From 841444e53a14395ac45189cf03dad26f5ca4fd1d Mon Sep 17 00:00:00 2001 From: "spin-stack-website-sync[bot]" <347572492+spin-stack-website-sync[bot]@users.noreply.github.com> Date: Fri, 6 Nov 2026 13:06:31 +0000 Subject: [PATCH] sources: spin v20261106.01 3cb9bb55ff Written by sync.yml: versions.yaml bumped by task sources:bump, the reference by task reference. --- public/openapi.json | 205 +++----- src/assets/diagrams/egress-policy.svg | 297 +++++++----- src/assets/shots/snapshots.png | Bin 58674 -> 59144 bytes src/assets/shots/workspace.png | Bin 74438 -> 74904 bytes src/assets/shots/workspaces.png | Bin 53823 -> 53729 bytes src/content/docs/reference/api/index.md | 2 +- .../docs/reference/api/shareservice.md | 2 +- .../docs/reference/api/signatureservice.md | 6 +- src/content/docs/reference/api/types.md | 32 +- .../docs/reference/api/workspaceservice.md | 22 +- src/content/docs/reference/cli/admin.md | 217 +++++---- src/content/docs/reference/cli/agent.md | 32 +- src/content/docs/reference/cli/api-key.md | 28 +- src/content/docs/reference/cli/code.md | 25 +- src/content/docs/reference/cli/cp.md | 7 +- src/content/docs/reference/cli/exec.md | 7 +- src/content/docs/reference/cli/git.md | 35 +- src/content/docs/reference/cli/index.md | 13 +- src/content/docs/reference/cli/login.md | 13 +- src/content/docs/reference/cli/logout.md | 7 +- src/content/docs/reference/cli/open.md | 13 +- src/content/docs/reference/cli/port.md | 49 +- src/content/docs/reference/cli/project.md | 56 ++- src/content/docs/reference/cli/settings.md | 35 +- src/content/docs/reference/cli/share.md | 49 +- src/content/docs/reference/cli/sign.md | 9 +- src/content/docs/reference/cli/smoke.md | 7 +- src/content/docs/reference/cli/snapshot.md | 35 +- src/content/docs/reference/cli/ssh-config.md | 9 +- src/content/docs/reference/cli/ssh-key.md | 38 +- src/content/docs/reference/cli/ssh.md | 7 +- src/content/docs/reference/cli/team.md | 126 ++--- src/content/docs/reference/cli/trust.md | 55 --- src/content/docs/reference/cli/update.md | 32 ++ src/content/docs/reference/cli/version.md | 7 +- src/content/docs/reference/cli/whoami.md | 7 +- src/content/docs/reference/cli/workspace.md | 441 ++++++++---------- .../docs/reference/security/known-gaps.md | 225 +++++---- src/content/docs/reference/security/rules.md | 9 +- src/content/docs/reference/status/index.md | 160 +++---- src/content/docs/use/dashboard.md | 2 +- src/data/features.json | 33 +- src/data/figures.json | 32 +- src/data/pricing.json | 4 +- src/data/reference.json | 6 +- src/data/shots.json | 4 +- versions.yaml | 4 +- 47 files changed, 1271 insertions(+), 1133 deletions(-) delete mode 100644 src/content/docs/reference/cli/trust.md create mode 100644 src/content/docs/reference/cli/update.md diff --git a/public/openapi.json b/public/openapi.json index 3bc7206..2faa843 100644 --- a/public/openapi.json +++ b/public/openapi.json @@ -7866,7 +7866,7 @@ "SignatureService" ], "summary": "ListPendingSignatures", - "description": "What the caller is asked to sign: their keyring when their keys changed, and the roster of\n each team they own when its members changed.", + "description": "What the caller is asked to sign: their keyring when their keys changed, the roster of each\n team they own when its members changed, and their settings when they or their projects did.", "operationId": "spin.v1.SignatureService.ListPendingSignatures", "parameters": [ { @@ -9903,7 +9903,7 @@ "WorkspaceService" ], "summary": "GetOwnerWord", - "description": "A workspace's newest access - who logs in, consent to collect logs, the settings approved -\n with what the next must say: the people the owner invited and the settings the guest would be\n handed now, for the owner to sign. Its owner's and its guests' to read.", + "description": "A workspace's newest access - who logs in - with what the next must say: the people the owner\n invited, for the owner to sign. Its owner's and its guests' to read.", "operationId": "spin.v1.WorkspaceService.GetOwnerWord", "parameters": [ { @@ -10522,7 +10522,7 @@ "WorkspaceService" ], "summary": "ListAgentThreads", - "description": "The agent's threads - T3 Code's chats - as the workspace's supervisor last reported them,\n which it does only while the owner's access consents (collect_logs). Titles, paths and\n times, never a message: the chat itself is read in T3 Code, over the owner's own session\n (`spin agent`).", + "description": "The agent's threads - T3 Code's chats - as the workspace's supervisor last reported them.\n Titles, paths and\n times, never a message: the chat itself is read in T3 Code, over the owner's own session\n (`spin agent`).", "operationId": "spin.v1.WorkspaceService.ListAgentThreads", "parameters": [ { @@ -13400,6 +13400,11 @@ "type": "string", "title": "workspace_id", "description": "The workspace the name was decided about, when allowed. The proxy pools connections by\n it and opens sessions for it: a name is freed by a rename and taken by someone else's\n workspace, and a connection pooled by name would carry the next request into the old one." + }, + "sessionRefused": { + "type": "boolean", + "title": "session_refused", + "description": "The session asked with is no good here: it has ended, or is another workspace's. The proxy\n drops the cookie, which would otherwise be sent and refused until it expires." } }, "title": "CheckPortAccessResponse", @@ -15886,52 +15891,6 @@ "title": "owner", "description": "owner is the workspace's owner, with their keyring as it is now: who signs the next. Empty\n keyring for an owner who has signed none." }, - "dotfiles": { - "allOf": [ - { - "$ref": "#/components/schemas/spin.v1.DotfilesConfig" - } - ], - "title": "dotfiles", - "description": "settings are the startup configuration the guest would be handed at its next registration:\n the owner's settings after the team's policy. A word approves them by their digest, which\n the client computes from these, as the guest does from what it is handed." - }, - "defaultShell": { - "type": "string", - "title": "default_shell" - }, - "env": { - "type": "object", - "title": "env", - "additionalProperties": { - "type": "string", - "title": "value" - } - }, - "editorSettings": { - "type": "object", - "title": "editor_settings", - "additionalProperties": { - "type": "string", - "title": "value" - } - }, - "taskfile": { - "type": "string", - "title": "taskfile" - }, - "egressRoot": { - "type": "string", - "title": "egress_root", - "description": "egress_root is the installation's egress root, PEM: what the guest is handed at registration,\n and trusts only when a word names its digest. A client names it only once it has held it to\n the root it pinned for the installation, never on this answer's say alone." - }, - "identityAudiences": { - "type": "array", - "items": { - "type": "string" - }, - "title": "identity_audiences", - "description": "identity_audiences is who the installation gives identities for, empty for anybody: what a\n client offers its owner to name in a word, which a host holds every token to as well." - }, "teamId": { "type": "string", "title": "team_id", @@ -15962,30 +15921,27 @@ "title": "role", "description": "role is the caller's: \"owner\", or \"guest\" - who reads it and signs nothing." }, - "repository": { + "ownerKeyring": { + "type": "array", + "items": { + "$ref": "#/components/schemas/spin.v1.SignedDocument" + }, + "title": "owner_keyring", + "description": "owner_keyring is, answered to the owner alone, their keyring's signed versions from the first:\n what their client holds the key an access is signed by to (roster.VerifyKeyrings), rather than\n the control plane's word of whose key it is." + }, + "standing": { "allOf": [ { - "$ref": "#/components/schemas/spin.v1.RepositoryConfig" + "$ref": "#/components/schemas/spin.v1.OwnerWord" } ], - "title": "repository", - "description": "repository is the one the workspace opened, part of the settings a word approves as the\n five above are: unset for a workspace that opened no project." + "title": "standing", + "description": "standing is the access a host lets people in by: the newest its owner signed with a key their\n newest keyring lists (ownerword.Newest). It is word, but where the key that signed word left\n the keyring: then it is what the next access is built on, which the client holds to\n owner_keyring before it does. Unset where no access a key of the keyring signed stands." }, - "prebuildClaim": { + "checkoutPath": { "type": "string", - "title": "prebuild_claim", - "format": "byte", - "description": "prebuild_claim is, for a workspace opened from a prebuild, the claim the host that built it\n signed (PrebuildClaim), whose SHA-256 repository.prebuild_claim_digest is: a client verifies\n it, and that it names the repository and the commit the settings do, before its word approves\n them." - }, - "prebuildWriters": { - "type": "object", - "title": "prebuild_writers", - "additionalProperties": { - "type": "string", - "title": "value", - "format": "byte" - }, - "description": "prebuild_writers is the record of the claim's writer, by its id (writers/\u003cid\u003e.json in the\n installation's store), which the client holds to its own anchors as it does a launch claim's." + "title": "checkout_path", + "description": "checkout_path is where the workspace's project is checked out (projects.CheckoutPath), empty\n for a workspace that opened none: where its agent works unless told otherwise." } }, "title": "GetOwnerWordResponse", @@ -17963,7 +17919,7 @@ } ], "title": "reported_at", - "description": "reported_at is when the supervisor last sent the index; unset where it never has - an owner\n who does not consent, or a workspace that ran no agent." + "description": "reported_at is when the supervisor last sent the index; unset where it never has - a\n workspace that ran no agent." } }, "title": "ListAgentThreadsResponse", @@ -19637,7 +19593,7 @@ }, "title": "OwnerWord", "additionalProperties": false, - "description": "OwnerWord is a workspace's access, as its owner signed it with a key of their keyring\n (internal/ownerword): document is the access as framed JSON, signature the key's SSH signature\n over it (sshsig, namespace \"spin-access\") - what `ssh-keygen -Y sign` writes, so a FIDO2 key\n signs one through ssh-agent." + "description": "OwnerWord is a workspace's access, as its owner signed it with a key of their keyring\n (internal/ownerword): document is the access as framed JSON, signature the key's over it for\n namespace \"spin-access\": an SSH signature (sshsig) - what `ssh-keygen -Y sign` writes, so a\n FIDO2 key signs one through ssh-agent - or a set's (sshsig.SignSet), one passkey prompt over\n several documents, which ssh-keygen does not read." }, "spin.v1.PageRequest": { "type": "object", @@ -19758,6 +19714,12 @@ "type": "boolean", "title": "deferred", "description": "deferred is a document nothing asks for until the person uses what it gives: the roster of a\n team that has only ever been its one member, read only for an identity. Offered there, not on\n every page." + }, + "previous": { + "type": "string", + "title": "previous", + "format": "byte", + "description": "previous is the version this one follows, as kept, for the client to show what changes\n against it; empty for none." } }, "title": "PendingSignature", @@ -20056,6 +20018,12 @@ } ], "title": "built_at" + }, + "workspaceCount": { + "type": "integer", + "title": "workspace_count", + "format": "int32", + "description": "In ListPrebuilds: the workspaces opened from it that are not deleted, whoever's they are." } }, "title": "Prebuild", @@ -20211,6 +20179,12 @@ "type": "string" }, "title": "shared_team_ids" + }, + "readyPrebuildCount": { + "type": "integer", + "title": "ready_prebuild_count", + "format": "int32", + "description": "In ListProjects: how many of its prebuilds are ready to open from." } }, "title": "Project", @@ -20678,59 +20652,6 @@ "title": "RemoveWorkspaceGuestResponse", "additionalProperties": false }, - "spin.v1.RepositoryConfig": { - "type": "object", - "properties": { - "url": { - "type": "string", - "title": "url" - }, - "ref": { - "type": "string", - "title": "ref" - }, - "path": { - "type": "string", - "title": "path" - }, - "authorName": { - "type": "string", - "title": "author_name", - "description": "Who the checkout's commits are by: the workspace's owner's name and email as the installation\n knows them, set as the checkout's own user.name and user.email - the push goes as the team's\n app, and the commit says the person. Empty is neither set." - }, - "authorEmail": { - "type": "string", - "title": "author_email" - }, - "commit": { - "type": "string", - "title": "commit", - "description": "commit is the one a prebuild's build checks out and runs create at; empty for a workspace a\n person opens, which follows the ref." - }, - "fromCommit": { - "type": "string", - "title": "from_commit", - "description": "from_commit is the commit the disk's checkout already is, for a disk cloned from a prebuild:\n the guest holds the tree to it (git fsck, no tracked file changed) before it fetches." - }, - "prebuildId": { - "type": "string", - "title": "prebuild_id", - "description": "The prebuild the disk is a clone of, and the SHA-256 of the claim its host signed of it\n (PrebuildClaim): what the owner approves when the open was from one." - }, - "prebuildClaimDigest": { - "type": "string", - "title": "prebuild_claim_digest" - }, - "pullRef": { - "type": "string", - "title": "pull_ref", - "description": "pull_ref is a pull request's ref as its forge serves it (refs/pull/\u003cn\u003e/head, GitLab's\n refs/merge-requests/\u003cn\u003e/head), fetched once ref is cloned and checked out as pr-\u003cn\u003e or mr-\u003cn\u003e;\n empty for a workspace that opens at ref itself." - } - }, - "title": "RepositoryConfig", - "additionalProperties": false, - "description": "The repository a workspace opened, as its guest clones it: the project's URL, the ref the\n workspace was opened at, and where on the disk it goes (projects.CheckoutPath). Part of the\n settings the owner approves, as the environment is: a disk is written to only as its owner said." - }, "spin.v1.RequestHostShellRequest": { "type": "object", "properties": { @@ -20899,6 +20820,12 @@ "type": "string", "title": "host_class", "description": "The host class its workspaces run on (HostClass)." + }, + "agentMinMemoryMb": { + "type": "integer", + "title": "agent_min_memory_mb", + "format": "int32", + "description": "What a workspace has to hold for its agent to start there, in MB, for whoever picks a preset." } }, "title": "ResourcePreset", @@ -22091,13 +22018,15 @@ "enum": [ "SIGNATURE_KIND_UNSPECIFIED", "SIGNATURE_KIND_KEYRING", - "SIGNATURE_KIND_ROSTER" + "SIGNATURE_KIND_ROSTER", + "SIGNATURE_KIND_SETTINGS" ], - "description": "- `SIGNATURE_KIND_KEYRING`: A user's keyring: the keys that may sign for them (roster.Keyring). Signed with a key of the\n keyring before it; the first, and one started anew, with a key it lists.\n- `SIGNATURE_KIND_ROSTER`: A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by\n an owner the roster before it lists; the first, by an owner it lists.", + "description": "- `SIGNATURE_KIND_KEYRING`: A user's keyring: the keys that may sign for them (roster.Keyring). Signed with a key of the\n keyring before it; the first, and one started anew, with a key it lists.\n- `SIGNATURE_KIND_ROSTER`: A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by\n an owner the roster before it lists; the first, by an owner it lists.\n- `SIGNATURE_KIND_SETTINGS`: A user's settings: what their workspaces apply - dotfiles, shell, environment, editor,\n Taskfile, each workspace's own environment - and the repositories, by URL and ref, their\n workspaces may clone (ownersettings.Settings). Signed with a key of their newest keyring, never\n a session's: a host applies nothing else of theirs.", "x-enum-descriptions": [ "", "A user's keyring: the keys that may sign for them (roster.Keyring). Signed with a key of the\n keyring before it; the first, and one started anew, with a key it lists.", - "A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by\n an owner the roster before it lists; the first, by an owner it lists." + "A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by\n an owner the roster before it lists; the first, by an owner it lists.", + "A user's settings: what their workspaces apply - dotfiles, shell, environment, editor,\n Taskfile, each workspace's own environment - and the repositories, by URL and ref, their\n workspaces may clone (ownersettings.Settings). Signed with a key of their newest keyring, never\n a session's: a host applies nothing else of theirs." ] }, "spin.v1.SignedDocument": { @@ -22116,7 +22045,7 @@ }, "title": "SignedDocument", "additionalProperties": false, - "description": "SignedDocument is a document as framed JSON and an SSH signature over it (sshsig) - what\n `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent, and a passkey's\n WebAuthn assertion is one too (internal/sshauth)." + "description": "SignedDocument is a document as framed JSON and a signature over it: an SSH signature (sshsig) -\n what `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent, and a passkey's\n WebAuthn assertion is one too (internal/sshauth) - or a set's (sshsig.SignSet), one passkey\n prompt over several documents, which ssh-keygen does not read." }, "spin.v1.Snapshot": { "type": "object", @@ -24476,6 +24405,22 @@ "type": "string", "title": "suspended_snapshot_id", "description": "The snapshot it was suspended into: its next start resumes it rather than booting its disk.\n Empty when a start boots the disk - never suspended, resumed since, or the snapshot deleted." + }, + "fromPrebuildId": { + "type": "string", + "title": "from_prebuild_id", + "description": "The prebuild its disk is a clone of; empty for one that opened with none." + }, + "agentMinMemoryMb": { + "type": "integer", + "title": "agent_min_memory_mb", + "format": "int32", + "description": "What it has to hold for its agent to start there, in MB (the supervisor refuses below it)." + }, + "projectError": { + "type": "string", + "title": "project_error", + "description": "project_error is what its guest last said went wrong with its project - the clone, its\n .spin.yaml or its create tasks - as the guest said it; empty when all of it went, or nothing\n has reported. The next boot tries again." } }, "title": "Workspace", @@ -25223,6 +25168,10 @@ "name": "SetupService", "description": "SetupService handles initial platform setup and admin bootstrap.\n Most endpoints require admin authentication, except GetSetupStatus and PasswordLogin." }, + { + "name": "SignatureService", + "description": "SignatureService is what only people sign of themselves: who a user's keys are, who a team's\n members are, and which settings their workspaces apply. A host holds every workspace's access\n and settings to these (internal/roster), so the control plane can say neither which keys are\n somebody's, nor who is in a team, nor what a guest applies for its owner. A workspace's access is\n signed through WorkspaceService.SetOwnerWord.\n\n The control plane proposes each document from what it holds - a key registered, a member added -\n and keeps what was signed; it signs nothing. A client shows a person what they are signing and\n signs it with a key of theirs: `spin sign`, with the keys ssh-agent holds, or the terminal's\n page, with a passkey." + }, { "name": "WorkspaceService" }, @@ -25230,10 +25179,6 @@ "name": "ShareService", "description": "ShareService manages snapshot sharing\n Snapshots can be shared with specific users or made public\n Users can create new workspaces from shared snapshots" }, - { - "name": "SignatureService", - "description": "SignatureService is what only people sign of themselves: who a user's keys are and who a team's\n members are. A host holds every workspace's access to these (internal/roster), so a control\n plane that is taken can say neither which keys are somebody's nor who is in a team. A\n workspace's access is signed through WorkspaceService.SetOwnerWord.\n\n The control plane proposes each document from what it holds - a key registered, a member added -\n and keeps what was signed; it signs nothing. A client shows a person what they are signing and\n signs it with a key of theirs: `spin sign`, with the keys ssh-agent holds, or the terminal's\n page, with a passkey." - }, { "name": "SSHKeyService", "description": "SSHKeyService is the user's own keys, as a registry: the ones a client offers when the owner\n signs a workspace's word (OwnerWord), and the anchor a create may name. A key here logs in to\n nothing on its own - only a key the owner's word for a workspace lists does, there." diff --git a/src/assets/diagrams/egress-policy.svg b/src/assets/diagrams/egress-policy.svg index 00e1e19..dafce86 100644 --- a/src/assets/diagrams/egress-policy.svg +++ b/src/assets/diagrams/egress-policy.svg @@ -4,193 +4,260 @@ - - + + egress_policy - -What the forward chain decides, in order + +What the forward chain decides, in order in - -a packet from a machine -iifname veth-eg-* + +a packet from a machine +iifname veth-eg-* node1 - -1 · ip daddr in the node's own space -    10/8 · 172.16/12 · 192.168/16 · 127/8 -    169.254/16 · 100.64/10 · 224/4 · 240/4 -    + every address the node answers on + +1 · ip daddr in the node's own space +    10/8 · 172.16/12 · 192.168/16 · 127/8 +    169.254/16 · 100.64/10 · 224/4 · 240/4 +    + every address the node answers on in->node1 - - + + - + -tagA - -2 · ip saddr @tag_<name>  ip daddr <allowed> -    what a tag permits +agent + +1a · ip dscp <agent's mark> +    an agent's packet: only the egress proxy +    stands in for what it may reach - + -node1->tagA - - -  no +node1->agent + + +  no - + dropped - -dropped, and counted + +dropped, and counted node1->dropped - - -  match + + +  match - + -tagD - -3 · ip saddr @tag_<name> -    and nothing else, when the tag says so +open + +1b · oifname wan0  ct state established,related +    what the machine already had open - + -tagA->tagD - - -  no +agent->open + + +  no + + + +agent->dropped + + +  match + + + +held + +1c · ip saddr @held +    a machine taken back from the last runner, +    until its record says what it carries + + + +open->held + + +  no - + allowed - -accepted - and recorded in @observed -machine . destination, with a counter, 6 h + +accepted - and recorded in @observed +machine . destination, with a counter, 6 h + + + +open->allowed + + +  match + + + +tagA + +2 · ip saddr @tag_<name>  ip daddr <allowed> +    what a tag permits + + + +held->tagA + + +  no + + + +held->dropped + + +  match + + + +tagD + +3 · ip saddr @tag_<name> +    and nothing else, when the tag says so + + + +tagA->tagD + + +  no - + tagA->allowed - - -  match + + +  match - + dflt - -4 · oifname wan0 -    the default: open beyond the node + +4 · oifname wan0 +    the default: open beyond the node - + tagD->dflt - - -  no + + +  no - + tagD->dropped - - -  match + + +  match - + home - -5 · iifname wan0  ct state established,related -    the way back, and only for a connection -    a machine opened + +5 · iifname wan0  ct state established,related +    the way back, and only for a connection +    a machine opened - + dflt->home - - -  no + + +  no - + dflt->allowed - - -  match + + +  match - + lat - -6 · veth-eg-* to veth-eg-* -    one machine to another, said out loud + +6 · veth-eg-* to veth-eg-* +    one machine to another, said out loud - + home->lat - - -  no + + +  no - + home->allowed - - -  match + + +  match - + lat->dropped - - -  match + + +  match - + policy - -no rule claimed it -policy drop + +no rule claimed it +policy drop - + lat->policy - - -  no + + +  no - + note - - - -Why this order. -1 is first because 4 is what would otherwise carry it: the -node's LAN is reached through the uplink like everything else, -so a drop written after the accept never runs. It matches the -destination alone and not the pair of interfaces - what is kept -away is a place, not a path, and a rule naming wan0 would stop -applying the day there is a second way out. -2 and 3 are between them, so a tag cannot open the node and a -tag that closes a machine is reached by what its own rules did -not claim. -4 is open on purpose. There is no allowlist to write yet, so -the accept records where it went instead - see @observed, and -`SIGUSR1` to the runner. + + + +Why this order. +1 is first because 4 is what would otherwise carry it: the +node's LAN is reached through the uplink like everything else, +so a drop written after the accept never runs. It matches the +destination alone and not the pair of interfaces - what is kept +away is a place, not a path, and a rule naming wan0 would stop +applying the day there is a second way out. +2 and 3 are between them, so a tag cannot open the node and a +tag that closes a machine is reached by what its own rules did +not claim. +1c is after 1b, so a runner's restart cuts nothing a machine +had open, and before 4, which a machine in no tag set reaches. +4 is open on purpose. There is no allowlist to write yet, so +the accept records where it went instead - see @observed, and +`SIGUSR1` to the runner. diff --git a/src/assets/shots/snapshots.png b/src/assets/shots/snapshots.png index e8f88464ab888b7745081982a4e11c9a2632b47b..94676e6bb869ee1da8731dfce11a0c0fc738653c 100644 GIT binary patch literal 59144 zcmc$`bx@p5@IS~KAS4hVxI=m{M9wj?mW{yJu}^(?tX$5#<~@w0h@gsF>cJwij`Gwq!ijHXcn|V>F=n*RkIL!fem^joCE#UGeK6_JGsZI# z;U7B!GvqaBAKO`(-m<)tW@R0NBl+=;m6})u4jvw@^Bch%tIyvE`kzr0&;qi*b3Qgf zLu(yJIIkBVkcRu_?bPC>$w?8IbR?>A#&G)z(wBL>w3D@6;Xf1%j0)i^!oPIp+546M zy5j<25dP8yJaAwBk^-9_fBo~9rbYb+vX*{LKA(jJ+~1dEa$L%M7j_Apl#&!CYoM@=?(4J87VF}iyhjJ>XNy`I zn7_BiZzs%D&}ZcJcuWXbugL6k7o1RkKH;@noa(a256nT29Ey&`2c9@DsM$!pqB~~jU zy`8{of!w~ce6EKb5U=DKqG~+p$bQQNfTbjnn?Lz!HM)Lw7OI%z`I<2i@?TK zlPCQE-PFW+^3;36vXxi=t;#QLluaIY z4aD#*V46H)WnXCg*rcjM$>%NVJ7szU2M!WrU}yg_QQfHIExfd}5_$DVlLwVS)cG7i zBg2i`z)f~)C5-XyYZ z8cs|B+2XYf_00WKjTcRl+VW6&8NGU{RYGZ*YXjXNYlHp1@#iw{;{$8laAP zs>(J?d}3?xOu==b`Sr2Mjy54gMWdC3n0+}|G-zal=E)-<+}|FS|N51F=gRE79d7%Y zrBa7a{@~Wnz#A>SHa4bjvWQO$jT#*$-9hnQc*s}{IN*?=tWvf>l@s`P!|$(rS-2(g zkcGTbfLh9;#$7Wa@7QPBHKJ&-Ft>2jdT|E@YuSg;u+jL>U+MRc)>IQ)ln7?t=PJ$B z@e_JLw}%pDU;kC{6((NE@504p^Y2Y26AM-1_9oy$SwxzSJN`t;7sI`5iZAV_K4C}03`>2QgsU6qMQ1A$u z{+pecU6&>f<|6AX!+A^SJK{d-Ae|i&%}K3P&f#{$iwz$YkDQ&aCzG<8O2d|n($74~ zlJu3S)mxBqJXq~BRU^M)!dn4etKFKM{cW#mM(KrUUz_u#fMcPaDlo~r^oFvZOlE!Q zp2hm$MGR)%6NS9p+!K8cREkk+6{q!9f|h1r>4P$pfql%f)6tL>Dg~6zh#`5A!<&*EY2YFR1`(EF2lUP36#@K{0_5dV6cM zVY=J?VJzfpsq|IN2uYEIRUaM_4npqF!=$EIr4u^0c74cd|5Ph4cAac_%6#Q%Pg1K6JY?5VEhVz}=8e2xww`Fp6idB}f35cdw} zOCT`H*c;%drfJA3%>j2=D3MiapJ{uVaqVqTI5SsEY1!x8O@!=;-O|@o;iSmnm?PsF zW|l5bVU-8Gwpum?P=Dm)rlR9r9}(u>BA(wT!p5*!Y;yX(-M+idJG(B9tJ*js_ld`G zuhJ|wCj4B0v{}cf^Mg8c#$0OvhmY3H z>YHJ+B5a#Z|2nxm^R;{?P5aV0fd!%52s>Z*sBKIk^}XX~<;k-jOrrr43)*W>&5Bw= zn8?{$qS*1@AW6ayur6=DiP+#)!uZzdXVNH*+{E{OIR*M|v{rGXje;}_%_fI^h_874 z5P3Xn4}8%&n6lpf5hqU;)j^wm1ksYnw=&?*x#Uz*XOU< zR#1W^BV#93lnB}!$O$OdI?5((j#tkL(tLAXCFcNULJs8NIT>q7pAm2Q#%ZA3eeCVW zs6}zPj{RIorYW;iCX3JZ^Tb=T=F{1$Z%sS^pWO!fK=6@PrAeocEDL=GYvn7{Yy(1R z{tK!grLf(ak51u!Jz!lb>?x)!;y`H_ECY^2T@ZKv_YI#_zSbkLHL zCG?#Kd;V_aNWt(B<)2gzRZ=Q;yL)B9RF%UUx(#afRq?DvyX=Kb$;o%LMJhS%xDGYk zb$1JBRn=3k?Jo|j0%R@$p%WR_Y@H?Y3HdRxA&BRU>b<#s!&@js<2;C>vCU7V|K7$u zheLt>vrP-Q9+*yGVg%9tLq?#Geq0v24&rxL={o}W1m9P`>S1+h3>P`iX2up689U_ z|LjM`k{5$4J3l|aXFQ8|%j8j?Ps{Sp2R}q@ znd{SBVz~K2PKeFAW?f#@;^mvan+u$twEG=V|KboDCR?1mFeqtmZ|ZS(GM3+ zO{1IQuq{vBsF{N$md9ig{u^TN$lBnabX)#zqC;q1*>Wrs>X0bQmP2(6Sf|XMo$|pd zxQ~3KdouLF!WCA_TrmlIW+q6?xQIa}G(r|aPI{*UO7a4`09m`rW1S0~z+(1tHHQad zrE!u{Yb{IeUbA8E8HWy<--;s@?*%c8EUpvDgS{NR41^FJZaV$8_xXoRabqSiyAH$T zX>D`IST6$`1~c}oigfi;9mx0Wd<4cmCun*d@$h!dd(UTRD$vA_4tn6+08=c{lRo6> zKK`*<1XN!xj?#H98v`8>Ks>Za|V_O>-1|Sbb7^f%g60+}-@l z_7-NWWc@|xrjsKAds^>}Ia-CNjbl8Veb5J%r{XkouFysLg6K-%A=Pi8g(I~H&sgRbs2vk!dsaAH(&JV0GaaI&lv1%F)^h*B(3k^O7 zXyWhp7Dd;3k+??Tn8o77P3~Y-Pc9bl-J5wBM0|z0mYVd++HQY_+d~u7I%rH}T~b1Q zd{~Z~ME!SpGLv6iq@7qT5{GRU<$G>qn=?9efZbPZbS;`bJ)jx6lv8)L&J35a3R zLH-=tfxQD~j_^RR3!x}(n_J@H_l~~p0bTkFOn7U0WG%X=ll3|;@3gH(ds_JnL}OeO zcCbYFEKT)i7DxM_0`y!!hgUee1$VUqAz5;(mZmrkIHC5oiLN*($IB8p9(fE z7Fs|#2MwU&*YdJ;-`m{~{&3^n9t?9^t9Nx%RBIQ9iju5(mdd8k`;z<7)iyzDqP-qu zoqxqAU|cv)o&zI4GgxSNf1!BKbTpg8Jbp1WxZ|I+Tla;hD~uo+HlU)Ig(bA6o`=3m zX+5j9n+>pyRi_q(#IU6|Q&quY&QI+J?nz@EbB=FSUL30@Z)v(S(DH~_n06Fe`C)Fu z`psU}aY0B)RYy_&u@&6(;Sn1;rX(EYR;*_an~*$ykgb)ZvzRzAMKeNIV5X<8wU958 z#aD9`vTz=PspNUun?IY))rDbv`NxedpuAXtaf74nK82FtQ9a$b5AK)okP|GLeU`s> ztHrbZUb~hTfj6R(PJ?Tbzq~N^W7t0VShLY$D#Y5a_rmIxuMT~|g*H)f*4U6PEDut< zOa9rGgHIF%^?z7E(Y3hed*PgksX4Ol*Gm6HX@}Sl%%F;UDv-VpV%6OmbY&UOjq{}(?WE{_R()d2ujbRJ29m(5E*5|~9M;rE z!&j@^=gOh4I6dD!QF_(*TI~D4i0eJYZDv?|JNpggJCiITnWnZXT&NlyP!-pCoVUJz z-5i<)2hh}dsD%Zo2$zQfT=MP zjwL^^TGz+|wxg)G!LPbyPvT~$rW_tabtOfjf3O6IUaOSLK>ZA*HeAbSSo_~V`~4(y z(t8PvAFAWBPPZvS;HQ!*eCXE4E&nxRoJ8Hm;a|y*3A?xfuS97ZS04i=95EI%6`(@a zV+!Ei3{9N3-)Z-4P$OEa7*$k53pK=gM1h~u=2(_PLV`2ymvUbKw8#=E7ikS~L-)B9 z0%bvAYcPm^=KLs|>uHYHUAaoSv$J>5GC4BR;Ju&DPXN!JfR+m<(-zlY>iYU{78@!* zC#mDA8kO;zL({;K&FJW`g0#1VqL+6%1jptWlyd~5SeJeNG!R&hEnNyLj#j)-o+0Nq zPNAotwJRB{fVpe8;0|kSLb(r=a?iSj(&VLYohfKit`LcE23^Oa=g`vg?l!r}r>%Q;RS?am5}i6A1+x0poct9rX@?^_oiWL4+%BBULUj z9%5dTnPIZdfxZaK68Tn$fKs*TzP-Dk*!EU)oc=_)z;g$I5wzb!TkW&?2qd+9uq6|Kg%S_fpSlU7pvVS3`Dl;$m zSct^cF+YO1XDnE_Y*n3O+1po+rQF$7L4>2=hrcP~nAP&>M$#UWY#L?ByYycZHbaKS z<|V?WTJ=q<#!BAJuj(j0X*X1Q4ZUfH*nSNq%Ke`8O9Lvoy4xk99%KL*TC4KZrEe$o zrID1!MS+CZl3qtK`BSH5&|U8ei> zGt0NKx(sND)r<3!T&6++BY_Md)KA795p{jBWjGGiK3 zXICDHEOW+cSa<7+C{!L^5xoYcSq84aW#ki7&ly=LR!a zmTGxcs~!vC7p9k3Y0I*{aBc9) zhG^2iu=+^-%d+E{umvGni+I#Mt9c4TL|Ze4xd2?yXX`QsHPtkX)|(F7Z02I4N}%Ak z?sQ?%&dx!NlpR#Zni$h=1YhYRlQ_L5!OxaS=Xabx!4^@PQ6R zMj@-T<|*te!$i$_cWazJkM3jo&!*Fz-;WJBD5!~_ACEgvv-G{sP8GiGbna5LPO3>uTeO2 zu!4Y@D`cQxB3R+W*yPLv>$DA2F=+S8m@N0B8@m2f;A>TK?*^*@JkiX6L*~cxAp*V( zj`7Nd1mUG4WbNUg;C{n*r*n3sEa%6wD^XVC$m5pc>aE5-EIY>+M|^z$UcujSI)*Hw zp1r4Ed(_KKb^$mcr4V5i>Uk~vZ^hVYUv97E?R)zB{Z*uvTRcku*!rGN_TTL1)T7+< zm~U@5^xd6AohU~<;kHz%Zn>7P*-dfhWK8yrWuwlfhB z&yKdU2;3O8_hd667lFuiH^A$I#ZJpz^v7w|{I1XF6;`6D17V}^GF*$!i$&A$P7&w* z;lm-m|Pa&?4-GenlsuWi(m-VW;8mJ^0{_M!|svfYjN z(mnH!%Zy3kuF1XU5ymFX*Pfx4txr#@n!(kUqPQm0J=iC3{8WQq?pXscylYqK0$v;L zQu#3??2Jqpge0DXjS}t{!+_G)%O%aL z`FX_KbI0L~XH7F%_5}u+FjHIb*(lsOdLQRfUBmi`UPe2cfd0h|AMx5Q<+F%nQiEU7 z994+NWS!b>oOT>~Q-^^un+v<|!i9wxV(yK_Pe0+z@=GPl zAX9YD5eidEaWSSM!uAIsK?pzx+yk>BkLl6_e|`Jy(zXq7TIckYGuaygnk_0eUxACno~#yL}`sX;} zls&sO_I0+)Hh?5MR`VZqAQ?&!deun!@y|uGPI6N*BSx6lhBUjxxU)v zsh_Q$ZA~jTQqs>g(Dnyw|KLz;8wqUmxc8N7RsUe4ynX~suHTawv@T;o&r+pwv7MD9 zfb_gfk!?(ICJ)imr|nr^&K*e{=`w}@y8O!SQsRoY{BiC57H8EL3UF9@xGzrB68!j z9!EcLyRL(y9-|q5Xupo+X+*c_+RZQ|Wvng?l5PUIqclB7K4-$Gkj*<~xTh9=!o5QJ zv3y;gwL~+bKW(S}9~MC2lio@lP!UuXr^^05zuRyVP?DS%=Z`g%aF zQ}s%5CB;#Xg>8VIdQ*c$`)jG9($Hs)TBU@v5ngV7@aMXgk@wn=QG4Iz4KsF?w_ZGn zwY2I&n6LsRk}coaCMUy!yrlbYK8t>^veNV6avb|{s&99X&P?kaw|k%R%r#P>sMWM8 zgNJ7!q~w*MXW$^As7+y65R8S^^_X0tAA_@JZt#f#HS*qFS+S$}l=4^|`KVqG%~7DB ztOKGGPh7~aZ)d#Ob}p&v8iW`fa!cBNn$BmKPj~5S_YezELJsfe_0se4R%oq%6__s@ zAwB<9xtinRoail1u5kBl+1-Zc9tW;-;j*j67kg*yJc{jLWPNw{x!TcF*o^*>@{88W z{JSB|8lHMvN6=H{{zDTIyq+P?j?;XqCJU9UC%?@IN`kt0HNC;X4sUeBr&FWTS1DQe z**`j~r3NH(KC#8x+&?=03_uF5z`<2!7iWzeqf{2-cGv$pTN}1AY||=Spg#txdyOD& zgc&Vp8@3g6^!gt-bACTByqKTEGv&k$ADlYG>2YY>=i=6)bs^V>VGFq+&`p%SqN3!B zaNpf4juaP*I%2~OWt<; z|6Hm6zImODK&&U+f{&OKcRjVMC)y#nD^`BG!hAwEK1LXISD|CFYPlv@?%U{!iru@UqP>Qh6oLLbFQ<*bagG6@AOf=( zDxh!iEDs#FV`!CWD6_|?K2`VR%TUJ8_|trc8Nq_RRpofVqU6mpr}d`hn1J^F*L3z! z%j?oInm!3f&1dKx`e8#1(Gu&+}$C@S{}Vjw3+qHhw{Hltp? zx)*6T_{dbv)a?H8C!14lF}(EHwrC%Uc`r9Ee$+^E^#P=Jh2~&B9wv~~v{$hE;$$++ zw^(n>7A4s2LgFypZk^SD5HD7~_v8qw*VV1*;7o4lFeFU!KXtzEH?tfMzu#5*_bLqg%*({wtedPt zUTXb8Y{+yUD@k!+N!wFvj36S!M#MJJyw5F6N~1%a3af-te&sY{!Gl5;<5XB7cIQ<+!WD^ z3n~y|q_&_ar_-FUFME*4MS6|quKRXua&mN%#CY_Yk^^Jy0-H zPGG?~G|?z17lyo}q>CKS1;A$sz4|hJ66wWxm=>Svai*i@Vz4sVxp8>!5&@~x0MgSl zC9qj+JIQOa&c<`?n|`+Tq>LmPB4=bln%GL0TjvO4-#ZMI^-M+(TWoNA zmgRT2sFTF#UUKK`U6|}0%`7a`?I9&2ATeF1=+hL95$$0XS->OK5d%SwIsj%Eu}AN{ zr~M~p5{Fkan)uUY@e?^AYcU0>{^r4&qFwDomS+YMzKM(s1AVkH5k{9D;+M5>?IF$l zJ<4IN zOfy+`6Jk90r9-zw!+bvJV#kzgyh9etFfb-y`(gj=_P&DIpz2nLw)==R;cFgBWi?QrQ^}=JS z3HyN-B=_au$D24Fn-0v6{#vBi%ln#CaZ(wD-lgHXTY-ZEnwZKmo-Z;*W}or$3w8aq zhG%VC^*jHh*)PO~oE{HCv)djYg9FjoiO4LH6SxS(HDeCaImPhJH#e2BEx^(*R!?qi zsPnIXmWG98fQpPb|VZ=T_wHpjBa(+O@8FT1{zCQ&$!7%n2-7CN!)aJGg!< zDzbRGKTLJjNdj$$Y ziH!0~)ekjZRIbho1p)1~vYGtNu-S9c2VNUA?eDQ*C|G6EdN|}Wl5ncN0b~ZukWOo= zn?oPAz`S$gZIRCd;!ln#IRpnY+oe||wDkR7(p;{ibU*DWQACDvjy7_F$%ljZk{K-& zCb6-j9^T2~E-DZbt(-4KXhn|7+9MdCkObW_d~yqZrcUv`rTiUWVuUl)4d0+JBzx-h zPTdLk5v2b>)_SZRqub(Am$>p3k88ph4fIsUKOm)TI+}@!XTcnj!{6q)lhSyZ1dnBk z*grB6hSQKTzh^Pa#oaSfjeCZhAiJ3WQEj3tcq5^Y?A%ykq90$;Qnj`CU4l%J^GEfR zVXEhr6>nmy3+?J?%Y?Cvw0J1HdN?kuZnL#0sP>rKx#9DA0#Tn37{pO`8c3pCH1^ssNe+;zM>W%DXR z&FcP?p;40wt@RCkH>4Wn+Uus)Qp5dTQ`%dz)#QFm86;0>^<=gL$sifTqFwwb2CIKn z9%~|UB+;m&_F$^@#MV`28nD@%N_x8alB!iAg?{m5+`*wo((usD6;$Tixvd2>Nq%&z%dLmpF zbK5xntfM&BpDPH=WB@!duJx3W8rm*ZAxgL`%`>Bv}1)%|$x;=iEZ zJ}q(On8f5K0dE{fPt(rtGWclN1KWil6Cs_smLFNPQSqGiO(Wup7)|ddMciWp@a#j^ z3U=erJ`W|0n~4G8_|{yaC29a1v4`D1P~*G1@=fJWW05bRrOdiXNrHqf)8|;tg|qR9 zoagw`-R8XUZfF#UK@kueTT-@A%Oc7;3!f!cv=M~-BvsFHSd>*FB7;`Yxf`-NKzzt+-4>G`dU2>ByrE)0qg7;-Un-u z;$D0?D>DhYtxv7H`X^;2Tx51GBxn|NiK;5jdL^9Kj~v35k)^as;m|T%2*WeOCsHf% z&eTf}CMFNV+klhZ$=lZ1?kS;qK07l-g?^vwI{&R3FV^F!%Mi4Q)iEErPvaj{E+|ac z$r<+CpY4ET^)uW{ltM_d#nBB6AIB4)BOv-+YtRBS}1faGgxOiMV#Z zvdUj$AjfA{8U8VyDmE-#JILZiEBL{h{_svaqySb~y$6`6Ds3nhw6u0*^xI%@5RIaGI;X5H$v zIZxu9o|PU3c*L??GQ8pelDizHmk2a(K4ou7(`9 zfc=F?6#LdE%9C2%Q4MdmxzR^dqzZSs-3i)tW0vpNliu2yz0)n{Y_fB)vr@dLXut3r zm_a3}@H`WcVS5QWj&hS%cDs)u_rrJ|D(bAeGwyHJc@I*n5wB#nlhpi3v!4{+ZHN9? zXch0tt(J`1&d+-%?fzMP*MDq4%NB)dkeAm=6C#BljY4?^as6i_s|)MU{QS&e-Zpi5 zF#3@j^}seme-{{P>W@9rs12Hgpsf zCr>&MnMlak?Q=NiS?ES|?OUr6>!j_%Up>33mX#$PBWd{jKi?}}p*p@Ijb@yDEo0lN zh#$}5#mk?w*P`b%+=TShhv`F{8Ea3XNxnFbk7Y5#K<()S{+C@=FcY4xYH z?@Qx9uR9ErH?=8ze3} z>9yLi$Qk>beeD@6e^GV%2H!VM0%^V(oC(_c%U;n0*7VkatL(W0aOSIR8C09ty7W0< z7v?XvHwa*qbgO%V=UK6r!1fN!xTR_Ib4jL9jWq^dcYdj(AX6eCwphW-^a?O{eTnEY z_X}3K)SrHwcZR8(AQ6qrCoS=UXc@wgd(@?4u?UsC6Hm_E(?IO(D6{G%n`U2kA z|F6O9m89;;OfwQj@QY_OwWw{h8r{ihG#J%@KS}<-Scdu&MOSEmy(r#uCMPfP zwhe&OQG47=yzM29_&1?{B?`Kj5#3YR<^P^a37tr@J(z;uBetwnN zKbf4I{N|VAs>od)6NB3CWT2G>$BS3b1G!BP-WDR44zHSh^CSuGqL--B+4ZJV1C20( zDZEW|d0baRGP9F;aKgeb0<}@|vk5-sv;U)D{N}}1{VlHF?K=*3!0&bW-TvPc8i3>) zx0S|fnp;!rr#@H%ZqcDD9e@b}0)p11Q%B>t0t!WGUna+SjhE2Xt4t-iEmNhcbyRsXS ziTi%sl?M0kwOawqyu>qYy&rTHRJiPZNz*gNC^7Rcrr9pHocCmyS_PokNaiw==NWzY z^$+dFRT{TG@#3ZIc#As?U?$W=^wIS+g@vE^T5p+8zGgp0M@e7YmVBh9XI`wWt4hex z6iUUFcC?#D!^nq;k*OPC}!#G z3zQne2sEPwNZS2Lb>hZdWr=T`i^JoXG8b%9b52u8$5ToBP|~uT{od7APX5f&A%`@^ zpDf=Rd8^kk!cUYk5q#lD4nM}NOhNWg3$!Qa>}d^I^qxH6ZvnzfIqcO;{uJXeeV&P# zXyh>Z5!+i(pcD~EBtXz?b zr}p)IQWA}t64GnXF?z(7IvPg$j7o-U>bs!v=88$xzA4i@Xn}^il*-`ou4s)@Ok27# zXvjiYMNRJ~{d%+EG*^jlqaD$evk*9FRKsd1s3P=%NM`e8TVNPrx!3Q{BPI zt?lv;5395Y&zA+M6P<5XZtQLO>&x@WJWjbepHk83BEN*WMS7mnwP-oE=I`$A-ID2& z=j|D5=I|T@P1@B1yKEdinupjj)=b#-QZ`c)o26|1H|G1K(w;w3 za?mS_a!Vm25O}z`l-t3iQvR?U+)0)}mtU*Z%)tv%vDzh@@4t*qtE9ZYK4o!i;RIG# zM1!JJBY@%Ck@->!4?;Z0-WPjP6R4_oIPl?9oDZH09T)>~rM=LFYvJ>FvfK!<9COP( zOB((!aoE?fbed={D)H;QRQ(lUN5DJg15lmSA_qMq8}0?_cC&1wc=yPo`SEEk;YX(R zTbc7DBU^z4Opy|9p#`^)j9#qdT9$_`M=94XN>laEx(_Cw&REr*$hR^Ut2o#oA~Iov zP5HMs?}Ss~8#hRw`wi){9Tzyd>eWrVKk@#;vEUB$I4t`z@e|WYDNrYW`^3IrKQFgF zNVum;e9#3%BR$D-rFrd-8imv8g>iYZru7gzYvj|sT-RnLspc`eI;k_W6~nQ)S7lf$ z8vCW>-BtPM5qYSLroR+Hp=umH#xu?$y^(JRjN+2Kq-kg%;3W14Id7-GwjzH8)H}I{ z#+Sm!S~zgaOY35r-RFHI*Y=?`U0L9O>fNY~wW)_y{#7-qx6`^=sMG`_du_UQ|9)|J zzV*V9Bk#VOij_y|X7p`GV-w3|?D0<&y7B512=g~^)0eB1H_Ybi%^zvey`-cX{FkF) zFaT{&i;4&i*1l=s#{E}HmO+^)u0i9JeIrL9^rP3QM7x}cda>{09bJQD>!5`!gWFKtjC+JM zv=LoKmOO=noz7TQ%v=c>k3w(!ozCn_k~aW*6D_81^5Z#u(w3XmZ5JWc&c)*wkIRk| z%4NkRAe8wCPGc-nRO2Zr4G8QNB83*^&_@DCqJdKa_3<4idzTbfA@l4evAGb;qG%xw zuefE2>enM$Tu^Y#NYwb+{F2naH}Hwaeq15k#if&XkVf2lNa3da*BPiv9Kk@Hw-@v(0suP*)^>Qj?y572i_1Qx5<3ozH9mdeyJdxRi&XkZTeyEmDxw z;T%xsD?bg7hj{@Gi?gW}slFTx5JPt0Kov(1w0-XCxJyvsT#Zb~yGV4oS8TbFM&(jb z&y_Xy#@R<*TUlE=CO=Qkebz5*?~c+62?O>paBDZW9i_OXYXtoHBzbkO_ZvQ{Bl6v- zFX*w}J*T-bU#7!_~nwi$^2Fh#w}QY*2{g z7pICb1Gusp5Q6MX{J?Y;3jl1mjF+#cqcn9(jZOj4Rdd^bZOuFl=>gFx7ZKNHM^tn2 zAw7Bo;O*?=LAmU!DK42U7Sj$X0G>xr1$o@kvd!JK!8Sa3LkAj7jWN7shDWt#r1Un1 zGPSpUFf;6)@{QwidE6qJF?;>e@M7R&H${YZL$hHV0>?HF&G&~^fi_?Fv%PuurP!j7 z&Kx(lP^?KkFS{fmGelt56qYP&RzZi>xqiofTB%UFJ@feW8UH}PJNuAA1-Xbs3oczr zvRF!&T2j~%Rei#Rr&Z7qInCD1E&iDuDz^9RzlrDR(u;>}-!gk-B)JLD8xQrQ_&wuQ zXx-Z(1--?}bzsTGc}mfN5b8!=kTC`{l4_pTD*!*-b9*g*2eT!CBx@oOJHDICNj5z+ zMSA>+%Q1paS9!T>h-LSF?d)zZq}nQ3HYlY5C2i+R1Axj}y1(#j>!P;_?j)6<8!r_| z1E~^COUO~Q_dyt;A?6eGnCnqj9u(UIs? zj3ZL?t37@ux)z&Rq?7R1I`WpC!ZOwycT{+HYu@FgS#KmDXLHpxzE*v6^LTgsDebUy z28^6*d1Q;W=+ItQfkCWOWF<;ytUAy+C%(R}RJIX6L#sBDCPJJag$wYj#}w&0kY@&r zoZI-zo3e1zfIUVqI2CjG-B?`<)5I<#=Rcyd?q)$x{SFU$-4Z*#=T>ds9_$T@^_X9G zQv_ETx{B+vCe}Daaf>tU1muIHW7G%2JlMq=m86x&37qSbr5u&2hX|L{UlA~sikr~UK z_va7o}(@W*1KkB}%iDxUpxh_K(YLstL6vcX8lAxSiWSLe)UV}?qbu}QvEjE+*V%}7Xhm9Jn_pF zN-;f6>jmP!(pBLSo%m)xzIjcGAMQ-rz%HF2M(ovC0PYw!cC;3XZ%kPWB<9JF64pbp zI}er%w@qj<8srAYUlE-zrx?Zl9Gp8oreci&WJ!Ara;EF~#?%JLM&u5IUhhwkoUc!t zwD-oFf0`pcue&p+9w?Fn1;=odO4@i06Ys6;b1XqCxxb+pV?=3%Ug@@K zCHH+jE}S5|@jv$$BWbx6zA3CqLlnX-Sj4>Z~N7;Egh^RrlzzxPNImco{lb;-Rv=8^W1Jw zk~u8G3p_j?#@UYShx@#!*Jvd3E(_AuK)la~CQaJ}#6W!#0$=KmKms^h?owkh%duKz8nD;e!2HD+zE*c{xvtihnwSg?p(%A+voJo^HiPe zzTqmnex)0395N?{RPq3Q5b)a`4!)2!)G3h|p?Lr~^^hRQ>GMfrenbrfl*!k4^o8-b z7s&S)mFC$X5fsR()M5}J-A z9UFo}NL*Cs1{v!9MIctpcVAMC2di-C5mJUzxoS5zE1j2h>Yd^)zE~fXz^{AH6A+Xu zOUStKc^%7Ug9jvubuG4DMe;I@{Sy_U%>tAoI{vZqng@k8^|UMO!`Wa?%4~g7uC;cJ z3BgOkCx~Lil(dYyE$C%F2)#v>ReOi|$-LX3iK5CR#$M>Z$Omm6g!jw*$i>l;q2}rM+zNf7?aGOM2!%ZZ2Q{mM;84`hSLAUjFny^AUvq z71jB_4n0Xyc@SS+k*`K;+vEufhIxS86`&;p^?7vzu!a9)fTv)Bn6M5XA6~UC*Fl71 zB}srNaB@t7C}uM1Z}|rd@ud0poP0Scm~`GR%>N1(CNoFQ{eA%77UR1qYJ|)mN$eC% zz=&gr<^N)ND^B^R%gGP&e}FUl)d=DOR`{13^CNM89>2J^P%dOUBfa8(Q=fl#7QqOs z{C)U;`(=r}T=(c0Z+V$7wBS-t3F3V4(aqZ>+a{*u|3AnQT?)6}q#mEL5XVowemYx#X1Zr^B6l)b9)B zP#QnVr~Ckgo!>JKd&=p~Z_^fda*g7k76lF2x;+1ednBI}~?)r#J$MjVDq# z@8pmkDR01E1r`Nbwb~vX9P8g7UrU|co@K}r1*Zyp;M|*!lg`GYs0KjMIQ8{gw)?V} zo(F6k2{<&=<}vdONO%%q-x*!=H2QcpoPvv$^XQ)KsCLg)tW3*b-LO16Y5t|Oh;Pu* z4HF zlICa+5%55*0QPdh5MPYk()}06z8V#kTF&;cOZ{e1EQX{W>a8Ix5j zuMx;~S6eM?>jk&35O{ogoV}9xE@F8{C~WIJmV~yWE<)#+ZAVFxi0yr}o^UsX6Y+Dk z7ZIR6pp`j)2jCTKD?CM6+3iM@vD0ftG*Ku3hS1R3X0U!&+c+Ga)imlpm{8Q-1?bVH zqU^1sM0aS81!>ofP4_ic>{IdN4Sni$2__VRTUMotDWk;pxtrny6@^0YTTF87j-j_KbUVqw=}^OLlF z)xyb5(}A4)yjS>0foyH->#!sK`$R+fl#s_bHiHJ{@&WOD~L)n#NJDr0v6K0|A)jcBBdK3W=2C(tFhbHv8=a4tQW_|D$JS#p z4Igg9Oa`Az)QFR4$?RTEW)0d-(aOh2N7yaq;@Nd%?lmZtS(O!>e23O5vTd2#-X>p7 z?uHZ@bCxfSu@{=i?pKhDJfkgW{d9Ww*`v5*Vc{7yK_4x0OhgZ3X_TGLfweR>pH$>N z;SlBM6V2VZ17sAA;>u5@f-9yA_N@EJk@UJ(9w3+p20Wt3-6trfgtol(ay3rL0IhikO=46+vE(`G_>YMV%$RRxTOanh0RoFo!Z-o?u-GSkvWc#1K;4ysh%9Tc1s5x9 zfLVQ(W$5Tjp^GsNQFHMq)M2`GK_g zzjVFuY1s8!e_T>_${8bOBu&)o;=xXhbX92}H9&Do73ak%6i+ z?wmx*mI%HN9qUn2X#RBOs`DTdA;nWSUGHChktq*^i>*GxL##U{&0R}H^_WU(4t7d? zc+_%))jR6Io)1pd#V4X8S~b;9Pm=cl6m98ybQ2?^(&e40D(F;MU`ouiBAB+j=$8%D zE#mEUPL_=>J!}@yUjhjQzH-JSQi{DKoj}ptJ}!`Om-Mn%YX>kad5%JK14m8N>ysVK zhj;(MFqthH;=}#SHRSF`>%4XLJPWJCOPx>c+v0H&KX*GPp>G^pX6eS)tPYlssBD|J zA&w4TXf?8pwIbdXIn9{vA$mb-(|RXm_Cdq0=_$#tXmC|SJMT|esA+F`9AeSvo z)Ks~gq;t2}AjX%p1y8F}fTyt4m#MWjugvpdFf#0C)BIxTpfG`H#C zRn}R;g|)y1Jv4qrL3_;I@r$J9fdfyw4(_2FyT*?jejE zYQz^KDIKtM9OcWWGFr^55y_Z%L~GrWZ%&dtN)n=ok9;xBh(Fcu zZbB|Wb06nzB1+yL7XOq@g3U(4*g{nzNV%iFSP3lO9c^bzjKK+@1MKAxXVaP=sRak* zS$>Mkx@cZl7UlBF0#Fg#lq)ZDuX2(EwuG|x+t&(Q&F_GS&Psu!JPgq9qvM!$LpErS z1E3S3`M!d(2YV+lYP0ke!OQ;oHyW+Zuz&UMnSzUpy17xmZA?D zN!X|*1v_QDdyO2|*A-ma6iV<}G&TzYSF%hsnlV-{8SHI2V3=6WmPo)`)1@maL7pI> z7K^Aqn6DRGM9PvWZ8o;_?)E1c@o}lJ*-rA+zS$bLUFCYX?(%~gBW1irNYR{jHobGOH!J4_Rr27mb+gMgD`y;X1k+MvSPZHEXfu(nnQ=dxV!+7p4pfG3`}r03ne5r0(iEGHb0xKe278PO7Rn{vYw;- zf+c%@XPeWe0D-wivxexyk zC@J&9I+yM9_xC?SZud}W_y8@5Wo8}u?DyD&O*9-_yV;o$W64dyfLRN6byVUOVc>|? zw(E&#lD>@`W0Vu1cLu7puH9!PJ-YoiwQctPLy?VoLoN(5Z8LADbyRz@7#xp~&f3#d zeH}=ilkK2|u)6?T39BVKO~$7gZpyu0iQ4OEHstEHDG*XfV`P~XL1eMQ>P&p;_3#{9 z2R(XgN1SeM^MGh3*G;AeUvH_!{V>Z=%naE;-bob|AGe+XPTGXD2$3H4VS`K=n-zIj zTt({JT296S#ELOrs1B{kPMw{+2>_qjWIZHgr%+iHlJv4N))qHww`qV9#jaB6v8%l8 z+UmxEG{A^a`!3opyD4vf2yy93kDq=Tde|$!HUlKNhI!6^rb{Qv>GRq{EH;Jg#z01j_O}Ttc3j8QwI5yGeD_l#0w0@Pht#J8wqd&WVEWo= z%3Y@b`L>j{A(s@#q@OMPhwzmzK+(#e{#Jpn+4%IQ{;NfYJ!%!5$yTk0%_vAhPxSRC2@m_~ z!h7N6PT;e}R+M`CZWN!)dn<&r9$OkYCVA%8pKHMKr>NLxOvZRHxWD|Z;?wA?wYAi< zMuWYEJO>rDYLWwM9d&QUCgE7l&Y{_^U)^E%ae7}DV~vD>&-gaMb`}sw3jV%@<$TI6 zX^U_g6H*BG;_OpK+w?M`#+Lldle>cnOMK=TPR{k+ar3%a934j^n+acTtLn^;6n6>z zJTlAY>_7|!Y9^%d@qDC-I7(U%aB~_#VV&N5->;7J?cF1x(gJRvm$X6_A=itSV2NV| zIlj~=&rjdSX3Ix@o>tbm1*Y|+w1t3mgl)QEm?KJmelCO7!4rjYR+xXWSj8 zUOQYnuyShWknG1~8tf61(4fpWt|tafHj#6n!(j(H4(l`0rG>&D{Klzm8DK>e^_&h? z$H$>{nP7i}c{hNytfNw4_=QtP;!T60;XE%e_HceUsU?-6|04Jfv)XT6LfQmH6)wsi zbGX=`ncSvBMjE9lRr~4uQM2!E=U0BDHJ)({U((*=U~3qq_5p(&{u>%IzrmC51fo-w zwGlhAukR8_UaT$DWLqXAl}e%MXWQLHR7=RdzSvMTBX-+Jkpuw`@AMW211WV=4i9&e zTNnZA11IS6R@s96E+t>L77zujw$Sbd;b!^MSqbRCejz*AnAzTW zZM7s$=GXF9CRcd&`fcXw8uidGv2C^Y%+~5-6ue8WrNSPI>OThdy=9sLX|fr1<#~&U zo9JP@`K-W{cY0qa=-XVMuSU+a45Bv%FWy74Au|(NE($$yZ<~Qi*)<3_*k`e%!%S_A zv@v+7S5CA+lC&Qf!Awzjvsx@3M@3(}n6Zg7BNnwcx6e1(_~hJ1<_;Vk_8EUu z6SvRGwEcMs?QjUjnI9;SQl7o(sh!B2ENr1pj9r@4ObO1-7ZRVGvR&L~BNqE6xFnSw zgEC%AO1janU&rZws+VnJxXIpmMGTCf;hXmTmM<{GXCChnm0R?Vn&C)rPahHUp(^9J z-|b_fU&h;}N1#*diQ4(JE98r2B2)9;{FUB1_Jz(fa{d|{u9)J<*2j0s*9D+Dn1sYB zj^c4>rP?`NGL?3yByAUm+I{atd-(Z<1AJ_xYiOpSO#J$r^7a-o z*B>>5ET%lOlPPx|vR#5EtD^vSA%m%vpj4`9mDUJp(2&b=6r0e*4!_T?lHT>@V~d;O zNY3#rLf8C!yL8++5j?+!#K<>0TC6$m(www5e;jRR$kXDbpW9oo3I96e##Ai{LDtoT3{Q_1ZODBdT8-rB;kz-usc zmWT*kuK##njS^mGhl`6FOT}Wh^enmY_6%DF@eQ8f6V>ntB(N}D%e&$l2xt@7tP`cL zDC@LHUzp*$S6gOUGrMp=q{TdJt#+#frXQ5^5z!$XVOz)c5ct#ME zYG#4%!pzx{t>u9Sw*0`%?{rj7F9hP~Ekk4)lD;lX65i8#9Pca0DU|}zaCJy+5j944 zdOkL1mg*}k%fNncrqulEU6hm=%L_j=NvqS;R)EW4uxk+1Hvq$F?A%hSjibRikJP6R z&>x{@E{9Lrkn#%mqd zesWEKJO5a!el3X!*>M6SXSW6DjGqS~GxQ&$$bPxhT5rl;hb%(qKR3U;TE=y2Ie`-Z zMte0@Bx$!RUpE3B9GNWjV!l$L9L}k*oNik4584+nhpum&^UHX0-<)ej7w9U)dE|mo zOZB}A3h8|i{PxjE`%m4V+Z*gc2sc~*F@?$6%32b85hLFT$j7_2G@Vj;#V*U@Gol#KIHT7 zjM@EU@k2)bAnX0}{zYfnyXH{R52Bnq_jHMcx=Ygx)3qrV`Ug`JL*Vpy?VP=sbMATCv#amlB_zdfTb2Q8M#d-0PNC<|^~0E4_QORM|mWL{Hgd z5fs4k?mkS{gQW zZx7QUA)yld+KG&Wr#@Cb(VMsoKi zh$X^3g_mgWeqp45nURuxx-Y?*`LMYFil8)|bZXEtd0mz{^AJA)TDIbV;#4>TNhCMj z9E>SxXs{6&AAF(x@rcD)_-KHNSs&ih0{1j2g$RYLpb7G=k+A59*T_k><57ut_|atS zP*Q^d^JRwhGK9hsp@Aal^7ljFb2t`CH;X<>mq64!Kxw{M=NG| z+ts=OF&C&HK$tB&zp!3NdtaBt-ud0D_~Kp+Kup0JO0sA~3^PV|{> z<+iu;FoB#V6(71y9t1nXc54DXH}_lsGShRN^}N)9nv5?qD2b&VZXzSy6k1;nPiBr? zV1KsUNl8kfwTgF^+G|ABUwk~OgCkkLCdZAQMm&9v;91T0qae!px%Ly1ObbpU?+~kzdQ zevH5l7&hl zg~!V6I+gjD5t3EocICFEW@Im!6g^8%^$*%jRIu;x`0P6=6i3vLl$y$y5BEj0(dc{P zEvzg;6ld1Lfh$5vY3IrNp#} zsUXm6)7e7i*sf~5rjp6*a1kqI7w-V#%UNm5iV_l_JvM<(O<9^P6Xyl+fTjF_2LiQJ zRAMJyLP%kfu;JH9l26i^eQ#Og^D`vd*m}A{1S6wgD?67<8~QXm{a7o}CYKBjzTG2t z*%TM(B}rp^yP~x5vU0Uuf_>Zn@}&DDecVA|?w42KHrn*NCy(5ofagzsg}%;_e3Ho; zKAqQL>1MQVTs-W^I|c%rzQ#{4yR8a!gPYK>u@XwenlUv#JsE0O=X~;{x!&CY74?a0 ztGSkI_*IeQwY7obIlY%?B#-9|+(pHks&i6RrN->;$f+UeiU?6f7XQhK`Sl(GoV-y7 zim2)>JB8g69&W?=DQ3LvzZ~A76U6s<77Ba~|9vQ8|MZ0mLH;>Z^?-1mmHpYtn~rFt zKQ9pj2v#!Tew0r}Nr;mEyfmf+e-|Gy!c*7FmA>B;F1)-r0?t*LTNDrynlqbw-F*># z!uz~nJ&K#4&?ttR37k6DE2Or>gT_g;I6Nb)|&-a-C*)TpZ>WG-+<2@|5x8O zJ(s|O)Z6_9xCEmxc1mRw1Y*mV$Fmu(e)s!Jejf@-aKcO#JY~Cp>3Dc6z`!Ik_@LRq zyyxB!#p}iX5`(Tz6nExN89F?#K85Gi65a+#P|mZ#Jg+<2XOwV>|4kdac4FCl&+e#g ziX5EXXpG#BYJX0ulom$XLhI?XyO^kTTYJP$I$FV=A1g7*n!;vAuqYYJi{PfYcBTJ0 z0tLzmCi`#wDc=OQdqoRe9uxEAWXCX2|GIfeSxJ1f_`l>YZCRil*5K6i!`G$xL(F3~_7-;5 zPvx1j)BOof_`0KA!c7nEZhXu%;TkTYTOFnH1L%-Z)QrKrb4MSD2QQ6;q~~wH zE6SJu$jJf{O3?%^0?=lRCuV=KnreszO)Kh~%UvT499!u9p8|0jn$U zp~JW4U+KKDt44tq#=(8PHf&uY%VIyr>BX39C4CT2>)QZ<>1M0dN^4jr-p6DYl%959 z^6%es<$h#eYg*jsgqIe$gi3{6TJtfUq++!Gr0AD=HIFZYmV8*Miw=Uif>M@ezF-yg zmF2Q&AHBF*iSJ>aCl4AG_bEfge%kPpAWhoy$Kzd*^JnKR?4+>21NE(FXO)BqT=wXA zJzMxVl-~Gwax6uY#0rdXD_IlOOKSwk?ad_MHZqOAIsxU96Zrk(N>yQ%ZkPi%bL6Om zxn`I8bC8J}EjQFta{C`|g0;RI(hO5|4eJETJEbl($JSDAs&WyewTM>3W@F8yvF(#9 zCZy(yET*)AYHRZ&q8pm(xc+5Zr^j2K1SX#uE0yLhlEVw5;EujA63RpEmG8Ua3#~O} zR5k(Gzm2Dy_fIeYUKDatN~NjhOS)Rxy6%+Lnos4Tvnm^#)dE!*#%;AlxrhfVzhgy8 z_?KOm#8ezEJj0CuOm)KLj(?8nu};2E2&k?WYxPP3-NdY%?59p`%PMPwAkt(M*WimM z$*3~1j6iY%27-N22b%=OQb3uaWg%mV6;{>MV$E=idJ!w@&Tqe|q`<`}vB{2Uvz%hI z!d2?-g9!d1$BXU1R)S9yUoJL=hD>mM;&=67fr8s-s!X0m^z_WL#B1+?sIowFH*L>Ek{4iH=G8>27(33~iNl4n%NchY*7WVJ%360-H94;`A?S=*?#oA zZ95sGRc( ze^_xcmFOiI*WhkL{(jAqolK9q;Fo{@b47rwLjL~!f6$dfuY5u5??+eM9R8a$XR&7@ z7sX5J7)ybW$qIFsY^VM2c~3sJZ6(Of+n<#eV+Yw@ytPzNzKewvPqk9={Z=IXb9@U# zQfL&+bh%h*?f!Qi2y zggD|<)9!T!Np$o-XLiN>tsSHu;K5_-_B9(}-LW$}=5je4Uqd(xi!${-nqIaYXA=Ii z^q)9=94b+;{n-c>^5rdtoBAq>yILN0m^6)`58B7Vs8GNkc!=>IL}scn712Y*K+1nU zHi{D<^eD!<%!{>0eX~4uftI@cl^rjaa0&#xxzkBC;!uP|bFquN)dS1jwX1G)yNh59 zX>9#%h5HQ0O24m;jFty#hEaL3d}6c_U=z(u1H@D~(BzNta-o+JRJ|x_DA$;4S;I}I zw?<`WJBby@xC=>3%Wmq8%iK9Y7BiIDqAB*h=N%eOTX;4@{T5z5Wv9#5(?9adbK~c? z>2ZtunN~7oZ^I_b6rLD*w3EuZs%p|Ua~sdrpc5aYlgmY2DcYEA$h_RV`ofszZ;%cS z)3I3)l%4p%UTZ@(tIY&>T{q#%09;myW|OhB*rQhZ;a1&UrgoOPC6*Dt?zXetQJ?am z0^_f4jt!8-kWwdgb?v3` zA|}kI2fxzF7;@+N&=GIkO>Gt*43mvlAH<|$K-0jH5odgrE-QaDTlG<~@7mz=Nx;jF z%)ZwmiPor>j+>H`;F|LAudn|3mAtz2tf5FmbLIBHb(`ct}X=YVU}&Y|1c zXZr!HCdLIwQa6j#V#cOcxZJiUDMZ5owC$0IlWLpNLG9lZ^#ffR==qd=T2}@Je79q} zxI=Nm9)HXyMk(DC%Pue9gWcf%+saps09H2k!XIrWI}qfC}B=*rCG!6I;?CU$yc^7@I%1%fv=?NM2X*J}XVwr8{{&bZA zO-3EGxjVQgTkRF^bg{X!tOj`!z-VW%pYiGqu?4`fh_NAX4H(r%>CbV_hCej2!1Vc88!^bQ5 z?8>v%V6f8BAG>PHglHFLZn^)cp=xVUswj=nIP!B>8NI7#oSM zJLE^>@NQ#|EP37!3N%z9CFPVyMVx=u=x=7?MlieH2R#Qh;a9``(_ImT6b_`7;COVn zxxE}r3Bk(;%X}6El)7cH_>Q^CJ*8SzbJj zlK@BAMQ{GCQQ!<6j}KgzQ;qVk8_HawQn|5M2y0jqmsIpn2+u%pF#wn;pKHtAzL?xy z&JW0^&$&cp-qFYk$To0jN2D=H`s^YdD+?TEb_>mkRuz4~ZoytDz?pt<@iOiQ!R3}@ zzK8*gY30Q^Voy{9uC<(*D@pjrdfYO@`KswpS8k=VG^FDY_j41`Y&2SVe7Yb%J0Ea5 zh#!vjt$4ODf^+>0`b=4Z3b%{+a)fC^9M4&@!FHeO0TKy^AM&78vjMUlxWNUGf?4s> zpb+O-yh;d)$-c&Xy&TCa+JBaH-p?*C*0`UJlNx6BzjG*DdzQDFvbEvqotMepd3fj6 zy_q4NYRURFCvx&d6Bp4bB8G)TS4n2%@*CC0fXh6{UT1c{gX3!lN2GCvo6B|Z@&??x zfn$&mTj>qoMDIw;YdXua3i7LCdmg%N2mvZv-Th43mFZ9=S~oGBXYIwz`y5292XwHs zcaR1Y27ZJ|xSo%VtDbeee~BRj&#wlgMzMfCEzCRU`ZG|>-$_?t&s3elakqF!n_wKy z>5(6Pd029*`Sk5(2ExlgTyzQ#v@#{&OM+Zwa%^1PVHtt=RB^B9pqD213Ezr8GEmW5 z+Ffi93j373&%dOQ?FU`IyHa|vQaHm-VehbG|;ATbu zbqGpt8=u3wELOZXOd=V^La=^v7O z@aQk^-X`3A4%i()=v=n@89Vn)&;?8F^G*5Vk`0i2kimqQp z5!}4oueW|h)AtC1@vE(AjYOV#nb}F2x|L|H+Re{3<6DnH#|d#1lhpmGgWP0lk2Q|P zUTTJkkECo54==NLEG4j2#z4{+@09<^=6T!p=ma8f)+c|oVo}u}c|689G{$Ef^>a^T zb@~_VbOg2`hb>CLK(-M5SQMFaIvK*vZB}G&8@8L<$9&vTHhzG(ptXdbvcNv!{%GP% zrM1N7V@3{fn^B?1=cNW`j(wP~N!P;dJXg6yi^&IRnY)!y%fc8c=PGjPb(`qM-8$0n zHz-nIp^sedX-_pi1zHNc032YOcUAy`|SZ0??JyJy6ZaUCyxXchEBm6;!cw)gf zr;Y$g7eEf1z{90GJNUr!Y1mP7Y3C%a@3iMn=AasXDIpNEt$wbn>iQ!C%QO|{!mTgK z(I(?Aj5gFBosg80?497gw!1Yo`V9)08Wrm{Nk5Vol{-ACRN33}0=BY420NkA&^}wF zeRFFj4>(7?ce3h!>&SP^6!%)i8PRsANqW}Sn-#|`c^|#u-MQ=3_nHF-!y&*=uHN1> z5vvFmqUeUN#jz}Ym(`uy4oHs&=`DqGl!k`JTkONVW+D^Wj{A^v$bGZ@{EVt zWK2OYDq;RsE^8rwfm%hfFga4l9$g3iq7)6mzgU2hhsLBZpHjD&-sf!!a$F&FGcsEW$L{~rVtYAX!CzKS+lIwv{nDc2 z!mnZ$W^XFjfmxJ5py{9ZHR$Y;MiV0VwW+{J5T zUClHSQXG$+4_5-M;&~q29Pz#*@BaMwv8LQSTydr*K~;UYoqHd@`WI7(&vpX#xVHM9 zxmC+q6*O648zjm}l0w4tbu(LY0g^Lc*UaMr7z6juVV62OPgo$R{npau`wtT8Q9;3U zmcb-om#oMpE)|K$^_{LP@JX>rDVNP6@!N3};s4dOdpgg|(V{sCiJS5y2`pGcCF;yB#@6c<&Kxt?N+WzI zE$kNZkJ&h1HZAdSSzFMC%jaOw9+6??b{#|xmQ%6;8bm*gIa{g7$jG~;{im-twdfyT z?^>;LJ#p4aAIarc3=ug?$8axx9M7y;7@;joyMq4@OE(J;$*8cxxXOAKiFNK--d+uy z8cUxv&K0syL27qn{xb}MiB6oqRzG>}oW}Z$KAcp~yBtl;EDn6~uph?d*=lAz4d%A* zGhq=1ssOLqh*3u;V?Ef^G#J#q6PWs>XH{&ms@fNS$nQBA`d+yV2~QgARyA;t$t=pv zhdCDx_U8^37g);iq^QM}S+!3~Hfp%H{y3o`K#OwR2rPfQfN6;an5J$K)wNLhoBU>m zHu8vWvYRzw3q4K1$)Dj39m_i>@8HJ>rhL3&8b-^jgCRskdfsUl{M3xkB zQ+uBVE{mF|^&3Os<|llCAwj`Oh8^Sb@MWXet{(|Qe_)laMZNgpqdJe9sZN6646nbL zs;jlMzfSK^yP6();s_Aa1UqkT6G}WVKHC{4WguSbXJeIHXw*Ucu3v`sJx&5b3$CXk zMD<@VQ+M*Yi;_K{Di3Z1VXIZQ(M5_M-Gn-@QMKZKywKq2F<5sO7XGHE?FQ1hKTgVh zY1B3)B9XJS_&yFDa2a$;=19c7&t_o#7~rBjRph^``l+LHd6=2ndr|&K?Gcd`4(l+U z%wk~?qic%E{;n=+n4L@( zJl<*dn%9O~bx*T{Og5kG1=I9uWaP;_amWAbJ|f7(<^KKAL|N}afIZti?DOtZdO65g z;syU{&1uzE6v;&BQ`B$3H~-;UqGpGp^e;f;Y6%A${vQATX|nqNt}pt3zH0Z_odqq0 z^zYlZvKSU0ct4rN#m)nzp5<{3qRLmVo#MQI^(O^?!pi|~BpZj`#k2<9#;@V!?Q|q8 zV6)iT)`K15z{uY#Ncu{Ofyn=gb-s}R<)36ePXJy0sH3Cs8NsmUdv-5T$zH%#si8Wb zw&NGDyFogt@OR|KUc2Wb25zWzey5-Y`+!2-?;SQGZ{52sR*r#Hc50!oz9COk5Vd_t z?-fKaXybJYZmVWqeZ*WjY-);8g*&CxrPP+!XMN9T28`oT^E^L~HhQKe0X!vyyv5Ch zRhZxRJ;1xM3Zv>Z;l8!td9_K_O_-Z_#ZYxT>ajWbUZ~U8^2TMx?O3~w{^HVwv>DRy!-#*1=>bHKWx6{^fjez2D?g+^o(8DwZom3A!0O51+W8}K z*UzBM_|9ct!ZCLjLufyiQ0F-X+#Q(!xoY4@0)+tiiV=AhUAyO0o8(})Pl{1lIj!J) zt>faPfvkT5oahBN<}EoDq%qK1v*`KIW}j;1bD;5H5*38k zb(ifYsoSJl7FuO zz%`SXs_r71YiA0v=d#qjHg3ymIbJlEJ8t{xVVpP)4hjfVIHxaBl*jv9kidYJx^ms) zPBOir!Sq2)Z+@84&IdwqWj(#hFM>i2Nvp4{b~kIntb|Q%Niy2KmT^x1@Qkh`P(iea zffV+sWqZ4Ncw>Vc5+jK=>6W)@YAQnE{Y&McR+Ne5I{VUmOU12{L5p!Gi-EC27mGh; zKBV_Dia9+`mwT>jHsoYrdZ@9*133Gd-rK}{;}U2jMVQM%V^HxkZ0pI(w0769wKdj$ zA3f^al27WhH-eaO{6IdMHlQHLFW%5nmws`}N!N%f8kvsZCoh_n0~Z7J@lc@^{kG=A zNJ-VCCay!(K+vJNNA2I%#;y++f@rA3HezqqZc(yY(`^T__R4D$$WKXE<@U;z1ia32 z_pZ&Z4&;UzF|a6D%i*Tzodw0C4*w_tEao=5e(ryCjELk36o)6L`w{4zdH@G4XaD@e zH*Ghm6S|e~C`cCfPq!Di;y@zuJ}yq(6K*HdG3=6DoP!bmgqK-m^s|S!zv|oVEfdl5 z<*#4&BTDR3cxR`c1t6#-3gwbl)(F|JzfB@XZ{HENpH~WT+TU$b|4NQ)4Y_yAcDV>6 zi$oT$_>k|v$T7B_*J?5$nCJ^WPHJNOTQ>&N+r-sU3#r1Gg=g9Sz;^zDZz=coj`ocQ=GT&E{$=E#aaArV(i1*{fHN{e=^l{6>d3+}!_ z@C~AKtRB_Hkt**-Y=}IAEBeZJB*q2ttWocd3`T05YfT0o?j7dN3R=cjl?Jv}6xEs= zunNf^Wm$v+w6eCRuuJTFJ^`m)ANYmz7VDd8(TIXWQPl5cI~}zZ|hT70T-VlgkOySbIs9$r$Dhe!R_F|X$& z;$K-jk0cOZBVjyN?zTi;;?R<#h*NA2pKop1CGpwGB)ewrhiP)eSCV~it>%1R&8t>= z(#B~L5U{y%GJH;zf^)3ZLZ#eSx$0b!o|SvuqDMk7gmJ#*K{!ov&r7a(T@X;k2bQqY z5c~|HIJbJUr>QrrX*}DnGOm5U6e{0@kgPisS zp1x_g=y;6yz$=JVQN{_c)D*NajmxEse_V%;H>97dH(KHVi6cYg220;t^VI$FHzJ0j zue&b&x2We=D6q-#E4)z#(H$R5*`TmM&4DR8uXwnc?dt67_>}RzH|_jVz`VjE5+l*1 zlSZR;nOvW;i^?rbRS0tBF<>LiQLjBFr7LfJ^1wKgZ?U>pJw6>cbrNgnEJ3=(b?f-I zrr`-MZX>(s=6~CQ=JQpUTppZU=ggMb*x6wTXIJ-;oT<_R5+oV_C48MX|0jG+l}`N6 z#xwhkYM%k}_l@N$BjCQ^1S&b^^gKjU^}qDfH#5(yP0yF>FIlIj0VfK{64{k~c*HqB+|qZ;G3^uP zUa_cxgZ{mZf=oMV-#Q&CcKw*k0ku=}lYqXJ@5CAZ7N%U3m>qLeK2bpaR{;$_Wn<{S zN%*hoC;zf)PZZt$OK`Ri2Mgi;l}VvDiCB@8oJ+RWDdyb2jL+WNG0d8CN&brk$jSZL ziTRNEK0P4`%zbCLo3JCywQI0;QO=1#yf#Q8TS_PO`t^g;{g2~GtDwEzQm;IMkTM&O5dK9ASaRKtufUPc5DoC+W_+xUU(R zbWge5=-o|Yw`6k&E%-#Y= zSb5s=apMOng~S7~hEMYvx|(zp;R86qu>!;vV;SJvisU<)xfZbrt5c!NE#A7(QFfchC!{B;oiX*MU!K$34^+EAcozd;brKnCs?{|?BlT)ciC2}NxZTh_Pc!w7F=6^a=@6k^R*6ROYCQ?|82`oY#OegKPo!Nk?@utpli(= zBwXF%8J5-F^LK>OWA|uZW4giqUX$G#t1+Mt{5nG4{Zc$=*uyPoi2@P<_50IT)Z>;gnYV zba&&UE#-bQbDEDbgk*v{a$uo5@-y&IiD={MDmVrr&64d*m5VdI?`YEulv6CZS}oqW zr?@{+9$<-zL(TZn`#AA?I9GG%(Ad$A6Z@@-<(6jay@u6(#{_rl$eXGod~nq3fZ9Kh2?c7He-!q4NK;Xz z!piClFo=}W`fxwrz?)RCIQ2vpUU5UnD~sR;Gg}^+W26`RUCq;4tmZ9~hV0z9=l-nC|A-(gy=b+=+ zuG>(Z_}qBt95>;$G)@tLoOjFu<>)rvlf75C7y+f2;=Lu3=VKxpKr^z@TWLgV=Bf!~ z&p%fffQdA|PHMWSY}{Yvk(e7#CxjO=L0`3%&OZ`zk7vH4DXp)TYXw$Eo^;C4jAqU~ zsGPjlha;)*C5-!bj@s~<30S<(dokb+?XIylISyou4SqVezwM2=4U~LPYW#J*xy02N3>I`Wxm*X z(f@+jEp6!piEqA#K$5w|w~pX6`mp)|4@b(*|BS7)#338G_}Y!F>n2o^O!bWWmT76A zW=F&58V)Oo6*@IuN8ql|-I-X3=&iVvo(h zV!4^S8JDveE0!~9F1n=QQv9b2;g7A#SK-r}AnsI%Ws5uhu+^0OnymtZtZUUXITWI zwGa zC#39tAvqd6+60?*#$P^uq9|d|Ab6vl@hfuTzHa+7M?DLB-(>!V*VO)j>)w5V;w9rG zbQVVov@K(~80PdcFAp;zi6)$TFOH~(#ZcBq)Tq&+era+sa=H^DqSC0KWfj{$Uv{Nu zL{f_!EV?UEU#%QD^vlzjQsE-+H#BkbOz7KlK_udw_Way}%IJS}NyE@CJllH#vsu*)-ta7<7`u#o#yY%Bc@`@IKJ4cJi7|8?X5ag*S#1 zvAmXIZpuMBFUhCvfB#>=TM!3_tIxcDc! zxPE10p{t6Jy4vLcGQ12jnp>1*MKEEKnLGCmOa-C%aeZ|xECh#=C+KGz_eqtduQzo%}xcghwBI z5`SH+D(zvREpphlHgnyTq7jKlFDvC$)^oJ+B#mCK{C@8})rtbEtweV5y ze@?LkZ@B)uYVTqT|ARCOs%~yWlVe=Eo-)^;x;@SFjUP&@l{DB6#H@(gZbCBlnqn5t zH%4!O$G1iCMI*ubSAc;V0yjqqY+)dPU?=XMV0`4JE79Qy?R|8AF(WqeTPCXz%*eBF zUDxM3x~1op+KdCUL>1wXu23r>GFgd|Q;yhzhYE zb_}a*>ZLZ7$_;YTq2Jeqc#D9vjclU!4)veuehrZBm6jh&z zPWebes_Xne(-@<3*}rlYh1WATx0tCaxjr|ijvIDa_oQtjXZNh6@qE?hPdw_g#l4|b z9b3GSkKEoXj2rx)cOL~*zj>G{&rK^+?^N5G*1y{)Ofwb;w5LwN&PM98_!^!HjT1LE z1dqDYq*#2Mzjt>Yl#CWME{C$yX+j8=-gz3U06!ltvS%)K+ACgz-=}L7@LjurzLJTO zT6YwWlUuoCjv+tY8)<2?%hR2~fCu^10>#Bz+z0?h%kOk1;hY8@d@y_SCzXMO^d*4+ zP`WtYC0iuVr*b>q^6|Ig3Z~{hQkTwq7%w|oPP^#OB&?Qb?Y&xuYcUi=|LHiiaCpIH zvGM)~rd;!Mknl2QkI^Wp(Un*))JqT>nJ`S2Ka-M*SD;+f#!=dwFOSJ-ysl)9qz*Hj z^}rs@|2=B5Zg~rKIB6--A7Tck-k+ATr+!r$6IC|!x$^+!@5Wgae>9gr=hQ5?q%|RS z#X{BrbMx}S)}MHvcux4d=*jo5eev_sdJm$SV$WX#TGCr`ehpht2UZhs!uHmFA4-Fx z&l`dxJWRajv~jj!jOk@*e@IMQ50iVKe#5fYNeEnbap%K$@a>?8){=HnpL02d_f~h$ z?adELzLxZ*^HB;3ZX)>zn{`v*WRWW60v_I4Dc8*&s8D_8xA}?`Xp^jtKjh_gFV@T= zs#hZC^9tbpUmyhxttKnhDg%RVcb6p8C~IPh&f3sCq=}UF$=}V^q-LY>DC;~{iAFy5 zVltInyO{bUS*8+=IYUyjKRdP^C4fon>HnYlVq_lwQ91a3wpsw3LwHUK_{N`$5(C$& z-?^-uDxiD+JR}YG{%`cUWf;JH|Nei#JpO-QG5Gr<|69qg|FYlxKjQ=i<^Oss4gBi4 zC&3laZ;NZ@1G8pcN#Fjytrh`5ZvK5q(eKcSubfQO02>+GGg^i*Tv0EFvPYHRz#H3l>r9__Rd*}wF4GT@1NSEN6Vk|_U8x>4PP@^ zL5GIGBAR%UJHG&6wyvFK?6;?P)%&g{%wHDzU40zb`6E*i-vpkx@zmyXN2E+h&~>Tn zIibUHJqDHFUB`bF_V`mO_O5f+o7%MAFATrlySnc9TT8vY)HA;33NYptz)nT4ntgM; z?#K1S1-9YDP*>M9gUNfvcS2mW8*LB^4!2SDS=B_kz!!f%#wS;4-Q~BvZ2g}S!f*5$ zb9%>LX8dM;=Xr=-&=@~RbN&_$^w74?#I&zR&fLnnj9gFYbO%WD8Lsd~1^frQ#Ms&` znq-tIafqV&e*dxHA3Kx5dvQXq>2AdH75qLCfayM>MpJ9SPdV*wKA_&O9NND^Zl1AW z4smyK{WbHkN~7~Mi{{E-GU$+hK}iz4z=Gg>Vr~d*uXf`LvPrx?n=sHygc;l z9{}LfpKChq*e4Impt9t(8xEmhr~3z*W7am*H|D65ksKTxt9UGMzv(}h(drX`%0oOk zfS#Z4;BT{UQA9N#gM@^HhLZnd&A(@MnIF>PuHT(rStdk~7bM`J+$+$=`$Xr?$3-u4 zMDG8KvAz=!y{i#lg7a$$QViVG+SJY~MD3x+fvO!;(y4yWG6J4Qa_GEYb2`a4U165K zq(Cs&(pt*V8 zvikSHdy5QW3z+Tj@S8q8y@hXPWcuI|{qxUbDivxn`Ra!KB^K#kn@a6(Q2@R1?& zwwfGQE2ZH0V<&QcGw;#qN}4?PN%+#3(|!UXUV&&$u~e0q-2ygeQ+>m^BNyZ{JD)~A z@18KSfGZSL2a=N0l|F#U*7ogT%ZBZkZf9*du=YR7P)6p4~fGt zf@V#XhRD_x1fpnc>Uk-yI;)Rhqyje73mtOhf|ttm{Zpg@bP|Ty^8xhlo-p^?(4oOc z>qI4kXS2u@O%o*>gv@P!_06xf2RxVPQG?TFW3Naxz(aO8+sX)KQu=|{tcoe=ar!*b zx3gZXm!zJuZW)^D!Jhfd1rMh2U9OgwZfmQmLR>%2YW^JfnUckZsD4rkVvnCo)swE-=% z8E$p2%Fp2Ms@^6ne}knL`o)<_!jknyGu?P*^zh3=JGD7@eZB5WUS`!(Jsy4G@>7!| zKM_{QHyrqS8rGSslVvL%1Lf_XI@P%F4PtiuM#a@hD-4f+ypPTK3|7srBlSH!4BD?7 zbwW{9u;qyS<|!-;Dfu)w{e)|hvBR|eS=992k=TX;G)m#Ne($xD-HnrBrNZb)<6E4l z2QS9Ht{%vi<|-nL)?0_8yX8ykd2e0sDly`3()K>Ib<2kPgGj!T^)caiO{OjFTkv$- zgf=MQ$iwDxK^@M+xfN`X?twlLb^g7D`e=jR-_~_`Hasc56DXoAgQjS+dQB3MbkaAT zIn?+QVY$PQR0L^s+nR)ZC=F+}>3i5!xaGt`#1@TT?tqRbKbO3(dgVMdI=>n(RP|mS zgB|vC5_s~fG9E)v?TwpliZ6SvX4>f2i8r9^o(+}e`12OW|Goxme#AjoJ)6B|WNb9? zoJZ&5%T-NsK_fYY&BY@n?zeAJoZ%T23XVYb`0zo3ru?h*Hfm?Nt$guci%;}t?&k;O zHK*mlwX@4UDJaWdGa20ze_Ga{*RX;NEnYOqY*P!+$BS&8#f;p0MBzPS-*cBr9l@J8w zP`v`A0Dmt2OLa3l2ZM8JLBg^`fbf}bF@`pS0`g8A@ ztq9J}h9<@p+K2fH!PGxH7!8QCOPh&cAi}mAz{>j(+5x|MBw$}NL zcLGB$*M~HQD(pr`Zw%|uuv>4F-zz9>W=ja^;vW^{?taPe79ub=7FU~HXAzC7s5&nD zX80lefP_hagTF*V(h_Q@|H8d*Vzm@;@`xQ)E9AYfdirhjQc%A%(tJAd}CHpR_2+4lJo4Td^>Qnwc_mbwFAFfvoym|Lu+E_?S zTbSD7F*@r@5kj93Ot^+O-h_UNkV!}Vex83*J3e!lp-H{gQSB3cDQww*2) zfcnRuD-DV}k|L(M_#)>QO@oS-Um@MIpkErEq?!!eXYKv57NHZ9jleyA_@l?7nHGbe z8RtaiexRIzd~(=6DhENe%nt&70`W{4H_-b{#rsO?;{LoZ4tTdbnZ?`|8dCZUWn9Ys z_Dr)gmc_`{%MLb4@~mP=`l}kON#X{K<_ZF78fIN#O3|3}&4LUHkmbH~f6TZ=l7k%# z2LmV`5ul)EE`Ky_7haUp0X&~}JPJZjQ@*pxskhBUF2u-+>qNt@r33 ze=9*>Z4tn{J6rx`))`U5Qd{`;U&W(d^mg9%c}Ml9;P#&wG#7fBnUz&Ox$pLgD;+GM zvQIQm_37{6zYXm_@c$Vi!OvVLmOs=F#y?}f?;bOhyGRI#=iBW7zq@!LjY>wRB+}Px zAvj@cEu56kz=WgInwu9K znwN>1NsS}T=o>`YD~C1dQeg-503z%C5-33->EJB5h7C7<%Ek+TTw~+H!QS9cpUGU4 zN41TvZRkIRTJQ8`!bi6ws;dW8rrLq$=P+kFHsbgIOHq((u-KXqkV?6}RKHDhJ1E&d zq`_Q)95jn(y|H<4-);E{^3bzcAI5Ki4=;tYU#%T}i3ejWY-8m3ek&bwv$NI!qTd6X zqc+2rrl~8RBje0BLkW^X2nAF)TC&$Fy6Iw5OiC&&D;3ye3U4WO^Fl^g03~+xB6z}K zQ<`vsX*P^EoW?11uMF=@Y{ zgx~Q)!Y7irZ#31uT1pF_6xuJGa-|pRf&4h*IJ?Aa-L*V7>7Jk__p=8qE=J0J40c&$ z74CS*kzOz`M}hV9F%Bkv|3IHwQk1##c1KPvz^S{Ym%+jplzgC%uc(nyFz-eAylZnL zA7YD$i0~Udbys3(XK)4p`#*jE+~QD819gT_4O8sicvv&ZJM^#A@!EMdZhJlJ$Kv&# z_CETrIOI<%>Ln!EmC2um`W%^g6<|qYv@mESIXhcWRk^j~axTqT*vrpr*N3n{Tc9)t z5Gqx>ievBCjdm8sk_51Xh5cyrn_S^F@QM`gRM^4`YOCyb3R^VAhE@e!MZY6(e0&xq z=?!XTPL?lH>mpLWKDcxLtAJ!Y-!=8APQ1T(9NX9|KbzW+iU{{#eST(YWer@Zp^Z5( z)HfTeywkUKOMs%z6-!~7tjY;$3c%KiD}2?}h!A>^J_MGYDzJ_eJ+*eesGKmw31gEZ>4QIOoWO*n#v}Y$_p5JQ^qUALYA2xDUq=T)CK` zv#PY|yK$+f7SVn*UM~^sDZ1s}Ki$qE;30mvgI#8HxqvfO#E~oJ;h#i*fXZ9^%OKqp zJI(WJiH1@w`%Q6Y!tH{GK^(&TH)#wX!VLpgj%9&L>C(Fr)i(_T(kKb<#uLTMmSRo^ z)rk^5$roMgUOgz~;pfbl=sQ@VvlHMo?7$@_2y*>3wU%p6OKY4wUk+s6JLJw&Cy&IgD?6;^> zyUe_U{_>_UbxFx1{UoXo)4#*;?dYQEEpb|n5LtK$EAKU8(rblpfwDK=J{7#7_lP|i zhZuarz)E7Xy>Uyh?PnvX-*;qcdAE%`R47CMyG5-$d-LqAYoOpA;_a{Ib)w_RJ|JL8 z>8MRjb@oCI(eMm$OsPNqdcZ5)zOWQoeMY8GD;dHS!^dx1cOuIN&DO z;qCEc!&W>}p8k`~E|1wK=R)Qh5q2@U;W&0U7h6MaPO7U%dPH{;m2K$l%B)V@hkvku zrN}dQ`yqdE2z95YA9!HhNlfp$Je;Hx{smv~fh2EMj)| zuj8dETvD^R{8KM`b1tO-bhmVTsh54>>65{-GOcj=%-1eaOg#?*FOA>$ zLBB1Mj%Ijl8y2g8^fLqZ+)*UCWnq6NVKc|!LuMH9TJOgmo81FtR+_RHR!XhV@c5>R z!spiJm>SOsTjKnq2Ti`#9qExD=1V?*n(#;-{*qqH-*FW4ZPajWEjVK!ScCcNVgyV5 z#buE*y2UlAp~E=$H5wXAk+WNW10$q8H&1&L?WExs^PJ~>SC4$0ilntOl3 zm$dez+=p+hrrQPaw(o0j_95T!lxNg>)qt>-Rgra&!_v*#0cj9=U`T8BmHC*R-9}Q9 zgeWPg5m4-hfwu)go}V#qyoUOwLDXYBs+-(idfNJY-K{>>4V_X;NSD2bmK56FKt-4| z%)pB)7rZf2ow}5jO2eQdFy-;_L&Ywa7MBU+2EHUizmr}}z^p$3&4_n+7DA9%s9H6y z*L+wAwocbeVW1Mkc29C;wrX_SkCFZGvs~e`}ma#zZb#V(BUWQ73;hdEdNu&KCM5rA6RW;#sH~5BGZ0b_zXpjG?~e`DtF8CSr_G5) z#+dHGy^?