From 985d7756afb8e21c886e8e3ed28062fa2856eb3b Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Fri, 19 Jun 2026 12:33:00 +0200 Subject: [PATCH 1/6] feat(stdio): harden startStdioServer lifecycle and error handling - await startStdioServer in cli.ts with .catch() so startup rejections are not silently swallowed - register uncaughtException/unhandledRejection handlers in stdio mode (previously only present in startServer/HTTP path) - add SIGTERM/SIGINT handlers that call destroyAllCertStrategies() and resolve the closed promise for a clean exit - guard against non-Error thrown values producing "Error: undefined" by using `error instanceof Error ? error.message : String(error)` - LOGGER.warn now respects forceStderr flag, consistent with log/info --- src/aem/aem.connector.ts | 4 +-- src/cli.ts | 28 +++++++++++++++--- src/index.ts | 4 +-- src/mcp/mcp.server.ts | 9 ++++-- src/server/app.server.ts | 64 ++++++++++++++++++++++++++++++++++++++++ src/types.ts | 1 + src/utils/logger.ts | 26 +++++++++++++--- src/utils/sanitize.ts | 20 ++++++++++++- 8 files changed, 141 insertions(+), 15 deletions(-) diff --git a/src/aem/aem.connector.ts b/src/aem/aem.connector.ts index 0fe5734..8d7372a 100644 --- a/src/aem/aem.connector.ts +++ b/src/aem/aem.connector.ts @@ -2546,7 +2546,7 @@ export class AEMConnector { */ async getAvailableTemplates(parentPath: string): Promise { return safeExecute(async () => { - console.log('getAvailableTemplates for parentPath:', parentPath); + LOGGER.log('getAvailableTemplates for parentPath:', parentPath); // Try to determine site configuration from parent path let confPath = '/conf'; const pathParts = parentPath.split('/'); @@ -3224,7 +3224,7 @@ export class AEMConnector { clearTemplateCache(): void { this.templateCache.clear(); this.templateCacheExpiry.clear(); - console.log('πŸ—‘οΈ Template cache cleared'); + LOGGER.log('πŸ—‘οΈ Template cache cleared'); } /** diff --git a/src/cli.ts b/src/cli.ts index 5f1071f..a577560 100644 --- a/src/cli.ts +++ b/src/cli.ts @@ -2,7 +2,7 @@ import yargs from 'yargs'; import { hideBin } from 'yargs/helpers'; -import { startServer } from './index.js'; +import { startServer, startStdioServer } from './index.js'; import { CliParams } from './types'; import { hasUrlCredentials } from './utils/sanitize.js'; import { CertParamsSchema } from './aem/aem.auth.schemas.js'; @@ -36,6 +36,12 @@ const argv: CliArgs = yargs(hideBin(process.argv)).options({ default: Number(process.env.AEM_CERT_WATCH_INTERVAL_MIN) || 0, describe: 'periodically check the cert file mtime every N minutes; on change, reload PEMs and rebuild the undici.Agent (rotation without restart). 0 disables (default). SIGHUP still works regardless. Env: AEM_CERT_WATCH_INTERVAL_MIN.', }, + stdio: { + type: 'boolean', + default: false, + alias: 'e', + describe: 'run as a stdio MCP subprocess (JSON-RPC over stdin/stdout) instead of the HTTP server. Mutually exclusive with the HTTP mode β€” no port is bound. For Claude Desktop / Cursor / VS Code.', + }, mcpPort: { type: 'number', default: 8502, alias: 'm' }, bind: { type: 'string', @@ -62,7 +68,7 @@ if (argv.help) { process.exit(0); // prevent startServer from running } -const { host, user, pass, mcpPort, id, secret, bind } = argv; +const { host, user, pass, mcpPort, id, secret, bind, stdio } = argv; const allowOrigin = argv.allowOrigin ?? []; const shutdownDrainSeconds = argv.shutdownDrainSeconds ?? 60; @@ -98,7 +104,7 @@ const { cert, key, ca, passphrase } = certValidation.data; const certWatchIntervalMin = argv.certWatchIntervalMin ?? 0; -startServer({ +const params = { host, user, pass, @@ -113,4 +119,18 @@ startServer({ allowOrigin, bind, shutdownDrainSeconds, -}); + stdio, +}; + +// Strict XOR: stdio mode and the HTTP server are mutually exclusive. Running +// both would leave an unauthenticated HTTP endpoint bound on mcpPort alongside +// the stdio subprocess β€” double the attack surface. In stdio mode no port is +// ever bound. +if (stdio) { + startStdioServer(params).catch((err) => { + process.stderr.write(`[stdio] fatal: ${err?.message ?? err}\n`); + process.exit(1); + }); +} else { + startServer(params); +} diff --git a/src/index.ts b/src/index.ts index 45fd3d7..e4c5953 100644 --- a/src/index.ts +++ b/src/index.ts @@ -1,3 +1,3 @@ -import { startServer } from './server/app.server.js'; +import { startServer, startStdioServer } from './server/app.server.js'; -export { startServer }; +export { startServer, startStdioServer }; diff --git a/src/mcp/mcp.server.ts b/src/mcp/mcp.server.ts index 2858ef4..d994172 100644 --- a/src/mcp/mcp.server.ts +++ b/src/mcp/mcp.server.ts @@ -4,6 +4,7 @@ import { tools } from './mcp.tools.js'; import { MCPRequestHandler } from './mcp.aem-handler.js'; import { CliParams } from '../types.js'; import { LOGGER } from '../utils/logger.js'; +import { sanitizeForWire } from '../utils/sanitize.js'; export const createMCPServer = (cliParams: CliParams) => { const mcpHandler = new MCPRequestHandler(cliParams); @@ -76,7 +77,7 @@ export const createMCPServer = (cliParams: CliParams) => { return { content: [{ type: 'text', text: JSON.stringify(result, null, 2) }] }; } catch (error: any) { - LOGGER.error('ERROR CallToolRequestSchema', error.message); + LOGGER.error('ERROR CallToolRequestSchema', error instanceof Error ? error.message : String(error)); // Check if it's an OAuth error if (error.code === 'OAUTH_REQUIRED' && error.authUrl) { @@ -97,8 +98,12 @@ export const createMCPServer = (cliParams: CliParams) => { }; } + // sanitizeForWire: collapse CR/LF so a multi-line AEM error renders as a + // single readable line. The transport JSON.stringify's this response, so + // newlines are already escaped for the wire β€” this is readability + + // defense-in-depth, not required for JSON-RPC framing. return { - content: [{ type: 'text', text: `Error: ${error.message}` }], + content: [{ type: 'text', text: sanitizeForWire(`Error: ${error instanceof Error ? error.message : String(error)}`) }], isError: true, }; } diff --git a/src/server/app.server.ts b/src/server/app.server.ts index d51fd8e..e27a805 100644 --- a/src/server/app.server.ts +++ b/src/server/app.server.ts @@ -1,13 +1,16 @@ import fs from 'node:fs'; import express, { Request, Response, NextFunction } from 'express'; import cors from 'cors'; +import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'; import { handleRequest } from '../mcp/mcp.server-handler.js'; +import { createMCPServer } from '../mcp/mcp.server.js'; // import { useBasicAuth } from './app.auth.js'; import { AEMConnector } from '../aem/aem.connector.js'; import { destroyAllCertStrategies, reloadAllCertStrategies } from '../aem/aem.auth.js'; import { config } from '../config.js'; import { CliParams } from '../types.js'; import { LOGGER } from '../utils/logger.js'; +import { redactCliParams } from '../utils/sanitize.js'; import { transports } from '../mcp/mcp.transports.js'; // Cap on how long we wait for `destroyAllCertStrategies()` during shutdown @@ -329,3 +332,64 @@ export const startServer = (params: CliParams = {}) => { process.on('uncaughtException', (err) => fatal('uncaughtException', err)); process.on('unhandledRejection', (reason) => fatal('unhandledRejection', reason)); }; + +/** + * Stdio transport entry point (feat: stdio mode). The sibling of startServer(): + * it serves the SAME MCP tool surface over newline-delimited JSON-RPC on + * stdin/stdout instead of HTTP. Used by Claude Desktop, Cursor, and VS Code, + * which spawn the binary as a subprocess. No Express, no CORS, no Origin + * allowlist, no session map, NO port bound β€” cli.ts dispatches this XOR + * startServer(), never both. + * + * stdout is the JSON-RPC wire here, so it MUST stay byte-clean. Two layers of + * protection are installed BEFORE the transport connects: + * 1. LOGGER.useStderr() β€” our logger never writes to stdout. + * 2. console.log/info/debug β†’ stderr β€” backstops stray stdout writes from + * *dependencies*, the subtlest corruption vector. A single non-framed + * byte on stdout makes the client reject the frame and drop the link. + */ +export const startStdioServer = async (params: CliParams = {}) => { + LOGGER.useStderr(); + const toStderr = console.error.bind(console); + console.log = toStderr; + console.info = toStderr; + console.debug = toStderr; + + LOGGER.log('Starting stdio MCP server with CLI params:', redactCliParams(params)); + + const server = createMCPServer(params); + const transport = new StdioServerTransport(); + + // Resolve when the connection closes OR when a signal requests shutdown. + // Use the Server's public `onclose` callback rather than transport.onclose β€” + // Protocol.connect() overwrites transport.onclose with its own internal + // cleanup handler, but invokes server.onclose afterwards. + // resolveClose! β€” the Promise executor runs synchronously so it is always + // assigned before any async code can reference it. + let resolveClose!: () => void; + const closed = new Promise((resolve) => { + resolveClose = resolve; + server.onclose = resolve; + }); + + const shutdown = (signal: string) => { + process.stderr.write(`[stdio] ${signal} received β€” closing\n`); + destroyAllCertStrategies(); + resolveClose(); + }; + process.on('SIGTERM', () => shutdown('SIGTERM')); + process.on('SIGINT', () => shutdown('SIGINT')); + + process.on('uncaughtException', (err) => { + process.stderr.write(`[stdio] uncaughtException: ${err.stack ?? err.message}\n`); + process.exit(1); + }); + process.on('unhandledRejection', (reason) => { + const msg = reason instanceof Error ? reason.stack : String(reason); + process.stderr.write(`[stdio] unhandledRejection: ${msg}\n`); + process.exit(1); + }); + + await server.connect(transport); + await closed; +}; diff --git a/src/types.ts b/src/types.ts index 4984dd1..e41e38b 100644 --- a/src/types.ts +++ b/src/types.ts @@ -13,4 +13,5 @@ export type CliParams = { allowOrigin?: string[]; bind?: string; shutdownDrainSeconds?: number; + stdio?: boolean; }; diff --git a/src/utils/logger.ts b/src/utils/logger.ts index 29b7899..079010a 100644 --- a/src/utils/logger.ts +++ b/src/utils/logger.ts @@ -1,7 +1,13 @@ /** * Simple logger utility. * Must be disabled for production use to not interfere with Cursor stdio/stdout. - * Set ENABLE_LOGGER=true in env to enable logging (default: disabled) + * Set MCP_LOGGER=true