wP6#kGqMK z!~Tzhy9uS>w78p}%>li0DVHZGLjsNp4LsAd*XD3LI&8z;Y-r5jZh8vgZo(B1DjrX9 z+)a5w+|6#Ur&3Ffr82miH{}{5S`P8y^+YR#yXh9Vn>#0f;cgNHqEUcW3um)A#p0`d zM@lZ}&)`lx&Dx`h#hM+HvVWN9J0lNSh^FnH{nO%$u8u9yta2UK>uL=oILx z4E{fsGhLCzuUy|u^zkw{jye*VJB?#+s??!JIJVI+MZ6`_`Yff9BWDOb#!->M-@x2y z+Kf55_#2$d-Z`Krb}4P_P9K1l#4c!?3*cI?l4Ehgd03py0*m7{fnjk}e&%NUfYQkO z0xQn(HVwx3n|vPvN~4UP-P1C78%2WFxn&UZmT|m|QkKQr{21pT&G9xI+f$!|?K!n1 zi`8Ire8tDZ;w1lnj>QQF6mwugJPQE3^UXU(W1U+s>K`N!9XQFcIsr-}8|-uZ6VL|d z@;Sc$j4W2?E=t{=Q5rpw#nAM891P8O@-Q@aA0k=3tN@1Q$&;tY&>Xg5Xg-zv+ZdYv zTtf6$3t(uzn)rAang#YTaS*NhY@u&@rfHX-F;(A8p7D=iXlB^!zkz6j=Va?&U7-Ho z7O4O4VQ5BY+uArnH1B!YHs%y)V|SrG6u{6Nvez4yw9fOh^_CW>_u(`CcQ7>PEg||B zCwPwC|C)f0fuWg-XGv6vShJ6TXZcGWo@Ip6;~6~5t{QFP5I?^^&%(3ps?kOdW$`R8 zzCm=Wy+U}F@zH-C&obd7`YbU9h43uRCj8TQmUAhMJmmZT7SGa1Y2-HFKY?etEEmr* zQU?2RPevYj-;u?$v~Zr?&vVJKI_CJPanKe6OpYr-$vexk_wkG!D znpiV?>Y8|E_CJPaxohHY<5`})jpJEunO# zZy0vy(`xWa2VuCDPtVEKcZNUBW$mR7>)a*J-Yiv2l+zDP&s z@1V6p$*~JwksyXT(w!4Da+9Q(I0kBqVkUZdEEVds-=3rqD#1}jf{ZR)wPVHbHJJ0hY4dEGJeq#pD2~a2(jk-!P$81La*s^SI9sv2N6Fn2u7iv%y-Y`T2sp{_Opig9KVppXyu%act{TlN|5U>Ev<2 zoehdP?B3bn1#n&iWJ3ZVv}F~<3-#p}9-@y6KQHoF(`^!tn~zF08@@V8L*czj8%VH< zsiL*h@0@I**Nn1ZdmN;24aQ`2UpnfA9?AN^kyYPT%eQ&feWee5W=R z^&dG$*xWzn{l1?-?DYoFNi&yy2`2xlG`M@FRy->=r;HQ8)$3HuF>%MXM}}DMDt4D< z?1cu<`wG-C+Q4Nt+T?+{O3m^^etQ`*(tlzk3L*N?fIw-c6EDM9k{gIE{2{ zpQ$zZ)L=K(bCqHy)&o1MPkf!nXVYyJ{R!D^q%NP)Psbqs_892wj>YwgDQ%YYQv$>M zBEv@28F1U}JEVDP@Fx<{6JG|i4tYOCqgZ!RuJg?vyZu02325V+gnU`8m`A>>m`B>d zTs98+k#@yYuRHgdEppw4>nCX_v2RUVN|v=cfS$T5U94}z@@#(J_CC1{Y5O|rfcw_8 zS`t}eRVy_O`KAc`79Tw_P9uuFOz%uBI!+_K4)EVEf%#B5#D~wZ?ux87zBx`K z>QU+k2V6dKSk`(kQR1Vrq$Oopdk5voK8Q0J^<1T9oyVz8^}NTOeDCfpRvt$=)hpx_ z*10E5BXb4KIM26_(+FP|E(7QJN{O%>M-~sZA(3NE{@Q0;{M;e(2K1CA{~3_suTO-bK!Fjr5QSpxdW0=bWdia}Qh_+3ueuO4La zv9ZfGNxFIvO#Ge@{s&q-HMbG-O?^{hxK7lid5(7Ov*h=a5W|wsmX4T%$rUl@jxCds zq|irxzG*U&AP{Bx3C_jUPOSmdAj>&`-|uj091G?)&S!gB!-iu#&v+2m=C|rWAFQ^? zv_&orQdQcI>qV|cry3k^sKK)vcz-hcN1hMUQxBn6K1xNBa)S@sTC_>hXRAs-uEoJ3 zmZ$x`#HGOQGhP2tDuTAnYzJt`)%(0+6tF&%G zSD#Z2{+Y?hSGjs%kVzt)J~pAMZz+)vUU?rt*o5;F?*{ZisgpoTEh#~nvD7`0exT^_ygszAAbw{ zX{qM*RBIxyZ}0&AUe4?Hj?7~3NP@qAPe5M);Chl_X=fWBl!2bSMTxUJ@o-MvI~y8- zd_@HaommU|=S!gKUP|2?r}O<~uoQNC7x}c`ok&FjWw0A%U7)#DJLuf`uyxPy@I_$m zJ&}qGU&LZ5TXD=e4xrBXPvoB>p3|k#0Usu12w6TIPZ9Vxmp~Pc@6T|J$gpAi2o0?) zgQzI~^TASHeifyWa4EF@wJvw=yj9t`bJl0?aSBj@sOMG>(0OY06Itk@n2RBuUjDgv^e{j1!|Dq0`aJjZ@(=DT^GL{ z{5yGWhABOsr1W^;iWQo7phaVSD0OLn{nn)Ww00wb*u8b2cUQ9YyBpsLoLi&8pIqA0 zb-DH;_W2X_picvEja0#Yy?iap*K$H8KAzu-VJ;0-Qp{sZi4G!P=v05WxKr{*NvlsC zx*N;Cy_D#Wo~@YeGIU)}Aaq?F=zUdFX}YgY=yR27@O5?{7IY;Dgu=_<(~YyC>m4VA zeoY|uIi%e+_5H2leKM290lW4H4E(FeI}a;y7c@FO&eGLemO&RG5bC=`F_R{ZdO(Ty znv`Kdx=kAU9oh(+<~SSu&=r;-wBQ+nCzrOaz?hEI zF}dh`ic>c&{JyI#=R=o*|68ETHda`CJUmbI2`DzuVZshYLa-DHlu4TAhkNWY{8os>pE8ejDzdw*{Lt;3z|?~88G2OQbl%i+3QKWAg9@)7cQO5h#}Vohg( zNhAn;$KK8#LF=f`w)3QWD(_w(+QR*3M3xNPZ=|!(zAEzVA`p93hSqQ7)yZ&>qRt<> zvwV0Abuw8t4$H*oBWm!Z>|i!5j>-N>mivq8;a^SD5YNd{!|qgOcb*G8O5)X>4Kjf1 z7MJb5mc08N^2dPNoJ@ZChO1zIKNjm*jRm-6Ly~m(^-fbyqDjF$HwCEGz~HQnOtproicoT zYkgkbgSNT@qVB;;euv~zF;2-Uk$ zr^Y$PrO^RrdSwWGyB73hgH7HYnWMpDwc2jcA0qT9TpOFM{vVmc&hL`*MgJeG)qZ4^ zpTWzoc7wi%fa_!x>_1q()*O%&^UxBaC(_i9G%7H@>dG~aIK$X1A$rG}wd`)Bzc{!K zohXAC);;^NS}iHhHioO!AWTz-s;P*tBM|$not_YAoi5brXB*wMxqgQIl)8`IEa?M2 zFhPdcC-UCIcSwyI+?e+s_M^xRdOgmUPch}2B^_y6SEmNaW3?>iZ1*JS|2jtf8yygP zhEn&bD%ihy+FFy1ONCn-m;?NCvs)Wz0*2QO%ZmBhB@qAK5~6$3)Nl3u`=akEKorY7 zyoBh(xQDG-8y^U1R=UW?h2Pci2CF%VN$0=U966mwL9=q^cV z+a-bD|5&ZIYaz!zgeI-KFKdk9g=%oC%>8CJ&)^sw+y^tV?&&-X%|ZyZevpcIMSUHU zpnpWEyHV!vg`2XmEa6(ke1&itwh~T5U@@m*rHzKIi`8JKMMEu^sB3ve*~OEfqt1c- zy@x>Pr+NMD@MXvDk2PZKs?^{LO5L}%K>U9wb>A~I83{{Z_Lf7mbB1De5{PxyDyFv_ zq5&aelCtFc11qPP_}l1#$w+txnBhy5cw;HoTf;uZyy#}`YiIcWVhD|w!S4E>)oQiK zlRoCt@vXU8(uaj#8`~Q=Fv-po1{@qii}nq}A%i+}?t#gOrx>E-XSGarZaq^C9!mqm zq;xhZ<|d@695Pt-_{)=#EfSdjZXbu&K}(*M9f$kGIFRXT@cl{d%f~j67JS}#U@`(} z8pFPYP1^dIyt+D8XY1M`>O$KG*Rr#g(-skQpd9{2CVs2N7(P=C9xR5cXVailsdhu> z7!AE6ViCg*Xl4DHqnK;4U&UZ1MGhGj4>Sq=-J;$z^Jwy(o2BXVf+nw14L*hagWe$z zv>)uFdz_6xj`pW%=wcVAlkE*xyR}6_d=9R3fgVfI*yvnI+bPws`<4@r6lpsp$Y3<_ z`Bs3Cx>eTpNN{vLMg75LNVC-;?Bl<_pNb60-2XW&OIq?U(GvTJwmZ#ZLEe+tSugW> zG=Um?K?WTh{QL)>O>=;beMR~%5d9r><;{VT?e84X-@fU54t`z(I@0)v148)!9$O#e ziR^vGNbj=uQ;`Uz?)Bx0Is6FGkhk%-Fti_3Pf>rkh510bzB)`<4Do+CK!;)4%APx* zYq|uXm-1-~Fxq;MwlSAja}{dv%1P?B#w>7(h90NX{YDk&sY&X-^%96rOj7qq8T7C_ zC?ur~ZQrMP-96TNR-dTVI-AwtbhLAxs1^5fxs2gvHTXG+Wbz#M=e_4$%E$JAD|i1{ zHYs9ceTvzBlcan8LR&4lvumjutV)CaKwe#gOZh!th5ZPx@?3Vd_+<~+&JoL?2kHL9 zev}{lTupMS!LbzR);U{~Qw^TL?3$hk{0>tj7b z0zFa0{A4}2=Xn!O?F|XC_c{naYqtchWSQlQc56o^9`lZEvuDtxQHkXe&ibqeinO!@ z`as%NF5IM@l7Q{E_`Ms{-~_gpqWj3r>OtS)!gqi-@*T1BY|$w)Kv|x z-1Fi+{c43e1mRsQR`c3Q9;>OcSk2j5No8)VW@36S_G0C2$_})xu%E+7$L__Nb@$=o z_fqW4N0pQ~oC__g#P_Hvck7nJe)jGaMU3xey~lkA>^*=M+~+#VMg5n_tc)|KOk>Mm zaqqI~`IDEGDa$D{rv>eHZ<#35T*JyhPMMk(v^$dJaGaGH;Cl7gF?*RaT3+IQHBQgK zVpit;oH7k9zqXf2@G@`al&Np|1*Pu3Qqh)+)APE$jKkgXq`e;Su`&m8>T$Oi_A)DY zncp4bxdV8a+Lk^_-4-w7|DAchf06sZSM6A_dIy}f3fJ^C6%1qU-vPkBUp)hKg?%q& z-(SPuCH!8=zNe@0yxu$DbL{(!>FjO>{|=~Q-)GL?XA3*vVqPEq4&Yx&u2_wH;Q(-b zWg6q**8H;tEMHlky*JJj{sI}Gr%7N|Ext=s@%Sz4E=GI2#E}D_t%q`cS9y^dq^lu* z^EW3WR!mA)HRyxo%%@3}Dt`IwK7%K7?zej5Lum@d|H1^<7ic>bXH{yp*g%i{b0 zDdX$@bU417B;oT1h~<|HKdi*VP`8@Jr&7xBhJzC5BR0Mvy-M6VHzE?Wk`;f)I|YQ<6vHVrA+xy@JCgZ#Di_8$x1mI`i6Knas zs{~qqmDi?sTDHx%ow;|*j8wsHy?m{yN{Tse5z##_15{U5nU#x_-XLsln~GI`Fpx1X?3@+P(`~a(b4w0cY;~TzQ(YSeePm#W9z!EM)hz ze#pkBbgk(DFq0)a8?1350P)jdVS&X2wI5_>Lp7OPLp&b-+Gg#|32-5AN|m;|@KERY zQZvKRS+WO+I`rEKzOFnH#J=FB%za8Cpp6Fs=z}Y@ch^0&77V_)@dxb*RCw6lgc)WHD|ce}pTiZ96}O)71aU zmzo(Cp4|yFTOB$i`pIGnQyjMrH%JV(t`If2ZkMDbJO|l)h(2wWCFTHGtz%#l)oeKyiPsH z2kR$5F9L8iT$qh_m@eWI?DEr!tHv=okhf-BPOdkqe^yKn;dK1Fh(Gd(yij&Nzy3x^ zSN{yALTPkV#M?=r2JwBVi=Fc`y))p<(%Civ`upMx@4b)F{wMxM`JJ}?W`LmeaoN0JW&O^Ht3CmHDgXiv* zw8bOf!vFt10-Pdat+Fi*`yww%+>- z)VnahURxdz(ro*@!uHv3`+Sz|^Mlzt+{neY`}Rewz7?kr&Eo$G@!v20pC$f3DDdPL zi|qPo#KK==_o&2f z`Wl!rfNQG+tu9JqScWJin)HrhdL4=>IUqJDL9F^6FhMENIwvdos~tSPvkJh)uPEl0uc2ImSm&1%vjZUNxeiS1ANK7U zs6N^W5L)*Y#gs(fBnN-q0T4pI&~LEGKTOeO+RkU&mFCTo|w?3P~RM!&+duw-?UCKb%1EMplj1w2a78ln9t)YzBEZA z$4*1vxpw-V0=9O^jMEN{rWDR%Z4Tc?-__s)htQR}#ig}g;V)qk>K9fh=ppCYqt)17H&j5O0MZI=BO(Uph^yj^ccFc#Ax=)mYsRv55 zZ+sCYS=`nU|qjeTrhP z22O0uuNZDp5ZbMv>y}v{uVv!+!Au+{|FuM~``Kc>*_60HT;(h+xXZ?&*QOQYt?OqA zU6R4l{B=o}d|L4S6q?S?6|urE&zA_pl{d`KDP2`ns#V2g(oL#WaRV&=KhQZh469LA zjy3@ySxwigt5j=EhP}_^s8*vai+v_X_@+vBossk7)Oas79xe~Z>jLR|I7{R;NY=Uj zgHmI7idrg+9t)D`aZ1uF&L5}8mu5}2YooI!=c^m9iw*ON)7*!Dmu=tjJ>l{BllKB< z-#SvpmX?l>eg3R*`?fD-J>NE8BGC~+XXkO%+A5>7Nft3I9UsJaEotphHKIznD-!bT z>@{iRq~hec7pmt=q=!-$sZx2Y>JMUe?f^yPU0{5%e!fI1`}6r(++!cajA%N_6Z_Ce zj2eHQIT3d6@^RQP3uHhkG}-&6nOZRL_!6DrPM-zxb4pzdR;H^qIaG`35KURCC1rru zyJNI&vg0C}id0K-!fJA>mQ)O@>1@@K=D=#2t6Gu=R?|Y&lIFu|TB2G^FKt?;T1+Qx zTCQ45A8oowwU{p2beU>Nm%wTYsFtL{YPv$Tm@eA%s2X8*2-8uU?oci1HgU#wJI`gP zTC?X%i8RDs&77tQGJC*dUHqmc&0egQ^e9O-& zl6+Us9;8O}Lt0Lf&KH(0$o2M;(ocW+4C3ZFYk^gY_`sXp9I6d@`#9s;Ok3q zn(s8ljmfckNoT)oUmF&AH@q2I5E)vqslh(Ouxmds-tBGxX&r{e+9vnaBx}LnHh^@G ziZdfALkm9B0HP*-e@+X&&>-$K5`OV7HHi9%WA`3Qm+HT75O*5mKK|$HuQZ4|jj?CZ zCHkuk;JG;dI)zMXQqaX@+1&@y^)rfWwr8o4sD$$8Dc`?3J7=nqCI|9%&qSp2_x_fT z>p`@9M8XHsbty-SNEuSg>Rd#a-7aMyQg$e&}5_K99c;CR=3cmbP0|?_U zn({rT>w$C~IYR%DWi80&)ebHAi@6x9Kb@d&|6CB(z90t{IgqYvGbhrS?H`9&n*?1Y z@ePviuX--lkIv=w_r{-fT%;eH3({?$DOSwYf^W|SQDfA9IQ1SP0duZ^c@G54QAPHB zYYLdV5-{i5Fy~K(`4=fLcTEBF|4adMcM8lun*j4fzT2H9`0kzq={m2;;Zq|}Q2w~h zcdsoGe7AoIBCq}4-|}zY1ksiuvY%1|5<1y;sckg74d>1CY~EaI^X4L(HxEE>XS}&& z8s2n*^XB#x-fX;2s%5t6ZhLP}@ao^Ephqji>#%Bd*MqbT^L1cdHy5OFrpS2|Vt?Cl znG^3Cl4G3muS*&`YaQJt{J|3PQ-W%7S=@7h zzT~}_(I}(#D(>%JX!hR&QgyG|S_Q`WD0qAK*Br=tLnY`wA4O2tQKqr&s{Lc8h%k*nT zs1Z)b`2O?LWqQ>JHM$*1F-*Hw>2)L2@HpVVFIOIu8N1R!v>EXK=Yd45Oo5r>0Ewo- z?{?6!XKNiGY8w1E|9rfiZw5%a0{_gYG}hnhbPy;QzjO91*9X!-!gA6x^*sH*W{5kz zv1eD8>3IP0Nbvv8zK?n!X5SYLQzIeU4rardEbD$XOkK%3Cets*&bid2zt<+6d0k?k zU8(l}Ysc$er}_(bOX#{c2V{RbKilZ(&O}e(t_yYKT&O>lGuckK=yM=hfb-9JI6i3G z1c^KXXB5SZ%BuA@uZSC%ly5o7f46dv8ewglB$U79mB@`bAiFar!|*_k?OQTa)JcEU zE0K+tsn$jbU03Ibd#luMwkN)sCC-%D_`-)<_-bh4o{G!I)j1%2Q}l7G-G`K`1rM-w z|09sn9;voH4WU;ggi4E1>roIYy$iK{LzJKEw*FM?RSBKq-2W7J8V~(q)c7AtU8P}1 zZ5RlZUY%cCF(|&dfA_?1uGuZVNdq;0Zo^)Y(x%vM^WvyPp0eBcQpS!yDcV@S88zCb zI!`DOxnyZJ*VFjC17Ya9bGe?@!*H-@3i|&l=hNwblUL$r?PGP6Qhc`)wBIeEe7#p9 ze@lU(DQ_Hx^c4DkiP1lxTK7rl>Ph*|n?L@Yl|9Y_z1;tLoc;_yj0Zd;wCmZFKK3W| z@xI-MH&+YpPs*W`n%jBgT#>usr^$W&TKK9a`g%QkGA=jgOs?&onn&pEJRGmjo{Z-~ zCCv;gsx_p{FfGMl4lC&HP$Md^j{TmWqwbZ`R7>XPNowS{lE!m^s8i+gPE)P?8ksQrJk0M+v|#y= zkh8K&+*j_;L=V5OeB7@`PQp1=t{8^vL|uoTEqp)mg{7h8tY5Y_?uMvo!TLXIh#HMq zn4nLwZzEe|(&$FyV`01WU}+#?pFj6_mdcUjTy-OLGxmuQUjPCb(B%*x|eoYqlR&QpaCpIAI#ch7Q2wE?di;h+*2(i6+7T{!i zD1cqw<3&1piu7v^fywVqjpsctGD|F;$G)8P*M113O@>uq`#5j$NF)JgYW?E&OoW1m zV}_^xo_#zgZapHbkD91$Go_)6$ESZzB6ruwL`{d) z4Rp<&sRemlwcW7 zTrR05OS`OEqooqjBtieg-J$ToD%LBa;_NKhx6CS)oT-+Fr z#nHsw|KI4Q}W=#fzVF|Vg`dTJW4zJ=1KbL zb%;EFNa(QLamw>~v-!;&_W&(JuT~Zv#T@vKr9t`rzY(C++)LbH$T3?H_cZ?sZp?jCQ^xqsx!jWroUa6{q zn33e?(1U1({>`MlP{gai*PWE>!=|A*mRIw9TQ;SsmdfluMKP^4lFsW~15V;V9$R0J zY>}C4sqrZY310*8?2H04ZINmXC@x>0GMmSfvHd%GuF7j>7H5dq@oNvqj4HPp*#Oj3 z#%ZWBOSJ+GYAbuU$l^9?Is4`w8GFa(JVoBP1p`U>PsZY1e>-0D#>T^0wtc(bj)iCV zNVD@_@i={#h|^zd*Vjq38*rt>EXW9D42Yby{X2QwU{JE>c-Z#k|J*1I4e-2N1?CL? z9=jME-m4eu43;}asqsEd*b0;Fs^^Bp*3#ORU zsww8g_F*MU$X?bqa6>t7`_U+MVNt@)nP3O|7z_zGljm@XQlni)*JYU?P1#BE{P}Vn zH$G#05PG;@yZscKz2KW-2Q^rI7E-Cp=qS)R~an7;CmPn{ss zzhdVv9>eE~lw3qJ5DIV}l6@P}a6uE-xr)rMiM8VEua>xfYGVG@PDyW$AK#Wsc`=JJwHuY7LZ$nAE;fSp50W^te}BtYc1vwRw~peJ<5%0y@3+Ieq&jX(a06^{x5$htHBo zv_!QA#(4dOabG!P>hH(xeCYP?-^a(~PS2R!nez|jPS135r>pNX$9VwYaDpuTKhH_~U(9L26mxnnHnl8$LY%pDu(koRoVWc!oVqaQAIj36>165A zbddexJf(y2WFWR&2U)HcW+cV8=WD^IGE#VQ3R$|Q?=#5KIpeaF^Oh%5zbcv6Jem6W zaq8-~bJMF5IvEelhZcM;6CDh1)$J>EZ*H!hXm7;E>*FNz!N+H&=Y#icKDf;0gXHlR z*kc`5X871xW3gJsPWyqJvFNB#j`6YJ~!Gt;cE&p4;2{ugsvFvXl^{xj>V zV+C)!KSo{fe75yfkh;E#SL*0kp8+wO~*Br?0P?=x118o)lgSXXO=ptUSI!jct9#}6`r37t&c=IUWSaFA zUO5KSR~e1$Ji<~=%AB=KeP!~TwM^Zen6q=5IjgI5Z`i9R+BZ)#=eJIO`kc>6p0jg` zIjgJ2=N$IxY`jg=&ADgg7)&K>&Q5#I&XhT~XX+y(Npo(`)c-m%#rm87+1B4nhd!fB zS-L=Huq+w*$1-K-Kfr53rW`yyjZFEBb87ux%xS?CbFzk~mMPCA%ap5E@wPu5p)Sn- zY%*nZ#@HQ*kSY6C>9~58zQ{4r{&~jn=`!VC4}AuiGJlf&(=*Bbng4&Xe|n~~e|(3M z?4O0x+doPN$aMA(Uk}}x`i05sqdQYC9I@AE@ia2wu8VYU#|3(#{f^kXcU?3t6FM%?*?5)1)5wIJi^gCoVtiF>%Y@<-nGns?&kQHcIhv`zIc&p_ zG0mK#7wKNDTu-!DrbS3y@eP+@)7Es@3muOk?&le6^7e37SlDu07hdFbGH4pi{G@VB_d+3rJf7LV^~ zcc@n5U+kPEfePymw=`w^RROf#MC|~Ny&jW%COa4$;UYxBRnWib7PYx2##blB-DF5D z-s3wC?vw+OY8lH5Ahm>>Rco#UzpQA%{fuVEFVe3#2GZCJtMLG=Hd&6$0Gt}oSqiM; z=d`jMnV8F8YAMxVm3G5AH7Td3$g%x5N)0Wmphbd~e;`W>ma2%fZNG3|>&$|d*D|q- zd~%WA7=R^p%aK0CX@=)kSc@1Ob0sU>Tp{A=v$fzn4x406=S#-$=@hw;_JAP>93a+WSR)kr1aM;N-o`MrYk`(I`YKGqznCBFsI=D;L;@^gvyi}WO3<1mJs zp}#p>;&IgBe33i%U>%Rwyw}IRZg;~gwVRb#tbcAjdU~Ew!5xvlq)}}VDb@7ZZzE5 znyCHq+9);JUY@Y!Jf@;?EqDkJ1cg7uf9bj8;7>VtLL)dx?yV4ZwI ztOs+H-xG14yHhS$PmWSUwc-9C1@3tLlS%g{l9?ELV(mL|*KgINiM+pm6uM8lGPL{$ z3146dT_>w0{eYc6Be3gYeGRl;DMRahxH)cE)v~T_M?Swd@o2q|ZdV`tDzx4gKHdZbyAh2!3>i*+ky%~nd>XHm$$2f_D6hRaWEJtTSUvb8#7_dA`>)$4za84N}j z)CkWPgZAFH-Uo>)@Sn-UuGj2!u05Ehd!v`?PZmqu=S(|WjdaWK6E1(9=Ff^nO_I_y z{2Yu&X9#&DL3?m-u|&cW{8j(T_sdzM;Hr?|&3alWXHA`RmBQF4ivK znW3|Fl7AFqv9#+(snN~Xm)6VV_c6Qn8tePp#X{}~dT71v?}PlejL3T_d+&cUS#0a` z$$O$~?}Z^A*sI8UT!}}yTV|gN$n8Ec)oEnwQYa*UBT(cUe?US@1x|`hLW+k$zc}-;V{c9o= zjv8r{hK^9`I+BLGekHwTAP4z@9OQ3Y+q}N1L2bQxd*!|tkg> zYAezZf(m{6_V7@#gwF7*3tJ>lg{5ZUIJPdui3P=c|GgTt*Tb% z2rb`qzY-}`!D~Dw`e*H*l@a*~rLNf$Iyb$#uqE+szsBo`@bN#S)D=2K%l9{ke3U#! zJ5G%sQtFyv=L${s(`WnJ{gk@iRnpAEJh!M=uYIDX9?wI^e$U{%gR%UU?A8RC*p|(!T_P4P ze6|`1k5Yd^H@=)bm$|<2Ap8A!m#7`c;C@&}CG@|ka(;x9^uOUEA&0y3&{ME>ZKTqHJZWuOB=PRVq#Q@$%!s}nGo&== z{dV35*8e=)Z~cD$O=OZkSpYX-igR%Oc%;Vr>yOaq-Dr0O$bE1 zX~FZd(OfunJo6CQ6O&bd)pxsk&VYvc1m(IOlE=`=KXG?1xW%VDER#FMH{mPBYsl=e=RBm$@eL|Y^9z3m`PH;};SzV!KNGdMT4wG|=$z3K z?b5zd?b7~v+NA?!+NFoj)h>PaeC^WrF4QhPvO>Fbpmo;XcOT2$d*u7}8R+>!5AEBT zruRLd?CsmB==}rG`^sSTIkfz~YZ2+2rRDcshe+QV=xUn!v?mQuZ)G$|=xbB>-CX{c zm=Uk<9m}`I;OvM~gP(h7Ya;S}Ya$yU)j&cBFL_%eRb@PsC#fR$!&pr~_IC9PAJdyEv!oV}%6aS>kKMlvQ3r2gzAdqT z9UGab6QG-Lec-*MxVRm0YCsWl>1T5HzBQ3XHolCI`jWQ=s>`1mzw{M^))ZXZP)VTah`fQZfKPH-}}2nn9P~AXVd_t{#dn$ zb^HC>aYGxWe%B_6$GT-TNIb5{`}0wwJ5K#ipOLxW@-=hf%wF;@3G@7){w;?@T+#Wb zMhz`S{Tsg?H`EyQ|MWK!k9B+D?=tBgq5emol!!J${SW;?BI*eBfA`m;21clV`&OBB z4^w~MN7T@Usek^TK-6LC*Kd;uhN<8GEtzy%)c>uOqlRWte@D%zp<2{`TlS~{i~75^ zjvC!V)W1#v(T1qMc0=4yhp7LGN||7Y`n@kmqB(Wv84WwX8uP zqDWZo)u3ZrPlu^?Mgetk;o>b$_K|X8eS*xwr?o%RlTrQ>YSfw{9HM9(I zp4OR(e0KlwcE%kNKho;K0HM(7%{nOtkEJw}ag1)as( zPQJ(gcP5Sxe{zw|WU`#D1q*YETiWMVSS#KKDUf)r{Z&xJ*$ivboUR3{j)^^@_&Hhs zzG|LF{%`qfebD9 zFULUI**7V*MyJaQZYl7MoD1ug7&X}5#o!ytWcvHg2-`0!XQBm=bwAU)HCW5LRjYBk zXWyaGStous1EEd_x(dPXbn*fvx!j%{$kBrJjcRM3QewuAfJ7bWJfoEGbJ5b5%2(bE zt+%pyC*PN=nC&Y|%eE1d5a;h2DnFFxymM7|QITn~lqZSJ<;m#=(|>4Y*)Y=qYPP;T3!FH`Db zc4r~i1-0H6ISu}ws1w{ebMJF`qCWAb?UV05Hf!&Z2PW1p9$1s64}4$QJFrvH4-Y^e zD1$YSrsWS@i^#w%Eq~xTLQK6sv`V_@n zSr>QZ6gBtK>hoTX*JDDx??j);wfKg2%DSbT$!^U;{7NvWlyGddva@@NyYC4!V@?Y-m8m=S$I zjcCYNp=P0n*@96~zbYt6T5oiotVfT5Jduf>Qs6|jbCtd)3q94)9u4F|Kly~LOK9#* z#5MKph#M|6^Rwpb-ijH0*Q!>PjFtfzFAv$VhyANzeS3r&{k+zbY+m(N%m9kB2VDQM zx9@=G<-1WyUS-#ey6}jI(Yx%en9;vNwG#1v-7>GS zS^LT$4UN(1x-U+mlatd)-OK1Pl|DwR&udAJ|47&*$#goIiu9Jt^tY6|fH5^`iRc**T>ZS-&SnjcB79X;(5<3@fuuYaOiUI@LP< zX3PM^KsvwRa^tqkPGs1zrAOb48BHgfdha>e)a!-wjF7OeQlt~ns1v!CnFg}kpz;?xkaBn4*wEG^je9>~e-zqt2Qy&74`>y-%G zr(Y>DH}V>gbIj;wHPWZJd<>UoMybK}49_4fALECVI2g@=(5^qnj6~k+58j9wF_BlC z*OmYAn=zwVL5o%sUdecC#MS1GDNY^-+$5{3G`ZkqhKnW%{{A=(#fE5C7T{!kJVdwj#n-4gs2S#}=ht&8=!(1IhiLbl&7Av9p;O-%F?VEv@w1hc1DKMY^< zljUpaWcj-A&&hSPpC9x2=lOkhmFQ263cX3PbLleOx>=7Ks(pT$-1di~6VHd&*2X8q z@`h)j1D*wX^52MJ;_q&W|E`{ej%v>W{lw?vuBut+2zVCgp)bZ=iFV3WaaZLmba*`r z^g~y~MNV=1-IwDrSK|BXDD-GjAAutT;*5;ykZ2X&cc~Wk? zv3NxugD#t=DK!T8S&tnDm~w~w%;)2iYAmwvk5Fm|z8udz&hS_G#rT+A^*2flW{VuS zGCt|9?ay>P#yf#~=^)-CC+$vEql^wXCo;jCNIpGd}8x1`^jinDG> zKNd^EnWp@oadyZ55@#=6J{f0s|C2bo;-A1-S1iW+4}VVUMfeGxC*5svd$EhpTRTVp z&5*e79Jf)QnRfr<`AV6*C=>GHI{WNilhNh0YbD?Eg3R~n5Typwt6yevD_aZh$;9#Y zOdJou#cSQ1j!|QRU%W#LJ`ktIIe_y&?gKgV9P~bpYjMA%KQF5iaf5x=Jw!X(r;FbJLc_1e3_8kf0IPe1cKs?PHY{Ot zAPrxhSYs6Cpdy*=DREn8swLf;2g_1qU$VY|3@z9#+#I9E9-AJ45Oi;`7HsGFfQt0*O+gz^oEj?tr<8?VQMPBjBJ0&# zK-6@UUw>_!>zgXSS1dLUTpKq!Wz}-VXy@HBtbuEp4NxR%?M-@crNICH82++gF%Y5ZynQYBct?$zqr)A>3b|#6YU!F|UZ@nHf7*78{sf+z@PF3fY$D}3p+>Qx* zZu>OxH)A?vqkRu97cqUPYjlLuD1VGTozVBs8K=*}7&Z3W^pR}(?2A!jYz~bR=iqT7 z6nZ^oFdiCG6!WAa>!%c62cpC4FXH<>c|B&Nj|ll8i@TcM#S1}1ZF_Nt{`2pO-(dw^ z=Z{e1wUHzq>V)ns9fvVKB6M4x3)`Uu*?hhqqeea8?3P8YHpWYgkD`>iWQdwGJimfN z3+iE!v-{*QHHHUdo$0*%Tzv(2Oi=9&GATtt%|{YKzYzEeCc`4l8;9jDHY}12%k430 zd<}5+DFr^(SM?3NMvr+)MyDpL7PF%UR*2Z+IlNxI%gmpn5DoD6H>!~hm{Zd&Aw*K< z-{ct|^EdXGJXa#6u5O2FeMqTmtCAQ)_A%aL`d#Gpn4vmQ{+f)=#~iBlwv4Vu8MS@s zZSK_yYNM_;_iCV~at1=*NX7Zw@iE)&F}9gN8+C9!#Jc8azFPeg}#to2i~Lb zyuW-88i)%$@0W3EFgfT;#@S2IcRR*$cJ0VyS@-S;HD&_NUtcd1O@`GTqg{#nAx68% zdYSJ-g`8iD%vY~xyjWQC3J{tqA31}Qwfo)mGVwwSmf0|C!?ZKe=a1IQ#4}9&T@K_O zO}V$@{zmp$+G$1MvDl1XPuO^A=XIi(O;pHhJl|^fA5}2c|998RL{l&Z^KKjFk5XVx z_A^Mp{n+(_&U5*zlQ!`)KASqLqk&H3u15~k@G%*Fqy62}F&bjDc~&l{X&I%w&UnV^Sr0UrqGw*L!Q=qxS!X4={jea z@nNx9xzOGxUYV_jQuz&9@V#MboINabq(r;G)zI4mv-SPwXu->;_~xx)rbENY@KQC4 z%@LMIMpuqKrnhW-%oS67|GVKN+rCT-ZtDlHwf~KoqCWhw42jE)a5H#~f^TvisK~tH zbr7a!Cg+tSlp0g(CbkdFOx1ca6UTqsKAZdLrwQNS;0)G(mZ;CxEUS@zM$Zh?dL@MT z{aHp}`~2d-_T9WTXPOUCe5KpY{(5_ihI%cV_g|UK@x<`eSFQzPmc1VpYe6>8?+;Vs z4N6^sG+eV`5o$AJgbsYMYUO4ixBuI7TU3<3QRP;xfP}7QhiX;1Vf{D_c@Dr?b+&3X z!+w4?ETkci1fai8sjF(PYVDy^yqgQlV$T+;mYjID5SBL$d8gQOpK1k0?dLvGqoQhw zYVC>J&z6A4$W|>=EjjUQ8LW5Nv*oH)6|f*MBlh!)>^?73EjjV* zGFa7V$a{@F52#jP*nS=mZKulx)sTeOz$?%z&a!2SI$Qs-MU8Gd=jZ->Ex3~Npq8I+ z^C6%{N|C|qXm3gBr!T3W)}(&=^0nZ?;S|}Fv>$}sD$jv;Dk(wda zG?j|n$(2Q_wa}wl4@u};1J!z0aha^&!(2`|`PrYyKjbhIHCrK#hd`tTwKXcCd|B%JO2_ASz0HF>_Y<_>#}=Po@FhxJ4?)BXHOa7^ zx8-Olq@&FeLTCMhKEIIYvp@^7y_(JcustUxduLq9^gA)H@!U!?Cd_Tx{9i*!g z4i7J`Omalaub{hzaLv?_U*RgwGwwri95=Xb8UZ-6~bSH zUMTXURVB|mBk8Ju)J- zgVYG;t5$msIxD}RT9q=o+6JkyHf7xXGsf|KyFF$_ffjT^j7#mjVHf;}=QD~#0H=4U zYDqFW84a0D_HTpKSdu!Q^znYL8=^*K(*DczdWK7P1Go*?E}?7NAT`cP?IUBnk1r(f zkt=e|5AT%pRp4-PotN1i(F;|}(*UwM8?{jdq40Oqy?u(yY@)U;qoA{aihDYSn+tb{ ze1TP2BA<8R4v^@DutseCzVdtOUS^lFb?_Fk?eYtGE~2ieQew_%0C`r%2~T##_S+PM zz6LG$SH`FLs#UZ@w6Ef4BrbD{4TBn^T_uA8*3~F2~mYAT=2OCiCoFL)55c z-!D|H0if&0soy(A4PtRuUC8U5ChEc8{t*o^9R0KAc4!Q`8)Mph%E)+00hD3|A+ z+%?E;ocsy%n>`NKzQJ+6VKA*5qQ;d>)_qa6D&lmkuG3f@`uD}S->V0i&)QwBT4%;= zY3D>+`rPrHQ~az$)q=yL!WWhOJvd5T{JEwDPbHpfTJXfEsD;mLeXyJ7$oDDyw;3d`Ud;Wo{z_qiP)0~{i+lDZ5yS=*Ao2({&)SR#Hab#o*23# zZglhc@m#=TKA*d8k57oRV!WSR$MPS=q5XMFoUhOBQQC=I)w=E~kUcr#9(;Eudc5B* z(eFGY?!%eP{oNLkC!Oi>zuyw)=lSp3ant=7<8|LUGtoo7Q!=scTSZgvV~0SPy%Ie` z`B|})$?cV%K*+0S4^FmMemE%h)6^Iz`^@1N;ea%>;3|-CzQ_+a7C(@s1uG7L`?rdi zghKPtE#jP=**A~buz$#5|L>%G2+2I7$dmT9#2G4+lYC#hT3!Jkfit^wtE=`{YWqj#=v8@Ikl8NY2DP>MUbWTR4*i!0{4Gt2)Uq0)p7UxHjOB!G z20|XlEzio}IiVST_x&+uG%4yinv85M9o)~d0thkqPb&rH8?tkqQBtfkyd9EJdu2L8 z-vXRY+h<#IsgYA0po8`rEph1z;WbJscWbw~(_9DFXbqPSSE zx>s#w^CPdu3 zcvd0}`VTpcW*=2g)6hc2{W5qQgu}NQsJRUY-Jgxf6O_6FHQ|;0_BYI4ZycS)eRvY| zxP6d@en6?~u|}N3U}#m;NTXa-Q`h^jdxKJVl)?SXfeTwQ6@)e@B}do1PeXm&-@DL^ zv$>=rqA6;G$OYMqKN7tDhFq}jv{GVT&Um_j>F@=<0mWtZD|5K7#jmaucxH6zX7+lV zhEzqYr6ablMN}#FP4>6=oh{2J<|Iy>Rf+pO*_V)6H{BYy&uELy=WdG|jk1tC(X$b< z6qrozuy?oK8fUsQudN>Ce5(b+`G_#Ru2F{7n1#su>p&_UYGn0P^5ed<^gZWl!T)}Z z=K_tCZWC<|oT~*VvPi^x~iT*LueH>au#30NznJlW5rIsDH z@;gAjKE5jPbq=P$t4E)EzR+Foh8FCSrFB#;tnoCctzA#HxlvrK zhh?E&NJ9ptE}Dhf^JIj=?qWRw_grZl?&@K-#)?b^+x%B!#@$(n{2QgNTPYoz2jihI zv>%wx=_S(G5$WR6#B$jc7a*B2l}#g zyvBPulRYHAZT%M3&gN;>UzJ}Au1mo~vtJ8-S@1yi|BUhOoC&=9>Mi54{S}_mu-IID zn~-rN|1tN~l)Bm!@cshJwcvG>x*k`sj`3x^g6w(+B8~L|hCR!*;CdUbMg=wheu{<; zEZ2fdgimYmQm)%Plj2WopRJ7h0dP6-m0N@!$l&=^4TneQCb>dJ&?Ts?kP$NWK!4O- ztT)N(Ic)9j&k}QB{Cwjral@0XE^p3KBY_DX^qqbc^h(0XUda@9r%TU`lN<$Z>#;m6JS$oml+mr>% za3hl3=Tv^#|9xwm=ksN2@TxcsG5x1iR?lg)Wrch(U;iELndnH!rh5;9)XAs`1EIQm z)mEN|I$w=+1LcYFc5}Hp+Z+(@tcR}PF$m>DtbYgV-(EkL2pzgkmTGp#Y3MbsM-}tf z5~f4mKT3^)2DP>B6kYzDJ&r2D&-&D^;PJTp?=}Y_!ZvW3GuD9^NxAPUC1Inpewn=g zcyruH#tVbGdFDc?DotPo0IIB9M#%&Ey$isbOg3~^=jL$k$la)54Zks!LP|}$__pFRs zCX<97RAiQM+!dKGZiyTIAzHpQON~5h%hY2cr#sgh|9zB(D&@f5)xgmv1)<8o48799 zXffNA(Hva1ncI9K-nR(`x^afl&X2s`a0;YaPX$8YVLj z_dM=Cawj5R`x3~JJJkprC};5SSo6(s<1rrVCB2;J`=>l__-vEe2(e9Zqg_Ecn{z`J zlLrOd7b^G5AZ$-&`dl^JFHl%h-Sd#Uk;%Lv8mekgTT2!9(Howd*YZ0DLZ!-_qt&Na zzi$5hz@3N$UWpk4cdC(LWsX_xK!nIjc9*QI>!8%tIRpL#{{Fm4;O`q-;`|&e`VBSm zxRSn($jI)Jv2Oiyo))GXd=~;I%yw_H_u=&JvX;&Hu;5`fKw9nN2Q@dF1H;#0WsZ-* zQt%}ar<=gZGn?W@V?H8ZvHPgcLL`mhSym$(^I>U2wEO`|U3)AVf+G0mcid-sj&J95 zXIxxod}&HOo2~mZ_L><|Br~CB-?u5T1`5p&ZXMUN+5R=IXBV2^-xN2#A*<&M%2>yB zBAMYEC!Tk!+pm%l8dQpW^#`E4(H!J7o2gpVq1K-2ebham6q|=Z+}n z>t51=+iYAgUd;iVLI)A@J+a1~-o#}j=N-oP?Ax3zpRPMIc$ppoIQd%p6ZgAUBZIPY zUGa1NF`bXu)d_v?ykW}wKcy7;PTm?fj-={EHca16f=Sd$FEo$b8aEEft{QcOhF+6h z>)uS#g%U6vo}xC3?YlBb#~C>nR>`JuJx9AWZiFP^%QIzsZc;54rgwN|3OatI2)#vP z`p6R0Rx-Wl0Q8HX1vQ6y4wFHZSqNz})ku3b%C(tdZ+>*<`2Kv}mq6H_uH_@b_~gn_ z8al-EVu!64WuZ1YL-@4|e@2(@Dy9$pR;q2!M2P9mOg9QUgl@Edl!g*}`{2!NZy*1T z;rZUp<9oY)YutFAk0sYiamwJd+GUYPjJ<#D=D5N1t7n*=GE=qq`NaVYG5q}LdXRS& z_|oj0Ps#ZMei8y{KTZ7yDRnj3Hq9U6biy2_j`8~KQ~$a-&UKRDTb5VPSVf` zN?j$8*2y+(Y@9jN)`vc!D;T~3X0hn+TI2!yeCpAg1ump3 z#9oWzw6kfZYPDV?Xwv?75jVl`q2C-gzDaFeraf1mF7{BI8>acj;}2zXSW(Qzo8tyV zuJhn@F@Zz2zx5+G$9X(YI1QaI+^e?s+xL6v(0Ug_3*HAU$nd?N;X=eBonZQ^)20Q3 z_hvTUEY*5fDe@gw+~$BXo8K`o8m$R|$IPx!KBfO$(f@09eW^Qcwsoo)?R-AzyBW}W zcR~y9=f1K6o>xX_=mn;yNSM%eK}y@-P?3x8naR1>xNi7^Tc*|xU*8;`KBpLy%f%p? zotMmO`*?b87Wy62r)J+ApOmkQ(Iz(8@5?tX>l3m>HnVRYm+^Pq5;xlZN2=8_naqZn zBO}zd47K4bgxVgKYSnav+8n5blCW!v`5kSaEn}m0jih+}^G`jzDeh|Pmufv}2(<;} zT8;gGK&q`674q}M#<<~;L~LqS7^GX~^`d)c@K~Ti^Mj3?&nDMhOY-+(&qg-bb+v7t zyY4K(^K89cHA+KoQ0h9!YySxT|I@}euY=6%`mr(M)St-1^xKVbV1zwxyttou; z5<0CNKjGtgY^l&=|6`+o;ny2LMsEW5MP#(<;@7=e=jdv+^HOi=6Olhd{pz8J}n!?p3mN`+9>h_FdKpKVRI7P^NT^+euO`F z@%i~Hc`b1v1H4h81Dm51sT6S zR-KSXE|b|(Z0~Jb0!malUZzH( zqtw4qR`<37FEd&8(F}w>q146p2am0bh-#iZI zg3WQGgpGSZs@**zzPp{#W(NGse!BlAo@>U+1Dtcw-OKu_a>HW%d729nFx`ud%WOL~ zpMK6`F7pmb**fR@6x&zo=4xDrXY)wtDZeNI0cARvi|++XtK-IBIDI>leUG@menL*C z-qUjVzd^|VqB%kzm@`Iur`fbAZVV@%QMg4-KUa0!(A@CPh8BF5$)X}~`hG)JEp-O` zl@8S!l%;iyXQ^CR!}xZv_aXOc6dfJ9S8aX!zzX}^q9o-lDg~$DdsvH%28y&DVKsx$w`3MCdy0MZE0Ovk+qI&(rN`3A6RJT-^Co zWC|SgR>h4Hr^@~Q>+{eVRZ7fbHwqu2B{zZ;H>j=qa)(y1=OZ_Q@Oy2Cx|i$WX~i|! z=?L{*$kulWr{`rQAf8$9_c>G!bDu1=v?t-166Tjj#IUU?AVkiZUlMv29Wmjp%rLQTU{5ck&;~Sb0#RNHJH`C zzFu*)l%nLQq9D|-xJ>CJboT9*A`rHwMSQ)ON8buqPZxoBX29Q{{)N5KPoP6V%Zo3? z3^fhqtWVr2?bV?54$5e8Dd0JnaUmk%x#FDal@Dkrp(or`CG>>cO+uzHJN@gFy3RR8 zIghp}IQm0ozbWb}b7PDtGsF5>zfL&?FY<$oQnw4<4flu@-AQB zPA<=`v&Ue6hpOVnY;lGt;;uJLj=O&8MG-PZLNRSCNUPSwht z&Chvv1>X1S)lU1I*VEklxj&EZ`R=OmJ-?(XZlu=Y##k=$$+^vjlI~MC0JZ<_Lg=&| zN9m{<*KuoZ7Uw>e0+Z`+x#BECs)`%kv*2gE!|&&nLUX7xZn&MQCC($!mm(iq2kvf(>w164 zMyOdtm>p=a}JjDihy$n11bsbxJAr zJ&fkw?L60q*yj&a#*GG9-OJB^mZ=dYhr@usO%eVhOkOhi$KbC7LTo*R@5SB~Y3Qt$ zRqGvDSr_j1x0IsjXgCV}@twpSmeEoQ*U`rs)z*Onm$d9jXLu=Tp|W(edXUMZ5`I=Q zumYCyV$5J;5P8nJffcG%ub`z~hBe4+e8qkA9EYIuf5oZMJ!AYlj#RRBCiJtYQZfa9 z3qQKF9CcM77y7)Yx@vwDtCSq9QgYR8)oI=9m0WE55v4AMyMASkPssDx<};NO{Y2Q9 z?wiFOfFx=s$5s8kUomuF^)pIc9}Lk@DU_qni@Z3s-#wL(6@})_ zm7=d1H?whyeSc(Yoaw{u1$t_Zu{kS2p4tKO%S`NAuo9&1OY`&}?EqQ05@gQ~kbk`x zqQJMF5ERwKkF)K;BUz`ne%E?YkJH&YY*;vjb%L#UNW#$9-p>POnV){`fq7_)78p02|jaU*EI?zW$Cq?z!x{q6PXF*>@S}3A{N& zA8Yr~e7*NdiG2Q25OoL07cK?4YzN5J%RnyK0rJsmkc)PJ99a#ratFxq)ga4vfPAc(*nIc_1VS+`eQZ@*fS>o+4I1C3v_fW(8-k&Y3A_)3phSB z*7wi?{d-qRr15+P<3fF;0c7j>AXWp&J?DcAHh|oIKFH~YahUjbOBd=|()j$@B@6ZX z)MsB@sNZv?L|QX(e8)17x;qx?{S6>rUj`CoV=V*uTLVbVGLUyt#~=&!&8hu8wNS50 zefH~x`i-g2q6_t}+T+eCV|-YqKi>dSR0eXO0i?7Hq`LvcTL$t!4IuN%Kz`i-QdkD^ zEBp7p29O)dK>n)%L@xvBYyjC<2J(vrkS%2(9Sr_5ke@YhKI;fv;^26VW}pLKbm%Lu zl*qO+kS9~;4InehKpt)YnNOKpt!WDJTQk zWxxNP{rkHOApSCt?=*niS_bm%29UL7Aon+be5nlNz66}xlHk10q0hWhBEd3{hEzBo zFVoXg;oMiI%Ql>&3qk7MDAVs~02y2ea$5t4R0gu80YokXxupRltqf$7{eGkUyQ%?X zW*JDh0c1@X$W09(`DGwCG=MN#t#1HXSO)Ud1iYO|@OC@&{&f=Zm4RHH3UAsX{q1!r z@Ol>MZ>$sWp2zTd*&;pA0CH{_h-&|Tnf?DI4ItMp2DzvKIRyKfKz8GYA14!*+ z5Pt*6_QfE}8bIz_46>BLzZhgm1ITw5gPhj@^6+91Un*R8Ez-ME;o7xG@37%wW7Yj) zkv^vZWW{0-cLT_(#mue%`Paov_W=nn25~aJTMUxl08+jfB$utD#UL{qKpGZ<4q)+WkGx z=D8H)0GsDhkZ$|^|D^V>`SgED?Z3mPueJMM#QN{|=^gbT-lZTvv-|sLJ;-@WLCkuP zB}+k`vfn?M+W-7>^$Sw_51p%@w@xC*&Ift49wdD!$RqV23|9}=gIwwdA@v}a`9Tsn zW_H!XnXGdhs|9(Y9&FF)NdG!W-AtF>R?q9B?g|w9b#G#<`_9$#*c$peh{0g219^!3 zk6pY55Ni|g7wLHFTs?iAy=U~CJO2Htb9HH*L{@wqBCn@6Q5mjo__iY ziDcD*)YpUL)Pa1n9;B!aRdp!uL1*xeA zd8iiT)_Rbcbs(GTL2~OrZmtK(uLG&B2XWScRNDP-u=`Ko?E3nYdNDk|v+T3|S9~k4 z0BHw0E1(4nuf{nA8Hh;5_IcYss0oitcx{PD^buFyJl)88=^I|o!Is>&8 z{~vSj9v@Y8?SZd-&LkuOA(>1v0b*Xz0x`T39%|)Gcxkn_Iv#DW_12kStF5&fK(L79 zBw)2o9~?P4>a}JPtin-lQ77uLS`x56zy}6J@x@HSOJbEr2stpx{(bi2WX?=p^zysE z&+iXDWMbo(!+*=^=eGj>TR}g+jpx6O@8`FP{I`jHf3s?WT6O%a z+Fe$?NvlSjy;gR$z1}p9l?%GPP8`kzGd~w96$EmA0lj-K6MEGH)WKF9Ab+@n`AYPT zXbMz1au%%e_h7jyjq&z4#%|vj$&9Q8HT@`PVFYD29>oE_$zt7fJ?4T6KQ2*!do&^c z3@F~5b{we61LI4EeKaGPk_jUu^WlAL^%hWQhadJ z8^m80U@VjO!T@p&#fJ*Fk>3?|CVpFC50(|DWE3DM^*b4Uw7Q$+A|U>jJ<&?N4ch!I#%{k;GSOKaQk;@`4SD7aE+c;< zP+Cr7>{hZRnp=vrSq)HHL+_UfxA{#h`?Dpp`7932-v>0W@*5btD_4PQ+4bP6TLrGp z9}#`R@`&Z9GyK6O05aanAYz#D(Eu*Ug=@%n4`3`uQlRm`SM(0tdNQx&b3iSeqG;XJ<9GOTR9_&T#{J<5GtG|8Gek*b|$nHv9)#b zD|R2#YOfjvm)>`j-ADeK_}6D}r~p_jGy)*Ml+af71jYL)#_j?aySG>{O)``&T(%`~ zY!hQN_x3~cRz}lH{ON*p$xr}FN&gA&JSHxCG@-rbN$gqco)Xi+0?qeUlL5!dd-FX( zFaBUYNM_q&R%bkr0mn{%xxjpo-2tWXg2@h$_dB67m0P_B9s4VQpa(J<1MyQ@(vB2i3V6B1Tc$@^g??CnxL4dMr68cp?GuE$Fwtn^Y zsZj9}-9hF~8A8a)c|rq4y}#ec$7Q?1(gcX50FwRDvH;UK7SQZeIZqf zu#SFKda&H9H_7`hRyULA-yp`aGD9-*T~O&83G(Fv&}S79WU?NchO@O;cnZs8op;Vh z>fK``^N5(O`WtvO55|kb#im-Fricx_z$Vg%QnTB4V}< ztECOTMPOd}0cgI4p-u z@KVM575jcSk)!fUC#&N@@!nx;&(6=)5zwCHI=4T5eQ_AHCkOfcvLm29KFIF}4uhsy zm{SK-`VX=Bhjh3me*{z>If!Mlmy*4o?0FaQXYu`D+?^(wzi~dRxae|?1Mi$mgQ z{h*kmuLH$P_&~;9{^1mr^d))(2Zm8TWb0pW+XaDVv;Q(MiA=xO!+3sI9zRFhhvkZF z$t3ec^q>7V|0itz8rDb~q>)gj zrIZ5l5rM7!u!HFYvNtCuv|E35tlgi+ zP4rDuGSd(Kesp&PvD{u24WJTPCc2yOiRg1nhhK6ST#4^V0P^L{QHnh!>#4u@$|K++ zZIbWn0YWM|NYm;`2YUl*qS5!r|a&j zX=)HNeg{(+za#zd+uw<0q6bMo5%kaRw0`(q-+^WFY=rNziSI13@wys8sCBVqwh5A1 z4q`j8CF)NwJ2i2Ce&PVQB8w%nRgla=?hAO1vu7jy?B~;3`}VE*TRv9<$j^d)=Bn_U z!QZ**5V&am!B_ddN%pr_vFsBB)#n6re|J2#r9%YbAM^ViNT++L0CIVXWR#~tSw$Yb z6Fa>Sf$U2I<9ppK=h@f8nC)Wsnae@(R-}PJZ0>xX>(KgcYIiKh8pCqa{NTm+^Y6EG zW4SJm>1}E^!B7E%5$FurVy>YjJn_uTPgu zd;4Uc`okK~@_osb%>u}DA6pF?{<0?!6uV}`Im&R!W!5 z`g=fIhM>{$Invrh=zXtsWkMbv0pyRjMFY!{;RA}X`V47R+Y8#40LVmVoWR)KwM0-O z<5+!;u;|ub`wVFX7?+CoEbAijP1bHJzdy$DrNxYw?{9ho_rFF-AFXvdn#^Sm%OPjU z9Lt%_cqSsHh4AfFZa-c?o|i^aJXY`AWeylC=tHmj-ofd$0ize>^p4+qe)J+k(A&Z3 zt>g4QI!}849D?3PPVZJu&p1zdn}?vcmeae6)BDSL();5O^pT5A^Q2cf1iks3 zo{Q7_*?H2tZU}ngI6Y!x6M9#iC%w5t&=Wbm&pExxL(==->#b$0K)V(}s45wbO9IHt z(wJVl>rwrdD_mfn1v)7y5Q^!_#kJxgyYoZiOsq_<%RdY0b2 znbW)fJn5|*f}W)}FX!}bJ5PE)8G@drH%mCZAD$<@c|*{%^kzDzH}gE{jT?fVr8hgc zUU8o%y&#<=>dc*+77yT`*?IWb5InSW zromip>K9fF>vGf#1yvhzIYy)pznOK0xm z^#12O={+$7Jxgc4#_2tHp7d%sy=nwB=Jwf2(8@kx`maCwq}|a`Mtd2jE&VTPFG-;N z>PpaDL(o2RmeH2allFoH+J9LI+R2Xxr~MhHU3Q+dzeC=?6Dr9*lD`{OHu1e@AiA${ zx?5{N`}}u36f<&)uP1*EXd@o#37kELIKr@hlWrZS`(O=dO$l`8*MN3Ri>EtSJnG1A z80`Xq(UwGzvs+n=n8uK!|3T3`L8ZVsg5kU3{h~~2KIl+{Y8E(UB>kx12-EJ&fF~({Ekt%x;yjG8 zTVnMD40_+L2rB)yI3dl$pC=jhf<)_w(>gRxFc-fX4G>zb{4O$~H<6F)2WMFPlgPal z|ExD-G0*yB$&9c&{mx7PS7SM-pAp)5Q0edDG1C;NRC=&X-fcb|i@*Mz%SQWdmct|{ zNCs)M02FVP6U-Mdc9ZrF^Em0>Fm{g{1-q9(iTarB?K6Y<~L1neAKM`Q<6d(wZXGj~LCbR)a@e;m6 z8XSY=lW9)D*nDOchiqfM{S213#&zWQK)#d#m!8EWVl0R=u5n zU0B{ml%4wpQe^_L>AR@5%#%%6M|C0!vcN|MgH$E-xNKMB<~hM<#8r&Erp|C zcOjIh1?f-=r7Snk>Nvi$vx5KP{kYw>HpzZW)_{-WfDW)2e@i=Cqb*-y?547Y+4>@W z!Cg+ttfsZWrmJBwOMmq5(LhjuQt}n`T1;-MlbPK5 z^1vjz&92w%@^pbsp8l8|n@f}lR8AvFApgcGnR74=##*DBTB|k}PcrC&L!S zDVa16rxQ%Yy6cya3mFaTt^X9uF+}UdFnkZu0g+A|<7FqqHXwd3LgaWJKUXan1zVTo zNd`cPN^2BKf?D+T>OBi?^}SpLj@x|6AQw77otF#8Js8Ui!gL?)<%#F7F`nEW?mY)z zPk2&(V7lr+ikI+(@FdE4x)Wn}wUrlQaXju(0+1gzV&~Y2<5Ty6YoK>MJ^T!_pZ97$ z1s8x&OLLIAd)m1y85zW&fjroV2%*quXUD>J*c z=|Rb$It@Vf=SgM(fKf%>%>(1!1f7()&qPnfWO;H*OqTt8efWiVy@ZlLmMAVfS&i_V zn`Hc!?v3SV*|BMUCw9|kQ%0(%5_IyVwzYV>gRPrF2gpRHcv9h5VaiCVQ`Wr_4MapJ zX0`pZbo$%)WOdCe(Lf<6UZPtH_})(B-q@e8hB}a1|Hl}gBm3j|ygW?oE^ztz`-wId zk!>rt^#lEQf87eQX(l+403SYPp4M2-)(dk>)LE}Y1CT=X?t1p!Om+Gz(Lit*P`z6?3byv@Tkuf%DI8{# zp8c0Q_qU_=A2#`dz_{uL!FEodF91HIgc2CCjbb5HX9pp&nQ`ZH`@ zyv*N!i~s%x&yO+Ehz8!|YvS!b`6l}AA#~r!XZr@3UpyAf>8EHtJ32T25*a3#?wv_| ztsszW~23)e*Ewu-->4&b8lj#Vk{$nErHyV0 zp)o)m>;eSx%`Zm-;jxl=WjWH6JTU5t;c%ua1pt*O&3*`srZf;(i2R z9J=-8Xh3=tv{jrAVBGjX0-eIOiuceEw&m{!nkOez7K%*w{NUwiU`tYLJioTn2?{E@ zKQ^8~!gz`Y7|(&1;39&I0h}Jx@weUZ-=YN$HZh#Oyjiu{P`&W%B%E9oSvrluV+#h<*`?9hIzj&z2*N%++$bhGX>qWTQVh%KZ|X zJzss6VY?70-se2bfBKmCNNG$*S$*oX<#)F5--@k<_DNo|^0bI_Ii0O@tDg2v=}ceZ zabWJei{W6D6p*hHK+eCD-SeRF55k`>Y;)WpsLk)i<~Z-m_!z`)zDYwhH_*g7J#7p?&chb67}*oKue?X4wpWC4QNa5>j_x*ODwu%y%OEktMd|SX-f`}C%hD;IV<+w3)+3_ zdjes58!o6sG!L6g&soOm8&!YU6Bz!0l}j>9U;ANCpo{hW)L7mM6Ct!Z zkKOsI6XAIH1u!1ZeB?2oQ!>IYfpO|bWIem}jyu4l^?1m76lu=L%6Dk)3b)>f*_`$I zNpCx#QA zjD2NLV@??l9;K?(ROgyX)ZY?(Xg$+}+)RL*Vk&`~U9!(Uo+P>h$hP zPVKYS+Iz{~I;H*0Bk{pN6pDHrW&Id32P3>0NRWZz=!7a00B;71 z^EHoD5YqCJKlF4SW8Q=$4ONwbNkgz)=WJVy;UA!OZjMfM8iH3ftCIE`-u8}xWJ~+( zzfy^^FP&0T_4Iy6o^Z?=d1FH8?gg*-tXfAu!=Vf$w2guZNRg(h3Aa%Oro(>o)6N?H zc%=4!x6d}N1~b1HbOUWgq?MCP!R)@2B?+A$hNc|Ik=MJJ;<8S@_3^!!F=qt1dopy~ zyMQ0uNH@2jWyw9+f*&LdpxT5slKJlyT_XY&t-TKbl_8sfzFtlA2`0;Cl^P zfQ>uY8F@C|rI%MQ=l+iCm+!VQRhXYNSLZKs~K?cUq6BA-fXobt0LPrfoD>u@{TU9SHVH8wo8ns7lR%5kO#{AvBnaj5_ z0daI{tSOM}F8ZCi6{%$~&|`2pP!xO$tU&OX(9p$b_{dSX$byGzT4vu*Lw0))%2b1K zfOXa+cvbXQfLPfni+j7qgU95-r~1h#KV(qWvMG!_E6ns);mPA_ETUk3$_E%c+(vG_ z*q`UyOgB3jz1aIYitLkG%WH}kdJ5g*cNP=gZt4}LmVef*3*7<-_jigKlLL$;J|>S2 zHPJ*&3iQ1T6!Wu*sY|2RiOx0yj0MPrMyp|amPeON&t(fWxsPs=^n*soR3KK!i+*e; zq+2rDIR9YKN%3=^aFBiSffqKS`7y1#_0H3GgeoL&6$LY>J+?6$c-sEW4y*tush`~m zFN;r|w_@KS@05>nbg8ohMmv#my5zeW2ubpo(9!vpjXh51A&9@iGx(edT`~Hz{>nzx zHw1DDqU*Rm`y%Hs<~tU9=MbvT=S)jS}fUzhs%D zFGnuh<+^6s8MtQY^}ct8pJWo{O6Urmp|L2Hc=PTlc0BqW$s{*BHQrt)7$9`P9zy}= z6;|zbn*zQeuZUdl6gzfNo1UgD2bj*J8#-)l+G@GeTyrFh zud6%+eWon>&K8m6z3DbzQ5dQ73wOOL&HUsfPrB!DK+LFOnY{Kzw0*<1J>v~IuVPX3 zj6AgACC%UauBgc=5}mTrvzWj4@ByxEY#scC=VHBoSlV@S2r#j`{KbgO5;F~OSJ~UB zG;tJqYE)xV&3Q`&ObvHCHdu!_i2DdWw|?6@I?CE=dvSfu;Z^?}(aTpwnfrVZz5i?@ zd-c5t{&@AhI^Wad2h|{~J)tnEnjzLRYKvAzrf;KkGp6gEbTHDVY4)3ZV^Hd>SqwNw z9JW1g;Z)w=oIbo9(xkF;irv|dY*@BF|M3?A7X>^hps`s^*dzh$?`jFBHx^XWD%QN3 zAc+0L=k-=0tsCE5KnUsu#aK2dmH@XW{f_}%Yy4u3CQP#bH4VI92erk^9P7&h z6)X5bWRBT_I&`<>&6x&PxP&ukY`ES1%zvSlQ{UAtNQAEEis|&G*$5>6L&>k;=74rA z-c>-t|Mz(4j3_Y5?lpIRVkzV0IUPFgx;fU4qvF&yx<Wo z!;^UmY273C{+$nXjp@4YZx`6GLk55Y)%T+FwDxbO;|D#-5=X{OO;yH78$82wK|04= z2nAoW)XV+z&{>WEo*N0@``C_G`<3g4t(^bq1H@>;W#^fQ^f+RfJoG*H&0#x#`H_p!YT)$~e-!$Yh#+aPQa(@~) z;{;88U3lpJ4a_{EKisP`D@2y6<4Jq3ozhbWy)}Cb-W5v>T7!CY!(hIlCUV#^{noQL zU3#4>+|oXN%zT`P7hW6}uKL@5duAIVes=(TkB8Uu&YMjsqW1-*c{zJZTCQ4HWG2x1>JriH#wX3!cM#cvLX-baQOq zgQoJm*EQXZrJRRECGRXBhXm3^ZC25sl6T8yz`Yuvofe`Xrx+8XLwox}iahxnTSMmE zjeQYU;$R2PJn?PvL8vb=UR2$a*R;J&at5v*NrcJ!W*5}lihXY?J`|cVIyE{THIFQU0v-Yz5u%qZ!X&etqJIT=kKgb0eUdHXnkw1~#9g298 z$;O#1=Ox#;1Pju|?5$lgV-vEA{$QTUC~?ct6nm($sOrFJ@mq>Vg{-|7r{j+l@_-Z? z-8W*jmlbo$_Ozm*S{NIBPcqJig4=9EZ8Sp;aFLx{sB&gkukx4`HwL?hB%k9VhkFrX zji1A^6X2#LIz><;gQ{l=J&e@ai=U*N2xp`Qp;`EThXqi&HW*h!!%4RV2_knPtY5PT zlBB$C+tmOBu+69X9R`ov17EcBMOj_pW?DxDVD$nuKf6-tH~LKa1_0E-Vj8U!yYdtE zai8@Z_%{H9_M{U`-w0!mkfKRO>0G7D@Y%NM{Di4#eQ!0H;(%Nh!8*H?p{=$Js**SJ zE40FFTTx3fr*la$oCc#`N{b1eLcAREidgM}9rvUohR|91oL7g>l|EgojFCsm`sA=lt-l|xQJcoGUGR!;#f4vM{tHG*w-L5nOUmEpZcEE1=uqt^LZ)f=Rm|zd6x)6=K^4wVo+U%Gzlu? z4I^U0B)>uikhMCh)jQCj*r`)z=m3Wmd|`)9f`ZTHRoco(vz1pHD9`*2h|``cDSLfIKr+1p}U|A2z3T0s>03qa41GFd;nZ-hP4Pw7RvLYxYu@4+aoH zF_Zr$TTt1FQ-7o>AO{Yk!Qb<@jGUxg9=3na%96Gv=wn7(PZp)TO=>9utD;kaRm6*_ z1Xjza4QJ+m2-W+DP0m@V$`F`qsg;x`2tY8T(%Xci=CI*4LuJ)DUXVC?L-e(?@Q&ec zfz!IjHVVHh=hq-lLIIO;!GMZzCzidvQ#Nj-YStz0i-_xunQ zHIopFndDeATK0uh@Kd7)w|~S>x~{&IYp4vKqaekpB_9?;6VXJt4ne5;Zl*A#ed-`- zVhuE4X+7|6jd0(PRe@)e6(}bMCP&rX;n@!z1`1EAN@gCzGDia*cHL1Q4xb#NEV|-C z5RVj4I}#dYF62QR$#$G*kmgy!S?K?!-vxhvl8#T0212l7dyCmbC2uu(aQ#7$99}wm z5{#(1#S)8n0>-NAoPJiCHpzxr`-C~@bB}b@Hq2VC?IJ%aU3)^sR-k$Sn7c7Y-aMmF22tvlhc0p*81hnZUY1p10Q-lS>5Atmw*qX)EsWEew z*ivNg`#%hPlJOwLrruh(r>=?V;{kc|O0)fSo9G%3a-wZp*6u8lzmwWO3ATN`2hV!F zH=`i!^e?KX|4o`=DCyO=CF~AYb<86xYK}gmZLaHXH}040kOMs1?agbC1wLq6lfR-r zVYk&znrSh0t+XR>-+sr7Xvsd&7iPuongA5ce{a}fx1IbMP2f#I$+ptw*325RU-J|1 zI$YrWh8{W2o0mlUathA)&~WVDL}WiYoNp|4whJ(v(A4SkJz~$#2{C2vi7ofvJ!Mob z`%i@5Z-q&t2tODOC#Wk>o|v~V`1P`dV6j*-I)7rh;4n&_!5ik_NSoHe!Y1Q@H~FVf zL)Nk3!&il3OCL>DjZHld>0YUm6_rRXXvO4@ddyYWCbt8}z)CV>-Yd z7#?IA4r;3p|_0+L=5rwL?uu3S0A*B zn#50o&g$_)=Zyd`Wf;ug>Eb|eqYDXAJaKewMjWcmDuj!Wh@y~L%7_@ zbzihJShYLp3}G3t_cx6JJqae;3tr$J7Nb%p9A?R}Kyl4iy_Ozflp)?z?d`mm+v(&d zsTZHb1M@umf+@XWJvEV;TlXwKcP`<8NexwuL+0Lt!3EXF)H;7ShouJJJ`O*({^`m} z*ZyS&oS^Qd!6W#~`bqdM``ZSi>gvxw>2bx7a^orq-?*d@|{2J&k^0p&b}(Ebp-5s)b++6JCPi*4KU z=hJ;G%l)jk*q7&4G^8t*^wEHLe4E^;ts2-tM=45XkzgG2)p~X`Ojxw2HT}6pFz{sB zmQeBTyVB2S(Z#WN>DOOIE$;d-ybk-&@ZPrFBDYt4E1=GPOCM~fJqgKvwro11{q#)c z>SF%MEB9&w*sz#!+kSBF;0gKW!4`iXR4WQs6l8W@L-#ek;jbUk1WeQ>hZB9+(Yr6Y z5f@$!$KzP@i@+&(m1T6T#+T-1#c)m-swkQ~=<08PhVY|yiLoj#Wy3pd@X{N4ywDe4 zods+7HoUJs?aqm>I4o6chnOnngXuRzl!+4`ZqXr9ZLInpc^RpySDG`*k}amTk@T&D zplmx%9EhW)UFA0Nk##y$+|YV!2mfB$lfF2$wv0ZZ!-rz@bUkh8P6*fZLfY&*7i;4@ zgjc?Os!8pQ7wRCi+kA<%$vu<9G?ycwxk6MEJKAu{{ridgK7&pFyj_=2`cI9G%P-lb zDax1MiSUC;P}sH;R1DSLzW2I zK_vQVWyI`1t=A)Nfrb91Rqx-NBVC=ZS`aX7um|O4`Tj{#6pM9nZXrbs%(J$51#Ex8kHAfaJ9o|VvQ z4{h47MBgVRW{QK3Z)1o#hubQCFFY?-$MG~8+n~(NvK!DJ)Zt(5mB`xQ;)YEmUnv!b z#Zu{3S`%RV(^uXqh}{t#g`w>E&Y22xzI#RJyy(dnvp&2Q9(mYImefq}OQmLOEJus( z(fjJV@705{^S_4;ZpoZuDj)r!C?e2s)OH(0m3;mFa?~uqw zADdnG9dj#qty49d6INLBE0Z2{oQ|mbM#z2-k1LZwJUjS^)I4vHgr(Rg?z^_EF?Y~7 zr8f_7i=V>p?#?5yx47aJoX8e9LJrgG(X?-S=x>?xc0?zcAN%0;-uLvGqoc3?&fYg6 zbLM+$J#QR6w8dG}wP5>WU+&3njkI6~V)^;Os^iCp(L&d59($kboI7AgVlSJYx=7wv zoIsiON$0QwD%FHgYBWXts$bv}Kk%dXy~hRaW4Vr{k|gXi_i0FF?I!db0PWjquK&L4 z;r3v-_<7aan&{2eB);K4z2iP|ynJsy00jA;eLioW8@a55 zHked0bZPWN2i)W9M5H-|Zz9%2kQyT>vMM$1B#lbEsf5n-25kD7S4rL@I$zMMt87cR!icTG8~wYdNw22hV$PD7YxUko#D2+GE@T`sM z&yUFGQv(~mIs`L$sQ_|Gu4*I$GrlAP7ugzSH2@?Jc~s>+N4rdfHS^%CbM&n!Y|{H1 z?HS|8J}heR*Y@RH+*-!agoNDZ!d38 z8ev;_k+GD4T|GljUzT3SzOL}*C({Tul#e>$V0R?jBmS>6i^e%?XEMQ6hb=LG3_#Fl zGS`lJnIq^uJ-oAe-dWq>j;H_J^|e`W8pl%RaR0K@J&^-fbO`leDnn;PJX+`|p^d@s zGEt~SHIM@4R9Ot*y!jwA8r;$@4rJj|BNU0QH+6NlqK^n@(MRmM2 zv3wKTS}mjZHQ)&!RSfJP4t*-f)<4?^J+L@)+ZC3*%5&|eIv@dLx1&cQAg#cWRLI_@ z@JmLK+JoeN7Ib4yq3>YG2BQ$(_W^4wJ_Uh+?K*z0gxEZ3sS+dgdqQ7RsBt@{yJF`pAjRd=p z7v#8^jsHty^iqS}&66tA)uku(@lZ`pT~|u|s8^zq%hjpmhdg>tZOaGGoI+&4M+Hx= z$?VzzqxUu8Of!7iB?@UAulP&~yhg_t3wohWktXG|7y_-v@Xu3jwEUs3vr8qQq6@CU z%l^?BV}k7Fi8~7R_Lv@I{L+?O^XuUZs#s0b@wqKDwT!6^w^4Prieysk%x+ogXbLH} zS;HMQjETXO$b7( zF|?5de9oT(j4)Nwqh&~d?;n4stHa`yGEfTEsa=d-{@E2`>^59X?t$8JEhupK%xA|^ zA@MCz=IWy*x!td`!*lYOxW-FxM4K4kZ*uzt^5T~wx?Rh zluFcQBgW+hwz9>@)5My^x{YJXz%MxCtOq8kOf5vWM|n#O|G4;$J!x!S$5HrvkEO79 zH5bHPX2pr8upHY9CeAu#_0Pi__n~2@y?ItFZ;*|rc+;fWW;&@)a zt1jozug*kDw=2{wC%SUTPtRGqm7Ciwg~znbfa!D4`BkfMDdB)q9t{kOX|E z=ADT4vfpf0f?8GEWg+-FtI*2Fjz0z!5Twh3ZvL9U0n6(?i5Yy7P9c>qL@TUn{^skI zx9Hp#+Bm$g9OFO-pCs4Q*`20zO0cr{c22N+oeL)Alej@efV_EAzR$dGrRw_t$4iRH z;UVsXaEUS4ut}e4$Ta}g)f3V$N~m-Q;;f3{jTelE{41yOGq=$o2cG9dz$Euj0exr1E-J61t^917x)0K*I0UUkM?r@YPY z?=m5$!4Uf@L(}+y_f>F1ubiLs$WG_PW?or!U6B(mBni2`1iCPz2C0P5Z9m;z8jb5Qbe+}QAsu%wIK*ejz+FR9W z@g@bHag8W7yp^B^&Obq{h207QjM^JBIpdAHi#d2&Nnvv&mjE z1CAHmwj(xjcdQJV=npCIm)5Z1@8r?mXg0CfLf@%|>aX#1<9WP;CMP zWrbCgdI@Hf4FV{WVQOb0YNBeWG`jVV<;mo1+(vzyJLc`+jL_6+fSMTnwmurXQn2bW z@E;kjG|IXTP!prD%b4-UP(xaR0}ifK!&h|eb%bf+=J}7J3)zn6u2Y5{+byG_0G>Ot zhD}Gfi8XTLwPi~Vzl|lZv$b!=a}9G@9K$+gwb_-+5d;-o#$Cj4{>5=k-)7vNc%7=M zTb3*zq8GR5qc%Tu(#dOLhJalN9T4|G)6Qwo;L0yG;*aOf~0b035%e6^Qx`D zY&0NCe+7?x2i3qP3(om$k!h=3K9uyo_CMg1c8KI^qz=u)`(&FmWY^nMZvZIX-+Jt(AK4D)|5Bu`eo-Fo7xXia2pX4(%NBw^*~(xi45)b})sj7A?fuH> z#Z9@f@TphbUFk|c*3GYi9|i?)y9YoC)<+3MUZKMuSz?0A4}N)Gw75A27ZUkQ;3_FgUt7w3fexIXOO{g{xmA1a=&v3*%IOjsBK|HiRmo$ohMMAu_$3iDx|Px)JfZ){`nd7 zYo64J2%zC_8ko$nSHQx=)ODkojv@}WS~pRgAd>4r9C2DW*0HxQCimqd?+ouzXAs@E zn|Eo_Q~>>>Y0m&>F;JCMWOX*{)`{F7H%nF?_K`HuMq5yAdzacXk zOQ<2zJeN4+eVcRSBpz7xpldqeX~SrP^=140Xu~X6QVtqI+T_7B7YKsY+hVlR97|=% zHu>YWp>q=rVamj;_nwl1jTcX(TlM$DgCAb;o2iQ@5?iEh1cSqoAqKk*%O8;pQ zlj*&FxAc1_^Do?y`Apq$@_FjPC(6agbsTIxAHJN&7p-&P74&_Be_h5(O8p4G@F#Q%f%xcL;23Hg%0GUFx0+#Hj1~aUH_KQHCK< zy@$<3FJ@HswEDw=c}cqpm5_E9I?L$a(6p)m0aBt_Z`~alf<-q|K80ko1itt2>PxX5 zG^;3BbT_dowXb{d$ORZ2+Ik@W^_*F(M7jya+$W&+^R$i4u&(hqXV2*m_QM=c(!i+` zJv+*6>q@atwiQ4ae|E9)=o)W~v=JP9NDhr))}}yjksSA8V^#FlB$???%1)&6$O}0m z=rQ_tglp^*hWO@{sFu~|r0mQf;~1tm98W&IDyR@F4+KHz`!~u-0$r%O12Luqy{DFR znA^DS93uyzAdH9EB##|+VlI>i@jQKX z@uY8Z_>KXd>XTt7^eVKL_8UgiG@L!vJy6BpASq1j@#ywY^;TCbq!VW63&kf$_$u!EOCn0*M@TdH(spw;poQ1ud53=%> z2mS;~30dIt;A%v~07P$PX9^QqmC^WMG6##+EeOe#)MyDUyD%)e zF}TGZciQop83=D(O#@UxiN+G$LwW8ymQREutbFiPk)Z_eFL+{`7&(D{)pE_$z=rNs z`fLtMs`-Y&Ww;WdGQcTIx&*qOVPiHc2D``Ofn%w&h^nVC?kIEqnjb_nfF4i6dTG|< z7;&Z_?$_8hATdDVHbN{EvyP{B0+$vn=_I{jp*wLh7tFK|L5L-0@Q7(;;6ryk@N^Rx zKqR6@_op+MK$xFr&M0V}Z@8X(^apHf{0gUMGhjpfg2-^9k|?;53Vd8j&`0f?W<|qV z*o?YSOf{DOulK0vf;b5uUr!iwSf{b5)nAPKvOwG86D|t4sj(d^U-eDg{N*uxLg<}x z?nuv(2bN)5zKBI6DbXQ>!f&znsJbR##>g#41vV}s$Z@|(0p?*aqn`U{ zLD}PBrYfUiZdm2k1Uxu%T>2D`9f$<`!Fv(xwn5+B%ToLCw(S^ zc8CpbtGCqig>3(JNfSWhW_xon+$Dt-IdQx0 ze@g+KS5Bjs>@vaErktkhJ&$Gc{vIz8!HIOt895eb?p%KxC3OLb7Q~tU&FTRYKA|PZ z0Y^(Sc>K$-i&vAvN|P0xXK36sTNjiSnDC@Gy#u6+S?bAx$A97P2k>$6fos-g-0*d{ z`LfEUwAX2WHPFImu5hE@+49-1wR^+}4SohW)2Hs6);{24{wSt!@sQl!8qI#UBK@;&2*!~5XX5~bgcI-83i33$E z*a9Cm3?E)?4w1{wX}izf2z_Lbz5Sj{{o+a!IjL%Ew&Y0U8MQ{I(O!~0LfN1yvz#&$$nH7r-sRT8^BzASdHiFW{CoYV@q!HBn(pq`CAx2 z+Kz`Cx(vphW(vvHI(-Qv%Mh1z0o;X6$ohfQYk37FZ2bNc;R0WJB{*YksH9!xxLeoN zuC>^g?xh^-J#l&z&N?{?e)SNF!w_=6f0kLhnc!^hKh0frVkgUsM(>HR5K%E}t_fUR z=H)^BUnQ={${zvid4nOk4$8S^T!Ut7dehTV^*z{# z+mGx`No$(NS2b<{v%M+JoWB#B+N|)+`x;so0PEkI7uLOOCLzuB)~Bx4QTgk$a#G@) zT|$iXU1W`1F+o)W=17UE9@8{whU&_vn^`x^4^oVOHC855iv1poUBKG4C!*x`%z)MbL~jIQ}&wN%hB3 z->zle4?N@8=VfS8GlU4&8o%lwqTr^t;L68^?{Q^JROrNJzloQ_qDH!x@b_&ET3<8L zcP%SYRb(GR!J0zvgn-WbbD`U{Rjbeenk!gZ4eMKBdJS7#4x|~I(M7I|<-znnU14cB zgD%fW7Q`W;^Nqobk(f{|bX5&|8b4d&bUek;d1c5!1g=XzW&WNnap#Wy#!0qoeUNM#h576q>KL$%# zo%I%Z23PK;$7yw_;d&nO6LBk3A2ceEyVPH96H*Z*9}HI%bi~9YruqDXQD;`u zR=Me$#8BSfeJXNCFxFKd=8nXxgfa;fN?n7%f|lWOK;30vPMP9?6pr3GPx8uC;3}MW74NqdJC$mj&c>{Yg?k?yHj72PE^0C5? z^@q!zlYgM{A__QQ(#|Qj7jO?&3$=#};BIqxHN5&<13*2nMy_!q#p8OB*CW22!*6KX zxaXnGz3=gFEv*6{FD(Smz;o=OYz2+ME9T4_+(JFS+{F6{O<%p3LzW78;~8GGaZQ)B0-$m_oPiWHmG1t;qW`NuaN zT0!nxxHi+Ldm z$Bql(%Q^sT|DFzJBwpt)>j1|+8Bnj6MsnlJBuwE)7x)6f7kjv`0-W+qVTy-5pq)-J zD-MugNy+3|1{k;cbtr6fP)lyy;J(B}f!4=Zcm$d8*!$`F8wLy+4_Ac^al(uqI2{_d zXpc^0B*~+1#`f@bmj#Q5pPO72FUa?oBXK(jK7Gk0*?4+v>&N~H@K8xQCxj*!@WRFw zbd-G99hNe6uNrmmnv6)U-A*YLv&sr+4D_TSuKlgEa={t#aG{4WdRLyoHtSs)s5oYu zG-MiPqegC!8aCSH!%;AClZy0N4|;wsgCK1YAVyNh&2ZB?&jB4gLv8Y=?YiyAhwQ^c zjAkpZ=&&f231)B{%)skpH;pnRPmU8xd$0Gz(nBj%teKn*ITs0VwAij)@{(eow2+kmD zw4m|2uO#&5$`T(*5(|^;OEKfIsJhKe4A34yDF?zLP@ur%FAkV+Dk4ZBF`=#_RCIJxiZ4Fr$u`C@%Ngy|PDS z`w<_^3DjSE_N^13`|NMzJo8QVQ@vr*Hhq}ranj#7;Eu`gdgv(te{-uD)4y%}uusS? zkPVSnpn6O0=o;>umX-D-SjTfg7lv@DSIT{TIx(Kne)qb+F`i*9k#=m#InwTswZ~FB z6h6ERt?SIpiI)Fi@G@}57&tx^THDzf;N4@#YQESEoQajnnAc~7i@-6skdGc_PR;?k znc2dRsOyppsOLkfFI7txdrv(X(x;FE_4rpVc{Pnt`GuCehuDJ+>8+e+e#oQdviN$w zr`Kc`yNU1FJyi#~MHSh@O)y4n+L6c(sv|r3*bb#YcY(-byeDr_b87W23W}~1r~isd zpXQ&xMn(z^h`2Ca-F_n$_4*_?b$y207V}wx8pkEiIC!e(dwhc)yXfBLPY|v+tz;oC zb0}R}-7Q2c6h=?XVuWyJ8ljCh)9Z$7T*=~TAr`xMpULrO7Z0j8C2MfefHqcd?KsxK zEZMD`5Dl55!R0;eJUrQUAV-37fq6(6qqn1U&whVY!TK;z(JgIpHN&_>O+r-vo z()wf-0)qYQA^*t?Fna#!a4G{4)QBItwi-F+IFI|+?B`sfQmgWD_bUkAsP+mZH=$o= zb?52|Ge?iu$B*NWEv8uPr6hk3dkDhpXFKZ%tX|+=P{tV`{6nun%(?`09Z`UZzTft^ zT4s!)d6Qs%UD}9@oqfN^SNAHWffp%>SNA%Swu$$;_l#l z#IvW&iYtF;5TlgF0w-VeykSopo0Lf{Zvr!5&ZmezP`07=*OohpXo#?cwa7PfyguG7 zbDW6sYj*evSMrCCS^n^!A%VQfF9`Xfuv>kHu^sND`B>yArQZ=e@Fq$P zhBabOTYB(`TEaSH6chx))y<8?mbR;W7b(npGv3RcBv_P5Ab;3y z@U=0@5TzFz+7TAn@PV>Q61bAP-U61)U+n+wo)U#EbG&4L`)j{^@`pHO|L@Zp_cx^6 zSoJw+txhHtNdE<8TS&F~wMsQo$=&9M1FiEIOXm1_0{2&l`^w!D4zz(YZ|?P9Z|a07 zx%;4-bM>$?%NH>hk!1ct8z^g}9@$sM|MNOhCPo~wt6U!9kU5_Cb!wvvUqSAQ=lH7#?XR};nGJYUb^K_2tX&!E@%;*TdQE0k&v zXjwVGxEz25GjinLE6>X#$=2ABrzc3|p03QebJ+z-A4v{klGuBCMa>huYvMwes>E!; z4tfh9KT>W?h#Ui#Y47XS^Ew~4f+c$WGto|^4w{E<`h2%E)Jq=L9DGi%Vbe9%$Q52} zHdOlKdIT(vN$)F{Du8QUY^KVyXUSWiJY&1n$Thl$>ea`OcPawx4l;J|ioHj_V3F%XR3OnR!^;wnR3sRNqTMk{SF zS*=Jcz!t|1>TJl(5!m!WdTM}{!%_XZa;oyshWjMsLL@B5?>0pE$(=93;i}evBD-|B zwLD#)=;AuQ{sz*fz69qUNQ;u-jkQf>lJDp3kQTqYxdbouT|accBvjV$lteMY!r1&d zwI9vXY=-~eJkeTkT{_~8_d}bOX7_&|WeVH-fTDQx>7sZKKoPzB6kE~~XC zc61H~Nxk%FC6V3=5jRd6(eN_oONR|-YP5*_Wg0yFHewwbvf_nkH8J*x;wq8G3en0s zz&#;}X-wE!^@|)mJei*B$r5^mN+CvLi#*J~5)$@pa~8U-f9|6L4V^FN$aH3(&6Ra# zKQu{s7x}N*J>v4udn#dAmW7e}3icY>(oy+if1pLqaw&ujo#clOuy$?azKRwXl|EKqIhyhBU$zjm0%hZrEinO{ z1H}ib#Aq1KmRc~is^VJsuel&+hkDW#^T-PvDxRL@w@gp7D_Qi$oD#qjitcx=r|d)T zt>Z2xmp8BJm#)4TEh%*j$EUSRpcNJM1<;ouh>GeC_{r8;M52&3?*41?fCea=y~pDI zt8Gk@UbE*fx%sFhDs@~esbHPk7@)IDICA>a{%)re>hvnyjECt~UjF9a8&!HMXA*9h zQkmBQb@MG9bzt-LcB#^>bN5PoIJ};9aq2~677xpALHh9WiOj>u@bEpWul2z4vytd( zEev1gl7^sGBjc^7>G<`)!a|pqPF87ucrI48bTtNt_1>pvR_PXeF6iX6?