^FQ%4ZR2U3c(UP&TBm#bW>lTRxu_d~@m;Va_c{C5u()fK8gB?QVe z$g8s9V-I)|6iSs;9hC2W>BCkp&7c@GA6bqGnwEqJXuZ+PzhXq@A;Lo6P|5j)#Ah|O z#VgU<6U>*wZSGy- zUjC-%ZWsMBxRO;cV)k)lnIS$(j^D%91;edIA84`F^lNrFULl3Kb}omQ29%njw#TcJ z5q2FF4Rw|`x{Tv*Z}Cpm*zEV`pEbVWV*5B>p=1+yiZFk4Q!_ReI7pQEN36lKWX;-c zWNdU}-TL;Z9QbOr*b?1mX2uKCtX%yi1Jy!ysVUJ8?-sMP;-;shUudf(8D-j-=1uTX ze*NP_w0t9tWfMt1ozZ-( zQiQ_LfzhgEX7J4sTB|fklfe|_A5p|-?AuwjUX~F&6A##;L{|U?n+M2Ov3BEfI zPmi#ar97YnUY4`jt>oM9sH0c{KgWbwg|UGv2b88cTx&ZOlXH(s(th5U{G|M9LJdRm zk%Nr7|B98$vOKT-gc6NMY=r2ON9@uA_nH`4%Gr|FcAv^+e@HL0)iZB9V8IrHLmb}d z8ZvKqtN*yt_CEV_Mfk5xeGNNSvu#d;wSwQ$C*+!hPuIF>i}TlYM!0(A8#8L{Jf!E> zK9YssH*_iGk1le!BM5R~3O}XION5c`#SZGA=n|ev+Y&r5} zJw6KkKcF7qtCeo@RPZ5>irj7#~_4iN8;|W*Xx`1xMjw{(E4i z+amQK$3WdI@b+@YsqIGlg_l>zu0ke#n&Xq)XjvLV?7dc0<@WhH_xp0T!76WR{P;yj zlEq#67#iN01!9p@l9Bm{QjQ>Y9(k>JjZSWJYOBR}k;8<9Vps5Kgoa7V9R~OBN28xE zZu1U91yyOir@KF*ZIqBJwLZ=d;81u`#n*vx2bY=ToU2bb6=UyIa{-~e*FY;SRkILt zWDL039=37Gxcac58n8*DEGz4tZ=vd6$0HT%1D8e3I#*C1W}5?xsM-vO&YppAAT$xHhVF*haBg1qv5CAeO!Bw^>PYr@%YW5&R%W7+L+6R z$kM~5liTQiR`di7?;iORiSo9}X+cJM`tWb527ge@#tVRHFaQzX*XdN0B`HKjWy4F- zLLD@TJ)U-I%M(HM9tAub2bl;rA1@AU_sto%9 zgFgUdAOR2FiI2XY>6Mt))={&Y7izsSNUkL?G(@N&Q)(KQ0;TWJ@RCjv67RdO8f-C?KgRk?sL9Xe%dYm(EbkVX%KJGSS1+VYhKlP?|)sJ(Z9(Q2Z-4@ z?9*~!g0JF&P3t(uwZ9s;i-~veJI>s0k1U%mLQakoS7)UR{{}t#S-9(+gfXF+Qp2rD zMMc^2ni^mu0_X>~tu&)O38?!C#h)`f<{W2SD}HyH=2;m?61OEaUgP*FWA? zv#31)-_#EMCB`#TW#S|f0yY{Pc$3m-t2}}PI)5!Sg=u(>A96TZwecZ|U{`MnyCdn-_8Q#*I2VW0bmv4~6?}yp2 zq$O#%WoIm_-CX06tnxp}ydG6{T%_Z2cHPDDZ~Z0D%u#uIO%HPg@sZCGi^IWxbT`Vg zv35NHz4yD}9UNOHzG=zm#?_bH?X7Pg2d}<-k@@D?fLnz~gXpt&ke8DMOMYr$mjbf( zf03)}1;)0%U5gG)0S$+?sXG~~N1qzXlnw4(d3!1PgWWt?}}L znn|y-5z|9YSRlU}l-Q}u1kFvrK{7WuR6%n#l3p>BvPScl`qj!p|UO;l4# z8uhYa1uvSW@LSDr#hT4=j=Is7?R-#YcklG*hl5N1v}XL*;T3r&wV>;KTEaJZ{df|} zSx&_msI=Z_MAs5M-}S|9JTM~jLCI@$)F*>HUPRP)?>^}udk8DNt7L`}X|FSQYGcGZ z`^NVHU%{YT9`-HM9;C1oQme=NRPZew9^`|)lxCqP>W_aiAsRj$&(PX3|MA<^2N&5D z=Sv?^A8-_9yoz}hBe;9h^@@JdOFHeji%KuaKi!4~kg(q*p;?98d3@`|w+~mH2f)8Y zds~geiQ+9UJ+KVM#8^1b`BT_rQW10ajilKI zdHc@dM31QN-^GhnQLEMkoJpR(kl|oiH?&Yz#JTuf)YL zr%6~ib*^w$YjsTV;M~Pw^UaDc)$8FQyqpT_6U4E`sy&M$Ihd!dA3DG>l8CtE`t^l(iaNP+WYxzKe3a^1A4rbcb@bEdzK4N=j8L8T7J+k?$D#uzU z5Y|oGHx0M2x-%LIN9+#GUN_b+cQ=R#rxH(#L7x1IwU%3}2nayX!e*WE*EmxBae7NXOfgRxK9MJKN_yAcqUxqDAU=H4jC-j&{65PeZzWm6wPtw;SUq$^?>PW zEq2qIOtFK}tqqcs3c~TJJ157`LhD6TvVh9#h{&dX8DNF_0;Ugxb&6wo1wZ|LCk_$J zPu~p{FQd4z{x?xtG~Mfdqim7}_Q|IQE}xPY5j)84ZO`o%lc}@QOti?j+(hF)Sb+W$ zpUsp*Oz+gudIcEfeYlN$!mBTdEg@ZDbKAnAP90Wfv+Rd14`1)jHoLD~U+}0fA@yuV zh>I(cNnfPUXWYtvu4l_GjX}I9XH+W?3N;}bD+~7~?dm&aK{Ok85}o$l-B_M3)kxPb zkA$>knXOOnMK4rCiVgPLlaMC-sJLj{Ns?Oeac%)r&p5mHgn%;{s@@$#5SLl(++QV| z5IZ)rJWwmp({(&W;$QjH0D{i4V?z@^ERHfx9X|IYBp#g1?u5N)AvuR>#%XLaUEGXq19pN-fwurSVkUH zEvt>R)^+(v%>4r6AgLx?brB0CNzuw9?#bE$&-NwL$}HWJyggna?YQ=5Ilhevo{a5) z{ZOUC*2w2-jrC1iO%5(GE^im70LVz8slK!QU@=`~cg0gxJ0$z*UB201Y=nm*O~3cM z-87^PN9t^ov?a`_O_5kb^Avcd^_3%-cYpJ5o^RLfHH9X*q%+eS9HD zwt9j1;;bpb$YAWOGG`@3QdLrH<^#R2m`~>tQrjMh_P)g)$yF_e6sU-q4lZiIQ!ScFw znh%dA6Y``GWm_WNXrV|7ovdk+eztRlQo6rISiT|1`d3-VKJYL}BKaAPE)jV!4JwNO z$)by0JY6#(S`HIC>nlbfc@Kra$hJvpiUduAY-U$LeI01X0_tlw|ixs z8wPIuECcy2?x~>*o>pRG(d#u5*+wzEJjS~E^kF)|mL@%bbwGg5nEh0_*&c5*&VmZJ(-gf$Nb^x0XQ7)q zI*i0!DJ-%nM;6>?TZs?(0WG%nQrnOP^GW0%gn&SVfvLjNsFaB&>FFH$@^+J+M=3(P zAATHTt(|SRiQ)zRu~n>#zee`zhUFmZQy7DM6VE<_Q{e*W(8-CF`B>ap zBkjs|9}F)&^p@YFNK})L$6x8!`}=$j8~b1nj(-`z@#(`v2_Iww<`i+gH%a(Jzn|I7 z7P`*7PH|x;L}PdF*ayQW>2aJPKrb_RMD5})>}#n$%R;f?eQ?@#fTlSRt&(7y zU;TBVrCh5)uR&OuqmOYMyW3mNsh|KxEob?&bgzf2HjRuF=ASrt+L^`hGuAp=5|VRw zq5e|UFI;=BGCB&{^U?dw;^86(Ta#tpfa6ZxP$@FI(~a9=M_Kd=~MyzIub8Ap9{JVEAL0O57PPwv13cdAGm%?Uv}=<=E0R=h<30vDo zMyt(6H3Cb|wy8D{&K(Exgi2y1f;Wugta@ecB#a-dU6~{|TWyEj6^aCTHoEoEru**= z0@?=whjojQK65%C{c6jfM|&O=$KM?kQa6j)2g@HiK7WuL)*ksyGuG{lnhAYI_(@vy zYYfJzVl(YEtNeX&Shja+CYLzCoajc?H(_}2JI1c!)L5j}t!cq429qS=V%)&fzz*}Z z@9A+%^@*y_ls{RpVP#2*eY(`e%oSoOjL(p6G+E0kUqq(3_riYakCi+!dU}*8@6wFQ zx5Jfak%huVATIje>iF0$v%?1RI;XdzF+D_=v=9=Wvq~+mto@$idbYu%QJ0S1qEw`q znN~n0Fp376DWmK@-B~||j(pG^Y#c~M-c)Rm7nsx|LMIybNx+hpZB$X}*C_)m)ejkb z!ZGs{$5NLluA_oj%oFdZI++!B*^nD8HzNQY+OQnwu4DKG-+qy0E1b9~u`Wj(uCjvS zhfRtNh%0A->8Dd@Z^MDD`6sL~(NZ%Uoq+QApkuLgJL&E>-PajUY3!0bPGEj0L50HI z`9L2jPA+|#YH+#7eQBA&@QEV*B}$2VlAEA>Qx)QULdj}uVv;&2-zYh+vwUxF{D@pe zMjp)H+ier84id-WXL@U>OQzx-SAdv7fJ2Ncg}barb8JUtoxLqpoI9teQCWM3!z}50 z;|t0@%nz%JB(zx%TTB4AuN47~JbL zvRN)QoKMoF%c|F~LJaPA7{JBz)CVmjA3~u_hpO`)7wseN^^`o%tHK(-0-IyE8U00^q!!8b5qowXGA8 zWWp$8VC>~PH90IN@p$#e0nxCg!fb7PKM9>v-GKW_YjW37wxOzB%%mB77EdXPi_e7? zKl5HpS+Rm*O<3B~A+{JAZ9#C&YKcL57`>(I>Qt_egVtxy*%VH$>iHR3 zYMCo!W22p2k%;M9m_(N+W?o5XeQZJtUYGS$LGf{=tJ)7~#$#%FVH-^;m-Up<39rQE zZZb>Qc>KtdP<8zqcbz(X&`c=f=AxXpT`(%ece?~vu^Ov<+0JXESXAL&>PNJm+QGqy z*czJBEC92^x=lt39L4(=)1=@(;{M~!m`Tj@)t-4ZS)Oskaj1;v2m+p{xKI@rz#T#ZfJ|rG=MeSe_3Jv;AzN>GVqI z9#vnh!yCj|s$D+=Xt&&gnzZMn|8rP6on&^FODUfiOSQErF_FbJ`0~U28Wu-z%}AR@ z(9}`#AQ`v1`nr(a-kFc%L!`r)1Z%EW{#hX3nxBIG*iWjnvaAQYb8=_b9{I0)ZKF## zv`J1ncDPsW7M2iiRSg+^%vEi1y6F+$r&mdo+Nj=|5X*hLkkgxw-ToH8ii=ft*=CTM z%gn04Ms4fvb{P0Kt#2&m@$)Ak@ccE<-ToR%f}M@#Myx*qFN2usA)%YFG8!mpjRzaJ z|B4yeBO3UqBVHt=j6Nm&qDTmDtbyiBid=>12~;i?Opx2=*7UMC4vP(f5*)(&VQ$vg z!PlM#ygcdYgqjIygp+$ryO?s{-Gkqa3C5lli;=*bJ{HvldaufDbOEgFlDugo{grX_ zwN3PJrJV|3mGOIP$jo>!g`8S#WBknJC>X~3&6ilr3H|Nn)r)lvdUmLu1&%8(Gg5KuGrNols$GJ^KfIMRp+9pUY8j_^Jaxu85tn6z(vR}eEH;QI@7vp~o6 z(3*65+0ZdrL}-|zPN^PBq6iR0Xvx=~j@3uObw-K|#IKv+!+s%D4z5{VA=Okp`TS$Z z8(ev0^!dwFjxzdL@^x(So9~Z|G<5aF#fy$Ex@2|1K2dRm8~HjDU-%u3MjV^?Dmy!8 zWfhPiAyMxvy02T>e@AA@G<_7HV##tI?!KZJT9~%rmr+6O0+<<116<$(ox3fNs2n$>1(*13eiAWBCt_z02@36L_G-k~Qu9VBrhb(XUqCPm#ICLBWppT3-8_%^=4&YQ`_WSJ*tr z=|nub(~$eyxXF*4*@{Fpzjs&`LD9yIQ|6ltxq_G(4)nI#&r_LQ-J8n?^^G3glc)qI zH2af(uz)7w{R##eylMN8j+vrK%IR_12YN6+i(r*pm}2QO?AH(~Qst6hddro=t<;1> z%{p&~ti)@8(0RS}&~aj?AEZ&pgNShA*6vO6M2>*1j8UZQ*Rkk8{T3E!U4Wok)wfg}*`r?Q&er%ukp0l@{72daJ6s%*6 z^x3)AKa-3-%oHg-9^A?oF*eyBsl<`jFZ0mtUb;0}tcPfwB=t$(?O+>}mn>;sOq#-} zbyh*pGxE>^25hMTDa=<+pedd%Fa8my<);}Ee3 zZ&oIObRVnN*pY0C4YXPr7p)uz$pH|JFNvUCbhGuE-QdO`?a=TKqmFX0k4&S3{Zv)8 zUvf;gYT2SYW`?OX|3~G%v1F-B(W)6WPZF*{p6euV5pkkpr&1kP$}9qKKoxPmnhtX@ z%dzfO#G^A4H?fVL%k4f(CP%#xL*KUL+0Y9Yu1-a!#sR=!vtGT8kJopsRZ+5fk(0N6 zWzT`WP}Dp|aMTJ|lhVt1S#fG8NDiBhi%K<^e>#4ekkz*?Yu(o+xhPk2LvsFOKg;9h z)m%30?0(qQ3-5Q@vY&Tv_8hDJdIGHJbY@}%HRBszjHV{uY5kyjLwFOUyLe15$+tR& zi{+OEkjVR$0hi|xc`93z2}XMnKsfy_torBZQUJ#v=5Q<3Ipp$w?%FwP_W8~^PI%#- z=Q)UZ;iklg^U}-Jv_EG8{!*O-ez@@Oul>7A{yj^8Iq>g=19ZZ_g96YA|BjPDC;a=> z0d&H@gTi@H`v1d0Vbs%orU(F9FFgNkn}V#<0)S{+CLoKlidQ@r#r?lKO&Sf3gezMZ zEE1IzVJzoe>-#9udG7Av92L}m8?#F*x#wKkP^fcGNpRd`>Q&U7;hwlt%1}etDNMhy zNeeCa;Oc;OtYi(=%!oV4$ee%9mxS>XHKVH3J~Fpk$3lqkV*_GuJ@#<1n@J^tQn>FJ z|2>GkjTBkzS80?Se%>}KJ5$((1dwH9iOgR(9YGgEVgEFQmI4r()5 za$9pnQI<}M>uSRf<8(|w=wb?%=AteS1vrO=D+Jldt&~&sdjs_V(-Z|SH8~hxbRpA$ zL=08dW4rnxOuckZ@CjrduLdE_LiwXnvIil|GsG=yJv(&-v#`K&AqH!=H@RxsA6xU< zKpe8Rp(dLkm0*~lQ~k^Av|_?TQo>^tz`j9v1;*)8#9Jo_F$R5pu9|qwJNuXdU++PASu*FK%jbH6#p_AhXm+k^R{mrsiN@l{{Wjl5} z?*o-^7=cAFq?XOKS?snBQYzzCkb4VPma?&w{DY0XP7TNWkhn3>#s3!Tg`XO*!vf@~q zx_Fg}Vx+AII5mbIrAY%)QTMfsjaF}P@ZK+xtat0H@;%@91UR`eQ=M)%5JQRkwToHP z4IV@vN6f}z6me=Bx+OKjB-FDxS*eOlYl4?T!DEXtvQnBpOBpJ02JkqT*H%e#Saf01 z&yosq)Vd`wd)MWHOfg6$g-FZ;8a9!h-zAk>%cH3J93+o%WnSY8?aG|*4&D2th7vBD z11v;)vsfp6J(afi|6lSO^$qG#?)pZ>g!lvUoT5qG7H!k zWQYIgq>6T3MLjrYti60Qt*A-UScN|j=I!4cU_Zn0Sfv08`2>ASkuY?)IEjg0dqQCv zZ8E9=jNkf^5D#4{>7r4sJNrBvZd6uKQIX}@hVRHL2~RQ?QV3BuK&R0dJhm})T25<- zh-7-=)R(5H6KQy|PNxwjexuH>>n9@R>3SD)uN_7bS9ZG6*eFIbT9B&gX4*ZdhdRF@ z-y4OecD^cMR6yl$hF?zEv%%iZa`6DNjBX2)^~J-Yl|7=ofIn(L>H5UDEG;0Ef}C{< z@>7U`QZD&@cTcyzvMsAcgh$d+G#C2WR#~;S2~9IIfJ$b+DXYb#G(rr=>()=$ z8huRT*qaXYe{S_DV-3+rAhHGFj%hyq5W>dLt)DjHI-ShcmTN(YUzgk6Jp&!f#I$pm z3-{@s;OhC!bEc1*6s0_-oCZ0hCn~ID`{f%J3a1L~jJZXqrGT?S>qkFHmxUD~uTK68 z$^bV0@B7n$2pMb@_F@*{irMg7S@j^4o$xo`4r@BK+-;w)F-nN{)~&fj@cadb=pr0k znsgt99??XMmvGj}<~RU-`n)W1C6)cD%Il`NDFMv!=+9jwt^XlU`tSN%2_wa3HQU{J zK->`#W1DRD(wU}7CGoBC%LZD$a8(Of@?zsC3xi1F)Gj&0NW|RY@@;^1`@X+8n^^p% zKVLW)_}B$0*-<~GN5EfNpsD{a1s#O4vLDifQRDsQO)UGpoCdog&06aEICtO2l7#&T z#FxQ&#jU>XQ>aziZf;Ia&iT{NS&Lui5q001JZzBTfNzX!+0AZZlV_#&uqXT_US`wc z)YQA_$6?2)(~j_si4F1HYf(zav&T!Tj$69^{h!2aB8dCL#~V>+E^?zB2Juq<)1Rz_ zqA20(N1&QsZ?g`$o>{AIyaC^)RN31NAB@MDi~TIW$$p2(1EBGHuSc&l0ucd`mhyC~ zhmZEm@i!BMI>GmN>Gl|H%*KN*$e1loNgDaS0D=5M(&ilmq< zH$$5`&}wOJ*5bP^sw$^4YiYoGD(lmmAU5rhU`VW{WmRV}omO|e4s+8+$oKxs!(o;Y zwN)}z7ILG9kE9{=1ljFgD6Ttp7F#MpfTLIp%JaQ94H56AxkRLd{k8`L=wAVCwm^q( zkwogmH+lCSf}U;iD9=#MI<_c_AR5glG9AkH4?)IWM+i*8;4+$j%X7BFfL6kDUozLq z$mfMSOgf2p-?m-I`VHbm*TDz1=rPiv7=%Hhc|Jr-tT?A9fmJEWUGf%wdzi`J@_2nI`VjwcEi$9IPzbE_iY_ zzr7YBg{oVELYN;*t$SeJJJ1C^1@YBcj@}N(vY7V24W!VCs`WnLO>nRGwHVn8z=YS@ zwS=(cvhhnnr)Bz)h5C#Ym7dEul3w^W9t*&S7g{)4zWx;{2POV0BKq^Y#VS{x`}@V8D)^ zy$#ko8wZO}`jw#|&cmvkzDKK07=-d#JQ}ExU6`X7Y!u4NNCf3Ap?tF zrn!|wz{q6fOICuS$!S*~DDq^#kV(sf0l@r)L_pPWeMKFh#rN6UWtThB^Ll+xw<=aS zCytNutnxsogZnd3)rfWz=t27KOxe*VpZ0!}WAs4zY)$5-j%-CnSCX3ec?XhM-DuueC($5H zo55G{&mMG;NS1C7_QY`kce2yzJT*VVd2lL1;e`+3B8?Q@IvS`tMVw&_-oDCJHQKM< zxZdx-T3*WAxYmGe)}>=9oT%y`L>(GA507G-Yr#b2(ptO$E7VKwuhFB;MxFkRsdEdp zxk_{yrggV{@-PI%>9zL3uHg z2pVSn4!1%#c^jj(&o>R}l0i)Y*(fn9zqtpIKRs+Wv;jwRAiO9C5$?n-Mv8CCT`p|^ zqRQal^982j|5v{Vf_gPUc3f{4RiC!1B8E#NbpjeY&5MWuj2ba)h7K z!g3iGV46L)M7cJcY1$|!;ez^Q-SQ=@B6~qBN;SFs-SE+OV-=)B!gBTNh^z|gE6{I^ z8PSSPAVcnDd#Gy^1!E7DGzldCeB$AU`vC}$9Q?2GS zPRG>*&#Lb18Hr6`uWq7b-?OH(e1AmfG$ z?xCilm?fx)Ug$peFStM4-_CiS^PKZN=RD^`2@*f2K8xxdpRERkv_|DG-7L@ zgF*`eZ}c*8g*Jcy0iVzm)Czg+>*94fVt6AV=h!&CpuGLC9^lmOa?QPT^86TJ)~okz zK;NtN5sZ>@U|mqptNqxQh@^}VEw;D2*M#{UWWLP_P?7lbRL*nG~<57I>$_D$Y!6_lW_t;4h{H z2$u&kGQQK5;N>P2Vnbe=L=ZV8+13_7r(w&WMB=YD(X$IE%OhHW{5&VZ4z_D8k{UNnO;UPNtiS z?%-9&QPKScE@c5WGUuJ{n9pRlx1+MnuHf{KuK03#ht#gMU|rK7{Kls8t1!P_r5@{> z@3WM0(85E?-@*SmK;-YI67Ip{ex0*6UCWF@zkzima*~}l)>rd7K)}#(2d6SO3s-so zn;Y$ZQkHrr$8JGgYAbFtXKwPEk`%rA$ycv;m9t?5H%86%z1Je|1#?O`$vO3rl06bA zhZ&84`o`FEnv&lihA;$M5y;f*-6U|^o98MhMMr1C$uEz6-cS`M2l7k z`frxwDRo1cD-cik>IFjk!5U2tVx`aSS56JrC24{wGR&1_)z(`%*e@gQSOav#7h+g? zT1E?C_oO@;)Uw!$>=fNv=GNTk>`x^SQuqqWp5Io?qduxxQYRV;^%x zOVa!W+SLU%u_QrWL$~cpcE*Rs!05I@#WHp_|A8BFh@-}&ke@7b@ zGktV!B!)^F+WaW=Iv{%s)Y}FmzZ#+pr*FUCt22T4^@W9V^aJ?{Rg<|tq%iyJ z{PVn0rTCps+Kv8va4tcuCx@0lbFt2$o3WV!Ie0%$6Z4N?ACreH0fF0WZ*w|;F??%I zK|xU!dg;8&O>tnyt9vpX!DG8m+9b~j8mCk#-lWN`gM1Xkxe2&xjhxi}A-~B0+cytE z`S-k{`40s=v@-exi8%KCd&Uqmsm|3g@8!OU?-1wKUBlBd(?ECl)vRldFY?oBrJ;cg zMELCRbicl5i5fe0Vg2MMR?=6cZ!Bn~A;~1T?Xdxw8*0|P@eGE^c9Salw8W0Bmd)lm z8xy^Mzd2EQU*p2W1pFX_%O;+=JseNG3>(3n_3woIMzhSU#gRq0}X&pV|2Da@R$37(!cmMYeEGg}v#1Kccl zO%aM$?5tj4^s;7@9sti3?KKYN8Sda4eWDj;CRsOY%Md;ZSpdzI*qDy7HDiq8ycF@K zO$7d0oKagJI<<+)+ZiuZ0gnCo`5b#m9Z=1AawL?bel`3T`6d~b$~K9wn;Tn5ZHoK& zcF#quMeJ67exEoatWBTU$56&ji4MEvdYK0?3-74HA`7;CTXW36P!6jjikiZJH0HBq z?CEcbbq}dE0gEh*!SO>AXk;(2gJl$y3t4OV3$j2Gt+jQQP*d#mjAW{rGQk40KT}oe zyPYtQ6gRI^t_7dZBK6n!cIBvg7L>z5c1R|XUqb=v3~?rShWW$g`}UFZlLgP9G&au< zTGmyx?}MT=_S+0@;2F3!tis_;75zciz*8Pm-RbjC)a@N`tM=KTbYMHAQ6&aAA~ita>fx#22QU7F{Uu#?9leuKDa`+iN@nk~jml_&D6YjbZ58KEl;ajK_o9SNGSl|a&q z{01xbe;`q0gcQ4yzRw5;7wZ;$nWSieIWKk}u&tsdFs)hD_4Ot}yZfQAzGExp z_W6@+@uc-a^L}uCq14Gr4UWf#pC2K^mPC#Squ3aX{YZj0AXX}ID)l@7a{7s3xQz3p zE@itj7JpJ+(rIVv_kT@%*@eeiA|@z}M)yHE8kvN_9eNVawT3{M7yH!T?br%QUtR?I z`EI=43z)HmY*@<<-c(hohryZJQ$&;SzlFL+ytswV?DxvF0o}NGt(PHjD90`lQx+w& zNOWsvDCuGJfdhv|t-&@RD_667Tmrm^h?`^O(25@>s=*~=Eq*J*39(XaFNFFni-yEO zDk9BTi=&0X+~fxA%Sg+B<$HV5iF4LwzE=#zAb2K9K;DZYRU;% zewiahFuwL!&14`fomUvJkw0)XG`O+kpDq-==wMOMQvMJn>o;Fva;mY086Dx&N^VR> z-xk#6rR3S$XSQTUg^^quew}93O1DBaC985wpHJKJinn8o_RiVW9m-yvv5G_BH)M3J zqEEA}&H9=#t5dHaVOq{F3mmn0bo6`d5UD3xq@XD;My*{`yxG*!tg5b-o-}{uLrmPZcx3rDKEiIW5|5Pf_!*hck z2QLIYie4BG(2lG9iG3y2xfu|&*pj2>p?-J-3DAQ~0u>b_;A^$q{RM<sATt*Ms=h71KBrg~E2-GP9M;{EUsZolL|8X*>C17>^avUE;dk3FEs|irbl~Ia$OhQc%YTCJ)RVFdO zqj0Iru7R}4!&l#tbFUoRm-tl@*SsasyF!Wb?lLqTm(`J~JERA(l6kN}RCQE$j#M0l zH&=&;9gu?M>wo+1Z8FE z+zRcAdG>``NBSV!dq*;V=bdXC=@sG1`{k5QwFSqU<&mGPn(VC=p80zzF^OvaFs40} zciG(vP3ro9o%mxp!OH7(HWamT1FQxz{6-!99f=93#Dfdx-79{sd58l2-9Y!+PL@pzIojS|!5(x@ylk;V@<+4Obo_KG^jGTOct6*5D6>k`g)25l&X z20qG5-M<2_#ZaFD5-TX*cr)b+bN~aqlv~5VRR_{DqMf6rh=H+jh7o) z(ifBfF@L%8+crp0VacOk#qDlaJ0bz?^B`3jow3*89UQbgrP>70kZ}yo>+3$E1;jIc zz0`5&rV!;oshjYFwZ9T)yj~0S>NraY-H)iYCtz#j$6o2>C;aN-6cBrMOFPa#5~m#c zg{t(%b|UOi_NISa$TY&OfVl3w`{d$`pX(Q?ZNFfBI%KWs*GWlA;43rYUZdt_=M~?n zaupbI@{v#OqO;O&xi&n;E;9}IWG=w2eC4y(!a&+zwQ^pLkzpphASF2GljI_O?o)1v`8;%!!iBj&NXxbObfT&sctccsmOwDPZFNCl^m`Jv z`&PsM-j%q52QwitDK0AcawkgnEb`!L@jW(Iu7d^tRo6sMQ)SNrL0r>t_y{*(yU0A( zzt+fy43ccu`Ef>j#&q+mQ`_c=HPim0@3k(4dxBJ_PTs}6!{t@;JEk!&a)q%0VgH88 z0bLv_Q$kLs4nS6iA4=8^=q@8jA44pt%xD+q3B&s3QjV_%8h+;VejjY_uVY|npn7LN zIvIo<>MAK~6&%`idw3^RoQDF07tvNu6SIW%GpI<9??ZuDF1NZUD1{LL!wR*e^njJ>)Fgqq}K7MIh9uMp?T7IxS`Sow+K~Vx*3iaf$IY4hN%O7)YIVC;J#$} z9iO_jh0I?S72z3~Sbv=rk1tiLsT?eiT}R%krc&=Ajw`%a2skeaR0;r&Q$%ZmG_#E~ z>_$xG7@_+%jK4RQ)8> zoOpxcBw_9{RbG&(7&x3EFMPv5gsf76i4;*>vGsTmq#CjdPhkg3uFW4nbjG4NKEJ8D zItVln!uqof+=S$3{Wo3|zc|PeMljiQMAXes2#~Xrg)DOcS#8u9TwH45HDw)4UBBBv^4Y^BZ&Mdr4`j~EI=X&T1cu>drsZjPpAEK{hsulE#;Z5%yYwLqpER7 zU7M(9Cywf8uvYO?->E9Fu;nop1wwUeV-wCIfY4KSYzabXu`s&AjPVsj~ z%Ww9*B76=)lnR^09L?G$eV=|jc`1KsqQzc`3nnOfix1sDnhxHF1>pn7fMXxvfe;?u zyJ5GE^D-UR$mu3^hT5K~(*4y|1FuKF-&iNK+uaq?yY$h0B0JfN16h@Cxd6b+puDZ21u~#YFN~ zb)5b1vGYI5Z@T^r^4YpAKgnkv-qLAObZttWEZ$=+V8X`-(iW-YwBtF}dH{e+Sk;M^ z3{K|(T4<@z3!Hq01c7+B zVAcK1E41Bk{vgZymALG?fjNuFPIulunW4Fnncy2TXowR_Nbv^{4?+&~K$?OqAd4ae zF;shcqM+;mnzt{s=YPSjKFqu|m&h&$A*GRQRS{w_o2Q&MqhykFs;3@;+f_=UN}i>lv?sPENXU3=lLy&{XUpNRds46)OPc< zeCabiU5+7fHk7;81?B3f@B-SE$>Qvs7yu9S(q|@Q{2j*eYoSM=Jo1IKE`-Bf3GF4J zI2L=DfU)44scEUmbe@>F7{Jvsq@SiMm*y6TCd<3fq+V_?9d8#-R9HB-x5ocp7}{Ks z?im!4oSaN7odQfux$rXDEPh^=reb@TV5dkpn5%sHxe0aHGNf?u^>=g{Yo?`vG$6Wp z9`qg@zN7261BPP!(a7DBqolp>Z}rcQmO|z774yrrwD4uoWM!Xq6buFfIm9?LgqN2b zzCg`$`Au8C=kK{0S_&y?-3`!23vs}cP)AXx4}@a5HuKt9c?Rp8NU3488f<`L-~M&h zypmHO$H~>%SvHF)koTqLgiPFgcTX2C?xL4mRVudn8+7CVebaefZ<=1XQ2H z|IspR{U0k$fEiOpz)DsO8YUYX8>I)hu3wU4U2}AuK7LATaSi#xy4l96y85~clm5Yx zddc%^ikvY8wZYg8{aHM`eb7hV%l#$ld6EV#1qzc|nY+0adUl1^+=x-?TjFA(W+@)! zsmAmpA$&^R$Xa{WGBnpWwKX8NKFbST95L@q&7=$*45H$PtVr&G-=^!>1I#W51bLV6_^j$=)WJ)S53e>Z&Lw5}g* z9~|tP)4F>MDY$p$V%nacwa7Euo&qm~AV-kga5cw^k;j=BA}?_Hes1l~wa{g4l5BAe zu@FQx-9|=c-=30T$b`5N_&*KVz`GokYp*b0+4nFP!r%&Ic zO=PfJ=a~JdZo<;)@J_^qTdWrNGWt_@DMHG0IBSm>hZA zcL=}*-qeh;Yi0dZAago9(5N7s4n}Y*)cXT^Fjnd2PTxhun`*@>BKoH zI#^*ht~y@I^6qC*mLmKdy=aJ`8YH0D}UKwLDTXxCTx<%c2!9=Hc6i@rkKE~aXydpzN*_LuhTjL7piQ<<1`k>qV8j?C3#kmWH}q)O|GPBu|}iDqAyIS#8S4G`l1TsrO8&8H2f=pWP#{D%dM z6!PGm=)Dh@Q#V_PyvTn^26(^3Zc7~QR<7_7-GXaKd)F{mv>rf|{GRBz4R#BpbiFi< zlcZv?>0xl@|4_+vPDSTs#FBo+8c|2=ktIF`3eRHt;-!q0-owh$_5D4Tf4>dd4BEew zpIJ4DA1n76F4IpgPw&Hqv1q!H>duS}4-AuM2HQyTk9{N#Af@>u!DXI~`oBsi8Sz2; ziwl?|0RLBDfqZY8i?{!w3koLChW*z(9O$Kgf<`w3gP?zql7F86?Wn>3hk(TYL)C>? z-{p#8rVRhQ2CcTF{7L+&gA=2k|eyKLjf!s zI`}E6xyc@3osm&6{a9;f2Qy^ z@=GUsft`D&rrSI|u3QAXt1*nlGRi+q!KKaE@P5r@cGud@lU9HGV=Hbk;Z73`pV65y z;kT2x677Cj6m_Y>lDKNBY}G4KE-o~N|pO!N=kNu&2J|OyVgB$hJ{_(E7n%%>;kKj8X zf-utQdh9GwpyPGkROjfk{WRI`TmxMP75eoL>~S3K*k1KMQ5V;kR+QC|$?E)4wWSpU!zgLuwJ<90rCQDxC22g}&GjSnw8|PxL^hMw!>tpf{C40+BGhY^Te199yB>NR4;{B8?1PQAsm2tM1 z#Bzs}d@?bSI1mjs6f^knD46ITww(aB^FpMUum{YWBqH;80o&Rbij`+(^3Xic@{;(a~|zS+fpjP4^mA zkFnfh{}0xz!^P1X9i>E^N^W}2R<#VPLr$CaPuj1**?f(R7UfUfsrx?;*IA5$n;O}D z>6wVFg{N(jiObwtcFaTHh;IZ1cbL(-1m$vOffy~$yt9_Ff64*>jUc$zLj*)tsezrS z{0UArN9RnN?yT0m-(hH}*Zje+QeC1Aw7U!fyjEaffvUk;ZmzhT@`fkNUh%4_YPED z{h-2%{8{~l?O&VV9M*t(X3L`*IlJap)xT2+6O*2F<>jaj`Hfs$EUeNw#Re>K&BvIU zQ66kopg5Wpz=D2q--_m3gl=%xx3KuQ{I2U9WbWdS-r9tw?o0*#4nB}zJRi%gvzgo$hcxSB>NSjTd($;*YZq8o4=nevcL8w@2@N%n6 zDQ6m*_*N4xbg5zL^2~eVJTHcaS%CopSHa%fRI!GuG*aknRq5=r-*u)Sk$uTYf+LH zDk2y;79+{((qp_$q^GmAnE%{(AXh3g5LVdiB&JM^pH}q##Yw&(J;Rn6nyYKn&ZkYT zFEw4MIU{@yK#||~7iOY5BSTRHpv22wi0>aq1C~~QMToQgKtt2DQ(gY9zS6Skyc6bg z!Ss!(mX%8_DfO-PD0aP0mW7ks(b3|@Si2PGP-0%kwid#hrsTSYBL;~ZZ~a1-QFwJ^ zuEM?$RG!&7c6?pw81H-~p)Q6|gUo!%w?^$(kFko>>Vs{SS1ac^!4C&Z@qtOG{=~r@_A8L0yUUwkMShWViGi;G-Co8TVnc4jTfe-Czzgs7uWThHX zy?HgAp45Ml_2aO8D0*C*8iR6Hcm)h~xvn2|9n9 zRHF7Pp$;a&$Hc^9iuuqsEWEYH^x>uEhII}`)|h0tu=?}tJgX6~|&iyb1c--$?9a=-EW?drN&ceNvPe#ZxNN?kvhGsEf$w7%Qi5NzKZz*h0} zH{WBnU_EThq55!g_33?o5EKhkng-p1+zNO?T}ZJJ(GzxZDFb|1JMJc43lb^1;|G-A zMbyLcjc&S)Ge~zG{&=eqa2fnpU|}KM-R=?}e2Hj=HP_k98w2+|9X);LvyA6Z(0Z=1 z6<3j*2*huG(8KqNCQ`il>?owM7!|~<%a@*?$Pvrf$b#EwK_z;7<9)k)dB&PBCMU*f zv@n*gwWCgliVwS!jSj9}O51d4x+(1-1hOOJhJ%P!ZtF(!ADeD&%ZAw-oWvue`k*G5 zS>H#G011luSXlzuh2{AcgVuA35;L~h$SfDeLcv97C^XXdmUGiiAp$517Pq+C?4Fh1 zewY|B1g1g=>e8{W;(G9QYu8kOw<}}5ZRxf~JY-d3MSGRr%-5v2YcnVa!!)k8d2 z^!KmUxD*j~whpSwP!+QnYgyS#wH%@6EBsxlpXsrcs3FhsczgBrZD{1#+mKe&6^6LJ zp4OY&4chGeQynUW$U5m7&JJ99f|lc~+GLM%E!e|qUX#JkM-eDSS7jOAyy#xM^ zp(=;wfPk*S(n=PN;5SOT8+TFfa2A3@gBmvCYNS(JEN^FZXM)R&%s0;o7CN$(rEd|4 zzux*9+>?#mh!;t=_AxmSEaG#kAx0oH42R=l5@ofo+h8!dV$ab1HsMk0V>2X99&)JCM z@vHgbaJOCRqk}8O&2JH0^W`Y?`)`Pa`(#n>6epFd`&}tNEz~nzZu-kt$h=2;RVjZ) zUN!+(ECfSZ$>JizU?4uD`}#c`-1l@<@=}uNk&mWrpD*;%9uJ2`nbLQ7xm>0eqMsmM zM>!az9T%Fp+J!9nH$dHVv*}h3`if{UG{k5pB!nAv*r5s(E)>BS`w8V*4={4FHL(E(+r5j<6vB)*Ez%FKw!ad%mc9CM4kRAn*sf=3 z>@x_}vskQ5!1S?Tp`2KWxcev{-D@wwk)6!)~cbpS0Kac00OzB!QK(`*%%ynOO5?IaZ z0Wh+Yv*;=%>Y=|^$%RgUdBt>xAF=g2gY`7g!7QwkD{8>oK;E4KX_+Z92R3&#lhgr6 zH?PH|CP0c_H<5he>K=VeUt#Cq8Sa8HM^(mVZ-1oxpdD8ix><$awj-A}=rT4Ud)%l0=T_XN#U2QerkPO>nsYXCXj!Iq zwZf`m-!$J4iR#WiiJjlYCil^jllPcBQZR%T&ox~dmoNfZ3M)f8XheVY*gk<>P-^#H zR51jGMZS=y56_N5?CwdiSXIq0{!`yl5hKA(4ghqNs#`bNVo36yH7#A&!e z_baJa;KJubZ4k?5XErJR&$xF^Mzk(-T?c2#MyFL)9w;>*@R@CYrw|T--?l{tDyx}D z2N}ZkqDRwyLt$nk&tAbC=aa!i+$T`aENe0zyJl#7w!TSC{pU+`KDwJ4v~+ravcz}H zq>`=j46K~l1*NHMy`3RJhTgK=1%1d4985R~0p0fy&eo$gw-^8|e2s3oM7@5{)iI#q z3$Kz#l#k8US|}3sRnXh$5NVMg8=PL+@^JUNrZ?q-HX1aNjpZUQtQ>E!ur8yDak<$f|ke2Dk9R2JN~!~gF+t@nTw=) zOZRWEZn=l&fZ37$gtxn4Y_G=M$y6@+)^@N(SFU`n{)?gY4yO=6^M21yblRU)(m?Iog;H{uNq4SlVMQE!kaDFL4)SYocD4Ez1joX0o7wJ9%eSLA(Fm18!@)Oa=! zsHaJtT>tsoS~CD%Be9-dP5l>M%D|=8kvbum`f@N_lI6Xfxvu7VnTZu3ZHSuu9r=Q2 zR1;s7Y0XkW_XcSg)3Bl^8EJ}!%#HC7P(P<3Fp{j^_NZ#=;5J<8DYLwQs;NcK_B5Jw z&s{zT0f9&UYd5gI_|r_tKvN|Nf-1JEfqPtT#!0nf20>wi!0ar!U~IL|1n&L}4RO|5 zzBK+szuo)#Mc2LXS(9ZJz=I^+{tk}oXUmI%?Gx&>!dxP-So{H1I0X}4$=!-FzO~#$ zxI(V{uV)2jc}GVOn77#AOsVYv(;@4Z=T0d{bU&}(tUzCS*4|xrl`!&Eh4}(shDNQH z$x2K}7)njJwcKGL({T4Dyv|-#|NZ0xT?-fu1qytd`)2AkDHbnufBo(BqDx1 z>>?Zf?NTPj>vTK4p&?9p_l|mwYbuIk+-g4iqBS*#p4!1wj2O*Jxaa(^V(}cM9QTQF zg+YeVa<06GT^@%dvGsFFV|k?tjp0{#8x-V=+TJ_&v-rt;rmedhWKKQ1JGu+~3UgmO z<^FPqR>;wT`M1pLD0vEcZ#&dDQf{iNEJN!B>S3_Dd`4d}dA77eun_WyA`X6k{ewQ4 zf$uLot(4_f^j>_{_Bp@2-Lq`tz{xE_RHOkDS*=T5x7GKqF3R79qgZwsjezEk^J}W* zvDQd$J?qJe9Ou%UypF4z|+d6vwEM3jDU9R!bybbvYBh>R1&~!*KX**#5?qaC73I-Tjo=wrdb(K_vldEd z>57Npk4z7YlgAI~d8v&NM1Np3F$+{EkOLerL`S(Q? zA~+6<%GQJ%5{&%}C*lekLu{R^qq*&PMoa{1HL6_D=m;O?#?FG(ZKG@z8JgT8o+fU% zq8X~!Bb-;E5G5;S6?N@R%hr`7^yh4l>_Zeh#3$w{<&2|oP1|lC-%4rbc;PZ76J@hj zz4@{p%ZGuNfi#3uFxj%{a>9L1RCWT%7T_b>bgBH4axK}rFh}yC0R6Mon*Rl}C0hV$ zRq8fhuAE#L%B~U-N<5c4K1--8_jE<1H|Ks*bfVj>keF%n)8ut$8iH%2M}-EEoPsZf z&GE_^K)}8SgW>QhkIBvkaP6Dz&b!GH^GhW(XQw1EKUqsjE`82PZ<(DecK9|4@px+4 z>xp<`w`iY5V9;mhU}I)AH#eWE?CqT&7<02Q6niut3ueUt1P~;Q9o2a_5YN5N>2@m{4-DWj1kTk}kDFy#rb4re>5@{|T^*aV^mKX5u0jqn)NjV%Ja zXlRNaZ@JIz>{@NL@LOo1&qsrvg9WxpQ~P4SZebpMGrCZ2FV}CTwHN16Xkrte=Uf@& zCfHbT7W`zZ9775-=EFCnMBbP&NZO=w*PG!jp6p+-tt21sH8|f$smYb8l;Jf^JttnP zP8VeNOib!iOzENqHdWwh76|BvpK!3SJ2SRJ&u)BKuu?Gbs4!1Gap&Kipx`GkdO&;8 zg`D-1n%!^qz2smPO^Pn=bSVNpKm?JTgjug%j=*GF6Ro9fRvXBw-Gguk#_CRX{KW##_2H$9WM5R z$i-n1j`t!IZ}{WSy{)Py*wsUkI_QK=x#-p=A1}=u6wlt_pZogDh&i59HJ}2O^V!q% zT_f~?QKrqEQhlzuNupGr$QE%Pers`EkhR>a~4y`EU?>}#1u`XskX0=qy0pn8}?v_yAhWx45 zghR7+8)?qW+3nsKT44Z7;-iOMn;E?IJr8hm)6HdNR%-_62X=v{sO`qDHoOTv5yV`4bbu^_y$RXkuIsG@|%~RA0WPo5ebZ zVb+OdM^1$KiqL$fx0Awnth9P0X(FaswsVvr#OCnQp-6iK1Q>AkPw>TNkj6bU0#64* z+UT73Io!ZMo(4O==7v`@sgt0d^4}l7teZH$NQsxP6ybl)R((%bA}`g)Nx4x53Qi1U z5kAyg%aDADn_fZTclz0%lWS~q6R{+j?I66}1i6jaUdqO7iy)y7NKcSR3CNjV!7fbk zzKg2z;nRj<$>3>aHb;A$ekqzJp>3=hG60aFKjTzk2vWIUYB|ldbYB zNY~(OIw2@{ZFh@6C|`N!$(Va@*#+=d8>@+zU6;1zO^W@(g!o)^5!pZ4d8-fA z%a*P;Mw}*NnCzOle$4cxi_5=$<|1!tOvAbfS>9>Za-K$FcC{Xf5qfZo-#JX+%Ho5r zkM=b_pEJcdrw3fLL+ZvnPw0*m#9*>AO&vR@if4l_O6Fq*0{N|ZE?ss znfA3U1)|msmpen=I0?PoUM#oisRTW(Xo1&y@;0d}i3jiKnEEOrPYV&`9$kUGAB#~{ zI`DQe8WzZp*FbnEtuK#mhjn0LN)rD0 z7PT&y+o%9dM~4NNyhY}Vb<%Iwl_>A1x1OoGwUkB@yFXbr?y$)E?+w!RHP-ViTlY#i zq&ghC%W=(EdDRbgwmmMGiMc|60foVp1|*PW2+-k{FV9!N(gx)ALP0fOsXWX9+S`gX zstk4Xb~D=!;FrZET*BQQ<;gF2Ccol9Xg+R6TDGTopU=)?Bw9VAKbbL!Bo7jgTMOaa~;NI%njw|K;wDXW*?uq_e%j=2Tx0KRTMNQBe@66hW}v! zlhLW&1YL|_U)gmyNEo#19X5E=ID_o|eNzBU@R^ejjw%bEIbG5l_>)}zJuwyf@2}4v z1z-Q~H2h}z1U}a9B0)U`B(s$GbHivJ{CgH!K^c zKc#10o5XE4ezVTyx9)|b0k@5tVE)@W5C4Bx4*plU1JGQnvdxv*r-4FlmvK-6LnR8I z4kM(c#e1PFV}MpfHdqTkENP-!ODho*F3ypQ|9Y(b`Kz4l9BZ8?2b8bM}`bG-P`iHbCW1i`8b(l+KuVRL$YnHsQy_29vB#Z_4+Wf z_2x$O;SMr+&P+-D1{SFeL5f)Oye@U1r^n8=yYU+e{tf<7TR^iNH&4lu4-@jmue* zlM_YxNzL7kMQa1`2c4d$pdu!HB;{G(pOh+|^CjTr96|`L63L@28kD}F=3*jk)mj;x zcUqs7MD0E#GL;IY)#v_4*UpNIU!XdK8}EKQs)}5;0dg)=WlE{Y;=_2FET*DCofq1d zD#4b-`UxeU9G9+yBJ%`?hxl-c{8e5e?JPN@~?YC0+o!FHIu4a|!OX*8;7_mAR_JnFUQPYvTfw*xg^IEhG^s zGm!JHCM^uQIv1wNOUf=+s%Gt6c*VbN#INy)){i5?NdH`uQOEm>e1xlxnrGNKFOq0Y z{75c-_RjihRiaAHo5<_9VeW1j=t;qOk!&eJdgR3Kw8IKRN%~05LzW%1!5&NLSwWT; ztlF<;tP*X{v*I@1E>Q;hNPf9rpiy_@Q6?ruP+rm?`7;{(pCl&F%(D_G6sg;FT^xoc zoTcc66jQ(h!LJ2e4rF*TSs__jYYQuAbtv`RcO@otvs;J2PM-nbB&xh{l!wDDOfM06cUv%Pl3t(R zxUIZ6c$-o<_PDS0ULCwcaT7&=_I3%^`@mA*ZOrt~v$O)?+sE%wJ@qkiu?Of|veCHt zo!&%g-lDli8-^XR{ImSJw)xF^j`{KQc4dlc(N*-#y|fifG^E86vn^NIq59uTlV+M5 zZ~Zw#1bO{!Zi!^6<9ka*=H6&^JW$OiG9x(<@w4owY$VW9Hq!Q4ZLZg_EqQ6(pi?>F)I~x{OVY?@L_?Ry{|Ckš;;!pjREgS%ie^p`y_~|#3 z+v-4o*Li&D9cV8P-v4pUuU>MdSE|Zq-iMh~T4K;mZ=#uU4u6#5zQUy^2wDCFt5Igc zG+;zXZY+KGnIxb~mGMD(aR{3zSb7+?kddnSnNrM@c%r!(o_zQvkz?bgRzA)cXIV;) z4(&vaA6gt@QiR}wC$L^uY0H(IdbsFz3evGLos6hxU!#4s^d<4oIEuPh!GgS&COXIP zDZA;l4c@YR?3r@=jbEEBPo9S`HMq*AWc}%Vx{d{`_C`1+xnzYr`>H3U*~jNC{LRo8 zzRI-G$hpPg*l5xT9~II#)#qjPYQ12Y*Hd$;3WdmGVm67X4* zQm`#h(^{ErTbe)KrZ6&FZ1|JXL`Uc5Dj{d&c~d$*wm~ogt888pg`4zWDmevZ#%G`t z#AmbY3zJagAWX=d-c%4|5jH>B{>=!dOOjbJ9|N_bZ;qcJnDM%m_9Vov$~}P3PJ%Mk(<=s_kEkS zFAX0~0#?IYQd0u6$=?p$3#-{)veABZ+jPrHrKz>Mlk`2z9UWaoM_bxl8attId^s9p zu4P)zc{0zN(V8K>5>z_GTHyq!ohU9XiLTF>ZCi)_5F?*_qX(i?mW~1C$$3ov2!q~I zS|ek<+9p4%Q8q|XU7_y#!g8FrX5BN!MtnecoJ9~hHwPKhlKs#s5X#}SZjVg9k#%GQ z8M0zIqfHL>u`?L4I@%MQs9dY6-2?ONR93?m z_KZMUNkHcXCx$UyTj+4Uc&o3bTq6q3<1vPeHT8*ej-!m~A>TFCAz`qRT;w z_DLz_$uB7>$SjFB<@DAyR|rDO|NeH%IJgir5yvWIVdz22Y_ET@wU$QW4VA*omeVUC zi@dZy5ik9RZLr$-43vjgu0|4F~k+D`Fq%UnfgbKD~DE1D@$aqh$QcDdA9-KO`*a-tG+VZ z&7S&s0ByiM>x7F|bB(^5>-JW*U+nCx|82G34iH*v`D!oGr#{G*b8TT435`Lujx3_8 z$YgzRqmrp_rb@aPyLd;AEK*56Y|$_E8bc8QOUATmrTlo$+LXI14(3iq6>=UJxs6&o zQE=(Ny_rSH>&Ts6k!JG&jd+=1?Y;}s)dUDxszKO@?o1lU%PMw;SC>pJTftLBk1M6)qJb*_ADS zHZ-s|;WFd0l=N5>SWJa>V!YL-O;dM8LYb_n#mBd4FW+WBdV10+Ic#z&sE9UnoP+MJ zpFa^OBC@Tf9Ys)-}1}0>WWTpDi#&pK1uZs zeV>t*A)N4~=I~ab1XaDDtI|mI(tC0I?t|h4=aV_Q@Qp&nRt0#Uw93b2iV35%U z*J7X3d=Dx%|DhbUIVve{>5#RuPHP&keoO*kRCcv}htO4(5r(AS9ZWZHzR)x9bB>Ln z=@+h62499>y|mKOKLF6C!nFPfE?yS(nEoFdeLfiJx)ZO-szP#Mm)-qo{MvhGA5F7t z42>Li?$dMbrIMPzQqXT#ftJ3#0-vU;#Dqkjb%i8LoyH(b^2<>zqvp{@Z&8#jqNfz@ z+LD(Kj%*L0l!Q&j*+!kZVm`0!cU(Dj5Bmy~3;qkAd{sl2+I0XhAC^5%pUf^DL+^t= zR#1-7m-K}Q-~D_q8_X^pI8=-J)|IUbjdwTqIc`01Ith`9u!(DN9{ge^y-;^UBEu{t zak~gW!%Xh;`<17+O$dm5fwaIOi<&>255GIXedA!oWMDkO8gE_ybHR%>);&JV(GS%SVe$@C2O-bKd3hU_1stmWOHXVcd6kI5$P6rT_3iys$ipf|OyhEV zGLa|uuA>RJae74bB_2u!OYQFdE^Oz>F4g#4ur-XnE~bVPihtD@R~>A>;r{SJ`i|}K z6)COMT!PynWn3C6e$_1LM z;0y&d^5OMNT85s-)+pc1zY5&{hadTUCtgcf_|=}@%82pNERiym&12y(`}oS~O%E=^ zmfa$bsP3JORPIYcOOeC2Qsae-poPxyQ*w6V66cJEN?LKX#B-PVT7$6vuz>3~%gsNR zDMkM$>)I+c#>Z!?ChtXEIR6QUm}wJ(j>YpRnCiNX>RPKSWtbK|uk_bKS98Iq#R&@Lo3YazWRW2^wEb+y#5wD$x_{GKMO zF)NgH3$zEQj)F?g8ih{3(5{#OpW+nsajE9caDYk0>w&te?A0BI|8jNRw7~QJu-tW##GE~TE(xebB`I<{ z7tJ|&bCuGh-1s#UJx@4XrqXir{#v55rXoCzZb%uvEs2QxPPp2CmX(R|Q-d3?|o^|zc&Ey1e!@80)rlxw|zu6%v3v&Y5$I~fY@hnK6zp>kP| zVz*!aHV*gQOuOkt#5uv%pYqSp8uqvU*GnMsY0k2S>#!4tp025>$ljdd92RfCo!zmV zzxNX11kiSs&>~JxPvxH&uC)Z)a;g>-I2Yh<<;UN6y1E<;^A0g6&)fx$ z@gqHT>IMF{+B_xFykC!&A>t2S&d&ZqIb--ND_+j*v`sBlwCV!{+A}66^qAxOK3h^l>mzmyi&kk<3Wk`OQ zR66&#p>#487|gp%ZPAy`$LT;}*xjFZ%l5vHxHQcT8^+fv;c={@SC6ncVRF*FlF146 zp>+jvtj%Xyr+*--*(Km?i^Mv}})7!?t|J?i*RxiIB z_-IbS-W{|8S-E_R_1IB!CD$U1?jSi$phs|H3e8bkAz2G}2znr7`$d|##~B$j*RdPi zAMBf?tjU)sG3XyOFC0XeyC5GTqo8exc9ZDo&!)v#CL7_75nFP#oWoHhAyLf0q_T~< zw-QG)`N=4m)LlClcgx|sc|NH%K5G$}xu7U$e) z_G%FsXSoV&Z1#H5Zdi>)9+_mAafyMPGu}xe-%RLdg2~lOdP*-Pm#b%ucWqO4vfDw# znKxitDoM#}EaQlWq(UMFwl9q%Ic+aJ&)pNIqoR)_OvJW(ktBM#G6GjbZbq#*I~YYm)mU_r4@? zG2yIxchsRfjE;31D~@9(RI8jZE0~iqb9TPTab2JyHTpeA$1D*y2ZIiX)qR9rY(DWNP+`sH!xqXret}HKF>hXw1Pn32}N%8$NL+F8_Gg; z^;=Tx-u}y%JsDmD8#p{)nX)1eGJ9Ys8xe-z3U^!$;t>)Rw0^X|ul-Q7I0z58+o0|x zmB|21HuY3nb+@d{YQJ>UF!R%j;=mR|hZ77!KVXpK^-08F=9wFKSHKIds{m$=xoUMA zAhIGb#woMac&XHbe!675$}X_7YJ}rQ6R47($ex-}24Bi!Iaw<^QZJm7wagg+;)r4F zG+3EL8a;>lm}#11F#u?E79pnYM$i&}f0NQVL&sPV63GU*+~8Wg&~T^T8g4*O;6Ap616`iaXqa?mEU|Y#654YQZVc8<5f)2P zH56?gYWyV?sV7-7*WR1ECyfq~6fR!l5mFo#4CUMRmlc!}AO9#j0en z!Ib5u5|Wj6dKBn>IqLhZpM3qnb_aXhSi99#bDfsol!NOSag|ipTB}@QrYWPJ*ftBt zjvX!+t5h8jjXUg$8+s+QSGs}w#OnBU+HI2A+(Rqqn;^IStww20K~l!f6#G?q2_F0J zYslGZ{rf>ctKBUzToov`?bWhd6~(lHuK)WmmBhN!0tKu+8P?`)6Czq^{}-I;=#|6M z(qXodbDpp7rKp$qFCbhZw0beXL~EmvU28t)g=tyx*-e9U+xzUsTW6f)n62e%q}6&pb6mI;rG*VE>EvJ^M%!EmB`l=52@BnZuPzbHHV7F&W7I2h*W&s-3S-3 zVyQ;rI`p8ae=ap*mRq!@W|fN-l8O-?PaE|H(f|#&B-pPKgBZH^S{yf{=I?_$BD%-I z^^$MNgWj(kjnbH$I^_`aoB>rK5zXshtvW@8u%$6D&U-H94D}yx0l4l%I!iZv#ob)k zZVD%#-6Kv74eWG=Z>D^AT&`>^89p1CdJr(f=4hH$u33!wK#yXt}-YWqDC?9=n@Ft!e7aQd;DFvc$@KlD4P2>zL8G4 zTCY{4z|=yJeM)kr#B3^NT()jsqJ7h(@yhG9G}z-rP(MaUSu7yvUI6@I7sgYKSi+@3 zp-@lo8OW@EH4&fVLw$1(qe?emV>(u?WKTP}&N+eY$_56XI+*B|h3$#(qKbA0r|ojz_e$l{~Z6b+*A50W?e;$d;8^iag(HN_mjY=q6t+!ACrCDt?@3~kK#6MYZfnYp@@#L47)T@?H5#>u7u)&uudETK8m zDOj)=r^LppbR9321+q{|$ya}3t_#raIo&;9=SkTflaXtuEhsXJ9MhO~*>xr{Q(e>o zgA+5*(P@xOUKEujDkml@+U@rqo7zGO?NV@LqV8emg3Xy39M#!9*vo>N3byn?9>><} zge~<7n-No{N;Sq!##RdjtB-G06!$**%Nz<@*WbB|9 z6$FIky=)JFM9i7kebh@MrRrRu%~BQw?K=*?o4Jn&3zZ56=}#TZZGsrTY|r9iG@waVjZ;r>1EIl9#DhIORx*26!;hSEw(>4H$5rOW9W0rd*BQEOq#0)i>|Y zh%L-*2()OK0gnXxwl(fnN5b25o2~nFYbGRHu12GjG`Z`HS+zX!mwUKy7eC*Bk~^PV z9AAdV4Ua}VX<#cKzG&0ycArtJRZq)5xIiNiAUymNxeo{9Q{dxxV8^X~MbC7uu7M%J z4XnBK@Te+I4OrtTqq9V<_qM{7Zit8EJs8> z*0Ow9k47H0oCDnLdC_Zu9+EEXPBc!xhoFdMF;?Cz-0PsdL;Jx`3O|O)cbwiuPTv%|nX^lkQHMsDHG81DpcWYh_?aa$T!1IHS{I z^~8a&y2R1c4sEgD7?MP68Atbly+}!r_jw-<2lcq|gFEkzEri0TNu9`$1GOf->pog- z)mU&qnl??v8I_s9Gc&41(9AMy71NnX=g`Dq<7Of%B7QvA8baGJ^5TSE>9&;`B=k%xQj3H2WffLZyFP;qQcJHHb5_a)hgp+Asp3E=KxJ%O<4CB@pWq&-p8B7<) zqMu@AUEc*8Im}?H+vt+)3h!5`{D_Tl>d{j?GPAV7wsJW7@y47)>PI@2>}hC+voK9W7L(Lu7915fGN(I>Qhs;&8C1g>#``Q5`qK zG`y>KYOia6Dk8z)w)Xw<_39;>oC*Mgo}Qr+m)WWR%qNh)9Z9?ZBO6!x-3d2)NAq1pH3<-cK!2G7_LP>F|J>9Rrp9!8bspk(HV)#J2z>+Hv7y)g8R#Y^Tpt<7eq7!SSlmB|o;KhztEizB@L;&Vmr0lJIFMKqIs>DDb0)nL50GBqdx#`v$Oo&uFS`?!nX>;>qdL=HXkmhW7ctG-t z>Z;KDzPJca)Cq~Gsn&FU_mlOyELNebw;kFCD7U50-1+jjwRFDd=FPh)JvT+l-FalU zw?y6)N13y0++Q(l7*nqtH@+iGa#uO_>f{--SBT|Sw0Px=qA+qq<2h?}JVLVcK384R zS@$zUk}g`qa`1KA=mDw~4k}HKfES!Hk-K9DTYMTLygS@pVU-^L?Z) zkN&%t2&UOv)2fa~^)OGijv1$J0|*=%#RGVchiQKqL{}rrVZhQgaVRs{sq=$9uQK$F zqDC8S!IT-h)u)oeW3ExVOaed=g_A#;*HJc^m(%c-ZQ6ZCF<8vXnS8aL$>0Wl*iI0s^3O$Mzb}uek@0A7K}AA(vspHK%O6k zdboOz)6XNwpg3P*Vds{Cx4aKu{2%Hp61~>9h7z@0o73(O7Ck+mjPYVpDGP#>w3-QO zwOZVt@lF~gex{}>G}NN z#Q4vFg6BhR7*0~Uh9UNEqYrF!wr|7=EsIu8uDBX>!*Io|s**=py3$>wkxYV4DJrRf z*OE_DPG^7$(+n5Wiq$AceL)~y!U$6h?iWeArk~?+(LNMq60mC|XYZ7JQaa;I=a)D^ ze2Q-CQg{pi+wap*$51SJdMv+pDmp^ZPS`c6F~Li|UirEqQeHu8su}*31R1gfVmO{0 zd>ga)Q5UnP4XP1yX}0!$l0dc~g$z~H5?7_=R&+Lsx-3W7>KPC1hf|>epP>hIjG(O7 zNSGK+AB8O_QQj55Sr!dgt~7DGRI&oK1N-y!jY^SKG6hA8rlazCsotSay%7+G?g%B$ zB}Ga3QjiBPR+_1T?{a$$Rt#y9+8?iXXls%SnsDz=Ey5wIl5Fe+l!m39X+ld!yaV5L1xJyO_CvF{F-X? z)4a24oC7OTFwU!qy56!@L<)R0XlO(%!!byRqp{eoP)13o@rr#7IE`w%+9Hp8CQT*l zZCqaoMZIP5Fo?2M=N+{Ts!zH+DrL&cD`_Inu&W8afn=7mlY6y|ebQI)$bRRa()m6fwa8<4 zp^M$7a}7m*IQ1rcDShY?@35^l%7*+(N=r7&w>iEpuUwHHDRR2%3UY7Rf(&1iQbH|| zzMes+4-=EM1$`>9XPz9r8A@Zs^exqCM*-Y&hLia!b4bnYKo@Mwf`;W@vs_&hI1Tj- z){-}*47ImjyMaktmdK*sgv4qz8YCD+a1>E0$Q?b-Vt$iu-n|Z%i!=_=VA(-Xj7f;N zH3@24WP2>KAN|gqIEc09-2Lc#pOpiB5Krd_6~I)RskM7&qs_xbELTlR{lnULT1b;j z>^7ve;r1pp1jB}f3U-i!e;sC4adkxey^6y=^_HB|&zPmvEk$WvgD8rGV)l(2muZ9d z4%h1YcU1|7uiJhR*@tT3))rnn|9LqAvB zOI-^LWiLI!hfu#j;u4cYsHHtg)Gv^j8zkjt#a_{oYaonO9y(Y$CimXNy&fOt#QemcHH-DM=jsL!*J20hEvm1UV0}K^r-gZ?(4O>FAU`BVz;?L! zf+xw+h{w1szqRja-cH9G8P<^2A7LmU@Y_Wtk`h!~sLU{#CE~o>-7vBmzr*uksxPmx zfcgWW9}T-&5uv-0S~9a3J4zqf?Nt}ENp3hM znWE0-1Al$_0>%3C7)8C{tWr&n$CWw!wmP!SgP4f}QG0ipS1C zc}m@EDrh?_)_h}23NQDxn%xbNx$bZImp|%Aixb{EzWOhQm;hIg9H)W+u}5 zI)r7r^k3t%)qnkg@c43M^_TFcss2Ie$)o+e5~{a~{m?{GHS?tP@52*qw0e&9CPB2@ zM1~5ZgN6H&DNQ>Ft&E6T@M6!SHOMfK?a|6ry74OgQU=w*Y1iYBiZe8>gHqt>g5zcU zYZ;KjeRHx4Xwx9&)HhM5|IxRe4kgw{j~Z*|0O=>)Tj&$ZqWFgJ$+W%sn`<)4TExSB z@oUb%j&J#`xc>zyho`b~^U%H-z6t$Ht~M%Ie1r&xQ9gD&U-?(s3jV1bW5yT%p78o6 zAR(|g!yCj0T|^>$vVz46@S6aO0wO2E#r}NLBfRrm8zE|6cG$0lPul6<81EW@bnC4WB)I#eSXfSi%h1GFGMUcg#faxW)8Q1-fV9b~ zC^T7_PJ|>rFf~z8+#7Co`zL1cpPVTicPLtf3>Fao{q)h=E<6pl(8v$5yi{sya-n=e z45wG#v@p+mP4BOq>DLTq4^1Q;Y;u3)edv)Vr3_HVa4y}sm!NjTQ7Q>DocS=`x4s)M zmB1QektxQ`r-}P;H@&GV;5tdDFAVs!EGbid&2+}4R1`S4-s3LbOJ1ANQQ>f$vSnr{NceZ4KVQ{jt{8oe zINwM0BS(Ag@sAepaCy4$=+qsb#x>DAS0?LB4n%m-;9{FpShy1?INmQv4-q7RlOVfO zDoi#%6G{>Eh0WlpeSuaD#|oT8bTrRPaI5c_Termh?_{hiw0RlD`b#rZrnJC4G10PB z>95G@#<*34!H(uc$OWEZn%`n z0b2ntqeqMxN(098)&w=<8{MQ%&a>aMmkb`AR%a4mdrLExS^>B#tpY>(2gu_)x7Gt# zFeUkeyNBx=nHlmrJ96rtbjc;y{RpaKNjBoBbtKsn?aeP`WcTnfI4$ECiK1Ae)6ViL zR~XN&dP4#N&G#-$jwk&c%Qwi5>Nf!?r}A9YF_Z9w1XVaAwojLQYegA*qp-kC1q9k; zPFIbO!K!e&^sjFY&n9Y7m1a7mEh?s}uQtX?&F=lIrJ`Cilov&(hAAsOZ(aD%8Hx6Z zlAD%vFOB9tsAq2XUm(M8COcbrxNze>lhs0Rs*ZGAVnS`h{XA%`pb9?$<`Q80^tTx( zhX7j&Vk&4&BH=g1sYF&K|JMs-Zgm*lf5vp3EdEkqOO{m+T>15UZf8#@AMW-$7slJ1 zy|Vt-qu@!iC?vFti+k9_5r56G&|Pl)B=q{a0Ztuvj4?<^cs&LCt=fPC{Z>#9Np&x(`O}r-pVPUigZljDc4F)HiM-e`-?EpsRR3 z#D&Qw*>rN4rSkSnvx zT<2wD?q3S#pP8+6jc5J2cG`o`1`l?MI?!|!!;N_uR^)PKO531CCcDpoBpL< z{yKPZG#aF+{`?HD*?IK;$#mkpLGusZb0l&-R=iofx9=`TT%MA2RG&&}?q}>7w^hyg zhxSj4&;GH_Ji^_0Uxth$xUlmNhk0Y|Qm$5I-f-M$m zKBWI$2ad>;o)J9Z%D}mx{#W0SFoNQa-l&wZkQ+<^`M-1c|IsOA?eU-!f}7u5{fL%J&n7;<`-;8{PQDbP=3}Qze)=AYp-SrgJvh1 zPLY$Ayu3r;@VW_|==}>H!_tF=zDl2BVCbO@`?dj%06`&=!k$+X9itIK?$|O7U!6cVb>{jQ#K){cp z-bM1I{~#5Jh($l8oV~SYXknqP%hF9fr51R4POOXTiyasCVZDZ(AuF@a(!Y|ZS)nQf zAQp4uG^>hS1!&PTH!Jp!x?S7eZK_F%A|9>*uW>bpl6ZC_B!nFx+$2bR#Bt{t7~fym{?$Gh*cJ5yoFdyK_;@a8lz9-EGkf$-pR zq?RO_vNP4@O0B7s(T?vyFE}htFS7@?hhM#?QZ`R6C8jd5rw2M4)eY5^euD)R);w)b z5)(Gl5iXnQk$0-1(r&kI(Ff~wrnmNOoD~-Z-T4ILD?YbSCVKs%g~@0)h8N#3l*vvC zI``s_U8i-ti=iT}HT(|S=6sQf-mdOMm0p56h)xI@jYUAXRI z{)Css;%h0X{1r>%SbIHCEXS!mZbrB&kRHd{8T=m{9e>;T!rb&apa10WOd`iNGP?$Z zq?M`LZgD;Yd3y#0D!^E(onQ;|4~k@khm)zSI|DV2mgRj4?%F#g+o+0_CQkirfi4?) zyx*SkzC;F%z!GU*zJP&e85!tB;8bY>U|}zaMnR zIcF@W2@d*fS>RlDtyd-g*Fyed!Q-bI$p^iYxAf%eU+hB=9Cm7!vOPQBn~Fkb7pxM3>Yh5iu@7ZF zHF$KwW2y2bMtXtgi5BRxp@I^Ft6|awXIxMV7n6-0CH{~bPI@g*&5th3B_}Ot-U~`C z!9p#6jmu3$casWB=!l&^o4XTO2!r_^&YVpdVLyPg+jZ*&JRBW9iru&@j5sViLnn() zot1pDs?4rJoKGgs%)VvR%F`Qv&wH8pDEEV~M_5&k@bjhK?d?sinfLWqUq{RD1yBkt zoTwN-1b*?XJcdd{H5>*ZtI4SMQbsb*fv}NCZJ30gy)~-{JBzYym_SX&ZbwQqpb&+q_T&iDdtKY8jkfkQ{{Xo0t6Z ztLy8dFt5QTC-}x%YI=y#?&`|h@@19gY?sY#>hSa(39BpATtjzgDOi=5QZ7k*VMOdi zUvVKEMZL)77CXFt_u2HP!iavx?ZEN;Lo}~y3==YJlJ||V@=2OjC1h>3bDWViY}hZa zHh93G$D!h~FhghulI22r3M%d>50PV9Xf@{J&sb|X@z3>oOYf&b?~2Urg4R(>Xx|5B z2|ATZJHvW?H(hM@r-cEqsy7EGb{blXEMcNV#IFUaX}sdiM<2#+TW^x;Ql&qv5X?%Z+PeG9AN}A8Nq^+U=uGxW_Kq3!uDSF^L;JMY|Yj&Url?d&8}sY;Xt>CZ$<(ux7fvbsL{vmRmd8r;j>r7d-vHN}mr z8Pcv~7HX>%Sve$FT(}p0wW=oqGx>)#Zs%b~=i%#p8v$_8a+@0A=|<*F0I0_NHJcm( z)G>g4r8N8q|4o*66Qg!_0bvfUN|pOn&g1WCt~z?qZf27j-eh_4%(Yu6 zFwgKUD3|ta+0WWc@)ZinfVp>NJSRc=pLk-?L251_YeJS*yUfG6apFK}Y&-9^tx~%v z#r_>0lkQ9R$z!cTO&nOqiHyK{m+$&A9yoOr>oo#etf8T1Eky)Ho>c7b6W9tOp`c(> zlB{Z~*ks2ZYf+VxXmwi#W zf^|T7S+>F9&C7EJZRoQvr+N}SgZmL0f**H;Y*r4-^GcZU`(qww49WIp=ZnH^q17aa1M z%`K##GN1jksAkezbllpx0n%2eS5ad6$a{%iMv)P-u}0$*l7zsiZV#L{3d#a2z)owF zU^w=;N7b2yg2L5u4Y^p&Xd{6C|=H0vRWd{ySZ)n3dwINq*>`K zjU_isxqRls%s@lJbhNgq8P+Ie7AnlFHoRz__z)9){%mR;JPZ9hG1X4lHO z9e2a(nX|2Zv#E7`r1ZTE+S@WEbz@qtEoDS+$78u01b4Epb7{hs5<*yzVlX$q@34aixEIM$f zB~+SS_2xKss8;#$Fn>lN&y-H zb2At$W6f5I)*~UwE??kI>70x?>X=H_8+Q3!avjfRH_u9MP{As_HY#Q~sTn+n#@EPl zZCxd%iyE3@LS#Gfr}DhFBIELi=|Ufv!5`V)gY(CU{8?cz%$;bYq`M*a=owGX5ZlAD zZSxPfx?<~R5$8on%*6qOal$$myVAlQo2qq=Ts`kPC`J*K+TRIagg}~dnwk4MhOWwB zy$3H$jm%Kh;CX7h%dfxq*$*^PNRj8)mVGGCf+`wnkM{HJ6P*nGq6L++CP7X73Eh6rSn-$fRZ;O!FgG>Ppy&&*%Pb^>QHx>J_2mXgORHbGCq2tZY+-D zq@~;8k5s}yPh9cug`qh&K+`DZf2`Z==>?BND?AL%XHGic?W^EzRyZo}p5<~igrTAOrK#)QVY*T1oj}ARjd2{L(X+eF1GzuwR!@xN zk^wW8^kt8FoG0TEGcNWd zN{D6>gH)y|6_Ic;qnv3f8>-3{a!!}mq@pNwR=X6`q&{R<1!J>E!F5&;%PIusgh0Ov z*?Rr>C3rAFRcN;6Y!k}7f^yR6fCcI0JFYAtze^ptuors=hcjW0AI;HI${KTdiAuGHSi`D*BM)Jq^mlqQ~`NiOev4SsY62I)8xZc zTo&eN;T-S_jEf&HBhpd2Hx$tm>eUI}(P^koj75Po3G@GvNp@b!{?SQ_Ckmp$gJ<|) zR{kK}oC}VY%DHsG-b%ne0s3teX>Qbe1;{bg**h*~yxmn{3axzU8;AYhrEKKp6rb2= z|L$^ke!ywbd%no*PS=NZ`0noTE>8SU3Z`>Q zmFczsq+;Rr&GaCBZ&q+^Y7!xjbBKpXFYZR6jI)3JSoYt|B`>0#oqsw3)lPia81B~T2+XvdHDhg$F$(7Dd;QiA>zBEhiiU{oP2dM zb`IzxB{2wmDKh`5fv~WVkW|o>xIl2XNfn03f%;pO(F*}N3jbDRs)l^$d#~v8h~?7@ z3&|=ftEGV0E~WH+5(81C=D|!=QnhzPz?V*)?PEW;JyFFI#ecsS;AJqn^{X@#!ze5h z>um!=&=`142({~ocDy=ft>aXai$jgOOY2PUm)pb=o_f4HK3$%3F>Y(lwd5iGm$LBo zBd7_ijZM<%-PIXf=md(?(pl|j7R@yFDrHc6o0=Q$q=3HUx?XcF`AjXx=k%*}GJr!p zK|*gJJ?qXcpNq8MQFqOZm$8i*78Engw!i5Lea|^8s2!y{N2Y`ukLWdsWV0 zfVP9RSZnD*(Yks7aomGzM;clP7Ii6=p26pP=o#Bk0cmPik#@C4X06VJYUd%8mYPwUhbpGnZa z!v*#DEx0>6O&rp?3UftCjF?ZU4=Qme*3t#sqzoRZTUNFPr}}l{;e+BdAvC8C19O%Fj_Va zZCMiFatEG^m=~=v9bGWS*H8*Q<9%+d9I92>TEyd33TM_$OoQY8r!1l&w)P*IO0kd? zUq7luci4{U0UgQCQ3xVmc#PL)JlRJ0cBJ*~d~>4`kJOt9F7+u|0_(|Jr6S*E2zmmU zS+P=-jbmMEY|-TB`D2Nx?yW$7wqp=0oD1$jo{bqeQf$q*1I7HRT4*$R{3xYPjW;mv z&lTr%sQ=Vz1s5)VR%tIkoI$fFpHJvs$cV(c-Af4wbXbac(B3+B#7`hS~J4JoZ%Y6%q(s$t0BzYN$ASzPf%{aa=5f z3oWtuv8rL^`avbBL+?S_QNe?6`NbLJUgfrmXqpuF`fqnn{>=xCBwKt)x4!Exg0hM) zALFsQog_{SJoWRqq2KBpl3TsT2qMgY8_%4KI!&wLb;@Byq}&_hfI1jzPFao*6|7={ z=+OhcZyD^P3yaq~oH;fQ6un5CoB=^^i$MkkmQA;J_ZA+Q>wJo6S(?_g3mQ#Yzc z{#4%Et{wC8q;IRqH3xIXpn>bL9tm-}>_7u(0}FPMM41S+a*Ix5*^fxKIUep7!Ox@^ z$xHYSpdOp;IhZEyTAItGo65q7A!g@CbEx5(Qeq9CCWeN|wZAS` z@wxsHZc{`SN4+v`?J-~u3r0DbCMFZQd%4rOvF#_~6uI=Xr^r@S8;~j-Kwgi{WGo!I zu-<(0H6p%Qq7}RAbmxm8>&ol|d`BQjx)==K>gPz~b=$a*Qe51Br7}*ICn0_vLz6+z z%V$W(F01ZJb3Bsh{qDUU(mcLs`xmlya=ETI7;r^EvM4C)uO!f3&aRO%|Hhh`m~wj| z9*3$2*c@88R)G~;&JY+dM5b1a@K^r4w-rD|G0!GIusV(TtR<7P`w|wLmnC{D;+S}C zIw6wEnfE`ESQC?m|1*viCi;UK`CmfHKdg}|eT?{?u)C-qpsyl+hKFlhL$kyF!jDqo z@^13o2)+7WmD`LFOk1)wx+!(n4q2F)JQfg8^5e@SD65pVT7MT$@TP5t*D5hQ@a)t0 zMe&L^?Ofw#kmE=%)>HiV!C%Ud?Zg5^<)vO=%;#dtf>BHfF@tn1d&2Sjmr1EV2|N*D z3wJEPk9~TEqci-D17+=(Z62P2R)_fF!CQpjY5=x|4^fjZ?@DxYhJ8iu(?`afW(PO6 zXS|uU+*wq5_^89lRGsO|}E#{>LGXcTW%;&bm6aZJL<`f`da&-B3Fx z+aE0#3&;UfH42oj_>%Ey+CZS~fM;L!a~H*um+!3$>&y!b$;j`2#`^gd-+B6^2v7R8 zypVXuU7Tii0Sm{$lvOBt6@q>mbFfgg)ZtHNVFNXixl5%tx~25R#>RCqMDis#VQ7!| zO;CY*btFvSeIhsF3CM$$Yig_^V;>QR*1Y{&$TNK-Byttz>mPZc9xloc;!~Rkrrsp{m5rOI0 zl`t>z@RA01yi$eTtk~{zX#x4&vOHh^#f^B87fY?`sF;+Z?MfTURJQTzUKMyYNIsfK za6g2zzv6WB7s=q);Yed^?B5TMV?C#Q-5$nEVvFBZO6F)D-0$v`kF*#Y8C_EE9{S*0 zvPC+7w@tbKvYmEv7Wevlp;a~5e{?640T@m5E65e#LeuJ_$lFy`h=vD|)x;Ww5$M!X z2|An-tb@g`{(RM=5r3NGZLJn7=yk}LLt~Fr>a77Sa~0z51vWMc?)`pG96GCn4^)Zj z-hH`bSr8BVIH5>2h!fDh@n0#$xTA%fPzQ!|aFwtNiD02>lDLr>tJZrC3hT1OhQ$kb z&jp)*5{WSNe@i5O+ZKx5TDhcTG+b0#et3tM-ZN%Vl`AKIH=I6c>V-LjiX%^)A75oO znLT+w#fkJ}RF@9%7s>-pFheSU7XWXRJ3}nzcMyb9vubzs&6CggeETWr{|1wfb{=cI z`l^gVmrS<>JCAX$=YZ>+E&DcqC;sgKwzo)vxgz#YQ2Fa$I{YmxhhGECe`VMHJvP)x z(0ljj(VPwN!sIrf^SS{>jV^UlA-%@`k1rrzGG!w#EANj_<)>O2A|kJ$=s!|o;y+TN z3tLq-ojzzKXZ^ifs;ZE@jLbgej~Q_l zsi{kKZ)DoiX7qA*Y;JqQLdA{XmB^*m;)9jr0`{+IYjWAbQ>xsmstSsSW5Zc?OIbl4T2B%sLD7C_bjXb8rEkNcp^0_ub(GE9l8PC zhWpc+%1_T`ja1}kx8_O;iEeW4NYTr^JA=2GhfE`i9&5CtsyRruGm}XV{Uah#7WYj3 zM_V>zMR_$)TsbMlFTkG14=)fD(?61*)jggsnd6t{b6sIK96ul0msA`5(wKj~F734L z%wADS-7z|VJYGM6h0zt$I`CYO)F5V;ebKV}&R$6mkLMi3FWm+Jq%;LxFd1?bnf518 zzt2n!W{ZkY5f85GFdRO$-W(MjM?f(^l7m+iA=n?Rzn89}&!#MjRE<=RtDN>&7idTy zk_O4#IY<<7BfE_#lnl*(%EFTybF%BQ8sM2Dc5@jjQA3=}67=>i4%j$QH5>XI6AShj z^VRAgy~s%k9E+j7Zo9_lpqZZCo2~^>Dq7a6SQqH)lxQ|__SEg8EK6p9do#$-uiz`` zET%|{vyq5#)$F!#rC(6vp`rD@m55KdLp(bhEvdy^vifHQ%5W$f^()P7Gu}C1aAMz_ zrQ}U&RE%Hc`8tEck?y30%R9uYmK#Aa^M7~fkWJm}C{#Y6x!aQKV~NTo%J6NsF#Wok znzr!U`=_APY?ThyeD_A1@k^=Y2-CESqkvo@kCF2kN)p{^AB2)qI?+3e!|?9aI|e7a ztiGKPj%l-tU*s%05*g{ug_^s}R(m-kqp$vc7AFTrT}jUsZn@^sEmfsw8ux=Nw@>xb z6+usT>Jf?;Rt!$cdu|ZzN9=US^WoU(bIqy~HHduaqQdkme^?KWC+oGf1zun%8Ph4M zN}UQgn6L-w0dTAJ@8QOEwmX4%f`&p=lI&qQ*=3Kpgh9f){n=EI*ugfF?aQ9%1O|G(~#hgExZSrr*-RUCh%>+kI(V`Skl9 za`#-B96#y=@C$D6nrxx~`?J4HO>;M9%U3GBf=}J~#ra$kZ+TttS4CpwQur!hIV)n# ze=qc}jJ-{cqO{Vq`$jbEw=>CLSP%yZUTg%1iJ6&3Mu?ldNE?4$_&ct_l+NIiG_j0P zptK$p7-YGy; znTiwO)+rS#BOkorsxZT@divztNST&Xp|_-Wj(Iy8O&irW*MF?q zHGK3T^6pm6^}e~!PS&)Yu`82?^`19oh*Va^7}1leqS`kZ?M*u!pc^x%ON$~SKYxG& zCsw66x3YL6mUim4J??nXG9ZUvc*#Fx0JBOti|iuy>88avAOr)*p}tKRy>x9D+yH&C zt)#}iARJOzO4k4j`^HJHf74jhgNxC>q^}Zvl&!vOQTjO9=p1KoJXT4*KVYmwdFp#N z=UU{+%8vultx(rO_A$Kl%Ig26Jt2NYAM?JeH~x4jik=azjN#v>k_m1)`57ET5;DPU zJ@(isBv&z8zuS!4Qf``cENVk(Kx~{`WSlezE@k>RHg8GW>4U4J1};N%(IAu(1y#Vw zXy+=1g!ub)VNy=Xrj7zdOZtQF&eEp9YOVjp@C6o4GyuicJs118{)OhM{Bh0+woXDJ zNy@gl(k4n|=1$xGCnH4n;c=%TI-)jD+|II2gzUX;n-@mUoIBanrp`@d0rV^|b$q!u zrM8)EQt2F>VBfB?RcsUg@p~%wS<8W7v_NibMwWRl`MQsryaWS`wxYV*fDn{vvHPdu zOCn9@p*iPauk;TYG{Vf&6x_;6=ek5iKFbqn$H$N5W=QvGQxSHb^)O`<`az#++$nSA zb1`MzWY)37H*PxPGi}Kh{1AK{Gqpx-oDP^IpCy!p zPer|3%CvD*MJ*q#RGFx|^NKvZ#tu*F8%raPC;Y6D_+LE~k$x$xO~>uE#yOTlW5)_L zBIE6|rWqCQ^C-mp=Wv{&44D|1$5q^D+umt%vUdzQDS>)0@Y#z1p>r^Cx%MXnkKH-^tv5iD5^02QQ zSwy!z3Tihq;`K*azha&v{#LjdS^umyQr+m~Dt(!XXFmm>0sr83A}Yx{Zl*O2kJ1W2 zUjV%Q!uNE#{a*cq0!oqHUE*k)Tuv?$fsdw1>U0E5?0J&K<}3@s!J_6 z;7zD`$)!^Kv|5v!5?L+ggqqUJ7PqdbZAXdA=iF62H46B}M1Q6dI}E2E^X!M6&r=hT zaMGsEMp7{c2&(8$z>b70ZqfHovtdqy?6we6y=SJ7ofML?vfGywsX-caroOqRH>c~W)pwbD*4^X=VwAyGAssBumo0vJO!NG(a6Vc5XC zHwR-Q%{|kK=_aZJo|^?2|4grWZK&{G^MUtC_?17d-*gB<+sVj$xl`pWzELRN8j#V1 zbX%>xF`)(2F2N6ltCz#Y0r+|e)gX30u^I<}soyPkp-Hdkl7xh;k+zydBFlr(ytcUM zj)-xV8P{z!@z-#R#q^nP2m|E2QJ(;+R+Ygv$aE9lue8Y&_CcY4P{qW^^}FT3K*-)x5@gx{E@t+V=*#k-!?(TB`5 z{PmolNDO2(D&%4G-9TP=r?swMyr$;+u!X;P$7cT5MZbReUyz{vTO3>$M7A#~tukf| zZ(`lv5fFXS?iXTy$OksUs%i@J3Iai~teN8iQfvL9ZXOjC#ZNdKG}eo2V*l03DB2C%za$=X*oUWY#U3-`hvzx7XI+}OW6IK7t#HW&t2)8{gN;dM z%g-3gA7X!ef(GbC-O)2kA>A@|UMepA6mdWP^k0a72|uN#2uP?63Ot_Kj1w<0faZBD zpYZu20@v?;Y~AnZD~C+%w5v=0g9Q*hI?FKaCwOLx+rTj!jr_-YgTWqs&JN%~iNDBA zzWZEt&QfbhzZx;SkKQxd1JaZ7ZEeW)0p8KSnDc6`U_hOZ6FMkrb3M1yQr&iAx~9aX zqNBZYW+JetFOn-T_r~xOZUOUWnGD`J9|?lpVN-3vt*?}PCGDqfys!?OEoR%3KW4^j zbZi`5pV&J7@Z&ESnrxWqY)wavD6L$$ttI!>!mUztS&WmH(>uPJg8b6WH?M*9sw_r> zuX~!m=uk40=NcIXJ6JSF*U_}JsGDSUyi z@__rAAj&x1Q;rY<%&rgt;*#$~0TSaU+6`os7T*Zn>N-&nyvqe7HksJl|Q zll6LLs=!xfQ^cBB{@^Q*dY(=hhfoiqP?E>IC?RIBouGCjz)a7v=*wt#SBUe?R2wl&tFk zc0=2n{56{ExQIA6`0%Y|&%N)Cx7g|a&OZ9&p#4r$pQTnta@fK~??+-}>c8WUTXJAv zAWoWqBx~m--abd;M#A|>ssKRP0qcM9l0RqP*SSDK9DJ(H$*K{VP4gaU^Xt;{k=|8K zrQ>~>9RKityPu=uSSd$|ka3n}yr zAS(Q8(LiRNso_9c{ZF}p@u}Px9|bITU~$>Nx^r=SU1fND3AYG!%)1?lQP)pGc)sz8 z2}JQdx(B5<4w&nTG8mNSqK{VyOVn`F~Q9yyidHQNuUjklUk)NEP z@I%mkt9vpqDwQ0uen*66tSWnc{OyYzAYoifQoCo(sir7IB_{5j(sFC;eG-J$p%;*n ztzxibU2GV~TygrrF1|Em-C$ZAzUNM#KPkZ)uwlcax;Dzr^M1qOVQtFYI|OeVuppwn z*E=-=_rY-FqD{z1#F}lL&jRhj&s^kqDq1tsAxr*SrUs9+LiO6XSyeYDl_eQVcw6Iw zz4b_+ee^S}S8_~mpF&afTlMJMzE9Z?lRkAqUEP!UoohH_4t~rlL(8oFELE zY76mnY&vDHe|#FT+%K_+ka}-0IT@5#Hnvh-;U^WD{n1`8P3I?Zvpsm?@(6SsC`>LG z{*igJ=5cNO(w1wQv`LgE^GHC(R8D^S1jhS7RpQ7 z9LxmCiV(5I$+A*r#?p@i5sys6uy+d=HU>!;KNC3dCBd=os5I?C}wr^DoP8qTZtx%6(K7$Oc#I3kj zs>?nJP#J$YT82$rwJcDgxN$9d5ZlLnsf)5$>7k3l*Eg9)@7SwNr4WypAXc8qDc6!t zypoiQyi9o>K;#_EIj0|UOJ1xy^J(2{SL7djXJ8x3wAJ{kLl|?d;x2g5#>ZiIUzbum zTn_ed&Bj_bixo?`NTJSG6dyv7mF{JlO(UZpot*e+W42lvXKs3P^QPxJC0Oopek2(> zjQm5B;oD)p>`{xYCv{0F-Pm+f{0iDp1g5-FOuHMWX`4Mfu;nrX#K~vm#cjVE@^hzoPvDUMG?I^wo#; zy7kJjr(hd(MTNr?i@V&H6K?_A2ELi zEn0ETJ|+Va3w2-Ew3&>EQYtk1RsZ4|92vE$iw}pgr#DoHn!9ja`zRL41B(LZPx2d(;b(?};Ew5mj+uZ*R0{eSFZYQrkEvRHg}Qq|sFB7Nf;zpMUwOMQ*B zSgYt1Y4NmZXn-8mdGx56YS*7U(zl3_a(kW~!}My+!?z|9yldt&hVy=NC=m0J`HBZ; z_ARX!EAm15^W^FmFAcQaSS8YH6M}w?M>kK~L%*@pOQa;+uCm+P39xF|5_r@+|LH&? zsqFAi^jsQ0X|N*Y+0>NRS#EinDg%L6?>VX4mI*i`;O>d^Pw5X>ha`>xf81~eqs$Fo z7ntHE6Ii=~v_$X#W+CvH^nk3JF%x>Fdzd_p&{~yw@owVe(w6|&P<8Um{hj4@A@%z2 zs#@ibFTkOFwK^zO)(NEVdh};&>6o4vi7J7#dhxn*L4ri64WFDnq0a80^QFA$Yn%OO zDWpgA>S>SIBqqYRos^0Zo$;68W2zUmROcgWt*B{XdK)8uStdIt>ymw|UlFU&EOM%q zejV|H9_tU}!Nf!9Xm#NBjo+${A(Q~XzUWjo?Zz&`n2jSK+Y$AmWhd`o&;zr9=EkfV zoT%3JC>41R#?EnN5RZl}qnN&sx8tDPr67By3jENdR*9|W&-!nJmyQV^Dy)Oj*fI#p zO9$J3U?5t{UGo+M_t%@qEg8jRdxe z&0f7!H~XO=;S}d>-O`1Q;}zuJ7PtB-y78R6si>4uzhBSe0`JfdJugVK6Y)ed>Frwp zCn=i=Zh(IE(estho89@xN8huOIRxRmbB`n5M>65uHT8j>jH5$aRo0_thSZ)m*G7-t zkWy0&S_Dv@D%d15+n0_U9J1QcM~6oue}MEOO90+&jNE+8vkl^G^_50`Lr#v&e5!rg zZOk@&VBC0ld+(}_{zO{fp!;|Xxwy>sx9kbs63b5PzO_xKsZv$F(pJ(LnZDIgfpY=lP?Ay@&#_1{1qaHs=F|}7i7ul$_3J}}%P^q!BY;^=wS41#}P zUAaQkf5)2}v!&(zT+F0v*eAzRK+I6S>FHsPX7WQFuE58G5~>-g&+0%I|YMA^rllOf`Sc=kG%lEAhT1V?xPvgz2oDXipB zrMxv>kgz6FjaW>!uFUbK_dH)jJ~@nx`hPznleIqslzDg7q-JM(J~5~6ueWznye68P zpiFmvCUouPVo#_no8p_AURpCr&bNNx&ranv92Oj`L+)Yk1~;tUN>i;!L=Ey=++C8G z5I;O!KC@BPVG|8Dk|cSU{4r^}!jev}8JU%z`=eA+`5sJYU5PpSSP&8T+9GhfT>0fz0f~IN#m95aivMyk}Q_pJhJXBFiOTUagA?%ULSaIGcKt zUK0dV6I%437ldFZjU>ESd#tv^3@*L`dwW`)cnu`tIX8r>`k&?|tc>4nZS-?xcegJ( z>CM-td;TuEV#`Na&R%*Jo2*S#IhX>f@G=c5K4x^2q%!U4VNv)>gJDo`P<(A9IACO z6ae^TIdvU)CWwe~=d>ekbe{T${=>=mShA=yRQqfsIgOS^Y|*50y?+}J5-haU1`?p; z;0(WRW$^x&Sz1I8iTQ=e^0BPh)Sueo!B5TIrPMcy{BqYj&ncHI1Kl5p6Zx0tqw>N} zey=+h)|0M7^2k{uw=XEXd8OH#?sGM0He&i%0zH-b^yn!wy{}ijClSyuMgwe^uui%j zfv?f3?AFuJ@~X(!Hd(J>9di5?V_~Ct(AZaHA378kc*+MHg^S&7*i0@x&}Y}^8e3iz z6^mRrMmxjx7;z79#&cJc#1IG z)%!aYCR&%hR|Vz?dO~h??4r*#(oORNJ!k2k(5IDyc7v8*(zJPe%gBmalDxf=rf|mc+-&o0Orr!au?Vu4? ziN?g+tPXl|S$5;617c?gx4Q({DZOEqyT1qAg7kS^T0>Ue?tILe-N;l>I#dK={7&x3 z?rf7oosX01TF<=J4ic*ML__+wPSe5YfQf*`vrB>5}5snfq*2pT(8c>wxR`VoJmOUtuhSs4Rny_YatRWxgq=(7}Ws+cvkp zOj}*QeAr>xiXwXpe2;$cxTGP)r9rbRydXn>gIwG}q2O`F+hIp?9!9KQw)Mws1v6?| zjdFZQy+^fnBDucH&kfjA$Ll++xjb*B{mKfTCugz(4K(}B%aomi5^NJ68>R+Z46K-< zf$V}4EKP}hC1a?A(R4}Zy^Xs`dFV@UpbV>khJhun<#LhZJr>2;rD`)JMLk19y_2X? z$;9>%&914j;mWPuiL_CNZ<(LZ=IFy%EdEWHmd9?YPLWEXt0wG$=r>FJtLAIJ;U~UNjdoxB0;tL8ld7JqG0VmM8)S{;1@ruJ zVG4P6;V|*H2mw#NkM&RIFf7PncIOP+0{V6?HI0LJOnTNQs$H(d-L8XdJC4flsuLOS zFZDn~9S>61*PFjoy@^0!(A$H*dalL9tq9ew+TXaJ z`A8P^^w;;*lvl|##fB@kcQpsV9rjVA{mJQoKT-2^boY_>Tdh)Vj}2KGpM|R_hE!}> zJY}qUWS0L0B&Fr!GL&r|QlIsMOG(qn65SjWc$vip2mGrKFKbX`U_~dp-S?xT{5OwK zxy5-|>GUhqON$d1yZM#>J2IQfB}(eXJy$My2r~6b*mq0JeD*?O+AWZhnZ$CszW z&(2F&%QZ}JAx3Q{W;Hkl6D1+%f$`I3!8!8U>ky|k_IC4|4SDNxAo$|h%6;o+Ub`vT zXfogQ^ST-JnU4wo_^0^}2}5lSZTrRNEmwzc#=U5r-Wy$c6d35MpOw}W2{Y}x{JZIJ z3a%#~tXqCDUGgIH5Y1Rr6Imv*yNnr|V3N9P>{C%`p6=!74tI9=a^)uLc_S_i(UGsX zu!|fT8A}l~<@##{#C)pH{ryvND|`P*9{As7CG-#6_W!_FlU<5t$O#%>|7!b7I6cZt zw(cSsX8&(CME^Ki{GZDy{N4Azt(zFxzk6G*4?VwA>;9Mh!-dpyB=@h+e|tNrVt-sP ze*1g-9ZccJt&X5};^f_%4V0RH>bY;`% z^3U5O&iJ|ze;!Olng-?6w9IaJGH&1<1;tHzi1E=X^HmqP$f0npD zEB5{`WF5}@zrqk)ePwZ$W->1yMK4uu5xJ4dFB{Nda(l6f&LNX*Q+rE)6K&mQ5vjmG z2jmHsZY4cwcXoHvM7iWu9oWt3)J~h2Wc(TWfA`1z{1-Udj4i3D{2t<EYM<;>wE165M#4fGQGrMuAsB^?k-1+>9>-TGg!~Q1}LW>E#&F!*xV+V>{cNLh8 z28TY-m%G`^#8hxO>?JduIe|8!4*McvYwbf|U`ccdAiVCcA!B4E7%eu=m^gB+>Jj`{ z;PLtU`e?U?ujBPo8Y+jBT|I5oU07;-_#z_2`Puy&kL%juREnqKsz+wDZvwX?ltg1Z z9-0IjzcdT4QQ<0xd2#1h)LKX=T-ReL z<&?El?0&$kbot}#iRaA%@pAC!hD$5Zm_T?Sytmk#cfCP+CeBh|-@SOa*_jBIxdv5X z#Fu-ohdKMZ)|_>h+;w>SH-B*;aGtjNuif|mEd$F#=)d5E)V+Zg){MU=#?ZjE-zUmk zju~a1>-j*Y0A|Nd zYFPF;>O2<|%uO(8lpJ!|m@vG;3fi3VJ>c-HsS%^(ko?Cn=M(KK9_dHyOMj9S$)jha z+U3D%SwzNjH43e-dskFDEe-2AN6Jd85(V4~3-GSAW4W~t=-s3Ftic^af>1ii!EyD3 ziQ#>BiX4->n-EK{TSM%mteKg**|^6t7vudK9s1mSB@KCQhArLw1&v=t)Z^a5$yD0! z2VKB(a4X*k?TwnP_t|QTqBif!VPys_3_NFri|HwBK^=i{E_3f;4S?n8s~k{sK8dw{wL(#9%#;ktWqNz+kBWqkZ;p3po`e@B0Be zsc4vG+iDXg>=1f#f{lo^xW7a7%yx!cALk~ElE`S#DzasAZ6 z9Dsh!2;!xSDBI%`+}N2-U2q&uf_bNk`yr9P>N`rk+;vQp^)5q_Np3cdp&j<|#veaEPCmt$S!O~F6H?AJDhESH=# z*f*ZT675V!iI)Y`;dj?8Sam`(1FRyG=xK>>@qR}b3W>gQr?X?za_9RwJi;aygQ!d% ze+&Ha)SP4%{8L(wf-Q+PIx|>*h}z2f8spEqO3$pVAI2V2J$>l^tn>%*r^vTImu|da zzk&$-KFYAwaoluKpxwWDsNoP>3tT*%-ytvpjd#{OQw?EYc}S%OoZw@Wpb?X9 zXkI|`^jLnl)1D*EWoFvacxX=}nRs@pho1kQu4g)F>9>M5emh&fwDVO-C!rDFGr{O8 z4FX!kh?Pz1NSri^!nYk)Qnx|dhDm*a`^uAzU$v zn)NxACZ52T42LHYNTMa{1Gn(T^}J0QatEu)YN(3+rU{sq35wtQ*2yZZzJoXLq*9hT z$IxR%3jv>kxpbz{+Rs%v;=JcQR^o(J2wQ7>R^uZ1*3}$yAg~jBxocJ8pu7J#bp7H- z3Ua7v?s}(yale1Yn;|Cy;B@+Co!tm{i z`K}fEy~aI@js4mPUL;Ozr4l14W z9DP1+M2D;nsM`DLS9tA_9y;!r!=Z;Ht|D)n5`NVP&`!nc1xJ9kzX383f_(+$WyJ9;({)-`m%x2G4HaxsSh5}LW?B5+A$j#~aw#oARtWJ!H3MWMy1EEVW^A4s zJ<6j*YMJ7-agD>A)`^O1r4KUAb`lEZ@grsRYAWZ?znWO_CiR9LM?z zxTw5t+6nKL+#{Gw#DsbqjftM*dcaGtW386*^Wx5{%fo_TFKc8=o5RN1^Rf%f6t+fQ z_|Kud(l~xbDs&@? z!4ZL(+z_9K(c(rz=_vC%9QyUp9LUU)#-#5WhafmU9-_uG9Wi_|JZ9$L)rix1+EjqRA-@CzoB(fEGQ*KW# zIwgq5mw5Rce7UY|HxuL2De8N&inDX=UZISGOYVjmti>^VO#UR`FpWah)^>!?i8w$w zv$N`G|JGUKsVWL_3;%iCfVy87n(iUL#F+@$ucO?GBBY6HYuyWD(thTM^#>^=ZkNN`6jz4^~DH(2asW^f^H4xf7Qh-<0dTm9zMrWX^Y`2+%jBsJ{!eC6Xp2lU1aq<0S z`#ug*5oSoXuf$Fd_x4LyB^+072~Ukdr<`H-fYWKIds8xGyWW5;Dh`Mn3Eor<^%xxt z5x#}b{iyz>u>WA4!0Pl80HvXxlgxTjaVoe*Lqv6d88@NVPGGG_NZRX~=lF?it;g17ts8zf55zGF84eCD2aPSAkky2Z4 z_HluVjYfVteoMXHZI+p_5-tO^-R4+4ay>b@&T@Mx9a1!t z7MFBeIx9pM<rP)|0_O3$%iyK{P#wv;}=zinuwH zc@;6@PCi|7;-R#(bJF&T$p)914lWe6XZG6$`V^=h#=yAJlHWTazY7{(W@Tj;Qsgx_ z4*JR%xY|kIdz4kNM$IOmSU4~c2DCpz4beM#H=+a+SQ}jgu%IqKU{lvZ83wC+=DA9R zBrU26+xZ+Ww5a+lQAzS`94*ugU%kq_WxD*wg@sF=O){N}9?DP0esa;+Mu85u2{Xb< zxvtACzRa;SMImC9DxThPU0cC@(R@t@XJY|LYXSpIB84PD2!C|U151z{^6_(RwL7!5 zdAU!1wZ(Z(4@5t(TyfhOwdooW6t_vCbG#&5u~uXckv{&@on`(Zl%^zNWF}ijC$N3& z`&Ro%>$rG&NLU3^;?eFt&nXjYRnB8=4tyjsJw_i_Tk8m}x99<&IoRIZOlIvO`K+Dy zUVz*{(u8AT(p_nI{08UEm}mn5(f1NX$Z~fVO>KQ9q|TShVpuu%>Y!ekAk-DHWL?02 zvYf>sD_>$mKw=t>3%6D+5AQ#-P*b>P?@f%_L&FI47I!En$vFwHy9Dve#)Gts)bt{pvmCWn+&f+7dSf z>`HTdY|XV|)!X{Z%{AgRq3bnvW8127fKf5`jTx4lz!9<#2Bz1MvVom6UoqEgDE)xh zWW2hjjSGDRLLN?tb^x`vI1Qg|AN6FF9fRwP#tN{Fp@#X;em|#?0JaY54MV?Ytkvc| zPxgKm*_?gedpd$U7^WneI6MVI-Di&0X9ZDC1(aNqC7cl>@ad)*wp#Z|DKtAE5w?F; z9(U9G{qSO#bwzqcl{ZLFVWvof<|cTBuL-u@C5_k036}1md$F>ZYXsZI-b$@Tf7K(^ zH?)B`h^2>^oUU6;Qb&0XC|>&s@B$V3vRszxO$=$M7KQOf+r(mR7$jzV9SjconBkI# z^%3`0GUd>g^T0j`NyfcilzGyW2xsd$ph>?hSc6Q+8YAC$u+o zQqwGD(gZp4Wq&0?RW}tlUV5u1xGcJ@9}i#H@9G*X-g1$d+{(0Ci=uSi?FS?a*%jG2 z_j(E&r7{^DE>8u=^d--G>>fTmWy?}x~lY>prCZ0Gb8hmH~Rh*5S z!S~LGDbn_HdN_>?W(yxVYDg<8_rMn8Rm^R#<*3x}5b-iW4ek-&*Gr8{^X>G=5|fN# zyo~EezBV5H*Nb$DNj`4CAU#2`c`V7XE%r$W5IKx25M;Y^U z1izzE0v}&ZrfJM`ap-nP5@TPOK)6fV;e>?X&JI?a=sUlAG3G9x7Z`g8c`&)3N-iYb ztaexAXFRmTurWhc<)l&YUL2a1wumQ`{rg!5bGjt8c~;hNrZ{wkaytP$ltM5;(<;Lp z9b%=oIvcc4U%&h!r!X9zuX~1DI!=}pN9M-NRf0_b{8SlY3LDcfmkNVUR|S>H)a#+E zj``o`sYUW9gDd;!#&~m1QnRnKhfTQ+Y6V>i&vnje^cCOs9)D5d9l=Jyy>#k{mdm`U zVX$VHsv+XiF=H>PN2;C3UgbL;;MXp+9|BuN+#(-Hs=d>+no`Ssl(g!*brMd!kMyNN|I;xAThhJwD&K2XYTFW=OWjVmwq?OEdrbnsdN&CYx%VJ&M16 z?!ox{$D`>?r6y67Big6Et5|@fNv>H_?%shmFo%*I$BuJte`q>(4fe|2M9VLR`b8a2 z21~VHx|ItF0Vwr7aPOY;V|z`gXmmcUblf66)E2-`Qaw0en&)OIOJDyfs-{`xyJ4!4 zV{b3*)a|L~NLZSGCMhnSB<9=GNmFZGrgh!I(Ppg5J>!8Tdv^8C$cMp^rQV8}@e(d> zBYkaY?h3GG)k-ZJJ=LtarLg3|OyvIfR|;1&uJ#wYQIf%}ekdetlqrR_uWx6(*m*oV zA>P5(N85`4DPU@{1ZPP3x|S!)(HlMCa!eXdf7SZRVEl|C!<{|`TKvAw!du%%$DEJn zX*e6GFzr5LRzQ4h!uF}5v^F+}(beYZAN3$dqgo3TbRx_MKilqn9SFJ)Rt)o-#CU<1 za^*7|rOyt=I%i3T)n(Oyk^ximh)Otn5#LtnX%H&AY3LV{u3iVu;EvmOXmdoz1J|Jl zDZfRM3Isg5utUO^1(Wv$%PFm%k=&1R_ZlaAp#rLazk0W4f;uBGjBgIQbJ(h8 zoN_PAolzv)ajOw@GrV7N`HwQeDZR6BQLSVe(#NA-T2t;cP9HPmOUNx9O1k-q!?=sQ zNzXj@BlF_aM!z?JefMA7&7Yv25U9|KXq?7~z$%u@?7N~Dq z^a?3VqZWu+RvQJS_{osw2nElM5WH?O5eHih7QqU1wVrgQJEY-&0q^vH%HoT~nDK0| ziIxg{MMDlD0TZBM%S@BBa>8w8f*iC)X_f8955;|z2{K0Fq;`}U0h(zmlRs! zfanBFkf3l+Km9w932a?`G2EIVZtzThK2p#8RC*_o*!HAo5`mTXE%O^x#q{=Js316$ z^Q613t7+P=9Em*wLWY;&g)I`H$(}Ol{LW1g8Dxn7t!fw-IPX5e;R_mmWn7+jmv1`w zB|aiGx_$Dh+LyN|aI{#b1k-+{iyT0GBr26v4Wav4>nrOTd7O*IsHw7w7e>NDj?-Y3 z)6opdvX~gbq*AKTDW?yH+{K#=@$8~haUg=wf}U<0(m6-XO#SB z;`}EloKJ-R#7S}|{AcMPcfx;GQ*tN#|2QZZLCC=I{qvnrK;dAA;f&mF)Xxd>KYi?K ze`ja>zr0N{f~>!pRd19eS}MAr&Npof7o9&}?D~O}I!WLl-SHdd=UeOi14f2vE_}iv zgB#wgRE_ZL)j4;8uAF^vA{~bklthW*P?|6pK?kLyBS*fjxvTlAZp+>j%Fh7bI@3>+ z=7o;~@QjX1&2ID`f529%hI@Wc^eOcq6fn+K_v|Ek-}4SBGJdw**riQlKXV5XJs3v0-y;kuDsa@Zh-CDLM{dSV6CbeYAcYK*^Q~w!-Pp@K} zfk|q#V51n~+gi>|0Xvyu>TGYfuX-C#hQlv^AG4R7*eyg>@?g z=R==D2*=E;#qUq$GPYdnk2WBqoPv+e#W}B?_938oy7AX8qn$BK5Xd-JhOF1jDCs>h z#+zMJtAorLyRRCPN(MG~_>*#o$n-U$0Cq>%7#DZk&$7d{w`{ddBG?}#^)6=vk_4=E zNz2tzxw`y|Yks^v8-zB0Nj|HC-nJOxp2aD)afr~W;&`vf!S&D)Q*%6exC!m;5nZ>x z*CE8m<-@th4}n{25)T@(N=guon>o#;wwFDdaAs0|N(1cu{lLHNJ z5?r<^aX04}odu^chuRSrN*blX{o4b{kn-b1t-Y2qN@aX6Ep~}w8HO7d@E+P0HX8Nn z+B)?+ta3ba+J#}`<2#nxR>&+pz{*c+Qu`(qRgybq1{*ulx?&Jc42fKo>hD&ohy$dx>i5>V&|&A{TEUI{G92Jb(NW zs$GKpXh4|6NWx~uq?7IQ8YOE;hdmsACOb_yrtR<~i{+!uM(kuUYT-2+2lK)kM8?6^diLC13V}HDuRfxMU{v{ zd^=N`2-ulqzk}5#5)6M>bn)~sgc6LNnU`jgB=&C=sxVd{Z7s|4^PfC_o=Sc9frZ)H zN>!?4ZKXu~P@zIb<-~T-tv>rikKJW`iGK;@9me?@P}1WwN?6B&ADB@xM8|0PijSP= ziQ-vY_cMy<*Hlsjz;eJGaM5|dd3dP`_Qrg#f-eQpIDm)DbQ$|$8Y;+jKmC#mpxCs)U5 zp(#JAc*qTEzVZ{=)M;5Qb;yUMA=>q4PWDw>3aAonz(x&L?On#)2p4#byb-rAA*LrR zjZc4;96TjKaXxamodcc}srm)m3?=S#G3zxWF}G&Xp5aCc+DVYN$I>wo1%0zI?P=Ut zsdR`1+>JKKiH*P?>d=Ciq{8p|HyiyfS{KdYHWSj2CtJ5% zIS^iL2gmP5`FS7A?L2XKa6Zp{L{i*#4f(^{ns6A{8nGuUxo_M~ z+w(`_t-Y`sFOqVKJU!cTM${eftJG;C8=32EzkJ3~rfWIx`5)$-BqikYC^08X01=`r zLCXS4-~XJUnt2S<_y-I43)uKAFiD#!UifAi`UqL)LPC42uKSIClZ8t#hr;kSJ*!cm zxgXI!%GLiOd}s$c%+!3e&Cq=sazq<8mHMPiCDY-22$rfWL)b@D6dIS)u{$UDFME>- z;6+#F-nu&pL;G_MlG+0d&oiGr=bWi^S0&eWxZ;aSu{bYec{_i`D1G0dB*9S}PsJf@ zKl1D|WxSFm`6p6Pm9vW1Qi*e{=e=@#Vf=_pr;8m95dtvw~R~~A|(ZCP1hWZ z&lE|Bln?zBuE1w{bm)CW-y%rM^EOG=$a8)dy z|jDpGc z{`7F1%jxVCNdnu=^keIdP7ohKFl}|O<(|E(Uz%`jytN5{Q>^hh48|B!m*cw!QnmN2 zvLe9?{LW5t&>b?JGt$K4YHoeX6W_%KeA5=qKqD5qK_4M-?qG2IEnjQlTTV!FqwDNU zLTCgyCSjtuelPxG#hL^iUnT2~V24Bs^YKxrr2A}^G2{E)m=Z&eSCis2<3~Tq z_kFp|;J5H&?>GhRaKGGk5@R~Yn_oERepvN|DB`QFsdV^)cinl>KZ~v&*r2W-HzAeb zpvgU(>Sr~Up@uxQq#l5s_D&2#4aX-dZjg?qbX*(=SmPW5_(O&sXb!)-={s(U>l~*a ztXWyq``QM#{hePz0(8-dq#7SC9SZyI{2-U`R`O|kg={>mr7j2uenIe&HfF9P8*}6) znWgK|jLeS4XR`)=dcc;O31;Ks`FQzv!o>}NG9!^WLAToLYNvQasbi@^4jR+w zuw}0UZ1e(*twxt1C2fZCvdpvK67DE-)$sx&hH|nvr<0whdI#)%9^@Bf7CipdCDY`0 z(BTKWH$HQnuQ+^XbEX6r7LGjXp!jk{a^^UGuL)L8P~*$aofRo^KInxqs#W^MAhPJ8 z^44LvBBIsV#@TH4Dw4+DdvQ_Rfsr`t&@`wZS=IN|w5tg#lr@_gLcY@{$}rQ$H|AY~ zA!)?3`SnY5czBjvu*9<;h$A7s@tqKBe+ zL;HTDOyTSh34XBme5ZtT}_q<5X*r&hX}bfauK5PB&C}r_cJh`K;#iu`ANx{DH_}(6S~+v_;y6XA36SR}82uS~P2zMSBZ| z*s^jsR$2m1oBO5U~@GTLKQQKnT=6V`} z`c;u+*=|Q@eI*$>zHodjy6WxJP!2X7V2+jYCLK=t`Yrk`$s%ZmhmR+ds?NjnOP-XP zX6FV)C1El;eBnZsQ$KFu2@g*J{!3+r<1uQ9r-Vj}bPv#w?QWvk$9Nv786YT6WxD~J znm6X8QMpYyHLde4|8Aq`Dm8<(b)LMaE4j+dEKpd{`!tH>@PS}({?eB&m<;)vPY)Pf z7p&sFdWTgIjX(uGlv2s*Qf*$a8fw(b2qb&D4d>PKTek_Xtjw5yM85tdAY9bR&B{-1 zfSJLEGF&Ik>*plrFeZU~v=7S8gA?~CCku-=?B`6 z-z5L{&-idWCl^`KF@n2{^dLu;bgGY2Ajc3XU9zMl`Gx6lsJS?>b7|-912UyGT5X#% z7SQH+hg(kqn;IOdZ8sn1rnriSc~kZdc$CO5XiEw2fhr7ej7c$f8H-R;=iMc;;K4*S zi;Z?*oJlJ)S-GyZoibg#oh7-SPB}zYA;|%F2ev0m{0dGS!=Bdc5Ea-6#hB^MXJMwc z!vS3(6(uk+biHjK>ZjLhwuUg9USJB zh*!^Qc^1WFc*= z5;$7f0-}xM$f|mqYd3|OvGuZJ5UkY{T&V5Q(%U{MeA44=3cu0LN!Maq6#Tv#ET+-ILmoh1BOW^hmAjFIA- zGycf%a3zVTc64Xrb~p(fxxyzQ3VZ6kzAZYC&LeBfMRnvJ`8hAkQ`pD$-Ds{^%kmv6 zS~E&?Jhc{I_**gDCUP!Py~=?osdgj?P|Eo}`(xa(`)9cKYDDruga_1W^q1aZQgp~I z1q0g|858oEj1Vf$6-x7Te&`{8f%WTwE-|M?MU;wfNn>{5&)qp&N4P>TykX6dKZa5g z53>8cYILoOT$F!LB)yLoAvU5L1vATCCZF5umKY)SD4Mp2U*Ymqk#4;k1HIR}q;!+w z63M4)-?k@E;#YH}$=G7X+Uz>HcA(vqel5_Ty6`wTv+|aGe!;78vUy;15?d!QR-V() zKrs9+cXAff@k#J-YW@>#brh32B}17H9%X8&1FZdJ3skoww6Y9Hyd5~*@>=h?Nbblg zmosudg80LyN12(N2n*zOTf7&b0=Jd>(H@Y5dq*a+mlY`bRGCFG9q0Y&?HL?a z+(8Y*+!IM+Q3m^b-e2&3c)y(=?&sWl?sCq#=YG$*oX+vkLCbkH_C52mgjgG!H|yHv zcb2T!s!!0J@CXd=5Ei|kxR{rRE4`i=*$X%Bk6 zY)TL^EQB9(E3!-d2D}(_Lm8O{7nIr6c6=tgU9XcsFl2KrA z9(MuJ3-{TdhuQ4I|9D5NB;f~Zdm?9T`5BMTL#O7xt@)}cbTic|A~_}3Xy^TKCW!n> zG^1d%>s$T*^U=_1=5<5xc9(7sQl2T$b$a3D79~Y7NBVYF?IF?aG^t=rq6}0EG4O%- zV)L>11f&Q6H_|+gOv$9-GZF~uPw?c!2b^$jRJ}yOigeF^1|ylKR$kpjN~U<8l(&AwysRehtXoLs%j>%9bd3nM!m)jK&wnxqqvQ`;Y35fj~I=d zD1mV}l$)%WrkSAfSb*u-s{oCUjg!BhJZ%TL{$v|;e+)#e3g8WpV&B`r%TS8wgj^uI z($$C|U#&t@rL8d1Xhbtr#=nRXopY-30wwZg+znIiv6 zPcg|Q2v{3xdRA>w^qhA>=0^9Fv=|qXaS+y@i@RA2`eNR8W~g1P+kX(zwmnf=8&>mA zcdf(OM?7)X6_M3d>mVO~4p!(px}9Pk!dIu7wE5X1!tabe@5@$R0tAM))_P6O;I0(j zzkO70-&P21lZ`fchA$L&z8!FJ7FmEgUJ_u_&yjL({f4HvSz+S{Xx}O)s(-CY8yV&1 ztP;jDXdqQY_0yW6Vm}Y(vu3iMZA#9yf7AlG>A_4L8#&gHT7o;S_^$T{ z>z#T5ymyVtx@oe&Wq~3-h=`4-qeO?ek7q78#@;Z%4);vY$d-~W#;>;HA;T}}mAa8@ zB_-=QcW-b5=qj0kOKN4l#Yjk54mzjv2Vy@R6K1wke)56#@Twj$gDyzhqXne6mf`X< zA2ZYTw$%r)y8EC0Rb#u%q)`>V2X)Mi%j7X11?EoBWivls`?OJ1cw z-$U>w(~Asm+;;OmJIcUc3bYR%{YN1laV`EuO%26NSTTLEiA0GD_YSrxaRg6U#>7o$ zx44}?XppOtpZZSIg`hZ``);&Etmh-D{jsBqiUj1#Q+%-1cga#&n|j3c>AI2@T8^B@ z_iO&b@ptuxUN1m?Nln$C)xYmvT{TTt=UB|v?nV$&Q(Vjsx##M1moJY}*q6`o4HF`Q zZi+uy;^TWz=7TGar(Mr_72Kn*fcPQ9^;Y&w``rx!(y;6)_ui*6hCj9X){?}Sk?lyc zm{%0(zR{XDwTgOnV30#4l7hHIgFVK_KGO@D<_7>%7b7{kk@R*^7C9c>Vc8n|Y3MH0 zTH%&I%q8Efof&Hjo0vJ#Q_>hFuhi*t1oh=HMO$e)lk0)e3k=c#!K`n)IkKUoh~ha9URVlgeU0gO#h^o%k+Y ztTOUu_(AE;4dsCoD@+;uHdbsaWneFeJ;g9u5Cnh7FJ4~mc=f=f#;IY~iA#}VdsS97 zCaV3mK9`qddz^PF`l%A3r9f156^o>+bmB7k$CxumKnqpi&0n335`-NDNeICwOV7!7 zyfIR4coa>R%u$X25%H21)P#1#30v-~%L|pdg{SF{03b|FMiZZy^joR- zj=Q#2{T-=<_hPw1uo#nofJ8E}%S_oN{l94riZ(jdEgkRm6~yZ&uccpp8>$#l0ypnC x&AY7hJ^m*+k5sN;BA3gKQ&$wkk2|VFX_xWyeVVj^htQo49PC_vt+NSu^f!AL3W5Lt diff --git a/src/assets/shots/workspace.png b/src/assets/shots/workspace.png index f074a29f391f79b0b0ddb3e0d16f6efe0bbf010b..2ebec62de3ed5f5a0abf571a78464c0985a9d65a 100644 GIT binary patch literal 74904 zcmd43bx>VR5GR_107P?;B-n`Vz z(!ch7_3Gm*aUp&smz2XL6fLPaDDNrSuvDROQHdFg0wcpNib6W=514&JKXx&KxKd*Mcyg8M)CB4{p@$Y#1GL)C1!`t%i5B2Itkl+uPzqAtm zn=gOKjPsAHf5}&|{;%Nw(gj>^+5VDzTZHYe|I$<_uaWc-_M;T(#<~Uj^<`F z?tlFwm%rNdox=|S&z8&CLMB&O;hW=?vIgS3tnZC9M{(G0H~TD$-Dk2g%8cJ{RZe ze;whcqM`1mueX={8U=L17%Rz&`mi=(FMfO1pl*V2D?9v7`=G9h-3~s=$e#U5OG}d+ zbEc;MYi$4Z7crhEQM$kE+^ya@>>#xM+TeT)U@jolEv~PJu4*zh58YRU*7PTP1|X+i zs<`uUA73dvG_7^e&b1);J`S2epSb$0BI3eoHOK|2#w`MIe+i&G%HMsH^u+1>+2(WM)mSU2OtlP--Qqj1!Nbqr zs$oVq6RwidEovkztZlR>uhA3|IoQo@<|D7d7km?Qt5%SgP zAQ3M|A@IjaR?4=Lo_aqmq4zKgKp{thI;a#~dEoQVYn8ZAR7^tNhflf#qZOZ7yTrWP zgQF#kR*uA7RxXwRbN7D*auu6f_D8m?O%4ALJSXf8_S8(S0MGD{&-FFQ(%!@_kn+fj z+xwbNQdB!Qw`0^LV*;#aO0Q33QUCQLL6Zy9y!khVT_p^}Jfg*~RD%)_3hYf|2vNv$ z-1g?!=qET6bk!IK@iA%dqtzQvrP0qKdXxI;1?$^WiD<*xJ<>Wnh&1%>CixKXS5>`C4Z_ZL zZ+_WG7U`Ks4&B`z=B=rodML*)K%LXRThd{+ay-xDz*e9wd92#58c2e>)2_LQCrF_^ zp0H_djngrq{*H9EWY@lKs$g!dBV#;GAZmb#zjT6+kHt`IXU03zt%FZz87}Xq47rF7 zhNL!-eX%exTS*ry!@y8B4ks3eVA7E1M!6%;JW&NL`t z9ok#goe@PDclG07W;1BU3_Z(A6TirQ>M4Urgo)pt25yzQj=c}eNZ zkTjE}$V(d4+prL$sG>nh`RiJK!Q=}0|l@w>@?PYQBW%ZYva;xpQLgXkuQIWk}qZq(Sd5@wj1fURhpDE_n7S9Nl z`|alh<(gHw6@tOs5mRwn zL6Y<=q?Mcvtb6-RUEEkB(|w6E-#|!FN>xVg{kj>&PI7=b4YYxK41U5wU{YAKe6y zW-8cN_eUlup=O4sG1l^~5xhqVY!v!ToPVFJHS2cSb8KWGg15}Iu|p>|e* z^7kZjp&KDsbva%AsYF#)(sTgu9MzSFHqk~cMF$=C3!xmxaG6FdMhD;=e;~Nby2@g@ zbaZdvyh**P?dNVdj?oHqzU zuQVWY^-I0Y6cGATQw)YLXcb1omQL?AcQ5Wv3aPzs)Vk>^^-*`5ms{Lcnw(E46Y(RK z_Y=bZ+DU0YaWL|~j%=Nn>#a@U@{&WN97i)y z(zy|)p{;rSMcZPKe}a2uN@7+ zvE}34zbjb)6{504dx=<`qsPY#Lsz-OokgQfE+x08&XB$Ts^w;{G~Rap5(@OGr3T_w zdA9?JwJS}dtyrZYL5fyQdRJR$t45g)B8Q-;=pdhN-AOVW41Cf#oZZUkjHh6FZs~F| zSDEPRFat{5-mjGzzxEGudu3AlsVN$rp z=io%F+egz4$em*{gtH{!q*(IL=2}&E9F~Gty3KMv(E)OVa(Et1h-U9)78Yh^@~f(< zo^^rr@bvyhVENBATWVU@Q%OS6%EeUji&=J(zU*TM!87L(5lJ_(x@-T7vGxn#h zdvl^G4&a(HOSfbq2j?v$n@+{&;Dz(3sAZZa{N}PTNh{5|CO|R5QVHBQ&0~5pX-qcz zq%N$HeEx?QKZ*o?z+?!fmxVWiplMTb$F0Bf@k!0i&7~Zjt)ru@`FKI!D!sY7bot4l-zNe?(owN>539ecfAv=~B=>4z5_B)DVz0?7*0GpOIl(-j z{)Ok$cY@yA)4h{Cti{qTm4*eXj>2jl7zc%a!N5x|c&ezQ zmRvDE{{lcDwo-Q-sMUt2zj%XKm92=g_(qitcX}sHObPa1dg43^3MzWSe{ zoavexdcf#}rmC92=0gcD-_mRrQB;v{IObC)YWv;xq7K^KK`NN{!@iSeXmv-8(hiHv zsrjP5jEHbJ%6X#4=n2V59Bdlqyu|?nviWGlrLk7&hl^Qms<`s~f!VsEQxm2+c?yQs z#DyO*XK(;h!d0p32H*tDO*!j|3`50=EVqW+>(u*CnZeQH=YO=Z655M*hj&lZ1zK5C zygA{$wcYN@-yI)%Hqto{81}mIIMt9N=bdh` z#4~-m*iHzIZTT=xVbN) zRqEu*uV-YSjSUYVN4PAQr@o-4QV<*7+DP6Aw!n~$iT!WMN4;TIDGNULmbIBYoj*W( z+MdeD4YP5PH_cK9ShlVv6q+Ylw-WoRsQr@mS)8gf91bxX;{5!)T2ntJmKyP8WV6S5 z)p;^7HzsD6SseP5rTvEm=-onq%K|dPnY-cZrocuH_eq~uRA22?$E-H4D|W-JRg~Vb z;9=6(Gad>OY+0sa64YM;xU~%ymeJ1)2)KzAmxr*wSZQAq)s3G@ zqr$7Zk@axZVdn+CrtGIrpgj z@$G(0e-ncJxB07AO89QJ?cj~6la9ZKIvyX&{~Kq264c);@wcy6N{JlD9Iwj|g%1AI z=xBb<`m6U|{oe!;{x9Ma|7+L#Z&$I!4Ury$I6+UerQrC;(u`bj&;=4+SY#<29z4mP zNpqp3$aYp`X5qT3-r4M$&ml5SAOHTUoq1gv^C4cYdmeH7YtLU^kGz=PrJp5rYW5mst z!|1AVoGYm+`Bs@_@%7V-`Cg4bKzce*2#$B0>Wg75&~GwV_#^DET$X^+KZs8h#^MT| zVnHit4b9XCqF_z0R8}VAGa4^a4yBqU9`M(b48fYx=fP0*{x$e5N(| z-a2^a7TJh3cS?%~zm>RUXq1x8G^z&kpDF#=aa#Wb1;_lN1}&jZ555PY#F1I`B{!xw zYBVBka1kcUDa9wc-)VJR1r6YwOMGLT#5H3d?Qo(94zxMSm~Z^rE^oVaKS1x)%ranq z(YO`fiH${%0m8$8?(LVXJnMe*UhbFs)l5Td_ptV>)1HCho1-l-iQCoZJ&%4-#1?bR9z?5l>i#mP(h;s;*aiCi(DT>E^&d)n#^|$|)ax=9Ap( zNj*N;!RiopGNI?wBmwV`a(G-Ovq>~p?~wEgDw;F>RDFJFCy(|b??mT+eM+E+&;aQh z?%nsCTue8N7)!RG-s9LnYqaWobO$c|J@y*aQV+7A_#l%65N! z=PG<%xceKsVXG^EQ~&yntO;_7-EF^JB1|0_spNMiUVXy&#i5|(#26i|vfdhCI)hnI zD37*$npQ+D;Jac6Qm4~-T20rKRB}541CF`yw6D7`W!eePw0=hgiN57cx-v&jDSPI% z@%;AF8%?M%a^t_~2gioFZv-ETTPHHFs;y`1jLSI{4v*z(DNLJOB=Vb#N*(5QyC=An z$xUghxJ+Q-m0YRTvMu@APjE;%2QdLC>>&F)no#OPy4 z=G|Ers%9z#_2*K+L^7vn6=I_5T6PBf4mqS&08KUA=#D?10Wy|_tA_C7Qe zu#?`qI*kxW%1Ra%lx|Qc{~-rm(!?^#Zi+?9U-qe+-G!Qpa?d>{;2tA4FG;-Hn?X@fc1x&iR*-+}R| zx{kf_Z%}XB#~HhO1QQp-)#2O5 ze*dh7T!p={RX1c&k1Fr^$*!Znn30k&zEUAL_pj5_E_p2MUx0|m_2Yw;kQZpzx+P~g zYX!2M!jpV((W*%vT+}bAb$?bjHaEqn?kOxk-J0FqH9IL5yo=;m9cMx?R2abmVa35i zO`m213cu`dhj=%l#-v_V4mgn!{jTo{F3e>bd7n$8DqM+=7ss^C>2wRq6VV=q+jgX{ zmoVDc#m{a>KxFPdo)>%Mf^YZY!G*VQd%q{M#;W~WnYznuod=|`d> z%X*wcnIDHh^zVwyH_!dX7eG(8r<-wj5ALWe<7RGxWFG6><=aA+{tmq91a1_HgL~1i zL9T*cxiag+4>1N)CS5OzuOvY#H)jK^)TD+S0@&ad^H7wb7~7 zjIz0>%ATfjM*FISnj@5NSS;bot~6OoZ*UF9W(PCBpY)XM2nlU5z`0sKl5#$P&iD;x zH(|wWQq`W)SY+GEmi*yw{~)+JD4>~lp3g1QHye(fGLXT$&X-;NK^Pn^;<6j1D+4|0 z^(G%2fK`$>S#I$=8*0;mipz`7&B#CGGB)%!WvA>ko1B~^ zYrep|Drlmngo5pV6jr#MEGymfG0C(D-5-_yW=^`lt%C}$D(4z)V^hZW+tRLFS`^K1Eev9hR$E|#a>ew2A z99SvXLe{nTRq7!?txR))XoKnQ$s75Lrg_BSN$Y7r!ez4CH?wR>gWjMZw4X0vDy&ei zyXv_U;J3=bF~V1PqHGysj6fhw@300Q=IS_CY){ozpj2RDiP+(gMyT|FbU={g{f1VW ze)N02Z$J@vODKAKIQ5(~J}+vruQ6S`H3P+NN5^}U z0Q4(u26ks*z*f*T`PtxjIFqfE{IuJLJIi;P;yS`y2#WNwsvM!L2@C0$0a$oh<9;dx zNC*zmdAlOfg~yN!UYD}?d8QEM*Dly%0}5~Q-686!r=k@J_h8DB=CcLaWRuo|D%Naa zo3}`Ls0U*RV>KbvMnU8pn7`R@Qt3C}=foB+u-ZI5`SIN!M#qU!M^D4U9Su`u6-5Oh z$n*?dF4?Nw9=fJgYz9q$O=LdI-A|}fHFhv7g{VbIbc2Nain&71DF5LOSY`fObNVxX zo85j(+FcVsu-CL>$eB@arR<^YW`vdija49AxG|=28j)aR5JBp}c^FoO2vwDUS2a$D z_P`LBy@R1e=P}dm8nV$A!