in env to enable logging (default: disabled). + * + * stdout safety: `LOGGER.log`/`LOGGER.info` default to `console.log`/ + * `console.info`, which write to stdout. In stdio transport mode stdout is the + * JSON-RPC wire β€” any non-framed byte there corrupts the stream and drops the + * client. `useStderr()` flips an internal switch so all levels route to + * `console.error` (stderr); `startStdioServer()` calls it before connecting. */ const link = (text: string, url: string) => { @@ -21,20 +27,32 @@ function getCallerInfo() { const ENABLE_LOGGER = !!process.env.MCP_LOGGER; +// When true, every level is forced onto stderr regardless of its usual console +// method. Set once at startup via LOGGER.useStderr(); never flipped back. +let forceStderr = false; + export const LOGGER = { + /** + * Force all log output onto stderr. Required before connecting a + * StdioServerTransport so logging never contaminates the stdout JSON-RPC + * stream. Idempotent and one-way. + */ + useStderr: () => { + forceStderr = true; + }, log: (...args: any[]) => { if (ENABLE_LOGGER) { - console.log(`[${getCallerInfo()}]`, ...args); + (forceStderr ? console.error : console.log)(`[${getCallerInfo()}]`, ...args); } }, info: (...args: any[]) => { if (ENABLE_LOGGER) { - console.info(`[${getCallerInfo()}]`, ...args); + (forceStderr ? console.error : console.info)(`[${getCallerInfo()}]`, ...args); } }, warn: (...args: any[]) => { if (ENABLE_LOGGER) { - console.warn(`[${getCallerInfo()}]`, ...args); + (forceStderr ? console.error : console.warn)(`[${getCallerInfo()}]`, ...args); } }, error: (...args: any[]) => { diff --git a/src/utils/sanitize.ts b/src/utils/sanitize.ts index 7b9eefd..8808bc1 100644 --- a/src/utils/sanitize.ts +++ b/src/utils/sanitize.ts @@ -27,6 +27,20 @@ export function sanitizeErrorMessage(msg: string): string { return msg.replace(/(\bhttps?:\/\/)[^\s@/]+@/gi, '$1'); } +/** + * Collapse embedded CR/LF into single spaces so a string renders as one line. + * The MCP transport JSON.stringify's outgoing messages, which already escapes + * newlines inside JSON string values β€” so this is a readability + defense-in- + * depth measure, not required for wire framing. Worth applying anywhere an + * error message is interpolated into a plain text field (e.g. + * `` `Error: ${err.message}` ``) so logs and clients show a single clean line. + * Safe to call in HTTP mode too β€” it only touches CR/LF. + */ +export function sanitizeForWire(s: string): string { + if (!s) return s; + return s.replace(/\r\n|\r|\n/g, ' '); +} + /** * True when the given URL string carries embedded credentials (`user:pass@`). * Used at config-load time to reject misconfigured hosts before any fetch is @@ -84,8 +98,12 @@ export function summarizeAemBody(data: unknown, maxLen = 200): string | null { /* not JSON β€” fall through to plain-text handling */ } + // Normalize C0 control chars (incl. TAB/CR/LF) to single spaces so the error + // summary renders as one readable line. The transport JSON.stringify's this + // value for the wire, so newlines are already escaped β€” this is readability + + // defense-in-depth, not required for JSON-RPC framing. // eslint-disable-next-line no-control-regex - const cleaned = str.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F]/g, ''); + const cleaned = str.replace(/[\x00-\x1F]/g, ' '); return truncate(cleaned, maxLen); } From 71671eb31649f0620bca99defcfaced7b84a2748 Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Fri, 19 Jun 2026 12:40:00 +0200 Subject: [PATCH 2/6] refactor(server): decouple cert reload from SIGHUP handler Extract doReloadCerts() so the mtime watcher invokes the reload logic directly instead of routing through onSighup (avoids the SIGHUP-specific log line and shuttingDown guard). Warn when certWatchIntervalMin is set without a cert path, and make BasicAuthStrategy.encodedToken private. --- src/aem/aem.auth.ts | 2 +- src/server/app.server.ts | 18 +++++++++++++----- 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/src/aem/aem.auth.ts b/src/aem/aem.auth.ts index 5f25427..2c74d0e 100644 --- a/src/aem/aem.auth.ts +++ b/src/aem/aem.auth.ts @@ -134,7 +134,7 @@ export class BasicAuthStrategy implements AuthStrategy { * (Γ©/ΓΌ/Γ±/etc.) round-trip correctly. Passwords with code points > 0xFF still * can't be expressed in Basic auth and are out of scope. */ - readonly encodedToken: string; + private readonly encodedToken: string; constructor(username: string, password: string) { if (!username || !password) { diff --git a/src/server/app.server.ts b/src/server/app.server.ts index e27a805..93f95f7 100644 --- a/src/server/app.server.ts +++ b/src/server/app.server.ts @@ -246,9 +246,7 @@ export const startServer = (params: CliParams = {}) => { // CertAuthStrategy: re-read PEMs, atomic Agent swap, 30s drain on the old // Agent. Stderr-only (unconditional) so SREs see the transition without // needing MCP_LOGGER. No-op when no cert-mode strategy is active. - const onSighup = async () => { - if (shuttingDown) return; - process.stderr.write('[cert-reload] SIGHUP received β€” reloading cert-auth strategies\n'); + const doReloadCerts = async () => { try { const { reloaded, errors } = await reloadAllCertStrategies(); if (reloaded === 0 && errors.length === 0) { @@ -263,6 +261,11 @@ export const startServer = (params: CliParams = {}) => { process.stderr.write(`[cert-reload] fatal error: ${e?.message ?? e}\n`); } }; + const onSighup = async () => { + if (shuttingDown) return; + process.stderr.write('[cert-reload] SIGHUP received β€” reloading cert-auth strategies\n'); + await doReloadCerts(); + }; process.on('SIGHUP', () => { void onSighup(); }); // Optional mtime polling. When --cert-watch-interval-min N is non-zero AND @@ -271,6 +274,11 @@ export const startServer = (params: CliParams = {}) => { // alone doesn't keep the process alive on shutdown. const watchMinutes = params?.certWatchIntervalMin ?? 0; const certPath = params?.cert; + if (watchMinutes > 0 && !certPath) { + process.stderr.write( + '[cert-watch] certWatchIntervalMin is set but no cert path was supplied β€” watcher disabled\n' + ); + } if (watchMinutes > 0 && certPath) { let lastMtimeMs: number | undefined; try { @@ -299,10 +307,10 @@ export const startServer = (params: CliParams = {}) => { if (currentMtimeMs !== lastMtimeMs) { process.stderr.write( `[cert-watch] cert mtime changed (was ${new Date(lastMtimeMs!).toISOString()}, ` + - `now ${new Date(currentMtimeMs).toISOString()}) β€” reloading\n` + `now ${new Date(currentMtimeMs).toISOString()}) β€” reloading cert-auth strategies\n` ); lastMtimeMs = currentMtimeMs; - await onSighup(); + await doReloadCerts(); } }, intervalMs); watchTimer.unref(); From e84377d7d2b6b42a680e78788b751876b4b8ef26 Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Thu, 25 Jun 2026 14:14:04 +0200 Subject: [PATCH 3/6] feat(stdio): credential env vars, URL validation, and audit trail MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit B2 – CliParamsSchema (Zod) validates --host shape at startup so bare hostnames without a scheme fail with a clear message rather than an opaque fetch error later; --stdio typed as boolean. B3 – MCPServerHooks.onToolCall fires for every CallTool request and writes a sanitized stderr line in stdio mode. redactToolArgs deep-walks nested arg objects, collapsing credential-like keys (pass|secret|token|authorization|…) to *** at any depth. B4 – AEM_USER/AEM_PASS env vars give subprocess clients (Claude Desktop, Cursor, VS Code) a safe credential channel; precedence is flag > env > 'admin'. README documents the stdio config blocks for all three clients including mTLS/OAuth and the trust boundary. --- README.md | 57 ++++++++++++++++++++++++++++++++++++++++ src/cli.schemas.ts | 27 +++++++++++++++++++ src/cli.ts | 34 +++++++++++++++++++++--- src/mcp/mcp.server.ts | 15 ++++++++++- src/server/app.server.ts | 14 ++++++++-- src/utils/sanitize.ts | 45 +++++++++++++++++++++++++++++++ 6 files changed, 185 insertions(+), 7 deletions(-) create mode 100644 src/cli.schemas.ts diff --git a/README.md b/README.md index 8fefa29..ee422a7 100644 --- a/README.md +++ b/README.md @@ -133,6 +133,7 @@ bundle (`--ca` or the OS trust store). | Variable | Purpose | |---|---| | `MCP_LOGGER` | Set to `true` to enable diagnostic logging on stdout (off by default β€” required off for MCP stdio clients). | +| `AEM_USER` / `AEM_PASS` | Basic-auth credentials for AEM. Precedence is **flag > env > default** (`-u`/`-p` win when given; `admin` is the fallback). Preferred for stdio clients β€” supply them via the client's `env` config block (not `args[]`, which shows in `ps aux`) and omit `-u`/`-p`. | | `MCP_USERNAME` / `MCP_PASSWORD` | Optional HTTP Basic auth gate on `POST /mcp` (only active when both are set). | | `MCP_BIND` | Default bind interface (overrides built-in `127.0.0.1`). CLI `--bind` takes precedence. | | `MCP_ALLOWED_ORIGINS` | Comma-separated extra `Origin` values allowed on `/mcp`. Inspector ports 6274/6277 on `localhost`/`127.0.0.1` are always allowed. | @@ -217,6 +218,62 @@ Sample for AI-based code editors or custom clients: } ``` +### Stdio mode (Claude Desktop, Cursor, VS Code) + +Local clients that spawn the server as a subprocess speak JSON-RPC over +stdin/stdout. Run with `--stdio` (alias `-e`) β€” **no HTTP port is bound** in +this mode. Pass credentials through the client's **`env` block, never +`args[]`** (args are visible in `ps aux`; env is readable only by the process +owner), and omit `-u`/`-p` so the env credentials are used (precedence is +flag > env > default). + +**Claude Desktop** (`claude_desktop_config.json`) and **Cursor** +(`~/.cursor/mcp.json`): + +```json +{ + "mcpServers": { + "AEM": { + "command": "npx", + "args": ["-y", "@netcentric/aem-mcp-server", "--stdio", "-H=https://author.example.com"], + "env": { + "AEM_USER": "your-user", + "AEM_PASS": "your-pass" + } + } + } +} +``` + +**VS Code** (`.vscode/mcp.json`) uses a `servers` key and an explicit +`"type": "stdio"`: + +```json +{ + "servers": { + "AEM": { + "type": "stdio", + "command": "npx", + "args": ["-y", "@netcentric/aem-mcp-server", "--stdio", "-H=https://author.example.com"], + "env": { + "AEM_USER": "your-user", + "AEM_PASS": "your-pass" + } + } + } +} +``` + +> **mTLS / OAuth in stdio mode** β€” swap the `env` block for +> `AEM_CERT_PATH`/`AEM_KEY_PATH` (+ `AEM_KEY_PASSPHRASE` if encrypted) or pass +> `-i`/`-s` for OAuth, exactly as in HTTP mode. +> +> **Trust boundary** β€” stdio has no CORS/Origin/session-auth layer: any local +> process that can write the subprocess's stdin gets the full tool surface +> (incl. page delete and replication). This is an accepted trade-off of the +> OS-process-isolation model β€” the client owns the child process. Do not +> expose the stdin of this process to untrusted input. + ## Usage ``` diff --git a/src/cli.schemas.ts b/src/cli.schemas.ts new file mode 100644 index 0000000..4589b18 --- /dev/null +++ b/src/cli.schemas.ts @@ -0,0 +1,27 @@ +import { z } from 'zod'; + +// ---------------------------------------------------------------------------- +// CliParamsSchema β€” shape validation for the non-cert CLI inputs (feat: stdio, B2) +// ---------------------------------------------------------------------------- +// +// Cert-auth inputs are validated separately by CertParamsSchema (feat #4); this +// schema covers the transport-selection + host shape that both modes share: +// - stdio: optional boolean (mode selector). +// - host: must be a syntactically valid URL. +// +// Embedded credentials in `--host` (`user:pass@`) are rejected earlier in +// cli.ts via `hasUrlCredentials` β€” this schema only enforces URL shape: strings +// without any scheme (e.g. `author.example.com`) are caught early; wrong-scheme +// or unreachable hosts surface as a network error at fetch time. +// +// Callers MUST use `safeParse(...)