_8{ljOt9x z-*_?n^?|f*GXA;(KK$ozr$6=DZl94|!m(~15jR%&_t>mGcP{;BEC*$AX(hTh=RuP# zWNNpcN6U~CUfhp%RDR74tmXlbwx#w$mwf(*Hr2PZY6MrZx{fDMLNo)5E#*3k_cP=!4uiOMQH9UrGh}xgcjCZBA`cgl{G)M|1Z(HeY~t3d znJ#zu&vpI;A)vZ9DQsy2Ise=BA`va;8){C4#H81{2Ld&v<=}=uUnLsweuu-bd>+G! z=`FqK^VDp+^GcC6v#0t>@g?Y>T@;`jSIWD<&ms(@O84}5`HCL7sfhZ(Y^=Kk{0y1n zlb)==S3kq-Ip}M~pQY_;-er>wp!R8K7p;+#t>$&I<}>HM`b=>S?S_{J0iL1ctI|_@ z%eJFGJu*F}LzFV8vI$CPr^A&%=g1EoJ%I~E?Iwo#S2M%6G|r(*_cgpumtr&7>Yi6? zLOCVWXUHHo@}~x^bG*_k#o}XOwq<5yb3R1g2jyV@fFLv8$74j%{*`TZ)r6Lam_P)aB-53I2k&@&CvSqk>p5^U+Xe% zojAnZwXHJ$ow&as5GB5eCXpDYo+dScg|raxW6!B~>eq7qR)aztF+=OO*F&3-7^}m$ zC3T~PQmVWDq=rOs$YvH-zdhVT@}>&yzm_gQ{5kth8bm?U#?m$)js}=zGlIJE2n%9J zJI_M=!B25`X2zEIXd*xA-um{h>74AZ6T7wbXP>)@-Q`7K&5?=UdnX*_j^8!I8WQbX zW(R)U$T91BXX@BR#yaNj6;3BBrZe=*2Oy+L*4NNQty$;TR)RrRr2DRJk5qJ5A4C*at0nU4Zfm<7Py87_{Y}qTB;314I=Qcu!4rG>~WQ2fnVl_ zGN^%+Si%%-h0Hxjgo}n1Grx!z0}(ZFqMZHUz<~3$gQ#t%*LpR*+NOy)Tdh9|b|x)C z68~AB;O21!9oGVO!2mY&)e3ghN2d9}>3hmp21)k@fwm^%F6V69Q{ss=AL&m51o^qS zUMO@J*eFCg*HlM(R;u$yU?RBBF-O{>wz&MvX(~w{s#~t#9|jIZBIm0I=k=O; zZRXrgnX(7-xGwMQGU)CWl^Cl<^ilyjjtj1&WDfw8<&S${oDAR)x>IQ_F0OPWEO#hhoT1;?Tbtd$Va*z~nwzST`OmeW#Z)n9OnDWATXS&=WHa~%`xVa@G z8R*MmdiD8c3I(jNLQU^9P8He@!5*mezm(@sv&k66eKEg?jf|=ezd14x++hkMGCy|(><8&**R*~q9zYwlL;mVGVA zuZVcTnIS*vh+(9LJ`g{|*W7(dEsF>Lz($1w)ux?$@qM@0GYq^S7t^G$BZAiV)WM&y z6avdYg^l>Yys0#Q%R*V^tUM`KK#ig7+zxZ`=kMpUJ9=(bJKRxJaIC|~6O%!6Vuams zxfjb6cFm_PvzW3l#7MHeGxd#lk$1Es8d7~v0WTlF)bvyN*frB3Ezj+Qa9ujQ1_F<1slQQFHwsGoHVcNgfbrbh5Pmov z+Umsoo--NEMatVGjAJVTlr-EzjH+SeD1HxOVhtjQdpZ0H^>uhwZ$r4@wy%HpnI(c& zze!ZBT7r#B1cqbJ<%;UrEO=+`WjCw^8Z}ous7=dz3K8wNd(yo&pU{(vrQV zoHKB4`F@+thU*zjcJfS6BmH{42|CJlr#zs!3GbPG+{0sAnGNnceQ`TMg1-!?hweL< z9$Elf+YM6>wQP!ZJ=BVquxuNLC6J$6Opb<39kjkUp(B3i;ri$abBz%Xw+*JoO;|RM zjLZAtI^&DQOeftpkWLB`$mMGicG>#;%*Ja!eveBHkD`RF$R4URBN~82{ zq^+>E{U7CtIhA72-up&+>c0=y|Ac<;D^Aw$7kLKP??1aPv9IgS0ZY{HKYND5GRFqT zJ3Qys?|*L_|I*_BtbRY~)sxWgFZ2wo-=CP-_l@-X-bdd^lD|$%V*DJf{61V` z9pv_$G;2uM^ZU+@75Uxx9zVnAMpK4Dd21RNmd$Ez8pw|v{mFjBg~Dvb?*?%Gs;_!~ zhg9nGWFL22)l zBwu5BUvSs_99>jJ_cA8%_ly zVDlRuHenr#Q8VT)Pd{vq_tHjC9}^wwDp6FqA1QG!9-7e?`~>Bdji9a<9qJ3B$b5zf z?;_aRj&!TLU$0t0|MU4gzQBrit=kR8J+u0PHKM30#h~8Bes-uRZ`RBjNEYeuXL#p) z(A*I)Iv9?Fo(CecCEhTrFNkBJ-1XgAh-VI#XH^AO9o}3Wb<)vK+vt(a2SHbgf9!o! zXz8uS`9wR9=KW%ClT04%Xkj#oopD;rX%hx#7pAwwY{0Ek2g3KXN{3Q3=Ax+b!AX(2b&c_eN01 zOAgf`iKdKHq~}iQ3w8uK-<3U#uWuiSUV{VVBTtz!($!#$vaRXv^KCLxHPXAH#v0pt z?mQo~v*yn?nrl1s%+)O{9(5Wqek3{6j;o0=P7+nb(SMdE)^w2vv^N?4RGK!gs+JSC zRkxg)JEO%|a8=9Mg)>{|O3}P~Zw@3!Z9kVBl{llcmb1BHLO#8^zZ_+q&pZdn&!Ze= zp3f(4(4tRpSd6uukLP?YUs-1~`g|^5rGY~|lq)j%3eO~Q9)uI5P$`wg%MkpP9+d0cnK=|B1FW{J{;{&U4CQ z?+;KfYv9-$M)xiNW7im)JSK5@ERV@!PJMrTolbq<7|_m`KYujF!Xc-=dkp6zf|S=7 z74sVJk{oKaB&rC%HZi~P2QyG!%j;?A9Y9`-=hSoCFx`{5+x#B0_$S>P&!-nnzrUk} z?;))P?=$oL-@<+W0<7|6NUbM=_SeVbu}L8T1_ zQ^q9d;XNBc#l7Rcxr|p7kGn@XY(i;Y@SOXr=KI5OC#9SL-m|f`c|BtibT7|3humvg z?v@;Cw1ODpB~e8g$dUmwO8bI)7<}JM@^yP`H7|~vem3ha*=bdD3E5Ex&~rEqWW0ZM zndE4F8psImDC64_^HJ9f1uY~($;j7P&k+BvOB8=`7VPt6!M>{N3sr~}sF%NJ2a(mcVSn$V-&@<)`aeZmvszVaaoPFH7?qpF{GQ@8klj*#&+1+(hw_QhB^Bz52nLgHqyl|O6|g?-jlDF8 z@DrGR?HV8eLXQ>R=7pj8!H(Vzy;<;{P&rq4P ztZzqom1tXzc1lj&bKc*McHsY;qenyeV6gs*y)?L;QrER-sT|tPbJ;r2P8>rl@!*Ynm!U~6(q$!nT-GO;H7o3$pl1U)NH@HL%UDX4r+`R1Bj@ijeK z%yX(GL219bmj)4jy8z^8i{X!*(kQ*YnEP!nYK#S!Rly&37lVrMw0h%S-b;h{?U_x2 zx?3F8*dZ0M=OqlbtTzqosq*`$dxM><7Yc{>2T%6~`MU+|op+z^4f0wu&iL44&9ON? z@tCj^djxe1v+L#Q9p-r7*)M2{$Z?GIw-A)}B@93Ebi|oO?B^o(yq5i3z<$1eHE4C| zaEWl3%GOx-t_JNUv&IE}k84}L8Z=KYEyXiAoaiZ@=m`|(J)CEvuD3zrx}IHUKpEn= z1ilcQo&qWTi#p60vzJU<9!`0j-`&^r1)HzrHT(j_pw7YH@8oqN0#%^ic@5VSzcl;W zM&k9z3RU~h$+g!CQ);gjrqo_5OsTzAm{NPKFs1fdVM^__!j#%;g(T)b%>0u6G4+K6Q$^e)t7-E&77Gp7|m<1`73(icF|g1duC+@m_l!B9tOs zZyCdMAQlVtvr(Wed}z##xd7ob04MUxHKRZSAgr$IK(SHBB+)k;pmrO8{MabazB14D zq#4(DykAc%AuiV-Z?VT9(@|hFWpRK1Bcph&FE@eO&jDnw$s4=~?_ou1!$`%yZw+WC zyYP;KuanXBT)krts8bHbg1D!hA}pvu9zBW}?!&yEtvf2zMjRl!6_Nd4`x*^yIM2p= zv?3MHbp30b_tX#Pyyx3HcyFsX|C!idH+lcRV!^y@#ebs+rJYh9>y;vb(q03KfAer2 zd-i27l{c)ASk1Dw^Z2v-da3+5rLMe8Ub`$WP4WMWQdc+IlT%LvCCA?L$>9VIdTHrj zDRm+5{7cF`PuK##ncXVYW`**PrE>)0a!>!5zpPQowyWNvge_!K4)WWCj(+LtZytDua7I>MOMf|eTZXRp`YQIv@1{nzM3?YO@bfhGY7o4z8S zk^`#m$>jA}_&rF>-#4oN^$lYFwhtEbH|4*$EHh_xBIa*fQ6lDVW6|I-e+Z|kPx83k z)R@2JqyN`2fB)zCMB_&%`ve{+;ySC84Qi@S!2e_-9{sA(OjjK=pQz(WuB#3oo$v|# z0C6E3)WLiLm)pkw*69DNPry?&xKH5HqJ&RiVo|bBpg0#)P0Vk+W3`}tGoQe(lI&Do zTYrB>f8Ct^P8kVn4*Y$F(dvL!TyNKYP%A<4KRk@nsqf(VOeJAAh_!fDZV>qYA*juD zD*j`+O+~ogq2_v{Zer{bi2)Xk6hKy5aYKY(0ceW;Ya+YfUIa!{_N|7hBQuupTiae2Jv#b6(>0DWU6^ktv z^mhw!&sI)Gu71Q$?`-^Xu-N3^jp`qp{90imHu=z#y!OjrvB`X`Ufa68@qH)Tqy*n_ zZd-`sK%(Z0Sx@6?jt^=f*K6x;g<3KM3$d&kBK z>c=ZcQ$U1m0a4iYsVLNblm>EswnIgI$i3I9bM0jM*NP8#ZAaGY`2(cgxeS(&srdJ# zEB<02<=}wYDv+)#c0yS_rScm&e5_%6K@&5Tc1xFA@BwJ}UDa^KUoZ0SydYjzpU=N* zYe-{yRo@5p@AC9JK0ui}R~IsscJ(oy@9@8P+X>~04p;^mDI7#KE9b_re?1kx(TNhqQ)_%K?*OaNd5^A$fP#NX- zKzig>Wd|(XbTnOkeS~0aV0)GHhM`LP+SRcjj=fP(+Aqevii&@|J%?gcLdH*~$tZPV9zbpVvNw<$Rij6gfja3jI>)0kiJ@$SA zS8io^Q^eqcf1kBF7UVUg`1^-#?|zTHo2y%~C>K8lT0mqqQT%b7u1LmdPddo{)t0Rw zkN0_hAGFjxAA7=#ks874FMh$|GYaD0y!$@S^+P!vacQSm7}o_tVgbXUSkgDSdI3A< ze70Us%05TN_gTos|L^!d3-!DYto7yUpQPs2#C5>;&PkKh0xSPAPj4zl~d=Va>(G^DAYKf!S{a5P=TX9u5PH8|G>M%e084nWJ8T;%atu_J4s z^(xjMF(i~tVZVP;Z3xObe}{MLL--u-8=V99W#+g+Sm1@>H#o8@ABnn}i>xvG`t_nb zcV6s`1)vqqNY0C$S@8d!7dy28v>#Oso)>%M7{v2pFFy`uUTlJAC)J_nxtl&;{A}{| z5e1+f<+8319B_l%0kw9xZFPVgbUs6{!VZYCK0W39Oiz}|o5D&r57 zx*nu77!VWdztCF$yu|uFXHw?st~Mg(T)Se_gvnLL+t%J@TxGmJXs_n}a-QD>T0YD7 z&C`G70_{^X-xqNV=_=wElkZ)4XPtUCyI-u|Cd0q4!!OHsv9gL7mOrAC_qs51hVxj? z@V^GB+v~N}*BUH8_-R){m%5_RmLFU-aDH%&Egy1rp-nCyARqGVTeF6V&) z(4Lri?tII|ry-upd8Qzq%eiK-T+W|8&h@38ICj;!#~yYXzG*J!c8E+??LQ~W=aW<9 z^T{dl`Q*5KZkKBkz8%r#+mTXyJB}91&l;U(`gT%u(M;2~6EStsefbIB&PVwP-_8g5 zTt~J1EWgPIZNgYlJtP71XC-0)6TY3c8Rv@Kc`sh){`GvD@3eyZbpAU(;nVp=e!`~{ z$~WUJnr61#Jyuk^Y(5>-VV|4P7ksy$jfBTtBA`_xfejLfIKF%)T9$bFk?7Z;X1BY5glSSR*m}-5O68tf{(qlnQ?> zQh)IZx8K#|aQoer+i1`ON{(e$6|#vT2+#)8i4if!M!lvYkX{Q;uOZYUepX4nGzP9@_(I z$LoT681BO#hl55bv%w-P>LrlbzM7Kv_3>tNUz_^xD{SqndfbYzXXX8N0u|J=22RIK(g6;stzsdIeO55{2w&!Jc zfD>VF*W;~o7zq9~D@aqvWnf%t;v>p7bt13hnuLe5`{SX@!o!ue^Lp@dwQ=j<=k=Yh zIj^^GOW>hqhyPoGTA!DI|F3_M4FB)ECx-(#Z?^Ayx~NtbB=%jGvhSQ%XmBt*M)~)@SH*%X zZ|706!wo{u;TV-eBCsBL$-aPZ2Cw6i=(EFYb6@}a+pvN(9X9g~7`$G%Tzx>Hv#Jlb}m?1`tZ5#*{wD>ZLsK^@1C`}b*`B7!`A zRV*0R?Kmf?8$1bEb?V8mdf0^3v8#y@eU$8|6QO6}+U8pi4MOiKzMoTzH1F}XiXUm* zSZMI?28Ge9T~J>%^mcGsG_l(Dx3t^A$!rM%$l`ghraE$kifg_rlZ2ZA7Hj~Jt0GsZ z-Y=H#C-Z7f<6K?`sB;OZ71sz~?dqd4fYN@3QkQfdteF$JLakDqY>XMUG3G|DP;0V< zM$eim!y2Os$CwUDW7uV*-1A_~!rfP>3mcqqpN|ui_GkaOd_UrSWd6d_V;_qJqX4A~ zQNJ2O!l^m1S~{rBSHf2{d=CFbt*saDQDU)IKGGe6@p=zw61+ug)apk(ht~?;t~ecgFSmm3e`(P{duP%)7fR zw9j1@y>RCKLr$`mJ&)q^d&;VYfjV~>+z>kAF6%&<5kMwvJkW70YmA6B-adC(9nu5< z`P~a=?q_31-DRN+9z%ftqwI^@(|Rmu+=K%3pGj^7o|EQy-sqcUenjqx7}c>v}7uzB_u+{>(9t>_0U6{{8PlrhW*rbQlKeyO5#( zF82NX8T;I2zl&Y7KO^ccOF!Z+dyi7rAvf=l`i|GlZ3p3YUgJSX zkF*N_hWkQb_jfh`-tF2i&qMh?VIOlkNSNz=T%T^P64-frO`QPO2s18G=j18=J*z=W z0}?(gN%|?t;nT#lSl$LgJ?SLeA?513SzJ@TeoA!C zIxH3FLnsY8my@Q2yFHDOJ4yIc5yA?>D612p{PRc2j_U-)kK@#VYr%&S z$jxF_PYd_q_;-pB9;okRR*cH13;&H$7t*7DvOVVNol+*_+yCgJL7ZDN=iil1!ly)G zR^~2mW58U;d~*#Q%y*L2vpPoQTLdVH6oc8PH#6QB$1Mmw)hGDAZ*PbNKNca}Dnj^G zvoDSyB>Li5v`qpM{)Z&$V?`)AEP;-A^|>VIh!dg*)LnfvDBMB9^#D^V1;y{ZmgQ8B zthm-w<`y7~I7bAIXE-JS{&SZk`Z`(s4(P}qUhShUw+#mo@BSr${)Oc5CC64+^{pj+ z<>Tb7Q=`B@y7QfMkd@tI8^t5D%Vr;k+FfZ#Tc9?Q1~Novm${Ea?U%0RqHSp~^24D} z(s>67BRxZUl81cUq-C?A?r07u{-;4%w?tI@%|hOSFC>t0j*qfHzRv*Io;qHGv}(^H!T z2!{kt6B4ve$>}xw750xaVKV1FOE$M+ZSD5KH;4BHEt~pXS$)BX0IjYpI8u-WM_5kn z+A_7^?K1Vuje?pFyxzyrOi^<~{(>(=rUUv>C%I%R4SF4lUqm@I3yxHkl&dhkOucQZ zS%<@nz5VA_UK7MxSE{|xlL_*Z^~_hr;-3DRDKh^=p@SIQu3D)7PeUvi6`_>JQs(OS zHi@h+H0xWN*~e;BiJejK-lQrACUrojyv{b5nC zl?LaoB`snWZ1?6V{;Ei>iZE%}N`r4x>N=1PBexFVW3z0YJZ=lt0LvlIP{C2IP8{Cn zO71x)=#`-O@5m6eIU)(qcEBYb#9aYe&*XwuBQjc6QUS1l@Lni60lcTSoIAupAq$Qa zXYqVJ@1k-QTuOWG8rHL*RY1M}K2G}>e+6MLSx%a|B-o3*NAy&l=?XR%%?79)_Z~SD z&1fzP01QcuX-Tc+FTg6lWyd}(Iedt#UHPC92}(paj08dPR}G64g+yZHI!G8Yi4k># zrqrcFZ4L7$@;tM@QW}g3Q1a84O`T<)sCut4&wEk1`o_!2@!;2PrNN;9&Q7Vo_c_Xg zA~B>o(q!4C9ZtgHm=&lv074>;HTjIpx>zR9M!DB5LG4cgWTcVJrcNEoSHif?hzN~4 zDBf!*nPaZA@;b$jYem|zC7*=TL?{hCPQq>p=5G)|KG(Ve042|f5axUm!idLp4N&_L z$^<4JvU7Z|TotcZ{7sL8hJU}1Qh8xI-0+wP;bmgMkX-4qA$1~;AHn(Nt{8Z}=qXyF zFgYc6DDL@(0+fV0LG9RmSz~b>@@1iCV^*S1mn4F`M2Q8%`4E1KQr9vuZB~U;5SN$4 zI?}Wy3TlYeUHaxd`Q|9GU??BgQ7|-=4`JMUh*DR9R5+_c%AEzUJ;w_LLjZDTA`1cCi#$gv2nV_^gN5Ves?=uWhgjVDuC_kiSlkimzDE;uI1pZgu1?sLF6L;Xm zOJ-bZ4)P{&?n-%Au)X__muRpurQhQ6mpL8pa1oBmI_AjVY!v>kL2<8hG~TOhqB-Sm@*3ip%Y_+R!>S6UhgXWm4N zc>t|Df!Dx#I%Td6HznqJ)0}IAOY#36WdWHOI~`E_xg_a_B!_QHc5_kZN>Dc~Crytn zCrxuB6C1mwEFFZ31IlSy(veGy&PT}()J;AIkQb)R)p0Y|b!tQihX?2dFOGzLRc6dg zH4vlA4aig4og%a{8XSnw&396vYp!jwViuF zh3w`cyo1tm(iFIv7do_;;bc6&o%esOI1o5Vr&=`rHA-DO z)1fv*sa$h8F~CW}8w4`NLutvETaw2W<|NjfZ?3s=q~d>(Qr9LCX4O=A8odtIGjTz+ z05ZEL+x;_+<$AdkrgPYNK@%_(R4VB$O`ZAr)nGSc{BQQf$LG*v)R&ky&M zHa^Mx*oARtB5X^04hyrXOQ49)|Ry+5siM*lg-t2+tXU>RrO%xewv_r_IUq zB9!uO&Emwn?{Dr;FK*is=V99i7`V2A!&nB7%tf$(il)C;gd|>`HKV@EFSz_L%%?bXs*T%o_j(13T?2gY} zPMYxUg$CeXH>Se(kp%zx}oRzvxh37^&K$ukr zjs^EIzlStyVX>&XL0s_VNh;UOpHsGBesNiq1JtugzGKc~8IA*#Jkd*CQz>;#q10tP z^Yl>{&&O+RsQ{=22YfHd&bLWW!K&wwi@ew7XTAr*%H^zP+cxp^lC=O!cK|f3Q!WQX z5%IaOEs&#Jfx0+MCx%CY))Vo#h&(-%1>51lZ>j5E04{wLhNeriDf`723zO<>DuIyP5iu~Ww-!FS7Y(qxPU1LX

@q;R?7ixQY6=k3ihJJ)oozW~|C7!e#fmjM2}to0N~W*H0h` z!tAm8M(xHt#QNz}2h;Ub)@!)yFaV?3+;?rMpUAl;7Q5@uYLHuW8RB!WAhYcOP@m5J z0eVp53>8l#1a#dmy1jF4>Zc)F#fLSEAKy4x*^?C~WLs>>c;bX|FlVz*4d@^$eTgA7 zEjIDZRKH1X7YyA>;~o(2K=JrV4alaZ6&vlt?-EPEpK|-mw<|$D>{w?~S}F67X*qUu9wy*4E|xjMD8ox}k8OxC`;piiGKzF=}dN{b#NMV~p2%S^M6 zNHRFepn1-FO}##NF!A4YQ*qWI3X}gDEI++=)2~yjAP1vd0IM9Ui-qr5gM>0^&q5cF zJP*O;O*hWlEmG)6VjOLD+7m^3={CevIMSqj0~g5Ffq)P0V2RRrRNWL6RUJv>k=)#R z1d&^D+FspqzcvtQJf}XOrdXES%=^nr#@!H@ZX<`13qu=xxLGo zsAX$MR~Jt4MHQCFw!mlA(I3a9{deKI8naW)45Y*fKDM*b&+s81wRM)DVFz>3EFs>2 zfnYtFY+L2b)+8|ZVF;7Odg}<7WTLXAU>T4eWECW>CKrS^lrxEc3}yG?1KNtm@?nsU z^w%;jqr~MN=tR@QvvY4wQ;q0GEE|dem3kvee=AJmhQc--p)+2usMXf7f;dExt&Cbw zRpGT&FxQ6?!&vKeZ=C-?O;n%j1`OJ+?V7zU3Nvi(QeLV3foboYn+t2Isq1D*lg zXu%4aXmm)kR@^PJ{kbgmwZ`uM*01RE$Ek93|5N@IUavTu_5$TgH=64B%kB7>mNYcJ z8tP5iqo{uP-u-ds>R;~M)bpweFXhn^E_Z0k zE}{)(6~OD<2KbAiw@vtTs;EWU zZ3Vk;=}iPx1y0<@^%q)Oz&Gh9o?ashqp33qPXr}W{qw@>9N5%}Zuybq2cV}fD z6Hj~K)w32bwih<%P}S0qF_*IxMcczSG(UdNfl%zxfE7+)ZXE{hN|n-`%)QBG!E{6R zDoYkGpn!31imP|kzbfmM!jUMV*1Ci1)d*wx+SYtl8+UX`{JkCx+g|QOfRJIx=a%TV zTLRi1PV5c&(Mz%_1**kddDm-PN}F-7|16WiWnZ9n_mdbg^q*`(eSzkf_&4I9`W!z4 zI@|te^Q+xnIN}ids~r9>0*y!MhIpeje6BO&w@Lzi>Yk4VO%W-bk9I@$y{c!!{1<}s z!>S9`x$-bLA2qn*t5w&RHQ?7pUHH9|XtH&8IaK?5C()&-al}+v{a4IN_(Ds*>1t{$ zqh!6l>CSP8Kb3q8F9{7K?*lIli|t# zjs6@1fuc3hoP&D#K*XSdExx+6t~587rCvh}KFVd+VqNN0UzOmQ0iYK%EkfEBPrVr5 zAoNJ|Pf1kh=IHPBiJSHqTJn}};;sg4CJU?Ym<7R?dpcZRIZ=SGJ`l!61P@M5$Spx1 zT6mOwM2Ul_A~ahjNuPZaY?r)<@WDFI$(9rUIt@CeU*k{%Pd(?t914)F9`xDjd!7}~ z93J>_*I!TK!Fy*N(|KdnE1gX)&4wttpwuI~ec87b7O0*+SpORt^q583j3>6$Y0AS|AmUO@I&JapjEaqnWWb~MJQcj&g^4BW^H|XWsmZ>MXCn$ zDsWLwMXA7^603Z!Ne_4KR%7;Y_JEqD+1m|V*EeU6#pZ07j`@sD>`)dE)_PGv1XPG* zg4+umlwhq~azi+mke|s$u52K}{d@<}S)PM#!9rpvL2P~ngosVHS)mk{on#=;+UBc! zkkWCPB3=IiL0q|@Qx0dq&J;hRj_!UT7&c;hV|U6UG{~^;L%J5nJx~%Nf|2W4xz_+P z(Av!~lslvwy+QMh1Cupf9p-pk8rgbPIYrm{84b;(0Md;VaOKk!dW+JB8a8n0#kDYj zbmdD^88d5`-T-X3P;8TY;kCh=#Z}2`O3;w}k0RX0u`K=h!?1_5STmx_a7q#O4RNz_ zRtfy4yX$MzlmE)Fr_`CBLTAyB!1crV|Mv_JAl!8Dqi2%qj4plzR}wf^5gA`Q6u(t! zX;k<4!?<}|zxmS?#)$J|T=(P~&^;bEI2tj6@lTzbL7<;9N56h_ZVJes{(~L(mny82 zAHt6rlmq_}(foV}?yoJ^e_r8kOSJwpK zQZHzbTDdUK11cBie3q#YlNo4h~%W3QQ?ag^q`)r03Mg^F&PJ+4ca3 zw;QW*I}{F9?~F?GGKb;X6{B%TMKdr@@uP{3dudKuze(P)_)Z4h7YceGlFM=d*1BXO zCA2rl9~4)BP##}sjlLX?J~9)N9;*yPh6dSIqETWZGM(E$8(EF7_(<{H0Uq)yZJUTA zp=OUC4o;2$Q$sz?4le}tL?7|bX^^ggyOky-*mBI(xSKFbHvdd+cmEnjf0n##28rv* zZ2Wrc42rSjr`3F>zXp%$KM$jS^r!0{FMN-3zi2_)KN8_w`~@^VbgzZ==DYWN)1H9d z=%?*f8pUyCdNDE&V4u`jz?q-gf>w_1z7ZjA!u-Qad?u#~2mOuu%P|9H=>C zu2z8Bwx<0xy_`;09>R@;Tk~+-ktJ@SLaz4qbW(cL-rKZxBUATSA6^8zKwJthGfJ17C)3l|FT_o5dqq^nX<_P+Wrbv>EClJ zjQzu|m1)GXqTi|W@(<*JN}o+SU=8q{m?O{Xd70*(cC{ynth0<>Uh@QK#v}0rQ??FZ z#vsjEQSE@6WF%}SK5Fp@93m5t;KodL`)RYO+lxm=){e+AuiO7b*_4RReZRd7%mmS-B9RI@i-FqU3DslydzJB0l(UasL~eF|fC3DL~fZkEUiBEfVa0FO!&K9tMVQDeXS#M8H%h$i2pI4$OoK#{lde)^%J6B z!Yg1jG@^U{^$n)#n9lL1$^BeA;@_>WI{H*Ry7_@p0ZA|f8>S3d_zqJA1J55$mqmJM z!_Q6QPv2p&^9%C$5n|=<*!i1@C2#Cmh#=W7HN-!xTOH2!_@CCSf91>y(6rl5Ayv|c z#qFL1!{;kkF$bB=h_ZrWLr@dKOIK+}f*DL}a!^uj8BOLvb{O782NVpo@R~N_=CEh6 zfAzk5M*BlADlQI5v_AJCv^OUz*2_McaB{Ko$+yKCS(M_PlM49S_f*`!WY=6#GT)$< z25NmYpvp+Z{xNz`WD@QE?__uX#(|X%B44H;E!zO<-cDnyU)17=D&O9)P;qLnPdAUA ztMsWi8^)#pk=6a7ErU^vSSg>!!Rj_ge=gVrvKJhW>*^71lm&KE`uhELL_RD(tFmY+ zLrSLf(j0y1<&59Q&~pPVCgGPs{j=nJakDJlfq$f|{#xX}_=}WP2k5N+RCT=-E?1+_{;!BxbY|Qp4R?(2h#`M83vo=Nh)U9}hgIT!KWS*HNv$ zI0JXqfyD%ZpogJ`N|VPsK6yWY+Z%~WJ;Li`Q1NvAAX=2#32h%m7TV*$?vRb~Q=kI@ z9X*WA5z5EnCq3c2?-iigI9V%eUx(W()2oSiQH~CmV)Q z0%VKY$9n;p=&q%J6eseEJhUXJSG%#TiOxuo$9?q#RtRnC(Jg0D1=XXM42${D*_Nq6 z{DeySabL#r^oh?pI3nL)4%v7CseBw9cEOetE&%acmMXQ5VxakL^kI+=5Gl`i@4q1< z7}-zhX?3?rx!XH?>cX!QrTRUHSrA$<59`Ej&Q>jM0{KFR+rV8{NPq%Ax+FIeDenmEQbE@y&#+lz z6WR!rMG>W#2ydbIxfc6jYE)UopBq*SA+*!HsFJ{QZwCj2oZ9QS(|}%>FG7K&m)(Ud z=x+H8Vf9;4?el)=qDy)Sn$KOa#*r3$=-tGC5+UG}#F=-OD~0daL5`$+$X9GHv7fl1 zc=A|l7c$}(8|=#md4U3Hh`A<_v3@>|7a#_fI+21ZxJ)QWG^Jwl!r^cr`7hdmD6F@! zb4H(F1EON;;G`&*{<3J#veCDJUseEo&}5#D^XrO-=Q*1jnrSVqEOYv8HwgHbCOvq?ANr}hB);yYoJHI;MqfvjJRA*Sd^t z&&phKW4$sLh$nNHT;pOcmW_>Pj3Dlsx}iI)t$*V^?vIi+_m^rSBYueoV?X6Ov$Z2$ z5Hp4?8W4;bjv?+tNz&$x?g);;rAwltry-~+Iy3?E@Oco|2$zC^0kgyY>& z;HLnnD2w)|ih>pT{8a4>1n#9TSi9)XiexLBJeo zaW3Oa-Te0>XsA+GYrn{;JpRKnF ziG|F*mG_>-t}PYwhA?H1cCkP`ghsVdU~YHxo*!ebVSFTy=3Vy#VA$$Jel3G~v?>Zo zea=+jcHHg04n~&D zsbcVT2=@D}K%AYmq=;(b>SSoXgejAI4-R+4hoCEo3_$>reEPRUZ#m*ugaJV%*%nqK zzmQKtX_n9v!BI?vWk$7ssh}Cm>?qx{J-+1lsikQFc!dJ%2GaUYl$Ds_AOu9|IASFK zY`l;Qzo6+>{WtXFYf{wyi<>V7evZ*qy7k-5w`F|*f4P*u-^tov-O0dTU&=p{qxxZb z`k{07rE@m^EjjwHYe3li_16B=odJKhwZGfh@9jarze$qb3xq>3ik{?|JOjelvnW+H zc!Lsa)yZ)_o>%t-s5i8!8#fWzlqIa1_Wg4)>tyonFj3Y!ki_Xcr-_oLNAVVKu@Q^G zZAdK7=tLn}1>n>)*x^m*tSRWZJtkPSavwbQO0THx`@4?Fj~td_&$wYlDU~swtAeDj z03_){$S6Qxz!r^3R;FIY$FgE2y&_zqF-nVxRe{OwO1O~_pKj1y9;+YKA;eTmfRb2+ z|A)K(XnquHoi~&(rgm|GaS{?p^eTfM1`3q^wg} zRhjYfFaXO(Xc7%kXysg(3 zR#Jd-mGq#zS*Ma)Uq1ilp$vH`Sg9M*_)XL}Bau2T5w)G^I1p_YTo- zq(qfLL!20w5FlYYT-C?NK}shN$>IK0Z0ZLe0sMuK_`QUa#nTDT&WrZxTo}f;BY*|c zsCe)r0$q<*P;M-b&l?;N;*;V|jPB|MFSmgw1ng-F0sf|xIs zFIT{8DQr|JWBs(g`vjALoh-}kozp<$;UGWVA-=bUR1;qAtl>JgdjjubOdQ?vFL1;G z<^Ua!A5_#8!|*xI1~HLA5QIIaDI5L-UxN~z-mpg%e$KACXwO8+JA>v=V>A=R0~DLn zp6+@f<(fKvLe3vzwA_%x~&oz zp8Mopm(O~!FVWb!$=L~6Z`gg@FReYOkhY`GO{DKDq#Hp)sn2j|^gnA2;<+!G$EWyD zKsNoRl=2sz1-0vJi03#sJ6W*%2&vyGa(-f@|G6dT53hLk)MwzAhrXM(%AEY4W`w^3 zopk_4E92khA%0{Z*73`=_V-Kwv2x)5y7V8<0RQXKtBSAw9to|lNGSj4l+?EtBtmgu zKjhNuXoBXpty;CAk5B{eonN)yMB0Ex|lKyCqg^+as=2dZN!5cA29kz{76V z$69PNnHS|!InqSAc$0V#5K=qWMKXc}(Q`{1y!s&7tHrE~`+S(eABuU4MGk#rKL6BN zy!^B}Gx+3KZW(0!W|^+~K7J*OsxFIC_5FU}w+|4)HjC4d z{HCSjFU%hVM4>VyfxpEpi)3%Onh--0>R@xsM9Z(64~9o?dLB*ix=}|Mq-XDeqo$kQNh7lO$#H@MiuK)` z4-XPBGUh!Fda%dh+Wuoklw4~O;B5>314+&@?ftLcKj6>lugYa0;Yz~! zlMejJ-?aUGD$HejqfJp8$`HFwMekoKJkbC4rPY7=(gHF2+i9`>*8wA$7xfv-PM4c!mRd{WcnNw2~uz$qDtVH{gjltzR=)D3ChOVxC}cjKAp6bvak zP07R7D`3=YCBNm_{~$Oi-?{vmFO<#e9wd=qa<{Y|@W#2bTKM?6xv$|fP-dHP8ZY)K zt%d>V6+dvnc{`8V&-#oN%PP$Lag~}%%Jm?3G<@4lr`t@UGtj{~UZ)t2k2>`YJ^FGE zmX5uB-%AcYPMlWiI@g~=)iLdpRIa4%j3HY+ZVYwf@z$D5h@XM-2uY)iT@IVc+yL@^ zD)JtKj#m@-^Pp}I<}vFCg>v#)Dw2r_Pa729i{sz+5WDvDHrn9mk=>6Q%-bPAic?S7 zEtwHUYoM_gzLU=bJj%}Gf8kdCrVjT4ey-a6R*_XYbiD>g#AP0*1Wyy9PE$s#47`0M zc!A&OE-K;2TppQeSO~_ z9zuKD-4KfsGfB**L!P>j)=A z36zv~!KU`LnbRuGYR?n>Xl!5$?7h=fnNuaF!N8!;Q9D8lIWuvFxVSOeg_1~cTzT*E z?)=4BNl$*i>R|jQ%3vJ%<Fg+#P-s_y3>6-PcXyKX6y?f5qLOy7m8e3E399Mp#63NTfDt*dKJI$)6y6AoZi` zEi4@qdv}JJtFyw4Gz)&Ek5qQ@0Rf)p9IVY7$r*ROAKQSP3n9hPJ8Ac*mwU@s*iB*CCcOZX{OI9cvr?hTZ)8r|fyFnS+4kwqc(f>T^;xa-8_!NYb z-U{@bMOGsb)*6>xU9+n6kY~|*&QXWUr_7h$!M9v_n3CpRrzN&^&RpgK-@tOb)7(0D zJ1t(ldIbgnM|URnICC!FN6v!=AC(f>ycwrw4PbK`;-Az{-(P;6g!*Uw zRNHBZH{q}YkKc99{l?$HkagQT_#Z%XoNkWvcLp1C{3U<#vQzrrTm4lTxi`=xG;R;+ zM<8t&DMh~00F2B+m3_;9_Nj6*taH_^b2|Kup!mzRmJ$BiImqpP4vgR;!Y4s&Dp( zpIzGFXC*f%Jx4*5Kg~C?;2@Bu3nNK5+p;u_c!p7%3y;9^_B^mLKlb%=@}F#MN^P$| zyspronJ+M(n@&;vs|GWGNcE@s{M@wtdIZ~p*{!+y;_MV(-yZYE|o)fNq(UDzVOSOG}mb7P= z={4t1!CQ0xyp$Z!hb8P0-9?^bTDUP;yR&-wsscLhIEKYseJEd2{WEbsHr=?_cBNiI zO}t-(47=q!pmT+#zMVqgj6$e$|McJRbvsJ;5p!h%Yld>gZLBTiICK_0w3e5`cQNLz z+@ceNT!6makwC4+{=|ndcd76LQvHq1d69!NqD1TEL9-`GW_lQ&K5_K%l!F@dGqi3# z1a$#|*uCb$Odt^ zXo0Yaw1ddAs|s$NU%rS$*h_50ML|9N!AH2Z+2@cGV7%TN|HmA~%CQWvxW9-0|HisL zxO@`m7rXaD0(+GvU5If(aO?PdVgIVQdHLk;?ghTwY**hsEx6}lx-`jDeN~4R6IeV; zTl}H5^u|=x%2d3-SQ$&(QT1c)0?<&U&qV4@Li>}A-8=jC`@g^Z{=bPM{oRb3%+PE> z02ppRp9x8$bvfX9>r=jSR1b%|eM~4Iu*`$xW4`L3{G3<8RUG2%jd-v)`0A@WyI+78 zt&+zHZ_JxPk)`G!ji^}WR}6dcc%w?~h*o5!#!*@olvb?`BL}rEpWWRAdXnJ43)UaU z<+y&o&)xeLj&#H5m$?bVfT4Q+q@!1?T0 zS7w7Ywx78E827zYhTTCNLVenhlq{ZWt6NC6B-defK`B{Q*@cICv=`CJKEm9;QbEkfeH;3Mi$Fyv8Bz zdo7V!;-MmY%i0`d7+hrU=j=n#00^*AAG6{(W_fo7O3-vyDp{sun4B)zBjFv zNGymmvrctH3GCFyVn3g67EXL$|Gb8MUv@RQ5QvxSCPx7ZSt@Hdw3kkXxldo+rj_bV zH;%#imRt2<;?80G5PK=K>=HV9=w){5rk+@QNBlekT2AzZk%`E#6wZyKuZDKzO0qsk zQ$z@}8Xlyj=~9~+>tfQg-QZx)8vkW~Mn`yq2N3H#GrmW45|@bE9#Le&;_^ zokEw0n-nGlgtoMw=Ji=W@P`Iz_H{D|SnoSvWlv@+2J8w_2)WYxwb;$>1M9FR~l zV2cx2Tq^%0`hVOn(f?1~C-?k#8tjl7wEf;^>i&!FlLb|$;L`4o6pIu7jP7Z}F!s&Y z-_=)m`qZPJ<1ru$#+*uVpEW2X=*w_vOuuEw=)WdPf4z19_Fve!|8+IMFUN!5 zt>!SKY(yU z<)z~juM5~(cbs~1geDCf^=|M)>-}eC^YcC858BbBkJz|QiAUj^*ukLT$#exGm$Xtt z8oz5HsoymcnZ$j5#17K4dJ~pXw6_xS(=9|D|#JKL)1RyGB*T! zoYMPP;S zx~(_%a{8d=lvllO6mYU@44>3ResFto6lM!~HaZt}6V)~BGe@Ex8X5-GA;5SiA1Nkq z1KLX9Aniv;1Qvj(C`PaG2ST{q;k^MC;rC85W7k2l1(lUMMxPHJ&=fRwhw=rf5 zdw$?c!_6fI_IwVbt3^u1w2nuP_gwhBlk-^!q7$tA0}Zelir;AHm}+y3X@S5B7GK%)2&dBQ8!%h9+P}Hw{t50&7JA7*3^5=yxo) zkq{^bI9{B^EGUwzvCbO2{x0;2`uIGYv#b9M@mahU@E-=z1WvvYvQ_(QsI__T1pb^r znsm9h_Me)Mg>R%O7c<39Epntp8>M-zfJv?ZCzrX)x zd%(Zj-+!|`;NR`<-)-+lV;JyX2uCd;HKid~-(3+Vq3JYuSN2b&_9NQM0eW%n0UmE@ zT0Vw~KDkVb9cFwd(L<5Vqh6{kCQ~L`#ZU@Ch%Kf4so9_4y$Bxa|t>5EI>P|l}WgTE_^<92QR(9 zbGBMpf_?Y2UkZaM4NTM6OT!5}tPh^|y4X|ngO@~eXc_~D3_q*VxH1L*JnH3z_)qv; zm5(7^pu<0!pdCX*fw6H0MYA#rG1~cQ5C7091pXJ{sDIUsavnh7&OO%$T9kvvq*>toIcph=?%`&L%e z*~30*?I1%K%K)fxlKf}ZREM{l%GN6_6m3M$m3k{Lh+}fg>oGF#TsJ-m#B}eay-)Cd z(fQjoR=YO=#wlJrA-s=&*yj5GSzOisimTVl^^pJ1;Hv&V;VPBK<`Ff@M^VYD7?Z6` z(O5A8Y=7Ja@Z`0MKpWZbiFD|#+_f&1+D$VvZD-FLmw6dtJqnD|d=9laeVU5p1ElfS z3%x?_cmTF`xn>})?gkm34_zs6^|GZWFHS`d1R6Eo}Fmq&%1 zz&jXFFCo%g8;&gc?HePJ)hjC3Ue+kWS|VwGAPc>*?u}xx(3ntMqJbox;3*#Stq5-% zhzol2^}2$PC^SJy_c`P4ESZ=`ip<-gk?;h0sRVo}1|-DnCSFg6bsh|9{~s4A74pc_AX3 z)aoJ%=1O0p_j!=7>)+t2-=d%12q=m-uzd=$$nE-#sTieR^TKSumUR+K-{a1&*_n8-U{2F3EB!kfz0l%DZ=%R>(oRMD7mBHpGv7%aSWGm?lqePBKOVl<{~E(Xk>Jk>{F zN)470lEnp1Q!v;JxU zLbXxgZ;30gI#2(o9^t;^UkTFVvBR)QaLzy)8hy$#NbE3P9PD3vU6Y|-WnQ?V(14Oq z*&~P1@=$@((5p0u@qABFd|uFW2RZ=t_&%I)*;*99@Hd3}+B~pEp@F9eR=L5K|J5gw zuO!r7fB8cm1f51pLw^{IYQF7TUGG`mRyl~U=MLk#4)aw<-9f1JFMoLcvP}>5FCY(~ z>bq{>so(smx8CvMWY}>1uMVX8%^yEs(`Cu|xylCchvIoZSsF2?ZrX_76vNm3YAIsW zad6JMCm$C5y(oD1ULGoI681eH^U9ox{hlHICQETI3wEC%Upo<&B-kn|RO$@1=WKv$ zncv}T^!NPByAZx@8L+(V)LeS~(a)*;cu9XW5bt${er+H&;!s)RaGt+?%-`M<;C|I= zuzv7>yD#{x_v>fu(EpRV;fi{PPAnvlP_I~H zWVAL0qreLqLdfxf?^f>;R`16weD+Uea*XaXF_Jr(*kEBhc0CEX#hc4n0c|m11GMS3 zuKFS}VCnumQneM%KE?JIqT1?fP5JvNOoL~5 zuNSmu;ZD<(Yh1HI@lU;ayv6(Z0b8D+>c=oPmk^H9TGB|NXbKVnQIc72A+X8=+m*Y9 zP_U$s4s$RF^5sgCu^0E`2ttJ5!&&T{vfHLyN_N#!7%z3=u2H87xjyIR0MUFm@kO zGo_+wKu=#dV31pPuR0~be^$SbA^)Aa;a4r=Z+*V(^uS8~Y8SE|gi{MQYL$jbff{w@ zx4iIC`1S{fuBFAr=>g|;q*R--256}O9le4VSuAm_+OF{V+6+ZAV03xso))$aMM?U6 zfY2bsC&&sfHIPxux!Uqb%@UAJ6URWEK%ZCE8}-Y58mmB-X!dUQxP8Hj|5`D#)|VKi zo)to@>liOvyn^wIT$eWn^!LGu>&%^Vg4>~tZA4M`En*iaNz1;W*C2Yau;Y8N>C1~} zG#}CBTHNDSF1kE21D-8^`R};{iv=F-c(6w8E~(e4d**YNvG5r{?Sk6_sG=ly)NiGM zAHtC-+jNtj&Xzzwq2~U9=+U3NVSTc;88XNGY{Er0r$YZnW_Di{`>x?fxL`RA`>mnH zUj?asAv*#7t47MVQUd!09{ikf8&Gx1<%GYZrYaF>ge)3UY@#enOgO|G9 zxdDjQO3#e_6^ULK$Vd_UT=lkty>^J{jfXa`BH5Qdl1(iSqjwaB!x21$UlbXx-7!XJw!xIQFAt+V19C`1l)2B zOY6QdA23aBEF?v7$--Nd5)E~V&fncTm;wpr%S=d5l;Ts;(&>^_Q(AGGGy^a~ow{Hu zk692J;qC{mK4;sDukeKV>^yS*xeq5|+a?^SDhIx?c)83uW8pSCyBz^8b!(7NH|Nq$ z=&5_SIM!5eqR9n)F@1eZYcC<}PEB>ST;$UABbgwv`tGJ%PH%$MRnK5$?&;cA+8 zNT(F0^t8yqx0T*J+ds7?07pQ$zm2IN>fHBOOO3BAcEXy~nrjvfFx*|f8Rtb9;M@l1 z*tL3oXr)6cn*6DThsJh7dMNAo2A`j6c?M6$Y9ZmsqT+JXj0cv;Y4rtslfxD^q7k)fY6R5m`X3-y;fm<>5SIvnd2k~j7?uqPr;6uM}buDOA7;ie`i-rmVYgki7oUbg z65@p@>t)hZr9Qi}vsVa@-a!Bmx83qitM{e2li(w(gjy!NH%1J>MwA!5r=e_@!*;}v z_+89RBa{5odvpAP4h`l8z_@8^bv9+PZmA;Dcc$MPb!&HM^mti-#cYy_{M0+L4xG(J zZ1+mUPY~YpNY2J_Rf ziN?|S4|aypo#{~NAO5d`2l$Y|{Flb4KNzboISrDb`^28PVioi&!W9>Im`o8dAS;8~T}nvX_^z4Q)M zZCNfD-rti(;CEx+rs1PzzLrh8NE}^zNyAv(N*tDp;L6}|Z1b2boefpCU;&+9mF__; zI1$k$*0aMN*|=}MwC8;xRmeZyigj{}SY~%p*0l1%WmxTB*W_t0nLTBCP{ZxVrUKwsAsw|d?ya!>Wu z?GuiZ(l}qi^ty}S@!8GWVi!Mhp|k`M7!OL7mwWZiJ#Vt)J|mE9vlL|p0U9rdVL(il z-P-7_;Dos1h0Ql=JVe&JOVU^$uwbxLHeOK;HPwBEXW7L-)D&CnXd!gpA|4T!_dJz* zJ&wn?y>y%-$z1k2`zfvejDQlps#9Kn=%w4V5`e7yT^>1UE(SJ{$O-8>MxjxBFD=YY(B`aj4W^-~;%6Mz8Yrhh{}~elx3< z51sRlZ=fdsdab2V-L?+?`}~N?(YqH1=N$RQCmsANa{2Q6mzJlGBlydz{!CjO1_AWn zn9u#K_nfYR#8n=0V%~`p`{j%ZfNv*uXrdoErQAxIc4!v$=#~zWb&rDxooqa;w6xG2 z42M!0msShdhQQ^0IcQY$VSr?3BYcVyX&(&C!pniocEdOMv^A}vul zW?M8L!mWT#GI@f)qYZ1)XUN564Kdf1cBscNeLnlMcHdXuoY`Dtn$HKbadQg9CqsFIw1YXJbtRv4PiX`7|>!EJ%Cbt1oZG>;PVA8uX>~1L!y1prIl7niR8RjeRL@zv7Xi8=Cr%-bRUuZbl+hd8#Bz|4p*73Qq_)P@6YUhQ;@F_HU`X9 zPF7xoFmjp~ZYcH6L2jxZ8ijvLq@4xDBOz+0FVNL0aq!;R34NigHo$LOCCd%idfw?_ zeGYc_;A<{(50&I+`4jEdBk_zUm#5D_@|Z?}Bcb~g@0okpho~^aiiD(U0m-VfbEV23 z(vZq#jp1^h3eGov5&QTXDu_M4yJGyl?%*CR++nn4!Y#f8oDr_z_+A9Ca`~UALf{wF zuXy_NwzH_iI*LBz$Afb@vF$pjYfQ)*Q*z(Y$r$dX)w%M9hbrxX{B&#rhnWKJmiiSw z9<0QKCD%!Cf#%6jhle~os8XUJvTz?QD)A{@bQGx1iKMVlxBuI@pB-4<}IxylC3=&UlB(}z3+pZ#RU zVSx_&rTZVfP~J{fJ@Sbj=qs8rE=8z@aj`Q$45r9|2&sw$yg4^YF#e`Lp%)o8Wcng8 z$K2Xytrg2_=t$wSeCoc<@SrBi7ExdfW?&gZ0u~lnXEaCW;HiaBUT345blz1Cg_$6( z3b`|983ymg71-As7uG7)X#I9KzqgQfk%8CMb9PUJD(t>I1T>s?5r8Xoa-FJ`CNxb3 zBVYT~vk{QA2k-YL5h0=VJdc;~@z=Vq4bgBrE+YETf7_@ObsqN+ z)z2s1@e79Esf83(+?@UiI4Xh?dmT51V|~u#Mv7qz0>QhOi?}vP#nP^F2{7r!j!|GE<3$5Q@&CI3F$0>8vtO|#6Scw*znO7IcG#(c(~L_X86XEh-8V-k7^ zI>uGT=yx5H#LX-Kt+RJ7*5I~0Bsfs-qNS{BIuM(+Tc}NEP7V3kCFc?jcgmKdloLVyzl@b)1c4krmB2687#_nW%ZyDD%L_jWi_!jSn;fKcm|< z+!qIoXi$4iUcXEsHY41^G#EEu`PP5%0jovP*yOyN2NjknWSNKt_h`0Ccz?u2Qe|`pV;PwFXzO3gln;v3oQ%sr zb(p?X$4!$rlYO$on~Rn>DA6NXGGJhp`Y>0g`G1u9zj?j>#i~_OH=Hx@r3)nLgKSbv z2ImEe2y5YgNwh9teOY&r%tHN0sg*$rc*{QZUUjeklH~(_FUIvJ%Qta*JRgH+wh0f7 z*yoi5LI0TSwLHfs$}7NgRh3%I`IQ_$WSnlJ=%#whd}4gr${xIygGb6qB5>I*pyfa? zac|BL*0@R8p)qa%s3byAc^)Ox;=7=rRShEurRPh@F+;^tX&6RjQ4;6fw4=mL_SkXj zg+mA$Vrj4I0R3!Yaq3{vz1_>VpNmOv_<%`8KrL92E?uO|Y>jedKQ!a8i$Ywd5J8Dj zpvm{dIDljGkIS;0<20V;{Z{*Zdrl0d?(*(!jXiP&$X+D&EOV(T2`qs7IC|$(wMDu= z6`%^ZuJW;*r|V6s2cIibsEUm``;n$u0+z*riACt|`!n)&g}y4*(u*50kt`EeQPp1p zKor_8&aVpX-qAE!AQNUx-=gHs(&i}1Y*EV}IC&9X*nHGx=VOn6AJ#e@8I0EmzXIsQ zgmy}e&-iVJOVE)*FY`2nog_ybki9dek9o}H^!+EH((3*0KPFx>%jj*NK+<=>y-;4_ zNNBskRj@Ep^h9;mg^(ZO(=}%ogUdCVJ!S0O9LnUUe_zx~MWR?MFdCm-z#o`=qiR-! zPmQ0Zi~x7)9OwDG^2cm8+Vkyr@sw*sY)P!G;LWP7Iqhcm$L52A4uEU(w!p}q#gl64 zVYW)wL*k_*4KSNdsRSbIej~XuI zFY)DQ{u~gN9aa;bS+q0%Vy*EtFw0{0gF*wob7+?3^5&PDzx$|*o+!Md0Iq+erQht~ zcPk3;It}>BLVBoh`3}(8Ka%D2o1CJ}rKtR~%(1IAOcy(hqjksoX8}l#!9Cz>OBio_ zvgY3^6`VgAk?CCj&3M5=s0;Y&_2581c|6F6@wG-L-#YxK6PfPvsNPnG0Z&I2AAcE= z?ioh6z7~+b%II)({9~`Dz|qbRFL@Sb>U0qH$YHo7v~k_B4nY3HdUp4I+RmS<)Pnw& zMZ1>;`R)EHa<5DMcSZa!d-=CY6)qp@jQ8U#^7{E@1GZ-{+HbTd|GqPhGh2|h_ZXb= zF--yVpga;aS~XI4`;Ubz!SiE3OQ2j&;YtaWN1Tf}Vm`D(LO7hL1>B=hqO81E^aI zd>C58l0lgEFfKvP-(C)KX+xgXjbv~Z1S8IMHs!yzc(-Y18Py@1p-U04*Bh7)yYMDf zlWMu=?J?ven9@C)A@=uYWA0Ct)7u$O^>CxR)$W$^(YAXOYG#mYpT{4-5kp{kv3jL% z3!>!BCF^$=BFEHErVm!+ZOZ+&+fNNVjdS4%Aza73hhVCVWv7h=Al@Bf5L)K%t{|F1VHs8#t$g6I!h&3n4@uq9&-^C#_>3Zqg(izWA;WQT6mf; zEC6-J3iuV6eSU<``zpnOIIg#ztM6Wq9#a#4buq#2~rr-jFUvfa`%w+7X`1C;9<}@73C0k0?Vo~22qk_9kOr(vnMb1iY!S`u0+Xgy7<_Jzi5A-;ly@3p@`6Kq(}6 zNI3g?XIk%@$&OU7j=#x_15Ky7yyunX5i-oZQCaThORU1i;+Y%o;Czz^>jQj*)s+@d zlVnDarl2PuEkyCVw%WK2cvetWO%U&bwe-2A(H z|9d5%=wGTD8e`GiHz7UNi(o}Gd5|!r8nQiV+HJOrCk9{j7&o|?*iHXrQrue=Rlo;s z!i>+GjAvX19yn`}H|o8WH&mnELsmYoYy)dQ6O34uV`kwc{WvtW2v1^px1{E&xxz_h zs9i98l|Wa3c0-mK86?e(;lqo(%2%aT3Izp&&iXLDbhs=gd2GR>!juh{iK{>O?8@0O zrN_WEjicUAh{O@>A}sD_ORZQDk((M2QGcZ6uJjX;@@<`+N4bOf{&DNVh_*2&@^;?< z4W=`k`XDjdl~knqLsg7|3YsWe)$uVpa0e$6(`D_LX9sR|rmL(DN_vIjaGy3efV+Q4 zQinY;xx0I7GiO%|Oku_~<{#NXiQ3Jw4D*NLnye&Jd9|h%SpPyQeeHy+66^nkXV+ir zS3jR!zq>f~+4!|`w*R2^jF!H1&iaDvm)?Hsy)%CF-rX{y-+l5W>itz>=zorSz>l!^ ze~o&;kFfWDje38+#D9r;@-N+ff7k2>eDC%fWszjnMQIczu=1_K%87H9r-53s6w)CS`!FZ{!-*QVq9-FCB^ER#lcDBL#r%2m^ds!oue0I`O{NI zXMb#O$q&M3p;N^N_PKWp0E5&?Yt{MxqwYPH-bRw|(LG)T3wRP(!h3-5W(PxfZwT}B zH>8#{lBRp6=ht`hUw##gkCnm7%B;+j=S&*$Q0RiQYVN8x$6=VQ^V@SpUOO83lO#Xg zC`ld6+!**ppU4=UWwS+O&I%l*LTyN8r?`S!JTqh7nmq3sKZU?YMYgr zd;96StQ4pMfE_Q;Eu7CQr?LRY9+@e2MO{c$P0Y=yiIqTbp3i1tyy3*>MxR~|zHg*| zp1NBLBngbc>j@^8WW>;2PLK9=%$XkaTAw(wGZK5;Vjp3(UT>$YA{rHh0SkSuIomF! zHrLRBlDb1)p)@E+SoNKmMQJ{x_9?i7{&tN9R97=}_qG(6eu=9zZc?FOL ztjrE4f6BgvC4xVm^5Hb~Jim{qFW;<6?fAgd8@e;1@VH;0^=k+PevYANfmfFJ@P_3| zU-3!xEFBZkaYT#!Zz1&iXMsQa@c$A*eOr=LJ-h{%uD>*V&_qNHd%8bjJ>^laM+C}1-iP`$eUx`8U(j`f8sC{5PLUH1pSOZ z=rL#j=xZ@4w_8Of#mgVM;4;!S}lVWDo36@2~vNR?Gwozw>#NET`<6TAH##E-|Hh$ zPdsr8)9qdbSRpwnI3(*vH zdn~F35FF{#$f^$s*;**5>Pk{JLXJBLe@;Hi7@&sg; zE`B_{zKN~osDQ=}Bd6%uCIK=0q+)RDEcrdh7{3H?Aj51d3gb@Z^EE}4D*cTP^$)Gs zpA(gDxyMc8UtW}e>FTiVDu479n?Dx6uYI@kKbZ;q9XtP%nZVz%^FNsh{JEWfA0q_N zT9WdBfp70PC@T zSejOX5HeI}mRmdvMVZ@bO@+6LF0?!@{6u!cToNBg9Mn+*E}WV}{>?F2z5~xOQTDOq zhET4miQSvS>@WqCRef*TwtYPf`i1uh@8Zn7ZtgJBlS`+w*%1PoE;k7v!HN)lvEyv+57nt zjQ)wGvDMEAhA=~bRhG#al##93a;JPL==6SAkz z-g}aXG^^EmJxDc)5^6kEvZp-s6po#7)Xo{e1SECuX<(yfeAf0St2B9$Kx?CSJ2PvH zs3I$~3ll5jm%|H`;mu85Xo`bv3?Co^upM>enw~8t1X~*Sv!z216gc&>JKIUB9&#o* zQN3Twoj!j>hyKyC1bznz{mPp=lwyz>(YB#0HB!6q86i(|bn78~ud4#T;YWiLD9sBUrP#V>Wi-B4ILqeI5!OsIx@@JkNp+sx;-J z&&mPb=)LE3>DCl-prk&cSN7@34ruCUy!Iw+&2$mm%Ik$v!X%ll3S4g%9n8VZLg}4y zWH3qpsE)x#Ut`9PI)=^#Q^9iN7;=Q&FS8?GQXz`U)O%N`FE3n|JCN- zO$Po~n}0VM`1>|9vCilsbN%si(k1`(rv<+Laqtoi%QPcBpQ#x&IHq5$K9xjgX8Yh6 zqQ>B@pwgJz&`yQfvwpdgl8L518h{XJVpH;S9HTRKJGM4T48fU>p1Bn3&i(6wHrCBB ze}($|UMu}JE$nghk%{zgMu&6s9gVLF%P?F=_=Tn#4(cHF<&)88`0LNvl%)&kWpoLHHv8nFH z4b6?l~pYXZAV>5&54E>AGG0x5a3{BTGD$|VkNx0BMSWb|bgb;c^ zJb7E+olj}$j@cCB%Pp=_HtQ%cS1>FqklwCL0UAm)b=^|?f2itPA%9Q0?wT=0*ERH^mf##T&ZfFdkV>PsG1sq>G zxY+F@+c4NubdFyL9&RaSlCNyA!G>B@hk#2DY9Hwo3*oXxShlPzpo>|@F1#M@k0~OQ z4-wNE)JOHz7F69xSP2o2&&h%!yS^JJnxx5&pEzC_Y zYugg|lleR$75yfcluz1sXC8Q`=+fc$qBSqrNcyc^`}5e#w-#-C7@UmiT!|R>AJkI@ zXZ^a?Fx9`2mbeX%>74hy2ESWD-le_K$vpALu6kjOov-!xe{&T;=KVDe3^?nlJqZOQ zcK-z<{)*j|{QZXp`;RgIe?5bN|2`}8GGOSU7~z$3Ed4;Da%a4ap(2wlK6wlb#N!=- z)s224arVe!d$pQ$_j+G*R#B$jlXK&0IgtQ=%cP;jh^nh=f20q%U0?H=1E^wgqj|uD z%kf5tJ(U(t(}wZTS3ukGK`imDD3)#X6Aij8v)BE{P=i9eS**;>QULs8lD*gTu&4=q z3VXu!3JUFWE=B(JWW=ZOE(_%eF=O_AI!v1TTcNu%SMAB2B9R^g;uzYUQiRuRbS$Lf zpr!6u5f3-nLR2)a_BqGt;Tcd)=Vc?2YIe|p^0r->rX|i4fUbr#D^oRIb~)B@6zS=` z(7eO!vvxX>$xfo>Uau$CB{}7(B7Mv~xA=A7J5pM8g9j{RLSm7yGt^c_pXbVp&m^HG zxIFjiH7lu1WvYk$l9EKLnfu%J?6KZ0(!@r;yf-9{TBzt~b6Ue5g-i~C@Jr%b)?5OP#rX1ZvpyBoIT5JLz177SHdH5ymF z`f&V^ZeQ7l6*!*@o!tDaEHw{T01(jijuM224>tU3Fp?$q(^_~Kc2bEe!*~Rap%HJd zoCjq0&jCjN2L7d!q(3RQC?sUk8@Fm6RfhC1K*3h^7c-fE`DUI=f8RFPzf$l9&YDA+ z_I*^7-oZFZTr>@JknbpXbzY%MJ;ytekE36@chn#1T)8i8_ohrMHb6XJ78zdxp(->OPJ@K#}p=$T|27YirST~>FU9m_% z{PR^K5|4xN6B5F6+fpwZ=hBX%JVrm40>N}XPpIvZ%G($s8rn%-0#G#g5Yu|~tKqez zm9e_PgV@&a-pfv^sY-@!Yk6{N+DtfXWlHi?G#aUbUNgOS=LB03&J?G+#lpUl;aV}&lDJZ)SES=Bv6&kN0H;?Ti5wm!OPp3 zRcMJq=|fyfJr{Wvi&r6x=U~*iKv~`M14S0Ve#E2kZLXo6$9O{@ya^>Rbj$R%8Caw4 z*w0EZ-iCJ{j|%^w;}o`fD~`!N`0RQt0Xu|RZ+T;~>+$hzC^HG=N=Mg)MM3AX6ZJuP zs~p)kN^GHHY(dQrUn#@$pl@B@n+C|KnX~2n?K=%!BaPc~gee}}DI_ST65~IL`d_uy z;UDF7%cbO{f&BL3%(r{nQCu5G^rs4JjP!5PI&Sk*9$y}^9}v^Gi1!=MqR&|lBLHv7 z?$X}wVwMS_;GAOdXLWPyTQK(y{pRnldT1Q|ZGN@KLdyU01cON6T>o_efYaNUwz~LWZRo0tEX7TK55y?bh zhaqv`8RJ@>dlD!367ferTn_VI1(ld&SgX+2l*+R9ae(zDzEJfP><>7{C=2HpF-!N6 zc*DrQtcZ2>tenxtu+a#8^z$!%r!O)0selBhi)`^{)3_29)#4pj; zZG!4=jU`ZR78`6J=9(TxvV5zcrWw3h)IbKa?tV1(3zSHfaBk&Ik<(V#3jsmhv>EquOgj0G$bT!+(C4eJT-u?2lTeHZwEspWzHB@!0cLihR3b&;HaoK@l6tc#gkIN+q)YBH))hzP7F>PLPa6c6YSx~&RC67?8fL)ByH>?q+XQoh{?j%}unw}1{$ zs|+t#AEi=FjA#WAu=}W#qB8M|9C~VrAy6j0N0)e$V;tdpR*3m!%UKcyeCh6uZahybI8hKwD|ywjP`6GnaIvP_$f1A z9cM~&Fx;7wei*5q8On~eY?9=$5s7(Q$ias0(4$!%I!%dA)%A2Nz-O|Uua;AyGClDZ zGz%NJlTe$*pKB{P=0^l8SN)K==u%m{;Fk5S?pSJH%2M{XOaR$qosnRW-wNOBAy%I^ zcS4Mf=cjD)kedsW1375^%mh=o7WPTrm7ys#anKkW2A>JQ_t39pEYLJ?5uXo4l`}`c z>>ZLYvY}W>S?CmecIynP@0T4i=0yy2SK9*!;Z{Yiz=k$Ro?x%7NFhGNSdw+RC4W6e z?wY_3%cg|;*s22}d(#n&83@=az8Y;ipE>)Hk_JFU4_EIJ@f_addU7`ygT|e0;6y~V zTso4G@$%zA5kQ*6KI!^S;3Z)CdU1|goB|X0OocQM_h|p`8 z#$N2M>q1o5g#VX6Z~qb9ZD$wsF>u^}$+vJ@hB=kc1{_$|`z6Lu9_|7N zQSJxo?bcoX5B*W@TNU{a)Z33Wor8ZLtu;*D{#JPT${$hrY2W>UN8|WZXWH-YV8{0i zM&|Ps_*Q|E^l#|mzaysiLrLcyEkKIhAEoq$5$9X9hcvqA<9=?hqgJKJ6K#|Ha0#=D zr*};%DGb6T=PHO1YSg>qP*XtL@8x))b+OLw`bh1D3;n!kLu#dj^X)&L(%T(nvRO(z zp)n9d3~tkgeX(mJg|52?d};O$cJxWTH&$tUDy9@BrhLBW=(d;GV_*=7|T54y8TjRGMbCZFa+R|v`XhHsTmJ%eoU{sar9y;pHF z&)f<{Edn@rQ!)1QNSE_&S8P2IZnWYwoI_$m%{FiF8QJ~X+1uGsk28QGZed@{TMh73 zqOT9o5T>%^J2et`b&YNOG(hAymqqvxxY6E0y3wF;UY3Ba{r=e=+LN>;rZlxs=b8uC z0Y<_kczYsJC{?Cgxo@7+OX3x>(<2XXP$kT;bWB@b+rn_`2~mg7C4W-oQ}%Y(-9OXE0`Y>ejJ&3DyD5DgS*iE^?JqP^tKao`7~Z6!d)x`%1ClF$nCV(9ry48%!dWn zX-@DpC7tj0)S&}84f(L;)RPRSPI%ju-~Xzw`ZKL4@ZWevf9Vs;65r@ILU0^3S%)0r zhY!S;0Mj{C{DrLmdnZ@XZgu4jx7X|E z{CI|y0(sUBEfZ;-boARmNTV6u{N# z_@+Y()VF=`wtcO14qI^g{s=x*bO^qq|L^u0v% zO5ZmGud^NBH$0gqx?IXXS-+ltNLT&A!3rq8@7lidUAEwBf9h{h*}3$gH}p>r-H_(fGj!tZ}#9!7!5d z0P#R)fcxHOs}kB#K|Rxw?YDnErDAILHy&7v3Dv8toaWuG9?a?%H>tfKHG-l#Fdk*E zGyrTP-l@oZq<&2)Mi)5d@;OySETd{R+ti-p&A0+7fqf)Qs`4KdrLeD<&*X>G(gm{V zudBH_aTK3t%QYUS{Tr3!@s-sd_-`lrza41czn$p+cA$YjInj;>^MBiMfiIr>PaGHc zyBE}7nF;*e3+k`T1pbqq|I0iH&G%ktlur&l>Kj(ikPFl8b_&;35vxR{dafCRb&!_L zZ?lde{gn(WwL%Ply(D+dFw|s3Jz22v*VjqfX|v+n}j@VDkuM zg;rj>Hs*R80h=OuQSYY3Ll?=YjFO42U)l}w5Gx7N2PGKLL`>U0zr?q)vM)UHd=4aa zhyYXNh5%uLqmM6|Mv@HiT3s=Cg`G= zrllz08<{ zz?0f%Xt2#B%a=xEU2JtF&VVX?e(LSL*>A-kY7nRV53a*v`w|c6R-AazQ4CAl;sIpv zt1HS!7ccx&a4H`mfpXFq(<0U(+U5#lFgAf(ZuSQf8XJS0S~7dBhEX+Lm%R%_;{%CT zva5BJ-!&eZxb}rw>icmjdKcbzas*RYCETr51HPB;kez9{8Ttw$DMURxAbT8*dBODO z_Whjh6qN5GaR41-kL|X6-pT-HuKgyj_sJ<63t2uz&z{Xw$}sr&`we&u75ZukLZRJg zPr-_4&nxIHhB<$f!p{W4GDVLcSgI|vZFPSjaMt(Vf$$QX7yFjF zFR|<%8RMa#kYHGc?4)PEnfrKD?n5;JKTvHFZGBX`WSn$n7Q#NW*=fErin56KZ?=t} z9eITO+VXw~Day2m^|(CC%@{BU18BGQ1jXl=V|YgDuuJOdG%A~f^E*nqZmVxn2Fb>@ z6EYG4$Kp%sR@tY3*R}}>%?gk&TYzfyeq5jlZ=DcXA=9DYm=Ef!#t(FPk_M9zXY)?_ z^rY5l5b85;tP+!TGRSP8wyuna&&x1C5(%YZ9;6&kyS3pCCk(>m<7dv+8Vdx5Z#Rf+ zF9YLcKf-OV&NjN=fKxnkBNS`Fd3%yhRrr-W(}yuAj*t@@oU<1(iucYg;Kjvw==FjC zuW28b@&FZB83UozsS*2dES1oWYh14^uP>U&sXI=uo$eG%gfV-R1}URo6qh0IgF;^O z^F>|)(o+yHJ6N$>8b-zMWOKvhK;K6N&y%X)P4l5L1^rYj58Vui)7oao6}dT99L^M9 zgwNh)06)Bpz*2oIQ1fFM_MoodN)6JD;3SSN3My*RoYMkT7mt}6G3`y?FbsnAKxLmMv(CGw7`cf<%I|| z&B-MdI*0~Az3lXiK7-n-4fX#cQ-S3v_WER+8HrB=iHlDjf#ve2%+o9b{H{LsC5}oB zoqg9w5W*bGF9OecVap_=i!lG|to&D@*k70mDm@JZrAkA(^iaRa!>`fq4`rCXYvNG< zip$a+`1q#r!||6L0p6GY%>GLP;_p#aTc_^Qr|xDaU~u#|)k^R9y2yFAar1vFuJ&i< z0sqOqzhfTopX~cP<^lf~Zfn|NBZYZTLh3vKjC|{p^F~d2o5*Ku&g`+vHj>!}S%o3q zfBf5s9ZX%kIuq}`k<$g zeTzy^!MQ{~w2Nx8{@CBrmlMg{abO@>-@(A!A(|A0KLMX}mP35`(81F`Z{1`5cvQ-Q+!rlm6?T0EWVCfJ@y$9yt6R3j8Y9}rw=-HF~0xJ^}J$so1D<2yX1g0_KA zn#=gfpjrnPo77}`&?(X~)0}_}YTU}lmh=YMIPqy%7H*{!8(9`$f=}LkxvPSm>@nD6 zIgZMeTAY#||42{ZE3W(!rPop~pJh1Un&^h}LO&<5xwco$}%a;TH zcYRsE0eWKP>o{dwJI-Qj+R+pr2Bjny#4X#8E*m;ECZh)?*$d`geMmIADlNeYab>Jq;QO; z=_I(C2AXhN{Z(|AvPcP3X?4GOA-I?j&*0zkJ}IUdi|NK-cxJmq_4A((_n2? ziKUojG=}!ij`Nr3M_V)qSC;~4O-O=Lm=gol)i3*U^>#&W#Uv>>etU1KX|}XID9dpy zH#sda+erm}h!qaA{PoTvKp!m95%Jdme?01Zx-A~JzLGat$N7E+J!C~^$LYh#gkcJu zkB$;Uq#0aEB>BQ`c1Q@M+xcSo$&bc;^*U%NpS) zvCq+5X8_dxID(c?Y{8B~SmpjvEB9tu`T~EDW$_jbZ|zewY8d@0ES}u8iro|9vpwm$mP^0Diuu z{x7=#ez~c>?&5!u0N?~5w|l$rY&e$-kZZnNCnY1S_Z|__z@m_89@8WaH;X?&wi(kf z9I5a@=~Ym`gaOM3@aedDE5WHY%3TZEilBH*n_Y!*b3+?U9hadnQWo#Ly;-<7KP`fLlf7 zaZkr+1xHiY&s0?`8(t5E6BS7)8qzO;~5{BR>ebe8*8>6BS=?kjKjS zW8ZCpk}zT=7Pv!VFCojIUvQ5F(#I1=8VORePQCQEI_G`iz4xCQh*S zlZ~y7Z5#jCwryu)+qRuIwr$(Cv9ayE-(G$fr_QPByP3J@s+p?kuKqob^ElT!TK{yq>c!2c8L$hiMmm|U^iOUq0Dr}1m8m{#($l{cosDS)-^d? zM^qwcQGI(yJ%rFnaaqBG__UaMg)yJy->@gXYV=XF&lS|>dp+TRVbi&x5Q?sc`OE&X z-YQDz@G+Vpes|s==uv@=@S(!rS7}(_pF6Debr&`eb`dDS8o=oGg~l3?M<&>pd4Hzj6SX6&?g8dx6W5u4KC}rkq+C|M>#o-hbC+eEQgB3A780 z(gDRnKI`Uw`9B;O@HCVZ%;S+RvMbp8C6d1VZF1LEtN9d+u>;R)o-p-M@7VtMeS7Zr zCnd3xoK`1?qa+RN#{O@CiXq%i8;TNPTlTmd&&;#4zH{3M$QuL8&PVu=pMg*0o5qCd z_#c{=2OG~-VtQU3bCrpMxsi|EJ`p57;0Z3^xR0=NSeTaV`jJ`UeG#({al}_S{9qBz z!0aa^Fk?iarC{uq&Ch9H2XXr+BkI#WxvhUqgLBNlON7wCQzQG!;L1m!=KR;s?O=PH zA4uafz{TMZbz;w?d9bi9>e>RcV431^RH7>WA$w|?`*Vzl-WyNtiWO&{bK0G}FHZ`p z?DvR&iRw3;Ea{y^zWDaN{v3*o^{k*V>JAyaUprsc5axMeIj8}Y0l6Hr#xHu%S@g1M zi)ts?>GT6f)qYt7Pr?T~bnuipCsJb^H2pWYvg8*CHA^bHmqFRPjtMY5P*>7_?v_;5 z^sh+|s!BRFJg@Qu1GvU&r6Uy?JNtJ_LJZQ!_QMst90~JO`)vpXG=bC^VMLxnLG!JxQo%ye0)PQrAQ$VHNB1RTzqGfm&)I<|qxKcJM& zta>v`wxI`cU@k$oaZC>r%8ss4=p#VK7!h)SS?ebi<_ESkhq_xVObNFyqau1JB^}Xo zIR|R!-@>XG;B}-%;vX^jVIYA2gNT(gn!XUY=Wjp*Ljt<3b5|+rR7zoPif|3UT9j9g z&}S?$m8w_(rnW6#Jmg-_E$G8=<^;DX*Jql}0Ry3C#P@WYLiWCrqqD-dug$!f$ph~o zl{gRI`wWZ|8zsppQRmK$mHnF*A4+-)QokPfMQ6}`#MChQ;vKuMN2nFLx$EFQe9CDS z9)x`C+HsA{;lr*`_?WQeE{V;NMJg!!%iUY@@Qgk7ym}Awvnm^hHW)1+aQLv8aIAym%Vvi6G(}b1T7J0%w z20Iy$-o4FI^!s~uX*OE`w+ulRIV;=ih;L6Qt*bg6pLQ8*B1~f@zh#z@jnN7_jA2)X zj~nhRH8C+Pqj}{`1hB25#6Qxqp<=>Qa;lrcU;{1@^hF_jvO1EA3XJp+5BFEY;vg*n zQHue-Oyh_n|7pJu>!ziO9$D@O9-=Qd-VvTaA)*KV{a+-;+8Yz>Zm-cXy8EmfEp{2+ z-onsnu)m>@4C5o7tc77CjY)6%{IF6gxNE&2#pG3@-4$MAS6<348f?Vk9MFRx;el|@i-V{kE4r8}dlge~xXIvyh zJ88wy1*dXzeK8IS>8074s?_vp;(;fie6jd@nts#n2(m*OtO_ss=J9O5Ml31_-4e@> z6azJVhHYMC8z`)T6hs4~EuWAA)_I;68fe0!YMZCB-_qja;Bw}@@~4AiWHOVqh31H*cT!@^N;CJS9-Af%NhjqVR+jT=2P+1QQ|2*%e-YCX2K>0dab{E2h!6m>jn z|DYZktioc)Ic`_&A<+C$uisXz74MO=TAl$hzG+_n6#8M)bcm}QY=4t0H5JBDGLgU% zu|wfq|wP$ojS;=mfWN7lW_e?O;F^+M%rCu9C zAbag%jQ`so*obE=55_nIm%Gu(N>CK?crQQ$Xu6nbbfNK!f4jg%TWFMV@M~{;f5kg7 zPujCM^1VIL103|N`7Lt_Zj+6>YZ}fx_N33|qi^ zGeK=u1E-igL&c)0!rnxvmyGAHwpDUp$>X-w<4pGods*hF^i~UpKC-^7A%~CeQx`0O zbtZjFO!8rsinFgobN2kIcFBpu9)7~S!3Ynm2eSxO*BE34qZ$mnGPn^ zMbyPmkYihts_Di)e19wWK*(S8JK4fxkMl+vcexYIt9FxfF~tGoxC4SJ)^N;hj*Zw( zKFb{Zry!2hlwbW&5^*Ct@(>X8o^JhKap-eULqxj=4b2ko*t4_8=ig1>nXb5LC69!Y zD;JmlFf2v|zOJcnSyXiTV4=wiN>QcM1k0{u?oHu8d< z5xjpL(jUMa`PV&?XI@h+;RY3HlLO3p+Yf@gCV|(`QK!!C-a-gu8L)HptMi+&3+iX$ zrSFR1jdBav=)K?9@0~r-=`gd3{A`wc8Mfk5vM92I9v6<0el#G6+&l_G`5Z z5;lg>Vt0COO{7z^aO;G=?}pdga(XoCAsICh+P?=8Q+##`G)iGntT-%$v$qS0AC=y7 zVJb70oYRu}9;*A5@&SvbSv9vzwEea&PR-;S%H!6cz&r4to+#Q3GvChL z)2WH-E3uC9{@Zj@%whuu7SvzO6I(s>@=kNBh;<(Z&wh|<4WH>TV%EjX=ZfYHi36W^ zN)hh&gv|;hw59 z2QtuX{K_TP5OU-fd}Tca{y~g=LmlzP4X=ydmpzFjgs_B*%G`_GJzqQCCG_fJNp9}! zV&}hA;f_6kdFP4^6N9bhI@l&%AVZtykGs61T4_|wjvVWX4f)2jx|C5@&8YUolKbo{ z9~a|yVm^?Ri_uYNPrv5IJ*c-A?Mb52@>{R694MmpuN0%gce%&qA3E?4HSs>)y!rd1 z)Tz=|Bwed1C1&kpzfABuE7;1t>0)@W-TESVmBVKEw&tanEoW?K#7vf+vdp;%C-yY# z-ml}GDz(|%Gr;?RSS+!tYJH_LEr6_npxFh_AL|5a%2YthK-6;cPo<9Bipw@rEr;E| zEt1r)nn{J8e_pRYf=Z*J!|2PFF23uPaxk8sEAhK7#_gDu>0+}q$}=ikp_Y`&7W*{X zYD_(F7_3dTl5VnF3VCttEvWu|h zjZsEQd7Z1;;ObW_cB<$Uw^ePl<7n|uO&ABOwmo*$!)>cvU6!xB5P+>uNejax-N#}effhK@(#qTDtAXPHfk2Ir)f2Y!aqr}&fzL} zZh9^r-w_z{zE(?k1#as2R6k_48Ih<*Yt2$9rZm-TM`Ar2R@cj2eEV?FCEmT2rP3h* zDVbfBVwR+-DT9xr^-DFp80O!OE_(GtFlF9qdb1&R{x_ZTU!wmNs`QUZm{|m~2R&Hm;5XR$_Il zaOVz%3%iKbxTj9N{_5kjbc&a4^(Lw8ICY}WGU&1{FjBM?#V%dZyz6IRNjW!5*EvP1 zsvEeig?{PgRbD3b*zm4D*1EJX(98Dd(l*yDI-Kl2KfE_GdpjIapW2}^lHKEpeI8$N zX3eb0^7LtzT-5M1=~k^Ye#=7`Sut(TM(8h?sPH5rZG8xPmXA=BOoWj=yz9U3J!mjL zbm*>b`gXP|XTzTsoo6B9EC~I5s=-;kzxMFoOiJ+4^ASeBm3M5q)OJU@>mQ_-YN-Xr zZe5kG0%~!mo$f?}+QO|`yr0j|+QdaFTdb>sUe!tmCwFBUf*utwpVZCvu+4ioI){Gn z(g@6tjkmDG%x^dw^`+xch7|vEXXjM3x$YGJatzem6c;|x8$13htW1 z`h2xnb0TobQg(mUBLI0TWMw=WqZ*t@l$;BFYtbgQ-4&D1eiIDKkF(B%4BTKHdNOJ< zP3k0lXXC84$hR+s|Lh!}w>P+zMPyEmk3RtFeO|kjsh>(lVJ3;5EqOC)M`5;pG28R$h7RSu5~+FD1L%1R#u z4eiNMVzfDfI%XJZtIB8`6t9zw_*(q#HQxVTUgrxmy^@l_)XZ3Mg_Y?UgJLCnw&u(j zY9vyT_R?-`+dV8kX0G+3^gmrIcP$t59`aqpTO-7(Z&8}u7%?5!7LLhu%T|G{)#nys z38`u=hsTt-zFfXSdpk@Cws`y?VUpu`1 z)Nb00IB))AfFxTjoc8>D;>;yV7HqI~UOp~cir3I0uXohkSb%K|_>;$(pl|Iw6PK|w zVt+ucZx(Y$3DH&%Wt)>6Rn*a;>JaTkYHEsKUgoF&OfKw0@*Zv?MBB=s?1ce?G` zoLj}C^M_NK#s+Wv1CF`l!mru75*bNUyRknVM*t4Ja`fbnqE`P6` zwmMl=kW^i7u0n!Z9g=R~y^Ek{q;2q1=CfYYK#fA}%o9%?-jxj8ppdH0Z5oLl6MK|z zVH*~FtGKhWu7x-VZ{^G3FW&-PU|$!%McVFf@dlssoI9@E+<_8xu4)FDiyvi6$noW=eO-g4QCy?u z-9Av-k#6ur&HT|@Khn;)m@_M-&0`%4{aQc>-+#Z6aO(a;(Ln*b?&J}KC z^j_r|VoHOlng3I2+3b~>w({eg3Og06zR+=hj=Lt9I?_iNXm!V9|B$~I2mK+FHNUUCN993es5t1LeKLl4-7@EwlKB=is51L5%imUZ` zHzF8~&3toJmeAePvi_@8-f>W!JIAN}^K#5YtAoVbtVgaaKxZ zpMJ5@>}#M1nJQPO=M)|K){{H@JSyT-gq51(n%cOtOoqFF5sb(#?)KR5ufbq0zeHO! z)@i!OxZ}{d;{XW68@him%<`RKQT4ZuwlQTJ40)POEBO`B1Cibm1QIgcyk>hHp!rt1^;rc(mqhS2)A}o&6%c z;KQR)F9TM=eAT`)=*xgwn*sRvUWH$4jW!$7UHOQ8DlW1zUz%P_+?CpS&7R!p*1p1- zWy!8AxAGGxZGI%<*;crSt?oKqc2KmW_7bs+FI5eF%C#Z=SoqFZ^wW9yyy>ov!2}?R z#-;qh(5R}KWqNin6R`9(=5wz*WcAMVYn6&m(K)kYK3~O5jp$Ooly=?BVoW|-Y=1~7 zxgWI2ms;)I50M$=-5gg~(stQY$b@Vm(CCqVoz&W(g)l!}cHq2vnHCl5+7rjg)_sfO zSY3JQ=2p!uxtEP5kCv9M<4d*>i5C5M97NZ0mwpH+m5#P)Y|#G`Ey~k4%YJi_Ezg!1 zKa6<~#idppy3t6XMihBUBhu4*qkiULPO%oP+npI-lFuD*G~vNaRb1_0-_!BOY^%9@ zx$@PTT-^ziYuzC2xnz0fRXWwGCFo{T-uuY(vsSGpqhsT!l6mJ)E-HB%!lr9f zq>A4ci`%+sVP@ApCsMuKtysPim@!qjn1uM4Ov@ILpQP=X0iUZebox}Zv_74p?!9um zh!Zzv5?oP>5f!UOOk=-<#B42G>?F-7z`x{T!kN{QPR_l}W*j*jT!GN#UUOm!PKdFS zLC{bos(#O{wfe_FAOG;&_;S?JC?{>y%50JKW70Ac_i)i|-EvZ#4LvjK(nm!>-b92{ z%Y~*$*H=k!=(!cUsX#rD%vSvnuwLv(`J7g(*Fpnk&FZPI`TVqk@8{QS>4bt^{b$Lz zWj(g!o>#5P2I^yzxq8sqz6C#So5YG&+qs0=)s;(&k{HVEC`CMGR$U6MM^| z7dLC2w0Mf&%GcNVaWEdcYz2xsfD%k04<5ixypoke^?pjIm3S;l_mWJPd(`Jdg7YaA zIdaqxLP8sPrqGBgCt4@~`X2srm^xO1NG31=bki9N{v>?J3BHjnGc3e~R>ZCN5S94N z$qMci!TBMoQ4lPcE*QO;KqRvR0;W*mf|!Ht0zwAOi52q?50$|$4kbIs+cx24pNE3Q z;sWJ8Pz!*iS9b`~lL2EDRTSrjI@GFBCwAT2jYYF$44Gi#ZM&Q7yw{!$IvLG0f?Eey zfML@@QnjH+arBr&;6&_``Yp@ETyXR(%q_4HpLw*-hK8u%YH<=LLc=kn z!k>0$-2)eoz>Aojz#S1{yIWI#c@}na77^x~2D>HN_6yJ4zSw!bD8l{q>I8CYyl~lL zu-2q&7CQsW0f&2}R^ZDs6eyA<4-ve=htUv#`R)zr!IZU}I zD39(n-t)fAzX;P)HCeEMQtBxlEH7vgK(TKwkDv5M;K0{uBk|VTy)Dx_@Z*bi!h^+; z3`p7_c_sG)#GiYgGfGdo(`*|Y*ZzfzBEk*DWn&+~58xsqnR<{Djibuv5$R=vkPFI7 zya=eioMtK@PGE$DP5tWgPMOM`(AN#w}McBa4){gb1|76!`RejivsEoT6mmg zMGj2}kuA3(KqT8MjqcROQ<7j#q0bNn6E5JXHQ^K0CR#6#KYSrAGm!ADIv-h=%EyJl zxh27l5XuL*4gq<{Hoq*lR2}Rj+sGzLpzCL=W+i^SAtFn3R6dlFrV%{)L``F;f3*p| zkE8x~igWzZIpT6?+Bowy zAKu2xn93MyD)Jq(S$r-A4OFcy+*GV)a8r}feQ|E9C{HNxF!NugV?3X2;a@GZRxr`;bpY{x+q*#WVZ?z zT-txfFgI2!K^kU9Y$zh^YCT!`_+6YDV}U@(90PL@pBa%4)ng%$$ytu zN0C`Us%{b8kWgn`kV2+<{t%-wfAxa-Dr*O*!F?gNQF3bsK;63k(@rBL#(>mY*yL0HDGDBi}QOK>lU z9!Xg_DQgGBV#7vnTq<>zkU?w_Ic&$1pS_)zs+GHC=K7C@AkhxXeD7PXqFQdZ-EGdz}Lf* zHvg|n^Ow48Y?iC3S8p?ye(}C9Wy{|J(tNOGR6|W2RtR>yTfe@dfu?4lc= zSr;nN-_SoZX5R+S+S?52 ze)JwVjKL3SKSr5Fc1@|SD4=fo!~6L8zDd{^^!~$gt1z@bU^8^Jk8dPrLtd5%%_&Ph z;li*HlocOEa(Tnt0^ge3NcrMdP7e@J*V$XIRu9a+gZJeV=D9hme@=la8%dY@)aH2W{|J1?1y`!r%cojnUQ=!kXqmA)v(6o|t4rzOG3*P@MqVrt!DeFZI zS>xk~GMwcos|i%xa_R2|Hprpq0(us|NqU;8^+gU6rTMia$it4aOhgfF{xhe{nV6g{ zbPfQ*g58oaie-(F zlbEiR1uL0t>)5YV=dNU!Q24HuO>-pxF2vv)BGeqKWJ%*Ghw(-qdl=5D zfB1Vw2*E!1Bt+F`!G>Xq4w@rWfgs%%*Qda{TQ4h{*=2cymi^RnC^l4M6wHo_gDzKK&U{J*PQt{mf)G47j}5%NqD2F3 zd;A#B1#Z`3>-AgV!6N?Z`)|`Gg@?M=G`s#lJR^E(8>26r3XK+efg-b`^vAvw?1Hux#Cps*)%W^GpHOkq@AP39@=?