$a20c|0BqPNfiu!NWRVR%>eYboGR9YQ9nLWD&L%iMdZ) zXp75L`iNnBcw1-(F?fM_5;u8!hKMjLv0{mgCWn(isx+ZCW~C zF1HoP4}9ehHY#I%Us1`3!gZrlrCs524v&>9`ik8aj^V2Km3ln}$TUoyW7S=X>|2G^ zrH@qpXm<^R8<~DB;FcY*<#0N~q&iOgB+7a`D_JNyFNHjw$Tgx=nM2~LDe(HrhtttU zWqCLl%jOG;t7rvN(KDMHKj|~v3({Fo%Ax){$3}5^RR7D}ZmLPJohi=C+4eXr77E^> z^GdPZlWOURYJg~pnmX=DPr6kxyF2UI$e3NFFNEvfRwzy7JGy@m?|2@WA%8D=FMJpf z@UA>EZMo{|&GC|jTOyFiD5?o8MV9}`VMNz5e#v$c-Cf1b z-rR12(vJda7&qFrWc0bp+X^IRZ{**mE2kgpJ2HQ?#-s9UlQbBR_aQ*y-ScCx*EaFx z!+Ak(Dfd~EQ!ju!|5KqbUNK2aY@$~CYJyl*m|=CBEyaM&i5csxgCzgX$fVmY1r-!5 zA*U?pCV?d^w^nnujmz=ky=`Cb-6#90Jkqkd3HmpGAu&=H4@C>maDkXCk2L`W1vgG+eWkOzu|I;| zhC^RLX(MSHN4N)-FcEQ~ZZfS!|6u_c4RmpnoLh}F?N{HO#w%z#q?K7WLe07GiLlX*gvk}p1MjM3XDm+{q|80h8-RB4 zCB^{jSopUfVeY^?x7@R2xSWS8ArxenSlbXFv{li$rML*;!A?$C9#&@hSYB;1@8jBrZ`=4bFF@ABdIr^OOg=p zJB~(qIv}p=dpZ7d+W2>eBx@fc&#)J5!}z;B%T8^eMAGCO;|4<7xn5k=9TXu7LO@0s zLwW%PjzzoK-k_L-;$G%ebtk84X2(ai)}j`+sc5e}!fWe*Dg^Q}e;=03-72&Iz?qEe z`60?XzE357uxHh3S_db_NfE_}{zz@s^@TOI`vJ~Z?kro(S?`HI*?X-{tT^CJr-+$- zv!Cw+zAv+~jnVA{bC>PNg&ASsbD zS3yp+Jk8+BdoFR^GiKzDc`u?8f^c_tyIq(CgYZP0{D32wE8ypOI^Fk<;36xX)u#V2 zkaA^2m*Ui8#ref}YDP0Jlmgu7osivemK3QO*Bh6<`lXyqpT@tz${z0}i3Il71mi?3Swu&e&DaQL8*1^sh zxCIrwJF4yCj4AoeaVvuGwDh7k+-$3JrlV6WAP^cz=h&wV(U6n1kUCaaCMG_ST=mQ|N-?;<{i`T%4A5^1vPA$hs zMX%*WK++;l&5>f{OhXa~{Vf;(v$ zVII#ZU8_3*@Z)wJm|orM%0Ao7-Em|kpyd=+AMmEdYfmyKZrY#h6d&-aSbQq&kLO65 zj1T%?MC+kMpRM!TEub55M(-0l!+5@=BeU9m4!JSrk$v&nV0en-h?q3DCm}h2{kxm} zei#fVIgbWSOKfDy2u{<);8c+GJ$!xFhzby`HVbl(Ek!+2h`*6wNK!>%ur`O-YM7$u ztZTVH#rAFg`Kj0D{tT^6CXsno#=v}CR0rXUZgOt%> zdXAo=S8-HtV;?{gF%syy+h`!329uMYKI!^}JBlkeSIN-K2O+FNB@v^~TmcJ{`5T1t z&tsbwG+}iVWnu$+^wRA1Nhel%%k=?c>AAo4KVb%EcI+x=S!Rnc;1i$-sHk|*>GE~E zxETg1D@M0+)_E<1Rq1Pg;_sopvu$U}?)<2Q2D8tvqm7uyo?KW@7-ZD`tjlw<>Q@#O zMVu)aci6)J%16A(FeUth{SEON`@-7RS8rQ`UMmAVT(49I@60& zaSVxd#yG~i>114;)~4zo5PHcc$U286xtx7#e0n0Dvt|4#Xn+1g7C=llntwB>>@%~p z1#zPgO`~!dGswUOLH^Dp(geBY^G(M$tH@k_RB0E5nMGvPwi%wX>TWLF(3Kx<(P7Lp z3xo4>Zm&fz`(fP z&bj3N6LrD%S?gqfpA-6|dt7?bYOR5Tfp*i~Q-*RJTv3ZNZ!Daxcbu(GD4supJb(xM2AX*BSCW@ zH3Kd27!3FIAh|3GS}w*b(xh)13ZD)R*vUl>Kh@r?uGJg(Z?vMIXlyf0pA)pce+e$N zTXcwt5Ty5FrU|DH#^y+nh9f*Ay`CNzBQHhr}_^S`KS!vFKkq1M5De&DpIE)npYDGZell z1#{M&1;;BX0q>=})cfaP#>C%15_NpC*F`MucUFCK2GR<+TUSd|}LOLOyJ z>nYI6w};Gd$UELGkc5E|ZC_Hn86HAihrW`AjTvtLL3l>SQte}s!q`(h(u%A5P*3^C zyfDnG#ku~oraq{J1l0Ng$_@}=u6C?0KrG3^4a%f=-){u-h+?7)RTtwfJ+#%+RgfB_ zqLd8fHL150MZ79`SdHUzM%d=9l$YhxK7VZMBWMi^YI830C+pyU2^ASJ59NE}12-3Y zc!gY>yq}!ld38Fc#jczZSOUbT2a1vu-nRA9JaXqv?Z0F`NM)_($x?47LLuL1dK$um zD25^jp4GS=f9TsHES+27N29kgGa#F7SPrfGtp4zsMwms`!R=I)sp8{(iAw!AR-m?e zCqDGV(3G>6%OZNhO&u*NnTvFj1<}eqr%lUs7c3ju|Fc>#Q;9ti40qL*0bvhE9I3-Buc8cHiVC_BjmDooyaJb5ow(#W7!fbBK-POFVJaQC# zu82v=Ld24pk6YwvC993Hcs(BVCV63caAfJN>nBF-QN~um2fejg){mg={a)$;I}dZw2o9UP@F7RruG{6%r+@p=3$8?)c7O&~=Q z0lMy@Q{dN&_5q~dqDKky1d5?AdL9`5;@D>I!sVu?O{@zX@YY3Y%y%-N2m-$01 z)h@2I8>%u6+l_*pCTbH zEg&*6v5cJzDmDUlBlwm4rp<;Jbn})i6Wg7Z(mW$Sc%&d{M>El^cVdS>`@D0wp*ane zY9YD4GH;T{!L0IXWdrXu=<@>2kt3{Id>R#3ft2 z5um>8rV0p0S(F2ir>>EffJ#~yv(dm}R)73GKyt8Fqz7HQ?Io(y-Tr#;&0_(Y_Bc|K zHNrf|;{4ifWZEwKLURWDKb%o8)jPc@LRWXiDGIlQM}yc;GfD>B7w}FaJxbRjJEU>G zf3seng}q)m`Kr0D0PWkvVqT{3)9Zs} z)=Kyf3#eFcba9`rm%6ld-u&A7CmOu;_9e@HSK!44jOFB3{Tr!In+kq0UH&ZvZ2x<5 z{;7h2`RKdL4Dv%;V!@WSw^N(SLRMHcjxS-szv=s@3b>YCM5Eqm<-bKWkhxTCQ=5b6 zv>JIlX8GP^4E((X;8FvBRorgofaLZbKo_2GTeI}(>%BoJw6nlCFWHDV+}kC z{>LAxo%D&Sy_|?-|BR|E1ugzoHy2&&?jWpOM<&C)oY_opdGcv;YTWAc&igr^tVUjY zI^B9;OID>{^QRERD?b!mF=2q36z#vC|DpO1zy2*{v@b@*AM*dnodns`<^*te-8I48 zR;keZ<+*h2bFY^U5)#r%*Q1g$t);|ac1HrY!7ty2_pjwB^UDlDvCR+DDn$a67;|!rUe=6ibNT5( zH+A;OYT&0RC2U>rjxf|@uc?YRkuBf34FBk!qzqh^3y4siXRO_iW8onfp=X=tCA_$5v{ttAt>n3$wV zM+lcE!(>cjzisLqp(x)u9C9RI$im9xoquteg#1ojSVHM?CXvN^=dG3f4l@DCz^7Oh zCB>LC0}peF3bm2RanExfN+%IKJYxyfmyr9*RNKJ^!Z2U5<~a^B7bCVDl6Bl%;FnQ@ z#5Yn+ehbDklUmPKK7^HD?-}*qRvb9JUyOt0WCf|mEJKra+P!D2irHtuk#EjZoi#8DTLj)~(|?ZauI8PI~d_a+?SF+sX@3 zY0g|+RQ-mrb+nWrONlyw0rzCwe7cj#nKOTxglG3W>&&Q>Mrl&Rk27~ryDjDuq?ar> zB_NQpw>ycb6gikANg;BLc8+VgG9wg)ixMgnOs`*$+_;@{$8p_|KEskr#=#}_g+?(I zHT_WR8P7K>{AqsedSoaWrLLGM4Xe$h4=E3^)Mocsa+IOq)dxko#jl5TWbSZMYkS;- z5T#bZd6h13-~$y&O`hEvKrvjNmt|SweveA@DQVEG;;bzDVcoLs^w;GC>~knvMn*hnkYWQBd@cogqEFa4s7tKia-TVr#B5H_!Ywo;*qoPm;n zN@}Imi7@#JAFkpE?8TLzJ-WA>pT-quoV*G-0nHHo9uv{`%Gf|mLI{4A`qOIMa%$wY<=2m00?)DPFnfp z@5ptjXDHHLl<`gwarC-6q&P@BEe8Ge_!;MU3g8K13T^B}9*7tOih6w7c4682zB#7Y zkiE@05ktC<<68PK9^Hqq(H81;zVCT!c2?WrD{5E9ryWm zfHFVbwg#SIBqg<+8S#TselO{B{4sj7oe-~HM>yqsXue)Wyuqe1^1*m=i2F;2lKGdjSZRf+Zrt@!aQ`@y!+u^W>5Gho#k1=1Zl;Yjdz~3D(qg5M8#@Cs$P^ zXU55-J2f{mzZ%QAlF#Qh6A*FaHmGf=Xq`s80Lp!DDmpoLpuSo%W}mlD5D~Qlw6VMc=5nX zd+$369S2#Iq%e&55^0n3FXSHIlv*~89ecCIVh)|u$Iil=VYt!5M^ti^c?+|ytJ%_m zTe$uA5B6}>=j^KY_l=a6@Qz4bJ)bjoF*qfq7s;vvtS?86Yjs=lyt&J)wyO;pk5=>Q zwW`Eh!)Wi*fO)AB&H zC0Z9Pg@VO&J;eu>9eejvF{RA0r3>5_Ew|W>Vsl@TR+$mP9Z@^U^nESM-hxKXCAJj$QW}$e;1qdu3A(Nz61j)1tA!=b%5d_inUupzVss9GseJFjSV2ACfkP0v>}ZC}iRC()YCdiQq+D_ZoxzcOj1hl#pQ-m=oB=ke0X$Mf zj#XUU&S9j?EB??j<{GY&BS0GtlAgje(VfD}{CqwUvRCe+-q!rMIG9U{9T@0;$)m=w zqFpDAE4IV6Ow`z&bFxleqf=B&6jqsKl(mQ!2tQG_6CaE*<&YmiZuZrWt^?V3%+6mS zWT&2orrdzIJXUIcPy_zp{>NB{6%`iY%fVvoA(o|8{%>Hu9!A;as1VoyGw_<_J~}S4274= z&!#=F)u80`q(f4On7QwI()i(NMA;h^x$xat>h&ZlhS$43;me7c%-Yh@Ru#cmdn8F= zsM0BA^|dr*6fHU`GoH>h1rToe(GlIVxjRbzexhV7f}p9rHxIU!>Qj`3lijx6%xGgP zB*r{vL=G>O5g*j?U_5Pf=7%Zn`OuaxyyCee6&PVcCY55UdW%&%6l==_;XV}SmQBnx zpN-*Ii6`{nn478Ha6Ib0uezDH%-dF15fUITG-yb%drbFmqxQhF&D`BcvMrG8`< ziI?5I^mzCMqK*G}kfCrPn3Zgss&S#uBIp8P>)sn_D%Lvk-02^0?8giw_Bh1wbSQ{qY1IAId2WHcQJeay4~W1vQjgZX@OLfFwN4msHZySa1jt?uP2b|^OU z_)I?&D|dzTedQSeo5pPQ2-Gx6UZ8Skgj>k8$4hUJYnZLn8b-0!S2i>Yk`K2(mVUM| zt>4*~XGSwe7hLOVK`~e)lOL!6C=<8xfZ#Lg=hgW)bqD*f$6%Ni(-3Q~m}Q#uhuxyI zbTe=KJf1L_-FK=6#7Nx~c;I54^Qf(U#H(@Mdxq;|bi7EM;!-x;x*C$Gbr?Jv-%`Uh zu?)M_f6&e{`fh%}u?Mr?$)e0EtqA6F>|WnCqclOD@`y_<3>gnXH+3^UOp>N0!>++z zvv%-smRrR#%+QSpcD*abkiU;4(5zXJq;eQtnt-Ng{vu)76hJeD-x34y9;8+h$fOMjYC`EmT;s26$hUU+R5&(A&LA_P~1 zE*(x$PNLcyJOqcPG_yb*o9RlgP|#PyT5H=dmcGW#^c6D=48c-ZV7nV(Cp~ zgQxyzz%_;$S}%$vvPhW*o(Aa{BOcEP$nPTCPRgoQOjVpSb_SnWApD=5-ds6}&*j3W z({5v8Uw6Vq5y=WtHo@Jux?7J9jt>HOqKRrhSV`o(`C=|~G*)8BdFivzH6D}=z$>y# zy$EDtZtjWy4+{`=Vmdk~Kxl>yHpYn;Ddo(qSzT$xtnOjIyO|kM!!(_^#Q-Tf%e6ziP__bB?TR z^gf-na>8~c?Cf!yd~nn*J>IhzzIL9&!aBgst!K$T0HVMP0an%J)yd|2%#v%44+7@(nAWnO$RC4z6`=!fQ$YJa`HIY`nOo z6J()iQ!noI8lGPAan||EuM_BHXG9H@MbuEzSof^{2@?HNM!Ek<-fJI(5mfq9p`-c# zm;Wi`Kl>Ot=OQ_GDY*V_c|dvB&I^vm$t=8?p3=M2EBNnDz%<8Uhn?!UoV=$hl_(HK z=fk9(7+&ZkgE(H|pLE4n88yf-U!2Wz->z>@a@XnAO&MrMNItcQSJWUkHitc^)!LK^n{$W)iwjAY|59XnGaDW~_4!|p1`>cZ`pCS5@Cw$lx z@dtC5_}uBnc7_>ROWS}I171M&SBbf^57M|tz z$u+@TJ#5Vn{9=bETjTx~MnZo7gSEGgimUmyMTsFHKyZiP9;9(iaCg@PcXv&2C%8K_ z5ZoPtyG!F9+}*jG2&%6Q6OZ45PdId-5{ zP01XuO&zkDaKvz{`_w{M=X(#jt)rG2pQSIdU;P&>%vy%=_c6<#@&aeA^gS=qJuuN< zAS71ZZ>IZf3K4`_;f!Z}K;7yzpP@)@w(Vlq^S|DGJn|$zvf#cRc%)wfk*sx>`AFVg zEn7*3ut(k6`PL2}=~%Jb7c*+gTkkTvxc!c3#fwm9{=j$JSVf(MMN(;Tk=DAb-F$RC zR_YG(n~>8}YGE=V;Z!bNu;=Oh$#>xE7PmM4iY7u(_|y{WYr9M&x52(pP1MvQ0Wihd zk%RHb#s|YUO7Oh!?7=+Q-p5No2$k<0zr$M22|T}zxhcM`-w;~^LuDT+m@wCD?!2m> zyCe5}4$vAGxofyeH$8TJjf6waZe`^sD>j}Xc)$TK3zlURyBl#mwK$Y8;_J=bTqKK5 zDsGc~mzxiE7@R${Pf2lhv7R~0>Z>E0S6E?U-8IUFobUXf)ydHHx*#L!;|x86LOaf@%^@~Rl!@8k6+cDgi(1Kf`Q)XT^pZ2^>`Q8N zFXLddQ9^W5R7|`_a7u8Xs8w)oHX09~ebJWxV0aL$_02gsqnn#@Z~r&Bp~!&EYWt;8 z@W3M)jdYY{+FXqq^*fXR0@WiZN$``D1%$rB|gDiHSo!~5eujOln9@W8wu@d4} zFR4Xi2=N&xy!rYEjO@OB&$%{tm+T#6njO&qUqU`;1sSw*_op?z*3aFtqhXmT@{bB_ ze@j7v>N@|fTBt{*=&rciP+ET!mS@}rfyLos5zWIH$S65Fy>&X0Y&A7z8%fWj*xCXc z9EFV3Xs_y)OeLmHhjCpB0UQr#8!pw$D3->K+HXy-UF~&D5L}G<&`Jm*mxmuMoJ@6d z3U-vMzXwOheUym#xLee6Al2m5aB z!sL9=zP`|t0L`WizVoj;Y78sIw)bJ%u9yqZQPXECSDgPAtW$M|D8QCl<+vvjT9;AE z`lNg3bwt%5xBV{RJr)PikHFH0`>8pLyA%?SWO$(D^%3<+izYjHXH;zJh_TU%-F#+U zs+e?mwrabv`!wIx>?ww2%fgZ_b_U{jm^8Fx;cBv7Rbo8Sqx@P?dNz?RQmu%JalWIw z0P zLpAIlLs7H*Ud`cfwR5Jb9oLBkWSvRb~8G<-g!46RdSnCVtp2@b;BA` zL$_gCyNp-)(H)+1)Sf|7yJl7j)T(rFNy=L>bRz3^cHeS639kL+P|*W}6hYQTNl|#Z zKe%Kim6^^l$v~v*S4sR$DY4pADa*aPf76$w-tjOhtQ^4gk+6Bn%)U7O%HnpKifp7EV<$?NztJ&3O%gU=b4g)KsX5DJ4 z!RS1t^v3nVQM^l|WL{g=nD|^l82l+X?JdytaCGf?s?=kIX^e_~XK7%AWy{KP+pzE= zj~M3EJ~q)P!_|6LhN z^d`YD8L$<~Hcc~DvOJzm7MO8nL$f%HGn6IiOL)#Yi8ICsx?jY5)N@)z5KcZWQQP~6 z&*EBPaoy5YKiFM4wZ=(^DRpoDm^$H5lIK@(cd`f;?alGp+FVu~T$PJ;yB@7>vEoW# zx$FW|K^_Z4AMQ-MtHD$f2+(1*#3pw*Tg>P>+)YH*cEYh)jM@4<>s~6%!mjIA7Btgo z)bZ5Cu!`Yjw1uB?^fbjzT7M6d}VVFb`04uNj z5s|};{VD)N(Q-vB5(neI#p+-mkDellVXNidyyQABFdG~}N%dVd6n7Y9106O;P&LXm zoW6Kag06&AP%&n}=pC-!tic!p|1R~o-D_6?k(oKw%jmO-v)4m%9sOrxT$QHyTSs#z z>1BPlWK?6V&>G zJ=61U-R}`}ztrpd9Z6codu|=p4b77v8uUx$(H@^O7xR{bF2zkZf^=^w zBV;hxFACQ&m8T(95<5Q!+U>RUSfx&vudjzr3aH{~OvTm<9PUybw{FK!Av>(7ya2xo z)zGV%uDYzGlB=d>9%ot5Gw)nid$nsIEJD{NxqWYLy2NtIapJUAWM8Ue+$r_<>fjn- zSaA5T+3gDR!Z1}nBmOGKug1owQwLBw3COAJsaM%VXYgx%C7Qg9DPCbG}gi+Rh zv+=N|oVpd)fLmmtjg++f^{{smqEpMb?)(wV_$J+9W-Svv-;JuNWo!d-eDTGkQ_pO> zjiU^!yw-?eJDR1(?dtN!8a(H$4WFVV*Q1@}nFP~CD!L|;JWs0)49Jhh-%rhA77`B! z122=XO9@?e;{f(LA=YWqKwi5O#;(-WLr!uwZa*J>zbA#$RXK15%HV%K?tZd6Q>$#M zF`reY@pRvdf|=ywpUn3{GTGa99!WD`{dK-Wwwo}AGvN6+Ki*$Q#dPeywp5h4W@WKMU|sgwlJ&WkE%ou9MQg;u_I1fY`4cVv6U&84 zYpKsjQm!&5Y4q@@=lT&zND77~3D|1nTK{+GXGOYqBI!Fladh}zzN2(tFU}#x^}Sdf zgt>?Mj`3K#S`U_|gQ;q(ca8}R^CRM8*`1DK{qyk1rgR32p==PnXUtcDEsbIO9B z(8UZ;sIq^5K|?@*_UZK{E(j{VqwG$~k!-1jTi@^F_qXV!WUY@)_(6?TG1#*hJoG`q zu)dR4j90ym`NBy7?E{eY~p_c9hucXx{J7_*5sVtM*4E8o*O z!m8*kVSLVmhku!9d;wkS4~>GpWCK(EqN6Y3o`bYa2mOqB3Xs|XtL3Sx3PzUksmYwJ z^{@Y80Tql>Ts99iWtmy*>#h8klC{X2lPtS(!!;sK28PE*BN@SRM*wQO+nYIWtc-Th zPgfj?Ou_?FNc$M(7;iDm0@@w7e8R7;&!VKcDmj6n*&JlfMpogf<;*G;D(sbwO91N& zEF9qEBbCNww$vkxOwIcJ%qK6k5Ld~>4TpXAGlC~3&6AeuLKP*md^w3_57nvCkt?j0 zG6quTztB|j;mmsHpwSn?8L=OJO1+WOh_jq?*l(qyeN!yNUzndPDRzKEmn_x%rk;PD zs&MmKeKfF=3hsfG?%)=NSCRGNMMr&M{DE+a-5w8Is{d&29c>TVMi==4Y>M>P5w`+Q%dKoE~(4D*N zcgxS6w%RBjQ{itkdE{Hy3d{J^OLNg-IcDXHTKIO5+#_jRf_nyD%}B_j4{bto*+oEa zsFAcpgSxg3O{=!3WU7Cl_-Vgcz|XDteko1K-!4Hi%i~?2;tJcMH^KNi9h_zZ(0vY3LLUXh3K~JHEQidLj z+nrSY>fV928~Q%&O5|@tIqWadwK@w)PfW#ZrH;@!F|lQj zA%xvs^ifm&%*QviZ_IBhL2@fw^=TlsNo{g>5nhDfvhL9Wl=c-HxK!ztt-LaQO&7#qnkndR(N<0X~Wl+QOX+aw3W zBu80E0|Wi~%If(Of%I+Z5V4B%o~FZn%(VcY;prPETpSe~%DwXoHJ;={vnKBnAFGWX zWvTTiGbTq5G%{!P1G=Ye%B7dP9*nya*TLYvLxEjtq3Vk6aww0aWx58Uk-qEe2##EI z0Txim-q516mg{1ZPi=-0LrK?3(Rs5mx|JM+X_VBd%fZ2xEZHivY9{MvvO(nHBso*=POo zV1BQ4X2$wRTTBej<9+-|7HLRo_Ao=E?Cbqg3mX5pvcOSVWtS0IDM@!$Ub>- zAjJFT`+UpEoQ%g9Tk6`;j`>U;zlum<#Lj-1mz%A+`$el=+Idd+d{J)U=lBqsBp;g7 zx$a>cd{XN9_x$D_yi(@{rFHI}SHqpz0iYBM@@g5zqom4!+lnkx3;6J~INlMP_9iZf z-4z5GB( zlw|y*s?b)M)#rzhHYjOo?Cvu2miwh^es1CRRi!fZ5z#*y2YW7dI8xtzsBOVT)JiwX z^g6cnG&BgCmOWe{>fGM;d)ic-G`1-UOH}`zx+qV#NA+ZbZoV9c>|%aReq?#jnd$zt zXG1&xAg%0}bFtk66h5txjmJiZ{w$#K&n;7xs?3iBim$+Kqc6EpYnn^vzxgKo@S{CB z4T6qZ+c+MrjEW>$B0>N9rlzH!pJ2PgtF0gLw_|t zgQewQv)8zFjf7lWqD=p?wt6g3GLUXv@@&0KvKOlZ*3_Z9E(}A9?Ne^exjS&enDWlp z48q;B6b|r=PH}mx!Ohcgadpe|7c z@@Y15-Q_J0=lm?jsAC12S6Jf0n>ncL;AjOT8=+~X^=`uvG=LgSeX z^Z2OkWz6@_T&1iI6S9xEeML$gq1#oS0#Z9vTME<{S`>R`xV9D!GWe1t>H&%qQJVKE;u3$s*e)U`jkcU>|a^KVbpUILt zZtx=9^WoN`kt8br2kR>hDD|)5YBvv`I}m6{_zk?~8pwVPX>_FWhtIGS>((Ax+l>9&!*FyaMFdsfxUMgVZtOh5iaG5-}(6QxGcBD*c zpD@Bu#Om%KJjK}NfcNZbg$i1vYRM#9b3wroU%htoy+hlyk+;N6W=zLc-b`K9QaPSV zIvl2x?0i%ofq~JmeCwjBUz(o*8%ql)W~xNYYRY_6}s6dIZBNIc~{| z+_3tIV*U0&rFVrxi;FjRz4p^h3OO@s?vc<3ho}Ne{hx`rn0L$6VK1^%His%y7S4qF zHZiHK0!k_#K8Y6A)@?0|FAg_x4SHooGNT5FfhJ0hK6*|LJGMp!8YVAu&w;rK=s>C6 z<>0vS3m6UKY4nhxfTUdqM+ri!ii1!%61&T11PH-)zr9hRHUV0wgUVW{EHz4bY%k_P z+VPHpZxg_3>CvBSGAXq(s_$WTjXodizdVk@9#y&74%J~Q4R^wl%oymU8Nc)gm+`4F zirMt5s6=95K3o_a{*+p((c;vi{51iT_>g!@8{hgloUojgoNU+BDX`aBBQCM?B%uGzz+{9Wx>=^@+jeOElNW;ezax^JCk>T>|6D8`ue}(D^iLLp8Iafe6!e;&>va5% z?2P(v&tz@Z@u8zjzCpo!L(#f;0gN?peM|e!@gG&Yj{t#@l$#^JyGre7W8RE1|W9ym-+GJM{)~Do@abD6CzkK{}`UT%R;{61gEB3Ee3z zj_J=%rtwdI1_nqybvc|^=q7Ti6W%p1lb<~Lz#I)BQd82}R8iO9(TB4;50~ z)~+L{-jF#tIA^CA4qI2TrMtqer(a|OT%pFpOcNAL>IA=pe;Yq-0C0_+KF5~A|s?vGP$>| zZdmh}msYA94p!|i7?60oj4gwda#W&()qJ2B7JXIoLC-XHkqTRRL2USQVdz?o2+D{Q zucig{OIr>e)>LQchb_9|-G%)VKG`(1n;*3obQ`M$qZNrTm}j48)$zl+OF+}VycU!qBv z#I;Eq&e>;KY;B}f@Q{_xO&{MYB~4M3aHE={H;NVR$0$i0ZkUsUWCK{5k3GURK`)Bk&Vdv+lzMQ<)(E6`>bXf$g z1)prMRyGP5yu0uBy8dmvY2-u$02D9tNZ_vrG=R>-)x{7gqB+55jo5D=$|6$(~yH3(@|I z1wa9F!X6Vn*Us9V*@^nX&No(Q;x!%u!j<^ImE*T0jzt%Z8)aeg_D2|sA;dD|2WO|Gf91ybFt&I4G67J=<#BVtG1=JSbHF5 zi_^tB_G7G)LPViX<$*@2d1D!{5iP7LQ@IIX5awcRBf3zG1_=DSe1-CPoR7b8mul2L zsoy`f+|L|6v{>OV=e}d!%bODE=-?XdOz^lH>A$-=YRw$ECEm#P^1Adw{yN}{0nP!2 zU5fTQWa|H5D*)+_TbE1%yobAH4wL)sR6c^jMj8|G#Iu(9qJkrN8D970A^k35A4)*wLdwAuASchp2%L6e0A3u3jD z#yIQOHA%j>0cg|GATAMbnglZv|7*KYnvIE*H6GcXB@fIR$El($s8nAf>c71$Ew)V5 zufpA$`=|3z##>#MsL%A~=j#~d)BhhIhbGJVkbiUTRTOAb2AkTvD%O8E7~KE|Ls%Wr zz6`%#*EI5@_rK;3pJXz!a2pX*aJWbHTOikfIQ<68Wqd|b@TshuUJJyxB-rM|zm5>2 zs7!YB0LAvoX}{MjBKWATHG5ei>^{=2zR(eNbLCHqp`fQbJ!f|3PAM$&nGDqA`iAc=`hW3o8#a!-|DzcR9AJ#T0gE8@1FaZO z4~2h|9JwUM{5LUs@FAzdgAvgMCH>&tS?|K)HkFa*Ai|mF>UcbkK07e zbkd)i6&cfjluU;>?uDI}Bvz44CHHM=7!m^0&vP89iWj&whvi9?-$_X z!UX~asmbK!PQtt;Jw2h*sefjL(leW=v1<8zCiQOjW^yw*>`vUf$&SBu!J@tmVwk~W zjsDY|UuIGOw^o1f5Y^~Z$UnQg{u=tVWaa(V2r9EG_Z5eN+Jp8u2;&?OA67Ncc9&e3 zPVn8(9iFUaqRbcN+)eEKwDOl2KBz4 zhkCi6|1@yrf~>xxW0{_^yuaP(;L@6q=JRP(7p_8MMRqNvTXWv*ml3)*<3<`0JnolS z^#mC7J5AqB0fy)Ys8Zj5qK&`ft}Q;m?_`dkaX)DuwGenxiCR=cYVHJ5Y{Jmya0~kS z+jy9Aj?d1OR4=P}TVI@)G5vBU34ymm&AW&$6IWLTGY)xp`&sT~q*{-rJBqT8sz5Rf zP7T+tCL@aBoyC2&t}+)B4b!Es2YP%=9|ViFo6mgRR-~in;Jr2n3UWCa;~s`yU`T{a zS%iq!_pF&m4b*%1`xG`b-od=}7LpSfnc?VQ*Hw>kY+xSzZSgS*@>}uOoxjF6Rz=@W z|6mLU3Jr*V1izL~HdrW;b5^h54;a5mNxQ^8eAsHjfOYL$Xi0T_3547*dV5(8Punc3tS<6 zI!-r+qBwGDad;lomt4XRMHvgd?v`@O>rtL%67* zyPTS~bfW#cLYLQXLo9xw7?5=e!V4o3g2uXng-DD2`vNQUUaD*&s^a6Wwa0Bz@D}8! zjcL6I$H~0r!_Bf>x{Y?_HU9Ech8|*Hb@!)2%Gm{0KF;}d=d$OydQW>B3%mPJRlI{W z3&7R)?qW5HZt`YAE;q-?lDEB#n(Vg`-CG{E=g$edvR=UR47z$asn)|HE3a(Miiv^5 zM3?4A48J^miJS}_h1UpPv59A_ST`jykN{S(ID|a zuS}=z_u`l1$!_$|CnbIOhypnXdbfBn0;^N7fDmojnO9tK{fEKq&lY5 znZ98;L=!H_!chR&H@LXZvB+rZJBy|V_qaFL*D|Y$`s78Sq6Hs-XCO08jt6 zgikS?!joEMP`@0ohkDADq_0RE3tRY_xFF|LT>5u3IYMkqZg)CJvxa1IX0^^ot|zezYRG@z*&U|o&>)5-kY^3g(aA(h0NJ~`Sn-fjrLL6 zkdfMeaI;_+hBQ@0q@5Bdk*Q@C*9K02qKkvQYj+D|te1B>#ZN0jeQ3Ou-CSW@KQ7`B zc(oLTH`&_*NzsH=%c25fi&LlXHf(0kJ^S`nFQM+bRI~o}EEc!@rRFX2XPeB76Pkju z4_|Xj^M<~d;YRq;AZf~l=ENN<)Y4&F85LUr4l75yGw)h*lxoP#P|;^e-;AvfIX}G} zk}o0_y&X+5+Dx?$an+7v&|`?$YW`Z>njF^SZ%%}~d8o6-2)0@VJ4ht8z&TZDLw!?8 z?EcXu$B4Wx%D)}eSLxF}u+L@%hm+l8^jhyn@-nmXF25UYn%B}chaMSUv05^byf*c~ zH?pC*h8e3<`*b*Iy|9D0&gcT5IwVf$y1A>;i>9vZi5)k)r`BG-%wkal4wZa<28&B5 zu=~yHh;?pFQssA|1x4c8hn5TRdCQR7<~kHzj>7dUS5XL(oXhb_8$F=;&9+scNFKs> zD$&vGrc$!#?sndrS3$S*({ z5PkLh5|K3+ub9k7P%?*(e0%y>CpA;U&3X}AMN2ixMyl39#%_+mfsIPfT)%3e^R^r05(Wh(hn)2OKrQsDTLsi*-jLnWmV!a`hl09DZ?(W2Tt+ ze!G$UJENgm9Sx1%NZbm`{#V8j7I{u3`qlTqu;RL1@0T4^cBto?s1DxVtQCQ`XnU%k z8fVTY9qhzcHv?P@=}m82J*3BGM|)GgB4Z9apXX)u)w^L_3xl;$?p!UN>EyXmqhBJl zJT~@s#AJgzLra*u=b7W*{dYVg`>)NjVl|S!Z@^*T#M89V0L15Bc zd9=~wl$(r~RZ4Qmy23!@BKqX`j3uj~u)43Yjh07UNd#v98xyxztmq3L%qfo4Bs7Pr zf|`i$6wg;f7i@Jq@fqE|=YayiSQHh9b%WnEqNB*l5(&$HNL+7S9mtF{QxW@vEkWEo z0o3G~#m$N3Tpw9-Rg2gdlX@R zEm_-s4&4VC`7Wp8IVQV&teVH6y)aH9K~g3pgr??LHfvKkh8xPJ>O-g6om7kX=}8)W z_Ra~F%4!PF&$dD9c|+EoP>2rtp3LXOLOia44OdX>u;5gzc4$axqn|PaE5?)L;GvoO zV>C?FUzohr)hn=fLf zxx8Lax>k>{Ibj774eq;{H zHC4M&$(`>0ys69xoZ~i#>IP`FJWwJrK&@Ep6L#J;*w{yPxYH z{VG#pNeo&&5s|Te;+ZJ3*SQ1R8b5~!8Oe;o(2usxAJ-{bPukRkNe)DkWmjJn{O?n! z0ji?O{BY8NEEYN{6Ubkj!5V3~MNrg0uS}IQjKe-OL6ABhjn~B$1l>% zfm~u;ZcSk?Z1xc3D+HuvX0iUV|FyN~IblQ&{rLZC77;XB#MUUMdxhcEY=T5!?$I$fVf%lIG~=k*Nz-g02X8|YJ>w%LafIxN zCKD#Y00Rr!`@G3idM4*zEMPZj{OpE#X}^zT(80uBKtZF+9H-bA_bhZHmyF-V!sWz5 z&rRjk3-rw&a5p!$JcW*l8uH`4$`Xm2VG=Hg(un@dJfLs_t%-%UzA0HndF|4wf9 zzyK|EZo4C5yM}l_#vX(Z91BP}6`WEF9xH#i#$awfxac2#C^6e^nZ#9t>v8mx{H;u8 zHSeI{(@&267Ps|Mw2Plww~bYQhXHt$f|T-uF+{PEh~!OXMf}tz>ME*HTC!9-=FN;8 zF9FDLv>V{h$SNpEHk@oLg=~!o#jkUB&Aar6sy|-DJixGdmDY3go_sCKDJWp(3=__; z3n(I{I~;AJ(dAc&hrm%+rKrb@$0%siph04^k&vizs9gD(Cu2gYIo5C%U9pE0kKjB= zZmrE7yl7}Klh59$vmUYcQG3$<%#Vzp-aZ|4K<8me%Xc7&rB}-1DM@vejz$g|2g{$Z zJj0=*pcy@nMQGB_oX#{vtb?u{KFc_f*2`kDCV36)5COHU5ky2&IKhadVk$LFk%$7Kl*P(L`SZUDLv31@D;lM*zW*=kMHo%qnm1>|NYq&+J)`bNZ=`h^y!F0xBaF6Tx~0kn z40LB==y;jE83#RQ!!v$cD!%u|zR%SW+D;>3gqv{RFHZ2g>EE4TNNnIx{)vo(jh@m) zz~ML>_rXho+H$Pk)y>_|6DR?`0n`%os+uphzPFforR)_i-K8?tNJWP}-aUEDGWQuz z*Gni8U{W-?RC2psxb|BoBsF!SbM;$b4kj99t0^RTof|VUrsX79SNTYzRy2AiHQMr* zwkGwIk~LjopZf!7umpEP2fQ_N6czZG7H=QaF>CJ|d%w~q$vYA&KrLZ6uoq;Kd||ww zDNM>s6W@LFOI9J-`fe&!oJyYUYWk>U#pe`^ql@^=O4*h+haAlM%@ekamua343<*VG zRM6&G2BtP-PQASh(Nn;z{V1TuD*R;gIbfI@Z?oCn;0!goAfQCrqPpau=s>KphOhY( z*#$5KtH$0q$pOf87D0rzrFQLp{BmWMBSr5q^kXI({wH z0U-Y!_)1V|9sfXZTHmRIfiK)oH0&PX0QHrmtmgB4%Vzh<<{mG@9#IsJIFASVb1Owv zw!I1P#COW=-HnZf1QiN%deO|3lpW*@Mh-1w*hbyP|E5?qi;}-zL z6!mdj>jk2U(Var;1H@^EbGIH0t#?0v`4?J(T4CAz!etNnuFyOQ>!AFUbhUmhAuA=s z1_+!CT_t^L5OqS3%bZ+5j*nH5m62o@cBRFCIXcu}{SSNPlhga)-N)W~$<%oj#pxfA zgvd++^xxP#rj#KCLJgv9&;YcB^f}l1pft{|<_Pc~uL3}>1ZZ%EZ%vrfKH|W!L*C5efIFSBU^fLb zPhReTH-2Kyb7>BXt%&*1nox^?%@Sxw)_fa?c&f6d%xh&K(YZ{&qgWO4)Qe! zyAHf?^1CjGRj7;6X?`TDJ#@2@>q*%11e30#;GZz^n+iTT_8Vtm^;>R{5h#%;&vSRb z&~L#g7-SYFR~3xwiL)+rs_8%I-FI=a?(6)TTDUzTw%x@-^xG2YTGF^d+RJSpLHyAr zVxnyMgB;ev>k}KNeDH-<1jdAm87V`(xABX;I#Gytd=<67*L!6esbBvkC#|pm!}ZH9 z;{vxItP;Bvhbk);MI*x6i5>=j%R#^ARbI&~EnLK-e%d+edp`I52U6=#+eE!(>ZT7= zK?qAf%-Q$ubVlxvtTUA4^koPA@&d%u5+$iU#KZml{g-x|=kt($BXBx8|Fz3=MgVZX zV@=~-pe~B&S7sIh>~r5 z?fguQ8vOJ1Q0Y(0SQ~Go^yVKeHc9qgqqiXRu&Lbc+^8VjiBtIqzmvDbY=kD^%8KNE z{+*~-Lp=)g`|wzb@9UWkgR``w)dET|l%Em-@FeXnjsii>Wap{naoVn8zP!Utofq-` zSWDV+skC6{&q`cD_Y)I-k>+!MY4CmUR|(-uJZj0L)};xKQ)r^|F`9LE3*4h15-Kqs zHI9CI-I`(|qLf)3PrgQu%GD3>U0xRc>Bb2&5r*A@UHbJ!cxI%{74)3HF%tVt!}+jO z!zu{{o4?fG!ffRFgVEr6aLU;yS{AsAZOX?)uf_(8vc#z}Ut$;-t<&4wI}JL>y`~34 zd%1qyROu7q6)0lvwWEAGD?KS0*28<6B41osI3H=H{$m02i{|YM#BWAq^aIkN!ylwW zM6kx-@@f62wkUr3P@l~?~Jt9ZG+0>W!+hS^^vcPQ9pp+ z=Hrc^uRK3W9!G145<=D)ogN)`J{7;un@IZMzm=@Zk<1w zg9LwOwtc|ySGKhC2~ptVPNYcCT}uBtnodQB!ke_gPaVm?oQ7raMQwO4joFM#PBN>U z?D~@zA+B;Gw>+{=Kf@OgkQ?B*FKqgpF7jx#@Seo>Yw=MMIEh)+-@HUZfB$lpeB(tOBF>&YYFNB=21_)Wn^3Qj3u`V?l1RsHiT3%}-w=ZlX`BZ`}X7|ndNWEza zu$3P0Vam|Izq5-E@;_l@6eIWisHwK=|BF(16e)eaGEF@zXQTJFR|8e$Hko_(K`z#d zvs5>w5SdCWSR(eFhTi8`;;eSEchK{{0)>1Hm{>#Preh$TOKvl1`3W(MG+KA4o~DET zBt_p~(}_}#eyuWD?td2$0mxF1XRGXgwyk6JcG7I9a!dVDbDk=tfm@^m~h`3SNm2K#whydGHCN?f4*@ans1L3nU z6+pI}i=X7Ir+9J2WQmyc>*#Wh{%_L8mRC(#fij(2dSPgGj&-zd>BxK@MV>m1Zz#62 zyBRNsF4dDIVmnS?HP$}{T4#yZ=wNB=?DFLTH)5~sESb_$ymj5L2k(2V!bN0I3aItIpJ97(RpQ|^tsr2v;_%yH$ zzZ?rEpPyl#)>_SqLP5>_2(pzSC6J`2rL`JeKTRQb^Zb%06Mv#7K!O;{J2)XS(m#6^ zt)?t|y4LFupuaTm(jtjGD=MDUtMM?n1N^~_uGnftyUcC#c4!Q$WG!` z>!a>XsmarP%h}3lgkhKi7O<^nh@6j2-hY|4e+e~;?GzjVhHzb9yUtO*#I8A9N~RSz zd&dHYTstWAU-b%{m@E0siRjHBs^&WF2(ukty>T>Lj|O7#sHgQu1uB=9y8UMw@KJJ%L z$2i;GP(5K9UVsiGl9BXz((T8K(@*WCfV-bdqh{IaSy%Z?I9C@x%5*HoVsRmHgW~#0$GMF2rV> zY%J97W}!FifPor0UUtEu72)H}dG%f`w4GGCdbrzm{NbdR16wxapg6IGb|zfxxjPwm z3&rshQ`NDKK|dflRvOVQ#XEk(y=pC>0yAlcjRMo)VVztxkF|c#7;&fNICW!p=YFWB z?nR$IjUDxvbvsOaZ8!L2u?a2}Z1tO)A9*q3RCBmDR}GpAfB}MPQls7aFJqcaVc@Be z>?MU-|HT5v#>XdFne80eNPsrr?|DN7)Woe>jUVv60f1pCnf!Eh540dJxJR%jPD`dp znu^6;TCkvYqzCn_wXh`z<63w^^RJ0S0g^B+ydcz4au$+W`3cjwD`M%L!|TZfaj?%- z5m|}h-1hSGG9DEsl)@=cS)$46!o#D>pP08l`hn_N_|A5A(N&F5p;&pja-+IEE@;=) zKgpp>m%{`o6n$ifr~{w7I*SrXMHXj*HH(IjCl)APOY)-QU*2FU`C1&Hl{tGCe{5-g z0rkxmcn%C~>kJN6j{BV4vqOMWE71+)9Z%dal)`#CiUK0xlSc-&h|ZDAo$e(1kr_l` zOsfz$h_>~4bx|~|EeM=6USX=jgk=y@GP(S}p-2agm=CzmaGv@YE1ofbFg(p3zI}2) z`sAtA64=fee+XG-LjNjKWubs#s65DjuHUs?*R;C#^HH`~tA+vv1syRVvqc=amb4JF z=$SfyJ%&VpuzI)@_;kChKCX=>MM^zDvI?Jvjl(sH>prHgxxB~O$D?izID32w(%$eh zF=co}-KIf-ScKe|i0mWp_5tDTJI({q@uN$UfRbDL7cSaTJm`F~=ZZPlvmEufu;XVx z4H^~_LwHh$66PB4G`J8S5L>~F>Ywu%hv-79b|lk$qJ4;@MnbbiAk0qIwk&9|F%VSs zfyc0qh9Wn4}ExX2eiix`#=4vtq z=2GshpgU-YOvE9>@Pr`yh^@-)awY55iFa>?!GMn5H)n>|E{}M?KAhA&-B0CV-8Tn73G7J37AZFu5wkX(KFED!!^KBd zg%GCS_0nlyawT$Yw{G0->-d(O^1fl6aW`*Cn($=@JR407wA86C=bKVT04f!`QRvMh z)`c<6L?IE>ZwXGNGmu~w+0wo`2y$JLLYMJSc{_rVV=ptv`4#(??m8hFMXB2cLBDOg%?#JWgQ z)As;_gh+aS+tC(XJMadVSEtErd1SepfZ!}HOg)4sR5LpMU;6TkV%cl}69dw-W}{_=svGXkOc`t`=p>`Ktnl zux5P6NC-OkU;024P>cUn463a`Kj|azQDI@B(8Jy*t7kmZb6O%Nf(Z!S|1GEcW_is2 z0x{$}d31Ngp>aWD;d;jRhk3q#tl^=y)#+U^(Z9uuU?R$81``9Vd18Lo3@p`c?gh!$ zpWxgx{|4`}boBPgs(+dbq|V}B{2SdvWt{$_oC^FeHUR41-~E4*w?L{5dINmYSqjk6 zjRpR=pXdhkQ?*_Ig0H~uLKIazo^R-k{r@eL@qgNp0#0(2a>WLgnk`iaRCMpWpjgC9lV&b3piKa3n=)9floMXBnP#$sn7g6#JU-&Rgb zYt&_D&@2sYSsC^C8okV;3#E&4G~jxERcgCE-y_pv9lx;y(l_HQta@$egqYey2^@c7 zpNt5*76pqoSjbS|g;IHf09OOofp!P9WbO!~f_&7Rn=yDJ^TrQET1N(RgA^{AjxCbD zZ{WU9bf2?S)||kG4i%e=7xe~euW*8`bkY)2RaU;!M1|YQlM2B}a4#5|b19r`fBO-G zr?#239Dk*4-?#1~sFpPzOl^AwzsP<&0z7mH@Cc{1$Q&Q68_&mU2tE}Zvsj@0q z^@r^LF{^X@*P*hPrb0%DaJZL_LU;kW64RLz(A0FTj#ub#0>>{Dlt%BdUze(G<(GNsmV&(GH%hZ}(wGR@vtw1L$(rgL1Hh*k06Sbp5d5l~k zqoJQ2Ocrgu$S2MXdTD^37=sryP@#%;)=G)r))ywhDtKPIz&j*pvL0JJTr4mDyf~Vc z0I%Z=1^v_8x4Jid-RQ~g?6pWeBFoGOuo~5~Jyjc{W2kJuH>6EmrG28Gf(cvHnC9#3 zuO7W|Oj8@y7HwwdqMz^^?G858ZvA@3>8Ghst}M8ezJkbzb%hdeK^{i#OghpTJ#gsp z;fsTV&P_Xv8xy|p{3_>d9L+`F^37@%}i-KuB@N+w#xGMv<^w)ME zt45AuW3Zr+K!Mph>o9J`;|#-qs$9jQcV|Di8%8?2q+y=JrF2Q<12O)7E=EqRv{eEl z-Lc$e+MJ}?><&w@vP#1iI=ah8F>_a=E3fTxK}Or0vjfEjffzP1S2~*xH^=E)A1y;c zeK~m8@D%UC8UzL%g4Q`5?V0j2*r3ks_!4^G8I+b z!QXZW@IH~*<{LuKiz|$rkoDW55cl(z>1lpA!AIKFnlV(N`XjaBZ% zsc_!g>{=fTQ2Bg6F~tN(L)xHpY%m0EQw? zVm6wkCQz?58Mb@mt=;}2z-A7_?i<7K87w8MCC_l*NdMB8sC3nETUvf;h05b1{$I8L z@cGCCzA;?D-7XW7IRSCa2g!3=ZgC z%&^APnd7W!t3JU5m~R3*QckPxXj>dg^^V*(^)EAAL9aC&Uj1eegYQ+E4R}b6e`v|j zlj%yH?Nwy@9x9VTyrD&(ED@^}{7mz+#^E_0&!019dW6tyHjXY{MWx&m#W*c9nJj3b zoLxAlnIu;;$0M-1EQp(eE}n+TGWT&O{(kV8uK0=79RwndXTANBJ_WLMRfqpYe^&b~ z-7JikYEBY$A8WhUpKkFRru7onLd;xjN`WENdo~?v^;5Fm2Ov2&7Mao=Y^H551fga0rns$T`GoTJDf=xm=1^%7Ba$udL51uH zmG`oK4})Pdi6P8g+8=24ka_B@vjhEQ2Aze>vd%(2-P|`91jP@Z$URM#`!Ew+#L71| zPQ2jntL)Gn>&rGf@~#4CoDei-%7$b1xiX~sxDNh}C4$wSXrWi?OY z4(0iHiKHeFp+%d&=kofOlcq=-1EvTUyVI|+W5D&=t0#0Ch1!jP8?T1(ndnaalt`dy zCt8UAUk0G!Q*)MxD~Q9DC+GIeX12fX$?a?|g^Q8cGp zNk$HCLbqJsuee9wTt=H@jCFsX+apkY2};VSp^$&$7g3psR=dIWa9R>hPuvO{KY7JB zBB8tsDVmjsq1RX*trs7F>l>z}qG03Q@`mFFlMRs4NS`#VSJ?d-FHtGS&-7e90s0?> zOp{CXW#Q*;Pdm9@hl~V@pp6)ij6mks^lPO3@i~FC@w2XHg)?>GM9c~p;YdbQe5CVA zwm8hRuq1A?{?@EoOMO#^TJNW9`iXKR3Dt`}IfsFpKcV3MkYsV1(Qko6rm07^?H91O z6O_lK)Xcyp{visJ&K^>u3Bu(e6cyFh?f5+P}dsL3j4j8I7Pd*BT&Xp>Ma2W23E6yTC7c5zX*HSKO&ZVK(q%XZb!iZis?92&72i-l0BxmSj&-uQGk(H{$98^G0~-9!+w3Ru}G042WpAvRu~&z*$Z4 zQ4xag{frwXlszKa`VoZ2W7t#$L)_{UE5pk>wzgRM!UlHOot}xMiyt7{9h+E6G%|6y z6NSI@Tjdmh-Xs(>!sbS1C%LRRyZ>SVS*n%1P;2h~-1?J@zI9KN=jQ0k6>Wj+xp2xA zsJkul2sWcLYDV}+^xL(J!%^#HYW`~Ap(^Lzk5NSXYd>;34x&h)1}4sxi$t7Ejp8ke ze1O}EG!1&~6O?a9RYKKjCpoEnsN^(RVaZ2V6mhVWA=1Mk`e2=+0=gSFr@gH0-}KP69hW~GdaaG0qNC$Q#m2=1e4ZpG`^Irxf6YzQ z$Ti!!y})K5w$QY@?}Rx$Van#Zo9PJPgF5{-3!ZCZB&v}qIP9M|kIRH!Ufv#LTW*`l z9CKk$yt`oI3H`Ie?`;8Q3ioym?1Ip=IY^~t$s!`+XjdD%=n{@PLk;!;Y)!5))B{H1s?@mGBG!;tJEb~Ej8#U5uzrE_?WYL^nh832*dQ1TNO9gB(00AMdR0(dq0)_K3V0E*F*Do7 zl2swjUjvkQi9z0)bj)PbsNt^aGcP)C(TNWQ%;p6P@y^I>@rs!FN@@ART3A_XaxE@< z_RBMej*A{DnR-rAV@D+SH939;hT$!+{S4Zicsfa{>Sz8MLRxF8&y++(P3@pfUREQK&3T`{T|UQKIX%d`vTm<;?vu zt!l0^x}56-U|h#DC6K%}JyZST@Wndt^iF2MzC=_>N3GmDI8Z;v;PDT`v4385nvkZQ zQ7F9Z3IkJtX#KOwI@)qJbEGs5p~}p)nW7dfj064uqf-TAc=BK`Dfj}aKV-{PT=`sN z4~==3@hhnN#)D*5Gsvlf(i`}!HEwXNHHAs2`o$MNIE`%F=jY)SJQ!G!!8H|`w^#_c+^M?+B7nZ4%R3AH&j}v*#{WBtvlZ7+wx-*W!psdE0y`MVnsiIHMy%)V{ z$YsAsxu&!7fo6BWcr#FsufG&{RmMxw0^MookP-O@z2?|9SH;HQ=PaP{&eUv8&V)n< z?ledJ=jagj9)ElfZ#r(^jNALp4wK>QjUJkH0!*(#*>v?3O_GcC>N}%8CWq4sEc|fE zD}0t=KP}z{%J^LYcf)CV@)}n7aC_%qsbNM;bm&v(x7dp+L)w%ADkNs0EJ2h20ix%5 zk>|CVeEdnn-Zj5r8!{2g9f=@e{D^G7l7Gw_A8XWh7sM|wUswrDv!-mP{py|{TjcTl z2YsewX%k+N%-VHfm%tNyHJ^6*#Yug?I4C!@u{q}??ewA@+8acKqO6QK;SXM#6^IBS zGBPs#fB?I;kb;$&?`h}#QJV>F!qIYqn*K(^NT6`Y1Zmrfq<{_^I7vg&qbY`;(ILJj z(^&e-zmqbAR*Rd$K|xVTZX$5oENtgnVl0Bch@06cTIA*=3oKUK?YrB z?)6&v_s~tDF7T0^Y+ds;&O$i2l!zdWeWF(rt&*L=x;m1IrgUJ-zU^rt4vs4*rG~ zSd-<@{=Aoht?hTDj{A>fe~Abv8%`OjX@P#P_Wg*F zigU+d9a|xT@z?2uu52y&%_>x-)GdUB3f~nkN=@^ru>kg6sN2g{cen*I?u)0tUYKO! zCFMHPy-G#g+AlWVrD}AP$@J4%46sQ&z-da|0;ie6e!8h@M+4H)m0?5zkl&rhX9{*nCvbET7ih~IKEbt z1i7s4*Ej+K>=Sf*b&H_`O6k-;=j8Z55HZ(+se_1zM(#raxjbMl=9e!p|v zc~z4Dx=y9WOqQ6QV0UCHej*9vw&sCe9W|V|RWI~S<||kgRpy2(@B@d}v)9HO{Ep)I zSdXlb6qejp_8+8rC(}fNAQU@vi~2pZ6>W^gR) zG3_EiK}6_i&THI5gx*2>Ak4qA{{N$ZzBz6WfmGEZoId6sgW{bxFSi_hYM}bYtyF@( zz&$Rimc&$bJ}p8eDv{h93){IW;pIZmO9;Y1SrZZYgOXqaR$9Zffkin*@`Px(*JXZC zZW4|Y-y@Vl#9B5>VivgjEAH)dIOF}ZdiN=G~^_Bd#yZOET)j?o9=ORg6*lqLuW6HP#oRv|JHj$@X~HL6pkwT z1B;|ZfGZZ^6zNc+^aSZ8)<)KKg|VOX+6S+v$a~q`&G$jnqxJ#Y&x(#>e9vY7Z)XR`O#y!p(0fUX3B2?$U9^x=wg{+L@u{B-u@|0oV8tRA4U zawj{rKr)Zg`2S{d!(j|kMf^{@Q{U$Lf3U{&42+Q36BXM8rkT3EQL^y(zf;5uD7uMZ z`+BS+cz&<@p!{G{xqAN)5{jH`P(t^M0>$@V^~Z0Qxf9^S_gS%PM*XR4C_ z342;H#tyAz9{sMPK@vBUfVIL=>&*T^P7ehbmBBbu#WJlF_oWyjUCY8b$?2SW@>AMV z1Gg>VA6Ys{@j?C!Z1PQWx z?Wpcj&E(q9blRCoMUd;P5m#q{-CB?hgx^2yT7l`;WFfoy082} zXLjw_%%BHsJ)VxzU(^;kc$4{ujP8fIc#yph3U zbhClsd%tAU#g}+6CR||c%Gph@StDdCy?c2QC6r788Ix0Fn1%!y`OTTv2;gfjtso3` zL!cdfhIwTwLx@6Y%r|q{8~NKQ&6tDpX836)5Fg+7WkOFBpy=mnzbVBC;Su*eY95fo3H19k2wO7nkK|;{X*7riT<%x!^elNi5GV zvdE85E(1}wNB9owJ1j8+#iWT`txd+^6+b?(IL=KJ19fvD_egaH(S+?R%ut>mT5rMN zimaMKdm@^BcxBaTBG(fyq>-(b@&=5^+9ttphND0A)lXPK+g(h1VMktH{NV?wmF*=t$;_J&ixdiJ$E$_jmz=q+~ zDZ_Ne0>wAv|AHS>N2Lmbe_IL6d0D`O^G^nSGTNH1C_!Sc32%7ZLr@3_YVa3msd%HQ zV8aw!Mzv-<{a1}R!s*`4EE&p5_{M<_K`!C0fA*k+dOoC)6n|oIn5Fv$ro{w*5!N8z z18SyG>0_cA7$Ct#OOPwI3#n043E-_7g4qgI6Ma3d3{Qulw%lK5dTFQ>bEWLXz+~?6i!<)($y-q zR$^y{G{{`r$VokmgE#hOEbgai7Z@yJ>q;=8RD!m};n5+@hwtldJfla5N|Y1#-+r`6NBW@gZbV zuoS)zivK}(OB*aJE74@6!$9B9BNfs~>2Bl9-(sTfhM@uaEzVQQaP^yT;2!|=DCcV^dXN|je@8HviCPUpK+x;1a% z)NgCGbVISqgFz3uYeB0)AEA${fXqiWD+i?^;0xhSlJOw4Uq5oe^b*yJoweecu$GdB zLUf$4LpFTQ#t-Ae8h8yKAJ+nmGgN(OwsjR7R?sJU*I$+Ke&||iuY}LJlmESAw6d0C zfG*>jlU!E*-nK#sqoC_H|06_*Ov?aVTv=?6PLsPnaC_PPP45_I9}UI@WBejDfdSFU zFs5;@qj|EApn^RV>lP(<9rwkA<~5D9i(c>9@1-t4r$pLGEIpPIMG0y!d1$L3dMBo_ z=v!-~u#M{Ud+}r7wsq?L2;J#PXxmcK zc7D^TUB~ZIXM%Lz@00Rw1FvU%{08!bmcms9rDpP_&N6tmO_jmF-Zyh~l&gF5S=ox6 zzU_cg0)=aO&A#~b+4wYVXRStL;~}s;`U^yC-gHxEwr$Ozb2!fuW_j_WNjA z)`cUZ=e{o2r`<|^C&2)OA#&e5soAlVO}*}3lnrR*T`ZYJ>TtTemQ2S1yB$&f0p{1! zT$c|+yH%I_M=xX@)?RVHmT3aK8v44is7<1H9@_oVanC|9vWXf@hWe;WA2#2 zBA(4=^cin0HQD=-X0&0`6Me67F)d_2Rd?bWJ`XwH3hPYMD!hKWsClb>}3po~_-1R*u!Af4wD~BngP3DQ7 z8r+hW=&FPa47OcxVJne$dom z6IqGRcbUX6(~_C^$63Kn`Dj}{i3I@U(~WLnCZeL6j!S6_4r0AcKN0dP?qt;mRorl&nh*NB!TCEkfnkeY zX{C$8NxA||Q3`_>$L+zjjImC1_g{)WU#XeVJ5HsKIH@;UfO`|z#Ueo`wry${*?%Cw zs6x#Shzy?4E8V`$OKax9fPml@a%j@&<pw4PvCj*b;bR$BCx0USI_f+xXK%#}bUYt!LBkK43{ zZYURKR3AQ6>)O~^>;-PdA#&S)d4Q z05slv3230>zoo#F?_sLX|5G~y{lJ&)mtE=2KawJte9ZqceERRCp1%*fNb8MIzp!*1 zrary;H>G9T{sjFkNid1L@Oxgyf4k`a9ZBdv5^3n^A4p%)Mg+cr#E&k!??;O-PUd51 zJrx>PhX%|9H0?x3%kLDGDCq6o8KJ#R@>{oOVMiOlPkJ4{9uc)lE)QSFzS(r;TcdI# zXojSqLT~IZwo&e;5e~fSo06*wlnbp!cD^SMb%LL&ftv%EsOerSfss%h%``}<`8(ZD z%MBt-7EA0{2iCn$Zo$3SRXrSSSjl$#dMV^aCVvY_?lhV_>jie_1@W<>bwV|7mhTYx z7eY{I4-3*L8l4=x=j!Xv4u%OW&iDw4M70}X$scm$7zt~D;H&Dz9vO?)3yo^kmDWf> zYMBKMvBhKou@YFGI<&--yLnF+pJ%Sl&Z+x(*SAo+pM(4~?FZsJF%%)__qYlCOPv&! z(ZYY!xNNv`+^S2|)X}MuUc;MPpU_V0_p*7iPI+T0M4oMU;Zl-jGqm*O8W?*I5rWaY3Z#zq(vB?Q{d+@DD#zc&WtP^}5` z0zf9b@^J_QUHr@US-ukPHXw0bhZG_LQSCZde=H}utM|0_bLDnY&k4I}3m%zqVLCv$ zfi^iZYj1! zr2#l3&{x_pUVUHXK%yva=4@0<%;M2>w=uF~9gUIGJF~0>_z|ae1ia0<5)L{WC*RD? z`~y*E>aH8;5{atpnxd@DKdt_*P-&375Q82cuAU=GIn!)nvNSVq|EIQB8-~!GEk_6% zPoa2N7i+%=tppbAYo+F!@5ZA}rzdmmM#*ill4VHAMWJ$|meig`Zr8wrzI+RYywAjA z3*AFQce<_7-c;PkhH5v(w*ns1*oYDFDJynjX_^h>Arm4G4-#qPiU;r&Kst21L|a(D zx8xlO;Y!Pe6cd^tQcRbyT>wW~F8Bt?|Y-b%@>af;oN3#)f{2a#v{L_LQ|e!mwy?7k>dpk|=e_lLk9YNb?y$>(^Ex4>9JMt6nYq{M`z?V*(`wh@DY z9HsM5-67{^W$|CZN0RbwxBiwW|CaCtRpfTeSi4hiOl6($?J0B(z?8APz+7V-o2NV7 zP0oa}O+^C<1WGxWKnkm=%X zP3p>jwxKu{4|anm6<65BO!h{$%U#S)Pom3$!Hma1sd#yG`^Pj;SAZy{Exhp;eJ+DT zAbn)>7WUbBS+F48ggA)%@~8@W z?hvp_?QN1?PX2DQb_Zi0MoL(f9)K@b88vZ>fcq<72RcI4I+T6WL5e%tUXb8N!Ss6l z$@%nvF$1+PIIJHtrU&X^$4j>w7>6!+gOd{g_l-JF^21h!l=yIox$Wu77%9!I5{$J{ z`_ozI0;nRx2$gCDB%v{D6^b+u1q*pg9!r17A#*`yCVil-g0UYhUBj|yLxPe{dWaH5 zFcL>T$zO^W+9C9P){G!ACfmYVBCNE~wR212FKW1OTFA1{jT-gHHj5HV;G+&qBy&Hlv#q|L32HWF#HkA}L_M~tN`wIfOh z0=)ud{RJ=R=!TCmHxmYfrBYK!IdF_5+ESw>s~+0>rBY;AEA8z#KjdsH&%~vVf=-QP z3H3@Pv+;HX{p#o!E)yma!KCJtzGVIw=%{y+6aqQVw+$pP1SRK!!iZA7|Sh2 zVhr?P0(?D+J~Nw?#W#CL9;+5AUJ66Wt)y=BVZ2ds?xR=sILuXWaw)9s{N+Oevqi&l zugOcydn$FGjKbVskAd;RF>;C0dMtQn}(o+8Vm~E>`$ZVnE>M>VcG+sgP z6bM)>sFJqI!3-sfSGCK5WH$`u@o%tncaLm}w~+D7s*YB`Yq;$}XidwJv5``?w-V3yk2PNfR2(TNoD_=);8P_n>Y1dW+e@JS<*I+9pm)+i2difWR#gU#^eC@e$b2#qfe?}8mm;URE`y3ga9O}I)z)aD&H0d zMYNEV7NE^cP7Rvgxv{-w^vATfQF?a03KZ>Bm(|SN6~s*Gk2>=w(0ZjmcPDzY+ci=P zJ_bB8t^`&6;wWOpo)phfqQFo>7$K(vZgMaCy3rwxt|EqrD*vLP_U-h#3oc}P{__0` z{wXq|jaefb{de^St}KhiWP{xTtO&6imKZFCm6bD1i{29R)GQK*H5XM;$xrAu99D^N z3yUG@@rqy4L?x}Y2hefnFH9r~I3$7iD)#5tbix60C(mUC$e`MXWxH>cHE# zBqG1FgGKV+7M(CsVMtb#cZINk9dhZ+6anPmvk3;LkAvT{%X22qViFnT5F5)wV~BN_ zqR9Lok?WCEf8yL-X1r2jFsV0#jE~-T7a5PFp7V{mLWa1`)3*6Q#gypw4ok4cBb8C6 zdM54{Db5K7pHgpczh`=`ZuY;by`A&VeXE{ZC@)ax1Z|YP72|0%w?SxH zRJ3Hhj(^rMkIX1_Vrx%0`{^*=3wW2UWcOp2pmtTS2^Pdh=Y6T9%F)>u!9E<}azo32$!>v~zbsX8s%kg*)o%>B#~#$0W8ZlkQ}Tq%@& znjzC-`l%ipLb3kQs7XgXjw-KoCFQa+&-D1<+!uYA-nyiy-#N#TV_0r0y5;sN`y1Ca zThUvet9M*5;&3gk+%0mm_2xptEfzGAj&Pa$^QWo-z-PBU?d7New*^&YFfj z+wn~WUs~v>jfsDFOUb}~L|duLbiKyIfIks=%biSI;=sIw8PyDP;}wDl@m_A5Nk&R) zR`me3@NCK>k})UM!!5l#YW%h*%c#|{LceZvI1#e)2rR5|=}N=lzIIO=KX)%`E@O+U z&*{urUIkiO;d}JqR^FYO2KIu*xQ&3XX?~e`xhnUy z)3@)tgi%9DIhwO2UYKptpvxRuy8HV@{rinIA{4{Wk9GAZXV=Bg0=-H2b1PZ9S7zv# z#&?Bc{9`(tPHp0zo&Jm*$jA^ySi}tY1PhmqTlXcNTRZ(sLQGs7Q}@05j?(1$Y;8rI z2~uILc(rWsRBG-x`)1IGK;s+u|L+5rYVlnC0$wC#6I9h=V1 z+X);>n1+w%N`q#rm&hhp?4v4j$?-{X+ZLDCT33{*Gu}? z=gD%%r9}Tr>2uOnHuv#u5bl9B0>M&LqgB%`SmCiC)mvhyTdnpueg}(1tlLt9-*VO; z{S{qmVE$g@;RuyQ@@3UQd!o7q@94Cmu+w~DKtN%KVxE20pj{g;XL;LMp!6{zqU56c z*-d7w`;3fr;ovM}T>rZ9Fi(R9^;joS4~s+GKv%c+IM%O=-=F{Sk5(o8P%-Uzht*Zp zjU|tCBW(_#4tqyX#PC3-7^&xgi7x#M?C#BqJ*?N-JdKv#Hl`j0Jguq!0UJ z0TU&l>`Sjq#k-Igq0BSqy7*-KLbJERH6vRQ@z#v$=vzAVMuQL!dsZoGxSK{QSew)AloiB`yz8h^h~OTVXZ)m;Law{6 z8&9UgVn}uIWVoz33Yq0_3Exb)Q|wLkj`;vtutus_7@oqVwu-$+Hh+xUECX3r=trvd z<47Oas8ue*1J-EHy(==li$282Zma%k6gT654CV&8`{j?*$3G5I-=b$NOW41^5KL*c z5KgCt*x0;xq8_EUZya9euWqTCsh%U|Fbf7}r@QM9e-#}gcr}8s_S@CLDafG5{aS3q zd*_fZm*3t-%axA**pt{;g;-4#s(dpafhjCOi@iz%awMOL*9Hb}R}vuIIvvN3JB z&1EgEmYZ%0&fsL7U%1uxVCgT`C z>@Ii>{hG;EUdXbp*Remhcc)h(fUI)W9AD-X!|Il%?-ZG(Pqv$FW=$&S?eaSw;>FVH zzPD!{1~EZSk%rG4nX@&O7sZPv>qb2$t*$>A{3K)*bWXunz<72!SeDqp8oW!*y=Iq9 z`|)rKkk@wtRt#4ZWht)=w>h4i{C=x0Fj|^)XibS5qPP;STl1*4urhl%$?5uJ@!)7R z6na1Oc*8IUyIr%V*^j9qaS#oZ@b;C7JwmYO-Q$q(bhB2*nL1RG7U8yhE8 z+K%TVi~7e0B***$Gh_?hC*m5QcpBN3{uu{NP2#aHrT;E8n0nnZ{lkO1+H0n!#?-WN zvZi6{(1GVxMwX(Kh1uvXp3~2T9cyCuL5zTsEG8Kw?rwPfDs;>hH4G=mj?m%07i(d0t1FeVczW5F~?Jl zuGJwkxzlajxwA0r=u+i*#`#343hjLT-LS?cXVKv_$MVl}1K4fEhh@4zKFbICZy}H6 z{YB2wI!ngD^D}J&sb_CJ(FGws5an^kvYm<4AkR8vcV7Wi254En4U|&7NJ^+T(Kwer ze$PlD<5FR8m{C{Mf>GD686lhCAws~l-}zWIWJ!6zTf5gGY#(zy3hgLtUU(`Pk7Ikk znEpH?8w<}Kj=6k&l$CVjNo*}kxI=Ka-Z;i#S?f$d;9|c^&smpZ=Uw$)xpL+R0sLJ*qD>ADV9o99gnWKj~?G*2>RP9<6R! zu+k;FD>OLY;}^S+#C2&hN#SbunmlW99rS;*yTn=J^z2^}D6R8!YuG=Wl1zTdQ|XYF z-fVJri{Z4zzho=Co9A>!vR5zDWKggH9)J35(V}ZQ$_C%t{Pw3)UjD}BpU7!T5B1a8 ziLq9oxF!ct5oSnhz`R0eBww`G%t`XTGX_a{fBv zbIVn>N6Cm>j{TSm&pX>Aja_5T#OXZqi)4Q@KcymOY2>NAAAcUsB9bXqZg0|^?-{)f z!ZcEM)r8NVc{1t?)pw(dCCZqN^PK(i)LqsyGC0oGUa#>VMb|4sf5Ia>fb=NS=4$?rqAn?2T@}g3TTf-q=%9NrI z9$O2US7tMfzJ?HOXEts4RI^gaY*A!nv}ZNb%qn7FVqJoF_zQ24L_OGT@GZFs$QScW@z%Noe7^{d0(8m6((wg{Rj|AnaTHE~%NX$my5I z5PVar+BT!Yy+sSTLvv>1X;LeqvmTIo!$>d6g8vZY;nV6sJ2efA&omv}5+VPR)%8Xu z@z=}^Pcdn))*q8+SRHT@CFZ#5Cx%qMc4cp_o)mS%aHlpDzk8v+Ojv#`+i}jH@xh7= zAUBAIMX)nYh+T>Ptf~^AEHI+N!Jq?cjtbhWOY_ODg3gOwD|c6ki?#36RB{_=2T zvuB){8@2r)IS}X}-csN7FBSm0M^^Pc4G% z{6?}PnV!4B%*0j?OmDSXG=~2$ubtKphqS9_62cBaBh~0zoIHzEYo+)!u0v>oURM*^ zChTejJhU+>I3uW@8VoF7mMihXnDi62Ln8ZI*GhS;^m)>8_=)Sd4zTr8)(SGIog4-MZCUzbk zO6bxuLS$~coFDVl1<3H*<9~kq%fFwY=}sT~R^Q!j>wq@Q>~%B)w8@Q) zD|0^;^b9_OBNO&+`Y}-j14KHF)_Zu!dixn$(Di`OK}}QdW)lLX@xj1oRdI>_T_@-x zeD$|xIEw%Eiv}15=Ck{ozqsSpI9w?bE_IoH#;kU%|8=hYx1J!i;&o z!S{J1@Rt{wPxC*ghxw0_rDj11hBo2)(27NS{HlWV$1l)=+rI~<{1lj+Gx*vki@!w?!c{q^F1zSs8nLJmf+HN4>4zfIwHBy?Z3P@x=!-VJhgO& z%at!GY2~vQ>sv}MT+iOFGR3C~M$)3omCCKM;gn}pV&}FQ)4Y{@oqm1Vvvn*ytm)vD zNemW-gR=t*R3)R<2D_)L_4H;SEQ}BBM^Y{rd!+f)=K0J&RRQ=~@i8D|g(hlgNkBwi z>3o!qn!GBY9671QM*VlJncnFiX(EtGMlssR(FSQpXW%@r^*h~y`u>&!&H0I}5XL8N zN2`2Ar^NwP)JeqCX;?Ggj8J!y*)<^}cFHO=jspqCeESPrOibHrGF?#KJW{S1UbbpF z)ZIVeHFR-y6eA9Gp4Q;Ki>s5LhQ7%3MAD{^5BO5u%*vf4Tl3+vO z!v`>GR_}okT?wDo=clCkbP=-~JW-K97C`Zh`D>)m?SY(2f`_H?E5`{1xt zjDx#{NWMEyF>c3fC-`e|R+6}pnI5$ifVm0ur(@Lh4y7H*)67XGTh^y(VJy0HlyHQ> z>~6TKcJ(pmkpulXwSFykN-^!sDTk<#oqn+zLR)g2Q(x~d*}ITy{e4;6LPOm;f4X6@ z;_Q$dkhO?dXEB#*je%dqWz{^0yz%_dAHcC2kl!b*b{=mfvYA}>+~|;{s3Y-BuOy1* z&u5yD2~;+?VV#?`6njv^r+psjLkq<-F-^m$Nnl%BOf0 z!PERKOzyXfs#huq;Iq+0%B>Z`b5WV;Hgu4N7tZy>RmUA-%?{o?>b&XAX{;#fM4Je{l%5y_FmO zO#pR%Yb>kfBF}BNUB7UiW>jZ2QL~(fbQvfUs1y!J%~y(rX??hsSYNNO602)Tm^cDi z3+qWtR1!G8lCMIWd3H403}63pHYncE2!Y3l_$tdV7vJordPcjSwJ2*XzU;y6)&KnR zzXUnaa-yo%)YNlmDe{J@BxxeRoZuO}f&VP68r`jU9MKY#)Jvb?~<2eC%0d4*!|ea-Vv zZM{V~HBHSqF84QquJ0V=GBT1~x*YEo6vgne-_*T7PhaBPI@Yu&!d?fvOE;l1v`-JL&{YAVB%?7qMEO(#)DkH3Xlokr%4 z16O2CZ(I_khLt<=xhu>&v!H~7#{10OAY&=ko(yas%|?^ z-}Awd*Ate8Z#Gz6LJU9|q^;UN@thtQcFq}%Xa*ZOLUeEmu&Z(UD|oxAllp#`_|HWv z3M8!+&eK!;7q04jsCD+B4 zS_AhBG~rn?JVkq!jmMnHxL@YI#H6rYHA6Nu1`G3}DBJN$p-)Gzetrd0+%-Htoub=I zYV+g@lC@UqFC}sdE|>{*WGD9ep;Ui@v8f?hg(1U1U`6%v&fmNjbE=`U5p?01oC1H{ znk%~->)-oqqG>5FU((W)(jlj)UP8-LVJ@!&=Is5ZEnX82xNIP*PSMpz$USAQ5>&^z zFxkI&TrA0LbE&2OS|%+yUwNxmBX_|*nP6Vx%VYIpgP+4~UG=@BuFGwh95QN1I_vbx zPerA9Qz~8+^R+!o*Mq~pB*Qv#qHksgMOP5j;OHl2U9!63^K)mS+=QG zvbGQ6QV|PmuD|Q-x6*5o3k7R=sf%ctHHE6~N)lfjflS8EOVngIhcsS`!Nv=|IACEz31P|%cjXeAK*Y1)@m93-=kO!ol1xRk?Q zvq@IfVW|jdxYs!V%aKxLyqNfNB1C&r-0Mj}{oR!48qs^f`SLAxcTlcg=^y6MDRIDt zsEZJYDW6Ph?-^A}!)6Ee~RTva+Ef!~dq!Hh2 zRCV9H%OGmJZ&{b;Y>zcpQ`VwlZj@->GQ;+omJd=^r=DnXEI4ldMn$!xg#No)Rmm8q zhk9I5pKPRVn>-&oASAS)6l_!|W`Kq2T+0IYhQPfNVj75hFYcUuw)n2n1i!GVj;!tZ zbZw2=(&QS3UN=ryzM}@4i)dl$#Te)Rcvni74ghvHwy5)hsxZKP19P0@KKI z{gJ%@B(~UcSD*)rUWQBZOlhi+=9r2kx_h3ym-wUwCY=^{w}Bj0u}HbpDt+xj)BRf$tc zSsBVZs3`w%7vKgCPr!hJuyu-Nu&U;p_)z;8WsH1HvcUU|h6b!|ijWT*Dpr@F2>}`C% zhghU^D63J)b{{ai&ENE(q;Zz<%$|pr4Qp*#w+IG53O*NE*8FBzxGA~MSy@l|Fv`(3 ztzy)Qb8VN$ETZT?X}|cC$r;$- zpi>`emJoTtE;%v7Cb;N)GARgObGr;ERSuZXf_7Ip<1-mTIA?!Zq35<`P7*zb%adQPV zHL~TxuP>R>*bEObaJMk#AABzA$qMB8CP+bkU8c!iLUu}Vt&gkOt-v9A$AZ-PM2{}l zy9GUgo-r*99(TwQ_3_b2B<{L!$E#Hu(e_v0^O+x=4$pROGk%w7KQ18?8DY-UUo2H= z@3+~AdlaorM+n0P9?#a^`cUx5m2e{ajo{&9d|WJppW=4AN5*Wb-HvmIrRh=K7m{aN-nf z0X&2ASXBf}KS&@BA{vm=w5>GO3^^~?+naS1#3j8YD$=>R30&Ym#0x?7s9e8&OH}N6 zADxF9gekyyKpjav`1rrrd+(qozrRh`@7J%QR1p!Riiq^yyMlm%^b$HE(z}!ZAp}K0 zsUl5EKza|oLqd_>2@nXqcR~p@lsDqdAZ!$x!wdRJXGA(o~dX`_PzbRH%T$~Zwt&JHmU;Ad#q|LjXm?j-_>L@o1x_hzG$2cKUsYxAKPjY}@POkEHFoLW!CXIV-JjS>ho59POG(k1b&RT&UFtYM0L?LIy*Iy*nv@ZD};LCbzt@)H&vxnC(EAJzY2asBOC z%4~kcil$Duur=?8Ut`|GoIsJk3(Ci6Br^}6m%t zdx4*V`=-i~GIM;0@@XGG7NrUgwgb{w9ZiW~iN==cC`@NNgWH%*%xjGEID2~}-As!TaPJ_M3Jr z@NaB%(&uu)e)Svrw%dXJ@@2a1&+_C_k`I3h2zy@i$1r6_(>qAeijUgR(7tT|*q`0E zM|Q>QXBFkdTXqkn%Uj9`YDzcF*^RqC!8qg{etWL8PI87e-uhC+lfd|K)WDvy@~E9U z{mfWrSYO+=q)POe>bBAeaO?F~8jL-ArirL>_~U3gf2);=_2zz#I^=+rVnrpd+x)$+ z>2@EEXtimfFWg64?EM3t`Rq+qRA8l@5qox7?{>fZBw!9m>`-zCGO#g8FDZ>q%>As& zNS7d$+4porzFLXfs0_;Y8RB?UU4n=EPe^zTNpB!TVd;OnzZaI;m^kSWE<%imM}+xU zFF&aM9#Gp4EXKX9T&KCm$Q8z5*a+@1FESnfjnY@_W@G|n4Nu3hQK|?nL;G|p@x zM`NN`$4I|On<40P2bWWwa@$7aJB-!e5fNO|?NcD6`d3#YH%?WQId~Ccknd`~%8N0C zh*=`ZS37aw0W-`fewAZn*}wXzEt~VlNId+KqxtwC|ar50~&_ zZbnTNco<|K;)|kWMDcxz2Pe zf+8eMG~W=S;_gC*2Pj1x)bPHdkH7{qN0}on9n+#?xAMAZONmd zw7Nb$CG>y640%LRPqXD!AUN2Q#fv z`lteV^!3LLLi9c=%2&D$vCt9TxdEV2bh$BYoy*QHV`2_6zx}s-hQ<-)`3*M7I2bYx z#s(FY)i3{bVjSV+)pnM!x;m08vAaH|E!szH?;-Fd>v*ZsS%?d~{8xNOKQ)R`WG8C5 zc!17!stICej7?ZgB?YZ_CU97*zQ=yA#3Q!*;lqt?ti5k!rYl^Lx;k7=1~Eqy%mFk< z{Rq$sjvJ*uLGRmY$7E~`sq*mtSt>mc&!hk0fTWG2#q(Dy|K31QzAC_C;^M5{;L4$s z@Y4OYigvR6SWaOhVAMRAi~GAsAvsl_Yv<=$rpfzpjk}4qW5gYk*)me1CALrQ%6ogN z&9JZjBnXVwT7Q7`dO4reRn9nJ)`S38$>m$P%zLe znRz?i?+|fwxf483@i5rO9Vh&r>K?xcc)9|eyGQ>l7q?GH<3zUUA{#QbBTm~ zQ6(y)oYfcWx{oEvY7Yujl9B3~?DlOnJj`_NpizJ2nUO&LUhC%IXC2-{8|(U^f#L11 z_yty_Tt0uIl6COYrwHKHZRm$r&vU_|#fxsb5~5BjY!1f4X=$dQ@2be#1zCFA?hLsR z%sIUzq;^Hc;n=wh&mTtl@m#tzqEQEKmH`^V;rd+MunHt`1qFV4TDOBTgHSf<&TsZE z0&fvNM6fSnMqk%gF&1eVh9-t6(iTURGcfk(Sl6Tz@6jLhqY<~l;YHK?CA$O|g!4iM zne1cOyVYXZjlP2YCxhXr`zHPPy<7arfY*tp8K;Tn&e2kF8U2pwX-ulcX6th^xFipg zq{|prTUDT>Lk3k4PIAPOm8GyB#bxAMox|kp;qbw>6N?D)9@lyBw4H^Kj8C;t8)Pn* zyHVkBcM_Vz1J%Fs3l^Y?WK-9#RiHZC6>Nr`McWn^;a&(@j6HCULfMg$nslT;sr7X@ z9-(qhq&N(kKJP1dMqJqKV|#QCnPEUIb|oczy4f@uLQeNwUCb*`R+!iL1^_nn5zp=W z*c-1W0zxo$^$ghYx46Libm>>rR8Hk#~OK%FlYU=p0bKif`4l&d5;eqJecp!Q%e|VsKqdD*Rt9`Vs zooRTJLOR~V*k8((lJXjxe+K{fAB4TQh2`<4_<-a zI8DiicSZHzVZx&uyC1KQ(OnAspXU^=U+Mpg|M+i9T3mc%P}A|nc^UUvr}qK4C~=3D z5QwPU(r@bip=k$pedjP0m+oeN-QSOCT5h{T`g8Tc zzfec?NwtUVmv>iy$^FfL-e=}7)gr);fLgpf(TTh=N0M-|55#l{bDMnXHuzS`yu|%Q8)f3ol9q}PdVzV zDMI_K*Hfh_AFI|{ek&Laq_xs{z?gJc&CR0@vANiab4^X*68JJ34E5Q$xFomB@_(J9 z^eJs6R2?|Iiw#zTNcuJ$9_VJ7Ts6o0h03@aHY|QD+D`5E*^VURx*YV`n{m#UFuM#r z8lPX0Z_(+e%Bh%^dD`O4aMI#shWH5K64Sm&<(T=2e|zDN{x@sbeoK4;pzYIo&yW0u z;x;$?X0{tchQBiwjW9#ck`YXeDQUhvW6Z%iqTq(LlwMngC&x{01d!rV24x_?8dv~B z*`LY5*Q<&w<1;g0IxCT%IULV}oZt1Bm^R{kj>oKhX|yAYu1tBQWKVi7I?^w0L#0l1 z6urTlN{C)6`P*R*s8;%T6!er&wSe@lOw9s30BOuoPTHXLm|WKvbS~@H1JtK=E6tXj z1ys>eoz;k4x@SMTWbCktU|4$lS`W{q!S3R{F|f%m;^9`W&l0mI33WTef?2)UehCYm zTx{(2>=lMx9rv%xxA43(ZYpRN0f}z?NVGo(pC`#$nOt3({morn1*a9ra_(}&&=u~M z;ZAYd2H_&d|B#wV^tYOrpJ|<`qCeJzeJ_+K;Fp=BGN19c{hu;I=zBPOHF@Eyx;<3@8Dt~Rx zLn8hs16 z$w-zmYi}K#O_KGHK})@s8J}75E2F(Ldv1;*HAPIP2t`x)BwO_y#a%Rc(38ds_s(}Z zslu7iy_}|E^nJvs=zIDl$#AW_$`2P(bj8}N2bw(mQTr>$wga^zRd%VL<>KKj<^Ic< zkyZsM7SCuQD~&aenwg%qY_B1YB;)5f&tf}%yG6wcXQK*`l6seYq8df*H@x!*==qHc zaY3=6S?d8vVs5TlIX~c}ft1n-yfgY4Ds~bnqN^M4tDouX+aBJkTEFs;-uIoB;e2F9 za*!wsReQFR4c7Q9=WKjIaF9Xxs*$&Mwr)huI+9pH`SoT!UeM+(6~_wg6WO- zONZgK)J8>ct<3^!S~oQH5+}dSD`(EQgp6_eQI*e`|IiMgQqHNeJrud@$v+f*g$L&9 zYEeFJM3R%4u=l59(Q#=&24nKQNRY!(4nvonVE)g6=e$Zi!~3b>CYm{uMun({sS>8B zDYADZ!C-I)gJ4I+A^}oY6uf`_(t>NhZwzc7UI~DPT+DqLTOI4oik2m(Sf?rc5n$#VGRF{HJ* zkD&Y3QoEKp#gZlFX9>-Y=(%g3IXJIsa27MJ@?&9+W`v+SEam7vY79Ub<8Sw5bThtOA;&4(0g4qSaEZb*4G-J}B! zBj`VA17`x9FlG8}Ynq$ytSlR=8nQdF0D!rT?F=+SN>Q90REL5B6*`nQ3pgTC6I1J! z7VI$r4KM(0KtL5!U_gP-&-vcH4Kt1ql?X|1YT9$vQaIeOdiJe!dku~r)Ju$vAgZR4 zlMa%cAV#!dyu&X;3k78#LVLAp+RnQiOQ54~84+YwC*cBq%hhgQ6GYyH1cwJek<^IG zhwZ-2gNJaHII{`M1GEfcmPXyu=h+C>dqt@Gg4E;$W?cSk>u&faYxe2EJ{i#RX{XPn5 zORm|nZTOFOPzv z#82Xks%JkG1-5ZdG9pJpF?qq@Mmu%kMg=+Jxh*~9jxKq;ViY&D=FVq#e z>ls|zVpRi5?Ym`N*4@^rfqQW~=S;^@&jim*DLSG9`$1bRJk-Fc7LD1#4|q1CWo8UL zre>=Nm>jezTyDunPX)MUp&+|d+Elu9J=DipYqz`hi@2U9uCn=b4)+h4B(vvVDhOGM z#x4s}>K*OqAzNo;E4qyU{Rx0kwdK{czI*}Z$OccysFQOWnwZUUGnBt9_`wq=qsj*j>`+u1HASz1|VCED~- z;cjMyRadk_enmP`YtxvZO?pYY^-tL=$3ht*I<1F<}X?e z$mP7+4P{0%`SHtSPiPVNh=uT~`C3>qE@ry(K?0LO0we` z-RS5Dujx3^IL)hp*d2@7b#yS;8sMkBNwY9B_bk1g!%{MfBZZCegmm6A>v9Gi+rNzk%Co>CH$7J&0(QuBMune9=CLcu&K)yGI*) zFTZNbRf(w5>ZD+qz+zDroZdgaJw|>U=6Cq;`h*+7f3I=dH4=j?>qPFD2`WL>LMz%9 zR@8S&uS%DL+<4*3rnVe}r2Rc*etz9Qn^gf_s#hOo8{Q2#3f`_2B_YvE0cC`he!X$_Td{&UleYi=U3r&38zRrKy`g&T2R-x)^8WS8P@@=o@KR zn~&y{89HP97RzuKb#A9x_z;^DRcQKHK=4O3XIy^y7=I1_c^~oL6{%hS=0CQf{O_yX z{_~H1SN8vcI>P?SDemS>9`~!+%!C?62o?qnE-%6!EJ%~cKwutPUEwy@VB4&~vNU}eD+JsC$9ST~QE{&X(@H#1qa?Q(9 zy{iaz-QdJu@U1}}wt_Lx)E_3#Uhb_TTeBUcn7g$YkLelqUYj?%LWSKhG~!cT7FZLc z*_&RroxLyjem~Ry5q@#|xm(+y*0Ke6l$SA`C_sYKR4+EdEqDQXvXxW>Ju&6f6yp7d ztB?lV`D{5y_^ILqStZuY8|wetT;>J4-DqB(x@(^rE$;1#ZiN-0rqWdS@*HO&73pI9Hcjqm^(F z=X2SpxKV!-!;|=7b}31iiHwE50Pl@~uNaj8{95QOMx?vL;5_-Fb)b*w_7qTkK;1;STaipz>KA>5zoRYH;&AN=K^ymPEJ_A7~8ds)o8k<~eXL-og zH2=!12~QA30%!L}$y5iD=0?BaOg3cIL(NTFhNsRBNl4Pu^5=3|6WZ`f@b+71?Y7u- zL||ZGu0(XwMQceDQ`{_f;=b};YD%(r^F$52M58u;>!06co%@a-&mMO)tq-zN~^Nff|P>^*;z2{;@(iFD(HDh(t*TJhKl z@34YLX$s@3BcrwdDesq*{qYbT+_!P6bYHIP7nu8A^Y2jC>sqoW!{dF|-~Nm4_rJxx z{ugw?>xcZ8zHDmt*Ux}r!APRt*PEO%F#qNSExhResc}9P_3vwQ`*RQe4Q>4IXq5kV zl=VNVnnuOs_lg4gXH5$+LyGv*kcnnr^@@J!SqJ7-99ZcrwegC~z$mB|zd!iU^$6&; zCs`i~nwbQ2B1gagt1B}ipP_^J^R+siTc*95?&1+mri}w;a)6V`me>&~u0{x^CLUJ6;@~= zdHe)R5ukXw5nFpV>R|G+=#A9SUS9oa#~CDy_iR~#8}CUM^3GiB`6ZRyZH5sJ2`<|@!+aOEjiEJ9 z*rA^?+9k3bC&Bw0gibd)@!a=YH8XilpLbTGkWV((Dr!2j7JRebyYc$v3mrw*T9aX) z*o~5L0Fb44rt&iH^-jc#gZLj#th~v78G-&^W0Qgl(1!bIJF?`fM78e+pl~sZy{*-h zR}vG^sXaVbaMt_S zGnt3SHSugRHS3Gmt!Ukr39#==uM>^>6%V`M{EA1xL?mjLX%tq|s~LLAdP|uO+H)fy zPFcTl$3|iL9;)<}_wBgXdF;1FBjgotf0^Nr$#x7g^*&)uBMeEF5FKe%e1#fq_+Ywk zv=?-jGo!)bO+eP{t9$bWsr#-EJc7U97nxAvf-Z5?jaTATh`c&QeXk;>nX=nn-ktEt1|<3-pCwj@EG6o@CpmY4&4UO+QY zB_&_#RS!L@m>m-gPht>FJax9|n-O!;kHR{0dSG z=zd>)O^UN>nafweM|k}$WqQ{8!A>ia&W=Fu@e`Qk##LFNu4{0>N?12oaulmK_d)Kg zB*w?lbBK)eyJL*cb`qG|eNW~psj*Ok?k?d_D@5SevRAx4vUS=UrRDC)RS8;F94Ru1 zlkvJNbV2I1B>|kc=&n|8$*VlAKlVi|TgHe*+;Pr84<$-dv zo93)LnAvd}c*E~L4n>5Bjk?Fs)X1G~MP5SN} zM;|3on#lxGR0Z zy13uaV=~wWeUt*Ae?_?od#5laQxH)32Pdmp(rhqR`P_Ijd2( zr*c*LI$^p53NL#JJ%oW8>k-*3&mc*r?=?WDZ@vE@{N*N|jF)D>9M?%;X2C@Y5V6188&nrcF~mRSKD zWfM5)-uRo&$3uYX2KHf2?u`}p`;4UT>wG8^sfOKi_uMC@!~JwN zF*I~#%{k$qRFi4;>oYTXGszJoO}%8Ep_8k0JMfTKb$}fuS|m7b4?e=_FGhz!-O2KH$f#nk!8r&#N}{Go&lmJ4*HH+OWjT-+k3 zdw72kJFj1M{5b#>BR=2E;3+~1yJQacRx0fu&pIWDCz5PwR&U}W5yJjf92dW6y5Ktz_ zN}(A)$8X%-_6EJoQL0(%Qc>Kebo4~kp##OPEYn-kY$X=K zujuO{W?H3w=Z^4GBciMrb3JM2XU^icBk0*q(OWEnyjc;kWA2ACkOVWm-=S6p@A0@Y zDL`7}MMFX*3)ZCME5`-_)5Ysma4(~Mzs)Z>GUsncb9$b%gN!P}Huy%?ljZf`jZdB0 z!|P%kvm>7sqI%0~uA*i}{wOL}{a{>fW$P*pq_! zNM4aD>%N!A%@nCUSfSp48;24Hy%B^Gi{UU?5BB#Im7`;CTrj}Q= zgu+wnJ$hD?|E26R0sC%)oF?r|hQ8{C?mx)xqxE1J6@iVOiEQ4nC*aIVYiNI~@e1&M z)MvRWvj-(UvQD`ZAq{Qm-7;m1X&)xR%LZAF6{hz~3sVaat<~NvqbY4!V{qU<>y?bl z_8vh`paJd3W@E;xSz)l_YdfvVZhfQIm43O<()YBO(jf|jvi@01kM(CeFAZ#R=_Mi4 zD5yONU6IM16!{3Te)vZv|Aw)rzY11eu2x^dto1Z;esG!4MCvc7V>+gWS8o01{uThd z_TJ-Lc~Mnv?%2$<>Jap1;pzIOg5XmSrlIP0*x)EV7I$sL?;HlH9DF{?mcE$kW1P=6 zE0L@k>s84dxUuY;S*A(p@e&~R%DjrIs)OUx*=5VoXovvMVtw*^ z0%eh(v>jSN83ka5uCh^h=&Olx&iTxOoa&V-avE*Kk6{TTM&4Nd?jdTyyyVY)tUZVF zCVkl2mLUU6iz57Ssz5~CkiP7eAKqfD5H8J)cxH_# zTMsTag|6AFnXQAx)onM|EfYRetZ5_+zR@A$tD*5s?vymLlYTm=$!1qyZLgfgvD9Ti z#-VM2!n}DjEcIieTaeG!@@-8no7!vij~aQw6L_2)`Y2_PVZ1W${rD%!<`iWMvZoym z{D+Zcsj>Tourd9;KoQQmadKPwMDk_yDB+4y8nE)~2%K6r$4503Ygn_tjH3iA$o3Wf zc&=_A2rIu?h^il(!VetL&!*>`03+MX2uv184m6X}AK~&E?C7(*^+Qsx{wihA5BQLD z{jhYXFQ68M37=-4eKUW*_|py*+Yl2v>^PIuM6&M=DpG4d!iZ|!I1DkKN>H;dN$-rq46%>v&(hU{tS)LoHQh>2cbJ*6Pn}sl;P;Ozeqj*a$6zk z?CO&-)cH~BIQg)HfGV-S-nOx7&FRfpb$QM!v)D%K$rUU`ElYOkQ^Mlc*@4O)HorQt zv98ggckJV7ORfX@%lQpixu?p?FHm_+-iH>?$!!u-3xmhat|D zqh-24yIjL1YfDtVZ*q}?al`Eq2DL7#l$q?VjkZIU|~%ID?R0RwjP!8zGX<{5zgU2oD);rm2ddGtJy&IRDF1$y8VAgW6?cc{WHVhjagrTC zN|`mpJaE0DQXWqRp>itd=cc^sGS^e*LOwaZHe2RsXnB(JQYrkf8pc!T(49g&+7YU3 zkJSytX;;%zq%f#aok|A6*)B5N`EB=9>Seqv`=b9!j3dsH0u9XnRj!Is#R)m>aG4>O zibZ%@g@UHG6S84^hX+ZM65g$%>!>tX_kvV_vPGiiX1a{Sjpyq8pKh)t_6<)EwAw^>dsZ_m|TB8%KhTQ%uU9{*i2)cKiJHeFn{eDg{r>GOH&+O+L z)`5E+&$C+eJf2BE+vr0Qj&i5X4}2C0e-T@ld%+v5=eQZmVP?YsrT_lzeCC4Iy_@N; zw4+rSN80Xkw|zBn0%^BGtlNO@)o(tIej-^d6s&{x9&r==eAV6 z|CiErP9Pl8Wd9Mc}yutTdYu!$^#`+Ybz70~+SC-pKezSNy_$~J_WN~$b z#MFM}q&LwdzGOZehZ-@cx0hp$IOGR6Y`QBwh`4!XI~yKOp<+axbn*`)F5 zXoa%b=sg5`6h%wonYei?nm}a4sGf`gVpfBYXSIlb5W&DP-8~i^hPHDf-JDWN6o?54 z#g+VZL)v}17;(wrU(kX|=)e$CbG=_ZZ&PY~)HUITvcs%L?1ZVi`M4|ov`wypOX13w zPNMxdE&d+$_4_5f*zHS+Ez|Yc-VruZi-dT^)%NI^fnb-w+7(u5?EK0LitW*dPYchL zg)Q`II-GIENtf^Kwi45SPLQXyQ^VwvlB&2%o19(WsPj@x>M5AEB-!TYcKB_!-+Zow z2c2(B@Q=hiNQIRMC(EkO46?<5Z>`^kF#%Qze#RH&vv*5MzuyuX4kv3Uj}Z=(t{NUT%x*$ z)UMm@hVjFAu{r&Nog6bi9PeUy$zW5h;FD`M^fw)-m6E=X$Xaf9XFi&E1cAy#O%gsYZ(~MITX_7N0F99wvno zg{ob20Dl0z^j$=i1(LhRtB%TB@hDF^0`&atARbC|8e0L(T+G;8xATPWm#llCn!&?i zce2X=kli;>{-N~EQHgL_SEL#dQCsPGH2Cb?d_A2tF& z?@7nD;ZV<@F3DmS(8J=VJjrv;oj$TzKiju9!s`S_eTHmSVArHpU5`X~tQA+v#T3PB z*26#V(>dA}F(>vNuqKFY4^&qWp6we?#m!{%hKb4rD7MQ;W_YKm0X&vY)T<+pFb!-M z6T>utb`8bB>_1A52*dXYrH?gK|GhO(NJUL-F+(oZLJ`66ZCNTRc99A=?qvzSA}0W2 zf|pX$%P-H%pq0N#8M3RVIxnKMSA!CRyhi9$O)8lhOVVLuZ)y2J^JULj(|8AF$`3MP zS_7>eg_%EPzx?M+lJifCeG8CLiQ^)tY94BKTFe1SNgET?g+aquA6&Fb#-;=hTG0Z^rz#iqd*b9 zg*F583`fXJ#hw|0nAT%;od44LV84;kkM#)lBJLr>$B#ujgyv$=v3_#iJ+EYqrr{%7 zS7$Tz*u1@F2-o!KI-=lqB)0sV-CVWX12|xKI#P2Zv|#`-=6&0y5OTJGnWWkA_8HSQ z4=A+1vVWsBwRLuOZs&S|YaUG||AfBTKu`fhP!)jI|fHSjp4bThul={g-+8Hk< z*S>|#(TigUWTXbapkBeT2GdY{gY|qEe94=F%LN>!RL^>??NO~F5)w_U_;|+fXt*9R zh_AC%F;63sm~hi9F-3dkLQpw|FsFIOjy4Nw-9*1=vY{5QyUD4nPD^(YEWsW)ino(d zlCSO8k8G*QE~%<2b3M94N_5x7^5ph)3CmnQ}OGg&rzBfKu?Ra8p0QHJ)N6rF} zy5_eVP1$1G^ z#4pi+|6@w_`l}+To2`J`L7^cFF`40CC50|EP5;%An%h#+%dUbgM9B`|eUKk}N2!V= z5c5lSXLV7FIMdTMNo z`@5d3N0Wcb!V?gBK~ua(b7E>knG#=cXPiueKT5}Fj=`k}p-n)vsJdTX; zRN5zOmAhHb)$Q6jZv6yVjd|^5<6&F0RzSmV-b^g3G$b_l&a*Q+^Vj-jcVOrOKNw@ap@)U#l z4`2vtQ}>oE^pY_a*}$58IbXN=EA|D@-P$)1nIZVM>T1JUPr0m0gzS2?z%z}a2j433 z3Xj?AtSx+~!lbDrKebXD{W|wHJaDw=<-h2%G?-=Nr}jIIJnHqBd!W6Ld4;66M%0{*HQo2DE>qCU0q0rD{$&)cvghkS-s{!9q_)+Jky1i zT;OsIX34*bTS=kj0 zm4xKg-r1Gr>Ffdsuy$4NIKoXBDEH^}jqT#!{-b1Ju?S*(ii;pl@V&xT&v;*%8O%~$ z_?|hKK=%f`TD^eVb-!MdM^Xd4Ad9T+u?p&=j3Dr*_VqI&2x=DB9C?_n#6bp;0=C$Y zEw(f>9skNcH=b=f~xkP6~|e6r(c=6kwXj0j;UtufyRfqJf@QRm001B{Q}+Y$>9%0iZ> zjf>aFklIL7GICIy6r!=F{O~&Fn{+qQ|0cE2*;^7Ept{rHkfP&#iYRP#Te@4K&a-OQ+Vp4pFx%x1=Y>l6e_KNc#9+F5;sg2+@ zz~}nd)k$Dz==*gEpYtDaX^##^W#cz=TaCGYDdb7*H|MJ>EKSxQXf0%Wf9>``o^q+A zMqG)z3{lNG;9TOicg9(g_LHsvE(K#gIuCp z3>s4Bm52dV)YA%`R~(k|N$$ zAo9&_)u123BUNDyc|7ajY|FoUr1WH(P?Pt))GXZZoU z(Rf!(=42PSD4TMRYI}Uo*FrN=`aZi)u^pu4d`*2D@5e9cs9#N>tv{Z(^=lw@R8Giw zSi`4IId>~j5i(9f2=P-nIY{3h&mLD$nI-Y&9Q1zM^yB1L6*5L|2QOE`f967l7PWQq z?d<^P+p4Z#3(qGL^EYUQR4j3(U;UWebf&ULrC*7@L@v=+OERjRJ+8DR)pR`C@p$wO zD`o~--2UVI4j;a4ap&EHkX-9&To=S{yl$tb#Rut-!Oq)fiapH>rK$VZq*2R2K!<;eLNmHx@g zB7K>i-c6*U8HWGE0w<`^La*a?;*&Duxow%B_upu7R&LLIuN56TW0o$TdIqIv1>mHDC2paJ!dOx-f6(%w!- zKMs?gF?yZtiNaB|R0hO%jOy7rj@J{Mea)tQkV=exZx0K2@6M%zq2A|sec$z)xoofR z(b37Ka>V)l#0FPe5BM@2$a$IbKX>nlycPK8<>#Il*ZF5uE2|9LxvqNu(7{Dj9%ps@6+BSFG)z{J60j%>LaA@?()gX7V;Gl6Lr>2J)AkoZ zB4Gt;m!RQ~`J}gIgkD}3@P_f{O}~pn6occp{p}eXV=_ArwAj;6YWT|PFXM{;dY+VK zXeR%FvndY{^V!Kx3wSMh{SQqF8+*Dsu=<_4)s+G8NvVx1UaNcb+SPkBS*pfcX>6}- zgC<}vrKR0+Jf`z8#5(Yln;3mjZ>rMWEv@Z5J$q60<;&Vz6pZJi5s+=YQQ9<$=x^vt z;NiPJ2b~Y5i^hK?p`}_7ba=HhZ?Uj2CFH*Qc`t22Aiqo9B-WUQj#7BKbz|y#Sf#V` zh@v#ziutp}+)mI{`ICX%TB0DdonUn#dS5piW6?|s)ypVG>W&<44c9b||LLU3$Rz*8 zx=mOp#PM_-ls$$L{W4QlQK4VGGP+Zk$J?)8mCfdBo{0$Hj~suL#Fb7pv&~*%%ZNco zo0&2@2sbm41^I{*ru7V**z{aB2J~7wX=8;32Ze2y*vz^;I@)T9g@P5wo%4cCYp<(I%W@}+r9R2<{!HBbwdv4#@dZi1NBf- ze#NKl?u*%Jjj3c>z^%z`%fwruH%HT@ihrsN#RNQcU?+hdtlAKy^}RBUi%Bz}USNL{ zz+9*#b>2_MdeK#Z`n;kUJlwY#BAxLr9ZZWHb3Bjdui8D*%%QTe2N!Z?Dr<1i(I*lB zN0u$OWTywFkuR7`06kwhJujokWDVoK$t;w%eN<}~Hrp)8w!pPlPyC5De})aqCi4e= z17em7=mbbaUO@q7C@3!O;n%yxk&OqQuH=Qd*<2o#$XShz^&N(LV!evgYV?vnOf(E@ z%9>&nsq@tVBb0hUUNji}0^bJJypNX-l{1D#LOPqDwZ8>JHOBIwMxJKuG>0ue@h+9M zS&An8{U_2Mf4O}U8Vk}+fEG=JxF@{Wru}^i;EfwR%9xv^Lqd-_Qnr(hLK*rpvlF{wFoPR9{!WhGxXAuPhM#n>NAbV`;J)F26q#yM(!9xjWv)kI&0wQ z#MGAIXr_j)=Tr}wOu`SC%gFYtF9z{BcMml=DTi6s3d*8IpDj&^aXu5MuuLa$vyWr! z?(8eztH{^(=_3sn{WHY4kn`C6qohI(#>t%R-Xv3NJjO4zAkh8DEsWdc0V2!N@=91{ zY3saWvluWd(Sqs!HW$V0q{sH4F|VoFUisBoORS347Ck}DBzqwHYgc#I;l_mBm*3^` zw(uJX5p+TxqZG|HY(SMO^Y6N)koCsadBS^OJYt zYAB_(gCrQCepTZQ1T#b!&^*%xSPtRkZ)2JVLd=wQ)(WQkpq}n0DG5(2t%BQ$hQ{qE z$kYt42jHJd*GWNb!oPm@y@o*WT06qP3=i!Zq&lSxv%p9tpo<8`XJ*ZS;QV3%P z_1l>*uFG=6UER!8lQ>7flVwZnhmnr;HtcSSn5W^-0@YR8k+D%W+P2uVXR^#p>jl`q zEf#}S6UZ5M9IcJnJ34b2NQct5No3T_Ed~GmnAfbqN6Vp)}2Dyplh54Wd@Tct2c3h0oEe zwvWX}ODK=JK<%~kc$ttrw+8_Kkg3led0FzzV-1Zi6JDj()37bV#g>L&Bc*~T#3NWTtU8zU&paed*$`9a9+3W z9F2=BvzVQVJtaqYbwNhuy)hYN>b|X^{A3Jqt73 zeBsm7e0zDqQ4HD6bCs+V0HY77`LXcd62@-yr(dx~%JSCI6kAW#vbl}osrYcEd}In8RvV#$cr$6j$gfx+-weCD zLHVA>Aodi#GcU;CMz>+7Y!q}xJRaqmKgL%hP+gL0hJDE>y2x-#{YTuvSW3onv>eMA z7HA_?!P+Ro_Tj}^;K%#I3JH@v4J-YO_T`I>eNbMmsQk`Wo?`ig?@vX^gkR}g&xK8u zbLomMY$l39;#3V)E(X});{_mNFQ=raZ>vU*8>zwR(f681q8nOOjxvUA~GmXP%QyuN?XRXD8*~+hqz| ziwjQcx$^eLp5Gbw+&zEGs{3(H^)mN)TXK!Xddjk=;hdLOOy094YWjtRWlovTZ_bJ2 zaDMo&2YCHXNq~gbDqb%4)W~C-X6!%y{EDU3m$jC`>N}V1(<%Sm_zHNT+j94_{PX{Q zzpAO8-Lm21ybVQ#DI2n9-|#3}nBqDq)oaq7J5j5Yz$tDWtGM~e6+yC6n+wh!(hO#r z3v4Io_C(Gu*rNG3;Kr|tl{r(&W*ykb&-XUEVpB~1HjdWC_bqw77#NsKL3;!?pE`Ey zq`k?F`@o^k#0hs|!l#Ab@Hfs~G=KT#s)`pkH04TfvMw{qwP||h7m^bji^%iHF=&d&O^ zY0;rgR;}M#QVY4Kx$P3myE$V*GEabrSErkY-jo$56k^lTZ*AMWxeM&09bK_+R2Co0 zzn;b4`%&NGOWzsu`?uySzPfvRoTH-1U7c0yuatkjHe37L+6&9?>K&I&F2bgX5uU%%cw={H%as}3IwOT6%M?&0ut+$MIjrrpeV zoT|EW*~G28?>7tA`b2tuxS`43^-U!Fb?w_-GYw{}UNJj$R=zseN!J$vvvpu`$?ZQg zzMIMC+I?NDvHQq_7ni=|-U+DPvto-|eCQ7Q(%Xg)Up~CDxsg@Yti0q}h14gr zO?|$!cI)yJr|zE)N%O6%a%y|KMs%~&=`yt?nbzKxGIyF|OEjx5{Z}>l_s%!6VV_Oz z-($IL2lmhMd!6CQo)c38T$5T;?>^5jf0x6VXN$xBInSMPDO+lG$dtGXTizdKeW`ww z;kw+LWht(G&rYv7dEc`B+ose^-Q>h2w}JN>1Hlfr*ee`-vll+(R@z@>|Fic4(_F_d zvH}7huQRA8YKU`bzn*lZwKyt`bFR@9uPw7uLOOu!kOd%%J(iw+yJP1C8w+KH#Jk7T z?ej#wy?eZP*(^2TwI{0WUv7wg@`WMXx;7-?-7MYPv2wE?<>o0g-+kaP{nAu++2!Y? zFHB*1(QRb5be@H--3+_tuFcgM&!XHqzfW| zdsT}IC-*=)MKO$Z&E8#6)n}ugse(;l&=Uuq>I4SVn@s)vA86qJ{~IMa)&Lo7pbW^& Y@WyA$>@D^OtUz{oy85}Sb4q9e04!^}Gynhq literal 74438 zcmc$`Rajh0&^Ag8f+rB%0t5&i+$FfX1Q`hK?oL8*cXt`wbzmU4ySux~FxbG)-pT&% z&N<)3|2(I!iZxBI>S`%_YXvLFiK8OnBf-JJp-M`KD8a$K$%2D>_3Q1+=O=TFFZ|)) z-oZ(Vd{uExJ6cB9mW4hcoXI<$(och@57+_JO?J5gd!sJ?Dbosgw;a{MQQNczb*nL6 z{zIA9fF485aJtkaA141YqnGNf%a%N(q4GEBTG;{|LTrh%lU`dZqqk|J zyAC6K4JU4y&&1T}YMVTq4w8V04&EVa(laa1?RN*C$oUlJ}p5DwulUC8^I^Dim5P5S%4@o3Orp#6QU;P!uG=%Uzihs>yE=m&w* zRrMAnW#z*%=eEQY{Qq9KCkMb>i&`evr;cWg;<>nI=4z6jD&!1ww-Gv(y&F5JVGY7Y z)k9M#tVks0bK|ba+B*Szur+k6e2_`ZUuG6Q)d2@+Xtc0c*A`Iv{pH+oqy}BFNj_+c z;a1E2X*A`IU>bTuX0I&q*qW>6qken>z6ZM(L2_~kq0W2;j)kWErj662iK0f+8FL*_R z!exu7rCViNV4jTQdJ25WY$c*LX}Gp|6z9a9V}Yk+`^uWpy?5e78RZ-JFcTzZH1X3B zDSp+x%U^H^(Ls4r@uMt=FzFmzxz-}brfT*(4x@?tP`F; zqoANkZGs0ugSC+H6dkQ`K&@AeTa5E&#P3&@b-?&rr9WU{LF0h3{-Suk#1R8Fc(rW9f5M$lliqC5R?TkdLk$K1bE@i zR=J7*QgBdk>3WNx=T%2I?qPdZma^)Xq!3%bLONQmT*Ih9uFx-cTFJ42!qT{e9_62R zb8=GQ7yF+U_tq4{I`%|c$GeA1Sb9^N!;_aXLu@{fpk;ul#Ru@XgzoO=Y0RU$^QKqD zhK^R_Dwt_KXA0G}EAu%bD|9O@bt4L?5thxb18h3M-x|;mMi3oJcsx2O9 za4LlGgc@yP@;XD}ku~I9fx*_!Z$-3l`GjV2(q(6a!xnbo20V?9cy<%2{gUfB@;e>gYADm2W z#fHCen!`h6Qb;xhoK@BAkJh0A7CL>VX_CTz`JH4UA4@SLG8J%h-RQX?%4BYF&9YoZ z`SD~zb96*v2D2#Gp_2KD!8aIOHYtUOP*E_naSND2JW3T@( zmNCw9z2<6qCRiUHZZu+qmVJ0NF}7b;w5TPXSTKB$UtaF4tEQDe%K&yf^=3p(xORoM zi@|HA)2hZ1;njXDj_S%pL(W)gyKodbT4xrT6Bb9E8d0Web8;Vz{(wkMOG=|57}Om! z?)OdBMKOAXu27|m?scMroSii@Dm)+m*?4^#hd9_suZ{X}c9je#P|~ZBB2Zsh^cTPV z#NOjCpU-rxcVv2DNrd0+y$7QYn-j|G1scr~x@*MLve;;Psvd-O|FLj@@XbvQY<;uy!4RoD;ThI?^ zIwCG}sn9W(r%By^*Qn=J<#QIiCBI9-Q7}f|Gpa#yGQwbiV*76YRPRS1froD8>Q&@} zE30%8*7ybk%|y*PvT--&PT_G?L}Xc^6_;hbDVw7c^j%;IJ+Qte0Bhrr6>$ z7EPniNn?L`pmBszKL(v#RZ{=uX+qR6mLi&U=?*>cf}Si>8G_{9OAPq`8aA#-<|=7F zd1Kp3{QcF-pW+@IM&^H7aL_(s$HKFv-T+?O${YNz0B9j!{? zWg*^ylZkw;QDzl#vQ*Sq*nn0|>R1f!R12;`yAL5>Twpwy8_0LED{Z}*^ce5!oBR=L z>_A}!#DrzY-*La8PdB-pgQ9T1Eha1fcq=)-oyN@6`D^$4=aIHP9A*@{IT3}K>NK&K zffAewOmh-tatK@5n_5%QfF;9iQ6ps6=i~ z2@6};qGq5@g|6`E*hGGk-`^dgHAsj5tAJb~ydJ)Onu?!`o4vF=!B;!m9Tpse1GGg+ zfeM~L9s8#hzB(N+u46z%M8c0&>(yCQcr?~+)Q#4Hiu)9PX#kkRO%44Op|~=8n2_Pu zH`BAykr}+{>I%<#9h|ZlBB^@is3ps{*sNZmr-pqRMo?CCJJsp)pW*3h#CQJ=i;ay9 zkiZW4!g74Sv*)wi>~dP(0S!B-PkMVuhgR44ulJJ7Sf`WhmcmMzZM$RQD&333K3KhV| z2})+nq9T$XmXRDhaCLLi-0ImDzhUlnaMKv5ciFX(+!@5GFr4luU@spo{A&}9rK?!c zh@(c-rEh+wMcW`4GjM)#eW+JBI=M?iv~U`-f|!TgvW4t!#PC+BktkZ*Z34ni<93iC zM>0-t|C|{|;4WB}?)TvFJ*?LQdUDKSbY$Q#9@a=$7H835&4d5m+dBRH6ExsT`T<|v zOViBm`7AgJJo!rc^@2coTKfc}s0`HDYTMWsEN$L@2;$9Zq%Uu$8d};`Vo=V72+hmQiLIODH z(+*5?RCQyV>2^%@{B!i=9K5vMKp_i0oKb*p6ves8a_C7XW(AUlSY}oORDUK?jPwG{ z7tIUAaJK?(o)K>JK+Et?EErX@ILSFb$CWed)_gRH!~b@Vid61|Jk ztl86KshGXRRD`MqAM(EvDn+N?Y)7CRQxGq7#XqaE~zKDUY9LP5Psbtnc1Ghn>rht={l2q|tn8YQa71A|Nj4ifMeGpg1 z1J&JlgKylM$Lji;-i57nlrJMGO?^DlgMP>Nx7T>vD*7#jj{aFW zCi=b~OZs2?d-O#i_UC1b5DFm@UKkPNEB#PT(*WG5Hc`mhAb-PIq+`-zl?X?Wod>f{_Hm>0KC8wNo3345b#t*za~ zjCIUKjP1UkIX2JS?uU?|8YNT3n%P)|)y|OT3>`C3v*y-V0RZowg97=g zaDn!c@w1Y|aK1q*Mu-KLd|W*GAC^Q3Jep%%XvoXbogMtkVnH&qG++AW)1=xaTXFH1hvr9N+>X}& z#R9-z^u@VtUI2FlhY-$LxdG``0t`_|K}(8`i;YgKJAMRMSVFSETVw#r{n#GuD}TcE%$6zCS5ETHtD&g?U>xvuAw9i1F%k_#AFiX1aK8 zsqUrf;l-Z|P$gl(D<2aHt}rW;r6SA;Uq(m2VYF=7b;RhFS3Qj4PbX7UVU<6J7*23I z8v&t(SLc!VZ#-b^#nsy1-~Kn@0D0K69{Fq7zzN0|ZI)x6O$gThQKf6~{-iX22mAjy z%Q1iX?wgO<3I4H)e%JiI{lrT|1B!O> ze@ZD&IR0pG%#SjGWqvAAWQ(X;di)(t|F5jiP;8kIJSek=V7KU?U??H1dAcGxp9eQ~mPPG+-fMC8{m&e~DBroVU7;tTQVqpcw7 zm{Q9Nmb&P24*iLvRsht-nCJY0_>Ty9V>2%XjZY-V$A$~n#-Ga7y585(3fj=+mAnz`?$H%&A6c86RgTs2P^}Xqs?mjbC2eWJHwu9-u;?b4caq-S z`dJ{MGItPL4&^DzZ=o`K_Y9nMAv=YOclP>Q+x zt{@)I8BZH^v@*M!ex_v121*L)?>vn5FA|sfLgu66bhIma>n_sR^<14NCL_xI)_1^t1+KU5&{H{fw&+{HL_WK4 zqrF?_aCO_z9n?!-aUp=0n9qAQ!l0|OJ-{MQ+@~_D+;wy&7VCtCJkj>xB8JTQ)0p3m zn|XY}E^Fg!x+e+sG>?yZvnwxC*Vf%b%3p72#UC~4(ORLf^&daTYRS(u-dLitQ;P04 zD>0WgVY-I9nTG+bmiT3(l0QV-es9}X8tOf7adi6;o%-@H1WJO{e1pQF^hp&+kv4g0 zTVsY|*oXg$@M7QrFuvbqu`&!Lt>LMJ4SfL|;Y>l?v z5tebI6i%6Mc)UM=(`hD^{?Y8|W+zt(fp)Mmsil-!@xG#{-XD%BHJPFB)Bj%Ej`_RC z?Rqn9HrKat0id^LQfidk#CD_Hg94GTL52b1Q9g9%;Zb2ievJ7Z@<@X=P0NZY_2zQKO#TFvF z7ZoTC#7o}$!Mab-XJ@1&QfwC~R#^`jw2?r|YK1nsobJKCcSLHaTT@tljPDx*W zuWop>q->2<-9DWrXMTzC6TOx(Tv(npI}j+}@r zxUO;0;$00F2a^P-A@6!B5;JFWh~=$K1MCQLTGHfZIY34z=7V;Yjire!WuG@@C!u)3kkYc`ic zsvKH3&wPXLS9AgBl>Xuu#YQ3PGL<`8yN0NQ?7!x-gFuk+yWi)R+&EPY)(J z>Nn~nK8Dm1Z7Q@6(eL)A9hGoeId|uP7TSJF0Y2JM-rszr?x>z@R@Vh2uD` zjA~%ujf&Li z3OL|ms7)KHs3jgEax@zhOcn>xnxLGx7~2%o5?SF949EvE&TGui&05cFZ0l#^F090&=i(6U8% zXL@`Wp89YhP()SFuExE<*bDbqPxE?OCCtzL!lZkZu7G{t8}M!|>)A65_c%m7P;?Pj zdQ{(rQ#OFCfQznv7^k@hUmd0+n6W~tY#u{@4@wOV@i^wY9J2ChWj4Mh$(i^?A$hN# z>jK>R5E{Jh8*MWCxz4L>NYa!?-ve z>0gM*H;tE;@Z+QUPf1!%_b~jn;6~qwcjc{a!6XTm@Oji!2+{4+6X`y3^Yg?uxZ&1o zy2yW=$HDRrIieGnw`oNUdgN|PSTkF2KQ%>T!j!~% zjdwVyuG?h-;i{a$tPx4v>1A%8tB7_t?a{=A3y5@vzxqX@R~KO-3!lZXVvHP zBn73|HOZWd^y+^W&%N~L4X9;yIxL`X1K>zxdQV`O8BKt))|NFyRaBMi+Joozy$?s< zX7Z0JCurN5PhTNsYkBhui*h6dguItlD!PFdj$r}6@V|kB%kr3(A_#y?uAT~rfoGL{ zpvHT+!Bz~ zdwxg5vbH$alk~p9(xL%_PU}RlzR3J}_Gy^&-eTgcOXVU@CShyw+mRq8f%BW$i8!R3 zml4D~Ts=-Iy@Rx|FU6AGy0--0awD>+!3KLg9Lfv*tZcs8ddtskRH3nl z6=C)?HWxoey*ACum#hF!())-P>KAqNBMT|ToJo$Ahcb860zj8%w;iRIz3ex(MX`{M zJ*V^e0Utgw7aDQ-L@dY`)%Tf1~uoWf3zDx#?Mnfs41!DUG@{7mKMQtS<8K;~C z*-N^LrPy1*UWeil{&}YsmUC-#{;E*cnbaq|TPp*G+L_|hWt`qkzYV7~Vf1vp+1PjY z>vqs?K$$(5NG*gIn_ZuDtfWmG2s9A!JP8*S%O769j`<1BESJWJIE!2&#=|qE<%2Aj z*Gy4RRw;a>Ev-$025%Fej%;4e_~T1Du8LB_m2Vwx%`;lu;BP zgXyw^fr|>p2#b%tTNl@GPitK?$g6CNWS(Vj`a^N7B(UDazq{Bsfei&7Lbnwo(^n~u zmg2{*(xmdRohoCljE(JI_!*E5bH|N8c4U9{NNOM8# z!&iUxp2LcNe5s^G;Gqq^=6S>19vjhxepH+h1)JPQb0%`vi+IWw6f+}RYMVmw?XO;{7kigJ2%_OwP-4wjxyd$1JA2&>^FA7yC~4d$j2M>w{wKk zIrmGGGDhu{$%;&@|HT4O-)3wYi-MI;q+czgQwLN9StqDUzE$2Vy5LpqpD4~5=#h24 zAe`nj^=F$}wlLkQXzTwZlpGhb{5|d&bRg)Gqfbbz*hYx%nHpjzbGtJu7oniFHT8_CKv%t*J5!uS4*%BC1<=a6Y7=t$_X$^Sm|;?M)Nx*m~4 z;LIwbAP=;0--)Mp>m( z{-F(-kT$v9q`k{U-gA_tI6!qQ}4MG$KniB9b|77R0hzkBOfXc%>BE`G0REVTh4A0u;Vs+jF={W9rP z!yb#4pI>fuNS|**kL@q?pKw@stNuRkGvoSaak*(edUjS9gvKo&Y4(Q$nxV%*D|sa) zH!->z8lqEED5yHQ8M9MwcM)FGr#(FiI@HvcJR6Oej5T2On|M*NPZ_OTW(6Cl@hSy9 z0p-Db$_kRW0rfBJss>AOk2#9ZU4!()Tt1{r^i%C9^Xq_DX1^3c6t`x&0re?>HVtCj zi#L!@*MnF+6$DWyvzUCGYepSR6R>;d<+|!(hNIrESfW_poSMrs$3yKi35p6u#^%Vs zeyilrU%q1t5jVV|_BPO*9dLb@_|-}7)H-YC&KY;MSw`K zHs5k5u^EpYmSb1AScmI~-7SdaJ(@dtU6MGu!Tgbu1JG*Pj5nnrE2RMgeIzVu8JO1% z#P~y#`gT^W$<{*E%xN=E)sF!)Kl?jZXHKW%CW9!$c+)QVG9M%E$96=d{7kj3g5x<1 zv2KC%oudyqHq-3~j^gDz)3s@k+q#LJ37Y4fY9XI_bk%C?wiRrlo=o|pT+FJsskTI2 zQ#UbP_vY)=`ueK&=j~@3%Y2RxXtNx_=J;&WJ|+}Jw2ZGzzMLW9mIf$o42AFz-xfsl zH!CLAaD>s_TmR5i=}sEUjIc_fTWI+BvAC(CN`=OdGr%%90qjGIsX8mS%@u{L8lP@)+ZIdlQQ^d%$Eg|pb zYF&RMPSQH#l$)7>63Ct*^_H=xB6xdI{FClT2>N;gVTgcNO>THh$ZMs={Pz|@N5yDf z?>)rE4nEr-)<=qu%B%h$COmUw-8-oF<7%L>-UZNCl=$2Qlg5otz(HZl+R|+P|ca#TB%NksEr! z>qd|2FiH`-$qdCx3(qtq7-i2x#^-T-*Qw}TW2Jf(`fOMDnpb^iL1*wh6c8WH*SU># z42GZgukja1i;dEs|9)bMP<|5RZa`2_KQ`@M!9tpnf}i4^3-Nd&^NG8}X=>*=We#U8 zvbZ_EmmPyY=hg&2CSv-~@u`b{aQMj@?|dBSP>q~IiMe$080T~xXfE5qcB?HOd#9wB zUFwg1Xf$Op_f1pAfrKU+liUlWBJP(j=dN!&&d`fre>8?S8a6ehyz5{e`wB=2v|ep6 zckP1Ju!^w=pxq?l*H`e^W^$H)HNpf^ax`o3PmYvAqr0@*!dujozaJ3ZvwKzBeHJh z*sYRP0110);EXOAa*KKM_J+!S8fpOqQ>%>Rgl(m5V0=9~_~}aa{#?|^jmv04v9$cO za7D>K%ld=y^LX*pkLfmC_FnR9#`AOnJ z6}wkFPW{vNRbl}lcQ>@^i;Z^I-sprL6Jluh*!L?M#d^i-F!5f$sQCD(K^z694B}+{ z>8ZTa2>Q(HgXvJKEOGbOFA2}43ctLb?ecYxO2qLq8!@J_4${YJgzn1oG_IHAZ7Ixc zbT?Nhw`I!o1bP!N_5Ofe`SV(Jejt6r^gfvQx-?cQpK(gpf*j~i`sfzADP6caqT=W` zTvz9Eaizsvvu&mJd<|u#DvXE6WToZuUGK<7R*7~=U9FPW(FdO zL82Uo@jEt0R-`mfpAN2mU~lr{7SLC-e$GLRJWN?!KX6&xjjvBK$vr1fu$hS7arc;S zTo~F7;tv|&q||@ob>;j~Q4a&rAnMZa;Onp0@PfMnckhO)G)ro+b3 z#V0?{JKM-jvaw(}D&rMe+JHC(G-bcVcor+DXyfwI)=~ekBg^k|$%ZJb zMx9gF03*<-esSqv6kw6-^3;{U#3VyB*?+7!Ac*A7&R0Ye|9TGWOPMBdy0gh;YP@UH z6ZM=lMIIjx1BZHHmvT){wMY7xCZGQ7*@M5AeNt^rnAj*~!9yo*qUeyrx~NTp1+w?V zi)h&OG9puiOpxU$>1HA3Qc&1=uhbZHTd${HlY|Mle|cOCTFYDmNYG>^>n%X0OO_mVgVJ;#)_+2eJ+%BOk!LVT}g6o3R~*T#7JT;}|5 zgIM3iD@RwEm*zqr$^w;H;TZ{r-H?M2^BrXXoh=)Oq_d zpQo$x=`9DcnVO^Jz;t!YDhtD^il>M1H{K!Y4*2QbQ0`J9acd77=Fr;#soJ+2Gl*gFzN zZ51iJf=rG6))2}_NhIAQ+`w8pcH{H)sNbDsIF;$frIFv5x?jTnfun+?%W6qknV^A3 zF$Ib2gkYCaSz?BG_N8!sFaLpD!{NJPE1rp8n}H0r_p|pYF4DJHi>=M?+{)z^SPARa z%N3TlQjJCmYMa%oWOigEftd|3E*b&+|r*7wXwtN~07jdwpK9NN7wg2GeUG8oC=ZOZ1}artpS;b?HBBF`XbVk6`erPa{$+T1Zeam>()$%yy7;jRo4 z$=Z`1ipyglCer?xzldP1b+F`+m`ZpYs5`qlB@rP1 zKJlgdv~|Q^C{v+tagu(??!gkg zHro`IS)w_+Gr`3NsYCi?0v%@PSF^+tb7;R=?Rec|O~VL}g)m z1eYA#o{y1hM8xf7n8|3;*RZCocG^=}A6Famwu0#1gIAe0WKU7gFc4TmMw9dOh1`w_ zSH|dWuhfX#G!oMu4OWk-Qs0vGSGb&X! zd6W}$iT>aTeJn+7OT8gk#ylG11s2xke5NI(`~1Mcv_8V=ZaMsUi0#>7J&UVN@RENd zML+G~zD$!E8NVGmU~j8n^)j2gre6=0pj!G&zledQ<#-I5$j5$#K!1)ZP9;17jn!cH#awT?zHN2V6jJg~dqvWE}Aka-Y%Qv!Ndxit%0VJT$(0J`eib9MPXq7+HgrX|LLr<=A_Hj~V@prY(vn zol!Q5;u8PG0t|+oF3;6hrW9L!Eb;NpCS2U{z)?{w9c*-AO9TN&;sS}^`^R{Tr|*_lM@-%dR9s7>}|M_olniA5v`b@Wr%00ssEGl5@lh0JyL&{Is` z#E#Kq^&W22e^Zo<>Hl8|-{t2l<%n*JnxclV4$?D|odIZhIRtbC*e?`}-rD{ieD$}U zz*ikRpzzP6;r=(33P8Dx(fEy24|JHPIGL6EEw|Q_@Dm;?DynYx<2O}$OR1yW_9Ql| zH2)^V7Yfus1{0s?mcyM@AEnXzwi&3wXp;dQk%WAS+&zsk`mn_&nFZfPWO4KRhV!@Q zu!hVx;f__nrJlvx)K(hXyRlx$MBaQHV-qDqtl;Qo8#e~D+G&-HY%PwOa!%t-$?FII z72{EuHNOWBiL&u}K_9EmZ(jN32?mRQu~IEZ863aQ2W@;lU?