`, never `.parse()`, and must NOT echo the +// raw input back: zod's `.url()` message is value-free ("Invalid url"), but the +// cli.ts error path additionally runs the message through `sanitizeErrorMessage` +// so a credential in any future value-bearing issue never reaches stderr. + +export const CliParamsSchema = z.object({ + stdio: z.boolean().optional(), + host: z.string().url({ message: 'must be a valid URL (e.g. https://author.example.com)' }).optional(), +}); + +export type ValidatedCliParams = z.infer; diff --git a/src/cli.ts b/src/cli.ts index a577560..bf644ff 100644 --- a/src/cli.ts +++ b/src/cli.ts @@ -4,8 +4,9 @@ import yargs from 'yargs'; import { hideBin } from 'yargs/helpers'; import { startServer, startStdioServer } from './index.js'; import { CliParams } from './types'; -import { hasUrlCredentials } from './utils/sanitize.js'; +import { hasUrlCredentials, sanitizeErrorMessage } from './utils/sanitize.js'; import { CertParamsSchema } from './aem/aem.auth.schemas.js'; +import { CliParamsSchema } from './cli.schemas.js'; type CliArgs = CliParams & { help?: boolean; @@ -13,8 +14,11 @@ type CliArgs = CliParams & { const argv: CliArgs = yargs(hideBin(process.argv)).options({ host: { type: 'string', default: 'http://localhost:4502', alias: 'H' }, - user: { type: 'string', default: 'admin', alias: 'u' }, - pass: { type: 'string', default: 'admin', alias: 'p' }, + // No yargs `default` for user/pass: we need to tell "flag explicitly passed" + // apart from "flag absent" so env vars can fill the gap. The 'admin' fallback + // is applied at resolution (flag > env > default). See AEM_USER/AEM_PASS below. + user: { type: 'string', alias: 'u', describe: 'AEM Basic-auth user. Flag wins over AEM_USER env. Default: admin.' }, + pass: { type: 'string', alias: 'p', describe: 'AEM Basic-auth password. Flag wins over AEM_PASS env. Default: admin.' }, id: { type: 'string', default: '', alias: 'i', describe: 'clientId' }, secret: { type: 'string', default: '', alias: 's', describe: 'clientSecret' }, cert: { @@ -68,15 +72,37 @@ if (argv.help) { process.exit(0); // prevent startServer from running } -const { host, user, pass, mcpPort, id, secret, bind, stdio } = argv; +const { host, mcpPort, id, secret, bind, stdio } = argv; const allowOrigin = argv.allowOrigin ?? []; const shutdownDrainSeconds = argv.shutdownDrainSeconds ?? 60; +// Basic-auth credentials follow standard precedence: flag > env > default +// (feat: stdio, B4). Matches the cert-path rule and POSIX/12-factor convention +// β€” an explicit flag always wins, env fills the gap, 'admin' is the local-dev +// fallback. Subprocess MCP clients (Claude Desktop / Cursor / VS Code) should +// supply secrets via their `env` block (AEM_USER/AEM_PASS): more private than +// `args[]`, which is visible in `ps aux`. +const user = argv.user ?? process.env.AEM_USER ?? 'admin'; +const pass = argv.pass ?? process.env.AEM_PASS ?? 'admin'; + if (host && hasUrlCredentials(host)) { console.error('Error: --host (-H) must not contain embedded credentials. Pass them via -u/-p (Basic) or -i/-s (OAuth) instead.'); process.exit(1); } +// URL-shape + transport-flag validation (feat: stdio, B2). Runs after the +// credentials-in-host guard so an embedded-cred host gets the specific message +// above rather than a generic URL error. Sanitize the issue message before it +// reaches stderr β€” defense-in-depth against a future value-bearing zod issue. +const cliValidation = CliParamsSchema.safeParse({ stdio, host }); +if (!cliValidation.success) { + const issue = cliValidation.error.issues[0]; + const pathSeg = issue?.path?.[0]; + const label = typeof pathSeg === 'string' && pathSeg.length > 0 ? `--${pathSeg}` : 'cli'; + console.error(`Error: ${label}: ${sanitizeErrorMessage(issue?.message ?? 'validation failed')}`); + process.exit(1); +} + // Cert-auth params. Flags take precedence over env vars; `??` only falls // through on null/undefined so an empty `--cert ""` reaches the schema and // gets rejected by `.min(1)` (instead of being silently coerced to "no cert diff --git a/src/mcp/mcp.server.ts b/src/mcp/mcp.server.ts index d994172..076667d 100644 --- a/src/mcp/mcp.server.ts +++ b/src/mcp/mcp.server.ts @@ -6,7 +6,17 @@ import { CliParams } from '../types.js'; import { LOGGER } from '../utils/logger.js'; import { sanitizeForWire } from '../utils/sanitize.js'; -export const createMCPServer = (cliParams: CliParams) => { +/** + * Optional transport-level hooks. Kept transport-agnostic so stdio-specific + * behaviour stays out of this file (leakage rule): startStdioServer() supplies + * an `onToolCall` that writes the stderr audit line (feat: stdio, B3); the HTTP + * path passes nothing. + */ +export type MCPServerHooks = { + onToolCall?: (name: string, args: Record | undefined) => void; +}; + +export const createMCPServer = (cliParams: CliParams, hooks: MCPServerHooks = {}) => { const mcpHandler = new MCPRequestHandler(cliParams); const serverInfo = { @@ -43,6 +53,9 @@ export const createMCPServer = (cliParams: CliParams) => { server.setRequestHandler(CallToolRequestSchema, async (request) => { const { name, arguments: args } = request.params; + // Audit hook fires for every CallTool attempt (incl. ones rejected below + // for missing args) so the trail records intent, not just successes. + hooks.onToolCall?.(name, args); LOGGER.log('3. Received CallToolRequestSchema', request.params); if (!args) { return { diff --git a/src/server/app.server.ts b/src/server/app.server.ts index 93f95f7..1188c80 100644 --- a/src/server/app.server.ts +++ b/src/server/app.server.ts @@ -10,7 +10,7 @@ import { destroyAllCertStrategies, reloadAllCertStrategies } from '../aem/aem.au import { config } from '../config.js'; import { CliParams } from '../types.js'; import { LOGGER } from '../utils/logger.js'; -import { redactCliParams } from '../utils/sanitize.js'; +import { redactCliParams, redactToolArgs } from '../utils/sanitize.js'; import { transports } from '../mcp/mcp.transports.js'; // Cap on how long we wait for `destroyAllCertStrategies()` during shutdown @@ -365,7 +365,17 @@ export const startStdioServer = async (params: CliParams = {}) => { LOGGER.log('Starting stdio MCP server with CLI params:', redactCliParams(params)); - const server = createMCPServer(params); + // stderr audit trail (feat: stdio, B3). One sanitized line per tool call. + // Claude Desktop persists a subprocess's stderr to mcp-server-*.log, giving + // a tamper-resistant record of what was invoked with zero client cooperation. + // stderr only β€” no MCP notifications (the client can silence those). + const server = createMCPServer(params, { + onToolCall: (name, args) => { + process.stderr.write( + `[stdio] tool_call: ${name} ${redactToolArgs(args)} ${new Date().toISOString()}\n` + ); + }, + }); const transport = new StdioServerTransport(); // Resolve when the connection closes OR when a signal requests shutdown. diff --git a/src/utils/sanitize.ts b/src/utils/sanitize.ts index 8808bc1..4466ec7 100644 --- a/src/utils/sanitize.ts +++ b/src/utils/sanitize.ts @@ -111,6 +111,51 @@ function truncate(s: string, maxLen: number): string { return s.length > maxLen ? s.slice(0, maxLen) + '…' : s; } +// Tool-argument keys whose values are secrets and must never reach an audit +// line. Substring (not anchored) so compound names like `clientSecret`, +// `accessToken`, `apiKey`, `privateKey`, `passphrase` are caught β€” the anchored +// form missed every one of those. Bare `auth` is intentionally NOT a token: it +// would redact the very common AEM `author`/authoring properties and gut the +// audit trail; the `authorization` header form is matched explicitly instead. +const SENSITIVE_ARG_KEY = /pass|secret|token|authorization|credential|api[_-]?key|private[_-]?key/i; + +// Cap recursion so a pathologically deep client payload can't overflow the +// stack; subtrees past the cap render as a placeholder (never the raw value, +// which could hide an un-redacted secret at that depth). +const MAX_REDACT_DEPTH = 8; + +function redactDeep(value: unknown, depth: number): unknown { + if (value === null || typeof value !== 'object') return value; + if (depth >= MAX_REDACT_DEPTH) return '[deep]'; + if (Array.isArray(value)) return value.map((v) => redactDeep(v, depth + 1)); + const out: Record = {}; + for (const [k, v] of Object.entries(value as Record)) { + out[k] = SENSITIVE_ARG_KEY.test(k) ? '***' : redactDeep(v, depth + 1); + } + return out; +} + +/** + * Render a tool call's arguments as a single safe line for the stderr audit + * trail (feat: stdio, B3). Values under credential-like keys collapse to `***` + * **at any depth** (AEM tools take arbitrary nested `properties` objects, so a + * top-level-only pass would leak nested secrets). The result is JSON, has CR/LF + * flattened (`sanitizeForWire`), any URL userinfo stripped + * (`sanitizeErrorMessage`), and is length-capped so a large `properties` + * payload can't flood the log. Never throws β€” an unserializable arg object + * degrades to a placeholder. + */ +export function redactToolArgs(args: unknown, maxLen = 300): string { + if (args == null || typeof args !