@D;mrc|gIBs^K@-OS!}mjGJ&T zHFEKF9xBh&;Foas>h;8=O|Ul(SY)^l`vt}7!?|$nvxkzMWF9kyi zTet3HMcxF3gP@pNqdZ%7o4>&WO`;ASIXP%+(r`2M{tepOHS8Joy?#Vfe?IBo_~ZAb z!|T)ggZJjo=@R9av9|YQ8IOVKw3q{N6F_WOmho7Xo?ZU+2fdTNA}wl%#6i7fuv#6)GBy@D0!k|c-#~=!HyrcUPh8ivzp;YpkV&I z%YFAS(ZNVwxq9^`%$4MxHmHc;C?j&hzsx&5>E~2(K%?x zw2ioR{Dm_Pv&@T!?K-wh%oy(AyZ!P^-~_V1a93*=FN5EX1itlx5os#7RzeMtr!WP-riJrg zXk4t-zP5rr<}HacK&3jT9{DyUYfSAP;WBT8S**LJx>YLIt{G+GY{uqSuy>cVp|oJS z)6%X6B}l<74wr*wOg9%aC8(^InL#mAG)^9_sY+SpKJ^@;t##eLGzr`3l!4Q_mlnP8 zljt6=S{=LPx&eD&3!0+=Au-`jF9GS{UcBf2dGgo$1L>QSS6t~}c06mj1H{LsD#GTm z9r5}c-|5W&YtI+{)AqS4ZK#s_GF`nE{cFJ-;g12HfHOdje|{fw zjIjA;fR-IgPt3=o16%pj+o9uwF#f=6F6NOjJ+S3SjOiOmT!T6$YeU{50ZFjQAkZ90 z%;w15Rh8fSOY)mLU$<44k>i(xQ(gbWH%g9qs}5|xRqwB|cUR798@|1AzWbvzKBfm) zrUzHU&`+PT#H!yx9$CG={^0Bv#*J~|6vo*(_5v$YtTpO7Sni46a8goVR8^t0Z~}fN z-1>ErZ_ue!YJ~OV5+9q<*aqY>z+#Wf9wr%;@h3Ai$gng+AwBXYh)Q#EM{oW@mDAQb z-FS_V9IZBiT=^?lrCb`n_+zTi)foq@1!U7->HU0EM}GhwOb)y#sr^rxdUb!GrKr7L zv*Y)PHarO4cIiItSZp}J?NqDp`Pe|$#7%=DJsscg%dwg!YpnX25SD-5F~-Mg8>g=X zg80PZ?Btkk*^V4)S@N7>eTdtmv2Egbj7-+%--67e@al{Do7O7-{k%8W4O~H1eJJKr zcd*s!-Jwpc%LE;Ny$W7KeXqO>h$U1r&LOt*WIRr8(4Eqr(q>GtU+f6?d=5XY9~aOz z7U*|t0A&2WzRq>C()Hzfq0W^##R7=KGe`^rBAMsngQw_~4&Bd(N6F_V172C$GXo7m z9(snzI&^J#(TcRw4K$7|t_I0V@@ zy>K!SmQu^KpdVfwWS}Y{k@onP=lk)4>rRGYD*23|W@5?aY+4^mqMy-bBi9HRB227r z59>$0eVRw5ei{*bzQmXt@%HR|_XO;>emVK)k#N-v`K(8D86P|?5*D(rDh5A{fE0Ac z2Gu^_-HwKy9T6p1Xm{E>4>7KN0j@()q~_n@K^-Jts=LY$bL#KFF_jNLOV{E#I$NHp zTbfCnX?1c%`bzpcg|g6tbDwd5l-9-)etJ=$1(oUrjDZTN6dEXAH@GGQU6^tP(F5&r ziu2XFH3O0Xtt=4IVVyLy-xi#}8=XSDC@^bWE$e!5w{Ob7o;PCo3ORK(MgF$d*B`p} zL7$Lm>Zt_p-|>3^>a(%$S13B4+Cy>Qh1SNV>)8D%4*02;!r*R3ucQ!dR5B>Sb)g=^ ztlcbw?>7ZU9xR9=~W5erOP9q%*AIo-4=_7sM}7K zyzM8#zxyBw{os5*`U>WNry~6z$i}ykD`t0Zd&tl+@9k9WzLD5p$EaUm;QB)1Pr<>P zZTngb###1$$I1N6y4+oyXui_{O+$c)W6VA4>e&2NRu@Fsg@7HByC94J1&=$B3=O1p zX<=T6vbuoAS2~?J>??GL9~>rz0QVB!a3IBN=4UA3^8GG8m4<9P?Y`fecW}fS=F!0+ zemC&_UrqOrHHHKlFD~x_`0w4izh?Te+5V+-Z?n1l!PeHFi%A^mwR)uqjdFm|z*6lBKCB(TPXP6gQt{@an0OmtYA3*c{;R3oA^uGoWA)3W> zNpD-|Q^Wot7M~%S<}&5@MES(?ex&0wm&aKB|6E)eecQ*mg)+N7C?gscE@A(CJzs5F zOle38oAwe()E(^!$MYD>o7Z_S+akNb`U2<-UW8OXM&*5MA-}OTQFa^?Mw%z4w7y6@ zAv^yNS$1&faD103wC?8Gdwx9{07Wk(_P(E&2zP;KsmJTlpM9oW4{kr7?!2dq?>DNL zH3e3c zYQsR>%p;(ql{5*b@tBDPKoDb8xiKv|8J=IWh55lzhzc38N!%iP+fx3$fVlk&nCdzcA8BC?al^;U&0va#L`8a%cuT(}l)@?E$`hanBlRvrcW9M4eC`>-56zI~fG z*@zS&yuMbd8pI6iWY!2no6kt^sA==q-30n~ck$GB10PZsCQ6<#GxLXoxg_`Ajxe#E z8OWhq=?wdRt{tmrh(gg`cN9I;MViE~MJ}wcLnkk62vAIIMjp70ePrtg~>G=`7Ia^Qa51|^r8pOM zL3ClLr(&0?NcJ0HBx4_$XymS&XLy_0)kUJ6Kc|wg!xz|vbRk1UAbn>>!r`JOp<4gp zF=SD^HSs|b8AcX9NO@3M#ng!A3r!vPBuNAq*f|wNa!RTeYb~Tp%f_GBvpuQ)+r$Ac znao3$V}NO=NipD&s6-l&um8JP?II0H1;&*KJUvoMcS|Xd&6aHg;>$;#es-Y z&sL(5iVY!9q579a;hZ7+(hBzczZN-k7Eusgs+6L^lkdZT*T~p-Kdm^3t$K!%yF<+H z3Wf#zJ*5xDUGMDJY9~R4&E?@NYa(+w$;GmK@DI9cGW2!`DE!3szWDZMV}tSJw?(Bg za(^)EF|1#sT<%PVV#WRyM*C0Q|eIJNK6ITH^SF9!E{UL^Md=<@rmF*7o%4UZNvzrFo53ie^DnHg3R$O4H6+`eW!z ztby-;FgQ;6c8Ue=Q)soH`THh$+-`h#I!D=BtD{TNeshdx$Lw{p&8;r8i(?KpHUXgt zqooJrL@rEZg!3&R-HRK88A3Ru4O3^@4lu4@aR|dJnHEmJ5=w+6l}my2=n!0y6>3{L zFwXebOC`6vErX_rsmC410O?M2FU6JK_n?sS!U?m`y{&)n zR+9&RxGv_)@BnFh(l{)8z2Nst$kPozqr^r;!NGHGHc`qH*4m?#v2>=z!-B{6!;v3$ z2>uk7B6?-!xwT_1u@q>sM|kAUj%G`qfVwq?7>#mQ9*wnxfuE=*#l5F1WI!*XKS0h7@x3~zZ3Z25bTYr~M{vgqo8#o|Q0EMteJjG*v?QHrRmX33Aks}$Cm z?yzq7F&s>1jnHbyCp0R_oDphhGcAyKV&1)?0zy>W-Ml|hp26Y#_6JM!WJj9lmq~Ct zR0+mSBaj>B0-d{q#mbOld3lS_;qbPa5=Ggb*FjE2qK#Pyq1NxUF)qGbV`_2d(FsvA zd~4fjD5(0H{N=yj(rxO^KkGfgDlrbpQ9S)Ivo<2E&{m4tcjXqOF1SRQiw~vlFhob@ z_==q8xXNCc-3dA|Am3&2h=n!B7oASXf7&?so7rX30T%zDD&{P%s-rTP0`YhwZt$G3H*2Q^K*Z%5V~r>5Gv@rnCI)1J=r;os;g)?4rz zjlKqmA}Y5=_>YRfyU;R@aVtT3C6T{OW)eLgC!@xxRO>` zfh*OHyB&j(zU_~}``t-6AvVV4``%DZ?F_nxN!V#HgWp^4_qPMz$Ebv`!k!sGy^Kb0&$nK@vDq66gERzovU5=|=f3JH5= zE#uE*6uc#~+Ia_7&f%>T(y)+(qRY~;7jr3hJwsopDP0heD!xg5MG~10(#kDf?_BFn zL5SI81)G#^)Bfu>3msu!f~ZDv?DdXKm@zyYJd(hB{iAC333~qn}xEqm@y5Zg(W>ltn)$Wgc$*PYFJ0* zRfqAdt=;xV!geX|7iv)>feHz~Sr0-!n%aw|nWQgrIRK54ZobtZwT=8@@J@#l}nP51E29_HE(&n6ah@jwMHx5@0ArDo!A_F>l1tk~T z4Zr@8K^~~{Rp5)*OT~2@m`TIcypDHmUH39R1$~^$S5s$bCTVqw$LG<$;K_jfC==}A zG}1#oO%_ZPL!xja%@LeVc#Pd_);6Loo^fW^=-?>4(!rK=FXi5zE(rXz>ANEf4?sqH z*Z}5pdfA^FZYMbIb1up{?5YEKnOolkB&CNd_5f_Jg4XX*cLunOgwCXs_8N z-+}YEL4#1;66e8ZRH$JDfr{zR(znfF3s>zB%lbn=$w+NvzF5D2P)P?j>Ps)<|i*`qO zOubp_=V7>I-@()G$iG0p?o!8xHBaV3s}?>!wpp9+x#L-G`t-a^XmsWEHJ0;NxW-pt zYzN`*{CE$)PINsSH@PfR3f=Nk{%u^O4Z%t374|nE?}ukocMx%R@i0!{5j|rAEg=Odp+Q`@MBfc?X1= z9+fgMeAA&8Ft7~9)&?`JSQn7B2wEwNg~uYLNCws3@<~qC$`ojV7`yjeQho zs)3p1If+HsT1G%d4D3vAZ~mayx91HWZHvbhL+cQ*W`_dzEWeTea55T;d8c!r0v=~d z>keOVGXkHNDLi@(D%URWV6HE(cVm!T>epk<|0wozu7mlhjM!Jc`8U!~MAR9tSB7~R zpfA<*V@KY2R8U3;klm9}_)M*W@7LbhZ|-vL>WP>PKI< zPJ1QQ;)tR8lNyL|{h<>fyjA|x6{aRUZ&D&MdSbVB1M4dY;Wg^N{LEID zof(}fGNk;7tmVjSJ$oLre39bfJ30S|#)5gC0>t#*F0-eOoX7Bsi&TEQLb^tG@pyh{ zwSi+O1Uz+m92!m*NKmR&=MCsY83->tQ8#gW2vWriqaCg<;AW*$&;R~~8LMZT7uGH3 zDkPrE3LiZGI~V&44%PV5U?~*0-d!5R<#c$yeSmoXEP@~)Ru@XY@OCzMYsD{=h-$(8 zqQiXwTeY@__@Qq>H3k?yTj!2gPLyk zQi)3UVEP{M8@_rrF9T~Sli&BSGO%&CA&7wZ2BB^d;BT#eq1cF4 z)YG_JN1}Cb8pEdkzm7hiJw$CGHx1@^Yp z$+rvy=t(b9-Y7p~=LGB4oOhU{X`zmjqBVt1a+Q0!4E2q03W+|n`r8Hatp)ET!OK0# z(ojzg9+~ujw(a97{>5Jsgr!KR7cgeL&f-yttlyC3tS%-cCQpQ=CMHi#Qh|>!nWs#L z0+~QX+B%@G9U@7{c@5kEwaFO_6f-8XbQU?m$O-*NYC5$$b`dIYYV`48?O=0Stg>E` zlFRUG$-cvU3UOMpIR5qGNcc4y7>mEUFYil&!1QR#(2*urKSZkd?-rgCuIv+%?mPW{ z1fk%^EbyffkTKHMUpHqQcE7**e;t%=ab% z_l^P#RqSz+b*6Th^K1?uj?1>6RJuy5y?XZJOtM~^mLYr<7(DBB*WB*8;vk*-9S$Yo zP~ue1>a}Sn3#Tm&SstC&^~U2$22PRQ%H(2&mvz(Wqg&+N7~-KS3Fyw(Kw=@MoOGYY zmS+4}g_#TQT}6ta-Pw1%TZ^T+N7PxcC0ePx@;&R-njPfc4uf#OhRM7=Tg2L9x`!`7 z+kHm>DoehD|Ih9U8M7z9i#^9&yhSqWNpFS#;VI*(2xXpoF|}0Q@=n#H{wc$|kEl&; z4RaEU}+rJsLNScK_!LPcr>HEh%-k-5-fAZola+SHf+dO|Uc`Exy zpgV8i`|I&HlD&vJi4#laSKNC%ZftuMk^fp6N)x1aZT@|5BGFCe*| zcea1n0fHJnY4Ks-{+7SMx6xM}-Bje8f;1h5)bQbgCClU)IqJWZzjbmScf!v-yNd~% zM)?rjEnE&jQY{aFkF7*+{-<0S8-3-m0!BdczyEy#?LF7Ox;AB7T7W5E8ikG1xBd~L zDVi*mJPA=#ovgg?Q0Am4>+wQDig z6*zKjx+WG(&niV2MGW^nkG+}8yF2+oJ0Ams8u$SugWNXw2tS*z$0N@Bh6i?oMP?N+ z2t##f<;Y31a_xSoJN}scaBK~i=k_~K38Yz%M-X3*fpGfST?JYmF)cGCXSCq&%C#_T z#Sc9W{sw@&iD-qkV7N)Xi1QMc8}uWCbbm~_@rT#fVe3_HL5lv$3sfAN$vJMDs=s5# zLU4uzSS8nhDoew5Z^7=2fTV<;dRzad?AcJQb@ajLotvSrdcA9GQ@V@YCC=wPLw5+7tnQQryUv<^)zw0M`J6%S z3lY389*1kEiI&nj)QH8Xxab&8KpZB+Kbu-~ARWIOz>t7BOg>h3`5T!aaF$5);Mgl>T`#twA|w54;ZGs-;>d68g0V_E#%h_7g}JT;g!X2j1gY*b3`m;0NsRB2Ay>*KuXqxJ`s$a7eJ+R zP;Yb#8F03%0gB~n;fzbjGi*D2jKOqqt&ECn$K?dF3o`UB``JS}6CP~3o83vf zzDC*&)wg~mtamtWLv@ZE25B`z1VMV(g&;sK=)5ap{zQ|8*Qj{Ad{i9iiDOT?V?F=Q9N|jGue+$l0)42hw9eU;Pw`yN?v-0lRpG- z&3`K)B@&Xuk=XuCk&IuwoZi0!K@mrJEa_XI|$Pqaz$KIX$ zl~NgSreZwTkuSB%O|Gpo{+&E$J_IH9?u-dw&a?d3R=A%Tn}CzBPurh(S410J1Ahh= z2Y1t41ByiOIJQFSWkxz@%q-ZBKlNS>1fO&8NnS^zpG84IP&}jD1TPE9idS$7$bL3Yw1VXPhnwy@I~@004Bl?Q;G8crfZ` z&m8(dcZEe&LBqW0>8g`JRj)90Clh_`;SoWi&I0xKBj@##$1Ggb|Ur}w2L_qOGTq0 zP%ab-K#}EWNCDkPk2ick+Smhi8c;k4sO?|YvzsFwiL2{M+8veD|hleKDjcC>Dp^-A5DA?IIQu)A1Ej{ zJ%;pFPOo(&n))oR)7zE2&?kT*XKzq*uYbxG&1`YVc*(ne2xAZ7O9NWE81G4hr(&N$ zN{)n-Cg@kQbx_Xl>)Ax-F6u`$MZLIJuO;gFWxd+S(lB`)$I+k&@d{HfoLaavIXex? z>=Cx~8gGQX;^|T8oHIjQPAVDD92TnOdT;36&*sgvyw+r|)uJNH$yl;*&;U_ViBMkkWwBZ5;V0us`9x1z+^iGagzS*-K-+qT5BEO zgz@fIItPt0#Rl3zri^>|ZU-WJE677Eo*pAsAT;?IB;{DRmv6E%z81LP9^o5m;OWmE z`7p(>!*~!v{4*#Q>OfHv-u-zT#5KTv?=G_L)TItk(#iDCKl|{6p~oQ}!b=HErV?>* zws5h7{H+WPZq9bl2_(qafD68%@Q+LG5V}|LCp#MR0jI=v!Ph~7ZX@5wFukv#B{Hzh zJvw;{E=7dT@oSn<^N2x~VY&{N(f90I0fU4BepoK43IOvZN;bT8Ymgxj;6lRm>?Pmg+d{4{0JEn`wYs> zWdaar>l)CIZQuy_!IM=kP~n7|93q8{A+)q82A(ZA4>9#|NoXJF#p~~=1BX|ZT!La zKVtDj>}dX@3giDb|Bt`^$z@u~bT#kgTASWoE3U7554B#}olcC0CG4kerDg^iwr+`N zEdy?_>qz}fG!zR(Z-^pgGY}GWmWWB6Oe(D?QaKZiD#>I*>SnUMBH+81n$CBF#N|}t zh677?ydzjD^)fTZv1uk8p6X6Wv}ov-yAEM84Xab#2}8E>rD2C46lM#d@XLNxGxyEv zO(Z1W@LTcliLRTOI&`1~kpXhphTs=V#WwusQH#GyPDV+jqKQ~Uk&}{|NyOuFM1|>S zGOcNmw5C8cHkQW|SyLx+6h<{o8Al^ADCJ+ad80uG-uf5=;jwOo=}anSG_(}|h8YUP zFFG@&Vur06+Zhu(n)H}yDV^%Plb+q_T5sH3t;p(X*p>&gWpuSl-HOtThrM4awk9FX ze<9d%;FwD748houU`Ec!nS?BJxXa00fp%|Dj%}(B_p@2Ot;zETeLY!@e7J0ucF;_$ z*#wVKNR!$bXy}k4$~}TOv_Wq?OLXr>^?oIZVxud!x2)1|a;Y!ow^BPZHlR8;bn5JD z#JbwFSekb=C+fCxSM@uGSWd$-(^ibt(4(ouzOZepFW*d;GhO>8-{m&q%H z=KEBFxsL{$*oe#zOHhc;I5LezByF^|O|z3LR{Cb^YP>Wb!}(^nz-Osl$mVMWUNRbQ z3}|kCc`=uQ#+6|$ZE8q)jHI1G?H)Gf z2ru(tGv@aEDf9hQrDBFHTcu*g(8uE6@I)sjzq&@enu53Z&*O<^i91m3j4a;>mfe$2 z$u1b%fwC@4&B~b< z!EA;(H`X{eCS{o=xNMH;m`^n&toL-oq=IAGUO^?9OiIO!ONsb5EQas>dO1*@!H=E; zzr&)1{d)iif2T8nMwUYNg%6V1@30B2!*`vsku4!%(#EwsVZ%DjCpg@xKW@V*wGz=f zmCBX+VE4&m*)7Iex1w5Dh3X6ie+OWOk!d>{4-@ft+)EX`54t`1uin7D-}AuFFm=ZQ zw<2Zg{W78M*AR2Xeo-4^g9&4nc{n0%JJ#TK^q7rU-EF6QA02J#tE3itaMjyjZ7ziw z{rkfB5KN=^=v+P4?Buh2Z*63<=v3Un!)7ruvp$$38jzUQ?icSP9rr=YcJ7Vg$`}@- z>14b+9^0+nNv+M*&}*t&QIc|0Drb_(R3!GlRCSXRZThNsLLE33WZX*5>L}H+^PPB9 znYxRdMuvA=oDE|pJOV?CpTO6nwmTB=Og-L*f3SUEae67@`>$3<+0lyY!>%cQ;#{Fi58s`TI+F*Y3YvN z(JpmnR>#5?&)^vUad_FxoPuZn22>&y{=N@ zMH$FLnw{&$^K3XQDOICIaETTk%Jb&qG=lUMt6@>P(j9fS7pdv|9j#eQxgD9nXV`tl z-KCsMEA_^Lqm5sEDilFiow;tcH*txqZC=)-h2VO8;St{WLWPNrigZqA*E4Wnv67R=FxO8rbE6nnw`(R4f} zl`~2_os2R5Z|*)^Ae@^#c~E6s#=Y&}6a`uThzX@?rdICmxtO>7J^UMu#gpkoobfM& z<3wtbQqyo8i^gCqkyK<2rH~StjH3}bfg3dc7&T+RhN4)qY-_GtdNrWMz9Gb0n^Dy>;P;zo!=y8WCPV|WHcB~uPR0% zF<7n&TI@T(Y7=ybgy`(yu2#zS7H)HF$Di$Nv-sR9M@GuB^&MbQG%g>2?T2B!nYJtK zhjGHuXN4$AH4S|ehP58l6HreiPxXwtEy8P{6{}Q^4Boq~? zhhXd0y_=_6tFewf)<=`OXg!@o)y;i#UjEOLdpxC%$FXGM0PLo@xT0<%KBslOj=ICU zt9(1zR8m*1Z)Z*vn`5MJESf2lYXsvq>dO_CvI+ zA+xnf+0Sk?S~2N=Uhs|8Nc4~$Iu@OpYHi$$O_R^@2Uw@F(=XYj{&ye&s?qTwJM>}g z?rt7yua}82ZdNPBtFoMmw^Ex(;eVQ#{#LNsI4U1AZn!rpBF|PDt5XRi}$V` zhlP6f_M~hN`xeZflS79lZSpy74IbvLtJS3J_FLO>k(kBDy2I+oT=ONo9XgcH5@iR%ROqv^;LDb9ao(uO~#|oD4CiT3U{wz*0$9| z%s_uqjUKk{L=? zEA37EA(cz$u+pqO!fqI)obhWijYiY*`cK*_M*`=0+>emRN-obL%ayjx#U2)kUOB1O zzDN2W=&Hj83^~1q$+k6alyiz!P8Szrn45IM_rurtVx3C-NrU{b<+2`E^kki=F?Zr9 zvC?eePGN7Ml@fp2G(T)$6icK2dS)*t&bSrbWVNMHov5T)?S6-fJ2Z9<8z?<%OSM0@ z?;f{AfgKdJlejg>I%c@=I_{pnmF)ip^c}4g4jah!ileK^s&m&>$p|^m-DJJAgcH(f zeTOnVG(is=SX8o+Xn$Mld7s#VLdxot- zKUK>o#i^z}zi}`&#Eys(3&}Sma=0lHNyg&|sho+X(n>_$?}|3X{s*WaWFrD@{0$Lc zLJLk25#eCG?BVXH0mm;kNX2`2-<_8`p}VZ_+W}2Rl98w^sTp+)C#hIm)l!jYDy1P+ zO-CcCR2;(iIH4ud@v)YIQ8^*yGp0+8U&R;RpQgGKkt0z#7Ks5B-UP3UzZtuhW*|Uu z#?Z%Vh*i7sFc+dYr1&}fa&VRs^-?G`g0EX%TCy|Z720!_Am-y%`~j+|F&y0PXXy|2 zcJ{CP%WrMy%&33-Beh>N=95=E&dIA%ncpeM>JRa%XCw-wKAj8~am&0{Vz=HAl4#iX zpFnG*`sX)o*4-n3#OY?^!@Ie=jt*zNjWK^9+NM!mbnpF5{*wn9|3CKL13s#v>mUE# zwroPl5{e)ZE+KT1Y)OaUCL|C@2x(M7vf14vOUfp@n}ook3sOQ+L7LJ8MFo`(f)Aod zQ<0{qs34$HEU1Vgs38B(?97In5PY8JE&kv4_d0yY-8*;cIWuR@oH9cS@{VTH_;D5G zu@(7gWvNLM@>8-biI(Jk(YmaHe6O@WufkcKXCLoBEKV0@hziq%IwI?gO1A zT3z9Hj#*!OO5(EjzT&W!$~o4OGHbEi$7#1Ztff8akTue`P?z^3DTBlj?K^4YGd=wk>;p;eZE1L9~^$ z{A~z1d~u<+Qk%=C(C8mWk?89~T}0ZQMdtG1k>f`=wBdy&?eOA+;jV0xIVMjZ5nrn= z@ZOnkb-Aj&SxORPBU8%t=|giyMaITvCE2o_<6^5K`#Xks*Am6a8s6l|1!?`qjf;x5 zR~W2=%gZ843=aLMaiy8jnYEfwU$cFq`gUWzlJ2b3XnVA+xY`n4Vo%B_8<0P|GO03U zhosNp2ZnisTCs&EJcZl=2W}2GE3)*(q?)Q$5fqv zqHXaVNYfV@F=Td>9IGtAOpVYuyFNl(p$=_5P9(~pB{9iJIbhJsQi!mD_v{6yI zD7`g5Kf)A6NP0ae(%U}bl`wRW1;Jr;I*avT(V?~ch+O+i7pAMjOgNpz{#kLg2Vd9Q zD~^jQ$Vs#mjVjCOKRn!?H)w#REWa{Uo9#-7znz}~iIh^eecqGEy}PoU)CtMunNC~J z5yJ-;m`u@wM@3rosrktznTlda%kJ6|SFs}_J9bD!Wq4_InWcKrunhaqqM`YTgA87Q z2W>$;emU7NynK|-l~q>dC@FJ|v}Bq`RZXZIRA6zkL7P@wY6^GQV(ck}#hC-MoTdRW z*#jyHw6>ywWY7|rg%U=9FwEMp=rH{qbR!}r(tluFgf^D27lW-XQ!Qicvdd)^#ojBP z*eOX~9Q>&QF)=$SR3F-}*i_-PdIuVbFt7-Jy4I5&#J@Mx^tz}heXPOX92XlCldp?0 zn9Z@4sHoW3ScBGVuu)oD%nd67P@nDyNYs?=(`D<>u^YiR%Q;t135 zDxG#vNnC=%X0nu8<$m^3TXC`6$3)+a7OTVOW^Snk zOtdyiZ!pA0lR0S7$LI_ueWWQO+K?ZSr;pO-X`^Gc+US@_lOfWeGsi|4qD|iI!k@8R zckBS-4Rk{O>C|(LEw&eorDlSRAF>x0#^jV)5^Va+(wyRm{;7tXah9RB?5Z5E2&!I| zFpJIU`d9M#py;cn$`)lAm6TN0f5?CmSGCjDFUJ{Et{WT?W3H-~{B{+8nx{TVxc%;3 z%d_J8C4`j~*W(aM%;jl$L!xY%)|i}<%zpN)B>RN^!?Vpcr&ng@f8lOE8SF_5|un~+|b%AcUCl_(A0mJwjwn%-`;OPR{Fs4dE;{u`-fMU zGlnXg&d!Bb?wb@StygAvc1A=|ajdhr|A>TsLk5Qram2%I=qJ$#Z2^7N@3ErQDYa2_dvHh z@@172r&mTs4@gUP@qJYfgE7zt|EVpHetvK&DnVF0o?ZIISfmCMDmIla)|7BxzK- zkK{X@#djrQdP9s(OK4b>ULWb@6|=L`WG_2xVPwp92lw&6fOg#}yQrmRKIw&*l=+&g zm>RzC^)QiGHGbq^lXXNtZFuECZK|%wFg!dhp`auuJo7H|qJBYaQrHKVTMfzS!&8bQ zw8LHH6{f7@sN&*;lEnO>45iT-F^RVENrtk>5jp9O)Z&Vaiu7_*dR|h27p0`LUdG>R z1XNevWr&T5iO>;zMn}d(X#I2IT!mJde##5Dfe;NO6*}StHb0p+KOyp`8LM(M@7a&L`9M%+7hGB z*J~pqqRg=deWczLV~+LWG(TFW)#jOF@}eUwQQAoD?bYT^Y{u(uBghhZ=R#E%Q{`z{ z_M)6j*PtrH1lQ2;LAGI5Yrm9n`n+;F?HgX~>LMv3tIXCfIe*l^a&v)hM3Q+}d09+m za+x`{$j54B3?E*qADUleNivM=AC)>TEvmYBf_6}qDJ#K;q*_+1VN}ILMn{wVKulD$ z{=X1YwR~0`#;bN$=Ljt}xvY-=etagyInAb0YjOVFC5%j{Q($$O?WOtgJ}}8F(pu`O z8)q}yODpR}6(D>r7$sXNM=z~Y*BWpDKcT)fMi3qIn6xS zW-0Kp48;~peeq?_)RC_0@RWXO#Svu@mdXrQOi{l)T}ff0mW^r4u#)8LVP!dG;l(3k zqJ|b16lLd)FkAD(GrWX{;gbp-!lLUNAR3}|u?GKvak_};h)Az=(rhY~lhgXkdA3sT zIzsP_bXDZ%D_0aU&eRQ5FU#r#SMOn3aZH(1mh}7rlVAE3lCd;^?rP`s%gGybaO8b?j_beFhL(;%fLy0wGU{ram zwmL6!)Zmn?jJ#2)6;+0z6iLqFvGgRIy9$RQVk5OoI7H}9@(AzMvc>Z4tn>mmCN-)e z?CSqqanZlU1=Q1E_%K)7afL+5cBcSJ_Hk2plQ!LffFd%tELdw8_gcN1OO(4r5U0HN@ zcmhP~qatIyGtpp(@+!T&_c=POPN&UY8g8*F-sCj8)+jJc%J!jm6sgBftNZ_ViYb*% z@wDGcwrxT~%Xm~mcy;QCky+a0{svQJe$T2w6GoWR(?+E*8tKbMORI~b@k5=1#yOKs zl~qYmJq_h~QTEaS!^@o35v7Fn{{P$OQyCQgzhqDH-%^Ly|MyP6??1c$ORLxY?f?5% z1O@&XDGDR-_%98A?*FZix)c8fLsaD7`2Q<{Z!M}_r^5bR*Bs_m*s-Gm{>3^7JpT0j z2ffaq^W=tI1JZ?O!K#Ns-0okVDJlU=kfH2YYp-ay1in0QS$zuH%>-cB$UvJPy*Ps7Uf9d@%f6xCq^WR}Du~&M} zXfJZoBYO)?PC3tNEtMTs?_CsDi)?qWbQb?ka%inKS~hu)dzbC`GMU%4E2Y%Y zWpWf)+1+V&r-EA210XH3$r5TMRoP2&MCCY!TP@8 z7HegAX+?2yFzHSOySc^bvX{xhW>aZbdWLDRTxD{U+DZ$Y-c#yL-jmtwrQU)_8_o7o zr@fe7a9}l=3*}O4mDjw>iw28@o`6eIk`I+uhx7JLBi=%MFk#x<+u$%&dGD^F2&uDJ zcp+S7x0SlQ=k0b?4zjMd!RhOe!&c_I*TmwzQiFikVX~24$z5f0p~*o zY{ip(%bgrrVj6F;mbnULogC__F0;zTz2!U0>@JV?_jA)>?)DC0IkbYtjW;<8oN}mx z4!cmZ9NalQSXK-Rnv7r}cyx$Cj*pi|2iFDl=wNvwMbGFE-K1bvm(?N%JHsFB8Xn$T zc7}Hi2@emhSEHlE-`{&Bj;*wa0K{8p83AnVuc+R##qRHC%aFnBLyQP5u4+93{T|{(kv3e+#=}$DO2y6eAAul-B+fB)y#f3ogd>|^ut#1-YEa+sXTOm#ohA(no3 zr=$6{ze(x;)8Wozf_&!#h5h-#fMI10>%S-m`ls?AZM3#7{WnBK{w@FcOM-&_n=BTu znXeq0Er%A!5qg=PbED)q{r#=uZ7x~+H&yt5B>X4l|Gz8<{-^w3bba|xg!XUw&tDT1 z^WW^Snq1bgmGlOUvEIvhoi2M>x9;*p!uq-7K7GcHO&-#J>{x$AwoX*u;=L`$M$I(L z_L4G_%a&&=wz;bPy-efikcrw(oqB{%BAlbcoYvjnFKcLeTJo^uw0NED-7$wd%(AoE z={;P|?UucSM(6KW`z_CIZ}`LLkcqmuQ090u$={EWD8h|7%&FZKDV>ECE{naY)ceiL zkNNw0G>PZd7@ppbA z-0R({OI1`?Tq=h;y{)X5##=)T(Vb{Qc08d<}T99QoDWX_APYv!*P|pY|atLR%-+zmr^1W}&F7bH=DoY~a0S%PZb-c9%{0 zE~|s=HyqYdQ;F45CleJA-R-E-Fn_iMy1fYruXBECc>M+_#Wl7267Tj&nX^uL<>-cl~Z>?6RtAGEOKHBiN{r6uI z{@mKbt2>r`*1VLRk!vk_<+}R+zZaeVg+Y0K-GA2&kpF@EA0rL=zwdwiD}wUwtp7py zkBW%?8~=YrAoy?ST!jD1I>`EeH~i}(v=NcfUi@pLqa$_EI_m!w`IqW{|L@}e;pDXb zJjd0(3)l|wwrq^b`)*|MJH*?|yAd%^!H5T{gYkD7Z~WcA z&U25NrdAtJCm+x9t+`3_t-0x6=jmZx@jY2F$T;t^hyYyg(|q-xud#H#r^ud}=Uo=n zKY^h#XxKB0)pxi4?PeADo<0oR6o54;5h&t8Ire<{~S=GK>7nJV6qDMRRlCVjmzhO2RYzT6`+!U5&@_XfIX~@?+Acd z1>EF-fgG?>1U?0DTmU{3fNQLr=>XP>Kst#RZ`V0f1fG+ChdE$8OIyeTzevDMmM&fb z9#H}1JRqom2Y8^Z3iyhpm)Uc?3K+o<&{P2C0;myywE*lqkSqY7bHE7>=)~IZ5`bzE z2o!-QMBp7o+mv!*odlRfU@8yjdEkNwoMzwhBw!>PTw_&$Q3aeK_yq8Y1niZ7KX_oU z3OEm7B?p|BfFlx6tOAyBz%BwG4!9-&X%g@l2c$FHz_f#m|QSpdG~075b*set9I zz5ot*LjuBiV7dw*6Dd;!4gjbIaF*435x_GX;1Pge5%_}xG6le?0!Zc%Z8UEZ~42 zSUH0QV4Va^08k_VUkSiM5y;|zN(qPnu#N*>;ee%N4iFkb<|7Zdd0-D4R|h0uy#!p5 z0FeXk<$xUwPPa%}0KElZDGvCjg%cz+x3JRs;xP`key?NWeD&@HXi?2gGtfA#2l<08AXvN(AybU=*Rd zBJeg3+{a*_0bl?JjFf;1mhVkMGelrC87Bg;UH}F&7<|V8s}y5#h@uY~6%Zf-HXb+z z;71-9Dgo@|2jJ#_PXu7L0Q6?_@H4W;sDRf6AcY5-a=_0baE$fYzyUv!@;IOg54=)$7@{Lf zmjK{*09QDGtN=ZDU^0N0Sh^1-;9U+_AOSA}xXuIL^MI2BKI4ECmaZQgs~itJLuiKx zwB~^JJdgumD-WCluz?3!0q7zEFS34a2M{9w;{YrIT|6ID0eXgylLD|s0(c21RRPTf zAVUJS0SHt9b0pwCvfikG4HD2t0DcmIg%Y4xmH-qgy33x&Uyie$x z1T+CKRRx$iV3-JW6oEDpaG3+zseo)1Fdl%7wW+ZLd`jx(fu~hK7Xc6jU>W<~m#l-r zZJfR!01gSbM*totqBUfKWnJVNFaOShTefVH=S0_M|r;7b5+hyc$4 z4-(qQ0pBRvyiEekBJdi)H-HNq@D+gIl&{u0tT`A#xPtLh`>L1puccu`+i|*%Q>Kf z1o)|dWjyda2dp7$3~SpHJaCc0?h_t(hyxb!fJy*v0f-iX`$S-s09@t)jR@?PfW{*5 zvIJaY^;D^Vk4d{(SwRe*4i&JK#R(#y7JzR#z~=27CD;3a51*DTcsDMuhO&5SCB;aWQcwPlq$=G5rSw?s$0kEooL!=H4I4uEh zk-Y+;ON6Eiz)l`0PyvAqE~`agp8~(LIbbgjJS+hRSlLB9@SFfl7l0XL&13xxmw+e^ z_<#fE@_>m4-XOGC1Uj)a9SPq|#y@~RMBqsuuS57f4tS9V9wBRl3iy(YQx)*A3YaAT zJ9uCV4;TpDC2?dAA_5*2@QMI@$OGd!K+Edt&dOc`pp4Kwf@c*lngjYvz;)Ko(GqZi z&~piRh48~X-OJ4&ysKi2y(9q7ssJ5>Re$!h@W6+xtTX^-33!pUp^^t47l5}o;2#RO z4r6)WCG?D}=j_|_WFIO5PjSFu4w$9_`m=tVA}}WWz68wk&1r&16;Q?ln-qLfF@W|y zo|?>A7T=QWw*=rDUzq|hfbe&O*CqQt056j{O7?aFFrV;A9FR+BzXbFos3jz2|1iDK=Tfz^MxhnxP zd7xYbW{5x+j_%j*1yCvh$s%xpjC}wDMc`4^FJ1svh(I}jYaDP+0tCVjko^@|56PNG z)}?2p^#E&UAQXZc7WPQMY6;lc06dnc zfN=uwDa-#c!K)(OI{-?^9!*i^*t@hlOYwW53b?3%*$q~vLjbOcz*-3y4xmB>yiNFi z5#ZQ3ohJa_H308H60nk$b6f;IRM4(m#qX=WeJa@pDB2yS_&pTBi=^M;T{^=;X8==J zogcHf>;}?}hV7r4Ya=};pI7C2@iB{ z0G9^|UPK_7)whbQ^*peUy$`7eue~DBfd?v8Kvuo_+5;HH;#_y32fgkR|7YQn2=rt5 zq6l9q0ZYglAp#o}eVRbl2@$v?0oxVzOcNEtQbHHl?=$SZsR*o80qT12=^z3}IUtI? zHzItE3UIS@U-N(;t7jtzgcH6(1l|;Y`^dgjQD+=`zQ)z9BUJv<^pM{EY$2EY13K6(pQC2HfM_&;LB76_wjk!DX zT~qvC#p-*BJ$tb9%@t{KSbr{&dCAh1Dd_160N(@n7QkW_pP>SN5P;uVyC0N*d=Yq^ zz0c!;uS7s1`(FVVF9LxQ5GDaL?rgF*gp;|=+V>G_M>GeVWpQt@bX5{iUorC$S=Z{p zq7B*O^T1FAY>OE@cd_!1alo%U5UT>J*}MuPedd6kit=!lmnz<&E`y|{Z- zz|ZXWGb&(-1axNQ?<8Yg1#ARhm4IEWjo*mC7d#N50$#ey*qX(jsVvVz0r;Bit0dr6 z7B`c%rN0WeCIN3VSR7~l7*%h)_%%>hKNTR8JtGIKuJ`>50hmnIW(8dSp-2r<`>Jfnb(K?HiUZy_9z#_G6NxUIKc%gU>0U_4ZFfJp$dBp^vq z?@`6?8kWx=zzG)DxdGZci|p@MK8dyQI(vV(fj-R^ffI^ylKzBun$OCU1i-=4P3D06 zSh-Iz+$|M=aSe>qRf^vyS$|H5K(+|HApo}+9zW-SZUQip@Cz(%5G#AO3OFnPb9f-N zUiq11jZyTm+geNx<=ji$EIzh$j4;3TVv( zPbj{%W_?OxWi1wfw0bxyVg0{RFFusLUnP5g_IsrwO@6(0JWbYw2KxEAZ(kt-CITA~ z*e(J?74z^d9%!$aV~;6y>=Kac!;J*Au16ETQT%Sk1Hab8NxE-NNkD%B6BZxS0Bvc> z+GuWlAcvd!m#A*`H3inKuuz^Ex%UmA!v z`1F4qaI0RwC6@kP9=M{2@5SnTOHtk=2{`HFlX&0@30NcndldP)G%)Xavpk_3Fn|Z1 z=73IjCd0=(U?%%}MH!PNpoRxpu=i07ly78xn#%!O>fvpe1WXoy``PXmhxy$@xui)LlT3BackaKBIIt^yvC zfOqPRo2OYl<3zxp&9N8&rDR{p0pHbY+k6$EC%lvd6qEgx1jLF!GxlBLfX4Oer~$B< z14LHWV)lIyD?5wDZy@_vvTl<(A^|_LwvVU>n^X15Z!Q5>S=vkme4dqnXB6)SLgRTL zQ2>-ih-CusG7s1};7bv>R|1l8XLwHpjm~&!&SgC06($#-iq<}Is1K-y+6s`9~FUp4UC_L!rTVZMX>W*Sej!3FpHHrg#%7=z_5Dw>&o5}C14{D z91(#=Jn)O6z4gh(WyQBAMIea%{z?L#KUNjNkiomt@^%^?aac=TGd}o&y5w z!TY^>W6iC2AK_aES)FSLtRz6KDC3>G@UTxQ;?Hrwy&~|t1e_It!xFGl1UL>b^1y++ zz_f&{7i9m*+VtRE>S`naZ*agS9=P1VdiAgfI7Fb80Bj(AR+JMZ0Ea}NCwu>r1Ntgp z(1_3m5je#I&Iam#g27@6!&4~-l!`!~2HLTV1G=#?LImIw4)}-%TC%vdzBP%JSxVL} z_WM2#$YXWb3ExQeJFJ~eRKPw(J>`F9jLX75Sl(|%KvGd#*(r*CFB5@WMSr&wUV?om zbkF;fqw9%`z@Sxf3(mt`n7cpuFg#F0^uU-1sAs8nLj#CVuissRJ~GmuQFocTd#Xq# zcr#s1Ow&A%XLl#Bv?PR6Pn9|v5rURTSg9G|IcPM>PMgujP@S-LU2}qn~gi-LwyhdIHs62tZTBXS)7%{7LI&dj! zqpZQoHbw|?5Aa+gG11f7$jL@8AyI4KkxfaE(PT1~N=BnsvaLSLL!J_psL=p&h&oTB ziD)tC8JUB>?6+6W?FOFLh@2>U0`pRNal{%wo@>ebb!^GWyvWPORY}Gs=spF75Ish@ zl}4`dc$$zETlNASK?s_(M=w(8coV2HrtR*0R`w9s!Xv79bqWV9w_AP1sD>=ySPBng zf?9*Ofj4_hL0~Yqa(d&`eJc~aDz)dZ@omjURkgo*u5~`ng6Gj>ZidkV9%(uaYNn&n zZuM?so7L*zDS_v@kP+dLA$vGa%V(PBs-rR%{zXs3sP62f;5v7Sa#cl#g9NE7jx8pbTmzRU9DCP~d@hzaVI>RGL8q;54eM#!23e|1Q# z8goMcEg#ajC8;A9xgHOi$Z)-=&iyesFbByRb;=r#3T-(U`>l*^`f-<<9Xuj5Y7Y+) z+8VWoR4wt%+sM;mjPNhx6OaKJ@XJ81x-3CVFmm#UmNmxf3EdOgc(mPeyW)JXr#UAX zjU6GX&{UkO7QL2MGUr)fRC_W+qeiXn*3G!=*_Bg!sxw=uz49vv9;iR?2s~G#wHUdS zvl^|4X@1S*mBtnt7$@_*26Hq(ZVKSvP2H5&@G$aPwR#FADc}Tfn%r196CU!(Gj_r zcFd%aje2ACks3Wf3jZ8H5&b{1Y(}52{65t+%Z>!$=cmh zveZ*BE^DS7m^+V@UxOr>C;QSTj3{p;%SoQOQN}jSd456b46*xekC?!FR`PQbWqGnj zo+`!~IWbq0;Wu^e6Q7g*6eiDY?J{}1d3`e4-uGPl-0*l_?En%M$<+;x7RsQ z%=2()V?saU@fK$_R7^0nhv=uafX6Chf~=l087Z>IlLRiYBVaW0MmY)KNr{?_V6XN+ z5mUfnY766nDZEGhrbg`6--F~rkwcfj$x!o+5z!?W(kCyjvGB(xB z3d(J{^{i&HM+?8zo;@{F+jyYnw4Obb{%0`-o&;|Jag@+nKh5%23Cc`s`Lq<|Z z&AI*%yomKj28^5$t7_EnkjZa_q=9<8I#7aowpKG?hoeRA`e*%u*N8wz%q`G2H;(4g zjS!oF6DOxw`itD&sUE{DXgG}=;J;_(n;y8xxYI%m_SDRmkD-O!WTgn6-;FSI$AAO~ z@?>-m>EmewUN#~E=sw-tX1W*@T?44k1#?sQvO>T!)1yv894ABLrAi{_$!MPFks(eN zb2Uiz9OL~4t%B#psr@;%m>C%0X)|DQQ?U~#LL-V6|EcBkn&3z9AzgyiFePwgapYuh zI)LY__ujc)y?QJ^6)_RN8%SUuZE_%#*>piB}Fnqg@`s9WCb>z+)WITA@Aix zvTqQRK3B_flP1B~Xq>~R@N+%=jWtt|=%)(yfNP>5ZQYFwGU(@dWR4f73Qbn>2`ixy zwd#;Oqk2J16d5{bsb1b4+`VWcchss=R_-zW2p%h^bezm-T80=kUb{I>%5iVQcT2J- zG9-BA$_%lEsyPQjr;c^=Bj9;t3GXk9B4^@TBw@;escK#foqIgf-yg?A@{{mQN#(Li zD2k%oZ6rxzAxUnPSgyGxuR;?85B&^Y?kb&*Sqr z*Z1d~_jx@hBrK-@zt0v<^Cii@u&GWpwfOn;D0^(ku*ma*rAGce{dUvS|1Rd&KMi?D zu-FkUIvSRD_H5DTr4wz`c7crM;xdI7kJUe%%~^Vy-qhphW$^)h2qpX@LX~~Hu0&8D z>he9u`!F^dJa)R&^X4|0u<-Xmx1(2b$nn_Cp14yEH`69x8MnEkfTt{<>snZs0@A){ zy8rs*{_)+7y=k9oI8&7e5!0GSx!;fn2lvQzB;u-)Ucf2yUQ9mn^db^()AJ{>m$GR zvR%}C`9@Eu@#Ac+LYR+T9``K&#YAJVm4bBX$3mXq`+tt?&i*ZM$o4h#prT?8TmGfyw5ulAkZd63$AzRTs$JO@T)#L=^5IcP9zQ*6KX3ni^mKhx2W=2v(+Dsm zQKA+gB^YkT{#(W$QFmmJNP4^i>%Y_@_2ZJJ^t*4!ig~t&O!qRYv^`lzN~BR)Mfy7D zO=Wd9LXQ6#Ht-iu>Ycm$KiA;Hx=Gkj)9V0{Ydk)QMV*Z_fsz1=;V<7_lgGY~YtdEB{R6qG+)$}2@h%2Oe z%H^L`e$VYB=DpB8;msNOO`XId-83B;x&bAwOGjBguM0P)v>!+l(e{MaziCTr8y=OR zLoYm&H08uR3h1B6Dr&ZO34LD_ocI)_^%P|$t)tu#9#<5RDJxSq9GYL$JZ~UV=Lc*b z&-f|3Tn6L`B=wqEz6yi~f9Sb2=pP6TOKJ5FXcBjq$is{kQ@Ln6e#!-E`5#x2K ze`|n#9fUqD1{)~AQ^qFO^$M`o>~0&xM?~00QE>kB*uM8m-|YrB_=|u+k%u8ucME|6 z1BaE-p64InELCE#xedq5wrcYYgA!y9Z@6Nu3e`Ux=qV%|s*zt)co6lt(QxJKk(ge^ zqPUq~RoXF3VY+0QsP*ex)hU-AxZIOqii{0DOEHYvRDT>v&s;vKXzg>-Wp*pz1kYp%#s*E%cnCV{fwP2dRj#{Ad zppAZE*XO-qP<5Z6r&p_WVK{P}pI+?Lv3XMKe?fF?Zrn`srz-wBDBQNtKYQ}#l06JkS%m1}YNiA6%4< z>6KLzewZ9=Qs|#w!9V_tr}`lGivxdM!o|GOd*6cpmnccmMMMSJq+-qL|AP`0$j8fP zk@0{wvCysm%Qnm6utVO$(3QO-Vo zf0gt4Zq%13%`oCgH{X-xiF=Pq>=d7s-u2N8PI#zQXZMXV(QsS24|u^EpzEToYRzf_ zn|zPZziJI%uDLLdaQv^_XHM%vh92*dwZnSFg}MN)(>HD={9S|3v3B+Wza#6Uf+z7? zW|^<0yp@aHH7674_gKTaw6X!)i1*9_miO?jZ!_T-Ux_+^Xj&QKo%2^_(cSmVI+nL{ zxcNiHnXGlJ#KrGjcQeb#-G|;|9b%`G_XFGQCB{9HK4o*A&O6lI9V@7Lw?38L?61Tk zeJV@d4t>ugwJ3a_jJo?3sGVltYm5=%4v@-d;jLxJ{-i|H;H-?`9)Aq>5F87SJhWduf6gzH6tNOy46uDD};p0TFF;b ziGl5yrBff<_n5M0noLo%k6sY^1J*~eq6{!i8u`ox6PtCB6ce%KwoC?a0&OFUI_{a_cDtQ!b(G$Cb0p^T~10befg z(v&x-^RjAm@5x7HW%)EuNqS$nv*3N=b;z$8d*Uv5Z<-W5uyOMA5BD)8NxOIx{cF2J z)D}74S&uqbwm206_6q6T_DvA<5rI!r{@Rg&*Zg11XXVOfsl}lKzj(}=77wzFJJUlmjA{Q!*JDX;!@$_eltz)F&K+2Y0eD2pd&O%J- zss7xl$i7EAI81N(wOKxda8EhhaSi#&d1WzaW3A<4>{K-EY2X z8M`Dgd@J4i7kxkfwE-RJG6k;qwkU35(*#bnUkRxr)Y;+HUw>@aob6KnHKO|Loq8c#FB{;G}oFk>g2``<0IS9N!Nym9)y^@P-`8xweM zxW;4(U`YGvOhCdUcWD$Tue<4mFCCA8K0*4_cut%iP4Dd{O&IU+9XAgK2YUtF6x8sa z!}u`m6Ep@u5mr%)MG=1|zOyE78_bsB=;h<+VDLEjGwImNfbX8}!(SNDd0JqE2W4z3 zf6wCB%&Rr7qV%WuQmPc6jgS?1|g)z^}XO~(4)B1aLvMQ6_p{&2V1)~8o ztu?-LeQpDqfoEx}cJW&IRc0a%izxbVtP_YlO~8H&7_fYj6e-I|^gHNPJR(?Vh0dZ- z1$n#Ds?1eaH9d}jbh37Tz{Iw zYI2Pr_=H}5nW6VloZuUoGT$^8X71e!oylCa^a`QIjK+*2L*_m;k3~khs89#J2sg-r zE~kt4mqx}i!)!jzv`GF7%$^O7(<4?;Tusvu_ng(4Q-6}06Uwmw6wJr&&dSl5lS{kC zRsDMCMv%{{QlA*EcU0d62`5PwDye`nD4=#VTp^JDrR$#a zy8nwIrh^rqOBJY1XR9wwNZv&)iYxMLUC83I&)PvHUCxLnP1fhf1>fFuOpYCW8 zf?NGK--uc5|HSjrd zTE(E6zulOARjQ>>y{<$guMJ^ao=FACUE%?^8*&BE2IanCz$hOY^I4a#e(m`K@rcMe zJn#p3)Bc1Sh}XH9f>%~9*<~$k&xmv(UzsaxI7oxo`i$80W#1YpgxLMuYZ62Q(~4Vr zpvTv@9?aIB+C#zIUJj>=lK-C7dyIkyP?j)NtjqNmnauQfm#LM=bD%%rFq*7euOk;J)PMxLc@+1lou{~>?FguPxp0K&aD%dv^}gKzxh%?D3kf zN2TxPv9O9(&xV$1l$rra7a+HUCQm`G0${Lw#=Hi4wsoH?&NrMvvMVq6Y~Y2Bv-;fd zIX@Ak_q79cDxq3POb$rpBkm7H_aOznPqT-K@n27ob5eM(5ve6td>h{)RYf! z%3R5OwU(9#oYC?LEADaJyE#)VCa&fm5?U4BIUey#&(VCe1tTLn1W$Z+kcscg5m1($Bdf}()bUF7HJ8Ud$wbWG8{mAhu_fu;@Fj5{LYZ`V=8=vIY?afU!GmrRt?uI3@01xW7Zlh`PmJ@^VsO zjJPKqH(|I0k(wC%=pAd27@S|D?RmDeps(BGsT!8G8%f<73}XwmzMG$3ueFDVWYXz{b9 zT1U)&?nZzu8b3EHuFtjUfoPjLnmxR#+OQ(-^%sAp9nwbbv^ayu@~`R!?GlT~vSHWV zjp93~aP4}P&=);x?^VKaFUOW}s!}dZ(~G#veW#XXDDdSD2XK@8kjisoo=NED-bi#C z(erGURFFrDVo2dCwK@#svTjg|Tj5{;pMQRx6gAG0+|o2&6!5mlY&PevX-BMePaESV zO%op@^d8hewu-4}*3Er4uI_bYZI5+G{P`WeusCsqZqO>WBu@%bfcD>??E;|on9m2% zJ!)W{^VtXEQBi}R{v7`aK5PMg{Hr$V$#UkS=g$^8NER6F_Z%yk2mRX5&-{SJsd_Lai!hl2H| z^`8DtJWBjqkHm+R?09TNaHJ=ZaI2d?aUVW+`q(8q{)D6%8MtALOUS6LNsSNzm~3EE z%N=TG-%lj+4E5zGA0D2|v+!=;DMt7(0_#gc$V#SU?W}`P?-_JpnW!NSyt%yWzc+XX znRxb5SoqSg7lfa}^sS>|acwihRRSNcgCp%H;0LxH@uki2rQVqdzoeQ$t-*?hZ05Kj zF6pubx(@w{)IO!9E7W)aE6S=RrOEzrc3_Ey(0{DoejpO?Gy+#}{`{btgiKb~Y$&!( zqbo{hw;;lL^6>#R2ayLD+x+*rbI&Zk7qfY`r6$gy?zhY5-NnMzRNJaNb5PR%kfEF} zu6vQ8VK_ooHPm@|qRLZAVYSq=(Gp$FT`U*$rS_F%yzNrvF9{Bi0ZE*Yei}}RZ-4W< z4|hT=@HXMYWsBGg5Iu+5)d_b4#(EZ?Ym2vUKy#@(t@?kyyPu5T#&&kTz`dpGBia{SMNo7{*~WQF-cWYHsM3oz12yF$kJacxGZ%%7hq6uZFM8qa zpSE&!TUqg2rG3U}a5Il*&NnxIj<@7lKmxOaUH{m1$WdPc=jd|{E~)@fL}!(kTHZ1c zh9poFNeCHg|D?}9uc`q(QYko5F68;#$aNijWL?;;k@63TL~?FwNAX`ZH{l_V_y)Bn{NLR2G*H?E$Ut)!-`J@WHM`WWbylEcu1&(X!yu?FYJoxk7m zEuIK%9hYhj0s!lorBw!_z6z(1Fh+Ne{CYi!af3!4Qgki z0$z`Z*4n_pe^6vM= zZRJ+TOjx!qH3 zOIDShcqs?39CqJ2|4>yI7kg<41stS-BF7%_B=?7nG)OVq08MPB~mIx+}d%xVFR!!DGW2+lR)BI5Bd+>qt_Yjf|hJpFCjx~o=H?Niv${V>y^ z=<&3h0VBqiG+$jG5qFGmzemK-@t`MOs9k1am=y%g4w^=`-ArDE9ly2)IQWlo@8VwH z-rFU0d33D)g=Kte8u6a-Li=O~l}rYt^6kN=FaBWq&nSx7A?wlEnOQ-ny_}_MeW)nG z>&F8=v#th`Pq+F$bHkKH?}_FjNP+W=%npQwbh31_1_+4VNPgcW4yz9H+v6x12+!aQ ziuk`8i>sb-(O#M`fLLy}zObkCcT6hZ{5R;qLK+;{3xF|=H=FcEbobBQ}>%QFHn=O(pRpWCjfJYOYzH=O)+1yAR>iqBtA7c4@KZ@W? zCLXX*c3EdYKbStc=*7*eGnDS=r0PWWZfUqsB_`j`YiM0i9y9jRk7r&}9Bf`;O7 zaaFG$L9f)QB_Gpf{kagbkil>;@zLnw{JI=CE1xe7ZKN=xQP0<`_jZ%6+GRk3rW&3R z;sSCJO{doM=cxZ6n>Q0{5PD;~bqB@etSH$V`>~ed!fDvje9KT@Lh9u$_n&s|LIxp< zM3ou6jwd0P%p@KG+ccjpu0vz}SvNsH!f_+^xyEGSP-e~R>uoO0;k7|!78>QF58+XjiWQpJUMK+G~vr3Q+9qU7Sn8pVh#%)~m}8SS2wD{^GTuCl5y% zf~<&X;$%CM-{`|G?i%2Tok^x}Z_O}H4lns^>ow)Di1qLfm@AR{D7Uog zCvdJnlvju<3cB$Avvbf+k*==?UZ0maiH4mgt);IT?@|OdKGQjligmF<=n+CUQD#5f8W9V)(K;L+*6pZ|q_l8q$mD zuyRNcQkvlW!|NZHrCA9N+(NNBGcor?oC3#(rVGsPcxPh?NFWXn{$ev%rP^LkyCHDr zFhOeJW_&$LLlGh3-N5FC zBc9or$Pl!TRMhtNfCVPQCpTcwZa{;q#~p8z1>{c99H+mALH8fErZj01>#?x8idb=c z$a+|Lo#_!~R*O3~vZvED+|tG7dKqqe(Nzmrzg^=4n7dYW7kzVQen>%W45>%qj?Abg z0JLw8k}5-$TkCo6xLSi|B;NhVN4a6e5N9-{2+UkV9pAC5&(HSGOnQ%K3LaQNiDMn9 z%z9e^xh667?$d0az3V%Zl6h9G zy4qpzg$!&N1fazA0mtr8F&nngmcY*2xyIzuVz1|vJTj$~$Lb>H!1ynQn zZ=2rIiPFzI_%`@fN!QHWxKb0aDr8_pwg}k^ki+kmR(PVpXLo(sm10C^ix#$Xmk|Mw z6-nvYPnKi2g(1q_BW-a%IVW;Q0ig?@&oJlLLt2MujpO>Hh4@cobMBYoQFZbUI|wm( zwk05p9$O4Z#_cV-?ErRVyt8IQ&2TvhACg0IX?E9AoSZT@!WcUNHCwEOt;?W6-Ko`< zh$H$161=Xdx-K+xq32hN`J#oOBZ4RH8mA|zBA4{1Bp-< zbVHZQC`ykv-zAmzlcob@G;+qsqpAtKm(Ffk<@nl&7E&T2@MWI83~%wf3UCuxJxTc( zHaVEj?eAvfBebi&L)EjiET@k1rbhCXsYm zje6c#Z>)WuLaK2Knsl_@`}0-Jz-^y}k@d9;w&z4WXDneaC#@C;IeXo8-0OQE0aV$? z$JFXgI1Q;#yNMl{c##L3E!?F^7VzP}_NonvmFO_QZP)aS%3gwIcviz})?w z#YO#WrJ&{yC?VHZhu+tThp~4$BIqOdX2vI=s&M-}8)O|LZZ z9GSrxT>uxWlT!ONEGPnh{gt!NGJd6qcUEG{paE|Cr=9%0bhUnyxH~_Wzhf}NI}V2~ zN+!#N)q>gCh^=Wm$yqGiIqcEG#xDy9xS)1#AR*rLb5)%NoOVU^1DaAAvAbS$>K|C7 z>VSl!1PtGW3%ZKaxWwCYAXjefEu#A5vVQp1b(fJ+@R@{!MYV&qG`g+WU?~~?Ie#1M zfnnT%SWKhhlF>~!mr4b48sHpE{YQjY<(kbyk2vL)yzw1ku#kB~Cq&fc)5t3K`Xmx{ zgZ|Tp$6>sdL|e?vJTqMT6fZWH_lld;1ByiKjK&c5wm#xXm6szb9ayt(*nlVMKnJ#C za@D}Tp9`33!C75tq^YSfS;f1Meqw&)q`i4EkI?!rBBXNZ}+?>B0Yr2KZt<=b{+DuKLxm$Ob0Gp1!*^*PXEGg_PZ4}%ZrleHHKhcT+1A5FV;B4Xw8Sw8VCD4ETsosz2%-2O~w zl3lIzgN6uvMb1uzaY%MTmk{doX&E4d^{y&Py!G=L1e!h&mi37KUaiU1ob`#Ax!Jn* zot0I8Y&ziSU0Vbr(@tZl)PVWocTO4%G~_ix7E=Gt{0s6=CU(7HZILzBF|Qd{MP+M= zV%#C#oDOCNOalxXcpTV$4=4M!(u*7>*i6#zUe&CLNcH^#V~5;C2BmLC?ex4u&ewnF ze9AgcbzCm=BCoFWh=KhCvK_aRN6!ZY*ggzCBgKY|p2(HoAtg1i*~7yW5bAX5b%=la zN5o^8eM3jAT}eOpD>!l^CEfg;I3efgyk3+6AcL-+x9Y}VE)shd?^Ptc(l;7D5D81FV19%M(@??7Kz*-qF#Ygkl6ZiPS9BvQ6XR*A#&~G<@u%?(s%?kx+=@ z)&$~802ug)g}bSO1`^_Y$Wie1HsO`dfg*Th1-JM(H{)`yl2}A5&Z`9~v+k1fi#_1X zv-GX^ZK>(t6mS4C`rIknoIwCv#pZ%^Lj!>5k~5+|nUT$8u0gwO`$MC~bKAHaTV!a6 z*|>q8ueP@Km(~NvQd4~?G==W0rQHW2XSnRo*o95DYWJ{kt;>mcpw)yMK0V?ng2CoM z^YxmcWoJG`<{D6z>^=j0bclN%5fDTJIdg>&73fU>nUmSUPZ11~0P8Qpu9d=S?2i$i zn<;T_+ulD|N?WMg-Q$U9Sw`XhNSxPMxZcpUAK+FM&i*gqm2tN(VE}YQl$$Go-p3<( zMB&uceJPx%IVhXdUO0zH`~YRKL&7b{vj33u@9QB009=yy+D_+KCy{WfuE~2I&Z^Ge zd)1NVHVMJw352UzsNk72>L(s!D|L02h{AKXEo#iY5=5#8FR|u+(gyw1NJkH}vL@*H zrXf%K*M{R+XQAVJjg0z_LYR%SbImt=2e-R_)7mHcRNH*VerGZh&>ZEV{Pe~AuWE;+Q(ZQladr7h`cVtl#l zVoT-Pj{r(9_KnwIj-A8x(0LqOd}`Ru2SsNk9TaOpf+DY=u6P8EmNp3w*dgzSu^9qz zG=BH}uLu_z6mf%fXV=qN23ni%|9dARk*xnDEFxa3fDvkq5D*9sJack3gZAv8uDI0+ zUqF8)ick&YIex0~$C`wQ8n6eA^Ys+__})p4CwgyR$P7A7`!_q!gIQY|GBz* zl{|?{3vKKuc$*oUaAEX>9C7yg7lo^Er&Wgl6!XH~FkWgfUmZ%~V*BJyhcBSDRvPsr zo%R-5a=8vUyLQHXMy6P9Y+amm0>(m@NYXJ?^?QV%-<}@qZLfagq++AGMy3blBycHwNV(x8#=)%syIL3*&GucY`}Zdi?md*;`kmEm69%l=m?94eyuCs>djS0mVp zS4=gu;tvfA;ls4AYJ{D_FURl?iW^P-Z91`u9}DGk`6$ZsH-v;pY+p6K&2wvvbod@^ z=Nf?Mmv7s=&xeFJT`fnSb7*f^I=6GX9lsR~tADo}z=wFvB_v9cy4l!^ts&;mBStXh zYLm6xC$CTGqD7*}D=$IDt#$<&`#x`@!EC2m4FNh*Cdn^o({MXe_kSdrWcg5FYL$mT zt>u%~b1|)ZQwm>U<4=aU_uE0f@*7&`%MW-HrEMmh+B07TbC66&H9qJcBOOX>rm>VT zV^!LOwPXd?UW5F+1+pu+I_H3TQfni|_^;OHUF^%1ut6QaY-Gbfkrka6$xh1i!Y=Qa zlopW_BZ93bUX#ra@s5T%ycHcx5v#-;=4*3%eRijbDBdAn91$&hJ3V%grpy+iPe`nm?u6k{O7L;YN=K=4~K zb~quV9GdZX4H3_(lKLfQ`@V(sDh zAH9yafOf#AiD9}!EVuHXk?1du)4Uzs^l#%uy!3lN9~Xs&Oq~R$ z+nis=_)-GZY5aWn(KdtMnEcarJ%{d= z?Hcz&GYpz6#liCf^HeZ~LI!Fx7dOnC@A2a;?HKiOFwGvip#I11lO#L92~xL4VCFN_ zS;+rFCFePZ5ZUME{SADHSF!fNIfX(^&e*5<)$MNsb*e?$0cUwC*dG4KLkvTT_qGcGe=~Sf|5I%}bZ9Dwr6@Y~TFQMLbJ}aewmf?W;#x z1(r7#UnmO^L{D+d1OO?NC|~teliy&C33F=cL*QI=m>TiU%H8JE zjX?Cp0>Ep1?7NPX7c3!-7@k<5Tykc%i7yP1C2|rXGTW&imCENbM0AmY`Q{vbVFpqVkU}W^mal{@|IK%iqK_7o zKPQCgWb@BSvcE~NEhs;i3M;;uws##O7yPA_gU&1Y55<$&&nk!(l>GzVZzE%Idf?+xtSLt*LW^ut25wnPUH z9yx}a5`d2G3%H5+%T}EKp}t?0XxC1#je?$JL|1j^SEwBUN{#Hy9o3u6zO_E|w-x!> zbRYAXDi~=enIVrc!ss*KpGKxj8J`0?NO-UkuFVB{*QPMrA%!!iWTG$ZFC;%M^*f#A zO>m-tgoV<&HC6@>&3Q^3o?8ybzYp?ky}iGml|q(=Nu;Q^&P!}3D*P}`8{)DTo;y;-hb2DmT13h~%;dgDj3S|)$%I~=Jfrj{BB)uJJaen3{j{)h`86p;UG ztj&t&6F0k?lIcIKw(~yG!`gQ)26pxX{;3=m3X5Zk4juu4*_o8_^~X|F{5OBL!CJA~ zOqm=?bobWL<;qBMTMD|*|2I6E2l-)Xi((#G3r_xnoG?nZUjL!B*=5ish))aTUT3^= zmF`tS95R@sNs#VxUqQ}p{?9~QN19eI6z|@*n>e`GM%4>G&#+JOo9=DgIt*-4EnQ*? z5q}b0AEKl9L$ATU(E@BB3k^9krg)als^8>kPaf38jEXu+98HX zHx|!n>^pVa9lV3Jzo#G4rJvb$f4xS6o?H5X>Gl$GjaG3$L9$MAxxhIDvIaS@sHY7A zCmtmdyU7aqwg2>0_cI4w4^e{x106iru0 z2r&EH3RI2}Fak}7PPV&z*)XvjG9Dd23DqGKa$HRGqz}QR86R!7(L!t;WZZ^0D4K`N z7Hd-6yDuOve3mX$67;rhC~21fu56*ik^WZ@)Xn*%@-L!TZsik9lF_mps`Si2wfrl0 zj&J+KmNokg{1GVEYyW&Q=Nc#MlOSWxm7tz(#}>DW=3Xw zi$6XF(hy!Ez1iud|9jhmojlq0Tx;26>DYC$e;Y_lw}%;vjZOF+-?I4M{b{bAS-Z66 z&3pT6Lh!p?e34dg5AZO8y*>t*k|I_d1z^eq*&=K4-whbY*eMoM53)qr{r@5p(feute)5v9wkXu^>i&L*Wl4<+}dIk#fH!1xNl`UBNhltj#TT}MN=e1VO_(hZd zoPVBC##32UFw4m@P9c}`to1nj^GZauUiel#a9TSWYq9eKDRt4Bix+24yfAL>Xvga9Z zl=>vl>mbT>>gFN94?o6_WpUAM@L=PIL9$a}$KTvCfWP!6^US^0p2PT;z`GnPk@G?} z2uYG%EKpnk8myZka=emgi?9mIKhH4{w*mDK%kYe*XmdFB%sf@v_v>!o`EJfp6X1jZ zCjZCuqXJp(f7>Y$I>neT?H$7%>1s_zn8c#Xz|xKa&j*|3SqoZINy$|`L4j&(RcC3J zF&J^f>Z-MSlXk}!&s9_x6Dx#hZ$v*7JneuYlC_J*q($06CyrQ$)mo!MTxEX4q3d0t zIjB8855Pc?|3b8^xrgf6bx7PRMrb`G3c&pu_z$Wt>#w1bN@>trfX`K~NgEUr)UxlAW?imT z=bTB0cgAo7K*hxBle1B6U_=c1$zs?_!@=4c8nIrJrog+@B ztaivf>^tsV^zBodh1Gp!1wW35s@QGs>ajJ5&_Xup@Px_q?PgWjpJw7=-nVarg86vA zZg2_>A<$Ic7_&<->W}!ohyaP{L)-aoNkEfJuj`E1s(^xzl=Fnvlm-3n>yTN$l}1mp zR#duwpAtj_EFkYbWJ^NNaWitwIaW2`B6v0boCNY~sK#$ZmOgledv7WuEWWIOr_NaT z9*V^T#1Nb`F2T9tjGkTJA3{cU@Q$tjUFLSw4;g>jF?zgS8YRG(=1B}BG>Woc0mXoi z6W(e@&ne@J{bmA=1AZ=*A-edQQob?}OGX%C@&oufdgz3%Y%wYF5UQCUaPJeoTiH;r z#nA2-@7bCXJJ#yD{}-`v%BS4RaAy&?#|d_EVl*_4o04w2zM$D3VJm*NAzYkhGf}Y7 z6E&}9;qizTNmJVKTkbJTa>x>9V2x{Gx0yv7m(c^{3v74W59lqyerV|vWvvR#e5Sh`{m5<)k@?SEuZdTFS1v|q9F zZPGiQ!uvhT*-P^y@NuEAm*0887JxO6$6rRE`iI#QRcks5@6s|~-auX!3yT~xgMLjf zurg=W9FNqFlBZ+Fj6iwA{BZg1#b?XXfdeOLid6V#D;F5eisFOuU^n9pEqzX3+&~IN zo|r$uGv)|DjKS~p?k}zH#ah;1+Nm=b%JQEpq#^E z6~d|%+KnlSSPba5)^2j~?wG_{L*kF3;wjZc%-UAK!zCL2&hLp zfpP+{JZWVDyZMLg#8Pq!!JQMb_*dD|P>t!DZOo8`*Smy}PSMH`}3Uc^0H!XQ!HGcKE!*PLV~|z)8=w24a9Y zbop^Sa9x4+b%XB)0wT2RG24*tn{}(Y_)_@hvs#ezaF%Lp!BFLtJo%|pKj1ED4{q2H ztojcV+TMpOVfH`W?ol*BH1RX+;iVETv1nZubYoIC2_{Ff+{awVK?ec`)Y_!kkRHOl zR^v{K@DICg1v9VCAmJ&UO`m>eNnovb5WNGe^T{Sn^a;v~B%A#R{_wuev%{$6_>3VX z!X?;Sr!~T`)@{AJ;IX9Nb2*{ugRb=-Bfjz^3O)n})4zp>9$lVa47tRX$Uzi#=M(;u zdNgTuX1S!Kd%(I>%3Y!fG;%PIoa{vzn1K*ogS+lbha1 z@+l;cIOVc8M3@dT%kO9!-}pd8Nw#+^ProRx9xp|#E`N(XZr-F{}< z14bRhSXP^B#KF{Hp+xlZJ#G$opRm_Hb5sGmdgW|BxJIXJN`M8ZXK;i^^S< zN_^{R4*j;X^)p4DmC^e5Akb@VS?mt&G7^8dgvLL`k)D8;yyzo?|GGq08tQjnixFhL zFt>%5b)-6N+QM&c*hLwwFeK+e`Jc<-K}xg>1TUpdRxX*dMBXAIaxb#aoNa?1`p@yS2=Ll$LcPFZA|(lzs`R@a>p3+ z8IMCGedb+maZG=U?_DBto>cCAGW}1gJr?c;RN4iY@$Sg3Db;=GEds?5NZRSzf@>|u z7~Wf|hej-W4(Dq@Mp{1`pN0x_s*r4q7tunAS|mP~?{j8U{bVD={WUQ4j%s@-(axIZ zBfJd=$ynzv^(Qz~v8H zj%3(%bL~09)#bleIa%5wfzDr+cjowj_EAU1#V3sp6s*4PE6;oZRqPOp+Tog-!QJ}? zic3bvo8bYPYcB*S7_DyV-vuGBv!j}ydYB~q{rMSX)c4o5W zD5opZK#*I%b4FLKr#;qBWjxL0wX=EEqb9}JO=*7+S-~el zACWlkyY;L&Z$#Q5{wG1(1MLL1-x%Uld$ZSRqa_M{zRlBl(Z3RZG7bRbV_H$est*~Q zgdOEcZ_mm_LNzuE4PFvN7(0vVYfNmi-&O7>=8o7?1NRQJGBv6CEzsucl*rCdMMI?d zy1pRA%Uw@*?#_DFTh7ek(Ch4L77(i_me+PMCrUSEZ!ivJ#Z#x<$Z-)xRjrzUQ(5n* z9x}TTG>x&05rXx0{EcPEJ?5q&^-{Y2!n5qG52+8KY}+kq6X#l5UxpFJ!+JOMst{g< zXhcO#{PuP7*Kkr>DeO=40*R8l164@4pf#S2j)O!OoS#jDIGN zC$WK^(9GY1IQWTw9sirEGC$|?4G*JwP&jvtfvY7pQS`S~m1Wxg zL60F@PEwtbn_ciT+@Jpl!%-^oM$lY*31v_4Z^o)jiQkzMw6st`_QR*fyi~t!uQKN+ z2lqyyS67tezu>DI(~>6Jo9|-p>^1oQ3BQtOxp(|ztmRSZb#`^U(<&^BLU8P#WV$zF z)}GAQu#MM#o}Toa_W^AmwA#dC+Xj~j!!02Czbv&a+}J0m(rQ+&ejtEXP{X+g9Z)aG z?fagB5MY=LIk+o__w5P%#{WRtC+&q)?!7+>;PSCGRCBPCBIl(Z9V>=y#;jqMWt7Q_ zUtG?704(vZ#Yq1L`V^QeY7k7STWlKv=s*AWYt)ufGQSQRq z%Ym)r-)h6Nv7K32w~$jm(pFvCguE`&%9Ek3`SGh;e z_kelJ51PGvSH#{pvLt6YC%N2iOeoE$90(_o%&#-{9VA?2eakE!vw(X~EY2 zNG$MDgFbjm+?MjfIVG%s@EiVmml*Lr3gYS5E~wY`BK4)qLEcZQ(xdX__fCoXRp2lC z9)t@?X_ad;24B$Q?A!as%4@A|Worc0W6*+G@j3fiHR^cUvj$CNmcmR7roX>1%mv9W zuD~gm(~}F#_`<03HGyvq)AG{7{CV1xq;CK+lwodjk{Nbu%i-bfq~oytyeSS&ySbSK zlfMirIBbx9IqVT3mfPZNvEwKX%Z^eQS4uX-m|=<{H=UZmK8MF0te2Yy3%OLn@Ziy9 z*Y2=0hr%!Y<_7lQ!_RRYhHve6oXM7Ic->$!1e(0SbEyv~m{ntc%2w+UC%jfG=XQ89 z;>H@;4TS+WU4H5@f;s0mc(cM$GX+K@HL_djphl~dzY>(cPOtYxLGTf}wB0@QUeQC< z`18r?z@q&_vCCY=d7}+0(?Ud9*t+g^5p$kqwg52-;d>v@u&^7uID(jaK>qN zDN4M!qvlIIL7B`sO=%dl-0VBVeo{#+5%-u|x>iZ_RG6Fm$TkZC&@88t56%#J_45MG z1G>OpU|7w<4*fVWp%?^`bdR*gG8A9w<-XQh)=|nYpA9?0>?n9fWAio4iYEj>m$~V? z+X7>jg-k=u)esE+A!btq-CJOlj>*fvNMr9GMWChqs;_#s%0(6`itNfW)86i;2@Nsm zO6@bJHsw>enUEFKErl)KTbjH@5nD-|8bPz%05=LV0vn3LpP(^x{Pnsk=-wIC~F%6aE?`d^Bdnu zQQO#eZSMa+0H;7$zxPx6(**l^^AQ@a+=+Rqi5Kn2_4p0=*s|BD{y72kR(-K(Uw+Sb z2IN|XvhR2>?AFQ1Ym)qV9rWZS%Kpmk@PDpX;;j#ZZ`3IEQ9bgMcGXh<)e+G7V)z5) zd2UCgp3sHj`EBUoP2;E>p9Fn-+11o8$d!4p%6UP5q5TD2sGmO*{@aAyll(tM1Yu&*RVIsf55Sa+-7XX}Rv z&V_%&R`Oo1L4CEIeCgkKfaXm#ou;3^KrYmer~8GcgI{Tie2J5Oi4N4i_YnBfo)5%4 zN;xtZa$og>)neVX;6O*YUn~qd)UKiQnGQZ#ugJ#>5eJFOqyFbL(D&9W`w)kKpG>@( z`j_qoo~w4!_?jutOSy&SCln`2Ig9y~er9>@(-)L4-6{8RoI&G&lR(e)=TNz0NqxRf zj2FvW`v&|WV=C3FAB0_#xSP_s3-qu@u_Jb1U1v3iguIBVROqF^=bQ4}*S^#)$U?qH)+JQm`}+d9FM#sB zi)FlZjOeHIlk|X|oHCyJCGNp_dNXmZrpzCB8uZ+x#L?oAkJ{2m{f*Coe>Sb6@!8(! z&nhL4efDYgo$W^au}O(PKEmw!cAd1!zEq#@n1DExvd`-X^yG?Us)v-y^I@LE1Y*38 zBM!S?$yZFp`dR>cO0K*9pob+&9RFd+g*{JE_*w8vbVWkC)MvU#zeEE3PV)Q#nP>GC zjYqh_$JP&_HjyZ-xZsv{=5?Wzu^ScPriZwHf;f27rU`u zHnyYs?IQSxtAC_?_%*~G(w0-Y9Vzqh&lK&;ePJ8nM_L9ylANy_ah{LrS8t2@$%>uz zDfE+7v*>=t8}Z&k#V^+u^x34WuNiV51oArMxHf{Hq;`T_0DKAT+!nVOPrQ=G?`-rlg!8Oq zJmpT%!{kFW|LRg14}G8dTiyd6wr@iFJp{Z3{4*c+quf_}4c1+Q($DnNQ^!q8rJuh& zl^26y*G%q8>E|-=J-5R5UIhK;o=yGXpFoc)pG^7BSk$jVo~P84Yhf2BccuGKZkGDq zIh4oy@#J z*++&r>E;BQx3*568~hff&znGp4LH}U0rNXZ`j^I2dRqoQy!LXsPozEU9d-Ysj`>aR zBiheH`v-x~#4C^w19%6})iUK=FCF&m2F0HJ2J*MM9(pF)S%&d$Uq<6@%VBqq|AFRj zzk~XT3VythgZ&Osd-JOv*zfQgjnjRCcIubYes)0rS1qFbIS9I)`~!_|cEh|RJx2Xe zJz#g|Bfnba5q%4NBP~enkukt$-nGj92$@&*36*zWqW_KPzs#S!673XTOV`)C&^H>A z=>D230Z-{c`SWJ@+f%wyxj6;=Em4U-9>BOJN9efv!Jk=%JYE?G84muoK=Ir30)JEe zgih$6ZsofJF08vmMUFfKex9_E&ez>o@BI|JW;(`|tc+{Alnd8VeWo@8=U427{~vVn zAo6h3Jfdd!G4?BZ<5A>AY`B8@>(+s9l-)%2^JOyMPl-P!!hgFA=YmRpwG4FIX&B8v zSt`%lc~Q)llwWJWS5wcRc+0@LXn2R}KTl%aRVv@Jm>xTeuanui%4*58FJYDY==6981Z~h1C zLgn+*Ag^mbqxQujd7dQlex+UTEb?tCCel3TiNKp0zc}kO`AGjoKlj{3=`ap{09(n2 z`~~{buFf>x>XrNEexq@#7VyJd_}k??E`;5YwVc{_56W}8)I3E8saSXOmGeNF zA>Z?q^EbW${p1{@_Q(#jlcD&#UIjhmKS2Ax1>ZMGzpX?IMad8&VaZ&&;Q{RjEL55WG~7@&TtTC8_94zdyY zv-<_Q@3j-;MKH|CcrPG#=Cv+&o@K=m-|-op>Iq)+LrYH9H}>AUL<`Q@N=sBG~YZ|$o=(- z+#dzLT@L$Q#s&Tdd6AV&_2h#x|8PJY!NU)jmx+oWpi5tIPTC%vlP2S&J)kGoDtUbq z;a^qHwKyB++iMS?Kb-|!2Y%egMSY-2dkg*zH7{!p`~Vvc(Ky;JNmok$9|3$0&Hytj99N5AZAez5A8@2#>=4YF6U%v%Kqz)(hsSeuUHPblLviF z(!<@zGX+;&ydnq~%{VzwnBWa0%%kL1K558(EdA|dszM-5O zd>DS470N!Bui@X=pv3*(g?!Ac@*+p z;0(nMC(P88UD4eZ-r9pG}yr#5u?-0Q_h9ofqXCu)xq6pSe*8y}L&4Yfp_%`qj$juuO z@7{v*G-O<(82-0qpHV;IrQq8O@ZA|HAAbeEtyJL|}09Yg6b0D0P^^1d#p`-9;uElwP(m&RKbEQ;%TLHdW+l}V=zO+9b$7TA?t+f%>IJdA6}R!ZkfV87QY@!57VUh^`|v%L`f zU*%&nF)zt?QUBXW=%2YtKErx>E~PTRmOLMC5$)$MIJZqbfAs^rcUc!|zdr|lTR0Tw zYy<8EotICc{H+FhPV#aJe*z^4RqxQ6XTWsw8vn-sPnrC{9*ef>eqTo?gJV|+pk0XXp3^5^HZn!Zea7sQ|HaLfX&~beWde*wod?ye1$+ANEg(UQ;IUUw=ZpH>!Vv&O?XWl6L0EbIbPwj`}G$PgSL> z2jus&l=G0&H`19o3 zV4p%jPJ>=IUOCs|DXEXWLi-cKdB5uSxgLTZrRvoWg8$4^;yC9)FIB&ndcO3-pN%|N z%*!zOJ+;v^-f<25rB&&a5Byi=`zhZ?I0N{p_yhR>a=n1R&0k98eiG{MX`*uZMj4Nu zhx|Rr*+a13*Plt_n4RVR-^G-#=E?p0yD8qzM*aPZDWAL+^SJm{(Y`!y?QHpdXYA*a zcspO_Q7h-qUykGzAy>=q*3t`j*#EQhP@``#RW1i?mn6ilMlRgflSBlyg!Bh;@oOn%o! z`L4tw*u_Vc{DB|jxhP8f{bKq3>k2xq&tY$>=VHANd76DS)uVow`JB_JfBQc8my&;^ zewZTo?I*rM{c;JAJ0*}iGOv3^7UGP`{-c%fvu#xJ@p^*)XB?w`>EYOqsruocf;_5# zJd*P@81Q~MbRE5j_pVpo`wsBjpx}8E^xhmr?|l${a`ihn4)D)<#cw$Xe5R>8mA@wZ zy<3z#Qm3TE28va0*dH^Z;1ekY|8aQi2kU$FyxU_JKHNWHWN=4%7?>q)tM9^R|kK~rG& zRZXFK<7CjS>hIky?UbdW{iDForI4rUd0%g!{>(N4pX*V7CFDZw2~l7A<%U8Z?sprt z_g4U)p$8FX$yf5gKSh7k@jflTH|mBx2>s+Q=+AT3QvPrpeySCtsDI{Wte0{(&D*&E zd?V?1>gWF$akrVbDCb0>KM5moo`#I$qyHt_Xn(fAud-?*9oN0mudDbW9XJ;&74bVc zFTG9^w@sAa!%JvCYd-W_wEwU?cXv9) z!+7Y2IoUMts}|!;Qoak&2J&V7Cd&8v$n$6JqICWi|HnZeTYM(v^Xt%`hNq!7Vq8<@IeR$QTDJcJO=%M}rx=-pSjCa*1)V}*&#yuxszaHr4BIxs~ z|8_9=>Z-$3Z+Q~^?>Ca>u{YzK9F-ro0bg46U#b_4mgilpM!p>8rAg*({zTVZfA|NI z)pIYQ=T|1tcy1o}bJ?3z&z}JMDE~2iZoEvM@=N1i9I?DPE`c<%QT zU5|Uf2j)ztan&b*hdl}&Ccuu!xm2_x^Nt+wPgYz@{m&k$KPcZ9C;{G59-)5zAK`DD zm_zrO_CouO6Y2hr*=Rpkv9r#Eyq>J&DP1SyhRS|?FXU;(M^tZl;w;EJ<-72^VE?N5 zCxO%CAwML~&qtg^+PM$FUy*uPv|otv9s~bbkSEro%tPoX?J30H<#=Df`pwU!c=!Tx zBwxw*D3af$!v2vo{& zpZiNY#3?@yGOL zs-I7QzOny3>L2S0dRFtA+F|`BD{ir`5kp-}?{b zMfFuQZ~t@b_ph2F-YESoFUs=|y;LrD$NE+Mr60=gLgL&%ng7!c{A9*xYVSM_{A@tn zN7_@h7+2D2s{ikU{MvxHu#~5-06+V`r~4PY@bl+CO7kA?l>70O{r=x2!md%yQ(7qP z5%eb=KT8EYG~P<>rY}HO*~x3DDEs}lV_lah`9&3&NA~&V_`|9Q)(h|)1Rk{6biSPOJT!a< zS)QvfOVaHZZ3+Hggguh_il{Hw%R=~twlq?FK8tlaU-6Sqg1%I~n&wYdKz~;C(krCg z8Bg&xSDrtE{Q}Z&wg!B=Qyx99{vY|>G<-)x+9@9BEz6YsVoQOC^=sNh>45#)3%xqw zOR5L%g`7?Pm&P>?$vC6pKX=J<>0ysZ{`LgMwd6HAUsuZgG726p#=IX@{OvELigQJh z`_TA8GUUE`zO)U!Mg8vB?~w26IbAE!|M^&_Qm&1HJ(Bee#ZPD8rv-Sxu(g|E7w7e$ z=kwf-_U%>FzuE=s)c%XcLwiX-PXg78-i7{9pGWPKQ1-AAGY-phY@rYX_oGHgo2i>8J4aWX&zU= zHZ+H<=rVL?ARKap!d7AQ*REi|?T9#iw$ffWz*`J4&?%Y-hO|(`^x3-RaXW3NRT^+b z8!#j6r;dmzTA)zbZtUv|%%Icla$2_L)$Nea%`Rb|Tm7l&7K8M8JwC&*^wut0KCj&Gj(>$enXJNe{;%KEZgZSvV3>w zCq40oou->Var%M|j#yd9%-}_V(P#-!565n_1gNRoVKWd@1Y9@GpxIgi)a4Agbfa}x z;Gw+bjjbl?Qy(?3Y&93h9B?X|i?8M#C;%)2rLI&#%W;&dksZU(jLrEZY~< z{7%CNx?&)i8Jf#kU}=S=p`gu+9#Qu28$;X}n#<`5TAIsg`2wQs5jP%jSBQ(eH8cmK zkwAe@{?-un*~Ro~PTLt6%8MRR_V61++!&h6nq}H-P+n2=@G{<6h>N^Mb&dotdx7l? zh`%0jDa1wIqK=`t_@G4p#hAn(JPakSV5pRhf!}$ex2Pn3Y-ldMB*g!C_+LYF`TS0= z`0EiDLvsZKxAQ+9{@2i4pyD+ zg<*hAj6jZ<7GOvsh@+k(Mj%9B2Ur181Wtkhk7b*hC*-sX*$rb3jzGu^x-193w@NJq z&WoYKQp*u?dUbK@ET#a{@c9`tuuYdg#4Z6t5AZ9ycbTOj+hMYMI~X=JOSg;kQcVx= z2b#m-vP(m{qkys9=pB2Fzrf)Nn-0ITBnq~JMlhnAq^cbZheCk)ET<6&`!