*OmLft0^<7zEk)O(*1 zZm{cn4cfsUvcW0=akX@>IR*Wfz%Hkuo6W6q^UyE(Yij39Nl$cc9y8*bCeV}VTtMcQ z6Qu46{zA#4*s8SAQSSSWDNF`92>`QfQ;6&9pSb$pCyh(ucto>b+GPOK8RHgm!jf)c z_q!pQ1!|MK9v)g>in>yyixhd390n=6eoq-K)cThb9;4aQNHs=R(R0`JIJ@_$Wav!3 zAT5yyj<{v6F+Mw53(rW~@e|R=nFuitVfL1gkfp{xOxARhBjo6BFU;+f**_St_y@7? z>c(f|E3Ber!t#p%WGOc(&6t_BD8yvea%m|tw^7gqNp)Gqp5bqz!xOMRmiy5=@osmA zF|?YXXpmf*sw{oC_)a(dYu$q#eVdWvW_DrRFOJ5UT=?*heB!Hoj^Q3ahrt^&Jw0)$ zMwW&EZv1G5v%=r#^Lfp@!|Vez_AK3gd@^FFx|+Z#Y$D`P zUf^yGXP0VQXY9k`Ez@|>%X>2|Kdy@wgZJZ-l(b$)5_(G!SKJ<%WyEQqmRMa%LQdGsFeAL&aU084WWXp4m!EBs~DW8yoAZ1NYR0`9EwxlmA)4pZSbfSZ^+*nj@ zBk?@gvIbonHJ)8({-9@Cism0+h-=Y5k}1*wW6d@&YSUP|Q)A5TA2K8Q9?WHc6uUYTALP9Os>7vR<#_c0674q4ucz zxt*!_4=@MaGF7GT%c!C-QL0(7hGI>%we12L93L8mT@Tle1*k|c;+jhG2(`XT35o9j(ya7Nq=>n@?s+? zT(X+f-Jg250`r;x6a0$m{3^rPgl3i0igshV%jbQH=49hpNxyheCcX{bt!sXb_i%n~ z<1gJw>1{FX!~NEk6XTGA`c-Lq=YZ#8kNv@1vc%g-zF}4mTNVOqBg)t1R#l)0K3#Rf zhVy4Q-@17D-ImzG!k!S-L6rBG?_2%Hd6*PDB5tu;MtH%xl!m(R556^jv*;%|$=tOD zwq&2k@c~w}bHXyK*g;b~jZ8G8C35qi`=6n@QDsHY2RCFw$9`P8`*OYQbjf8a7>hp%5PQ%4=Q?i$x_ow}7w-CT3@N~4c@IX)^ytKaeB zU);rbbdrzt=*ra+0hzw(0n_lJ$J-6MG3vyd*$ngd>6;+xl{!iu@7u4ff`d$3w7T8N zVgNk^qdp^0rvQ>mYfQDkL0`Z2y<0h}Q7}ks#Xqku~Chy`uiQE=_|>g0T+qp5LPSfQW?#UjFLCp zAuOE@HiT*j<%k1^M~XAeGO1MRCxHgqY=u!To!WarcRMAK z6+cq;(Pg<~(v{UN4*~8y6t{BFyqPE&4?;m{^_Q{{S8fRKhul!=lVG28HH*|+j~E77 z9h!tm_z7B;nE<1`+Y#q+)rzuWAlkw;mr?v~#8%MZw`SNi(!m`rM}Xx}Eqx1ndEWSb z&Jy?)#qM4%U#cJj?Wfqwlr3e^Jva&9%fXwj{eV8jh;CWb* z@`_9zaV9Jnf47^3zU-{QH-HbMgm6PF54Tt5WIEHlt@U;mJg zO58Z_AE-U(Rh`Pf?)8X{gue6Q1CU!FM5qD4Va3h4;7=8!0`F=(#fyS_8?nd3i5G^h zOJ*G_ck70=vE}oQS8+2f*xN^&L|0=+YL)lV6ld}lE+&wKccHw6uL6t>2M&SvA0Hnd zjxGJlZI1I?Xm>SHqt&%X5>rua-tU(%O3s6?O~Hc?i1fLLPLU~Pyui}x+Pvxv?fam>t$Xpo*5bj0S|j zRt6UOO>K#r`atT6{i-~rd6pGXQJvUUC#Sm^Y-%rfOwoqjFl~LWDwN)FF{t-tS;dV*gZ%i_q46gSJH5sUn zYcZFXOB|AhV{9T#`?0TX&!ahY?#@cXFm{)=agNDaILVWGGdI02b}~sg!67EM^0hV$ z0dzl7@1`yD!}#Q+`QrQyEq$e&#&qPQw~gaUCsvWdV6LumUH81YV<2t71FHcyz2*WV zqX1ONOj1mL;{_O+FnT#<^?X9OBI|>!nbuQ(A(kc5lmz9LnkIjSx^6sPS=??v!=9HU zx9sqPvbBPg^<*A?eAt{nK}R}D9zOc+wC$167fc3*j4u^A^j6Xz1Kjc-62v$}eLH3Y7weLvP_j?hLC8lS>Ks2Uc|6L(kRJeG_xBESb4~Cl!Owl-_3>=HBX;bh$$J>WLEW*=XocON+Z z@ZxkXJ&02|&~MaF2~MiOU?K5{ZmQq=rto{A&Mb1@La-LqZRer`Mtw^WKkaWu6`5$h zV3%6n6M9ke26lwNkEFE1AQvW(EWhb~Cxd=PWCEmMc+Y-f*mNURl%+;V(=R96A~Q66 zl?i=D9AZ&l3zmdcPh62q^ykG}#I$NPI0a)?P@{~G>*VZzYesXqNV|>}hM@B>OQi@) z@YN+BtIZyMADzX{?={?`TdEubUwo6%?Dm6}D<7-03dfDJv$J7jEXFE*Q>3b(-bFrP zbyVbuCvpN6l=rYv_f9^EyE@Ba2K5zBwl1fCc6l6?$_!*ewlc7|sSU@cp1v31}2+r!!e4x}0+ z+<5*0`TVBceO}#4)GK~O&o2XGk5ev+`|o5^^Cc4n!c1AGkhV4Hi16JW_H#h& z(t*QuNE#>RKN;Q6;>1w#*LOFF5;Nu~z4qszY4nzhyFQ%#pGoI0cL+bS8a$oluNV`$ zME;=GBBvBr-c^1D*^|GuvtZIQoMcU~Z1C6eVvRFW1x|_-rK$nh`AxLYGEX+Q&CYrC z(2U;T(+*0^x@fEcs`=KvNSKCQvv#M;c@1bc-XFN!`RW*;@3plMbb;BxY}OZ zo289PjpW)u~TtiDGVOY^m1I+Kkup7D6(jK_UU|u!wdOZ z;w=M-9a6t(+70!*Vmql3u;1=`+s^&Gr~Z5|z&g(h&ntt&XWemgqOgvtZs%!n^ydsG z)zeCfnY5oJLEDB+*r1DU<3v5Tv4MVB?~$Mhd9r@}ct?9Hee1^#>D@ntT(RZKSL$X* zHVC8IeBvKSBiA2o{S4r@9I(N zc@!e?Jb^d1nYQ8++y}GWfBf0v8$I>-;Uh<$e?fij1DDrpef%!{`dR&@MVl!)0p+l} zjrha7K{LBucvn~@N4rg+FYaZFm$7_K`QS94TbafSYmbf1ha9X1W5>*c?O%KFyr?v3 z=eI*2FFJAww3={DERnUq;jAkelRtO)qM^L)K@5zQ$bH2Q4hL2RDXm+;$>QqdioV5v z8KBvIK7O_P>Fe8=wVp+cP4XG}2nfF~_b>h{T*#sUZ8Ok7@%<>#F>O}v4u_+i|Eo*L z^5C`cH5mBCl(WF&BhW~0ISEiXS#1;OT!gKEi(hB=1IoC@KCkP)%`tM9DCgzb#_xAn z|NiZ(uEzMc-VrWqCmAJi%6}yZ2WMK=3D6ZmYdqoIkVt%6|@js9FmPDTuuKzX_oj^X$2Mp%IOgsLO z|3tmkJ)`GKesBD*)$&g_g*Ui4|B3Ja>EjW~RHIaEklC%gO|q&RCbuMRZXHbCRd)-N zzx=}O!H-V+<(*a+&-1H#baxKnrsZ~fs@!wih~GPB4seI?1nC3PyUb?l=nVhF&U<&Nv!4F z43x)_a~te8Qd$H3BBT+mn(-)U)vOt_h?`tI_3weHF?dy~iK*+(~dJxI+jogS!TIcTWNd4#8z`cXxO9!3TGD*R#o!Jg?SQ=Tv?3gW|`) zp6R{2SNDCdb*=iN)w6Z^qe$JIyPS3zxjWvu@DoS5+|%nJwdkRfScW;nBW%hN=RKCc z_v{m^>$j)4@Va??9IVHE9Rk;e_h>pByQ{Y|3pM^_r)N-8a=*9$=bhtn9{*TKzJ1nJ=nuw5QL}iEk!ZaLJ=nTE@8|@w(jpa~52uu- zckEk0bZEt2H}|C;s|y_FuJyQKeVedIQe%GzZzh^zq+nXa*CC@6TYKjbh@)zYCYWcTt$iO=7EnE`tR1-%M6(%PiH+cOl* z{x9{MHD*Z$SyE;C^{`k)&?{tKUc>nGw^@9M2q2cgOnRDiEvLNP?lVj0K|o z5#EfnKY@93Xo0~}`sg(tXOq;kE(8xyS9AZo^V_=v-iN5L+&tb5M)eIzJ3u0sf!Sck zVHqr$FgAmqv)|{OkcaIYWL%(cv}U-F$|?2##OzmkQQ)%BH;_*k!s^m_YcHx)NA$Xd zseJMHW$ecuUdhf7HT>1Jlb+)U|KP@!NyTHhtFzUuZgJ#BC&#OjR*um#j*)c?Fd(>C zuN^DQ^Y|AySzZmci>GFuO752L&z2;}DB)HRZ#EPio8l9X>Fv5rI_j#+aHnj=;NV;^ zj>%Wf@Xqa4a=5^0KIg6|!d?)gOL~R0fc8yGKfGXEEBo>8(iiKf# zZw04)cOW)}>ggVs2oQX?>N7#ncNB{8#B*#l_Tf79uwIlKLpFGfg5L_Z%~Or~7p`LS zHuOf(1bglq@3VqSV(1Gr1YbUv|3%JAYUMz@;PLYy^V2iYqgd~$;Vu2rBo?XtBEDMW zK5Lb7BIhUFVnb_+CdDcUBv?PtXoW~mE3r%hf@!pFOoR4zvw_l+^b>58?d>{>>%(@I zrcDcs{h3gYj$v&J7%8d2AyD6Z_%HLa*#Y%DM$Q5p$K8|BHA$p(hvMBArVc)qPn@5e zZZ?jVx|tpk7vhI5^xoSmndn61Y;}spOS+}IoFhbPK|K%SA;`jMWL3K_?!VfF8r~(q z1EvgvYYH&4SNOc_JbL?ku5Orb`235%mPE$x*7d{xtUiDS6=B(VO>UOXywXz9V{T=LUZP@!)jzA-MB6+r{)Df_cN-f+lim(qeEM#AEJayjfnj zS%*{rn;l;Y0jHHJhwD`R2r;10bPZy77o>q+!EU>l?f!s>eECpsIQSlckb?8JQHhw! zZ2{3TxcEH}dF1BvT?njOCou@x$79K7R9H=;wvW{Or zy};8jqA*wc&L=q)c)>V(K>+XY#c$A!!TB0?zB1ihP9j}t<&Lb=rV?*q-H^+Xz1K^1#xqdS(n`2S>#fc@#nm=Sx3i zpE{{-NOZktOXY=P5?`-zptn1eW55Y|eQeJ%nJYPc*b$9E?0t(}{~oG)b^J*UG^)>G z!g$ues|yVdkIewYdajEc%>#Dw!JiRil?!iG?Dt#RtIJz=9GPB05ijC72Is09&HYs- z%>>QYD#AFiC-7J56V70<_P2Qo6@?&~RSU-3Xwzi6hz1)`eP`8e8-q!Uy*ZZQhAAyI z#l^bq8!JKk*Xe~;kmH1_O1LW8MU$!p+%j4>IF4bvj}q#&J^YMK3VXrCA94qdq+M5L z6TQbWtD4m%d&zrYo^>FC)1_}$8qiz$6<`AELBXzd%&K9 zDMr|Me3Gc1z}kgq;%SM-!QZu8F&UU}7d>@Xvjf)Z%}A%zmD|kqj;EwZp=zvS5hT_d zZL&SFBws(w?&Wq`G+AIx=*Pa%={6C6kWasNCs{FpL}a}5>QoIc=MJ)s^QXgACn%># z6C1&Foi6cSKn)7jd@$cRW+v;)5Tkk;NkrX8`F2Y=XsHB0z1SzX@{2q=>TrG+)C4u_ zUNbXBQ}9=)d~-37cKG3Y1X{r7A3e|BM6_jDMxLeyYT;nPOF}U zpFmEY56HCj+R}5Dnj~!O&E6*+`dyPykU_3&Y&dyIk3SU__RSPU71>2+33lz(j*SV| zE-6~)L^VL|T-OUu+hfY#V2zZV9K{;s@WJP!(_MfE_eKw9@v5BFR=-KqY^7h#&u5Nz zITBOO2DMG8;gMAH+qbB7Vi$*;Ww$9UHPVuS>lv92YkFohs7*8!WTn3lf{) zfD8|%1OGq}Dlr|x7N+z3i{2;7G;(4FfiHQ_G935l{NnNqYeU1NjF z=a2=(iB3@Hw@K8CVD76bjg{xPL0G#{`G+A_>yR9+h_EMxa=fp>`f2>_cxV@KWedyU zd|DQF=It*xs`i5K4SS~Oa+swm>zU&BwxB;-p%}!{D!kMgE|f}$%8w~K3vjk9%yl;}hE%KEPx#}LIKV0O`%PbO zaps9_c_m~HYTRbhd!;}s37_VQP=;vo%WBzuG9 zkaBKj!+2zs+ia6ll*J6@BOR~{(1>?Sw^Dgufj>9zc~(i%hAJ3Ip%VH!u8*!yTJie> zxoPLmc%2bcV@*Ws_*+umhcWx5*VhLa8F%h9D(QV=QAtAuW2*y9%nTEb3?#gI=<_xk zF_4@c=vvjjkt#F}d&|URI&Qlq)KLAe7J%2}AU-866Mw|}!L_!_%61#Oq9JcCG$9u2 zRt1u+Gj;=Lww$(`m2qf-oVMbodhH@Z{SjH>X>;0O+kwE^a;T@Uc_DdkZ-egb{P8qo zz^Hw$B`w&j4q=~)CI zG4414qg_^m!P{;~{+#3r4g3mo;Rn_ts%|c2mmS2Vib0~fg8Db?TZNshId!)?8_}NT zp~IBhq;j%#LVX5umVAZ7PNTik9_UQVCSt9PlHzseiFA=5_pdkoZwVM{by9(P_B}m= zoT-E~&6uueaIG@Vs0hZ^Ce5%SwY&`%#2(s&VS`^lUlstad*-wM>BW5&^$?rm(zzA* z9PC*qZ(PFcym!IBvwFA?{di^+i;Rpc*1^Ie zWcGfj)oC_UtE<9|`zSAotg^QS^Kd;Z$dcALHhtyv$WgLa3%jYt-~bF7$~5OtlVo}6*{Ke`BL%6)wLH5mKQDIt+wG5!HBvs*;pZ2T zp!TVuW%FgB#H!Ph&1I#rgx5lmu|RTpSEwO|I*4Rkh zI5{6OX?SKO$6wMf)xL6U6!NiY?XXU1g&esS5Ri8hxL_XWvbZ z_e7dC{utHaoIxtUo(Z?qCvp}gn@?b=tqVn^fy3a9wlxj8k7F;`QkK2vi>eB)c!zF( zCE#&ub48p_Rkk6b>|kdEUEDL7%KEG%oENf{f9UCItLk>v z_HXzKEQ;OlLbhQ^Vj}5s!P40V?}= z(I^eq^@-T3#gwi_497S{)9k$5tX5K0e=F>Qz4cet5opkwyJ3i>KAGD1Ns!(QC~h$# z+KO1PX`hcX(*2j(0)kKBP}%T;Ck1a=sgUVw$6^wC4x4*Vb~I*HTpZm@MQ6h*`96bD z&)FByN&^8ryvmU*HBM{tg$EbhJcp+6NIYZiYkDAA#_5~g8gZJ5iN7`lwIYPtBweWp zV++3=M(W4j<_7(umD%RgD5q(sXQI|N0#jH$zS2qW{EMGL2j}AQLxM?=>&A&dsM9x` zQs;U;oq~J%Lmwx}>)bX4Qrr(snjCEP%C(L@pk$CJ)89a+O$6|Qsa7P8Hi{*>$=gIs z>^ox+&^1^;WmKN3TSV5L-7c>C;p|wnd%H)*JMTxm%F=Rn5pb)JYyOPEZ@-P48d}0r zG21v-xygvpFt zm3JZy+Vy{JQDL}Hf#fSc6h@K}1qbY^`+#?3qb0^Gu8VPwk)x|5N49eds_k~mDqnZ~wsoa1$+N>N#b$P4i_>k~e11cB9)OJwsue^9pf{ zXi^n}pRp9z!edeI*!oO$r4TpiGyVy>-RzA>k88?i^oSJ|8TSvWObmcEN%&r!?1V?E z7!FuWTpjnuP0G#g-Oi2gb7Pu3hp&^v5dwW z0e5r$!i4>vJ7WRUZaZ6=)X8ZY1w*8zW89xZ_LR5OYa;%TriOvqV00XMks__8qAKBcXrl&S;673H%TP7WSyp=p>TRAX zr^bk_%#GjhCK%5FWmj#(BM|@RiSNU`2;dpD>xyP5=IVJ^oJ>-_ZcYtpmPGWK*}jmu z0ygtB-~2Icgw^OT@Ft4w(lkweg(|*WioLChrwI~K%4rIdQEpovsBnMlHoRP27eh)w z-A_YcXu&o-bGZ6VxPf@=m6ST>zHY;o~IE$pF2IK zw#eV`LMD{V@95J7Ow)x~Z2FuVp}R_g>w|XkvnPT*>ll=lK82-spG5Misy7zI<_7CI`#n=bnNYG|A&|m7 zN{^{Qho(?p1MmXZOePmT4P!!QNlMh{*()`p3ABI#pO|fX2XO-P(z$YLBAfGl(e6q( zhyB(%xvH3#f^8&5&c0q@iX%G_carCqWW2x6r>KwVm{c0c6}zt6hJ4)uPY=Ii4J%!3 z2L1s*CHHkxjXL;b6!WU`@LBgNDTSgFoUD=T_XhDeXmDtdH-~q_p%8k7m|puh9x=})p1{yyfNYWILVDAO&|ff1t_$1Mw5<<1t}H>BPSc?s zu9XLa5nz`=0*mj6$cJKW2YSGMifq%$w-*eSl;&M=i-&E7d-<18l^g`v8Sl&gO7gi+ zZU2L3z4Ng-B~u7S^V7ff#G_+jcQ*fgvBQh#5880%@m+ZX?_uchaby3H=7%+X0NO70 zw$QaZX8C->M?x4)m@#V+yr409QM}lHeUz>Qs&nmZIi$b##i34{#(!|L{(mA$CF2$7 zFN9-g&aGek!;*ku`uz3TC%-mE+-|sof8ko6I)VV0SM5_EM_9~m{1u?(J-%FCt}p)n z1^Drw+1>Skg=KT?x#4+pXJ)R!eWsol(m4jJ3!o?dTm$A4k_&L!131|@RqYG)XG)O1 z(b6VGi@+KM+V|WC4%%bAG}eM=e_b6-Zoq$8u^B!&_ePJ-gveVZ-93r9S?&k2y)8k)TYnJYJPWHXS3d8FQ6jifI$N-%g@BA!tay zXFJ^+G`3<@jYD&@8agWJ&^ydTzk+ETnl&OVM-mnK^6$-}EDW$j=^Gol9)6f(@w?bx z@HAAk;?wpk^J3m&sx2(3QM@ZScF|GCt~ihB_frcGBPmY6sQC)msSm{$dSZ!RV~*>y zoTW;~vnJ7m3b=Ea9~L~&%l{iT>EMGzZutz33O#4oXu!@{wPGTKRH9U2C~)@DIoSJG zkzqQ*J@N6gNuKeVu8_N5veGufK86Pj?r~)aAAx4IYD8-A$j1gHB135x_I;tqAZQB%QFipa0mtzY2NGj(|-PzO0 zxwoNnt8G6ZK?M1VO7(_2J#Q{zL&e$bodInDd6VyitKyArWn#Yd(KNQ1L_sMPNn0Fe z3$s&(%xxw4a>Gb;9!T&LZAMoH%E978eTqT?*d0Vl^!N5q)>gmj8c_4ZwDILX9k zyEYY5Jt!+#97<)S!R( zxiVi@PC^@Wumn;6szWhA+1?=mmMq6p=aQ?;SXF>xCDwf|yYEgg{9Lg7Q9Hw{G}l<3 zMnGI#4m#XF4hj4_V%xxo`NSRTrBoLV5Hd4Y0I<(+GTHu?5~lXp95WR;xwVQ`7Zn1z zg7qb$ZI_>M_8mIxBW}g=>T)hLgyp|7yN9LaXeZXk#*8b}1=-C5tiPd1b$WYVtDtE^ ztDnD0f<&>=(_rCf7CZ+jKqO5{8)uLF|l%tW|h zw5+13B&D<7Q!>V|=o2LXVWYvO*jsNtW^X^fYNZ?#Iv?zg15>`?XB9174=jjgFhD$t zEN^Zf#>U3FPaw;K2#43&mfsf;pU|&6-}EPru}O8cWt2UgJ#X*25>%2CpUZM#r?B{` z)9^8w$Dk|9v1-CJ_IQ>oxNIV$)MVTG%(T*jn+W>BEiDAkF~+`ke^^jB`$cV(<%=tu zKa^CM?AMRsE!@!lWI`+8{@?`ZZej1HmQSwtQ<(>lU0Cn-T_SM0>OQ~T@nGKcI)CUh z@8t#ALlC@HZ`ntZx%3Wm9oYI@kHLC|3FD9d#E!2@Lx3^7xo~g>t1G;JxnwklCo0#w z>&R^&=>c{*zOTbaZ1W+;y}rsq$*OAKO_ROGZV;+P18Ly2ApA2lUzJ8r5M@+WStDJ_ zMdg7`1><=bUXoz?9t}A!>%GnbW0W~%3G-19U@q3VJrsOEA;ltU{S&wjDP0ObP~uTg zQ!?*exF`)!z8Mz%Ym6WEZbyj<)maz*xem-%hr|Pxl7B7=DA6$gPn{TcqU!$EQG9a! zFTg#j{{H~(Wuk8p{@cFc^f_g1iS0s9%QMjW0Ok#cT2g)MJ+i!<48DnFKbXESPY3ru z-s}CBMfd8sH*J|S(Q@lTmZ)h%eLENLJNw_35iYF&GMOmV1Jj%ot~?Q9R9+s36m5p98@TX4anSA=P$#tcwymA!ONakilI6{o^6hBK zvQ|}RCX2)HTXbB_r44h=sm=*gKHVY2`wzTBTXlIN`rA*{z{WRX#K<1owJ#n@OGXY% zbva4MX{%&QRE67Qv-{OBLhOr2SaFyqEEUvWYJL9a11@d>-)R_@+P3N)uFZ~(WUOxl z$&0HWooKeVtxA_AMZ$C^TGqGs-HQlMh&H{o>+Ei-cDk%Y)~@)oF45F2hRiZ=RX9ehcp1s@RL+9QpEg*;vNeLp_3!VYx$5vshZ1g4m8I zDkT)wQsp%Mp8DmVS(F9zZTPf7-Wl{!8UClVGzsBy+ldf?N3r*ZY~)HT1;YAz!?~X{ zWP=zAz1Ui|>3Bm!BMZ*!)LE^YfKOU7M)hpScgnmmiu%v0C-nr_=yC8p`Uq0+&gY~O z=+LjCcBBVf8h3^t&dBNdZ%&5e`3f@eBQ?28wLA9vNWUFL7a3+0EOMtqa5>`)e~WG=&#p_{GgHdkw|#O6(%poA>E)YyY&)dJu7>O< zFP5IVyz?UV_7$5&iK=RMyx0Y<3$p)z;Gy z-(#xNgybL}hzp$GLZENIkZ_=)b8)T~w>t+fyryK(X6s#82zPbv<9eXMO68mX=D{yI zxIerlei4e*!lQn)l-+Q(j7|b(dwCh6lMtkV(r3sy6mO~!`4*YYeg3C>l-g8Q;{^7f zxu+4<2Yq(yg_1|@Hfa`cSbs=ZSK1RJawVk@ImiwXa&1h3^IhAFLJLO+OEM_A{DW}Un z*`7#|O$^Tu1x~LDgZ=)22dz!MQoXCD@OWr%8?|H0meL$v(-HUw&c?^shih-G@8B%& zjB6#6S3X3wJ$Z3oxC2M93OSlhyli0IuomRL;Msx)M*E+a)3?_zNS^9^(Leq|{JPI3 zqRjau=yf{bw=oCf_PDoox%^t~iSORFu1Cljo%pzJt$T$C*6%PvnIjkwFUDckP9=zGTSnwB)0rfjU$sQBpWJ}3GagneKzKp3XjrYA66!bfHED&HT@URV4Cg+NJuXtNMTI7s?7 z>1>46;$D=SfT`H?^7seGjQj5(UC;KMBB0?ZiUqe@f$q{OK5~gmZvaO%Hq0Vgiw?L< zRFf~(SD6_>hJxKz#$?ZI`nrlS;jQrsH!iE7`l`DtP$w!RI-8F*BGzl#E2_-z&fl5U zpUA-x|90KC2do(Awl_xma?rYjIZo$_+-e7;2T8GbK%#%&mErOb-MG9J(oBF zwWQsUzGh5C_tsZ&tEDlMkn8t4no4yMaeTp+dtW#L8K-vwO?FEsK_-iHuN}w~!=m+f zweahEp=8~zJyE{iw)*y~Khl05wxo1Hf~Mh3u>MUlznc%qWBwE96p{*+3Gg>3LSFmB zy$I40{qe#_>CzdBSXpwWTCB66-yvcG%WJ>$$V0m}Nb9^V@b6m`SJhXmCzS~W$-ZTr z2)rmNrtYBpo_=BOWWeKNDLd4MD23C%a+R-zvZ%dN!J{VPUE_-38ng|qGM)>|v}{et z$ADSX&(y9V=U}mcXUDB{TFzheW#|Hdy@V+auv#!zmw10f);5nsVfNPaDE3+{y>M^#HnpXet9wH{wX^Xysi}jf_ z6?jn~rQd*qx+Yh?2AclOuCo>lqXD8X+}JLg5hyA;SS%@0!Er8O7? zvgC5%u2x-t)Eygr?Wox42Icht8N>?JWd1)pBJ~w zcnV{lDrpHmDko{h^-1N`jjN+FuoM7jW+4X;mv#1Szq)`nV8>mg<3UYJ0hoyIO-zKP z;uVz+xX%*k@ht|WsD=Lp4jaEq?XbUCtL0TC$4K8poK?0;DAsT@pmkt{kRJQ*hSR@d zwCVGE=XjZaHD8DurxV{jqsu^M0TPR9cF#;ds5laJH$%c%T8rw4lBz`}}6$u~(H#FZ=m-2_VMLPo% z!xBwEA|y%BVn0A4wbWdzY#z+d6{9rAAMU|bMtx~rQPNd(MPXs%nd|Q!AV+0SYN=J` zuX>>&#Y++1k&4VIN0<5f35?TAiGZUtnhC)MMz(4Rf!9E7`+@(jBRYlpO8|Upc;5{z zzN!OAEP!HiP)^vNvi@=Qc;~@Gr0o{pr5m&u&1`*H}^i8yGo=-BO`+<7YuR{TQ)*2fdn zC#1NI9DDQ0i7~Zv6c%@*aVbqq6qVsxv~rKi&eLZZPqCELG!xZSwS?b@Z|CnBjgzqY zUNO0I7-QR|uVB}Yl6$D39$CQukp2L#A5@-PG39-Ytpk8~*A%b6`FeZD`0?;9QJFHJ z5FrQSZrr=pYHuZ;gVu&0gU%;b-N4t^SBtovA@{ocrGY|h!AvQwuVhn_#RS@YHiCF= zKZ29Rpcen`H|4*7Gi)+K|3ZNRj`pz zl9VlXS+vB_fu%l6cNO>6UG}51Gxq^5Zp{W92z0$ab!=q5u%C%agPU`8z_G%~W*P|!7rff-Qo`1CfAe#{4R7Q%(I+-zo0NO(>GcHdx?`I5)j(WXTvDQ%) zh&PAuTt0@MbakWeEFY?GAu39wMx!6cO1s8h!-h3_+Rx@<2eKu@aO9T}b#55V{0(=- zZ^dNt_^HMlhSGF!(J8vCZ1#+FB)0ywrhq*dW`FJZ@C81AM{2FhF05}&T~gjB_Wzb6np7mte*OM@7B z`@42ijxHnZHc^u@**hmBf9}f=qyVw6ReZJvZB_UVe~wEf6W|BcD1(U#M+%}xB+l?5 ztf@#{k{6S$HYMy@$@(`@0r|^5ss7l`#zC}0>PjPWDHPssfcR1Z$ySx*CDZ6;|CI-m5XK80z-*S`zEOKhIFH0SwUJ|1U2mo zeZSs(kuC|mS6ne~&>1AoSE~?WQgz{CQPEpG*(Zln)b`{*zVXZUjmf>oxJZ=Y8OQV5 z+g&qoTDMxwy-yu!ZO_&)WY_Lmj<(O$M8wf`egc!6uz_GTg;2)jydC09;NfsF&uzVz zkZ&8U=!wty(BL;T=EqMP{*EJoqa(}M)@gr#b_Mo3cFl3wt$%zv_nP7d9QA>%bQZb~ zm!EE^naraQ!KP@Xv*YO`?48{#o((ByJqZpk0R=(MXQRee zMBmuLnVa6c3_pmw-IrKzZItZ*%ftl5qNz5VLU4PX=XwsqO?qCQzaOwUU|{C__8MvG zte{>>*ottTjU|UmpQFZC&#c2It5jR8Wz@G*C-lktIyZSqFPpbswbe)G8+qt3Ts24b z6iifrYiNwuE6Fgj(=`DDgr#iVOfU|uE*mIzwKC8yJht}navnpF#wLDMY||>=wcLPjL(k498lH;lO4yQ1kSF zeA{qU7LvX3!8A2ci&g!)MQ&E+#Uj@2BRmH3WfUzt6Hb0FD)>1Vu?Qc6BPd;4HsEBhCRG@z%{zXqz4q*Gbww0k!wFgmks?@V#x@OmPGZ*gxV=STG%=%TwLm7e=NR9g)Gb;dq$XbY>^0>mh29F0Pg6(dWZ&lzVtY;&;4)ahM&i zNq;4kTYfUAr+3$<-999G6O1=AcWk}cm4NpBH)aFo@Xe>M&la(UuMxB%d1975u-U|- zqUzn(dTp@__cqrdUVIaRGA$(=1Q^l3)Ppr^uiu9ECSBWJ8fm*39fpQwZa&`uJ(TbK z826M7sV`>^R#Xf|59~rEZm6X@y`#&WHQ?oe%9$D&Z5GVexnIAXPfmN)^p8tY^r+J& z!h#aIR~eqO$%m)2tx1d0%Rd5ja*Uy@Z#jY_ ziIP*(1t?QIesy}F%En3)qe~Y7py^9_1`mE!?{9}@W?!Z<`H6Jys4)fF+#-COPvXLI z{l&1LJzrJj+GsDcyw_L3S?7t`)xyCa&D<1XQPJZ*ky>(84t$P7YoIj|tiQT|qhZb` z72c1XU1*hdst4I}bT4RMuiRer6*Z8#1ll{AS2V~@hlTLmkucBM*5mwE6`imEGxZRD z6-ZXqdx?1Wc2OFHO&UxTTQX9jVnHQ@BT9GRCt4#)T88=#ZZKkq6=dA6%hYO1%$S!g zE2fG-`cA*A2yqDSZDnh{LIj@;yRnw0=fNja#T9^U4~xP61iDd8F_D0Kd~~&?MT~K! zs%nafSSn3z$%&hpb{mNoc~V_K^>9K5K*oBnw9H2b20#zDdEb9Oz4ht9oN`h(-5%G@vzRdWIw(=X2?J1Z#S#07D*49p6l zhO3()PERgOM)_Nc_=gcScH^8Hj}hon2X$XDd*rD}lz-?AhJC}MgK1;ch6-n}(|Vb6 zl+_c%oHjL3#H{?&tWZsUwo-*O!9>F6DkFg=>tII+5ad|_9KQso63OFWG>g9iU`-_D z=I+bLZmOA==CiB9iy1@|?B%rE>z8OxNQ1Zmlsz^!{7Y!Fub{U+151F+M0^1QGlNrE zvn@0+cEC$oHA?1J=|*abRPkOK32877e^Wp(2&e6|c3{VD zp(}L2X{9GRoW+Y5NcQ`76cInxA8N{kmFDkh%UtPB3etEOr%SDtDJwE}LhJKj1$ z7BobAH{O?AdT$3hDeJO!SnF7?#)AUE0bm(MrH*CXwCi zBZwKMeyoS$rZno^B;J`DrFzD`Wjd<* zSiHJ>o#Ddq)o?+u*~m**dwt&>L$P+0HU;9}0}fUL?Q5&qI!8J^(AXJxt(Mw+d+k64 zW0Y~o{c5^YYxI7qQum=0$spJPTL{R26h0jpbF*BRe+n~7we+#;|6?_$23cdh0SxpA2~MCe*s@t$!)p zLg_n#znKlcF4`CBpP6Hpi~jkivzA>F=b24yZRIHKyW>9#Rl_hAJ;aj3ejq29O9nJj zL&dZcGV4sL>J79Z+8U0DNeC6s=Z!Nmmn6Xsc0Cx4s%C2RK}vy~{&O;xPZYltT+cm0Qaf$&z-AI=eDpQkz zG(L|JtiGF!&GHoew~~J@NLp0%;qhE(kwM@qBH|mniGtc#O3Fx2xYTXE-^9J2?D@EH`9wAI^BG9Q zT3f#%+~VXgT=hOk%?`0BjeXfTZkOlSA9|L~&N3pcrXr;*QGm|A>CUv}XtKSUF1YHI zIWU^um*e}=SW}#QQfF&eq_3n$9v_col2WfGPju&(UuD^akfEgwI0?ClbD!L@m`(`{ zT#yu1ERGUnhHIJ>V9^p0&>07bZr<-x>lC=9j zQ^Ss3KATQAjSTpCP4NO3u0OV`30F6w7`Z_?p)|2jTFu;jFoS%Hz&XQP&)R`b?L?=i z8!Gmqc`5sso@*&q*|L~pSr3RDgFgN9I1aBmU%r@|ZUAuA z)Mx&k4&Z~T;cudP%ZSI2{yF!jYh50%wa!!&o`L&pW49UIMRt0G?F%qoj&p8xFh{$4}G&t$(f#qmqEUq z+3nrdilKx@-4=ccXn(G$>EMtKXli4fr(S#y5#+qMJ++^0k+Gc0t>}hO^tw_uuEipw zRFcb$1dL901pBM+E?S(qe-?F_t-QneYx31oCz|^9KG?ubc$A#@Y+7k3LYICqe?Gc- zk~iUf2}LTar^$Dxdrz&Skc>7I4`YV|`24@WA<#Wp2??=A!rHdzd<4NCIJaJ_(1r5! zOWUdm{C)%QqqfEN1snCtI0;P7(zJ}k{Xwsn=avtD+EBtIn{pojnT?vb8f*eTDE)!= z-$Fi~0>{DR6D!7dFeHaRejg2CK2>l{n(O>?RbV6Y{NJRI{~KVZ&!5I;Kec%E`G z6$ZWE_g-imJ;FRWNxATt^!e07%c-D`x9PAKIG%rkH3u3~?Rn64c0yW-Se$J(SDkw< zv8bN$T)n@4sY6mk9;!^fy(_vq5I6=#-#<4yrcTUEmHf5dMIBRlR_|@sfMLu?uu(H} zMfeUK7cq_@wurHYm0VZ^8d8>9Ts-j6}5Mdz|6?ZKyE&@+1* zysWQlrU_?ge*a^~^!%P3XpM9rrJ?bqYH4HOnTX?(gdZnkMz}KxiJ_!?@Nt!XsNo?K zntho31kE>Z40A@#WA(jV07V>g@$9^WH)vsfU}Td#{Js7_X*M`qF-s6C#>hg0I6dY$ z^pe$vgOFO2&A@&JUwkPidy!7D3n56Wou`19OiiZMUw`4<0%&2V*sM^nl^3#y9f)1zq;5+dyeyZ5XUC%QQsPK+>#B$D3l04!rn)492fv(Aq zq4K>Vfw^+yNVM(Fm(TqOkmkckup3Am5trSAU(zD_k4ti&*HIQI?zl&joidR_HIJ55 zzcx6f}&EcuLDeh6c4MjYcg&PHDO-O-}Pe0m9nP=wjj%_RE zQO%wB``2TTu{4yqE?lVQW3rE4J+c#f!Nd)5)%SR>aPC?xAcSS!A(YPd4vMf;f}f2~ z#5+bQkUGaiE?u7*JWt3amQZW*&Bha-eN}=`kRYt`_8ycXuk2R)bqfnwgv2J>;OCU6 z+|V&euMIL`?|hXKn=b!q+vdyh)Bx9&-k*XNNaqZCzq-gM3w-r!jQTPKb^C*qCD6T6 zT2_lWU!PNIG<;SOe4NDoz$8wV`~TcE{4Z{efP0ej_{TQyiR8=5&8MFqt4MTtVt;10oqySoJo?jGFT9fAdS zcXxLuxLf1a!QI`@;+602v-dea?!EIDPt(tm?lrrrM%5Uj;yFY*i;W<@>BlCoXUFP8rCjg;4_$X_Q4$tu4)=n;7&_|YSBleEs@gP$u1I4H zwIx-SVWofrH0Z?CZ%OuB@!~s^``ED(ke{ znopp)&$O6>f)z$e1Sg~vb$wLd`6tY0xC83>T0>Yb1GbrFsWsxZ3$7}3fKpuIKqa4) z$)!w2Lp~W7@%}>`qqWQTWdj?@IE**p=>`00Fx9a0RHP}wb3b^vvJ9?S*D6&~Wf{?$ zF~vVj`Xunt^zP9&3(>F>4zuVzgLfANbV_ z>8d^9Dg|d<0+$XpCo3E+VASrxo}Y86T_ja@gIzet1y#tE@uIe8XytyAfMO^DLG9Gv zS=`w=#Q3MeSCodOhB906;W6}BMH4niPcM$U-Tu~}Wm#rYI^R`_awzx zXK|gJHZY2IH5W2Q?CIv3UxiZwxr4Vd3V>H@W)hN_NH-}?1Z>G-^M-5CEfZV?}Uue1D)wK2g{;Iu^ZBk=DzufR#v!+L3G~Ktw+vD{d29zay<5P4QNNlPY+a}9% zvktgkn@BI$3E@Q`n?Yo}*;IEo+0kHWF_Ewx zZnkF1adSA0RO8RKbdGT~*{oq7hxr862lu9mcCyb;slot(|y& zR7@X$YpAaluCFaUUzUi;FBe~JxOd+Vrcp@5z6keSdK7xr8+%eA4WFF?O+Lt-58o~X zRZXHN5d~r~eH5p#lZw5(v1W2rSiWnloX6>->mZ?=4SZ;!zxxmujBHR;Tb!9l8>_I5 z9}zYdsiuy}brN?7Phl!;OV6_|Qf)k*#9LwXWL0n?>bNoJB;qFK%V-)v*_ub+qX}jzk@9i+!Uu!X0C;a-D}rZ(j&K z`Y=@B=1xbRf7Dpm3Z9c@IUascR*8?~b~U-x55xD>z+LGpqpXG3I5L`XR-zgZr(jh6 zo^bkkc-hlI=EH!Y)b66gvi%12uxVg5-P{$jom5&@=!6#w}obh;*^AGv;2Uy zsCmhopJ*|mrq*N+?8@afJA0fT^Q*t9qgQ0$MayNG)7Ew3ptch5>74`*^pRdo8&arh z?xmxrhO0RB>565h^wM>pGLlpsY$TIHA8ByLoqW!NW3WN^RNL0%@S9F#yjP@$>Kl5U zeAbn0!4G5JbSFD)2293gledV2y={n9M$vk{s3PVY5P4Pf2_%P;1Z(YBy!UGGl^#UI z{}P?*W?<7>BU$VpjUXv_ZtFkDAY%07#KcrB$OzC>P2lECVAc8U8l zTFvjlij-!X8|Pv^c8%Y`BZH}z8G>(4uEpzx=Z!P@Kh4(_w4azG-2*@1IqpeTxR4`tTXh<)D=9C^w=GZxQ__OiW=bhiUj> z>!JVTH1lmwc1eHE&$*o@iwI3a|0n~931py?Y7gUL!TvI9f!mZCng1)G)n{VnQ#Lj& z1YCIwf|K^C-{fyUx(B$*25jy*uW4TFmCSbe{PfRZu(j@k(glhJjM`BR?=nA08u^8o zNZwa8jn!zviK!ZzT4t;r=ldhL^-Q0SA1$P$y9o-xN^=#n!V#kNp(&6g}8-PzeHc0X< zniQ*GMPE5doD$OPME&m%K?zB#PNNccC zCE5Y7f~?vizoTyTt%k`-H}`{1^LxL8c(rANSn)H| zJ=wM)H?gqh&QgRs|9Q7ToxVjxaXupFQo z>dyH_3wlvdV|mN%1|M*CBmid+x^(yRpA7gyh-jXrmy!K9c=}?Rgu%rFt_phLk1gdB zpOApSh)_o6X&iG>5aK71aJv`ol}h`$*&ZbIle%^sxmdh^aqnrhb@jNzCLKx(SZ1^8 zaeOWne?(kgC{kHs z$4&eRJ$Iha79?yZkF4TmJG!5oR3&ovAkI=>zxZ|^oV`)9%yV_pp=jdmD>?*i2L+4~ zzIg+&iwM9U_Sl-`H-Qpu06Nea5|)3$G)ZEhr`rQ3XSQEAE5~>tdJ&!cf5Nbj#s8^4 zG-Gx)*JEunXG3#D=B5DzQ+h#FPD@)JVD9||jF$`lT5G(au?UjbaJ!W;+f#3WFUZDL z7zB7-lJNOEN*pQH`x3Udi}f^56N6RQ#+7gwJ&vliFBHF%Ms-TiV+Kw*nQx_Haj~15 zY^U?jw#BzE4P>gK**{$ywp^H(ciPPfcvbtQ`M!$?QyOyky8KjSc$P5Mo z5wM(RCfVUVj~9j`%&1bwK|}}z=y7wWy4lqptlJk~OO|ROt0fam{=zeo}CS8p=DKFU(&%B4V*(YnM zU}-ryJ^8!Vb_N4C%T@6ST_BkdTkhS1z`Knga6BJt{W%U6S~@|^O*^t#rRT6Qk=%?a zre5b}nxvhzC?&KUp}<=(nJk#Lwr4Z~A`=oI+Pq#nliiI80owj74wj4k1zqxgWSOTJ z9%Yno=d-8lRFmzSZhvb|V4M2eQpdxGG1ZRsZ7$S!iIP+4$Dv=Zx#+r!vqp)MV1;h~ z`KdtRat@t+n3&m#pCqxNYs7824jXV4I>T9-NF<4o+bw|kP3f3ttjfno!Vlm(LF|5N zl>Dm;|2ez23VZ5WO8bB2PeU0hNOkeJCu0C$QZw~d-id|nFU&L)z;`aewMX`62L+T8CdejnzYz>Ihb%ZY4l8$J-alBjDUz+?{xE9;X0`LB~uYc;_4d3__W{zJI;ssI!fDNSBK5)J1NIk@Z~8MvF(`N|6a9UdSk3 zIq`qLvy&GBpx=cT4oiSG7%27AhL-hdZ<74dxFklWo5a!xg8E1N|3Fp#G%yTS&cEj+H>%iHH#QbZDb}_eY@lm#e-lLqpVNthf7lP z(_@k8U9+UYSUU&{pDY1TKXDdleh7#0=M*)Vk^{5lk%;vQ5NHw-aA(~wrs5hPZ+Eb3 zX8iSOwElc8_aj;62HPx8(%<>Bgp}6d<sGUQB7c%$-``JEqM1Eql>1=em<`M zb~}h`^z+KD>Ce*9H>+HXT3`UZ>xwRCajcGvJxXIqECA10{Eq6{G)V752*|dNUA5VZ z6MK`B8~_M;R*a+Zh{m68JaVmqo1MZkQWpNmo^TZ^^E-RGc{h|{N_PmmaS&HLv+!&@ ze2h8m93;sq_epNxxjWmBD^H5LK8`C5#hhf{BLu2@par1@Y~epPfJE6&vq2!Ps7H4J z`SF(u)L=953SmFADHQs^fMnY$77;3<5v7u=wfVhgH5D3`9hh2kux*s$ql|(q5pCJz zR?>kS$@E|GD3EIU3YPgGxYu?{;W;NFx3rv#S!*O8(WOa+#ZQcE!h!fvP$w(!*GWT% z^EG-}kX8dZTYQbzARSyx5@h)Zv7gu1A7@$gDeWFiD0w-T;TW#M8AaiwU7=T?xw@j{ z`~I^f_xTgu^W;c4%Eox`gIt~>slPvIOG zjLmGeV}-Eg zIRE$qvqha7lixMkxa_Wvr5P;_^Z7xBdzDQ}1jCw=YH7za4QfH*A{D5sh{mcM2Z(C85-~LByp7ANGL*4qRrbb5q+jzu3ziaS?IO}}57#QeTU^rc z95(itVg|EWAvhgrj3TOZP)V)!VzZaDau*(f?3JPjKavt}jOc?dHVsbjv@|*sknF<# zGpog1Pqw*n0qPK?Ij^fd{?bKIRNhurZgE*zfv{J$7C6?@Jpx zbfc$gFzw*A>+U*-KK6fkeb!n#fo=9jtagMe|ICzOJZ_r&C(^$G8^uYvXe%Qm=(}i% zIWLQMAD*sIaJB8h{A@t-V&Af-!v}KVo@IfIRh6Hwp?pv|)|%*GfF!wuQl!PBjY*PQ z6PIYo#x8LB5bRbS<7DR}g{TCL$zhI`vxgdDl1Wg8bTv{Yg+deh`$R zpk#cqud=|JVfeA%o?1=un-LZ%%j9xyZaULs$r|o{*ar4f!M|95umFYetc=&%&B)n7 zMEf1M)}gmfAnLnIeZC`i=MN-)n?2e*1InD})kmwTR6SJXJ1;FnWC-WFWtvd6CX(_( zt-)-dO4*vuF2}?IrqCu7U-#W$ZD8wFy2rB-dl+qP<9{grfJfMa0xenZWd;*>x##F? zg^@m|pVeg*h!B`1Sct>C6HE<50mWb~?J0?%z+GAOvUVN>wte#Ce6R3nm8XVG z)i}C2oWh7h5<8*&Y`z@F@)x6J#H6rF02LuBMLw)z4_mHWl%Gkbexz6M$Kl9PhmhbU zmf>8xyQ?~f1OGf-U68%dfLYD06J#9@X&we2Nlau*o)N9Pw6lm(B4*TmM*G7RU&_zq z8bmmvn%>zwyJxq=JTX+u>pN$UZ=SUB=}+zK)4>p@axs6;Sh2KC03)(yt(+!g5A?h zx!!ryUagj4?>CIa*r|V3H+sER_khbP!WgyIff}U6)8phmez};rVr!jtWu5l$Rh_dB zwhN#n2#*kiBb9kzjKLwb)+f}Tjt5N9bzDBC&r@9|!p*+?QD#II$;bi=_ve3I6ud2} zIzXs;OXR_s>MQ7L!4Z~J513@x{G>;166LkoM)tXLLUyGbU$Ise(9}m&PTQW7XvB^E zT6|xmaBvZ^>MGLF^!d}=JW~l($)cZlQKP%1W|izMXJ7Ms2(52S+zBKSf~iTl<;`@o z%%*M{quKtRf`yF%`9YY0-r~sV;C3o!^rR|Jf2p3Jco>S9S^vH$e{g!Z0ZdJ{Aj|t+ zJGJpA;!yw@{yYu~6%mFr^jV+SA{^GEBf5&$y_WEF6obyi=n)=4aQ~!#W<&P(filns z)HLiRe$C#19O%zX&hI3o_H9Ga-Hwm%#e>E~UuL47yHUXV?+eh~?#Px+N9=k)&X_tf zb1m>=n8f>ExeeOg{;Un<3vh=ibBoRueuqxvdJt6v{j_Oy?yA&uqVkj#Is4Fc2CXew z*Kfd=IbiKwaMKkTo`Vg|^z@;9Y;)dUOs8Xe4w=Pi*Qwq2Bddm4LPbMS-PUet=ovN* z)*hXRI<|to=3`Ms))ZmhV|3CQNw87!$ft0Y3~3CMW3>x@1-abz*)R2z569ntfx_0u z+Dn(QRi8X<5ghiNK?jy-^nYb%^4FI)`aMO-zc%G`*El8dj4qUqcROqX^2ItLgQY+4 zm&YDI5Jv?w_xT-rIWe(E&6)b>9+L@n9Hq~if7EG#yd{&4u;9Ll`D1VI9%pn*%4;M% z-!-7O#=_Z;^QK^>4q`i#KHXBb=&n~6@aKhSg#gkcZ)Kz<8&!?{>iVFZ1_N|UvkcXo z9QzwwbZDnqX)l2E;mGD`(~p0-tfN93D(%(i$80Wpc_u8bv4Vhgyj^Ea9>9V7Cne%I=acWs#B;%yl)GsJO&AWlS4qx4x0EjMlq(SHGlVxf z1h5w&DjHX*>V0ID)&eKd{nuNN9PYn}qmSiogD3DSqN~ar+zJ1Pm4j!HKCtsfyWxf zsxt%WBWS!BYN?OJdXkM3D{3aLpf6;BiI5h3IDifjS&-;CRtHB8- zr|Z?mtBc$t2{4G_7pIzRvAs#5@0W;NZms-J{fm+D7J~NutHRBH^V0>|)BC^wF`fYi16}?r`jHJb+iqfw(Jn`j4=;aa5sYTNv`diej({QyeTBNZ$kao2{ST2K87l$}TCQz<<( zn*Uq|leeeX2}@VqBP)%)6^9_K|)7*ECddeG&pU&kbqQJ;9I>K;1K&r@$pmU z8IQx@Ys@8-*yP#`uJb*7R#BN$F3^nA{KH_NC^yNAhaRaFrhPire8G*K<|2@{(g6}u zjyR;oM%GSm8w`<5@6E|6lyJ)Q%RpiAHR?Oy+-fPI7LSchTLs7+5_wC`tsOLb#nD5# zsF(m)iDfXGFgN%6;i;@($@5z>k4V`&4pwAz`6e*9-z#?QH)L5wcW99=uAcj z)+K$SR4oJ%x`scUsUCLD^Fr4=-@4b*c{&Ig8ni&~h7JL(Ks+40uF}SNDzRaYyItS- zI5bOjlsb;`%p3%@InQ6uQNEvnJABpw9-^-VEkuQRRp3fy#;GYl4sOMRSA{*Oq)dgd zVt}XK@ebMwjEe7fBE2z;>ML1qrSbfuGN_cn?C3nrB<>s#aZ4Pa#-~z!;CFUk&)cTG ztYc-!?wWIb@LX?L)8}dSYo%kF=Yq+)R75io3wfSxgNggLqs*7dWSpU2YBkmcn(F2@W5;=7txK(Bf*qKwmVLEl2_#{Gk}@Or zHzEa-G9zccv%Fr%iw2j{Q!V+Vkd%$AoU70B~ zzujpF5NO&g;sWy!Ll(e;pfJhzU5>u{7y*{;$5TXSgTWs~E7EUi;`Z3h{CukG=^(?- z?Ddqk&_m)_uEg-O16^9t13%Pp#>ckd;^Mz<<Ht!DjIwGybz)E!e` z8p&}J>rX1rPs$-imN0|fTyCJn)-Ls6^Ydhh9g5Jvi~HE)SK!A{PJi><8o}^B z+)tkZ#kR%zmEevB5ZvpIQ$BDdRi<}_@DqL=LEpP%o!q1Itu5}d?z<_d8Sfv}Nt^$S z0$!WO=n4S~KZ?2ooX&iqvGwSD#&5m*PwqEHY0r1^!;fXtsOIDjS)A^w(~>(A8J=Q~ zo>@}1^ZVSw!97qElN6Ubt%tRzlR}w?Tr!c>?De+dnFS8R;g8YLoAV%8WF+q4ESpCD zrO%;LO57^(PP=Sp!E73dsQ9{3=!gr>AEoMu59x^Lo+Dt4JfH3Pq!i5SBbn-5x|6be zzy&xjtKcupRA1HTHGh765fV4GR167u3DBAxBzxy_?c+8~Yo5~OnarK(oZtsG_9AX?85c+Jwj7yv0_{3fiIllgoeah z=quG4&1CG{%V+#M(T+>m=GxrlF4V@ad0F$#obep5zXgx!SMnih*;X4QPyX_G{ZQ(b zja6h+qZs+TR&vK9B6Ry%C~zK;c=pBx#gLRpzj70G(z2`-hM1}j{8|$n^OuOLTgihz zDstzJ_Rd^!m4Jq&eBv704FEx0=Sk2b0?KH7gCIDxI zm`+|%*QZmUvo8M*qeaMMM5}G2y!-bH7VOwpPP_Pz-2;~A3|?9bK_FpV`1v0)DpdQ$ zx0U2DJ4|ry&XvtsSHxbto{z*ZuH$T-leF5o9ZL3VH0yb>) ziB@9PW2brGat@9o2;tbk)f@bL`T>bzUEWr4$fkyI?#uTO#GD1Wc0O?w3(|Cg_TyPn z9J7edNcyQwB7Xt6VFR%RFL$2BUtCgTH{R!I#ijlcOWDU@lOZSnsd_uy2Z@?sioC9M zkaAOuQIduv zJJ=+hBC2-Tq-J}RE6l3YI9)`HUBm2Bv;d!!7o6)L#gK$=Xs}lZ7?ZB*Y914_Fk~O3 zTx{j>8%%~G^2XY5GgJR+rVsD@Ci)X1Y4Vtk5nc3`63%%46M5|4koda|!3$o1f2_t8nKZ?wm>n46cD6s6Qo=A&E?BATPQSLw z77(+vWftBh^!I3@%_#(#?e7~fd2nO-pbLbsvlYK^T|9N^l#-QAT;hj}>WkiW!Iwi+ z9X=90IjkG9@7~niC1`JA@~6yT!tN8xQN%z~d@w?wP5;9^8{$g!Yv2z|u(0CWefN~^ zdvbCptpib?LtPi zWw_yJQaM_dq{#kZTDA6ayO%2~%fc%^*0d&eP=}c{;x~gn)Q31}M*9Ak8$QS!s@U37 z8};cU&Lb1Y4(eaW+ zxTK%{OA?lwRPfzZf&4ctD6WWb(shEkm+{rMPGLpTXM8WUv^Se$LnE}G3EtvL5(`j^ zu4&6q#Ovw=p&I1xiK|ZK&x+@#Bsf+nPzg$QBS{QPXjNyTnd_jF$bYAg6!L$1L({GJ zBf#_7=%WIS(dUVgoQ#{{go-4_9j+br@l?!h_i?-Qnu9X-gPvRF2L`WYjH5J%D!c5a zy-`ieQ(TiHI7WptP`kzhfp2QXHijI8rPO;IZ{jwoxkRn6<{HddSz0WpBx-G6c`D8H zCcTqF4Et$4Nsifh9pu$?3NSYT1Dx9*AaXuseu(qKN6qtw7Zq*|Jr2z0&MB|wN{7^w ziKM-__yD_=gdn4l+2Y%hTPM4~-W1dGt?0_tuq6ZD%{=7*To-a7kkhH}*%h)j{)wK6 zPGODkQ!i|GdwKP$*4FY2B0-)ypDj_Y*?g8GT8CtgLq0i`+x@b^!$lN6f_@OcQ`7a? zP3gm0BmsMMhXiPCn3QUyRuNL2Pfd8W{oR$IVJm}YVS|~~i)@Y7C;1%`d=q5tX=c3k z`4)H&_w8vun?EhuBc;7vJ7+Ft32oQE)Hxx^(DvVCMfubhcnx%DD00@B43#t+bq$R= zRYo`*B~7Un(HCGOTOdTR+j+4>Cpm+B(Xt<`X zufHx3IRO*0+|+R}XnH-a$OdNnko?|Y+$}=-{!3kJ(Ma?(T$xhXbrSBcoy!|BUUunF z_zPL)fYx>r?IRXPDJIsoreTD3B4+EjJDq?~fBh|$W#%3XFAc-ToO)l@BuugWf!U-8 z3{v>khp40g_5&KF(ot`jFc2-Hesqr-Y>mH&#&>gxXru68*B7X{4u}rkxA1&FuP5r! zwcKfSypp7p)l*ZNY~0eVZLGK^b2*i>xs7ntFK@FX(wuSIp18(w7gE)>Sq4@nPiwvY z@I5_`LWX+qe9s9Z&5Pf+SblQ9WKUrXO+Y&khp7(6@ZGrA+hHG|;WfEBK8(H(ZXNMT zw`_)OEq^||3Clr^)i0MAvB9PvSsFQ$KXZa18@=6i6BO6cF*13cZoMzBx|y}oyi)W` zGjZ=>Ef~97w{LsG%@RD2SF&JzRx9T8*v%;G*R92PyibSGl(G$OPjWfY)MLfJ_cX~& zv%ZG2pln<^&H`$tBvr0G*i^pPV!oGmb5pyc0%X4R(@=>xvHvkc#y*5 zb+-i%1?7iu!aCqlI94oLmfH13t&~h1b@dq^9*B3mFzKwMKaQo-C78cqybzzR^gVjS zW=^)3Pb}iIdhsOma1zhk`NGQSRzct)F4rzP2gd-{X+vT`BHPydsQKv=_7Zk^ooZd` zL(zWtkrZp2jYA$}`w&(Ag~9?RXNFa1+QqSxe?FS?#_vEw%MoT456$D77EdG|r>0~$ z|HB9W_ga=Y`{xKaMRF@^Krm6{eB5T)n^>AOZ<*lHbdhbBxocSx4`Vk-22vG=Ca<%H z3nihZ9jk?E_PJ#!`CzSfnxU8vBmpOr$=Rhp7n6Ucx(hmIQ4aHxbG4<#qALTGSWWAZ z<;EzQhOkFafmsHEBVCQDMtGBtGllrMgwXivH999*vziiGdNC7cTi!5iJLtGmQBIH) zvmM9tGf)0Ws-b{9YZG!*c&P98FJzC{(jDr?>^iHBctX@1if0In%F&YYMD4cEzZ%sr$ID?NqE z8QL~7i1uFIH3DqL=}B1YiO*|#QH&Yxydoy!7&vqI65}FT5ty+Jbn|mJ$Mb?{#rfKQ z;?e5&r=;nF=E>$yLQ`q99i8v+F6#C$TxseE9w7JM-E*vY0J z-0AY_&qfbkFBz?xur*yyDLv4~bi)?39|exOvZ~cl-`A@%JGD2D3m7b&nTm{gQEy&~ zNW)Jy-iCWMcpj?91Ttw`an{L!S?@4gRyN$3rSM`ptg*4>Fkdtd+o8LC3|6x4B3R(l zey}|;8)+&PWsOxyWGjM4TU$;#GgXs#DyWk8t;qIaVi`DHl!VrgSX_G{ebeEF>Io^(3axn;kn0OS5n6gN`$? z%dlmN%ZQ7WlU{oFZxz9)_4D_^BXa?mZWYVy)FiBWliUrM$@I(C;geHtk3$A}l&jEo z^x?nh51Z^qyA!0io$!m89(9!=g=j;oRbF;K%kLyO)3aOZG?wg^8tPfI zt*|)88B7aw_lr~)quXB!+DBb3O;*FDSfCT{)|pUlGXuxGj3oA|a5LZxH`KY8--pX$$4o2&^D0)yuBXv(nRitA-uPNu3sA)FI zUfv^~ABY?qXF47VV;;vT)s8cqCxISt?TC#gRw?bG#X&d2q(PdUZSQ}7GZ5Uc!q%wo;U#6S8PL#)k?sN{fZ~Dcb z>?tLK!tU0~g(+LCcSA}_XuMV=V5EhqJ%}cxGS30tyg{`NPHVhG;rspC%HVz zlHrL>1}|&RXyPYjLn<$;ng{ui{zeK1gF#A`O+Ow~rN$%Vt)~rpH{MBvi0kj#0fouw;VFu2GpCoemzT2Wv?V2+*T;TIO)<#I;kCn3zg(Ri#{IRa(*C$RuJr84 zbp#eO;~z6+wg!>$PmzGO$}$kS*%8_il@zr2645^kf}KB8OkURG#G0)e_` zTX9XXDw@xCEY2!=E$&$WKYC{lORH^a-&5S_H3Ay4f^ReY6;~s+fh?2qS-8u=UPO9&X5FS z1XnxL`DK@r@a1&#t%2^jz)2a1x6N*=xT@{oyu-K#4S#q_vqDM=tI~e-SJxbA`L$NH z>mr1!HAF|p@mmOQiTx01{9)=N6D}j8N0UO7xU0Sk7df*0eOty3r|@LvpY|I!%4hQ1 zMV;idg9HqbvWiwb&>{#O6VG58b|u@XwLg8?Z)(s!xKRjSW#uMP8zxk>({;tBRByqE zt4q@kZ{~aml<+sKZBAHK?AQ<*YeG8k^a;mR#pxiCi0hNY;ZT&N{jO)H5R0NTZ{oU? zlt$CbbUOyo;Fk)D&@}dxRRMO44HBY?0kEYuc|nP7Uz%t9PCgj94bia zVYAu)&P8`Ze~#xW-Jt{lw~)5B!>o0`%UGstmeB7a^WmQQfr@eIZXU5EvPdK2tpsJ*heaPd{@1;tsVbEV^xS_RLEh~eC39$jtvzIkATkE?6yD(cRzOKQ9YMAv)M zgwl}M_!ablXgl92;IdOOp%#O%fRL7P$#WnR#>-$4xCvc8!ojFqh3-`qhF-$6vn8&N zAKi%m-2ICM^d8sXGdjvZ9&5~uMT$+C(YI!v<8CS4_Bx>v_@r-QcRKu}XS3e;0sA^4 zcvmEmWyV|?7$+$0HVCxO^d)LVG_cUE6v$C>rE5EtXajHieJ^UBj zBr|IW4Ru%s0QrablU#F|+DIcipwJs(#lzvL>M@_J+{p8xG2A)`+7d_OZ#gYiYMOu8 z%he)(PijKwM*u^|uWJDB&0i`w5Ru$({~B9__~Q2dZ>loibu$cvg?pNf27vjwZCvjF z6Mr~wAiwzF|23QTh4!Dr|JQ>h6avRw&cy)w64u;}YJ%@SzZ%H=^8(Qt(%(X6|K${~ z-!QPe4}q-ZueCt*=kGuM&(~_*Ry-J#(Ppk$4(PZ6i>9Cj;zxM7^UZo=oXar?UGkHi z;;#}uFV~yElT=(D-l6Vq8p0j2Rgp0{{hq5&isIcBaHC|+SGJg(q@{szaj(a)vlI)*mwIHle4f-M zd)aun9NB(BqjERu8|i>*dT4WHeEN0}M^(>7=2@|>G_$)tR+>z82(78z#p|y5XfQBOYQlWzPLD?10$tn&f$qmh>8z?EkwGe z$oO-b6k&=JXR%E&z7*eR_K@|qtgDyI+4(YuXMgr$db{9Qqk)X9g|Fmr?-<$ng)!nD zgO|U#%c06f9hzpu-~s?Rh|6=7_2K#H?t8}aZQ=~CQmy)PG3G^k zCF4lO`PHKiYLK07{mxvSa@KtYZ`#EscsziMxo0Vx2&De1wl>?QzO?tm?BVDRxa~G3 zcWrKR^-m)6sxVsh*1lmbN}0ngF=v!F__iL;t$SM9*f2Yad+cbx#5q_d<#BKkgN%My z2=^jtIGHbcD zy;fY0#u}Jnsy7L%C-DZtQxDjdxqHF3)qaNAEpalyU@R8=Go(}?MLhTv&@`~x(NHHg&OCwalpX1>Ea@30XsP&QU^^~up+hhN9S z!eHYN5oeoVLdoFSXDU6aA_4*P2U*W;LUwe&N3ymC>&WVeeMsvj?KxM$7(VaxXys{P zg4O`e&FpbT&M}U;)d-Ixbt6 z;9w4{VxND?J4*JvhTsK-jR<7fa{k#X$6SC>xo*0Z>mhSz|Jn~vmz3`FsnnGZN<`Wi zr8Y89kQp{P2xF@@biDJ5c4y9YTt*k^#ol7FI!|Got$Ke1Ywi&S$m`7PxXiY;Ip>W; z#sIL!4nK_LvUg9cinGTrao~rM|3bR_lVb0l$oZAjb5>41hFgL{zPM950Nu2qSK!yN z4Gs4>M|D-dM{K_o#ut%wW24u}@#uM!A(#m%_T{dpahx@-ar9TH>O;C#lfDND-B2)c zSJEgi(U)h_J;X@5#UR8%IY~MTHC7QN7U?!a&|26U2A$N{M9EQ`fDOaAr9_!?Op0c? z2SOcU4!uby#nClA^}5H?Y8oS<;%sj6X$a_9 zHK#-FIl8^NrX#Yolx0;F<*eLe)7Y$@qm~Ry)lsr3BvlbR4of_30={%l+3kvs=R3@# zQPa#6y>-P(D5d-^_8pN3EsthT^{jh;cRo*hxz07a!GFuU$_Bgt`r5I49+aKDo!@X` zb<&E?4x!LJdq56kfSUBX-%a-t2 zxT;SEwNwQis#UaoGc`)Dz}BImsI(A729H^90u$h@%;J=spFKV8{?oi z7;T>^4jxggK^y&U|Ku#rO9&6aN&$eB;*vVw$_aI!)seBKsj$Ow&`!jui?1%PlRxh< zyPav{%iE)KGs)||p#>R^TPUh2W=xeTP0E!%i%4k`8UQ$T~|} z(Uiqcag|FF|KFl!uZN6g4- z6-Blk1aAhLsjr#!Zs7FptY|%YE`Q#aSGpZB*hw7tpRFVB@T~R)SX@=&w=awZV)MuY<9eeb@kQesa zR5YpWnL*3N9}k|TGLejQvvph>KX4bIu&nw>hmItrrRs%}j=EQyYcQEUJwHOX6?2`0 z4oAuW7S3#^HZ&u%oB_#ilk3|GYqxMuszlVjSK5GU@wW)PWCloM1{a$0Asl2%dLb1xut5 zDdH=pFpy9p|8b>L&r0H19Is7jdT3GE3Q37Q))1=`V4j-mcAku^Q#OuOHr{}ldWz0< zJrli2MM7#bafKSxl5L(%i)c2YtDl~+y?@BfNF{5>-_EK2Ts%<};}oIZ#>rZof$#~^ z8yf|v3bGcRj~BO+LJBg=G@n+kGW1cDTI|6!ZS!8&t+$3NWw;NJ@XJ*e7jGo(Gu4a^ zq0&IC6oic;WJ)``M{~-Di=Krej1xtqtR5@zUEU@eZ$}=T86Pob(m^l=M`wcmGXfyT zk4IS+XGP(9*>54QE9Ec{@@^9wY&h5rXGv!cQaoG7LGA6QodqFUDOZz2HyPLD%#16~ zV+rv+u_MU~C-oFMPD@WtF7Q~0ra11k>xV_+Fm7&k-Fg@z6TiYM-1QfRK1m81D;&Qt zS*otzfL~;cu@<_nFwZ#mk9V`rr`hZFIP}p^*Hc$cFDn&)!LZ`lo~E?Sj$_zSiMCWW>P^5f8h%*B%nAPsd0MLoHVSKd zw^$Zep8u7kYRLMqn6`N8szE+D{4y137G6o*L)C$EQU^iVE6~a=xR?t@qSWIAVG7kN zTD^1z-58fC9lmel(J+tsI@`36$H^avq|xb3ZFnk2GqV$4Mmc{vIN8@150*^9lo%dF zn~N1OQ~2342G?^B5OZcGxjCsp;%u|l3!YTyN7SClRnTMzvDk#eCH->E@}N3 z8U&4S^NKj@>#a8jl??fXkX}y8zUh0uh$c~IcV#zGZoRpE{(XTia<5GV{%tfgz35jr zjHfPZc2xcemwS0<>bD}yE3h4ntXp7!Fdq*`Dz1yN#5fo67-mFvs z=^YeAn)FTx2uKaRw}6U(bdlbr_fF^#0Rg4=7D8_c2{rU~xA^L0m<5Huf6u#- zV%5Zwal_~Rl~2`?!&xp*!IJ*oD@Hu?Bd)w)1ARj zZP}7MdPs%Mf?0>htNKAM@Ru^E8}$f%%ZTD`?%8XFO;fB^7$UCMqyBkW>GhI!Hg>X! zdIwu}h;R2H-c|WuwR)LH{oYnwOH6RfC8a4`lNCuq4UX0KOrAXrE)cJp{W@i_x8TUv zNFZpDv8tr3sEF7-uc%>r0L8x{c8_XgLLwt`@g)I@L!w|Gm|YmM(dymE8c2vdceO^` zsPSv9F?kVPHOHO63pQ;ml%#oF>xDJVMD8C&BQBD@);k7rLMy%&htxsm?Kq9u{ z>v9@2o}WG4e{^%sq8kW6K<(+AL$|}+`19Gswlw8SQgUlj{OeG0u|?e%3&n@(PZ$I1 z5*YP7148Y^%RKi=o@BeY_%|45cC?!&Zq%zK?r7mo(4OGR|I}CkdqgrT6w9e z=BrPFz7#$MHVbFGGn_r%V0|iVIy-02Iq{`+i7#k#H_!{8Z-zUWtFD|m++c<8OxswuvK#tc0vX#K09ct zv(H-hZ*C$NSKT%4?+NmFrxSG7_Q^_-hufF!66Rbtc!Th6+Fn9SS}!DVQ0TqlPM6HI zq?u^-UcO8qJ8AU+yv}nBO0K{tYP)@uYv)dvcr>uIr+6SYN#~7Fd!(Q1)9f-&XO@FM z1)F)S5b_ho_LIyBBVgtEtNQbeQn(2%U)y%-wz47#FVWL<&TiporzxQ|g83{B;TvKU zk#JE<^f1kxQXJuzc)t2k8{#6~2yv0Z&g#PnkIl6P5qHa0DZf)Tjynqz#&?M4U)YaK zt3(j{24Jo}4#;JnsXPBLUi1=`sxI$ejJDQ$JF>$=I0{am=M3cEC*m6R=$e>aa@Dl- zbiH^v3|0W2(sjiy&CqXHpO05NI>RWI&g6#4^WmR`O(4dSC~Y>Bc)5_d6~TFjs*58u;AsJ6~A ztC+K^l2{RUhBTTXe;<&f(P9As(cVs#R+MXCBgt}olpb6 z&mXD{lFDU8`*%@7{)zt+;MJ-k9nViau1w!;?h`zJ_tJ1Xi95MeX&QEBkv*iR5hpO= zPL#ScZ66@q=8~PZSw^CD&Tg?LR-6;)FR?w5nVIH+c5t}X;C`WMCmy5y!K^XCg2X2E z%qQ|9D>ro;Hbnm3PI)S6d23*S;*2(F^JaYo(t$wtqk0Z=b?=N3jhM*vY&t(1myu*NtC=K<2ew4=7`#X^@q0c7Jmry#ohc|AP&NI`(SpNg66h4 z0aDO$u_IqL3SMQJDemy_+zhKT;29FjjlM7DtR(w@b@J%fL`xvB?Y^lnF0<1AJB4et z4`CcCM#|vjWcmPg^8*c)7yy~ql8Xs`Sf8nznkq)PrHQMLcpD$sBHP}4#%+$vOi!$N z+G`Gku03$2#QWjm2gum%rBFtudp{3l+IxQs@|M1tBOD9`2>PkDA%B2#JOJ+ot^y$8 z7q0DG!>hIZr*!?_#l!!zVD;Y8TvbGY(O_U0bKn4;j2qK(w)|4 zte4+>x&J?Rf`0?K|92W12jf{3GIIK~kb{>(6PmShR*z4So9u$*WrAj3^t5X^_-z$h z{Dr&(kFN*z2k$uWzBSx3`u&Tl@+$WFpKi`gW#Hovco24er&z(t>scMvxcGcAzL>G8 zgI(oT)5W1@n}bF2NylaP;ux@rJ5nx{_~SKQ!==qm?1g3=k#aAO|iEd1h}93#%_ z-98@R+w6-J=e4Z?8m}b)21ffeYHq<2?3MH7!{W`Y_3aV6H`eSWQ9hnGSYfl#x;N|e zz@G2kc+8ix_#zf|hC0Vet*N#re_w4ngihq=N~|!XYY|ey8kp7!;iuN)Hk?oluI5Q+ z65KGR9U^|*W!KlKcsHeVAhllZ`>=Bik0wB;TmbiP2~a-1 zh)cuaOHXm=WNfhn9RSo?_O(%wioV|es7-Qi02PbgDCyhKic9Nve%TCovt(;$ra)!t#*b>pX>>FY_;Pm>Q_pAfP$5K)YAq2 z2&Gc769=nu;irdl88ReF_W8d=x3p4UYiwh;FAmwKjck6kzrFCDowAKzTUXH`3E)D%iu4?QH~E!B;uuux*tuNqM^`Ve{jQ38;%rKb}B; z@Xs$FYW!^Wi;-O72z#H?Bnh*b`t$yev7jUgBC7GGwNVmcK=zPwJnwAg*W32-+G@m> zy*4F@JX}ufZk$21E`+bAQ^f2w{2^k>u37jn>^L0ItUeE88#?nY8fxtx2B(Wm<9-Oj zN)DGmBEH8tDooa1;zwnMRdHc=k;m6(&m!YMhHcx$$KmmqVW(Zz?!XB_+5Ty@>~c>R zAM^r_^hTnQVc0+ub(+W$>LkqxYxYZVVG%Atd;IcK!&oiB#+U>{W9?`kan6lwMtZG? z28j+-(a*wwUyPe`yJ;zc`q^w_AnCW1XQd5^tWf)R5<7c=z} zt>jl?e>$_d^k}#Yn~)sfW0cIb&ZeqkVslP$I57iGUH#KtFMa_h#oel3e1oW$}mBU)geHOmmeCK^W)G>LZ{8T+!nE zQV)!&K}^&VMJguajEn6We`!$I*F-P3A_?>PbZCOi!Fcx}BfuWlgKoXB%Ltg_tK ze}3k$T`FnBuw)`H5UMaru0a4R%$`ihu3lT^Zirtizu;!PO*d_oQWu0}R|8equgi50 z;1hEMA9l9!pQ!tESq~O|2ibATbbqT*56HV*XX~EEqzIX{&^}Mrl+;khPBlQ8OqFsvg&2p#sR=xUm zYf5g2NCj4HxyC~Zfg$LfF;rlRTm6KbCM&*{xYO0Ouran#tvHNLv3?FIOe#^!7p03U z2%&U1`JuH+(W40ee)zscz_arfXOIt{G})@Bh^|1Iv8+H2qpA1l+kx5!(L0<(yIO!; z@Iw+F0IWzGWuwzeS>W!|V=7=hHVn21)R#s7V5wB1_UL88hiM&F>ragsx(8a<&Tfk5 zj?r-py0}N$T1AL+wS?zZ-1gz8t#I8m%U?6I%XYSRq^A&`Gjb6yTBhAy?F5z#h-gj` z8{3RFA--yY)S#+>5NEgFYSN56#TR z$l^39C@)51*OLkke%y_Cq}0`C>vEzvxIbFo6}$-JCvl(DAv9$u1&s#GeK(bzpDWlX zmhfssj{^m<7nSG(2z}M_3JZre#z7=J);_@PXsexX#qOy@d{pAUwz=b_n0dmzi|N0? z#6xDwbx^+tt3irp-& z3NQp23=Q=Ty~u9a`o5o3>chH4ML8(^fKLF48I@!EeK-e0N;JRJ?F7(sm(5lFx^*l8TbrGK;QRB@i{I zz;I}HFHljtlh%Ce#$@UA<^yBi@&v6U8JBOz>rLX&;agM%c?HEaj*c&U{8&$BTn_ddHppYL8SHw$ zC^}5?Yaua&kyC9RE>@+fR;nka!`F;N)9lPq8xEcL{UmD$VTxf>#$55V{4WW@nBO^3 zM=NGp7mHxHLO&~LCQK@xc&^>9O`dMIOxSyrzrWY_g=ne-D*R)ytCN54%LCh_-9EF} zpqBJ~C{D?Rr9A=0x4%IRb0D3vD_2N*H(`Gp3Wg4=n~>b{0zp6`+0r(OP(LH~I5YM> zaY}8+bs1lNe$}IL+&#k};;+wVyCgF_!!x3uV`-7?lb;F<{aG6FnF~2;D%@(0_f|2( zzdiVX8VnqLb)41iL%W%&J(0=co*r;p7f+-7HO3;0-v*ta*lJR(NzAgiR&nBbqoCd4 z_@Q7;mSgwQi6mbQHGSGJ-|5aQni_oV4+W%F4v4(Wm{U$WUmrzSiXdGUKGnsg>Uk;Z zPUD;x7P3ii*y^|(qpKQ&<>))O1jkR+5s1#x2+0QwCkKTIV^Q=Q6z@g(`CVED45>d4 zRj4(T>TJLK5|j7b*7IG4D;yesKG$VkQ?pq?(Q)N<$j$I3ujFD5o7IEzcCk3=6TVHp zhhk1AajZJJB;|z$QQnU&FxaNT;DZ0@jAtd9OoYI@Rp~_(9jU6E?axT?*Jl%Xf5Y z0-11_Mcn$`vz9{>vhK}_QW1~m`-NSBOw(d2Uyi2|)nV{`vidfmso((O8zJA8$AK#x zE-o0C-#r-DAFLK*uotF`^WOPLP}49@-kzHZ!=cAz274Vb6N%-Dl_M#ll+AU*D@R5h zKEh{NxfJHP5l3niXU^XrVGGzergWKaioeGWY`i%;`gjE}-I+6!1~@rk(N=EjpMKh% z$7AbOvwu8nh*b{r6V%BsbbQlTApkNu82I|C+b^uMCYC<6Z3s@1c45+Vx2cJjAry-m zP%)$ZT+#K!?29^BZqSHr?`f{>@(o3jL@m?Ro#X3B5J>&Rrl?w@FpY+5&8SVmGQo@t&2l^`KkS}KiXWo~-rM!b6^9muY8TycDlkz0?$gJ6{-xd~1Qo); z4l$kVEU@lqFbs-&^V7YyC+)>namwt8O))g|aw zok>}W{hC{67S68C#7Ww%LC%DagjQq=XSV0Im`Jw#6!ysV{xWE+IzM%7%vf1v#K7B^ z9TH-Ah7e#&x;cN;5B5D*z18{5m;N5sieY;K*(o8vd9iw@?Y6j&)P2d(*c4lf^szhM z4VZVv;uiu3w$7w zqMkxn8Cpvc?1;(?@SH9fyc3exY&@GUJSew!GE42T z{sUzg{YR;e_rtEB0q%}L4>yNvCr?6#JWEA}6)cH95 zA>Jg<)L8GO9~&6axI&M&3-}B-6+-Dq@86%Z96Ypw&TmYtZfuBbZTzZ@zOVjCRXcuX z%*l;}cFlSH<*bZZNjEE5##Ts>(IS5`SvE`m5pn1tFTC$Xe=v%Kn0{@E3)cdy*$SK( z=ZMS6_<;(LWPJ`EPMFMYJ!#&SLcUE1IQtr>RqSn&RhW$${f0x%g6@RS&U>O63Jp)Z z%={nCGM{aSY!WuL8HV^eMIYxPxzs7JtSAq=o{W4q7JvWE(1Y>kjr}n3Cq65!(e*#p z4xg!BLpu^DmjE^jKyY37SwRDjz=h0wov1vZX-E>SISP%UXcm_TFC?CUaT|@T3&Mk) zHX~gr>8(RAyyD$Z5p9bRbb?@sF8J)j7=Jl1W3V&>DCCYvLlMHAeM{?Q8YA9+y|;x2=^1M7OHdf21a?Gc;G-rhsOZ+YATi!VG* zGRFC7okEmE_Z7_05NcH2w4{kZ&gr*0m(D<^4$l;1lkwh_jgrd=qfG!1G}Wd9dgC!C zXRX=FN@>HZ*DOpaQT> zQH$c?RK}cQmC|WjYe8;buFt=~|}* z&z$v8(V9a)hkQ9n5LB$IQ|<4d27~(2Bsf3Nw2o7CGF)P5z~2QJF0nk|)Bk`ydfCRm z#dQ6jTigB>vIk74*%`kp(Du=nKd#8u>M^|dbFLq-mj9#J-v5Gi*p@Yhs+*#J+8}Rz zM3PTvyE3l0do%=sa?`au8D;JdN`tuTvz7eRWLYZUv0j-baiwr=hLuLucoidEZe z^>PD_Wv#-snNaU*!6;E3{`m^xag<$M-ypq$GO5p#lgXgI;qeizv<4r3#WXl{8IxtU z84f%7^-g*!HF=%)(-nKEbq+jPwTT%rv}UEbcEF~3OCNh*$r@p$#AKDgkxG#L_-C2V z5!=|*do_pHYc7(F2kut0+KZ_quC*^9ib|)SQvQWt*Y6S3>PI7xZJJW_pl{>Jlh(Eq z1Ye)}u%TwM&r`$AB?e)uu1s;O?4{u3Xm&!{3)%LZW%h9pvfBGmfpSi%@>{vSLPv~% z;7jMQzkK5-@LQTHONXd*dVWbya2U_OVhB#?dg^|duEQ%_ZDv-`!&=l(t9~* z*1HxwLVBv5yg?9-=Tz&Ncp)IJ{dRR^IVok8b{5)Ga2u%gE@HM#s__0(xciL{|HJ|y zkQJomIhoP0EyS(LG;5}lV}r&Fl*0|{JxG1MS5mZ`6!lzxK^-ug`>1vj^s^*s``ilw zPUZH7P$A&FPIA+c-z}voW|g^o$ZC_n&ah{TC&gLfMn6)F5$l+#w?hakG@pb5*G24%)oqr5} zQZjVO(b#*7nf}tK(=}iYKj4`s9i_@&UOO`?K0KDg4iJ#8WijX_u zO~a=zw1F9?uSd?@h)gQ2VYD+r>=Y{(8Advq4M-^%(hex3Mcs9K?VMU3z;Q2RHiG&0 z1njA0x7h&|DVXr-*yu>V)?oLzbY1rM*Q=(PoL#JW#rK4c_{7hHD^8Z<<_C2^FJN0UME4+-1k+%dvMckG;0xNS3^-b}Bw@ger5)WFCjr-+8Bjhr4F z_3HUA-m)n&2f-{zH2G7^$E+?^EF^z&Boqu zC^7qb!sO-H7wWvHfriPDkT={J#9>mQ>6E_(^cH}PVS~)N>sQ93$++_Y@P^m9z^M)l zNh*B8v^eG64IXN-W0yAYI#CNzw)Lo9qG2w7ym>pRi0AoCQ(TD6B2SxP{j+X2Q|(*+ zP4YYzhd5>l0jNRi0=WJ>TXs2XB?`y<#V`H=+Q=}pRJsRCFJDg#B<2R ztob53ylKrscke{%woXM?i56F^V$&n<^Jgkp<+HjdFM)5K_Akd_s*Y!aE>+wFc z3e~ChThs#Vq7!X>9WA52Wsf$QN2n8d59S>F`$^NO1@J{`T1a}sJY-GSr)KY3s*SEq z-$`Lrw*omYKQqULpPvzR4rw(VLumI*_0CM)$`tGjDGDA*e6yRkdmuLU%*^4HqLc%`e{T58Ks+`$Aw1 zoUq-R+9on^Rw?V4oA$vAu`x1Rg(*9_?S)PT_9N?8KV|I-a}4N?^@^Q-EgY=2E7pUP z8ha1bU*{7WZta(3J#)xJf&$DuQ~YMTcMTInhPb^>W}Z7O`j0-y$szZ6)2CD8-ND1* zpXQwkw$}5qQj;&YTf&E|u!nJfrm&n`&bj`A3&HN#VJ@d2kxHl2WZu1>6X^gd{$(}i zSUE zEbaHB-Yco6l^>Vz4lW2vZkGP?`!?kwQ(tem>)U4`5QTDDugs%ZI5v6 zhFGFeGEayXBK*vo56Bz;aSRaoph@Jv;Q zm27n?FN)C3U7BuYx52PUplWx|(vBo<1ers+8D0m4EzS}Y3z)mYIW}qNrV|=YkrRff_($d25ZYtCuu%a@Yd@0usQQf{B zG}*Cko7m4TOdaK7x5+-FX@;Gw7Q()EjV$L3YK4S4WT??ma|zlwOi#dCr}Lkgy&LbQYvAX4E}{bW-MzAyqFZpAgz@LI>{#mV5ma~hDml%GW85ls zMm>*s0H@|^D*bI4QG0T<=0x2+7(@P^3|u>%lk>tuaiRXqG((}sruzn=rZ4PQZ%={h zksxTY)_t!)=vy+IXj7QqsEhOP1Fdl4YOC4#e%!e2jPpPlBS5CU9h*zfpUlmjY|6cV zj3mxu{vFN8N(C|1_QJ3(Lv4b~1HgCw6sN@%bqB44^mgA6j3BHZ4joe9Luf$eU z0>Y_D1B`^%Of}5T4zz6@j}k_6SSxfE0xyacS&cuB`&OziY-WICG`C4iUoDr_%yw9K zg4;%*GrjQSO{d#R2~@zf%p293Eq;TJQ{@<;V>Qm#NSC@AZmq=bM64m zM9}1*4=KY2Qf{7>$&Z}eJTgOgVI{PRSqFfdjREx~SCg&%6!0L)Z5HeLc7W;U6fmfE zt*zSMSy!LhceE8$e}7D>pIXE2U{~GB_S{k5dBom#z2KBkeLt%dsG*`(T-Y<4R)LM* z!r9li?mnphRHZ!hGrrDl<9Mx@jPtrhB6oB}k(i99BHxSvwz3wb?j7a_pQ^nxuvS@P zPMOp?(bruA+x52_$?UCXC3M2EhB>@0W;-swf|nvqLOi!)eLQ>d^E(Dk|3a*M-_s18 zr_BFMQ6KbJpLae|IgBeTV|8sg3%otEc!J+=NQ<)D@J^Zc9vS%>7PQV-!pifU=6Ed+ z&)k3h{dYB^Lg6HGQrKyzq>Hx2VRw3tc-}WQE9lBV!Lny|7e%6ZPQcTr(8CG6;tIo; zd1wBHh~tVPDWTjHztp?nl3XLf zFMn=TwTp~1Y$YyxCQe$gA%whl4N(|Vn@HXdU zDvoR;+tPRKELIV-(=yG#tor8CIZIcWG}aOu>CRA02A&p}LL`8EFJ$>O#=Gs#QM<9M z`ng{ZA2`?ks3yw5JZf5>60E)65ZzAi=sSv#(~p%b(3)`twop*Hop8JU>sFtR5#W_d zhG#G}e4g1|inD5l!dS#(O{){&EwWsb{FFx#8ENN8nhmiS$vf3V7{ph%*U!H54Gcf6 zuihnao=i=45`KwYnG+s(2DO|v)J`QG6GNU!F?hCicR2?I$GE6=VJsE>Lc`bXCRRC# zxTgg3a#`PZ1-M`U(BYgo0y$zPKygM{;XVUn=DLTFm%>tWmS*uQ{d_w0+06F z=`ZEIP#0k;0v{bt2}2H=pD+OGFpJ#HZ>@t;+2CpKud0XzDVeGbzc4EKqnNV^ybntC z%cn=XS8E>ug6`9n56zOU95db{NvX*xZk5%k`)hrN8oB0-H>gi6*Sjjjm4hWvHG+&P zy_+)Aye0k0uP7kdY%@*9-3gJ(id=3<=%oIz3-3Cj#vV&ms_FU_c&&t9k1 zzDQ>#bz|)Z*A>HV@%^-4ZlBCYj4dDahM_Pv#vs;yIi1vkV9))U5>dP=;L*VQN(XgO zolkHCowcto?GZ^%g1_3%F*-th2tTKpgck~(c=MN%>)pp2@VHJ}>+p+j?hk~Ar_TkD z%`ZRw$3*l0LnyH<+2Y+lu>ib(EuQ~(l=%O{M*pj!|0Cqd{{;Z+e-eVDjjxw|6}s-A-eB0G&bgg3=3kj;htJA*D4kB5t~)~hR7wE290dCQ z^t5T4ryIY@y$=j7cDwT*3s8(A&)p~)X9|uNgZYw(NN+1$bh>?TbJwxQmmf+~nyud1 zeFDHd8M$6B-wgm*qV3p<`OMk8h#z$w&*dC+k*r<)y<7kRtuahHZ)b1_Wmv zDdgnACUr~=E+=iLLj3|tzE1l~AlrKZLFBPrqcqjN2hcIokRh@S!vyzM2i#ARu|}Bf zKC>@$<#?&lsxYQ4K;xNHblr)~%p-_BCHydJ!|`XPE+iRGme z92~kIq8g?=d|>WdyRFdXH}Jisy!5SAa^9%cx$|ke-H*n9d z-RIr+4TRLL-IBE|J!lL0h^gdj|DxkSy z2q(qp!G(C$R?41m$~nfj+YP#_yoo^S+qs;Zugn)WoNq5Ib>4BRHjJ)F`gO7D=Cxx* zM~A^;ZHnr_?&*wnXFxR`;!t-J`3V(-I*q{T`uG(odP?!03w@=M19gU<;uD=itxsN* zO{zb_nez-QF>g|1%nQ%NpRL22BYFVDV2eS))n|XRtJ&}Dxv!i~q<6QJIyqeM@sG!= zA*Ha?E7a?T`{z*5SsSOK2Uk%9U`0QP9wRPU3D|Ozw#EENl!)e7R~1TVCDg1 zkMCKjxxdvr62DR}G|FA+v-VunhT98($3Ib8kc(W&w z4wGXozDqWJb!-YEnKh1S_l3S41mgzY1`*(RiDj&osVJKTU+70uFf!Td)JQEdEI+&K z%m-S1)HBu-Us2apyiKoDd`kLRk@s`!JWQTm^;8R?0_KYJj&a*QXB`2Wa|eoMKru__;PqV>p`)tnK93zi)go zxm#Tf^+E)jw}}=}k2k;bK+iiitr=y%Fqm+3IR=c*f#U;YPM&0u&!7n||J&WGJ>bHM z4Q%J)BPu%b)q*nT!cJ~dq>%s2?ziv7n#F;-l8=tXoM{M<|2 zW>_NM?|#*IVg0v6lkv5-3kBTs83a&gjSt)BjD#|rOxWN9`dJD0^95O7NFlj0!Z1oQ zeSpGR_k~?Z{tXR-YaM@(fq&|`1LTO$Hqxj@KfaQ>?BkEU`Ph|AGv}6z6p4$z6S-&R zu$h`YKtlO#K@EH2>oxiU+SMJRZ;M5F7P4-}@myp&CT^b|N=!S3)QVd~Y=kPic$%qw z-%g|e>yE9;Z8M#bcLK?ys}=h$9ozWVjxUvCKYCZ?z3eHCL*gYAExfJ22r)L7J=_gU z!yOx5sC&CQV4Rscm56S5+N>3Z5cWqS(0h`+jMSIXP+5V?ZhkE;6dL+mkh}QhWYc5U z4nhTTjbRfOR_eah^YKl`8$24;iJnKoz;OM;}u*j%@_ zaR|EX({xqId6VS%ng!?OH}Oi+*_!^=!o~Zs8U7!!di(!F90t67?>8BwotIvl&B{8r z-`es$ugR*y!2^Q&`g|Mrd^OJ9j>IXCFE*$g<0RAnL2}eaXs)#k4h(F~%g8nRNp*4};xj_}4g zrEJFpKS|1ophg?TPY5i{Pb{gs#3jJxq*oxBZ~ESrHf}YZuYS&J$h8&w$D{iktomcy z_u{}e%?{zBJdmet20wzgKg0H0#~ZBx#n`V)RAIYIEndCI|0fpkhu9?CzEEAxu)%hs zth5Nf@ZNT2P>}i>dC?9ktZd4VP*RYC3cSW798B%E?yvmy?GwmjBNV)&+78(8#9k=8 z>ZA~g^mRNAo%GuGVJo?Mdo#}i5*x~Z#-e!~cN72+fV$_R#{8UK2ebS zUgoCqI8E;IhNlyH@m1TKo6>zA5=|q5p!VkRH)7&EM)Of^0XN&t3{diyLC=pEl;@9f zlhv8u!^UVdTBI&HuejI?J-NnNy-BY9Ysh8omysfv2VI~Pv!-!PpZzCU{vj&!Sz6Gq z1Gm+uor+uc$y_?tbywgId|B=L;%2Q++=H4+a@ z)hVupr-jp}9k&*yG!HFZZTmFH*(;O`t;)PTa#682X++UEa?5kQv!0w&d&5v{6*-hX z{Kj3+)#BV$hjIdem~22E{ff?&@c=!zDBJT28Hl5A7@ir*IDjh4)Gzx+s#-Aj4z=>V zfBWm5z(3+TA3JbeNLMNR{CK)50ld~Qm~6Cd$=M^XFgaEXs_E{xp;dq4fR#1RA4gY8 zq>!dCGjfCwtGc}Rxt8r;e)~-~Up(W~iE?-n?ZwpR7UgAv&3nq7>_Hn~HNBm-W)umw zlGl|upRnUi){h))G5En>$=v><_>2meemd>2xBJ7CUjyTC4x#Gm$A#nN)7O z_xTFl##O73lkj^Lc7|5jTCFsBJXrg z>toxZwJ@ZYOT%3KAWA`_pa4RCW>Z%yPkvz|ZK?@d%NW|64fYW;k)7_yPLUP(Y`GPF zk{t2WC)$`=s!9-YP~gnv{JFGg{vRIWC*M4!ZW&vm)91a%C%o2cN{(59h1=Ma;8W;fY~G&J;Sjy18GKK>;mL9-JuJPS{X_n0fp z&V(lAh!CYlsTup6D?InkAZMp_*hdmb+3it^9v4GrxD-sTh20ARY=6@Cf)>4@DYmyg zD&J2O{dSu|kR-s~SDfu9xOv`bJjpKJHvvo*98CWTeaGWK!XhebX=Xh$xXJ12%{WX`ifC~_JE!ArKa*&daM@X>ifg?cVvzB~r>`3j`u;hz=g>E3!J2B0K*hN~ zhyF+4H>zrCtY@FleU^q8PGEj)8!9dE7|1*L-}nnLI=|JnC1q1wxF6He5T6NoZsX0Ll*-{vMn-6DjRM8@o#U`gz4-L@2oMMN$zq9o>$uS#;0bS$8nyYtL}e@ zFC}5%5NS5YeksU;GtuW+tIyG$U2;6}evsAv!I4w+9v&f}5n^1r`eI&gwm@Dq_rD*Z zgSlIEc6pOZv?*>f7tL8TmnWVhbUEf=t(kW0F67CT*t4#xr8a}_e5$Q3P^O=5e6s6q zsR^6edTX@E{Z9Y=S9oRX>HXt{vxXVDo*r?KIdb?c^~;wvAa{nmTC;Dz5a`wT*!+fY zP&m5v@n!Sh<$wXC;eY(o{3RUor1NJ?U8e7>>JzDUK8=*5il_Nc1zD{!0!RH>P;9fa zDztkV@qr1UnWE-rt2a_rht2nD*!w0b-gnR3nKk#Ln*xWGXn_n6b)ZF8qkEU_+rQGj z8V<6pdv>1U-^M_1sIARe-!(L3JQ`dh!kt_40@@P%X=^g_oH#(#*xdTtm(;Vbxy(w) zDu}YJF05?ydZ6e%^fL2jeu1+n_7kT*tuf~5PDMHjGg+=K5)PfOIk<`*iLAY&;p_dr zhccW z#`pi3tjJm^uB_+#UDk`&$kpJmh&jwcB)3F!S@VdU!r^i^fcKrW{=WUK;Um6w*Q@*0(Vvx0)T{iMm6Y|q#+M|} zEwF^9JSoB#+iT%vLjDF!eOIUgzx5Upie(ySKxx#pZ4ToeRd4O9<}QH0Yf&#^=UKZx3sZ$>;Ur|HOP@(%P)^F;2zK_NHecNhhtzQXzLDW%he$pYQZl3x} zVzNcr_5k-Hi{{$Kz?Z(k8tODjz$j|WyR@hZ7b?Y~z`c`U(yE!!&?VsA65_*NvdL^$ zElUD2RV-FATF=W9HqfKOJg-_N5~cvm@HjT+Gqi4{yeG(k0bBeEZr#uQsq|Kj52QJJ z`X*zSl8ad-`et8UPQ(u!>o_2tLbWz5@x*0ysAl$*0akD(M8tCn-KGgh5J|FSF1E43 zJ)67{6YxGgr|LDN@g!(~UUAk{c9Zm21vm2Lp|qS&oyx(kYMdDZ$7qrPvW}Ofv|dxF zZ==9zQkSoQE4`qo7B0TsTF>jB=_(`HQ$VYj7onH`mE)CmLQK`8`2noD@nfl^n^P|Y z%qQn@m}Ez2rHg$3WX_J~-&FAj&*8!cvnzG}gwbDG^<~vw4r$V+KEy zA0WeCyzd9}gHI%~Y^CH7VP{vu);^HGnbzzxxjbHclqn}m9C z$IEd2WwUMdhid}de_fSpEx{;uZc-n@mH}93vKe)@U_R+V+!VLg=1H%DZKe#r163L zF$^zk)!b`qQj9Y8E#yz9qKh(w2ZzO&9~;Y;IfOi2<&CxHhAtO8DBi5q{p0YPBUit$ zq)D*(-r_`@tWvNC=8(Ab`Zrm^8bAX!D?L;d+G!_KrI+W4i8Ii5#9rQ>>9vwP{J;|2 zyH;Qsk5JOBS?SGI$7dtPAfrHtjr&UJPBW)ZJNi}i@w+NXwX&me5jxxFm>W;pQ#BhZ zx`;@f#)=gSsUFlVoWY-mtI#P=Rjg(ic=qMoACg|H^bG>Mn6gUbWtr`XsPgI`aL6h} z>#Hte{PD+`LO$S8K%_-t;`H<#rT=#2dPxz!jG|naWcIeJOBH$Rl=(u4cutT9L5Lgb zSY+kt#bJmFl1Et7GqgihyV2&=G+NYTHq0Q?Q2(AKI$p)e5xIcnyHW#DAF8w(>9D<( z9@a!j-S_^fG^a&%?cJ&Akq91uV~;@N(n7jt5ZUD#V9!&VK~F0m*J9M?vDssASL~wg z5Q*<3&*?lnFm9D1MGlwXv>n1uE!iYRj1guFd$;@{)c*`~t+7=NFj$>C*g4f+39ssz zX|BmPe~oDGb`sZ($-y!-J0BInL!E__t1J)Xn#%U61uV;4J6Di0PU3RYn}VMDd4bMp z_}P_=6X{R+YSbvbQkJsDYCrGSkOE~dI(j76b`Nq_Z^r~Z9!IrVTzxpV&^Kw znNkPnO4v6iw0va^LtcSUnUV2G&sM&#VWM}19snJwhOEB1*--r@>?xCcsqC6^E;MP` z=R(jBvET4cmcy1E_BRf(y{XOrD-WOz@p!dk8~`&2EAHyvaNPv^k!S~IYiOeeP<}&k zZj0&ItzSYnhX?ezbx_yT1iJ)K%r;dD*~b+)O4xgUZ>A@_nCc(a1zh0{1tX@4L`@R- z>0b@Yu<>&$_3XG?7=MqNRC$S7BAs(z`9V-TK*7*G=5^>{Ag^n+8zu03LY0OWmHx3e zBQ7yf54pXEF3#=%d(_)_b>sQ2{8Ph$R>!iEjRjCa%kmQRc7wv!mHIs;wyfZi#eAjqtAmM`?Q6oG-23Wz`q1Ys zRTuY$I~<8;n$xn+M`O*J?w~aPY$?@}n0oDtITHetkGIG=i5jK4E?HW#Ggn-Embx0N z%9>jr4lQF#d~auzwWrYF;-@)ZJKgUnsk804^>Pu@=J1@G?>@b;$S;l(m0)FCkzFw- zEo;@>rmC*_`+9{^@KmMwRmZM-O_84?z4>8#ac}X_-n$CmR-?+sEpLxV?BAv>^!9@J zl{u?JU(J5EMM*~GmFC`Wub<2_1^f8VH1HiTJ9hPy2i{yg%S83g;>F?18N!dEcEz-% zQy|US2UZ`X?*v`Bm3@jyAJPITSPNWk2{wy*Gi>+%1KWcC|9>+uR0EpK28u3bhJ!Y? U&lyt=&H>rw>FVdQ&MBb@0K2Kv2><{9 diff --git a/src/assets/shots/workspaces.png b/src/assets/shots/workspaces.png index 413258029af5a54617aba1bac0e0713ae0099228..941ad3856ff7cb67b4907cdfe62bc9e5e7d9c134 100644 GIT binary patch literal 53729 zcmb@uWl&sC@GeXQ4HhH>4RqW`pop{>F($0o(+(Z5=KJ6L4bmSLJ}4ECIeN}KwIt0H{kD7jlJ$+MQg-y>l7Z`wwj6Wc_e*R95JRO6%y9+~dLSf>Y^tK|=H{eO(mzv~=$iN0eO@N=a<#RFvA+5{gc`Giv-~&o=n?RE^KZ;d z@EY&mFzpO=_1_RG#19Jg-`J4rE!)2#-v&|JfAVlpULpUxJ?8lTLiAqv@}xxHu-ZWC z@bG|vs;cT^RYG-j72JRC*4j^o@_YCY(I=vdUY~9lL)9mlA=u4s3wiI%tHWoazyBTv zNgG+l*f1QQ-HEa^?R2|XEkhL^6PigIr)GFeTFs@-8*Gv(ynk?j_E)CIvC}OD<**O) z@|Rh?VNei`n6Wv~zrUKp`q5XhQ?fX*_GJRqRr%z?m5SaODxXL|v+@k#exC}ds7C1O z93{!k507crO@4NJHQa9*7xj$}b7;s|tptxXx^pL^JFLd3r>7B!?`NY0T&5s0);~19 z>2<#+j{UbF+eLxU)o|vBr3E!fN!8vF_>m)NM}e#rpdzl4ivR zlEbr`fai53b&-1;!Mf+~z7gq)00GL1K~a+qCH&jWeftiN_l2w_$vb-Kv(uWud_sxj zrd)mpWs#0{6k&SKVI_yBM(B-o1Q-df$cmaE)3E~t+7B)bobFY&AFdpalva$4j0CBX z>&c`QE=RnAlwLnH{Zl;O4c8Bkje|%vbY)d7jk+rVc*&Gey8LD1tAV#Y;pw#>FZDGt zvJ34B^Ur!#I&i!7)@_t7;}$x5tqu$~`Q03QxfKqqa4j18SWWlp-mKe7F4 zj`}&Sad~ffULjAA$H?;PF~WP2O$@66?u}N+`ld@$uZI&+Sl0hp;ZrdIX&aH5amzwl z_mnXud9fV*{9_D=woi(d^LDs+K^6RDO7o^u4NzU3h%xl_4K+6m(zE3k6OZwCsvLqk z@ms@*T}^7Qkk{_y?-a6h=G4Xy1i3zhv-oG*W5CK0pq31&*p1z`am)`|QSm5M zjEXXS;mZi5@DoyPc8c!Kyua%!*s7t*XL9_k#0aB@=xi7aN>=o+or=Xrs*lt zM)<;34PLwN;w=S5eMZC!(VdYRoGtnzF0j^JH0-;`Of&Ad>@h0tz{NSArC!D8e z7m;p*IX?I$H3_JXlS(?EsWx?GM<~6Q92pZLj6nc1B3) zdxzNmm<|L{l4N(NYU?KR?>O@&Qy!^3lV>3cW|n5uLyU)&?l3ve11Ybc>~C+g%?Z4Y zSRCd*+I${aytQw$VI|f~#(LB>p9b3r>FI317v2=1V6%9@G1dBktO`Q=6Kh$H``V8f zm{R1GQj}+@Tt{cJU%e4oTid-NqvW6xR(3SZXKc{kyzZIUmCk80B%+(E@vxBNa3ly7w|6^zEsjCR(|U&%w$zYn3er_dUN^LN4kZ9I?NXVl<@?%a)%8iEVE8RcLxIHUo)m7sh@BHLv|~A)x{OqWkW!v>IT)KyhMB7l#4<{S5G(-VKFB ztsNc5Rb}~^`LW9Y1ywN`dWR0qUV*PZeSD9Cb9|i_C5V2~{&2}7gbW#ja;JXC4cs2b zN2l`Go)k9YUP;YJst>;Z*!6F7p{%Wy#!psPt4kmXl}jejvg~Von5Y~XpR~4}7>Qb< zd_*9=AO(ETP3o?U8iu)BX&9FQvAaOYo107@y~hjb?zi%*I8aU5MYdhd6B1u)28fCK zXOv5240SNK8f=XnH|F9|nY`1TmX9~)kYJzy5j82YylzqMLZr+BIW?i7ij_?* z)Jk&BYl@XM1e2D*E2uT>nJ(FZm6@?40c%lp@`W8_$VD8Ot&cL;L`B-fFxcA^wXvxS z4s6-704kpCxNy|Q9bshsnk7L&`{Fb)>`GM4p}P>9;W<~!SAQ_>T5feoYN2nSYG<6nI3QNV`ppzdtlLf<)l`IN+C9YRrqStQ+l`SW z%AG?w>|dfp;PC-7_Y=yNvn2lW#B^%tW0FnI>OghD0op{C-c(Wc;?k0|O4bL=9vMS$ zL%N&z&<{iIUIr`ck6aX|EF+agMBc^Kjnzq6MJ1=}Ta@*|V=C(R?FB02cJ(HjxL8W` z-*q}#>Z!})%1n=nf`Nm2Rl%!L^MjP*iGz1=AU@COOAmj3&z6ynnco-yX zyvE1BT!Pv^t3C%+`NvE{U2{7H1`aN#JT1&AX?{W3-5C-ubw(!oYnP`d7pJd~je9xD zt7;Ujt1lM>pQ26lqJauSnNrr7>E(AbG&E*r8Vw~8?>m=hn)h{>e4Ffo>!?8Frc)fKv@vcMCSk5$!voO8{r&RH!_ zZ=|2cPoezST&91GFP5U|hQ<9lnk=HfhyOF7)mK~(7??CPH0U`*SED_U`BOfeJ6v{_NJBY&5eTw(|Ta*T8S=)W{q>c_j)5%y&ERCuh z?z@{-cJr%J9e&$nUQQgqN;(V7*KV*TK9-V5FsZrZ!u!7ew9t2D8!`St;Wk5ymoj{O z=YW*nueo|FPb--gmP(6HYeLWJ2sUyOI;){9t>H{BC}vOGPEZA!W-{$ZHwXhb>R=e4 z*Y|ekZuS@FeCS7gsegOkYOE?7?}{z7gn$^2&EJAAbz;N0j$#&`D0cMpXR*Z;$~6b?UgPi3zn&ZwAKu73A$7^wcne)^GTdgBHsy zkL@^ZwS`nLsm$W2O%z^?D#<_B;%s|j8vONx1XwQ#{S>3aWfd^AmwW>Y0qB5Mvi>al z&HwCl6;%sX&sozwp0T++5Y!M1;RTNmJ{>=P#|e_xjfK6d=e?&sQMqXYC>`+@4-|bK z(cH4QrXDpF=_?7|l=gabVwEa2Z<(7bM+m{>rM(7jyV`dhW~~bW0}JNfvnphS+=F^X zRB#*$SVksl=9Y@w2z?wmWy6GnbjyXAU0-TwVs6~XfYXl<7YguKjvLK}D9DxC$dtNQgB zMkPu7N6n@5l{=cR@K$%zS~o@byk?U7NA&=^`tc1d_!UPlEye7j=->f9p!?y3+s}%a z9GYYdwv7z|5JrB2qTSUjA*+Nt$!63{j$NtmpJhY2LA}7Tt2lKO*sUY^JWXdo;s}kw z+rnT}&e;fW8dG6%gHnZ^ADYFP6Yqke+h0)`)W+a8vVQ0VmDw(0vyX2LKTsZ*Hpzns z)bY8314%XoN7Rz3O>Lm&r>Cr?PM5;FwZ#pb;}5F2?K9b2Y~~J+l=44$sm=M)q+buz z)9K}INGp(|uxMZPHx(5+^@f@vIYkWOa<+R<+Z(6|#sii4A^C+W_qzJ0zw9E<9J;d# z_z^$QjUXl7P53*hZ9EMPHpI0&R>F@`IIx3u3(;waztJAwA2#CYk#};fMje5+vr`_7 z0}~mDw(=XL)r;g=%x;|68SFKiF2=MTidsWUkhUoYSFTmm?KNsm{z8~BSmzyDN+@X} zT^9iDqfGRJ>MJc}19h1+Jc+f{J3RT(x%NrLn{Uh2UO`?QQrbDzKV@g=Q8=ex)jQ<=-(yvtuNC?d2e?18MP_+QpLX?43E8oS=_fddFShT_b| zou+IW0U51Ggq^VcsA$79M}1{GYkM$0uNm?NktKricQgw#eJ=AYi-%;;JL_(BHe<4 zN>b`DWFWr7fS*ep@jJU@aNc+6wWpYzc}aNCs1~M;6_PU7jm&uk^;!HcT|pagaf6b; zZ&UHmw0m&v#-f16dd@F4kwG0pm2gXVWFkGeXTL?+2-oz2g5@K-90IGef4L~ABQGr* z+P!pQAFn2C&t8AuU<$kA`K7dsyfAHuHCH4<-DzsDMbA? zeHWKz1&x|QEpeahWBbW{gzM60>g=s>J3-8Xs(lkZ#`T3}oIj59G9~qVFy~l=IL#=} za4J=)(5vRT22?X@5~`R5_|*1l412?Kbg{Azs6E|1iT$lUtGjFlx1G|U6w#lGdM7uf zzad9m`_~5RP}2>mc3=K3j0u#6GVSPm3#5?2s#e%ZIaq_x;fL~&5^vUnb4p+VD&@I# z5&4O2#9^*RdMLQwQ(R-lZ<4{_;RVCxB$tKxJKV@T7x{EBF_I9~h{7qK> z{*Oo@oyEz&ljcg>{dMt{8T$(Nuowz-vq^e|SEXs{t z?7>GgjO8V>6J5U!6I$=0o$fQq$YH(xnZmMTs_O>>g8Pn(cAf4&)O5`y^-mRZrY04* zUgU-aE~S*2bo%z8%u**A8n`+rX~ejRbCx8R*4apW?Qzh;??Yo=HcJqgdm3oHV>x>0(rl1N48?4fw_TS2HuS-)Hc2^N~zC`rMY^pU{dNH2>3{R z;sbwK#MQ$itz^!DS1E315z$j2zo;V@eZfY}rRh*z_beOYH;Q=n(Qv2s&<#b;c5CPw zlL0hcz1;p|eOHMTrkKOFK}I5&-Cj{>fC#Ih;Rr^vucAhf%HnW={J~_UVC!HsFVObm zUS5*gWTdR7qNQveqL=>#NSxM?NnUWYqdxn*W2L5dCs0%u_;j`leK8}{g2m`QO)-Cz zgV|O5NPn!*V$B+KtJ?Df-EPBkSDc*`1 zO-Ai@!Y8tcz4a|xLw9|<-1f>g|Cax%bTRh1;nAF@kby|IzF{B&xA>mhfMkhh*~u(1 z(y?+If}CaChrc%%LPh=gr%Q+5b6G+*RemJ`+%@w;G6lsF!8*8(`|%>8wDnohb^98x z;CzGYSaDgWs|gh)C*?Rf=SY*);ijTd`1@WqjEfY$NJGiryoism0}k1P_TysxxhkxI z@_g+woZ?R-mX2~eW|-dL=t=u^_{p_mpUm+K&Gn^zGp-?r>6R=DHBu{ELYvznO!Omv z>x=;iaPcBUxFj7R{$O17oo?u2TtLvQg|srS{r5#{JDQ%7xzqW$Me%s#Q{`%tK}I?t zaU5~1S%@Z=Z!Yy$QlqMbI=zGaFyhWP3y4(O4ZehTB+h3?1Gp%w&_fz-U-Sm4VZou2 zlhvzDBGYSyk49>_$TP&wivPY26d&Q3@&7@aK8OcYDoJ8DKT0I%+ z9^Xy)wy9iM-UA$rO{4U|3USqS{qtTr-B88Z2++I#=-gG>dj9gw%u>qd`~=p$X@-`R zN6B~v9WxC#=k56B0N&AeTD-gL$dkKkZ_rw`p+RJShNa7OuN14Cc2T&?Mu0 zOFEBI_0$e|FU8xtsYW_sqWromD^t*Rg>%P!Eny?c1b}Y3HcU<*nS)LlScM%hG>@bG z1)?6*BkE?x=fFjTn5*9_=A?QQ3ihZ>A)4BmCGqi5^TXoUIdF zy0W{!YQ{r8$UcK*6)8-emdK+b{IZLS@fk@xxG-_Lk({rk2ssp6Y!nwrRT8`LF<5*7 zBMUN$#J3bzO9e%ch{+yT0}XZ(QmX8)7E4v-u!n*{Ee~#f;cSo=>yBKja^pT2qT08Z zz}dd1}herhlle&8|;Ii8$!*?qqqauSRfgBBjZ#3!7*~WkiZb0ak5g&%hpmN zDOTT#z;&B-HJbaGX}A&5L#=XF{ezXuGKM0WfxDDC*AWK7JgwduRz0z|dn^bVF-JM` z&raF-=lAH{UCYPA{lu3z?kZo>u8#p-%jXN-6+RQjuNV}gXTv0ct1LC2HWYRVKWn&* ziqKs&RPKBL?uOVh+|Xx|`2(GlFD>M4+{+27+B(;8U%VwJf_TWhP1BGl{IfUp0+r@< zs&tfAX#em;Z2*!L?!3(1k#sa8ZsR;UxCEHxUbs6qr}g0iw|~Rqzp_acheJ!Bc{p&^ z$=MMr`i1xGjB)$QJ@>Tb7c&|c)!Uxay0#5?5;({OpHDqu>oXCNb!ZwnQMNjnjH5hL z)oX&Dy%P5AljxzcidD6Q@g=wG^BUW<Lme{7P>`JT{@i5v-@9;r0kI6% zHZ_|eG*{m;wbFSP%C9EogVSr<^6j2tSmp2yeY5wVVUSX2fb_kNnLqj9Fdjif#^c28)c&T{L zJHSy~P=KQN91WW_(!^Xxh&CA$J^{iWKYr=2K9dOdsvZ+=a<{{C+j)zd8bRhNVixl0?AyoynjTMlhF)o+9g=m1fbJyRI6#Yj z-p;c*zS^C4>w{o)Nri^9L)crft6 zUuQ*)vwd$5=EA~4m{p)y{}tp+P5y)n%w+Qga}w_E7{kf3f^<)sV#mwz8UDghX4%3Q z0eyr>4wJWLJM!IsB3h;1{eRWkqLc;}XY zFl5|EOOr#s_Zs`^J}$qod!RPuc;hrdwv$ff_1bXgRfALUH_QE@`qA?(Da}p;wF6}PGp?tUQ3w`IvEAnD zvtiW$g}evjmC=O=z+$I;`({KU7a}h7YsvzC+p3rC$;yn%>cSXnjO7M5m{*hcrO}h! zph77NE81x)l`vG*7+f0F!$a^ph5j<~Xb&!`#@4Idcy(S-l=o8>x1#$k0k7bExkXG* zw5=}xkJ@-;={S6h@A=XxaBgFKFN*Up&m1>YRqb*wliWNXBf0QCnTLdxkzO|nq#TFN zyh$NK5hsm$25jHc)poBmIR$Z%VBD$f)F@Q-eEiWdA-J;jkYRCkr$*-nusZ#2wUv*s zm62%ox_yhZA%Oq#9j20D-hDQ|d4@DCX25a%QK1C&fTAxI&Io1zu$DL?l?rVd?XwJR z+jx#^!t~B$6OTjFoqWe0%6WG3@^p@9g5$cYbClq%$td=td?fe>4y)CsXYJEPPRsY< zfJlD5XbS|&&1Kyt9?*DG`R;j!fKmmnxdxBRlS}$q(mZ-;%TCv3>T|v?_NIXu4F!D2 z;9YjVYdh}qU3lT`p3F?BoS;F78#TQkbQ-a4FMOsMaoF*ojqU(7%@e%{^J6I4a8HRY7;~+-V`;af2IJDF+Lqn!n7AW z_mnm~N+_$=vE^7=-E;rwSZ~|vu1#ghITY79lvlEjauk<%h+(a6jEU~)H;(;D`J5cr zaV`4uY4F`5Ug7X0Ld&zY`(Wo%To%yGenO7|Gy{*YvJf$UyE()1-U6e!n4yo@o=iywZSPm&knIj#lZm_lsB7!auq%!7Q&-zILoy4EnleY zg{_@sy(wmiJ{cxe_+0xP9}_Kw9Eda8_h#o{h)NuRxu>f$DiN)?45d3=`XB99Pg@$qb_i44}MUUlrZLGWoYvg){A2zK?%y;&<{#lglYQ+Z5GNbmt> z;39>*a@Vw3#w#rpC*%IE*Ux%lF(Iv%ctIV+h0Vj`9OJRwiGc}KZCJyT>DD*zMqwb2 zHad_je80GhZZv*8EE-EKEG#Je?JiNzy>Z8Kr;xP|GxD5rW)n!&YJ?8{RDD;TC>^-u z1+aJ|w{F7bCCOA?aIZZk%!p}qu`#X(*C8eH-0LGtYtD{=5hpU-5~UH6$i4{+e}mxW zp7`@BrjOcGmW*!1Qsr)vf5RF4^|9-xsA^m+GeCBH`GArq2|fL}st2X24cACAT&gdU(oLS8TTS>hii06-$ZLpM!nr zXd>8*Tlh|m^_P;U2w8)cmyusj1?OEixHRO*cv=Z5OV$a_JKe%idjoy-puhbT=|yw9 zYMDX}%k|F(mavV0*N>k+_))7d>rR-^p|q?V>3-eF)34}qAt){(mVWb_mB3gWo*jjV zwd9uOTFZH4w3K``|2}MZ^nE{0byqy-OJK>9|M7fQ_==$#zc7j=Tz=J8sY=$PrrJeO zn0-_<*}dqi!8_)y98%fru5jXrL}eFMD&!sbN2Ba`AT=*%CWOmw{#Xn6Sc7B`w>yc+ zauw(z<&S)1UYys<%x~W;aJ-|0P$}otw+shjEBY7}6Q7Qa^WW;Yd`}y!Y{JZUxKdjk| zhH?Q$mNA}4g!20)x&sh)^M*;cR!R$K#C2IIUKVj)CcM%!t3gC5C{; z7#$=w75f9fh412Q?ITVc5<{LSdy0m7VO}XUhtl*I5Z<0v0PeZW*xW0RUbl0>XK2BX z%O|}$DAQ{tQeG37pyqU9#X0ygbD|MmzJz z^1!VOG?rKd=m8^^YQf%6r7~`(Hw_G;7cG7VV66*2u_JCgddlGwnL{0B!%AYYz$04Z`#o!e)xj4T*a6`eA7>g4^f- zdMLu@*Xe(Un8MI5m5Lgw)i<|pCi-rNjPVexA=zN+6`;G@_@no(m>LPwaUW=H#qd=A*Yt|GtQMcqKris2*VX8USSj>;&GKz%l*3j@PeWM zeuu?`@@Pz>b(}Ipd8TNf@`;aKFEh&YrnunOz9(*Z!DOcZYxJb@=sh&;*@msjd&+7* zdEPSqm0u>L3lCSnOmF(^+Dn4{$kPRMIZLA#Sb2i|%s)BQ=?=6Mr?f|QYB&R*#DA8L2 z;w?96Y08sYV?Vpkza^~7es8+reuYH#xGy<@OYilDK;mawOrW`C@sQ|A`fC#PHySkj z1JKpYYK(tg2=yTT9SPZy{#iYiYjVZ^@|8V^xZMu^FCnzcs>>aWKV#Z_i+fo89*?p9 zGu6$*op^VL@%x+lSIF1iNxs(bTy|MV=gSH4)+hyY%c@gv2ykKOO!341Navyym>W8r zFn)~_1VM__oZuv8J0HOsd8bwDevwkdgk^lN58`lgcAA=v&^kn&=5fN>%>J8%6CT1K zSrSeJX6@zyKA6wjeRU<1v|Tgo>Ojd6Cg8rY3}XDtgDpwdt%^sfT3hdS(QGo=*Q)iwwm*p^ z)vcD7o%u_dnjr9pML?qt4%Y!LfVH{iGl0d;A#gkrUVRDutY5epF>e;FGg3F&VFy23 zR7zQZI>ZPlX)PGl^qJV$&(hj44c*(nVnc~wJf47Oe)3;S#3kyqz;U+}qhU!34BJzz zON-E#9351%><`y`N&`AUJIC3N&?sN za@T&7pe}m!e*MM|2R#GzM`|#4T!fnFoO-NLnFXL^jw2iq0bgRmz`%Sk`6g{7s0+r#*FlQj%(AsNFtJOWI*=4FjYw3 zkqYG%i4pGgJB^*6pBw&>k5SkE%^e`FKvb<|5s8a$ z;^ARvcRr)$ENWb2B5f+$Mbe(g@F7M!`Hoe?m`_UcRFvOZ8bujSqy)`|0laIh%|?G7 z+p~xKH5RC}n@igW+48JqpZPsW0ZGYURCH5;2cix#$(zyd^sPyHYt3D4Mta2o+1rW~ zxt#vAKQ<@ua$FWaP8gXwoIu%VJ8On4`EWY9r-g--r^EM7CkvDoqvjvCe*Kd{kZ0mf zh5j_48^_DNKP!?5E?(*_MkMUjt=h)c>1EBrU33mTuQeqv?I;!{gonmF7m>(y8a~&b z{M+OJ#b>d<2Zx;KIja9`S6*4HBuzqIl_#gu7ty!%g^8A7EyHKb7DF!GV-1}1D@KT76M(Y`GlO{L&7^uh zwyTh??7J;1Lr!^jC(zu42~B|o7Dz7NCjaY#E^}T?)zl1T%D>Ctg07wod9UuOs}yt% z&}BrtY*32xLQorvu2oORwsv%PU)nh1kMQcz$0@Hv9{lWDw4i>2_2Y0!X|K$*IE*HF zYNy+e%$_<#2r!nrf-0JS3k`#K$zmkhQN!(G^9^AO2hZg=hfoxMb-VF<4P6+-O_|MS zgy29q{=rCxBXyA@0p{TpaA{tJKk2{5Pde=skiT*j(?%C|Jx|LEZj(zh9*Wdpp)V!{UN85Qr@c_tq$V|{&5A> zr_mdDvX+Ggtwh5JbEay-<}Z%nyN-v67R8P(KpoOfmwwZ&hIF6yWY*DHdb8Q0aFpeF z*O+bYfl03(djibwmiE&Rdb$EFQk9q1%@G9E-XM#(&MpSqW%7ly5R11U)EaM#{f#Yu zPKQhE`X*6YOa!>2YfEf=j`s*zkQ`EosnDV)e^1FqGj=?gJS9ELZ}9SRIfp3P*f8xe z6ojXO?pM+`R|YA6PEEQ$R{5Qo?liHdm(`hGToW$4xlH_S6gpM7WxtpxOu^3~78Q?V zJ(_n9y%nZLZftJxC8u-WYcO4BXR%K41K#Mv=hHR$+5PRJ@&I|Jl(diYi;J6F=3(W5 zCU8Su$YX8;v;4_Y!f2j8-^nrZd*_|6IFdUrkXc~WsJjeay@j#NEg|3LwB+{tze3B{ zjWb!B6>KNpNs3F31mbDE-9b#v%$p(LKlMX7erm>Bl`)y9i-qT+`3Sj$;4%ul(U@4w z)5-7nx5?VP5B5H1o?2W;fHFZP;v$5o>ak__xbOce!vprE|DEe2^5Uj*@uirG-6InA z9*Kgig6DMg#4FRKoqr}t(32UL@md<4yCL)fRjNLX^~5^+B{_C}Bak|BZ1D|K9P?kZ z4-^3&Bb z4T=Cz^KzQz+WLvSiz^O}iTXN6TaHUrN<7-VF** zO`V@!pZZ|)n2u@fl>Tkd*@Ys0=|VzP2%u+zPT`vxL<{Qpv;4fD@BeQPBsjcanTUrV zrIF1u@xfvjS3DQQ+Wvj&Z%rRle6$MOf!SKgSMrNjExtn9{u(c8e+b^;RYLh%{($KhHI10+IK$MKH`nL z0hHHPzBI>v$t$?yIeXj52U=D`zq+yu5E4+jSlO%%n%BZxbUT8qOl^2Rrn>Qd-yXa^ z);Ri9I#*4}QGR(X|3+RowM~yGG$+eIqKIq=IYW)Bp056RD`h3oaowWbZvU+E@X4ZO z?PQIyYLFX44_j0X`NJs{N!QZCTB4U7@hB@7%{f#~NOIPjbfj;K}m_ z7WghjTyCO*PQAssyzKIZcVtO4i!m!p@4ZK^h>gv~LaDtp{G}T6O~^|z$I@;a`qs(q zBwH`>1o8WZ?+p04i_`USN)s@J?;uJ znqSPr<(~6krzYt_-Gt5djinRvZ#t&?&v5fVexKcp=E6);=G+Y#r!Z@fI7p8-YowwLCovFWLe64Rl5V%%5Qo-|zZbYpxaFZHB} z#VTv(GzLSRiFC98eIBc6BOX@J93dt~{{$RyOEO8#$XD;`3$gwGPOj@J zesg|{bx1*YFyy!8PW z*(0}ypW>Z#^`hm~WTcQYLsIe8FV{fcIb3DomgN)0Ra~>7G()n7b(e4a<_~9%i)4v=9rU1Y;;q@ ztf+aQZNfY%XAP0Y%9zbBkgBPBw2yLu^q~$`y=R%a_C8=LSjzB?@41A$xL}}^iGd-& z9xR5FOglo-ys^)+^_s+-_Sy_R8E6&qQi|mS5Bp%%SbtSjg`5@R@|I>ISzV+M93B~4 zotS9a5)sF;(PEz%iZ??m2dB7eZbt*$?3$0vZKE%0rm`{8{l9_2VO?K}>MN5f2NKVSKI|XMD74A2nu``={(o8>{hHVC(n|cz5 z)_nPaHySPrP;aVWFDMY9v4Ftv<4ejN6zjD2ZsNK~OdGlmeA9zRlgh%(5h8@4K~}IL z2GE|z5gCaVX`%^!o1HC}Qw>x)*;1fOzU26sA*ywVH%67DO^bfZ zR+^#Pnf$fI96(9pix<$B^_y07^FV3lVYhhE7*v>q^c%bvH(`Wr5G!b2A2qS^iz2F@ z@SK*?tQ4Wu08R!+%?ao7xwYd9%mdUMB zi6o~5)s=JL6INC?390%o)PzueN(}m@#UB=TiPP!eqbiv&BkKv}(h@&nGMeOkbGr51$32`I^` z%;M2~$r>yAm_~HW8dwJYoC!Wiw5x3uhI@@S_O9o)#gdCf_c>iF@8e6YT~Yiq=0f7d zGLEmOrh&~l=hw<}Y~1ilUZUZKtr}>rq)oSIftd}#>YYK*~s;X-HUWy3ZUUq$BP|T6yK0-6r-)8Fnb@*&!zNG!Q zXd%M}h}7(aqF~g2*7Z4` z84tXJzOrZa{l|t1qoh&2!84xR6KGBf{X(*N+R-#;y|pCq6dwMG&;(0Zke^>4dNfR+ zK+J{;*PrD#$Z!n2Vs2|^1U!B^9Ckq?LECbpBfO=hOm?noQJH;lqy!8T&tRJ6m?}&6&z;NQ=`5vOJ~=BBK_i_hV<4iWpR+|OD%wZGS<$l0 z>%)OlZUgfwu7H#}Kl&wo*G$#E?X^0Ni|rsn3}6Nu0X;SmP4%_v7MT zlPH8?ZZ_UBV$<_xhZXZQc4L68gaB3$H_0NmwMH40H>b_=T=V^g!4WE&xaRlMV0e4T zH?du2VnsV=$G#kEoCBxUHWK&Z3y-N>dD-s&p>;9W0Y*i+=V3trn-mMvhY^6i|L%2) z`_Mi3w!Zei2sTNV)|xT^t{_gAov~hvFQb-dh1kOHnW4-A1pE*nQ%uyANU|sR95ITj z*AC;;=P&RZJL)mNt|tOLm(}d~tGL?13$&bkoIvyoO*oEuHVQpwSaee06FV%piyzp+ z6=>49h|I9J1o$nL!d-DEHL6Y9XE=+v0S$2TU(~O{?I@urox}@f`hI@`E3L&N{)-4D zww_M1!X;<$-J|VDQC_q|Dq~&xfokf68COinh4KPzt<_w^;(Lw;m9}$#s4e13T68D; z+CW;o;o6V2G#%pDWihjx1i@jV)Td1j+(C;H>KXQR;hHQ~hvLVy0w9SeZa`RRaq-rR z?Y|Vjkjj48Ril98c9=pTvsUjG5008O%^0om41RKsGyt%Mr+HwZMBWQZ16isWEe~LY7xxb zYhq}>N$EP%724muq@tv4mG;<3(frJCoz%)$e^oxb2{a*HnO~n>KyO$)(489!46M^Y z=ClNUOWRLhAdpIYW54^2Vd3)2bneBmgG^;8@TiJz;l+_!rFUSbN*|eH-7?5dDJlM% z#i78uH4HE$Pk__#<60PZQeey6ad`VXm-lFyoP_FqIT0K$*HJm6B!9AxL9wef#+Qu3vU-&lV=X)QoYn!Ee~AJy7gL z9@Lm(>XP7=q7Bp4s?_?+0Vqx9@#vQx&DW5OF<6N@&!7*mk)V+Ku#(?6+{5LnUqc}w zF){Zo1RP(uzRtXPWkvTM>NfVa_Db*%(Xa|XM&=+pJ~4q1kH+^~{_l$b-t0dZpSJc= zTK{+bK2Ps~WBP6ql)ONZp%=7_ zNXY8{M+hJ6OPfdD+8)Q{M05putDY_%EEiE;?B^@5CS`@|j76Eh@5MJ{0RYfFayv%j zV>Pev_?<U(WaKdDNw;4WUsF{vNS`c zOd_52{y^9l?O$^sSx(Ii!nH-gmP-89;cnjK_|th#;tSW{t@NiW7YfRD%E%)Vn@N5( zz~_H%`84MJQ@Tgbf$iJgqFcoMos#c#uU}5H*=&>i`#NqXFU6WHfGy5yUyGt7)KjtZ z0Se;Z=LnEqilYBS{QvzA!d`fasO007^0`&{w+TT4UE<90jn_gU&hh`AgSzx22wBZ5 zDS29b{#=5A<&YdQz^B)!DK9{PB)W}d(cFBH6#VbEZLI=fLYA9b$(in?qy%H*dj)tu z`Oi8)nnU+gr3YW}THUzVXUIQayD1Uxi(ZWmdh<4LIUgL)O|5rLb|$Cjr`Y4=n2X-rrXt3x*dK(xib)YrI76DBUU3kV zAl%{BSz5wuWK?*CI-T^3#RcHg%0qe^w8T2-*+(f|0_T1ZwUVb^F%aBL#ji!UwZ~0# zSb2*_DOf*y83u4e(>izd9Y|$~_x*vKw(rt#Ve1e+Bf$9?WqcB1;C?pVVl&|3tFEYWezO|S z0Dnd!ulj2?Vxzk9h5P5yV#!;l=iJhH)BwuEPq7-U%g?^d>_24IZ$>+KY2xS@v2SkGr)yTMfE0akb{k?