== 'object') return '{}'; + let json: string; + try { + json = JSON.stringify(redactDeep(args, 0)); + } catch { + return ''; + } + return truncate(sanitizeForWire(sanitizeErrorMessage(json)), maxLen); +} + export type RedactedCliParams = { host: string; authMode: 'cert' | 'basic' | 'oauth' | 'none'; From 180e679e3c872293d00f4d336242f42079cde59b Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Thu, 25 Jun 2026 14:31:29 +0200 Subject: [PATCH 4/6] fix(stdio): call process.exit(0) on SIGINT/SIGTERM to unblock event loop MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Attaching a process.on('SIGINT') listener suppresses Node's default termination behaviour. Without an explicit process.exit(0), the stdin readable stream kept the event loop alive after resolveClose() β€” the process printed the closing message but never exited. --- src/server/app.server.ts | 1 + 1 file changed, 1 insertion(+) diff --git a/src/server/app.server.ts b/src/server/app.server.ts index 1188c80..2402d5b 100644 --- a/src/server/app.server.ts +++ b/src/server/app.server.ts @@ -394,6 +394,7 @@ export const startStdioServer = async (params: CliParams = {}) => { process.stderr.write(`[stdio] ${signal} received β€” closing\n`); destroyAllCertStrategies(); resolveClose(); + process.exit(0); }; process.on('SIGTERM', () => shutdown('SIGTERM')); process.on('SIGINT', () => shutdown('SIGINT')); From fbd4f0d040926b111a0e2a45363b45c14a9467a9 Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Thu, 25 Jun 2026 14:39:01 +0200 Subject: [PATCH 5/6] fix(stdio): 5s drain window before forced exit on SIGINT/SIGTERM process.exit(0) is still required to unblock the event loop (stdin keeps it alive when a SIGINT listener is attached), but an immediate exit drops in-flight tool calls. A 5s unref'd timer mirrors the HTTP drain pattern and gives bulk operations a chance to finish before the process exits. --- src/server/app.server.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/server/app.server.ts b/src/server/app.server.ts index 2402d5b..6490a75 100644 --- a/src/server/app.server.ts +++ b/src/server/app.server.ts @@ -394,7 +394,12 @@ export const startStdioServer = async (params: CliParams = {}) => { process.stderr.write(`[stdio] ${signal} received β€” closing\n`); destroyAllCertStrategies(); resolveClose(); - process.exit(0); + // Give in-flight tool calls a 5s window to finish before forcing exit. + // process.exit(0) is still required: attaching a SIGINT listener suppresses + // Node's default termination, so without it the stdin stream keeps the + // event loop alive indefinitely. unref() so the timer itself never blocks exit + // if everything drains faster than 5s. + setTimeout(() => process.exit(0), 5_000).unref(); }; process.on('SIGTERM', () => shutdown('SIGTERM')); process.on('SIGINT', () => shutdown('SIGINT')); From 49e7f22e80cd7b183561da03e015fc33b7c7c0db Mon Sep 17 00:00:00 2001 From: Zoran Markovic Date: Fri, 26 Jun 2026 10:49:49 +0200 Subject: [PATCH 6/6] docs: add stdio connected proof screenshot --- docs/screenshots/stdio-connected.png | Bin 0 -> 71089 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 docs/screenshots/stdio-connected.png diff --git a/docs/screenshots/stdio-connected.png b/docs/screenshots/stdio-connected.png new file mode 100644 index 0000000000000000000000000000000000000000..23c9c4f5ee23fd05cc2246fd8e9a049dd91d794b GIT binary patch literal 71089 zcmeFZcQl;u_b!}BkPsvhBwC7=s6mtvMi9Lu%IGAbL>GP3NFfNKiyqxDCdwFXkccvR z8-u~qn*k3`}>{qp7oLSp8wu=o%OZWnDMN8p8I+Beeb=meO>zz_FPMuhKiZ$ z+_`f!sw#>)=gv{apF4M+c!`X3M0s^FgYq|cYm zT|Ccxj{MIM(o6O{%m4hWbpHOi3;#M!I!~zGxr_fbMvL_R=jSWw_2)bPekaQ!`|lBy z@mUxC`}29?pP|?_H%HRjWmgp=_jBhMx&FM)tLkuWoI59XPF3-#p3nK!2})D_d6uTl z@$9Tim&mdueq@(6^Nu!cJWndr0 zlV)p}s!gjEjyI?9 zruA+PHkf{$`{UnkgLD%Pe?9sC!A)>NYyLC+S-I^$#{bXO`~T4KvT{Yc3Qa<#cLpUr z{0)45zYVxt7I1N_YIR;Gzn&S_H0@-YtyQGiY&QlA(sdla1v4O*H9zsR7b`WZc=b~5 zxs8pDspDMOU?`*DsiywdEd4>j($a(-t|SpbZqDE7jaQj`SH3pXtIT9cX|j;ROIJ(= zJ9E_3>@6J~hrT8M=*A>wMoO7+9uHnV6I@)nQ6ncDohANk(k@sk{>j1;<>au$sJ9Ph zADTIsbQPoga_e+>iE^yU;n)CxC{1`|H*_)@3h2WhZ|+48yO@^<#rTY?11Nxy*Y}6S z8xIM`ktT`OZJE&fy5;es_BuCju?c%4g}`pkDEFj9FdCBoNjBk_9kEC#xP8*+VGyjwTdU8!*U?*JU7E*7=iNIj;CrJ`o0sG4=>jgY zX4ccv+B-`QmFIQrAEF-JD7OnbZ@^@rO=saWPW*Wnq&-C_XcV-lGM)6Ks)QTmc(EDp z2|TA)n76%sJG1S0BBaCdFZZH*S<^65ce>ZN#%;$fq7KQO>tz(0HLIa_U>TCj^wLd3j86XJXYGHLn9bNke%3k|Vz$59JL%19K&5$afqqi~W2MEIpnOiDD zs2lWb>=e3TzuJll;T+89P23`jC~SJ8GF@I)gs^oaJn-h0(y*TH9@aZnd8zuzUnmgu zeRQ%*OGE7L*=D+Rku|N}x&IMQb9KO8V>b&N{TvLu+@)FY^m+RdC00z+fgRwv6a=VG zaTNrL9nGWzU_Q7W*j)q4TE9N}Ssq!yTvgkUQ_Z(;-!g;tRwgf`>NS&*e`4k8Yh2fj z4&;mwVxdTo{seci*q(5~gWbfw#%rV=!wPH@Ce0`u{QSIcbN`HG5IspgjRae8KJ9+@ za#>kt1hgZbd&)t?l+G(IiJ}LdPa6Bo{fx~n&Pv{qW?>L>vM)Ki5gw{M;d8 z;qC<6SsUKc=C(cmhp)bXIi4N@1K8OQz`Wlc5fGXtNyVC}S{jk^XSCDV$b563*5 zd(6d84N6bdMXJW~t@fCQBr3qoh~|u-&9Gh#(xt0qbncB-8+EgIJ!b>US(n1DFFz&u ztYWM0o8Nrka#S!w&K35JrRt=hhux-~tX5?URS;hvQv_)IVR6qIWnmX=3{}wfgA(6^ z^aH!`k*O~6bP1u%s^t+({kDpwapN}=*37GU z*!i^tbSwukB}9@qR=132-~aes-Z^#H>@{&RMckRE$Ub1fc(=oPVLc;3J87-~%NEOsZJwhnwcFLKpQ_AwvI7o zV`P*0UQPT1zPCzBN_rZ}-%}iY^|y3C=_or30#kt(8}#j$O!Bxb`dp0JGrvgYLsw^K zPY0Qbt(=^V1QactKS#_l7hAOLU(q?ff9hlBX;TamH{4yzO9pDl{2fZ`WWW{q-lWKoT8S0}Ola3E3KGf`-<=JWJzB8?jc4*E zIqnxu3l(WH_!F8_DWli*Qj3=DW_b{-w{DfHF{2%dEsH;pMQ&}hqX`#~W{Z62UXq{l zxHF!XFHQlE1uM!f@tbTf)^j!H=jN^OU0L7z8aTM(gKmg4#N{UD{xSTbLNik4|bl(Isb*n9r?QdnhbM^LMj2 zm`m7=m|tU+&hX5{XDFl|?y{CL_yRiu$Fr+Oi?^=^n7g2A9|sBUYhgT>+IueJyY=_P zI%U9d1wq+s1A!fuOj}QyhrUGogjKjW(8z#ZVox-2;Ne^20BMxTBuW$eJG@#hr=1h^ z(YhozciYAPiCW`JIK1HW^e)5+~T+&gKJ>0Tz>=L zu;k(dnVs9zRN^}@y5wp$frE}ykIlULYoR6e2MW*B#_bLvYxN{|cXzb&CXi;f)J$G6 z!Q`g@VQ2MQp;N~t-LZ}UoVM&yX}!f3N*fxw!nk?AOUx#Dpy>1LYe21q#r+5)<<^X0 zH7(_jKmzs9Og>>uvvJ-*z?oq{fx0qN9c?2t<_r&8R_0MUtJY~MBa6~7Kh!VErwznU z3taDvJJt)kNJ_D0ji551j`WY7_=?Td%`Pzl&*bS zpW({WUk5${?gH~9D28-DeeWRAzp`XtDO}0hXJabA^J&QHn1uqf=kzeO9td(@25`yL z$mOV5+nIMm^GAU}UEkhRjsN=9p1ff&S%d3;@w&To_AWl^OMvr$ZJc>5!M>7~+C6f) zfOF53MFd^Ghdp(3&Y7%s8ok=6T*+OY5oV9ce$f-YX6tdA`UmFskjAAm>qyt?cg?YA z8XT;jN5&i9Yfe;PG~C$Q>Nh2Yp%+LTZ>s|uvGCoYi(dUw#f#+F*rx4z4IMS(3LoW&hAQ;~fWn*d!%kD=#Bk}`dC<({_$=&B zndE7yi#0PY?ng|2jZHIQ+xx-z3SapKd|a==e{GdAV_C|3vo~M2yi}3>qSW+ZQeN-! zc0&vXNl0&xT)99T&q=s}5@QUKRRVmp<9|RXOs)Xe&nL8C=g(&l$BD#9YJKuLO^ryE zv(rN}`D#p=nBP~L_o=u}f}OO!paW1PRzgaAu`Jx)VDf3$46Sr&Jx~6wd4s=Ei%qoI zni$KCy7?4uHW85uXHKClsI`Ml!u@XoAd%IV&c~VBUvzQaxTIT1NW=G|{h|*5%|l5s zu{@P^MhOq+5z|_?5dX%lp(J~Pd(l8iPpsQ$yk3fid zy3O@U$KhwNSVFb+C?m`$E9)ygU!S4g*`Dh~MytN%TkU7!rUyy!Hmg38D7wXTdwyjG zEEXfi1uQ+~i(aUsvl5bzRc5QG^IA36h1ok*)M-%Du{GMP(GF69;uTvmcDLFYT?GuL zY@hk+*V;JI_o|`C6WMRY;mig=8pzes7QTX10W_0RTUyaVW(Ad6V+IFIHy;|O?0@&M z>iULf zO>D}bABbh`Rpv=Dtc?d8>o#wS>Td65_Use+Zrhut7fn#_?b<)? zJuM_&oVYq7nLFYQ<_&HBL`UsndE!pxsKvK+HH~m>O>JH6Dm`j1 z%p&vP0!Jp#S8|;pHk=uTHl9)iTvXZ*xpnW;Zd!86h4W`tcu@@1HiXM{nt9J=we0y- zIif&L?@s)Z)p-B03?!;ltV ze4QoNW51mdbEC%WAiN(cwu1z;9G};%YEpo{`aU^?CgY>YuM-cZ1;w?l~cwvZJ98PsY`-OS8wZ09NoxpmdiISaEM^dN99HS^^9_agu*TgKuA8i!Up7iRTpqN7iLVAyq2(PkTKLvLN4 z$h^=r8A!UTDUF2lA|>98{fM+n2QZyF8o$BCGB_-bkG;+ftt$x3DiP~2+aafom>0O( z$a{XvN$Nt)X3)XdD0n;rJyNv6!K4#MXrvx{G<;kq*R4!W+I`INXC?G==P9WqUygoF z?5@Mn`7CAx5mK*bs((R4-%sQQ?wXC9t{vGfuNZ}Npz--ubGBWnoOGF$Ggp80npc#3 zTzQ3D`L_8s#(ps4r~7NlHR<~942}hf;rS!p@q7Cg8osI)-96}$^$C`p9CiNU23Bd$ zrswxly)u%QFWx_ssBP*Yqg64NC`{e{@$<`;(;Jd1?F+^#|!Bt&K$lb7Y( zwATj`L}#vNYkI39TOpmN#!rkg_Y-}_R-vcKaqfKZ(GU<5m{!Q52e9ohh9Z$GaUS(2 zk(Bz28dm$$9MY(T`Oe|oReg8$_orT^?5Ew-<$<-PuWfLr@BqU0YzX^6w_34Hi&&zo z;PC3z1IE%x$9kl1wDV7I1$RHKu7{6O&t$hpEJ)1t*Kc_|s{lGarJcQEBaSZdRkaC)+dw{GmP ziBnoTt}kYjs>1m!1;Ws`$c&1{d+U5hMcgE(zfXtGx+8yKY{3nasQLi1Cw#t1yyo}B z@2+Tc+3A{Bh`t?j=(6LnNsN&{b5ECCt&WOA16kKRCw@C_5o=}daYvsOlS#+sxTi>5 zyIU&N{F%4>F9q}sNpGyVekO4EQ{Vreu<^v&8VV6nQD|z7$cr;C`Knx&E7_ADWv+ph zXQsqI{_rFCoVPjVT!P@)>WLoyt2x9; z>a5cRy;{YyUG(DB`)TKpxL*hT%xClGSLK>0NCtI!rn_(l(af76?cupU^iTumfx%2V@ zNoW?A%Txc`9KpXXf2|ixyAAp4f;rwHN#PWQ9$|l*M;f2|k|A@*>VdNy@5KYcNZ(ba0JR`ob5v%v?hL^vlSKamn_HU_UhU4OdR!xJcL*MSC{mST%rUbEkP z>kzGF%$oW2q2*3zz9*H1W#$VifVQvPx!_dArrv_BXp4FtO1~YS5nUH6^4$a87xl>j z6qYys8AIfRrhd%98Z&##zX1~XjpP9=0j6c|G3m#CDVpY3(lq%rA7CBJ%Sk(s@P}2s z_n%3=s+B(%%wp2ioTGzVh@8L4auHQ!yG3jT&M*DbPIlz1yG^YJx;zUpHD1O-+#!Dp zK`$xKhfaXl3{e(rlX>d5_|Q(t@HhI7ziMb9sc;8W{j*u3z0ld!!oQ5nJ(WC1Xuo@b z&<72AINfF!WY5Jn>=ZATLATq@<6>=NK5Rg}vxgGzOcb=PGNlrAe!$4c{+(pZi7_}W zSU)GF(Ph3PLlybpMZYi$e0ATpIVfKYa+9kG3;iuHs!Kxy$ieFpyfz2&KDWO)7Gxlq zrq|cgez*`Q_V_W^J&_f~HzQq*NnpgqOXC}4PV&s&jtn|*VC06Vt@j$>2%S9-VlA(i z^uYJ!tIkrqD&QD)9xD&r-W}(4Xbe~}D1VmY`{8i!fm!X)*lAU_N&SE$A79GS;qpYD zLP6DC=Xo;;r-?HEiN^l2%S1#?%K>|X@2$%lgnp?9`rusNAvM9={5fIMr##|6T;S_# zW50j5k#^zIR9Re2cbeNjm%S;UtmVo3u@R4R73qzetFL=yeKW@hb9{Ks)Vk+RDKx`9 zhx&;ivAWLZ`y1OX-A2_Ke2!O57gM7ruaue%u3qPIYuoeIwf%BD$A|jhnWKn5h5Kx- zk{bdc7|FTm#Y$Q%Xc@`FUTxwzS-35ya6;U3Y28~NYcLcRrBjHA)GowSLG2wbIpZ)B z=uUM8Euv>g_~olVV%|Bx%FQ9;oxbrk{>zCKILjWkn&zkGf61upc#q}Jb^SkpMg#WZLdqaB)n`%iKI@15Led>c7(`^ z?Cd_U`?zga$q<3SM=!dQdWl6Kj@iX$UUA3r>Y!5`sd7k)U$5Smy5P}_Qvo4*0 z1x=7;c09iPCO|VxhOdSa4bH&GM90a3iamF zZDZUeG=mE_fCCOJaGXw&gZ9h?_0N3soK1SF~0vMRW7} z`U%jJ%6A|9eLk3hKK0<(_MXd4`HXaFT-)UkdGRx#i1Z~%ZVKr~zDSaae%3w~{T}kwp=3Jla-yvC{vgA%InFa?fK&L6+@Z$*VL&c{&+y@>BHBq0#Pl$&W(V0>KCYc${l!OF* zwJYfr|I7xLMxHhaKe$};eP3~8nfbgv>Y7?9SQ}2e#m0V%fJ6h1#T^>P^2o8L;>Fgp zA;#lS+eNkY$3>M`8-YH9$@1-#ymM9tzQjBdU)pO_X^%d+(59g6?Sx(#ZBv4|pfnt~ z6gqk4vHMFwpOm~(CB8S3D7 zG5ZND=mbVcHX~POu9vV4X7hr~8C7duP z^M_EJ^jX~gDhDa0z*sQ>+6`5f!`eicQ00Zh!~2c?d#Ja)0O6Ho146WAoJUp18;KGF zWiBX}@bOOS?YR(`70MV13OMe36hIEr%JI*fsL-0wGAvNa0{*Ohv6F6cv#vJLKulL> zu(AsluVQ>URrbKbAMmW)tOjx`oB8^kmkz;G%3z!*dNJBUatpWoi_Uj1{kT%gD$*yR z1~}0nYCr?$rCUWk!_-->DG9hkc%wnbh)<0HJgMspeC_hL@^OnQ#zrJX5=h^WdXFzr z#k5Sm$L}Rr;WEF=y-Z9WbKt{izl54$HLo?mBNrq9zPHAmN;eTuAPX|-EJK)HIrz`_EJ zeOm4#zckF?&IDlwEEjBiR&in`>KQc9ceZ!6!)Y0=-YEx!F^jjNcjKme^MteDyA58Gf zQhlpWwZ=*y}bzzFLO?m?QKxlq20w?Z7S8Ae8SXeMV$@qR@?oi&XgV=2XNZ;?= zMNkfz558NOQJR(@R>s(d8_0sX4kPTU!+4m5+Llq|fe3iL32U$yG_ z5|;J|4hF58W`_%0;ddO!4gB$mZKarDXM^A*@CA}=n4W@y^~CAuXed7h@s3x1y?