$CHC5ORb zp+YBMp+cvCSuUSX^H~LkGf>2z@e+UL3fQK>VZ6j)ZlBj@a~LminAdcM3OS6IIE?p? z!_ZUBXN62(K>U`M1S}kI0me!kW`&$Cox^yE!}!=Z45QS1RzwVv7v#tya=5sWYdfb}F9b_`VXKEfMWi^*z|4eu=Ag-AivgC+?@p8l$;599mGk{<4 z7G{Ya2xw-8#c@)&SthURcM^gyxC30jFPg zc*2GebFVoZhOfZouxzJkJN!-`tIS2d!&O-1;3A$tJWd~z1iI7I1I1b>Y_m%^VClSI z>8`NJIS0S9O~!;AOmYW;j5#=MUr@Zk~j@4^b$@ht`eui;|n+qrg(^3r!Ag&d;uTl*tYnanW3=>a@x2sr66eeN*o@iyO_O+ z+{HXKcvp4xo+H&`*bXxo4!AANqcg_K%9=-K+Jau<(nGf9(FKC!9UoTo4#@H7mMky` zf9f%uUd^Ky1`T(#x}`j{T3;Csxt+GoG3|011p&?D54sI5Pz`_#jm@;_WGZ4Y@bBOg ze+sx&7&L7M$Rg}9f)UMQ2a7bn<#pKxyLfe*T})RoyI27?(_ID@ zP}sJ#5E^ICO4wrJ3(YLiSX)k)OSde|Bd$(c(*X&1?1<(GvjJPU2Dn6a+s*<*=lZc% zw~e6F?JV{(>CSu1y2fNT9*3NkrP(g8ZZqv#vt3rS=v?I5rtb7>20D!XI&Ccs1tO|Sus7NzdH^L>U@sIPUSb7r z6y&8Km_4?UD*7p+V=D5{d z&JeStT+R?9GFPD)40263pmP<^;qe)|!*m9`x~7MMh5?Ic2)UCtwt-TJ8%v@rip6@s z_PFI$SU>UxhNLqPw0)jZVPHh>{7$n-^Ke6i5s4nKt!N=LgR64RfIH~dxV7Qdd@-#I zA$QRmr<<9)wyQ7-G5r7(89^`Br^BsVwiztd{JOuuX_`LWWJOQZDD<;V4HXxSy};oQ zy2FO9xphOgb$J)|2g3mym!TS$Dt6FO=nS|G-2rCnC@77AgmlviGL~(ZY9U{7ka5tU zt%VpqwUEg=7y{Md%9ybkWDCqu>=y_vj)gFM7i%HgWctsnaL{(LMohhcwQK5rXGqMn z(2uPGvq-b_fSbXh1uj@^kLC5bMIkH-UNaaDS*%nTv}{gumTm_)gwa^g<93#U>;Pg$ ze86dV+?pkBBhC=xHtgbIDt*8eOL^?xV`;XoYplB2ItTJrwkz+Y=@|}Kg-%n~iVK|q zZ#bkC`>l}SbLkqR%3=I(hGuwmyM%KOPqbt(gA~BlqG3gAMoWgN`-8p9I1FdN%lI-^2xIOw(I9Wb;Rxsvyue}{9q)yv=rGuDJpN#ywImEKkEmn^ zJ>rQSbW4a^LX0TLaPv-Bwprpa{o=VRRH^~MM6;zwU(U2|@p4x3hcp1hBeW24Sxga& z_;o*P2@f=<;qwM`w?i;gf5;5ly32+a!x6Ta{Bj7_4_Aczx}X0<>ZwlCbe0l3n%sC8 zn+uw)zKYfov*wu|srwAn@@O8vll|v~68?u3eF6T*qZtObe#C{}axDl~j~39KWd z5-oW&+YAR>;;%Q`riY^(NUJ~*T5q~|JZhBnok0|lK1~2k@ zL(-_ zUw|fqA;w_KvLs|^0lma_dTiY^G@lXl7VxJf2FIAewL$*JBkGI49#K{N^=P-JYo+Ph z?dcw^G~J`!K13@WqTN2kqm>TvXtxKn(tvh*z@wG232?JE_+JmSO8^bc@H+i|C+647 z^a~Dfm?(JU)xpR?l#S?91G8$#*);g{q>H~|uF^SdDF4GDLk%t946y$m_QzB5w`N7WlP+OdDw9gl%Zf%nU;_GBel&l!UyF0;i>OvE}xe z{Oa*o?7zYPFv76?mbca0ti#PIT*aQCSroEMxfl;|fgRF0-hBawZI^Nx1E;pb6*f&h zU^|#`D+Hx&y2By%%oX8PoZ*sUC)Yp)Zx^~8|H};_+YE+ES&_+FpIh??^gdPA~7e6)s?}V2cw9gBPj;6R(;t$P^Nv#S~@M zBGVQ;;;+y<`~e%fHA-FybC{Y(4|p-$ zJ8f>4a4)ze%sq}5F{hf>bO!8@t%=}8$dpg03Q_cn1RkCQH2B5)__Ck5G-68?tf9;0l}OW-6dR#IAZt$SELJkuM}Eg{^5=ive8{xdeKn zKt14=Kt14=K)X;k9ZowKaF{VSCm?!<5h`U5T7kH+gSZW3a#T74rO~nx z42BAv+$5E5B2i+~DG;LDk)T<`M{fv_-&v%$Ry6|7peI^4T4ZFycxDLggjkD=d+Pxi zDKS8%paFTqaS`B-t09>v3>(S{p)eq!Fd%F}m?kT+r5JLW7XK-qfpCB=Ad~x%EC+wa zq*%amcnqi4?X;b2MKHxYh;6 zVcq0>T~0D%L3WT|WOY%8m0;6Ffw11hBQCvp(H0TsfSbQr54ahTVK}nrZ7o`bVcQ*y z1h^=1+T33vq)N!?6XMWoa`DIAd$MGOc!@h=c$I+DFDTq=dbtbGl0Vb~Zc&gAqdyQH zL-9*Xw$5fCBGDX)`W0DqOTL$lDkKLILQA~hFtxDZDhfs19xW7>UFV8`&(JlG5KW>S z3fnGLNxUu;mW`XvfIA~gbK`2bf&p(vmKKorxZaMdA6JWAHTH)M2W}-c+j2^x1wC3l zBTI8kV2i1k>49AE77OvKi;ED(#qy$S9$w%s5TE7OIl&1jYlWPVKx|p~K%6edJT11A zU4>k84E^7gxHSI1YPiGP06TpJ&;QelxO_fs1?fIJZ3U4&(fX9=>)>D%9N}r|I;c^wj!4pGJQhG<>d;$7cQi zK0fu(ti&>j%HYhnVOB`M z&)uh9BUr%yFzw$67I39h7ISg%aJRaXfI{(ZlWd(palY!WdnO zir!OH^wNqBhp6fbg7=%-Oq8S+bH zS75ni(einNrX*cw*y0V!lqCk!18!fy%ZjtYdYC^pSzly`SK8_fZi|GDQ^0+EmEb+x z3gPh%%jb=~a`ZSHo)T_q%7TcG@}kogG4YtEcy7qw7_GmNpcsh1D8Rj>qQIJS6>@(T zzsTk@GvsSnNyN0Awq}UB2CDdZ@SOj3+M2(}F-2#A zaBs63vdmg?I6MVmk0s*Z9y$N47&g6n^w)(v<5Ap%Y%`|l3%Jk^u6160y~CpiJ*~YL z5FV$G!bJCD?inlLe~o|^4n*%lK}%j4Mj2CyY1qL45m!tz5uaPv1XNrsTw?0@3_TFU zB?fGprL8Iyli}=z?CJ^zi+n<@qAw4H>C5@OxLCNvJmp+C_Etn%#g$X5&kDLmjBt1? zmowlIZkZr1oSc9TD~b+VH;f=I@?I8@hNY>REp%l`QM&Jt&V#jkE(v1S_^k4cs0Z2w8d367$7YM@I2rS z^QJ;P3T~U09uoK~!i6;#aTaJ1R|w%jaS>f*L@L4P7YDVLTi?oWY<{sq0d{5Yj;Su{ z1W<|RrgBcgRBwjRLX*LHPa`hN#68+#=;5`*YuNxIE{l6G*(5Ng;4gBs<*50Kf)*)o zH9!=t*s|s?k`-I)(MO^_ujFFfHE4x&-7U&KS@t`NbkiBpT#U;{YY6{DNMjI~!!`3TnNNza0zliws1`%^+m&yYwHwcL4jhMVltkk4EvZ4^1( zulRP4=tDDT2VFtqG*ADppPIpfuw|e68P77NJ0VWjrnIq7kA3U(*jIf4Cp|j}`<9A* z;P@n3l5nzZMFPq0me^T3O)DpFfQfxzos1Qpaw>0_YsITEbEJXrqU6Ut~#;Mvk zxt~#}by^yW>AqcPM#ELStj`L^bcx;}{Kfrdtsqx0AZ$h#aZ-H;-pxcAKKx{L%S*n7H^ir8c6$^r+fNrI71p}5(M4adY73Bho zAhApL8O+3@53T>}VJq`g;9#RCugz2T;N)3v1zZ0ok2nS8l82||5thOuxX4kqPN{vB zTdjCd^OT#dY_s&#`{=|nIMt(5VkPDgK}!r=C3^TdhyzYE&Ao~Wk)G~RG+BZm$2#?@ zuui7`Q?tq_)bs@jP+bgG$QL*X85~H^z##;e9HLSk2SSQlx}S}^*lC2t{y-5I*ZmHe zZ0wKWRs7B@jg}Fj7KlbFBj+xROY#yAg7cDP=z2&Lg@cfB0r?}#k}H-KMdF8j2XfNc z`|k(_Skdh)HGJMeTeI(Am7JDKY|Rr_huOMiFNQBgVWw{3Cg2PNMTdAw9d9IBa+sRi z=Mi}eOle^~#ML1zL^C8Gwq}NkoCl^d`b1=wH{dXMGN;!saym)EXLQK?hN+mvx@m?3 zt$@~KP?8$T=z}v*?)nlrfAVdzs5xCOTXWgE>G!!ccQ`bRhr5s_&#odm!Y;u`02imN zd3bsePYIGGkp$D4?-EUr6~{MOKWsI&Go0hrDJ;=;@+li%2Z44pR#|4X5eX#5!@>T38UB!)@@bH>}`r z>jhyi;-wDuWN3l74vTrro^%>`zth086nF*jkfXqB0iUSA zHvm3afy;T#SKxA9XR7T0UZ}w3JcSgv>_>?LuR12~%N2MC@Jafl+s=&{v2R$h8 zvjCr{z|RLfUx8l=cu0Y72c48C@ElFR%N2Nf8v(CW;QiVPc$ETgM*H&>coxp7SfIWa z@TwCEAH(;@*DLTEw6CGR629p@;9r4%19*Z0ZvZ?=f&T<}KLx%A@N@-Ui1YEX6u87^ zz5-u>b6qMGxP7jGS1EAgTzSqLg}*jX+^4qba?1Id*yhyl4Jq)NWSqO+=G5=4RN%|; z-lVn^F6kkw?Wx~esKDLlp+9X;{oWD_L4E(Z~BSa_1z~z~x>|cHi{E8U(%ozC7G3^(|z+Z^Le{>vo zzF)UFPHXP*{8fh%e$IZZU)#Rh`u1zLRsQGC7G8BIq3tOCjNiX})uDs|G54=tbtqw6 z%>B}<4kZ-C+`o0zp@e&5?%%%ZP{KlSf9%e6b;sIikNwj{JM>RG?ZUL7TJ^B&+f>&c z(5f5Toq6Hpejb&Z2MVD${eKS9QseWqosqU9eSm_ZwrI7_CC}S*t6A@>m92)Xxi%9 z^?g^dXKmYPE3P{__M1Uk&WMMa9a*V`fvgUiHlkDEC0VaF_sx>OXYWf*8C&;I+THxU z4z11JJ(`xs-rp&uP2H<$qoe&`^)JaDSC>BiiaJMmo4s|KmUnO0vbxy`chxQInqBu| z!l*j=yYAU->k`JdJL&gn898;`yXHLJuBq(t{#y4h#%bLj9+W(`u4{%?mzpxJ?!vSy z>e4dm>&E4@-Ro*Cmal(*Sii+O09}INEf?IIUCW?8d$&45n%2qdwHqhnH(FWEW_unOa== zsB-Q3Z2l~+e3YiOdA(d4^E$ilpRDy{xM06=l(*g6FE!_mv2C@y|7jz)zLb#j`1=Xk z-VfSnc{Ah6N6pmQyzbg{$K&^E?Y?#yrK5C;%+1euGgU@8!W znc!kV&&F-$B|!%@g;(gnWR_hzfanO$NP2a5nc1NeKrW4vaM1)hIq&DGs!lq=x&1!x z@ALkVPj^?H^E}Uap6_!zb-FW1o5oeCI8v^%BQ)2CHE(>?xI}zTa*dart^(QZ8ZT$7 ziu{1fBNwWQ+&puV%!+T3p(t|XCrx7&#UpqAq-iX`mNq9ro4-$ynfvYRiI^n+Jfz6J zf{AkHdrf0KfcHZuG{OCL_Iyl|C!#>keb|xNTrgek$h$O^#;8hxOylU@fxJsoUrB-H zQ^v~&Q=n;~A-XF=imWHleN2P~_uJXPB-w)k+4-;|(^sI#1$if@Mu={~*JJ=*h5~tf z-pQ%YB|+1bLiwN*T8(SGT3XJ?D~<sjQm*6?18Yj7ZwJ?zL7^E#(? zaV`P6_XEzQQz1o;C>GuGoJ;O~iVT}ilym8peTuA*3|F~!isspL9C@8nKe9h(=bfB- zh;u2)fy{k*m!|Hp-{(B+$lRZIaq8O%^Mt(4slOjV=i`LW*?FB)f5*8r91m5p)3s1` zyQ<`D)h9pTs+0>=pWHlivCN8B$WVMX9x4a%5Ha!KlbO)nFcFKl_(ML~SFmW%ZW&3? z1fjd(E-c=dW_@Q<|4R zi|qPa`x@EwH-w23n6@wP;?%e7_oQ>uH(})U5%UQr|Me9#KN@i@PCF4V{ZH?(^5J~e z(wU~0mgT*4e^;hndOSxjjYxW_;)1_3CsZ1_Q7?_8g-Y{W@JFWUrRFs$R63eIPuEL3 z(?X?@%us1AeZEaEjocV2?VJ`Wy_5ofWSm|anI0ShR)4(mHAo zDm^hx?duX@6!xk+kBbhYE7RE`X27rKpu{J@3n2T|4ERq-YF~VQXJ)9B#*_YNt~F0+ zxtwmvM7E)OJ?ZdA5@a0I-8fr!`NMU0GX1OdFvnig#rK-VM#kHEo%EOWdgM>gyY0{D z^*}oO&FRo9{b zPWLva!>{CG2HAmp;M>VI#?wNkU(8R2pKu%*7b-1DfxlV63kXd!bu!l;8~2~P>2r=f zH#1Z^J3cojRN9W=b4!yg-?=!ytc7TI=7&oApZ@J@X6~bL2|E5`(vZzcIhO|S+xq+@ z;r^blxc}RP``_bS3ik3D@i8Wb=Gz$h_HYboLpC2K&#!HIhaINPhvmEG3FeXr$N2T+lwqL9mN& z?3e{1s!o7*5clmUfZmb+5i{deehe$7+yYH->E3c+j&njN;PUJX2OwDU+Z9Yz`dAssiRzP6!3Q@7W*N3-p{wZVGtdFe;S&fn{LE z?7~pM#~cQ-(0WeHD0V>aa6<23&^xGBsokSCcxED7gx=w~Grf529(89k7H=7U=e(Uh zytSn{A2TSPMAD&kPDE=B(hSed2u4Ju7_(8*$v1W^U@RKC4Vq`9Uj7ambLn0WFlVtT zW4kFM>7+(!4|tGl=!Kzx2cmHhI0VL`pNT0(rzjXv5yk=JA1(Z{X*b#3m!dYH0Kt%R zX+u8d^(Zpg$k(HfgQjL9NNa6$ahJz|`nb(VZd%{7>4!GezF!eONH_vk+>`6!rx@)x^kp#H|<sw(X%J(#qzRPwF{c*y?I7Dc z`nA6aYjp}-+Xr!0@?79W>IE{?29i^N?#*|jCo%!r_p|U0t($DP09X+forXa2y4Q^T zzFqH=OefAY?bc%zVe+GOENlLn^h2A(J?c&si?NVOHp<`Vq27<_{xWD<^+n zrEXg2*%z1vF*-LJ8Uvf7IIJgx=83H+FOlaOtKLv=XiK5wtQnmppJDn%z6Mf&4+>TskKv7n81k z!nribfqGt2ePL@Vv~@@`DsMn*2rlE42f;`-f=ifdyN&OF<4n`8+TOVhWTP(8VVn@t zjHu`^@pwWM45E2)fJOB8$C$5^pf$sdZnYVJ_%oqL9BcbfVW50&@MZFu)@;QgPJ!}-Pz4n#v^pphOs z#bo0k906pMg%8Ba!iOC1Z`xvyTfh*73)%@W$&4qRVyY3h)5DxgpPMmaRMa;X+5(J< zHeU~Iqky1sJ%T4iw^0+T2tVtp*m*#HVfXg#0PH{$zt!QwOYd$XyU@Bc&ZUvD>b3zc zCE9lT0GI9^LpHGZ6K|UP4Q`H$(zRM79i247Hd{|wwpsHBZu zfJ;B)JV-Q12I4`oeI8kGtC>5Q?!A#>6kLW9<-t(wi7<^Nf1|i!=>gd^&qL#!OE37G z6jSH*gtD#J8p?&{fNsVd!X){HF6iFBCtH*KQ_xDj^XmaFy#cfmUlSXm?!9Y(OV{|J z9iL|naEUNeYRwByvFFgenf5$-ADo(ft!O2Yvc+ahF8Kw+W?p1 z*LL;)^=p27fJ;U?TBkX!9QEpeWoP9JZrWKF?Ha}T)pq{4e<>h#{=NNNn(cUD7h#2XMv|c2eQ7vP!o@^~rIYi2NT6@~BwZ)JpjV=?_4i!6*MT5? zUiACMU5T`QKftAfR~mOM=ELdSlrX>SEZ0b$$$~{A>1^Y!^PEe+>%W$F{s5Og_?!nn zjWzC0O6x(vHlIMH7n?)rB%T$hLJ&c5YgPc}+U@{QhEa4v%cty5&h<(GcD z={I~`g9j;f-@tu4T#Oys*Rwi&4@E z#1d$0`^&;L&V!o{qAdLSVJ&QYv~SaWtJQ`%hkqFUzUy${!Blpq&&QMiqoZ3tfi;6&unw?^rEtu3Y8Yc|v5y0)d%xW;3?E zjOKi8_LcQBpmmANn5R39$5*Qj&S%tyAN2de!hkPagX}}MAk^{ls?5#aRhgULy~nxv z;ZSRasgqTw7 zfq0bic4RuV0@vX{S#A2}msbm$J^H~-)v#nMV{H382afn|F1xa1CduYDD5sBi9S%HN zo4&bIOfueBEpDz^?c2GR4b55Pz>(%#%C0QA720tz$ylfhh6fpk?pmcb+>B7ieKBA7 z`0Aw1Z>`SUe6TcW^P{WOhTpEv*t}n_s5{8qb)1RO-|GJyc&ffNWNk~>Pt&fje|my%R^obY#7rta~>w z%<(Au1BVL_2R1Nf98~rPLj7@E3y0#kzSpMnXfj%ppm&H&?>NmjcHC#*FXvo(mv3xv zF=yR3Fv|G8h}J4p?@YvN9$Gmb*zu`2 z$|&EXHV|J4$R)mO&GqUXH`(hM#kmyuH+2W~q31+qMAkKpU2CuTF_M*YsS2vu)4k8R z6ctm78T7$*P@J*Wl6K8nn)|r9UqDzmA*L2b#nj>j4)oNxsjnHL(apJ(2Ho4mc|($& zlSt;XHoru@o#b3PBc>G}=j%Ec6YFLHJ@+L+Ti{YJ)G%n@NAs?2y>l8^mRi5xtS`jq zhBT}1eu$ykn_rBS$r)_s8;fM#Rfu7r%0u*z}#|zSk z2aBFbCtne^J5zCl?$Nl|0GGx?@2CVjH0vYQGdC65tQdNpPlqPDb#E2eoLOK!9q zR`v%fAQ}tZYXVyf+s(f3)8wYWK`>*VOT9pAAbp*(*T*rhhhj3P9$td>UM7NT(q7yR z-0-!#(hqJTTa>?F5&jOzPJVL$_2ppo`Q7Nr_>^n7ga-~Qp#ZIKI_FY*R_JKa0n~fI z>Sy(!=d&)Z6C>Fam#p1u? zTq@5&aDfXwp>D2qiRs4YVv;eBbLoVDk80=kGZyubLlQPjk{8*cD~_jam-N-ehlb|$0x;Iai#qz*Ql@3 zQGTT;%(WNE)?$+3a^lEwG2NiG`v$CCFp6=lD<=W`G)&0DU1LE&Vz&yCwXPTe?opY%P=%LS~pGwq>Ek{$})10QGyEvB~KEs3M ziiN?uNnf^a(|B4-xeG^Xky@t>aA}(hN2-uoH+#VHoj5;E_x&H{K~P zSrd51lw)1T%Y0n}W2{bq-jL74Xz?koCF1doDAyA4q&h7;J%^@13+K{febr%-qnc$z z%YOc|z%gV*YZ$8|9aj%ClRa4tE{@Ly3r*j z8QlY1O2wirX?Sx>0Tyi;k2kkq_8lL8zrQ;CaI8AKsBd}r4D}d!$ga&pcICgT;YatV zVXBu-@r@nFkQ{9`Yx?A9h!M^at#Lq`h4iS(%CC4F6!UfOUO1M)0qqqLtsbNrv#dRu zu@o17$^_$#fZ!~K9*V(hveYX}1Ze$F?`@$NNO>Tf0>AnG>2@;*Oh&5VVhDDbFP#XXc(}Qd9>tnn!cuynYkott3ww=ca5U&x^$C#rS?Y>0?pva&z64 zvFh+^d(?1C@A7bStU7$w)In+#BD7g7HR@x~J{8frjtRyiB3jd!!#Lzb@YQ6r<^w$> z3v%^;B%UtjFkDG!T?DjlV1kj(d64pthmrnZ_6Ild{#mF zJ#Fs2xJ>;nU@lX?r$n?q#{^?(5?XI$4r5L-g3o=0ev6pH_^A`Ei$~~Jaa^lEqBoKH zNR}M+aIO*E?V`2btpnD2Gl1NC2WVfqz> zYwbJn3J?Cz2z_3k0>7God76LM70VtZLuVh?y39FyTH-pTd2zi`pVMjgIi%aW@{oO6 z6b$m+P~K3l(=1!P&W6kFn>Mifb`*854*${abp*(DqwE@~Q*;{JV%6cd^N@Yh9yRRg zT^?qmQF7MocT$)6a;$!*!|Zjk>)yD0V3P+z-5cz_9kt!7!vzl1XF~6&o{XMH8MOD| zzV}nnWmLP+^Joq<>V>Ku=($^jc23MN&WH}7n6&svtRPT9PvBxUo@R;vw{zazB#OTRCCc(u6smeu0s>}S-5mYY*H zFJCjSF1*^Yc`tKEry3)%BY<)Xb^7x2B@*m#ePd{4UF^t6HTtys7_lV6TuKeOJt^ z^R98%{fE9K@Y|Yu>Y9YqXqBE?ck`NgbsLdc=N5A6PSn%}sxWH%vejzCncJEI`9fCo z6h6vcU_!c*5YBLqw*Gy;~t|ZmTqk5 zFAGyXEdw)a)6cS?%}P-(fI&;FH_4tkEkmlXsbMf0u=eRCSh+-m(k`+3UTvCy9V zO-1;p8Nb;5S)At@;qOz?T^z^b zY0+uoach)ok8&>6Aj7CkLGZI21h-~|j^21Djy#@$EF)R>-pkVFyy5v>;Ae#&1ny%Q zMy>L@KpEJfBmLwbS#{(KhH-7w1wD(v6}d1n0UD{8?7$Xn84)+>?&1=47f9 zg*h8MzX>RXp+Gu~Q+^ZJXZLR9NIewy)9Y^ic=&4)Rm#4gVf`N3Pu~H8DibB=kze;|I_?zOeSE%pQyC zuBkR(sx>GcnSGQ4^%?e_%``hEJb#R9PR=F5Q80 zC`M7N8b5R1&iyDeV^t(mFa6hK_#>Ir>sm3Z*d01r{x0h8WvqTdH+tSU&$aSPcz|Nq z6lGt4>bV+s=;)1hA5z_eo{V!`TXq=_)G3Doq~FiPG-DyveU7CKv)H_z=47f>d_5r% z+C3umBSLW;2W!lJL@53*&L!))E}K(0p*>LK*=OpL>U+|2IUL5b6WRl15RF+b^+M%k zu1#5tgLgK}*bwNaUNFPz zKhuRVf^@ZE0rjO9xaP6@(t6INM7u5i-GW<5mS2wK>8=^O&D|6@BQ_l+ z*_Ql)w;tzQs=gCF?cH2U@2TGPS$FmBZH)R0cQM(V<}M!KlIuJVdh8zLN1RLRKj*En z5%o84ESsgyLXLb0^-sR!DdzXio<{|rxC>p0O z-DP<4)P@b0XB%Cj%h=z&I{bY1>hMXbF_|;kY(9sB7i`oV8aIovXmg5HTRcAt+7AlQ zTEj97CRxwOBeS68GiNkXeC;`e^jn6W4R4ze3cTTI5A0>uS&14?d%y#yp-%{z=O#`8 zhbqCM$3-qJrca?h zKrqi|)B8mEgKI<^u(wEP3t-dzg_&4dR&I56~sjrfC zf%jZ5?kcy>IV=F8%`>3+pf+@x=Nu{wF_vshij{>cU1|g2XR8}QpMB;)_gK$MkPpo# zAxQdwpnJb*(=?xVf<>wJI?+4V)XTH!`^|G56+mu?Z_Iv{Wf)*cd)Gm|7rb%o=xNZJ zvr%$)AzHg28Ve^`&ru_Hn6+WYF(yQtXF{VGe~mtF9n#0crY+k|TT;C3G|v_|jEH%* zKrl8i9NNlQv`ZXikWSXI{G-XAH|?hNzRS5pvV?AirjA0%`&W5T?|&kER%FG1+HqXW zFlZit>{DX8;V}Pgx9%lO`HG;Oh*gA7rtjYr*MsLg*J|K2w%$Md8UCNbO6YTIZ%!4V zy*3uXk!LAR*=H%z|F-qkd62PvaJ@4&1gbfgbO|%Q;XwV~lIjcXW1&SL8U<6)x`t&K z&0j;XybwVjGPWNVVXR}xfmf4X+;ysVZUg1NPBGayC5pyzG1(vtoD!M&obDNlTQ2oN zgh7jAMxAUwOD%+^OtT6-=}a4wYrMrS^Pr_A$Vf=RE=X`Mr%F^`z>(iv4!piw^% zxBY#8N6^@a4xA1)aRE}U+7GSM%X(I(Rk@Pw7#E*;Dj3xT!@Tl z1nEaZSDSV@^=HzZW={eCcWf$(2tr-UF@5jduw5?j)EpYn4{X~N^ZItT6qi)6cp|o zJXa#Rb*~SY<55BZd(Xl=7eIRZ?*T564Z#qMB%CYx4%wPz7{0M+wa(}1-rcrN^#MLi zr#JmC*Deom>5LP>Dh2Np!&)P)HJNNn`T9C&)r03pQU=eDlwIOf&onp?YoJ>B*8^Ni zaiEpxq$bcI`jdL+Hk8A8h z0g7>Z6Q1`zW$qtY=P`aiz@=jQJ?ZA|Uf$XX(P$rQpU?1E=QEBm7R8r*Fvh6H4taX#Hr&pwXWDy#Xk-k&&~xngavd}gdV>{@L}Q=*4F4bOvl@@2T4yzS3Ey@O zd1io1EkJ9keZGQt+&93bVc55?e{+CK`X{{P^k-I1Alb;r67zv><1crYgwtb#u7|);QgIIa*^Tu6k`zyj5K5yLpT({cLC5pzuOX&vbhk6~tjFmSm z%+U2;+UGYCeSL3#0*3#W*WT>^>(}SCZQXp?I>nPh zYhaz%Aie%qKbOq7En51fYaRVuTH-`2)fS%9T$^x)2REb*o!9UU=1t2--s$I3N)Hbv zLpRq=`H%RLT|@m`QfyjO%f#19>%Y>^CCaNWC8HJp$xU03UtQ|w(od7oI+7k?;`M$m zQ5{RQ0@bMB>F3g7#|yhm`YF&(_VeIDvRSMmeDG4T$%kw?CDORNHl<=G+457-VcIfg z`*s@V(l?zi>>|t%osbJ!^VMtVJk7Z@MSNlR`ed|@j7OxKgZ+CSCy9q*61TqH2 z@^D2Svft(FItuov;U+kvk1}WuCt9g4$$@!JK1ea}InnyQ_Qf={FW&oX6W4dpoDUha zcJn=pQeBaQx3gCwC#@Q6sUkw--z<-I3ebc-g3;B_O?u}{8#s(|%-eC%x!!xAe_i%U zfz2s|Bdr=(F~2YzSedlxAIp^kW{p%3v*!Jgb1BEJ3o1qUe{b9Ldm{Y*{b$xYzIS<@VCUPZqX#pCU> z(qh6{X@`Bb3HClxd>qXmIX2E80!ktxirbUddj)ssDDm|`nB%eeLfIdH&DW%{N8LF- zfe!5bbuobtgYF&w6}+tPOMbOIr}r)okB{3^a75=aX!DcMS_K$YHfH}vFl}XwwCOLC z*LRRzY2Igq-Q@Kh)q;iHi=t5MKzGAR!BMw>@auq9bs)6qxQJFh3sJqFYed^Tw;<*i zCo*?4$Gfd50zrFWg{vnRlrRtq+VDeszn1PTuXh*p*IZXgGu z5lzGl(4&Y5vR~>)_a(3Qj(3NSlFa20=O9)c{>DsXgD@T{IJ6*!o+%=eFT=O?!*IhKYlL}t0U=R_8lJs z6J^Jf-wv~f)P^+<)H@$i!-V+-qpL6I44UV~#pd?{oZag>YT>L)#PHgg^LC2%o+!~f z0kl?%XdT2j%EIw`Wex=6v^;oVM|_N!o)J z!}o_KxI;&Y-Ya+Ffx^q{ytQ!7vHbI3K(+NaQpPx6pe!uToVO!>eMldRwy@qGh8?kL z^Ep^;9%5kJET8{VG(&_rTMko~>9fPM zCMV|&ab3p8=ffFY@)f!~!-nh9X~z!Y$;^KJTE2;6I{C)097BKKxDyXJm3IRak3LB7 z7m^|I`6tC2=j=N^j)M$;q8x!-8UEaMqOf>>8slE_Ng4TI{ zT|*UEU3IV6^SlUcn`7yPNWSh>1ZaCPuctYiUacPd7}!#lYh73D>!EzzOZU3+b#FV^ zQYT^!z#4OJ+o_~Xr}}H>s-)tr41S+5NluJ!RDXY%46XbZFp|x^ExR6nSTz)v+7QV? zaGPUkgUK(|;-_aoo8Uq)IUO@Rv5Ih2p0zJnsiaJwzACAB9fSW<&LshYv7e!JjRV1E zhqXWC%dl(uRA`|T^L%s%^=3q8ZJxDP^f}EH5ENohgjwvnVHGfIHp-D6EZqS#jlGz! zd#8Ulr+DQvNyTa(pD}V>bbn<*%6z&%@?MTzn^u1p@65T%HQ>G-l`kUeo1*SL4si}M z_tXT#ik15*Rt6@S@roJd^Anfa@N0^*>1qS@9icDH=K%Ez7B#G6nBn`92Nya}PxkCg zqW)MYe)l2|ZsJ^e_zT|ZQLM4=4e*i(LlExf1{xdT$1hY7Uee2cR_Ic%sL9YgO6u20 zC#2U~82m4AE|Cmdp?91RMPrBg-4e5BXgzLzpGGv^;9N5G%JdF{bE!7QTi?6DOHP=3 zcn;%B`^<9Tc^+&6Ed1o_UK2O=^NA;jF4H?^U*tj2wh_($7klnflEdBHKz2XQk6)-v zFZ)@+cZK5ltCEV78T^ZAeyk$AG7s5{8A>S5KYL+;xz883TR-6cF6Yup+wNEF?{6s& zVY*LFnH~b0eo;j6Pybqfi&cj&ilVV75814Dx#@F-4%Ac6NWNFmy*k`fQhfo*&`wmZ zYbb=HuBkV_=Z(0}aowxhKBrta+~;bpw|z0!_Bn3*9KY7*%=4I2=I%88E|z2L2l?IN zEr}Q;y?>Srjpqwd@;k!V`0fg$(hZ}^r8bPu9rC-7?RSw(Xz#iZTxa{;y2+N`bxxVP zb9yYtXhGcXM5CRd^`!*A3uRh<7fFStrhGB=zP%P~gYi}!_1AK{%FuX63BWWD2?a2z5Z z2s=ei+L! z{vPme;9S~j_k*WIhw-NEhns-b6Xt%o!)W1LO1Ay*70#uabe6@zddi_^)B0G#UI+^J znR_9VY%ExD5$5_*8)+a?14aWaG5$hv9QPSS`T9BOmU=3v3_0*v$vyEX`kQ z&;2&}un;qS*!16z1Y>?I$B+QOX8Z4&$wU78{cg*DU#dl?A69qH zpFDSG7-c*EX+%Gw1Gh2F#47`TCT2iwv3slwp{O4+g@CV`Wd3y_VvfhS|Z|TFCq5)wX~AI{F}B2Gzb1@w(yy=-#()X8ul5F+8#Aa7_~0bg_3g-K&J|ou3as zCf^&@Q_)5;=-Fud@?}=ffET*NF@~o(w>~0D#$#cv|6s1|y5g17m_KKgx~a?lyl@)x$L!og^Nx!!?oQV` zJZ`uGfd1O7ArMZ8l3iXWo6mrU0zeEs_%zG%IHV)w%wxIqd6xs-G!d~IdyTiy^9rip~)k~jeEm3;g9eCT*om8*H7OW@!N=#V) z66Z5Q3*Ge}++fj9%42>@rkp{UQoo7ZxV$9G-W!;|!`vr%d)PW7A~V`oTT>s zFk9`b(NX{N(Q2RKP~T{L=o>|F;0?u5_J&z|JJ=gOS?$yBM4#^^)C;i%>sd@(zn}9N z<>bpwhz+~9;4oXE0@`NI8$%AfjYv|xd4_!0e3WeByis3>`n_YB-MD7BBJqtBOA*3vE_sJPHaxIdI@t-qf0#&3z3u_n_x8xzS9>gS!~jXvnvU#>-4 zqz-M*Ok@7YCba#GUK`OC8L#%;ouzkli9&tnTD>ju_vnjk(%T3Rq(c*<<0#*KWMWhQ zI{J=tE*(q73dXq>j~9FI5I@eJf;M`kdEMf5Mtm;up!qO=57D?Le#K)~GwZ$e(Hr3R znBU^;(R=Mjhi737*vf}Gkjm{aHhwO-$XSC)qf8+P& zg^^a?_w&EIJFHVq{O=$4stmzSd36{|DtjY9aI5`Z2ZCk!tHU`~JbdGV8g}Gw#ZCQrD`3k=+wwBdjT`SfT--CaE-}2Wyb5Hty(+6^loep%D z-@yF7r1Cy6wEB|t4(VqUCtURmwH^5`wFgQ~z?UTSk<86ND|4IAjyl}4;YXU#my=fB zH=UuC^h2_x-azqooMH9Nx_7$F{8UGO^33W@zNJ6zHEAdo4PF7iZ|SYQL_256k9#ln z^Wc~A>acI=Plk=VY>vCl9ET-8?#)^9lip1+9&9zo{%F|Pv*y?tgJZGeC%stmqh4I) z!GAP$`BZO?d0s;AK&IaD#|oISbmaJ)C13Ad*~f#I#Tus^9Ris@ba)2KzO_? zGSjAJUfn6w_l-v%#c(g@jh84+*6;Yt_v- zHrhBuabc?3mhZxftqy3Fvf9TS2$BwjWWD3_v%Hbk(N`gwG5EDC(#II%iwb9bzKPB2 zjZSfliOp9DkE3)i$szzR9Iq1U%k|{?PVqV;QpM`)uV?;{fEk_Q^@A7-nE02BU*t1? zi1QgAS-Hn}DvSB;JY@VNi}{-!=w^=cKKi`Nl;Jwlwsl#|+^?p!JU7OQUzG#A@zFf^ z<9ednr1A;0`Th=liM*e_f%$iGE|Cp3T6L=Tc{4wvI3hBm?8&t3Sq{~#8#+ay_&NJ5 zIN4gugTGxEq(6AR9(SsJ^h)sy%hfhKiEJw$ZXXt}z7SD-S!9M8x5lHdlOd=;ZOg~? z%X9|q&OG>Ypl8Q<*zv1)Fn*b~{n+a1D_DK6X`dY9*T09qQ_L~C#L=crC`QbO?wyFnn*_AIHNYFc5Md|`t-7GLgO{q@S)%Ni2wF2(KLN`Pgz?fP(pNGNIF`G0#I^Uwv0Tcj`FmI!UH|1c=BFB?87QGKvs}W^ zKDevAZ=YyBSMDf#($~vG1WBHXCw;wDODcQE3o!QyW=W$(5nRlR$c6!z9CsBePOQ^vVgrJ%l=-Vbn%da+qhdMf+P-}tQ0htRV%#!Z=t zS6psk9Lw#0`d5QEo4!ijWW^#FUxHg7?-=upuHMlkB^MA!ws4370Hxv`|-B?i*>}bv#^NBCB&W{X>n^YUzNIHGrwDGT=`eE;vNyzdiq5fAC zA7=e)1KHuF4ZpfTI*24Ex9sO!BHBKnmB#JkT;c;351m`TtIA@+`Zc|L#(SJg{{+mS znrDpu;IIDEfw%Rpr24V31?#T>C8URO&^xMyaZ&0^=-wXAr7s5Zv{$n#=*Z8mVU3Za}V_mL$%(4!Lyy!PnGnx3XNk) zH>b^KKGzphyrMWWpYujF#!JqdGVU6bk>XVj)V>bWw{wj<&hSR6`y)UJt)HCVH5LjB7$o_etHXrtOSawFP4n!@~%>1g`{z21hl&hdI%*ILy31gn0Hn_&?U? z;K+3j*4rsc20OzWE#Dg*Eo0EG7cql$ty{H+srS>TdEeH=TgZ4Z@kL6v=V5|h3-8-m>i|HU8-XBWFO{$ zwsn-+S1D3Gk!#iyM^9Vz#1|DpJzeu>Qck$uxLo0=PdiHW#B~PcX!6NTWL$^xpz7Hv@us|}vm z55p*&v%~WT@qu(K-l8BUt&IF3y?ty!EHlge?YmfJR{50l`Q~$|De3c5HQxeY@fMfn zTi`46$@mWZDXvFldS8^XR4z(cB7a;BKXW~5?#(M@KKWdx+V62KmCsJAc+BHkBA=dA z{#e|%u95vGzwnam>cg)+aigl3`#zTJ9=W-aWS=M(JcMk|Drvqt+VwThTs)A9Npf6v z!h)8SEk6qciJ8!6g zAFg6kUbu>6xF(x2)0mu9zMZ~jFn{HMFHH0*2cJP$>$$WDxwkGx?zY9qjn`V$fZwB5 z%48R+vxG<0es!i#w$^Wrc^>drUaj#`Eb#Qb`a}UH$uw4-NjjJ)E2>9UR;fG9_p5w6 z*(%IO%okQL$<$H2UWn^*Iu>n-aNa1WK3P$H@=o;bDpM`Hjp&O^L!XYt=5NL}<1Kp+`k?h&tSIX!!{RL`#-lGX z34N7#YfB_2RQhFtk6ijTYgupZ+oK!$P4y*Mv}Fd~+`{sj?*~GquUzDfm&T#5Stv7O z>7{R%wR9$YcP6e+(wq1oas^e96;+YTR7L&~ea>sXpVn5E_tO2n4-y9cqeXE4KqlU& zC$Yy|s!uLbeKPqXE2@;?s+5^~xy({3Wx|BV^@yCG1V3gzB6}t;k>3^JC!VJ#l|4p$ zN$+IGxV;7U@&ww7T%;;8`3fuY$Z&aN)?OfcTnps_`&DpHl?hWGb)me}-#iU5GUfP+amwGPpM(cOB^-`kKc9u7qzZIMrD!sMGdT-(>bd&izs@GlQ zjWpK0hN<;5hapsYV~<6rsAp*YKPJIXen8igX(qrgu}EPgF-jH?WfoB|E~OAnX6JxnOQ00 zN$Z;G^2tTF`(&(A`^#NE8MiN!T}8`enAaD|u9PJ*CNGs;MN4Ij@yQJY9j(Zt6~$Z^`3J2Flj+{fE#;vC8Mhb9uA*Yu%pWM&0vza2*y#%* zOjgcJ7mx%7)ciaAx6DqygzSkv%%-`Bq^Ip3Dy)(R#`2DkH=L2=B z`TNji-Mo?bSUJMF=J?E-&raa+=g;%TuAES5b4u@R@p(j##_c%68z20FH~#VqYrG|= zMdQY}JW{AM{Xzl{OsgjuX-q-F7%_2-Iy7cXcOvbZ>M1_Z^)KzXlGV){DQ9gw!y6;x zt{wN&Gj^P@e+&Ig4{x0PC2yqs5!W4T8qbi9#)V1`oa2qR{g`sKUWzhB{>2vwF;1U0 zNc+Nh-gwKGywU%KCClkFwcq;g>3gP4N9yZ?9^M$_T#93xFr5YD#_{`qgIgWQb(poo zqAe6Z1mW#$!qM7ZUwCV;FI){_8O6j;-)kCs3|K+2GM<+ecllFOT+lpl7H?PaVy^-oJdn!e>^2>&FXfH9$SpAUIZxH4v?kOpg`WpnAlKc@)gP{pMD#DHAOMwykhqmKYs@P6nhMwp`N2iz8T2vEdOV(=UcBm zL9|XYXn(lR+)M57eb35msgy6u6#2-vtvz<%yZ;d?63DL!kRzE8;J(#$>i&vYVv%6aQuX21>0Vy#QF@ zK-p8z6NX$C?KsWqhtvx-fM&|?K;{w7rJ|xD`8?+mVWM`l`jiff2V)auopUMGrO2em zdl)pD&loh4>z*rID`OT$XguNM$At6SC!5!ZE>enZ+^9PrH+zwPAC}kJzo6LblPQM& z2gOa*iX*=p;EhzbJ$u=T*K}>o<%GDJMsd~BWjyclwK!tdqm*++%D3o?h@n!x7WG}` znE)#$#(M^$FZTMvXLHc+1BxTSjQ`Jf;6IzA_Q&JKV9daxEkds^%woRqY@oQ1VFuM4 z{9A-$OXg3W9*TXWPlxb!b~PN!9%0ZZ7GU5l?*d>M=@+*zk!kEn&ZRQ3_qNG1D`k=~ zbX&lyoZtNfz|zXJdM^{2O$@&eXe5vMUAi2#pX6%4%B2y^hk1(9^IPkGQY=>HQgN z55%m!GWF7*T(xQ}>N9EGJy$KAP>uYDmGF0(y0G>(Ja%0l-wR5#^#gyM{D`W^Z<*s2StwKF zuP2P3lz@xl$$Dv5nqIn>^Ty-Jq0+9jQ0c6bypi;^!aSq1Xp4v9%fR^#u~%)VhG72A z+IahY4aM;jm`44K2aC-!qVGKjKjBIj@B;NFs3lA<9y%j$*8xKJTVC-=WK&IH(zM@K z3f5V3!ZEtv>L8jP)2Go#_$R#YeDF{EYT{m6qJ29}ds;UBVfEJkFZ#lN1^j<& zU--Ay?>BhqO}rjs@t<4gkMSV$?uU**fl!!6=cH+4_dkH-jt>C@9Y{qIbNeXDL+t+ zzQnAx@gV%W66*738D@~4-*61o)IMMa=_USu?JjDT{8tld^XCCgnOP~jTubGb?7IAU zVTgtzSp1)d#UCz<9?9FMS^Wg*=A(bIXb=9MKvPGR^7EWaYRXdCb^8+e-lC;4TubC% z{Qsbae?1-A8ipBrp8o6d_|y^g`uiwAWuC3pH^x#mwbU#gYQ{?MM)bFo}(9Yd! z)$hx{GgQBO?7XsB8=~>Qnnfcq-(Gntu^#^G>gvS0f3gVe@V!HI|Nl+R-`K|+Q*FJ* zYyQV1)d)o?MT2$x?ysoh<24OSvFh-LH28m>P`f{7*V>hU zMmF4N=81{s*m!)Nqru;nP`86!TPMZ)wl(JOcd}(?1dHxg!K&fU!0Hj=HGI5QzhL6n zvj2~@YiprRWE=bcp~B^n8)kvy#ScTFCo_s6fOllEO4s+0C!9IBIocJ2S%g`qlW z?S(&I`~SH;w=T{b|C&8F!OXEk&*Y#il;h72&01@k_?Y5YD0>(*)vmP&gXe4vo}E@P z_-v1Q4K{GT=uv2B1zb|7uhSj&cKr=q_mL8)e1f3+>NnbRJb04j=An27aqS|Pa zlHro){j9zBkc-%J-t+mq?_V=}@8`PKde-``=e95=ZMB0NBA<(FHQJ=}qlV2V{l||< zTWi4$J#6R@ZjP>xH4N>pD{^pSzn@d3>u#!#^y`5d-S(3ni8E%~Z#>gC!o_CESLBj> zMdm7fZZC7QbUw>*Z_(e0*A>2^lqv-2c{Lzgw0p&1&B$6^v>1x_()86u8R@Hwnw-8O zQ`WsjE*^4H_n)gp5bj1zPc5v{?Etl5S2KR8g{88(&F&B-eOI{>es`NRFb93veDzN0CExXgs0s zWFJXJKQ55Y(|FbGWRfSB6p>GXCTP0O;K{IQVa0!HJmEC|C5OfZ@uS4;EGn5(qVc0n zS< zc7dMv7VW=jf}WI?XnIpcebJvTGVYF!PK>+$(TQ;<8UD$$BNO9p=g7s!-T&XX>;C@* z?t+H7{?siPn2W|VH|Fcp)>Dk}Tn?eJTZGJ?^Yv+1h1R>QG-Fq8? zqywA=uKJUAVyr&*J+i~~MJ7|7_WXtyK~wq!ZsXD$HTE*2fhE?_xZfOzeHbu)^rQsSizlrm zQ!8rsN67yBv#VPkMc^Y2@>jE`>^F=h_XG2SKgYgK0AmYL}a5`+IE_- zI(>hBmO93mt^8I5i0?@~clFdVwsZ5e~y!(b>A4d~;tBav-AG zekB6O&ojA|$FTExQFX5HxqUzuXT-H|%-9(7p>tG^XTBx&K4Z2{5nJ%_vV=Cbw_f_~ zyZSjUEsiKZQ;EgX`0n^VXlG@fc%OwDW@&dV#JDUaHn54_<4r*EE`#LR2b5KcP@N(I zt&GXUua_9JtrAhK$21i)mH{4Z|J)|1uQ(8lw@VT73$=4`?TB=IoeOZ(_qkGnzM+|W zqD#aU=f}$uF!gTlC7iZE(&B+Tfp(GyU#b#&`XTbWHpK|{5nWnd7q03*$z*_Q->IL; ziakZT8=bK(#%w!8900FCP`|2dn5kZs3M&sKCN$Oe_)XC}gr?#i>I3P;I;P(t|ABr^ z$@Od&r+z4;g!={F_40D5heukKbmy&oH#X$i!%Ml6myl7_hE&%N?zyYyz&-w+g$?t2UV^FWhKBh)JF}qf zad0Db=a}3kEqBG)9xoj8Rsu6J(&wdTNFX|-S4lvGEz{=_sqG}knU0My=D+M9J)d8X zi|#dbK=RnPAmHO5=W2RJ>W&M!+Sw+`Kl%Iz^Iz7k*%ndqoD{gQ{Qv@W<4ks#BoErS zYWpgEjP(k5-g)2(b>RV@yWu=5Rc7jSa5VmMB#$$S>T(f*&F7e`%$7WeqS`(W0n<4q zpAz`+#(c?By9EK_S0$%--CDd+z94UIZ@yg+8uy)HviPNqv3~!&_O}E)zp)7FX@LvB zwCKy~K5Y-Dy5k>1Hz$k|)lL;k>WljLbrP~FkY1rCf*pI2#p zZWz(x`lw1XUz3uR;+ikQbNz6wd#8fxJw%^jCP!D?<+c-jhMDZlgevBVF29Jw^M>v2 z=d^npEn%%b?fy_HLOM)Xaccw)YLieUEWb6vEA}2fTH8a^z!kqA+zAxLW zpB1r$PmZ(Dz=?A0e97SVRwRhFH~#G3O0M7X%@Qh?%7;Ydrd9E<_wW*xnOen5_8wlL z|0z`yb%|PC72`~fe^p9QeaX52;Z>?zJ3A;?!f%bUP+l4WT?r<4^Vo898K;(Hr>c!4 zTbxvqX;QrL+YlMJP15L1d0rW3p?(3bM^g}}U`&qRCPhk|P%G4|NMi~D(oeD?RZghf zIFmODN=(~REaZlF{gs832PDs1i@vPx7w~-B^H-`QbG=Z!J3oZ_i_f4&U-h{mHg8oL zeD2N%;2}BNInF{mzDssP^2{x)?Az4fcau$+D;CypqU7;sRk)m)MK#)c5uQEZwRkAX ziaK|v37$Qp@MIANFi9TbIWnO-^Om{%R%vT%L!G-KZg;mf_}vx5cK7?>hkDO3S>F%( zbhp6kcAfOYn*yFU&Ygun+mxc7E?<4fCU5fC?@(#2k65>(1acR4E$C^JrK-ie$ArIIpBIx{q zSNYa29;gKx$-kyP^65&9jUgBZv_0b5-t%-Nc4iDg2`F0w>^>o2c+Jl*QKy^>)y^#Z zmxf`89((n33gI1s5*r#rP)V>dOP{F z`?7-z+^fAq^;yPj+?%N8KSs4(;Q~^$HUBflY)(aq@rB6Yl=x`v#|Sv)MYj{}ait!M zhj8*EJciqN3@7$jbP7&EF*EaUty!PInMlRD;!kJwwo7VR= zaHjUnO$|LJm|VUrRQnyM9-0@;Z=4}*y(>GVeWe50(RtB)WJ+7jS?2ai5!p)9T|M7# zYU}}0T!6_{n}tCCStcJ6utnuDyp_lB&v^`Q<1w7|`eOB}2eMS}0~zYy*34AbJdmoE zf>U|JZvRA3yu#{w_e?0>Sx~%}2#U82g83<4T$$C)C?nbKD3(~VqO`=!t#9n{BhB?XC%E=xAwXmC z%T2{SkFC=&R;`4Q)-y~ylXA*3vG33X&SlC$>0>;G+j$JX9{3lvF>r-Sm?X`>B=&8Tq#E<9weIcCkzfz_G=q`A`WDbU|nf3;8ht(#MGjJ{cC>fZxj zs+o~(*YX_04A(8!ON8HCXkOu308}|Kqv{w^GH$s}ia3#01)w>g8*{-Lqir-91;V{r4U!YesWU&2yZny?>6I>7sX+FTc6ZdD#tp&vBgU z1h0K_uC43o;y717I9J;8oBMFt4SmOuq5`QZmFHON>xl!dV}i-$09+=RtA>O$S1p%0 z)PI`EZ6c~WL|o-O&1B-w4|ohW1};%wy8jY2Q;RXAc-!=Nx89O0WV@Q1`%>ob&)=CT zZH>>{ugU-QTuM8#(%YRPvhP}ZSC4P4ucs4mJ<7qQWTCpvf$Eg`Q6rB&W~#W9_Vldu z_Gr`Uo)??$(Z#%1fT&JbMk_;Bi*~rNLCF+8IIzMx2bvWBWKYF3bt{3whxW$606}FL_#; zxj2IVJYudn`06Si-eGhZ}+xId|DK1^1|DOrZz}-@0uC&qOEUfI~$d2d0Q@8wP{r_xu>MpyXk8Hg5oDUC2 zHogd+ifgO%G{x{#%v;`9nYlrGMnk>3;u3fy7d#ie%RoD?_=d6GeM`xJP!Oj63<~*S zrzv^|Owl`tF7u#x|7)CuHWovT`=y9>cH0!aBi@Ke{B9|t{l5>94qnG8Bo`zfwc{*A zekRf1$5`oHNFI_UpNJ}l74DPTUK+u5%Qy=;c$Do=l{|4lblo)0LY*AS=)ZfMg-&Vn zDT1qPoQ3>6Jh^$ft_L!pMpGrvQbF*lv!A0s-jD;i~yL)+R8-@u3Ko-^VXAvMQ zuqH>@KK0%YeIDpS9g7yJyH_t#k7>BT8ZJ#B*m<6ntr=C}ZuJ1jtneIRJ}BYBEN z$c`jKlx%c}-S0zMOeZ%}7e-_jha3fvgOwPQlqU0Amwq(q!EP3hv zE7VVfl<;vOH9R1syZVI;*Pvi_9ThTNWD6I7ubRb4kz)`tUe8AMG4NHU3aG~*nxE#R z$a57?+c3*KtD?524Qb}P!Bw@bYO|2-JO(l27`Uoq;LSTK2#?P)&uXRLH1iK3R8`)( z(NYP~d<=ZXF$h)1z?r*RYkQoOu9to(9be_Vw$|eOa;s^96W&nS~3ug}=fcME2i+wRrdzY&6#z7kvp`7M={ej&0eDZNKee>rBDEAQ0%(F$Hm z?}U)ygjnUI^w%QWN$IcC(;vGP+26(tvvY;sr)5T){17wz;H&(YY4&4=*?*f7N;{wWkY;}7A-xZ#tB`#+(#%e& z)lvb@yvgXdADq$tG_!x+Cd*t1X8YIpK;0Q8r@0jGCz%`i4n(EMOA^%0Fqv1O*!5h) zw|jJ6%rJjaNW3ta5A2d6&&}A-w*n?}TZ7&QO1BYCm(GV7=1<(j2b1|gkDhiROyKIR%bJwApfx#miAVjJNS`t z*M*no4*z4Eg-#gr;{&sloXO{*PY7I?Fn_KODj+4u&)^7m^JwRN@RY|9xQBzBj1v_X zI4z!OCy(~pcgZ)_{h=e{ETsGQoQqG>zf*d8_qBIfNa3XfrN!_=eF~3+;(~U5_T_OF zQi`GW3zo3I5~?=0kOj3kYIoEB%4Snd@gcjL7p1kual4yeF7;G4=hYMs+uh|5hRBvr z$H$W~jd3@Ic2~iez-#xBogtn7i^pPT*Q9jkCJ;;rAl&1^FCO!j3()oy=Rt|-=g;%P zpT7@Fw~M_3w#3OEW|pe;P+~{O9~@_8(k!U)rAQEd>R&1)&Ixci8+`6MptO7o0wZTA78$Jztjab&Q3|mmzS#40%A9<4TrKwvx@|J#U(mzOp4;Z`4Wk{kL^N z@jj6e&0pV#0v{Cb;~CL>g-1@j1rbl$9P{J+oRzyWuw-)o@)-+7%qaUtx?U&GD=~U+ zoz(AODzYWULLED11-i~Md7>|Q;hWxJAzmnKS4748lz`#oBGemXsD59WipFc*on+Sw zOVt!n@^FwmJ6GT3?pj^v-g#$UO_#*EQcU_gCp3RCw!kWFbvCEg+}&`u`-ctl-8)67 zd$OS2!_j8U$#fufi2SMeS1UcWcf!Mw4^wzUUtL3;+t=W8SIF>4x5HDb@9Wj@b=N0M zCRqw-ctP(M_0_Ws)$fe6(33_Sy*Gg+7y7+{tBD!kh+b#4`)DR;cW|7AemAYWm&RG> zaUNxV1WG5TjgC*q)w7hR{RR!&{Kq&8edDBlmOuG@H;ro^Im!uEc4AW6UyrlU+4HRQ z)Z{bBHC(ravCzp)I>zb}FibQb5UgS6(NYz8WvZF6kcGo8JFG*!fJ|xXMJ49Ey;S|# zNd$dB=?MXc2zO23Eq%Y{JV>4owYWE2_?WdhU)58Y%c`!A65bNb%N$a~ zj}$ZguecVG4se0~^GwcJUQzOM9>ZCsl_h^$vq;UnY+1<(VTLQ+vApE(g4s1FWV${T zvRo$xlj{Q^-Swf6?HUkrTxn2Z%ej=Qy300MoO%1I+8|`KA*IT>YG2ind+zRWLNxDh zyu0UE7U9TT^Vg6{*vY)yw9(>()hr{`)mFNiWANxIPqk*PxK=8W1?w8ziT%JsERWJU7~P=*VdQy{AX*BDyR7 z{pYdXA3ZZ#@yy>w`@2t$awa7Dzxqh5*BKsd&HnRfm+!xp|2ZDH=IseQatZrlJaX0BpT{G}jJ~TZ(lLpRO~ND_q4Jr@v1#CtLzA$H zfk~2hr0b%1Bs^)3g$p|!O6+2Hqz)`ag0+~s*)~Kz{R}}n#J~!hwq71i2yl_k)7D^C zEz$5s8o^se@~p_-g~rxPk)&N25b|^%TgVTe z^7E=LyO!{xN%s3Y`h8qsN@LUB+l(^vF4(6_wCCJ#zhHGGanG(#;(kel`o4i_c4k3!WFw*`|qn*%l`^$+X|05-@roO zZ@9~Smlf_7@I!Ts$@X8tBLddKhZJukV>Y%FiO=1cwdVS6>Ra+o&BDM&?_G@9%8w&3 zFRyByZ``=QOu`8FF_TID{EXR78u*9kmc&3E<1F-$hJADyJTvJ(rCFbb?4ORa(E1DS z=V&t2JI+EsH*^@4_oHzZI(-2fO{Dw7cv8Og=iiO9P>}LnBP9m3IWJ3i1C>9L#7TPE zZUZMd##w3GwDb>9`tz*x(7u3DSoIctIb;^E$Bt~&SEmmsX^PeY-a%h((Pm=i+#GKZA#Bc+}GS6qukhh$)x{ZjV^9?xg>RCNE% zFRC-1uk0qAlF_-W`$Hi+d_tHR{#3{c4+uHoAtO%KDZv!}K*$I`4fCsYEB0-3y7#@> z2H}x5q`c~Udf%(1_uM_^gxJ2n@$Ru>4#G0lb{VN*dbj-kz1y6~ZExGW_tmc<^^qVy z>yaRz8*Y1Y@2iyVl#miGg{7U+o)Bh*88Su)V?M`O+r2#3eihHRXYr}+uXD57ALWGh zD$d+);!@gk_MUhQ+{!~Z}4{5Q<`0$`$4G#!h z_;to?ob&Nm>-Sz5?SJjRMx7O(Xn3aXSTI)c`12Pq4&j-)l#W-_sDXGNla(~n}kcki6QLU~BkJr{~O z8}^LWmAyAwH#|7X6(ZsMa$BtTz8w?z$nn3yN8*@2&%j4n|1*4a_=t{=-Z=7ke6;*? z_=q#`(T#oaS^o?l@rTR)C-{ix{^$6}q{PuV%$ib-`q=YjMISvuobv)Nz z?BG21C>OYiOU6ydN*x}^8f99groHTxAqa1 z(*LjMBP>P#Nv9K@vd_bawm)GSo?@F!hbQYM!c_Xa4#IOVfvu)vDyea;J31R>T>=hi zIO^uBH5_#}`HvGg>d<5yG!k?lJ2y-->kf~vx{P1GNLTA4>fuRUD4G0C= z{-FVF{Y}R*C6h4Jy@b0A`$TDopC`4soBXg{%U5s#OBGzeQhNFu84FpnbWBocV5!>; zoO5iPut;8GMHb|QUr_TkETy;it45l?UBFU$9fEPK(uc?RI?h7tG|Z&S+?h%LwfV?2WN#j4p{5J(^Df|{CzH6!q{Ldr zbza4Jl>LW>ttQewJD!wj{rTx}7E&+79Vpc5xo@0>@-JX3J?-{M*s66}dOx-MBG~Gq zso3gJr#4QlVW)hZir21F`#+DZ4sD#N#GGx{sGog$0b4zPF>G~y{R`b6=yxW^;(n+f z8Zot=&E(nzJ@&m)l=8S5}Hp{XmZ2(VGtlu3AN3 z$A566zNh&E!5SVE6mR@eM0QvucO{Th>DZU=7q$3;t`-qjk<9jg8Id1|7+#)&(t&+Y z_aRLsEFwbj-gT`$KXpA2@n_-iU5Y+Wb^W!7bV&Mr{e!=QI`9*5ueor}N^VMxU3E zrVcV@Q$%b5F4x9`7Bc|xuJ20X^iNV^jUAym`(mC{W+J8y^&!J$EvyH1RUxh$7 zASZ1^{D=BpD+d(sIAgZYv^~}Zi;{a}li$x8`@E9Rb_D@3@1}KeoBn*x_>R2Vb;&eZ z42@~^Xz$ukZGVuP_HJr@+B*f+_NJ-nxHeRmKd57sFPL@0e76FWaM?iQCLU=9*14I|Ll6 z%qv%g!exChA*Z6D&Ru8a%=GJ6sLKZB?P49?3g~xhP#dUCpD!euDt&e zwQ@zByAH@I-dx-+!T#1>#%zScwKypk;oGHv^=iPn9I)O6Sib{UHv-m2^)nRS)6?+f zE&;>A{A*PmUn0C%i~B2id_WnEfpoyyMK}a#tkB||>ibc@G=g9hDD!QQwoS)VYf_ON z%-8SbeT6aG(Jzp%>G!5r0YPYcF)S|YBwkLBLv_xe+w}Y|YI!V;lwOwsJr9i)`FI^FZ-_$e8W@i_73}<+a!Sw=xJrUWOU7`8br4 z%=hbe0c(3M(Rqn#KdI4dWU~Ax$JdFA(Cd5ugkH(rL zei4dynd!y+`pqc?PVna9wRJtqnoXA4Jo^LvfK2wY5@}Tf0>82nLWTsGsh#zO$azt~ z7Jsv;X6K)-QR^8itrIKFH#KuLtHnz5rDH99T_V^1%Z5g`oil6ugdL*fX}fZvy0OXE zlPtfY5IIhyRrL$p%3{aHj3{_B$r1wsJd~VD>&82XUYn>bNMAW9WVk-iFiE;=(1;na z%ZM5ATgGfe|Fe_E{=~ieT$uELRlhUL`#x{g&T@9Hd$6a|*pIgW2*xqCgk)xNoQDhJ zorgIY2SKCb(~H$fau&`RMv!DyoByKk`xmP-hK=!U>)4L5mcA+X7DI{A7%vwwQUSmZJ(uv1Ib~V3Q$clk6Bi&}^m3gKh)Tseg>;6ptQruj?LC5~i;fsNqfgfv zIfu3LQ;PQuLx=oX`;`(-ND15w)p;}2BMbFAh$qK)fk}#Nw&-yPh~_^ztldv<@XXMo zCMlxhIvuO_Z@Mtw;M%#L^zhhH%0qh2AtLDDo?TKdOpRGI9goHrOA%yRbL?4CKmp{% z0)nl);?-=s&>ADY)*sgIh{rhFMdcSm@m4_brilnXn1RTUAx9iGdpWN2futPywKj|` zB^gYX_0_{H1P;3wrYSM9L&n*-*p!%|CPdB|vB5YWR9>klsRbH;X~dy@HjQv{tA=TP zCMBYs*#+LDHj)h8%t01=DzB#goDeK4$9V)T#`(!9@mLkEq&`!MIHJYvoI_emI-@QV z5l)m6b$}M1?Vo+udGW`K#p$^a8^d-hv^YI~<@H!8b0BH4)?PcM$G`625qXKR(9d`& za=SL(Y~hs85H$9kxTeP4(f1BM&Lcu~MS)$sLt1-6^U?R~cY6v=DkqOq~g2z)pp2;sA9 zQo8#WBe6l7UqHBvN3Z}=q=(0@&jf^Xjr$ErXBFby*7tcmR?rU_3!N4a_VL(F&sQ@R zitJSSJER_<<>f*7^b8Oc@v9xwgDzvqxR}Qhzdo*^1^0yr0tn6*ZY`f32^zBZC zx`!_uT6mVpU84{6Q5$v~Vxi76Y!~s9^t-Zd%~ZGi53L1#33MEJIm@T z)}FUOv8%qXAmJO}RNucKLGRYQj&AHBnSO@%2p?G53b?4M|$|#?Z4wK?fG+|t}PbSAcx(jcND4d z*;1l&^^&nBW4>~_oFvDPGFwVG1hh*(#8~SiQg`zC#zQO=BLqa0{J3XFWtB5U*{X(L1N0HjUQc7@nNb~`_#Pu=Dth2@8-|3?#@8==do{2$yL(tEqGhl78o;{Z9zQ$C>QoB@c}O zMT=1;gnw%1g7J`)cn}EoZ(7-14rp^6{hMyq{?`F={KpdUdKcL}#>DOq=5lJh1`(1M z_GKgn2B9uYS7LQWyl;_HVvGsh@o&(WPYG)>#Ep@y9(F!`joJxoJ2IuU4sPKR6WN7K zW$VDES&Jy0g0bI|-nIiCJmh#YSPZqJ9wT+*Ox{g&gyQYYfM;SXyfftvL6WhrzvgTw zIeV-4!d$WIq`-$)*f}HC82LvQS0`Wo)*s(sp{aBEoJ(7aFnlfPHD`MTjV%Y%wc7ls z#aL_34GX{)|MPQHJ;tCAPL54Iw&0&GwC8Jwt~s*1SU61OpDsY6vtCNfhLrd^k6k1S zrKBtWYnk@G?h&cm*7V>QVLH<59dEFZFQcNH%BI`^ma2`aDX)!eMvve#>NeYl^k`rPwAd_JfpA7~7rnb-U8^d9ftj ziB`)$LC}g^O&($F&7ADR0+L5!tSs3Es=IHT?V`T4jjmD=$LG^^++q>xC&pUUC$AfIo@2Ynu5yBu*inhY z<~LZ#vA8mkc%6m5!{@dyUd$){u%W!$A|SEkJlkc&&53O;OeyHz{ud@*0B1+eJHJ>OJp>ABlCoE0QvFY-%s;Pdg z!_aSQnu@1<-~BqXwE??p2!k{gj}dmM6m{J>d95-Tm(|B%_bN=>UtxukGbL8jq_KFy z@ZnAhyo>1h*vAOw!ZM`IxkK_q&$F@z1;T=}!}orIAjw@P$rEht>tEMnJwlU@Tn%Gv zf1QOo(-g0=y3E~~3UxrkG_%7BkM?b^vk=v-pOMwq7?bis?OCD8hb26hv5<0x?H-&y z{tO#UeO>i2g0qo(f!7WWr3)}M9@<3NI*lif#To&-lk-^v+8R@C_~B0wjB+SbNZ&Mk z*Ij-RfeP(@9VPY_l&E~$*QA|QUgcH+zP%+2)`~;d9C6~`#x(z@S=x5M zOuCWNY}T`8C3fE6f7F<_|LzO=nqB$}2x=H9D_uP@iXdy@yANb3u_%-n`Dxny8Ds}r zgl;N}+O{G~iSLHS9K<_C#N?0A+E>-R&A&qBgs#6F&?WA}7_An>lEf)E}s_Otd1 zIOM!}wuVpixol3o?-c~!VpDBdP{g6&qI8X?G?sP`WUJdm99mPHuB}r%GfKXn6e$M+ zznZj$p5&!dL^Y*rIRO+rr8I`KbN86yZcvQ~$eO zAf1lD&ErgVKuUDJz$YLoUWG^G!wcAPO8d4X&zk*2#G&L_kwM&UA`;(iL*j0|Ebk}UnjAEp4PXl#9`(-``ZRSuvcZUv zS*Bqj&gER8c<%!F8-LW+o(2Uz+`ml6&S}lkw*EA}yIG%7_ z1*{~!)sdGK=oj?-RBo>_QLcl7ENC(J#+H&js(=zJHpVbL>oH~1G`c49#7Tc)Z0W)@ zB}Vnq`%Yfj`e!4p-abA3M`SmfrEMK~2xM}QiC%yHj9q9;vM(=?PkJq??IHptjLFYU zKJ%#YjdKybe}^lVIvqJVPG3e&dDg93zlc{yS4xpD;*+1BwTSf2Q9;!91p1q$ZN!VZ zOl2$5l-S232oeqA7+czhpDm$wU5pk@X$b0gK&QJ1#rx4D+d61RVh65Vy3CQ2cM8Ywb3i|ZcT2X)Yb#2}QM!AlWgUq)mZW-X$&4Uo=mmbOv*lJY|B z+dqQfzosFW93xaO*^1)@I{p0y4~XCN{iwi&NrsQ7B>6*h7Q>U%B-gUCwYhnpc8AW# zfb8Q?YR9bsNjnSNaYu4~-;VpWc~0_$eNen-j5)+H!a>WgIRY_5pKo7&%@OB=Chguo zZh66xr%CN+MeW^ zOSb^oS1%<_awwx;2S4_ED~64D^49Qlyr`ri_<@1b9!f=!u#Ym%{y=p>#9?aBVx!Pt~G|747no)oMH z_Zoe>Ar(QwpES;l_B~;=?=ZEm6I0taXykLJA{f{1IGdpT^t699(q5j5;Jb|3GOcae zomf-%kRg0h5L_hJI_~9Np9!MtLX6`zDcyxoydU@xu}2Z;OoeRkL7+cV zhk`}rK`!8&0lD8VMW{d3+8Kvo?M^o*2RZJSBFYSuUX0#^BRvAzPdp_>EHhEo%hzjn zd^$|NqU!%*p?bhNxgXJKG`tpyH_5B_QV=|6{C_(I!IusCd(v?DpXGnS$aB!h&*^cU zV}E4KM*VK(Aoo_HEFsv!L@O%OuazeZ(fATXsD7io-Hh2zr$TKxVGsO@hfFl~wMg6U z5JLI4b122h4SjiO$o_tVuji@E)PhY7jvo601gKrt8urEw#k;A=(L-%npN8yf4Sr~I zWW=*`Opb5!MYf;a>;HA5xlz7m2 za_TtkqHouXEqUi03nl#~DvR{*x)cO)6!)E9FLjfAUTls#dG}hmU>k~O+;rwO4)UIL z(C!2BU2-H}($?Z?cSsu1<|N#r--N|o|+h+g-%H?=ztw0HD8MEd9vp_=kO!a?3KJ+Cy8 z_l;y;=}MLSg)yMCu4Tivfla)+j8nY!xd>d&LndC>IK^8o*cu&uq5Lsnj;mHc{M5xRCl9eOHf*MzSb1)b$YW(JT~54bGmwGiEEFi@?W5+TBLl)BK#3 z;Wzb|Y+B64`Ej|%yOi@jBAo_Qec?fM?*@$kL1 zC~WNFAQP@_7LhHzH@C+kSXMS&g6tDQsw;K-W8M_$as4h9OXmaEuX$$lYQXw1q)07N z8_7qQpZ;?Gvw(T$(`g0LjFLQqT&>4M5oq3z3tz0M%_-P>+%i zb50OlSh%6DveDO5i8NPbqoZfpdy9MQKStoWGfcK`)93%B_tx~-k=mGkhRH2z)33mZF02VJ#P9S|%oqVe+g>U-)TMLNJY?h_zyHukI7v!LNsDjTNd>p-^R zj|h-F3_SmEz5vC0n&-_QI`-zjB%=D}lD+wM6gKvAke7)lJS=8^7F7DyA@GgdIVLN{UKMlmhHXR>s{i`N#-69=?ahA?DH&}L%*z`u?Rly> zQ{&kxpv+?MjA%Mw@N9xcSVS}$5DH!A1l~nDpFfKGNH5M2EN0K8$SD^J8@mAc$uwj? zc`0%zf9-pY9&KzZS8A~YY5dWckM-$eL3(d(&tKkQp?-Vxx?BFtLVRK8SL_x9>drHn z#>d&0xa^mWv_8SQGTwoR9l4EFvmh(8#+Hr=aCxA3?fbaEy|W-Y3JF)|twh$p7d`Al zu=8EL>?^NDFg{ng&M|Z1d#ew@pS?RV{=R)9g8KMYuA}E49WlPmjb3-jpN%%;Ae-nz zd?DK-z31!c?|9VP6?saJ*<^;?36!mwt;-$B2l;c+GnGXTP0}AZf7bO&vOVON5kAsr z6}|j|Zd^faI*R*#8e^e2P&WNLjBH2zajD-|#Z0X}bX}m*<*pb(mNbAVg_3{-em3ul>=bhi+M|>}r z9h`}5JFJZv9As)IwW~2^><>)q$S)VLS^?zZvlIGXzem)j&Et?w``lh+d-OW8X?OZy z9TRe0bD(%PGiLJ`cKC;S9F+T5i>aIXPI{Q@eAFA|>x+_n@Da|)`gTz&V4cj1I>ux! z>s~FM^OKC(p4`WDyuE*_P5#ojwpS(a>I4Rw1Ia@+q|1txn044tYlob`fpj*<-)|?U~PGlNv$CCdI~l{x<~e&J5RU1{S)_ zcqVLJTZoZ3r(@#VsLdC_gVcus!4^JjEWk?dsJ|EM=hH?%XH4qnWNd8j)W?vIM_DP9*kl=sPxB-Bru-c8 zw<<-hx^@);j?Fi%yNBA;%xN*Lf~io4C-rBttUI*WwpVE}v43r}={S!dVL1EK2!JuU zu3k#CPRsY5Pg!X&6^A=g@tgR0CU>!^V<=(JDEWLJVe@TLq--;HkK;KxuOv>*`(zppUv0ECI?iP6-eMlZ&gkW80hAc&IM$NZ z?LhQ8_6#CqtH|$bnTNo`B4iN-i@x8+RqwGP@Cv8*HOfKWZr0}uI@5LDBtKPf zMgF4Or#B8y*x;KF>b8aG8GlBKv_RK?z2}%w<`r6*R9^3-eE(wP)9yom29b9S-VEM` zL>Z6Z;B8WZ^b+x(YzX;Wx%wVuO_w=%1Vz9)HXCIy>GW%zWLLuvlw5DPgn#+EvgF{eAq6P=WNd=2`rf=k*Tw7) zwUKPl!f(P#WjYGGzVds>;&N5s6kdABO$90|jo%dNOGI6-dz)n#k4r2Kh1m^v$V%^2|@twUC3BvQg z8=J8GHGtLFm*&#v!i4Y?otZjqzHri65W+V0UHU!7_Fo|o&zCeGi1MEnY%7yxAZ2P9 z9qS4ncw4}hidp)6PH*N^o8XwHYqdGCI2Yhjr>2vp&t=+es`G%)U4AVBC7H&2BtQ21 zuL%=+A)iBVwxLJoatJ1|jf2zY42g$t8}AA@1pAHuc^rbr4V&;2Oz33NYf1fbVZX{` znbGdo)bA(i;1S?B#cSmiZ!o7dzn@pUdj)K%EG$q9>^8M^16Po%*^WIq&cf^a?r5lU z*B$h^%VBM-2jo5coW_r4L7oF;E2Z}=cz65c@8v@7(8estd3Kx18SnR5FFr53ho3#< zpAGrDxmbEzF3PT$B>T}+9M;a18}tlvDAVS&`HPp8r0qT+cn@PXqW^($CR0COX3RE+ z$}!r*k2AT$1&x<&@Zk zGzli};jKf@WgwoC$aYz z%_VP#E*F!(z0a7fH5Jvwt8!RZM@N|auKO|X_QB2voKyIf-`Jf3Ip1zm6N1%Mk)**1 zChyqr&J%k_+3w<&+$X5r^`q=_?XF1C+r1Y0x;uT}UHoqTZk}^}(H!`LM!W9?f`N%V z+slv}{-Qkh8F^}f;JwK_sn&uoO8>Hvz6J>HpGF({CUc6nb~^Urrs2VZJ~#Q9gX2v8 z@o5%1CCm=L&r72ugQxk9e3C=2QI7`*o@C5MGW!Z)meZ5%-|X;Q!l4_aZKwF$S37yz zK|5o%{Q|bMNd>9^CHDOWzk5Is!YK`N-F^}3_Zche0?N2l#mhAmyX_5g-84Q21jK^_Nv z-_m~DY3xOfGpUb~|ESRy3Eve`0^kk;)^^{wG(EJ{SFhi*l3f2HI-dO_g1&LKw7y>R zJJq_!r0%`Iu1Z)Bt^#+k1H9I*x!~LV-$cTHg_NiVcd!!H_WExj(E@JBf1b&XVY~aI z&!1Zg+ePU&-GE$hnuSgXmX(%djGrlMhWZ}!_);W%BA%aYqfQH4n0tF!B6%M*`P#)z zzOmXijP$2!b8f1$$v4)Oid}QFq=W^^*7^5KYso*J3!zJTt8 zCMw?bmX7W3D2g|lDn*F?5A%>ab0iO!i5%|I-h5{UmY`Xzaal8(|Y zUOx*^A#m+W1`&*#Q1(PBc6X*~`)Yg)vh+Tw+QP(I^ z_hMMu*YG&#xK~=+rl0X`-$VG`gg_l*a=j=eiov&!F=mrQz0Qt&jC694kCUFw!HB{^ z?wE~{J1olfN=dJ$gXe}o?|E_PNsF@m3}d!a0>V_zX9B{XF=jhUxPdWS{rU%+;zD7V z6Q#9Xz*5d6t*ro8RqmEXHQkXVMVuT;Avv`;MO>y7;Tr0C;!C9j(Pel5LFKgOd#bzZ zp*}PDthTY2p??$9XL|IrCUJ|D=&zC1qA;rl;9T%oT)K?CI&Ba7p6&*lzNW9mm^Rk^ z>A70lH#HIKYQ;s;t(cbP`^G*4N^?{Yv^@jKJqU_TiT&auJxj_0~#| zi7(Ag0u{wpGdZ{+i48mTwS~bkE`aE@RnJvY50gzomjCH1-m>kaO@88%@z zilG>}$(WDLV~GZ*Yoc+#w=aJ0T)@8$^L8?NOD5sPqs)%W*eWVSFR;$n%K@D|7ZR7& zG*Y#@0Wv@Txcw&S9i}@oiA&owBJY+doon=Y+xfG!M(kVT9B2F-8iUQ?)(Gfy5tjxI z6X#*-6JQbxx|E)q-if4;7f$fF`Tsf`%$Jy-_d@*K$U8F-^rw&)PDz3`AWh?O(*zj# z&_XGA;mmso%JpP@n+rn_)V?N{x?w#(znc}_nrEDKRYi0%9P#!sDJ#s{9(@l%^$k+o zdN-TLoY$*wnCJe_$NAZ9o)aYc%QKAoRr?LUy~Q}o{d?oyT=Qiev2t09rAi&Ka!HF7 zK#!%Uw%8(c$EK*Z*q!K(l|zd<)LUZH)mx%ZmA=sLRBst5P;WVOm3qtJtJPbMd_}$G z!#V0L1M4Su9Nsvkvky81o=c`79RVU3G7*!qJW%tr z12pN5Q_^|mpNP=Uu{GpscOv$UIlmIHxgW*vrU=19&w}S5i0y(Vp|S7%|AS!ELG+M- z&ggWaH;QWCyZs0{?_y&BWd+d1?*!bRsl}!fT{Op|X&37Y>4=}_rmNlBh39|-PY9SB zk!X54$s}B`A-{XafmcLPk`$CH;WMTi^KDxQkKUJ)mLi~ zf>FWv&Dt$x<-+hh#-H!Q_-0EiLh!})Jm>yb8Qp$1Z$R~p%0e)?-VGMPI1`!VTij(8 zf__Tpwa432s({j>V-xZLoRkn=A!Dmw#yT9mRcGV1LKL)9#yQ({?gwwuL=e8N`RQK~ zd{97VD22SxzYCgqk0eZFyzuf{2(rF2*~P*ev=e_d?({J|Fvj$?Ek|E9&Ph(Z19l$w zy<*2hGPeFf6f}mL;br)lU;7Ay2Xw0Eac70udxkss7J}`f!0(|DLG>ADcwgJ{_tzM{ zKaV@V8I^=En?H$6USRV37xSEyzLSmp7uW4I>wd=T{?F^yPsi!j|2)2*kHfc>1x>^gtOFKV8XXJu<^5R7FIJ^C1ViRontFz8yR^4KaR zFwRrN?|+Xz_Un%G_kVUJ+fd`4t0W^>CSqN~WCZ+Bef~Z*w{&0WD4T0GO%|GoOh)l; z^%JmG&rnyoN8Bt4a4C|CFh@AI!12k#l`)HM*H?{Phtwx7j^`BM2IIgzO%E z2jH$WZQnMA$HCu;nQGtvO%a0Tz38Fk0u*L9A)_~Tzu#Lj3jx0fr9l*jqEpnq6*hH4 z=uerNvv!WRU&;=b@)%!s&(lW`o zljrMfeoE~|uwk;Sk6-g$ST`!5D<0F*jVm-{UZIu#8A1PKS%-kGP3*m>_LY$?^E|J^b4x;B#ZO2qn5&(4vym5iJ+AXaSG2Z;LWJ z$>y!E5S`wMZoK=*{%97zd*VC%T?9kmb8Jg;EOoZV!pLp=&zW}u%ym`Y7yVB@6P$a3 zw#G6NcZT9T;x@_5wfl`7MqVm0SM3{EjZ5CW-M+)PcN-MZsft8*hNkfERgEb`7s=22 z%2qsoyaeLln}9NMJh8XU@J<5k;=(n3{X*zCWN~BE!TP<<7cD?HgKqUavnH_$wM^>#pcJ#tm^>md62BM35>D#u}* z?cY+6SkoPrEFOld?wp}7YsB$uLG~O-qR$D#uVef>Y3dkTi?aIPo6y%S;`lXUd~Nrg zqpF&+;cZ#yT{IqFKlVRhnn z9i~mFXO%C+H)%qhfyc;8RgeaG>^k%AO4+*A8(3XoVqHn}#P>!R&n-NDD8h`Vk$knU z>aejla^kFcXHWgsw)1i?T__(PolTNosJ{4~MQu{ueo5p!_Y>-Nt$-W2?PhqB~7#$cWK!B#)x6}jQd$xTJ(Et zP5i8n&G`be>y-kxVUI+NIO!tPJ|e5W`?n$p5p$QUQifOLOTAUd8Wbcb52X|RXG_ww z?PAtosRYG{@oKc2#{7WqL1*n3Z$*&NG;|!n*vHHd$POR;J%XVp$okc1$DhlI$LuC9 zwR>Tv+E*$YcBafq^nSj7pA&xhB!XS(#&5lqDJcMA{*+h)V#GawCjvdI7I|j-H?U10_#@*3k@65f(SccRwUmTvd z)CKKO2K2*MlkOT2{ZIzcH)HsQ?Rog>{eW_43elS)Gn<=0^rQB~{kV_x#N6_v3sVnY zjqdFL&y&0KW@t^v9&h=WQpdm)qSr(Un~$3IVT)8&;L4YRWba>cs=HC7=G&C662kEp-gN_>d%(k1pU9z4IYT~ zWWD>^)qSCNHgb8`Jyq><{bT#_QgQQfR9hP5_7GwUl)B!=-@td4YcUh%vZ!ZV7B(+2?V28 ztKGM8nsz00%bw7!vI+fJX> ze9eH3Z2sf^Lpe0*EP|)axMOkr%+Fbvme}(a&Azi|M-m-t(k}GTrs(mwUS@lSyFuuP zmP6~K$#G`4cUber+c-?%!>qgnkM!XQJW5aSXh4!U?qd_`)Vjy}0Y@j6XD8stlFGKE zCFC#;`@Lb)9;9D5HhmM|?!HK!Jrn92O&?F&jtS+nCXFxe9!~z&VAxo;u4{kMn8y~T zCi?Qbq`I|cU*i3EewaGU??@hVjbRhaHO3m(g|>nH-jD>(YRbY-hN)wg`P?#09Seno z-T1%5)KP1eH4jtA8uNM0Fm-H6s@D|fDb&8Eq`p2ek)IRFAD+ldTsRkge;jg|g}48I`Lp5 zVQ`rhO4Nvr=BXmC!H-g*yeq!I97^!QgU-S#Gr0S`}GnQL&Z1xk}B>}?|jgR?DAYJd#?{Wac*jJeTy zM6VWw=9c#n^h=mqp7HIB#TnnusF5+1;qtFsx$RGUACbYW+4jdIxO+q>K?b)he{h)y zrHsQ};${A(Ulf|Z=o|L-6ysi=AH(xr5vMO2mhwEOr0Jf&nXzHm+G~fvY~}V2ww7&| z(8F~y=X&k4g9xfXk^K3%^?hH`8lf+FJuFyBx7!+7?7j8=f~Tq3y|(} zW`A8E-NTf&RsqYSt!=q*C9mgRnQ)(3;_{IVtUK_MsGXS(9#4KX(;1m`AEC7Mu(7A^ z8KAT^x(MA-N%XKWZ}dTHJy1HkU$S_jccMF5AZVApgCG&mwf8gHT53t0%^$z__}ck> z6o!N0+ZU(ZO1k%$V-=Mgp4Uy;PzBXja~HF1m>!)YXw}5s%xG*Bh2~>#BdCthPFP9z zpU$_P=3!&*Caz}pUC>lfX#OB+&yUTSA0J0BB%o6Q>F#%GzStC^_m{l*Km)|(I{-zr zlI}8VWO3PDm|A6?y?*mP1cR(^I6r2;qMRf*rlDu zx2tT;?x6(`hT`-J z0lx%=)peyZpMn&VRLrF!hLH8Gvo*t1iAtA;Zv^bltwKO$ZF+>jjxow(F2*uc-+c!W zG~x!5Vgi2Oj(;O;m$23S_7&RC4k9=rA)LX_PiBX|_P+7^4J4ze-cD9hS%pctQ zX~M?ED0SQ;w=v_D1>%yQ1xD+P3^VsV-?#>iwpT0s{1?PMn1ID?7lB9D7hbVQ311_y{1iL}$ z+$g0E)ui>4_ly|k4WfNeHS4#TbOlAC9~>7;?B#Jbne^QBPU1Y77#@~nPuynEa`aBa zcZQ$66MB0U^uVXIHFPgOkJughF}g!lM2`ySbUF~&B0zZ%=-QEG=r)s2Hipvs2(s~V zjz~jm03|Lbb3}B7?&Rk`h8UbPHg!YjUZS`Em~Acwd_-2wU*~7nmkB=3X zC6^6z*_bgo4`mbGiLAjGTQlUc=jnru?Dx%v>v?=Bp?ovVZUGpA-q3=PDrl2!R zhV~ZIyA){q&Hw$BIuxjVOvYBsfcEla=$-lKR;SO`Ln8FXT`tW%Qnj1Mbx1lFvuc-1 z`__oCTcC7q=-WKTp%(gg(y^(E=nt8^^B<#~j|k`t<&$ogfTGZ3qPO2k^zG)H5Xx8i zdBK9uDVL`+QdW2+8_R>FBbb6-zlgmDMC>(k;be!GA4HJnvOxCWs!yr1LPYa%ll~n> z-0(hF)xKvdq5n1u!DlN8KWh>>M!VQpvvEFAgJ7KAdztNNAnRXQSv@>`kaqrW8OMGy zeZJoHDea0%(AuT+j#UEFd!mQRq4W7?-3;xaa%hjHtKE?DHx^6T&7l(LQE6Iu$9o9& zO9;1D5~FV23~f^-^z7PdFDnU&;-KDh;@g9zc))ow=B{H&jV{-%6^PqQB68&T<^be)W!$+hvPpE|P0(!?B=!d0g;Y~LY{g9OFdA6MCSavwHi0E(s z6~Xp-L}$-`IEEnKYduA~I_3~P?FjAa=ecdB@wu_$0D}Hgl+$;ZQpX`l^c0x!bUqlP zj_08I{?q&)fB)Xtg=b`uqW1kTi^ulrY)HY2)qqkd=O0sy?{>*?7=Jho_T)Bh8Mb`DC+%M1&4<$`?q1?8``2?C`t0ejTBfq{71yuY@Si+ZI*&seX8q|O zrE^(32$<{V=Vo0RFm3O|czz7m+ex@iOo-pd*0`^jeiHNBe><4)J+h#-|arau&dVZT_KW}oYzT#h0I4Slz6T>h-%-f z-L#dA(#|ZHXU47QmY7evP~!Je6S3=ejysbx{+zhP^T6qn%wv*|NJ99WB!<-#%o{fR zSDh}0&er<%JA}?v64CQ_2%Qf~M1N35r+9Pee*F2a{r%D#pt=7h=>6qH zw?pmwmJF>+M04~eqQ88+%A0+x%Ik7Tz0rBlWAliPJBS`Fflg%fAat$fx&ykO#|ODd zi&mP?#H&TW4Sk73^qm5_*xEZ*LUiE{=;LBRjq?Y3c;9oN_WcL*izK4&5TyzWNO4IB zfi=H_GVpDpSKm`zR|8~LZ*e!f;5@KF#IeOSY1;M?A&_fc2(qc+EuAyQy(P#U90);S^I(wqEj)LuB^(urp4&}Z*?