+N+E2j%gLSA zkLO{9t!zv`w7X0MY=Q8$8X67h5$O@x8@qe$biBERVimUki?z3oYHRKKwQJB8Ybj8Q z7cZJ3#id1yrnp0KCq;rwTilCVf#MFuCAhl=4I#J$m*DbcKYQ=@edImg8Rv|X|6pW5 zR@Tb8@637qt_iN<7@vISLdxqnx7gw{!kV#+FI8Hp?iWruj_9559hTaUU%2BhtDP$K7#RDgM$#}cI89#gg0(5P*-XoU^9+>K@DDBzeR|%fBe!gg zJmNCKS1O}_4$!aHzaXPxKKQ)4X?3DwCnIzB!bn(wr13{zQP}`4137LY*e6o=MvK6@OE;=iKS$Tf~`M(2$%;g3qhg zt9M%~p(xDCU+?DY&>YOJHjIdq;^}_?qp0<-;G8~2moMUEG+xrTc%wkHa=~_=0v{$3 z{B;d&ssL5LicdQne9lVebaW^^b0I6n!PXR*>1`Pp9E}sY3PIMh!y85Q^Z}qDK!Th} zz`E+Sm^VnqY1=;C##5S?{W=s^6mom^ZtX2r)`k=yoTMrCBm3P+7h}rVMdzRun;&!h zW%{an(@#5N3C7755W;KHamb|&su=wfoPo&i&x+8wt8IJ-vbHVgG}l9DH&LIbDUnL; zK0ATaNdI-)O5Q)e2>H9m`Rg?hBUfbTmL%rvhWt9vJ}6*&j4(nb?YV-8(D`14yW4nuN8*OtrmGYKX47l|rfTWRJ^rDPZ76`+9;?5?;BN}{Fh3*ncC9a zy6D>_PDOR90JvYnz_v7Dz6mVDg`%R?hWgZ!kdj~kQ>>1EqHg54E1aui@0{RmV-@tA zqXusKGcnV8YS>@$IqTT3zu4{YvM_il$)+7AoeURRDoRO=YuVp4nX&QJp9~DOh_*~^ z6HU`nv3a88_^C(S1B&%GEhIR%8Uk+0?p`5ob{g{bpSB;^_S`oI%;`*4o~H%rq8IB`Q7JqrPqR9OpiW8guok@t0U#M#Dy4# zbPu9)N=wI@9@G4JG5)&9R2h!RBc5!SCNBwMm_UbA)FFQ)P@p5b~evC#cqL>otE;}J~_n}_uj|Dr)5#X)3#*R0JnVoj+$rp50*@zzf0v4CXE-mlQ zz_q&*P2_9}eJyeCHO0I5&~RQ0#&jR;7`hh(`QG&8UX@0|6?|L`rZS=$8a@Q?_LG!W z1e-($(hnenOpk)2o<8oNK=sCK`P6TmF{D|ziMq$b?}m7?g>8Fkrw#GOb%3$Xj- zr1z`;D(G*z#O2j+w)FQ-&IO&=mFp?RQot@uQJcNb$;8LyD8*SCHmI3T=?VaSGZnig zW(5)-xWFfrwRD~S3L3WgY_cJ8B0n{lGqnUR!|+m8XQCG@z3C6@J3MMu6BSa3R~iRJxwZ{WcS$>zD^|)qr7fzS>(%U*LC4F}rPXVxQy9xj0Blgrzt{fK&c}DQwiRQg~ zciL)NN-5{wOVnu$+0yPsKN%M)G$`(jjSqW>mbT6wo|+PuiMXr3wxqk`6cXHK`sVFK zYWu|HwHuxLF;DqDV0}X|Y9KRm(rxh4B-?KN)>gDwzjgVh%ILf!fX@VM3Oq^CZI6P& z5Bprw^qC6&DCC<1sqWBaiQb2w2&p2%n>ctlXD})J(tc=|NJ!E@ZCZc}1)n4~$KmE} zlcVCUjeI{4uu{JH=yYcUf&N+K-x7|@B7z@%BJwcmWl>&M4rP;;WOw3bRfr6h3n{Ne zf00v(pb3@}Qfy3+46MkJdB_5Be~XFFGY zrR%#Jb^yM=6tLBf;_qN@dOr%yuP;aKax|FrnXypo5=g70jXctAz6WCVvC z4Wz>IY|VAFqnuY)m%=jTz$W*m$9&p1?^(Gpwb-KM>pB=8KgPs+$M6hH*-)$x(paRd zzIf&$3xR%Nx7)C{JKzLx9la&|zOxEgsX!-(NY=ij2FkfD+M_MJ}ZMRFbcwHF$%o1$8RzLBppCAwGBlMW9`=M8V-O#-xFAPrFXDThH0beDf?DLMgy6phKpF}+I z5+jL@Vq(3{=^GJ4Lar9R3HEx1M;g{OcQZB54Uba12g;g+Cikv0j7=NtjMv$94yT^H zq)yEtK)u6X^(Ma1(mf(MY~>(;oA_-mv|QA?c``Q`_H!q{vz zSaHhyGTCy$=!sBL`FgzjA66Lho1b<`P{esSNHS@OZPaFMe9@7XdNTp!G;0wYh+rt| zML_OMWYd0V9zWRkZc~okP#X=z)9}WQK^Fi-8+dbmod@8L40$;GAVy)tGOG*3()Yf3 zqn=oQ8IEgPzv-2yDW`^6s-2o&>U@tP(<(d%Cv^@>r;pCH=_xjB=>@1Q*5855Ghi4v<6< z#3Gp1)U>vDaYW&vu~#yOX_*l;&hG6izRNKrET zRh#l>fzlHi>FLjv7W(x3<15>R=OQA1#7HGOE((ZJ_OaTYMQ_oiIyvhG46PoxXdi!} zAXgZEIqiI|J>Az_lS+Youc0iSiY&FYmQr|v?PerGXN^ck=PWzrJfIY(#`NP+Bx9F% z(eaoNPpY9X*EPJ4hubueU&MJJie}{b(c5gvtD02Sv!9J_Q90ZIw~pGUVL>(Gf<(&x zY~M@%s1y*P-U&*e64!;>%v28O>|N~;6`&j(jrYU?>=6GqG-}G!+qEG zPi68)PoAiV{A>|I9LMYf-MG^ix4jM`|xTl)hokeN6 zFr0R5va0t6>I4J>8B>RuQX0-Xs*8~EWdO4J_2cIV!|r~u1w7ysDz(~(=EC-_<^tQ~ z3a@xc8G?><%bEF?p@bbRR!*z2P1Z$0WCIMT*+nJ6YU-j^J%LlC4uzBM~%^56Y48QZVo65uXg`i*IP(wHtsvZmL5j3E$5H;!CnKYqKanJN{mf@~Aw3M^Bp&!mcF(jZHryp7ilB^!z;YD6L>lLM@No zS=!1yD#%Wx7ob@!h^mi^Ix+P;%@LrL21$3TRGxpWvT)I@Svq%dxp|7;SrMZ!ImS1B6#=c5U8_Z9oTtVXO9IK*p|o0V#BWjhaJsNMeE*{jwVto7*4 z9PLAwMcG#qxMwk$1iMg@Taa;?&*##Bw^k07WxWLe0A?Xp;(s^(X57ah3T;+a7SnqT zp8}1-J=--ZR%$wbw1TM%-^<%tx+}(_P^w(H4TA5ZeAKey6VfP4yep)P7;;a6(%wjGmq<7GPwKehLG z>^f)y?_(jcojyR4&$6SHIYcAVb+&18+8^0Xc|;x$-0;^p`ERyseam?~5{lNEWFFbYdgp3Jpq3(D=E)Y%5f-t}vIc@VH5$e3U0B`Emvo>RJR#;ZkMIPHHCsWiTRDg{k2=nG#_gtDiI$*C~V9aZ#6YGHTT==Aq5WWP)Sh zQvi2+vZ0ZDbvJa@u=TJ~x#0U3C_O1Odlx98uc-nIa}{ZxxT$jy96Foo?+6)d6@5vS z!b~XBrHl#sAn_b5E9p-HS>|G)Z3s``v1nhDHeN|AvaK4>{$@zJ|e*$isqP|;7^ zA4;j=+HFvs0zYlIyky8;N+>?oIVuQ!@2?Xv9wg>7+*qFOSb#Uy8(LJnzSF>St+v5i zFV76)zm1Cv9L|Bxk5^MV8!i0q<}&SEi2iwr2sWgho*%xO(jW9s~)Fe;r=N`58g4t z5oM7Yj^6U`SK=0MZm2m*R|xhAAwsh0Zs=9<5=N_!lljCLKy(fA*p83{#%2+ERW&U5 zu&jngxBW4>$frnMxlF93CYLWA9(bzM!zRkTk&i20mVGjF^rWSmLFkVlIwIsrd=@n$ zzU*jbiolih6mmT%1@*d;szDt+`rX-M>WNMkUcAGtlh!^eqHx_E7=u93GAZ;bHkl${ zj^l7P?3X0M!|@e3Cy6+DQvzW*+`q~nvV2}<-0KH+$<2ozo!Q9|*JIdenrNk;S=(IS z8prP|6VnG}elYofLOd97RP63%q@Q8Kt5#3ZEC;Y7m|YK_K?Ci&W)p3L1KAeRY@%BP z(?H0xQ=XO&Cz-1#w@82#ylAz$-NC;A@rg?y1NT)wmjaubGt9zIk&EmPnsl2CO_Ksc zhsvUZtVZ-R`PmOu^ypluYRC1eTU3)K#(KI6VucMV=rOWNNU*nhp*u-ytl=`;+=&%6?@w3=%01H7wL}K2c*15g?(>u&R9C&m zu;fr4NzM)oUf;XdOG6`rXaa`Yw&%kkY8;ulOSwp96`vIwk?`8jjiE=sI_D;pTh14f zMQ!Lwcq*q#k|veoQ+;>a3>;aSY}x4R`CqUAtxw@x&{omJ#7{kX$Q)8c#-~p$`j>El z=MB2lAYu!Pg!E4!!W^Ueu3w`;>Il@KmoNuOjU>VMD$0H>b> zPIm$iTg5YV_%P2u-4PeTnM(?Pj1S7=?$M3n6o_`6?!PjXq%qnuy8J?MPWFPykfi2z zZ2J`{cXb%Rf=#|OKY`~dSG0OJHW34>#=a84{QmH-sHvxt+*v$e+Wtkc0q^k;zs*f< zOjH5w%jbL1YV12#Y7#eYn-%U&I^Q1Cg5IL=;MJcDRAVK*_BnM4ci2WEWQxC}-rT;h zrnOXDF7z!li2jzea!zs!eH`A%V0t|4huxUd#$~47l?!Q7(CdlTF!4-!bCPmrm-rOl zq*J=f^nk|mv1$R!279ul^{~vSo`mYXRK1IBLqq}QDt7(sW>^fP@0w2Z zw%#Qd(4_kyCDu%nO;@=S-lVsnL&LEui{MR4-JAUhhZn~fd5Wo6u5p0SLsD z<=2k)z(8BGPk(h4bctN&tE!(U&H5{5e~x zh0qSF9I_D@`vMV{0l&O>E{~(0)$(_V}5zox;>&KqbA~s{$XE5 z0<1Zu5R1CIIQ~gUDaSw}G)`^6#I}qV$ypKxHhp238djxqx}w;isi(l)Wn`aPiXZ1M z#P=r^K>>m*6QAXf9kR;wAFj^4h$x}h$Ka)e!~jDtnZ3*JgUsa020EhK3mQ?%AbVj3{2Rw5?#UH5NW!yp*EPLEwzs^ z6NTs#^tKpSbsqNBzX-1NkNQ=m+Fw=Ea3!;F6!<<%h4>dCI*#Bw-tXB)F{%gEYUKREd`S6(E z`75fjtK#80`tF$`7Lr$;f*wp3sXt|m+OSW|@~G%ydXD#WjT(Sm`PM3DJi1<{+2fe} zLvvLVEI{GHRXv8Ow5gB|H!&Y=OEaQ@k-cFQP|{xZ`jUIO*1~3cKOz@M>(ax>((%a2 z>k^KHrx>v3G$Sf+uJv41=iA!tEAD0oY0X1(bQv+--s(|I&p3`T_ElnRaQcLY!$_=u zyB0v~YtJyg_Pl3jgEx83+D#fK=UhcUL3#!Iw4_>%^K>!1dL%Wp1a^5Oq=)DaP_tVS zVe9>vXpc^-rn$#pRPG4q<9vFeY=oG#_jd=qdh0#5eyIBE8<$&}RX|YVx~}Yayh2|t z{x{o&YRX22v%_CRn;e(}W5Z#Jj5eiNMIW5)GCGyoh&Ah6=a@E#Nat`#KmWP}zv=Ai zdFE4J^6irEg<7y}YRa7F?58K}X+vx;UY4;aH>WVutySZ8ffvGPz-vyg`vplI8`~V4 zc_TAKlOy7;KyDkK>DVLNDp3K0ZD(&ISmg$Fk}{Wv1jhEmlJ{ zfM|oWpEG7zh0m3#i)lMUuv~)tjoQi0N{fm}Yo`QU71T8t;+{$xkBk zw);wzwX~-eEL3kG03GXr%8P{KVd4l+!}HY6#s{XIWyf&28f=CS=vh} zD`#$<1hMZKi$QK8O2tvj0(SIPr;wE1MfWn>JA3`~>FAY$jzvZ6b*bX36I>)K$$?l$ zQ*4uwWsj$T(?hRI+^DMEuFb0~63&9svQ_8Wrh;b0w$G$vL5b;%hJucEK3H2YcZ||w zEV^nUCVLNOiX~i2y|t=>wb)vx%D9A#hQ>XG+QabRGuspgP&xH({3+oo-F}giW{tX= zUXBPrL`X?%X*gLXuhNq^Krt_`^zzgq#A^T>s5}3-q;5B@NkA}0LSOC2kJ;80WH$NI z)u4;2+PVl4*IKTNMV)(pR9^^b)ORP&s|Ln6n}NiQ?%9;~md-asS`Fx6D;>|lvz`)Q zoW0Kc=$h+9Wp~cJ^O26y4z3<|!>#wWW#AD&t z=6pmZ$PZd+7BXytlpEHbVtj4x`n~wpE;b(ix~6ttrxT!t^Vo)64ytk9bdP$ms&yW`~q~r_kMGjdxCzk*B5N z+dSTvw~4GOlK$_tcu8TP577o4^>u8Jean0B!9Mu6xMV&3qAv|(E*csH)#$3%Gv-m@ zs;e~RNqhmgfl|EN(JNbMg9VaS{Ac|;p0$OQ?cYBiX1%Phx_GbTv@#x($x3T4hxIf} zbJ08tp+%FrQqCHkl9Cpcl+Ykj`G(c=XcwE#%1UyhPTpA%B0^)u>nqhYAm+=8?ye~z z`J6M-Yt+#jX_jt2gX=u!;WM8fR}*IAs}~p7*Pcj}+R+eNow7vARk`O$40S%TPaeW= zA&9Y89n@`Djr;9f7b%WjJ3`?zZu6c z`cCi-sM?h?y&LyQ8u?4kxj1U3Qiw2SsTZhi^t*Y{B4hR{vBu=Vgd!zi(q*l1Dp>U+ zdmPsG+Vb)aG&{6&O3Ev=4Uwv7|Q2pIMB+@pO+Qxfw{aTTBDb=l@*jm-NVhdhWnLbee5Ip zBOePb`+C_#C8*zax{B-Cx|C`a+7$Q)k>z`N%Gey6cMW!#luvFh2*!uGoeXAV`rVjg zK-WdA{pXsX=`!`Nh4-?1-H_6u4^o+9jJZ@9TLg)=N553#l<4JSTeCe@Q}oDaPCZkn zUwfByXwP9ubOg(T{~go?%Y`xUdYcbo>_x}z8pOz31CNtCq_O%}3wix$H7vv*mv5f+ z-I-q!A>4m zW6{w5rbCkcpZ&ZunJ3uM5o!c+y7*(7HZfOF2{zQ^wm+5=kT_3OTSYg=6INWdYQFHf zevTx`!ELAT+L5R~8LFYSfEzmh3D>8HZHO(pDt%Vk7$(T^sqqtH zieAb)!9!$(q?De#4H@iF0(vrTSkf)_hR5FW4hT9cb{(z%I1K z?HIr0=G%SJd&u9{A`47cRzs%;GM>~N4k?FAMx`7~g>Q;7Z{>l~!!5!F!!xuD^mfT{ z4THPoff(mVf9YnIk5aoQ*PZW{njZ$2@5KfK%xs>etLeI&w0huqTi2A{FuQx4R~f+# zX$|hI&@Mb<8oK@*fdGhd9@{i$J^ENtEvg5dASVk?gZ1G^!ii;wYyEw zZ^mN!?g+ryojr^bpMEzMFpk}8jCch--olEy4RP85@B|a@Po1j~#0o?YtwazFq z-c;C;k_1<^VenM7o=GgPSB?2jjWG5ZuTm5C-H(EPNrLRc?Wb`C_{Tca1gS!*23|Bv ziYXgp5aWSZig285>f0D?^$zDG{(_T%^Hk8j1{C|d^GJp?R|yF%Mi`9V7iH|RXx zlVEzlTi5PKf;X4g*A5T$TX!e1qR8CpbeKg&kUn$9n^98J8rJ8jXDn5HQtEy-$ zyiZ)$x&I9W%PrMJ!XlF_j;B>B;Iz{i5P?XnkHLEHL{;kD#e!;Ch@Q-}!G&73%}6~k z!xar&oLul+zR4I=i{0p34QDHA$tr(`diA-IiDM>_b6c3sk8wjjPZwUP4#ww}E?I$S zKDVdH+^}`-dm0A@+3j!jK=(^zFJH~;nW)xh1?NPX4iyS*Khs{%QzfD!Z*fqwH@&!q z)kc}&Md}hSTN$kjGv>RhTsPL9ezJTh$GFxYqj zHdnRp_e~JP$j=jj2;ci@Jk=N5w9YxTPFp0O^*ICrNZsWHVeT&WB?e^|ffcyr0`FOK ziBC=@*Kk?nQ``^-G%WD4!us4ksWgccekD!)IZoDZNVX zJND+9gu97j{ghi!{|1qUdMdu_d7Y#H)7O770)gUy?0DKFKFfu#Pg*=`5K zB25eFm5?kIH8vl4Q=48p<%?{QbbBCNxHcNzYcS{k(Qk%`G&skIe}44%o>K^xIcxG2=C_{g=8DY5sm(oGNQBz zxZ-x>dW5k7O+fQ4hZt$1}6%u2pE)R2n64 z3GMp%q-JEKLh6%lifX+ZuOo9`T$f zMyM(6`xF{dT3lcZHkMKpQTUlRt%z`v*FR ze$yMm?Wg5HvkAbtK{Exu zk8vA;_D3OlMVSP0AklYk!6#33IVYnO7~!Lz)Ro0+7k`sv!w5}#oV~S#1vopqf3!|4 z{tMf3us`u9@R;pgBf+apS$z9BqUZPw&l-O+BthDXE&k)a0nHH9V+px>jtgxOk7};k zi3ya0@V^m9^sj%*B#UKGs+Lep{woB1&!P?;P_}<&OxvAV51Nm0Evmn$wp_xvHUhXv zkJ~yC$mvLlyO};LXAS>X-_jfB3Ds zRV`8UTL02I=G!)rD!UTOi~3QPmyLVz`jUdmH+gZMNnMcL~@}sC9GIpzNU7vIq2wl6s$wI0jRI$E>kGlscdkeNzL?U z@~TfP{bQ&RFC&rQV=4bH9}V6AYDUG^y2QNPg?TD3^1gGYmQGG+^p+O#+JfE3@!naF zq1j&?T8f9VLsU4)>sS7%_oOS%{J??QOGDr(&fO-4l!DzUQT@-qu9C00n``*w=!=Qp zVHpYm0cC}btYx)Nt7OVVM)xGBWf6@6UXB9B~P%3km0k#rb+@ z(SnnPiv=l|u>JEUnfA>2qnW><%29G*>@OAtz|xqH`?J|OIg@1uq7DZA@AzH@b%GhbiU*2?~!QzA*0hDt!J(QCl8XT zRnkj;(U7twBew~0a`8*RC7-N{@I$wMv$ppX4mD{=%xayG(J)m5HF!@h!Mn)1W50#!5}^N95+Fn zKA<&<@U1F+yqmuc@I7Ly$nF}*2-HbTaY(DyJf3vnOqzFZ<1 z+lx%E7XQfV_N|SJA%AMCt`a;agz&P5nAsL()Lbf%ZWlC?g!~UuAk)czjg&m;URdKGz-^8d^2fW4SZGz4L0e*drSeF@~aB@g8Jzpv)qtet}S{wSyx; z-PcYRg8SYFh|S(EAwlbL>A87^_|}%mzd-pv4{Z^VCr!(TiRWrIUj*2j@sM!ODyKK? zCc9N(Y!(xCJ;p^xKr;?SZ?7kURmhB=ePSA^xQY>xoZyi7@<(O?{a7?8$Wu{WA4!(D zfiNn`$;s*H=p-nnaJB&rfM>EYZlkUSx#iSbwAJQWG%xxCBT_yGKly9QS!;_@WNyAw zfPto!@M6+}wi@BD6nFa&tXJ<2(C_@8GX>QM|GayDZJyS-sT0vMsd_d&ch8mXcl@7! znn4Um0PC$3zC%gu2&xHKiXu{6e=mEKf%g z8}~OBMZ+c}YXr)%_g7j@@jQUAl7p5^}S^IqWb!zdqPCs!;L3} z8_)k(8xNc=m|AR*5!??V`)_AO%J{Vl;1ZI&&Xj!oCO?RX@LdB;rP8qOo>=F*4&|_z zf`BC9uO3@)|HbmVW=iJ$WIT8Rwr}V9+gboraPk$a_P2@>o<>Ig#D4TX=CARF2NDpv zeA<6Jd4y2cZNc!l8!0Xo&t}=N#*?oM9i)E>3V_`9v{P``>;}H2@62Np+|F5Sg?hlD zLYjlJ|67Ma(@sM^`zjo0#uidYFdZYE33^Cw8YhONy8l%~Ili%Vg!j#<5$!i0T=e2% zv{Kqm$(m;{5UC{-H#%y{U_X}|zRhLz5kL%k+#o>R1P@6|zYZ*&xxpIz)1At{)g}Aj z-uuYd*m$;!7PS@q^o&!g>frwOw-i{Rr7t!Yt@^4bNba(3Wso_mO!UvEK5^g~#%-cK z1VT5V3YSZ?N?cHAZKoW1d%Hh+cEO&m7Pkl~rz9s=+kQnI_23wUK zk+~W0F@?g@6H0>ZrIIDEL9Z$tc3cyIf_q7cz;Zj`d6&-lDXCX&4o+3#HHR~VM?uCQ|?e5s=01=9T(c*ckpu(WS*&iTErN$SEdfKD#AaDBDhu#cq95v1tsZ ztP~+BNU8UMJu4#q?J8RG>XuKOTt4!w#?6Tfq-S@sDg!GE4_*h6!6bQ*pwrM5NQ)x> z7si}ljTUA*(%1$`H70{$-gA*o`YB>_pMW5m_d#gM6*IHUCTee8CcEdP#D-6ABfo5w zm<%WR^Wl4t#TlSRP9f7O_~*%b*_C}&rVeGH5fH~sQdZZhd@aA%KO!J!i^E=q!+AFOTGzSK>7nKHMn^mLH`|t6u9nHYzy-@&5n48xxhm_kdQ2F}()I&^PGu{(2>LXk zc*h)F!)`~%bn?|*t1qVF5;j)gZRddMjzPD!`wWuX(>a3dIJk@X-U`(hWK%gX^bf1^ z8@1~HuQ1Eq?gR($M#caV<&3eXlydhauSyPgW7(N<0~2uUUZ)W&_9OM$R9D>_OxrPk z>Hq83+w>`b-%&_0fR_=w?!$l>`8yU$4S+SNNGq%1-at(4-RUn5JU!ae6yt!Qa$Xls zngnL%$lTOO5tc&QCh5R`1}(#RucTy##<;5HNZoj|$RhRIFuXhO*hrU9RMk2~h1MdG z5!7dl!x1`U^}_UdAH~A>?FjO*ZP3M_U=`8CqYT#TUMW!?w{Z%7_aoDE{8UhxY#Oiq z2d!SLkS zyXudMUXE@Yo_BXI@%9^*&{huwPlLU*yzDi$ZV$e1I%8x+655F)m11N@fzYBFC;su13zbU^hcKi8rZoBV= zIxh&os(XDzIVMk25fNz}wqBK11V7?5R`=mPob2YGwjE zvbKswfR|EiqC5iMK*H|1I+y7bwf!v7HG49=hq!tqHUmFasemCj>Kj>ZHUb^)X6KL? zTZ?`?N6(#jTFEr(Rl|>=r?!Gxd;D(4G;)^uM*$#$SNNdE^SiAq*;vMipf0)8Nw2$j zY~`BWc@~$ap-)JS#_0y-!Y_Ez`~oqxf7DE}h%|CB9~N8tMH1b#jfhWAZo{#JNRKd; zY<+(U6>Hz_`R3G6W5?sZdtt&*3KUA(D#qehG6x;^x$l2s7MrdlF8n75G>epnCXP4! zN?^@(hDEfQ3yDI*pI=`EHeY<76;ax`^b;NS(wP|P8?$TE5qa1L*mv^yBEfrNj69pz zZsMycUf*YvzGDDFy1(DBh{)NI6TGAtrZz2rtTe;C%sNQ{ZmF7LPJJ;<8}bX+{sZVj z^xkwC6^i@9wO`QDtamMh*udLXXKI)PUp z3Gd6!LTiZRws$yj?Qja2mdVxSJaAnr*m1cAkO(lO)ZHGS0XCbmh``Bw4x~EZOyzbbt8>+IEGbH|CH6k}N_XzG`f6_Oo+5`f=eH|A|7Ux;^V>I};RlcKb3OTd+?qES(d8}+p>p&DTe+t! zd&bjC6YBF3ctJ&_llbdzY4w_hIbE)AnE`zEgLYy2tN==#1jI%8T7u*8_l|Y;DR{H@ zNKZN+pAXge3-&G6rU8lpWs&Q}AADa13>lw#fx(@9E#0Lr&sxUX6)9Dj!&g;ve|^b0~Gh243%x`g-- zX&15&_8;<*g3C+f#xvpevjHmz_?oecnyQ8#LiTy%^2EixjcfrtSYjx2UDx zm0WL?6Enw8ta_0W6O#HcON!>%ibZJCeGQHW&E~8)zq5b zH`Gj%=lD7$pKj_sNZzr99gI8;B=EhHcGVHtI%gNK#2OmPti23{>iBs!Ewz;w~ zn_|cW>12k%l%)wy&P;%|;cTD2)kyYqouykjWCa^jp62Q_VNTIYg9u({&;{kuy#d_x z?+q2K*{$%fI=uSz%e@j~*J>d~R<`R}$lI-2C!zMwPqA z`eb!5bxSh(-f(IghJvzx1e3zeR}44P53)qOtVX(Wz?o6&BLQ=a)DJfTbL-<798Ry$ zuHBpAUvtN!V3d39gJ-`^ZB$hS%IU5fv5fjs$X{fWQf5A1%jx-V1{LL1UGv6JT3ObV zAUqc&0OfLe0d%GFc2UgP6tj^~TC8|ZnIVGrqVi(Wh-t|EsIl)p&n0r8zQd20)Ntr6 zN3OOpa_8;hxmJPd2l?dl9+lAgZ!9n=-qr6_H+?C!!R=I$k`;{o4pzC>~uFF&u3 zEZ>b{ye7#QA4@*Ahv{jk`qag>^6+nh)xY^Xr=u0qV4z&_GUurun?XD{jChdjia!Cl7tvVPk1Q#> z73#771o2o&;xq!ujC-dl8@Xv}X}_CTaClN6ch1D3luo>5-uF^Nit!pGuC$VR!2p`X zLAuThtlW=^(OX#MRLF0ozw7T8-%z%)!^fo~(17AAw#F7rH0FzjmzRyiZEdOTW1l{| zO1&I>QaO^C_@iPf!@_6P92PS&fEoEz3w5hQTkKRIcN4=XNdSm!2!lQ-zX%1fB3|%2 z|Dtqz#CbQEL@4Aj8MwqY7G7}_^8MKJPQz=KQJfR-P<#;CCIt#+9sIGUZ?OsN=^ov`cna4?%0R_Oe z?W${ls&Z!V)e*2JojsqX;pOnLvu$1`83kF6yKv`b#NqSwk9~|aWi2i43PF+%R~k_u z1deQrdkLq_EHTt~*TCE2B8-2_qv`o#Z|^X0M0J?r=-7E5)ICplC9Y(jlpZOF@(^%X zCL}6JI++`|ZPq_yllB(Z1R7rm!rq9wkf7yeb}1~i6aWoo0Z8}csRMlh9|Yv%ZWo-W zsd@FdIwF7PIy&L#{WTihB{Wt;{O(Fh;pvWUMLV+;;*4J#pKqvS*8oa0#_0*Q^>*MX;s9Ch|(X~e9$T7&H;LVFO zhPNK2lqEjr;ayiEupi8h`tMxmATfi-B_CzS4aAUe6^-d(>t)R~2pimX56Old$bty% zZ+P-$wBT&{vyX=`AQWA!xP6oVBP#yAl=+t4?i+%2qL6Uu#vP#_rh}eIJrM)U*+{7A z*A=m@xW{u68|OAb$M~i_lH|qDIfdeF(GkGBIOnPN{_~xtGTGBPv3`jijE?XHy9-!7 z@0cIOE0o(Wt z7I5ZeMTV*{vdI3S&wbHDzd~VK(8MYQZ24`kq3z#7k$`rXdvtJ)Dpw~Qeepw%y!uDE zcAiOH?S67b>a>%Ow**$pe55ffclE#6WBz+8fo@ghE&7i7X z`9?n%O(CZLDzD#Orp*k>a6AxjS+P?KLx-CR8v3CKz7*gJ+pGOdp*R0B!00MRfL0Gz=Z&W8SuP`U&hQ118V${2e^mZtN(Y=#~Dc zC3AqW`%q>4J4w7>`c#T5TLq9_qea>uBGEbC6{|?ujT;>M8%M{$S0DgWfo%m_8#{&t znWNAimK}E}=KpkH(gXVF3{pvz4Hm;6%2$8~an_Aiq*u{U3kZaNXd3N$(5_d}zt-#v zg{B9x|08zv_6SpDe^d_}B`K*@ekc3q{~@DyczbaHyO{D%G3y)LBICWkl$dJsxFhruWS zWge{f49dM-jl)l4z^zBv&8AR0fmyJ)DB5=)ESGbYmEr>pMdE8i}&W8DiUB4<@mv(GeUPMw$7 zJKB#~h~;*glWgce4jnYQZpU$?MG@#Js+nA8_V?vZdO3ewT;i~aK>SWWDmukdGxTRT zjJIWU>d=20bG?t=zHHkBFcu(E_u3}!MA#TPTJ+7J%E^nB;&BTi>>$MxsGJ~`SEk`` zVw<4|eK38__ZqfMSKVN4!T-RSx$Tvl*MA4Mb>K-V9tCY2kq5XnQXWlh>;JTbL=2c= zcz0=E9ZQLtwYkKY+fJuKF7r^`dDE=vT)+x*gF4#kJbCrJ?Q)wHi6xNz_6m>Z+J5=c zn#g`r`c2X6gK#Z5;ubED-S+#s^k^Tqv4M_3`HQtM*+zZZOwMfbtG2PW+dVthjp?Q^ z^E>ClFQqrF$9)B2up|IW%Nnx4`YILF0&X{==5VR2B&3+|_ABg})jWXzj9|>(`D8LE zx$d`yxO61-fl)F+QXOZhA-^|I!W;5<0XJW?!eC=Ssgs-4Q)4C z8OG?@$(zs&n&E90&xd|_&Dzea)i%qlg7Ai8v>T!9i;fR#TZVx5;dedzJTnpvz~<;1 zQz03Km;FBzN~pBX#ZN8)HIKt)$4}Lufhww1RlQl0X!Fn3-CD^F5@N1-1A;ezWl7dY z9bC%qE?cNH?PJX??Kflhh)pfpR>oGG_xWV6;i+{yH3&ASUOn=JbQ(SoH%^1pPHzQS zorp!CV|_Ofu9xGr4_~F~A1P^o4aw(dozKfCgH|ksUV81rTfoS!SZ)-k( z;~ri^&bH3%?|!!VJPeYjT#DU$Gb*5p#RdANSiw<9WIzm3zL<>yv!Gt< z;T$^K*;pG={LRiy^iZIc4=kg`IPqDjB&mve6%J1CdWYF!`IyfiU=src*HjtAAs-&% zsJ7tw*PWj)0cziU^0}YMTwda+l5)oDzqmX*Ph)u4K%+LJtE>myI! zoS1UM)JT|jp(SsqAWychupf$;k%CAORfaOk8r1R(6^AKAVwtAvyNf9-vDR8w2G zuSbufBA_C0=tq&>6r>ZPA|O&Cy@T{l=pCXWA|2^HQbR|2C-hzfLMQYdI)qO0Hs^T0 z``!EQePg`)-njRTH%|V5F_OL4T6?aw=Uj8H`I|p)p z9W6sN)DA~hNehNoBu`OlzkjHvnieXs@kx%T(+QjTE_q!)VZd0@U6wZWt4oq0F>Jei z=oiZDY~)2$ga?P!U=b>xzZhhK=@Cj&7&tDL&KP1C}V#7$qjeFXBfJAG?U6D%ultlDgP$Lp4^0{ zo0W~+Mo;Ii6jdwPd~t0e&-hJ~nZEJ6H**j1VUI19KdXm(3-6+nulae8Nq~}%+w!WQ zNXjQ|YD^JIl%MY`mj|s?$|b^%$Bdbn)f3fN7Vbo5oF8jReAnrAqC|g?WmuoT7m=Nd z$koX!P_U_X(Iau{$vd994IoZL!!c_ks{LDIl`nylM8nLiMO-U_?E<@kmjWg8n6`d@ zSe}c6^1BHFJP1*QgM)*iQ1r1It@W3Lql0%)wc*!>P88Qf>e`%E>@)V}ANT6VRS-FO zwf#Vg{BA7sMmLxlF(jkQd56=@O2XML>7$C4GQhLPT==btCWM^q1m&dMT`)4NrY2p& zuN7>qqUDx6oy_Ww<)=}quFpnP=ymnYcim8kiqE-Wn;dWa>$6b0?nLvA+6^-rGD_=& zX?0hY^UYA$WACQ~Y7k4Eme&;#J%;!rmxR_ZUy8{nNTiaMromlzo=2FHek~9?GE^T>H=wja4v{XZ8zOCK8rfXIivllGW>(%18dgBy0S2v#|Ts@Kk z>TK%hb#B^tD0wA)YEBCH^^u zzrOIMefW`z;tTyHiN4d?NLSFcZ|u^w^`=-b)Rm(G`a9IkK3 z-gi@Z@zUg4Xl{i4r|ltk-fw`Oi%ghKnOkQ?++wkKb$d`+x#-^{@GH_6a{3dUH``%` z%p(|Hs+3%byd#%IlF$Be@|QOf*1@Rv&HSs+@P>_lrRC>S^e^$9E4E(gF1M7OVj4CL zV`>bZgpd&dVF&#hC2J$h0_|(VGLP=3PYmu3zh*S<%RHqP&QyNCwq;^CI{Qv-n1LNR zfDljb9iKI9 zjCFteVJiiF6qyt9V+|Kj+!N7mmNp`xRH$gTJTeyP5n9-6PaLGVIJnH0cQ@=zG1B<4 zjr7A0_Xy9Gx#fii^Z{(`ah7C&n;U`A-Vhu0syHZG!rozsmuFvb)Rf%U7gA4)P*P$S zZZ|HT9LL^MsG)qurb|v`B;EZm^gbE-wT7s>c-KiVQfKv0zT#It>{SEdFO0ZF@;edttE)oNI#`3tM6iYOdOaxE-4;9gpAvDyvhuw02Ij{O)I@B=} zTR9;wCSM{n?_$6c5)da7Q+r?XnYv-x*1JM~6j)KxF zf93_~RYt1WDrCMT*4{+q>!_gJ_fbH>Pyr~L-udmSk3jJ`kItH2nlIJ!hREGkiSr%v zY|dNN%!;?gU()*da!^O`7!G#4Ugupt@uwE^EW$%;MEG-xzFU*6hHhO?*#oGj-9EXy zi~kDbb}(H<3_qkgdjAI<$*47Mv0>sJRHE%OwB)*r$Lme*G~i6K9(|v@o{M8Xa0l9d zd%}y+x>H&wG4jisl2LB_$1YOxdo`HUSIV6CSdr^-an8FbRt+Z%xywdGNS3KE?i~NG(G&j;V#47HVRAwg2eUc8 zXh#0Rb+%?`i3IsdbCinkko!2#bz@{xinxt-yv%)i{|E_cxvW{6X=!fWd$f5N%MpJs zfvJ-_=d02Tw@hKA^qEarJaG7O{n~QAe8|j>_`%1wD+o)Qn9{{#{STHc>*=&`W^3=7 zz~q$dr0%;-;6$k;+a=j;0H(mRtud~l`E}2Fs$e7D*@Fmcgo{<1)`b{{BE8%omt zRx?g3d&TvPI5V|2Jxk7fCDO+@3$w4Br+OmBq=wRFdw?QcTHH5mXCF(h{e?tuMAN$H zDC`eDlkN0*88}nGWQT#iEbbSR#;um%ZH7UGGoV4x@8XTolEoNqmrx z>MWwniI_zcNjrTh*h~qA{kUY=6!5+)+ZZ)nqRD?9$B2Hz!vC5Z8Z% zMF_s1^CuSJip0N0_N9 zQ|;>5vrR$&xH?5yP2t>20y)a$ZnIZJyJA2g)a&pIVlD>U^+rqW$2XGl3YyNRv@3@A z00nV=;8de2J`sMS%ONdoXV**bd68I`-7pOloIUO)A3BY(~4`4 zs4Cr)e_vQo16?(RibclTv7PLE7&2~iE-1I=%3dQrxNVy!Qig5F?)KFH+d#rd~wN!T zON7J8cLP84pG|ZYms>-sv{lcg+FC8U`YCm4M1(LcF`myI>{))7%&^Y z!*D1Z{pQ`uC zX8kJ*ke$Q;3^4SyhiRt_1*s3O%{@%$GS6GNxEgZ|+6lkC9*|M}$RxE_57OxjKq@xY zMcIC51W1!)UmBi#cCAtT@Sb+6cfZC4C>io&^}tEWWyO{v_CSRlwVkmnyB?YGnDI3_ zCaB`6QCQ~-AJsNmxe`L>d;qm z&eTB5V0*ENN-~y!v-y7R?fW5mRXLT#p5FGD-PmS^QQyk=ShxOLY|{_G+xZ~ni7Wlz zj2Bca6`Z2sS-KH-w%4{!Q&Ur?Hf|ty>8x0zVj&xn*QbjL@>N2NC2K&wiOmrwmY zZgz_}?tAKD60Zs~+Ya1uH?VKn7~7-na;UfZ8bcstTBl(ahj$ zvtcErFTXFG}fLm)W{>fQthB?8^#Qivdle#MIyp(BAuQV6m zDqiWdw?d4Kl~0`-J9e&8qB*U)4GN`>HanVomkg#^Q)^*e+zaP==F;izZWOpT+n&sZ z70*cyldpY@Sw5ZC{+G{>nuQr2}CLo7&0{Li~E&6E*CYk zv9YlVQ=pvKe%J>Q=A6ADOJm}B)+0-!UwbeHrC5=BYT8xI-`77eR{Uaox(ql(5^G5@ zMJ=nK+(V~zUDmqFX7GaIAXjV#{>}nuwj<4NaN#LMj)de8PH+f)Jwq}H+LLS#k4TOY5&yPK}wu$5ym0RKg#|r zGWvmC3k%1iAH(Sn1-P8WA97nP32I3sB))Qc$l|P{SceaK!dJ)gLY5`%(*fq|uiE*Kt(RVn*F>4m zS7`Z&%Q32*P9>)fI_K`m-#wFf5f~$kVfV1ZI4_;~7C06tD5((UHSWIqD<#&Yvw&9p zborMR&YG7|6+!vzxZRQ}8D7vE`TV-=WM6!w4gO+wt-A~BBX!3)?riXJjcHzIgp_W0 zwS`0WQSI+wwk!qq4v5Tz%3?9kIct?1htoYCre3RMD{kY}i0WClCt{f`#yXW0H6#ov zw{df0Xd|n|UlZg>9$Dk%&mOxQXbl7h{Bk~tN)Fa^84-Eu1RFtoco{~HH%@8i84hQ` zl4)r1rziC3-W4uIM3nrt?FFIJe&76Ff*Y;VRrJEn!P|2gJpY-1ZLzQSO=j|N2O|ev z{6Vh3a3;5InUmq7=OB^8GUxE{5Ro^-+s%>f1rmPN_v+)U9$UJi3#7W zH=eI2cyGCsn6|FwzdrTuy703C^ZXmYk(3<_rTZJv^3vApi<*5$anw8<)<02x7N-4> z1P;C!$xon03N@5Jp+4&h)QK^)0J}@up3W^4L2d57$+nELF^uVTUbFh~>tq%6Xk`{5 z>%Qkv>t=je{^x4VrAwj%Abz{XSSWIb^F~n)&z_$<>-Ne^4jnm*5enklwMYEFo^EpS zhbJrOsl2BPzZDSRTRd6OG^iq1$-6aj5tn7#wxSdh&P<0MY@FmV?9LfR89xQeqLnOM z4_N{6<&OSYTOVD==bP&P!|65rFbD_*5XzO4j>V%dybZK=9TRo0tlkdRH@A+DuGY8C zDJ^&*KUA?tC-C8HEIL_8^{xB`!%nPcsb^?WrEi$cw?%@2pb8MsWcE^29W2uWA8 zASU$<#O7+ZKH6-G>w=n93QTl7c~^PIWz|`_&Dl_L!i#)=B5a4}DOLr}%eL5TY?%CQ z^+xNTBsh!r)`2W(i~Pw4N1;2XYH+R;I_|T_ZF`h~t=pmvv?^EVu1eZEqST!&CQSz> ziT8bT5UR*{3M%+kI7yQeM`Z7{wGyH7-B$= zTso!kuUNoO)_{MyVa~hxrszwcNyunQOhIJQG3S{%Rr?Dd`F)@@wU`3^`TiBT%;Bji z*(=Gnf1(F3v-n-tX~25B5^ow?VHOyw2fv=)P=cG_gF4T=iE+(>I!3vqGWd?Fozatj zB=P%^Py^7eZJ z)b+^p3ut%9r=#gO;Xwz%zwjEXyg<@JrTZq7t$KHP@u?CM06GELuEuPW%15f*9?gqI zvg1}qYluT!8#QEPF!f6`f#>hKTQd*M^S*VomTVmSwVs}@xIb)A@T!YG6*7rLl(Pjq zJzb*6y5jd;)2LM+a>sRT7J}5Nx3|7IdRo8qYu>5o`%^ej9>gNlY;fNAFIHuM5`Y?L zM!(~2$afaJmYIbCYVZAN=aaWgIEGsJi_%r-8#-05)^V@1AqSb3mZk|X%M)7`GVI%% z#gI0-o{s#-Rt4Rq;~&ImsJ`wQriR@A_gLFZFVkW9KmSk3toCK!ezI|1ab-Jr`M!DN zv!PYXSoQv_D{MP6Gt&@h6w4EwTvC4ikacNxV1{7awnvuUnd5V*+01gpRb=)6q0nIM zB35L6O=gDpU1a9UGq?Ugb%RHpazQh7$OhIa-+*r&WJHhV0iIeHH~0C|hjFOi7YXBLf6&lNc zeb+juQSCSp+KKcK1v@UCm2@`W*XiiU5RyFtFl$3&ThqTRHyzYcRo!ygJAY13Z75C} zk}Kk;tMyP(f_?Rwp%%b!22i`KZJNK}Et`uS#9D*uE;w3Rqli998vlOhbA5_$Fywt9 z^IzoTfG(h`b4VD|7oFU$@Un-@<2K>pbPA}^f3R!KePL3_XbEHZ+AVFOZO|lfD`kx( z{pBysHN9M%y#py|BE3JTuZ+wDgssjy$2!R1s-)2oE@S5d1x#P;elBHE#!K$(X*1DX z%jJxwL1F&``A0)v8cRxckFcoG(F?3{LCLiWBx{7|llX^2Us|2i$>$6ukO^!ZV^xKN z`s14PTEf}=fh3R(6Z6w@-4B@BtJ2mIZ>ExUq+AOgYX7AUA-;5S3ILhwNHN5~dFx{B zJY&9m4K+mT5z2u-z$`B>>kZ;4s*N_YdypMIya28(y+gj^UWZC<@Sh;IEXNa~6u{Ge z?#Wu1TJLd52>efc_F^*IcXWQfXYZL`gr1(L6<&B@HJ1`1+GXR8-*kfvw5BX<#QxRW z<}d@%+ZGm_ziyh(?^f-5Ny_V@H&vi9Y4L@zA7G(}5K^Jv{bUdN)V4>o>zwh3LZmW5 zd`l_(AO5ORsNBCot+{GmaJ(}Ot-^15-|Kz_2mWL zr?n~=FtNkz`2F`{0Ch7 zm2V^mEDibs9TotN&AFVfq2CgK?9kHx1gTv)C;(*ri)-q;fZKmeasyH|^j|Q@JC6Y_ z*q@XCjP5TLe&zo!uLm>NuIPtL^K~;BsNr$t%CC@F z;O~`>%(j>R{=N+m!rvkRgz*3EDp_SC#QYTt`2YDi|9-Z=l^?JM{#NXO5dOAxfDryR z|9}wwn|4GN;JSBim(hp2#S;i8YwAYWuVuiNZ1&3%`DMMc|LUnJOKY|kA75^PQ6mKY zU|JO;^%JrULY~cmFHWjj{B+%_Vu;sCFZYM%7}`E9Wt>9sLj{3?v$bz<68f;??;h;! z$o96>Tcgv$<`NQ@4@UC~aWipQFTKB%o-a5mU=zW$}_@J(iQ8?3hbjoH0KAbJFj$;Np&2VBM$Rb$o>6y2j zrQ6{*F;+_KBcPkvn{S6`X&hF#6Axy4gq;iu^VOYD3VM~h>-5`nNPX0-W?5>>yQFGX z7f9T0j41_dT`|g%Vp{A3dr)#?%BjDQDR><%ggd`*P_;pCAJ7_ODwHKf4)@D+166yA z6~Wj<{|Itjk%Jt1pgtJor2tZL)`&yY0s}-!MVwJf7cMYP?aG6C0(|Uo*l2#Y6PUKt z<9nXfes1^7@iJ=?Nv-md2cwo@97v=*=Qe5fxZ6d^zS#M|NEx@-@sIP?Tz)A^PLIRR zekesRwaD_a#ANDfh{H-*orM*0b-E6TtMte-Yg!%8_Ti%Zae%#*W*TiO;BDE+4t*7e zK235l*BvGg&F@~GcHBOn4<=jMy`ke5LX|Wrm^1a=b)*N}9;`VXzXXk_2V{|^k(c~#>So(HPrC)8DzOoxkL#QCCtma za{+>zS@J=`W8G#m6hi_6@TV~v?CgU>RD2f7$Y}+7+&9mq3*^N@^^_R$w?Rzg4XBvl zQq|EU{Csl=vU#pM5Wr6{?SwYh%hy7v*lg+QrLolGPEHCDp7}C}8^-;8I_Ea++taRY z{abn*aVI-7{1uyn*;~}t7gkWh4jr-G{i~XY)gnZOPPERUrj1ph zZh6ywaDlq({)#`NiDY&*cHOjeeL7ca)TI29VEp+L;(kkm85rKD1!g%M;Jh_;(%*=N zhYGI~ih#%5z7uBfVZ5D@Tc$_j)rVLi5;P6C6F|F@3ZSV%9~j#>SE1;T^Y&PJ8Y5_KHpAI9UVRi>dfJdThY<%17j^ z9*}}Y_IFAp{o64hiym$yeJ(9+60gxK8%$37*AdI41Td2Tc%ss|Z;>@3xnpe#Eb_-% zeLJM3OkRI5;SZGCOLI7DS-}gRe1a3v|HyO-eAQQ}zc?F#RK?bhO>xoQ*Q2OAm_Tr; z9PS--b0O2-&3*3b3UFdihS|1tWtn&9p;+p4wr=hE4w2{QPGL(2J{BphY*srh{fH`z z=QGq(KUQVO z$BuDHVY4T~J(LE;3YsXJGcXG!V1`gVu@grRBD3-x@p_!pwjE;aD6 zXI9yf5-)Khfr!hr{R%1^YiwOV=-Dg6h(DGYA={iugl7_ zHMIZiWxnRXiuibO9O*J&z1drvVGwr|H91(=sVPU^P;${EjXb-vuUb6!J?$izHlV%IhcAkA6lqWQuIQUPNF7I z(o-r@QAAMy80hcne*4m-aqa1F;EJi8Ne@!E2kZry-8_JKf*zTqBb2g$w|xE6eABi{GF zmD3~rWAdQ?kA^jLH&>tdw=ekibDqvr?d!VQb&B9wSUJ4}p2mLNZDrEy+Bh!@K>#Wi zns{EO&Ov@@h-hs5^a-dVJBf%;Bx??nJjSGA(2ez6>X#Kv|Xf1m!o9uzLP zwjlwLG=#kM1cyg zu5%DS2qw3k+)O9{JN7!8Av}e7tu8<%fxe%ISv(LFJD&BCLV!<#ZR%jc>z`qH>_R(> zEuZGpE>bOzcoFzrh=|KpP)dp52Bz3*GN{A(|%aSK0@Qt>I3OT?k-AR9^dY4JAV1F zFl^lIr|Yazw*Bnn?Rc(3J$?GTMUxy9;~Q~u8L{7%gcY9~5T=bcZMecSePU0J=9U>c91@7ytw z(X~508Kz=N6&4O1hfeIH{1!!SXJC>`4KGGO%xEjRGeg3SKf@>l*Ohxp7-W9{Z&1)y z_Yx9*Ch@48Ba7G)LteaqW@ZgNDbYVz&g4`mJqz1pwB(nHBXZfqnH>+GThetRnI;Y< zd`5M=7SN!rj^1PYQ6*;C(__Oo0-!&(u5jw%dI{t1k-eGo!}8T9l>3vr2^Chs#0qOA zNUFn<>&&5Ew%UB_lBJkA+L<0#}5X_LQ4(HXeVMsgwS{zq)9S|)|%U3{KR~0@z4>{Azy(u6eFFOiZIe*-o>8>TL~tLw!i+*(XiOs?c0` zK;@}>*2~T5j)|xd;^8H62j255?~Q=z5iSLDosb-Q-)I-^SI&dgJcZR+uGa2gY z-Wg8RZHo42i_S(S)SB&!5z@i5|9prtV56pye{K2vByL;piJ-8jNxx^7%nB((RuO`N z1DtO;2^gsN43IJx+XKK4I77E6c(qqp=Gp+=Ug1;TtjI#;s9)`CB@=u~d9g|+0vJ-eF|hg)$JUZ2YgVm*dX z;aeAHBxWkx&0m`)w-bvC@V<4Ln+Q8Aj%xhCaQ>N|aIub$6CqvI+ShSHVd9Ns=Y}C= z)ky2Stm#}kl0Qny&Wiip7ql48;hT%rgX5C+%dIErXmfxxFHC70v z-F-5{g}^kaen@A5*15fgpG+V0Vzf->Y^B1><8-G;!Z%F-*R6yQd4H z?P;>xP9hz8xfm=2BOC5*y2o_UR-m8Rc0>(4lztrk3N2WVP63k?Z?ElAjg}wwir+1(PD19z_6YN)40!maRvn$jsy`95Ygh?cXND17sp2O?>nVk>MwQ-P z&cThI0x_^nR;Cr3D_7Z}tJ4xpT2s5y**ApGw0uLS#F)G2od9PzpJmq!$$J##xXjE| z4_zs}+$IVd4SUONFem;<;raK3U7m?py;@5 zP95!JH)q}D`66WPY_asd;hHhzK~SuEWW?x0cE)H=->%+3ggmS3$=E}N)1^(fA8j}j z8+FCXQZqx(LI);zRex(c12EEWH!Mnh4EyhwS?W2?RZ%1!p;wY&b8ABQieq1(u$q*# z`C5%Xy|IyJk#s~}Asn?f395DxT5D0~aAskC-Muwwh|799+HW2?U2EJNnU#~CE?}+g ztkoFG+^(o-VVdlC`aRR1MCbE?w%1T>(GXQeg<1Si38Wh`efo7GPi=IydKZ#;rx%Ht z_C8By&d>-aW1G=E_R}cj2u1ESo%=cCt7*At>b_q)5kkjd3S z9nInJ#3ZX_F$#JKkwfA1sD#T@&~KU+n^RT1!XH~k>qPN5soODDK^cgx01+wEWs>!n z(T%V!LZF-nx4O6Hs5s1?6S!qgc2E*i)E2{j)ySRiG~LojdD2CFyzfmv9PCC)cw1Ef zWA}1d%I@LXyFpS$9o~~xW)ab~OSJ?9J7Ydl%* z>~da{aL{#U=sIuHIBD+dlP=U2@H!Z)QB&PSn|Y5cEu59*oD$Z04yQlm?W&>E;;*o^ zb5kAW|5S^v`OP^`^1V;3i@Txjo^EK9@v$!0~&uCDGP`BHW!ledZ$3J@IbM){)f%H# z^#!H{=CUaQ-+-s;?-jCiuRdMw!?Y6%ms|B6n0K?KM&_Ll2!MsK0OqPp_F{}`x2seh zT(yfBJ}m%xOS6FS|@kpL%JA=Ro8y7k(=w7wAf%+;T~U3;w!x?a4xq zl2GHcbRTI*q+@S-I9+o5#?Qwd7nf8j-jfWX0_Q+yrrMSWGefEDJQ|C2f*D4>i94HI zM1B^kLg@V{aNf-!iaOJI6rKE416*deQoEHj#MZ^%7D1=0s;TVh*mq*;WRdjM>E-mA zmzD~Lu11;3g({j0#LjQsv)G#7M-w*bimahiq;gq}uQwUM7%O<9EoBz+h0AbR#mW!* z<9JT}18jWyMD+^~6m@kKPC5f|V?AAi!>t))Mf`PAp|oy>NR!r3Syoq}dv6U`rMVuh zy$dI8jVN^cogUeDE$PyZ;CzM;9;W#t3raMX9^;()&qh8@Zp9w%Rd+>uK)y&6`Do`j z7bAO*#6%D0K20cC6?TV6sVtmvv(y-uVNjlZfifc|(VSBQRsCT2r)sxd6zlbFDm}-| z40OV9uCSD*k9ut$4+E^HWvT_T!a1e@uF)NgyOqr;qGPM-m!mp(aZn$q+OJuYQEb@k z!*SF|3Ue>uzKobL!S;`|wpT^w^j7hA6G zU0!RAy1q>+#AA3|W%}^G+SVyh#5@tnW-*;dg)|u?&De(Z=Chj+(+j&F)Pg+p!}Uxr zx7AWvm-=gl3uc5IKZ4Zp!HhLTbI`SxaJY*#O{>7GBKK@)KdsYlGUC&rwHo&X=3$zG z)&E*(x59L{dyof-EOpV`bb-b*?JDLi1*a;P{C**juWoZkiM4TWo) z?v=pgr!_8vvG_NaUIrztt_oBkE=kDjwRf&hoyc|Kz<=do^wRNMI(R!mJKU}rW)_EG z1LKz-eS>K$@&8eh51t+v0p6KUFBfR-#-$XlU71V7M}gO(>40ypNK44SDtP(s!aM$4OZo!?wT>=CNPH=a(;O_43E`tm{xXvYS@_y%@ z^XIO!*4=-m*OuPhwX2@4da8PU$jOMJAmSpzz`&r0iwP;fz`$m}z`XkY=H>I5dB6*Q z7#MUIaUlUEmz2X5B(3NfDEz5kr7aFU|A!u-H-V_2EZbXH${0DsBz^s0a#u3x>6oV< zi7IlzkDUq(DCckUOuuIRi1$Tg-hJ`lpsVo-wUU|-fOxaYHH3z|1RtJ{Vq5KU zjJb}wvi6Q%bL?_2hJ}T_UN1bg--%V_33&TFkmuv(dSCQU3kHT6|0Vw4cE%a{`oE{c z0%73)woSQTv;S@KZxOe@_}j)sdx845Iqvet=5O;`ui&>=f7{H2|3A83%(-TMYj+#iD!>}j{9ao{KF_82Aj_vMX8#G*E0xMDIRsR3}MTi7?)sGpkA*++~&4o!aJ&Xz^q&uLR3y*zQ^ zD@{fTW81ESZpP|L+}k@Qtf2>F`lzr8QdJg3VPVB)k;Lm@2Qy0X8O`S}>O|)D@)o{xmFFff^q8K~VS}Ai zpm*cQy(%2qiv%WV7XbG#g7c-wiBE+ZJ$Id;UfQo4?ygUq@2>>IZvJTDH}B#=1RF6t z-10dyh8kRmBo&ra$Wt-zt_ejv;oXjmbl4~i60N5nSKa-kg&aLRTD1ca_om-OiBAB) z)C@b=D6S5OS!E5&{u*0$S3W9u11Jo9V{7pCE&c7~x*Y+$X2>0+IRr#PP@DZqQ&i4D z(3rJsd!JLv*$OvaUN_PCtT8Bo1JxvY(5@BL{Y~-ZAS$DJ zOGdLW$4Ft;WELI?!TY}1FNsuJ*jjW2F$W)bcK0%Ze+3Oz0pf-nkdFeEH22=_aU@DT zjW`Fcy>S8I#8LjWHWz+0%=Ph;a+dA_+x+!#nM;<$f)rx|VRtj%vzWPk2b?3BRMgTa zy@HXiVDKI*?v=%d*$A}(yr;Kf;X0qg9q}cG8y(*ekQ&tsXeBvvXPXA4(?;(h+x;TD z&WqdorOmNfg&o_)tVW2`x>W(j2qo&{7q9Gt*Vq|8CH5QcfM)8>9!QcnrLqBna7B<*DyLJb^YSIanG zu6%^&bJMBx233!fDyu|idEX7D@khu{grUuO+dqo*;Js-5Yt!o;Ji{c}8XBJ>XV^Qx zThlKNI0R+ZmPnk*`sWDAkrrT6Rs*l*$_|}(iTq88AAXh5p# zA>gSdHJ-Hx4`Lp;1RSl@c6xuLWPjVTVdyFfdV`2sE+@i6(?}kNaN!oJjXCjO=;C?INH*0Yt~B= zKD4~c!v|$bdZ;PugeZ&=a(I%mcUyJb?b%O#ktNh65DbcPzfjH0R(tIxN^1LysAT43 z<7EFY&@%tmrWJ{TT?&%6stNoxW}}*v(na1 z%q+`{p0z1of@-`bp~DEkH%m&GoX@{-U<-~JFDgcX<{guv#rl_-m_eTH@C zd)ls(c-itDk=wHoY&D0WHvZQV2qy)@*XvF8zQ#pIKQ0VeeqlSzx0u%*t8dF>82Pp! ztEpKmucMhnO4;C$Uy)8X^)=;04v9(RS^~>Nv^;^Ri_|uMEygLpOhX+#f3J_AQ2&d!?c|<7&O={Kajotr&M{dX)62O$(z$Dz`}xc9UK}Sh zJawPhf)AoMlVATX7^iZCyzLY7^Pi(B&2#JCOW{DquAs3$Ky^l&OLn#f(((p^k4J8{ zU9|EBd>VX>;f1z*-X|vcZHA7T#BG8HYvt)Gsz!JX{$;wV^&bzn&t~i+iWT;pwpKN; zH-@N`VcCNYBWf}Om9qhA0NNlgAhTjjO=gd_lHu;=&R7tsNOtX!&B+D7)sS9=AzoV} zH+03%`%oJi2(Cx1ngycN(gtb%+7!cLAi{c_>0?q8rjb7duPO4W-KK6Gql=RJ96t{M zdbCv6)ITkDXJNqe*ZFaQ(NIe9<&H_7Az6(*;3I(E9yUB!uu%ae#Qfs)vg2e747`n^ zG?YFFW;*Vwv~lT^3m$OPRz!D2Qobm!NH;I9;vM$E?;1$b!O; zaICozt)I>nS~&*BeI&kWY!jW2M9hTAu+GuNt!HM~RvWTs%F|J``^F>njLjbonT-A5HSGg!;1Y1r=#9)R zt|`zCbiQqw4&KQJ(U@j5axP3L=G&hmS+6yamdMi;>FY0>?=L((-i6uxa<@7(9Dt>N9QCB1G6gQF|e-Hay3Rn z*JgbLfe1=PF4T8hWndeEpJafpw0ty!U<=!A1F6kPePQ`mr6aUtv2m=v_yg{)^Izh4 zwpzcmztPl;xD9rgSG#?A_Y*b5fG;RzfI=DeR{0W;%qFe-7RwmKChhkV>rq~L_NR0L; zym8w`?|vNT#qYeMR4oFrbN!+(|AQIpXYDOiFw=UAjhvsc;W4nE9J48Z%Il`ZE0#59 zj-3zs;N|XCT2Hg(s)DpjvYvn}%LLS;f9AtY_w2?O813xo72`+94^pES9DmXpxX+G6 z&&Ckw;6)w0SZ-D@a`PlRk)pixZp_Yqe7x_N#?I|6L%eWwzfwQ0vVH+99fm7=p^*U;*T1s?L&+Q}ZiJuGk)7rrcdr(BV3Ss;X02MtYc zBRO`kPsuf^;84F`L%XueB8+fjF`cOmh1~nksTvb$u>n4>^9dH}H?UfJ`J8w=i+r?j zocG<9-FeN<#gRxweS$5f+-d|TFK>5PG$&G=w6l#}Ps3Wnzg#&=Fo*t+s$`%&hcFp& zqaWdqKW1rJZ%JiVz8V7z4`Nd9W;X9}XmGd-Yh46VX{#jU9kfJE2YU<r{#5vbs_qm6vrJ@}b-p zw&ONbaglfxr(1>sA+P$&^5ZJ}-oFMQX)`QMN!5WW4tf?ezw92>%fMo239?zERH%-6 zQu1JWS8BNyh!dp`jx?sZKkU`6V{*JvYxtArq_?Iyel&iss!o9ebe1Zj z>i+t)={vpv2-B#iJsw*w8QSOKO}tVA zwr3&9p>Z4=7$Q-gy3&flB;7S?LWTAW-5t!|eGIRBI7;s^3Tf2-6Kj3r9p`eEf8m0N zv(RL>7f20agSftolJ{!0qxbjgvzO8)g-6p&jc#Cr0M3OEeWgH%*(DptPDQZnV9BbV zW0ZZoYAqO76U@#=xE6PV<5L463O%vvd^<|v*G+Zk`}Rm}!MFWAd&g7vm^`l&8J4o` z3wND>Lf&{k@E&gdw zX$>rbEY9QVXG0Rf-eYf4=t%Q@B`sZ*{QjyeooeUV?X>LJ*p5}-w5RMt!md|$ED!j{ zLR!GxJrIBb1OQbeEmA}uN0;JBdSvQ7x#he;F^Sgkg@NaXcNo#qp8s^-SWjPKu^W1@Mz)74?B>&?0p`rh|wmA50!$Ro{>|z=9pok`sY_4 zeojsnx!GOU&Gj$K9BHd|dwbTfO43*?MvXMHUHO0rFBtD{&_J8R^|y+fF|al%qOLap z58z!v9B2=nVC7!g2H#p_R2joIR_qh05^IO5MmVP zsW>wGW7ULm4uirklS18K-KpDsSlD4WbC3-`P|o4-cx^if4B>U)F5KJfeUC}!Ncc%X zYMAl(xp*g$oKvKhW=7Dg-iX|R{ol

NUEmIBr2;3hUV^;g~Vbqh^!%D z?rAhcc&C*uJA5*(1Fw=?=H}P+#ttQhlvcMIuRM}HbHotjT}JB;WG^0 zKax(qGP)j8N57gQAgE@H_=EeMK4B1lzv1u#@!%8q@;J?w`X@1r7=T_s`8P$#9) zQnSI&fRQ#DIXHoC*EX`4+O^%ga&k&zA4_x*ISQMMReYL*w3#31}e>$)l0t)T=xn z@NH!{-}j6v?=?I>Md+bc{fHk^$zd|^b#Z4k zE@++`*Y612Y0Yu=eg9OYvtrL5P;mlc#XYWa@}8`dj%II+;Lslh4>$=u&!lUSz*QuB zPTrr!23Y2gvE;bCZG`9a$?^kVfl&kJ&Xy|h!E$*eR|>wde5J)PH@^sDc!Ii47=YKO z9QQGLT2p$p@n|c8r1L=&nOd*$JHaEF+rr8q9?JF|;O543aFzp=^C&sbVALzBs7n=o zvR0ZXOVXjVQT5-2A!BBKUJND;kEu*K1cm+!stqa04x!y-&on+ z_Ht|G1i_SjUlsUs^&7^2F{#ysA*=sVl>E_V(2&53t|_<)&fiacqtKNX7cRYcf7$*m z6KG*24&#P!ob~e5f!;2JU7kST_dPIfL$RHBuJMRSAwy!MnIss?#H=!1>`Hg#`S#Bw z*zOU>PwtG~-d^Wb=*hFoew?d@=3#uW3(e2X6^3y`{+F6H&D9}?I-Nve7A8(_J#!ER z>G{xykh^`(PA{{5Jnx-tGmO%}H#S<$cB#SE9``fwV;TwavO~~9WcAi3$jqjmU^;08 zmSTj+ z>4z1t@|-WXcBf+pSbccFPc}0he|+i9lX^ZiW>RE5OMl@|n6K+;{|huL&4nrfoT-9K zkb<1M1!ahrv$LO&fp_Z@bP2x_b@{B(c<)Ph4YDw_S<}dih^Uc@K5}$z=ciJ{pAoXk zWtHNw8$39t6xFqIrmA_0_D$b4Ig7T56u-HJTzmR*b)POsX98Nt`(5^%e&V6LUhL9V z`bWqx>#f@NUPUEut)cp$;dWc;36x-lsdl69kM1ERsJJ&$Paun$$wqj}pVKolYwvcC*&TB{&o^x&eKPfi;5>m=8C_GID~7P|}quS_|uY?E!{ z#dNn`Lv?m}6Unh{EF{iLrM~Iufs3oyFAPKzVW?kU|K-`4i;LsQpbveMk!I3WVj95@ zC!>>y0#jRViJ=Zl2@`b8M^Ey}TdfZl+BG=6@TCbj>`oU*q(OOw*mL`fT%PM{XIHLf zA=_RwqwD>)%Lub@mF7>fh1j#kGvR3r$6N=&W(?|-j*Xbcp?szQtvk>O7i{;$Zfx}G z<&csf>zjryKzXx30DA?B1ENJK2YKVngMNlxXR+F<%aRw7rj=)8hMJ#-J1toD<`f>_#kL z>1fkX?5KC995+LqR|hyP^Sqk!H+We@&MfMjF9uAWu;gs3XTLjLNF9`?QfdmYOyhpQ zV%1g}l@;S^qm%rsFg4%DN(uKL)sAy6l+)C_kBwhm0xl8~$hi4sNSLy=C%DNuRs|Rt ze_@`t@*+N=P|UyG3h>r-x$0a|B8Z#W!6}mgndC#`%eVG$xn}%=6te+H!r|mHdDSuI z(W;ggL4>aUrPrP;wv`N#vDn(^Y!Nyb%I5&FL){A2%JHTnYXdn&mn(Nhh<)wCN1iDE z8U)2o*>aV=UzTiR_hZy3SZnDtBv(#A8G>BR>mdc+8fR$cRU8{#Jb8@LnfR1g;?sL2 zSe>eMlN8ij!2*L5j14n#PH#Q4hU2{`F*OfRpo$h~^z+)b}lE z$ZeW&PQta<`y(vb`!SRL^4@L3{e^D0rtq@jo2z`p#ITj-fikv1#Wv+?;2~hh1&swi zukYWC&NpLhy7!AHwP5Zs!8PIB0SH>##r0(jHLk*B<&~8;H`~iVl-M+H<9hrWYcyjBrnHnHibAFMVMp7+@-d@Gp zs{_eSg$F-|Ft%qJm_Ih$e+}uZ+VZ;79Os8KyPnI9`q{Wx?5gUVM~RI%p{FkA9((G- zRdth9GD&Ut(6L*(ELE~KYbur4A7jqNnUd=IlJCDVqGV8z?=5*F=?J~WC#7g@5O!Rc z9g0hD(&Vhz7Q6sgx@6sBdf|fU-p$S0ORbdb3kJDZxN0MmZX)9FCK(u8N|dEwL-6jn z5+@ygr0C{zYH7C=gwvy3CJ1p*2+zjMmq5pN1Ceu|#u#yOM9U=l!aV;=Aw$whq{*U>w8dpokKXXKbyq2;duEo2BfA`$6aSmP0K;RPE_Rk!dtg>F$-;tqiawNqw?*g(A*asw|c<~heS6a zC2b0l$ECT_ywiszb&>S35BU3t`)eNu#^DUBdWq{H-l->ct&;&M)N z!l`rRsEI{e;DdS)kh-!1!(LAGVmNO#l^ka6~HH?>bt z02&$=L${ktEN=_>Z)aNDYDk^anvOOLv)P*Prq6Gcl>AMvv(2@1RYhrN^6UznCITyw zEf7Ph4ie7u-9%gz68j!*I})&FAGu5qw|t(1L-)-TVD?VQ*yk2Jv`AHBVY(m73AE&= zH~;hO(XMelg<3zk~|QhJwLeL0hj|`n8?&5$(5ibiHbjs?z?H@13q8y z{0XXiJ%9pcjRl`{EzW9lv}M{LBNqNS*Qz&k{X zHyhO0>!$L&Bj9tKv~;f3C(4cCd)GirltMsQ}e*wnxj61?n!9``J$#a z?pSJz)u^5k9gu%&n->Fv=YC=E}=(RPb3V z@_pZDepa2bTNgZcK~F($W)+g^pf;FJ;?<$a#iY5qq^zP{d)Rh%eULue%tg5^4FyC* z*2bEx&G)^0h7*>(9aN@A###Kk%g$dgOTibO4Q@|*q@{a8I%#z$?S(N~FDiE6Uc*V* zvF6TgTLnoGHIjV#CY{YnA#_9waW?_|3Qp)ZutN){CzD*~W^?21Telvl=~1uXik?C` zkYY!D^1+NDtLAlZM%yq}(oCtKpkv9E)7L-Q$t=SnFe;$sYlHH;$y6jHXx_uZy+$TY zTx#Xj=b+Yqn_PxlR!PjcMr|1v!rkUrTYE;pq8tk;2#^e{xWTyqU0b0?Z|MOjGE41N*>3A ze0qBBmrh+-NxVC+i>1}x)M`mj1lJ?HrhXovCY8Y|mpx5+jqAo9K~05nA}gHd9RDLY z1+(uecN=?!al6q?8s)-)As^%U%YSP%H0;0G2|1OnfbW{MW@H|(`-);}YKpFe2%MR@ zzjqt;w$BPjeH0jCW{~$vEV;=agy2-MCJ#c(a=cLK^?vs4W*h7xnDRcabkkW2ZV{I< zYfXGTcm9&Qpi#xgXQ!yzW-Km;WcOSDS5``~h+8LsIxgdk*5i|%e@@9y7WX4uiu3oF zMCK6vx|FwWuvQ3FITG{HKR5al+pQWjuhHbYma52Vh8;V5b5UPmHP7!o92-ZzKVGv7 zKH=hVL(oi0Zq_s5_UzF@Q$6sca53_-)NK6Xvd_IXnOdw{$=7Jb>b+G~WL{`lKTboh zZy#Cx$$f3K8<3cX@l+(|n#JFw><5 z+YC<9yvnYHMP!U->!u)A10-YC_L5jzAR`1Jwi2;|3$)E8-X_;Lne`Kq zmbR23TZZ5PMTL{ma?k$RL8$tA%UPpYTAEfvq%TOAZoPu>KJ9najKjB%L}uI5 zU|RR{VUcD&Z~B>;cRGXp#Nk5}oQsTa7>KyeC-YX!KwduJ>%1u`f)>%*U~4(DcPVXO z?6r=EYO*A3l7IC|$5L5EWiAC4&~l`UZqcQ&DeiM*zJFMtn!2nf)FGt&QNwD9*_ietFdjHqmKDsYXB4p5wL&XB)@~50t6`~=`+dGp zmr~HPX*%{RV~LdkZ4mzv(ws7$=Ja6Y7_L}01RYLrtbMt6Y3(1n@uDKmSsrKOtLP(X zOJ;i9Y%R1^wnySQL%3+k_;qhdL-VZ*zF{dvttscTZgLuKfVV6>X~(+y1UV@A<*AFJ z4>XyQcHvEv6Ar|Y$bv_`ek@ul^aE>XGF#x;zbk1_ilVer*dXG zD2>vI_~V5p30v*eFBSX&teXi5Mr!p|r+}IUaHXTRa!VYF$%lgpteKkNXOKyDYEzju zNJ^P5E>|vYF?BFc&Wcu?J9@jwIvZ2{#-_S|E%jMdluy{k+pR74x)m!hiup=OXei3Z zg$=Yr8H8bS!oJ~_@_&a~Ruc^>XFq99shB8_X4cX4Zrd3`Z%(5g|{i;`pp z0&9I*_vIeJF_;U&EWwMxok+2csj*+#>^^T043x%E=NB7VYNbc2pGOAL|03KkSZ4vn zsK#w8Rr6Sj;uHw7Q&wV*LO?}E0E6tUDJm>!$Eudt^hgyekh#^QZ7p3NoQ+S%-53^cpKMV-M3M0P_@OwUm z*GzmOu?*L)L(>~hZ5gLv^_s)u@^^4Y(=~32rQ{rJUmsT6tKzf1PC1&HCich=y*6#6 z4y?$nGrC;VI=GHiWaaFiHB!!1LR*ehjwO8G+z{I9w#xRk0nnr=X<5vZa_58PMvkwz z5m%mX)Fdnf+dxm4_1!7#s9wc<>4u)L(I*8XoYGyDmNToQ<}m@Q!xDMz_vB&ZBoBOm zS4dE6B?r=LiCY*0IIN%a<8#C<&jDyCV*GMR6epU|^{3vmzsX#e(3oo;p4{fOB7)f; zzdQIQ>T`B{{hB%DqL@t_*!~99g&y>POV!v>!ARN?h!|sY;aL5Ka%=9wdf@l%FfgZp zXV!VW<5|>@VHm+lcpA755TL}LN*De*oPGVnU%yGtUvnZh{oBDMDIwV9?+}Wq1YS7^Xr#R(xb6K} z+64GV7gR%8Ah)9J}vJIb{?3hUYc_~cG5sPSXH!Q$A>ZkW@I<7oH znV|)89^uFn&epXD!9zfmIAGuGn_!uokar6d7CVqd&t5Z+3uV{ib{}#(#CLzpZzpEM zUl&X@wuD3 z*r1HyR)97Pv}WY%4mlxFMB1NBp zq3#L^`OODop&;LMPpT_95gFKu_0SXsKzp*Z;z|}IVcCyVYTzyVSXkN^@qhQ!$T^ZH zV?mU!&D;gEA?28Hs^b?ut*k+r7m+>mqHi1Y7M(y_JffPG>`78IE4*3;V#lKjg|sqD zF8u42^sgsS{>XSwmJk}iNUmwd?1N~gX}$bi#7Kro6U|_I%200K(SmE} zO#_E5jntkqn;6nHkfY~1m9XVI?TGa1FQ&9s{W8AnPmh*jE2AEk~}L-;>UEc5bTx%eY+x6PU#a9J_MZ#Ack5iTE=Sn2WSD zI!3CvX;3(9zXJ{chdL!0_v^ldZv&#h`!DJ#gGCFMO3Wb^^t`&-Yx_G@Qw^ zL8Vtj#Ts+=yYxC^(m8TX6@3QYf?McWRS9)*cd0lL0xT9pOe)`X^sF-DPu&H~x7Fz> z4189IFOr8kkb{%;8ZWj5{k0}W;4gX|4Cq4fzYZGi9XOTK z!(!EDPy-vjFnzW6^yHw}g#7|L;%nBw$zFndU2AT;lAc~+;qBiwc)42ZppcA56gS_> z{O|g^iT&XjKXZBzmadPvsFgm?t2az$@y{s^2QztgO0bJXLNo`s74Taf8xk{hn-CTBGvfVE)j&p*dVP zvIZ(fTv1*76+K!nO(yv8dzD9ndCkQ9-VO82G}bMx&*}S1eh;!btt0#om`zcF2q$9J zHCi0nWCmMz--mHudJ4Gg16t2ZR+85ed2C0^Zo&ozy@|ZoZ9TeouH%-FCIQNdXDC^~ z?u-fKfUrcv(WPhw8j8OP){>Y1BK*0ax_H&o;v1#?hC7}N^fo?2qCk#0Cg$)6U0q7PYuFim zzB+rv*&JV+)5PFehi<;QTjR1s#PWaz-p=opl|8^oe+p0FB=C4U(Z!u}bCkeSgbo-f z3G4BtiAzf)S?0AzVcL(1G}vqqKQU?i51r6qMM_Wt?%$M3i%4-rMbyOy<^Hj@#}gaK zNiNn)uo?8}F~Htxw~eDPqrhP(oM<(X%jmgy>8%UZLy9X%Il^fwDyK(0`TDq?|DiM9 ze^pyoFafWPgeuuZDnf0~dZtDF3mEA{Z{?3*)^#)TEo_)4CMR*Zc3{Ej7b>1Te6eHd zn&#IhvbkurdUG>Ft*eefB2!+MxlnW$4F=1XDy0afsm7c5)m*$m|JrZMDuT^&*Z7>3 z{aDPv)2j3F@_zm$jJ@*T>oA030C@K4B*qP+ml_kCKL2t7vPc1hEmv{F{JMb`tVL=? zHh&Nr=5*byvH$bK5;s%(X?pV8N%$K!viGl$5&m@7?)O}NPl&wKd1D-Qp<$+cM2oXe zrX;WAqs%ht^S*xUFFbOGiaz_LY2=L#R=b&pj9${mGl*uXDHm`7ge&^rh?QxS+5c3H zz_{4#$#%ZV?nK9@W&#uady?^M@b6s?zmNa#y94s2VfYE6)RGeI_qCo_ymBL9xUJvs zkdJX8U)kXFGVA{-<1vN*%^Vc$^_KbN2cXs_aUIQ=sO7z0x4jpYllEUKr~@sV8DMPv z8RGAq3M`EFbn+7@PzLMQ>jV6-iw}JXS5qY3DJ|cf$$#I)@2=+eiXR26aC?sGhtQ5` z+f!5aW?J0=@(k z`r5jx=Yrkg@{%XsvrmG$zzxml%L|7f5kb}Swe7m01zr3#`>ma|=`Dd*X`W-=S3_6U zsYf3HYb~tLy!5f6C#LAhx7dzw@*I=UQi>6zoMgTRU;`ASwH)sP0X|8C&#KC9mW3zVu;hGfDYnYOb=CDy z`NcLh=1!C+BhAb9fy-Rc#C=k#InE;mzb)#{nY}YG&XcMzBm5#JEf!_Tcfyg^)wMUt z|D=sTmF9#7lh4S0`z8a6Iy`!6iJD{xyTND4kS4QkWwt&!*W zor)6a&qxu_7K#Nn8(G=CxolWL?LlS1lg>7s&st?{n#c%3PvOP{Sv1M68y@C2ioxIb zr;b#$p|!-i@5M_fDw{_4nd)dYlFUk2{O(vPkfrs#?0kl;k!th>ToC{lC-Kv%hl%7b z6u4eKvnOZTlYY2F7OQ$O7?N!ioPfk^LaSq&? zEg2X{&hyGJzu1T6XlUj+8z7hJ;$R}@KIzU?7}Z`sTJ^TvZOyJ_J;XqD0$bQh%1IjB zax8t$Wx->>9DY8OZs%J|6-Tpk{Ef^{&4xh_j%ihX~5XMT@J-hrc@Kx zT%?!jJD$qL_AIT@-mll=}i)Z2b#yIAYzxr~JOmleupy+EaybA78@E zT-qG(7hsZIufI{Od_8KPy=$KYKU{Zg?)03)R6fc8EV^E7;Le%kvlQ9 z6PFi$R`|f7j^~shK#ZXQCt`*4&X61!BrEkxhqX_^Q$N2c=J3Z5Yr@T_H88t!tBE8c zPuB+32K=>N)Jl9ON@8>q%K#<(SmI;L`m?&q^R0PVKujYrq$zoItQ~M^&F%4P3bSDX zeK_JJBbKVpKb+ayZ>l9Qi{6Abcg?DGTZIw7knbp3V>jDKqZJn(eG%1RsSrtcexy^$ zY-m13$%qs>kN=5wV6~3vOft{xdz;-Y^5yn(Z(&zdYe!tiIMn z(me6tdzd5v9FGJ2%aF$Bq+#I|Y;tHm@twt^lWhus-i7#80X#ql;HQr4T9W}1bh(E>f$tS4J5{PB>1%y*-yywQ!m6=hf z#;Ox$d4fkY$a`*Zga!|j`sY++-OnF}qN)E9)(8=EO)t;k3m$u@#ZL_qB?mRGS50T~ z7N!o3?12~I2W&A&G45n z>*iAh5mZ|(-ie90yEpXzp$Y}AWnPZ7kJ{%E0l58DcZO=oz*Eu%UrbS{TP%_Hy4y#F z_>3$htZU%!JqW{^TsFmw2D%q}6v~4f^8PR3qhcC#o#@a0)S1>>D}jF&IN>jk-V$)0 z+)-XpG7GC8jX2wc6wk}P9MM#X`tHP$=48|1#Kxd(H^c4C-qmz9x)|zL_zp=?rA2dn zm!}Xh@sb+7?q&}~CoJV@1nQX!8;^yNXkE^IAr7|)2e6A#-zb`d<+M_)e0Cmy zie|6GEkiHH!iGk3zpzhssfpDebg~Ev<4Ag%9p7Wdm3K%h@S>7 zL@`%q%*-ab)U73}@mW4HPj_IaZ35YVr!lLs_NcHazAWR%f0#o%-0xU#U)2hkYW*e_ zx!Z|acsYR2>IxGf^}HzO^@^C`?5c`bw!|~Gf2WKdAcD|Q(Uv2!o^Z!F%(A(!Kc(?4 z`NCWzl(KN$KjgB#^jOLn+75mg5^h~R&RN>qAvL)-ESHw@B;K=*5g3&Xk(8>ZA!fGn zS86wLsp((6;3}4GS~JTeoZ8N5RnbNhl}X}MTmcI?mSp>}7L*n>wiaYffjhPsLV4I9 zC1gaC#pX=km+8<^Y+{bOm7S@S1_}J87{61C0rhQ+U)y$O^LqN_NnbP&>!sDMsD)S8 z&1-0;jWs2?SA2c0EjcFJ*}<0MgI_{Ebm8;YlG$?r6UhE2j8ghlewmzR+@9n6?q`!p zai&VnS9%n)5y?mezSuT;g+fLpJ^m(Vm8Bd-{|}YysMK98r5f*al9Q$V`3guiHs+9@ zrS?Sd%rm%nb`EVWYO60H*}$^6F8XL>(YD1|hw&~{geIgf;RxG$BJr?7JoxQYq634sv^N_gwz zlam_TOkoc2U5jH8HCIA+uyZgJo>Q53GZZq0O|Kg&%n<=fvzI$Oa=ASe;iuZ2eBrM6 zOeho)-aim+JgRnW1iOx+!Ua#38|-;c2Fo7#FlLB4!mr-$koyCRZ4%imYOB(IeLCrn z`l8Q~`Dmpt72w*4FD=!N->{ra3mE0J`?13lVZ|@89Sp8~=~bENSoh40}a z0E=nWhVmp`t0O)2s`>m1wid$T`rCa)ACg!v7kDYzKem_oeH9(KWzlmVTQPTg%i{{r zs~^1+sfirvvbEiLPH%0NdGdKyIIgt_QB^j4oz0QSN+iEBh=B>m~=8=S>L*8)M^STMI!kzxo_Nf!f);#zC)L^<{vK+cXAVw*kcw{QFc>1-C@K% za9#TbY8^TMHl431-{a4FzvVQxpd*d7$z{|W2#F8ja?g~td?;gcLfpS1Y#lDMepp`G z{T*kmV;t;bkL$|rTCOC@0W2C%rPOxFbv+wXE@}f0k~0NiJ;69}`@Q|nXhgEql#flP zZVNDqJ0*o)N?Kcc15?S)4;eGE2Q%?cQ;(Cs!}k58>wR^Q0n#qR6J>=3wh>i45c$e( zKstDNVBzhuG6vY4{kpE`Na!;1u4t4==~?{MZl?(z+^!Q+Xi$PSB2N2DZutOi5jq#M z;1#A+oxS|3U7@lDXiNvf4|6YxI$K=~P-~X5b@q5c69#8vA+*TG8$>!KgV}IYhX^1T zVoLwTv#f~oD^7J6KR7~s_}a87tw+0;l+-!=Q;Rv|CVp82^`7DOIz>yT?RhU9L0~KI zQ?5^3$>>!ko^1<-9CQ&_ahlRJRwXP_yOl!U$6;kZA;s<6ieL>*F6UkO#=~eh(;vzD z!zqn=)~)R0$`t$`G0KC@zLDNPkTrFvFy)0>xivn!10kwq(K^>Qo=k9@O5=5=%tvhG zx7Fe)?AFz_PSDP*O1hW$R&GDK`wb?Nws-ni73a#5-GCuLd)Ym&@(4X93dRR(j`uGt zx?U-v&0N`N;Q!L52%gBIDCA9Dnh}s*QmyG~HO-&#>+?r6@!)M~(q8WqlGl{iQ86gc zTF<7;$~67xU-cnON$Jqu5 z@+1Fp0WkcMo_5%=Tw!6;e(pcm2A^E_g|T14KoR#sz7Wyxyr$89&;P{INT~fg)dXX8 zIiRid95Us@-mE4UGftZA9boE^JX7^&z=M!~ScG=W4B6wXtlV5I?veE0kNiHk-#-4~ z?Vkgafd8?H-&`#r`GK^697gs7*h;*G;}6?V?FR$@4fi=P=Z*IcgW=YDYIL!Bj+*~) zG>Zb?p2KOhcs)ye;;11c4T;Lbh#C=Ongv;P15cGkYNVo5+FT#_}3%h7|S5 zO-c&s?-Q8-Rh=OU%iF}PjVpp>Q&_?}FOBbcD{J#|qPn8Ve><(7-FOqOd5Q7>)?|du!aEhp zSPh(RigJ@xIFb6x$&70Rz6ej!zUSx^1T#2h)YFY2z^B*SpKo{s(*`L`=hWE*CE zV?^$#|2k!ZjrI3M<1Pf@>j{|Y0*}iC+u|@!p3gG*^5^^qARV}dVkIJ!Fonb>2si~_Y}?u06igiv63oL6+p-S0|V}6a(}P)-f*Ey;AN18yREdcz+s@0-v1QT5Ua;B6 zyog9v9b5I7HR^{Upc;;>0&M~81L%TyPX#YRUnJ^!)I)t4Gl=7r-$8i{ous~aOvSt> zYuG*vcf1EN@xJk1P!P2PwX^X>&COCgc&ty&Sq2GVIYkaxui~G&T|^Y}3B%(&J%Jj# zi;HZ;p99F`9E_U0cgH)DL`Qs1+aVl+khc-qvCPWGqW_1t zw+v`&ZP#_%(v}u&ai@53cPqs;xVyVUaEdz=cXuyN&=z+MZpGaK!DVNDvvaL)t-bcy z=lnVR4kV0`@s9C6&vjo<&>>|0<}}|7@99Yt445;qME(0q{o;l9fnCeBtn!$7-Lx*>Z&rFErm|W?02x~HV?=JKC%A+7e*i3;3epNA zI}=LBsI?Q)pN<=V+@bw3om`yGk~dbuF3Rtn2?<;La{Y1(H|JA@7zK;-rD~lW>Y2fl z%uZ=co_*gteaGpFHa-S3IH`t26Y~6=80njFdiS`q#%WS;a4_!9vsy>x!Dq(tn|r)z zR=j=Nyrc|i#q-K4TKRoa*0f$7oj~G6lgx_WKPw0TddX4KKJ>HiTw`#dyw{W)4d0ID zOn-0B@J36{;ryGSA-^zg+xNk8+aY8Eq&?Z&{a`p}%WC=akfP?dkGevRl25s#n93p| zs&ug+8gU;Sp7sXIzUV#q?CbEbQR!(l?+*uy1n%am!}i}^>O3`x$nnz&G??T&c7&m* zjICh?a}2%GB5Vq)W#PPF5%i&rucDLkxwu;kPD0E4=?c$6_RnHboK^B7BzpThNwAOZG`i9P9<21jo#s40)T?3u#tK{VZ+d_dZytW5bE*pNnw$x14(+I^eM z<{yk4Pe+ioxrFY|NZI(Uq^3s*q@cTL>}>0WQ$p5a(1$Yh1K+sx2FI2tl1$~t4x@3G z7?-s-3cQkIVnJT{G%-B3$7_(Cw$X+{v}_mm!_6om8!-!SG~u5s+`I!Fd$?0# zu=4>{$dVJvLiqP689MS@J~d4McO!VbJ0yOr@q1R1+@n>h-vrr}BV=N?)G}ac_2I+{YG20x>0#uMDlJ@oE*?-T5@T@*6W|dXOIq zQN7>ik{&8$+TAHOEvMrOO@(z`$Sv+wtkR?y2sE1vjl>dbS*jpL=bf~)WUwVA=?oyJ zG5{v}b5*mg0Ne}xczy0KJhqk4S90WSay3O7A}k3f?O}@?^Zcyq-KB+|cSE77UkFQVrE-iz&pf= zIK)9}zBLM+Yb)=$EBv`l{2C=UI&Tw~Z+ownqWVc<&sAyFbA@$t7_|eZ)~umF4s~@A z(z~22P)5iEHad!Y6Fu~if`Np%4YSn*YDJtl5#k|}+I~YJO-R_?2v7Rw?sS`{#1L1E zJ<~ErP#H=&ZE0<--1-+t03LrxL?49H1UX`2E`=`s$l_ZkPt^-N!THc=6OA6MVV<&^ z#jcqC^zYg7Zvto5H$o1N)2y!f$YeT;YYNk$l!p!MTth=c0{70|-N#F!qM`+{bm~98 z7gav~Iym!#ga6|-dVze6AzP%5n36YJM~N z{nJm+E`kKFXJWJcl<%LF*<1jr_Rq^+{LcoYoa7aZaR0Si`pKO7*gIiZ4Yi4eaL7qgZ0 z&LSy#)kwIQi=z;jq9^IKKCoJ8CTm8AblGvuOItk_xdb(_49Z~j8O9?n_e|xLQuEag zV&dfI5Xj_VFsLPHhf|eVPn%d`FACrRy3xJ(=36;bF)+%v_Cp`lXo{>|WenYJyFB{2 zhWU9j?e~c1(|uipfPiZjV=2`$i#G3}#mf$7Je$vEAKb}3E;wpl0Js%qgA*tFMNgar za4X~8_3u%M8BHC0HThuyCju6Qee_3?WP3IjfET2_crJWc@b+QJot3IXV4VW;0z*{X z(8w+-=3T82d@j}2Hg0UJteh>6*O*( zPwl%7^?6!EWrhGGcXugm%h>IdP>Sfc6#L8$lFY8Nv8zQx3gix9RH1W2dmj)j47#og z{>3v|dxYFlZ)7yDv|8~AXm75PYAR&>usLAAfGo-;^3wQbdrY9J}pX zP}WU(+HMS7=}xM&=dfH!LAg3UQ-5*x>91ZV@DwC(#!E{#w3c@~_bqK>Gpsl|yIr-2 zX}hHbhL1WPO zKkqEkt1?x0dW3_6Q5uaUUsi(bI@J?ttbK}3&wMVmPm?ljEZi3-mBd*PszV39MCY#+ z)I5Pt6m^FWaGk_tkP-euLWmCdoHg55tG?i~yQ2c7cvXNTwsY_0CZqsLkTVR?exvT| zq#s3$OI%@8tGV_s|`w}be3KyovTk7Ijt!riKO3kO4cD2$z${1(5E;K^7{jrw3jbLR_b2(`J8C z(7U*`OC6WZ?R{5l*jI1Hfv`z``=Cjz=H341%#!N&g1fDu;~R0~VenDuM>J$2#fLk) zTac2y;P=z^W0CL2c^yge0}I@X6~X8UiVcv1e252_E36WE8#8!^8L}|Go7f zF7|mEz`WDW+8<5HIKBk@tt?gbP2CCZ#P^qC!gkVhNR+%!;&-*(46a5-iq5?xlDQcx z%N#1`n*rNHjta=-}mKwl7+9$1G@>3DTqoze-hWZ@V3Nsk5KNDPZ#MIw!i%&6v^G_{+ zUvuxH3{h~s{qvQQ36WA0T|>eSrQHLE-^W!)^Wv{%Opy0>#Fy4(_<|<)Ro;-;+;uE+4Qf2|)U!NETCNEx0xI;afUd05r$*C*Nb)R}R^zOH^ zLcRFaMPDbug{nH7b6Q8(aBSD=s_(jx=BatjoN1LLn_&w7CBf^i6G9 zAHU=XV-Bn6RF3MU0ddFAlCi-K%Hoc;y>c3TESwr{3C*~6J2S%z(NnB9<)yhg<%eI7 z!`UxUw2VGBu?N2vc~kz1nVn+a48IL4n2|GSi@fiY`}-*d$5a6&z=l-?uLSrzSsb5| zK4W`@jU|s!(_rD3uH|^aZXhnG#&hEWUXJ7*HDO-PR~&O?uguUAzv@Y}^WU3>C3b$d zm6ogVQc}Hb+PZS164aQK_6@5*f3=9I*~f2h+(mt)D5%)HzA6Fce>zzv)cKF)2;gh&OcgQL<0A2UsQr4=u$y~v z0JVKX^kwvRV8Gc>(haoT6UWQWCC|<$!o9*s3Cp2;9iL5<#V8vyk~QcWD@X``izhp7 zoFYDeQT5yWA*&9vOS)z~=p}6csNj>4o*_rI6kVYPK!2n2^ZoFcbvoIpb9%W^^+Yw2XZ8GMUfEBcCW)mvq8qMMiH2@q zo-o@%R78f$mes!ms81YSWKCY#hxpJ{e&f;&AjuEzk?}N$#Rm3O)u$_J>{9IQ?c>I` z=+!dVj^;DG!nEcWBSUDvMeO$-%jFTtXRK~W>%8v^Rm)u4Vk))9cAJ|e==iP(%Y1v> z3$;pCJjBu3v=AO6Kd7xllfESBcu*-9RQJRF#}!pV7~;IWRhNcT0iAoqy6GEq$S#?-pu7QU>#qsq*l!G?w>=3bkyBp{cyP zUJ=G$bICz)pj7hrZeU5@#Q!DabJgN=;%dCu6VN}7&=*5>Fiki!V_ejK&YF0{ zeb4E$Wg&84^F}g+(|Hp~yYrkAI_*;6JuG6Tq8)ITp;!m!LQN@<{;~PelaWJMInKS* zPwp~fr&=Ar<~fk6#`q=>>`F_|HRcmrMKHJvZDbJDi&CQHroB?FPKP zm=AO*sy`-B%Xo#PPQADJ%~U068CJU_M&_KhFVBkz*OKMekJDK{-zF9IW9I=gZPQV2 zM%1zCz16bvy>ucsEXTs*@*^+sKO5MK!(K-t(&?_niT4W*dx;d>O>}T{DxTD+;w9Dc zZ+AFWpE$0=RaCy2>hE$-$6#l5(OwiXc&yEJ1ow=|tCPjjwq`CO6~(3*F3HF-!+6&o z1%4KoR_+u)hdm@7_X;|ytQ$cqx#H$;#>?2VR&<*l-UeH3N_`mPQN{{@zi%>1Zq6hO ze-mJAn}RFDKe8ipDyXF{YVBT_FZZI0)1XRK=+HsK7iS*~Xa|3!qBq#eDQUQ(G=}($ zmY&r%By43Qs=KReEei^}vfLGe@xM@hOu~Ed#`TH!br%x5jH{)FbyXBd6*R=>=+-?aAJ$?4w?V zYk7UGwiGM-WM}dh)*K&9EnmX~EQGLaiTIGipKEav?}u}4lXaKAbmm%k2{{=!idNPO zeUGiD)XiZs1-V6~Zn^s21t^n$m_pJ5M|}=Jl)aZ6M$gNi#sTXQGH2T-RTElFs)&NK zL*&ZmS~1<2AUx=>N~iQ?V2}p*njxT2NEdRH(&L!yeoEiOk&q>;?I{5z-B0I{%h(ow z%#Bqmwq8iI4{IegpFJ9ycb)@*UFcx&RC3s>HPO>RJaiv1FJtYuoXckVg)NRJ<*oLY z5^1;d5@t$1B>P+7_l(aT1#zv8QN?dccQ9ug?$qtn%H@Y2yi+}t<^nx&=C-|BUG#!~ z_BN1Hc1&2U)?!+BjmzCRng#ztvs)6tf8|uX;uQ)L^EMUgaob$QcD+ac<+MQ332>a~R#`o&E#Ap6Ld@i{*`4>AzEwl)LXKj^6~bt!j>kt(q*cLacF z&YGdqq%ccEUog)dPmJMuiic35L`Lf!=I#toNxhr46cy3ro3Q;|d=M>%PQ6YeuW77f zO0bNLse;8xQOpKH!uTGeEzU7|o8hK^p8Mg~nCkq-Xavp2!68_EC#?*DM69CdU3m1z z;m}a2a^u>hIeeECRWTlxurK6fl}V4y$qcG$@d!2QbW_X)wcp{3<=OW38&}T92wfcX zT1e*N3Nj?3=}ngw9rWzCUD*_B8{^ap#xqyIv=@ZD?3^5hKNhnQ>?e>2x#`NJ`=A88 ztehOV&6>8AlnN5V;~=j>I>;vf=(YuKQmD6G;@K#_+KoeEK3gRSE-E{2xXRfmsj_41 zYfaDa@^?K&QWH(Bm1pVI%ZM-eO4vCV$d00!+G}aKPoyH^oh;#+3d8O7vLn!fAhZMg zkorKX24^Lg^f14b`H8S%Lo!ugO;L3@-Q0-2mI+PFVW!!9+A=FlLc*rfU=iJn4pS9~ zi%IwiqIB1sTO)1b=y!z!G+AxKE|W5=vdZrWH%N?ST@bBGZI<7%l`~ zdm`#}#%j}?=$~-SoO&BYXwa zH0yRw(0YXphw+dw-vrdn7r=ijr`=*gifOJ7&?!kHA+7HC9#`+;R4eKBB?3?hUoDAE zRR4;7zp8c2#MK62$CAIIK_e_S7*-VnCNzTw9-=>OP`^0bwc*sF?L7$1!>5}%p(rJC&7rAS&batP|%wD z_^L=Jek|tT8f_=vLwozEa#dJ-l*$$#Z8fo++;B^$j=0v`;3~re(5>BHJ!Q%yxJAY$ z57tlvKRQBuhsVl;ANgigIAIaX6_ABXr_UqNGX^HYOuQFcrsOxOD2Cxki>)?@`Z7VQ z>dO6{f46~?;9cxZAHkhE2rVQ|4nDR2`ScW3^W?DZPXFBUJSuV%f3|ArNfdHO6t88i zjQMrw4e8g468jMKPn09;raU}l4pyT9bH;g!H8TB4gKeG(jr(GjR$YRzRkW>gCKj5W z`MS_*>BiY4SS(>jmk#H#E7UU#bUPF}s-Nz6aK!{suea8>)g3F0%Zn^15Q$G+&s^>g zbiGE`Nk8aqSd#)D0R>}!oolY$jl0{}Dn%Eg1hA5Yq7y;)@xdBXyTO6(G@iXvSGV>1 zcOI8oUoD0sCUx?0nM$jww``l*|L`~>Bg2X6Ty>{Um{WC7q)-UbC-!Y>2TvgJHj0hz zc75)C0;fw|Vsb7|`-yDRd05!BMe0=J{BKohPsljsX|=sNNY`Dbkb_fzPC;WmI!&^; z&MPT!q@cL!@k%}1dm1004Ti65E+5q;%#!jX;>NeV5Njen0Vj-;aLKrUlI!9wr6Rs(?<;DtQ@UBttS|}AMsnC` zoKI-%pEKo#7hxb=*g%!qHHc`Lves3gSU`vN3QT>f#CSKb+CaLkoP0%S$g|{a@|uc@ zpNy5$McCB9d>;G_Ga})iT0kqd1Q;AXM#Mb>eF#1q;77v4WJG*lUyw-=qj+C~_;_y- z6p2^sk#Vu@Yq{h548N}_NGY3@+&?^=zpB^!ms1Hd`XlS%D)5(&+^XEg{6>=zOLSN& zZBi%NqU9Qu2`CJvj2a*V$GrH$8^A|(Ul;D$ParYImFdCcdY*yVdeI9l9E>ol2(Jd} z;c~ctPXSVr9m>dk?9}z%;dle_)xyT9KPV5-;4}`VBO|07&M1|3PRxyj)TJh;Bb*yx z_Ld_^3N&x_D_-4LoXA?)Y!QY<2*%d>4wp?3&be@%paA{;zo$(kPhQ^N_ZJ8+%v?UdmqsqWABq!Sk^t$8;BG8MZ2I7Q4NjAC*jH@A)~k_|@6R7a@jG@koV{)8M{j9_Z66y*NVQB+Ygt`N?&*P zi5ZaX%Os*lMi6 zrFLbyAshF3t099!Qnkfnma(R1iV87znjVds_a}mOF?@~`(Nogr?ESftIcZ&`j8xrU zIJ0akJ1<@AwGC`H;#549!V`-{b+fW{WvoM}s|gzKboPFXy_jg)OVVaEy^TfZn~~Dl zKn%I^alcHHKjy@EJ3OiQup4$EI#m>u$_kTWYMBl*u#XNcD6wZ=2*61*B;R>DB;8@C zykj)UC}DD5$DtADH{LogiP5%jpW0~-ls4SnHRx?1i2XRHSS`9j;5ABn)ob?IiAGQ# zahg$bQB79eOIE^20|%&p-T+ps#-^Fz&&*J?a8W3P7}YiUC%Z>%8=9GSt!pap=zLb2 zEoiLW@KN7Nvb@ofm6XdZfQ|^H1-0ipCQF%=olVt5od-1p&Kht_4M~nl^3HjoLv>}8 z=cV+l`oro-{byqQbLG?&tGXtEU-!DcFs9{{6hU3WU}bk|Nk-$*XryOK9zM#E{y}w> zrZg`Vc8mvUcauI8xg>8lKbdkUPPAHc(gLlX*4@;PLcxdA#8JUyW$9L$oVA?T=Rs{= zW(yk535VY@*Ce*VP1Ok!qSvgK#ZUW|)AW~jtn@O=P@+MpAXEv;_-D?Ydsv!vt>ZCt z_UY#fHj8O>n6J2cL2DV?2J zy5Rf!yw z4KO#~$B!Sj6$!hM$14!|was^UEPgHi7!-C+Hzg~Ro>Ngm*I5}n>_D>%4O@D$J;-tR z#fVZ2G@CKSHamIXq&iu=p2pU?UXea3E^N@BC5JZ2Gn?{im|90ZIUmw@G1a-AXEMc4 zU+Vao8g`?JHE0_r@H%CQA6>Oeqp-=hBX<7Y9}-0`C_8+QS-KvPHiw?cBLnazU56#K z(OaDk>ocK9hq*pVX{y~s+@4Z{$>*&*MDp}3Ql6Ru3+8NTdF0FxqZt)18?1fyQW7c}D+R6#QPOHSi$3u;VcWp~;J%eu6GJ9(ea1Fm1cSO{E8Ro&Yq7!9ef$cEWA`a64 z_~$RHjp)LKHy~wK1!k?Zmf-UCuy4#j4ruF#&cmq8uPyB%j7rr_H2amlzOf41(S1p) zNi$YXm1}ls*@~&z_8W^Xy$vc6C#zy<+@z#5^S$$6D53b^(c0MO8W&TCNc|yit1G3Jotp>X|4X4$()ig+}yluo{xLkD$XvX~`vkrv2Z| zSDV=P z=^kXQ(PKj-DryE#mnjO6LCG$@d;NpB&at!@Q});zgDi&H=y^G%+4$+@HfvojVv>hz zyZNgCR-@Gv{&N`r>jGB8So>YtVU1Tx$BpJ2`LQkXu1q~H498K43OH8^Ak-0q$} zbvPrg1=X2{$n^$N>0q-@&=EdV$|5VPS!s^t0f=s5b^&

>$E5Bst;VNuO z=;j!T?(5JQ*^Rj5+X-?@o!;xQY2;+|nmMSHQPRRsviwayIyAFHP4CkirzaapucKWV zWKqnL*{_u{?RMTuN(+|^a6~+(UHE{R`ID`tcI)nqCas>c>%Ak<0r*WS0%v~*p?Lmu zgGQB+@M#DYcxGr!K{w;}c4}n2^!Tn~x4l1D28ei0uhHrXRXs4q;|;7jtM?`sIwqmZ zhqcf6Z8Y=>w(Rbpim>4)p1Xawb#{{(s-CFNJEHtLiphyd=U2pEH3Ck8;xvn{_lBQ= zw+-HH*;&`i55Cg^jGc{F1Zyix>|L?Xt}cg$cn2ptocPx&WBWXi&pII2O&GYXfU4`g zFW3!gEI74b-!T1gR)52NF;q?@JUA`l!mBQ{_bZ>|s%1s;)W!tUpE%yPm%=k&1OMq3%q)Fv+D6rz3HzScD$tC{jQL`?7vtfx$9ck*m z$NqFyOr65}Kq z2+qC`$UeHuNc~m97`?0VZm=^htY#g^Y&A$0_yYa~-%Ff~?-FuNuwzo8?ft+&As$>f zja$%I^y}Lu7EfoB-MhKBE2R1}EP4A`|GZt6R3F)#NEA8XBOLE(qE-9gCRrPW-Verr zpZP)5G-sD?2*oA;!XAF2=ie(Svnij-DY#$$JDCVG)%^YQe~&rtrNuHt@wI39&;G}( zsELMLEE&k92ZCm?tjEq}w(sLpKS~ z*|cNC?B7|DE2MAOCOl4G))!o6vn$k?V7`Lv&72v|S}*Fzi~spxcRyjK<}gHEpLK4h zqSa|uwIEBx8PYNx<-^e6zlaoaR9Z6L)4HhE7@ud+=cl1BgU3t2r_)V(|1!&~x{9O) zBpi?FS6(4VL|{<|2xP@7A6@!HV20D-5=C8LWzt`+CAX@+In8#gQUANGQUcK$)MREp zR39Ji6(As+wYm+)Xa4<3es%(2pL)5&JN<3}W5wL#?EL;>CEJd-LR6hh7xT73o%Fax zBrR+%E+&4HQ}G!^{AQvSKuEp6lY_)hn+^}N`}_e2{`_M(>mDs{#qq_0BVq9;^LV%7 zn)3!+gWEPz0H^qrjkA%omY9x)C}9m<*ne&3?rpo@qhv@8Vt%l){i6Sq+)Sw@0UO;t zocT19+qHfXa&eDZu!|8925QjL|MHWGtgIf^2#K)8b<}Audh5}WA~=e;^@oGyll6e%N}R3R>8B{quv7et z11>qZ?H3DcuHv1AMQm#~e+xiY!%?)16RZfhRVSe?Hy+h(?HkmNkw7$RBFBX7iQd*p z3VDn)c@9o}FHHgh}Odf^HbwSXS`oEu%g>&?EC($L_hi^=1WjQ2XE%< zK<}GZ`8-tjY1(ps4(1o7OUS!ue3NGae)qdfkP=$VQ(9aSztK=RYCW&QyXhvcjE=(n zu=R`SU73b_QoKMpR+men(n#A6q-_bY!UV|x=X#S5h61iTg|e;FLy!Jxi1N0D+!dF# z%sJ?AoQ%&2mDHdahMnE&34-K%$I23&Wy%T%C7?N;3r3gz9&XB#+x^nt31*lmW}tpd zw=%0NE*AC(7-Rxq$H5#yu-y-#$KSi33B&SuQr>ksJy64gm$kE(W?@&4?UsBOZ=9Aa z1p*=qM-{BHV4+pP#7XVwv>1fRf+GDYridjj>(8((I29P~XqA4Gyu-`{IoxafIP z#Sd1(3)Dd`o?+QJQvUwmBf4BZYkoJ}F!601{s%UzILpjvPc1XL%LU>l&#@~@%ktBN zbE2X2T&`fciij1^eiXe6l2z4dPfc{6vMN7%bgBLD+;r^D*wRnf6m>rz+V8N`EOQqU2g|iLUu|EDob6rdX_HG zg{=uQ<@`NU@D}snSGwH|D2f2Qf@5qW8sAvH9ZLcea0y(*rHkIeaLO zTdBm?2CbpK{tkLrEL<#`zExga?o`=KXP<{UJ@D-^7Ix=ce{a%FDN`#F_^+%xEYPx6 zBCe#&(?$EahUiAdu95~}LbjbtG>9hr@4x+J?Xc2EJDZMWF~rISmM2gj{`(id)LkCI zD6Bs}fEWMhRA2o6HBJ!l_u2UwfBau28|>l#JB|vBlO<0w-O=WOg&Fjy$pLQ=o#J;1 z-+DG98R0R%`}Qxak^BW9=-(E5J{_MS+RP5tsGs?ce~${Vl^^6`yyIo;)K+hYfL~4W z;rjqo8wd3k{Q# z6F8h~+i@x)@%4*uMAQt_I#0e|Xg&4}xeM>YNQ@2dppZHt<{M<2p(3+q>6ay2Bhhv}#<%4?r|E zv8jj66MLci(J~M&+|(t9W*ORiTT|>r-42Cu*ZM=AXS?LOPOgsKKH2T+vz(XX9lL_} zCZ3#-5|v_`=oJ7yal^o5;FnY8#w<3*@3vKQ8d+)KZBoM6R>D)Qy{=*k9$s_FDn?}f zHb@eT?nsq;Ss^9!@ddDC`QepPDh1k`(Vj`GF39g#Ea#cvw622YEiw?r*R;a?>-h=l zXxV+j9r(TI{{}b4k9Ns(dR0t6Kc=kM7sv7)r_6SvwwZWt7V9NvB@eYUMMOi-;t@d) z#Bs&hz8G`C0y@uy(N%Icp1GDyKE%GELubcVQCk+kTd7~e)g4a&Ng{U^@U93TBObDG z5 z_=DxHdBA&&D&K_#)%tmTvzP7!P%h3l_5ptSapm}AWrTJpEQ`maKgwaU?Rb-SQ0#Hc z$H8!XjvD^7a4Q*eEc(%Ykd`$mCVi%JjVyDn==&^eh}F9fq>SUCkuqp*9d#xM`^@~b z_^!L$mb7l7cL7wXf)ntXbG@!*Lh2N;@vB}SVsYA*?Od9xp6|)UJ%v~r(P8Qv=JIhw z=*bvHW`z4TWe@Rq$!`8`m60el-?1pI0e5j0ck&*E&gTdW95~g zW*sUnAzFSsj8~@5)lfwP>w}w5!aAyTjvJi)aXztV9!&cPGS~!2p+>}%umX8U~NeP zFXu~>+r?el+F9J!w|WbI2@)bWfK>#rO}s7-x|VZR98Oz4xY*d$l>e@NWahof;L4=p z0D3Q&$(ipRqQr2Uo_~>h!T>yaF+QM!^0YP?4iQn>xYsxJT)aADSMORd_iMz@84l*E z_0HIQA@86n-|`QNCVJ*4tiM4}U%?&<$_~kYqC z4L?SBdfV50%p%Ww*g~GaRI?4UNp`fn^?e3~t zm>IwgXZmGh{-G`^CHe3y@9>HZ4bxeA5UadID~$}Kl#Hg`Ih6cQPX)q zjkiC=j!g@r5+Q$1tLA`@S#$qoc&8ju?BeAiUXSUD#{8r<@112H; zv!|%}?~XXF8AQeDk^3N;8{BiNm^fSmq1B;zA>xLwBm7dluPdT~8B6qOJtD6edZD#z@`X-XLf`JCzc zr>J_Cn9P>u#OcgLOBmn=XzMscc0K6{?G8Di-3Hp*#O7Bir66}tgx3wLMQ;<^HYq%O zq?enO@uLWf<@ktwF1=zo)1{}Cva>Iv@N})6UyXYlS#M4l@PeqBYSlp6GxLGNKz0|$DYE~>I7i=ScF3TLDWoOgq~~J)`22HQAxNSC68v7T zIOCo7c7IcU+tX+@>W9qDcPfu#JqB@2^&03{ul100{RuL>v_eEMiTp2w(~~ip zzWmAau%>fxx=P^r=fQZ~VSkWVNR6b$L00qWRR(^;m=Xh;bSR2DOD2DEtNGxN;B-7p zlndaO6^MmgJ!m+BHhPowmWVDu!xF`_3!^$zAl5bhEX|vwe7G5Mht)y4*cs#Obus8| z&B3DWYMb8Uwhbb-2*zSZ$M5(c)r~p_UM$8qCe+GngIKDyp_%NH2tnualc$7v9nXYc zDBk?-sX|H|URSv-nZ}$fF}sI9DvdP+O%pl=Do3F>4p(Nslr{%iLr^*nCq{w6Ta#@O zu(2gmvnS&$o+5Cyo`Qc(sl2&3)$q+~CyyWA^nC!WUmXvtMd*3d9LmME@p)P;v&ZLf zuQh8oPPMpCD z08tbEE^B|hRc`m;%{-)>8zclPS?(Xr|G3Tv5M*?s+9D)7C#>#A7g7_q`KlBAfL6b0 zP3_0z)|Q7;~Jrh$N{rDOkGXZaE5?{bZ&w#5ivtPbSoJ<$%~NK zsRu{Ju!3fs|3F&FK}FK#AL)HwN}U`evi6;q;>gqYYMS*%N3)rVVM%|3x3xWLDEc&< zFU{u{_qRL6Pihi@Nq!1Tuim5%;%}g%S0s-z@AleqQ(Ph}qM1q}OkEckb2(Dlt8fqh z?Ne0b-SwyOl~#;(`eMwKzDT>X)NX7spv=opihUN2Zw;52xv|)Fxw23G>8KkUXNG%W zZc7>PRZrz*-Otcbp{ckdZ(j6tMsU+-by;Ms7+Wi~id^74UPN;xGx;YPb!d&=|LBCV zgn&7e3WeOLp~J8ODb^Uo77uq4yYk18K4XK~lv7va@;v|fEnM;UM|dgg;?DeVTW1yK z24uD8JiUL{S}WUebgGPcDoU27Bo7al;!+oOp;yh`%bg89%r`m*olUuS6!OkZb#*~( z-zhNsA6ZmP>fqA&bc_23@4%LK923A}{*x$W>;HdGlz=CqehJQq ziIkyA3QX3LqXQ`gz^QZ#V{|QFrrdxt5csv!I21}cs%J4Mk7T4u&2uI%VG@f#nRSF{ z7~`u&(uRSri}QmeMY==~K5U_lrY6CZ-(_9d7oQ)xT~AIg@DaFbyitLTfVzxqU*eg% z^-vEtNQF>l6-F|*WLCtu`*eNT*x=Y?2tJSQ?=M0KRIEw(r9(g@k*Rn9m^rzLq$M@% za!CIu(hhfT{{kCx^DN?a8}>*e(|DYIv?NH8;m#{v5ow;W8}U^y^*S%ng{V4^|6!|Z zy`}dnA$~;eA_UQWR~QWea&U+2;2e&_d4t)g>&^ar-;HZ^Q6R$o(wGZ0Vz#KIfj-Gd ztsy;q1G{YwFN#HAM?Yr>y8y-YbgiJXYQDPqyd^8`PukQqP2?7xaXb7$CN(h-*G^j(RD=X8DQw! zxUgZ-z+*w1J0!q?n$g1{qH#-$%6-7YSKs0%)4)YD8951!Q+c;f8+C+(*e1e#Z>qgd zD-~3Ez=cmF<_YWn)B;MC^1_N+Ka;WRSzm47mp6(<5*J7l`HcvU%e_x)x(fJFv?pev z;r=9=wN@_R%ww~9gd1PfmiWUrq#v=09#~_4PHa+taAPNmNOuW#t-tBDEbQn7Oo_IYdV{5V&Ep5s9_Kpcmp| zuDTvYjwj!%lb2w%n4NiI*u-1!_LY*keVBhkx!!chit+x|%~d1%At@)R4>s^e;c3Oh z-YbBczG}I#Q@eC;4^M4)II-a0)nfB}d9|C;xdsz z7KMcD@+6!@Aik~(DXFg`u}a)kPU$|tMM^xa*CIYdId|TX$6mlkNd1j+htmY70p0#W z0kZh?1z&)6R?_VZ1Wzcns|T1uojLIqWizcH>2qrY+t=b$l)v1whq!K$=h6|Q>xGc_jD-D3Kr-cgVjrM;GXH_7B% zp(W$?`n#EIW~Qd|t0s_IMcFGhINtG8pSCj$-BiYd6 zd5&{KqcN~3!3-H0Hs{q-k7KSEIko(n%r@p+95{-~t?}aPgH2j1GNi*isPL{`hKDPD z)o;@&Z=;(m%+E6FYP_cluxHg2=Y99$MpTG=2jERco)fUsInL-Cbo2LBnm=Nm}?)G)ko?sp$Uy>qD;k4?+UwCY9o+O29$-{)X&c|>u!!Gj9`I{aDUtO52?$J_bm+1H8sT)5Y4SCUEW9q7Zt7%$VBtly-c z)x~!#ryBg|S-M(ZHChqwpGJa*#(kPi4eYQv9NpA)ds)I(IF%}IN^yyjPup0=$P6I^)7!Y6C61aC zBH4sHt*xlpr@RlvZA0F#RMc~Y+Fb4>Gbhx(QapR^x1z<4hLS^Dr&qW=)`~M_N6Hg% zITHJxkL-hzuLn4(Jok!pA_X)!eV4z>pKkPQp!p1A)eBaMq-FN=de?5yjItQ^4M?1J z)}daoJ1DsBoDB+fql(Ko#O&G=2Df$+J`o8yr5{yB+7-0;lcS&$NQSqqu34+S~1g zF1|Ep$N9QXPOpHKZ?_|*+BE13SPBT9e@*^+da|Y4o#T(%d30^j_j}BV7%Y9Yw7^K) zxqVP(b>D8+Nh%ckErokoD?HjlP-S z)~n>p(&TZE&WzqOT&Ch3(%~ck*q4OsHM#+p_qoMXB9_>tZ~<{)Z&-E{@x`zoKD4h# z5I$`-HhN)0*D)~Z=^^G&wx13=zM#X-yA#~mZ@j>h4Ao%n`em_2-^aD<%K4$XdOBmx z>j)O6UB`U~Pgf!`A6q$sh@>@ouny?p3~%mnIC1LhfhO@9(Bl%Vk&V;6d(7=F9P|{4 z!suQ)@s>wx3SIiOW3*o$X>oy^l$)rcIJTyX0&@*=K?^RLN~0?_exZ(bO#Th~2g}bLL_!me{iJBn#>1taUMl zsvJcY!5lL1P35qeFz8N6F9UWq4v!rcx(_Ro;l@}*YItd9*Ux#DQg@)M0! zYrT$7kj3ON3VZA%$U3C^IXhk1`0+r38eec1a}Fm@)v9%#sKT^0Yt3ec_{;j)q?@+a z!KJ@l8sZ%>w_ZPf8@OFQL1`&GgbijI8d))YjfcP@*L$+8W!2Vv9H%RV;3IXk#9K|B z7W_lD;1%*wDWVFi$kq(DVqBxG9LIZ9d&A2dN*%WegiD-&ZF4iJVx{B?0-eh`Cj|2U z)!uuCHMK?UqNv-7!bTKCnu>sQ>78tqqS8cq7m?m;XbCC`(xrEzbO;b?s0kvyh8}va zfh0f(op6JD@9%u&eD^%(IrZLWuRnQ`td-0))|_L`G3I#RH{u%0j9*qznk#qAhpE{Q zhXo1G?(<8zEOuc%hMeA)ytZGT?3*X3Ha7Ul<-U4#OFQpcigKqdCPdyO?5W4nBzw0k zoHIdGc(VUfarKP0&Yn<@2&2755=*(}8#@QGl0l!Xv&)fzel(r`)qK;@ON~o1$kN;x zjBi@Y^PFJP3faU>*shH>)~Kp$ug%0a?Dc#U7UwP=MW2+p*5+oiHnC+Fx}rNHEX+H zCFHA$Y!|zA)8I*7tpGMrVpT)$G81*0tBl7)W7-~CEOx40BE5|X;g$?z3%!1g7z~MW zt#|&wM)Xi`YZrV&E+GwXCn#QIAfVpGq8sd|(dH6|M9p2x{D?V3tT`t*NyKaek&7DB zOG-%+6N5A8y~F)J>sZQ5w4Zy|-@!{`RZFduOJ>4wM{327)86c^_gW5&^4;-u(x7Kv z4|m;rnEgtUQYZq#$9r>QUjh&@6x!92U1Ozek(mgRwh9o)li7S0U1-Aa_Qm1aBG8wb zg=9wF%GhRfqw59@`lm*!aO4VIXZ~q(chDt40^hy`Rq^~PQT0bF%R}XZt*Y&Nbvf%o zQUQs9LoI9^no7F4rct$uHJC|%z?Ve*Ey<uV!ADBNU4EgAcMS6G34MSw+n z4F)&`V74j_ph47?#z+2y_9n76L9u>nd_4H=L=H-!;(M`)a6rA07F+nR@%0U|6GU{y zb%w_L(h?dXGW^S4H_Hau35p7qEE+s23zfg7qiU9vT?eaAz2+v7oUo#S*5H#i)HO9` zS2eU3Ez@>b^6~P{dN?v(qPptC!D52sste)9e2TLzz@Wgk@icuhwY{ z7CxZHxsn>zljnZsR3Mp5ZyL5VDxt{JnHfI1XLLr6+Hx9d4mKfARy)5GqDa#ig9C7d z6tPla5Mrowf^{~5uLbbyKD^t?k_u+e%~WN^D`h^VEDB(}k=7eJk^>Yk9h_RDLw;~v z)98-@-V9uNGc&7?I7mAxHUIbQn4Q%8qI)!hIqU2FPFJ(}1ik^o$;_9v$mqJM-M{pE zXaogx-_CU-k941-MuhKm3cnwU&27d`fnudAyyFHhErqHj*Nt`B{Y>MJRQT7W_A|P_ z*ePEsjcfy=&SGC{FMT50szF5rH!<{3zUI=i% zJff>#O|p~Vh-7$0e_MDitIDq0r_<(qi0$`}?!Rkq{JTPXvZi@Xv($7{^^LWP{JHxD z`V=oOwGOcs*&WxNd#RvWsReQPK4V5|`)Jl{Imyk1P)HU??}B=>hkS_VLnl@%7qs2G zacl^LaAUHrIRxnBj`xjB@VsxeB}QdBwcjg*-=QzNJXjNS3@V@3Ot6w)YH#vCYuQ z9bSKOu{LOAiA$ULd(+A7?4;a?!B%+%P5kSBUp_BeI2)rj6lX~Y;qFM!6WEQqWRv~J zAG^i3xpHeO{F7FvaXf4il4}e}HTjG}l+T)Sro#vG^KYlgx)!V-+?b2bGCcrH2< zGxT>Zz`V>}{~?(KNrg$vKUH4AiocUdmUW|h)wvZmar!&~TkW;>(vf75^i18jy1b$cRK zmg|vi7w2X4Wp6GaF>p#x!^|^V5JPxv^&WPluOzQ;Q{X337Ue{YtKj1FaC!ZJw_~~l zL&>df?X`jHx@i_CpLbkfWjoNpY5{_WmVVN`PjlzYC(_>!E74 zFk4g8UZQ|BFh zo*`T|Nu~2(%_a9!?;ybF?yOc6Q_6R#gQS-Q zhNE;X@XL3c4qv)n;~w#;jMG8f^P!P_K?+riK7w6jcJ6%K*ZW9kYkUHka%dP#A*>e> zKMzn(6^Irqx|pKhyf`Xk2=@J^FX>xg`E^Rkm~HO0Q-ApoW$w4)vVVgT(A76cuaM-Q zi`F~1sb$nf!{B0QB=Ox)YCl)No)-I56()OWaH#&QJW;cQUSq*c$kE*l9wO zqj#Q;Y_xAWWi*-p^h*uX_JDTiYCmgih}E^+n0+^<+a%6=-9s}WJpABfJ3wAMR(?rg zCSlLtp{&i)Y2qpy_JO4ruO<3qTgm1H;o9Au`@8X(V;r>gSX05mu4V1?1#P2m`n+5OGIggeEIUZ1 zCc8)-v^NT8D|+(7`S|nKu5a%EZ>3FpZte_!EMx^{U6VkPn1<2!ld5N{2EDTttf*Q! zC`U6*;Gl=f&c8>}8^zq*Jq9kIwSXt1!KQh7t-^Gj#c-qI(R$)URyg)a@qS)T9q-d+P}|vEOK3L+H-y8X49l9_w%AzJXi16%0$)6L)gxWJ_!jSy=eLHQ>Vs@-k0l8f1+c@brbU}o z!als=m`^Gkr%v5_rjC&fpd%W-kAs7#n+Y_#x!|Lj$!y3p(oN~LFVFgMb|hd%&}ms7 z8pHtl_O&aY(nVy+LqQCUPH=l*QX`i%{&C27(k`IZz~W4#$R5!Lba3>{O{mXn*bIa- zO~op+({o=1X0-fq(a>e*EkNht15!@-cEaakh>GsIF4)YYe`P(s+8tf}$sP-|*uQ$#^7ZusNR*prcS;slUsX zdnr6uZn9(WL&$sXmp9n}I-s96nvk0@A1|Ee9bOXouZZv&MiO6Xk=c=6_8=^y=@9oW zS?&JZI-+Vujd9(JpM3vKKW1acR$!}hr-lT?zp?$vFqc>c9L`|t3>b~nr|A~EhyD-b z&eZi;A8X&{7k~Lz1%9b*`?<}<#<4G~c_D8E=(&F{i7B_xSm_bjzQUBk;$e@{?|r*~ zwEcXD7)pJC9f-~PEq`J=SnSeuAyMbees#`Gxr23{H+9 zR489vw#*7of{#J}P_LrkcB0TODm++une~;NFk|hTd@FP)$72cM3_Iheuw86C0k^~XxIZhofM)^$p+PAw`{XP?2X{YOyt(H^z zZ1oxnY4|=*xdkeeTS(MAa4)Ne{{|1fup1P$@oD z%AE&>4Rya4)qV~s1B^KvW;qah>e5FlCUncx{5@+-hMZm2)Vl+m!bpQD<5hXKods$v78qY~WIX_rnk!AY}w zFEt+wch&9a`m{+i)Lg1I+>mYexA}mY8lIQ3J~FP|4Ta<1v~G-&fmj%!n%>P0!>Z5W z8E?4?*RbkW%+yTilck86ee`cfN#&{fic6j6netNWms6K~Ry8Q(v#UTjpib;P=ocNvD{`G+ZYo<+;<@B z|2pJGPo2|BaQY-&M#4YngR*IDL#%n){BFj6w|}z-wN^VKB~AqZi&EB;5n0o9Do{0r zdrsthQOIIk7BKpr38mdpd_P_^)5dE1O2n@Y#I|-p71(p9Vr_pUft9zo|765ttv5{? zH7)^BlND;lX}H^oUKu{eDr-5wKCNA87&J!xT`gIsYGnBqM4yp~L+@(|==dHc1>6fH zEH|$fs~v(3(9htk3})erQ`8L`Gq4#lOMiG$8jX9|#oDzIrjkzYlma+-Q|ny9 zLulEU4e1z@KG>s}8O8&F390d7MW@|N`$|Rn_5Diu_rpqLA zkx4uLkjH73`=~l7cGH5A(%xGSsvKc7>P)SwWNguiy^@I$c`Xryi>>+4N)O%yvQ>EVz@hfetRc_ z-wAR+%wt}WJYS^I7&_R%BDtq)Vr)EN&Grl;==$kdm9kJ7qxd+kJP{oj7#ETcJKPX# zWG!Uc`%OXo5l3s_OiLkqCBD|Z_E z$gFi4b0PS2L?(EnJM_zNj4mZP3?wHwp-oCV`V^2w&bN_Dw^HoOj<@X9MD&+b9&87V< zlF0VwwG^~b!w=A9dgKene>Yg)$C%HJi zW2Ov}-)8eS{|iCy``q5(&?Pc{(3F&`sFi!KPdw2_ z7*!+`?7@N1PJm-dHfWPQ}Novu4T$9{tXg(FE>bejw}mB z%E@4KQezf(*yb4;3<&Z+kehp_|M|@nMxkyY5`;MF%cD;v!#QesSG<~!35^Ts@WUqLcF%&If8}P+tTbX>EKDOTG5CkwMbjI95ue9|isXeQsZXfvhRFQpo53{H3J(#$KbCy=F`hbLd&2<gtuF&5Md2YP+H}sejq!hh`?d zBP|(3LzoMZd>eeGKMKc^qI^nxT9}xnux*PoQxI18GQxY&?5cppVjq*G&)A(l8#+f5 zlI6#pN!uDhD@+E36C>LNb9g9Yiisw_mIBYJ2%F&#`Tz7@hoCsl@_+=}?hdBO~jxB34SqRL(e^W~t79V1`7qXbgq?i-wi6 z{C^_7`!*qG*?JHcB#_r8B5CuugppBdOUu3)qYk~&)xqQ5uSaj*Eb-Uvrr#tBEI)S| zh8&9$UOowa{s58CF7nP9Yk%w~v$Nw4mQ7pO_`&ez=R@i+%O4`|T$pqMeGU8Zx!b~? z*fUm{>4|tXTepR#n|1oh|2dj$HouQd5l@y()jxRAO&0huu75owl;%_GHq);S0Z)<3 zG|6M;X*>*&c0lj#Octw8yES&z>cDlFOxoJNWfOOe+xS<4OZIou4n7#xMC0dVR(p>P zz3r{D4b4>4fb=unziw#uMPDYEL}c_gZP3_S9&#DvXc%yh9OVGsWhC#)EFFD{A%m4Y zp!C@B(?N6{b+}KXK2#yy@t5@NU-+@N9mF)D>84agH0uK7W}T-72bs(545#1TLdNOO z^1l?C3v*T(tF!H=!IYN%5^nzs;zglOS=8F9xLrc(?ua~oi$-E;T2%tXQa(NCNTCEA zzFRtvrr9OSohMPE9rqs%eXvueIP69x>6#Gly!^BMvopC$Y!bJ&FJY{XRxh=DvUz?| z2u+ykx>rc^uSGs6f~MX;ufmX{{W|`pD6-O1rT;JS8uE|y)%l1hT$~O57de$v1KHZp zYk!&NM-0XP44?bI9s2b@Wv2M2)fE4B>iowb{}|+#WB5O@Zu_V6{ePtMouZ}@ZC3j9 zVXO_$apxkM6dgk~d6@*S%0Df{YV6-uzIe^@NifIN-^}Lkud-X)a5MLv*L>x|^2+Nb z>lVeOn{uzH2LrEqQMAxVJW(*$Y_*~C%sj@O{TZ6%RiT$ zS>_*;kd5&F>t2!%rg#547x2$$_{Tx~(SFMQZ4gAVMvr}$*EEGVfjt*Au2h;mjxgPu4^QXHmg%6HsDW09DF?(fW z*2@`Zn(kkk<*<%I9Cxle807e8PbAz7;2Qu)A4KQ}HxgmU{%p;oV>wxBv+RASLb(%o z^I#rbrO;N{(}8tSYbbVzrj|MAuXFSwgxOuT5+kin#KKR4ZajZ!ck9f4N*`)*vwB+9 z?&AnIMv*UwYRf6XHoxWZF8>PPak5L(`f%vYfE#x?rsT|fP1E&ArOMh4dOn1mgx5zm zYOoQes*LC=!{huq`r;|@kF~nanMs}7Sg9WqiVi}C77zV5BxyPMYF!sC0LjQ=?z5!S zQ*AUelfbP6cbwO8b?9Y0$gskF$#{<>xb*<0v&Nyln?>$x)-}0vX`jZvGH`Fj`1P z0&Y7cbQ0VkySL7WD=r9WI2c*>K0QM3wpG~-KfuD&i@dz1PmN`c>w=Rmn{uxu<}Jef zlN#VcqS^Z8mf?)dgz3w-?eHWltN1e2e#;lRTruyZX$E!V;99Ixs*6EYRVcawfQLiX zPTw|NN~)NgX#_lZPj8kF(rPc?A#z+vh1>p;ZyW>v$C&s_~q5}o!RZR5o zDQp}@ewJzh^Fb^;P6;t-$J-xgdZrJGl$DGoS3)~(JF&lfnUd2c|JzbFdRhwE<8szb zl_0ey8QU!j0KlxFX#*A)L<>s*7*4`fL#3UL$0|B>;q4NRYlG060h+i(;#B$e&5Mf* z=$9QV9!sBBtQ=DO*TZK{=L8gIDy+TrWdx0o1=ik$gEg{3jGQe(wR@{>MmBS9DO4vR z(OG%~Dy;BbPEm&h0&$v;$CPJ6r?O_J(#y6gq9-Opu}Io7w^cljvzJ!6J1jbeQBcZXR*ajROK%F;BUQe0Euf%1_^8 z8BGklW(r>bMUq8we23#5mex&caoh8H9&V%Bq(gXX5nNkAHPc}9$gVZ|rgC#;R_u;v zo1ft`_F>Dd)GZ~F!