(}q zA0~^^HZSI2-CI^XFqb%$05yE$b!3YTh|A|Kd-6P*UsrQ(+4Y5RnW`$2&VXRY{S}T= zuzWv7O9WGAPO~w@Pbg*Atk@>9Yw~2Yz@*?ZzJ9mMFoIFP{q+s6yD!7!?Dk@f7mRs3 z@1bMc1?OX7wNbmCJJB24$`uAp)y6i*L85}TP`B5+9TIDMZi0^;^mPewc36VDh)8+d za=Ei=^v}KGgJgHZ22uBvSsYsJ}i`Qz zMCNEULu?y`ESy=(n|V(WQ0v_%FWIZk3>50!SX2dRAVj@^C}&H&=l`X_~db+ zo)4%?!A!c+`Klh~2N{0jDLl5mhvh5c8JDZ@bZi4(LVMz`_S2c(6P5z3NxKhbeU5Ds^(atBfR)vW%cDhW+7|ULRW^!N9=^U>>=3KV zqRWIU6Y0rBtFrG35(WkVVX`D0^+1rva{B&2LT&GhnQ#U-AlVDtg{6X5%t1$l=zw)! z$t)wZxdQuFmS+7=v0Uo=2YSF%;?!W7kXGg+^8g$Z`LF?pQj=S7e7oLY$AcGk%7HRY z#^%Yfr(WyBDM^C*9kJ>X{7>X%MZb&LO=QO`_az{nz5%Dd-)KI_X#}%#F9a=?RTMJtR&nEpDRxI*%E=~@5kJcQ_tS=~#J-IZ%nM9ew)?%=HEztp%Z;l->mdO}H0F&)Gw%N|KX( zmx}ANC%w^ZU_OCrh>N$v^)fyst8QJqYkP+ zB~}od&FkIL19c;!GcFA>X&tOIL)2}1_SfAH5>sPPh_qMN&?R>_x|LmshX*RnFPbT3 z2z@F6bT+T4m1C+dFZL9%&jrU7R6&WG+j~)`aQ^5cpT>;zhGUO3R=lkXA~zO)?B@vz z+_{fRxX80scjbNHo0(M2J8l)ipa2h`;tQGF{&xr4_zGC;E+i!q^z!2?m#jv7Yh%H| z(&XWR`-u)jYtid&NGg=aeWr;r4z^?>_zyMrSxJ}w-jBQKO0bz#ngj|3l&p`webPh2*^N`w`# zJS4@7Y3oco^lxP5U;#6`83H!&@CLjgM@WoB|l3 z#&EyW>8Y_`NUGS%a2ce2GslALq~`5yY=CVLs7^f)bb8`Bu=6+qzBaLlpOslD#gK|5 z2bsq0WyRyGyI~dwQ`>bE6TFo7=uEr zyx&HjgnMpxA~!yhpmv_sFKOsFU^PmiO`Ds?T1I`lDP|U+b*PJ~w6qk8I`kPW$;_jq z+Y46~7dWsRTivhzsI?|PH(drcIit&_DT6FZ)!cSG7V+MRJ(Rb2Ty~=i*I(9J_cSkz zA6n)-I2`39zx772u3_D{k*MRLs^&TDHL#*S8UU#Tr;$8`-I2#bSojTF|i<_!+WwBaq{zHbepV@ zs?)(U7UAkle;n@g5F3THIfV$7nUny&4tKM3!nqW1CPr@i;NCWin{cbv=rNl(il_i7TuG>)~bm^SaehBZe!qf)mL_JLF1ZXk0hYmVIfZ@%U;;{N1wZox!_v4HWBO} zl1^Tm`Y1Xtv2SnHk!qIt;Tm4J>y0A7>h$6cpN0B@8L7cl&@jJN;NpDiSTZ8&7Lor?*hVU=Iktj6cf1vov7sZ~_+4dqM)6M0BvnM8~1AH6OP)G4Cxt zXfwURWSRFKuW#Q4ZTkRbuOg#sXThec_ZO}WwK5(XPuj*2pVF)h(-yAqIgq7Y0l07U zy+HODPLBUdxp3&^U<@#fwG0xn$YJ-jd1caBj9fvj8H*>-Z8_i)4F`VYjXyT33u$yo zxK2XXR#vRCfo_W#$03#JT*uETgK-8~T9Ni^n2&lztKZ_|>ld4*#aQ5T0sJ3`1bbBO zG;;9T=~3M#i8=xqR4q=Du(5QN-7;>Ct7z_nvI2a4gq{Q>@fS(3;=t>T@%Jox2l|0( zgGJi1vQ1GYe(}Rirop>sX_?`sO`AyEJpiZFUqzkjNpjW-$96(#>(Lnu!oP8tBQHtJ z$glT^`d|6)fB*C{@*L8^Vd%|YpT2pi`$tik&vXALu=_8y$$_MHnB*w2{B=Mo6-m~4 zAe8=B>Bx|Sbd}6vV`nV$zw`Hq9!Xo$1TC}vOK`16yThMX1Q030_^o>w*=-DtFWidK4Kziyoi#;G(REDw@yv+~kwY1ZxU{>DOczKQCeVYlFWOs?V5P&i~?^ar@{WW-*N?hVVp zYRq9s!^z1<)yAGa{JpFPZsEU5aE5|Y?Q?`he7$A6X&X-(7KZO@*{N(Ld;t3xR2@AmJcFG1_p-Wj zTqgC&PSiR0$;`*1ut?*82 z@JWO5t2g_%EL`xR_*?v`SgnkFnTuP)>*>yGlk;=SgYHaFNfPP>4u*3ZE3DbVcOf6_ zQH2Y5lbUi{9XB;SkFHh$X;Qa&WPE=ZW zdz}Jk+)~UU(|*!?bCF&L`p(-s7(e`#m0XnoPF z%41pAHiwp#y5a`|>K}Cl$)`$%f-TvfIIKmR-)>f_N0`Lx3h7T3R{x-$E{ z0F{3+cId?UsJh&`V~JYGqT#5`LcO(qH>%+wY0o*i4_28u89#baw;r@hfM?u>Fpecw zVKG$!us#nxUQvesoN~(pbW2@*2Zs64BdJSI8d|ju^PNiO4!E8 zGJ2jxe)EH0vwJwa!m0bua%BsDb*$n{kCREy{>ipZp4+6`=kTyKvDKJ#KHK7yMvc_% zU(&Ovd@4@Sb=-WOIOs}#_8pQ&gn=&&)Rs9qPk4Kr#`M)udI%WZTa4AJOFlWi9dXZc zMlXP29|U?Lnd|*HsT{2Mo4cZokGg^0P4!!J)#JMChJzjOxCum3Ay#LmI ztOd?<@<-pvSzo%PmjnKO)Q%Jd^qO1Vx1v8I2u%4hxf*WyqE?Zb%oiUtEMnOKAR;U5 zo5@DAEuMA-%>hSD$Gnii``;1aJ`B`O2$+UcDKMf{;vxdcAkW@04Jx=VJ5W zK~PtK^LU$mk}N1aEp|nx>Wi#9MBfj;t@?+V5{p^g*3N8nFcy#!FD)+!1t*$p5xX*A zdFlx|DCb6(uG((Q5cheqds(q)Tgw^$C*u)J60&^+9i`S(3oS82Sc%2ruKAha6VM~2yKE7rp z!#iB_edG)r;H3&u9-AfA0U?}^ zp}B=UV7IMsN#fayJh>z+z3osVeQQk_POvUmZWR+`Ld1^v>sAC>skOxcwL(D@yFxW2QM58k z>J8J;4Ef59JHc>xk~qGG^6=ZNL+YKTot-U20l&t~vVF`lwSnXK-Bcarz_1Vku7sEV ztVA(>?hmhK;OegH|Dec@w})fjYCM97P}cewcsz)Y0G13hg*>wByer4 zvL9^ra@EnX18(>d;f)4tPXdi`HL9*O$5)S~s)iC7W4Z_*AGi-YP55nT4E0=SWGwXOeQ9guq~{@LBHF4!5o`-^DM8BVjy{iF=NMbD^(`JLP_{knO{h4qENx^ z`eWB>P3*KwHycKK0k>xz4Jrm3HLNzjY9C`a(>G zx2Cu{OLOi;oJ+uweu5I4wa5UZN(KI;;O!J5hbsqC3(@6x-V!oJpyRG5PBS4wWbd0T zdy5riBFa0GDWNsgek7QQ2$k8{k8pwE0P=v34FbYsKx&mJpPq68alrv@HE~P8!nxK$ zVf2cf>7LrA0A}xYq^8P%<=Ub}r}&%TItP%^j=~yv-QrmU6Lcb*ic8Y<3IFamC?G5x zwKlm8bo?Bqt~Y=E_wRIUf)2PFSws9!1hp;*2tK$UfKM0-O?48`a=;eG2HH4`_k&69G7fna)Nb4RJ3lo9ytDZ zUlEckrzzju>wnx?$$b9gedHMV9e0kF5HMvZyea4mbFemx(4 zEJ#KCxOlEIfk#93=qS}V{l~^<28Yu%45Epe+sewO@WrL84=*XU@Z40NDOc}EB&lKg zRT{esM5n`@`RkoIY;m!=rkyn^rY#jZidMsxJLNW?ftu?>vab9Z5vX1#zvvx%th|%` z(`RtEmA(7(I=&yqP!%1}6H6qY>Pm|TB;O?=t>ts&^}w?bfobC(pX=l~M$u1>cO>;1 z`~bex*XI!vaKZ;S+v~pX#&{D}2A=Xg2;wrz$EL=_Bot~63TVY)hX7;m;gNf`Kv*FGQbfU}h6S=W|TFz#TV_`!FuP3jo z$D$S3eOvQ1b|==$)sP_q(x|M9mu_CX-g66ZERn7Y>6w+q-ug^(#{ z!o*lBbpfR_;}P6-Xq2}_{dfhIORdJIzf$!mAzJZfM}Q}tx7e!XnaPfVk>u7=;&-2N zK|9S693%E`j_+{-y)Dg}d)p9>?WUdO?EjN*9fq2yPrP(CJFS#&vLhEEbujuluZXX8 zCRJ2m#+n)29rTYFCjur6_=<$BuEmB8GMNg9Z(9tqw07%dUph0UTq8|RbhOg&3SSZ4s+;mnTeEDByyVyViva_4KPoTXcMZQK}I)bH}O zfB=wNQPnNB%=G%G$WGdhgl_X-GYjnEiWDdDm*@*4ZQpq4KpyL^O{)0$Gu>`Px9JrU zC)ALc9b}n0p5afzYe9`^EQLX*Hb+BH+0|iTX%Hf?Q%qevh|tdxzFb79yn=U@eY;XQ zW*s^;15@7 z0tsSzFX_+oUDO#YPbys>2bX;ZiD5hD&B|S%QC}j_yGo|rik;nKG#|)lG>sp19S~mB zk>Ijv?N*omgBqB^XI`GO9=fb9BWF#lXB>9n)<)0zRvU~X?43uVf~<-nM?SC|dem|A zNY6(%&Ol3_+<~kNT^c{`wV1{FzgnMzPWoTz_=v9Y=w$lZ2R>lCxuKjcpEm)hsr%cuHBfRs=r-6b2+K?NrCQg? z{wJ{;Q-zm#dB1Xbp}wV<8C6^y^5&+gvd%_%qI|z>!P|)ir>(0huod_frh(jG|Khio zueyG23XhbQf;k$3tyF8`e0M&d$5pM5jJ!H}$S|ew%5!DU&8#8$J+q@y{J*8m9A}Q!EUOyLn!ky34dyt4@TgVm!}t z_S$jnE`C_ax^$0S3N+=@^PV6AFC1~l!BijAWO%4<|-;GA~EhHNi4f< zD(|#J7gBjg=6E1E37g=ij zpF)0nySbHrCriCV%HsByk_64lO<&``_X*|qglTJtJR)Jbv5qbN+`mEve=gS5`3)yW^>d z!u9K8M#f1~EYQw^eyKdRj9@8<18~ zl_mOS6)E^n@s(_pQ7P-)klbvOnsWd=m9-fshMhhrBhAzK`B|%jhP`v=fkYE<&cXNbDcfrSJ$d>=I;8e)9JD`B( zG&S0bXQaA6L#p4B=r63~Vl2m*Pb83r{Qu@Mf@3ARVqEY18|xYhOf9Y%H8|d~3!KyY zh)N&%{=Hazlxn^cDR)iyt=G+UikrVM6_zbq^Ye0PM_rTWhFHnSBx2>V8nuhAa}5j# zrAyH#w7s2hgd%^6UFa}7fa|!pJ$iKH?-t&`89gFvS--XTmddd#0-JR21!M`>Qx{w3 z!Qgk|Zz``7v!lwBPxdK@O>}MW1sAytW2vxm`h!-1`ggjVPz(0$uO}*`*0^eGv~0j- zQs$O4%`)#k=Z!A8*f*^^U3NKa%zsRrcKCf{9bHP#kC31Q-VCFlU^Y4c%dOOx#?!5W z!hBw@Z*O@9c+k-;>sD#lJ^ly{%)EW=7Ot{wYwGKye*F_GU)_aLNuMWOwA+vTxD3FC zvemxtUXe;`k)GeJnNeSa5f>W2a(|qmgq}#aW@5CIFp4Tj*}-yy+E&d?DkC!>P9l zubfkNugxX^B!W!hu`e5iY{JGKQSkyx43%sag8b-Gfg9Ufh3ks~^IHbb-}vO(kyERW zJt{@#dA=^H_r&&(s-ulYR=A67T5yKWnpCG!3r`mQWxqjp9v83Stvyr+UAmMLu_0y` z=Q8%3FHAbq0O`urWF}YJ4XM zOuO0-jG$wc{^t7AXRy1kfo+_xTJ;ku)m!M;I~BOieP9P%<$ml%J19$*Br1e?l{H>E z$4J0=xnLf_FaPG@?lx%xL>`4wd^H6Y@Io(*BYXXyd|HFtSCt_Mz)+J&F3h% z2rTLVSprVNBU$K6Yj~hfCsxLwLC&@Uyn@qxR-#A;)r2Q9TV89!_w7t@jHG4^*cJ5sZHd4G<;7EpU@{DTAfQTz`Q zR~p5zgegi8KYy^{s4)&|(^{y#$ySD&c_fVVCoids<*TWQVjgne3!WWhf+D>?r$XLG zs234o70$-cb&JsqqytWCzT3-7a*{=7iip^cn48ajLw6c?+omXDuE@`28?mK&M_=A` z;_?lonAZfGXN>lKxr{SUyX`PAO^q*QPV{o>TGfmve>Atm0B$7GgMV!P^rz4hEe=!U5q3SK*VW^a-SgV`gK2R5d+ckCErC=1lM(T!Z&XRN5`BV&-bY({O_kA`~=D`tDRzjQ( ztw+CV)YS3pX%{j~Uz_*ive0O(betIG<6zt_Tmp7Cx}kUzV3!}28o2M3^#z1(6a7uE zX^Fv06Hn?8;mTa2Ec8Kwa487|P(#6%joj2t7p?QD=0{$EnpHDb#@06m2ZfA;Zy$c% z>~Lu*DpR08Obd`^y`(T=)D(^urcO27ld@TChPzg?EF1DanUe>`kt>YB9@=oY<48^F zEBWc@@puU8i^$$7(;nSQo^|Q`EOP|fX~J`=`iYs{bEp?XX~{2NW$14CZq9PWJrNNR zZ`LPX_f}Vz+uwlH`3sfwRZY~lj4A9focm2NaS{jHex(02Lc6i&j@X)d(99(=(}Phl zXVDl@Y$CiU~!nBDn z*FWu``^OG^DI?pTZ+5C)oLjymLa%zuqG7%~k)!9e<>K`?pyPOqGC8cXvsu$`JSx7+ ztl_EOL|k3e$sXc!g347kZ)a?OAJh8n5-~e$ z_IacOA{sI4M?v>c+A3-Hu1#m&!;KZomFuA)nf+if7ekl!ce3-HNdW)VeRQLSs1xal zc?5>IyHT_%7BmW=PJ$*&+N66 zvV{Z@8p`Se%o>4&>s;ZPRM8@Sy!rv4WLpHYzV@@WLft!bou%^@T>Mhv@K9NXH3i^RmnCgbBh!%5LzCzl3va>I9qP?t<5F22$-S^?%a z4;HLhs=OU0II(lE$-DUK*DAxW4d(f#{j*Ql>X=dBH+FAE83uk-$%15FZH@B@d;!eS z#U3mFVy4hfVrxjKkX7*&4SKxa;{X!R8Nk*Dc;gmE3u?d?4Em*Xb6RUoB)KH^GFDqA zNOl=ja62YJNpHG3srAX}?*4(;te`<{F5KKtyFNc6nWSKg#mn_-7RIi_g7+~zq< z0o8c~8`s*b^{)(3$_UAy-m`8x+ndtN;m;5#J|5?P*4@CltUt0PS4^(IxB?$;m9mn2 za|(>WA*;m$E^RZd7!Qt;81}Phn%=$~2(>i>Eh>B*#I~h;`40FeEu+-V5L9_jV{>nB za6tklak<=Qk4JQndk{@ok2+Diw2|iOPF0O>3dim`JCf3;nZ$DuKW;bUlQ@6V?@VnD zz@ko|_n@A;L2Xx;Wp;A*?MI;i;=wKUbdazo-qQZq3-R1qRV!amOMaN&bPr);#cO7D zGsSPZSGU(pdM`xf)6K3BPx6-!vH~}hC?qxz9oK+3x(V(M= zZSrZ?Rvgk*iI_^SdiV77>w9isSDyu+b|76G4TsN4ly|m*SAY@=F9rs%yX_-9$o z_yI3!Y{SqFf)8Iy8Zk@eA}JkfL!QIr9e+=6r9A+v9veSL%Ji}KAHcmDjUN5z{Roti zsw{r3frL&znpz*=)(_jp9x^;}x~V$G<*om=!ZHdlm($-4=1YW^-s^7#+^n0=6ZRXq z=lWn|PnTx6xxRiYxU!X~$=)w{)AuiY=${%mrcICey?5aEyFPI_l-GZCjKkINv1&M$ zdxV>YxfvxRGpi-GB3r;YT4;tcCD&62jOtT+^P z4z%>9MJX)~c&qJ>+AYc7&6m4wluQ%2gmD&P^WB( zA@wNm`ass#BRt#kQ0pZ@@x>X@P~j)ER>bzEi|P_Kn;W~6yh<9*=uq)z+olh&`4&t=;7oAg_&i11;X;L$<1 zZdl`1mY%NA7L!K1*{XH5sL0?q*HQYmQ1sOfI-;NB?-k{7%i8kMATus$gjP1aIS>o= zxS?%+K{Jt3>382+Azclj>8J-ETuGoPYdzY$e61zy3Y0Nmjzx z2ijxnZ;Cztokh$k*qRJT4f^~~i`#U$p~K@QL#yiRZ4k$JGJ|c~a(vI6y8Fe6xTy=; zKSy7VD*q0y8a^w*%U_%IpAw2(8%qsUODP*hbR5We(c#G=*>NS}7lNPh(2bL^w>$ZI zYXT6C%H_Q0rk^*p(GwHg0lv5FWpCWlYHk|cQvwsrexHrb)SoJd=UZan&!uYtdnMCi zL&=OsN<1?h`H{`OoV1k1_6&6tMt*c!AZs*@I_=2KRglF+oW<#2RHz-yqfJGpmG0O` zd{(}xVyx7qovs$g+~rUe-Z53)rt+CR&e~XUNEjnq2=KV9AuKK|C&hf7LjT&q$$Gug z*I}}HV70>>Evzoa>+cveMywO8c1D*gJ4 z-j$yH9zdvCC3qz2V0V__LU`bq!p1AZvLG8|ZN+EL>VY$|VT#xJ-PF&wRK5iDqFG6{ z-^SrHKev2sOPC5sh!7JQdw1`Ma$hx9EE(^rV1{QElBzT6!CIrZD1H$W9iv{yUwhs0 z6;|_1fR*Mg-VQ2~5@`V8jk#_=j7t(3iY>|7(ij=9xFqTFU^5zRa(us; z|90Xp%TED8OmgV^aZS35k=onknGaob70%$Ta#>!`W9;TlEz4Q+MZ5cr(mZryqhH^K z?)diB@68QNy!(`@@G8#Nr5tRwW^X^*Dqn(zhk*r>;~;PS;eAoP&Ua$@2aQHcV5^fP zl9lS&O1Wa$XM-DogCfE7b~UVoIG7?B8l=iOsq4A!Z%VNkNeUpxM*RN z$@c9x<odybW^IS{)x}S@(*7fUZXO;Ume)-mudBn0tg50b zs>C@q%~=I_Mr`lx0QMChN=Ei)iY7#?6jC#Vf@1%ku^I~*k4`YlYj4m7 zBr&^{_&jN6VPRvEkHwFrbi5lQBm-#zp@Wul*2Xs5^fgqRcjr=C8nAV<&x5p@{Bvey z=*baJWIfk zC~8thlJN0JUV19BkRiGX&{LsIg~#IyC-__pwHAJrXa>((5|VFr1=9*zR={*Qe0w24 zo50Ez2Y8qWVBOm7T@~SWY+>U<2r%#7-Owg!_(xMDsbrmHVS_zoltSoq-k*ZbL|YE2;nN%^+>GXfUI;&h#17&m*7`$GfZ_q?c6NS zwo9u6U_Rd4n~c*CEwt+Z_!u8w(wXER31U2qB&JC_@tO}NOd^srf_341+8`T9d4WbJ zhjpn`h;q_k@fp4!jyR}ma(>rZHX(|T%=_UYX**xjNEXKemqiB$NA?YOEm`QKz|+!k zjAj@`m-*v@NVUo^MTKc@AblU{-qjoD!5Ne!>|l5N5raiyQ1oaCe0G2C@|a$if7KYC z*u&XI5W~|M4t-QIMF=3{VA>@2?$nc-^au8{Vv>rVWL8>Ghom7m%bNj(CelY40VUm~ zUjgrH&WpFS<-I9H$<*Jlb;T-R^%eC84%0oVv3IY08juF|f;>m+RE5c2OS9EFqO-NF z0}8%c^m#%3k?ejVZ$f0)L-(MDXPs3c-3^zOE<&j6c~2jZFB0W)LUfLF*+z^?ocs92 zE4>XC5YmY07hB+u5ANF{gw@Ip#@}7NnVI24kky0iS$Olc0*>s3iSliNh$mmW@wN91 zx+yehxu6%U1&`+YA)S>kD;&K&X%nH%P@}%VLVGO6hYMzhTiPp-U!({sI0`NJwM-&G6Er}1(tEhCGt`N&);7eO z&#L;+(y`VnP1SD21(s|%8e(>_p9&o(hRby^^ZOghG}rS8TSd@zDJqlcAAe&^M3oB4 zXpLdP?Iy6vjHbo)$GdI6p7WVDsER<4E0@miO+Vr79_w3Y_#-#gu59pD- z+NJN@AEaW{iYVFIur)M0PGtLJ1s0UTTlC^ycuzf&h1dI*4$a8+0vyP0cmWWlYDr9- z4B*7pT7VHWZNq5D)qHhggCuoO_9rMn)J4S==JEXxuR*9#xc!bi8X=)Gk0k z=#d^t)jOL{(li>*KhW)Dc2|Y3G(P+peFZh+xCCgrfe&uJjQg84Ohu{wcf1u`c$9}s zZ2W}Zg5B&kic8H!OVdP0X2Iv~evo%L%A*S?%Zl2uc7JYtts-+t#S>?b@MlijTGA;A zOBOgt^;7$hd#D-RqK{))G)h)F07~uTJ)I%!;QC-15OA4gu9!G4E1N+D0}KRC_;F1Zn>-w4nW#eRpt6r{s5nbKGpRs1tZ)Ar9jtzzQ}C{(63jH z#Uk+jVv_IiP3t`^IY%4bd-`4IUMC*LfX6QV-pcXaugYD1K+(bYZmP3`g(Wwmb_bZk zEB>QD_iU$j7X2_zS`82zmv$QBtd`B@#USPTut#*q?+p>fn~;=r_P20t0h(u-foT2V zD)stV;5}6-bv6Ioem=Gn_?h+~KiXNp&2%pg%Nq{cQ;d1|i00zlqU4$2)_HD<`v_d| zzics=olN?$H`gXo#^0b}fVa_0jr*0!-30f{afyXh$8HyMZz~@1My|AoIW9#|vC>va z9*P5*BmQ_c_J<%kHtb>-ee$UVb4w--1VEfZJww2Om>jYv@^6+Ep9nLFL#PZ%tEKYM zr)wl6FjGkx+$@vS95TgSlti0aM?Tw#tjn((rj3JxgVFv}A<_OK@X`KN^;%a{U%7@< zdb=arh;}v$-Hw(j8?ck+eHRmA#SCo{AF!8rvO^qW7K3x z{%=?Aqd2@NiWPFAEVyE)ljcKKix8T9ySngIs?nAXI*@`(#&XsvEAYm=BU(8LO!W2C zxE%unsK&ZUeiv@m*ee=W5L|>6ED`EY1ZlTb{^-V`=)cfgN}%6c5_ zqUL5f%yecvh!OQtq?Q2AXN6g z0;;OV%*XPK!8bYje+>XtKJbH#6}6tza*AQ8SjN2@c==e&k9v=O(C5?