%Cn zIVwVTN&I=QOM-q}f_Ei# zvCf^DG=5o7xQq=WV4VeJi6~V}ez(onj>#ES3lUf|1jR369o7|VxMxY-5+IXoaWwH}4y<)&U4+_ImdyaBEliqFfSun}K^9d9V=eip;w~43J z)DM1k@K)%tIg++g#Jbob=%xE_)M9rU_?BG;B_<&}uzF!fum-`i{7wsAbPZF*X~m0f z0m^<+_0@b#TeFx?KabmqmbgAoqSP_?7U}kjQbqs9(nmj$vOG)EB8v}88J;pZve>y0 zf!a@@#O@@z>mGkyHIV5tdB9|#WDK`6(&A5n?Y_rzD&3jrT~J%-l>uK< z9%;Gn@ytr&x0C+{o5%TkD}TSJ*5xhBgw`)YcT3RO+{NU@$>9GVC^05SndrTGKDNcU zEJ1ez_J&a-FBq#EdIp`WUcPL=xf&?$Ples~Nt?|t*fN+NhU}_uX(L$~`ximUmxx}K zgQ1U}hQj2u;U{9C`m2H>utoXry+jm*5ipfF1L@L@c7Y>esH}M*g@NTkRyw6Gi-v$<5etovvpOD>RZg#2^r|lE+ECKVJkQ< z{ifaUOVIBfqYhV&>N~~bED6g)lq#h;s!zy3cRXiS?1MI+oLRbZz|pp0<#5A(=6f{e z7`_yv%PnFq>(gx?Qf28VZFQ>TtL=c|&ry9FOd395bxpVo9)ru_oqS^dyOcU|q4pi1 z)KMT2yTnTP`3j z0)&d48ET)qUfk#+uI5FL`RmFa^Vh}g$@2ZQC|Ry&y#^(A>xFVH){7NY4+?=Tqm=oi zQ=^jT`IxOGO`CJu_l3X${z$F+LiwA3d*|;B++QC{$W~gl z(bvCG>e$>QR)jKC-}XC%K>j+i()ub@A{lDm=6Y;wC+_A2k5$)|u|GMoc;>DNa`5uS z<$&X1`t==ST;k*XT)nljEEByYN#k8|k?}69E%45)b$Q*H2Jac4che;Oxi>N1Gn2-9 zyJ@#S+72b-lQvrj8Ry6QIhCx8Q6%P%dkh|I4~l{IWAqE>kK{4_Pj15`BW{dU3N-$S zDt;ax&&aRH#(~))J{FVAv6y6x#gb=f=gdi@_{CA`P+{0ZV#W-1LG=xpwytE7kpr?s zMqu}3=4VJ15eZ7kLIjTf-k3L+h*(#4*DYGvJ=L7|`CE+qkeok0gFkWJFg`K<=zzT> z6M?A1@SB()Q~QDekNYymZn?mh+5RITP@Q7n-m)d`TYXJ~iFe|d&;I84G5=>{&EAz~ zs5T}S1rx^n%_JRPw#b0H$*%hH=VRL&ae2tW(AwKgdB{U=eqLN3p7h-abmv>~Xqi>@ z<>#Q7%g3+~*l~*T{w&;R_UF2iOZKPZ*75z3nP2-Qf4(nv&$A3aCW9P`FhN` zKDw21e{*vaDwzJYXQ)0jp+a0&x^nmPRN2AxP}o>1;h1|kPYV%O^UOMbU4EUP>*MBM z)1qoqA6b8DH<VtV3YWFQ^h~LIu+UC!4cA zq)OURwvI^S{{6xqb6#%6k8r^{g8R2OB<3<^zuCN1kTi!CnEZ>|YxZtIlD(duk_^P<1gcLbTmFrl&^dDv>1Lz$w?tl+d_@? z(*~-@GAS;fuKLfF8uxpC3A20>5^YvFdRhYl~bX|4b?E)562^q^50!o<- zjpu1gL!{nf%C@x*1}I6PD#^qg0VbsiR@U*eh5q3l$NEah577 zq6hC@rxlQbW=ma79g|UgggSE9(xN4%&N4aM@}Q}+nZgBfc3wUT#>>ZohRn)~$;ZXk zY6}{Swc6r~$;bq~UGf7%Z~t&EAtN151NUOnPpxEYAu0s+s8CWqX|oY2<-ESmUrko- zcr~G~d#*6#sH#;AG-FRERWr<1aUE(Ea-D8_T>*LnSFJs3& zwJz_0B)ZmS8gM-Gv5m)E92Ekye+Wfp<15IC@ogk4cXTCbrTLbY z_CG%dii)92e>|Hs{+53-2YwIA3_b_W7(WMw6Fi?SCFa1`hA*#E?=WBgQCbweiRdxO z;tA=-z5^bma|@F6y%tbTK=oChqmGNwnwm6!>=vL53`iP-7nP*&z#{0uY6NrZ$$Gx# zi?{}#9i_^^BBC36j8gc+v(&-si$q^rjUdC}j<}j*d|k(%_ptMYY@ki?m5Em zK&5+*(TkPmdj20T&-ENlDrdg*L^|)UMo>(mlb>4=iQa!JbVe_u_3tkmd!fws0AkX9 zsJOR*I7Rx{!|0NP-_(UqHv*N%B*BmU24&a?!EMI8Ph(kEcx< zypXnk`vTfV&&6rW@O%GNu4K?h_*Dgw*#h`By^naU3 z-@6Gu9$IA3_ufmimGRK{4l2OD0N)TZ2PDXSe9eN+s$~JcE(}cV8STgjlB+>udCY$(oB=A2Q=b`h`_`7xLxRK{UBj>+WeUhX4PDqnHDS-W&T-7(qV{;kn z?n$|-kJV+k7FblD>#wxa(6?#frx-q1mbYgbdragnlz;2t_uft1GlAldM-7~xQtG%P z*NBxo_zHuQ&fz?ChPGA-SRT9F@O=c?@OjeNn6q`iVy z7f|Z(bSLPmIzwBx1Iyix@o+6b@ghncZ~QS)S264En08^^3Q8UK|AE!b;B{|1Lt7gJ zEU&hYubTlBGy9p|m4N#-6RwbTA>79(b%b9|z@1~l-7)n-xa%l&ke6s@e5~3`I~aPA zcCv9Q1nkVtT>T>LtQwU9wUjDx{$647*L8|2r>G%AAOD_qR#7Q1YmC)1c$;PNmYkx> zpjj{cJKDK@L<$@oVfBnYrI~&5pQ1|4q{IIL?PNYW8|T+jn|x0{G^3KyG3&Dg9p_FP z@)Amea=QgnhfN$$|Hi}NYbOLW*9Pe?egiX8uJAWbu+*w8)rrZ9u@%2_^sJ?ul znCY^9hC0~X6Niak(awI6=;boB0TKFQpqR~(Rjp!R&|K@B$N!7*aA%tM+4{ykB?f`B* z1TRfzX=(zdy8a9LZmus`J<@XNdN^zJXPHbDMzbI#!C!ajc3Hy)&1rp9;dGff0iMiI zea&M`?uZdAXde`qJyIm6pk>Z}YmQ z+(RPKOD&k{c9rgT!;;Ym6bpHQRrViJzF!c;I=omajTV1p^hVh$>V0-pW+o-!(bLSRA|RSGL=Q%nYZDp^sKmzVB8rS+(6Rh!rtO3>Or_ zd%KKczIS9r?{rh|mK~zX6uuWXg~MBzZNU5Ns$bbkrO6!LvPP;5h(s@(tlHe1J}ErE z5Z-DT#f-*JOubw-K>4@Q5R7l7v+M?}PpiV82Rnqu(;xwc0HiOoqSN+PiT(ELlXFrmFw_F%c>mn0o^>7mYhZ6NK)-Tc2 zueBdgC6)6j)fhw5XF9_9l)`b}w&I`j={IIyW*;8o`*(hG|IV5Th4F9Ts$bdsf|SAd zxaUWP+|FdQnKHYe5MDKjm+5DyL;c}}c4~0Up!>ELsUmW^MPqy?Ly2AWD_aOc#(Dkt zK2;8jM3?KWl}+dM!@|ccl!S||KYw_J>6kH>MWtNNOjGA3pQ5emZxcHA(fya!xn%m= z&QS-mMPnyvYc#oi?U&Qp7ta~^KRZcV{acdSfA^o`{|=`;!}GyO+8X+GqHWrJUyk@bQ>Znx^{L+%XxjpHA`z&(9Z9Qu}+2_N)z?I~W|~ zLA&4F>r7wgtP{36y_Sg6`!w(Qk*KuFO^W`Hc5ZC+3+CDRnRy|6=m>QO1v7 znDa>f>$SybxdP3%)n?Z%E+#)hYA)Ba`ntOgIoKSQ`nd&25Fo#$AGBLX)CSuW-!ijefzm(M>-cEr~k4GmkmF%S{?sTV@At1C-6Q%@?;-%Wg9GxI{F*x5>5n-hOG0r;MMG%=a=r zGT!}Qj5_=_iRUY4eOco&`m(Ipz{%RPF(^oCUvB#}=NN65ilk*gR&Ax_q#|A2=qs-+JP%{${M+}t3t@93-Ls&!z`MW-&0~De z(!#Zc-uBu8Z_99^KeNA@=+CqDFJ)LNKo5#QxZ_C=rN$rH%g7Y|!o=)oD ztOT7k6UI0riO%U`30xmtc_A*Q-zerlDAGcPP*1Eh=X^saVE&M#CDSN6Fy+1#h(3{#cv%S+83)Ws_ zHZ`eznfW_D4xgL4J$pt%&q|VLoSCFw1*WbrJx_~KC60G(lq%=Xr%$KKWz7p<$D?la<<}ORhx6S0+xIhEo00A*tj+fpTA_vO`FU0C>DmJClePKY zDZ|v!HVH#(v#H`QHE4}-T8ZaAk+dL*Rv^QZUpq4)SM}CPPi?-}V}%y~p1f$;OfOlM z?^QF=JNIPb-0a#cW9&D}k;Nk6XAK{<$as|XkM%!lo{7EW`O_+64#>(;eI+LnaQ9>y zaGk)TqKrpBiO;8u|5J>z@`lVx=8KeNqL<-gGVY8xy;6_UD@2`j40nIh8Q~Xxy(#PYC z;}T68FL^%p?gZY)PbBp}HOU9bG<^`W|0NM;U9unYQ4-%~riSw^XY)jNN_=8RDh2zeQ{P6^J z*rE1KKTaJ{U|u{n%x{0g%>uHqGgRR$SRltxt z=Xwoj8(_<2ds+Tc_|C7*%!z8YxwrMKc~KrIeNR;O%QPw!U$Coe#8+neTRAqe&vaKf?D3 z|3Rsv;Z+2FJ8G7@uGNP5JwpTb>a%pN1X5gnmKHHOU;30fWIOR5qI7PJjEYYwb;RQ+ z{q-VwfZBns?K1L+bR_3a2%B+UJjrohTp-1eFqhML-Syh> z_sx6vKqo+oU7}g`v+K1+LG?vM_r{MV)Pcb3@VF}dW|=A(Wkf>JG^l<4`ycW~fFkFg z5l{i8D+Sv2f5i~vE00^S&B#eweg8vVLBw3=Bq2}@BPL4}C}QKz;}v9Huidm~H8uwAdQHEH~Lh*HP-c6VH_{mUMnpQ&h`jAJMB=j$hBbh*s9HLBI@ z=hEx77vHC?JSIgdIuAP4K7E&iTeG3|8TXvw8J2`_=y;l@7eM#E#bdF0Vx9xJZV~fVi0JgMe0W%0 zdBd<%#*2|OCCv%+`wNS+Q!enQy`#7E{!|;@1%jSx_`bM$d{(*N!W@{&gPrqv#$PTjwx& zU0v4A^s-gLu}Aye+L@Q8Xsl11cF7SIDQ$HU!{@484%7#>d{{1K(C z3_g?B{0J(l3XK>uv1h^Kq`dShf-zRt!S8(NPS^)sqf{x8@nUp@D(_L+`XQx`l5IjD zX4oCw&(;VjIFGxBm4^%)FUU;qB%Z^z4hS;bCC?$yc$V@!YA0CTCIp1DbX?uPQQBH9 z5}nOQF-O}5M#~;9uST8_Gha!?X-V|-OVd2@I0{T&w^7>4=8aVnddhm{Xadx}`L)&F zHb~3cWhniU;3=^q@QDOvwS=CUZF4kPCdJjeSsh_{OoYPLSU;1{lSAidt8D0QwUKUd z?<3wSWG}zg3S~V%U!_=xurAhZ8zt(^7F3OU?_H$Dw_n=*U#fM3E>72Lnl((HlzS{_FR}l&N97d5QV`L zjAs%^uW_;YI;x3T>BsjsJVuT)N^3VI!N* zV?gJU^c@>2_X!&rebqqciu4^D4kgXa<6|$sdV#ztG6HOj4kIC_6JtW0;QX_DM5w-} zO}Q)?0gnY{$b#MTuxRAJiOX%tQ3M)Csq&Edt(?{2F>5Goy&LFa?;jGOA2wrbteRxz z1j#b;8boVg<~%ZD07a)5Igfz0gYldk6XQI@eE??;0<{(>-;%NJ569DZ{)3Y|KR|Z) z#G42<>C~sw9wPx<7di6Ewbgc<2*N2YVszg(GzMUR~W@v~)gNzrV zW*nHsGS=NJqvs|WJwKPwbN4GY?H8+^+GEeo(2DPzqdCkR*fpuDPhI}V@W2nzUF{@# z7J+sqpZk`BIgX#@I)R}%()taIuDAYX%$>|Hi{}**I%w;_4@vi~`-{B66le!Tdo$gM zq3Thpd~n?9W&Qj6n+Q6mBLJN$m9N;e*C}-bMRb~Rqdd(fKdO12m+bJL4L$2|hh}JV z_RVSb&wwrvXp9!_2YqvnwnA*&z+gw-MDV5fyc?RKW%2q%XZrKu>#&#g-1JTvzB4?^ zWh^Nth9rhhn6X?=NkTZD2Q3~aSs-~SR+-?^)y=i<=uB_R5D^GNr%CZo$Q=Ip&4 zu%DDH;RgV_nnH@7Oo8SMBH*W#=OieA+Sd+J>~2DZI}f&!li+6smb!LqXhZJDf&iuD zN8o2mO0F|v&`3~yR=~blhQ|JmnRf{p?KOFqPe06K!dk+GcH(_1f(lxQz-^Q&ZOF9&w=BQw-Augm^6*Y`dTGnYgti|w(hqG3iV|D_MNW5 zqcW7)2We|8DNf=S!rp!HoQ+!BgaU;8UK7>m!u6$kvay-C2gPp`hcX`1{R@v zV2WxRxD(w2UpnW~WgSPHlRNw}Uic1=ll<1Wcr^p-FY6ePZ_< z1MJL~^xr*SCjvUz|5e{HF5`Zx9ZdyAPo95jk)OSdnVeNzl`(M<1r&o z^EpTeui9hw6P3x@X=%uwkcj8?$$D z{>LW7YpNE|nO`5-m@lBS^gY_zC>T7obN|{tE_TwKdTeCl`n~7P_2L-qES0g&y{@dg zT0~L9Sjo^@5sE5iHH+7f7C_v~^mE{O+L{IXUS7`ngH?T!+|c2M6poG2E)evV5e!vR zsxUwDvJ?bEqqHc>*MEjj&gc;MzRAulZ#_>P3q>ZQ7w^ZEFWC<_%vg+HvL7%07yI$P z<%|3A%jc^1A1SkWNxTs`zfwwBtuw5lvo!Pu?|n$7CkXlSZJ3 zKR;8}El^tIBp4DzwJ*!nxIryLFObzd*@7TOX{RuW99NCpJAF=|n9W&Yq{^GxQ{|PT zRdpX`!X^qRS_%}E0L6IR^|q{5ZR@9PzBY)fiDzV}jb^j^ytZAv9ZRtB0Sp z61@u2VCg7Tew|759htCE2+Q}4P^CSGbh``xmRmiNIyZ?wPM| z0&6b}mY$=^&TCRCtNx6@LKzCbbN%j>n)}@)b%*PP>20tqzxpgy+^}S@HN+b_RX!Lg z8CoVmd2Qc=E$t)o_w!tL|-)legTMH19VoI@EJal*(4b{fdP}@a>)iRGoE6{ zsFA<=0-cc~RbH{D$}2^y>dG=c#0*kd|L_mMTpUGuYbvO`R$wBPD#Eb~7D3uQLT) zXIS6!?JHZVn9L6wXVIAryArDJb=QvEeG4z7SxmVtX-M_W%Dd(a@~Ey$*`QWpw9;EsgbLiKa6~%m_8!}I!36n`6$0H zJM}6-^`Y**;j8Me+UP{;U=6eXcOdY8&QV3qMA3=|p!vtD)-o zh#mtvU2Hs3d7i)XI`Ax|UDY-`&K9CJ+~#m+oD!0JWv)3vAeAQ&_Ejy@mbxiWa34OSM} zgJ9d z*p!K08FDl84Xc47HfPkxm?}i7yft~SHDbJ;eh?|(cJ4L%g79YRg7D_d1>qW4(%Jh> z%myH35gT{*yL^l)101Hau7=Gql4=uroL)o(~qY>E4e4l)X%i}%@Yr}ld zm?SQ0+wDH@&$exKdRJY-pN)SP6(&J*jm+O)QZEjrNyZwev|g-q%Vi$7wbbLzEcLiu zr5+b4^)Nm{#?%64(-B#W%*bLexqWa(rObS?cbC>RKpZRs-w&Q@_(O*AYtQ)n-bFIDsyp+!Z#GB9R_1HL zO1dE$xd20NuI-C>w;X?D(+q7I)V|0Q*ciPEdNhUTLhVDtjUu{O``A@PZ(Jg!@+PKi3nhQO4#QRxe_O zzWoVwTn*SiutMkhgH?SWq>!Nl`RaytnZ;HU%4U85G6vhhyYKyQ>&;>iuV-|E~6%sv?g5CxZ zAG;+cui1PbYY9|e)g1_`B8pbN!}prIoj*eWqT$yvTaws2f6a`KEO2}!z+n3b<@n|x zd+*M%JNAoq=nOBX!A^AM6A5ZHZZx}@q}aJ$ReJ<{zd;;s$?O%`AiCWBV%{$ z&$eydM^xq}zrLr}|<@IEJ;nmQX+~1%O~YJ z%|~F;?kw#&r6~DR;+5wt!bFEvD!GVF}SP%N^}M)m=Cii2a2#O zUvouV%_8|maZ2PH#hbD*_k(AIz>(Ir+_%SQt3$v%`UC>|0417&sl5I^S2K<>KN-#b zhi6o_MO=fT0ObfUH<|*QQ$`>*4a)z=+uO%SRh*0C&pBt4oDd{S65SZNlXEr!mJ~%L z!Nt1fWTDlHwXoT?_I|yWv)S-c0-6Nwuc=aUfK;dv&4$!f(7f;>B<-zKr9i9K1+CR; zy}(*)y=~n@R1m%LrY4$YexGM%&h93)_jA9W-{zsLJ=9!u2%sg-N%$(MVS*KC2 zS>0)sv=V4~5g;)5yPlF><~zt<5xNY5_q5L5{)uFD?w7B4B{YxSU47qvS!y3tE*;36 zbGS}$uGNWohIM<^K|j(GWp0nqwR#F*WZFd*|5C6Vps2N_e7KAGMqmKHU5%6LTJxqD zhsv40^+E~q@m2tK|M_9?%(1_(-(if%E&4E){hG?_^*PYSG2$ps?7F3(tdJxK&U0}8 zfgwTA#({e7kfID2#m1qSGFC>KPGiKcz)?TS3Kb?hW_~?BzoovVZRM0&_gcplegh_N z0y*zJ2P`@Q@-2%;tDC-wxUp>qOfChf0gkRO>C=q4*bm7Gv->oddqU`eLrM<2+r&@} zW^-cybvEY1C6drF-%;d&dZA-3{SqB>iO`R9a7?HvhC|Zlw9;@IBQP_&7WHAAM<)S- zxaQ25)~>|9ITvk6l*T2Kbsgn7kq2tZm9dyfWf`T0ND?P%xUM5!y0ZFI7G z_!}!DvzMFRtpL~Aa}Mp6#J7wm9RNkE*GYvVd|$FK)H-`R&h@>N2Cqk27`M&UL0(W@ z4ox#p(clpWOvX8`Ut$&L+J+J-cFEj%l)AEUUZ8AMp=mupuvN`EZGsh8h_d1XT7~m@ zGr}ENr+dK)+=A_a75E0Fu78tp4wt-AQ=6W{xDKC_rPI$NJtt(H-g%M+LwA?f_Qdql z{*yE~8?33eO>Q|k-Zf7TD-H>{Zmhop<^kL&6i+jIvks)oXb z1pvWNHoilX-rG}Bb{ZnZ&$}a^T?PenzXB2Yp75|gHoINEr)=1d>n|G?&C?DuJ$qvb z9P(@N5^DmCtS*3pjU~pR)$$eB{-DHF;Rj`b-vNs@5I9r>Fk($GMr6&H>vqCyS%bN_ z&Md$2L%6l5;4>L2tP& z`b?t}X=CeidVR^Ys3%I?wwR1Mv>z^OZA-kCWZWYB=MMN~Oit@z*P-r}VLv3?6Cyu& z5xUkVX>_Of{|d;kAK|}z5#{Wq%xC-5EzpJY_=oYdUm4d2h<(}2y>nCEa6BeMJL>vt zCcp?3-}B^F8Ai+kW^Xh5t(Cx`OTh}XmcSuN%q3|e9K!sfXKp@Z>xdmMLKotGM=7cp zQZ5@9R4%O;ySMVf-V3ADRh48it->CscicFkY(m8MB6L~njIGx>V4v)P$RO$^Ep@}K zGMsIjFz@bfDvW10wY~NAyEO*{iyUwroCLH@hI}2yw=z{5AAplM9Nyi!+J~I za38?a?qcK627oGkigBn0pej5OBCVBh7TbWUyGpQc`m0*|Y>zQgE5XxfKYpUXg8eeA zh;dzV!G1aR&-)8v|7@1Pq5oj}FsOqSReY4>|39=~cn*$Z!Hdwf8+b$(-_(0go0|wVS5KR6&r`%FF#zeY&7S(o2KyhoY9=?{I9O*yb0J@*be{g^G7Ji z%n!P0W_B%o2AVc!LC~+jKGYBVZ!T-`td*~51(od`_(9FX@9_H(8tfUZKHKkr;D%S% zblyBVKdxrMvC_lb58C52&K*`D=r`clJSQC6h4%AAdHeHgvuf9a-2V1jxhYqIU~3UH zg+8Ofve@E-txhf^HqiP=8U)sn04NF?u)=5_&pLk^yzm+2o`?X?}23tp~&(4?t!O*K~I?G4r z$J-omtS9C^z3~egY;_vvYH}f{8*ofEAX4sxWAU|FwOtdW?dxSndX8MiWAA3;94Uaa z{UbE!-nZCWH$to2aOo?Hq42aaf_hEiD@$c#?&HI>s%=HRw|5HuYS!Fl6YE7!I;jEXjOenp#ee#J&@e#QJZ zr$xdJm>h=KKZl*Me@1;KyoS^+b-?7dHOPZ^ zKb_8o;05Km)*K}4xG2^>KO7TD$Sb@fyxm}ZxAUIfH zjLfCC#uF&p4Tuy$Q9Jfm|Ial~4Wj;23&%>A>s|?@cI@|+lt%xPovprX;I~{(55Q^q zbe(+ZE2v*AhRaU-J09Bhs~#G~F?W7Wqt8?7>hAgbICxw))l-1&Jr64Kz)yQ(-O7r;*^(?+LT|ey>UVo+ZTa zEF*TmKsAZ%ypu@aXZ01;B$65;x~GoF4i2kR>v&q_X<4l!j*0#xsA1yw))PZDiRLj0 z7iv~EZ<;$%y+^S^I21N-S*aALA#uo?>7TH-=^bWUX0Ok{{W2+6~=ruQ+C|; zqye^L=9njoLOTt`+>Y_}xzCLDFNGL~{C*;0=-gx)i!FPb%^!)!Yz)T$7y4 zGm^Mga1Pt`tsguZFzWXxAn|OS`4vHSs=x zDw+cGC;e(?5;?%t1@M=;1dnx>L82pc-d~FIphtC$} zznQ|%;V+BwH>L1%_;gXeCWZex27gwR|LWe1^=Vv}TAx)Z{Ji`xMfq7N{2ZPy@Xtu$ z_cHiyQNAqIe-2kf`F~2`=kP~Fc~=TQhkw>D)_)5BTn67F%IBr#ZD8U)6*q=mw9+oQkc>qNWHpQP*7!2~W0g5Ce zM6i8*ib?EsDH*zeX~bS@sAJCi)|S9K5?`zKxd>c?@~{~%8f}d)2Bl$nHUy?RC*7kq_dz%*nG`u83kjVv&%Ll34pA1T{AG~!0?IGD4BKVHH zq)vua-1g==2zcrUfK?!SL>Uh+Bi7X!*&}ey^e2l1PUA~(o^XF4C>=3I^&=ZJIz!+*3~ z^Ct%-I4T?dB+B=xa!ro%HHfx zV*1rA2+sG0iGOWT?Rr?+tq-q>*MPL3+JL4l3NKrBE5~1^hKYe?QTOnMN!dbw5@BI) z9dUTW#IElLX~E(bplOv|KbWpBd&7bjVN!OxKdGx>Qsy-Y>w~wR;jNzlt5#6zLR|(N zun5OfF2*B!>&ffsyvaCT)##LFo;(g9 z4FD|b252D?)S+H>6u-@2DI}#kP!|dj%#)#x_f-uMRWr$u;#j4#e}O^MJ2^ciNV9UV z0{+{bi^AZ@8{7$z#5)j~2+%dS(Z8xlf~R#OM8F7P&f)S)+uEpo*ggg96bKQ@&-m}iwiftrTn4<|9+QYKE05mw(3efc71PCUSqKfxQ z3unArHlcs{Z0J%AlYnzM(@Vac1znP}p7hAj^lsTL{rDZ;E3KWO&NWG~)Ivb1Blv#F z1PGehut-s?Kp2V^z}j_N|G2_DxTE6vl43>9^J~wS?3d*Qe_Wv*OvqLMplHGVide~W zGBkZN7lOq(F!>$jvH_ecxnKn*B%UkC(|QA~GBo^rA_TGhe+LNmWJ8lV34%QnpeZp4 zg3nC=c4r~V4%NGyoXTcrLsR3a#PQ5E3HBZPJqw^H8?3-KKI&F-Y|-M3;6^ExuJs6AZQRVepo)*=7304)I(Yi z<2q2kPs*T$gaCQL3O0`wXdwVb67~D%?{*(VypK}qV*ixOhDCpT%RIP$ovZNIEM{XR zaq1>n;eg)vmsH~IZ1;_{L=EFh!URO#G#C*Rb zFQ@}JJn%-0qJTTH(F+lBK;{S4Fdqd8CeiX+^vlwEncJ4b?4fN z+jq2tN5c+?^nL%%)VI7qsjI6F79l;3+-)9I_&vdu=M|{Hd4=<7$FqdHXLwF^9yHBVAy}ek`!AWwygn`3`^5snrqg zTWuk+yT5wyk67-t_m4}ktb27fOzx_K$tasN!DHEYy&)n)3psN4R}aSCntkvkN?p(2 zU3W0V@=?#JBZGIdb#M&x4!49yhwkPyv+1>1Q5qW14gjTL0;R#-4p{V=8;-%Br;i>H zYhan2wLlU6yXt&ssu`xi_mD11VZ{-U+uu>-fv^V0o&#u_m<>Tc@}q2Mx<4C&SijT( zO%rnZ;Y*WAkbNR=vPzn;r+I{YHq`vI@uh!nm^;MKFz^UTJ)>KA;`y zZ(e^l6jYW?H+C`Gr2}F-9q1mLe)4e|O%z(bGXpeQ*a8JC53Y|S3c2lu_6@Uj zN@Kn~Sk}etyACkYWuCRmTw(bVu9)vJELSGVS=Y06%w05UT{1j}w|yn6%jOfre38dR zpIE!x2edb%-Jkq}c6)GaqRqi8V!l=^C+G#kjq#Wa3rb&wrb|>o6ZmSXZpXMjH$E=X zWjwv|aT*=Eg8N9mZ}-pmDmw>e<7nN5-!SG2J)VK9Eav-{FYCu&q$ZSaoF?gh+_`IP z-P>$jE}p(6qaQcf{fK=v!paLA|APIvBIc`peC(LMYWJfw#{6xT%;8m!^YXJFr%@~0 z@`=6A3g!#G!Wc>3^9S2M*#WWZBiIjYC%ThHQD5D1fdB8lcg^!kDl1F#%g(Bu@O5uWsWEk0y4I^z6V8ogPBdFUw^smt0cA3=A zbTU}l4Wq4b?iZUzU~OqFzSDVdETLGwM2;~+=RpKU8{@DxzgGANj>@V@%DOnuoUhiA zsSo>;^VBfov2AJ{34522Hng1{Gy_+UtK~B5BFmz&XuH1UBc`kZr9b5I<=1RXZh#;;OfOmwxL`J0U~KIem(zW$0tzU3Qq zasTs!J8eIXP-XkJZnE>Cn*0BD^LbyhlST*gW4`CGd|vu~4p!En-PQjxKW4@tM&d08?>3&7bS0MT_b0_DelXi0-BF9yo;*;e&(>}K>dp+gHeDZD@ zeVfIQFYP|j))~k$OtNcqPxHJ{GhWxi;|Kat=C3WS4FObU3Eku!3HF&c`;+(t?-H^k z=1=bSa-ZF9k4YX^m#{K*FYq!kbt$QTiNEhuml9d6BYsaksehHj{Hn>*N5`dKAD4b} zT>39O?NIBap3m5Os6alDsvSGd?D@|5yPU-K?u>)V`CKFQ&{li+xDF=pmhQp0Smo}tt=D8W8l z`|e@JbM}>u@~2y^Bjsv{WT_#xS5*e{c)l7Y(;V}X$PWhD_?M8dXDKhE@-oa9G?ACl zJ;)oD@VzMJD}zeOxsGVXnSA0v=3OwHPZV0de=dYBHW#gGHm_}ex~U9bC!K)1a1PGc zL8G7z&q?IX>#qbWPy;o`6FEwMB5!^_e|Plrb#{FO*9}0-7u=OG&tugQTvrIcZ5Lk; zC%4lmZFTgse&ok|+LXTA!aLHsfw@EY+Vf*RTsL>@5bKQb1xWF(@9eO70^ff)zMbP= zXu~ZIe^tP5vEeZee^J2a+i;K=JSN~brtow4uLazj!q4GP3;4Au{2cxZ0iT(|FEjXF z0iTw_&*3`+Tub5S@J9u_B!!>D9}@7Q6n=%lI|O`E3O|S6w>?vLRZ?_xr10``CwB7s z7yE3y4hH|5fDhYngTvQ|_RiUGi^J~}@DFWxjKh};_nZ#kzEHqlOX1IE@LL4@r4)V+pD*A?QusOi#_gPMKV$ESl*N2=w{!jSKp&SE zRieyOB7M#F)IL!M#IhqO2N2iK`gj{Nw%hs=pWjorXRH;A%Occi&-c=(-9zOl zT(EJEppDC7>m}O9+hyw_FXk)Uo|Zeecc*o-CLz!AM1HPa&K2{m*vZ@O0;o*n`Nevc z`w<_vAzx;)uL!I_4yCSIN-H@%b5e8XlWjJQb6DS*JWkm&IjMcw+1;6In3sKTT-~pW z{$PKxfBv26aa4=B_dWbZ$T#wMnQ!;ma-Q#B9ov?cpRaA>-|ALD``>Tl_|fKvSUum9 zij|9}*rST^{V6b(i04%PRBKB4Q{vC%Tt2{ZvCq{a(k&uwEJK^Uo4-#d0ABtM_2OCH z{eM+1woLSIdJ4Z?hd-B!=QL4H^d~0z6BFZ!O||17_DRlpsAukzi}*7Y15wP=DAQ0j z%2P7Zn6J%CCeFi?y~FRHOO=6T-DAp>3*2fQQ9SATes7p4GkKcp31OmKjk1jA86q}= z?Q4mBLkVpP!z7A)us|C&t_(p%J{SN{@&Kd?)Z6{J!*ftZ!X)lv(;AH= zcsMPxye0v*Z@DD3e=j)>7TA0Dr64uzl_4nIzbAn2*hj}oBY6@ai1+}Obz7cv8~~pW zCi!ox@_~qd_yFJUvUezQ}W0EMPQHR0bA7wb| zQ#csCu)iyfr0%H~ekqfnO{vaZLeyMd?_NryNE>)B=dQ=6Xp>%0my%x3QsS6fPuhxk znIBUc1r_z1dIFxMBRWKhJd8%B(Zx>vkcQo?`=N~7{A@q ztb5%A)3N=J2CVlEH0!EHbPtE&JE(3VJFg<(aT87K?@BO@I1G)*&VvP73lx-s%)Xa= z25Bod=n@1E=MK-Q`C@$l8hZnJ?%rlVd@!AWhtFAuS0ljolFL)yOV%>Km(2EIrG<~P z@1@DGPkD90v+R2{_6882>Cwi0FO59U=uuAK%C>;9=5aQ5&8v|%uSQI7IkVYR9FKD* zSuYRIY4do6lR#@j& z3aU*fyAN;z>XNESa&g{zzfV5GI-cc3yPVfE=9>%0_~Eq9k^QLf zndHZOFMP^%h`Bvn&pYri@8|x9Y4p#WpWd~d`+7QrT4;B;-oAHx{kZhHuhMypRl@A71%TnHI87d07 zZ>$6563Rrh%TX?(P3{0FatImgD6S`{Lt2JOPKtHNbjeXO4vvEbtui!tBnYmS=Pv>; zPygg14I~HO;Yp)ozrH7$QzWpr1x^}+TdaGw`2VjeG<~kt%gXO2ftm2 zsB`OxdU-u@-0V-T_lAf%V>tBDVf}Xm^B)U;Y&gU5;nt?pczbdt-Bjln~tg}5ENju1JzobAA zz+5CHczVV~8kALy*fJi3j7Ryd;Jd1&WITAwh>{`WQKqBJK^VUK)iR2m#|CNP9LQbHyS`SPo)gU*VV&l=s#BwhCY`Ld;bR1KqTBD0G zX@55+OFA3H(wZW`^RH2S+;nX>ml|6w6}kw+n4KkqU|%+FEw zN)7!ECVP+C@+k2r-^<~0f!nI*T|Ff%URmTNTs>K8?81+#uw>Umel>1?j4v2HtV>CMR6E0u+ z9!twTl(kKhpbOLX_|{x(jIaI=Gmf(FZZ12I+On_nF>ZT5aix%bu9)w#PxyY3Jw^wP zkJSR?0cGaAhFCHxv?VvfHb%MF!UJ}!%u{>*;YKgN9nHhmKh(WvcD|Ch(O{~}S!{T|kFB-S<`)`Y#ywvHh??;-|R$5~mmE~N)y`Tt-s5bKC3>i?RbY3n@5efJ%D;_`^Q z#T;etW=X`3Pt{w@QS8Hm?0&qZ-7@MT7e78;Gi-FSv+C^r-KE_jk^Tul(C-Nm!{EAC z&8Qi7$Oi*$Amy2(X1opLiunLl%f-EBj_%tf+pylm-J6D8BaGd=7`<`1#XZlWTCsY%Emc)rNMMX*flTdpJ)=~Masn| z0@a{245D6^4U3R>4FUwQ9o637@0}8nZ(lw7KBX>%@68r)V@l+6N?o$m8z^UYxn1%I4OmGM66}l_xkBvqWpReJ!C=QX!zo1b!rBS3Y z)-kbv7iratB7gE1G+JWkXG7B<>ODq?ecLa?Eqm+80g)#+8p)^a_nZC6U*Z@}z^o@I zb?GpT$c9FgGfxEEY`;xuIGGQ@%rjP~-*MeeX?PhRD0_54e=S9S$C*9sJjHr|pncwI zmIOumT2iY+X~FEZwH2E9p2kE7;Fz2KSg7@upi6F#yQLjVgAUTW_{#9 z%5Nf1)R}(>`>8u1h<2%@KoHB@bYt^Gh9J_3;W%}mSwFRB4349ey0qNA&9YM`tbG;r zx(fDuIhA(}izmi;g1Ap+Lr{}(9?Zh|@yv6$u6p|d^Fhih1xLfppYyo@pVMHWf^$L2 zTMWQ>rR;!wHg>e3cSi%}54bM{`|bB=L=(OtzgHvu?3?T4q0edbZvb8ReeAK#zDTS3 zME(Px)94#^eritW7-i^?|FYoOEjS+>kl&6^k52Hr{@t0?LKs1t z6XnQYq2-%)o}IC)V*6KxG2hIea+{O@6d{b9r%{d4N?WGe`@m0bnv11#J8e$&xs^VMciu*J(@G%?W z1l)z~{#4Yl^#i68!HB99twuo`5?JL%E37%HPqPpS4Ms8 zgC+AmB*c7+fhZ^B{?hF<%JhRPjFChcjNljn+nWv}b~&3ipV+oPs9eX(kNM8nFhh-e zA^1@Oc$(@9SdvBI~0ai-z#Fj6S^kXj)$y zdXz>39M4g(R7RKEQZ~qcFk3g}H)#A-L17CN6s;|-ZIvai1D$z-#fGE)lk)S9qH2TUjPR5#JS{nLQ) z$34v^@;*;FL3rZk4FTgfXd9O?81s9h4O9C_piXrY>t$Zw?=5HcGPZ?wai%_%dCjp z5_*Qc$7V&q>n4&{C(sgl2A{h!bl6P0*tUgHKdruy-?UkVV0BAA`^P{HK$T?FF*_Ix zZU@`+S3KOWgt9fHnnW+IBbp~n))DBEoGY2mc22~Zvi*!=zK=1SF^_DYzHQ5*4XX(o z_9YqV@#_M7N7~qPK~gnl!-AoY>yO6hg|Z@~YD6z~6U|dbj}^de2slHy7kNURP)m3&~001_g1m5n{WBt+ql0mHttL-WUR@-hqyfy-Abd`r7V79 zpUqDTge^K~ul)=hA8$|FG)IN4^Rc*hO`f!w`?U)#Ut+p3V#~C`(Z;wm+!+72b@{bO z|6B=zcb%nCLx##v+#uxF1jZL$1t@}Nmd96LUtEiJb>cuzAd%C{bnulD1bc@!1*!oW zHWNOdruWfkN-h{r<}!h<*R=R>8|+S4Ili{~=<& zUu{p(?9~_4kED3?Q84oO`Oim$jcxJt+^wAc z2W)tZ!)FWlFKswXWbi8m{AV`Y;PB}JzB`4V!*v1gN#W=4D+K(J6#h#X{89nmn!?ZF z`2xNrg`dN71$Co741TkK*QM}txL?5UNa5%38wC72Df}EhN5B`R@H-j&Y5~6`g`dMK1blu9 zKZlnK_>C$298Lt>o5DYt!HWg_+DFp=)7fGU zXKf$L18f>^?@Z6(#7}vdZ?XH-tN^Hdo%~!D`W2{=T7mEEw#+r5rtsxFl3qWU-k5>^ zC4v7sTlO0{EVgSkyDKZ^i;4VMl)4JRD!7tT*Xt4-#j;&Taw8B^BVEU5w-+9r-5!!- zzN6bXEnX8o8B31&UJ?EJ&u3qwBqD(9hP;oy%t#7jpc#TN_M}OdZeVT;K9JqtliCMgX&PzsaY@}!?JGFA8U$D zGGDDD%FpK|F`c!KKikw0S+CZUjVh174SScc*goZHo{#XXgZv%y!fHKnJTor|u{0y{$UY*nI&|psPnp{5Nh4xPQN^SqC`}Kq>%` zD%gDmF*oz8%N~=(CF0oUdFn|>4H3mtPuO^h!=y|Nk+6taWbu=%&peLOFzT2tgYBl; zx@C7W{~y<({set6?ZYj!eCMYdBcCpo`%hj0N#@u5yfHqMKffR6GW&nrl-}F^8sYN< zWyPn9{rxAeFp^we{Eo?st+wqVe5;EdrcqmtqwJnN+!#kWUU-pKt{##Wy+Ah=n6e`; z1XjQg%evp8@1K(<9xkbaC%ScqlqZ3-pxOaVu?Y~YR-wtrW6x_0OgrEjgyT9Gq?-a= z{>cTO(f5zT#CVAv&wm+M$I-S0D5`MXu<)sG^wOwmm}IDs@1YL4EZ_1T8pUr}bK}N< ze#`D=Xn_Jy<0ZV_bOO8HKhE}qW-L#A3&s8xGyeWtApO-DVSfI0Mws9ngW~0EE`8E% z^ES?_ei9j*KJ`dC9!-9j^Lk8UUtjFv>lS(a+m8qzt&p2Pi17Hce~YC3qrVpA&qVq2 z&IpYjmX~!8%1?Bkj`H&pC`S`n1`P7@=- z`T34VgzubgVs^~Uif!krO#a!n?pXVp>oKz;V{tzCNLn6e;@k_uZbV-1ve+Iy;;9ky z>7OE8C&4k>b7+2)M$J(=XS|Fkh|uU?DCe0P1DU8{@h$nehtLe@%Fz+ulD8RksBs!z6lgPcsagY(EBd;l9GI zz~PtnG~2NV_C6MiQ+D1-gb!lYryudN=veOi;w*aR|7jBQAQJhQM!~`Fp#`)7RBqo} z5>zE}YF54b5sljVKc??KPorq3e8Kh}YF7RABN`nQ?;2Qv=JPaqfzfFi@qe*CfOf3= z)ShNLPRX`EQ+*eERk}xGcU~Bkrqp-+f;|Ut3y>{jJO2+l)B&$`Gtu`$z!G z9g#Wg8xo&CQlpXVL)*m@B7gY^`>K)x{ zdCvDoq&Wu*ROg)p(`a+zd|`YH!o z(yXtIPcV549-YN(W%l(g)>ppwiLzQN=I_{7Y)AhNKii0S-p|6mUPaW)HKNYod+Cs? zW%Ttb*4Lqr()*>q?55GjDUIIq*w|R5AzRkw!H69PbKYf)Ab$+qxbUe~S!Vb9An#uO zFt-~$I0v~-v=5*lqQMj0l8D)vj&@UC%-1Uo&*?qOdDlyvcXil0*1S ztm{9buEg^YS)ZCe+;5dRhhjVqqH5MhH2OD6UB5qv@^NW5@~1>0jA*DEx?lwH@;z2= zLzjI-qo0a@8a{iD-^4<_S;Jy>Oae!Fn(1*~lfdg4Y0Q6fT>f9iG! zoBfy9F}kP|I3H1AKF9Ci&zsfdJO)SQX*HMMDFGA5rJdu_MdQ-N?k z=P*V`&-}4;ojERj^|*B9xU_d%`iA+*)cbomcg_4KZ4#!fnh>e*tRT|Dl?2q4Y_IQ4 z8M^Welc<-kAlBUPlbJI_o@Y5ZCPSB*i{tt}^R2Nl7=m{5$IQ|9*(;9NYJpXQ5wGMBGxkNSH4ezPsZob^O%na|F{*9eer4gn~wFw@vu#oFk$IO z$EADcC+&A;7dr1`HXrkGs(fGi2+Gyu0b8~)p82PXGzxP~vidX1&Y3Yf%L%3*eJ*IO z7$%Vgouw3w<%UzhX{@)D)}jrd0jDq0bO)oU+^{(Zf^zf00$^>*4a=E453@2yBsf~H zhDpuZ`AK~DTl~2m`JK0p_}h3I?Om4MJT85IM%q(H{2e^KL9HWS>k>FUOUTzA7VqpX z#wFxykB&?C&QHqOyuXP}sGmy}b{>CnUoz6w0;mj$`w*D!uMU%*f`qV3@ER>s2{1LiY(no&Q%wDtR*fbses9%JX_FsSJa#Qr2; zqFgU*30QB9Ef+iZNWch>EoTPX1J>rT<;){n0yU~m674+JFJayr&|-UpgQ{z!)40)0TDzwBL+{S)X?WV$Y{x{8_<#>2|#PKaxEjq?f7**`twI zHp(71mpv0982i`?^p^2`Z*xg!;AT}LMv(8#Chpi8fMt7|)wvqmm$rU+Kf8O8#Rdvk zVnRni`_@>P;ph&))N$o5>tgY6nJ}}UE1?akZ`f!H-;Vb-s=2CP$KX=;24 zosFT6fH~*jSlX}I%;?OjVZ5x9F6HuVvx>IEA@+_o zruFLw0^lqs<{7~!RE_vmok&hkYVYtPN?i)_k~i)PB!+**zeQw2p!Wy7j;U%SvFN^l z_Sl~0)Y|{imOza0m$DQ;z_!fTSeP;I(SUXIS7JX?tlgI%3xrgi7&_m}jJZ1ku{Fpy z_#UWv>yHDy`*7`-5gQi!VKiX=c`VF+*G1g0&fs6f$F1jzEKgMH~5f=K< zmcZfHam?k!hOPhg1A$O%EUaeUqk;8Df5l-Q4%1(LEU-a!lNx4gI+y-UuJn+B7cnvk2EhF`tN_Luho-1_VWCO0)==Yg8O(-Z4Y+)ks- zNg93QkxZME=VfiD(U+1m`kxtj{0`1F@tX4dMb*R5^bHw;>tT2fyPL=pB3}h4TC6#n zn0|SYvY1M10t6S2mNq3W(x3^$zXGrV!ymBNy};QIs7nSbfOf28UKNpF{aR9Y7|AlH zk>qz9gvfkY+U@s-h^`t*)G;>}x5mvIAQJXM1a)9-qLI{E%wfN360OKc!qbj+)OR#- zE&y$=vX<~D>Un;(j+6<1c-a(#-_=-bByImcj$wxbs^&|>*GXjfIDpj7d>e_6kJ~b(4(5{B~x%mU96 zc1A(f(AEl(^@hpzGR`vp7jJWqI1f0OahDbHIn^*pVkhT;L&eZF=rWQTEbWHjHSto_ z$^QL-c;gc6(sQNnXw$Rufg(`@F=cP zw(iRL8ZA?~FT~I8^r`1-vQn(ctH-X%ItNraa7|vM=`|_VqrJcQ|Myzlo3R!pm`0?S zn`kY;c&RxIP(WPc6>cSxHHbddAh7dHhK zYkGqs3BRJaU+s(~c5HHN+&u%AKR~0O*z-EZ>koI(sF^i9CuZN1CeC@B z>)`uC|8BPzo1Drk4T@KLY;e6n+l>wt&Y|`1yTL z-xBaYr0{e2H|`VhKY2Wc^tT=9xQ8Phe2>n+GUCoSoOA#APf#>wE$($T&5-$8?ER9p znD9Rk(7v;`*uKTi1qoz zN&bBDBwwFzWSqI`eV9gjk~F#^I#wqu&)*WLSNAqc!)9C=HRJMVYrGm94gJd4^DUbv zLhwi->}S3>hd=4mLS&+dMUk8<**`R7@js2j5*$T&uTS(R@m&V)!(@Ek>1XFvivWsX z^kaU1gKCmn0g8;5ejJE>zNeX;F;gL^eWxn`7kT=nY|++4fAUBc>_@x|A6Nmm)1TD5 z-1lDQtz-WqVfpG(;x6WWm^y_&9cqYdVEW+_GF9U+{tuBQ?C$Wx8UCxO9)Hr#%VKvx zarkt#j!4cB(Y?z^jx$XB><-Tm8T5vTzc|FonF>@fJ=9yz?iz(|}-ClrTt2iShi94V0Tcf^T!|skV3A;niThGqV zu>U%ELj=^N1iVX`+$wbd`+u?Qyqh?+I1#J?-F)q)UWdW$iY@CpaU!@gJs=e z#B(eEH!1dSr#GD1+jxai7s_rMzoym^cK*Y;j@`?O>ocrI13RzX%l2{IYfEd{nGDpc z&OE{R?cO{HZYY4N!Hj*kOA&$vA;Gy8icv(?~ger8e!FSm_9?+zq}9&dJo zo77-AZ~A;hAwbdKG9_PAH8KyNNSXIQpzMu3&De(-IS|yJ+z{wH!}r5CXF(A8uw>l! z>;?x^v3IXdbg%;Q{M(+@ylxhoTIO|=EayxD^1Xq?_xPDvNu5gIl1KphxP6|j>g0&( zW--SO=T*e7P9uI#Ihn4yiR9FY?ww9@oMpt1Hb2_2UY+=hbyjXYn}=9;8Ue4HT#D-s z`@(zyR)Ku;ZO{IdQWw%^F+h_|BgJ_`nobkT$bL#)a_=GLgT=X6oe`rO6aW5vjm^a} zc3+5&PwzAq7tQCQP5{T{oyz87b!skN&v_-Ai#pLgI?+7kY%XSbrV?;oO?2;6vXfGm zHY!a<`uKy_d#@KmnY2g2mc$9Mg#2!tWsFICPG~0r?zFUMMr>N89}OF+U%RFy{wMW4dC#dml)j`%pI1=oEk=)Pp{KmzVv+MH&O!2eyE*c6zNC`0{Q${Xx44$16)8qzftD)Lt=@YVrr zBj!7T{dYnW`(K}A1ztZuqdl_OgmzSq+}Nba_*~d@xHvt&t>ee{r=F741Pb2WLZhwg zj0V#M;ycWWlmQgk@ zycD_)@w?0!j>dn`mm{JtQlXfi;ttf0DRnL0tTe5h1VIg8LFpCHh57)_gI5mN^YzBm z-E@xBJg|HSJMo~n_a&dty|tUh=KtkE9t)VlQ!4DKEg5&)mBxI>Z9HNQuh=v;|Mw4y zJDf#K$j}yXKOv?|W4^y_5qG`ee7GX!duvO2zJ52ePh~M*Z6@xrnD40vX>>@esarSE zDB`pG|565?uWd@lH6pERHl^F#@nFWi+4(VF_k(F$VY}UTSIjq5#@l)5!Swm^S(|wN z`Hg`Y_IF(^L*AkLY1EXVDxnlrEXVoj;$u&I#quS-67%Vzee5UNAp1(7%SEY+%{Ald z2)lOxV!p|r(r7!Su1W_~;#|M<0RQJLzF&rTm7(<^$vu#9PJ{8QR~WzgH%eK%!>GfFHqPBEY^&0kuQro* zg)!f^GH7$_gW}x&6=~Yt^k6!6K5;M4N4l-LpGGZ|Ic3I(A;ER_nzQfV{q~mhH+i85 zy6pRU?o@Ej7v|wRj*rD0fzzu8;@C zx52q8?k&GOBmc>J(|o)7etu3SG0PZ%Q6`(dlK6@-GMIxhiOXX{O7jq#m+M>7bm+kG zxOhLXzpsyrZ(@GLe9L#=3C3HQjNWvD`6t-fQ+6*!DrV}1l$`m>DRK9AUd-n?MWe`n zdI1=(FF!@2=0#d{M%+z-u)X*Vl61~T|DgR98SO9oU$mc>(Y`vaea9&p)h^Pia~bV# z=IvkikvMB_47bKL37(!OY|vJaGS1ttiQE6qV>Yn3>!^OXHC_si(>noz>nRN~f1Da( zXPEmOP-VWlCJv6_U$Of(L0VvHv2F8**TmZ#Q1!J}*TmmdhJQ5`tiWz?Ebwc;-IfLN zD`*RUs6g;JfU^w%K{H8%2_(}>YhTB}J=Ij;o@&>m_yc)+yJ{24@SF^qmCSGXZoD38cDt+gx61IG44Rc>fxG}|_9~}Y zQwGf{=whQGp+Haua}m;v(d!PWg40VXfbthg;OK@D6QBZZt~YIZwUpK(UCi5|03i3; zgiWuO(pr4?-wp+S$h~%u(~GqkKQd*;2$r+&6-T_=-eGgT^874gBtahx z{687`EYjz*>x>agUe^6@H!ggtSAL@Vv(FpjC|gEuT=>-Rvh03r^SO4RdzHp~Ovk$- z<|FMis*TbrTaTDkNLm!lC~NBr!|mzv z*NryDM-*vbSb>4hhNMM9%B2G*l*0h4=@e^NQ+Dv#{7r36yVS(_J6dr$)GgoKU&kN59cp3 zv;|KhuL#L-=t8Q^X=F^BE#DPwYP`)eKMUw$PwRizro!92Ln_dRrA0=OdM&QEbeqCH z%(HxhE@Oo44d(mVzZA96#<)J*81IvT&AD~=(J07JnVLVspS`@D$=`vGM1K$$B+`B2 z@`Brrtuh?K?_vLw6etaXF}YwD-BbWqmtL!bBMzp%_oDeia5}kl_=gcI)B;rGBfW(TNnINFpRu0qFK71}` z5*`8(OMq62)Eoqr8mbvc9Yqa;ijb+TRD+sZEyF_<3tCKU^?F-72`Ch>Mi8A~Cj0kV zd+(E(MD4wwdq1z=_pfvI!`Wv)uD#aYYrPluueV+eG2c3gbrAj|rIGHV5VmxaB=$r2 zWy<~RB#Jr4ZTBVOS-_w4A2b4LozO?;`|rG7^&?f>cSu)?e@#sP>pg*2dz4bQC9rBT z?MFPTfXU~`zwo}0%DZtdSLAXw&tL+P*?F5>A9q4fX8wd^e%Ap|Q35bqUiSO^#zFfv zPa50xruIQ>SN!IB+sEdO-+T$5>P_E#iRnJ6+*Xa*tcmfoeK8+kZT1b(!IzHwF5lL% zXXV`_%DXXL-f4mPdXiH2aC{G>g`7{jHhfl*VvNUw_|)g_9qMD_fsOpm;mY+x znwoiM=7it0BJWfJziCa~{(PH5(5mB#lbuN+ovTSM>%#Uvn_SlQzT${2y7s1L{nv0? zfq)FbJ7H1l$BJB@$d=oB;OSP}tG3Ee?~x(MY}@jzsmHtdSpl{MdEEutR)xBEt8S;x;+4u7PveSA5zs>Ba?&alh8EYEDNb6oFvF{VrQn;tUntCkH zntD6s{&~6;Ih@!pFjpN8^=J)vAp=ywPT<7X8FA| zg8N3?y`G&3-6)H?>OvAvW&hjhQVznGoZ+xh5K(kaXfF6;ZuuBSh5&KYseuC4km zFaKuu+;|=qP@|B_GPmt<|mM^jLGkvKQfMwYC#*kdr6&3pm_SMQB zY0mo_n4CJ~-=++?nf}kB!ZwuQFDQlO*pCN)&inTy^UoA$v+tAFO6mIHe`;UUH|emb z)r6;84{Z=MJ(?jGotPjm&CyLF=tlWjMJhjeg|aly&20!Y zze&D!hDJu{Cd027p@+z^nUy(@wo@d{v7ea8Z@L8fs+@CS@Kc7Djpnk)J5Y*qeYtYZHng>B^>BB}`_%UwF z<9oqg37S1HI_!Lc*_AZQJNXl$qr;^+iwq(zjXJ{o7UvFa&%xZG?Wr4? z(H=8D?2L={9I)FnDm-2bEZv~i5w&a~89!1_sX6ocyPEOtNWb%E4argigZ0O@+jY*$ zXiL_=Xp1_!hRCiufhD_`VcGgB>jK8|a|ByU3R0`0%u`lE+!rp7K6M_!a zt{4%Vi`N5{|Db`Jt8pxK_wGPl=i#`)mv72k^S zc5+*-W_$dd$?DV>&1>0L%j_6*HSOPv`KEvlj)#o&(zS$W!oQGN86t6;#`l{j-cn7-z=*p5q4zF61O93X0}je zAtG@*vSx1E6e7~dj4-CVhNTw{OXqfE&3-jRl(FeFq!o%L!c|K+{sP98+V);t|4U}J zI=Bu)WFF=8*z}v^^ayCtb4&v2VrJj`5HNQrV z_hQ+ap!FUytL#z&S|+V8Bk%U&JoXSh=TcInX@b`K1g$S8KHS@S+lSG557DIYL`Hr* z!D;23D;L<_9Q+=>+5odw&z6d(DrN?nbDqIRbgjBwC9-Jo+_mEmu*meL@gVSwEiVE zrC7^&{Ce1VT9nZ%@*KH3{A6aHWmkut zAB#Lmk;ip4^VyBG9$cIj+5U2o-lu83#^#?{aJ_$=0~lwWc*IEDpVrrRGCh&c&v)5Z!u0WVwS=u5 z&8IP&K{)cej6I;7U>iKDM$Af&z^ENhidX4pm<>1btgdUBeZ?UC7kum>{dWzg{~EJ_ z;Pn4;0!5d8j{Zx)?F+t${_jEhFL36WANzhj&N-mJ^lCP6-1({Njl>^zbK92hS_XXk z$>pnO9usiw2T}FJeZ4)GH-A-&Y^o=4;2-{8fKMxua!H)!v+Y?A@^?pUr?m6J^SwoJP=nc1%38upMml+$w4 zuaW0R;y$4fP|KJt)o&?vKQj{di82C} zgcjU?fW0Y%IWB&$ybafM)E9O>cpcm00~Mm~7x1IkY_oM`pAKykTd%XwM6Fdp!Ri$p$6?S3Q#t)G|}Z2DMB!;5hvu z!s?eHBdG7C?`2P3F?__*+|hx}(;*clgP9I*SlH2g$n9;+nm zJSg%Uw#)H`AI^{ylnmVUFOn6QT{z=sYlrL~g;MY2dydh_o#*Fu*}A>BhhX}}89eu5 zr_iN9`QV7C%bWZu2^(qo?dwwT3HQ~(WC2*zis^$sTmCA(Q)`GL!QXBFppIiaZ2L%c zoER29eO=0a4~Vwda~$dk^m-;}AG0FqEu3JgY$D%)z{CT~)n3N$;-_OHkIW?pVd48CY4r97w z#?W+?hnWm8lD{)v-zDB{-oJ2IxM;=@S-|6~CuO5Uq%6lI3xzBIev|wo8(MD2F-iUC zIuaE=`){bKCm5%fEhaB~j>cc&k#^2x%F}^SH0gdFwy-XgMRaH+Iy>@Y# z;6Fa#G#=vKK{_uBIv?m_Zrb9+$UiC<-3e{Z(3G}ZvBM;-%a}~f?YyZu;qe3-D_yS+Mc%mRZBS^ zyJ4fjzMsV91wFadh(7z|a*vP;;@{b7=ssaLEaJ4>M-6N9&^Y@YpAN>CmJ)xFhsg|} zmXN*wOSypg<>UK6hFswLQn}#E_JQBwJ`m-0?mGd3=9OCw{TRo_I8CXW$p)~|h_2!? znWZ!txvtAeH2LK6>xF!vzxPW+pSNRqna$6?ve}5Y?O0xx<0WN+@7ESSXuzu?PUK5e zH5>Xf+lS;czp|Cd0@16vEMR@#GUCrYIf#W}{(Pfhl@Gi7#J4bBwM${rUj>`T(>lJ`^!6H=c#+` zfZ63)Q#>~&K~T~|Slgk7fCEM`-bk$_#ZXWmqBMxS4zopgayKih&B^?c?xG?Kr>xc#30o;h;Fh9;PN`e}$dr-7k*yYp_%!f1xKBGab z7xufubt_R^CfUa9r7WYiXfe5=Y(ANw%}D8GOBmji?5ibNx=AF4EjFKAsVyQ72L#n) zaD~MCc8lh2I#Dq|zBFj^kt! z%!~hq%6fu%Pdgwu8}sQVnSi{Bua=GJIJJgsuUtsR>n7Qzo6Ob%c`D@paK5a_f`%K) zmXI5A>d6hG7n2*R`1z|xh9LIY`92yMDf&-J@p)%qA9vHp1tNYk*56~2dvSi}EGC|! zdU6k?ZmiF7O5N&clgu8?+kpS;?xVqfQ0g9;a|>BJdI?#>@13t$EqG|=3o&Co_9)Wq z07&H}Nwdqo*Q;3*D4z!orb{rc-|V7|*PYTN2!=o^_efA-^VvAZGX1GFf}f_;s5`zpSlYG^09wLWX$RAJnpaU?-^yu zr??N<;p?onn?{f?xhhF3Iw^H`W_)w*B#m??};=m^^!b* z!p9gr(unTY$ghUbBQLY7@)VT|+bkc!d`OQ%5|=4Fx`+I$Hrn<>xVM*;d5OcNk#0e^ z))$qN2~YW7LYW4N%8BADC0V*gB(;R`NLOkTNGZ}R2joe-4RbucvcWp}Dt%;Dk#CS@ zJ(!@8x3k4L+m+nTR$?}_9!9qkjBatiz|t=NOQ!5)xSK40Q8|IiOIco|TbE)!U1M~s z)>kU%Rtec&Ii8HyHL^|T{w;A|NB#uI2kA&zSs5wI!TrCSlvVNbK&AuZ*T}5%NVj-D zBi+Yww)`4dl0dq};}<26ZfSyUl@m|VrQ}IU-B=$^w={C;Xx@fQx+UdIB%Y!&@-V(T zAnzec-HPoGvNuh)LTrx9jGvnZGPC=d2GDRUd+V63YpRzdGW0Np(<#i)Y?=WYqJmD@ z>9yynJ0@tJCF35^Fu#O(Fm?boNsdPp24;4mmqjmKdq1f z3g@Oc2JYV|b!YzX8!2Y1oH0jzVvd%var3}<6B8WlJj9Zr!#-EKUV@;ia+;2N z7}MpwMDIIUtfx*)m_B&s_S`^Y7u=WjZTkQ~yQ*`WURIvpByTE66FE(Pe!%SdBn#R{ z=pmBhx`kYyvzXJ|ztc!rmC1Oeva-d*(|0rR;MyJ;9}|^em)0+{a{;Z&Bst6U6sU{I zG!>W~)3lL%pP1%gvn~`BTafK9ry0VUJqJ!@Gus+lPgxXM`(j zi2Q;mH>ZXuFQ(I&zvMU%2kh{HVc~-_QiJcz=DRL^m+x9bhqc8xqs4jUsWAh zL8<%Gg5D|CLk}62@J~Ez6!$YbM}ZdXN7MHUBhk;(aK+SRWRiJ}f+ohZ*kWjdofM$F{u5?i+!185|bAd06;|GlpPc@;m%n zn12AK?^0&6yL33*Vnq9RTVL(vwv4iGMoO-#A%3-nwOKWJ*(GWXam>$XbJcv}sLO1_ zeB!tzBaG?GhNi1IAtJ5JXy+spvZdwW>; zufxKLVd3dK>^YW>w{dE<6C%xL676(4-Nv5PdPTY&{&-k8IU|kR>$-LDJ9RXlZ|py1 zAyQn({mwllL9lqFz?ybJga0TEO0E#``$Aj?$YnA-FkLmtQW;vlL#eyCh||vEvCy!$ zn+CyE%W!<8=9-M}((lOkz_JkZN&$EcNs8cEC(AhiVDO znVwG^j+tUEa9PfwW`r?)ks2^VdEQ6P2%&_kiQL3_heBQRjnic zF+klYBfd32-CwpxUJT>OIR#?4PvRblJoB5YA)lWSIhIC|=DWBaOBvfAHL*WxL*#0E zZ|u6GcrKV7EI;mzn*l0R-NW`qR+e8QHBQ_cJq+Xb*(|Ovlk1vDuFtuYoq>MkUECKn zu`iYpPhZiHeNkGbr!?dt)k}$1rLjE{)DYVn;}YK++0(&ofw%l8jUfN=*`IMg)QF$$ zhdyFsupbt9_Q<=R`7`HHK4E*HCiXzj;2y}@pq3Nvx0CavT9HOBbK-ueky(C?K<^Hw zqm29E`h0zL^ePBmto2TbAKqxhPw!aH^m{JiKD&!iF4sLIQT=nnJkHa8t|AS%oCGR; z%txKRve_`t^Rvpt=}ksr;*RBY;`~f&x!17f?ijpZkAKTD^gDJeS93}R@5nW1HMHLj zjY}+AZ^WM+8W+9qF2l+m7Pq09<3x_-I26{)4;WG1zF!x(kZ=FOh%Oq63mNrpHsF`T z@FQtgD+HG1eXT~~J3E$_s9sX13ZH(7M~uX(9m~}!5#IT8BObNeD(ZJ>#7Mj=;_Q6a zK58T;rSqvdqF-Ehvwn&C`9HO;I}NL5$8t}lC~NCh1MV8uCxIrzvN1J9zC`I(!>o9I zdAc8jKm3tfnXke4jiOETK0~{8$MS$(*73UybJLFHC<6vWS=NO0Mq;0c6Z!Oe*BS9^ zo*c|)pJ7Kk9x`ALuZzFZGpJ*MPn4|_`&x|XXS~n(o}{7Nl!tTj2bjLU#fY92V*(H~ z-@el@Kjmkjauv_Jh2dsg&T(EHkQZ;d$1t1txWUu+8B&gi=&y0S6a6PYH}ntF`ZgrFo4A zop0quMQNjrc;lKLpn9w|{BqyVLn>8W25tzY%{Yy(Tz~zZq)&Krnpzjv>V)d7q`iq+)pEQ>uDs@HZZP0Gx7*$ zg?$Fd))3z!pFGKZgPc{MJeb3AC(lYS$zpbz)0mCvo;BQl;xsV7J-ra0HfRs%`WcOw zkerO=9v5Y;TW8l{{}BAxP!6=LSvM4?EFdR4mBhQ7Y9Vn(2DwS>bmc>hz_UCJQVvr%zASvUFaqm)Rxq?-gGSsjaLb$O{J4g~aKr zA&$xgWIg_;()O{oknyL?r@k*lq5_+;M29&&pWSaXf?VGwLy%^}sSrRA`L)77Q@70U z+2m8v0UDeJ4eU(G=te(&L^cVJ>{ufNT#dv35fn*?_0#urmMBY>(Eo%)f(be z^%SV{Ni7?T1>D~PD`O#-FOR_$9W?DX(A#fzO^4}o5{g{D6_onxM`Axorx@-OU=V;XaTdo^j6L% zfw9_!TG33Ddv;A2%b%V~&i6mAE+7llS`ugTVG)_2@pOjehT+noVeHEiACKFw){+Sm z`Fkzqy;8iZ3kim6**CT9UXIz6;e1mUkZ~0=Q`6N29LKbh$sD_~uHnys&t!h-Fdxp- zEPZAQ%fY$6&KF|3OB$QU^O-*kEPp$tZX6q2qq9DyL1kb^C%)s{rR$_qCc`DL3>%mD zAsgGuwJTo+bIv@F>R%nf=6n4%;TKwRUCa1wru)XmQ6udByU4@FaqR**PgZaYQRWy= z;6-CpZL4KK#l%sMzrSO-bTcqqa1SWC9+*I!E{!-`6B)*J&mZ85y$3cMu*N-C`qPf( z&@asakaL~Bam1mP5@*pkvR>7QQdvrB$9gYh_~82dbj^z_z0@*wDQNz=@V>wio zkS7_=St;48jwfEGUp|3g9{;z0Y53nm9?e5MDv$H{khYH}0fxusCE5=jH7t03kk>Om zTW?q~&^_Uv;6fmGM>`NU+)}BkN57n-`M7OVfkab?l&HD>|750 zW|s#bm)Z0pk0bA7I%3x|jJG@ZdedqMj=wH+)RzTXnHkah*!I{`&LgOnVa=PODrF{Dum_YK9G2 zOKOX12;2zy`wLo({r$+}D7k?(`X=4t7#+A@I9%-BYnRh?3z+~l#NnGyq$0i+oazGN z8q41uMf1sa)g*VS^T`aghU{guZy9lEJl&%%uecuT`At# z`dY@;8<+P3EWSt3M7GZey;@J@0)AF9GLT9LJ82w4;dAd)+b1;m1f}lk$`Da1Ysns5 zo5$da-;1XNma*Sne|JA>gvPzFyyvb*jhb;N<4SByb8@lI*_hVzF};?rJPW4Q}?*{P2jS?YMUzO~LB%U@PCvO^t5j;a$#i1Bk* z63nL~pY|S?nQB!YXJbXy`mQ9k>V!cZ61eg{qgpK?3|G=Op42kgZXDMusT|LAc_b!F zc-R_!Cc`h^tDn-~Zzy$7uk;W{WhuiQbT}aIW$^^Cj8`+(XZboB8B1y8M6f!5{GJ%zLRhXEc`F|qSrhBdwfx6=YNYYYF?{d9j-on zYZvkn$QON8)lW1P>n-RRrjyl9GH0HCII=60*hMbLk*D})y3BInW++oo(lNp zlWa9a#;YOXd?Zv{qSlg92rTUt{ssb-%Q%lT67w!%`~vRp>wOJ8ek|9oFJ(Rl=92>| z*Q>|gnhJ(*|6chy4zmYg4QRpIR1{Laaw!53_)pC@!Sx=B<#DpvF`-7 zgXx5z1<5I(MHv>v^#H*Qozxv#Am>5z?+sw*P~(XPkh^X43kK2(ua=V!AkX&RJhzL< zg%a$lKE0+3%#mR!j`EA#h0R(5_;00_OwHi_gsobqX$Y7T?Y>Svr<;EEim7Ggi@vrf@$USZ3xwubA{anE3)TgU?y%HsQU*ZzzOH9!F z0Q{YaV(1&0flvB>zNid=FY^9sfqf}(_wHEEabyyg=zWO-=t~rfGTqSkq>VfB@r;zv zJ8y;;{A|2gx$sri4_~&17C)9=L$5fXt? zeN!Vi81A3O{FUgN=7EFLY#(3W%r>3UV6_Ch@1(RHz`qGVe@04jyryaW#SI||f&pI* z!<}vf`4saB1=1f)NIs`I;0=^7GzWywQtA$+=%j#JLnM{o8J=ZWQyOvfK5b~aM*J|I zl&pgMMsU>gdT~39dEgLOM_#*L^;oZ32`1f1X$AMg4_}kU<}g3QHhwd&o0t8k(e~pA z(hW#EGzZN2nAdF-(r`bko0s68g7V_o3|}-h9&k6quC%5O{7Lwi5xA?4<$T<~443%K zpJ*gHKr6cQ;tcz8!)-h~h-drV>22$7W4N-DaE?@f)d{#}^-=j3U31g3(eul?Y>bt? zGRGgrJ*kIMw_Rr5DjGSPJ-yA_zpSfA@sjK+qi+_^>mL zIkT|!L;?4Gg#8sd&+)fWt^vPEJdM2E=No9mu(%E0i2^-k(;MusCq;i@{)-yZ*iTpA z#%LAm_m3!bs~(f!7-RTsw*Q&y-sEd@#l>5=Psy|G;A zD}eFD_OH~PYfTNU<~U!x?HXylgVU>34Ky-E>{r~6(t$yo??r=c*T|+j()8rBpNO{S z+HKc(+i{&|OJB=Mw|$H$PatZJk08IKmTA20f+pQ{8_r$U?m3MzG!(RN9%GW6d>iAR zx7}yAo#%OC^O#Qu+dhF{+pBQxCRcXNOXfAaCP8rCVOPUp34)=!EyDxyYz3@M0kAr2 zwY^)4q2#1gx_65Q^i6({4kZfKjcWrjN#WPirp*@Sv+FK# zp7{VIpGzpt*bd71Rlm>~a}Lnwn2+Ehlj*>%S9rchDaQvNUjDK_ao-f{llrEFd+V4U z?2C#E=VG6fBrlxP*e^9KRv>7%+x&zEr+s{3!z>Ac7{)$qW3)F!-VnY}J`(=$U!&BG zdAje}I_B^F#SMvjwvNI1j(PN42oA5y5B@~mvILW)g(o^0Z}lMU45)lR@+9?5rQm1^ zefzb}$0ca?D9JNxL26Q5cMxy?%FQ~|5bwkrH+c>(?OG4=p_=%V@OoI(dR?K^bp2R8 z^;oH%x~Wi4ts5CAu1U^FJu%VtRX3kZcW}A)i7WNgLLWbK(p5bbs9Z=))g;&XYDt}H zl0{LoSl9Fv#w}6n$Uf#De=)hfNKY+R7ZXtHNLkr39_P|iwd!JW{YWgkj@0@Vv$NU# zl{I9cua2x^a^n(qF1%m(wwvxVneI}FuvykN&MywZ!q$KqBHrZ6uIkdfIewo>8k5kF zBSUaM^0=;BnVhcwllwYeMyZ?m4nz6p9DQzhA7}rG`|evO!I6-8dDuLBUCQg=ZNh!s zA$;R_Ro*}AiW<8X2)|&Kt~CXGwWMUEo*K7mK@xfYXgf6NK9ik+l|W#rcTi^dzw_T$ zQ+Vjb1W5Mg@}aR&tV$}kCB zmy=7l-i(3qB`O3%$OrZAFdA|FQ5uBA9>xPnG6ZW^70<HPh?&x{y|R zhzd~1@+9`K@9TK|>n(tw?(?K&a@XYq5>K-{CZ)ksl)6p)&H-~!e&w`FBRFppilhA5 zA+*aw4y5R0$#prqXTWcjkvv};<$D|cXXfjiUe&IGeAa*0xaLZ|d-5AWVtUx-0y$4< z{yp;#EeSl$5>Rp<8~uV&19I+kEhm4Q1iJz^&+YO+Rk#)$vrU*lt~vuDr>b50CSBK>BsIkDOL6ZgSyh|F zwHNR$B<732d|XMx{8}}Mx!A_|n7unceT_fQzsBz=)@AyP%!L%n703s^_cLyL!tfS< zMkA8nB>4k0@~bs8!ZAbl4?S~P0pUD=7W;f9Gk)cl#J`mhKLHlD76Ww9>}+Ny)FUv< z=LyX6ELhmO5BZQUz$~ZPSxkO;FS)X-M}kRv53lU)Csu)fIyH$H((QYvEErGrehF4O&CX&n zUAGLA_TB8B8<3Ne`8Y{9PGjC%_1&&N$S|qrX7^mLoSf_hq`l7BJ=(r8ICdjc2zo_( z*NSoY3P7R90doSYiszojal9GwYa!=rNaMGQczo{>80Y`w<1vt_)6V%b4Ju8^c zf{Mg6z0cjhtZQs?S=U*BibrIqXq3m+pHv`N2$pgCwKqL`Ge99fi^&e_%A(fW_vo7> zh)*?@r&}LgITV}yGewG>7uf8N@H0pD9Vm-htHgJj@^tI{;yX>?vyV+kbG9l4^*3Gs z!5-z3*!#-p*fC{HtXmlqdrv7S_d?>#cu1VVI#ol~Aq^ad_Q2Tsr6wJnUL6rIa$))=Pr}P{Mex}H=^NJKhIqaz<4Hf_t zW|pT&$>-(%#x9AiO{EFTZdqMCce}vi&%|XvPpSJ7usX+p)p_3vBrZ%tOvMD=rFXmXkGgojw7jFVg#_?u-QXHRp(NFkX+I>gf+?Lgl zzejenIsdUzIQvZ*I?kP@6^Yy#q7GSYwW5tHvS1Fj5!?D(O5HdP&x$>4-vz>lYPK~s zk*D`%`cJJ>>~lPRrbwsx>p_O#*&nmB#=-cer8L5^bFHaGEBN`E1p-euJ3dueNh5>u z+|r@nCVosKABlT{PsO>?UQs9Ji!0Zfde*J?nS*OVs^2L?u<#lvNXV-uCkn)wq&s~k zX_s%GJ=QLzk*M&MwNtYFFj-Tvo_}4z@p^H6a%}jQ2hST4dDheq_&MufecOM`&uE_c zafVNzy!g}`mhy5ehI4xP;Mr-B7~fw=tS_6{nW#9c-}YnvO+`PQoX8D`ag*By&vpR@ z%lS7^&Qk;QbLCvR)V^Cu=I}BEQSx zl7n#$iQ9=V-*7K&HMos1|L+X|g^3rp=6@#ch=#U9WA|M?T^l^V#@oT-UKoty?WoLXhc@`%t25fs zy)MKsjUc*qOZV*@-w2MZ-I51T_+@G3{~~QVKw)uzUc+TF z3iI>A>mac@>_vY5MgL3EgVHGWT~gw8xKbGmNAo^khfHkWvkH`dOz&Yfpsy)ntqC8` zN0)P4^N?IPdm0qhe?uCY{+}ZKae9A#NLF$&kLO6sm;}AY@Brk>V09j)$2l}|6|7Z6%rlk(j$a%JZ@O+zI=h)_-h`4hHX{2AAM`Js&jhVg|u>EHhDR!;^`cAlc zpAP8*1%i(iv>5vi?pTiDgQ6cKDcui{!|#qa$dEE+NFg6$_Xm`j%%_pvA4^`R5le;? z3;Rv-+CdsQo7S1)_D+>1sgogv+tL z;UJAfvv_|p+ccHo4+KpKCSjS#3#ZRBHST3+TQhl|y@c;O4$=t9o!-^=8nC8#ZcX0K<@k>}2Lx-@JY-05FWD#aI8|n6 z1-pE==&3kBh0j;V%6s4-x3_Wt6slDr78gF4{>P=S)5w2P>c(%iWqL}N@LP`CR{A>s z*3P?5l!blft27DnFpph*w-Ff2>)=x$*z>zbS-pBL;&I4>u(A(Sry!&3Wf^rC@j8v1 z6lHeVb%|G}OyK$dU8KFh>|MAXNE!1>tC5flFJZra;oLb2;rhcgk|@?wICpwq!J4>ne&Csl^@7$jAzQ8-uCGw z(06Wv-naYwvaW5{-t_DqS+4hE8^%Vz`TZ6Ae%O*TWT#8?zSQlnuy))jL304|!_3z$ z$|dl0>qQMTVkybV(U0yi7~Y)>!E?amm}cbPZC+}gxT7S1h)=!bAdN5@Q^5Urn1{KK#Dp8`Vj0NmKm8hwTnr0a@!bu-X~nb)4$_DW z3tO?D75Ggn_H{z^wa$IWOnTtopsnUYXxoS7%l^(gFNC(A$k1nILElRv?g1J4tSsm= z!QWXULm&1zzTYY0fAVk8_Ke`A?6sS@K7Dd}eIjiy9-FhA(e{k>iF^{H?HTKm@n>-_ zsdNlbZB>xu!ht5Jqi*tb_EXar=21#t@JI85g6ITE+;SA8baBLH6w zy9-mROrqv2X7_85fy=}6#aRA2q84%cY@E}W&r`N|FyCvh@OsAs91~^8ovy$F$#G32 z;JOCu-LPUcA1t5q6NbIL@W zwPAI}{63-<`Pdz9y3S>T`F6dM*1c+6MI(<<8oB&BrRkH<8%bmb+ECU+IWu%E z_f5of>BdICIe9sk)$#!fzlipH@*^5CmE`1jlFOOMJFSp1XpfN9^kqUHV$c^EzuV_B zT{_=$i#dH^?FY-SebZq6hYnLWlTY_UI50RDxxPgvJ;7&O;<|Jj57WpIO5Gp4Oe3$O z3O&tZ;_Bq41ofIdy=-~0!q?xQc$2-1|2ezQwnqi=Hbn_bKXWsUN%XN}|GK)>1L zxBN|(LwOkMKfd4WQbZnDqi>qOMtaz}ChK8&jr8!gHTouxUfQ%B)2%>L)SBKDSfg($ zWo1ZBwXUp(0hA_NH|>NX$4)6q49DiA01!eN+a7L`&Tbl+`UBt=da=wcW=qmw|j!#-)Z}pJDMA4!?C}ye_7XEPIzMv zI8L>Vf*{S7Pa!RQT!P)hea0o|hn@2PSb7Pi?V0I4uTXcK-ru=Zf>X1oEvJtf9Mio& zN}sn)>|fS}ZP~b2dgFq4Ls#NJd~+7~pScBK@@tOQHox5O?@G{nI=kabx;9GC6qlhF zZuW)$&~J9-L9%mW%HIX6LaQWrp%bog&E38R9>)H~=Q!)SL)+KroA5oMWW`wgs(D@A ziZiy6(g;3JC=mNO_NN4g5=wRqnhUF_@b#^Nk#KM&MUXA@zkz$yJ@%X=K03SKv#HJ4=IAj4F>QM?}N0kd>;JSZH zw;~-{M`^_8f;Xm(gpXzkpNiT2-{?{+4sPakQDb$KMt=R{f9sNemi_RrS)HXrk2&Q- zet`CX1KyA%si_C#L&cz;`iH{K_ul{~gpVrOF%Q76YC&$&`y0Dz6?Qfl22h&(XaKr#C#>c-G9~tvsb5qwgc)AtW`|EX_9;~9& zeO!@a2}OzBhjiWvzdc%U&la{asQ?_n74vwbx{yVZ(<^N9By5R7CEo*)I6_gwN zO93EXI-J(+{W3mb*8h@Ez@aOq;EO$7Ma01w#-Hbd!T;}^S(y3m)UpF(JK*VFY zCx`I?>KE_<2kkNsRHsgfJ^qwkUc5SWTEv~s*!LHUegBV{eOC+NM_)zSt*5Z>JVW}9 zpS$^gwyD$JPdxoQ&J^@Fc0p3#gkyCg4^q%?b}>65luNR9cH-V^+bZE0;$96^%y$>N zS4!(ZiU0Ua^3``~L~@x-F97ABy%#lgO6PZ+8N}E2nZzgZNZ3zBylvgz;^#KJ{-5&&S1wEQ1vL`%4(AJc zmwqu{U2e%%^xpWK3Q9}fBLS)Nf8qqu)2MM5;+2?3uO~P!{`ac{z>p@vJ#~)%m zdf8X%2>#EkT1-Y%E+OEWPe!_KVRlVe_bWXnxvc6I;*j|o_n2}R;t-a>V*18Vw3vA7 zYWh7zi@B{qT}^*LgRsX}L*_-Lk0eTic>-H)@Y|96TP?@r-{yoezkP#!tHE#a+Y5_A z#Po;A@86-3B9BQfRBt6uaNqFF+j4FpuwGByki+p&Z^*fo+%USHyk54196LuNujiN~ zo@0`Al)8PG*Kd+JhiL@m2|rkdT2@D(?`DQ=2qX87v1v3w4FUBQM$3@SATMgl94jd* zb9=f>{J8C}rt#x)4$ug;3wfs-{2}sde~5s3E4eUQoqBz=$@D8TapXP{;m`JS9J!Cg zzGJWP>Bz(AH5v9UJbv|$xsA^Bl|$FQefMPB2QWEj@J>u(XE%G+j<_yiVK+4PVnM?#P?FncWwr?|gVUX3e^!)K;iKbIU&~!uH*F z0a%?Efn|JJtF*lhma%uqiptyWD7wTiK}A9-j5*dqO9G%>g2F>9vLNiy-Ws!8mdYE) zz(?B#DD%@Ay+hw@-+$X@QI9LoD=W|(N*0C#rz^r1z$7zS7@h`Dh3Sq$lqIs}POqC^ zSy~8{OvhM(_Tl&v66jUkGE{V~g%;!;H3`~7OU%k?FY+^$DAvsZZ`3RaRnB`6m=3ck zLsKRWMdK2!lHEfpQjGZwRp1DyYM9YA@&55JY>NcI?g9mltQet&6G}lWvplR5s~e>i zPlW=o)b}R?$snhg3J11GAZw83J1FrZx zwq6~!dw86!SNyNisG_`)x?O5ZRpWe++dgLJc1qhh#S#0o*3tHCvQ(9$+S1yXZylisVbK~Uj8unfK$yPiRnA;A>;R$}cX2hVN%@`To;P zuhi-kI@F!Wr%ZN0`)II?O8^QB71-7C432AI>@U2pcCC0OkNGFQNP%6upUDfquUr&M zC>O=v5&eg4Dg-FpyChUO?F2NG7U`?IKc&H_79Zo!wu~y~SN!7GpBtei`YCO{*a6|V ztXGW#%Se1iCyoA;PI@y%cW3?^`|X-f=_LFA&oO%NtF~i`62m!%bfHI)V%eF zk`y)mxgA>KxMzG_?;(mU=1tMlO<(2~frjQ@jqzomCP_&BtT0Vu@pektNMi}Je9LKwd( zf0B*mN8gYj*j*qYFJmN>g7V5q&=SP*r{S7_4*Ukk2%mR84lRu`G%P(&gILF?3>}GT zzIJwQ#x@tmkSD^q@`Dy=VYWiTuSV+jKQo$&?dE5wziDGMVAqteO^Zu6F?+doo9^zF zp`v>ogpF@Q3-$}r@a}bT80q*oz6~vL2_|*pKj!Lv(*RESu`O=BFY#R-Mj02!=cPty z;dH%I&~>X5=jgg8pyj;S54I`LT>L}$Xi)Zxk}xnmHofmE(EH{}u=~QzG=e-6_KOTq zc$KPG4c{{wWo}D;l|yIe`5qm@z3d-Pv<<&UNgRbR&adyO&~lXoyFb}PBYS0DK7f^P z-~FU+|0^r|+^5bku8$lG$FAViodY!3&DKm|Y)&Jz*qFSTd;pd|4ICe#Ecfmv8o3Cp z{B5EQOkYO1sGR?U@8@>i*!{;@2!Cxew5$Nwjl4rHKq1cY1RrPPS5banqDjfguWUkD zMeitfK|^AI1{2fxyzp*@miH-jx9roJR_xObeIV#VrVoAONnTK(*{w*Tf0UTbx8Pph zR|0)~iX6N8arVDh;y%420m;eTiaUnu|Mx$HmZ&2+r2zR^ocD@5HtIV#AKkIDf=2BA zA+%U>atij}#flVup%K#|c2v2T(Ht*Woptk|#gw2O<8VDEl+iH{Se-TVu)hmWtpx~n zD;LLf$ugd-g_Z&dDj24vB83O_0!y$j|FH8b-{Bbg!{d3oJ2K{i9NVlw?~3xVxI!#pIr)lmIA$SdS+ip);mG~6%yzj-2fHE039qXF|!Zf*?ufTM~$p^%!ASO ze^em2?VXzBS_RrQ(5s5uIR>;P^Y^{@j^7`i*%xrYs2Uk?&G%`-cjgdX$4k@qcA7)4 zO5p$7IUlB}dQ}u)l3fPQU7Yg|DA4H*XlUk#`dCTinO?wHnONw6gnA0+*Jp~P=uE6T3 z1i`He)PL|52(DdiCbxYB+P$Dx&1(l{f9`SURUu&h|HGdkzbr$?It6-b56|p-Ue-Gr z0s6i^657|kb6e70AKP*vi1T|~E>!5be2!yTURAH!Hv%eTMX!3&X&F8Tgy%g44bxpS zR`Q@uJ=^1eIi+j# z&1+xxG&O>|KGy}oDT+Jyd71Aq!*!-@eQE4l{TvPUC`GYuMsLTKcMQ1cg*;z9`Kf?m}qJC2UQh$0q7K^^Jpy6f}!mPh!=shb# zFGMTDEA~wZuaK=R38g6J6@AFtRKWJ983Qze|3(=N=isl|nsUbG0o1<+5Og{qJYum~ zxp?t{%6U>wy+&yeNS-Pkuj0qC0!(0&gZL>G#_698n;TkX_@~IzlY9_ox{P^kM!Tt7?+>to9}Y4tOKUd4c@f*i)}M zuE^zyk0=|f$&|XCU>QdTs2lnD?g4)0yK|J)iE=X2@mHjB>HkOA+sDOK-TCA1d(JQ* zU;@Ly5Q5GOq&6A-uGR1~CjK~q_|T25W^&uQ)|LUH%?4XLqE!+M7n0W0X=`pWc5Kou zB+*sw*4?y1mvQZeB-UE#?j}U-w)@}=BtD^SNI)K!$Q6i@80_(E8e@%=ADf>zn3`XYD1hk0)6xa=p)x6A@Go2g;)~P)yZqMgxGIC>rU568M6I4nkyYU z_#B;s+bC6Ze>>YXx=`sI6@3=K9EIi@y&4HF`u1AuD%$_)DFIt+Y&}9}dG4#hG@M5% z0w)S^L5JyXC%sFcg?K%kK2eXh6StskWHC&kJIXUS98f<1)V&lHwGKp>1M2h>mfT+m zxNCC}>Ev7;*$REH><4ZCv4h8x%5-(Iez47(g@~+aDDW(24!_Q{c;G+Ixl)WAe)msV`Xab4KqJCB`(R0kg%~ zo1ob7BE^ni`Sto;^m_f=3Yg~zPHp~mP_NB{IYNsJP8N+R4k6!{7(#zYeFd>IlJ*rD z*L(pnnHNNhjFn$NOq16I#wtY%{bDm>g9QD8F8X5@zZ|^_v8_+=_$r45f3c5dH`fW8 zV4PW3-#hu`)xA^AH}#q=H}{@f!A!oDNV`&s76+s~;fsikSoGBRK|5kXCrfT-Kkp_O zdzC=#*$F+l5N1yo^kfdqWGm5=nJ|;hL{Czf@2n&G+x0|0xt!=H%85Q&K=ctx^b}oe zh(0IQ|7m%nUcoom^|x`Jinjff?;YKid1aEO+Kb2gwEre;%di6Urq7} zEg^s7_HVcSE8ZiB_6T|vwXdBple_HeY?#SCTB4O8`oaR3vTh)>&_0SCLg%jYU9bDY z*XdCk@9Ln1=F{5=X&cstC+@P~-n4-A3i`9YXjQL(`Mp=JUgi(qpuce^VrciSn~zsM z8=sNO%>Q{5?