>vj zeikax86OOO4@OU^Ntrd8lEilAO_2m#ofERsyLpxr+{jAJya|0Vh>V>oHcZ%vG~_kW zzRk|gUiP%m1-emRUw9y_+_g{|W~n+*E)~v|5O#jI~$8C@)NyJQibve|`i#VEB| zM&5~;C_ePe3LjruR&Vc#6m!y(0JT;qmDSzoJ)_Qg|N9W}W?VK3>Ge8y*AzR#wRPB_ zCb?ym8C2nf=7|aRBk7j8G>oz1sYO0@sD)TwGeY znC+Mto8(JuqVHS3wL%L<=zca?K~m&^ zs<;XQ&zkK7602OJY+(m&y8=A(hiH5EJHGvtBv2v&`4tZeAYj*-(x%!RMPD(auniCV zj?J?i#}EU{6;Q5|8j+y-HebJ|i*sfhkv#=Vdz@$Jnn_(RyPx#7RL}3^!U7EZ26g&} zk4`QrfIui$!_+&sF41?txSpN5N$d}xp3AvUZs?EPXNVJgvdf+6Da28rp;bImf0{&D zWa^vgZmxe&)PUd>l$+;luo;`L*5MmKBag>d22xD7Gs^**Fq56NS4dl2Y)cP{HQo@^ zqdc6mMBSTOR=oa6u!i9U%@bey4$PpN)Y;A#69`iqz!t^Vdc2>CfYBzIw<|0_d=5W* z9jA$lAtmPuC{uDrFgo8LVf(vi@p^d83mFy#-%v$A-B>Na>t91aPib3?cC9Tt{eTEF zAxucq!j8ZT4RUcFZ1+c&7flelJ&b^y$6S)*NN?SRLR={dYC;WTp4nJdZ`l?d`E4%U?4VXI^n+F!^JO{i^>A%3Dyw*SXaT|W!ByhwX(RqWsBhBZ(zgJ?9U2Z;udO{$c}kVnX>Lmu z{@^GAqYjtxpZN?@?@_t#xk@a8(jm(h%$M=yOZhy9yDY{PM8ux-smbGg9yV4m`J+GpQ$S0PHkEx*+b7sla$F zes3i_2)x-682nXZyAS4Qnk0&8prq#`fne68VcqUA=aPf7j_aQ%bumJ|pn8>4H@3c> z)JN@||8DAYLRd<}EUKTT@7u{N6km(T9zdnp^QjhH~=&Q^nnfp1HAvWAe`qeT6Q=9Gd<`0?t2)~w2?I52Yy$P%= zKH~sF2)J+ZKghiJC$s$1wpL8 z0@r}*wj(8tD-F8=PaIyd7?j;FHE6n2@gspNYK40*pciKi21b16HHIlRS5m{{2Knze@fSmgJ#BiR=-m8NEPqHU@mgKJ;KHASqGr$u}$y5Nt- zecO8n&~U{y)x8ap^a1U>kQMM8L9T0VnASzPS6f zE(e*Kp&6Q}jRD@RLxBbs&kkAjSe%Od*FaxS>nzYg;pzCn<`5umBM&*T`qNI)gwzN1 z7_U7WB}^`rR80PhstiSqBpe|(pWG6TN#O8Ga z|50lSu)$Ab?ZZj~?8!=F!vQhLi9|}(G<@fY--EVIL?*dwJ9<3m*ms3!0@YYYvy}+~ zJGD7G6{St&C%h3`ioW3_X0`Joi4(ju5R^h>oz4yC(LC!}gV`nyPPYyhlv}5OryJCf zaGXb5eM-X#%J7Z61$DU0`p>0YGRK&H7yrpzxVkQT;N1$G8vzlZYa(^rnp=hSUp-g> zISmle@~^DOfeXk-Er=W?yw6lG!Z&VpLK$sI-*(0fm8ed~qW2aQ0!I43?;njvp9K=% zs3MGJC5*DOoz8*+3XfOozRt1n@x#YY4qwpARJac^whRMW22rS&A(-lW1TjA`&Q=!V~#;Ejk&o9E{P45~DtC$^sIoB++7)uT9x0@yOXVnjR z8bueB6vthHq&)08%F1#;K@bmDgV#ell%PP!l+Aj1m&wVdW5mwRGn2C#l5ZU3$CD(S#|d?>SBZY)3g71b(!di zpEibGpd%e@;nSsMq+IE`5isAXm-H!)5YDj+#iM=tts?#+8xzeS;}q?VagmP7J`ALt$flqn1(V9 z4K{u#HH-770h@Mmb&xe|2i0&>=ErZeP&%x8S0+1e58{&{qSp3~gw1>VR}Ly}%u>Nq^Q3-AV!s-H}~zA5__r!AbRv49-oAFtj=dK1w0 z<1C^bxUu!g`of_{+@_j4L6_s{8fq#ZjCjtre*oRQZB7tgXrt$_5asnQt|vsIZ1&JM zBm)T2^>V&D&GXxfJ0qo?t%#uX8Q-SZ&n=RG4I{!et}(XON>w$R!@a_sY;+y0^m&QvjaMo;&?X+N_7$YwWBt4@J)gtL>cgd8LXKeeSAB z_o+Ub1jQissORJmSDBgm6#R8bfaI;FzdOp~CY+(#V#j0dEA_nbLbf;kv6t4%ic;(4 z{WXQL1)s{$0&%5>5Wi^$dJ&jG)qdckqvO~CeNFKSMj1=31mn=$UN502zHwmhBcr;~ z47cs&WS!?B**P0ilN$O)6+4yY6L96=VZUM!eX$5uY_*=yb?urui;smPp}Ct;PDq&8 zWJW&W zn>x6Io2#^F#5@eS-@RR#%}zU_gZ{D)M~msk+pi7tZ*fQ>+>S7|uZX+wg2k|`efV~s zcVu^t#%l}3ail4LYh3$wi}*GO`W&D7YnB+2KD}5WpRNSeF*V1KUegqq(`EZ&hELPv|5#V3X+LoTjyhg$l;&T^36D zgx_jthx3r7AfXD>ll6}~S%KtOIQ!Ao>U&{8L2DBE;a;fAKC{#hGbqvgEnu;^mpOqq zU3%@%PA(w|yqOeywIO9Qw0UuSBs^=8BYYv72koR9ORi2I*v8~Si!mH>Ku>Ryiq z+vS}vaq;#MLTan28gN$yeLqyL8)uJE-O01{tV&gX-=*!49g_E27bj_ZGBoFQ>+3F7 zt~5XsEhngyjWhS(~+BID)c8XJZF&iS6LlU{v7cckBe*O_M- zdXnbpykVFDJ|UovrfaPHk2-SG!S-{feEx?u;v@|Non4*z%!&#W+&XG2E~XBgNnQ(Z zLT-h&P_6vNrGLTqc0`IZ@uy{e(S(?4NP+T8+pgs$@!QANKD=D{;KL59Fxw=revmw# zh*nLMfa=?(#E&5^SDb8Svvw36F3RhYHIPJvPT|s*K|3-pifr}1V~E-QiKoYyeS$ju zbk!aj>o=WfcQoW)%(uSMoth%EAH9Jq4Xe=G>aJ@|xUv7@G}#io*rn88d_vXX-hWmj zGxQQcj%t;Z$ckbs*YMzP)-B6=w%h5|ZuUN;k|*9pRM7fOF2ZQ^aPA5dDb0?&D7b>| zr<2%M=QvBgF;!xGsLysT-}_7dA56&NX{ne}=w?Lbl&Xq(0qwCNl^1oVWqgfg&RmCt z2r*MCxWPaKHXCK7Qw&paOqnX5VOUv&+xl%@;O4I4#D>T*!(m+9iO6rx4)a~WyAr&B z2GC&hn}Y%cO`K81F_F37#liRboyQqgL?^9Mc?2kiC5_PvJJ zzSs8>nocEAcUZ8}Yp$G})-uH=01Es)ZHHUO7C5Joa38$lI+$LarNYYmX-lmQ?XuP) zlPNOK+FL=9DE6ryQFq4^0e`ogw{^tKqOfE~N3U{9h_0N7HeiA5rJY+@v3#gqm?k#& zVW6G{ur?-RP~~+zG@lyv?C9OdtBVCSz`mXk9jT5P=7sraSN9lw~K7y_T2BO>4?Z{Q9(=AZADrjv# zeZ>v z#3hgM#;Bn(Uq}U+3W5=U8L!KcIaF~O^PLc%k6W@qa7_9To6Xu11X5+~v@K#|qX48s zZ(&%lK?S>a4f7tz;=%Td+?(n2@u}n3$kXNDs=Y*huHf4n^CC7XZ_42^3o=p-XLIhbpF~ zEooYmWo(&)#g}S2hhh&WW(o^kEVaivCA;9-yeWe3Hdl|M z8d55pr*7T)x5hRnn0NZ#HPFzStg#aYA0wlXp`Ike<)|D*q# zqd0?VXFH>?<979j3vMa8yh*Z--8~nfyCM;KF}?b0;W5dUE9owdZHMgZV%p5k!Fsj^ zJ`0P>Q`ZBl^BjA;R#QTrOGzNDc9Ef!-PG2~q6N#b9LHs; z<5^C!hj@Sb#skq|Jr7$C>)vQqN7cgwYS!ZQQ4WQ+b*G>7Zb>(1W6(QQ2c)33>6BN1 z5bR#%f(CK_17)WP19KhRWWPJ)#@doH(1URkHR0`OEa#@!Sg^ce>TQP72`@lJ4Lqb1 zfW7R3JQfw-TAOFDyK5y{;9~jIb)tA>cim{}rBAw`^Vs15BV60V#^=lD?>V#x!twFN z&}&tE2JSPy<&IKz+Nb%tyY?~ekAlR{5^uBC+GN);q1(eEyIiaf-8DHZ1s|+$4aNJC zenvVOB9QLB!z0nzp_UDID!c4W>cTIwO3H}x)fv}&jr@#bw@3-07f5VCYE%_sM5|z2 zypL>!=Ed2zJD2Hrr@cx#qXytsUE7}tl#sBpy2`1+^W_*%(Q2xY^cFR4f z6)P*X9Vg?StH7|6zAzrOb4Kfkx8q|^L4p^8Oy$}sXD6AODn~x$3Ifz zpIwFn`V<3mm|YFy)x0=}8_EWFu5;S!p*Z860lR)>wiVQ<^a7<-WYQ48x4ncV#*uHI z#1;&Tnl|6`MhKg0+u5d$dAHB1UIdcL@aw+Ffp3If{J^8} diff --git a/src/content/docs/reference/api/signatureservice.md b/src/content/docs/reference/api/signatureservice.md index 01a787c..007e049 100644 --- a/src/content/docs/reference/api/signatureservice.md +++ b/src/content/docs/reference/api/signatureservice.md @@ -4,18 +4,18 @@ description: "spin.v1.SignatureService: each procedure, its request and its resp source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json" editUrl: false sidebar: - order: 13 + order: 11 --- -SignatureService is what only people sign of themselves: who a user's keys are and who a team's. members are. A host holds every workspace's access to these (internal/roster), so a control. plane that is taken can say neither which keys are somebody's nor who is in a team. A. workspace's access is signed through WorkspaceService.SetOwnerWord. The control plane proposes each document from what it holds - a key registered, a member added -. and keeps what was signed; it signs nothing. A client shows a person what they are signing and. signs it with a key of theirs: `spin sign`, with the keys ssh-agent holds, or the terminal's. page, with a passkey. +SignatureService is what only people sign of themselves: who a user's keys are, who a team's. members are, and which settings their workspaces apply. A host holds every workspace's access. and settings to these (internal/roster), so the control plane can say neither which keys are. somebody's, nor who is in a team, nor what a guest applies for its owner. A workspace's access is. signed through WorkspaceService.SetOwnerWord. The control plane proposes each document from what it holds - a key registered, a member added -. and keeps what was signed; it signs nothing. A client shows a person what they are signing and. signs it with a key of theirs: `spin sign`, with the keys ssh-agent holds, or the terminal's. page, with a passkey. ## ListPendingSignatures `POST /spin.v1.SignatureService/ListPendingSignatures` -What the caller is asked to sign: their keyring when their keys changed, and the roster of each team they own when its members changed. +What the caller is asked to sign: their keyring when their keys changed, the roster of each team they own when its members changed, and their settings when they or their projects did. **Request** diff --git a/src/content/docs/reference/api/types.md b/src/content/docs/reference/api/types.md index 9be7d42..78e3222 100644 --- a/src/content/docs/reference/api/types.md +++ b/src/content/docs/reference/api/types.md @@ -701,7 +701,7 @@ One of: `OUTSIDE_SHARE_STATE_UNSPECIFIED`, `OUTSIDE_SHARE_STATE_PREPARING`, `OUT ## OwnerWord -OwnerWord is a workspace's access, as its owner signed it with a key of their keyring (internal/ownerword): document is the access as framed JSON, signature the key's SSH signature over it (sshsig, namespace "spin-access") - what `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent. +OwnerWord is a workspace's access, as its owner signed it with a key of their keyring (internal/ownerword): document is the access as framed JSON, signature the key's over it for namespace "spin-access": an SSH signature (sshsig) - what `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent - or a set's (sshsig.SignSet), one passkey prompt over several documents, which ssh-keygen does not read. | Field | Type | What it is | |---|---|---| @@ -736,6 +736,7 @@ PendingSignature is one document the caller is asked to sign. | `signers` | list of string | signers are the keys, in authorized_keys form, any one of which may sign it. | | `summary` | string | summary is a line saying what it changes, for a list: the document itself is what to read. | | `deferred` | boolean | deferred is a document nothing asks for until the person uses what it gives: the roster of a team that has only ever been its one member, read only for an identity. Offered there, not on every page. | +| `previous` | string (byte) | previous is the version this one follows, as kept, for the client to show what changes against it; empty for none. | ## PlatformImage @@ -796,6 +797,7 @@ A prebuild: one build of a project's ref at a commit, and the snapshot it left. | `error` | string | | | `createdAt` | `Timestamp` | | | `builtAt` | `Timestamp` | | +| `workspaceCount` | integer (int32) | In ListPrebuilds: the workspaces opened from it that are not deleted, whoever's they are. | ## PrebuildState @@ -835,6 +837,7 @@ A project: a repository and the shape of the workspace that opens it. | `adminIds` | list of string | Its admins and whom it is shared with: shown to its admins, empty to everybody else. | | `sharedUserIds` | list of string | | | `sharedTeamIds` | list of string | | +| `readyPrebuildCount` | integer (int32) | In ListProjects: how many of its prebuilds are ready to open from. | ## QuarantineDenial @@ -894,23 +897,6 @@ RekeyState is how far a disk's re-key is. - `REKEY_STATE_PENDING`: Marked by a r One of: `REKEY_STATE_UNSPECIFIED`, `REKEY_STATE_PENDING`, `REKEY_STATE_COPYING`, `REKEY_STATE_READY`. -## RepositoryConfig - -The repository a workspace opened, as its guest clones it: the project's URL, the ref the workspace was opened at, and where on the disk it goes (projects.CheckoutPath). Part of the settings the owner approves, as the environment is: a disk is written to only as its owner said. - -| Field | Type | What it is | -|---|---|---| -| `url` | string | | -| `ref` | string | | -| `path` | string | | -| `authorName` | string | Who the checkout's commits are by: the workspace's owner's name and email as the installation knows them, set as the checkout's own user.name and user.email - the push goes as the team's app, and the commit says the person. Empty is neither set. | -| `authorEmail` | string | | -| `commit` | string | commit is the one a prebuild's build checks out and runs create at; empty for a workspace a person opens, which follows the ref. | -| `fromCommit` | string | from_commit is the commit the disk's checkout already is, for a disk cloned from a prebuild: the guest holds the tree to it (git fsck, no tracked file changed) before it fetches. | -| `prebuildId` | string | The prebuild the disk is a clone of, and the SHA-256 of the claim its host signed of it (PrebuildClaim): what the owner approves when the open was from one. | -| `prebuildClaimDigest` | string | | -| `pullRef` | string | pull_ref is a pull request's ref as its forge serves it (refs/pull/<n>/head, GitLab's refs/merge-requests/<n>/head), fetched once ref is cloned and checked out as pr-<n> or mr-<n>; empty for a workspace that opens at ref itself. | - ## ResolverLookup | Field | Type | What it is | @@ -942,6 +928,7 @@ ResourcePreset is a class of workspace: its size, and how a workspace of it may | `bandwidthMbps` | integer (int32) | What a workspace of it may carry each way, in megabits a second; 0 is unshaped. | | `rpoSeconds` | integer (int32) | How far behind the object store a workspace of it may fall, in seconds; 0 is the installation's (InstallationSettings.volume_rpo_seconds). | | `hostClass` | string | The host class its workspaces run on (HostClass). | +| `agentMinMemoryMb` | integer (int32) | What a workspace has to hold for its agent to start there, in MB, for whoever picks a preset. | ## Resources @@ -1013,13 +1000,13 @@ ServiceHealth is one service over a window: the traces begun in it - what it was ## SignatureKind -- `SIGNATURE_KIND_KEYRING`: A user's keyring: the keys that may sign for them (roster.Keyring). Signed with a key of the keyring before it; the first, and one started anew, with a key it lists. - `SIGNATURE_KIND_ROSTER`: A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by an owner the roster before it lists; the first, by an owner it lists. +- `SIGNATURE_KIND_KEYRING`: A user's keyring: the keys that may sign for them (roster.Keyring). Signed with a key of the keyring before it; the first, and one started anew, with a key it lists. - `SIGNATURE_KIND_ROSTER`: A team's roster: its members, its owners and each member's keyring (roster.Roster). Signed by an owner the roster before it lists; the first, by an owner it lists. - `SIGNATURE_KIND_SETTINGS`: A user's settings: what their workspaces apply - dotfiles, shell, environment, editor, Taskfile, each workspace's own environment - and the repositories, by URL and ref, their workspaces may clone (ownersettings.Settings). Signed with a key of their newest keyring, never a session's: a host applies nothing else of theirs. -One of: `SIGNATURE_KIND_UNSPECIFIED`, `SIGNATURE_KIND_KEYRING`, `SIGNATURE_KIND_ROSTER`. +One of: `SIGNATURE_KIND_UNSPECIFIED`, `SIGNATURE_KIND_KEYRING`, `SIGNATURE_KIND_ROSTER`, `SIGNATURE_KIND_SETTINGS`. ## SignedDocument -SignedDocument is a document as framed JSON and an SSH signature over it (sshsig) - what `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent, and a passkey's WebAuthn assertion is one too (internal/sshauth). +SignedDocument is a document as framed JSON and a signature over it: an SSH signature (sshsig) - what `ssh-keygen -Y sign` writes, so a FIDO2 key signs one through ssh-agent, and a passkey's WebAuthn assertion is one too (internal/sshauth) - or a set's (sshsig.SignSet), one passkey prompt over several documents, which ssh-keygen does not read. | Field | Type | What it is | |---|---|---| @@ -1328,6 +1315,9 @@ VolumeRekey is a workspace's disk to re-key or being re-keyed. | `ref` | string | | | `wakeOnAccess` | boolean | Suspended, it is resumed by a signed-in visitor of one of its published ports (OpenWorkspaceProxySession). Never by an anonymous one: that would undo the idle suspension for whoever has a public port's URL. | | `suspendedSnapshotId` | string | The snapshot it was suspended into: its next start resumes it rather than booting its disk. Empty when a start boots the disk - never suspended, resumed since, or the snapshot deleted. | +| `fromPrebuildId` | string | The prebuild its disk is a clone of; empty for one that opened with none. | +| `agentMinMemoryMb` | integer (int32) | What it has to hold for its agent to start there, in MB (the supervisor refuses below it). | +| `projectError` | string | project_error is what its guest last said went wrong with its project - the clone, its .spin.yaml or its create tasks - as the guest said it; empty when all of it went, or nothing has reported. The next boot tries again. | ## WorkspaceAction diff --git a/src/content/docs/reference/api/workspaceservice.md b/src/content/docs/reference/api/workspaceservice.md index b2da469..5d425c0 100644 --- a/src/content/docs/reference/api/workspaceservice.md +++ b/src/content/docs/reference/api/workspaceservice.md @@ -4,7 +4,7 @@ description: "spin.v1.WorkspaceService: each procedure, its request and its resp source: "spin:internal/controlplane/apidocs/spin.v1.openapi.json" editUrl: false sidebar: - order: 11 + order: 12 --- @@ -71,6 +71,7 @@ Whether one request may reach one published port. The gate in front of them. | `allowed` | boolean | | | `access` | [PortAccess](/reference/api/types/#portaccess) | What the port's level is, so the proxy can tell a refusal that a login would fix from one it would not: an anonymous request to a PRIVATE port is a redirect, and a signed-in request to the same port is a 403 no amount of signing in changes. | | `workspaceId` | string | The workspace the name was decided about, when allowed. The proxy pools connections by it and opens sessions for it: a name is freed by a rename and taken by someone else's workspace, and a connection pooled by name would carry the next request into the old one. | +| `sessionRefused` | boolean | The session asked with is no good here: it has ended, or is another workspace's. The proxy drops the cookie, which would otherwise be sent and refused until it expires. | ## CheckPortPublished @@ -261,7 +262,7 @@ Port exposure `POST /spin.v1.WorkspaceService/GetOwnerWord` -A workspace's newest access - who logs in, consent to collect logs, the settings approved - with what the next must say: the people the owner invited and the settings the guest would be handed now, for the owner to sign. Its owner's and its guests' to read. +A workspace's newest access - who logs in - with what the next must say: the people the owner invited, for the owner to sign. Its owner's and its guests' to read. **Request** @@ -275,22 +276,15 @@ A workspace's newest access - who logs in, consent to collect logs, the settings |---|---|---| | `word` | [OwnerWord](/reference/api/types/#ownerword) | word is the newest the owner signed; unset for a workspace whose owner has signed none. | | `owner` | [AccessPerson](/reference/api/types/#accessperson) | owner is the workspace's owner, with their keyring as it is now: who signs the next. Empty keyring for an owner who has signed none. | -| `dotfiles` | [DotfilesConfig](/reference/api/types/#dotfilesconfig) | settings are the startup configuration the guest would be handed at its next registration: the owner's settings after the team's policy. A word approves them by their digest, which the client computes from these, as the guest does from what it is handed. | -| `defaultShell` | string | | -| `env` | map of string to string | | -| `editorSettings` | map of string to string | | -| `taskfile` | string | | -| `egressRoot` | string | egress_root is the installation's egress root, PEM: what the guest is handed at registration, and trusts only when a word names its digest. A client names it only once it has held it to the root it pinned for the installation, never on this answer's say alone. | -| `identityAudiences` | list of string | identity_audiences is who the installation gives identities for, empty for anybody: what a client offers its owner to name in a word, which a host holds every token to as well. | | `teamId` | string | The workspace as its first access says it: team, image, and the snapshot and workspace it was cloned from. The next access says the same; the first says these. | | `image` | string | | | `parentSnapshotId` | string | | | `parentWorkspaceId` | string | | | `guests` | list of [AccessPerson](/reference/api/types/#accessperson) | guests are the people the owner invited, each with their keyring as it is now: who the next access names besides the owner. One with an empty keyring has signed none, and is named once they have. | | `role` | string | role is the caller's: "owner", or "guest" - who reads it and signs nothing. | -| `repository` | [RepositoryConfig](/reference/api/types/#repositoryconfig) | repository is the one the workspace opened, part of the settings a word approves as the five above are: unset for a workspace that opened no project. | -| `prebuildClaim` | string (byte) | prebuild_claim is, for a workspace opened from a prebuild, the claim the host that built it signed (PrebuildClaim), whose SHA-256 repository.prebuild_claim_digest is: a client verifies it, and that it names the repository and the commit the settings do, before its word approves them. | -| `prebuildWriters` | map of string to string (byte) | prebuild_writers is the record of the claim's writer, by its id (writers/<id>.json in the installation's store), which the client holds to its own anchors as it does a launch claim's. | +| `ownerKeyring` | list of [SignedDocument](/reference/api/types/#signeddocument) | owner_keyring is, answered to the owner alone, their keyring's signed versions from the first: what their client holds the key an access is signed by to (roster.VerifyKeyrings), rather than the control plane's word of whose key it is. | +| `standing` | [OwnerWord](/reference/api/types/#ownerword) | standing is the access a host lets people in by: the newest its owner signed with a key their newest keyring lists (ownerword.Newest). It is word, but where the key that signed word left the keyring: then it is what the next access is built on, which the client holds to owner_keyring before it does. Unset where no access a key of the keyring signed stands. | +| `checkoutPath` | string | checkout_path is where the workspace's project is checked out (projects.CheckoutPath), empty for a workspace that opened none: where its agent works unless told otherwise. | ## GetWorkspace @@ -483,7 +477,7 @@ Keep a running workspace awake for a while: neither the idle suspension nor the `POST /spin.v1.WorkspaceService/ListAgentThreads` -The agent's threads - T3 Code's chats - as the workspace's supervisor last reported them, which it does only while the owner's access consents (collect_logs). Titles, paths and times, never a message: the chat itself is read in T3 Code, over the owner's own session (`spin agent`). +The agent's threads - T3 Code's chats - as the workspace's supervisor last reported them. Titles, paths and times, never a message: the chat itself is read in T3 Code, over the owner's own session (`spin agent`). **Request** @@ -497,7 +491,7 @@ The agent's threads - T3 Code's chats - as the workspace's supervisor last repor |---|---|---| | `environmentId` | string | environment_id is T3 Code's id for the workspace's server: a thread's page in its web client is /<environment_id>/<thread id>, served at the port `spin agent` forwards. | | `threads` | list of [AgentThread](/reference/api/types/#agentthread) | Newest first. | -| `reportedAt` | `Timestamp` | reported_at is when the supervisor last sent the index; unset where it never has - an owner who does not consent, or a workspace that ran no agent. | +| `reportedAt` | `Timestamp` | reported_at is when the supervisor last sent the index; unset where it never has - a workspace that ran no agent. | ## ListAgentVolumes diff --git a/src/content/docs/reference/cli/admin.md b/src/content/docs/reference/cli/admin.md index 926e691..44b709b 100644 --- a/src/content/docs/reference/cli/admin.md +++ b/src/content/docs/reference/cli/admin.md @@ -33,9 +33,10 @@ Flags: -h, --help help for admin Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin [command] --help" for more information about a command. ``` @@ -59,9 +60,10 @@ Flags: --month string the month, as 2026-10 (default: this month) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin costs [command] --help" for more information about a command. ``` @@ -82,9 +84,10 @@ Flags: --month string the month, as 2026-10 (default: this month) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin jobs @@ -104,9 +107,10 @@ Flags: -h, --help help for jobs Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin jobs [command] --help" for more information about a command. ``` @@ -123,9 +127,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin jobs run @@ -141,9 +146,10 @@ Flags: -h, --help help for run Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin logs @@ -167,9 +173,10 @@ Flags: --since duration how far back to look, at most 744h (31 days) (default 1h0m0s) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin runner @@ -192,9 +199,10 @@ Flags: -h, --help help for runner Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin runner [command] --help" for more information about a command. ``` @@ -213,9 +221,10 @@ Flags: -h, --help help for activate Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin runner drain @@ -240,9 +249,10 @@ Flags: --suspend Suspend the runner's running workspaces so they resume elsewhere Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin runner list @@ -257,9 +267,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin runner policy @@ -296,9 +307,10 @@ Flags: --writeback-limit-bytes int dirty page cache this runner holds before a writer waits (vm.dirty_bytes); unset is what it booted with Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin runner revoke @@ -324,9 +336,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin shell @@ -357,9 +370,10 @@ Flags: -h, --help help for shell Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin shell [command] --help" for more information about a command. ``` @@ -376,9 +390,10 @@ Flags: -h, --help help for approve Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin shell close @@ -393,9 +408,10 @@ Flags: -h, --help help for close Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin shell list @@ -410,9 +426,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin shell open @@ -437,9 +454,10 @@ Flags: --reason string Why: said to whoever approves it, and kept Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin shell recording @@ -456,9 +474,10 @@ Flags: -h, --help help for recording Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin storage @@ -479,9 +498,10 @@ Flags: -h, --help help for storage Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin storage [command] --help" for more information about a command. ``` @@ -499,9 +519,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin storage remove @@ -521,9 +542,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin storage untag-image @@ -540,9 +562,10 @@ Flags: -h, --help help for untag-image Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin token @@ -563,9 +586,10 @@ Flags: -h, --help help for token Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin token [command] --help" for more information about a command. ``` @@ -616,9 +640,10 @@ Flags: --writeback-limit-bytes int dirty page cache each host it registers holds before a writer waits (vm.dirty_bytes); unset is what it booted with Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin token list @@ -634,9 +659,10 @@ Flags: --include-used Include already-used tokens Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin token revoke @@ -651,9 +677,10 @@ Flags: -h, --help help for revoke Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin versions @@ -668,9 +695,10 @@ Flags: -h, --help help for versions Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin admin volume @@ -690,9 +718,10 @@ Flags: -h, --help help for volume Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin admin volume [command] --help" for more information about a command. ``` @@ -714,9 +743,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin admin volume rekeys @@ -731,8 +761,9 @@ Flags: -h, --help help for rekeys Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/agent.md b/src/content/docs/reference/cli/agent.md index d5e0e72..a335bb0 100644 --- a/src/content/docs/reference/cli/agent.md +++ b/src/content/docs/reference/cli/agent.md @@ -22,8 +22,8 @@ forwarding; the server goes on for half an hour with nothing asked of it and no then stops, and its threads stay in the agent's home on the disk. path defaults to the project's checkout; a workspace with no project is told where to work. -T3 Code's server is a Node program that wants a workspace of two gigabytes or more: in one of -a gigabyte the kernel kills it as it starts. +T3 Code's server is a Node program that needs a workspace of 2048 MB or more; the +supervisor refuses to start it below that and says how to give the workspace more. Examples: spin agent my-workspace @@ -45,9 +45,10 @@ Flags: --timeout duration How long to wait for the workspace to be running; by default, until the control plane gives up on it Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin agent [command] --help" for more information about a command. ``` @@ -72,9 +73,10 @@ Flags: -h, --help help for home Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin agent home [command] --help" for more information about a command. ``` @@ -91,9 +93,10 @@ Flags: -h, --help help for delete Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin agent home list @@ -108,8 +111,9 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/api-key.md b/src/content/docs/reference/cli/api-key.md index 1708b8b..a495492 100644 --- a/src/content/docs/reference/cli/api-key.md +++ b/src/content/docs/reference/cli/api-key.md @@ -29,9 +29,10 @@ Flags: -h, --help help for api-key Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin api-key [command] --help" for more information about a command. ``` @@ -68,9 +69,10 @@ Flags: --scope strings Scopes for the key (can be repeated) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin api-key list @@ -85,9 +87,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin api-key revoke @@ -103,8 +106,9 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/code.md b/src/content/docs/reference/cli/code.md index 49f2951..57fbfa8 100644 --- a/src/content/docs/reference/cli/code.md +++ b/src/content/docs/reference/cli/code.md @@ -29,23 +29,32 @@ Spin installs and configures neither extension. The server an installation publishes is Microsoft's, licensed for internal use only: one that sells workspaces to others leaves VS Code to download its own. +An editor that runs spin itself - the Spinbox extension - names its own commit with +--vscode-commit and --no-open: no local 'code' is looked for, the workspace is given that +commit's server as above, the SSH config is written, and nothing is opened. + Examples: spin code my-workspace spin code my-workspace /srv/app --start + spin code my-workspace --no-open --vscode-commit -o json Usage: spin code [path] [flags] Flags: - --editor string The editor's command, one with Remote-SSH or Open Remote - SSH installed (default "code") - -h, --help help for code - -i, --identity string Identity file (private key); default: the first of ~/.ssh/id_ed25519, id_rsa, id_ecdsa - --start Start the workspace first if it is stopped - --timeout duration How long to wait for the workspace to be running; by default, until the control plane gives up on it + --editor string The editor's command, one with Remote-SSH or Open Remote - SSH installed (default "code") + -h, --help help for code + -i, --identity string Identity file (private key); default: the first key this machine holds that your keyring lists + --no-open Write the SSH config and give the workspace the server, and open nothing; needs --vscode-commit + --start Start the workspace first if it is stopped + --timeout duration How long to wait for the workspace to be running; by default, until the control plane gives up on it + --vscode-commit string The commit of the VS Code that will connect, instead of asking a local 'code'; needs --no-open + --vscode-version string The version of that VS Code, which is only said; needs --vscode-commit Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/cp.md b/src/content/docs/reference/cli/cp.md index 93d2666..34a5f50 100644 --- a/src/content/docs/reference/cli/cp.md +++ b/src/content/docs/reference/cli/cp.md @@ -31,8 +31,9 @@ Flags: -u, --user string User to copy as (default "root") Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/exec.md b/src/content/docs/reference/cli/exec.md index 9ba5854..7d0336a 100644 --- a/src/content/docs/reference/cli/exec.md +++ b/src/content/docs/reference/cli/exec.md @@ -49,8 +49,9 @@ Flags: -w, --workdir string Directory to run the command in Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/git.md b/src/content/docs/reference/cli/git.md index 6882311..05a452d 100644 --- a/src/content/docs/reference/cli/git.md +++ b/src/content/docs/reference/cli/git.md @@ -32,9 +32,10 @@ Flags: -h, --help help for git Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin git [command] --help" for more information about a command. ``` @@ -58,9 +59,10 @@ Flags: --no-browser Do not open the forge's page in a browser Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin git disconnect @@ -77,9 +79,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin git list @@ -94,9 +97,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin git repos @@ -112,8 +116,9 @@ Flags: -h, --help help for repos Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/index.md b/src/content/docs/reference/cli/index.md index b101a48..7a6b901 100644 --- a/src/content/docs/reference/cli/index.md +++ b/src/content/docs/reference/cli/index.md @@ -43,16 +43,17 @@ Available Commands: ssh-config Make every workspace reachable with plain ssh, as the host spin. ssh-key Manage SSH keys team Manage teams - trust What this machine trusts of an installation + update Install the CLI of the release your installation runs version Print version information whoami Show current user info workspace Manage workspaces Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -h, --help help for spin - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -h, --help help for spin + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin [command] --help" for more information about a command. ``` @@ -78,7 +79,7 @@ Use "spin [command] --help" for more information about a command. - [`spin ssh-config`](/reference/cli/ssh-config/): Make every workspace reachable with plain ssh, as the host spin. - [`spin ssh-key`](/reference/cli/ssh-key/): Manage SSH keys - [`spin team`](/reference/cli/team/): Manage teams -- [`spin trust`](/reference/cli/trust/): What this machine trusts of an installation +- [`spin update`](/reference/cli/update/): Install the CLI of the release your installation runs - [`spin version`](/reference/cli/version/): Print version information - [`spin whoami`](/reference/cli/whoami/): Show current user info - [`spin workspace`](/reference/cli/workspace/): Manage workspaces diff --git a/src/content/docs/reference/cli/login.md b/src/content/docs/reference/cli/login.md index ea9692d..d471782 100644 --- a/src/content/docs/reference/cli/login.md +++ b/src/content/docs/reference/cli/login.md @@ -26,8 +26,13 @@ There are two ways to authenticate: The server is --endpoint, else SPIN_ENDPOINT, else the one the profile is already logged in to, else https://app.spinbox.dev. +With --no-browser and -o json, the code is written as a first line of JSON before the wait +({verification_url, user_code, expires_in}), and the login as a second +({profile, endpoint, user}): a program shows the code itself and reads each line as it comes. + Examples: spin login # Sign in with a code, in a browser + spin login --no-browser -o json # the same, for a program that shows the code spin login --token-stdin < key.txt # Login with an API key (recommended for CI) printenv SPIN_KEY | spin login --token-stdin # the same, from a CI secret @@ -37,11 +42,13 @@ Usage: Flags: --endpoint string API endpoint URL (default: SPIN_ENDPOINT, the profile's, or https://app.spinbox.dev) -h, --help help for login + --no-browser do not open the code's page in a browser; with -o json, write the code as a first line of JSON --token-stdin read an API key (Settings > API Keys) from standard input instead of signing in with a code Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/logout.md b/src/content/docs/reference/cli/logout.md index 46b278a..112a798 100644 --- a/src/content/docs/reference/cli/logout.md +++ b/src/content/docs/reference/cli/logout.md @@ -19,8 +19,9 @@ Flags: -h, --help help for logout Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/open.md b/src/content/docs/reference/cli/open.md index b477326..ef145b4 100644 --- a/src/content/docs/reference/cli/open.md +++ b/src/content/docs/reference/cli/open.md @@ -18,8 +18,9 @@ workspace is made in --team, or your personal team. A repository no project has project of first ('spin project create'). The workspace is the project's shape, and its first access is signed here with a key of your -keyring, with the settings approved - the repository is one of them. It ends in 'spin ssh' -unless --no-connect. +keyring. Its repository is cloned once your settings name it at that ref: when they do not yet, +the settings you would sign are shown and asked about (--sign-settings: without asking), and +with no terminal to ask on they wait for 'spin sign'. It ends in 'spin ssh' unless --no-connect. Examples: spin open https://github.com/spin-stack/qboot @@ -34,13 +35,15 @@ Flags: --name string Workspace name (auto-generated if empty) --no-connect Create the workspace and print it, without connecting --project string The project to open, by slug, when more than one has the repository + --sign-settings Sign your settings, shown, without asking, when this workspace adds to them --team string The team the workspace is made in, by id, path or me (your personal team if empty) --timeout duration How long --wait waits; by default, until the control plane gives up on it --wait Return once the workspace is running, with --no-connect Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/port.md b/src/content/docs/reference/cli/port.md index 287060a..d738ec3 100644 --- a/src/content/docs/reference/cli/port.md +++ b/src/content/docs/reference/cli/port.md @@ -28,9 +28,10 @@ Flags: -h, --help help for port Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin port [command] --help" for more information about a command. ``` @@ -54,9 +55,10 @@ Flags: -h, --help help for access Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin port expose @@ -91,9 +93,10 @@ Flags: --https The port speaks TLS; the proxy does not verify its certificate, and its URL is {port}s- Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin port grant @@ -114,9 +117,10 @@ Flags: -h, --help help for grant Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin port list @@ -136,9 +140,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin port revoke @@ -156,9 +161,10 @@ Flags: -h, --help help for revoke Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin port unexpose @@ -179,8 +185,9 @@ Flags: -h, --help help for unexpose Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/project.md b/src/content/docs/reference/cli/project.md index 3c7e9ad..06f7c41 100644 --- a/src/content/docs/reference/cli/project.md +++ b/src/content/docs/reference/cli/project.md @@ -37,9 +37,10 @@ Flags: -h, --help help for project Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin project [command] --help" for more information about a command. ``` @@ -71,9 +72,10 @@ Flags: --slug string What it is named by in the installation (made from the name if empty) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project delete @@ -89,9 +91,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project list @@ -106,9 +109,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project prebuild @@ -125,9 +129,10 @@ Flags: -h, --help help for prebuild Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project prebuilds @@ -145,9 +150,10 @@ Flags: -h, --help help for prebuilds Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project share @@ -171,9 +177,10 @@ Flags: --user stringArray A person who sees it, by id (repeatable) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin project update @@ -200,8 +207,9 @@ Flags: --slug string What it is named by in the installation (made from the name if empty) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/settings.md b/src/content/docs/reference/cli/settings.md index 48b2ec1..e0ef53a 100644 --- a/src/content/docs/reference/cli/settings.md +++ b/src/content/docs/reference/cli/settings.md @@ -29,9 +29,10 @@ Flags: -h, --help help for settings Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin settings [command] --help" for more information about a command. ``` @@ -57,9 +58,10 @@ Flags: --repo string Git repository URL Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin settings get @@ -74,9 +76,10 @@ Flags: -h, --help help for get Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin settings set @@ -101,9 +104,10 @@ Flags: -h, --help help for set Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin settings taskfile @@ -126,8 +130,9 @@ Flags: --validate string Validate a Taskfile without saving Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/share.md b/src/content/docs/reference/cli/share.md index 66fcfab..a4b357d 100644 --- a/src/content/docs/reference/cli/share.md +++ b/src/content/docs/reference/cli/share.md @@ -32,9 +32,10 @@ Flags: -h, --help help for share Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin share [command] --help" for more information about a command. ``` @@ -52,9 +53,10 @@ Flags: -h, --help help for add Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin share browse @@ -70,9 +72,10 @@ Flags: --public Include public snapshots (default true) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin share list @@ -87,9 +90,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin share private @@ -104,9 +108,10 @@ Flags: -h, --help help for private Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin share public @@ -122,9 +127,10 @@ Flags: -h, --help help for public Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin share remove @@ -139,8 +145,9 @@ Flags: -h, --help help for remove Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/sign.md b/src/content/docs/reference/cli/sign.md index be87c12..86b9dd6 100644 --- a/src/content/docs/reference/cli/sign.md +++ b/src/content/docs/reference/cli/sign.md @@ -14,7 +14,7 @@ Who logs in to a workspace is its access, which its owner signs with a key of th (the keys that sign for you), and its identity - the token it presents to a cloud, the certificate it signs a commit with - names its team as the team's roster says (its members, signed by its owners). The host a workspace runs on holds both to these, and the control plane -proposes each from what it holds and signs none of them: a control plane that is taken can +proposes each from what it holds and signs none of them: the control plane can neither let somebody into your workspace nor put one in your team. This shows each document waiting for your signature, and signs it with a key this machine holds @@ -35,8 +35,9 @@ Flags: -y, --yes sign without asking about each document Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/smoke.md b/src/content/docs/reference/cli/smoke.md index 47dac61..26ded69 100644 --- a/src/content/docs/reference/cli/smoke.md +++ b/src/content/docs/reference/cli/smoke.md @@ -37,8 +37,9 @@ Flags: --timeout duration How long the scenarios may take, not counting the erase (default 15m0s) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/snapshot.md b/src/content/docs/reference/cli/snapshot.md index c5cca16..f9cb0b6 100644 --- a/src/content/docs/reference/cli/snapshot.md +++ b/src/content/docs/reference/cli/snapshot.md @@ -29,9 +29,10 @@ Flags: -h, --help help for snapshot Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin snapshot [command] --help" for more information about a command. ``` @@ -54,9 +55,10 @@ Flags: --with-memory Keep the running processes too, so a restore resumes them Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin snapshot delete @@ -72,9 +74,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin snapshot diff @@ -99,9 +102,10 @@ Flags: --under string Compare only this path of the filesystem, from its root (default: all of it) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin snapshot list @@ -116,8 +120,9 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/ssh-config.md b/src/content/docs/reference/cli/ssh-config.md index b4889bf..698ed0c 100644 --- a/src/content/docs/reference/cli/ssh-config.md +++ b/src/content/docs/reference/cli/ssh-config.md @@ -26,11 +26,12 @@ Usage: Flags: -h, --help help for ssh-config - -i, --identity string Identity file (private key); default: the first of ~/.ssh/id_ed25519, id_rsa, id_ecdsa + -i, --identity string Identity file (private key); default: the first key this machine holds that your keyring lists Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/ssh-key.md b/src/content/docs/reference/cli/ssh-key.md index 64b3b93..5c4f4a7 100644 --- a/src/content/docs/reference/cli/ssh-key.md +++ b/src/content/docs/reference/cli/ssh-key.md @@ -30,9 +30,10 @@ Flags: -h, --help help for ssh-key Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin ssh-key [command] --help" for more information about a command. ``` @@ -42,6 +43,11 @@ Use "spin ssh-key [command] --help" for more information about a command. ``` Upload an SSH public key that will be added to all your workspaces. +At a terminal, or with --wait, this goes on to get it signed: where this machine holds a key +your keyring lists it signs your keyring with it - when the keyring waiting is the one before +and this key, and nothing else; 'spin sign' shows and signs one that says more - and otherwise +it opens the page where your passkey signs and waits until you have. + Examples: spin ssh-key add laptop ~/.ssh/id_ed25519.pub spin ssh-key add work-key /path/to/key.pub @@ -51,13 +57,15 @@ Usage: spin ssh-key add [flags] Flags: - -h, --help help for add - --wait wait until your keyring lists the key, signed elsewhere + -h, --help help for add + --no-browser print the page where a passkey signs, instead of opening it + --wait wait until your keyring lists the key, signed elsewhere Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin ssh-key delete @@ -73,9 +81,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin ssh-key list @@ -90,8 +99,9 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/ssh.md b/src/content/docs/reference/cli/ssh.md index 800d8ee..ebcd39d 100644 --- a/src/content/docs/reference/cli/ssh.md +++ b/src/content/docs/reference/cli/ssh.md @@ -30,8 +30,9 @@ Flags: -u, --user string SSH username (certificates are issued for root today) (default "root") Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/team.md b/src/content/docs/reference/cli/team.md index 0d55482..c9d9d63 100644 --- a/src/content/docs/reference/cli/team.md +++ b/src/content/docs/reference/cli/team.md @@ -32,9 +32,10 @@ Flags: -h, --help help for team Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin team [command] --help" for more information about a command. ``` @@ -59,9 +60,10 @@ Flags: --slug string URL-friendly slug (auto-generated if empty) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team delete @@ -79,9 +81,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team get @@ -96,9 +99,10 @@ Flags: -h, --help help for get Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team list @@ -115,9 +119,10 @@ Flags: --parent string Filter by parent team Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team member @@ -139,9 +144,10 @@ Flags: -h, --help help for member Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin team member [command] --help" for more information about a command. ``` @@ -159,9 +165,10 @@ Flags: --role string Role: owner, admin, member (default "member") Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team member list @@ -176,9 +183,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team member remove @@ -193,9 +201,10 @@ Flags: -h, --help help for remove Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team member role @@ -210,9 +219,10 @@ Flags: -h, --help help for role Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team policy @@ -236,9 +246,10 @@ Flags: -h, --help help for policy Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin team policy [command] --help" for more information about a command. ``` @@ -256,9 +267,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team policy list @@ -273,9 +285,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team policy set @@ -297,9 +310,10 @@ Flags: --rule stringArray Destinations and ports, as dest,dest:port,port (repeatable) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin team secret @@ -324,9 +338,10 @@ Flags: -h, --help help for secret Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin team secret [command] --help" for more information about a command. ``` @@ -344,9 +359,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team secret list @@ -361,9 +377,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin team secret set @@ -392,8 +409,9 @@ Flags: --ref string The ARN of the Secrets Manager secret or the Parameter Store parameter the team keeps the value in Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/trust.md b/src/content/docs/reference/cli/trust.md deleted file mode 100644 index 51e0fd8..0000000 --- a/src/content/docs/reference/cli/trust.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -title: "spin trust" -description: "spin trust: What this machine trusts of an installation." -source: "spin:cmd/cli" -editUrl: false -sidebar: - order: 22 ---- - - - -``` -What this machine trusts of an installation - -Usage: - spin trust [flags] - spin trust [command] - -Available Commands: - egress-root Pin the installation's egress root this machine names in a workspace's word - -Flags: - -h, --help help for trust - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") - -Use "spin trust [command] --help" for more information about a command. -``` - -### spin trust egress-root - -``` -A workspace's guest trusts its host's egress proxy only by the root its owner's word names, -and this machine names only the root it pinned for the installation: the first one the control -plane offered. Pin another - the installation's root was changed - by the SHA-256 that -'spin-controlplane egress-root' prints on the control plane's machine. Colons and capitals, as -openssl prints a fingerprint, are taken. - -A workspace's word names the new root once signed again: 'spin workspace approve-egress-root'. - -Usage: - spin trust egress-root [flags] - -Flags: - -h, --help help for egress-root - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") -``` - diff --git a/src/content/docs/reference/cli/update.md b/src/content/docs/reference/cli/update.md new file mode 100644 index 0000000..504bdb6 --- /dev/null +++ b/src/content/docs/reference/cli/update.md @@ -0,0 +1,32 @@ +--- +title: "spin update" +description: "spin update: Install the CLI of the release your installation runs." +source: "spin:cmd/cli" +editUrl: false +sidebar: + order: 22 +--- + + + +``` +An installation serves a CLI of its own release alone. This asks yours which it runs, pulls +that release's CLI, and replaces this one once the release's signature and provenance say it is +what the release workflow built. Whichever release it runs is the one installed, an older one +included: it is the only one it serves. + +A command the installation refuses for a CLI behind it does this by itself and runs again. + +Usage: + spin update [flags] + +Flags: + -h, --help help for update + +Global Flags: + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false +``` + diff --git a/src/content/docs/reference/cli/version.md b/src/content/docs/reference/cli/version.md index 0236a1c..84df3f9 100644 --- a/src/content/docs/reference/cli/version.md +++ b/src/content/docs/reference/cli/version.md @@ -19,8 +19,9 @@ Flags: -h, --help help for version Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/whoami.md b/src/content/docs/reference/cli/whoami.md index 01c94ec..65370b9 100644 --- a/src/content/docs/reference/cli/whoami.md +++ b/src/content/docs/reference/cli/whoami.md @@ -19,8 +19,9 @@ Flags: -h, --help help for whoami Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/cli/workspace.md b/src/content/docs/reference/cli/workspace.md index 3fc0d2f..62d4d5c 100644 --- a/src/content/docs/reference/cli/workspace.md +++ b/src/content/docs/reference/cli/workspace.md @@ -20,124 +20,52 @@ Aliases: workspace, ws Available Commands: - approve-egress-root Let the workspace trust the installation's egress root - approve-settings Approve the startup settings the workspace is handed - audiences Who the workspace's identity may be given for, as its owner's word says - bandwidth Set what a workspace's network carries each way (admin) - clone Clone a running workspace - console What the workspace's machine printed to its serial console - create Create a new workspace - delete Delete a workspace - deleted List your workspaces in the trash - denials What a workspace attempted past its policy (admin) - egress What a workspace has reached beyond this installation - get Get workspace details - grant Give a workspace more cores and memory of its own - guests The people who log in to a workspace besides its owner - history Show workspace state change history - keep Keep a running workspace awake for a while - list List your workspaces - logs Search what the workspace's machine printed to its console - logs-consent Say whether the workspace's journal and console may be collected - move Move a running workspace to another host - policies The network policies a workspace can be created with - quarantine Hold a workspace in quarantine (admin) - recover Re-home a workspace whose host is gone - release Give back what a workspace was granted - reset Put a stopped workspace's disk back to what it was created from - restore Put a stopped workspace's disk back to a snapshot, or to what it was created from - retag Change which network policies a workspace runs under - sign Sign the workspace's next access: who logs in, as you invited them - start Start a stopped workspace - status Why a workspace is not behaving - stop Stop a running workspace - suspend Put a running workspace down with its processes where they are - threads The agent's chats, as the workspace last reported them - undelete Take a workspace out of the trash, stopped - unquarantine Release a quarantined workspace (admin) - update Update workspace properties - watch Record where a workspace connects, into its logs + bandwidth Set what a workspace's network carries each way (admin) + clone Clone a running workspace + console What the workspace's machine printed to its serial console + create Create a new workspace + delete Delete a workspace + deleted List your workspaces in the trash + denials What a workspace attempted past its policy (admin) + egress What a workspace has reached beyond this installation + get Get workspace details + grant Give a workspace more cores and memory of its own + guests The people who log in to a workspace besides its owner + history Show workspace state change history + keep Keep a running workspace awake for a while + list List your workspaces + logs Search what the workspace's machine printed to its console + move Move a running workspace to another host + policies The network policies a workspace can be created with + quarantine Hold a workspace in quarantine (admin) + recover Re-home a workspace whose host is gone + release Give back what a workspace was granted + reset Put a stopped workspace's disk back to what it was created from + restore Put a stopped workspace's disk back to a snapshot, or to what it was created from + retag Change which network policies a workspace runs under + sign Sign the workspace's next access: who logs in, as you invited them + start Start a stopped workspace + status Why a workspace is not behaving + stop Stop a running workspace + suspend Put a running workspace down with its processes where they are + threads The agent's chats, as the workspace last reported them + undelete Take a workspace out of the trash, stopped + unquarantine Release a quarantined workspace (admin) + update Update workspace properties + watch Record where a workspace connects, into its logs Flags: -h, --help help for workspace Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin workspace [command] --help" for more information about a command. ``` -### spin workspace approve-egress-root - -``` -A workspace's guest puts the installation's egress root in its trust store - the CA its host's -egress proxy stands in for brokered hosts with - only while its owner's word names it: a root -there reads what the guest's TLS clients send through the proxy. This signs a word naming the -root the control plane offers, once held to the one this machine pinned for the installation -(the first offered; 'spin trust egress-root' pins another). - -Usage: - spin workspace approve-egress-root [flags] - -Flags: - -h, --help help for approve-egress-root - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") -``` - -### spin workspace approve-settings - -``` -A workspace applies its startup settings - dotfiles and the command that installs them, the -login shell, the environment, the editor's settings and the Taskfile - only as its access -approves them, by their digest. This shows the settings the control plane would hand it now, -and signs an access approving exactly those: settings changed afterwards, by anyone, are not -applied until approved again. - -Usage: - spin workspace approve-settings [flags] - -Flags: - -h, --help help for approve-settings - -y, --yes Skip confirmation - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") -``` - -### spin workspace audiences - -``` -A host gives a workspace's identity token - to the guest, or through its egress proxy - only -for an audience its owner's word names and the installation allows: the installation's list is -the control plane's to write, so it alone never widens who the identity reaches. - -With no flags this shows the word's audiences and the installation's. --add and --remove sign -the owner's next word naming more or fewer; --any signs one naming any audience the -installation allows, which trusts the installation's list. - -Usage: - spin workspace audiences [flags] - -Flags: - --add strings an audience to name - --any name any audience the installation allows - -h, --help help for audiences - --remove strings an audience to name no more - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") -``` - ### spin workspace bandwidth ``` @@ -156,9 +84,10 @@ Flags: -h, --help help for bandwidth Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace clone @@ -185,9 +114,10 @@ Flags: --wait Return once the clone is running Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace console @@ -209,9 +139,10 @@ Flags: --lines int32 How many lines from the end (default 200) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace create @@ -223,14 +154,18 @@ preset the installation offers; without --preset, the installation's default. Every workspace answers to its access, which you sign here with a key of your keyring (the keys you registered, 'spin ssh-key add', and signed, 'spin sign'): who logs in - you, and the guests -you invite - whether logs leave the workspace and which settings it applies. The host it runs -on lets a key in only by it, and the control plane cannot write one. Settings are applied once -you approve them (--approve-settings, or 'spin workspace approve-settings'). +you invite. The host it runs on lets a key in only by it, and the control plane cannot write one. + +What it applies of yours - dotfiles, shell, environment, editor settings, Taskfile, this +workspace's own --env, and the repository a project clones - is your settings, signed once for +every workspace ('spin sign'): its host applies only what a key of your keyring signed. A +workspace that adds to them - a project or a ref you have not signed, an --env of its own - shows +what you would sign and asks (--sign-settings: without asking); until you sign, it applies what +you signed before. A project (--project) is the workspace's shape - its image, preset and network policies - and the repository its guest clones into /workspace/, at --ref or the project's own; -the workspace is made in --team, or your personal team. Opening one approves the settings, since -the repository is one of them. A project whose repository is on GitHub opens once you have +the workspace is made in --team, or your personal team. A project whose repository is on GitHub opens once you have connected your GitHub account (Settings → Git in the dashboard). Examples: @@ -245,7 +180,6 @@ Usage: Flags: --agent-home string An agent's home of yours to mount, by id (spin agent home list): the chats of a workspace since erased - --approve-settings Show your startup settings and approve them in the first access --env strings Environment variables (KEY=VALUE) --from-snapshot string Start from a snapshot instead of an image -h, --help help for create @@ -255,14 +189,16 @@ Flags: --preset string The preset it is sized by, by name (default: the installation's) --project string A project to open, by slug: its image, preset and policies, and its repository cloned --ref string The branch or tag to open the project at (default: the project's) + --sign-settings Sign your settings, shown, without asking, when this workspace adds to them --team string The team, by id, path or me (your personal team if empty) --timeout duration How long --wait waits; by default, until the control plane gives up on it --wait Return once the workspace is running Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace delete @@ -282,9 +218,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace deleted @@ -299,9 +236,10 @@ Flags: -h, --help help for deleted Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace denials @@ -319,9 +257,10 @@ Flags: --limit int32 How many of the newest to read (default 100) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace egress @@ -342,9 +281,10 @@ Flags: -h, --help help for egress Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace get @@ -359,9 +299,10 @@ Flags: -h, --help help for get Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace grant @@ -396,9 +337,10 @@ Flags: --move Move it to a host with room when its own has none (it is paused while it moves) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace guests @@ -421,9 +363,10 @@ Flags: -h, --help help for guests Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false Use "spin workspace guests [command] --help" for more information about a command. ``` @@ -440,9 +383,10 @@ Flags: -h, --help help for add Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin workspace guests list @@ -457,9 +401,10 @@ Flags: -h, --help help for list Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` #### spin workspace guests remove @@ -475,9 +420,10 @@ Flags: -h, --help help for remove Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace history @@ -493,9 +439,10 @@ Flags: --limit int32 Number of events to show (default 50) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace keep @@ -514,9 +461,10 @@ Flags: -h, --help help for keep Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace list @@ -532,9 +480,10 @@ Flags: --state string Filter by state (running, stopped, etc.) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace logs @@ -559,27 +508,10 @@ Flags: --since duration how far back to look, at most 744h (31 days) (default 1h0m0s) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") -``` - -### spin workspace logs-consent - -``` -A workspace's journal and its console leave it only while its access consents, and the -installation collects them: either can say no. The owner signs the consent, on this machine. - -Usage: - spin workspace logs-consent [flags] - -Flags: - -h, --help help for logs-consent - -Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace move @@ -601,9 +533,10 @@ Flags: -h, --help help for move Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace policies @@ -624,9 +557,10 @@ Flags: -h, --help help for policies Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace quarantine @@ -646,9 +580,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace recover @@ -670,9 +605,10 @@ Flags: -h, --help help for recover Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace release @@ -689,9 +625,10 @@ Flags: -h, --help help for release Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace reset @@ -714,9 +651,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace restore @@ -742,9 +680,10 @@ Flags: --with-memory Resume the snapshot's processes too; the workspace may be running Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace retag @@ -774,9 +713,10 @@ Flags: --network-tag strings Network policy to run under, by name (repeatable); the whole set, not an addition Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace sign @@ -784,9 +724,8 @@ Global Flags: ``` A workspace lets in whoever its access names - you, and the guests you invited - and nobody else: its host holds every login to it, with each person's own keyring. This signs the next -access with a key of your keyring, on this machine, naming the guests as they are now and -keeping every consent as it was. A workspace you created and never signed lets nobody in -until you do. +access with a key of your keyring, on this machine, naming the guests as they are now. A +workspace you created and never signed lets nobody in until you do. Usage: spin workspace sign [flags] @@ -795,9 +734,10 @@ Flags: -h, --help help for sign Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace start @@ -819,9 +759,10 @@ Flags: --wait Return once the workspace is running Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace status @@ -841,9 +782,10 @@ Flags: -h, --help help for status Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace stop @@ -864,9 +806,10 @@ Flags: --wait Return once the workspace is stopped Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace suspend @@ -890,9 +833,10 @@ Flags: -h, --help help for suspend Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace threads @@ -902,10 +846,6 @@ The agent's threads - T3 Code's chats - as the workspace's supervisor last repor newest first: a title, the directory it works in, the model, and when it last moved. Never a message: a chat is read in T3 Code, over your own session (spin agent). -The supervisor reports the index only while the workspace's access consents to its logs -leaving the machine (spin workspace logs-consent); a workspace whose owner has not says -nothing here. - Usage: spin workspace threads [flags] @@ -913,9 +853,10 @@ Flags: -h, --help help for threads Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace undelete @@ -932,9 +873,10 @@ Flags: -h, --help help for undelete Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace unquarantine @@ -953,9 +895,10 @@ Flags: -y, --yes Skip confirmation Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace update @@ -981,9 +924,10 @@ Flags: --wake-on-access Resume it, when suspended, for a signed-in visitor of one of its ports (never an anonymous one) Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` ### spin workspace watch @@ -1005,8 +949,9 @@ Flags: --off Stop recording where the workspace connects Global Flags: - --config string config file (default is $HOME/.spin/config.yaml) - -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") - --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --config string config file (default is $HOME/.spin/config.yaml) + -o, --output string text for a person, or json: one document of what the API answered, and no prose (default "text") + --profile string named profile to use; SPIN_PROFILE names it when this flag does not (default "default") + --traceparent string the W3C traceparent of the span this command is part of; its own span is sent to the installation unless the profile says telemetry: false ``` diff --git a/src/content/docs/reference/security/known-gaps.md b/src/content/docs/reference/security/known-gaps.md index d28db07..22ba521 100644 --- a/src/content/docs/reference/security/known-gaps.md +++ b/src/content/docs/reference/security/known-gaps.md @@ -9,7 +9,7 @@ sidebar: -The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/security/README.md) at `2cfbcd74d`. The numbers are [its rules](/reference/security/rules/). +The open items of Spinbox's security model, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/security/README.md) at `3cb9bb55f`. The numbers are [its rules](/reference/security/rules/). What no line keeps yet. Each is a design change, not a patch, which is why it is here. @@ -40,13 +40,10 @@ What no line keeps yet. Each is a design change, not a patch, which is why it is and HEADs under its own subtree that no restore takes, each counted as it is passed over and every request in the bucket's access log (I8). - **A key a host was given opens what it sealed until the volume is re-keyed.** A volume's key - never turns, and an honest host forgets it when the volume leaves; a taken one keeps it. Revoking + never turns, and an honest host forgets it when the volume leaves; one running other code keeps it. Revoking a host marks every volume it was granted for a re-key, which runs once the workspace is stopped: until then the layers that key opens are open to whoever holds it, and the re-key deletes the volume's snapshots with it, being exactly what that key opens. -- **The storage layer holds nothing against a control plane that is taken.** It mints every - credential and grants every key: one that is taken clones any snapshot to a workspace of its own - on an attested runner, and comes in with a keyring of its own. - **A move between a detach and its attach is the old host's.** A grant is made over the HEAD the volume's history reaches when the control plane places it, so what the host it left wrote in that window - seconds, when the move is one `RecoverWorkspace` - is history the new holder starts @@ -64,45 +61,48 @@ What no line keeps yet. Each is a design change, not a patch, which is why it is which carries Quickwit's own services beside the logs it is sent, and Grafana can write samples as well as read them. Root on the control plane's machine can drop the table; that root is the installation already. -- **I17, I18 and I19 do not hold against a control plane that uses a host.** It opens a root shell - on any host (`OpenHostShellCommand`): both keys are its own, and the host checks only the time and - the keys' shape. Emptying the host first, the approval and the recording are the control plane's - own code, which one that is taken skips. Root on a host reads and writes every workspace on it, - memory included, and is answered by the key service as that host is. Holding the shell to a key - the control plane does not have is not built: a lost key would leave a host with no way in during - an incident, and it would only narrow a control plane already taken (`CLAUDE.md`). -- **The owner's word names no disk.** A host takes the spec's volume over the one it held, since a - restore changes it, and a word says nothing of the volume. So a control plane that is taken can - start a person's workspace on a disk it chose, whose code then runs as that workspace: it logs in - as nobody, and pushes and calls through the egress proxy as the owner. -- **A taken control plane opens every connected person's forge tokens.** It holds the access and - refresh tokens sealed under its own key, and with them acts on the forge directly, as each person, - within the app's permissions (contents and pull requests, read and write) and the repositories - that person reaches where the app is installed. Nothing on a host stands in the way, and the app - installed on selected repositories and the forge's branch rules are the only limit. A refresh - token it copied can outlive it until the person's authorization ends. -- **Machines the control plane's role starts.** Auto Scaling asks that role for `ec2:RunInstances` - on the runners' launch template, and under that grant a call that names the template and other - user data starts the machine with the other user data, tried on AWS on 2026-11-04; holding the - instance to `ec2:IsLaunchTemplateResource` did not stop it. User data is not measured, so such a - machine might attest as a runner under a document the control plane chose; whether it does has - not been tried. It is told, not stopped: a rule emails `security_emails` within minutes of the - call. +- **Which release of the CLI a person runs.** A CLI behind its installation replaces itself with + the release the control plane names (`internal/selfupdate`), and `spin update` does so for any + release it names, an older one included. Only what the release workflow signed and attested of + that very version is installed, checked offline before it replaces anything, so a control plane + cannot have a CLI run a binary of its own. It can have `spin update` install an older signed one, + with whatever that one got wrong; the automatic update only ever moves forward. +- **A workspace's owner sees who opens its pages.** Signing in to a workspace's host gives that host a + session for that workspace alone, which the API refuses, and a page on the host can read how it got + there. So its owner can act as the visitor on their own workspace and nowhere else, and learns + that the person visited. +- **Workspaces are one site to a browser unless `ws.` is on the public suffix list.** A + dashboard cookie is host-only and the API refuses it from another origin, and the proxy asks as + nobody for another workspace's page, by `Origin`, `Sec-Fetch-Site` and `Referer`. A link followed + from another workspace still carries the visitor's session on the workspace it opens, as a top-level + navigation has to: `SameSite=Lax` sends it on a link from any site, so that listing does not change + it. What the listing does change is what a tenant's page can do with cookies of its own: until + then it can set one with `Domain=`, or `Domain=ws.`, which reaches the dashboard's + host and every other workspace. A browser that sends no `Sec-Fetch-Site` is not told apart from a tool on a plain `GET`. Sessions issued + through a workspace before this release can reach the whole account until they expire. - **I17 and I18 hold against an operator, not against the tenant, nor a guest.** Root in a guest is anybody the access lets in - its owner and each guest alike: it can rewrite the drop-in and the supervisor's answers. Sealing keeps everyone else out; it does not keep the people let in from the machine they were let into. -- **A browser session logs in for 12 h with nobody asked.** Code running on the terminal's origin - - already trusted with every signature there - or malware in the browser uses its session key - without a prompt until the grant ends; ending the session (`#/session`) drops the key, and taking - the passkey that signed it out of the keyring ends the grant at every host within `roster.Fresh`. +- **A browser session logs in for 7 days, and changes an access, with nobody asked.** Code running on + the terminal's origin - already trusted with every signature there - or malware in the browser uses + its session key without a prompt until the grant ends; ending the session (`#/session`) drops the + key, and taking the passkey that signed it out of the keyring ends the grant at every host within + `roster.Fresh`. Past the first, the key also signs any access that lets nobody new in - guests + taken out - by a click at most, and none of it ends with the grant. It signs no settings: those + take a key of the keyring (I18). A host reads an + access for the workspace's life, and a word's own date is the key's to write, so holding it to + the grant is only the control plane's, when it keeps it (`SetOwnerWord`): a taken one keeps what + such code signs after the grant ended, and it stands while the passkey stays in the keyring. The + key stays in the browser until the session ends. What a host holds a session key's access to is the people it names, against the + word below it (`ownerword.highest`), so no script or control plane lets anybody in with it. A first access the key signed is read for the workspace's life, held only to having been taken - while the grant held (`SetOwnerWord`). A taken control plane holds no key that signs one, but it + while the grant held (`SetOwnerWord`). The control plane holds no key that signs one, but it serves the page that frames the agent's: while a grant holds and the dashboard is open, it can make a workspace in the person's name and frame it, and the session key signs that first access - with no prompt and nothing on screen. It gets a word naming the image and team it chose and the - installation's audiences, so identity tokens naming the person for a disk it chose; it gets no - login, guests, settings or logs (`ownerword.Word.Minimal`) and none of the workspaces that have - a word. A link to a terminal of its own got the same for one click, so this was accepted. A script + with no prompt and nothing on screen. It gets a word naming the image and team it chose, so + identity tokens naming the person for a disk it chose, for any audience the installation allows; + it gets no login, guests or settings (`ownerword.Word.Minimal`, I18) and none of the workspaces + that have a word. A link to a terminal of its own got the same for one click, so this was accepted. A script on the dashboard's origin reaches the same, for an image the installation allows. - **Taking a passkey out of a keyring locks what it signed.** A workspace whose newest access that passkey or its session key signed lets nobody in until its owner signs it again with another key, @@ -110,7 +110,7 @@ What no line keeps yet. Each is a design change, not a patch, which is why it is workspaces hang on one passkey, so the page leads its owner to that signature (`enter`). An owner whose keyring started anew cannot sign one, and recovers the workspace instead. - **A person's first keyring is whoever signs it first.** A keyring's first version is taken as it - is signed: nothing names a person's keys before it. A stolen account, or a taken control plane, + is signed: nothing names a person's keys before it. A stolen account, or a control plane running someone else's code, can sign one for somebody who has not yet, list the person's passkey beside its own when they register one, and log in to all they make. It holds for anybody whose first keyring was signed before: the chain is then theirs. @@ -118,64 +118,133 @@ What no line keeps yet. Each is a design change, not a patch, which is why it is account, or their password manager, holds their passkey and signs as them: the same as the person to every host. It is a third party outside the control plane and the operator, accepted so that a person has one passkey rather than one per browser. A security key stays on the device. -- **A new browser is one touch from pinning an egress root.** With a synced passkey it no longer - waits for another device, and pins the first root offered (`heldRoot`), so a control plane taken - before then has it trust its own. The person's way to check is unchanged: `spin-controlplane - egress-root`. - **What is typed in an overlaid Agent frame reaches T3 Code.** The dashboard frames the agent's page and can lay words over it, as it cannot over the routes that sign: typing goes to the client, as the agent's user. A terminal stays in a tab of its own for this reason, a shell there being root. -- **A taken control plane can start a person's keyring anew.** It does through the account what a - person who lost every key does (`StartKeyringAnew`), and a keyring started anew is somebody no - access or roster signed before names - so it gets into none of their workspaces and none of their - teams of more than one - but it can make new workspaces that answer to it, and sign the person's - own team of one again (`roster.Roster.Start`), whose identity then names those workspaces. The CLI - and the terminal show a keyring started anew before it is signed; nothing tells a person their - account was used to start one. - **A guest is let into the guest by the same certificate as the owner.** The host decides who logs in, not what a login may do: a guest is root, and changes nothing the control plane holds - `middleware.guestMay` - but can change the machine itself. Sharing a workspace is trusting the guest with it. -- **A control plane can withhold the owner's newest access.** It carries every one, so one taken - before an access reaches the bucket can keep it from the bucket and the host - a guest taken out - logs in until the host reads it - and answer the owner's client with an older one. An access the - bucket has is past withholding: the host reads it at every login. A client signs nothing over an - access behind the newest it signed itself (`~/.spin/words`, the terminal origin's storage); a - client that signed nothing yet of the workspace has no newest to hold it to. -- **The egress root is trusted on first use.** An owner's client pins the first root an - installation offers (`~/.spin/egress-roots`, the terminal origin's storage), so a control plane - that is taken can offer its own to a client that never pinned one. A person closes that by - comparing the fingerprint with `spin-controlplane egress-root` on the control plane's machine. - A guest whose access names no root, or another, trusts none, and its brokered hosts fail - TLS: denial, not a read. -- **I21 holds against a confused deputy, not a taken control plane.** The control plane tags the - session, so one that is taken tags it with any team, and it holds every value it reads in the - clear, as it does a sealed one. The tag is only as good as who may tag a secret: a principal of - the account that can tag one `spin-team-id` hands it to that team. - Its role takes the control plane's credentials from anywhere while they last, so a reference is - read off the machine where a sealed value is not: that needs the attested key. +- **A person's agent CLI credentials are one, for all their workspaces.** Claude Code's and Codex's + credentials files are kept as the person's (`agent_credentials`, sealed) and handed to every + workspace they own, so one login signs in each (`supervisorserver.pushCredentials`, + `agentcredentials.Keeper`). So whoever runs code in one of them - the agent itself, led there by + what it read, or a dependency the workspace installed - holds the provider token of every one, and + a change it sends replaces the copy they all use, until the person logs out or revokes it at the + provider. Only a workspace its owner's alone is handed any or has one taken from it + (`workspaces.owners_alone`, `supervisorserver.holdsCredentials`): made of an image, of a + snapshot or clone of a workspace of theirs that is so too, or of the prebuild of a project they + may open, mounting an agent's home only such workspaces mounted (`agent_volumes.owners_alone`), + never naming a guest, and never a prebuild's build. A prebuild's disk holds what the + repository's code did in its build, which is no more than that code does as root in a workspace + opened straight from the repository; the build, which nobody watches and every member opens, is + handed nothing. A copy of another person's snapshot, and every workspace and home made before + the mark was kept, get none, and the person signs in there as before. Its + supervisor takes out what it held once the access names a guest (`handler.TakeOwnerWord`). What + does not leave with the files: a guest named while the agent was signed in may read what the + machine kept of them - freed blocks of the agent's home, and the memory of a CLI the agent's + stopped server did not end. +- **A guest trusts the egress root its control plane hands it.** Every registration hands the + installation's root, and the guest puts it in its trust store (`handler.InstallEgressCA`): a root + there reads what the guest's TLS clients send through a proxy that holds it. Only the egress proxy + of the host the workspace runs on is issued under it, and that host is one the control plane can + open a root shell on anyway; nothing an owner says narrows it. +- **Logs leave as the installation says.** A guest's journal and a machine's console are collected + while the installation's policy collects them (`LogCollection`, `HostPolicy.collect_console`), + and the agent's thread index is reported always: titles, paths and times, never a message. An owner + has no say over it, so an installation admin's session - stolen or not - reads every collected + journal: a decision, not an oversight. +- **A key taken out of a keyring works for up to `roster.Fresh` (5 minutes) more.** A host reads a + keyring again when what it holds is older than that, so a key taken out still logs in, and settings + it signed still apply, at a host that read the keyring just before. +- **A repository approval is not withdrawn.** Settings name each repository a workspace of the person + opened, and signing new settings is the only way to drop one: nothing takes an approval back + without the person's key, and nothing reminds them that one stands. - **The terminal's code is trusted as the proxy serves it.** `term.`, and the agent's client it frames at `agents.`, are the release's signed files on the proxy image's verity - root, under a Caddyfile spin-boot carries, so a control plane that is taken changes neither; a - proxy taken at run time serves any code that holds a session and asks the passkey. + root, under a Caddyfile spin-boot carries, so the control plane changes neither; a + proxy running other code serves any code that holds a session and asks the passkey. - **The published key set is the identity key's first version, as the proxy serves it.** `id.` is written on the proxy from the first version of `identity/issuer.json` and its CA, - which no role may delete, so a control plane that is taken and writes another key publishes - nothing of it; a proxy taken at run time publishes any key set. A self-hosted installation + which no role may delete, so another key the control plane writes publishes + nothing; a proxy running other code publishes any key set. A self-hosted installation serves none. - **I19 holds the identity key to the image a host booted, not to the host.** Every host shares - the key, because the published key set is one key: a runner taken at run time signs for any + the key, because the published key set is one key: a runner running other code signs for any subject. A self-hosted installation has no key service, and its control plane keeps the key it grants. - **A keyring and a roster are trusted from their first version.** A version is signed by a key the one before trusts, and kept under the bucket's lock in GOVERNANCE, which the account's root - can lift. A user or a team made while the control plane is taken starts a chain whose first + can lift. A user or a team made by a control plane running someone else's code starts a chain whose first version the control plane can sign - and a team it makes is its own, which nothing trusts. A version already kept is not written over: on AWS the bucket's policy refuses a write under `rosters/` without `If-None-Match`. A store with no such policy has only the client's word for it. + +## What this does not protect + +The control plane holds what it needs to serve people. What follows is what it could do with that if +someone ran their own code with its permissions. This is an assumption the design is checked against, +not a finding: no way of doing that is known, and no outside test has looked for one yet. Below, "it" +is such a control plane. + +- **The storage layer holds nothing against it.** The control plane mints every credential and + grants every key, so it could clone any snapshot to a workspace of its own on an attested runner, + and come in with a keyring of its own. +- **I17, I18 and I19 do not hold against a control plane that uses a host.** It can open a root shell + on any host (`OpenHostShellCommand`): both keys are its own, and the host checks only the time and + the keys' shape. Emptying the host first, the approval and the recording are the control plane's + own code, which other code would skip. Root on a host reads and writes every workspace on it, + memory included, and is answered by the key service as that host is. Holding the shell to a key + the control plane does not have is not built: a lost key would leave a host with no way in during + an incident, and it would only narrow what is described here (`CLAUDE.md`). +- **The owner's word names no disk.** A host takes the spec's volume over the one it held, since a + restore changes it, and a word says nothing of the volume. So the control plane could + start a person's workspace on a disk it chose, whose code then runs as that workspace: it logs in + as nobody, and pushes and calls through the egress proxy as the owner. +- **It can open every connected person's forge tokens.** The control plane holds the access and + refresh tokens sealed under its own key, and with them could act on the forge directly, as each person, + within the app's permissions (contents and pull requests, read and write) and the repositories + that person reaches where the app is installed. Nothing on a host stands in the way, and the app + installed on selected repositories and the forge's branch rules are the only limit. A refresh + token it copied can outlive it until the person's authorization ends. +- **It can open every person's agent CLI credentials.** Their Claude Code and Codex tokens are + sealed under its key (`agent_credentials`), as the forge's are, and with them it could use each + person's provider account directly, until the person logs out or revokes them at the provider. +- **Machines the control plane's role starts.** Auto Scaling asks that role for `ec2:RunInstances` + on the runners' launch template, and under that grant a call that names the template and other + user data starts the machine with the other user data, tried on AWS on 2026-11-04; holding the + instance to `ec2:IsLaunchTemplateResource` did not stop it. User data is not measured, so such a + machine might attest as a runner under a document the control plane chose; whether it does has + not been tried. It is told, not stopped: a rule emails `security_emails` within minutes of the + call. +- **It can start a person's keyring anew.** It does through the account what a + person who lost every key does (`StartKeyringAnew`), and a keyring started anew is somebody no + access or roster signed before names - so it gets into none of their workspaces and none of their + teams of more than one - but it can make new workspaces that answer to it, and sign the person's + own team of one again (`roster.Roster.Start`), whose identity then names those workspaces. The CLI + and the terminal show a keyring started anew before it is signed; nothing tells a person their + account was used to start one. +- **A control plane can withhold the owner's newest access.** It carries every one, so before an + access reaches the bucket it can keep it from the bucket and the host - a guest taken out + logs in until the host reads it - and answer the owner's client with an older one. An access the + bucket has is past withholding: the host reads it at every login, and takes no lower counter over + it. A client builds the next access on what the control plane answers and keeps no record of its + own, so over an access withheld before it reached the bucket it signs the guests it is shown - + which the CLI prints and the terminal lists before anything is signed. +- **It can hand a host settings its owner signed before.** The host is handed the owner's + settings as the control plane keeps them, and holds them to the owner's keyring, not to being the + newest the owner signed: older settings, signed with a key the keyring still holds, are applied as + readily. It also says whether a workspace is its owner's alone, which withholds their own + settings where it says no and nothing where it says yes, and which prebuild a disk came from, + whose claim the host still holds the checkout to. +- **I21 holds against a confused deputy, not this.** The control plane tags the + session, so other code in it could tag it with any team, and it holds every value it reads in the + clear, as it does a sealed one. The tag is only as good as who may tag a secret: a principal of + the account that can tag one `spin-team-id` hands it to that team. + Its role takes the control plane's credentials from anywhere while they last, so a reference is + read off the machine where a sealed value is not: that needs the attested key. - **The domain an identity is named under is the control plane's word.** It comes with the host's - policy, and a taken control plane can change it - which a relying party refuses, since the - issuer it names publishes another key set: denial, not a widening. An owner who names - `"*"` in their word trusts the installation's list of audiences, which a taken control plane - writes. A member of a parent team is no member of a team below it: a roster names a team's own + policy, and it can change it - which a relying party refuses, since the + issuer it names publishes another key set: denial, not a widening. Who an identity is given for is + the installation's list of audiences alone, which the control plane writes. A member of a parent team is no member of a team below it: a roster names a team's own members. diff --git a/src/content/docs/reference/security/rules.md b/src/content/docs/reference/security/rules.md index 283fd02..1803a89 100644 --- a/src/content/docs/reference/security/rules.md +++ b/src/content/docs/reference/security/rules.md @@ -9,7 +9,7 @@ sidebar: -The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/security/README.md) at `2cfbcd74d`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/). +The rules every entry point must keep, from spin's [`docs/security/README.md`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/security/README.md) at `3cb9bb55f`. Code cites a rule's number at the line that keeps it. **Gate** is what fails a build when the rule is broken; *none* marks a rule kept only by each place remembering it. What is still open is on [Known gaps](/reference/security/known-gaps/). | # | Rule | Gate | |---|---|---| @@ -29,9 +29,10 @@ The rules every entry point must keep, from spin's [`docs/security/README.md`](h | I14 | A machine's QEMU reaches only what it is handed, and holds only what it is bounded to - a core included. | `TestAProductionInstallationPlacesOnlyOnIsolatedHosts`, `TestEveryIsolationIsAskedOnce`, `TestAHostSaysItKeepsWhatItCanGiveAMachine`, `TestSMTTurnedOnGivesTheMachinesCoresOfTheirOwn`, `TestAHostThatNoLongerKeepsItsMachinesApartIsDrained`; the VM lane's `TestAMachinesQEMUReachesNothingOnTheHostOrAnotherMachine`, `TestAGuestAnswersOnlyTheRunner`, `TestAMachineIsBornWithinItsBounds`; `TestAMachineWithAUserOfItsOwnIsLaunchedApart`, `TestARunnersMachineMergesNoPagesAcrossMachines` | | I15 | A program that parses a tenant's bytes on the host opens only the files of its operation. | `TestOnlyARootRunnerOnANewLandlockSaysItHoldsAProgramToItsFiles`, `TestAProductionInstallationPlacesOnlyOnIsolatedHosts`, `TestQemuImgDoesItsWorkWithOnlyItsFiles`, `TestAProgramReadsOnlyWhatItIsGiven`, `TestAProgramWritesOnlyWhatItIsGiven`, `TestAProgramMakesNoSocket`; the VM lane's `TestARootRunnersProgramHoldsNothingOfRoots`; the storage fakes refuse a file a run was not given, as the kernel does | | I16 | A store on the control plane's machine is reached by the installation's administrators only through the control plane, and by its processes only for what each is. | `TestOnlyTheControlPlaneSaysWhoTheAdministratorIs`, `TestGrafanaShowsTheStoreToTheAdministratorItIsTold`, `TestNothingWithoutTheStoresKeyTakesItsMetrics`, `TestTheStoresRunWhileTheirControlPlaneDoes` (each account to each port, against the kernel), `TestTheStoresGuardNamesEveryPortAndOnlyAccountsTheImageHas`; the dashboard lane's `Monitoring access` and `Admin Metrics` | -| I17 | Only the keys of the people a workspace's access names - its owner and the guests they invited - log in to it, each with the installation's certificate over it, or a session key under a grant one of those keys signed, within its 12 h; the control plane holds no key that logs in and is never an SSH client of a guest (ADR-0030). | the sshd lanes' `TestSSHDLetsInOnlyACertificateOverAKeyTheHostAdmits`, `TestThePasskeyTerminalLogsInToTheClaimedGuest`; `TestAPreparedRootLetsInOnlyByItsHostsWord`, `TestALoginIsWhatTheHostSaysOfTheKey`, `TestALoginIsWhatTheNewestAccessSaysOfTheKey`, `TestAWordAdmitsTheKeysOfThePeopleItNames`, `TestTheNewestKeptWordIsTheHighestItsOwnerSigns`, `TestAMachineIsGivenItsOwnWorkspacesNewestAccess`, `TestTheControlPlaneKeepsOnlyTheOwnersNewerAccess`, `TestAGuestIsLetInByTheAccessThatNamesThem`, `TestATunnelCertifiesOnlyAKeyOfSomebodyTheAccessNames`, `TestOnlyTheListedProceduresAdmitAGuest`, `TestAKeyringStartedAnewIsAnotherChain`; `TestAGrantHoldsFromItsIssueToItsEnd`, `TestASessionKeyLogsInWhereTheKeyThatGrantedItWould`, `TestASessionKeySignsOnlyAFirstAccessThatLetsInItsOwner`, `TestASessionKeysFirstWrittenAfterTheOwnersIsPassedOver`, `TestATunnelCertifiesASessionKeyOnlyUnderAGrantThatHolds`, `TestALoginUnderAGrantIsThePersonsWhoseKeySignedIt`, `TestSSHDHandsTheHostTheGrantACertificateCarries`; the VM lane's `TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`, `TestAGuestTakenOutStaysOutOfAWorkspaceRestoredToBeforeIt`, `TestTheOwnerLogsInToACloneOfTheirOwnSnapshot`; `TestAGuestIsConnectedToOnlyByAClaimThatHolds`, `TestASessionIsRefusedBeforeTheRelayIsDialled` | -| I19 | A workspace's identity is signed by the host that runs it, for the machine that asked, named only as its owner's access says - its team, owner, image and parent, fixed by the first - held to the owner's keyring and the team's roster, which people sign, and given only for an audience the access names; the control plane holds no key that signs one (ADR-0030). | `TestATokenIsTheAskingMachinesWorkspace`, `TestATokenIsForAnAudienceItsOwnerNamed`, `TestAWordGivesTheIdentityForTheAudiencesItNames`, `TestARunIsHeldToTheFirstKeyItPresents`, `TestAMachineIsNamedAsItsAccessSays`, `TestAnOwnerWhoseKeyringStartedAnewNamesNoMachine`, `TestABookSaysWhoIsAMemberByTheKeyringTheRosterNames`, `TestAKeyringIsAChainItsOwnKeysSigned`, `TestARosterIsAChainItsOwnersSigned`, `TestOnlyATeamOfOneStartsAnew`, `TestASignatureIsKeptOnlyAsProposedByWhoMaySignIt`, `TestAKeyringStartsAnewWhenItsPersonAsks`, `TestATeamOfMoreThanOneIsSignedAgainByAnotherOwner`, `TestAHostOpensTheKeyThroughAnAttestedDecrypt`, `TestAHostWritesOnlyItsOwnIdentityRecords`; the VM lane's `TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned` | -| I18 | What a workspace applies of its owner's settings, what of it leaves it, and which egress root it trusts are its access's: settings only as approved by their digest, the journal and the console only with consent, the root only as named by its digest (ADR-0030). | `TestOnlySettingsTheOwnerApprovedAreApplied`, `TestTheJournalIsSentOnlyWithTheOwnersConsent`, `TestTheEgressRootIsTrustedOnlyByTheOwnersWord`, `TestAWordNamesOnlyTheEgressRootThisMachinePinned`, `TestTheConsoleLeavesTheHostOnlyAsTheNewestAccessSays`, `TestAConsoleLeavesTheHostOnlyWithItsOwnersConsent` | +| I17 | Only the keys of the people a workspace's access names - its owner and the guests they invited - log in to it, each with the installation's certificate over it, or a session key under a grant one of those keys signed, within its 7 days; the control plane holds no key that logs in and is never an SSH client of a guest (ADR-0030). | the sshd lanes' `TestSSHDLetsInOnlyACertificateOverAKeyTheHostAdmits`, `TestThePasskeyTerminalLogsInToTheClaimedGuest`; `TestAPreparedRootLetsInOnlyByItsHostsWord`, `TestALoginIsWhatTheHostSaysOfTheKey`, `TestALoginIsWhatTheNewestAccessSaysOfTheKey`, `TestAWordAdmitsTheKeysOfThePeopleItNames`, `TestTheNewestKeptWordIsTheHighestItsOwnerSigns`, `TestAMachineIsGivenItsOwnWorkspacesNewestAccess`, `TestTheControlPlaneKeepsOnlyTheOwnersNewerAccess`, `TestAGuestIsLetInByTheAccessThatNamesThem`, `TestATunnelCertifiesOnlyAKeyOfSomebodyTheAccessNames`, `TestOnlyTheListedProceduresAdmitAGuest`, `TestAKeyringStartedAnewIsAnotherChain`; `TestAGrantHoldsFromItsIssueToItsEnd`, `TestASessionKeyLogsInWhereTheKeyThatGrantedItWould`, `TestASessionKeySignsOnlyAFirstAccessThatLetsInItsOwner`, `TestASessionKeysFirstWrittenAfterTheOwnersIsPassedOver`, `TestATunnelCertifiesASessionKeyOnlyUnderAGrantThatHolds`, `TestALoginUnderAGrantIsThePersonsWhoseKeySignedIt`, `TestSSHDHandsTheHostTheGrantACertificateCarries`, `TestOnePromptSignsASetAndOnlyWhatItLists`, `TestASetsNamespaceIsTheSetsAlone`; the VM lane's `TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`, `TestAGuestTakenOutStaysOutOfAWorkspaceRestoredToBeforeIt`, `TestTheOwnerLogsInToACloneOfTheirOwnSnapshot`; `TestAGuestIsConnectedToOnlyByAClaimThatHolds`, `TestASessionIsRefusedBeforeTheRelayIsDialled` | +| I19 | A workspace's identity is signed by the host that runs it, for the machine that asked, named only as its owner's access says - its team, owner, image and parent, fixed by the first - held to the owner's keyring and the team's roster, which people sign, and given only for an audience the installation allows; the control plane holds no key that signs one (ADR-0030). | `TestATokenIsTheAskingMachinesWorkspace`, `TestATokenIsForAnAudienceTheInstallationAllows`, `TestARunIsHeldToTheFirstKeyItPresents`, `TestAMachineIsNamedAsItsAccessSays`, `TestAnOwnerWhoseKeyringStartedAnewNamesNoMachine`, `TestABookSaysWhoIsAMemberByTheKeyringTheRosterNames`, `TestAKeyringIsAChainItsOwnKeysSigned`, `TestARosterIsAChainItsOwnersSigned`, `TestOnlyATeamOfOneStartsAnew`, `TestASignatureIsKeptOnlyAsProposedByWhoMaySignIt`, `TestAKeyringStartsAnewWhenItsPersonAsks`, `TestATeamOfMoreThanOneIsSignedAgainByAnotherOwner`, `TestAHostOpensTheKeyThroughAnAttestedDecrypt`, `TestAHostWritesOnlyItsOwnIdentityRecords`; the VM lane's `TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned` | +| I18 | What a workspace applies of its owner's - dotfiles, shell, environment, editor settings, Taskfile, the workspace's own environment, and the repository it clones - is what a key of the owner's newest keyring signed; a session key signs none of it, so an account taken over changes settings that apply nowhere. A repository is cloned only at a URL and ref they named, a pull request's head only where they named its ref too, a commit only in the history of the ref they named, and a disk's checkout from a prebuild only as the claim its building host signed says it is - that repository at the commit the guest is told. A guest is given what of the settings is its own workspace's, never another's environment, and the owner's own settings - all but the repository - only where they alone are root: not with a guest let in, nor on a copy of another person's snapshot. A control plane, which can open a root shell on any host, can hand back settings the owner signed before. | `TestTheHostApprovesOnlySettingsTheOwnersKeyringSigned`, `TestAPullRequestIsFetchedOnlyWhereTheSettingsNameIt`, `TestAGuestIsGivenItsOwnWorkspacesSettingsAlone`, `TestTheOwnersSettingsAreWithheldWhereOthersAreRoot`, `TestADisksCheckoutIsHeldToItsPrebuildsClaim`, `TestAPrebuildsBuildIsApprovedItsOwnCheckoutAlone`, `TestABuildChecksOutItsCommit`, `TestAPrebuildsCheckoutIsHeldToItsCommit`, `TestTheHostHoldsTheSettingsItsNewestSetCarries`, `TestOnlySettingsTheOwnerSignedAreApplied`, `TestSettingsHandedToARunningGuestApplyAsTheyCome`, `TestSettingsTheHostHasNotYetAreAskedForAgain`, `TestAProjectsRepositoryIsClonedAndItsTasksRunOnceApproved`, `TestAPersonsSettingsAreKeptOnlySignedByTheirKeyring`, `TestSettingsAreWhatTheKeyThatSignedThemSigned`, `TestADescriptionWritesOutWhatWouldNotShow`, `TestSettingsThatHideWhatTheyRunAreNotSigned`, `TestSettingsThatHideWhatTheyRunAreNotSaved`, `TestTheOwnersSettingsGoOnceAGuestIsLetIn`, `TestSettingsToSignAreShownAgainstThoseSignedLast`, `TestAProjectOpensFromItsNewestPrebuild`; the e2e lane's `TestSettingsChangedWithoutThePersonsKeyApplyNowhere` | | I20 | No commit holds a credential, in any file. | `task lint:secrets` | | I21 | A team's secret kept as a reference is read only as the team whose secret it is, so a team's admin cannot name another team's secret, or the installation's. | `TestASecretIsReadInASessionTaggedWithItsTeam`, `TestASecretSetAsAReferenceIsReadAsTheTeamBeforeItIsKept`, `TestASecretKeptAsAReferenceIsReadAsTheTeamThatKeepsIt`; spin-terraform-aws's posture run `a_teams_secret_is_read_only_as_the_team` | | I22 | A header the egress proxy sets for a workspace goes on no request its rule's scope - methods, a path prefix by whole segments - leaves out. | `TestAnInjectionIsSetOnlyOnTheRequestsItsScopeNames`, `TestARequestOutsideAnInjectionsScopeIsRefused`, `TestAnInjectionCrossesTheWireWhole` | +| I23 | A span a client sends the installation is kept as the client and the person whose credential sent it, never as anyone or anything else. | `TestAnExportReachesTheCollectorAsWhoSentIt`, `TestAnExportTheProxyCannotStampReachesNoCollector`, `TestExportsPastTheBoundAreToldToSendAgain`, `TestAnExportsSenderIsTheUserAuthFound`; the CLI lane's `TestE2E_ACommandIsASpanOfTheTraceItIsHanded` | diff --git a/src/content/docs/reference/status/index.md b/src/content/docs/reference/status/index.md index a76be1e..61a3d25 100644 --- a/src/content/docs/reference/status/index.md +++ b/src/content/docs/reference/status/index.md @@ -9,7 +9,7 @@ sidebar: -Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `2cfbcd74d`, and cannot say a feature the binary does not. spin is a private repository: a link to its code opens only for someone with access to it. +Every row of this page is a line of `internal/features` in spin, and a test there resolves it against the tree. A row that says **built** names what shows the feature exists - a procedure the control plane serves, a command the CLI has, or a test - and, under **End to end**, the tests that drive a real runner and its guest and check what the feature did, or what no test checks yet. spin's build checks that each of those tests is there and not quarantined; whether it checks the whole feature is its review's. A row that says **not built** is an item of [`docs/ROADMAP.md`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/ROADMAP.md). The page is written by `task reference` from `spin features` at spin `3cb9bb55f`, and cannot say a feature the binary does not. spin is a private repository: a link to its code opens only for someone with access to it. ## Built @@ -17,126 +17,126 @@ Every row of this page is a line of `internal/features` in spin, and a test ther | Feature | Exists | End to end | |---|---|---| -| A machine per workspace: KVM, its own kernel, root, a persistent disk, SSH | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vm_test.go#L189), a test of `internal/e2e` | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vm_test.go#L189) | -| Create, start, stop and delete | [`WorkspaceService/CreateWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_WorkspaceCRUD`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L415) | -| A trash: a deleted workspace stays whole, for its owner to undelete, until its days are up | [`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L379), a test of `internal/e2e` | [`TestATrashedWorkspaceIsWholeWhenItsOwnerUndeletesIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L411)
[`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L379) | -| Idle suspend, with a question before it that a keep answers | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L107), a test of `internal/e2e` | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L107) | -| A workspace that ran as long as the installation allows is suspended | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L69), a test of `internal/e2e` | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L69) | -| A process inside holds its workspace awake while it lives | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L190), a test of `internal/e2e` | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L190) | -| Suspend with the processes where they are; a start resumes them | [`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L35), a test of `internal/e2e` | [`TestE2E_ASuspendedWorkspaceResumesWhereItWas`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L288)
[`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L35) | -| Cores and memory lent while the host has them, and taken back
*A loan refused while the host is full has no test against the stack: the budget is the host's own cores and half its memory, which no lane's workspaces fill.* | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L342), a test of `internal/e2e` | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L342)
[`TestABusyWorkspaceIsLentMemoryAndGivesItBack`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/memory_test.go#L109) | -| A grant of cores and memory of its own, for a while | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L288), a test of `internal/e2e` | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/background_test.go#L288)
[`TestAResumedWorkspaceIsGivenWhatItIsGrantedWhileItRuns`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/resume_grant_test.go#L20) | -| An administrator changes a running workspace's bandwidth, its connections open | [`TestAnAdministratorChangesARunningWorkspacesBandwidth`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/bandwidth_test.go#L118), a test of `internal/e2e` | [`TestAnAdministratorChangesARunningWorkspacesBandwidth`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/bandwidth_test.go#L118)
[`TestAWorkspacesBandwidthHoldsAcrossItsRunsAndItsRunner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/bandwidth_test.go#L172) | -| Move a running workspace to another host, its processes as they are | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/hosts_flows_test.go#L65), a test of `internal/e2e` | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/hosts_flows_test.go#L65) | -| Clone a workspace: its disk, team, project, size, policies and environment, in one | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/clone_test.go#L64), a test of `internal/e2e` | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/clone_test.go#L64) | -| Recover a workspace whose host is gone, at a cost its owner accepts | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/hosts_flows_test.go#L100), a test of `internal/e2e` | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/hosts_flows_test.go#L100) | -| A workspace outlives its runner | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vm_test.go#L272), a test of `internal/e2e` | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vm_test.go#L272) | -| Quarantine, by an administrator | [`WorkspaceService/QuarantineWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L337) | -| Why a workspace is not behaving: status, console, history | [`spin workspace status`](/reference/cli/workspace/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L337)
[`TestE2E_AWorkspacesConsoleIsWhatItsMachinePrinted`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L371) | -| The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest | [`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/env_test.go#L23), a test of `internal/e2e` | [`TestTheOwnersSettingsArriveInTheGuest`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/env_test.go#L64)
[`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/env_test.go#L23) | -| Reset a disk to what it was created from | [`spin workspace reset`](/reference/cli/workspace/) | [`TestE2E_ResetPutsAWorkspaceBackToWhatItWasCreatedFrom`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L1197) | -| Claude Code, Codex and T3 Code on every workspace's PATH, at the versions the release pins, with their own defaults
*Where the installation fetches them (agents_fetch) or an operator publishes them: no image carries Claude Code, which only Anthropic may distribute.* | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/agentclis_test.go#L20), a test of `internal/e2e` | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/agentclis_test.go#L20) | -| An agent UI: T3 Code in a workspace as its agent user, over the owner's SSH session - from `spin agent` on the person's computer, or in the workspace's Agent tab in the dashboard, which frames the terminal's agent page that carries the client over a passkey's session
*The lane has no provider credential, so no test has a model answer through the brokered egress: the server is reached, as the agent's user, and nothing is asked of it. The browser's test drives the page with a virtual authenticator, which no real passkey's maker vouches for.* | [`spin agent --port`](/reference/cli/agent/) | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/t3_test.go#L80)
[`TestE2E_TheAgentIsServedOnThisComputerWhileTheSessionIsOpen`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L94)
[`agent.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/agent.spec.ts#L63): a passkey signs the person in, and the agent runs in their workspace from the terminal's page | -| Claude Code and Codex signed in from the agent's page: each CLI's own login, run by the supervisor as the agent's user, its credentials kept in the agent's home and never passing through the page
*The lane has no provider account: it begins a login and sees the provider's page, and finishing one is the unit tests' on each CLI's own output.* | `AgentService/BeginLogin` | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/t3_test.go#L80) | -| The supervisor runs the agent for its owner while it is used: started, paired and listed over the owner's own session on a socket only root opens, and stopped once nobody has used it for half an hour and no chat is at work