=|i)W?q2nDP2Wd`7`{HJYgjF z=rX!2EH5>zy9cXdR~`vW>Za`LcrLx_-|fYFy3})U-(5d;Yi3ApjHJ2U6eS6~UzUTL zMc%?U!6cn*Q1Qk!H`y2!{w?V$UEtT=xoZ13+o%?X1G#uC@jmncE*pE%VZmmrAFY3ImzlRRi^?Rsd@@Q^mmPKdA#<2~dN=Zt8h6NvHd;h`p)s7JdW z2T_gr68$cOJ@Kh{H0^f+4!w$sysx#oFfFVn6b?6AV#q>7TrZKtcvx#qgB|q0#&iMp z0;eDfKFduKBbNY9+@S;s4Y6E2#_BxL7##wNUTd-%greppvCO1xokQ$Ak=@>;m%mi# zhHA;6{MQ!hKk{GqfE2%f^4|%cc`1hVXrb-U7kBycv%W7@yMue*+`o%-~2vN1{ z=LOhDJfg>u&#r2^IKaCmo%{PrEg0_$m1~u$DE}{l{q5|u*}?|L!u5A|To?u}myarK z?-at9oat^t9wYzGA$dy9EnC5>%j;FFF2BC}W*1BU?6tP?aCul>L0H6#%><7MHX)XZ z?}`HKDr=0KsryAY{VR@$6&_^f;!n=DL|@#3uPI|q7@M-9y51L6fHm0*6Q0sNAn4V zs(D`wQw=PL-$|X&=?gK@%^f*vF9Ul0@I-yCQcyaP3C-|$RD!qGQ_zS{@gifPLU}a% z^+Pwf_a_>(W}0Y~cOB-CM0}&?uN2GBf8UbNa(-Fs(-J$TM^@snBro6HvAwqzbnX7J zR`@tpRF**&pFPH7VK|QNtw@yot~ESyg5xSO#eG;gCGRf27jH5H(Vnf4brbxnfORW7 z`!WdAn6mpuP7Mmlj1W7?b#=i9F#TYZd*zdaEMiKd?rE*7>56m;c)%v&CUzna_8|Tr zXQ%&)os7->L1GV%C;`EqT_q`seanpw4y%p)OM^fHwgH=i&F|fQ{+&{}K#qkzdkRkR zNVo-M`^hQguvQN$-1oPZ08~P-Z*~({HLKr8v&v~c!yV|bIxbQ1M}#MaD--lRBDfOY1D$nkYpRW_g0D|_4aV~X+^p86D%2rf@1Gv`fM$~)I&+bc z!9Bu3U$R+xwgLkPalL~yQ~vY=*}9pMc>fSf=}=2FPHBsOaFq7 zVSMAGE;b8mi|OR6hl>l`^_%h$x*?>8TuPCt?+xxr_nQkM5*%x9(+gakWkg!^+rN@I z-)7nhwaQn6&4s8$K^W~Oi#{!`70qr=U)Y+0CT>-;&&!J-i19h5$_-THlB`?i%=?r- zx3Dc0Nd#WzQ7Eh^2xs6`#5}8sey#>i(K3HsVJeLVf=PTjzO@5hre(c$pC}@F$h7~+ zT(1p|>N#0AECJHrR>Ix7pTw*&nMfGJs=x1;n;f)oSD+(H+!n*YyqsCWsyh53dwYG1 zF6(S}LB6-15|9S_c$y8Oajzm0EceMr!`WzOxg!cp_hh$MD=jaY`Z4*?q4MrBDInSR z@;*G(0}~nVUEY}IRj;E^E-)7!NzZT0b8SrTFBT1^x1|--fgUoaf$3lGiP9mV_}y_6|(v z)RpHI(9Nd*NX8l8bY@JGRE0e`_SQh;xlc9NUVRwnjZRDnjcPSowN*gyjhGCmH*D)X z%zMANd$veJmP){?{Dj`-xB6V^NYBNc}wdyc@lAf23e+<1aZfpF+rO= zyLz+?XwiUYa40r}{`IPr(ocqD000J_V%2FfuVUv4oc}D}dXH#!D(EW@i_unezli5u zNtkLb{1*SoZ$zYWK_AzKJzjt&p3lXe3YDvw+;JBbAB9_nia`X?sap!%dZ6Y#Zsq(2{ z^&sMlQODS2$j7r+(pq9AU8W}QUuHpIECrdF?-F#DzVb(=qxDmLZfF=lth%y% zmlRqjJ+G01hP(~)Q5Ej6d`?7UL=L;9js}YA3aoWP`qN5nUtk|wRudUa_+H80XS2g- zT7$lLu^Y?u0^*5H&>Ea^Snr3zSM8@^tB-t%eGDO36-`L!u=0A{e)R0B56hDA^}b(5 zSjvwMF0&gvI{NQHOv3AuL7Cif!+Iv>2df%spNYZPt~8b89zdHk){>o-O}xU` zLIusJa`A2ty6&jXA$4%*T0*5L#ou}5{2(qjN2_M5EicXT?;$wKDJ~V6c;j{|cD$r| zO_^tBr-F|I>9&JlbCdUM_8(J%ph<8c`pkM2)8DTldQy_(2YRPp39(x$Z*T2a*ERY( zrSbgiuZGI0U=pZ|X`$BNc-(FhakqF(4h|hMtf0*5WhVQK`aofbx~UH~2r+i|Ecjd( zW-YxSn2cg~QrTD2zxvs|JonMmM2|&LzA?5dV_5V*Kvs4t zzE}Gd=9z78`YkxXnrPqp*Y4h;6@iqV;E5wi_p8AmD4os@R`2S#8ZOY$#dmL}jT+K_ zN-0t(CJfpmRhCypWm&<_aGJ1Lj>7E%PO>oI^~a6G!m4vRX{_*N2#=m&TaaE4!km2F zF(Lbd5a-TFUSg=2r0^%U?hssdraIe2#z5=4t^w5La4mww$O!`cI2B}Djkt#?y;KKW zhSRxUcg>OZ&3!g521yy2!^b)%uE+O)nmOSx7t4MtFjBqq;}a)`Ys$UKwT`$Nc(rc# z9H)0NIlYidw|J#S^`j*j_vzjAcg2$DP!S05NVj(tc&j(b=(NNdDd)=-CsZ!f?UQ9P z$f(G0%rkafb^HC`(0D`Vb^UI$L4vpQclC#3+_{?JUp0s11l#Z3DBIugmx3gbFSgGf zPL!Y2B-Q7iNoW5_o&*h|iYpnjfP`!-W%o9Vad!os+)_;!GT*R<{x;P9Ocy{0%Z)*~ zm>m@(a6FKOd@4s*JW$ga>qi-8s;j<$SdHTKrp@2XA?VFsiWx10V%-~&z)Ch1q}cYv9w|tCT4L-jJK7o+K$eAb zDBR|@(;LRf|HQt}H8caFy|R*8b!sUi+d$Uz8E-SZ$~i^ly8bBqQb##8V}BC%l#1HS zO!Q5r0Czf!htFFa{nrHiDGt{r*&XuUrq5(f)E-XYvNFKIVSMGbSRvW~O4vXUu57fv zYZ(lJaD^QmKaVYm!6o`{G}vB80<+v>QLa;TaSDasM3y)Atoe<7DkgZn1lae8d(Gtpm^=RAO z>~=n%i`cbK1EmE#K)jWV@ILgvclOwK>qP~rqVwcNnWA`SFUmu4fpKP-4#bpluVsy- z!V@qA0ceIK=if$KQoSf-$J?P2kv}@$d(M;zAt-H-eD_uXbw`X;C1zZ!9M=zzJq-~+ z@v=nn+9uRJuj}l=YRK?JL(!b2}X#x(O|-auaPik!D9n_i^6;5v|T00{>VyA2G;P& zQq^ov#Dz0#2e;GSip0eV)ki1&f_~&9~?Bu z-ZQ%2()@lE^1HxWi9KD$oKMANVF)w+ z`x>0gS7BcB^~=w5nP&u3bQ{B|6$h&2I^%jF%8}{u)h;mj;cVGpUBb#1P?@vZ7Gftc z;O|PnCW$YB9|;W~&-7}6kg;2uE4`0F{zX;Qt=(qtp_Dl@J1dPL2($zk+J=yVVrg>? zP8zAt5yG#6oW!&|Ksm+L)R>8lvl5K4hT(KWMf7$MZ`OaQ&ejJCnzkj3^7yVy++DSW zEw%_m-jH5}f1A?<)1dwX%2~!z%XO2l$juh)-^5^2fz2hcT&S2?`U*RHC!vfNRs@_y z*7ZFKx2~oP*fS!Qz=8-s5>aOV4LO9Tv;Ql`Q^)(p%E118yBmVP-`=6^2On2acmOoZ z8!i`v*|kC!9N8u_-enePS7|i5w8dko6hmTUTt*Y((7OmHj zcsO53CyZ=E?%8Xma2`U-5c_zYpY{xa5;U@6#aarpScV#-04>F3EF zXALjljgJ6XLluWRwb$Y*9Rf+9kdl}QMpIjLmiB%c+Febc+J2*{INRO*(b}Zf+2*w6 z4Ts`qJ{gx6X}wtwbv~$8h!g_yccd+hAciEQgye=UtEaPFXY?sAY|Og;>o9QBVh7xY z3VI{4g~;p=OPlD-=zh<4RlP=3J~N(3ch|TWPZ9&zf(k0!E)&F9(Fhioa70^D2Xm45 z%8?obE`$!(tJC8U{Fzh2xpe&QNZ{5@L^uMaRFL>2zA;xAhW#w&Nq;et>Zrvkw>p4j z2|fk%!OFYZSn`oyoNr??JQOVy*@`a}B64tE2Wd8{eK z;wLggp~aNJLLlZ2CG8C})Sd#y#QEgP7OjD@A~zQFl97qjQc`_DrLNx{lGqe=($QD# z-UGGbsxdq5WPa4Ujfml^t?k_XWTai-Zkm%cU64B=RSKr|G z{ZQ-PY3YYQcr$xJ%YESmm`UhHdqzrW!6{J>qKEh_>;Hakt#B0n2aQ6O7@%q~T%|F% ztUIKCYC~*d~8ydJ|%J#irlV#>&__XwsjnMV1H4 zjq5w6)=j2W8RBG5`G_WNI)AKKu-M?5=;f2-@evA|vmY=o=@=}tr(-YjDfA7---q!p!8fv4^*!B-oua-7iY_AR~ zXxx8%8)G8nqPQqa+XnshDl9loRI-1)8IvcvJe(MEBKpg|nb8%`_DFXMF%M3g$96)| z=Ve>b)@=lTf1|_B@rg(GTMWKfkL4POv)A|zEs0q;yYkgnBXKEXw1?pCNT4Qk(>75$ zdhy3xG^qDox1*dTAT#?8WbuI^SXo;rGG{$$bkpgDPPza0&1}`v9i4c$-+29DofMIh zEp^@p*6*{`w1(UmJ0IzF!|&NEOAU#_N+9ZrYAODySd)%{CWR>hLI_n&Rj078q@^(Z zC&)-lWA?N|1Um95TDgJetVz5_v^P@*XA5ur8w-OX)$}hySWPQEAq|9PPKj}<6$%JO zfQ24&?KojB*Ufr0l$qlwA6kw3r)g{yfcWn4ejdcllE!<$FgxBJzBe777gaD_p2z5_ z(PnrZY9X6BXzO2Q|iK4l)J=L9sUcs1MVzL2st8GVU!;cjdB`S(&u8lrUhkQsGDx<%z92 z;Vwj#;j+HYSH~Gn*JSuzgHNw*iIMu+QfR^lz)MMcyxKAMzLB4RtpKS7gMTFe4l9Vu z2pa!zxukE>k*aQoMU>fzri9qhoZSE61whl;n0o)?L%~S6NEWi|>2g#|)_?%RBG5#BuynYKbgAFlD`<{ zpjOZ6xJdYbC%aW>SWk(yKE^R3H5(?%bt?P6ioYv(UQ(`@-JQ9&8;!4r4x(zi5q!0u zci*5iOhks+1AHetc{jc-R%&9{^-WPw=I|1@(Qt{9ii!T%DG=KEokmqRk4-}O4YTCQ zL7TIAth1n@B1rdRl80t>8IfUZDi+D$s7x3lYpv1R>|k?bbV_=h#xJ@MMwMs%CHJx# z=~T0~*&f7|^8u{+r0!Kl-6kXk?w|5Y%0-n?;>4y}Ic}4b<|$x8PAn<9;dA3TTwTf) zE5wYHw92_lTHg+flPc?D>lm^;b)vzr(5Hoz*jr34u`o>!_jOfEIK^|YGDa}`CK(RXxND3 zf{_Owe5x_bz9{+r+(|OUFOAyoo}xu{^(P>~SghLEp)lADqgmSxUT)w_<}bOBhNYrA z^#KlZ{p&<XI^i%YV{orZ2YwKd;jfmtjB`VOtI}3AWCfXcj`t|Onh*l zPaG7RK;KP-n6-r>N~eE37d*kb2NJyOI>B#Ja18AU*5Bj(@Z!vz5rH*%RixN>h>UWc zC;|skTn3Fuh&H}Kl*JZdNh`jzJ{BM&!^bd0jIvI&^IJNo$gG~h@BVsFu&G=-?Iana z6c{+e74}X&D_!6X(jjqL1&~}9K*a6k;)4HSn&a5I0iwYk6g+vf^Q6&mU z<4!fm(?1W65sF(w2Zu(>XXFn;P55UD>E8mvcx}VWcFErV{l)xWmtw*E zP@3dKIna2Z$$;MU|8eQTfuwe~Mf6-q{XcH{_W^pyVHK{|$ZHdo{?8%*?QUaK_Yo8u zR_JfLO-Cs9{Y_5YuLsSlXSEW+P-yu->xiFBGXKvfDnx#PsyQG%JXB8VDYUdbx3CX;bL|yMh1WwlohRrN_46NTO~w03o_WMe>Wqn-CJt$PN=b6vL$Y&u zYNA`i(BktUWu@x6HB_z#arUxfX!Y1wer|61e0X)C`T5au4bP|}*ZT7ndAdx=85Cq1 zt(WMizjr03TK*i?$vHo-tm=*V&R<85{FUn;O#c6`UKJyt9K8ei9(b|Ys4Nj?@QI~Y zL;;*@sFxqk{q(#c(&X|;g|ZvSubtk`Sshsv{X0bDSM9gA_l$0q@|{7OsaXt(-qMh{ z!AZ*%Ppe3W!kiEmQp?k8Z9Q33a7tHlbhLfc8`<(=I($SKF0=Fc)?#5~l<+Bn<^(sj zE0t}Ng-x8+sF+>qB?Qgg?!3nnNF@JJd)vJbjc>?TZ1;4&0v3}^&^tEg=SD$JnYD(0 z+q9Hap>DhC_MJqruaZ>Mi{}iRkO*;VgP!{BcsKIW!@ExHgn%b9g6Nw zPj-`TLv!57w|hjg5i+<+P+mtNKS`(#pvSusWYrNU~&~>Ok3M&7x-}#|TgidWD85bA83a z#2mK~H4-CbDixC ze|>Hk9+)(A4IVd7)$_sG>0*VtW_V|2@)Zn7(74&+b2WRcEa=}46H7RM@c4_O;&hQl zIvd_E%k9EA`1#Yvc8d3`?IC^B&79BPNkF{(d9#!ot74=@g+TDD2m1bU^r-z7UQy{T z8Ldn>U%jyXX)F;pA&jN)rD}!i8>ZwS_jsZNHO?9Bg; zVGyDXG$HA5J3e0a+{hEoHahSCb>;|B@LDiWmc<$D0!mH5X-*?okV|!5?n5p<(TDvd z&~ZS9zQKDEniX&tBKftWnshHP==KYmu$PPB^E^xSfm+Dja5=wou*M?MZ?i zr(Co8)qM7x0v2<|yfW8S=NCzq|A>OO* z<-XRgx%aWz-egIT?#Sw2mhOWXtzQE8WtpJ9Xx)l(u&1dXfBAl^W%B6 z*=og3C%iqjmf=dwhJ)ACxQKF8(v=wSSfaKS@jlBBEwao2|OvCQ- zgs^Q+Sy&U(7ck$s>>Eq6oXB8cu*G?1^4#v!)Giwm(&b@KV}exooyIOYzQPcWWP z4Y;&^Oi))<((*j}5J?Ol#l=qdV!P_L40e!A7MyMB!t97D9FHvSkcn+?Fa{mTsbJdA zo}Y17J&ux;OxPC$l1#tPl2M+g6Xs}8Fd5cXk^X8e$!acHzi5Z5!)83v>!xU^`sE^1 zEcexzg(ym}ht`;5ahYa1Z3bLAFMD*la_3+=5;_eb!d`{^zi)g2;uv62P&M73_n%L; z%V~*;AbBI=P%(kmrZzD6%P$iH;?noKH!hIh@U5fZ#TlbqfC^#7=PLVNXB!X;*$O5`%skp?@ge-kKx4-0b|EA35LPv<+C|laH0qDZ*5i}cb6C6t>4@G z^y;0jfoQnfohmiNK%(kr$Hy#hZV)S^2k^6DVyhZ#FB*60bF0%!e$xFY?ux%gSDTGt z*vJTmmmf1LJw^eN*>e$e28kp(THO@LN68TUI{kUvv%60C3@ljR;x-s zSb$ZOcXAfBwCo?5`jK=fH2U@53U(hJFk8X4%<^or(+F+Azx4+GdLvx6CTB7ag6?=|1*E6I=3au`5-dZTo ze4cWx`E#t)*H>?jZP#0A?dq(_G9^r5r+q%xzZ_(Ig5sxvye=Ue_`bs6NU6_TYjQBe z2N!XG<^ULWKZ8c|+RFfRbWkFpIP$+*HU^^@c9{<&m)aMNK@C`eRad>niHZzM1#2o= z0;!O$);r3y2_9a8xO>N9gJxfU$&rPjLHt+;o^E_QHm<||JEiaIsA12ps$nZ+IQw@| zTdASOu);D9#p-kxHnP^QJ0gpA5Brhv!*jGPjVjiEg<%izYV&zsw4xRhRf@paHpMls zd1U_D!E`8i7csTtOs_+W7iZi|v5vw}l7N^8i9<7qo)kq>qa?A9Ga zn8;+V-+iAz;dMIcZhtBpS0{NN$S1VbdND{qqo4rFk?ZI*^Zn>c`-(JW64CMN7a$gw zwa~fmn#E)D5d!@^Z!!}xD)cblUjwAT2=a6mc_!)P?&WTE4w^b@luqdDbRa3b*Yf9%9Nvm*K4=5-mbL<{vl=p1{|Eek`R zlQaM&M~t7ZCMQ7s>jY~`=$qr4-!M6A&0v31+PMENm68y(ni-)o`#wC6wq+jgF4w4& z1Q$xzZ@ug0Wj22B%l>Yv>K$Rj@Xs3_$C?-%VPmph@RxNz{J?;C4x8p*Y4J`l+yB-P z2J3QVm(#&JjuGy5wZbs6tuDR);;SF8p(1s>aG7Zaf7z z=siWeMc39{hh~zqGK(!NH$$S=Un&BQAsfs*EVmTgg)z#`fTqA}6LW=nY;AAR$T}zk zeKy2XTrnQ4PlFN4L88f8ds+v!`82||*I&4(;WD6-5@Bw1;-6niVNu3&fXm7ZDQ7pZjb z+1~|c^+eqZjjEa~m;Gy9ye@qlQMBhj_gpf=KQ8Z3PM6Alm+36WnaE0F{2UMrz37+c zFTOi!ORq>8Lh`enN;9$z(T;E-np7?03f03EcD6iFzw*T*SP{j;blbvF^NI{vl(SEc((J6n#?y&gf z7W50?=ke_|puR9IEI%^J893y=ces2(IR3jBjfzyaxT`m3HB3zctY56_yVwi&&hxIWcHYGwMn5 zcpmEXZuZ3r(SvKVLLmn?c)3`00*`4VF;=?YmJfY4*P8lu;C4Cfk39=Ylopbpk7;R6ICNgXzJ*r&dcp((I3e3=UGGTnon$8>bJ5GxIO@67lZ zNrFQc{=5u#c2(#sW~mj2aaENvAs++{$33Ofk)7c(Il9`Fq5Ye|_D!RNT=wZ# zcE-f`cu9=2OfiWuWi&np6UPqNm!#nSFMTL^ZN7X0GbNHhxhkvWIS+HweQwHOKzwU< zVx8k1;a9>{s$f6PVDDU1jhC;ozFVnt2Z8p|tp6h|;|+v8ev2@*qWiXzYVOnN)GQd= z>fyAtKRBh|*1`9d@1`8r>*GbzEu7WEK%hm$PZ^WK1U4dm^E&2ou@2p6U$wRa?LBI? z8{${_`0yQ}y=OZZAPg8vPReR_QGZ?^z`HssF*Cwl<)Z!A8ad8nv+gBy5IcLpMi2GR z^S($pRz?&5m50MM(_eL-BI1Ar($A{Ak`y&#;7!LGQ+Gcu6Q)pio~P#!D3yhBKVE zB8FQtcUADD#UHxvl4br}pUWvat>&+@MyVAisQOkWqE29Ao8Dxf_7Q~}>~wp($DsFY z?^bB9d@^;`MPj=e1Sa8jeR2Dc9*A2nKaef!{ZOXJq)mKO`M-4+T`i}jQUs~K)40fN zR=@fEtHCIhLqYl9I*ef3=xfql4J3fEHp(m_)!n*ng#LkIl9m}%dyHN8`!ho^W6X+( zC##b3*WV!j)nH`rwm+(yfcdy=uHXKXfd*=>s;AgRVXjKoe`$wJMKp)2+gBVC_1f+6 zc5#&KwJzQb&yR6(=b>u^C%mTjXiuH8PJ(EkyfrZuDzB@+)Y#TsH?J(vFUC3g1hC@6 z8U|TNp37}UjFfDxy1oHpC&8bb4+>IPvl5q5(0K#OISB1P zyN&Fg=k+7VX& zJ+`;-uYXvj|BqDIK@;gQ>b0)$bV0j(({7Gm5|znfoeD)T&yE#Xwq7uyjWTZ~hS`zfgYkKHdHPFx{xo=(w8((o+g%fGh+7Kg~6N_FmB@d=8ZMrmy||d$6BD z>G4^ldlE_vH(v+|7g45Tx4MJCQdI!NMGN z&@$@BVS+jMTeo)=Nbq>ZZ;x!js#IEH1&QZxD9!GX%MIN?Tj&Ypc4V%u0eILj-G z?0QvCiRVht2ii#logc0vf~zma3B_IPF2cb0Spy)?9}hqsKPbJFUr`+p*O`Cd)WrsL zf$DNB6cx=E(-W;z)|a5p9@-x=Nut$tk9h=PdcIbWUoUJcNyq|ngPTB|0#f7&)_>|P zuMDv|%IwKJ%ZP(}eHm-Zcs& zD#x>RnAX??erRONrEtiX^LLrx;c(L?tOZd_a{yf{3hzCtXpsW51XFvMkEM4-Z(DC8 z$EgQAxzl;Nr*bLHVfT;}Q3N_4@Fb#6)ixaiVG#ZH-?1|LFRX0LBDQSPFm>Fu8Mm{) z!A`ngvC#b(OIWRu>qlCM;TwBww0t*Cur6K0KpTXq!E0>;fzY~t%=E>*Y%AH^%6u|6 z>ZSYTCeDMXD?pS5!-&|;ssx^n+1`9wzel_}0N3l$XgDD5&Ic5Kp%bh}0{MK#o+x8B z@!Gh#R#w%z{k{`_GPk$CNN{vjomkXeO1}XdV^cP06R7_fpgo=e&cx*;l5lYLRJR^( z!&Kvtj=S!