%B=HUqlxts6*05i!KUWarB<0iebsGByepzV$&2xj{|*04jc<_{8o+k zB}CpNPwnO%IlbqO%)#_`6jf*LKnxkEa6Dnt`3gk*c~GAe`{K*YoS>KWCL5TUTn96j zh5kV&@;NPBCUAy7fkaQ%oXy*pEA*<1ZQebZVh<@&zA1t>{1)e)oV9{>PglM31N)m< zmOPUl*T3I^n0Ag=PC^Ui3EF*xC6McOdGlB#Ord(0vWQ=S+Mm{)=RYUbbKiNcRtg^c zWoG`)Tv*j-@;=SUOj!d^fvQ~Kc}n2pvfgpI7MwhK`VD9yL4*2TTFHl;d*;JKD`AO4 zPUH(2Dft8v$;`rK+LbJkj3Uvq=?a&e7qPx2=Jm%XcwFemz4p9oDI&>cB$5;X418`= z*#1sC#9mz#IQ|pFlH>|k@_r;dN^!M-&uF>W7lm@qFo@3P9Xg3N%)*lY%CTJW zgv7TbXMbLn`l%ORF z`kTLhku7;x><{t&C+XwqJu*pQ_|Y|dW)or>&>#A~W$*rz%oVF0-<}JViWV9gDTwa=GLMhubqyz*%cC#nbq$;4L{C-=xnxPS1X@V&tYT=xi-lex zXq=bm$y%6FKX}QapAS2sC(B7t+xW1&=g)__D!*$u)$EV@H?&ILsO3RT_jkAG>(eBt z5l>X`^hUyhqD^ukR58ADwA5%Np6ENAd!8f((UhRCw9r`BCUCKEjODORgA1S@bYeV3 zp~|rgK<4j@vCPoL#(SK5R#5a$(L!T}78+uobdrLok1mdW<;y%?+p@CeVd9A%%*MFi z302TXYTwc>oJ<)DnJO17|uD<_0i#|Wbxkrr6dhJV-FUd*j13KQ7p_dpGBv<KQ_Y#CQar{rAI&$#e6Z(5Gx4s=$Sn(1y2g z?h!hs_?;{#`oWDWYLex3LD5gx0jYBf9C!Q#G4>Ac6aV|$EZtSms5hNB_LdVrJ4B(@ zVzI2rk(4;?i(-R?r<%}Z?DY`e+Dw(9rcA-VNmT5UThDNHGcAbjB}%l16hsd^EZ|pQ z!?VyhdKZr;mow8x&?nv#`)BAb9`|tW>2PAa*Q#lEEWIxpITx~^-a#?;SwQvWig#d0 zzZ@+zGTIQ!vTXymy65Z}tDd~X)^UmLq^_Oq678zzwG;iq%@XN+_U&$M*q5gXIp*~w z#TuU*iL~x}f+8?t)4xtZ`+SyPjS5Gqo(yK@d4J%PWLVx$JvF4uJHhzHi6Iy-Q)p zc;2mw)XS4p=}jJiE^Aa$#Sr>^Du?!tP|Y=RH4>u*j^5F&ihgo&M(+rnu5R){AIX84 zx|$`Lz|7GcW;QyetJklDzU|bbJ5Sipn!(Hy_OoxVg#OH_M|YmIpKSv(Pv$UlFQ%(% zOL5&sKs~vTna>RRqtAeuDVk{r`21%~z}||zTjfK3>S`ovfynm(wP_{vx>Jwt{2$Ie zqYIhYJXjX}FU~zne8@j>H4@!G>lkj;08XzLT{=_YVd|zo8^WV&VwZQ<*SFX+c2IwBeJjL_Z;QCAabS6bD4V zuiRIt*L`M%KKT{P=bm)3=SPny`ilgK5=|Sv>&Wt<5xU6G4*Q}){tY|u{OJ9Nv8?Ip zR)U;{Bfha@hsC$UPOQ~l3)gs;T6BXcT1b0M(v5rpkB6nN#iF%BFaEbH5lcFzf6+r& z!mC;NALvomdP@<>B2fML+OTiQ;O-s;RpNcIMq;hRI_=H0Y+>U5{5}V+M2wN?UkDh1 zWL5cnT1d!CV*N2trSJLP1wU@}NHfK zxNVR0ox8LU6*8f5%NE3v*IF{`15xW6bA8X9fjCK(Kx(<7UvyTmv?Y+h`Y2)p6gys^ z*n$1o`sqgzd!3@M^&3LQ)rJMW{pb9SE~)n_U~K6qilJn|CHq$E z6IgnvWRRe$v6K@M~(=7QY3W|=D_n) z=XqS}i;p6fY_P`Wn>V&Jy_?;9K#pf*;pM#})S-_Enp{uyk#d+L8JcTk4H6>@HP^`P zNQ~4&PkOW)Q;W45laH->e#EQYI9jgVc;eIAjVG_xZhZS%?Z$VOYd4(LARFKZre+_Y;xZ~WKZQ3@kX7gNnvo(1nvdT+2|p2m~5o`9b2-Dw=VsBXav z(Csx0h<@(92C*JYS9Lx<7Z(9;#Zg{bLo98Ng5ZBZpBvh6BVoPWL>W5*sC{?xc*hp> z&ewk$vzggRlxWNe9gj3l|HGYD4*KlopUuNhp+8%AnYO2;b}2I6Vv69X&>5zFzED4R zHOzs>5j#lQPbUcu;KwWUDVMhUArw~$oP3k>_(LSGia;B7Knn?4DtLS@;I8dKWH1Nn zQYX~f9hTkdT?f?KrHJ&1d)pBSXIuF?hc-6Xbe`vx|3bX3{@kpp2b);$iv+IzTvUa# znW=#9^gMWc+W+>O|mfl2{8A%k8e#`~1z2d(`vB8}&`y80Zi1Q7a9&ONo?RHWZu z(AnCj5ea8Ntv!XvQqlfhMBX#Gs=yKOx3gV-5TnuL{p)PITJ1Ca6QyvhMZ-uRKI()bC(Hu|EC@t~O^`-xU7^->u7nzK3%U zJHsn?*)fPhHxsxg?ssIv>=E+i{VXB$GOq)XMq-`yBV-8UaUMTGaA4c|mHOM%W1OT# zMv6L&Q6hQhf#%V z(sF&nZHNhZ!Ka{K+&>}OD}sM73Y@w{@S;TlALsG!3cZwK{G-g+?uDGk-~W=JJB0?j zUB>ZLi0jnob99bf@@#wQ+_T^%&t5IP*splq&QJC!rfm)f zuVJT|0`=DKUSw<7c`*-~iz^enCOOsd^IBl+yMTJbcX_;1(L$%?x{$ybN&{2W5tyVI z#ya?_KKFggRwZ}~>0rB>x3FC&wy<3%X`%7zV#{aRO)!qERWDj~z)M|WMcdiYg$U67 zhfBvXt6T6Bv|jK#F(1bV_2#Xm7CcW<$Ivzhj%|Yy4I|_6MmVB=WIXN%hQzl%)aS$F z#f#t}W7VcQetzOwNL%qT1uC)UcPU)b{BKhFH;5tTy^ds6<$oVBemfE;u4SgsU6Pdc zChHYFSq?J^&6Qk(L{jdvLK&YX;E`p+;T4_7-?i%G4GW#PzFo+biXrqlF=r>V;S7s@ z%k>YJYQyF2hz;l$ehHs7ChS@zVZx+N&nQ&Orc+@2?}LabV8KoWl^q0Q0yhg$Fmx~* z>^S3jHts-*D!LV4OaiZPSvRCl z%rSKa(gu8dyO@tI=QctM143T!Bue0)zH95zc8uk3w*TL;wo)KNfQO z@C6_FY?`)YUQ7c%GjE**K8f!oi@jxLPL7~k4eLCK$_kGaU`A+>MHxJ+on)_(hqji*od&i5@^G7_YJfp=u| z@(yP&@5t;;)x+!r`h2;TKdncBD(2a^vA{0 zj~no1OjkE9U}o}53zkim6FucXpWq)PQyc#4FY>tM-zqdR9!2a-y%m=&?oClE)_mo6 z1<%RQlhk8;>lVaDBt7uRxbySd5hK8kQCeWs<^4ZtS4x&E`um-TfuKUHt+vJ5XOgDc zvD&A$Blf$;csy+v7kKlUZCm<}cEtXR%bMH6GWHc(=)`u!(!P_xcIoRkMjy9+FaIuL zXEw9M3koX4x5PK)zW%h3@3i6Zt%#-lDT}uwmUxWEQ=3^r`n&D>h1(G`=EX6OETp{z zEZFdpU2E9^-A_JKH9{4ABuD8L`o~BC%n@j=Q7HIg@c5+l#bezodmk#tOCX zn2Y5QGOU2_lub8t0JlTtNeTQu*t^to@m~1)j*IExN$N11Ha$(}56C^z&UPh>wBeym zVvikqu3-oFh_)vv4a{$orpw~}!6I$=;3mY>9iKo~r7g{}Yp3V`T#*G=D<@#O%Im;& znxeT{U0TT*TCk@1u{pcgrGAbuYN}BRm$W$@UGat=UzzrUnJJ)O^doakN>PyFdqRMc z{gEA~HNm;3d?j2>K>t399d!q?_0?br4d_2XWPI{5X6t()V^QQd3hZ%+F`a6}auLnzr zKDT9}(()r6wr#fPPqsqua-#23V8PWHsC>E<1<#VW#Rf&<%-so(6t__jOm84x_)?|?48 zv%S5f;MsP%F5~i>a^7KB`wTJz2TLJs6`yjmnpYe+_6*3{r;8nd6PT`c00{=?PzR7W z#<}NhN{l~p?)iII;}&fX&LDD%bI*EfJUf3a&(lF-=XWl~wL=$j?kxLw($ig%jx&)t zcSrJ%UFw^gybyQiFs%3z$oP_TGRK0M$!eG{QuIwwYJ5aX40FGt&m2+Y+D%t8Q|LF_ zO4wN;C+$05cf6aBvF{S72N#g>TZ!dc8q7rhCZJDThbc_k7jAr_ukT2{w84FJMA6+o zZCK!y=yQ~MjINzsyHj+Lj9LAE0%wK(p+J3$l*%)A-^@ldMlh7BW@alvvzO8As2SFmlS-eovy3PU6u0;!`eDz1R6>a$;uY=h^$>w>mw1 zaT()F*Vev@$h!*EeF_fLAycm7>N^_;#QWcFFDWQ%r|b6SuF9!nSnCG~)RrRhSu5W2 z*vkqkZCF&gv(OLFq2F-s5wI8guF=VYt7rbBO2D~x29e9`_kRBEx&5cg_q3h=BKPT2 z)vejk-xTj=vtar?L0?-JKtK8ka1k(R6g=py?$FC`9em&(!h#)n82=5RHVIk}M~)o# zpd#x~%!kXncHF91HvyX-d&~kp-*#eItPXnPNJC9?9*%W(c?TL#H`H_<_71$mxu-0P zu5EY~kzPRUG@1Xuv~Iy)4*5le$(@L4^SiD=5YawG#tdb|10MnfsgAk zE#YwYpMisD^94Ibg4%LMY9Y*2GxSP6?@Y+c=JK&g7W&e(eF+AGpF_wE%~^D9hoI{jb98;{oy`LcxfmDt_A<0k zUAtp(T`|@+`3{#5$8>d>g9X>OmlWL8PSkW5*5NDDbzo+lg8q>|?QxZXj@B490)RK!*7eZ*08lBe5*Xec7*Q^ z`Lw!C+vR(?>*_WvmhH=~x%s&4BfQA!!-1fZgdv`IkVJoLiG0rwCdL@{o z|1X!YvterGlyDcu+45a7Z{`_p#mNb}&#ZbYeS87N-vv}oFm^^=J z&<6#*S%C2kvs|4nSM)c|@xDv@|E`d+W_g8xiRkYpZrMXcpMpOhBp7R+;i~9YJWszb z^M;5g8st1a|9gV=^*eE_u?RK)Yx8Is7e|TlKl7fQ`7`us?>zeColzt&xl~t4{b`TO zK4Uy0^cj4n`>wP-L&#(4Sn_lZM;@Plmany^KS>{(Zzp4mwBf&b7_mQoZ|>cCpz^e> zpRR9byV5$`1%FyQ+hymmN`23YUliXdGDP2#6ajXnHeCNOV*mL)%Z|{aOjmuh)s9np z3XvtnU)&_{CdGdeN}WIWKsQk~3ch`aXd$7~NjufYY!5Hnb{dai`Qr)$uX4Np^St_X zJXN*S&Vg8E>jpxHe0{c|DlBw$8M`KQ;!b)0UE3y2j8YQ# zOYjUY(uOl0Mr`-IcleR4kIBvHxXF|^O*g15H^Vql4RfRwiT5@maccyzcUxKFz0EA4 zDd_hqhL1cX;`b*jon=`^L0v=!j{%y@N}~woh3x z;Um;-AQSpOt+i}TAuZ)KMMJ(CUl#I(d@gGM z7T0b1+$2|nlf2JQnVFj4eItaKDe5t%%AoJ#ynm#cnGNuaT{gkhns)U5MDQBQ%uHyZ zUx5XMzICet^-}~DgP=oRTt0S9Ce&vf$PfSi(~rF4K>jQERCH44TaFT!7c}B`LLGFl z;4|*xb#{jAmx`hJombtMit9a0|@$%3aIGZio4)uOs%s zEzA_K9=n~HC$7F@*?Z-oWsIQm?JqI&kNa7ol`P14TR}yu6Zt~-j47xX&Ag>I=ESjg zo@I&mXlB6gz_I_9d5V_>1dQIJMFHLZ-;IKnjhw3o4=*3XX|BFcivlNTLEs}9)3->@ z=W)(G%)@HXQeFcG^8G;0PR>2vmhzh2oO^!%N8axdbj3QaF!COSv3hXT*+wf*NZNV2 zr)gx+tA(~5)k;oMV!TbMaWyU*T0giXnr+oXaQ!wz3w0>jV_!ed)n~zidzU>1a}E}KN31~>bfE*kgRHaR)&?+`wYk$F%CTa?UJ{Eppe&uT+jeztl6G_2H>s-3vLA} z88DQtmD4dpq>NqffG+Q6A-@)M3|jYHLbqymAb$zS&^@JWXE(~n{$ZA@b;yXmC*-ti z5c#(psPp|m6SmwlKOPskEa=T;r+tc@v-OGju$J7R6|vwXRRWzZ7M!Bg*uRDC`e6wR zZo85NrztTMpOOrx8TglOw4%DG`Vj_o0fqPs~+^i3z$zU9Pq zek%9~_Z$Wb*4a9ZkbPfqKtBxkPy^`L)tswurO&j7=6cg^-vC5LGP`%zxuL%T5*-z? z30M%e+>q{P5bhx_7TNujjJ-R{Rnbn`Niw^4i+y$+h&Gn7VE8H)q&_95kroVvmmT7dpDMr@m{&R~6WPf;nB>;-g~BglHkbOV4byVqlYAW;V=FY0K-{SXm?F zweAv(H_mbuV8NbQUYT6Z5@CWwPc~}{XQNHvODDxqe?^i0`%CI`Oi;xru*df%!Kq2A z7;l!`C}T8!M{r8WtW#IssFRk~nht_-AzP-%4|fZlaf6Cj|6yOWqXe?X+{fihYaa63 z9~9~%^I&)B?|j=yMLMt5%}hT*e?iY+o06l2TD$yv9=hI&!T8q)5o`Q=*5-$MjejKy z8vh<`eg&16+B7omuw>dKRSZE3?079BZP)nVLAV7^l(lg`bE8hcf{KEQCOdE63Al-y z)r@d1>ph5lS;u)r^-k{LTNi(#+;HKHuWFcpVvN?p3@=8XkSF%J(6{bxwrt`t&Bg9p zwJiBHBpxL0jeAR=@&F>wl|b#$v|%jy-ELNbs!e3EYkBt4Dxr6o%|vI);OXS;Fnbj2 zKu@-wJZ@iqCRi%;v``tbd_$#=JT#D` zrGa}3tyls^r>j%zh~@w5L@c?L=tQ*H>eQ7-9-2fhTpuMxS7b{S*}=^~^jGWr@{5;>(>@ToSe^YrV|Uh4)fz*pHsm zc6?#=-HIhciSd1+9JO_^l%p!44gXs39_neCq9uVkVYb=p$ zCc5BlBXn^fMT?E(3Yc%@A~r)27@XnNLT)g(T5U$DCm?N+Tb=s(Y#9#{z=G-O8y28a z>%d}njusMYm!yk~o4#TB1+|XC#qRcsJwg}nbVBzJE{}fUb{;=VVf5spZx=;HlN0%F zxTBVx({0qXvt9Sy&f}gOEp(2S7}NWmI)xU}I;!^+K??~SdW#gc^khMuTEWaPN^{Q8 z#fC{~AQ?rX9B?m&l*vOS&_W()A^tTaUbfEY8h)R1Puo7UDMSl(Q7we64Fm5jV8M5@ zSNXHiRmZ7VpV~f(;v4!-8{~pW2hoNtHTv--g0P{f?%)bFDTFDjDWNX7fLzWf4 z)UXthK>{_HiTu_kMW1p(Pex@PTubMStj}bQ(nWzcoyae4g}#|0`tO{3nwrp-B&_Y} z48+3sqD`zrc-XE9bvuuLFt5#?d2I;MhH<1}ApF-zgh!wYStB{b+Df5?*t2L$)-tmM zFdyXHvl5!?0nR<8&|Kf--18DN*Eg*A|G<5mdwvYfwNbQFG}nep;u6z5RPe!%D6w)f zn-%>>6g#9HJyRQ=KHG8Jx8`QklL`I9&-1w85x@I9kNeg*r9ULBpnqisVvTm4qxrP` zQeFT048-1{Fy5vmMn(sYt?z<9D*f$6ft1Vza~l~z%)1>CHpA63*D~{id9_f|HvQz9 zG{2$71kJc;4wf$CG^S{#t;0ABZ@aViEx;TZMH?^An&uv*O|Gd}+bl$US*tgNv!I3{ zV|5dQz0g3=*n74+CX9BXvK{5{;!4GUnpJE1?=;+r0k z@^*<4UcgL%nR`CZ7uPW=Yu;ZMAW*%Z!F7HGDsyO|!}7eS5+iwBk$9?op2stZWv}yIgX=)%;KVM| zLcieLqj6r@=w#-%zDSn&!OTVivw*_azwJ?9>~&X@bo z;%25cEOYsqt$50(D0ckrY{zljezW{pz?6FP5k)^sm4Jnt#F(H?8E>Ktp z(8XiVIidCwC3#e0$Jk0z!E|v#jOrlHkgfBYV^=g>DEY>Du8pY0+Cyu&-GLYyhV5l}1;~QY*k!J&L>R@dOSX)P_ zRnOR;i+q30mYskSo#5Q#&%;{3kLC-R!r#tzt@@mGK0?nG=+m;T@2pw?RV!kNC%d4B z{}G8t%BZfDuteA;YkMVxt_Bnid2=!ToC7kRlPyMH_#asU?njRg5=50OW;R|4vmnc& zjjROHM$3Ty;{@iQQ(pHK0OoNgOd%Kh-7MjAvz^F-{>G;8bfqGFWPh=CThBkTL@m&Q zX|DEP$xN}gdYr7yn`_lPx>d1aeZ$l~&nN?G4`FS{MLue_?Cd9yI+(W17|qX_1&EjY+}JCBqRy=@=#9+&m~O-<0BY=Ztt>-nyr zc?*~sKF#}{s$;>2yP(HzX2G_diq1Qny^~uNy_=B8dzaaM0iq43yjp1a=XiWn#&Iq( zthyf_L-0xm(T1<&Jl-*HT?Umq2Zj7g&(Ul*ZUdh@Jx5q)>ovEa9hgnm$LtY6I@ z*_MZ6mjUkdGcj&)U$ha=G@0{VEa{}!k4;3;!%fi7p6BtCVlRq$D(Fi(+4JEtqIWs8 zVL0%7s*EKR9}?jrm{$Cn$2fPJHNUwrc#I@1xiF5gOYq}4ldGFA;KyR)vDN378oO( zpAzlrPW^u}=j^5I3w2v7lLgGw$c6X}sZ*tG(c;-3xOHAn?PsjG)Jtn*C#gf$ol*ur z6?OQuP{ui{?$vF8+CdOZpC@o>K0BvNE~*7>`C^=b$uHC1sb)v7*^<$FuGQJQ2&`>n zS7z_1Cx2OOjzte^uSP`h_Z}h31MZ?c=(Q^m`7Y;bMji_m3Y>Mb;30xjw3r3`K1C;` zESRKJXLleb^a7bb6J-fUG20Zr5-K0f48ER$Dz&({$_LGLm+03Az4kstej{`jT4Z!7 z+OX);{|M2Kd`;Hs42V7zii*Por<%VC{hlkK*HsYxf<+WxVL82hQ=D_ptnXzdTSh~yfp_w$Ap|L`c6`Z?%$^9WFuk^l~{Fd?+ICRS^q_A zF3oqbVAEGw@bWtlo8sJaZnQv8)jM>7i?mZ4mUfHh6#Z9B*03~^8R$=r-Vz+7sGJ(j z(UGf#-jTSEgzXCnIbnnbJO^ZA2^;WeG3yk2SlXhNUk533++4uJsa$gJR7a zbD*BBCo-Q)$lA$PqCdSx?2D3%)}(t4kDpxu^XzDjp5EIE(?Tcf5ld#FPyBCmXrXWX zEn;DyZCUtu;K(pG6|MLdadElJd)G$NGZ=14e6iQpiXr>-oW9h2T*CO^X=bn#Nz&yaYXKFN4!rOx5q5$=2 zp-PHa|2VJcQ&?50$y$eIxte;XK;TEJkVl2s*X-n_YxtRp3> zG;1!6=fzya9-o^_5O9x({WhATr}tWnl)CV`qQ6&bH?R4j4OBXO{E9u5}TIQU!|2kVL4M|Fx8dhi~^yuRgQ$}Crt zYh>KQSkDYs1@1jaQ6cdym*~?1Cg*tNKH?c_&@leJb3#7y$hANI*Oor`SG9lu=eWV5v~fjrf7lj-y0D7sU3&?I_Dnw9Usx(PS*jP=a;?ICtLUJ z`EkU*>=klFGsUSiKWU{n)q41P{p5a2uWZ(?*PXETT9|b2zBn%Q#S1!R+Ak}|a$uo8 zMKg@FZYf}umdAx|Y1O)M7^!PvrkWMK>>im{YXU4N_#wMgR-LE+PSCqXAeMBXvdp&IC+ij6VdX1^Ud}{}DbrQB z2Khpk$`Z1sV&%RGS~DSi9#%e54{=AoMbP_;jTO@uY!&-i+nYcPE8!Yhvr6&_F%BUY zHWW*H+$rP{9eJI*!wX~`gU}gb$uL6y`jw39&_YM-SVf29lh$PU+?ufEe_>57t~YeX zu9-b)>vLkAidVw*ksWs`)+t?2I&}nX)4xU=uXj%K`;mB(pg%pA_c@QVYzwB=830Ab zX!;z0Jh3Mh1ybC~)wZDxA<#n*_k?F*_ni1<5N%}@bXp8 zJ>uJ<|M9OO)^mM8IgKQa)dJ&<6i5C4eT(UX zw)@f?Egz9O<*C-6FVrV!ficc4o615Uc0$%fcN-(NUFs0QQ6W$I-PL-S;uN6hXII1h zI>Avf@7P~g$@=z+18XJz|CIb+KAg2_AI>XL?m^a|6|>{8e%n54*@MZvI)D>4PAf{! z1NM0g^1SRt3uRpcSvPBP4HA>1(3LV>*2Qv+@%YkAA!i{FwsT%OmFcQ0Hrp{aw^{i@ zhcH(oX)fOO6}uLSRa;-k4f+PerazuTZ}>DT?x!kj)v-_ep31UVTaB9~8W$Z*F^?SUR4NwPOpAAG=}8&NqoW`Vr@zSP|BC*CBFS7St(P+yW0= zQ$=u{rS5=db^NaXazXzw)j|)yRvk^2utZxnGX?EyBy5?`@%JlG3m@^W6MLiIiF_#9 zaKB62-AOIn-MdBElmA&BXHN7z8&kne@XVGI9Q?< z#Vuh#^|d@Sa7^Hkj|FStZjtp*X^D}diw*J3BkK`Mp68YSm;YSoch(vivi^gNCo8b( zGn^^6a?`{b&2B=Blw10o;JE^28kU$Ayz*LRPSK*k zgcExIRnXme?&zC9W%7^h#~*fiq8%H31KbHy@Ts1kHw*~81hs1NxiewD>BQRNdg%QR zK;L)$S8E1tEFU{BN+&qIR zH~+mt%b)%}D8n+LJBV~G_}J|K zdqmJrhn<6&VaEwO?Ha6^z3DUSWz8G{^*|es`*W=tUt+I)0dQZH%Yx!tpUPrE@x3Ju z78LSzIan}7Jpt!!0>3;h^_M~IY2)!uYMntU^g}T&S!*Ea(0|&D*hD$e*DqkfjoB>N z>}0{eB`o;$G8X*WRV;X42@BqPB@4E=Sn!@A7TjB;N5|p7U-25@M{c_;Pce@#W-f^JV8W`!36o{^uF0 zcjjute^`Uq9|(?`)NS1LJBK{O;tRH4*+*H>=S1bf1&Dm8Kt(3msCE_cZDs)Q`*a;L{A+9^;w9JsDgfvRP99B*{8V8aIABVi|WKy!3|Gb2s-T5L|6&eeUaKg?H}!o^SaG=<)<06-p0#fOMqkaU z4Za$I|6XR%(Qi3WvF~~-A79A!-{6+rH2J&klCAbx6XF|UT@J`~vtT0QKd7RwZ)dx@ zoXGdQTpq0hU9+_mdh=k#kl;CWk9gO?L8C%8|3x!mBhW&1aIX<#Y5-b3Jj+$S$@hr( z#*BSt`@QL0`$ZSa_r$K9H(w{XqjSDa@QaIlUuUQy=alA^A5kKG!(u=D)p=`Aji9nVoaqL##ZWy-p-f+jS21IXGBv zelw2?9cv#!q7~>Dc=^AUO)2=GSZ^CQ1umw_6>|i|#1aEcyl5@|QPg}Jldd~C8w{5$ZpL46dZTFh6=l)N#R$b%p6t9%Funs0` znY{NAS3j`xgr1Y<;IW{f51les+p?cY`|326@rDE}A#@|+V1h4H3@Tbk$gRY|f_07( zR|AOL3!>eK-EN=w&9dM73=4KCs1SYc6|$-wBRy#A+$Tj}Su9aE%Vk?4ek)k;uz0tI z1-r!WN)~KzST*UyxO!%}`oFf{{S7gfVwUh1vxE;;J&xQ3-?nSd&ei^#q*VXtNRIR= z#1tHjHRb42%?^1E&=hqT`??y`B=x#ch?qglNl-3~MPSavV&>>55y5FJ?u zlQ+QB>@$mcGN5LbYoR?(mUxFEk)p-M*S`4aJ%T=!K?{x2#Q~?iR|MS4orpDV*|KZo zh@#)Kh3#S+`~zMGuG?$J-Og@a)hp)kiFN7h`nNZT{Vvy<=!-Y_2T-mJrxsGZryYB0 zH~4DK02O;ThHFmJ`rtt*Ekb{M#)152Hu_{ezgQXchD=C1>*S~+>mr??g~n(z(Z#q@ zkuqps#sFDWpdB37)cpsh`HLRKp<9;y?vo7?zoBVtTJ zWzQD2tLbJI?A$2h^|KFeVY}+?F5bg7gloL;w+NhlQ_$;>l|yl998EgzRn~^~YQyt= zXfLg|&T;ilP+4bn?i`K77ib}|&jD2&4e9x`g^d6w@ zi|}|4P$_w@ofkf4*P%Ua*I#*?DuMZSgIc#$hbBoK#>7_0vnkVly@eANef;S>y(L|% zMZoDb&f|>p3ZY*Jx*BRmOx9?~V+rp|ka9_i5~HbzB^uytNzHOq?sWpS;hR?6U>DUw z>j^W_Ubg444ZZ05j|=jCQ#;!QA9UYMJT7FCjy#L6++x@F z?O>Ko-0N~G;y*2pI~ zfaetb{UBm26aB`wY+KG9h`gF9_}jMOb&BQ!={b!hhjx3xPM;~*RWje-`ti7#Y1WT&+*kfUMcG; zTQax8v{1>7mT#=%Fd}=2Rh#&#pmoM(t7~`3uskCH#z*@z^qFTf^g=tvRM62cD_Tg% zm}0)K%AAL}ejPU=)-%id#Q#Qz7W#gZ<@;DHeIKQ=Ud*C<5DTB@eafkZnzRo@`rw3K zu$-C7hQ^ETXH9W+nid(LV$T*E0zTxC5?9wem@MU7)u!oV@ybu~yM1=TIuA_9hP?jbys){vQW}_~j=+3-oA_Rn1O1)2!c|F% zt2&k<;>&{iqz`K+b5Sk$TE`ajO54;zEd*cB1L15WIb2yinlw zPnr=^95_}xLFHMTzQ2^8R&T`wkhJfRx{dnPJpLq#tAs44WkT&Q!&)mwwOGa*xn*&89c*PKeW*At+P&~@8qG6Jk{124aFDgrM_p& zx#4MEdA8o6o3d`OrCSo8He8s67;{RSmg{NGJq-g^4IRM)WqwCXxTcBoN{<7_Ml)9> zNXx@DwV-1p18Rd^ubtOBg7MS54-`=(t-4`2%~gJ$j=wrC@YQ3a*Xj55JU*DAg}y^P zvNrHZuQvQ5JVTn0gPqVd;)x1cCiJ;Mg37mm;0e0OxO84m+w1w;ajy3Kk*g2c=PL`o zbX@KYhqPM>*}3OK-Zw>I{I`96wCJ1IdrIuxzvWy#M-?MXS@6<5o26KF&IiwNwVf(M z-LzzEztqDQ8^7b+vpLh^Vaesp9HFJgk4b6t?P{3a^*r9)Qe87QcK3y`KV*;n?P_KY z&hm=8?K5AuQf-*D(>*6B0!?OS--Jqpj+%s1!{QX$jT+{<$LZWBfAR2@1I3xh?|%ULt@a$cs5Y#$ zlRb?a8wYCbv$zyFex>DuJUN$qF36B$nhAbDTzsrJx(Y+Nz066 zlcY)$-#y!wwZ7lG)*fjrJMB5Y@1O7cOPamcUiZuUuJ?VPN8ZoUdZ=j@k*Oiw+{u(r z$la02LY}*x*e|9Omrf=wC3Fw3*R<#p$qrbdyLf%_X;?|N*#E;k2k-Lg zbnVd|ZqfW6XD&ZGA!983MgeNZi)sBWp|i-p+7=OBfSR6s)laDvx|uwsOFeTzvxrOU!k9vTb#J>OfOH zpxqtKtE-iGw1uPx(cIDHeXQQi*0pwQtQ+67kz~lb^*j`j+_v$Cw<;Q-Z;DQf;CaOj z?0;t`!b#fKv1qO4HUd7Buk~{HQ%`d%Gyc8nG(VvE;jQpTn<~d>zq{w82=;F012pGp zUQ7sayzTjFbN;6hPWCzRI8P${Kc`8j&|*&r;i0qj?10OZ_mBs4b84w>zSBf=uT=T6 zu(H_O^m_%j)m^10_MXy~$?41_Dr*c$YB5W)!Tnz8XTG)9jjj7C&>5c+K`LwG_U!|`KV8vJvWu~)YKynY2zXuC z`col1HM$X)5W;gxFDvpaxUZJV^tO`xnrqq;qr#Q(U)hUaXyzTY%2&**V}$kv()IWP zY5U$w`$EX!O;P?p<D*e9 z4+o`ATP|h6d7-)fSmhEc;Ac>*mOdd2R%?_N{eQ z&bi{FcZCY?c#@};3`%o* zX)D5B4K*|t#yJrr9p7-q;e}1UExslrpt-O$Rjbld9%b~+Sy4k{nmlv)H#Eld%`48` zU!49r=i%?piy)nO3B|?H`H8b4NPW&%B7CpnGAa6m zaC~O`=U9&9S918w{X29caa)s!7`hQiu7l+b8G#IDKfSZRi>=AOr!gw^ryqiKs!yx` zM>q9Hy4K+m@v}T5pkrs^1x?x0KF4OU52%iF{cAFJ9ie&3?#vy3;*iuCi{*I`*Bjo& zw5XA|CIwjNdvg1(E?w&fD?V7c3MX!u7Qv*%^eBma<1KIhd1ud=$kP9v{lni1BXEYX zSjOIXn(5L;=Wu%Yp&Nnga}f?PWye3pN@GVQ7njH1B>7y8z_)~md?5J=P&50!O!A1l zr7Jw@mz*>=L?NP;=y8W~Fo$6k|4Wr1;;-R1Y%eTT6-+)zcVq>|L?VsQUw#xtW zDn~Pw6JpeN_ z52TMKUZdyNVQW$^?cXazB)+L;%ji6q`>JrFRfu5M?Jy%dRN4dEzObd&&Fup^s!wgJ zNoTm${$8kdcfIAM`kMQSaAI&;1Qo|%@nkQ_cw+Z1AbQf+?i#+_R-^h+Y^zBh7sB)M zoVK3H<}}TR{rVpjCW?Xd%D>4bhdV!mH1nPh+tm2w)Hx0KeYyyH}37H zZ$fT9Ji$t18?WQ`GQ&vhqkhg)=`v|3PoEPPb8{YoS{}^S>tKIWh)C3(x0TAvJgcK; z^YXTaU8v5~MSfd?6Q7`Spirf|U8Zwc+21Y~BEnYjT|*UlTQ|D7O?7C3cCf{}bh5*R z;NU#n_JQ?N+Rz%uk7Nxj>L2RY&&|b8$Qt*3^IX=xioC7+=IJulDeT6=C!1jHE}G%W zEuy@7u7gc_0QKvCkSz3sh_ue)mKXg_2v4aqA4ry%>zfo}I8^x~-J1JVc55B!C~ZZs5cl=BGCc3&)h7Rn+irEkE^0xT z`po!olLct`#*cMtHlBXQuRk%DrUve!fg%SUrCax?K{l+PpGeBcrc+(kxW-e(jB?l-q74BQWx7CXvx zf5xZb5e+pCF76C&kQ+uKbghxN@Cd@sZ=1D$?R4S(A441$Y;H|k^`?uopBZZ%Y8BbC4&K;khl>8jn=j`Shykg zg^HfD>;xa++X|*dFs_&TE2miJju-CT_UuIw{PP|@aAra?$JwG-28%k6iwImsAY63K zy5t|VddaQB7E7Bk_2KDBtv-29t514#^KTjy@ARIZw$^#O`M?exHC`7Mk{mJiQ*WL0 ziTtUrE;Xc?W7`l;eT3UomUrsDBQ)QoZ<8y&A$dyqX@9XnME=Ra5Bs?go}o>lx^c;s z0<&ifosX3BZFJ6XXlt2+yL6YbaoivMsjsflg@ym>_}gZD!sLAKQ}*DD=8D6yo=xz(qkTF>M5Y8ST~ z;F_$`5Nrmw+o1I~12()Ad)`rNO* zFe|5OhNDaK%x}E`EBfX6!!-7LdSLIEXC(H$4trmhW__taM7;S}i0)?wunH!A-@Qw; zc@HKT%;g}YstGE7y)$aFD?U0`ubYNNWb;zv#};2 zruPr!YS#N7qw~=S1kQ-aP;R5u#;`S%i>=Y(M(gP=m@jq7`^AOPVok;sW#UglOJN>z zzHL4uBJ_=Mpk*wySlzWg$*`5$X)x8!->W;lg?ow{trln-w76+&^fi5J2}`eh3@DL(@e1EYdF(r)Swqda=1v%aCT0YDIY!`G7s50S z|E%NrCA1HGFwcBYGXl{s!;Z>+U((T=r})e$U->s*v-Wrzt--b&lVqFD-%E_K1kX>` z()rq>YaRFGBRKdRx4oyHIkM+DZu<%r^$$J{o1Rs-t2^|;$GPpz!`6@+3!_8w&bY{% z2P?{QObvM6_k5MP=23*BH#W*UmcRZy!kVK(*VMn?;T8)1cSUp`ERE!mhhRtd z8CG;H?C3+>-q+(E9^A*R*XjRUjn3kO(GJ+rA{>r3s5FD$;Z{<|!OFOAvMmomDxdU` z<&R3fFxpo;zEY>;l5(IV#JJ?=CwW!Qm31&%ncg4#n1~F1ncFn>J2WG4-^WB`GsD)N zTv$DeVZD@#g*0bk%AP9wGt;)f=M^{EJ_hqo+6(%wG9BBXf02POor^=yal7jHGe>+b zn4$KnF?9!^#i-6d1A==RxUIQhHf?DgYXLfM5+X?Nl4%i)c5r)eEw`!d4Z!5v8iM68 z5-%_#;RZ^m?SGKA<}G797uDstFnjd!j;{z23~j4i_d4|>)2!$|ZVe6@mJZL_=n-x; z0r}DAxE;D#>8dv~1fv6PGkP!VsHf42Hp7nQ(%dTUIOsyqdXC#;&AH~#M2`7#o7+6k z7R5Xc=WCDd>3F9S!8h*Y_75n{8-_(`vftmc48a`^ug_PgzMHwt@ND2)o*0yX(Qy<>T5LR=1QOD<|MeuDQJd0o?NG6Ql%k9_Oa%gSe`-9wG zYp~5NeVMh zy)XKjW>L96yC@&OedrH($JCNm9AhFpsW0&`a_zT{XxwV7e<<_~A&m5ul zzp<%)jP~bN7lM0=aJWaWka&qa7iQy@&{!)&%@1-ltA!PJ?5DZ#xWqWvx>(s?7anlz z89$?bXN{KkkD?kb-2d{@Jd@@Z?U6K=G^Va%?~8IQ+bw4-H_Ng7wT^Iy5FT~cBs}{! zb*DG>@PYWI&FR1TDCw)4)5zoXA>`FY4>nr({Vmc~6x~!mCVA^%1Uer_comJobKLHw zeR*;Gql@9`r}MI$`Cg3X-aD+fZ%*&|C)lzMFame9Zyg)#$~Doxb&D5x)%STi58@l5 z&HC18pUZ6M#_%A`m3^=|j70PR?C7Ls(K$BwE6r-`;RAyQVGmB^m}8T$2T#HFIp^E2 zbj5u}d*;w_e@MxZqxTld2V{H-p1DynH;RyL|de$S+ca2IMa zdrbY~2z!7M9nS_fIPl*_O~RZjLW{F z{+LhwcSzJe&5%#u4n4^2#an8}sO*=!XkBd{Lmn3PFi3wOnlC&bThF;+ZdeNQ-D%9~@8ZMXhsEASBIm4@34iOQg)J#zom2F z4Q@3#zhBi5q&n&ayxyxBiKYS+VcA(CBGd4$m!^Jr1Zotd~0Tgu5fhchwQm&U`h7+Y!t zCK#;K%;i6`7!uo=bkg5Qj0VlGVzwoBNZ{Ei5i#T)Ec_F!#6RxnhMxq&l{caD9u2{l zPAcy7%-zCF?Db-9i@qFrUboKY^}YfWH54eF>WH0l3Ix~A$o=1)7Ze>ThUD_s<^?uV3)N$IH0TOLyP@F5-j zGWHj-w$C3dKB5A2Ct_wr;V?4GII&d=%6_G>b({AW%(n8wi3wc{&jO_apw3~M@M zR3tszZtCU(=RP7Lm*6ZgB_kbU%zyL%%!whG<40hoCKT7!gCrv&U3+SU;+O6!+P&ep z;zBPXS%)(mN4#3*A)2qg%rAw@vm$;n8@pKby&j{!4}BPR6h&`dN zK7_DW$B0(W>wR(D->?jlv!S#cW~xt{iNh{hk8o-Q>DHx_Q6N~k3MW#Uk-+o4FNFRA z)=Zw?$Tw4&JeSSMbJ?YNUVLCqo;Tn`VP{va!Fep&=8kK;sdu9NphSpP%ng=&2@X-1-b1HyDJCp#|fuUDAz zlfLPs2&Nv-xy-*~xvp@Ik}F{A;PuU0DvJ7m>ZWD5zoihJ?V5^dCwYm+HU3HOi+}0( z7{2@N*DIcO|r$D-}{3YnQ41rf%z8caWtM9YLXAl8PER^!80v6=2bw+%r`fw zZ&qwT*q9d88x`ie8P)kE-##XU#Krl=pOa3oXi}dPLFM;UD(#Rt9}$stLU?|lxJL+222-O|-br45XTOo5x&?)uXPq+#hU8Q8Kk&R!Q7rXF z+OwqpoWBSN8(R8xY3IEIR#?}}eR^@nZ>KZ(s+Z%fXZDM<+Ak#Ug=j9CV_To)o1=ZY zHwPo9Ct&KiiX-vh9U?N`#x3z6Eb%C;9WGS27=;q|{_~%^lt(gq4T|O>weD`=_NfD! z#Am1V`}!Rsa_Sb?$u@3Pu7czxILeA+p(bzt7s0LFE?E0kDUOz7EXS|Gb?{qD6o>sD z4zmT?95qjoI&gh7TNfYgn1NO|>o4u8^)cAwzEUw?tEI%(QRr zdv*8ixy-(M@#!B9uVy&jD&Gt8#Y$4sB`F;nEj?sR3odFz#I{N&U?R%|$ofbhUhbs+pC!}C&} z8iHwTg!z+tX~+M*j4i%i`3n7WhZ8fI#Vu#d=k_{=<6TV+^1k}COYWyDm0!7%s|8@s z%7Hntvn)53@vlxh^~mN>m}0Kj1?G;Wx?rVN=%&?y@Su*pB!l>Hjfu|}n7P&R9x-NU z7`?AUM2f+!qlHb&WgPfBGd}WP zb-qtx_WPa=gsxNUbneQijzf5P2PbVSLA*{qx6L%PYBk=T)=`Ym);jHLdaTbhoVj$0A_UqX12UEE6b>*i|B z2(Y{#Rctg|i<{zDST$8yH?Hul{4EalO$bJS&f}x6aqB2hv*A{RC0Dr9mU}u7{+SS- z@z=RkB}8>&Hy`MeyyWb==WBPrFaZQVaVx?D+Uz$C9SFyT@a%-1pIoP#IS#(@PTCXp zQUB+3yrUu5%ed`j%7)QQa%T=kQ_LlKH*)GlyF!c}9V&8IM;UUSF0edHdtowxYM|H{ie6|K*J|#xl7`LgN zx(f@bzk1?TlW!?pz1ucH`QN`Lv0u3DJO0d(pVo;;GA%};I^=f}>!6ztgqZrhN9T4Z z2h}OI{xON|z@%-bp96MO@#9Dg5K5=)Ko$KBV3R(EV9R^nbZVc%V%&dD1btMu*9>d? z4HzM>skys&{8$YAPF1PAr25FpC+>vV53a zvD6C9%<$#LHqo9{8v6|^i+wPpnaBDx^Jtr9PBdrq$8!I>(<(NC)}xo!%`M!f`Qj}= zKcX-z;gP%p54eoL`#Nk&XVAK5B?nQ!cct<_KHR6H|8y<4+vdX#yJ0?AP|{E1^-P_J zgmii5mPp;GY-@&&{*bP4G-rOhVJBB`yLCRd(Y`V5gWlidg~@e{HbA}GK;wNQw?9RH z?^SE&iA@N90jOTENkmGact4Y@)IaOPqi_T!WZ6uX0F!hLI13 zU>=)*IdK4H=B(Ta&1~{&>TEP%-T;J2pH^kgo~=~hk2`1MZ`xo|UPt?2ehZq}?Bvzv z)yyVC#pco(`@pn_Tzba-P}&&(PxGNXR$rEfHDhOgNXyJuHFq=qt7n)VOTDHrnw|S3 zhli8JZ03%ge+*$YPb=gd&P1)ml=(iL!;QD7^C|>XKlhm0>u6mcsuhuav?n~S=E(0J zL%4y#K9!5=FFvNumsL_1;x?`2##|#%dAzcYzK!eh-p_pH0ktPpmY|N_$K9}p9&paw z3u1)!jooFa>(zOE73rGG(D}O@1mg;WRK|EWo)^JWtR&V`hC0KY#kE2EljN!9_4`Sm z)VV!WDxh+O|-Mqdv2h~ja+rnduSmMD@{_>X#$VyFnmG z?V>e8<*#V>rn}sb{27&it!(=LkaY*6$1*;L&i&U+Y#GTsTfi;xWmux;s$uD4&(Qe^ zAlSMFV@Hd1bNqmArr4rbpJpVInh|)ODa_{hLX0F|=a%6{b@C0vqO*TfpCcSWmX#7`(cC)phmQd$RK97SBUx2nbf*htB;42z~@cg3jUIZJ{w=UVKBZ zbN@>9YXBzi5hCcsG{)S<(9zNj2yGtIY3p%Wx19g*KM|S`3U#5jT^BK*z zwcOTf<=$$Gl^H*pE6H&`mvd&vw$NDW2$y#6Mj-h0Ic+KsB6v8fO(ZM)T%K=>Vy*`e zZd?j8Bt#9h4ei^~G}oWbg-Lb$eOd&QN4OPQgRvjcH%oO>#$@y<-|J+XZca7pCiSa~ z(HPRrWCLtV2oLpf1Ijw0fb_-v`*K0nPk*`<(glc7eI%wpm&IGwqJ7{-|1`Z?z-b z#Zc{^k<~r19|jRlYN%G&ZWS>VccgHAKH|veNnOe4QDEdjM@Fy2qK;NaKL7sBS@OA4 z)_2+}Zk#>Y@+W%|$e306nE-=NAJ1uma5C^sTq-S@94}5Ft z2(}85J1j)ruy_$xN=I;&xny!kL1Fx*?cp?2jtzICw5v0&j)?n`T(fuyxEb_o%Xb~ zBm54X_h07LhlHp;I>4=?)1rDJ!mXicQ9b@5w>D0T>ix*^e;Lg0L$2Qk-Je2wUl{aP{|r z^$!+dcq8=w5AKw5O8>X#Ys1I-NjBDpcOGx4TQ)6f+K#u>O6;AP+a;1WEc(BWkWvZ=Jk0Sh< z4x7$}A4@Lr@)=B~f0^@}bkxz$s{Q{BaizQA+1Qc?7!GCpo?rQ_h?Id_((m~xZX3WT zyhb8XEh5pUVDEW~+Z$<4PC#PCFt3qlWH{tAbn{6dJYFerj5|^I^@@<5S!=rF2F~a` z=Wj%b^gD&Zmm&GvRetxjxbjO+tk#SK>G-XfwKx5l+0$t=6< zY|eV=gRR9#ccigQdSLGk&^iH~!J~jtl)YZE$NXzF9zyl~u_2iBO_Jrrej!98G!Hhd zwal3BcW|gOX%14F`In{{oVqm4Ta>2g(losnE=^-mnzBpNw4T2-&0b1VacP=H`_eSu zp)}WCn#PyDG|e|DO_fR`$KnQbCfV){V{y*v4?6V@W z#FTIm9bU0yUoLr6(xP$tdVf37ik>oDTtVG4+V-8Od&7J=$rvJPi|K_% zB3i9tdFeZLJysBbu~vH+)uc!WBM+aB{QShwk{S-N6Z=fNE*$>8j%s65TOEzt+1%X~lHW&HI*qG5xGi-?1gYGpj=f3;y4q~} zuqxj>B}TK;qHuS`ki@_6IKCj|q{G{#>r|}rL@l?YQ=+DK)8;xVQ_iO;A+ZGqHOM$a zs^7IjM7-xkZE^*-<^3L86!XCd{N2OS|1!|6!}@DSx1i^*JdE(eE*gU+emjdJel`Z+ zwM)*HAnAVIOZ{9jcM>!g(`~x>H#+vxoZY75Q2o9Y=4p2Ia?;}$tdn;Ag>d2CWEZUD zkS28zLo*VUi(x05mA(&#S2y(EWFp`A=&3tl_XOm3W^yg;AB27SHCPXSM(M9q z*B5o^<7zoLL~_0rR4WXys1D2LV208hq&c+87Lh53uUcX??bKv^f@42;-WR>v#LFKs z&)qzW5%!`ED-S3k{rbf9PK<-pkC*uW@(WUDNL-1dP3eL^Q#ymR54bwt$#9&pC4QY5 zfk#pz!ZUSwQ|ok2Sx|CiOZoR# zB**Afx8m4-Kf)mSSC@RAGJa-@AK_$&b5Gp?EBUzd|KqTzj`II5g>w<3`9l2*)I^;* z8&6ApM#d}C`Sx1@uGdfJK4CYj`=n-JbJ zpAXYGyj;XB-^kVStb6Xm3iF))zvedOOMJPXl)^fU&gXViC*7e$;>EhF(_FXqj%7<-vDt%yDjM6^#x{keLI`*FX zhXrQ&-(PK(!AMv-_DVZ>9}bT@ZOZs$HI{HY#b8rge8;ag*Syp?-0b4^>XN4AP2l#1 z4bR+0eTy=@utGO*)_+BapK{t#*E{ue>klPI|e6KeL!2*Sim$<5w+YLGR zo-YT%t6>DLf{~cFh}$hW_}+dOg7YQ6l#$54hTAwhUL3!zWKWau>Y_W*1vmT|8WJZ$x7JAn_>O-df1C*`rzZk zqEC~3;DS+fNC=M`M$r)=JOvJq@6|AhXs*qNQS@seJPTkHk*rk+qi9?R4+FRKJic`q zxV6#HV@vb+R$l?%+Gns>ql>+$0an#i=!l+&t=>2Ju8dv0kzudzw+l>~n|~A{g5P%^ z!Lob)K`Z>LYk^0QL+mZhNMxRU<#y#ake%PJD8H%u zkIdkkJ892~%hMjBv~S)waHX^)=fQ>hy<1eg4gKD8?776AUBf56Te!XFi~n}AYTo2Y zbn7qDdZTohYCR&ca>1>kpZ#^1!x=dZPP_rfL^l-CDs<#CTYO_am*O_bjwzIO=c;^D z#jO>`_OF*1vi|pk;z`QH5?)w;Wxt!2B{;D>2SGZAA7nV5lzC~APwwy5%liz{zhgby zabh_`uxC2+S5tp=*NJgv1d_Q%py^hlg8C_31XB+&*`Folbncb;M}&xco9a}RZ@#x4 z;TewMIer0jj{T8j1t|GyTvNW3r7#kwvSsm0+b&}W&lJP%U61froH|qay+ts!a_O_X zw^!#@Rd?aKOx>zh-F3vb1V#G8^7nD=9Tms9H@kktm+HTnvV#oAjjDX}GwTtiymV*& zjBBW&d9vqce;s(M?v*EexnBy9e%a;L7k6z#5$R3zU1WW>AA!$>jk13niP(j4h}FGT0f!bjUbJLW6gUC{z`3_i@PEp*v<#ebU6O1a$F9|vYHqU>y#=VJGH+dvFv$jmcZx_#2#>5^ z)w478`$dPk>-sI7V+`hCpJx7!X|b0*uHmChi+u=2U@%u3-ggVEJqy_IM2=B3bR(>9 zSLO_V`vA;u7sF<*bnT8+Fq@7)v+FnV9!QU+!0kOQEKKPbZR&nzfYLRsf_WW`MAPrP zcTs+#t?J+&iQx)!Prf!ho?{g4xe?Y4fc;9JW*%jEv3+oN+@mAd@ZN{gKLf%lE-7;t zrTeK(tzIl_06Jde(QrunHZ|0;y%`u$7$>G!WCk4Cz-ZxzfoSx?=+1Kd8!SgdNx zb?F~VT;p8-Q6W5cda+PA`B8d$PT!o8SiP>8YkyV$3Gtuz+qVwDq<;HWG3+b#-Ssd6 zL+;sr`@re9{owYv3k!R5RKGD80qQrB4XEEJzwCbd5R62o@3Q-i`jN_g%Qf5P-#K@5 zOJM|-YusMGzuLpCm}p*yjb|Y!!M@#*e(0`Iv4?xA+FkA)lbi^bMRsR z|1w8k{QuY-tztOd^xmB|$+4Lj`d1dKeN?XhP1!z*)*M@rj150dGCy|S?r=|Q4yUvp z`$b5_{vU0XcLmZnDXznc>b%}ywC9z|JB+J7iEvcIh~k@5cJF@^BC=1GbtQfcWy9?P zMqktMeAoO1a?d4ww*6jZAE}&Dc&dg=l}UTv?;ZZdup4Gd^d>%iFT#slFqgmxMD#`d z=RO8A`G@XZ(OTHiT5hKq%*I?JpkjlIWB>jMgmn}jJjW1g!J^3naxdle+=c2>ZkUw} zjyzc$OVWH;0o%SsME0!Uc8~6vOy(E?dFFIf)$wIJUP!ii`^Q;H?D#DrGTU~TyCwbz zw<@a@rd8#A3WuHaHG}>#nC~cF^S~+QiG|8|op(yq(DPrXMRinDoKD$eYdU%xy7|B{ zhFG>A@C{3iggP7bnBo8}i4E#_-h~|r-`)js9#nn<^F8*;*1)_c6t>4k03KtxoKKV<)EZAlb*~_z^4oh}VW?Y|0#5)^xKbV|Bjw0G*HJ zvF=JKhdhtywWg^zq*wlpKEv%j=T2YUWyGssy*rQFhm|jbrErs88P#b{ z1KEDNG+!mwY!ys>=Urnhc;+PK>x1zE?LqIgA{_s3-1adX_q~0mx13en|N?BpKE|Chv==&J{7kD{UIp#tz(1YjU}!xEZPbBsV=+Dep7wN*7Kv z+9LRKg|nYfF?>cMxmj{@`>B2RR3iKXAv~`XJN14PRx&MCCLiTiieYW)QCQGWJ-VF_ zqy|(hM_!(h*x|I(5aRXZ0wb{F^9b*E8`fRL3X?OFSNyD~Cfy>hOg+mh$|`3{)Vy7) ze&3b#Jak6cIFoK}d(ViGqmG>+F2tx&!mUb_cC=~;4sPcIzm+^IS}gM|KQC%;$en$5 z=231Lh1{wvKquS?7C5}YQBCbBC`P~P@C8S6C4al*4K_*)>n^vExC1Dm z|0!?jYb}JwC|8`B64zccim3d55W>@2!Y$U#2O5A5uZCcfG3ooA$BcxY)i-=fto*h- z6IhJqkI#9hZ>cPzxg`6DG3j4V#nBf#jXW|yh^70(Q<=dllq$fHVO8Uj^O0pb@ zWp( zQj_@iq=$=pVf_ycVa2Ubyq4N>VvY`e+PTkDXQdW9cn`vO8Rpwx5|NOO5y_+F;DXUP zADRa{vD?Ltoe~+B)Dn_) z^PgtAEbqB5iHKLnNTX9;X*sO_s?6**d7U;&$PL{B31^Pmrwl^uFPwqZ_q)Vd{lOV%^OuhB71D zU!G2v>Hcg^I!Z%(Nk%UC)|~fomn!#9{q?Oval;hrd=?05S@n$TMqpa;Hd?bbt9`>% z2Y4axRj<2JUF3URzQ6Xe_usiB-Yw;Dl1?zqr13qsSjoH!7n8-#v78vS&8K7Z@tYky zVj+$rT4ZLpM`vQZzpHFqU!Ts3DPBB_b9Lb+5jieniHi>FMVE55OWo-}PS%_(mGdy5 z>R+@%^83L$^*Zcdw;&uYz{shg9P=E@Gc(v<>9%>Mw257V@Yx~FR6cXXF`BP0UZeJE zpKb*H=^BJnQl>A9of%@11Kzw=z0Z|@8>O6L$asTN$!qxo`u^TapSQvYj9i28sRIS_ zE^E6W8NW=*_umwmyR_oifKai4^#2!yh@2KV!-kGScx08Cyq@+I9Kz~VX7WbZN0(}* zm*EiJyVIUv#j#!;hkW;~lIKT`^bOR^k4;P4pwugxg@`<o{{3t(X0v0Mkczweb zt#esn(>AY;V6h8kMTW=gNlkKi?|Vv<7*rb=0$0R)lRCP>pexRUc?T5NUFC@KvEKK6 z#obLhSLkF*-MQB^(>|b?b=b8l`8cdro!2)!sdaiUieSSCIyHu1$gRrv<{{YXhM8oG zB>vSG-V>4NRq5JP|0k9=K<~)Y5Nv|Bc1YLO_CW9W-FXq*uWM^tpmppxFM=iAd?4(` z;V1Qy{sA}4V?uZuKBsjy<{-Gy&FlFX?#B`oRjxwk+b#rgWBdifh1w_Q!!%B|)Kx<7 z7-R?cay}-eeF{s5dA~mH@X+nn)tQz#%V~dF z2iOL9edXu1&PE+UL-9&gPvqy-?nH4vm+K1l4#evzojxsA(mYST1~bK6vE27WBt9>_ z(hH-A^8YQ(kI!kHtydw~K>N;=2<~w4`lT)-(6UAATwU0_ZNH9SLmo~jD*qN zRwu^*2)4Okeh9k~4PcX3AGz7oY9;#adREG*+ z(%JDP7YZjhV?Y;wPbAl2bjAv{zETXFKmZ0VETRu>1V|EayLPC)O_ga}gI_fHGi z7Mxf0ew$<`TLk|={q>6C`mCH%e~V!RUY5Qe#rf#w1BMPec?-8_oDCR7&k5lP!6^Fg zm-%_=vHi-YE6@U5;s>cCUjLSsUg`L3%JKWgKg&5qW0wdiUg;vzk7O*GQ>MJzfstsH z?|Hq#2zh;uyqE0*Mf!`vbkD?vMo_qtL-{-W_v!<pRvcSeqYDr4Hrew(9xf)Rd%Sx zLm&C&`#MhSD0<+0-_;1NoD!o`tTbk`ir9svx|!6M6eXXAm1(cW79FI0uh?lzvYFeo zw|E))WlTUV$;nF&(mwL6P~32t_O7=@jm)nLR*zmWIi425DOM6ov*K7L|3+4RFv-ee z7p4{e0_6{;>f7MKZM+b{L4C==%zpN`Q%2~ls2=a)R#gG2slK0@7LnA`+!|-_H!Q$y zgZau|tz}w7lKH4k-pTEBEw^7{=uZjZIe#a&&%s-}Z$54d>2hp3UanYu$KWXuyb35; zJuM=X7rmE0QVMH3wsu-XjFY08>KWE6`s-Q6!7d&B<&r$vP3PZZAl`J)KF>xRjIk{`GseMG37Q62ry3gL;Ke80|+Yv9xJ z&dvZvN8LF5t{aE@>HTy|9iZP&YqMR5;BLKivQ3B}$^PSaQrq?Z@u#`9Lqm142Ub4y zS&!GPs>{HS8}9bEE0m35H3bHDR`h|V;o zbu3%F`i|&ndcUY6BzcS$#|HJ1gES}Ma30>IA^4ITrh2F5jyNqa{FRdoMx8(mf=91wb+W8AN%q~{ke?$n+7g%{M zeS6gLd#Ca!pN!3z!PrH4lAb~N{%BfwsNPY<4`)){4Iyg&DC2}@>+Iai>>8UEk@&Qz z`GpXkvrLn*99eqapVSu*Ex)q9NZJKp+n}*mKrp5RTiYuP<;Nj&W5@#48 zy=1ehv#oTF(pU-Py=AO&C(;L&OPTXTGIw`HCBr5vZz_AmfL`1m(LMdi z93v2_LcOR$J+8JYE1E$j~(V28l#$AOx!A+MI^ z_Bqe)igQm~v+gZ74%0po7oxhQ(0TsUwd>A1auv=&W)J%;t)d%I77z=3_-RsmnyUw&n zH9EFvsypo$-`*f1X@=OKzUT?kOH*v&^62)Q;*@811yEUpJk6in3=7zi0E!PLn`IoR zMf?7jAC&Qp@(yaV3nP3juMaU)lWrSQxKN$F`3OFAFX=*yW3Swa@RXF>RbIOpCYN3% zZG|$wE+@bEMKM~;xV3p6M(O#o2Suc79%_=$aSIHV=E#tle0Mqd(%Cne_53SY&#A1Y z^CCFDncArEqqfo+VvCvwb1;(Z=ayGTHNRKMStJMZbyB~m=K0)yD<_`7s?e@V=#m>h z>Exs1+S@6w&(gj~^2-Wt?~piei(^AKh)D84V|}Z>q(7;neu8;oO>24mv084^-ugj< z8k_%^Rx%1dBdV#rsWw=@SuY}~Hg0Va!XtFlCmcSpOx|C)K}7m=9HRUv|F*pgBo2e>rDsI-79l(Zldabd&azb<-l^EkI4RiU+p5^HJTZbKB5M`)NP)0sSGj z!p2}Xh=?%{BO$lsPnL2Tl}Y7APd;-*a$hmT9&xMq?ulk@w|QaqwO6H^yv}cMd!iZk zZe5!sy{pyD?XT&j{S8}c(p0VwB{H_|`?-a+k2qYX6G9x+iDUN0gvUhyf3FOX=J{3@lB{GEO0k#a)q1wpRJ^Aoeo2wG-);8jK>%@oT-V zklTITTJfXZ-2(>>E$!b4)V|ez{n)n(VV+iZ4%S>*`t%HEkK<48$T@pTFmlG>vaWzp zv?$jI7&^DSCF$B(sW;Sl9ac7bQQ+I82`#qm?e$hFiuE zSjIeVh1{@0eJ_nAw}r+Ktbb9ip}vR5LPfB8^`_yC>@UVDp=7-V-~^rNz9+9;=PiK0 zw}M+f=#q;rR0XT|c5XGYbS+SRJN<6;!`e~C?WU_RBI69Vw5CbUq51iy5Tgpi=9z)~ z>z!CES|eH(ugVqterW8a&9sQyp)z%Mqye^3#%-;=I~}T^v02jp(o&d>LX1|@yLl2D zX9R^fO!b&@>Y#6F9or+s%23~@(@~dtFR@#g9&2*JWLq|l4bl7gQpX!fJr3*ibs~~_ zoLfEfVH-@lF{&w^MRac;_?PRP_%&OM$TAs5Tl+qpZj_is@KZh&@A<|^7kPRD=9a#P z$G&k=tPGFC{O>||dMaT5Qu5;&fnO<(%|ObrQTMi2jrGpswtjm1kw@lpo6#QFzH!Va z#LC||xC5jcetXNtF{=CfU=kCc5_-qyga{73C;h4y?kt44vG3FA=JrR%`Ywpt&&*eN zHD}eGw#1fA%e~96d`Xx%z5U3>_7LT{aHGV;=ayHfI@A0MLGqaf2ITi;vGiqjMQ!G; zM{;jDa$l4o*ie8@l3g2I$`>G;Qzvr=Rpz37ur#K0krHX=_^nX7Qryk$-wWZPGz#OZ zM9QCWHy`#DavLRFa{XXhRR6n^ZvT94QCS{F?Y)TO!fPf5Ru;r;rW+299v3f zcg5z$fRz_;Yc(*kTX9guP6`n@rufdPl`Nj)pR2pkIPx3>sXdh_@A%oYigo(C=~+47 z>qhYHX%Y0exSeuvU@8mnJ+JZw`JQiD1k0wyNXpIaxK3@<{Ba!?$({7fcTv3lH4XBt z7}^#Z(_Ju!kX|WclVB7@w^fa~qM}%mD2T zq4j)tSrNj~P1Wgtcjl?ftxBHSo_6cJM~RppWs3K~XQn|S?`I_%9GwB>_3 zRWA!lP#tQd|Bb?32s${M4wql--xjLaJ}O(q5_)1|Lf#9F zd?A40r;4)5nuFKq(j}f|AlrVd&EPoc{xiz;x7UC~1_k7swqOAP)u zftrw)+dcP59a+kE#!3f+Z_6`Bezi^vqu_o`#iN2b=cz z)OXdn^o|R`RSY%btlYsYE{%QkqKJH5PuK3KqP@~ctS-dijLg^f|M2#&@oiOC-Z=g} z7t4-q65CQN#|g3IKmoN6m&CGT0*|+ya4FZuoYD)OMv7^h;$grIEom^xagugY%(N&r zRhx7kD}hdt3R5UDo%piiAP% z2g9^wS#6w06%Vt>w%=KtscqDp^QlT0Yl>j7d}i-0Ly+`-q7i-fieIG*VZ>Bs#R@ZZ zKPi=1R5A~BMc}U!^4sP@W~U!vmh$$}-MRB}L(aTBy)L}_>5rKgTBGdTl+T!#+<8AT zCjCcZs+_NkHZM@0FXFUIQ)^*;ifjW9+RP;|sw&WC(!N`QwvLl>um1Iz@Ocq;E0&Xk zdn3?R@#5yn&5rN<(`9)5mt#Ddt0QlAbY%bVhC^6ab(hF9b)SFtPF3j?u}0FTr+?rs z5l5Rq2_j8vLc2F{UQ25SD00pFs&;>!bFa_|D`7NwnYHPPOzns^KhVOt_oro2H%~d= zeR|#M$vLZDS9RB}`+U1&Dmqn|WvUMAOB#aIzVIgzb3MJ@rZQ&NwYPUQ9`tuM=&<_~ z)MWMe_ZRUfTY_YVz{&A;`gDjj8>nM;)0*(^eM+WQd}ob+ccYgHJ!x!Q@(4mayeoZNQBU}Fr52h9p|Dx@74MyrtW@CZ;{|_R!n4}x3 z_uFjyr)B#cFq`*f+ds{N5_86#_`35fbZV*}yPap>mv)SZzxZ4}vlkSihIqzArZ(Ng z>is~O3V8eu)_)?~{s|tGF%j;>%53`|$@Zyi%z4)LS02pjY&SX2e1Dzl#}A!n=3lso zdnbD()x_$}JkalS{SI0tTug*hlHO%JfHNO9={QJ@9-{xPE zzsn?UfZ)+kcKq-0V7idm|4MTI5hi?FNmeOeV)68y0{hiU&Cb;M^HDmW%@cJ8egW$< zPW^#jFe`SH=2~L4-;$kw@l5U&C&!%mALPNEs-&s3<`4MWtM2-r+4&uqTCZbH`BZv} zMpDi*mY$;Dcb#Xklw7Yc%;rG$`>CnAuV=r1WNKY~+429kd`7zF{OtPw_tZD`Id#qd znyOox<*z?Un(*ai>aNqL%kK^2|8M2@1OI>4pUro8_APEK%|~f{5lUa4AbOY=pmrW} z?k|-|c{japX_B=hD}@d3?6W$oXC|aDndb;c=2@4ocEc@5cGiwao0X#ums3&hz`k+J~R z&^Y(@mWg}}Rv+iJ?>qGtj`HYHCuVp4D37KZq@Ph?q9$x zYQG6eQ4>%Us*v-RdaI|B=_m>bo}}>UIOot>#gt6^lA5IrJu#qF z2CjDGI?;yk!G8PN-ERTGbc6882vFI}&MUKQx5VU->q+weWzM~%2mX9q;t1&ZQ?^@H zUw(GB!0b$tou&Xb=|)q&fVuw7d5O~^zxbq`CSp1D*)j)@#G+FJildAFaJI;0pQJsx z;!C)KXj6r`ZSH5(xch2Y)sJhL>Vl86$E=Sz-$CN6b4Q!?<*9_(PkQ!zn9Um5ekFLF z9o6Lyzn=EDjVGRrK26{=(wP#!Sn z!wQu#+jPSYl{4G)!VWEFmbnC0xKQXuy>=dwUfS!``C=Sfbd=`WPFvbHbRByD)@4K! zqda-c!M=6DEUO;gaEPl)>$571feoz7`&wP6z?s+NvqnwrbglF6{;7`AwF8L!WDpT^ z^TnAy&b|H;yzZ60to<~nv^E2yypHI1jB{^GA+uMnS-o3zuo;eV?p^dqc=zCX`G5BO z@dJUK1WTMRyPWgoLRe-cvqF`y#F=fGJgW_r!!{Q)E3_C^MYc~?cW9v1y7PwW~M_ub-5h4kv= z9f+^4l-OO)8F`UXF&T$94P(F!v;X{94B3zL-{{A`TqH55s4sq}ALgjQ*i2@>pZo2Z zwma#=qv!eY5HGtXc{%Oa%4fCwL`Ktu&xLdU&`dmi9r4d>W*u7sTi_3A?!;yM1cIy1Zo;pX2T?FH1 z9mYJJ*^R{r`rItO$Sq{`$u#LRnjRqAOeuhoQknI|e3Z5Tf}aK-fOY>UkD4m%!3UVt zSAbp-YYVOQ=d)n!P|W6(ID4!tO3^;7%@6#oy9lyX!soc?i}1NGV)4J{vi;aNPkMBz zgZT5A9dq^-j8EwyA7%HNF&^xwhVZTbq4TV7bV}Df<~;L_@}R)x*W8K6ooD8`srKG= zo;}UEx2hN~gfrY&s-SLZW=`!-fSU9YCUSiG-o9k_0+`K>Fw1^Lb_vWf(*FiEHSm&i z&gq}SY^4~s-_2~LL|~6v8-dopoZ`lQ71ooSd+G0sBtMFnz!1698GGLuIrg3nh?9Jo zmz@WV*4ZW{loVWPQ{;-cnQ#Zlx^COv3S$)+yMa0^sHoC891dI{kPvlM5FDj99ni`oe z=G855>1c2LkKYTtR)LL9GPwb0J56>V%;vSKSt;(wZ({a6J|0aL!j4@jb;a0~63Z_e z!+UvoADkOF$U zU^c(x_-^%Fi<5iDxiKpC9Zx58Cr)948{LJ7tW`ao!#kKY>_RXzzNajuRVF;=c(l)j zWXA>(yJ;&MS(l>2o?im1ycl+@mRX@wb87EC#d~|yiq_&&0%JOGR`UePZ|Bi&7fSnF zs7Yz%fp>4`(FN_S>xcO$rLzAckK|cpV$|l*n1>IUc{KBY)J4sGpI`s%FgK_TTFc*)&fmkVsxh?P z@8lzSK*mv(rh8zeH>;7_w|$vaoO?5xCvaN&Nd=y}o%XBp)}80LLE|~>k~vFgOjq2_ zqb$S4_;$`1-=}Oj7dvj}(IYBacV?#QXJ~9NoA2b@OLKTyQzKAHYDNApn@4@4JlUv- zJB+xnJxb(x>mcU`(_N<3^8CVxs+j!)^%5^AVe_bI^Q2#mP1ZTu!z`-z>Ib|grZPKM zKicBliKL1I)?y+y!jl6%rkI1K6OSJHVHJ<2dQ9ucdS9l2b8q#!hckman8kD!e@YQP z6QvtfwEi40HmXYN+Fc!$#Lsmy58cYO8(0_GS=U_v?UMoGP5K@yfpvF@%&`))g|Bjg zev@7I!MKCXKhAr9%(<7=XLb&TUT!Wnl0Sa1dbNgG#7AZ^4ALK#17*kaVKh8}Hs*s- z;DQl$qej?`OBAvbw!L^j`oLpRrY>B|tkj*%O8W|GU%HJ)nGZGe|HCS?ue#mw9lw)V zpSoT8RkvKpEa_A2P5g`P@Y$WrTBkDGf4g%gd?&LOPAl&XkRH6<8SfDlC-n+;4hvy~ zROttp80XROmCWki7wn|D4POcCUcf^#0drv-2Mqr+Sm|GYvIZS(TWxN%*u18P%8a2c z#<}rZk}2zywvZRb%^Hk`2bH$Q3^x=FCq7{=7Wm8RhwX>zMcN=d)dXA~H#wkjfyUV~Yt76@C1Y|*k$**uzbA;OA~3^gkv z?)x`Xm&Tq?{Z`sK#<|fl&Vy7(6aCTxX-x}UY)k(c(PoLnEEB&~v-x=Tw{A9*jbIkC z`YLKuhmgn19Y0!?bei!!Wn1nGFFm6v0kaP)t1dy?e~7%I^B3z|l$AXmv=t~Y@Fits zuM4GWiCVNr)mq8kV9(#M{(nqxBesEcJ-IK~xzQ(cbeQ*rmR1cbZ5@R$dR>S}T2%wR zF1(&Qrypi`l=PDB*@$S0^tI5=@?cCcn`sWUPl@|_JM7TyfLc;pEwD<==Kspba|3F7 zV0=$mSTUP(+kP`6d18;l6Jh7>{woq!)=rZiIwtlJqC+pWLGAuF!=tp1Z3coUp*`6% zlupUDtH#vYo#ouSTtU!uv3k({`JmFa^9VO+t~=(K%~emMO)qI&uN;wen_xDdB-wr^ zv%Y#OkH(J3H66HaxYz}hnB|T-y3|oa{ms@AH zy8uZK%;xfZvpHNS_BWeomS~>=$xkfg(T56|{g94cvV)lmy`hB?gQaRAkCIJHzZcN& zYWaKK!pXcGlQxrQA@@GH;iVnGT*23V1xXak@)s?X`IqP&D&(_*g>uiPH8y9nz`XpDW-!!J<6Wlm;F^?XUxiv&g`%L?4 z{E_G5GqG&4y5*>*BvK8qp_%;yn_(TeSl){dJ3hR>y;%4&%KJjilX&Z59;LnG<8zc8 zly~+_V#@(fd?T93{i!%P*sh{^KU5q~ zZDv-AOTS>iEE|0oc4`zNcSGNZ#Kh?pV-%qGuH{f3x$9%|b9#gvcrlZS(aV+bi-> zTAze~R>Ju!&bQQ`yA$^X+O?}0>42?xi=myh7+T4uXpmQf!Y^UP-IBk@hj1>@RT zs3DyyoM$%EGvRanq0$yEfH9`cPnce|l>Tp=Eyr~F6}EC44T*()(d`O*QyALwRjdH zKJt-#L{bkkf#bhX!%#ZIjnL^;OUb_J$Z#W%zB`7tz6mbo!JLra7ykYaF#GjU9&OiH zJ?Reb4L<2`y~$l#xbq!*%59W8PnR?@@+LVjroc}xL-fsgz zw_-MTbMB?F(|Ud3jH9QOGpjxyD^p6QF1z0Jed@=u5g98SJHeB3TwZa9;5)&S=}KnN z{3;c&QkBf=(amwQuMuxR^(& zUI)oJ=e~L40v_$FhHbi$q&_IB*}r}PkHU>)Um5J&J`i7g+vx)w9J;;&$tSL}Jo>5% z57F)3(_F04Pe=y^+EBpO@0GS-A~Q^UJwG9IWzCZq9+vd{sEn=df7|(M&KA0ILim zhUxfYGytug6I|Hvp9DPFyj*4xi~=8PkxAgE}v?0{3Q4^!o?amxA5 z@tV{Kv(lZ+S_BlOUY2J}Eitola0J$p(>zGJl@ou}oEo8doSSGrD|IaBNXmU=ZsPfK za&AJJywjk0Np;G3-|O@tc4BJIOPoG{o(-yzc`(aFt}RWAq?W-J^V%ur_11YXQX{5? z;SGmU^W|Ezr81}5H4g1Oe1=DBRCs7E>Hm58%pP&Ro67K@gK?JlU(Pd@k$v&QZ2n8O zeXXbcX~9mezFios+C#PkAYRpeiumYyNK3qzF5!e&dD|2Re&VZ znT>qd3;@|cCciRHDg6VgCusIoS|cCPPUqyf+i2X4?{g#7DcdI<_Wk*vju+&iw3_H& zSd!gr_uo7?(8BEFzhKrVrus-_%Fgj9 zJ*U1lX-JN0YT^}vzsT(OX%1dw)_a3$08t;jY+gkH0ZQn;I!TMHV+Q`pIhU*ME~6~ zzoad(j!v(Fy>^@@bN3f|zw3X|nj;%2pCCrKeL6$Fn)1EMx-%~kQ1~CU3%zl>7 z;?*V0R!Zdj9Lex#stk5)geU1;wp_J`*@{P&Ih^6qy8+L}VzhOnNjG4&Qot-_Hfj_w z+g~F1Tf`}*WiBFmW~a*pZh`P0PnE+SpAc~@GS6X=Jc|ewB6!Xv`(IUp7s4(WyiCry z3uYOuN26P;VgKOxo-$g;Zl}*U#gjJ{F)NGpl6_C*h2ECo(aT9MA-Vf5pVXCqFf8(9 z2K`QK)sbQ0PZ~@KKT65t-yP=BK9avq8QMRX;*^0b^XM>-#&YEGABK6$HD2IMh`8}1? z|FGuxcNe1OXq_CtCeI-HuN#*6LqPNMN;aqRhOVzwN*#pkq@O5e^J#5C;Osc}enEra z^TB1Z9cr7#$@jy$!f8w7j@Bv@_f^VslCZ|&gIZt?n; zh1barP}{W~)oWIZ7$0i;%sd`NF_L|Sutzl{7Py&hYRn4hnOfS5lzg*!V?OM@LRb*_ zoJ`C2NN6|K_;-k0vm?yvyBikSyM14jG=GiD+5b=TXiD=YKAb0G=l(oT#yytnu*=4{ zmpeIBe#NGh%A*=K$orE68C=+`u_?}m0$Kj@pGe8~Q}VQriPyQ7HNigQnX z>AKKvM+b`hl=IrGemt;@)=o{lG>=C^b6}e~l2mVC8MEJ<$D`(aW<4?}@Bc%a7w+y8 za(ixq=gD#0;Edx}^W>RBb_|>eIs4 zxc@KCw~ji`sr@TX^XNx2&Xm@wI5Dgtu=Z3*BsV@Kq_TQLK}`qO(~NV0tAFqwiB&eJA+brt6T&~_GqWN)FP3?XPT$oiaFKJ*Zirv1ptoM6 zz_@JPy}NH*cW>q^>+a1QLEg~MfMAgV<2f16(d+^|q(A+fb7PAxF`#`8Zo@HTULv`! z!`wEgsevk1J@ncvnTM^3SJmBDBK%XEi(qd1Y7MiFKy7_ZhoQ<`FWc^|A>Bj`^gwO> zV4NFO$Qz1}bK~g`+YjAPn%DV^&g^G^=i%8lQC*nWuGys^~Pc{%bsKmGNu?QT$tTRX+dX;a=efX{-~W;L z2cLt@m%vWH!Yp$Yv;3$kOZUL)xQAK%BUpYcEKBcz6}yXc9)V%eJglReY#gQ_spn6R z&nU^0G2=0yH?@q}wvKM<$Ga*#Rby(L`s`CtLw)_{3aLN#P4J{y$E=t_&)W}0D;yh1 zk!>8;(S3THi~EuaM^pwD;0?A5!2E_&awo+lhPF zChWB3uv0H;k<`~Hn$QB)#m(q7HbE6Og;8@;jF%uY4He#OP? zQozGB)TWm+d*CfGuP4)Q^;G(y20B#Kq<2WY8uM>izZWo4D5y<;#4JTcO~d7Ag9@W} zKz&d?ryFXi z%s`zOx5Kdxl9tx4WIkN4`EM-Po^==Ql~%-4@AiFZXF zW5Ex;eAvW0z9QJMGG_Va!=f?xs;2Ythk!ve7!tm)%u{zKr0_5{SHo<$}hfPL=%@@x5IK`%?~9Sa^LX)9AEK zG)Z;_D?l=|h*>CLwfBFLS%cbw#HM@Xd0#9KrN^{+iKcZ6%8qL81nC#!<2)LBw7u&u z{r{tLkYw3?p-gWcv(q;Tyov(@+T274==AG&{d=|Oj-`1p>^80H;SGoO7Al=j0=<3r zt=^qV@u2YG0<2yaUQgX5Wf{pX1#>%l)p?z%dzfvhm7VFEU_ZNG$}{>-R;KOMq)hXn zvh$2KKQUio&Wd%2>F9m;zqpWJp?CSD9K*Z3F5STFZ@=Tq_)8E;H^8J<`@6DkppO;6y3(P@t)$V zgCm>L`qg!5*V5W=7ostbDb>zq;(#6af za_QmaJQ~W8OBm(GHHu zXns%0`Hk7$T6!O{=ZOB?zk)}p+}+E0v`?JBRs`;Io~>NYqrMCec5v?fP9?MdO}(&u zd`(67F%1ddTRfQ@yRghV_5f^>d%vNw4=_7c0z395Pkx7F-%ZT6fVkkb0x9!i6;kHK z7EG6U&t_$wg5F^*FY!gry*o>$%eph1dv}#cdG>|3{TY&t9h}#a9Y*>)-H^;eG#KEl#Wk_$x%0SXFJYyRV6+8Ly zuPo=$InswL@yT)?y+~l}GrRk9%rZByuCRjSk8Wj_a&-Nnxf@xRzx~Y}jXC~f#x;M0UbzF-`R})^}r@A})T-f1<+0S%z z^0_iLq%XmfUX*vDfSn>mtLQXUcV~xF zURBKgMkoh*|0;b0WDZ)hfAi;PPr6iA&-|1IBTaJtMJ;mrBW96IB%SZ( zeLPD00qNhQ*FCGkU@8ofvm_t?L}OXPY!>6mS2*{wR)1!{3SsxeRCEsB=g;^VA|xl2 z58DsXdThGSpBZrSj8MDj2X2a=(Yy)LnMrr%n`v#8&T0B{R`+}g7OkaOk$I`3h}rci zM10!cWlRmddsNue_q(n`4bgX2XFjY#$oaW5#zJ;*co~ezek_wZZ}!{fonn8l5q<@g z@|=wJ%L9PNxA~uUDW~Z}n6*K?$tR zk>#PvDOo=75wivq)U0x3dHtZwmz0&|)tkS(dqBUsZeZ5Z+QY6XSx)uT8M1uihO8`i z2g;kym*u5RQkGLcNtUnr7+Fs3NLlU<=uPL#a^5&4%gY^EZn{uI^*VB7c{R-DflgSb z8+mk~GgmIELY7lMeA?1UJ(KG1)n)yViplze7pTAYEH~txqdV|!qxAL5_OW`52OGy^ z`%GP0NAwYs*uVX>7ZVNpv@d638hUrB%qClA6);5K7G(g>>d}U}Q=EG@oo=W*A>)Yy zduM!S;2aN{r?~MJ$ux0ZZEnlzUGLHSqN4Raz~FnYogta0f>}+R*A6&!Nai%H zo05;zzuPz`nruExbiWxE(b}$RM0%SLA)5Q)eZCAmGt1Da>af>JytlTaWuHB#9Or^J z&w63ONo2|TmrbPKa-fBfz!kGeVc-m8;5sA&D23gZ(xv$wQA+I4&hvwyqh z-i-eBdovvR5YcH<`=ed2u34Q?zrH%t19j+D1xAYxk=0<KXH)wFke2~N^`b|S*b$Qgz`|E%WFF)xWQCMZ_=gSq)c$b z%#%D58<#xuX`<^HJhP&aM`L5WhT2vEPv694!v6CwlJ+0zSc3jXCH*!QIChc?QZIM~ z){;gZO}{c-FHp{L<8q?k(K(`D9dPVLTl$btAJZAhn|sgk;H!@Pm&=~@s6wZ?} zWEtRTKt<~_hm~Y)*F@m(82H#GEc!YnL@IJ_L@;m6aDZVWJ}YzXB&whf?Nfw3TGOPUm&O~ahUJ;e!7sm?i_Zho z>|d=a@rMeTy-D?UHaWT;6w<%c15NODnyT6<@-NM%wNnp-X2bsBIIqdxcaFGu^f=Ai ziAN7T`QXKORiWf0OtZOnlUWJX?Ejiu`t6&eJlVT}b)~eqiPdfyiqf6W}3=c`Z2yj%rkXte_4sHTeiJJrAe zk@rK!XE*=BJw2yQZf=~L=a~KCT*1lJ`N8c|IYPucpJ~ZlcoL(K>QLDuTm&^B6-U!qZ%{J+Xtn%Sxm~)Yj zf$WlO+t1AC>;Ind?bl|!f9dw=`A!Pv%6mhRM`dj`HX3gb-KVOUHHlf(&boefJCBYz zdD&ySxsB@Vn(@8t^PkLketbqhx<97g_dn+O))~*Y&Y8-k+A;0jug{DBIIAHMoW!qE z6DgJ1C}#1^s`gm;!}de&60H+!!kLut-zZOfbhU^Jujy9jcJ{htENiZ>^mI(CsqeWJ z;w=YXaz5-jk^A*TKhYwd=-57dH;Y%nJ#<`wp{O!%+|SB{-+|qyN}1TGpx1+(TwgOV zwAP;6c<3XUBIIzn@ZHqe_Zpm%s&E2KeWzleht?G z7Qb-;;v|EQo`)f-B#6fqP0G!GD3jP+F((&BE*6^fm+>V2mGda$(trLNWdZ};COTI% z9Q3EO$ngtd1v)uB>F-y{q#Rut=@wjBmP36nbL{1KS5o}vi z0|R0ltiDf2P{z@f3xA!jaCt`~;u&@HS}JP3xf*ejONzuejVJ}MH<8@ZnT-N=fcCoY zX)suUjAKG(?(pCDzkkB!dLipUjb|yhugVVIz0p1UFI2;aW#ikbq9UxE#WUT z)xYbV{`s6dK?1{0!@(^nP2}|&Y!O(Y(bSx&xe5clRqcq=?`kkx)e-jrf;PjPi#&0* zxa)B4I0QBXgpW+vSqmyJdE-~pc+m~X9}>$zbK*kPM8=5?wKY94`bpULfY}?>`9nJu z;kyta{ut286MfC@9W)2&Y|j5_`3C;|nc-4_;gUEf`~l}CDzx%WpC&QH*SZiHa$*Tc zU%ya&*=I=~wDw;Bv$OPke!q2rliQ=t8}chKE{I`}vqmDfnB(WQRxR&LsSStC30~9f zlJ}r|`9lk>w_7R5j8rqPm@hvh?S?cxq;L>p-efLZMvB4(~<0`MkM`?C|mmC z2G&J1yjMjpt#yYAd#=vx&QgIvw{mTvjN79&<^uMMKuv1>+6>91{|R)PoCjrGZFwSB zj`8IeMPxh$BB}LDGBPGpNgU(c`(&Zihu$Y!9cDk#EK`xZKt96+bVhU-4HZg0I?H+V zAs`tNIMxk^r{Y@nJ@e(#?0%UOTjPekS3zTc8V21ve!x3c)xDuj*HI{@_hb(GE~SzE!ZO+c?IeCgmJ9i*v(S(iY) zb&HPDo&vNT2aHuvTJN9WMx%~WAM$SvS4g~Ldj8&9J=>4{wr4x_=d}}$9{Osrt22J$ z(L=B5%>GVsUS~(K(z#1#c0gzLYK7L#Y)&ZX-KT?iwDc*ma|=+qx&qdKrYAZoNFRi! zv4UCm0lkIdycM2X<}quPqO{&J!HrL2R%alO*}v0a--v?F*K}q-qr+a52m4hWHuaC% zp>Z}=2s{s)RWJ+4zqMcF>ANspD=ssyDUlkY>qW2+O|HY-NxF_{s7bxmQ>o}E z4gJyA8UCZcGrhhhL;T}*=o-4&|9?sxnXDm6a&JgeA_5=7g_YffSozHjh==|&l_QmQ z-{3?J%|NX>e8$0z38@W-Uvi<8cyT~050Je0fb-}8@u}m>Ol8c%srTue_l=M-f-<+1 z+5AquTAm&sT5W+B~4dzR}XI&TnaFUB~7q@xkSYWb;vp ze0hrWq4do%`?m$rec7#~XYF%n-RwW(_=vo(DG5c9`q;62C9bryuBR0ww}8cuZARp% zrpDh}PJgw8%;T4zz$~->(IC3ZM4OU-@*J$>Y@5{H7NX;J)Wy zYU{ory7K_f))E$16g{yMnU`X!x$WF7Q|-^Xd27E5C$@c{#7^x+!GZ4-|Ht+{P==`e zzW~Ouh9CE*G*{w=wLd$R@+$FT%MlrrXPBKoePY%Q{ZX_3r|tR<+W*|2Vez@2Z;X3G zP4RhamdEEmxFUY>x*OtZjX0l+6kKxC{e_>p`TpXXPv1ZLx?AoSF(ICw%08{?u=_KJ z&;7g-_lDH?yfs>U{)2k_;&plP0Sytg26n+E`S%xos^I?OnpyYHzOL|ovJa^LYf7bV zu1xUc!q3BYhom0#p_4C4;5vPt+3pat|3QUE;Qj+Aj+aOq!ynQkn&Q|<+N#6ny=T+k z6CKby=J-hFz7w`Z@pPTO=a%U@`sF24@BL0b=O5;j2_aKQ_Rtx}rl4}aXynnos?1$4 za@J4UX9C02Gc&&1t>KAWpP+SD$vgItszj8>nU&Tubp?4MHZMTWybm(FVk@(rY~;~O zFpF#hk0xx&C%S(*Co)L9q~gR;;ScFa_&s$Is#jNpZiY`jBuhLp-c;4^RBmXjo=KojI@)f$yIQNpCZNAZDr7}DiLSKJcQzFDmSw2cFg6(r`ZGo}-hHCv<`VjRW za_kgc$4bq_%Iv!IjG-;`qo(!QJ#>u%W03Kv8)jLSXQsum&Y#jhiKeP5Wd5k>cICf4 z)4{oy^vW}uBKG2x<|Upucw&M_vw6yYy#(E)gFCo|frq#gzoB^&XO^Iw>I_ftXo_?1 zA{{F?jzQ!i_M2GQP=L0}6&P6_e~Dd~#|3sc%>E|d{_TFK2?bMmnX`3$Dw1jevsNnw zb$S7_2l=M{9%w_PJH?pHkvp^9O+f9Boo|xt-dZB(eeI`tbVT^PGrLLT^im(o{bsd} zm8<^7IJSJuIQ)V)_H9?mo`-*0n^if#)2F}u%jsjxkpY_#$>!%hE#$jL{EiEp?@XP8 zVIpk9wLo_+?