*That it stops once idle is the sweep's unit test on a clock the test moves: no lane waits half an hour.* | `AgentService/Start` | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/t3_test.go#L80) | -| The agent's chats listed on the workspace - titles, paths and times, never a message - reported by its supervisor only with the owner's consent | [`WorkspaceService/ListAgentThreads`](/reference/api/workspaceservice/) | [`TestTheAgentsThreadsAreListedOnlyWithTheOwnersConsent`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/t3_test.go#L136) | -| The agent's home is a volume of its own: the chats and sessions outlive the workspace, kept in the installation's store as every disk is, and a new workspace mounts them at its creation
*Sealed with the workspace's checkpoints, claimed with the launch beside the disk, and moved with the workspace.* | [`spin workspace create --agent-home`](/reference/cli/workspace/) | [`TestAnAgentsHomeOutlivesItsWorkspace`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/agenthome_test.go#L78) | +| A machine per workspace: KVM, its own kernel, root, a persistent disk, SSH | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vm_test.go#L189), a test of `internal/e2e` | [`TestAWorkspaceBootsARealGuest`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vm_test.go#L189) | +| Create, start, stop and delete | [`WorkspaceService/CreateWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_WorkspaceCRUD`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L416) | +| A trash: a deleted workspace stays whole, for its owner to undelete, until its days are up | [`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L379), a test of `internal/e2e` | [`TestATrashedWorkspaceIsWholeWhenItsOwnerUndeletesIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L411)
[`TestAWorkspaceWhoseDaysInTheTrashAreUpIsErasedFromItsHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L379) | +| Idle suspend, with a question before it that a keep answers | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L107), a test of `internal/e2e` | [`TestAWorkspaceIsAskedBeforeItsSuspensionAndAKeepAnswersIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L107) | +| A workspace that ran as long as the installation allows is suspended | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L69), a test of `internal/e2e` | [`TestAWorkspaceThatRanForAsLongAsAllowedIsSuspended`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L69) | +| A process inside holds its workspace awake while it lives | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L190), a test of `internal/e2e` | [`TestAProcessHoldsItsWorkspaceAwakeWhileItLives`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L190) | +| Suspend with the processes where they are; a start resumes them | [`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L35), a test of `internal/e2e` | [`TestE2E_ASuspendedWorkspaceResumesWhereItWas`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L288)
[`TestAWorkspaceNobodyUsesIsSuspendedAndAStartResumesIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L35) | +| Cores and memory lent while the host has them, and taken back
*A loan refused while the host is full has no test against the stack: the budget is the host's own cores and half its memory, which no lane's workspaces fill.* | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L342), a test of `internal/e2e` | [`TestABusyWorkspaceIsLentCoresAndGivesThemBack`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L342)
[`TestABusyWorkspaceIsLentMemoryAndGivesItBack`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/memory_test.go#L109) | +| A grant of cores and memory of its own, for a while | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L288), a test of `internal/e2e` | [`TestAGrantWhoseTimeIsUpIsGivenBackToTheMachine`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/background_test.go#L288)
[`TestAResumedWorkspaceIsGivenWhatItIsGrantedWhileItRuns`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/resume_grant_test.go#L20) | +| An administrator changes a running workspace's bandwidth, its connections open | [`TestAnAdministratorChangesARunningWorkspacesBandwidth`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/bandwidth_test.go#L118), a test of `internal/e2e` | [`TestAnAdministratorChangesARunningWorkspacesBandwidth`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/bandwidth_test.go#L118)
[`TestAWorkspacesBandwidthHoldsAcrossItsRunsAndItsRunner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/bandwidth_test.go#L172) | +| Move a running workspace to another host, its processes as they are | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/hosts_flows_test.go#L65), a test of `internal/e2e` | [`TestHostsAMoveTakesARunningWorkspaceToAnotherHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/hosts_flows_test.go#L65) | +| Clone a workspace: its disk, team, project, size, policies and environment, in one | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/clone_test.go#L64), a test of `internal/e2e` | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/clone_test.go#L64) | +| Recover a workspace whose host is gone, at a cost its owner accepts | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/hosts_flows_test.go#L100), a test of `internal/e2e` | [`TestHostsAWorkspaceWhoseHostIsGoneIsRecoveredOnAnother`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/hosts_flows_test.go#L100) | +| A workspace outlives its runner | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vm_test.go#L272), a test of `internal/e2e` | [`TestAWorkspaceOutlivesItsRunner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vm_test.go#L272) | +| Quarantine, by an administrator | [`WorkspaceService/QuarantineWorkspace`](/reference/api/workspaceservice/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L337) | +| Why a workspace is not behaving: status, console, history | [`spin workspace status`](/reference/cli/workspace/) | [`TestE2E_AQuarantinedWorkspaceIsHeldUntilReleased`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L337)
[`TestE2E_AWorkspacesConsoleIsWhatItsMachinePrinted`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L370) | +| The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest once they sign them, and a change nobody signed reaches none | [`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/env_test.go#L23), a test of `internal/e2e` | [`TestTheOwnersSettingsArriveInTheGuest`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/env_test.go#L82)
[`TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/env_test.go#L23)
[`TestSettingsChangedWithoutThePersonsKeyApplyNowhere`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/env_test.go#L128) | +| Reset a disk to what it was created from | [`spin workspace reset`](/reference/cli/workspace/) | [`TestE2E_ResetPutsAWorkspaceBackToWhatItWasCreatedFrom`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1218) | +| Claude Code, Codex and T3 Code on every workspace's PATH, at the versions the release pins, with their own defaults
*Where the installation fetches them (agents_fetch) or an operator publishes them: no image carries Claude Code, which only Anthropic may distribute.* | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/agentclis_test.go#L20), a test of `internal/e2e` | [`TestTheAgentCLIsAreOnPathWithThePinnedVersions`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/agentclis_test.go#L20) | +| An agent UI: T3 Code in a workspace as its agent user, over the owner's SSH session - from `spin agent` on the person's computer, or in the workspace's Agent tab in the dashboard, which frames the terminal's agent page that carries the client over a passkey's session
*The lane has no provider credential, so no test has a model answer through the brokered egress: the server is reached, as the agent's user, and nothing is asked of it. The browser's test drives the page with a virtual authenticator, which no real passkey's maker vouches for.* | [`spin agent --port`](/reference/cli/agent/) | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/t3_test.go#L79)
[`TestE2E_TheAgentIsServedOnThisComputerWhileTheSessionIsOpen`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L94)
[`agent.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/agent.spec.ts#L63): a passkey signs the person in, and the agent runs in their workspace from the terminal's page | +| Claude Code and Codex signed in from the agent's page: each CLI's own login, run by the supervisor as the agent's user, its credentials kept in the agent's home and never passing through the page
*The lane has no provider account: it begins a login and sees the provider's page, and finishing one is the unit tests' on each CLI's own output.* | `AgentService/BeginLogin` | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/t3_test.go#L79) | +| A person signs Claude Code and Codex in once: every workspace of theirs, plain or a project's, is handed the same credentials and hands back each refresh and logout, and a workspace that names a guest holds none
*The lane has no provider account: its login is the file the CLI writes, written as the agent's user. Only a workspace its owner's alone through all it came from holds them: a project opened from its prebuild does, but not a prebuild's build, a copy of another person's snapshot, or one made before the release that keeps the mark.* | [`TestAPersonSignsInToTheAgentOnceForEveryWorkspaceOfTheirs`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/agentcredentials_test.go#L32), a test of `internal/e2e` | [`TestAPersonSignsInToTheAgentOnceForEveryWorkspaceOfTheirs`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/agentcredentials_test.go#L32) | +| The supervisor runs the agent for its owner while it is used: started, paired and listed over the owner's own session on a socket only root opens, and stopped once nobody has used it for half an hour and no chat is at work
*That it stops once idle is the sweep's unit test on a clock the test moves: no lane waits half an hour.* | `AgentService/Start` | [`TestTheSupervisorRunsTheAgentForItsOwner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/t3_test.go#L79) | +| The agent's chats listed on the workspace - titles, paths and times, never a message - reported by its supervisor | [`WorkspaceService/ListAgentThreads`](/reference/api/workspaceservice/) | [`TestTheAgentsThreadsAreListed`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/t3_test.go#L184) | +| The agent's home is a volume of its own: the chats and sessions outlive the workspace, kept in the installation's store as every disk is, and a new workspace mounts them at its creation
*Sealed with the workspace's checkpoints, claimed with the launch beside the disk, and moved with the workspace.* | [`spin workspace create --agent-home`](/reference/cli/workspace/) | [`TestAnAgentsHomeOutlivesItsWorkspace`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/agenthome_test.go#L78) | ### Teams and projects | Feature | Exists | End to end | |---|---|---| -| Open a repository, branch, commit or pull request from its URL, in the dashboard (/launch) and from the terminal
*From the terminal; the dashboard's /launch page makes the same create and has no test of its own against the stack.* | [`spin open --no-connect`](/reference/cli/open/) | [`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L222) | -| A workspace opened at a commit or a pull request, checked out as pr-<n> | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/project_test.go#L91), a test of `internal/e2e` | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/project_test.go#L91)
[`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L222) | -| Teams, with owner, admin and member | [`spin team member role`](/reference/cli/team/) | [`TestE2E_ATeamRoleIsWhatItsHolderMayDo`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L491) | -| A team's own identity providers | [`TeamService/CreateIdentityProvider`](/reference/api/teamservice/) | [`TestE2E_ATeamsIdentityProviderIsItsAdminsAndSignsNobodyIn`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L523) | +| Open a repository, branch, commit or pull request from its URL, in the dashboard (/launch) and from the terminal
*From the terminal; the dashboard's /launch page makes the same create and has no test of its own against the stack.* | [`spin open --no-connect`](/reference/cli/open/) | [`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L222) | +| A workspace opened at a commit or a pull request, checked out as pr-<n> | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/project_test.go#L90), a test of `internal/e2e` | [`TestAProjectsWorkspaceOpensAtTheCommitItWasAskedFor`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/project_test.go#L90)
[`TestE2E_AURLOpensTheWorkspaceItNames`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L222) | +| Teams, with owner, admin and member | [`spin team member role`](/reference/cli/team/) | [`TestE2E_ATeamRoleIsWhatItsHolderMayDo`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L492) | +| A team's own identity providers | [`TeamService/CreateIdentityProvider`](/reference/api/teamservice/) | [`TestE2E_ATeamsIdentityProviderIsItsAdminsAndSignsNobodyIn`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L524) | | Your GitHub account, connected once: private repositories cloned and pushed with nothing on the disk | [`ForgeService/CompleteConnect`](/reference/api/forgeservice/) | not yet: consent takes a person on GitHub's page, and revoking a grant would end the one authorization a lane could live on: checked by hand once per release | | Your GitHub account connected from the CLI, with a code entered on GitHub's page | [`spin git connect`](/reference/cli/git/) | not yet: the code is entered by a person on GitHub's page: checked by hand once per release | | A repository picked from the ones your account reaches | [`spin git repos`](/reference/cli/git/) | not yet: a real GitHub account the lane can search with | -| A team's own network policies, where the installation allows them | [`spin team policy set`](/reference/cli/team/) | [`TestATeamsOwnPolicyIsWhatItsWorkspacesReach`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/team_policy_test.go#L24) | -| Projects of the installation: a repository and the shape of the workspace that opens it, shared with everyone or some | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/project_test.go#L27), a test of `internal/e2e` | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/project_test.go#L27) | -| Prebuilds of a project's refs, as the floor of the workspaces that open them | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/prebuild_test.go#L29), a test of `internal/e2e` | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/prebuild_test.go#L29) | -| A team's workspaces run on the installation's hosts | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/team_test.go#L20), a test of `internal/e2e` | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/team_test.go#L20) | +| A team's own network policies, where the installation allows them | [`spin team policy set`](/reference/cli/team/) | [`TestATeamsOwnPolicyIsWhatItsWorkspacesReach`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/team_policy_test.go#L24) | +| Projects of the installation: a repository and the shape of the workspace that opens it, shared with everyone or some | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/project_test.go#L29), a test of `internal/e2e` | [`TestAProjectsWorkspaceHasItsRepositoryCheckedOutAtTheRef`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/project_test.go#L29) | +| Prebuilds of a project's refs, as the floor of the workspaces that open them | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/prebuild_test.go#L25), a test of `internal/e2e` | [`TestAProjectOpensAsItsPrebuildMadeIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/prebuild_test.go#L25) | +| A team's workspaces run on the installation's hosts | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/team_test.go#L20), a test of `internal/e2e` | [`TestATeamsWorkspaceRunsOnTheInstallationsHost`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/team_test.go#L20) | ### Snapshots | Feature | Exists | End to end | |---|---|---| -| Snapshots of a running workspace's disk | [`WorkspaceService/CreateSnapshot`](/reference/api/workspaceservice/) | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/clone_test.go#L64)
[`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/compaction_test.go#L19) | -| Snapshots with memory, resumed with their processes | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restore_test.go#L175), a test of `internal/e2e` | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restore_test.go#L175) | -| Restore a workspace to a snapshot | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restore_test.go#L29), a test of `internal/e2e` | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restore_test.go#L29)
[`TestE2E_TheQuickstartsDiffIsWhatTheSiteShows`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/site_e2e_test.go#L24) | -| A diff of the files that changed between two snapshots | [`TestADiffOfTwoSnapshotsIsWhatChangedBetweenThem`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/diff_test.go#L28), a test of `internal/e2e` | [`TestADiffOfTwoSnapshotsNamesWhatWasAddedChangedAndRemoved`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/diff_test.go#L95)
[`TestE2E_TheQuickstartsDiffIsWhatTheSiteShows`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/site_e2e_test.go#L24) | -| Share a snapshot with a person or make it public, and create a workspace from it | [`TestACloneOfASnapshotRegistersAsItself`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/clone_test.go#L24), a test of `internal/e2e` | [`TestASharedSnapshotIsCreatedFromByThePersonItIsSharedWith`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/share_test.go#L22) | -| What looks like a credential is found before a share, and the share refused unless acknowledged | [`ShareService/ShareSnapshot`](/reference/api/shareservice/) | [`TestE2E_ASharedSnapshotIsScannedForCredentials`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L171) | -| A long chain is compacted while the workspace runs | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/compaction_test.go#L19), a test of `internal/e2e` | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/compaction_test.go#L19) | +| Snapshots of a running workspace's disk | [`WorkspaceService/CreateSnapshot`](/reference/api/workspaceservice/) | [`TestACloneHoldsWhatItsSourceWroteAndItsShape`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/clone_test.go#L64)
[`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/compaction_test.go#L19) | +| Snapshots with memory, resumed with their processes | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restore_test.go#L175), a test of `internal/e2e` | [`TestARunningWorkspaceResumesFromASnapshotsMemory`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restore_test.go#L175) | +| Restore a workspace to a snapshot | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restore_test.go#L29), a test of `internal/e2e` | [`TestARestoredWorkspaceBootsOnTheSnapshotItWasRestoredTo`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restore_test.go#L29)
[`TestE2E_TheQuickstartsDiffIsWhatTheSiteShows`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/site_e2e_test.go#L24) | +| A diff of the files that changed between two snapshots | [`TestADiffOfTwoSnapshotsIsWhatChangedBetweenThem`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/diff_test.go#L28), a test of `internal/e2e` | [`TestADiffOfTwoSnapshotsNamesWhatWasAddedChangedAndRemoved`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/diff_test.go#L95)
[`TestE2E_TheQuickstartsDiffIsWhatTheSiteShows`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/site_e2e_test.go#L24) | +| Share a snapshot with a person or make it public, and create a workspace from it | [`TestACloneOfASnapshotRegistersAsItself`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/clone_test.go#L24), a test of `internal/e2e` | [`TestASharedSnapshotIsCreatedFromByThePersonItIsSharedWith`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/share_test.go#L22) | +| What looks like a credential is found before a share, and the share refused unless acknowledged | [`ShareService/ShareSnapshot`](/reference/api/shareservice/) | [`TestE2E_ASharedSnapshotIsScannedForCredentials`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L171) | +| A long chain is compacted while the workspace runs | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/compaction_test.go#L19), a test of `internal/e2e` | [`TestADiskSnapshottedPastTheThresholdIsCompactedWhileItRuns`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/compaction_test.go#L19) | ### Network | Feature | Exists | End to end | |---|---|---| -| Egress is closed by default; policies, by tag, name what a workspace may reach | [`TestAnOwnerMayOnlyChooseAPolicyTheInstallationDeclares`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L163), a test of `internal/e2e` | [`TestAWorkspaceNamedNoPolicyReachesNothing`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L71)
[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L24) | -| A workspace's DNS goes upstream only for what its policy names, so a policy that closes egress closes the tunnel through names | [`TestAWorkspaceAsksItsResolverOnlyWhatItsPolicyNames`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/resolver_test.go#L76), a test of `internal/e2e` | [`TestAWorkspaceAsksItsResolverOnlyWhatItsPolicyNames`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/resolver_test.go#L76) | -| A policy changed reaches the host that runs the workspace | [`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L24), a test of `internal/e2e` | [`TestAnEditedPolicyChangesWhatARunningGuestReaches`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L100)
[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/retag_test.go#L24) | -| Brokered names: the host's proxy stands in and adds what the workspace never holds - a team secret, a forge token, its identity, a cloud role
*The team secret's value is read at the origin; the forge token, identity and cloud role injections have no test against the stack.* | [`spin team secret set`](/reference/cli/team/) | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L100) | -| A workspace trusts the egress root only by its owner's word | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/egress_root_test.go#L20), a test of `internal/e2e` | [`TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/egress_root_test.go#L20) | -| What a workspace reached, what it looked up and what it was refused | [`spin workspace egress`](/reference/cli/workspace/) | [`TestE2E_EgressIsAnsweredByTheHostTheWorkspaceRunsOn`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L784) | -| Each request to a brokered name as the proxy read it, served or refused and why; and whether each injection's secret is the team's to give | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L28), a test of `internal/e2e` | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L28) | -| The egress proxy is a process of its own, holding no key of the host's, started again by the runner when it ends | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/egress_process_test.go#L21), a test of `internal/e2e` | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/egress_process_test.go#L21) | -| A brokered rule names whose it is, the agent's or the person's: one policy says what each may reach and with what | [`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L72), a test of `internal/e2e` | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L100)
[`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L72) | -| A WebSocket to a brokered name: its handshake under the rule's headers and scope, then bytes each way
*The rule's header on the handshake is not read at the origin: the lane's WebSocket echo answers frames, not headers.* | [`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L168), a test of `internal/e2e` | [`TestAWebSocketToABrokeredNameCarriesTheGuestsBytesAndRefusesAPathOutOfScope`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L196)
[`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L168) | -| HTTP/2 to a brokered name, the proxy's ALPN the real host's: a rule's headers set stream by stream, gRPC's trailers both ways
*gRPC's trailers are egressproxy's h2 test against an origin of its own; the lane has no gRPC origin to reach.* | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L231), a test of `internal/e2e` | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L231)
[`TestEachStreamOfAnHTTP2ConnectionToABrokeredNameCarriesTheRulesHeader`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L251) | -| Watch where a workspace connects, into its logs | [`spin workspace watch`](/reference/cli/workspace/) | [`TestE2E_AWatchedWorkspacesConnectionsAreInItsLogs`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L392) | -| An agent the supervisor starts is marked, and reaches only brokered names | [`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/seal_test.go#L21), a test of `internal/e2e` | [`TestAnAgentReachesOnlyBrokeredNames`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/brokered_test.go#L138)
[`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/seal_test.go#L21) | -| Published ports at https://{port}-{workspace}.{domain}: private, whitelisted or public | [`spin port expose`](/reference/cli/port/) | [`TestAPublicPortIsReachedWithNoSessionAtAll`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/proxy/lane_test.go#L144)
[`workspace-sign-in.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/workspace-sign-in.spec.ts#L31): a visitor signed in to the dashboard reaches their private port | +| Egress is closed by default; policies, by tag, name what a workspace may reach | [`TestAnOwnerMayOnlyChooseAPolicyTheInstallationDeclares`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L163), a test of `internal/e2e` | [`TestAWorkspaceNamedNoPolicyReachesNothing`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L71)
[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L24) | +| A workspace's DNS goes upstream only for what its policy names, so a policy that closes egress closes the tunnel through names | [`TestAWorkspaceAsksItsResolverOnlyWhatItsPolicyNames`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/resolver_test.go#L76), a test of `internal/e2e` | [`TestAWorkspaceAsksItsResolverOnlyWhatItsPolicyNames`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/resolver_test.go#L76) | +| A policy changed reaches the host that runs the workspace | [`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L24), a test of `internal/e2e` | [`TestAnEditedPolicyChangesWhatARunningGuestReaches`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L100)
[`TestChangingAWorkspacesPoliciesReachesTheHostThatRunsIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/retag_test.go#L24) | +| Brokered names: the host's proxy stands in and adds what the workspace never holds - a team secret, a forge token, its identity, a cloud role
*The team secret's value is read at the origin; the forge token, identity and cloud role injections have no test against the stack.* | [`spin team secret set`](/reference/cli/team/) | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L100) | +| What a workspace reached, what it looked up and what it was refused | [`spin workspace egress`](/reference/cli/workspace/) | [`TestE2E_EgressIsAnsweredByTheHostTheWorkspaceRunsOn`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L838) | +| Each request to a brokered name as the proxy read it, served or refused and why; and whether each injection's secret is the team's to give | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L28), a test of `internal/e2e` | [`TestABrokeredRequestIsSeenAsTheProxyReadIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L28) | +| The egress proxy is a process of its own, holding no key of the host's, started again by the runner when it ends | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/egress_process_test.go#L21), a test of `internal/e2e` | [`TestTheEgressProxyIsAProcessOfItsOwnThatTheRunnerStartsAgain`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/egress_process_test.go#L21) | +| A brokered rule names whose it is, the agent's or the person's: one policy says what each may reach and with what | [`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L72), a test of `internal/e2e` | [`TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L100)
[`TestABrokeredNameForTheAgentIsTheAgentsAlone`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L72) | +| A WebSocket to a brokered name: its handshake under the rule's headers and scope, then bytes each way
*The rule's header on the handshake is not read at the origin: the lane's WebSocket echo answers frames, not headers.* | [`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L168), a test of `internal/e2e` | [`TestAWebSocketToABrokeredNameCarriesTheGuestsBytesAndRefusesAPathOutOfScope`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L196)
[`TestAWebSocketToABrokeredNameIsCarriedAfterItsHandshake`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L168) | +| HTTP/2 to a brokered name, the proxy's ALPN the real host's: a rule's headers set stream by stream, gRPC's trailers both ways
*gRPC's trailers are egressproxy's h2 test against an origin of its own; the lane has no gRPC origin to reach.* | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L231), a test of `internal/e2e` | [`TestHTTP2ToABrokeredNameIsTheRealHosts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L231)
[`TestEachStreamOfAnHTTP2ConnectionToABrokeredNameCarriesTheRulesHeader`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L251) | +| Watch where a workspace connects, into its logs | [`spin workspace watch`](/reference/cli/workspace/) | [`TestE2E_AWatchedWorkspacesConnectionsAreInItsLogs`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L388) | +| An agent the supervisor starts is marked, and reaches only brokered names | [`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/seal_test.go#L21), a test of `internal/e2e` | [`TestAnAgentReachesOnlyBrokeredNames`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/brokered_test.go#L138)
[`TestARealWorkspaceMarksTheAgentItsSupervisorStarts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/seal_test.go#L21) | +| Published ports at https://{port}-{workspace}.{domain}: private, whitelisted or public | [`spin port expose`](/reference/cli/port/) | [`TestAPublicPortIsReachedWithNoSessionAtAll`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/proxy/lane_test.go#L144)
[`workspace-sign-in.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/workspace-sign-in.spec.ts#L31): a visitor signed in to the dashboard reaches their private port | ### Access | Feature | Exists | End to end | |---|---|---| | Sign in with GitHub or an OIDC provider | [`AuthService/StartLogin`](/reference/api/authservice/) | not yet: a GitHub provider: the sign-in through it and the verified email it gives | -| Device login for a terminal | [`AuthService/StartDeviceLogin`](/reference/api/authservice/) | [`TestE2E_Logout`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L1184)
[`auth.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/auth.spec.ts#L19): the CLI's device page stands alone and keeps its code through a sign-in | -| API keys for scripts and agents | [`spin api-key create`](/reference/cli/api-key/) | [`TestE2E_APIKeyCRUD`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L1139) | -| SSH keys, and plain ssh to spin.<workspace> | [`spin ssh-config`](/reference/cli/ssh-config/) | [`TestE2E_SSHConfigCarriesSSHToAWorkspace`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L655) | -| Who logs in to a workspace is what its owner signed | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/login_test.go#L259), a test of `internal/e2e` | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/login_test.go#L259) | -| Guests of a workspace, invited by its owner | [`spin workspace guests`](/reference/cli/workspace/) | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/login_test.go#L259) | -| A workspace's identity, signed by its host, for the audiences its owner allows | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/identity_test.go#L60), a test of `internal/e2e` | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/identity_test.go#L60) | -| VS Code over SSH, with the server the installation publishes and nothing downloaded
*The server is Microsoft's, for Remote-SSH; spin code also opens an editor with Open Remote - SSH, which downloads its own. spin code itself is run by its unit tests only: it opens a desktop editor, which no lane has.* | [`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vscodehotplug_test.go#L23), a test of `internal/e2e` | [`TestTheCarriedVSCodeServerRunsOfflineAndAnswersOverTheSSHTunnel`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vscodeserver_test.go#L86)
[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vscodehotplug_test.go#L23) | -| Run a command in a workspace, copy files to and from it | [`spin exec`](/reference/cli/exec/) | [`TestE2E_ADetachedRunIsFollowedToItsEndAndFilesGoBothWays`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L306) | +| Device login for a terminal | [`AuthService/StartDeviceLogin`](/reference/api/authservice/) | [`TestE2E_Logout`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1205)
[`auth.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/auth.spec.ts#L19): the CLI's device page stands alone and keeps its code through a sign-in | +| API keys for scripts and agents | [`spin api-key create`](/reference/cli/api-key/) | [`TestE2E_APIKeyCRUD`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1160) | +| SSH keys, and plain ssh to spin.<workspace> | [`spin ssh-config`](/reference/cli/ssh-config/) | [`TestE2E_SSHConfigCarriesSSHToAWorkspace`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L709) | +| Who logs in to a workspace is what its owner signed | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/login_test.go#L307), a test of `internal/e2e` | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/login_test.go#L307) | +| Guests of a workspace, invited by its owner | [`spin workspace guests`](/reference/cli/workspace/) | [`TestOnlyThePeopleTheAccessNamesLogInToAWorkspace`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/login_test.go#L307) | +| A workspace's identity, signed by its host, for the audiences its owner allows | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/identity_test.go#L59), a test of `internal/e2e` | [`TestAWorkspacesIdentityIsTheHostsSignatureOfWhatItsOwnerSigned`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/identity_test.go#L59) | +| VS Code over SSH, with the server the installation publishes and nothing downloaded
*The server is Microsoft's, for Remote-SSH; spin code also opens an editor with Open Remote - SSH, which downloads its own. spin code itself is run by its unit tests only: it opens a desktop editor, which no lane has.* | [`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vscodehotplug_test.go#L23), a test of `internal/e2e` | [`TestTheCarriedVSCodeServerRunsOfflineAndAnswersOverTheSSHTunnel`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vscodeserver_test.go#L86)
[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vscodehotplug_test.go#L23) | +| Run a command in a workspace, copy files to and from it | [`spin exec`](/reference/cli/exec/) | [`TestE2E_ADetachedRunIsFollowedToItsEndAndFilesGoBothWays`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L306) | ### Administration | Feature | Exists | End to end | |---|---|---| -| Installation settings seeded from a file; a change in the file is a proposal to apply or dismiss | [`AdminService/DecideConfigChange`](/reference/api/adminservice/) | [`TestTheInstallationFileSeedsAndItsChangesAreAnAdministratorsToDecide`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/config_file_test.go#L92) | -| Resource presets | [`AdminService/CreateResourcePreset`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L424): an admin's preset sizes a person's workspace, and is gone once deleted | -| Registration: open, by allowlist, or closed | [`AdminService/SetRegistrationMode`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L218): closed, open and a domain on the allowlist decide who registers
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L148): the allowlist lets in who it names, and nobody else | -| An audit log | [`AdminService/ListAuditLog`](/reference/api/adminservice/) | [`TestE2E_AnAdministratorsActionIsAuditedWithItsActorAndTarget`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L598)
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L897): admin reads the log and can narrow it to one kind of event | -| The control plane's jobs, and running one now | [`spin admin jobs`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L1044)
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L707): admin runs a job by hand and sees how it ended | +| Installation settings seeded from a file; a change in the file is a proposal to apply or dismiss | [`AdminService/DecideConfigChange`](/reference/api/adminservice/) | [`TestTheInstallationFileSeedsAndItsChangesAreAnAdministratorsToDecide`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/config_file_test.go#L92) | +| Resource presets | [`AdminService/CreateResourcePreset`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L424): an admin's preset sizes a person's workspace, and is gone once deleted | +| Registration: open, by allowlist, or closed | [`AdminService/SetRegistrationMode`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L218): closed, open and a domain on the allowlist decide who registers
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L148): the allowlist lets in who it names, and nobody else | +| An audit log | [`AdminService/ListAuditLog`](/reference/api/adminservice/) | [`TestE2E_AnAdministratorsActionIsAuditedWithItsActorAndTarget`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L599)
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L897): admin reads the log and can narrow it to one kind of event | +| The control plane's jobs, and running one now | [`spin admin jobs`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1063)
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L707): admin runs a job by hand and sees how it ended | | The month's bill, its forecast, and what each workspace cost | [`spin admin costs`](/reference/cli/admin/) | not yet: the cloud's real bill read: no lane has an AWS account, so the bill a test gives the reader stands in for it | -| The store: every volume, whose it is, and taking out what nothing needs | [`spin admin storage list`](/reference/cli/admin/) | [`TestAVolumeNothingNeedsIsTakenOutOfTheStore`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/orphan_test.go#L26) | -| Re-key a workspace's disk | [`spin admin volume rekey`](/reference/cli/admin/) | [`TestARekeyedDiskBootsWithWhatItHeldUnderANewKey`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/rekey_test.go#L24) | -| Runners: registration tokens, drain, activate, revoke, and a policy per host | [`spin admin runner drain`](/reference/cli/admin/) | [`TestARunnerRegisteredWithATokenTheAPIMadeIsRevokedByTheAdmin`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/runner_token_test.go#L99)
[`TestARegistrationTokenExpiredOrRevokedRegistersNothing`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/runner_token_test.go#L148) | +| The store: every volume, whose it is, and taking out what nothing needs | [`spin admin storage list`](/reference/cli/admin/) | [`TestAVolumeNothingNeedsIsTakenOutOfTheStore`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/orphan_test.go#L26) | +| Re-key a workspace's disk | [`spin admin volume rekey`](/reference/cli/admin/) | [`TestARekeyedDiskBootsWithWhatItHeldUnderANewKey`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/rekey_test.go#L24) | +| Runners: registration tokens, drain, activate, revoke, and a policy per host | [`spin admin runner drain`](/reference/cli/admin/) | [`TestARunnerRegisteredWithATokenTheAPIMadeIsRevokedByTheAdmin`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/runner_token_test.go#L99)
[`TestARegistrationTokenExpiredOrRevokedRegistersNothing`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/runner_token_test.go#L148) | | Runners start when a workspace waits for one and stop when nothing runs | [`HostService/GetFleet`](/reference/api/hostservice/) | not yet: an autoscaling group to start and stop: the one group is AWS's, and no lane has an account | -| A root shell on a runner, for a while and with a reason: the runner emptied first, every session recorded under Object Lock, the runner retired after | [`spin admin shell open`](/reference/cli/admin/) | [`TestHostsARootShellOnAHostIsRecordedAndItsHostRetired`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/hosts_test.go#L420) | -| A host that reboots brings its workspaces back | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restart_test.go#L38), a test of `internal/e2e` | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/restart_test.go#L38) | -| A cloud's reclaim warning empties the host before the machine goes | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/preemption_test.go#L26), a test of `internal/e2e` | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/preemption_test.go#L26) | -| A writeback bound per host, measured on that host before it is taken | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/writeback_test.go#L28), a test of `internal/e2e` | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/writeback_test.go#L28) | -| What is running where: the control plane, each runner and its machine | [`spin admin versions`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L1044) | +| A root shell on a runner, for a while and with a reason: the runner emptied first, every session recorded under Object Lock, the runner retired after | [`spin admin shell open`](/reference/cli/admin/) | [`TestHostsARootShellOnAHostIsRecordedAndItsHostRetired`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/hosts_test.go#L420) | +| A host that reboots brings its workspaces back | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restart_test.go#L38), a test of `internal/e2e` | [`TestAHostRebootBringsItsWorkspacesBack`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/restart_test.go#L38) | +| A cloud's reclaim warning empties the host before the machine goes | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/preemption_test.go#L26), a test of `internal/e2e` | [`TestACloudsReclaimWarningEmptiesTheHostBeforeAnySignal`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/preemption_test.go#L26) | +| A writeback bound per host, measured on that host before it is taken | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/writeback_test.go#L28), a test of `internal/e2e` | [`TestCustomWritebackValuesAreMeasuredOnTheRunner`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/writeback_test.go#L28) | +| What is running where: the control plane, each runner and its machine | [`spin admin versions`](/reference/cli/admin/) | [`TestE2E_Admin`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1063) | ### Observability | Feature | Exists | End to end | |---|---|---| -| Platform logs, workspace logs and traces, searched in the product | [`LogService/SearchPlatformLogs`](/reference/api/logservice/) | [`TestAWorkspacesLinesAndTracesAreFoundBySearchingForIt`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/observe_test.go#L130)
[`TestE2E_TheInstallationsLogsAreSearchable`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L946) | -| Metrics, with Grafana on the control plane | [`AdminService/GetMonitoring`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L1159): a series of the lane's host is in the metric store, read through Grafana
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/dashboard/e2e/admin.spec.ts#L1128): admin reads the installation's dashboards without leaving the page | -| A workspace's journal and console are collected only with its owner's consent | [`spin workspace logs-consent`](/reference/cli/workspace/) | [`TestE2E_AWorkspacesConsoleIsKeptAndSearchable`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/e2e_test.go#L967) | +| Platform logs, workspace logs and traces, searched in the product | [`LogService/SearchPlatformLogs`](/reference/api/logservice/) | [`TestAWorkspacesLinesAndTracesAreFoundBySearchingForIt`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/observe_test.go#L130)
[`TestE2E_TheInstallationsLogsAreSearchable`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1000) | +| Metrics, with Grafana on the control plane | [`AdminService/GetMonitoring`](/reference/api/adminservice/) | [`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L1159): a series of the lane's host is in the metric store, read through Grafana
[`admin.spec.ts`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/dashboard/e2e/admin.spec.ts#L1128): admin reads the installation's dashboards without leaving the page | +| A workspace's journal and console are collected as the installation's policy says | [`spin workspace logs`](/reference/cli/workspace/) | [`TestE2E_AWorkspacesConsoleIsKeptAndSearchable`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/e2e_test.go#L1021) | ### Platform | Feature | Exists | End to end | |---|---|---| -| A smoke test of what an installation's API promises, with a workspace of its own | [`spin smoke`](/reference/cli/smoke/) | [`TestE2E_SmokePassesAndLeavesNothingBehind`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/cmd/cli/journeys_e2e_test.go#L442) | -| A host serves only the releases it carries
*A resume whose recorded release was collected since has no test against the stack.* | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/suspend_test.go#L126), a test of `internal/e2e` | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/suspend_test.go#L126)
[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/internal/e2e/vscodehotplug_test.go#L23) | +| A smoke test of what an installation's API promises, with a workspace of its own | [`spin smoke`](/reference/cli/smoke/) | [`TestE2E_SmokePassesAndLeavesNothingBehind`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/cmd/cli/journeys_e2e_test.go#L437) | +| A host serves only the releases it carries
*A resume whose recorded release was collected since has no test against the stack.* | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/suspend_test.go#L126), a test of `internal/e2e` | [`TestAMachineAdoptedWithoutItsReleasesIsSuspendedWithItsDisk`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/suspend_test.go#L126)
[`TestAVSCodeServerOfAnotherCommitIsHandedToTheRunningMachine`](https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/internal/e2e/vscodehotplug_test.go#L23) | ## Partly there diff --git a/src/content/docs/use/dashboard.md b/src/content/docs/use/dashboard.md index 76ead5c..b835cc3 100644 --- a/src/content/docs/use/dashboard.md +++ b/src/content/docs/use/dashboard.md @@ -7,7 +7,7 @@ editUrl: false -The dashboard is at `https://app.`. These screenshots are of spin v20261104.01, taken by spin's dashboard suite on its end-to-end stack - real workspaces on a real runner - each by a test that first checks the screen shows what its title says. Everything here is also in the [CLI](/reference/cli/) and the [API](/reference/api/). +The dashboard is at `https://app.`. These screenshots are of spin v20261106.01, taken by spin's dashboard suite on its end-to-end stack - real workspaces on a real runner - each by a test that first checks the screen shows what its title says. Everything here is also in the [CLI](/reference/cli/) and the [API](/reference/api/). ## A person's workspaces diff --git a/src/data/features.json b/src/data/features.json index 0765840..557abc8 100644 --- a/src/data/features.json +++ b/src/data/features.json @@ -188,13 +188,14 @@ }, { "area": "Workspaces", - "name": "The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest", + "name": "The owner's shell, environment, editor settings, Taskfile and dotfiles reach the guest once they sign them, and a change nobody signed reaches none", "state": "built", "proof": "e2e:TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell", "note": "", "endToEnd": [ "go:internal/e2e.TestTheOwnersSettingsArriveInTheGuest", - "go:internal/e2e.TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell" + "go:internal/e2e.TestAWorkspacesOwnEnvironmentIsInItsOwnersLoginShell", + "go:internal/e2e.TestSettingsChangedWithoutThePersonsKeyApplyNowhere" ] }, { @@ -336,16 +337,6 @@ "go:internal/e2e.TestAPersonsRuleAndAnAgentsOnOneNameEachArriveWithTheirOwnInjection" ] }, - { - "area": "Network", - "name": "A workspace trusts the egress root only by its owner's word", - "state": "built", - "proof": "e2e:TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord", - "note": "", - "endToEnd": [ - "go:internal/e2e.TestAGuestTrustsTheEgressRootOnlyByItsOwnersWord" - ] - }, { "area": "Network", "name": "What a workspace reached, what it looked up and what it was refused", @@ -553,6 +544,16 @@ "go:internal/e2e.TestTheSupervisorRunsTheAgentForItsOwner" ] }, + { + "area": "Workspaces", + "name": "A person signs Claude Code and Codex in once: every workspace of theirs, plain or a project's, is handed the same credentials and hands back each refresh and logout, and a workspace that names a guest holds none", + "state": "built", + "proof": "e2e:TestAPersonSignsInToTheAgentOnceForEveryWorkspaceOfTheirs", + "note": "The lane has no provider account: its login is the file the CLI writes, written as the agent's user. Only a workspace its owner's alone through all it came from holds them: a project opened from its prebuild does, but not a prebuild's build, a copy of another person's snapshot, or one made before the release that keeps the mark.", + "endToEnd": [ + "go:internal/e2e.TestAPersonSignsInToTheAgentOnceForEveryWorkspaceOfTheirs" + ] + }, { "area": "Workspaces", "name": "The supervisor runs the agent for its owner while it is used: started, paired and listed over the owner's own session on a socket only root opens, and stopped once nobody has used it for half an hour and no chat is at work", @@ -565,12 +566,12 @@ }, { "area": "Workspaces", - "name": "The agent's chats listed on the workspace - titles, paths and times, never a message - reported by its supervisor only with the owner's consent", + "name": "The agent's chats listed on the workspace - titles, paths and times, never a message - reported by its supervisor", "state": "built", "proof": "rpc:spin.v1.WorkspaceService/ListAgentThreads", "note": "", "endToEnd": [ - "go:internal/e2e.TestTheAgentsThreadsAreListedOnlyWithTheOwnersConsent" + "go:internal/e2e.TestTheAgentsThreadsAreListed" ] }, { @@ -858,9 +859,9 @@ }, { "area": "Observability", - "name": "A workspace's journal and console are collected only with its owner's consent", + "name": "A workspace's journal and console are collected as the installation's policy says", "state": "built", - "proof": "cli:workspace logs-consent", + "proof": "cli:workspace logs", "note": "", "endToEnd": [ "go:cmd/cli.TestE2E_AWorkspacesConsoleIsKeptAndSearchable" diff --git a/src/data/figures.json b/src/data/figures.json index 556382b..5d872e9 100644 --- a/src/data/figures.json +++ b/src/data/figures.json @@ -1,6 +1,6 @@ { "datapath": { - "source": "https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/network/datapath", + "source": "https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/network/datapath", "width": 552, "words": [ "How a packet leaves a workspace", @@ -56,8 +56,8 @@ ] }, "egress-policy": { - "source": "https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/network/egress-policy", - "width": 854, + "source": "https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/network/egress-policy", + "width": 923, "words": [ "What the forward chain decides, in order", "a packet from a machine", @@ -66,16 +66,30 @@ "10/8 · 172.16/12 · 192.168/16 · 127/8", "169.254/16 · 100.64/10 · 224/4 · 240/4", "+ every address the node answers on", + "1a · ip dscp \u003cagent's mark\u003e", + "an agent's packet: only the egress proxy", + "stands in for what it may reach", + "no", + "dropped, and counted", + "match", + "1b · oifname wan0 ct state established,related", + "what the machine already had open", + "no", + "match", + "1c · ip saddr @held", + "a machine taken back from the last runner,", + "until its record says what it carries", + "no", + "accepted - and recorded in @observed", + "machine . destination, with a counter, 6 h", + "match", "2 · ip saddr @tag_\u003cname\u003e ip daddr \u003callowed\u003e", "what a tag permits", "no", - "dropped, and counted", "match", "3 · ip saddr @tag_\u003cname\u003e", "and nothing else, when the tag says so", "no", - "accepted - and recorded in @observed", - "machine . destination, with a counter, 6 h", "match", "4 · oifname wan0", "the default: open beyond the node", @@ -104,6 +118,8 @@ "2 and 3 are between them, so a tag cannot open the node and a", "tag that closes a machine is reached by what its own rules did", "not claim.", + "1c is after 1b, so a runner's restart cuts nothing a machine", + "had open, and before 4, which a machine in no tag set reaches.", "4 is open on purpose. There is no allowlist to write yet, so", "the accept records where it went instead - see @observed, and", "`SIGUSR1` to the runner." @@ -157,7 +173,7 @@ ] }, "isolation": { - "source": "https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/network/isolation", + "source": "https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/network/isolation", "width": 499, "words": [ "Same address, different segment", @@ -204,7 +220,7 @@ ] }, "traffic": { - "source": "https://github.com/spin-stack/spin/blob/2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9/docs/security/traffic", + "source": "https://github.com/spin-stack/spin/blob/3cb9bb55ff21e9b9ff669480dc9053aa9dee732a/docs/security/traffic", "width": 1889, "words": [ "Traffic: every arrow is a connection opened in its direction, and nothing else is let in", diff --git a/src/data/pricing.json b/src/data/pricing.json index bff5065..9779afd 100644 --- a/src/data/pricing.json +++ b/src/data/pricing.json @@ -1,6 +1,6 @@ { - "generated": "2026-11-05", - "published": "2026-11-04T21:03:05Z", + "generated": "2026-11-06", + "published": "2026-11-05T16:26:28Z", "source": "https://b0.p.awsstatic.com/pricing/2.0/meteredUnitMaps/ec2/USD/current/ec2-ondemand-without-sec-sel/\u003cregion\u003e/Linux/index.json", "machines": { "controlPlane": "t8i.medium", diff --git a/src/data/reference.json b/src/data/reference.json index a05ba8e..2de5a05 100644 --- a/src/data/reference.json +++ b/src/data/reference.json @@ -1,8 +1,8 @@ { "spin": { "installs": "v20261027.01", - "commit": "2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9", - "tag": "v20261104.01", + "commit": "3cb9bb55ff21e9b9ff669480dc9053aa9dee732a", + "tag": "v20261106.01", "machine": "v20261026.01" }, "terraform": { @@ -20,5 +20,5 @@ "endToEnd": 79, "gap": 6 }, - "openapiSha256": "7550d0c634c6ebaaffb877af8073dbca698aa2c3c0e9f096c7739454c32ca690" + "openapiSha256": "2c0df30bc095c02d4c0a21fa51cbd3c25606199c67eb7be74a62776c3abc1d64" } diff --git a/src/data/shots.json b/src/data/shots.json index 384b883..26c55fc 100644 --- a/src/data/shots.json +++ b/src/data/shots.json @@ -1,6 +1,6 @@ { - "release": "v20261104.01", - "commit": "2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9", + "release": "v20261106.01", + "commit": "3cb9bb55ff21e9b9ff669480dc9053aa9dee732a", "shots": [ { "name": "workspaces", diff --git a/versions.yaml b/versions.yaml index ed975cf..5d64fbc 100644 --- a/versions.yaml +++ b/versions.yaml @@ -7,8 +7,8 @@ - name: spin kind: git source: https://github.com/spin-stack/spin - version: v20261104.01 - pin: 2cfbcd74db9e1b599cc29f342d1d35ce1dbe1be9 + version: v20261106.01 + pin: 3cb9bb55ff21e9b9ff669480dc9053aa9dee732a track: github-release note: >- The release the site documents (D2: the newest, exactly). The daily sync moves it to the next