+b6y%(SC@u0f0ndR*FL{vlP%QAYDj{1LIBc#w8y+4f#QsE7LF0BGvR6t z?L4RwPS_MC&1!rb7QR=P_?;6OO{u0f-I0t6hOgH;Xfw?sRA)Lqqp`&^6}V;}b)MndQz%ZmRcoTt?JF{qzv&`FO^P3Xf-k8$LI3caC?;7-iD2-3fp#+DpJyNTmii47i${}(kSRS%G}%i zO-bxp$E$7vX+~3Ww7SNi$)AVwu&$K=pVvNCNpnK|S%l4++_<>bH&|0fpmcNLu=FHk zJLg`E77|^!{gG}O)_myReA3{V9VKP<_Z-uo)R3O}PJ{$>zcW#_=u#D9^3fvbq0X!i z#crwjJe>e@hi8ZU?ttTy87z*^Dkct{Mn99o<=iLEAx3%( zzeTQki0W2*by1>CX*^O~R4L#u$QL6SV4rsRRwwLjiLI8<#5ezogP!Ek#PkHE7z_k0 zu}|?+lB@n@5wsl^_}skh@Cu%S>34JMA9}USIS)Rm=(-8A5+h7xi$&@Kb7)bb*}PW< zaz#tuGk4$ueKVtTp7a+$xj8|!DzLaXPn4EfFG}AQh9n<+m)Yb@b(S)nN=#^=IGlq% zd)b{KoZ^7HiB{X!QJ|u@U&7hNoCAR9>B~NTJ%#CuXW6o?W z(Dh3&UKf6~m&&L>3l56qU+x_yP_EbbpvNhW`FFQ2;F&6&Q%ZE4KLAVJNy%-0b|U`% zb4+}(u5P4RIH_t;;eLusg>yzv1VhC2>A@QHoy*W{RFA!>si~2J3^4ze7xoJjy_;P& zWklwj9ZP+^6;CkM_}+%W;X#25qn3O#tR{b49(k116Nd%&i?JOdLLVO(H$0x1)c_bM z*Rn--k2&mMNIK1g=$zREi9lC)AqSau^vK+ZKT9VMSqpXRGZBEf(~06+^ctlKo)1M+ zvr|8y${?Frqi_Er z9&kI+RohEise@?aqld!?k9sqd(4dyBz1enQzW^PP1T7!c0P;brbA0;ru-LiT=)dR( z>&QiTRRiv*rsPtTM^as_OYuZjF zg?E3~M|eN=QLeE8=lLhG+7_qF2>^%>7n~^UV#JYZFeOON?UgGgWDXrEH)sJ-RmThn zDI(BxM?gB`{NjJdXc3UG#X<^aW9E{R>B3m|il%sCq?Jj@2U{86d9Pz6a7>+^Iq9lZI<9*6uoZM1PIFe}g#H_+r2^_K& zL^!Jk(U&McwLH4P94-Agk@;;0GYB)OU4NKDJaM<20k!ZfLxcb^JY*Ud*PZQRZ$O-! z)afPsdw%we!}6C6R|^1Wj0zoX`IGzz)(?&+J`nmQK2k&ujOD?YwaVwOi=Bc`wkwM? zDCY!4B^UzLyc6g~({oKi^j*eJl=RU3TM_`IJJI<-!t_5DsnM3J{4g|c}x0S?Ow z*Zt$A>UH`_f?CbCwMYaP zPYo!+0PuKA^94`goKBw0)giRynM)y?RysOr&sjk-m`+;Lgos_|i_88~%Q=Ip1?e|( zbo8wLqjayCP6h?H9A6Nk2oB6om>N8mNPYhnjgX6mCZF`#i|Xms5rRXfgxR-e{wXX* z$|X)mcu2?w5|#_~nYeX+uX++42EUgD=$8c=mbp45m-4M}?HWlE4?92=P`wP%AE*`F zK*{N-F`fQ`^+WmG-hu1^Z598T(X;nxJMd)zW_)k@>ALv$7N>pFyEl9;UJOF*Vc*_y z;dqU5@Muk;B{6+EAX6+vh>PYCdUo?fc!=Hps9sAmb=bryNjSRqQnO-`M2x=&PN^4l zq~+&pT34mQ{SVLVr+IMtX&oMnjurR?Sj?;WJe`vK8)&?s8A>#`Jg1Sh&$bs5>hMvO zNZF5&Z6A>vj{7Rmubb-QN;EnP3dGG3!$kwDc% zivOKlK1LZje13O2ze+egFbVPC#bA&8eoahI&ue9HzJ#4z9zR#46??k6db5elOnF$F z==hr5#0q!4cAl^17jlCy-LMRWjki>st*bR04+{&SO4@FJ#h?o}%XlZe=vx;M#&CGi z;04C6t>+?%rs|-S3cD#w$ZXn?N7*sY_27f%7R)M0%X_=%dzW~uBv^w?^QiEhh8)6t zO_JFuL25_u-X7he&`3t{*Agl4>F7PFT)$6~X05>lJ|ll9lHg9D;_~A=Vf<>`lQt8| zQoC~j;(^4C^aYsp-HE;NRL^RE;75AWd?hpz+6KFAkC+Jwp?tb#?FT~6k-{&ofH}-TRQ|xhpX!!V}~#+T&Z$% zW@p)3W$2S{+oH!7rNjs0Sv<~Y6{*OyvD*&A;S#b1+#?x=ZgcuUz4RmV-6yHX5eGp>3u32@70iGFR{n?GgFPIq9}bXj ztESw}Js%{Vadk;izk89`N*Wq*g7Zw%pH1RT_?rY2EQJdjaXCcB%RJV*Wp4mm&aynW z%gLNhY08irpBOpVL11o?OlVO7j#*u-HayLVoprXb?#6nky9V+BZ{Ohu5b+B*jKsB+ zh`b5KjoTW-zWH1UrKAsMr*AFpv`><|QYj_`-Eq(p4O3s`@Arwzph0plbCuyp0&lzq zPoM}g>}j!{AV{0i8?|8*1eByUr0hk%IzaLBB8#r}rcsk{=-P~1(bsZK)$vU0A`w%$ zCLwvNk&Wsgg~eKo7MZW!MH~f4`9%mzMHu8M|_8bL<6wkqHPi z*yxji)5F-zZhXFSg2T6$dhnz9rP~OBtoan)LeOj?;o2c0GW}Zj!Q*VTYgYxj9O=@= z#5g*CNCm|kz3ar6g2AD|s+Xe){$4n!SnWA_T~%|mrXS&4&n_=uz_PC!UM%;y{{aq+dRuzN;m=D72s9k28ZCreP=$Va~dqy z^gYoxrs;@t&I7>WvrlRbyaXI{9DAJ6 z{)!gwAL^{CsqSmAhkyAxrFTjWm2?RQOsuesyfq3{0{bV3w%}6N;4DA^f+FS6)xp%u zHSzHSN<_~D+*oK2MHN-zA{?OVtKV2HIM#|(jFKQ%tnBCOBMEnIU}Ic40TflG$?vcyRq~-j1Jkncl(U}SMCS(XTjc$ww`O@ zEsxyy+s9D{CRNb5`jlb#lSS6f3i>GeP>RJTXdB04$M8tR(dIRAJlw{Uo^$Ns zWCb;v&w~3d3KzxSd!bmrDN(KImX^dLr1}p*=pQ ze!n|Ytl0fRudUW=BlReMh?g zi?^H_c<9F(sqqkHCsl0P^YnZQeKLpbuTS%)bh(TW7fS(bNtpV5s~kq4 zE(?nt1eqhY$LqY3?8*(qcPo{k{bolAQX=!uA7>66l3o@QJ!f=XezF4b&?=y!MR74| z11$wh;{fx>n|7FnZ~d#qGLQ14cFkZKD#$a2>~?XUMxnG2VNJp&=@1Zbzdv&4Jm>Kf zT}S^dgkoGIj`~|o8S32=lv33pkZ=nmuNUQV+@(*?#c1;2-d`RqfRjH};AUIJa$y*& z?^Jhl1HgCiAh{(QLu-Ec@M^hqg)r0&R;^P)QnKpAd1HU}$2h!O@n;5V>RIxxhrfWK zzoZiJS>N;%d+ZAweDv_Nvn;vdP^coDcq|=u-y2sMrqF8czi!=e0()g*7~~jSG!nan zB_=248-gw0>Mm`z>SGQ_G!+N6QB%`g0bpYj|?K z6T5T;=_&x&g8d1omUCxIW>E3gE@CbuWo+Z@pZp&EM7%I6%5}F!q-c(SVOcWBrXG3u z5GXx&eyEm$Nq^bap#89rqXd(hs#avdM!_#wRx4beK?aXLgn^wOHbl!HKZpX={VJ!5 zhcVKdjNf%^Z>WAB^^<%lCA!~bS2e(t8t<*hqoTh}+`#-?72k@-ZS%~bw^i~*V%&?p za(`o)yK0bkLJ0p{0~Mii(GLk~8!5%_qpX`)#WODgjzRAc96tt1<2=(kGb=_*S<5fai&k@yPD~^0r3& zuUYEf(jTZ#3jo})6?VB(+U@x>1e4LZp&=}?cvSyzZJANrAZQh_mj@8;+KKhGuTB0) zR2ov{wWl#Ff{?H_{5ZyUO8xakdogRGEkfWK&Gib?@|ScR?C*4~azoad>G z#09(W>-ZEx{8pf60USpa2=Y1Z%(nd0z^JIYq8Qm!7jL}6$K?I*pyg~$os$znRy1bj zOEtFhBa^jcS8{>Z?0lE?G#NBG5+K?s_vxvLe9>aOKygzy4~ydV4Flzm-8j#3h_Ln3 z{j$13@#|VCY-{qUS*Z>ScsjXvDtmx3DIB2?GVC*N1eoqLjxSZ&%}TLRUtnzxTsf^9 z>~oid?_jSz5?u&|WEavdo=UQx0%dcOx6e=55w0cEvMiKR@6c58-~TNfM<#$)qIJ4& zZKK-zbgN7cVfUk~L)7#H4MYDfr|x#3OYFg3@ef8&@5D%)!_UiQHFnmFw3V3-%AvQ5E@ZH5}=yD`al0596zxgj? zr-TVL%ZzbaW@Y!-?HAyEDTmje&$ov1t% zN{pdROevuFg9S962bKS>XjgqA55XXGWhJTs78XEM0f021^I26V?Igd{eRlKzK-j$U zQBBr&*LR9|xK{xv4PcPEG~eHto?|J_Qv3=n8~+SS0$-0zN1Xl_%lQuz?!^Vo-jSpr z`HM~c_bUG=Beb&pM8~q#Mk)V4e4894eW?m{NnY{);k#oba{X*(;)N_vhlm&aUT%0? z_FENB>XxAe`u9puw7)C(+oSwdy`(=U6Kva+!1;>m+b$YVH-m;H z5}*i}&Og69UhK>Aeodo4lnX6X zxp`}GhMp~_*AUerI=yM1I(9RY-s7l*l(F*Jk-qYGE<`L(H->6gx#k1n9NN zbrpUCYX7nMe_gQ`N}k!X4}nYP$C{ud_KT%&$7VaYKfdjsMt3(oPS*&~KL&%zX5Rb( zMlA-=+X!Qe9O3iukRVr~IPF7$uG)zByS~R5f#Fh}@Sva|dXp5Xzdc37leCJ_(EV@{7;_z#ClRG|AF<4I6$A79_}s- z^#28{l5O?mm4=MC{@v?UF`)I$jogQ`pq57=ap`x>n1j`=3CCyA56y$f!bJC=RgPll zMytjrH@&Q1OtY2cnzd498s*nuD*gwLDWffD3nn5ZRD%WhWaKATy?~E?f>-$?6YdfO zOd_AiI^LgkRA6Oc)RfVxFl|s4XJtagmE}|l`pM!UjpqKedqAiu7JlQxj<7qKExp^i zR+xW_EG9w_$gx!+i0;e74!iV3$;t02lhDM(S>@GfAb$11BnCOspXKLoFF}Xwr%PbZ z9BFoM_7k>98G`G>0st3zU*PzQylPBhmuYm1!35G$*hBZNEp?8?YV7h)0s)1Y7I)9? zx`5ncZCx(QRf`$C$e=Y@S=OBgbW(-VJNL6-Y|HOUWr!AR7as>SGuGrq4HdR|q?Pi{_U*OsWby!#}9if`9-o7ea zMUlGsahelQ0lse1dMo-u0v@-R0Bt3T=4gLubPI^2-e3LQ#{5O*q`bX49kk%9icnr@ zmKsz|9_X&&nKd|?W3L?+D!qtD8THsspt9J3{6spb8Fq!?Y>kd6DV%o%cmox@@RlRI zlhDeOsiTLm3x~W=RDk?#<7kU3urH0E4Jy;>G|5rMT}=>GE2}O+v6)y8C!+1gc4Mx! zVk~~yl;|RQcy~L2yiuZB6Nw$bTUz!_()mdu7<#6+ZDBFjw7v5cLK>!L;-zlN%(`o@ z{;($3r?pyT@lz&kXNQ$N&K!{FvN!AQb*_v3J_g5zX&}|l#(HZQ#Kas&4Z{l%8iZzh z^H~WHCiCBb5P#N>-V$N}C}P)-A#5ta_40uJV--Xxul1ES27fjy*cp|i@4FlY6H=Q3=;cJXRt+` z#ioRLS9%Wr?Huk_dq##M|E-_n_F6ty^Ru&CunbT*chXLHGreb4aRn-VS4CMd1xkp{iL#oqNHyycMFsaEYA&jRND_F{{tRF;z)@4esON{4^8 ze|Z=`6UCM~>ZxCsfS#z=DX;$m28w%`;H;g(K~brwo&)8Rn$~<8RKf~Fdf4V?;cB_i zcz%`VeaAmHyqLg!laSDe+@%V|=Smj#&ZJy@)4|OznsFh8eP>%GJ|<)@8Pl_{8WU3V z5p-vga?Rib{`y0rnC^E}(Li5>2Or@ce!9q6taXM=Y8Oqma{4m7l~nfz6LsOFmFD#@ zoEYyd07|li(0D1m-PjVq9&|nFtWmXQi#vo(Y&@Inrc2=3t0uyj1l_Q%+VgP;3gwWH zoRBIO^}IU~;$SARnKvF7D?`|PYrgr=Bhs%-JlhP%kt%fT z`;ifd&%G(tr11?_(*0j}kg<~o_xk$py@fWw=gjl|U(~b2+u!js>j`0}R`XF~xLl*C z?>rD6uA;I1{sma+;K5yl6yh?rj#U^98~U?7l)20w*n5^1gGolJ^m#E@7y9<<79VR3 zFsVPk=uA?%3rQ5>$s^kfVLkO7F6$F+1C4-to_qQFtHM>Cb#hUDK5^#T;y?qyF3oO7 zGr?}DyP>m}jdu@JQWLTBx6xsT)nz5aLAvt|83_3JpsZz6cp_f}=XYof4EI2JfNNP% zWeCMw6(G6ZyE4ld`Zn`l;2YqN4o>>g3?mx{l+xyd zD4*G$;Ut6x^15EQWdQvomA`mfQRA7e14tk`o0kPh#Ju(oKMY^woGQo9i=8fB029y) zKVBLSKSp-zZZ^Mva}c#yllof|RS9;*#e#)({f38mH2%ljMFj;`)zhCw%H?c~;!@%a zF}@P(&iH2Y@hYhUWdJumkIrq8a)cPj>`A{$T*tWHdOTco<5)V*w^56H@!yTk^WVzw zZy*sXzV^KUXhN|#RmO!A)VR`p?ZH2I)*~2`QtV(sHQaIf(ou|{ZHfKpxJZD!I5|i% zPsi{P^@Y}{vQvUssO8G`kmL2*fxVmjyUSfv=xa7F=cP|<0$SA^lYpx6MSepcz-6;n zNcp$XSx75@8@r;A>(ksy&OPY=Psb&-r7__w{y0c2Fd`^(#D|r9BvDqX;XH412Ev zv7-gP6q;7}(I*g_ja=Fxzbi8I^z7q}QW#tm z>3=<&G_XJE47Mj9PknW98;i(R(qZK;T)GDU9Iv7E0;DK_u%7E<ner{M5d^VnP|K194Gox`s?O3n%Gui$+0IQK>P3gSd-`7*_c z_Q3MxHCaWw?Nbwe1?^l13#gZ|7E!kJHO>C`r%>&g_%(+UtKn;(TiaxtpR`*I$ImpV zZvy0pc!We#908Z3qUrT+ogH~lTfrCtcD%h*61jEPbX%A;gSNEsXF>Epne5KTq+33> zbS1!frwqmApe}-U4bp+MUNj{zx;6$A;uLa*5*s-*}xS=i zB6M?JZ+k0q)kaQY1k(3y7X(1~)Dj$qr%~@~5YB|~0-E_6jzp$DJr`Lmu0%T8obWr} z8o*A#OeGi8?r#|FQNj$UDbdyz^i8Iun1j=Ocq7Gaao(>XBXj%#9<2L#J63@KU{Qf4 zY)4SE`|4F1WhTvq6+7Ng1V>v7BNXi9l4IUrqn7PuEsv;8^)xr2!EM27<<|t7@}@Zi zd+&NuEx-o=`!;elmqJu?e4g9$(fj%MbGFE>&w6j=ne}H1eOD7%5|fVtz8^t7Tz{V> z*zeESndhk)``;W_xorSbV$s7H9Cu<0UjEDz5awJPcc`dU_vxXWxOr<#6Z4Lqj&6;Y zcApavCd|Wv>vYl0xTqqf5V75Z$~#fL3J;2X$?eJU>bi=ud%+ zZfj>kB9?0KXP@NnBwTXT(y1ZPk?V4ll2zjso5Pa}`_$);*gkdswrT_oS)Zh5kl?Ki?+uNd`2I=M5`* zN$mb+F_P3*&L4eWBzsMu1O8psJW)zNjEP+uGK8Y7*t}=5Ux^3klc);-)Vq^#s@CIl zs3K6D0ST#C?FR0e^U`wi=?l%~L?8Ya+Yp#{!>0l+pncC-z)mcby9#`G`Fn>gIk#O<#XZwc4)``%HKA2BOP6vT$^qv_J1{a1V5 zMJ_i#3VwI-VwIid$CJ&Lw^*8d(o0KRv96aBn^cdBps`m`bjsAaTKx?NvxX#0z_1E* zB+Hm_GkOOCE{ECmQep*1$I^V|Il*(yCw87h6G zbXR7zV-ad%rcqdI2)K%7Xc#I2-O2#4C5+%&fB#pv)l9H~MB@9sPR@;VqnMljF8bDgd1vfnh?%%wyGN6#`>@>QD^r z;<)=XOGha-KR6thV=vrAU@MzZ&{Bn4HG>wHvkM=;>{q_AJ^sNy-1GotW4YKIT=_O5JzY?7 zBlr+2JmqGmuA|?P-AsPLiIzOK@opyBS^RZA6HgS;H_3M8ClMa{siWt@P=4$;c5~g2 zw2NuY*0WkpF5mh?fxtRf%fs=0gK#VUa|BzX`)##wxN+6i-6cOB~PjQvtFrRKZzp_nb85?ISE?N-9 zx12W6WbLP;uNd8N7%MNQ+mBTnI(HjU0|IcdG|F7_mQ*2id_-7m$;ILcub+ZN2VyxN}Q% zG`eQbTDL*U^O!gDIM(^J_$O&ro*vix8EQXP{g4q5kThB-^zN<$r-%9B9Zpt{42O zf3VQJADa?c&QnnmCt2*3cRN?6Bq>Jaf7f`ork{@>7Jb>(1%fwO4O@9{i|$FxI1F&S zu`w`S5r{9~6FRc3yV#rWFR7CeF=u(^PSQt(=UPlvlk+oAC-bQ@btW55#7~mGr5Eyr z#=D-Gokm!W|NJ?i$7Dj%>&frS`hCtc$?qQpai4t!uT|L-*Jc4f58KWD^4CBAhcb4l z`!q_S02(6MFRuiAcWwvz71-*Wv*!U-@K=M*pLjo~7CfnkZvH@o@K0mACtzu8PHsLZ z4*|S(;8Gp`cqs{Lxk!O2RRnFS@Q^=0=bskv;e~gQ+ey7%BWWu1Kin_xGw{f?%aWUs z|MbWw48S8dwvb-<|I=OG0prYLjtum<)U3glRWO%7m{;rJhXki+Xvew9kA@||ngy1cLRz!6DtE3z;TNRmd%Jf>-J+{n{c1bo`M5u_ zzQxZ@bvGry0vq3N8lTh2E;{DMB^B1c`Uf#(K__v(=iJ%M87v1|^ei-=?2#i~*gsCX z2WtoTkj~He$9n|$v=_p{ei6^dWrhz==E) zL`jjY646pYJPP9SyyVy7onG|w)QSH9GuuX8jzI0W(bUV6d=U|wA;&QJP2$&br#g9_se!5@ zo+7bZInGTNz21r0OczH>O@))04nFcs9q`<3J3`1dlWjL;4b!;o zib9&%%^oOmfsx&RKQyiMq(8-UaO4HxBL+{8?U_N8gWo(}!2sor`(sESR=B+EasEh>;QX1<%{|XZO(a}hM6iY=RG0|eV2{x@a85D6fFnm zhB|&WGp`c!nk)El0nWn(Jj}wB5}$&3jI<7uz5@28AwtF+lbfniqTESy>((kRU# zBlXAUn#sN}_`nRI-I?|E%?d5BQbitt|6QOoS0e@4$xMv>L-S>r7NB|2LHD)hnVq!N z&&=pHfhn0oDimBs%}ZuUSwd?#@xsU9 z(m#x{SgnOVy=-`?x#>egUdnv7P~p-1tzj^*DuoSrayV@FXYvmL(3G;xT=%(#w4K>p z7JPZKU@9Vl-5Zs%ZIDpk&7u6gYmj=-A=^Xwj@7j8*e#BY`sR`#v31t`!jR1PnVfHp z2q9NQd>j2^&EAyCMsc20>)1LFm2+P)tSE0?M1(HOorGF6r-!J)J{c13>0 z&uy6p%)G88uu-SlC&Q9@eKGkswY9QE(mim$;kn7E6;(F%?fuwev!&QrS90Tn*gLpi zE;t=~L`7%hGA?Pin=-_q6kJ%1?oRTpKfMe*{9w?YrIPBYUu}lncB`oUH4aN^v_#)y zFFoJR?f8dbLLJtaNJ<29^IeW ze5;7tQke%ImBq%*uC_A$B97&dU19k4NI`-IE6qXafJUMEUA;>~NDARz6W>mu!|$hO zMKQvxw0YrLo6tW>apDQ|(_ac7lj2gWxR#^&WsTJfnM4*LzGWW~$>HQCtuND%Zb^ra zOd`e3LT{CotMM3{DdH<#_vf}1-5U8mte#BZE8T^^eXH9h5XNjPNDhVrOj_qsMcpRn zoKA6g;~n&I+1vS0BAijMh3)Kkn;iF9apVm$YmQ+m);Z6bGT$z~SyF%`V$N17B)LDC zb#tOL5+(?#?(`pw94F(a{;w|)&Q6tNUAIrx<6#hX6rQ5W-`-sAkgD(PPDXmeDprCL ziLDUApIc((b@B2{$>O;CU-5Y^uS^EaAG-4h&}?|^up^1`-I=G%R2jN@c(h$;x`uYE zPO>ZyE!eDt({e0sJxBD=B+uoVEM8sg0lim+2cRkPHZEuBsjw=Dm)*p5qp(&+jZ?mf z9y@2an1v*p<|W^?_2)EqdPRXuy=q>e_g#Jf6uE1NpR9py%L>{L&UZ<8s> zO!OTmPR*=Q__+neyAq9->jf&UALj-A#i;T$)p{f}{QYj0?-XW6$I-FCZU^lmkp);S z!