^9poIZbj}KHJoOk?S-{beDcgp7jt9(R%V1VYSej3cLCDjtqHG;*+~! zpBW_GU~XbkK4}W+E&X?s4zizFJu2FWHrP6?tO@$!CYY7f?!bP5eb;{*ck($4f6zZn z=25G1u%N}f=~&q?CgXfXjL0Q>w*x54p3hC>>=V8Tl4U=St7Xnv>{P!JDVf`)`Hk5; zI=qVJcUSYkW<=71Y9zH>vBa6YlSeD%X2PyUtmmEaN8WVSZ;~DoGuJ13R+e3(0nJVN zUVzG!0^QklYLhZK@#7h5L;WwHeO#G3zk2=V3+Eu#8)bfe6R7#1f%qJjTjELwrk^oC zH$^x5iEhN&G&?qHK=QOZp_Z8aKbS4CFo&1GN-cwR_A=PNTZ!(o`_)M5CWzch=f-*T z<(248Er)e;soCGLfpyV1V-nZrji26}-FwOtBjb}e0?z((==}XGhn86mEuWp3PRqi# zn`hx8%;nrxTG{%4WDPzk6hHR2~bUQ@-qWOcCY zzLnDSfRvYJe>PwC%pBJuuEn9TSc%!cYcaa(rqS7XzTHkv4K*<+@|sJ$sL3`Jv)@;0 z_CK*0-Bl&HCN;qg+Jmca&gJXY&J#A+R+n58YOCrJTtoY7sGW8F>830lzv}qD z>xs)Xv)}LR`Kby1GU<3}O&9d}@J)g*M1GWPU#Q$)h0J?#x^Aec0*mx11wkqck?ULy zXinR|xk=gsx%vIFGIt|%aaT;X5!qU2m&<*hX!AOtJC=uFs>R7qcsXke14dtwxowEn z#rH%%=|Cjs3-Zl=H7|CGzIR&qv}bCoVz?&e(8UqXy=V5*_#omP8*a+xwV#`KTgXW# zHZ12`iXy-DPfq{oTbJj{G5x{0haAv6f!z5y<6vO_8`-|d)RFzFVN)~d@c!rLMDiim z8j8F}_|~*_eJ;LHXKhCvTa)HjDPZff7?El_>pHVvjpW7~+&T+}$k_r`pDI8wrKv(E zDkzlwBsoWP(5Q*L%G1`IxiT-y@_K^y(&Mv;Pd81~`#i4cP+$x%Cz+5Z=;Gv!S-Ozr zY24X$raDOt!Q)l8igSwhytlfa+p8KZwSId?7`-^UluUUxry=Ac5uZ8u~Cq;cMQ&fy}X#&;=KZ+sesw^d|-|mA6O2N-|ja+ zw+48G{eR<>{ZG8E`OIdLm!V>_ERgL_&a+1x9V1sZ+^kQR4aaVrZs*ebterI=&U5g_ zpK{9h;aRK-xeQMeJd0`lW;=9wOhe+R^PNGWm&tGCCCIj*w*F(r_b$J{_xf_mWal_L zrW>8Jpg~PZsFU|*BzxugK}ypS-z%25&ujAJy;OFri5s&z;l4@zB)6TcZYg78wZy|t zJ6rQiM^?yoeso?tFU6A3e-|*@L{H4#2pfnAv-v50U*_P$X%m#W|0m z-`C`{qZBjygr+2*R-J#BD)a*cn2HlvGdJP~tAFqcfpy*6c>Oe6C?^+_<6H2*%>Fe+ z&e<&IN%dms^E*^Tda@@G&NG|;?h16LfL>E&^@?IPSG}gRnJ}AC(oq>wCEmo&Vzc?K zD@5L$B*|9NNgHAIS7-07RaRfMMQKYbFrK3QL!&v<5@F|kA3js3qI_`&znIg`IL$}`tHCWBF|`Me|XblqU{jS%M`Pj z%8GM|2Ny?Zjm7VS!3eFh`2Bn^BG(#Ez`Qad=!E9<=`YuZfS~x^_a)}<_lnT{oWs8~ zN4dTvr8M`NoG+TI)A>D>!VhDP*<5%9x*3pMtIk`TowvNnXBREb))Ck|e-i%V25vT+ z*Q!EK59Hp_-sR|~VYPBG&8@nX%Bg|1YDeXn3+ANLa`GL?yA{DV7n}VL6iGdR^aql2 zO-fA6-4i$PXlOmGkd~>VH6yyrT~{B?t9pTXoiUfa)rfRg<8_)-n#XVU=f!C*{}w*9 z`Z%*14=#JtZ+>=n(>kSW6_nPP4nx0MjhJJrw#F3H>{+J0c`4Mz^nXZ`|Eu)Ba-yzd zY}M8Vpfv>;^n8SKZ^sz6`X*#Ni8zB8Q?~A%;6c&@iRNxDHv5$lsi)KUs(yqQ{KB_S z7kNI#KEt{9J7d@y8sovgIyuY5J^s~dgnoyqFJtP~eVhlw%86Q{XKL49GBt11uEc`Y zgnm4Ae*2qgcj@Ups8>puy;DIl9$$`p#taz2Y0D zWKv4YxdU|itI(PuQy1Yp8ZKvcXrc5YBmJBDoN{bR#p!c+6BA?dDKJ_BB8S8QXG}ug zo)Ed^_lY~1+2l_H0zI#VvobHU^J@}4zaCFf5Sn3l?c(06Z$ zYtTAF-$y(QiN|wN;@?KP)w!KvfqTd5%~MrN$p)o0JaaqgG{2f@S5C&6kIaYtInqmt z^5W$lksHT8tl~iG9zA|oRXaoLO-tyy8(7!P1#(=Etq^#)Ltz@%cW;P?7Q$AbbcR(` z;9^fd%amubAtmz?&B4YEY8;p^WctR1uz4Zcm*{h%oku29P zk$IW2bf29E8h;8Uwb}WY;#J4*&N`X*)va} zGi<#fUNwfe;(@I!fK6>EB~q7}mb26u!vQWZQqGeXE!7v6HG3zxkTr6zk=Ty|b1sSx zXnJIzNQ)0F*CGRpU=QS(Wdpau8kl324crNf?17ZmygohOygv1hjn55Knb!|4GOs^+ znR)%OPny@ica?el`%BF0k9udv->aGvXF8tya1@a z3NHL!j2j#JQJ~(Hy^{kT?MJaD|9^s6Da|J_>*)WhneYP=`wEa$9G)jW%Jz@iCEBTK zSL0O+rp{WG0%ms*f9U6z*S50wMyP_`o1h)225c&qTSnEH-2_F%9Aw9yrP~Xgf068^ z_4Vgv>c++;<}Uw(t=V|NGEzxLZZwn*xi*ow#^H_?=mOD(dL}@4C=kG7H_| zTImn9`dVgJFNGbx*7?7d+0`}DpQ-`wp)g?3I|ZvqH zx6Fmv{GT&??uH%u+?%D(k`;$?b-3S-^JtgI(S=~BY{enl!Ib*Tc-E)$Z?xsPVOm?s z+_uVZm~88v$+o8Z+4x*yuRN#}H`-wpN!lkzviC>ye1Wsp3&h?SB^`860lGb4c8!AG ze=9(@<8Kp~p}z^gHuL+;VoIjAqnz2MqX(Fd|Koo-?R8(v?7uku+%nFiRQ8OMLnycW z>rVM6C!|mFPse#w?0b*PoFid1Q}>X>9uMT|9Vz9)dPk_7*-+5?kV7w#ad}_&dk5e4 zBhsrK-9+dvj&4%z*qYSF#tFo;GW;PRNaOysqfB+DrR#NaA4gckxMoC zkW2VLMi@K?`c&AfU9hvfzi{&IBkRNe>Lh;-I^%Af;L-QQIg>k)9z-OxOO5a<*!%Nk zuHb(Xd9qb}L#2Mxy*z9p; z`P58pgO0YxH5iRsndQ^5l5|A26;_W60^@s+iu!5#)eL{el%^(rIVNx+161cW1xEO> zskTCo!P-48_rEvBBo=Z7%;s(vR-V=7CPI(Vny5pdJ~(qef06Xv2s{3W3X}srv0lus z>Z=)wZeU#_)#mn;gE_h`pGRrUx>fJ34H`}!R=u5ow=?8|y`_+?C;FzfAJNJawEo1S zx$CbiKv`NvJ@x6Z3z3G)(H2u+)Qs|A5#R|GiulR{sjU7!F7ASAkEnBn9YJzG1z+uF zf#eYt^*=f*$NQr(9(}>l5l5Z;P5;WL`&baY8V8rXN$b;Ht-YRIA7v}Ep1ecIl(xTz zjLTYf2pPnUIR_=eY3)M}{;aQ+pwtBHD9`#-{f0U0llREZ<%|cHw>X5 zHQ`e;b;K7Rj!KMSqN@?jok%JWxe&SV9lE^kTaehev&VRJqv{`iLR@6%py*5R2U zpPFaR@035avbVJMx~xu!7qMV{}+Ziuf!`Ow`@ z{BXO1@=o)+h!1Gx393u=sLoZBb;?DZT$w&a_p-m*ZOmR(fHs<|Kh#Y-&)qheQyUug(l;I6yY&Z4=yBT|m0G{QrQUZKX2=*dLvj^IlDy(G+p^J2h95 z9^P4m?hy@%y(+6`Dh^`J+{l}Y(9IO|{!32ZgzttE)0Vq-Jt|Jd3fZ~G0AqWd^b4YO zqvy&~W`At8NBE5G&vS6L#(7e$mS@s8(wyzmBB48+v)}cw#QE=PecHM38$jpt%Me-isGapyT6RWWBV$z|Fz3i8eVrgqj9DmJ(6 zua&yxZ07iujPtrT@uS)codrv*ad+Ttn@9V`cyI1Kar$H8B(vvF-rJb%xtiI7E@lhg z!2F)=yHxeSQ#z8QJFZsI+pQranx)+?L`Z)~sm#vSc}|6~da;Z(*aRedRUFvk!pT|V-1s>86IPjs*Mx31XV36L zS28=a3Gvg8u1IaGs@Y6ss60wGIcM^}J}>8CR?e2+#_YKsX74MM^0rr14(wB9j*K@I zk+)A^pzSY|c?D<;;*MX*ykx4(>T%B1OchqoLf9_ABW2~>#DI{MbB6}T1zvjp$HmRz zHi_5T;lvDO@0_Og3c2s3=fFmeT>4qp%cJQcdG18*rdtr9{tNvG zXiLpuw(og!`>6}ickX=!(Kb`@Jkj~f)sn`y)?QfdWN92vnf<@e&%fhZoHupH^>p>$ zzT?W3H!03fAk`2F@6sYM7kh4!=TB%;Jb%I!36ow(vMI~^54t4pYwkq&O4y2N_Jd#WzA95_c$?n)qj%+E){nz_~zVg$H&BWPd4v znR7Ngc~77ultscn(DBz2xk~$KOwX%iTe^qjn0mfA-8U=OMnoVR+jjTCWp9!Va=2Q1 z-M5ulZ`~oz00n-1Hdp36RoWqacfjtMP}&N}zS<^yKU>KjnOqlTYF#`){abfnQrDiD z6D;cs_$8UAlx)dsIwrVL0C-lbO>w0J5z-^#3hkMmz;|BY(LQ8qLsB-DWo?P~IroOk zneFTIb%x4e|CMuZW|0z+?N=loenI;2&25*yjB@|2NL-(Q&A+ip=J<~Nu-={{`jYOx19q-Y zW!84%n@b~Enj?F3YRuZCto>|B&-Tgupo?JFxBvgx`}eT8uIqjn|D3ZA!$`=M1OtNx zqL~53b|!9o5eTsCasWATD>sftr*$HyWe`qFMZQ0Gj1$Y2A`U`HRF9kJ2qhCE{|b_o z#7yGWbs%QirWz#IbwipMl-P;mRx=>mvaxG)We$Sb@3ZzfBS04?Pv5tFzu)J1|Injh zW?$D{d+l{!^8V1{YFrh2X0a#ImX4ugo^C;Z4DpVik{nzxp~}$OWNA3biel~Ziix(p zPju7yz9JVy{(|wS?jYW`AhMbj2-{78gn?f&lIIFz*I2cugKu;0KEqbTvU<#?Odi!G zRBW~Pc__`J)IYTN)$Xh5LpsZ>H#1vjiQXJ!cz>IW;a6lt#_X|;G>=}+qsX!Oazgf< zW;Tw6zNQMhIN{YFUc`Zd*mtIR^sJ15ET5F+kwTAJ`3c6}>Iu^4vCQEI56bdlYSRIW z=c3<#a0ie2l=Kg2EW(|&(>z*cpZ`gFz4ZR?$ktlS@cyPp)i}0Vb%YNvk+UOTe-v@z zJ%~5(1NnX+&?FZ+{Tx7wx-qS9)P> zviW?&LHU~e{5!EvpW%YGUpsBp3j6PV!_F4|IF^{<&kGx027TCClAraf zB^N zvg0dc=)n_L&?m4PtQ?rCT)k%gzQ=NVJoO5e+qqT5+7n1Wzj?80mPr=8{E&x9ww$kP z5cYh|-J4gcWseV@1NRCO<}{e@3o znVzM$i0HNo)7t{G?9-|#e;y=P_p2>1eV?9dPv_|Ov5_*L8oz(5l-~on)lYA*N^qat zo7ESJd<5#8jjbIBzXNFA#}Q{Y%f|gPjk{k!*0%+&5EptWVdLFAqwH2hOswUz@hiSC zf68UHQq_tXO99#t=h60hiyzIN)jd<(?N=~D>$!Tq94Rp0HYZ8xHHEv?_*sTZi?=CU zz^`39#iI|&sAzgnHJeB#eR=IK{P^Sa5nxZfeyveX@_>vz{@&j)+JRI4Wjni@9uzv& z_yJh8KYC=T)qkjCQ`2LJf8jATo|v)pVdYaiI&S;moctf4H-F)}8qX}xlT)Oax=b|_ zw$BdH4@6M=)&U`Pyw=kBJ(p4k}>kfsy_+11YdR~{S)0a;-}Br zJ|^@wX8DDzP3N4QccE&#yuayjHBPYDxU8ppNJ_5}aeB-h`=Nbrx$K%y0j+ECE8Pp; z5y5x9aB)uJFFMX!{6$uWL*pE>$N8nOUlhg;o#)Ys|A90AjOz-%2fx9dx8eN%JNCTD z)PLQcw|(l$_B{Do4%i|KQwRYr{+Mfim_;3B{N%JBF?RH^Cny z=Jr6a`<*H7K70k((U|kw68y@hu4FTf&%-M=FRzId%f>mFOb%RV%jqLNT(|k~=g(R9 zW{4H$`a8 z{yp8@sVbP2;L%i-YU&CGteWMX*v%06zXo2BRkKO>owI(r-V_x%=V8syQWN_~)FvFECfk4Slo}`smMv4#N}cm0=FaFz>Z_ zs4?aiHPvbURrdU6SxGEwM=d?a`{{RYOGR~d&d@napY=7H7VJK6*{Pb&a?Q@c5)Wmr zuNs`R-cIctkM88${gkYln_DWXYniXL?kv}`upeh~tX|TCpShauR>q#*BZ?vNh7cbh zr>hF=I-buTQ4GS5q>Tqz-9yU81Mdw86HN-)dfD>}Y;5k>XY92PWw_S9rJ|bJ_X1k) zt#xr-@~!ESajGr9r<-IGT7&=G)n$`{i}@=opTM$tdDTen`rR4JM>CsO4a<5qQNMpn zTQq_0?~l`#U#!sEhw?<8raxXq@50d2Ng2;VRSf&Si{HPw3a(3euSw3MB0tk@FzbN+ z)fHBrlQaDC{DgD*)`fMatv6S`%qDk0hPGL*>wBn3H4n;iq!F%(%?w&d*yM_0*XXSr5*F`rUlY(B5BZ@T?hy;YCM z*eA=P?&v0-iRvVq%9dPd<*U+z%|)uYQ)a^ei;VD0^r0flck@d2uI0B}#opz#?On^R zZto%<`!ai%bD_O!q0Li@;VCO0T{+K)`qXxwu2C<~2;Rdd>QfiQZsM8f)off3A7n;W z$1MB~cqVFncE@CgKDv)*q7U1;;V-;)ZJ!Q3Nc6OQ2h8@&vc7&9=0iJS_Q_I#ko3B6Hqk?=LnYsjwsMVMRk4mAA!+aWb?Y?Fq(nkUMC{%nB}Jc*|PhJGg%CQ zkG}~IU$gOW^UNi9I4_=s@DLaA5HVn8FY&>cO2`_WTN;WymYci{n;JI z0yb{`9GBButeEtl@C?27a*wrqh{#orHG_}iA5!(Scx=mVLB_}iZO?eX_y zW*+|L>Z2zzHvaDXjrbdH%H;G3{M4_T!`qhwb9fuN&dAzVvbcK@Z|C7`R@eO}Ggqeb z-_9)bXD-;T#{btj9!>oKhRBCT@1f7m^O5Bjm*Ezbb1i}N8f;g)eo>u`g|ls=H>vT< z{kIS!-u7Z{n{t>ZZz7pnji0&6ssWYFanqEOuDa)p^&WmfmW;s%RWtsW8h6R)*JZUP zVb$o0oh!w@aaJharIejJ=G!woD)Khu>cO9w)@LYs@Lx?HZIdN~&f=|75w9B?xBar| zyQt__5K|>R_)jK}KJpmiTOWk^M-nP7mASHd(%>2E?S1vqJUH|8sI%LiyR6n%Hb3Bn zk6N__iI?@hB#9jK-q)pYl0iFg)7;&-%|qN&lyAH*%nw$u7yb(C+NJ`)8IOE+ll?MKSed9!>t48b7c^4~BLS zJ{QNnT7rGOz(DV#j|_@hsL+EIH}h!kqklh`-P60XJo*F9-TDs8uXo>VsyV{ByW>$+ zQ55^|%N9TJ%vmePDBxaCUweiOj}@h3TVi+XDU z$N$!{>qf5WOEoA4$;qi))|YBvMyebDzCc00X3C-Gr`98$TB_%#?m=AOsawB8@JG7S z_)YTkc-OUkZ|q;%_tsZol1%;HBI2D!{!6yUM^FFnWqa&8{r|k}amVQowmph@_NZ~1 z7ebaQ7vt0|tMBW9B;rf07=Jm|dYZdC6c}|bn4Q4o^15wDJ0@c?w9|P}W(b9dn9 zGA6USM17}Iyd@nhUG#i(>T+Ez$R8b6k5h+#=vk->KGj^gh40W?@{lsQGK> zh#*{{_Ae>=D19${j@Dcuf6qKW%sMH(#;&tJ8aAzX5p1>NhvxZU{>dqemdiFjMD0I! zN&9`ae`dDdmrh+yQ$LWN{+4>l`E=B$;F*)l=jdoHaEj^r=$O05Q@_=_aj~c$fKw#L zpK$khc5d}<%mG}?vPTB(cvhDJJzv>_IPtS7K=a-#;$Y%_c(UCii`<&>&v1 z+++FO&>QaaVBf~``f5=sUi)1Il(es^>G3SF)6#Mvv zOf;FJ2NPRXSGPGJ@D9T}$+!)KXPFwHU^$vO98o zOHDQL5naGB3W^NkULQJVwd zx>>G`*l`PjH~oI0k+sR3E0>J(_ezGmMC~K^VVN2i@x8_R=)NU-@Lu$u?#)Mh?CXli z0liDCuTaEoWMlu?%@)lyDlI;{S58+^n-)6z%TE5cHMEKk)&-7uvD0|3>p$I-&dz@=u%ZA4PkA{*$U1 zvi+j=yl=_Ap~tNHK=XapKA+~%(1WVk`$?;o2xRp4IB-joob`Pwh<*QkD>mZ!5Aai) z^NA^l?YH5B4DWyM5!ACGqO@Kvefr*A0uJvT3aEk=Z zr(h)HfLU<~e13Srg3p)V=h4?h{W*C!BCIQA?H@oKL?*?%MgfTg#6KF^F1z z>NCX4(>+M$vS)M$p1FA$_Sre{@)zRdOO`&{_P>}mGggg?4DauCsLzaxd{h=+NaL(r zhJ99jf$v-IMYD7zZ-wUUg*{?~LSs*AA@8?*9KiX17)jaD7KGxxzfcMKx7 zDA{mrn)(nOf5c(mAA!d|xAH5k!iL&)2s`uXzF7QM161>3ej{KKz1JAHtEsvPSmxX9 zivZqN)M7R6lhRe88)0DbOM6w2?4!p+m(-7td{%CA;_tto;aY>Dn#~DcgwBA*NZ`^j z)Hv}V^ZPB~bN$j+?WaGI`Y-iUA3644o3G}d|7-KrJpbGFyL~}Fv+pcJA~s+Yhf!(nsrUf1U>CQ1|BD(*F7cmdi8V>M_QIui%%Tcp`X$A@=1b4m?P_ zs{?xe^^%_N#IyOGP|eLyYw8o&(6|cW-vhLS$p4ztdV>T_+MZkDgEOxV()vcA)%WsO zJk1J>PC(=b$;Nb!+v_2@V>8tFX53Ik^KYB7*1Ky-LH@3XmgOH(P}vT-b&EoG;F&&u zDK5&~8^PAM%Szay4Fv(&rw2EW?)01!xk4dw^3`uwyLOwI=bw%~-!l==;Mz z$$^$CN!;NpJ@CnH<%TuKB_3TZV~=0P%k(z*`-_aWOp!6xuEx!4vAiw6qx*$Nm*$VN z6~eDpQuN^WIFF__s^*x`=elA&RvyvVX4}7dKj+bA8LlGf(^ap^c+e-~Wm+5VE;5Rn ziwqR#-9)pq>&3lA#w(n=|Iu2@%NN(OugGZoPLc8N^sdl8&d5gKVIGxAdq3%)$wUbb z(g{59HxiHPuxibdteZTH_-9zjt+ij3!YMa2m6hZtzlV4?ZdjAtsG3*>K}V++V|n`) zgm){@dVyyF$@mP@gEg#Ry^O>i+3(cSgP*L)#Rdt9J33_^l}md+S(}SnB+fN49@H9d zKf*&xpe0wUrl{#(rJA(P#&;8p)L}KgsTRx6 zH8A6K`9t}1e?3WW^)xGtl{hhSFh>tI<>*0w?@o_2>8++Sfzxe>wU#9ANVCFNB9})~ z4XRoGQm8uhJvCkq7GQ2vf6QsYoZ4Nlh}7>OJ`*y}(IwWqOfmv}V6P+7AYMlbIftzjj@N&dH| zffd6|JJc>Ds)lEFs9oN~>WLrQJe%Ot2Rlcvri zAo8sw6?`q-X^ceqkHkN?9MyEiUQ-zeeq7b znX&H#D;0PBwG59^+ZW_z!Hex2dhm7no)yPZ%p=;poZ(SL)I8CHo8`jw*> zm56pP+T+pZ7vuslCe8a&hDVd_B6hYlc~JNKqwv)(4A6bb!j<5kfF5i+sC&l2qpE}o zafYfS=mVYOzeyG>#2xwz>kiEvR^!QWW+?5Qqi;2@iu5pq)4h5(!HW9*MJ|u_ejI}@ z=FZ_q4-KCDo`zToL399)?WjycE2R*W8x=rNo|i5uDb>r!6!xEL0W%6E*|#J z)OYz6jQE#Gk=lfB;&<|)VUN1pFX_Q%-m_O)GUO>8_DB3nq&({LBx8{}Ne@E7@^K~w zysHo%S`1BRYFu#+c{+8ermqJ^Yk19odBDk*YyARevY2C~|JG~ju zb{%aTynhj@b^(*S5;q&a54d_BM)+VpMs^+B?IAv~oyik_E&AdIgfVxbhcl8!8=HA&_F&$=soqW!YveIy4P{^lb`JcOG)D4b}Pq215a_&T6+TY-3sE8b*J6M*TnAw+82-)0pz?g=)rxQyUQd?PS_1KzWBpOJWgrR;s%N3b*{r8 z`_i=~Z;D!ltfXGS@-8daaj?tEVH^Aw=WhRYRzh(8F6VCLeD0bFKw8&fh8c zcwYo{qwn10==-QtH~Kcqi%HU-{Wak?16x1Vg}7h(+rJ*qE&NFPbS6sg={4Zd@!UWB zh^T?qrN%oM;!ldXOD6{QKG{A0e2|L@!o35FEZl1=A{r^T*1fduwpIr;Rl)L2x!BMq zWBri)q5Lm8i>tEz4;^V7d?6o|go`%=uKD|?y^B4nA2a@ibN3-&&n`HP7lf{u<#jN` zQ?*Y7>)O8iAmOGLQtNK%gYV3^$+hfx5Wm&)FW$j+Rw~v)xYy1Qr?KcvbcXmlHcru; zoAR)s&4CR+6KCoyp?lluOn932prn)Yie9;RxPg`2>ff$*wGn-vsqcb<5iCKZ{aaEv zl_&CzP2f{K-Ch(-6ujKk-Ia&RUtQa9jBvY#A@8%SU3 z(LbDSUJR{Vvf7NvERWt4TAw<5>ASH)yc@U8TJJ_JL#yv8-Se>wchmWwWC%p*yb@)R z1H^Yd?7g*JMr-T^u7w;}UIRUNP}IXl_yl8ydT8gSzq}bniYuN*Ud197m=J8Azoz{q~TNp%$~#z6E_ZVt%fOidpUQr z8E-YwD#EjM*NdFsvHzH{^jtlxWI~dl37$x@c%r&;7|CW<;{;sp8E>^0o{5(@*Hk7A z*TN%U?FS;ntI-{mAq|UMPcuCFP1-xNa(4W)Jx47{CSDSAluR@+4EudO-TXR)iI$Cx z?(|5IBEbG0CGIbp`yf(w5PjK$OZN^(oauwa*yNDhZz?f=aMw*qxX0C&An~X^{ z&uI{j5G|0O`orl?$+CYo$krKdw$Jn5W_UE&pqgW=nPK^3BDQMQTJMSLEVz7YhDWCv zVp$$>x(tTk6PsBL;pY&`+EzURm!6&B(S-b=e4rrE3sj_5TX7upTi*=|xkZUM(ShDbM)hBxm}yBd$Ko)B_SZ+CZ_>{(ARq4oS&=!HDuzF4*g%ZDLb z-*CR~OcC^;;7#vx8zl3rfF2~7rxbed#8O8e@vEtgFsC=F<|}e(p32mk#5z>aeq7WS zYRwpP1;&{a^D7qrd^Weo{(pajMFUYFnQ&YPSVdPl6$eE2W zOYm%dh!w5h3eRw|4RP;L-^9DOLz`j6fdQajZdbc3Uam0q$1^-SxE7Uv?oew!GK3Aa zA4Yh$<(pOG-Gi`S_yI!Xl_`K8ybgMh8*A^58jolkLplsphz3M zClEd`66Rgs;RYv2I;q-r}>&Tx!~5b%(ea~=WcVB zR}#K`0~jEg~81<81+B+tEw$(V%v~@l#KjA^V$JX^E9jZyR zH*L>d_bI=a_tPy+gEU@znpYM|=%;a0vTBYYT~#)3+-lMa2+ihJ= z%AuP6L|J4?)B=RD*2X`=v2R?k{MVlre$mB&V(9tb7WFpd*qclW&}V{IFN5}xFR5L$ zPokgF){hK+$gU5*XxXBOFGuZ5=H~VF%4)p#+)Y))SA7Sl(3c?Jy9D7n;&Hcn@;9Po zP1~bO^E(u2L+$GbpZqYiB*`R`*BJP8(^jE}eA?1O{-K0{BD*ebk`)Cm_l^Ilo!8wR zOCFVt6SXkkj39nwnnzF6s^*&!HU2v1?k`;61E(|GeS8VRy)rZ>(b@Y{^SFX=LV|YO ziLfp~D+1ytsa>)CeW~^R@ns0tz0O6SBB17YhP#I>`-=H`hP&_Tmdg##i8oe3tnC_D^paDu#9+P(d)Hx$1y{>QYoBJDE`noB}+X3vE8Sdv<_9W=0AqwH8dWL zMPsZ7v|8b*ryN23O`xk#wBz({>{{2#sksX)5qy5rYw3q32W>nK0?X2c5c!r6; z^A1%{0Hy1TkL~uHBs};8OfQOC*Dr-u!b2XeU@fV4Rf% z#)OTcQ1E}Jr+M_vPpIb3cB=;a408oi%n>^=&7=1V9&lcJhaP-$nnzF8lKfvRzN7bg zoH+yZ+sU;s|AT&CYsEPvg>B3k8xdm_1TUTY*ffvcmErFG4_p3>hd*q=>(g?24ZWkO zZR&G(7hvBT46%BKh}s&eR-LFM_@r4*APb{^;M_fZpK5N(@PX@PJUjhvk*K9Bi9LB@ zYv+w|%7!uB`(%6JN0Lv;2A$mueMjw^WupZ8=rk*hC2L_4FF`VB9aH0e2^Gm&)!bA7 z<8udiH2Di&C9#rWwq5Na`S}R(9NX0A+8HLCg8wLt&4)SdIn7D}-8LLvZ&$k-S;>TRmTRe6tDfrTr+IXYb2r_w1G8L9-jujwoD~G< zTvPV^UDG@|!w^ts_?ii8)Id^~KH9qi}*LcNh+LNG_ZG)18%Ju+G z^-7km5L?>@@e^Lz=72G6(@~;hSXL0B?+lYislAlp+8XG=!@|GzyK}nYX35CLfnZ*Z zZlNz8mkjeLGgL)=<^=P^#_gJooagrG4m`uTvya~c^T}Br?RBQBLSIwk35OL&-+9uu zd&+9ujgtJVe@*CC)lBAKfZmMu9dh3nKc<@PD`ASfPm8U*Pt-sDHjgH9ta{+txl^L< zbU{qF^MigZ#jUG$^+H{y@-t(xdX&_{n|+bh5JHjnC@SGb_(zh&hO%Kw%9{{+b$68dX_@Bs-G z-v_i>CvG8`Lk4Pc09UPoFeGTTORV~VB32K0MC928;#SQjh&X2`>NC6(BMf?wXhbp> z&y1Cjd?w<7g5HPQ0BS z#N?Ou`W0+=mveW$56emJ`YS-2|NAQFLE;0-d{|C%P@5YG-*buo@JHSjeENX}{-E>g zh!Rge!w{>3YNpo0tSeUIsR-iI<7#}Y0j8g&*GP(L*2(DSUq{>nJ;+zX49RMZ&QO{B zy6~f|NV3wH>!f8fNixqB-uC0-{2X*fxvJSa%LhEr^Urebe(fzDO@1A5`W~}a5tafh_y<3G1UL9dy@w!KE$PsaFHD_5tjPBR`-+qtyFIFmSz!z?`#_4FZ;vr!B zvv%a#xiRPU`_~ND^k&u6k$zsRMZt)k3zI&dVXj!mO;+xLjz6>FEJ()k3HcKyt>GU8 z9+t-5xzWl4O0o*cZcPqL9y#E^#dZDSM&a*PLv5NEH0nQpogw*y*V!biHKG=S46UPC zH9L@gz9U!E;vbKVS~wllo)@9Z`G^Nl=8Z^ryNda-bh3A^pz-^imUvu!_M&%`g2 zOwgo2BRQrR`luUv@J^DanG{o9YBft>L;EU(7cGM3?U%xJ^gqL?6q92l$I<;2Ip*6D zC)^Absny=6rLeOAn)fa#>~uo&-YkWaE@*cxhvr=(g>^t{Sq9CkNZ|v^piw`P8SeyK z{scDEu0ojJo2IQom6(Wv>{t7w0za>(eb?A(~V&7G^M#la7yMu^Y%*N zCMSg4N1uoCpsjYosDPgTh^*EmbM&B(VKMRTO+t@Wax2M`wO^OQy^EpM{(}@w(Ekre zVSgU9qNNkeXcb!gf|uRY)ZDPas1kfZI7PH2w(nhoXSLxWw;y9+I^}K-ksrE z1@zIK8+VTCWr=PtYghI>!ZkAA%K&szDEa$9`uH z(b>rePrcaV`5WRRR*Sm*!e=Iw;nDLM>y8l(`1wZ{!Zq<5?)=qg(+AzrzslbKkMiid z_U9uX7*Z;%wTo^F5kA2eDC8@IQbMal2sxuNh|XSULpU`sZ5kV#cFDQCWTW@ zXuN#sApbS1;nyoQQ;cYXD)Keg6+rVjQIR~q97GE{JCsPhA{}Jcz^TdC3G9$SjX7T|h_<14! zw=pAmFHGKM9P*9m%ubKqA+5J4~dy`lEmU#9(yumf1Ax+Dm zrS7rv*)*Nt8l9I8RERTM3ayA){fX|=7@KmtJy*lmkJ0^jfYn&BTfg5ozFsxIwx376 zPW)ZS~@0PXIT$V*`7i%qrVl89qA@WY%KWXFgBJ_`~7y0^Q7nmG7VXy0zfb|}y z83q>cGRnd=q--4Xy%efWWO!xvPSDyT#Iv@pttJ@FA48X}zK@O!uROjK~C!k~~!}wN&{fRLD@{W5SP43Y1&EVSAdNU26Du zuQY!2jUaZ8dWTZ?(m#>IJI@C-?yEut$pEF)R@7Q94b(4#5n`6_^2|J2&Xdft<&eC5 z;a-?y_hxN5a;zR|ym24GzN{_hUYOgMBy@y8(fZ_m#2@ALU5!V56W_lL+BxP4>;wAi z+btX3)0{`UYlJN)p0(vXZP{|-BpcL`>~*X4_LB@kyaLJ8G|y&P6>-vaIyThW_MFe! zYe+sN8(Zz#E(u3^%?~BGnjLC`bkUwe zzn7!;!RA#%9>#O4ZfB@$wCy>PqQ~BJO@qY8q}mZDzMxA=ubGkyZau>a)-M8F^c~Gl?`4w%l~@L&-+_TM%o9l3 z=SgSj9Yk2l6Y@peOKVz0e3%+X0vo)m5I*UER<^`iQ->qFCZAZ7Uxne*8waT^-ras| zQ%h*@0=q3h_;P={cjL^xs#yX(*pRD_TK)%fcAz)b6VFx>*jWI>?_&G?cg@*>-gZD6 zyLZkGG~}@DK)KL9?VGa$y#To65;ZO{%XX8su@GOn8fyISZTku*oqZSDKHkS0m|@vgiY?np1o6rYkDiEF`7G6?H&i{z)cF2VROm}B8&A_B zXiskQb}(fs5}V-?XI=-s=XE;P9O1@Su$6&fFwv1b?b?r$GjX>hsC`o4Fi;gB);ZRp)E zerk=uW%V>Xt$CU#pMOXZ2TE{jn!7#tH&iU%t=3ZRu9~0T;n&=sefj3lL5?pgD6an^b!qL>=<> zr3fc-pk?h$0~zk_d0qT|@;I+tM|&h9vN zU`uGQ=~`5l%+z;{F?XO{E@>rLwH@5=*)Er?PqEU#r!zddx!tO-PQTS=cyvrI2-0tV z0=VjITg{oJ)|l^c?tb#9FEZf3a^g`QMS6|S)EZwND%<74)|pP(Xgl}~56$+0gJRt^^(@!)ZJvDZ5-Ciwmhj0X_!jku{eQuM4JlR_ z;Io8Fs!8`$1+?d*Jeul~4Y9xPS~Z4Kvst(o2F|eps}4K$+fQ$FVe4Z@f zU;jZ0tM7BI=Vwwl`3~3EyjYkl|AH+4(kx=kM6R{;xMWOq%7$4E^8_o7jWf5fU0AU? zg)z>ZeZ3Am!|#Fl`Yey?ie(pBeDJeqt;@I#|Tw(f`EKl%>IVQO5x1{Hpf6|;a`HGYN_$BGMJ zlzM~>rc(c^ov%)YCLvMNLHoDmOc&IeBy$Cpdqn=}N(n^Vn_oyD;xOUOdI4XD{$I$7O_H$?w_px_yR^5kE9fSC2f49~Zj% zPpD?WY8Yd+w!Z$W^YrzfnA6vn+WAZO(EMK&wGpe5wW^u=>YT2g#z@w}B>dK(nqRit zlH6IF)zjC`>FG&+qWQ;ZPDK@U>+2Kck+E8cx{9e*HSS-cl%!g%^M8nQ_cSYs@dps! z@d5h!1Cy4%K9pnW>pNtdpYD~ybve*h`-DGP{#KGXa`Yfn zRF=r;HUDDcPF4@~?gWosUnYazemJIgii*QIcs z0*&zF2rx;wl{*!xpM&2nmVZQ+J1zGh(7is9Lk4Qw+zPJ zfQw{jf(PwYf16j3OicJj@T_09{Niuth(Ciq`b)d^pnzkm8Yh@S!E!4GOAk`}vGp*M zt5uWsl_ESpyWoxg6_U`-(;F@MGLDMZ;i9SkWy-)nuJC-h(`XS8+ z&e%9eGU)G5@aP!H$|hgak*AtX%h2zgk-|4DyMz{Zsd2)Sl)J|RAm{@Ez9Li-9CcW* zPhAUbzYKF5(4SnZn(fW>NDRgRTIjkiA}h3_v`A596I*MsAo#Otuu z$VGo@t!kDlFhbk>g9L-rcj-LYL{>MRTx|KSjIV`BaPp+vkEyv3KFreD9mhys z`q4X?XmTm~FW7q*JXot57rOK=2>c+NPrlmY@d2%bCxn}{r-T!gwBG|J*IbJ*a7~80 zYaf!r(lplu&XF9_kFZ~Ywn|asCxD8cha|xlmnRwrd%#*x0vgH9V!t%L{da=!9ITb@ zL$iYA=j=Q>hwXcknC2So|FDcxw6~{ZDI)SW-J_a7XZP=Xi$}3IT}5qZU%rGdl3Z)y zbTZ8=1iaR&CYD(_0qWCSz-m5>Qg%$~L+@mSUsvKi-cLC4L(bg<(*gSq=S=b_?e!Zn z%*X8Y4Z%8R0iQ{(y+X3htks6z&+GEAT#_;AfA>0r;Jq1o@GVvxAb2Y>CSO#__UH8W zc!(#V`#A3I@uV4I1dAbAAKmq>>kL`OWc{J*jEDb|N2%R-12Z;bU$^DIQySx~FhBp6 zl@}I2NtL!aDjPZ>)y#k-n;iojaZ3Zs`qPNq3CCr|*X5fM?o^81QBnZ@s9?An4ZQCm>tM1V`= zDR@ZKSF>s|J~XdSin(KpKcHVo&FM4>pzkeEm#35C zl9B9!ncSv6cUXp~MfBwoOa8NJX%++)uJ2VV$NW*rAh|EaxjW$y`4@~H88uctRV$yt zo#!oiI(vS^!;Lq<7-N#~gA6Hn=0$$xv&+^3_#-HWsPS6@kxP2Y%JUF(-EGA>+?j)Y zs_+SO4Ih^aCQ{55JGQs0JIUO!F;)=!&fA%&E*C`h$wiUgQHZ>W{qt+FE`a&M91q#r zH3VDQ)5Y3U1n0Li(a^jc4+74gS}Wd2K+ivWAI#)i#4i@c&Tb=^TQKQ9Z^xL=%kgmK zntswnyd_+v{nnyT-1(<(SozzCX2gi!vT!cm$*j6k z?RI@T;Sac7?P|Ac+{rFcQ-1j0t-7p#mzv?)m0+YhRI}OD;}P$h1160>aHKpkb)nWX75cGcLynPbh6$fOn*1{>w??vIX*$^~5uGv5(0jT~eXd=G@OS;0 zXAZAjcKq@DoG83ukzw!g89Gy|4n(0ix1$#><}Vu+eyq?(_i`R>KTYTtQDHeL{&c4(*3L+m@}_W8wGl3v{3DdRYak$=M>~18DfmS$f}k;WyIzm$UT# z#RYBu`}4z%2pTo=KQ>=t-h6@=KctIX>V$KnGVy{|o>=P(ceUqiGG+Owo@sw+Q{q6=I8X_!Zuf#WLPiqMcTPw{|j@E zu9Ni9tIWM$v`Lf=UuEv$|6S&upSx+U_PqTj3q2b|jW?4ivDFd=To?27x-QEVEb>EV z>W(E@aqR3L744_{<71+hYWRDAre?U-=D^4|&uMNmiiu;h2m)pZnb^!Bw?vug?Bxr5FTP5VK-Xp$9`}!|NdLx7I!)m_`;pb(=@tgOw0m-L)$glCgfDokwPN+duV-=0x9u zK8n>x-fs1gm#BUB`(Eg-UuE}MHPkIHvHCPB2!}-epYLC>mRpiZA||!!CuNahpFZmQ zWm)#LZ!W@r zz@Vk7R5K~*d-0R%$P=t2LOA1V38g~}!%s3qM4mlX8q?+4SA3#A6yekgA=}Y+y>fa@ zaUM3zuobZaz%}=Kf%sj|@TxIZ6tH5M+_4y+_g-I`gM}>EIpiJh+T|jA==1tW3=xJ%n`U9BL34%egdYhsKS>d$)sVy=QYd1$2wUq z3!l;HdtfF%p_*O=r#d8P$@QZC=fHjkDz3WjPHWxGJHFI4UTet>wBL%>=JZ+FCE~?< zWsBba+bq}G9SCn@2qs_c@r>81W;??cqH)Q!syRh?LGs4d+tW|x!bn!BW~IoPgg~2& zJo@`?Zt3dE8H>qyMdnUn@nw0Bk< zyVE|CH`t08?dgOqgN?JI80~M&t{Y;>^zIn#o%Z}$I-8@{jMQzH_Rl|`tQ_pK@iCik zKH2W*>rl{7Z$cI1;jyEVk!CDLZ`kv)J2K7W*qM8B`_v_BU%ijsQx*XVBC2B7JK-OVs7PfuY(>O&+sVq z9gqtmfchNa+A+@E`yJSjlnaOJe!VSS3rv*Dzj+U;y@w$w>(gE&ViA6n;ZdUXH23^< zW&57Z@aSp5$CQXZ1h;21Ru05}kPC)CZ|5-m|7S!EgaF}KRCecy9Q7F<9gqu#&oX!5 zS)qrt_SKu=(dc4qNUc^)TKAV7*l->3KTdTtwHiWqcPPW7>aQP8&)-i-MugVYD`R+x z4JT^*IPHOG!)n!hgSjulfMAy0%XJrJvXa=Wz5YoiiyG%A7>hArPqTWP@yFtQ`ERy%4-+7 zROLYOqxRbEypEP`h6!1g*8M9l$>JoJ&+Q|;(%Q$^M^%x(fMo7eMEoCVljQ~bu;gwl z4;_QP_jSR)PL2}1g&(2)Kk>85-KyCMHQo$Vz5qPC>o4+!e3|RigE=>==3%gjoEug1 z&jIZ#Tbl=8lu-E{u*fbai{yL@eeJ-hb;atmayLv}f_BiZt=0>*#s^ELq;(vJ9DecU zuX?`IQeNGxSawPoWk6aLti{whH7=TmQFqG#!Dtd@)fe4zSm_n-jUCvN!h9gL9jpD1+(2txZ)OfieQ{9;n7OT@~cj^ z5o|G>{GRy#dsgj4Ir4+c;B4u&_T|HPlUupfv$*qP&Z8Aq!JVU=M;Bd!JOA{5(s@{U zJOV`b=}dn2w>=Zxaq&z_^M#-Gf-~_5+$VZ5cP`I;XzpB6Z8q+UbCIrmE`n#9JC`>s z`EBoyId^C5yYMgeXU@6%0_W~O2V8S`C0T5zL_CnS@7y;sZY$@#^*6yreq-+J9+Kfw zApN+$6!|?)^>k8#ra&KUhceMCL;G;c{ncMlVC1x{sy+<4b%;T0hB6E&kvzcFOuRG6 zlnRVmr+OL;+Bnd^3Tll4)bv1ZO=Y-L4lk&u6%H9aQrL zam`LbUKmY+Uvq^&=LDJ=k7bVt6e9K;<>keo%`Hd$9qnHd%LoKl5@9T z#6_v6dl|HY4E+phO*^F4AsJfsb3%f)YP;GseiYBW`Rm;0-aOuOde?Tgzp)gj-iByr zc7px*b8tkSLiuCu3F$Q9VVN{HUXx_`Khu8d6^x9Nj5^E3zC^sN4@SKYBNKMc3Ti{^ zyI#Qv!L^a#Dna|Q0)w^OU;Spw=c?P`XiWeb{YL-$TJEn7!O}sTU^%ffc8#qW!Rz=( zJ`8>I#Lr%#g^W0QLexbN^^f+JL5Vb?aN?*F+K>arX2q)K|H|IZ?zX*p_iGLqDUs{k z;>%Uu{kwl9h=>F0{i?Ccf?4)lIMkaw2aqB_{MHTSC<$ zcTDNWj~(<4b?d+Mr?1=AoUVr>R<^A?J;b?tOfHHvwA^1kwk1^EZr51uL4l~bu}bV0 zu3ZYPk?s{@e{bD2tpG*CY0ljQH=hFG|3&bdB0flFk?*wJU;W0G&DF<|V~>f;#vHSA zzH;^XCC?mmvfiFygz*p@%7 zmRkO_x)GA79r7ZIh5<+9N1VG~RID0_?J_BsSr8t?vN%88Mbu${`S1p8f1jQl(2?oO9l9r7VScdGqboa$iEb~@CWT}xo-vRc#m za$|MLR9MF@E)wq4xMiycLeX>#X&(7Bfv<{`YwrUAR{@KbiX3e(* zBSYEwfB-&Qyiv@Vk5hFrG<}^qxKmc+a3(g@I}@Ack5_k|Ypa%Fw+tiC%v=9i z&fNslaaJI5BxGx_q%%Y-5j!Y&a>PzBDK^gJST-j7I_P_^hdlfiF#PfDj{O`Ck>_j0 zc*YG#KZaA?dl=HhK?RymMt_Rs2w%r`U?K@j&;NluK;S?C&C zLe&TCHV1%6nNvMIl;PSgAkqvBhaeAoOL596K?}_^9270GY!X*(D#-v!T$FwdOgz75=tLv@ujCOt7k9Aj*VrabT{VfqUfz5y54BV=n;Gz zfJ&z4X-gB>I zfeo=`fs9R%WHT*syVC?@uqU1I@k?H2)7{2G?Q}Bpt7V&{G<0|3KoSCOd~ImzL7fg4 zl-w4&YeAAWXxphLwNoo?24iTN)|n1A32kROMKX}kIBg9C@C94v_c`ZW*|Kq_v-<}h zEa}{H&)f5y@AF>CabzjruCwoX&a?R#I5s#;(B}iK4ii*^u}c0o2mQmpF~q*%)BcZcK6>MbfO_u9Fk|9LR3#Ux`Pv z&qt?%&>0}g<;(f&&*u_mOs*#r`g)^du{@9E?R0P z=PqcG!zkMWkT^dBNg3}|Jvb%%)Td;hoUd#xgE3+6wYs^bYW3!pst#y^t~i~vGFBOe zcHhl&M*PDI)Ww}|E6CU?{h-y&KtOlUYA77f7x8=EEa`ur=$xjZss3k}{r zmNv_wkMi@w&%Ltp?o<4Xgnfet4)185EH=RjXGQGUw#6X#1Q&eH_u z=U7`E@60JDr1%W z@A_#b_*;gz{bY)TG$A+SL|U<0$P9j)w{cluwaweg(yX7$FWTnTss}X~t2dWdHQZo< zvuaNKG-DnvfBw?8_wjjfI?T{g8K_kcEz*KA!Q(m4;&;PgK->${ynoQ@7NF7xX~W~+ za~#b1E2pEw8v3$r^&t%-MRp7W-y^W#Rh?-T=pjYpG|fVsmN{+jUMh8Z{Q1tMBKPZ-+G$DSZ)epF{^bYo(o7BEA24Qy z#aYltj}leHiFQ8RT9pDSy_?Ic=GxxmIZ|xh0LMu~3i|47`HRb3T&6t>1bzerxXi^d zGsol|$k_tMLSf_xzQV_sUf>S>NO~du^6I?W$B5qoL^%!fbM?QHX;~9V(63wgt^6>V zHai{;R4sHbNE?}~Q8xgqKvci$8zSVe;9XP9q(EO0+{6Dd|3`c%&CF(kNciD!6(6q` zX!8}!y#wa0dqoptrlfOsMRxx~({pLC2-MoBNS`d;?ptYQwmclJ;_oAhJewU4`>Hw# ztoh?qYKky-?afu-AWkPYHTI%;~VPM#CMoKqy|uJj6|_#u%%-F6E_(I!X+- z3nOP$7&Jyd!Owp2}hV zoh}NWpRy4y@13nDGjh6+zd0rVCNM~h>&K=2j?3s=KF`Qg%b}0n*qU>MK8H_W%i~qC zd<6Vk9&X!3(a^kf+%O=Me z^QfvPvT1WmmAWNd)dO`)r<2PbQuZyg< zqN&Qa^6pb~XLu5;j~!4!_rZbn&;6o#@;Fh24?X86&z0>u5GAVMFIQAmft7~%*cxWlDeu$uws1eVMvF2{3Tg|MaNLe^A&esfC|mw`DC8YBqCHh-=P zC(!8iq3uPX3!VLZMCJ69JDxOqO3nZehc$%sK{Pho@%fx)MeYCL-Ql>J2xMjh&X=Oqn`SV}HKe@K)5jtx+Udo*19gq=I%`OU3W9RG1Fc!J{;r=-!j z*k6hNSIpL>)VbWZcrIq0i@9g<(i`@38JzxaSGZ zp3xqVE!|Q_zJ>3yUoR}vMHINR*P7qKWuS>J8{_ja37l`QPm93!bI-#@4I>#ph!~-Xu!2hd z|J6L1&qF6PaXC+5>-*-*VV#5~4y9ROf134W@ce~5S(lMNcRr7qX9%`*PP0(I3r5r> zbR#3#xc=Y%0InbAxPI|GT)(4rK;ZiAv_Oo>#$G&gRj}etZ~ji#~j180Da|~!vm_q?;u1t=AepA16k*q_u2Ze zPvm{SJacz0jN8+kp6qi~G*!3%57E>8jG4`g5ee@I5Bz7b`{VYSa{0bo#2eB?4cvmB zvfqUQj9jzv>h%S6X_)c-=jXW-GB!q)w9(Jc_CmD5&;R?Pzr=$6{n`0gIW6*j`F_R`ZNm^ z=SqFjSwbSu?`R!(Zbw+eTPXtXx<3%_QYaCxit&3Fz`M23B3@M)@6Mfzccc6C103^S z6?QFIPxjDacVrI`9dsh#&XssKN<70o#4{c(GY>=^FiJi2rRdeCPF+`v;+w8Lb!r9l zQK}XVd-L@1zf};DxVc1}p>rExeF2D`+d!?bgX3P_u5*0NRTjFgB7TOf7(ZV2^#idT ztpmv%1e$lW4siOVIS94FGrV=N8o6NOTQ@wz#~AYj=HOemz<_}neCrnYmSfNdK_cJW z@!-Gx`yNoW$OvN|PTL~_uX^IGE*OdiqefN6>weEdhj)Yr zICgE`9v*1Q=pczZVyP?RegBtOr-3nZn@wB)w^--lG&7a=pE{*4Mx^WE<^hg(IQ{oL z>>r2`8Ar+c`z>RhKjVB#+K&?)YuDNsAj69+n+EwA?NZREfhNj96a0*FEdN3L>q-{? z%ILZ>eXri$I-uEn^185rDdSQnrVMvD$#}gos~@8ZLfP&4ILf!T45-`71~N7depfH_ z9wqCU%-W}R&EccL?|2YR=G7gkJ$dI_e*IGe0Evw4!dgGd4noN1D_!OJaJ6bmp?~VG zQ!N_FYk64Oj=aS(m&h#7J-z_$k-TN?4Q6`XxOlIEkZb8|UZfA&)1qRGTvaf!pA0jU*_NtSU`2hl`1{>yMJM3Y?=l79WtlM2^X*0!`XG~Qp6j3uD?zyotO2zwj&CE=!my$Jy)RNgb++5FB>fJ~&Mw*|Z`mJjK?Zw&(h4)?D>83#GE=y7*UV;R{N{JoVsf_TMMOx#+)X zuYP=8&hvF3^sTIU_7GGr1KfOXQuf~Xle6#n?lorWX;yjlIE>8xw1{y_x_tRxWUat` znXx+2);!HZbN7E(tR3G&CCx(oolh@err#dJ6)A%zl1f+52Q21or$jwBYPGzo?;B!g zF8M+BD1fEp(?rXny)Hks8j<#Y4)Ipdc@oHS7fb#X0}3f@nK)@y;l@3LrLX{Y;nUk>P_InYP>9aYZhs&mgM z??0yMqb3mj=yEpW^TW?%ZReigZC{ksF$u%Ynez zTxIQ{siyAE90ZQuslL^M$@Pe>GQ9byu2b}&hF;g(xyo7}v^)_5(A!y}!jZ?H5jHCg zA^u#QhPG6ig`S^k>fWuP@cAip#~7>3MX$?&-r)1f6y8WIWC|hERe9t*m5qV&qn^L-Kud~YR@$z}{@BKGeYrxDn?56#8)mCcG1f4VtOQ1Zu`N0So+c>^Ry#ln0%Szf@C=?(65iut>3y- z2Smm`3@ceqtuQ8E9$caa-w`sKCw_*Y?VMT^AIt42Icw|UIsMe($y1z$Xudwm`Tm%S z3h&o&N3CtE=g(xf&$K;iw{03w?r11(_!G`Ao8DLMh~1(GlSO*TPZ;ww72uB44Hk+K z^x|Zl$R{A`dTv{_@z_nVRuaqmpa)ayGX7koVm209t9T_J(Q~S&;;e`ZT2_(K)&DO$ zS7Y*%G{MhOZ$6?nrj~UkveuV?+V^tPqodQSh1ng01$>B-W!GQ99YiG1$GJo&%>z4m>+{G&(sxf@fp z_*pe4eol47yG!No6zG$(^|2Rys5zZ^j?)RpgcpQ8p9r7I?B~y`xijZ~Gl84t!7cK8 zYjBI0qjntewkt=x?V`qs7@Hq@@EaPZ70J*3K}9qM1iS-ETP^gUE^=~rmSpiop%;k} z?1iow@8!Xr`Flgw-$Qw`@ALyM&L73Q3xw}#(2jFT9OH6v0Stxc!TPDD?p=`lP7&uA z?%FA}yI%O7WMpDF&bOU^Xq+_BqM%YKfI)~J^i4H&>vrELXgDSOSfaN%P%F&XO>OzR z_!xw*z$1AEf9E&Tb7P`2w(yLN6*>ASr{OQHWoC?^kJI}133`){<{5vH7T@iC{L?t1 zew$j`o>Gpqx?t4a{GouD)PZ*Jc-f$ebJ z^j*7m<4xb?*PpuSyOsCc{GGGz=I^wd-!XTM@X7hQ7;iBjKfVK}{->*$u!Wz*g?f=U zTl{^lJ`r}nD&hP$Pv-T_=vrztiEEVN*>_~thG1%64aj)6tWjdk|9$4!l{Y`@=RA4! z?DvXq_V1*sREV6h8rqV1dXQr$PPhEG2KYu)Oz!J}I?ge;A0$FJo^{^*{&M(62qyP+ zfQ-M$#{pR01=`)DLvzxE4w-*p5U6~8DWdb&C7f>R29&kowB+Y4geID{(@R{I;&+)U z<%!Y1PBYW8Yq;QbC-O@6GZ&8S~7?Hzn|oQgKd2yf(aIV~1^5 zR?+M718bA27H_d}nZI4+EzP=*w7B2CkLLRkiF|{lu$DP#Vp$FXeBMV1+Qv16mKTV+ zBtbsMZE2NJjV*oGT|0SZ1fU6mB_w9h| zSqBQEj0HReFj~@0-D5Vt=IfoZb4s#lx#o|jmvvv^GM8Eu4=<$&MML4SpJAYfU`wqk zF+j&sd+aVb_N2NzZp(tM!;G2y-G8|h(ZO_6x1yo(SXyFEFWesqs|anYgVC~-CdxDf zq%WMz_3`UzW^!J((E8XlxPts%{aeP&C+t2%O`0hdlJk)LykXDf4~_K+#>{iM%36MA zTO4Apjb3P5`~^KFt!a+;WgaH}{58fr&1rdOX0Wp^{de0?T)X3tI6Jdr3^QhWISpjz z;mpEf#^$r@bj0E7o?7D7B49mnK+*_G6Q2Co!GUl2}EwwP7R@srLg|c z8LMK<}B>imNRB{mch_nG7l(UzrUWAwHGq9?akuVoWH#&c$l(L z!Oc99p1kudMgMdaeCkNeN<7NSJ|@Bthlb<1mOz<}TuQ zz>j~PmEYy$3M1)(B{A%Cj}k@Jo296?|^z2%>L7_%k2Ltl0#|lEiy@u1^)U_*|QTem*Z^K7J=82?E>J!qDyeT(|G@*0TS% zcM3kfonAU*pOI|LkW}3>xZu-M%;Yjsw!D>s#06#B;UWb{G-GnT0)3x?Ir7lVI&pem z{|DB|4|$%(R7LXQ|6rYXzx??cVCJsi-?vO@-3?6YW%yc_*}Bqf%yg0S0Y%Q`nE5oi6_foG_Qr>v-ikn>#r)s8oA>i zcOaVjo?>v`+U7(w`8N^+H4E&jkAA_4=nn{j=hV`Qvm#$wNkvN3z+Dml?>D4<+b3#w z6bnC~Gdpg5l;hDeF0`d&Uisi-xv0E$TrrX=F*1A5#hB^KL*-*#()Rad#!N0Zdf^%O zFOs=;MZT)#S>N4Bt?+UgH+_gPbL<{!b>*P1cB-k{r=gMB_b9*Pj%hMqZ~$;;-tj*f zGh3E(*-H;5zl=ocxMJ{kHalc~4YmsjqM*Ooeuq^g{ON+9fgb!4V`iVwYs2E$=oyOz z&RkVQ9Y;|!1jSoUlb(|B?7iNYx!1>Xm9;e>TR>!O{(shlzexoJDlebeQGT+q@<#J?E!LubIx3PkLUC0~78#soTe@4VR>^4*_-ViObd6tI849{`{?(?cU ze&`c)pvKNgUIt}tQq74kV$9@YA%%L7_wk|oMGmROoW^V1@?M~X)2~D174Y(L+H1kr zp>~pmil7IFbLZ*gvT{C5@BE3)=N#g0=Cs>fAbq9Ev#?+7G{=69c(eW8+tMd7_%36f zQ$!D5SRglBrsmFa9mW+^5i!cF28my#nfc&yYQ23K9B;HeUreue5`^y3&==FB{=^Gd zM>SXvE{ApbGCzOIMQ(?&8k(q6QMnE1(}OU6pO(4)I6svBBvLOCqcAc&@B3-tLl8*T z(8M?MIbSAu$r>bH0JV~gd3p#g_B+rRb$#i8h%s}(8na_0%55I_^Xp95*Z8{pTY6z^ zSms0{-$VLh?T+8bd_9ReC@x`BSpX|?I=hf*w;it9_J!N&K%epznyAI(dhb`HE`+~_ z^V?KzPst3w#gnJ}n7!i`;<+4Oa?F$2r~L#I9AmomPYs0Y>JnVe(iMcBA(+@o78(8f z@}$hBWXo*Jgv_?@x|DM|2_}3O>VzENyFe22@#3~Lx|7q=E|6)jx4<2Ihx2_^`wOLP$g_}!*v?zN4|kto4L5f%v>Ugy3%< zslQ#97_?5)N^7ucTkovd5H`8Vr=n=n@TFvWWQPiA1!zrM)bik#nA9#F#Kn-&a)Re@rbm1ltmeg3=y10F3`h9f4skrXidta>eSF-HoM2|Sj#@FGZ*#sr z3K4TH`A7Ka`Xjermoi{Sh2&+j4#l$gpEG8@m}j>K-kcWq#%BkJ{@H=>-LTY#&rY`f z87y_Gsauzd zKGdB4oX9;S_0kIDcfwxDn91=<86KDlx+K%><$6_sso z3R|`X7y6%gQ=Wwj1+()&lvEBmJQcIi8SSZYJ6x3LQPZNi``2QYJIxa`YTl(-k~bPBEP9x z5)Z$bHg_&T-%9AC{BGjo_)B%gF!HGtRx$jvDt*1gd~~m|mB0%BcUkLU+iCU4j<>ZV z?SBkw=byl$MF@nsd{%)(cuXFMo00pX|cO4L<+RQY-vfSjnZ-3NMAIOYBou zO>*2ob73XFHLH`RMV!t{Oh=W?R293v-BrA>MZwJ_PVkKO{yNXxb3bSd;6 zHeHIf%ty617yo!{DVGDW7mpMgB-t5!nqcC=GSzqui;PWOFwUwaB2U-hTVjufEM^Y6 zCO7c0gqNT)xtLl{bm2&mCUYtmIblUb>``g_?~XIGgYU-%Y8BbC%|h`Ynfz}X)67H_ zwf-k#p8sjtXXHYCLgXXkf1j&QB=3XO&2j$WRR)TwwM@fEQpIpTA(4K9J^Y@reGFXn znjUNsaToI4$O9KyzaMbZVru!ZEW&>uQ!)JZebmZ@ z8hHmw!~sX-9StL|X&AWt+y}y&0 zJ_VKhU3?q|i5lVa`Z`$|$<3$M4mEdp6Jws-9NSmqYtn}&<1<~|&dd*6%nU1fFfMCw zjt(;B;k@Z{LKlU-xcwF*!kFj6Qhjvnd&CHr>50_;(G%jn2im4YJ~&iV*JFgAO%(K$ z_*ql8kCE;nj_aMWZaSAe_?h|rG&9>LSb%@#cW8^v$G$Pi%pd-qtv`Kul`-fL`n|?M z2NE#_fdczHEIQ828Wf!YuQv&H<$mCHvbj2=2e8gX8WY8)tBtF6puT zwgta@^`=_=HN~7q;X6L3{-??sn&9h``gu=Da|sg4N2Oe&tfrP!<`O{0Lq@z1d+!V!#Y$#Exyh^xFcng9j68fhPUsO zxrsTx);0TV+%D@A#!9FaC5T+gwy*hUBB}Z+@W`zjQH;WDJJR&dSLWCXnm&$;x8)*q zH503@lK5^7(K7_&ia5VT86Q)@-$C@?pA<=Zei#V+wZ_aM&_uTEFun6NG2i25G%=>2 zx9+2BjrY&WyehStKKjyWW~NTb`i$Sv5EZ^`N-X%592wi0#N_(B?S7LR_ojKX>mnna}N> zp?S5ggpOV6*dF6D31c3qgLq)l_nGkIe4Ebu3*;idD+kfkIz_DEU-LEmq^LE-@z>~Q zG(^qAF!8q%fBE*;-mP7gMwH;B-j!qYsfg|(nCK)p=?^=M@OyQMF+N9? zRQ%EQO_L8Q=s!%5;B8ypBZ+m}S5NLz5uKs^EcvERLt$MpTwahZN}7fEGuu@}IWNDG zbuR6FHl8IonbGe{{~8EC$ZsEG=3rNj@pmes(K2=9nJH#oe(H;-q(3ONYBsN%ZmyhcQgLy0DZS3mYmHhga=wW8E-{Z1k+WIk2q1{|m%%tn3NEIEF2Wu6 zs)+t#p3i5-mr1PkajCa@yo(tB?U+zT1FF>6$I`r&_}~h(fysWcI2CvRouth zG+yOxm&NZt#>~0APx^B9IFzFwEY&dew*%GdG<0sE7>}NIX*xI zu$pb1bha)*#AW2uOPr^EkY7&j0)9D}{sT(W;E^RVL2eiNaIyH4KuR#IJE@q$ksabSfjjH(UcE*P-}SjRN)+RwRQ_}l6Jq?#K) zt1c5dDw5Gn72poaSV&h9INAWqJD}Vla;7cOgQ}Phx(9Et%A3!vyvMcxA@5gkM@&QL z@>az-YwI>LypPKctO<$0Rc3kz6ybaJ8^$~uDcBHpaK1dTA-tF-bXz|H=&tZ$DbF5r zVl5wYww<4k(T-Vig_mdL@t!xfugSb!t{x}aYHzSmSkr_5!sX6h^0WtYuQKsX$pfChXHhKS) zxgBkTKxpQEoXYL~R+?45#^nIsCu4zdf%G#;s%rc$9ftOmdnOwSV9|V7UTEX|j{TDE zoqX`)uy~)H77NeKLaUM&!Av^KqZd? zy{;(HOP&QPIe$ss4eMWW5N%#ctuZdcyQJTk7euV1qI)MRbBfo0{W@FUhXv?+G1l_A zWYaevOR=b93b%Wzxce8Al9zf_w54);N}5!(1=?xFUyH(kR9#Nr1VwF=yZ=U=4p0G+e2VV%6aD*^K84u0%r)?c%S^e{_u*8@7i}v{|ERs zoKq3!^datIC)#2vLdR5&J88ndeWi=H>$H9GzC^G$_FjDg>g0M>j}boBJ7tyj}7poq4gVcI5}_ z*1J`NM1D4cz;1%Q`b2%gXOFi#Ums1WFviMd4U6n?>Jzi$Y@QkCs%$RtNKQqZ>oWabPx2^g>djKD6#t%N*R-Mt~XZwZSWIN4A8^_JRpRt?HrPIJn z9U3JbPB(Rji9F9lLGAZKT>AAeT|thA~BqZC%nc?YWE#Z+j@z7X)opdA7xp%HLJEoIIVPd z-e8qyGQ7){CtkB{0@?ne8JRy@cIdP*5vPOf_!irj$vr=AID>B9H{tCmzoE@@7a?v`m*IX^E$cC2kf1`}w1cz%2w zRhjir5o#ec(ZX1u)}D`T+bq=W`S5er1pJ5d`Ss<6=M&4!Cri$1w$E9nPK}0M*ZC*B zYs)|rRM_`5VY~7oNBmzeY_W0-8Q%ylkCoeZnm8vm?eTkY%I=q-*EQ!ZwCOr?7fy5h z=j3xiJQuw#PU{b9(g(z+p|J_MTN;XMcc7rB^)N_i#+p!LHjvj67H_W6eDxV2bSzo3gHhPqVFZS=#5A=|R ziy*Pl=sx|x+n1TyNwC*8k& zTn4+ofG_aqWl<;RlRClPjuKePh57{lTlh>9e5aY=RuB@h zn@=6#e4~DlR=2K%tDLXjO1S7Cs^_mGZ_jz>1^#U2xf8R`DJ$WsJ%MVUfoh<~v(A_zlL)f0ubXf>&)_-!B)`^^q)HpY%1jRtoDcUY*tTm0ps% zJ|98g!cu({?R5X4r|AB%jL)Hv|2^@>OHx;G|EqK5|7;z~R?OAyWa%Enx^P-~tcw__ z8YI@gD)k9BF3R^O6$DfGnHUcD4o}Ln~hMTYeQ}agV*L2CqHrG|9BDKpQ z>I#khm13Q3QmnI&F%txRQG(uQ2=?wD$}=Wy8q_Z`GxoCvixTuJK7ACbKDzaf_;;EW zQy}ure*Ypfi)Qkx-K+KpKGqXokg$$ikiv_0p#8O0)%TalMIz1EDTmiV(LB#U8 h@ z9O+Lav7;vK=vTH$d#kYH<@5eL6VYI&fK9{yQ_Rjlfxsi%q$)^2VV zHDr`Ri5Gca4?o7ttE#6WwSijKo~k;?*GhpB0X&f!4OWpxtq#DwCY_#%)8<(D73KB~ z$-kF;COVX7bfzWk6<(Bf&O<+Iu>3%Tf5-cYGUnMY{H^kg)c5KVV?U@%B-O=7lE)Xz zTA9#Y$sZswxLy~r+{q`9U`LVY!sPlz_L)pb*>xr?k*a%v?R3ljfYf!;N z=~vboMM~_^RE@N6ZO=vY>_M6sQ%mEDQy)#LE8?Fy$;`1QXdI+B0Z#x|sOX$C#Y%-AKip6^59QbZF152+#t zZN3Z98+@;HTpWblD<|J~bw&JKA)^1l+wRghpRM@gqs#{(2#z*M7$WDUqk7DE{s? zc_x!3jXRQ)EEKWp*)yVDZ2lb!LDhrL{j9+ne9CvQ8Hkh>(8M|o7RTOY1xTb!YH^;) z&)w(*Gc#vmdYYLl81o#M*s$U81$;<2-ScO@G$Hixd-*e(s*jR48mxLB3}3r;FuXZD z=|z#q`RUgLOHr8+f5=kJy`|O>Vm4h2o!sb1sLq)6R>^WfCZ;yh#rvYC+08J{j4jX1ml;&zEofjD?DU zy-&Dc6o2nlV+DGJ540bM(rFghwwNZ8wtSPc5 z%EbG~{u(DFK6>A_`S{*v=9^P2piHMtw|!sz3uB%q)9A*u^y$jv;%eGXFZr|f@%^c^ z$?@U*d#+wX<9xYiVxHXdrESc^&+E5reSwTy`P6{$%?Q*dYJe?@s0BDHH|{6s-8z~l z>{xG2rG+oVGX%YSUj4y*<5@xzO-y2)-!Pjd-fXZ0_CDEQ`A~D3xBax;CTZu*4l-sw zOOTi^zsfW4ts}%Gb1g_&L^Cou>N37h8J{N+gSSOHVx3hClc1O1)vd#v7h*4Z%Z+3Q zzuTS*CU+@e95FkjS{3zM4DoZog3_mHeQ<)~aEC)`WdyG^Lirsip@De!$Gbi>bAXpm)>Be4`1=#s?LIs87UX zC8$rv{M2f*x-#!a(MA~yaXc;TtB1=C-v7S^^Np#|JfkC^CYFi1b?z-(_VC&76LLof zEdJh0uQ2m_cD~TDBFB-xV$2*Xy8B4ffkHl(Iw!UM-TwV`LGLT${SFj1GG@LjzF!vK z>OkSKG&5hw`uyiie&)1t)~^2{{q6L9w_g>x^8$SQNl#A+oU^guB0j5~?&od4c!ilW z=ikmtntBe#f1PCJR-iBGp;nlm+j)K{@|`k9$$n>0rdw2QQy zKHelVbz?|e>YJpUH?@vhe7@(@qKYw96&RNDh>+eQzi1f{IjBRl5O5S?P|Eab`0q!_{jZNccl_w3vQ^1TXM0Xw zA|R3ak0&oRK^=c_2|{DvjqFoz-!s~BVc-%#BISr(BKgM;P+dKELCEiuFK-6&>NJcr zibh5w=lbMk*w zaW82lU`lz#V?ea6RZoDaSngxu#8Mt1Hk;_?`6hf6-krI7(kgv&tr* zZIhGkc-zxca@a}ozLc*A7rlo@_kwR-Ti!M`nOZKwOY^2-jM zP%yFkjkO~8>6bRQR()QBaTM6{9TlN-s#?*p8g2gr2yMDu=40KJuaBPZpf9QDy;Ki1 z(t(`u7m2h1?slTkw^z9hL!H68y-H!(H^^;RG+5G=s|P={5(yud7Z(kcsLr91R-Ke0 zMoNA8xNTN8&AIQax+wl@+s1q218UZ9bI}CcdZOo#(Y8oIs7ujOo3Ea?`5QnjQS+k@Z5%T|gYjYL!5BDQ!Dh&&K%oi*Ek@0RMgo5+W9P_bw4*BWp9z>W&Giv*-I#23Rs)hgzF9 zw^a2^qHT9E-NE_nCLqu%^3B6q&7Wo_ zdx4N<*9YQ!Z2otd_v}LH+Sc7lW5*`6{U*&q8K197+lK|t!3P%dck{K={h2&N9J{?k z5WS`%u0KF;^9GbQogj2sU0&f`qlmpf^E*ku$xjNqdgUnx8gcucpbxP}w?2i^%R}oT zx=R;2OHn(?j&aJ^j#8hbiC;L-xc}3&wr0&_ zTODXj@xK=kR(+ae|YVKSr%%U#+$Li_jk>*sHsi7|#&weS%;@_yrXp z5o=juWd2TGYOs<{se{5hQWp22YqW!4{0OIa1t+)iyYBvgct;Dt$=dE(s|H2mP6Z+V zWXCD~_r19Yg&ic?R5afb=5#sC^KaoR5~LMTjd5-)zXT6fC&IL!nT{=p9!uye6uiMv!^ z7Q3Wbv8?ak0o(ws#x+)%`L557>B@bZnS)ms@(KEdv@`Md{i4Bo^ATo#U-)2mjdE=5 z+p8b=5o4aq&nZS~mm*?}uC9Ys%4FSRFP4voCI6_#x9vGqN!!bzslVUnTQhhdc0G6f zF$E`uY}v5RICq|zxXuDI--Xs0XU;P-Y_ULQ&5m7VA&!w}+Bnx4r_VFfcZ~)9$)3|! z-xjf?aqpCRam_Vpt2>sX2fucnnX#*^-%^P&B=)07=va0TObq-uZ9Z`PLq^S(^;M@8 zoIJf_ox$JfyTU}CiYMQeIA@)T;Yks1FLRj|=fXJhozVq-bj4X_hOe>8u!~kd_!5lEmo&?J0&RM(q&q32@x5*#h}2CqRW+@Vd=XBJWNLafUu~+YS%bDiOs)}MpDxBcyx%(L z!JPLr>lci9TDZJ-;vQ=^!QKZ6dS95l$NF;b65}C)-q(J3kJa-9HL(VIu&EtKjsn&h zAkhJ3+({6kkUm+p8l5>`!rp<-1C*Z=(1f03mAoC5HGVDq3u=O;na5W^t91ndstF(I zexF!ERGwxw-7 z#6*KNScpEp&*+8m;rALW25_D4Oe&Fp}(DxhF z5tq4M^x!{357y-1qLZIT4I>@EIBr2m&Et1QZhTRincgL6JG2NPtv!4ySpY+m^RCdK z#d-htI%WM;BpWP%4C_wxe;o)=;_po}lgs5vBItX9_j|(4f9KdtOA&ix$F20+D~7o}HTo1Y*dKV4|rC z?Mq7OpfByk4)A$Ni-Koz+!m8L=moF! zsz`7=oK!K)*Zwgl`o(W2L|comJ@3c;fA)?BJ|4TYZRwi_q9xJ>%KLuAuKo624nj9n zcRXs>;N`!4-u~@A#zHBzv_j|!!%K{9Vm(VM-j}g>dr`2&_?u~Fu24|fOwj9}yoY0V zD@sI-*1i5O>`DMiq=#VqU4l>#DH_*KZoK|mOXN}y@-rm*`9ghy(`M!zy#@4T=9!se zjM(=FpPxpp*BSFf9T<5-&}-57?$M3cKYERY-W9oz=Jv^-P0aI0*iW!`D_J72!p?V@ z`SkSMT3#=|JJ+tj@mooWxOSc&Oef!_F$Cjn{Ax?}m`N+lB2|}bm zX{>7}MP7|wN+}36E9e)w(Qe-pM6uGyac*6^QmQ=ibkP6t*rRYNrF>lm?R-<^K;nJI zJe_IQR|6z2iMmx7sRjB|>tJB7GNP^3M|1K|9C%*W4xUwWD#lc;q6fJ6u8Poe8XCK( zqp)eE+V(#*gqpsswf(b-P+hOqxCwgju!caBMlaR1la1#+JtcnxBotK-?rv8~{rP&3 z)x&5l5aS#5e>`@n6*>2zT{+kal9$2hVfYU!v3;Y*mVE0HKT~|{ol`9IN47t>X6HPp z^QnyucI}m>uP7pKL)~7baW(WHm;HIWe`m~-V}BNyGEl|kKsQsBk?Ebvk?DHA=Oimu zNj>r@U~hldQUk>_ky4k%q0_>zt&rF*?3(=!RVduIf|h9$v+DA=zxUR{ zR2~v_+XI5mnhAdfiCR@3{oDb1+k;DK;?IA=Oz$R{Ya%;#XL@I?owvH~$d$jUKf+YS z$mj~G9TT6bhYWA}9L zBk7};&`u5#Oza~d5g#yI12T@2J^wmW9|HQmX`wUoRq!)$PF3RfF4aft9=Ua6N`+D9 zL?O-Ckv@YvVq8uUG5xqNs>W61R;UUpGk!&}e0}uU-$)#kS?ig+ zU3?Gudzb2?*X(?W89ldi-d>f?*(<3BKWNu9;opBm>~ZGzS8meN@3-6X^(nXWWM+Js zI1dC`{`Z`iGTVPFwM+N}2M=($u1M(kt)z!q%DvsADJ6EP<1hx0f9ycmg(qkI$1=MA z{+nu*^D~9+O5<87tSj%!x{RqJQ5QeB=_)fXa~ugh*v#*;H}A2EMBW-ClJ`iP&|h7h z@k5Hw`XLS5aaTq0LkcGRxYc<6pJaUUAVJ?_1ShYRD@H$AV~hZsKxDs(bLok9=Ig;P z|8OS8y`R(iz8^625cHt1E!eqsGvg3rP~Gvnejt6YesM+m6&&O3Z$}#yF~*%GqcgFa zG6&)jf@pY(^>KO2H^nM1tII@<{4mL?88mOLYv!*tKco4_O6Hu=taZ-lTbl_^`jcx6 z>BBpx7O}_~R&ia}0M;M5k`}%;8N2uVx;kQy_#In@L`N4nGAViXN&nz&Gkufr-;W+X ze)Q7xyc*C#|9SuGqyAONOJhAJFDXzWbstY&;ymsrKxogrcP|0lEnU(s^xzPT*26G3 z?WCue*+r_&K#WE^|>WkEf=Xsh812s-DYFlN-i%ir6z*3*;j*_xVd^QJBCXSrs>Z8W-w0UL5es{Ai z?O$yXPSll#V9Oy4wW?TCgQoIf>4cH+GmKHCX}^$kaD`|R!X6v z@rQOlXLEZ>T2G=dsj4%&^5-0KZo3@PkCtOJnalAXv*J}%A#+wK`aX|C+Sjjh8C50m z8(VXZOsPtIJ7bq*eO7(++&WktWaaoSAT;F?amJ$>;P$DsnkuMl+On?dgKIARi}b;b z${HYa%etzq4j9$BQV;z{xwJagXX|fXx9j13WblAb!}>dOVQ{SVxJs+f{DbuG+LZsYi2S?ckybsmjyd^vG{MK_%~#sAg4!MY-rNTC*QllA@8|X$IJb^k zsk4evrqXKRyIxL=O+YloF#$n8pU;mO^W2#SBgOB_l}a1ZEacs!v<*(Pkk_rWr55Qy z-Zvi;pNkv%D94adr^sbpeKUX!RzJ?FZ48OtTOL0_SRA@&1UwdG2wyFM6PSb4yk0AR0SXqwVtw zLeDLyi3YVO($RbC9Tf^hy<|S7E})vrK2cH>aoe?)xD3nJx0$ifE`s3)p^vtLM8@jr z|4-S!fJIfUkK_2e_a0_OL_`=EM3Wh?RIHOF7s+F@7%Vh9mE)9FmIGJ^(^Dauc#92M znbU=>)-JIew2REKq5^Zy=^XJ=SyTsxvQt^kfVV;oyfKT*tpBst-XjBbKL78p$0ug3 zz4qGc@~-!`-V3$@%3ct~74HDiYmIqoYZ>tEsX-%*f7a1J?oO9=F zf!U#WO%^*>JVO9GyLS@=w+K+%rRY-9;I23c=H-{>1H_ninVbO0M@$h)OkxDCrT<7! z^q&HNf%4bZT^Z7G!RQY8FqB7$-VDXg1vf+~u)Yw$;7CNCzdEFM<(g2r>TEAbP|o(R-@)D(O^I z!`567Z8riK-i{VM^ml|7GU%9(3p%&ektv17d)uc(t^zRpHA?hcAjG)HAbL&c}MMe7>95Pfdbm$~(M026+lWw4Ktxh*N9O z<~;!E$M!&RLk!rDJ;@a}U}C>Am(on>E815K@`T#&r)7=k*++=+Lk>Dhyb1I?uzUI6 z^G(W~r$eu-YlB9#(Y=Om#H5#%+}*X-jtuE()yGl_5V<-5VI6Rd6hD4XzXhV_4K=@5 z3kS6&FH`v$@QKj-`b_Bw+Aa}!C{IOz>3EXpSbw8?Iy!g4snIav6u>O{{FJ^SsZy=? zQ~H(&Bj|Hpzds3y+$h@alzxBGGwPTg2ohPh25nx)z9D*kAjF6wM4OHFVGuoZpP}|D zNf)($>nV||A^@GI-gxGR6)N2L{OcLq5PWb@-UtP_)$=M)ofb-zv;~(lJ7e6nAzpT@=5#JW|2cShahqj|7Pu zjiy+3L$Qk&w{l_k_>>2sbd1u$FMd??m6R^9T%8GM3T%Pd$#-$Zr*&Yj0I0M=f@GcN zD0KkD@Vio+2$GL*AjV!K#8_1TQUFBTd~n%}tCQz+X<@dHA3gNlcp_8Yp#2!_Kgo>+ zV0;^0i{4{I_9a3(ZA-LpLwS(c#{w9Ra-yxu3eqba>u>29br0#8+!{~uuYu)9j0Z5V z*oq+9S`TuP*(D|&;UP@}qK&Q@rJr1^vL2KVkN^zjH-gkE(7h3D0*E%+$9@hfX`kj@ z84M>rNz{9*PQvgvg}L$+ka$7iGtaB#3Qn|98K!(GNC&P{`fL**Z6S}c*EhiI?PC@G zYzXi}uLjYU$0>O$9_CT@SU{e`4KO?TYADuoU|*l88%4+Y<{I57`tDc&kA;g^>}G4i z?CoaJ{jKOBcFIrE=MMU9t1=GCXOzc+RH0Mi-q6128u)%C1K?&RA$FS@dx@^+t?@(- z2;g4F_9xNZ6}CTHjH$~eaK%Np_Z~|yp`D~CFA#up4HbL*E{nIt^MgBLbgdgdIqlu#& z0(g!Gi7`2bE8hJRu|p*{;@9B+&UyHFk0LwIQS{k(pgzL$JKLk9mx+9-4Wx@|&gT5f zL`Ga7)7Q!DLi=Sk=6@8*WA|B@j26dawDAo=xq*YqaJiY%dvZ|U%wisygaQ6Eej{Km z2H_Mvv%SHsI-zF9DI!yOAFf3nmj*H}v{-9=ZJgvw1?(&2B;PnH``3DX*8}#aBJ3N7 z@P-eF>>wn|w~qO8++gOx?rRgI3oU$&=RGQSLdJ!4oYcx}UgH#BWJjWO@HB($6N^2$8r6VmA4m@BrNMf`P^|lj=ZIWpP1svj zkuarfQ^J%oJ}Gd0N09lG(C@5&kH~$iYr@}4yKp5w70+ZWPJlXdloE%`p#l5tRJPMV z@#$zr7qD+KU`HhK_!cWZOa8~eGlb&B7%1L9?DuV$zW6cl(6#WDfG4CYY@N(WMZ*+* zptUR0X)65Z7&6&vvj zcLIL+Jt9*W@E3AYcq~c^6CvMy9-y*KNOW6$2A0Fkm&-|+?P_i^A>RGKdqlnfkUp+c z@q7A2jg4wPNn~cLrxCsWb(|zZ!+9cTYv>yJCL&DNiN#z~*N?>o!$H|U5n&f7Yv#KX zJaoRMYr*5Y6M0Nqz(eOCon-MVJ?Ik2qV3JSIW1<$`GD@-ejf0fgcya+eqS{z%ec6} z9tf1Ra9fba4BU+@HqREt7j8z3=w-fBCM6cxl{{p_`s1XA^rRvv{lFIFp|HG5ZSyJq zy-sy-+YM^lfBrwTJv^*GKE-=s?Z?OU+wD>q4*8$>Rh-3i-Q9GLO-vsFYZQCte*5Hq zUCC>$=H9{np@4HV2)E{fLoj{{7Mfc;EH6K#$tG4_rR={Zwy9}yx4;2+B8#X-nd zmQ(N2LAgsWiKv;%iJMjva-Q;iNm|jS=rR(RF5{jN{kjZM&265%dh*`?+jlQg3fE`A z>dAX4ZP^kF5|#g-(jt$m4rYgR84gvKu`O2NVO|xG$MT+{%h(nd(q)XkqRUA5fyk79 zyBMa+pkoWyWh@7%-_DP2zZ9m+sNj*Ojh>NIUb>-|@q$d3LFe-sA;xVf|8KesI*)i& zm(hDrkSe0+*&XdZ_Xv@x?9Tl9E)#n_2lakow42KJ4ZI@X&rs!iS_ebpob7)44#Fio zIQKGMU^Mfycq2lzX#otW8sy34Al)3J=tWYPJ_LEnc0=*PnCYt!A@;HcC~gQ6yOqWI z2Hci_JT5IX7hHa_g|4HS1N*{@>uhD9VRW1B#mL1ed+8V)JUA&XEvvoi1~&)xoe`pq zJ{K0J?4|N~lDc;S#5FDep?wD?_G7%FxA;Qkzgb*@ONw6NoiKUh!LV~_>RpFl5ZrpL$n4ic`F4&52A;j~LzR0M`s~{Q&;D8C6CjN~BV~L|>p|s?j+AjVzBom1 zPRfKDQl_bKzDs0EKa&AEeW^-p4bX^5SH7X`|Hj9IzJEdh_i=$^-)U3w8>Ssr$Ltp( zm`^!<@7=)faYl1XklAmA=Zp>cpPO`|cW4`tlVjiph}q8c{jY`fQO!Y<1E9`)bhMOm zlo(A%M@yl;PxAxsi(U+SPqPMX-VWSi9|v|Nc9_Pk7y9FdQQkcnDY3(7Uk0&zUX5{0`xgmezSc!y{VMmH;2y8~?wlUM zXer}296Z$R8p`q(uxI5Ogeh#$^%6n!RKzH_U#}Ov{>i}X$$Z1XBO3Z?Lg+s9biC5X z_*ganWFM(N!}znfL3pu0r-pG2+B|O!+Pss44EkLk^Jz1lkfddAyc)1(^*8 zJ89FM{Ce#4;{yqSS+9X;n|?$xO9-^ z;%EHUoGyhgq%vHa5a$lziV&V?S8*b(51rvwflq4_gtYZ4KT*}ye`fwD?{o-<(03h? zq8Iy#{KEf-cTlA0J>w^GdDlRkbvR-mURgQddA~m-@K9H-=G3g)2@K}O^UC~|bOmLK zXCryAQ@&xJpga%H2~TvWnS%=N1%b(85LNsTamxDN@gtFwA-=tUQ(~O3n4v#}DA8|`NGDLm947qsqF=A#_J@^2p=qMVzM zUDbBbw&$z9yIj-uB-0wS`TQli{|8hXC(cdB&=F<>db|*%LV$YOAMKm&Iqf&p=K|3D zuFs#s`lRy;&Haz&Wzvh@sp`D`b4gi;!-LKx{np`21L2s;d_@|Sc1DStc%+Q!-(l@q z1xOP>jCI9|HoqXG-3ed_)j8C<+W-uHrB2C{5G&el0VVJFj4)gng8jF``VXD;OU!VMZ1E84DBzrQQ4|D0|J`)>GnQLJbi z2?O&WhVsJzAINfO(V~KsoJF(`N_!9o>5f>IUowNzgpb@r4$*`0F{0P3##34rtHd+t z-$#XpwF#ODEVsc>VS>L9B;Q2vDDer#NuT^iWZy*5^8g#`!7H|bA^DEVbv`QB37q?; zF4Z4A4tbcJVa)cVeq7GEH>i7?ufp$)LHkdio5Sc73VS|2av+`Zmv3bHn${AKrp#Br zo2-7L$rTXw(1&fMSsP``Rf;N4@D9AFva&L}o){jny#Wqn*`ysLr54SVBa zP!7c^qvcCMBBLPrXde&lA`kYmM@&=vxr&UD@h*`aeI&!5%i=4fJw|1LUXtOTh_G)l z!WK|+cKWYJ*!P%HrgY3Fh)Ks(9^@xx8zbi;vjnV2e{&2VQpytbbr`41ds&%fuwwq9|dbg zn|Te4YSXFX5;*rumj~|m|Ami1FM5X^Q}9;xMFnsDUw97bMK7nef9Yb-com4=F-%ts zQVtJIW>=<^d}a-Wb;C&k+~lCXnO~0rEH?idv{@)EpueSqgw&r%1&NR1ofMAtm6`&e z0V!F8&T2yJ(*fb>5m0|3RU_>y9UEA$0cradkfpD^a&<8e7S z0wSDmg2q`5n#QpaP@ls?N6MBQ>=(3jUQ&m^vs|p(*Fa|xmC-Z^yGq9ftO%qgLW~P4 zm3oZ^;WtWC0)RmB5@NK1M)5z@AZ#v0n=DZ=oz(#LHvwU;=%Iiaz{wR|P5Wu4?XK1! z{AMZIv`=k!H6UzecQ@dyE;0qI4rp#xeUc9VWcmfcZSBozv2svf=+jAB00UQ45D3Z{%LDwt9R8kQH6?p+}v84l3Q zV!9U)y_V9{K%oYt1t7H3{jqAG`D(_?A)E_PPunfjK=XFs+gkzbV*%lvrh{A8f#6OB zz(NeF8C#ml*5?8tM*3bE@a@&0_*0mG<*;J<=t6)x+OA8DgV&?@&e(WB*#!U@rX|4Q zW#`0jLn%C^tVx_>jT#-B1Ke%&omr;oH75n$efuPYe-XevOc1?1hdgG=B%=4Ev2!YHA5g>gT)Me_}ymV}B!r$|A{qM2$n&&S?Tp$a~2%FcuQ>6pW2}SvP zxf_rg*Dcch5K&^m(7t!