~9Gd9(czk{F?n-&hxDk9}l!Y957tG9ooR7kq%Y>c(JgGL7LOaU56^>PBwdl3hHZ@ zeDfNeRy7x-D_ixgj~kwTo^VXYum9=XW7Hb<`NezalIdEwcv*vC6+^J)>Ah3ng@yOA zwLu@~XLNK9ndILK&nm!KpBja(X=?0D3-CJxT+|qa?vxjL4quedi`!P#Wi{njOl1)G z*Cc_&ze{8`l|EIqXFPuZYq1;D(8p&eH;f8?KuS2i4)?TNh)H!;QwNE>D)0Qbr$U75 zo{7lv5BqDG5DlS{G2-~dO3>_JV>i-N=f@90lnQ=P&gDQ4r^+PKP{e`wvCv4`LZ$3@ z$vQmfB94;J%{6@J+goYjW6*wS89AH)@41DAWI|^_l;1I-2%g$_C)R$|zL`>;GRKTl zygBM?HS41~m-7tIBa@{AG8*YPwjVqD3DbTGq$dYmySy{_m8`ZyeOib)IE=1B^hu80 z0ou$W5!KJ1Z;cn24&sSC-lDB5*VmXfTY&R_Fmu|G!;$|gs*uBd`g1k@;W>Gi@(s$x zVZ}ld+0S@ttTGuyvQ2T-nMCNxe8wO@(#fj9>MFB_WFD8%V7P@-&zG|c3!dY?fHyqe zgU4Rr>RMYUX>qhLj*aEcuYMntNHwDsyc!kejoq*m)7YptYadDjC zto&C7`N!BLrA4`S!mhk=E@3ApAF4?KV~?@#!-7T8W4QFGn7Zy5XEj!Tn<~!gMcU11 zdopMd^`*(0{+kf2e^5W9pZb#<7wT!vIwG2P#Q8los~CK{`ucN;@eXx7`Rd%xrmUwe z+c2t{pUD^`zo@&w?E;z>gb;I|HBj_d!F+h*u|}xEp#2f3(VL;ZH8=xQsru2u_@!?s&(MtakgO7T??goa1*;dX|Q_o6$FO$xF= z)+1X*AmGf$2*#s-#v+>*U9m=Lh)%0f?&bg;l9fD0Qci`LH|!T z>_rFnftQ~a85Y%`z2=67Xcy(hw%XY+4bp`lvP~juF!SFXv7aWB{n zj%;q?hG-RjqYsBiM9(Pj=p>qRjMJ~S#);FJa4=#NDqU2n4<_wh$Vg}@S-A*+nqTkO zW8M70_R${D)Eu8qzLH`tFuamm@3z-Z-knB%xx4m>-nC@^rKuS;Z)%Eu&nU<>@Yk+& z>*rQ_+Y_}n-zyZ2Jx)iZ&YAeNQjr&U6*T*FK*9ze2F_R7v83b?o6p-eW%<~&zTV2w zzxDQ5QPJYznejZHA1;u5x^i|2qko9jG9!wa#_c*pvzb5PlZ{%-!^?4T+&J8=nEX*@ zum^23%ywvlhi8iOr08(hxoM*}CuLN*@iuUPF0JKxK?v~-FX`+34@MWAjkJ3A(bL8m ztKkLs#q(uUMf!-=g6dgyX|XeU;8>~9OR-?ckLq45x@iU8cSF_v=SFVX2pFk4;nqAssZ11X504hbbqaz z%1oUujH=~0wbQoWBjYMUUx%FW805AK6Zm?!{SvQ6eeUG6uXuRDs^^OH^c1VbCjV?; zY-X*>M5EEHf9h?GQlYZ+8rap|GP^;4pluCCtOQ#$t_ko@=o{SJJ2dZuWgLR<>?2yh zdrfW>vJ~J6r{fgS>vPEoGGBLiG!ZRzNDsv?f(t;Vj|d@r*l1NSVDa-rj6AN^^ZXxUKE2xhv7T{SJ(Jd-7;8w&Nl7THq>V9- zgl;WicH=JFRBqR4rrA(GF5UQP*=L6)o1~@ni16L~4VgB9BbNw4!(>%|fAZWZVrZP6v0+CAiY#f(aZCX z&!G&Y8Z6i)u-^SLVFp~cH1x@{(q7R_M$43-LFl8d}7#Cxi>4# zuk-!;9}Y0j!;01H9LpVl@M-R~%};aZ+J$QTx*j38jqsslt;(H{_fa%e0WgRP+hvJb zb&lZ;9bP^@chbDEF>EYZAJvE9JTf?0cRLz9^BX;1bnIo5ZVMY7e+1*|5?eh6mY!CsV2Ia!3&y>wg zU{+e3=SQLoh6nj?Z_Iu9erbv1dSPiiPG;t-7Dlu*fxK2+G$$c`OJRC?y36^Fo&e#@ z{KIV;VhAUtLjBH>)zv|e+Y+R?#Jxdz{!8n$7uNbK=li=|$3jk)`}OP4MwoGmf3W^v z6TAkaAm^HV#?@m} z)C=v-t`)=f4>jRS&UEcaw_G^|mXoSHUYj_GOO9A7EcM0oQ{HY1|I++<|3G6JAE7Q@ zm(=3iJqu({ip%qe?DW`(bR5sFg63^VG|R7yPSCzP^RKVeEoC+HZFJR7qwKWI+}HMx z6oDM0i+3VLgeE!CX;+@Dibx7DGy5_8gNa*G#weZc1$k4Hm!!;|E1fgHnQMYS$GzRG z7f}Yri}D@ccBPo&epJ?;E{7GFd{}5m!?G1Qj-d3WN22Q5nnXCWB2{;Yaobbl>`d;@ z@h(n;tt?WXXmyUqu9RucT!wCK z-ttk0Rv?WsA(s`2qVp9YFA%tB0?9)=+IU;ssl2*yS+6*CA!aVxO@o_!40(#K-<;dt{!X7JFp7`S>HgyDVIyC#P3BD6ZwDe%RulyP=5ni{_+3L@ zEUBl+=yAj1f*%iy{SOZ)yleLcngzYC>@8B-CawA!wzk|hkD%+M4*|*AtbPC zwgI`tbD+fzri0v*=^oo+wXBj{aWNs!0@a#4Er*exySuGTe3l`o@a}5YxRCR{$l^m8 zkU!Np^{xIkPZi?4Ffknwtb*RT;BYv9H|+yaLi`6=jVITsC?~bC4SWsHVXj@mK@;RJ z<>KU5UnwDn#0pud%gEsD&jn3179KG3R`1fQ4{fCO@}!jP#%Q~Yvn#)*9errOI(q4G zFQ_cZ$|HHcOewzaJsjKfol)nJ$p8U+{9>KBWnRb`BK~WlzW(oGmnIf!c5(E~*1Yzb zDX86>8=2Pl8)E2mJ z7oBpwEo4~Lxk`s$Z+VV^fzilw+Kf&W-p?E;rtc_PlEl1@ABl)$`GXR$2xaCPZeK~A z=PR26*Q&Vs=vjLb5^%d5*>XiNDwJOv4Z}6B7GO|-Pfr*MyY#T@jHl46K;syiWVU?g z`?sttiXwD0B>}}UDRI{^U=xqdT@oC#+F|Fhb)nLgJFJ%t9_H=)7zEm{(i~_dP93RM2yN3u1lsk~ECt`DI}s8iX@kW?kWCv zx;;aq7EhzN;5it+%z7EZ81T#2CfNGM+a|IROa0z$`Rp`~A&)N@4W+n5X;>~4lP(~D zZEe>#sY)??vdn@Jmx{7GU$h?@TLoE(At#O;387-i z5%on*-qfKdM@=GiGW-4yYOszmvOp&9yEK1!nhJVVJ36wAVwv^Q-U6YgBWP-0~W&eZ?Kf;@)bH4A#xKP!ltOJ>T?FcwoNx?Un)ZkFbkLLhQy6? zGY+L(>NvlK0@C%4!m)c(S5H3{m&z<|+ybUqD-hi=HrKBubRk^!N5g?Z2FJH`HnS zs;9z{dpritEy!FXJ3rjrhdfp{qu0qd=C#bstjXO!UM66{xliTR! zj@lZ+X+$FD;3Q7d2AlbCizG+vl zK8_{D?2d@u1bs9O@k8EWtp;^JG^cu;Py`*5p%|BKN@?HBjiXZLjD7hd1o%sOx(j-p z8t|IX4-3gK^)m4ti{A4%j5u{;=8L$w%29%o*e%FY3vG9quI=PUldK+?!?OuugU3rW z#jbw`bn`Q8MDc|V@bHs(H9`DqT$)Ho6!Z0l0@q1x)?Zf6(GCRwwH zFys|D?M{Lni%WU}rM~L|<*u#C#?gKO2t8VhUhLJ55yYX%)viG(Jy22}D@S{(C+Yud z@5}$$`nPvKohM@zHC1WV%%Me7ihfX~rW#vBs;blwLy9IbRJEoUs*0+yS~UwQVoFjq z3u2CWoQsPzla(OBn`HdtV^d1Yg~NH zNYnQMr4<5~EMaR3+FA?* zZ@8o}SX7-&n8n4&y3moOSa14pamtV-N-tNzr6+k3BXdde&=d1Bi-@!wn*YmkwrAYh zw0@^m|8?NoJ`%3aCKxn7SC=!yq=TfUz8x|XGNVD#`a;#a@1`& z$h%EV@Wa$SK|ylp?O)Pe#7_N_&w?_F7|tZtPPNbzZ^JG1&_+2Ca~@Kb4KXJIX?QaQ z*D+`F0J>y{UAH$9$hrLAnj~mF2&t4`l>0LBojb%YusgV+ZnDAbi~rd zkct=r*vUe1^{bmSk=WcE_Py(5w{6uWIkVICMr^iML!VH}yKH^Tq*rX)5fM_^8mAV` zH$S=ch^m>mb!+@@A@J{2_;Jb!BL7`uP0HEA)2QN720~?Lp4|h!cF$F{`kpmk7@6zt z^@S$(>Z-}T6;1N{CAlj`rzIcBSlHfUFlhk^7S)i9Loa0;@d;zZ&zz}-4@Wp7;bps- zwB@^$)n~Omf!3VyXcxPPx}f4F*4N!vP0G+phy^ssxY_~_3*SdG znVYpvW|ZKoN)EWn=7t9`LIt(9PITzv=Y%k$j*ENT@@yy_#8%7f7Wm~$O({#fh!l{j zBZ6-Yf-U!#Na!;(oaXhm+MhZJz~PREGLg)x-1d{ZjV1~Y(c48D{r?*$U00XA3R>4)5WX3lQ3>Sdhme%#Us+(T& z72N-hX3S$z;gbcml{!3k|0;g77)_4U_XbzgZmU#&!&PpV`a9xI=ht3xcJ(YULpeHH z%sqkH>e z9?>jY3Kj4>$Lzo@KiBdrkLlwr5}SvSL`7JsXZaHyeUgD)D(Z=Z3dz;D@-zP8myV9; zWFP0PeqBQF+EAUEdQv!h4k7Yk@3%$ma#J^?elt@y-UmBo6Z0(TnpR+WZ}#Sk<0~7r zjh)m!ejZ=>%`lqAXdICoXpJ6+1?gwy#te_8hk1-^9Wgr0Ic*u5bw<&4g!bE%Z}YVm0f58>VtdA3Lf8cy}ojv%M}?NpKmXI1QXUISH7hi#fz3FV%S}bPd^NCxarH7 z@WR%PS39g#DGA!j_b=8x%q-yk@D<+;3bLmpC&_L6^?c*=s5mp+$$y9GfBxpGcDzK# z%5Rl=-kFub?Y_yU%lNNDH!mMWW2gRozPD(4BgK(Zw38So{h`d1`-ls_Q5E7Wm};bG z>yai7?dbkl`cK!NPB6>I7EAUY9s&TW75n*DBc+K>gCD{0tEMKN|4=EFAsy%}aKvtk zdGcn`!`63KN%7Ew@a$Csy;BdY;yO92OAaqy|MG8=0JNX71fOKSBi@Wi2EgwV=TO!b z|M_$4)wSnogT3|9HC1>h$s9D^!Tja%^e)*fmjo zg6XB@BLph8q6SsO!1Y-cbEj!@7ILPQk7^{XdgqnoLnw?oWi_%vVIDSL-*$qXzWL+R zNlP&J4%Sh~cZv5EQgrC8?codm>z!)42#=wGL8-9vihWba1Xo7BRo=zPCGn0PLAa!4 zc?pxUtH^d+;VriN>HTspRcULS(k5uryh5}-@xu+>y}ijrKp-Pyy`FS|^T0IQ%g*g^ zJgJ)MecpI^(t}n8Yd;gM4rj^R&+4>$#w@Ix{MrlSpmBy&fn~;6ukK*Hlsl+-kjG>V zNF@a0VA8%-Hz}-T<>(fC_!FeAo&~PEF?i}goCbc80^;`)N!Kv2X{St44Hqsa+{*8( zw3*sz3D_CDL8VU4K7Gb~0!$8;1Qb22grY=BqRn4#cL8X!#xsDAOZtn#ednvO(}3 zn<;O`T)r9_ue96XL-CDA^W}yIeA#O8aSWA*Ng@^<$oqRdK6s0k@~@({Yg-O3N2JZC zYW@_sArJKT4J>W#<<%wREurcgJR-ncZzoFrdq(WcAfYI}L4R0ao zr714If$iZvw>sv(FC3nLADg9qyn(L3o-51&KQyHFXP}AJ;Bg-F#lmynx>@IZ3jGFp z6JJUnr=#!?{GW{LGaU{BF6@9Z6X-ZYlXPkKcn=A=-m$_&vAH?ArZs zo=~En%C3E3qhmV;G0{^PiMwjH`?9aeM8&83t4C%jZ-+{5?<8j1sA+UXqlNmN-!CS? zrM)s<0PZ8Sl;9X%gi<*oAuya2v*}||FsrY^F?6S3@7JZcCk?r)8uMhJUO z+g>TokU|lV`%swKflz%S!F8o71JWLm@(;x4N^c}J?hl8f4qg~Bg??D6p1AK|7tRAx zx5^(WQnStPe)Fm8mYboX!SIb{MCpD zs7R5B9l}iUBA^k^#@F}3$|f|~g^Fz5m|27KVKc476+i^gt^Vk^MGL~AX&`$@J@tH8 z^Zq)a+>=Q z8JACP+}s?RGr&fS0>ka-h(>LTvV>9>E8qPed^?q{SekR!rzdEAQ-F<`U&!TF#EOf7 zBz@JbKZG?)a3yRR8M8jZA#Em1a^D)oKaqtGNsJ;wEjN;HrxP@G8l#KMruw>{a(xD+ zJ6(Zb6^^RY1CPgu!}l6y{ga{jZ!L^-w%k`z;xkBnAFPIVBF;rZN?jYfYvEl<0Xsn+ ztn46%?%eGWl>LhRwt-v0R#C) zc?p$UZI0)m-GXWNDd7<;M@U)=%2b84twt2TV+rWEO9$55bvAQ>YE>mZX8^f=3=hi) z_)^urE@AuiEtaZ|w)` z9BYT9-+xy(W#TR*2tvkE1?;7F)TIJbRm~E8AqPt=;AYRoMOD7|4)!R^Cqg72O)7W75>q z;ttCaw)hy4(&iB}Z`-Hjo27glb@(3r#dyv*baLYjbx{#>>r%}Yj7S9+1~tnd9De`9 zWpl^jIUo$Br{{Fpik{N^7=a$(9o{U-f3^q68?z=o)Vq}7no(Wy2R(|LRI{JzcPT&| zb;4@@S}A(~uLLaCv8++;tr&9*bEoxg2^jZbCXYIFRtMaiPBb-xJJ~)9cjXC%$=)ikCv<66botMbn8uj9?A` zS+HygkUixt9@-gvqZ)s%_lAnai%4>o#!mo?PXWf8a0u>hb~Ds@C0thaXUTo_rnzr{ zG$Ts$fpu0`Jp+Fm)~>zXX(;lx_+C9TBv=Kr2=ODRTX`;Zd3FSBI#j4H%uHZxwwbSx zTa8e$5MPBvDIgo488U>8BnxKP+0JAd4wavJxCFc{NQK{axAuzuS+@HlSv98e+eSb>5Jt@&F?so$Fj|O&=`w^2(z>aZ-J*R|}$O8T~+QO<`vS zZ$2yd7J##-&#Ax!(`e{{qHENrX(?#^oY)qmhx5oNnzuNCvSBFvtVjH&%4J3O;Lk$i z3Ra1?c3S=YfW)aHB~TgynJJM(ZZ3$0zUu-EONgn+(v8w6HOHP@0csI&w4-A8xwzQG z@dDew?p9MOZWCoXM|Riymy32QfM?rPYRr1M&*-B;9GsKZ=Y^50t~GMHlTgGHK@r{? z)zbY@HHTw@ryl<2lPh}=Wgs49`Albtl)_AJoHXqzrR{1V?oss)aS{`(spsv`NRPC= zQ4Xsx9VaL5IoiEHEyqguVTaqH4SHoLOMmPa^z&I7Qma9G(o2$%c#9&-0mB!Cw0qi1 zE8P=H%JBZC6#U1yac~1!K+4FlQ_D(R=N0DXMhv5;1goM@Om;mfzPk9WsOgytnkWy8G>h@tF`^7H-Zmj0(o6m6^F4tB@L zAKx7^=w9s~t*%{ZXa(gsUn&&&CbNel1rBY#%imkIt)8&NyK9h5I)HvqjUoBU_gDOo zMK~GXOI4$WghmkW`rV6Vi2}pna0iAXT6>>9s+y2frP7OU5o5De-=w&Zr1)^$r6HCM z^s(2VaGbKG*+gnOq+&T98brmnI5#(vNTa z1&nUdQom;b{QH1mOCq_|Dw7>4*(Fh1f*N} zLAdMFiPRUmHK&1_luq$=79 z0c&^h`wSw^SKmwSYzf15~JaImUA%xFOoz6>)iuSp;#^eQ;SoS`X2%bw3Vm35xwfYx{|= zy`poAD%WoK__2K&*4uMxYATKtUMPMzeidOp&R#j~F;wm;Bx(lqP&Id1qK2eis`g<4 z+h0x=VdTewq_@lb1zW#OS-efO)QP_l3^4@JPv=E#e4vLKSyjt8Ge?Ed7tW(OE?v5j z{-TCg2{Hbvb#CFOoMX5B!lH~wZh+d*o$^xnW3^*L;m5!%P-U8 z>`L&vesf~Dh4*4lKr?CMO!^78@Sb^J(y(AxHVYxN#xQ(32$Id`2_127uiT`7K%ucf zX^L@dSNfOjMR{wLXX3v3;r{?IB47QpNH>NJp09s}E~?f1CCzNcR^3!2E+~5^)##vj zFF}2e#cf1?IH}*c;jyFhC=HqfU_v=Yk?g;G>FPWFYMQ>gu%wV$jT<HPkUdU)o?_zl z=Hfq(PLBJ?GzfcNo!jdsG?|k2J33cYu_b%+i3-@ou=2Hit^WI)JFO$WvN^h_QFA#|L^?60 z-D{oG|F-acEfxhy0&SYZWc>U#=M({Q;>QbJzwMWgNaeaIthEf7;+HL?17~v4EQD{8 zg!5u%t=caQz(&6Q)m8&JJXN|f$-Au1_iA0GYA~{9uD7@bL7B%8NH!lqFk&JJ@Q(*G$h3dzP}Pu^efo&ja2f= zJmL96>h^`7Dtn0Pl4UWI91J5Pm8Zw~>C%<*s(C}+qG3*?YjsI5u5d-PzVpN$j|yUB z7BJP;zKLx~z^(lLPPX$)JDro-4++@_2+>OM*;AwS!6vBOw+g&I&w3P~cjubPf6hwo zmrs`WD*HS!j;OL{NK{;&Rf+r1lsH^%=iQJW$u;UR7HwfSR@rwqC>-nL_Tq33RJH7% zwYdP+gNbQfRNJk;udiDwTSU^Yf=y3ckKdweC$aWZG1GgOYpELWy@NWtMV zdQ&A)&eP5FLW z*EhTHgC4PuS`p;v11WwM*ys4yWdbe7gJ??_?~VIJXqChfNl@i@ZC9#@O2W@^y-J?a zQV=-@Lefeo+uw;ZAu0q~tVs2k&+9<*Et~2qs#-pO}hwPQC*Z%>US}cQPH)EVw z%QpTe5Fegx3OfQ8xr-P)(X*PF;tXc1D9V42U}O%P-6Uo^Bbj(jC8w^JdaryO3<(I> zYjF})mU*IkuoJ*_qE0DSs)Ye?H}&26HL{O>#`i2VlPu8DHlEQtmjP?75$0|8c&|xa z>`M=@ce>d2fNZ;O`z8gA@UkOKMev(^YA_vO0nfB1#pRshVmFsLkP18Eh+4h&N2hqf zSB_W4GuNV?5Jmn_zy!>85u5`d3`lQt-tSIqh?))H1!8`-HZ|cJlX!LYR$K-RBm~7w z?XL7DdkWf+hf5hPs%`r|eB|&04w?z-m7T~_7>`c<p9zWkhrOd>i_1t{D?# z;WJT|ksswyp_i;IDGdfo=!;{S&h_ML9Wgk9-72*xu~ObQYFvW$kU5-VG3|T_V9_)G zAyDt2RJ34WY)!4!bfMXN42rnoIEW_!1@hfuh&04S-^4-fB=AR3NjWF(Y><^li{Fpl@CHp4=6y`4T78WSIs}go1PmF2#PSDB77weZ$F@i zrXx0IWyh$Br#H^!Jo!1>O@_HAt~P&j@!NV|iNXd|_^Cm-0J~q(dz4>v;f|5B4#qy< zG!@$akPC^toc;d!3yXcy31r&DqyxsG`_kO&iHf$jhxanrby8PvpleZ|;vHFgyG828 zvd&dk4xu^gA3V@bAiOf+s@$KGR=&0*h>s|p#j4~Y>o+W_YtfI_47Rk*W)On2?PW>j z8cY9BI~4;fn+d;34nS-gUqdk}4O)f|oY-URTP|LYuEP~gxm)2G62YM*&*^Ne7=8Jk z>?fV2aYtD0GG8B$$)Cm`-b=ov8++5A$A+4u8V+QqGrWcJ4HUbu3%V3Lb=P%NOccfN zOpfPE>CH=F94{MI$4Nmdw-QB8zmU{xXnj6n>SXuoeQaLy%=5}!K01D zo;@$&sblDX@b&dy*qL0+s*U){dU&@;?4zoNo)xmo%h#znb=sdX9P$~fxhHd?`Z*F{ zu2#ZyCS+_!WL;=HKx-!2HVc@eEUc_Jbz_r-xA$@G+{B`FrQT9Md>yLdlK^j4V2lmGjj2yZ$rOaz48p?(Gt=Q{%m99_Vt%qtk zubEWHe?F)-go9pey}{pQ6t2OXP%n#7@!k5Hp5=V~aB$;qVVwHeoeMh~ec5H8yRWb? za>hqF8F)onEe%c0pahsaxxES>W#J zXvffZc=;Hv!V79PQu`z#1^YDW%jFc;No}iSkrn~@66y^4S{hB-yvVYv7Vl`Uvf`mB z*R0;wHR7^Vp1#JphnUhH{-t~u@d_$^2HjWOQj;6c@4MYx&8E%;U8%4e`Z&Aw?xvl4 z?G~Hx&l|e&Qo?vTEfIO2fdj4IHM9@V3pK+%&V8(2|7a(XGfarnxbhO0QB&iI+LjGO zIwzag_X~%wc2n7()fPtpQy`A>z(XM2X>b4KSj#3BF{@KeygI{-;=l33m8VtT=7TNq zJA*cV`gGV$TwczW$)ez{l1EQH;Q1EJknqJw$_^KJ%=Akt7B5QcBy5a@nQ5RN{P0@p zGNor*J=*;CybVLSW%RKYk#Es_%7KYeIYH0Px-G?d=iG_5*L|y+uX00yPb%KW|DD9H+fiiwZp62Mo8} zwQl5h2;&u%Z_A}z9Ri0*&v+L;Z9cdg_wh^qkn_E&kz@tgoi~smJOOQqu6S>$`@Mm1 zU|S1RG~t{Xrw(5sD9ArM{~j1xraLklm^9zB;tF%~Ea1!t%rVJ92;LOFCa$ERo>b3N16-az#l1gTi@?pmYFxpM$q{lTB%6)6Rn>x*+tC?v*&1GfTbmcSljW1&~d z!Ea%FD(4lrr<`GV4LGsCnVrB^R#t9RYgKHjJFd<3lwUZ)SN10Fq?pEPziH_p=i&Da z*ve%6LoMZNWLb|W{DAb_YYET}W1Ew$-U<#A>JLPmJ zZTIKaRHao{&82_K9Z6NR0BpwqoxR|w=lJUw4luXj&XNxY5kMbZo)fUgt(pBgeFTs@ zc5)r)z;6gz9?lT|_lx*96ZPLa;=lIk|2HpU%kR6#xwZhNR|kIqKUx}k>iK^^efvKE D