~_4hqkhxwbTyE!L-`@AYAsk9~SJy(T|(wweBp~eJ?ontzP z-pgyXbGD@XXKNgYw(msI7KjpU=K$&{-kAts0K@R1W(`QcaWIt1y!$60?B}8GgkW$h z@$_TetwOZhCk#)kBFqn{j*CJo_XA`s=OBZNLD}Xgh_xg_u@At`YY>I$?EEN*J-|Ud zt#9DK{&fao`7AfHm};>s-V&9&Xx~cwxLEf*qU3DhChkuv59%@t*J$Rnr5#L44eBx} zt@I1g?*4nhL+aY>uA#Vghe~I3dW0EIBk0_Tgvf_Lxvy;<&iuih4JN=8Z?fN$09Sx1 zvn?6nbs#toj-}<&%(htw3$(n1mQQE4twR_sek&ZWo`e_(LI2nI4MGJlIq9${GlIz^q;a#T=*9Ut>U+;x}vMx~+wvb?yV9 z{Y}%lt-@#u!-Df?LX2e)xwxDIyLKeP^qrG}wy_Yj8-+?>9KTMBdCJyjcr%dk~L{}y06w(3(vp2r=|qQ9RzspJ@Syv1jiJp!11f18iUTT(#!FCoV6od_p_=v~bt z?5jffK9bwAS^(z)A+a5T#O_#K8c5WE1YkMR6Y@zqko5*?FJ&%ZNJZE;6);Rj*p~;G?YTHrN*16!Cz<&vR>F9MlYwKo+I(foJ-Tl- zcwFb#wmiW@r4dBi5o@$GpNA%27GM_#O|T(b^34J~6TskGjXbG3cIML^rD#)fR7@x6 z!CqJjOB-}xA0i+;UO@OJPVd|o4V~qBuumO|uxU8*n1(|gCx|v!W3KW~MR+2Bb8?Ym zuP+bbIEZtGV6+Tk*c~jSBfMk;%6@LGX3p)AkY1*bDQ5N*#_dUMRp2?Z6Flv2N7kHP z0C;(j$n9_6R&!F|+@}{H+*XA=K0VYshM|=rK*pJ!$g_P26uX9kowp#oLko3`xy@GWl=HA z&yDW&?ewokQw(a^#eQuvohV0`E*&G(NDM z5M#c;In9g42euJn^yMNP0i&E(FB%_sg%D%G5QKd~lKZo zrv321JI@kg+!qO*6#nklDf2M!QRHwt7X#FP$U#%do=ldnfvw-(DQs_Q>H6$c^7_I~VB?_QSxpx4yylz#Zy3df5lYk_(up+IjxN6m>eI%3CUn=-!HJ3 zhBn6zKD#6uVJZuq{7~_=I0k&XD@g3+MFoKz93AZV|7-b_frQ zo+_Eb=hi)NZady2G9AYWLX2~G=qRyfO3PQJ2U0+^?Rb~Z-uE!zco4nY`God$g5n=t zwkjjAkB4@D1lad*(6oYw$|L`tDs@?-nJ>>g9-8*?hIUsMu{%~R3vfkL27x-W33<$1 zAd}Oue4uWAXAaBR&0>GY5ZT8gkEw@b(D_oim%dAX3!2+&D8I7~!0uR;5vbRKbd>J@ zJcJ8N^8!oC-o4d*6+ zwVMDqw|@om6?BUN)KmJC52Ckq0m7i)zm?K4USoCok`ad9oEAC`1mL_rn#hiu0XtOu z6oOB-kFWe$LWA)6~J?6Kedq zg5*yH?AMC1{#oGh4;N$ocY-IMhf1GOoMx`f_4r4L(^`|oX>F*PMC=u%CkrhX%dlr+h4kHl%@fX8)7O z!YQ%oIN+UBCaR4lM%tzfH0_0^^;_wChl9kv9r$)@W%D<> z1HuWDM9-cu{2S6iJ9y+_K0Q3Jym6pOj!jNfWS4?S#YVU~31Q0bn}Of>B_VQtB*Kma z1*f`_C~a4AJ6nNsS^+lFcMedQYz)Fjv`VZXKczkC2>XHQyqZ!Rc`O%~gYp{=9Y*Pj z{P0J)Y+$#N*VJ(erf1IaF2bA! zt+arl{d90(?wK!#6C*w6@q*|L`R|9{Cx_zOQ6BhJSnnOlyUvGlbA)*1dJbwY3*fH5 zbsF>0{fL9wF55IIu%hgPk$l7XkX`jd->`d6XQ+J6tN2ua2AY#0vHdg;_7g&a`?wJ2 zZWEHyTA9za!ObDj+p<^jw@L2Rbrz}lUpdZYd*@V;*>@M6RO7-|Lh%L;?51%ITM-AD zC47?8r{2B)uRLld5Mwcm*D<1*FBQEZ`ys~n=kix_k@$s?S8R!>EZ|!Qo{^ZyNFVqp zxfeSBHWuuyxj8GXdYEnfGsG^?K=I*Ju(!ULv(mpgXQg!wH)`G*w0QwU7oXKCIR@?- zMr2HJy%y@)?nlht)3*+JT7^WnH$Y@lMBpPTQ&gM5-YtxD-_Jv>W9Jy@#O9opGu+#3 zr(VoiIl;Zn#wAi%9m(#q6F}T_QQ#Ukys&%evoGvkO0obG3(LLB@K-}J)R{HV{4$@g z(F_{r@pZ`aCU4ldh37VI;Uk=_f-z0x6B=`sdnflLA)%4VIuy_En@{8}HNJgyB-pW# z#A2@9G@Qsr5WOn^40Im(km#hcPXXPlb;yHr1&PjyuHm)-k$t0-dF@XEdlHD=F97vVb6Mcs@fw65f#lc~dTUD|jG5EL zN2Yc0LYiQpe4F5;cw@b(V(Xh4Xa>+Z|3!##!Dz*Hmwm$mm`_Bw;Ay~o48jFZ0_F_} z7gPYIXLkYU7l+zf!LYGl6JYu~)IY0x8SoL-cF5xLZeq9c&|$62^`vx@j9eaSX@8HL z&h;#S$o6M3u`d8eXJm}aYpvY4wcxbi`Hb?MQxRTKp|A1f=B!MPf?~vh{TL6Ohhpb; z`vC0ko(Reu-|y#tF-T;}kN0lQS$T<%cdp(!Mk-4HTy`UPK33_~9u})C!Oh}za*D3k zG7mb-39(bzklD3?Xj?U($fjYC;iy1(IS=@WNWf?q)KgymKs1pRdtl=q+XLs0V0LmQ zLBXdk0K4zSoR!;j&`jmEpA`QT?BJo^tV7s$zakq`{GSqsupodlg~~_3x6hz;EbcU= z1ze+x2d5(euy1qDO2>`hq5V3>0KR%Vs&R}$IMs+)4tziG8!0Y1#q!{T)1*V5i@?WPHhRPeyb`!f6#X0T zOwm9yr2$Oe58TGKJeG^LF$MUI?5?*iD7WPy?11>jWH7X+1c?1@-r!{U13+kR0I;_{ zgFIJq?`uWdnfsOe==(1d`}2etT`cC465IL~h}f9Ri?-uK@0!pWYS&Hd>j*JkcOuxI zXa790KS|-nf^a<#&gH9=TplAq^rli+QDf*E2{F>M+M_;;W44kbn)yHV#{sXLl0mg`}B}8 zhleId#Z-xlL3n?N78d1UQ<0A4`Q&2&msCuZLN;ZC?J=*w+d&21L@mlreuFEn?j?3H z5@jcE;EHp4nO%0%tI;5R_}~!cKZZC+-yb2eJOz=>L{89vbbya*48@GR%}ZpL02#Dx zE)Pvlh*PEgT7*q1k4xI$u_o6OXKG1W0CA5{{9uK+w2C!? zXW`>{Sg{Y}+|?Y^njfDg9j+lV?USy@lbFa92VD>n-2Y{^F9x?iLbSCtDZ20weZzvm zeepz4z9c|e{3ViA&Ftjk)1uxYvSbd3m|Eh{tHctF9GG>fsjpQ0<@p*BX)<|nmwO~T9+Qu z#hqg$(4%ZqAIYdcI7D)BP|M;`1*SuTb-P39d!mS{BKWt|D`3#p9q}4i*ex%PB-i>#saH99`%|td4l1^zLm&8dZ(;`|HHO;0IaFKo;0Hl@M;7H<;@#N-?`&mpR7bk!eGru2oQ!a`kl=J_P4e0{xyyUz|m#f~w!GgKH%Q1hKOGG7l3v$ygI8uu3}?oBS5Jf(~u+5R~P_5yxnW4@u zk&dx5I1oR$bTeuuYuMTCNLZiiIr0<9P+}a#r`_Ba@?Vcn`}6{l=QI=M+cp&wnc_0$ zTV}FIDInU;2Z-#@K;4!4BBlOJfZZgr2{GQyLx*cquE)Xd z1C8!gy-L23wM|6k4n;`x84@7f)q}8!hq@g?4tD8sm~M})k0B336i6rvoK_xc@7bN_ z;h|%bRo}4nh!#d1d=hP@JW9R>s?3$!e=vdQO^;OO(*P9b8r?7U5_wvX7!y=mX1cDF z&Tf7`D3?A6*p-X0;|{#pw!1;UlY|10Q{vRR_p8M&h{<#;dLO3M? z>gFnUR<-oJ9(fXN_9f)u{B1c*U+zoLVaE%=WLL-22p<=qk@81o&}^i2`P(>5-_4K7 z!&VkEjNeFk9>+$&`4!AY!0Cw5F+6o0{kDnOqtsG9gMO#}{Mt<^iFr6-UP6^)hal~V zPH-;2FRrG5hdKm+O^G^;c&O!y@^D-c``tw8=;SEC`LTd~4J3Ubk8qnXlG)N%b5KcX zDy5ZuZxfmH5u=rdN_14fXa69UY^r?H1!ZW9oxM;G-c;TOZU;fA`zZav^=nv($D)4PA*LkEGqy^ z&qm81-IYx2j~SP&gHAIK_J5{;RB$80rlQpW${Qg7=M#O*@3_980@dX1%)$9LA`C^V z1By;L!R-JG_39ac^t$X%1vD-N93>if^p* z7}GH|(Ye!o?BcT|P868TGq06BtG%ab>bG$V^YD=rp?NX~^?&5w>sRyk&;0TC_m_^h ztl1P#l)Qy7(@}=$-;=u(e=-yKF0)lubb|KY+!kxc+D#N!_(0rL$|EdBLRF#w&MjJK z-mZoBU46t3tCs~rcaPz=mvr8C9%_9M$aGX>OSiQWSv-&>h3x(AI7W=L{GgA>^m(X$ zbnC#ltF#}-r?=wu0cDM#((3U6WY9W#KFugoqOuhNu-k_cx$ILd9uN2=(LV)=3I z$$)T4BuJB^;+%hb8U@Z0QcuVGLd8^R2M3i_(ISaUb@)IH-~$nWxyRAU{WpMz*{C&W zB`P=bRAyU(Rvw54d;mmm!&SiIqx&w?eT{Y>?ILnb7m*u=AWYY}x(%d5mx=5eetS*D z(!48pI2QybKOUHUzV3*O#JA+oNJS>0IB50LiM_JH6AnwuScd z&I2I5R54Y0=j@tIr0}{%KjjgwW%sqU@kbgZt5sS+Enfs=-Zjd#b=JbWn* zsbe;{I|TlUe-7};O71aLM^4XOmjLc?ym~hem7y3hJx`;6qYQ2K3)&in(^w9HJnV}G zrwIW2b9u=(8DZOHC0D?79xBUCV_0s*g3ClMKa`76)6{SAEQC3T54d)Wk^F@Srwm`d ziAw~`!HZr>_sf}#d`Aua?T80EZAZ^P#dDkbb&6l1Wr#5*U6f2GBZ9 zrGVd1%lj*)N&p(CNdx%%_(0Z5EyA?l3xd%-QUjRsa^t&*O!1SyV3L$7BD_w3I?6XN zIs)kuO4Q*UJH|*z517_de!=t{U}Vr?Qz^nJ>k$S7&C@l|+$!*m0Gf?}Kr(FrTnON# zbEbU>F*`0!hG#Y%BFD}jFC*t+9Ax+kCP^tlB0C<- z!;l8`bbtM+yp*C5z3nWQ8>IX55Uv)WZU%+P>NF|!akSDDgK+L7@T4w5D|1J)9NJD~ z06g|_v~uitsMlAgNsQ*z4wn+wX(WhX_7Antp^>0Qu}y?(dM5Sm#Crj6yG&$paUO;d zfa%=yQObJK@mYOS7;TNvBb;i2<~NE817pWQy%rOB9uG|vCz=jvvA&DQ6s8~w;baui zNo6;74!7lCiwQb^xrX`GcpG#|96j+GsIT8KhMlhh9%1vO2x(_D!U#m$w{H^JH(bd9 z+xpC%3}(xJC3gSY2XY@5&E|6#C%tzpD6=ul(KKHt(IXtO2JqDegd;@2S0^GI zu^t#r!=E8c$4_yw`D0F^yzua^iR}7?r2mBwV=2=|B)aRrB66}GI%hIFBxt7ZfB;VO ze>rK+B}IM>(PQp8!9(X!Vg(6Ka}qrVzNzZ|^>QrN>na}MZh$%@pzP#2#m5Wjl;0qL zoxxp75Ba=^hOjD|ve{);RYN97x;9Ag0}UO$PGDmZAO<5~~mRu&Iq z%_zxS#7lHPir-Xhh92l3a*q(_1`s#R9}1G=83>@EC>!Y^UD0)pcJBbu``8ymZWuJD z3&JS3m-6ctrCkLldLR0N$R-{#&{UM2d=ZMPLE#Z|Eg%W=bj)7M0gzs%Ro0vG>J5FQ zj_&trD@b(Df2Hz1laEHb&69Yk6-4iyUnsF$&^V=Ey0`X;N*pX#AIYHoP`RD5j25yG(>) zP-B*romS4@0)XsL%>ULbz-=Yqad#8BH4EXk66Cok@a|lI?3y4k0wyxWJ?{pYJvOtE zq+=8`2p0n9%+&)HR2xYOXTla#!)y*AqA?c$Q(U^9-CqdK_kzT@-LA+PJBrK!jUM5r zKya=rDhw0?)UPYb59}yP4N&>xA3vD z=>AI=k+<`S?V#SVmHrfz?LP%&A2*Qypm>q;E_0ive%qBIH1CZ@*cA;-x4HPIpqvcG z_VOUH?~PV@nGLxf@d(KX$$<3C0Hy7O7?(Ykhf_j)mtM>Cc}FiQw2JbvqH^Yxb6Ux> zxXoAEkJU=e|EukDya%cHpSI^K1&_%$MM{|x?eP=RWJU(bupVmmFU`ZriQwU406%$& z$oB%&t>gjEITn;lQlL2*z~g%i;W8d1faD{<;@n66&wT2XXY#KGk1r1}DZF9>Pzy`) z@c-0jtMOF)ElMu(mlXM@7Q}1`9V7DW7NyMQbyu{krJbO z=`rQKW<|$bN!Jq+^O*f3d(V)EeY4cxF?rZG2e65U4$8~==BoAc^RVwu^|vDrQyzr< zF3Mx}l)lx-1287mv|jKqJ})&wGTpAjz1tL>noq}YbtShX5Bu^EZpL&>fa$mzhC)64 z9+Oe#YbC*zqrmohg^qwv%V-GYQvfQqQhD_s>V152x{}+*MF^9}DPH0z&y72y>K|G5+o(P54bO;J8_1m$HbgR0cTBywRn0V!Uhjc;Xwh_5!sPZlfk~%t%W%mItC`5Sw z`L!*{z_;geV5j5m65`X6i_C#Ul{cVst+=qZ<+0sC`8*-U!ut{CJJz-o78L{*?zUzh z2gq2po6kO?1&KbR^#%7KoLgjOc2=iUzkJ6Bd^X$PC3#rvBy}O1w?6egvf;cglff*A z-m1&t`%@C|b&|U9GTl!KJ0&T=>;c1{J$IQfTO!)0*pZhN+JA=%Bd$wId?nDKOgj&i z@q*}m0z~iT2lMdu2X%O}7V7Wkp;CX5$i7(!FEi%h?L4%bzGHV{m6R8_r)lc96sH|Y z5t_H0U)yp)NO04=H;zTPp#b4aROSPOeW`+ktB8D)4y5BphTyn+S>%Mmqa7n`~L?YeWBt3 zx()?agv+deS7`H?eWGswPrWLuCJDZXvIpwOcoS|ZO6D*56=Fh}WX-|Bre z^xRN7+^4`%4yz1ws=xh{Q(5_K{=kie5#q@6daf6hcv_|(k zM-{!~h6|y)5u-cvCnA3s33Utk=`|1Ch_H`?I$nc3S{Cm}^q!6qZJ&#xtwIBg7thf_ zy~qQ0+^XOYQOW(_od#fVq#>*g#c9wZ59I^RdXTs%&UsAr53%-0FNi-@YM0>~y{jJo2~zoT8SiF@@rnT(O5fbS3{q z_wV%moSUBQ(4Jftc(+)QEroclTaGe1R2jV_5AWlnS?-#64(j%4;eC!%Y->keQ0~_t z=7p`%Q3xl25`T^E>m!874LoF=6XM-BF}tTY_Xn;D8}oS+AR`k*@7yP~bB?5Vx85f} z`hV_4I37gXe?`%TqeR;|Ucuk=y(@62AHv{};y*f8_t8PQPOjLYsd-xrvCL=A#>3E7 zLX5*z-=6&w5au*cr`X0B(-gTZ+U*l!)4uE^a)SoygebIs>eoXPNi)V3}#7-hpxs`pZm(P?-mEtSC=%oN>K$yRL zE2YOS-f~3jB^gxysQHn|6mQet=|_otRQ1KW!2Sa4<&2*^_w1te&DQDl$(x7;2K+a; z3=IQ|LCe7R0V(xGgUUOym39r5*ZzCMr3YeMg*VTc{&?(+CkOT4H~9NyWWayHvVqUJ z@WNe3j*dnHpFcjZERsR*_k_MzS^Lm;O;Kh2n0a&y_cUdyHDKc02y#hnK}*FATey!i*q)_ZIIbh&=^ z>Sv!PFPt6IYDwF@?ddJQ{pqty&#ve>KJFLGwD%8@?Oc*e`S+XUmHGP;mh2DxyJVSh zcldwZmW99m(}X@-^VSC6*vixz2}FdAD+MA z%t!04zW%&r^vd};rH1LRzIN5tcp;_Bk`?vSuGudp9g$ypIr!DH-ImI#(nYhDMcw-t z|B>x3ZJ*`)qvJYb9Ytdvm~LwR_^F`f=+5P5hQ0g5D*ooD#*d#vEMwN*J~xZ6m+tuM z{Z;Z@V#)c_^|gk~Unl%|+e3#ZuLxQi?+YJ)uZ63h_vO)t-Onrw+@_th9p0 zshGK9<&C$#))Eu2Y}y9~d*zq4|GcUiP;q*#z8uYdzoqCg-~8V=^!G6-Q)53$*mTWaY@hfDk8Z9$b@EJX zt|pS-J*53+9&P#M>|OJh|M?8&M(&)P$)QJn-TB@ffjMa#wjI@8xFt9c{=~-=_!0Zp z_rj|w6`Rp*>AEc6j#qB@$Ds8O?i*BA`U`6>ef8{BbB;xDH=Ue(i)LK0^4!;7j!Efh zEPlGH{@tGzo;h^y_9vW{`@3?ECM?O&(D*OJi#dL0O@xMal zNx_%@S~v6hPc4s^9=eoTxAC=?BZU>$zVx-_`R9-PoF>ah%NhJ0u?%@=T6a{#Cvwx% zH|3Ab|Jkzn-DQicCBZ3o*vsx&`0fcy@UO*pkKWxqrDVz7H~n0E#`08GV5I8`{GPXz z#f%91FJKt}zIXQyE{En<`P-r0#@u^@7RLbic8139%6;q~|2muZbEu5&p77k~*Vp*3 zJb(J_=O1p^(i$q8u8Bx{e96%(?n8DaZ7JGTzX}=ZR^J3inf(8OvRLtH|reM;*SqBm26zp}$#{JU{#B zG3)oyiH+|iKKXK|CHVTnYr1;Z<}J$<$Ii>RXvtdLy8eZ;3wnN<>u+i~a@q2g^EKZ; zkKDL@`2LC+cRq|Q^<%=02g|#y~EC&pi6F&Mn^3jKy(^ss$ zbl&o(&kvk>{p$r2AN&QF?`U7u!Q-_R2ma=Ib`ZXFT9!!T-u-e^ z>h>SDe*W-@cIUpq_;h*c_s+w|HeRk9bKaV{ z$l&te@gY~0`@!cY|7UIQIHT{@Q31>S2fkZ=-G4^<&uxiof8|bWY5nbvck?grIzH-h zdrzqgTe3Faas7rVXaD`YGwNKh1zS=d-Q`MMcI)}y4zK$@N8fFkaOtY1v%0Ofbj_=n zRdju~rE1m$%}<#XyO%ss`P8)wyDd?Hj$&!G@Iq_S7mLTg*KNVyd@<$Crn%}V?XkSP z{DD1B+ul2{zj*X#%D*1V z>xNgu{_7nCU)&&goI0rdSg0(9_Wz8`KYCO02lwVLKZkEJePuZ{ZQYO|Z;z?<#6Gfj zW>J$Rf7tO^jdxu$x=3Ds&HMu`mIpRGI=t+>JfiyN*jHAL{LZp0?Y5RNzxCZc^JQc3 zy9Ga3M%0hqaPpD0fB$jyYkgmR^php6b3}Yo!JlR=`dh`neX)Ma^1t1aw7v(wc2J*s z?v=U6EnfW@(?hFDpSt+P-zSv4bIP*rsmn&IsWioZhP{r`WG`_ znCHCnoaHs~ngdV2J@<Me{YR~`84 zM4BnAEI#_ovedA$>9(5YYr@L*uZN_jg_VEF`Ev1f{bf{W+xO`tw4f?@cJ8L$_^hpR zM|usQ!Snz1*u!x>ALu{-_`+XL4tXSK`T36F;;WB*ckb{1x@#P_Bxw1jVbs5`jZXP( z$Lvp2d;S)*yfWtIJ4Zbk`16dBFCFW8ENGeWe#f7NXL+Y}ee%MCUByAmvf7O&-}wC7 zsm6I5-@qk7%dThNnC$-LvUANf3+sc+gO)coJtgw*j=bD*qHl|~G-yd`Tw>v8ul-wM z?ag^3Rs}6Tmu|i#eembAo~+k%#YLknMc`}T?(ZoKjJ8=ihWXxaVGFZS+wXTq#|ey;!P zr>>yo;`_r^BpaX0XxVY--$Ql=EnjYUZ}iNub%*b6O`Uqzn?cK%3-jLp;Mn=6Glov~ zzxsC2vSSYUSMCQlU;J_V-1?I>LCc0ku{$634BM7v>HBBq?w~~+U1I!8$?0!zdgmql z?7KnB9X+2O+ilg~`|yviEcMj}Ewwq{ua53p{N94j{~tMT9!}NwK7Ma0GA2VA3Yq6A z6*4(^GFFHT5g}1BcG!n951BJ3l(BP=DdIfWDc;}n`TVZu`o4dE zJbyjspZmJcYpuQ4y7#^A``&Bsb3#SWmh1qzdp3s;M@%Lq7>)@gmhONxP|AMLFW+sd zRMLIDd#~kpDF|c6=tbI5T z@v)U%*Ut?eTx;3^)XyGqR-<&{D1LR&U2ok1jM}ea9&emW1tW%~i|sog{!Hcx$>q+9 zMBj|w>zzA*{zY06@7F@s^noCcjqV+=@x^Z5G{fS$dex_gcl&lg24%$lXWA8h@<}ez z^aDG9R^8Q%9edD7s6^2+ZDtvqw1`O6OQ z8o8ax<<0nj(Nx>YW?~0)#>=xvb=|l|DDlPZ`?dqJeR)IPs+Y<(d11I-Oz(hqL#wQ3 z*Nv0tE{JSu%$)pwmp5GvwW|~#P0yU80!!2jx%0) z@4ZX(mUlpom5}$v4KE6VsWMy2)g9nleSPPmLY&;!*1;iUeFs=tzxBF9JsV6n%f{-z zxdSLVMN6{H5*fJGD|k@bJO4*~OmaK<+D>EO^2w6)A!{-MV7;x~(z5=Yp2BxJt9c&* zC}-0>|0VbN;>L9N73uv1;1pFBZQ%b}#mHEiF696LaQY48k$-d@asBe_Ed?b3To!s{ zv3x2j2xD?j*Xtkwm|rrcrQp<)m2-c!FiAxKkTPp|e5CMNY|^K2LmC1Y8&0S=P)_L; z$XCwOOiKWd)*om~cyV*HD~f+W(-T12kq4u3+`L87KL}1`hX~-9%;4*#_gd7Y{A9sHZgR?^DK_A`*&N2|$ip+%d+nRlodqS>8ZL8&hn4Tv` z*0{SA0Z1i4AC^+}nL^q>9y%&R0Q3$|=&YKWSKO5ZBC#h4U`pYPx9qh?v;^T_hAyWF zKtxqlQb*M@KQ;fx4fZnxAk|khSe$BV9B$G1y+w`yb~4A4<1v|T1QV^2fU^X!7*#5? zOa`k*pOqewK@kA%GZUIe$&6Q-x7KD(kpNQtl=8{eX{yMYG<3270kl*p#+b>3rcYew zdTyyi077L9k5u+Iy56ULY{8{M0DP2Rs8&u(cgC|)gpZ#i0P1uelNCmOp97s;oZ06I zKtPhhQGp#r*3M)u>ZDEp?~>hDFay`WD+bUN$!HM3X^D?Jx8-|1pI_52+`dQvV{B>c z_|ppgoulc(t(OQOiYDJNQnAOWrQ1<3MVkQZEH5?bNgh6CvnH1Bs!ISX&I1=vFBgw* z^g5O*>k|O2fy%yX3wjIOgD*7M4GDnryNw#u>Xs9r=X_)3G65L$soW67=yeDBUl8vy zCV-c-ak^v)QID0wdIO403843m<6Vx6$2^=Ly>N&(CjiE0^4yv=v*FC$rc2&e2*A!m zUBtwlG7{^W$Z^Gz0Okg}-7^kxT{M0{KCgC-0C>J?X?kvW|CVmkw3f9YfaemG!f64F z7kKpeBY5oyAZ@Ku@Ou4Ssl=9Z7Ay|`y+8J!`%{Yq+W*)u!;sPa*Z!H)f7~BzK>x*q z9QNuB?uodp%b%wHx!;rWG$APQmrnn)Kjm+JmIr%neotrEA8Gu%m4E}^uA<&rm#ujF zx@<5~sVsxR!`n=_R4c+WMLkDmm#qtN6K4^xxi#fin2t$+v=s0(o8weNK{mpxkbY z=Z!me##2(^(!!@LY$;~={@oYDrL%IS>OaluF3YoZ9w=KnykwH1%~q5h4B}bux(@YS zIaZ*&k31_WpK_qa-9wekEQB%Y?UYtcm^9zSJ3`-w09r%$`+mz_7B$!3JUODU^JXmQ z6k{WQF2zX7BLT-xUP~#p-5N`2wT>xMll!UaEgMWGLd7cfl7soSrT^i9zO_xNC#-OK@T%i)Wy71{7Ez3z@JND1Ppg^;L zx!eg3i60^#O@F(JUHVe;_!$$Ooc@?~QKZ2QYTK7@eNgYIoxH!l{-Gw(Tz6ODR4{Xx z*!6fD@+Hm88RR*clrrX`9sA3;#Enjm$cuGSH3k$}x-N~ZdiZ{}nfNY-JX=FPisXI~ zZcn4IQ}inpUGHT)GMpHiI=d^5)Mm5k7bxi-bUDMBJRki<(??zKrFzQOQcSU|wP|yG z3GFfY)(1+H8ufpwe6MmruIS{jnO760l~@Lzpg5rU)w{RfHnoy70icE4X#3~6e1 zmAX2$8{gzq{;tzmWLE+Rvix(r8y@5m57@F4APD*+YcFu~KMnDd-yMb$@h*{gexfFR z&WmWTprrE~CpW!j+ z5_L=Bcy=Z5@B3tWcJQ0xe5&Y!@83+(0XuJuCXY9w`>bl&GRQJAaA0`IzAhjISVG2knud))La5v9q(Cs(Q7Yl6$}9jk^eu;5Z~m;wi9eGOafca@ z*)A^+oKpcpUyTwTGLeu~f)nDpB{2^uSZa2*hJlKothlhA3 z&lbjlc{*>ti+*`PSFtn0j_wU`oXG+vDz7JIFZ%Mvn!naMqjPITUe9fTH6u!)Akp6n0$ z=!E^?6Vpz5w5P1#d)^+^l{qJ2AUBetC3goKZzADjwLcaXTE58?u@C|${is*5V77rx zldl?5)k(u+VRar=39~@MeMbJzdBr`ICp=DLt*6tcyTRm4+N$sp*U_ZvwY;gh{a_;%a)9D4OI!+sEz9HrFeKw{BClhr{ZIqTVDgWUnst>{yg}_ ze^~KxzrYNQ#9{Q=D5;6)TdHXFBFxj}&$rPJf0SmdHx#3n93~@5H>S|yD#zw0PP2pG zc}v}wuIcRVD~9gwC+bWum#d3bc^eaPt%_&XEh_B< zYItuPUSTXf#e;Zo=>9Jk<5E1(HDl}~OTYs^-2ha@bv($gbdbJhfCqBdZo1u;!-KD5 zT&vGG@qndVntF!<4_foip2=Op0UlXK&73hD5WjC_d9VWq1Vv8w4IwxXto`h==sO$` zHc%g>EWm*kYAc4ceXn}7qUdSRm}Y$KI?+r)bQ z3qTqC%{OtPM?Vqs`O(g7dtx5?+pkG^FW&Nf3?@_~9iViD_VYpKSD;Pje0Ray5Dop@l?^xaBp-4fN5a+6iH5f74kPMS?+ z#iBxfHngB?@W9nC#3JWuB5KcHe&e^}*-N8Q>uT3U<6q%HSE{6kVhtMgysJlMAqx*^ z++y#`k~?8IdUlHJQt*JjT2e&s@?*@NpBc_+Md5>VFm2K<*y;y(aAc*glD9byGcKO@ z`e`s86d9V&PWA+$bfaH1CEdmY^@JC5EF3|YJ^xgc88ckuiowi1jFS81ga?Q|6NtJW ziMrY9K5u4?2Lkhly;BFDV0z8>hmM=!fu-bG^!mb6)Sh2IlM8PRo{qsBANFbuFJDe>M?XRBt%m@0uVvON_fR0` zt#*er9xP9DC5fs9p+@~DY*j_^;L1Ty;8*bkbJu$H>lZ#ekS?Hd{kk5E+FM7Ph&y}A z2}Mlo;815ED;~U~roA3~CK5$MK9v*3hzBvP9rxpz-B6b$(RoF*cu-bQeCg(;5Y*oK z)AV{ZL8cszk{;0f?LmeI8XG+p@}n^*!V#Od2Y=(hezRzWpsaArQhNN=`ZXMI(7D+5 zLn9uuw{D}wbvZUDlQDJ!2V7q-;6V53N9dU@Pt1DyH`(E79AM$-C}Cqu#(aCp^g(pm|SCwh{XB{>V6#HczVG;Ma&d8@4+^`3y#=8+n?&hM71Z#B&9~mn2~J;%9KB?7c!p zCk!$~bCWRx2XJ|=6?l7Vj3m1)>TNm>=thhiD2@bSLLce=3P{I+PiWISHe9}#y|`N( z5Q){mg=4(#zEFRfjsp+A8*<99g=3oSl`qey<3LX@)s@!NSQM}r({{|jf#WYORgTE` zVfNy+GuGZYGW=L1>ZG{FLP{qNu)N3gbiI$m?B%g;X{i$%NQ`A-~x*K!o;vtu!5O};(6{tE|W6AI;4`W-NPdGpi*W9JE697cm8 zQ>yp?9<+~MrT$FtLUq?(jOC=ogI7uMn_Ja!7%I-sW_65sP(oWI_1f(QYA@eD+D0&X<_vsGa)5e2bO2wS8 zEHBhvem}$mbEm}xW0FFek4#$P!K?V%J{{9&RG7>#`FBS=xadsw%H(V)%JLoA&l5NB zfD8SO@6uFNP&Rk_aAC3n-5oay;mwBPqK;*PUEFO4Xf2O-oAA$^~i**rk))geD76{f1rL}Qq1QVX|-@!(l|+$DwkKB$4%w7a#_ zcyPbXQmOWUK5EG`MzroH9{jBn!r{Ml$2x$Z@jrEgH|o|Yy!@QvuB;aSK;>4x{h&r( z?|XR5r%rVFaDEzF2QvsW++oWgGX*Pu-h9a1ttX_I|H@+LAGfjVPb|^x5iIK1^6GX57*a?;vF4=HGvtWmv*9{b;L(#J62y}hTTafA_IGwmb z0N>ny~x>64QzeDSI3Z5;MK~f-pa;6pOX%UD$Pn6`g#k7Pe!FrSD~&fK5yyV{PS5!!h?} z=+h{y;1tR^CDatyZ=_Wu2=)W=Dcd~{}UWc~pO$~asfxYa-cOejC;kAM}$c)bG3+*sa$V9IU z8;y47aDwc*rr??1F@USHHMxK4EodqMj*3(D)x8B;3PzA2y3oA)M()lhv~$W^?o0Kj zLE@&%n;Fe0@OyIh8QHT2fFJBvVAa`C+}^hwC~gynu5IvLeZRm2*c+SUJQyDUg3W8+ z2N8;J)v@4Vhje#%J>x>hfmionVQjBDKgT_|cL0sLa>p8Wp5d4d?`Ohx3pAV)Sh`ok zP^=yojjlq5wB9?0?x(;8#yZqa+}PsE zTo>0>JFNB%X~zby$Jl4N+Yyrv+1PLGW@9;GHZWW0KE1*9T*8d^l@49RPkERvop7@GhzG&t zw0GWDgayH`Tx_FNADYA3f|s6*guQ|T-`6LG(@enckH)+e>s^P%X>L0nW*Pfuop=0s zL{<$t0s~JyyDb98zL2o(#omJ3WL{(isJ@0rg9Sg_o~!xC4tw+5JI~%c_Qtt)9roDFLMMfSlN(40+Gef2^72(7pnu1jk>*(f*xhGGDh|Y5hFR#2N)Ey9cwcX@o5>7*LkZL{xrwzIC2)96QyP3ge1G-#hUr7A$WZ`lE?W;=TL*fZQOaH(o9Ij57=A1)ivbJZ ze)!P?eK3QMDbt4UfZS__>=615XethvwEtKF&KPIMMu$-X%B_H;2%Td9O0B%#PzD3% z`0}=aLVMt65dVsY=`kogl=D$Ds~4=lr+0BJk_Aib;z;z)WpHlNV{-hrFJLM^_2p%A z26!%qYZ6@_11mjsGwAJ8U}5}5DnpJEU}L|f*e+zJvzF8KtO)k;YOLj6=0Q|aOaqM3RqwMR+IX^ z4w$4fX~zuq0^frZrz1mK0erXQ#d_5k+AL40WhmeRxY;Y=HFq=t2!7dW`$5(KMn-xP zSlOq6SHZ_?xvFbmN+pfvS%oRm)i|JD>YtG*v&BE{zr}cuQZ;rUr>8%1dRw)Clw2DOU};1&I2H}MLO%kOoLKJE z{W`=BXDTFFf(09|-Z%^KtpljI9e0)LE0WpPZMXh)4M3gV)sI5Qkq5m}^op5l0NR*& ztwJ`Agt>IeELg1p2&Oq*zcYqxBprUd$-4%i@pAUT?NP*K-=}P|=~V#5HqyQ(j35=- zCrl5#S_M$X_F=jGBM7J4kwZT`R{=DBR>q!Y7&)~;V?rgr3ZPg-Pdjl*ZdHan3w)nROGbUy(kH7%2R zyc7BC`L>0Bd>KHNo6iHnI*{OYrce9dEdwY>(YmRp4bf@!7b}if22cjGCb>W>^6ku*HliqMniX^8v)d+x~wWHhUN8#l28AjoKT z_0dN}N}k48)9g-+Y>iAazsa zYFE{X{Fj-L9|q|Pg9?p#iG1ZygJmTm$fJK~ac2=gP?_3Rb445Op8z$G5W)a}K(xL|vjz zTmO>x8S*@uyEaaWsQU^FIK?3+?v(H|Fc9^bfemgS#5uR+*BvY#K#3S*c4**#P>U59P0_&UfBX6@80F*ICUf}%^=(hIH zM1utYaZmWDP&NWh+I`xhqw@fQ^CHKhn?VbUCFBw?51{dGrwY0@5OY$(?KC%0?Sh5HRIhcOq8IE-_FtLum<7<{S*jZGKCp}lmfzx@1yH9BcdTwdSTb3^N7gd~pvAfN zZqLuab**y#TlfrsVgtfbqX)pFO5?Ib)C_X52$4;G33Xa3L^X|=3Ga-n1;@OTk)TvaQ3=AMuI z=kpy1dZqSsJIWFV6j%AuTjWYWhSNT-lI#Ug6(?tq=lv0U|LtT%ydK?CA2nz~JAin8 zrZv&N$7~xGRVjMG4<%pn@8L6GBb`HxXs>JP`m4nGxB0!%BF_KP9qRQm#?Q#OjKc+_ zWeki>Zl)9CYemzktAFCO+~4O4f8SP;Q2hIz&p2WxrTgc3Ypm)#fk60#941@hD@kq! z=}i>hZW`9_&SM<$*?lhC`se=Y6GA)s_|Nm#Tvhu&&&{RA&Smjkr~|f&%Gm@0g0%FD z2!(oL0KuVHWj?tQ3F|Cc558Lt+Eu%5GU=5f>0{#`7G>7~6#M;FVB2SeYgWw3muVe9 z5M3S4{WFqLx_QuYnHZ0CnI@S&BLPuNTsd890P+=*Gpp!Fy57~(TzEs&gJKOW`jIMH z$&+evYXE{+y*u~yBfQEytm&R>0E&$bZ+Y2=4066m*4A4CkPi7}741IcBVSDZ<&(tt z@BHD+S}(#p^31t}naE#m=RWI2G|e0IY}Qr*^zy!ZylO9^Ef!a5Kd=g*iemYdA3exe ztXV6jY85~pG3Pp-^dP?MgUeRWi20%VC@0*5+`D|9@p8~AfP&8BCuX~m9_Q(fL~CNc zkdotg)Quzr=1%adtpX@wD5@UajfALDC=*18`9@Iq>ueYDrTXnK&!JTSZK#X7KJG$3 zkIAaV{9FOhM&(m`r7i>(8vCR&umYeY{G-kvok&xbFBV-*%ooF~FP?TH5BSGF1U_E@ zP=&SLcePGLHnf-TK*S1w7Q1lVRJCm>naF7~D?) zG2Fi_%-x2}YSLs3_7U~F50Bn$MMP^Eu$I+7iR-zod7=fW7`iFS_u?mjVi_f1)fQx5 zXL>u&!=C_JJnrE0vKcvcJG9>HCNV#$JG#;~BNL|!FLYS^1Q1p=hugCWfqO3{-8xU? z%&swBf#Jz45*nvgL;5<<>5hCBYFoMD&GD>YvZm|&a??p_t5rU-r z?mo^^)d6BY9niA>^&auRV|19eehEO9 zlH9jOs*qWMRxkfI#C$0<{Q+Bvl(CD^lBE&z>GhKHITc8?N10#o17d!DRYLZ#94W)# z`5*WYbve}~uQFsvTJzLH8)E-^uJl(*kO|D_^p*^tB4WQ5Uf@iK`rS|06rUimVqNVQE)d6)AGIYEkK`3DHZ;f) z^6k8~weq&CMkCmt|)R8m#B9GrNQ|v!T)cI~v?YBhOHwD(Y z#)`F-Zv^b|17 z6i41PivtjJxMQF=6BN8@^$mKBBj)Q)vj;Cg3hlG!>|VrrV*m~@&jY2&)FE+aiMkQq zNw5%HericIPDX5>^eyRTF-Usv^Np}0`fS2n&tQ(#Ooh9D)A0`K0vAdx$r@*XM&?PAVox8(%@Ssv3;DX0YdZsk6Ats&}k?;CyJ z1J{FRTm>SD^~tmhlS(z%Z){Qh$e75-Jf*1-5S9M^WU0UcfZ#Y$7JDoJ(+jwe)p-CF z#|MY0)q>h5!#B4-&I3rQrQJ=S4hU(4({etZ2aryE&S&xuKn#tqpRk<=5W`8-hc6#M zWJI&Q`k8qE1>JT&UG))YNF6_Mk!l`5i(NwU3H9I(emQJrcn&~|tbFZG4dA(=rS$Ql zIRM4lEo{JzAlJADd=Dma_EjuP6NtP)g@=uZ_0gJv@N5$hyjTz`A~pvgcw^t`_syVd zIe{sIYz{z>*s&jxEr0_x%$NR|SpSfj>zcKK*f)&__+QTg2#aa67j6TR9f`{lVY2|T zRPQ^r)&_1~%*Iuj6Zv`B>e_Z7r#}6xL3S2E*3l9>r1_ege-v z6QcFL&j6@`i_wL?6Zk`I=^e-nfI1WCD?B>^{fC+%Z1N0%Ji^nQdpp6_QQmw(FCxEq z^4{q#aPVo#D@c0=K4GK#~d`fDj0c5GdaGkXW)bS_U=ch~qh;_kLz^4ZoQ5;>SyfqCV zsiH0Iz8*l!)IZ#EnOMI`PU2*G|Ebr;@}q**{rdi?*M?oOxr;U3|I};tXLSQ#b9Vky zug&rW=L|@<{!_0R`(UZHjT-)`*Py$pjiULr|I}+&=%YHkwW|K9*V>L*nW7Tk{8O)S z(ted&(R=>?TCatgEL-Hi$p5Eadna)^U;hf`pL*@!Ft^V)f%<>yH4il&y70Qzf9kcb zcQTqH4|M%guTkO3jHLGWg1z@VWJ4;{v*i*kgl~x7 zD`f9O`s|C-rb54C{(Q$x!hL-nU#;my#?itFjvV{{_J>Hg<*~X*t6ronR8w7Yfa&kN z$5;P{zYGtT+TV+ur3wD=Q+ed?_^~8h-O*4prw6foq#NGwhWl^-3=$rc^mJ6M2Z;}= z@4aNg|Ca}maPF^F6Eoe&fM|I#r=P%IZb`x;#+Xd+cO#(qQyFs$%fI6=3HSZ9r6k;q zcn|3d@tGd^JAZBxp5$1Y)YOISH<)(76mjj^hjji01?Ki$$l}Z3lMP&4yY^Wjng8ow zkq5dEJJSQ(A72Xm?T;nlu{S38vN{oZ@|8O{XWG9!gM@d!d&CcSB7x#7X%(jzG5?AO zk#P8mD{JK^;{N3QsK;5Z$#8311X(qZI5w7zn^XTk`0x zeMmS~+xdifJHp}6@;M!7h>A^+&=xxotB7n-Hqa;XtH%&weC)oMGSnf=0wxL;rg0@W15Tq{nBQKGffU z*iF36a++e;^*>VkJfPzhIExQ&VR?pmr3TIIr&YX9*HrdjEx-Q-t|us9@Oe0 zdg&vA@;zl$OM6uDU-1kQ9?Qx7+w%i*)yU#VJ&#H~G(OGd{!z!zA*i28@eL)?>ILJ56Z%wwta(8WyN@3@n_z( zKPf+qm7*>};-XK7q?w5SJ3hWh!r44Wl?xC}kN$7BgOB|?jwRt(nKfgtTm+Z7EPMX9 zSoOc+8Kiut@?KgNlD{LcTE1@;^{;pk35R^?Q-afxDXKgE0ztyn|B73Z&aaP>qcRbZ z&)G~ccqp{HzDWE3E`EuPK~i&i*8DlYVEz^7CglvyBIAL`6g)%+CfKU~6^9o8`~ScG z>+`>GES`klzsbT71ZG5^B|A6n#@8Sc9+Y5wnL8GAuTM~zjqKG|r2U(P_%9>@Sz1$> zs*K(I0FiKb`o4uy2GIY!WR5*dw(B1_lKv9CukEsd(029B8%K7pe-H`BrZeY1dIABayPoY^GeVBeX{{J9Z-{-p&65oK7 zG`h+WoS7@tu?l21g&Q z1OkhZyR9zI$amu_36Etd z{%!jK+`oR2_oZaRU;Dr$y!d2@V%$gITefX*D`YpmbCdGSsc(YypfSMl+sw(``H#>2 z4`+y~(K2cPz7i<0$WMFq6AAaY8OgZV0KT3`{r2$i-t{NpI_JV3-fsj4RN_1s?Dp$~w~ ze3qpCF*6#FZUy;YUuiu&wOb!!N%**e+`Z0LP{wFr^6}#C_01sR42un0?ror3^hy2o zg{8mo$C8A{_7*F?X$Pl@S=L1eyXzMw?LSSR*Y5yQD@vAvjCFsn4>t*iMyCo_JHX-S z_qHr2TK*m%BH_g)F2|BT0jV#vEeow2yY`PC2;Zslgu16sBb_#y}be{^-qi93=Pm( zYf5N2ej0BYY*YG|#61%0v3PTnbU6E-?m*sTy_2jqB|wJG4cocp50 zco>m>ubUF46_+r$SY4JP`&Qlm0RSjT?|bGyhkNm~ZaQ-eBwTQ?>!zHEZ}K8$F4-?p7|}T&fL?jT zr0_mQ(~uY%3AvN?vQ^=%j(&aE`H`2LW zbw@4rKVpfO3oGWh0?$!x^{uTeCPIu%WIW!o6kf&qROp-L`noBuiS$|^;2Bx3E_!Gp zr+&w`}-DiwY@{sf^0%rmABwMUgRySnx)G-#%!4c1>ksl*4X> z_chkEUp{)-jDNrW_-yzhA(!`S>dyWuVqh_KiN{TVYMEl{1bOF>!F`lTs(58fvhJ1Z z0L~CaOTmc_NLPBUv@MU+8F%@m)*rW%)>`|7n2Zs5&M?o^ufHo7Uv zKgtAOA~?L#XT2j9zj#1u7ct{Y!!i_|V_#m96|#hT?^9qmS7|6Sb3~l|wn@@k&eyw?jBo>TNG zOMz?!rFjAp%VT15#-g;3Gf9<6?Fh`A-Ys+?>x%qQ$Qp9wdS0>X%oe^$IAeuBbkE6; zHGZx3yQo~wZEA>ge*XHm4YQ2Zc|PC`(aS;mh0l|Br0n6Q>5YU5nbi5^C5;$uD1dI< zA1DC&%c1J^FiA|H)W>XK-CeDGGLk^V>0FTp2(Y(|F|e{y6}#2cxo=f4#X;}{WOy20 z$V|AmGEcolasjdQ5?)g!%DPc}->U?ZUVr7nr9qsu>PA%Q!0MOHDjG&~YukJ}4OK3# z(W=Ms24hlRxC_&&RwN96l;3FCw1>6$(pS{Apq5!Mt`g==zUwUy?GV4azcw>gSH-O2 z%@PW-4;aO6NY?S{Iqekb25=@vbA6b4ki4KNxIQIC1*gkjs3n zr}m=kpuscFidWEKhSkE1#uOJQBa!9 z-NKKZiGIfpuvQ$=l@HONe<4#}SO)YDlh^L!)s!kw!{Ya_a%rx^EN&CXYD4Dr-kJ8^ zsCD33H#?WKU3G5^O5(ahM^M8m&*v~Oq9fPjEjYc#Dgurg3rNx377dv116#sw+^1|m z_#~nHISBCep9-!zsZAXIT7~P`0~?k?jz)qs z`l|F|9&YJcK^JB&v3e%GX&WdwsjccAEh46Zg*SMgWq|zc$E*79nGYq9q3(J6{!Dcq z6Y3ZOT1buI&C60$n5U8fJR>v+}u@djxkTWiSn-?j}RJtZ0>LM{1 zG>x4kZzez&?CPR%Ok3Wto~!Y;+x6XhJ`Wt;x<~IC_ml0PjbeVeviWnyU-%!ev|;d3 z#WTn6BLAe)cDN-Djrgu#@W+TGf_}D8hqIr_t@lc84swdeBT`nJZRN-n5|WPjH0|GL zlCtuBwYKE3zpt~J=A?JBR_>>aYHP!I$`VXAp@BdxFSQjkBZGE-+a5QwB`bub0ormr ze`=BL5k@CRCaTE)G;ADcah1>)$F6uF4Q>ls#{&wIGbJM>ZT{SJ*iG~@_95uRKqW{| z9NL~!{rs)NQnE9>iELGYmCaSozkZ`}FHlpd>`V?Vy8s=PyQdQgxEuS_meUoqqnpzd zHukEH3+(B2mwjYs zP~fk~^AjB{#Vu&G1uJPooXTUES!;{*=5Wp8fiKQbE| zg^%jqG!?xGnYGR{ErNZ-%Jq&xEmGMD+)Po6_9?NQ`23eY94r)xcM`qG|8}o(p4>-b zX>$|&PCkgPc!W^ahy>#2d0*HJW_%^R9viIqB7(MU;m%7=NXE>D1s3mO+pjl9T!*w>rHiE>hd77BbB{_-`^am}NJ@R6qxi1(~U>hToXFoU7U7e$38VQ+kJ+mIFO{nu0wh$&G^{COhK@ZMzW!bRH^5vo$aU<$ikX6{C=9-S6c($AUA^GoTxaUyXmWS>@-WDjq~~RI1a#OcO`&>aGfOa*Xxwd7SfN%FT_8s$^s_$*H{tK zZ5RK=rnvSp0V*VWYc%ArS*t1A8!uY>;{XEv}rVLVXujq`agB0D7GY6+aBhM3jvUQ10rMb{&z4 ze;XS=u9dHhhAW(HAR< ze#s#^>OPcBu8P_F$Mslbip~b9m5}E%dYX7?v>eHT!OdvB?QAUx_Rrf14r zxCv^p<~kuTQqOd&{4cFuVNKxnbo`!{Q8BFTl$jr%IEmuqQ#6I2MjG3#*968MoDg$N}CUxDwZX@ieOz-uqOFoXfT8{z8 zfP*kPa06pX5s?Ka_nt@Kyn~sR)?Q1bQl=0()qTxR8vKf{~Rmf!wnB$6glHRk(beAImX!%s6#_iiJX`Xr*gL)bNp#Sy^k4#MBub3k!=^S%5L z(i68{;dJBZnC>|NuBj|%ti3nd@-J$COm`-VgTCz#1N5J-`M|_!M&(u(=Krweb0Yyb z`&+{7b70VM+m*)Om%09w-YE7v~1`y@n=M&I*-5LFeA7>z^Q7p)%J2(%c(VB z!wH1KZ19tduiN4rZ(_@@XoO3Z&td&mZFuRUo=gC|#%;2ET|ub@gtWCiBRpgc4fzS{ z>51gu2z^|zgnwaZJ5uwwdoQ*l4M@@H@}JwnuPYei&^&`{vPE!Nb8R{tn%!d~#bFZ8 z^^$NOpjHd{m>)eqY~ne0(0y!QzJKw(xY6^hh<(3-RL4O5_bv=T+1`~$(;<;aJY4=) zM+p*_f6y%;4UaO%`@bL0vmty9dH-Dw6`t{vJae`0g4yM}FGs@Y(R7L09v$j{Le$-- z=R*2P-edJ_Q9W-LSz(5&>uipT&0bnnc>05DFUVGK`?m@N+xscic|92%CqNmqu*)=i z!@!R#7bAnqd*(&qm$8D!xTEK^o|@S!=Wd*D21% z7#;}#H3hxrmU&HI-rI*m;=2G0@SXF#!fa za~_8N1ny0iZlCwO-65f*k)8z3*^JZr-hKDW@=}DhSA$9}pl?YX>#+u#q+Ryoi(iYA zhV|K9ZYi&sPXppMx#?M`@#a zn@IHeY7V>e6T;V>S(q8$zQTJrPB=jV*cnIoI8VJu*bK|WH)(xfd~Ei6VFv#uEMADd$6@4UMkPZ61^m&js5Cz8Jht z3|5SaKc(85i8U<RzmGwUbH$8#)7<_Z53K(d1aZV<|5z zVT|>_*@g@$a@72LyJ|I;GkjJK>hEKiTBOL8vG{JpbN89(`CYg(;`+1O^GCrmLiPdo z*4~%U^Bcie0g!L#BrP#>ZSH>^{GdSR_ctzM#1rS>hp_WKK`7QqxGYULXQHN)>bh+H z??~m1aCZb<{(@qx#{X@!K0!9;C!hbq9#gcKwZN@P@{Jn^+&9QT~}Uz%d09SNg+DVbjL&W zoPy!b>u&_1z1YfY4CdL+(-Wy*z;GK2pNN^w=&Sx7jOQz651X`tA!Ply%M-AMl!A^N;sIP8-vuu}(S@_UE> zKTg3ukf4#=mh&g{$!Y$6z692En=Bu*Vf&f{qW4YeEDW$HpiSl(wfBOw-5X- zKq^a);&?c=lOdbm)#5L$Y}e>ypZX}Dp|Yw_b>fGas8Jt}pV_hveGJ0NQxct#K4tAE z+oP7H59x`WiEnCw|GHo8W$giNS#)v}8tvdaam)rY{>3e6m36QTq|=VE2v@SJ1K zYV}EF7H+=QTgE)k`&5hb}(Y!H^VM#QMJ@S{WJMXHRa>zc1NIDN}Sz9>m>z7ui2OsMkK z`|C|x(1&OTy!+5^2dLB*Y$hz9uiC$&pgGq!l;=d(qR&`e5|~{a~~Iww!SYh2OKD#=TRLPA_f4;)qI!Cq?P)dgbH`MH55L zxPo<9PGGqti9kYHAcA6%8ikx|8vp9+`NA&_sU#(uu=v~45^J>!>eFJ2S2aI5eD|_; zIh`=?;&sC8<2eiPSlXmglR)x_gsV)hB1@9$`Vr@^16Xr%pbTMpU&H|ip7NCD z3^Rh?yk4+rADH(e;s@bMrt%HB4?HAG5q;C=#1l#Bb7JWyy6!Q4*)g$_HR41TCN24C z*xVBgdY_y4asjdt7#8*+y|gW6If!qA4c%e`+h1J++h!A*i51SE97P(OgmMXmvXGo2 zg=88pkcaG&@}Ws@{&bB3p*08B81*xHXKvAandi#MA+o?CE>o9pVX?VPJ&C}gWx0}W zYF~ZhhMbvlXmWYdjX{rTe^}L-XAZBRl+~N#Wl0r_bLofuwvSax?Oa!+wyqDP7uuE9 zb7lA3iPu4EdmFat=K73MqwT*41w-gNcIAZp9Hxe-r&xwqa2~ll49x>Aml=%iuk>HD zqz)U`V}(48A1^OSMIM$)U!avgKXO)Il>!(}D~9g`PCAy*shgE$uhyQAp#0n)(p%3v zJ89@d!k)e_`)dliz)izkI{^<;3l_ieT5}Kc=e-6fu|XQ++Cbauk=nM}<-?P#rNpbyCFtcSaCu|SZ(KsF3+lH$!GPZLrm@_- zG>ZO4%C9*|tJ`=%j3P|soq(D2jU?JATrX_=S283R9;ng?5*ZAcBI#}?q7A zEG-Nz>|dC_u+}iv^J*!=J~yAgtIA}t!m`5G!qmdm!q&o%!tcQBe2Pc!Md< zi`0w$&&y}BPh_ZMaAe42h-7GaFrxnj72L7=q6S65MkBDI^-{qwBe0V6TEH+PvBLJ^ zz)-`rV)jzPB+Y*motNJM*g6q=n_#NpS#f$fVV2=rVS8g>+W&n*j$xfKf>dCnKS=FA zsA1+|H&AzQVOrk32)91;Kir_8`|UtzkMMgM3@yS>#5^KVgdlksjgz?A1(@%MdAPmK zFdi_cu$(Z~pJqN8e+sgMp@40Ku|}9d%p(>>3YrFRyng^~KLEoYA8qfh7@YiL)1#An z=HTP$+xzp|Hz-;WQOZoQaJRJb3}^r!AXQC;GQbIBz(zhvEmn2q=upXEHRn!QF-4__tr@QP@&~@+yOlkp((x zq<;yM2V_)O)v#Sqq%eFuzX@SWXJVc`4&UZ_?P|6GNQAs#KI^`=7>ixdwk zn5o75Yw*RJ7I`T}^jW@FO2t_fJFp3siXqsIn=G!txRjQt1=fNA_Ep{(UaC)A#XF|J zxPUfX3+`7+9)8$Ab~vO%;xFHp;r`&0DZ;3rev1%;e3RN`mD*K{6epE3VUWUz2o4~W zGQpGDHHhpd#15Iq4zZ#|wxgxzdjgfxnhHpn@JV4<(MFb}v#;>{cHn`NG$nufud3zG z^fsSz$>3rdf@vc?)vdtef2$8Rkp*l=B{z}ED&7aYAr5Xq10!^d{7NR*F39M_rB_!j z$PBTiPk+F02l_kO(?EL!0oq8~=jej6OQkge7yg`Wvwi8OaINVy^dZJK^Q8T=IRr(mn=0i#iG$wU8K+ zH?HwBBivB2{@s?J$khobngY(1PBo6rn+vl_k|7}yCH!+8VbXWCh_LXoK}u=3+!6Rz zoHBPf{i3M1-@<>uIa;YOlsuG|W9>8yIA`H)ldI7J+K=Y`u& zmF<=4oj_~zOnjk#;#l^}B#9>6LxbI_GBpovspXF;`5|_FP-mFS7dzXf+iabTv|3E( z&>wY}XQ>msR60~TWh;_v=@+OZ6_j>@rR+%~^1UJ}p!yB`i2G!U`Gkx}jTw&CqTrKJ zqKv~aR#vPlI6J2KWOZ#PX(ws=)E&(m)fZD~r{Vg^lk=hIPcz!KmZqET-{LFaifBul zO*nX@dsXwKU)uQwWmqG*QER5WrL;rO2)dq(!cRSDcOmj462R$j5$Q_s{K^*_ATzAJ z#AOcGZOX}>_#sP(rGuqYrXA(eXuF5;BDpkhewGn8gB9O5N-;I&E5ZgaEit9@Zsftp z`xxY`^O=MZf^{2<8l9Jm;u{qlRUCrLCSRfm3ydE#0}PDj(-^b2#WO41toLv9D-IEy zQ>OTiJwl1jh8|9i|-p;Fl@*N5ovKFN8Bdbq;@*Z=$j zACD9w@fKW6tD_xS_XA)&kg%xDV~JFd6zyG8jmMO!S$9;3D+eEDPPa7MvJAK1BH;!n3i`ZoILY)N=UEl{)9+T9PK?abca3+sTe;p z24!tUW=(7E9h@@ctv_-9DkT{ND_6M8ru+43k_-@|>;F0|P|^PBkME2AvsPaXiF*Dw zkM59nz#>=cNyBWbX&~vrdd1b!Q=obF(`RCii*z0jfn4>?s2e=t(9R2kN=EabzJi^O z;?L`yG|qql4Exqq6gM#uPA&g98D*nCLEMpg0DpLqjk4jp5MM=BrIBvAp1zB0M3+ib zmMG5xqj%Qa_3p2+?U>Fpzjb)D_HHY(wVQ9no|qArx_OB0fbHn{sR2*5S9pSbN%@Ya zI?;YBv2>)>!z(AHF8i6>vO^=YTJw=B@4vlIA6TP9dFlWVPWM<&n6>3Ai4x44F5r#| zdWZrS)|Ke`cfnUb9LKhM7*`e@q{|3C-ewEV?(KJ6YDA71wL4f!8DUAk^Utx2dVd~W zt7@nDgF$O&wYOhcR)7l5cSk(`UDypOpO%sdtcCdJlX4*7nOSlL120ee-RvAgjw(o1 zgep-xuP^sA;?Q@VRf^MDEm_#B7_Q#o?fU$0WZacIaFp${BG|51)BUFIy-fmXr~$2C zrfEj@7E*cYcA76uw)jc@QMc{H{1(&J>I!o(!xg=H;f%M$_>?kH+hr!;c}Xj?DFT5l z650J-4>qoN#soiH2TfV!>(nEuJp>||?1G-a=w03?-Xfkk&8BQ-Uz!ay!r!9P;x(?Z zEKx}MZ8v|60-jaWnbtzHI+>kys|OdAnFeu2nyxy1SRCU~CC0u2cNb{foK439p3YY; zynEe9EdhQA(lN-U18qd=BCWXlT8e`jT4|f&Mnl6a9JRe>{WZ(dJC=Xrr~dmn z(Ty5=xu$YIDX#CA9s1)n=IQ>3hOO+yR*?Rg#EZ!X)9&&a;gXwY_hOPXzhgTLXy?=? zGHe(cha!{T8Wt;Xv=Nz#!To3Wes>&R(7U4Rm>`h&wB`i{hl1um1~Z0p5hJwO;#Xr6 zp=gqN3_G*1>-z=b*4t=oF0BpJCJP}**G6cLU+$1wL4x+v>ZeIzUZmIxLb2+VXq!r^ zr!gS}Uc0_!t*ZXwbz4@5H7w-Sn>v@a9o<4<`ai!Ve{cC%W0eCFe?bf3qO;iFP&w4S zpCs*mX@w15Y~F8DJGs0;5nU`htQt{Q;>`T!YA)CEY{Q*xupLL8h=$kHosSd|nP-eo zM=3_myk79^QXu2l)esksQgVtTiD^uP%mR=obdbCA>f-j88^!ssnV;9m|8qdqW3VA7 z7CsF?%<$S@|HKC-p^4Gi-IVC~vL6)HYzB5~`U^0l%0=!9F;hmW^PR=?*Z2L0_=z(< zeY3xQN8(uVsbizL~?ih?|USj%NP>}9?#HHWzOrwnl z__f&OsL%g_7w;5#t;dXo)bq1&rx?dtZ7XI+5C1O<6uEzjVTYqLItfHO<2**++2TP} zAK7}`{?7D$T5;&dt?XoiVN8xPx7ke*=nBfyTW@l)5@=1F+vYA*(hcR_DlWU;Lsyyv z7&E*8vqE(i!>;T=uIJ}MAy&%mSJxt>k}8kVoo)y6j2p!v&?^S-eryCo?{6S3mSF}5 zO8e=izZYEyVcNH5yrv+xFKC?&Lfm; z)0=XAx}*K+*TO3n4L@5>>^j}w5H&}^ zKLSO7i~aS{w9T)}Ej*d`A_U~1KH#{||}iY0TQJ*G1D=48d~ z%d$aR@d7Xz)}+PM z@5p@z6zXJTcFNXzp}3n3}gKt`}8zrRGn z8wa{$#cH05bzShB1I&1o-qe4c?8h3fw!-tauKvb(yf@Q*MQVM!CFb>!{a3NVOK*{4 z-R6kBwSLDz&9oL_b?XR zo4yz{eb7|AY{S(Od_?c$Ix)dE48Zcdq1jn(0ft^=Dqr24oz0%GkPSbZav1wUL%DAERbYR5QHi#Lt{Hk zwe}ix(ERWFE_gd0Z2UhqJ4Vqv(X`A_`(IpX(ILYQRvg!_wO^de(DHmPF8%_Hg{6-m z!Ci+GcNZIRjL%&^6@75hScs9_z}DC?PiQSSZM^sFq*mK+`0p`FPdtHPSVDeR*HVRS z@6{IC2d^YG3PwZe4;D|24iuS|kilSa65;N00;R- z>h$EN_~06CT?rl?AYueE*6U`(lf{UyLfX|;Jnt^_GMCed*cseuE%reqf$P|H@=Qq;S@q)$Q1r{xL?=$HXnDrgUP44nz~otrD^WpfqNKt z`V;U$n9gp-=$PRM^T@@L`|`{jt{W%u0Z+&xVn1@AcUr5u^(PHfIUKG0u)h^IB8pjL z;&-Pq>Ho&254}hUXKcmbFbp8j^6pTvIe~lI-V;(BSXE;p<3Dx2E8pr9GGXtc@ehCX zRoSCDWNj&V`ZriydIaw(!R!ImPE1+{9f}{VEP@Z~{Sq6Q1yPWmGFpwEv~Kr_!0nQm z%H9S6#{W**y#|sHI0`dJ3HF>WR@GqcaADgqjlJlc&G;fUQmoHweqFC+Zuwa>)gG~k zUf#N?bVdC>Y<}jg3xfZCB-Ua>;t81QgM2}mS)UdobtCbGC%WUFgl9f7-o-}qjhi0m ze|hdj!tYJWI1Vsl_J!*3)|ta@SfXuZ4D=Cz{f}Lb3NQ80wpOQLsVz+I_I1*s)JS&Y zyxJ>*q$s7X&hA70#^d&!sV=qpldx!0VlL8X)LY!7G}W1Ldk;RxU4hKfR#O9x5B~o5 z?{L~UL`3&f65Hd9if!J)wbbx-jknG(_l()@7Wpj6U+mMPl2ADE{k)l_S%657S3cVB zZ$zEG%lefVmQ+R(f!gUIAx@Kh{flmWhHQA>xsZlN#kWuSoR!nV4k14ALJ1)nRYZz( zWBn9-tH&Nz;tvYA&eZS|_(ZK~F3zUpNNJngq`RJIv4P1Uh3RogNno?7UyP`BdO?Ti zlLI2?u6Za^654#E6LFSeBV*Ej1)%M$u&s`U8NA#$I%U_OOvUJCkc^Qhu4FcXc55d5 zqX0^+B@fcjr6p{nBBTB|EVt#(;FG;RfE3B@k5~SsF>dsz^lRob?}HMz`z1(%q74SZ zL==7G7PNe{_cBi;=wX0X5`B1Qcu42_sAY4!X;gd`WC%MWaJ>k4*LHnuXc)KOI=W%u zaZlU+m>jKt0Ompj1Z6H;KI$8dCp^oKH(K@;stJ6m&4taRBPa_i)wyQXgl&hPBCmlx zhO?Ua)yK4$j|?mw%N!xPx>tM^P2MB!ekU}37ZyhLtZ7U}we`vOY$|m{&Mw6-A-UyM z4SX6|GXH|Ap#b5dqQAum4ct{MhJQ^{y12SqIz1;&Zmc{B#+$!PYcM`oY5?-+YEG^e z7xmw#)H>7zavyOSNpM*bj1n~7hX*Ie4?>So!0^r*fNI}=v!?0=9|zg zBh0tJ#}Xly?&ibUX0-sZvVVApvX^cuthQn&djmbs7$=)&Hrv4G3WaP7`R21Bt+Eat zCJ*`-=}Le}MczrhLmDGAfFY~1MBRIJ^5%lHx@ILHqUfe$HZihIpd48Ew}WR&b8FU1 zZ6s$sRj9N6BXq_M`gq$z54Bu9h#XMh(wJX0Qm+Cx0IBLw;Vwpi zyI334xbG{qvnDele(j9t|QS?I_@mG%M_?e12s@vk=nvVANoj!ydLqDpioYM33W zSC((}hXjBCy}+!v#ck)?TNY21OGnH}-3_nhmFsm9Mxx~p%e;z@e|hD!t$-u<=aVxl zEyK3_#_^57zc(+0xR>!gEs!>mzg|2Dab{;Y6%x>H8Z9R+4Sdf(%(H27;GFW6o&-(k zjEFv$0ylU`y~oE(*XYtgcPG8h2y31Pkq?O7H?&VMJylrfv9>(YJ(3Kc?Q2okHQ%}H=hNfmd3770NQUONB z+HSQ^F=6P*)g95a+b5J0#8}<5Pr$B9{1#ZeW%PDbLRdEYWAXPRK&hTen2 z)*{Yp7NAOYG~Sv+EXkUpkK-EkO9ocE?44f$IwmyrxKI*6^TN&dP|$)@7>5lP&;r** zL@*cTNH?StOgrko2LwaXA>+8!-63y^7XhB9!fa_f_cdh6+t<+f`{UZ z0;p$z2zPEl@Af-TqC6nV9enoJPrOi0=a-Y6yQCeW>A~lo7G8Jc#0`m0Qk%ZJ%k3Xi zV{%76R;6Q`7h4M%wAIQvIh52>li2$QZSn=|0$pFH|e#|aA{ZyWuG?Sso2!1sX|XDlAb>RpzEG9`_s1?<9m|20xvJ(s|EGm zkI%jc9W$@TUcF4J1uY%v$530r;7yb-jh*uTa1a2pIcq-}bt`WOukK9hG>}uf5YMgl z8@e$L$=^r?+M#I}!xP%UiyyxXVUdXB6r)+?6U%15$FWlX7cKRfX5K_F za^%|lX7b&2a_F#?%clq4Ye#c(NWF68#cRpz=oR2r>J??iqY?HAuNV)GE%W@Z@0fZI$vrC9Tcr$o<2%SAs&Ck;+S^WcZ!Z*$bA zdtnh+rt@XrZC4P~=nVQ)kyu z9mn9u@=TLEv4JwEnDAJ-J;Jd>?^v@v#<3JUOYBY~1cVfHoRGAqK?+|_ zV146B3c^k>e3MBEM@|s##C!qWLh^%hJiOCU!hmngxl>0(QWl@x^ z9xtydRWA3njLM@ZcarLBQ37Xz<(#;#9H9-(tt`?B<*gjv3AIpB+Fe2*yC~w=H+*Ue z^W^9Rm--+^%BWG(`ag_R6Qi#6zbYv!Ms4duiKLej2gdm8bM46p$EaODtt!S+>d7J| ze-jPYb(E==T(zkA>4tM?OSNsa$op9ftwu@IZMMl*S(LIxqkK`RD+W?NN@YN78p^K&}Xde;v*b+lp-8`ziuWYG9;}X%yvoUe1mh_L`~PMbAtj$mAJoydG7N1s%evl zGouA%{W%~bN{MhQ%YCT|Xo+@IcU+|5YaH?96&-XYnID9cJjj3=edq#AzaO|R7 zmf}IjBGC7AOlZ_xF*(%hFOUu_Rrth)61AW6;IX?Oqo>Skw2}Q2i}Vl{`iPyzO%?G7`={=h1h?wIhE?wKnJe|MP z#VWt7UwAB8+Qdrlp{^ETsu~SHmiJe~X-(p|A0AUww=$eYu8UXOPkr{wuNalm`s&p- zX=;~J(MNr>+)l55&m1>R7Lze0f$^npTQBEcv&RwbW0r-yN6fWaW$kwe5O%fvj?o+@T2GE4pAxiO1q6kNj+OKp zIuEN=a$WIJ+|)LP4Oh7~zdsGS#q|fP^qUT`^j`mVtG#b&=XWrbXyRB=V5n*G9b$QU zcIW}|<_>};`fcP6!bPPFs!Z=w0}<%;vn+%WbQs3-4zZhUWC+)=aMk8N~x~a;d60 zu3gV2l{&`M3UTBnNup??coGHlN9Q`EV$eEd`dfV12Yqsf1;a-6&l4kymEtCnF6kCV zy%7XkM)nhAyK?z4jCOB1*QIX4!%v(~I8z;qbu@~J%IsBan8cKsK~-m|1jQ+Pf05dR zUKH63h;JnY5d%XE%NrTKcOr^~OqPWEAq#3I$o-^i2uJ=(8E2&m7F&X_68aVKCCV$8 ztysqC(F-EG;FkHq2h9neU!LeE4!d*z zo&-y(PJ>)c<(3h0D{s9vKEsl>p{4X>ASeL zY@JfHEJ=>4?w5SR{0KWKI%BqcoswEs1?JZG9PXQaVj#@L5^TS=hq(@#{Z4ND9fL~- z>{7YM+dFf%$n{$Ax=C1e3!inVqy*dJb}0fFjRr>_B3eUSQz%7v2GUOUpXviFTwAnF zK{tm_?yi}NI~0e%^s8A+zrDzF`U6Kx6T$;9NexPHM*UrZ{WSO2{_?h!oNXzJTHpEQ8jDvOpNYjX2bDS7`M0YARRyy3 zEMp1A11!3cjf!i=wJzM&ZT+d=S%GtXINCzEDbhw~gsC)>6}K9vRMJ(#)>V&OPy9Zv z7KNZ8hntwIlq-S|sS-=Q3Q&#RwGEZZtE^F5-RAPq*`3EzySIUGbNh(Qk>~5DW=)NS z&mwdbZ>)IQ8$LyR^DH>{#C$$Fu$jPJp3`E_tb`Mmmh}UC+tlsiQLWKdT$_@msi_;c zH~c_47Malp!dq`m+?Jd(P48At=55eD!|kWQT#*sby!k6dGke(}%e_^3$b03RV8aS1 zdE)KAiVc<1H#11A7A0$!++7;9@I%{+RTt*{tp0NK%u{c z{4#ymPYXo+QGd)|;4kzS`5W|1UbRxs4eGc;k&-2=Fha!>R^`?hq+FS3q)o5%h=ysE zN|vM89~0T-d_gHMOKsto_)QM0s!UnxA0hOZ*m-6Ca(~!b>1PRB#T9^GY+34q}oBSjEUanm4(KP!7 zrfhYNdZd52maA^@xB83n+WaOlp=$Sc_+!c}O|!|TX|oV!tGLr&FY5C5i1STczE{!h zCjtm`i+lW1BUf)XT9hGOhl3s<0|Apj!3?kh>_D?HBaj)$;wyAzLQa5{=h24+IRRdv zP?#Oy1_S|qKo}4ORHkfkIbR%51Z06$TZ^sIC=K{jl0cJ28K{x#1GxcJKp;>D%mGut z7|;c@0Yjk8W)D~bwm_4^8qfqrXz~IQxg+2VxC5?0exS-I4+I0=fG6M!_yeIpg)ew==JVVwXDhkNtHfeEyk(X;O31rH$gv?xz*r$kE zb(Ye=NMS_)hVnpJpfWJbP^$4OY+A3L5D|u|Ky{#AEwk4Kh6QQ@-PRF-h<$jVJ}}H) z7ib8uER6xRttlW7YHT^?=D^56mP{yY2}q>|2iwsiYzxo~92rktXyL2dRJDe7o6MLk zi&@(PVWVDdmku}Na_dw%GP9#2&>3)>y8^9FPJU0IJ75+dNDq=hT2N~hsF^`VkO;DZ z>|jQa6U+=|1+#-?ygEZputUq|%@)s0o%UNkfiU9?Z0wauq>kkSkUN)j@5r#i$GFgSkOrP!Kc( zbrPmEPcE@C40fwAC{&wxrl2|4lviZ21-p4!T5He})JuGNXD}~l4>FzQ(sq?2m}gY0 zv?h1Z70eHMf)!G4u*(`%`GV~hor!7S8vVgckx-LmZ51-ifnY!(w=3*DylAjGHxz8; zb3&0I*BlN8gB`MXuryd5EDpwu6~VZ*C|Dk>bOsfEeL=85R2AfC%XuZiHhyK0CoT)t z1Z#sW!RBCNup!vyYzp$lJXwdTJvb~_A1n-Z@J9qk2Hm+Vxs*RV*cNOJ3dC%Eg&VJg-NdpMRn4UC?pP5C}kmKND?Ad@{lmpmDic4 z4rxMut{~JTW^lzqMJP9<51B)jkSSyh=|aYkEo2XALtP3(D4^%d_#u%d6sop4L-`?B zC>RQay6qC7FJzPm1@4g4=?w+A{!m`X6AFh65=SWR$aKU)MWG&DyR$e{5Q>H(p~4W? zCN!BOC82nzG}I~K@rQ+^!s<{>h%K)QRfNhzwV|?5U8s}a5ULNc3?o8~p~_H~q$$)A z8X0O0HHX?l?V*lPjjb!x8Pce-wH5p>es@U2&C~XTa%&MTmJs23EiFtB%SB|E5oU&i zdWW<)Pie1FvBC{nRb7dtM(L2V!)86x)~L@4XM{Q7%y4#?XOnOXtfiKmFh49(D@5F| zBrI0*!Ul7JLl72*rQsT*C@hc_XiZ_ErAc3A;Y2!YjfRnSMHu{=Ttirxs}38(+ORpC z8`g*G&B|~$Umk80jnIq3vanDV)k@U5u*cjavIr^#&{)IHur1sz$qy5XY8gYN3U@2= z!XbqtY~WhLY{LkVP;3t~xw&$&rpe&5xWfgy41K1;6ZVB&;bNQ05Yu(qoXVnbVYp4x zBMFCP>M9e@91O>GZOT|!st$ysVXxUAh9oYChclf{xhOXhj%h`*GED_fsSAaTBC{ml zP!KNE6^Bd15`A^JEL;)RSw|Qu!&wfCLnh4TmWNBiZNf@kRoLpN4J-5`!o$Ng;l{8x zTo-N%>n+2K!@~7pi=1!SZrY;!OpvtS;)`%q{7m5`jlU35Ju|>FAma))kkK{!h5veWiH)->%A$hqa*WxhhocR%#(iIVN zePV~U$m)*h73SQiLZb0Rx^1nzn8F|NMgkF;(--N~1|xiZDAFN}M8c71Bo^rucA3Pv zwW7G9SQk@qx$y|WFOEoLMUhOoTwNGZsI_?+@*vl#t%&fnW}aVFVQ-Qv)l6-9q%=|% z8J5e4)t4>LY$jvDGGNitx26wI|ms9uaAc z*!j(omdMD+FqI|O$ZdlQIi#gh1QAZ8Y+-SabxZUflwCC{) z6qbBbbfm@@)kgEBc~M)`!M8-6QD4-e*VzJ5!s?GUm^F5VuvM#7c@5bPchnX2MDwG; zs3U5RdZX58ZEjnhN!cuy%j@krfzx0!S$R!bp*BMjjw)nbf@ri^P#i6Yj?mf#S#p~o zUmlB=OYD;2#z@q}jYkWk4sn)5DYT19qV4iVyF^hM1IkB}d;=Cww9%@>`;eScuyemFIOw360q>B1*Y7AuQs)%kgCv0*VnO5+y_yfK}+A=VmeS2hW^MK36CdH=#tUMCxG*l_iQ|{z!#O-sCjKP4OayIc|yD;?{V`UZAQ~8Wi@pBTm!g z#hvl|xGV0Cd*Z&hH|~#+~g}rg)Wv6g9-_;=|%a4y_?1J}7IUeHG!D-t3upyleM{WV zb2_*MIR!1+tb$sH*u*F>8uEA=8M}a~$}Zp(unIB@sstGYR&%zqSv^uKE)W(tth@q2 zft;t6@$*%J5^J%8E>LJh1@eMiHP<02;1@^>3Y;U1dXxD7W8Xcao4)dXUs-Z*>XvME z>Hk-k{g>o!tM^{q8`yxsv;e`T1%hb_HJCsM5R$-zOvps;Hg2+UlVltBN+x7NCS-;@ zLnh=5nL#sTbk}-b+Ks!%7n5CBvU4mk*IQVI4>bNMaGpS19+Md10}O4WEq1j zNFvF^GAlWmpp@mx3UH}FhDN0EsMH2BlI+ReZH9fn%4Y5ENvsEK$TDx@0z_L#C0LWENSfP%ldWj54Rp zEMp6FvM^GW%!Dz>tTLO-!pLD1$tq-JvSxl`_!s6gE*#k(1<9IYXWzHxZ-QL|K85ET_v0 z88msU+-L{nTsd3Ll(Xa3X=Q}d(&S<}BrlXnB5yUFu6d7~`DPEDFNK}Yw?NfTs{BSfVsVs-lP)&kiSu6hZ|` zh!#Q$8>)z?N)an0igX2&oTQ$rT!fjigdglDHhTqDo;@kO^9xPEjdDii#Kpg-MYi%EVW2cxl93aEAt-Z@F&rKTB_bSsZ;8eMx|M4QCgKYrAg^f+LcZvASzJ0ly0R8TP5J}ij;-QVr7Z4LRqRT zQG>-su&;=!y-niqEykU=#*Ghj4DnQuQGBHREa91 z8>vF6(5i$Kj4FdI=ZjF8D69&v!l@hpkw(l|0q^b;6x=P5)AcLYzRT7w`%2ws8a#eY%9FnURAm4e$s!zr&u3=>c|@~{PeF?SVk801v8wDUGr^`R zVmVbw7>mlpL82_l;#7yqrQ-9lX$7i6m0Kmkl&i{Ak)#S$v8qy4qRQeFsY+F0YM5Hd zuTq(j2sKMT4t6-URa#pq%djE7T~;qYpLny8LuC#zG`By~1k zf(F1SvL=PBjwbWaOfE%j<^XiMnxQtb=~Sv($)u@8lssfKj;StTvD9o@ya3Jx)Sx<@ z$rf?cY_*-lQ#+7CHD4`7i;@Itkmw@ncp|lwpQeUrsitn*oq$rSi!ds+Qms|X z)H-#vNUt`i3#2BsQEgUR)HsnL{jDO=7y#;dm;P&%}^8ShqS% zQ=~TF3e^ZrfjW&+qApd(0%d9$CWorwR;Ue(Vs*K?QeB=Lp-JFIa7uw3e7FX#!Evh8 zGG;kY1{5U|G*OxuO}r*S6RU~SL~9~7Fik2i9gWkVHAx!0#?6itq@*AjJuNlVeBa;O>!FPE9DA!*1OnubLJK|sUO&^7o}o<^kMYuFl&MyO$E z(#2d2QzOubH9TypCQSorq#B8)h?B0V5LtOSnoLcGMoi1rfQA`?xMyIi9tQw2Ptg&kx znq-<&HDB4`Sg=3|siR@&XmZPnr zv9w$*Ut7u&X?a>HkB{XGWJsa5QY6sYQ5G;&o1sn9W@;tcayE~Yt`%#uw2+oX4(AKV zQmsOpr(&-%%d{y#k+x76FTcw5R!gO#QLKm)!&_(GY zb)_~0i+Y_Bs!@sT^B>L3Nm$6W`-_Xm!-?mrOoZoKp%?QlmL$orDs@wdhPb5mrht zq}Vty1Sa3Ev+6{|RH6}SNX}-7(^A zdIu>=UqX!3$Li6nFdm$q$4Jy8^>O-meS#h$;`L~~j%(pZaZ!4#9;0XRlk^0A5}l|| z(Npy#eX^d)ChIABG#b#;^mIK#4`Zp6NR)rjWmGexnac(N%algZQb^(d4; zFVu_lsrocM86T4a>9sVmo==kKk!e!BjF*Q+(6h)+ZUQ-7FD7Q_1ssh&OV4E#vZ;hj zeK%p_l7Zu}Zy4uhyfIxgxDTlIlR|^m@HP??M{&CcU1^CRy~+ z7&OwXx9LS}7BvGM$ZM6=L!2Sr5R1eboXA*1j3L~BFoYRk1~s#s5ow4p zL>nCR^dvee${-;+>B)u^LpC}AO)w-F@CLFW$$&Ey=`n^xLmC!kAQ{jGiUDb;U>k)* zL#lyoD5rwBd_2RDi65z3|51jX)|O9)dm8_Xs{UK1a^bL zU^YbaVX1CInZadXk|2YK7bYk*lo$#Og$6vT*x)pzvx*E=$S?+zS8jkAvpH3U3<{S7 zH&XBjV=1@NkYT7Wq^5>}Zf>j*WkegpjYaH4W274yG7|oCKqrOg1u%1$4SG%*Zry=@cW) zNHwDJ!}0+m%UC2NsX!y!$T4OTq&S{2A1cHpi`;m=QDC$&g~l>48L38#jS{2CNKQ#L zGT3QG$e3$PH)a{7#tdVoF^iOKq%$*;7??aG6{9rf8x_W6j?5@Ga=1Ahm9dgxF&d0! zw9XjA*BdoPtZ5mQTyrAC-3hFWf{G8P#N zjbWxdbcGRasx+1vF|1;vfgNc|5k{E8O$nwb6Vjv;VoWinSW}`2Z9ri&32(xh zaHeEaiYW%ez!6Od6Tw6>C7CEDnu%&+nCPY)BWPlpSSG;4Hd&ImCXNY7mJ%anJQGAF zV)!O8Dw85Gr4xlFC6de)nM~Allh|ZuN=#`c89vpNVZtZL72CON*+6lR8* z5oWkK+>9bem?O_SITQ_LhY*-Rspvnb}wqzo$Ei~wn7R1(!(%!tP^%uI7O z#hS!2$MNN~B3z+>M+eMos)LzB0nJ=9&rC^XFgWI13WduyTT&z_kvS{LmSRm2rV7mh zb0l4eW2Po!@+f?Bni(>unzINrp*JLOY$c?dGt6SMipB*K znfYi3hl#_oa?ROh0h3M>V{^>8RGx^InrGIVaV(u#Z8n=VW`((eB{%1rVM0fW(kwG; z%>`sSp^O3Wb5JT|IA}B*%sS9&R+%kkn>mhPGG`FeNp^FV&}A+(yUjSR!>qs;n2XG1 z=3;ZHxx`#g~}yb=$2#)$&z9rTR=X= zLbcE=3`;yl&oXjV$(h7dt{g4m02T>0oyM|oEu~DgfNkMe5^y|=nk{EIIb;B|u=y6W zz!H_pU;(Ml6ut$;$g@PzOTaX4s)d^3N|8~t?0AC6BD9#ebdnf=EMiL*G0h^eNG%x_ zI3wMn!)94BE!mb_OTI;B$)Kf@wdn}}0e@T^>v#^NLuQR5kUi_W68 zSS@CY!D6x)Efz~L&SA-FpB9>pu?JuE43C`!)?)^ zg6Xzau_Qo&wZy8R>e&JogH~)!U?3QU)@Wo{YME8Zz>#^>3TwI5j;ypMawBcIpqZM@ zEWtn&X#D? zlH+Z$^ccDZ$rqt)E)K?qwjpgAwG?Z!;%rzO-bN5A!32JiEt^EJ5pBsf7+^wX6O&UZ zHf&Ogjbtm}N-;zs6)y#-HkyrY3j>%ohD`#pYC z5}9w~*>Z?(A}vK^(~*TXfz8OU6PPq4he%Gf$thx6nhml^Z4z42;1%9d)^ z+RUOHg58D%Og5{{Y;)M0HlwY`R)8|t;yD(Zf|5(*@HKdlOakNS1vZ<_ZDR@utU{a1 z7Dq3&mDq}HiTrYMnN7}TS%RyuSJXQ)O!JcSmvf}M1 zdy+lbPPE4ZXgkJ^w-f9%e2N`s$J(iOnw@T^*vWPkB?ctf0Xx&qvNP-@4A9QDbM5I^ zj=fAEwe##kJKrv_i|lE3$S$_0+a>l4dzL-ZPGso?+4cl_j-AEJwZ~#es7!1IHqV}K zm)YfZg*^+Kj*$`Z9F<*ZSKISYI=j}cvFq(7I~!@RTkK}L&2F{Z?Fpd6?zFq@F1v+W zU@x?5lZ))db}pY!MNKNN4Urd z#-h|TJSmAsLs>;;VTuC)%1I;#*&(1(95xZrL31!1bO+VJbg&#{bQKzK5Couu?TAT5 z<#HTc2hSmL@Ern&(2?q3(TW8CEzRNPKn{spAP_qw4yhv(li|pwW;zf_S&lqMjw9FM z#$-G49Wn<8DR(Fw8j8}v#%UaChsxnJ=kc@-okQ<1IE)UHBL{1CSR8P+&5?q3IvfrJ zijHUVl38KN3ZkBzM|C?~4u;Tx6?5{y3aUtyn^fc|bny9cU>d5}QQ&~MCSi%A)KTs* zF>*0^m@h6dI09WX6^)B^ z#yR7}DftpkIWh%Vkb>k_QR1C)L4q?+$UxCk5}h_Q(us0noLDE`iFV?gx!5Ep!AW!` zJ5!uwC&@{5GMp4A%}IAMoeaF2#Bu^oB@uK|FsW>|ljF=`nnA9!k}Y6lp=@|N-pv#_ z9e6uh=;S*EPM$N%nd(e)LQb($>XbOM$?48aCkB_{ET>}#*-jxN#~BaiIu%ZtGv6t9 z<~dbPrBmZ%;?+*AQ|B}|^-iPH>@+zmh!&^SNy6BicBhl-a5|kXr`xF_7B~x?Mb2Vp zi4(;sb4GB>ou$r7XN9xM33G+H;4XwK+!f)9bVa$MT`{g$SDY)}mEgkVC%Q^BSR4$4 zPDZ(qu5bayg>|7_IG2i#ca`J9Q(aUOE`!VHN@1B?NgTV& z?6SB}e3l>$bhw-@3TSg#T`}lVSBa|-Rpcskxn1QLmkUjbMyrVxu5wqItJqcPs&a+9 z5$*_gJPPIxa~BYa0=OH^k99}7bV*;6}Oe z?j(1zo9HIF$!?09o0{S_Gpxx}H_c6VGu%u!mcViY?nDykX1h6Vu3O;dxk;&fw_PN3 z=ZZw`Dt4+Ha*N$*ZYxnJQ1gp36#3=+ShUoghDxHH{_#4NW|kta00-f0I0w#!^Wc2A04{`!;HmI5 zI0P5NC2%P`9i9QtglECC;W=;-EcHK4<^-4$u7a!K8n_m&gX`f2xDjrGo8cC?6>fvu z;SRVH?t;7F1@J<65xf{)0xyM^!P8(&7z9JX>@XM<2Em~o7)WQ+@4^sJGYn4$nfal7 zCXt>@C(|i(9E69Wp%^F@ii6^z1Sk=mp